diff --git a/.github/cli-purge-fix.py b/.github/cli-purge-fix.py
new file mode 100644
index 000000000..857a90aff
--- /dev/null
+++ b/.github/cli-purge-fix.py
@@ -0,0 +1,9 @@
+from pathlib import Path
+p = Path('Compression.CLI/Program.cs')
+t = p.read_text()
+old = '''    var before = ops.List(File.OpenRead(archive.FullName), null).Count(e => !e.IsDirectory);'''
+new = '''    int before;\n    using (var source = File.OpenRead(archive.FullName))\n      before = ops.List(source, null).Count(e => !e.IsDirectory);'''
+if old not in t:
+    raise SystemExit('generated purge read handle anchor not found')
+p.write_text(t.replace(old, new, 1))
+Path('.github/cli-purge-fix.py').unlink()
diff --git a/.github/coverage-matrix.py b/.github/coverage-matrix.py
new file mode 100644
index 000000000..0b187dcfc
--- /dev/null
+++ b/.github/coverage-matrix.py
@@ -0,0 +1,94 @@
+from pathlib import Path
+import re
+
+
+def scan(root):
+    rows=[]
+    for path in sorted(Path(root).glob('**/*FormatDescriptor.cs')):
+        text=path.read_text(errors='ignore')
+        cm=re.search(r'public\s+(?:sealed\s+)?class\s+\w+FormatDescriptor\s*:\s*(.*?)\{',text,re.S)
+        mid=re.search(r'public\s+string\s+Id\s*=>\s*"([^"]+)"',text)
+        if not cm or not mid: continue
+        interfaces=set(re.findall(r'\bI[A-Za-z0-9_]+\b',cm.group(1)))
+        tunable='FormatOptionKind.Boolean' in text or re.search(r'AllowedValues\s*:\s*\[[^\]]*,',text,re.S)
+        optimize=('ILayoutOptimizable' in interfaces or
+                  ('IFormatOptionsSchema' in interfaces and tunable and
+                   ('IArchiveCreatable' in interfaces or 'IStreamFormatOperations' in interfaces)))
+        row={
+          'id':mid.group(1), 'ifaces':interfaces,
+          'defrag':'IArchiveDefragmentable' in interfaces,
+          'shrink':'IArchiveShrinkable' in interfaces,
+          'wipe':'IWipeEmpty' in interfaces,
+          'purge':'IArchivePurgeable' in interfaces or 'IArchiveModifiable' in interfaces,
+          'optimize':optimize,
+          'meta':'IFileInternalLayoutMap' in interfaces or 'IFileInternalChunkMover' in interfaces,
+        }
+        row['compact']=row['defrag'] or row['shrink'] or row['optimize']
+        rows.append(row)
+    return rows
+
+
+def mark(v): return '✅' if v else '—'
+
+def fs_section(rows):
+    lines=[
+      '## Filesystem descriptors', '',
+      'Generated from the descriptor capability interfaces in this tree. **Compact** is the composite '
+      'defrag → optimize → shrink action and is available when at least one of those primitives is executable. '
+      'A checkmark may represent a native in-place operation or a verified offline rebuild; mounted-driver R/W '
+      'is tracked separately by the filesystem-driver readiness model.', '',
+      '| Format | Optimize | Wipe / clean | Purge | Defrag | Shrink | Compact |',
+      '| --- | :---: | :---: | :---: | :---: | :---: | :---: |',
+    ]
+    for r in sorted(rows,key=lambda r:r['id'].lower()):
+        lines.append(f"| {r['id']} | {mark(r['optimize'])} | {mark(r['wipe'])} | {mark(r['purge'])} | {mark(r['defrag'])} | {mark(r['shrink'])} | {mark(r['compact'])} |")
+    return '\n'.join(lines)
+
+
+def archive_section(rows):
+    visible=[r for r in rows if any(r[k] for k in ('optimize','wipe','purge','defrag','shrink','compact','meta'))]
+    lines=[
+      '## Archive / stream descriptors with at least one operation', '',
+      'Archive **defrag** includes verified repack/relayout (including solid-stream regrouping where the format supports it). '
+      '**Optimize** includes layout tuning and finite compression/dictionary/solid-block parameter search; candidates only win '
+      'after round-trip verification.', '',
+      '| Format | Optimize | Wipe / clean | Purge | Defrag | Shrink | Compact | Meta reorder |',
+      '| --- | :---: | :---: | :---: | :---: | :---: | :---: | :---: |',
+    ]
+    for r in sorted(visible,key=lambda r:r['id'].lower()):
+        lines.append(f"| {r['id']} | {mark(r['optimize'])} | {mark(r['wipe'])} | {mark(r['purge'])} | {mark(r['defrag'])} | {mark(r['shrink'])} | {mark(r['compact'])} | {mark(r['meta'])} |")
+    return '\n'.join(lines)
+
+p=Path('docs/OPERATION_COVERAGE.md')
+t=p.read_text()
+# Canonical verb definitions and defaults.
+t=re.sub(r'\| Purge\s*\| `IArchiveModifiable\.Remove`-all / empty `Create`\s*\|[^\n]*\|',
+         '| Purge           | `IArchivePurgeable`                                  | Erase all live user data, leaving a valid empty container/image; system metadata may be recreated as required by the format. |',t)
+t=t.replace('`Remove(all)` is the **purge** verb.', '`IArchivePurgeable.Purge` is the **purge** verb; `IArchiveModifiable` inherits it because full modification includes removing all live user files.')
+t=t.replace('A filesystem descriptor therefore gains shrink / defrag / purge by simply declaring\nthe interface', 'A filesystem descriptor therefore gains shrink / defrag / purge by declaring\nthe corresponding interface')
+t=t.replace('> **`CanModify` is advertised when the format is a mutable container with a working modify\n> path.** It is withheld only from **read-only-by-design** formats (CramFS, SquashFS) and\n> **create-only** formats — even though a rebuild could synthesise a modified copy, those do\n> not present themselves as editable.',
+'''**`CanModify` means the public API can edit an existing instance and produce a verified valid result.**\nThe physical strategy may be in-place, copy-on-write, relayout/repack, or verified rebuild. Native OS mount\nimmutability (for example CramFS/SquashFS/EROFS) is not the same thing as offline image-editor capability.\nMounted-driver write readiness is tracked separately and remains fail-closed until its durability model is proven.''')
+t=t.replace('- **CramFS**, **SquashFS** — compressed *read-only* filesystems by design; not presented as editable.\n','')
+t=t.replace('- A handful of niche/append-shift formats (MSA per-track RLE; Wrapster/PFS0 header-at-start;\n  OVA manifest-over-all-members; MFS-1 bespoke catalog) keep the rebuild-backed verb without\n  advertising R/W.\n','- Formats whose correct edit necessarily rewrites headers, manifests, tracks, or whole images still advertise R/W when the verified rebuild is their supported existing-instance mutation strategy.\n')
+# Broaden optimize definition to match the runtime implementation.
+t=re.sub(r'\| Optimize\s*\| `ILayoutOptimizable`\s*\|[^\n]*\|',
+         '| Optimize        | `ILayoutOptimizable` / tunable `IFormatOptionsSchema` | Search executable layout/compression parameters and keep the smallest/best verified result. |',t)
+
+fs=scan('FileSystems')
+arc=scan('FileFormats')
+start=t.index('## Filesystem descriptors')
+na=t.index('## N/A notes',start)
+t=t[:start]+fs_section(fs)+'\n\n'+archive_section(arc)+'\n\n'+t[na:]
+
+# Replace stale totals with source-derived advertised counts so the document and interfaces cannot drift in this pass.
+allrows=fs+arc
+counts={k:sum(1 for r in allrows if r[k]) for k in ('defrag','wipe','purge','shrink','optimize','meta')}
+t=re.sub(r'\| Defragment\s*\| \d+ \|',f"| Defragment       | {counts['defrag']} |",t)
+t=re.sub(r'\| Wipe\s*\| \d+ \|',f"| Wipe             | {counts['wipe']} |",t)
+t=re.sub(r'\| Purge\s*\| \d+ \|',f"| Purge            | {counts['purge']} |",t)
+t=re.sub(r'\| Shrink\s*\| \d+\s*\|',f"| Shrink           | {counts['shrink']} |",t)
+t=re.sub(r'\| Optimize \(layout\)\| \d+\s*\|',f"| Optimize         | {counts['optimize']} |",t)
+t=re.sub(r'\| Metadata-reorder\s*\| \d+\s*\|',f"| Metadata-reorder | {counts['meta']} |",t)
+t=t.replace('(Counts are `GetArchiveOps(id) is IXxx` over the registered descriptors — i.e.\nwhat the UI/CLI actually gate on.', '(Counts above are regenerated from explicit descriptor capability interfaces in this tree. Runtime marker/flag consistency is enforced by CI; the UI/CLI gate on the same capability contracts.')
+p.write_text(t)
+Path('.github/coverage-matrix.py').unlink()
diff --git a/.github/merge-readiness.py b/.github/merge-readiness.py
new file mode 100644
index 000000000..66d81324f
--- /dev/null
+++ b/.github/merge-readiness.py
@@ -0,0 +1,66 @@
+from pathlib import Path
+
+
+def replace(path, old, new, count=1):
+    p = Path(path)
+    text = p.read_text()
+    if old not in text:
+        raise SystemExit(f'expected text not found in {path}: {old[:120]!r}')
+    p.write_text(text.replace(old, new, count))
+
+# ReFS: wire the already-implemented offline editor into the public descriptor.
+replace('FileSystems/FileSystem.Refs/RefsFormatDescriptor.cs',
+'''  IFormatDescriptor,\n  IArchiveFormatOperations,\n  IFilesystemExtentMap,''',
+'''  IFormatDescriptor,\n  IArchiveFormatOperations,\n  IArchiveModifiable,\n  IFilesystemExtentMap,''')
+replace('FileSystems/FileSystem.Refs/RefsFormatDescriptor.cs',
+'''    FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanTest |\n    FormatCapabilities.SupportsMultipleEntries;''',
+'''    FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanTest |\n    FormatCapabilities.CanModify | FormatCapabilities.SupportsMultipleEntries;''')
+replace('FileSystems/FileSystem.Refs/RefsFormatDescriptor.cs',
+'''  public string Description => "Microsoft ReFS 3.x volume image with native read-only driver projection, namespace/allocation parsing, and offline filesystem-metadata placement support.";''',
+'''  public string Description => "Microsoft ReFS 3.x volume image with native read-only driver projection, namespace/allocation parsing, offline existing-file replacement/removal, and filesystem-metadata placement support.";''')
+anchor = '''\n  private static List<ArchiveEntryInfo> ListDiagnosticSurface(Stream stream) {'''
+insert = '''\n  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)\n    => RefsOfflineModifier.Add(archive, inputs);\n\n  public void Remove(Stream archive, string[] entryNames)\n    => RefsOfflineModifier.Remove(archive, entryNames);\n'''
+replace('FileSystems/FileSystem.Refs/RefsFormatDescriptor.cs', anchor, insert + anchor)
+
+# Maintenance marker tests: purge is its own explicit capability.
+replace('Compression.Tests/Operations/MarkerInterfaceCoverageTests.cs',
+'''    ("purge/modify", typeof(IArchiveModifiable)),''',
+'''    ("purge", typeof(IArchivePurgeable)),\n    ("modify", typeof(IArchiveModifiable)),''')
+
+# Generic purge test must exercise the Purge contract, not approximate it with Remove(all).
+p = Path('Compression.Tests/Operations/GenericPurgeRoundTripTests.cs')
+t = p.read_text()
+t = t.replace('''/// Safety net for the broad rollout of the default <see cref="IArchiveModifiable"/>\n/// (verified extract → edit → re-create rebuild). For every filesystem descriptor\n/// using the DEFAULT Remove, this builds a small image, purges it (Remove every\n/// entry), and asserts the result is a valid, listable, empty container — the\n/// <em>purge</em> verb. The rebuild only commits a result that re-lists, so a writer\n/// limitation surfaces as a clean throw (original untouched) rather than corruption.''',
+'''/// Safety net for the explicit <see cref="IArchivePurgeable"/> capability. For every\n/// purgeable descriptor that can create a representative probe, this builds an image,\n/// invokes Purge, and asserts the user's live files are gone while the result remains\n/// listable. A descriptor that advertises purge must not silently fail or corrupt.''')
+t = t.replace('''  private static IEnumerable<string> ModifiableDefaultIds() =>\n    Compression.Tests.Support.CapabilityImplementers.RegisteredIdsExposing(typeof(IArchiveModifiable))\n      .Where(id => FormatRegistry.GetArchiveOps(id) is IArchiveCreatable\n                   && Enum.TryParse<FormatDetector.Format>(id, out _)\n                   && !Compression.Tests.Support.CapabilityImplementers.DeclaresOwn(id, "Remove", typeof(Stream), typeof(string[])));\n\n  [TestCaseSource(nameof(ModifiableDefaultIds))]''',
+'''  private static IEnumerable<string> PurgeableIds() =>\n    Compression.Tests.Support.CapabilityImplementers.RegisteredIdsExposing(typeof(IArchivePurgeable))\n      .Where(id => FormatRegistry.GetArchiveOps(id) is IArchiveCreatable\n                   && Enum.TryParse<FormatDetector.Format>(id, out _));\n\n  [TestCaseSource(nameof(PurgeableIds))]''')
+t = t.replace('''      var modifiable = (IArchiveModifiable)fmtOps;\n      try {\n        modifiable.Remove(ms, [.. before]);\n      } catch (NotSupportedException) {\n        Assert.Pass($"{formatId}: purge cleanly NotSupported (no corruption).");\n        return;\n      } catch (Exception ex) {\n        Assert.Ignore($"{formatId}: purge rebuild failed non-destructively ({ex.GetType().Name}).");\n        return;\n      }''',
+'''      var purgeable = (IArchivePurgeable)fmtOps;\n      Assert.DoesNotThrow(() => purgeable.Purge(ms),\n        $"{formatId}: advertises IArchivePurgeable but purge failed for its own representative image.");''')
+p.write_text(t)
+
+# Add a root-level purge verb to the CLI. It is deliberately destructive and requires --yes.
+program = Path('Compression.CLI/Program.cs')
+t = program.read_text()
+insert_after = '''replaceCmd.SetAction((ParseResult ctx) => {\n  var archive = ctx.GetValue(replaceArchiveArg)!;\n  var name = ctx.GetValue(replaceNameArg)!;\n  var file = ctx.GetValue(replaceFileArg)!;\n  if (!archive.Exists) { Console.Error.WriteLine($"File not found: {archive.FullName}"); return 1; }\n  if (!file.Exists) { Console.Error.WriteLine($"File not found: {file.FullName}"); return 1; }\n\n  var opts = new CompressionOptions {\n    Method = MethodSpec.Parse(ctx.GetValue(methodOpt)),\n    Level = ctx.GetValue(levelOpt),\n    Password = ctx.GetValue(passwordOpt),\n  };\n\n  Console.Write($"Replacing '{name}' in {archive.Name}...");\n  var sw = Stopwatch.StartNew();\n  ArchiveOperations.Replace(archive.FullName, name, file.FullName, opts);\n  sw.Stop();\n  Console.WriteLine($" done ({sw.ElapsedMilliseconds}ms)");\n  return 0;\n});\n'''
+purge_block = '''\n// ── purge ────────────────────────────────────────────────────────────\n\nvar purgeArchiveArg = new Argument<FileInfo>("archive") { Description = "Archive or filesystem image to empty" };\nvar purgeYesOpt = new Option<bool>("--yes", "-y") { Description = "Confirm destructive purge without prompting" };\nvar purgeCmd = new Command("purge", """\n  Remove all live user entries while leaving a valid empty container/image.\n  This is different from 'wipe': purge removes content; wipe preserves content\n  and sanitizes only unused/dead bytes. The format must advertise IArchivePurgeable.\n\n  Examples:\n    cwb purge disk.d64 --yes\n    cwb purge archive.zip --yes\n  """) { purgeArchiveArg, purgeYesOpt };\npurgeCmd.SetAction((ParseResult ctx) => {\n  var archive = ctx.GetValue(purgeArchiveArg)!;\n  if (!archive.Exists) { Console.Error.WriteLine($"File not found: {archive.FullName}"); return 1; }\n  if (!ctx.GetValue(purgeYesOpt)) {\n    Console.Error.WriteLine("Purge is destructive. Re-run with --yes to remove all live user entries.");\n    return 2;\n  }\n\n  try {\n    FormatRegistration.EnsureInitialized();\n    var formatId = FormatDetector.Detect(archive.FullName).ToString();\n    var ops = FormatRegistry.GetArchiveOps(formatId);\n    if (ops is not IArchivePurgeable purgeable) {\n      Console.Error.WriteLine($"Format {formatId} does not advertise purge support.");\n      return 1;\n    }\n\n    var before = ops.List(File.OpenRead(archive.FullName), null).Count(e => !e.IsDirectory);\n    Console.Write($"Purging {archive.Name} ({formatId}, {before} live file(s))...");\n    var sw = Stopwatch.StartNew();\n    using (var stream = File.Open(archive.FullName, FileMode.Open, FileAccess.ReadWrite, FileShare.None))\n      purgeable.Purge(stream);\n    sw.Stop();\n    using var verify = File.OpenRead(archive.FullName);\n    var after = ops.List(verify, null).Count(e => !e.IsDirectory);\n    Console.WriteLine($" done ({sw.ElapsedMilliseconds}ms; {before} -> {after} live file(s))");\n    return 0;\n  } catch (Exception ex) {\n    Console.Error.WriteLine($"Purge failed: {ex.Message}");\n    return 1;\n  }\n});\n'''
+if insert_after not in t:
+    raise SystemExit('replace command anchor not found in Program.cs')
+t = t.replace(insert_after, insert_after + purge_block, 1)
+t = t.replace('''    cwb wipe-empty disk.img                  Zero all unused space in image''',
+'''    cwb purge disk.img --yes                 Remove all live user entries\n    cwb wipe-empty disk.img                  Zero all unused space in image''', 1)
+t = t.replace('''  listCmd, extractCmd, createCmd, testCmd, addCmd, removeCmd, replaceCmd, infoCmd,''',
+'''  listCmd, extractCmd, createCmd, testCmd, addCmd, removeCmd, replaceCmd, purgeCmd, infoCmd,''', 1)
+program.write_text(t)
+
+# Correct stale operation-model prose without touching generated tables.
+coverage = Path('docs/OPERATION_COVERAGE.md')
+t = coverage.read_text()
+t = t.replace('''No archive descriptor currently implements a dedicated `IArchivePurgeable` interface; purge is represented by `IArchiveModifiable.Remove` over all live entries.''',
+'''Purge is an explicit `IArchivePurgeable` capability. `IArchiveModifiable` inherits it because removing all live user entries is a required subset of full modification; generic purge is staged and verified before commit.''')
+t = t.replace('''CramFS and SquashFS remain read-only/WORM because their on-disk formats are immutable by design.''',
+'''CramFS, SquashFS and EROFS remain read-only when mounted by their native operating-system drivers, but CompressionWorkbench exposes verified offline rebuild-backed modification for supported profiles. Mounted-driver R/W is a separate capability and remains fail-closed where the native format is immutable or crash-consistent mutation is not implemented.''')
+coverage.write_text(t)
+
+# Remove the one-shot machinery in the commit it creates.
+Path('.github/merge-readiness.py').unlink()
+Path('.github/workflows/merge-readiness-once.yml').unlink()
diff --git a/.github/modify-consistency.py b/.github/modify-consistency.py
new file mode 100644
index 000000000..45487557a
--- /dev/null
+++ b/.github/modify-consistency.py
@@ -0,0 +1,43 @@
+from pathlib import Path
+import re
+
+# Normalize descriptor flags to the established public contract:
+# IArchiveModifiable means an existing instance can be edited through the API,
+# regardless of whether the physical implementation patches in place or stages a
+# verified rebuild.
+for path in list(Path('FileSystems').glob('**/*FormatDescriptor.cs')) + list(Path('FileFormats').glob('**/*FormatDescriptor.cs')):
+    text = path.read_text(errors='ignore')
+    # Only touch classes that explicitly implement the capability.
+    head = text[:text.find('{', text.find('class ')) + 1] if 'class ' in text else ''
+    if 'IArchiveModifiable' not in head:
+        continue
+    m = re.search(r'public\s+FormatCapabilities\s+Capabilities\s*=>\s*(.*?);', text, re.S)
+    if not m:
+        continue
+    expr = m.group(1)
+    if 'FormatCapabilities.CanModify' in expr:
+        continue
+    replacement = m.group(0)[:-1].rstrip() + ' | FormatCapabilities.CanModify;'
+    text = text[:m.start()] + replacement + text[m.end():]
+    # Remove obsolete comments that equate rebuild-backed mutation with WORM.
+    text = re.sub(
+      r'\s*// WORM, not R/W: Add/Remove rebuild the whole image \(read-all -> re-create\),\n'
+      r'\s*// so the verb works via rebuild but nothing is modified in place\. CanModify\n'
+      r'\s*// must not be advertised\. See Compression\.Registry/FormatCapabilities\.cs\.\n',
+      '\n  // Existing-instance mutation may be implemented by a verified rebuild; that still satisfies CanModify.\n',
+      text,
+      count=1)
+    path.write_text(text)
+
+# Permanent runtime consistency test: no hidden modifier and no false CanModify flag.
+p = Path('Compression.Tests/Operations/MarkerInterfaceCoverageTests.cs')
+t = p.read_text()
+anchor = '''  [TestCaseSource(nameof(Markers))]\n  public void RegistryDrivenSourceIsSupersetOfReflection(Type marker) {'''
+method = '''  [Test]\n  public void CanModifyFlagAndRuntimeModifierStayInSync() {\n    Compression.Lib.FormatRegistration.EnsureInitialized();\n    var problems = new List<string>();\n    foreach (var descriptor in FormatRegistry.All) {\n      var ops = FormatRegistry.GetArchiveOps(descriptor.Id);\n      var flag = descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify);\n      var runtime = ops is IArchiveModifiable;\n      if (flag != runtime)\n        problems.Add($"{descriptor.Id}: CanModify={flag}, IArchiveModifiable={runtime}");\n    }\n    Assert.That(problems, Is.Empty,\n      "Existing-instance mutation capability drift:\\n  " + string.Join("\\n  ", problems));\n  }\n\n'''
+if method not in t:
+    if anchor not in t:
+        raise SystemExit('marker consistency insertion anchor not found')
+    t = t.replace(anchor, method + anchor, 1)
+p.write_text(t)
+
+Path('.github/modify-consistency.py').unlink()
diff --git a/.github/optimizer-wire.py b/.github/optimizer-wire.py
new file mode 100644
index 000000000..b8327922e
--- /dev/null
+++ b/.github/optimizer-wire.py
@@ -0,0 +1,12 @@
+from pathlib import Path
+
+p = Path('Compression.Lib/ArchiveOperations.cs')
+t = p.read_text()
+old = '''    // ── Unsupported: fall back to copy ───────────────────────────────\n    // Use temp+rename so a crash mid-copy doesn't leave a truncated target.\n    AtomicFileWriter.WriteAtomic(outputPath, outFs => {\n      using var inFs = File.OpenRead(inputPath);\n      inFs.CopyTo(outFs);\n    });\n    return (originalSize, originalSize, 0);'''
+new = '''    // ── Generic multi-entry optimizer ─────────────────────────────────\n    // Any creatable/listable container that publishes a finite tunable schema\n    // can participate. Every candidate is rebuilt and exact-name/data verified\n    // by ArchiveCompressionOptimizer/RebuildVerb before it can win.\n    FormatRegistration.EnsureInitialized();\n    var archiveOps = Compression.Registry.FormatRegistry.GetArchiveOps(format.ToString());\n    if (archiveOps is Compression.Registry.IArchiveCreatable creator && archiveOps is Compression.Registry.IFormatOptionsSchema schema\n        && schema.OptionsSchema.Any(option =>\n          option.Kind == Compression.Registry.FormatOptionKind.Boolean || option.AllowedValues is { Count: > 1 })) {\n      var optimized = ArchiveCompressionOptimizer.Optimize(\n        inputPath, outputPath, archiveOps, creator, schema);\n      return (optimized.OriginalSize, optimized.OptimizedSize, optimized.EntriesOptimized);\n    }\n\n    // ── No honest optimization surface: preserve the input byte-for-byte ───\n    // Use temp+rename so a crash mid-copy doesn't leave a truncated target.\n    AtomicFileWriter.WriteAtomic(outputPath, outFs => {\n      using var inFs = File.OpenRead(inputPath);\n      inFs.CopyTo(outFs);\n    });\n    return (originalSize, originalSize, 0);'''
+if old not in t:
+    raise SystemExit('ArchiveOperations optimize fallback anchor not found')
+p.write_text(t.replace(old, new, 1))
+
+# The helper exists only to transform this branch; never retain it in the PR.
+Path('.github/optimizer-wire.py').unlink()
diff --git a/.github/readme-capabilities.py b/.github/readme-capabilities.py
new file mode 100644
index 000000000..a99900605
--- /dev/null
+++ b/.github/readme-capabilities.py
@@ -0,0 +1,95 @@
+from pathlib import Path
+import re
+
+
+def patch_states():
+    p = Path('Hawkynt.FileFormats.FileSystems/README.md')
+    t = p.read_text()
+    replacements = {
+      '| [Apple DMG](https://en.wikipedia.org/wiki/Apple_Disk_Image) | WORM | Apple disk-image container |':
+        '| [Apple DMG](https://en.wikipedia.org/wiki/Apple_Disk_Image) | R/W | Apple disk-image container; verified rebuild-backed modification |',
+      '| [Expert Witness Format](https://en.wikipedia.org/wiki/EnCase#Expert_Witness_File_Format) | R | EWF/EnCase forensic images |':
+        '| [Expert Witness Format](https://en.wikipedia.org/wiki/EnCase#Expert_Witness_File_Format) | R/W ⚠️ | EWF/EnCase forensic images; logical `media.raw` mutation/repack profile |',
+      '| [UEFI Firmware Volume](https://en.wikipedia.org/wiki/UEFI) | R | Firmware volume / FFS-oriented inspection |':
+        '| [UEFI Firmware Volume](https://en.wikipedia.org/wiki/UEFI) | R/W ⚠️ | Fixed-size firmware-volume create/add/replace/remove profile |',
+      '| [Device Tree Blob](https://en.wikipedia.org/wiki/Devicetree) | R | Flattened Device Tree property traversal |':
+        '| [Device Tree Blob](https://en.wikipedia.org/wiki/Devicetree) | R/W | Flattened Device Tree hierarchy-preserving rebuild/edit |',
+      '| [ReFS](https://en.wikipedia.org/wiki/ReFS) | R ⚠️ | Header/boot-sector oriented subset |':
+        '| [ReFS](https://en.wikipedia.org/wiki/ReFS) | R/W ⚠️ | Native metadata read plus offline existing-file replace/remove and empty-directory removal; new-name insertion remains gated |',
+      '| [EROFS](https://en.wikipedia.org/wiki/EROFS) | WORM | Enhanced read-only filesystem images |':
+        '| [EROFS](https://en.wikipedia.org/wiki/EROFS) | R/W ⚠️ | Native-mounted read-only format; supported FLAT_PLAIN/FLAT_INLINE images are mutable offline by verified rebuild |',
+    }
+    for old, new in replacements.items():
+        if old in t:
+            t = t.replace(old, new, 1)
+    p.write_text(t)
+
+
+def descriptors(root):
+    rows = []
+    for path in sorted(Path(root).glob('**/*FormatDescriptor.cs')):
+        text = path.read_text(errors='ignore')
+        m = re.search(r'public\s+(?:sealed\s+)?class\s+\w+FormatDescriptor\s*:\s*(.*?)(?:\{|\n\s*public\s)', text, re.S)
+        if not m:
+            continue
+        decl = m.group(1)
+        mid = re.search(r'public\s+string\s+Id\s*=>\s*"([^"]+)"', text)
+        if not mid:
+            continue
+        id_ = mid.group(1)
+        interfaces = set(re.findall(r'\bI[A-Za-z0-9_]+\b', decl))
+        # The class declaration may span until a later member in unusual formatting;
+        # source-level interface tokens are still the authoritative advertised markers.
+        rows.append((id_, interfaces, text))
+    return rows
+
+
+def matrix(rows, archive=False):
+    out = [
+      '<!-- maintenance-capabilities:start -->',
+      '## Maintenance capability matrix',
+      '',
+      'A checkmark means the descriptor explicitly exposes the corresponding runtime capability. '
+      'Profile-specific limitations still apply and unsafe/unknown layouts must fail closed. '
+      'For immutable-on-mount filesystems, a checkmark may represent verified offline rebuild-backed maintenance.',
+      '',
+      '| Format | Optimize | Wipe / clean | Purge | Defrag |',
+      '| --- | :---: | :---: | :---: | :---: |',
+    ]
+    for id_, interfaces, text in sorted(rows, key=lambda r: r[0].lower()):
+        optimize = 'ILayoutOptimizable' in interfaces
+        if archive and 'IStreamFormatOperations' in interfaces and 'IFormatOptionsSchema' in interfaces:
+            optimize = True
+        wipe = 'IWipeEmpty' in interfaces
+        purge = 'IArchivePurgeable' in interfaces or 'IArchiveModifiable' in interfaces
+        defrag = 'IArchiveDefragmentable' in interfaces
+        mark = lambda v: '✅' if v else '—'
+        out.append(f'| `{id_}` | {mark(optimize)} | {mark(wipe)} | {mark(purge)} | {mark(defrag)} |')
+    out += [
+      '',
+      'The matrix is generated from descriptor interfaces during the merge-readiness audit; '
+      'do not add a checkmark without an executable capability and round-trip/fail-closed coverage.',
+      '<!-- maintenance-capabilities:end -->',
+    ]
+    return '\n'.join(out)
+
+
+def install_matrix(readme, rows, archive=False):
+    p = Path(readme)
+    t = p.read_text()
+    block = matrix(rows, archive)
+    pattern = re.compile(r'<!-- maintenance-capabilities:start -->.*?<!-- maintenance-capabilities:end -->', re.S)
+    if pattern.search(t):
+        t = pattern.sub(block, t, count=1)
+    else:
+        anchor = '\n## 🚀 Quick start\n'
+        if anchor not in t:
+            raise SystemExit(f'quick-start anchor not found in {readme}')
+        t = t.replace(anchor, '\n' + block + '\n' + anchor, 1)
+    p.write_text(t)
+
+
+patch_states()
+install_matrix('Hawkynt.FileFormats.FileSystems/README.md', descriptors('FileSystems'))
+install_matrix('Hawkynt.FileFormats.Archives/README.md', descriptors('FileFormats'), archive=True)
+Path('.github/readme-capabilities.py').unlink()
diff --git a/.github/workflows/branch-screenshots.yml b/.github/workflows/branch-screenshots.yml
new file mode 100644
index 000000000..63da9fca2
--- /dev/null
+++ b/.github/workflows/branch-screenshots.yml
@@ -0,0 +1,97 @@
+name: Branch screenshots
+
+on:
+  push:
+    branches-ignore:
+      - main
+      - master
+    paths-ignore:
+      - README.md
+      - docs/screenshots/**
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: branch-screenshots-${{ github.ref }}
+  cancel-in-progress: true
+
+# Match the repository's other workflows while GitHub finishes the Node 24
+# transition for JavaScript actions.
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
+jobs:
+  capture:
+    # The workflow commits refreshed images back to the branch. The actor guard
+    # is a second loop breaker in addition to the [skip ci] commit marker.
+    if: github.actor != 'github-actions[bot]'
+    runs-on: windows-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+          dotnet-quality: 'preview'
+
+      - name: Build screenshot host
+        # Documentation capture needs the normal build output, not the Release
+        # single-file packaging target which rewrites/removes that output tree.
+        run: dotnet build Compression.UI/Compression.UI.csproj --configuration Release --nologo -p:EnableSingleFileBundle=false
+
+      - name: Capture deterministic UI screenshots
+        shell: pwsh
+        run: |
+          Remove-Item docs/screenshots -Recurse -Force -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Force docs/screenshots | Out-Null
+
+          dotnet run --project Compression.UI/Compression.UI.csproj --configuration Release --no-build -p:EnableSingleFileBundle=false -- --screenshots docs/screenshots
+          if ($LASTEXITCODE -ne 0) {
+            $diagnostic = "docs/screenshots/screenshot-error.txt"
+            if (Test-Path $diagnostic) {
+              Write-Host "--- screenshot diagnostic ---"
+              Get-Content $diagnostic
+              Write-Host "--- end diagnostic ---"
+            }
+            throw "Compression.UI screenshot mode exited with $LASTEXITCODE"
+          }
+
+          $expected = @(
+            "archive-browser.png",
+            "analysis.png",
+            "maintenance.png"
+          )
+          foreach ($name in $expected) {
+            $path = Join-Path "docs/screenshots" $name
+            if (!(Test-Path $path)) { throw "Missing screenshot: $path" }
+            if ((Get-Item $path).Length -lt 1024) { throw "Screenshot is suspiciously small: $path" }
+          }
+
+      - name: Update README screenshot section
+        run: python .github/workflows/scripts/update-readme-screenshots.py
+
+      - name: Upload screenshot artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: branch-screenshots
+          path: docs/screenshots/*.png
+          retention-days: 14
+
+      - name: Commit refreshed screenshots
+        shell: bash
+        run: |
+          if [ -z "$(git status --porcelain -- README.md docs/screenshots)" ]; then
+            echo "Screenshots and README are already current."
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add README.md docs/screenshots
+          git commit -m "docs: refresh branch screenshots [skip ci]"
+          git push origin "HEAD:${GITHUB_REF_NAME}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8fdb8d11..d35ec4700 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,13 +8,6 @@ on:
   workflow_call: {}
   workflow_dispatch: {}
 
-# Pushing three times to a branch used to queue three full matrices and run all of them. A newer
-# pull-request run supersedes the older one; a push to main is not cancelled, because main wants a
-# recorded result for every commit rather than only for the newest.
-concurrency:
-  group: ci-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 # One run per pull request at a time. Pushing again while checks are running
 # supersedes them, and without this the old run keeps a runner busy: a handful
 # of quick force-pushes left a dozen doomed runs queued ahead of the one that
@@ -284,4 +277,4 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: coverage-report
-          path: ./coverage/report
+          path: ./coverage/report
\ No newline at end of file
diff --git a/.github/workflows/merge-readiness-once.yml b/.github/workflows/merge-readiness-once.yml
new file mode 100644
index 000000000..163018eb8
--- /dev/null
+++ b/.github/workflows/merge-readiness-once.yml
@@ -0,0 +1,49 @@
+name: Merge readiness one-shot
+
+on:
+  push:
+    branches:
+      - feat/filesystem-rw-gaps
+
+permissions:
+  contents: write
+
+concurrency:
+  group: merge-readiness-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: feat/filesystem-rw-gaps
+          fetch-depth: 0
+      - name: Apply merge-readiness fixes
+        run: |
+          python .github/merge-readiness.py
+          python .github/optimizer-wire.py
+          python .github/cli-purge-fix.py
+          python .github/modify-consistency.py
+          python .github/readme-capabilities.py
+          python .github/coverage-matrix.py
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+          dotnet-quality: preview
+      - name: Clone optional sibling dependency
+        run: git clone --depth 1 https://github.com/Hawkynt/PNGCrushCS.git ../PNGCrushCS || true
+      - name: Build tests
+        run: dotnet build Compression.Tests/Compression.Tests.csproj -c Release
+      - name: Run maintenance and driver safety tests
+        run: >-
+          dotnet test Compression.Tests/Compression.Tests.csproj -c Release --no-build
+          --filter "FullyQualifiedName~MarkerInterfaceCoverageTests|FullyQualifiedName~GenericPurgeRoundTripTests|FullyQualifiedName~FilesystemRwPromotionRoundTripTests|FullyQualifiedName~FilesystemDriver|FullyQualifiedName~Btrfs|FullyQualifiedName~Zfs"
+      - name: Commit generated fixes
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git commit -m "fix: complete mutable maintenance surfaces"
+          git push origin HEAD:feat/filesystem-rw-gaps
diff --git a/.github/workflows/scripts/update-readme-screenshots.py b/.github/workflows/scripts/update-readme-screenshots.py
new file mode 100644
index 000000000..e6d228543
--- /dev/null
+++ b/.github/workflows/scripts/update-readme-screenshots.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+from pathlib import Path
+
+START = "<!-- branch-screenshots:start -->"
+END = "<!-- branch-screenshots:end -->"
+ANCHOR = "\n## Vision\n"
+
+BLOCK = f"""{START}
+## UI snapshots
+
+These screenshots are generated from the current branch by the real WPF application on every non-main push. They are committed back to the branch so the README shows the UI that branch actually builds, rather than a manually curated image from some older revision.
+
+| Archive browser | Binary analysis | Maintenance |
+| :--: | :--: | :--: |
+| [![Archive browser](docs/screenshots/archive-browser.png)](docs/screenshots/archive-browser.png) | [![Binary analysis](docs/screenshots/analysis.png)](docs/screenshots/analysis.png) | [![Maintenance](docs/screenshots/maintenance.png)](docs/screenshots/maintenance.png) |
+
+{END}"""
+
+
+def update_readme(path: Path) -> bool:
+    text = path.read_text(encoding="utf-8")
+
+    start_count = text.count(START)
+    end_count = text.count(END)
+    if start_count != end_count or start_count > 1:
+        raise RuntimeError(
+            f"Malformed screenshot markers: {START}={start_count}, {END}={end_count}"
+        )
+
+    if start_count == 1:
+        start = text.index(START)
+        end = text.index(END, start) + len(END)
+        updated = text[:start] + BLOCK + text[end:]
+    else:
+        if ANCHOR not in text:
+            raise RuntimeError("README anchor '## Vision' was not found")
+        updated = text.replace(ANCHOR, f"\n{BLOCK}\n\n## Vision\n", 1)
+
+    if updated == text:
+        return False
+
+    path.write_text(updated, encoding="utf-8", newline="\n")
+    return True
+
+
+def main() -> None:
+    changed = update_readme(Path("README.md"))
+    print("README screenshot section updated." if changed else "README screenshot section already current.")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/Compression.CLI/Compression.CLI.csproj b/Compression.CLI/Compression.CLI.csproj
index b591550fc..9c1dd41d6 100644
--- a/Compression.CLI/Compression.CLI.csproj
+++ b/Compression.CLI/Compression.CLI.csproj
@@ -33,6 +33,7 @@
   <ItemGroup>
     <ProjectReference Include="..\Compression.Lib\Compression.Lib.csproj" />
     <ProjectReference Include="..\Compression.Analysis\Compression.Analysis.csproj" />
+    <ProjectReference Include="..\Compression.Mounting\Compression.Mounting.csproj" />
   </ItemGroup>
 
   <Import Project="..\build\SingleFileBundle.targets" />
diff --git a/Compression.Core/Layout/DefragPlannerExecutor.cs b/Compression.Core/Layout/DefragPlannerExecutor.cs
index 75908e66c..4c351d3d5 100644
--- a/Compression.Core/Layout/DefragPlannerExecutor.cs
+++ b/Compression.Core/Layout/DefragPlannerExecutor.cs
@@ -17,7 +17,8 @@ public static class DefragPlannerExecutor {
   /// calling <see cref="IFilesystemBlockMover.MoveExtent"/> and
   /// <see cref="IFilesystemBlockMover.UpdateAllocationAfterMove(Stream, string, long, long, long)"/> for each move.
   /// Emits a <see cref="DefragProgressEvent"/> per move so the UI can animate
-  /// read/write head positions in real time.
+  /// read/write head positions in real time. Cancellation is checked between
+  /// safe move units; already-completed in-place moves are intentionally not rolled back.
   /// </summary>
   public static void Execute(
     Stream archive,
@@ -28,6 +29,7 @@ public static void Execute(
     Action? reinitAfterMove = null,
     IFilesystemMetadataMover? metadataMover = null) {
 
+    options.CancellationToken.ThrowIfCancellationRequested();
     var metadataNames = metadataMover?.RelocatableMetadata ?? (IReadOnlySet<string>)new HashSet<string>();
     bool IsMetadata(string owner) => metadataNames.Contains(owner);
 
@@ -65,6 +67,10 @@ public static void Execute(
     using var staging = parks ? new DefragStagingBuffer(options.StagingMemoryBudgetBytes) : null;
 
     for (var i = 0; i < moves.Count; i++) {
+      // This is the native/in-place cancellation boundary. A previous move may
+      // already be durable; stopping here preserves validity rather than trying
+      // to reverse arbitrary filesystem pointer updates.
+      options.CancellationToken.ThrowIfCancellationRequested();
       var move = moves[i];
       var what = move.Staging switch {
         DefragStaging.Park => "Holding",
@@ -117,6 +123,7 @@ public static void Execute(
       reinitAfterMove?.Invoke();
     }
 
+    options.CancellationToken.ThrowIfCancellationRequested();
     if (relink != null) {
       var live = new HashSet<long>(relink.BlocksInUseAfterMoves);
       if (metadataNames.Count > 0) {
@@ -129,8 +136,10 @@ public static void Execute(
         }
       }
 
-      foreach (var (owner, oldBlocks, newBlocks) in relink.Owners())
+      foreach (var (owner, oldBlocks, newBlocks) in relink.Owners()) {
+        options.CancellationToken.ThrowIfCancellationRequested();
         mover.UpdateAllocationScattered(archive, owner, oldBlocks, newBlocks, live);
+      }
     }
   }
 
diff --git a/Compression.Core/README.md b/Compression.Core/README.md
index 977e66dfc..238b40c26 100644
--- a/Compression.Core/README.md
+++ b/Compression.Core/README.md
@@ -204,7 +204,7 @@ Use the concrete version you intend to consume; this document does not predict a
 
 <!-- API:BEGIN generated by Hawkynt/RepositoryTemplate/package-readme — edit the XML docs in source, not here -->
 
-Every public and protected member of all 537 types, generated from the built assembly and its XML documentation, is in [REFERENCE.md](https://github.com/Hawkynt/CompressionWorkbench/blob/main/Compression.Core/REFERENCE.md).
+Every public and protected member of all 573 types, generated from the built assembly and its XML documentation, is in [REFERENCE.md](https://github.com/Hawkynt/CompressionWorkbench/blob/main/Compression.Core/REFERENCE.md).
 
 <!-- API:END -->
 
diff --git a/Compression.Core/REFERENCE.md b/Compression.Core/REFERENCE.md
index 6db8bbfff..510b2640a 100644
--- a/Compression.Core/REFERENCE.md
+++ b/Compression.Core/REFERENCE.md
@@ -5391,7 +5391,7 @@ Shared execution loop for planner-driven defragmentation. Runs an ordered list o
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Execute` | `static void Execute(Stream archive, DefragOptions options, IFilesystemBlockMover mover, IReadOnlyList<ClusterMove> moves, long imageSize, Action reinitAfterMove = null, IFilesystemMetadataMover metadataMover = null)` | Executes the supplied `moves` against `archive`, calling `MoveExtent` and `UpdateAllocationAfterMove` for each move. Emits a `DefragProgressEvent` per move so the UI can animate read/write head positions in real time. |
+| `Execute` | `static void Execute(Stream archive, DefragOptions options, IFilesystemBlockMover mover, IReadOnlyList<ClusterMove> moves, long imageSize, Action reinitAfterMove = null, IFilesystemMetadataMover metadataMover = null)` | Executes the supplied `moves` against `archive`, calling `MoveExtent` and `UpdateAllocationAfterMove` for each move. Emits a `DefragProgressEvent` per move so the UI can animate read/write head positions in real time. Cancellation is checked between safe move units; already-completed in-place moves are intentionally not rolled back. |
 
 #### `DefragStaging`
 
@@ -6068,7 +6068,7 @@ Run-Length Encoding (RLE) transform. Encodes runs of identical bytes as (count,
 
 ### Namespace `Compression.Registry`
 
-[`AlgorithmFamily`](#algorithmfamily) · [`ArchiveEntryInfo`](#archiveentryinfo) · [`ArchiveInputInfo`](#archiveinputinfo) · [`ArchiveShrinker`](#archiveshrinker) · [`AudioPseudoArchive`](#audiopseudoarchive) · [`AudioPseudoArchive.Entry`](#audiopseudoarchiveentry) · [`BuildingBlockRegistry`](#buildingblockregistry) · [`CompoundTarDescriptor`](#compoundtardescriptor) · [`DefragBlockClass`](#defragblockclass) · [`DefragBlockInfo`](#defragblockinfo) · [`DefragBlockKind`](#defragblockkind) · [`DefragContentGuard`](#defragcontentguard) · [`DefragMode`](#defragmode) · [`DefragOptions`](#defragoptions) · [`DefragProgressEvent`](#defragprogressevent) · [`DefragRebuilder`](#defragrebuilder) · [`EntropyDetector`](#entropydetector) · [`FatDirStamp`](#fatdirstamp) · [`FilesystemSchemaPresets`](#filesystemschemapresets) · [`FormatCapabilities`](#formatcapabilities) · [`FormatCategory`](#formatcategory) · [`FormatCreateOptions`](#formatcreateoptions) · [`FormatHealth`](#formathealth) · [`FormatHelpers`](#formathelpers) · [`FormatMethodInfo`](#formatmethodinfo) · [`FormatOptionDescriptor`](#formatoptiondescriptor) · [`FormatOptionKind`](#formatoptionkind) · [`FormatRegistry`](#formatregistry) · [`IArchiveCreatable`](#iarchivecreatable) · [`IArchiveDefragmentable`](#iarchivedefragmentable) · [`IArchiveFormatOperations`](#iarchiveformatoperations) · [`IArchiveInMemoryExtract`](#iarchiveinmemoryextract) · [`IArchiveLayoutMap`](#iarchivelayoutmap) · [`IArchiveModifiable`](#iarchivemodifiable) · [`IArchiveShrinkable`](#iarchiveshrinkable) · [`IArchiveWriteConstraints`](#iarchivewriteconstraints) · [`IAsyncArchiveOperations`](#iasyncarchiveoperations) · [`IBuildingBlock`](#ibuildingblock) · [`IFileInternalChunkMover`](#ifileinternalchunkmover) · [`IFileInternalLayoutMap`](#ifileinternallayoutmap) · [`IFilesystemBlockMover`](#ifilesystemblockmover) · [`IFilesystemExtentMap`](#ifilesystemextentmap) · [`IFilesystemMetadataMover`](#ifilesystemmetadatamover) · [`IFormatDescriptor`](#iformatdescriptor) · [`IFormatOptionsSchema`](#iformatoptionsschema) · [`IFormatValidator`](#iformatvalidator) · [`ILayoutOptimizable`](#ilayoutoptimizable) · [`IPartitionEditable`](#ipartitioneditable) · [`IStreamFormatOperations`](#istreamformatoperations) · [`IWipeEmpty`](#iwipeempty) · [`InnerFsDetector`](#innerfsdetector) · [`IssueSeverity`](#issueseverity) · [`LayoutAnalysis`](#layoutanalysis) · [`LayoutPatch`](#layoutpatch) · [`LayoutProfile`](#layoutprofile) · [`LayoutRebuildOptions`](#layoutrebuildoptions) · [`LayoutReclaim`](#layoutreclaim) · [`MagicSignature`](#magicsignature) · [`MediaProfile`](#mediaprofile) · [`MediaProfileLookup`](#mediaprofilelookup) · [`MetadataPlacementProfile`](#metadataplacementprofile) · [`MetadataPlacementRule`](#metadataplacementrule) · [`MetadataZone`](#metadatazone) · [`MethodNameParser`](#methodnameparser) · [`ModifyRebuilder`](#modifyrebuilder) · [`PlacementZone`](#placementzone) · [`RebuildVerb`](#rebuildverb) · [`SymlinkResolver`](#symlinkresolver) · [`UnusedSpaceWiper`](#unusedspacewiper) · [`ValidationIssue`](#validationissue) · [`ValidationLevel`](#validationlevel) · [`ValidationResult`](#validationresult)
+[`AlgorithmFamily`](#algorithmfamily) · [`ArchiveEntryInfo`](#archiveentryinfo) · [`ArchiveInputInfo`](#archiveinputinfo) · [`ArchiveShrinker`](#archiveshrinker) · [`AudioPseudoArchive`](#audiopseudoarchive) · [`AudioPseudoArchive.Entry`](#audiopseudoarchiveentry) · [`BlockDeviceGeometry`](#blockdevicegeometry) · [`BlockDeviceStream`](#blockdevicestream) · [`BuildingBlockRegistry`](#buildingblockregistry) · [`CompoundTarDescriptor`](#compoundtardescriptor) · [`DefragBlockClass`](#defragblockclass) · [`DefragBlockInfo`](#defragblockinfo) · [`DefragBlockKind`](#defragblockkind) · [`DefragContentGuard`](#defragcontentguard) · [`DefragMode`](#defragmode) · [`DefragOptions`](#defragoptions) · [`DefragProgressEvent`](#defragprogressevent) · [`DefragRebuilder`](#defragrebuilder) · [`EntropyDetector`](#entropydetector) · [`FatDirStamp`](#fatdirstamp) · [`FilesystemDirectoryEntry`](#filesystemdirectoryentry) · [`FilesystemDriverBindingKind`](#filesystemdriverbindingkind) · [`FilesystemDriverCapabilities`](#filesystemdrivercapabilities) · [`FilesystemDriverCoverage`](#filesystemdrivercoverage) · [`FilesystemDriverDerivation`](#filesystemdriverderivation) · [`FilesystemDriverProfile`](#filesystemdriverprofile) · [`FilesystemDriverReadinessLayer`](#filesystemdriverreadinesslayer) · [`FilesystemDriverReadinessReport`](#filesystemdriverreadinessreport) · [`FilesystemDriverTarget`](#filesystemdrivertarget) · [`FilesystemMetadataPatch`](#filesystemmetadatapatch) · [`FilesystemMutationModel`](#filesystemmutationmodel) · [`FilesystemNodeId`](#filesystemnodeid) · [`FilesystemNodeInfo`](#filesystemnodeinfo) · [`FilesystemNodeKind`](#filesystemnodekind) · [`FilesystemOpenOptions`](#filesystemopenoptions) · [`FilesystemSchemaPresets`](#filesystemschemapresets) · [`FilesystemSnapshotDirectoryEntry`](#filesystemsnapshotdirectoryentry) · [`FilesystemSnapshotNode`](#filesystemsnapshotnode) · [`FormatCapabilities`](#formatcapabilities) · [`FormatCategory`](#formatcategory) · [`FormatCreateOptions`](#formatcreateoptions) · [`FormatHealth`](#formathealth) · [`FormatHelpers`](#formathelpers) · [`FormatMethodInfo`](#formatmethodinfo) · [`FormatOptionDescriptor`](#formatoptiondescriptor) · [`FormatOptionKind`](#formatoptionkind) · [`FormatRegistry`](#formatregistry) · [`IArchiveCreatable`](#iarchivecreatable) · [`IArchiveDefragmentable`](#iarchivedefragmentable) · [`IArchiveFormatOperations`](#iarchiveformatoperations) · [`IArchiveInMemoryExtract`](#iarchiveinmemoryextract) · [`IArchiveLayoutMap`](#iarchivelayoutmap) · [`IArchiveModifiable`](#iarchivemodifiable) · [`IArchivePurgeable`](#iarchivepurgeable) · [`IArchiveShrinkable`](#iarchiveshrinkable) · [`IArchiveWriteConstraints`](#iarchivewriteconstraints) · [`IAsyncArchiveOperations`](#iasyncarchiveoperations) · [`IBlockDeviceFilesystemDriverProvider`](#iblockdevicefilesystemdriverprovider) · [`IBlockDeviceProvider`](#iblockdeviceprovider) · [`IBuildingBlock`](#ibuildingblock) · [`IFileInternalChunkMover`](#ifileinternalchunkmover) · [`IFileInternalLayoutMap`](#ifileinternallayoutmap) · [`IFilesystemBlockMover`](#ifilesystemblockmover) · [`IFilesystemDriverAdapter`](#ifilesystemdriveradapter) · [`IFilesystemDriverProvider`](#ifilesystemdriverprovider) · [`IFilesystemDriverReadinessProvider`](#ifilesystemdriverreadinessprovider) · [`IFilesystemExtentMap`](#ifilesystemextentmap) · [`IFilesystemFileHandle`](#ifilesystemfilehandle) · [`IFilesystemMetadataMover`](#ifilesystemmetadatamover) · [`IFilesystemSession`](#ifilesystemsession) · [`IFilesystemTransaction`](#ifilesystemtransaction) · [`IFormatDescriptor`](#iformatdescriptor) · [`IFormatOptionsSchema`](#iformatoptionsschema) · [`IFormatValidator`](#iformatvalidator) · [`ILayoutOptimizable`](#ilayoutoptimizable) · [`IPartitionEditable`](#ipartitioneditable) · [`IRandomAccessBlockDevice`](#irandomaccessblockdevice) · [`IRandomAccessBlockDeviceProvider`](#irandomaccessblockdeviceprovider) · [`IRawTrackDevice`](#irawtrackdevice) · [`IRawTrackDeviceProvider`](#irawtrackdeviceprovider) · [`IStreamFormatOperations`](#istreamformatoperations) · [`IWipeEmpty`](#iwipeempty) · [`InnerFsDetector`](#innerfsdetector) · [`IssueSeverity`](#issueseverity) · [`LayoutAnalysis`](#layoutanalysis) · [`LayoutPatch`](#layoutpatch) · [`LayoutProfile`](#layoutprofile) · [`LayoutRebuildOptions`](#layoutrebuildoptions) · [`LayoutReclaim`](#layoutreclaim) · [`MagicSignature`](#magicsignature) · [`MediaProfile`](#mediaprofile) · [`MediaProfileLookup`](#mediaprofilelookup) · [`MetadataPlacementProfile`](#metadataplacementprofile) · [`MetadataPlacementRule`](#metadataplacementrule) · [`MetadataZone`](#metadatazone) · [`MethodNameParser`](#methodnameparser) · [`ModifyRebuilder`](#modifyrebuilder) · [`PlacementZone`](#placementzone) · [`RawTrackInfo`](#rawtrackinfo) · [`ReadOnlyFilesystemSnapshotSession`](#readonlyfilesystemsnapshotsession) · [`RebuildVerb`](#rebuildverb) · [`SpoolingReadOnlyFileHandle`](#spoolingreadonlyfilehandle) · [`StreamBlockDevice`](#streamblockdevice) · [`SymlinkResolver`](#symlinkresolver) · [`UnusedSpaceWiper`](#unusedspacewiper) · [`ValidationIssue`](#validationissue) · [`ValidationLevel`](#validationlevel) · [`ValidationResult`](#validationresult)
 
 #### `AlgorithmFamily`
 
@@ -6160,6 +6160,46 @@ One surfaced pseudo-archive entry with its display `Kind` and codec `Method`. Th
 | `Lazy` | `static Entry Lazy(string name, string kind, Func<byte[]> factory, long declaredSize, string method = "stored")` | Builds a lazy entry: `factory` produces the payload only when the entry is extracted, and `declaredSize` is the exact byte count the factory will yield (used for listing without invoking the factory). The produced bytes are cached on first materialisation so a second extraction reuses them. |
 | `Materialize` | `byte[] Materialize()` | Returns the payload, invoking and caching the factory on first access for a lazy entry. |
 
+#### `BlockDeviceGeometry`
+
+Geometry of a sector/block-addressable device exposed beneath a filesystem. Container formats such as VHD/QCOW2/EWF should eventually implement this layer; FAT/ext/ReFS drivers then consume block devices rather than knowing how their outer container stores bytes.
+
+Implements `IEquatable<BlockDeviceGeometry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `BlockDeviceGeometry` | `BlockDeviceGeometry(int LogicalBlockSize, long BlockCount, int PhysicalBlockSize = 0, bool SupportsTrim = false)` | Geometry of a sector/block-addressable device exposed beneath a filesystem. Container formats such as VHD/QCOW2/EWF should eventually implement this layer; FAT/ext/ReFS drivers then consume block devices rather than knowing how their outer container stores bytes. |
+| `BlockCount` | `long BlockCount { get; init; }` |  |
+| `Length` | `long Length { get; }` |  |
+| `LogicalBlockSize` | `int LogicalBlockSize { get; init; }` |  |
+| `PhysicalBlockSize` | `int PhysicalBlockSize { get; init; }` |  |
+| `SupportsTrim` | `bool SupportsTrim { get; init; }` |  |
+
+#### `BlockDeviceStream`
+
+Seekable byte-stream view over a block device. Legacy filesystem parsers can therefore run on VHD/QCOW2/GCR-backed logical disks before they are rewritten to issue block requests directly. Unaligned writes use read-modify-write of only the touched edge blocks; unrelated blocks are never rewritten.
+
+Inherits `Stream`. Implements `IAsyncDisposable`, `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `BlockDeviceStream` | `BlockDeviceStream(IRandomAccessBlockDevice device, bool leaveOpen = true)` |  |
+| `CanRead` | `override bool CanRead { get; }` |  |
+| `CanSeek` | `override bool CanSeek { get; }` |  |
+| `CanWrite` | `override bool CanWrite { get; }` |  |
+| `Length` | `override long Length { get; }` |  |
+| `Position` | `override long Position { get; set; }` |  |
+| `Dispose` | `protected override void Dispose(bool disposing)` |  |
+| `Flush` | `override void Flush()` |  |
+| `ReadByte` | `override int ReadByte()` |  |
+| `Read` | `override int Read(Span<byte> buffer)` |  |
+| `Read` | `override int Read(byte[] buffer, int offset, int count)` |  |
+| `Seek` | `override long Seek(long offset, SeekOrigin origin)` |  |
+| `SetLength` | `override void SetLength(long value)` |  |
+| `WriteByte` | `override void WriteByte(byte value)` |  |
+| `Write` | `override void Write(ReadOnlySpan<byte> buffer)` |  |
+| `Write` | `override void Write(byte[] buffer, int offset, int count)` |  |
+
 #### `BuildingBlockRegistry`
 
 Central registry for compression building blocks (algorithm primitives). Populated at startup via source-generated code, similar to `FormatRegistry`.
@@ -6198,25 +6238,25 @@ Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IFormatDescriptor`,
 
 #### `DefragBlockClass`
 
-Heuristic classification of a file's "thermal" zone based on its modification time. Drives layout placement: hot at start, normal in the middle, frozen near the end. Used by the live-progress block map for tile coloring.
+Heuristic classification used for the maintenance block-map colors. Filesystem defraggers commonly map this to hot/cold placement; archive rebuilds may map it to storage/compression classes so a staged target remains visually informative.
 
 | Value | Numeric | Summary |
 | --- | --- | --- |
-| `Hot` | `0` | File modified recently (top quartile) — placed near start. |
-| `Normal` | `1` | File modified normally — placed in the middle. |
-| `Cold` | `2` | File modified a while ago — placed near end. |
-| `Frozen` | `3` | File hasn't been touched in a long time (bottom quartile) — placed at end. |
-| `Directory` | `4` | Directory metadata (folder contents, B-tree dir node, etc.) — rendered gold to make placement visible. |
+| `Hot` | `0` | Hot / heavy-processing class. |
+| `Normal` | `1` | Normal class. |
+| `Cold` | `2` | Cold / alternative-processing class. |
+| `Frozen` | `3` | Frozen / stored-verbatim class. |
+| `Directory` | `4` | Directory or structural metadata class. |
 
 #### `DefragBlockInfo`
 
-One contiguous region of an image's address space, as seen by the live-progress block map.
+One contiguous region in the address-space currently visualized by the maintenance block map.
 
 Implements `IEquatable<DefragBlockInfo>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `DefragBlockInfo` | `DefragBlockInfo(long Offset, long Length, DefragBlockKind Kind, string FileName = null, DefragBlockClass? Classification = null)` | One contiguous region of an image's address space, as seen by the live-progress block map. |
+| `DefragBlockInfo` | `DefragBlockInfo(long Offset, long Length, DefragBlockKind Kind, string FileName = null, DefragBlockClass? Classification = null)` | One contiguous region in the address-space currently visualized by the maintenance block map. |
 | `Classification` | `DefragBlockClass? Classification { get; init; }` |  |
 | `FileName` | `string FileName { get; init; }` |  |
 | `Kind` | `DefragBlockKind Kind { get; init; }` |  |
@@ -6225,15 +6265,15 @@ Implements `IEquatable<DefragBlockInfo>`.
 
 #### `DefragBlockKind`
 
-What kind of bytes a contiguous region holds. Used by the live-progress block map to color-code regions as defrag proceeds.
+What kind of bytes a contiguous region holds. Used by the live-progress block map to color-code regions as maintenance proceeds.
 
 | Value | Numeric | Summary |
 | --- | --- | --- |
 | `Free` | `0` | Free space — not allocated to any file. |
 | `Used` | `1` | Allocated to a file (see `FileName`). |
 | `Bad` | `2` | Marked bad / quarantined (FAT-style "BAD" cluster, or post-fsck flag). |
-| `MetadataReserved` | `3` | Reserved for filesystem metadata (boot sectors, superblock, MFT, FAT, bitmap, root directory). |
-| `InProgress` | `4` | Currently being read or written by the in-progress defrag operation. |
+| `MetadataReserved` | `3` | Reserved for filesystem/container metadata. |
+| `InProgress` | `4` | Currently being read, moved, compressed, grouped, or written. |
 
 #### `DefragContentGuard`
 
@@ -6264,6 +6304,7 @@ Implements `IEquatable<DefragOptions>`.
 | --- | --- | --- |
 | `DefragOptions` | `DefragOptions()` |  |
 | `Alignment` | `long Alignment { get; init; }` | Round each target offset up to this byte alignment (1 for byte-tight, 2048 for ISO 9660 sectors, 512 for FAT12/16, …). Default: 1. |
+| `CancellationToken` | `CancellationToken CancellationToken { get; init; }` | Cooperative cancellation for long maintenance operations. Generic staged rebuilds honour it while reading and writing and never commit a cancelled target. Native in-place movers may honour it at their next safe move boundary. |
 | `HoleAt` | `long HoleAt { get; init; }` | Byte offset where the carved hole should start. -1 (default) = auto-pick (carve at the end, immediately after the last live extent). Ignored except in `CarveHole`. |
 | `HoleSize` | `long HoleSize { get; init; }` | Size in bytes of the hole to carve. Required for `CarveHole`; ignored otherwise. |
 | `ImageEnd` | `long ImageEnd { get; init; }` | Byte offset just past the last sector available for live data. -1 = auto-detect from the image's physical size. Required for `ConsolidateAtEnd` — must be set explicitly or auto-detected. |
@@ -6272,27 +6313,27 @@ Implements `IEquatable<DefragOptions>`.
 | `MetadataPlacement` | `MetadataPlacementProfile MetadataPlacement { get; init; }` | Optional metadata placement profile for file-internal optimizers. When non-null, optimizers that support `IFileInternalChunkMover` use these rules to decide where metadata chunks land relative to the primary data payload. When null, each optimizer uses its format-specific default placement. |
 | `MetadataZonePlacement` | `MetadataZone MetadataZonePlacement { get; init; }` | Controls where filesystem metadata and directory extents are placed during defragmentation. Default: `Unchanged` (metadata stays where it is). Only affects planner-driven defragmentation of filesystem images; ignored for archive optimization and file-internal layout. |
 | `Mode` | `DefragMode Mode { get; init; }` | Defragmentation strategy. Default: `ConsolidateAtStart`. |
-| `OnProgress` | `Action<DefragProgressEvent> OnProgress { get; init; }` | Optional progress callback. When non-null, the defragmenter emits at least three events: a "scanning" event with the pre-defrag block map, periodic "writing" events with read/write offsets during the rebuild, and a "complete" event with the post-defrag block map. UI consumers can render a live tile chart from these events. |
+| `OnProgress` | `Action<DefragProgressEvent> OnProgress { get; init; }` | Optional progress callback. When non-null, the defragmenter emits snapshots and incremental read/write-head updates that can drive the maintenance block map. Staged archive rebuilds use the same contract as native block movers. |
 | `Origin` | `long Origin { get; init; }` | Byte offset of the first sector available for live data (e.g. 16 * 2048 for ISO 9660 to leave the volume descriptor space alone, 0 for raw FAT). Default: 0. |
 | `Profile` | `LayoutProfile Profile { get; init; }` | Layout profile for planner-driven defragmentation. Controls whether the defragmenter performs full zone-based rearrangement (`Performance`) or per-file consolidation only (`Quick`). Default: `Performance`. |
 | `StagingMemoryBudgetBytes` | `long StagingMemoryBudgetBytes { get; set; }` | Bytes a defragmentation may hold in memory while rearranging a volume that has nowhere of its own to park a run. |
 
 #### `DefragProgressEvent`
 
-Snapshot of an image's block layout at a moment in time. Emitted by `Defragment` implementations through DefragOptions.OnProgress at scan start, periodically during writes, and at completion.
+Snapshot emitted by defrag/re-layout/rebuild maintenance operations. Native in-place movers normally report one physical image address-space. Transactional WORM/archive rebuilds may report the source read head and staged target write head in their respective byte-spaces, projected onto the same chart. In that mode the two head offsets are progress visualization and do not assert that identical numerical offsets refer to the same physical bytes.
 
 Implements `IEquatable<DefragProgressEvent>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `DefragProgressEvent` | `DefragProgressEvent(string Phase, double Fraction, long CurrentReadOffset, long CurrentWriteOffset, long ImageSize, IReadOnlyList<DefragBlockInfo> BlockMap, string Status = null)` | Snapshot of an image's block layout at a moment in time. Emitted by `Defragment` implementations through DefragOptions.OnProgress at scan start, periodically during writes, and at completion. |
-| `BlockMap` | `IReadOnlyList<DefragBlockInfo> BlockMap { get; init; }` | Block-map snapshot, present at scan start + completion. Null during incremental updates. |
-| `CurrentReadOffset` | `long CurrentReadOffset { get; init; }` | Byte offset currently being read; -1 if not reading. |
-| `CurrentWriteOffset` | `long CurrentWriteOffset { get; init; }` | Byte offset currently being written; -1 if not writing. |
+| `DefragProgressEvent` | `DefragProgressEvent(string Phase, double Fraction, long CurrentReadOffset, long CurrentWriteOffset, long ImageSize, IReadOnlyList<DefragBlockInfo> BlockMap, string Status = null)` | Snapshot emitted by defrag/re-layout/rebuild maintenance operations. Native in-place movers normally report one physical image address-space. Transactional WORM/archive rebuilds may report the source read head and staged target write head in their respective byte-spaces, projected onto the same chart. In that mode the two head offsets are progress visualization and do not assert that identical numerical offsets refer to the same physical bytes. |
+| `BlockMap` | `IReadOnlyList<DefragBlockInfo> BlockMap { get; init; }` | Optional block-map snapshot. Null incremental events retain the previous map and only move heads/progress, keeping redraw cost low on large archives. |
+| `CurrentReadOffset` | `long CurrentReadOffset { get; init; }` | Current source/read offset; -1 when not reading. |
+| `CurrentWriteOffset` | `long CurrentWriteOffset { get; init; }` | Current destination/write offset; -1 when not writing. |
 | `Fraction` | `double Fraction { get; init; }` | 0..1 fraction of work done. -1 = indeterminate. |
-| `ImageSize` | `long ImageSize { get; init; }` | Total image size in bytes (helpful for tile binning). |
-| `Phase` | `string Phase { get; init; }` | Progress phase identifier ("scanning" / "writing" / "complete" / "error"). |
-| `Status` | `string Status { get; init; }` | Optional human-readable status (e.g. "moving extent 23 of 87"). |
+| `ImageSize` | `long ImageSize { get; init; }` | Address-space size used for visualization/binning. For staged rebuilds this is a display scale large enough to project the source and target progress. |
+| `Phase` | `string Phase { get; init; }` | Progress phase identifier. Common values are `scanning`, `reading`, `writing`, `verifying`, `staged`, `committing`, `complete`, and `error`. |
+| `Status` | `string Status { get; init; }` | Optional human-readable phase/status text. |
 
 #### `DefragRebuilder`
 
@@ -6322,6 +6363,226 @@ Small helpers for writing FAT directory metadata (creation/modification timestam
 | `Parse` | `static DateTime Parse(string iso)` | Parses an ISO-8601 date/time string for a create-option; returns `default(DateTime)` (treated as "unset") when blank or unparsable. |
 | `WriteVolumeLabel` | `static void WriteVolumeLabel(byte[] img, int entryOffset, string label)` | Writes an 11-byte volume-label directory entry (attribute 0x08, no cluster, zero size) at `entryOffset`. The label is upper-cased and space-padded/truncated to 11 bytes, matching the FAT short-name field. |
 
+#### `FilesystemDirectoryEntry`
+
+Implements `IEquatable<FilesystemDirectoryEntry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemDirectoryEntry` | `FilesystemDirectoryEntry(string Name, FilesystemNodeId NodeId, FilesystemNodeKind Kind)` |  |
+| `Kind` | `FilesystemNodeKind Kind { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `NodeId` | `FilesystemNodeId NodeId { get; init; }` |  |
+
+#### `FilesystemDriverBindingKind`
+
+Structural binding used to reach the common filesystem-driver contract. This deliberately says nothing about the exact image profile: probing an image can still refuse a damaged/unsupported feature set.
+
+| Value | Numeric | Summary |
+| --- | --- | --- |
+| `None` | `0` |  |
+| `ArchiveProjection` | `1` |  |
+| `SidecarNative` | `2` |  |
+| `DescriptorNative` | `3` |  |
+
+#### `FilesystemDriverCapabilities`
+
+| Value | Numeric | Summary |
+| --- | --- | --- |
+| `None` | `0` |  |
+| `EnumerateDirectories` | `1` |  |
+| `ReadData` | `2` |  |
+| `RandomAccess` | `4` |  |
+| `StableNodeIds` | `8` |  |
+| `WriteData` | `16` |  |
+| `Truncate` | `32` |  |
+| `CreateFile` | `64` |  |
+| `DeleteFile` | `128` |  |
+| `CreateDirectory` | `256` |  |
+| `RemoveDirectory` | `512` |  |
+| `Rename` | `1024` |  |
+| `HardLinks` | `2048` |  |
+| `SymbolicLinks` | `4096` |  |
+| `SetMetadata` | `8192` |  |
+| `SparseFiles` | `16384` |  |
+| `Flush` | `32768` |  |
+| `Transactions` | `65536` |  |
+| `CaseSensitiveNames` | `131072` |  |
+| `CasePreservingNames` | `262144` |  |
+
+#### `FilesystemDriverCoverage`
+
+Machine-readable repository coverage for one FileSystem.* descriptor. It answers whether the implementation has a path to an IFilesystemSession and which lower-level primitives are already available for finishing a native read/write driver.
+
+Implements `IEquatable<FilesystemDriverCoverage>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemDriverCoverage` | `FilesystemDriverCoverage(string FormatId, string DisplayName, FilesystemDriverBindingKind Binding, bool HasArchiveProjection, bool HasArchiveMutation, bool HasExtentMap, bool HasBlockMover, bool HasBlockDeviceProvider, bool HasNativeReadinessProvider)` | Machine-readable repository coverage for one FileSystem.* descriptor. It answers whether the implementation has a path to an IFilesystemSession and which lower-level primitives are already available for finishing a native read/write driver. |
+| `Binding` | `FilesystemDriverBindingKind Binding { get; init; }` |  |
+| `DisplayName` | `string DisplayName { get; init; }` |  |
+| `FormatId` | `string FormatId { get; init; }` |  |
+| `HasArchiveMutation` | `bool HasArchiveMutation { get; init; }` |  |
+| `HasArchiveProjection` | `bool HasArchiveProjection { get; init; }` |  |
+| `HasBlockDeviceProvider` | `bool HasBlockDeviceProvider { get; init; }` |  |
+| `HasBlockMover` | `bool HasBlockMover { get; init; }` |  |
+| `HasDriverPath` | `bool HasDriverPath { get; }` |  |
+| `HasExtentMap` | `bool HasExtentMap { get; init; }` |  |
+| `HasNativeReadinessProvider` | `bool HasNativeReadinessProvider { get; init; }` |  |
+| `IsNative` | `bool IsNative { get; }` |  |
+
+#### `FilesystemDriverDerivation`
+
+Common entry point for filesystem frontends. Native filesystem providers are always preferred. A descriptor that only exposes the normalized archive listing/open-entry surface still gets a real read-only filesystem session: hierarchy is reconstructed, node ids remain stable for the lifetime of the mount, symlinks are represented, and file handles use positional reads. The fallback is deliberately read-only. It never turns archive-level rebuild/Add/Remove support into mounted write support. This makes every filesystem parser usable by FUSE/Dokany/WinFsp-style frontends immediately, while leaving a precise upgrade path to native allocation and mutation code.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Assess` | `static FilesystemDriverReadinessReport Assess(IFormatDescriptor descriptor, Stream image, FilesystemDriverTarget target, string password = null)` |  |
+| `Open` | `static IFilesystemSession Open(IFormatDescriptor descriptor, Stream image, FilesystemOpenOptions options, string password = null)` |  |
+| `Probe` | `static FilesystemDriverProfile Probe(IFormatDescriptor descriptor, Stream image, string password = null)` |  |
+
+#### `FilesystemDriverProfile`
+
+Per-image probe result. Capabilities are not assumed from the format name: an EROFS flat profile, a compressed EROFS profile, a damaged FAT image, or a ReFS version with an unsupported metadata feature can have different safe operations even though they share one descriptor.
+
+Implements `IEquatable<FilesystemDriverProfile>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemDriverProfile` | `FilesystemDriverProfile(string FormatId, string ProfileName, FilesystemDriverCapabilities Capabilities, FilesystemMutationModel MutationModel, bool CanMount, bool CanMountWritable, IReadOnlyList<string> Limitations)` | Per-image probe result. Capabilities are not assumed from the format name: an EROFS flat profile, a compressed EROFS profile, a damaged FAT image, or a ReFS version with an unsupported metadata feature can have different safe operations even though they share one descriptor. |
+| `CanMountWritable` | `bool CanMountWritable { get; init; }` |  |
+| `CanMount` | `bool CanMount { get; init; }` |  |
+| `Capabilities` | `FilesystemDriverCapabilities Capabilities { get; init; }` |  |
+| `FormatId` | `string FormatId { get; init; }` |  |
+| `Limitations` | `IReadOnlyList<string> Limitations { get; init; }` |  |
+| `MutationModel` | `FilesystemMutationModel MutationModel { get; init; }` |  |
+| `ProfileName` | `string ProfileName { get; init; }` |  |
+
+#### `FilesystemDriverReadinessLayer`
+
+| Value | Numeric | Summary |
+| --- | --- | --- |
+| `None` | `0` |  |
+| `ImageValidation` | `1` |  |
+| `Namespace` | `2` |  |
+| `SessionStableNodeIds` | `4` |  |
+| `NativeStableNodeIds` | `8` |  |
+| `ReadData` | `16` |  |
+| `RandomAccessRead` | `32` |  |
+| `AllocationMap` | `64` |  |
+| `WriteData` | `128` |  |
+| `Truncate` | `256` |  |
+| `NamespaceMutation` | `512` |  |
+| `MetadataMutation` | `1024` |  |
+| `Links` | `2048` |  |
+| `Flush` | `4096` |  |
+| `DurabilityModel` | `8192` |  |
+| `Recovery` | `16384` |  |
+| `Concurrency` | `32768` |  |
+| `ValidationCorpus` | `65536` |  |
+
+#### `FilesystemDriverReadinessReport`
+
+Implements `IEquatable<FilesystemDriverReadinessReport>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemDriverReadinessReport` | `FilesystemDriverReadinessReport(string FormatId, FilesystemDriverTarget Target, FilesystemDriverReadinessLayer AvailableLayers, FilesystemDriverReadinessLayer RequiredLayers, bool Derivable, bool UsesNativeProvider, IReadOnlyList<string> Blockers)` |  |
+| `AvailableLayers` | `FilesystemDriverReadinessLayer AvailableLayers { get; init; }` |  |
+| `Blockers` | `IReadOnlyList<string> Blockers { get; init; }` |  |
+| `Derivable` | `bool Derivable { get; init; }` |  |
+| `FormatId` | `string FormatId { get; init; }` |  |
+| `RequiredLayers` | `FilesystemDriverReadinessLayer RequiredLayers { get; init; }` |  |
+| `Target` | `FilesystemDriverTarget Target { get; init; }` |  |
+| `UsesNativeProvider` | `bool UsesNativeProvider { get; init; }` |  |
+
+#### `FilesystemDriverTarget`
+
+| Value | Numeric | Summary |
+| --- | --- | --- |
+| `ReadOnly` | `0` |  |
+| `ReadWrite` | `1` |  |
+
+#### `FilesystemMetadataPatch`
+
+Optional metadata changes; null means leave the field unchanged.
+
+Implements `IEquatable<FilesystemMetadataPatch>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemMetadataPatch` | `FilesystemMetadataPatch(DateTimeOffset? Created = null, DateTimeOffset? Modified = null, DateTimeOffset? Accessed = null, ulong? NativeAttributes = null)` | Optional metadata changes; null means leave the field unchanged. |
+| `Accessed` | `DateTimeOffset? Accessed { get; init; }` |  |
+| `Created` | `DateTimeOffset? Created { get; init; }` |  |
+| `Modified` | `DateTimeOffset? Modified { get; init; }` |  |
+| `NativeAttributes` | `ulong? NativeAttributes { get; init; }` |  |
+
+#### `FilesystemMutationModel`
+
+Describes how namespace/data writes become durable on this exact on-disk profile. This is intentionally separate from `CanModify`: archive-level Add/Remove may legitimately rebuild a whole image, while a writable mounted filesystem driver needs bounded, handle-safe mutations.
+
+| Value | Numeric | Summary |
+| --- | --- | --- |
+| `None` | `0` |  |
+| `Direct` | `1` |  |
+| `Journaled` | `2` |  |
+| `CopyOnWrite` | `3` |  |
+| `LogStructured` | `4` |  |
+| `WholeImageRebuild` | `5` |  |
+
+#### `FilesystemNodeId`
+
+Stable, path-independent identity of a filesystem object. A real driver must not use a pathname as identity: rename/unlink can change names while open handles keep referring to the same inode/object. Providers map their native inode, file-reference, object-id or directory-slot identity into these two opaque 64-bit words.
+
+Implements `IEquatable<FilesystemNodeId>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemNodeId` | `FilesystemNodeId(ulong Value, ulong Generation = 0)` | Stable, path-independent identity of a filesystem object. A real driver must not use a pathname as identity: rename/unlink can change names while open handles keep referring to the same inode/object. Providers map their native inode, file-reference, object-id or directory-slot identity into these two opaque 64-bit words. |
+| `Generation` | `ulong Generation { get; init; }` |  |
+| `Value` | `ulong Value { get; init; }` |  |
+
+#### `FilesystemNodeInfo`
+
+Implements `IEquatable<FilesystemNodeInfo>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemNodeInfo` | `FilesystemNodeInfo(FilesystemNodeId NodeId, FilesystemNodeKind Kind, long Size, long AllocatedSize, uint LinkCount = 1, ulong NativeAttributes = 0, DateTimeOffset? Created = null, DateTimeOffset? Modified = null, DateTimeOffset? Accessed = null, DateTimeOffset? Changed = null)` |  |
+| `Accessed` | `DateTimeOffset? Accessed { get; init; }` |  |
+| `AllocatedSize` | `long AllocatedSize { get; init; }` |  |
+| `Changed` | `DateTimeOffset? Changed { get; init; }` |  |
+| `Created` | `DateTimeOffset? Created { get; init; }` |  |
+| `Kind` | `FilesystemNodeKind Kind { get; init; }` |  |
+| `LinkCount` | `uint LinkCount { get; init; }` |  |
+| `Modified` | `DateTimeOffset? Modified { get; init; }` |  |
+| `NativeAttributes` | `ulong NativeAttributes { get; init; }` |  |
+| `NodeId` | `FilesystemNodeId NodeId { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `FilesystemNodeKind`
+
+| Value | Numeric | Summary |
+| --- | --- | --- |
+| `Unknown` | `0` |  |
+| `RegularFile` | `1` |  |
+| `Directory` | `2` |  |
+| `SymbolicLink` | `3` |  |
+| `BlockDevice` | `4` |  |
+| `CharacterDevice` | `5` |  |
+| `Fifo` | `6` |  |
+| `Socket` | `7` |  |
+
+#### `FilesystemOpenOptions`
+
+Implements `IEquatable<FilesystemOpenOptions>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemOpenOptions` | `FilesystemOpenOptions(bool ReadOnly = true, bool LeaveOpen = true)` |  |
+| `LeaveOpen` | `bool LeaveOpen { get; init; }` |  |
+| `ReadOnly` | `bool ReadOnly { get; init; }` |  |
+
 #### `FilesystemSchemaPresets`
 
 Reusable `FormatOptionDescriptor` building blocks shared by every filesystem that exposes tunable layout parameters through `IFormatOptionsSchema`. Cluster/block size and volume size are near-universal across cluster-based filesystems, so they live here rather than being re-declared in each descriptor. Filesystem-specific knobs (MFT record size, inode size, FAT type, …) are declared by the individual descriptor.
@@ -6335,23 +6596,58 @@ Reusable `FormatOptionDescriptor` building blocks shared by every filesystem tha
 | `PowerOfTwoSize` | `static FormatOptionDescriptor PowerOfTwoSize(string key, string displayName, int min, int max, string defaultLabel, string description)` | Generic power-of-two size dropdown for any byte-valued knob (inode size, MFT record, …). |
 | `VolumeLabel` | `static FormatOptionDescriptor VolumeLabel(int maxChars = 11)` | Standard volume-label text field. |
 
+#### `FilesystemSnapshotDirectoryEntry`
+
+Implements `IEquatable<FilesystemSnapshotDirectoryEntry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemSnapshotDirectoryEntry` | `FilesystemSnapshotDirectoryEntry(FilesystemNodeId ParentNodeId, string Name, FilesystemNodeId NodeId)` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `NodeId` | `FilesystemNodeId NodeId { get; init; }` |  |
+| `ParentNodeId` | `FilesystemNodeId ParentNodeId { get; init; }` |  |
+
+#### `FilesystemSnapshotNode`
+
+Native filesystem object projected into the common driver contract. Name and parent are a convenient primary-link description for simple filesystems; use explicit `FilesystemSnapshotDirectoryEntry` values when one node has multiple directory entries (hard links).
+
+Implements `IEquatable<FilesystemSnapshotNode>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FilesystemSnapshotNode` | `FilesystemSnapshotNode(FilesystemNodeId NodeId, FilesystemNodeId ParentNodeId, string Name, FilesystemNodeKind Kind, long Size, long AllocatedSize, uint LinkCount = 1, ulong NativeAttributes = 0, DateTimeOffset? Created = null, DateTimeOffset? Modified = null, DateTimeOffset? Accessed = null, DateTimeOffset? Changed = null, string SymbolicLinkTarget = null, Func<IFilesystemFileHandle> OpenReadHandle = null)` | Native filesystem object projected into the common driver contract. Name and parent are a convenient primary-link description for simple filesystems; use explicit `FilesystemSnapshotDirectoryEntry` values when one node has multiple directory entries (hard links). |
+| `Accessed` | `DateTimeOffset? Accessed { get; init; }` |  |
+| `AllocatedSize` | `long AllocatedSize { get; init; }` |  |
+| `Changed` | `DateTimeOffset? Changed { get; init; }` |  |
+| `Created` | `DateTimeOffset? Created { get; init; }` |  |
+| `Kind` | `FilesystemNodeKind Kind { get; init; }` |  |
+| `LinkCount` | `uint LinkCount { get; init; }` |  |
+| `Modified` | `DateTimeOffset? Modified { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `NativeAttributes` | `ulong NativeAttributes { get; init; }` |  |
+| `NodeId` | `FilesystemNodeId NodeId { get; init; }` |  |
+| `OpenReadHandle` | `Func<IFilesystemFileHandle> OpenReadHandle { get; init; }` |  |
+| `ParentNodeId` | `FilesystemNodeId ParentNodeId { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+| `SymbolicLinkTarget` | `string SymbolicLinkTarget { get; init; }` |  |
+
 #### `FormatCapabilities`
 
-Flags describing what operations a format supports. Write capability is a four-level scale: Unsupported — no descriptor exists.Read-Only — `CanList` and/or `CanExtract` only.WORM (Write-Once-Read-Many) — adds `CanCreate`: a fresh archive can be produced from inputs, but existing archives cannot be modified in place.R/W (Modify) — adds `CanModify`: entries can be added, replaced, or removed in an existing archive without full rewrite. Most archive formats stop at WORM; true in-place modification is rare because compressed archive containers don't generally support entry mutation without a full rebuild. Honesty rule — rebuild-backed modification is WORM, not R/W. A format may implement `IArchiveModifiable` purely to make the add / remove / purge verbs work, backing them with the verified extract → re-create rebuild (the default `IArchiveModifiable` members, or `ModifyRebuilder` / `RebuildVerb`). That is a full rewrite of the container, so such a format advertises `CanCreate` only and must not set `CanModify` — the verb still runs, but no in-place R/W is claimed. `CanModify` is reserved for formats with a genuine in-place writer that edits the existing container (e.g. ZIP/TAR central-directory edits, FAT/NTFS/ext block writes, byte-identity append). `Compression.Tests.Operations.WriteCapabilityHonestyTests` enforces this for every claimant.
+Flags describing what operations a format supports. Write capability is a four-level scale: Unsupported — no descriptor exists.Read-Only — `CanList` and/or `CanExtract` only.WORM (Write-Once-Read-Many) — adds `CanCreate`: a fresh archive/image can be produced, but the library has no supported edit of an existing instance.R/W (Modify) — adds `CanModify`: an existing instance supports add/replace/remove and remains valid after the edit.R/W describes the public operation, not the physical write strategy. A format may update allocation metadata in place, append a new index, relayout members, or rebuild the complete image. Those are implementation choices. If callers can open an existing instance, apply add/replace/remove through `IArchiveModifiable`, and obtain a valid instance preserving the semantics the implementation claims to support, the format is R/W at this API surface. Conversely, merely having a writer for fresh images is WORM and must not set `CanModify`. This distinction is especially important for read-only-on-mount filesystem formats such as SquashFS, CramFS and EROFS: the native filesystem driver may intentionally forbid mounted writes while an offline image editor can still support complete, deterministic mutation by relayout/rebuild. `CanModify` reports the latter capability.
 
 | Value | Numeric | Summary |
 | --- | --- | --- |
 | `None` | `0` |  |
 | `CanList` | `1` |  |
 | `CanExtract` | `2` |  |
-| `CanCreate` | `4` | WORM: can produce a fresh archive from inputs (no in-place modification). |
+| `CanCreate` | `4` | WORM: can produce a fresh archive/image, but has no supported existing-instance edit. |
 | `CanTest` | `8` |  |
 | `SupportsPassword` | `16` |  |
 | `SupportsMultipleEntries` | `32` |  |
 | `SupportsDirectories` | `64` |  |
 | `SupportsOptimize` | `256` |  |
 | `CanCompoundWithTar` | `512` |  |
-| `CanModify` | `1024` | R/W: can modify an existing archive (add/replace/remove entries) without full rewrite. Implies `CanCreate`. |
+| `CanModify` | `1024` | R/W: can add/replace/remove entries in an existing archive/image. The implementation may edit in place or relayout/rebuild. Implies `CanCreate` for normal writable formats. |
 
 #### `FormatCategory`
 
@@ -6461,19 +6757,27 @@ How a `FormatOptionDescriptor` renders + parses.
 
 #### `FormatRegistry`
 
-Central registry of all format descriptors. Populated at startup via `Register` calls (typically from source-generated code), then finalized with `Initialize`.
+Central registry of all format descriptors and their optional driver sidecars. Populated at startup by generated registration code, then finalized with `Initialize`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `All` | `static IReadOnlyList<IFormatDescriptor> All { get; }` | All registered descriptors. |
-| `GetArchiveOps` | `static IArchiveFormatOperations GetArchiveOps(string id)` | Get archive operations for a format ID, or null if not an archive format. |
-| `GetAsyncArchiveOps` | `static IAsyncArchiveOperations GetAsyncArchiveOps(string id)` | Get async archive operations for a format ID, or null if the format doesn't support async listing. |
-| `GetByCategory` | `static IEnumerable<IFormatDescriptor> GetByCategory(FormatCategory category)` | Get all descriptors in a given category. |
-| `GetByExtension` | `static IFormatDescriptor GetByExtension(string path)` | Look up a descriptor by file path/extension. Checks compound extensions first (longest match). |
-| `GetById` | `static IFormatDescriptor GetById(string id)` | Look up a descriptor by its unique ID. |
-| `GetStreamOps` | `static IStreamFormatOperations GetStreamOps(string id)` | Get stream operations for a format ID, or null if not a stream format. |
-| `Initialize` | `static void Initialize()` | Finalize the registry by building lookup tables. Safe to call multiple times. Call this after all `Register` calls are complete. |
-| `Register` | `static void Register(IFormatDescriptor descriptor)` | Register a format descriptor. Called by generated code and for compound tar auto-generation. Must be called before `Initialize`. |
+| `All` | `static IReadOnlyList<IFormatDescriptor> All { get; }` |  |
+| `FilesystemFormatIds` | `static IReadOnlyList<string> FilesystemFormatIds { get; }` | All descriptor IDs originating from FileSystem.* projects. |
+| `AssessFilesystemDriver` | `static FilesystemDriverReadinessReport AssessFilesystemDriver(string id, Stream image, FilesystemDriverTarget target, string password = null)` |  |
+| `GetArchiveOps` | `static IArchiveFormatOperations GetArchiveOps(string id)` |  |
+| `GetAsyncArchiveOps` | `static IAsyncArchiveOperations GetAsyncArchiveOps(string id)` |  |
+| `GetByCategory` | `static IEnumerable<IFormatDescriptor> GetByCategory(FormatCategory category)` |  |
+| `GetByExtension` | `static IFormatDescriptor GetByExtension(string path)` |  |
+| `GetById` | `static IFormatDescriptor GetById(string id)` |  |
+| `GetFilesystemDriverCoverage` | `static FilesystemDriverCoverage GetFilesystemDriverCoverage(string id)` |  |
+| `GetFilesystemDriverCoverage` | `static IReadOnlyList<FilesystemDriverCoverage> GetFilesystemDriverCoverage()` | Structural driver coverage for all FileSystem.* descriptors. This is safe to inspect without an image and is intended for CI/readiness dashboards. Use `AssessFilesystemDriver` for exact per-image semantics. |
+| `GetFilesystemDriver` | `static IFilesystemDriverAdapter GetFilesystemDriver(string id)` | Returns a generated native driver sidecar for the format, when one exists. |
+| `GetStreamOps` | `static IStreamFormatOperations GetStreamOps(string id)` |  |
+| `Initialize` | `static void Initialize()` |  |
+| `OpenFilesystem` | `static IFilesystemSession OpenFilesystem(string id, Stream image, FilesystemOpenOptions options, string password = null)` |  |
+| `ProbeFilesystem` | `static FilesystemDriverProfile ProbeFilesystem(string id, Stream image, string password = null)` |  |
+| `RegisterFilesystemDriver` | `static void RegisterFilesystemDriver(IFilesystemDriverAdapter driver)` | Registers one source-generated native filesystem-driver sidecar. Duplicate adapters for the same format ID are a build/runtime contract error rather than whichever registration happened to win. |
+| `Register` | `static void Register(IFormatDescriptor descriptor, bool isFilesystem = false)` | Register a format descriptor. Source-generated calls set `isFilesystem` for descriptors declared under a `FileSystem.*` namespace so filesystem coverage is explicit rather than inferred from extensions or display names. |
 
 #### `IArchiveCreatable`
 
@@ -6486,12 +6790,12 @@ Opt-in capability: the descriptor can produce a fresh archive from a list of inp
 
 #### `IArchiveDefragmentable`
 
-Opt-in capability: the descriptor can rewrite an archive in place so that every file occupies a contiguous cluster run, optionally with a chosen layout strategy (consolidate at start / end, lazy hole-fill, carve a free region). Complements the allocator's automatic fast-defrag (which fires only when a pending allocation can't find a contiguous hole); this is the user-initiated full pass.
+Opt-in capability for physical or logical re-layout. Native mutable filesystems may move extents in place; WORM/archive containers can satisfy the same verb by building a verified staged target and committing it after completion.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Defragment` | `void Defragment(Stream archive)` | Rebuilds the archive content in place so every file is contiguous. Outer byte size is preserved. Free space is consolidated at the end. Default implementation: any descriptor that also implements `IArchiveFormatOperations` + `IArchiveCreatable` gets defragmentation for free — a verified in-place extract → re-create rebuild via `RebuildInPlace` (the rebuild-via-WORM pattern inherently lays every file out contiguously) that refuses to commit a lossy result. Formats with a true in-place block mover override this for efficiency and full mode support. |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Rewrites the archive content according to `options`. Default implementation forwards to `Defragment` for `ConsolidateAtStart` and throws for every other mode — implementers should override to support all modes their on-disk format permits. |
+| `Defragment` | `void Defragment(Stream archive)` | Defragments using the format's default consolidate-at-start strategy. Generic list/extract/create descriptors use the verified staged rebuild. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Rewrites according to `options`. Descriptors with their own native parameterless mover retain it. Descriptors relying on the interface default are routed through the progress-reporting, cancellable staged rebuild, so archive repacks and WORM re-layouts drive the same block-map UI as physical filesystem extent moves. |
 
 #### `IArchiveFormatOperations`
 
@@ -6499,10 +6803,10 @@ The base capability every archive descriptor implements: list entries and extrac
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Extracts a single entry to a byte array without writing to disk. The default implementation now routes through `OpenEntry` so the bounded streaming contract is enforced even when callers ask for a buffered result. Descriptors that have a more efficient native byte-array path (e.g. a reader that already materialises the whole entry) can still override. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Extracts a single entry to a byte array. This is the explicitly buffered convenience API; callers working with large entries should use `OpenEntry` instead. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` | Extract entries from the archive to an output directory. |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` | List all entries in the archive. |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single entry as a read-only `Stream` bounded to that entry's logical bytes — physically incapable of reading slack space, adjacent entries, padding/alignment fillers, or header/metadata regions. This is the canonical per-entry isolation primitive used by streaming conversion pipelines. |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single entry as a read-only `Stream` bounded to that entry's logical bytes — physically incapable of reading slack space, adjacent entries, padding/alignment fillers, or header/metadata regions. This is the canonical per-entry isolation primitive used by streaming conversion and derived-filesystem pipelines. |
 
 #### `IArchiveInMemoryExtract`
 
@@ -6514,20 +6818,32 @@ Opt-in capability: the descriptor can extract a single named entry straight to a
 
 #### `IArchiveLayoutMap`
 
-Opt-in capability: the descriptor can enumerate the real byte-level layout of an archive — every entry's header, compressed payload, and inter-entry gaps at their actual offsets. Parallel to `IFilesystemExtentMap` but for archive formats (ZIP, 7z, TAR, LZH, ARJ, etc.). Drives the Defragment/Optimize window block-map preview so the user sees the real archive layout before pressing "Optimize".
+Opt-in capability: the descriptor can enumerate the real byte-level layout of an archive — every entry's header, compressed payload, and inter-entry gaps at their actual offsets. Parallel to `IFilesystemExtentMap` but for archive formats (ZIP, 7z, TAR, LZH, ARJ, etc.). Fail-closed contract: omitted bytes are interpreted as unused by maintenance consumers. Any live, structural, ambiguous or undecoded region must therefore be emitted as `MetadataReserved` (or `Used`), never silently omitted. If a layout cannot be proven safe, return no extents and the inherited generic wipe is a no-op.That exact preservation map also makes every implementation an `IWipeEmpty` capability. The generic implementation zeros proven dead gaps while format-specific overrides may additionally scrub tombstones, reserved growth records, stale indexes, or other recoverable metadata.Drives the Defragment/Optimize window block-map preview so the user sees the real archive layout before pressing "Optimize".
+
+Implements `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `EnumerateLayout` | `IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive)` | Enumerates the actual byte layout of `archive`. Coverage may be sparse; callers fill the gaps with `Free`. The stream's position may be modified during enumeration but the caller owns the lifetime — implementations must not dispose `archive`. |
+| `EnumerateLayout` | `IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive)` | Enumerates the actual byte layout of `archive`. Coverage may be sparse only where omitted bytes are proven unused; callers fill those gaps with `Free`. The stream's position may be modified during enumeration but the caller owns the lifetime — implementations must not dispose `archive`. |
 
 #### `IArchiveModifiable`
 
-Opt-in capability: the descriptor exposes add / remove (and thereby the purge verb). Implementing this interface makes the verbs work; it does not by itself entitle the format to advertise `CanModify` (R/W). The default `Add` / `Remove` below — and any override that delegates to `ModifyRebuilder` / `RebuildVerb` — are a verified extract → re-create rebuild, i.e. a full rewrite of the container. A format whose modification is only rebuild-backed is WORM: it advertises `CanCreate` and must NOT advertise `CanModify` (see `FormatCapabilities`). Reserve `CanModify` for a genuine in-place writer that edits the existing bytes (R/W filesystems; central-directory / member edits; byte-identity append).
+Opt-in capability for editing an existing archive/image through add/replace/remove. The physical strategy is format-specific: implementations may patch blocks in place, append replacement metadata, relayout members, or perform a verified extract → edit → re-create rebuild. All are valid implementations of the same public mutation contract when the resulting instance preserves the semantics the descriptor claims to support. A descriptor advertising `CanModify` must expose this interface and its supported-profile edit path must actually round-trip. Merely being able to create a fresh instance is not enough. A fully modifiable container is also purgeable: removing all live entries is a required subset of the remove contract.
+
+Implements `IArchivePurgeable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds files to an existing instance, replacing entries with the same logical path/name. Default implementation: descriptors that also implement `IArchiveFormatOperations` and `IArchiveCreatable` get a verified extract → edit → re-create implementation through `EditViaRebuild`. Formats with a cheaper native editor override it. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing instance. Passing every entry name yields an empty container/image where the format permits one. Default implementation: a verified extract → drop-named-files → re-create edit through `EditViaRebuild`. Native implementations may instead unlink/free in place and optionally wipe released storage. |
+
+#### `IArchivePurgeable`
+
+Opt-in capability: all user/live entries can be removed from an existing container while leaving a valid, listable empty instance. This is distinct from `IWipeEmpty`, which preserves live entries and overwrites only unused/dead bytes.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Appends or replaces files inside `archive`. On replacement the previous bytes are wiped the same way `Remove` wipes them. Default implementation: any descriptor that also implements `IArchiveFormatOperations` + `IArchiveCreatable` gets add for free — a verified extract → splat-new-files → re-create rebuild via `EditViaRebuild` (the same WORM rebuild that backs the other verbs). Formats with a true in-place writer override for efficiency. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from `archive` and wipes all on-disk traces. Default implementation: a verified extract → drop-named-files → re-create rebuild via `EditViaRebuild`. Passing every entry name (or all files) yields an empty container — i.e. the purge verb. Formats with a true in-place writer override for efficiency and forensic wiping. |
+| `Purge` | `void Purge(Stream archive)` | Removes every live non-directory entry from `archive`. Default implementation: descriptors that also implement `IArchiveFormatOperations` and `IArchiveModifiable` get a transactional staged purge through `PurgeViaModifier`. Native implementations may override this when they can empty the container more efficiently. |
 
 #### `IArchiveShrinkable`
 
@@ -6558,6 +6874,23 @@ Optional interface for archive formats that support lazy, asynchronous entry enu
 | --- | --- | --- |
 | `ListEntriesAsync` | `IAsyncEnumerable<ArchiveEntryInfo> ListEntriesAsync(Stream stream, string password, CancellationToken ct = null)` | Lazily enumerates archive entries as an async stream. Each entry is yielded as it is discovered, without requiring the full archive to be scanned first. |
 
+#### `IBlockDeviceFilesystemDriverProvider`
+
+Optional filesystem-core capability for implementations whose native parser already works directly on a block device. This is the long-term driver core: the same filesystem implementation can mount raw disks, virtual disks, forensic images, or decoded track media without container-specific code.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device)` |  |
+
+#### `IBlockDeviceProvider`
+
+Compatibility alias for the original block-device provider name. New code uses `IRandomAccessBlockDeviceProvider` so containers, decoded track media and raw images expose exactly one logical-block abstraction.
+
+Implements `IRandomAccessBlockDeviceProvider`.
+
+_No public or protected members._
+
 #### `IBuildingBlock`
 
 A raw compression/decompression building block (algorithm primitive) that can be benchmarked. Unlike `IFormatDescriptor`, building blocks have no file format container — they operate directly on raw byte data.
@@ -6603,13 +6936,57 @@ Opt-in capability for filesystems that support true in-place defragmentation via
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` | Repoints a run the way `UpdateAllocationAfterMove` does, but says whether the space it came from should be released. |
 | `UpdateAllocationScattered` | `void UpdateAllocationScattered(Stream image, string fileName, IReadOnlyList<long> oldBlockOffsets, IReadOnlyList<long> newBlockOffsets, IReadOnlySet<long> blocksLiveElsewhere)` | Rewrites `fileName`'s allocation so that it occupies `newBlockOffsets` in that order, having previously occupied `oldBlockOffsets`. Both lists are one entry per allocation block, in the file's own order. |
 
+#### `IFilesystemDriverAdapter`
+
+Sidecar binding from an existing format descriptor ID to a native filesystem driver core. This lets large/legacy descriptors acquire driver semantics without mixing mount state, locking and block-device code into their archive surface. The source generator discovers public parameterless implementations and registers them by `FormatId`.
+
+Implements `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FormatId` | `string FormatId { get; }` |  |
+
+#### `IFilesystemDriverProvider`
+
+Descriptor-side entry point for a mount-grade filesystem implementation. Probe must be non-destructive and fail closed. Open must reject writable mode unless the returned profile has `CanMountWritable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
+#### `IFilesystemDriverReadinessProvider`
+
+Optional filesystem-specific readiness description. The generic derivation layer supplies a conservative report when a descriptor does not implement this interface; native implementations can use it to explain exactly which on-disk semantics still block a complete mounted driver.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+
 #### `IFilesystemExtentMap`
 
-Opt-in capability: the descriptor (or a partner type) can enumerate the actual on-disk byte layout of a filesystem image — every used cluster chain per file (one `DefragBlockInfo` per contiguous run), every metadata-reserved region (boot sector, FAT, bitmap, superblock, MFT, root directory, inode table, BAM, group descriptor table, etc.), and optionally every free region. Coverage may be sparse — gaps in the returned set are interpreted by the caller as `Free`. The yielded extents don't need to be sorted; the caller is responsible for sorting + gap filling. Implementations must not throw for malformed or partially-walked images — they should yield whatever they can identify and return.Drives the Defragment-window block-map preview so the user sees the real fragmented layout before pressing "Defragment" rather than the post-defrag approximation.
+Opt-in capability: the descriptor (or a partner type) can enumerate the actual on-disk byte layout of a filesystem image — every used cluster chain per file (one `DefragBlockInfo` per contiguous run), every metadata-reserved region (boot sector, FAT, bitmap, superblock, MFT, root directory, inode table, BAM, group descriptor table, etc.), and optionally every free region. Fail-closed contract: gaps in the returned set are interpreted as free space by maintenance consumers. Therefore an implementation that encounters an allocated-but-undecoded, damaged, ambiguous, or otherwise unproven region MUST emit that region as `MetadataReserved` rather than silently omit it. If the image cannot be walked safely at all, yield no extents; the inherited generic `IWipeEmpty` implementation then wipes nothing.Because this contract identifies all bytes that must be preserved, every extent map is also an `IWipeEmpty` implementation: the default wiper zeros only proven gaps (and cluster tips when a trustworthy logical-size lookup exists). Formats that know about deleted directory records or other hidden remnants may override the wipe for deeper cleaning.Drives the Defragment-window block-map preview so the user sees the real fragmented layout before pressing "Defragment" rather than the post-defrag approximation.
+
+Implements `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Enumerates the actual on-disk layout of `image`. Coverage may be sparse; callers fill the gaps with `Free`. The stream's position may be modified during enumeration but the caller owns the lifetime — implementations must not dispose `image`. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Enumerates the actual on-disk layout of `image`. Coverage may be sparse only where the omitted bytes are proven free; callers fill those gaps with `Free`. Unknown allocated bytes must be returned as `MetadataReserved`. The stream's position may be modified during enumeration but the caller owns its lifetime — implementations must not dispose `image`. |
+
+#### `IFilesystemFileHandle`
+
+Positional file handle. It deliberately has no shared Stream.Position so two concurrent kernel requests cannot race a mutable cursor. Reads/writes operate at explicit logical offsets and therefore map naturally to filesystem extents.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Length` | `long Length { get; }` |  |
+| `NodeId` | `FilesystemNodeId NodeId { get; }` |  |
+| `Flush` | `void Flush()` |  |
+| `Read` | `int Read(long offset, Span<byte> destination)` |  |
+| `SetLength` | `void SetLength(long length)` |  |
+| `Write` | `void Write(long offset, ReadOnlySpan<byte> source)` |  |
 
 #### `IFilesystemMetadataMover`
 
@@ -6621,6 +6998,42 @@ Opt-in capability for filesystems whose own structures — the MFT, an allocatio
 | `PrepareMetadataMove` | `void PrepareMetadataMove(Stream image, string metadataName, long oldOffset, long newOffset, long length)` | Gives the filesystem a chance to make the destination safe before the raw bytes are copied there. |
 | `UpdateMetadataAfterMove` | `void UpdateMetadataAfterMove(Stream image, string metadataName, long oldOffset, long newOffset, long length, IReadOnlyList<ValueTuple<long, long>> liveRanges = null)` | Repoints whatever locates `metadataName` after its bytes have been copied from `oldOffset` to `newOffset`, and moves the allocation with it. |
 
+#### `IFilesystemSession`
+
+Open filesystem namespace. Operations use stable node ids rather than paths, mirroring the semantics required by FUSE/Dokany/WinFsp-style adapters: a caller may keep a file handle open across rename or unlink.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Profile` | `FilesystemDriverProfile Profile { get; }` |  |
+| `RootNodeId` | `FilesystemNodeId RootNodeId { get; }` |  |
+| `BeginTransaction` | `IFilesystemTransaction BeginTransaction()` | Begins one durability transaction for this session. Until Commit/Rollback, namespace operations and writes through handles opened by the session belong to that transaction. Providers that do not advertise Transactions throw. |
+| `CreateDirectory` | `FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name)` |  |
+| `CreateFile` | `FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name)` |  |
+| `CreateHardLink` | `void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)` |  |
+| `CreateSymbolicLink` | `FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)` |  |
+| `DeleteFile` | `void DeleteFile(FilesystemNodeId parentDirectory, string name)` |  |
+| `Enumerate` | `IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory)` |  |
+| `Flush` | `void Flush()` | Flushes all dirty data and metadata that are not inside an active transaction. |
+| `Lookup` | `FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name)` |  |
+| `OpenFile` | `IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access)` |  |
+| `ReadSymbolicLink` | `string ReadSymbolicLink(FilesystemNodeId nodeId)` |  |
+| `RemoveDirectory` | `void RemoveDirectory(FilesystemNodeId parentDirectory, string name)` |  |
+| `Rename` | `void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)` |  |
+| `SetMetadata` | `void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch)` |  |
+| `Stat` | `FilesystemNodeInfo Stat(FilesystemNodeId nodeId)` |  |
+
+#### `IFilesystemTransaction`
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `IsCompleted` | `bool IsCompleted { get; }` |  |
+| `Commit` | `void Commit()` |  |
+| `Rollback` | `void Rollback()` |  |
+
 #### `IFormatDescriptor`
 
 Self-describing metadata for a file format. Each FileFormat.* project provides one implementation of this interface to register itself with the format registry.
@@ -6677,6 +7090,49 @@ Capability marker for archive/disk-container formats whose payload is a raw bloc
 | --- | --- | --- |
 | `OpenGuestDiskStream` | `Stream OpenGuestDiskStream(Stream image)` | Opens the inner (guest) disk image as a `Stream` suitable for partition-table editing. The returned stream must support reading, writing, and seeking. The caller owns the returned stream and must dispose it; disposing it must not dispose the outer `image` stream. |
 
+#### `IRandomAccessBlockDevice`
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CanWrite` | `bool CanWrite { get; }` |  |
+| `Geometry` | `BlockDeviceGeometry Geometry { get; }` |  |
+| `Flush` | `void Flush()` |  |
+| `ReadBlocks` | `int ReadBlocks(long firstBlock, Span<byte> destination)` |  |
+| `Trim` | `void Trim(long firstBlock, long blockCount)` |  |
+| `WriteBlocks` | `void WriteBlocks(long firstBlock, ReadOnlySpan<byte> source)` |  |
+
+#### `IRandomAccessBlockDeviceProvider`
+
+Optional descriptor capability for exposing the sector/block device that sits below a filesystem namespace. Container descriptors can implement this without pretending the container itself is a filesystem.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenBlockDevice` | `IRandomAccessBlockDevice OpenBlockDevice(Stream image, bool writable, bool leaveOpen = true)` | Opens a random-access block device over `image`. Implementations must fail closed when the exact on-disk profile cannot be projected losslessly/safely at block granularity. |
+
+#### `IRawTrackDevice`
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CanWrite` | `bool CanWrite { get; }` |  |
+| `TrackCount` | `int TrackCount { get; }` |  |
+| `ClearTrack` | `void ClearTrack(int index)` |  |
+| `EnumerateTracks` | `IReadOnlyList<RawTrackInfo> EnumerateTracks()` |  |
+| `Flush` | `void Flush()` |  |
+| `ReadTrack` | `int ReadTrack(int index, Span<byte> destination)` |  |
+| `WriteTrack` | `void WriteTrack(int index, ReadOnlySpan<byte> source, uint? encodingParameter = null)` |  |
+
+#### `IRawTrackDeviceProvider`
+
+Optional descriptor capability for opening the raw-track layer directly. This keeps track-container mutation separate from filesystem namespace CRUD.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenRawTrackDevice` | `IRawTrackDevice OpenRawTrackDevice(Stream image, bool writable, bool leaveOpen = true)` |  |
+
 #### `IStreamFormatOperations`
 
 Operations for single-stream compression formats.
@@ -6692,7 +7148,7 @@ Operations for single-stream compression formats.
 
 #### `IWipeEmpty`
 
-Opt-in capability: the descriptor can zero-fill all unused bytes in an image or archive — free clusters/sectors, cluster-tip slack, deleted directory entries, padding regions, and dead archive bytes. This is a forensic-cleanliness tool ensuring no deleted file remnants survive. Implementations that don't need format-specific logic can delegate to `Wipe` which works generically with any `IFilesystemExtentMap` or `IArchiveLayoutMap`.
+Opt-in capability: the descriptor can zero-fill all unused bytes in an image or archive — free clusters/sectors, cluster-tip slack, deleted directory entries, padding regions, and dead archive bytes. This is a forensic-cleanliness tool ensuring no deleted file remnants survive. The default implementation is deliberately conservative. It is available only when the same descriptor exposes an exact filesystem extent map or archive layout map; unknown/undecoded regions must therefore be emitted as `MetadataReserved` by those maps rather than omitted. An empty map is treated as "cannot prove anything is free" and wipes nothing.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -6886,15 +7342,92 @@ Which zone a metadata chunk should be placed in relative to the primary data pay
 | `AfterData` | `1` | Place the chunk after the primary data payload. |
 | `Remove` | `2` | Remove the chunk entirely during optimization. |
 
+#### `RawTrackInfo`
+
+Raw variable-length track device for flux/GCR/MFM-style containers that are not yet sector-addressable. G64 belongs here; a decoder can later project it as `IRandomAccessBlockDevice` for a Commodore filesystem driver.
+
+Implements `IEquatable<RawTrackInfo>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `RawTrackInfo` | `RawTrackInfo(int Index, long Length, uint EncodingParameter = 0, bool IsPresent = true)` | Raw variable-length track device for flux/GCR/MFM-style containers that are not yet sector-addressable. G64 belongs here; a decoder can later project it as `IRandomAccessBlockDevice` for a Commodore filesystem driver. |
+| `EncodingParameter` | `uint EncodingParameter { get; init; }` |  |
+| `Index` | `int Index { get; init; }` |  |
+| `IsPresent` | `bool IsPresent { get; init; }` |  |
+| `Length` | `long Length { get; init; }` |  |
+
+#### `ReadOnlyFilesystemSnapshotSession`
+
+Implements `IDisposable`, `IFilesystemSession`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ReadOnlyFilesystemSnapshotSession` | `ReadOnlyFilesystemSnapshotSession(FilesystemDriverProfile profile, FilesystemNodeId rootNodeId, IEnumerable<FilesystemSnapshotNode> nodes)` |  |
+| `ReadOnlyFilesystemSnapshotSession` | `ReadOnlyFilesystemSnapshotSession(FilesystemDriverProfile profile, FilesystemNodeId rootNodeId, IEnumerable<FilesystemSnapshotNode> nodes, IEnumerable<FilesystemSnapshotDirectoryEntry> directoryEntries)` | Full constructor with independent object and directory-entry sets. Multiple entries may target the same node ID; that is how hard links are represented. |
+| `Profile` | `FilesystemDriverProfile Profile { get; }` |  |
+| `RootNodeId` | `FilesystemNodeId RootNodeId { get; }` |  |
+| `BeginTransaction` | `IFilesystemTransaction BeginTransaction()` |  |
+| `CreateDirectory` | `FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name)` |  |
+| `CreateFile` | `FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name)` |  |
+| `CreateHardLink` | `void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)` |  |
+| `CreateSymbolicLink` | `FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)` |  |
+| `DeleteFile` | `void DeleteFile(FilesystemNodeId parentDirectory, string name)` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Enumerate` | `IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory)` |  |
+| `Flush` | `void Flush()` |  |
+| `Lookup` | `FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name)` |  |
+| `OpenFile` | `IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access)` |  |
+| `ReadSymbolicLink` | `string ReadSymbolicLink(FilesystemNodeId nodeId)` |  |
+| `RemoveDirectory` | `void RemoveDirectory(FilesystemNodeId parentDirectory, string name)` |  |
+| `Rename` | `void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)` |  |
+| `SetMetadata` | `void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch)` |  |
+| `Stat` | `FilesystemNodeInfo Stat(FilesystemNodeId nodeId)` |  |
+
 #### `RebuildVerb`
 
-Generic, round-trip-verified "extract → re-create" engine shared by the default implementations of the maintenance verbs (shrink, defragment) for any descriptor that can both enumerate/extract (`IArchiveFormatOperations`) and create (`IArchiveCreatable`) its format. Every rebuild is verified: the freshly created image is listed back and its live-file count compared against the source. If the rebuild would drop files, the operation throws `InvalidOperationException` instead of producing a lossy result — so enabling a verb on a format whose create path doesn't faithfully round-trip fails loudly rather than silently corrupting data. This is what makes broad, default-implementation rollout across filesystems safe.
+Generic, round-trip-verified extract → re-create engine shared by maintenance verbs. Rebuilds are staged, verified, progress-reporting, and cancellable; the caller's original stream is not touched until the staged target has been built successfully and cancellation is no longer accepted.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `EditViaRebuild` | `static void EditViaRebuild(Stream archive, IArchiveFormatOperations ops, IArchiveCreatable creator, Action<string> mutate)` | Rebuild-based in-place edit shared by the default `IArchiveModifiable`: extract the archive, apply `mutate` to the extracted file tree (add/overwrite/delete real files on disk), re-create the image, and overwrite the stream. The original bytes are left untouched on any failure. |
-| `RebuildInPlace` | `static void RebuildInPlace(Stream archive, IArchiveFormatOperations ops, IArchiveCreatable creator, IReadOnlyDictionary<string, string> formatSpecific = null)` | In-place rebuild: re-creates `archive` from its own contents (consolidating live data — the defragmentation side effect of the rebuild-via-WORM pattern) and overwrites the stream only when the rebuild is verified to round-trip. On any failure the original bytes are left untouched. |
-| `RebuildToStream` | `static int RebuildToStream(Stream input, Stream output, IArchiveFormatOperations ops, IArchiveCreatable creator, IReadOnlyDictionary<string, string> formatSpecific = null, IReadOnlySet<string> syntheticNames = null)` | Extracts every entry of `input` and re-creates the image into `output` via `creator`. Returns the source live-file count. Throws if the rebuilt image lists fewer live files than the source (lossy round-trip) — the caller's `output` should be discarded in that case. |
+| `EditViaRebuild` | `static void EditViaRebuild(Stream archive, IArchiveFormatOperations ops, IArchiveCreatable creator, Action<string> mutate)` | Rebuild-based edit used by the generic modifier. Mutation and validation happen off to the side; the original is overwritten only after a valid staged result exists. |
+| `PurgeViaModifier` | `static void PurgeViaModifier(Stream archive, IArchiveFormatOperations ops, IArchiveModifiable modifier)` | Transactional purge for a mutable container. The modifier operates on a staged copy and the caller's stream is replaced only after the result lists successfully with every original live entry gone. |
+| `RebuildInPlace` | `static void RebuildInPlace(Stream archive, IArchiveFormatOperations ops, IArchiveCreatable creator, IReadOnlyDictionary<string, string> formatSpecific = null, Action<DefragProgressEvent> onProgress = null, CancellationToken cancellationToken = null)` | Rebuilds into a scratch file, verifies it, and only then replaces the caller-supplied stream. Cancellation is honoured until commit starts; once commit begins it runs to completion so a cancellation cannot leave the original half-overwritten. |
+| `RebuildToStream` | `static int RebuildToStream(Stream input, Stream output, IArchiveFormatOperations ops, IArchiveCreatable creator, IReadOnlyDictionary<string, string> formatSpecific = null, IReadOnlySet<string> syntheticNames = null, Action<DefragProgressEvent> onProgress = null, CancellationToken cancellationToken = null)` | Extracts every live entry, re-creates the container in `output`, verifies the exact live-name multiset, and reports block-map/read/write-head progress suitable for the maintenance UI. |
+
+#### `SpoolingReadOnlyFileHandle`
+
+Transitional positional handle for native filesystem readers that can stream a file correctly but do not yet expose a seekable block/extent map. Small files stay in memory; large files are spooled to a delete-on-close temporary file. This preserves driver-style positional reads without imposing a whole- file RAM ceiling while the filesystem's direct block mapping is implemented.
+
+Implements `IDisposable`, `IFilesystemFileHandle`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `DefaultMemoryThreshold` | `const long DefaultMemoryThreshold` |  |
+| `Length` | `long Length { get; }` |  |
+| `NodeId` | `FilesystemNodeId NodeId { get; }` |  |
+| `Create` | `static SpoolingReadOnlyFileHandle Create(FilesystemNodeId nodeId, long expectedLength, Action<Stream> writeContent, long memoryThreshold = 8388608)` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Flush` | `void Flush()` |  |
+| `Read` | `int Read(long offset, Span<byte> destination)` |  |
+| `SetLength` | `void SetLength(long length)` |  |
+| `Write` | `void Write(long offset, ReadOnlySpan<byte> source)` |  |
+
+#### `StreamBlockDevice`
+
+Fixed-size random-access block device over an ordinary seekable stream. This is the bridge for raw filesystem images while parsers migrate away from direct Stream.Position access.
+
+Implements `IDisposable`, `IRandomAccessBlockDevice`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `StreamBlockDevice` | `StreamBlockDevice(Stream stream, int logicalBlockSize, bool writable, bool leaveOpen = true, int? physicalBlockSize = null)` |  |
+| `CanWrite` | `bool CanWrite { get; }` |  |
+| `Geometry` | `BlockDeviceGeometry Geometry { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Flush` | `void Flush()` |  |
+| `ReadBlocks` | `int ReadBlocks(long firstBlock, Span<byte> destination)` |  |
+| `Trim` | `void Trim(long firstBlock, long blockCount)` |  |
+| `WriteBlocks` | `void WriteBlocks(long firstBlock, ReadOnlySpan<byte> source)` |  |
 
 #### `SymlinkResolver`
 
diff --git a/Compression.Lib/ArchiveCompressionOptimizer.cs b/Compression.Lib/ArchiveCompressionOptimizer.cs
new file mode 100644
index 000000000..0ebbd7a21
--- /dev/null
+++ b/Compression.Lib/ArchiveCompressionOptimizer.cs
@@ -0,0 +1,154 @@
+using Compression.Registry;
+
+namespace Compression.Lib;
+
+/// <summary>
+/// Searches a creatable archive/container's finite option schema and keeps the
+/// smallest verified same-format rebuild. Unlike <see cref="CompressionOptimizer"/>,
+/// which optimizes one compressed stream, this optimizer works on multi-entry
+/// containers (compression method/level, dictionary, solid-block size, etc.).
+/// </summary>
+public static class ArchiveCompressionOptimizer {
+  public sealed record Result(long OriginalSize, long OptimizedSize, int EntriesOptimized,
+                              IReadOnlyDictionary<string, string> Parameters, int Probes);
+
+  public static Result Optimize(
+      string inputPath,
+      string outputPath,
+      IArchiveFormatOperations ops,
+      IArchiveCreatable creator,
+      IFormatOptionsSchema schema,
+      int maxCombinations = 256) {
+    ArgumentException.ThrowIfNullOrEmpty(inputPath);
+    ArgumentException.ThrowIfNullOrEmpty(outputPath);
+    ArgumentNullException.ThrowIfNull(ops);
+    ArgumentNullException.ThrowIfNull(creator);
+    ArgumentNullException.ThrowIfNull(schema);
+
+    var axes = SearchAxes(schema).ToArray();
+    var originalSize = new FileInfo(inputPath).Length;
+    var sourceEntries = CountLiveEntries(inputPath, ops);
+    var bestSize = originalSize;
+    var bestParameters = (IReadOnlyDictionary<string, string>)new Dictionary<string, string>();
+    string? bestPath = null;
+    var probes = 0;
+
+    try {
+      if (axes.Length > 0) {
+        long product = 1;
+        foreach (var axis in axes) {
+          product = checked(Math.Min((long)maxCombinations + 1, product * axis.Values.Count));
+          if (product > maxCombinations) break;
+        }
+
+        if (product <= maxCombinations) {
+          foreach (var combination in EnumerateCombinations(axes))
+            Probe(combination);
+        } else {
+          var current = axes.ToDictionary(a => a.Key, a => a.Default, StringComparer.Ordinal);
+          Probe(current);
+          var improved = true;
+          while (improved && probes < maxCombinations) {
+            improved = false;
+            foreach (var axis in axes) {
+              foreach (var value in axis.Values) {
+                if (probes >= maxCombinations) break;
+                if (current[axis.Key] == value) continue;
+                var trial = new Dictionary<string, string>(current, StringComparer.Ordinal) {
+                  [axis.Key] = value,
+                };
+                var before = bestSize;
+                Probe(trial);
+                if (bestSize < before) {
+                  current = trial;
+                  improved = true;
+                }
+              }
+            }
+          }
+        }
+      }
+
+      if (bestPath == null) {
+        AtomicFileWriter.WriteAtomic(outputPath, output => {
+          using var input = File.OpenRead(inputPath);
+          input.CopyTo(output);
+        });
+        return new Result(originalSize, originalSize, 0, bestParameters, probes);
+      }
+
+      AtomicFileWriter.WriteAtomic(outputPath, output => {
+        using var best = File.OpenRead(bestPath);
+        best.CopyTo(output);
+      });
+      return new Result(originalSize, bestSize, sourceEntries, bestParameters, probes);
+    } finally {
+      if (bestPath != null) TryDelete(bestPath);
+    }
+
+    void Probe(IReadOnlyDictionary<string, string> parameters) {
+      ++probes;
+      var candidatePath = Path.Combine(Path.GetTempPath(), "cwb_arcopt_" + Guid.NewGuid().ToString("N") + ".tmp");
+      try {
+        using (var input = File.OpenRead(inputPath))
+        using (var candidate = new FileStream(candidatePath, FileMode.CreateNew, FileAccess.ReadWrite, FileShare.None)) {
+          RebuildVerb.RebuildToStream(input, candidate, ops, creator, parameters);
+          candidate.Flush(flushToDisk: true);
+          if (candidate.Length >= bestSize) return;
+          bestSize = candidate.Length;
+        }
+
+        if (bestPath != null) TryDelete(bestPath);
+        bestPath = candidatePath;
+        candidatePath = "";
+        bestParameters = new Dictionary<string, string>(parameters, StringComparer.Ordinal);
+      } catch (Exception ex) when (ex is InvalidOperationException or NotSupportedException or IOException or ArgumentException) {
+        // An individual parameter combination may be invalid for the current
+        // content/profile. It is a rejected probe, not an optimization failure.
+      } finally {
+        if (!string.IsNullOrEmpty(candidatePath)) TryDelete(candidatePath);
+      }
+    }
+  }
+
+  private sealed record Axis(string Key, IReadOnlyList<string> Values, string Default);
+
+  private static IEnumerable<Axis> SearchAxes(IFormatOptionsSchema schema) {
+    foreach (var option in schema.OptionsSchema) {
+      IReadOnlyList<string>? values = option.Kind switch {
+        FormatOptionKind.Enum or FormatOptionKind.Integer when option.AllowedValues is { Count: > 1 }
+          => option.AllowedValues,
+        FormatOptionKind.Boolean => ["false", "true"],
+        _ => null,
+      };
+      if (values is { Count: > 1 })
+        yield return new Axis(option.Key, values, option.Default);
+    }
+  }
+
+  private static IEnumerable<IReadOnlyDictionary<string, string>> EnumerateCombinations(IReadOnlyList<Axis> axes) {
+    if (axes.Count == 0) yield break;
+    var indices = new int[axes.Count];
+    while (true) {
+      var result = new Dictionary<string, string>(axes.Count, StringComparer.Ordinal);
+      for (var i = 0; i < axes.Count; ++i) result[axes[i].Key] = axes[i].Values[indices[i]];
+      yield return result;
+
+      var position = axes.Count - 1;
+      while (position >= 0 && ++indices[position] == axes[position].Values.Count) {
+        indices[position] = 0;
+        --position;
+      }
+      if (position < 0) yield break;
+    }
+  }
+
+  private static int CountLiveEntries(string path, IArchiveFormatOperations ops) {
+    using var input = File.OpenRead(path);
+    return ops.List(input, null).Count(e => !e.IsDirectory);
+  }
+
+  private static void TryDelete(string path) {
+    try { File.Delete(path); } catch { /* best effort */ }
+  }
+}
diff --git a/Compression.Lib/CompactOperation.cs b/Compression.Lib/CompactOperation.cs
index ecce34ce6..4c067b1ad 100644
--- a/Compression.Lib/CompactOperation.cs
+++ b/Compression.Lib/CompactOperation.cs
@@ -4,59 +4,22 @@
 namespace Compression.Lib;
 
 /// <summary>
-/// The composite <c>compact</c> maintenance verb: <em>defrag → optimize →
-/// shrink</em>, run as one pass to produce the smallest valid container that
-/// still holds the same contents.
-/// <list type="bullet">
-///   <item><b>defrag</b> consolidates live data so it is contiguous;</item>
-///   <item><b>optimize</b> re-encodes the payload with the best methods (where
-///   the format is re-encodable);</item>
-///   <item><b>shrink</b> truncates the freed tail and steps the container down
-///   to the smallest canonical size that still fits.</item>
-/// </list>
-/// <para>With <see cref="CompactOptions.Minimal"/> the standard trio is replaced
-/// by a single <em>minimal-geometry rebuild</em>: the contents are extracted and
-/// the container re-created at the smallest geometry the format allows (auto-fit
-/// image size, smallest cluster, minimal root-directory entries). For a FAT
-/// floppy that turns a fixed 1.44&#160;MB image into a few-KB image whose
-/// root-directory and FAT are sized to exactly hold the data — smaller, but no
-/// longer a standard mountable floppy. Formats without geometry knobs fall back
-/// to the standard compact and say so via <see cref="CompactOptions.Log"/>.</para>
+/// Composite maintenance verb: defragment, optimize and shrink. Every stage is
+/// optional and selected from the descriptor's real capabilities.
 /// </summary>
 public static class CompactOperation {
-
-  /// <summary>Outcome of a compact pass.</summary>
-  /// <param name="OriginalSize">Container size before compacting, in bytes.</param>
-  /// <param name="NewSize">Container size after compacting, in bytes.</param>
-  /// <param name="StepsRun">Human-readable list of the steps that actually ran.</param>
-  /// <param name="Minimal">Whether the minimal-geometry rebuild was used.</param>
   public sealed record CompactResult(long OriginalSize, long NewSize, IReadOnlyList<string> StepsRun, bool Minimal);
 
-  /// <summary>Tunables for <see cref="Compact"/>.</summary>
   public sealed class CompactOptions {
-    /// <summary>
-    /// When true, rebuild the container at the smallest geometry the format
-    /// allows instead of the conservative defrag+optimize+shrink trio. The
-    /// result is the smallest possible file but may no longer be a
-    /// standard/mountable image of that type.
-    /// </summary>
     public bool Minimal { get; init; }
-    /// <summary>Password for encrypted source containers (read side).</summary>
     public string? Password { get; init; }
-    /// <summary>Optional progress/diagnostic sink — one line per step.</summary>
     public Action<string>? Log { get; init; }
   }
 
-  // Schema keys understood by the minimal-geometry rebuild, grouped by intent.
   private static readonly string[] SizeKeys = ["ImageSize", "TotalSize", "VolumeSize"];
   private static readonly string[] UnitKeys = ["ClusterSize", "BlockSize", "UnitSize", "AllocationUnit", "AllocSize"];
   private static readonly string[] CountKeys = ["RootEntries", "InodeCount", "InodeSize"];
 
-  /// <summary>
-  /// Compacts the container at <paramref name="path"/> in place. Live contents
-  /// are preserved byte-for-byte; only layout, encoding and (in
-  /// <see cref="CompactOptions.Minimal"/> mode) geometry change.
-  /// </summary>
   public static CompactResult Compact(string path, CompactOptions? options = null) {
     ArgumentException.ThrowIfNullOrEmpty(path);
     if (!File.Exists(path)) throw new FileNotFoundException("Container not found.", path);
@@ -67,10 +30,10 @@ public static CompactResult Compact(string path, CompactOptions? options = null)
     var originalSize = new FileInfo(path).Length;
     var format = FormatDetector.Detect(path);
     var formatId = format.ToString();
+    var descriptor = FormatRegistry.GetById(formatId);
     var ops = FormatRegistry.GetArchiveOps(formatId);
     var steps = new List<string>();
 
-    // ── Minimal: a single minimal-geometry rebuild replaces the whole trio ──
     if (options.Minimal) {
       if (ops is IArchiveCreatable && ops is IFormatOptionsSchema schema
           && SelectMinimalGeometry(schema) is { Count: > 0 } minimal) {
@@ -81,7 +44,6 @@ public static CompactResult Compact(string path, CompactOptions? options = null)
       log($"compact: '{formatId}' exposes no minimal-geometry knobs — running standard compact instead.");
     }
 
-    // ── 1) Defragment — consolidate live data at the start ──────────────────
     if (ops is IArchiveDefragmentable defragmentable) {
       try {
         using var stream = File.Open(path, FileMode.Open, FileAccess.ReadWrite);
@@ -93,9 +55,7 @@ public static CompactResult Compact(string path, CompactOptions? options = null)
       }
     }
 
-    // ── 2) Optimize — re-encode the payload where the format is re-encodable ─
     if (formatId is "DoubleSpace" or "DriveSpace" or "DriveSpace3") {
-      var descriptor = FormatRegistry.GetById(formatId);
       if (descriptor != null) {
         try {
           var r = CvfOptimizer.Optimize(path, descriptor);
@@ -105,6 +65,30 @@ public static CompactResult Compact(string path, CompactOptions? options = null)
           log($"optimize: skipped ({ex.GetType().Name}: {ex.Message}).");
         }
       }
+    } else if (descriptor?.Capabilities.HasFlag(FormatCapabilities.SupportsOptimize) == true
+               && ops is IArchiveCreatable creator
+               && ops is IFormatOptionsSchema archiveSchema
+               && archiveSchema.OptionsSchema.Count > 0
+               && format != F.Zip
+               && !FormatDetector.IsStreamFormat(format)
+               && !FormatDetector.GetTarCompression(format).HasValue) {
+      // Multi-entry containers with their own finite creation schema (EWF,
+      // SquashFS, etc.) need the archive optimizer, not the stream optimizer.
+      // It searches the declared axes and accepts only verified same-format
+      // rebuilds smaller than the source; otherwise it copies through unchanged.
+      var tempOut = path + ".compact-arcopt.tmp";
+      try {
+        var r = ArchiveCompressionOptimizer.Optimize(path, tempOut, ops, creator, archiveSchema);
+        File.Move(tempOut, path, overwrite: true);
+        steps.Add("optimize");
+        log(r.OptimizedSize < r.OriginalSize
+          ? $"optimize: {r.OriginalSize:N0} → {r.OptimizedSize:N0} bytes across {r.Probes} parameter probe(s)."
+          : $"optimize: no smaller verified representation after {r.Probes} parameter probe(s).");
+      } catch (Exception ex) {
+        log($"optimize: skipped ({ex.GetType().Name}: {ex.Message}).");
+      } finally {
+        if (File.Exists(tempOut)) try { File.Delete(tempOut); } catch { }
+      }
     } else if (format == F.Zip || FormatDetector.IsStreamFormat(format)
                || FormatDetector.GetTarCompression(format).HasValue) {
       var tempOut = path + ".compact-opt.tmp";
@@ -116,11 +100,10 @@ public static CompactResult Compact(string path, CompactOptions? options = null)
       } catch (Exception ex) {
         log($"optimize: skipped ({ex.GetType().Name}: {ex.Message}).");
       } finally {
-        if (File.Exists(tempOut)) try { File.Delete(tempOut); } catch { /* best effort */ }
+        if (File.Exists(tempOut)) try { File.Delete(tempOut); } catch { }
       }
     }
 
-    // ── 3) Shrink — truncate freed tail / step down to the smallest size ────
     if (ops is IArchiveShrinkable shrinkable) {
       var tempOut = path + ".compact-shrink.tmp";
       try {
@@ -139,41 +122,29 @@ public static CompactResult Compact(string path, CompactOptions? options = null)
       } catch (Exception ex) {
         log($"shrink: skipped ({ex.GetType().Name}: {ex.Message}).");
       } finally {
-        if (File.Exists(tempOut)) try { File.Delete(tempOut); } catch { /* best effort */ }
+        if (File.Exists(tempOut)) try { File.Delete(tempOut); } catch { }
       }
     }
 
     return new CompactResult(originalSize, new FileInfo(path).Length, steps, Minimal: false);
   }
 
-  /// <summary>
-  /// Extracts every entry, then re-creates the container at minimal geometry
-  /// using the format's creation path. The swap only happens when the rebuilt
-  /// image both round-trips (lists at least as many entries as the source) and
-  /// is no larger than the original — otherwise the source is left untouched.
-  /// </summary>
   private static void TryMinimalRebuild(string path, F format,
       IReadOnlyDictionary<string, string> minimalGeometry, string? password, Action<string> log) {
     var sourceEntryCount = SafeFileCount(path, password);
     var tempDir = Path.Combine(Path.GetTempPath(), "cwb_compact_" + Guid.NewGuid().ToString("N")[..8]);
-    // Keep the original extension so the rebuilt image still content/extension-
-    // detects as the same format when we re-list it for the safety check
-    // (weak-magic formats like FAT lean on the extension).
     var tempOut = Path.Combine(Path.GetDirectoryName(Path.GetFullPath(path))!,
       Path.GetFileNameWithoutExtension(path) + ".compact-min" + Path.GetExtension(path));
     try {
       Directory.CreateDirectory(tempDir);
       ArchiveOperations.Extract(path, tempDir, password, files: null);
       var inputs = ArchiveOperations.EnumerateTempInputs(tempDir);
-
       ArchiveOperations.Create(tempOut, inputs,
-        new CompressionOptions { Password = password },
-        format, minimalGeometry);
+        new CompressionOptions { Password = password }, format, minimalGeometry);
 
       var rebuiltCount = SafeFileCount(tempOut, password);
       var rebuiltLen = new FileInfo(tempOut).Length;
       var originalLen = new FileInfo(path).Length;
-
       if (rebuiltCount < sourceEntryCount) {
         log($"minimal rebuild: aborted — rebuilt image lists {rebuiltCount} file(s) vs {sourceEntryCount}; keeping original.");
         return;
@@ -186,33 +157,22 @@ private static void TryMinimalRebuild(string path, F format,
       log($"minimal rebuild: re-created at minimal geometry — {originalLen:N0} → {rebuiltLen:N0} bytes "
           + $"({string.Join(", ", minimalGeometry.Select(kv => $"{kv.Key}={kv.Value}"))}).");
     } finally {
-      if (Directory.Exists(tempDir)) try { Directory.Delete(tempDir, recursive: true); } catch { /* best effort */ }
-      if (File.Exists(tempOut)) try { File.Delete(tempOut); } catch { /* best effort */ }
+      if (Directory.Exists(tempDir)) try { Directory.Delete(tempDir, recursive: true); } catch { }
+      if (File.Exists(tempOut)) try { File.Delete(tempOut); } catch { }
     }
   }
 
   private static int SafeFileCount(string path, string? password) {
-    try {
-      return ArchiveOperations.List(path, password).Count(e => !e.IsDirectory);
-    } catch {
-      return 0;
-    }
+    try { return ArchiveOperations.List(path, password).Count(e => !e.IsDirectory); }
+    catch { return 0; }
   }
 
-  /// <summary>
-  /// Picks the smallest-footprint value for each geometry knob the schema
-  /// exposes: auto-fit for the image size, the smallest concrete allocation
-  /// unit, and the smallest root/inode count. Only keys we understand are set;
-  /// everything else stays at its writer default.
-  /// </summary>
   private static Dictionary<string, string> SelectMinimalGeometry(IFormatOptionsSchema schema) {
     var result = new Dictionary<string, string>(StringComparer.Ordinal);
     var hasRealKnob = false;
     foreach (var opt in schema.OptionsSchema) {
       if (opt.AllowedValues is not { Count: > 0 } allowed) continue;
-
       if (MatchesAny(opt.Key, SizeKeys)) {
-        // Auto-fit-to-contents is the minimal image size.
         var auto = allowed.FirstOrDefault(v =>
           v.Contains("Auto", StringComparison.OrdinalIgnoreCase)
           || v.Contains("fit", StringComparison.OrdinalIgnoreCase));
@@ -225,8 +185,6 @@ private static Dictionary<string, string> SelectMinimalGeometry(IFormatOptionsSc
         if (smallest != null) { result[opt.Key] = smallest; hasRealKnob = true; }
       }
     }
-    // Only a format with a real geometry knob gets the minimal-rebuild path.
-    // The universal opt-in flag tells the writer to drop its size headroom.
     if (!hasRealKnob) return [];
     result["MinimalGeometry"] = "true";
     return result;
@@ -235,53 +193,52 @@ private static Dictionary<string, string> SelectMinimalGeometry(IFormatOptionsSc
   private static bool MatchesAny(string key, string[] candidates)
     => candidates.Any(c => string.Equals(key, c, StringComparison.OrdinalIgnoreCase));
 
-  /// <summary>Returns the allowed value with the smallest parsed byte size (ignoring "Auto").</summary>
   private static string? SmallestByBytes(IReadOnlyList<string> allowed) {
     string? best = null;
     var bestBytes = long.MaxValue;
-    foreach (var v in allowed) {
-      var b = ParseByteSize(v);
-      if (b <= 0) continue;
-      if (b < bestBytes) { bestBytes = b; best = v; }
+    foreach (var value in allowed) {
+      var bytes = ParseByteSize(value);
+      if (bytes <= 0 || bytes >= bestBytes) continue;
+      bestBytes = bytes;
+      best = value;
     }
     return best;
   }
 
-  /// <summary>Returns the allowed value with the smallest leading integer (ignoring "Auto").</summary>
   private static string? SmallestByLeadingInt(IReadOnlyList<string> allowed) {
     string? best = null;
-    var bestN = long.MaxValue;
-    foreach (var v in allowed) {
-      var n = ParseLeadingInt(v);
-      if (n <= 0) continue;
-      if (n < bestN) { bestN = n; best = v; }
+    var bestNumber = long.MaxValue;
+    foreach (var value in allowed) {
+      var number = ParseLeadingInt(value);
+      if (number <= 0 || number >= bestNumber) continue;
+      bestNumber = number;
+      best = value;
     }
     return best;
   }
 
-  /// <summary>Parses "512 B" / "1 KB" / "32 KB" / "1.44 MB" → bytes; 0 if not a size.</summary>
-  private static long ParseByteSize(string s) {
-    var t = s.Trim();
+  private static long ParseByteSize(string text) {
+    var value = text.Trim();
     var i = 0;
-    while (i < t.Length && (char.IsDigit(t[i]) || t[i] is '.' or ',')) i++;
+    while (i < value.Length && (char.IsDigit(value[i]) || value[i] is '.' or ',')) ++i;
     if (i == 0) return 0;
-    if (!double.TryParse(t[..i].Replace(',', '.'), System.Globalization.NumberStyles.Float,
-        System.Globalization.CultureInfo.InvariantCulture, out var num)) return 0;
-    var rest = t[i..].TrimStart().ToUpperInvariant();
-    long mult = rest switch {
+    if (!double.TryParse(value[..i].Replace(',', '.'), System.Globalization.NumberStyles.Float,
+        System.Globalization.CultureInfo.InvariantCulture, out var number)) return 0;
+    var rest = value[i..].TrimStart().ToUpperInvariant();
+    long multiplier = rest switch {
       var r when r.StartsWith("KB") || r.StartsWith("K") => 1024L,
       var r when r.StartsWith("MB") || r.StartsWith("M") => 1024L * 1024,
       var r when r.StartsWith("GB") || r.StartsWith("G") => 1024L * 1024 * 1024,
       var r when r.StartsWith('B') || r.Length == 0 => 1L,
       _ => 0L,
     };
-    return (long)(num * mult);
+    return (long)(number * multiplier);
   }
 
-  private static long ParseLeadingInt(string s) {
-    var t = s.Trim();
+  private static long ParseLeadingInt(string text) {
+    var value = text.Trim();
     var i = 0;
-    while (i < t.Length && char.IsDigit(t[i])) i++;
-    return i > 0 && long.TryParse(t[..i], out var n) ? n : 0;
+    while (i < value.Length && char.IsDigit(value[i])) ++i;
+    return i > 0 && long.TryParse(value[..i], out var number) ? number : 0;
   }
 }
diff --git a/Compression.Lib/Compression.Lib.csproj b/Compression.Lib/Compression.Lib.csproj
index 8e2da84b2..226a5df95 100644
--- a/Compression.Lib/Compression.Lib.csproj
+++ b/Compression.Lib/Compression.Lib.csproj
@@ -627,4 +627,11 @@
     <ProjectReference Include="..\FileFormats\FileFormat.Amr\FileFormat.Amr.csproj" />
   </ItemGroup>
 
+  <!-- Driver-coverage invariant: every FileSystem.* assembly must be visible
+       to Compression.Registry.Generator, including newly added projects. -->
+  <ItemGroup>
+    <ProjectReference Remove="..\FileSystems\FileSystem.*\FileSystem.*.csproj" />
+    <ProjectReference Include="..\FileSystems\FileSystem.*\FileSystem.*.csproj" />
+  </ItemGroup>
+
 </Project>
diff --git a/Compression.Lib/FormatRegistration.cs b/Compression.Lib/FormatRegistration.cs
index ad1f0fd42..28469e282 100644
--- a/Compression.Lib/FormatRegistration.cs
+++ b/Compression.Lib/FormatRegistration.cs
@@ -1,3 +1,4 @@
+using System.Runtime.ExceptionServices;
 using Compression.Core.DiskImage;
 using Compression.Lib.FsConversion;
 using Compression.Registry;
@@ -6,45 +7,29 @@ namespace Compression.Lib;
 
 /// <summary>
 /// Registers all format descriptors with the central registry.
-/// The <c>RegisterFormats()</c> partial method is generated at compile time by
-/// <c>Compression.Registry.Generator</c>, which discovers all public classes implementing
-/// <c>IFormatDescriptor</c> with a parameterless constructor across referenced assemblies.
-/// Compound tar descriptors are registered manually since they are composites, not standalone formats.
+/// The generated partial methods discover descriptors, building blocks and
+/// filesystem-driver sidecars across referenced assemblies without reflection.
 /// </summary>
 public static partial class FormatRegistration {
   private static int _initStarted;
   private static readonly ManualResetEventSlim _initDone = new(initialState: false);
+  private static ExceptionDispatchInfo? _initFailure;
 
-  /// <summary>True iff the registry is fully populated and safe to enumerate.</summary>
-  public static bool IsReady => _initDone.IsSet;
+  /// <summary>True iff the registry completed successfully and is safe to enumerate.</summary>
+  public static bool IsReady => _initDone.IsSet && _initFailure == null;
 
-  /// <summary>
-  /// Async-friendly variant of <see cref="EnsureInitialized"/>. Returns a
-  /// completed task immediately if the registry is already populated;
-  /// otherwise dispatches the registration to a worker thread and yields the
-  /// resulting task so UI callers can <c>await</c> it without blocking the
-  /// dispatcher. The UI sets a busy cursor + status line while awaiting,
-  /// giving the user a "loading…" hint instead of an apparent freeze.
-  /// </summary>
   public static System.Threading.Tasks.Task EnsureInitializedAsync() {
-    if (_initDone.IsSet) return System.Threading.Tasks.Task.CompletedTask;
+    if (_initDone.IsSet) {
+      _initFailure?.Throw();
+      return System.Threading.Tasks.Task.CompletedTask;
+    }
     return System.Threading.Tasks.Task.Run(EnsureInitialized);
   }
 
-  /// <summary>
-  /// Ensures all format descriptors and building blocks are registered exactly once.
-  /// Thread-safe: the first caller runs the registration; concurrent callers
-  /// WAIT for it to finish (rather than seeing a half-populated
-  /// <see cref="FormatRegistry"/>). The earlier "flip flag and return" pattern
-  /// caused a race: a background warm-up Task that had set the flag but not
-  /// yet finished registering would let a synchronous caller through with an
-  /// empty registry, producing "No creatable formats are registered." popups.
-  /// </summary>
   public static void EnsureInitialized() {
     if (Interlocked.CompareExchange(ref _initStarted, 1, 0) != 0) {
-      // Another thread is already registering — wait for it to finish so the
-      // registry is fully populated before we return.
       _initDone.Wait();
+      _initFailure?.Throw();
       return;
     }
 
@@ -52,40 +37,43 @@ public static void EnsureInitialized() {
       RegisterFormats();
       RegisterCompoundTar();
       RegisterBuildingBlocks();
+      RegisterFilesystemDrivers();
       FormatRegistry.Initialize();
 
-      // Wire the in-place FS-variant converter delegate so PartitionEditor.
-      // ConvertFilesystem can dispatch FAT12↔16↔32 and ext2→3→4 conversions
-      // without taking a hard dependency on Compression.Lib from Compression.Core.
       PartitionEditor.InPlaceFilesystemConverter = (stream, srcId, dstId)
         => InPlaceConverter.TryConvert(stream, srcId, dstId)
            is InPlaceConversionResult.Succeeded or InPlaceConversionResult.NoOp;
 
-      // Wire the in-place FS-resizer delegate so PartitionEditor.ResizePartition
-      // can dispatch FAT shrink/grow and ext shrink/grow without a Core →
-      // FileSystem.* dependency.
       PartitionEditor.InPlaceFilesystemResizer = (stream, fsId, newSize, isShrink) => {
         if (!FilesystemResizer.IsSupported(fsId)) return false;
         if (isShrink) FilesystemResizer.Shrink(stream, fsId, newSize);
         else FilesystemResizer.Grow(stream, fsId, newSize);
         return true;
       };
+    } catch (Exception e) {
+      // Registration is deliberately one-shot. Once constructor side effects have
+      // populated the registries, blindly retrying would create duplicate entries.
+      // Preserve and rethrow the original failure for every concurrent/later caller
+      // instead of letting waiters observe a false-success half registry.
+      _initFailure = ExceptionDispatchInfo.Capture(e);
+      throw;
     } finally {
       _initDone.Set();
     }
   }
 
-  /// <summary>
-  /// Generated by Compression.Registry.Generator — calls FormatRegistry.Register()
-  /// for every discovered format descriptor. Falls back to no-op if generator is not wired up.
-  /// </summary>
+  /// <summary>Generated by Compression.Registry.Generator.</summary>
   static partial void RegisterFormats();
 
+  /// <summary>Generated by Compression.Registry.Generator.</summary>
+  static partial void RegisterBuildingBlocks();
+
   /// <summary>
-  /// Generated by Compression.Registry.Generator — calls BuildingBlockRegistry.Register()
-  /// for every discovered building block. Falls back to no-op if generator is not wired up.
+  /// Generated by Compression.Registry.Generator. Registers public parameterless
+  /// <see cref="IFilesystemDriverAdapter"/> implementations after their format
+  /// descriptors and before the registry is finalized.
   /// </summary>
-  static partial void RegisterBuildingBlocks();
+  static partial void RegisterFilesystemDrivers();
 
   private static void RegisterCompoundTar() {
     FormatRegistry.Register(new CompoundTarDescriptor("TarGz", "tar.gz", "Gzip", ".tar.gz", [".tar.gz", ".tgz"]));
diff --git a/Compression.Mounting.Dokan/Compression.Mounting.Dokan.csproj b/Compression.Mounting.Dokan/Compression.Mounting.Dokan.csproj
new file mode 100644
index 000000000..cf89eb6d5
--- /dev/null
+++ b/Compression.Mounting.Dokan/Compression.Mounting.Dokan.csproj
@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <RootNamespace>Compression.Mounting.Dokan</RootNamespace>
+    <GenerateDocumentationFile>false</GenerateDocumentationFile>
+    <NoWarn>CS1591</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Compression.Mounting\Compression.Mounting.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/Compression.Mounting.Dokan/DokanFilesystemMountBackend.cs b/Compression.Mounting.Dokan/DokanFilesystemMountBackend.cs
new file mode 100644
index 000000000..93797a86f
--- /dev/null
+++ b/Compression.Mounting.Dokan/DokanFilesystemMountBackend.cs
@@ -0,0 +1,56 @@
+using Compression.Registry;
+
+namespace Compression.Mounting.Dokan;
+
+/// <summary>
+/// Dokany 2 backend boundary. The runtime probe is real, but mount-mode support
+/// remains disabled until the callback bridge has passed backend conformance.
+/// </summary>
+public sealed class DokanFilesystemMountBackend : IFilesystemMountBackend {
+  private readonly DokanRuntimeStatus _runtime;
+
+  public DokanFilesystemMountBackend()
+    : this(DokanRuntimeProbe.Probe()) { }
+
+  public DokanFilesystemMountBackend(DokanRuntimeStatus runtime)
+    => this._runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
+
+  public DokanRuntimeStatus RuntimeStatus => this._runtime;
+
+  public MountBackendProfile GetProfile() {
+    var limitations = new List<string>();
+    if (!this._runtime.IsAvailable)
+      limitations.Add(this._runtime.UnavailableReason ?? "Dokany 2 runtime is unavailable.");
+    limitations.Add(
+      "The Dokan callback bridge has not been qualified yet; read-only and read-write mounting are intentionally disabled."
+    );
+
+    return new(
+      Id: "dokan",
+      DisplayName: "Dokany 2",
+      IsAvailable: this._runtime.IsAvailable,
+      SupportsReadOnly: false,
+      SupportsReadWrite: false,
+      RequiredReadCapabilities: FilesystemDriverCapabilities.None,
+      RequiredWriteCapabilities: FilesystemDriverCapabilities.None,
+      Limitations: limitations
+    );
+  }
+
+  public ValueTask<IMountSession> MountAsync(
+    FilesystemMountRequest request,
+    CancellationToken cancellationToken = default
+  ) {
+    ArgumentNullException.ThrowIfNull(request);
+    cancellationToken.ThrowIfCancellationRequested();
+
+    if (!this._runtime.IsAvailable)
+      throw new PlatformNotSupportedException(
+        this._runtime.UnavailableReason ?? "Dokany 2 runtime is unavailable."
+      );
+
+    throw new NotSupportedException(
+      "The Dokan callback bridge is not implemented yet; this backend deliberately advertises no supported mount mode."
+    );
+  }
+}
diff --git a/Compression.Mounting.Dokan/DokanRuntimeProbe.cs b/Compression.Mounting.Dokan/DokanRuntimeProbe.cs
new file mode 100644
index 000000000..82930ffaf
--- /dev/null
+++ b/Compression.Mounting.Dokan/DokanRuntimeProbe.cs
@@ -0,0 +1,89 @@
+using System.Runtime.InteropServices;
+
+namespace Compression.Mounting.Dokan;
+
+public sealed record DokanRuntimeStatus(
+  bool IsAvailable,
+  uint LibraryVersion,
+  uint DriverVersion,
+  string? LibraryPath,
+  string? UnavailableReason
+);
+
+/// <summary>
+/// Probes the native Dokany 2 user-mode library and its kernel driver without
+/// registering a filesystem or requiring administrator privileges.
+/// </summary>
+public static class DokanRuntimeProbe {
+  private const string LibraryFileName = "dokan2.dll";
+  private const string LibraryVersionExport = "DokanVersion";
+  private const string DriverVersionExport = "DokanDriverVersion";
+
+  [UnmanagedFunctionPointer(CallingConvention.Winapi)]
+  private delegate uint VersionProcedure();
+
+  public static DokanRuntimeStatus Probe() {
+    if (!OperatingSystem.IsWindows())
+      return Unavailable("Dokan is a Windows-only mount backend.");
+
+    var candidates = new[] {
+      Path.Combine(AppContext.BaseDirectory, LibraryFileName),
+      Path.Combine(Environment.SystemDirectory, LibraryFileName),
+    }.Distinct(StringComparer.OrdinalIgnoreCase);
+
+    string? lastFailure = null;
+    foreach (var candidate in candidates) {
+      if (!File.Exists(candidate)) continue;
+
+      IntPtr library = IntPtr.Zero;
+      try {
+        if (!NativeLibrary.TryLoad(candidate, out library)) {
+          lastFailure = $"Found '{candidate}' but the native loader rejected it.";
+          continue;
+        }
+
+        if (!TryGetVersionProcedure(library, LibraryVersionExport, out var libraryVersionProcedure))
+          return Unavailable($"'{candidate}' does not export {LibraryVersionExport}().", candidate);
+        if (!TryGetVersionProcedure(library, DriverVersionExport, out var driverVersionProcedure))
+          return Unavailable($"'{candidate}' does not export {DriverVersionExport}().", candidate);
+
+        var libraryVersion = libraryVersionProcedure();
+        var driverVersion = driverVersionProcedure();
+        if (libraryVersion == 0)
+          return new(false, 0, driverVersion, candidate, "DokanVersion() returned 0.");
+        if (driverVersion == 0)
+          return new(
+            false,
+            libraryVersion,
+            0,
+            candidate,
+            "The Dokan user-mode library is present, but DokanDriverVersion() returned 0; the Dokan 2 driver is unavailable or could not be queried."
+          );
+
+        return new(true, libraryVersion, driverVersion, candidate, null);
+      } catch (BadImageFormatException ex) {
+        lastFailure = $"'{candidate}' has the wrong architecture or is not a valid native library: {ex.Message}";
+      } catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException) {
+        lastFailure = $"Unable to use '{candidate}': {ex.Message}";
+      } finally {
+        if (library != IntPtr.Zero)
+          NativeLibrary.Free(library);
+      }
+    }
+
+    return Unavailable(lastFailure ?? $"{LibraryFileName} was not found beside the application or in the Windows system directory.");
+  }
+
+  private static bool TryGetVersionProcedure(IntPtr library, string export, out VersionProcedure procedure) {
+    if (NativeLibrary.TryGetExport(library, export, out var address)) {
+      procedure = Marshal.GetDelegateForFunctionPointer<VersionProcedure>(address);
+      return true;
+    }
+
+    procedure = null!;
+    return false;
+  }
+
+  private static DokanRuntimeStatus Unavailable(string reason, string? libraryPath = null)
+    => new(false, 0, 0, libraryPath, reason);
+}
diff --git a/Compression.Mounting.Dokan/README.md b/Compression.Mounting.Dokan/README.md
new file mode 100644
index 000000000..37b4a1e40
--- /dev/null
+++ b/Compression.Mounting.Dokan/README.md
@@ -0,0 +1,7 @@
+# Compression.Mounting.Dokan
+
+Windows Dokany 2 adapter for the mount-neutral `Compression.Mounting` contracts.
+
+The first slice is intentionally limited to a real runtime probe and a truthful backend profile. It checks the application directory and Windows system directory for `dokan2.dll`, resolves `DokanVersion` and `DokanDriverVersion`, and only reports the runtime as available when both the user-mode library and kernel driver answer successfully.
+
+No filesystem callback is advertised yet. `SupportsReadOnly` and `SupportsReadWrite` remain false until the stable-node-ID callback bridge and its conformance tests exist. A present DLL is not treated as evidence that read or write mounting works.
diff --git a/Compression.Mounting/Compression.Mounting.csproj b/Compression.Mounting/Compression.Mounting.csproj
new file mode 100644
index 000000000..b227880c9
--- /dev/null
+++ b/Compression.Mounting/Compression.Mounting.csproj
@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <RootNamespace>Compression.Mounting</RootNamespace>
+    <GenerateDocumentationFile>false</GenerateDocumentationFile>
+    <NoWarn>CS1591</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Compression.Registry\Compression.Registry.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/Compression.Mounting/FilesystemMountCapabilityResolver.cs b/Compression.Mounting/FilesystemMountCapabilityResolver.cs
new file mode 100644
index 000000000..db6f1bbc5
--- /dev/null
+++ b/Compression.Mounting/FilesystemMountCapabilityResolver.cs
@@ -0,0 +1,93 @@
+using Compression.Registry;
+
+namespace Compression.Mounting;
+
+public static class FilesystemMountCapabilityResolver {
+  public const FilesystemDriverCapabilities CoreReadCapabilities =
+    FilesystemDriverCapabilities.EnumerateDirectories |
+    FilesystemDriverCapabilities.ReadData |
+    FilesystemDriverCapabilities.RandomAccess |
+    FilesystemDriverCapabilities.StableNodeIds;
+
+  public const FilesystemDriverCapabilities CoreWriteCapabilities =
+    FilesystemDriverCapabilities.WriteData |
+    FilesystemDriverCapabilities.Truncate |
+    FilesystemDriverCapabilities.CreateFile |
+    FilesystemDriverCapabilities.DeleteFile |
+    FilesystemDriverCapabilities.CreateDirectory |
+    FilesystemDriverCapabilities.RemoveDirectory |
+    FilesystemDriverCapabilities.Rename |
+    FilesystemDriverCapabilities.Flush;
+
+  public static MountPlan Resolve(
+    FilesystemDriverProfile driverProfile,
+    MountBackendProfile backend,
+    MountAccessMode accessMode,
+    bool sourceCanWrite
+  ) {
+    ArgumentNullException.ThrowIfNull(driverProfile);
+    ArgumentNullException.ThrowIfNull(backend);
+
+    var reasons = new List<MountSupportReason>();
+    var requiredRead = CoreReadCapabilities | backend.RequiredReadCapabilities;
+    var required = requiredRead;
+
+    if (!backend.IsAvailable)
+      reasons.Add(new(MountSupportReasonCode.BackendUnavailable, $"Mount backend '{backend.DisplayName}' is not available on this host."));
+
+    if (!backend.SupportsReadOnly)
+      reasons.Add(new(MountSupportReasonCode.BackendDoesNotSupportReadOnly, $"Mount backend '{backend.DisplayName}' does not support filesystem reads."));
+
+    if (!driverProfile.CanMount)
+      reasons.Add(new(MountSupportReasonCode.FilesystemProfileNotMountable, $"Filesystem profile '{driverProfile.ProfileName}' is not mount-grade."));
+
+    var missingRead = requiredRead & ~driverProfile.Capabilities;
+    if (missingRead != FilesystemDriverCapabilities.None)
+      reasons.Add(MissingCapabilitiesReason(missingRead, "read-only"));
+
+    if (accessMode == MountAccessMode.ReadWrite) {
+      required |= CoreWriteCapabilities | backend.RequiredWriteCapabilities;
+
+      if (!backend.SupportsReadWrite)
+        reasons.Add(new(MountSupportReasonCode.BackendDoesNotSupportReadWrite, $"Mount backend '{backend.DisplayName}' does not support writable mounts."));
+
+      if (!driverProfile.CanMountWritable)
+        reasons.Add(new(MountSupportReasonCode.FilesystemProfileNotWritable, $"Filesystem profile '{driverProfile.ProfileName}' does not advertise writable mounting."));
+
+      if (!sourceCanWrite)
+        reasons.Add(new(MountSupportReasonCode.SourceIsReadOnly, "The backing image or an outer container layer is read-only."));
+
+      if (driverProfile.MutationModel is FilesystemMutationModel.None or FilesystemMutationModel.WholeImageRebuild)
+        reasons.Add(new(MountSupportReasonCode.UnsupportedMutationModel, $"Mutation model '{driverProfile.MutationModel}' is not suitable for mounted random writes."));
+
+      var missingWrite = (CoreWriteCapabilities | backend.RequiredWriteCapabilities) & ~driverProfile.Capabilities;
+      if (missingWrite != FilesystemDriverCapabilities.None)
+        reasons.Add(MissingCapabilitiesReason(missingWrite, "read-write"));
+    }
+
+    var missing = required & ~driverProfile.Capabilities;
+    var limitations = driverProfile.Limitations.Concat(backend.Limitations).Distinct(StringComparer.Ordinal).ToArray();
+
+    return new(
+      accessMode,
+      reasons.Count == 0,
+      driverProfile,
+      backend,
+      required,
+      missing,
+      reasons,
+      limitations
+    );
+  }
+
+  private static MountSupportReason MissingCapabilitiesReason(FilesystemDriverCapabilities missing, string mode)
+    => new(
+      MountSupportReasonCode.MissingDriverCapabilities,
+      $"Filesystem profile is missing {mode} mount primitives: {FormatCapabilities(missing)}.",
+      missing
+    );
+
+  private static string FormatCapabilities(FilesystemDriverCapabilities capabilities)
+    => string.Join(", ", Enum.GetValues<FilesystemDriverCapabilities>()
+      .Where(value => value != FilesystemDriverCapabilities.None && (value & (value - 1)) == 0 && capabilities.HasFlag(value)));
+}
diff --git a/Compression.Mounting/FilesystemMountLauncher.cs b/Compression.Mounting/FilesystemMountLauncher.cs
new file mode 100644
index 000000000..1f80862f8
--- /dev/null
+++ b/Compression.Mounting/FilesystemMountLauncher.cs
@@ -0,0 +1,119 @@
+using Compression.Registry;
+
+namespace Compression.Mounting;
+
+/// <summary>
+/// Opens a backing image and filesystem session for one already-selected mount
+/// request. Capability policy is re-evaluated against the exact stream and the
+/// opened session immediately before the backend receives ownership.
+/// </summary>
+public sealed class FilesystemMountLauncher(MountBackendRegistry backends) {
+  private readonly MountBackendRegistry _backends = backends ?? throw new ArgumentNullException(nameof(backends));
+
+  public async ValueTask<IMountSession> MountAsync(
+    string imagePath,
+    string formatId,
+    MountPlan requestedPlan,
+    string target,
+    CancellationToken cancellationToken = default
+  ) {
+    ArgumentException.ThrowIfNullOrWhiteSpace(imagePath);
+    ArgumentException.ThrowIfNullOrWhiteSpace(formatId);
+    ArgumentNullException.ThrowIfNull(requestedPlan);
+    ArgumentException.ThrowIfNullOrWhiteSpace(target);
+    cancellationToken.ThrowIfCancellationRequested();
+
+    if (!FormatRegistry.FilesystemFormatIds.Contains(formatId, StringComparer.OrdinalIgnoreCase))
+      throw new ArgumentException($"Format '{formatId}' is not registered as a filesystem.", nameof(formatId));
+
+    var backend = this._backends.GetBackend(requestedPlan.BackendId);
+    FileStream? source = null;
+    IFilesystemSession? filesystem = null;
+    var ownershipTransferred = false;
+
+    try {
+      source = OpenBackingSource(imagePath, requestedPlan.AccessMode);
+
+      var probePosition = source.CanSeek ? source.Position : 0;
+      FilesystemDriverProfile probedProfile;
+      try {
+        probedProfile = FormatRegistry.ProbeFilesystem(formatId, source);
+      } finally {
+        if (source.CanSeek)
+          source.Position = probePosition;
+      }
+
+      var resolvedPlan = this._backends.ResolveFilesystem(
+        requestedPlan.BackendId,
+        probedProfile,
+        requestedPlan.AccessMode,
+        source.CanWrite
+      );
+      EnsureSupported(resolvedPlan);
+
+      filesystem = FormatRegistry.OpenFilesystem(
+        formatId,
+        source,
+        new FilesystemOpenOptions(
+          ReadOnly: requestedPlan.AccessMode == MountAccessMode.ReadOnly,
+          LeaveOpen: false
+        )
+      );
+
+      // OpenFilesystem is allowed to specialize the profile further than Probe.
+      // Re-resolve once more so the backend never receives a session whose exact
+      // opened profile is weaker than the plan shown by the probe.
+      resolvedPlan = this._backends.ResolveFilesystem(
+        requestedPlan.BackendId,
+        filesystem.Profile,
+        requestedPlan.AccessMode,
+        source.CanWrite
+      );
+      EnsureSupported(resolvedPlan);
+
+      cancellationToken.ThrowIfCancellationRequested();
+      var mounted = await backend.MountAsync(
+        new FilesystemMountRequest(filesystem, target, resolvedPlan, OwnsFilesystemSession: true),
+        cancellationToken
+      ).ConfigureAwait(false);
+
+      ownershipTransferred = true;
+      filesystem = null;
+      source = null;
+      return mounted;
+    } finally {
+      if (!ownershipTransferred) {
+        filesystem?.Dispose();
+        source?.Dispose();
+      }
+    }
+  }
+
+  private static FileStream OpenBackingSource(string path, MountAccessMode accessMode)
+    => accessMode switch {
+      MountAccessMode.ReadOnly => new(path, FileMode.Open, FileAccess.Read, FileShare.Read),
+      MountAccessMode.ReadWrite => new(path, FileMode.Open, FileAccess.ReadWrite, FileShare.Read),
+      _ => throw new ArgumentOutOfRangeException(nameof(accessMode), accessMode, "Unknown mount access mode."),
+    };
+
+  private static void EnsureSupported(MountPlan plan) {
+    if (plan.IsSupported) return;
+    throw new FilesystemMountNotSupportedException(plan);
+  }
+}
+
+public sealed class FilesystemMountNotSupportedException : InvalidOperationException {
+  public FilesystemMountNotSupportedException(MountPlan plan)
+    : base(CreateMessage(plan))
+    => this.Plan = plan ?? throw new ArgumentNullException(nameof(plan));
+
+  public MountPlan Plan { get; }
+
+  private static string CreateMessage(MountPlan? plan) {
+    ArgumentNullException.ThrowIfNull(plan);
+    var reasons = plan.Reasons.Count == 0
+      ? "mount plan is unsupported"
+      : string.Join("; ", plan.Reasons.Select(static reason => reason.Message));
+    return $"{plan.AccessMode} mount through backend '{plan.BackendId}' is not supported: {reasons}.";
+  }
+}
diff --git a/Compression.Mounting/IFilesystemMountBackend.cs b/Compression.Mounting/IFilesystemMountBackend.cs
new file mode 100644
index 000000000..a8f3ab556
--- /dev/null
+++ b/Compression.Mounting/IFilesystemMountBackend.cs
@@ -0,0 +1,31 @@
+using Compression.Registry;
+
+namespace Compression.Mounting;
+
+/// <summary>
+/// One mount request over an already-open filesystem session.
+/// When <see cref="OwnsFilesystemSession"/> is true, ownership transfers to the
+/// returned <see cref="IMountSession"/> only after <see cref="IFilesystemMountBackend.MountAsync"/>
+/// completes successfully. If mounting throws or is cancelled, the caller still
+/// owns and must dispose the filesystem session.
+/// </summary>
+public sealed record FilesystemMountRequest(
+  IFilesystemSession Filesystem,
+  string Target,
+  MountPlan Plan,
+  bool OwnsFilesystemSession = false
+);
+
+public interface IFilesystemMountBackend {
+  MountBackendProfile GetProfile();
+  ValueTask<IMountSession> MountAsync(FilesystemMountRequest request, CancellationToken cancellationToken = default);
+}
+
+public interface IMountSession : IAsyncDisposable {
+  string BackendId { get; }
+  string Target { get; }
+  MountAccessMode AccessMode { get; }
+  bool IsMounted { get; }
+  ValueTask FlushAsync(CancellationToken cancellationToken = default);
+  ValueTask UnmountAsync(CancellationToken cancellationToken = default);
+}
diff --git a/Compression.Mounting/MountAccessMode.cs b/Compression.Mounting/MountAccessMode.cs
new file mode 100644
index 000000000..18f4e700f
--- /dev/null
+++ b/Compression.Mounting/MountAccessMode.cs
@@ -0,0 +1,6 @@
+namespace Compression.Mounting;
+
+public enum MountAccessMode {
+  ReadOnly,
+  ReadWrite,
+}
diff --git a/Compression.Mounting/MountBackendRegistry.cs b/Compression.Mounting/MountBackendRegistry.cs
new file mode 100644
index 000000000..dd5411f7a
--- /dev/null
+++ b/Compression.Mounting/MountBackendRegistry.cs
@@ -0,0 +1,60 @@
+using Compression.Registry;
+
+namespace Compression.Mounting;
+
+public sealed class MountBackendRegistry {
+  private readonly IReadOnlyList<IFilesystemMountBackend> _backends;
+  private readonly IReadOnlyDictionary<string, IFilesystemMountBackend> _backendsById;
+
+  public MountBackendRegistry(IEnumerable<IFilesystemMountBackend> backends) {
+    ArgumentNullException.ThrowIfNull(backends);
+
+    var materialized = backends.ToArray();
+    var byId = new Dictionary<string, IFilesystemMountBackend>(StringComparer.OrdinalIgnoreCase);
+    foreach (var backend in materialized) {
+      ArgumentNullException.ThrowIfNull(backend);
+      var profile = backend.GetProfile();
+      if (!byId.TryAdd(profile.Id, backend))
+        throw new ArgumentException($"Duplicate mount backend id '{profile.Id}'.", nameof(backends));
+    }
+
+    this._backends = materialized;
+    this._backendsById = byId;
+  }
+
+  public IReadOnlyList<IFilesystemMountBackend> Backends => this._backends;
+
+  public IFilesystemMountBackend GetBackend(string backendId) {
+    ArgumentException.ThrowIfNullOrWhiteSpace(backendId);
+    return this._backendsById.TryGetValue(backendId, out var backend)
+      ? backend
+      : throw new KeyNotFoundException($"Unknown mount backend '{backendId}'.");
+  }
+
+  public MountAccessOptions ResolveFilesystem(FilesystemDriverProfile driverProfile, bool sourceCanWrite) {
+    ArgumentNullException.ThrowIfNull(driverProfile);
+
+    var readOnly = new MountPlan[this._backends.Count];
+    var readWrite = new MountPlan[this._backends.Count];
+    for (var i = 0; i < this._backends.Count; ++i) {
+      var profile = this._backends[i].GetProfile();
+      readOnly[i] = FilesystemMountCapabilityResolver.Resolve(driverProfile, profile, MountAccessMode.ReadOnly, sourceCanWrite);
+      readWrite[i] = FilesystemMountCapabilityResolver.Resolve(driverProfile, profile, MountAccessMode.ReadWrite, sourceCanWrite);
+    }
+
+    return new(readOnly, readWrite);
+  }
+
+  public MountPlan ResolveFilesystem(
+    string backendId,
+    FilesystemDriverProfile driverProfile,
+    MountAccessMode accessMode,
+    bool sourceCanWrite
+  ) {
+    ArgumentException.ThrowIfNullOrWhiteSpace(backendId);
+    ArgumentNullException.ThrowIfNull(driverProfile);
+
+    var backend = this.GetBackend(backendId);
+    return FilesystemMountCapabilityResolver.Resolve(driverProfile, backend.GetProfile(), accessMode, sourceCanWrite);
+  }
+}
diff --git a/Compression.Mounting/MountCapabilityModel.cs b/Compression.Mounting/MountCapabilityModel.cs
new file mode 100644
index 000000000..ef9b0c16d
--- /dev/null
+++ b/Compression.Mounting/MountCapabilityModel.cs
@@ -0,0 +1,50 @@
+using Compression.Registry;
+
+namespace Compression.Mounting;
+
+public enum MountSupportReasonCode {
+  BackendUnavailable,
+  BackendDoesNotSupportReadOnly,
+  BackendDoesNotSupportReadWrite,
+  FilesystemProfileNotMountable,
+  FilesystemProfileNotWritable,
+  SourceIsReadOnly,
+  UnsupportedMutationModel,
+  MissingDriverCapabilities,
+}
+
+public sealed record MountSupportReason(
+  MountSupportReasonCode Code,
+  string Message,
+  FilesystemDriverCapabilities MissingCapabilities = FilesystemDriverCapabilities.None
+);
+
+public sealed record MountBackendProfile(
+  string Id,
+  string DisplayName,
+  bool IsAvailable,
+  bool SupportsReadOnly,
+  bool SupportsReadWrite,
+  FilesystemDriverCapabilities RequiredReadCapabilities,
+  FilesystemDriverCapabilities RequiredWriteCapabilities,
+  IReadOnlyList<string> Limitations
+);
+
+public sealed record MountPlan(
+  MountAccessMode AccessMode,
+  bool IsSupported,
+  FilesystemDriverProfile DriverProfile,
+  MountBackendProfile Backend,
+  FilesystemDriverCapabilities RequiredCapabilities,
+  FilesystemDriverCapabilities MissingCapabilities,
+  IReadOnlyList<MountSupportReason> Reasons,
+  IReadOnlyList<string> Limitations
+);
+
+public sealed record MountAccessOptions(
+  IReadOnlyList<MountPlan> ReadOnly,
+  IReadOnlyList<MountPlan> ReadWrite
+) {
+  public bool CanMountReadOnly => this.ReadOnly.Any(static plan => plan.IsSupported);
+  public bool CanMountReadWrite => this.ReadWrite.Any(static plan => plan.IsSupported);
+}
diff --git a/Compression.NativeUI/Compression.NativeUI.csproj b/Compression.NativeUI/Compression.NativeUI.csproj
new file mode 100644
index 000000000..dc13bc7a3
--- /dev/null
+++ b/Compression.NativeUI/Compression.NativeUI.csproj
@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>WinExe</OutputType>
+    <RootNamespace>Compression.NativeUI</RootNamespace>
+    <IsPackable>false</IsPackable>
+    <GenerateDocumentationFile>false</GenerateDocumentationFile>
+    <NoWarn>CS1591</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Hawkynt.NativeForms" Version="1.0.0.219" />
+    <PackageReference Include="Hawkynt.NativeForms.Backends.Windows" Version="1.0.0.62" />
+    <PackageReference Include="Hawkynt.NativeForms.Backends.Gtk" Version="1.0.0.71" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Compression.Lib\Compression.Lib.csproj" />
+    <ProjectReference Include="..\Compression.Mounting\Compression.Mounting.csproj" />
+    <ProjectReference Include="..\Compression.Mounting.Dokan\Compression.Mounting.Dokan.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/Compression.NativeUI/IMountLauncher.cs b/Compression.NativeUI/IMountLauncher.cs
new file mode 100644
index 000000000..390dabede
--- /dev/null
+++ b/Compression.NativeUI/IMountLauncher.cs
@@ -0,0 +1,18 @@
+using Compression.Mounting;
+
+namespace Compression.NativeUI;
+
+/// <summary>
+/// Composition seam between the cross-platform UI and an actual filesystem-session opener.
+/// Dokan/FUSE composition owns opening the image and filesystem session; the UI owns the
+/// user-selected plan and the returned mount-session lifecycle.
+/// </summary>
+internal interface IMountLauncher {
+  ValueTask<IMountSession> MountAsync(
+    string imagePath,
+    string formatId,
+    MountPlan plan,
+    string target,
+    CancellationToken cancellationToken = default
+  );
+}
diff --git a/Compression.NativeUI/MainForm.cs b/Compression.NativeUI/MainForm.cs
new file mode 100644
index 000000000..b3d6100ff
--- /dev/null
+++ b/Compression.NativeUI/MainForm.cs
@@ -0,0 +1,303 @@
+using Compression.Lib;
+using Compression.Mounting;
+using Compression.Registry;
+using Hawkynt.NativeForms;
+
+namespace Compression.NativeUI;
+
+internal sealed class MainForm : Form {
+  private readonly IFilesystemMountBackend[] _backends;
+  private readonly MountBackendRegistry _mountBackends;
+  private readonly IMountLauncher? _mountLauncher;
+
+  private readonly FilePicker _imagePicker = new() {
+    Bounds = new(132, 24, 544, 28),
+    Filter = "All files|*.*",
+    PlaceholderText = "Filesystem image",
+    Title = "Select an image to mount",
+  };
+
+  private readonly ComboBox _accessPicker = new() { Bounds = new(132, 68, 190, 28) };
+  private readonly ComboBox _backendPicker = new() { Bounds = new(410, 68, 266, 28) };
+  private readonly TextBox _targetBox = new() {
+    Bounds = new(132, 112, 544, 28),
+    PlaceholderText = "Drive letter or mountpoint",
+  };
+  private readonly Button _probeButton = new() { Bounds = new(132, 156, 118, 32), Text = "Probe" };
+  private readonly Button _mountButton = new() { Bounds = new(262, 156, 118, 32), Text = "Mount", Enabled = false };
+  private readonly Button _unmountButton = new() { Bounds = new(392, 156, 118, 32), Text = "Unmount", Enabled = false };
+  private readonly TextBox _detailsBox = new() { Bounds = new(24, 224, 652, 280), Multiline = true, ReadOnly = true };
+  private readonly Label _statusLabel = new() {
+    Bounds = new(24, 520, 652, 28),
+    Text = "Select an image and probe its mount capabilities.",
+  };
+
+  private FilesystemDriverProfile? _driverProfile;
+  private string? _formatId;
+  private bool _sourceCanWrite;
+  private IMountSession? _mountSession;
+  private bool _busy;
+
+  public MainForm(IEnumerable<IFilesystemMountBackend> backends, IMountLauncher? mountLauncher = null) {
+    ArgumentNullException.ThrowIfNull(backends);
+    this._backends = backends.ToArray();
+    this._mountBackends = new(this._backends);
+    this._mountLauncher = mountLauncher;
+
+    this.Text = "CompressionWorkbench — Mount";
+    this.Bounds = new(0, 0, 720, 600);
+    this.StartPosition = FormStartPosition.CenterScreen;
+    this.MinimumSize = new(720, 600);
+
+    this.Controls.AddRange(
+      new Label { Bounds = new(24, 28, 96, 24), Text = "Image" }, this._imagePicker,
+      new Label { Bounds = new(24, 72, 96, 24), Text = "Access" }, this._accessPicker,
+      new Label { Bounds = new(338, 72, 64, 24), Text = "Backend" }, this._backendPicker,
+      new Label { Bounds = new(24, 116, 96, 24), Text = "Target" }, this._targetBox,
+      this._probeButton, this._mountButton, this._unmountButton,
+      new Label { Bounds = new(24, 200, 160, 24), Text = "Resolved capabilities" },
+      this._detailsBox, this._statusLabel
+    );
+
+    this._accessPicker.DisplaySelector = static item => item switch {
+      MountAccessMode.ReadOnly => "Read-only",
+      MountAccessMode.ReadWrite => "Read-write",
+      _ => string.Empty,
+    };
+    this._accessPicker.Items.Add(MountAccessMode.ReadOnly);
+    this._accessPicker.Items.Add(MountAccessMode.ReadWrite);
+    this._accessPicker.SelectedIndex = 0;
+
+    this._backendPicker.DisplaySelector = static item => item is IFilesystemMountBackend backend
+      ? backend.GetProfile().DisplayName
+      : string.Empty;
+    foreach (var backend in this._backends)
+      this._backendPicker.Items.Add(backend);
+
+    if (this._backends.Length > 0)
+      this._backendPicker.SelectedIndex = 0;
+    else {
+      this._backendPicker.Enabled = false;
+      this._backendPicker.PlaceholderText = "No mount backend registered";
+    }
+
+    this._imagePicker.PathChanged += (_, _) => this.ResetProbe();
+    this._accessPicker.SelectedIndexChanged += (_, _) => this.RefreshPlan();
+    this._backendPicker.SelectedIndexChanged += (_, _) => this.RefreshPlan();
+    this._targetBox.TextChanged += (_, _) => this.RefreshMountButton();
+    this._probeButton.Click += (_, _) => this.Probe();
+    this._mountButton.Click += async (_, _) => await this.MountAsync();
+    this._unmountButton.Click += async (_, _) => await this.UnmountAsync();
+    this.FormClosing += (_, _) => this.CleanupActiveMount();
+  }
+
+  private string ImagePath => string.IsNullOrWhiteSpace(this._imagePicker.SelectedPath)
+    ? this._imagePicker.Text.Trim()
+    : this._imagePicker.SelectedPath;
+
+  private MountAccessMode AccessMode
+    => this._accessPicker.SelectedItem is MountAccessMode mode ? mode : MountAccessMode.ReadOnly;
+
+  private IFilesystemMountBackend? SelectedBackend
+    => this._backendPicker.SelectedItem as IFilesystemMountBackend;
+
+  private void ResetProbe() {
+    if (this._mountSession is not null) return;
+    this._driverProfile = null;
+    this._formatId = null;
+    this._sourceCanWrite = false;
+    this._detailsBox.Text = string.Empty;
+    this._statusLabel.Text = "Image changed; probe again.";
+    this.RefreshMountButton();
+  }
+
+  private void Probe() {
+    if (this._mountSession is not null || this._busy) return;
+    var path = this.ImagePath;
+    if (!File.Exists(path)) {
+      this.ShowProbeFailure("The selected image does not exist.");
+      return;
+    }
+
+    try {
+      FormatRegistration.EnsureInitialized();
+      var detected = FormatDetector.DetectByExtension(path);
+      if (detected == FormatDetector.Format.Unknown) {
+        this.ShowProbeFailure("No registered format could be detected for this file.");
+        return;
+      }
+
+      var formatId = detected.ToString();
+      var descriptor = FormatRegistry.GetById(formatId);
+      if (descriptor is null) {
+        this.ShowProbeFailure($"Detected format '{formatId}' has no registered descriptor.");
+        return;
+      }
+
+      if (!FormatRegistry.FilesystemFormatIds.Contains(formatId, StringComparer.OrdinalIgnoreCase)) {
+        this.ShowProbeFailure(
+          $"'{descriptor.DisplayName}' is not registered as a filesystem image. " +
+          "Archive mounting belongs behind the synthetic archive namespace adapter; it is not filesystem writability."
+        );
+        return;
+      }
+
+      using var probeSource = OpenProbeSource(path, out var sourceCanWrite);
+      var profile = FormatRegistry.ProbeFilesystem(formatId, probeSource);
+      this._formatId = formatId;
+      this._driverProfile = profile;
+      this._sourceCanWrite = sourceCanWrite;
+      this._statusLabel.Text = $"Detected {descriptor.DisplayName}: {profile.ProfileName}.";
+      this.RefreshPlan();
+    } catch (Exception ex) {
+      this.ShowProbeFailure($"Probe failed: {ex.GetType().Name}: {ex.Message}");
+    }
+  }
+
+  private void RefreshPlan() {
+    if (this._driverProfile is not { } profile || this._formatId is null) {
+      this.RefreshMountButton();
+      return;
+    }
+
+    var lines = new List<string> {
+      $"Format: {profile.FormatId}",
+      $"Profile: {profile.ProfileName}",
+      $"Mutation model: {profile.MutationModel}",
+      $"Backing source writable: {this._sourceCanWrite}",
+      $"Can mount: {profile.CanMount}",
+      $"Can mount writable: {profile.CanMountWritable}",
+      $"Driver capabilities: {profile.Capabilities}",
+    };
+
+    if (profile.Limitations.Count > 0) {
+      lines.Add(string.Empty);
+      lines.Add("Filesystem limitations:");
+      lines.AddRange(profile.Limitations.Select(static limitation => $"- {limitation}"));
+    }
+
+    if (this.SelectedBackend is { } backend) {
+      var backendProfile = backend.GetProfile();
+      var plan = this._mountBackends.ResolveFilesystem(backendProfile.Id, profile, this.AccessMode, this._sourceCanWrite);
+      lines.Add(string.Empty);
+      lines.Add($"Selected backend: {backendProfile.DisplayName}");
+      lines.Add($"Selected access: {this.AccessMode}");
+      lines.Add($"Supported: {plan.IsSupported}");
+      if (plan.Reasons.Count > 0) {
+        lines.Add("Reasons:");
+        lines.AddRange(plan.Reasons.Select(static reason => $"- {reason.Message}"));
+      }
+      if (plan.Limitations.Count > 0) {
+        lines.Add("Backend/profile limitations:");
+        lines.AddRange(plan.Limitations.Select(static limitation => $"- {limitation}"));
+      }
+    } else {
+      lines.Add(string.Empty);
+      lines.Add("No mount backend is registered in this build yet.");
+    }
+
+    if (this._mountLauncher is null) {
+      lines.Add(string.Empty);
+      lines.Add("No mount launcher is composed yet; probing and capability resolution are available, mounting stays disabled.");
+    }
+
+    this._detailsBox.Text = string.Join(Environment.NewLine, lines);
+    this.RefreshMountButton();
+  }
+
+  private MountPlan? CurrentPlan() {
+    if (this._driverProfile is not { } profile || this.SelectedBackend is not { } backend) return null;
+    return this._mountBackends.ResolveFilesystem(backend.GetProfile().Id, profile, this.AccessMode, this._sourceCanWrite);
+  }
+
+  private void RefreshMountButton() {
+    var plan = this.CurrentPlan();
+    this._mountButton.Enabled = !this._busy
+      && this._mountSession is null
+      && this._mountLauncher is not null
+      && plan?.IsSupported == true
+      && !string.IsNullOrWhiteSpace(this._targetBox.Text);
+    this._unmountButton.Enabled = !this._busy && this._mountSession?.IsMounted == true;
+  }
+
+  private async Task MountAsync() {
+    if (this._mountSession is not null || this._busy || this._mountLauncher is null) return;
+    var plan = this.CurrentPlan();
+    var formatId = this._formatId;
+    var target = this._targetBox.Text.Trim();
+    if (plan?.IsSupported != true || formatId is null || target.Length == 0) return;
+
+    try {
+      this.SetBusy(true, $"Mounting at {target}...");
+      this._mountSession = await this._mountLauncher.MountAsync(this.ImagePath, formatId, plan, target);
+      this._statusLabel.Text = $"Mounted at {this._mountSession.Target} via {this._mountSession.BackendId}.";
+    } catch (Exception ex) {
+      this._statusLabel.Text = $"Mount failed: {ex.GetType().Name}: {ex.Message}";
+    } finally {
+      this.SetBusy(false, this._statusLabel.Text);
+    }
+  }
+
+  private async Task UnmountAsync() {
+    if (this._mountSession is not { } session || this._busy) return;
+    try {
+      this.SetBusy(true, $"Unmounting {session.Target}...");
+      if (session.IsMounted) await session.FlushAsync();
+      if (session.IsMounted) await session.UnmountAsync();
+      await session.DisposeAsync();
+      this._mountSession = null;
+      this._statusLabel.Text = "Unmounted.";
+    } catch (Exception ex) {
+      this._statusLabel.Text = $"Unmount failed: {ex.GetType().Name}: {ex.Message}";
+    } finally {
+      this.SetBusy(false, this._statusLabel.Text);
+    }
+  }
+
+  private void CleanupActiveMount() {
+    if (this._mountSession is not { } session) return;
+    try {
+      if (session.IsMounted) session.FlushAsync().AsTask().GetAwaiter().GetResult();
+      if (session.IsMounted) session.UnmountAsync().AsTask().GetAwaiter().GetResult();
+      session.DisposeAsync().AsTask().GetAwaiter().GetResult();
+    } catch {
+      // Best-effort process teardown; forced-unmount policy remains backend-specific.
+    } finally {
+      this._mountSession = null;
+    }
+  }
+
+  private void SetBusy(bool busy, string status) {
+    this._busy = busy;
+    this._probeButton.Enabled = !busy && this._mountSession is null;
+    this._imagePicker.Enabled = !busy && this._mountSession is null;
+    this._accessPicker.Enabled = !busy && this._mountSession is null;
+    this._backendPicker.Enabled = !busy && this._mountSession is null && this._backends.Length > 0;
+    this._targetBox.Enabled = !busy && this._mountSession is null;
+    this._statusLabel.Text = status;
+    this.RefreshMountButton();
+  }
+
+  private void ShowProbeFailure(string message) {
+    this._driverProfile = null;
+    this._formatId = null;
+    this._sourceCanWrite = false;
+    this._detailsBox.Text = message;
+    this._statusLabel.Text = message;
+    this.RefreshMountButton();
+  }
+
+  private static FileStream OpenProbeSource(string path, out bool canWrite) {
+    try {
+      var source = new FileStream(path, FileMode.Open, FileAccess.ReadWrite, FileShare.Read);
+      canWrite = true;
+      return source;
+    } catch (UnauthorizedAccessException) {
+      canWrite = false;
+      return new(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+    } catch (IOException) {
+      canWrite = false;
+      return new(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+    }
+  }
+}
diff --git a/Compression.NativeUI/Program.cs b/Compression.NativeUI/Program.cs
new file mode 100644
index 000000000..52f2c9c22
--- /dev/null
+++ b/Compression.NativeUI/Program.cs
@@ -0,0 +1,23 @@
+using Compression.Lib;
+using Compression.Mounting;
+using Compression.Mounting.Dokan;
+using Hawkynt.NativeForms;
+using Hawkynt.NativeForms.Backends;
+using Hawkynt.NativeForms.Backends.Gtk;
+using Hawkynt.NativeForms.Backends.Windows;
+
+BackendRegistry.Register(new Win32Backend());
+BackendRegistry.Register(new GtkBackend());
+
+FormatRegistration.EnsureInitialized();
+
+var backends = new List<IFilesystemMountBackend>();
+if (OperatingSystem.IsWindows()) {
+  var dokan = new DokanFilesystemMountBackend();
+  if (dokan.RuntimeStatus.IsAvailable)
+    backends.Add(dokan);
+}
+
+var mountBackends = new MountBackendRegistry(backends);
+var launcher = new RegistryMountLauncher(new FilesystemMountLauncher(mountBackends));
+Application.Run(new MainForm(backends, launcher));
diff --git a/Compression.NativeUI/README.md b/Compression.NativeUI/README.md
new file mode 100644
index 000000000..7ec6d345c
--- /dev/null
+++ b/Compression.NativeUI/README.md
@@ -0,0 +1,26 @@
+# Compression.NativeUI
+
+Cross-platform NativeForms shell for CompressionWorkbench's mounting workflow.
+
+The existing WPF `Compression.UI` remains the full Windows workstation while this frontend grows screen by screen. Mounting starts here because it benefits immediately from one UI contract across the Win32 and GTK NativeForms backends instead of duplicating policy in WPF and a future Linux frontend.
+
+## Current scope
+
+- select a filesystem image;
+- detect and probe the concrete filesystem profile through `FormatRegistry`;
+- display per-image mountability, mutation model, driver capabilities, and limitations;
+- choose read-only or read-write access;
+- choose an injected mount backend and resolve support through `Compression.Mounting`;
+- provide a mount target and own mount/unmount lifecycle once an `IMountLauncher` is composed.
+
+No filesystem mount backend or launcher is registered by this project yet. That is deliberate: the UI does not invent Dokan/FUSE availability. The Dokan/FUSE composition layer will inject real `IFilesystemMountBackend` implementations and an image/session opener after their dependency probes and callback bridges exist.
+
+Archive files are also rejected for now rather than being mislabeled as filesystem images. They will become mountable through the synthetic archive namespace adapter described in the repository `TODO.md`.
+
+## Run
+
+```text
+dotnet run --project Compression.NativeUI/Compression.NativeUI.csproj
+```
+
+NativeForms currently provides working Win32 and GTK backends. Its Cocoa backend remains a placeholder, so this frontend intentionally registers Windows and GTK only.
diff --git a/Compression.NativeUI/RegistryMountLauncher.cs b/Compression.NativeUI/RegistryMountLauncher.cs
new file mode 100644
index 000000000..44623f87f
--- /dev/null
+++ b/Compression.NativeUI/RegistryMountLauncher.cs
@@ -0,0 +1,15 @@
+using Compression.Mounting;
+
+namespace Compression.NativeUI;
+
+internal sealed class RegistryMountLauncher(FilesystemMountLauncher launcher) : IMountLauncher {
+  private readonly FilesystemMountLauncher _launcher = launcher ?? throw new ArgumentNullException(nameof(launcher));
+
+  public ValueTask<IMountSession> MountAsync(
+    string imagePath,
+    string formatId,
+    MountPlan plan,
+    string target,
+    CancellationToken cancellationToken = default
+  ) => this._launcher.MountAsync(imagePath, formatId, plan, target, cancellationToken);
+}
diff --git a/Compression.Registry.Generator/FormatDescriptorGenerator.cs b/Compression.Registry.Generator/FormatDescriptorGenerator.cs
index 2bf387baa..bf37d849c 100644
--- a/Compression.Registry.Generator/FormatDescriptorGenerator.cs
+++ b/Compression.Registry.Generator/FormatDescriptorGenerator.cs
@@ -8,23 +8,23 @@ namespace Compression.Registry.Generator;
 
 /// <summary>
 /// Roslyn incremental source generator that discovers all public non-abstract types implementing
-/// IFormatDescriptor and IBuildingBlock across referenced assemblies and generates:
+/// IFormatDescriptor, IBuildingBlock and IFilesystemDriverAdapter across referenced assemblies and generates:
 /// 1. A partial FormatRegistration class with explicit constructor calls (zero reflection)
 /// 2. A Format enum inside FormatDetector with all discovered format IDs plus special values
+///
+/// Descriptors declared under a FileSystem.* namespace are explicitly marked as
+/// filesystems when registered. FormatRegistry can therefore enforce that every
+/// filesystem has a common-driver path without guessing from extensions/names.
 /// </summary>
 [Generator(LanguageNames.CSharp)]
 public sealed class FormatDescriptorGenerator : IIncrementalGenerator {
 
   private const string DescriptorInterfaceFullName = "Compression.Registry.IFormatDescriptor";
   private const string BuildingBlockInterfaceFullName = "Compression.Registry.IBuildingBlock";
+  private const string FilesystemDriverAdapterInterfaceFullName = "Compression.Registry.IFilesystemDriverAdapter";
 
-  /// <summary>
-  /// Special enum members that are always generated even though they have no descriptor.
-  /// Unknown = no format detected; Sfx/Iso/Udf = detected by special logic, not a registry descriptor.
-  /// </summary>
   private static readonly string[] SpecialFormats = [
     "Unknown", "Sfx", "Iso", "Udf",
-    // Compound tar formats — registered manually in FormatRegistration.RegisterCompoundTar()
     "TarGz", "TarBz2", "TarXz", "TarZst", "TarLz4", "TarLzip", "TarBr",
   ];
 
@@ -32,35 +32,55 @@ public void Initialize(IncrementalGeneratorInitializationContext context) {
     var allTypes = context.CompilationProvider.Select((compilation, ct) => {
       var descriptorInterface = compilation.GetTypeByMetadataName(DescriptorInterfaceFullName);
       var buildingBlockInterface = compilation.GetTypeByMetadataName(BuildingBlockInterfaceFullName);
+      var filesystemDriverAdapterInterface = compilation.GetTypeByMetadataName(FilesystemDriverAdapterInterfaceFullName);
 
-      var descriptors = new List<(string FullName, string Id)>();
+      var descriptors = new List<(string FullName, string Id, bool IsFilesystem)>();
       var buildingBlocks = new List<string>();
+      var filesystemDrivers = new List<string>();
 
-      if (descriptorInterface != null || buildingBlockInterface != null) {
-        // Check all referenced assemblies
+      if (descriptorInterface != null || buildingBlockInterface != null || filesystemDriverAdapterInterface != null) {
         foreach (var reference in compilation.References) {
           if (compilation.GetAssemblyOrModuleSymbol(reference) is not IAssemblySymbol assembly)
             continue;
-          FindTypes(assembly.GlobalNamespace, descriptorInterface, buildingBlockInterface, descriptors, buildingBlocks, ct);
+          FindTypes(
+            assembly.GlobalNamespace,
+            descriptorInterface,
+            buildingBlockInterface,
+            filesystemDriverAdapterInterface,
+            descriptors,
+            buildingBlocks,
+            filesystemDrivers,
+            ct);
         }
 
-        // Also check the compilation's own types
-        FindTypes(compilation.Assembly.GlobalNamespace, descriptorInterface, buildingBlockInterface, descriptors, buildingBlocks, ct);
+        FindTypes(
+          compilation.Assembly.GlobalNamespace,
+          descriptorInterface,
+          buildingBlockInterface,
+          filesystemDriverAdapterInterface,
+          descriptors,
+          buildingBlocks,
+          filesystemDrivers,
+          ct);
       }
 
       descriptors.Sort((a, b) => StringComparer.Ordinal.Compare(a.FullName, b.FullName));
       buildingBlocks.Sort(StringComparer.Ordinal);
-      return (Descriptors: descriptors, BuildingBlocks: buildingBlocks);
+      filesystemDrivers.Sort(StringComparer.Ordinal);
+      return (Descriptors: descriptors, BuildingBlocks: buildingBlocks, FilesystemDrivers: filesystemDrivers);
     });
 
     context.RegisterSourceOutput(allTypes, static (spc, types) => {
-      EmitFormatRegistration(spc, types.Descriptors, types.BuildingBlocks);
+      EmitFormatRegistration(spc, types.Descriptors, types.BuildingBlocks, types.FilesystemDrivers);
       EmitFormatEnum(spc, types.Descriptors);
     });
   }
 
-  private static void EmitFormatRegistration(SourceProductionContext spc,
-      List<(string FullName, string Id)> descriptors, List<string> buildingBlocks) {
+  private static void EmitFormatRegistration(
+      SourceProductionContext spc,
+      List<(string FullName, string Id, bool IsFilesystem)> descriptors,
+      List<string> buildingBlocks,
+      List<string> filesystemDrivers) {
     var sb = new StringBuilder();
     sb.AppendLine("// <auto-generated/>");
     sb.AppendLine("using Compression.Registry;");
@@ -69,22 +89,30 @@ private static void EmitFormatRegistration(SourceProductionContext spc,
     sb.AppendLine();
     sb.AppendLine("public static partial class FormatRegistration {");
     sb.AppendLine("  static partial void RegisterFormats() {");
-    foreach (var (fullName, _) in descriptors) {
-      sb.AppendLine($"    FormatRegistry.Register(new {fullName}());");
+    foreach (var (fullName, _, isFilesystem) in descriptors) {
+      sb.AppendLine(isFilesystem
+        ? $"    FormatRegistry.Register(new {fullName}(), isFilesystem: true);"
+        : $"    FormatRegistry.Register(new {fullName}());");
     }
     sb.AppendLine("  }");
     sb.AppendLine();
     sb.AppendLine("  static partial void RegisterBuildingBlocks() {");
-    foreach (var fullName in buildingBlocks) {
+    foreach (var fullName in buildingBlocks)
       sb.AppendLine($"    BuildingBlockRegistry.Register(new {fullName}());");
-    }
+    sb.AppendLine("  }");
+    sb.AppendLine();
+    sb.AppendLine("  static partial void RegisterFilesystemDrivers() {");
+    foreach (var fullName in filesystemDrivers)
+      sb.AppendLine($"    FormatRegistry.RegisterFilesystemDriver(new {fullName}());");
     sb.AppendLine("  }");
     sb.AppendLine("}");
 
     spc.AddSource("FormatRegistration.g.cs", sb.ToString());
   }
 
-  private static void EmitFormatEnum(SourceProductionContext spc, List<(string FullName, string Id)> types) {
+  private static void EmitFormatEnum(
+      SourceProductionContext spc,
+      List<(string FullName, string Id, bool IsFilesystem)> types) {
     var sb = new StringBuilder();
     sb.AppendLine("// <auto-generated/>");
     sb.AppendLine();
@@ -93,18 +121,13 @@ private static void EmitFormatEnum(SourceProductionContext spc, List<(string Ful
     sb.AppendLine("public static partial class FormatDetector {");
     sb.AppendLine("  public enum Format {");
 
-    // Special values first
-    foreach (var special in SpecialFormats) {
+    foreach (var special in SpecialFormats)
       sb.AppendLine($"    {special},");
-    }
 
-    // All discovered descriptor IDs (excluding any that match special values)
     var specialSet = new HashSet<string>(SpecialFormats);
-    foreach (var (_, id) in types) {
-      if (!specialSet.Contains(id)) {
+    foreach (var (_, id, _) in types)
+      if (!specialSet.Contains(id))
         sb.AppendLine($"    {id},");
-      }
-    }
 
     sb.AppendLine("  }");
     sb.AppendLine("}");
@@ -116,13 +139,23 @@ private static void FindTypes(
       INamespaceSymbol ns,
       INamedTypeSymbol? descriptorInterface,
       INamedTypeSymbol? buildingBlockInterface,
-      List<(string FullName, string Id)> descriptors,
+      INamedTypeSymbol? filesystemDriverAdapterInterface,
+      List<(string FullName, string Id, bool IsFilesystem)> descriptors,
       List<string> buildingBlocks,
+      List<string> filesystemDrivers,
       System.Threading.CancellationToken ct) {
     foreach (var member in ns.GetMembers()) {
       ct.ThrowIfCancellationRequested();
       if (member is INamespaceSymbol childNs) {
-        FindTypes(childNs, descriptorInterface, buildingBlockInterface, descriptors, buildingBlocks, ct);
+        FindTypes(
+          childNs,
+          descriptorInterface,
+          buildingBlockInterface,
+          filesystemDriverAdapterInterface,
+          descriptors,
+          buildingBlocks,
+          filesystemDrivers,
+          ct);
       } else if (member is INamedTypeSymbol type &&
                  type.TypeKind == TypeKind.Class &&
                  !type.IsAbstract &&
@@ -132,22 +165,23 @@ private static void FindTypes(
 
         if (descriptorInterface != null && Implements(type, descriptorInterface)) {
           var id = DeriveId(type.Name, "FormatDescriptor");
-          descriptors.Add((fullName, id));
+          var nsName = type.ContainingNamespace?.ToDisplayString() ?? string.Empty;
+          var isFilesystem = nsName.Equals("FileSystem", StringComparison.Ordinal) ||
+                             nsName.StartsWith("FileSystem.", StringComparison.Ordinal);
+          descriptors.Add((fullName, id, isFilesystem));
         }
 
-        if (buildingBlockInterface != null && Implements(type, buildingBlockInterface)) {
+        if (buildingBlockInterface != null && Implements(type, buildingBlockInterface))
           buildingBlocks.Add(fullName);
-        }
+
+        if (filesystemDriverAdapterInterface != null && Implements(type, filesystemDriverAdapterInterface))
+          filesystemDrivers.Add(fullName);
       }
     }
   }
 
-  /// <summary>
-  /// Derives the format ID from the class name by stripping a suffix.
-  /// E.g., "GzipFormatDescriptor" → "Gzip", "SevenZipFormatDescriptor" → "SevenZip".
-  /// </summary>
   private static string DeriveId(string className, string suffix) {
-    if (className.EndsWith(suffix))
+    if (className.EndsWith(suffix, StringComparison.Ordinal))
       return className.Substring(0, className.Length - suffix.Length);
     return className;
   }
@@ -163,10 +197,9 @@ private static bool HasParameterlessConstructor(INamedTypeSymbol type) {
   }
 
   private static bool Implements(INamedTypeSymbol type, INamedTypeSymbol iface) {
-    foreach (var i in type.AllInterfaces) {
+    foreach (var i in type.AllInterfaces)
       if (SymbolEqualityComparer.Default.Equals(i, iface))
         return true;
-    }
     return false;
   }
 }
diff --git a/Compression.Registry/BlockDeviceAdapters.cs b/Compression.Registry/BlockDeviceAdapters.cs
new file mode 100644
index 000000000..bb1ca94c9
--- /dev/null
+++ b/Compression.Registry/BlockDeviceAdapters.cs
@@ -0,0 +1,282 @@
+#pragma warning disable CS1591
+
+namespace Compression.Registry;
+
+/// <summary>
+/// Compatibility alias for the original block-device provider name. New code
+/// uses <see cref="IRandomAccessBlockDeviceProvider"/> so containers, decoded
+/// track media and raw images expose exactly one logical-block abstraction.
+/// </summary>
+[Obsolete("Use IRandomAccessBlockDeviceProvider; both names represent the same logical-block boundary.")]
+public interface IBlockDeviceProvider : IRandomAccessBlockDeviceProvider { }
+
+/// <summary>
+/// Optional filesystem-core capability for implementations whose native parser
+/// already works directly on a block device. This is the long-term driver core:
+/// the same filesystem implementation can mount raw disks, virtual disks,
+/// forensic images, or decoded track media without container-specific code.
+/// </summary>
+public interface IBlockDeviceFilesystemDriverProvider {
+  FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device);
+  IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options);
+}
+
+/// <summary>
+/// Fixed-size random-access block device over an ordinary seekable stream. This
+/// is the bridge for raw filesystem images while parsers migrate away from
+/// direct Stream.Position access.
+/// </summary>
+public sealed class StreamBlockDevice : IRandomAccessBlockDevice {
+  private readonly Stream _stream;
+  private readonly bool _leaveOpen;
+  private readonly object _gate = new();
+  private bool _disposed;
+
+  public StreamBlockDevice(
+      Stream stream,
+      int logicalBlockSize,
+      bool writable,
+      bool leaveOpen = true,
+      int? physicalBlockSize = null) {
+    ArgumentNullException.ThrowIfNull(stream);
+    if (!stream.CanRead || !stream.CanSeek)
+      throw new ArgumentException("A stream block device requires a readable, seekable stream.", nameof(stream));
+    if (logicalBlockSize <= 0 || (logicalBlockSize & (logicalBlockSize - 1)) != 0)
+      throw new ArgumentOutOfRangeException(nameof(logicalBlockSize), "Logical block size must be a positive power of two.");
+    if (stream.Length % logicalBlockSize != 0)
+      throw new InvalidDataException(
+        $"Stream length {stream.Length:N0} is not an exact multiple of logical block size {logicalBlockSize:N0}.");
+    if (writable && !stream.CanWrite)
+      throw new ArgumentException("Writable block-device access requires a writable stream.", nameof(stream));
+
+    _stream = stream;
+    _leaveOpen = leaveOpen;
+    CanWrite = writable;
+    Geometry = new BlockDeviceGeometry(
+      logicalBlockSize,
+      stream.Length / logicalBlockSize,
+      physicalBlockSize.GetValueOrDefault(logicalBlockSize),
+      SupportsTrim: false);
+  }
+
+  public BlockDeviceGeometry Geometry { get; }
+  public bool CanWrite { get; }
+
+  public int ReadBlocks(long firstBlock, Span<byte> destination) {
+    ThrowIfDisposed();
+    ValidateBuffer(firstBlock, destination.Length, nameof(destination));
+    if (destination.Length == 0) return 0;
+    lock (_gate) {
+      _stream.Position = checked(firstBlock * Geometry.LogicalBlockSize);
+      _stream.ReadExactly(destination);
+    }
+    return destination.Length / Geometry.LogicalBlockSize;
+  }
+
+  public void WriteBlocks(long firstBlock, ReadOnlySpan<byte> source) {
+    ThrowIfDisposed();
+    if (!CanWrite) throw new NotSupportedException("The stream block device was opened read-only.");
+    ValidateBuffer(firstBlock, source.Length, nameof(source));
+    if (source.Length == 0) return;
+    lock (_gate) {
+      _stream.Position = checked(firstBlock * Geometry.LogicalBlockSize);
+      _stream.Write(source);
+    }
+  }
+
+  public void Trim(long firstBlock, long blockCount) {
+    ThrowIfDisposed();
+    if (!CanWrite) throw new NotSupportedException("The stream block device was opened read-only.");
+    ValidateRange(firstBlock, blockCount);
+    throw new NotSupportedException("An ordinary stream has no portable deallocate/TRIM primitive.");
+  }
+
+  public void Flush() {
+    ThrowIfDisposed();
+    _stream.Flush();
+  }
+
+  public void Dispose() {
+    if (_disposed) return;
+    if (CanWrite) _stream.Flush();
+    _disposed = true;
+    if (!_leaveOpen) _stream.Dispose();
+  }
+
+  private void ValidateBuffer(long firstBlock, int byteCount, string parameterName) {
+    if (byteCount < 0 || byteCount % Geometry.LogicalBlockSize != 0)
+      throw new ArgumentException("Block I/O buffers must contain a whole number of logical blocks.", parameterName);
+    ValidateRange(firstBlock, byteCount / Geometry.LogicalBlockSize);
+  }
+
+  private void ValidateRange(long firstBlock, long blockCount) {
+    if (firstBlock < 0) throw new ArgumentOutOfRangeException(nameof(firstBlock));
+    if (blockCount < 0) throw new ArgumentOutOfRangeException(nameof(blockCount));
+    if (firstBlock > Geometry.BlockCount || blockCount > Geometry.BlockCount - firstBlock)
+      throw new ArgumentOutOfRangeException(nameof(firstBlock), "Block range extends beyond the device.");
+  }
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
+
+/// <summary>
+/// Seekable byte-stream view over a block device. Legacy filesystem parsers can
+/// therefore run on VHD/QCOW2/GCR-backed logical disks before they are rewritten
+/// to issue block requests directly. Unaligned writes use read-modify-write of
+/// only the touched edge blocks; unrelated blocks are never rewritten.
+/// </summary>
+public sealed class BlockDeviceStream : Stream {
+  private readonly IRandomAccessBlockDevice _device;
+  private readonly bool _leaveOpen;
+  private readonly object _gate = new();
+  private long _position;
+  private bool _disposed;
+
+  public BlockDeviceStream(IRandomAccessBlockDevice device, bool leaveOpen = true) {
+    ArgumentNullException.ThrowIfNull(device);
+    _device = device;
+    _leaveOpen = leaveOpen;
+  }
+
+  public override bool CanRead => !_disposed;
+  public override bool CanSeek => !_disposed;
+  public override bool CanWrite => !_disposed && _device.CanWrite;
+  public override long Length {
+    get {
+      ThrowIfDisposed();
+      return _device.Geometry.Length;
+    }
+  }
+
+  public override long Position {
+    get {
+      ThrowIfDisposed();
+      return _position;
+    }
+    set {
+      ThrowIfDisposed();
+      if (value < 0 || value > Length) throw new ArgumentOutOfRangeException(nameof(value));
+      _position = value;
+    }
+  }
+
+  public override int Read(byte[] buffer, int offset, int count) {
+    ArgumentNullException.ThrowIfNull(buffer);
+    return Read(buffer.AsSpan(offset, count));
+  }
+
+  public override int Read(Span<byte> buffer) {
+    ThrowIfDisposed();
+    if (buffer.Length == 0 || _position >= Length) return 0;
+    var count = checked((int)Math.Min(buffer.Length, Length - _position));
+    ReadAt(_position, buffer[..count]);
+    _position += count;
+    return count;
+  }
+
+  public override int ReadByte() {
+    Span<byte> one = stackalloc byte[1];
+    return Read(one) == 0 ? -1 : one[0];
+  }
+
+  public override void Write(byte[] buffer, int offset, int count) {
+    ArgumentNullException.ThrowIfNull(buffer);
+    Write(buffer.AsSpan(offset, count));
+  }
+
+  public override void Write(ReadOnlySpan<byte> buffer) {
+    ThrowIfDisposed();
+    if (!CanWrite) throw new NotSupportedException("The block-device stream is read-only.");
+    if (buffer.Length == 0) return;
+    if ((long)buffer.Length > Length - _position)
+      throw new IOException("Block-device streams have fixed length and cannot be extended.");
+    WriteAt(_position, buffer);
+    _position += buffer.Length;
+  }
+
+  public override void WriteByte(byte value) {
+    Span<byte> one = stackalloc byte[1] { value };
+    Write(one);
+  }
+
+  public override long Seek(long offset, SeekOrigin origin) {
+    ThrowIfDisposed();
+    long target;
+    try {
+      target = origin switch {
+        SeekOrigin.Begin => offset,
+        SeekOrigin.Current => checked(_position + offset),
+        SeekOrigin.End => checked(Length + offset),
+        _ => throw new ArgumentOutOfRangeException(nameof(origin)),
+      };
+    } catch (OverflowException) {
+      throw new IOException("Seek target overflows the block-device address space.");
+    }
+    if (target < 0 || target > Length) throw new IOException("Seek target lies outside the fixed block device.");
+    return _position = target;
+  }
+
+  public override void SetLength(long value)
+    => throw new NotSupportedException("Block-device streams have fixed geometry.");
+
+  public override void Flush() {
+    ThrowIfDisposed();
+    _device.Flush();
+  }
+
+  protected override void Dispose(bool disposing) {
+    if (!_disposed && disposing) {
+      if (_device.CanWrite) _device.Flush();
+      if (!_leaveOpen) _device.Dispose();
+    }
+    _disposed = true;
+    base.Dispose(disposing);
+  }
+
+  private void ReadAt(long offset, Span<byte> destination) {
+    var blockSize = _device.Geometry.LogicalBlockSize;
+    lock (_gate) {
+      var cursor = 0;
+      var logicalOffset = offset;
+      while (cursor < destination.Length) {
+        var block = logicalOffset / blockSize;
+        var within = checked((int)(logicalOffset % blockSize));
+        var take = Math.Min(destination.Length - cursor, blockSize - within);
+        if (within == 0 && take == blockSize) {
+          _device.ReadBlocks(block, destination.Slice(cursor, blockSize));
+        } else {
+          var scratch = new byte[blockSize];
+          _device.ReadBlocks(block, scratch);
+          scratch.AsSpan(within, take).CopyTo(destination.Slice(cursor, take));
+        }
+        cursor += take;
+        logicalOffset += take;
+      }
+    }
+  }
+
+  private void WriteAt(long offset, ReadOnlySpan<byte> source) {
+    var blockSize = _device.Geometry.LogicalBlockSize;
+    lock (_gate) {
+      var cursor = 0;
+      var logicalOffset = offset;
+      while (cursor < source.Length) {
+        var block = logicalOffset / blockSize;
+        var within = checked((int)(logicalOffset % blockSize));
+        var take = Math.Min(source.Length - cursor, blockSize - within);
+        if (within == 0 && take == blockSize) {
+          _device.WriteBlocks(block, source.Slice(cursor, blockSize));
+        } else {
+          var scratch = new byte[blockSize];
+          _device.ReadBlocks(block, scratch);
+          source.Slice(cursor, take).CopyTo(scratch.AsSpan(within, take));
+          _device.WriteBlocks(block, scratch);
+        }
+        cursor += take;
+        logicalOffset += take;
+      }
+    }
+  }
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/Compression.Registry/DefragOptions.cs b/Compression.Registry/DefragOptions.cs
index 865c7ffc7..383001e52 100644
--- a/Compression.Registry/DefragOptions.cs
+++ b/Compression.Registry/DefragOptions.cs
@@ -100,14 +100,19 @@ public sealed record class DefragOptions {
   public long HoleAt { get; init; } = -1;
 
   /// <summary>
-  /// Optional progress callback. When non-null, the defragmenter emits at
-  /// least three events: a "scanning" event with the pre-defrag block map,
-  /// periodic "writing" events with read/write offsets during the rebuild,
-  /// and a "complete" event with the post-defrag block map. UI consumers
-  /// can render a live tile chart from these events.
+  /// Optional progress callback. When non-null, the defragmenter emits snapshots
+  /// and incremental read/write-head updates that can drive the maintenance block
+  /// map. Staged archive rebuilds use the same contract as native block movers.
   /// </summary>
   public Action<DefragProgressEvent>? OnProgress { get; init; }
 
+  /// <summary>
+  /// Cooperative cancellation for long maintenance operations. Generic staged
+  /// rebuilds honour it while reading and writing and never commit a cancelled
+  /// target. Native in-place movers may honour it at their next safe move boundary.
+  /// </summary>
+  public CancellationToken CancellationToken { get; init; }
+
   /// <summary>
   /// Layout profile for planner-driven defragmentation. Controls whether
   /// the defragmenter performs full zone-based rearrangement
diff --git a/Compression.Registry/DefragProgress.cs b/Compression.Registry/DefragProgress.cs
index 3b0ff79a1..3725f250c 100644
--- a/Compression.Registry/DefragProgress.cs
+++ b/Compression.Registry/DefragProgress.cs
@@ -2,7 +2,7 @@ namespace Compression.Registry;
 
 /// <summary>
 /// What kind of bytes a contiguous region holds. Used by the live-progress
-/// block map to color-code regions as defrag proceeds.
+/// block map to color-code regions as maintenance proceeds.
 /// </summary>
 public enum DefragBlockKind {
   /// <summary>Free space — not allocated to any file.</summary>
@@ -11,34 +11,33 @@ public enum DefragBlockKind {
   Used,
   /// <summary>Marked bad / quarantined (FAT-style "BAD" cluster, or post-fsck flag).</summary>
   Bad,
-  /// <summary>Reserved for filesystem metadata (boot sectors, superblock, MFT, FAT, bitmap, root directory).</summary>
+  /// <summary>Reserved for filesystem/container metadata.</summary>
   MetadataReserved,
-  /// <summary>Currently being read or written by the in-progress defrag operation.</summary>
+  /// <summary>Currently being read, moved, compressed, grouped, or written.</summary>
   InProgress,
 }
 
 /// <summary>
-/// Heuristic classification of a file's "thermal" zone based on its
-/// modification time. Drives layout placement: hot at start, normal in
-/// the middle, frozen near the end. Used by the live-progress block map
-/// for tile coloring.
+/// Heuristic classification used for the maintenance block-map colors. Filesystem
+/// defraggers commonly map this to hot/cold placement; archive rebuilds may map it
+/// to storage/compression classes so a staged target remains visually informative.
 /// </summary>
 public enum DefragBlockClass {
-  /// <summary>File modified recently (top quartile) — placed near start.</summary>
+  /// <summary>Hot / heavy-processing class.</summary>
   Hot,
-  /// <summary>File modified normally — placed in the middle.</summary>
+  /// <summary>Normal class.</summary>
   Normal,
-  /// <summary>File modified a while ago — placed near end.</summary>
+  /// <summary>Cold / alternative-processing class.</summary>
   Cold,
-  /// <summary>File hasn't been touched in a long time (bottom quartile) — placed at end.</summary>
+  /// <summary>Frozen / stored-verbatim class.</summary>
   Frozen,
-  /// <summary>Directory metadata (folder contents, B-tree dir node, etc.) — rendered gold to make placement visible.</summary>
+  /// <summary>Directory or structural metadata class.</summary>
   Directory,
 }
 
 /// <summary>
-/// One contiguous region of an image's address space, as seen by the
-/// live-progress block map.
+/// One contiguous region in the address-space currently visualized by the
+/// maintenance block map.
 /// </summary>
 public sealed record DefragBlockInfo(
   long Offset,
@@ -48,18 +47,30 @@ public sealed record DefragBlockInfo(
   DefragBlockClass? Classification = null);
 
 /// <summary>
-/// Snapshot of an image's block layout at a moment in time. Emitted by
-/// <see cref="IArchiveDefragmentable.Defragment(System.IO.Stream, DefragOptions)"/>
-/// implementations through DefragOptions.OnProgress at scan
-/// start, periodically during writes, and at completion.
+/// Snapshot emitted by defrag/re-layout/rebuild maintenance operations.
+/// Native in-place movers normally report one physical image address-space.
+/// Transactional WORM/archive rebuilds may report the source read head and staged
+/// target write head in their respective byte-spaces, projected onto the same
+/// chart. In that mode the two head offsets are progress visualization and do not
+/// assert that identical numerical offsets refer to the same physical bytes.
 /// </summary>
-/// <param name="Phase">Progress phase identifier ("scanning" / "writing" / "complete" / "error").</param>
+/// <param name="Phase">
+/// Progress phase identifier. Common values are <c>scanning</c>, <c>reading</c>,
+/// <c>writing</c>, <c>verifying</c>, <c>staged</c>, <c>committing</c>,
+/// <c>complete</c>, and <c>error</c>.
+/// </param>
 /// <param name="Fraction">0..1 fraction of work done. -1 = indeterminate.</param>
-/// <param name="CurrentReadOffset">Byte offset currently being read; -1 if not reading.</param>
-/// <param name="CurrentWriteOffset">Byte offset currently being written; -1 if not writing.</param>
-/// <param name="ImageSize">Total image size in bytes (helpful for tile binning).</param>
-/// <param name="BlockMap">Block-map snapshot, present at scan start + completion. Null during incremental updates.</param>
-/// <param name="Status">Optional human-readable status (e.g. "moving extent 23 of 87").</param>
+/// <param name="CurrentReadOffset">Current source/read offset; -1 when not reading.</param>
+/// <param name="CurrentWriteOffset">Current destination/write offset; -1 when not writing.</param>
+/// <param name="ImageSize">
+/// Address-space size used for visualization/binning. For staged rebuilds this is
+/// a display scale large enough to project the source and target progress.
+/// </param>
+/// <param name="BlockMap">
+/// Optional block-map snapshot. Null incremental events retain the previous map
+/// and only move heads/progress, keeping redraw cost low on large archives.
+/// </param>
+/// <param name="Status">Optional human-readable phase/status text.</param>
 public sealed record DefragProgressEvent(
   string Phase,
   double Fraction,
diff --git a/Compression.Registry/FilesystemDriverContracts.cs b/Compression.Registry/FilesystemDriverContracts.cs
new file mode 100644
index 000000000..77dea6de0
--- /dev/null
+++ b/Compression.Registry/FilesystemDriverContracts.cs
@@ -0,0 +1,228 @@
+#pragma warning disable CS1591
+namespace Compression.Registry;
+
+/// <summary>
+/// Stable, path-independent identity of a filesystem object. A real driver must
+/// not use a pathname as identity: rename/unlink can change names while open
+/// handles keep referring to the same inode/object. Providers map their native
+/// inode, file-reference, object-id or directory-slot identity into these two
+/// opaque 64-bit words.
+/// </summary>
+public readonly record struct FilesystemNodeId(ulong Value, ulong Generation = 0);
+
+public enum FilesystemNodeKind {
+  Unknown,
+  RegularFile,
+  Directory,
+  SymbolicLink,
+  BlockDevice,
+  CharacterDevice,
+  Fifo,
+  Socket,
+}
+
+[Flags]
+public enum FilesystemDriverCapabilities : ulong {
+  None = 0,
+  EnumerateDirectories = 1UL << 0,
+  ReadData = 1UL << 1,
+  RandomAccess = 1UL << 2,
+  StableNodeIds = 1UL << 3,
+  WriteData = 1UL << 4,
+  Truncate = 1UL << 5,
+  CreateFile = 1UL << 6,
+  DeleteFile = 1UL << 7,
+  CreateDirectory = 1UL << 8,
+  RemoveDirectory = 1UL << 9,
+  Rename = 1UL << 10,
+  HardLinks = 1UL << 11,
+  SymbolicLinks = 1UL << 12,
+  SetMetadata = 1UL << 13,
+  SparseFiles = 1UL << 14,
+  Flush = 1UL << 15,
+  Transactions = 1UL << 16,
+  CaseSensitiveNames = 1UL << 17,
+  CasePreservingNames = 1UL << 18,
+}
+
+/// <summary>
+/// Describes how namespace/data writes become durable on this exact on-disk
+/// profile. This is intentionally separate from <see cref="FormatCapabilities.CanModify"/>:
+/// archive-level Add/Remove may legitimately rebuild a whole image, while a
+/// writable mounted filesystem driver needs bounded, handle-safe mutations.
+/// </summary>
+public enum FilesystemMutationModel {
+  None,
+  Direct,
+  Journaled,
+  CopyOnWrite,
+  LogStructured,
+  WholeImageRebuild,
+}
+
+/// <summary>
+/// Per-image probe result. Capabilities are not assumed from the format name:
+/// an EROFS flat profile, a compressed EROFS profile, a damaged FAT image, or a
+/// ReFS version with an unsupported metadata feature can have different safe
+/// operations even though they share one descriptor.
+/// </summary>
+public sealed record FilesystemDriverProfile(
+  string FormatId,
+  string ProfileName,
+  FilesystemDriverCapabilities Capabilities,
+  FilesystemMutationModel MutationModel,
+  bool CanMount,
+  bool CanMountWritable,
+  IReadOnlyList<string> Limitations
+);
+
+public sealed record FilesystemOpenOptions(
+  bool ReadOnly = true,
+  bool LeaveOpen = true
+);
+
+public sealed record FilesystemDirectoryEntry(
+  string Name,
+  FilesystemNodeId NodeId,
+  FilesystemNodeKind Kind
+);
+
+public sealed record FilesystemNodeInfo(
+  FilesystemNodeId NodeId,
+  FilesystemNodeKind Kind,
+  long Size,
+  long AllocatedSize,
+  uint LinkCount = 1,
+  ulong NativeAttributes = 0,
+  DateTimeOffset? Created = null,
+  DateTimeOffset? Modified = null,
+  DateTimeOffset? Accessed = null,
+  DateTimeOffset? Changed = null
+);
+
+/// <summary>Optional metadata changes; null means leave the field unchanged.</summary>
+public sealed record FilesystemMetadataPatch(
+  DateTimeOffset? Created = null,
+  DateTimeOffset? Modified = null,
+  DateTimeOffset? Accessed = null,
+  ulong? NativeAttributes = null
+);
+
+/// <summary>
+/// Descriptor-side entry point for a mount-grade filesystem implementation.
+/// Probe must be non-destructive and fail closed. Open must reject writable mode
+/// unless the returned profile has <see cref="FilesystemDriverProfile.CanMountWritable"/>.
+/// </summary>
+public interface IFilesystemDriverProvider {
+  FilesystemDriverProfile ProbeFilesystem(Stream image);
+  IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options);
+}
+
+/// <summary>
+/// Open filesystem namespace. Operations use stable node ids rather than paths,
+/// mirroring the semantics required by FUSE/Dokany/WinFsp-style adapters: a
+/// caller may keep a file handle open across rename or unlink.
+/// </summary>
+public interface IFilesystemSession : IDisposable {
+  FilesystemDriverProfile Profile { get; }
+  FilesystemNodeId RootNodeId { get; }
+
+  FilesystemNodeInfo Stat(FilesystemNodeId nodeId);
+  FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name);
+  IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory);
+  IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access);
+
+  FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name);
+  FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name);
+  void DeleteFile(FilesystemNodeId parentDirectory, string name);
+  void RemoveDirectory(FilesystemNodeId parentDirectory, string name);
+  void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace);
+  void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName);
+  FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target);
+  string ReadSymbolicLink(FilesystemNodeId nodeId);
+  void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch);
+
+  /// <summary>Flushes all dirty data and metadata that are not inside an active transaction.</summary>
+  void Flush();
+
+  /// <summary>
+  /// Begins one durability transaction for this session. Until Commit/Rollback,
+  /// namespace operations and writes through handles opened by the session belong
+  /// to that transaction. Providers that do not advertise Transactions throw.
+  /// </summary>
+  IFilesystemTransaction BeginTransaction();
+}
+
+/// <summary>
+/// Positional file handle. It deliberately has no shared Stream.Position so two
+/// concurrent kernel requests cannot race a mutable cursor. Reads/writes operate
+/// at explicit logical offsets and therefore map naturally to filesystem extents.
+/// </summary>
+public interface IFilesystemFileHandle : IDisposable {
+  FilesystemNodeId NodeId { get; }
+  long Length { get; }
+  int Read(long offset, Span<byte> destination);
+  void Write(long offset, ReadOnlySpan<byte> source);
+  void SetLength(long length);
+  void Flush();
+}
+
+public interface IFilesystemTransaction : IDisposable {
+  bool IsCompleted { get; }
+  void Commit();
+  void Rollback();
+}
+
+/// <summary>
+/// Geometry of a sector/block-addressable device exposed beneath a filesystem.
+/// Container formats such as VHD/QCOW2/EWF should eventually implement this
+/// layer; FAT/ext/ReFS drivers then consume block devices rather than knowing
+/// how their outer container stores bytes.
+/// </summary>
+public sealed record BlockDeviceGeometry(
+  int LogicalBlockSize,
+  long BlockCount,
+  int PhysicalBlockSize = 0,
+  bool SupportsTrim = false
+) {
+  public long Length => checked(BlockCount * LogicalBlockSize);
+}
+
+public interface IRandomAccessBlockDevice : IDisposable {
+  BlockDeviceGeometry Geometry { get; }
+  bool CanWrite { get; }
+  int ReadBlocks(long firstBlock, Span<byte> destination);
+  void WriteBlocks(long firstBlock, ReadOnlySpan<byte> source);
+  void Trim(long firstBlock, long blockCount);
+  void Flush();
+}
+
+/// <summary>
+/// Raw variable-length track device for flux/GCR/MFM-style containers that are
+/// not yet sector-addressable. G64 belongs here; a decoder can later project it
+/// as <see cref="IRandomAccessBlockDevice"/> for a Commodore filesystem driver.
+/// </summary>
+public sealed record RawTrackInfo(
+  int Index,
+  long Length,
+  uint EncodingParameter = 0,
+  bool IsPresent = true
+);
+
+public interface IRawTrackDevice : IDisposable {
+  int TrackCount { get; }
+  bool CanWrite { get; }
+  IReadOnlyList<RawTrackInfo> EnumerateTracks();
+  int ReadTrack(int index, Span<byte> destination);
+  void WriteTrack(int index, ReadOnlySpan<byte> source, uint? encodingParameter = null);
+  void ClearTrack(int index);
+  void Flush();
+}
+
+/// <summary>
+/// Optional descriptor capability for opening the raw-track layer directly.
+/// This keeps track-container mutation separate from filesystem namespace CRUD.
+/// </summary>
+public interface IRawTrackDeviceProvider {
+  IRawTrackDevice OpenRawTrackDevice(Stream image, bool writable, bool leaveOpen = true);
+}
diff --git a/Compression.Registry/FilesystemDriverCoverage.cs b/Compression.Registry/FilesystemDriverCoverage.cs
new file mode 100644
index 000000000..7b0bc26e1
--- /dev/null
+++ b/Compression.Registry/FilesystemDriverCoverage.cs
@@ -0,0 +1,35 @@
+#pragma warning disable CS1591
+namespace Compression.Registry;
+
+/// <summary>
+/// Structural binding used to reach the common filesystem-driver contract.
+/// This deliberately says nothing about the exact image profile: probing an
+/// image can still refuse a damaged/unsupported feature set.
+/// </summary>
+public enum FilesystemDriverBindingKind {
+  None,
+  ArchiveProjection,
+  SidecarNative,
+  DescriptorNative,
+}
+
+/// <summary>
+/// Machine-readable repository coverage for one FileSystem.* descriptor.
+/// It answers whether the implementation has a path to an IFilesystemSession
+/// and which lower-level primitives are already available for finishing a
+/// native read/write driver.
+/// </summary>
+public sealed record FilesystemDriverCoverage(
+  string FormatId,
+  string DisplayName,
+  FilesystemDriverBindingKind Binding,
+  bool HasArchiveProjection,
+  bool HasArchiveMutation,
+  bool HasExtentMap,
+  bool HasBlockMover,
+  bool HasBlockDeviceProvider,
+  bool HasNativeReadinessProvider
+) {
+  public bool HasDriverPath => Binding != FilesystemDriverBindingKind.None;
+  public bool IsNative => Binding is FilesystemDriverBindingKind.DescriptorNative or FilesystemDriverBindingKind.SidecarNative;
+}
diff --git a/Compression.Registry/FilesystemDriverDerivation.cs b/Compression.Registry/FilesystemDriverDerivation.cs
new file mode 100644
index 000000000..1b483a824
--- /dev/null
+++ b/Compression.Registry/FilesystemDriverDerivation.cs
@@ -0,0 +1,597 @@
+#pragma warning disable CS1591
+
+namespace Compression.Registry;
+
+[Flags]
+public enum FilesystemDriverReadinessLayer : ulong {
+  None = 0,
+  ImageValidation = 1UL << 0,
+  Namespace = 1UL << 1,
+  SessionStableNodeIds = 1UL << 2,
+  NativeStableNodeIds = 1UL << 3,
+  ReadData = 1UL << 4,
+  RandomAccessRead = 1UL << 5,
+  AllocationMap = 1UL << 6,
+  WriteData = 1UL << 7,
+  Truncate = 1UL << 8,
+  NamespaceMutation = 1UL << 9,
+  MetadataMutation = 1UL << 10,
+  Links = 1UL << 11,
+  Flush = 1UL << 12,
+  DurabilityModel = 1UL << 13,
+  Recovery = 1UL << 14,
+  Concurrency = 1UL << 15,
+  ValidationCorpus = 1UL << 16,
+}
+
+public enum FilesystemDriverTarget {
+  ReadOnly,
+  ReadWrite,
+}
+
+public sealed record FilesystemDriverReadinessReport(
+  string FormatId,
+  FilesystemDriverTarget Target,
+  FilesystemDriverReadinessLayer AvailableLayers,
+  FilesystemDriverReadinessLayer RequiredLayers,
+  bool Derivable,
+  bool UsesNativeProvider,
+  IReadOnlyList<string> Blockers
+);
+
+/// <summary>
+/// Optional filesystem-specific readiness description. The generic derivation
+/// layer supplies a conservative report when a descriptor does not implement
+/// this interface; native implementations can use it to explain exactly which
+/// on-disk semantics still block a complete mounted driver.
+/// </summary>
+public interface IFilesystemDriverReadinessProvider {
+  FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(
+    Stream image,
+    FilesystemDriverTarget target);
+}
+
+/// <summary>
+/// Common entry point for filesystem frontends. Native filesystem providers are
+/// always preferred. A descriptor that only exposes the normalized archive
+/// listing/open-entry surface still gets a real read-only filesystem session:
+/// hierarchy is reconstructed, node ids remain stable for the lifetime of the
+/// mount, symlinks are represented, and file handles use positional reads.
+///
+/// The fallback is deliberately read-only. It never turns archive-level
+/// rebuild/Add/Remove support into mounted write support. This makes every
+/// filesystem parser usable by FUSE/Dokany/WinFsp-style frontends immediately,
+/// while leaving a precise upgrade path to native allocation and mutation code.
+/// </summary>
+public static class FilesystemDriverDerivation {
+  private const FilesystemDriverReadinessLayer ReadOnlyRequired =
+    FilesystemDriverReadinessLayer.ImageValidation |
+    FilesystemDriverReadinessLayer.Namespace |
+    FilesystemDriverReadinessLayer.SessionStableNodeIds |
+    FilesystemDriverReadinessLayer.ReadData |
+    FilesystemDriverReadinessLayer.RandomAccessRead;
+
+  private const FilesystemDriverReadinessLayer ReadWriteRequired =
+    ReadOnlyRequired |
+    FilesystemDriverReadinessLayer.AllocationMap |
+    FilesystemDriverReadinessLayer.WriteData |
+    FilesystemDriverReadinessLayer.Truncate |
+    FilesystemDriverReadinessLayer.NamespaceMutation |
+    FilesystemDriverReadinessLayer.Flush |
+    FilesystemDriverReadinessLayer.DurabilityModel |
+    FilesystemDriverReadinessLayer.Concurrency;
+
+  public static FilesystemDriverProfile Probe(
+      IFormatDescriptor descriptor,
+      Stream image,
+      string? password = null) {
+    ArgumentNullException.ThrowIfNull(descriptor);
+    ArgumentNullException.ThrowIfNull(image);
+
+    if (descriptor is IFilesystemDriverProvider native)
+      return native.ProbeFilesystem(image);
+
+    if (descriptor is not IArchiveFormatOperations archive)
+      return new FilesystemDriverProfile(
+        descriptor.Id,
+        "no filesystem projection",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        ["Descriptor exposes neither IFilesystemDriverProvider nor IArchiveFormatOperations."]);
+
+    try {
+      using var snapshot = DerivedFilesystemSnapshot.Capture(image);
+      using var probe = snapshot.OpenRead();
+      _ = archive.List(probe, password);
+      return DerivedReadOnlyProfile(descriptor.Id);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException) {
+      return new FilesystemDriverProfile(
+        descriptor.Id,
+        "archive-view probe failed",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [$"Filesystem projection could not enumerate this image: {FirstLine(e.Message)}"]);
+    }
+  }
+
+  public static IFilesystemSession Open(
+      IFormatDescriptor descriptor,
+      Stream image,
+      FilesystemOpenOptions options,
+      string? password = null) {
+    ArgumentNullException.ThrowIfNull(descriptor);
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(options);
+
+    if (descriptor is IFilesystemDriverProvider native)
+      return native.OpenFilesystem(image, options);
+
+    if (!options.ReadOnly)
+      throw new NotSupportedException(
+        $"{descriptor.Id} has no native writable filesystem provider. " +
+        "Archive-level rebuild/modify support is not a mount-grade write path.");
+
+    if (descriptor is not IArchiveFormatOperations archive)
+      throw new NotSupportedException(
+        $"{descriptor.Id} exposes no filesystem-driver provider and no list/open-entry projection.");
+
+    return new DerivedReadOnlyFilesystemSession(descriptor, archive, image, password);
+  }
+
+  public static FilesystemDriverReadinessReport Assess(
+      IFormatDescriptor descriptor,
+      Stream image,
+      FilesystemDriverTarget target,
+      string? password = null) {
+    ArgumentNullException.ThrowIfNull(descriptor);
+    ArgumentNullException.ThrowIfNull(image);
+
+    if (descriptor is IFilesystemDriverReadinessProvider specific)
+      return specific.DescribeFilesystemDriverReadiness(image, target);
+
+    var required = target == FilesystemDriverTarget.ReadOnly ? ReadOnlyRequired : ReadWriteRequired;
+    var blockers = new List<string>();
+    FilesystemDriverReadinessLayer available = FilesystemDriverReadinessLayer.None;
+    var usesNative = descriptor is IFilesystemDriverProvider;
+
+    if (usesNative) {
+      var profile = ((IFilesystemDriverProvider)descriptor).ProbeFilesystem(image);
+      if (profile.CanMount) {
+        available |= FilesystemDriverReadinessLayer.ImageValidation |
+                     FilesystemDriverReadinessLayer.Namespace |
+                     FilesystemDriverReadinessLayer.SessionStableNodeIds;
+        available |= LayersFor(profile.Capabilities);
+      }
+      if (profile.MutationModel != FilesystemMutationModel.None &&
+          profile.MutationModel != FilesystemMutationModel.WholeImageRebuild)
+        available |= FilesystemDriverReadinessLayer.DurabilityModel;
+      blockers.AddRange(profile.Limitations);
+    } else if (descriptor is IArchiveFormatOperations archive) {
+      try {
+        using var snapshot = DerivedFilesystemSnapshot.Capture(image);
+        using var source = snapshot.OpenRead();
+        _ = archive.List(source, password);
+        available |= ReadOnlyRequired;
+        blockers.Add("Node ids are stable only within the derived session; native on-disk object identity is not exposed yet.");
+        blockers.Add("Allocation/extents are not exposed through the generic archive projection.");
+      } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException) {
+        blockers.Add($"Current parser cannot enumerate this image: {FirstLine(e.Message)}");
+      }
+    } else {
+      blockers.Add("Descriptor does not expose IArchiveFormatOperations or a native filesystem provider.");
+    }
+
+    if (target == FilesystemDriverTarget.ReadWrite && (available & ReadWriteRequired) != ReadWriteRequired) {
+      if ((available & FilesystemDriverReadinessLayer.AllocationMap) == 0)
+        blockers.Add("Expose native allocation/free-space ownership instead of inferring it from extracted files.");
+      if ((available & FilesystemDriverReadinessLayer.WriteData) == 0)
+        blockers.Add("Implement bounded native file-data writes through the filesystem allocator.");
+      if ((available & FilesystemDriverReadinessLayer.NamespaceMutation) == 0)
+        blockers.Add("Implement native create/unlink/rename namespace mutation.");
+      if ((available & FilesystemDriverReadinessLayer.DurabilityModel) == 0)
+        blockers.Add("Model the filesystem's real write-ordering/journal/CoW durability boundary.");
+      if ((available & FilesystemDriverReadinessLayer.Concurrency) == 0)
+        blockers.Add("Define handle/cache/locking behavior for concurrent frontend requests.");
+    }
+
+    var derivable = (available & required) == required;
+    return new FilesystemDriverReadinessReport(
+      descriptor.Id,
+      target,
+      available,
+      required,
+      derivable,
+      usesNative,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static FilesystemDriverProfile DerivedReadOnlyProfile(string formatId)
+    => new(
+      formatId,
+      "derived read-only archive view",
+      FilesystemDriverCapabilities.EnumerateDirectories |
+      FilesystemDriverCapabilities.ReadData |
+      FilesystemDriverCapabilities.RandomAccess |
+      FilesystemDriverCapabilities.StableNodeIds |
+      FilesystemDriverCapabilities.CasePreservingNames,
+      FilesystemMutationModel.None,
+      CanMount: true,
+      CanMountWritable: false,
+      [
+        "Read-only compatibility projection over List/OpenEntry; allocation metadata is not exposed.",
+        "Node ids are deterministic and stable for this session, not claimed to be native inode/object identifiers.",
+      ]);
+
+  private static FilesystemDriverReadinessLayer LayersFor(FilesystemDriverCapabilities capabilities) {
+    var result = FilesystemDriverReadinessLayer.None;
+    if ((capabilities & FilesystemDriverCapabilities.EnumerateDirectories) != 0)
+      result |= FilesystemDriverReadinessLayer.Namespace;
+    if ((capabilities & FilesystemDriverCapabilities.StableNodeIds) != 0)
+      result |= FilesystemDriverReadinessLayer.SessionStableNodeIds |
+                FilesystemDriverReadinessLayer.NativeStableNodeIds;
+    if ((capabilities & FilesystemDriverCapabilities.ReadData) != 0)
+      result |= FilesystemDriverReadinessLayer.ReadData;
+    if ((capabilities & FilesystemDriverCapabilities.RandomAccess) != 0)
+      result |= FilesystemDriverReadinessLayer.RandomAccessRead;
+    if ((capabilities & FilesystemDriverCapabilities.WriteData) != 0)
+      result |= FilesystemDriverReadinessLayer.WriteData;
+    if ((capabilities & FilesystemDriverCapabilities.Truncate) != 0)
+      result |= FilesystemDriverReadinessLayer.Truncate;
+    if ((capabilities & (FilesystemDriverCapabilities.CreateFile |
+                         FilesystemDriverCapabilities.DeleteFile |
+                         FilesystemDriverCapabilities.CreateDirectory |
+                         FilesystemDriverCapabilities.RemoveDirectory |
+                         FilesystemDriverCapabilities.Rename)) != 0)
+      result |= FilesystemDriverReadinessLayer.NamespaceMutation;
+    if ((capabilities & FilesystemDriverCapabilities.SetMetadata) != 0)
+      result |= FilesystemDriverReadinessLayer.MetadataMutation;
+    if ((capabilities & (FilesystemDriverCapabilities.HardLinks |
+                         FilesystemDriverCapabilities.SymbolicLinks)) != 0)
+      result |= FilesystemDriverReadinessLayer.Links;
+    if ((capabilities & FilesystemDriverCapabilities.Flush) != 0)
+      result |= FilesystemDriverReadinessLayer.Flush;
+    return result;
+  }
+
+  private static string FirstLine(string message) {
+    var index = message.IndexOfAny(['\r', '\n']);
+    return index < 0 ? message : message[..index];
+  }
+}
+
+internal sealed class DerivedReadOnlyFilesystemSession : IFilesystemSession {
+  private readonly IArchiveFormatOperations _operations;
+  private readonly DerivedFilesystemSnapshot _snapshot;
+  private readonly string? _password;
+  private readonly Dictionary<FilesystemNodeId, Node> _nodes = [];
+  private readonly Dictionary<FilesystemNodeId, List<Node>> _children = [];
+  private bool _disposed;
+
+  private sealed class Node {
+    public required FilesystemNodeId Id { get; init; }
+    public required string Name { get; init; }
+    public required string Path { get; init; }
+    public required FilesystemNodeId Parent { get; init; }
+    public required FilesystemNodeKind Kind { get; set; }
+    public ArchiveEntryInfo? Entry { get; set; }
+  }
+
+  public DerivedReadOnlyFilesystemSession(
+      IFormatDescriptor descriptor,
+      IArchiveFormatOperations operations,
+      Stream image,
+      string? password) {
+    _operations = operations;
+    _password = password;
+    _snapshot = DerivedFilesystemSnapshot.Capture(image);
+    Profile = new FilesystemDriverProfile(
+      descriptor.Id,
+      "derived read-only archive view",
+      FilesystemDriverCapabilities.EnumerateDirectories |
+      FilesystemDriverCapabilities.ReadData |
+      FilesystemDriverCapabilities.RandomAccess |
+      FilesystemDriverCapabilities.StableNodeIds |
+      FilesystemDriverCapabilities.SymbolicLinks |
+      FilesystemDriverCapabilities.CasePreservingNames,
+      FilesystemMutationModel.None,
+      CanMount: true,
+      CanMountWritable: false,
+      [
+        "Compatibility filesystem projection; native allocation/extents are not exposed.",
+        "Writes require a native IFilesystemDriverProvider and are never emulated by rebuilding the image.",
+      ]);
+
+    BuildNamespace();
+  }
+
+  public FilesystemDriverProfile Profile { get; }
+  public FilesystemNodeId RootNodeId { get; } = new(1, 1);
+
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) {
+    ThrowIfDisposed();
+    var node = RequireNode(nodeId);
+    var entry = node.Entry;
+    var logical = node.Kind == FilesystemNodeKind.Directory ? 0 : Math.Max(0, entry?.OriginalSize ?? 0);
+    var allocated = node.Kind == FilesystemNodeKind.Directory
+      ? 0
+      : entry?.CompressedSize is >= 0 ? entry.CompressedSize : logical;
+    return new FilesystemNodeInfo(
+      node.Id,
+      node.Kind,
+      logical,
+      Math.Max(0, allocated),
+      LinkCount: 1,
+      Modified: ToOffset(entry?.LastModified));
+  }
+
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) {
+    ArgumentNullException.ThrowIfNull(name);
+    ThrowIfDisposed();
+    var parent = RequireNode(parentDirectory);
+    if (parent.Kind != FilesystemNodeKind.Directory)
+      throw new DirectoryNotFoundException(parent.Path);
+    if (!_children.TryGetValue(parentDirectory, out var children)) return null;
+
+    var exact = children.FirstOrDefault(child => string.Equals(child.Name, name, StringComparison.Ordinal));
+    if (exact != null) return exact.Id;
+    var folded = children.Where(child => string.Equals(child.Name, name, StringComparison.OrdinalIgnoreCase)).ToArray();
+    return folded.Length == 1 ? folded[0].Id : null;
+  }
+
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) {
+    ThrowIfDisposed();
+    var parent = RequireNode(directory);
+    if (parent.Kind != FilesystemNodeKind.Directory)
+      throw new DirectoryNotFoundException(parent.Path);
+    return (_children.TryGetValue(directory, out var children) ? children : [])
+      .OrderBy(child => child.Name, StringComparer.Ordinal)
+      .Select(child => new FilesystemDirectoryEntry(child.Name, child.Id, child.Kind))
+      .ToArray();
+  }
+
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) {
+    ThrowIfDisposed();
+    if (access != FileAccess.Read)
+      throw new NotSupportedException("The derived filesystem projection is read-only.");
+    var node = RequireNode(nodeId);
+    if (node.Kind != FilesystemNodeKind.RegularFile)
+      throw new UnauthorizedAccessException($"'{node.Path}' is not a regular file.");
+    if (node.Entry == null)
+      throw new InvalidDataException($"Derived node '{node.Path}' has no backing archive entry.");
+
+    var backing = node.Entry;
+    return SpoolingReadOnlyFileHandle.Create(
+      node.Id,
+      Math.Max(0, backing.OriginalSize),
+      output => {
+        using var archive = _snapshot.OpenRead();
+        using var entry = _operations.OpenEntry(archive, backing.Name, _password);
+        entry.CopyTo(output);
+      });
+  }
+
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name)
+    => throw ReadOnly();
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name)
+    => throw ReadOnly();
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name)
+    => throw ReadOnly();
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name)
+    => throw ReadOnly();
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)
+    => throw ReadOnly();
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)
+    => throw ReadOnly();
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)
+    => throw ReadOnly();
+
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) {
+    ThrowIfDisposed();
+    var node = RequireNode(nodeId);
+    if (node.Kind != FilesystemNodeKind.SymbolicLink || node.Entry?.LinkTarget == null)
+      throw new InvalidOperationException($"'{node.Path}' is not a symbolic link with a decoded target.");
+    return node.Entry.LinkTarget;
+  }
+
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch)
+    => throw ReadOnly();
+
+  public void Flush() {
+    ThrowIfDisposed();
+  }
+
+  public IFilesystemTransaction BeginTransaction()
+    => throw new NotSupportedException("The derived read-only filesystem projection has no transactions.");
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _snapshot.Dispose();
+  }
+
+  private void BuildNamespace() {
+    var root = new Node {
+      Id = RootNodeId,
+      Name = string.Empty,
+      Path = string.Empty,
+      Parent = default,
+      Kind = FilesystemNodeKind.Directory,
+    };
+    _nodes[root.Id] = root;
+    _children[root.Id] = [];
+
+    List<ArchiveEntryInfo> entries;
+    using (var source = _snapshot.OpenRead())
+      entries = _operations.List(source, _password);
+
+    var normalized = entries
+      .Select(entry => (Entry: entry, Path: NormalizePath(entry.Name)))
+      .Where(item => item.Path.Length > 0)
+      .OrderBy(item => item.Path, StringComparer.Ordinal)
+      .ToArray();
+
+    var byPath = new Dictionary<string, Node>(StringComparer.Ordinal) { [string.Empty] = root };
+    ulong nextId = 2;
+
+    foreach (var item in normalized) {
+      var segments = item.Path.Split('/');
+      var currentPath = string.Empty;
+      var parent = root;
+      for (var i = 0; i < segments.Length; ++i) {
+        var segment = segments[i];
+        currentPath = currentPath.Length == 0 ? segment : currentPath + "/" + segment;
+        var isLeaf = i == segments.Length - 1;
+        if (!byPath.TryGetValue(currentPath, out var node)) {
+          node = new Node {
+            Id = new FilesystemNodeId(nextId++, 1),
+            Name = segment,
+            Path = currentPath,
+            Parent = parent.Id,
+            Kind = isLeaf ? KindFor(item.Entry) : FilesystemNodeKind.Directory,
+            Entry = isLeaf ? item.Entry : null,
+          };
+          byPath[currentPath] = node;
+          _nodes[node.Id] = node;
+          _children.TryAdd(node.Id, []);
+          _children[parent.Id].Add(node);
+        } else if (isLeaf) {
+          if (node.Entry != null)
+            throw new InvalidDataException($"Filesystem projection contains duplicate path '{currentPath}'.");
+          if (node.Kind != FilesystemNodeKind.Directory && item.Entry.IsDirectory)
+            throw new InvalidDataException($"Filesystem projection path '{currentPath}' changes node kind.");
+          node.Entry = item.Entry;
+          node.Kind = KindFor(item.Entry);
+        }
+        parent = node;
+      }
+    }
+  }
+
+  private Node RequireNode(FilesystemNodeId nodeId)
+    => _nodes.TryGetValue(nodeId, out var node)
+      ? node
+      : throw new FileNotFoundException($"Filesystem node {nodeId.Value}:{nodeId.Generation} is not present in this session.");
+
+  private static FilesystemNodeKind KindFor(ArchiveEntryInfo entry)
+    => entry.IsDirectory ? FilesystemNodeKind.Directory
+      : entry.IsSymlink ? FilesystemNodeKind.SymbolicLink
+      : FilesystemNodeKind.RegularFile;
+
+  private static string NormalizePath(string path) {
+    ArgumentNullException.ThrowIfNull(path);
+    var result = new List<string>();
+    foreach (var raw in path.Replace('\\', '/').Split('/', StringSplitOptions.RemoveEmptyEntries)) {
+      if (raw == ".") continue;
+      if (raw == "..")
+        throw new InvalidDataException($"Filesystem entry '{path}' escapes its root with '..'.");
+      result.Add(raw);
+    }
+    return string.Join('/', result);
+  }
+
+  private static DateTimeOffset? ToOffset(DateTime? value) {
+    if (value == null) return null;
+    return value.Value.Kind switch {
+      DateTimeKind.Utc => new DateTimeOffset(value.Value, TimeSpan.Zero),
+      DateTimeKind.Local => new DateTimeOffset(value.Value),
+      _ => new DateTimeOffset(DateTime.SpecifyKind(value.Value, DateTimeKind.Utc), TimeSpan.Zero),
+    };
+  }
+
+  private static NotSupportedException ReadOnly()
+    => new("The derived filesystem projection is read-only; use a native filesystem provider for mounted writes.");
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
+
+internal sealed class DerivedReadOnlyFileHandle : IFilesystemFileHandle {
+  private readonly byte[] _data;
+  private bool _disposed;
+
+  public DerivedReadOnlyFileHandle(FilesystemNodeId nodeId, byte[] data) {
+    NodeId = nodeId;
+    _data = data;
+  }
+
+  public FilesystemNodeId NodeId { get; }
+  public long Length {
+    get {
+      ThrowIfDisposed();
+      return _data.LongLength;
+    }
+  }
+
+  public int Read(long offset, Span<byte> destination) {
+    ThrowIfDisposed();
+    if (offset < 0) throw new ArgumentOutOfRangeException(nameof(offset));
+    if (offset >= _data.LongLength || destination.Length == 0) return 0;
+    var count = checked((int)Math.Min(destination.Length, _data.LongLength - offset));
+    _data.AsSpan(checked((int)offset), count).CopyTo(destination);
+    return count;
+  }
+
+  public void Write(long offset, ReadOnlySpan<byte> source)
+    => throw new NotSupportedException("The derived filesystem projection is read-only.");
+  public void SetLength(long length)
+    => throw new NotSupportedException("The derived filesystem projection is read-only.");
+  public void Flush() => ThrowIfDisposed();
+  public void Dispose() => _disposed = true;
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
+
+internal sealed class DerivedFilesystemSnapshot : IDisposable {
+  private const long MemoryThreshold = 16L * 1024 * 1024;
+  private readonly byte[]? _memory;
+  private readonly string? _temporaryPath;
+  private bool _disposed;
+
+  private DerivedFilesystemSnapshot(byte[] memory) => _memory = memory;
+  private DerivedFilesystemSnapshot(string temporaryPath) => _temporaryPath = temporaryPath;
+
+  public static DerivedFilesystemSnapshot Capture(Stream source) {
+    ArgumentNullException.ThrowIfNull(source);
+    if (!source.CanRead) throw new ArgumentException("Filesystem derivation requires a readable image.", nameof(source));
+
+    var originalPosition = source.CanSeek ? source.Position : 0;
+    try {
+      if (source.CanSeek) source.Position = 0;
+      if (source.CanSeek && source.Length <= MemoryThreshold) {
+        using var memory = new MemoryStream(checked((int)source.Length));
+        source.CopyTo(memory);
+        return new DerivedFilesystemSnapshot(memory.ToArray());
+      }
+
+      var path = Path.Combine(Path.GetTempPath(), "cwb_fs_" + Guid.NewGuid().ToString("N") + ".img");
+      try {
+        using (var target = new FileStream(path, FileMode.CreateNew, FileAccess.Write, FileShare.Read,
+                   64 * 1024, FileOptions.SequentialScan))
+          source.CopyTo(target);
+        return new DerivedFilesystemSnapshot(path);
+      } catch {
+        try { File.Delete(path); } catch { }
+        throw;
+      }
+    } finally {
+      if (source.CanSeek) source.Position = originalPosition;
+    }
+  }
+
+  public Stream OpenRead() {
+    ObjectDisposedException.ThrowIf(_disposed, this);
+    if (_memory != null) return new MemoryStream(_memory, writable: false);
+    return new FileStream(_temporaryPath!, FileMode.Open, FileAccess.Read,
+      FileShare.Read | FileShare.Delete, 64 * 1024, FileOptions.RandomAccess);
+  }
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    if (_temporaryPath != null) {
+      try { File.Delete(_temporaryPath); } catch { }
+    }
+  }
+}
diff --git a/Compression.Registry/FormatCapabilities.cs b/Compression.Registry/FormatCapabilities.cs
index b5a77191b..cff72da2a 100644
--- a/Compression.Registry/FormatCapabilities.cs
+++ b/Compression.Registry/FormatCapabilities.cs
@@ -8,23 +8,23 @@ namespace Compression.Registry;
 /// <list type="bullet">
 ///   <item><description><b>Unsupported</b> — no descriptor exists.</description></item>
 ///   <item><description><b>Read-Only</b> — <see cref="CanList"/> and/or <see cref="CanExtract"/> only.</description></item>
-///   <item><description><b>WORM</b> (Write-Once-Read-Many) — adds <see cref="CanCreate"/>: a fresh archive can be produced from inputs, but existing archives cannot be modified in place.</description></item>
-///   <item><description><b>R/W</b> (Modify) — adds <see cref="CanModify"/>: entries can be added, replaced, or removed in an existing archive without full rewrite.</description></item>
+///   <item><description><b>WORM</b> (Write-Once-Read-Many) — adds <see cref="CanCreate"/>: a fresh archive/image can be produced, but the library has no supported edit of an existing instance.</description></item>
+///   <item><description><b>R/W</b> (Modify) — adds <see cref="CanModify"/>: an existing instance supports add/replace/remove and remains valid after the edit.</description></item>
 /// </list>
 /// <para>
-/// Most archive formats stop at WORM; true in-place modification is rare because compressed
-/// archive containers don't generally support entry mutation without a full rebuild.
+/// <b>R/W describes the public operation, not the physical write strategy.</b>
+/// A format may update allocation metadata in place, append a new index, relayout members,
+/// or rebuild the complete image. Those are implementation choices. If callers can open an
+/// existing instance, apply add/replace/remove through <see cref="IArchiveModifiable"/>, and
+/// obtain a valid instance preserving the semantics the implementation claims to support,
+/// the format is R/W at this API surface. Conversely, merely having a writer for fresh images
+/// is WORM and must not set <see cref="CanModify"/>.
 /// </para>
 /// <para>
-/// <b>Honesty rule — rebuild-backed modification is WORM, not R/W.</b> A format may implement
-/// <see cref="IArchiveModifiable"/> purely to make the add / remove / purge verbs <em>work</em>,
-/// backing them with the verified extract → re-create rebuild (the default <see cref="IArchiveModifiable"/>
-/// members, or <c>ModifyRebuilder</c> / <see cref="RebuildVerb"/>). That is a full rewrite of the
-/// container, so such a format advertises <see cref="CanCreate"/> only and must <b>not</b> set
-/// <see cref="CanModify"/> — the verb still runs, but no in-place R/W is claimed. <see cref="CanModify"/>
-/// is reserved for formats with a genuine in-place writer that edits the existing container
-/// (e.g. ZIP/TAR central-directory edits, FAT/NTFS/ext block writes, byte-identity append).
-/// <c>Compression.Tests.Operations.WriteCapabilityHonestyTests</c> enforces this for every claimant.
+/// This distinction is especially important for read-only-on-mount filesystem formats such as
+/// SquashFS, CramFS and EROFS: the native filesystem driver may intentionally forbid mounted
+/// writes while an offline image editor can still support complete, deterministic mutation by
+/// relayout/rebuild. <see cref="CanModify"/> reports the latter capability.
 /// </para>
 /// </summary>
 [Flags]
@@ -32,7 +32,7 @@ public enum FormatCapabilities {
   None = 0,
   CanList = 1 << 0,
   CanExtract = 1 << 1,
-  /// <summary>WORM: can produce a fresh archive from inputs (no in-place modification).</summary>
+  /// <summary>WORM: can produce a fresh archive/image, but has no supported existing-instance edit.</summary>
   CanCreate = 1 << 2,
   CanTest = 1 << 3,
   SupportsPassword = 1 << 4,
@@ -40,6 +40,6 @@ public enum FormatCapabilities {
   SupportsDirectories = 1 << 6,
   SupportsOptimize = 1 << 8,
   CanCompoundWithTar = 1 << 9,
-  /// <summary>R/W: can modify an existing archive (add/replace/remove entries) without full rewrite. Implies <see cref="CanCreate"/>.</summary>
+  /// <summary>R/W: can add/replace/remove entries in an existing archive/image. The implementation may edit in place or relayout/rebuild. Implies <see cref="CanCreate"/> for normal writable formats.</summary>
   CanModify = 1 << 10,
-}
+}
\ No newline at end of file
diff --git a/Compression.Registry/FormatRegistry.cs b/Compression.Registry/FormatRegistry.cs
index 3fba96f8e..a7d93702f 100644
--- a/Compression.Registry/FormatRegistry.cs
+++ b/Compression.Registry/FormatRegistry.cs
@@ -1,8 +1,9 @@
 namespace Compression.Registry;
 
 /// <summary>
-/// Central registry of all format descriptors. Populated at startup via <see cref="Register"/>
-/// calls (typically from source-generated code), then finalized with <see cref="Initialize"/>.
+/// Central registry of all format descriptors and their optional driver sidecars.
+/// Populated at startup by generated registration code, then finalized with
+/// <see cref="Initialize"/>.
 /// </summary>
 public static class FormatRegistry {
 
@@ -13,25 +14,53 @@ public static class FormatRegistry {
   private static readonly Dictionary<string, IStreamFormatOperations> _streamOps = new(StringComparer.OrdinalIgnoreCase);
   private static readonly Dictionary<string, IArchiveFormatOperations> _archiveOps = new(StringComparer.OrdinalIgnoreCase);
   private static readonly Dictionary<string, IAsyncArchiveOperations> _asyncArchiveOps = new(StringComparer.OrdinalIgnoreCase);
+  private static readonly Dictionary<string, IFilesystemDriverAdapter> _filesystemDrivers = new(StringComparer.OrdinalIgnoreCase);
+  private static readonly HashSet<string> _filesystemFormatIds = new(StringComparer.OrdinalIgnoreCase);
   private static bool _initialized;
 
-  /// <summary>
-  /// Finalize the registry by building lookup tables. Safe to call multiple times.
-  /// Call this after all <see cref="Register"/> calls are complete.
-  /// </summary>
   public static void Initialize() {
     if (_initialized) return;
-    _initialized = true;
     BuildLookups();
+
+    foreach (var (id, _) in _filesystemDrivers)
+      if (!_byId.ContainsKey(id))
+        throw new InvalidOperationException($"Filesystem driver adapter '{id}' has no registered format descriptor.");
+
+    // A FileSystem.* project is not allowed to stop at an isolated parser API.
+    // Every registered filesystem must be reachable through the common driver
+    // contract either natively/through a sidecar or through the conservative
+    // read-only List/OpenEntry projection. This is structural; per-image Probe
+    // can still reject damaged or unsupported feature profiles.
+    foreach (var id in _filesystemFormatIds) {
+      if (!_byId.TryGetValue(id, out var descriptor))
+        throw new InvalidOperationException($"Generated filesystem id '{id}' has no registered descriptor.");
+      if (descriptor is IFilesystemDriverProvider) continue;
+      if (_filesystemDrivers.ContainsKey(id)) continue;
+      if (descriptor is IArchiveFormatOperations) continue;
+      throw new InvalidOperationException(
+        $"Filesystem '{id}' exposes no IFilesystemDriverProvider, generated sidecar, or IArchiveFormatOperations projection.");
+    }
+
+    // Publish initialized only after every cross-registry invariant succeeds.
+    // A failed coverage check must not poison the registry into an apparently
+    // initialized state that subsequent callers can no longer repair/reset in tests.
+    _initialized = true;
   }
 
   /// <summary>
-  /// Register a format descriptor. Called by generated code and for compound tar auto-generation.
-  /// Must be called before <see cref="Initialize"/>.
+  /// Register a format descriptor. Source-generated calls set
+  /// <paramref name="isFilesystem"/> for descriptors declared under a
+  /// <c>FileSystem.*</c> namespace so filesystem coverage is explicit rather
+  /// than inferred from extensions or display names.
   /// </summary>
-  public static void Register(IFormatDescriptor descriptor) {
+  public static void Register(IFormatDescriptor descriptor, bool isFilesystem = false) {
+    ArgumentNullException.ThrowIfNull(descriptor);
+    if (_initialized) throw new InvalidOperationException("FormatRegistry is already initialized.");
+    if (_byId.ContainsKey(descriptor.Id))
+      throw new InvalidOperationException($"A format descriptor with id '{descriptor.Id}' is already registered.");
     _all.Add(descriptor);
-    _byId[descriptor.Id] = descriptor;
+    _byId.Add(descriptor.Id, descriptor);
+    if (isFilesystem) _filesystemFormatIds.Add(descriptor.Id);
     if (descriptor is IStreamFormatOperations streamOps)
       _streamOps[descriptor.Id] = streamOps;
     if (descriptor is IArchiveFormatOperations archiveOps)
@@ -40,45 +69,131 @@ public static void Register(IFormatDescriptor descriptor) {
       _asyncArchiveOps[descriptor.Id] = asyncArchiveOps;
   }
 
-  /// <summary>All registered descriptors.</summary>
+  /// <summary>
+  /// Registers one source-generated native filesystem-driver sidecar. Duplicate
+  /// adapters for the same format ID are a build/runtime contract error rather
+  /// than whichever registration happened to win.
+  /// </summary>
+  public static void RegisterFilesystemDriver(IFilesystemDriverAdapter driver) {
+    ArgumentNullException.ThrowIfNull(driver);
+    if (_initialized) throw new InvalidOperationException("FormatRegistry is already initialized.");
+    if (string.IsNullOrWhiteSpace(driver.FormatId))
+      throw new ArgumentException("Filesystem driver adapter must provide a format ID.", nameof(driver));
+    if (!_filesystemDrivers.TryAdd(driver.FormatId, driver))
+      throw new InvalidOperationException($"A filesystem driver adapter for '{driver.FormatId}' is already registered.");
+  }
+
   public static IReadOnlyList<IFormatDescriptor> All => _all;
 
-  /// <summary>Look up a descriptor by its unique ID.</summary>
+  /// <summary>All descriptor IDs originating from FileSystem.* projects.</summary>
+  public static IReadOnlyList<string> FilesystemFormatIds
+    => _filesystemFormatIds.OrderBy(id => id, StringComparer.OrdinalIgnoreCase).ToArray();
+
   public static IFormatDescriptor? GetById(string id)
     => _byId.GetValueOrDefault(id);
 
-  /// <summary>Look up a descriptor by file path/extension. Checks compound extensions first (longest match).</summary>
   public static IFormatDescriptor? GetByExtension(string path) {
     var lower = path.ToLowerInvariant();
-
-    // Check compound extensions first (e.g. .tar.gz, .tar.bz2)
-    foreach (var (ext, desc) in _byCompoundExtension) {
-      if (lower.EndsWith(ext))
-        return desc;
-    }
-
-    // Fall back to single extension
+    foreach (var (ext, desc) in _byCompoundExtension)
+      if (lower.EndsWith(ext)) return desc;
     var singleExt = Path.GetExtension(lower);
     return string.IsNullOrEmpty(singleExt) ? null : _byExtension.GetValueOrDefault(singleExt);
   }
 
-  /// <summary>Get all descriptors in a given category.</summary>
   public static IEnumerable<IFormatDescriptor> GetByCategory(FormatCategory category)
     => _all.Where(d => d.Category == category);
 
-  /// <summary>Get stream operations for a format ID, or null if not a stream format.</summary>
   public static IStreamFormatOperations? GetStreamOps(string id)
     => _streamOps.GetValueOrDefault(id);
 
-  /// <summary>Get archive operations for a format ID, or null if not an archive format.</summary>
   public static IArchiveFormatOperations? GetArchiveOps(string id)
     => _archiveOps.GetValueOrDefault(id);
 
-  /// <summary>Get async archive operations for a format ID, or null if the format doesn't support async listing.</summary>
+  /// <summary>Returns a generated native driver sidecar for the format, when one exists.</summary>
+  public static IFilesystemDriverAdapter? GetFilesystemDriver(string id)
+    => _filesystemDrivers.GetValueOrDefault(id);
+
+  /// <summary>
+  /// Structural driver coverage for all FileSystem.* descriptors. This is safe
+  /// to inspect without an image and is intended for CI/readiness dashboards.
+  /// Use <see cref="AssessFilesystemDriver"/> for exact per-image semantics.
+  /// </summary>
+  public static IReadOnlyList<FilesystemDriverCoverage> GetFilesystemDriverCoverage()
+    => _filesystemFormatIds
+      .OrderBy(id => id, StringComparer.OrdinalIgnoreCase)
+      .Select(GetFilesystemDriverCoverage)
+      .ToArray();
+
+  public static FilesystemDriverCoverage GetFilesystemDriverCoverage(string id) {
+    if (!_filesystemFormatIds.Contains(id))
+      throw new KeyNotFoundException($"Format '{id}' is not registered as a FileSystem.* descriptor.");
+    var descriptor = GetById(id)
+      ?? throw new KeyNotFoundException($"Unknown format id '{id}'.");
+    var sidecar = _filesystemDrivers.GetValueOrDefault(id);
+    var binding = descriptor is IFilesystemDriverProvider
+      ? FilesystemDriverBindingKind.DescriptorNative
+      : sidecar != null
+        ? FilesystemDriverBindingKind.SidecarNative
+        : descriptor is IArchiveFormatOperations
+          ? FilesystemDriverBindingKind.ArchiveProjection
+          : FilesystemDriverBindingKind.None;
+    return new FilesystemDriverCoverage(
+      descriptor.Id,
+      descriptor.DisplayName,
+      binding,
+      HasArchiveProjection: descriptor is IArchiveFormatOperations,
+      HasArchiveMutation: descriptor is IArchiveModifiable,
+      HasExtentMap: descriptor is IFilesystemExtentMap,
+      HasBlockMover: descriptor is IFilesystemBlockMover,
+      HasBlockDeviceProvider: descriptor is IRandomAccessBlockDeviceProvider,
+      HasNativeReadinessProvider:
+        descriptor is IFilesystemDriverReadinessProvider || sidecar is IFilesystemDriverReadinessProvider);
+  }
+
+  public static FilesystemDriverProfile ProbeFilesystem(
+      string id,
+      Stream image,
+      string? password = null) {
+    var descriptor = GetById(id)
+      ?? throw new KeyNotFoundException($"Unknown format id '{id}'.");
+    if (descriptor is IFilesystemDriverProvider native)
+      return native.ProbeFilesystem(image);
+    if (_filesystemDrivers.TryGetValue(id, out var adapter))
+      return adapter.ProbeFilesystem(image);
+    return FilesystemDriverDerivation.Probe(descriptor, image, password);
+  }
+
+  public static IFilesystemSession OpenFilesystem(
+      string id,
+      Stream image,
+      FilesystemOpenOptions options,
+      string? password = null) {
+    var descriptor = GetById(id)
+      ?? throw new KeyNotFoundException($"Unknown format id '{id}'.");
+    if (descriptor is IFilesystemDriverProvider native)
+      return native.OpenFilesystem(image, options);
+    if (_filesystemDrivers.TryGetValue(id, out var adapter))
+      return adapter.OpenFilesystem(image, options);
+    return FilesystemDriverDerivation.Open(descriptor, image, options, password);
+  }
+
+  public static FilesystemDriverReadinessReport AssessFilesystemDriver(
+      string id,
+      Stream image,
+      FilesystemDriverTarget target,
+      string? password = null) {
+    var descriptor = GetById(id)
+      ?? throw new KeyNotFoundException($"Unknown format id '{id}'.");
+    if (descriptor is IFilesystemDriverReadinessProvider native)
+      return native.DescribeFilesystemDriverReadiness(image, target);
+    if (_filesystemDrivers.TryGetValue(id, out var adapter))
+      return adapter.DescribeFilesystemDriverReadiness(image, target);
+    return FilesystemDriverDerivation.Assess(descriptor, image, target, password);
+  }
+
   public static IAsyncArchiveOperations? GetAsyncArchiveOps(string id)
     => _asyncArchiveOps.GetValueOrDefault(id);
 
-  /// <summary>Reset the registry (for testing only).</summary>
   internal static void Reset() {
     _all.Clear();
     _byId.Clear();
@@ -87,6 +202,8 @@ internal static void Reset() {
     _streamOps.Clear();
     _archiveOps.Clear();
     _asyncArchiveOps.Clear();
+    _filesystemDrivers.Clear();
+    _filesystemFormatIds.Clear();
     _initialized = false;
   }
 
@@ -94,7 +211,6 @@ private static void BuildLookups() {
     foreach (var desc in _all) {
       foreach (var ext in desc.CompoundExtensions)
         _byCompoundExtension.TryAdd(ext.ToLowerInvariant(), desc);
-
       foreach (var ext in desc.Extensions)
         _byExtension.TryAdd(ext.ToLowerInvariant(), desc);
     }
diff --git a/Compression.Registry/IArchiveDefragmentable.cs b/Compression.Registry/IArchiveDefragmentable.cs
index d62d7ca49..53a59841d 100644
--- a/Compression.Registry/IArchiveDefragmentable.cs
+++ b/Compression.Registry/IArchiveDefragmentable.cs
@@ -1,47 +1,52 @@
 namespace Compression.Registry;
 
 /// <summary>
-/// Opt-in capability: the descriptor can rewrite an archive in place so that every file
-/// occupies a contiguous cluster run, optionally with a chosen layout strategy
-/// (consolidate at start / end, lazy hole-fill, carve a free region). Complements the
-/// allocator's automatic fast-defrag (which fires only when a pending allocation can't
-/// find a contiguous hole); this is the user-initiated full pass.
+/// Opt-in capability for physical or logical re-layout. Native mutable filesystems
+/// may move extents in place; WORM/archive containers can satisfy the same verb by
+/// building a verified staged target and committing it after completion.
 /// </summary>
 public interface IArchiveDefragmentable {
   /// <summary>
-  /// Rebuilds the archive content in place so every file is contiguous. Outer byte size
-  /// is preserved. Free space is consolidated at the end.
-  ///
-  /// <para><b>Default implementation</b>: any descriptor that also implements
-  /// <see cref="IArchiveFormatOperations"/> + <see cref="IArchiveCreatable"/> gets
-  /// defragmentation for free — a verified in-place extract → re-create rebuild via
-  /// <see cref="RebuildVerb.RebuildInPlace"/> (the rebuild-via-WORM pattern inherently
-  /// lays every file out contiguously) that refuses to commit a lossy result. Formats
-  /// with a true in-place block mover override this for efficiency and full mode support.</para>
+  /// Defragments using the format's default consolidate-at-start strategy.
+  /// Generic list/extract/create descriptors use the verified staged rebuild.
   /// </summary>
   void Defragment(Stream archive) {
     if (this is not IArchiveFormatOperations ops || this is not IArchiveCreatable creator)
-      throw new System.NotSupportedException(
-        "The default Defragment requires the descriptor to also implement IArchiveFormatOperations + IArchiveCreatable.");
+      throw new NotSupportedException(
+        "The default Defragment requires IArchiveFormatOperations + IArchiveCreatable.");
     RebuildVerb.RebuildInPlace(archive, ops, creator);
   }
 
   /// <summary>
-  /// Rewrites the archive content according to <paramref name="options"/>. Default
-  /// implementation forwards to <see cref="Defragment(System.IO.Stream)"/> for
-  /// <see cref="DefragMode.ConsolidateAtStart"/> and throws for every other mode —
-  /// implementers should override to support all modes their on-disk format permits.
+  /// Rewrites according to <paramref name="options"/>. Descriptors with their own
+  /// native parameterless mover retain it. Descriptors relying on the interface
+  /// default are routed through the progress-reporting, cancellable staged rebuild,
+  /// so archive repacks and WORM re-layouts drive the same block-map UI as physical
+  /// filesystem extent moves.
   /// </summary>
-  /// <exception cref="System.NotSupportedException">If the implementer doesn't support
-  /// the requested mode (default for any mode other than
-  /// <see cref="DefragMode.ConsolidateAtStart"/>).</exception>
   void Defragment(Stream archive, DefragOptions options) {
-    System.ArgumentNullException.ThrowIfNull(options);
-    if (options.Mode == DefragMode.ConsolidateAtStart) {
+    ArgumentNullException.ThrowIfNull(options);
+    if (options.Mode != DefragMode.ConsolidateAtStart)
+      throw new NotSupportedException(
+        $"This descriptor only supports DefragMode.ConsolidateAtStart; got {options.Mode}.");
+
+    // Preserve a concrete native parameterless implementation when one exists.
+    // Generic promoted descriptors have no such method and therefore get the
+    // staged rebuild below, including block-map progress and safe cancellation.
+    var native = this.GetType().GetMethod(nameof(Defragment), [typeof(Stream)]);
+    if (native != null && native.DeclaringType != typeof(IArchiveDefragmentable)) {
+      options.CancellationToken.ThrowIfCancellationRequested();
       this.Defragment(archive);
       return;
     }
-    throw new System.NotSupportedException(
-      $"This descriptor only supports DefragMode.ConsolidateAtStart; got {options.Mode}.");
+
+    if (this is IArchiveFormatOperations ops && this is IArchiveCreatable creator) {
+      RebuildVerb.RebuildInPlace(archive, ops, creator,
+        onProgress: options.OnProgress,
+        cancellationToken: options.CancellationToken);
+      return;
+    }
+
+    this.Defragment(archive);
   }
 }
diff --git a/Compression.Registry/IArchiveFormatOperations.cs b/Compression.Registry/IArchiveFormatOperations.cs
index ce8dd587e..120498064 100644
--- a/Compression.Registry/IArchiveFormatOperations.cs
+++ b/Compression.Registry/IArchiveFormatOperations.cs
@@ -20,59 +20,48 @@ public interface IArchiveFormatOperations {
   /// entry's logical bytes — physically incapable of reading slack space,
   /// adjacent entries, padding/alignment fillers, or header/metadata regions.
   /// This is the canonical per-entry isolation primitive used by streaming
-  /// conversion pipelines.
+  /// conversion and derived-filesystem pipelines.
   /// </summary>
   /// <remarks>
   /// <para>
-  /// The returned stream is always a <see cref="BoundedEntryStream"/> (or a
-  /// wrapper that satisfies the same contract). Reads past the entry's
-  /// logical size return 0 (EOF); seek targets are clamped to the bound.
-  /// The caller owns disposal.
+  /// Reads past the logical size return 0 (EOF); seek targets cannot escape the
+  /// entry. The caller owns disposal.
   /// </para>
   /// <para>
-  /// Default implementation buffers the entry's bytes via
-  /// <see cref="ExtractEntryToMemory"/> and wraps a <see cref="MemoryStream"/>
-  /// over the result. Descriptors with native per-entry readers (FAT cluster
-  /// chains, ZIP DEFLATE wrapper, TAR positional slice, 7z folder slot)
-  /// should override to return a properly bounded streaming view of their
-  /// decoder output.
+  /// The default implementation intentionally does <b>not</b> materialize a
+  /// <c>byte[]</c>. It asks <see cref="Extract"/> for the selected entry in an
+  /// isolated temporary directory, opens the resulting file as a seekable
+  /// stream, and deletes that tree on dispose. This gives every descriptor a
+  /// large-file-safe streaming fallback even before it grows a native per-entry
+  /// reader. Native readers (FAT chains, ZIP decoder streams, TAR slices, etc.)
+  /// should still override this to avoid the temporary extraction pass.
   /// </para>
   /// </remarks>
   public virtual Stream OpenEntry(Stream archive, string entryName, string? password) {
     ArgumentNullException.ThrowIfNull(archive);
-    ArgumentNullException.ThrowIfNull(entryName);
-    var bytes = this.ExtractEntryToMemory(archive, entryName, password);
-    return new BoundedEntryStream(new MemoryStream(bytes, writable: false), bytes.Length, leaveOpen: false);
+    ArgumentException.ThrowIfNullOrWhiteSpace(entryName);
+    var extracted = TemporaryExtractedEntryStream.Open(this, archive, entryName, password);
+    return new BoundedEntryStream(extracted, extracted.Length, leaveOpen: false);
   }
 
   /// <summary>
-  /// Extracts a single entry to a byte array without writing to disk. The default
-  /// implementation now routes through <see cref="OpenEntry"/> so the bounded
-  /// streaming contract is enforced even when callers ask for a buffered result.
-  /// Descriptors that have a more efficient native byte-array path (e.g. a
-  /// reader that already materialises the whole entry) can still override.
+  /// Extracts a single entry to a byte array. This is the explicitly buffered
+  /// convenience API; callers working with large entries should use
+  /// <see cref="OpenEntry"/> instead.
   /// </summary>
   /// <remarks>
-  /// The wrapper rewinds <paramref name="archive"/> to position 0 when
-  /// possible, opens the entry as a bounded stream, and copies it into a
-  /// fresh byte array. The bound on <see cref="OpenEntry"/> guarantees the
-  /// result contains only the entry's logical bytes.
+  /// The default routes through <see cref="OpenEntry"/>, so descriptor-specific
+  /// isolation/decoding semantics are preserved. A result past the runtime array
+  /// limit naturally fails here rather than imposing that limit on the streaming
+  /// API or filesystem-driver layer.
   /// </remarks>
   public virtual byte[] ExtractEntryToMemory(Stream archive, string entryName, string? password) {
     ArgumentNullException.ThrowIfNull(archive);
-    ArgumentNullException.ThrowIfNull(entryName);
+    ArgumentException.ThrowIfNullOrWhiteSpace(entryName);
     if (archive.CanSeek) archive.Position = 0;
-    // Fall back to the tempdir path when the descriptor has not overridden
-    // either method — that's the only way to break the recursion between the
-    // two virtual defaults.
-    var tempDir = Path.Combine(Path.GetTempPath(), "cwb_x2m_" + Guid.NewGuid().ToString("N")[..8]);
-    try {
-      Directory.CreateDirectory(tempDir);
-      this.Extract(archive, tempDir, password, [entryName]);
-      var file = Path.Combine(tempDir, entryName.Replace('/', Path.DirectorySeparatorChar));
-      return File.Exists(file) ? File.ReadAllBytes(file) : [];
-    } finally {
-      try { if (Directory.Exists(tempDir)) Directory.Delete(tempDir, true); } catch { /* best-effort */ }
-    }
+    using var entry = this.OpenEntry(archive, entryName, password);
+    using var memory = new MemoryStream();
+    entry.CopyTo(memory);
+    return memory.ToArray();
   }
 }
diff --git a/Compression.Registry/IArchiveLayoutMap.cs b/Compression.Registry/IArchiveLayoutMap.cs
index 606200a12..a4742b24b 100644
--- a/Compression.Registry/IArchiveLayoutMap.cs
+++ b/Compression.Registry/IArchiveLayoutMap.cs
@@ -7,16 +7,28 @@ namespace Compression.Registry;
 /// gaps at their actual offsets. Parallel to <see cref="IFilesystemExtentMap"/>
 /// but for archive formats (ZIP, 7z, TAR, LZH, ARJ, etc.).
 ///
+/// <para><b>Fail-closed contract:</b> omitted bytes are interpreted as unused by
+/// maintenance consumers. Any live, structural, ambiguous or undecoded region
+/// must therefore be emitted as <see cref="DefragBlockKind.MetadataReserved"/>
+/// (or <see cref="DefragBlockKind.Used"/>), never silently omitted. If a layout
+/// cannot be proven safe, return no extents and the inherited generic wipe is a
+/// no-op.</para>
+///
+/// <para>That exact preservation map also makes every implementation an
+/// <see cref="IWipeEmpty"/> capability. The generic implementation zeros proven
+/// dead gaps while format-specific overrides may additionally scrub tombstones,
+/// reserved growth records, stale indexes, or other recoverable metadata.</para>
+///
 /// <para>Drives the Defragment/Optimize window block-map preview so the user
 /// sees the real archive layout before pressing "Optimize".</para>
 /// </summary>
-public interface IArchiveLayoutMap {
+public interface IArchiveLayoutMap : IWipeEmpty {
   /// <summary>
   /// Enumerates the actual byte layout of <paramref name="archive"/>.
-  /// Coverage may be sparse; callers fill the gaps with
-  /// <see cref="DefragBlockKind.Free"/>. The stream's position may be
-  /// modified during enumeration but the caller owns the lifetime —
-  /// implementations must not dispose <paramref name="archive"/>.
+  /// Coverage may be sparse only where omitted bytes are proven unused; callers
+  /// fill those gaps with <see cref="DefragBlockKind.Free"/>. The stream's
+  /// position may be modified during enumeration but the caller owns the
+  /// lifetime — implementations must not dispose <paramref name="archive"/>.
   /// </summary>
   IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive);
 }
diff --git a/Compression.Registry/IArchiveModifiable.cs b/Compression.Registry/IArchiveModifiable.cs
index bcaa47969..323ec77ea 100644
--- a/Compression.Registry/IArchiveModifiable.cs
+++ b/Compression.Registry/IArchiveModifiable.cs
@@ -1,29 +1,28 @@
 namespace Compression.Registry;
 
 /// <summary>
-/// Opt-in capability: the descriptor exposes add / remove (and thereby the purge verb).
+/// Opt-in capability for editing an existing archive/image through add/replace/remove.
 /// <para>
-/// Implementing this interface makes the verbs <em>work</em>; it does <b>not</b> by itself
-/// entitle the format to advertise <see cref="FormatCapabilities.CanModify"/> (R/W). The
-/// default <see cref="Add"/> / <see cref="Remove"/> below — and any override that delegates
-/// to <c>ModifyRebuilder</c> / <see cref="RebuildVerb"/> — are a verified extract → re-create
-/// <em>rebuild</em>, i.e. a full rewrite of the container. A format whose modification is only
-/// rebuild-backed is WORM: it advertises <see cref="FormatCapabilities.CanCreate"/> and must
-/// NOT advertise <see cref="FormatCapabilities.CanModify"/> (see <see cref="FormatCapabilities"/>).
-/// Reserve <see cref="FormatCapabilities.CanModify"/> for a genuine in-place writer that edits
-/// the existing bytes (R/W filesystems; central-directory / member edits; byte-identity append).
+/// The physical strategy is format-specific: implementations may patch blocks in place,
+/// append replacement metadata, relayout members, or perform a verified extract → edit →
+/// re-create rebuild. All are valid implementations of the same public mutation contract
+/// when the resulting instance preserves the semantics the descriptor claims to support.
+/// </para>
+/// <para>
+/// A descriptor advertising <see cref="FormatCapabilities.CanModify"/> must expose this
+/// interface and its supported-profile edit path must actually round-trip. Merely being able
+/// to create a fresh instance is not enough. A fully modifiable container is also purgeable:
+/// removing all live entries is a required subset of the remove contract.
 /// </para>
 /// </summary>
-public interface IArchiveModifiable {
+public interface IArchiveModifiable : IArchivePurgeable {
   /// <summary>
-  /// Appends or replaces files inside <paramref name="archive"/>. On replacement the
-  /// previous bytes are wiped the same way <see cref="Remove"/> wipes them.
+  /// Adds files to an existing instance, replacing entries with the same logical path/name.
   ///
-  /// <para><b>Default implementation</b>: any descriptor that also implements
-  /// <see cref="IArchiveFormatOperations"/> + <see cref="IArchiveCreatable"/> gets
-  /// add for free — a verified extract → splat-new-files → re-create rebuild via
-  /// <see cref="RebuildVerb.EditViaRebuild"/> (the same WORM rebuild that backs the
-  /// other verbs). Formats with a true in-place writer override for efficiency.</para>
+  /// <para><b>Default implementation</b>: descriptors that also implement
+  /// <see cref="IArchiveFormatOperations"/> and <see cref="IArchiveCreatable"/> get a verified
+  /// extract → edit → re-create implementation through <see cref="RebuildVerb.EditViaRebuild"/>.
+  /// Formats with a cheaper native editor override it.</para>
   /// </summary>
   void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
     if (this is not IArchiveFormatOperations ops || this is not IArchiveCreatable creator)
@@ -41,11 +40,12 @@ void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
   }
 
   /// <summary>
-  /// Removes the named entries from <paramref name="archive"/> and wipes all on-disk
-  /// traces. <b>Default implementation</b>: a verified extract → drop-named-files →
-  /// re-create rebuild via <see cref="RebuildVerb.EditViaRebuild"/>. Passing every
-  /// entry name (or all files) yields an empty container — i.e. the <em>purge</em> verb.
-  /// Formats with a true in-place writer override for efficiency and forensic wiping.
+  /// Removes the named entries from an existing instance. Passing every entry name yields an
+  /// empty container/image where the format permits one.
+  ///
+  /// <para><b>Default implementation</b>: a verified extract → drop-named-files → re-create
+  /// edit through <see cref="RebuildVerb.EditViaRebuild"/>. Native implementations may instead
+  /// unlink/free in place and optionally wipe released storage.</para>
   /// </summary>
   void Remove(Stream archive, string[] entryNames) {
     if (this is not IArchiveFormatOperations ops || this is not IArchiveCreatable creator)
diff --git a/Compression.Registry/IArchivePurgeable.cs b/Compression.Registry/IArchivePurgeable.cs
new file mode 100644
index 000000000..ea1b0128c
--- /dev/null
+++ b/Compression.Registry/IArchivePurgeable.cs
@@ -0,0 +1,25 @@
+namespace Compression.Registry;
+
+/// <summary>
+/// Opt-in capability: all user/live entries can be removed from an existing
+/// container while leaving a valid, listable empty instance. This is distinct
+/// from <see cref="IWipeEmpty"/>, which preserves live entries and overwrites only
+/// unused/dead bytes.
+/// </summary>
+public interface IArchivePurgeable {
+  /// <summary>
+  /// Removes every live non-directory entry from <paramref name="archive"/>.
+  ///
+  /// <para><b>Default implementation</b>: descriptors that also implement
+  /// <see cref="IArchiveFormatOperations"/> and <see cref="IArchiveModifiable"/>
+  /// get a transactional staged purge through <see cref="RebuildVerb.PurgeViaModifier"/>.
+  /// Native implementations may override this when they can empty the container
+  /// more efficiently.</para>
+  /// </summary>
+  void Purge(Stream archive) {
+    if (this is not IArchiveFormatOperations ops || this is not IArchiveModifiable modifier)
+      throw new NotSupportedException(
+        "The default Purge requires IArchiveFormatOperations + IArchiveModifiable.");
+    RebuildVerb.PurgeViaModifier(archive, ops, modifier);
+  }
+}
diff --git a/Compression.Registry/IFilesystemDriverAdapter.cs b/Compression.Registry/IFilesystemDriverAdapter.cs
new file mode 100644
index 000000000..78b0a1748
--- /dev/null
+++ b/Compression.Registry/IFilesystemDriverAdapter.cs
@@ -0,0 +1,15 @@
+#pragma warning disable CS1591
+namespace Compression.Registry;
+
+/// <summary>
+/// Sidecar binding from an existing format descriptor ID to a native filesystem
+/// driver core. This lets large/legacy descriptors acquire driver semantics
+/// without mixing mount state, locking and block-device code into their archive
+/// surface. The source generator discovers public parameterless implementations
+/// and registers them by <see cref="FormatId"/>.
+/// </summary>
+public interface IFilesystemDriverAdapter :
+  IFilesystemDriverProvider,
+  IFilesystemDriverReadinessProvider {
+  string FormatId { get; }
+}
diff --git a/Compression.Registry/IFilesystemExtentMap.cs b/Compression.Registry/IFilesystemExtentMap.cs
index 13d394aef..0960b35c7 100644
--- a/Compression.Registry/IFilesystemExtentMap.cs
+++ b/Compression.Registry/IFilesystemExtentMap.cs
@@ -9,23 +9,32 @@ namespace Compression.Registry;
 /// superblock, MFT, root directory, inode table, BAM, group descriptor table,
 /// etc.), and optionally every free region.
 ///
-/// <para>Coverage may be sparse — gaps in the returned set are interpreted by
-/// the caller as <see cref="DefragBlockKind.Free"/>. The yielded extents
-/// don't need to be sorted; the caller is responsible for sorting + gap
-/// filling. Implementations must not throw for malformed or partially-walked
-/// images — they should yield whatever they can identify and return.</para>
+/// <para><b>Fail-closed contract:</b> gaps in the returned set are interpreted
+/// as free space by maintenance consumers. Therefore an implementation that
+/// encounters an allocated-but-undecoded, damaged, ambiguous, or otherwise
+/// unproven region MUST emit that region as
+/// <see cref="DefragBlockKind.MetadataReserved"/> rather than silently omit it.
+/// If the image cannot be walked safely at all, yield no extents; the inherited
+/// generic <see cref="IWipeEmpty"/> implementation then wipes nothing.</para>
+///
+/// <para>Because this contract identifies all bytes that must be preserved,
+/// every extent map is also an <see cref="IWipeEmpty"/> implementation: the
+/// default wiper zeros only proven gaps (and cluster tips when a trustworthy
+/// logical-size lookup exists). Formats that know about deleted directory
+/// records or other hidden remnants may override the wipe for deeper cleaning.</para>
 ///
 /// <para>Drives the Defragment-window block-map preview so the user sees the
 /// real fragmented layout before pressing "Defragment" rather than the
 /// post-defrag approximation.</para>
 /// </summary>
-public interface IFilesystemExtentMap {
+public interface IFilesystemExtentMap : IWipeEmpty {
   /// <summary>
   /// Enumerates the actual on-disk layout of <paramref name="image"/>.
-  /// Coverage may be sparse; callers fill the gaps with
-  /// <see cref="DefragBlockKind.Free"/>. The stream's position may be
-  /// modified during enumeration but the caller owns the lifetime —
-  /// implementations must not dispose <paramref name="image"/>.
+  /// Coverage may be sparse only where the omitted bytes are proven free;
+  /// callers fill those gaps with <see cref="DefragBlockKind.Free"/>. Unknown
+  /// allocated bytes must be returned as <see cref="DefragBlockKind.MetadataReserved"/>.
+  /// The stream's position may be modified during enumeration but the caller
+  /// owns its lifetime — implementations must not dispose <paramref name="image"/>.
   /// </summary>
   /// <param name="image">The filesystem image to walk. Must be readable and
   /// seekable.</param>
diff --git a/Compression.Registry/IRandomAccessBlockDeviceProvider.cs b/Compression.Registry/IRandomAccessBlockDeviceProvider.cs
new file mode 100644
index 000000000..c70483b26
--- /dev/null
+++ b/Compression.Registry/IRandomAccessBlockDeviceProvider.cs
@@ -0,0 +1,16 @@
+#pragma warning disable CS1591
+namespace Compression.Registry;
+
+/// <summary>
+/// Optional descriptor capability for exposing the sector/block device that
+/// sits below a filesystem namespace. Container descriptors can implement this
+/// without pretending the container itself is a filesystem.
+/// </summary>
+public interface IRandomAccessBlockDeviceProvider {
+  /// <summary>
+  /// Opens a random-access block device over <paramref name="image"/>.
+  /// Implementations must fail closed when the exact on-disk profile cannot be
+  /// projected losslessly/safely at block granularity.
+  /// </summary>
+  IRandomAccessBlockDevice OpenBlockDevice(Stream image, bool writable, bool leaveOpen = true);
+}
diff --git a/Compression.Registry/IWipeEmpty.cs b/Compression.Registry/IWipeEmpty.cs
index 41e535937..a465eb24d 100644
--- a/Compression.Registry/IWipeEmpty.cs
+++ b/Compression.Registry/IWipeEmpty.cs
@@ -7,9 +7,11 @@ namespace Compression.Registry;
 /// entries, padding regions, and dead archive bytes. This is a forensic-cleanliness
 /// tool ensuring no deleted file remnants survive.
 ///
-/// <para>Implementations that don't need format-specific logic can delegate to
-/// <see cref="UnusedSpaceWiper.Wipe"/> which works generically with any
-/// <see cref="IFilesystemExtentMap"/> or <see cref="IArchiveLayoutMap"/>.</para>
+/// <para>The default implementation is deliberately conservative. It is available
+/// only when the same descriptor exposes an exact filesystem extent map or archive
+/// layout map; unknown/undecoded regions must therefore be emitted as
+/// <see cref="DefragBlockKind.MetadataReserved"/> by those maps rather than omitted.
+/// An empty map is treated as "cannot prove anything is free" and wipes nothing.</para>
 /// </summary>
 public interface IWipeEmpty {
   /// <summary>
@@ -21,7 +23,45 @@ public interface IWipeEmpty {
   /// <param name="wipeClusterTips">When true, also zero the tail of cluster-aligned
   /// extents where the actual file size is smaller than the allocated extent.</param>
   /// <param name="wipeDeletedEntries">When true, zero deleted directory entries
-  /// and any other recoverable remnants beyond simple free-space gaps.</param>
+  /// and any other recoverable remnants beyond simple free-space gaps. The generic
+  /// implementation can only wipe gaps/tips; format-specific implementations may
+  /// additionally scrub deleted metadata records.</param>
   /// <returns>The number of bytes that were overwritten with zeros.</returns>
-  long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true);
+  long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true) {
+    ArgumentNullException.ThrowIfNull(image);
+    if (!image.CanRead || !image.CanWrite || !image.CanSeek)
+      throw new ArgumentException("Wipe requires a readable, writable, seekable stream.", nameof(image));
+
+    List<DefragBlockInfo> extents = this switch {
+      IFilesystemExtentMap fs => fs.EnumerateExtents(image).ToList(),
+      IArchiveLayoutMap archive => archive.EnumerateLayout(image).ToList(),
+      _ => throw new NotSupportedException(
+        "The generic wipe requires IFilesystemExtentMap or IArchiveLayoutMap."),
+    };
+
+    // Fail closed. A parser that cannot prove even one region exists must never
+    // turn "unknown image" into "everything is free".
+    if (extents.Count == 0)
+      return 0;
+
+    Func<string, long>? sizeLookup = null;
+    if (wipeClusterTips && this is IArchiveFormatOperations ops) {
+      try {
+        image.Position = 0;
+        var sizes = ops.List(image, null)
+          .Where(e => !e.IsDirectory)
+          .GroupBy(e => e.Name, StringComparer.Ordinal)
+          .ToDictionary(g => g.Key, g => Math.Max(0L, g.First().OriginalSize), StringComparer.Ordinal);
+        sizeLookup = name => sizes.TryGetValue(name, out var size) ? size : -1;
+      } catch {
+        // Lack of a trustworthy logical-size table merely disables tip wiping;
+        // it must not disable proven whole free gaps.
+        sizeLookup = null;
+        wipeClusterTips = false;
+      }
+    }
+
+    image.Position = 0;
+    return UnusedSpaceWiper.Wipe(image, extents, image.Length, wipeClusterTips, sizeLookup);
+  }
 }
diff --git a/Compression.Registry/ReadOnlyFilesystemSnapshotSession.cs b/Compression.Registry/ReadOnlyFilesystemSnapshotSession.cs
new file mode 100644
index 000000000..508091bdf
--- /dev/null
+++ b/Compression.Registry/ReadOnlyFilesystemSnapshotSession.cs
@@ -0,0 +1,201 @@
+#pragma warning disable CS1591
+
+namespace Compression.Registry;
+
+/// <summary>
+/// Native filesystem object projected into the common driver contract. Name and
+/// parent are a convenient primary-link description for simple filesystems; use
+/// explicit <see cref="FilesystemSnapshotDirectoryEntry"/> values when one node
+/// has multiple directory entries (hard links).
+/// </summary>
+public sealed record FilesystemSnapshotNode(
+  FilesystemNodeId NodeId,
+  FilesystemNodeId ParentNodeId,
+  string Name,
+  FilesystemNodeKind Kind,
+  long Size,
+  long AllocatedSize,
+  uint LinkCount = 1,
+  ulong NativeAttributes = 0,
+  DateTimeOffset? Created = null,
+  DateTimeOffset? Modified = null,
+  DateTimeOffset? Accessed = null,
+  DateTimeOffset? Changed = null,
+  string? SymbolicLinkTarget = null,
+  Func<IFilesystemFileHandle>? OpenReadHandle = null
+);
+
+public sealed record FilesystemSnapshotDirectoryEntry(
+  FilesystemNodeId ParentNodeId,
+  string Name,
+  FilesystemNodeId NodeId
+);
+
+public sealed class ReadOnlyFilesystemSnapshotSession : IFilesystemSession {
+  private sealed record Child(string Name, FilesystemSnapshotNode Node);
+  private sealed record SnapshotInput(
+    FilesystemSnapshotNode[] Nodes,
+    FilesystemSnapshotDirectoryEntry[] Entries);
+
+  private readonly Dictionary<FilesystemNodeId, FilesystemSnapshotNode> _nodes;
+  private readonly Dictionary<FilesystemNodeId, Child[]> _children;
+  private bool _disposed;
+
+  public ReadOnlyFilesystemSnapshotSession(
+      FilesystemDriverProfile profile,
+      FilesystemNodeId rootNodeId,
+      IEnumerable<FilesystemSnapshotNode> nodes)
+    : this(profile, rootNodeId, Prepare(nodes, rootNodeId)) { }
+
+  private ReadOnlyFilesystemSnapshotSession(
+      FilesystemDriverProfile profile,
+      FilesystemNodeId rootNodeId,
+      SnapshotInput input)
+    : this(profile, rootNodeId, input.Nodes, input.Entries) { }
+
+  /// <summary>
+  /// Full constructor with independent object and directory-entry sets. Multiple
+  /// entries may target the same node ID; that is how hard links are represented.
+  /// </summary>
+  public ReadOnlyFilesystemSnapshotSession(
+      FilesystemDriverProfile profile,
+      FilesystemNodeId rootNodeId,
+      IEnumerable<FilesystemSnapshotNode> nodes,
+      IEnumerable<FilesystemSnapshotDirectoryEntry> directoryEntries) {
+    ArgumentNullException.ThrowIfNull(profile);
+    ArgumentNullException.ThrowIfNull(nodes);
+    ArgumentNullException.ThrowIfNull(directoryEntries);
+    if (!profile.CanMount)
+      throw new ArgumentException("A snapshot session requires a mountable filesystem profile.", nameof(profile));
+    if (profile.CanMountWritable)
+      throw new ArgumentException("ReadOnlyFilesystemSnapshotSession cannot represent a writable profile.", nameof(profile));
+
+    Profile = profile;
+    RootNodeId = rootNodeId;
+    _nodes = new Dictionary<FilesystemNodeId, FilesystemSnapshotNode>();
+    foreach (var node in nodes) {
+      if (!_nodes.TryAdd(node.NodeId, node))
+        throw new InvalidDataException(
+          $"Filesystem snapshot defines node {node.NodeId.Value}:{node.NodeId.Generation} more than once.");
+    }
+    if (!_nodes.TryGetValue(rootNodeId, out var root) || root.Kind != FilesystemNodeKind.Directory)
+      throw new InvalidDataException("Filesystem snapshot must contain its root directory node.");
+
+    var children = _nodes.Keys.ToDictionary(id => id, _ => new List<Child>());
+    foreach (var entry in directoryEntries) {
+      ArgumentNullException.ThrowIfNull(entry.Name);
+      if (entry.Name.Length == 0 || entry.Name is "." or ".." || entry.Name.Contains('/') || entry.Name.Contains('\\'))
+        throw new InvalidDataException($"Filesystem directory entry name '{entry.Name}' is not a single valid path component.");
+      if (!_nodes.TryGetValue(entry.ParentNodeId, out var parent) || parent.Kind != FilesystemNodeKind.Directory)
+        throw new InvalidDataException(
+          $"Filesystem directory entry '{entry.Name}' has no directory parent {entry.ParentNodeId.Value}:{entry.ParentNodeId.Generation}.");
+      if (!_nodes.TryGetValue(entry.NodeId, out var target))
+        throw new InvalidDataException(
+          $"Filesystem directory entry '{entry.Name}' targets missing node {entry.NodeId.Value}:{entry.NodeId.Generation}.");
+      var list = children[entry.ParentNodeId];
+      if (list.Any(existing => string.Equals(existing.Name, entry.Name, StringComparison.Ordinal)))
+        throw new InvalidDataException($"Filesystem directory contains duplicate name '{entry.Name}'.");
+      list.Add(new Child(entry.Name, target));
+    }
+
+    _children = children.ToDictionary(
+      item => item.Key,
+      item => item.Value.OrderBy(child => child.Name, StringComparer.Ordinal).ToArray());
+  }
+
+  public FilesystemDriverProfile Profile { get; }
+  public FilesystemNodeId RootNodeId { get; }
+
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) {
+    ThrowIfDisposed();
+    var node = RequireNode(nodeId);
+    return new FilesystemNodeInfo(
+      node.NodeId,
+      node.Kind,
+      Math.Max(0, node.Size),
+      Math.Max(0, node.AllocatedSize),
+      node.LinkCount,
+      node.NativeAttributes,
+      node.Created,
+      node.Modified,
+      node.Accessed,
+      node.Changed);
+  }
+
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) {
+    ArgumentNullException.ThrowIfNull(name);
+    ThrowIfDisposed();
+    var parent = RequireNode(parentDirectory);
+    if (parent.Kind != FilesystemNodeKind.Directory) throw new DirectoryNotFoundException(parent.Name);
+    if (!_children.TryGetValue(parentDirectory, out var children)) return null;
+    var exact = children.FirstOrDefault(child => string.Equals(child.Name, name, StringComparison.Ordinal));
+    if (exact != null) return exact.Node.NodeId;
+    if ((Profile.Capabilities & FilesystemDriverCapabilities.CaseSensitiveNames) != 0)
+      return null;
+    var folded = children.Where(child => string.Equals(child.Name, name, StringComparison.OrdinalIgnoreCase)).ToArray();
+    return folded.Length == 1 ? folded[0].Node.NodeId : null;
+  }
+
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) {
+    ThrowIfDisposed();
+    var node = RequireNode(directory);
+    if (node.Kind != FilesystemNodeKind.Directory) throw new DirectoryNotFoundException(node.Name);
+    return (_children.TryGetValue(directory, out var children) ? children : [])
+      .Select(child => new FilesystemDirectoryEntry(child.Name, child.Node.NodeId, child.Node.Kind))
+      .ToArray();
+  }
+
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) {
+    ThrowIfDisposed();
+    if (access != FileAccess.Read) throw ReadOnly();
+    var node = RequireNode(nodeId);
+    if (node.Kind != FilesystemNodeKind.RegularFile)
+      throw new UnauthorizedAccessException($"'{node.Name}' is not a regular file.");
+    return node.OpenReadHandle?.Invoke()
+      ?? throw new NotSupportedException($"Filesystem node '{node.Name}' has no native data handle.");
+  }
+
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => throw ReadOnly();
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => throw ReadOnly();
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => throw ReadOnly();
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => throw ReadOnly();
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace) => throw ReadOnly();
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName) => throw ReadOnly();
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target) => throw ReadOnly();
+
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) {
+    ThrowIfDisposed();
+    var node = RequireNode(nodeId);
+    if (node.Kind != FilesystemNodeKind.SymbolicLink || node.SymbolicLinkTarget == null)
+      throw new InvalidOperationException($"'{node.Name}' is not a decoded symbolic link.");
+    return node.SymbolicLinkTarget;
+  }
+
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => throw ReadOnly();
+  public void Flush() => ThrowIfDisposed();
+  public IFilesystemTransaction BeginTransaction()
+    => throw new NotSupportedException("The native snapshot session is read-only and has no write transaction.");
+  public void Dispose() => _disposed = true;
+
+  private FilesystemSnapshotNode RequireNode(FilesystemNodeId nodeId)
+    => _nodes.TryGetValue(nodeId, out var node)
+      ? node
+      : throw new FileNotFoundException($"Filesystem node {nodeId.Value}:{nodeId.Generation} does not exist in this session.");
+
+  private static SnapshotInput Prepare(
+      IEnumerable<FilesystemSnapshotNode> nodes,
+      FilesystemNodeId rootNodeId) {
+    ArgumentNullException.ThrowIfNull(nodes);
+    var materialized = nodes.ToArray();
+    var entries = materialized
+      .Where(node => node.NodeId != rootNodeId)
+      .Select(node => new FilesystemSnapshotDirectoryEntry(node.ParentNodeId, node.Name, node.NodeId))
+      .ToArray();
+    return new SnapshotInput(materialized, entries);
+  }
+
+  private static NotSupportedException ReadOnly()
+    => new("This native filesystem snapshot session is read-only.");
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/Compression.Registry/RebuildVerb.cs b/Compression.Registry/RebuildVerb.cs
index c1cb3f17a..9c6e3d297 100644
--- a/Compression.Registry/RebuildVerb.cs
+++ b/Compression.Registry/RebuildVerb.cs
@@ -1,49 +1,111 @@
 namespace Compression.Registry;
 
 /// <summary>
-/// Generic, round-trip-verified "extract → re-create" engine shared by the
-/// default implementations of the maintenance verbs (shrink, defragment) for
-/// any descriptor that can both enumerate/extract (<see cref="IArchiveFormatOperations"/>)
-/// and create (<see cref="IArchiveCreatable"/>) its format.
-///
-/// <para>Every rebuild is <b>verified</b>: the freshly created image is listed
-/// back and its live-file count compared against the source. If the rebuild
-/// would drop files, the operation throws <see cref="InvalidOperationException"/>
-/// instead of producing a lossy result — so enabling a verb on a format whose
-/// create path doesn't faithfully round-trip fails loudly rather than silently
-/// corrupting data. This is what makes broad, default-implementation rollout
-/// across filesystems safe.</para>
+/// Generic, round-trip-verified extract → re-create engine shared by maintenance
+/// verbs. Rebuilds are staged, verified, progress-reporting, and cancellable;
+/// the caller's original stream is not touched until the staged target has been
+/// built successfully and cancellation is no longer accepted.
 /// </summary>
 public static class RebuildVerb {
 
   /// <summary>
-  /// Extracts every entry of <paramref name="input"/> and re-creates the image
-  /// into <paramref name="output"/> via <paramref name="creator"/>. Returns the
-  /// source live-file count. Throws if the rebuilt image lists fewer live files
-  /// than the source (lossy round-trip) — the caller's <paramref name="output"/>
-  /// should be discarded in that case.
+  /// Extracts every live entry, re-creates the container in <paramref name="output"/>,
+  /// verifies the exact live-name multiset, and reports block-map/read/write-head
+  /// progress suitable for the maintenance UI.
   /// </summary>
-  public static int RebuildToStream(Stream input, Stream output,
-      IArchiveFormatOperations ops, IArchiveCreatable creator,
+  public static int RebuildToStream(
+      Stream input,
+      Stream output,
+      IArchiveFormatOperations ops,
+      IArchiveCreatable creator,
       IReadOnlyDictionary<string, string>? formatSpecific = null,
-      IReadOnlySet<string>? syntheticNames = null) {
+      IReadOnlySet<string>? syntheticNames = null,
+      Action<DefragProgressEvent>? onProgress = null,
+      CancellationToken cancellationToken = default) {
     ArgumentNullException.ThrowIfNull(input);
     ArgumentNullException.ThrowIfNull(output);
     ArgumentNullException.ThrowIfNull(ops);
     ArgumentNullException.ThrowIfNull(creator);
+    if (!input.CanRead || !input.CanSeek)
+      throw new ArgumentException("Rebuild input must be readable and seekable.", nameof(input));
+    if (!output.CanWrite || !output.CanSeek)
+      throw new ArgumentException("Rebuild output must be writable and seekable.", nameof(output));
+
+    cancellationToken.ThrowIfCancellationRequested();
+    input.Position = 0;
+    var sourceEntries = ops.List(input, null);
+    var sourceNames = LiveNameList(sourceEntries);
+    var sourceFileCount = sourceNames.Count;
+    var sourceLength = Math.Max(1L, input.Length);
+    var liveEntries = sourceEntries
+      .Where(e => !e.IsDirectory && (syntheticNames == null || !syntheticNames.Contains(e.Name)))
+      .ToArray();
+    var totalLogical = Math.Max(1L, liveEntries.Sum(e => Math.Max(0L, e.OriginalSize)));
+    var sourceLayout = BuildSourceLayout(input, ops, sourceEntries);
+
+    onProgress?.Invoke(new DefragProgressEvent(
+      "scanning", 0, 0, -1, sourceLength, sourceLayout,
+      $"Scanning {sourceFileCount:N0} live entr{(sourceFileCount == 1 ? "y" : "ies")} before staged rebuild"));
 
     var tmpDir = Path.Combine(Path.GetTempPath(), "cwb_rebuild_" + Guid.NewGuid().ToString("N")[..8]);
     Directory.CreateDirectory(tmpDir);
     try {
-      // Capture the source's live entry names (as a sorted MULTISET — duplicates
-      // matter) as the descriptor itself reports them. This is the identity a
-      // faithful rebuild must reproduce exactly.
-      input.Position = 0;
-      var sourceNames = LiveNameList(ops, input);
-      var sourceFileCount = sourceNames.Count;
+      // Extract entry-by-entry rather than through the opaque bulk Extract call.
+      // This makes large WORM/re-layout passes cancellable and gives the UI an
+      // honest moving read head while bytes are consumed from the source.
+      long logicalDone = 0;
+      var liveIndex = 0;
+      foreach (var entry in sourceEntries) {
+        cancellationToken.ThrowIfCancellationRequested();
+        var target = SafeExtractPath(tmpDir, entry.Name);
+        if (entry.IsDirectory) {
+          Directory.CreateDirectory(target);
+          continue;
+        }
+        if (syntheticNames != null && syntheticNames.Contains(entry.Name))
+          continue;
 
-      input.Position = 0;
-      ops.Extract(input, tmpDir, null, null);
+        ++liveIndex;
+        var parent = Path.GetDirectoryName(target);
+        if (!string.IsNullOrEmpty(parent)) Directory.CreateDirectory(parent);
+
+        var entrySize = Math.Max(0L, entry.OriginalSize);
+        onProgress?.Invoke(new DefragProgressEvent(
+          "reading", 0.45 * logicalDone / totalLogical,
+          ScaleOffset(logicalDone, totalLogical, sourceLength), -1,
+          sourceLength, HighlightEntry(sourceLayout, entry.Name),
+          $"Reading {liveIndex:N0}/{liveEntries.Length:N0}: {entry.Name}"));
+
+        input.Position = 0;
+        using var src = ops.OpenEntry(input, entry.Name, null);
+        using var dst = new FileStream(target, FileMode.Create, FileAccess.Write, FileShare.None, 64 * 1024,
+          FileOptions.SequentialScan);
+        var buffer = new byte[64 * 1024];
+        long entryDone = 0;
+        var lastReport = Environment.TickCount64;
+        while (true) {
+          cancellationToken.ThrowIfCancellationRequested();
+          var read = src.Read(buffer, 0, buffer.Length);
+          if (read <= 0) break;
+          dst.Write(buffer, 0, read);
+          entryDone += read;
+          var now = Environment.TickCount64;
+          if (now - lastReport >= 50) {
+            lastReport = now;
+            var effective = logicalDone + (entrySize > 0 ? Math.Min(entrySize, entryDone) : entryDone);
+            var fraction = 0.45 * Math.Clamp((double)effective / totalLogical, 0, 1);
+            onProgress?.Invoke(new DefragProgressEvent(
+              "reading", fraction,
+              ScaleOffset(effective, totalLogical, sourceLength), -1,
+              sourceLength, null,
+              $"Reading {liveIndex:N0}/{liveEntries.Length:N0}: {entry.Name} ({entryDone:N0} bytes)"));
+          }
+        }
+        dst.Flush(flushToDisk: true);
+        logicalDone += entrySize > 0 ? entrySize : entryDone;
+      }
+
+      cancellationToken.ThrowIfCancellationRequested();
 
       var inputs = new List<ArchiveInputInfo>();
       foreach (var dir in Directory.GetDirectories(tmpDir, "*", SearchOption.AllDirectories)) {
@@ -52,28 +114,37 @@ public static int RebuildToStream(Stream input, Stream output,
       }
       foreach (var file in Directory.GetFiles(tmpDir, "*", SearchOption.AllDirectories)) {
         var rel = Path.GetRelativePath(tmpDir, file).Replace('\\', '/');
-        // A reader that also surfaces the raw image and a metadata sheet must
-        // not have them written back as files: the rebuilt volume would carry
-        // a copy of its own previous self, and its reader would surface fresh
-        // synthetic entries on top of them.
-        if (syntheticNames != null && syntheticNames.Contains(rel)) continue;
         inputs.Add(new ArchiveInputInfo(file, rel, false));
       }
 
+      var visualSize = Math.Max(sourceLength, totalLogical);
+      var targetLayout = BuildWeightedLayout(liveEntries, visualSize);
+      onProgress?.Invoke(new DefragProgressEvent(
+        "writing", 0.45, -1, 0, visualSize, targetLayout,
+        "Building staged target — original container is still unchanged"));
+
       var options = new FormatCreateOptions { FormatSpecific = formatSpecific };
       output.Position = 0;
       output.SetLength(0);
-      creator.Create(output, inputs, options);
+      using (var progressOutput = new ProgressWriteStream(output, cancellationToken, maxPosition => {
+        var fraction = 0.45 + 0.45 * Math.Clamp((double)maxPosition / sourceLength, 0, 1);
+        onProgress?.Invoke(new DefragProgressEvent(
+          "writing", fraction, -1, maxPosition, visualSize, null,
+          $"Writing staged target: {maxPosition:N0} bytes"));
+      })) {
+        creator.Create(progressOutput, inputs, options);
+        progressOutput.Flush();
+      }
+
+      cancellationToken.ThrowIfCancellationRequested();
+      onProgress?.Invoke(new DefragProgressEvent(
+        "verifying", 0.92, -1, Math.Max(0, output.Position), Math.Max(1, output.Length), null,
+        "Verifying rebuilt container before commit"));
 
-      // Identity guard: a faithful rebuild must list back the EXACT same set of
-      // live entry names. Anything else — dropped, duplicated, renamed (e.g.
-      // content-addressed/hashed names, synthetic metadata entries the writer
-      // re-derives) — means the round-trip isn't identity-preserving, so refuse
-      // to commit and leave the caller to fall back / keep the original.
       output.Position = 0;
       List<string> rebuiltNames;
       try {
-        rebuiltNames = LiveNameList(ops, output);
+        rebuiltNames = LiveNameList(ops.List(output, null));
       } catch (Exception ex) {
         throw new InvalidOperationException(
           $"Rebuilt image could not be listed back ({ex.GetType().Name}: {ex.Message}); refusing a lossy rebuild.", ex);
@@ -82,6 +153,12 @@ public static int RebuildToStream(Stream input, Stream output,
         throw new InvalidOperationException(
           $"Rebuild changed the entry set ({sourceFileCount} → {rebuiltNames.Count}); refusing a non-identity-preserving rebuild.");
 
+      cancellationToken.ThrowIfCancellationRequested();
+      var finalLength = Math.Max(1L, output.Length);
+      onProgress?.Invoke(new DefragProgressEvent(
+        "staged", 0.98, -1, Math.Max(0, output.Length - 1), finalLength,
+        BuildWeightedLayout(liveEntries, finalLength),
+        "Staged rebuild verified; ready to commit"));
       output.Position = 0;
       return sourceFileCount;
     } finally {
@@ -89,41 +166,49 @@ public static int RebuildToStream(Stream input, Stream output,
     }
   }
 
-  /// <summary>The sorted multiset of live (non-directory) entry names the descriptor lists.</summary>
-  private static List<string> LiveNameList(IArchiveFormatOperations ops, Stream stream) {
-    stream.Position = 0;
-    return ops.List(stream, null).Where(e => !e.IsDirectory).Select(e => e.Name)
-      .OrderBy(n => n, StringComparer.Ordinal).ToList();
-  }
-
   /// <summary>
-  /// In-place rebuild: re-creates <paramref name="archive"/> from its own
-  /// contents (consolidating live data — the defragmentation side effect of the
-  /// rebuild-via-WORM pattern) and overwrites the stream only when the rebuild
-  /// is verified to round-trip. On any failure the original bytes are left
-  /// untouched.
+  /// Rebuilds into a scratch file, verifies it, and only then replaces the
+  /// caller-supplied stream. Cancellation is honoured until commit starts;
+  /// once commit begins it runs to completion so a cancellation cannot leave
+  /// the original half-overwritten.
   /// </summary>
-  public static void RebuildInPlace(Stream archive,
-      IArchiveFormatOperations ops, IArchiveCreatable creator,
-      IReadOnlyDictionary<string, string>? formatSpecific = null) {
+  public static void RebuildInPlace(
+      Stream archive,
+      IArchiveFormatOperations ops,
+      IArchiveCreatable creator,
+      IReadOnlyDictionary<string, string>? formatSpecific = null,
+      Action<DefragProgressEvent>? onProgress = null,
+      CancellationToken cancellationToken = default) {
     ArgumentNullException.ThrowIfNull(archive);
-    // A scratch file, not a MemoryStream: the rebuilt image is a whole volume,
-    // and a MemoryStream cannot hold one past 2 GB ("Stream was too long").
     using var rebuilt = CreateScratchStream();
-    // Throws (leaving `archive` untouched) if the rebuild would lose data.
-    RebuildToStream(archive, rebuilt, ops, creator, formatSpecific);
+    RebuildToStream(archive, rebuilt, ops, creator, formatSpecific,
+      onProgress: onProgress, cancellationToken: cancellationToken);
+
+    // Point of no return. Do not inspect cancellation again after announcing
+    // commit; callers disable Cancel for this phase.
+    onProgress?.Invoke(new DefragProgressEvent(
+      "committing", 0.99, -1, 0, Math.Max(1, rebuilt.Length), null,
+      "Committing verified staged target — cancellation is no longer safe"));
+
     archive.Position = 0;
     archive.SetLength(0);
     rebuilt.Position = 0;
     rebuilt.CopyTo(archive);
     archive.Flush();
+
+    var finalLength = Math.Max(1L, archive.Length);
+    archive.Position = 0;
+    var entries = ops.List(archive, null);
+    onProgress?.Invoke(new DefragProgressEvent(
+      "complete", 1, -1, -1, finalLength,
+      BuildWeightedLayout(entries.Where(e => !e.IsDirectory).ToArray(), finalLength),
+      "Rebuild committed successfully"));
   }
 
   /// <summary>
-  /// Rebuild-based in-place edit shared by the default <see cref="IArchiveModifiable"/>:
-  /// extract the archive, apply <paramref name="mutate"/> to the extracted file
-  /// tree (add/overwrite/delete real files on disk), re-create the image, and
-  /// overwrite the stream. The original bytes are left untouched on any failure.
+  /// Rebuild-based edit used by the generic modifier. Mutation and validation
+  /// happen off to the side; the original is overwritten only after a valid
+  /// staged result exists.
   /// </summary>
   public static void EditViaRebuild(Stream archive, IArchiveFormatOperations ops,
       IArchiveCreatable creator, Action<string> mutate) {
@@ -134,7 +219,6 @@ public static void EditViaRebuild(Stream archive, IArchiveFormatOperations ops,
     try {
       archive.Position = 0;
       ops.Extract(archive, tmpDir, null, null);
-
       mutate(tmpDir);
 
       var inputs = new List<ArchiveInputInfo>();
@@ -149,8 +233,6 @@ public static void EditViaRebuild(Stream archive, IArchiveFormatOperations ops,
 
       using var rebuilt = CreateScratchStream();
       creator.Create(rebuilt, inputs, new FormatCreateOptions());
-
-      // Verify the result lists back (a valid image) before committing.
       rebuilt.Position = 0;
       _ = ops.List(rebuilt, null);
 
@@ -163,13 +245,204 @@ public static void EditViaRebuild(Stream archive, IArchiveFormatOperations ops,
       try { Directory.Delete(tmpDir, true); } catch { /* best effort */ }
     }
   }
+
   /// <summary>
-  /// A writable scratch stream that is not bounded by what a byte[] can hold.
-  /// Deleted on close.
+  /// Transactional purge for a mutable container. The modifier operates on a
+  /// staged copy and the caller's stream is replaced only after the result lists
+  /// successfully with every original live entry gone.
   /// </summary>
+  public static void PurgeViaModifier(Stream archive, IArchiveFormatOperations ops, IArchiveModifiable modifier) {
+    ArgumentNullException.ThrowIfNull(archive);
+    ArgumentNullException.ThrowIfNull(ops);
+    ArgumentNullException.ThrowIfNull(modifier);
+    if (!archive.CanRead || !archive.CanWrite || !archive.CanSeek)
+      throw new ArgumentException("Purge requires a readable, writable, seekable stream.", nameof(archive));
+
+    using var staged = CreateScratchStream();
+    archive.Position = 0;
+    archive.CopyTo(staged);
+    staged.Flush();
+
+    staged.Position = 0;
+    var sourceNames = ops.List(staged, null)
+      .Where(e => !e.IsDirectory)
+      .Select(e => e.Name)
+      .Distinct(StringComparer.OrdinalIgnoreCase)
+      .ToArray();
+    if (sourceNames.Length == 0) return;
+
+    staged.Position = 0;
+    modifier.Remove(staged, sourceNames);
+    staged.Position = 0;
+    var remaining = ops.List(staged, null)
+      .Where(e => !e.IsDirectory)
+      .Select(e => e.Name)
+      .ToHashSet(StringComparer.OrdinalIgnoreCase);
+    var survivors = sourceNames.Where(remaining.Contains).ToArray();
+    if (survivors.Length != 0)
+      throw new InvalidOperationException(
+        $"Purge left {survivors.Length} original live entr{(survivors.Length == 1 ? "y" : "ies")} behind; original container retained.");
+
+    archive.Position = 0;
+    archive.SetLength(0);
+    staged.Position = 0;
+    staged.CopyTo(archive);
+    archive.Flush();
+  }
+
+  private static List<string> LiveNameList(IEnumerable<ArchiveEntryInfo> entries)
+    => entries.Where(e => !e.IsDirectory).Select(e => e.Name)
+      .OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+  private static IReadOnlyList<DefragBlockInfo> BuildSourceLayout(
+      Stream input, IArchiveFormatOperations ops, IReadOnlyList<ArchiveEntryInfo> entries) {
+    try {
+      input.Position = 0;
+      var extents = ops switch {
+        IFilesystemExtentMap fs => fs.EnumerateExtents(input).ToArray(),
+        IArchiveLayoutMap archive => archive.EnumerateLayout(input).ToArray(),
+        _ => [],
+      };
+      if (extents.Length > 0) return extents;
+    } catch {
+      // Visualization is best-effort; the actual rebuild remains fully verified.
+    }
+    return BuildWeightedLayout(entries.Where(e => !e.IsDirectory).ToArray(), Math.Max(1, input.Length));
+  }
+
+  private static IReadOnlyList<DefragBlockInfo> BuildWeightedLayout(
+      IReadOnlyList<ArchiveEntryInfo> entries, long totalSize) {
+    totalSize = Math.Max(1, totalSize);
+    if (entries.Count == 0)
+      return [new DefragBlockInfo(0, totalSize, DefragBlockKind.Free)];
+
+    var weights = entries.Select(e => Math.Max(1L, e.OriginalSize)).ToArray();
+    var totalWeight = Math.Max(1L, weights.Sum());
+    var result = new List<DefragBlockInfo>(entries.Count);
+    long cumulative = 0;
+    long cursor = 0;
+    for (var i = 0; i < entries.Count; i++) {
+      cumulative += weights[i];
+      var end = i == entries.Count - 1
+        ? totalSize
+        : (long)((double)cumulative / totalWeight * totalSize);
+      end = Math.Clamp(end, cursor, totalSize);
+      var length = end - cursor;
+      if (length > 0)
+        result.Add(new DefragBlockInfo(cursor, length, DefragBlockKind.Used,
+          entries[i].Name, Classify(entries[i].Method)));
+      cursor = end;
+    }
+    if (cursor < totalSize)
+      result.Add(new DefragBlockInfo(cursor, totalSize - cursor, DefragBlockKind.Free));
+    return result;
+  }
+
+  private static IReadOnlyList<DefragBlockInfo> HighlightEntry(
+      IReadOnlyList<DefragBlockInfo> source, string entryName) {
+    var changed = false;
+    var result = new DefragBlockInfo[source.Count];
+    for (var i = 0; i < source.Count; i++) {
+      var block = source[i];
+      if (block.FileName != null && string.Equals(block.FileName, entryName, StringComparison.Ordinal)) {
+        result[i] = block with { Kind = DefragBlockKind.InProgress };
+        changed = true;
+      } else {
+        result[i] = block;
+      }
+    }
+    return changed ? result : source;
+  }
+
+  private static DefragBlockClass Classify(string? method) {
+    var value = (method ?? "").ToUpperInvariant();
+    if (value.Contains("STORE") || value.Contains("COPY") || value == "NONE" || value.Length == 0)
+      return DefragBlockClass.Frozen;
+    if (value.Contains("LZMA") || value.Contains("PPMD") || value.Contains("BZIP"))
+      return DefragBlockClass.Hot;
+    if (value.Contains("ZSTD") || value.Contains("LZ4"))
+      return DefragBlockClass.Cold;
+    return DefragBlockClass.Normal;
+  }
+
+  private static long ScaleOffset(long done, long total, long imageSize)
+    => total <= 0 ? 0 : Math.Clamp((long)((double)done / total * imageSize), 0, Math.Max(0, imageSize - 1));
+
+  private static string SafeExtractPath(string root, string archiveName) {
+    var normalized = archiveName.Replace('/', Path.DirectorySeparatorChar).TrimStart(Path.DirectorySeparatorChar);
+    var rootFull = Path.GetFullPath(root) + Path.DirectorySeparatorChar;
+    var candidate = Path.GetFullPath(Path.Combine(root, normalized));
+    if (!candidate.StartsWith(rootFull, StringComparison.OrdinalIgnoreCase) &&
+        !string.Equals(candidate, rootFull.TrimEnd(Path.DirectorySeparatorChar), StringComparison.OrdinalIgnoreCase))
+      throw new InvalidDataException($"Entry path escapes rebuild staging directory: {archiveName}");
+    return candidate;
+  }
+
+  /// <summary>A writable scratch stream not bounded by byte[] / MemoryStream size.</summary>
   internal static FileStream CreateScratchStream()
     => new(Path.Combine(Path.GetTempPath(), "cwb_rebuild_" + Guid.NewGuid().ToString("N") + ".tmp"),
-           FileMode.CreateNew, FileAccess.ReadWrite, FileShare.None, 64 * 1024,
-           FileOptions.DeleteOnClose);
+      FileMode.CreateNew, FileAccess.ReadWrite, FileShare.None, 64 * 1024, FileOptions.DeleteOnClose);
 
+  /// <summary>
+  /// Write-through wrapper used solely to expose actual target-byte progress and
+  /// make long encoder writes cancellable without giving ownership of the target
+  /// stream to the wrapper.
+  /// </summary>
+  private sealed class ProgressWriteStream(
+      Stream inner, CancellationToken cancellationToken, Action<long> report) : Stream {
+    private long _maxPosition;
+    private long _lastReportTick;
+
+    public override bool CanRead => inner.CanRead;
+    public override bool CanSeek => inner.CanSeek;
+    public override bool CanWrite => inner.CanWrite;
+    public override long Length => inner.Length;
+    public override long Position { get => inner.Position; set => inner.Position = value; }
+    public override void Flush() => inner.Flush();
+    public override int Read(byte[] buffer, int offset, int count) => inner.Read(buffer, offset, count);
+    public override long Seek(long offset, SeekOrigin origin) => inner.Seek(offset, origin);
+    public override void SetLength(long value) => inner.SetLength(value);
+
+    public override void Write(byte[] buffer, int offset, int count) {
+      cancellationToken.ThrowIfCancellationRequested();
+      inner.Write(buffer, offset, count);
+      Report();
+    }
+
+    public override void Write(ReadOnlySpan<byte> buffer) {
+      cancellationToken.ThrowIfCancellationRequested();
+      inner.Write(buffer);
+      Report();
+    }
+
+    public override void WriteByte(byte value) {
+      cancellationToken.ThrowIfCancellationRequested();
+      inner.WriteByte(value);
+      Report();
+    }
+
+    public override async ValueTask WriteAsync(ReadOnlyMemory<byte> buffer,
+        CancellationToken cancellationTokenFromCaller = default) {
+      cancellationToken.ThrowIfCancellationRequested();
+      cancellationTokenFromCaller.ThrowIfCancellationRequested();
+      await inner.WriteAsync(buffer, cancellationTokenFromCaller).ConfigureAwait(false);
+      Report();
+    }
+
+    private void Report() {
+      _maxPosition = Math.Max(_maxPosition, inner.Position);
+      var now = Environment.TickCount64;
+      if (now - _lastReportTick < 50) return;
+      _lastReportTick = now;
+      report(_maxPosition);
+    }
+
+    protected override void Dispose(bool disposing) {
+      if (disposing) {
+        try { inner.Flush(); } catch { }
+        report(Math.Max(_maxPosition, inner.CanSeek ? inner.Position : _maxPosition));
+      }
+      base.Dispose(disposing);
+    }
+  }
 }
diff --git a/Compression.Registry/SpoolingReadOnlyFileHandle.cs b/Compression.Registry/SpoolingReadOnlyFileHandle.cs
new file mode 100644
index 000000000..068ceb785
--- /dev/null
+++ b/Compression.Registry/SpoolingReadOnlyFileHandle.cs
@@ -0,0 +1,105 @@
+#pragma warning disable CS1591
+
+namespace Compression.Registry;
+
+/// <summary>
+/// Transitional positional handle for native filesystem readers that can stream
+/// a file correctly but do not yet expose a seekable block/extent map. Small
+/// files stay in memory; large files are spooled to a delete-on-close temporary
+/// file. This preserves driver-style positional reads without imposing a whole-
+/// file RAM ceiling while the filesystem's direct block mapping is implemented.
+/// </summary>
+public sealed class SpoolingReadOnlyFileHandle : IFilesystemFileHandle {
+  public const long DefaultMemoryThreshold = 8L * 1024 * 1024;
+
+  private readonly Stream _spool;
+  private readonly object _gate = new();
+  private readonly long _length;
+  private bool _disposed;
+
+  private SpoolingReadOnlyFileHandle(FilesystemNodeId nodeId, Stream spool, long length) {
+    NodeId = nodeId;
+    _spool = spool;
+    _length = length;
+  }
+
+  public static SpoolingReadOnlyFileHandle Create(
+      FilesystemNodeId nodeId,
+      long expectedLength,
+      Action<Stream> writeContent,
+      long memoryThreshold = DefaultMemoryThreshold) {
+    ArgumentNullException.ThrowIfNull(writeContent);
+    if (expectedLength < 0) throw new ArgumentOutOfRangeException(nameof(expectedLength));
+    if (memoryThreshold < 0) throw new ArgumentOutOfRangeException(nameof(memoryThreshold));
+
+    Stream spool;
+    if (expectedLength <= memoryThreshold && expectedLength <= int.MaxValue) {
+      spool = new MemoryStream(checked((int)expectedLength));
+    } else {
+      var path = Path.Combine(Path.GetTempPath(), "cwb_handle_" + Guid.NewGuid().ToString("N") + ".tmp");
+      spool = new FileStream(
+        path,
+        FileMode.CreateNew,
+        FileAccess.ReadWrite,
+        FileShare.Read | FileShare.Delete,
+        64 * 1024,
+        FileOptions.RandomAccess | FileOptions.DeleteOnClose);
+    }
+
+    try {
+      writeContent(spool);
+      if (spool.Length < expectedLength)
+        throw new InvalidDataException(
+          $"Filesystem reader produced {spool.Length:N0} bytes for a {expectedLength:N0}-byte file.");
+      if (spool.Length > expectedLength) spool.SetLength(expectedLength);
+      spool.Position = 0;
+      return new SpoolingReadOnlyFileHandle(nodeId, spool, expectedLength);
+    } catch {
+      spool.Dispose();
+      throw;
+    }
+  }
+
+  public FilesystemNodeId NodeId { get; }
+  public long Length {
+    get {
+      ThrowIfDisposed();
+      return _length;
+    }
+  }
+
+  public int Read(long offset, Span<byte> destination) {
+    ThrowIfDisposed();
+    if (offset < 0) throw new ArgumentOutOfRangeException(nameof(offset));
+    if (destination.Length == 0 || offset >= _length) return 0;
+    var count = checked((int)Math.Min(destination.Length, _length - offset));
+    lock (_gate) {
+      _spool.Position = offset;
+      var total = 0;
+      while (total < count) {
+        var read = _spool.Read(destination.Slice(total, count - total));
+        if (read == 0) break;
+        total += read;
+      }
+      if (total != count)
+        throw new EndOfStreamException("The filesystem spool ended before the advertised logical file length.");
+      return total;
+    }
+  }
+
+  public void Write(long offset, ReadOnlySpan<byte> source)
+    => throw new NotSupportedException("The spooled filesystem handle is read-only.");
+
+  public void SetLength(long length)
+    => throw new NotSupportedException("The spooled filesystem handle is read-only.");
+
+  public void Flush() => ThrowIfDisposed();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _spool.Dispose();
+  }
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/Compression.Registry/Streaming/TemporaryExtractedEntryStream.cs b/Compression.Registry/Streaming/TemporaryExtractedEntryStream.cs
new file mode 100644
index 000000000..3694209e3
--- /dev/null
+++ b/Compression.Registry/Streaming/TemporaryExtractedEntryStream.cs
@@ -0,0 +1,128 @@
+namespace Compression.Registry.Streaming;
+
+/// <summary>
+/// Seekable read-only stream over an entry extracted into an isolated temporary
+/// directory. The directory tree is removed when the stream is disposed.
+///
+/// This is the default bridge for archive/filesystem descriptors that have not
+/// yet implemented a native <c>OpenEntry</c>. Unlike the historical byte-array
+/// fallback it has no Array.MaxLength / whole-file-RAM ceiling and therefore is
+/// safe to use beneath filesystem-driver positional spooling.
+/// </summary>
+internal sealed class TemporaryExtractedEntryStream : Stream {
+  private readonly FileStream _inner;
+  private readonly string _temporaryDirectory;
+  private bool _disposed;
+
+  private TemporaryExtractedEntryStream(FileStream inner, string temporaryDirectory) {
+    _inner = inner;
+    _temporaryDirectory = temporaryDirectory;
+  }
+
+  public static TemporaryExtractedEntryStream Open(
+      IArchiveFormatOperations operations,
+      Stream archive,
+      string entryName,
+      string? password) {
+    ArgumentNullException.ThrowIfNull(operations);
+    ArgumentNullException.ThrowIfNull(archive);
+    ArgumentException.ThrowIfNullOrWhiteSpace(entryName);
+
+    var tempDir = Path.Combine(Path.GetTempPath(), "cwb_entry_" + Guid.NewGuid().ToString("N"));
+    Directory.CreateDirectory(tempDir);
+    try {
+      if (archive.CanSeek) archive.Position = 0;
+      operations.Extract(archive, tempDir, password, [entryName]);
+
+      var wanted = Normalize(entryName);
+      string? path = null;
+      foreach (var candidate in Directory.EnumerateFiles(tempDir, "*", SearchOption.AllDirectories)) {
+        var relative = Normalize(Path.GetRelativePath(tempDir, candidate));
+        if (!relative.Equals(wanted, StringComparison.OrdinalIgnoreCase) &&
+            !Path.GetFileName(relative).Equals(Path.GetFileName(wanted), StringComparison.OrdinalIgnoreCase))
+          continue;
+        if (path != null && !relative.Equals(wanted, StringComparison.OrdinalIgnoreCase))
+          throw new InvalidDataException($"Extraction of '{entryName}' produced multiple ambiguous files.");
+        path = candidate;
+        if (relative.Equals(wanted, StringComparison.OrdinalIgnoreCase)) break;
+      }
+
+      if (path == null)
+        throw new FileNotFoundException(
+          $"Archive extraction did not materialize requested entry '{entryName}'.", entryName);
+
+      var stream = new FileStream(
+        path,
+        FileMode.Open,
+        FileAccess.Read,
+        FileShare.Read | FileShare.Delete,
+        64 * 1024,
+        FileOptions.RandomAccess);
+      return new TemporaryExtractedEntryStream(stream, tempDir);
+    } catch {
+      TryDelete(tempDir);
+      throw;
+    }
+  }
+
+  public override bool CanRead => !_disposed && _inner.CanRead;
+  public override bool CanSeek => !_disposed && _inner.CanSeek;
+  public override bool CanWrite => false;
+  public override long Length { get { ThrowIfDisposed(); return _inner.Length; } }
+  public override long Position {
+    get { ThrowIfDisposed(); return _inner.Position; }
+    set { ThrowIfDisposed(); _inner.Position = value; }
+  }
+
+  public override int Read(byte[] buffer, int offset, int count) {
+    ThrowIfDisposed();
+    return _inner.Read(buffer, offset, count);
+  }
+
+  public override int Read(Span<byte> buffer) {
+    ThrowIfDisposed();
+    return _inner.Read(buffer);
+  }
+
+  public override int ReadByte() {
+    ThrowIfDisposed();
+    return _inner.ReadByte();
+  }
+
+  public override long Seek(long offset, SeekOrigin origin) {
+    ThrowIfDisposed();
+    return _inner.Seek(offset, origin);
+  }
+
+  public override void Flush() => ThrowIfDisposed();
+  public override void SetLength(long value) => throw new NotSupportedException("Temporary extracted entry streams are read-only.");
+  public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException("Temporary extracted entry streams are read-only.");
+  public override void Write(ReadOnlySpan<byte> buffer) => throw new NotSupportedException("Temporary extracted entry streams are read-only.");
+
+  protected override void Dispose(bool disposing) {
+    if (_disposed) {
+      base.Dispose(disposing);
+      return;
+    }
+    _disposed = true;
+    if (disposing) {
+      _inner.Dispose();
+      TryDelete(_temporaryDirectory);
+    }
+    base.Dispose(disposing);
+  }
+
+  private static string Normalize(string value)
+    => value.Replace('\\', '/').TrimStart('/');
+
+  private static void TryDelete(string directory) {
+    try {
+      if (Directory.Exists(directory)) Directory.Delete(directory, recursive: true);
+    } catch {
+      // Best-effort temporary cleanup. The OS/temp cleaner may remove an entry
+      // held by an external scanner after our file handle has already closed.
+    }
+  }
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/Compression.Tests/Btrfs/BtrfsFilesystemDriverTests.cs b/Compression.Tests/Btrfs/BtrfsFilesystemDriverTests.cs
new file mode 100644
index 000000000..62dad99ed
--- /dev/null
+++ b/Compression.Tests/Btrfs/BtrfsFilesystemDriverTests.cs
@@ -0,0 +1,84 @@
+using Compression.Registry;
+using FileSystem.Btrfs;
+
+namespace Compression.Tests.Btrfs;
+
+[TestFixture]
+public sealed class BtrfsFilesystemDriverTests {
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void NativeSession_UsesInodeIdentityAndDirectPositionalReads() {
+    var payload = new byte[32 * 1024 + 503];
+    for (var i = 0; i < payload.Length; i++) payload[i] = (byte)((i * 41 + 13) & 0xFF);
+
+    var writer = new BtrfsWriter();
+    writer.AddFile("dir/data.bin", payload);
+    writer.AddFile("dir/tiny.txt", "tiny"u8.ToArray()); // exercises an inline extent too
+    using var image = new MemoryStream();
+    writer.WriteTo(image);
+
+    var adapter = new BtrfsFilesystemDriverAdapter();
+    image.Position = 0;
+    var profile = adapter.ProbeFilesystem(image);
+    Assert.That(profile.CanMount, Is.True, string.Join("; ", profile.Limitations));
+    Assert.That(profile.CanMountWritable, Is.False);
+    Assert.That(profile.Capabilities.HasFlag(FilesystemDriverCapabilities.StableNodeIds), Is.True);
+    Assert.That(profile.Capabilities.HasFlag(FilesystemDriverCapabilities.SparseFiles), Is.True);
+
+    image.Position = 0;
+    using var session = adapter.OpenFilesystem(image, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+    Assert.That(session.RootNodeId.Value, Is.EqualTo(256UL));
+    var dir = session.Lookup(session.RootNodeId, "dir");
+    Assert.That(dir, Is.Not.Null);
+    var file = session.Lookup(dir!.Value, "data.bin");
+    Assert.That(file, Is.Not.Null);
+    Assert.That(file!.Value.Value, Is.GreaterThan(256UL), "file identity must be the native Btrfs inode object id");
+
+    using var handle = session.OpenFile(file.Value, FileAccess.Read);
+    var slice = new byte[911];
+    var read = handle.Read(7_777, slice);
+    Assert.That(read, Is.EqualTo(slice.Length));
+    Assert.That(slice, Is.EqualTo(payload.AsSpan(7_777, slice.Length).ToArray()));
+
+    var tiny = session.Lookup(dir.Value, "tiny.txt");
+    Assert.That(tiny, Is.Not.Null);
+    using var tinyHandle = session.OpenFile(tiny!.Value, FileAccess.Read);
+    var tinyBytes = new byte[4];
+    Assert.That(tinyHandle.Read(0, tinyBytes), Is.EqualTo(4));
+    Assert.That(tinyBytes, Is.EqualTo("tiny"u8.ToArray()));
+  }
+
+  [Test, Category("ErrorHandling")]
+  public void Probe_RejectsCompressedExtentInsteadOfSilentlyShorteningFile() {
+    var inline = Enumerable.Range(0, 31).Select(i => (byte)(0xA1 + i)).ToArray();
+    var writer = new BtrfsWriter();
+    writer.AddFile("compressed-marker.bin", inline);
+    using var built = new MemoryStream();
+    writer.WriteTo(built);
+    var bytes = built.ToArray();
+
+    var payloadAt = bytes.AsSpan().IndexOf(inline);
+    Assert.That(payloadAt, Is.GreaterThanOrEqualTo(21), "test payload must be present as one inline EXTENT_DATA value");
+    Assert.That(bytes.AsSpan(payloadAt + inline.Length).IndexOf(inline), Is.EqualTo(-1), "payload marker must be unique in the image");
+
+    // Inline payload starts at file_extent_item + 21; compression is byte 16.
+    bytes[payloadAt - 5] = 1; // non-zero compression id: current native profile must reject it
+    using var image = new MemoryStream(bytes, writable: false);
+    var profile = new BtrfsFilesystemDriverAdapter().ProbeFilesystem(image);
+
+    Assert.That(profile.CanMount, Is.False);
+    Assert.That(string.Join("; ", profile.Limitations), Does.Contain("compression="));
+  }
+
+  [Test, Category("ErrorHandling")]
+  public void NativeSession_RefusesWritableMount() {
+    var writer = new BtrfsWriter();
+    writer.AddFile("a.bin", "abc"u8.ToArray());
+    using var image = new MemoryStream();
+    writer.WriteTo(image);
+
+    var adapter = new BtrfsFilesystemDriverAdapter();
+    image.Position = 0;
+    Assert.Throws<NotSupportedException>(() =>
+      adapter.OpenFilesystem(image, new FilesystemOpenOptions(ReadOnly: false, LeaveOpen: true)));
+  }
+}
diff --git a/Compression.Tests/CbmNibble/CbmNibbleFilesystemDriverTests.cs b/Compression.Tests/CbmNibble/CbmNibbleFilesystemDriverTests.cs
new file mode 100644
index 000000000..8641bc9e4
--- /dev/null
+++ b/Compression.Tests/CbmNibble/CbmNibbleFilesystemDriverTests.cs
@@ -0,0 +1,126 @@
+using Compression.Registry;
+using FileSystem.CbmNibble;
+
+namespace Compression.Tests.CbmNibble;
+
+[TestFixture]
+public sealed class CbmNibbleFilesystemDriverTests {
+  [TestCase(false)]
+  [TestCase(true)]
+  [Category("Driver")]
+  public void CanonicalNibbleImage_SupportsFilesystemRoundTrip(bool nib) {
+    var original = Enumerable.Range(0, 900).Select(i => (byte)(i * 29)).ToArray();
+    var writer = new CbmNibbleWriter();
+    writer.AddFile("HELLO", original);
+    var bytes = nib ? writer.BuildNib() : writer.Build();
+
+    using var image = new MemoryStream();
+    image.Write(bytes);
+    image.Position = 0;
+
+    IFilesystemDriverProvider filesystem = nib ? new NibFormatDescriptor() : new G64FormatDescriptor();
+    var beforeTracks = CbmNibbleReader.Read(image.ToArray(), nib ? "image.nib" : "image.g64");
+    var untouchedBefore = beforeTracks.Tracks.Single(track => track.Index == 68).Data.ToArray();
+
+    var profile = filesystem.ProbeFilesystem(image);
+    Assert.Multiple(() => {
+      Assert.That(profile.CanMount, Is.True, string.Join("; ", profile.Limitations));
+      Assert.That(profile.CanMountWritable, Is.True, string.Join("; ", profile.Limitations));
+      Assert.That(profile.MutationModel, Is.EqualTo(FilesystemMutationModel.Direct));
+    });
+
+    using (var fs = filesystem.OpenFilesystem(image, new FilesystemOpenOptions(ReadOnly: false, LeaveOpen: true))) {
+      var root = fs.RootNodeId;
+      var helloId = fs.Lookup(root, "HELLO");
+      Assert.That(helloId.HasValue, Is.True);
+      using (var hello = fs.OpenFile(helloId!.Value, FileAccess.Read)) {
+        var probe = new byte[111];
+        Assert.That(hello.Read(257, probe), Is.EqualTo(probe.Length));
+        Assert.That(probe, Is.EqualTo(original.AsSpan(257, probe.Length).ToArray()));
+      }
+
+      var newId = fs.CreateFile(root, "MOUNTED");
+      using (var handle = fs.OpenFile(newId, FileAccess.ReadWrite)) {
+        handle.Write(0, "filesystem-driver"u8);
+        handle.Write(32, "gcr"u8);
+        handle.SetLength(40);
+      }
+      fs.Rename(root, "MOUNTED", root, "RENAMED", replace: false);
+      fs.DeleteFile(root, "HELLO");
+      fs.Flush();
+    }
+
+    var afterTracks = CbmNibbleReader.Read(image.ToArray(), nib ? "image.nib" : "image.g64");
+    Assert.That(afterTracks.Tracks.Single(track => track.Index == 68).Data, Is.EqualTo(untouchedBefore),
+      "filesystem writes must not rewrite an unrelated track");
+
+    image.Position = 0;
+    using var reopened = filesystem.OpenFilesystem(image, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+    Assert.That(reopened.Lookup(reopened.RootNodeId, "HELLO"), Is.Null);
+    var renamedId = reopened.Lookup(reopened.RootNodeId, "RENAMED");
+    Assert.That(renamedId.HasValue, Is.True);
+    using var renamed = reopened.OpenFile(renamedId!.Value, FileAccess.Read);
+    var result = new byte[40];
+    Assert.That(renamed.Read(0, result), Is.EqualTo(result.Length));
+    Assert.Multiple(() => {
+      Assert.That(result.AsSpan(0, 17).ToArray(), Is.EqualTo("filesystem-driver"u8.ToArray()));
+      Assert.That(result.AsSpan(17, 15).ToArray(), Is.EqualTo(new byte[15]));
+      Assert.That(result.AsSpan(32, 3).ToArray(), Is.EqualTo("gcr"u8.ToArray()));
+      Assert.That(result.AsSpan(35, 5).ToArray(), Is.EqualTo(new byte[5]));
+    });
+  }
+
+  [Test, Category("Driver"), Category("EdgeCase")]
+  public void G64SectorProjection_DecodesNonByteAlignedTrackRotation() {
+    var writer = new CbmNibbleWriter();
+    writer.AddFile("HELLO", Enumerable.Range(0, 600).Select(i => (byte)i).ToArray());
+    using var image = new MemoryStream();
+    image.Write(writer.Build());
+    image.Position = 0;
+
+    using (var tracks = CbmNibbleRawTrackDevices.OpenG64(image, writable: true, leaveOpen: true)) {
+      var info = tracks.EnumerateTracks().Single(track => track.Index == 0);
+      var raw = new byte[(int)info.Length];
+      Assert.That(tracks.ReadTrack(0, raw), Is.EqualTo(raw.Length));
+      tracks.WriteTrack(0, RotateBits(raw, 3));
+      tracks.Flush();
+    }
+
+    image.Position = 0;
+    var profile = new G64FormatDescriptor().ProbeFilesystem(image);
+    Assert.That(profile.CanMount, Is.True, string.Join("; ", profile.Limitations));
+  }
+
+  [Test, Category("Driver"), Category("EdgeCase")]
+  public void G64WritableMount_RejectsMeaningfulOddHalfTrack() {
+    var writer = new CbmNibbleWriter();
+    writer.AddFile("HELLO", [1, 2, 3, 4]);
+    using var image = new MemoryStream();
+    image.Write(writer.Build());
+    image.Position = 0;
+
+    using (var tracks = CbmNibbleRawTrackDevices.OpenG64(image, writable: true, leaveOpen: true)) {
+      tracks.WriteTrack(1, Enumerable.Repeat((byte)0xA5, 128).ToArray(), encodingParameter: 3);
+      tracks.Flush();
+    }
+
+    image.Position = 0;
+    var profile = new G64FormatDescriptor().ProbeFilesystem(image);
+    Assert.Multiple(() => {
+      Assert.That(profile.CanMount, Is.True, "standard whole tracks remain readable");
+      Assert.That(profile.CanMountWritable, Is.False);
+      Assert.That(profile.Limitations.Any(x => x.Contains("half-track", StringComparison.OrdinalIgnoreCase)), Is.True);
+    });
+  }
+
+  private static byte[] RotateBits(byte[] source, int shift) {
+    var totalBits = source.Length * 8;
+    var result = new byte[source.Length];
+    for (var destinationBit = 0; destinationBit < totalBits; ++destinationBit) {
+      var sourceBit = (destinationBit + shift) % totalBits;
+      var value = (source[sourceBit >> 3] >> (7 - (sourceBit & 7))) & 1;
+      result[destinationBit >> 3] |= (byte)(value << (7 - (destinationBit & 7)));
+    }
+    return result;
+  }
+}
diff --git a/Compression.Tests/CbmNibble/CbmNibbleModifyTests.cs b/Compression.Tests/CbmNibble/CbmNibbleModifyTests.cs
new file mode 100644
index 000000000..afcdaddea
--- /dev/null
+++ b/Compression.Tests/CbmNibble/CbmNibbleModifyTests.cs
@@ -0,0 +1,150 @@
+using System.Buffers.Binary;
+using Compression.Registry;
+using FileSystem.CbmNibble;
+
+namespace Compression.Tests.CbmNibble;
+
+[TestFixture]
+public sealed class CbmNibbleModifyTests {
+  [Test, Category("RoundTrip")]
+  public void G64_DirectTracks_AddReplaceRemoveDefragAndPurge() {
+    var descriptor = new G64FormatDescriptor();
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+
+    var a = Enumerable.Range(0, 113).Select(i => (byte)(i * 17)).ToArray();
+    var b = Enumerable.Range(0, 227).Select(i => (byte)(255 - i)).ToArray();
+    using var image = new MemoryStream();
+    descriptor.Create(image, [
+      ArchiveInputInfo.InMemory("track_00.bin", a),
+      ArchiveInputInfo.InMemory("track_03.bin", b),
+    ], new FormatCreateOptions());
+
+    AssertTrack(descriptor, image, "track_00.bin", a);
+    AssertTrack(descriptor, image, "track_03.bin", b);
+
+    var replacement = Enumerable.Repeat((byte)0xA5, 181).ToArray();
+    var added = Enumerable.Repeat((byte)0x3C, 97).ToArray();
+    descriptor.Add(image, [
+      ArchiveInputInfo.InMemory("track_00.bin", replacement),
+      ArchiveInputInfo.InMemory("track_05.bin", added),
+    ]);
+    AssertTrack(descriptor, image, "track_00.bin", replacement);
+    AssertTrack(descriptor, image, "track_03.bin", b);
+    AssertTrack(descriptor, image, "track_05.bin", added);
+
+    descriptor.Remove(image, ["track_03.bin"]);
+    var names = ListNames(descriptor, image);
+    Assert.That(names, Does.Not.Contain("track_03.bin"));
+    Assert.That(names, Does.Contain("track_00.bin"));
+    Assert.That(names, Does.Contain("track_05.bin"));
+
+    descriptor.Defragment(image, new DefragOptions());
+    AssertTrack(descriptor, image, "track_00.bin", replacement);
+    AssertTrack(descriptor, image, "track_05.bin", added);
+
+    descriptor.Purge(image);
+    names = ListNames(descriptor, image);
+    Assert.That(names.Where(n => n.StartsWith("track_", StringComparison.Ordinal)), Is.Empty);
+    Assert.That(names, Does.Contain("metadata.ini"));
+  }
+
+  [Test, Category("EdgeCase")]
+  public void G64_VariableSpeedMap_FailsClosedForMutationAndWipe() {
+    var descriptor = new G64FormatDescriptor();
+    using var image = new MemoryStream();
+    descriptor.Create(image, [ArchiveInputInfo.InMemory("track_00.bin", new byte[] { 1, 2, 3, 4 })],
+      new FormatCreateOptions());
+
+    var bytes = image.ToArray();
+    var trackCount = bytes[9];
+    var speedTable = 12 + trackCount * 4;
+    BinaryPrimitives.WriteUInt32LittleEndian(bytes.AsSpan(speedTable, 4), 0x100);
+    image.Position = 0;
+    image.SetLength(0);
+    image.Write(bytes);
+
+    Assert.That(() => descriptor.Add(image,
+      [ArchiveInputInfo.InMemory("track_00.bin", new byte[] { 9, 8, 7 })]),
+      Throws.InstanceOf<NotSupportedException>());
+
+    var before = image.ToArray();
+    Assert.That(descriptor.WipeUnusedSpace(image), Is.EqualTo(0));
+    Assert.That(image.ToArray(), Is.EqualTo(before));
+  }
+
+  [Test, Category("Maintenance")]
+  public void G64_Wipe_ClearsOnlyUnreferencedTrailingBytes() {
+    var descriptor = new G64FormatDescriptor();
+    using var image = new MemoryStream();
+    var track = Enumerable.Repeat((byte)0x55, 64).ToArray();
+    descriptor.Create(image, [ArchiveInputInfo.InMemory("track_00.bin", track)], new FormatCreateOptions());
+    var liveLength = image.Length;
+    image.Position = image.Length;
+    image.Write(Enumerable.Repeat((byte)0xCC, 128).ToArray());
+
+    var wiped = descriptor.WipeUnusedSpace(image);
+    Assert.That(wiped, Is.GreaterThanOrEqualTo(128));
+    Assert.That(image.ToArray().AsSpan((int)liveLength, 128).ToArray(), Is.All.EqualTo((byte)0));
+    AssertTrack(descriptor, image, "track_00.bin", track);
+  }
+
+  [Test, Category("RoundTrip")]
+  public void Nib_DirectTracks_UseFixedSlotsForReplaceRemoveAndPurge() {
+    var descriptor = new NibFormatDescriptor();
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+
+    var a = Enumerable.Repeat((byte)0x55, CbmNibbleReader.NibTrackSize).ToArray();
+    var b = Enumerable.Repeat((byte)0xAA, CbmNibbleReader.NibTrackSize).ToArray();
+    using var image = new MemoryStream();
+    descriptor.Create(image, [
+      ArchiveInputInfo.InMemory("track_00.bin", a),
+      ArchiveInputInfo.InMemory("track_17.bin", b),
+    ], new FormatCreateOptions());
+
+    Assert.That(image.Length, Is.EqualTo(CbmNibbleReader.NibExpectedFileSize));
+    AssertTrack(descriptor, image, "track_00.bin", a);
+    AssertTrack(descriptor, image, "track_17.bin", b);
+
+    var replacement = Enumerable.Repeat((byte)0x6D, CbmNibbleReader.NibTrackSize).ToArray();
+    descriptor.Add(image, [ArchiveInputInfo.InMemory("track_17.bin", replacement)]);
+    AssertTrack(descriptor, image, "track_00.bin", a);
+    AssertTrack(descriptor, image, "track_17.bin", replacement);
+
+    var beforeDefrag = image.ToArray();
+    descriptor.Defragment(image, new DefragOptions());
+    Assert.That(image.ToArray(), Is.EqualTo(beforeDefrag), "Fixed-slot NIB defrag should be a true no-op.");
+
+    descriptor.Remove(image, ["track_00.bin"]);
+    Assert.That(ListNames(descriptor, image), Does.Not.Contain("track_00.bin"));
+    AssertTrack(descriptor, image, "track_17.bin", replacement);
+
+    descriptor.Purge(image);
+    Assert.That(image.ToArray(), Is.All.EqualTo((byte)0));
+    Assert.That(ListNames(descriptor, image).Where(n => n.StartsWith("track_", StringComparison.Ordinal)), Is.Empty);
+  }
+
+  [Test, Category("EdgeCase")]
+  public void Nib_RejectsNonSlotSizedTrackReplacementWithoutChangingImage() {
+    var descriptor = new NibFormatDescriptor();
+    using var image = new MemoryStream();
+    descriptor.Create(image, [], new FormatCreateOptions());
+    var before = image.ToArray();
+
+    Assert.That(() => descriptor.Add(image,
+      [ArchiveInputInfo.InMemory("track_01.bin", new byte[123])]),
+      Throws.InstanceOf<NotSupportedException>());
+    Assert.That(image.ToArray(), Is.EqualTo(before));
+  }
+
+  private static HashSet<string> ListNames(IArchiveFormatOperations descriptor, MemoryStream image) {
+    image.Position = 0;
+    return descriptor.List(image, null).Select(e => e.Name).ToHashSet(StringComparer.OrdinalIgnoreCase);
+  }
+
+  private static void AssertTrack(IArchiveFormatOperations descriptor, MemoryStream image,
+      string name, byte[] expected) {
+    image.Position = 0;
+    var actual = descriptor.ExtractEntryToMemory(image, name, null);
+    Assert.That(actual, Is.EqualTo(expected), name);
+  }
+}
diff --git a/Compression.Tests/CbmNibble/CbmNibbleRawTrackDeviceTests.cs b/Compression.Tests/CbmNibble/CbmNibbleRawTrackDeviceTests.cs
new file mode 100644
index 000000000..24a688058
--- /dev/null
+++ b/Compression.Tests/CbmNibble/CbmNibbleRawTrackDeviceTests.cs
@@ -0,0 +1,75 @@
+using Compression.Registry;
+using FileSystem.CbmNibble;
+
+namespace Compression.Tests.CbmNibble;
+
+[TestFixture]
+public sealed class CbmNibbleRawTrackDeviceTests {
+  [Test, Category("Driver")]
+  public void NibTrackDevice_PerformsPositionalTrackWritesWithoutRebuildingOtherSlots() {
+    using var image = new MemoryStream(new byte[CbmNibbleReader.NibExpectedFileSize], writable: true);
+    var first = Enumerable.Repeat((byte)0x44, CbmNibbleReader.NibTrackSize).ToArray();
+    var second = Enumerable.Repeat((byte)0x99, CbmNibbleReader.NibTrackSize).ToArray();
+
+    using (var device = CbmNibbleRawTrackDevices.OpenNib(image, writable: true)) {
+      Assert.That(device.TrackCount, Is.EqualTo(84));
+      device.WriteTrack(2, first);
+      device.WriteTrack(40, second);
+      device.Flush();
+
+      var buffer = new byte[CbmNibbleReader.NibTrackSize];
+      Assert.That(device.ReadTrack(2, buffer), Is.EqualTo(buffer.Length));
+      Assert.That(buffer, Is.EqualTo(first));
+      device.ClearTrack(2);
+      Assert.That(device.ReadTrack(2, buffer), Is.EqualTo(0));
+      Assert.That(device.ReadTrack(40, buffer), Is.EqualTo(buffer.Length));
+      Assert.That(buffer, Is.EqualTo(second));
+    }
+  }
+
+  [Test, Category("Driver")]
+  public void G64TrackDevice_PreservesStableTrackIndexesAcrossCommit() {
+    var initial = CbmNibbleWriter.BuildG64FromTracks([
+      new CbmNibbleReader.Track(0, new byte[] { 1, 2, 3 }, 3),
+      new CbmNibbleReader.Track(4, new byte[] { 7, 8, 9 }, 3),
+    ], trackCount: 6);
+    using var image = new MemoryStream();
+    image.Write(initial);
+    image.Position = 0;
+
+    using (var device = CbmNibbleRawTrackDevices.OpenG64(image, writable: true)) {
+      var replacement = new byte[] { 9, 9, 9, 9, 9 };
+      device.WriteTrack(0, replacement);
+      device.WriteTrack(5, new byte[] { 0x55, 0xAA }, encodingParameter: 3);
+      device.ClearTrack(4);
+      device.Flush();
+
+      var buffer = new byte[64];
+      Assert.That(device.ReadTrack(0, buffer), Is.EqualTo(replacement.Length));
+      Assert.That(buffer.AsSpan(0, replacement.Length).ToArray(), Is.EqualTo(replacement));
+      Assert.That(device.ReadTrack(4, buffer), Is.EqualTo(0));
+      Assert.That(device.ReadTrack(5, buffer), Is.EqualTo(2));
+    }
+
+    var parsed = CbmNibbleReader.Read(image.ToArray(), "image.g64");
+    Assert.That(parsed.TrackCount, Is.EqualTo(6));
+    Assert.That(parsed.Tracks.Single(t => t.Index == 0).Data, Is.EqualTo(new byte[] { 9, 9, 9, 9, 9 }));
+    Assert.That(parsed.Tracks.Single(t => t.Index == 4).Data, Is.Empty);
+    Assert.That(parsed.Tracks.Single(t => t.Index == 5).Data, Is.EqualTo(new byte[] { 0x55, 0xAA }));
+  }
+
+  [Test, Category("Driver"), Category("EdgeCase")]
+  public void G64TrackDevice_RejectsWritableVariableSpeedProfile() {
+    var imageBytes = CbmNibbleWriter.BuildG64FromTracks([
+      new CbmNibbleReader.Track(0, new byte[] { 1 }, 3),
+    ], trackCount: 1);
+    // one track => speed table begins at 12 + 4
+    System.Buffers.Binary.BinaryPrimitives.WriteUInt32LittleEndian(imageBytes.AsSpan(16, 4), 0x100);
+    using var image = new MemoryStream(imageBytes, writable: true);
+
+    Assert.That(() => CbmNibbleRawTrackDevices.OpenG64(image, writable: true),
+      Throws.InstanceOf<NotSupportedException>());
+    using var readOnly = CbmNibbleRawTrackDevices.OpenG64(image, writable: false);
+    Assert.That(readOnly.CanWrite, Is.False);
+  }
+}
diff --git a/Compression.Tests/D64/D64FilesystemDriverTests.cs b/Compression.Tests/D64/D64FilesystemDriverTests.cs
new file mode 100644
index 000000000..d0e2065b6
--- /dev/null
+++ b/Compression.Tests/D64/D64FilesystemDriverTests.cs
@@ -0,0 +1,94 @@
+using Compression.Registry;
+using FileSystem.D64;
+
+namespace Compression.Tests.D64;
+
+[TestFixture]
+public sealed class D64FilesystemDriverTests {
+  [Test, Category("Driver")]
+  public void WritableSession_PreservesNodeIdentityAndPersistsNamespaceAndData() {
+    var original = Enumerable.Range(0, 700).Select(i => (byte)(i * 17)).ToArray();
+    var writer = new D64Writer();
+    writer.AddFile("HELLO", original);
+    using var image = new MemoryStream();
+    image.Write(writer.Build("DRIVER", "42"));
+    image.Position = 0;
+
+    var descriptor = new D64FormatDescriptor();
+    var profile = descriptor.ProbeFilesystem(image);
+    Assert.Multiple(() => {
+      Assert.That(profile.CanMount, Is.True);
+      Assert.That(profile.CanMountWritable, Is.True, string.Join("; ", profile.Limitations));
+      Assert.That(profile.MutationModel, Is.EqualTo(FilesystemMutationModel.Direct));
+      Assert.That(profile.Capabilities.HasFlag(FilesystemDriverCapabilities.RandomAccess), Is.True);
+      Assert.That(profile.Capabilities.HasFlag(FilesystemDriverCapabilities.Transactions), Is.False);
+    });
+
+    FilesystemNodeId createdId;
+    using (var fs = descriptor.OpenFilesystem(image, new FilesystemOpenOptions(ReadOnly: false, LeaveOpen: true))) {
+      var root = fs.RootNodeId;
+      var helloId = fs.Lookup(root, "hello");
+      Assert.That(helloId.HasValue, Is.True);
+      using (var hello = fs.OpenFile(helloId!.Value, FileAccess.Read)) {
+        var slice = new byte[97];
+        Assert.That(hello.Read(123, slice), Is.EqualTo(slice.Length));
+        Assert.That(slice, Is.EqualTo(original.AsSpan(123, slice.Length).ToArray()));
+      }
+
+      createdId = fs.CreateFile(root, "newfile");
+      using (var handleA = fs.OpenFile(createdId, FileAccess.ReadWrite))
+      using (var handleB = fs.OpenFile(createdId, FileAccess.ReadWrite)) {
+        handleA.Write(0, "0123456789"u8);
+        var observed = new byte[4];
+        Assert.That(handleB.Read(3, observed), Is.EqualTo(4));
+        Assert.That(observed, Is.EqualTo("3456"u8.ToArray()));
+        handleB.Write(4, "ABCD"u8);
+        handleA.SetLength(12);
+        handleA.Flush();
+      }
+
+      fs.Rename(root, "NEWFILE", root, "RENAMED", replace: false);
+      Assert.That(fs.Lookup(root, "RENAMED"), Is.EqualTo(createdId), "rename must not change node identity");
+      fs.DeleteFile(root, "HELLO");
+      fs.Flush();
+    }
+
+    image.Position = 0;
+    using var reopened = descriptor.OpenFilesystem(image, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+    var reopenedRoot = reopened.RootNodeId;
+    Assert.Multiple(() => {
+      Assert.That(reopened.Lookup(reopenedRoot, "HELLO"), Is.Null);
+      Assert.That(reopened.Lookup(reopenedRoot, "RENAMED").HasValue, Is.True);
+    });
+    var renamedId = reopened.Lookup(reopenedRoot, "RENAMED")!.Value;
+    using var renamed = reopened.OpenFile(renamedId, FileAccess.Read);
+    var payload = new byte[12];
+    Assert.That(renamed.Read(0, payload), Is.EqualTo(payload.Length));
+    Assert.That(payload, Is.EqualTo(new byte[] {
+      (byte)'0', (byte)'1', (byte)'2', (byte)'3',
+      (byte)'A', (byte)'B', (byte)'C', (byte)'D',
+      (byte)'8', (byte)'9', 0, 0,
+    }));
+  }
+
+  [Test, Category("Driver"), Category("EdgeCase")]
+  public void Probe_RefusesWritableMountWhenBamOwnershipIsInconsistent() {
+    var writer = new D64Writer();
+    writer.AddFile("HELLO", [1, 2, 3]);
+    var bytes = writer.Build();
+
+    // Track 1 sector 0 is allocated to HELLO by the writer. Lie in the BAM and
+    // mark it free while retaining a matching free-count byte.
+    const int bamOffset = 17 * 21 * 256; // start of track 18
+    bytes[bamOffset + 4]++;
+    bytes[bamOffset + 5] |= 0x01;
+
+    using var image = new MemoryStream(bytes, writable: true);
+    var profile = new D64FormatDescriptor().ProbeFilesystem(image);
+    Assert.Multiple(() => {
+      Assert.That(profile.CanMount, Is.True);
+      Assert.That(profile.CanMountWritable, Is.False);
+      Assert.That(profile.Limitations.Any(x => x.Contains("BAM", StringComparison.OrdinalIgnoreCase)), Is.True);
+    });
+  }
+}
diff --git a/Compression.Tests/Directory.Build.targets b/Compression.Tests/Directory.Build.targets
new file mode 100644
index 000000000..3f3f3082a
--- /dev/null
+++ b/Compression.Tests/Directory.Build.targets
@@ -0,0 +1,6 @@
+<Project>
+  <ItemGroup>
+    <ProjectReference Include="..\Compression.Mounting\Compression.Mounting.csproj" />
+    <ProjectReference Include="..\Compression.Mounting.Dokan\Compression.Mounting.Dokan.csproj" />
+  </ItemGroup>
+</Project>
diff --git a/Compression.Tests/Dmg/DmgModifyTests.cs b/Compression.Tests/Dmg/DmgModifyTests.cs
new file mode 100644
index 000000000..110c31021
--- /dev/null
+++ b/Compression.Tests/Dmg/DmgModifyTests.cs
@@ -0,0 +1,71 @@
+using Compression.Registry;
+using FileFormat.Dmg;
+
+namespace Compression.Tests.Dmg;
+
+[TestFixture]
+public sealed class DmgModifyTests {
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Writer_NonSectorAlignedPartition_RoundTripsExactLength() {
+    var payload = new byte[517];
+    new Random(19).NextBytes(payload);
+
+    var writer = new DmgWriter();
+    writer.AddPartition("odd.bin", payload);
+    using var image = new MemoryStream();
+    writer.WriteTo(image);
+
+    image.Position = 0;
+    using var reader = new DmgReader(image);
+    Assert.That(reader.Entries, Has.Count.EqualTo(1));
+    Assert.That(reader.Entries[0].Size, Is.EqualTo(payload.Length));
+    Assert.That(reader.Extract(reader.Entries[0]), Is.EqualTo(payload));
+  }
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Descriptor_AddReplaceRemove_MutatesRawUdifProfile() {
+    var descriptor = new DmgFormatDescriptor();
+    Assert.That(descriptor, Is.InstanceOf<IArchiveModifiable>());
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+
+    var a = Enumerable.Range(0, 517).Select(i => (byte)(i * 11)).ToArray();
+    var b = Enumerable.Range(0, 733).Select(i => (byte)(i * 7)).ToArray();
+    var c = Enumerable.Range(0, 91).Select(i => (byte)(255 - i)).ToArray();
+    var a2 = Enumerable.Range(0, 1025).Select(i => (byte)(i * 3)).ToArray();
+
+    using var image = new MemoryStream();
+    descriptor.Create(image, [
+      ArchiveInputInfo.InMemory("A.BIN", a),
+      ArchiveInputInfo.InMemory("B.BIN", b),
+    ], new FormatCreateOptions());
+
+    var modifier = (IArchiveModifiable)descriptor;
+    image.Position = 0;
+    modifier.Add(image, [ArchiveInputInfo.InMemory("C.BIN", c)]);
+    AssertPayload(image, "A.BIN", a);
+    AssertPayload(image, "B.BIN", b);
+    AssertPayload(image, "C.BIN", c);
+
+    image.Position = 0;
+    modifier.Add(image, [ArchiveInputInfo.InMemory("A.BIN", a2)]);
+    AssertPayload(image, "A.BIN", a2);
+    AssertPayload(image, "B.BIN", b);
+    AssertPayload(image, "C.BIN", c);
+
+    image.Position = 0;
+    modifier.Remove(image, ["B.BIN"]);
+    image.Position = 0;
+    using var reader = new DmgReader(image);
+    Assert.That(reader.Entries.Select(e => e.Name), Is.EquivalentTo(new[] { "A.BIN", "C.BIN" }));
+    Assert.That(reader.Extract(reader.Entries.Single(e => e.Name == "A.BIN")), Is.EqualTo(a2));
+    Assert.That(reader.Extract(reader.Entries.Single(e => e.Name == "C.BIN")), Is.EqualTo(c));
+  }
+
+  private static void AssertPayload(MemoryStream image, string name, byte[] expected) {
+    image.Position = 0;
+    using var reader = new DmgReader(image);
+    var entry = reader.Entries.Single(e => string.Equals(e.Name, name, StringComparison.OrdinalIgnoreCase));
+    Assert.That(entry.Size, Is.EqualTo(expected.Length));
+    Assert.That(reader.Extract(entry), Is.EqualTo(expected));
+  }
+}
diff --git a/Compression.Tests/Dtb/DtbInPlaceModifyTests.cs b/Compression.Tests/Dtb/DtbInPlaceModifyTests.cs
deleted file mode 100644
index 898550e38..000000000
--- a/Compression.Tests/Dtb/DtbInPlaceModifyTests.cs
+++ /dev/null
@@ -1,38 +0,0 @@
-using Compression.Registry;
-using FileFormat.Dtb;
-
-namespace Compression.Tests.Dtb;
-
-/// <summary>
-/// Locks the honest demotion of FileFormat.Dtb: the descriptor must NOT
-/// advertise <see cref="FormatCapabilities.CanModify"/> and the Description
-/// must name the specific spec-level reason that blocks in-place mutation.
-/// The companion read tests live in <see cref="DtbTests"/>.
-///
-/// Why DTB stays R-only: the 40-byte FDT header at offset 0 records
-/// <c>totalsize</c>, <c>off_dt_struct</c>, <c>off_dt_strings</c>,
-/// <c>size_dt_struct</c>, <c>size_dt_strings</c>. Adding/removing any
-/// property mutates the struct or strings block, which cascades through every
-/// downstream offset and the four header size/offset fields. Mutating those
-/// fields in place is a rebuild, not an in-place splice — so promoting to
-/// CanModify would mis-advertise the surface.
-/// </summary>
-[TestFixture]
-public class DtbInPlaceModifyTests {
-
-  [Test, Category("HappyPath")]
-  public void Descriptor_DoesNotAdvertiseCanModify() {
-    var desc = new DtbFormatDescriptor();
-    Assert.That(desc.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.False);
-    Assert.That(desc, Is.Not.InstanceOf<IArchiveModifiable>());
-  }
-
-  [Test, Category("HappyPath")]
-  public void Description_NamesTheBlockingFdtHeaderFields() {
-    var desc = new DtbFormatDescriptor();
-    Assert.That(desc.Description, Does.Contain("totalsize"));
-    Assert.That(desc.Description, Does.Contain("off_dt_strings"));
-    Assert.That(desc.Description, Does.Contain("off_dt_struct"));
-    Assert.That(desc.Description, Does.Contain("rebuild"));
-  }
-}
diff --git a/Compression.Tests/Dtb/DtbModifyTests.cs b/Compression.Tests/Dtb/DtbModifyTests.cs
new file mode 100644
index 000000000..04332a5aa
--- /dev/null
+++ b/Compression.Tests/Dtb/DtbModifyTests.cs
@@ -0,0 +1,62 @@
+using Compression.Registry;
+using FileFormat.Dtb;
+
+namespace Compression.Tests.Dtb;
+
+[TestFixture]
+public sealed class DtbModifyTests {
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void CreateAddReplaceRemove_PreservesHierarchy() {
+    var descriptor = new DtbFormatDescriptor();
+    var compatible = "vendor,board\0"u8.ToArray();
+    var reg = new byte[] { 0, 0, 0, 1, 0, 0, 0, 32 };
+    var status = "okay\0"u8.ToArray();
+    var replacement = "disabled\0"u8.ToArray();
+
+    using var image = new MemoryStream();
+    descriptor.Create(image, [
+      ArchiveInputInfo.InMemory("soc/serial@1000/compatible.bin", compatible),
+      ArchiveInputInfo.InMemory("soc/serial@1000/reg.bin", reg),
+    ], new FormatCreateOptions());
+
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+    AssertProperty(image, "/soc/serial@1000", "compatible", compatible);
+    AssertProperty(image, "/soc/serial@1000", "reg", reg);
+
+    image.Position = 0;
+    ((IArchiveModifiable)descriptor).Add(image,
+      [ArchiveInputInfo.InMemory("soc/serial@1000/status.bin", status)]);
+    AssertProperty(image, "/soc/serial@1000", "status", status);
+
+    image.Position = 0;
+    ((IArchiveModifiable)descriptor).Add(image,
+      [ArchiveInputInfo.InMemory("soc/serial@1000/status.bin", replacement)]);
+    AssertProperty(image, "/soc/serial@1000", "status", replacement);
+
+    image.Position = 0;
+    ((IArchiveModifiable)descriptor).Remove(image, ["soc/serial@1000/reg.bin"]);
+    var parsed = Parse(image);
+    Assert.That(parsed.Properties.Any(p => p.NodePath == "/soc/serial@1000" && p.Name == "reg"), Is.False);
+    Assert.That(parsed.Properties.Any(p => p.NodePath == "/soc/serial@1000" && p.Name == "compatible"), Is.True);
+  }
+
+  [Test, Category("RoundTrip")]
+  public void RootTextEntry_ListCreateRoundTrip_MapsBackToRootAndRestoresNulTermination() {
+    var descriptor = new DtbFormatDescriptor();
+    using var image = new MemoryStream();
+    descriptor.Create(image,
+      [ArchiveInputInfo.InMemory("_root/compatible.txt", "vendor,board"u8.ToArray())],
+      new FormatCreateOptions());
+
+    var parsed = Parse(image);
+    var property = parsed.Properties.Single(p => p.NodePath == "/" && p.Name == "compatible");
+    Assert.That(property.Data, Is.EqualTo("vendor,board\0"u8.ToArray()));
+  }
+
+  private static DtbReader.Fdt Parse(MemoryStream image) => DtbReader.Read(image.ToArray());
+
+  private static void AssertProperty(MemoryStream image, string path, string name, byte[] data) {
+    var property = Parse(image).Properties.Single(p => p.NodePath == path && p.Name == name);
+    Assert.That(property.Data, Is.EqualTo(data));
+  }
+}
diff --git a/Compression.Tests/Erofs/ErofsRwTests.cs b/Compression.Tests/Erofs/ErofsRwTests.cs
new file mode 100644
index 000000000..990ff6b65
--- /dev/null
+++ b/Compression.Tests/Erofs/ErofsRwTests.cs
@@ -0,0 +1,110 @@
+using Compression.Registry;
+using FileSystem.Erofs;
+
+namespace Compression.Tests.Erofs;
+
+[TestFixture]
+public sealed class ErofsRwTests {
+  private static readonly byte[] Alpha = "alpha payload"u8.ToArray();
+  private static readonly byte[] Beta = Enumerable.Range(0, 9000).Select(i => (byte)(i * 29 + 3)).ToArray();
+
+  private static MemoryStream CreateImage(string label = "CWB") {
+    var descriptor = new ErofsFormatDescriptor();
+    var stream = new MemoryStream();
+    descriptor.Create(stream, [
+      ArchiveInputInfo.InMemory("dir/alpha.txt", Alpha),
+      ArchiveInputInfo.InMemory("beta.bin", Beta),
+    ], new FormatCreateOptions {
+      FormatSpecific = new Dictionary<string, string> { ["VolumeLabel"] = label },
+    });
+    stream.Position = 0;
+    return stream;
+  }
+
+  [Test]
+  public void SupportedFlatProfile_AdvertisesRwAndMaintenance() {
+    var descriptor = new ErofsFormatDescriptor();
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+    Assert.That(descriptor, Is.InstanceOf<IArchiveModifiable>());
+    Assert.That(descriptor, Is.InstanceOf<IArchivePurgeable>());
+    Assert.That(descriptor, Is.InstanceOf<IArchiveDefragmentable>());
+    Assert.That(descriptor, Is.InstanceOf<IArchiveShrinkable>());
+    Assert.That(descriptor, Is.InstanceOf<IFilesystemExtentMap>());
+    Assert.That(descriptor, Is.InstanceOf<IWipeEmpty>());
+  }
+
+  [Test]
+  public void Add_ReplacesExistingFile_AndPreservesVolumeLabel() {
+    using var image = CreateImage("SYSTEM");
+    var replacement = "replacement alpha"u8.ToArray();
+    var descriptor = new ErofsFormatDescriptor();
+
+    descriptor.Add(image, [ArchiveInputInfo.InMemory("dir/alpha.txt", replacement)]);
+
+    image.Position = 0;
+    var reader = new ErofsReader(image);
+    Assert.That(reader.VolumeName, Is.EqualTo("SYSTEM"));
+    var alpha = reader.Entries.Single(e => e.Path == "dir/alpha.txt");
+    Assert.That(reader.ExtractFile(alpha), Is.EqualTo(replacement));
+    var beta = reader.Entries.Single(e => e.Path == "beta.bin");
+    Assert.That(reader.ExtractFile(beta), Is.EqualTo(Beta));
+  }
+
+  [Test]
+  public void Remove_DropsFile_AndPreservesOtherPayload() {
+    using var image = CreateImage();
+    var descriptor = new ErofsFormatDescriptor();
+
+    descriptor.Remove(image, ["dir/alpha.txt"]);
+
+    image.Position = 0;
+    var reader = new ErofsReader(image);
+    Assert.That(reader.Entries.Any(e => e.Path == "dir/alpha.txt"), Is.False);
+    var beta = reader.Entries.Single(e => e.Path == "beta.bin");
+    Assert.That(reader.ExtractFile(beta), Is.EqualTo(Beta));
+  }
+
+  [Test]
+  public void Purge_LeavesValidEmptyImage() {
+    using var image = CreateImage("EMPTYME");
+    var descriptor = new ErofsFormatDescriptor();
+
+    ((IArchivePurgeable)descriptor).Purge(image);
+
+    image.Position = 0;
+    var reader = new ErofsReader(image);
+    Assert.That(reader.VolumeName, Is.EqualTo("EMPTYME"));
+    Assert.That(reader.Entries.Where(e => !e.IsDirectory), Is.Empty);
+  }
+
+  [Test]
+  public void Defragment_PreservesPayloadAndEmitsProgress() {
+    using var image = CreateImage();
+    var descriptor = new ErofsFormatDescriptor();
+    var phases = new List<string>();
+
+    descriptor.Defragment(image, new DefragOptions { OnProgress = e => phases.Add(e.Phase) });
+
+    image.Position = 0;
+    var reader = new ErofsReader(image);
+    Assert.That(reader.ExtractFile(reader.Entries.Single(e => e.Path == "dir/alpha.txt")), Is.EqualTo(Alpha));
+    Assert.That(reader.ExtractFile(reader.Entries.Single(e => e.Path == "beta.bin")), Is.EqualTo(Beta));
+    Assert.That(phases, Does.Contain("scanning").Or.Contain("complete"));
+  }
+
+  [Test]
+  public void Wipe_IsConservativeWithoutAllocatorProof() {
+    using var image = CreateImage();
+    var before = image.ToArray();
+    var descriptor = new ErofsFormatDescriptor();
+
+    var wiped = descriptor.WipeUnusedSpace(image);
+
+    Assert.That(wiped, Is.Zero);
+    Assert.That(image.ToArray(), Is.EqualTo(before));
+    var map = descriptor.EnumerateExtents(image).ToArray();
+    Assert.That(map, Is.Not.Empty);
+    Assert.That(map.Any(e => e.Kind == DefragBlockKind.Free), Is.False,
+      "Unproven EROFS bytes must be reserved, never inferred free.");
+  }
+}
diff --git a/Compression.Tests/Ewf/EwfPurgeTests.cs b/Compression.Tests/Ewf/EwfPurgeTests.cs
new file mode 100644
index 000000000..3c6f6a147
--- /dev/null
+++ b/Compression.Tests/Ewf/EwfPurgeTests.cs
@@ -0,0 +1,26 @@
+using Compression.Registry;
+using FileFormat.Ewf;
+
+namespace Compression.Tests.Ewf;
+
+[TestFixture]
+public sealed class EwfPurgeTests {
+  [Test]
+  public void Purge_LeavesValidEmptyImageAndGeneratedDiagnostics() {
+    var media = new byte[EwfWriter.ChunkSize * 2];
+    for (var i = 0; i < media.Length; ++i) media[i] = (byte)(i * 31 + 7);
+    using var image = new MemoryStream();
+    image.Write(new EwfWriter { CompressChunks = true }.Build(media));
+    image.Position = 0;
+
+    var descriptor = new EwfFormatDescriptor();
+    ((IArchivePurgeable)descriptor).Purge(image);
+
+    var parsed = EwfReader.Read(image.ToArray());
+    Assert.That(EwfReader.ExtractMedia(parsed), Is.Empty);
+    var names = descriptor.List(image, null).Select(e => e.Name).ToArray();
+    Assert.That(names, Does.Contain("media.raw"));
+    Assert.That(names, Does.Contain("metadata.ini"));
+    Assert.That(names.Any(n => n.StartsWith("section_", StringComparison.Ordinal)), Is.True);
+  }
+}
diff --git a/Compression.Tests/Ewf/EwfTests.cs b/Compression.Tests/Ewf/EwfTests.cs
index 4ecf09409..73d43df64 100644
--- a/Compression.Tests/Ewf/EwfTests.cs
+++ b/Compression.Tests/Ewf/EwfTests.cs
@@ -1,88 +1,80 @@
 using System.Buffers.Binary;
 using System.Text;
+using Compression.Registry;
 using FileFormat.Ewf;
+using FileFormat.Zlib;
 
 namespace Compression.Tests.Ewf;
 
 [TestFixture]
 public class EwfTests {
 
-  // Build a minimal EWF segment: 13-byte header + one "header" section
-  // carrying a fabricated acquisition header + a terminal "done" section.
   private static byte[] BuildEwf(byte[] headerPayload, bool logical = false) {
     const int headerSize = EwfReader.FileHeaderSize;
     const int descSize = EwfReader.SectionDescriptorSize;
     var headerSectionSize = descSize + headerPayload.Length;
     var doneSectionOffset = headerSize + headerSectionSize;
-    var total = doneSectionOffset + descSize; // "done" payload empty
-
+    var total = doneSectionOffset + descSize;
     var buf = new byte[total];
 
-    // File header.
     (logical ? EwfReader.LvfSignature : EwfReader.EvfSignature).CopyTo(buf, 0);
-    buf[8] = 0x01;                                                          // fields_start
-    BinaryPrimitives.WriteUInt16LittleEndian(buf.AsSpan(9), 1);             // segment 1
-    BinaryPrimitives.WriteUInt16LittleEndian(buf.AsSpan(11), 0x0000);       // fields_end
-
-    // Section 1: "header" — 16-byte type + 8-byte next + 8-byte size + pad + CRC.
-    var sec1Offset = headerSize;
-    WriteSectionType(buf, sec1Offset, "header");
-    BinaryPrimitives.WriteUInt64LittleEndian(buf.AsSpan(sec1Offset + 16), (ulong)doneSectionOffset);
-    BinaryPrimitives.WriteUInt64LittleEndian(buf.AsSpan(sec1Offset + 24), (ulong)headerSectionSize);
-    BinaryPrimitives.WriteUInt32LittleEndian(buf.AsSpan(sec1Offset + 72), 0xCAFEBABE); // checksum
-    headerPayload.CopyTo(buf.AsSpan(sec1Offset + descSize));
-
-    // Section 2: "done" — terminal; next_offset points to itself per convention.
+    buf[8] = 0x01;
+    BinaryPrimitives.WriteUInt16LittleEndian(buf.AsSpan(9), 1);
+    BinaryPrimitives.WriteUInt16LittleEndian(buf.AsSpan(11), 0);
+
+    WriteSectionType(buf, headerSize, "header");
+    BinaryPrimitives.WriteUInt64LittleEndian(buf.AsSpan(headerSize + 16), (ulong)doneSectionOffset);
+    BinaryPrimitives.WriteUInt64LittleEndian(buf.AsSpan(headerSize + 24), (ulong)headerSectionSize);
+    BinaryPrimitives.WriteUInt32LittleEndian(buf.AsSpan(headerSize + 72), 0xCAFEBABE);
+    headerPayload.CopyTo(buf.AsSpan(headerSize + descSize));
+
     WriteSectionType(buf, doneSectionOffset, "done");
     BinaryPrimitives.WriteUInt64LittleEndian(buf.AsSpan(doneSectionOffset + 16), (ulong)doneSectionOffset);
     BinaryPrimitives.WriteUInt64LittleEndian(buf.AsSpan(doneSectionOffset + 24), descSize);
     BinaryPrimitives.WriteUInt32LittleEndian(buf.AsSpan(doneSectionOffset + 72), 0xDEADBEEF);
-
     return buf;
   }
 
   private static void WriteSectionType(byte[] buf, int offset, string type) {
     var ascii = Encoding.ASCII.GetBytes(type);
     Buffer.BlockCopy(ascii, 0, buf, offset, Math.Min(ascii.Length, 16));
-    // Remaining bytes in the 16-byte type field stay zero by default.
   }
 
   private static byte[] SampleHeader() {
-    // Fake "header" text block in the shape libewf emits: version line, key row,
-    // value row, tab-separated.
     var text = "1\r\n" +
-               "c\tn\te\tnotes\tav\tov\tm\tu\tp\tr\r\n" +
-               "CASE123\tSMITH\tExaminer\tNotes\t20060101\t20060102\tMD5\tUnknown\tp\tr\r\n";
-    return Encoding.UTF8.GetBytes(text);
+               "a\tc\tn\te\tt\tav\tov\tm\tu\tp\tr\r\n" +
+               "Description\tCASE123\tEVIDENCE7\tExaminer\tNotes\t20060101\t20060102\tMD5\tUnknown\tp\tr\r\n";
+    return ZlibStream.Compress(Encoding.UTF8.GetBytes(text));
+  }
+
+  private static byte[] Media(int length = 3 * EwfWriter.ChunkSize) {
+    var data = new byte[length];
+    for (var i = 0; i < data.Length; ++i)
+      data[i] = (byte)((i * 17 + i / 101) & 0xFF);
+    return data;
   }
 
   [Test, Category("HappyPath")]
   public void Read_ParsesEvfSignatureAndSections() {
     var data = BuildEwf(SampleHeader());
     var img = EwfReader.Read(data);
-
     Assert.That(img.IsLogical, Is.False);
     Assert.That(img.SegmentNumber, Is.EqualTo((ushort)1));
     Assert.That(img.Sections, Has.Count.EqualTo(2));
     Assert.That(img.Sections[0].Type, Is.EqualTo("header"));
     Assert.That(img.Sections[1].Type, Is.EqualTo("done"));
-    Assert.That(img.Sections[0].Payload.Length, Is.EqualTo(SampleHeader().Length));
   }
 
   [Test, Category("HappyPath")]
   public void Read_RecognisesLvfSignature() {
-    var data = BuildEwf(SampleHeader(), logical: true);
-    var img = EwfReader.Read(data);
+    var img = EwfReader.Read(BuildEwf(SampleHeader(), logical: true));
     Assert.That(img.IsLogical, Is.True);
   }
 
   [Test, Category("HappyPath")]
   public void Descriptor_List_EmitsMetadataAndSectionEntries() {
-    var data = BuildEwf(SampleHeader());
-    using var ms = new MemoryStream(data);
-    var entries = new EwfFormatDescriptor().List(ms, null);
-    var names = entries.Select(e => e.Name).ToList();
-
+    using var ms = new MemoryStream(BuildEwf(SampleHeader()));
+    var names = new EwfFormatDescriptor().List(ms, null).Select(e => e.Name).ToList();
     Assert.That(names, Does.Contain("metadata.ini"));
     Assert.That(names.Any(n => n.StartsWith("section_00_header", StringComparison.Ordinal)), Is.True);
     Assert.That(names.Any(n => n.StartsWith("section_01_done", StringComparison.Ordinal)), Is.True);
@@ -90,15 +82,12 @@ public void Descriptor_List_EmitsMetadataAndSectionEntries() {
 
   [Test, Category("HappyPath"), Category("RoundTrip")]
   public void Descriptor_Extract_ExtractsMetadataIniWithAcquisitionBlock() {
-    var data = BuildEwf(SampleHeader());
     var tmp = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
     Directory.CreateDirectory(tmp);
     try {
-      using var ms = new MemoryStream(data);
+      using var ms = new MemoryStream(BuildEwf(SampleHeader()));
       new EwfFormatDescriptor().Extract(ms, tmp, null, null);
-      var meta = Path.Combine(tmp, "metadata.ini");
-      Assert.That(File.Exists(meta), Is.True);
-      var text = File.ReadAllText(meta);
+      var text = File.ReadAllText(Path.Combine(tmp, "metadata.ini"));
       Assert.That(text, Does.Contain("[ewf]"));
       Assert.That(text, Does.Contain("section_count = 2"));
       Assert.That(text, Does.Contain("[acquisition]"));
@@ -108,6 +97,90 @@ public void Descriptor_Extract_ExtractsMetadataIniWithAcquisitionBlock() {
     }
   }
 
+  [TestCase(false), TestCase(true)]
+  [Category("HappyPath"), Category("RoundTrip")]
+  public void Writer_Reader_ReconstructsLogicalMedia(bool compress) {
+    var media = Media();
+    var encoded = new EwfWriter { CompressChunks = compress }.Build(media);
+    var decoded = EwfReader.ExtractMedia(EwfReader.Read(encoded));
+    Assert.That(decoded.AsSpan(0, media.Length).ToArray(), Is.EqualTo(media));
+  }
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Descriptor_List_ExposesMutableMediaRaw() {
+    var media = Media();
+    using var image = new MemoryStream(new EwfWriter().Build(media), writable: true);
+    var descriptor = new EwfFormatDescriptor();
+    var mediaEntry = descriptor.List(image, null).Single(e => e.Name == "media.raw");
+    Assert.That(mediaEntry.OriginalSize, Is.EqualTo(media.Length));
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+    Assert.That(descriptor, Is.InstanceOf<IArchiveModifiable>());
+    Assert.That(descriptor, Is.InstanceOf<IArchiveDefragmentable>());
+    Assert.That(descriptor, Is.InstanceOf<IArchiveShrinkable>());
+    Assert.That(descriptor, Is.InstanceOf<IArchiveLayoutMap>());
+  }
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Descriptor_Add_ReplacesMediaRaw() {
+    var original = Media(EwfWriter.ChunkSize);
+    var replacement = Media(EwfWriter.ChunkSize * 2);
+    replacement.AsSpan().Reverse();
+    using var image = new MemoryStream();
+    image.Write(new EwfWriter { CompressChunks = true }.Build(original));
+    image.Position = 0;
+
+    var descriptor = new EwfFormatDescriptor();
+    descriptor.Add(image, [ArchiveInputInfo.InMemory("media.raw", replacement)]);
+    image.Position = 0;
+    var decoded = EwfReader.ExtractMedia(EwfReader.Read(image.ToArray()));
+    Assert.That(decoded.AsSpan(0, replacement.Length).ToArray(), Is.EqualTo(replacement));
+  }
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Descriptor_RemoveMedia_LeavesValidEmptyEvf() {
+    using var image = new MemoryStream();
+    image.Write(new EwfWriter().Build(Media(EwfWriter.ChunkSize)));
+    image.Position = 0;
+    var descriptor = new EwfFormatDescriptor();
+    descriptor.Remove(image, ["media.raw"]);
+    var parsed = EwfReader.Read(image.ToArray());
+    Assert.That(EwfReader.ExtractMedia(parsed), Is.Empty);
+    Assert.That(parsed.Sections.Any(s => s.Type == "done"), Is.True);
+  }
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Descriptor_Defragment_PreservesMediaAndReportsLayout() {
+    var media = Media();
+    using var image = new MemoryStream();
+    image.Write(new EwfWriter { CompressChunks = true }.Build(media));
+    image.Position = 0;
+    var phases = new List<string>();
+    var descriptor = new EwfFormatDescriptor();
+    descriptor.Defragment(image, new DefragOptions {
+      OnProgress = e => phases.Add(e.Phase),
+    });
+    var decoded = EwfReader.ExtractMedia(EwfReader.Read(image.ToArray()));
+    Assert.That(decoded.AsSpan(0, media.Length).ToArray(), Is.EqualTo(media));
+    Assert.That(phases, Does.Contain("scanning"));
+    Assert.That(phases, Does.Contain("writing"));
+    Assert.That(phases, Does.Contain("committing"));
+    Assert.That(phases, Does.Contain("complete"));
+    Assert.That(descriptor.EnumerateLayout(image).Any(), Is.True);
+  }
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Descriptor_Shrink_ChoosesSmallerValidRepresentation() {
+    var media = new byte[EwfWriter.ChunkSize * 4];
+    Array.Fill(media, (byte)0x41);
+    var original = new EwfWriter { CompressChunks = false }.Build(media);
+    using var input = new MemoryStream(original);
+    using var output = new MemoryStream();
+    new EwfFormatDescriptor().Shrink(input, output);
+    Assert.That(output.Length, Is.LessThan(original.Length));
+    var decoded = EwfReader.ExtractMedia(EwfReader.Read(output.ToArray()));
+    Assert.That(decoded.AsSpan(0, media.Length).ToArray(), Is.EqualTo(media));
+  }
+
   [Test, Category("EdgeCase")]
   public void Read_BadSignature_Throws() {
     var data = new byte[64];
@@ -117,7 +190,7 @@ public void Read_BadSignature_Throws() {
 
   [Test, Category("EdgeCase")]
   public void Read_TruncatedHeader_Throws() {
-    var data = new byte[8]; // signature only, no fields_start/segment/fields_end
+    var data = new byte[8];
     EwfReader.EvfSignature.CopyTo(data, 0);
     Assert.That(() => EwfReader.Read(data), Throws.InstanceOf<InvalidDataException>());
   }
@@ -125,7 +198,7 @@ public void Read_TruncatedHeader_Throws() {
   [Test, Category("EdgeCase")]
   public void Read_BadFieldsStart_Throws() {
     var data = BuildEwf(SampleHeader());
-    data[8] = 0x02; // corrupt fields_start (must be 0x01)
+    data[8] = 0x02;
     Assert.That(() => EwfReader.Read(data), Throws.InstanceOf<InvalidDataException>());
   }
 }
diff --git a/Compression.Tests/FilesystemDrivers/ApfsFilesystemDriverTests.cs b/Compression.Tests/FilesystemDrivers/ApfsFilesystemDriverTests.cs
new file mode 100644
index 000000000..41f08dfc2
--- /dev/null
+++ b/Compression.Tests/FilesystemDrivers/ApfsFilesystemDriverTests.cs
@@ -0,0 +1,63 @@
+using Compression.Lib;
+using Compression.Registry;
+using FileSystem.Apfs;
+
+namespace Compression.Tests.FilesystemDrivers;
+
+[TestFixture]
+public sealed class ApfsFilesystemDriverTests {
+  [OneTimeSetUp]
+  public void Init() => FormatRegistration.EnsureInitialized();
+
+  [Test]
+  public void RegistryUsesNativeApfsSidecar() {
+    var coverage = FormatRegistry.GetFilesystemDriverCoverage("Apfs");
+    Assert.That(coverage.Binding, Is.EqualTo(FilesystemDriverBindingKind.SidecarNative));
+    Assert.That(coverage.HasExtentMap, Is.True);
+    Assert.That(coverage.HasBlockMover, Is.True);
+  }
+
+  [Test]
+  public void NativeWriterProfileUsesObjectIdentityAndDirectPositionalReads() {
+    var payload = Enumerable.Range(0, 20_000).Select(i => (byte)(i * 13 + 5)).ToArray();
+    var writer = new ApfsWriter();
+    writer.SetMinImageSize(4 * 1024 * 1024);
+    writer.AddFile("dir/data.bin", payload);
+    var image = writer.Build();
+
+    using var stream = new MemoryStream(image, writable: false);
+    var profile = FormatRegistry.ProbeFilesystem("Apfs", stream);
+    Assert.That(profile.CanMount, Is.True, string.Join("; ", profile.Limitations));
+    Assert.That(profile.CanMountWritable, Is.False);
+
+    stream.Position = 0;
+    using var session = FormatRegistry.OpenFilesystem(
+      "Apfs", stream, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+    var dir = session.Lookup(session.RootNodeId, "dir");
+    Assert.That(dir, Is.Not.Null);
+    var file = session.Lookup(dir!.Value, "data.bin");
+    Assert.That(file, Is.Not.Null);
+
+    var stat = session.Stat(file!.Value);
+    Assert.That(stat.NodeId.Value, Is.GreaterThanOrEqualTo((ulong)ApfsConstants.APFS_MIN_USER_INO_NUM));
+    Assert.That(stat.Size, Is.EqualTo(payload.Length));
+
+    using var handle = session.OpenFile(file.Value, FileAccess.Read);
+    var slice = new byte[1025];
+    var read = handle.Read(12_345, slice);
+    Assert.That(read, Is.EqualTo(slice.Length));
+    Assert.That(slice, Is.EqualTo(payload.AsSpan(12_345, slice.Length).ToArray()));
+  }
+
+  [Test]
+  public void WritableMountStaysFailClosed() {
+    var writer = new ApfsWriter();
+    writer.SetMinImageSize(4 * 1024 * 1024);
+    writer.AddFile("x", "x"u8.ToArray());
+    using var stream = new MemoryStream(writer.Build(), writable: true);
+
+    Assert.Throws<NotSupportedException>(() =>
+      FormatRegistry.OpenFilesystem(
+        "Apfs", stream, new FilesystemOpenOptions(ReadOnly: false, LeaveOpen: true)));
+  }
+}
diff --git a/Compression.Tests/FilesystemDrivers/BlockDeviceAdapterTests.cs b/Compression.Tests/FilesystemDrivers/BlockDeviceAdapterTests.cs
new file mode 100644
index 000000000..3a867fd4b
--- /dev/null
+++ b/Compression.Tests/FilesystemDrivers/BlockDeviceAdapterTests.cs
@@ -0,0 +1,55 @@
+using Compression.Registry;
+
+namespace Compression.Tests.FilesystemDrivers;
+
+[TestFixture]
+public sealed class BlockDeviceAdapterTests {
+  [Test, Category("Driver")]
+  public void StreamBlockDevice_ProvidesAlignedPositionalBlocks() {
+    var bytes = Enumerable.Range(0, 2048).Select(i => (byte)i).ToArray();
+    using var image = new MemoryStream(bytes.ToArray(), writable: true);
+    using var device = new StreamBlockDevice(image, 512, writable: true);
+
+    Span<byte> block = stackalloc byte[512];
+    Assert.That(device.ReadBlocks(2, block), Is.EqualTo(1));
+    Assert.That(block[0], Is.EqualTo(bytes[1024]));
+    Assert.That(block[511], Is.EqualTo(bytes[1535]));
+
+    block.Fill(0xA5);
+    device.WriteBlocks(1, block);
+    Assert.That(image.ToArray().AsSpan(512, 512).ToArray(), Is.All.EqualTo((byte)0xA5));
+    Assert.That(image.ToArray().AsSpan(0, 512).ToArray(), Is.EqualTo(bytes.AsSpan(0, 512).ToArray()));
+  }
+
+  [Test, Category("Driver")]
+  public void BlockDeviceStream_UnalignedWriteTouchesOnlyNecessaryBlocks() {
+    var original = Enumerable.Range(0, 2048).Select(i => (byte)(i * 17)).ToArray();
+    using var image = new MemoryStream(original.ToArray(), writable: true);
+    using var device = new StreamBlockDevice(image, 512, writable: true);
+    using var stream = new BlockDeviceStream(device);
+
+    stream.Position = 510;
+    stream.Write(new byte[] { 0x11, 0x22, 0x33, 0x44, 0x55 });
+    stream.Flush();
+
+    var actual = image.ToArray();
+    Assert.That(actual.AsSpan(0, 510).ToArray(), Is.EqualTo(original.AsSpan(0, 510).ToArray()));
+    Assert.That(actual.AsSpan(510, 5).ToArray(), Is.EqualTo(new byte[] { 0x11, 0x22, 0x33, 0x44, 0x55 }));
+    Assert.That(actual.AsSpan(515).ToArray(), Is.EqualTo(original.AsSpan(515).ToArray()));
+  }
+
+  [Test, Category("Driver")]
+  public void BlockDeviceStream_ProvidesSeekableByteReadsAcrossBlockBoundaries() {
+    var bytes = Enumerable.Range(0, 1536).Select(i => (byte)(i ^ 0x5A)).ToArray();
+    using var image = new MemoryStream(bytes, writable: false);
+    using var device = new StreamBlockDevice(image, 512, writable: false);
+    using var stream = new BlockDeviceStream(device);
+
+    stream.Position = 509;
+    var read = new byte[11];
+    Assert.That(stream.Read(read), Is.EqualTo(read.Length));
+    Assert.That(read, Is.EqualTo(bytes.AsSpan(509, 11).ToArray()));
+    Assert.That(stream.CanWrite, Is.False);
+    Assert.That(() => stream.WriteByte(1), Throws.InstanceOf<NotSupportedException>());
+  }
+}
diff --git a/Compression.Tests/FilesystemDrivers/ExtFilesystemDriverTests.cs b/Compression.Tests/FilesystemDrivers/ExtFilesystemDriverTests.cs
new file mode 100644
index 000000000..bc11f403e
--- /dev/null
+++ b/Compression.Tests/FilesystemDrivers/ExtFilesystemDriverTests.cs
@@ -0,0 +1,63 @@
+using Compression.Lib;
+using Compression.Registry;
+using FileSystem.Ext;
+
+namespace Compression.Tests.FilesystemDrivers;
+
+[TestFixture]
+public sealed class ExtFilesystemDriverTests {
+  [OneTimeSetUp]
+  public void Init() => FormatRegistration.EnsureInitialized();
+
+  [Test]
+  public void RegistryUsesNativeExtSidecar() {
+    var coverage = FormatRegistry.GetFilesystemDriverCoverage("Ext");
+    Assert.That(coverage.Binding, Is.EqualTo(FilesystemDriverBindingKind.SidecarNative));
+    Assert.That(coverage.HasNativeReadinessProvider, Is.True);
+  }
+
+  [Test]
+  public void NativeSessionProvidesStableInodeIdentityAndPositionalReads() {
+    var payload = Enumerable.Range(0, 20_000).Select(i => (byte)(i * 31)).ToArray();
+    var writer = new ExtWriter();
+    writer.AddFile("dir/file.bin", payload);
+    var image = writer.Build();
+
+    using var stream = new MemoryStream(image, writable: false);
+    var profile = FormatRegistry.ProbeFilesystem("Ext", stream);
+    Assert.That(profile.CanMount, Is.True, string.Join("; ", profile.Limitations));
+    Assert.That(profile.CanMountWritable, Is.False);
+
+    stream.Position = 0;
+    using var session = FormatRegistry.OpenFilesystem(
+      "Ext", stream, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+
+    var dir = session.Lookup(session.RootNodeId, "dir");
+    Assert.That(dir, Is.Not.Null);
+    var file = session.Lookup(dir!.Value, "file.bin");
+    Assert.That(file, Is.Not.Null);
+
+    var firstStat = session.Stat(file!.Value);
+    var secondStat = session.Stat(file.Value);
+    Assert.That(secondStat.NodeId, Is.EqualTo(firstStat.NodeId));
+    Assert.That(firstStat.NodeId.Value, Is.GreaterThan(0));
+    Assert.That(firstStat.Size, Is.EqualTo(payload.Length));
+
+    using var handle = session.OpenFile(file.Value, FileAccess.Read);
+    var slice = new byte[777];
+    var read = handle.Read(12_345, slice);
+    Assert.That(read, Is.EqualTo(slice.Length));
+    Assert.That(slice, Is.EqualTo(payload.AsSpan(12_345, slice.Length).ToArray()));
+  }
+
+  [Test]
+  public void WritableMountStaysFailClosed() {
+    var writer = new ExtWriter();
+    writer.AddFile("x", "data"u8.ToArray());
+    using var stream = new MemoryStream(writer.Build(), writable: true);
+
+    Assert.Throws<NotSupportedException>(() =>
+      FormatRegistry.OpenFilesystem(
+        "Ext", stream, new FilesystemOpenOptions(ReadOnly: false, LeaveOpen: true)));
+  }
+}
diff --git a/Compression.Tests/FilesystemDrivers/FatFilesystemDriverTests.cs b/Compression.Tests/FilesystemDrivers/FatFilesystemDriverTests.cs
new file mode 100644
index 000000000..f9cc789d1
--- /dev/null
+++ b/Compression.Tests/FilesystemDrivers/FatFilesystemDriverTests.cs
@@ -0,0 +1,99 @@
+using Compression.Lib;
+using Compression.Registry;
+using FileSystem.Fat;
+
+namespace Compression.Tests.FilesystemDrivers;
+
+[TestFixture]
+public sealed class FatFilesystemDriverTests {
+  [OneTimeSetUp]
+  public void InitializeRegistry() => FormatRegistration.EnsureInitialized();
+
+  [Test, Category("Driver")]
+  public void GeneratedSidecar_IsRegisteredForFat() {
+    var driver = FormatRegistry.GetFilesystemDriver("Fat");
+    Assert.That(driver, Is.TypeOf<FatFilesystemDriverAdapter>());
+  }
+
+  [Test, Category("Driver")]
+  public void NativeFatSession_ReadsArbitraryOffsetsWithoutExtractingWholeFile() {
+    var payload = Enumerable.Range(0, 1700).Select(i => (byte)(i * 29 + 7)).ToArray();
+    var writer = new FatWriter();
+    writer.SetVolumeSerial(0x11223344);
+    writer.AddFile("HELLO.BIN", payload);
+    using var image = new MemoryStream(writer.Build(), writable: false);
+
+    var profile = FormatRegistry.ProbeFilesystem("Fat", image);
+    Assert.That(profile.CanMount, Is.True);
+    Assert.That(profile.CanMountWritable, Is.False);
+    Assert.That(profile.ProfileName, Does.StartWith("FAT"));
+
+    using var session = FormatRegistry.OpenFilesystem(
+      "Fat", image, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+    var node = session.Lookup(session.RootNodeId, "hello.bin");
+    Assert.That(node, Is.Not.Null, "FAT lookup should be case-insensitive when unambiguous.");
+
+    using var handle = session.OpenFile(node!.Value, FileAccess.Read);
+    var buffer = new byte[777];
+    Assert.That(handle.Read(503, buffer), Is.EqualTo(buffer.Length));
+    Assert.That(buffer, Is.EqualTo(payload.AsSpan(503, buffer.Length).ToArray()));
+
+    var tail = new byte[64];
+    Assert.That(handle.Read(payload.Length - 17, tail), Is.EqualTo(17));
+    Assert.That(tail.AsSpan(0, 17).ToArray(), Is.EqualTo(payload[^17..]));
+    Assert.That(handle.Read(payload.Length, tail), Is.Zero);
+  }
+
+  [Test, Category("Driver")]
+  public void FatDriver_ComposesWithRandomAccessBlockDevice() {
+    var payload = Enumerable.Range(0, 900).Select(i => (byte)(255 - i)).ToArray();
+    var writer = new FatWriter();
+    writer.SetVolumeSerial(0x55667788);
+    writer.AddFile("BLOCK.DAT", payload);
+    using var image = new MemoryStream(writer.Build(), writable: false);
+    using var device = new StreamBlockDevice(image, 512, writable: false, leaveOpen: true);
+    var adapter = new FatFilesystemDriverAdapter();
+
+    using var session = adapter.OpenFilesystem(
+      device, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+    var node = session.Lookup(session.RootNodeId, "BLOCK.DAT");
+    Assert.That(node, Is.Not.Null);
+    using var handle = session.OpenFile(node!.Value, FileAccess.Read);
+    var bytes = new byte[300];
+    Assert.That(handle.Read(510, bytes), Is.EqualTo(bytes.Length));
+    Assert.That(bytes, Is.EqualTo(payload.AsSpan(510, bytes.Length).ToArray()));
+  }
+
+  [Test, Category("Driver"), Category("Corruption")]
+  public void WritableReadiness_FailsClosedWhenFatCopiesDisagree() {
+    var writer = new FatWriter();
+    writer.SetVolumeSerial(0x99AABBCC);
+    writer.AddFile("A.BIN", Enumerable.Repeat((byte)0xA5, 700).ToArray());
+    var bytes = writer.Build();
+
+    // Default 1.44 MB FAT12 geometry: reserved sector 1, each FAT is 9 sectors.
+    // Cluster 2's packed FAT12 entry starts at byte offset cluster + cluster/2.
+    var secondFatStart = (1 + 9) * 512;
+    bytes[secondFatStart + 3] ^= 0x01;
+    using var image = new MemoryStream(bytes, writable: false);
+
+    var profile = new FatFilesystemDriverAdapter().ProbeFilesystem(image);
+    Assert.That(profile.CanMount, Is.False);
+    Assert.That(profile.Limitations.Any(text => text.Contains("copies disagree", StringComparison.OrdinalIgnoreCase)), Is.True);
+  }
+
+  [Test, Category("Driver"), Category("Contract")]
+  public void FatReadiness_SeparatesExistingOfflineMutationFromMountedWriteCompleteness() {
+    var writer = new FatWriter();
+    writer.SetVolumeSerial(0xCAFEBABE);
+    writer.AddFile("A.TXT", "abc"u8.ToArray());
+    using var image = new MemoryStream(writer.Build(), writable: true);
+
+    var report = FormatRegistry.AssessFilesystemDriver("Fat", image, FilesystemDriverTarget.ReadWrite);
+    Assert.That(report.UsesNativeProvider, Is.True);
+    Assert.That(report.Derivable, Is.False);
+    Assert.That(report.AvailableLayers.HasFlag(FilesystemDriverReadinessLayer.AllocationMap), Is.True);
+    Assert.That(report.AvailableLayers.HasFlag(FilesystemDriverReadinessLayer.WriteData), Is.False);
+    Assert.That(report.Blockers.Any(text => text.Contains("FatModifier", StringComparison.Ordinal)), Is.True);
+  }
+}
diff --git a/Compression.Tests/FilesystemDrivers/FilesystemDriverDerivationTests.cs b/Compression.Tests/FilesystemDrivers/FilesystemDriverDerivationTests.cs
new file mode 100644
index 000000000..57aca98f8
--- /dev/null
+++ b/Compression.Tests/FilesystemDrivers/FilesystemDriverDerivationTests.cs
@@ -0,0 +1,118 @@
+using Compression.Lib;
+using Compression.Registry;
+
+namespace Compression.Tests.FilesystemDrivers;
+
+[TestFixture]
+public sealed class FilesystemDriverDerivationTests {
+  [OneTimeSetUp]
+  public void InitializeRegistry() => FormatRegistration.EnsureInitialized();
+
+  [Test, Category("Driver")]
+  public void DerivedReadOnlySession_ReconstructsHierarchyAndProvidesPositionalHandles() {
+    var descriptor = new ProjectionDescriptor();
+    using var image = new MemoryStream(new byte[] { 0x42 }, writable: false);
+    using var session = FilesystemDriverDerivation.Open(
+      descriptor, image, new FilesystemOpenOptions(ReadOnly: true));
+
+    Assert.That(session.Profile.CanMount, Is.True);
+    Assert.That(session.Profile.CanMountWritable, Is.False);
+    var root = session.RootNodeId;
+    var rootEntries = session.Enumerate(root);
+    Assert.That(rootEntries.Select(e => e.Name), Is.EqualTo(new[] { "folder", "link" }));
+
+    var folder = session.Lookup(root, "folder");
+    Assert.That(folder, Is.Not.Null);
+    Assert.That(session.Lookup(root, "FOLDER"), Is.EqualTo(folder),
+      "fallback lookup may case-fold only when the result is unambiguous");
+    var dataNode = session.Lookup(folder!.Value, "data.bin");
+    Assert.That(dataNode, Is.Not.Null);
+    Assert.That(session.Lookup(folder.Value, "data.bin"), Is.EqualTo(dataNode),
+      "node ids must remain stable for the session lifetime");
+
+    using var handle = session.OpenFile(dataNode!.Value, FileAccess.Read);
+    Span<byte> slice = stackalloc byte[3];
+    Assert.That(handle.Read(2, slice), Is.EqualTo(3));
+    Assert.That(slice.ToArray(), Is.EqualTo(new byte[] { 3, 4, 5 }));
+    Assert.That(handle.Read(99, slice), Is.Zero);
+
+    var link = session.Lookup(root, "link");
+    Assert.That(link, Is.Not.Null);
+    Assert.That(session.Stat(link!.Value).Kind, Is.EqualTo(FilesystemNodeKind.SymbolicLink));
+    Assert.That(session.ReadSymbolicLink(link.Value), Is.EqualTo("folder/data.bin"));
+
+    Assert.That(() => session.CreateFile(root, "new.bin"), Throws.InstanceOf<NotSupportedException>());
+    Assert.That(() => session.BeginTransaction(), Throws.InstanceOf<NotSupportedException>());
+  }
+
+  [Test, Category("Driver"), Category("Contract")]
+  public void EveryRegisteredFilesystemDescriptor_HasAtLeastReadOnlyDriverDerivationSurface() {
+    var filesystemDescriptors = FormatRegistry.All
+      .Where(descriptor => descriptor.GetType().Assembly.GetName().Name
+        ?.StartsWith("FileSystem.", StringComparison.Ordinal) == true)
+      .ToArray();
+
+    Assert.That(filesystemDescriptors, Is.Not.Empty, "No FileSystem.* descriptors were registered.");
+    var missing = filesystemDescriptors
+      .Where(descriptor => descriptor is not IFilesystemDriverProvider && descriptor is not IArchiveFormatOperations)
+      .Select(descriptor => $"{descriptor.Id} ({descriptor.GetType().FullName})")
+      .OrderBy(name => name, StringComparer.Ordinal)
+      .ToArray();
+
+    Assert.That(missing, Is.Empty,
+      "Every FileSystem.* descriptor must expose either a native filesystem provider or List/OpenEntry so the common read-only driver can be derived. Missing: " +
+      string.Join(", ", missing));
+  }
+
+  [Test, Category("Driver"), Category("Contract")]
+  public void ArchiveModifyCapability_IsNeverPromotedToMountedWriteSupport() {
+    var descriptor = new ProjectionDescriptor();
+    using var image = new MemoryStream(new byte[] { 0x42 }, writable: true);
+
+    var profile = FilesystemDriverDerivation.Probe(descriptor, image);
+    Assert.That(profile.CanMount, Is.True);
+    Assert.That(profile.CanMountWritable, Is.False);
+    Assert.That(() => FilesystemDriverDerivation.Open(
+      descriptor, image, new FilesystemOpenOptions(ReadOnly: false)),
+      Throws.InstanceOf<NotSupportedException>());
+  }
+
+  private sealed class ProjectionDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveModifiable {
+    private static readonly byte[] Data = [1, 2, 3, 4, 5, 6];
+
+    public string Id => "DriverProjectionTest";
+    public string DisplayName => "driver projection test";
+    public FormatCategory Category => FormatCategory.Archive;
+    public FormatCapabilities Capabilities =>
+      FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanModify |
+      FormatCapabilities.SupportsMultipleEntries;
+    public string DefaultExtension => ".drvtest";
+    public IReadOnlyList<string> Extensions => [".drvtest"];
+    public IReadOnlyList<string> CompoundExtensions => [];
+    public IReadOnlyList<MagicSignature> MagicSignatures => [];
+    public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored")];
+    public string? TarCompressionFormatId => null;
+
+    public List<ArchiveEntryInfo> List(Stream stream, string? password) => [
+      new(0, "folder", 0, 0, "directory", true, false, null),
+      new(1, "folder/data.bin", Data.Length, Data.Length, "stored", false, false, null),
+      new(2, "link", "folder/data.bin".Length, "folder/data.bin".Length,
+        "symlink", false, false, null, IsSymlink: true, LinkTarget: "folder/data.bin"),
+    ];
+
+    public void Extract(Stream stream, string outputDir, string? password, string[]? files)
+      => throw new NotSupportedException("The derivation test uses OpenEntry directly.");
+
+    public Stream OpenEntry(Stream archive, string entryName, string? password) {
+      var bytes = string.Equals(entryName, "folder/data.bin", StringComparison.Ordinal)
+        ? Data
+        : [];
+      return new MemoryStream(bytes, writable: false);
+    }
+
+    public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)
+      => throw new NotSupportedException();
+    public void Remove(Stream archive, string[] entryNames)
+      => throw new NotSupportedException();
+  }
+}
diff --git a/Compression.Tests/FilesystemDrivers/NtfsFilesystemDriverTests.cs b/Compression.Tests/FilesystemDrivers/NtfsFilesystemDriverTests.cs
new file mode 100644
index 000000000..03cce30dd
--- /dev/null
+++ b/Compression.Tests/FilesystemDrivers/NtfsFilesystemDriverTests.cs
@@ -0,0 +1,59 @@
+using Compression.Lib;
+using Compression.Registry;
+using FileSystem.Ntfs;
+
+namespace Compression.Tests.FilesystemDrivers;
+
+[TestFixture]
+public sealed class NtfsFilesystemDriverTests {
+  [OneTimeSetUp]
+  public void Init() => FormatRegistration.EnsureInitialized();
+
+  [Test]
+  public void RegistryUsesNativeNtfsSidecar() {
+    var coverage = FormatRegistry.GetFilesystemDriverCoverage("Ntfs");
+    Assert.That(coverage.Binding, Is.EqualTo(FilesystemDriverBindingKind.SidecarNative));
+    Assert.That(coverage.HasExtentMap, Is.True);
+    Assert.That(coverage.HasBlockMover, Is.True);
+  }
+
+  [Test]
+  public void NativeSessionUsesMftIdentityAndSupportsPositionalReads() {
+    var payload = Enumerable.Range(0, 200 * 1024).Select(i => (byte)(i * 29 + 7)).ToArray();
+    var writer = new NtfsWriter();
+    writer.AddFile("dir/data.bin", payload);
+    var image = writer.Build(8 * 1024 * 1024);
+
+    using var stream = new MemoryStream(image, writable: false);
+    var profile = FormatRegistry.ProbeFilesystem("Ntfs", stream);
+    Assert.That(profile.CanMount, Is.True, string.Join("; ", profile.Limitations));
+    Assert.That(profile.CanMountWritable, Is.False);
+
+    stream.Position = 0;
+    using var session = FormatRegistry.OpenFilesystem(
+      "Ntfs", stream, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+
+    var dir = session.Lookup(session.RootNodeId, "dir");
+    Assert.That(dir, Is.Not.Null);
+    var file = session.Lookup(dir!.Value, "data.bin");
+    Assert.That(file, Is.Not.Null);
+    Assert.That(file!.Value.Value, Is.GreaterThan(15), "user object id should be its non-reserved MFT record");
+
+    using var handle = session.OpenFile(file.Value, FileAccess.Read);
+    var slice = new byte[2049];
+    var read = handle.Read(73_333, slice);
+    Assert.That(read, Is.EqualTo(slice.Length));
+    Assert.That(slice, Is.EqualTo(payload.AsSpan(73_333, slice.Length).ToArray()));
+  }
+
+  [Test]
+  public void WritableMountStaysFailClosed() {
+    var writer = new NtfsWriter();
+    writer.AddFile("x.txt", "x"u8.ToArray());
+    using var stream = new MemoryStream(writer.Build(), writable: true);
+
+    Assert.Throws<NotSupportedException>(() =>
+      FormatRegistry.OpenFilesystem(
+        "Ntfs", stream, new FilesystemOpenOptions(ReadOnly: false, LeaveOpen: true)));
+  }
+}
diff --git a/Compression.Tests/FilesystemDrivers/XfsFilesystemDriverTests.cs b/Compression.Tests/FilesystemDrivers/XfsFilesystemDriverTests.cs
new file mode 100644
index 000000000..d72df34ff
--- /dev/null
+++ b/Compression.Tests/FilesystemDrivers/XfsFilesystemDriverTests.cs
@@ -0,0 +1,61 @@
+using Compression.Lib;
+using Compression.Registry;
+using FileSystem.Xfs;
+
+namespace Compression.Tests.FilesystemDrivers;
+
+[TestFixture]
+public sealed class XfsFilesystemDriverTests {
+  [OneTimeSetUp]
+  public void Init() => FormatRegistration.EnsureInitialized();
+
+  [Test]
+  public void RegistryUsesNativeXfsSidecar() {
+    var coverage = FormatRegistry.GetFilesystemDriverCoverage("Xfs");
+    Assert.That(coverage.Binding, Is.EqualTo(FilesystemDriverBindingKind.SidecarNative));
+    Assert.That(coverage.HasExtentMap, Is.True);
+    Assert.That(coverage.HasBlockMover, Is.True);
+  }
+
+  [Test]
+  public void NativeSessionUsesInodeIdentityAndStreamsPositionalReads() {
+    var payload = Enumerable.Range(0, 80_000).Select(i => (byte)(i * 17 + 11)).ToArray();
+    var writer = new XfsWriter();
+    writer.AddFile("a/b.bin", payload);
+    var image = writer.BuildImageBytes();
+
+    using var stream = new MemoryStream(image, writable: false);
+    var profile = FormatRegistry.ProbeFilesystem("Xfs", stream);
+    Assert.That(profile.CanMount, Is.True, string.Join("; ", profile.Limitations));
+    Assert.That(profile.CanMountWritable, Is.False);
+
+    stream.Position = 0;
+    using var session = FormatRegistry.OpenFilesystem(
+      "Xfs", stream, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+    var a = session.Lookup(session.RootNodeId, "a");
+    Assert.That(a, Is.Not.Null);
+    var file = session.Lookup(a!.Value, "b.bin");
+    Assert.That(file, Is.Not.Null);
+
+    var stat = session.Stat(file!.Value);
+    Assert.That(stat.NodeId.Value, Is.GreaterThan(0));
+    Assert.That(stat.Size, Is.EqualTo(payload.Length));
+
+    using var handle = session.OpenFile(file.Value, FileAccess.Read);
+    var slice = new byte[1537];
+    var read = handle.Read(31_337, slice);
+    Assert.That(read, Is.EqualTo(slice.Length));
+    Assert.That(slice, Is.EqualTo(payload.AsSpan(31_337, slice.Length).ToArray()));
+  }
+
+  [Test]
+  public void WritableMountStaysFailClosed() {
+    var writer = new XfsWriter();
+    writer.AddFile("x", "x"u8.ToArray());
+    using var stream = new MemoryStream(writer.BuildImageBytes(), writable: true);
+
+    Assert.Throws<NotSupportedException>(() =>
+      FormatRegistry.OpenFilesystem(
+        "Xfs", stream, new FilesystemOpenOptions(ReadOnly: false, LeaveOpen: true)));
+  }
+}
diff --git a/Compression.Tests/Mounting/DokanRuntimeProbeTests.cs b/Compression.Tests/Mounting/DokanRuntimeProbeTests.cs
new file mode 100644
index 000000000..b8cd1eea1
--- /dev/null
+++ b/Compression.Tests/Mounting/DokanRuntimeProbeTests.cs
@@ -0,0 +1,52 @@
+using Compression.Mounting.Dokan;
+using Compression.Registry;
+
+namespace Compression.Tests.Mounting;
+
+[TestFixture]
+public sealed class DokanRuntimeProbeTests {
+  [Test]
+  public void BackendNeverAdvertisesUnimplementedMountModes() {
+    var backend = new DokanFilesystemMountBackend(
+      new DokanRuntimeStatus(
+        IsAvailable: true,
+        LibraryVersion: 210,
+        DriverVersion: 210,
+        LibraryPath: "dokan2.dll",
+        UnavailableReason: null
+      )
+    );
+
+    var profile = backend.GetProfile();
+
+    Assert.Multiple(() => {
+      Assert.That(profile.Id, Is.EqualTo("dokan"));
+      Assert.That(profile.IsAvailable, Is.True);
+      Assert.That(profile.SupportsReadOnly, Is.False);
+      Assert.That(profile.SupportsReadWrite, Is.False);
+      Assert.That(profile.RequiredReadCapabilities, Is.EqualTo(FilesystemDriverCapabilities.None));
+      Assert.That(profile.RequiredWriteCapabilities, Is.EqualTo(FilesystemDriverCapabilities.None));
+      Assert.That(
+        profile.Limitations.Any(static limitation => limitation.Contains("intentionally disabled", StringComparison.Ordinal)),
+        Is.True
+      );
+    });
+  }
+
+  [Test]
+  public void RuntimeAvailabilityRequiresBothLibraryAndDriverVersions() {
+    var status = DokanRuntimeProbe.Probe();
+
+    Assert.Multiple(() => {
+      Assert.That(status.IsAvailable, Is.EqualTo(
+        OperatingSystem.IsWindows() && status.LibraryVersion != 0 && status.DriverVersion != 0
+      ));
+      if (status.IsAvailable) {
+        Assert.That(status.LibraryPath, Is.Not.Null.And.Not.Empty);
+        Assert.That(status.UnavailableReason, Is.Null);
+      } else {
+        Assert.That(status.UnavailableReason, Is.Not.Null.And.Not.Empty);
+      }
+    });
+  }
+}
diff --git a/Compression.Tests/Mounting/FilesystemMountCapabilityResolverTests.cs b/Compression.Tests/Mounting/FilesystemMountCapabilityResolverTests.cs
new file mode 100644
index 000000000..cba1f70f5
--- /dev/null
+++ b/Compression.Tests/Mounting/FilesystemMountCapabilityResolverTests.cs
@@ -0,0 +1,254 @@
+using Compression.Mounting;
+using Compression.Registry;
+
+namespace Compression.Tests.Mounting;
+
+[TestFixture]
+public sealed class FilesystemMountCapabilityResolverTests {
+  private static readonly FilesystemDriverCapabilities AllCoreCapabilities =
+    FilesystemMountCapabilityResolver.CoreReadCapabilities |
+    FilesystemMountCapabilityResolver.CoreWriteCapabilities;
+
+  [Test]
+  public void DescriptorCanModifyAloneDoesNotGrantWritableMount() {
+    var descriptorCapabilities = FormatCapabilities.CanModify;
+    Assert.That(descriptorCapabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+
+    var plan = Resolve(
+      Profile(canMountWritable: false),
+      MountAccessMode.ReadWrite,
+      sourceCanWrite: true
+    );
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.Reasons.Select(static reason => reason.Code),
+        Does.Contain(MountSupportReasonCode.FilesystemProfileNotWritable));
+      Assert.That(plan.Reasons.Select(static reason => reason.Code),
+        Does.Not.Contain(MountSupportReasonCode.MissingDriverCapabilities));
+    });
+  }
+
+  [Test]
+  public void WholeImageRebuildNeverGrantsWritableMount() {
+    var plan = Resolve(
+      Profile(mutationModel: FilesystemMutationModel.WholeImageRebuild),
+      MountAccessMode.ReadWrite,
+      sourceCanWrite: true
+    );
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.Reasons.Select(static reason => reason.Code),
+        Does.Contain(MountSupportReasonCode.UnsupportedMutationModel));
+    });
+  }
+
+  [Test]
+  public void ReadOnlySourceRejectsWritableMount() {
+    var plan = Resolve(Profile(), MountAccessMode.ReadWrite, sourceCanWrite: false);
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.Reasons.Select(static reason => reason.Code),
+        Does.Contain(MountSupportReasonCode.SourceIsReadOnly));
+    });
+  }
+
+  [TestCase(FilesystemDriverCapabilities.WriteData)]
+  [TestCase(FilesystemDriverCapabilities.Truncate)]
+  [TestCase(FilesystemDriverCapabilities.CreateFile)]
+  [TestCase(FilesystemDriverCapabilities.DeleteFile)]
+  [TestCase(FilesystemDriverCapabilities.CreateDirectory)]
+  [TestCase(FilesystemDriverCapabilities.RemoveDirectory)]
+  [TestCase(FilesystemDriverCapabilities.Rename)]
+  [TestCase(FilesystemDriverCapabilities.Flush)]
+  public void MissingCoreWritePrimitiveRejectsWritableMount(FilesystemDriverCapabilities missingCapability) {
+    var plan = Resolve(
+      Profile(capabilities: AllCoreCapabilities & ~missingCapability),
+      MountAccessMode.ReadWrite,
+      sourceCanWrite: true
+    );
+
+    var missingReason = plan.Reasons.Single(reason =>
+      reason.Code == MountSupportReasonCode.MissingDriverCapabilities &&
+      reason.MissingCapabilities.HasFlag(missingCapability));
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.MissingCapabilities, Is.EqualTo(missingCapability));
+      Assert.That(missingReason.MissingCapabilities, Is.EqualTo(missingCapability));
+    });
+  }
+
+  [TestCase(FilesystemDriverCapabilities.EnumerateDirectories)]
+  [TestCase(FilesystemDriverCapabilities.ReadData)]
+  [TestCase(FilesystemDriverCapabilities.RandomAccess)]
+  [TestCase(FilesystemDriverCapabilities.StableNodeIds)]
+  public void MissingCoreReadPrimitiveRejectsReadOnlyMount(FilesystemDriverCapabilities missingCapability) {
+    var plan = Resolve(
+      Profile(capabilities: AllCoreCapabilities & ~missingCapability),
+      MountAccessMode.ReadOnly,
+      sourceCanWrite: false
+    );
+
+    var missingReason = plan.Reasons.Single(reason => reason.Code == MountSupportReasonCode.MissingDriverCapabilities);
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.MissingCapabilities, Is.EqualTo(missingCapability));
+      Assert.That(missingReason.MissingCapabilities, Is.EqualTo(missingCapability));
+    });
+  }
+
+  [TestCase(MountAccessMode.ReadOnly)]
+  [TestCase(MountAccessMode.ReadWrite)]
+  public void UnavailableBackendRejectsEveryAccessMode(MountAccessMode accessMode) {
+    var plan = Resolve(
+      Profile(),
+      accessMode,
+      sourceCanWrite: true,
+      backend: Backend(isAvailable: false)
+    );
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.Reasons.Select(static reason => reason.Code),
+        Does.Contain(MountSupportReasonCode.BackendUnavailable));
+    });
+  }
+
+  [Test]
+  public void BackendReadOnlySupportFlagIsRequired() {
+    var plan = Resolve(
+      Profile(),
+      MountAccessMode.ReadOnly,
+      sourceCanWrite: false,
+      backend: Backend(supportsReadOnly: false)
+    );
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.Reasons.Select(static reason => reason.Code),
+        Does.Contain(MountSupportReasonCode.BackendDoesNotSupportReadOnly));
+    });
+  }
+
+  [Test]
+  public void BackendReadWriteSupportFlagIsRequired() {
+    var plan = Resolve(
+      Profile(),
+      MountAccessMode.ReadWrite,
+      sourceCanWrite: true,
+      backend: Backend(supportsReadWrite: false)
+    );
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.Reasons.Select(static reason => reason.Code),
+        Does.Contain(MountSupportReasonCode.BackendDoesNotSupportReadWrite));
+    });
+  }
+
+  [Test]
+  public void OptionalFilesystemCapabilitiesRemainOptional() {
+    var optional =
+      FilesystemDriverCapabilities.HardLinks |
+      FilesystemDriverCapabilities.SymbolicLinks |
+      FilesystemDriverCapabilities.SetMetadata |
+      FilesystemDriverCapabilities.SparseFiles |
+      FilesystemDriverCapabilities.Transactions;
+    var profile = Profile(capabilities: AllCoreCapabilities & ~optional);
+
+    var readOnly = Resolve(profile, MountAccessMode.ReadOnly, sourceCanWrite: false);
+    var readWrite = Resolve(profile, MountAccessMode.ReadWrite, sourceCanWrite: true);
+
+    Assert.Multiple(() => {
+      Assert.That(readOnly.IsSupported, Is.True);
+      Assert.That(readWrite.IsSupported, Is.True);
+      Assert.That(readOnly.RequiredCapabilities & optional, Is.EqualTo(FilesystemDriverCapabilities.None));
+      Assert.That(readWrite.RequiredCapabilities & optional, Is.EqualTo(FilesystemDriverCapabilities.None));
+    });
+  }
+
+  [Test]
+  public void BackendSpecificCapabilitiesAreReportedExactly() {
+    var requiredRead = FilesystemDriverCapabilities.SetMetadata;
+    var requiredWrite = FilesystemDriverCapabilities.SymbolicLinks;
+    var backend = Backend(requiredReadCapabilities: requiredRead, requiredWriteCapabilities: requiredWrite);
+    var plan = Resolve(Profile(), MountAccessMode.ReadWrite, sourceCanWrite: true, backend: backend);
+
+    Assert.Multiple(() => {
+      Assert.That(plan.IsSupported, Is.False);
+      Assert.That(plan.MissingCapabilities, Is.EqualTo(requiredRead | requiredWrite));
+      Assert.That(plan.Reasons.Where(static reason => reason.Code == MountSupportReasonCode.MissingDriverCapabilities)
+        .Select(static reason => reason.MissingCapabilities),
+        Is.EquivalentTo(new[] { requiredRead, requiredWrite }));
+    });
+  }
+
+  [Test]
+  public void RegistryRejectsDuplicateBackendIdsCaseInsensitively() {
+    var first = new StubBackend(Backend(id: "dokan"));
+    var duplicate = new StubBackend(Backend(id: "DOKAN"));
+
+    Assert.That(
+      () => new MountBackendRegistry(new IFilesystemMountBackend[] { first, duplicate }),
+      Throws.ArgumentException
+    );
+  }
+
+  private static MountPlan Resolve(
+    FilesystemDriverProfile profile,
+    MountAccessMode accessMode,
+    bool sourceCanWrite,
+    MountBackendProfile? backend = null
+  ) => FilesystemMountCapabilityResolver.Resolve(
+    profile,
+    backend ?? Backend(),
+    accessMode,
+    sourceCanWrite
+  );
+
+  private static FilesystemDriverProfile Profile(
+    FilesystemDriverCapabilities? capabilities = null,
+    FilesystemMutationModel mutationModel = FilesystemMutationModel.Direct,
+    bool canMount = true,
+    bool canMountWritable = true
+  ) => new(
+    "testfs",
+    "synthetic",
+    capabilities ?? AllCoreCapabilities,
+    mutationModel,
+    canMount,
+    canMountWritable,
+    Array.Empty<string>()
+  );
+
+  private static MountBackendProfile Backend(
+    string id = "test",
+    bool isAvailable = true,
+    bool supportsReadOnly = true,
+    bool supportsReadWrite = true,
+    FilesystemDriverCapabilities requiredReadCapabilities = FilesystemDriverCapabilities.None,
+    FilesystemDriverCapabilities requiredWriteCapabilities = FilesystemDriverCapabilities.None
+  ) => new(
+    id,
+    "Synthetic backend",
+    isAvailable,
+    supportsReadOnly,
+    supportsReadWrite,
+    requiredReadCapabilities,
+    requiredWriteCapabilities,
+    Array.Empty<string>()
+  );
+
+  private sealed class StubBackend(MountBackendProfile profile) : IFilesystemMountBackend {
+    public MountBackendProfile GetProfile() => profile;
+
+    public ValueTask<IMountSession> MountAsync(
+      FilesystemMountRequest request,
+      CancellationToken cancellationToken = default
+    ) => throw new NotSupportedException();
+  }
+}
diff --git a/Compression.Tests/Operations/ArchiveModifyRoundTripTests.cs b/Compression.Tests/Operations/ArchiveModifyRoundTripTests.cs
index 13e9c5058..490751766 100644
--- a/Compression.Tests/Operations/ArchiveModifyRoundTripTests.cs
+++ b/Compression.Tests/Operations/ArchiveModifyRoundTripTests.cs
@@ -19,15 +19,13 @@ namespace Compression.Tests.Operations;
 [TestFixture]
 public class ArchiveModifyRoundTripTests {
 
-  // Name-preserving modifiable archive containers (probe names round-trip verbatim).
   private static readonly string[] NamePreservingModifiableArchives = [
     "Ace", "Afs", "Ampk", "AndroidBundle", "Ba2", "Big", "Bsa", "Cbr", "Chm",
-    "CompactPro", "Deb", "Doc", "Dzip", "FreeArc", "Gar", "Gob", "GodotPck",
+    "CompactPro", "Deb", "Dmg", "Doc", "Dzip", "FreeArc", "Gar", "Gob", "GodotPck",
     "Grp", "Hpi", "LzxAmiga", "Mpq", "Msg", "Msi", "Msix", "Narc", "Nds", "Nsa",
     "Ppt", "Psarc", "Rgss", "Rpa", "Sar", "Sarc", "Slf", "Sqx", "StuffIt",
     "ThumbsDb", "Tnef", "U8", "Uharc", "Vpk", "Vpp", "VppV2", "Vsdx", "Wad",
     "Xls", "Xps", "Ypf", "Zpaq",
-    // previously promoted siblings that share the same contract
     "SevenZip", "Zip", "Tar", "Rar", "Cab", "Arj", "Zoo", "Arc", "Appx", "Apk",
   ];
 
@@ -64,7 +62,6 @@ public void CreateAddRemove_SurvivorsStayByteIdentical(string formatId) {
     }
     if (ms.Length == 0) { Assert.Ignore($"{formatId}: create produced no image."); return; }
 
-    // Add a third file through the modify path.
     ms.Position = 0;
     try {
       modifiable.Add(ms, [ArchiveInputInfo.InMemory("C.TXT", cData)]);
@@ -77,7 +74,6 @@ public void CreateAddRemove_SurvivorsStayByteIdentical(string formatId) {
     Assert.That(Has(afterAdd, "B.BIN"), Is.True, $"{formatId}: B.BIN lost during Add (after={Join(afterAdd)})");
     Assert.That(Has(afterAdd, "C.TXT"), Is.True, $"{formatId}: C.TXT missing after Add (after={Join(afterAdd)})");
 
-    // Remove the second file through the modify path.
     ms.Position = 0;
     var bName = afterAdd.First(n => Matches(n, "B.BIN"));
     modifiable.Remove(ms, [bName]);
@@ -86,7 +82,6 @@ public void CreateAddRemove_SurvivorsStayByteIdentical(string formatId) {
     Assert.That(Has(afterRemove, "A.TXT"), Is.True, $"{formatId}: A.TXT lost during Remove (after={Join(afterRemove)})");
     Assert.That(Has(afterRemove, "C.TXT"), Is.True, $"{formatId}: C.TXT lost during Remove (after={Join(afterRemove)})");
 
-    // Survivors must extract byte-identically.
     var work = Path.Combine(Path.GetTempPath(), "cwb_modrt_" + Guid.NewGuid().ToString("N")[..8]);
     Directory.CreateDirectory(work);
     try {
@@ -100,7 +95,7 @@ public void CreateAddRemove_SurvivorsStayByteIdentical(string formatId) {
       Assert.That(File.ReadAllBytes(a!).SequenceEqual(aData), Is.True, $"{formatId}: A.TXT content changed by modify cycle");
       Assert.That(File.ReadAllBytes(c!).SequenceEqual(cData), Is.True, $"{formatId}: C.TXT content changed by modify cycle");
     } finally {
-      try { Directory.Delete(work, true); } catch { /* best effort */ }
+      try { Directory.Delete(work, true); } catch { }
     }
   }
 
@@ -113,6 +108,5 @@ private static bool Matches(string name, string user) =>
     string.Equals(Path.GetFileName(name.Replace('\\', '/')), user, StringComparison.OrdinalIgnoreCase);
 
   private static bool Has(IEnumerable<string> names, string user) => names.Any(n => Matches(n, user));
-
   private static string Join(IEnumerable<string> names) => string.Join(",", names.Take(8));
 }
diff --git a/Compression.Tests/Operations/CapabilityDocumentationTests.cs b/Compression.Tests/Operations/CapabilityDocumentationTests.cs
new file mode 100644
index 000000000..80c577eda
--- /dev/null
+++ b/Compression.Tests/Operations/CapabilityDocumentationTests.cs
@@ -0,0 +1,125 @@
+#pragma warning disable CS1591
+using System.Text.RegularExpressions;
+using Compression.Registry;
+
+namespace Compression.Tests.Operations;
+
+[TestFixture]
+public sealed class CapabilityDocumentationTests {
+  [Test, Category("HappyPath")]
+  public void OperationCoverageFilesystemMatrixMatchesLiveRegistry() {
+    Compression.Lib.FormatRegistration.EnsureInitialized();
+    var document = File.ReadAllText(FindRepositoryFile("docs", "OPERATION_COVERAGE.md"));
+    var section = Slice(document, "## Filesystem descriptors", "## N/A notes");
+    var documented = ParseFilesystemMatrix(section);
+    var problems = new List<string>();
+
+    foreach (var id in FormatRegistry.FilesystemFormatIds) {
+      var descriptor = FormatRegistry.GetById(id)!;
+      var ops = FormatRegistry.GetArchiveOps(id);
+      var expected = ExpectedRow(descriptor, ops);
+      if (!documented.Remove(id, out var actual)) {
+        problems.Add($"missing row: {RenderRow(id, expected)}");
+        continue;
+      }
+
+      foreach (var column in expected.Keys)
+        if (!actual.TryGetValue(column, out var value) || value != expected[column])
+          problems.Add($"{id}.{column}: documented={Render(actual.GetValueOrDefault(column))}, live={Render(expected[column])}; expected row: {RenderRow(id, expected)}");
+    }
+
+    foreach (var unexpected in documented.Keys.OrderBy(x => x, StringComparer.OrdinalIgnoreCase))
+      problems.Add($"unexpected filesystem row not present in live registry: {unexpected}");
+
+    Assert.That(problems, Is.Empty,
+      "docs/OPERATION_COVERAGE.md filesystem matrix is stale. Regenerate/update it from the live registry:\n" +
+      string.Join("\n", problems));
+  }
+
+  [Test, Category("HappyPath")]
+  public void WormProseCannotNameDescriptorsThatAdvertiseCanModify() {
+    Compression.Lib.FormatRegistration.EnsureInitialized();
+    var document = File.ReadAllText(FindRepositoryFile("docs", "OPERATION_COVERAGE.md"));
+    var section = Slice(document, "### Stays WORM", "## Filesystem descriptors");
+    var boldNames = Regex.Matches(section, @"\*\*([^*]+)\*\*")
+      .SelectMany(m => m.Groups[1].Value.Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries))
+      .ToHashSet(StringComparer.OrdinalIgnoreCase);
+
+    var contradictions = FormatRegistry.All
+      .Where(d => d.Capabilities.HasFlag(FormatCapabilities.CanModify))
+      .Where(d => boldNames.Contains(d.Id) || boldNames.Contains(d.DisplayName))
+      .Select(d => $"{d.Id} ({d.DisplayName}) advertises CanModify but is listed under 'Stays WORM'.")
+      .OrderBy(x => x, StringComparer.Ordinal)
+      .ToArray();
+
+    Assert.That(contradictions, Is.Empty,
+      "Write-capability prose contradicts executable descriptor state:\n" + string.Join("\n", contradictions));
+  }
+
+  private static Dictionary<string, bool> ExpectedRow(IFormatDescriptor descriptor, IArchiveFormatOperations? ops) {
+    var defrag = ops is IArchiveDefragmentable;
+    var shrink = ops is IArchiveShrinkable;
+    var purge = ops is IArchivePurgeable;
+    var wipe = ops is IWipeEmpty or IFilesystemExtentMap or IArchiveLayoutMap;
+    var optimize = ops is ILayoutOptimizable || descriptor.Capabilities.HasFlag(FormatCapabilities.SupportsOptimize);
+    return new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase) {
+      ["Compact"] = defrag || shrink || optimize,
+      ["Defrag"] = defrag,
+      ["Shrink"] = shrink,
+      ["Purge"] = purge,
+      ["Wipe"] = wipe,
+      ["Optimize"] = optimize,
+    };
+  }
+
+  private static Dictionary<string, Dictionary<string, bool>> ParseFilesystemMatrix(string section) {
+    var lines = section.Replace("\r\n", "\n", StringComparison.Ordinal).Split('\n');
+    var headerIndex = Array.FindIndex(lines, line => line.TrimStart().StartsWith("| Format |", StringComparison.Ordinal));
+    Assert.That(headerIndex, Is.GreaterThanOrEqualTo(0), "Filesystem capability table header is missing.");
+    var columns = SplitRow(lines[headerIndex]);
+    var result = new Dictionary<string, Dictionary<string, bool>>(StringComparer.OrdinalIgnoreCase);
+    for (var i = headerIndex + 2; i < lines.Length; ++i) {
+      if (!lines[i].TrimStart().StartsWith('|')) break;
+      var cells = SplitRow(lines[i]);
+      if (cells.Count != columns.Count || cells.Count == 0) continue;
+      var id = cells[0];
+      if (string.IsNullOrWhiteSpace(id)) continue;
+      var row = new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
+      for (var c = 1; c < cells.Count; ++c)
+        row[columns[c]] = ParseMarker(cells[c]);
+      result[id] = row;
+    }
+    return result;
+  }
+
+  private static List<string> SplitRow(string line)
+    => line.Trim().Trim('|').Split('|').Select(cell => cell.Trim()).ToList();
+
+  private static bool ParseMarker(string marker)
+    => marker switch {
+      "Y" or "Yes" or "✅" => true,
+      "·" or "—" or "-" or "" => false,
+      _ => throw new InvalidDataException($"Unknown capability marker '{marker}'."),
+    };
+
+  private static string Render(bool value) => value ? "Y" : "·";
+
+  private static string RenderRow(string id, IReadOnlyDictionary<string, bool> row)
+    => $"| {id} | {Render(row["Compact"])} | {Render(row["Defrag"])} | {Render(row["Shrink"])} | {Render(row["Purge"])} | {Render(row["Wipe"])} | {Render(row["Optimize"])} |";
+
+  private static string Slice(string text, string startHeading, string endHeading) {
+    var start = text.IndexOf(startHeading, StringComparison.Ordinal);
+    Assert.That(start, Is.GreaterThanOrEqualTo(0), $"Missing heading '{startHeading}'.");
+    var end = text.IndexOf(endHeading, start + startHeading.Length, StringComparison.Ordinal);
+    Assert.That(end, Is.GreaterThan(start), $"Missing heading '{endHeading}' after '{startHeading}'.");
+    return text[start..end];
+  }
+
+  private static string FindRepositoryFile(params string[] relativeParts) {
+    for (var current = new DirectoryInfo(AppContext.BaseDirectory); current != null; current = current.Parent) {
+      var path = relativeParts.Aggregate(current.FullName, Path.Combine);
+      if (File.Exists(path)) return path;
+    }
+    throw new FileNotFoundException($"Could not locate repository file '{Path.Combine(relativeParts)}' from '{AppContext.BaseDirectory}'.");
+  }
+}
diff --git a/Compression.Tests/Operations/FilesystemDriverCoverageTests.cs b/Compression.Tests/Operations/FilesystemDriverCoverageTests.cs
new file mode 100644
index 000000000..309c56fc8
--- /dev/null
+++ b/Compression.Tests/Operations/FilesystemDriverCoverageTests.cs
@@ -0,0 +1,60 @@
+using Compression.Lib;
+using Compression.Registry;
+
+namespace Compression.Tests.Operations;
+
+[TestFixture]
+public sealed class FilesystemDriverCoverageTests {
+  [OneTimeSetUp]
+  public void Init() => FormatRegistration.EnsureInitialized();
+
+  [Test]
+  public void EveryFileSystemProjectHasACommonDriverPath() {
+    var coverage = FormatRegistry.GetFilesystemDriverCoverage();
+
+    Assert.That(coverage, Is.Not.Empty,
+      "Source generation did not mark any FileSystem.* descriptors.");
+
+    var missing = coverage
+      .Where(item => !item.HasDriverPath)
+      .Select(item => item.FormatId)
+      .OrderBy(id => id, StringComparer.OrdinalIgnoreCase)
+      .ToArray();
+
+    Assert.That(missing, Is.Empty,
+      "Every FileSystem.* descriptor must expose a native provider/sidecar or the safe read-only archive projection.");
+  }
+
+  [Test]
+  public void FilesystemCoverageIdsResolveToDescriptors() {
+    foreach (var id in FormatRegistry.FilesystemFormatIds) {
+      var descriptor = FormatRegistry.GetById(id);
+      Assert.That(descriptor, Is.Not.Null, $"Filesystem id '{id}' has no descriptor.");
+      Assert.That(FormatRegistry.GetFilesystemDriverCoverage(id).FormatId,
+        Is.EqualTo(descriptor!.Id).IgnoreCase);
+    }
+  }
+
+  [Test]
+  public void NativeSidecarsAreVisibleInCoverage() {
+    var coverage = FormatRegistry.GetFilesystemDriverCoverage()
+      .ToDictionary(item => item.FormatId, StringComparer.OrdinalIgnoreCase);
+
+    foreach (var id in FormatRegistry.FilesystemFormatIds) {
+      var sidecar = FormatRegistry.GetFilesystemDriver(id);
+      if (sidecar == null) continue;
+      Assert.That(coverage[id].Binding, Is.EqualTo(FilesystemDriverBindingKind.SidecarNative),
+        $"Generated sidecar for '{id}' is not the selected common-driver binding.");
+      Assert.That(coverage[id].HasNativeReadinessProvider, Is.True);
+    }
+  }
+
+  [Test]
+  public void ArchiveModifyNeverCountsAsMountedWriteByItself() {
+    foreach (var item in FormatRegistry.GetFilesystemDriverCoverage()) {
+      if (!item.HasArchiveMutation || item.IsNative) continue;
+      Assert.That(item.Binding, Is.EqualTo(FilesystemDriverBindingKind.ArchiveProjection),
+        $"'{item.FormatId}' only has archive mutation; it must remain a read-only mounted projection until a native provider exists.");
+    }
+  }
+}
diff --git a/Compression.Tests/Operations/FilesystemRwPromotionRoundTripTests.cs b/Compression.Tests/Operations/FilesystemRwPromotionRoundTripTests.cs
new file mode 100644
index 000000000..54e92283f
--- /dev/null
+++ b/Compression.Tests/Operations/FilesystemRwPromotionRoundTripTests.cs
@@ -0,0 +1,149 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+
+namespace Compression.Tests.Operations;
+
+[TestFixture]
+public sealed class FilesystemRwPromotionRoundTripTests {
+  [TestCase("CramFs")]
+  [TestCase("SquashFs")]
+  [TestCase("Erofs")]
+  [TestCase("Msa")]
+  [TestCase("Pfs0")]
+  [Category("HappyPath"), Category("RoundTrip")]
+  public void CreateAddRemove_PromotedFormatsKeepSurvivorsByteExact(string formatId) {
+    Compression.Lib.FormatRegistration.EnsureInitialized();
+    var ops = FormatRegistry.GetArchiveOps(formatId);
+    Assert.That(ops, Is.Not.Null, formatId);
+    Assert.That(ops, Is.InstanceOf<IArchiveCreatable>(), formatId);
+    Assert.That(ops, Is.InstanceOf<IArchiveModifiable>(), formatId);
+
+    var descriptor = FormatRegistry.All.Single(d => d.Id == formatId);
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True, formatId);
+
+    var creator = (IArchiveCreatable)ops!;
+    var modifier = (IArchiveModifiable)ops!;
+    var archiveOps = (IArchiveFormatOperations)ops!;
+    var a = Enumerable.Range(0, 333).Select(i => (byte)(i * 7)).ToArray();
+    var b = Enumerable.Range(0, 517).Select(i => (byte)(i * 11)).ToArray();
+    var c = Enumerable.Range(0, 129).Select(i => (byte)(255 - i)).ToArray();
+
+    using var image = new MemoryStream();
+    creator.Create(image, [
+      ArchiveInputInfo.InMemory("A.TXT", a),
+      ArchiveInputInfo.InMemory("B.BIN", b),
+    ], new FormatCreateOptions());
+    Assert.That(image.Length, Is.GreaterThan(0), formatId);
+
+    image.Position = 0;
+    modifier.Add(image, [ArchiveInputInfo.InMemory("C.DAT", c)]);
+    Assert.That(ListNames(archiveOps, image), Does.Contain("C.DAT").IgnoreCase, formatId);
+
+    image.Position = 0;
+    modifier.Remove(image, ["B.BIN"]);
+    var names = ListNames(archiveOps, image);
+    Assert.Multiple(() => {
+      Assert.That(names.Any(n => Matches(n, "A.TXT")), Is.True, $"{formatId}: A.TXT disappeared");
+      Assert.That(names.Any(n => Matches(n, "B.BIN")), Is.False, $"{formatId}: B.BIN survived removal");
+      Assert.That(names.Any(n => Matches(n, "C.DAT")), Is.True, $"{formatId}: C.DAT disappeared");
+    });
+
+    var work = Path.Combine(Path.GetTempPath(), "cwb_rw_promote_" + Guid.NewGuid().ToString("N"));
+    Directory.CreateDirectory(work);
+    try {
+      image.Position = 0;
+      archiveOps.Extract(image, work, null, null);
+      Assert.That(FindExtracted(work, "A.TXT"), Is.EqualTo(a), $"{formatId}: A.TXT changed");
+      Assert.That(FindExtracted(work, "C.DAT"), Is.EqualTo(c), $"{formatId}: C.DAT changed");
+    } finally {
+      try { Directory.Delete(work, recursive: true); } catch { }
+    }
+  }
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Ewf_ReplaceAndClearSemanticMedia_RoundTrips() {
+    Compression.Lib.FormatRegistration.EnsureInitialized();
+    var ops = FormatRegistry.GetArchiveOps("Ewf")!;
+    var descriptor = FormatRegistry.All.Single(d => d.Id == "Ewf");
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+    Assert.That(ops, Is.InstanceOf<IArchiveCreatable>());
+    Assert.That(ops, Is.InstanceOf<IArchiveModifiable>());
+
+    var original = Enumerable.Range(0, 300_123).Select(i => (byte)(i * 13)).ToArray();
+    var replacement = Enumerable.Range(0, 130_777).Select(i => (byte)(i * 17)).ToArray();
+    using var image = new MemoryStream();
+    ((IArchiveCreatable)ops).Create(image,
+      [ArchiveInputInfo.InMemory("capture.raw", original)], new FormatCreateOptions());
+
+    Assert.That(ReadNamed((IArchiveFormatOperations)ops, image, "media.raw"), Is.EqualTo(original));
+
+    image.Position = 0;
+    ((IArchiveModifiable)ops).Add(image, [ArchiveInputInfo.InMemory("media.raw", replacement)]);
+    Assert.That(ReadNamed((IArchiveFormatOperations)ops, image, "media.raw"), Is.EqualTo(replacement));
+
+    image.Position = 0;
+    ((IArchiveModifiable)ops).Remove(image, ["media.raw"]);
+    var names = ListNames((IArchiveFormatOperations)ops, image);
+    Assert.That(names.Any(n => Matches(n, "media.raw")), Is.True,
+      "An empty EWF still represents a zero-length acquired medium.");
+    Assert.That(ReadNamed((IArchiveFormatOperations)ops, image, "media.raw"), Is.Empty);
+  }
+
+  [Test, Category("HappyPath")]
+  public void Refs_AdvertisesScopedOfflineMutationAndFailsClosedOnDiagnosticImage() {
+    Compression.Lib.FormatRegistration.EnsureInitialized();
+    var ops = FormatRegistry.GetArchiveOps("Refs")!;
+    var descriptor = FormatRegistry.All.Single(d => d.Id == "Refs");
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+    Assert.That(ops, Is.InstanceOf<IArchiveModifiable>());
+
+    // A header-only diagnostic image has no live namespace. The modifier must
+    // reject it before touching bytes rather than treating FULL.refs as content.
+    var imageBytes = BuildMinimalRefsHeader();
+    using var image = new MemoryStream(imageBytes, writable: true);
+    var before = image.ToArray();
+    Assert.Throws<InvalidDataException>(() =>
+      ((IArchiveModifiable)ops).Add(image, [ArchiveInputInfo.InMemory("A.TXT", [1, 2, 3])]));
+    Assert.That(image.ToArray(), Is.EqualTo(before));
+  }
+
+  private static List<string> ListNames(IArchiveFormatOperations ops, MemoryStream image) {
+    image.Position = 0;
+    return ops.List(image, null).Where(e => !e.IsDirectory).Select(e => e.Name).ToList();
+  }
+
+  private static byte[] ReadNamed(IArchiveFormatOperations ops, MemoryStream image, string name) {
+    var work = Path.Combine(Path.GetTempPath(), "cwb_rw_extract_" + Guid.NewGuid().ToString("N"));
+    Directory.CreateDirectory(work);
+    try {
+      image.Position = 0;
+      ops.Extract(image, work, null, [name]);
+      return FindExtracted(work, name);
+    } finally {
+      try { Directory.Delete(work, recursive: true); } catch { }
+    }
+  }
+
+  private static byte[] FindExtracted(string root, string name) {
+    var file = Directory.GetFiles(root, "*", SearchOption.AllDirectories)
+      .FirstOrDefault(f => Matches(Path.GetFileName(f), name));
+    Assert.That(file, Is.Not.Null, $"Expected extracted file {name}");
+    return File.ReadAllBytes(file!);
+  }
+
+  private static bool Matches(string actual, string expected)
+    => string.Equals(Path.GetFileName(actual.Replace('\\', '/')), expected, StringComparison.OrdinalIgnoreCase);
+
+  private static byte[] BuildMinimalRefsHeader() {
+    var image = new byte[4096];
+    System.Text.Encoding.ASCII.GetBytes("ReFS").CopyTo(image.AsSpan(3));
+    System.Text.Encoding.ASCII.GetBytes("FSRS").CopyTo(image.AsSpan(0x10));
+    System.Buffers.Binary.BinaryPrimitives.WriteUInt16LittleEndian(image.AsSpan(0x14, 2), 0x200);
+    System.Buffers.Binary.BinaryPrimitives.WriteUInt64LittleEndian(image.AsSpan(0x18, 8), 1024UL);
+    System.Buffers.Binary.BinaryPrimitives.WriteUInt32LittleEndian(image.AsSpan(0x20, 4), 512);
+    System.Buffers.Binary.BinaryPrimitives.WriteUInt32LittleEndian(image.AsSpan(0x24, 4), 8);
+    image[0x28] = 3;
+    image[0x29] = 14;
+    return image;
+  }
+}
\ No newline at end of file
diff --git a/Compression.Tests/Operations/RebuildProgressCancellationTests.cs b/Compression.Tests/Operations/RebuildProgressCancellationTests.cs
new file mode 100644
index 000000000..b557c0e31
--- /dev/null
+++ b/Compression.Tests/Operations/RebuildProgressCancellationTests.cs
@@ -0,0 +1,78 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+
+namespace Compression.Tests.Operations;
+
+[TestFixture]
+public sealed class RebuildProgressCancellationTests {
+  [Test]
+  public void RebuildInPlace_CancelDuringTargetWrite_LeavesOriginalUntouched() {
+    var original = Enumerable.Range(0, 4096).Select(i => (byte)(i * 31)).ToArray();
+    using var archive = new MemoryStream();
+    archive.Write(original);
+    archive.Position = 0;
+
+    var descriptor = new FakeDescriptor();
+    using var cts = new CancellationTokenSource();
+    var phases = new List<string>();
+
+    Assert.Throws<OperationCanceledException>(() =>
+      RebuildVerb.RebuildInPlace(archive, descriptor, descriptor,
+        onProgress: e => {
+          phases.Add(e.Phase);
+          if (e.Phase == "writing" && e.CurrentWriteOffset > 0)
+            cts.Cancel();
+        }, cancellationToken: cts.Token));
+
+    Assert.That(phases, Does.Contain("scanning"));
+    Assert.That(phases, Does.Contain("reading"));
+    Assert.That(phases, Does.Contain("writing"));
+    Assert.That(phases, Does.Not.Contain("committing"));
+    Assert.That(archive.ToArray(), Is.EqualTo(original),
+      "A cancelled staged rebuild must never overwrite the source stream.");
+  }
+
+  [Test]
+  public void RebuildInPlace_ReportsColoredTargetAndCommitPhases() {
+    using var archive = new MemoryStream();
+    archive.Write(new byte[4096]);
+    archive.Position = 0;
+    var descriptor = new FakeDescriptor();
+    var events = new List<DefragProgressEvent>();
+
+    RebuildVerb.RebuildInPlace(archive, descriptor, descriptor, onProgress: events.Add);
+
+    Assert.That(events.Select(e => e.Phase), Does.Contain("writing"));
+    Assert.That(events.Select(e => e.Phase), Does.Contain("verifying"));
+    Assert.That(events.Select(e => e.Phase), Does.Contain("staged"));
+    Assert.That(events.Select(e => e.Phase), Does.Contain("committing"));
+    Assert.That(events.Select(e => e.Phase), Does.Contain("complete"));
+
+    var targetMap = events.First(e => e.Phase == "writing").BlockMap;
+    Assert.That(targetMap, Is.Not.Null.And.Not.Empty);
+    Assert.That(targetMap!.Any(b => b.Kind == DefragBlockKind.Used && b.Classification.HasValue), Is.True,
+      "Staged archive rebuilds should keep a colored block map visible while writing.");
+  }
+
+  private sealed class FakeDescriptor : IArchiveFormatOperations, IArchiveCreatable {
+    private static readonly byte[] Payload = Enumerable.Range(0, 256 * 1024)
+      .Select(i => (byte)(i * 17)).ToArray();
+
+    public List<ArchiveEntryInfo> List(Stream stream, string? password)
+      => [new ArchiveEntryInfo(0, "payload.bin", Payload.Length, Payload.Length,
+        "deflate", false, false, null)];
+
+    public void Extract(Stream stream, string outputDir, string? password, string[]? files)
+      => File.WriteAllBytes(Path.Combine(outputDir, "payload.bin"), Payload);
+
+    public Stream OpenEntry(Stream archive, string entryName, string? password)
+      => new MemoryStream(Payload, writable: false);
+
+    public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
+      var data = inputs.Single(i => !i.IsDirectory).ReadContent();
+      const int ChunkSize = 16 * 1024;
+      for (var offset = 0; offset < data.Length; offset += ChunkSize)
+        output.Write(data, offset, Math.Min(ChunkSize, data.Length - offset));
+    }
+  }
+}
diff --git a/Compression.Tests/Operations/WriteCapabilityHonestyTests.cs b/Compression.Tests/Operations/WriteCapabilityHonestyTests.cs
index f76aac18b..fff90c079 100644
--- a/Compression.Tests/Operations/WriteCapabilityHonestyTests.cs
+++ b/Compression.Tests/Operations/WriteCapabilityHonestyTests.cs
@@ -7,22 +7,18 @@ namespace Compression.Tests.Operations;
 /// Honesty guard for the WORM-vs-R/W capability claim. The write scale
 /// (Unsupported → Read-Only → WORM → R/W) is only meaningful if
 /// <see cref="FormatCapabilities.CanModify"/> is reserved for formats that genuinely
-/// support modifying an <em>existing</em> container.
+/// support modifying an <em>existing</em> container/image.
 /// <para>
 /// <b>R/W means a working add / replace / remove on an existing instance that yields a
-/// valid result.</b> The edit may be byte-preserving in place <em>or</em> may relayout /
-/// re-pack the container (moving existing data) — both are honest R/W for a conceptually
-/// read-write format. What is NOT honest is advertising <see cref="FormatCapabilities.CanModify"/>
-/// with no working modify path at all. Read-only-by-design formats (CramFS, SquashFS) and
-/// create-only formats stay WORM (<see cref="FormatCapabilities.CanCreate"/>) even though a
-/// rebuild could synthesise a modified copy — they do not advertise R/W.
+/// valid result.</b> The edit may be byte-preserving in place, append replacement state,
+/// relayout members, or rebuild the image. Those are implementation choices. What is not
+/// honest is advertising <see cref="FormatCapabilities.CanModify"/> with no working edit path.
+/// A format that can only create a fresh instance remains WORM.
 /// </para>
 /// <para>
-/// This test enforces the deterministic half of that rule for every registered format that
-/// claims <see cref="FormatCapabilities.CanModify"/>: its runtime ops object must actually
-/// implement <see cref="IArchiveModifiable"/> (otherwise the R/W claim is entirely unbacked —
-/// there is no modify path). That the modify <em>works</em> (round-trips) is verified
-/// separately by the registry-driven <c>Generic{Purge,Defrag}RoundTripTests</c>.
+/// This test enforces the deterministic half of that rule for every registered claimant:
+/// its runtime ops object must implement <see cref="IArchiveModifiable"/>. Behavioural
+/// round-trip tests verify that individual modify paths actually work.
 /// </para>
 /// </summary>
 [TestFixture]
@@ -42,7 +38,7 @@ public void EveryCanModifyClaimIsBackedByAModifyPath(string formatId) {
 
     Assert.That(ops, Is.InstanceOf<IArchiveModifiable>(),
       $"{formatId} advertises R/W (CanModify) but its ops does not implement IArchiveModifiable — "
-      + "the claim is unbacked. Implement IArchiveModifiable (in-place or relayout/rebuild) "
+      + "the claim is unbacked. Implement a working existing-instance edit path "
       + "or downgrade to WORM (CanCreate only).");
   }
-}
+}
\ No newline at end of file
diff --git a/Compression.Tests/OrangeFs/OrangeFsWriteTests.cs b/Compression.Tests/OrangeFs/OrangeFsWriteTests.cs
new file mode 100644
index 000000000..42cdfcb26
--- /dev/null
+++ b/Compression.Tests/OrangeFs/OrangeFsWriteTests.cs
@@ -0,0 +1,46 @@
+using Compression.Registry;
+using FileSystem.OrangeFs;
+
+namespace Compression.Tests.OrangeFs;
+
+[TestFixture]
+public sealed class OrangeFsWriteTests {
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void CreateReplaceRemove_RoundTripsObjectPayloadAndPreservesHeaderIdentity() {
+    var descriptor = new OrangeFsFormatDescriptor();
+    var first = Enumerable.Range(0, 97).Select(i => (byte)(i * 3)).ToArray();
+    var replacement = Enumerable.Range(0, 513).Select(i => (byte)(i * 7)).ToArray();
+    using var image = new MemoryStream();
+
+    ((IArchiveCreatable)descriptor).Create(image,
+      [ArchiveInputInfo.InMemory("object.bin", first)], new FormatCreateOptions());
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+
+    var before = image.ToArray()[..12];
+    AssertPayload(image, first);
+
+    image.Position = 0;
+    ((IArchiveModifiable)descriptor).Add(image,
+      [ArchiveInputInfo.InMemory("object.bin", replacement)]);
+    Assert.That(image.ToArray()[..12], Is.EqualTo(before));
+    AssertPayload(image, replacement);
+
+    image.Position = 0;
+    ((IArchiveModifiable)descriptor).Remove(image, ["object.bin"]);
+    Assert.That(image.Length, Is.EqualTo(16));
+    AssertPayload(image, []);
+  }
+
+  private static void AssertPayload(MemoryStream image, byte[] expected) {
+    image.Position = 0;
+    using var reader = new OrangeFsReader(image);
+    var objectEntry = reader.Entries.FirstOrDefault(e => e.Name == "object.bin");
+    if (expected.Length == 0) {
+      Assert.That(objectEntry, Is.Null);
+      Assert.That(reader.ObjectSize, Is.Zero);
+      return;
+    }
+    Assert.That(objectEntry, Is.Not.Null);
+    Assert.That(reader.Extract(objectEntry!), Is.EqualTo(expected));
+  }
+}
diff --git a/Compression.Tests/UefiFv/UefiFvWriteTests.cs b/Compression.Tests/UefiFv/UefiFvWriteTests.cs
new file mode 100644
index 000000000..64f6dd99d
--- /dev/null
+++ b/Compression.Tests/UefiFv/UefiFvWriteTests.cs
@@ -0,0 +1,75 @@
+using System.Buffers.Binary;
+using Compression.Registry;
+using FileFormat.UefiFv;
+
+namespace Compression.Tests.UefiFv;
+
+[TestFixture]
+public sealed class UefiFvWriteTests {
+  private const string DriverName = "11223344-5566-7788-99aa-bbccddeeff00_DRIVER.bin";
+  private const string RawName = "01234567-89ab-cdef-0123-456789abcdef_RAW.bin";
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Descriptor_Create_ProducesChecksummedFixedCapacityFv() {
+    var payload = Enumerable.Range(0, 333).Select(i => (byte)(i * 13)).ToArray();
+    var descriptor = new UefiFvFormatDescriptor();
+    using var image = new MemoryStream();
+
+    ((IArchiveCreatable)descriptor).Create(image,
+      [ArchiveInputInfo.InMemory(DriverName, payload)], new FormatCreateOptions());
+
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanCreate), Is.True);
+    Assert.That(descriptor.Capabilities.HasFlag(FormatCapabilities.CanModify), Is.True);
+    Assert.That(image.Length, Is.GreaterThan(payload.Length + 64 * 1024));
+
+    var bytes = image.ToArray();
+    var fv = UefiFvReader.Read(bytes);
+    Assert.That(fv.Files, Has.Count.EqualTo(1));
+    Assert.That(fv.Files[0].Contents, Is.EqualTo(payload));
+
+    uint sum = 0;
+    for (var i = 0; i < fv.Header.HeaderLength; i += 2)
+      sum += BinaryPrimitives.ReadUInt16LittleEndian(bytes.AsSpan(i, 2));
+    Assert.That((ushort)sum, Is.Zero, "FV header checksum must sum to zero");
+  }
+
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void Descriptor_AddReplaceRemove_ReusesErasedSpaceWithoutGrowingVolume() {
+    var descriptor = new UefiFvFormatDescriptor();
+    var first = Enumerable.Range(0, 257).Select(i => (byte)i).ToArray();
+    var second = Enumerable.Range(0, 721).Select(i => (byte)(i * 5)).ToArray();
+    var replacement = Enumerable.Range(0, 1023).Select(i => (byte)(255 - i)).ToArray();
+
+    using var image = new MemoryStream();
+    ((IArchiveCreatable)descriptor).Create(image,
+      [ArchiveInputInfo.InMemory(DriverName, first)], new FormatCreateOptions());
+    var originalLength = image.Length;
+
+    var modifier = (IArchiveModifiable)descriptor;
+    image.Position = 0;
+    modifier.Add(image, [ArchiveInputInfo.InMemory(RawName, second)]);
+    Assert.That(image.Length, Is.EqualTo(originalLength));
+    AssertFiles(image, (DriverName, first), (RawName, second));
+
+    image.Position = 0;
+    modifier.Add(image, [ArchiveInputInfo.InMemory(DriverName, replacement)]);
+    Assert.That(image.Length, Is.EqualTo(originalLength));
+    AssertFiles(image, (DriverName, replacement), (RawName, second));
+
+    image.Position = 0;
+    modifier.Remove(image, [RawName]);
+    Assert.That(image.Length, Is.EqualTo(originalLength));
+    AssertFiles(image, (DriverName, replacement));
+  }
+
+  private static void AssertFiles(MemoryStream image, params (string Name, byte[] Data)[] expected) {
+    var bytes = image.ToArray();
+    var fv = UefiFvReader.Read(bytes);
+    var actual = fv.Files.Where(f => f.Type != 0xF0)
+      .ToDictionary(f => $"{f.Name:D}_{UefiFvReader.ShortTypeTag(f.Type)}.bin", f => f.Contents,
+        StringComparer.OrdinalIgnoreCase);
+    Assert.That(actual.Keys, Is.EquivalentTo(expected.Select(e => e.Name)));
+    foreach (var (name, data) in expected)
+      Assert.That(actual[name], Is.EqualTo(data), name);
+  }
+}
diff --git a/Compression.Tests/Zfs/ZfsFilesystemDriverTests.cs b/Compression.Tests/Zfs/ZfsFilesystemDriverTests.cs
new file mode 100644
index 000000000..1ed974b51
--- /dev/null
+++ b/Compression.Tests/Zfs/ZfsFilesystemDriverTests.cs
@@ -0,0 +1,80 @@
+using System.Buffers.Binary;
+using Compression.Registry;
+using FileSystem.Zfs;
+
+namespace Compression.Tests.Zfs;
+
+[TestFixture]
+public sealed class ZfsFilesystemDriverTests {
+  [Test, Category("HappyPath"), Category("RoundTrip")]
+  public void NativeSession_UsesDnodeIdentityAndSupportsPositionalReads() {
+    var payload = new byte[48 * 1024 + 137];
+    for (var i = 0; i < payload.Length; i++) payload[i] = (byte)((i * 29 + 7) & 0xFF);
+
+    var writer = new ZfsWriter();
+    writer.AddFile("dir/data.bin", payload);
+    using var image = new MemoryStream();
+    writer.WriteTo(image, 8L * 1024 * 1024);
+
+    var adapter = new ZfsFilesystemDriverAdapter();
+    image.Position = 0;
+    var profile = adapter.ProbeFilesystem(image);
+    Assert.That(profile.CanMount, Is.True, string.Join("; ", profile.Limitations));
+    Assert.That(profile.CanMountWritable, Is.False);
+    Assert.That(profile.Capabilities.HasFlag(FilesystemDriverCapabilities.StableNodeIds), Is.True);
+    Assert.That(profile.Capabilities.HasFlag(FilesystemDriverCapabilities.RandomAccess), Is.True);
+
+    image.Position = 0;
+    using var session = adapter.OpenFilesystem(image, new FilesystemOpenOptions(ReadOnly: true, LeaveOpen: true));
+    var dirId = session.Lookup(session.RootNodeId, "dir");
+    Assert.That(dirId, Is.Not.Null);
+    var fileId = session.Lookup(dirId!.Value, "data.bin");
+    Assert.That(fileId, Is.Not.Null);
+    Assert.That(fileId!.Value.Value, Is.GreaterThan(0UL), "regular-file node must carry the native dataset dnode object id");
+
+    using var handle = session.OpenFile(fileId.Value, FileAccess.Read);
+    Assert.That(handle.Length, Is.EqualTo(payload.Length));
+    var slice = new byte[733];
+    var read = handle.Read(12_345, slice);
+    Assert.That(read, Is.EqualTo(slice.Length));
+    Assert.That(slice, Is.EqualTo(payload.AsSpan(12_345, slice.Length).ToArray()));
+  }
+
+  [Test, Category("ErrorHandling")]
+  public void Probe_RejectsUnsupportedPoolVersion() {
+    var writer = new ZfsWriter();
+    writer.AddFile("a.bin", "abc"u8.ToArray());
+    using var built = new MemoryStream();
+    writer.WriteTo(built, 8L * 1024 * 1024);
+    var bytes = built.ToArray();
+
+    var changed = 0;
+    for (var slot = ZfsConstants.UberblockArrayOffset;
+         slot + ZfsConstants.UberblockSize <= ZfsConstants.LabelSize;
+         slot += ZfsConstants.UberblockSize) {
+      if (BinaryPrimitives.ReadUInt64LittleEndian(bytes.AsSpan(slot, 8)) != ZfsConstants.UberblockMagic)
+        continue;
+      BinaryPrimitives.WriteUInt64LittleEndian(bytes.AsSpan(slot + 8, 8), ZfsConstants.PoolVersion + 1);
+      changed++;
+    }
+    Assert.That(changed, Is.GreaterThan(0), "writer must emit at least one valid L0 uberblock");
+
+    using var image = new MemoryStream(bytes, writable: false);
+    var profile = new ZfsFilesystemDriverAdapter().ProbeFilesystem(image);
+    Assert.That(profile.CanMount, Is.False);
+    Assert.That(string.Join("; ", profile.Limitations), Does.Contain("pool version"));
+  }
+
+  [Test, Category("ErrorHandling")]
+  public void NativeSession_RefusesWritableMount() {
+    var writer = new ZfsWriter();
+    writer.AddFile("a.bin", "abc"u8.ToArray());
+    using var image = new MemoryStream();
+    writer.WriteTo(image, 8L * 1024 * 1024);
+
+    var adapter = new ZfsFilesystemDriverAdapter();
+    image.Position = 0;
+    Assert.Throws<NotSupportedException>(() =>
+      adapter.OpenFilesystem(image, new FilesystemOpenOptions(ReadOnly: false, LeaveOpen: true)));
+  }
+}
diff --git a/Compression.UI/App.xaml.cs b/Compression.UI/App.xaml.cs
index 8b09005d1..477fd11da 100644
--- a/Compression.UI/App.xaml.cs
+++ b/Compression.UI/App.xaml.cs
@@ -13,6 +13,12 @@ protected override void OnStartup(System.Windows.StartupEventArgs e) {
     if (System.Environment.GetEnvironmentVariable("COMPRESSIONWORKBENCH_WINE") == "1")
       System.Windows.Media.RenderOptions.ProcessRenderMode = System.Windows.Interop.RenderMode.SoftwareOnly;
 
+    // Documentation CI asks the real application to render its own visual tree.
+    // Handle that before background registry warm-up and normal startup so the
+    // captures are deterministic and never depend on desktop automation.
+    if (ScreenshotMode.TryRun(this, e.Args))
+      return;
+
     // Warm the format registry on a background thread so the first user-driven
     // CanExecute / right-click that calls FormatDetector.DetectByExtension or
     // FormatRegistry.GetArchiveOps doesn't pay the ~180-descriptor registration
@@ -173,4 +179,4 @@ private void HandleExtractArchive(string archivePath) {
 
     Shutdown();
   }
-}
+}
\ No newline at end of file
diff --git a/Compression.UI/Compression.UI.csproj b/Compression.UI/Compression.UI.csproj
index cd161d555..60e6d7426 100644
--- a/Compression.UI/Compression.UI.csproj
+++ b/Compression.UI/Compression.UI.csproj
@@ -31,6 +31,7 @@
   <ItemGroup>
     <ProjectReference Include="..\Compression.Lib\Compression.Lib.csproj" />
     <ProjectReference Include="..\Compression.Analysis\Compression.Analysis.csproj" />
+    <ProjectReference Include="..\Compression.Mounting\Compression.Mounting.csproj" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/Compression.UI/ScreenshotMode.cs b/Compression.UI/ScreenshotMode.cs
new file mode 100644
index 000000000..105911110
--- /dev/null
+++ b/Compression.UI/ScreenshotMode.cs
@@ -0,0 +1,154 @@
+using System.IO;
+using System.Windows;
+using System.Windows.Media;
+using System.Windows.Media.Imaging;
+using System.Windows.Threading;
+using Compression.Lib;
+
+namespace Compression.UI;
+
+/// <summary>
+/// Deterministic, interaction-free screenshot generation for documentation CI.
+/// The application renders its own WPF visual tree instead of relying on desktop
+/// automation, so captures do not depend on focus, monitor geometry, or runner timing.
+/// </summary>
+internal static class ScreenshotMode {
+  private const double CaptureWidth = 1200;
+  private const double CaptureHeight = 760;
+
+  public static bool TryRun(Application application, string[] args) {
+    if (args.Length == 0 || !string.Equals(args[0], "--screenshots", StringComparison.OrdinalIgnoreCase))
+      return false;
+
+    application.ShutdownMode = ShutdownMode.OnExplicitShutdown;
+    var outputDirectory = Path.GetFullPath(
+      args.Length > 1 ? args[1] : Path.Combine("docs", "screenshots"));
+
+    try {
+      Directory.CreateDirectory(outputDirectory);
+      Console.WriteLine($"Screenshot output: {outputDirectory}");
+
+      var fixtureRoot = Path.Combine(Path.GetTempPath(), "CompressionWorkbench-Screenshots");
+      RecreateDirectory(fixtureRoot);
+
+      try {
+        Console.WriteLine("Creating deterministic archive fixture...");
+        var archivePath = CreateArchiveFixture(fixtureRoot);
+
+        Console.WriteLine("Capturing archive browser...");
+        var mainWindow = new MainWindow {
+          Width = CaptureWidth,
+          Height = CaptureHeight,
+        };
+        mainWindow.OpenArchive(archivePath);
+        Capture(mainWindow, Path.Combine(outputDirectory, "archive-browser.png"));
+
+        Console.WriteLine("Capturing analysis window...");
+        Capture(new Views.AnalysisWindow {
+          Width = CaptureWidth,
+          Height = CaptureHeight,
+        }, Path.Combine(outputDirectory, "analysis.png"));
+
+        Console.WriteLine("Capturing maintenance window...");
+        Capture(new Views.DefragmentWindow {
+          Width = CaptureWidth,
+          Height = CaptureHeight,
+        }, Path.Combine(outputDirectory, "maintenance.png"));
+      }
+      finally {
+        try { Directory.Delete(fixtureRoot, recursive: true); }
+        catch { /* CI fixture cleanup is best-effort. */ }
+      }
+
+      Console.WriteLine("Screenshot generation completed successfully.");
+      application.Shutdown(0);
+    }
+    catch (Exception ex) {
+      var diagnostic = $"Screenshot generation failed:{Environment.NewLine}{ex}";
+      Console.Error.WriteLine(diagnostic);
+      System.Diagnostics.Trace.WriteLine(diagnostic);
+      try {
+        Directory.CreateDirectory(outputDirectory);
+        File.WriteAllText(Path.Combine(outputDirectory, "screenshot-error.txt"), diagnostic);
+      }
+      catch { /* The original exception is the useful failure. */ }
+      application.Shutdown(1);
+    }
+
+    return true;
+  }
+
+  private static string CreateArchiveFixture(string fixtureRoot) {
+    var inputRoot = Path.Combine(fixtureRoot, "CompressionWorkbench-demo");
+    var docs = Path.Combine(inputRoot, "docs");
+    var source = Path.Combine(inputRoot, "src");
+    Directory.CreateDirectory(docs);
+    Directory.CreateDirectory(source);
+
+    var readme = Path.Combine(inputRoot, "README.txt");
+    var vision = Path.Combine(docs, "vision.txt");
+    var codec = Path.Combine(source, "Codec.cs");
+    var payloadPath = Path.Combine(inputRoot, "payload.bin");
+
+    File.WriteAllText(readme,
+      "CompressionWorkbench demo archive\n\nEvery payload is generated locally by screenshot CI.\n");
+    File.WriteAllText(vision,
+      "One tool for codecs, archives, pseudo-archives, filesystems, analysis and maintenance.\n");
+    File.WriteAllText(codec,
+      "namespace Demo;\n\ninternal static class Codec { public const string Method = \"Deflate\"; }\n");
+
+    var payload = new byte[4096];
+    for (var i = 0; i < payload.Length; i++)
+      payload[i] = (byte)((i * 37 + i / 7) & 0xff);
+    File.WriteAllBytes(payloadPath, payload);
+
+    // Archive listings include modification timestamps. Pin them so repeated CI
+    // captures are byte-stable when the UI itself has not changed.
+    var timestamp = new DateTime(2024, 1, 2, 12, 34, 56, DateTimeKind.Utc);
+    foreach (var path in new[] { readme, vision, codec, payloadPath })
+      File.SetLastWriteTimeUtc(path, timestamp);
+
+    var archivePath = Path.Combine(fixtureRoot, "CompressionWorkbench-demo.zip");
+    var inputs = ArchiveInput.Resolve([inputRoot]);
+    ArchiveOperations.Create(archivePath, inputs, new CompressionOptions());
+    return archivePath;
+  }
+
+  private static void Capture(Window window, string outputPath) {
+    window.WindowStartupLocation = WindowStartupLocation.Manual;
+    window.Left = -10000;
+    window.Top = -10000;
+    window.ShowInTaskbar = false;
+    window.ShowActivated = false;
+    window.Show();
+
+    DrainDispatcher(window.Dispatcher);
+    window.UpdateLayout();
+
+    var width = Math.Max(1, (int)Math.Ceiling(window.ActualWidth));
+    var height = Math.Max(1, (int)Math.Ceiling(window.ActualHeight));
+    Console.WriteLine($"Rendering {Path.GetFileName(outputPath)} at {width}x{height}...");
+    var bitmap = new RenderTargetBitmap(width, height, 96, 96, PixelFormats.Pbgra32);
+    bitmap.Render(window);
+
+    var encoder = new PngBitmapEncoder();
+    encoder.Frames.Add(BitmapFrame.Create(bitmap));
+    using (var output = File.Create(outputPath))
+      encoder.Save(output);
+
+    window.Close();
+    DrainDispatcher(window.Dispatcher);
+  }
+
+  private static void DrainDispatcher(Dispatcher dispatcher) {
+    var frame = new DispatcherFrame();
+    dispatcher.BeginInvoke(DispatcherPriority.ApplicationIdle, new Action(() => frame.Continue = false));
+    Dispatcher.PushFrame(frame);
+  }
+
+  private static void RecreateDirectory(string path) {
+    if (Directory.Exists(path))
+      Directory.Delete(path, recursive: true);
+    Directory.CreateDirectory(path);
+  }
+}
diff --git a/Compression.UI/Views/DefragmentWindow.RebuildProgress.cs b/Compression.UI/Views/DefragmentWindow.RebuildProgress.cs
new file mode 100644
index 000000000..68bea5959
--- /dev/null
+++ b/Compression.UI/Views/DefragmentWindow.RebuildProgress.cs
@@ -0,0 +1,522 @@
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Windows;
+using System.Windows.Controls;
+using Button = System.Windows.Controls.Button;
+using Compression.Lib;
+using Compression.Registry;
+
+namespace Compression.UI.Views;
+
+/// <summary>
+/// Universal live block-map/cancellation layer for maintenance operations that
+/// rebuild or re-group a container instead of physically moving blocks in place.
+/// Kept as a partial so it can reuse the existing maintenance window controls and
+/// helpers without duplicating the large preview/rendering implementation.
+/// </summary>
+public partial class DefragmentWindow {
+  private bool _rebuildProgressHooked;
+  private Button? _maintenanceCancelButton;
+  private CancellationTokenSource? _maintenanceCancellation;
+  private bool _maintenanceIsStaged;
+  private bool _maintenanceCommitStarted;
+  private string? _maintenanceOperationName;
+
+  protected override void OnContentRendered(EventArgs e) {
+    base.OnContentRendered(e);
+    if (this._rebuildProgressHooked) return;
+    this._rebuildProgressHooked = true;
+
+    // Replace only the main Run dispatch. Shrink/Purge/Wipe/Compact keep their
+    // existing handlers; rebuild-backed Defrag/Optimize now share this richer UI.
+    RunBtn.Click -= OnRun;
+    RunBtn.Click += OnRunWithBlockProgress;
+    InsertMaintenanceCancelButton();
+
+    // The original loader sees IArchiveDefragmentable before archive-repack
+    // support. When the caller explicitly asked for Optimize, correct that
+    // ambiguity here so ZIP/7z can expose their repack UI instead of looking like
+    // filesystem-only defraggers.
+    if (this._requestedVerb == MaintenanceVerb.Optimize && this._formatId is { Length: > 0 } id) {
+      var descriptor = FormatRegistry.GetById(id);
+      var ops = FormatRegistry.GetArchiveOps(id);
+      if (descriptor?.Category is FormatCategory.Archive or FormatCategory.CompoundTar
+          && ops is IArchiveCreatable) {
+        this._isArchiveMode = true;
+        this._archiveOps = ops;
+        this._isSevenZipFormat = string.Equals(id, "SevenZip", StringComparison.Ordinal);
+        FsModesGroup.Visibility = Visibility.Collapsed;
+        ArchiveRepackGroup.Visibility = Visibility.Visible;
+        SmartSolidRepackCheck.Visibility = this._isSevenZipFormat ? Visibility.Visible : Visibility.Collapsed;
+        RunBtn.Content = "Optimize";
+        RunBtn.IsEnabled = true;
+        SupportLbl.Text = "Archive re-layout/repack with live staged-target visualization.";
+        SupportLbl.Foreground = System.Windows.Media.Brushes.DarkGreen;
+        if (LayoutStatusLbl != null)
+          LayoutStatusLbl.Text = "Source + staged-target address spaces share the chart for progress; offsets are projected, not physical equivalence.";
+      }
+    }
+  }
+
+  protected override void OnClosing(CancelEventArgs e) {
+    base.OnClosing(e);
+    if (e.Cancel || this._maintenanceCancellation == null) return;
+
+    e.Cancel = true;
+    RequestMaintenanceCancellation(confirmNativeInPlace: true);
+  }
+
+  private void InsertMaintenanceCancelButton() {
+    if (this._maintenanceCancelButton != null || RunBtn.Parent is not StackPanel panel)
+      return;
+
+    var close = panel.Children.OfType<Button>()
+      .FirstOrDefault(button => string.Equals(button.Content?.ToString(), "Close", StringComparison.Ordinal));
+    var index = close == null ? panel.Children.Count : panel.Children.IndexOf(close);
+    var cancel = new Button {
+      Content = "Cancel",
+      Width = 80,
+      Padding = new Thickness(4),
+      Margin = new Thickness(0, 0, 8, 0),
+      IsEnabled = false,
+      ToolTip = "Cancel the active maintenance pass. Staged rebuilds are discarded and leave the original unchanged; native in-place moves cancel at a safe boundary when supported.",
+    };
+    cancel.Click += (_, _) => RequestMaintenanceCancellation(confirmNativeInPlace: true);
+    panel.Children.Insert(index, cancel);
+    this._maintenanceCancelButton = cancel;
+  }
+
+  private CancellationToken BeginMaintenanceOperation(string name, bool staged) {
+    this._maintenanceCancellation?.Dispose();
+    this._maintenanceCancellation = new CancellationTokenSource();
+    this._maintenanceOperationName = name;
+    this._maintenanceIsStaged = staged;
+    this._maintenanceCommitStarted = false;
+
+    if (this._maintenanceCancelButton != null) this._maintenanceCancelButton.IsEnabled = true;
+    BrowseBtn.IsEnabled = false;
+    RunBtn.IsEnabled = false;
+    ShrinkBtn.IsEnabled = false;
+    WipeEmptyBtn.IsEnabled = false;
+    PurgeBtn.IsEnabled = false;
+    CompactBtn.IsEnabled = false;
+
+    if (staged && LayoutStatusLbl != null)
+      LayoutStatusLbl.Text = $"{name}: building a staged target — original remains unchanged until commit.";
+    return this._maintenanceCancellation.Token;
+  }
+
+  private void EndMaintenanceOperation() {
+    this._maintenanceCancellation?.Dispose();
+    this._maintenanceCancellation = null;
+    this._maintenanceOperationName = null;
+    this._maintenanceIsStaged = false;
+    this._maintenanceCommitStarted = false;
+    if (this._maintenanceCancelButton != null) this._maintenanceCancelButton.IsEnabled = false;
+    BrowseBtn.IsEnabled = true;
+
+    if (this._imagePath is { Length: > 0 } path && File.Exists(path))
+      LoadImage(path);
+  }
+
+  private void RequestMaintenanceCancellation(bool confirmNativeInPlace) {
+    var cts = this._maintenanceCancellation;
+    if (cts == null || cts.IsCancellationRequested) return;
+
+    if (this._maintenanceCommitStarted) {
+      Append("Cancellation ignored: verified target commit has started; completing it is safer than interrupting the only commit step.");
+      if (this._maintenanceCancelButton != null) this._maintenanceCancelButton.IsEnabled = false;
+      return;
+    }
+
+    if (!this._maintenanceIsStaged && confirmNativeInPlace) {
+      var result = MessageBox.Show(this,
+        $"Cancel {this._maintenanceOperationName ?? "maintenance"}?\n\n"
+        + "This operation is moving data in place. Moves already completed are not rolled back. "
+        + "Cancellation is best-effort at the next safe boundary, so the layout may be partially changed although the container should remain valid.",
+        "Cancel in-place maintenance", MessageBoxButton.YesNo, MessageBoxImage.Warning);
+      if (result != MessageBoxResult.Yes) return;
+      Append("Cancellation requested — already-completed in-place moves will remain moved.");
+    } else {
+      Append("Cancellation requested — staged target will be discarded; existing archive remains unchanged.");
+    }
+
+    if (this._maintenanceCancelButton != null) this._maintenanceCancelButton.IsEnabled = false;
+    cts.Cancel();
+  }
+
+  private void OnRunWithBlockProgress(object sender, RoutedEventArgs e) {
+    if (this._imagePath == null || this._maintenanceCancellation != null) return;
+
+    if (this._isFileInternalMode) {
+      OnRunFileInternalOptimize();
+      return;
+    }
+
+    var ops = this._formatId is { Length: > 0 } id
+      ? FormatRegistry.GetArchiveOps(id)
+      : this._archiveOps;
+    var descriptor = this._formatId is { Length: > 0 } formatId
+      ? FormatRegistry.GetById(formatId)
+      : null;
+    var explicitlyOptimizingArchive = this._requestedVerb == MaintenanceVerb.Optimize
+      && descriptor?.Category is FormatCategory.Archive or FormatCategory.CompoundTar
+      && ops is IArchiveCreatable;
+
+    if (this._isArchiveMode || explicitlyOptimizingArchive) {
+      RunArchiveOptimizeWithBlockProgress(ops);
+      return;
+    }
+
+    RunDefragWithBlockProgress();
+  }
+
+  private void RunDefragWithBlockProgress() {
+    if (this._imagePath == null || this._defragmentable == null) return;
+
+    var path = this._imagePath;
+    var defragmentable = this._defragmentable;
+    var mode = SelectedMode();
+    var holeSize = mode == DefragMode.CarveHole ? ParseSize(HoleSizeBox.Text) : 0L;
+    var holeAt = mode == DefragMode.CarveHole ? ParseHoleAt(HoleAtBox.Text) : -1L;
+    var interleaveStride = ParseInterleaveStride(InterleaveStrideBox.Text);
+    var metadataZone = SelectedMetadataZone();
+    var layoutProfile = this._selectedLayoutProfile;
+    var staged = UsesGenericStagedDefrag(defragmentable);
+    var cancellationToken = BeginMaintenanceOperation("Defragment / re-layout", staged);
+
+    Append($"=== {DateTime.Now:HH:mm:ss}  Defragmenting {Path.GetFileName(path)} ===");
+    Append($"Mode: {mode}");
+    if (staged)
+      Append("Strategy: verified staged rebuild; original is unchanged until commit.");
+
+    Progress.IsIndeterminate = false;
+    Progress.Value = 0;
+
+    Task.Run(() => {
+      var sw = Stopwatch.StartNew();
+      Exception? error = null;
+      var cancelled = false;
+      string? finalStatus = null;
+
+      void OnProgress(DefragProgressEvent ev) {
+        if (ev.Phase == "complete" && !string.IsNullOrWhiteSpace(ev.Status))
+          finalStatus = ev.Status;
+        Dispatcher.BeginInvoke(() => {
+          if (ev.Phase == "committing") {
+            this._maintenanceCommitStarted = true;
+            if (this._maintenanceCancelButton != null) this._maintenanceCancelButton.IsEnabled = false;
+          }
+          if (ev.BlockMap != null) {
+            BlockMap.BlockMap = ev.BlockMap;
+            BlockMap.ImageSize = ev.ImageSize;
+          } else if (ev.ImageSize > 0 && BlockMap.ImageSize <= 0) {
+            BlockMap.ImageSize = ev.ImageSize;
+          }
+          BlockMap.ReadHead = ev.CurrentReadOffset;
+          BlockMap.WriteHead = ev.CurrentWriteOffset;
+          if (ev.Fraction >= 0) Progress.Value = Math.Clamp(ev.Fraction, 0, 1) * 100;
+          if (!string.IsNullOrWhiteSpace(ev.Status) && LayoutStatusLbl != null)
+            LayoutStatusLbl.Text = ev.Status;
+        });
+      }
+
+      try {
+        using var stream = File.Open(path, FileMode.Open, FileAccess.ReadWrite);
+        defragmentable.Defragment(stream, new DefragOptions {
+          Mode = mode,
+          HoleSize = holeSize,
+          HoleAt = holeAt,
+          InterleaveStride = interleaveStride,
+          MetadataZonePlacement = metadataZone,
+          LayoutTemplate = layoutProfile,
+          OnProgress = OnProgress,
+          CancellationToken = cancellationToken,
+        });
+      } catch (OperationCanceledException) {
+        cancelled = true;
+      } catch (Exception ex) {
+        error = ex;
+      }
+      sw.Stop();
+
+      Dispatcher.Invoke(() => {
+        BlockMap.ReadHead = -1;
+        BlockMap.WriteHead = -1;
+        Progress.Value = 100;
+        if (cancelled) {
+          Append(staged
+            ? $"CANCELLED ({sw.ElapsedMilliseconds} ms) — staged rebuild discarded; existing container unchanged."
+            : $"CANCELLED ({sw.ElapsedMilliseconds} ms) — completed native moves remain in place.");
+        } else if (error != null) {
+          Append($"FAILED ({sw.ElapsedMilliseconds} ms): {error.GetType().Name}: {error.Message}");
+        } else {
+          Append($"OK ({sw.ElapsedMilliseconds} ms)");
+          if (cancellationToken.IsCancellationRequested)
+            Append("Cancellation was requested, but the native operation completed before reaching a cancellable boundary.");
+          if (!string.IsNullOrWhiteSpace(finalStatus)) Append($"Status: {finalStatus}");
+          NotifyMutated(path);
+        }
+        Append("");
+        EndMaintenanceOperation();
+      });
+    });
+  }
+
+  private static bool UsesGenericStagedDefrag(IArchiveDefragmentable defragmentable) {
+    var type = defragmentable.GetType();
+    return type.GetMethod(nameof(IArchiveDefragmentable.Defragment), [typeof(Stream)]) == null
+      && type.GetMethod(nameof(IArchiveDefragmentable.Defragment), [typeof(Stream), typeof(DefragOptions)]) == null;
+  }
+
+  private void RunArchiveOptimizeWithBlockProgress(IArchiveFormatOperations? ops) {
+    if (this._imagePath == null || ops == null) return;
+    if (this._isSevenZipFormat && SmartSolidRepackCheck?.IsChecked == true) {
+      RunSmartSevenZipWithBlockProgress(ops);
+      return;
+    }
+
+    var path = this._imagePath;
+    var formatId = this._formatId;
+    if (formatId is "DoubleSpace" or "DriveSpace" or "DriveSpace3") {
+      // CVF has a dedicated per-cluster optimizer. Keep that implementation;
+      // its writer already chooses compress/store per cluster.
+      OnRunCvfOptimize(path, formatId);
+      return;
+    }
+
+    var originalSize = new FileInfo(path).Length;
+    var tempOut = path + ".opt.tmp";
+    AtomicFileWriter.TryDelete(tempOut);
+    var cancellationToken = BeginMaintenanceOperation("Archive optimize / repack", staged: true);
+    SetStagedArchiveMap(path, ops, originalSize);
+
+    Append($"=== {DateTime.Now:HH:mm:ss}  Optimizing {Path.GetFileName(path)} ===");
+    Append("Staged rebuild: green head = projected source consumption; orange head = staged-target bytes written.");
+    Progress.IsIndeterminate = false;
+    Progress.Value = 0;
+
+    Task.Run(() => {
+      var sw = Stopwatch.StartNew();
+      Exception? error = null;
+      var cancelled = false;
+      long newSize = originalSize;
+      var entriesOptimized = 0;
+
+      try {
+        var worker = Task.Run(() => ArchiveOperations.Optimize(path, tempOut, password: null));
+        while (!worker.Wait(100)) {
+          var stagedBytes = FindStagedOutputLength(tempOut);
+          var fraction = originalSize > 0
+            ? Math.Clamp((double)stagedBytes / originalSize, 0, 0.95)
+            : 0;
+          Dispatcher.BeginInvoke(() => {
+            Progress.Value = fraction * 100;
+            var displaySize = Math.Max(1L, BlockMap.ImageSize > 0 ? BlockMap.ImageSize : originalSize);
+            BlockMap.ReadHead = Math.Clamp((long)(fraction * displaySize), 0, displaySize - 1);
+            BlockMap.WriteHead = stagedBytes > 0 ? Math.Clamp(stagedBytes, 0, displaySize - 1) : -1;
+            if (LayoutStatusLbl != null)
+              LayoutStatusLbl.Text = cancellationToken.IsCancellationRequested
+                ? "Cancellation pending — current codec unit will finish, then the staged target is discarded."
+                : $"Rebuilding staged target — {FormatSize(stagedBytes)} written; original unchanged.";
+          });
+        }
+
+        var result = worker.GetAwaiter().GetResult();
+        newSize = result.OptimizedSize;
+        entriesOptimized = result.EntriesOptimized;
+        if (cancellationToken.IsCancellationRequested) {
+          cancelled = true;
+        } else {
+          Dispatcher.Invoke(() => {
+            this._maintenanceCommitStarted = true;
+            if (this._maintenanceCancelButton != null) this._maintenanceCancelButton.IsEnabled = false;
+            Progress.Value = 99;
+            if (LayoutStatusLbl != null)
+              LayoutStatusLbl.Text = "Staged target complete — committing; cancellation is no longer safe.";
+          });
+          AtomicFileWriter.ReplaceTarget(tempOut, path);
+        }
+      } catch (OperationCanceledException) {
+        cancelled = true;
+      } catch (Exception ex) {
+        error = ex;
+      } finally {
+        AtomicFileWriter.TryDelete(tempOut);
+      }
+      sw.Stop();
+
+      Dispatcher.Invoke(() => {
+        BlockMap.ReadHead = -1;
+        BlockMap.WriteHead = -1;
+        Progress.Value = 100;
+        if (cancelled) {
+          Append($"CANCELLED ({sw.ElapsedMilliseconds} ms) — staged target discarded; existing archive unchanged.");
+        } else if (error != null) {
+          Append($"FAILED ({sw.ElapsedMilliseconds} ms): {error.GetType().Name}: {error.Message}");
+        } else {
+          var delta = newSize - originalSize;
+          var pct = originalSize > 0 ? (double)delta / originalSize * 100 : 0;
+          Append($"OK ({sw.ElapsedMilliseconds} ms) — {entriesOptimized} entries re-encoded");
+          Append($"Archive size: {originalSize:N0} -> {newSize:N0} bytes (Δ {delta:+#,#;-#,#;0}, {pct:+0.0;-0.0;0.0}%)");
+          NotifyMutated(path);
+        }
+        Append("");
+        EndMaintenanceOperation();
+      });
+    });
+  }
+
+  private void RunSmartSevenZipWithBlockProgress(IArchiveFormatOperations ops) {
+    if (this._imagePath == null) return;
+    var path = this._imagePath;
+    var originalSize = new FileInfo(path).Length;
+    var cancellationToken = BeginMaintenanceOperation("7z solid-block re-group", staged: true);
+    SetStagedArchiveMap(path, ops, originalSize);
+
+    Append($"=== {DateTime.Now:HH:mm:ss}  Smart solid-block repack: {Path.GetFileName(path)} ===");
+    Append("All candidate layouts are staged. Cancel discards them and leaves the current 7z untouched.");
+    Progress.IsIndeterminate = false;
+    Progress.Value = 0;
+
+    Task.Run(() => {
+      var sw = Stopwatch.StartNew();
+      Exception? error = null;
+      var cancelled = false;
+      FileFormat.SevenZip.SolidBlockOptimizer.OptimizeResult? result = null;
+
+      try {
+        using var fs = File.OpenRead(path);
+        result = FileFormat.SevenZip.SolidBlockOptimizer.Optimize(
+          fs,
+          maxTrials: 5,
+          onProgress: (index, total, name) => Dispatcher.BeginInvoke(() =>
+            Append($"  Trying strategy {index + 1}/{total}: {name}...")),
+          onDetailedProgress: detail => Dispatcher.BeginInvoke(() => {
+            var displaySize = Math.Max(1L, BlockMap.ImageSize > 0 ? BlockMap.ImageSize : originalSize);
+            double fraction;
+            switch (detail.Phase) {
+              case "extracting":
+                fraction = 0.30 * detail.BytesDone / Math.Max(1.0, detail.BytesTotal);
+                BlockMap.ReadHead = Math.Clamp((long)(detail.BytesDone / Math.Max(1.0, detail.BytesTotal) * displaySize), 0, displaySize - 1);
+                BlockMap.WriteHead = -1;
+                break;
+              case "strategy":
+                fraction = 0.30 + 0.10 * detail.Current / Math.Max(1.0, detail.Total);
+                BlockMap.ReadHead = -1;
+                break;
+              case "building":
+                fraction = 0.40 + 0.55 * detail.Current / Math.Max(1.0, detail.Total);
+                BlockMap.ReadHead = -1;
+                BlockMap.WriteHead = Math.Clamp((long)(detail.Current / Math.Max(1.0, detail.Total) * displaySize), 0, displaySize - 1);
+                break;
+              default:
+                fraction = 0;
+                break;
+            }
+            Progress.Value = Math.Clamp(fraction, 0, 0.95) * 100;
+            if (LayoutStatusLbl != null)
+              LayoutStatusLbl.Text = detail.Phase switch {
+                "extracting" => $"Reading source entry: {detail.Name}",
+                "strategy" => $"Planning solid grouping: {detail.Name}",
+                "building" => $"Building staged solid candidate: {detail.Name}",
+                _ => "Staged 7z regrouping",
+              };
+          }),
+          cancellationToken: cancellationToken);
+      } catch (OperationCanceledException) {
+        cancelled = true;
+      } catch (Exception ex) {
+        error = ex;
+      }
+      sw.Stop();
+
+      Dispatcher.Invoke(() => {
+        BlockMap.ReadHead = -1;
+        BlockMap.WriteHead = -1;
+        Progress.Value = 100;
+
+        if (cancelled) {
+          Append($"CANCELLED ({sw.ElapsedMilliseconds} ms) — candidate regroup discarded; existing 7z unchanged.");
+        } else if (error != null) {
+          Append($"FAILED ({sw.ElapsedMilliseconds} ms): {error.GetType().Name}: {error.Message}");
+        } else if (result != null) {
+          foreach (var trial in result.Trials)
+            Append($"    {trial.StrategyName}: {FormatSize(trial.OutputSize)} ({trial.Elapsed.TotalMilliseconds:F0} ms)");
+
+          var newSize = (long)result.Data.Length;
+          var delta = newSize - originalSize;
+          var pct = originalSize > 0 ? (double)delta / originalSize * 100 : 0;
+          Append($"  Winner: {result.WinningStrategy}");
+          Append($"Archive size: {originalSize:N0} -> {newSize:N0} bytes ({delta:+#,#;-#,#;0}, {pct:+0.0;-0.0;0.0}%)");
+
+          if (newSize < originalSize) {
+            this._maintenanceCommitStarted = true;
+            if (this._maintenanceCancelButton != null) this._maintenanceCancelButton.IsEnabled = false;
+            if (LayoutStatusLbl != null)
+              LayoutStatusLbl.Text = "Winning staged layout selected — committing; cancellation disabled.";
+            try {
+              AtomicFileWriter.WriteAllBytesAtomic(path, result.Data);
+              Append("Optimized archive written.");
+              NotifyMutated(path);
+            } catch (Exception writeError) {
+              Append($"FAILED while committing winner: {writeError.Message}");
+            }
+          } else {
+            Append("No strategy improved on the original size; archive unchanged.");
+          }
+        }
+        Append("");
+        EndMaintenanceOperation();
+      });
+    });
+  }
+
+  private void SetStagedArchiveMap(string path, IArchiveFormatOperations ops, long displaySize) {
+    try {
+      using var stream = File.OpenRead(path);
+      var entries = ops.List(stream, null).Where(e => !e.IsDirectory).ToArray();
+      if (entries.Length == 0) return;
+      var weights = entries.Select(e => Math.Max(1L, e.OriginalSize)).ToArray();
+      var totalWeight = Math.Max(1L, weights.Sum());
+      var size = Math.Max(1L, displaySize);
+      var map = new List<DefragBlockInfo>(entries.Length);
+      long cumulative = 0;
+      long offset = 0;
+      for (var i = 0; i < entries.Length; i++) {
+        cumulative += weights[i];
+        var end = i == entries.Length - 1
+          ? size
+          : (long)((double)cumulative / totalWeight * size);
+        end = Math.Clamp(end, offset, size);
+        if (end > offset)
+          map.Add(new DefragBlockInfo(offset, end - offset, DefragBlockKind.Used,
+            entries[i].Name, ClassifyByMethod(entries[i].Method)));
+        offset = end;
+      }
+      BlockMap.BlockMap = map;
+      BlockMap.ImageSize = size;
+      BlockMap.ReadHead = 0;
+      BlockMap.WriteHead = -1;
+      if (LayoutStatusLbl != null)
+        LayoutStatusLbl.Text = "Staged rebuild projection — colored target blocks; green source head / orange target head use separate byte-spaces.";
+    } catch {
+      // The existing preview remains usable if a synthetic target map cannot be built.
+    }
+  }
+
+  private static long FindStagedOutputLength(string target) {
+    try {
+      var best = File.Exists(target) ? new FileInfo(target).Length : 0L;
+      var directory = Path.GetDirectoryName(target);
+      if (string.IsNullOrEmpty(directory)) directory = Directory.GetCurrentDirectory();
+      var pattern = Path.GetFileName(target) + ".tmp.*";
+      foreach (var candidate in Directory.EnumerateFiles(directory, pattern))
+        best = Math.Max(best, new FileInfo(candidate).Length);
+      return best;
+    } catch {
+      return 0;
+    }
+  }
+}
diff --git a/FileFormats/FileFormat.Dmg/DmgFormatDescriptor.cs b/FileFormats/FileFormat.Dmg/DmgFormatDescriptor.cs
index d3328d2ed..fdc8de195 100644
--- a/FileFormats/FileFormat.Dmg/DmgFormatDescriptor.cs
+++ b/FileFormats/FileFormat.Dmg/DmgFormatDescriptor.cs
@@ -15,11 +15,12 @@ namespace FileFormat.Dmg;
 ///   <item><description><c>https://en.wikipedia.org/wiki/Apple_Disk_Image</c> — format overview</description></item>
 /// </list>
 /// </summary>
-public sealed class DmgFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveCreatable, IArchiveDefragmentable {
+public sealed class DmgFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveCreatable,
+  IArchiveModifiable, IArchiveDefragmentable {
 
   public void Defragment(Stream archive)
     => throw new NotSupportedException(
-      "DMG is an Apple disk image with mish blocks and a signed footer — defragmentation isn't meaningful.");
+      "DMG is an Apple disk image with mish blocks and a trailing block index; defragmentation is not exposed as a generic archive verb.");
   public void Defragment(Stream archive, DefragOptions options) => this.Defragment(archive);
 
   public string Id => "Dmg";
@@ -27,7 +28,7 @@ public void Defragment(Stream archive)
   public FormatCategory Category => FormatCategory.Archive;
   public FormatCapabilities Capabilities =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate |
-    FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries;
+    FormatCapabilities.CanModify | FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries;
   public string DefaultExtension => ".dmg";
   public IReadOnlyList<string> Extensions => [".dmg"];
   public IReadOnlyList<string> CompoundExtensions => [];
@@ -51,12 +52,6 @@ public void Extract(Stream stream, string outputDir, string? password, string[]?
     }
   }
 
-  /// <summary>
-  /// Opens a single DMG partition as a bounded read-only <see cref="Stream"/>.
-  /// The reader's per-entry extractor reconstructs the partition's raw
-  /// sectors; they are wrapped in a <see cref="BoundedEntryStream"/> sized
-  /// to the entry's size.
-  /// </summary>
   public Stream OpenEntry(Stream archive, string entryName, string? password) {
     ArgumentNullException.ThrowIfNull(archive);
     ArgumentNullException.ThrowIfNull(entryName);
@@ -72,7 +67,6 @@ public Stream OpenEntry(Stream archive, string entryName, string? password) {
       0, leaveOpen: false);
   }
 
-  /// <summary>Native in-memory single-entry extraction.</summary>
   public byte[] ExtractEntryToMemory(Stream archive, string entryName, string? password) {
     using var s = this.OpenEntry(archive, entryName, password);
     using var ms = new MemoryStream();
@@ -81,9 +75,6 @@ public byte[] ExtractEntryToMemory(Stream archive, string entryName, string? pas
   }
 
   public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
-    // WORM: each input becomes a partition with a single raw mish block (no
-    // compression). The reader rebuilds sectors from the raw block and writes
-    // each partition out at extract time.
     var w = new DmgWriter();
     foreach (var i in inputs) {
       if (i.IsDirectory) continue;
@@ -91,4 +82,20 @@ public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, Format
     }
     w.WriteTo(output);
   }
+
+  /// <summary>
+  /// Adds or replaces partitions in the raw UDIF profile emitted by this writer.
+  /// Existing partition payload offsets are preserved; new data occupies the old
+  /// plist tail and only the blkx/plist + koly index are rewritten.
+  /// </summary>
+  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)
+    => DmgInPlaceModifier.Add(archive, inputs);
+
+  /// <summary>
+  /// Removes partitions from the raw UDIF profile by dropping their blkx records.
+  /// Payload bytes are left as unreachable data-fork slack so unrelated partitions
+  /// never need to move.
+  /// </summary>
+  public void Remove(Stream archive, string[] entryNames)
+    => DmgInPlaceModifier.Remove(archive, entryNames);
 }
diff --git a/FileFormats/FileFormat.Dmg/DmgInPlaceModifier.cs b/FileFormats/FileFormat.Dmg/DmgInPlaceModifier.cs
new file mode 100644
index 000000000..4a4a16e91
--- /dev/null
+++ b/FileFormats/FileFormat.Dmg/DmgInPlaceModifier.cs
@@ -0,0 +1,87 @@
+#pragma warning disable CS1591
+using System.Text;
+using Compression.Registry;
+using static Compression.Registry.FormatHelpers;
+
+namespace FileFormat.Dmg;
+
+/// <summary>
+/// Mutates the raw UDIF profile emitted by <see cref="DmgWriter"/> without
+/// rebuilding existing partition payloads. Existing data-fork bytes stay at
+/// their physical offsets; replacements/new partitions are appended where the
+/// old plist started and the trailing blkx index + koly footer are regenerated.
+/// Removed/replaced payloads become unreachable data-fork slack.
+/// </summary>
+internal static class DmgInPlaceModifier {
+
+  public static void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
+    ArgumentNullException.ThrowIfNull(inputs);
+    Mutate(archive, inputs, []);
+  }
+
+  public static void Remove(Stream archive, string[] entryNames) {
+    ArgumentNullException.ThrowIfNull(entryNames);
+    Mutate(archive, [], entryNames);
+  }
+
+  private static void Mutate(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs,
+      IReadOnlyCollection<string> removals) {
+    ArgumentNullException.ThrowIfNull(archive);
+    if (!archive.CanSeek || !archive.CanRead || !archive.CanWrite)
+      throw new ArgumentException("DMG mutation requires a seekable read/write stream.", nameof(archive));
+
+    archive.Position = 0;
+    using var reader = new DmgReader(archive, leaveOpen: true);
+    if (!reader.IsWorkbenchRawProfile)
+      throw new NotSupportedException(
+        "DMG mutation is supported for the raw UDIF profile emitted by CompressionWorkbench; " +
+        "foreign compressed/signed plist profiles remain read-only.");
+    if ((reader.XmlOffset % DmgWriter.SectorSize) != 0)
+      throw new InvalidDataException("DMG data fork is not sector-aligned.");
+
+    var entries = reader.Partitions
+      .Select(p => (Name: p.Name, Mish: p.Mish, LogicalSize: p.LogicalSize))
+      .ToList();
+
+    foreach (var name in removals)
+      entries.RemoveAll(e => string.Equals(e.Name, name, StringComparison.OrdinalIgnoreCase));
+
+    archive.Position = reader.XmlOffset;
+    foreach (var (name, data) in FilesOnly(inputs)) {
+      entries.RemoveAll(e => string.Equals(e.Name, name, StringComparison.OrdinalIgnoreCase));
+
+      var offset = archive.Position;
+      var paddedLength = DmgWriter.AlignSector(data.Length);
+      archive.Write(data);
+      WriteZeros(archive, paddedLength - data.Length);
+
+      var sectorCount = checked((ulong)(paddedLength / DmgWriter.SectorSize));
+      var mish = DmgWriter.BuildMishBlob(0, sectorCount, checked((ulong)offset), checked((ulong)paddedLength));
+      entries.Add((name, mish, data.LongLength));
+    }
+
+    var xmlOffset = archive.Position;
+    var xmlBytes = Encoding.UTF8.GetBytes(DmgWriter.BuildXmlPlist(entries));
+    archive.Write(xmlBytes);
+
+    // The workbench raw profile keeps the data fork at offset zero. Its old
+    // payload bytes (including orphaned removed/replaced partitions) remain part
+    // of that fork; this is what makes removal metadata-only and preserves every
+    // untouched physical partition offset.
+    var dataForkLength = xmlOffset;
+    var sectors = checked((ulong)(dataForkLength / DmgWriter.SectorSize));
+    archive.Write(DmgWriter.BuildKoly(xmlOffset, xmlBytes.LongLength, dataForkLength,
+      sectors, reader.KolyTrailer));
+    archive.SetLength(archive.Position);
+  }
+
+  private static void WriteZeros(Stream output, int count) {
+    if (count <= 0) return;
+    Span<byte> zero = stackalloc byte[512];
+    while (count > 0) {
+      var take = Math.Min(count, zero.Length);
+      output.Write(zero[..take]);
+      count -= take;
+    }
+  }
+}
diff --git a/FileFormats/FileFormat.Dmg/DmgReader.cs b/FileFormats/FileFormat.Dmg/DmgReader.cs
index 91078aaa8..162829aaa 100644
--- a/FileFormats/FileFormat.Dmg/DmgReader.cs
+++ b/FileFormats/FileFormat.Dmg/DmgReader.cs
@@ -1,18 +1,16 @@
 #pragma warning disable CS1591
 using System.Buffers.Binary;
 using System.IO.Compression;
+using System.Net;
 using System.Text;
 
 namespace FileFormat.Dmg;
 
-
 /// <summary>
-/// Read-only reader for Apple Disk Image (DMG) files.
-/// Parses the koly trailer, XML plist, and mish block tables to expose each
-/// partition as an extractable entry.
+/// Reader for Apple Disk Image (DMG/UDIF) files. Parses the koly trailer,
+/// XML plist, and mish block tables to expose each partition as an entry.
 /// </summary>
 public sealed class DmgReader : IDisposable {
-  // Block types in the mish block table
   private const uint BlockTypeZeroFill  = 0x00000000;
   private const uint BlockTypeRaw       = 0x00000001;
   private const uint BlockTypeZlib      = 0x80000005;
@@ -29,89 +27,52 @@ public sealed class DmgReader : IDisposable {
   private readonly List<DmgEntry> _entries = [];
   private readonly List<PartitionInfo> _partitions = [];
 
-  /// <summary>All partitions found in the DMG, each exposed as a named entry.</summary>
   public IReadOnlyList<DmgEntry> Entries => _entries;
+  internal long XmlOffset { get; private set; }
+  internal long XmlLength { get; private set; }
+  internal byte[] KolyTrailer { get; private set; } = [];
+  internal IReadOnlyList<PartitionInfo> Partitions => _partitions;
+  internal bool IsWorkbenchRawProfile =>
+    _partitions.All(p => p.HasLogicalSizeMarker && IsRawMish(p.Mish));
 
   public DmgReader(Stream stream, bool leaveOpen = false) {
+    ArgumentNullException.ThrowIfNull(stream);
     using var ms = new MemoryStream();
     stream.CopyTo(ms);
     _data = ms.ToArray();
     Parse();
+    _ = leaveOpen;
   }
 
-  // ──────────────────────────────────────────────────────────────────────────
-  // Parsing
-  // ──────────────────────────────────────────────────────────────────────────
-
   private void Parse() {
     if (_data.Length < KolySize)
       throw new InvalidDataException("DMG: file too small to contain koly trailer.");
 
     var kolyOff = _data.Length - KolySize;
     var kolySpan = _data.AsSpan(kolyOff, KolySize);
-
-    // Check "koly" signature
-    if (kolySpan[0] != 'k' || kolySpan[1] != 'o' || kolySpan[2] != 'l' || kolySpan[3] != 'y')
+    if (!kolySpan[..4].SequenceEqual("koly"u8))
       throw new InvalidDataException("DMG: missing 'koly' trailer signature.");
 
-    // Parse koly fields (all big-endian)
-    // Offset  4: uint32 version
-    // Offset  8: uint32 headerSize
-    // Offset 12: uint32 flags
-    // Offset 16: uint64 runningDataForkOffset
-    // Offset 24: uint64 dataForkOffset
-    // Offset 32: uint64 dataForkLength
-    // Offset 40: uint64 rsrcForkOffset
-    // Offset 48: uint64 rsrcForkLength
-    // Offset 56: uint32 segmentNumber
-    // Offset 60: uint32 segmentCount
-    // Offset 64: Guid   segmentId (16 bytes)
-    // Offset 80: uint32 dataChecksumType
-    // Offset 84: uint32 dataChecksumSize
-    // Offset 88: uint32[32] dataChecksum  (128 bytes)
-    // Offset 216: uint64 xmlOffset
-    // Offset 224: uint64 xmlLength
-    // Offset 232: reserved (120 bytes, brings us to 352)
-    // Offset 352: uint32 masterChecksumType
-    // Offset 356: uint32 masterChecksumSize
-    // Offset 360: uint32[32] masterChecksum (128 bytes)
-    // Offset 488: uint32 imageVariant
-    // Offset 492: uint64 sectorCount
-    // Offset 500: 12 bytes reserved
-
-    var xmlOffset = (long)BinaryPrimitives.ReadUInt64BigEndian(kolySpan[216..]);
-    var xmlLength = (long)BinaryPrimitives.ReadUInt64BigEndian(kolySpan[224..]);
-
-    if (xmlLength <= 0 || xmlOffset < 0 || xmlOffset + xmlLength > _data.Length)
+    XmlOffset = checked((long)BinaryPrimitives.ReadUInt64BigEndian(kolySpan[216..]));
+    XmlLength = checked((long)BinaryPrimitives.ReadUInt64BigEndian(kolySpan[224..]));
+    KolyTrailer = kolySpan.ToArray();
+
+    if (XmlLength <= 0 || XmlOffset < 0 || XmlOffset + XmlLength > kolyOff)
       throw new InvalidDataException("DMG: invalid XML plist region in koly trailer.");
 
-    var xmlText = Encoding.UTF8.GetString(_data, (int)xmlOffset, (int)xmlLength);
+    var xmlText = Encoding.UTF8.GetString(_data, checked((int)XmlOffset), checked((int)XmlLength));
     ParseXmlPlist(xmlText);
   }
 
   private void ParseXmlPlist(string xml) {
-    // We use simple string search — no XML parser dependency.
-    // Structure we're looking for (may repeat for multiple partitions):
-    //
-    //   <key>blkx</key>
-    //   <array>
-    //     <dict>
-    //       <key>Name</key><string>…</string>
-    //       <key>Data</key><data>BASE64…</data>
-    //     </dict>
-    //     …
-    //   </array>
-
     var blkxPos = xml.IndexOf("<key>blkx</key>", StringComparison.Ordinal);
-    if (blkxPos < 0) return; // no partitions
+    if (blkxPos < 0) return;
 
     var arrayStart = xml.IndexOf("<array>", blkxPos, StringComparison.Ordinal);
-    var arrayEnd   = xml.IndexOf("</array>", blkxPos, StringComparison.Ordinal);
+    var arrayEnd = xml.IndexOf("</array>", blkxPos, StringComparison.Ordinal);
     if (arrayStart < 0 || arrayEnd < 0 || arrayEnd <= arrayStart) return;
 
     var arrayBody = xml.Substring(arrayStart + 7, arrayEnd - arrayStart - 7);
-
-    // Parse each <dict> element
     var dictStart = 0;
     var partIndex = 0;
     while (true) {
@@ -121,11 +82,14 @@ private void ParseXmlPlist(string xml) {
       if (dEnd < 0) break;
 
       var dictBody = arrayBody.Substring(dStart + 6, dEnd - dStart - 6);
-      var (name, mish) = ParseBlkxDict(dictBody, partIndex);
-      if (mish != null) {
-        var size = ComputePartitionSize(mish);
-        _entries.Add(new DmgEntry { Name = name, Size = size });
-        _partitions.Add(new PartitionInfo(name, mish));
+      var parsed = ParseBlkxDict(dictBody, partIndex);
+      if (parsed.Mish != null) {
+        var physicalSize = ComputePartitionSize(parsed.Mish);
+        var logicalSize = parsed.LogicalSize.HasValue
+          ? Math.Min(parsed.LogicalSize.Value, physicalSize)
+          : physicalSize;
+        _entries.Add(new DmgEntry { Name = parsed.Name, Size = logicalSize });
+        _partitions.Add(new PartitionInfo(parsed.Name, parsed.Mish, logicalSize, parsed.LogicalSize.HasValue));
         partIndex++;
       }
 
@@ -133,28 +97,35 @@ private void ParseXmlPlist(string xml) {
     }
   }
 
-  private static (string name, byte[]? mish) ParseBlkxDict(string dictBody, int index) {
-    // Extract <key>Name</key><string>…</string>
+  private static (string Name, byte[]? Mish, long? LogicalSize) ParseBlkxDict(string dictBody, int index) {
     var name = $"partition_{index}.img";
     var nameKeyPos = dictBody.IndexOf("<key>Name</key>", StringComparison.Ordinal);
     if (nameKeyPos >= 0) {
       var strStart = dictBody.IndexOf("<string>", nameKeyPos, StringComparison.Ordinal);
-      var strEnd   = dictBody.IndexOf("</string>", nameKeyPos, StringComparison.Ordinal);
+      var strEnd = dictBody.IndexOf("</string>", nameKeyPos, StringComparison.Ordinal);
       if (strStart >= 0 && strEnd > strStart) {
-        var raw = dictBody.Substring(strStart + 8, strEnd - strStart - 8).Trim();
-        if (raw.Length > 0)
-          name = SanitizeName(raw, index);
+        var raw = WebUtility.HtmlDecode(dictBody.Substring(strStart + 8, strEnd - strStart - 8).Trim());
+        if (raw.Length > 0) name = SanitizeName(raw, index);
       }
     }
 
-    // Extract <key>Data</key><data>BASE64</data>
+    long? logicalSize = null;
+    var logicalKey = dictBody.IndexOf("<key>CWBLogicalSize</key>", StringComparison.Ordinal);
+    if (logicalKey >= 0) {
+      var valueStart = dictBody.IndexOf("<integer>", logicalKey, StringComparison.Ordinal);
+      var valueEnd = dictBody.IndexOf("</integer>", logicalKey, StringComparison.Ordinal);
+      if (valueStart >= 0 && valueEnd > valueStart &&
+          long.TryParse(dictBody.AsSpan(valueStart + 9, valueEnd - valueStart - 9), out var parsed) && parsed >= 0)
+        logicalSize = parsed;
+    }
+
     byte[]? mish = null;
     var dataKeyPos = dictBody.IndexOf("<key>Data</key>", StringComparison.Ordinal);
     if (dataKeyPos < 0)
-      dataKeyPos = dictBody.IndexOf("<key>data</key>", StringComparison.Ordinal); // lowercase fallback
+      dataKeyPos = dictBody.IndexOf("<key>data</key>", StringComparison.Ordinal);
     if (dataKeyPos >= 0) {
       var dataStart = dictBody.IndexOf("<data>", dataKeyPos, StringComparison.Ordinal);
-      var dataEnd   = dictBody.IndexOf("</data>", dataKeyPos, StringComparison.Ordinal);
+      var dataEnd = dictBody.IndexOf("</data>", dataKeyPos, StringComparison.Ordinal);
       if (dataStart >= 0 && dataEnd > dataStart) {
         var b64 = dictBody.Substring(dataStart + 6, dataEnd - dataStart - 6)
                           .Replace("\n", "").Replace("\r", "").Replace(" ", "").Replace("\t", "");
@@ -162,87 +133,58 @@ private static (string name, byte[]? mish) ParseBlkxDict(string dictBody, int in
       }
     }
 
-    return (name, mish);
+    return (name, mish, logicalSize);
   }
 
   private static string SanitizeName(string raw, int index) {
-    // Strip common Apple partition decorators like "(Apple_HFS : 2)"
     var paren = raw.IndexOf('(');
     if (paren > 0) raw = raw[..paren].Trim();
-    // Replace characters that are bad in filenames
-    foreach (var ch in Path.GetInvalidFileNameChars())
-      raw = raw.Replace(ch, '_');
+    foreach (var ch in Path.GetInvalidFileNameChars()) raw = raw.Replace(ch, '_');
     raw = raw.Trim().Replace(' ', '_');
     if (raw.Length == 0) raw = $"partition_{index}";
     if (!raw.Contains('.')) raw += ".img";
     return raw;
   }
 
-  // ──────────────────────────────────────────────────────────────────────────
-  // Mish (block table) parsing
-  // ──────────────────────────────────────────────────────────────────────────
-
-  private sealed record BlockEntry(uint Type, ulong SectorOffset, ulong SectorCount,
-                                   ulong CompressedOffset, ulong CompressedLength);
+  internal sealed record BlockEntry(uint Type, ulong SectorOffset, ulong SectorCount,
+                                    ulong CompressedOffset, ulong CompressedLength);
+  internal sealed record MishTable(ulong FirstSector, ulong SectorCount, ulong DataStart,
+                                   List<BlockEntry> Blocks);
 
-  private sealed record MishTable(ulong FirstSector, ulong SectorCount, ulong DataStart,
-                                  List<BlockEntry> Blocks);
+  internal static MishTable? ParseMish(byte[] mish) {
+    if (mish.Length < 204 || !mish.AsSpan(0, 4).SequenceEqual("mish"u8)) return null;
 
-  private static MishTable? ParseMish(byte[] mish) {
-    if (mish == null || mish.Length < 204) return null;
+    var firstSector = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(8));
+    var sectorCount = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(16));
+    var dataStart = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(24));
+    var numEntries = BinaryPrimitives.ReadUInt32BigEndian(mish.AsSpan(200));
+    if (numEntries > 100_000) return null;
 
-    // "mish" signature
-    if (mish[0] != 'm' || mish[1] != 'i' || mish[2] != 's' || mish[3] != 'h') return null;
-
-    // All big-endian
-    // Offset  4: uint32 version
-    // Offset  8: uint64 firstSector
-    // Offset 16: uint64 sectorCount
-    // Offset 24: uint64 dataStart
-    // Offset 32: uint32 decompressedBufferRequested
-    // Offset 36: uint32 blocksDescriptor
-    // Offset 40: reserved 24 bytes
-    // Offset 64: checksum type/size/data (136 bytes total: 4+4+128)
-    // Offset 200: uint32 numBlockEntries
-    // Then block entries at offset 204, each 40 bytes
-
-    var firstSector  = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(8));
-    var sectorCount  = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(16));
-    var dataStart    = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(24));
-    var numEntries   = BinaryPrimitives.ReadUInt32BigEndian(mish.AsSpan(200));
-
-    if (numEntries > 100_000) return null; // sanity guard
     var blocks = new List<BlockEntry>((int)numEntries);
-
     var off = 204;
     for (var i = 0u; i < numEntries; i++) {
       if (off + 40 > mish.Length) break;
-      var blockType        = BinaryPrimitives.ReadUInt32BigEndian(mish.AsSpan(off));
-      // offset 4 = uint32 reserved
-      var sectorOffset     = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(off + 8));
-      var blockSectorCount = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(off + 16));
-      var compressedOffset = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(off + 24));
-      var compressedLength = BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(off + 32));
-      blocks.Add(new BlockEntry(blockType, sectorOffset, blockSectorCount, compressedOffset, compressedLength));
+      blocks.Add(new BlockEntry(
+        BinaryPrimitives.ReadUInt32BigEndian(mish.AsSpan(off)),
+        BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(off + 8)),
+        BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(off + 16)),
+        BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(off + 24)),
+        BinaryPrimitives.ReadUInt64BigEndian(mish.AsSpan(off + 32))));
       off += 40;
     }
-
     return new MishTable(firstSector, sectorCount, dataStart, blocks);
   }
 
-  private static long ComputePartitionSize(byte[] mish) {
+  internal static bool IsRawMish(byte[] mish) {
     var table = ParseMish(mish);
-    if (table == null) return 0;
-    return (long)table.SectorCount * SectorSize;
+    return table != null && table.Blocks.All(b => b.Type is BlockTypeRaw or BlockTypeTerminator);
   }
 
-  // ──────────────────────────────────────────────────────────────────────────
-  // Extraction
-  // ──────────────────────────────────────────────────────────────────────────
+  private static long ComputePartitionSize(byte[] mish) {
+    var table = ParseMish(mish);
+    return table == null ? 0 : checked((long)table.SectorCount * SectorSize);
+  }
 
-  /// <summary>
-  /// Reassembles and returns the raw sector data for <paramref name="entry"/>.
-  /// </summary>
   public byte[] Extract(DmgEntry entry) {
     ArgumentNullException.ThrowIfNull(entry);
     var pi = _partitions.FirstOrDefault(p => p.Name == entry.Name);
@@ -251,87 +193,60 @@ public byte[] Extract(DmgEntry entry) {
     var table = ParseMish(pi.Mish);
     if (table == null) return [];
 
-    var totalBytes = (long)table.SectorCount * SectorSize;
-    if (totalBytes <= 0 || totalBytes > 2L * 1024 * 1024 * 1024)
-      totalBytes = Math.Max(0, Math.Min(totalBytes, 2L * 1024 * 1024 * 1024));
-
-    var output = new byte[totalBytes];
+    var physicalBytes = checked((long)table.SectorCount * SectorSize);
+    if (physicalBytes > int.MaxValue)
+      throw new NotSupportedException("DMG partition is too large for the in-memory extraction API.");
 
+    var output = new byte[(int)physicalBytes];
     foreach (var block in table.Blocks) {
       if (block.Type == BlockTypeComment || block.Type == BlockTypeTerminator) continue;
-
-      var destOffset = (long)block.SectorOffset * SectorSize;
-      var destLength = (long)block.SectorCount  * SectorSize;
-
-      if (destLength == 0) continue;
-      if (destOffset < 0 || destOffset + destLength > output.LongLength) continue;
+      var destOffset = checked((long)block.SectorOffset * SectorSize);
+      var destLength = checked((long)block.SectorCount * SectorSize);
+      if (destLength == 0 || destOffset < 0 || destOffset + destLength > output.LongLength) continue;
 
       switch (block.Type) {
-        case BlockTypeZeroFill:
-          // Already zero — nothing to write
-          break;
-
-        case BlockTypeRaw:
-          ExtractRaw(block, destOffset, destLength, output);
-          break;
-
-        case BlockTypeZlib:
-          ExtractZlib(block, destOffset, destLength, output);
-          break;
-
-        case BlockTypeBzip2:
-          ExtractBzip2(block, destOffset, destLength, output);
-          break;
-
+        case BlockTypeZeroFill: break;
+        case BlockTypeRaw: ExtractRaw(block, destOffset, destLength, output); break;
+        case BlockTypeZlib: ExtractZlib(block, destOffset, destLength, output); break;
+        case BlockTypeBzip2: ExtractBzip2(block, destOffset, destLength, output); break;
         case BlockTypeLzfse:
         case BlockTypeLzma:
-          // Unsupported compression — leave zeros in output
-          break;
-
         default:
-          // Unknown type — leave zeros
           break;
       }
     }
 
-    return output;
+    if (pi.LogicalSize == output.LongLength) return output;
+    return output.AsSpan(0, checked((int)Math.Min(pi.LogicalSize, output.LongLength))).ToArray();
   }
 
   private void ExtractRaw(BlockEntry block, long destOffset, long destLength, byte[] output) {
-    var srcOffset = (long)block.CompressedOffset;
-    var srcLength = (long)block.CompressedLength;
+    var srcOffset = checked((long)block.CompressedOffset);
+    var srcLength = checked((long)block.CompressedLength);
     if (srcOffset < 0 || srcOffset + srcLength > _data.LongLength) return;
-    var copyLen = (int)Math.Min(srcLength, destLength);
-    _data.AsSpan((int)srcOffset, copyLen).CopyTo(output.AsSpan((int)destOffset));
+    var copyLen = checked((int)Math.Min(srcLength, destLength));
+    _data.AsSpan(checked((int)srcOffset), copyLen).CopyTo(output.AsSpan(checked((int)destOffset)));
   }
 
   private void ExtractZlib(BlockEntry block, long destOffset, long destLength, byte[] output) {
-    var srcOffset = (long)block.CompressedOffset;
-    var srcLength = (long)block.CompressedLength;
+    var srcOffset = checked((long)block.CompressedOffset);
+    var srcLength = checked((long)block.CompressedLength);
     if (srcOffset < 0 || srcLength < 2 || srcOffset + srcLength > _data.LongLength) return;
-
-    // zlib stream: skip 2-byte header (CMF + FLG), use raw DEFLATE
     try {
-      using var src = new MemoryStream(_data, (int)srcOffset + 2, (int)srcLength - 2);
+      using var src = new MemoryStream(_data, checked((int)srcOffset + 2), checked((int)srcLength - 2));
       using var deflate = new DeflateStream(src, CompressionMode.Decompress);
-      using var dst = new MemoryStream(output, (int)destOffset, (int)destLength);
+      using var dst = new MemoryStream(output, checked((int)destOffset), checked((int)destLength));
       deflate.CopyTo(dst);
     } catch {
-      // Decompression failed — leave zeros in the output region
+      // Unsupported or corrupt compressed block: retain zero-fill in this region.
     }
   }
 
   private static void ExtractBzip2(BlockEntry block, long destOffset, long destLength, byte[] output) {
-    // bzip2 decompression is not available in the Compression.Core dependency set.
-    // Leave the region zero-filled (safe no-op for read-only listing/testing scenarios).
     _ = block; _ = destOffset; _ = destLength; _ = output;
   }
 
   public void Dispose() { }
 
-  // ──────────────────────────────────────────────────────────────────────────
-  // Internal helpers
-  // ──────────────────────────────────────────────────────────────────────────
-
-  private sealed record PartitionInfo(string Name, byte[] Mish);
+  internal sealed record PartitionInfo(string Name, byte[] Mish, long LogicalSize, bool HasLogicalSizeMarker);
 }
diff --git a/FileFormats/FileFormat.Dmg/DmgWriter.cs b/FileFormats/FileFormat.Dmg/DmgWriter.cs
index b7dc09225..79e0057f4 100644
--- a/FileFormats/FileFormat.Dmg/DmgWriter.cs
+++ b/FileFormats/FileFormat.Dmg/DmgWriter.cs
@@ -5,23 +5,18 @@
 namespace FileFormat.Dmg;
 
 /// <summary>
-/// Writes Apple Disk Image (DMG) files in WORM mode. Each input file becomes
-/// one partition with a single raw (uncompressed) mish block. The output
-/// roundtrips through <see cref="DmgReader"/>:
-/// <list type="bullet">
-///   <item>Layout: [partition data sectors] [XML plist] [512-byte koly trailer].</item>
-///   <item>Each partition has a mish table with one <c>BlockTypeRaw</c> entry covering all its sectors plus a terminator.</item>
-///   <item>No compression -- DMG's zlib/bz2/lzfse encoders aren't paired here, and raw is fully spec-valid.</item>
-///   <item>No checksums -- mish/koly checksum-type fields set to 0 ("none"), which the reader accepts.</item>
-/// </list>
+/// Writes Apple Disk Image (DMG/UDIF) files using raw <c>mish</c> blocks.
+/// Each input becomes one partition and the exact caller-visible byte length is
+/// carried in a private plist key so non-sector-aligned inputs round-trip without
+/// exposing the mandatory 512-byte UDIF sector padding.
 /// </summary>
 public sealed class DmgWriter {
-  private const int SectorSize = 512;
-  private const int KolySize = 512;
-  private const int MishHeaderSize = 204;
-  private const int MishBlockSize = 40;
-  private const uint BlockTypeRaw = 0x00000001;
-  private const uint BlockTypeTerminator = 0xFFFFFFFF;
+  internal const int SectorSize = 512;
+  internal const int KolySize = 512;
+  internal const int MishHeaderSize = 204;
+  internal const int MishBlockSize = 40;
+  internal const uint BlockTypeRaw = 0x00000001;
+  internal const uint BlockTypeTerminator = 0xFFFFFFFF;
   private static readonly byte[] KolyMagic = "koly"u8.ToArray();
   private static readonly byte[] MishMagic = "mish"u8.ToArray();
 
@@ -38,17 +33,15 @@ public void AddPartition(string name, byte[] data) {
   public void WriteTo(Stream output) {
     ArgumentNullException.ThrowIfNull(output);
 
-    // Pad each partition to a sector boundary so sectorCount is exact.
-    var padded = new (string name, byte[] data)[_partitions.Count];
+    var padded = new (string name, byte[] data, long logicalSize)[_partitions.Count];
     for (var i = 0; i < _partitions.Count; i++) {
       var (name, data) = _partitions[i];
-      var paddedLen = ((data.Length + SectorSize - 1) / SectorSize) * SectorSize;
+      var paddedLen = AlignSector(data.Length);
       var buf = new byte[paddedLen];
       data.CopyTo(buf, 0);
-      padded[i] = (name, buf);
+      padded[i] = (name, buf, data.LongLength);
     }
 
-    // Compute layout: partition data sequentially from offset 0.
     var partitionOffsets = new long[padded.Length];
     long pos = 0;
     for (var i = 0; i < padded.Length; i++) {
@@ -57,96 +50,57 @@ public void WriteTo(Stream output) {
     }
     var dataForkLength = pos;
 
-    // Build mish blob per partition (raw block + terminator).
-    var mishBlobs = new byte[padded.Length][];
+    var entries = new List<(string Name, byte[] Mish, long LogicalSize)>(padded.Length);
     for (var i = 0; i < padded.Length; i++) {
       var sectorCount = (ulong)(padded[i].data.Length / SectorSize);
-      mishBlobs[i] = BuildMishBlob(
-        firstSector: 0,
-        sectorCount: sectorCount,
-        rawDataOffset: (ulong)partitionOffsets[i],
-        rawDataLength: (ulong)padded[i].data.Length);
+      entries.Add((padded[i].name,
+        BuildMishBlob(0, sectorCount, (ulong)partitionOffsets[i], (ulong)padded[i].data.Length),
+        padded[i].logicalSize));
     }
 
-    // Build XML plist after data fork.
-    var xml = BuildXmlPlist(padded, mishBlobs);
-    var xmlBytes = Encoding.UTF8.GetBytes(xml);
+    var xmlBytes = Encoding.UTF8.GetBytes(BuildXmlPlist(entries));
     var xmlOffset = pos;
-    pos += xmlBytes.Length;
 
-    // ---- Write data fork ----
-    foreach (var (_, data) in padded)
+    foreach (var (_, data, _) in padded)
       output.Write(data);
-
-    // ---- Write XML plist ----
     output.Write(xmlBytes);
 
-    // ---- Write koly trailer ----
-    Span<byte> koly = stackalloc byte[KolySize];
-    koly.Clear();
-    KolyMagic.CopyTo(koly);
-    BinaryPrimitives.WriteUInt32BigEndian(koly[4..], 4);              // version
-    BinaryPrimitives.WriteUInt32BigEndian(koly[8..], KolySize);       // header size
-    BinaryPrimitives.WriteUInt32BigEndian(koly[12..], 1);             // flags
-    BinaryPrimitives.WriteUInt64BigEndian(koly[16..], 0);             // running data fork offset
-    BinaryPrimitives.WriteUInt64BigEndian(koly[24..], 0);             // data fork offset (always 0 for unsegmented)
-    BinaryPrimitives.WriteUInt64BigEndian(koly[32..], (ulong)dataForkLength);
-    BinaryPrimitives.WriteUInt64BigEndian(koly[40..], 0);             // resource fork offset
-    BinaryPrimitives.WriteUInt64BigEndian(koly[48..], 0);             // resource fork length
-    BinaryPrimitives.WriteUInt32BigEndian(koly[56..], 1);             // segment number
-    BinaryPrimitives.WriteUInt32BigEndian(koly[60..], 1);             // segment count
-    // Segment GUID (16 bytes at 64): leave zero
-    BinaryPrimitives.WriteUInt32BigEndian(koly[80..], 0);             // data checksum type = none
-    BinaryPrimitives.WriteUInt32BigEndian(koly[84..], 0);             // data checksum size = 0
-    // 128 bytes data checksum at 88: zeros
-    BinaryPrimitives.WriteUInt64BigEndian(koly[216..], (ulong)xmlOffset);
-    BinaryPrimitives.WriteUInt64BigEndian(koly[224..], (ulong)xmlBytes.Length);
-    // 120 bytes reserved at 232: zeros
-    BinaryPrimitives.WriteUInt32BigEndian(koly[352..], 0);            // master checksum type = none
-    BinaryPrimitives.WriteUInt32BigEndian(koly[356..], 0);            // master checksum size = 0
-    // 128 bytes master checksum at 360: zeros
-    BinaryPrimitives.WriteUInt32BigEndian(koly[488..], 1);            // image variant
-    var totalSectors = (ulong)(dataForkLength / SectorSize);
-    BinaryPrimitives.WriteUInt64BigEndian(koly[492..], totalSectors); // sector count
-    output.Write(koly);
+    var totalSectors = padded.Aggregate<(string name, byte[] data, long logicalSize), ulong>(0UL,
+      (current, partition) => current + (ulong)(partition.data.Length / SectorSize));
+    output.Write(BuildKoly(xmlOffset, xmlBytes.LongLength, dataForkLength, totalSectors));
   }
 
-  // ── Mish blob ─────────────────────────────────────────────────────────────
+  internal static int AlignSector(int length) {
+    if (length < 0) throw new ArgumentOutOfRangeException(nameof(length));
+    return checked((length + SectorSize - 1) / SectorSize * SectorSize);
+  }
 
-  private static byte[] BuildMishBlob(ulong firstSector, ulong sectorCount,
+  internal static byte[] BuildMishBlob(ulong firstSector, ulong sectorCount,
       ulong rawDataOffset, ulong rawDataLength) {
-    // Two block entries: one raw covering all sectors, plus terminator.
     var blob = new byte[MishHeaderSize + 2 * MishBlockSize];
 
     MishMagic.CopyTo(blob, 0);
-    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(4), 1);                       // version
+    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(4), 1);
     BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(8), firstSector);
     BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(16), sectorCount);
-    BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(24), 0);                      // dataStart (unused by reader)
-    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(32), (uint)SectorSize);       // decompressedBufferRequested
-    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(36), 0);                      // blocksDescriptor
-    // 24 reserved + 4 checksumType + 4 checksumSize + 128 checksum data = zeros
-    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(200), 2);                     // numBlockEntries
+    BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(24), 0);
+    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(32), SectorSize);
+    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(36), 0);
+    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(200), 2);
 
-    // Block 0: raw
     var off = MishHeaderSize;
-    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(off + 0), BlockTypeRaw);
-    // 4 reserved bytes
-    BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(off + 8), 0);                 // sectorOffset (within partition)
+    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(off), BlockTypeRaw);
+    BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(off + 8), 0);
     BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(off + 16), sectorCount);
-    BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(off + 24), rawDataOffset);    // absolute file offset
+    BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(off + 24), rawDataOffset);
     BinaryPrimitives.WriteUInt64BigEndian(blob.AsSpan(off + 32), rawDataLength);
 
-    // Block 1: terminator
     off += MishBlockSize;
-    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(off + 0), BlockTypeTerminator);
-
+    BinaryPrimitives.WriteUInt32BigEndian(blob.AsSpan(off), BlockTypeTerminator);
     return blob;
   }
 
-  // ── XML plist ─────────────────────────────────────────────────────────────
-
-  private static string BuildXmlPlist((string name, byte[] data)[] partitions, byte[][] mishBlobs) {
+  internal static string BuildXmlPlist(IEnumerable<(string Name, byte[] Mish, long LogicalSize)> entries) {
     var sb = new StringBuilder();
     sb.AppendLine("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
     sb.AppendLine("<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">");
@@ -156,12 +110,8 @@ private static string BuildXmlPlist((string name, byte[] data)[] partitions, byt
     sb.AppendLine("  <dict>");
     sb.AppendLine("    <key>blkx</key>");
     sb.AppendLine("    <array>");
-    for (var i = 0; i < partitions.Length; i++) {
-      sb.AppendLine("      <dict>");
-      sb.Append("        <key>Name</key><string>").Append(EscapeXml(partitions[i].name)).AppendLine("</string>");
-      sb.Append("        <key>Data</key><data>").Append(Convert.ToBase64String(mishBlobs[i])).AppendLine("</data>");
-      sb.AppendLine("      </dict>");
-    }
+    foreach (var entry in entries)
+      sb.AppendLine(BuildBlkxDict(entry.Name, entry.Mish, entry.LogicalSize));
     sb.AppendLine("    </array>");
     sb.AppendLine("  </dict>");
     sb.AppendLine("</dict>");
@@ -169,7 +119,45 @@ private static string BuildXmlPlist((string name, byte[] data)[] partitions, byt
     return sb.ToString();
   }
 
-  private static string EscapeXml(string s) {
+  internal static string BuildBlkxDict(string name, byte[] mish, long logicalSize) {
+    var sb = new StringBuilder();
+    sb.AppendLine("      <dict>");
+    sb.Append("        <key>Name</key><string>").Append(EscapeXml(name)).AppendLine("</string>");
+    sb.Append("        <key>CWBLogicalSize</key><integer>").Append(logicalSize).AppendLine("</integer>");
+    sb.Append("        <key>Data</key><data>").Append(Convert.ToBase64String(mish)).AppendLine("</data>");
+    sb.Append("      </dict>");
+    return sb.ToString();
+  }
+
+  internal static byte[] BuildKoly(long xmlOffset, long xmlLength, long dataForkLength, ulong totalSectors,
+      byte[]? template = null) {
+    if (xmlOffset < 0 || xmlLength < 0 || dataForkLength < 0)
+      throw new ArgumentOutOfRangeException(nameof(xmlOffset));
+
+    var koly = template is { Length: KolySize } ? (byte[])template.Clone() : new byte[KolySize];
+    KolyMagic.CopyTo(koly, 0);
+    BinaryPrimitives.WriteUInt32BigEndian(koly.AsSpan(4), 4);
+    BinaryPrimitives.WriteUInt32BigEndian(koly.AsSpan(8), KolySize);
+    if (template == null) {
+      BinaryPrimitives.WriteUInt32BigEndian(koly.AsSpan(12), 1);
+      BinaryPrimitives.WriteUInt64BigEndian(koly.AsSpan(16), 0);
+      BinaryPrimitives.WriteUInt64BigEndian(koly.AsSpan(24), 0);
+      BinaryPrimitives.WriteUInt32BigEndian(koly.AsSpan(56), 1);
+      BinaryPrimitives.WriteUInt32BigEndian(koly.AsSpan(60), 1);
+      BinaryPrimitives.WriteUInt32BigEndian(koly.AsSpan(488), 1);
+    }
+
+    BinaryPrimitives.WriteUInt64BigEndian(koly.AsSpan(32), (ulong)dataForkLength);
+    BinaryPrimitives.WriteUInt64BigEndian(koly.AsSpan(216), (ulong)xmlOffset);
+    BinaryPrimitives.WriteUInt64BigEndian(koly.AsSpan(224), (ulong)xmlLength);
+    BinaryPrimitives.WriteUInt64BigEndian(koly.AsSpan(492), totalSectors);
+
+    koly.AsSpan(80, 136).Clear();
+    koly.AsSpan(352, 136).Clear();
+    return koly;
+  }
+
+  internal static string EscapeXml(string s) {
     return s.Replace("&", "&amp;").Replace("<", "&lt;").Replace(">", "&gt;")
             .Replace("\"", "&quot;").Replace("'", "&apos;");
   }
diff --git a/FileFormats/FileFormat.Dtb/DtbFormatDescriptor.cs b/FileFormats/FileFormat.Dtb/DtbFormatDescriptor.cs
index b2890b3ae..c4f448309 100644
--- a/FileFormats/FileFormat.Dtb/DtbFormatDescriptor.cs
+++ b/FileFormats/FileFormat.Dtb/DtbFormatDescriptor.cs
@@ -17,17 +17,17 @@ namespace FileFormat.Dtb;
 /// <list type="bullet">
 ///   <item><description><c>https://github.com/devicetree-org/devicetree-specification</c> — Devicetree Specification — defines the flattened (FDT/DTB) encoding</description></item>
 ///   <item><description><c>https://www.devicetree.org</c> — devicetree.org portal</description></item>
-///   <item><description><c>https://en.wikipedia.org/wiki/Device_tree</c> — background</description></item>
 /// </list>
 /// </summary>
-public sealed class DtbFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveCreatable {
+public sealed class DtbFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations,
+    IArchiveCreatable, IArchiveModifiable {
 
   public string Id => "Dtb";
   public string DisplayName => "Flattened Device Tree Blob";
   public FormatCategory Category => FormatCategory.Archive;
   public FormatCapabilities Capabilities =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate |
-    FormatCapabilities.CanTest |
+    FormatCapabilities.CanModify | FormatCapabilities.CanTest |
     FormatCapabilities.SupportsMultipleEntries | FormatCapabilities.SupportsDirectories;
   public string DefaultExtension => ".dtb";
   public IReadOnlyList<string> Extensions => [".dtb", ".dtbo"];
@@ -39,13 +39,7 @@ public sealed class DtbFormatDescriptor : IFormatDescriptor, IArchiveFormatOpera
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
   public string Description =>
-    "Flattened Device Tree Blob — BE structured description of hardware used by Linux/U-Boot. " +
-    "R-only: in-place R/W is not honestly available because the 40-byte FDT header carries " +
-    "totalsize / off_dt_strings / off_dt_struct / size_dt_struct / size_dt_strings fields whose " +
-    "values cascade through every property add/remove. Any single-byte change to the struct or " +
-    "strings block would require rewriting all four header offsets plus shifting every " +
-    "downstream byte of the blob — that's a rebuild, not an in-place mutation, so promoting " +
-    "to CanModify would mis-advertise the surface.";
+    "Flattened Device Tree Blob — hierarchy-preserving create/add/replace/remove with reservation and boot CPU preservation.";
 
   public List<ArchiveEntryInfo> List(Stream stream, string? password) =>
     BuildEntries(stream).Select((e, i) => new ArchiveEntryInfo(
@@ -60,15 +54,6 @@ public void Extract(Stream stream, string outputDir, string? password, string[]?
     }
   }
 
-  /// <summary>
-  /// WORM creation: emits a minimal valid FDT v17 blob whose root node carries
-  /// each input as a leaf property. The synthetic <c>metadata.ini</c> + any
-  /// reader-emitted <c>.txt</c>/<c>.bin</c> suffixes are stripped from the
-  /// archive name before sanitisation so a list-then-create round-trip lands at
-  /// the same property name. Property names are sanitised to the
-  /// devicetree-spec character set; collisions in the input list are preserved
-  /// as repeated FDT_PROP records.
-  /// </summary>
   public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
     ArgumentNullException.ThrowIfNull(output);
     ArgumentNullException.ThrowIfNull(inputs);
@@ -77,27 +62,27 @@ public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, Format
       if (i.IsDirectory) continue;
       var leaf = Path.GetFileName(i.ArchiveName);
       if (string.Equals(leaf, "metadata.ini", StringComparison.OrdinalIgnoreCase)) continue;
-      // Strip reader-emitted ".txt" / ".bin" suffixes so the property name on
-      // round-trip matches the original property name in the input DTB.
-      if (leaf.EndsWith(".txt", StringComparison.OrdinalIgnoreCase) ||
-          leaf.EndsWith(".bin", StringComparison.OrdinalIgnoreCase))
-        leaf = leaf[..^4];
-      list.Add((leaf, i.ReadContent()));
+      list.Add((i.ArchiveName, i.ReadContent()));
     }
     DtbWriter.Write(output, list);
   }
 
+  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)
+    => DtbModifier.Add(archive, inputs);
+
+  public void Remove(Stream archive, string[] entryNames)
+    => DtbModifier.Remove(archive, entryNames);
+
   private static List<(string Name, byte[] Data, string Method)> BuildEntries(Stream stream) {
+    if (stream.CanSeek) stream.Position = 0;
     using var ms = new MemoryStream();
     stream.CopyTo(ms);
-    var fdt = DtbReader.Read(ms.GetBuffer().AsSpan(0, (int)ms.Length));
+    var fdt = DtbReader.Read(ms.GetBuffer().AsSpan(0, checked((int)ms.Length)));
 
     var entries = new List<(string, byte[], string)> {
       ("metadata.ini", BuildMetadata(fdt), "stored"),
     };
 
-    // Names can collide (same property name reached through NOP-walked ambiguity);
-    // disambiguate with an auto-increment suffix per collision.
     var seen = new Dictionary<string, int>(StringComparer.Ordinal);
     foreach (var p in fdt.Properties) {
       var asText = TryStringifyPropertyValue(p.Data);
@@ -117,14 +102,9 @@ public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, Format
     return entries;
   }
 
-  /// <summary>
-  /// Returns a newline-separated decoded string when <paramref name="data"/> is
-  /// entirely printable ASCII plus NUL separators (the common <c>compatible</c>
-  /// pattern), or null for binary cell/byte data.
-  /// </summary>
   private static string? TryStringifyPropertyValue(byte[] data) {
     if (data.Length == 0) return "";
-    if (data[^1] != 0) return null; // must be NUL-terminated
+    if (data[^1] != 0) return null;
     foreach (var b in data)
       if (b != 0 && (b < 0x20 || b > 0x7E)) return null;
     var parts = Encoding.ASCII.GetString(data, 0, data.Length - 1).Split('\0');
diff --git a/FileFormats/FileFormat.Dtb/DtbModifier.cs b/FileFormats/FileFormat.Dtb/DtbModifier.cs
new file mode 100644
index 000000000..fb7adda46
--- /dev/null
+++ b/FileFormats/FileFormat.Dtb/DtbModifier.cs
@@ -0,0 +1,59 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+using static Compression.Registry.FormatHelpers;
+
+namespace FileFormat.Dtb;
+
+/// <summary>Rewrites mutable DTB structure/string blocks while preserving reservations and boot CPU metadata.</summary>
+internal static class DtbModifier {
+  public static void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
+    ArgumentNullException.ThrowIfNull(inputs);
+    Mutate(archive, properties => {
+      foreach (var (name, data) in FilesOnly(inputs)) {
+        if (string.Equals(Path.GetFileName(name), "metadata.ini", StringComparison.OrdinalIgnoreCase)) continue;
+        var incoming = DtbWriter.FromArchiveEntry(name, data);
+        properties.RemoveAll(p => SameProperty(p, incoming));
+        properties.Add(incoming);
+      }
+    });
+  }
+
+  public static void Remove(Stream archive, string[] entryNames) {
+    ArgumentNullException.ThrowIfNull(entryNames);
+    Mutate(archive, properties => {
+      foreach (var name in entryNames) {
+        if (string.Equals(Path.GetFileName(name), "metadata.ini", StringComparison.OrdinalIgnoreCase)) continue;
+        var target = DtbWriter.FromArchiveEntry(name, []);
+        properties.RemoveAll(p => SameProperty(p, target));
+      }
+    });
+  }
+
+  private static void Mutate(Stream archive, Action<List<DtbWriter.PropertySpec>> edit) {
+    ArgumentNullException.ThrowIfNull(archive);
+    if (!archive.CanRead || !archive.CanWrite || !archive.CanSeek)
+      throw new ArgumentException("DTB mutation requires a seekable read/write stream.", nameof(archive));
+    if (archive.Length > int.MaxValue)
+      throw new NotSupportedException("DTB images larger than 2 GiB are not supported.");
+
+    archive.Position = 0;
+    var bytes = new byte[checked((int)archive.Length)];
+    archive.ReadExactly(bytes);
+    var fdt = DtbReader.Read(bytes);
+    var properties = fdt.Properties
+      .Select(p => new DtbWriter.PropertySpec(p.NodePath, p.Name, p.Data))
+      .ToList();
+    edit(properties);
+
+    using var rebuilt = new MemoryStream();
+    DtbWriter.Write(rebuilt, properties, fdt.Reservations, fdt.Header.BootCpuidPhys);
+    archive.Position = 0;
+    rebuilt.Position = 0;
+    rebuilt.CopyTo(archive);
+    archive.SetLength(archive.Position);
+  }
+
+  private static bool SameProperty(DtbWriter.PropertySpec a, DtbWriter.PropertySpec b) =>
+    string.Equals(a.NodePath.TrimEnd('/'), b.NodePath.TrimEnd('/'), StringComparison.Ordinal) &&
+    string.Equals(a.Name, b.Name, StringComparison.Ordinal);
+}
diff --git a/FileFormats/FileFormat.Dtb/DtbWriter.cs b/FileFormats/FileFormat.Dtb/DtbWriter.cs
index 43425cf6f..6b2f82637 100644
--- a/FileFormats/FileFormat.Dtb/DtbWriter.cs
+++ b/FileFormats/FileFormat.Dtb/DtbWriter.cs
@@ -4,142 +4,113 @@
 
 namespace FileFormat.Dtb;
 
-/// <summary>
-/// WORM writer for the Flattened Device Tree Blob (FDT v17) format. Produces a
-/// minimal valid DTB where every input becomes a leaf property on the root node.
-/// The root node carries spec-required <c>#address-cells = &lt;2&gt;</c> and
-/// <c>#size-cells = &lt;2&gt;</c> properties so the blob round-trips through
-/// <c>fdtdump</c> / <c>dtc</c> consumers without warnings.
-/// </summary>
-/// <remarks>
-/// Layout per Devicetree Specification v0.4:
-/// <list type="bullet">
-///   <item>40-byte BE header: magic, totalsize, off_dt_struct, off_dt_strings,
-///         off_mem_rsvmap, version=17, last_comp_version=16, boot_cpuid_phys=0,
-///         size_dt_strings, size_dt_struct.</item>
-///   <item>Memory reservation block: one terminating <c>{0, 0}</c> 16-byte entry.</item>
-///   <item>Structure block: <c>FDT_BEGIN_NODE "" \0 (padding)</c>
-///         + per-property <c>FDT_PROP len nameoff data (padding)</c>
-///         + <c>FDT_END_NODE</c> + <c>FDT_END</c>.</item>
-///   <item>Strings block: NUL-terminated property names.</item>
-/// </list>
-/// All values are big-endian per the spec. Structure-block tokens and property
-/// payloads are 4-byte aligned.
-/// </remarks>
+/// <summary>Writer for Flattened Device Tree Blob (FDT v17) images.</summary>
 public sealed class DtbWriter {
+  internal sealed record PropertySpec(string NodePath, string Name, byte[] Data);
 
-  /// <summary>
-  /// Writes a minimal FDT blob to <paramref name="output"/> whose root node
-  /// contains one property per input. Each input's archive-name leaf is used as
-  /// the property name; the raw bytes become the property value. Names are
-  /// deduplicated in the strings block, but each occurrence still gets its own
-  /// FDT_PROP record (multiple identical property names on one node are
-  /// technically nonconforming, but matching the input list verbatim is the
-  /// honest WORM behaviour).
-  /// </summary>
   public static void Write(Stream output, IReadOnlyList<(string Name, byte[] Data)> inputs) {
-    ArgumentNullException.ThrowIfNull(output);
     ArgumentNullException.ThrowIfNull(inputs);
+    var properties = inputs.Select(i => FromArchiveEntry(i.Name, i.Data)).ToList();
+    Write(output, properties, [], 0, addDefaultRootCells: true);
+  }
+
+  internal static void Write(Stream output, IReadOnlyList<PropertySpec> properties,
+      IReadOnlyList<DtbReader.Reservation> reservations, uint bootCpuidPhys,
+      bool addDefaultRootCells = false) {
+    ArgumentNullException.ThrowIfNull(output);
+    ArgumentNullException.ThrowIfNull(properties);
+    ArgumentNullException.ThrowIfNull(reservations);
+
+    var root = new Node("");
+    foreach (var property in properties) {
+      var node = root;
+      foreach (var segment in property.NodePath.Trim('/').Split('/', StringSplitOptions.RemoveEmptyEntries))
+        node = node.GetOrAdd(SanitiseNodeName(segment));
+      node.Properties.Add(new PropertySpec(property.NodePath,
+        SanitisePropertyName(property.Name), property.Data));
+    }
+
+    if (addDefaultRootCells) {
+      EnsureCellProperty(root, "#address-cells", 2);
+      EnsureCellProperty(root, "#size-cells", 2);
+    }
 
-    // Build the strings block first so we can compute name offsets up front.
     using var strings = new MemoryStream();
     var stringOffsets = new Dictionary<string, uint>(StringComparer.Ordinal);
-
     uint InternName(string name) {
-      if (stringOffsets.TryGetValue(name, out var off)) return off;
-      off = (uint)strings.Length;
-      stringOffsets[name] = off;
+      if (stringOffsets.TryGetValue(name, out var existing)) return existing;
+      var offset = checked((uint)strings.Length);
+      stringOffsets[name] = offset;
       var bytes = Encoding.ASCII.GetBytes(name);
-      strings.Write(bytes, 0, bytes.Length);
+      strings.Write(bytes);
       strings.WriteByte(0);
-      return off;
+      return offset;
     }
 
-    // Pre-intern the spec-required root-node properties so they appear early in
-    // the strings block (fdtdump-friendly).
-    var addrCellsOff = InternName("#address-cells");
-    var sizeCellsOff = InternName("#size-cells");
-
-    // Build the structure block.
-    using var structBlk = new MemoryStream();
+    foreach (var node in root.Walk())
+      foreach (var property in node.Properties)
+        _ = InternName(property.Name);
 
-    void WriteToken(uint token) {
-      Span<byte> tk = stackalloc byte[4];
-      BinaryPrimitives.WriteUInt32BigEndian(tk, token);
-      structBlk.Write(tk);
-    }
+    using var structBlock = new MemoryStream();
+    WriteNode(root, structBlock, InternName);
+    WriteToken(structBlock, DtbReader.FDT_END);
 
-    void AlignStruct() {
-      while ((structBlk.Length & 3) != 0) structBlk.WriteByte(0);
-    }
+    const int headerSize = 40;
+    var reservationSize = checked((reservations.Count + 1) * 16);
+    var structOffset = checked(headerSize + reservationSize);
+    var structSize = checked((uint)structBlock.Length);
+    var stringsOffset = checked((uint)(structOffset + structSize));
+    var stringsSize = checked((uint)strings.Length);
+    var totalSize = checked(stringsOffset + stringsSize);
 
-    void WriteProp(uint nameOff, ReadOnlySpan<byte> data) {
-      WriteToken(DtbReader.FDT_PROP);
-      Span<byte> hdr = stackalloc byte[8];
-      BinaryPrimitives.WriteUInt32BigEndian(hdr[..4], (uint)data.Length);
-      BinaryPrimitives.WriteUInt32BigEndian(hdr[4..], nameOff);
-      structBlk.Write(hdr);
-      if (data.Length > 0) structBlk.Write(data);
-      AlignStruct();
-    }
-
-    // FDT_BEGIN_NODE for root ("" name, NUL-terminated, padded).
-    WriteToken(DtbReader.FDT_BEGIN_NODE);
-    structBlk.WriteByte(0);
-    AlignStruct();
-
-    // Root: #address-cells = <2>, #size-cells = <2> (big-endian u32).
-    Span<byte> twoCells = stackalloc byte[4];
-    BinaryPrimitives.WriteUInt32BigEndian(twoCells, 2);
-    WriteProp(addrCellsOff, twoCells);
-    WriteProp(sizeCellsOff, twoCells);
-
-    // One FDT_PROP per input, in order.
-    foreach (var (name, data) in inputs) {
-      var safe = SanitisePropertyName(name);
-      var off = InternName(safe);
-      WriteProp(off, data);
-    }
-
-    WriteToken(DtbReader.FDT_END_NODE);
-    WriteToken(DtbReader.FDT_END);
-
-    // Assemble final blob.
-    const int HeaderSize = 40;
-    const int MemRsvmapSize = 16; // one terminator {0, 0}
-    var structOff = HeaderSize + MemRsvmapSize;
-    var structSize = (uint)structBlk.Length;
-    var stringsOff = (uint)(structOff + structSize);
-    var stringsSize = (uint)strings.Length;
-    var totalSize = stringsOff + stringsSize;
-
-    Span<byte> header = stackalloc byte[HeaderSize];
+    Span<byte> header = stackalloc byte[headerSize];
     BinaryPrimitives.WriteUInt32BigEndian(header[0..4], DtbReader.Magic);
     BinaryPrimitives.WriteUInt32BigEndian(header[4..8], totalSize);
-    BinaryPrimitives.WriteUInt32BigEndian(header[8..12], (uint)structOff);
-    BinaryPrimitives.WriteUInt32BigEndian(header[12..16], stringsOff);
-    BinaryPrimitives.WriteUInt32BigEndian(header[16..20], HeaderSize); // off_mem_rsvmap
-    BinaryPrimitives.WriteUInt32BigEndian(header[20..24], 17);          // version
-    BinaryPrimitives.WriteUInt32BigEndian(header[24..28], 16);          // last_comp_version
-    BinaryPrimitives.WriteUInt32BigEndian(header[28..32], 0);           // boot_cpuid_phys
+    BinaryPrimitives.WriteUInt32BigEndian(header[8..12], (uint)structOffset);
+    BinaryPrimitives.WriteUInt32BigEndian(header[12..16], stringsOffset);
+    BinaryPrimitives.WriteUInt32BigEndian(header[16..20], headerSize);
+    BinaryPrimitives.WriteUInt32BigEndian(header[20..24], 17);
+    BinaryPrimitives.WriteUInt32BigEndian(header[24..28], 16);
+    BinaryPrimitives.WriteUInt32BigEndian(header[28..32], bootCpuidPhys);
     BinaryPrimitives.WriteUInt32BigEndian(header[32..36], stringsSize);
     BinaryPrimitives.WriteUInt32BigEndian(header[36..40], structSize);
-
     output.Write(header);
-    // 16-byte memory reservation terminator (both 64-bit fields zero).
-    Span<byte> rsv = stackalloc byte[MemRsvmapSize];
-    output.Write(rsv);
-    structBlk.Position = 0;
-    structBlk.CopyTo(output);
+
+    Span<byte> reservation = stackalloc byte[16];
+    foreach (var item in reservations) {
+      reservation.Clear();
+      BinaryPrimitives.WriteUInt64BigEndian(reservation[..8], item.Address);
+      BinaryPrimitives.WriteUInt64BigEndian(reservation[8..], item.Size);
+      output.Write(reservation);
+    }
+    reservation.Clear();
+    output.Write(reservation);
+
+    structBlock.Position = 0;
+    structBlock.CopyTo(output);
     strings.Position = 0;
     strings.CopyTo(output);
   }
 
-  /// <summary>
-  /// Coerces an input archive name into a property name valid per
-  /// devicetree-specification §2.2.4 (ASCII subset of property-name chars).
-  /// Reserved chars are replaced with <c>_</c>; the leaf of any path is used.
-  /// </summary>
+  internal static PropertySpec FromArchiveEntry(string archiveName, byte[] data) {
+    var normalized = archiveName.Replace('\\', '/').Trim('/');
+    var slash = normalized.LastIndexOf('/');
+    var directory = slash < 0 ? "" : normalized[..slash];
+    var nodePath = directory.Length == 0 || directory.Equals("_root", StringComparison.OrdinalIgnoreCase)
+      ? "/"
+      : "/" + directory;
+    var leaf = slash < 0 ? normalized : normalized[(slash + 1)..];
+    var isText = leaf.EndsWith(".txt", StringComparison.OrdinalIgnoreCase);
+    if (isText || leaf.EndsWith(".bin", StringComparison.OrdinalIgnoreCase))
+      leaf = leaf[..^4];
+
+    if (isText && (data.Length == 0 || data[^1] != 0)) {
+      var text = Encoding.UTF8.GetString(data).Replace("\r\n", "\n");
+      data = Encoding.UTF8.GetBytes(text.Replace('\n', '\0') + "\0");
+    }
+    return new PropertySpec(nodePath, SanitisePropertyName(leaf), data);
+  }
+
   public static string SanitisePropertyName(string archiveName) {
     var leaf = archiveName;
     var slash = leaf.LastIndexOfAny(['/', '\\']);
@@ -148,8 +119,7 @@ public static string SanitisePropertyName(string archiveName) {
 
     var sb = new StringBuilder(leaf.Length);
     foreach (var c in leaf) {
-      var keep =
-        c is >= '0' and <= '9'
+      var keep = c is >= '0' and <= '9'
         || c is >= 'a' and <= 'z'
         || c is >= 'A' and <= 'Z'
         || c is ',' or '.' or '_' or '+' or '?' or '#' or '-';
@@ -157,4 +127,78 @@ public static string SanitisePropertyName(string archiveName) {
     }
     return sb.Length == 0 ? "_" : sb.ToString();
   }
+
+  private static string SanitiseNodeName(string name) {
+    if (name.Length == 0) return "_";
+    var sb = new StringBuilder(name.Length);
+    foreach (var c in name) {
+      var keep = c is >= '0' and <= '9'
+        || c is >= 'a' and <= 'z'
+        || c is >= 'A' and <= 'Z'
+        || c is ',' or '.' or '_' or '+' or '?' or '#' or '-' or '@';
+      sb.Append(keep ? c : '_');
+    }
+    return sb.ToString();
+  }
+
+  private static void EnsureCellProperty(Node root, string name, uint value) {
+    if (root.Properties.Any(p => string.Equals(p.Name, name, StringComparison.Ordinal))) return;
+    var data = new byte[4];
+    BinaryPrimitives.WriteUInt32BigEndian(data, value);
+    root.Properties.Insert(0, new PropertySpec("/", name, data));
+  }
+
+  private static void WriteNode(Node node, Stream output, Func<string, uint> internName) {
+    WriteToken(output, DtbReader.FDT_BEGIN_NODE);
+    var name = Encoding.ASCII.GetBytes(node.Name);
+    output.Write(name);
+    output.WriteByte(0);
+    Align4(output);
+
+    var propertyHeader = new byte[8];
+    foreach (var property in node.Properties) {
+      WriteToken(output, DtbReader.FDT_PROP);
+      BinaryPrimitives.WriteUInt32BigEndian(propertyHeader.AsSpan(0, 4), checked((uint)property.Data.Length));
+      BinaryPrimitives.WriteUInt32BigEndian(propertyHeader.AsSpan(4, 4), internName(property.Name));
+      output.Write(propertyHeader);
+      output.Write(property.Data);
+      Align4(output);
+    }
+
+    foreach (var child in node.Children)
+      WriteNode(child, output, internName);
+    WriteToken(output, DtbReader.FDT_END_NODE);
+  }
+
+  private static void WriteToken(Stream output, uint token) {
+    Span<byte> bytes = stackalloc byte[4];
+    BinaryPrimitives.WriteUInt32BigEndian(bytes, token);
+    output.Write(bytes);
+  }
+
+  private static void Align4(Stream output) {
+    while ((output.Position & 3) != 0) output.WriteByte(0);
+  }
+
+  private sealed class Node(string name) {
+    private readonly Dictionary<string, Node> _childrenByName = new(StringComparer.Ordinal);
+    public string Name { get; } = name;
+    public List<PropertySpec> Properties { get; } = [];
+    public List<Node> Children { get; } = [];
+
+    public Node GetOrAdd(string childName) {
+      if (_childrenByName.TryGetValue(childName, out var child)) return child;
+      child = new Node(childName);
+      _childrenByName.Add(childName, child);
+      Children.Add(child);
+      return child;
+    }
+
+    public IEnumerable<Node> Walk() {
+      yield return this;
+      foreach (var child in Children)
+        foreach (var descendant in child.Walk())
+          yield return descendant;
+    }
+  }
 }
diff --git a/FileFormats/FileFormat.Ewf/EwfFormatDescriptor.cs b/FileFormats/FileFormat.Ewf/EwfFormatDescriptor.cs
index 7b0b4bba5..653a4e2e9 100644
--- a/FileFormats/FileFormat.Ewf/EwfFormatDescriptor.cs
+++ b/FileFormats/FileFormat.Ewf/EwfFormatDescriptor.cs
@@ -1,194 +1,425 @@
 #pragma warning disable CS1591
+using System.Buffers.Binary;
 using System.Globalization;
 using System.Text;
 using Compression.Registry;
+using FileFormat.Zlib;
 using static Compression.Registry.FormatHelpers;
 
 namespace FileFormat.Ewf;
 
 /// <summary>
-/// Pseudo-archive descriptor for EnCase Expert Witness Format (EWF) forensic
-/// images (.e01/.ewf/.l01). Surfaces each parsed section as a separate entry
-/// along with a <c>metadata.ini</c> summarising acquisition parameters pulled
-/// from the <c>header</c>/<c>header2</c>/<c>hash</c>/<c>digest</c> sections.
-/// Full sector decompression + segment chaining across multi-file sets is
-/// deferred to a later phase — forensic tooling (libewf, EnCase) can decode
-/// the per-section data directly.
-///
-/// References:
-/// <list type="bullet">
-///   <item><description><c>https://github.com/libyal/libewf</c> — libewf — canonical open-source implementation; its documentation folder carries Joachim Metz's EWF/EWF2 format specs</description></item>
-///   <item><description>ASR Data "Expert Witness Compression Format" — the original format the EnCase .E01 family derives from</description></item>
-/// </list>
+/// EnCase Expert Witness Format (EWF/E01) descriptor. The mutable archive
+/// surface is the forensic image's logical <c>media.raw</c> payload; parsed
+/// section payloads remain available as read-only diagnostic entries. Existing
+/// physical EVF images can therefore be replaced, purged, canonicalized,
+/// compressed and shrunk without pretending their internal sections are user
+/// files.
 /// </summary>
-public sealed class EwfFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveCreatable {
+public sealed class EwfFormatDescriptor :
+  IFormatDescriptor,
+  IArchiveFormatOperations,
+  IArchiveCreatable,
+  IArchiveModifiable,
+  IArchiveDefragmentable,
+  IArchiveShrinkable,
+  IArchiveLayoutMap,
+  ILayoutOptimizable,
+  IFormatOptionsSchema {
+
   public string Id => "Ewf";
   public string DisplayName => "EnCase EWF (E01)";
   public FormatCategory Category => FormatCategory.Archive;
   public FormatCapabilities Capabilities =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract |
-    FormatCapabilities.CanTest | FormatCapabilities.CanCreate |
-    FormatCapabilities.SupportsMultipleEntries;
+    FormatCapabilities.CanTest | FormatCapabilities.CanCreate | FormatCapabilities.CanModify |
+    FormatCapabilities.SupportsOptimize | FormatCapabilities.SupportsMultipleEntries;
   public string DefaultExtension => ".e01";
   public IReadOnlyList<string> Extensions => [".e01", ".ewf", ".l01"];
   public IReadOnlyList<string> CompoundExtensions => [];
   public IReadOnlyList<MagicSignature> MagicSignatures => [
-    new([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00], Offset: 0, Confidence: 0.95), // "EVF\t\r\n\xFF\x00"
-    new([0x4C, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00], Offset: 0, Confidence: 0.95), // "LVF\t\r\n\xFF\x00"
+    new([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00], Offset: 0, Confidence: 0.95),
+    new([0x4C, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00], Offset: 0, Confidence: 0.95),
+  ];
+  public IReadOnlyList<FormatMethodInfo> Methods => [
+    new("stored", "Stored chunks", SupportsOptimize: true),
+    new("zlib", "Zlib-compressed chunks", SupportsOptimize: true),
   ];
-  public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored")];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
   public string Description =>
-    "EnCase Expert Witness Format forensic image; surfaces section descriptors " +
-    "(header, volume, sectors, table, hash, digest, done/next) as entries.";
+    "EnCase EWF forensic media image with logical-media R/W, canonical repack and chunk compression optimization.";
+
+  public IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; } = [
+    new FormatOptionDescriptor(
+      Key: "CompressChunks",
+      DisplayName: "Compress media chunks",
+      Kind: FormatOptionKind.Boolean,
+      Default: "false",
+      Description: "Zlib-compress each 32 KiB EWF media chunk when compression makes that chunk smaller."),
+  ];
 
-  public List<ArchiveEntryInfo> List(Stream stream, string? password) =>
-    BuildEntries(stream).Select((e, i) => new ArchiveEntryInfo(
-      i, e.Name, e.Data.LongLength, e.Data.LongLength, "stored", false, false, null
-    )).ToList();
+  public List<ArchiveEntryInfo> List(Stream stream, string? password) {
+    var image = ReadImage(stream);
+    var result = new List<ArchiveEntryInfo>();
+    var index = 0;
+    if (!image.IsLogical) {
+      try {
+        var media = EwfReader.ExtractMedia(image);
+        result.Add(new ArchiveEntryInfo(index++, "media.raw", media.LongLength, MediaStoredBytes(image),
+          HasCompressedChunks(image) ? "mixed/zlib" : "stored", false, false, null, "media"));
+      } catch (NotSupportedException) {
+        // Keep diagnostics available even when this EWF profile cannot expose media.raw.
+      } catch (InvalidDataException) { }
+    }
+
+    var metadata = BuildMetadata(image);
+    result.Add(new ArchiveEntryInfo(index++, "metadata.ini", metadata.LongLength, metadata.LongLength,
+      "generated", false, false, null, "metadata"));
+    foreach (var (section, i) in image.Sections.Select((s, i) => (s, i))) {
+      var name = $"section_{i:D2}_{SafeNameSegment(section.Type)}.bin";
+      result.Add(new ArchiveEntryInfo(index++, name, section.Payload.LongLength, section.Payload.LongLength,
+        "stored", false, false, null, "section"));
+    }
+    return result;
+  }
 
   public void Extract(Stream stream, string outputDir, string? password, string[]? files) {
-    foreach (var e in BuildEntries(stream)) {
-      if (files != null && files.Length > 0 && !MatchesFilter(e.Name, files)) continue;
-      WriteFile(outputDir, e.Name, e.Data);
+    var image = ReadImage(stream);
+    if (!image.IsLogical && MatchesRequested("media.raw", files)) {
+      try { WriteFile(outputDir, "media.raw", EwfReader.ExtractMedia(image)); }
+      catch (NotSupportedException) { }
+    }
+    if (MatchesRequested("metadata.ini", files))
+      WriteFile(outputDir, "metadata.ini", BuildMetadata(image));
+    for (var i = 0; i < image.Sections.Count; ++i) {
+      var section = image.Sections[i];
+      var name = $"section_{i:D2}_{SafeNameSegment(section.Type)}.bin";
+      if (MatchesRequested(name, files)) WriteFile(outputDir, name, section.Payload);
+    }
+  }
+
+  public Stream OpenEntry(Stream archive, string entryName, string? password) {
+    var image = ReadImage(archive);
+    byte[] data;
+    if (string.Equals(entryName, "media.raw", StringComparison.OrdinalIgnoreCase))
+      data = EwfReader.ExtractMedia(image);
+    else if (string.Equals(entryName, "metadata.ini", StringComparison.OrdinalIgnoreCase))
+      data = BuildMetadata(image);
+    else {
+      data = [];
+      for (var i = 0; i < image.Sections.Count; ++i) {
+        var section = image.Sections[i];
+        var name = $"section_{i:D2}_{SafeNameSegment(section.Type)}.bin";
+        if (!string.Equals(name, entryName, StringComparison.OrdinalIgnoreCase)) continue;
+        data = section.Payload;
+        break;
+      }
     }
+    return new Compression.Registry.Streaming.BoundedEntryStream(
+      new MemoryStream(data, writable: false), data.Length, leaveOpen: false);
+  }
+
+  public byte[] ExtractEntryToMemory(Stream archive, string entryName, string? password) {
+    using var entry = this.OpenEntry(archive, entryName, password);
+    using var result = new MemoryStream();
+    entry.CopyTo(result);
+    return result.ToArray();
   }
 
-  /// <summary>
-  /// Creates a single-segment .E01 image wrapping the supplied input(s) as raw
-  /// media. EWF is a media-wrapper format, so file inputs are concatenated into
-  /// one contiguous raw image (the common case is a single disk-image input).
-  /// The produced image is accepted by libewf's <c>ewfverify</c>.
-  /// </summary>
   public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
     ArgumentNullException.ThrowIfNull(output);
     ArgumentNullException.ThrowIfNull(inputs);
+    var media = ReadCreateMedia(inputs);
+    var compress = ParseBool(options?.FormatSpecific?.GetValueOrDefault("CompressChunks"), false);
+    var writer = new EwfWriter { CompressChunks = compress };
+    output.Write(writer.Build(media));
+  }
 
-    byte[] media;
-    var files = inputs.Where(i => !i.IsDirectory).ToList();
-    if (files.Count == 0)
-      media = [];
-    else if (files.Count == 1)
-      media = files[0].ReadContent();
-    else {
-      using var ms = new MemoryStream();
-      foreach (var f in files) ms.Write(f.ReadContent());
-      media = ms.ToArray();
+  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
+    ArgumentNullException.ThrowIfNull(archive);
+    ArgumentNullException.ThrowIfNull(inputs);
+    var files = inputs.Where(i => !i.IsDirectory).ToArray();
+    if (files.Length == 0) return;
+    if (files.Length != 1)
+      throw new NotSupportedException("EWF existing-image mutation accepts one logical media payload at a time.");
+
+    var existing = ReadImage(archive);
+    if (existing.IsLogical)
+      throw new NotSupportedException("LVF logical-evidence mutation is not implemented; physical EVF/E01 is R/W.");
+    RewriteMedia(archive, files[0].ReadContent(), existing, HasCompressedChunks(existing));
+  }
+
+  public void Remove(Stream archive, string[] entryNames) {
+    ArgumentNullException.ThrowIfNull(archive);
+    ArgumentNullException.ThrowIfNull(entryNames);
+    if (!entryNames.Any(n => string.Equals(n, "media.raw", StringComparison.OrdinalIgnoreCase))) {
+      if (entryNames.Length > 0)
+        throw new NotSupportedException("EWF section_*/metadata.ini entries are diagnostic views; remove 'media.raw' to empty the forensic image.");
+      return;
     }
+    var existing = ReadImage(archive);
+    if (existing.IsLogical)
+      throw new NotSupportedException("LVF logical-evidence mutation is not implemented; physical EVF/E01 is R/W.");
+    RewriteMedia(archive, [], existing, HasCompressedChunks(existing));
+  }
 
-    var image = new EwfWriter().Build(media);
-    output.Write(image);
+  public void Purge(Stream archive) {
+    ArgumentNullException.ThrowIfNull(archive);
+    var existing = ReadImage(archive);
+    if (existing.IsLogical)
+      throw new NotSupportedException("LVF logical-evidence purge is not implemented; physical EVF/E01 is purgeable.");
+    RewriteMedia(archive, [], existing, HasCompressedChunks(existing));
   }
 
-  private static List<(string Name, byte[] Data)> BuildEntries(Stream stream) {
+  public void Defragment(Stream archive)
+    => this.Defragment(archive, new DefragOptions());
+
+  public void Defragment(Stream archive, DefragOptions options) {
+    ArgumentNullException.ThrowIfNull(options);
+    var existing = ReadImage(archive);
+    var media = EwfReader.ExtractMedia(existing);
+    options.OnProgress?.Invoke(new DefragProgressEvent(
+      "scanning", 0, 0, -1, archive.Length, this.EnumerateLayout(archive).ToList(),
+      "Reading EWF media/chunk table"));
+    options.CancellationToken.ThrowIfCancellationRequested();
+
+    var writer = WriterFrom(existing, HasCompressedChunks(existing));
+    var rebuilt = writer.Build(media);
+    VerifyMedia(rebuilt, media);
+    options.CancellationToken.ThrowIfCancellationRequested();
+    options.OnProgress?.Invoke(new DefragProgressEvent(
+      "writing", 0.9, Math.Max(0, archive.Length - 1), Math.Max(0, rebuilt.LongLength - 1),
+      Math.Max(archive.Length, rebuilt.LongLength), null, "Staged canonical EVF complete"));
+    options.OnProgress?.Invoke(new DefragProgressEvent(
+      "committing", 0.99, -1, -1, rebuilt.LongLength, null,
+      "Committing verified EVF rebuild"));
+    CommitBytes(archive, rebuilt);
+    options.OnProgress?.Invoke(new DefragProgressEvent(
+      "complete", 1, -1, -1, archive.Length, this.EnumerateLayout(archive).ToList(),
+      "EWF canonicalization complete"));
+  }
+
+  public void Shrink(Stream input, Stream output) {
+    ArgumentNullException.ThrowIfNull(input);
+    ArgumentNullException.ThrowIfNull(output);
+    var original = ReadAll(input);
+    var image = EwfReader.Read(original);
+    var media = EwfReader.ExtractMedia(image);
+    var stored = WriterFrom(image, false).Build(media);
+    var compressed = WriterFrom(image, true).Build(media);
+    VerifyMedia(stored, media);
+    VerifyMedia(compressed, media);
+    var best = new[] { original, stored, compressed }.MinBy(a => a.LongLength)!;
+    output.Position = 0;
+    output.SetLength(0);
+    output.Write(best);
+  }
+
+  public LayoutAnalysis AnalyzeLayout(Stream image) {
+    var parsed = ReadImage(image);
+    long mediaBytes = 0;
+    try { mediaBytes = EwfReader.ExtractMedia(parsed).LongLength; } catch { }
+    return new LayoutAnalysis {
+      ImageSize = image.CanSeek ? image.Length : parsed.TotalFileSize,
+      CurrentUnitSize = EwfWriter.ChunkSize,
+      CurrentSlackBytes = Math.Max(0, parsed.TotalFileSize - mediaBytes),
+      OptimalUnitSize = EwfWriter.ChunkSize,
+      OptimalSlackBytes = 0,
+      RequiresRebuild = ["Changing chunk compression rewrites sectors/table/hash sections."],
+      Notes = [
+        $"{parsed.Sections.Count} section(s); chunk size {EwfWriter.ChunkSize:N0} bytes.",
+        HasCompressedChunks(parsed) ? "At least one media chunk is zlib-compressed." : "Media chunks are stored; compression optimization is available.",
+        "Re-layout is a staged forensic-image rebuild; the source remains unchanged until commit.",
+      ],
+    };
+  }
+
+  public void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options) {
+    ArgumentNullException.ThrowIfNull(options);
+    if (options.MakeSparse || options.DeduplicateWithLinks)
+      throw new NotSupportedException("EWF cannot express filesystem sparse files or hard-link deduplication.");
+    var image = ReadImage(source);
+    var media = EwfReader.ExtractMedia(image);
+    var compress = options.Parameters != null && options.Parameters.TryGetValue("CompressChunks", out var raw)
+      ? ParseBool(raw, HasCompressedChunks(image))
+      : HasCompressedChunks(image);
+    var rebuilt = WriterFrom(image, compress).Build(media);
+    VerifyMedia(rebuilt, media);
+    target.Position = 0;
+    target.SetLength(0);
+    target.Write(rebuilt);
+    options.OnProgress?.Invoke(media.LongLength, media.LongLength);
+  }
+
+  public IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive) {
+    var image = ReadImage(archive);
+    yield return new DefragBlockInfo(0, Math.Min(EwfReader.FileHeaderSize, image.TotalFileSize),
+      DefragBlockKind.MetadataReserved, "$EWF/header");
+    foreach (var section in image.Sections) {
+      var length = section.SectionSize == 0
+        ? EwfReader.SectionDescriptorSize
+        : checked((long)section.SectionSize);
+      if (section.DescriptorOffset >= image.TotalFileSize) continue;
+      length = Math.Min(length, image.TotalFileSize - section.DescriptorOffset);
+      if (length <= 0) continue;
+      yield return new DefragBlockInfo(
+        section.DescriptorOffset,
+        length,
+        section.Type == "sectors" ? DefragBlockKind.Used : DefragBlockKind.MetadataReserved,
+        section.Type == "sectors" ? "media.raw" : "$EWF/" + section.Type);
+    }
+  }
+
+  private static bool MatchesRequested(string name, string[]? files)
+    => files == null || files.Length == 0 || MatchesFilter(name, files);
+
+  private static EwfReader.EwfImage ReadImage(Stream stream)
+    => EwfReader.Read(ReadAll(stream));
+
+  private static byte[] ReadAll(Stream stream) {
+    if (stream.CanSeek) stream.Position = 0;
     using var ms = new MemoryStream();
     stream.CopyTo(ms);
-    var img = EwfReader.Read(ms.GetBuffer().AsSpan(0, (int)ms.Length));
+    return ms.ToArray();
+  }
+
+  private static byte[] ReadCreateMedia(IReadOnlyList<ArchiveInputInfo> inputs) {
+    var files = inputs.Where(i => !i.IsDirectory).ToArray();
+    var named = files.LastOrDefault(i => string.Equals(i.ArchiveName, "media.raw", StringComparison.OrdinalIgnoreCase));
+    if (named != null) return named.ReadContent();
+    if (files.Length == 0) return [];
+    if (files.Length == 1) return files[0].ReadContent();
+    using var ms = new MemoryStream();
+    foreach (var file in files) ms.Write(file.ReadContent());
+    return ms.ToArray();
+  }
+
+  private static void RewriteMedia(Stream archive, byte[] media, EwfReader.EwfImage existing, bool compress) {
+    var rebuilt = WriterFrom(existing, compress).Build(media);
+    VerifyMedia(rebuilt, media);
+    CommitBytes(archive, rebuilt);
+  }
 
-    var result = new List<(string, byte[])> {
-      ("metadata.ini", BuildMetadata(img)),
+  private static void CommitBytes(Stream archive, byte[] rebuilt) {
+    if (!archive.CanWrite || !archive.CanSeek)
+      throw new ArgumentException("EWF mutation requires a writable, seekable stream.", nameof(archive));
+    archive.Position = 0;
+    archive.SetLength(0);
+    archive.Write(rebuilt);
+    archive.Flush();
+  }
+
+  private static void VerifyMedia(byte[] rebuilt, ReadOnlySpan<byte> media) {
+    var decoded = EwfReader.ExtractMedia(EwfReader.Read(rebuilt));
+    if (decoded.Length < media.Length || !decoded.AsSpan(0, media.Length).SequenceEqual(media))
+      throw new InvalidOperationException("EWF rebuild did not reproduce the logical media; refusing to commit it.");
+  }
+
+  private static EwfWriter WriterFrom(EwfReader.EwfImage image, bool compress) {
+    var fields = ReadAcquisitionFields(image);
+    return new EwfWriter {
+      CompressChunks = compress,
+      Description = fields.GetValueOrDefault("a", ""),
+      CaseNumber = fields.GetValueOrDefault("c", ""),
+      EvidenceNumber = fields.GetValueOrDefault("n", ""),
+      ExaminerName = fields.GetValueOrDefault("e", ""),
+      Notes = fields.GetValueOrDefault("t", ""),
     };
+  }
 
-    // Section file names: `section_{index:D2}_{type}.bin`. The index keeps the
-    // walk order stable even when multiple sections share a type (e.g. table/table2).
-    for (var i = 0; i < img.Sections.Count; i++) {
-      var s = img.Sections[i];
-      var safeType = SafeNameSegment(s.Type);
-      result.Add(($"section_{i:D2}_{safeType}.bin", s.Payload));
-    }
-    return result;
+  private static bool HasCompressedChunks(EwfReader.EwfImage image) {
+    var table = image.Sections.FirstOrDefault(s => s.Type is "table" or "table2");
+    if (table == null || table.Payload.Length < 28) return false;
+    var count = Math.Min(
+      BinaryPrimitives.ReadUInt32LittleEndian(table.Payload.AsSpan(0)),
+      (uint)Math.Max(0, (table.Payload.Length - 28) / 4));
+    for (var i = 0; i < count; ++i)
+      if ((BinaryPrimitives.ReadUInt32LittleEndian(table.Payload.AsSpan(24 + i * 4)) & 0x80000000U) != 0)
+        return true;
+    return false;
   }
 
+  private static long MediaStoredBytes(EwfReader.EwfImage image)
+    => image.Sections.FirstOrDefault(s => s.Type == "sectors")?.Payload.LongLength ?? -1;
+
+  private static bool ParseBool(string? value, bool fallback)
+    => bool.TryParse(value, out var parsed) ? parsed : fallback;
+
   private static string SafeNameSegment(string raw) {
     var sb = new StringBuilder(raw.Length);
-    foreach (var c in raw) {
-      if (char.IsLetterOrDigit(c) || c == '_' || c == '-') sb.Append(c);
-      else sb.Append('_');
-    }
+    foreach (var c in raw)
+      sb.Append(char.IsLetterOrDigit(c) || c is '_' or '-' ? c : '_');
     return sb.Length == 0 ? "unknown" : sb.ToString();
   }
 
-  private static byte[] BuildMetadata(EwfReader.EwfImage img) {
+  private static byte[] BuildMetadata(EwfReader.EwfImage image) {
     var sb = new StringBuilder();
     sb.AppendLine("[ewf]");
-    sb.Append("signature = ").AppendLine(img.IsLogical ? "LVF (logical)" : "EVF (physical)");
-    sb.Append(CultureInfo.InvariantCulture, $"segment_number = {img.SegmentNumber}\n");
-    sb.Append(CultureInfo.InvariantCulture, $"file_size = {img.TotalFileSize}\n");
-    sb.Append(CultureInfo.InvariantCulture, $"section_count = {img.Sections.Count}\n");
-
-    var headerSection = img.Sections.FirstOrDefault(s => s.Type is "header" or "header2");
-    if (headerSection is not null) {
-      var parsed = ParseAcquisitionHeader(headerSection.Payload);
-      if (parsed.Count > 0) {
-        sb.AppendLine();
-        sb.AppendLine("[acquisition]");
-        foreach (var kv in parsed)
-          sb.Append(CultureInfo.InvariantCulture, $"{kv.Key} = {kv.Value}\n");
-      }
+    sb.Append("signature = ").AppendLine(image.IsLogical ? "LVF (logical)" : "EVF (physical)");
+    sb.Append(CultureInfo.InvariantCulture, $"segment_number = {image.SegmentNumber}\n");
+    sb.Append(CultureInfo.InvariantCulture, $"file_size = {image.TotalFileSize}\n");
+    sb.Append(CultureInfo.InvariantCulture, $"section_count = {image.Sections.Count}\n");
+    if (!image.IsLogical) {
+      try { sb.Append(CultureInfo.InvariantCulture, $"media_size = {EwfReader.ExtractMedia(image).LongLength}\n"); }
+      catch { sb.AppendLine("media_size = unavailable"); }
     }
 
-    var hashSection = img.Sections.FirstOrDefault(s => s.Type == "hash");
-    if (hashSection is not null && hashSection.Payload.Length >= 16) {
+    var fields = ReadAcquisitionFields(image);
+    if (fields.Count > 0) {
       sb.AppendLine();
-      sb.AppendLine("[hash]");
-      sb.Append("md5 = ").AppendLine(Convert.ToHexString(hashSection.Payload.AsSpan(0, 16)));
+      sb.AppendLine("[acquisition]");
+      foreach (var kv in fields) sb.Append(CultureInfo.InvariantCulture, $"{kv.Key} = {kv.Value}\n");
     }
 
-    var digestSection = img.Sections.FirstOrDefault(s => s.Type == "digest");
-    if (digestSection is not null && digestSection.Payload.Length >= 36) {
+    var hash = image.Sections.FirstOrDefault(s => s.Type == "hash");
+    if (hash is { Payload.Length: >= 16 }) {
       sb.AppendLine();
-      sb.AppendLine("[digest]");
-      sb.Append("md5 = ").AppendLine(Convert.ToHexString(digestSection.Payload.AsSpan(0, 16)));
-      sb.Append("sha1 = ").AppendLine(Convert.ToHexString(digestSection.Payload.AsSpan(16, 20)));
+      sb.AppendLine("[hash]");
+      sb.Append("md5 = ").AppendLine(Convert.ToHexString(hash.Payload.AsSpan(0, 16)));
     }
 
     sb.AppendLine();
     sb.AppendLine("[sections]");
-    for (var i = 0; i < img.Sections.Count; i++) {
-      var s = img.Sections[i];
+    for (var i = 0; i < image.Sections.Count; ++i) {
+      var section = image.Sections[i];
       sb.Append(CultureInfo.InvariantCulture,
-        $"section_{i:D2} = type={s.Type} offset={s.DescriptorOffset} size={s.SectionSize} next=0x{s.NextSectionOffset:X} checksum=0x{s.Checksum:X8}\n");
+        $"section_{i:D2} = type={section.Type} offset={section.DescriptorOffset} size={section.SectionSize} next=0x{section.NextSectionOffset:X} checksum=0x{section.Checksum:X8}\n");
     }
     return Encoding.UTF8.GetBytes(sb.ToString());
   }
 
-  private static Dictionary<string, string> ParseAcquisitionHeader(byte[] payload) {
-    // header/header2 payloads are typically zlib-compressed UTF-8/UTF-16 text
-    // organised as tab-separated rows (category, key..., value...). Surface
-    // the raw printable text when we can't decompress — leaves forensic tools
-    // something to work with without us re-implementing zlib here.
-    var result = new Dictionary<string, string>(StringComparer.Ordinal);
-    if (payload.Length == 0) return result;
-
-    try {
-      // header2 is UTF-16LE with BOM (0xFF 0xFE); header is ASCII/UTF-8.
-      var text = payload.Length >= 2 && payload[0] == 0xFF && payload[1] == 0xFE
-        ? Encoding.Unicode.GetString(payload, 2, payload.Length - 2)
-        : Encoding.UTF8.GetString(payload);
-
-      // Strip non-printable / control chars except tab and newline for safety.
-      var sb = new StringBuilder(text.Length);
-      foreach (var c in text) {
-        if (c == '\t' || c == '\n' || c == '\r' || (c >= 0x20 && c < 0x7F) || c > 0xA0) sb.Append(c);
-      }
-      var printable = sb.ToString();
-
-      var lines = printable.Split('\n', StringSplitOptions.RemoveEmptyEntries);
-      if (lines.Length >= 2) {
-        var keys = lines[1].Split('\t');
-        if (lines.Length >= 3) {
-          var values = lines[2].Split('\t');
-          for (var i = 0; i < Math.Min(keys.Length, values.Length); i++) {
-            var k = keys[i].Trim().Trim('\r');
-            var v = values[i].Trim().Trim('\r');
-            if (k.Length > 0) result[k] = v;
+  private static Dictionary<string, string> ReadAcquisitionFields(EwfReader.EwfImage image) {
+    foreach (var section in image.Sections.Where(s => s.Type is "header2" or "header")) {
+      foreach (var payload in CandidateHeaderPayloads(section.Payload)) {
+        try {
+          var text = payload.Length >= 2 && payload[0] == 0xFF && payload[1] == 0xFE
+            ? Encoding.Unicode.GetString(payload, 2, payload.Length - 2)
+            : Encoding.UTF8.GetString(payload);
+          var lines = text.Replace("\r", "").Split('\n', StringSplitOptions.RemoveEmptyEntries);
+          for (var line = 0; line + 1 < lines.Length; ++line) {
+            if (!lines[line].Contains('\t')) continue;
+            var keys = lines[line].Split('\t');
+            var values = lines[line + 1].Split('\t');
+            if (keys.Length < 2 || values.Length == 0) continue;
+            var result = new Dictionary<string, string>(StringComparer.Ordinal);
+            for (var i = 0; i < Math.Min(keys.Length, values.Length); ++i) {
+              var key = keys[i].Trim();
+              if (key.Length > 0) result[key] = values[i].Trim();
+            }
+            if (result.Count > 0) return result;
           }
-        }
+        } catch { }
       }
-    } catch {
-      // Swallow — payload isn't a header2 text block (may be raw / compressed).
     }
+    return [];
+  }
+
+  private static IReadOnlyList<byte[]> CandidateHeaderPayloads(byte[] payload) {
+    var result = new List<byte[]>(2);
+    try { result.Add(ZlibStream.Decompress(payload)); }
+    catch { }
+    result.Add(payload);
     return result;
   }
 }
diff --git a/FileFormats/FileFormat.Ewf/EwfMedia.cs b/FileFormats/FileFormat.Ewf/EwfMedia.cs
new file mode 100644
index 000000000..9860e514e
--- /dev/null
+++ b/FileFormats/FileFormat.Ewf/EwfMedia.cs
@@ -0,0 +1,115 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using Compression.Core.Checksums;
+using FileFormat.Zlib;
+
+namespace FileFormat.Ewf;
+
+/// <summary>
+/// Reconstructs the acquired medium represented by a single-segment EWF image.
+/// The descriptor treats that medium as the one semantic mutable payload; EWF
+/// sections remain diagnostic/internal views because editing one independently
+/// would invalidate table offsets, checksums and evidence hashes.
+/// </summary>
+internal static class EwfMedia {
+  private const int TableHeaderSize = 24;
+
+  public static bool TryExtract(EwfReader.EwfImage image, out byte[] media) {
+    try {
+      media = Extract(image);
+      return true;
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or OverflowException) {
+      media = [];
+      return false;
+    }
+  }
+
+  public static byte[] Extract(EwfReader.EwfImage image) {
+    ArgumentNullException.ThrowIfNull(image);
+    if (image.IsLogical)
+      throw new NotSupportedException("Logical EWF/L01 media reconstruction is not implemented.");
+
+    var volume = image.Sections.FirstOrDefault(s => s.Type is "volume" or "data")
+      ?? throw new InvalidDataException("EWF image has no volume/data media descriptor.");
+    if (volume.Payload.Length < 20)
+      throw new InvalidDataException("EWF volume payload is too short.");
+
+    var chunkCount = checked((int)BinaryPrimitives.ReadUInt32LittleEndian(volume.Payload.AsSpan(4, 4)));
+    var sectorsPerChunk = checked((int)BinaryPrimitives.ReadUInt32LittleEndian(volume.Payload.AsSpan(8, 4)));
+    var bytesPerSector = checked((int)BinaryPrimitives.ReadUInt32LittleEndian(volume.Payload.AsSpan(12, 4)));
+    var totalSectors = checked((int)BinaryPrimitives.ReadUInt32LittleEndian(volume.Payload.AsSpan(16, 4)));
+    if (chunkCount < 0 || sectorsPerChunk <= 0 || bytesPerSector <= 0 || totalSectors < 0)
+      throw new InvalidDataException("EWF volume geometry is invalid.");
+
+    var sectors = image.Sections.FirstOrDefault(s => s.Type == "sectors")
+      ?? throw new InvalidDataException("EWF image has no sectors section.");
+    var table = image.Sections.FirstOrDefault(s => s.Type is "table" or "table2")
+      ?? throw new InvalidDataException("EWF image has no chunk table.");
+    var entries = ReadTable(table.Payload, chunkCount);
+
+    var expectedBytes = checked((long)totalSectors * bytesPerSector);
+    if (expectedBytes > int.MaxValue)
+      throw new NotSupportedException("EWF media exceeds the in-memory mutation profile.");
+    var output = new byte[(int)expectedBytes];
+    var outputOffset = 0;
+    var nominalChunkBytes = checked(sectorsPerChunk * bytesPerSector);
+
+    for (var i = 0; i < entries.Length && outputOffset < output.Length; ++i) {
+      var encoded = entries[i];
+      var compressed = (encoded & 0x80000000u) != 0;
+      var relative = encoded & 0x7FFFFFFFu;
+      var nextRelative = i + 1 < entries.Length
+        ? entries[i + 1] & 0x7FFFFFFFu
+        : checked((uint)(EwfReader.SectionDescriptorSize + sectors.Payload.Length));
+      if (relative < EwfReader.SectionDescriptorSize || nextRelative < relative)
+        throw new InvalidDataException("EWF chunk table contains invalid offsets.");
+
+      var start = checked((int)relative - EwfReader.SectionDescriptorSize);
+      var end = checked((int)nextRelative - EwfReader.SectionDescriptorSize);
+      if (start < 0 || end < start || end > sectors.Payload.Length)
+        throw new InvalidDataException("EWF chunk table points outside the sectors payload.");
+      var stored = sectors.Payload.AsSpan(start, end - start);
+
+      byte[] chunk;
+      if (compressed) {
+        chunk = ZlibStream.Decompress(stored);
+      } else {
+        if (stored.Length < 4)
+          throw new InvalidDataException("Stored EWF chunk is shorter than its Adler-32 trailer.");
+        var data = stored[..^4];
+        var expected = BinaryPrimitives.ReadUInt32LittleEndian(stored[^4..]);
+        var actual = Adler32.Compute(data);
+        if (actual != expected)
+          throw new InvalidDataException(
+            $"Stored EWF chunk Adler-32 mismatch: expected 0x{expected:X8}, got 0x{actual:X8}.");
+        chunk = data.ToArray();
+      }
+
+      var expectedChunk = Math.Min(nominalChunkBytes, output.Length - outputOffset);
+      if (chunk.Length < expectedChunk)
+        throw new InvalidDataException("EWF chunk decompressed shorter than the declared media geometry.");
+      chunk.AsSpan(0, expectedChunk).CopyTo(output.AsSpan(outputOffset));
+      outputOffset += expectedChunk;
+    }
+
+    if (outputOffset != output.Length)
+      throw new InvalidDataException("EWF chunk table does not cover the complete declared medium.");
+    return output;
+  }
+
+  private static uint[] ReadTable(byte[] payload, int expectedChunks) {
+    if (payload.Length < TableHeaderSize + 4)
+      throw new InvalidDataException("EWF table payload is too short.");
+    var count = checked((int)BinaryPrimitives.ReadUInt32LittleEndian(payload.AsSpan(0, 4)));
+    if (count != expectedChunks)
+      throw new InvalidDataException($"EWF table has {count} chunks, volume declares {expectedChunks}.");
+    var entriesBytes = checked(count * 4);
+    if (TableHeaderSize + entriesBytes + 4 > payload.Length)
+      throw new InvalidDataException("EWF table entry array is truncated.");
+
+    var entries = new uint[count];
+    for (var i = 0; i < count; ++i)
+      entries[i] = BinaryPrimitives.ReadUInt32LittleEndian(payload.AsSpan(TableHeaderSize + i * 4, 4));
+    return entries;
+  }
+}
\ No newline at end of file
diff --git a/FileFormats/FileFormat.Ewf/EwfReader.cs b/FileFormats/FileFormat.Ewf/EwfReader.cs
index 967a0d94d..e52e8ed81 100644
--- a/FileFormats/FileFormat.Ewf/EwfReader.cs
+++ b/FileFormats/FileFormat.Ewf/EwfReader.cs
@@ -1,38 +1,21 @@
 #pragma warning disable CS1591
 using System.Buffers.Binary;
 using System.Text;
+using Compression.Core.Checksums;
+using FileFormat.Zlib;
 
 namespace FileFormat.Ewf;
 
 /// <summary>
 /// Reader for EnCase Expert Witness Format (EWF) forensic images — the
-/// .e01/.ewf/.l01 family used by EnCase and libewf. Walks the section chain
-/// starting at offset 13 (just past the 8-byte signature + 1-byte fields_start
-/// + 2-byte segment + 2-byte fields_end) and surfaces each section's raw bytes
-/// along with parsed metadata. Full sector decompression is deferred.
+/// .e01/.ewf/.l01 family used by EnCase and libewf. Besides the raw section
+/// chain it reconstructs the logical media carried by the common single-segment
+/// EVF layout emitted by <see cref="EwfWriter"/>.
 /// </summary>
-/// <remarks>
-/// Layout per libewf documentation:
-/// <code>
-///   Offset 0-7    Signature "EVF\x09\x0D\x0A\xFF\x00" (or "LVF..." for .l01)
-///   Offset 8      fields_start     (0x01)
-///   Offset 9-10   segment_number   (u16 LE)
-///   Offset 11-12  fields_end       (0x0000)
-///   Offset 13..   Section descriptors (76 bytes each):
-///                   0-15  type (ASCII, NUL-padded)
-///                   16-23 next_section_offset (u64 LE, absolute)
-///                   24-31 section_size        (u64 LE)
-///                   32-71 padding (zero)
-///                   72-75 Adler-32 checksum
-///                 followed by section_size - 76 bytes of payload.
-///   The final section in a segment has type "next" or "done"; "next" links
-///   to the following segment, "done" closes the image.
-/// </code>
-/// </remarks>
 public sealed class EwfReader {
 
-  public static readonly byte[] EvfSignature = [0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00]; // "EVF\t\r\n\xFF\x00"
-  public static readonly byte[] LvfSignature = [0x4C, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00]; // "LVF\t\r\n\xFF\x00"
+  public static readonly byte[] EvfSignature = [0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00];
+  public static readonly byte[] LvfSignature = [0x4C, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00];
 
   public const int FileHeaderSize = 13;
   public const int SectionDescriptorSize = 76;
@@ -46,11 +29,12 @@ public sealed record Section(
     byte[] Payload);
 
   public sealed record EwfImage(
-    bool IsLogical,             // true for LVF (.l01), false for EVF (.e01/.ewf)
+    bool IsLogical,
     ushort SegmentNumber,
     List<Section> Sections,
     long TotalFileSize);
 
+  /// <summary>Reads one EWF segment and its section chain.</summary>
   public static EwfImage Read(ReadOnlySpan<byte> data) {
     if (data.Length < FileHeaderSize)
       throw new InvalidDataException("EWF: file shorter than 13-byte header.");
@@ -59,21 +43,19 @@ public static EwfImage Read(ReadOnlySpan<byte> data) {
     if (!isLogical && !data[..8].SequenceEqual(EvfSignature))
       throw new InvalidDataException("EWF: invalid file signature (expected EVF or LVF magic at offset 0).");
 
-    var fieldsStart = data[8];
-    if (fieldsStart != 0x01)
-      throw new InvalidDataException($"EWF: unexpected fields_start byte 0x{fieldsStart:X2} (expected 0x01).");
+    if (data[8] != 0x01)
+      throw new InvalidDataException($"EWF: unexpected fields_start byte 0x{data[8]:X2} (expected 0x01).");
 
     var segment = BinaryPrimitives.ReadUInt16LittleEndian(data[9..]);
     var fieldsEnd = BinaryPrimitives.ReadUInt16LittleEndian(data[11..]);
-    if (fieldsEnd != 0x0000)
+    if (fieldsEnd != 0)
       throw new InvalidDataException($"EWF: unexpected fields_end 0x{fieldsEnd:X4} (expected 0x0000).");
 
     var sections = new List<Section>();
     long cursor = FileHeaderSize;
     var guard = 0;
     while (cursor + SectionDescriptorSize <= data.Length) {
-      guard++;
-      if (guard > 4096) // runaway guard — real EWF segments have dozens of sections
+      if (++guard > 4096)
         throw new InvalidDataException("EWF: section-chain guard tripped.");
 
       var desc = data.Slice((int)cursor, SectionDescriptorSize);
@@ -82,46 +64,132 @@ public static EwfImage Read(ReadOnlySpan<byte> data) {
       var sectionSize = BinaryPrimitives.ReadUInt64LittleEndian(desc[24..]);
       var checksum = BinaryPrimitives.ReadUInt32LittleEndian(desc[72..]);
 
-      // section_size includes the 76-byte descriptor; payload is whatever follows.
-      var payloadLen = sectionSize >= SectionDescriptorSize
-        ? (int)Math.Min(sectionSize - SectionDescriptorSize, (ulong)(data.Length - cursor - SectionDescriptorSize))
-        : 0;
-      var payload = payloadLen > 0
-        ? data.Slice((int)(cursor + SectionDescriptorSize), payloadLen).ToArray()
-        : [];
+      var available = Math.Max(0L, data.Length - cursor - SectionDescriptorSize);
+      var declaredPayload = sectionSize >= SectionDescriptorSize
+        ? Math.Min((ulong)available, sectionSize - SectionDescriptorSize)
+        : 0UL;
+      if (declaredPayload > int.MaxValue)
+        throw new NotSupportedException("EWF: one section exceeds the in-memory section-reader limit.");
+      var payloadLen = (int)declaredPayload;
+      var payload = payloadLen == 0
+        ? []
+        : data.Slice(checked((int)(cursor + SectionDescriptorSize)), payloadLen).ToArray();
 
       sections.Add(new Section(type, cursor, nextOffset, sectionSize, checksum, payload));
-
-      // Terminal sections: "done" closes; "next" closes the current segment (caller would open the next segment file).
       if (type is "done" or "next") break;
 
-      // Step to next section: prefer next_section_offset when it moves forward.
       if (nextOffset > (ulong)cursor && nextOffset < (ulong)data.Length) {
-        cursor = (long)nextOffset;
-      } else if (sectionSize >= SectionDescriptorSize) {
-        cursor += (long)sectionSize;
+        cursor = checked((long)nextOffset);
+      } else if (sectionSize >= SectionDescriptorSize && sectionSize <= (ulong)(data.Length - cursor)) {
+        cursor += checked((long)sectionSize);
       } else {
-        // Malformed — walk by descriptor only to make progress.
         cursor += SectionDescriptorSize;
       }
     }
 
-    return new EwfImage(
-      IsLogical: isLogical,
-      SegmentNumber: segment,
-      Sections: sections,
-      TotalFileSize: data.Length);
+    return new EwfImage(isLogical, segment, sections, data.Length);
+  }
+
+  /// <summary>
+  /// Reconstructs the logical raw media from a single EVF segment. Stored chunks
+  /// have their trailing Adler-32 removed and verified; compressed chunks are
+  /// decoded as zlib according to the table-entry MSB.
+  /// </summary>
+  public static byte[] ExtractMedia(EwfImage image) {
+    ArgumentNullException.ThrowIfNull(image);
+    if (image.IsLogical)
+      throw new NotSupportedException("EWF: LVF logical-evidence payload reconstruction is not implemented yet.");
+
+    var volume = image.Sections.FirstOrDefault(s => s.Type is "volume" or "data")
+      ?? throw new InvalidDataException("EWF: missing volume/data section.");
+    var sectors = image.Sections.FirstOrDefault(s => s.Type == "sectors")
+      ?? throw new InvalidDataException("EWF: missing sectors section.");
+    var table = image.Sections.FirstOrDefault(s => s.Type is "table" or "table2")
+      ?? throw new InvalidDataException("EWF: missing chunk table section.");
+
+    if (volume.Payload.Length < 20)
+      throw new InvalidDataException("EWF: volume section is too short.");
+    if (table.Payload.Length < 28)
+      throw new InvalidDataException("EWF: table section is too short.");
+
+    var volumeChunkCount = BinaryPrimitives.ReadUInt32LittleEndian(volume.Payload.AsSpan(4));
+    var sectorsPerChunk = BinaryPrimitives.ReadUInt32LittleEndian(volume.Payload.AsSpan(8));
+    var bytesPerSector = BinaryPrimitives.ReadUInt32LittleEndian(volume.Payload.AsSpan(12));
+    var totalSectors = BinaryPrimitives.ReadUInt32LittleEndian(volume.Payload.AsSpan(16));
+    var chunkCount = BinaryPrimitives.ReadUInt32LittleEndian(table.Payload.AsSpan(0));
+    var baseOffset = BinaryPrimitives.ReadUInt64LittleEndian(table.Payload.AsSpan(8));
+
+    if (volumeChunkCount != 0 && chunkCount != volumeChunkCount)
+      throw new InvalidDataException($"EWF: volume/table chunk-count mismatch ({volumeChunkCount} vs {chunkCount}).");
+    if (chunkCount > 0x01000000)
+      throw new InvalidDataException($"EWF: implausible chunk count {chunkCount}.");
+    if (bytesPerSector == 0 || bytesPerSector > 1024 * 1024 || sectorsPerChunk == 0)
+      throw new InvalidDataException("EWF: invalid sector/chunk geometry.");
+
+    var entriesBytes = checked((long)chunkCount * sizeof(uint));
+    if (24L + entriesBytes + 4 > table.Payload.LongLength)
+      throw new InvalidDataException("EWF: chunk table is truncated.");
+
+    var offsets = new uint[checked((int)chunkCount)];
+    for (var i = 0; i < offsets.Length; ++i)
+      offsets[i] = BinaryPrimitives.ReadUInt32LittleEndian(table.Payload.AsSpan(24 + i * 4));
+
+    using var media = new MemoryStream();
+    var sectorsPayloadAbsolute = checked((ulong)sectors.DescriptorOffset + SectionDescriptorSize);
+    var sectorsEndAbsolute = checked((ulong)sectors.DescriptorOffset +
+      (sectors.SectionSize >= SectionDescriptorSize
+        ? sectors.SectionSize
+        : (ulong)(SectionDescriptorSize + sectors.Payload.Length)));
+
+    for (var i = 0; i < offsets.Length; ++i) {
+      var rawEntry = offsets[i];
+      var compressed = (rawEntry & 0x80000000U) != 0;
+      var absoluteStart = checked(baseOffset + (rawEntry & 0x7FFFFFFFU));
+      var absoluteEnd = i + 1 < offsets.Length
+        ? checked(baseOffset + (offsets[i + 1] & 0x7FFFFFFFU))
+        : sectorsEndAbsolute;
+
+      if (absoluteStart < sectorsPayloadAbsolute || absoluteEnd < absoluteStart || absoluteEnd > sectorsEndAbsolute)
+        throw new InvalidDataException($"EWF: chunk {i} points outside the sectors section.");
+
+      var payloadStart = checked((long)(absoluteStart - sectorsPayloadAbsolute));
+      var payloadLength = checked((long)(absoluteEnd - absoluteStart));
+      if (payloadStart < 0 || payloadLength < 0 || payloadStart + payloadLength > sectors.Payload.LongLength)
+        throw new InvalidDataException($"EWF: chunk {i} range is invalid.");
+      if (payloadLength > int.MaxValue)
+        throw new NotSupportedException("EWF: one chunk exceeds the in-memory decoder limit.");
+
+      var chunk = sectors.Payload.AsSpan((int)payloadStart, (int)payloadLength);
+      if (compressed) {
+        media.Write(ZlibStream.Decompress(chunk));
+      } else {
+        if (chunk.Length < 4)
+          throw new InvalidDataException($"EWF: stored chunk {i} has no Adler-32 trailer.");
+        var data = chunk[..^4];
+        var expected = BinaryPrimitives.ReadUInt32LittleEndian(chunk[^4..]);
+        var actual = Adler32.Compute(data);
+        if (expected != actual)
+          throw new InvalidDataException(
+            $"EWF: stored chunk {i} Adler-32 mismatch (expected 0x{expected:X8}, got 0x{actual:X8}).");
+        media.Write(data);
+      }
+    }
+
+    var declaredLength = checked((long)totalSectors * bytesPerSector);
+    if (declaredLength > media.Length)
+      throw new InvalidDataException(
+        $"EWF: decoded chunks are shorter than declared media ({media.Length} < {declaredLength}).");
+    media.SetLength(declaredLength);
+    return media.ToArray();
   }
 
   private static string ReadAsciiType(ReadOnlySpan<byte> raw) {
-    // Trim trailing NULs; fall back to hex if ASCII isn't printable.
     var end = raw.Length;
-    while (end > 0 && raw[end - 1] == 0) end--;
+    while (end > 0 && raw[end - 1] == 0) --end;
     var slice = raw[..end];
-    for (var i = 0; i < slice.Length; i++) {
+    for (var i = 0; i < slice.Length; ++i)
       if (slice[i] < 0x20 || slice[i] > 0x7E)
         return Convert.ToHexString(raw);
-    }
     return Encoding.ASCII.GetString(slice);
   }
 }
diff --git a/FileFormats/FileFormat.Ewf/GlobalUsings.cs b/FileFormats/FileFormat.Ewf/GlobalUsings.cs
new file mode 100644
index 000000000..a2e3e718c
--- /dev/null
+++ b/FileFormats/FileFormat.Ewf/GlobalUsings.cs
@@ -0,0 +1 @@
+global using System.Buffers.Binary;
diff --git a/FileFormats/FileFormat.SevenZip/SolidBlockOptimizer.cs b/FileFormats/FileFormat.SevenZip/SolidBlockOptimizer.cs
index d4cfb440f..f5214a42c 100644
--- a/FileFormats/FileFormat.SevenZip/SolidBlockOptimizer.cs
+++ b/FileFormats/FileFormat.SevenZip/SolidBlockOptimizer.cs
@@ -26,6 +26,20 @@ public sealed class TrialResult {
     public required TimeSpan Elapsed { get; init; }
   }
 
+  /// <summary>
+  /// Detailed progress used by the maintenance block-map UI. <c>Phase</c> is
+  /// <c>extracting</c>, <c>strategy</c>, or <c>building</c>. The byte counters
+  /// are meaningful for extraction; current/total are meaningful for strategy
+  /// and target-entry construction.
+  /// </summary>
+  public sealed record DetailedProgress(
+    string Phase,
+    int Current,
+    int Total,
+    string? Name,
+    long BytesDone,
+    long BytesTotal);
+
   /// <summary>
   /// Callback invoked before each trial starts. Parameters: (strategyIndex, totalStrategies, strategyName).
   /// </summary>
@@ -37,24 +51,44 @@ public sealed class TrialResult {
   /// </summary>
   /// <param name="archive">Seekable stream containing a valid 7z archive.</param>
   /// <param name="maxTrials">Maximum number of strategies to try (1-5). Default 5.</param>
-  /// <param name="onProgress">Optional progress callback invoked before each trial.</param>
-  /// <returns>The optimization result with the winning archive bytes and trial report.</returns>
-  public static OptimizeResult Optimize(Stream archive, int maxTrials = 5, ProgressCallback? onProgress = null) {
+  /// <param name="onProgress">Optional coarse callback invoked before each trial.</param>
+  /// <param name="onDetailedProgress">Optional per-entry/per-strategy callback for UI feedback.</param>
+  /// <param name="cancellationToken">Cancellation checked between extraction, planning and target-build units.</param>
+  public static OptimizeResult Optimize(
+      Stream archive,
+      int maxTrials = 5,
+      ProgressCallback? onProgress = null,
+      Action<DetailedProgress>? onDetailedProgress = null,
+      CancellationToken cancellationToken = default) {
     ArgumentNullException.ThrowIfNull(archive);
     maxTrials = Math.Clamp(maxTrials, 1, Strategies.Count);
+    cancellationToken.ThrowIfCancellationRequested();
 
-    // Step 1: Extract all entries from the input archive
+    // Step 1: Extract all entries. The callback is deliberately emitted before
+    // and after each file so even a multi-gigabyte regroup has visible read-head
+    // progress rather than a frozen indeterminate spinner.
     archive.Position = 0;
     var reader = new SevenZipReader(archive, leaveOpen: true);
+    var fileEntries = reader.Entries.Where(e => !e.IsDirectory).ToArray();
+    var totalBytes = Math.Max(1L, fileEntries.Sum(e => Math.Max(0L, e.Size)));
+    long extractedBytes = 0;
     var entries = new List<(string Name, byte[] Data, SevenZipEntry Meta)>();
     for (var i = 0; i < reader.Entries.Count; i++) {
+      cancellationToken.ThrowIfCancellationRequested();
       var e = reader.Entries[i];
       if (e.IsDirectory) continue;
+
+      onDetailedProgress?.Invoke(new DetailedProgress(
+        "extracting", entries.Count, fileEntries.Length, e.Name, extractedBytes, totalBytes));
       var data = reader.Extract(i);
+      extractedBytes += data.LongLength;
       entries.Add((e.Name, data, e));
+      onDetailedProgress?.Invoke(new DetailedProgress(
+        "extracting", entries.Count, fileEntries.Length, e.Name, extractedBytes, totalBytes));
     }
+    cancellationToken.ThrowIfCancellationRequested();
 
-    // Trivial case: 0 or 1 files cannot benefit from regrouping
+    // Trivial case: 0 or 1 files cannot benefit from regrouping.
     if (entries.Count <= 1) {
       archive.Position = 0;
       var original = new byte[archive.Length];
@@ -66,28 +100,40 @@ public static OptimizeResult Optimize(Stream archive, int maxTrials = 5, Progres
       };
     }
 
-    // Step 2: Run each strategy (up to maxTrials)
+    // Step 2: Run each strategy (up to maxTrials).
     var strategies = Strategies.Take(maxTrials).ToList();
     var trials = new List<(string Name, byte[] Output, TimeSpan Elapsed)>();
 
     for (var i = 0; i < strategies.Count; i++) {
+      cancellationToken.ThrowIfCancellationRequested();
       var (name, grouper) = strategies[i];
       onProgress?.Invoke(i, strategies.Count, name);
+      onDetailedProgress?.Invoke(new DetailedProgress(
+        "strategy", i, strategies.Count, name, i, strategies.Count));
 
       var sw = System.Diagnostics.Stopwatch.StartNew();
       try {
         var groups = grouper(entries);
-        var output = BuildArchive(entries, groups);
+        cancellationToken.ThrowIfCancellationRequested();
+        var output = BuildArchive(entries, groups, cancellationToken,
+          (current, total, entryName) => onDetailedProgress?.Invoke(new DetailedProgress(
+            "building", current, total, entryName, current, total)));
         sw.Stop();
         trials.Add((name, output, sw.Elapsed));
+        onDetailedProgress?.Invoke(new DetailedProgress(
+          "strategy", i + 1, strategies.Count, name, i + 1, strategies.Count));
+      } catch (OperationCanceledException) {
+        sw.Stop();
+        throw;
       } catch {
         sw.Stop();
-        // Strategy failed — skip it
+        // A strategy can legitimately fail for a particular content/layout.
+        // Skip it and continue searching the other candidates.
       }
     }
 
+    cancellationToken.ThrowIfCancellationRequested();
     if (trials.Count == 0) {
-      // All strategies failed — return original
       archive.Position = 0;
       var original = new byte[archive.Length];
       archive.ReadExactly(original);
@@ -98,7 +144,7 @@ public static OptimizeResult Optimize(Stream archive, int maxTrials = 5, Progres
       };
     }
 
-    // Step 3: Pick the smallest
+    // Step 3: Pick the smallest.
     var sorted = trials.OrderBy(t => t.Output.Length).ToList();
     var winner = sorted[0];
 
@@ -115,10 +161,6 @@ public static OptimizeResult Optimize(Stream archive, int maxTrials = 5, Progres
 
   // ── Strategy registry ──────────────────────────────────────────────
 
-  /// <summary>
-  /// A grouping strategy: given a list of entries, returns a list of groups
-  /// (each group is a list of indices into the entries list).
-  /// </summary>
   private delegate IReadOnlyList<int[]> GroupingStrategy(
     IReadOnlyList<(string Name, byte[] Data, SevenZipEntry Meta)> entries);
 
@@ -151,10 +193,8 @@ private static IReadOnlyList<int[]> GroupByExtension(
 
   private static IReadOnlyList<int[]> GroupBySimilarityHash(
       IReadOnlyList<(string Name, byte[] Data, SevenZipEntry Meta)> entries) {
-    // Compute a fingerprint from the first 4KB of each file using a
-    // simple rolling hash, then cluster files with similar fingerprints.
     const int FingerprintSize = 4096;
-    const int NumBuckets = 16; // cluster into 16 buckets by hash
+    const int NumBuckets = 16;
 
     var groups = new Dictionary<int, List<int>>();
     for (var i = 0; i < entries.Count; i++) {
@@ -171,26 +211,18 @@ private static IReadOnlyList<int[]> GroupBySimilarityHash(
     return groups.Values.Select(g => g.ToArray()).ToArray();
   }
 
-  /// <summary>
-  /// Computes a simple rolling hash fingerprint over data. Uses a polynomial
-  /// hash with a small window to produce a content-dependent signature.
-  /// </summary>
   private static int ComputeRollingHash(ReadOnlySpan<byte> data) {
     if (data.IsEmpty) return 0;
-    // Use byte frequency distribution as the fingerprint — files with similar
-    // byte distributions will hash to similar values.
     Span<int> freq = stackalloc int[256];
     freq.Clear();
     foreach (var b in data)
       freq[b]++;
 
-    // Hash the frequency table
-    var hash = 0x811C9DC5u; // FNV-1a offset basis
+    var hash = 0x811C9DC5u;
     for (var i = 0; i < 256; i++) {
-      // Quantize frequency to reduce noise: bucket into 8 levels
       var quantized = (byte)Math.Min(7, freq[i] * 8 / Math.Max(1, data.Length));
       hash ^= quantized;
-      hash *= 0x01000193u; // FNV-1a prime
+      hash *= 0x01000193u;
     }
     return (int)hash;
   }
@@ -199,9 +231,9 @@ private static int ComputeRollingHash(ReadOnlySpan<byte> data) {
 
   private static IReadOnlyList<int[]> GroupBySizeBuckets(
       IReadOnlyList<(string Name, byte[] Data, SevenZipEntry Meta)> entries) {
-    var small = new List<int>();  // < 4KB
-    var medium = new List<int>(); // 4KB - 64KB
-    var large = new List<int>();  // > 64KB
+    var small = new List<int>();
+    var medium = new List<int>();
+    var large = new List<int>();
 
     for (var i = 0; i < entries.Count; i++) {
       var len = entries[i].Data.Length;
@@ -213,7 +245,6 @@ private static IReadOnlyList<int[]> GroupBySizeBuckets(
     var result = new List<int[]>();
     if (small.Count > 0) result.Add(small.ToArray());
     if (medium.Count > 0) result.Add(medium.ToArray());
-    // Large files each get their own block for better random access
     foreach (var idx in large)
       result.Add([idx]);
     return result;
@@ -244,49 +275,29 @@ private static IReadOnlyList<int[]> GroupByHeaderMagic(
     return groups.Values.Select(g => g.ToArray()).ToArray();
   }
 
-  /// <summary>
-  /// Detects the file type from magic bytes in the header. Returns a
-  /// short category string for grouping purposes.
-  /// </summary>
   private static string DetectFileKind(byte[] data) {
     if (data.Length < 4) return "tiny";
 
     var b = data.AsSpan();
-    // PDF
     if (b.Length >= 5 && b[0] == '%' && b[1] == 'P' && b[2] == 'D' && b[3] == 'F') return "pdf";
-    // PNG
     if (b.Length >= 8 && b[0] == 0x89 && b[1] == 'P' && b[2] == 'N' && b[3] == 'G') return "image";
-    // JPEG
     if (b[0] == 0xFF && b[1] == 0xD8 && b[2] == 0xFF) return "image";
-    // GIF
     if (b[0] == 'G' && b[1] == 'I' && b[2] == 'F' && b[3] == '8') return "image";
-    // BMP
     if (b[0] == 'B' && b[1] == 'M') return "image";
-    // WebP
     if (b.Length >= 12 && b[0] == 'R' && b[1] == 'I' && b[2] == 'F' && b[3] == 'F' &&
         b[8] == 'W' && b[9] == 'E' && b[10] == 'B' && b[11] == 'P') return "image";
-    // PE executable (MZ header)
     if (b[0] == 'M' && b[1] == 'Z') return "executable";
-    // ELF
     if (b[0] == 0x7F && b[1] == 'E' && b[2] == 'L' && b[3] == 'F') return "executable";
-    // Mach-O
     if ((b[0] == 0xFE && b[1] == 0xED && b[2] == 0xFA) ||
         (b[0] == 0xCF && b[1] == 0xFA && b[2] == 0xED)) return "executable";
-    // ZIP / JAR / Office (PK)
     if (b[0] == 'P' && b[1] == 'K' && b[2] == 3 && b[3] == 4) return "archive";
-    // Gzip
     if (b[0] == 0x1F && b[1] == 0x8B) return "archive";
-    // 7z
     if (b[0] == '7' && b[1] == 'z' && b[2] == 0xBC && b[3] == 0xAF) return "archive";
-    // RAR
     if (b[0] == 'R' && b[1] == 'a' && b[2] == 'r' && b[3] == '!') return "archive";
-    // XML / HTML / SVG (angle bracket start)
     if (b[0] == '<') return "markup";
-    // JSON (object or array)
     if (b[0] == '{' || b[0] == '[') return "structured";
-    // UTF-8 BOM
     if (b.Length >= 3 && b[0] == 0xEF && b[1] == 0xBB && b[2] == 0xBF) return "text";
-    // Heuristic: mostly printable ASCII → text
+
     var printable = 0;
     var sample = Math.Min(data.Length, 512);
     for (var i = 0; i < sample; i++)
@@ -301,22 +312,25 @@ private static string DetectFileKind(byte[] data) {
 
   /// <summary>
   /// Builds a 7z archive from the given entries with the specified block grouping.
-  /// Each group becomes one solid block.
+  /// Each group becomes one solid block. Cancellation is checked between target
+  /// entries and immediately before/after the potentially expensive solid encode.
   /// </summary>
   private static byte[] BuildArchive(
       IReadOnlyList<(string Name, byte[] Data, SevenZipEntry Meta)> entries,
-      IReadOnlyList<int[]> groups) {
+      IReadOnlyList<int[]> groups,
+      CancellationToken cancellationToken,
+      Action<int, int, string?>? onProgress) {
 
     using var ms = new MemoryStream();
     var writer = new SevenZipWriter(ms, SevenZipCodec.Lzma2, leaveOpen: true);
 
-    // Add all entries in group order (entries within each group stay together
-    // in the solid block)
-    var entryIndexMap = new int[entries.Count]; // original index → add-order index
+    var entryIndexMap = new int[entries.Count];
     var addOrder = 0;
     foreach (var group in groups)
       foreach (var idx in group) {
+        cancellationToken.ThrowIfCancellationRequested();
         var (name, data, meta) = entries[idx];
+        onProgress?.Invoke(addOrder, entries.Count, name);
         writer.AddEntry(new SevenZipEntry {
           Name = name,
           LastWriteTime = meta.LastWriteTime,
@@ -324,9 +338,9 @@ private static byte[] BuildArchive(
           Attributes = meta.Attributes,
         }, data);
         entryIndexMap[idx] = addOrder++;
+        onProgress?.Invoke(addOrder, entries.Count, name);
       }
 
-    // Build block descriptors mapping add-order indices to groups
     var blockDescs = new List<SevenZipWriter.BlockDescriptor>();
     foreach (var group in groups) {
       blockDescs.Add(new SevenZipWriter.BlockDescriptor {
@@ -334,7 +348,9 @@ private static byte[] BuildArchive(
       });
     }
 
+    cancellationToken.ThrowIfCancellationRequested();
     writer.FinishWithBlocks(blockDescs);
+    cancellationToken.ThrowIfCancellationRequested();
     return ms.ToArray();
   }
 }
diff --git a/FileFormats/FileFormat.UefiFv/UefiFvFormatDescriptor.cs b/FileFormats/FileFormat.UefiFv/UefiFvFormatDescriptor.cs
index c44753ada..ceb6e5e3f 100644
--- a/FileFormats/FileFormat.UefiFv/UefiFvFormatDescriptor.cs
+++ b/FileFormats/FileFormat.UefiFv/UefiFvFormatDescriptor.cs
@@ -7,29 +7,30 @@
 namespace FileFormat.UefiFv;
 
 /// <summary>
-/// Pseudo-archive descriptor for UEFI PI Firmware Volumes (<c>.fv</c>/<c>.fd</c>).
-/// Locates the FV by scanning for the <c>_FVH</c> signature at offset 40 and
-/// emits one entry per FFS file, named <c>{GUID}_{TYPE_TAG}.bin</c>.
+/// UEFI PI Firmware Volume (<c>.fv</c>/<c>.fd</c>) archive surface. FFS files are
+/// exposed as <c>{GUID}_{TYPE_TAG}.bin</c>; standalone volumes can be created and
+/// ordinary FFS2 records can be added/replaced/removed through erased free space.
 ///
 /// References:
 /// <list type="bullet">
-///   <item><description><c>https://uefi.org/specifications</c> — UEFI Platform Initialization (PI) Specification — Volume 3 defines Firmware Volumes and FFS</description></item>
-///   <item><description><c>https://github.com/LongSoft/UEFITool</c> — UEFITool — canonical firmware-volume parser/editor</description></item>
+///   <item><description><c>https://uefi.org/specifications</c> — UEFI Platform Initialization (PI) Specification, Volume 3: Firmware Storage Design</description></item>
+///   <item><description><c>https://github.com/LongSoft/UEFITool</c> — UEFITool firmware-volume parser/editor</description></item>
 /// </list>
 /// </summary>
-public sealed class UefiFvFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations {
+public sealed class UefiFvFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations,
+  IArchiveCreatable, IArchiveModifiable {
 
   public string Id => "UefiFv";
   public string DisplayName => "UEFI Firmware Volume";
   public FormatCategory Category => FormatCategory.Archive;
   public FormatCapabilities Capabilities =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract |
+    FormatCapabilities.CanCreate | FormatCapabilities.CanModify |
     FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries;
   public string DefaultExtension => ".fv";
   public IReadOnlyList<string> Extensions => [".fv", ".fd"];
   public IReadOnlyList<string> CompoundExtensions => [];
   public IReadOnlyList<MagicSignature> MagicSignatures => [
-    // '_FVH' signature is at offset 40 (not 0) — callers must respect the Offset.
     new([(byte)'_', (byte)'F', (byte)'V', (byte)'H'],
       Offset: UefiFvReader.SignatureOffset, Confidence: 0.95),
   ];
@@ -37,7 +38,7 @@ public sealed class UefiFvFormatDescriptor : IFormatDescriptor, IArchiveFormatOp
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
   public string Description =>
-    "UEFI PI Firmware Volume — container for FFS files (PEI/DXE/driver modules).";
+    "UEFI PI Firmware Volume — create and offline R/W for ordinary FFS2 files in fixed-capacity volumes.";
 
   public List<ArchiveEntryInfo> List(Stream stream, string? password) =>
     BuildEntries(stream).Select((e, i) => new ArchiveEntryInfo(
@@ -52,10 +53,25 @@ public void Extract(Stream stream, string outputDir, string? password, string[]?
     }
   }
 
+  public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
+    ArgumentNullException.ThrowIfNull(output);
+    ArgumentNullException.ThrowIfNull(inputs);
+    var files = FilesOnly(inputs).Where(f => !string.Equals(f.Name, "metadata.ini", StringComparison.OrdinalIgnoreCase));
+    output.Write(UefiFvWriter.Build(files));
+  }
+
+  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)
+    => UefiFvInPlaceModifier.Add(archive, inputs);
+
+  public void Remove(Stream archive, string[] entryNames)
+    => UefiFvInPlaceModifier.Remove(archive,
+      entryNames.Where(n => !string.Equals(n, "metadata.ini", StringComparison.OrdinalIgnoreCase)).ToArray());
+
   private static List<(string Name, byte[] Data, string Method)> BuildEntries(Stream stream) {
+    if (stream.CanSeek) stream.Position = 0;
     using var ms = new MemoryStream();
     stream.CopyTo(ms);
-    var data = ms.GetBuffer().AsSpan(0, (int)ms.Length);
+    var data = ms.GetBuffer().AsSpan(0, checked((int)ms.Length));
     var fvStart = UefiFvReader.FindFirst(data) ?? 0;
     var fv = UefiFvReader.Read(data, fvStart);
 
@@ -63,8 +79,8 @@ public void Extract(Stream stream, string outputDir, string? password, string[]?
       ("metadata.ini", BuildMetadata(fv), "stored"),
     };
     foreach (var f in fv.Files) {
-      var tag = UefiFvReader.ShortTypeTag(f.Type);
-      entries.Add(($"{f.Name:D}_{tag}.bin", f.Contents, "stored"));
+      if (f.Type == 0xF0) continue;
+      entries.Add((UefiFvWriter.EntryName(f.Name, f.Type), f.Contents, "stored"));
     }
     return entries;
   }
diff --git a/FileFormats/FileFormat.UefiFv/UefiFvInPlaceModifier.cs b/FileFormats/FileFormat.UefiFv/UefiFvInPlaceModifier.cs
new file mode 100644
index 000000000..de6bf610b
--- /dev/null
+++ b/FileFormats/FileFormat.UefiFv/UefiFvInPlaceModifier.cs
@@ -0,0 +1,124 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+using static Compression.Registry.FormatHelpers;
+
+namespace FileFormat.UefiFv;
+
+/// <summary>
+/// Offline random-access editor for ordinary FFS2 records in a firmware volume.
+/// It reuses erased 0xFF ranges and never relocates unrelated FFS files.
+/// </summary>
+internal static class UefiFvInPlaceModifier {
+  private sealed record Slot(int Offset, int Length, Guid Guid, byte Type) {
+    public string Name => UefiFvWriter.EntryName(Guid, Type);
+  }
+
+  public static void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
+    ArgumentNullException.ThrowIfNull(inputs);
+    var state = Open(archive);
+    foreach (var (name, data) in FilesOnly(inputs)) {
+      var identity = UefiFvWriter.IdentityFromName(name);
+      var existing = ScanSlots(state.Image, state.FvStart, state.FvEnd)
+        .FirstOrDefault(s => s.Guid == identity.Guid);
+      if (existing != null)
+        Erase(state, existing.Offset, existing.Length);
+
+      var encoded = UefiFvWriter.BuildFfsFile(identity.Guid, identity.Type, data);
+      var footprint = UefiFvWriter.Align8(encoded.Length);
+      var offset = FindErasedRun(state.Image, state.DataStart, state.FvEnd, footprint);
+      if (offset < 0)
+        throw new IOException($"UEFI FV has no erased run large enough for '{name}' ({footprint} bytes).");
+
+      Write(state, offset, encoded);
+      if (footprint > encoded.Length)
+        Erase(state, offset + encoded.Length, footprint - encoded.Length);
+    }
+  }
+
+  public static void Remove(Stream archive, string[] entryNames) {
+    ArgumentNullException.ThrowIfNull(entryNames);
+    var state = Open(archive);
+    foreach (var name in entryNames) {
+      var slot = ScanSlots(state.Image, state.FvStart, state.FvEnd)
+        .FirstOrDefault(s => string.Equals(s.Name, name, StringComparison.OrdinalIgnoreCase));
+      if (slot != null)
+        Erase(state, slot.Offset, slot.Length);
+    }
+  }
+
+  private static EditorState Open(Stream archive) {
+    ArgumentNullException.ThrowIfNull(archive);
+    if (!archive.CanRead || !archive.CanWrite || !archive.CanSeek)
+      throw new ArgumentException("UEFI FV mutation requires a seekable read/write stream.", nameof(archive));
+    if (archive.Length > int.MaxValue)
+      throw new NotSupportedException("The in-memory FV editor supports images up to 2 GiB.");
+
+    archive.Position = 0;
+    var image = new byte[checked((int)archive.Length)];
+    archive.ReadExactly(image);
+    var fvStart = UefiFvReader.FindFirst(image)
+      ?? throw new InvalidDataException("UEFI FV header was not found.");
+    var fv = UefiFvReader.Read(image, fvStart);
+    var fvEnd = checked(fvStart + (int)fv.Header.FvLength);
+    if (fvEnd > image.Length) throw new InvalidDataException("UEFI FV extends past the image.");
+    var dataStart = Align8(checked(fvStart + fv.Header.HeaderLength));
+    return new EditorState(archive, image, fvStart, dataStart, fvEnd);
+  }
+
+  private static List<Slot> ScanSlots(byte[] image, int fvStart, int fvEnd) {
+    var fv = UefiFvReader.Read(image, fvStart);
+    var pos = Align8(checked(fvStart + fv.Header.HeaderLength));
+    var result = new List<Slot>();
+    while (pos + UefiFvWriter.FfsHeaderLength <= fvEnd) {
+      if (IsErased(image.AsSpan(pos, UefiFvWriter.FfsHeaderLength))) {
+        pos += UefiFvWriter.Alignment;
+        continue;
+      }
+
+      var size = image[pos + 20] | (image[pos + 21] << 8) | (image[pos + 22] << 16);
+      if (size < UefiFvWriter.FfsHeaderLength || pos + size > fvEnd)
+        throw new InvalidDataException($"Invalid FFS file header at FV offset 0x{pos - fvStart:X}.");
+      var guid = new Guid(image.AsSpan(pos, 16));
+      var type = image[pos + 18];
+      var footprint = UefiFvWriter.Align8(size);
+      result.Add(new Slot(pos, footprint, guid, type));
+      pos += footprint;
+    }
+    return result;
+  }
+
+  private static int FindErasedRun(byte[] image, int start, int end, int needed) {
+    for (var pos = Align8(start); pos + needed <= end; pos += UefiFvWriter.Alignment) {
+      if (IsErased(image.AsSpan(pos, needed))) return pos;
+    }
+    return -1;
+  }
+
+  private static bool IsErased(ReadOnlySpan<byte> bytes) {
+    foreach (var b in bytes)
+      if (b != 0xFF) return false;
+    return true;
+  }
+
+  private static void Write(EditorState state, int offset, ReadOnlySpan<byte> bytes) {
+    bytes.CopyTo(state.Image.AsSpan(offset, bytes.Length));
+    state.Archive.Position = offset;
+    state.Archive.Write(bytes);
+  }
+
+  private static void Erase(EditorState state, int offset, int length) {
+    state.Image.AsSpan(offset, length).Fill(0xFF);
+    state.Archive.Position = offset;
+    Span<byte> erased = stackalloc byte[1024];
+    erased.Fill(0xFF);
+    var remaining = length;
+    while (remaining > 0) {
+      var take = Math.Min(remaining, erased.Length);
+      state.Archive.Write(erased[..take]);
+      remaining -= take;
+    }
+  }
+
+  private static int Align8(int value) => (value + 7) & ~7;
+  private sealed record EditorState(Stream Archive, byte[] Image, int FvStart, int DataStart, int FvEnd);
+}
diff --git a/FileFormats/FileFormat.UefiFv/UefiFvReader.cs b/FileFormats/FileFormat.UefiFv/UefiFvReader.cs
index db2bda1fd..6eef1d1bd 100644
--- a/FileFormats/FileFormat.UefiFv/UefiFvReader.cs
+++ b/FileFormats/FileFormat.UefiFv/UefiFvReader.cs
@@ -8,33 +8,12 @@ namespace FileFormat.UefiFv;
 /// Reader for UEFI Platform Initialization (PI) Firmware Volumes. Locates the
 /// FV header by scanning for the <c>_FVH</c> signature at offset 40 from the
 /// start of each 16-byte-aligned candidate (UEFI PI Volume 3). Walks the FFS
-/// file list and returns one <see cref="FfsFile"/> record per file.
+/// file list and returns one <see cref="FfsFile"/> record per live file.
 /// </summary>
-/// <remarks>
-/// The FV header layout per UEFI PI Spec Vol. 3, §3.2:
-/// <code>
-///   ZeroVector         16 bytes
-///   FileSystemGuid     16 bytes (EFI_FIRMWARE_FILE_SYSTEM2/3_GUID)
-///   FvLength            8 bytes (u64 LE)
-///   Signature           4 bytes ("_FVH")
-///   Attributes          4 bytes (u32 LE)
-///   HeaderLength        2 bytes (u16 LE)
-///   Checksum            2 bytes (u16 LE)
-///   ExtHeaderOffset     2 bytes (u16 LE)  — v2 only
-///   Reserved            1 byte
-///   Revision            1 byte
-///   BlockMap[] { u32 NumBlocks, u32 Length } terminated by {0,0}
-/// </code>
-/// </remarks>
 public sealed class UefiFvReader {
-
-  /// <summary>FV signature bytes (<c>_FVH</c>) at FV offset 40.</summary>
   public static readonly byte[] Signature = [(byte)'_', (byte)'F', (byte)'V', (byte)'H'];
-
-  /// <summary>Signature offset from FV start.</summary>
   public const int SignatureOffset = 40;
 
-  /// <summary>FV header (excluding block map + extended header body).</summary>
   public sealed record FvHeader(
     Guid FileSystemGuid,
     ulong FvLength,
@@ -46,13 +25,6 @@ public sealed record FvHeader(
     IReadOnlyList<(uint NumBlocks, uint Length)> BlockMap
   );
 
-  /// <summary>A single FFS (Firmware File System) file inside the FV.</summary>
-  /// <param name="Name">File GUID (<c>EFI_FFS_FILE_HEADER.Name</c>).</param>
-  /// <param name="Type">Raw FFS type byte (see <see cref="FileTypeName"/>).</param>
-  /// <param name="Attributes">FFS file attributes byte.</param>
-  /// <param name="State">FFS file state byte.</param>
-  /// <param name="Size">Declared file size including the 24-byte header.</param>
-  /// <param name="Contents">File contents (size minus the 24-byte header).</param>
   public sealed record FfsFile(
     Guid Name,
     byte Type,
@@ -62,14 +34,12 @@ public sealed record FfsFile(
     byte[] Contents
   );
 
-  /// <summary>Parsed firmware volume.</summary>
   public sealed record FirmwareVolume(
     int StartOffset,
     FvHeader Header,
     IReadOnlyList<FfsFile> Files
   );
 
-  /// <summary>Parses a firmware volume located at the given file offset.</summary>
   public static FirmwareVolume Read(ReadOnlySpan<byte> data, int fvStart = 0) {
     if (data.Length < fvStart + 56)
       throw new InvalidDataException("UefiFv: file shorter than minimum FV header.");
@@ -79,8 +49,6 @@ public static FirmwareVolume Read(ReadOnlySpan<byte> data, int fvStart = 0) {
       throw new InvalidDataException(
         $"UefiFv: '_FVH' signature not found at offset {fvStart + SignatureOffset}.");
 
-    // GUID is stored in EFI format: Data1/Data2/Data3 LE + Data4 BE (.NET's
-    // little-endian constructor matches).
     var fsGuid = new Guid(data.Slice(fvStart + 16, 16));
     var fvLength = BinaryPrimitives.ReadUInt64LittleEndian(data[(fvStart + 32)..]);
     var attributes = BinaryPrimitives.ReadUInt32LittleEndian(data[(fvStart + 44)..]);
@@ -100,16 +68,12 @@ public static FirmwareVolume Read(ReadOnlySpan<byte> data, int fvStart = 0) {
     }
 
     var header = new FvHeader(fsGuid, fvLength, attributes, headerLength, checksum, extOff, revision, blockMap);
-
-    // FFS files begin at the end of the FV header, 8-byte aligned. fvLength bounds the FV payload.
     var ffsStart = fvStart + headerLength;
-    var ffsEnd = (int)Math.Min((long)data.Length, fvStart + (long)fvLength);
+    var ffsEnd = checked((int)Math.Min((long)data.Length, fvStart + (long)fvLength));
     var files = ReadFfsFiles(data, ffsStart, ffsEnd);
-
     return new FirmwareVolume(fvStart, header, files);
   }
 
-  /// <summary>Scans <paramref name="data"/> for the first <c>_FVH</c> signature and returns the FV start.</summary>
   public static int? FindFirst(ReadOnlySpan<byte> data) {
     for (var i = 0; i + SignatureOffset + 4 <= data.Length; i += 16) {
       if (data.Slice(i + SignatureOffset, 4).SequenceEqual(Signature))
@@ -122,26 +86,36 @@ private static List<FfsFile> ReadFfsFiles(ReadOnlySpan<byte> data, int start, in
     var files = new List<FfsFile>();
     var pos = Align8(start);
     while (pos + 24 <= end) {
-      var name = new Guid(data.Slice(pos, 16));
-      var type = data[pos + 18];
-      var attrs = data[pos + 19];
-      var size = (uint)(data[pos + 20] | (data[pos + 21] << 8) | (data[pos + 22] << 16));
-      var state = data[pos + 23];
-
-      // An all-0xFF header region marks the end of the file list (unallocated space).
-      if (type == 0xFF && size == 0xFFFFFFu) break;
-      if (size < 24 || pos + (int)size > end) break;
-
-      var contents = data.Slice(pos + 24, (int)size - 24).ToArray();
+      var header = data.Slice(pos, 24);
+      if (IsErased(header)) {
+        // Free/deleted regions may occur between live files after offline
+        // mutation. Advance one alignment quantum until the next header.
+        pos += 8;
+        continue;
+      }
+
+      var name = new Guid(header[..16]);
+      var type = header[18];
+      var attrs = header[19];
+      var size = (uint)(header[20] | (header[21] << 8) | (header[22] << 16));
+      var state = header[23];
+      if (size < 24 || pos + (long)size > end) break;
+
+      var contents = data.Slice(pos + 24, checked((int)size - 24)).ToArray();
       files.Add(new FfsFile(name, type, attrs, state, size, contents));
-      pos = Align8(pos + (int)size);
+      pos = Align8(pos + checked((int)size));
     }
     return files;
 
+    static bool IsErased(ReadOnlySpan<byte> bytes) {
+      foreach (var b in bytes)
+        if (b != 0xFF) return false;
+      return true;
+    }
+
     static int Align8(int v) => (v + 7) & ~7;
   }
 
-  /// <summary>Decodes the FFS type byte to the UEFI PI spec name.</summary>
   public static string FileTypeName(byte t) => t switch {
     0x00 => "EFI_FV_FILETYPE_ALL",
     0x01 => "EFI_FV_FILETYPE_RAW",
@@ -163,7 +137,6 @@ private static List<FfsFile> ReadFfsFiles(ReadOnlySpan<byte> data, int start, in
     _ => $"EFI_FV_FILETYPE_UNKNOWN_0x{t:X2}",
   };
 
-  /// <summary>Returns a short type tag for use in entry names (e.g. <c>RAW</c>, <c>DRIVER</c>).</summary>
   public static string ShortTypeTag(byte t) {
     var n = FileTypeName(t);
     const string prefix = "EFI_FV_FILETYPE_";
diff --git a/FileFormats/FileFormat.UefiFv/UefiFvWriter.cs b/FileFormats/FileFormat.UefiFv/UefiFvWriter.cs
new file mode 100644
index 000000000..cc6a148da
--- /dev/null
+++ b/FileFormats/FileFormat.UefiFv/UefiFvWriter.cs
@@ -0,0 +1,128 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace FileFormat.UefiFv;
+
+/// <summary>Writes a standalone PI firmware volume containing ordinary FFS2 files.</summary>
+internal static class UefiFvWriter {
+  internal const int HeaderLength = 72;
+  internal const int FfsHeaderLength = 24;
+  internal const int Alignment = 8;
+  internal const int DefaultReserve = 64 * 1024;
+  internal const uint FvAttributes = 0x0004FEFF;
+  internal static readonly Guid Ffs2Guid = Guid.Parse("8C8CE578-8A3D-4F1C-9935-896185C32DD3");
+
+  internal readonly record struct FileIdentity(Guid Guid, byte Type);
+
+  public static byte[] Build(IEnumerable<(string Name, byte[] Data)> inputs) {
+    var files = inputs.Select(i => (Identity: IdentityFromName(i.Name), i.Data)).ToList();
+    var used = HeaderLength + files.Sum(f => Align8(checked(FfsHeaderLength + f.Data.Length)));
+    var capacity = Align4K(checked(used + DefaultReserve));
+    var image = new byte[capacity];
+    image.AsSpan().Fill(0xFF);
+    WriteVolumeHeader(image);
+
+    var position = HeaderLength;
+    foreach (var file in files) {
+      var encoded = BuildFfsFile(file.Identity.Guid, file.Identity.Type, file.Data);
+      encoded.CopyTo(image, position);
+      position += Align8(encoded.Length);
+    }
+    return image;
+  }
+
+  internal static FileIdentity IdentityFromName(string name) {
+    ArgumentNullException.ThrowIfNull(name);
+    var leaf = Path.GetFileName(name);
+    if (leaf.Length >= 36 && Guid.TryParse(leaf.AsSpan(0, 36), out var guid)) {
+      var type = ParseTypeTag(leaf.Length > 37 ? leaf[37..] : "");
+      return new FileIdentity(guid, type);
+    }
+
+    var hash = SHA256.HashData(Encoding.UTF8.GetBytes(name.Replace('\\', '/')));
+    return new FileIdentity(new Guid(hash.AsSpan(0, 16)), 0x01); // RAW
+  }
+
+  internal static byte[] BuildFfsFile(Guid guid, byte type, ReadOnlySpan<byte> contents) {
+    var size = checked(FfsHeaderLength + contents.Length);
+    if (size > 0xFFFFFF)
+      throw new NotSupportedException("FFS2 files larger than 16 MiB require EFI_FFS_FILE_HEADER2.");
+
+    var file = new byte[size];
+    guid.TryWriteBytes(file.AsSpan(0, 16));
+    file[17] = 0xAA; // fixed checksum when FFS_ATTRIB_CHECKSUM is clear
+    file[18] = type;
+    file[19] = 0;
+    file[20] = (byte)size;
+    file[21] = (byte)(size >> 8);
+    file[22] = (byte)(size >> 16);
+    file[23] = 0xF8;
+    contents.CopyTo(file.AsSpan(FfsHeaderLength));
+    file[16] = HeaderChecksum(file.AsSpan(0, FfsHeaderLength));
+    return file;
+  }
+
+  internal static void WriteVolumeHeader(Span<byte> image) {
+    if (image.Length < HeaderLength) throw new ArgumentException("FV buffer is too small.", nameof(image));
+    image[..HeaderLength].Clear();
+    Ffs2Guid.TryWriteBytes(image.Slice(16, 16));
+    BinaryPrimitives.WriteUInt64LittleEndian(image[32..], (ulong)image.Length);
+    "_FVH"u8.CopyTo(image[40..]);
+    BinaryPrimitives.WriteUInt32LittleEndian(image[44..], FvAttributes);
+    BinaryPrimitives.WriteUInt16LittleEndian(image[48..], HeaderLength);
+    BinaryPrimitives.WriteUInt16LittleEndian(image[52..], 0);
+    image[54] = 0;
+    image[55] = 2;
+    BinaryPrimitives.WriteUInt32LittleEndian(image[56..], 1);
+    BinaryPrimitives.WriteUInt32LittleEndian(image[60..], (uint)image.Length);
+    BinaryPrimitives.WriteUInt32LittleEndian(image[64..], 0);
+    BinaryPrimitives.WriteUInt32LittleEndian(image[68..], 0);
+    BinaryPrimitives.WriteUInt16LittleEndian(image[50..], VolumeHeaderChecksum(image[..HeaderLength]));
+  }
+
+  private static byte HeaderChecksum(ReadOnlySpan<byte> header) {
+    var sum = 0;
+    for (var i = 0; i < header.Length; i++) {
+      if (i is 16 or 17 or 23) continue;
+      sum = (sum + header[i]) & 0xFF;
+    }
+    return unchecked((byte)(0 - sum));
+  }
+
+  private static ushort VolumeHeaderChecksum(ReadOnlySpan<byte> header) {
+    uint sum = 0;
+    for (var i = 0; i + 1 < header.Length; i += 2)
+      sum += BinaryPrimitives.ReadUInt16LittleEndian(header[i..]);
+    return unchecked((ushort)(0 - sum));
+  }
+
+  internal static int Align8(int value) => checked((value + Alignment - 1) & ~(Alignment - 1));
+  private static int Align4K(int value) => checked((value + 4095) & ~4095);
+
+  internal static string EntryName(Guid guid, byte type)
+    => $"{guid:D}_{UefiFvReader.ShortTypeTag(type)}.bin";
+
+  private static byte ParseTypeTag(string tail) {
+    var tag = Path.GetFileNameWithoutExtension(tail).TrimStart('_').ToUpperInvariant();
+    return tag switch {
+      "RAW" => 0x01,
+      "FREEFORM" => 0x02,
+      "SECURITY_CORE" => 0x03,
+      "PEI_CORE" => 0x04,
+      "DXE_CORE" => 0x05,
+      "PEIM" => 0x06,
+      "DRIVER" => 0x07,
+      "COMBINED_PEIM_DRIVER" => 0x08,
+      "APPLICATION" => 0x09,
+      "MM" => 0x0A,
+      "FIRMWARE_VOLUME_IMAGE" => 0x0B,
+      "COMBINED_MM_DXE" => 0x0C,
+      "MM_CORE" => 0x0D,
+      "MM_STANDALONE" => 0x0E,
+      "MM_CORE_STANDALONE" => 0x0F,
+      _ => 0x01,
+    };
+  }
+}
diff --git a/FileSystems/FileSystem.Apfs/ApfsFilesystemDriverAdapter.cs b/FileSystems/FileSystem.Apfs/ApfsFilesystemDriverAdapter.cs
new file mode 100644
index 000000000..cb70d4e1f
--- /dev/null
+++ b/FileSystems/FileSystem.Apfs/ApfsFilesystemDriverAdapter.cs
@@ -0,0 +1,350 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using Compression.Registry;
+using static FileSystem.Apfs.ApfsConstants;
+
+namespace FileSystem.Apfs;
+
+/// <summary>
+/// Native APFS read-only sidecar for the fully decoded single-extent profile.
+/// It uses APFS inode/object IDs directly and serves regular-file reads from the
+/// physical FILE_EXTENT mapping without passing through archive extraction.
+///
+/// The sidecar intentionally requires the repository writer's verified
+/// container-OMAP physical hint. ApfsReader can also heuristically discover OMAP
+/// objects on broader real-world images, but that is not enough evidence to call
+/// encrypted, multi-extent, fusion or otherwise advanced profiles mount-grade.
+/// Those remain available through the conservative archive projection until the
+/// corresponding APFS transaction/object-map semantics are proven.
+/// </summary>
+public sealed class ApfsFilesystemDriverAdapter :
+  IFilesystemDriverAdapter,
+  IBlockDeviceFilesystemDriverProvider {
+
+  public string FormatId => "Apfs";
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var original = image.CanSeek ? image.Position : 0;
+    try {
+      var geometry = ApfsDriverGeometry.ParseWriterProfile(image);
+      using var reader = new ApfsReader(image, leaveOpen: true);
+      ValidateEntries(reader.Entries, reader.BlockSize, image.Length);
+      return new FilesystemDriverProfile(
+        FormatId,
+        "APFS native writer-profile single-extent reader",
+        FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.HardLinks |
+        FilesystemDriverCapabilities.SymbolicLinks |
+        FilesystemDriverCapabilities.CasePreservingNames,
+        FilesystemMutationModel.None,
+        CanMount: true,
+        CanMountWritable: false,
+        [
+          $"Native APFS object IDs are used as path-independent node identities; block size is {geometry.BlockSize:N0} bytes.",
+          "Regular files are accepted only when one decoded physical FILE_EXTENT covers the entire logical file; multi-extent/compressed profiles fail closed.",
+          "This native path is restricted to the repository writer's verified OMAP-hinted profile; broader discovered real-world profiles continue through the conservative read-only projection.",
+          "Writable mounting requires atomic checkpoint/OMAP/spaceman/extent-reference publication plus snapshot/clone/encryption semantics and is not inferred from offline image modification.",
+        ]);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException or OverflowException) {
+      return new FilesystemDriverProfile(
+        FormatId,
+        "unsupported APFS native profile",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [FirstLine(e.Message)]);
+    } finally {
+      if (image.CanSeek) image.Position = original;
+    }
+  }
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(options);
+    if (!options.ReadOnly)
+      throw new NotSupportedException(
+        "APFS mounted writes require transactional CoW publication through OMAP/spaceman/checkpoints and complete snapshot/clone semantics.");
+    var profile = ProbeFilesystem(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("APFS image is not accepted by the native mounted profile: " + string.Join("; ", profile.Limitations));
+    return new ApfsReadOnlyFilesystemSession(image, profile, options.LeaveOpen);
+  }
+
+  public FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device) {
+    ArgumentNullException.ThrowIfNull(device);
+    using var stream = new BlockDeviceStream(device, leaveOpen: true);
+    return ProbeFilesystem(stream);
+  }
+
+  public IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(device);
+    var stream = new BlockDeviceStream(device, leaveOpen: false);
+    try {
+      return OpenFilesystem(stream, options with { LeaveOpen = false });
+    } catch {
+      stream.Dispose();
+      throw;
+    }
+  }
+
+  public FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target) {
+    var profile = ProbeFilesystem(image);
+    var readRequired =
+      FilesystemDriverReadinessLayer.ImageValidation |
+      FilesystemDriverReadinessLayer.Namespace |
+      FilesystemDriverReadinessLayer.SessionStableNodeIds |
+      FilesystemDriverReadinessLayer.NativeStableNodeIds |
+      FilesystemDriverReadinessLayer.ReadData |
+      FilesystemDriverReadinessLayer.RandomAccessRead;
+    var writeRequired = readRequired |
+      FilesystemDriverReadinessLayer.AllocationMap |
+      FilesystemDriverReadinessLayer.WriteData |
+      FilesystemDriverReadinessLayer.Truncate |
+      FilesystemDriverReadinessLayer.NamespaceMutation |
+      FilesystemDriverReadinessLayer.MetadataMutation |
+      FilesystemDriverReadinessLayer.Links |
+      FilesystemDriverReadinessLayer.Flush |
+      FilesystemDriverReadinessLayer.DurabilityModel |
+      FilesystemDriverReadinessLayer.Recovery |
+      FilesystemDriverReadinessLayer.Concurrency;
+    var available = profile.CanMount
+      ? readRequired |
+        FilesystemDriverReadinessLayer.AllocationMap |
+        FilesystemDriverReadinessLayer.Links |
+        FilesystemDriverReadinessLayer.ValidationCorpus
+      : FilesystemDriverReadinessLayer.None;
+
+    var blockers = new List<string>(profile.Limitations);
+    if (target == FilesystemDriverTarget.ReadWrite) {
+      blockers.Add("Implement arbitrary multi-extent, sparse, compressed and clone-aware dstream mapping with extent-reference ownership/refcounts.");
+      blockers.Add("Implement inode/DREC/xattr/sibling-link B-tree insert/delete/split/merge with APFS name normalization/hash and hard-link semantics.");
+      blockers.Add("Allocate through spaceman/CIB/CAB/free-queue structures and update volume/container object maps without overwriting the active transaction.");
+      blockers.Add("Publish new APSB/NXSB checkpoint descriptors/maps and transaction IDs atomically, retaining the old checkpoint until the new graph is durable.");
+      blockers.Add("Implement snapshot metadata, clones/reflinks, encrypted crypto states/keybags, sealed/system volume roles and fusion/multi-device mapping before enabling those profiles.");
+      blockers.Add("Add crash fault-injection and fsck_apfs/mount interoperability corpora plus concurrent inode/dentry/transaction locking.");
+    }
+    var required = target == FilesystemDriverTarget.ReadOnly ? readRequired : writeRequired;
+    return new FilesystemDriverReadinessReport(
+      FormatId,
+      target,
+      available,
+      required,
+      profile.CanMount && (available & required) == required,
+      UsesNativeProvider: true,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static void ValidateEntries(IReadOnlyList<ApfsEntry> entries, uint blockSize, long imageLength) {
+    var paths = new HashSet<string>(StringComparer.Ordinal);
+    foreach (var entry in entries) {
+      var path = Normalize(entry.Name);
+      if (path.Length == 0 || !paths.Add(path))
+        throw new InvalidDataException($"APFS namespace contains an empty or duplicate path '{path}'.");
+      if (entry.ObjectId < APFS_MIN_USER_INO_NUM)
+        throw new InvalidDataException($"APFS user namespace exposed reserved object id {entry.ObjectId} as '{path}'.");
+      if (entry.Size < 0)
+        throw new InvalidDataException($"APFS entry '{path}' has a negative logical size.");
+      if (entry.IsSymlink && entry.LinkTarget == null)
+        throw new NotSupportedException($"APFS symlink '{path}' has no decoded embedded target.");
+      if (entry.IsDirectory || entry.IsSymlink || entry.Size == 0) continue;
+      if (entry.FirstBlock == 0 || entry.ExtentLength < entry.Size)
+        throw new NotSupportedException(
+          $"APFS file '{path}' is not completely covered by the decoded single FILE_EXTENT profile.");
+      var offset = checked((long)entry.FirstBlock * blockSize);
+      if (offset < 0 || offset > imageLength - entry.Size)
+        throw new InvalidDataException($"APFS file '{path}' extent lies outside the image.");
+    }
+  }
+
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static string FirstLine(string message) {
+    var p = message.IndexOfAny(['\r', '\n']);
+    return p < 0 ? message : message[..p];
+  }
+}
+
+internal sealed class ApfsReadOnlyFilesystemSession : IFilesystemSession {
+  private readonly Stream _image;
+  private readonly bool _leaveOpen;
+  private readonly object _ioGate = new();
+  private readonly ReadOnlyFilesystemSnapshotSession _namespace;
+  private bool _disposed;
+
+  public ApfsReadOnlyFilesystemSession(Stream image, FilesystemDriverProfile profile, bool leaveOpen) {
+    _image = image;
+    _leaveOpen = leaveOpen;
+    using var reader = new ApfsReader(image, leaveOpen: true);
+    var records = reader.Entries.ToArray();
+    var blockSize = reader.BlockSize;
+    var rootId = new FilesystemNodeId(APFS_ROOT_DIR_INO_NUM, 0);
+    var (nodes, links) = BuildNamespace(records, rootId, blockSize);
+    _namespace = new ReadOnlyFilesystemSnapshotSession(profile, rootId, nodes, links);
+  }
+
+  public FilesystemDriverProfile Profile => _namespace.Profile;
+  public FilesystemNodeId RootNodeId => _namespace.RootNodeId;
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) => _namespace.Stat(nodeId);
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) => _namespace.Lookup(parentDirectory, name);
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) => _namespace.Enumerate(directory);
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) => _namespace.OpenFile(nodeId, access);
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => _namespace.CreateFile(parentDirectory, name);
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.CreateDirectory(parentDirectory, name);
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => _namespace.DeleteFile(parentDirectory, name);
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.RemoveDirectory(parentDirectory, name);
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace) => _namespace.Rename(oldParent, oldName, newParent, newName, replace);
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName) => _namespace.CreateHardLink(existingNode, newParent, newName);
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target) => _namespace.CreateSymbolicLink(parentDirectory, name, target);
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) => _namespace.ReadSymbolicLink(nodeId);
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => _namespace.SetMetadata(nodeId, patch);
+  public void Flush() => _namespace.Flush();
+  public IFilesystemTransaction BeginTransaction() => _namespace.BeginTransaction();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _namespace.Dispose();
+    if (!_leaveOpen) _image.Dispose();
+  }
+
+  private (FilesystemSnapshotNode[] Nodes, FilesystemSnapshotDirectoryEntry[] Links) BuildNamespace(
+      IReadOnlyList<ApfsEntry> records,
+      FilesystemNodeId rootId,
+      uint blockSize) {
+    var aliases = records.GroupBy(r => r.ObjectId).ToDictionary(g => g.Key, g => checked((uint)g.Count()));
+    var nodes = new Dictionary<ulong, FilesystemSnapshotNode> {
+      [APFS_ROOT_DIR_INO_NUM] = new(rootId, default, string.Empty, FilesystemNodeKind.Directory, 0, 0),
+    };
+    var links = new List<FilesystemSnapshotDirectoryEntry>(records.Count);
+    var pathToNode = new Dictionary<string, FilesystemNodeId>(StringComparer.Ordinal) { [string.Empty] = rootId };
+
+    foreach (var record in records.OrderBy(r => Depth(r.Name)).ThenBy(r => r.Name, StringComparer.Ordinal)) {
+      var path = Normalize(record.Name);
+      var slash = path.LastIndexOf('/');
+      var parentPath = slash < 0 ? string.Empty : path[..slash];
+      var name = slash < 0 ? path : path[(slash + 1)..];
+      if (!pathToNode.TryGetValue(parentPath, out var parent))
+        throw new InvalidDataException($"APFS entry '{path}' has no decoded parent '{parentPath}'.");
+      var nodeId = new FilesystemNodeId(record.ObjectId, 0);
+      var kind = record.IsDirectory ? FilesystemNodeKind.Directory
+        : record.IsSymlink ? FilesystemNodeKind.SymbolicLink
+        : FilesystemNodeKind.RegularFile;
+      if (!nodes.TryGetValue(record.ObjectId, out var existing)) {
+        Func<IFilesystemFileHandle>? open = null;
+        if (kind == FilesystemNodeKind.RegularFile)
+          open = () => new ApfsExtentFileHandle(nodeId, _image, _ioGate, blockSize, record.FirstBlock, record.Size);
+        nodes[record.ObjectId] = new FilesystemSnapshotNode(
+          nodeId,
+          parent,
+          name,
+          kind,
+          kind == FilesystemNodeKind.Directory ? 0 : record.Size,
+          kind == FilesystemNodeKind.RegularFile ? record.ExtentLength : 0,
+          LinkCount: aliases[record.ObjectId],
+          Modified: ToOffset(record.LastModified),
+          SymbolicLinkTarget: record.LinkTarget,
+          OpenReadHandle: open);
+      } else if (existing.Kind != kind || existing.Size != (kind == FilesystemNodeKind.Directory ? 0 : record.Size)) {
+        throw new InvalidDataException($"APFS aliases for object {record.ObjectId} disagree on object metadata.");
+      }
+      links.Add(new FilesystemSnapshotDirectoryEntry(parent, name, nodeId));
+      if (kind == FilesystemNodeKind.Directory) pathToNode[path] = nodeId;
+    }
+    return (nodes.Values.ToArray(), links.ToArray());
+  }
+
+  private static int Depth(string path) => Normalize(path).Count(c => c == '/');
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static DateTimeOffset? ToOffset(DateTime? value)
+    => value == null ? null : new DateTimeOffset(DateTime.SpecifyKind(value.Value, DateTimeKind.Utc), TimeSpan.Zero);
+}
+
+internal sealed class ApfsExtentFileHandle : IFilesystemFileHandle {
+  private readonly Stream _image;
+  private readonly object _gate;
+  private readonly long _physicalOffset;
+  private readonly long _length;
+  private bool _disposed;
+
+  public ApfsExtentFileHandle(
+      FilesystemNodeId nodeId,
+      Stream image,
+      object gate,
+      uint blockSize,
+      ulong firstBlock,
+      long length) {
+    NodeId = nodeId;
+    _image = image;
+    _gate = gate;
+    _physicalOffset = checked((long)firstBlock * blockSize);
+    _length = Math.Max(0, length);
+  }
+
+  public FilesystemNodeId NodeId { get; }
+  public long Length { get { ThrowIfDisposed(); return _length; } }
+
+  public int Read(long offset, Span<byte> destination) {
+    ThrowIfDisposed();
+    if (offset < 0) throw new ArgumentOutOfRangeException(nameof(offset));
+    if (destination.Length == 0 || offset >= _length) return 0;
+    var count = checked((int)Math.Min(destination.Length, _length - offset));
+    lock (_gate) {
+      _image.Position = checked(_physicalOffset + offset);
+      var total = 0;
+      while (total < count) {
+        var read = _image.Read(destination.Slice(total, count - total));
+        if (read == 0) throw new EndOfStreamException("APFS file extent ended before its logical size.");
+        total += read;
+      }
+    }
+    return count;
+  }
+
+  public void Write(long offset, ReadOnlySpan<byte> source) => throw new NotSupportedException("APFS native extent handle is read-only.");
+  public void SetLength(long length) => throw new NotSupportedException("APFS native extent handle is read-only.");
+  public void Flush() => ThrowIfDisposed();
+  public void Dispose() => _disposed = true;
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
+
+internal readonly record struct ApfsDriverGeometry(uint BlockSize, ulong OmapHint) {
+  public static ApfsDriverGeometry ParseWriterProfile(Stream image) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("APFS driver probing requires a readable, seekable stream.", nameof(image));
+    if (image.Length < 4096) throw new InvalidDataException("APFS image is too small.");
+    var original = image.Position;
+    Span<byte> header = stackalloc byte[4096];
+    try {
+      image.Position = 0;
+      image.ReadExactly(header);
+    } finally {
+      image.Position = original;
+    }
+    if (BinaryPrimitives.ReadUInt32LittleEndian(header[32..36]) != 0x4253584E)
+      throw new InvalidDataException("APFS NXSB magic is invalid.");
+    var blockSize = BinaryPrimitives.ReadUInt32LittleEndian(header[36..40]);
+    if (blockSize is < 4096 or > 65536 || (blockSize & (blockSize - 1)) != 0)
+      throw new NotSupportedException($"APFS block size {blockSize:N0} is unsupported.");
+    var hint = BinaryPrimitives.ReadUInt64LittleEndian(header[3072..3080]);
+    if (hint == 0)
+      throw new NotSupportedException("APFS native mounted profile currently requires the repository writer's physical OMAP hint; use the derived read-only projection for broader images.");
+    var offset = checked((long)hint * blockSize);
+    if (offset < 0 || offset > image.Length - blockSize)
+      throw new InvalidDataException("APFS OMAP hint lies outside the image.");
+    Span<byte> objectHeader = stackalloc byte[32];
+    try {
+      image.Position = offset;
+      image.ReadExactly(objectHeader);
+    } finally {
+      image.Position = original;
+    }
+    var type = BinaryPrimitives.ReadUInt32LittleEndian(objectHeader[24..28]) & OBJECT_TYPE_MASK;
+    if (type != OBJECT_TYPE_OMAP)
+      throw new InvalidDataException("APFS OMAP hint does not reference an OMAP object.");
+    return new ApfsDriverGeometry(blockSize, hint);
+  }
+}
diff --git a/FileSystems/FileSystem.Btrfs/BtrfsFilesystemDriverAdapter.cs b/FileSystems/FileSystem.Btrfs/BtrfsFilesystemDriverAdapter.cs
new file mode 100644
index 000000000..1339047c2
--- /dev/null
+++ b/FileSystems/FileSystem.Btrfs/BtrfsFilesystemDriverAdapter.cs
@@ -0,0 +1,346 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+
+namespace FileSystem.Btrfs;
+
+/// <summary>
+/// Native read-only Btrfs driver for single-device, single-stripe volumes whose
+/// namespace and EXTENT_DATA records are completely understood. Native inode IDs
+/// are retained across aliases; a global logical extent map provides true
+/// positional reads, including holes and preallocated unwritten ranges, without
+/// depending on the archive reader's leaf-local extraction order.
+/// </summary>
+public sealed class BtrfsFilesystemDriverAdapter :
+  IFilesystemDriverAdapter,
+  IBlockDeviceFilesystemDriverProvider {
+
+  public string FormatId => "Btrfs";
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var original = image.CanSeek ? image.Position : 0;
+    try {
+      using var reader = new BtrfsReader(image, leaveOpen: true);
+      var records = reader.Entries.ToArray();
+      ValidateNamespace(records);
+      var map = BtrfsNativeFileMap.Read(image, records);
+
+      return new FilesystemDriverProfile(
+        FormatId,
+        $"Btrfs native single-device extent reader ({map.NodeSize:N0}-byte nodes)",
+        FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.HardLinks |
+        FilesystemDriverCapabilities.SparseFiles |
+        FilesystemDriverCapabilities.CaseSensitiveNames |
+        FilesystemDriverCapabilities.CasePreservingNames,
+        FilesystemMutationModel.None,
+        CanMount: true,
+        CanMountWritable: false,
+        [
+          "Native Btrfs inode object IDs are used as path-independent identities; the root directory uses native object id 256.",
+          "EXTENT_DATA records are merged globally across all FS-tree leaves before reads; missing ranges, explicit sparse extents and prealloc extents return zeroes.",
+          "Only single-device, single-stripe chunks with uncompressed/unencrypted/unencoded inline or regular/prealloc extents are accepted; RAID and compressed profiles fail closed.",
+          "Mounted writes remain disabled until CoW tree mutation, delayed refs, checksum/free-space trees, transaction generation and log-tree replay are one crash-consistent core.",
+        ]);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException or OverflowException) {
+      return new FilesystemDriverProfile(
+        FormatId,
+        "unsupported or damaged Btrfs native profile",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [FirstLine(e.Message)]);
+    } finally {
+      if (image.CanSeek) image.Position = original;
+    }
+  }
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(options);
+    if (!options.ReadOnly)
+      throw new NotSupportedException(
+        "Btrfs mounted writes require CoW tree publication, delayed refs, checksum/free-space updates, transaction generations and log-tree recovery; offline archive mutation is not sufficient.");
+    var profile = ProbeFilesystem(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("Btrfs image is not accepted by the native mounted profile: " + string.Join("; ", profile.Limitations));
+    return new BtrfsReadOnlyFilesystemSession(image, profile, options.LeaveOpen);
+  }
+
+  public FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device) {
+    ArgumentNullException.ThrowIfNull(device);
+    using var stream = new BlockDeviceStream(device, leaveOpen: true);
+    return ProbeFilesystem(stream);
+  }
+
+  public IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(device);
+    ArgumentNullException.ThrowIfNull(options);
+    var stream = new BlockDeviceStream(device, leaveOpen: false);
+    try {
+      return OpenFilesystem(stream, options with { LeaveOpen = false });
+    } catch {
+      stream.Dispose();
+      throw;
+    }
+  }
+
+  public FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(
+      Stream image,
+      FilesystemDriverTarget target) {
+    var profile = ProbeFilesystem(image);
+    var readRequired =
+      FilesystemDriverReadinessLayer.ImageValidation |
+      FilesystemDriverReadinessLayer.Namespace |
+      FilesystemDriverReadinessLayer.SessionStableNodeIds |
+      FilesystemDriverReadinessLayer.NativeStableNodeIds |
+      FilesystemDriverReadinessLayer.ReadData |
+      FilesystemDriverReadinessLayer.RandomAccessRead;
+    var writeRequired = readRequired |
+      FilesystemDriverReadinessLayer.AllocationMap |
+      FilesystemDriverReadinessLayer.WriteData |
+      FilesystemDriverReadinessLayer.Truncate |
+      FilesystemDriverReadinessLayer.NamespaceMutation |
+      FilesystemDriverReadinessLayer.MetadataMutation |
+      FilesystemDriverReadinessLayer.Links |
+      FilesystemDriverReadinessLayer.Flush |
+      FilesystemDriverReadinessLayer.DurabilityModel |
+      FilesystemDriverReadinessLayer.Recovery |
+      FilesystemDriverReadinessLayer.Concurrency;
+
+    var available = profile.CanMount
+      ? readRequired |
+        FilesystemDriverReadinessLayer.AllocationMap |
+        FilesystemDriverReadinessLayer.Links |
+        FilesystemDriverReadinessLayer.ValidationCorpus
+      : FilesystemDriverReadinessLayer.None;
+    var blockers = new List<string>(profile.Limitations);
+    if (target == FilesystemDriverTarget.ReadWrite) {
+      blockers.Add("Implement fs/root/chunk/extent/checksum/free-space tree insert/delete/split/merge as copy-on-write path updates rather than in-place archive edits.");
+      blockers.Add("Implement extent refs/backrefs, delayed refs, block-group accounting, free-space tree/cache and data checksums for allocation and truncation.");
+      blockers.Add("Publish new tree roots under one transaction generation and rotate all superblock mirrors only after the new graph is durable.");
+      blockers.Add("Implement log-tree/fsync intent publication and replay so synchronous namespace/data changes survive before the main transaction commits.");
+      blockers.Add("Cover subvolumes, snapshots, reflinks/shared extents, compression, RAID/DUP profiles, qgroups, send/receive, device replace/scrub and zoned profiles.");
+      blockers.Add("Add inode/dentry/tree locking plus crash fault-injection and btrfs check/kernel-mount interoperability corpora before enabling mounted mutation.");
+    }
+
+    var required = target == FilesystemDriverTarget.ReadOnly ? readRequired : writeRequired;
+    return new FilesystemDriverReadinessReport(
+      FormatId,
+      target,
+      available,
+      required,
+      profile.CanMount && (available & required) == required,
+      UsesNativeProvider: true,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static void ValidateNamespace(IReadOnlyList<BtrfsEntry> entries) {
+    var paths = new HashSet<string>(StringComparer.Ordinal);
+    foreach (var entry in entries) {
+      var path = Normalize(entry.Name);
+      if (path.Length == 0 || !paths.Add(path))
+        throw new InvalidDataException($"Btrfs namespace contains an empty or duplicate path '{path}'.");
+      if (entry.Inode <= 0)
+        throw new InvalidDataException($"Btrfs entry '{path}' has invalid inode {entry.Inode}.");
+      if (entry.Size < 0)
+        throw new InvalidDataException($"Btrfs entry '{path}' has a negative logical size.");
+    }
+  }
+
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static string FirstLine(string message) {
+    var p = message.IndexOfAny(['\r', '\n']);
+    return p < 0 ? message : message[..p];
+  }
+}
+
+internal sealed class BtrfsReadOnlyFilesystemSession : IFilesystemSession {
+  private readonly Stream _image;
+  private readonly bool _leaveOpen;
+  private readonly object _ioGate = new();
+  private readonly ReadOnlyFilesystemSnapshotSession _namespace;
+  private bool _disposed;
+
+  public BtrfsReadOnlyFilesystemSession(Stream image, FilesystemDriverProfile profile, bool leaveOpen) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("Btrfs mounted reads require a readable, seekable image.", nameof(image));
+    _image = image;
+    _leaveOpen = leaveOpen;
+    using var reader = new BtrfsReader(image, leaveOpen: true);
+    var records = reader.Entries.ToArray();
+    var map = BtrfsNativeFileMap.Read(image, records);
+    var (nodes, links) = BuildNamespace(records, map);
+    _namespace = new ReadOnlyFilesystemSnapshotSession(profile, new FilesystemNodeId(256, 0), nodes, links);
+  }
+
+  public FilesystemDriverProfile Profile => _namespace.Profile;
+  public FilesystemNodeId RootNodeId => _namespace.RootNodeId;
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) => _namespace.Stat(nodeId);
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) => _namespace.Lookup(parentDirectory, name);
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) => _namespace.Enumerate(directory);
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) => _namespace.OpenFile(nodeId, access);
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => _namespace.CreateFile(parentDirectory, name);
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.CreateDirectory(parentDirectory, name);
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => _namespace.DeleteFile(parentDirectory, name);
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.RemoveDirectory(parentDirectory, name);
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace) => _namespace.Rename(oldParent, oldName, newParent, newName, replace);
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName) => _namespace.CreateHardLink(existingNode, newParent, newName);
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target) => _namespace.CreateSymbolicLink(parentDirectory, name, target);
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) => _namespace.ReadSymbolicLink(nodeId);
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => _namespace.SetMetadata(nodeId, patch);
+  public void Flush() => _namespace.Flush();
+  public IFilesystemTransaction BeginTransaction() => _namespace.BeginTransaction();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _namespace.Dispose();
+    if (!_leaveOpen) _image.Dispose();
+  }
+
+  private (FilesystemSnapshotNode[] Nodes, FilesystemSnapshotDirectoryEntry[] Links) BuildNamespace(
+      IReadOnlyList<BtrfsEntry> records,
+      BtrfsNativeFileMap.Map map) {
+    var aliases = records.GroupBy(r => r.Inode).ToDictionary(g => g.Key, g => checked((uint)g.Count()));
+    var rootId = new FilesystemNodeId(256, 0);
+    var nodes = new Dictionary<long, FilesystemSnapshotNode> {
+      [256] = new(rootId, default, string.Empty, FilesystemNodeKind.Directory, 0, 0),
+    };
+    var links = new List<FilesystemSnapshotDirectoryEntry>(records.Count);
+    var pathToNode = new Dictionary<string, FilesystemNodeId>(StringComparer.Ordinal) { [string.Empty] = rootId };
+
+    foreach (var record in records.OrderBy(r => Depth(r.Name)).ThenBy(r => r.Name, StringComparer.Ordinal)) {
+      var path = Normalize(record.Name);
+      var slash = path.LastIndexOf('/');
+      var parentPath = slash < 0 ? string.Empty : path[..slash];
+      var name = slash < 0 ? path : path[(slash + 1)..];
+      if (!pathToNode.TryGetValue(parentPath, out var parent))
+        throw new InvalidDataException($"Btrfs entry '{path}' has no decoded parent '{parentPath}'.");
+
+      var nodeId = new FilesystemNodeId(checked((ulong)record.Inode), 0);
+      var kind = record.IsDirectory ? FilesystemNodeKind.Directory : FilesystemNodeKind.RegularFile;
+      if (!nodes.TryGetValue(record.Inode, out var existing)) {
+        Func<IFilesystemFileHandle>? open = null;
+        long allocated = 0;
+        if (kind == FilesystemNodeKind.RegularFile) {
+          if (!map.Files.TryGetValue(record.Inode, out var segments))
+            throw new InvalidDataException($"Btrfs inode {record.Inode} has no native file map.");
+          allocated = segments.Where(s => !s.IsZero).Sum(s => s.Length);
+          var captured = segments;
+          open = () => new BtrfsMappedFileHandle(nodeId, _image, _ioGate, record.Size, captured);
+        }
+        nodes[record.Inode] = new FilesystemSnapshotNode(
+          nodeId,
+          parent,
+          name,
+          kind,
+          kind == FilesystemNodeKind.Directory ? 0 : record.Size,
+          allocated,
+          LinkCount: aliases[record.Inode],
+          Modified: ToOffset(record.LastModified),
+          OpenReadHandle: open);
+      } else if (existing.Kind != kind || existing.Size != (kind == FilesystemNodeKind.Directory ? 0 : record.Size)) {
+        throw new InvalidDataException($"Btrfs aliases for inode {record.Inode} disagree on object metadata.");
+      }
+
+      links.Add(new FilesystemSnapshotDirectoryEntry(parent, name, nodeId));
+      if (kind == FilesystemNodeKind.Directory) pathToNode[path] = nodeId;
+    }
+    return (nodes.Values.ToArray(), links.ToArray());
+  }
+
+  private static int Depth(string path) => Normalize(path).Count(c => c == '/');
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static DateTimeOffset? ToOffset(DateTime? value)
+    => value == null ? null : new DateTimeOffset(DateTime.SpecifyKind(value.Value, DateTimeKind.Utc), TimeSpan.Zero);
+}
+
+internal sealed class BtrfsMappedFileHandle : IFilesystemFileHandle {
+  private readonly Stream _image;
+  private readonly object _gate;
+  private readonly long _length;
+  private readonly BtrfsNativeFileMap.Segment[] _segments;
+  private bool _disposed;
+
+  public BtrfsMappedFileHandle(
+      FilesystemNodeId nodeId,
+      Stream image,
+      object gate,
+      long length,
+      BtrfsNativeFileMap.Segment[] segments) {
+    NodeId = nodeId;
+    _image = image;
+    _gate = gate;
+    _length = Math.Max(0, length);
+    _segments = segments;
+  }
+
+  public FilesystemNodeId NodeId { get; }
+  public long Length { get { ThrowIfDisposed(); return _length; } }
+
+  public int Read(long offset, Span<byte> destination) {
+    ThrowIfDisposed();
+    if (offset < 0) throw new ArgumentOutOfRangeException(nameof(offset));
+    if (destination.Length == 0 || offset >= _length) return 0;
+
+    var totalWanted = checked((int)Math.Min(destination.Length, _length - offset));
+    var output = destination[..totalWanted];
+    var logical = offset;
+    var written = 0;
+    var segmentIndex = 0;
+    while (segmentIndex < _segments.Length && _segments[segmentIndex].End <= logical) segmentIndex++;
+
+    while (written < totalWanted) {
+      var remaining = totalWanted - written;
+      if (segmentIndex >= _segments.Length) {
+        output.Slice(written, remaining).Clear();
+        written += remaining;
+        break;
+      }
+
+      var segment = _segments[segmentIndex];
+      if (logical < segment.FileOffset) {
+        var zero = checked((int)Math.Min(remaining, segment.FileOffset - logical));
+        output.Slice(written, zero).Clear();
+        logical += zero;
+        written += zero;
+        continue;
+      }
+      if (logical >= segment.End) {
+        segmentIndex++;
+        continue;
+      }
+
+      var within = logical - segment.FileOffset;
+      var take = checked((int)Math.Min(remaining, segment.Length - within));
+      if (segment.IsZero) {
+        output.Slice(written, take).Clear();
+      } else {
+        lock (_gate) {
+          _image.Position = checked(segment.PhysicalOffset!.Value + within);
+          var done = 0;
+          while (done < take) {
+            var n = _image.Read(output.Slice(written + done, take - done));
+            if (n == 0) throw new EndOfStreamException("Btrfs physical extent ended before its decoded logical range.");
+            done += n;
+          }
+        }
+      }
+      logical += take;
+      written += take;
+      if (logical >= segment.End) segmentIndex++;
+    }
+    return written;
+  }
+
+  public void Write(long offset, ReadOnlySpan<byte> source) => throw new NotSupportedException("Btrfs native mapped handle is read-only.");
+  public void SetLength(long length) => throw new NotSupportedException("Btrfs native mapped handle is read-only.");
+  public void Flush() => ThrowIfDisposed();
+  public void Dispose() => _disposed = true;
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/FileSystems/FileSystem.Btrfs/BtrfsNativeFileMap.cs b/FileSystems/FileSystem.Btrfs/BtrfsNativeFileMap.cs
new file mode 100644
index 000000000..165022a87
--- /dev/null
+++ b/FileSystems/FileSystem.Btrfs/BtrfsNativeFileMap.cs
@@ -0,0 +1,357 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+
+namespace FileSystem.Btrfs;
+
+/// <summary>
+/// Mount-grade logical file map for the single-device Btrfs profile understood
+/// by this package. Unlike <see cref="BtrfsReader.ExtractTo"/>, this collector
+/// merges EXTENT_DATA records across every FS-tree leaf before ordering them by
+/// file offset, so a file cannot be reordered merely because its keys crossed a
+/// leaf boundary. Missing logical ranges, explicit sparse extents and prealloc
+/// extents read as zeroes. Compressed/encrypted/other-encoded records fail
+/// closed until their decoder is implemented.
+/// </summary>
+internal static class BtrfsNativeFileMap {
+  private const int SuperblockOffset = 0x10000;
+  private const int SuperblockSize = 4096;
+  private const int SystemChunkArrayOffset = 0x32B;
+  private const byte ChunkItem = 228;
+  private const byte RootItem = 132;
+  private const byte ExtentData = 108;
+  private const long FsTreeObjectId = 5;
+
+  internal readonly record struct Segment(long FileOffset, long Length, long? PhysicalOffset) {
+    public long End => checked(FileOffset + Length);
+    public bool IsZero => PhysicalOffset == null;
+  }
+
+  internal sealed record Map(
+    uint NodeSize,
+    uint SectorSize,
+    IReadOnlyDictionary<long, Segment[]> Files,
+    bool UsesRealChunkMap);
+
+  private readonly record struct Chunk(long Logical, long Physical, long Length);
+
+  public static Map Read(Stream image, IReadOnlyList<BtrfsEntry> entries) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(entries);
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("Btrfs native mapping requires a readable, seekable image.", nameof(image));
+    if (image.Length < SuperblockOffset + SuperblockSize)
+      throw new InvalidDataException("Btrfs image is too small for its superblock.");
+
+    var sb = ReadBytes(image, SuperblockOffset, SuperblockSize);
+    if (!sb.AsSpan(0x40, 8).SequenceEqual("_BHRfS_M"u8))
+      throw new InvalidDataException("Btrfs superblock magic is invalid.");
+
+    var rootTreeLogical = BinaryPrimitives.ReadInt64LittleEndian(sb.AsSpan(0x50));
+    var chunkTreeLogical = BinaryPrimitives.ReadInt64LittleEndian(sb.AsSpan(0x58));
+    var sectorSize = BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(0x90));
+    var nodeSize = BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(0x94));
+    var sysChunkSize = checked((int)BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(0xA0)));
+
+    if (nodeSize is < 4096 or > 65536 || (nodeSize & (nodeSize - 1)) != 0)
+      throw new NotSupportedException($"Btrfs node size {nodeSize:N0} is unsupported.");
+    if (sectorSize is < 512 or > 65536 || (sectorSize & (sectorSize - 1)) != 0)
+      throw new NotSupportedException($"Btrfs sector size {sectorSize:N0} is unsupported.");
+    if (sysChunkSize < 0 || SystemChunkArrayOffset + sysChunkSize > sb.Length)
+      throw new InvalidDataException("Btrfs sys_chunk_array exceeds the superblock.");
+
+    var chunks = new List<Chunk>();
+    ParseSystemChunkArray(sb.AsSpan(SystemChunkArrayOffset, sysChunkSize), chunks);
+    if (chunks.Count == 0)
+      throw new NotSupportedException(
+        "Btrfs native mounting requires a real single-device sys_chunk_array; synthetic identity-mapped test images remain reader-only fixtures.");
+
+    var chunkTreePhysical = LogicalToPhysical(chunks, chunkTreeLogical, image.Length);
+    WalkChunkTree(image, chunkTreePhysical, nodeSize, chunks, new HashSet<long>());
+
+    var rootTreePhysical = LogicalToPhysical(chunks, rootTreeLogical, image.Length);
+    var fsRootLogical = FindFsRoot(image, rootTreePhysical, nodeSize, chunks, new HashSet<long>());
+    if (fsRootLogical < 0)
+      throw new InvalidDataException("Btrfs FS-tree root could not be resolved from the root tree.");
+
+    var fsRootPhysical = LogicalToPhysical(chunks, fsRootLogical, image.Length);
+    var leaves = new List<long>();
+    CollectLeaves(image, fsRootPhysical, nodeSize, chunks, leaves, new HashSet<long>());
+    if (leaves.Count == 0)
+      throw new InvalidDataException("Btrfs FS tree contains no reachable leaves.");
+
+    var byInode = new Dictionary<long, List<Segment>>();
+    foreach (var leaf in leaves)
+      CollectExtentRecords(image, leaf, nodeSize, chunks, byInode);
+
+    var wanted = entries.Where(e => !e.IsDirectory)
+      .GroupBy(e => e.Inode)
+      .ToDictionary(g => g.Key, g => g.Max(e => e.Size));
+    var result = new Dictionary<long, Segment[]>();
+
+    foreach (var (inode, size) in wanted) {
+      if (inode <= 0)
+        throw new InvalidDataException($"Btrfs exposes invalid inode {inode}.");
+      if (size < 0)
+        throw new InvalidDataException($"Btrfs inode {inode} has a negative logical size.");
+      if (size == 0) {
+        result[inode] = [];
+        continue;
+      }
+      if (!byInode.TryGetValue(inode, out var raw) || raw.Count == 0)
+        throw new NotSupportedException($"Btrfs inode {inode} has no decoded EXTENT_DATA mapping.");
+
+      var ordered = raw.OrderBy(s => s.FileOffset).ThenBy(s => s.Length).ToArray();
+      long previousEnd = 0;
+      foreach (var segment in ordered) {
+        if (segment.FileOffset < 0 || segment.Length <= 0)
+          throw new InvalidDataException($"Btrfs inode {inode} contains an invalid logical extent.");
+        if (segment.FileOffset < previousEnd)
+          throw new NotSupportedException($"Btrfs inode {inode} has overlapping logical extents.");
+        previousEnd = segment.End;
+        if (segment.PhysicalOffset is { } physical &&
+            (physical < 0 || physical > image.Length - segment.Length))
+          throw new InvalidDataException($"Btrfs inode {inode} extent lies outside the image.");
+      }
+      result[inode] = ordered;
+    }
+
+    return new Map(nodeSize, sectorSize, result, UsesRealChunkMap: true);
+  }
+
+  private static void ParseSystemChunkArray(ReadOnlySpan<byte> array, List<Chunk> chunks) {
+    var pos = 0;
+    while (pos + 17 + 48 <= array.Length) {
+      var keyType = array[pos + 8];
+      var logical = BinaryPrimitives.ReadInt64LittleEndian(array[(pos + 9)..]);
+      pos += 17;
+      if (keyType != ChunkItem)
+        throw new NotSupportedException($"Btrfs sys_chunk_array contains unexpected key type {keyType}.");
+
+      var length = BinaryPrimitives.ReadInt64LittleEndian(array[pos..]);
+      var numStripes = BinaryPrimitives.ReadUInt16LittleEndian(array[(pos + 44)..]);
+      var subStripes = BinaryPrimitives.ReadUInt16LittleEndian(array[(pos + 46)..]);
+      pos += 48;
+      if (numStripes != 1 || subStripes > 1)
+        throw new NotSupportedException(
+          $"Btrfs native mounting currently requires one physical stripe per chunk (found {numStripes}, sub_stripes={subStripes}).");
+      if (pos + 32 > array.Length)
+        throw new InvalidDataException("Btrfs sys_chunk_array stripe is truncated.");
+      var physical = BinaryPrimitives.ReadInt64LittleEndian(array[(pos + 8)..]);
+      AddChunk(chunks, logical, physical, length);
+      pos += 32;
+    }
+    if (pos != array.Length && array[pos..].IndexOfAnyExcept((byte)0) >= 0)
+      throw new InvalidDataException("Btrfs sys_chunk_array has trailing non-zero bytes.");
+  }
+
+  private static void WalkChunkTree(
+      Stream image,
+      long physical,
+      uint nodeSize,
+      List<Chunk> chunks,
+      HashSet<long> visited) {
+    if (!visited.Add(physical)) return;
+    var node = ReadNode(image, physical, nodeSize);
+    var nritems = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(96));
+    var level = node[100];
+    if (level > 0) {
+      for (uint i = 0; i < nritems; i++) {
+        var item = 101 + checked((int)i * 33);
+        if (item + 33 > node.Length) throw new InvalidDataException("Btrfs chunk-tree node item is truncated.");
+        var childLogical = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(item + 17));
+        WalkChunkTree(image, LogicalToPhysical(chunks, childLogical, image.Length), nodeSize, chunks, visited);
+      }
+      return;
+    }
+
+    for (uint i = 0; i < nritems; i++) {
+      var item = 101 + checked((int)i * 25);
+      if (item + 25 > node.Length) throw new InvalidDataException("Btrfs chunk-tree leaf item is truncated.");
+      if (node[item + 8] != ChunkItem) continue;
+      var logical = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(item + 9));
+      var dataOffset = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(item + 17));
+      var dataSize = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(item + 21));
+      var data = 101 + checked((int)dataOffset);
+      if (dataSize < 80 || data < 0 || data + dataSize > node.Length)
+        throw new InvalidDataException("Btrfs CHUNK_ITEM value is truncated.");
+      var length = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(data));
+      var numStripes = BinaryPrimitives.ReadUInt16LittleEndian(node.AsSpan(data + 44));
+      var subStripes = BinaryPrimitives.ReadUInt16LittleEndian(node.AsSpan(data + 46));
+      if (numStripes != 1 || subStripes > 1)
+        throw new NotSupportedException(
+          $"Btrfs native mounting currently requires one physical stripe per chunk (found {numStripes}, sub_stripes={subStripes}).");
+      var physicalOffset = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(data + 56));
+      AddChunk(chunks, logical, physicalOffset, length);
+    }
+  }
+
+  private static long FindFsRoot(
+      Stream image,
+      long physical,
+      uint nodeSize,
+      List<Chunk> chunks,
+      HashSet<long> visited) {
+    if (!visited.Add(physical)) return -1;
+    var node = ReadNode(image, physical, nodeSize);
+    var nritems = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(96));
+    var level = node[100];
+    if (level > 0) {
+      for (uint i = 0; i < nritems; i++) {
+        var item = 101 + checked((int)i * 33);
+        if (item + 33 > node.Length) throw new InvalidDataException("Btrfs root-tree node item is truncated.");
+        var childLogical = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(item + 17));
+        var found = FindFsRoot(image, LogicalToPhysical(chunks, childLogical, image.Length), nodeSize, chunks, visited);
+        if (found >= 0) return found;
+      }
+      return -1;
+    }
+
+    for (uint i = 0; i < nritems; i++) {
+      var item = 101 + checked((int)i * 25);
+      if (item + 25 > node.Length) throw new InvalidDataException("Btrfs root-tree leaf item is truncated.");
+      var objectId = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(item));
+      if (objectId != FsTreeObjectId || node[item + 8] != RootItem) continue;
+      var dataOffset = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(item + 17));
+      var dataSize = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(item + 21));
+      var data = 101 + checked((int)dataOffset);
+      if (dataSize < 184 || data < 0 || data + 184 > node.Length)
+        throw new InvalidDataException("Btrfs ROOT_ITEM is too short to contain its bytenr.");
+      return BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(data + 176));
+    }
+    return -1;
+  }
+
+  private static void CollectLeaves(
+      Stream image,
+      long physical,
+      uint nodeSize,
+      List<Chunk> chunks,
+      List<long> leaves,
+      HashSet<long> visited) {
+    if (!visited.Add(physical)) return;
+    var node = ReadNode(image, physical, nodeSize);
+    var nritems = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(96));
+    var level = node[100];
+    if (level == 0) {
+      leaves.Add(physical);
+      return;
+    }
+    for (uint i = 0; i < nritems; i++) {
+      var item = 101 + checked((int)i * 33);
+      if (item + 33 > node.Length) throw new InvalidDataException("Btrfs FS-tree node item is truncated.");
+      var childLogical = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(item + 17));
+      CollectLeaves(image, LogicalToPhysical(chunks, childLogical, image.Length), nodeSize, chunks, leaves, visited);
+    }
+  }
+
+  private static void CollectExtentRecords(
+      Stream image,
+      long leafPhysical,
+      uint nodeSize,
+      List<Chunk> chunks,
+      Dictionary<long, List<Segment>> byInode) {
+    var node = ReadNode(image, leafPhysical, nodeSize);
+    if (node[100] != 0) throw new InvalidDataException("Btrfs extent collector was given a non-leaf node.");
+    var nritems = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(96));
+
+    for (uint i = 0; i < nritems; i++) {
+      var item = 101 + checked((int)i * 25);
+      if (item + 25 > node.Length) throw new InvalidDataException("Btrfs FS-tree leaf item is truncated.");
+      if (node[item + 8] != ExtentData) continue;
+
+      var inode = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(item));
+      var fileOffset = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(item + 9));
+      var dataOffset = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(item + 17));
+      var dataSize = BinaryPrimitives.ReadUInt32LittleEndian(node.AsSpan(item + 21));
+      var data = 101 + checked((int)dataOffset);
+      if (dataSize < 21 || data < 0 || data + dataSize > node.Length)
+        throw new InvalidDataException($"Btrfs inode {inode} has a truncated EXTENT_DATA record.");
+
+      var compression = node[data + 16];
+      var encryption = node[data + 17];
+      var otherEncoding = BinaryPrimitives.ReadUInt16LittleEndian(node.AsSpan(data + 18));
+      var type = node[data + 20];
+      if (compression != 0 || encryption != 0 || otherEncoding != 0)
+        throw new NotSupportedException(
+          $"Btrfs inode {inode} EXTENT_DATA at {fileOffset:N0} uses compression={compression}, encryption={encryption}, other_encoding={otherEncoding}.");
+
+      Segment segment;
+      switch (type) {
+        case 0: {
+          var inlineLength = checked((long)dataSize - 21);
+          if (inlineLength <= 0) continue;
+          segment = new Segment(fileOffset, inlineLength, checked(leafPhysical + data + 21L));
+          break;
+        }
+        case 1:
+        case 2: {
+          if (dataSize < 53)
+            throw new InvalidDataException($"Btrfs inode {inode} regular/prealloc extent is truncated.");
+          var diskBytenr = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(data + 21));
+          var diskNumBytes = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(data + 29));
+          var extentOffset = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(data + 37));
+          var numBytes = BinaryPrimitives.ReadInt64LittleEndian(node.AsSpan(data + 45));
+          if (numBytes <= 0 || extentOffset < 0 || diskNumBytes < 0 || extentOffset > diskNumBytes || numBytes > diskNumBytes - extentOffset)
+            throw new InvalidDataException($"Btrfs inode {inode} has invalid regular extent lengths.");
+          if (type == 2 || diskBytenr == 0) {
+            segment = new Segment(fileOffset, numBytes, null);
+          } else {
+            var basePhysical = LogicalToPhysical(chunks, diskBytenr, image.Length);
+            segment = new Segment(fileOffset, numBytes, checked(basePhysical + extentOffset));
+          }
+          break;
+        }
+        default:
+          throw new NotSupportedException($"Btrfs inode {inode} uses unsupported extent type {type}.");
+      }
+
+      if (!byInode.TryGetValue(inode, out var segments))
+        byInode[inode] = segments = [];
+      segments.Add(segment);
+    }
+  }
+
+  private static void AddChunk(List<Chunk> chunks, long logical, long physical, long length) {
+    if (logical < 0 || physical < 0 || length <= 0)
+      throw new InvalidDataException("Btrfs chunk mapping contains a negative address or non-positive length.");
+    foreach (var existing in chunks) {
+      if (existing.Logical == logical && existing.Length == length) {
+        if (existing.Physical != physical)
+          throw new NotSupportedException("Btrfs duplicate logical chunk maps to multiple physical stripes.");
+        return;
+      }
+    }
+    chunks.Add(new Chunk(logical, physical, length));
+  }
+
+  private static long LogicalToPhysical(List<Chunk> chunks, long logical, long imageLength) {
+    foreach (var chunk in chunks) {
+      if (logical < chunk.Logical || logical >= checked(chunk.Logical + chunk.Length)) continue;
+      var physical = checked(chunk.Physical + logical - chunk.Logical);
+      if (physical < 0 || physical >= imageLength)
+        throw new InvalidDataException($"Btrfs logical address {logical:N0} maps outside the image.");
+      return physical;
+    }
+    throw new NotSupportedException($"Btrfs logical address {logical:N0} has no decoded single-device chunk mapping.");
+  }
+
+  private static byte[] ReadNode(Stream image, long physical, uint nodeSize) {
+    if (physical < 0 || physical > image.Length - nodeSize)
+      throw new InvalidDataException($"Btrfs tree node at {physical:N0} lies outside the image.");
+    return ReadBytes(image, physical, checked((int)nodeSize));
+  }
+
+  private static byte[] ReadBytes(Stream image, long offset, int length) {
+    if (offset < 0 || length < 0 || offset > image.Length - length)
+      throw new InvalidDataException("Btrfs read range lies outside the image.");
+    var buffer = new byte[length];
+    var original = image.Position;
+    try {
+      image.Position = offset;
+      image.ReadExactly(buffer);
+      return buffer;
+    } finally {
+      image.Position = original;
+    }
+  }
+}
diff --git a/FileSystems/FileSystem.CbmNibble/CbmGcrSectorDevice.cs b/FileSystems/FileSystem.CbmNibble/CbmGcrSectorDevice.cs
new file mode 100644
index 000000000..1244dc93b
--- /dev/null
+++ b/FileSystems/FileSystem.CbmNibble/CbmGcrSectorDevice.cs
@@ -0,0 +1,354 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+
+namespace FileSystem.CbmNibble;
+
+/// <summary>
+/// Strict 1541 logical-sector projection over raw GCR tracks. Every standard
+/// sector must exist exactly once with valid header/data checksums before the
+/// medium is exposed. Writable projection additionally rejects meaningful odd
+/// half-track data that a sector rewrite could not preserve.
+/// </summary>
+public sealed class CbmGcrSectorDevice : IRandomAccessBlockDevice {
+  public const int SectorSize = 256;
+  public const int SectorCount = 683;
+  public const int DataLength = SectorSize * SectorCount;
+
+  private const int TotalTracks = 35;
+  private const int SyncMinimumBits = 10;
+  private const int HeaderRawBytes = 8;
+  private const int DataRawBytes = 260;
+  private const int HeaderGap = 9;
+  private const int TailGap = 8;
+  private const int SyncBytes = 5;
+  private const byte GapByte = 0x55;
+
+  private static readonly int[] SectorsPerTrack = [
+    0,
+    21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21,
+    19, 19, 19, 19, 19, 19, 19,
+    18, 18, 18, 18, 18, 18,
+    17, 17, 17, 17, 17,
+  ];
+
+  private static readonly byte[] NibbleToGcr = [
+    0b01010, 0b01011, 0b10010, 0b10011,
+    0b01110, 0b01111, 0b10110, 0b10111,
+    0b01001, 0b11001, 0b11010, 0b11011,
+    0b01101, 0b11101, 0b11110, 0b10101,
+  ];
+
+  private static readonly byte[] GcrToNibble = BuildDecodeTable();
+
+  private readonly IRawTrackDevice _tracks;
+  private readonly bool _ownsTracks;
+  private readonly int? _fixedTrackLength;
+  private readonly byte[] _data = new byte[DataLength];
+  private readonly HashSet<int> _dirtyTracks = [];
+  private readonly object _gate = new();
+  private readonly byte _diskId1;
+  private readonly byte _diskId2;
+  private bool _disposed;
+
+  public CbmGcrSectorDevice(
+      IRawTrackDevice tracks,
+      bool writable,
+      int? fixedTrackLength = null,
+      bool ownsTracks = true) {
+    ArgumentNullException.ThrowIfNull(tracks);
+    if (writable && !tracks.CanWrite)
+      throw new ArgumentException("Writable GCR sector projection requires a writable raw-track device.", nameof(tracks));
+    _tracks = tracks;
+    _ownsTracks = ownsTracks;
+    _fixedTrackLength = fixedTrackLength;
+    CanWrite = writable;
+
+    var infos = tracks.EnumerateTracks().ToDictionary(info => info.Index);
+    byte? id1 = null;
+    byte? id2 = null;
+    for (var track = 1; track <= TotalTracks; ++track) {
+      var rawIndex = (track - 1) * 2;
+      if (!infos.TryGetValue(rawIndex, out var info) || !info.IsPresent || info.Length <= 0)
+        throw new InvalidDataException($"GCR projection: required track {track} (half-track {rawIndex}) is missing.");
+      if (info.EncodingParameter > 3)
+        throw new NotSupportedException(
+          $"GCR projection: half-track {rawIndex} uses a pointer-based variable-speed map.");
+      if (info.Length > int.MaxValue)
+        throw new NotSupportedException("GCR track is too large to decode in memory.");
+
+      var raw = new byte[(int)info.Length];
+      var read = tracks.ReadTrack(rawIndex, raw);
+      if (read <= 0) throw new InvalidDataException($"GCR projection: track {track} is empty.");
+      if (read != raw.Length) Array.Resize(ref raw, read);
+
+      var sectors = DecodeTrack(raw, track, out var trackId1, out var trackId2);
+      id1 ??= trackId1;
+      id2 ??= trackId2;
+      if (id1 != trackId1 || id2 != trackId2)
+        throw new InvalidDataException($"GCR projection: track {track} uses an inconsistent disk id.");
+      foreach (var pair in sectors)
+        pair.Value.CopyTo(_data, SectorOffset(track, pair.Key));
+    }
+
+    if (writable) {
+      foreach (var info in infos.Values.Where(info => (info.Index & 1) != 0 && info.IsPresent && info.Length > 0)) {
+        if (info.Length > int.MaxValue) throw new NotSupportedException("GCR half-track is too large to inspect.");
+        var raw = new byte[(int)info.Length];
+        var read = tracks.ReadTrack(info.Index, raw);
+        if (read > 0 && !IsBlank(raw.AsSpan(0, read)))
+          throw new NotSupportedException(
+            $"GCR half-track {info.Index} contains non-gap data; writable logical-sector projection would not preserve it.");
+      }
+    }
+
+    _diskId1 = id1 ?? (byte)'0';
+    _diskId2 = id2 ?? (byte)'0';
+  }
+
+  public BlockDeviceGeometry Geometry { get; } = new(SectorSize, SectorCount, SectorSize, false);
+  public bool CanWrite { get; }
+
+  public int ReadBlocks(long firstBlock, Span<byte> destination) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      var blocks = ValidateTransfer(firstBlock, destination.Length);
+      if (blocks == 0) return 0;
+      _data.AsSpan(checked((int)firstBlock * SectorSize), destination.Length).CopyTo(destination);
+      return blocks;
+    }
+  }
+
+  public void WriteBlocks(long firstBlock, ReadOnlySpan<byte> source) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      EnsureWritable();
+      var blocks = ValidateTransfer(firstBlock, source.Length);
+      if (blocks == 0) return;
+      source.CopyTo(_data.AsSpan(checked((int)firstBlock * SectorSize), source.Length));
+      for (var block = (int)firstBlock; block < (int)firstBlock + blocks; ++block)
+        _dirtyTracks.Add(TrackForBlock(block));
+    }
+  }
+
+  public void Trim(long firstBlock, long blockCount) {
+    ThrowIfDisposed();
+    EnsureWritable();
+    if (firstBlock < 0 || blockCount < 0 || firstBlock > SectorCount - blockCount)
+      throw new ArgumentOutOfRangeException(nameof(firstBlock));
+    throw new NotSupportedException("1541 sector media has no trim/discard primitive.");
+  }
+
+  public void Flush() {
+    lock (_gate) {
+      ThrowIfDisposed();
+      if (!CanWrite || _dirtyTracks.Count == 0) {
+        _tracks.Flush();
+        return;
+      }
+
+      foreach (var track in _dirtyTracks.Order()) {
+        var encoded = EncodeTrack(track);
+        if (_fixedTrackLength is int fixedLength) {
+          if (encoded.Length > fixedLength)
+            throw new IOException($"Encoded GCR track {track} is larger than its {fixedLength}-byte slot.");
+          var slot = new byte[fixedLength];
+          slot.AsSpan().Fill(GapByte);
+          encoded.CopyTo(slot, 0);
+          encoded = slot;
+        }
+
+        var verify = DecodeTrack(encoded, track, out var id1, out var id2);
+        if (id1 != _diskId1 || id2 != _diskId2 || verify.Count != SectorsPerTrack[track])
+          throw new InvalidOperationException($"GCR encoder self-check failed for track {track}.");
+        _tracks.WriteTrack((track - 1) * 2, encoded);
+      }
+      _tracks.Flush();
+      _dirtyTracks.Clear();
+    }
+  }
+
+  public void Dispose() {
+    if (_disposed) return;
+    if (CanWrite) Flush();
+    _disposed = true;
+    if (_ownsTracks) _tracks.Dispose();
+  }
+
+  private byte[] EncodeTrack(int track) {
+    using var output = new MemoryStream();
+    var header = new byte[HeaderRawBytes];
+    var dataBlock = new byte[DataRawBytes];
+    for (var sector = 0; sector < SectorsPerTrack[track]; ++sector) {
+      Array.Clear(header);
+      header[0] = 0x08;
+      header[2] = (byte)sector;
+      header[3] = (byte)track;
+      header[4] = _diskId2;
+      header[5] = _diskId1;
+      header[6] = 0x0F;
+      header[7] = 0x0F;
+      header[1] = (byte)(header[2] ^ header[3] ^ header[4] ^ header[5]);
+
+      Array.Clear(dataBlock);
+      dataBlock[0] = 0x07;
+      _data.AsSpan(SectorOffset(track, sector), SectorSize).CopyTo(dataBlock.AsSpan(1, SectorSize));
+      byte checksum = 0;
+      for (var i = 0; i < SectorSize; ++i) checksum ^= dataBlock[i + 1];
+      dataBlock[257] = checksum;
+
+      WriteSync(output);
+      output.Write(CbmGcr.Encode(header));
+      WriteGap(output, HeaderGap);
+      WriteSync(output);
+      output.Write(CbmGcr.Encode(dataBlock));
+      WriteGap(output, TailGap);
+    }
+    return output.ToArray();
+  }
+
+  private static Dictionary<int, byte[]> DecodeTrack(
+      ReadOnlySpan<byte> raw,
+      int expectedTrack,
+      out byte diskId1,
+      out byte diskId2) {
+    var syncStarts = FindSyncEnds(raw);
+    if (syncStarts.Count == 0)
+      throw new InvalidDataException($"GCR projection: track {expectedTrack} contains no sync mark.");
+
+    var result = new Dictionary<int, byte[]>();
+    byte? id1 = null;
+    byte? id2 = null;
+    var header = new byte[HeaderRawBytes];
+    var data = new byte[DataRawBytes];
+    for (var i = 0; i < syncStarts.Count; ++i) {
+      if (!TryDecodeBits(raw, syncStarts[i], header) || header[0] != 0x08) continue;
+      if (header[1] != (byte)(header[2] ^ header[3] ^ header[4] ^ header[5])) continue;
+      if (header[3] != expectedTrack) continue;
+      var sector = header[2];
+      if (sector >= SectorsPerTrack[expectedTrack]) continue;
+
+      if (!TryDecodeBits(raw, syncStarts[(i + 1) % syncStarts.Count], data) || data[0] != 0x07) continue;
+      byte checksum = 0;
+      for (var p = 1; p <= SectorSize; ++p) checksum ^= data[p];
+      if (checksum != data[257]) continue;
+      if (result.ContainsKey(sector))
+        throw new InvalidDataException($"GCR projection: track {expectedTrack} contains duplicate valid sector {sector}.");
+
+      id1 ??= header[5];
+      id2 ??= header[4];
+      if (id1 != header[5] || id2 != header[4])
+        throw new InvalidDataException($"GCR projection: track {expectedTrack} contains inconsistent disk ids.");
+      result.Add(sector, data.AsSpan(1, SectorSize).ToArray());
+    }
+
+    if (result.Count != SectorsPerTrack[expectedTrack]) {
+      var missing = Enumerable.Range(0, SectorsPerTrack[expectedTrack]).Where(s => !result.ContainsKey(s));
+      throw new InvalidDataException(
+        $"GCR projection: track {expectedTrack} decoded {result.Count}/{SectorsPerTrack[expectedTrack]} sectors; missing {string.Join(",", missing)}.");
+    }
+    diskId1 = id1 ?? throw new InvalidDataException($"GCR projection: track {expectedTrack} has no valid sector header.");
+    diskId2 = id2 ?? throw new InvalidDataException($"GCR projection: track {expectedTrack} has no valid sector header.");
+    return result;
+  }
+
+  private static List<int> FindSyncEnds(ReadOnlySpan<byte> raw) {
+    var totalBits = raw.Length * 8;
+    var result = new List<int>();
+    if (totalBits == 0) return result;
+
+    var trailingOnes = 0;
+    for (var bit = totalBits - 1; bit >= 0 && GetBit(raw, bit) != 0; --bit) trailingOnes++;
+    if (trailingOnes == totalBits) return result;
+
+    var run = trailingOnes;
+    for (var bit = 0; bit < totalBits; ++bit) {
+      if (GetBit(raw, bit) != 0) {
+        run++;
+        continue;
+      }
+      if (run >= SyncMinimumBits) result.Add(bit);
+      run = 0;
+    }
+    return result.Distinct().Order().ToList();
+  }
+
+  private static bool TryDecodeBits(ReadOnlySpan<byte> raw, int startBit, Span<byte> destination) {
+    var totalBits = raw.Length * 8;
+    if (totalBits == 0 || destination.Length * 10 > totalBits) return false;
+    var bit = startBit;
+    for (var i = 0; i < destination.Length; ++i) {
+      var hiCode = ReadBits(raw, ref bit, 5);
+      var loCode = ReadBits(raw, ref bit, 5);
+      var hi = GcrToNibble[hiCode];
+      var lo = GcrToNibble[loCode];
+      if (hi == 0xFF || lo == 0xFF) return false;
+      destination[i] = (byte)((hi << 4) | lo);
+    }
+    return true;
+  }
+
+  private static int ReadBits(ReadOnlySpan<byte> raw, ref int bit, int count) {
+    var totalBits = raw.Length * 8;
+    var value = 0;
+    for (var i = 0; i < count; ++i) {
+      if (bit == totalBits) bit = 0;
+      value = (value << 1) | GetBit(raw, bit++);
+    }
+    return value;
+  }
+
+  private static int GetBit(ReadOnlySpan<byte> raw, int bit)
+    => (raw[bit >> 3] >> (7 - (bit & 7))) & 1;
+
+  private static byte[] BuildDecodeTable() {
+    var table = new byte[32];
+    Array.Fill(table, (byte)0xFF);
+    for (var i = 0; i < NibbleToGcr.Length; ++i) table[NibbleToGcr[i]] = (byte)i;
+    return table;
+  }
+
+  private static bool IsBlank(ReadOnlySpan<byte> raw) {
+    foreach (var value in raw)
+      if (value != 0x00 && value != GapByte) return false;
+    return true;
+  }
+
+  private static int ValidateTransfer(long firstBlock, int byteCount) {
+    if (byteCount < 0 || byteCount % SectorSize != 0)
+      throw new ArgumentException($"Block transfers must be a multiple of {SectorSize} bytes.", nameof(byteCount));
+    var blocks = byteCount / SectorSize;
+    if (firstBlock < 0 || firstBlock > SectorCount - blocks)
+      throw new ArgumentOutOfRangeException(nameof(firstBlock));
+    return blocks;
+  }
+
+  private static int TrackForBlock(int block) {
+    var first = 0;
+    for (var track = 1; track <= TotalTracks; ++track) {
+      var next = first + SectorsPerTrack[track];
+      if (block < next) return track;
+      first = next;
+    }
+    throw new ArgumentOutOfRangeException(nameof(block));
+  }
+
+  private static int SectorOffset(int track, int sector) {
+    var offset = 0;
+    for (var t = 1; t < track; ++t) offset += SectorsPerTrack[t] * SectorSize;
+    return offset + sector * SectorSize;
+  }
+
+  private static void WriteSync(Stream output) {
+    for (var i = 0; i < SyncBytes; ++i) output.WriteByte(0xFF);
+  }
+
+  private static void WriteGap(Stream output, int count) {
+    for (var i = 0; i < count; ++i) output.WriteByte(GapByte);
+  }
+
+  private void EnsureWritable() {
+    if (!CanWrite) throw new NotSupportedException("The GCR sector device was opened read-only.");
+  }
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/FileSystems/FileSystem.CbmNibble/CbmNibbleFilesystemDriver.cs b/FileSystems/FileSystem.CbmNibble/CbmNibbleFilesystemDriver.cs
new file mode 100644
index 000000000..0d8448214
--- /dev/null
+++ b/FileSystems/FileSystem.CbmNibble/CbmNibbleFilesystemDriver.cs
@@ -0,0 +1,138 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+using FileSystem.D64;
+
+namespace FileSystem.CbmNibble;
+
+/// <summary>
+/// Shared filesystem-driver bridge for canonical 1541 GCR media. It performs
+/// two independent probes: GCR sector integrity first, then CBM DOS allocation
+/// integrity. Only profiles that pass both are exposed as writable mounts.
+/// </summary>
+internal static class CbmNibbleFilesystemDriver {
+  public enum ContainerKind { G64, Nib }
+
+  public static IRandomAccessBlockDevice OpenBlockDevice(
+      Stream image,
+      ContainerKind kind,
+      bool writable,
+      bool leaveOpen) {
+    IRawTrackDevice raw = kind switch {
+      ContainerKind.G64 => new G64DirectRawTrackDevice(image, writable, leaveOpen),
+      ContainerKind.Nib => CbmNibbleRawTrackDevices.OpenNib(image, writable, leaveOpen),
+      _ => throw new ArgumentOutOfRangeException(nameof(kind)),
+    };
+    try {
+      return new CbmGcrSectorDevice(
+        raw,
+        writable,
+        kind == ContainerKind.Nib ? CbmNibbleReader.NibTrackSize : null,
+        ownsTracks: true);
+    } catch {
+      raw.Dispose();
+      throw;
+    }
+  }
+
+  public static FilesystemDriverProfile Probe(Stream image, ContainerKind kind) {
+    ArgumentNullException.ThrowIfNull(image);
+    var id = kind == ContainerKind.G64 ? "G64" : "Nib";
+    var profileName = kind == ContainerKind.G64
+      ? "CBM DOS 2.6 over canonical G64"
+      : "CBM DOS 2.6 over canonical NIB";
+    var limitations = new List<string> {
+      "Filesystem projection requires all 35 standard 1541 tracks and all 683 sectors with valid GCR/header/data checksums.",
+      "CBM DOS 2.6 is a flat root namespace; subdirectories, hard links, symlinks and transactions are unavailable.",
+      "Node ids are stable for one mounted session but are not persistent across remounts.",
+      "REL side-sector semantics and unclosed/splat files are read-only until their mutation rules are modeled.",
+    };
+    if (kind == ContainerKind.G64)
+      limitations.Add("Writable G64 mounts require constant speed zones and blank/nonexistent odd half-tracks; copy-protection half-tracks stay raw/read-only.");
+
+    if (!image.CanRead || !image.CanSeek) {
+      limitations.Add("Mounting requires a readable, seekable image stream.");
+      return BuildProfile(id, profileName, false, false, limitations);
+    }
+
+    var saved = image.Position;
+    try {
+      byte[] d64;
+      try {
+        image.Position = 0;
+        using var block = OpenBlockDevice(image, kind, writable: false, leaveOpen: true);
+        d64 = new byte[D64BlockDevice.DataLength];
+        if (block.ReadBlocks(0, d64) != D64BlockDevice.SectorCount)
+          throw new EndOfStreamException("GCR sector device did not return all 683 1541 sectors.");
+      } catch (Exception ex) when (ex is InvalidDataException or NotSupportedException or IOException) {
+        limitations.Add(ex.Message);
+        return BuildProfile(id, profileName, false, false, limitations);
+      }
+
+      var fs = D64MountValidator.Validate(d64);
+      limitations.AddRange(fs.Limitations);
+      if (!fs.CanRead) return BuildProfile(id, profileName, false, false, limitations);
+
+      var writable = false;
+      if (fs.CanWrite && image.CanWrite) {
+        try {
+          image.Position = 0;
+          using var block = OpenBlockDevice(image, kind, writable: true, leaveOpen: true);
+          writable = block.CanWrite;
+        } catch (Exception ex) when (ex is InvalidDataException or NotSupportedException or IOException) {
+          limitations.Add(ex.Message);
+        }
+      } else if (!image.CanWrite) {
+        limitations.Add("Backing stream is not writable.");
+      }
+
+      return BuildProfile(id, profileName, true, writable, limitations);
+    } finally {
+      image.Position = saved;
+    }
+  }
+
+  public static IFilesystemSession OpenFilesystem(
+      Stream image,
+      ContainerKind kind,
+      FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(options);
+    var profile = Probe(image, kind);
+    if (!profile.CanMount)
+      throw new InvalidDataException($"{profile.FormatId} cannot be mounted as CBM DOS: {string.Join(" ", profile.Limitations)}");
+    if (!options.ReadOnly && !profile.CanMountWritable)
+      throw new NotSupportedException($"{profile.FormatId} is not safe for a writable CBM DOS mount: {string.Join(" ", profile.Limitations)}");
+
+    image.Position = 0;
+    var block = OpenBlockDevice(image, kind, writable: !options.ReadOnly, leaveOpen: options.LeaveOpen);
+    return new D64FilesystemSession(block, profile, options.ReadOnly, ownsDevice: true);
+  }
+
+  private static FilesystemDriverProfile BuildProfile(
+      string id,
+      string profileName,
+      bool canMount,
+      bool canWrite,
+      IReadOnlyList<string> limitations) {
+    var capabilities = FilesystemDriverCapabilities.None;
+    if (canMount)
+      capabilities = FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.Flush;
+    if (canWrite)
+      capabilities |= FilesystemDriverCapabilities.WriteData |
+        FilesystemDriverCapabilities.Truncate |
+        FilesystemDriverCapabilities.CreateFile |
+        FilesystemDriverCapabilities.DeleteFile |
+        FilesystemDriverCapabilities.Rename;
+    return new FilesystemDriverProfile(
+      id,
+      profileName,
+      capabilities,
+      canWrite ? FilesystemMutationModel.Direct : FilesystemMutationModel.None,
+      canMount,
+      canWrite,
+      limitations.Distinct().ToArray());
+  }
+}
diff --git a/FileSystems/FileSystem.CbmNibble/CbmNibbleFormatDescriptor.cs b/FileSystems/FileSystem.CbmNibble/CbmNibbleFormatDescriptor.cs
index b2009c489..c70cdca58 100644
--- a/FileSystems/FileSystem.CbmNibble/CbmNibbleFormatDescriptor.cs
+++ b/FileSystems/FileSystem.CbmNibble/CbmNibbleFormatDescriptor.cs
@@ -4,120 +4,466 @@
 
 namespace FileSystem.CbmNibble;
 
-/// <summary>
-/// Shared implementation for the .nib + .g64 Commodore nibble-dump pseudo-archives.
-/// Both variants share the same section walk: <c>metadata.ini</c> plus one
-/// <c>track_{NN}.bin</c> entry per (half-)track containing raw GCR bytes.
-/// Converting GCR back to a cleanly sectored D64 is a separate, non-trivial
-/// undertaking (see nibtools); this descriptor is intentionally read-only.
-/// </summary>
 internal static class CbmNibbleEntries {
-  public static List<(string Name, byte[] Data)> Build(Stream stream, string? fileName) {
+  public static CbmNibbleReader.NibbleImage ReadImage(Stream stream, string fileName) {
+    ArgumentNullException.ThrowIfNull(stream);
+    if (stream.CanSeek) stream.Position = 0;
     using var ms = new MemoryStream();
     stream.CopyTo(ms);
-    var img = CbmNibbleReader.Read(ms.GetBuffer().AsSpan(0, (int)ms.Length), fileName);
+    return CbmNibbleReader.Read(ms.ToArray(), fileName);
+  }
 
+  public static List<(string Name, byte[] Data)> Build(Stream stream, string fileName) {
+    var image = ReadImage(stream, fileName);
     var result = new List<(string, byte[])> {
-      ("metadata.ini", CbmNibbleReader.BuildMetadata(img)),
+      ("metadata.ini", CbmNibbleReader.BuildMetadata(image)),
     };
-    foreach (var t in img.Tracks) {
-      if (t.Data.Length == 0) continue;  // skip empty half-tracks
-      result.Add(($"track_{t.Index:D2}.bin", t.Data));
-    }
+    foreach (var track in image.Tracks)
+      if (track.Data.Length > 0)
+        result.Add(($"track_{track.Index:D2}.bin", track.Data));
     return result;
   }
 
-  public static List<ArchiveEntryInfo> List(Stream stream, string? fileName) =>
-    Build(stream, fileName).Select((e, i) => new ArchiveEntryInfo(
-      i, e.Name, e.Data.LongLength, e.Data.LongLength, "stored", false, false, null
-    )).ToList();
+  public static List<ArchiveEntryInfo> List(Stream stream, string fileName)
+    => Build(stream, fileName).Select((entry, index) => new ArchiveEntryInfo(
+      index, entry.Name, entry.Data.LongLength, entry.Data.LongLength,
+      "stored", false, false, null)).ToList();
 
-  public static void Extract(Stream stream, string outputDir, string[]? files, string? fileName) {
-    foreach (var e in Build(stream, fileName)) {
-      if (files != null && files.Length > 0 && !MatchesFilter(e.Name, files)) continue;
-      WriteFile(outputDir, e.Name, e.Data);
+  public static void Extract(Stream stream, string outputDir, string[]? files, string fileName) {
+    foreach (var entry in Build(stream, fileName)) {
+      if (files != null && files.Length > 0 && !MatchesFilter(entry.Name, files)) continue;
+      WriteFile(outputDir, entry.Name, entry.Data);
     }
   }
+
+  public static bool TryParseTrackName(string name, out int index) {
+    index = -1;
+    var leaf = Path.GetFileName(name.Replace('\\', '/'));
+    if (!leaf.StartsWith("track_", StringComparison.OrdinalIgnoreCase) ||
+        !leaf.EndsWith(".bin", StringComparison.OrdinalIgnoreCase)) return false;
+    var digits = leaf.AsSpan(6, leaf.Length - 10);
+    return int.TryParse(digits, System.Globalization.NumberStyles.None,
+      System.Globalization.CultureInfo.InvariantCulture, out index);
+  }
+
+  public static bool IsMetadata(string name)
+    => string.Equals(Path.GetFileName(name), "metadata.ini", StringComparison.OrdinalIgnoreCase);
+
+  public static uint DefaultSpeedZone(int halfTrackIndex) {
+    var track = halfTrackIndex / 2 + 1;
+    return track switch {
+      >= 1 and <= 17 => 3,
+      >= 18 and <= 24 => 2,
+      >= 25 and <= 30 => 1,
+      _ => 0,
+    };
+  }
+
+  public static void Commit(Stream archive, byte[] image) {
+    if (!archive.CanRead || !archive.CanWrite || !archive.CanSeek)
+      throw new ArgumentException("Nibble-image mutation requires a readable, writable, seekable stream.", nameof(archive));
+    archive.Position = 0;
+    archive.SetLength(0);
+    archive.Write(image);
+    archive.Flush();
+  }
+
+  public static byte[] ReadAll(Stream stream) {
+    if (stream.CanSeek) stream.Position = 0;
+    using var ms = new MemoryStream();
+    stream.CopyTo(ms);
+    return ms.ToArray();
+  }
 }
 
 /// <summary>
-/// Commodore G64 GCR track container (VICE emulator). Detected by the
-/// 8-byte "GCR-1541" ASCII magic at offset 0.
-///
-/// References:
-/// <list type="bullet">
-///   <item><description><c>http://unusedino.de/ec64/technical/formats/g64.html</c> — Peter Schepers' G64 format specification</description></item>
-///   <item><description><c>https://vice-emu.sourceforge.io</c> — VICE emulator, the origin and maintained implementation of G64</description></item>
-/// </list>
+/// VICE G64 raw-GCR track container. Archive-level operations expose tracks;
+/// block/filesystem providers expose only strict canonical 1541 sector media.
 /// </summary>
-public sealed class G64FormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveShrinkable, IArchiveModifiable, IArchiveDefragmentable, IArchiveCreatable {
+public sealed class G64FormatDescriptor :
+  IFormatDescriptor,
+  IArchiveFormatOperations,
+  IArchiveShrinkable,
+  IArchiveModifiable,
+  IArchiveDefragmentable,
+  IArchiveCreatable,
+  IArchiveLayoutMap,
+  IRawTrackDeviceProvider,
+  IRandomAccessBlockDeviceProvider,
+  IFilesystemDriverProvider {
+
   public string Id => "G64";
   public string DisplayName => "G64 (Commodore GCR)";
   public FormatCategory Category => FormatCategory.Archive;
   public FormatCapabilities Capabilities =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate |
-    FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries;
+    FormatCapabilities.CanModify | FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries;
   public string DefaultExtension => ".g64";
   public IReadOnlyList<string> Extensions => [".g64"];
   public IReadOnlyList<string> CompoundExtensions => [];
   public IReadOnlyList<MagicSignature> MagicSignatures =>
     [new("GCR-1541"u8.ToArray(), Offset: 0, Confidence: 0.90)];
-  public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored")];
+  public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored GCR tracks")];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
-  public string Description => "Commodore 1541 GCR-encoded disk image (VICE G64)";
+  public string Description => "VICE G64 Commodore GCR track image with raw-track, strict sector, and CBM DOS driver layers";
+
+  public IRawTrackDevice OpenRawTrackDevice(Stream image, bool writable, bool leaveOpen = true)
+    => CbmNibbleRawTrackDevices.OpenG64(image, writable, leaveOpen);
+
+  public IRandomAccessBlockDevice OpenBlockDevice(Stream image, bool writable, bool leaveOpen = true)
+    => CbmNibbleFilesystemDriver.OpenBlockDevice(
+      image, CbmNibbleFilesystemDriver.ContainerKind.G64, writable, leaveOpen);
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image)
+    => CbmNibbleFilesystemDriver.Probe(image, CbmNibbleFilesystemDriver.ContainerKind.G64);
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)
+    => CbmNibbleFilesystemDriver.OpenFilesystem(
+      image, CbmNibbleFilesystemDriver.ContainerKind.G64, options);
+
+  public List<ArchiveEntryInfo> List(Stream stream, string? password)
+    => CbmNibbleEntries.List(stream, "image.g64");
+
+  public void Extract(Stream stream, string outputDir, string? password, string[]? files)
+    => CbmNibbleEntries.Extract(stream, outputDir, files, "image.g64");
 
-  public List<ArchiveEntryInfo> List(Stream stream, string? password) =>
-    CbmNibbleEntries.List(stream, "image.g64");
+  public Stream OpenEntry(Stream archive, string entryName, string? password) {
+    var image = CbmNibbleEntries.ReadImage(archive, "image.g64");
+    byte[] data;
+    if (CbmNibbleEntries.IsMetadata(entryName))
+      data = CbmNibbleReader.BuildMetadata(image);
+    else if (CbmNibbleEntries.TryParseTrackName(entryName, out var index))
+      data = image.Tracks.FirstOrDefault(t => t.Index == index)?.Data ?? [];
+    else
+      data = [];
+    return new Compression.Registry.Streaming.BoundedEntryStream(
+      new MemoryStream(data, writable: false), data.Length, leaveOpen: false);
+  }
 
-  public void Extract(Stream stream, string outputDir, string? password, string[]? files) =>
-    CbmNibbleEntries.Extract(stream, outputDir, files, "image.g64");
+  public byte[] ExtractEntryToMemory(Stream archive, string entryName, string? password) {
+    using var entry = this.OpenEntry(archive, entryName, password);
+    using var ms = new MemoryStream();
+    entry.CopyTo(ms);
+    return ms.ToArray();
+  }
 
-  /// <summary>
-  /// Builds a fresh G64 image from the inputs. The Commodore filesystem is flat,
-  /// so names are reduced to their filename component and stored in the single
-  /// track-18 directory by <see cref="CbmNibbleWriter"/>.
-  /// </summary>
   public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
+    ArgumentNullException.ThrowIfNull(output);
+    ArgumentNullException.ThrowIfNull(inputs);
+    var files = inputs.Where(i => !i.IsDirectory && !CbmNibbleEntries.IsMetadata(i.ArchiveName)).ToArray();
+    var direct = files.Where(i => CbmNibbleEntries.TryParseTrackName(i.ArchiveName, out _)).ToArray();
+    if (direct.Length > 0) {
+      if (direct.Length != files.Length)
+        throw new NotSupportedException("G64 Create cannot mix track_NN.bin inputs with Commodore filesystem files.");
+      var tracks = direct.Select(input => {
+        CbmNibbleEntries.TryParseTrackName(input.ArchiveName, out var index);
+        return new CbmNibbleReader.Track(index, input.ReadContent(), CbmNibbleEntries.DefaultSpeedZone(index));
+      }).ToArray();
+      output.Write(CbmNibbleWriter.BuildG64FromTracks(tracks));
+      return;
+    }
+
     var writer = new CbmNibbleWriter();
-    foreach (var input in inputs) {
-      if (input.IsDirectory) continue;
+    foreach (var input in files)
       writer.AddFile(Path.GetFileName(input.ArchiveName), input.ReadContent());
-    }
     writer.WriteTo(output);
   }
+
+  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
+    var image = RequireDirectWritableProfile(archive);
+    var tracks = image.Tracks.ToDictionary(t => t.Index);
+    var highest = image.TrackCount - 1;
+    foreach (var input in inputs.Where(i => !i.IsDirectory)) {
+      if (CbmNibbleEntries.IsMetadata(input.ArchiveName)) continue;
+      if (!CbmNibbleEntries.TryParseTrackName(input.ArchiveName, out var index) || index is < 0 or >= 84)
+        throw new NotSupportedException("G64 mutation accepts track_00.bin through track_83.bin entries only.");
+      var data = input.ReadContent();
+      if (data.Length > ushort.MaxValue)
+        throw new NotSupportedException($"G64 track_{index:D2}.bin exceeds the 16-bit track length field.");
+      var speed = tracks.TryGetValue(index, out var old) ? old.SpeedZone : CbmNibbleEntries.DefaultSpeedZone(index);
+      tracks[index] = new CbmNibbleReader.Track(index, data, speed);
+      highest = Math.Max(highest, index);
+    }
+    var rebuilt = CbmNibbleWriter.BuildG64FromTracks(
+      tracks.Values.OrderBy(t => t.Index).ToArray(), image.Version, Math.Max(1, highest + 1));
+    VerifyTrackPayloads(rebuilt, tracks.Values.Where(t => t.Data.Length > 0));
+    CbmNibbleEntries.Commit(archive, rebuilt);
+  }
+
+  public void Remove(Stream archive, string[] entryNames) {
+    var image = RequireDirectWritableProfile(archive);
+    var remove = new HashSet<int>();
+    foreach (var name in entryNames) {
+      if (CbmNibbleEntries.IsMetadata(name))
+        throw new NotSupportedException("metadata.ini is a generated G64 view and cannot be removed.");
+      if (!CbmNibbleEntries.TryParseTrackName(name, out var index))
+        throw new NotSupportedException("G64 removal accepts track_NN.bin entries only.");
+      remove.Add(index);
+    }
+    var tracks = image.Tracks.Select(t => remove.Contains(t.Index) ? t with { Data = [] } : t).ToArray();
+    var rebuilt = CbmNibbleWriter.BuildG64FromTracks(tracks, image.Version, image.TrackCount);
+    VerifyTrackPayloads(rebuilt, tracks.Where(t => t.Data.Length > 0));
+    CbmNibbleEntries.Commit(archive, rebuilt);
+  }
+
+  public void Purge(Stream archive) {
+    var image = RequireDirectWritableProfile(archive);
+    var empty = image.Tracks.Select(t => t with { Data = [] }).ToArray();
+    CbmNibbleEntries.Commit(archive,
+      CbmNibbleWriter.BuildG64FromTracks(empty, image.Version, image.TrackCount));
+  }
+
+  public void Defragment(Stream archive)
+    => this.Defragment(archive, new DefragOptions());
+
+  public void Defragment(Stream archive, DefragOptions options) {
+    ArgumentNullException.ThrowIfNull(options);
+    var image = RequireDirectWritableProfile(archive);
+    options.OnProgress?.Invoke(new DefragProgressEvent(
+      "scanning", 0, 0, -1, archive.Length, this.EnumerateLayout(archive).ToList(), "Reading G64 track map"));
+    options.CancellationToken.ThrowIfCancellationRequested();
+    var rebuilt = CbmNibbleWriter.BuildG64FromTracks(image.Tracks, image.Version, image.TrackCount);
+    VerifyTrackPayloads(rebuilt, image.Tracks.Where(t => t.Data.Length > 0));
+    options.CancellationToken.ThrowIfCancellationRequested();
+    CbmNibbleEntries.Commit(archive, rebuilt);
+    options.OnProgress?.Invoke(new DefragProgressEvent(
+      "complete", 1, -1, -1, archive.Length, this.EnumerateLayout(archive).ToList(), "G64 track blocks compacted"));
+  }
+
+  public void Shrink(Stream input, Stream output) {
+    ArgumentNullException.ThrowIfNull(input);
+    ArgumentNullException.ThrowIfNull(output);
+    var original = CbmNibbleEntries.ReadAll(input);
+    var image = CbmNibbleReader.Read(original, "image.g64");
+    EnsureConstantSpeedZones(image);
+    var compact = CbmNibbleWriter.BuildG64FromTracks(image.Tracks, image.Version, image.TrackCount);
+    VerifyTrackPayloads(compact, image.Tracks.Where(t => t.Data.Length > 0));
+    var selected = compact.Length < original.Length ? compact : original;
+    output.Position = 0;
+    output.SetLength(0);
+    output.Write(selected);
+  }
+
+  public IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive) {
+    var image = CbmNibbleEntries.ReadImage(archive, "image.g64");
+    if (image.Tracks.Any(t => t.SpeedZone > 3))
+      return [new DefragBlockInfo(0, image.TotalFileSize, DefragBlockKind.MetadataReserved, "$G64/variable-speed-profile")];
+
+    var result = new List<DefragBlockInfo>();
+    var tableBytes = 12L + image.TrackCount * 8L;
+    result.Add(new DefragBlockInfo(0, Math.Min(tableBytes, image.TotalFileSize),
+      DefragBlockKind.MetadataReserved, "$G64/header-and-tables"));
+    foreach (var track in image.Tracks)
+      if (track.Data.Length > 0 && track.PhysicalOffset >= 0 && track.PhysicalLength > 0)
+        result.Add(new DefragBlockInfo(track.PhysicalOffset, track.PhysicalLength,
+          DefragBlockKind.Used, $"track_{track.Index:D2}.bin"));
+    return result;
+  }
+
+  public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true) {
+    var extents = this.EnumerateLayout(image).ToList();
+    if (extents.Count == 0) return 0;
+    image.Position = 0;
+    return UnusedSpaceWiper.Wipe(image, extents, image.Length, false, null);
+  }
+
+  private static CbmNibbleReader.NibbleImage RequireDirectWritableProfile(Stream archive) {
+    var image = CbmNibbleEntries.ReadImage(archive, "image.g64");
+    EnsureConstantSpeedZones(image);
+    return image;
+  }
+
+  private static void EnsureConstantSpeedZones(CbmNibbleReader.NibbleImage image) {
+    var variable = image.Tracks.FirstOrDefault(t => t.SpeedZone > 3);
+    if (variable != null)
+      throw new NotSupportedException(
+        $"G64 track {variable.Index} uses variable-speed map pointer 0x{variable.SpeedZone:X8}; " +
+        "the image remains readable, but mutation is refused until speed-map blocks are modeled.");
+  }
+
+  private static void VerifyTrackPayloads(byte[] rebuilt, IEnumerable<CbmNibbleReader.Track> expected) {
+    var parsed = CbmNibbleReader.Read(rebuilt, "image.g64");
+    var actual = parsed.Tracks.ToDictionary(t => t.Index);
+    foreach (var track in expected)
+      if (!actual.TryGetValue(track.Index, out var found) || !found.Data.AsSpan().SequenceEqual(track.Data))
+        throw new InvalidOperationException($"G64 rebuild changed track_{track.Index:D2}.bin; refusing to commit it.");
+  }
 }
 
 /// <summary>
-/// Commodore NIB raw nibble dump (nibtools / ZoomFloppy). No magic header —
-/// detected by file extension only; the typical dump is exactly 84 × 8192 bytes.
-///
-/// References:
-/// <list type="bullet">
-///   <item><description>nibtools (Pete Rittwage's C64 Disk Preservation Project) — the tool that defines and produces the de-facto NIB dump layout</description></item>
-///   <item><description><c>http://unusedino.de/ec64/technical/formats/g64.html</c> — Peter Schepers' GCR track documentation (shared with G64)</description></item>
-/// </list>
+/// Fixed-slot NIB raw nibble dump. Archive-level operations expose track slots;
+/// block/filesystem providers expose strict canonical 1541 sector media.
 /// </summary>
-public sealed class NibFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations {
+public sealed class NibFormatDescriptor :
+  IFormatDescriptor,
+  IArchiveFormatOperations,
+  IArchiveCreatable,
+  IArchiveModifiable,
+  IArchiveDefragmentable,
+  IArchiveLayoutMap,
+  IRawTrackDeviceProvider,
+  IRandomAccessBlockDeviceProvider,
+  IFilesystemDriverProvider {
+
   public string Id => "Nib";
   public string DisplayName => "NIB (Commodore nibble dump)";
   public FormatCategory Category => FormatCategory.Archive;
   public FormatCapabilities Capabilities =>
-    FormatCapabilities.CanList | FormatCapabilities.CanExtract |
-    FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries;
+    FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate |
+    FormatCapabilities.CanModify | FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries;
   public string DefaultExtension => ".nib";
   public IReadOnlyList<string> Extensions => [".nib"];
   public IReadOnlyList<string> CompoundExtensions => [];
-  // NIB has no leading magic — detection is purely extension-based.
   public IReadOnlyList<MagicSignature> MagicSignatures => [];
-  public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored")];
+  public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Fixed 8192-byte GCR slots")];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
-  public string Description => "Commodore 1541 raw nibble dump (nibtools / ZoomFloppy)";
+  public string Description => "Commodore raw nibble dump with raw-track, strict sector, and CBM DOS driver layers";
+
+  public IRawTrackDevice OpenRawTrackDevice(Stream image, bool writable, bool leaveOpen = true)
+    => CbmNibbleRawTrackDevices.OpenNib(image, writable, leaveOpen);
+
+  public IRandomAccessBlockDevice OpenBlockDevice(Stream image, bool writable, bool leaveOpen = true)
+    => CbmNibbleFilesystemDriver.OpenBlockDevice(
+      image, CbmNibbleFilesystemDriver.ContainerKind.Nib, writable, leaveOpen);
 
-  public List<ArchiveEntryInfo> List(Stream stream, string? password) =>
-    CbmNibbleEntries.List(stream, "image.nib");
+  public FilesystemDriverProfile ProbeFilesystem(Stream image)
+    => CbmNibbleFilesystemDriver.Probe(image, CbmNibbleFilesystemDriver.ContainerKind.Nib);
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)
+    => CbmNibbleFilesystemDriver.OpenFilesystem(
+      image, CbmNibbleFilesystemDriver.ContainerKind.Nib, options);
+
+  public List<ArchiveEntryInfo> List(Stream stream, string? password)
+    => CbmNibbleEntries.List(stream, "image.nib");
+
+  public void Extract(Stream stream, string outputDir, string? password, string[]? files)
+    => CbmNibbleEntries.Extract(stream, outputDir, files, "image.nib");
+
+  public Stream OpenEntry(Stream archive, string entryName, string? password) {
+    var image = CbmNibbleEntries.ReadImage(archive, "image.nib");
+    byte[] data;
+    if (CbmNibbleEntries.IsMetadata(entryName))
+      data = CbmNibbleReader.BuildMetadata(image);
+    else if (CbmNibbleEntries.TryParseTrackName(entryName, out var index))
+      data = image.Tracks.FirstOrDefault(t => t.Index == index)?.Data ?? [];
+    else
+      data = [];
+    return new Compression.Registry.Streaming.BoundedEntryStream(
+      new MemoryStream(data, writable: false), data.Length, leaveOpen: false);
+  }
+
+  public byte[] ExtractEntryToMemory(Stream archive, string entryName, string? password) {
+    using var entry = this.OpenEntry(archive, entryName, password);
+    using var ms = new MemoryStream();
+    entry.CopyTo(ms);
+    return ms.ToArray();
+  }
+
+  public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
+    ArgumentNullException.ThrowIfNull(output);
+    ArgumentNullException.ThrowIfNull(inputs);
+    var files = inputs.Where(i => !i.IsDirectory && !CbmNibbleEntries.IsMetadata(i.ArchiveName)).ToArray();
+    var direct = files.Where(i => CbmNibbleEntries.TryParseTrackName(i.ArchiveName, out _)).ToArray();
+    if (direct.Length > 0) {
+      if (direct.Length != files.Length)
+        throw new NotSupportedException("NIB Create cannot mix track_NN.bin inputs with Commodore filesystem files.");
+      var tracks = direct.Select(input => {
+        CbmNibbleEntries.TryParseTrackName(input.ArchiveName, out var index);
+        return new CbmNibbleReader.Track(index, input.ReadContent(), 0);
+      }).ToArray();
+      output.Write(CbmNibbleWriter.BuildNibFromTracks(tracks));
+      return;
+    }
 
-  public void Extract(Stream stream, string outputDir, string? password, string[]? files) =>
-    CbmNibbleEntries.Extract(stream, outputDir, files, "image.nib");
+    var writer = new CbmNibbleWriter();
+    foreach (var input in files)
+      writer.AddFile(Path.GetFileName(input.ArchiveName), input.ReadContent());
+    output.Write(writer.BuildNib());
+  }
+
+  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
+    var image = CbmNibbleEntries.ReadImage(archive, "image.nib");
+    var tracks = image.Tracks.ToDictionary(t => t.Index);
+    foreach (var input in inputs.Where(i => !i.IsDirectory)) {
+      if (CbmNibbleEntries.IsMetadata(input.ArchiveName)) continue;
+      if (!CbmNibbleEntries.TryParseTrackName(input.ArchiveName, out var index) || index is < 0 or >= CbmNibbleReader.NibTrackCount)
+        throw new NotSupportedException("NIB mutation accepts track_00.bin through track_83.bin entries only.");
+      var data = input.ReadContent();
+      if (data.Length != CbmNibbleReader.NibTrackSize)
+        throw new NotSupportedException($"NIB track_{index:D2}.bin must be exactly {CbmNibbleReader.NibTrackSize} bytes.");
+      tracks[index] = new CbmNibbleReader.Track(index, data, 0);
+    }
+    var rebuilt = CbmNibbleWriter.BuildNibFromTracks(tracks.Values.OrderBy(t => t.Index).ToArray());
+    VerifyNibTracks(rebuilt, tracks.Values.Where(t => t.Data.Length > 0));
+    CbmNibbleEntries.Commit(archive, rebuilt);
+  }
+
+  public void Remove(Stream archive, string[] entryNames) {
+    var image = CbmNibbleEntries.ReadImage(archive, "image.nib");
+    var remove = new HashSet<int>();
+    foreach (var name in entryNames) {
+      if (CbmNibbleEntries.IsMetadata(name))
+        throw new NotSupportedException("metadata.ini is a generated NIB view and cannot be removed.");
+      if (!CbmNibbleEntries.TryParseTrackName(name, out var index))
+        throw new NotSupportedException("NIB removal accepts track_NN.bin entries only.");
+      remove.Add(index);
+    }
+    var tracks = image.Tracks.Select(t => remove.Contains(t.Index) ? t with { Data = [] } : t).ToArray();
+    var rebuilt = CbmNibbleWriter.BuildNibFromTracks(tracks);
+    VerifyNibTracks(rebuilt, tracks.Where(t => t.Data.Length > 0));
+    CbmNibbleEntries.Commit(archive, rebuilt);
+  }
+
+  public void Purge(Stream archive) {
+    _ = CbmNibbleEntries.ReadImage(archive, "image.nib");
+    CbmNibbleEntries.Commit(archive, new byte[CbmNibbleReader.NibExpectedFileSize]);
+  }
+
+  public void Defragment(Stream archive)
+    => this.Defragment(archive, new DefragOptions());
+
+  public void Defragment(Stream archive, DefragOptions options) {
+    ArgumentNullException.ThrowIfNull(options);
+    var image = CbmNibbleEntries.ReadImage(archive, "image.nib");
+    options.OnProgress?.Invoke(new DefragProgressEvent(
+      "scanning", 0, 0, -1, archive.Length, this.EnumerateLayout(archive).ToList(),
+      "NIB uses fixed half-track slots; no relocation is necessary"));
+    options.CancellationToken.ThrowIfCancellationRequested();
+    options.OnProgress?.Invoke(new DefragProgressEvent(
+      "complete", 1, -1, -1, image.TotalFileSize, this.EnumerateLayout(archive).ToList(),
+      "NIB is already physically canonical"));
+  }
+
+  public IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive) {
+    var image = CbmNibbleEntries.ReadImage(archive, "image.nib");
+    var result = new List<DefragBlockInfo>(image.Tracks.Count + 1);
+    foreach (var track in image.Tracks) {
+      var offset = track.Index * (long)CbmNibbleReader.NibTrackSize;
+      result.Add(new DefragBlockInfo(offset, CbmNibbleReader.NibTrackSize,
+        track.Data.Length == 0 ? DefragBlockKind.Free : DefragBlockKind.Used,
+        track.Data.Length == 0 ? null : $"track_{track.Index:D2}.bin"));
+    }
+    var covered = image.Tracks.Count * (long)CbmNibbleReader.NibTrackSize;
+    if (covered < image.TotalFileSize)
+      result.Add(new DefragBlockInfo(covered, image.TotalFileSize - covered,
+        DefragBlockKind.MetadataReserved, "$NIB/trailing-partial-slot"));
+    return result;
+  }
+
+  public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true) {
+    var extents = this.EnumerateLayout(image).ToList();
+    if (extents.Count == 0) return 0;
+    image.Position = 0;
+    return UnusedSpaceWiper.Wipe(image, extents, image.Length, false, null);
+  }
+
+  private static void VerifyNibTracks(byte[] rebuilt, IEnumerable<CbmNibbleReader.Track> expected) {
+    var parsed = CbmNibbleReader.Read(rebuilt, "image.nib");
+    var actual = parsed.Tracks.ToDictionary(t => t.Index);
+    foreach (var track in expected)
+      if (!actual.TryGetValue(track.Index, out var found) || !found.Data.AsSpan().SequenceEqual(track.Data))
+        throw new InvalidOperationException($"NIB rebuild changed track_{track.Index:D2}.bin; refusing to commit it.");
+  }
 }
diff --git a/FileSystems/FileSystem.CbmNibble/CbmNibbleRawTrackDevice.cs b/FileSystems/FileSystem.CbmNibble/CbmNibbleRawTrackDevice.cs
new file mode 100644
index 000000000..de7e85805
--- /dev/null
+++ b/FileSystems/FileSystem.CbmNibble/CbmNibbleRawTrackDevice.cs
@@ -0,0 +1,239 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+
+namespace FileSystem.CbmNibble;
+
+/// <summary>
+/// Opens the device layer below the pseudo-archive descriptors. A future
+/// Commodore sector decoder can project these tracks as an
+/// <see cref="IRandomAccessBlockDevice"/>, and a CBM DOS filesystem session can
+/// then mount that block device without knowing whether the outer image was G64,
+/// NIB, flux, or a physical drive.
+/// </summary>
+public static class CbmNibbleRawTrackDevices {
+  public static IRawTrackDevice OpenG64(Stream image, bool writable, bool leaveOpen = true)
+    => new G64Device(image, writable, leaveOpen);
+
+  public static IRawTrackDevice OpenNib(Stream image, bool writable, bool leaveOpen = true)
+    => new NibDevice(image, writable, leaveOpen);
+
+  private sealed class G64Device : IRawTrackDevice {
+    private readonly Stream _stream;
+    private readonly bool _leaveOpen;
+    private readonly Dictionary<int, CbmNibbleReader.Track> _tracks;
+    private readonly byte _version;
+    private int _trackCount;
+    private bool _dirty;
+    private bool _disposed;
+
+    public G64Device(Stream stream, bool writable, bool leaveOpen) {
+      ArgumentNullException.ThrowIfNull(stream);
+      if (!stream.CanRead || !stream.CanSeek)
+        throw new ArgumentException("G64 track access requires a readable, seekable stream.", nameof(stream));
+      if (writable && !stream.CanWrite)
+        throw new ArgumentException("Writable G64 track access requires a writable stream.", nameof(stream));
+      _stream = stream;
+      _leaveOpen = leaveOpen;
+      var parsed = CbmNibbleEntries.ReadImage(stream, "image.g64");
+      if (writable) {
+        var variable = parsed.Tracks.FirstOrDefault(t => t.SpeedZone > 3);
+        if (variable != null)
+          throw new NotSupportedException(
+            $"G64 half-track {variable.Index} uses variable-speed map pointer 0x{variable.SpeedZone:X8}; writable raw-track access requires modeled speed-map blocks.");
+      }
+      CanWrite = writable;
+      _version = parsed.Version;
+      _trackCount = parsed.TrackCount;
+      _tracks = parsed.Tracks.ToDictionary(t => t.Index,
+        t => new CbmNibbleReader.Track(t.Index, t.Data.ToArray(), t.SpeedZone));
+    }
+
+    public int TrackCount => _trackCount;
+    public bool CanWrite { get; }
+
+    public IReadOnlyList<RawTrackInfo> EnumerateTracks() {
+      ThrowIfDisposed();
+      return Enumerable.Range(0, _trackCount)
+        .Select(index => _tracks.TryGetValue(index, out var track)
+          ? new RawTrackInfo(index, track.Data.LongLength, track.SpeedZone, track.Data.Length > 0)
+          : new RawTrackInfo(index, 0, CbmNibbleEntries.DefaultSpeedZone(index), false))
+        .ToArray();
+    }
+
+    public int ReadTrack(int index, Span<byte> destination) {
+      ThrowIfDisposed();
+      ValidateIndex(index);
+      if (!_tracks.TryGetValue(index, out var track) || track.Data.Length == 0) return 0;
+      if (destination.Length < track.Data.Length)
+        throw new ArgumentException($"Destination is {destination.Length} bytes; track requires {track.Data.Length}.", nameof(destination));
+      track.Data.CopyTo(destination);
+      return track.Data.Length;
+    }
+
+    public void WriteTrack(int index, ReadOnlySpan<byte> source, uint? encodingParameter = null) {
+      ThrowIfDisposed();
+      EnsureWritable();
+      if (index is < 0 or >= 84) throw new ArgumentOutOfRangeException(nameof(index));
+      if (source.Length > ushort.MaxValue)
+        throw new NotSupportedException("G64's track length field is 16-bit.");
+      var speed = encodingParameter
+        ?? (_tracks.TryGetValue(index, out var old) ? old.SpeedZone : CbmNibbleEntries.DefaultSpeedZone(index));
+      if (speed > 3)
+        throw new NotSupportedException("Pointer-based G64 variable-speed maps are not writable yet.");
+      _tracks[index] = new CbmNibbleReader.Track(index, source.ToArray(), speed);
+      _trackCount = Math.Max(_trackCount, index + 1);
+      _dirty = true;
+    }
+
+    public void ClearTrack(int index) {
+      ThrowIfDisposed();
+      EnsureWritable();
+      ValidateIndex(index);
+      var speed = _tracks.TryGetValue(index, out var old)
+        ? old.SpeedZone
+        : CbmNibbleEntries.DefaultSpeedZone(index);
+      _tracks[index] = new CbmNibbleReader.Track(index, [], speed);
+      _dirty = true;
+    }
+
+    public void Flush() {
+      ThrowIfDisposed();
+      if (!CanWrite || !_dirty) {
+        _stream.Flush();
+        return;
+      }
+      var ordered = _tracks.Values.OrderBy(t => t.Index).ToArray();
+      var rebuilt = CbmNibbleWriter.BuildG64FromTracks(ordered, _version, _trackCount);
+      var verify = CbmNibbleReader.Read(rebuilt, "image.g64").Tracks.ToDictionary(t => t.Index);
+      foreach (var expected in ordered.Where(t => t.Data.Length > 0))
+        if (!verify.TryGetValue(expected.Index, out var actual) || !actual.Data.AsSpan().SequenceEqual(expected.Data))
+          throw new InvalidOperationException($"G64 track-device commit changed track {expected.Index}.");
+      CbmNibbleEntries.Commit(_stream, rebuilt);
+      _dirty = false;
+    }
+
+    public void Dispose() {
+      if (_disposed) return;
+      if (CanWrite && _dirty) Flush();
+      _disposed = true;
+      if (!_leaveOpen) _stream.Dispose();
+    }
+
+    private void ValidateIndex(int index) {
+      if (index < 0 || index >= _trackCount) throw new ArgumentOutOfRangeException(nameof(index));
+    }
+
+    private void EnsureWritable() {
+      if (!CanWrite) throw new NotSupportedException("The G64 raw-track device was opened read-only.");
+    }
+
+    private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+  }
+
+  private sealed class NibDevice : IRawTrackDevice {
+    private readonly Stream _stream;
+    private readonly bool _leaveOpen;
+    private bool _disposed;
+
+    public NibDevice(Stream stream, bool writable, bool leaveOpen) {
+      ArgumentNullException.ThrowIfNull(stream);
+      if (!stream.CanRead || !stream.CanSeek)
+        throw new ArgumentException("NIB track access requires a readable, seekable stream.", nameof(stream));
+      if (writable && !stream.CanWrite)
+        throw new ArgumentException("Writable NIB track access requires a writable stream.", nameof(stream));
+      _ = CbmNibbleEntries.ReadImage(stream, "image.nib");
+      _stream = stream;
+      _leaveOpen = leaveOpen;
+      CanWrite = writable;
+    }
+
+    public int TrackCount => CbmNibbleReader.NibTrackCount;
+    public bool CanWrite { get; }
+
+    public IReadOnlyList<RawTrackInfo> EnumerateTracks() {
+      ThrowIfDisposed();
+      var result = new RawTrackInfo[TrackCount];
+      var buffer = new byte[CbmNibbleReader.NibTrackSize];
+      for (var index = 0; index < TrackCount; ++index) {
+        var read = ReadSlot(index, buffer);
+        var present = read == buffer.Length && buffer.AsSpan().IndexOfAnyExcept((byte)0) >= 0;
+        result[index] = new RawTrackInfo(index, present ? buffer.Length : 0, 0, present);
+      }
+      return result;
+    }
+
+    public int ReadTrack(int index, Span<byte> destination) {
+      ThrowIfDisposed();
+      ValidateIndex(index);
+      if (destination.Length < CbmNibbleReader.NibTrackSize)
+        throw new ArgumentException($"NIB track reads require a {CbmNibbleReader.NibTrackSize}-byte destination.", nameof(destination));
+      var read = ReadSlot(index, destination[..CbmNibbleReader.NibTrackSize]);
+      if (read != CbmNibbleReader.NibTrackSize) return 0;
+      return destination[..CbmNibbleReader.NibTrackSize].IndexOfAnyExcept((byte)0) < 0
+        ? 0
+        : CbmNibbleReader.NibTrackSize;
+    }
+
+    public void WriteTrack(int index, ReadOnlySpan<byte> source, uint? encodingParameter = null) {
+      ThrowIfDisposed();
+      EnsureWritable();
+      ValidateIndex(index);
+      if (source.Length != CbmNibbleReader.NibTrackSize)
+        throw new NotSupportedException($"NIB tracks are fixed {CbmNibbleReader.NibTrackSize}-byte slots.");
+      if (encodingParameter is > 0)
+        throw new NotSupportedException("Raw NIB has no separate speed-zone field.");
+      EnsureCanonicalLength();
+      _stream.Position = index * (long)CbmNibbleReader.NibTrackSize;
+      _stream.Write(source);
+    }
+
+    public void ClearTrack(int index) {
+      ThrowIfDisposed();
+      EnsureWritable();
+      ValidateIndex(index);
+      EnsureCanonicalLength();
+      _stream.Position = index * (long)CbmNibbleReader.NibTrackSize;
+      var zeros = new byte[CbmNibbleReader.NibTrackSize];
+      _stream.Write(zeros);
+    }
+
+    public void Flush() {
+      ThrowIfDisposed();
+      _stream.Flush();
+    }
+
+    public void Dispose() {
+      if (_disposed) return;
+      if (CanWrite) _stream.Flush();
+      _disposed = true;
+      if (!_leaveOpen) _stream.Dispose();
+    }
+
+    private int ReadSlot(int index, Span<byte> destination) {
+      destination.Clear();
+      _stream.Position = index * (long)CbmNibbleReader.NibTrackSize;
+      var total = 0;
+      while (total < destination.Length) {
+        var read = _stream.Read(destination[total..]);
+        if (read == 0) break;
+        total += read;
+      }
+      return total;
+    }
+
+    private void EnsureCanonicalLength() {
+      if (_stream.Length < CbmNibbleReader.NibExpectedFileSize)
+        _stream.SetLength(CbmNibbleReader.NibExpectedFileSize);
+    }
+
+    private static void ValidateIndex(int index) {
+      if (index is < 0 or >= CbmNibbleReader.NibTrackCount) throw new ArgumentOutOfRangeException(nameof(index));
+    }
+
+    private void EnsureWritable() {
+      if (!CanWrite) throw new NotSupportedException("The NIB raw-track device was opened read-only.");
+    }
+
+    private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+  }
+}
diff --git a/FileSystems/FileSystem.CbmNibble/CbmNibbleReader.cs b/FileSystems/FileSystem.CbmNibble/CbmNibbleReader.cs
index 696e81bac..fad8598c1 100644
--- a/FileSystems/FileSystem.CbmNibble/CbmNibbleReader.cs
+++ b/FileSystems/FileSystem.CbmNibble/CbmNibbleReader.cs
@@ -5,40 +5,28 @@
 namespace FileSystem.CbmNibble;
 
 /// <summary>
-/// Reader for Commodore 1541/1571 nibble dumps — both the raw .nib format
-/// (used by nibtools and ZoomFloppy) and the .g64 GCR track container
-/// produced by emulators like VICE. Converting GCR back to a cleanly
-/// sectored D64 is outside scope for this sweep; this reader detects the
-/// format variant and surfaces each track as a raw byte buffer for
-/// downstream tools to consume.
+/// Reader for Commodore 1541/1571 nibble dumps — both raw .nib fixed-slot
+/// images and VICE .g64 track containers. The pseudo-archive surface is one
+/// opaque GCR payload per half-track; callers that need filesystem semantics
+/// can explicitly decode those tracks to a D64 through <see cref="CbmNibbleWriter.DecodeToD64"/>.
 /// </summary>
-/// <remarks>
-/// <para>
-/// <b>NIB format</b>: a flat dump of 84 half-tracks × 0x2000 (8192) bytes
-/// each — the raw 1541 read-head stream including sync marks and jitter.
-/// There is no magic header; detection is extension-only, and the typical
-/// file size is exactly <c>84 × 8192 = 688 128</c> bytes.
-/// </para>
-/// <para>
-/// <b>G64 format</b>: per VICE spec, a 12-byte signature
-/// <c>"GCR-1541\0\x00\x00\xA2\xA2"</c> (byte 8 = version, byte 9 = track
-/// count, bytes 10-11 = max track-data size in bytes little-endian),
-/// followed by an offset table of <c>track_count</c> u32 LE entries
-/// (0 = empty track), an equal-length u32 LE speed-zone table, and the
-/// raw track data blocks. Each track block starts with a u16 LE length
-/// followed by the GCR bytes.
-/// </para>
-/// </remarks>
 public sealed class CbmNibbleReader {
 
   public static readonly byte[] G64Signature = "GCR-1541"u8.ToArray();
-  public const int NibTrackCount = 84;          // standard nibtools: 84 half-tracks
-  public const int NibTrackSize = 0x2000;       // 8192 bytes per half-track
-  public const int NibExpectedFileSize = NibTrackCount * NibTrackSize; // 688128
+  public const int NibTrackCount = 84;
+  public const int NibTrackSize = 0x2000;
+  public const int NibExpectedFileSize = NibTrackCount * NibTrackSize;
 
   public enum ImageKind { Nib, G64 }
 
-  public sealed record Track(int Index, byte[] Data, uint SpeedZone);
+  /// <param name="PhysicalOffset">Start of the physical slot/block in the container.</param>
+  /// <param name="PhysicalLength">Physical bytes occupied by this track block/slot.</param>
+  public sealed record Track(
+    int Index,
+    byte[] Data,
+    uint SpeedZone,
+    long PhysicalOffset = -1,
+    long PhysicalLength = 0);
 
   public sealed record NibbleImage(
     ImageKind Kind,
@@ -52,7 +40,6 @@ public static NibbleImage Read(ReadOnlySpan<byte> data, string? fileName = null)
     if (data.Length >= G64Signature.Length && data[..G64Signature.Length].SequenceEqual(G64Signature))
       return ReadG64(data);
 
-    // NIB has no magic — fall back on extension or raw size.
     if (fileName is not null && fileName.EndsWith(".nib", StringComparison.OrdinalIgnoreCase))
       return ReadNib(data);
     if (data.Length == NibExpectedFileSize)
@@ -64,21 +51,22 @@ public static NibbleImage Read(ReadOnlySpan<byte> data, string? fileName = null)
   }
 
   private static NibbleImage ReadNib(ReadOnlySpan<byte> data) {
-    // Most nib dumps are exactly 84 × 8192; truncated / short dumps are
-    // tolerated by surfacing however many whole tracks fit.
-    var trackCount = data.Length / NibTrackSize;
+    var trackCount = Math.Min(NibTrackCount, data.Length / NibTrackSize);
     var tracks = new List<Track>(trackCount);
     for (var i = 0; i < trackCount; i++) {
       var offset = i * NibTrackSize;
-      tracks.Add(new Track(i, data.Slice(offset, NibTrackSize).ToArray(), SpeedZone: 0));
+      var slot = data.Slice(offset, NibTrackSize);
+      // NIB has no absent-track marker. CompressionWorkbench reserves an
+      // all-zero fixed slot as its canonical empty representation: a useful
+      // GCR track cannot be all zero, and the physical slot is still retained.
+      var empty = true;
+      foreach (var b in slot)
+        if (b != 0) { empty = false; break; }
+      tracks.Add(new Track(i, empty ? [] : slot.ToArray(), SpeedZone: 0,
+        PhysicalOffset: offset, PhysicalLength: NibTrackSize));
     }
     return new NibbleImage(
-      Kind: ImageKind.Nib,
-      Version: 0,
-      TrackCount: trackCount,
-      MaxTrackSize: NibTrackSize,
-      Tracks: tracks,
-      TotalFileSize: data.Length);
+      ImageKind.Nib, Version: 0, trackCount, NibTrackSize, tracks, data.Length);
   }
 
   private static NibbleImage ReadG64(ReadOnlySpan<byte> data) {
@@ -88,7 +76,6 @@ private static NibbleImage ReadG64(ReadOnlySpan<byte> data) {
     var version = data[8];
     int trackCount = data[9];
     var maxTrackSize = BinaryPrimitives.ReadUInt16LittleEndian(data[10..]);
-
     if (trackCount == 0 || trackCount > 84)
       throw new InvalidDataException($"G64: implausible track count {trackCount} (valid range 1-84).");
 
@@ -102,28 +89,22 @@ private static NibbleImage ReadG64(ReadOnlySpan<byte> data) {
       var offset = BinaryPrimitives.ReadUInt32LittleEndian(data[(offsetTableStart + i * 4)..]);
       var speed = BinaryPrimitives.ReadUInt32LittleEndian(data[(speedTableStart + i * 4)..]);
       if (offset == 0) {
-        // Empty track — no data recorded for this half-track.
         tracks.Add(new Track(i, [], speed));
         continue;
       }
       if (offset + 2 > (uint)data.Length) {
-        tracks.Add(new Track(i, [], speed));
+        tracks.Add(new Track(i, [], speed, offset, 0));
         continue;
       }
       var trackLen = BinaryPrimitives.ReadUInt16LittleEndian(data[(int)offset..]);
       var payloadStart = (int)offset + 2;
       var copyLen = Math.Min(trackLen, Math.Max(0, data.Length - payloadStart));
       var buf = copyLen > 0 ? data.Slice(payloadStart, copyLen).ToArray() : [];
-      tracks.Add(new Track(i, buf, speed));
+      tracks.Add(new Track(i, buf, speed, offset, 2L + copyLen));
     }
 
     return new NibbleImage(
-      Kind: ImageKind.G64,
-      Version: version,
-      TrackCount: trackCount,
-      MaxTrackSize: maxTrackSize,
-      Tracks: tracks,
-      TotalFileSize: data.Length);
+      ImageKind.G64, version, trackCount, maxTrackSize, tracks, data.Length);
   }
 
   public static byte[] BuildMetadata(NibbleImage img) {
@@ -147,8 +128,6 @@ public static byte[] BuildMetadata(NibbleImage img) {
     sb.AppendLine();
     sb.AppendLine("[tracks]");
     foreach (var t in img.Tracks) {
-      // Half-tracks 0,2,4... are whole tracks 1,2,3... — expose both numbers
-      // so operators can cross-reference with nibtools / c64 docs.
       var halfTrack = t.Index;
       var track = (halfTrack / 2) + 1;
       var half = halfTrack % 2 == 0 ? "" : ".5";
diff --git a/FileSystems/FileSystem.CbmNibble/CbmNibbleWriter.cs b/FileSystems/FileSystem.CbmNibble/CbmNibbleWriter.cs
index 874406c4a..57009a71b 100644
--- a/FileSystems/FileSystem.CbmNibble/CbmNibbleWriter.cs
+++ b/FileSystems/FileSystem.CbmNibble/CbmNibbleWriter.cs
@@ -5,29 +5,16 @@
 namespace FileSystem.CbmNibble;
 
 /// <summary>
-/// From-scratch writer for the Commodore nibble container the
-/// <see cref="CbmNibbleReader"/> consumes. The Commodore 1541 filesystem is
-/// flat — files live in the single directory on track 18 with a BAM — so the
-/// writer first builds a standard sectored D64 image (reusing
-/// <see cref="D64Writer"/> for the BAM, directory and linked sector chains)
-/// and then GCR-encodes every track into the VICE <c>.g64</c> wire format,
-/// framing each sector with sync marks, a header block and a data block exactly
-/// as a real 1541 lays them down on disk.
+/// Writer for Commodore nibble containers. It supports two distinct layers:
+/// ordinary Commodore files are first placed into a D64 and GCR-encoded, while
+/// pseudo-archive callers can directly build G64/NIB containers from opaque
+/// <c>track_XX.bin</c> payloads without touching the filesystem inside them.
 /// </summary>
-/// <remarks>
-/// <para>
-/// The reader surfaces each G64 track as an opaque GCR byte buffer; it does not
-/// decode GCR. <see cref="DecodeToD64"/> performs the inverse transform so a
-/// caller can recover the sectored image (and thus the directory and file
-/// contents) from the tracks the reader hands back.
-/// </para>
-/// </remarks>
 public sealed class CbmNibbleWriter {
 
   private const int SectorSize = 256;
   private const int TotalTracks = 35;
 
-  // 1541 sector layout per track (track 0 is unused).
   private static readonly int[] SectorsPerTrack = [
     0,
     21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21,
@@ -36,7 +23,6 @@ public sealed class CbmNibbleWriter {
     17, 17, 17, 17, 17,
   ];
 
-  // 1541 speed zones: outer tracks spin faster (more sectors), inner slower.
   private static byte SpeedZoneFor(int track) => track switch {
     >= 1 and <= 17 => 3,
     >= 18 and <= 24 => 2,
@@ -44,9 +30,7 @@ public sealed class CbmNibbleWriter {
     _ => 0,
   };
 
-  // Sync mark: a run of 0xFF bytes the controller uses to lock onto a block.
   private const int SyncLength = 5;
-  // Gap bytes between blocks; 0x55 is the conventional 1541 inter-sector gap.
   private const byte GapByte = 0x55;
   private const int HeaderGap = 9;
   private const int TailGap = 8;
@@ -56,17 +40,12 @@ public sealed class CbmNibbleWriter {
   private byte _diskId2 = (byte)'0';
   private string _diskName = "DISK";
 
-  /// <summary>Sets the on-disk volume name (PETSCII, ≤16 chars) and the 2-byte disk id.</summary>
   public void SetDisk(string name, char id1 = '0', char id2 = '0') {
     _diskName = name ?? "DISK";
     _diskId1 = (byte)id1;
     _diskId2 = (byte)id2;
   }
 
-  /// <summary>
-  /// Adds a file to the flat directory. Commodore names are PETSCII and at most
-  /// 16 characters; longer names are truncated. The default file type is PRG.
-  /// </summary>
   public void AddFile(string name, byte[] data) {
     ArgumentNullException.ThrowIfNull(name);
     ArgumentNullException.ThrowIfNull(data);
@@ -74,76 +53,125 @@ public void AddFile(string name, byte[] data) {
     _d64.AddFile(trimmed, data);
   }
 
-  /// <summary>Builds the G64 GCR nibble image holding all added files.</summary>
+  /// <summary>Builds a VICE G64 image from the ordinary files added above.</summary>
   public byte[] Build() {
     var d64 = _d64.Build(_diskName);
     return BuildG64(d64);
   }
 
-  /// <summary>Writes the G64 image to <paramref name="output"/>.</summary>
+  /// <summary>
+  /// Builds a raw 84×8192-byte NIB image from the ordinary files added above.
+  /// Whole-track G64 payloads are copied to their corresponding even half-track
+  /// slots and padded with the conventional 0x55 gap byte; unused half-tracks
+  /// remain the workbench's all-zero empty-slot representation.
+  /// </summary>
+  public byte[] BuildNib() {
+    var g64 = CbmNibbleReader.Read(this.Build(), "image.g64");
+    var result = new byte[CbmNibbleReader.NibExpectedFileSize];
+    foreach (var track in g64.Tracks) {
+      if (track.Data.Length == 0 || track.Index >= CbmNibbleReader.NibTrackCount) continue;
+      if (track.Data.Length > CbmNibbleReader.NibTrackSize)
+        throw new InvalidOperationException(
+          $"Encoded GCR track {track.Index} is {track.Data.Length} bytes and does not fit a NIB slot.");
+      var slot = result.AsSpan(track.Index * CbmNibbleReader.NibTrackSize, CbmNibbleReader.NibTrackSize);
+      slot.Fill(GapByte);
+      track.Data.CopyTo(slot);
+    }
+    return result;
+  }
+
   public void WriteTo(Stream output) {
     ArgumentNullException.ThrowIfNull(output);
     var image = this.Build();
     output.Write(image, 0, image.Length);
   }
 
-  // ── G64 assembly ────────────────────────────────────────────────────────
-
-  private byte[] BuildG64(byte[] d64) {
-    // One G64 half-track entry per physical track (1..35) → indices 0,2,4,...
-    // (the reader maps half-track index N to track N/2 + 1). Half-tracks
-    // between real tracks stay empty (offset 0).
-    var halfTrackCount = TotalTracks * 2 - 1; // 69 half-tracks cover tracks 1..35
-
-    // Encode each real track first to learn the maximum block size.
-    var encodedTracks = new byte[TotalTracks + 1][];
-    var maxTrackSize = 0;
-    for (var track = 1; track <= TotalTracks; track++) {
-      var gcr = EncodeTrack(d64, track);
-      encodedTracks[track] = gcr;
-      if (gcr.Length > maxTrackSize) maxTrackSize = gcr.Length;
+  /// <summary>
+  /// Builds a compact G64 directly from opaque half-track payloads. This is the
+  /// canonical mutation/re-layout path for the pseudo-archive surface: track
+  /// bytes are preserved exactly and placed back-to-back with no obsolete
+  /// fixed-stride padding. Constant speed zones 0..3 are preserved; pointer-based
+  /// variable-speed maps are intentionally refused until their auxiliary speed
+  /// blocks are modeled.
+  /// </summary>
+  public static byte[] BuildG64FromTracks(
+      IReadOnlyList<CbmNibbleReader.Track> tracks,
+      byte version = 0,
+      int? trackCount = null) {
+    ArgumentNullException.ThrowIfNull(tracks);
+    var byIndex = tracks.GroupBy(t => t.Index).ToDictionary(g => g.Key, g => g.Last());
+    foreach (var track in byIndex.Values) {
+      if (track.Index is < 0 or >= 84)
+        throw new ArgumentOutOfRangeException(nameof(tracks), $"G64 half-track index {track.Index} is outside 0..83.");
+      if (track.Data.Length > ushort.MaxValue)
+        throw new NotSupportedException($"G64 track {track.Index} exceeds the 16-bit track-length field.");
+      if (track.SpeedZone > 3)
+        throw new NotSupportedException(
+          $"G64 track {track.Index} uses variable-speed map pointer 0x{track.SpeedZone:X8}; direct mutation requires constant speed zones 0..3.");
     }
 
-    const int headerSize = 12;
-    var offsetTableSize = halfTrackCount * 4;
-    var speedTableSize = halfTrackCount * 4;
-    var tableEnd = headerSize + offsetTableSize + speedTableSize;
-
-    // Each populated half-track stores a u16 length prefix + its GCR payload.
-    var blockStride = 2 + maxTrackSize;
-    var populated = TotalTracks;
-    var total = tableEnd + populated * blockStride;
-    var buf = new byte[total];
-
-    CbmNibbleReader.G64Signature.CopyTo(buf, 0);
-    buf[8] = 0;                                   // version 0
-    buf[9] = (byte)halfTrackCount;
-    BinaryPrimitives.WriteUInt16LittleEndian(buf.AsSpan(10), (ushort)maxTrackSize);
-
-    var offsetTableStart = headerSize;
-    var speedTableStart = offsetTableStart + offsetTableSize;
-    var nextBlock = tableEnd;
-
-    for (var half = 0; half < halfTrackCount; half++) {
-      var isWholeTrack = half % 2 == 0;
-      var track = half / 2 + 1;
-      if (!isWholeTrack || track > TotalTracks) {
-        // Empty half-track: offset 0, speed 0.
-        continue;
-      }
+    var highest = byIndex.Count == 0 ? 0 : byIndex.Keys.Max() + 1;
+    var count = trackCount ?? Math.Max(1, highest);
+    if (count is < 1 or > 84 || count < highest)
+      throw new ArgumentOutOfRangeException(nameof(trackCount), "G64 track count must be 1..84 and cover every supplied track index.");
 
-      var gcr = encodedTracks[track];
-      BinaryPrimitives.WriteUInt32LittleEndian(buf.AsSpan(offsetTableStart + half * 4), (uint)nextBlock);
-      BinaryPrimitives.WriteUInt32LittleEndian(buf.AsSpan(speedTableStart + half * 4), SpeedZoneFor(track));
+    var maxTrackSize = byIndex.Values.Where(t => t.Data.Length > 0)
+      .Select(t => t.Data.Length).DefaultIfEmpty(0).Max();
+    const int headerSize = 12;
+    var tablesEnd = headerSize + count * 8;
+    var payloadBytes = byIndex.Values.Where(t => t.Index < count && t.Data.Length > 0)
+      .Sum(t => checked(2 + t.Data.Length));
+    var buffer = new byte[checked(tablesEnd + payloadBytes)];
+
+    CbmNibbleReader.G64Signature.CopyTo(buffer, 0);
+    buffer[8] = version;
+    buffer[9] = (byte)count;
+    BinaryPrimitives.WriteUInt16LittleEndian(buffer.AsSpan(10), (ushort)maxTrackSize);
+
+    var offsetTable = headerSize;
+    var speedTable = headerSize + count * 4;
+    var cursor = tablesEnd;
+    for (var i = 0; i < count; ++i) {
+      if (!byIndex.TryGetValue(i, out var track)) continue;
+      BinaryPrimitives.WriteUInt32LittleEndian(buffer.AsSpan(speedTable + i * 4), track.SpeedZone);
+      if (track.Data.Length == 0) continue;
+      BinaryPrimitives.WriteUInt32LittleEndian(buffer.AsSpan(offsetTable + i * 4), (uint)cursor);
+      BinaryPrimitives.WriteUInt16LittleEndian(buffer.AsSpan(cursor), (ushort)track.Data.Length);
+      track.Data.CopyTo(buffer, cursor + 2);
+      cursor += 2 + track.Data.Length;
+    }
+    return buffer;
+  }
 
-      BinaryPrimitives.WriteUInt16LittleEndian(buf.AsSpan(nextBlock), (ushort)gcr.Length);
-      gcr.CopyTo(buf, nextBlock + 2);
-      // Remaining bytes of the fixed-stride block stay as gap (0x00 padding is
-      // acceptable; the length prefix bounds the meaningful GCR data).
-      nextBlock += blockStride;
+  /// <summary>
+  /// Builds a fixed-size NIB directly from opaque track slots. A non-empty
+  /// replacement must be exactly 8192 bytes so extracting it again yields the
+  /// same pseudo-entry bytes. Missing/empty tracks are encoded as all-zero slots.
+  /// </summary>
+  public static byte[] BuildNibFromTracks(IReadOnlyList<CbmNibbleReader.Track> tracks) {
+    ArgumentNullException.ThrowIfNull(tracks);
+    var result = new byte[CbmNibbleReader.NibExpectedFileSize];
+    foreach (var track in tracks) {
+      if (track.Index is < 0 or >= CbmNibbleReader.NibTrackCount)
+        throw new ArgumentOutOfRangeException(nameof(tracks), $"NIB half-track index {track.Index} is outside 0..83.");
+      if (track.Data.Length == 0) continue;
+      if (track.Data.Length != CbmNibbleReader.NibTrackSize)
+        throw new NotSupportedException(
+          $"NIB track_{track.Index:D2}.bin must be exactly {CbmNibbleReader.NibTrackSize} bytes; got {track.Data.Length}.");
+      track.Data.CopyTo(result, track.Index * CbmNibbleReader.NibTrackSize);
     }
+    return result;
+  }
 
-    return buf;
+  private byte[] BuildG64(byte[] d64) {
+    var halfTrackCount = TotalTracks * 2 - 1;
+    var encodedTracks = new List<CbmNibbleReader.Track>(TotalTracks);
+    for (var track = 1; track <= TotalTracks; track++) {
+      var half = (track - 1) * 2;
+      encodedTracks.Add(new CbmNibbleReader.Track(
+        half, EncodeTrack(d64, track), SpeedZoneFor(track)));
+    }
+    return BuildG64FromTracks(encodedTracks, version: 0, trackCount: halfTrackCount);
   }
 
   private byte[] EncodeTrack(byte[] d64, int track) {
@@ -157,7 +185,6 @@ private byte[] EncodeTrack(byte[] d64, int track) {
   }
 
   private void WriteSectorImage(Stream output, int track, int sector, ReadOnlySpan<byte> data) {
-    // Header block (8 bytes pre-GCR): 0x08, checksum, sector, track, id2, id1, 0x0F, 0x0F.
     Span<byte> header = stackalloc byte[8];
     header[0] = 0x08;
     header[2] = (byte)sector;
@@ -166,17 +193,14 @@ private void WriteSectorImage(Stream output, int track, int sector, ReadOnlySpan
     header[5] = _diskId1;
     header[6] = 0x0F;
     header[7] = 0x0F;
-    header[1] = (byte)(header[2] ^ header[3] ^ header[4] ^ header[5]); // header checksum
+    header[1] = (byte)(header[2] ^ header[3] ^ header[4] ^ header[5]);
 
-    // Data block (260 bytes pre-GCR): 0x07 marker, 256 data bytes, checksum, 2 × 0x00.
     Span<byte> dataBlock = stackalloc byte[260];
     dataBlock[0] = 0x07;
     data[..SectorSize].CopyTo(dataBlock[1..]);
     byte checksum = 0;
     for (var i = 0; i < SectorSize; i++) checksum ^= dataBlock[1 + i];
     dataBlock[257] = checksum;
-    dataBlock[258] = 0x00;
-    dataBlock[259] = 0x00;
 
     WriteSync(output);
     output.Write(CbmGcr.Encode(header));
@@ -208,13 +232,9 @@ private static int SectorOffset(int track, int sector) {
     return offset + sector * SectorSize;
   }
 
-  // ── GCR → D64 recovery ────────────────────────────────────────────────────
-
   /// <summary>
-  /// Reconstructs a standard 174 848-byte D64 image from the GCR tracks of a
-  /// nibble image previously parsed by <see cref="CbmNibbleReader"/>. Each
-  /// track is rescanned for sync marks and its header/data blocks GCR-decoded
-  /// back into the correct sector slots.
+  /// Reconstructs a standard 174848-byte D64 image from the GCR tracks of a
+  /// nibble image. Whole-track entries are rescanned for sync/header/data blocks.
   /// </summary>
   public static byte[] DecodeToD64(CbmNibbleReader.NibbleImage image) {
     ArgumentNullException.ThrowIfNull(image);
@@ -222,7 +242,6 @@ public static byte[] DecodeToD64(CbmNibbleReader.NibbleImage image) {
 
     foreach (var trackEntry in image.Tracks) {
       if (trackEntry.Data.Length == 0) continue;
-      // Half-track index N → physical track N/2 + 1; ignore half-step tracks.
       if (trackEntry.Index % 2 != 0) continue;
       var track = trackEntry.Index / 2 + 1;
       if (track < 1 || track > TotalTracks) continue;
@@ -234,14 +253,10 @@ public static byte[] DecodeToD64(CbmNibbleReader.NibbleImage image) {
   private static void DecodeTrack(byte[] gcr, int track, byte[] d64) {
     var pos = 0;
     while (pos < gcr.Length) {
-      // Skip to the start of a sync run (0xFF bytes).
       while (pos < gcr.Length && gcr[pos] != 0xFF) pos++;
       while (pos < gcr.Length && gcr[pos] == 0xFF) pos++;
       if (pos >= gcr.Length) break;
 
-      // After a sync we expect a GCR block. A header block is 8 raw bytes → 10
-      // GCR bytes; a data block is 260 raw bytes → 325 GCR bytes. Peek the
-      // decoded marker to tell them apart.
       if (pos + 10 > gcr.Length) break;
       byte[] firstBlock;
       try {
@@ -252,7 +267,6 @@ private static void DecodeTrack(byte[] gcr, int track, byte[] d64) {
       }
 
       if (firstBlock[0] != 0x08) {
-        // Not a recognised header marker — advance and keep scanning.
         pos++;
         continue;
       }
@@ -261,7 +275,6 @@ private static void DecodeTrack(byte[] gcr, int track, byte[] d64) {
       var blockTrack = firstBlock[3];
       pos += 10;
 
-      // Advance past the header gap to the data-block sync.
       while (pos < gcr.Length && gcr[pos] != 0xFF) pos++;
       while (pos < gcr.Length && gcr[pos] == 0xFF) pos++;
       if (pos + 325 > gcr.Length) break;
diff --git a/FileSystems/FileSystem.CbmNibble/G64DirectRawTrackDevice.cs b/FileSystems/FileSystem.CbmNibble/G64DirectRawTrackDevice.cs
new file mode 100644
index 000000000..5e0dee878
--- /dev/null
+++ b/FileSystems/FileSystem.CbmNibble/G64DirectRawTrackDevice.cs
@@ -0,0 +1,167 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using Compression.Registry;
+
+namespace FileSystem.CbmNibble;
+
+/// <summary>
+/// G64 track device for mounted filesystems. Existing track-table entries are
+/// replaced without compacting unrelated tracks: the new variable-length record
+/// is appended first, flushed, then its existing offset-table entry is retargeted.
+/// Old records become unreachable slack for the explicit archive defragmenter.
+/// Growing the offset/speed tables is intentionally not supported here.
+/// </summary>
+internal sealed class G64DirectRawTrackDevice : IRawTrackDevice {
+  private const int HeaderSize = 12;
+  private readonly Stream _stream;
+  private readonly bool _leaveOpen;
+  private readonly Dictionary<int, CbmNibbleReader.Track> _tracks;
+  private readonly int _trackCount;
+  private int _maxTrackSize;
+  private bool _disposed;
+
+  public G64DirectRawTrackDevice(Stream stream, bool writable, bool leaveOpen = true) {
+    ArgumentNullException.ThrowIfNull(stream);
+    if (!stream.CanRead || !stream.CanSeek)
+      throw new ArgumentException("G64 track access requires a readable, seekable stream.", nameof(stream));
+    if (writable && !stream.CanWrite)
+      throw new ArgumentException("Writable G64 track access requires a writable stream.", nameof(stream));
+
+    _stream = stream;
+    _leaveOpen = leaveOpen;
+    var parsed = CbmNibbleEntries.ReadImage(stream, "image.g64");
+    var variable = parsed.Tracks.FirstOrDefault(track => track.SpeedZone > 3);
+    if (writable && variable != null)
+      throw new NotSupportedException(
+        $"G64 half-track {variable.Index} uses variable-speed map pointer 0x{variable.SpeedZone:X8}; writable sector projection requires modeled speed-map blocks.");
+
+    CanWrite = writable;
+    _trackCount = parsed.TrackCount;
+    _maxTrackSize = parsed.MaxTrackSize;
+    _tracks = Enumerable.Range(0, _trackCount).ToDictionary(
+      index => index,
+      index => parsed.Tracks.FirstOrDefault(track => track.Index == index)
+        ?? new CbmNibbleReader.Track(index, [], CbmNibbleEntries.DefaultSpeedZone(index)));
+  }
+
+  public int TrackCount => _trackCount;
+  public bool CanWrite { get; }
+
+  public IReadOnlyList<RawTrackInfo> EnumerateTracks() {
+    ThrowIfDisposed();
+    return Enumerable.Range(0, _trackCount)
+      .Select(index => {
+        var track = _tracks[index];
+        return new RawTrackInfo(index, track.Data.LongLength, track.SpeedZone, track.Data.Length != 0);
+      })
+      .ToArray();
+  }
+
+  public int ReadTrack(int index, Span<byte> destination) {
+    ThrowIfDisposed();
+    ValidateIndex(index);
+    var track = _tracks[index];
+    if (track.Data.Length == 0) return 0;
+    if (destination.Length < track.Data.Length)
+      throw new ArgumentException($"Destination is {destination.Length} bytes; track needs {track.Data.Length}.", nameof(destination));
+    track.Data.CopyTo(destination);
+    return track.Data.Length;
+  }
+
+  public void WriteTrack(int index, ReadOnlySpan<byte> source, uint? encodingParameter = null) {
+    ThrowIfDisposed();
+    EnsureWritable();
+    ValidateIndex(index);
+    if (source.Length == 0) {
+      ClearTrack(index);
+      return;
+    }
+    if (source.Length > ushort.MaxValue)
+      throw new NotSupportedException("G64's track length field is 16-bit.");
+
+    var old = _tracks[index];
+    var speed = encodingParameter ?? old.SpeedZone;
+    if (speed > 3)
+      throw new NotSupportedException("Pointer-based G64 variable-speed maps are not writable yet.");
+    if (old.Data.Length != 0 && speed != old.SpeedZone)
+      throw new NotSupportedException(
+        "Mounted G64 writes keep an existing track's speed zone stable; change it through the offline track editor instead.");
+
+    var recordOffset = _stream.Length;
+    var recordEnd = checked(recordOffset + 2L + source.Length);
+    if (recordOffset > uint.MaxValue || recordEnd > uint.MaxValue)
+      throw new IOException("G64 append would exceed its 32-bit track-offset address space.");
+
+    Span<byte> half = stackalloc byte[2];
+    BinaryPrimitives.WriteUInt16LittleEndian(half, (ushort)source.Length);
+    _stream.Position = recordOffset;
+    _stream.Write(half);
+    _stream.Write(source);
+    _stream.Flush();
+
+    if (source.Length > _maxTrackSize) {
+      _maxTrackSize = source.Length;
+      _stream.Position = 10;
+      BinaryPrimitives.WriteUInt16LittleEndian(half, (ushort)_maxTrackSize);
+      _stream.Write(half);
+      _stream.Flush();
+    }
+
+    Span<byte> word = stackalloc byte[4];
+    if (old.Data.Length == 0) {
+      BinaryPrimitives.WriteUInt32LittleEndian(word, speed);
+      _stream.Position = SpeedTableOffset(index);
+      _stream.Write(word);
+      _stream.Flush();
+    }
+
+    // Publication point: until this 32-bit table entry changes, readers still
+    // select the old complete record. The appended record is harmless slack.
+    BinaryPrimitives.WriteUInt32LittleEndian(word, (uint)recordOffset);
+    _stream.Position = OffsetTableOffset(index);
+    _stream.Write(word);
+    _stream.Flush();
+
+    _tracks[index] = new CbmNibbleReader.Track(
+      index, source.ToArray(), speed, recordOffset, 2L + source.Length);
+  }
+
+  public void ClearTrack(int index) {
+    ThrowIfDisposed();
+    EnsureWritable();
+    ValidateIndex(index);
+    Span<byte> zero = stackalloc byte[4];
+    _stream.Position = OffsetTableOffset(index);
+    _stream.Write(zero);
+    _stream.Flush();
+    var old = _tracks[index];
+    _tracks[index] = new CbmNibbleReader.Track(index, [], old.SpeedZone);
+  }
+
+  public void Flush() {
+    ThrowIfDisposed();
+    _stream.Flush();
+  }
+
+  public void Dispose() {
+    if (_disposed) return;
+    if (CanWrite) _stream.Flush();
+    _disposed = true;
+    if (!_leaveOpen) _stream.Dispose();
+  }
+
+  private long OffsetTableOffset(int index) => HeaderSize + index * 4L;
+  private long SpeedTableOffset(int index) => HeaderSize + _trackCount * 4L + index * 4L;
+
+  private void ValidateIndex(int index) {
+    if (index < 0 || index >= _trackCount)
+      throw new ArgumentOutOfRangeException(nameof(index),
+        "Mounted G64 writes cannot grow the offset/speed tables; use offline archive Add/Create for that relayout.");
+  }
+
+  private void EnsureWritable() {
+    if (!CanWrite) throw new NotSupportedException("The G64 track device was opened read-only.");
+  }
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/FileSystems/FileSystem.CramFs/CramFsFormatDescriptor.cs b/FileSystems/FileSystem.CramFs/CramFsFormatDescriptor.cs
index a3a5ac475..0399b36cb 100644
--- a/FileSystems/FileSystem.CramFs/CramFsFormatDescriptor.cs
+++ b/FileSystems/FileSystem.CramFs/CramFsFormatDescriptor.cs
@@ -5,6 +5,11 @@
 namespace FileSystem.CramFs;
 
 /// <summary>
+/// Offline R/W descriptor for Linux CramFS images. The Linux filesystem is
+/// intentionally read-only when mounted, but the workbench can create and edit
+/// an existing image by verified rebuild and can perform physical layout moves
+/// where the compressed-block metadata can be repointed safely.
+///
 /// References:
 /// <list type="bullet">
 ///   <item><description><c>https://docs.kernel.org/filesystems/cramfs.html</c> — Linux kernel cramfs documentation</description></item>
@@ -16,14 +21,13 @@ public sealed class CramFsFormatDescriptor : IFormatDescriptor, IArchiveFormatOp
   public string Id => "CramFs";
   public string DisplayName => "CramFS";
   public FormatCategory Category => FormatCategory.Archive;
-  // WORM (Write-Once-Read-Many), NOT R/W: CramFS is a compressed, read-only ROM
-  // filesystem. Add/Remove are implemented via the verified extract -> re-create
-  // rebuild (ModifyRebuilder), which is a full rewrite — so the verb works, but the
-  // image is not modified in place. Advertising CanModify would falsely claim genuine
-  // in-place R/W. See Compression.Registry/FormatCapabilities.cs for the WORM vs R/W rule.
+  // R/W is the public existing-instance edit contract, not a claim that a Linux
+  // kernel mounts CramFS writable or that every edit is byte-local. Add/Remove
+  // rebuild the image when necessary and return a valid edited CramFS image.
   public FormatCapabilities Capabilities =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate |
-    FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries | FormatCapabilities.SupportsDirectories;
+    FormatCapabilities.CanModify | FormatCapabilities.CanTest |
+    FormatCapabilities.SupportsMultipleEntries | FormatCapabilities.SupportsDirectories;
   public string DefaultExtension => ".cramfs";
   public IReadOnlyList<string> Extensions => [".cramfs"];
   public IReadOnlyList<string> CompoundExtensions => [];
@@ -31,7 +35,7 @@ public sealed class CramFsFormatDescriptor : IFormatDescriptor, IArchiveFormatOp
   public IReadOnlyList<FormatMethodInfo> Methods => [new("cramfs", "CramFS")];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
-  public string Description => "Linux Compressed ROM filesystem";
+  public string Description => "Linux compressed ROM filesystem with offline R/W rebuild and layout maintenance support";
 
   public List<ArchiveEntryInfo> List(Stream stream, string? password) {
     var r = new CramFsReader(stream);
@@ -193,21 +197,14 @@ private void DefragmentWithPlanner(Stream archive, DefragOptions options) {
   }
 
   /// <summary>
-  /// CramFS is a compressed, read-only ROM filesystem: the superblock, inode
-  /// tables, block-pointer tables and zlib-compressed page blocks are laid out
-  /// tightly back-to-back (only 4-byte alignment padding, which is already
-  /// zero) with no free space and no cluster tips. File data is packed at the
-  /// compressed-block level, so there is no allocation slack to wipe.
-  ///
-  /// <para>Note: <see cref="EnumerateExtents"/> reports Used runs at synthetic,
-  /// uncompressed-size offsets for the defrag preview — those offsets do
-  /// <em>not</em> map to real on-disk positions, so this method deliberately
-  /// does not drive the generic wiper from them (doing so would zero live
-  /// compressed bytes). Nothing is reclaimable; this returns 0.</para>
+  /// CramFS images produced by the canonical writer are tightly packed and have
+  /// no allocation-unit cluster tips. If a non-canonical image contains gaps,
+  /// the physical extent map below identifies them; this explicit override
+  /// remains conservative and leaves them alone because old CramFS tooling may
+  /// use alignment/padding bytes in ways that are not recoverable from inodes.
   /// </summary>
   public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true) {
     ArgumentNullException.ThrowIfNull(image);
-    // Fully packed, read-only image — no free regions or cluster tips exist.
     return 0;
   }
 
@@ -216,12 +213,6 @@ public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipe
   /// area as structure, and each file's block pointer table and compressed
   /// blocks under its name.
   /// </summary>
-  /// <remarks>
-  /// This used to walk a cursor forward by each file's uncompressed size, which
-  /// described a volume that does not exist — the bytes on disk are compressed
-  /// and sit wherever the inode says. Anything driven off that map operated on
-  /// offsets that belonged to nothing.
-  /// </remarks>
   public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image) {
     ArgumentNullException.ThrowIfNull(image);
     var result = new List<DefragBlockInfo>();
@@ -241,11 +232,6 @@ public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image) {
       }
       owned.Sort((a, b) => a.Start.CompareTo(b.Start));
 
-      // The superblock and every inode with its name sit ahead of the first
-      // file's table; nothing of the volume's own is written past it. So the
-      // prefix is structure and whatever no file claims after it is space
-      // nothing holds — alignment padding in a freshly written image, and a
-      // gap wherever something has since been moved out of.
       if (firstData > 0 && firstData <= image.Length)
         result.Add(new DefragBlockInfo(0, firstData, DefragBlockKind.MetadataReserved,
           "superblock and inodes"));
@@ -259,7 +245,7 @@ public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image) {
       if (cursor < image.Length)
         result.Add(new DefragBlockInfo(cursor, image.Length - cursor, DefragBlockKind.Free));
     } catch {
-      // An image we cannot walk claims nothing; wiping it would zero live data.
+      // Fail closed: an image we cannot walk claims no free space.
       return [];
     }
     return result;
diff --git a/FileSystems/FileSystem.D64/D64BlockDevice.cs b/FileSystems/FileSystem.D64/D64BlockDevice.cs
new file mode 100644
index 000000000..b74e65a0f
--- /dev/null
+++ b/FileSystems/FileSystem.D64/D64BlockDevice.cs
@@ -0,0 +1,92 @@
+#pragma warning disable CS1591
+using Compression.Registry;
+
+namespace FileSystem.D64;
+
+/// <summary>
+/// Sector-addressable view of the data portion of a standard 35-track D64.
+/// The optional per-sector error table in 175531-byte images is deliberately
+/// outside this device geometry and is therefore preserved by ordinary writes.
+/// </summary>
+public sealed class D64BlockDevice : IRandomAccessBlockDevice {
+  public const int LogicalSectorSize = 256;
+  public const int SectorCount = 683;
+  public const int DataLength = LogicalSectorSize * SectorCount;
+
+  private readonly Stream _stream;
+  private readonly bool _leaveOpen;
+  private readonly object _gate = new();
+  private bool _disposed;
+
+  public D64BlockDevice(Stream stream, bool writable, bool leaveOpen = true) {
+    ArgumentNullException.ThrowIfNull(stream);
+    if (!stream.CanRead || !stream.CanSeek)
+      throw new ArgumentException("D64 block access requires a readable, seekable stream.", nameof(stream));
+    if (stream.Length < DataLength)
+      throw new InvalidDataException($"D64 image is {stream.Length} bytes; at least {DataLength} bytes are required.");
+    if (writable && !stream.CanWrite)
+      throw new ArgumentException("Writable D64 block access requires a writable stream.", nameof(stream));
+    _stream = stream;
+    _leaveOpen = leaveOpen;
+    CanWrite = writable;
+  }
+
+  public BlockDeviceGeometry Geometry { get; } = new(LogicalSectorSize, SectorCount, LogicalSectorSize, false);
+  public bool CanWrite { get; }
+
+  public int ReadBlocks(long firstBlock, Span<byte> destination) {
+    ThrowIfDisposed();
+    ValidateTransfer(firstBlock, destination.Length);
+    var blockCount = destination.Length / LogicalSectorSize;
+    lock (_gate) {
+      _stream.Position = checked(firstBlock * LogicalSectorSize);
+      _stream.ReadExactly(destination);
+    }
+    return blockCount;
+  }
+
+  public void WriteBlocks(long firstBlock, ReadOnlySpan<byte> source) {
+    ThrowIfDisposed();
+    EnsureWritable();
+    ValidateTransfer(firstBlock, source.Length);
+    lock (_gate) {
+      _stream.Position = checked(firstBlock * LogicalSectorSize);
+      _stream.Write(source);
+    }
+  }
+
+  public void Trim(long firstBlock, long blockCount) {
+    ThrowIfDisposed();
+    EnsureWritable();
+    if (firstBlock < 0 || blockCount < 0 || firstBlock > SectorCount - blockCount)
+      throw new ArgumentOutOfRangeException(nameof(firstBlock));
+    throw new NotSupportedException("D64 has no discard/trim primitive; filesystem allocation owns free-sector contents.");
+  }
+
+  public void Flush() {
+    ThrowIfDisposed();
+    lock (_gate) _stream.Flush();
+  }
+
+  public void Dispose() {
+    if (_disposed) return;
+    if (CanWrite) Flush();
+    _disposed = true;
+    if (!_leaveOpen) _stream.Dispose();
+  }
+
+  private static void ValidateTransfer(long firstBlock, int byteCount) {
+    if (byteCount == 0) return;
+    if (byteCount < 0 || byteCount % LogicalSectorSize != 0)
+      throw new ArgumentException($"Block transfers must be a multiple of {LogicalSectorSize} bytes.", nameof(byteCount));
+    var blocks = byteCount / LogicalSectorSize;
+    if (firstBlock < 0 || firstBlock > SectorCount - blocks)
+      throw new ArgumentOutOfRangeException(nameof(firstBlock));
+  }
+
+  private void EnsureWritable() {
+    if (!CanWrite) throw new NotSupportedException("The D64 block device was opened read-only.");
+  }
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/FileSystems/FileSystem.D64/D64FilesystemSession.cs b/FileSystems/FileSystem.D64/D64FilesystemSession.cs
new file mode 100644
index 000000000..0629cfc70
--- /dev/null
+++ b/FileSystems/FileSystem.D64/D64FilesystemSession.cs
@@ -0,0 +1,504 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using System.Text;
+using Compression.Registry;
+
+namespace FileSystem.D64;
+
+/// <summary>
+/// Root-only CBM DOS 2.6 namespace session over a 1541 sector device. File
+/// handles are path-independent: rename keeps the node id stable and unlink
+/// detaches a namespace entry without invalidating already-open handles.
+/// </summary>
+public sealed class D64FilesystemSession : IFilesystemSession {
+  private const int SectorSize = 256;
+  private const int DirectoryTrack = 18;
+  private const int DirectoryStartSector = 1;
+  private const int TotalTracks = 35;
+  private const int MaximumFileBytes = 664 * 254;
+
+  private static readonly int[] SectorsPerTrack = [
+    0,
+    21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21,
+    19, 19, 19, 19, 19, 19, 19,
+    18, 18, 18, 18, 18, 18,
+    17, 17, 17, 17, 17,
+  ];
+
+  private readonly IRandomAccessBlockDevice _device;
+  private readonly bool _ownsDevice;
+  private readonly bool _readOnly;
+  private readonly object _gate = new();
+  private readonly Dictionary<FilesystemNodeId, NodeState> _states = [];
+  private readonly Dictionary<string, FilesystemNodeId> _idsByName = new(StringComparer.OrdinalIgnoreCase);
+  private byte[] _image;
+  private ulong _nextNodeId = 2;
+  private bool _disposed;
+
+  public D64FilesystemSession(
+      IRandomAccessBlockDevice device,
+      FilesystemDriverProfile profile,
+      bool readOnly,
+      bool ownsDevice = true) {
+    ArgumentNullException.ThrowIfNull(device);
+    ArgumentNullException.ThrowIfNull(profile);
+    if (device.Geometry.LogicalBlockSize != SectorSize || device.Geometry.BlockCount < D64BlockDevice.SectorCount)
+      throw new InvalidDataException("CBM DOS requires a 683-sector, 256-byte 1541 block device.");
+    if (!readOnly && !device.CanWrite)
+      throw new ArgumentException("Writable CBM DOS session requires a writable block device.", nameof(device));
+    if (!readOnly && !profile.CanMountWritable)
+      throw new NotSupportedException("This exact CBM DOS media profile is not safe for writable mounting.");
+
+    _device = device;
+    _ownsDevice = ownsDevice;
+    _readOnly = readOnly;
+    Profile = profile;
+    _image = ReadWholeImage(device);
+    IndexInitialNamespace();
+  }
+
+  public FilesystemDriverProfile Profile { get; }
+  public FilesystemNodeId RootNodeId { get; } = new(1, 1);
+
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      if (nodeId == RootNodeId)
+        return new FilesystemNodeInfo(RootNodeId, FilesystemNodeKind.Directory, 0, 0, 1);
+      if (!_states.TryGetValue(nodeId, out var state))
+        throw new FileNotFoundException($"CBM DOS node {nodeId.Value}:{nodeId.Generation} is unknown.");
+      if (!state.Linked)
+        return new FilesystemNodeInfo(nodeId, FilesystemNodeKind.RegularFile,
+          state.Data?.LongLength ?? 0, 0, 0, state.FileType);
+      var record = FindRecord(state.Name);
+      return new FilesystemNodeInfo(nodeId, FilesystemNodeKind.RegularFile,
+        state.Data?.LongLength ?? record.Size, record.SectorCount * (long)SectorSize,
+        1, state.FileType);
+    }
+  }
+
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) {
+    ArgumentNullException.ThrowIfNull(name);
+    lock (_gate) {
+      ThrowIfDisposed();
+      RequireRoot(parentDirectory);
+      return _idsByName.TryGetValue(name, out var nodeId) ? nodeId : null;
+    }
+  }
+
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      RequireRoot(directory);
+      return ScanDirectory(_image)
+        .Select(record => new FilesystemDirectoryEntry(
+          record.Name, _idsByName[record.Name], FilesystemNodeKind.RegularFile))
+        .ToArray();
+    }
+  }
+
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      if (nodeId == RootNodeId) throw new UnauthorizedAccessException("The CBM DOS root directory is not a regular file.");
+      if (access != FileAccess.Read && _readOnly)
+        throw new NotSupportedException("The CBM DOS session was opened read-only.");
+      var state = RequireLinkedState(nodeId);
+      if (access != FileAccess.Read && state.IsLocked)
+        throw new UnauthorizedAccessException($"CBM DOS entry '{state.Name}' is locked.");
+      state.Data ??= ReadFileData(_image, FindRecord(state.Name));
+      return new FileHandle(this, state, access);
+    }
+  }
+
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      EnsureWritable();
+      RequireRoot(parentDirectory);
+      ValidateName(name);
+      if (_idsByName.ContainsKey(name)) throw new IOException($"CBM DOS entry '{name}' already exists.");
+
+      ApplyStreamMutation(stream => D64Modifier.AddFile(stream, name, [], 0x82));
+      var nodeId = new FilesystemNodeId(_nextNodeId++, 1);
+      var canonicalName = FindRecord(name).Name;
+      var state = new NodeState(nodeId, canonicalName, 0x82) { Data = [] };
+      _states[nodeId] = state;
+      _idsByName[canonicalName] = nodeId;
+      return nodeId;
+    }
+  }
+
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name)
+    => throw new NotSupportedException("1541 CBM DOS 2.6 has a flat root directory and cannot create subdirectories.");
+
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      EnsureWritable();
+      RequireRoot(parentDirectory);
+      if (!_idsByName.TryGetValue(name, out var nodeId)) throw new FileNotFoundException(name);
+      var state = _states[nodeId];
+      EnsureUnlocked(state);
+      ApplyStreamMutation(stream => {
+        if (!D64Modifier.RemoveFile(stream, state.Name, wipeData: true))
+          throw new FileNotFoundException(state.Name);
+      });
+      _idsByName.Remove(state.Name);
+      state.Linked = false;
+      state.Dirty = false;
+    }
+  }
+
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name)
+    => throw new NotSupportedException("1541 CBM DOS 2.6 has no subdirectories.");
+
+  public void Rename(
+      FilesystemNodeId oldParent,
+      string oldName,
+      FilesystemNodeId newParent,
+      string newName,
+      bool replace) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      EnsureWritable();
+      RequireRoot(oldParent);
+      RequireRoot(newParent);
+      ValidateName(newName);
+      if (!_idsByName.TryGetValue(oldName, out var sourceId)) throw new FileNotFoundException(oldName);
+      var source = _states[sourceId];
+      EnsureUnlocked(source);
+
+      if (_idsByName.TryGetValue(newName, out var targetId) && targetId != sourceId) {
+        if (!replace) throw new IOException($"CBM DOS entry '{newName}' already exists.");
+        var target = _states[targetId];
+        EnsureUnlocked(target);
+        ApplyStreamMutation(stream => {
+          if (!D64Modifier.RemoveFile(stream, target.Name, wipeData: true))
+            throw new IOException($"Unable to replace existing CBM DOS entry '{newName}'.");
+        });
+        _idsByName.Remove(target.Name);
+        target.Linked = false;
+        target.Dirty = false;
+      }
+
+      var record = FindRecord(source.Name);
+      var renamed = _image.ToArray();
+      WriteDirectoryName(renamed, record.DirectoryEntryOffset, newName);
+      CommitChangedBlocks(renamed);
+      _idsByName.Remove(source.Name);
+      source.Name = NormalizeName(newName);
+      _idsByName[source.Name] = sourceId;
+    }
+  }
+
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)
+    => throw new NotSupportedException("1541 CBM DOS has no hard links.");
+
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)
+    => throw new NotSupportedException("1541 CBM DOS has no symbolic links.");
+
+  public string ReadSymbolicLink(FilesystemNodeId nodeId)
+    => throw new NotSupportedException("1541 CBM DOS has no symbolic links.");
+
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch)
+    => throw new NotSupportedException("The generic metadata patch has no lossless CBM DOS 2.6 mapping.");
+
+  public void Flush() {
+    NodeState[] dirty;
+    lock (_gate) {
+      ThrowIfDisposed();
+      dirty = _states.Values.Where(state => state.Linked && state.Dirty).ToArray();
+    }
+    foreach (var state in dirty) FlushState(state);
+    _device.Flush();
+  }
+
+  public IFilesystemTransaction BeginTransaction()
+    => throw new NotSupportedException("CBM DOS 2.6 has no crash-atomic journal/transaction primitive.");
+
+  public void Dispose() {
+    if (_disposed) return;
+    if (!_readOnly) Flush();
+    _disposed = true;
+    if (_ownsDevice) _device.Dispose();
+  }
+
+  private static byte[] ReadWholeImage(IRandomAccessBlockDevice device) {
+    var data = new byte[D64BlockDevice.DataLength];
+    var blocks = device.ReadBlocks(0, data);
+    if (blocks != D64BlockDevice.SectorCount)
+      throw new EndOfStreamException($"CBM DOS block device returned {blocks} sectors; expected {D64BlockDevice.SectorCount}.");
+    return data;
+  }
+
+  private void IndexInitialNamespace() {
+    foreach (var record in ScanDirectory(_image)) {
+      if (_idsByName.ContainsKey(record.Name))
+        throw new InvalidDataException($"CBM DOS directory contains duplicate name '{record.Name}'; mount would be ambiguous.");
+      var nodeId = new FilesystemNodeId(_nextNodeId++, 1);
+      _idsByName[record.Name] = nodeId;
+      _states[nodeId] = new NodeState(nodeId, record.Name, record.FileType);
+    }
+  }
+
+  private void FlushState(NodeState state) {
+    lock (_gate) {
+      ThrowIfDisposed();
+      if (!state.Linked || !state.Dirty || state.Data == null) return;
+      EnsureUnlocked(state);
+      var oldName = state.Name;
+      ApplyStreamMutation(stream => {
+        if (!D64Modifier.RemoveFile(stream, oldName, wipeData: false))
+          throw new IOException($"CBM DOS entry '{oldName}' disappeared while flushing an open handle.");
+        D64Modifier.AddFile(stream, oldName, state.Data, state.FileType);
+      });
+      state.Name = FindRecord(oldName).Name;
+      state.Dirty = false;
+      _idsByName.Remove(oldName);
+      _idsByName[state.Name] = state.NodeId;
+    }
+  }
+
+  private void ApplyStreamMutation(Action<Stream> mutate) {
+    var candidate = _image.ToArray();
+    using var stream = new MemoryStream(candidate, writable: true);
+    mutate(stream);
+    CommitChangedBlocks(candidate);
+  }
+
+  private void CommitChangedBlocks(byte[] candidate) {
+    if (candidate.Length != D64BlockDevice.DataLength)
+      throw new InvalidDataException("CBM DOS mutation changed the fixed D64 data geometry.");
+    for (var block = 0; block < D64BlockDevice.SectorCount; ++block) {
+      var offset = block * SectorSize;
+      var next = candidate.AsSpan(offset, SectorSize);
+      if (_image.AsSpan(offset, SectorSize).SequenceEqual(next)) continue;
+      _device.WriteBlocks(block, next);
+    }
+    _image = candidate;
+  }
+
+  private NodeState RequireLinkedState(FilesystemNodeId nodeId) {
+    if (!_states.TryGetValue(nodeId, out var state) || !state.Linked)
+      throw new FileNotFoundException($"CBM DOS node {nodeId.Value}:{nodeId.Generation} is not linked in this session.");
+    return state;
+  }
+
+  private DirectoryRecord FindRecord(string name)
+    => ScanDirectory(_image).FirstOrDefault(record => string.Equals(record.Name, name, StringComparison.OrdinalIgnoreCase))
+       ?? throw new FileNotFoundException(name);
+
+  private static IReadOnlyList<DirectoryRecord> ScanDirectory(byte[] image) {
+    var result = new List<DirectoryRecord>();
+    var track = DirectoryTrack;
+    var sector = DirectoryStartSector;
+    var visited = new HashSet<(int, int)>();
+    while (track != 0) {
+      if (!visited.Add((track, sector))) throw new InvalidDataException("CBM DOS directory chain contains a loop.");
+      var offset = SectorOffset(track, sector);
+      if (offset < 0 || offset + SectorSize > image.Length)
+        throw new InvalidDataException("CBM DOS directory points outside the 1541 geometry.");
+      var nextTrack = image[offset];
+      var nextSector = image[offset + 1];
+      for (var slot = 0; slot < 8; ++slot) {
+        var entryOffset = offset + slot * 32;
+        var fileType = image[entryOffset + 2];
+        if ((fileType & 0x07) == 0) continue;
+        var startTrack = image[entryOffset + 3];
+        var startSector = image[entryOffset + 4];
+        var name = DecodeName(image.AsSpan(entryOffset + 5, 16));
+        var chain = WalkChain(image, startTrack, startSector);
+        result.Add(new DirectoryRecord(
+          name,
+          fileType,
+          startTrack,
+          startSector,
+          BinaryPrimitives.ReadUInt16LittleEndian(image.AsSpan(entryOffset + 30, 2)),
+          CalculateSize(image, chain),
+          entryOffset));
+      }
+      if (nextTrack == 0) break;
+      track = nextTrack;
+      sector = nextSector;
+    }
+    return result;
+  }
+
+  private static List<(int Track, int Sector)> WalkChain(byte[] image, int track, int sector) {
+    var chain = new List<(int, int)>();
+    var visited = new HashSet<(int, int)>();
+    while (track != 0) {
+      if (!visited.Add((track, sector))) throw new InvalidDataException("CBM DOS file sector chain contains a loop.");
+      var offset = SectorOffset(track, sector);
+      if (offset < 0 || offset + SectorSize > image.Length)
+        throw new InvalidDataException("CBM DOS file sector chain points outside the 1541 geometry.");
+      chain.Add((track, sector));
+      var nextTrack = image[offset];
+      var nextSector = image[offset + 1];
+      track = nextTrack;
+      sector = nextSector;
+    }
+    return chain;
+  }
+
+  private static long CalculateSize(byte[] image, IReadOnlyList<(int Track, int Sector)> chain) {
+    if (chain.Count == 0) return 0;
+    var last = chain[^1];
+    var offset = SectorOffset(last.Track, last.Sector);
+    var used = image[offset + 1] > 1 ? image[offset + 1] - 1 : 254;
+    return (chain.Count - 1L) * 254 + used;
+  }
+
+  private static byte[] ReadFileData(byte[] image, DirectoryRecord record) {
+    var chain = WalkChain(image, record.StartTrack, record.StartSector);
+    if (chain.Count == 0) return [];
+    using var output = new MemoryStream((int)Math.Min(record.Size, int.MaxValue));
+    for (var i = 0; i < chain.Count; ++i) {
+      var item = chain[i];
+      var offset = SectorOffset(item.Track, item.Sector);
+      var count = i == chain.Count - 1
+        ? (image[offset + 1] > 1 ? image[offset + 1] - 1 : 254)
+        : 254;
+      output.Write(image, offset + 2, count);
+    }
+    return output.ToArray();
+  }
+
+  private static int SectorOffset(int track, int sector) {
+    if (track < 1 || track > TotalTracks || sector < 0 || sector >= SectorsPerTrack[track]) return -1;
+    var offset = 0;
+    for (var t = 1; t < track; ++t) offset += SectorsPerTrack[t] * SectorSize;
+    return offset + sector * SectorSize;
+  }
+
+  private static string DecodeName(ReadOnlySpan<byte> bytes) {
+    var end = bytes.IndexOf((byte)0xA0);
+    if (end < 0) end = bytes.Length;
+    return Encoding.ASCII.GetString(bytes[..end]);
+  }
+
+  private static string NormalizeName(string name) => name.ToUpperInvariant();
+
+  private static void WriteDirectoryName(byte[] image, int entryOffset, string name) {
+    var encoded = Encoding.ASCII.GetBytes(NormalizeName(name));
+    image.AsSpan(entryOffset + 5, 16).Fill(0xA0);
+    encoded.AsSpan(0, Math.Min(16, encoded.Length)).CopyTo(image.AsSpan(entryOffset + 5, 16));
+  }
+
+  private static void ValidateName(string name) {
+    ArgumentException.ThrowIfNullOrWhiteSpace(name);
+    if (name.Length > 16) throw new ArgumentException("CBM DOS names are limited to 16 characters.", nameof(name));
+    if (name.IndexOfAny(['/', '\\', '\0']) >= 0)
+      throw new ArgumentException("CBM DOS file names cannot contain path separators or NUL.", nameof(name));
+  }
+
+  private static void EnsureUnlocked(NodeState state) {
+    if (state.IsLocked) throw new UnauthorizedAccessException($"CBM DOS entry '{state.Name}' is locked.");
+  }
+
+  private void RequireRoot(FilesystemNodeId nodeId) {
+    if (nodeId != RootNodeId) throw new DirectoryNotFoundException("CBM DOS 2.6 has only the root directory.");
+  }
+
+  private void EnsureWritable() {
+    if (_readOnly) throw new NotSupportedException("The CBM DOS session was opened read-only.");
+  }
+
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+
+  private sealed class NodeState(FilesystemNodeId nodeId, string name, byte fileType) {
+    public FilesystemNodeId NodeId { get; } = nodeId;
+    public string Name { get; set; } = name;
+    public byte FileType { get; } = fileType;
+    public bool IsLocked => (FileType & 0x40) != 0;
+    public byte[]? Data { get; set; }
+    public bool Dirty { get; set; }
+    public bool Linked { get; set; } = true;
+  }
+
+  private sealed record DirectoryRecord(
+    string Name,
+    byte FileType,
+    byte StartTrack,
+    byte StartSector,
+    ushort SectorCount,
+    long Size,
+    int DirectoryEntryOffset
+  );
+
+  private sealed class FileHandle(D64FilesystemSession session, NodeState state, FileAccess access) : IFilesystemFileHandle {
+    private bool _disposed;
+
+    public FilesystemNodeId NodeId => state.NodeId;
+    public long Length {
+      get {
+        lock (session._gate) {
+          ThrowIfDisposed();
+          return state.Data?.LongLength ?? 0;
+        }
+      }
+    }
+
+    public int Read(long offset, Span<byte> destination) {
+      lock (session._gate) {
+        ThrowIfDisposed();
+        if (access == FileAccess.Write) throw new NotSupportedException("This handle was opened write-only.");
+        if (offset < 0) throw new ArgumentOutOfRangeException(nameof(offset));
+        var data = state.Data ?? [];
+        if (offset >= data.LongLength) return 0;
+        var count = (int)Math.Min(destination.Length, data.LongLength - offset);
+        data.AsSpan((int)offset, count).CopyTo(destination);
+        return count;
+      }
+    }
+
+    public void Write(long offset, ReadOnlySpan<byte> source) {
+      lock (session._gate) {
+        ThrowIfDisposed();
+        if (access == FileAccess.Read) throw new NotSupportedException("This handle was opened read-only.");
+        session.EnsureWritable();
+        EnsureUnlocked(state);
+        if (offset < 0 || offset > MaximumFileBytes) throw new ArgumentOutOfRangeException(nameof(offset));
+        var end = checked(offset + source.Length);
+        if (end > MaximumFileBytes) throw new IOException("CBM DOS file exceeds the maximum 1541 data capacity.");
+        var data = state.Data ?? [];
+        if (end > data.LongLength) Array.Resize(ref data, (int)end);
+        source.CopyTo(data.AsSpan((int)offset));
+        state.Data = data;
+        state.Dirty = true;
+      }
+    }
+
+    public void SetLength(long length) {
+      lock (session._gate) {
+        ThrowIfDisposed();
+        if (access == FileAccess.Read) throw new NotSupportedException("This handle was opened read-only.");
+        session.EnsureWritable();
+        EnsureUnlocked(state);
+        if (length < 0 || length > MaximumFileBytes) throw new ArgumentOutOfRangeException(nameof(length));
+        var data = state.Data ?? [];
+        Array.Resize(ref data, (int)length);
+        state.Data = data;
+        state.Dirty = true;
+      }
+    }
+
+    public void Flush() {
+      ThrowIfDisposed();
+      if (access != FileAccess.Read) session.FlushState(state);
+      session._device.Flush();
+    }
+
+    public void Dispose() {
+      if (_disposed) return;
+      if (access != FileAccess.Read && !session._disposed) Flush();
+      _disposed = true;
+    }
+
+    private void ThrowIfDisposed() {
+      ObjectDisposedException.ThrowIf(_disposed, this);
+      session.ThrowIfDisposed();
+    }
+  }
+}
diff --git a/FileSystems/FileSystem.D64/D64FormatDescriptor.cs b/FileSystems/FileSystem.D64/D64FormatDescriptor.cs
index 061fee800..cc246508e 100644
--- a/FileSystems/FileSystem.D64/D64FormatDescriptor.cs
+++ b/FileSystems/FileSystem.D64/D64FormatDescriptor.cs
@@ -13,16 +13,11 @@ namespace FileSystem.D64;
 ///   <item><description><c>https://en.wikipedia.org/wiki/Commodore_1541</c> — Wikipedia overview of the drive whose disks D64 images</description></item>
 /// </list>
 /// </summary>
-public sealed class D64FormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveCreatable, IArchiveWriteConstraints, IArchiveShrinkable, IArchiveModifiable, IArchiveDefragmentable, IFilesystemExtentMap, IFilesystemBlockMover, IWipeEmpty, IFormatOptionsSchema, ILayoutOptimizable {
+public sealed class D64FormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveCreatable,
+  IArchiveWriteConstraints, IArchiveShrinkable, IArchiveModifiable, IArchiveDefragmentable,
+  IFilesystemExtentMap, IFilesystemBlockMover, IWipeEmpty, IFormatOptionsSchema, ILayoutOptimizable,
+  IRandomAccessBlockDeviceProvider, IFilesystemDriverProvider {
 
-  // ── IFormatOptionsSchema ────────────────────────────────────────────────
-
-  /// <summary>
-  /// Tunable knobs for D64 creation. The Commodore 1541 stores a 16-char
-  /// PETSCII disk name plus a 2-char disk ID in the BAM (track 18 sector 0);
-  /// both are user-visible from the C64 directory listing. Disk geometry is
-  /// fixed at the single-sided 1541 size (174 848 bytes).
-  /// </summary>
   public IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; } = [
     FilesystemSchemaPresets.VolumeLabel(maxChars: 16),
     new FormatOptionDescriptor(
@@ -34,17 +29,9 @@ public sealed class D64FormatDescriptor : IFormatDescriptor, IArchiveFormatOpera
         "header (\"0 \"DISKNAME\" ID 2A\"). Padded with '0' if shorter, truncated if longer."),
   ];
 
-  /// <summary>
-  /// Walks the directory chain on track 18 and yields the actual on-disk
-  /// byte layout — track 18 (BAM + directory) as <see cref="DefragBlockKind.MetadataReserved"/>,
-  /// every per-file sector chain as one or more contiguous-run extents, and
-  /// the un-attributed sectors as <see cref="DefragBlockKind.Free"/>. Used by
-  /// the defragment window's block-map preview.
-  /// </summary>
   public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)
     => D64ExtentMap.Enumerate(image);
 
-  // D64 1541 geometry — zoned sectors per track (track 0 doesn't exist).
   private const int D64SectorSize = 256;
   private const int D64DirTrack = 18;
   private const int D64DirStartSector = 1;
@@ -64,23 +51,6 @@ private static int D64SectorOffset(int track, int sector) {
     return offset + sector * D64SectorSize;
   }
 
-  /// <summary>
-  /// Zeros all unused space in a D64 image: unallocated sectors and the
-  /// cluster-tip slack at the tail of each file's <em>last</em> sector. A D64
-  /// file is a linked chain of 256-byte sectors — each carries a 2-byte
-  /// next-track/next-sector link followed by up to 254 data bytes. The final
-  /// sector's link is <c>(0, used+1)</c>, so the bytes after the last used
-  /// data byte up to the sector boundary are slack. Those slack bytes are
-  /// zero-filled when <paramref name="wipeClusterTips"/> is set, while the
-  /// 2-byte link headers, live file data, and the track-18 BAM/directory are
-  /// preserved.
-  ///
-  /// <para>Because file content is interleaved with per-sector link bytes and
-  /// chains may be fragmented, the simple "offset + size" cluster-tip model of
-  /// the generic wiper does not apply; tip wiping is done here by walking each
-  /// chain to its final sector. Free-space wiping is delegated to the generic
-  /// wiper using the extent map.</para>
-  /// </summary>
   public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true) {
     ArgumentNullException.ThrowIfNull(image);
 
@@ -89,10 +59,8 @@ public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipe
     image.CopyTo(ms);
     var data = ms.GetBuffer();
     var length = (int)ms.Length;
-
     var totalWiped = 0L;
 
-    // 1. Wipe the tail slack of every file chain's final sector.
     if (wipeClusterTips && length >= 174848) {
       var t = D64DirTrack;
       var s = D64DirStartSector;
@@ -113,9 +81,6 @@ public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipe
       }
     }
 
-    // 2. Wipe free sectors via the generic wiper. Tips are handled above, so
-    //    disable the generic cluster-tip path (its offset+size model is wrong
-    //    for chained sectors).
     var msStream = new MemoryStream(data, 0, length, writable: true);
     msStream.Position = 0;
     var extents = D64ExtentMap.Enumerate(msStream);
@@ -123,7 +88,6 @@ public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipe
     totalWiped += UnusedSpaceWiper.Wipe(msStream, extents, length, wipeClusterTips: false, fileSizeLookup: null);
     msStream.Flush();
 
-    // Persist back to the caller's stream.
     image.Position = 0;
     image.Write(data, 0, length);
     image.SetLength(length);
@@ -131,11 +95,6 @@ public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipe
     return totalWiped;
   }
 
-  /// <summary>
-  /// Walks one file's sector chain to its final sector and zeros the slack
-  /// bytes between the last used data byte and the 256-byte sector boundary,
-  /// preserving the 2-byte link header. Returns bytes actually changed.
-  /// </summary>
   private static long WipeChainTail(byte[] data, int length, int startTrack, int startSector) {
     var t = startTrack;
     var s = startSector;
@@ -146,7 +105,6 @@ private static long WipeChainTail(byte[] data, int length, int startTrack, int s
       var nextTrack = data[off];
       var nextSector = data[off + 1];
       if (nextTrack == 0) {
-        // Final sector: nextSector = bytes used + 1, data starts at off+2.
         var bytesUsed = nextSector > 1 ? nextSector - 1 : 254;
         var tipStart = off + 2 + bytesUsed;
         var changed = 0L;
@@ -161,20 +119,18 @@ private static long WipeChainTail(byte[] data, int length, int startTrack, int s
     return 0;
   }
 
-  public long? MaxTotalArchiveSize => 174848;  // standard 1541 single-sided D64 image size
+  public long? MaxTotalArchiveSize => 174848;
   public string AcceptedInputsDescription =>
     "Commodore 1541 D64 disk; any file up to 174 848 bytes total (664 data sectors × 254 bytes).";
 
   public bool CanAccept(ArchiveInputInfo input, out string? reason) {
-    // C64 allows any filename internally; the PETSCII-to-ASCII mapping happens at write time.
     reason = null;
     return true;
   }
 
-  // D64 has only one canonical size. Shrink therefore rebuilds to the fixed 174848 bytes.
   public IReadOnlyList<long> CanonicalSizes => [174848];
   public void Shrink(Stream input, Stream output) =>
-    Compression.Registry.ArchiveShrinker.ShrinkViaRebuild(input, output, this, this, this.CanonicalSizes);
+    ArchiveShrinker.ShrinkViaRebuild(input, output, this, this, this.CanonicalSizes);
 
   public string Id => "D64";
   public string DisplayName => "D64";
@@ -183,28 +139,14 @@ public void Shrink(Stream input, Stream output) =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate | FormatCapabilities.CanModify |
     FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries;
 
-  /// <summary>
-  /// Adds (or replaces by name) files inside an existing D64 image.
-  /// Uses <see cref="D64Modifier"/> for true O(touched bytes) random-access
-  /// I/O — only the BAM (1 sector) + directory chain (≤19 sectors) + the
-  /// new file's data sectors (⌈len/254⌉ sectors) are read or written. The
-  /// 174 848-byte image isn't touched outside that.
-  /// </summary>
   public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
     foreach (var (name, data) in FilesOnly(inputs)) {
       var truncatedName = name.Length > 16 ? name[..16] : name;
-      // Replacement semantics: if the file exists, remove it first.
       D64Modifier.RemoveFile(archive, truncatedName, wipeData: true);
       D64Modifier.AddFile(archive, truncatedName, data);
     }
   }
 
-  /// <summary>
-  /// Removes the named entries from an existing D64 image. Uses
-  /// <see cref="D64Modifier"/> for O(touched bytes) random-access I/O —
-  /// walks the file chain, marks each sector free in the BAM, secure-wipes
-  /// data sectors, and clears the directory entry's file-type byte.
-  /// </summary>
   public void Remove(Stream archive, string[] entryNames) {
     foreach (var name in entryNames) {
       var truncatedName = name.Length > 16 ? name[..16] : name;
@@ -219,7 +161,77 @@ public void Remove(Stream archive, string[] entryNames) {
   public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored")];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
-  public string Description => "Commodore 64 1541 disk image";
+  public string Description => "Commodore 64 1541 disk image with mount-grade sector and CBM DOS namespace access";
+
+  public IRandomAccessBlockDevice OpenBlockDevice(Stream image, bool writable, bool leaveOpen = true)
+    => new D64BlockDevice(image, writable, leaveOpen);
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var limitations = new List<string> {
+      "CBM DOS 2.6 is a flat root namespace; subdirectories, hard links, symlinks and transactions are unavailable.",
+      "Node ids are stable for the lifetime of one mounted session but are not persistent across remounts.",
+      "Writable mounting supports ordinary closed SEQ/PRG/USR files; REL side-sector semantics are fail-closed.",
+    };
+    if (!image.CanRead || !image.CanSeek) {
+      limitations.Add("Mounting requires a readable, seekable image stream.");
+      return BuildProfile(false, false, limitations);
+    }
+
+    var saved = image.Position;
+    try {
+      if (image.Length < D64BlockDevice.DataLength) {
+        limitations.Add($"Image is {image.Length} bytes; a 35-track D64 needs at least {D64BlockDevice.DataLength} bytes.");
+        return BuildProfile(false, false, limitations);
+      }
+      image.Position = 0;
+      var data = new byte[D64BlockDevice.DataLength];
+      image.ReadExactly(data);
+      var validation = D64MountValidator.Validate(data);
+      limitations.AddRange(validation.Limitations);
+      return BuildProfile(validation.CanRead, validation.CanWrite && image.CanWrite, limitations);
+    } catch (Exception ex) when (ex is InvalidDataException or EndOfStreamException or IOException) {
+      limitations.Add(ex.Message);
+      return BuildProfile(false, false, limitations);
+    } finally {
+      image.Position = saved;
+    }
+  }
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(options);
+    var profile = ProbeFilesystem(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("D64 cannot be mounted: " + string.Join(" ", profile.Limitations));
+    if (!options.ReadOnly && !profile.CanMountWritable)
+      throw new NotSupportedException("D64 is not safe for writable mounting: " + string.Join(" ", profile.Limitations));
+    var device = new D64BlockDevice(image, writable: !options.ReadOnly, leaveOpen: options.LeaveOpen);
+    return new D64FilesystemSession(device, profile, options.ReadOnly, ownsDevice: true);
+  }
+
+  private static FilesystemDriverProfile BuildProfile(bool canMount, bool canWrite, IReadOnlyList<string> limitations) {
+    var capabilities = FilesystemDriverCapabilities.None;
+    if (canMount)
+      capabilities = FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.Flush;
+    if (canWrite)
+      capabilities |= FilesystemDriverCapabilities.WriteData |
+        FilesystemDriverCapabilities.Truncate |
+        FilesystemDriverCapabilities.CreateFile |
+        FilesystemDriverCapabilities.DeleteFile |
+        FilesystemDriverCapabilities.Rename;
+    return new FilesystemDriverProfile(
+      "D64",
+      "CBM DOS 2.6 / 1541",
+      capabilities,
+      canWrite ? FilesystemMutationModel.Direct : FilesystemMutationModel.None,
+      canMount,
+      canWrite,
+      limitations.Distinct().ToArray());
+  }
 
   public List<ArchiveEntryInfo> List(Stream stream, string? password) {
     var r = new D64Reader(stream);
@@ -236,14 +248,6 @@ public void Extract(Stream stream, string outputDir, string? password, string[]?
     }
   }
 
-  /// <summary>
-  /// Opens a single filesystem entry as a bounded read-only stream. The
-  /// reader produces the decoded file bytes by walking the entry's extent
-  /// or block chain; the matched bytes are wrapped in a
-  /// <see cref="Compression.Registry.Streaming.BoundedEntryStream"/> sized
-  /// to the entry's logical length so cluster/extent slack past the entry's
-  /// end is physically unreachable through this view.
-  /// </summary>
   public Stream OpenEntry(Stream archive, string entryName, string? password) {
     ArgumentNullException.ThrowIfNull(archive);
     ArgumentNullException.ThrowIfNull(entryName);
@@ -257,10 +261,9 @@ public Stream OpenEntry(Stream archive, string entryName, string? password) {
         new MemoryStream(bytes, writable: false), bytes.Length, leaveOpen: false);
     }
     return new Compression.Registry.Streaming.BoundedEntryStream(
-      new MemoryStream(System.Array.Empty<byte>(), writable: false), 0, leaveOpen: false);
+      new MemoryStream(Array.Empty<byte>(), writable: false), 0, leaveOpen: false);
   }
 
-  /// <summary>Native in-memory single-entry extraction routed through the bounded <see cref="OpenEntry"/>.</summary>
   public byte[] ExtractEntryToMemory(Stream archive, string entryName, string? password) {
     using var s = this.OpenEntry(archive, entryName, password);
     using var memoryStream = new MemoryStream();
@@ -279,24 +282,15 @@ public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, Format
     output.Write(w.Build(label, diskId));
   }
 
-  // ── IFilesystemBlockMover delegation ───────────────────────────────────
-
-  /// <inheritdoc />
   public void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)
     => new D64BlockMover().MoveExtent(image, srcOffset, dstOffset, length, zeroSource);
 
-  /// <inheritdoc />
   public void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)
     => new D64BlockMover().UpdateAllocationAfterMove(image, fileName, oldOffset, newOffset, length);
 
   public void Defragment(Stream archive)
     => this.Defragment(archive, new DefragOptions { Mode = DefragMode.ConsolidateAtStart });
 
-  /// <summary>
-  /// Mode-aware D64 defragmentor. Tries the planner-driven in-place path first
-  /// (using the planner + <see cref="D64BlockMover"/>), falling back to the
-  /// rebuild path on error or for <see cref="DefragMode.CarveHole"/>.
-  /// </summary>
   public void Defragment(Stream archive, DefragOptions options) {
     ArgumentNullException.ThrowIfNull(options);
     if (options.Mode is DefragMode.ConsolidateAtStart or DefragMode.ConsolidateAtEnd or DefragMode.FillHolesLazy or DefragMode.CarveHole) {
@@ -304,8 +298,6 @@ public void Defragment(Stream archive, DefragOptions options) {
         DefragmentWithPlanner(archive, options);
         return;
       } catch (Exception planFailure) {
-        // A silent fallback looks exactly like a successful in-place
-        // defragmentation from outside, so the reason is reported.
         options.OnProgress?.Invoke(new DefragProgressEvent(
           "fallback", 0, -1, -1, archive.Length, null,
           $"In-place planning declined ({planFailure.GetType().Name}: " +
@@ -334,15 +326,14 @@ private void DefragmentWithPlanner(Stream archive, DefragOptions options) {
     var imageData = snap.ToArray();
     var extents = D64ExtentMap.Enumerate(new MemoryStream(imageData)).ToList();
     var mover = new D64BlockMover();
-    var moves = Compression.Core.Layout.DefragPlanner.Plan(extents, 0, imageSize, 256, options.Profile, options.Mode, holeSize: options.HoleSize, holeAt: options.HoleAt);
+    var moves = DefragPlanner.Plan(extents, 0, imageSize, 256, options.Profile, options.Mode,
+      holeSize: options.HoleSize, holeAt: options.HoleAt);
     if (moves.Count == 0) return;
     DefragPlannerExecutor.Execute(archive, options, mover, moves, imageSize);
   }
 
-  /// <summary>The first line of a message, for a one-line progress note.</summary>
   private static string FirstLine(string message) {
     var end = message.IndexOf('\n');
     return end < 0 ? message : message[..end].TrimEnd('\r');
   }
-
 }
diff --git a/FileSystems/FileSystem.D64/D64MountValidator.cs b/FileSystems/FileSystem.D64/D64MountValidator.cs
new file mode 100644
index 000000000..df68f1b23
--- /dev/null
+++ b/FileSystems/FileSystem.D64/D64MountValidator.cs
@@ -0,0 +1,137 @@
+#pragma warning disable CS1591
+namespace FileSystem.D64;
+
+/// <summary>
+/// Strict mount-time validation for the subset of CBM DOS 2.6 that the
+/// namespace driver can mutate losslessly. Read-only parsing may accept more;
+/// writable mounting requires exact BAM ownership with no overlapping/orphaned
+/// sectors, closed files, and no REL side-sector semantics.
+/// </summary>
+public static class D64MountValidator {
+  private const int SectorSize = 256;
+  private const int TotalTracks = 35;
+  private const int DirectoryTrack = 18;
+  private const int BamSector = 0;
+  private const int DirectoryStartSector = 1;
+  private static readonly int[] SectorsPerTrack = [
+    0,
+    21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21,
+    19, 19, 19, 19, 19, 19, 19,
+    18, 18, 18, 18, 18, 18,
+    17, 17, 17, 17, 17,
+  ];
+
+  public sealed record ValidationResult(bool CanRead, bool CanWrite, IReadOnlyList<string> Limitations);
+
+  public static ValidationResult Validate(ReadOnlySpan<byte> image) {
+    var limitations = new List<string>();
+    if (image.Length < D64BlockDevice.DataLength)
+      return new ValidationResult(false, false, ["Image is shorter than the 35-track D64 data area."]);
+
+    var used = new HashSet<(int Track, int Sector)> { (DirectoryTrack, BamSector) };
+    var names = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+    var writable = true;
+
+    try {
+      var track = DirectoryTrack;
+      var sector = DirectoryStartSector;
+      var visitedDirectory = new HashSet<(int, int)>();
+      while (track != 0) {
+        ValidateSector(track, sector);
+        if (!visitedDirectory.Add((track, sector)))
+          throw new InvalidDataException("Directory chain contains a loop.");
+        if (!used.Add((track, sector)))
+          throw new InvalidDataException("Directory sector overlaps another live object.");
+        var offset = SectorOffset(track, sector);
+
+        for (var slot = 0; slot < 8; ++slot) {
+          var entry = offset + slot * 32;
+          var fileType = image[entry + 2];
+          var baseType = fileType & 0x07;
+          if (baseType == 0) continue;
+          if (baseType > 4) {
+            writable = false;
+            limitations.Add($"Directory entry {slot} has unsupported CBM DOS file type {baseType}.");
+          }
+          if (baseType == 4) {
+            writable = false;
+            limitations.Add("REL files use side-sector metadata that the writable session does not yet model.");
+          }
+          if ((fileType & 0x80) == 0) {
+            writable = false;
+            limitations.Add("An unclosed/splat file is present; writable mounting is refused until recovery semantics are modeled.");
+          }
+
+          var name = DecodeName(image.Slice(entry + 5, 16));
+          if (!names.Add(name))
+            throw new InvalidDataException($"Duplicate directory name '{name}' makes lookup ambiguous.");
+
+          var fileTrack = image[entry + 3];
+          var fileSector = image[entry + 4];
+          var visitedFile = new HashSet<(int, int)>();
+          while (fileTrack != 0) {
+            ValidateSector(fileTrack, fileSector);
+            if (fileTrack == DirectoryTrack) {
+              writable = false;
+              limitations.Add($"File '{name}' allocates track 18, which the current allocator reserves for BAM/directory metadata.");
+            }
+            if (!visitedFile.Add((fileTrack, fileSector)))
+              throw new InvalidDataException($"File '{name}' contains a sector-chain loop.");
+            if (!used.Add((fileTrack, fileSector)))
+              throw new InvalidDataException($"File '{name}' overlaps another live sector.");
+            var fileOffset = SectorOffset(fileTrack, fileSector);
+            fileTrack = image[fileOffset];
+            fileSector = image[fileOffset + 1];
+          }
+        }
+
+        var nextTrack = image[offset];
+        var nextSector = image[offset + 1];
+        if (nextTrack == 0) break;
+        track = nextTrack;
+        sector = nextSector;
+      }
+
+      var bamOffset = SectorOffset(DirectoryTrack, BamSector);
+      for (var t = 1; t <= TotalTracks; ++t) {
+        var entry = bamOffset + 4 + (t - 1) * 4;
+        var freeCount = 0;
+        for (var s = 0; s < SectorsPerTrack[t]; ++s) {
+          var isFree = (image[entry + 1 + s / 8] & (1 << (s & 7))) != 0;
+          if (isFree) freeCount++;
+          var shouldBeFree = !used.Contains((t, s));
+          if (isFree != shouldBeFree) {
+            writable = false;
+            limitations.Add(
+              $"BAM ownership mismatch at track {t}, sector {s} (BAM says {(isFree ? "free" : "allocated")}, namespace says {(shouldBeFree ? "free" : "used")}).");
+          }
+        }
+        if (image[entry] != freeCount) {
+          writable = false;
+          limitations.Add($"BAM free-count mismatch on track {t}: header={image[entry]}, bitmap={freeCount}.");
+        }
+      }
+    } catch (Exception ex) when (ex is InvalidDataException or ArgumentOutOfRangeException) {
+      return new ValidationResult(false, false, [ex.Message]);
+    }
+
+    return new ValidationResult(true, writable, limitations.Distinct().ToArray());
+  }
+
+  private static void ValidateSector(int track, int sector) {
+    if (track < 1 || track > TotalTracks || sector < 0 || sector >= SectorsPerTrack[track])
+      throw new InvalidDataException($"Invalid 1541 track/sector link {track}/{sector}.");
+  }
+
+  private static int SectorOffset(int track, int sector) {
+    var offset = 0;
+    for (var t = 1; t < track; ++t) offset += SectorsPerTrack[t] * SectorSize;
+    return offset + sector * SectorSize;
+  }
+
+  private static string DecodeName(ReadOnlySpan<byte> bytes) {
+    var end = bytes.IndexOf((byte)0xA0);
+    if (end < 0) end = bytes.Length;
+    return System.Text.Encoding.ASCII.GetString(bytes[..end]);
+  }
+}
diff --git a/FileSystems/FileSystem.Erofs/ErofsFormatDescriptor.cs b/FileSystems/FileSystem.Erofs/ErofsFormatDescriptor.cs
index 4cc4e28ab..25b88b963 100644
--- a/FileSystems/FileSystem.Erofs/ErofsFormatDescriptor.cs
+++ b/FileSystems/FileSystem.Erofs/ErofsFormatDescriptor.cs
@@ -4,29 +4,25 @@
 namespace FileSystem.Erofs;
 
 /// <summary>
-/// Descriptor for EROFS images. Reading covers the uncompressed + inline inode layouts;
-/// creation produces a minimal uncompressed (FLAT_PLAIN) image via <see cref="ErofsWriter"/>.
-/// Full-fidelity, compressed images remain the job of <c>mkfs.erofs</c>; our writer targets
-/// the round-trippable WORM subset (compact inodes, plain data, nested directories).
+/// Offline R/W descriptor for EROFS images. Reading covers the uncompressed
+/// FLAT_PLAIN/FLAT_INLINE inode layouts; creation emits the same conservative,
+/// round-trippable subset through <see cref="ErofsWriter"/>. Linux mounts EROFS
+/// read-only by design, but an existing supported-profile image can be edited by
+/// verified rebuild. Compressed inode layouts remain readable as metadata only
+/// until their data decoder/writer is implemented and are therefore rejected by
+/// mutation rather than silently rewritten as placeholders.
 ///
 /// References:
 /// <list type="bullet">
-///   <item><description><c>https://docs.kernel.org/filesystems/erofs.html</c> — Linux kernel EROFS documentation (on-disk overview)</description></item>
-///   <item><description><c>https://github.com/torvalds/linux/tree/master/fs/erofs</c> — mainline implementation (<c>erofs_fs.h</c> defines the on-disk structures)</description></item>
-///   <item><description><c>https://en.wikipedia.org/wiki/EROFS</c> — Wikipedia overview</description></item>
+///   <item><description><c>https://docs.kernel.org/filesystems/erofs.html</c> — Linux kernel EROFS documentation</description></item>
+///   <item><description><c>https://github.com/torvalds/linux/tree/master/fs/erofs</c> — mainline implementation (<c>erofs_fs.h</c>)</description></item>
+///   <item><description><c>https://en.wikipedia.org/wiki/EROFS</c> — overview</description></item>
 /// </list>
 /// </summary>
-public sealed class ErofsFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveShrinkable, IArchiveModifiable, IArchiveDefragmentable, IArchiveCreatable, IFormatOptionsSchema, ILayoutOptimizable , IFilesystemExtentMap, IWipeEmpty {
+public sealed class ErofsFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations,
+  IArchiveShrinkable, IArchiveModifiable, IArchiveDefragmentable, IArchiveCreatable,
+  IFormatOptionsSchema, ILayoutOptimizable, IFilesystemExtentMap, IWipeEmpty {
 
-  // ── IFormatOptionsSchema ────────────────────────────────────────────────
-
-  /// <summary>
-  /// The one tunable the uncompressed writer honours: the volume label written
-  /// into the superblock <c>volume_name</c> field (16 bytes) via
-  /// <see cref="ErofsWriter.VolumeName"/> and read back as
-  /// <c>ErofsReader.VolumeName</c>. The 4&#160;KB block size is fixed by the
-  /// FLAT_PLAIN/FLAT_INLINE layout, so it is not exposed.
-  /// </summary>
   public IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; } = [
     FilesystemSchemaPresets.VolumeLabel(maxChars: 16),
   ];
@@ -36,20 +32,19 @@ public sealed class ErofsFormatDescriptor : IFormatDescriptor, IArchiveFormatOpe
   public FormatCategory Category => FormatCategory.Archive;
   public FormatCapabilities Capabilities =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate |
-    FormatCapabilities.CanTest |
+    FormatCapabilities.CanModify | FormatCapabilities.CanTest |
     FormatCapabilities.SupportsMultipleEntries | FormatCapabilities.SupportsDirectories;
   public string DefaultExtension => ".erofs";
   public IReadOnlyList<string> Extensions => [".erofs", ".img"];
   public IReadOnlyList<string> CompoundExtensions => [];
   public IReadOnlyList<MagicSignature> MagicSignatures => [
-    // Magic sits at offset 1024 (start of superblock). Value is 0xE0F5E1E2 stored
-    // little-endian, so the on-disk byte sequence is E2 E1 F5 E0.
     new([0xE2, 0xE1, 0xF5, 0xE0], Offset: 1024, Confidence: 0.95),
   ];
-  public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored")];
+  public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored / flat inode")];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
-  public string Description => "Android read-only compressed filesystem; uncompressed + inline inode layouts.";
+  public string Description =>
+    "Android/Linux read-only-on-mount filesystem; FLAT_PLAIN/FLAT_INLINE profile supports offline R/W and maintenance.";
 
   public List<ArchiveEntryInfo> List(Stream stream, string? password) {
     var reader = OpenReader(stream);
@@ -61,7 +56,7 @@ public List<ArchiveEntryInfo> List(Stream stream, string? password) {
         Name: e.Path,
         OriginalSize: e.Size,
         CompressedSize: e.Size,
-        Method: "stored",
+        Method: "stored/erofs",
         IsDirectory: e.IsDirectory,
         IsEncrypted: false,
         LastModified: null,
@@ -81,19 +76,13 @@ public void Extract(Stream stream, string outputDir, string? password, string[]?
         var data = reader.ExtractFile(e);
         FormatHelpers.WriteFile(outputDir, e.Path, data);
       } catch (NotSupportedException) {
-        // Compressed-inode entry we can't decode yet; write an empty placeholder so
-        // the user sees it exists but the content is unavailable.
+        // Browsing remains useful for unsupported compressed profiles. Mutation
+        // never uses this lossy path; it goes through ReadWritableEntries below.
         FormatHelpers.WriteFile(outputDir, e.Path + ".compressed-unsupported", []);
       }
     }
   }
 
-  /// <summary>
-  /// Opens a single EROFS file as a bounded read-only stream. The reader
-  /// produces the decoded file bytes; the matched bytes are wrapped in a
-  /// <see cref="Compression.Registry.Streaming.BoundedEntryStream"/> sized
-  /// to the entry's logical length.
-  /// </summary>
   public Stream OpenEntry(Stream archive, string entryName, string? password) {
     ArgumentNullException.ThrowIfNull(archive);
     ArgumentNullException.ThrowIfNull(entryName);
@@ -102,80 +91,83 @@ public Stream OpenEntry(Stream archive, string entryName, string? password) {
     foreach (var e in reader.Entries) {
       if (e.IsDirectory) continue;
       if (!string.Equals(e.Path, entryName, StringComparison.OrdinalIgnoreCase)) continue;
-      byte[] bytes;
-      try { bytes = reader.ExtractFile(e); }
-      catch (NotSupportedException) { bytes = System.Array.Empty<byte>(); }
+      var bytes = reader.ExtractFile(e);
       return new Compression.Registry.Streaming.BoundedEntryStream(
         new MemoryStream(bytes, writable: false), bytes.Length, leaveOpen: false);
     }
     return new Compression.Registry.Streaming.BoundedEntryStream(
-      new MemoryStream(System.Array.Empty<byte>(), writable: false), 0, leaveOpen: false);
+      new MemoryStream(Array.Empty<byte>(), writable: false), 0, leaveOpen: false);
   }
 
-  /// <summary>Native in-memory single-entry extraction routed through the bounded <see cref="OpenEntry"/>.</summary>
   public byte[] ExtractEntryToMemory(Stream archive, string entryName, string? password) {
     using var s = this.OpenEntry(archive, entryName, password);
-    using var memoryStream = new MemoryStream();
-    s.CopyTo(memoryStream);
-    return memoryStream.ToArray();
+    using var memory = new MemoryStream();
+    s.CopyTo(memory);
+    return memory.ToArray();
   }
 
   public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
-    var writer = new ErofsWriter();
+    ArgumentNullException.ThrowIfNull(output);
+    ArgumentNullException.ThrowIfNull(inputs);
     var label = options?.GetOption("VolumeLabel", "") ?? "";
-    if (!string.IsNullOrEmpty(label))
-      writer.VolumeName = label;
-    foreach (var i in inputs) {
-      if (i.IsDirectory) continue;
-      var info = i;
-      // Only the length is needed to lay the image out; reading a large input
-      // into a byte[] would cap it at what an array can hold.
-      if (info.InMemoryContent is { } bytes)
-        writer.AddFile(info.ArchiveName, bytes);
-      else
-        writer.AddStreamingFile(info.ArchiveName, new FileInfo(info.FullPath).Length,
-                                () => File.OpenRead(info.FullPath));
-    }
-    writer.WriteTo(output);
+    BuildWriter(inputs, label).WriteTo(output);
+  }
+
+  /// <summary>
+  /// Existing-image edit for the writer-compatible EROFS subset. Every live file
+  /// is decoded before the rebuild starts; compressed layouts and symlinks are
+  /// rejected up front so no placeholder or type-changing rewrite can occur.
+  /// The volume label survives the rebuild.
+  /// </summary>
+  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
+    ArgumentNullException.ThrowIfNull(archive);
+    ArgumentNullException.ThrowIfNull(inputs);
+    var label = ReadVolumeName(archive);
+    archive.Position = 0;
+    ModifyRebuilder.Add(archive, inputs,
+      readEntries: ReadWritableEntries,
+      buildImage: files => BuildImage(files, label));
+  }
+
+  public void Remove(Stream archive, string[] entryNames) {
+    ArgumentNullException.ThrowIfNull(archive);
+    ArgumentNullException.ThrowIfNull(entryNames);
+    var label = ReadVolumeName(archive);
+    archive.Position = 0;
+    ModifyRebuilder.Remove(archive, entryNames,
+      readEntries: ReadWritableEntries,
+      buildImage: files => BuildImage(files, label));
   }
 
   private static ErofsReader OpenReader(Stream stream) {
-    // Straight from the stream: copying the image into a byte[] capped the
-    // reader at the array limit, which EROFS's block addresses do not.
     if (stream.CanSeek) return new ErofsReader(stream);
     using var ms = new MemoryStream();
     stream.CopyTo(ms);
     return new ErofsReader(ms.ToArray());
   }
 
-  // ── IArchiveDefragmentable ─────────────────────────────────────────────
-
   public void Defragment(Stream archive)
     => this.Defragment(archive, new DefragOptions { Mode = DefragMode.ConsolidateAtStart });
 
-  /// <summary>
-  /// Lays the image out again. Moving what is out of place beats writing the
-  /// image out anew: EROFS lays a file's blocks out contiguously from the raw
-  /// block address in its inode, so a move is the copy plus four bytes. The
-  /// default this replaces offered start-packing only, through a rebuild.
-  /// </summary>
   public void Defragment(Stream archive, DefragOptions options) {
     ArgumentNullException.ThrowIfNull(archive);
     ArgumentNullException.ThrowIfNull(options);
 
-    // The in-place pass is kept only if every payload still reads back: it can
-    // refuse partway — a file laid out in a way the inode does not describe as
-    // one run has nothing here to repoint — and a rebuild is the honest answer
-    // when it does.
+    var label = ReadVolumeName(archive);
+    archive.Position = 0;
+    // Validate the whole writable profile before any in-place attempt. In
+    // particular this refuses compressed inode layouts rather than letting a
+    // fallback rebuild discover them after bytes have moved.
+    _ = ReadWritableEntries(archive).ToList();
+    archive.Position = 0;
+
     DefragContentGuard.RunOrRebuild(archive,
-      readContents: stream => ReadEntries(stream).Select(e => e.Data).ToList(),
+      readContents: stream => ReadWritableEntries(stream).Select(e => e.Data).ToList(),
       inPlace: () => this.DefragmentWithPlanner(archive, options),
       rebuild: () => DefragRebuilder.Rebuild(archive, options,
-        readEntries: stream => ReadEntries(stream).ToList(),
+        readEntries: stream => ReadWritableEntries(stream).ToList(),
         buildImage: files => {
-          var writer = new ErofsWriter();
-          foreach (var (name, data) in files) writer.AddFile(name, data);
-          var built = writer.Build();
+          var built = BuildImage(files, label);
           if (built.Length >= archive.Length) return built;
           var padded = new byte[archive.Length];
           Array.Copy(built, padded, built.Length);
@@ -183,7 +175,6 @@ public void Defragment(Stream archive, DefragOptions options) {
         }));
   }
 
-  /// <summary>Plans the moves the layout needs and commits them in place.</summary>
   private void DefragmentWithPlanner(Stream archive, DefragOptions options) {
     archive.Position = 0;
     var mover = new ErofsBlockMover();
@@ -191,7 +182,7 @@ private void DefragmentWithPlanner(Stream archive, DefragOptions options) {
 
     var extents = this.EnumerateExtents(archive).ToList();
     options.OnProgress?.Invoke(new DefragProgressEvent(
-      "scanning", 0, 0, -1, archive.Length, extents, "Analysing layout"));
+      "scanning", 0, 0, -1, archive.Length, extents, "Analysing EROFS flat-layout extents"));
 
     var moves = Compression.Core.Layout.DefragPlanner.Plan(
       extents, mover.FirstDataByte, archive.Length, mover.BlockSize,
@@ -209,23 +200,58 @@ private void DefragmentWithPlanner(Stream archive, DefragOptions options) {
     archive.Position = 0;
     var postExtents = this.EnumerateExtents(archive).ToList();
     options.OnProgress?.Invoke(new DefragProgressEvent(
-      "complete", 1, -1, -1, archive.Length, postExtents, "Defragmentation complete"));
+      "complete", 1, -1, -1, archive.Length, postExtents, "EROFS defragmentation complete"));
   }
 
-  /// <summary>Every file's name and bytes, for the rebuild and the guard.</summary>
-  private static List<(string Name, byte[] Data)> ReadEntries(Stream stream) {
-    stream.Position = 0;
+  private static IEnumerable<(string Name, byte[] Data)> ReadWritableEntries(Stream stream) {
+    if (stream.CanSeek) stream.Position = 0;
     var reader = new ErofsReader(stream);
-    return reader.Entries.Where(e => !e.IsDirectory)
-                         .Select(e => (e.Path, reader.ExtractFile(e))).ToList();
+    foreach (var entry in reader.Entries) {
+      if (entry.IsDirectory) continue;
+      if (entry.IsSymlink)
+        throw new NotSupportedException(
+          $"EROFS mutation refuses symlink '{entry.Path}' until the writer can preserve symlink inode semantics.");
+      byte[] data;
+      try {
+        data = reader.ExtractFile(entry);
+      } catch (NotSupportedException ex) {
+        throw new NotSupportedException(
+          $"EROFS mutation requires FLAT_PLAIN/FLAT_INLINE data; '{entry.Path}' uses an unsupported compressed layout.", ex);
+      }
+      yield return (entry.Path, data);
+    }
   }
 
-  // ── IFilesystemExtentMap / IWipeEmpty ──────────────────────────────────
+  private static string ReadVolumeName(Stream archive) {
+    if (archive.CanSeek) archive.Position = 0;
+    return new ErofsReader(archive).VolumeName;
+  }
+
+  private static ErofsWriter BuildWriter(IReadOnlyList<ArchiveInputInfo> inputs, string label) {
+    var writer = new ErofsWriter { VolumeName = label };
+    foreach (var input in inputs) {
+      if (input.IsDirectory) continue;
+      if (input.InMemoryContent is { } bytes)
+        writer.AddFile(input.ArchiveName, bytes);
+      else
+        writer.AddStreamingFile(input.ArchiveName, new FileInfo(input.FullPath).Length,
+          () => File.OpenRead(input.FullPath));
+    }
+    return writer;
+  }
+
+  private static byte[] BuildImage(IReadOnlyList<(string Name, byte[] Data)> files, string label) {
+    var writer = new ErofsWriter { VolumeName = label };
+    foreach (var (name, data) in files) writer.AddFile(name, data);
+    return writer.Build();
+  }
 
   /// <summary>
-  /// The superblock, inode and directory region is structure; each file's full
-  /// blocks are the run its inode addresses. A short file whose tail is stored
-  /// inline with its inode has no run of its own, and needs none.
+  /// Conservative physical extent map. Flat file runs are marked Used. Every
+  /// byte not proven to belong to one of those runs is structural/reserved —
+  /// EROFS has no allocator bitmap from which this implementation can prove an
+  /// arbitrary hole is reusable. This deliberately sacrifices generic free-gap
+  /// wiping for correctness on externally-produced images.
   /// </summary>
   public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image) {
     ArgumentNullException.ThrowIfNull(image);
@@ -233,31 +259,42 @@ public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image) {
     try {
       if (image.CanSeek) image.Position = 0;
       var reader = new ErofsReader(image);
-      var first = long.MaxValue;
-      foreach (var e in reader.Entries) {
-        if (!reader.TryGetDataExtent(e, out var offset, out var length)) continue;
-        result.Add(new DefragBlockInfo(offset, length, DefragBlockKind.Used, e.Path));
-        first = Math.Min(first, offset);
+      var owned = new List<(long Start, long End, string Name)>();
+      foreach (var entry in reader.Entries) {
+        if (!reader.TryGetDataExtent(entry, out var offset, out var length)) continue;
+        if (offset < 0 || length <= 0 || offset + length > image.Length) continue;
+        owned.Add((offset, offset + length, entry.Path));
       }
-      if (first == long.MaxValue) first = image.Length;
-      result.Add(new DefragBlockInfo(0, first, DefragBlockKind.MetadataReserved));
+      owned.Sort((a, b) => a.Start.CompareTo(b.Start));
+
+      var cursor = 0L;
+      foreach (var run in owned) {
+        if (run.Start > cursor)
+          result.Add(new DefragBlockInfo(cursor, run.Start - cursor,
+            DefragBlockKind.MetadataReserved, "$EROFS/metadata-or-unproven"));
+        result.Add(new DefragBlockInfo(run.Start, run.End - run.Start,
+          DefragBlockKind.Used, run.Name));
+        cursor = Math.Max(cursor, run.End);
+      }
+      if (cursor < image.Length)
+        result.Add(new DefragBlockInfo(cursor, image.Length - cursor,
+          DefragBlockKind.MetadataReserved, "$EROFS/metadata-or-unproven"));
+      if (result.Count == 0 && image.Length > 0)
+        result.Add(new DefragBlockInfo(0, image.Length, DefragBlockKind.MetadataReserved,
+          "$EROFS/unproven"));
     } catch {
-      // An image we cannot walk claims nothing; wiping it would zero live data.
       return [];
     }
     return result;
   }
 
-  /// <inheritdoc />
+  /// <summary>
+  /// No byte is considered wipeable without allocator evidence. The extent map
+  /// intentionally reserves every unproven region, so this currently returns 0
+  /// for valid EROFS images rather than risking metadata damage.
+  /// </summary>
   public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true) {
     ArgumentNullException.ThrowIfNull(image);
-    var extents = this.EnumerateExtents(image).ToList();
-    if (extents.Count == 0) return 0;
-    // A file's last block is shared with nothing, but its slack belongs to the
-    // file's own run; trimming it would need the size of the run, not the file.
-    image.Position = 0;
-    return UnusedSpaceWiper.Wipe(image, extents, image.Length,
-      wipeClusterTips: false, fileSizeLookup: null);
+    return 0;
   }
-
 }
diff --git a/FileSystems/FileSystem.Ext/ExtFilesystemDriverAdapter.cs b/FileSystems/FileSystem.Ext/ExtFilesystemDriverAdapter.cs
new file mode 100644
index 000000000..dfa2328f3
--- /dev/null
+++ b/FileSystems/FileSystem.Ext/ExtFilesystemDriverAdapter.cs
@@ -0,0 +1,463 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using Compression.Registry;
+
+namespace FileSystem.Ext;
+
+/// <summary>
+/// Native ext2/3/4 driver sidecar. Inode numbers + i_generation form stable node
+/// identities and hard-linked directory entries converge on the same node. File
+/// content is streamed by the existing native inode/extent walker into a bounded
+/// positional spool until the reader exposes its extent map directly.
+/// </summary>
+public sealed class ExtFilesystemDriverAdapter :
+  IFilesystemDriverAdapter,
+  IBlockDeviceFilesystemDriverProvider {
+
+  public string FormatId => "Ext";
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var original = image.CanSeek ? image.Position : 0;
+    try {
+      var super = ExtDriverSuperblock.Parse(image);
+      super.ValidateReadableProfile(image);
+      using var reader = new ExtReader(image, leaveOpen: true);
+      var entries = reader.Entries.ToArray();
+      ValidateEntries(image, super, entries);
+
+      return new FilesystemDriverProfile(
+        FormatId,
+        super.ProfileName,
+        FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.CaseSensitiveNames |
+        FilesystemDriverCapabilities.CasePreservingNames,
+        FilesystemMutationModel.None,
+        CanMount: true,
+        CanMountWritable: false,
+        [
+          "Native inode+i_generation identities and hard-link aliasing are preserved.",
+          "File handles currently spool the native streaming inode/extent reader to obtain positional frontend I/O; direct logical-block mapping is the next read-path optimization.",
+          "Dirty journal-recovery profiles and incompatible data-layout features are rejected rather than exposing stale or undecoded contents.",
+          "Mounted writes remain disabled until nested namespace mutation, journal transactions/replay and complete extent/htree/xattr ownership semantics are available.",
+        ]);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException or OverflowException) {
+      return new FilesystemDriverProfile(
+        FormatId,
+        "unsupported or damaged ext profile",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [FirstLine(e.Message)]);
+    } finally {
+      if (image.CanSeek) image.Position = original;
+    }
+  }
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(options);
+    if (!options.ReadOnly)
+      throw new NotSupportedException(
+        "ext mounted writes are fail-closed until JBD/JBD2 publication/replay and complete nested namespace/extent mutation are implemented.");
+    var profile = ProbeFilesystem(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("ext image is not mountable: " + string.Join("; ", profile.Limitations));
+    return new ExtReadOnlyFilesystemSession(image, profile, options.LeaveOpen);
+  }
+
+  public FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device) {
+    using var stream = new BlockDeviceStream(device, leaveOpen: true);
+    return ProbeFilesystem(stream);
+  }
+
+  public IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options) {
+    var stream = new BlockDeviceStream(device, leaveOpen: false);
+    try {
+      return OpenFilesystem(stream, options with { LeaveOpen = false });
+    } catch {
+      stream.Dispose();
+      throw;
+    }
+  }
+
+  public FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(
+      Stream image,
+      FilesystemDriverTarget target) {
+    var profile = ProbeFilesystem(image);
+    var readRequired =
+      FilesystemDriverReadinessLayer.ImageValidation |
+      FilesystemDriverReadinessLayer.Namespace |
+      FilesystemDriverReadinessLayer.SessionStableNodeIds |
+      FilesystemDriverReadinessLayer.ReadData |
+      FilesystemDriverReadinessLayer.RandomAccessRead;
+    var writeRequired = readRequired |
+      FilesystemDriverReadinessLayer.AllocationMap |
+      FilesystemDriverReadinessLayer.WriteData |
+      FilesystemDriverReadinessLayer.Truncate |
+      FilesystemDriverReadinessLayer.NamespaceMutation |
+      FilesystemDriverReadinessLayer.MetadataMutation |
+      FilesystemDriverReadinessLayer.Links |
+      FilesystemDriverReadinessLayer.Flush |
+      FilesystemDriverReadinessLayer.DurabilityModel |
+      FilesystemDriverReadinessLayer.Recovery |
+      FilesystemDriverReadinessLayer.Concurrency;
+
+    var available = profile.CanMount
+      ? readRequired |
+        FilesystemDriverReadinessLayer.NativeStableNodeIds |
+        FilesystemDriverReadinessLayer.AllocationMap
+      : FilesystemDriverReadinessLayer.None;
+    var blockers = new List<string>(profile.Limitations);
+    if (target == FilesystemDriverTarget.ReadWrite) {
+      blockers.Add("Move ExtModifier/ExtRemover operations behind IRandomAccessBlockDevice and remove root-only / rebuild fallbacks from the mounted path.");
+      blockers.Add("Implement arbitrary-directory create/mkdir/unlink/rmdir/rename/link/symlink with htree split/update and inode link-count/orphan handling.");
+      blockers.Add("Implement positional write/truncate for direct/indirect and extent-tree files, including sparse/unwritten extents, extent-tree growth/merge and delayed allocation rules.");
+      blockers.Add("Implement JBD/JBD2 transaction emission, revoke handling, barriers/checkpoint ordering and journal replay before enabling ext3/ext4 writable mounts.");
+      blockers.Add("Complete xattr/ACL/quota/project-ID/encryption/verity/inline-data semantics or reject each profile before mutation.");
+      blockers.Add("Add inode/dentry/page-cache locking semantics plus crash fault-injection and e2fsck/debugfs interoperability corpus.");
+    }
+    var required = target == FilesystemDriverTarget.ReadOnly ? readRequired : writeRequired;
+    return new FilesystemDriverReadinessReport(
+      FormatId,
+      target,
+      available,
+      required,
+      profile.CanMount && (available & required) == required,
+      UsesNativeProvider: true,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static void ValidateEntries(
+      Stream image,
+      ExtDriverSuperblock super,
+      IReadOnlyList<ExtEntry> entries) {
+    var byInode = new Dictionary<uint, ExtDriverInode>();
+    foreach (var entry in entries) {
+      if (entry.Inode == 0) throw new InvalidDataException($"ext entry '{entry.Name}' has inode 0.");
+      if (!byInode.TryGetValue(entry.Inode, out var inode))
+        byInode[entry.Inode] = inode = super.ReadInode(image, entry.Inode);
+
+      var expectedKind = inode.Kind;
+      if (entry.IsDirectory != (expectedKind == FilesystemNodeKind.Directory)
+          || entry.IsSymlink != (expectedKind == FilesystemNodeKind.SymbolicLink))
+        throw new InvalidDataException($"ext inode {entry.Inode} type disagrees with directory entry '{entry.Name}'.");
+      if (!entry.IsDirectory && inode.Size != entry.Size)
+        throw new NotSupportedException(
+          $"ext inode {entry.Inode} for '{entry.Name}' has 64-bit size {inode.Size:N0}, but the current namespace reader exposed {entry.Size:N0}; direct large-file decoding must be completed before mounting this profile.");
+    }
+  }
+
+  private static string FirstLine(string message) {
+    var p = message.IndexOfAny(['\r', '\n']);
+    return p < 0 ? message : message[..p];
+  }
+}
+
+internal sealed class ExtReadOnlyFilesystemSession : IFilesystemSession {
+  private readonly Stream _image;
+  private readonly bool _leaveOpen;
+  private readonly object _ioGate = new();
+  private readonly ExtReader _reader;
+  private readonly ReadOnlyFilesystemSnapshotSession _namespace;
+  private bool _disposed;
+
+  public ExtReadOnlyFilesystemSession(Stream image, FilesystemDriverProfile profile, bool leaveOpen) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("ext mounted reads require a readable, seekable image.", nameof(image));
+    _image = image;
+    _leaveOpen = leaveOpen;
+    var super = ExtDriverSuperblock.Parse(image);
+    _reader = new ExtReader(image, leaveOpen: true);
+    var records = _reader.Entries.ToArray();
+
+    var rootInode = super.ReadInode(image, 2);
+    var rootId = new FilesystemNodeId(2, rootInode.Generation);
+    var (nodes, links) = BuildNamespace(super, records, rootId, rootInode);
+    _namespace = new ReadOnlyFilesystemSnapshotSession(profile, rootId, nodes, links);
+  }
+
+  public FilesystemDriverProfile Profile => _namespace.Profile;
+  public FilesystemNodeId RootNodeId => _namespace.RootNodeId;
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) => _namespace.Stat(nodeId);
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) => _namespace.Lookup(parentDirectory, name);
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) => _namespace.Enumerate(directory);
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) => _namespace.OpenFile(nodeId, access);
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => _namespace.CreateFile(parentDirectory, name);
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.CreateDirectory(parentDirectory, name);
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => _namespace.DeleteFile(parentDirectory, name);
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.RemoveDirectory(parentDirectory, name);
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)
+    => _namespace.Rename(oldParent, oldName, newParent, newName, replace);
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)
+    => _namespace.CreateHardLink(existingNode, newParent, newName);
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)
+    => _namespace.CreateSymbolicLink(parentDirectory, name, target);
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) => _namespace.ReadSymbolicLink(nodeId);
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => _namespace.SetMetadata(nodeId, patch);
+  public void Flush() => _namespace.Flush();
+  public IFilesystemTransaction BeginTransaction() => _namespace.BeginTransaction();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _namespace.Dispose();
+    _reader.Dispose();
+    if (!_leaveOpen) _image.Dispose();
+  }
+
+  private (FilesystemSnapshotNode[] Nodes, FilesystemSnapshotDirectoryEntry[] Links) BuildNamespace(
+      ExtDriverSuperblock super,
+      IReadOnlyList<ExtEntry> records,
+      FilesystemNodeId rootId,
+      ExtDriverInode rootInode) {
+    var nodesByInode = new Dictionary<uint, FilesystemSnapshotNode>();
+    var pathToNode = new Dictionary<string, FilesystemNodeId>(StringComparer.Ordinal) {
+      [string.Empty] = rootId,
+    };
+    var links = new List<FilesystemSnapshotDirectoryEntry>(records.Count);
+
+    nodesByInode[2] = MakeNode(rootId, rootInode, string.Empty, default, null);
+
+    foreach (var record in records.OrderBy(r => Depth(r.Name)).ThenBy(r => r.Name, StringComparer.Ordinal)) {
+      var path = Normalize(record.Name);
+      var slash = path.LastIndexOf('/');
+      var parentPath = slash < 0 ? string.Empty : path[..slash];
+      var name = slash < 0 ? path : path[(slash + 1)..];
+      if (!pathToNode.TryGetValue(parentPath, out var parentId))
+        throw new InvalidDataException($"ext entry '{path}' has no decoded parent '{parentPath}'.");
+
+      var inode = super.ReadInode(_image, record.Inode);
+      var nodeId = new FilesystemNodeId(record.Inode, inode.Generation);
+      if (!nodesByInode.TryGetValue(record.Inode, out var existing)) {
+        var captured = record;
+        nodesByInode[record.Inode] = MakeNode(nodeId, inode, name, parentId, captured);
+      } else if (existing.NodeId != nodeId || existing.Kind != inode.Kind || existing.Size != inode.Size) {
+        throw new InvalidDataException($"ext hard-link aliases for inode {record.Inode} disagree on object metadata.");
+      }
+
+      links.Add(new FilesystemSnapshotDirectoryEntry(parentId, name, nodeId));
+      if (inode.Kind == FilesystemNodeKind.Directory)
+        pathToNode[path] = nodeId;
+    }
+
+    return (nodesByInode.Values.ToArray(), links.ToArray());
+  }
+
+  private FilesystemSnapshotNode MakeNode(
+      FilesystemNodeId nodeId,
+      ExtDriverInode inode,
+      string name,
+      FilesystemNodeId parent,
+      ExtEntry? record) {
+    Func<IFilesystemFileHandle>? open = null;
+    if (inode.Kind == FilesystemNodeKind.RegularFile && record != null) {
+      var captured = record;
+      open = () => SpoolingReadOnlyFileHandle.Create(
+        nodeId,
+        inode.Size,
+        output => {
+          lock (_ioGate) _reader.ExtractTo(captured, output);
+        });
+    }
+
+    return new FilesystemSnapshotNode(
+      nodeId,
+      parent,
+      name,
+      inode.Kind,
+      inode.Kind == FilesystemNodeKind.Directory ? 0 : inode.Size,
+      inode.AllocatedBytes,
+      LinkCount: inode.LinkCount,
+      NativeAttributes: ((ulong)inode.Flags << 32) | inode.Mode,
+      Modified: inode.Modified,
+      SymbolicLinkTarget: record?.LinkTarget,
+      OpenReadHandle: open);
+  }
+
+  private static int Depth(string path) => Normalize(path).Count(c => c == '/');
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+}
+
+internal sealed record ExtDriverInode(
+  uint Number,
+  ushort Mode,
+  FilesystemNodeKind Kind,
+  long Size,
+  long AllocatedBytes,
+  uint LinkCount,
+  uint Generation,
+  uint Flags,
+  DateTimeOffset? Modified);
+
+internal readonly record struct ExtDriverSuperblock(
+  uint InodesCount,
+  ulong BlocksCount,
+  int BlockSize,
+  uint BlocksPerGroup,
+  uint InodesPerGroup,
+  ushort InodeSize,
+  uint FirstDataBlock,
+  uint FeatureCompat,
+  uint FeatureIncompat,
+  uint FeatureRoCompat,
+  ushort State,
+  ushort DescriptorSize) {
+
+  public const uint CompatHasJournal = 0x0004;
+  private const uint IncompatRecover = 0x0004;
+  private const uint IncompatJournalDevice = 0x0008;
+  private const uint IncompatMetaBg = 0x0010;
+  private const uint Incompat64Bit = 0x0080;
+  private const uint IncompatDirData = 0x1000;
+  private const uint IncompatInlineData = 0x8000;
+  private const uint IncompatEncrypt = 0x10000;
+  private const uint IncompatCasefold = 0x20000;
+  private const uint IncompatVerity = 0x100000;
+  private const uint RoCompatBigalloc = 0x0200;
+
+  public string ProfileName {
+    get {
+      var ext4 = (FeatureIncompat & (0x0040u | Incompat64Bit)) != 0 || (FeatureRoCompat & 0x0400u) != 0;
+      if (ext4) return "ext4 native inode reader";
+      return (FeatureCompat & CompatHasJournal) != 0
+        ? "ext3 native inode reader"
+        : "ext2 native inode reader";
+    }
+  }
+
+  public static ExtDriverSuperblock Parse(Stream image) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("ext driver probing requires a readable, seekable image.", nameof(image));
+    if (image.Length < 2048) throw new InvalidDataException("ext image is too small for its superblock.");
+    var sb = new byte[1024];
+    var original = image.Position;
+    try {
+      image.Position = 1024;
+      image.ReadExactly(sb);
+    } finally {
+      image.Position = original;
+    }
+    if (BinaryPrimitives.ReadUInt16LittleEndian(sb.AsSpan(56, 2)) != 0xEF53)
+      throw new InvalidDataException("ext superblock magic is not 0xEF53.");
+
+    var logBlock = BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(24, 4));
+    if (logBlock > 6) throw new NotSupportedException($"ext block-size shift {logBlock} is unsupported.");
+    var blockSize = checked(1024 << (int)logBlock);
+    var blocksLo = BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(4, 4));
+    var incompat = BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(96, 4));
+    var blocksHi = (incompat & Incompat64Bit) != 0
+      ? BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(0x150, 4))
+      : 0u;
+    var blocks = ((ulong)blocksHi << 32) | blocksLo;
+    var inodeSize = BinaryPrimitives.ReadUInt16LittleEndian(sb.AsSpan(88, 2));
+    if (inodeSize == 0) inodeSize = 128;
+    var descSize = (incompat & Incompat64Bit) != 0
+      ? Math.Max((ushort)64, BinaryPrimitives.ReadUInt16LittleEndian(sb.AsSpan(0xFE, 2)))
+      : (ushort)32;
+
+    return new ExtDriverSuperblock(
+      BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(0, 4)),
+      blocks,
+      blockSize,
+      BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(32, 4)),
+      BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(40, 4)),
+      inodeSize,
+      BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(20, 4)),
+      BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(92, 4)),
+      incompat,
+      BinaryPrimitives.ReadUInt32LittleEndian(sb.AsSpan(100, 4)),
+      BinaryPrimitives.ReadUInt16LittleEndian(sb.AsSpan(58, 2)),
+      descSize);
+  }
+
+  public void ValidateReadableProfile(Stream image) {
+    if (InodesCount == 0 || BlocksCount == 0 || BlocksPerGroup == 0 || InodesPerGroup == 0)
+      throw new InvalidDataException("ext superblock has zero geometry fields.");
+    var declared = checked((long)Math.Min(BlocksCount, (ulong)long.MaxValue) * BlockSize);
+    if ((ulong)declared / (ulong)BlockSize != BlocksCount)
+      throw new NotSupportedException("ext declared volume size exceeds the addressable stream range.");
+    if (image.Length < declared)
+      throw new InvalidDataException($"ext volume declares {declared:N0} bytes but image has {image.Length:N0}.");
+
+    var unsupported = FeatureIncompat &
+      (IncompatRecover | IncompatJournalDevice | IncompatMetaBg | IncompatDirData |
+       IncompatInlineData | IncompatEncrypt | IncompatCasefold | IncompatVerity);
+    if (unsupported != 0)
+      throw new NotSupportedException(
+        $"ext profile has unsupported/unsafe incompat feature bits 0x{unsupported:X8}; mount remains fail-closed.");
+    if ((FeatureRoCompat & RoCompatBigalloc) != 0)
+      throw new NotSupportedException("ext bigalloc cluster semantics are not decoded by the current mounted reader.");
+    if ((State & 0x0001) == 0 && (FeatureCompat & CompatHasJournal) != 0)
+      throw new NotSupportedException("ext journaled volume is not marked clean; JBD/JBD2 replay is required before mounting this snapshot.");
+  }
+
+  public ExtDriverInode ReadInode(Stream image, uint inodeNumber) {
+    if (inodeNumber == 0 || inodeNumber > InodesCount)
+      throw new InvalidDataException($"ext inode {inodeNumber} lies outside 1..{InodesCount}.");
+    var group = (inodeNumber - 1) / InodesPerGroup;
+    var index = (inodeNumber - 1) % InodesPerGroup;
+    var groupCount = checked((BlocksCount + BlocksPerGroup - 1) / BlocksPerGroup);
+    if (group >= groupCount) throw new InvalidDataException($"ext inode {inodeNumber} has invalid block group {group}.");
+
+    var bgdtBlock = FirstDataBlock + 1UL;
+    var descriptorOffset = checked((long)bgdtBlock * BlockSize + (long)group * DescriptorSize);
+    Span<byte> descriptor = stackalloc byte[64];
+    var original = image.Position;
+    try {
+      image.Position = descriptorOffset;
+      image.ReadExactly(descriptor[..DescriptorSize]);
+    } finally {
+      image.Position = original;
+    }
+    var tableLo = BinaryPrimitives.ReadUInt32LittleEndian(descriptor.Slice(8, 4));
+    var tableHi = DescriptorSize >= 64
+      ? BinaryPrimitives.ReadUInt32LittleEndian(descriptor.Slice(0x28, 4))
+      : 0u;
+    var tableBlock = ((ulong)tableHi << 32) | tableLo;
+    var inodeOffset = checked((long)tableBlock * BlockSize + (long)index * InodeSize);
+    if (inodeOffset < 0 || inodeOffset > image.Length - InodeSize)
+      throw new InvalidDataException($"ext inode {inodeNumber} table slot lies outside the image.");
+
+    var inode = new byte[InodeSize];
+    try {
+      image.Position = inodeOffset;
+      image.ReadExactly(inode);
+    } finally {
+      image.Position = original;
+    }
+
+    var mode = BinaryPrimitives.ReadUInt16LittleEndian(inode.AsSpan(0, 2));
+    var kind = (mode & 0xF000) switch {
+      0x4000 => FilesystemNodeKind.Directory,
+      0x8000 => FilesystemNodeKind.RegularFile,
+      0xA000 => FilesystemNodeKind.SymbolicLink,
+      0x2000 => FilesystemNodeKind.CharacterDevice,
+      0x6000 => FilesystemNodeKind.BlockDevice,
+      0x1000 => FilesystemNodeKind.Fifo,
+      0xC000 => FilesystemNodeKind.Socket,
+      _ => FilesystemNodeKind.Unknown,
+    };
+    var sizeLo = BinaryPrimitives.ReadUInt32LittleEndian(inode.AsSpan(4, 4));
+    var sizeHi = kind == FilesystemNodeKind.RegularFile && inode.Length >= 112
+      ? BinaryPrimitives.ReadUInt32LittleEndian(inode.AsSpan(108, 4))
+      : 0u;
+    var size = checked((long)(((ulong)sizeHi << 32) | sizeLo));
+    var blocksLo = BinaryPrimitives.ReadUInt32LittleEndian(inode.AsSpan(28, 4));
+    var blocksHi = inode.Length >= 118 ? BinaryPrimitives.ReadUInt16LittleEndian(inode.AsSpan(116, 2)) : (ushort)0;
+    var sectors = ((ulong)blocksHi << 32) | blocksLo;
+    var allocated = checked((long)checked(sectors * 512UL));
+    var links = BinaryPrimitives.ReadUInt16LittleEndian(inode.AsSpan(26, 2));
+    var generation = inode.Length >= 104 ? BinaryPrimitives.ReadUInt32LittleEndian(inode.AsSpan(100, 4)) : 0u;
+    var flags = BinaryPrimitives.ReadUInt32LittleEndian(inode.AsSpan(32, 4));
+    var mtime = BinaryPrimitives.ReadUInt32LittleEndian(inode.AsSpan(16, 4));
+    DateTimeOffset? modified = null;
+    if (mtime != 0) {
+      try { modified = DateTimeOffset.FromUnixTimeSeconds(mtime); } catch { }
+    }
+    return new ExtDriverInode(inodeNumber, mode, kind, size, allocated, links, generation, flags, modified);
+  }
+}
diff --git a/FileSystems/FileSystem.Fat/FatFilesystemDriverAdapter.cs b/FileSystems/FileSystem.Fat/FatFilesystemDriverAdapter.cs
new file mode 100644
index 000000000..d1b71b986
--- /dev/null
+++ b/FileSystems/FileSystem.Fat/FatFilesystemDriverAdapter.cs
@@ -0,0 +1,471 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using Compression.Registry;
+
+namespace FileSystem.Fat;
+
+/// <summary>
+/// Native FAT12/16/32 driver sidecar. The current milestone is a validated,
+/// positional read-only mount over the real FAT chains; writable mounting stays
+/// fail-closed until the existing offline mutators are converted to bounded
+/// block-device operations with complete directory/durability semantics.
+/// </summary>
+public sealed class FatFilesystemDriverAdapter :
+  IFilesystemDriverAdapter,
+  IBlockDeviceFilesystemDriverProvider {
+
+  public string FormatId => "Fat";
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var original = image.CanSeek ? image.Position : 0;
+    try {
+      var geometry = FatDriverGeometry.Parse(image);
+      using var reader = new FatReader(image, leaveOpen: true);
+      var entries = reader.Entries.ToArray();
+      ValidateAllocationGraph(image, geometry, entries);
+
+      return new FilesystemDriverProfile(
+        FormatId,
+        $"FAT{reader.FatType} native chain reader",
+        FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.CasePreservingNames,
+        FilesystemMutationModel.None,
+        CanMount: true,
+        CanMountWritable: false,
+        [
+          "Native positional reads use FAT chains directly; no whole-file extraction is required.",
+          "Node ids are stable for the mounted session. FAT has no inode number; durable identity across remount is not claimed.",
+          "Writable mounting remains disabled until nested namespace mutation, large-volume block writes, dirty-bit/write ordering and handle-safe truncate/rename are complete.",
+        ]);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException or OverflowException) {
+      return new FilesystemDriverProfile(
+        FormatId,
+        "unsupported or damaged FAT profile",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [FirstLine(e.Message)]);
+    } finally {
+      if (image.CanSeek) image.Position = original;
+    }
+  }
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(options);
+    if (!options.ReadOnly)
+      throw new NotSupportedException(
+        "FAT mounted writes are not yet enabled: archive Add/Remove is not a substitute for complete handle-safe filesystem mutation.");
+
+    var profile = ProbeFilesystem(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("FAT image is not mountable: " + string.Join("; ", profile.Limitations));
+    return new FatReadOnlyFilesystemSession(image, profile, options.LeaveOpen);
+  }
+
+  public FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device) {
+    ArgumentNullException.ThrowIfNull(device);
+    using var stream = new BlockDeviceStream(device, leaveOpen: true);
+    return ProbeFilesystem(stream);
+  }
+
+  public IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(device);
+    ArgumentNullException.ThrowIfNull(options);
+    var stream = new BlockDeviceStream(device, leaveOpen: false);
+    try {
+      return OpenFilesystem(stream, options with { LeaveOpen = false });
+    } catch {
+      stream.Dispose();
+      throw;
+    }
+  }
+
+  public FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(
+      Stream image,
+      FilesystemDriverTarget target) {
+    var profile = ProbeFilesystem(image);
+    var readRequired =
+      FilesystemDriverReadinessLayer.ImageValidation |
+      FilesystemDriverReadinessLayer.Namespace |
+      FilesystemDriverReadinessLayer.SessionStableNodeIds |
+      FilesystemDriverReadinessLayer.ReadData |
+      FilesystemDriverReadinessLayer.RandomAccessRead;
+    var writeRequired = readRequired |
+      FilesystemDriverReadinessLayer.AllocationMap |
+      FilesystemDriverReadinessLayer.WriteData |
+      FilesystemDriverReadinessLayer.Truncate |
+      FilesystemDriverReadinessLayer.NamespaceMutation |
+      FilesystemDriverReadinessLayer.Flush |
+      FilesystemDriverReadinessLayer.DurabilityModel |
+      FilesystemDriverReadinessLayer.Concurrency;
+
+    var available = profile.CanMount
+      ? readRequired |
+        FilesystemDriverReadinessLayer.AllocationMap
+      : FilesystemDriverReadinessLayer.None;
+    var blockers = new List<string>(profile.Limitations);
+    if (target == FilesystemDriverTarget.ReadWrite) {
+      blockers.Add("Replace byte[]-based FatModifier/FatRemover mutation with bounded IRandomAccessBlockDevice updates so multi-gigabyte FAT32 volumes do not require materialization.");
+      blockers.Add("Implement create/mkdir/unlink/rmdir in arbitrary directories, including directory-chain growth and LFN slot allocation.");
+      blockers.Add("Implement positional handle writes and truncate with cluster allocate/free, all FAT-copy updates and FAT32 FSInfo maintenance.");
+      blockers.Add("Implement rename with LFN/8.3 alias regeneration while open handles retain session object identity even when directory slots relocate.");
+      blockers.Add("Implement FAT clean/dirty bit and write-ordering rules; TFAT-marked volumes require their transaction-specific commit protocol rather than ordinary FAT ordering.");
+      blockers.Add("Add mounted locking/cache invalidation plus fault-injection tests around FAT, directory and FSInfo publication phases.");
+    }
+
+    var required = target == FilesystemDriverTarget.ReadOnly ? readRequired : writeRequired;
+    return new FilesystemDriverReadinessReport(
+      FormatId,
+      target,
+      available,
+      required,
+      profile.CanMount && (available & required) == required,
+      UsesNativeProvider: true,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static void ValidateAllocationGraph(
+      Stream image,
+      FatDriverGeometry geometry,
+      IReadOnlyList<FatEntry> entries) {
+    var owners = new Dictionary<int, string>();
+    foreach (var entry in entries) {
+      if (entry.StartCluster < 2) {
+        if (!entry.IsDirectory && entry.Size > 0)
+          throw new InvalidDataException($"FAT file '{entry.Name}' has data but no start cluster.");
+        continue;
+      }
+
+      var chain = geometry.ReadChain(image, entry.StartCluster, entry.Name);
+      if (!entry.IsDirectory) {
+        var needed = entry.Size == 0 ? 0L : (entry.Size + geometry.ClusterSize - 1) / geometry.ClusterSize;
+        if (chain.Count < needed)
+          throw new InvalidDataException(
+            $"FAT file '{entry.Name}' needs {needed} cluster(s) for {entry.Size} bytes but its chain has {chain.Count}.");
+      }
+
+      foreach (var cluster in chain) {
+        if (owners.TryGetValue(cluster, out var previous))
+          throw new InvalidDataException(
+            $"FAT cluster {cluster} is cross-linked by '{previous}' and '{entry.Name}'.");
+        owners[cluster] = entry.Name;
+      }
+    }
+  }
+
+  private static string FirstLine(string message) {
+    var p = message.IndexOfAny(['\r', '\n']);
+    return p < 0 ? message : message[..p];
+  }
+}
+
+internal sealed class FatReadOnlyFilesystemSession : IFilesystemSession {
+  private readonly Stream _image;
+  private readonly bool _leaveOpen;
+  private readonly object _ioGate = new();
+  private readonly ReadOnlyFilesystemSnapshotSession _namespace;
+  private bool _disposed;
+
+  public FatReadOnlyFilesystemSession(Stream image, FilesystemDriverProfile profile, bool leaveOpen) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("FAT mounted reads require a readable, seekable image.", nameof(image));
+    _image = image;
+    _leaveOpen = leaveOpen;
+
+    var geometry = FatDriverGeometry.Parse(image);
+    using var reader = new FatReader(image, leaveOpen: true);
+    var records = reader.Entries.ToArray();
+    var root = new FilesystemNodeId(1, 1);
+    var nodes = BuildNodes(records, geometry, root);
+    _namespace = new ReadOnlyFilesystemSnapshotSession(profile, root, nodes);
+  }
+
+  public FilesystemDriverProfile Profile => _namespace.Profile;
+  public FilesystemNodeId RootNodeId => _namespace.RootNodeId;
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) => _namespace.Stat(nodeId);
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) => _namespace.Lookup(parentDirectory, name);
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) => _namespace.Enumerate(directory);
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) => _namespace.OpenFile(nodeId, access);
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => _namespace.CreateFile(parentDirectory, name);
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.CreateDirectory(parentDirectory, name);
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => _namespace.DeleteFile(parentDirectory, name);
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.RemoveDirectory(parentDirectory, name);
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)
+    => _namespace.Rename(oldParent, oldName, newParent, newName, replace);
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)
+    => _namespace.CreateHardLink(existingNode, newParent, newName);
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)
+    => _namespace.CreateSymbolicLink(parentDirectory, name, target);
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) => _namespace.ReadSymbolicLink(nodeId);
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => _namespace.SetMetadata(nodeId, patch);
+  public void Flush() => _namespace.Flush();
+  public IFilesystemTransaction BeginTransaction() => _namespace.BeginTransaction();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _namespace.Dispose();
+    if (!_leaveOpen) _image.Dispose();
+  }
+
+  private IReadOnlyList<FilesystemSnapshotNode> BuildNodes(
+      IReadOnlyList<FatEntry> entries,
+      FatDriverGeometry geometry,
+      FilesystemNodeId rootId) {
+    var result = new List<FilesystemSnapshotNode>(entries.Count + 1) {
+      new(rootId, default, string.Empty, FilesystemNodeKind.Directory, 0, 0),
+    };
+    var byPath = new Dictionary<string, FilesystemNodeId>(StringComparer.OrdinalIgnoreCase) {
+      [string.Empty] = rootId,
+    };
+    ulong next = 2;
+
+    foreach (var entry in entries.OrderBy(e => Depth(e.Name)).ThenBy(e => e.Name, StringComparer.OrdinalIgnoreCase)) {
+      var path = Normalize(entry.Name);
+      var slash = path.LastIndexOf('/');
+      var parentPath = slash < 0 ? string.Empty : path[..slash];
+      var name = slash < 0 ? path : path[(slash + 1)..];
+      if (!byPath.TryGetValue(parentPath, out var parent))
+        throw new InvalidDataException($"FAT entry '{path}' has no decoded parent directory '{parentPath}'.");
+
+      var nodeId = new FilesystemNodeId(next++, 1);
+      byPath[path] = nodeId;
+      var captured = entry;
+      var allocated = entry.IsDirectory || entry.StartCluster < 2
+        ? 0L
+        : checked((long)geometry.ReadChain(_image, entry.StartCluster, entry.Name).Count * geometry.ClusterSize);
+      result.Add(new FilesystemSnapshotNode(
+        nodeId,
+        parent,
+        name,
+        entry.IsDirectory ? FilesystemNodeKind.Directory : FilesystemNodeKind.RegularFile,
+        entry.Size,
+        allocated,
+        Modified: ToOffset(entry.LastModified),
+        OpenReadHandle: entry.IsDirectory ? null : () => new FatPositionalFileHandle(
+          nodeId, _image, _ioGate, geometry, captured)));
+    }
+    return result;
+  }
+
+  private static int Depth(string path) => Normalize(path).Count(c => c == '/');
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static DateTimeOffset? ToOffset(DateTime? value) {
+    if (value == null) return null;
+    return value.Value.Kind == DateTimeKind.Local
+      ? new DateTimeOffset(value.Value)
+      : new DateTimeOffset(DateTime.SpecifyKind(value.Value, DateTimeKind.Utc), TimeSpan.Zero);
+  }
+}
+
+internal sealed class FatPositionalFileHandle : IFilesystemFileHandle {
+  private readonly Stream _image;
+  private readonly object _ioGate;
+  private readonly FatDriverGeometry _geometry;
+  private readonly FatEntry _entry;
+  private readonly IReadOnlyList<int> _chain;
+  private bool _disposed;
+
+  public FatPositionalFileHandle(
+      FilesystemNodeId nodeId,
+      Stream image,
+      object ioGate,
+      FatDriverGeometry geometry,
+      FatEntry entry) {
+    NodeId = nodeId;
+    _image = image;
+    _ioGate = ioGate;
+    _geometry = geometry;
+    _entry = entry;
+    _chain = entry.StartCluster < 2
+      ? []
+      : geometry.ReadChain(image, entry.StartCluster, entry.Name);
+  }
+
+  public FilesystemNodeId NodeId { get; }
+  public long Length {
+    get {
+      ThrowIfDisposed();
+      return Math.Max(0, _entry.Size);
+    }
+  }
+
+  public int Read(long offset, Span<byte> destination) {
+    ThrowIfDisposed();
+    if (offset < 0) throw new ArgumentOutOfRangeException(nameof(offset));
+    if (destination.Length == 0 || offset >= Length) return 0;
+
+    var remaining = checked((int)Math.Min(destination.Length, Length - offset));
+    var written = 0;
+    var logical = offset;
+    while (remaining > 0) {
+      var chainIndex = checked((int)(logical / _geometry.ClusterSize));
+      if (chainIndex < 0 || chainIndex >= _chain.Count)
+        throw new InvalidDataException($"FAT chain for '{_entry.Name}' ends before logical offset {logical}.");
+      var within = checked((int)(logical % _geometry.ClusterSize));
+      var take = Math.Min(remaining, _geometry.ClusterSize - within);
+      var physical = checked(_geometry.ClusterOffset(_chain[chainIndex]) + within);
+      lock (_ioGate) {
+        if (physical < 0 || physical > _image.Length - take)
+          throw new InvalidDataException($"FAT cluster for '{_entry.Name}' lies outside the image.");
+        _image.Position = physical;
+        _image.ReadExactly(destination.Slice(written, take));
+      }
+      logical += take;
+      written += take;
+      remaining -= take;
+    }
+    return written;
+  }
+
+  public void Write(long offset, ReadOnlySpan<byte> source)
+    => throw new NotSupportedException("The FAT filesystem session is read-only.");
+  public void SetLength(long length)
+    => throw new NotSupportedException("The FAT filesystem session is read-only.");
+  public void Flush() => ThrowIfDisposed();
+  public void Dispose() => _disposed = true;
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
+
+internal readonly record struct FatDriverGeometry(
+  int BytesPerSector,
+  int SectorsPerCluster,
+  int ReservedSectors,
+  int FatCount,
+  long TotalSectors,
+  int FatSize,
+  long FirstDataSector,
+  long TotalDataClusters,
+  int FatType,
+  int RootCluster) {
+
+  public int ClusterSize => checked(BytesPerSector * SectorsPerCluster);
+  public long DataLength => checked(TotalSectors * BytesPerSector);
+
+  public static FatDriverGeometry Parse(Stream image) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("FAT driver probing requires a readable, seekable stream.", nameof(image));
+    if (image.Length < 512) throw new InvalidDataException("FAT image is shorter than one boot sector.");
+
+    Span<byte> boot = stackalloc byte[512];
+    var original = image.Position;
+    try {
+      image.Position = 0;
+      image.ReadExactly(boot);
+    } finally {
+      image.Position = original;
+    }
+
+    if (boot[0] is not (0xEB or 0xE9 or 0x00))
+      throw new InvalidDataException("FAT boot jump is invalid.");
+    var bps = BinaryPrimitives.ReadUInt16LittleEndian(boot[11..13]);
+    if (bps is not (512 or 1024 or 2048 or 4096))
+      throw new InvalidDataException($"FAT bytes-per-sector value {bps} is unsupported.");
+    var spc = boot[13];
+    if (spc == 0 || (spc & (spc - 1)) != 0 || spc > 128)
+      throw new InvalidDataException($"FAT sectors-per-cluster value {spc} is invalid.");
+    var reserved = BinaryPrimitives.ReadUInt16LittleEndian(boot[14..16]);
+    if (reserved == 0) throw new InvalidDataException("FAT reserved-sector count is zero.");
+    var fatCount = boot[16];
+    if (fatCount is 0 or > 4) throw new InvalidDataException($"FAT copy count {fatCount} is invalid.");
+    var rootEntries = BinaryPrimitives.ReadUInt16LittleEndian(boot[17..19]);
+    var total16 = BinaryPrimitives.ReadUInt16LittleEndian(boot[19..21]);
+    var total = total16 != 0 ? total16 : BinaryPrimitives.ReadUInt32LittleEndian(boot[32..36]);
+    if (total == 0) throw new InvalidDataException("FAT total sector count is zero.");
+    var fat16 = BinaryPrimitives.ReadUInt16LittleEndian(boot[22..24]);
+    var fatSize = fat16 != 0 ? fat16 : checked((int)BinaryPrimitives.ReadUInt32LittleEndian(boot[36..40]));
+    if (fatSize <= 0) throw new InvalidDataException("FAT table size is zero.");
+
+    var rootSectors = ((long)rootEntries * 32 + bps - 1) / bps;
+    var firstData = checked((long)reserved + (long)fatCount * fatSize + rootSectors);
+    if (firstData >= total) throw new InvalidDataException("FAT data region starts outside the volume.");
+    var dataClusters = (total - firstData) / spc;
+    var fatType = fat16 == 0 ? 32 : dataClusters < 4085 ? 12 : dataClusters < 65525 ? 16 : 32;
+    var rootCluster = fatType == 32 ? checked((int)BinaryPrimitives.ReadUInt32LittleEndian(boot[44..48])) : 0;
+    if (fatType == 32 && rootCluster < 2) throw new InvalidDataException("FAT32 root cluster is invalid.");
+    var dataLength = checked((long)total * bps);
+    if (image.Length < dataLength)
+      throw new InvalidDataException($"FAT volume declares {dataLength:N0} bytes but image has only {image.Length:N0}.");
+
+    return new FatDriverGeometry(
+      bps, spc, reserved, fatCount, total, fatSize,
+      firstData, dataClusters, fatType, rootCluster);
+  }
+
+  public long ClusterOffset(int cluster) {
+    if (cluster < 2 || cluster >= TotalDataClusters + 2)
+      throw new InvalidDataException($"FAT cluster {cluster} lies outside the data-cluster range.");
+    return checked((FirstDataSector + (long)(cluster - 2) * SectorsPerCluster) * BytesPerSector);
+  }
+
+  public IReadOnlyList<int> ReadChain(Stream image, int startCluster, string owner) {
+    if (startCluster < 2) return [];
+    var result = new List<int>();
+    var seen = new HashSet<int>();
+    var cluster = startCluster;
+    while (true) {
+      if (cluster < 2 || cluster >= TotalDataClusters + 2)
+        throw new InvalidDataException($"FAT chain for '{owner}' references out-of-range cluster {cluster}.");
+      if (!seen.Add(cluster))
+        throw new InvalidDataException($"FAT chain for '{owner}' contains a loop at cluster {cluster}.");
+      result.Add(cluster);
+
+      var next = ReadFatEntry(image, 0, cluster);
+      for (var copy = 1; copy < FatCount; ++copy) {
+        var mirror = ReadFatEntry(image, copy, cluster);
+        if (mirror != next)
+          throw new InvalidDataException(
+            $"FAT copies disagree at cluster {cluster}: primary=0x{next:X}, copy {copy}=0x{mirror:X}.");
+      }
+      if (IsEndOfChain(next)) return result;
+      if (IsBadOrReserved(next))
+        throw new InvalidDataException($"FAT chain for '{owner}' terminates in reserved/bad value 0x{next:X}.");
+      if (next == 0)
+        throw new InvalidDataException($"FAT chain for '{owner}' reaches a free cluster after {cluster}.");
+      cluster = next;
+    }
+  }
+
+  private int ReadFatEntry(Stream image, int fatCopy, int cluster) {
+    var fatStart = checked(((long)ReservedSectors + (long)fatCopy * FatSize) * BytesPerSector);
+    Span<byte> bytes = stackalloc byte[4];
+    var position = FatType switch {
+      12 => fatStart + cluster + cluster / 2,
+      16 => fatStart + (long)cluster * 2,
+      _ => fatStart + (long)cluster * 4,
+    };
+    var needed = FatType == 12 || FatType == 16 ? 2 : 4;
+    var original = image.Position;
+    try {
+      image.Position = position;
+      image.ReadExactly(bytes[..needed]);
+    } finally {
+      image.Position = original;
+    }
+
+    if (FatType == 12) {
+      var raw = BinaryPrimitives.ReadUInt16LittleEndian(bytes[..2]);
+      return (cluster & 1) == 0 ? raw & 0x0FFF : raw >> 4;
+    }
+    if (FatType == 16) return BinaryPrimitives.ReadUInt16LittleEndian(bytes[..2]);
+    return checked((int)(BinaryPrimitives.ReadUInt32LittleEndian(bytes) & 0x0FFFFFFF));
+  }
+
+  private bool IsEndOfChain(int value) => FatType switch {
+    12 => value >= 0xFF8,
+    16 => value >= 0xFFF8,
+    _ => value >= 0x0FFFFFF8,
+  };
+
+  private bool IsBadOrReserved(int value) => FatType switch {
+    12 => value is >= 0xFF0 and < 0xFF8,
+    16 => value is >= 0xFFF0 and < 0xFFF8,
+    _ => value is >= 0x0FFFFFF0 and < 0x0FFFFFF8,
+  };
+}
diff --git a/FileSystems/FileSystem.Ntfs/NtfsFilesystemDriverAdapter.cs b/FileSystems/FileSystem.Ntfs/NtfsFilesystemDriverAdapter.cs
new file mode 100644
index 000000000..8cd9d6c55
--- /dev/null
+++ b/FileSystems/FileSystem.Ntfs/NtfsFilesystemDriverAdapter.cs
@@ -0,0 +1,342 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using Compression.Registry;
+
+namespace FileSystem.Ntfs;
+
+/// <summary>
+/// Native NTFS driver sidecar. Namespace identity is based on the MFT record
+/// number rather than path text, so rename/unlink can later preserve open-handle
+/// identity. The reader already decodes resident/non-resident $DATA, sparse
+/// runs, LZNT1, reparse symlinks and INDEX_ALLOCATION directories. Mounted
+/// writes remain fail-closed until $LogFile transactions/replay and the full
+/// file-reference (MFT record + sequence number) are part of the mutable core.
+/// </summary>
+public sealed class NtfsFilesystemDriverAdapter :
+  IFilesystemDriverAdapter,
+  IBlockDeviceFilesystemDriverProvider {
+
+  public string FormatId => "Ntfs";
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var original = image.CanSeek ? image.Position : 0;
+    try {
+      var geometry = NtfsDriverGeometry.Parse(image);
+      using var reader = new NtfsReader(image, leaveOpen: true);
+      ValidateNamespace(reader.Entries, geometry);
+
+      return new FilesystemDriverProfile(
+        FormatId,
+        "NTFS native MFT reader",
+        FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.SymbolicLinks |
+        FilesystemDriverCapabilities.SparseFiles |
+        FilesystemDriverCapabilities.CasePreservingNames,
+        FilesystemMutationModel.None,
+        CanMount: true,
+        CanMountWritable: false,
+        [
+          "MFT record numbers provide path-independent object identity for the read-only mounted snapshot.",
+          "The current namespace reader retains one preferred $FILE_NAME per MFT record; expose all $FILE_NAME attributes plus the MFT sequence number before claiming durable hard-link/file-reference identity.",
+          "File data is decoded by the native NTFS reader; the transitional positional handle spools that decoded stream while a direct resident/data-run/LZNT1 positional handle is completed.",
+          "$LogFile restart/replay and transactional publication are not implemented, so writable mounting remains disabled even though offline add/remove/block-move primitives exist.",
+        ]);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException or OverflowException) {
+      return new FilesystemDriverProfile(
+        FormatId,
+        "unsupported or damaged NTFS profile",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [FirstLine(e.Message)]);
+    } finally {
+      if (image.CanSeek) image.Position = original;
+    }
+  }
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(options);
+    if (!options.ReadOnly)
+      throw new NotSupportedException(
+        "NTFS mounted writes require $LogFile transaction/replay semantics and complete mutable file-reference/index handling; offline archive mutation is not a mounted-write substitute.");
+
+    var profile = ProbeFilesystem(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("NTFS image is not mountable: " + string.Join("; ", profile.Limitations));
+    return new NtfsReadOnlyFilesystemSession(image, profile, options.LeaveOpen);
+  }
+
+  public FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device) {
+    ArgumentNullException.ThrowIfNull(device);
+    using var stream = new BlockDeviceStream(device, leaveOpen: true);
+    return ProbeFilesystem(stream);
+  }
+
+  public IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(device);
+    ArgumentNullException.ThrowIfNull(options);
+    var stream = new BlockDeviceStream(device, leaveOpen: false);
+    try {
+      return OpenFilesystem(stream, options with { LeaveOpen = false });
+    } catch {
+      stream.Dispose();
+      throw;
+    }
+  }
+
+  public FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(
+      Stream image,
+      FilesystemDriverTarget target) {
+    var profile = ProbeFilesystem(image);
+    var readRequired =
+      FilesystemDriverReadinessLayer.ImageValidation |
+      FilesystemDriverReadinessLayer.Namespace |
+      FilesystemDriverReadinessLayer.SessionStableNodeIds |
+      FilesystemDriverReadinessLayer.ReadData |
+      FilesystemDriverReadinessLayer.RandomAccessRead;
+    var writeRequired = readRequired |
+      FilesystemDriverReadinessLayer.NativeStableNodeIds |
+      FilesystemDriverReadinessLayer.AllocationMap |
+      FilesystemDriverReadinessLayer.WriteData |
+      FilesystemDriverReadinessLayer.Truncate |
+      FilesystemDriverReadinessLayer.NamespaceMutation |
+      FilesystemDriverReadinessLayer.MetadataMutation |
+      FilesystemDriverReadinessLayer.Links |
+      FilesystemDriverReadinessLayer.Flush |
+      FilesystemDriverReadinessLayer.DurabilityModel |
+      FilesystemDriverReadinessLayer.Recovery |
+      FilesystemDriverReadinessLayer.Concurrency;
+
+    var available = profile.CanMount
+      ? readRequired |
+        FilesystemDriverReadinessLayer.AllocationMap |
+        FilesystemDriverReadinessLayer.ValidationCorpus
+      : FilesystemDriverReadinessLayer.None;
+    var blockers = new List<string>(profile.Limitations);
+    if (target == FilesystemDriverTarget.ReadWrite) {
+      blockers.Add("Expose the MFT sequence number and every live $FILE_NAME attribute so file references and hard links survive rename/unlink/reuse correctly.");
+      blockers.Add("Move resident/data-run/LZNT1 reads and writes behind direct positional handles; remove whole-file materialization from the mounted path.");
+      blockers.Add("Implement arbitrary-directory create/unlink/mkdir/rmdir/rename/link with $INDEX_ROOT/$INDEX_ALLOCATION B+tree split/merge and correct namespace collation.");
+      blockers.Add("Implement resident↔non-resident conversion, sparse/compressed run-list growth, truncate and $Bitmap allocation as bounded block-device transactions.");
+      blockers.Add("Implement $LogFile restart areas, redo/undo records, transaction publication, replay/recovery and volume dirty/clean state before enabling writes.");
+      blockers.Add("Complete security descriptors, ACLs, object IDs, quotas, EAs/ADS/reparse semantics and cache/locking behavior for concurrent kernel requests.");
+    }
+    var required = target == FilesystemDriverTarget.ReadOnly ? readRequired : writeRequired;
+    return new FilesystemDriverReadinessReport(
+      FormatId,
+      target,
+      available,
+      required,
+      profile.CanMount && (available & required) == required,
+      UsesNativeProvider: true,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static void ValidateNamespace(IReadOnlyList<NtfsEntry> entries, NtfsDriverGeometry geometry) {
+    var paths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+    foreach (var entry in entries) {
+      if (entry.MftRecord <= 15)
+        throw new InvalidDataException($"NTFS user namespace unexpectedly exposed reserved MFT record {entry.MftRecord} as '{entry.Name}'.");
+      var path = Normalize(entry.Name);
+      if (path.Length == 0)
+        throw new InvalidDataException("NTFS namespace exposed an empty path.");
+      if (!paths.Add(path))
+        throw new InvalidDataException($"NTFS namespace contains duplicate path '{path}'.");
+      if (entry.Size < 0)
+        throw new InvalidDataException($"NTFS entry '{path}' has a negative logical size.");
+      if (entry.Size > geometry.VolumeBytes)
+        throw new InvalidDataException($"NTFS entry '{path}' is larger than the declared volume.");
+    }
+  }
+
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static string FirstLine(string message) {
+    var p = message.IndexOfAny(['\r', '\n']);
+    return p < 0 ? message : message[..p];
+  }
+}
+
+internal sealed class NtfsReadOnlyFilesystemSession : IFilesystemSession {
+  private readonly Stream _image;
+  private readonly bool _leaveOpen;
+  private readonly object _ioGate = new();
+  private readonly NtfsReader _reader;
+  private readonly ReadOnlyFilesystemSnapshotSession _namespace;
+  private bool _disposed;
+
+  public NtfsReadOnlyFilesystemSession(Stream image, FilesystemDriverProfile profile, bool leaveOpen) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("NTFS mounted reads require a readable, seekable image.", nameof(image));
+    _image = image;
+    _leaveOpen = leaveOpen;
+    _reader = new NtfsReader(image, leaveOpen: true);
+    var records = _reader.Entries.ToArray();
+    var root = new FilesystemNodeId(5, 0);
+    var (nodes, links) = BuildNamespace(records, root);
+    _namespace = new ReadOnlyFilesystemSnapshotSession(profile, root, nodes, links);
+  }
+
+  public FilesystemDriverProfile Profile => _namespace.Profile;
+  public FilesystemNodeId RootNodeId => _namespace.RootNodeId;
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) => _namespace.Stat(nodeId);
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) => _namespace.Lookup(parentDirectory, name);
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) => _namespace.Enumerate(directory);
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) => _namespace.OpenFile(nodeId, access);
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => _namespace.CreateFile(parentDirectory, name);
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.CreateDirectory(parentDirectory, name);
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => _namespace.DeleteFile(parentDirectory, name);
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.RemoveDirectory(parentDirectory, name);
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)
+    => _namespace.Rename(oldParent, oldName, newParent, newName, replace);
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)
+    => _namespace.CreateHardLink(existingNode, newParent, newName);
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)
+    => _namespace.CreateSymbolicLink(parentDirectory, name, target);
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) => _namespace.ReadSymbolicLink(nodeId);
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => _namespace.SetMetadata(nodeId, patch);
+  public void Flush() => _namespace.Flush();
+  public IFilesystemTransaction BeginTransaction() => _namespace.BeginTransaction();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _namespace.Dispose();
+    _reader.Dispose();
+    if (!_leaveOpen) _image.Dispose();
+  }
+
+  private (FilesystemSnapshotNode[] Nodes, FilesystemSnapshotDirectoryEntry[] Links) BuildNamespace(
+      IReadOnlyList<NtfsEntry> records,
+      FilesystemNodeId rootId) {
+    var nodes = new Dictionary<uint, FilesystemSnapshotNode>();
+    var links = new List<FilesystemSnapshotDirectoryEntry>(records.Count);
+    var pathToNode = new Dictionary<string, FilesystemNodeId>(StringComparer.OrdinalIgnoreCase) {
+      [string.Empty] = rootId,
+    };
+    nodes[5] = new FilesystemSnapshotNode(
+      rootId, default, string.Empty, FilesystemNodeKind.Directory, 0, 0);
+
+    foreach (var record in records.OrderBy(r => Depth(r.Name)).ThenBy(r => r.Name, StringComparer.OrdinalIgnoreCase)) {
+      var path = Normalize(record.Name);
+      var slash = path.LastIndexOf('/');
+      var parentPath = slash < 0 ? string.Empty : path[..slash];
+      var name = slash < 0 ? path : path[(slash + 1)..];
+      if (!pathToNode.TryGetValue(parentPath, out var parent))
+        throw new InvalidDataException($"NTFS entry '{path}' has no decoded parent '{parentPath}'.");
+
+      var nodeId = new FilesystemNodeId(record.MftRecord, 0);
+      if (!nodes.TryGetValue(record.MftRecord, out var existing)) {
+        var captured = record;
+        Func<IFilesystemFileHandle>? open = null;
+        if (!record.IsDirectory && !record.IsSymlink) {
+          open = () => SpoolingReadOnlyFileHandle.Create(
+            nodeId,
+            record.Size,
+            output => {
+              byte[] data;
+              lock (_ioGate) data = _reader.Extract(captured);
+              output.Write(data);
+            });
+        }
+        nodes[record.MftRecord] = new FilesystemSnapshotNode(
+          nodeId,
+          parent,
+          name,
+          record.IsDirectory ? FilesystemNodeKind.Directory
+            : record.IsSymlink ? FilesystemNodeKind.SymbolicLink
+            : FilesystemNodeKind.RegularFile,
+          record.IsDirectory ? 0 : record.Size,
+          record.IsDirectory ? 0 : record.Size,
+          Modified: ToOffset(record.LastModified),
+          SymbolicLinkTarget: record.LinkTarget,
+          OpenReadHandle: open);
+      } else {
+        var expectedKind = record.IsDirectory ? FilesystemNodeKind.Directory
+          : record.IsSymlink ? FilesystemNodeKind.SymbolicLink
+          : FilesystemNodeKind.RegularFile;
+        if (existing.Kind != expectedKind || existing.Size != (record.IsDirectory ? 0 : record.Size))
+          throw new InvalidDataException($"NTFS aliases for MFT record {record.MftRecord} disagree on object metadata.");
+      }
+
+      links.Add(new FilesystemSnapshotDirectoryEntry(parent, name, nodeId));
+      if (record.IsDirectory)
+        pathToNode[path] = nodeId;
+    }
+
+    return (nodes.Values.ToArray(), links.ToArray());
+  }
+
+  private static int Depth(string path) => Normalize(path).Count(c => c == '/');
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static DateTimeOffset? ToOffset(DateTime? value) {
+    if (value == null) return null;
+    return value.Value.Kind == DateTimeKind.Local
+      ? new DateTimeOffset(value.Value)
+      : new DateTimeOffset(DateTime.SpecifyKind(value.Value, DateTimeKind.Utc), TimeSpan.Zero);
+  }
+}
+
+internal readonly record struct NtfsDriverGeometry(
+  int BytesPerSector,
+  int SectorsPerCluster,
+  long TotalSectors,
+  long MftCluster,
+  long MftMirrorCluster,
+  int MftRecordSize) {
+
+  public int ClusterSize => checked(BytesPerSector * SectorsPerCluster);
+  public long VolumeBytes => checked(TotalSectors * BytesPerSector);
+
+  public static NtfsDriverGeometry Parse(Stream image) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("NTFS driver probing requires a readable, seekable stream.", nameof(image));
+    if (image.Length < 512) throw new InvalidDataException("NTFS image is shorter than one boot sector.");
+
+    Span<byte> boot = stackalloc byte[512];
+    var original = image.Position;
+    try {
+      image.Position = 0;
+      image.ReadExactly(boot);
+    } finally {
+      image.Position = original;
+    }
+
+    if (!boot.Slice(3, 8).SequenceEqual("NTFS    "u8))
+      throw new InvalidDataException("NTFS OEM id is invalid.");
+    if (boot[510] != 0x55 || boot[511] != 0xAA)
+      throw new InvalidDataException("NTFS boot-sector signature is invalid.");
+
+    var bps = BinaryPrimitives.ReadUInt16LittleEndian(boot[11..13]);
+    if (bps is not (512 or 1024 or 2048 or 4096))
+      throw new NotSupportedException($"NTFS bytes-per-sector {bps} is unsupported.");
+    var spc = boot[13];
+    if (spc == 0 || (spc & (spc - 1)) != 0)
+      throw new InvalidDataException($"NTFS sectors-per-cluster {spc} is invalid.");
+    var total = checked((long)BinaryPrimitives.ReadUInt64LittleEndian(boot[40..48]));
+    if (total <= 0) throw new InvalidDataException("NTFS total-sector count is zero.");
+    var volumeBytes = checked(total * bps);
+    if (volumeBytes > image.Length)
+      throw new InvalidDataException($"NTFS volume declares {volumeBytes:N0} bytes but image has {image.Length:N0}.");
+
+    var clusterSize = checked(bps * spc);
+    var mft = checked((long)BinaryPrimitives.ReadUInt64LittleEndian(boot[48..56]));
+    var mirror = checked((long)BinaryPrimitives.ReadUInt64LittleEndian(boot[56..64]));
+    if (mft <= 0 || mft >= total / spc)
+      throw new InvalidDataException("NTFS $MFT LCN lies outside the declared volume.");
+    if (mirror < 0 || mirror >= total / spc)
+      throw new InvalidDataException("NTFS $MFTMirr LCN lies outside the declared volume.");
+
+    var cpr = unchecked((sbyte)boot[64]);
+    var recordSize = cpr < 0 ? 1 << -cpr : checked(cpr * clusterSize);
+    if (recordSize is < 512 or > 65536 || (recordSize & (recordSize - 1)) != 0)
+      throw new NotSupportedException($"NTFS MFT record size {recordSize:N0} is unsupported.");
+
+    return new NtfsDriverGeometry(bps, spc, total, mft, mirror, recordSize);
+  }
+}
diff --git a/FileSystems/FileSystem.OrangeFs/OrangeFsFormatDescriptor.cs b/FileSystems/FileSystem.OrangeFs/OrangeFsFormatDescriptor.cs
index c0b667b74..737f9745d 100644
--- a/FileSystems/FileSystem.OrangeFs/OrangeFsFormatDescriptor.cs
+++ b/FileSystems/FileSystem.OrangeFs/OrangeFsFormatDescriptor.cs
@@ -5,49 +5,48 @@
 namespace FileSystem.OrangeFs;
 
 /// <summary>
-/// Read-only descriptor for OrangeFS / PVFS2 DBPF (Direct Block Pool
-/// Format) storage-object files. PVFS2 is a parallel distributed FS, but
-/// its server-side <c>bstream-XX</c> objects are single files starting
-/// with a 4-byte ASCII tag (<c>"PVFS"</c> classic, <c>"OGFP"</c>
-/// OrangeFS-native) followed by version, datastream-type, and object-size
-/// fields. The contained object payload is surfaced as a single opaque
-/// entry — semantic resolution requires cluster <c>fs.conf</c>.
+/// OrangeFS / PVFS2 DBPF storage-object descriptor. A DBPF file is one server-side
+/// storage object rather than a complete distributed filesystem namespace; the
+/// opaque object payload can nevertheless be created, replaced and removed while
+/// preserving its DBPF tag/version/datastream identity.
 ///
 /// References:
 /// <list type="bullet">
 ///   <item><description><c>https://github.com/waltligon/orangefs</c> — official PVFS/OrangeFS repository (DBPF storage layer)</description></item>
 ///   <item><description><c>https://www.kernel.org/doc/html/latest/filesystems/orangefs.html</c> — Linux kernel client documentation</description></item>
-///   <item><description><c>https://en.wikipedia.org/wiki/OrangeFS</c> — Wikipedia article</description></item>
 /// </list>
 /// </summary>
-public sealed class OrangeFsFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations, IArchiveDefragmentable {
+public sealed class OrangeFsFormatDescriptor : IFormatDescriptor, IArchiveFormatOperations,
+    IArchiveCreatable, IArchiveModifiable, IArchiveDefragmentable {
   public string Id => "OrangeFs";
   public string DisplayName => "OrangeFS / PVFS2 DBPF";
   public FormatCategory Category => FormatCategory.Archive;
   public FormatCapabilities Capabilities =>
-    FormatCapabilities.CanList | FormatCapabilities.CanExtract;
+    FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate |
+    FormatCapabilities.CanModify | FormatCapabilities.CanTest;
   public string DefaultExtension => ".orangefs";
   public IReadOnlyList<string> Extensions => [".orangefs", ".pvfs", ".bstream"];
   public IReadOnlyList<string> CompoundExtensions => [];
   public IReadOnlyList<MagicSignature> MagicSignatures => [
-    // "PVFS" at offset 0 (classic PVFS2 DBPF).
     new("PVFS"u8.ToArray(), Offset: 0, Confidence: 0.90),
-    // "OGFP" at offset 0 (OrangeFS-native DBPF).
     new("OGFP"u8.ToArray(), Offset: 0, Confidence: 0.90),
   ];
   public IReadOnlyList<FormatMethodInfo> Methods => [new("stored", "Stored")];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
-  public string Description => "OrangeFS / PVFS2 DBPF — stub: header-only, opaque storage-object payload.";
+  public string Description =>
+    "OrangeFS / PVFS2 DBPF storage object — opaque object payload R/W; cluster namespace resolution requires fs.conf.";
 
   public List<ArchiveEntryInfo> List(Stream stream, string? password) {
-    var r = new OrangeFsReader(stream);
+    if (stream.CanSeek) stream.Position = 0;
+    using var r = new OrangeFsReader(stream);
     return r.Entries.Select((e, i) => new ArchiveEntryInfo(
       i, e.Name, e.Size, e.Size, "Stored", e.IsDirectory, false, null)).ToList();
   }
 
   public void Extract(Stream stream, string outputDir, string? password, string[]? files) {
-    var r = new OrangeFsReader(stream);
+    if (stream.CanSeek) stream.Position = 0;
+    using var r = new OrangeFsReader(stream);
     foreach (var e in r.Entries) {
       if (e.IsDirectory) continue;
       if (files != null && !MatchesFilter(e.Name, files)) continue;
@@ -55,9 +54,33 @@ public void Extract(Stream stream, string outputDir, string? password, string[]?
     }
   }
 
-  public void Defragment(Stream archive)
-    => throw new NotSupportedException("OrangeFs read-only — defragmentation requires a writer.");
+  public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options) {
+    ArgumentNullException.ThrowIfNull(output);
+    ArgumentNullException.ThrowIfNull(inputs);
+    var payload = FilesOnly(inputs)
+      .FirstOrDefault(f => !IsSynthetic(f.Name)).Data ?? [];
+    OrangeFsWriter.Create(output, payload);
+  }
+
+  public void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs) {
+    ArgumentNullException.ThrowIfNull(inputs);
+    var payload = FilesOnly(inputs).LastOrDefault(f => !IsSynthetic(f.Name)).Data;
+    if (payload != null)
+      OrangeFsWriter.ReplacePayload(archive, payload);
+  }
 
-  public void Defragment(Stream archive, DefragOptions options)
-    => throw new NotSupportedException("OrangeFs read-only — defragmentation requires a writer.");
+  public void Remove(Stream archive, string[] entryNames) {
+    ArgumentNullException.ThrowIfNull(entryNames);
+    if (entryNames.Any(n => string.Equals(Path.GetFileName(n), "object.bin", StringComparison.OrdinalIgnoreCase)))
+      OrangeFsWriter.ReplacePayload(archive, []);
+  }
+
+  public void Defragment(Stream archive) { }
+  public void Defragment(Stream archive, DefragOptions options) { }
+
+  private static bool IsSynthetic(string name) {
+    var leaf = Path.GetFileName(name);
+    return leaf.Equals("metadata.ini", StringComparison.OrdinalIgnoreCase)
+      || leaf.StartsWith("FULL.", StringComparison.OrdinalIgnoreCase);
+  }
 }
diff --git a/FileSystems/FileSystem.OrangeFs/OrangeFsWriter.cs b/FileSystems/FileSystem.OrangeFs/OrangeFsWriter.cs
new file mode 100644
index 000000000..ba7535960
--- /dev/null
+++ b/FileSystems/FileSystem.OrangeFs/OrangeFsWriter.cs
@@ -0,0 +1,43 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+
+namespace FileSystem.OrangeFs;
+
+/// <summary>Writes and edits standalone OrangeFS/PVFS2 DBPF storage objects.</summary>
+internal static class OrangeFsWriter {
+  internal const int HeaderSize = 16;
+
+  public static void Create(Stream output, ReadOnlySpan<byte> payload,
+      bool orangeFs = true, uint version = 1, uint datastreamType = 0) {
+    ArgumentNullException.ThrowIfNull(output);
+    Span<byte> header = stackalloc byte[HeaderSize];
+    (orangeFs ? OrangeFsReader.OrangeFsTag : OrangeFsReader.PvfsTag).CopyTo(header);
+    BinaryPrimitives.WriteUInt32LittleEndian(header[4..], version);
+    BinaryPrimitives.WriteUInt32LittleEndian(header[8..], datastreamType);
+    BinaryPrimitives.WriteUInt32LittleEndian(header[12..], checked((uint)payload.Length));
+    output.Write(header);
+    output.Write(payload);
+  }
+
+  public static void ReplacePayload(Stream image, ReadOnlySpan<byte> payload) {
+    ArgumentNullException.ThrowIfNull(image);
+    if (!image.CanRead || !image.CanWrite || !image.CanSeek)
+      throw new ArgumentException("OrangeFS mutation requires a seekable read/write stream.", nameof(image));
+
+    // ReadOnlySpan<byte>.Length is an Int32, therefore it always fits the
+    // DBPF object's unsigned 32-bit length field. The checked cast documents
+    // the wire-format boundary without an impossible int > uint.MaxValue test.
+    image.Position = 0;
+    Span<byte> header = stackalloc byte[HeaderSize];
+    image.ReadExactly(header);
+    if (!header[..4].SequenceEqual(OrangeFsReader.PvfsTag) &&
+        !header[..4].SequenceEqual(OrangeFsReader.OrangeFsTag))
+      throw new InvalidDataException("OrangeFS/PVFS2 DBPF header is invalid.");
+
+    BinaryPrimitives.WriteUInt32LittleEndian(header[12..], checked((uint)payload.Length));
+    image.Position = 0;
+    image.Write(header);
+    image.Write(payload);
+    image.SetLength(HeaderSize + payload.Length);
+  }
+}
diff --git a/FileSystems/FileSystem.Refs/RefsFilesystemDriver.cs b/FileSystems/FileSystem.Refs/RefsFilesystemDriver.cs
new file mode 100644
index 000000000..308530a9b
--- /dev/null
+++ b/FileSystems/FileSystem.Refs/RefsFilesystemDriver.cs
@@ -0,0 +1,299 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using Compression.Registry;
+
+namespace FileSystem.Refs;
+
+internal static class RefsFilesystemDriver {
+  private static readonly FilesystemDriverCapabilities ReadCapabilities =
+    FilesystemDriverCapabilities.EnumerateDirectories |
+    FilesystemDriverCapabilities.ReadData |
+    FilesystemDriverCapabilities.RandomAccess |
+    FilesystemDriverCapabilities.CasePreservingNames;
+
+  public static FilesystemDriverProfile Probe(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var original = image.CanSeek ? image.Position : 0;
+    try {
+      var metadata = RefsMetadataReader.Open(image);
+      _ = new RefsNamespaceReader(metadata).ReadAll();
+      return new FilesystemDriverProfile(
+        "Refs",
+        $"ReFS {metadata.Header.MajorVersion}.{metadata.Header.MinorVersion} native namespace",
+        ReadCapabilities,
+        FilesystemMutationModel.CopyOnWrite,
+        CanMount: true,
+        CanMountWritable: false,
+        [
+          "Native read-only namespace and positional stream I/O are available.",
+          "Native CoW B+ page/allocator/MLog/checkpoint publication exists, but mounted writes remain disabled until version-qualified redo payload encoders and recovery application are complete.",
+          "Resident type-0x30 rows still need a decoded rename-stable file identity before StableNodeIds can be advertised for every node.",
+        ]);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException or OverflowException) {
+      return new FilesystemDriverProfile(
+        "Refs",
+        "unsupported or damaged ReFS profile",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [FirstLine(e.Message)]);
+    } finally {
+      if (image.CanSeek) image.Position = original;
+    }
+  }
+
+  public static IFilesystemSession Open(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(options);
+    if (options.ReadOnly == false)
+      throw new NotSupportedException(
+        "ReFS writable mounting is intentionally fail-closed until native redo payload generation/replay and the complete namespace/stream mutation path are validated.");
+
+    var profile = Probe(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("The ReFS image is not mountable by the native reader: " + string.Join("; ", profile.Limitations));
+    return new RefsReadOnlyFilesystemSession(image, profile, options.LeaveOpen);
+  }
+
+  public static FilesystemDriverReadinessReport Readiness(Stream image, FilesystemDriverTarget target) {
+    var profile = Probe(image);
+    var requiredRead =
+      FilesystemDriverReadinessLayer.ImageValidation |
+      FilesystemDriverReadinessLayer.Namespace |
+      FilesystemDriverReadinessLayer.SessionStableNodeIds |
+      FilesystemDriverReadinessLayer.ReadData |
+      FilesystemDriverReadinessLayer.RandomAccessRead;
+    var requiredWrite = requiredRead |
+      FilesystemDriverReadinessLayer.AllocationMap |
+      FilesystemDriverReadinessLayer.WriteData |
+      FilesystemDriverReadinessLayer.Truncate |
+      FilesystemDriverReadinessLayer.NamespaceMutation |
+      FilesystemDriverReadinessLayer.Flush |
+      FilesystemDriverReadinessLayer.DurabilityModel |
+      FilesystemDriverReadinessLayer.Concurrency;
+
+    var available = profile.CanMount
+      ? requiredRead |
+        FilesystemDriverReadinessLayer.AllocationMap |
+        FilesystemDriverReadinessLayer.DurabilityModel
+      : FilesystemDriverReadinessLayer.None;
+    var blockers = new List<string>(profile.Limitations);
+    if (target == FilesystemDriverTarget.ReadWrite) {
+      blockers.Add("Encode version-qualified ReFS MLog redo payloads for every namespace/stream opcode emitted by supported profiles.");
+      blockers.Add("Apply supported redo payloads during dirty-volume restart instead of validating the envelope only.");
+      blockers.Add("Complete create/unlink/rename/truncate/write allocation semantics including sparse, integrity, refcount, snapshot and ADS ownership cases.");
+      blockers.Add("Decode rename-stable native identity for resident filename rows and preserve it across namespace mutations.");
+      blockers.Add("Add mounted cache/locking/coherency rules and phase-by-phase crash fault injection.");
+    }
+    var required = target == FilesystemDriverTarget.ReadOnly ? requiredRead : requiredWrite;
+    return new FilesystemDriverReadinessReport(
+      "Refs", target, available, required,
+      profile.CanMount && (available & required) == required,
+      UsesNativeProvider: true,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static string FirstLine(string message) {
+    var p = message.IndexOfAny(['\r', '\n']);
+    return p < 0 ? message : message[..p];
+  }
+}
+
+internal sealed class RefsReadOnlyFilesystemSession : IFilesystemSession {
+  private const ulong RootDirectoryOid = 0x600;
+  private readonly Stream _image;
+  private readonly bool _leaveOpen;
+  private readonly object _ioGate = new();
+  private readonly ReadOnlyFilesystemSnapshotSession _namespace;
+  private bool _disposed;
+
+  public RefsReadOnlyFilesystemSession(Stream image, FilesystemDriverProfile profile, bool leaveOpen) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("ReFS mounted reads require a readable, seekable image.", nameof(image));
+    _image = image;
+    _leaveOpen = leaveOpen;
+
+    var metadata = RefsMetadataReader.Open(image);
+    var records = new RefsNamespaceReader(metadata).ReadAll();
+    var rootId = new FilesystemNodeId(RootDirectoryOid, 1);
+    var nodes = BuildNodes(metadata, records, rootId);
+    _namespace = new ReadOnlyFilesystemSnapshotSession(profile, rootId, nodes);
+  }
+
+  public FilesystemDriverProfile Profile => _namespace.Profile;
+  public FilesystemNodeId RootNodeId => _namespace.RootNodeId;
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) => _namespace.Stat(nodeId);
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) => _namespace.Lookup(parentDirectory, name);
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) => _namespace.Enumerate(directory);
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) => _namespace.OpenFile(nodeId, access);
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => _namespace.CreateFile(parentDirectory, name);
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.CreateDirectory(parentDirectory, name);
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => _namespace.DeleteFile(parentDirectory, name);
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.RemoveDirectory(parentDirectory, name);
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)
+    => _namespace.Rename(oldParent, oldName, newParent, newName, replace);
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)
+    => _namespace.CreateHardLink(existingNode, newParent, newName);
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)
+    => _namespace.CreateSymbolicLink(parentDirectory, name, target);
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) => _namespace.ReadSymbolicLink(nodeId);
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => _namespace.SetMetadata(nodeId, patch);
+  public void Flush() => _namespace.Flush();
+  public IFilesystemTransaction BeginTransaction() => _namespace.BeginTransaction();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _namespace.Dispose();
+    if (!_leaveOpen) _image.Dispose();
+  }
+
+  private IReadOnlyList<FilesystemSnapshotNode> BuildNodes(
+      RefsMetadataReader metadata,
+      IReadOnlyList<RefsFileRecord> records,
+      FilesystemNodeId rootId) {
+    var result = new List<FilesystemSnapshotNode>(records.Count + 1) {
+      new(rootId, default, string.Empty, FilesystemNodeKind.Directory, 0, 0),
+    };
+    var byPath = new Dictionary<string, FilesystemNodeId>(StringComparer.OrdinalIgnoreCase) {
+      [string.Empty] = rootId,
+    };
+    var usedIds = new HashSet<FilesystemNodeId> { rootId };
+    ulong synthetic = 0x8000_0000_0000_0000UL;
+
+    foreach (var record in records.OrderBy(r => Depth(r.Path)).ThenBy(r => r.Path, StringComparer.OrdinalIgnoreCase)) {
+      var path = Normalize(record.Path);
+      if (path.Length == 0) continue;
+      var slash = path.LastIndexOf('/');
+      var parentPath = slash < 0 ? string.Empty : path[..slash];
+      var name = slash < 0 ? path : path[(slash + 1)..];
+      if (!byPath.TryGetValue(parentPath, out var parentId))
+        throw new InvalidDataException($"ReFS namespace record '{path}' has no decoded parent '{parentPath}'.");
+
+      var candidate = TryNativeId(record, out var native)
+        ? new FilesystemNodeId(native, 1)
+        : new FilesystemNodeId(synthetic++, 1);
+      while (!usedIds.Add(candidate)) candidate = new FilesystemNodeId(synthetic++, 1);
+      byPath[path] = candidate;
+
+      var captured = record;
+      result.Add(new FilesystemSnapshotNode(
+        candidate,
+        parentId,
+        name,
+        record.IsDirectory ? FilesystemNodeKind.Directory : FilesystemNodeKind.RegularFile,
+        record.Size,
+        record.AllocatedSize,
+        LinkCount: 1,
+        NativeAttributes: record.Attributes,
+        Modified: ToOffset(record.Modified),
+        OpenReadHandle: record.IsDirectory ? null : () => new RefsFileHandle(
+          candidate, _image, _ioGate, metadata.ClusterSize, captured)));
+    }
+    return result;
+  }
+
+  private static bool TryNativeId(RefsFileRecord record, out ulong id) {
+    if (record.Backing != null && record.Backing.FileId != 0) {
+      id = record.Backing.FileId;
+      return true;
+    }
+    id = 0;
+    return false;
+  }
+
+  private static int Depth(string path) => Normalize(path).Count(c => c == '/');
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static DateTimeOffset? ToOffset(DateTime? value)
+    => value == null ? null : new DateTimeOffset(DateTime.SpecifyKind(value.Value, DateTimeKind.Utc), TimeSpan.Zero);
+}
+
+internal sealed class RefsFileHandle : IFilesystemFileHandle {
+  private readonly Stream _image;
+  private readonly object _ioGate;
+  private readonly int _clusterSize;
+  private readonly RefsFileRecord _record;
+  private bool _disposed;
+
+  public RefsFileHandle(
+      FilesystemNodeId nodeId,
+      Stream image,
+      object ioGate,
+      int clusterSize,
+      RefsFileRecord record) {
+    NodeId = nodeId;
+    _image = image;
+    _ioGate = ioGate;
+    _clusterSize = clusterSize;
+    _record = record;
+  }
+
+  public FilesystemNodeId NodeId { get; }
+  public long Length {
+    get {
+      ThrowIfDisposed();
+      return Math.Max(0, _record.Size);
+    }
+  }
+
+  public int Read(long offset, Span<byte> destination) {
+    ThrowIfDisposed();
+    if (offset < 0) throw new ArgumentOutOfRangeException(nameof(offset));
+    if (destination.Length == 0 || offset >= Length) return 0;
+    var requested = checked((int)Math.Min(destination.Length, Length - offset));
+
+    if (_record.IsResident) {
+      var content = _record.ResidentContent ?? [];
+      var count = Math.Min(requested, Math.Max(0, content.Length - checked((int)offset)));
+      if (count > 0) content.AsSpan(checked((int)offset), count).CopyTo(destination);
+      return count;
+    }
+
+    var written = 0;
+    var cursor = offset;
+    var remaining = requested;
+    foreach (var extent in _record.Extents.OrderBy(e => e.FileVcn)) {
+      if (remaining == 0) break;
+      var extentStart = checked((long)extent.FileVcn * _clusterSize);
+      var extentBytes = checked((long)extent.ClusterCount * _clusterSize);
+      var extentEnd = checked(extentStart + extentBytes);
+      if (cursor >= extentEnd || cursor + remaining <= extentStart) continue;
+
+      var start = Math.Max(cursor, extentStart);
+      var end = Math.Min(cursor + remaining, extentEnd);
+      if (start != cursor)
+        throw new InvalidDataException("ReFS decoded extents do not continuously cover the requested logical range.");
+      var take = checked((int)(end - start));
+      if (take <= 0) continue;
+
+      if (extent.IsSparse) {
+        destination.Slice(written, take).Clear();
+      } else {
+        var withinExtent = start - extentStart;
+        var physicalOffset = checked((long)extent.PhysicalLcn * _clusterSize + withinExtent);
+        lock (_ioGate) {
+          if (physicalOffset < 0 || physicalOffset > _image.Length - take)
+            throw new InvalidDataException("ReFS data extent points outside the image.");
+          _image.Position = physicalOffset;
+          _image.ReadExactly(destination.Slice(written, take));
+        }
+      }
+      written += take;
+      cursor += take;
+      remaining -= take;
+    }
+
+    if (remaining != 0)
+      throw new InvalidDataException("ReFS decoded extents do not cover the requested logical range.");
+    return written;
+  }
+
+  public void Write(long offset, ReadOnlySpan<byte> source)
+    => throw new NotSupportedException("The ReFS filesystem session is read-only.");
+  public void SetLength(long length)
+    => throw new NotSupportedException("The ReFS filesystem session is read-only.");
+  public void Flush() => ThrowIfDisposed();
+  public void Dispose() => _disposed = true;
+  private void ThrowIfDisposed() => ObjectDisposedException.ThrowIf(_disposed, this);
+}
diff --git a/FileSystems/FileSystem.Refs/RefsFormatDescriptor.cs b/FileSystems/FileSystem.Refs/RefsFormatDescriptor.cs
index 1309ce630..d8fd61553 100644
--- a/FileSystems/FileSystem.Refs/RefsFormatDescriptor.cs
+++ b/FileSystems/FileSystem.Refs/RefsFormatDescriptor.cs
@@ -19,7 +19,9 @@ public sealed class RefsFormatDescriptor :
   IArchiveFormatOperations,
   IFilesystemExtentMap,
   IArchiveDefragmentable,
-  ILayoutOptimizable {
+  ILayoutOptimizable,
+  IFilesystemDriverProvider,
+  IFilesystemDriverReadinessProvider {
 
   public string Id => "Refs";
   public string DisplayName => "ReFS";
@@ -40,7 +42,18 @@ public sealed class RefsFormatDescriptor :
   ];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
-  public string Description => "Microsoft ReFS 3.x volume image with namespace, allocation, in-place data relocation and filesystem-metadata placement support.";
+  public string Description => "Microsoft ReFS 3.x volume image with native read-only driver projection, namespace/allocation parsing, and offline filesystem-metadata placement support.";
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image)
+    => RefsFilesystemDriver.Probe(image);
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)
+    => RefsFilesystemDriver.Open(image, options);
+
+  public FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(
+      Stream image,
+      FilesystemDriverTarget target)
+    => RefsFilesystemDriver.Readiness(image, target);
 
   public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)
     => RefsExtentMap.Enumerate(image);
diff --git a/FileSystems/FileSystem.Refs/RefsOfflineModifier.cs b/FileSystems/FileSystem.Refs/RefsOfflineModifier.cs
new file mode 100644
index 000000000..3c5704aaa
--- /dev/null
+++ b/FileSystems/FileSystem.Refs/RefsOfflineModifier.cs
@@ -0,0 +1,395 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using System.Text;
+using Compression.Registry;
+
+namespace FileSystem.Refs;
+
+/// <summary>
+/// Offline-quiescent ReFS 3.x regular-file editor.
+///
+/// This is deliberately not a mounted-driver transaction layer. It operates on an
+/// unmounted image, reopens the active metadata graph between logical edits, uses
+/// allocator-verified storage for replacement data, and uses the existing immutable
+/// CoW B+ engine + alternate checkpoint publisher for namespace deletion so parent
+/// separator keys remain correct even when a leaf disappears.
+///
+/// Supported profile:
+/// - replace existing regular files whose live stream layout is resident or an
+///   ordinary non-sparse/non-integrity/non-shared extent holder understood by
+///   <see cref="RefsStreamLayoutEditor"/>;
+/// - remove regular files and empty directories;
+/// - release old ordinary data extents after the namespace/data repoint is live.
+///
+/// New-name insertion remains fail-closed until the directory-entry value template
+/// (file identity/security/link semantics) is derived for every writable ReFS 3.x
+/// profile. Replacing an existing name through <see cref="Add"/> is fully supported.
+/// </summary>
+internal static class RefsOfflineModifier {
+  private const ulong RootDirectoryOid = 0x600;
+
+  public static void Add(Stream image, IReadOnlyList<ArchiveInputInfo> inputs) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(inputs);
+    RequireWritableImage(image);
+
+    foreach (var input in inputs) {
+      if (input.IsDirectory) continue;
+      var path = NormalizePath(input.ArchiveName);
+      if (path.Length == 0)
+        throw new ArgumentException("ReFS entry path must not be empty.", nameof(inputs));
+
+      var metadata = RefsMetadataReader.Open(image);
+      var existing = new RefsNamespaceReader(metadata).ReadAll().FirstOrDefault(f =>
+        !f.IsDirectory && string.Equals(f.Path, path, StringComparison.OrdinalIgnoreCase));
+      if (existing == null)
+        throw new NotSupportedException(
+          $"ReFS offline R/W currently replaces existing regular files; creating the new namespace entry '{path}' " +
+          "is withheld until all file-identity/security/link fields are proven for the active ReFS profile.");
+
+      ReplaceExisting(image, path, input.ReadContent());
+    }
+  }
+
+  public static void Remove(Stream image, string[] entryNames) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(entryNames);
+    RequireWritableImage(image);
+
+    foreach (var raw in entryNames) {
+      var path = NormalizePath(raw);
+      if (path.Length == 0) continue;
+      RemoveOne(image, path);
+    }
+  }
+
+  private static void ReplaceExisting(Stream image, string path, byte[] data) {
+    var metadata = RefsMetadataReader.Open(image);
+    var files = new RefsNamespaceReader(metadata).ReadAll();
+    var file = files.FirstOrDefault(f =>
+      !f.IsDirectory && string.Equals(f.Path, path, StringComparison.OrdinalIgnoreCase))
+      ?? throw new FileNotFoundException($"ReFS file '{path}' is no longer reachable.", path);
+    if (file.Extents.Any(e => e.IsSparse || e.Flags == 0x1C00D0 || (e.Flags & 0x04) != 0))
+      throw new NotSupportedException(
+        $"ReFS file '{path}' uses sparse/integrity/shared allocation semantics outside the offline CRUD profile.");
+
+    var graph = new RefsMetadataGraph(image, metadata);
+    var writable = new RefsWritableNamespace(metadata);
+    var location = writable.ResolveStorage(path);
+
+    var clusterSize = metadata.ClusterSize;
+    var blocks = checked((data.LongLength + clusterSize - 1) / clusterSize);
+    if (blocks > int.MaxValue)
+      throw new NotSupportedException("ReFS replacement exceeds the supported allocation-run size.");
+
+    var targets = blocks == 0
+      ? Array.Empty<ulong>()
+      : SelectContiguousFreeDataRun(metadata, graph, checked((int)blocks));
+    var targetOffsets = targets.Select(lcn => checked((long)lcn * clusterSize)).ToArray();
+    var extents = RefsStreamLayoutEditor.BuildExtents(metadata, targetOffsets);
+    var allocatedBytes = checked((long)targets.Length * clusterSize);
+    var replacementFile = file with {
+      Size = data.LongLength,
+      AllocatedSize = allocatedBytes,
+    };
+    var replacementValue = RefsStreamLayoutEditor.BuildUpdatedValue(
+      replacementFile,
+      location.StorageRow,
+      extents,
+      clusterSize);
+
+    if (!RefsPageEditor.CanReplaceValue(graph, location.StorageRow, replacementValue.Length))
+      throw new NotSupportedException(
+        $"ReFS replacement for '{path}' would require an outer B+ page split; this offline value-repoint path refuses before allocating data.");
+
+    RefsBTreeRow? shortEntry = null;
+    byte[]? shortEntryValue = null;
+    if (location.UsesBackingRow) {
+      shortEntry = writable.FindDirectoryEntry(path);
+      if (shortEntry.Value.Length < 0x40)
+        throw new InvalidDataException("ReFS short directory entry is too small for size/allocation fields.");
+      shortEntryValue = shortEntry.Value.ToArray();
+      BinaryPrimitives.WriteUInt64LittleEndian(shortEntryValue.AsSpan(0x30, 8), checked((ulong)allocatedBytes));
+      BinaryPrimitives.WriteUInt64LittleEndian(shortEntryValue.AsSpan(0x38, 8), checked((ulong)data.LongLength));
+      if (shortEntryValue.Length >= 0x20)
+        BinaryPrimitives.WriteUInt64LittleEndian(shortEntryValue.AsSpan(0x18, 8), checked((ulong)DateTime.UtcNow.ToFileTimeUtc()));
+      if (!RefsPageEditor.CanReplaceValue(graph, shortEntry, shortEntryValue.Length))
+        throw new NotSupportedException(
+          $"ReFS parent entry for '{path}' cannot be updated without an outer B+ split.");
+    }
+
+    var newClaimed = false;
+    var metadataRepointed = false;
+    try {
+      if (targets.Length > 0) {
+        var allocator = FindAllocator(metadata, graph, targets[0]);
+        if (!targets.All(allocator.CoversPhysical))
+          throw new InvalidDataException("ReFS replacement run crosses allocator ownership boundaries.");
+        allocator.SetAllocated(targets, allocated: true);
+        image.Flush();
+        newClaimed = true;
+        WriteData(image, data, targets, clusterSize);
+        image.Flush();
+      }
+
+      var changedPages = new HashSet<ulong> {
+        RefsPageEditor.ReplaceValue(graph, location.StorageRow, replacementValue),
+      };
+      metadataRepointed = true;
+      if (shortEntry != null && shortEntryValue != null)
+        changedPages.Add(RefsPageEditor.ReplaceValue(graph, shortEntry, shortEntryValue));
+      graph.RefreshChecksumPaths(changedPages);
+      image.Flush();
+    } catch {
+      // Before the stream metadata points at the new allocation, the new run is
+      // merely an orphan reservation and can be released. After the repoint, a
+      // leak is safer than freeing bytes that may already be reachable.
+      if (newClaimed && !metadataRepointed)
+        TryReleaseAllocation(image, targets);
+      throw;
+    }
+
+    ReleaseOldData(image, file);
+  }
+
+  private static void RemoveOne(Stream image, string path) {
+    var metadata = RefsMetadataReader.Open(image);
+    var files = new RefsNamespaceReader(metadata).ReadAll();
+    var file = files.FirstOrDefault(f => string.Equals(f.Path, path, StringComparison.OrdinalIgnoreCase))
+      ?? throw new FileNotFoundException($"ReFS entry '{path}' was not found.", path);
+
+    if (file.IsDirectory && files.Any(f =>
+          !string.Equals(f.Path, path, StringComparison.OrdinalIgnoreCase)
+          && f.Path.StartsWith(path.TrimEnd('/') + "/", StringComparison.OrdinalIgnoreCase)))
+      throw new IOException($"ReFS directory '{path}' is not empty.");
+    if (!file.IsDirectory && file.Extents.Any(e => e.IsSparse || e.Flags == 0x1C00D0 || (e.Flags & 0x04) != 0))
+      throw new NotSupportedException(
+        $"ReFS file '{path}' uses sparse/integrity/shared allocation semantics outside the offline CRUD profile.");
+
+    var parent = ResolveParentDirectory(metadata, path);
+    var writable = new RefsWritableNamespace(metadata);
+    var entry = writable.FindDirectoryEntry(path);
+    var keys = new List<byte[]> { entry.Key.ToArray() };
+    if (!file.IsDirectory && file.Backing != null)
+      keys.Add(file.Backing.Row.Key.ToArray());
+
+    var store = new RefsCowPageStore(image, metadata);
+    var tree = new RefsCowBTree(image, metadata, store);
+    var parentTree = tree.Rewrite(parent.Root, virtualAddresses: true, (rows, comparer) => {
+      var removed = 0;
+      foreach (var key in keys) {
+        var index = FindKey(rows, key, comparer);
+        if (index < 0) continue;
+        rows.RemoveAt(index);
+        ++removed;
+      }
+      if (removed != keys.Count)
+        throw new InvalidDataException(
+          $"ReFS namespace/storage rows for '{path}' changed before deletion could be materialized.");
+      return true;
+    });
+
+    var objectEditor = new RefsCowObjectEditor(metadata, tree);
+    var objectTable = objectEditor.ReplaceObjectRoot(parent.ObjectId, parentTree.RootReference);
+    PublishOfflineCheckpoint(image, metadata, store, objectTable);
+
+    if (!file.IsDirectory)
+      ReleaseOldData(image, file);
+  }
+
+  /// <summary>
+  /// Publishes immutable namespace/Object-Table pages and the allocator roots that
+  /// account for their newly reserved metadata pages. There is intentionally no
+  /// synthetic MLog redo record here: this is the offline-quiescent transaction
+  /// boundary, not the native mounted-driver crash-recovery path.
+  /// </summary>
+  private static void PublishOfflineCheckpoint(
+      Stream image,
+      RefsMetadataReader metadata,
+      RefsCowPageStore store,
+      RefsCowTreeResult objectTable) {
+    var roots = new Dictionary<int, byte[]> { [0] = objectTable.RootReference };
+    var allocatorChanged = false;
+    foreach (var tier in new[] {
+               RefsAllocatorTier.Medium,
+               RefsAllocatorTier.Container,
+               RefsAllocatorTier.Small,
+             }) {
+      if (store.GetReservedClusters(tier).Count == 0) continue;
+      var publication = new RefsCowAllocatorPublisher(image, metadata, store).Publish(tier);
+      roots[publication.RootIndex] = publication.Tree.RootReference;
+      allocatorChanged = true;
+    }
+
+    var committer = new RefsCheckpointCommitter(image);
+    var prepared = committer.PrepareNext();
+    committer.SetRootReferences(prepared, roots);
+    committer.Commit(prepared, allocatorChanged: allocatorChanged);
+  }
+
+  private static ParentDirectory ResolveParentDirectory(RefsMetadataReader metadata, string path) {
+    var parts = NormalizePath(path).Split('/', StringSplitOptions.RemoveEmptyEntries);
+    if (parts.Length == 0) throw new ArgumentException("ReFS path is empty.", nameof(path));
+
+    var objects = BuildObjectMap(metadata);
+    if (!objects.TryGetValue(RootDirectoryOid, out var root))
+      throw new InvalidDataException("ReFS root directory object is absent from the Object Table.");
+    var oid = RootDirectoryOid;
+
+    for (var i = 0; i < parts.Length - 1; ++i) {
+      RefsBTreeRow? found = null;
+      foreach (var row in metadata.WalkTree(root, virtualAddresses: true)) {
+        if (row.Key.Length < 4 || BinaryPrimitives.ReadUInt16LittleEndian(row.Key.AsSpan(0, 2)) != 0x30)
+          continue;
+        var name = DecodeName(row.Key.AsSpan(4));
+        if (!string.Equals(name, parts[i], StringComparison.OrdinalIgnoreCase)) continue;
+        if (found != null)
+          throw new InvalidDataException($"ReFS directory '{parts[i]}' is ambiguous.");
+        found = row;
+      }
+      if (found == null || found.Value.Length < 0x44)
+        throw new DirectoryNotFoundException($"ReFS parent directory component '{parts[i]}' was not found.");
+      var attributes = BinaryPrimitives.ReadUInt32LittleEndian(found.Value.AsSpan(0x40, 4));
+      if ((attributes & 0x10000000) == 0)
+        throw new DirectoryNotFoundException($"ReFS path component '{parts[i]}' is not a directory.");
+      oid = BinaryPrimitives.ReadUInt64LittleEndian(found.Value.AsSpan(0x08, 8));
+      if (!objects.TryGetValue(oid, out root))
+        throw new InvalidDataException($"ReFS child directory OID 0x{oid:X} has no Object Table root.");
+    }
+    return new ParentDirectory(oid, root);
+  }
+
+  private static Dictionary<ulong, RefsPageReference> BuildObjectMap(RefsMetadataReader metadata) {
+    var result = new Dictionary<ulong, RefsPageReference>();
+    foreach (var row in metadata.WalkRoot(0)) {
+      if (row.Key.Length < 16 || row.Value.Length < 0x20 + metadata.PageReferenceSize) continue;
+      var oid = BinaryPrimitives.ReadUInt64LittleEndian(row.Key.AsSpan(8, 8));
+      var reference = RefsPageReference.Parse(row.Value.AsSpan(0x20));
+      if (reference.Lcns.Count > 0) result[oid] = reference;
+    }
+    return result;
+  }
+
+  private static int FindKey(IReadOnlyList<RefsTreeRow> rows, byte[] key, RefsKeyComparer comparer) {
+    for (var i = 0; i < rows.Count; ++i)
+      if (comparer.Compare(rows[i].Key, key) == 0) return i;
+    return -1;
+  }
+
+  private static ulong[] SelectContiguousFreeDataRun(
+      RefsMetadataReader metadata,
+      RefsMetadataGraph graph,
+      int count) {
+    var medium = new RefsAllocatorWriter(metadata, graph, RefsAllocatorTier.Medium);
+    if (!medium.TryFindFreeRun(count, out var start))
+      throw new IOException($"ReFS Medium Allocator has no verified contiguous free run of {count:N0} cluster(s).");
+    var result = new ulong[count];
+    for (var i = 0; i < count; ++i) result[i] = checked(start + (ulong)i);
+    return result;
+  }
+
+  private static RefsAllocatorWriter FindAllocator(
+      RefsMetadataReader metadata,
+      RefsMetadataGraph graph,
+      ulong physicalLcn) {
+    foreach (var tier in new[] {
+               RefsAllocatorTier.Medium,
+               RefsAllocatorTier.Container,
+               RefsAllocatorTier.Small,
+             }) {
+      var writer = new RefsAllocatorWriter(metadata, graph, tier);
+      if (writer.CoversPhysical(physicalLcn)) return writer;
+    }
+    throw new InvalidDataException($"No ReFS allocator tier covers PLCN 0x{physicalLcn:X}.");
+  }
+
+  private static void WriteData(Stream image, byte[] data, IReadOnlyList<ulong> targets, int clusterSize) {
+    var cursor = 0;
+    var buffer = new byte[clusterSize];
+    foreach (var lcn in targets) {
+      buffer.AsSpan().Clear();
+      var take = Math.Min(clusterSize, data.Length - cursor);
+      if (take > 0) data.AsSpan(cursor, take).CopyTo(buffer);
+      image.Position = checked((long)lcn * clusterSize);
+      image.Write(buffer);
+      cursor += take;
+    }
+    if (cursor != data.Length)
+      throw new IOException("ReFS replacement allocation did not receive every source byte.");
+  }
+
+  private static void ReleaseOldData(Stream image, RefsFileRecord file) {
+    var old = ExpandPhysicalClusters(file.Extents).Distinct().ToArray();
+    if (old.Length == 0) return;
+
+    var metadata = RefsMetadataReader.Open(image);
+    var graph = new RefsMetadataGraph(image, metadata);
+    var releasable = new RefsBlockRefcount(metadata, graph).DetachPhysicalReferences(old);
+    image.Flush();
+    if (releasable.Count == 0) return;
+
+    var fresh = RefsMetadataReader.Open(image);
+    var freshGraph = new RefsMetadataGraph(image, fresh);
+    var remaining = releasable.ToHashSet();
+    foreach (var tier in new[] {
+               RefsAllocatorTier.Medium,
+               RefsAllocatorTier.Container,
+               RefsAllocatorTier.Small,
+             }) {
+      var writer = new RefsAllocatorWriter(fresh, freshGraph, tier);
+      var covered = remaining.Where(writer.CoversPhysical).ToArray();
+      if (covered.Length == 0) continue;
+      writer.SetAllocated(covered, allocated: false);
+      foreach (var lcn in covered) remaining.Remove(lcn);
+      image.Flush();
+    }
+    // Unknown allocator ownership is intentionally leaked rather than guessed free.
+  }
+
+  private static IEnumerable<ulong> ExpandPhysicalClusters(IEnumerable<RefsDataExtent> extents) {
+    foreach (var extent in extents) {
+      if (extent.IsSparse) continue;
+      for (uint i = 0; i < extent.ClusterCount; ++i)
+        yield return checked(extent.PhysicalLcn + i);
+    }
+  }
+
+  private static void TryReleaseAllocation(Stream image, IReadOnlyList<ulong> targets) {
+    try {
+      if (targets.Count == 0) return;
+      var metadata = RefsMetadataReader.Open(image);
+      var graph = new RefsMetadataGraph(image, metadata);
+      var remaining = targets.ToHashSet();
+      foreach (var tier in new[] {
+                 RefsAllocatorTier.Medium,
+                 RefsAllocatorTier.Container,
+                 RefsAllocatorTier.Small,
+               }) {
+        var writer = new RefsAllocatorWriter(metadata, graph, tier);
+        var covered = remaining.Where(writer.CoversPhysical).ToArray();
+        if (covered.Length == 0) continue;
+        writer.SetAllocated(covered, allocated: false);
+        foreach (var lcn in covered) remaining.Remove(lcn);
+      }
+      image.Flush();
+    } catch {
+      // An allocation leak is safer than masking the original exception or
+      // freeing a range whose publication state became uncertain.
+    }
+  }
+
+  private static void RequireWritableImage(Stream image) {
+    if (!image.CanRead || !image.CanWrite || !image.CanSeek)
+      throw new ArgumentException("ReFS offline mutation requires a readable, writable, seekable unmounted image stream.", nameof(image));
+  }
+
+  private static string NormalizePath(string path)
+    => (path ?? string.Empty).Replace('\\', '/').Trim('/');
+
+  private static string DecodeName(ReadOnlySpan<byte> bytes) {
+    try { return Encoding.Unicode.GetString(bytes).TrimEnd('\0'); }
+    catch { return Convert.ToHexString(bytes); }
+  }
+
+  private sealed record ParentDirectory(ulong ObjectId, RefsPageReference Root);
+}
diff --git a/FileSystems/FileSystem.SquashFs/SquashFsFormatDescriptor.cs b/FileSystems/FileSystem.SquashFs/SquashFsFormatDescriptor.cs
index 7db822d49..838ec178a 100644
--- a/FileSystems/FileSystem.SquashFs/SquashFsFormatDescriptor.cs
+++ b/FileSystems/FileSystem.SquashFs/SquashFsFormatDescriptor.cs
@@ -5,9 +5,11 @@
 namespace FileSystem.SquashFs;
 
 /// <summary>
-/// R/W descriptor for SquashFS images ("hsqs" magic) — the compressed
-/// read-only filesystem used by live media and embedded Linux; this writer
-/// emits gzip-compressed images.
+/// Offline R/W descriptor for SquashFS images ("hsqs" magic). Linux mounts
+/// SquashFS read-only by design; the workbench nevertheless supports editing an
+/// existing image by verified rebuild, plus guarded physical re-layout where
+/// compressed metadata can be repointed safely. The writer emits gzip-compressed
+/// images.
 ///
 /// References:
 /// <list type="bullet">
@@ -38,13 +40,14 @@ public sealed class SquashFsFormatDescriptor : IFormatDescriptor, IArchiveFormat
   public string Id => "SquashFs";
   public string DisplayName => "SquashFS";
   public FormatCategory Category => FormatCategory.Archive;
-  // WORM (Write-Once-Read-Many), NOT R/W: SquashFS is a compressed, read-only image.
-  // Add/Remove go through the verified extract -> re-create rebuild (ModifyRebuilder),
-  // a full rewrite — the verb works but nothing is modified in place. Advertising
-  // CanModify would falsely claim genuine in-place R/W. See FormatCapabilities.cs.
+  // R/W describes the supported existing-image edit API. It does not imply that
+  // the Linux kernel can mount this filesystem writable or that every edit is
+  // byte-local: Add/Remove may perform a complete verified re-layout.
   public FormatCapabilities Capabilities =>
     FormatCapabilities.CanList | FormatCapabilities.CanExtract | FormatCapabilities.CanCreate |
-    FormatCapabilities.CanTest | FormatCapabilities.SupportsMultipleEntries | FormatCapabilities.SupportsDirectories;
+    FormatCapabilities.CanModify | FormatCapabilities.CanTest |
+    FormatCapabilities.SupportsMultipleEntries | FormatCapabilities.SupportsDirectories |
+    FormatCapabilities.SupportsOptimize;
   public string DefaultExtension => ".sqfs";
   public IReadOnlyList<string> Extensions => [".sqfs", ".squashfs", ".snap", ".appimage"];
   public IReadOnlyList<string> CompoundExtensions => [];
@@ -52,10 +55,10 @@ public sealed class SquashFsFormatDescriptor : IFormatDescriptor, IArchiveFormat
     new([(byte)'h', (byte)'s', (byte)'q', (byte)'s'], Confidence: 0.95),
     new([(byte)'s', (byte)'q', (byte)'s', (byte)'h'], Confidence: 0.95)
   ];
-  public IReadOnlyList<FormatMethodInfo> Methods => [new("squashfs", "SquashFS")];
+  public IReadOnlyList<FormatMethodInfo> Methods => [new("squashfs", "SquashFS", SupportsOptimize: true)];
   public string? TarCompressionFormatId => null;
   public AlgorithmFamily Family => AlgorithmFamily.Archive;
-  public string Description => "Linux compressed read-only filesystem";
+  public string Description => "Linux compressed read-only-on-mount filesystem with offline R/W and layout optimization";
 
   public List<ArchiveEntryInfo> List(Stream stream, string? password) {
     var r = new SquashFsReader(stream);
@@ -74,14 +77,6 @@ public void Extract(Stream stream, string outputDir, string? password, string[]?
     }
   }
 
-  /// <summary>
-  /// Opens a single filesystem entry as a bounded read-only stream. The
-  /// reader produces the decoded file bytes by walking the entry's extent
-  /// or block chain; the matched bytes are wrapped in a
-  /// <see cref="Compression.Registry.Streaming.BoundedEntryStream"/> sized
-  /// to the entry's logical length so cluster/extent slack past the entry's
-  /// end is physically unreachable through this view.
-  /// </summary>
   public Stream OpenEntry(Stream archive, string entryName, string? password) {
     ArgumentNullException.ThrowIfNull(archive);
     ArgumentNullException.ThrowIfNull(entryName);
@@ -98,7 +93,6 @@ public Stream OpenEntry(Stream archive, string entryName, string? password) {
       new MemoryStream(System.Array.Empty<byte>(), writable: false), 0, leaveOpen: false);
   }
 
-  /// <summary>Native in-memory single-entry extraction routed through the bounded <see cref="OpenEntry"/>.</summary>
   public byte[] ExtractEntryToMemory(Stream archive, string entryName, string? password) {
     using var s = this.OpenEntry(archive, entryName, password);
     using var memoryStream = new MemoryStream();
@@ -119,11 +113,6 @@ public void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, Format
     }
   }
 
-  /// <summary>
-  /// Resolves the writer's data block size from the schema. "Auto"/absent keeps
-  /// the <see cref="SquashFsWriter.DefaultBlockSize"/>; a pinned power-of-two size
-  /// label is parsed back to bytes.
-  /// </summary>
   private static uint ResolveBlockSize(FormatCreateOptions? options) {
     var parsed = FilesystemSchemaPresets.ParseSize(options?.GetOption("BlockSize", "Auto"));
     return parsed > 0 ? (uint)parsed : SquashFsWriter.DefaultBlockSize;
@@ -158,31 +147,12 @@ public void Remove(Stream archive, string[] entryNames)
   public void Defragment(Stream archive)
     => this.Defragment(archive, new DefragOptions { Mode = DefragMode.ConsolidateAtStart });
 
-  /// <summary>
-  /// Lays the image out again by writing it anew.
-  /// </summary>
-  /// <remarks>
-  /// A file's data blocks could be moved — the inode records where they start —
-  /// but that field lives inside a metadata block the writer compresses.
-  /// Patching it means compressing the block again, which changes its length,
-  /// which shifts every metadata block after it and invalidates every offset
-  /// stored into them: the inode references in the directory table, the
-  /// directory references in the inodes, and the table pointers in the
-  /// superblock. So this is a rebuild, and the extent map above is what tells
-  /// the truth about where the bytes are.
-  /// </remarks>
   public void Defragment(Stream archive, DefragOptions options) {
     ArgumentNullException.ThrowIfNull(archive);
     ArgumentNullException.ThrowIfNull(options);
 
-    // Moving what is out of place beats writing the image out again, even
-    // though the field that names a file's data lives inside a deflated
-    // metadata block: the block is taken apart, changed and packed again, and
-    // it has to come back no longer than it was.
     if (archive.CanSeek && archive.Length <= PlannerImageCap) {
       var planned = false;
-      // The in-place pass is kept only if every payload still reads back: it
-      // can refuse partway, and a rebuild is the honest answer when it does.
       DefragContentGuard.RunOrRebuild(archive,
         readContents: ReadPayloadsForGuard,
         inPlace: () => { DefragmentWithPlanner(archive, options); planned = true; },
@@ -194,13 +164,8 @@ public void Defragment(Stream archive, DefragOptions options) {
     this.DefragmentWithRebuild(archive, options);
   }
 
-  /// <summary>
-  /// Largest image the in-place pass is offered for. Its guard holds a copy of
-  /// the image to compare payloads across the pass.
-  /// </summary>
   private const long PlannerImageCap = 256L * 1024 * 1024;
 
-  /// <summary>Every file's bytes, as the guard compares them before and after.</summary>
   private static IReadOnlyList<byte[]> ReadPayloadsForGuard(Stream stream) {
     stream.Position = 0;
     var reader = new SquashFsReader(stream, leaveOpen: true);
@@ -211,7 +176,6 @@ private static IReadOnlyList<byte[]> ReadPayloadsForGuard(Stream stream) {
       .ToList();
   }
 
-  /// <summary>Plans the new layout, moves the data, then writes the inode table again.</summary>
   private void DefragmentWithPlanner(Stream archive, DefragOptions options) {
     archive.Position = 0;
     var mover = new SquashFsBlockMover();
@@ -235,8 +199,6 @@ private void DefragmentWithPlanner(Stream archive, DefragOptions options) {
     Compression.Core.Layout.DefragPlannerExecutor.Execute(archive, options, mover, moves,
       archive.Length, reinitAfterMove: null);
 
-    // The table is packed again once, because a block that has to grow can
-    // only be found out about after every field in it is final.
     mover.SettleInodeTable(archive);
 
     archive.Position = 0;
@@ -259,52 +221,15 @@ private void DefragmentWithRebuild(Stream archive, DefragOptions options)
       });
 
   /// <summary>
-  /// SquashFS is a compressed, read-only image: superblock, compressed data
-  /// blocks, fragment table, inode/directory tables and the export/id/lookup
-  /// tables are packed back-to-back with no free regions and no cluster tips
-  /// (file data is stored at the compressed-block level, so there is no
-  /// allocation slack to wipe).
-  ///
-  /// <para>Note: <see cref="EnumerateExtents"/> reports Used runs at synthetic,
-  /// uncompressed-size offsets for the defrag preview — those offsets do
-  /// <em>not</em> map to real on-disk positions, so this method deliberately
-  /// does not drive the generic wiper from them (doing so would zero live
-  /// compressed bytes). Cluster tips are not applicable; this returns 0.</para>
+  /// A canonical SquashFS image is fully packed. The real extent map marks all
+  /// non-file bytes as metadata-reserved, so there is no proven dead space to
+  /// scrub and this format-specific implementation is intentionally a no-op.
   /// </summary>
   public long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true) {
     ArgumentNullException.ThrowIfNull(image);
-    // Fully packed, read-only image — no free regions or cluster tips exist.
     return 0;
   }
 
-  /// <summary>
-  /// Why this image is laid out again by rebuilding rather than by moving.
-  /// </summary>
-  /// <remarks>
-  /// A file's data blocks sit where its inode says, and the inode sits inside a
-  /// metadata block the writer deflates. Repointing one means decompressing
-  /// that block, changing the field and compressing it again — and the result
-  /// is a different length, which moves every table that follows it and every
-  /// offset into them: the directory entries, the fragment table, the fields in
-  /// the superblock. Storing the block uncompressed instead does not help,
-  /// since uncompressed is the larger of the two. So there is no way to change
-  /// where a file lives without writing the tables again, which is the rebuild.
-  /// </remarks>
-  /// <summary>
-  /// Reports where the image's bytes actually are: the superblock and the
-  /// metadata tables as structure, and each file's compressed data blocks under
-  /// its name, at the offset its inode records.
-  /// </summary>
-  /// <remarks>
-  /// <para>This used to walk a cursor forward by each file's uncompressed size,
-  /// which described a volume that does not exist — the bytes on disk are
-  /// compressed and sit where the inode says. Anything reading that map was
-  /// handed offsets belonging to nothing.</para>
-  ///
-  /// <para>A file small enough to live in a shared fragment has no run of its
-  /// own and none is reported: its bytes are part of a block several files
-  /// share, which no single one of them owns.</para>
-  /// </remarks>
   public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image) {
     ArgumentNullException.ThrowIfNull(image);
     var result = new List<DefragBlockInfo>();
@@ -322,9 +247,8 @@ public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image) {
       }
       owned.Sort((a, b) => a.Start.CompareTo(b.Start));
 
-      // The image is packed: the superblock leads, the data blocks follow, and
-      // the inode, directory and fragment tables trail. Whatever no file claims
-      // is one of those, not free space.
+      // SquashFS is packed: everything not owned by a file data extent belongs
+      // to the superblock, fragment store, inode/directory tables or indexes.
       var cursor = 0L;
       foreach (var (start, end) in owned) {
         if (start > cursor)
@@ -336,7 +260,7 @@ public IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image) {
         result.Add(new DefragBlockInfo(cursor, image.Length - cursor,
           DefragBlockKind.MetadataReserved, "fragments and tables"));
     } catch {
-      // An image we cannot walk claims nothing; wiping it would zero live data.
+      // Fail closed: an image we cannot walk claims no free space.
       return [];
     }
     return result;
diff --git a/FileSystems/FileSystem.Xfs/XfsFilesystemDriverAdapter.cs b/FileSystems/FileSystem.Xfs/XfsFilesystemDriverAdapter.cs
new file mode 100644
index 000000000..62b21da03
--- /dev/null
+++ b/FileSystems/FileSystem.Xfs/XfsFilesystemDriverAdapter.cs
@@ -0,0 +1,493 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using System.Text;
+using Compression.Registry;
+
+namespace FileSystem.Xfs;
+
+/// <summary>
+/// Native XFS read-only driver sidecar. XFS inode numbers and di_gen are used
+/// as path-independent object identities; duplicate directory entries targeting
+/// one inode therefore naturally become hard links in the common session.
+/// The current reader supports local and inline extent forks. Btree-format data
+/// forks, sparse logical gaps and unsupported v5 incompat features fail closed
+/// until their mappings are decoded rather than being flattened incorrectly.
+/// </summary>
+public sealed class XfsFilesystemDriverAdapter :
+  IFilesystemDriverAdapter,
+  IBlockDeviceFilesystemDriverProvider {
+
+  public string FormatId => "Xfs";
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var original = image.CanSeek ? image.Position : 0;
+    try {
+      var geometry = XfsDriverGeometry.Parse(image);
+      using var reader = new XfsReader(image, leaveOpen: true);
+      var records = reader.Entries.ToArray();
+      geometry.ValidateInode(image, geometry.RootInode, requireDirectory: true);
+      foreach (var entry in records)
+        geometry.ValidateEntry(image, entry);
+
+      return new FilesystemDriverProfile(
+        FormatId,
+        geometry.Version >= 5 ? "XFS v5 native inode reader" : "XFS v4 native inode reader",
+        FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.HardLinks |
+        FilesystemDriverCapabilities.SymbolicLinks |
+        FilesystemDriverCapabilities.CaseSensitiveNames |
+        FilesystemDriverCapabilities.CasePreservingNames,
+        FilesystemMutationModel.None,
+        CanMount: true,
+        CanMountWritable: false,
+        [
+          "Native inode+di_gen identities are preserved; multiple decoded directory entries can reference the same session object as hard links.",
+          "Regular-file reads stream local/extent forks into a bounded positional spool; direct extent-at-offset handles are the next read-path optimization.",
+          "Sparse logical gaps and btree-format data forks are rejected because the current XfsReader extent streamer would otherwise flatten them.",
+          "Mounted writes remain disabled until allocation-group btrees, log transactions/replay and complete directory/data-fork mutation share one transactional core.",
+        ]);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException or OverflowException) {
+      return new FilesystemDriverProfile(
+        FormatId,
+        "unsupported or damaged XFS profile",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [FirstLine(e.Message)]);
+    } finally {
+      if (image.CanSeek) image.Position = original;
+    }
+  }
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(options);
+    if (!options.ReadOnly)
+      throw new NotSupportedException(
+        "XFS mounted writes require allocation-group btree updates plus log emission/replay and complete inode/directory mutation; offline archive mutation is not sufficient.");
+    var profile = ProbeFilesystem(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("XFS image is not mountable: " + string.Join("; ", profile.Limitations));
+    return new XfsReadOnlyFilesystemSession(image, profile, options.LeaveOpen);
+  }
+
+  public FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device) {
+    ArgumentNullException.ThrowIfNull(device);
+    using var stream = new BlockDeviceStream(device, leaveOpen: true);
+    return ProbeFilesystem(stream);
+  }
+
+  public IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(device);
+    ArgumentNullException.ThrowIfNull(options);
+    var stream = new BlockDeviceStream(device, leaveOpen: false);
+    try {
+      return OpenFilesystem(stream, options with { LeaveOpen = false });
+    } catch {
+      stream.Dispose();
+      throw;
+    }
+  }
+
+  public FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(
+      Stream image,
+      FilesystemDriverTarget target) {
+    var profile = ProbeFilesystem(image);
+    var readRequired =
+      FilesystemDriverReadinessLayer.ImageValidation |
+      FilesystemDriverReadinessLayer.Namespace |
+      FilesystemDriverReadinessLayer.SessionStableNodeIds |
+      FilesystemDriverReadinessLayer.NativeStableNodeIds |
+      FilesystemDriverReadinessLayer.ReadData |
+      FilesystemDriverReadinessLayer.RandomAccessRead;
+    var writeRequired = readRequired |
+      FilesystemDriverReadinessLayer.AllocationMap |
+      FilesystemDriverReadinessLayer.WriteData |
+      FilesystemDriverReadinessLayer.Truncate |
+      FilesystemDriverReadinessLayer.NamespaceMutation |
+      FilesystemDriverReadinessLayer.MetadataMutation |
+      FilesystemDriverReadinessLayer.Links |
+      FilesystemDriverReadinessLayer.Flush |
+      FilesystemDriverReadinessLayer.DurabilityModel |
+      FilesystemDriverReadinessLayer.Recovery |
+      FilesystemDriverReadinessLayer.Concurrency;
+
+    var available = profile.CanMount
+      ? readRequired |
+        FilesystemDriverReadinessLayer.AllocationMap |
+        FilesystemDriverReadinessLayer.Links |
+        FilesystemDriverReadinessLayer.ValidationCorpus
+      : FilesystemDriverReadinessLayer.None;
+    var blockers = new List<string>(profile.Limitations);
+    if (target == FilesystemDriverTarget.ReadWrite) {
+      blockers.Add("Implement direct positional extent/local/btree file handles, including sparse and unwritten extent semantics and extent-btree growth/merge.");
+      blockers.Add("Move create/unlink/mkdir/rmdir/rename/link/symlink behind common inode + dir2/dir3 shortform/block/leaf/node mutation with exact name-hash/collation semantics.");
+      blockers.Add("Unify bnobt/cntbt/inobt/finobt/rmapbt/refcountbt allocation ownership and per-AG free-space updates behind bounded block-device transactions.");
+      blockers.Add("Implement XFS log item formatting, transaction commit ordering, log grant/tail handling, recovery replay and superblock/AG/inode CRC publication.");
+      blockers.Add("Cover reflink/COW, realtime, quota, xattr/ACL, project ID, bigtime, sparse-inode and newer v5 feature profiles before allowing their mutation.");
+      blockers.Add("Add inode/dentry/AG locking plus crash fault-injection and xfs_repair/xfs_db interoperability corpora for mounted mutations.");
+    }
+    var required = target == FilesystemDriverTarget.ReadOnly ? readRequired : writeRequired;
+    return new FilesystemDriverReadinessReport(
+      FormatId,
+      target,
+      available,
+      required,
+      profile.CanMount && (available & required) == required,
+      UsesNativeProvider: true,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static string FirstLine(string message) {
+    var p = message.IndexOfAny(['\r', '\n']);
+    return p < 0 ? message : message[..p];
+  }
+}
+
+internal sealed class XfsReadOnlyFilesystemSession : IFilesystemSession {
+  private readonly Stream _image;
+  private readonly bool _leaveOpen;
+  private readonly object _ioGate = new();
+  private readonly XfsReader _reader;
+  private readonly XfsDriverGeometry _geometry;
+  private readonly ReadOnlyFilesystemSnapshotSession _namespace;
+  private bool _disposed;
+
+  public XfsReadOnlyFilesystemSession(Stream image, FilesystemDriverProfile profile, bool leaveOpen) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("XFS mounted reads require a readable, seekable image.", nameof(image));
+    _image = image;
+    _leaveOpen = leaveOpen;
+    _geometry = XfsDriverGeometry.Parse(image);
+    _reader = new XfsReader(image, leaveOpen: true);
+    var records = _reader.Entries.ToArray();
+    var rootInode = _geometry.ReadInode(image, _geometry.RootInode);
+    var rootId = new FilesystemNodeId(_geometry.RootInode, rootInode.Generation);
+    var (nodes, links) = BuildNamespace(records, rootId, rootInode);
+    _namespace = new ReadOnlyFilesystemSnapshotSession(profile, rootId, nodes, links);
+  }
+
+  public FilesystemDriverProfile Profile => _namespace.Profile;
+  public FilesystemNodeId RootNodeId => _namespace.RootNodeId;
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) => _namespace.Stat(nodeId);
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) => _namespace.Lookup(parentDirectory, name);
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) => _namespace.Enumerate(directory);
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) => _namespace.OpenFile(nodeId, access);
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => _namespace.CreateFile(parentDirectory, name);
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.CreateDirectory(parentDirectory, name);
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => _namespace.DeleteFile(parentDirectory, name);
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.RemoveDirectory(parentDirectory, name);
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)
+    => _namespace.Rename(oldParent, oldName, newParent, newName, replace);
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)
+    => _namespace.CreateHardLink(existingNode, newParent, newName);
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)
+    => _namespace.CreateSymbolicLink(parentDirectory, name, target);
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) => _namespace.ReadSymbolicLink(nodeId);
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => _namespace.SetMetadata(nodeId, patch);
+  public void Flush() => _namespace.Flush();
+  public IFilesystemTransaction BeginTransaction() => _namespace.BeginTransaction();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _namespace.Dispose();
+    _reader.Dispose();
+    if (!_leaveOpen) _image.Dispose();
+  }
+
+  private (FilesystemSnapshotNode[] Nodes, FilesystemSnapshotDirectoryEntry[] Links) BuildNamespace(
+      IReadOnlyList<XfsEntry> records,
+      FilesystemNodeId rootId,
+      XfsDriverInode rootInode) {
+    var nodes = new Dictionary<ulong, FilesystemSnapshotNode>();
+    var links = new List<FilesystemSnapshotDirectoryEntry>(records.Count);
+    var pathToNode = new Dictionary<string, FilesystemNodeId>(StringComparer.Ordinal) {
+      [string.Empty] = rootId,
+    };
+    nodes[_geometry.RootInode] = MakeNode(rootId, rootInode, string.Empty, default, null);
+
+    foreach (var record in records.OrderBy(r => Depth(r.Name)).ThenBy(r => r.Name, StringComparer.Ordinal)) {
+      var path = Normalize(record.Name);
+      var slash = path.LastIndexOf('/');
+      var parentPath = slash < 0 ? string.Empty : path[..slash];
+      var name = slash < 0 ? path : path[(slash + 1)..];
+      if (!pathToNode.TryGetValue(parentPath, out var parent))
+        throw new InvalidDataException($"XFS entry '{path}' has no decoded parent '{parentPath}'.");
+      if (record.InodeNumber <= 0)
+        throw new InvalidDataException($"XFS entry '{path}' has invalid inode {record.InodeNumber}.");
+
+      var ino = checked((ulong)record.InodeNumber);
+      var inode = _geometry.ReadInode(_image, ino);
+      var nodeId = new FilesystemNodeId(ino, inode.Generation);
+      if (!nodes.TryGetValue(ino, out var existing)) {
+        nodes[ino] = MakeNode(nodeId, inode, name, parent, record);
+      } else if (existing.NodeId != nodeId || existing.Kind != inode.Kind || existing.Size != (inode.Kind == FilesystemNodeKind.Directory ? 0 : inode.Size)) {
+        throw new InvalidDataException($"XFS hard-link aliases for inode {ino} disagree on object metadata.");
+      }
+
+      links.Add(new FilesystemSnapshotDirectoryEntry(parent, name, nodeId));
+      if (inode.Kind == FilesystemNodeKind.Directory)
+        pathToNode[path] = nodeId;
+    }
+    return (nodes.Values.ToArray(), links.ToArray());
+  }
+
+  private FilesystemSnapshotNode MakeNode(
+      FilesystemNodeId nodeId,
+      XfsDriverInode inode,
+      string name,
+      FilesystemNodeId parent,
+      XfsEntry? record) {
+    Func<IFilesystemFileHandle>? open = null;
+    string? symlink = null;
+    if (record != null && inode.Kind == FilesystemNodeKind.RegularFile) {
+      var captured = record;
+      open = () => SpoolingReadOnlyFileHandle.Create(
+        nodeId,
+        inode.Size,
+        output => {
+          long written;
+          lock (_ioGate) written = _reader.ExtractTo(captured, output);
+          if (written != inode.Size)
+            throw new InvalidDataException($"XFS inode {inode.Number} yielded {written:N0} of {inode.Size:N0} logical bytes.");
+        });
+    } else if (record != null && inode.Kind == FilesystemNodeKind.SymbolicLink) {
+      if (inode.Size > 64 * 1024)
+        throw new NotSupportedException($"XFS symlink inode {inode.Number} has implausible size {inode.Size:N0}.");
+      using var memory = new MemoryStream();
+      long written;
+      lock (_ioGate) written = _reader.ExtractTo(record, memory);
+      if (written != inode.Size)
+        throw new InvalidDataException($"XFS symlink inode {inode.Number} could not be decoded completely.");
+      symlink = Encoding.UTF8.GetString(memory.ToArray()).TrimEnd('\0');
+    }
+
+    return new FilesystemSnapshotNode(
+      nodeId,
+      parent,
+      name,
+      inode.Kind,
+      inode.Kind == FilesystemNodeKind.Directory ? 0 : inode.Size,
+      inode.AllocatedBytes,
+      LinkCount: inode.LinkCount,
+      NativeAttributes: ((ulong)inode.Format << 32) | inode.Mode,
+      Modified: inode.Modified,
+      SymbolicLinkTarget: symlink,
+      OpenReadHandle: open);
+  }
+
+  private static int Depth(string path) => Normalize(path).Count(c => c == '/');
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+}
+
+internal sealed record XfsDriverInode(
+  ulong Number,
+  ushort Mode,
+  FilesystemNodeKind Kind,
+  byte Format,
+  long Size,
+  long AllocatedBytes,
+  uint LinkCount,
+  uint Generation,
+  DateTimeOffset? Modified);
+
+internal readonly record struct XfsDriverGeometry(
+  uint BlockSize,
+  ushort InodeSize,
+  ulong RootInode,
+  uint AgBlocks,
+  uint AgCount,
+  byte AgBlockLog,
+  ushort VersionNumber,
+  uint FeaturesIncompat,
+  ulong DataBlocks) {
+
+  public int Version => VersionNumber & 0xF;
+  private int InodeForkOffset => Version >= 5 ? 176 : 100;
+  public long VolumeBytes => checked((long)Math.Min(DataBlocks, (ulong)(long.MaxValue / BlockSize)) * BlockSize);
+
+  public static XfsDriverGeometry Parse(Stream image) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("XFS driver probing requires a readable, seekable stream.", nameof(image));
+    if (image.Length < 512) throw new InvalidDataException("XFS image is too small for its superblock.");
+    Span<byte> sb = stackalloc byte[512];
+    var original = image.Position;
+    try {
+      image.Position = 0;
+      image.ReadExactly(sb);
+    } finally {
+      image.Position = original;
+    }
+    if (BinaryPrimitives.ReadUInt32BigEndian(sb[0..4]) != 0x58465342)
+      throw new InvalidDataException("XFS superblock magic is invalid.");
+    var blockSize = BinaryPrimitives.ReadUInt32BigEndian(sb[4..8]);
+    if (blockSize is < 512 or > 65536 || (blockSize & (blockSize - 1)) != 0)
+      throw new NotSupportedException($"XFS block size {blockSize:N0} is unsupported.");
+    var dblocks = BinaryPrimitives.ReadUInt64BigEndian(sb[8..16]);
+    var root = BinaryPrimitives.ReadUInt64BigEndian(sb[56..64]);
+    var agBlocks = BinaryPrimitives.ReadUInt32BigEndian(sb[84..88]);
+    var agCount = BinaryPrimitives.ReadUInt32BigEndian(sb[88..92]);
+    var version = BinaryPrimitives.ReadUInt16BigEndian(sb[100..102]);
+    var inodeSize = BinaryPrimitives.ReadUInt16BigEndian(sb[104..106]);
+    var agBlkLog = sb[124];
+    var incompat = (version & 0xF) >= 5 ? BinaryPrimitives.ReadUInt32BigEndian(sb[216..220]) : 0u;
+
+    if (inodeSize is < 256 or > 2048 || (inodeSize & (inodeSize - 1)) != 0)
+      throw new NotSupportedException($"XFS inode size {inodeSize:N0} is unsupported.");
+    if (root == 0 || agBlocks == 0 || agCount == 0 || dblocks == 0)
+      throw new InvalidDataException("XFS superblock has zero root/AG/data geometry.");
+    if (agBlkLog == 0 || agBlkLog >= 32)
+      throw new InvalidDataException($"XFS sb_agblklog {agBlkLog} is invalid.");
+    var declaredBytes = checked((long)Math.Min(dblocks, (ulong)(long.MaxValue / blockSize)) * blockSize);
+    if ((ulong)(declaredBytes / blockSize) != dblocks)
+      throw new NotSupportedException("XFS declared data-device size exceeds the addressable stream range.");
+    if (declaredBytes > image.Length)
+      throw new InvalidDataException($"XFS data device declares {declaredBytes:N0} bytes but image has {image.Length:N0}.");
+
+    // The current namespace/data reader only understands FTYPE among v5
+    // incompat features. Refuse any other incompat bit rather than interpreting
+    // newer on-disk structures with an older layout.
+    const uint ftype = 0x00000001;
+    var unsupported = incompat & ~ftype;
+    if (unsupported != 0)
+      throw new NotSupportedException($"XFS incompat feature bits 0x{unsupported:X8} are not decoded by the mounted reader.");
+
+    return new XfsDriverGeometry(blockSize, inodeSize, root, agBlocks, agCount, agBlkLog, version, incompat, dblocks);
+  }
+
+  public void ValidateEntry(Stream image, XfsEntry entry) {
+    if (entry.InodeNumber <= 0)
+      throw new InvalidDataException($"XFS entry '{entry.Name}' has invalid inode number {entry.InodeNumber}.");
+    var inode = ReadInode(image, checked((ulong)entry.InodeNumber));
+    if (entry.IsDirectory != (inode.Kind == FilesystemNodeKind.Directory))
+      throw new InvalidDataException($"XFS inode {inode.Number} type disagrees with directory entry '{entry.Name}'.");
+    if (!entry.IsDirectory && entry.Size != inode.Size)
+      throw new InvalidDataException($"XFS inode {inode.Number} size disagrees with directory entry '{entry.Name}'.");
+    ValidateInodeDataMap(image, inode);
+  }
+
+  public void ValidateInode(Stream image, ulong inodeNumber, bool requireDirectory = false) {
+    var inode = ReadInode(image, inodeNumber);
+    if (requireDirectory && inode.Kind != FilesystemNodeKind.Directory)
+      throw new InvalidDataException($"XFS root inode {inodeNumber} is not a directory.");
+    ValidateInodeDataMap(image, inode);
+  }
+
+  public XfsDriverInode ReadInode(Stream image, ulong inodeNumber) {
+    var offset = InodeOffset(inodeNumber);
+    if (offset < 0 || offset > image.Length - InodeSize)
+      throw new InvalidDataException($"XFS inode {inodeNumber} lies outside the data device.");
+    var inode = new byte[InodeSize];
+    var original = image.Position;
+    try {
+      image.Position = offset;
+      image.ReadExactly(inode);
+    } finally {
+      image.Position = original;
+    }
+    if (BinaryPrimitives.ReadUInt16BigEndian(inode.AsSpan(0, 2)) != 0x494E)
+      throw new InvalidDataException($"XFS inode {inodeNumber} has invalid magic.");
+    var mode = BinaryPrimitives.ReadUInt16BigEndian(inode.AsSpan(2, 2));
+    var kind = (mode & 0xF000) switch {
+      0x4000 => FilesystemNodeKind.Directory,
+      0x8000 => FilesystemNodeKind.RegularFile,
+      0xA000 => FilesystemNodeKind.SymbolicLink,
+      0x2000 => FilesystemNodeKind.CharacterDevice,
+      0x6000 => FilesystemNodeKind.BlockDevice,
+      0x1000 => FilesystemNodeKind.Fifo,
+      0xC000 => FilesystemNodeKind.Socket,
+      _ => FilesystemNodeKind.Unknown,
+    };
+    var format = inode[5];
+    if (format is not (1 or 2))
+      throw new NotSupportedException($"XFS inode {inodeNumber} uses data-fork format {format}; only local/extents are decoded by the mounted reader.");
+    var sizeU = BinaryPrimitives.ReadUInt64BigEndian(inode.AsSpan(56, 8));
+    if (sizeU > long.MaxValue) throw new NotSupportedException($"XFS inode {inodeNumber} size exceeds Int64.");
+    var size = (long)sizeU;
+    var blocks = BinaryPrimitives.ReadUInt64BigEndian(inode.AsSpan(64, 8));
+    var allocated = blocks > (ulong)(long.MaxValue / 512) ? long.MaxValue : (long)blocks * 512;
+    var links = BinaryPrimitives.ReadUInt32BigEndian(inode.AsSpan(16, 4));
+    var generation = inode.Length >= 96 ? BinaryPrimitives.ReadUInt32BigEndian(inode.AsSpan(92, 4)) : 0u;
+    DateTimeOffset? modified = null;
+    if (inode.Length >= 40) {
+      var seconds = BinaryPrimitives.ReadInt32BigEndian(inode.AsSpan(32, 4));
+      try { modified = DateTimeOffset.FromUnixTimeSeconds(seconds); } catch { }
+    }
+    return new XfsDriverInode(inodeNumber, mode, kind, format, size, allocated, links, generation, modified);
+  }
+
+  private void ValidateInodeDataMap(Stream image, XfsDriverInode inode) {
+    if (inode.Kind is FilesystemNodeKind.CharacterDevice or FilesystemNodeKind.BlockDevice or FilesystemNodeKind.Fifo or FilesystemNodeKind.Socket)
+      return;
+    if (inode.Format == 1) {
+      if (inode.Size > InodeSize - InodeForkOffset)
+        throw new InvalidDataException($"XFS local inode {inode.Number} size does not fit its data fork.");
+      return;
+    }
+
+    var offset = InodeOffset(inode.Number);
+    Span<byte> header = stackalloc byte[96];
+    var original = image.Position;
+    try {
+      image.Position = offset;
+      image.ReadExactly(header);
+    } finally {
+      image.Position = original;
+    }
+    var nextents = BinaryPrimitives.ReadUInt32BigEndian(header[76..80]);
+    var capacity = (InodeSize - InodeForkOffset) / 16;
+    if (nextents > capacity)
+      throw new NotSupportedException($"XFS inode {inode.Number} has {nextents} inline extents; extent-btree decoding is required.");
+
+    var extentBytes = new byte[checked((int)nextents * 16)];
+    if (extentBytes.Length > 0) {
+      try {
+        image.Position = offset + InodeForkOffset;
+        image.ReadExactly(extentBytes);
+      } finally {
+        image.Position = original;
+      }
+    }
+    ulong logical = 0;
+    for (var i = 0; i < nextents; ++i) {
+      var hi = BinaryPrimitives.ReadUInt64BigEndian(extentBytes.AsSpan(i * 16, 8));
+      var lo = BinaryPrimitives.ReadUInt64BigEndian(extentBytes.AsSpan(i * 16 + 8, 8));
+      var startOff = (hi >> 9) & 0x003F_FFFF_FFFF_FFFFUL;
+      var startBlock = ((hi & 0x1FF) << 43) | (lo >> 21);
+      var blockCount = lo & 0x1F_FFFFUL;
+      if (blockCount == 0) throw new InvalidDataException($"XFS inode {inode.Number} contains a zero-length extent.");
+      if (startOff != logical)
+        throw new NotSupportedException($"XFS inode {inode.Number} has a sparse/non-contiguous logical extent map; mounted sparse reads are not decoded yet.");
+      if (startBlock >= DataBlocks || blockCount > DataBlocks - startBlock)
+        throw new InvalidDataException($"XFS inode {inode.Number} extent points outside the data device.");
+      logical += blockCount;
+    }
+    var covered = checked(logical * BlockSize);
+    if (covered < (ulong)inode.Size)
+      throw new InvalidDataException($"XFS inode {inode.Number} extents cover {covered:N0} of {inode.Size:N0} logical bytes.");
+  }
+
+  private long InodeOffset(ulong ino) {
+    var inodesPerBlock = BlockSize / InodeSize;
+    if (inodesPerBlock == 0 || (inodesPerBlock & (inodesPerBlock - 1)) != 0)
+      throw new NotSupportedException("XFS inodes-per-block is not a power of two.");
+    var inoPbLog = 0;
+    for (var v = inodesPerBlock; v > 1; v >>= 1) ++inoPbLog;
+    var aginoLog = checked(AgBlockLog + inoPbLog);
+    if (aginoLog >= 64) throw new InvalidDataException("XFS inode geometry overflows native inode encoding.");
+    var agNo = ino >> aginoLog;
+    var agInoMask = aginoLog == 64 ? ulong.MaxValue : (1UL << aginoLog) - 1;
+    var agIno = ino & agInoMask;
+    var block = agIno / inodesPerBlock;
+    var index = agIno % inodesPerBlock;
+    if (agNo >= AgCount || block >= AgBlocks)
+      throw new InvalidDataException($"XFS inode {ino} encodes an invalid allocation-group position.");
+    return checked((long)((agNo * AgBlocks + block) * BlockSize + index * InodeSize));
+  }
+}
diff --git a/FileSystems/FileSystem.Zfs/ZfsFilesystemDriverAdapter.cs b/FileSystems/FileSystem.Zfs/ZfsFilesystemDriverAdapter.cs
new file mode 100644
index 000000000..f54a9e977
--- /dev/null
+++ b/FileSystems/FileSystem.Zfs/ZfsFilesystemDriverAdapter.cs
@@ -0,0 +1,345 @@
+#pragma warning disable CS1591
+using System.Buffers.Binary;
+using Compression.Registry;
+
+namespace FileSystem.Zfs;
+
+/// <summary>
+/// Native read-only ZFS sidecar for the repository's v28 single-vdev profile.
+/// Dataset dnode object IDs are preserved as path-independent identities and
+/// file bytes are streamed through <see cref="ZfsReader"/>, which validates the
+/// Fletcher-4 checksum of every block it follows.  The driver rejects compressed
+/// or hole-bearing data mappings instead of exposing the raw physical bytes as
+/// logical file contents.
+/// </summary>
+public sealed class ZfsFilesystemDriverAdapter :
+  IFilesystemDriverAdapter,
+  IBlockDeviceFilesystemDriverProvider {
+
+  public string FormatId => "Zfs";
+
+  public FilesystemDriverProfile ProbeFilesystem(Stream image) {
+    ArgumentNullException.ThrowIfNull(image);
+    var original = image.CanSeek ? image.Position : 0;
+    try {
+      var geometry = ZfsDriverGeometry.Parse(image);
+      using var reader = new ZfsReader(image, leaveOpen: true);
+      var layout = ZfsLayout.Read(image)
+        ?? throw new InvalidDataException("ZFS block-pointer layout could not be resolved.");
+      ValidateEntries(image, reader.Entries, layout);
+
+      return new FilesystemDriverProfile(
+        FormatId,
+        $"ZFS v{geometry.Version} native dnode reader",
+        FilesystemDriverCapabilities.EnumerateDirectories |
+        FilesystemDriverCapabilities.ReadData |
+        FilesystemDriverCapabilities.RandomAccess |
+        FilesystemDriverCapabilities.StableNodeIds |
+        FilesystemDriverCapabilities.HardLinks |
+        FilesystemDriverCapabilities.CaseSensitiveNames |
+        FilesystemDriverCapabilities.CasePreservingNames,
+        FilesystemMutationModel.None,
+        CanMount: true,
+        CanMountWritable: false,
+        [
+          $"Dataset dnode object IDs are preserved as native node identities; selected uberblock TXG is {geometry.Txg}.",
+          "Regular files are accepted only when their complete logical data is covered by uncompressed, non-hole block pointers understood by ZfsReader/ZfsLayout.",
+          "Fletcher-4 verification remains on the read path; positional file handles spool the checksum-verified logical stream and never require a whole-file byte array.",
+          "The native profile is intentionally limited to legacy v28 single-vdev semantics; feature-flag pools, RAID-Z/mirror repair, encryption and advanced compression remain outside this mount target.",
+          "Mounted writes remain disabled until TXG publication, metaslab/spacemap ownership, ZIL replay and complete DSL/ZAP/dnode mutation share one crash-consistent transaction core.",
+        ]);
+    } catch (Exception e) when (e is InvalidDataException or NotSupportedException or IOException or ArgumentException or OverflowException) {
+      return new FilesystemDriverProfile(
+        FormatId,
+        "unsupported or damaged ZFS native profile",
+        FilesystemDriverCapabilities.None,
+        FilesystemMutationModel.None,
+        CanMount: false,
+        CanMountWritable: false,
+        [FirstLine(e.Message)]);
+    } finally {
+      if (image.CanSeek) image.Position = original;
+    }
+  }
+
+  public IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(image);
+    ArgumentNullException.ThrowIfNull(options);
+    if (!options.ReadOnly)
+      throw new NotSupportedException(
+        "ZFS mounted writes require TXG/ZIL publication, metaslab/spacemap allocation and complete CoW DSL/ZAP/dnode mutation; offline archive modification is not a mounted transaction model.");
+
+    var profile = ProbeFilesystem(image);
+    if (!profile.CanMount)
+      throw new InvalidDataException("ZFS image is not accepted by the native mounted profile: " + string.Join("; ", profile.Limitations));
+    return new ZfsReadOnlyFilesystemSession(image, profile, options.LeaveOpen);
+  }
+
+  public FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device) {
+    ArgumentNullException.ThrowIfNull(device);
+    using var stream = new BlockDeviceStream(device, leaveOpen: true);
+    return ProbeFilesystem(stream);
+  }
+
+  public IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options) {
+    ArgumentNullException.ThrowIfNull(device);
+    ArgumentNullException.ThrowIfNull(options);
+    var stream = new BlockDeviceStream(device, leaveOpen: false);
+    try {
+      return OpenFilesystem(stream, options with { LeaveOpen = false });
+    } catch {
+      stream.Dispose();
+      throw;
+    }
+  }
+
+  public FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(
+      Stream image,
+      FilesystemDriverTarget target) {
+    var profile = ProbeFilesystem(image);
+    var readRequired =
+      FilesystemDriverReadinessLayer.ImageValidation |
+      FilesystemDriverReadinessLayer.Namespace |
+      FilesystemDriverReadinessLayer.SessionStableNodeIds |
+      FilesystemDriverReadinessLayer.NativeStableNodeIds |
+      FilesystemDriverReadinessLayer.ReadData |
+      FilesystemDriverReadinessLayer.RandomAccessRead;
+    var writeRequired = readRequired |
+      FilesystemDriverReadinessLayer.AllocationMap |
+      FilesystemDriverReadinessLayer.WriteData |
+      FilesystemDriverReadinessLayer.Truncate |
+      FilesystemDriverReadinessLayer.NamespaceMutation |
+      FilesystemDriverReadinessLayer.MetadataMutation |
+      FilesystemDriverReadinessLayer.Links |
+      FilesystemDriverReadinessLayer.Flush |
+      FilesystemDriverReadinessLayer.DurabilityModel |
+      FilesystemDriverReadinessLayer.Recovery |
+      FilesystemDriverReadinessLayer.Concurrency;
+
+    var available = profile.CanMount
+      ? readRequired |
+        FilesystemDriverReadinessLayer.AllocationMap |
+        FilesystemDriverReadinessLayer.Links |
+        FilesystemDriverReadinessLayer.ValidationCorpus
+      : FilesystemDriverReadinessLayer.None;
+    var blockers = new List<string>(profile.Limitations);
+    if (target == FilesystemDriverTarget.ReadWrite) {
+      blockers.Add("Implement gang blocks, holes, ditto copies, mirrors/RAID-Z reconstruction and all enabled compression/checksum algorithms as logical block mappings.");
+      blockers.Add("Implement dnode bonus/SA, ZAP micro/fat update, directory link/unlink/rename, hard links, symlinks, xattrs, ACLs and exact ZPL metadata semantics.");
+      blockers.Add("Allocate/free through metaslabs, space maps and deferred frees while preserving birth TXGs and reference ownership for snapshots/clones.");
+      blockers.Add("Publish dirty object sets through a new TXG and uberblock only after all child blocks/checksums are durable; never overwrite the active graph in place.");
+      blockers.Add("Implement ZIL intent-log emission, commit records and replay ordering so synchronous mutations survive crashes before their TXG reaches the uberblock ring.");
+      blockers.Add("Cover feature-flag pools, snapshots/clones, encryption, send/receive metadata, multi-vdev topologies and crash fault-injection with zpool import/scrub interoperability tests.");
+    }
+
+    var required = target == FilesystemDriverTarget.ReadOnly ? readRequired : writeRequired;
+    return new FilesystemDriverReadinessReport(
+      FormatId,
+      target,
+      available,
+      required,
+      profile.CanMount && (available & required) == required,
+      UsesNativeProvider: true,
+      blockers.Distinct(StringComparer.Ordinal).ToArray());
+  }
+
+  private static void ValidateEntries(Stream image, IReadOnlyList<ZfsEntry> entries, ZfsLayout.Layout layout) {
+    var paths = new HashSet<string>(StringComparer.Ordinal);
+    var dataByOwner = layout.DataBlocks
+      .GroupBy(b => Normalize(b.Owner), StringComparer.Ordinal)
+      .ToDictionary(g => g.Key, g => g.ToArray(), StringComparer.Ordinal);
+
+    foreach (var entry in entries) {
+      var path = Normalize(entry.Name);
+      if (path.Length == 0 || !paths.Add(path))
+        throw new InvalidDataException($"ZFS namespace contains an empty or duplicate path '{path}'.");
+      if (entry.ObjectId == 0)
+        throw new InvalidDataException($"ZFS entry '{path}' has object id zero.");
+      if (entry.Size < 0)
+        throw new InvalidDataException($"ZFS entry '{path}' has a negative logical size.");
+      if (entry.IsDirectory || entry.Size == 0) continue;
+
+      if (!dataByOwner.TryGetValue(path, out var blocks) || blocks.Length == 0)
+        throw new NotSupportedException($"ZFS file '{path}' has no completely decoded physical data mapping.");
+
+      long logicalCoverage = 0;
+      foreach (var block in blocks.OrderBy(b => b.Offset)) {
+        var props = ReadUInt64(image, checked(block.PointerOffset + 0x30));
+        var logicalSectors = (props & 0xFFFFUL) + 1;
+        var compression = (byte)((props >> 32) & 0x7F);
+        var checksum = (byte)((props >> 40) & 0xFF);
+        if (compression != ZfsConstants.ZioCompressOff)
+          throw new NotSupportedException($"ZFS file '{path}' uses compression id {compression}; the native driver currently accepts uncompressed records only.");
+        if (checksum != ZfsConstants.ZioChecksumFletcher4)
+          throw new NotSupportedException($"ZFS file '{path}' uses checksum id {checksum}; the native profile currently requires Fletcher-4.");
+        logicalCoverage = checked(logicalCoverage + checked((long)logicalSectors * ZfsConstants.SectorSize));
+      }
+      if (logicalCoverage < entry.Size)
+        throw new NotSupportedException(
+          $"ZFS file '{path}' has only {logicalCoverage:N0} decoded logical bytes for a {entry.Size:N0}-byte file (hole/gang/unsupported mapping)." );
+    }
+  }
+
+  private static ulong ReadUInt64(Stream image, long offset) {
+    Span<byte> bytes = stackalloc byte[8];
+    var original = image.Position;
+    try {
+      image.Position = offset;
+      image.ReadExactly(bytes);
+      return BinaryPrimitives.ReadUInt64LittleEndian(bytes);
+    } finally {
+      image.Position = original;
+    }
+  }
+
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static string FirstLine(string message) {
+    var p = message.IndexOfAny(['\r', '\n']);
+    return p < 0 ? message : message[..p];
+  }
+}
+
+internal sealed class ZfsReadOnlyFilesystemSession : IFilesystemSession {
+  private readonly Stream _image;
+  private readonly bool _leaveOpen;
+  private readonly object _ioGate = new();
+  private readonly ZfsReader _reader;
+  private readonly ReadOnlyFilesystemSnapshotSession _namespace;
+  private bool _disposed;
+
+  public ZfsReadOnlyFilesystemSession(Stream image, FilesystemDriverProfile profile, bool leaveOpen) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("ZFS mounted reads require a readable, seekable image.", nameof(image));
+    _image = image;
+    _leaveOpen = leaveOpen;
+    _reader = new ZfsReader(image, leaveOpen: true);
+    var records = _reader.Entries.ToArray();
+    var rootId = new FilesystemNodeId(0, 0); // synthetic namespace root; dataset objects retain native dnode IDs.
+    var (nodes, links) = BuildNamespace(records, rootId);
+    _namespace = new ReadOnlyFilesystemSnapshotSession(profile, rootId, nodes, links);
+  }
+
+  public FilesystemDriverProfile Profile => _namespace.Profile;
+  public FilesystemNodeId RootNodeId => _namespace.RootNodeId;
+  public FilesystemNodeInfo Stat(FilesystemNodeId nodeId) => _namespace.Stat(nodeId);
+  public FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name) => _namespace.Lookup(parentDirectory, name);
+  public IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory) => _namespace.Enumerate(directory);
+  public IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access) => _namespace.OpenFile(nodeId, access);
+  public FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name) => _namespace.CreateFile(parentDirectory, name);
+  public FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.CreateDirectory(parentDirectory, name);
+  public void DeleteFile(FilesystemNodeId parentDirectory, string name) => _namespace.DeleteFile(parentDirectory, name);
+  public void RemoveDirectory(FilesystemNodeId parentDirectory, string name) => _namespace.RemoveDirectory(parentDirectory, name);
+  public void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace) => _namespace.Rename(oldParent, oldName, newParent, newName, replace);
+  public void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName) => _namespace.CreateHardLink(existingNode, newParent, newName);
+  public FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target) => _namespace.CreateSymbolicLink(parentDirectory, name, target);
+  public string ReadSymbolicLink(FilesystemNodeId nodeId) => _namespace.ReadSymbolicLink(nodeId);
+  public void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch) => _namespace.SetMetadata(nodeId, patch);
+  public void Flush() => _namespace.Flush();
+  public IFilesystemTransaction BeginTransaction() => _namespace.BeginTransaction();
+
+  public void Dispose() {
+    if (_disposed) return;
+    _disposed = true;
+    _namespace.Dispose();
+    _reader.Dispose();
+    if (!_leaveOpen) _image.Dispose();
+  }
+
+  private (FilesystemSnapshotNode[] Nodes, FilesystemSnapshotDirectoryEntry[] Links) BuildNamespace(
+      IReadOnlyList<ZfsEntry> records,
+      FilesystemNodeId rootId) {
+    var aliases = records.GroupBy(r => r.ObjectId).ToDictionary(g => g.Key, g => checked((uint)g.Count()));
+    var nodes = new Dictionary<ulong, FilesystemSnapshotNode> {
+      [0] = new(rootId, default, string.Empty, FilesystemNodeKind.Directory, 0, 0),
+    };
+    var links = new List<FilesystemSnapshotDirectoryEntry>(records.Count);
+    var pathToNode = new Dictionary<string, FilesystemNodeId>(StringComparer.Ordinal) { [string.Empty] = rootId };
+
+    foreach (var record in records.OrderBy(r => Depth(r.Name)).ThenBy(r => r.Name, StringComparer.Ordinal)) {
+      var path = Normalize(record.Name);
+      var slash = path.LastIndexOf('/');
+      var parentPath = slash < 0 ? string.Empty : path[..slash];
+      var name = slash < 0 ? path : path[(slash + 1)..];
+      if (!pathToNode.TryGetValue(parentPath, out var parent))
+        throw new InvalidDataException($"ZFS entry '{path}' has no decoded parent '{parentPath}'.");
+
+      var nodeId = new FilesystemNodeId(record.ObjectId, 0);
+      var kind = record.IsDirectory ? FilesystemNodeKind.Directory : FilesystemNodeKind.RegularFile;
+      if (!nodes.TryGetValue(record.ObjectId, out var existing)) {
+        Func<IFilesystemFileHandle>? open = null;
+        if (kind == FilesystemNodeKind.RegularFile) {
+          var captured = record;
+          open = () => SpoolingReadOnlyFileHandle.Create(
+            nodeId,
+            captured.Size,
+            output => {
+              long written;
+              lock (_ioGate) written = _reader.ExtractTo(captured, output);
+              if (written != captured.Size)
+                throw new InvalidDataException($"ZFS dnode {captured.ObjectId} yielded {written:N0} of {captured.Size:N0} logical bytes.");
+            });
+        }
+
+        nodes[record.ObjectId] = new FilesystemSnapshotNode(
+          nodeId,
+          parent,
+          name,
+          kind,
+          kind == FilesystemNodeKind.Directory ? 0 : record.Size,
+          0,
+          LinkCount: aliases[record.ObjectId],
+          Modified: ToOffset(record.LastModified),
+          OpenReadHandle: open);
+      } else if (existing.Kind != kind || existing.Size != (kind == FilesystemNodeKind.Directory ? 0 : record.Size)) {
+        throw new InvalidDataException($"ZFS aliases for object {record.ObjectId} disagree on object metadata.");
+      }
+
+      links.Add(new FilesystemSnapshotDirectoryEntry(parent, name, nodeId));
+      if (kind == FilesystemNodeKind.Directory) pathToNode[path] = nodeId;
+    }
+
+    return (nodes.Values.ToArray(), links.ToArray());
+  }
+
+  private static int Depth(string path) => Normalize(path).Count(c => c == '/');
+  private static string Normalize(string path) => path.Replace('\\', '/').Trim('/');
+  private static DateTimeOffset? ToOffset(DateTime? value)
+    => value == null ? null : new DateTimeOffset(DateTime.SpecifyKind(value.Value, DateTimeKind.Utc), TimeSpan.Zero);
+}
+
+internal readonly record struct ZfsDriverGeometry(ulong Version, ulong Txg) {
+  public static ZfsDriverGeometry Parse(Stream image) {
+    if (!image.CanRead || !image.CanSeek)
+      throw new ArgumentException("ZFS driver probing requires a readable, seekable stream.", nameof(image));
+    if (image.Length < ZfsConstants.LabelSize)
+      throw new InvalidDataException("ZFS image is too small for a vdev label.");
+
+    var original = image.Position;
+    try {
+      Span<byte> slot = stackalloc byte[40];
+      ulong bestTxg = 0;
+      ulong bestVersion = 0;
+      var found = false;
+      for (long at = ZfsConstants.UberblockArrayOffset;
+           at + ZfsConstants.UberblockSize <= ZfsConstants.LabelSize;
+           at += ZfsConstants.UberblockSize) {
+        image.Position = at;
+        image.ReadExactly(slot);
+        if (BinaryPrimitives.ReadUInt64LittleEndian(slot) != ZfsConstants.UberblockMagic) continue;
+        var version = BinaryPrimitives.ReadUInt64LittleEndian(slot[8..]);
+        var txg = BinaryPrimitives.ReadUInt64LittleEndian(slot[16..]);
+        if (!found || txg > bestTxg) {
+          found = true;
+          bestTxg = txg;
+          bestVersion = version;
+        }
+      }
+      if (!found) throw new InvalidDataException("ZFS vdev label contains no valid uberblock magic.");
+      if (bestVersion != ZfsConstants.PoolVersion)
+        throw new NotSupportedException($"ZFS pool version {bestVersion} is outside the native v{ZfsConstants.PoolVersion} mounted profile.");
+      return new ZfsDriverGeometry(bestVersion, bestTxg);
+    } finally {
+      image.Position = original;
+    }
+  }
+}
diff --git a/Hawkynt.FileFormats.Archives/README.md b/Hawkynt.FileFormats.Archives/README.md
index 6df766d07..29f31f861 100644
--- a/Hawkynt.FileFormats.Archives/README.md
+++ b/Hawkynt.FileFormats.Archives/README.md
@@ -615,7 +615,7 @@ This package is built against the repository's shared Core version. Consume a mu
 
 <!-- API:BEGIN generated by Hawkynt/RepositoryTemplate/package-readme — edit the XML docs in source, not here -->
 
-Every public and protected member of all 968 types, generated from the built assembly and its XML documentation, is in [REFERENCE.md](https://github.com/Hawkynt/CompressionWorkbench/blob/main/Hawkynt.FileFormats.Archives/REFERENCE.md).
+Every public and protected member of all 969 types, generated from the built assembly and its XML documentation, is in [REFERENCE.md](https://github.com/Hawkynt/CompressionWorkbench/blob/main/Hawkynt.FileFormats.Archives/REFERENCE.md).
 
 <!-- API:END -->
 
diff --git a/Hawkynt.FileFormats.Archives/REFERENCE.md b/Hawkynt.FileFormats.Archives/REFERENCE.md
index 713901e72..a7f301bd2 100644
--- a/Hawkynt.FileFormats.Archives/REFERENCE.md
+++ b/Hawkynt.FileFormats.Archives/REFERENCE.md
@@ -124,7 +124,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 Pseudo-archive descriptor for Windows ICO/CUR icon bundles. Each embedded image (PNG or DIB) is exposed as its own archive entry; creating a bundle from PNG/BMP inputs is supported. References: `https://en.wikipedia.org/wiki/ICO_(file_format)` — Wikipedia — documents the ICONDIR / ICONDIRENTRY directory and PNG/DIB payloads"The evolution of the ICO file format" — Raymond Chen, The Old New Thing (Microsoft DevBlogs) series
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveWriteConstraints`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveWriteConstraints`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -247,7 +247,7 @@ Represents a file entry in an ACE archive.
 
 ACE archive (Marcel Lemke / WinAce) — proprietary high-ratio DOS/Windows compressor of the late 1990s. References: `https://github.com/droe/acefile` — acefile — open-source ACE 1.0/2.0 reader/extractor, the de-facto format reference`https://en.wikipedia.org/wiki/ACE_(compressed_file_format)` — format overview and historyWinAce / unacev2.dll (Marcel Lemke) — the original closed-source implementation; no official spec was ever published
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -429,7 +429,7 @@ Decoder for inflated FileMeta record bodies (record types 102, 1, 2, 5).
 
 Format descriptor for Acronis True Image classic .tib backups. References: `https://github.com/dennisss/acronis-tib` — community reverse-engineering of the .tib record stream (the upstream spec this reader is built on)Acronis True Image / Cyber Protect Home Office vendor documentation — the format itself is proprietary and unpublished
 
-Implements `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1076,7 +1076,7 @@ Represents a single file entry in a Sega AFS archive.
 
 Sega AFS archive ("AFS\0" magic) — audio/data container used by Dreamcast, PS2 and GameCube era titles. References: `https://github.com/MaikelChan/AFSPacker` — AFSPacker — open-source AFS extractor/creator, the de-facto format referenceThe container was never documented by Sega/CRI; the offset-table layout was recovered by the game-modding community
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1147,7 +1147,7 @@ Represents a single audio entry within a Square Enix AKB audio bank.
 
 Square Enix AKB audio bank descriptor — surfaces per-entry raw audio payloads plus a synthetic `metadata.ini` entry containing bank-wide header fields (sample rate, channel mode, loop points). References: `https://github.com/vgmstream/vgmstream` — vgmstream — implements AKB parsing; the de-facto referenceSquare Enix never published the AKB layout; header fields were recovered by the VGM ripping community
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1235,7 +1235,7 @@ Represents a single file entry in an ALZip (.alz) archive.
 
 ALZ archive — the proprietary container of ESTsoft's ALZip (Korean shareware archiver). References: `http://kippler.com/win/unalz/` — unalz — open-source ALZ extractor, the de-facto format reference`https://en.wikipedia.org/wiki/ALZip` — application backgroundThe format is proprietary (ESTsoft); no official specification was published
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1315,7 +1315,7 @@ Implements `IDisposable`.
 
 AMPK (Amiga Pack) archive with LZHUF-compressed members. References: Haruhiko Okumura's `lzhuf.c` (1988/89) — the LZSS + adaptive-Huffman codec AMPK members use`https://aminet.net` — Aminet — the Amiga software archive distributing the original packer; the container layout itself is undocumented
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1371,7 +1371,7 @@ Creates AMPK archives with stored (uncompressed) files.
 
 Archive view of an Android App Bundle (`.aab`) or split-APK set (`.apks`). The underlying container is a ZIP; this descriptor re-exposes its entries with the split-APK semantics surfaced in the path: `base/` sub-tree → `base/...` (verbatim).`splits/*.apk` top-level APKs → kept at `splits/*.apk`.`BundleConfig.pb` → kept at root. The actual content is a ZIP, so detection is extension-based; at the raw-magic level this still looks like any other PK-signed ZIP and the Zip / Apk descriptors would also match if routed by magic. This descriptor intentionally declares a lower detection confidence for the ZIP local-file header so Zip/Apk win on ambiguous inputs. References: `https://developer.android.com/guide/app-bundle` — official Android App Bundle documentation`https://github.com/google/bundletool` — bundletool — the canonical .aab / .apks tool`https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE APPNOTE — the underlying ZIP container spec
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1523,7 +1523,7 @@ Wire-format constants for the AOMEI Backupper image format, recovered from rever
 
 Read/write descriptor for AOMEI Backupper image files (`.adi` disk / partition / system backup, `.afi` file/folder backup). Both share the `Magic` 5-byte ASCII signature at offset 0 (the trailing backslash is the low byte of the `Size` field, not a path separator). Implementation ported from the reverse-engineered format spec at `docs/AOMEI_FORMAT_SPEC.md`: full `BIFH`/`BIFT` structs with `BRCrc32` verification, the recovered `BR_STANDARD_HEADER` tagged-record framing, and typed views of the four confirmed INFO records (COMPRESS / ENCRYPT / PASSWORD / BACKUP_TYPE). What is surfaced for parsable input:`FULL.bifh` — the raw image bytes (also acts as a fallback for callers that just want the original payload).`metadata.ini` — parse status, decoded INFO record fields (backup_type, compress method/level, encrypt method/keylen, password MD5), record-walk summary.`header.bin` — the original 64-byte capture of the file start (preserved from the R/O baseline for backward compatibility with downstream forensic tooling).`head.bin` / `tail.bin` — the full 0x65C BIFH and 0x674 BIFT structs, available when the file is long enough to contain them, for future RE work on the as-yet-TODO body fields.`record-NN-NAME.bin` — every walked `BR_STANDARD_HEADER`-prefixed record's raw bytes, filename-tagged with its type code. Lets callers inspect the INDEX_TYPE_* records whose body layouts remain TODO.`userdata/NAME` — when the file was produced by this project's writer, the user-data envelopes (`UserDataTypeTag`) are unwrapped and their original filename + payload are emitted under a `userdata/` prefix.Create() — round-trip honest: the writer emits a wire-format correct BIFH+INFO+BIFT container with sealed CRCs. The container round-trips through our own reader. It is not byte-compatible with the AOMEI Backupper application: the head/tail body fields (0x650 / 0x668 bytes after the standard header) are zero-filled because their layout is TODO in the recovered spec. Containers produced here advertise compression / encryption / backup-type via standard INFO records, and wrap user inputs in a vendor-namespace `UserDataTypeTag` envelope so the project's own reader can extract them again. References: `https://www.aomeitech.com` — vendor — the .adi/.afi container is proprietary and unpublished`docs/AOMEI_FORMAT_SPEC.md` (this repository) — reverse-engineered BIFH/BIFT + BR_STANDARD_HEADER on-disk spec
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1797,7 +1797,7 @@ Provides static methods for compressing and decompressing data using the aPLib a
 
 Android application package (.apk) — a ZIP container holding the manifest, DEX bytecode, resources and native libraries. References: `https://developer.android.com/guide/components/fundamentals` — Android application fundamentals (APK packaging)`https://en.wikipedia.org/wiki/Apk_(file_format)` — format overview`https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE APPNOTE — the underlying ZIP container spec
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1833,7 +1833,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 Alternative view over an Android APK that surfaces only its packaged native libraries (`lib/<abi>/*.so`) as archive entries under `native_libs/<abi>/*.so`. Intentionally not registered for magic detection (all magic signatures are zero-confidence); the caller must route here explicitly, e.g. `cwb list --format ApkNativeLibs foo.apk`. References: `https://developer.android.com/ndk/guides/abis` — Android ABI management — defines the per-ABI native-library directory layout inside an APK`https://en.wikipedia.org/wiki/Apk_(file_format)` — APK container overview
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1934,7 +1934,7 @@ Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 
 Pseudo-archive descriptor for AppleSingle (RFC 1740) container files. Each entry id (data fork, resource fork, Finder info, dates, real name, …) is surfaced as a separate archive entry plus a metadata.ini summary. References: `https://www.rfc-editor.org/rfc/rfc1740` — RFC 1740 — carries the AppleSingle/AppleDouble format description as an appendixApple "AppleSingle/AppleDouble Formats for Foreign Files Developer's Note" (1990) — the defining vendor document`https://en.wikipedia.org/wiki/AppleSingle_and_AppleDouble_formats` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2083,7 +2083,7 @@ Inherits `Stream`. Implements `IAsyncDisposable`, `IDisposable`.
 
 Apple `sparseimage` — a single-file expanding disk image produced by `hdiutil create -type SPARSE` and used by Time Machine, FileVault and HDIUTIL workflows. The on-disk format is a 4096-byte `sprs` header plus a Band Allocation Table (BAT) mapping virtual bands (typically 1 MB each) to physical bands stored sequentially in the file; unallocated virtual bands read as zeros. References: Apple `hdiutil(1)` man page — the creating tool; the 'sprs' header + band allocation table are undocumented by Apple and community-reverse-engineered`https://en.wikipedia.org/wiki/Sparse_image` — background on Apple sparse images
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2197,7 +2197,7 @@ Synthetic sparseimage writer used for round-trip testing and the `SparseimageFor
 
 Windows app package (.appx/.msix) — ZIP-based container with AppxManifest.xml, block map and package signature. References: `https://learn.microsoft.com/en-us/windows/msix/` — MSIX/APPX packaging documentation`https://en.wikipedia.org/wiki/APPX` — format overview`https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE APPNOTE — the underlying ZIP container spec
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2265,7 +2265,7 @@ Represents a single file entry in a Unix ar archive.
 
 Unix ar archive — the static-library (.a) and .deb outer container with 60-byte ASCII member headers. References: `ar(5)` man page (4.4BSD / FreeBSD) — the de-facto format definition (ar was never standardized by POSIX)`https://en.wikipedia.org/wiki/Ar_(Unix)` — format overview incl. the GNU and BSD long-name extensions
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2409,7 +2409,7 @@ Represents the metadata for a single entry in an ARC archive.
 
 ARC archive (System Enhancement Associates, 1985) — one of the first PC compression container formats. References: `https://github.com/hyc/arc` — SEA ARC source (GPL continuation maintained by Howard Chu) — the reference implementation`https://en.wikipedia.org/wiki/ARC_(file_format)` — format history
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2535,7 +2535,7 @@ Represents a single entry (file or directory) within an ARJ archive.
 
 ARJ archive (Robert K. Jung, 1991) — DOS-era compressor known for solid multi-volume support. References: ARJ `TECHNOTE.TXT` — the official format description shipped with the ARJ distribution`https://arj.sourceforge.net` — ARJ for Unix — open-source continuation`https://en.wikipedia.org/wiki/ARJ` — format history
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2897,7 +2897,7 @@ Represents a single audio entry inside a CRI Audio Wave Bank (AFS2). The wave ba
 
 CRI Audio Wave Bank (AFS2) — used by Capcom (Resident Evil, Monster Hunter), Sega (Yakuza, Persona 5), and other CRI Middleware titles. Contains raw codec payloads (HCA, ADX, etc.) which are surfaced verbatim — we do not decode the inner audio. References: `https://github.com/vgmstream/vgmstream` — vgmstream — implements AFS2/AWB parsing; the de-facto referenceCRI Middleware never published the AFS2 layout; it was recovered by the VGM ripping community
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2981,7 +2981,7 @@ One file record inside a BA2 GNRL archive.
 
 Bethesda Archive v2 (BA2, "BTDX" magic) — asset archive introduced with Fallout 4 (GNRL general and DX10 texture variants). References: `https://github.com/Guekka/bsa` — bsa — maintained open-source C++ library reading/writing BSA and BA2BA2 layout documented by the xEdit/BSArch project and the Fallout 4 modding community — Bethesda never published a spec
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3132,7 +3132,7 @@ Represents a single file entry in a BIG archive.
 
 EA BIG/BIGF archive — resource container used across Electronic Arts titles (Command & Conquer generation and later). References: `https://wiki.multimedia.cx/index.php/Electronic_Arts_Formats` — MultimediaWiki — community documentation of EA container formatsFinalBIG and the EA modding community's unpackers — de-facto references; EA never published a spec
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3248,7 +3248,7 @@ A single entry surfaced from a Microsoft NTBackup (.bkf) Microsoft Tape Format (
 
 Microsoft NTBackup (`.bkf`) — Microsoft Tape Format (MTF) v1.0 container. Surfaces FILE/DIRB entries via the `STAN` (Standard) data streams. Compressed streams are surfaced as "compressed" in the listing; the MTF spec does not name a compression algorithm and most ntbackup.exe writes are uncompressed. In-place R/W tier: `Add` appends one FILE DBLK per input at the position of the existing EOTM block (or at EOF when absent) and re-emits a fresh EOTM at the new end, leaving every pre-existing DBLK byte-identical at its original offset. `Remove` tombstones the matching FILE DBLK by overwriting its 4-byte type field with the `XXXX` sentinel and zero-wiping the rest of that FLB block; the reader's parse loop hits an unknown DBLK type and skips it. References: "Microsoft Tape Format Specification" v1.00a (Seagate Software, 1998) — the defining MTF document`https://en.wikipedia.org/wiki/NTBackup` — background on the creating tool
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3424,7 +3424,7 @@ Entry in a BSA/BA2 archive.
 
 Bethesda Softworks Archive (BSA) — asset archive used by The Elder Scrolls (Morrowind through Skyrim) and Fallout 3 / New Vegas. References: `https://en.uesp.net/wiki/Oblivion_Mod:BSA_File_Format` — UESP — BSA v103/v104 format documentation`https://en.uesp.net/wiki/Skyrim_Mod:Archive_File_Format` — UESP — Skyrim-era v104/v105 archive documentation`https://en.uesp.net/wiki/Morrowind_Mod:BSA_File_Format` — UESP — Morrowind v100 variant
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3636,7 +3636,7 @@ Represents a file entry stored inside a Microsoft Cabinet (CAB) archive.
 
 Microsoft Cabinet (CAB) archive — CFHEADER/CFFOLDER/CFFILE structures with MSZIP/Quantum/LZX-compressed folders. References: [MS-CAB]: Cabinet File Format — Microsoft Open Specifications`https://www.cabextract.org.uk/libmspack/` — libmspack — maintained open-source CAB implementation`https://en.wikipedia.org/wiki/Cabinet_(file_format)` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3704,7 +3704,7 @@ Creates Microsoft Cabinet (CAB) archives.
 
 Comic book archive — a RAR container of sequentially named page images, conventionally suffixed .cbr. References: `https://en.wikipedia.org/wiki/Comic_book_archive` — the .cbr/.cbz naming convention`https://www.rarlab.com/technote.htm` — RAR 5.x technote — the underlying container format
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3739,7 +3739,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 Comic book archive — a ZIP container of sequentially named page images, conventionally suffixed .cbz. References: `https://en.wikipedia.org/wiki/Comic_book_archive` — the .cbr/.cbz naming convention`https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE APPNOTE — the underlying ZIP container spec
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3787,7 +3787,7 @@ Represents a single entry (file) within a CHM archive.
 
 Microsoft Compiled HTML Help (CHM) — ITSF/ITSP container with LZX-compressed content sections. References: Matthew Russotto's "Microsoft's HTML Help (.chm) format" — the classic unofficial specification (russotto.net)`https://www.cabextract.org.uk/libmspack/` — libmspack — maintained open-source CHM decoder`https://en.wikipedia.org/wiki/Microsoft_Compiled_HTML_Help` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3925,7 +3925,7 @@ Represents a single entry in a Compact Pro (.cpt) archive.
 
 Compact Pro archive (Bill Goodman / Cyclos) — classic-Mac compressor that rivaled StuffIt in the early 1990s. References: `https://github.com/MacPaw/XADMaster` — The Unarchiver's XADMaster — open-source Compact Pro reader`https://en.wikipedia.org/wiki/Compact_Pro` — format history
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4052,7 +4052,7 @@ Represents a single entry in a cpio archive.
 
 cpio archive — Unix copy-in/copy-out container (binary, portable-ASCII odc and newc variants). References: `https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html` — POSIX pax — defines the cpio interchange headers`cpio(5)` man page (libarchive / FreeBSD) — documents the binary, odc, newc and crc variants`https://en.wikipedia.org/wiki/Cpio` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4210,7 +4210,7 @@ Inherits `CompressionStream`. Implements `IAsyncDisposable`, `IDisposable`.
 
 Chrome extension package (CRX3) — "Cr24" magic + version + protobuf SignedData header followed by the ZIP payload. References: `https://chromium.googlesource.com/chromium/src/+/main/components/crx_file/` — Chromium crx_file component — `crx3.proto` defines the header`https://developer.chrome.com/docs/extensions` — Chrome extensions documentation portal
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4342,7 +4342,7 @@ Implements `IEquatable<DebEntry>`.
 
 Debian binary package (.deb) — an ar archive holding debian-binary, control.tar.* and data.tar.*. References: `deb(5)` man page (dpkg) — the authoritative format description`https://www.debian.org/doc/debian-policy/` — Debian Policy Manual — binary package requirements`https://en.wikipedia.org/wiki/Deb_(file_format)` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4514,7 +4514,7 @@ Represents a single compressed file stored in a DiskDoubler file.
 
 DiskDoubler compressed file (Salient Software, 1989-1993) — classic-Mac per-file compressor. References: `https://github.com/MacPaw/XADMaster` — The Unarchiver's XADMaster — open-source DiskDoubler decoder`https://en.wikipedia.org/wiki/DiskDoubler` — format history
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4673,7 +4673,7 @@ Implements `IDisposable`.
 
 Office Open XML word-processing document (.docx) — an OPC/ZIP package per ECMA-376 / ISO/IEC 29500. References: `https://ecma-international.org/publications-and-standards/standards/ecma-376/` — ECMA-376 — Office Open XML file formats`https://en.wikipedia.org/wiki/Office_Open_XML` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4751,7 +4751,7 @@ Represents a single entry in a Bloodlines DZIP archive.
 
 DZIP v2 archive ("DZIP" magic) used by Vampire: The Masquerade — Bloodlines; stored and LZSS-compressed entries. References: Undocumented Troika Games format; the header/TOC layout was recovered by the Bloodlines modding community's unpacking tools`https://en.wikipedia.org/wiki/Vampire:_The_Masquerade_%E2%80%93_Bloodlines` — background on the game
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4817,7 +4817,7 @@ Implements `IDisposable`.
 
 Java EE / Jakarta EE Enterprise Application aRchive (.ear) — ZIP container with META-INF/application.xml and bundled WAR/JAR modules. References: `https://jakarta.ee/specifications/platform/` — Jakarta EE Platform specification — defines EAR packaging`https://en.wikipedia.org/wiki/EAR_(file_format)` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -5031,7 +5031,7 @@ Linear scanner that locates zlib substreams inside an EaseUS Todo Backup `.pbd`
 
 EPUB e-book — ZIP-based OCF container with a mimetype entry, META-INF/container.xml and the OPF package document. References: `https://www.w3.org/TR/epub-33/` — EPUB 3.3 — W3C Recommendation (incl. the OCF container)`https://en.wikipedia.org/wiki/EPUB` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -5067,7 +5067,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 Descriptor for the Microsoft ESD (Electronic Software Download) format — the encrypted-CAB / install-image variant of WIM that the Windows Update service streams down for OS provisioning. References: `https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/wim-and-esd-windows-image-files-overview` — Microsoft's WIM/ESD overviewMicrosoft "Windows Imaging File Format (WIM)" whitepaper — the on-disk header / resource-table spec ESD shares`https://wimlib.net` — open-source WIM/ESD implementation (LZMS, solid resources)
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -6651,7 +6651,7 @@ Represents a single file entry within a FreeArc archive.
 
 Format descriptor for FreeArc compressed archives (.arc). References: `https://github.com/Bulat-Ziganshin/FA` — FreeArc'Next by FreeArc's author, Bulat Ziganshin (the original freearc.org site is defunct)`https://en.wikipedia.org/wiki/FreeArc` — Wikipedia overviewNo formal specification — the archive layout is defined by the original FreeArc sources
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -6754,7 +6754,7 @@ Represents a single file entry in a Nintendo 3DS GAR archive.
 
 Nintendo 3DS GAR (Generic Asset Resource) archive as used in Tomodachi Life / Animal Crossing-era titles. References: No official specification — proprietary Nintendo-era container, reverse-engineered by the 3DS modding community`https://github.com/FanTranslatorsInternational/Kuriimu2` — Kuriimu2 — fan-translation toolkit covering many 3DS archive containers
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7020,7 +7020,7 @@ Ghost Fast LZ (Z1) codec — a custom LZ77 variant with a 4096-entry hash table
 
 Symantec / Norton Ghost backup-image descriptor — R/W for the FE EF record container shared across the entire Binary Research → Symantec → Norton lineage (v4 DOS-era through Ghost 11.x / 12.x). References: No public specification — proprietary Symantec format; record layout reverse-engineered across Ghost 3.0 through 12.x images`https://en.wikipedia.org/wiki/Ghost_(disk_utility)` — Wikipedia on the Binary Research / Symantec / Norton lineage
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7168,7 +7168,7 @@ Represents a single entry in a Lucasarts GOB archive.
 
 LucasArts GOB resource archive used by Star Wars: Jedi Knight (Dark Forces II) and Outlaws. References: `https://github.com/luciusDXL/TheForceEngine` — The Force Engine — maintained open reimplementation of the Jedi engine, reads GOB containersNo official specification — community-reverse-engineered LucasArts container
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7227,7 +7227,7 @@ Implements `IDisposable`.
 
 Godot Engine resource pack (.pck, GDPC container). References: `https://github.com/godotengine/godot` — canonical implementation — the format is defined by core/io/file_access_pack.cpp`https://docs.godotengine.org` — Godot Engine documentation (PCK export and loading)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7311,7 +7311,7 @@ Entry in a BUILD Engine GRP archive.
 
 BUILD engine GRP game resource archive ('KenSilverman' signature + file table), used by Duke Nukem 3D and other BUILD titles. References: `https://moddingwiki.shikadi.net/wiki/GRP_Format` — DOS Game Modding Wiki — GRP format layout`https://advsys.net/ken/build.htm` — Ken Silverman's BUILD engine page (format author)`https://voidpoint.io/terminx/eduke32` — EDuke32 — maintained BUILD engine implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7483,7 +7483,7 @@ Represents a single entry in an Ha archive.
 
 HA archive (Harri Hirvola) with ASC (sliding-window LZ + arithmetic coding) and HSC (context modelling + arithmetic coding) methods. References: HA.DOC shipped with the HA 0.999 archiver (Harri Hirvola) — the canonical format and method descriptionNo online specification — the format is known from the archiver's released source code
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7673,7 +7673,7 @@ Represents a single file entry in a HOG archive.
 
 Descent / Descent II HOG game-data archive ('DHF' signature + 13-byte-name records). References: `https://github.com/dxx-rebirth/dxx-rebirth` — DXX-Rebirth — maintained open-source Descent engine and de-facto format referenceNo official specification — documented by the community from the released Descent source code
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7776,7 +7776,7 @@ Represents a single entry (file or directory) in a Total Annihilation HPI archiv
 
 Total Annihilation HPI (HAPI) game resource archive with chunked, zlib-subset-compressed entries. References: Total Annihilation modding-community HPI format documentation (HPIUtil and successors) — no official Cavedog specification exists`https://en.wikipedia.org/wiki/Total_Annihilation` — Wikipedia on the game
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7879,7 +7879,7 @@ Compressor and decompressor for the Atari ST ICE Packer format (Axe of Delight,
 
 Amiga IFF CDAF (Compact Disk Archive Format) — an EA-IFF-85 FORM container carrying FNAM/FDAT chunk pairs per archived file. References: "EA IFF 85: Standard for Interchange Format Files" (Jerry Morrison, Electronic Arts, 1985) — the underlying container standard`https://en.wikipedia.org/wiki/Interchange_File_Format` — Wikipedia on IFF`https://aminet.net` — Aminet — distribution home of the Amiga CDAF tooling
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8013,7 +8013,7 @@ Writes a minimal Inno Setup header. No PE stub is emitted; the reader scans from
 
 Apple iOS application package (.ipa) — a ZIP archive laid out as Payload/AppName.app plus metadata. References: `https://en.wikipedia.org/wiki/.ipa` — Wikipedia on the .ipa bundle layout`https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE ZIP APPNOTE — the underlying container format
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8049,7 +8049,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 Java Archive (JAR) — a ZIP container with a META-INF/MANIFEST.MF manifest. References: `https://docs.oracle.com/javase/8/docs/technotes/guides/jar/jar.html` — Oracle JAR File Specification`https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE ZIP APPNOTE — the underlying container format`https://en.wikipedia.org/wiki/JAR_(file_format)` — Wikipedia
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8085,7 +8085,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 Google Earth KMZ — a ZIP archive bundling a root KML document plus referenced resources. References: `https://developers.google.com/kml/documentation` — Google KML documentation (KMZ packaging rules)OGC KML 2.3 (OGC 12-007r2) — the standardized KML specification`https://en.wikipedia.org/wiki/Keyhole_Markup_Language` — Wikipedia
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8198,7 +8198,7 @@ Represents a single entry in a CP/M LBR archive directory.
 
 CP/M LBR library archive (LU by Gary P. Novosielski) — a directory of stored, uncompressed member files. References: LU library utility documentation (Gary P. Novosielski) — the defining format description`https://en.wikipedia.org/wiki/LBR_(file_format)` — Wikipedia
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8282,7 +8282,7 @@ Represents a single resource entry inside a LucasArts LFD bundle.
 
 LucasArts LFD resource bundle used by X-Wing and TIE Fighter. References: `https://github.com/MikeG621/LfdReader` — Idmr.LfdReader — community reference implementation with detailed format documentationNo official specification — community-reverse-engineered LucasArts container
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8349,7 +8349,7 @@ Implements `IDisposable`.
 
 Amiga LhFloppy (LhF) disk archive storing whole floppy tracks with LZ77+Huffman compression. References: `https://aminet.net` — Aminet — distribution home of the Amiga disk-archiver toolingNo published specification — format reverse-engineered from the archiver
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8516,7 +8516,7 @@ Writes a Long Range Zip (lrzip) container with the LZMA subtype. Other methods a
 
 Commodore 64 Lynx/LNX archive. The format stores a textual PETSCII-ish directory and uncompressed file extents in 254-byte blocks mirroring a 1541 sector with its two link bytes removed.
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IFormatOptionsSchema`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8747,7 +8747,7 @@ Creates LHA/LZH archives.
 
 LHA/LZH archive — the LZSS+Huffman archiver family historically dominant in Japan and on the Amiga. References: `https://github.com/jca02266/lha` — LHa for UNIX — maintained canonical implementation; header layouts documented in the source tree`https://en.wikipedia.org/wiki/LHA_(file_format)` — Wikipedia
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9044,7 +9044,7 @@ Represents a single entry in an Amiga LZX archive.
 
 Amiga LZX archive (Jonathan Forbes and Tomi Salo) — LZ77+Huffman with merged-file compression groups. References: `https://en.wikipedia.org/wiki/LZX` — Wikipedia — covers the Amiga LZX archiver lineage`https://aminet.net` — Aminet — home of the original archiver and the unlzx extractor whose source is the de-facto format reference
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9427,7 +9427,7 @@ Writes a valid Macrium Reflect X (`.mrimgx`) container from a flat disk-image pa
 
 Mozilla Archive Format (MAFF) — a ZIP container of saved web pages plus RDF metadata. References: `https://en.wikipedia.org/wiki/Mozilla_Archive_Format` — WikipediaMAFF specification by the Mozilla Archive Format add-on project (formerly maf.mozdev.org; mozdev has shut down)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9648,7 +9648,7 @@ Represents a single resource entry in a Cyan Mohawk (MHK) archive. Resources are
 
 Cyan / Broderbund Mohawk (MHWK) resource archive used by Myst, Riven and Living Books titles. References: `https://github.com/scummvm/scummvm` — ScummVM — the Mohawk engine is the de-facto reference implementation`https://wiki.scummvm.org` — ScummVM wiki — Mohawk engine and archive documentation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9721,7 +9721,7 @@ Represents a single entry in a Westwood TD/RA1 MIX archive.
 
 Westwood Studios MIX archive (Command and Conquer: Tiberian Dawn / Red Alert variant) — header plus CRC-keyed file table. References: `https://github.com/OpenRA/OpenRA` — OpenRA — maintained open reimplementation with a MIX readerXCC Utilities (Olaf van der Spek) — long-standing de-facto MIX reference implementationNo official specification — community-reverse-engineered
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10020,7 +10020,7 @@ Entry in an MPQ archive.
 
 Blizzard MPQ (Mo'PaQ) game archive used by Diablo, StarCraft, WarCraft III and World of Warcraft. References: `http://www.zezula.net/en/mpq/main.html` — Ladislav Zezula's MPQ format documentation — the de-facto specification`https://github.com/ladislav-zezula/StormLib` — StormLib — maintained reference implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10109,7 +10109,7 @@ Represents an entry (stream or storage) in an MSI/OLE Compound File.
 
 Microsoft OLE2 Compound File Binary container (MSI installer databases, legacy Office documents). References: `https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cfb/` — [MS-CFB] Compound File Binary File Format — Microsoft Open Specifications`https://learn.microsoft.com/en-us/windows/win32/msi/windows-installer-portal` — Windows Installer documentation portal`https://en.wikipedia.org/wiki/Compound_File_Binary_Format` — Wikipedia
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10157,7 +10157,7 @@ Implements `IDisposable`.
 
 Descriptor for MSIX and MSIXBUNDLE packages. On disk these are ZIP archives whose root contains an `AppxManifest.xml` (MSIX) or `AppxBundleManifest.xml` (MSIX bundle). The on-disk structure is identical to APPX; only the manifest semantics and file extensions differ. The descriptor surfaces a synthetic `metadata.ini` summarising identity and capability declarations parsed from the manifest, followed by every ZIP entry verbatim. References: `https://learn.microsoft.com/en-us/windows/msix/` — Microsoft MSIX documentation portal`https://github.com/microsoft/msix-packaging` — Microsoft MSIX SDK — canonical packaging implementation`https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE ZIP APPNOTE — the underlying container format
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10221,7 +10221,7 @@ Represents a single file inside a NARC archive.
 
 Nintendo DS NARC (Nitro Archive) — BTAF/BTNF/GMIF chunks reusing the NitroROM FNT/FAT layout. References: `https://problemkaputt.de/gbatek.htm` — GBATEK (Martin Korth) — canonical DS technical reference including the NitroROM FNT/FAT structures`https://github.com/pleonex/tinke` — Tinke — community DS resource tool reading NARC
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10293,7 +10293,7 @@ Represents a single file or directory entry within a Nintendo DS ROM NitroFS fil
 
 Nintendo DS ROM image — cartridge header, FNT/FAT filesystem and ARM9/ARM7 binaries. References: `https://problemkaputt.de/gbatek.htm` — GBATEK (Martin Korth) — canonical DS cartridge-header and filesystem reference`https://github.com/devkitPro/ndstool` — ndstool (devkitPro) — maintained ROM build/extract tool
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10449,7 +10449,7 @@ Represents a single file entry in an NSA archive.
 
 NScripter NSA game-data archive (entry table + data-offset header). References: ONScripter (Ogapee) — the open NScripter engine whose NsaReader is the de-facto format referenceNo official specification — NScripter is proprietary; the container is documented by the visual-novel tooling community
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10590,7 +10590,7 @@ Writes a minimal NSIS-formatted file. No PE stub is emitted — the reader's `Sc
 
 NuGet package (.nupkg) — a ZIP/OPC container with a .nuspec manifest. References: `https://learn.microsoft.com/en-us/nuget/` — Microsoft NuGet documentation portal (package structure, .nuspec)`https://github.com/NuGet/NuGet.Client` — canonical client implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10690,7 +10690,7 @@ WORM writer for the NumPy NPY array serialization format (NEP 1). Emits a v1 fil
 
 Descriptor for NumPy's NPZ format — a ZIP archive whose entries are all `.npy` array serializations. Detection is extension-based (NPZ has no dedicated magic; its raw magic is the plain ZIP signature) and the contents are surfaced as-is: one entry per enclosed `.npy`, plus a `metadata.ini` summary of array names and byte sizes. References: `https://numpy.org/doc/stable/reference/generated/numpy.lib.format.html` — numpy.lib.format — defines NPZ as a ZIP of .npy members`https://github.com/numpy/numpy` — canonical implementation (numpy.savez / numpy.load)`https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE ZIP APPNOTE — the underlying container format
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10749,7 +10749,7 @@ Implements `IArchiveFormatOperations`, `IArchiveInMemoryExtract`, `IFormatDescri
 
 OpenDocument presentation (.odp) — an OASIS ODF ZIP package. References: OASIS OpenDocument Format v1.3 (also ISO/IEC 26300) — the ODF package and XML specification`https://en.wikipedia.org/wiki/OpenDocument` — Wikipedia`https://www.libreoffice.org` — LibreOffice — principal implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10785,7 +10785,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 OpenDocument spreadsheet (.ods) — an OASIS ODF ZIP package. References: OASIS OpenDocument Format v1.3 (also ISO/IEC 26300) — the ODF package and XML specification`https://en.wikipedia.org/wiki/OpenDocument` — Wikipedia`https://www.libreoffice.org` — LibreOffice — principal implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10821,7 +10821,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 OpenDocument text document (.odt) — an OASIS ODF ZIP package. References: OASIS OpenDocument Format v1.3 (also ISO/IEC 26300) — the ODF package and XML specification`https://en.wikipedia.org/wiki/OpenDocument` — Wikipedia`https://www.libreoffice.org` — LibreOffice — principal implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -11184,7 +11184,7 @@ Represents a file entry in a PackIt (.pit) archive.
 
 PackIt classic Macintosh archive (.pit; Harry Chesley, 1984) — sequential PMag/PMa4 records bundling data and resource forks. References: `https://github.com/MacPaw/XADMaster` — XADMaster (The Unarchiver) — maintained implementation including PackItNo formal specification — format known from PackIt itself and later community documentation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -11255,7 +11255,7 @@ Implements `IDisposable`.
 
 id Software Quake PAK resource archive ('PACK' header + 64-byte-entry directory). References: `https://github.com/id-Software/Quake` — released Quake source — the pakfile code is the canonical definitionUnofficial Quake Specs (Olivier Montanuy et al.) — long-standing community format documentation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -11387,7 +11387,7 @@ A single entry in the CWBP chunk-offset table — surfaces the exact per-chunk f
 
 R/O metadata descriptor for Paragon Backup & Recovery (`.pbf`) sector-image backup files. Surfaces the corrected (TrID-documented) `"PImg"` magic, a synthetic `metadata.ini` describing the multi-file companion convention and the format-evolution history, and the raw image bytes; no real entry walk is attempted. Promotion outcome: R/O metadata only. The earlier Stage-0 baseline declined any promotion entirely; this revision corrects the detection magic against the public spec and surfaces what little structural information is publicly documented. R/W is still blocked: the byte layout after the 4-byte magic is undocumented, the format is proprietary, vendor restore-only since HDM 16. What the deep-RE research established:Real magic, not the Stage-0 guess. The TrID file-identifier database catalogues the "Paragon Backup Format image" header as the 4-byte ASCII tag `"PImg"` (hex `50 49 6D 67`) at offset 0, cross-confirmed by file-extension.net, recoveryutility.com, and datenrettungtool.de. The earlier Stage-0 baseline had used the ASCII tags `"PBF"` / `"PBR1"`, which were a guess from the format's display name and never observed in real samples — those have been replaced by the documented `"PImg"` signature. Multi-file archive convention is documented. Per Paragon KB article 767 ("Archive Formats"), a complete Paragon backup directory contains: `.pbf` main image / legacy pre-HDM-11 index; `.pfi` Paragon Backup Index Data (main index since HDM 11 / late 2011, small and used to ship deltas over the network); `.pfm` Image Descriptor sidecar consumed by Paragon's Image Explorer for fast browsing; and split data chunks `.000` / `.001` / `.002` / ... at the ~4 GB segment boundary. Format-evolution timeline is documented. PBF was the sole index up to HDM 10 (2009/2010); HDM 11 (late 2011) introduced PFI and demoted PBF to the data file; HDM 14 introduced pVHD (Paragon Virtual Hard Disk) as the new container, with PBF still primary under "Smart Backup"; HDM 15 made pVHD the default, with PBF only via "Legacy Mode"; HDM 16+ removed PBF creation entirely — restore-only. R/W blockers that remain after research. The byte layout after the 4-byte magic is undocumented in every public source consulted — TrID only catalogues the signature, the Paragon Knowledge Base and the HDM / Backup&Recovery user manuals only describe user-facing operations, and no open-source third-party PBF reader exists. The block index, per-cluster allocation bitmap (sector-based mode), snapshot / incremental chain framing, on-disk compressor identifier, per-block frame header, and per-segment split-archive trailer all remain proprietary. The format is also obsolete for creation since HDM 16. Deep-RE audit conclusion. Twelve research vectors were pursued past the bare TrID signature on top of the Stage-0 -> R/O baseline: asmodean expimg (false lead, Japanese visual-novel format unrelated to Paragon), Paragon HDM SDK (partitioning only), Paragon-Software- Group + Paragon-Backup-Recovery GitHub orgs (no backup-format code), USPTO patent search (no Paragon-assigned PBF-layout disclosure), EnCase / X-Ways / FTK forensic-suite custom-carver repositories (no Paragon-PBF-specific carver), Russian Habr / Toster.ru threads, paragon284.rssing.com Drive Backup forum mirror (community confirms the conceptual triple {index, metadata, compressed} but no byte-level layout), Gary Kessler / SEARCH file-signatures table (no PBF entry), Kaitai Struct + 010 Editor / Hexinator / Synalize It! / ImHex template libraries (no `.ksy` / `.bt` template for PBF), Paragon Scripting Language User Manual (0-9 compression dial, `*.pbf` exclusion only), and the Paragon ExtFS / NTFS3 / UFSD / APFS-SDK-CE open-source releases (filesystem drivers only, share no structures with PBF). All twelve vectors dead-ended. The audit produced one material correction: legacy PBF is unencrypted; password protection, compression and splitting are pVHD-only per the B&R 17 / HDM 16 manuals — the earlier baseline's "optional AES with vendor KDF" blocker was incorrect and is retired. Stage stays at R/O metadata; the audit trail is persisted in `metadata.ini` as `re_audit_*` keys so the next maintainer doesn't repeat it. Sources (all public, all consulted during the R/O promotion): TrID file-identifier database; Paragon KB articles 767 (Archive Formats) and 262 (Backup Types); Paragon Backup & Recovery 17 User Manual; Paragon Hard Disk Manager 16 User Manual; cross-references via file-extension.net, recoveryutility.com, datenrettungtool.de, openthefile.net, fileinfo.com, file.org, solvusoft.com. References: `https://www.paragon-software.com` — vendor site — the .pbf container is proprietary and undocumentedNo public specification — vendor images parsed from a reverse-engineered header layout
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -11564,7 +11564,7 @@ Represents a single section in a PSP PBP archive.
 
 Sony PSP PBP package (EBOOT.PBP) — 'PBP' magic plus eight offsets to PARAM.SFO, icon/PIC/PMF media and DATA.PSP / DATA.PSAR sections. References: `https://github.com/pspdev/pspsdk` — PSP homebrew SDK — de-facto reference for the PBP headerNo official Sony specification — structure documented by the PSP homebrew community
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -11665,7 +11665,7 @@ Represents a single entry in a Nintendo Switch PartitionFS (PFS0) archive.
 
 Nintendo Switch PartitionFS (PFS0) archive — the flat file table inside NSP packages. References: `https://switchbrew.org/` — Switchbrew wiki — community reverse-engineered Switch format documentation (PFS0/NSP)`https://github.com/SciresM/hactool` — hactool — reference extraction tool implementing PFS0
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -11837,7 +11837,7 @@ PPMd stream container format. Layout: 4-byte magic (0x8F 0xAF 0xAC 0x84), then t
 
 Office Open XML presentation (.pptx) — an OPC ZIP package. References: `https://ecma-international.org/publications-and-standards/standards/ecma-376/` — ECMA-376 Office Open XML File Formats (also ISO/IEC 29500)`https://en.wikipedia.org/wiki/Office_Open_XML` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -11886,7 +11886,7 @@ Represents a single entry inside a PSARC archive.
 
 Sony PlayStation archive (PSARC) used on PS3/PS4/Vita — manifest-named entries behind a compressed table of contents. References: psdevwiki "PlayStation archive (PSARC)" (www.psdevwiki.com) — community on-disk layout notesPSARC.EXE from Sony's PlayStation SDKs — the defining (non-public) tool
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -12113,7 +12113,7 @@ Represents an entry in a RAR archive.
 
 RAR archive (RAR4 and RAR5 container framing). References: `https://www.rarlab.com/technote.htm` — RAR 5.0 archive format technote (RARLAB, official)unrar source distribution (rarlab.com) — de-facto reference for RAR4 decoding`https://en.wikipedia.org/wiki/RAR_(file_format)` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -12232,7 +12232,7 @@ Implements `IDisposable`.
 
 Nintendo Resource Archive (RARC), used heavily by GameCube-era JSystem titles and some Wii software. The raw container is big-endian; Yaz0/Yay0 compression is an independent outer layer and is intentionally not folded into this descriptor. References: `https://wiki.cloudmodding.com/zgcn/ARC` — RARC headers, nodes, file entries and flags`https://kuribo64.net/wiki/?page=RARC` — alignment, hierarchy and filename hash documentation`https://www.lumasworkshop.com/wiki/RARC_(File_Format)` — MRAM/ARAM/DVD data-block layout
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -12410,7 +12410,7 @@ Writes a minimal PE32+ DLL whose only purpose is to host opaque files as Win32 r
 
 RPG Maker XP/VX/VX Ace RGSSAD encrypted resource archive. References: `https://github.com/morkt/GARbro` — GARbro — game resource browser implementing RGSSAD decryptionformat defined by Enterbrain's RPG Maker runtime (RGSS); no official spec, key schedule reverse-engineered
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -12506,7 +12506,7 @@ A single entry parsed from an RPA index.
 
 Ren'Py visual-novel resource archive (RPA) — pickle-encoded index, zlib-compressed header. References: `https://github.com/renpy/renpy` — Ren'Py engine — its loader defines the RPA format`https://github.com/Shizmob/rpatool` — rpatool — standalone RPA reader/writer`https://www.renpy.org/` — Ren'Py project home
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -12566,7 +12566,7 @@ Implements `IDisposable`.
 
 RPM package — lead + signature header + main header + compressed cpio payload. References: `https://github.com/rpm-software-management/rpm` — canonical rpm sources (docs/manual describes the package format)Edward C. Bailey, "Maximum RPM" — classic format documentation`https://en.wikipedia.org/wiki/RPM_Package_Manager` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -12725,7 +12725,7 @@ Represents a single file entry in a SAR archive.
 
 NScripter SAR resource archive (uncompressed entries behind a big-endian index). References: `https://github.com/morkt/GARbro` — GARbro — implements NScripter SAR extractionNScripter engine (Naoki Takahashi) defines the format; ONScripter is the open reimplementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -12794,7 +12794,7 @@ Represents a single file entry in a Nintendo SARC archive.
 
 Nintendo SARC (Sorted ARChive) used across Wii U / 3DS / Switch first-party titles. References: `https://zeldamods.org/wiki/SARC` — ZeldaMods wiki — community SARC/SFAT/SFNT layout documentationNintendo's internal archive format; no official spec, structure community-documented
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -12859,7 +12859,7 @@ Implements `IDisposable`.
 
 ### Namespace `FileFormat.SevenZip`
 
-[`SevenZipCodec`](#sevenzipcodec) · [`SevenZipEntry`](#sevenzipentry) · [`SevenZipFilter`](#sevenzipfilter) · [`SevenZipFormatDescriptor`](#sevenzipformatdescriptor) · [`SevenZipInPlaceAdder`](#sevenzipinplaceadder) · [`SevenZipInPlaceRemover`](#sevenzipinplaceremover) · [`SevenZipLayoutMap`](#sevenziplayoutmap) · [`SevenZipReader`](#sevenzipreader) · [`SevenZipWriter`](#sevenzipwriter) · [`SevenZipWriter.BlockDescriptor`](#sevenzipwriterblockdescriptor) · [`SolidBlockOptimizer`](#solidblockoptimizer) · [`SolidBlockOptimizer.OptimizeResult`](#solidblockoptimizeroptimizeresult) · [`SolidBlockOptimizer.ProgressCallback`](#solidblockoptimizerprogresscallback) · [`SolidBlockOptimizer.TrialResult`](#solidblockoptimizertrialresult) · [`SolidBlockPlanner`](#solidblockplanner) · [`SolidBlockPlanner.SolidBlock`](#solidblockplannersolidblock)
+[`SevenZipCodec`](#sevenzipcodec) · [`SevenZipEntry`](#sevenzipentry) · [`SevenZipFilter`](#sevenzipfilter) · [`SevenZipFormatDescriptor`](#sevenzipformatdescriptor) · [`SevenZipInPlaceAdder`](#sevenzipinplaceadder) · [`SevenZipInPlaceRemover`](#sevenzipinplaceremover) · [`SevenZipLayoutMap`](#sevenziplayoutmap) · [`SevenZipReader`](#sevenzipreader) · [`SevenZipWriter`](#sevenzipwriter) · [`SevenZipWriter.BlockDescriptor`](#sevenzipwriterblockdescriptor) · [`SolidBlockOptimizer`](#solidblockoptimizer) · [`SolidBlockOptimizer.DetailedProgress`](#solidblockoptimizerdetailedprogress) · [`SolidBlockOptimizer.OptimizeResult`](#solidblockoptimizeroptimizeresult) · [`SolidBlockOptimizer.ProgressCallback`](#solidblockoptimizerprogresscallback) · [`SolidBlockOptimizer.TrialResult`](#solidblockoptimizertrialresult) · [`SolidBlockPlanner`](#solidblockplanner) · [`SolidBlockPlanner.SolidBlock`](#solidblockplannersolidblock)
 
 #### `SevenZipCodec`
 
@@ -12912,7 +12912,7 @@ Specifies an optional pre-filter applied before compression when writing a 7z ar
 
 7-Zip (.7z) archive — LZMA/LZMA2-based container with solid compression and encrypted-header support. References: `https://www.7-zip.org/7z.html` — official 7z format page (Igor Pavlov)`7zFormat.txt` in the 7-Zip / LZMA SDK sources — the structural reference`https://en.wikipedia.org/wiki/7z` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `IFormatValidator`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `IFormatValidator`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -13020,7 +13020,23 @@ Tries multiple solid-block grouping strategies on a 7z archive and returns the o
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Optimize` | `static OptimizeResult Optimize(Stream archive, int maxTrials = 5, ProgressCallback onProgress = null)` | Tries up to `maxTrials` candidate grouping strategies and returns the one that produces the smallest archive. |
+| `Optimize` | `static OptimizeResult Optimize(Stream archive, int maxTrials = 5, ProgressCallback onProgress = null, Action<DetailedProgress> onDetailedProgress = null, CancellationToken cancellationToken = null)` | Tries up to `maxTrials` candidate grouping strategies and returns the one that produces the smallest archive. |
+
+#### `SolidBlockOptimizer.DetailedProgress`
+
+Detailed progress used by the maintenance block-map UI. `Phase` is `extracting`, `strategy`, or `building`. The byte counters are meaningful for extraction; current/total are meaningful for strategy and target-entry construction.
+
+Implements `IEquatable<DetailedProgress>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `DetailedProgress` | `DetailedProgress(string Phase, int Current, int Total, string Name, long BytesDone, long BytesTotal)` | Detailed progress used by the maintenance block-map UI. `Phase` is `extracting`, `strategy`, or `building`. The byte counters are meaningful for extraction; current/total are meaningful for strategy and target-entry construction. |
+| `BytesDone` | `long BytesDone { get; init; }` |  |
+| `BytesTotal` | `long BytesTotal { get; init; }` |  |
+| `Current` | `int Current { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Phase` | `string Phase { get; init; }` |  |
+| `Total` | `int Total { get; init; }` |  |
 
 #### `SolidBlockOptimizer.OptimizeResult`
 
@@ -13099,7 +13115,7 @@ One file entry inside a BioWare SFAR archive. SFARs store no in-band paths — o
 
 BioWare SFAR (Sirius File Archive) — Mass Effect 3 DLC container. References: `https://github.com/ME3Tweaks/LegendaryExplorer` — Legendary Explorer (ME3Tweaks) — modding toolset implementing SFARBioWare's DLC packaging format; no official spec, layout reverse-engineered by the modding community
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -13166,7 +13182,7 @@ An entry in a shell archive.
 
 Shell archive (shar) — self-extracting Unix shell script carrying files as here-documents. References: `https://www.gnu.org/software/sharutils/` — GNU sharutils — shar/unshar reference implementation`https://en.wikipedia.org/wiki/Shar` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -13239,7 +13255,7 @@ Represents one active entry inside a Sir-Tech SLF library (Jagged Alliance 2).
 
 Sir-Tech SLF library archive (Jagged Alliance 2). References: `https://github.com/ja2-stracciatella/ja2-stracciatella` — JA2 Stracciatella — open Jagged Alliance 2 engine; its SLF reader is the open referenceSir-Tech's library format; no official spec
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -13404,7 +13420,7 @@ Represents the metadata for a single entry in a Spark archive.
 
 RISC OS Spark archive (Acorn/ARM) — ARC-compatible layout with RISC OS file-type extensions. References: David Pilling's Spark / SparkFS (davidpilling.com) — the defining RISC OS archivernspark — portable open unarchiver for Spark/ARC archives`https://en.wikipedia.org/wiki/ARC_(file_format)` — Wikipedia — the base ARC format Spark extends
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -13595,7 +13611,7 @@ Represents a file entry in an SQX archive.
 
 SQX archive (SpeedProject Squeez / SpeedCommander) with multiple compression algorithms. References: SpeedProject (www.speedproject.de) — vendor of Squeez/SpeedCommander; published the "SQX Archive Format" description`https://en.wikipedia.org/wiki/SQX` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -13706,7 +13722,7 @@ Represents a single file entry in a StuffIt (SIT) archive.
 
 Macintosh StuffIt (SIT) archive — classic Mac compression with resource/data fork entries. References: `https://github.com/MacPaw/XADMaster` — XADMaster (The Unarchiver) — open StuffIt decoder, the de-facto format reference`https://en.wikipedia.org/wiki/StuffIt` — Wikipedia overviewAladdin Systems StuffIt — proprietary; no official spec published
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -13781,7 +13797,7 @@ Represents a single entry in a StuffIt X (.sitx) archive.
 
 StuffIt X (.sitx) archive (Aladdin/Smith Micro) — proprietary element-stream container. References: `https://github.com/MacPaw/XADMaster` — XADMaster (The Unarchiver) — partial open StuffIt X decoder`https://en.wikipedia.org/wiki/StuffIt` — Wikipedia — covers StuffIt Xproprietary format; the element-stream codecs have no public specification
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -13958,7 +13974,7 @@ Provides static methods for reading and writing SWF (Adobe Flash) files.
 
 Descriptor for a Split WIM (.swm / .swmN) volume — a WIM file that has been chopped into N pieces for size-limited media (DVD, FAT32, etc.). References: `https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/wim-and-esd-windows-image-files-overview` — Microsoft's WIM/ESD overview (DISM `/Split-Image` produces .swm sets)Microsoft "Windows Imaging File Format (WIM)" whitepaper — defines `part_number`/`total_parts` in the shared header`https://wimlib.net` — open-source implementation with full split-WIM support
 
-Implements `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -14078,7 +14094,7 @@ Implements `IFilesystemBlockMover`.
 
 Commodore 64 T64 tape container — directory of memory-load records. References: Peter Schepers, "C64 File Formats: T64" — the classic reference document`https://vice-emu.sourceforge.io/` — VICE emulator — reference implementation reading/writing T64
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFilesystemBlockMover`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemBlockMover`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -14175,7 +14191,7 @@ Represents a single entry in a TAR archive.
 
 Unix tape archive (tar) — 512-byte header blocks; ustar/GNU/pax variants; container only, no compression. References: `https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html` — POSIX pax — defines the ustar header and pax extended headers`https://www.gnu.org/software/tar/manual/` — GNU tar manual — GNU extensions (long names, sparse files)`https://en.wikipedia.org/wiki/Tar_(computing)` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `IFormatValidator`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `IFormatValidator`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -14357,7 +14373,7 @@ Implements `IDisposable`.
 
 Microsoft TNEF (winmail.dat) email attachment container. References: [MS-OXTNEF]: Transport Neutral Encapsulation Format (Microsoft Open Specifications, learn.microsoft.com)`https://github.com/Yeraze/ytnef` — ytnef — open TNEF decoder`https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -14438,7 +14454,7 @@ Represents a single entry (file or directory) inside a Nintendo U8 archive.
 
 Nintendo U8 archive (Wii / Wii U / 3DS) — node table + string pool + aligned file data. References: `https://wiibrew.org/wiki/U8_archive` — WiiBrew wiki — community U8 archive documentationWiimms SZS Tools (wszst) — maintained implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -14514,7 +14530,7 @@ Represents a single entry in a UHARC archive.
 
 UHARC high-compression archive (PPM/LZP/delta) by Uwe Herklotz. References: UHARC by Uwe Herklotz — closed-source archiver; the bundled UHARC documentation is the only official descriptionno public format specification; container layout reverse-engineered from the DOS/Win32 binaries
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -14581,7 +14597,7 @@ Implements `IDisposable`.
 
 Unreal Engine 1 UMX music package — tracker modules (S3M/IT/XM/MOD) wrapped in Unreal package serialization. References: `https://www.gildor.org/` — Gildor's UE tools (UE Viewer) — reference for the Unreal package formatEpic MegaGames Unreal package (UPKG) serialized-object format; music objects embed standard tracker modules
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -14636,7 +14652,7 @@ Writes a minimal UMX (Unreal Package) file with a valid header. File data is emb
 
 Unity Asset Bundle (`.unity3d` / `.assets` / `.bundle`) — the UnityFS container that ships serialized Unity assets bundled for runtime loading. Each bundled asset is listed as a Node entry (path from the internal directory). Storage blocks can be stored, LZMA, or LZ4/LZ4HC-compressed; all four are supported for reading and fresh UnityFS creation. References: `https://docs.unity3d.com/Manual/AssetBundlesIntro.html` — official Unity AssetBundle documentation`https://github.com/K0lb3/UnityPy` — UnityPy — open UnityFS parser/writer interoperability reference`https://github.com/Perfare/AssetStudio` — AssetStudio — widely used bundle inspector
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`, `IFormatOptionsSchema`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IFormatOptionsSchema`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -14721,7 +14737,7 @@ Clean-room UnityFS writer for modern Unity Asset Bundles. The writer emits versi
 
 Legacy-index Unreal Engine Pak archive. Versions 1-7 are read with strict index/entry SHA-1 verification and block-aware Stored/Zlib extraction. Fresh archives are emitted as the widely interoperable version-3 layout. Version 8+ compression-name/path-hash index generations and IoStore (`.utoc`/`.ucas`) are intentionally separate concerns. References: Epic `FPakInfo`/`FPakEntry` in Runtime/PakFile`https://github.com/panzi/u4pak` — open UE4 legacy-index reader/packer
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`, `IFormatOptionsSchema`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IFormatOptionsSchema`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15420,7 +15436,7 @@ Entry in a VPK archive.
 
 Valve Pak (VPK) game resource archive — directory-tree index, optionally split across numbered data packs. References: `https://developer.valvesoftware.com/wiki/VPK` — Valve Developer Community — VPK format and tool documentation`https://github.com/ValvePython/vpk` — open VPK implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15490,7 +15506,7 @@ Represents a single file entry in a VPP_PC v1 archive.
 
 Volition Package (VPP v1) — Red Faction 1 / Summoner game archive. References: `https://github.com/gibbed/Gibbed.Volition` — Gibbed.Volition — community tools for Volition package formatsVolition's game archive; no official spec, layout community-documented
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15564,7 +15580,7 @@ Represents a single file entry in a VPP v2 (Saint's Row 2) archive.
 
 Volition Package v2 (Saint's Row 2 era) descriptor — handles `.vpp_pc` archives with optional per-entry zlib compression. References: `https://github.com/gibbed/Gibbed.Volition` — Gibbed.Volition — community tools for Volition package formatsVolition's package format for Saints Row 2 (.vpp_pc); no official spec, reverse-engineered
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15625,7 +15641,7 @@ Implements `IDisposable`.
 
 Microsoft Visio VSDX drawing — an OPC ZIP package. References: [MS-VSDX]: Visio Graphics Service File Format (Microsoft Open Specifications, learn.microsoft.com)`https://ecma-international.org/publications-and-standards/standards/ecma-376/` — ECMA-376 Part 2 — Open Packaging Conventions, the container VSDX uses`https://en.wikipedia.org/wiki/Microsoft_Visio` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15662,7 +15678,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 Descriptor for the WACZ (Web Archive Collection Zipped) format — a ZIP container that wraps one or more WARC files together with a Frictionless-Data manifest, page index and optional resource bundles. References: `https://specs.webrecorder.net/wacz/1.1.1/` — the WACZ 1.1.1 specification (Webrecorder)`https://webrecorder.net` — Webrecorder, the format's author and reference tooling (py-wacz, ReplayWeb.page)
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15706,7 +15722,7 @@ Represents a single lump entry in a WAD archive.
 
 Doom WAD (IWAD/PWAD) — the id Software lump-directory game-data archive. References: `https://doomwiki.org/wiki/WAD` — Doom Wiki — definitive community WAD documentationMatthew S. Fell, "The Unofficial Doom Specs" — the original public format documentation`https://en.wikipedia.org/wiki/Doom_WAD` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15783,7 +15799,7 @@ Represents a single entry in a WAD2/WAD3 texture archive.
 
 WAD2 texture/lump archive used by Quake (WAD3 variant used by GoldSrc/Half-Life). References: id Software "Quake Specifications" v3.4 — documents the WAD2 lump directory`https://developer.valvesoftware.com/wiki/WAD` — Valve Developer Community — the WAD3 (GoldSrc) variant
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15855,7 +15871,7 @@ Implements `IDisposable`.
 
 Java Web Application Archive (WAR) — a ZIP/JAR with WEB-INF layout. References: `https://jakarta.ee/specifications/servlet/` — Jakarta Servlet specification — defines WAR packaging`https://en.wikipedia.org/wiki/WAR_(file_format)` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -15906,7 +15922,7 @@ Represents a single record in a WARC archive.
 
 Descriptor for WARC (Web ARChive, ISO 28500) files — the record-oriented container web crawlers use to store captured HTTP transactions and metadata. References: ISO 28500:2017 "WARC file format" — the defining standard`https://iipc.github.io/warc-specifications/` — IIPC-maintained WARC specifications and proposals`https://en.wikipedia.org/wiki/WARC_(file_format)` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16058,7 +16074,7 @@ WORM writer for Web Bundle (`.wbn`) files. Emits the canonical 10-byte CBOR-arra
 
 Descriptor for a Python wheel distribution (`.whl`) — a ZIP archive that obeys the on-disk layout mandated by PEP 427. References: `https://peps.python.org/pep-0427/` — PEP 427, the original wheel binary-package specification`https://packaging.python.org/en/latest/specifications/binary-distribution-format/` — the living binary-distribution (wheel) format spec that superseded the PEP text
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16129,7 +16145,7 @@ Constants for the Windows Imaging (WIM) file format.
 
 Windows Imaging Format (WIM) — file-based disk image with single-instance resource storage. References: Microsoft, "Windows Imaging File Format (WIM)" white paper — the vendor format description`https://wimlib.net/` — wimlib — open implementation with detailed format documentation`https://en.wikipedia.org/wiki/Windows_Imaging_Format` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16250,7 +16266,7 @@ Writes a WIM (Windows Imaging) file to a stream.
 
 Wrapster container — arbitrary files disguised as an MP3 (v1/v2/v3) for Napster-era sharing. References: Wrapster (ca. 2000) — the defining Napster-era tool; no formal spec ever publishedlayout reverse-engineered from the tool's output (fake MP3 framing + embedded file table)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16331,7 +16347,7 @@ Represents a single file entry in a XAR archive.
 
 eXtensible ARchive (XAR) — gzip-compressed XML table of contents + heap; used by Apple installer packages. References: `https://github.com/mackyle/xar` — maintained xar sources (format documentation in the repository)`https://en.wikipedia.org/wiki/Xar_(archiver)` — Wikipedia overvieworiginally released as an OpenDarwin/Apple open-source project
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16397,7 +16413,7 @@ Implements `IDisposable`.
 
 Office Open XML spreadsheet (.xlsx) — an OPC ZIP package. References: `https://ecma-international.org/publications-and-standards/standards/ecma-376/` — ECMA-376 Office Open XML File Formats (also ISO/IEC 29500)`https://en.wikipedia.org/wiki/Office_Open_XML` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16433,7 +16449,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 Mozilla XPI extension package (ZIP-based) for Firefox/Thunderbird. References: `https://extensionworkshop.com/` — Mozilla Extension Workshop — extension packaging documentation`https://en.wikipedia.org/wiki/XPInstall` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16647,7 +16663,7 @@ One entry in a YPF v480 archive. `IsCorrupt` is set by `YpfReader` when the stor
 
 YPF resource archive of the YU-RIS / YukaScript visual-novel engine. References: `https://github.com/morkt/GARbro` — GARbro — implements YPF extraction for the YU-RIS engineYU-RIS engine's packaging format; no official spec, reverse-engineered
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16725,7 +16741,7 @@ Implements `IDisposable`.
 
 Amiga ZAP disk archive — LZ77+RLE backward-bitstream disk packer. References: `https://aminet.net/` — Aminet — distribution home of the Amiga ZAP disk archiverno formal spec; format known from the tool's own documentation and depacker sources
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -16840,7 +16856,7 @@ Represents a single entry in a ZIP archive.
 
 ZIP archive — the universal container with per-entry compression methods. References: `https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT` — PKWARE APPNOTE.TXT — the canonical .ZIP file format specification`https://en.wikipedia.org/wiki/ZIP_(file_format)` — Wikipedia overviewInfo-ZIP zip/unzip — long-standing open reference implementations
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `IFormatValidator`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `IFormatValidator`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -17088,7 +17104,7 @@ Represents a single file entry in a Zoo archive.
 
 Zoo archive — early DOS/Unix compressor by Rahul Dhesi (LZW/LZH methods). References: `https://en.wikipedia.org/wiki/Zoo_(file_format)` — Wikipedia overviewRahul Dhesi's zoo 2.10 sources — the defining implementation (widely mirrored)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -17238,7 +17254,7 @@ Represents a single file entry recorded in a ZPAQ journaling archive.
 
 ZPAQ journaling archive with content-defined deduplication and configurable context-mixing compression. References: `http://mattmahoney.net/dc/zpaq.html` — official ZPAQ page and Level 2 format specification (Matt Mahoney)`https://github.com/zpaq/zpaq` — reference implementation`https://en.wikipedia.org/wiki/ZPAQ` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
diff --git a/Hawkynt.FileFormats.Audio/REFERENCE.md b/Hawkynt.FileFormats.Audio/REFERENCE.md
index 5f86b2c2a..ef03d45b5 100644
--- a/Hawkynt.FileFormats.Audio/REFERENCE.md
+++ b/Hawkynt.FileFormats.Audio/REFERENCE.md
@@ -1361,7 +1361,7 @@ Represents a single audio entry within a Square Enix AKB audio bank.
 
 Square Enix AKB audio bank descriptor — surfaces per-entry raw audio payloads plus a synthetic `metadata.ini` entry containing bank-wide header fields (sample rate, channel mode, loop points). References: `https://github.com/vgmstream/vgmstream` — vgmstream — implements AKB parsing; the de-facto referenceSquare Enix never published the AKB layout; header fields were recovered by the VGM ripping community
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1566,7 +1566,7 @@ Represents a single audio entry inside a CRI Audio Wave Bank (AFS2). The wave ba
 
 CRI Audio Wave Bank (AFS2) — used by Capcom (Resident Evil, Monster Hunter), Sega (Yakuza, Persona 5), and other CRI Middleware titles. Contains raw codec payloads (HCA, ADX, etc.) which are surfaced verbatim — we do not decode the inner audio. References: `https://github.com/vgmstream/vgmstream` — vgmstream — implements AFS2/AWB parsing; the de-facto referenceCRI Middleware never published the AFS2 layout; it was recovered by the VGM ripping community
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1725,7 +1725,7 @@ Implements `IArchiveFormatOperations`, `IArchiveInMemoryExtract`, `IFormatDescri
 
 Format descriptor and stream operations for the FLAC (Free Lossless Audio Codec) format. Also surfaces an archive view: `FULL.flac` plus one mono WAV per channel (`LEFT.wav`/`RIGHT.wav`/...) so multi-channel FLAC files can be decomposed in the archive browser.
 
-Implements `IArchiveFormatOperations`, `IArchiveInMemoryExtract`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IStreamFormatOperations`.
+Implements `IArchiveFormatOperations`, `IArchiveInMemoryExtract`, `IArchiveLayoutMap`, `IFormatDescriptor`, `IStreamFormatOperations`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
diff --git a/Hawkynt.FileFormats.FileSystems/Hawkynt.FileFormats.FileSystems.csproj b/Hawkynt.FileFormats.FileSystems/Hawkynt.FileFormats.FileSystems.csproj
index 3ef4eb3d2..ed0d0114f 100644
--- a/Hawkynt.FileFormats.FileSystems/Hawkynt.FileFormats.FileSystems.csproj
+++ b/Hawkynt.FileFormats.FileSystems/Hawkynt.FileFormats.FileSystems.csproj
@@ -142,4 +142,12 @@
     </ItemGroup>
   </Target>
 
+  <!-- Keep the NuGet bundle exhaustive too. The Remove eliminates the
+       legacy explicit subset above; the glob makes new FileSystem.* projects
+       part of the package automatically. -->
+  <ItemGroup>
+    <ProjectReference Remove="..\FileSystems\FileSystem.*\FileSystem.*.csproj" />
+    <ProjectReference Include="..\FileSystems\FileSystem.*\FileSystem.*.csproj" PrivateAssets="all" />
+  </ItemGroup>
+
 </Project>
diff --git a/Hawkynt.FileFormats.FileSystems/README.md b/Hawkynt.FileFormats.FileSystems/README.md
index 5f37d346a..779495f26 100644
--- a/Hawkynt.FileFormats.FileSystems/README.md
+++ b/Hawkynt.FileFormats.FileSystems/README.md
@@ -366,7 +366,7 @@ The filesystem package is built against the repository's shared Core version. Re
 
 <!-- API:BEGIN generated by Hawkynt/RepositoryTemplate/package-readme — edit the XML docs in source, not here -->
 
-Every public and protected member of all 583 types, generated from the built assembly and its XML documentation, is in [REFERENCE.md](https://github.com/Hawkynt/CompressionWorkbench/blob/main/Hawkynt.FileFormats.FileSystems/REFERENCE.md).
+Every public and protected member of all 832 types, generated from the built assembly and its XML documentation, is in [REFERENCE.md](https://github.com/Hawkynt/CompressionWorkbench/blob/main/Hawkynt.FileFormats.FileSystems/REFERENCE.md).
 
 <!-- API:END -->
 
diff --git a/Hawkynt.FileFormats.FileSystems/REFERENCE.md b/Hawkynt.FileFormats.FileSystems/REFERENCE.md
index f613f59c3..9d6d5d79a 100644
--- a/Hawkynt.FileFormats.FileSystems/REFERENCE.md
+++ b/Hawkynt.FileFormats.FileSystems/REFERENCE.md
@@ -28,7 +28,7 @@ Represents a file or directory entry in a BIN/CUE disc image.
 
 BIN/CUE CD-ROM image — raw 2352-byte sector dump (.bin) described by a CDRWIN cue sheet (.cue). References: Golden Hawk Technology CDRWIN user manual — the defining cue-sheet documentation`https://en.wikipedia.org/wiki/Cue_sheet_(computing)` — cue-sheet syntax overviewECMA-130 — CD-ROM sector layout (mode 1 / mode 2 framing)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -125,7 +125,7 @@ Represents a file or directory entry in a DiscJuggler CDI disc image.
 
 DiscJuggler CDI disc image (Padus) — track data plus trailing session/track descriptor blocks. References: `https://en.wikipedia.org/wiki/DiscJuggler` — background on the creating toolCDIrip source — the DiscJuggler layout was reverse-engineered by the disc-preservation community; Padus never published a spec
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -202,7 +202,7 @@ Implements `IDisposable`.
 
 PSP CSO / ZSO compressed ISO image. Layout after the 4-byte magic (`CISO` for CSO, `ZISO` for LZ4-compressed ZSO): uint32 header_size, uint64 uncompressed_size, uint32 block_size, uint8 version, uint8 align, uint16 reserved, then an index table of `N = uncompressed_size / block_size + 1` uint32 entries (high bit = stored/uncompressed, low 31 bits = file offset). This descriptor surfaces each compressed block as a raw blob — it does NOT decompress the blocks (consumers can further process with zlib for CSO or LZ4 for ZSO). References: `https://github.com/unknownbrackets/maxcso` — maxcso — maintained CSO/ZSO tool; its docs describe the CSO v1/v2 and ZSO layoutsThe format originates in PSP homebrew (ciso); there is no official Sony documentation
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -259,7 +259,7 @@ Writes a PSP CSO v1 ("CISO") compressed-ISO container from scratch (WORM). Layou
 
 Apple disk image (DMG/UDIF) — "koly" trailer + XML plist block map (blkx) with zlib/bzip2/ADC-compressed chunks. References: `http://newosxbook.com/DMG.html` — Jonathan Levin's UDIF format write-up — the standard unofficial reference (Apple never published a spec)`https://github.com/darlinghq/darling-dmg` — darling-dmg — open-source DMG/UDIF implementation`https://en.wikipedia.org/wiki/Apple_Disk_Image` — format overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -276,30 +276,32 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds or replaces partitions in the raw UDIF profile emitted by this writer. Existing partition payload offsets are preserved; new data occupies the old plist tail and only the blkx/plist + koly index are rewritten. |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
 | `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single DMG partition as a bounded read-only `Stream`. The reader's per-entry extractor reconstructs the partition's raw sectors; they are wrapped in a `BoundedEntryStream` sized to the entry's size. |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes partitions from the raw UDIF profile by dropping their blkx records. Payload bytes are left as unreachable data-fork slack so unrelated partitions never need to move. |
 
 #### `DmgReader`
 
-Read-only reader for Apple Disk Image (DMG) files. Parses the koly trailer, XML plist, and mish block tables to expose each partition as an extractable entry.
+Reader for Apple Disk Image (DMG/UDIF) files. Parses the koly trailer, XML plist, and mish block tables to expose each partition as an entry.
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `DmgReader` | `DmgReader(Stream stream, bool leaveOpen = false)` |  |
-| `Entries` | `IReadOnlyList<DmgEntry> Entries { get; }` | All partitions found in the DMG, each exposed as a named entry. |
+| `Entries` | `IReadOnlyList<DmgEntry> Entries { get; }` |  |
 | `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(DmgEntry entry)` | Reassembles and returns the raw sector data for `entry`. |
+| `Extract` | `byte[] Extract(DmgEntry entry)` |  |
 
 #### `DmgWriter`
 
-Writes Apple Disk Image (DMG) files in WORM mode. Each input file becomes one partition with a single raw (uncompressed) mish block. The output roundtrips through `DmgReader`: Layout: [partition data sectors] [XML plist] [512-byte koly trailer].Each partition has a mish table with one `BlockTypeRaw` entry covering all its sectors plus a terminator.No compression -- DMG's zlib/bz2/lzfse encoders aren't paired here, and raw is fully spec-valid.No checksums -- mish/koly checksum-type fields set to 0 ("none"), which the reader accepts.
+Writes Apple Disk Image (DMG/UDIF) files using raw `mish` blocks. Each input becomes one partition and the exact caller-visible byte length is carried in a private plist key so non-sector-aligned inputs round-trip without exposing the mandatory 512-byte UDIF sector padding.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -313,9 +315,9 @@ Writes Apple Disk Image (DMG) files in WORM mode. Each input file becomes one pa
 
 #### `DtbFormatDescriptor`
 
-Pseudo-archive descriptor for Flattened Device Tree Blobs (DTB/DTBO). Walks the structure block and emits one entry per leaf property. Property data that parses cleanly as a UTF-8 string list is written as a `.txt` file; anything else is written as raw bytes. A `metadata.ini` summarises the FDT header + memory reservation map. References: `https://github.com/devicetree-org/devicetree-specification` — Devicetree Specification — defines the flattened (FDT/DTB) encoding`https://www.devicetree.org` — devicetree.org portal`https://en.wikipedia.org/wiki/Device_tree` — background
+Pseudo-archive descriptor for Flattened Device Tree Blobs (DTB/DTBO). Walks the structure block and emits one entry per leaf property. Property data that parses cleanly as a UTF-8 string list is written as a `.txt` file; anything else is written as raw bytes. A `metadata.ini` summarises the FDT header + memory reservation map. References: `https://github.com/devicetree-org/devicetree-specification` — Devicetree Specification — defines the flattened (FDT/DTB) encoding`https://www.devicetree.org` — devicetree.org portal
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -332,9 +334,11 @@ Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IFormatDescriptor`.
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | WORM creation: emits a minimal valid FDT v17 blob whose root node carries each input as a leaf property. The synthetic `metadata.ini` + any reader-emitted `.txt`/`.bin` suffixes are stripped from the archive name before sanitisation so a list-then-create round-trip lands at the same property name. Property names are sanitised to the devicetree-spec character set; collisions in the input list are preserved as repeated FDT_PROP records. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
 
 #### `DtbReader`
 
@@ -411,13 +415,13 @@ Implements `IEquatable<Reservation>`.
 
 #### `DtbWriter`
 
-WORM writer for the Flattened Device Tree Blob (FDT v17) format. Produces a minimal valid DTB where every input becomes a leaf property on the root node. The root node carries spec-required `#address-cells = <2>` and `#size-cells = <2>` properties so the blob round-trips through `fdtdump` / `dtc` consumers without warnings.
+Writer for Flattened Device Tree Blob (FDT v17) images.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `DtbWriter` | `DtbWriter()` |  |
-| `SanitisePropertyName` | `static string SanitisePropertyName(string archiveName)` | Coerces an input archive name into a property name valid per devicetree-specification §2.2.4 (ASCII subset of property-name chars). Reserved chars are replaced with `_`; the leaf of any path is used. |
-| `Write` | `static void Write(Stream output, IReadOnlyList<ValueTuple<string, byte[]>> inputs)` | Writes a minimal FDT blob to `output` whose root node contains one property per input. Each input's archive-name leaf is used as the property name; the raw bytes become the property value. Names are deduplicated in the strings block, but each occurrence still gets its own FDT_PROP record (multiple identical property names on one node are technically nonconforming, but matching the input list verbatim is the honest WORM behaviour). |
+| `SanitisePropertyName` | `static string SanitisePropertyName(string archiveName)` |  |
+| `Write` | `static void Write(Stream output, IReadOnlyList<ValueTuple<string, byte[]>> inputs)` |  |
 
 ### Namespace `FileFormat.Ewf`
 
@@ -425,9 +429,9 @@ WORM writer for the Flattened Device Tree Blob (FDT v17) format. Produces a mini
 
 #### `EwfFormatDescriptor`
 
-Pseudo-archive descriptor for EnCase Expert Witness Format (EWF) forensic images (.e01/.ewf/.l01). Surfaces each parsed section as a separate entry along with a `metadata.ini` summarising acquisition parameters pulled from the `header`/`header2`/`hash`/`digest` sections. Full sector decompression + segment chaining across multi-file sets is deferred to a later phase — forensic tooling (libewf, EnCase) can decode the per-section data directly. References: `https://github.com/libyal/libewf` — libewf — canonical open-source implementation; its documentation folder carries Joachim Metz's EWF/EWF2 format specsASR Data "Expert Witness Compression Format" — the original format the EnCase .E01 family derives from
+EnCase Expert Witness Format (EWF/E01) descriptor. The mutable archive surface is the forensic image's logical `media.raw` payload; parsed section payloads remain available as read-only diagnostic entries. Existing physical EVF images can therefore be replaced, purged, canonicalized, compressed and shrunk without pretending their internal sections are user files.
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -443,14 +447,26 @@ Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IFormatDescriptor`.
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a single-segment .E01 image wrapping the supplied input(s) as raw media. EWF is a media-wrapper format, so file inputs are concatenated into one contiguous raw image (the common case is a single disk-image input). The produced image is accepted by libewf's `ewfverify`. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `AnalyzeLayout` | `LayoutAnalysis AnalyzeLayout(Stream image)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateLayout` | `IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Purge` | `void Purge(Stream archive)` |  |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `Shrink` | `void Shrink(Stream input, Stream output)` |  |
 
 #### `EwfReader`
 
-Reader for EnCase Expert Witness Format (EWF) forensic images — the .e01/.ewf/.l01 family used by EnCase and libewf. Walks the section chain starting at offset 13 (just past the 8-byte signature + 1-byte fields_start + 2-byte segment + 2-byte fields_end) and surfaces each section's raw bytes along with parsed metadata. Full sector decompression is deferred.
+Reader for EnCase Expert Witness Format (EWF) forensic images — the .e01/.ewf/.l01 family used by EnCase and libewf. Besides the raw section chain it reconstructs the logical media carried by the common single-segment EVF layout emitted by `EwfWriter`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -459,7 +475,8 @@ Reader for EnCase Expert Witness Format (EWF) forensic images — the .e01/.ewf/
 | `FileHeaderSize` | `const int FileHeaderSize` |  |
 | `LvfSignature` | `static readonly byte[] LvfSignature` |  |
 | `SectionDescriptorSize` | `const int SectionDescriptorSize` |  |
-| `Read` | `static EwfImage Read(ReadOnlySpan<byte> data)` |  |
+| `ExtractMedia` | `static byte[] ExtractMedia(EwfImage image)` | Reconstructs the logical raw media from a single EVF segment. Stored chunks have their trailing Adler-32 removed and verified; compressed chunks are decoded as zlib according to the table-entry MSB. |
+| `Read` | `static EwfImage Read(ReadOnlySpan<byte> data)` | Reads one EWF segment and its section chain. |
 
 #### `EwfReader.EwfImage`
 
@@ -610,7 +627,7 @@ Reader for TI-TXT MSP430 text firmware files. Addresses are introduced by `@HHHH
 
 Apple IPSW / OTA firmware package. An IPSW is just a ZIP file (with an Apple-specific layout). Rather than surfacing entries as a flat generic ZIP, this descriptor lifts the well-known Apple artifacts (`BuildManifest.plist`, `Firmware/` subtree, `LLB.*`, `iBSS.*`, `iBEC.*`, `iBoot.*`, root-filesystem `*.dmg`) into first-class canonical entries. Everything else is exposed under `other/`. This is a compound-extension descriptor (`.ipsw`, `.otazip`): magic is empty so it does not steal generic ZIPs. Read-only; the plist and DMG payloads are emitted as raw bytes — no plist parsing or DMG mounting. References: `https://theapplewiki.com` — The Apple Wiki (formerly The iPhone Wiki) — community IPSW documentation`https://github.com/blacktop/ipsw` — ipsw — maintained IPSW research and extraction tool`https://en.wikipedia.org/wiki/IPSW` — Wikipedia
 
-Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -651,7 +668,7 @@ In-place modifier for Apple IPSW packages. An IPSW is just a ZIP file with an Ap
 
 Commodore 64 Lynx/LNX archive. The format stores a textual PETSCII-ish directory and uncompressed file extents in 254-byte blocks mirroring a 1541 sector with its two link bytes removed.
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`, `IFormatOptionsSchema`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -701,7 +718,7 @@ Represents a file or directory entry in an MDF disc image.
 
 Alcohol 120% MDF/MDS disc image pair — raw sector data (.mdf) plus a session/track descriptor (.mds). References: `https://cdemu.sourceforge.io` — CDEmu / libMirage — its MDS/MDF parser is the de-facto format documentationNo official specification — proprietary Alcohol Soft format, reverse-engineered
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -789,7 +806,7 @@ Represents a file or directory entry in a Nero NRG disc image.
 
 Nero Burning ROM NRG disc image — trailing NER5/NERO footer pointing at a chunked session/track descriptor area. References: `https://cdemu.sourceforge.io` — CDEmu / libMirage — its NRG parser is the de-facto format documentation`https://en.wikipedia.org/wiki/NRG_(file_format)` — WikipediaNo official specification — proprietary Nero format, reverse-engineered
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -877,7 +894,7 @@ Represents a single entry in a Nintendo Switch PartitionFS (PFS0) archive.
 
 Nintendo Switch PartitionFS (PFS0) archive — the flat file table inside NSP packages. References: `https://switchbrew.org/` — Switchbrew wiki — community reverse-engineered Switch format documentation (PFS0/NSP)`https://github.com/SciresM/hactool` — hactool — reference extraction tool implementing PFS0
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -957,7 +974,7 @@ Implements `IDisposable`.
 
 QEMU Copy-On-Write v2/v3 (qcow2) disk image — two-level L1/L2 cluster-mapped sparse virtual disk. References: `docs/interop/qcow2.rst` in the QEMU source tree — the authoritative on-disk specification`https://gitlab.com/qemu-project/qemu` — canonical QEMU repository`https://en.wikipedia.org/wiki/Qcow` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1071,7 +1088,7 @@ Implements `IFilesystemBlockMover`.
 
 Commodore 64 T64 tape container — directory of memory-load records. References: Peter Schepers, "C64 File Formats: T64" — the classic reference document`https://vice-emu.sourceforge.io/` — VICE emulator — reference implementation reading/writing T64
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFilesystemBlockMover`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemBlockMover`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1168,7 +1185,7 @@ Implements `IFilesystemBlockMover`.
 
 ZX Spectrum TAP tape image — length-prefixed blocks as written by the ROM SAVE routine. References: `https://sinclair.wiki.zxnet.co.uk/wiki/TAP_format` — Sinclair wiki — TAP format descriptionWorld of Spectrum "File format reference" — long-standing community documentation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFilesystemBlockMover`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemBlockMover`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1304,9 +1321,9 @@ Implements `IEquatable<UImage>`.
 
 #### `UefiFvFormatDescriptor`
 
-Pseudo-archive descriptor for UEFI PI Firmware Volumes (`.fv`/`.fd`). Locates the FV by scanning for the `_FVH` signature at offset 40 and emits one entry per FFS file, named `{GUID}_{TYPE_TAG}.bin`. References: `https://uefi.org/specifications` — UEFI Platform Initialization (PI) Specification — Volume 3 defines Firmware Volumes and FFS`https://github.com/LongSoft/UEFITool` — UEFITool — canonical firmware-volume parser/editor
+UEFI PI Firmware Volume (`.fv`/`.fd`) archive surface. FFS files are exposed as `{GUID}_{TYPE_TAG}.bin`; standalone volumes can be created and ordinary FFS2 records can be added/replaced/removed through erased free space. References: `https://uefi.org/specifications` — UEFI Platform Initialization (PI) Specification, Volume 3: Firmware Storage Design`https://github.com/LongSoft/UEFITool` — UEFITool firmware-volume parser/editor
 
-Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1323,61 +1340,58 @@ Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
 
 #### `UefiFvReader`
 
-Reader for UEFI Platform Initialization (PI) Firmware Volumes. Locates the FV header by scanning for the `_FVH` signature at offset 40 from the start of each 16-byte-aligned candidate (UEFI PI Volume 3). Walks the FFS file list and returns one `FfsFile` record per file.
+Reader for UEFI Platform Initialization (PI) Firmware Volumes. Locates the FV header by scanning for the `_FVH` signature at offset 40 from the start of each 16-byte-aligned candidate (UEFI PI Volume 3). Walks the FFS file list and returns one `FfsFile` record per live file.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `UefiFvReader` | `UefiFvReader()` |  |
-| `SignatureOffset` | `const int SignatureOffset` | Signature offset from FV start. |
-| `Signature` | `static readonly byte[] Signature` | FV signature bytes (`_FVH`) at FV offset 40. |
-| `FileTypeName` | `static string FileTypeName(byte t)` | Decodes the FFS type byte to the UEFI PI spec name. |
-| `FindFirst` | `static int? FindFirst(ReadOnlySpan<byte> data)` | Scans `data` for the first `_FVH` signature and returns the FV start. |
-| `Read` | `static FirmwareVolume Read(ReadOnlySpan<byte> data, int fvStart = 0)` | Parses a firmware volume located at the given file offset. |
-| `ShortTypeTag` | `static string ShortTypeTag(byte t)` | Returns a short type tag for use in entry names (e.g. `RAW`, `DRIVER`). |
+| `SignatureOffset` | `const int SignatureOffset` |  |
+| `Signature` | `static readonly byte[] Signature` |  |
+| `FileTypeName` | `static string FileTypeName(byte t)` |  |
+| `FindFirst` | `static int? FindFirst(ReadOnlySpan<byte> data)` |  |
+| `Read` | `static FirmwareVolume Read(ReadOnlySpan<byte> data, int fvStart = 0)` |  |
+| `ShortTypeTag` | `static string ShortTypeTag(byte t)` |  |
 
 #### `UefiFvReader.FfsFile`
 
-A single FFS (Firmware File System) file inside the FV.
-
 Implements `IEquatable<FfsFile>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FfsFile` | `FfsFile(Guid Name, byte Type, byte Attributes, byte State, uint Size, byte[] Contents)` | A single FFS (Firmware File System) file inside the FV. |
-| `Attributes` | `byte Attributes { get; init; }` | FFS file attributes byte. |
-| `Contents` | `byte[] Contents { get; init; }` | File contents (size minus the 24-byte header). |
-| `Name` | `Guid Name { get; init; }` | File GUID (`EFI_FFS_FILE_HEADER.Name`). |
-| `Size` | `uint Size { get; init; }` | Declared file size including the 24-byte header. |
-| `State` | `byte State { get; init; }` | FFS file state byte. |
-| `Type` | `byte Type { get; init; }` | Raw FFS type byte (see `FileTypeName`). |
+| `FfsFile` | `FfsFile(Guid Name, byte Type, byte Attributes, byte State, uint Size, byte[] Contents)` |  |
+| `Attributes` | `byte Attributes { get; init; }` |  |
+| `Contents` | `byte[] Contents { get; init; }` |  |
+| `Name` | `Guid Name { get; init; }` |  |
+| `Size` | `uint Size { get; init; }` |  |
+| `State` | `byte State { get; init; }` |  |
+| `Type` | `byte Type { get; init; }` |  |
 
 #### `UefiFvReader.FirmwareVolume`
 
-Parsed firmware volume.
-
 Implements `IEquatable<FirmwareVolume>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FirmwareVolume` | `FirmwareVolume(int StartOffset, FvHeader Header, IReadOnlyList<FfsFile> Files)` | Parsed firmware volume. |
+| `FirmwareVolume` | `FirmwareVolume(int StartOffset, FvHeader Header, IReadOnlyList<FfsFile> Files)` |  |
 | `Files` | `IReadOnlyList<FfsFile> Files { get; init; }` |  |
 | `Header` | `FvHeader Header { get; init; }` |  |
 | `StartOffset` | `int StartOffset { get; init; }` |  |
 
 #### `UefiFvReader.FvHeader`
 
-FV header (excluding block map + extended header body).
-
 Implements `IEquatable<FvHeader>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FvHeader` | `FvHeader(Guid FileSystemGuid, ulong FvLength, uint Attributes, ushort HeaderLength, ushort Checksum, ushort ExtHeaderOffset, byte Revision, IReadOnlyList<ValueTuple<uint, uint>> BlockMap)` | FV header (excluding block map + extended header body). |
+| `FvHeader` | `FvHeader(Guid FileSystemGuid, ulong FvLength, uint Attributes, ushort HeaderLength, ushort Checksum, ushort ExtHeaderOffset, byte Revision, IReadOnlyList<ValueTuple<uint, uint>> BlockMap)` |  |
 | `Attributes` | `uint Attributes { get; init; }` |  |
 | `BlockMap` | `IReadOnlyList<ValueTuple<uint, uint>> BlockMap { get; init; }` |  |
 | `Checksum` | `ushort Checksum { get; init; }` |  |
@@ -1403,7 +1417,7 @@ Implements `IEquatable<FvHeader>`.
 
 VirtualBox VDI virtual disk image — block-mapped sparse/fixed disk container. References: `https://www.virtualbox.org/` — VirtualBox — the VDI layout is defined by its open-source Storage/VDI code`https://en.wikipedia.org/wiki/VDI_(file_format)` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1531,7 +1545,7 @@ Implements `IEquatable<CompactResult>`.
 
 Microsoft VHD virtual hard disk (fixed/dynamic/differencing; 512-byte footer). References: Microsoft, "Virtual Hard Disk Image Format Specification" v1.0 (2006, published under the Open Specification Promise)`https://github.com/libyal/libvhdi` — libvhdi — open implementation with format documentation`https://en.wikipedia.org/wiki/VHD_(file_format)` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1620,7 +1634,7 @@ Creates fixed or dynamic VHD images.
 
 Descriptor for Hyper-V VHDX virtual hard-disk images (MS-VHDX v1). For fixed-payload VHDX images the descriptor delegates List, Extract, Add, Remove, and Defragment operations to the detected inner filesystem via `VhdxStream`. Falls back to structural metadata listing when the inner FS is not detected or the image uses dynamic/differencing layout. References: [MS-VHDX]: Virtual Hard Disk v2 (VHDX) File Format (Microsoft Open Specifications, learn.microsoft.com)`https://github.com/libyal/libvhdi` — libvhdi — open VHD/VHDX implementation with format documentation`https://en.wikipedia.org/wiki/VHD_(file_format)` — Wikipedia overview (covers VHDX)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1750,7 +1764,7 @@ Writes spec-compliant Microsoft VHDX (MS-VHDX v2) virtual hard-disk images from
 
 VMware VMDK virtual disk (sparse extents with grain directories/tables). References: VMware, "Virtual Disk Format 5.0" technical note — the vendor VMDK specification`https://github.com/libyal/libvmdk` — libvmdk — open implementation with format documentation`https://en.wikipedia.org/wiki/VMDK` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IPartitionEditable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1869,7 +1883,7 @@ Walks an Amiga ADF image (901,120 bytes, 1760 × 512-byte sectors) and yields th
 
 References: `http://lclevy.free.fr/adflib/adf_info.html` — Laurent Clévy's ADF / AmigaDOS (OFS/FFS) on-disk format reference, the de-facto ADF specADFlib — the reference open-source ADF implementation built on that document`https://en.wikipedia.org/wiki/Amiga_Disk_File` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -1939,6 +1953,147 @@ Creates Amiga Disk File (.adf) images using the Fast File System (FFS). Produces
 | `AddFile` | `void AddFile(string name, byte[] data, DateTime? modTime = null)` | Adds a file to the disk image being built. |
 | `Build` | `byte[] Build(string diskName = "DISK", byte fileSystemType = 1)` | Builds and returns the complete 901,120-byte ADF disk image. |
 
+### Namespace `FileSystem.Adfs`
+
+[`AdfsBlockMover`](#adfsblockmover) · [`AdfsEntry`](#adfsentry) · [`AdfsExtentMap`](#adfsextentmap) · [`AdfsFormatDescriptor`](#adfsformatdescriptor) · [`AdfsModifier`](#adfsmodifier) · [`AdfsNewMapWriter`](#adfsnewmapwriter) · [`AdfsReader`](#adfsreader) · [`AdfsWriter`](#adfswriter)
+
+#### `AdfsBlockMover`
+
+Moves a file's sectors inside an old-map ADFS disc and rewrites the directory entry that named them.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AdfsBlockMover` | `AdfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A sector, which is what the map addresses. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. On an old-map disc that is past the free map and the root directory; on a new-map disc it is past the zone the map itself lives in. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the entry naming the run it is given. An old-map file is never in more than one piece, so one call is the whole of it. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the disc while the rest of the layout moves, which is what lets a full disc be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the map, which on a new-map disc is where the fragments are. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SettleFreeMap` | `void SettleFreeMap(Stream image, IEnumerable<ValueTuple<long, long>> live)` | Writes the free-space map from the runs the disc actually holds. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `AdfsEntry`
+
+Directory entry from an Acorn ADFS volume.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AdfsEntry` | `AdfsEntry()` |  |
+| `Attributes` | `byte Attributes { get; init; }` |  |
+| `ExecAddress` | `uint ExecAddress { get; init; }` |  |
+| `IndirectAddress` | `uint IndirectAddress { get; init; }` | Indirect disc address on a new-map volume: the fragment id in the high bits, a share offset in the low byte. Zero on an old-map volume, where `StartSector` locates the object instead. |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `LoadAddress` | `uint LoadAddress { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+| `StartSector` | `uint StartSector { get; init; }` |  |
+
+#### `AdfsExtentMap`
+
+Describes where an old-map ADFS disc keeps its bytes: the two free-space map sectors, the root directory, and each file's run of sectors.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `AdfsFormatDescriptor`
+
+Descriptor for Acorn Advanced Disc Filing System (ADFS) images. Read works for both old-map (S/M/L, 256-byte sectors) and new-map (D/E/F, 1024-byte sectors, fragment-mapped). Create emits a new-map volume by default, which is the layout a real ADFS driver mounts — Linux's has no code path for an old map at all; pass `Variant=old` for the ADFS-L 640 KB layout. Detected by the "Hugo" or "Nick" directory marker at sector 2 — root dir magic at file offset 0x200 (old map) or 0x400 (new map). References: Acorn "Advanced Disc Filing System User Guide" (Acorn Computers) — the original vendor format documentationRISC OS Programmer's Reference Manual, FileCore chapter — new-map (D/E/F) on-disk structures`https://en.wikipedia.org/wiki/Advanced_Disc_Filing_System` — Wikipedia overview of the ADFS variants
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AdfsFormatDescriptor` | `AdfsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The writer-honoured knob is the disc title, written as the 19-byte ASCII title in the root directory tail. The writer always emits the ADFS-L 640 KiB / 256-byte-sector geometry, so disc size is not exposed. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing ADFS-L image. Uses `AdfsModifier` for in-place mutation against the old-map FSM and Hugo-bracketed root directory — only the FSM sectors, the root directory, and the file's freshly-allocated data sectors are touched. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Emits a fresh ADFS-L disc image (640 KiB, old-map, 256-byte sectors) containing the supplied inputs at the root directory. Capacity is validated up-front against the 2 553 usable data sectors (total 2 560 minus 2 for the FSM and 5 for the root directory). |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the disc out again by moving what is out of place. An old-map file is one contiguous run and its directory entry says which sector it starts at, so a move is the copy plus three bytes; the free-space map is written once from the finished layout. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Where an old-map disc keeps its bytes: the free-space map, the root directory, and each file's contiguous run of sectors. A new-map disc describes nothing here — see `AdfsExtentMap`. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing ADFS-L image. Each entry's data sectors are wiped and returned to the FSM with adjacent-region merging, and the root directory's entry slot is compacted so the trailing zero sentinel re-engages. |
+
+#### `AdfsModifier`
+
+In-place R/W modifier for Acorn ADFS-L (old-map, 256-byte sectors, 640 KiB) images. Performs Add / Remove against the existing on-disk Hugo-bracketed root directory and the two-sector free-space map (FSM).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a single file (no path component — root-level only) to an existing ADFS-L image. The image stream must be seekable, writable, and exactly `DiskSizeL` bytes long. If the name already exists the caller should `RemoveFile` first; this method does not dedupe (matches AppleDOS modifier semantics). |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, uint loadAddr, uint execAddr, byte attrs)` | Adds a file with explicit load/exec addresses and attribute byte. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name)` | Removes a named file from an existing ADFS-L image. Returns `true` if a matching entry was found and removed. The file's data sectors are wiped (zeroed) and returned to the FSM with adjacent-region merging so the free list stays compact. |
+
+#### `AdfsNewMapWriter`
+
+Builds an Acorn ADFS new-map image — the E/F-style layout, as opposed to the S/M/L free-space-list layout `AdfsWriter` emits.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AdfsNewMapWriter` | `AdfsNewMapWriter()` |  |
+| `DirectorySize` | `const int DirectorySize` | Size of a "Hugo" directory. |
+| `IdLen` | `const int IdLen` | Bits of fragment id. Must be at least log2(sector size) + 3. |
+| `MaxSectors` | `const int MaxSectors` | Sectors one zone can describe. |
+| `MinFragmentSectors` | `const int MinFragmentSectors` | Shortest fragment the map can express, in sectors. |
+| `SectorSize` | `const int SectorSize` | Sector size: the driver reads new-map discs a block at a time. |
+| `DiscId` | `ushort DiscId { get; set; }` | Disc identifier, stored in the disc record. |
+| `DiscTitle` | `string DiscTitle { get; set; }` | Disc title, kept in the root directory's tail (19 bytes). |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the root directory. |
+| `Build` | `byte[] Build()` | Builds the image. |
+| `WriteTo` | `void WriteTo(Stream output)` | Writes the image to a stream. |
+
+#### `AdfsReader`
+
+Reader for Acorn Advanced Disc Filing System (ADFS) "old map" image formats (ADFS-S, ADFS-M, ADFS-L). Sector size = 256 bytes. The root directory is at sector 2 (file offset 0x200). Each directory is 1280 bytes (5 sectors) and bracketed by a 4-byte "Hugo" or "Nick" marker at the start (DirHdr) and matching marker just before the directory tail. Directory layout (per https://mdfs.net/Docs/Comp/Disk/Format/ADFS, originally published in the BBC Master Reference Manual): +0x000 StartName 1 byte 'H' (=0x48) — start of "Hugo" magic +0x000 "Hugo" 4 bytes (master/L variant) or "Nick" 4 bytes +0x005 DirEntries 47 entries x 26 bytes = 1222 bytes +0x4CB EndName "Hugo" again +0x4CF DirName 10-byte master sequence name (parent ref) +0x4D9 ParentInd 3-byte parent directory sector +0x4DC DirTitle 19-byte ASCII title +0x4EF Reserved 14 bytes +0x4FD EndCheckByte 1 byte Each 26-byte directory entry: +0x00 Name 10 bytes (top bit of byte 0 = attribute flag) +0x0A LoadAddr 4 bytes (LE) +0x0E ExecAddr 4 bytes (LE) +0x12 Length 4 bytes (LE) +0x16 IndCyl 3 bytes (start sector, LE) +0x19 CycleCount 1 byte (sequence #) Attributes are encoded in the high bits of the name characters (R=byte0, W=byte1, L=byte2, D=byte3, E=byte4, r=byte5, w=byte6, e=byte7, P=byte8). D = directory. We support the "old map" (S/M/L) variant by default; the newer D/E/F variants use 1024-byte sectors and a different free-space map but the directory layout is similar. Format auto-detected via the "Hugo" marker.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AdfsReader` | `AdfsReader(Stream stream)` |  |
+| `DirectoryMagic` | `string DirectoryMagic { get; }` | Magic word found in the directory header ("Hugo" / "Nick"). |
+| `Entries` | `IReadOnlyList<AdfsEntry> Entries { get; }` |  |
+| `IsNewMap` | `bool IsNewMap { get; }` | True when the volume carries a new-map (D/E/F) disc record. |
+| `SectorSize` | `int SectorSize { get; }` | Sector size — 256 bytes for old map (S/M/L), 1024 for new map (D/E/F). |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(AdfsEntry entry)` |  |
+
+#### `AdfsWriter`
+
+Builds a fresh Acorn ADFS "old-map" disk image (Write-Once-Read-Many).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AdfsWriter` | `AdfsWriter()` |  |
+| `DiskSizeL` | `const int DiskSizeL` | ADFS-L canonical size: 80 tracks × 16 sectors × 2 sides × 256 bytes. |
+| `DiskSizeM` | `const int DiskSizeM` | ADFS-M canonical size: 80 tracks × 16 sectors × 1 side × 256 bytes. |
+| `DiskSizeS` | `const int DiskSizeS` | ADFS-S canonical size: 40 tracks × 16 sectors × 1 side × 256 bytes. |
+| `SectorSize` | `const int SectorSize` | Sector size for ADFS old-map variants. |
+| `BootOption` | `byte BootOption { get; set; }` | Boot option (0..7) stored at sector 1 byte 0xFD. 0=no boot, 1=*LOAD, 2=*RUN, 3=*EXEC are the canonical values. |
+| `DiscId` | `ushort DiscId { get; set; }` | Disc identifier (16-bit) — stored at sector 0 byte 0xFB-0xFC and again at sector 1 byte 0xFB-0xFC. Used by ADFS to disambiguate physical media. |
+| `DiscSize` | `int DiscSize { get; set; }` | Target disc size — defaults to ADFS-L (640 KiB). |
+| `DiscTitle` | `string DiscTitle { get; set; }` | Disc title — 19-byte ASCII string stored in the root directory tail. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file with default load/exec addresses and no attributes. |
+| `AddFile` | `void AddFile(string name, byte[] data, uint loadAddr, uint execAddr, byte attrs)` | Adds a file with specified load/exec/attributes. |
+| `Build` | `byte[] Build()` | Builds the complete disc image. Throws `InvalidOperationException` if total file data would not fit in `DiscSize`. |
+
 ### Namespace `FileSystem.AdvFs`
 
 [`AdvFsBlockMover`](#advfsblockmover) · [`AdvFsEntry`](#advfsentry) · [`AdvFsFormatDescriptor`](#advfsformatdescriptor) · [`AdvFsReader`](#advfsreader) · [`AdvFsWriter`](#advfswriter)
@@ -1975,7 +2130,7 @@ Logical entry surfaced by `AdvFsReader`. Header/metadata entries (`FULL.advfs`,
 
 Read-only descriptor for AdvFS (Tru64 UNIX Advanced File System, DEC/HP). Open-sourced by HP in 2008 under the GPL; the storage domain → file set → file model and the on-disk structures are described in `bs_ods.h`, `bs_disk_block.h`, and `bs_public.h` of that release. Walking the BMT (Bitfile Metadata Table) B-tree and following BFD (Bitfile Descriptor) extent chains to extract user files is explicitly out of scope (multi-week effort) — this descriptor surfaces: `FULL.advfs` — the raw image bytes`metadata.ini` — parsed BSR_DMN_ATTR/BSR_VD_ATTR/BSR_DMN_MATTR fields`rbmt_page0.bin` — 4 KB capture of RBMT page 0 (offset 131072) Detection: a 16-byte cookie `"ADVFS\0RBMT0\0\0\0\0\0"` at offset 131072 (= page 16 × 8192-byte AdvFS page). This is an internal convention rather than the canonical Tru64 on-disk magic (record type discriminators rather than a fixed bytes-at-offset signature). Real Tru64 images that don't carry the cookie will not auto-detect but can still be parsed when fed to the descriptor directly. Create / Modify: a clean-room AdvFS-WB storage-domain layout with a flat file table inside RBMT page 0; `AdvFsInPlaceModifier` performs genuine in-place add/replace/remove against that table. References: `https://sourceforge.net/projects/advfs/` — HP 2008 GPL releaseHP "AdvFS Technical Reference" (in the source tarball)Wikipedia "Advanced File System"
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2048,9 +2203,118 @@ Implements `IDisposable`.
 | `Finish` | `void Finish()` | Writes the complete image to `_output`. |
 | `SetVolumeTag` | `void SetVolumeTag(string tag)` | Sets the textual volume tag surfaced in the BSR_VD_ATTR record (capped at 63 ASCII bytes). |
 
+### Namespace `FileSystem.AmigaPfs`
+
+[`AmigaPfsBlockMover`](#amigapfsblockmover) · [`AmigaPfsEntry`](#amigapfsentry) · [`AmigaPfsFormatDescriptor`](#amigapfsformatdescriptor) · [`AmigaPfsModifier`](#amigapfsmodifier) · [`AmigaPfsReader`](#amigapfsreader) · [`AmigaPfsWriter`](#amigapfswriter)
+
+#### `AmigaPfsBlockMover`
+
+Moves a file's blocks inside an AmigaPFS volume and repoints its directory entry.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AmigaPfsBlockMover` | `AmigaPfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the volume was laid out with. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the boot, root and dirblocks. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and walks the dirblock chain. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `AmigaPfsEntry`
+
+Directory entry from an AmigaPFS volume.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AmigaPfsEntry` | `AmigaPfsEntry()` |  |
+| `AnodeNumber` | `uint AnodeNumber { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `AmigaPfsFormatDescriptor`
+
+R/W descriptor for the Amiga Professional File System (PFS3 / PFS3aio). Signature "PFS\x02"/"PFS\x03"/"PFSa" at offset 0 of the boot block. Stage 1 caveat: only direct-block file references are extractable; multi- block files requiring full anode-tree traversal will report a partial extraction. The reader robustly lists all dirblock entries regardless. Stage 1 writer emits boot + root + linear dirblock chain + contiguous per-file data extents (anode-as-direct-block convention) — self-round-trip clean with the matching reader. Stage 1 R/W (this descriptor) adds in-place Add/Remove against the same shape via `AmigaPfsModifier`; image is still not FS-UAE/WinUAE mountable (full PFS3aio anode-table / bitmap / rootinfo emission deferred to a future Stage 2 promotion). References: `https://github.com/tonioni/pfs3aio` — PFS3 All-In-One source (Toni Wilen), the canonical open-source PFS3 on-disk implementationProfessional File System 3 by Michiel Pelt (original Aminet release + documentation)`https://en.wikipedia.org/wiki/Professional_File_System` — Wikipedia overview
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AmigaPfsFormatDescriptor` | `AmigaPfsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The writer-honoured knob is the volume label, written as the BCPL disk name at root-block offset +26. Block size and root-block location are fixed at the floppy convention and are not exposed. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Appends or replaces files inside an existing Stage 1 PFS3 image. Each `inputs` entry is removed by name first (so callers get replace-by-name semantics) and then written through `AmigaPfsModifier` — touching only the affected dirblock, any newly chained dirblock, and the file's contiguous data extent. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh PFS3 image from `inputs`. Directories surface as PFS dirblock entries with the directory type bit set; nested paths flatten into the root dirblock for parity with the Stage 1 reader. Image grows past the conventional 880 KB DD floppy when content requires. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file here is one contiguous run of blocks whose start is the anode number in its directory entry, so a move is the copy plus four bytes — cheaper than reading every file out and writing a fresh volume, which is what the inherited default did for the one mode it offered. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Reports the volume's layout: the boot block, root block and dirblock chain, then each file's contiguous extent, with everything between and after them free. Stage 1 lays a file out as one run starting at its anode number, so the map is exact. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing Stage 1 PFS3 image. The dirblock entry bytes and the file's data extent are zeroed; the freed blocks are not currently re-used by subsequent `Add` calls (Stage 1 has no free-list bookkeeping — extents grow past the high-water mark). |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros every byte no live file occupies. A file is one contiguous extent, so the gaps between them — and the tail past the last one — are the volume's free space. Cluster-tip wiping is inherent: an extent is reported at its logical length, so the padding to the block boundary counts as free. |
+
+#### `AmigaPfsModifier`
+
+Random-access in-place modifier for Stage 1 PFS3 images produced by `AmigaPfsWriter`. Adds and removes entries against the same on-disk shape `AmigaPfsReader` parses: root block, linear dirblock chain (id 0xC4 / 0xCC, next-chain pointer at +12, variable-length entries from +20), and per-file contiguous data extents whose starting block number is recorded as the entry's anode field. Stage 1 scope. This modifier preserves the writer's "anode-as-direct-block" convention: each file's data sits at `anode * BlockSize`, not in an anode table. The full PFS3aio anode table / bitmap / rootinfo machinery is still deferred to a future Stage 2 promotion, so mutated images are not FS-UAE/WinUAE mountable. Self-round-trip through `AmigaPfsReader` is the only correctness gate. Allocation policy. Data extents always live past the high-water mark of (last dirblock, last existing file extent). The image is grown via `SetLength` when a new file's extent or a newly chained dirblock pushes past the current length. Removed extents are zeroed in place; the freed range is not currently re-used by subsequent adds (no free-list bookkeeping — the writer never allocated one).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddDirectory` | `static void AddDirectory(Stream image, string name, DateTime? modTime = null)` | Adds a directory marker. Stage 1 PFS3 has no real subdir; the entry is recorded with the directory type bit so the reader surfaces it via `Entries`. |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, DateTime? modTime = null)` | Adds `name` with `data` to the image. If an entry with the same name already exists it is removed first (replace-by-name semantics, matching the descriptor's `Add`). |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes `name` from the image (if present). Returns true on success, false if the entry wasn't found. The file's data extent and the dirblock entry bytes are zeroed when `wipeData` is true. |
+
+#### `AmigaPfsReader`
+
+Reader for Amiga Professional File System (PFS3 / PFS3aio) — a high performance Amiga filesystem authored by Michiel Pelt & Toni Wilen. On-disk layout (BIG-endian, 512-byte blocks on floppy, configurable on HD): Block 0..1 boot block — first 4 bytes are the disk signature: "PFS\x02" (older PFS2), "PFS\x03" (PFS3) or "PFSa" (PFS3aio). Bytes 2-5 of byte 0..3 of block 0 may also carry "muFS" (multi-user fs variant). For this reader we accept the 3 standard PFS signatures. Root block typically block 80 on a floppy (located via the rootblock pointer in the bootblock). The root block carries: +0 ID 4 bytes "PFS\x02"/"PFS\x03"/"PFSa" +12 rblkcluster u16 +14 blocknr u32 +18 datestamp u32 +22 options u32 +26 diskname 32 bytes (null-padded ASCII) +60 rootinfo (anode pointers) Subsequent fields point to "anode blocks" and "dirblocks". PFS uses a tree of "anodes" — each 4-byte allocation entry pointing to a next block in a file or to the next anode in the chain. A directory is a linked list of "dirblocks", each containing variable-length entries with the filename, anode number, file size, and protection bits. This Stage 1 reader walks the bootblock + root block, identifies the first dirblock chain, and extracts simple file entries that fit in a single block reference (no fragmented file traversal across multiple anodes). Real-world PFS3 multi-block files require full anode-tree traversal which is deferred to Stage 2. Spec source: https://github.com/tonioni/AmigaPFS — public PFS3aio reference implementation; Michiel Pelt's original PFS Technical Note (1995).
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AmigaPfsReader` | `AmigaPfsReader(Stream stream, int blockSize = 512)` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size, default 512 bytes for floppy. Override by passing into the reader. |
+| `DiskName` | `string DiskName { get; }` | Disk name from the root block. |
+| `Entries` | `IReadOnlyList<AmigaPfsEntry> Entries { get; }` |  |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `Signature` | `string Signature { get; }` | 4-byte signature found in the boot block: "PFS\x02", "PFS\x03" or "PFSa". |
+| `Dispose` | `void Dispose()` |  |
+| `ExtractTo` | `long ExtractTo(AmigaPfsEntry entry, Stream destination)` | Copies `entry`'s bytes into `destination`. |
+| `Extract` | `byte[] Extract(AmigaPfsEntry entry)` |  |
+| `Locate` | `ValueTuple<long, long> Locate(AmigaPfsEntry entry)` | Resolves an entry to its byte range. Stage 1 treats the anode number as a direct block number: real PFS3 anodes index an anode table, which this reader does not walk, and the writer lays every file out to match. |
+
+#### `AmigaPfsWriter`
+
+Writer for Amiga Professional File System (PFS3) images. Emits the same on-disk shape `AmigaPfsReader` parses: Block 0: boot block — signature "PFS\x03" at +0, root-block pointer (u32 BE) at +8.Root block (default block 80, or as configured): BCPL volume label at +26 (32 bytes max), first dirblock pointer (u32 BE) at +60.Directory block(s): u16 BE id 0xC4 at +0, u32 BE next-chain pointer at +12, u32 BE parent at +16, variable-length entries starting at +20. Each entry carries length, type (bit 7 = directory), 32-bit anode number, 32-bit file size, packed date/time, BCPL filename, and a (zero-length) trailing comment.File data blocks: contiguous run of blocks starting at the file's "anode number". The Stage 1 reader treats `anode * BlockSize` as the start of the file's payload and reads exactly `Size` bytes — i.e. anode is used as a direct block pointer, not as an index into an anode-table. The writer matches that convention by allocating each file's payload as a single contiguous extent. PFS3aio (Toni Wilen's reference implementation) and Michiel Pelt's original 1995 PFS technical note describe far richer on-disk structures (anode tables, root-info pointers to anode/dir B-trees, bitmap blocks, deldir, rblkcluster groups). The Stage 1 reader explicitly does not walk those structures, so the writer's output is intentionally a Stage 1 skeleton: signature + root block + linear dirblock chain + contiguous file extents. It is sufficient for self-round-trip with the matching reader and for descriptors that exercise the WORM `Create` path. It is not mountable in FS-UAE / WinUAE — full anode/bitmap emission would be required for emulator parity and is deferred to a Stage 2 promotion.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AmigaPfsWriter` | `AmigaPfsWriter(int blockSize = 512, uint rootBlock = 80)` | Creates a writer that produces a PFS3 image with the given block size and root-block location. Both arguments default to the floppy convention used by `AmigaPfsReader`. |
+| `DefaultBlockSize` | `const int DefaultBlockSize` | Default block size (512 bytes — matches floppy and the reader default). |
+| `AddDirectory` | `void AddDirectory(string name, DateTime? modTime = null)` | Adds an explicit directory marker. Empty leaf directories show up in the dirblock chain; the reader currently surfaces only top-level entries, so nested paths are flattened into `parent/child` filenames at the root dirblock for round-trip parity with the Stage 1 reader. |
+| `AddFile` | `void AddFile(string name, byte[] data, DateTime? modTime = null)` | Adds a regular file. The leaf name is taken from the last path segment. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream, DateTime? modTime = null)` | Adds a regular file whose bytes are pulled from `openStream` when the image is emitted. Only the length is needed to lay the volume out, so the file never has to fit in memory. |
+| `BuildTo` | `void BuildTo(Stream output, string diskName = "DISK")` | Emits the image to `output`: the boot block, root block and dirblock chain first, then each file's extent copied into place. Only the metadata prefix and one copy buffer are ever resident. |
+| `Build` | `byte[] Build(string diskName = "DISK")` | Builds and returns the complete PFS3 image. The image size is rounded up to a whole number of blocks; the last file's payload may push the image past the conventional 880 KB DD floppy. The reader does not enforce a fixed image size. |
+
 ### Namespace `FileSystem.Apfs`
 
-[`ApfsBlockMover`](#apfsblockmover) · [`ApfsEntry`](#apfsentry) · [`ApfsFormatDescriptor`](#apfsformatdescriptor) · [`ApfsReader`](#apfsreader) · [`ApfsStructuralValidator`](#apfsstructuralvalidator) · [`ApfsStructuralValidator.Report`](#apfsstructuralvalidatorreport) · [`ApfsWriter`](#apfswriter)
+[`ApfsBlockMover`](#apfsblockmover) · [`ApfsEntry`](#apfsentry) · [`ApfsFilesystemDriverAdapter`](#apfsfilesystemdriveradapter) · [`ApfsFormatDescriptor`](#apfsformatdescriptor) · [`ApfsReader`](#apfsreader) · [`ApfsStructuralValidator`](#apfsstructuralvalidator) · [`ApfsStructuralValidator.Report`](#apfsstructuralvalidatorreport) · [`ApfsWriter`](#apfswriter)
 
 #### `ApfsBlockMover`
 
@@ -2082,11 +2346,27 @@ Implements `IFilesystemBlockMover`.
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
+#### `ApfsFilesystemDriverAdapter`
+
+Native APFS read-only sidecar for the fully decoded single-extent profile. It uses APFS inode/object IDs directly and serves regular-file reads from the physical FILE_EXTENT mapping without passing through archive extraction. The sidecar intentionally requires the repository writer's verified container-OMAP physical hint. ApfsReader can also heuristically discover OMAP objects on broader real-world images, but that is not enough evidence to call encrypted, multi-extent, fusion or otherwise advanced profiles mount-grade. Those remain available through the conservative archive projection until the corresponding APFS transaction/object-map semantics are proven.
+
+Implements `IBlockDeviceFilesystemDriverProvider`, `IFilesystemDriverAdapter`, `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ApfsFilesystemDriverAdapter` | `ApfsFilesystemDriverAdapter()` |  |
+| `FormatId` | `string FormatId { get; }` |  |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
 #### `ApfsFormatDescriptor`
 
 References: `https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf` — Apple File System Reference, the official on-disk format specification`https://github.com/libyal/libfsapfs` — libfsapfs, maintained open-source APFS reader with format documentation`https://en.wikipedia.org/wiki/Apple_File_System` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2216,7 +2496,7 @@ Walks an Apple DOS 3.3 image (143,360 bytes, 35 tracks × 16 sectors, 256-byte s
 
 References: "Beneath Apple DOS" (Don Worth & Pieter Lechner, Quality Software, 1981) — the canonical DOS 3.3 on-disk reference (VTOC, catalog, track/sector lists)`https://github.com/fadden/CiderPress2` — CiderPress II, maintained implementation covering DOS 3.3 disk images`https://en.wikipedia.org/wiki/Apple_DOS` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2294,6 +2574,142 @@ Builds a fresh Apple DOS 3.3 `.dsk` / `.do` disk image (143 360 bytes) from scra
 | `BuildFrom` | `static byte[] BuildFrom(IEnumerable<ValueTuple<string, byte[]>> files)` | Escape hatch for callers that prefer to operate on an already-prepared List/Stream. |
 | `Build` | `byte[] Build()` | Builds the complete 143 360-byte image. |
 
+### Namespace `FileSystem.ApplePascal`
+
+[`ApplePascalBlockMover`](#applepascalblockmover) · [`ApplePascalEntry`](#applepascalentry) · [`ApplePascalExtentMap`](#applepascalextentmap) · [`ApplePascalFormatDescriptor`](#applepascalformatdescriptor) · [`ApplePascalInPlaceModifier`](#applepascalinplacemodifier) · [`ApplePascalOptimizer`](#applepascaloptimizer) · [`ApplePascalOptimizer.ApplePascalGeometry`](#applepascaloptimizerapplepascalgeometry) · [`ApplePascalReader`](#applepascalreader) · [`ApplePascalWriter`](#applepascalwriter)
+
+#### `ApplePascalBlockMover`
+
+Moves a file's blocks inside an Apple Pascal volume and repoints its directory entry.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ApplePascalBlockMover` | `ApplePascalBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A block. A directory entry names a block, not a byte. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the boot blocks and the directory. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the entry it is given and nothing else, so an owner in several runs — which this format cannot produce — would be several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads how many entries the directory holds. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SortDirectory` | `void SortDirectory(Stream image)` | Puts the directory back in block order. The p-System finds free space by walking the entries and measuring the gaps between them, so an out-of-order directory reads as a volume with no room and overlapping files. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `ApplePascalEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ApplePascalEntry` | `ApplePascalEntry()` |  |
+| `BytesInLastBlock` | `int BytesInLastBlock { get; init; }` |  |
+| `EndBlock` | `int EndBlock { get; init; }` |  |
+| `FileKind` | `int FileKind { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+| `StartBlock` | `int StartBlock { get; init; }` |  |
+
+#### `ApplePascalExtentMap`
+
+Walks an Apple Pascal volume and emits the on-disk byte layout: boot blocks (0..1) as metadata-reserved, volume directory (blocks 2..5) as metadata-reserved, each file's contiguous extent as a Used block. Any remaining bytes are implicitly Free.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `ApplePascalFormatDescriptor`
+
+Descriptor for Apple UCSD Pascal disk volumes (Apple II, Apple III, Lisa Pascal — late 1970s / early 1980s). Volume directory header is at fixed disk block 2 (file offset 0x400); files are stored as contiguous block extents with at most 77 directory entries. Flat-only by spec. Apple Pascal does not support subdirectories — its 26-byte directory entry has no parent-pointer or nested-volume indirection. Writer / reader treat all inputs as living at the volume root; a leaf-name-only round trip is the maximum possible. This is honest and documented in the writer's xmldoc.Spec. Apple Pascal Operating System Reference Manual (1980). References: Apple Pascal Operating System Reference Manual (Apple Computer, 1980) — the original vendor spec for the UCSD-Pascal volume layout`https://github.com/fadden/CiderPress2` — CiderPress II, maintained implementation covering Apple Pascal volumes`https://en.wikipedia.org/wiki/UCSD_Pascal` — Wikipedia overview of the UCSD p-System family
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ApplePascalFormatDescriptor` | `ApplePascalFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Apple Pascal image. Routed through `AddFile`: the volume directory at blocks 2-5 is mutated in place, the new file's contiguous extent is allocated from the gap between existing entries' extents, and the new 26-byte entry lands at the tail of the live region. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing Apple Pascal image. Routed through `RemoveFile`: the dirent is located in the volume directory, the data extent is zero-wiped, the trailing dirents are shifted up to keep the live region packed, and the volume header's file count is decremented. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `ApplePascalInPlaceModifier`
+
+In-place modifier for Apple UCSD Pascal disk volumes. Performs `Add`, `Replace`, and `Remove` against an existing image without rebuilding the entire volume. The companion `ApplePascalWriter` still serves the WORM "build a fresh image from a file list" path; this class handles the "mutate an existing image" path that `IArchiveModifiable` exposes. Spec source. Apple Pascal Operating System Reference Manual (1979/1980). 512-byte blocks, volume directory at blocks 2-5 (file offset 0x400), 26-byte fixed entries packed back-to-back after the 26-byte volume header, hard cap of 77 file entries (78 × 26 = 2028 bytes fits inside the 4-block 2048-byte directory region).Layout reminders (little-endian throughout):Blocks 0-1: boot blocks (1024 bytes total) — untouched by the modifier.Blocks 2-5: volume directory (2048 bytes). First 26 bytes = volume header; next 77 × 26 = 2002 bytes = file entries.Volume header: `firstBlock=0` at +0, `nextBlock` at +2 (= first file's start block, conventionally 6), entry type = 0 at +4, name length at +6, name at +7..+13, total blocks at +14, file count at +16, first to access (cached) at +18, last-mod date at +20, reserved at +24.File entry: start block at +0, end block (exclusive) at +2, file kind at +4, name length at +6, name at +7..+21, bytes-in-last-block at +22, date at +24.File data: blocks 6.. — every file occupies a single contiguous extent `[startBlock, endBlock)`.Scope match with WORM: the modifier respects the same 77-entry cap and the 8-block-tile rounding for the underlying volume size. The flat directory is the only directory — Apple Pascal has no subdirectories by spec.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, int kind = 0)` | Adds a single file to the existing image. If a file with the same name already exists, it is removed first (its extent zero-wiped and its directory entry shifted out) so the new entry replaces it cleanly. The new file's contiguous extent is allocated by scanning every live directory entry to derive the occupied-block map; the first free run of the required size at or after block 6 is chosen. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file from the existing image. Zero-wipes the file's contiguous extent, shifts the trailing directory entries up to keep the live region packed (Apple Pascal walks entries 0..fileCount and stops — holes would orphan everything after), and decrements the file count. |
+| `ReplaceFileIfFits` | `static bool ReplaceFileIfFits(Stream image, string name, byte[] data)` | Replaces the data of an existing file in place when the new payload fits inside the file's currently allocated extent. Returns false when the file is missing or the new payload exceeds the existing extent — the caller can fall back to `RemoveFile` + `AddFile` in that case. The directory entry's `bytesInLastBlock` field is updated so the reader reports the new logical size correctly. |
+
+#### `ApplePascalOptimizer`
+
+Picks the smallest Apple Pascal volume size (in 512-byte blocks, rounded to a multiple of 8 per Pascal convention) that fits a given fileset. Block size is always 512 (spec-mandated for Apple Pascal volumes); only the volume total varies.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Find` | `static ApplePascalGeometry Find(IReadOnlyList<long> fileSizes)` |  |
+
+#### `ApplePascalOptimizer.ApplePascalGeometry`
+
+Implements `IEquatable<ApplePascalGeometry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ApplePascalGeometry` | `ApplePascalGeometry(int BlockSize, int VolumeBlocks)` |  |
+| `BlockSize` | `int BlockSize { get; init; }` |  |
+| `VolumeBlocks` | `int VolumeBlocks { get; init; }` |  |
+
+#### `ApplePascalReader`
+
+Reads Apple UCSD Pascal disk volumes (Apple II / Apple III / Lisa Pascal, late 1970s–early 1980s). The Apple Pascal filesystem is extent-based — every file is a single contiguous block range, the directory holds at most 77 entries, and the entire volume directory fits in 2 KB (blocks 2..5). Volume directory header (26 bytes, starts at block 2 = offset 0x400 on a 512-byte-block image; little-endian throughout): 0x00 u16 first block of the directory (=0) 0x02 u16 block after directory (=6) 0x04 u16 entry type (0 = volume header) 0x06 byte volume-name length (1..7) 0x07 char[7] volume name (uppercased ASCII) 0x0E u16 total blocks on volume 0x10 u16 number of files (1..77) 0x12 u16 first block to access (cached) 0x14 u32 last modification date (Pascal packed format) 0x18 byte[4] reserved File entry layout (26 bytes each, packed back-to-back after the header): 0x00 u16 start block 0x02 u16 end block (exclusive — file occupies [start..end)) 0x04 u16 file kind (0=untyped, 1=xdsk, 2=code, 3=text, 4=info, 5=data, 6=graf, 7=foto) 0x06 byte filename length (1..15) 0x07 char[15] filename (uppercased ASCII) 0x16 u16 bytes used in last block (1..512) 0x18 u32 last modification date (Pascal packed)
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ApplePascalReader` | `ApplePascalReader(Stream stream)` |  |
+| `BlockSize` | `const int BlockSize` |  |
+| `DirectoryBlock` | `const int DirectoryBlock` |  |
+| `DirectoryOffset` | `const int DirectoryOffset` |  |
+| `EntrySize` | `const int EntrySize` |  |
+| `MaxEntries` | `const int MaxEntries` |  |
+| `Entries` | `IReadOnlyList<ApplePascalEntry> Entries { get; }` |  |
+| `FileCount` | `int FileCount { get; }` |  |
+| `TotalBlocks` | `int TotalBlocks { get; }` |  |
+| `ValidVolume` | `bool ValidVolume { get; }` |  |
+| `VolumeName` | `string VolumeName { get; }` |  |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(ApplePascalEntry entry)` |  |
+
+#### `ApplePascalWriter`
+
+Writes Apple UCSD Pascal disk volumes (Apple II / Apple III / Lisa Pascal era, late 1970s–early 1980s). UCSD Pascal is an extent-based filesystem: every file occupies a contiguous block range. The volume directory at disk block 2 (file offset 0x400) holds the 26-byte volume header followed by up to 77 file entries. Flat by spec. Apple Pascal volumes are flat — there are no subdirectories. Files written with '/' or '\' in the input name have those chars stripped to a single 15-char short name. The writer enforces the 77-entry maximum and rejects names that don't fit.Always 512-byte blocks (spec-mandated); the only sizing knob is the total block count. Typical sizes: 280 blocks (140 KB single-sided 5.25" floppy), 560 (280 KB double-sided), or larger for ProFile / Lisa hard disks. Pascal convention: volume size in blocks is a multiple of 8 (one allocation tile = 8 blocks = 4 KB).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ApplePascalWriter` | `ApplePascalWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data, int kind = 0)` | Adds a file to the volume. `kind` is the Pascal file-kind code (0=untyped, 2=code, 3=text, 4=info, 5=data, 6=graf, 7=foto). |
+| `Build` | `byte[] Build(int volumeBlocks = 280, string volumeName = "PASCAL")` | Builds the image. `volumeBlocks` is the total block count (typical: 280 for 140 KB floppy, 560 for 280 KB DS floppy, 1024+ for HD). Must be ≥ 8 and rounded up to a multiple of 8 (Pascal allocates in 8-block tiles). `volumeName` may be 1..7 ASCII chars. |
+
 ### Namespace `FileSystem.Atari8`
 
 [`Atari8BlockMover`](#atari8blockmover) · [`Atari8Entry`](#atari8entry) · [`Atari8ExtentMap`](#atari8extentmap) · [`Atari8FormatDescriptor`](#atari8formatdescriptor) · [`Atari8Modifier`](#atari8modifier) · [`Atari8Reader`](#atari8reader) · [`Atari8Writer`](#atari8writer)
@@ -2336,7 +2752,7 @@ Walks an Atari 8-bit ATR image (AtariDOS 2.x) and yields the actual on-disk byte
 
 References: `https://www.atarimax.com/jindroush.atari.org/afmtatr.html` — ATR file format description (Jindroush archive); the header layout defined by Nick Kennedy's SIO2PCAtari DOS 2.0S/2.5 Reference Manual (Atari, Inc.) — VTOC + directory sector layout on the SS/SD 720-sector disk`https://en.wikipedia.org/wiki/Atari_DOS` — Wikipedia overview of the Atari 8-bit DOS family
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2458,7 +2874,7 @@ Walks a BBC Micro Acorn DFS image (.ssd / .dsd, 256-byte sectors, 10 sectors/tra
 
 References: `https://beebwiki.mdfs.net/Acorn_DFS_disc_format` — BeebWiki's Acorn DFS disc format page, the de-facto on-disk reference (catalog sectors, boot option)Acorn "Disc Filing System User Guide" (Acorn Computers) — original vendor documentation`https://en.wikipedia.org/wiki/Disc_Filing_System` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2565,7 +2981,7 @@ Implements `IFilesystemBlockMover`.
 
 Full workbench descriptor for the single-device bcachefs profile implemented here: native b-trees, true in-place CRUD, allocation/accounting maintenance, in-place defragmentation, purge and unused-space wiping.
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2669,11 +3085,68 @@ Writes a bcachefs volume: a superblock, the b-trees that describe the files, and
 | `SetUserUuid` | `void SetUserUuid(Guid uuid)` | Overrides the user-facing UUID. |
 | `WriteTo` | `void WriteTo(Stream output)` | Writes the volume. |
 
-### Namespace `FileSystem.Bfs`
+### Namespace `FileSystem.BeeGfs`
 
-[`BfsBlockMover`](#bfsblockmover) · [`BfsFormatDescriptor`](#bfsformatdescriptor)
+[`BeeGfsEntry`](#beegfsentry) · [`BeeGfsFormatDescriptor`](#beegfsformatdescriptor) · [`BeeGfsReader`](#beegfsreader)
 
-#### `BfsBlockMover`
+#### `BeeGfsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `BeeGfsEntry` | `BeeGfsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `BeeGfsFormatDescriptor`
+
+Stage 0 detection-only descriptor for BeeGFS chunk-file / dump tags. Surfaces only a synthetic `metadata.ini` and the raw image bytes; no real file-walk is attempted because a BeeGFS volume has no standalone on-disk image. References: `https://www.beegfs.io` — official BeeGFS site and documentation portal`https://github.com/ThinkParQ/beegfs` — BeeGFS source (ThinkParQ)`https://en.wikipedia.org/wiki/BeeGFS` — Wikipedia overview
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `BeeGfsFormatDescriptor` | `BeeGfsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `BeeGfsReader`
+
+Stage 0 detection-only reader for BeeGFS chunk-file / dump tags. BeeGFS (Fraunhofer Parallel Cluster FS, originally FhGFS) is a distributed parallel cluster filesystem. There is no standalone on-disk image format for a BeeGFS volume: the namespace lives across one or more metadata targets (each a directory tree on a regular Linux FS like ext4/xfs, with per-inode metadata stored as files + extended attributes), and the file payload lives across many storage targets (chunk files in a 2-level hash directory layout on the storage targets' regular Linux FS). Reconstructing a single logical file requires the live metadata-server stripe pattern + storage-target map; a single byte-stream cannot represent it. This descriptor therefore only verifies the ASCII tag `"BeeGFS"` (6 bytes, 0x42 0x65 0x65 0x47 0x46 0x53) or the short 4-byte tag `"BeeG"` (0x42 0x65 0x65 0x47 = 0x42656547 BE) at offset 0 of a chunk-file or dump produced by a BeeGFS utility, and surfaces a synthetic `metadata.ini` documenting the tag + a raw `beegfs-chunk.bin` blob containing the file bytes verbatim. Promotion to R/O is not possible from a single stream — see `Description` on the descriptor.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `BeeGfsReader` | `BeeGfsReader(Stream stream)` |  |
+| `LongTag` | `static readonly byte[] LongTag` | BeeGFS long tag: ASCII "BeeGFS" (6 bytes). |
+| `ShortTag` | `static readonly byte[] ShortTag` | BeeGFS short tag: ASCII "BeeG" (4 bytes, 0x42656547 BE). |
+| `Entries` | `IReadOnlyList<BeeGfsEntry> Entries { get; }` |  |
+| `Tag` | `string Tag { get; }` |  |
+| `TrailingWord` | `uint TrailingWord { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(BeeGfsEntry entry)` |  |
+
+### Namespace `FileSystem.Bfs`
+
+[`BfsBlockMover`](#bfsblockmover) · [`BfsFormatDescriptor`](#bfsformatdescriptor)
+
+#### `BfsBlockMover`
 
 Moves a file's block runs inside a BFS volume, repoints the run in its inode, and moves the allocation with it.
 
@@ -2694,7 +3167,7 @@ Implements `IFilesystemBlockMover`.
 
 R/W descriptor for BeOS / Haiku BFS filesystem images. Can list, extract, create (WORM), modify (via rebuild), and defragment BFS images. The writer produces a minimal single-AG image with a single B+ tree leaf for the root directory and direct block_run extents for file data. References: "Practical File System Design with the Be File System" (Dominic Giampaolo, Morgan Kaufmann, 1999) — the canonical BFS on-disk reference by its author`https://github.com/haiku/haiku/tree/master/src/add-ons/kernel/file_systems/bfs` — Haiku's maintained BFS implementation`https://en.wikipedia.org/wiki/Be_File_System` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2726,7 +3199,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 ### Namespace `FileSystem.Btrfs`
 
-[`BtrfsBlockMover`](#btrfsblockmover) · [`BtrfsEntry`](#btrfsentry) · [`BtrfsExtentMap`](#btrfsextentmap) · [`BtrfsFormatDescriptor`](#btrfsformatdescriptor) · [`BtrfsInPlaceAdder`](#btrfsinplaceadder) · [`BtrfsModifier`](#btrfsmodifier) · [`BtrfsReader`](#btrfsreader) · [`BtrfsWriter`](#btrfswriter)
+[`BtrfsBlockMover`](#btrfsblockmover) · [`BtrfsEntry`](#btrfsentry) · [`BtrfsExtentMap`](#btrfsextentmap) · [`BtrfsFilesystemDriverAdapter`](#btrfsfilesystemdriveradapter) · [`BtrfsFormatDescriptor`](#btrfsformatdescriptor) · [`BtrfsInPlaceAdder`](#btrfsinplaceadder) · [`BtrfsModifier`](#btrfsmodifier) · [`BtrfsReader`](#btrfsreader) · [`BtrfsWriter`](#btrfswriter)
 
 #### `BtrfsBlockMover`
 
@@ -2764,11 +3237,27 @@ Walks a Btrfs image (single-device, non-RAID) and yields its actual on-disk byte
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Single-pass walker. Parses the superblock at 0x10000, the `sys_chunk_array` for the boot chunk map, the chunk tree to extend it, the root tree to find the FS tree, and finally the FS tree leaves to emit per-file EXTENT_DATA runs. Reads flow through a `SectorCache` — the image is never loaded whole. |
 
+#### `BtrfsFilesystemDriverAdapter`
+
+Native read-only Btrfs driver for single-device, single-stripe volumes whose namespace and EXTENT_DATA records are completely understood. Native inode IDs are retained across aliases; a global logical extent map provides true positional reads, including holes and preallocated unwritten ranges, without depending on the archive reader's leaf-local extraction order.
+
+Implements `IBlockDeviceFilesystemDriverProvider`, `IFilesystemDriverAdapter`, `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `BtrfsFilesystemDriverAdapter` | `BtrfsFilesystemDriverAdapter()` |  |
+| `FormatId` | `string FormatId { get; }` |  |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
 #### `BtrfsFormatDescriptor`
 
 References: `https://btrfs.readthedocs.io/en/latest/dev/On-disk-format.html` — official btrfs on-disk format documentation (superblock, chunk/root/fs trees)`https://github.com/torvalds/linux/tree/master/fs/btrfs` — mainline kernel implementation`https://en.wikipedia.org/wiki/Btrfs` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2852,11 +3341,40 @@ Writes spec-compliant Btrfs filesystem images. Every image contains a populated
 
 ### Namespace `FileSystem.CbmNibble`
 
-[`CbmNibbleReader`](#cbmnibblereader) · [`CbmNibbleReader.ImageKind`](#cbmnibblereaderimagekind) · [`CbmNibbleReader.NibbleImage`](#cbmnibblereadernibbleimage) · [`CbmNibbleReader.Track`](#cbmnibblereadertrack) · [`CbmNibbleWriter`](#cbmnibblewriter) · [`G64FormatDescriptor`](#g64formatdescriptor) · [`NibFormatDescriptor`](#nibformatdescriptor)
+[`CbmGcrSectorDevice`](#cbmgcrsectordevice) · [`CbmNibbleRawTrackDevices`](#cbmnibblerawtrackdevices) · [`CbmNibbleReader`](#cbmnibblereader) · [`CbmNibbleReader.ImageKind`](#cbmnibblereaderimagekind) · [`CbmNibbleReader.NibbleImage`](#cbmnibblereadernibbleimage) · [`CbmNibbleReader.Track`](#cbmnibblereadertrack) · [`CbmNibbleWriter`](#cbmnibblewriter) · [`G64FormatDescriptor`](#g64formatdescriptor) · [`NibFormatDescriptor`](#nibformatdescriptor)
+
+#### `CbmGcrSectorDevice`
+
+Strict 1541 logical-sector projection over raw GCR tracks. Every standard sector must exist exactly once with valid header/data checksums before the medium is exposed. Writable projection additionally rejects meaningful odd half-track data that a sector rewrite could not preserve.
+
+Implements `IDisposable`, `IRandomAccessBlockDevice`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CbmGcrSectorDevice` | `CbmGcrSectorDevice(IRawTrackDevice tracks, bool writable, int? fixedTrackLength = null, bool ownsTracks = true)` |  |
+| `DataLength` | `const int DataLength` |  |
+| `SectorCount` | `const int SectorCount` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `CanWrite` | `bool CanWrite { get; }` |  |
+| `Geometry` | `BlockDeviceGeometry Geometry { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Flush` | `void Flush()` |  |
+| `ReadBlocks` | `int ReadBlocks(long firstBlock, Span<byte> destination)` |  |
+| `Trim` | `void Trim(long firstBlock, long blockCount)` |  |
+| `WriteBlocks` | `void WriteBlocks(long firstBlock, ReadOnlySpan<byte> source)` |  |
+
+#### `CbmNibbleRawTrackDevices`
+
+Opens the device layer below the pseudo-archive descriptors. A future Commodore sector decoder can project these tracks as an `IRandomAccessBlockDevice`, and a CBM DOS filesystem session can then mount that block device without knowing whether the outer image was G64, NIB, flux, or a physical drive.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenG64` | `static IRawTrackDevice OpenG64(Stream image, bool writable, bool leaveOpen = true)` |  |
+| `OpenNib` | `static IRawTrackDevice OpenNib(Stream image, bool writable, bool leaveOpen = true)` |  |
 
 #### `CbmNibbleReader`
 
-Reader for Commodore 1541/1571 nibble dumps — both the raw .nib format (used by nibtools and ZoomFloppy) and the .g64 GCR track container produced by emulators like VICE. Converting GCR back to a cleanly sectored D64 is outside scope for this sweep; this reader detects the format variant and surfaces each track as a raw byte buffer for downstream tools to consume.
+Reader for Commodore 1541/1571 nibble dumps — both raw .nib fixed-slot images and VICE .g64 track containers. The pseudo-archive surface is one opaque GCR payload per half-track; callers that need filesystem semantics can explicitly decode those tracks to a D64 through `DecodeToD64`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2895,29 +3413,34 @@ Implements `IEquatable<Track>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Track` | `Track(int Index, byte[] Data, uint SpeedZone)` |  |
+| `Track` | `Track(int Index, byte[] Data, uint SpeedZone, long PhysicalOffset = -1, long PhysicalLength = 0)` |  |
 | `Data` | `byte[] Data { get; init; }` |  |
 | `Index` | `int Index { get; init; }` |  |
+| `PhysicalLength` | `long PhysicalLength { get; init; }` | Physical bytes occupied by this track block/slot. |
+| `PhysicalOffset` | `long PhysicalOffset { get; init; }` | Start of the physical slot/block in the container. |
 | `SpeedZone` | `uint SpeedZone { get; init; }` |  |
 
 #### `CbmNibbleWriter`
 
-From-scratch writer for the Commodore nibble container the `CbmNibbleReader` consumes. The Commodore 1541 filesystem is flat — files live in the single directory on track 18 with a BAM — so the writer first builds a standard sectored D64 image (reusing `D64Writer` for the BAM, directory and linked sector chains) and then GCR-encodes every track into the VICE `.g64` wire format, framing each sector with sync marks, a header block and a data block exactly as a real 1541 lays them down on disk.
+Writer for Commodore nibble containers. It supports two distinct layers: ordinary Commodore files are first placed into a D64 and GCR-encoded, while pseudo-archive callers can directly build G64/NIB containers from opaque `track_XX.bin` payloads without touching the filesystem inside them.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `CbmNibbleWriter` | `CbmNibbleWriter()` |  |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the flat directory. Commodore names are PETSCII and at most 16 characters; longer names are truncated. The default file type is PRG. |
-| `Build` | `byte[] Build()` | Builds the G64 GCR nibble image holding all added files. |
-| `DecodeToD64` | `static byte[] DecodeToD64(NibbleImage image)` | Reconstructs a standard 174 848-byte D64 image from the GCR tracks of a nibble image previously parsed by `CbmNibbleReader`. Each track is rescanned for sync marks and its header/data blocks GCR-decoded back into the correct sector slots. |
-| `SetDisk` | `void SetDisk(string name, char id1 = '0', char id2 = '0')` | Sets the on-disk volume name (PETSCII, ≤16 chars) and the 2-byte disk id. |
-| `WriteTo` | `void WriteTo(Stream output)` | Writes the G64 image to `output`. |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `BuildG64FromTracks` | `static byte[] BuildG64FromTracks(IReadOnlyList<Track> tracks, byte version = 0, int? trackCount = null)` | Builds a compact G64 directly from opaque half-track payloads. This is the canonical mutation/re-layout path for the pseudo-archive surface: track bytes are preserved exactly and placed back-to-back with no obsolete fixed-stride padding. Constant speed zones 0..3 are preserved; pointer-based variable-speed maps are intentionally refused until their auxiliary speed blocks are modeled. |
+| `BuildNibFromTracks` | `static byte[] BuildNibFromTracks(IReadOnlyList<Track> tracks)` | Builds a fixed-size NIB directly from opaque track slots. A non-empty replacement must be exactly 8192 bytes so extracting it again yields the same pseudo-entry bytes. Missing/empty tracks are encoded as all-zero slots. |
+| `BuildNib` | `byte[] BuildNib()` | Builds a raw 84×8192-byte NIB image from the ordinary files added above. Whole-track G64 payloads are copied to their corresponding even half-track slots and padded with the conventional 0x55 gap byte; unused half-tracks remain the workbench's all-zero empty-slot representation. |
+| `Build` | `byte[] Build()` | Builds a VICE G64 image from the ordinary files added above. |
+| `DecodeToD64` | `static byte[] DecodeToD64(NibbleImage image)` | Reconstructs a standard 174848-byte D64 image from the GCR tracks of a nibble image. Whole-track entries are rescanned for sync/header/data blocks. |
+| `SetDisk` | `void SetDisk(string name, char id1 = '0', char id2 = '0')` |  |
+| `WriteTo` | `void WriteTo(Stream output)` |  |
 
 #### `G64FormatDescriptor`
 
-Commodore G64 GCR track container (VICE emulator). Detected by the 8-byte "GCR-1541" ASCII magic at offset 0. References: `http://unusedino.de/ec64/technical/formats/g64.html` — Peter Schepers' G64 format specification`https://vice-emu.sourceforge.io` — VICE emulator, the origin and maintained implementation of G64
+VICE G64 raw-GCR track container. Archive-level operations expose tracks; block/filesystem providers expose only strict canonical 1541 sector media.
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemDriverProvider`, `IFormatDescriptor`, `IRandomAccessBlockDeviceProvider`, `IRawTrackDeviceProvider`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2934,15 +3457,29 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds a fresh G64 image from the inputs. The Commodore filesystem is flat, so names are reduced to their filename component and stored in the single track-18 directory by `CbmNibbleWriter`. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateLayout` | `IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenBlockDevice` | `IRandomAccessBlockDevice OpenBlockDevice(Stream image, bool writable, bool leaveOpen = true)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `OpenRawTrackDevice` | `IRawTrackDevice OpenRawTrackDevice(Stream image, bool writable, bool leaveOpen = true)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+| `Purge` | `void Purge(Stream archive)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `Shrink` | `void Shrink(Stream input, Stream output)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
 #### `NibFormatDescriptor`
 
-Commodore NIB raw nibble dump (nibtools / ZoomFloppy). No magic header — detected by file extension only; the typical dump is exactly 84 × 8192 bytes. References: nibtools (Pete Rittwage's C64 Disk Preservation Project) — the tool that defines and produces the de-facto NIB dump layout`http://unusedino.de/ec64/technical/formats/g64.html` — Peter Schepers' GCR track documentation (shared with G64)
+Fixed-slot NIB raw nibble dump. Archive-level operations expose track slots; block/filesystem providers expose strict canonical 1541 sector media.
 
-Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IFilesystemDriverProvider`, `IFormatDescriptor`, `IRandomAccessBlockDeviceProvider`, `IRawTrackDeviceProvider`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2959,8 +3496,198 @@ Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateLayout` | `IEnumerable<DefragBlockInfo> EnumerateLayout(Stream archive)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenBlockDevice` | `IRandomAccessBlockDevice OpenBlockDevice(Stream image, bool writable, bool leaveOpen = true)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `OpenRawTrackDevice` | `IRawTrackDevice OpenRawTrackDevice(Stream image, bool writable, bool leaveOpen = true)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+| `Purge` | `void Purge(Stream archive)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+### Namespace `FileSystem.CephFs`
+
+[`CephFsEntry`](#cephfsentry) · [`CephFsFormatDescriptor`](#cephfsformatdescriptor) · [`CephFsReader`](#cephfsreader)
+
+#### `CephFsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CephFsEntry` | `CephFsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `CephFsFormatDescriptor`
+
+Stage 0 detection-only descriptor for CephFS / RADOS OSD object metadata dumps. Surfaces only a synthetic `metadata.ini` and the raw image bytes; no real file-walk is attempted. Stage-0 confirmation — promotion to R/O is structurally impossible from a single image. CephFS has no standalone on-disk image format. A CephFS volume consists of:Metadata (inodes, dirfrags, MDS journal) stored as RADOS objects inside a dedicated metadata pool, managed by one or more MDS daemons. Resolving a path requires replaying the MDS journal and walking dirfrag objects across the metadata pool.File data striped across many RADOS objects (default 4 MiB stripe-unit, named `{inode}.{stripe-index}`) and placed across OSDs via CRUSH against the cluster's mon-map / osd-map / CRUSH-map — none of which live in any single file.OSDs themselves store those RADOS objects in a BlueStore (RocksDB + raw-block) or legacy FileStore backend; neither exposes CephFS-level paths.Reconstructing a CephFS namespace would require: (a) a full OSD-set snapshot, (b) the live mon/mds cluster state (osd-map, mds-map, CRUSH-map), and (c) a BlueStore reader. Even with all three, the result is OSD-level objects, not CephFS-level paths. Treatment confirmed: stay Stage 0. References: `https://docs.ceph.com/en/latest/cephfs/` — official CephFS documentation (MDS, RADOS layout, striping)`https://github.com/ceph/ceph` — canonical Ceph source`https://en.wikipedia.org/wiki/Ceph_(software)` — Wikipedia overview
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CephFsFormatDescriptor` | `CephFsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `CephFsReader`
+
+Stage 0 detection-only reader for CephFS / RADOS OSD object metadata dumps. Ceph is a distributed object store (RADOS) with the CephFS POSIX namespace layered over it via MDS daemons — files become RADOS objects sharded across many OSDs. Single OSD object metadata dumps begin with the ASCII tag `"CEPH"` (0x43 0x45 0x50 0x48 = 0x43455048 BE). Only the tag is verified. Full RADOS semantics (object name → PG mapping via CRUSH, replica/EC erasure coding, MDS namespace resolution) require a live Ceph cluster's mon/mds state. Stage-0 confirmation (no promotion possible from a single image). A CephFS volume is metadata-in-pool plus data-striped-across-OSDs:Metadata pool: inodes, dirfrags, and the MDS journal live as RADOS objects in a dedicated pool, mutated by MDS daemons. Path resolution requires journal replay + dirfrag walking across many objects.Data objects: each file is striped (default stripe-unit 4 MiB) into RADOS objects named `{inode-hex}.{stripe-index-hex}`, then placed via CRUSH against the cluster's mon-map / osd-map / CRUSH-map.OSD backing store: BlueStore (RocksDB key/value index over a raw block device) or legacy FileStore (object → file on a local POSIX FS). Neither stores CephFS-level paths.Promotion to R/O would require simultaneous access to a full OSD-set snapshot, the live cluster maps (mon/mds/osd/CRUSH), and a BlueStore reader — and even then the surface is OSD-level objects, not CephFS-level paths. Conclusion: stay Stage 0. The honest deliverable is magic-tag detection + metadata.ini + raw bytes.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CephFsReader` | `CephFsReader(Stream stream)` |  |
+| `CephTag` | `static readonly byte[] CephTag` | Ceph OSD metadata tag: ASCII "CEPH" (0x43455048 BE). |
+| `Entries` | `IReadOnlyList<CephFsEntry> Entries { get; }` |  |
+| `MagicWord` | `uint MagicWord { get; }` |  |
+| `TrailingWord` | `uint TrailingWord { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(CephFsEntry entry)` |  |
+
+### Namespace `FileSystem.Coherent`
+
+[`CoherentBlockMover`](#coherentblockmover) · [`CoherentEntry`](#coherententry) · [`CoherentExtentMap`](#coherentextentmap) · [`CoherentFormatDescriptor`](#coherentformatdescriptor) · [`CoherentInPlaceModifier`](#coherentinplacemodifier) · [`CoherentModifier`](#coherentmodifier) · [`CoherentReader`](#coherentreader) · [`CoherentWriter`](#coherentwriter)
+
+#### `CoherentBlockMover`
+
+Moves a file's blocks inside a Coherent volume and rewrites the three bytes that named each of them.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CoherentBlockMover` | `CoherentBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A block, which is what a zone address counts in. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the superblock and the inode table. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the pointer naming the block it is given, so a file spread over the volume is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A block may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the inodes once and notes which three bytes name each block. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `CoherentEntry`
+
+Directory entry from a Coherent FS image.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CoherentEntry` | `CoherentEntry()` |  |
+| `InodeNumber` | `int InodeNumber { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `CoherentExtentMap`
+
+Describes where a Coherent volume keeps its bytes: the superblock, the inode table, each file's data blocks, and the indirect blocks that name them.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `CoherentFormatDescriptor`
+
+Descriptor for Mark Williams Coherent OS file system. Coherent carries no numeric magic — it is recognised by the coh_super_block s_fname/s_fpack volume strings ("noname"/"nopack"), which is exactly how the Linux sysv driver's detect_coherent() identifies it. References: `https://github.com/torvalds/linux/tree/v6.8/fs/sysv` — Linux sysv driver (incl. `detect_coherent()`); pinned at v6.8, the last release before its removalMark Williams Company "COHERENT" manual — original vendor documentation of the filesystem`https://en.wikipedia.org/wiki/Coherent_(operating_system)` — Wikipedia overview
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CoherentFormatDescriptor` | `CoherentFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by leaf name) files inside an existing Coherent image via true in-place V7-style inode + zone mutation. Routes through `CoherentInPlaceModifier` — no rebuild fall-back: if the inode table is exhausted (the WORM writer sizes it tight to the originally-committed files) the operation surfaces `IOException`. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | WORM emission: builds a fresh Coherent filesystem image from the supplied inputs. Directories are flattened (Coherent dirents only support a single-component 14-byte name) and the resulting image self-round-trips via `CoherentReader`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again by moving what is out of place. A block is named once — by a zone slot in the inode, or by an entry in an indirect block — so a move is the copy plus three bytes. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Where the volume keeps its bytes: the superblock and the inode table, each file's blocks under its name, and the indirect blocks that name them. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing Coherent image. Wipes all data zones AND indirect pointer blocks, then clears the inode slot and the dirent — no forensic recovery of the removed content is possible. |
+
+#### `CoherentInPlaceModifier`
+
+True in-place R/W modifier for Mark Williams Coherent OS filesystem images. V7-derived s5fs layout: 512-byte blocks, 64-byte inodes (10 direct + 1/2/3 indirect 3-byte zone pointers), 16-byte directory entries (u16 inode + 14-byte NUL-padded name), superblock at file offset 1024 with magic `0xFD18` at offset 504. In-place semantic. All three public operations mutate the image stream at fixed byte offsets — no full rebuild, no temporary buffer of the whole image: Add — scan the inode table for free slots (mode == 0), scan the data area [`2 + s_isize`, `s_fsize`) for unreferenced zones, write the new inode + indirect blocks + data blocks at those exact offsets, append a 16-byte dirent into the root directory. The underlying stream is extended (and `s_fsize` bumped) only when free zones are exhausted.Replace — locate the entry's inode by leaf name. If the new payload fits inside the inode's existing on-disk zones, rewrite the data zones byte-for-byte at their current block offsets and patch `i_size`. Untouched zones (other files, the inode list, the superblock, the root directory) remain byte-identical. If the new payload no longer fits in the existing zones the operation falls back to Remove + Add.Remove — zero the 16-byte dirent slot in the root directory, zero every zone the inode reaches (direct + single-indirect pointer block + its data blocks + double-indirect pointer block + per-row indirect blocks + their data blocks + triple-indirect chain), zero the 64-byte inode slot. Both the freed zones and the dirent are wiped so no forensic recovery of the removed entry's content or name is possible.Honest scope. Subdirectory mutation is not supported — Add and Remove operate on the root directory only. Replace honours the same root-only convention. Multi-component names are flattened to their leaf before lookup (matching the way `CoherentWriter` emits them and the way the format's 14-byte dirents enforce). The inode table is sized by the WORM writer to the originally-committed files, so adding more files than the table can hold raises `IOException` — callers that want unbounded growth must rebuild the image.The heavy lifting (free-inode scan with SB-overlap exclusion, free-zone reachability scan, tier-aware zone allocation across direct + single-indirect + double-indirect, dirent slot reuse, indirect-pointer block wiping) lives in `CoherentModifier`; this class is the public canonical-signature surface that the descriptor delegates to.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Add` | `static void Add(Stream image, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds the given files to the root directory of `image` using V7-style in-place inode + zone allocation. Each input's leaf name (last path component, truncated to 14 bytes) is used as the on-disk dirent name; an existing entry with the same leaf is replaced. |
+| `Remove` | `static bool Remove(Stream image, string name)` | Removes the named root-level entry from `image`. Wipes every reachable zone (data + indirect pointer blocks) and the inode slot, then clears the 16-byte dirent so the slot is reusable by a subsequent Add. Returns false when the name is not present or refers to a directory; true on success. |
+| `Replace` | `static bool Replace(Stream image, string name, byte[] newData)` | Replaces the contents of the named root-level entry with `newData`. When the new payload fits inside the entry's existing direct/indirect zone footprint the rewrite happens at the original block offsets — all other on-disk bytes (other inodes, other files' data, the superblock, the root directory dirent layout) remain byte-identical. Falls back to Remove + Add when the existing zones can no longer hold the new payload, or when the entry does not yet exist. Returns true when the rewrite happened in place, false on the realloc fall-back path. |
+
+#### `CoherentModifier`
+
+In-place Coherent FS modifier — random-access Add/Remove against a Coherent image emitted by `CoherentWriter` (or anything else with the same V7-flavoured layout: 512-byte blocks, 64-byte inodes, 24-bit zone pointers, magic 0xFD18 at file offset 1528). Free space discovery. Coherent's V7-style on-disk free-list uses a chained free-block list seeded from `s_free[]/s_nfree` in the superblock and a free-inode cache `s_inode[]/s_ninode`. The `CoherentWriter` intentionally leaves both caches at zero (a fresh image has no free chain yet — the data area is exactly sized to the committed files). The modifier therefore allocates by: Inodes: scanning the inode table for slots whose mode is zero.Zones: building the set of zones reachable from the inode table (direct + single/double/triple indirect pointer blocks themselves and their data zones) and treating any zone in [dataStart, fsize) that is not reachable as free. If none free, the image is grown by extending the underlying stream and bumping `s_fsize`. This matches what V7 `fsck` would reconstruct after a crash that trashed the free-list caches: walk every inode, mark referenced zones, rebuild the free list from the gaps.Tier selection on Add. The same tier rules the writer uses are applied: ≤10 data blocks → direct; ≤10+170 → single-indirect; bigger → double-indirect. Triple-indirect is not emitted (the writer never does either; ~14.5 MB per file is the practical ceiling).Wiping on Remove. The freed data zones AND any freed indirect/double-indirect pointer blocks are zeroed before the inode is cleared. The dirent slot is cleared (inode set to zero, name bytes zeroed) so no forensic recovery of the removed entry's name is possible either. Trailing slack inside the file's last block is wiped via the data-block zeroing.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file at root level. Replaces any existing entry with the same (truncated) leaf name. Allocates inode + zones in place; grows the underlying stream if free zones are exhausted. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a file by name from the root directory. Frees all referenced zones (direct + indirect pointer blocks + their data blocks), zeros the inode slot, clears the dirent. Returns false if the entry is not found or refers to a directory. |
+
+#### `CoherentReader`
+
+Reader for Mark Williams Coherent OS file system (1983-1995). Coherent is a commercial UNIX V7/System V clone with a near-identical s5fs-style layout but a distinct 16-bit magic (0xFD18 at superblock+504) and 14-character directory entries like Minix v1's 14-name variant. Block size is 512 by default (sometimes 1024). Inode size is 64 bytes with 13 block pointers (10 direct + 1/2/3 indirect) stored as 3-byte addresses. Root inode = 2. Spec source: Mark Williams Company "The Coherent Operating System Reference Manual" (1992); Coherent kernel header /usr/include/sys/filsys.h.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CoherentReader` | `CoherentReader(Stream stream)` |  |
+| `BlockSize` | `int BlockSize { get; }` |  |
+| `Entries` | `IReadOnlyList<CoherentEntry> Entries { get; }` |  |
+| `Valid` | `bool Valid { get; }` | True once a valid coh_super_block (s_fname/s_fpack volume strings) was found. |
+| `VolumeName` | `string VolumeName { get; }` | Volume name from the superblock s_fname field (e.g. "noname"). |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(CoherentEntry entry)` |  |
+
+#### `CoherentWriter`
+
+Builds minimal Mark Williams Coherent OS filesystem images compatible with `CoherentReader`. WORM emission: produces a fresh image; existing content is overwritten. Layout (BlockSize = 512, matches the reader's hard-coded assumptions): The writer fills in V7-flavoured superblock fields (s_isize, s_fsize, s_nfree/s_free free-block cache, s_ninode/s_inode free-inode cache, s_time, magic 0xFD18) so an external Coherent-aware reader can mount the image (the in-tree reader only checks the magic). Files use direct zone pointers (up to 10 per inode, 5120 bytes with 512-byte blocks). Larger files use one single-indirect zone (extra 512/3 ≈ 170 zones = 87,040 bytes). Larger still falls back to the double-indirect zone slot for up to ~14.5 MB per file. The directory hierarchy is flat: every input is added under the root inode using its leaf filename (Coherent dir entries are 16 bytes total, 14 bytes for the name, so longer names are truncated).
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CoherentWriter` | `CoherentWriter(Stream output, bool leaveOpen = false)` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Registers a file to be written into the image. |
+| `Dispose` | `void Dispose()` |  |
+| `Finish` | `void Finish()` | Builds and writes the Coherent filesystem image. Layout is sized dynamically to the registered files; a 16 KB image holds a handful of small files and is enough for self-round-trip tests. |
 
 ### Namespace `FileSystem.CpcDsk`
 
@@ -3009,7 +3736,7 @@ Describes what occupies each stretch of a CPC DSK image: the container's own hea
 
 References: `https://www.cpcwiki.eu/index.php/Format:DSK_disk_image_file_format` — CPCWiki's DSK / Extended DSK image format specification`https://www.seasip.info/Unix/LibDsk/` — John Elliott's LibDsk, the maintained multi-format floppy-image library incl. CPC DSKAmstrad AMSDOS documentation (SOFT 968 firmware guide era) — the filesystem stored inside the image
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3109,7 +3836,7 @@ Walks a Digital Research CP/M 2.2 reference disk image (8" SSSD geometry — 256
 
 Read+write descriptor for CP/M 2.2 disk images using the 8" SSSD reference geometry (256 256 bytes, 2 reserved tracks, 1024-byte blocks, 64 directory entries). Kaypro/Osborne/Amstrad and other manufacturer-specific geometries are not emitted by the writer; the reader still parses any image that matches this layout. References: "CP/M 2.2 Operating System Manual" (Digital Research, 1979) — the original vendor documentation of the directory/extent model`http://www.moria.de/~michael/cpmtools/` — cpmtools (Michael Haardt), maintained implementation with the diskdefs geometry database`https://en.wikipedia.org/wiki/CP/M` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3240,9 +3967,9 @@ Represents a single inode entry discovered while walking a CramFS image.
 
 #### `CramFsFormatDescriptor`
 
-References: `https://docs.kernel.org/filesystems/cramfs.html` — Linux kernel cramfs documentation`https://github.com/torvalds/linux/tree/master/fs/cramfs` — mainline implementation (its README documents the on-disk layout)`https://en.wikipedia.org/wiki/Cramfs` — Wikipedia overview
+Offline R/W descriptor for Linux CramFS images. The Linux filesystem is intentionally read-only when mounted, but the workbench can create and edit an existing image by verified rebuild and can perform physical layout moves where the compressed-block metadata can be repointed safely. References: `https://docs.kernel.org/filesystems/cramfs.html` — Linux kernel cramfs documentation`https://github.com/torvalds/linux/tree/master/fs/cramfs` — mainline implementation (its README documents the on-disk layout)`https://en.wikipedia.org/wiki/Cramfs` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3269,7 +3996,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 | `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
 | `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | CramFS is a compressed, read-only ROM filesystem: the superblock, inode tables, block-pointer tables and zlib-compressed page blocks are laid out tightly back-to-back (only 4-byte alignment padding, which is already zero) with no free space and no cluster tips. File data is packed at the compressed-block level, so there is no allocation slack to wipe. Note: `EnumerateExtents` reports Used runs at synthetic, uncompressed-size offsets for the defrag preview — those offsets do not map to real on-disk positions, so this method deliberately does not drive the generic wiper from them (doing so would zero live compressed bytes). Nothing is reclaimable; this returns 0. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | CramFS images produced by the canonical writer are tightly packed and have no allocation-unit cluster tips. If a non-canonical image contains gaps, the physical extent map below identifies them; this explicit override remains conservative and leaves them alone because old CramFS tooling may use alignment/padding bytes in ways that are not recoverable from inodes. |
 
 #### `CramFsReader`
 
@@ -3302,51 +4029,53 @@ Implements `IDisposable`.
 | `AddSymlink` | `void AddSymlink(string path, string target)` | Adds a symbolic link. |
 | `Dispose` | `void Dispose()` | Serialises the entire CramFS image to the output stream. |
 
-### Namespace `FileSystem.D64`
+### Namespace `FileSystem.Cromemco`
 
-[`D64BlockMover`](#d64blockmover) · [`D64Entry`](#d64entry) · [`D64ExtentMap`](#d64extentmap) · [`D64FormatDescriptor`](#d64formatdescriptor) · [`D64Modifier`](#d64modifier) · [`D64Reader`](#d64reader) · [`D64Writer`](#d64writer)
+[`CromemcoBlockMover`](#cromemcoblockmover) · [`CromemcoEntry`](#cromemcoentry) · [`CromemcoExtentMap`](#cromemcoextentmap) · [`CromemcoFormatDescriptor`](#cromemcoformatdescriptor) · [`CromemcoModifier`](#cromemcomodifier) · [`CromemcoOptimizer`](#cromemcooptimizer) · [`CromemcoOptimizer.CromemcoGeometry`](#cromemcooptimizercromemcogeometry) · [`CromemcoReader`](#cromemcoreader) · [`CromemcoWriter`](#cromemcowriter)
 
-#### `D64BlockMover`
+#### `CromemcoBlockMover`
 
-In-place D64 block mover. Moves sector-aligned extents within a 1541 disk image and patches the T/S chain links + BAM bitmap so the file remains reachable at its new location.
+Moves a file inside a Cromemco RDOS volume and repoints its directory entry.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `D64BlockMover` | `D64BlockMover()` |  |
+| `CromemcoBlockMover` | `CromemcoBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. |
+| `Init` | `void Init(Stream image)` | Notes where file data starts on this volume. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `D64Entry`
+#### `CromemcoEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `D64Entry` | `D64Entry()` |  |
-| `FileType` | `byte FileType { get; init; }` |  |
-| `IsDirectory` | `bool IsDirectory { get; }` |  |
+| `CromemcoEntry` | `CromemcoEntry()` |  |
+| `BlockCount` | `int BlockCount { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
+| `StartBlock` | `int StartBlock { get; init; }` |  |
 
-#### `D64ExtentMap`
+#### `CromemcoExtentMap`
 
-Walks a Commodore 1541 D64 image (174,848 bytes, 35 tracks, 256-byte sectors, zoned 21/19/18/17 sectors per track) and yields the actual on-disk byte layout — track 18 (BAM + directory) as metadata, every per-file sector chain as a sequence of contiguous-run extents, and the remaining sectors as Free. Used by the defragment window's block-map preview.
+Enumerates the on-disk byte layout of a Cromemco RDOS image: the boot block (sector 0) and directory area (sectors 2..17) are emitted as `MetadataReserved`, each file is one contiguous `Used` run, and any sector not covered is left for the caller to fill as `Free`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Walks the image and yields one extent per file plus the metadata blocks. |
 
-#### `D64FormatDescriptor`
+#### `CromemcoFormatDescriptor`
 
-References: `http://unusedino.de/ec64/technical/formats/d64.html` — Peter Schepers' D64 format specification (BAM, directory, track/sector layout)"Inside Commodore DOS" (Richard Immers & Gerald Neufeld, Datamost, 1984) — the canonical 1541 DOS internals book`https://en.wikipedia.org/wiki/Commodore_1541` — Wikipedia overview of the drive whose disks D64 images
+Descriptor for Cromemco RDOS volumes (Z-80 CP/M-derived system used on Cromemco Z2 / System Three machines, late 1970s). Detection by the 0xC3 (Z-80 JP) prefix at offset 0 plus an embedded "CROMEMCO" ASCII tag inside the first 64 bytes of the boot block. RDOS is a flat-only filesystem (CP/M-style): all entries live in a single 16-sector directory area starting at sector 2 with no support for subdirectories. The `List` output therefore never contains a directory entry.Capabilities: read + write (write-once, no in-place add/remove), defragment via extract-and-rebuild, free-space wiping driven by the extent map, and creation-options schema for density/track-count selection through the Convert Archive dialog. References: Cromemco RDOS Instruction Manual (Cromemco Inc.) — the original vendor documentation`https://bitsavers.org/pdf/cromemco/` — Bitsavers' scanned Cromemco manual archive`https://en.wikipedia.org/wiki/Cromemco` — Wikipedia overview of the machines
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `D64FormatDescriptor` | `D64FormatDescriptor()` |  |
-| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
-| `CanonicalSizes` | `IReadOnlyList<long> CanonicalSizes { get; }` |  |
+| `CromemcoFormatDescriptor` | `CromemcoFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -3357,68 +4086,333 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
-| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for D64 creation. The Commodore 1541 stores a 16-char PETSCII disk name plus a 2-char disk ID in the BAM (track 18 sector 0); both are user-visible from the C64 directory listing. Disk geometry is fixed at the single-sided 1541 size (174 848 bytes). |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs the Convert Archive dialog / CLI exposes for Cromemco creation: floppy density and track count select the disk geometry (sector size is locked at 128 B by the reader). |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing D64 image. Uses `D64Modifier` for true O(touched bytes) random-access I/O — only the BAM (1 sector) + directory chain (≤19 sectors) + the new file's data sectors (⌈len/254⌉ sectors) are read or written. The 174 848-byte image isn't touched outside that. |
-| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Cromemco RDOS image using `CromemcoModifier` for genuine O(touched bytes) in-place I/O — only the directory area and the new file's contiguous data run are touched. |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware D64 defragmentor. Tries the planner-driven in-place path first (using the planner + `D64BlockMover`), falling back to the rebuild path on error or for `CarveHole`. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the directory chain on track 18 and yields the actual on-disk byte layout — track 18 (BAM + directory) as `MetadataReserved`, every per-file sector chain as one or more contiguous-run extents, and the un-attributed sectors as `Free`. Used by the defragment window's block-map preview. |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing D64 image. Uses `D64Modifier` for O(touched bytes) random-access I/O — walks the file chain, marks each sector free in the BAM, secure-wipes data sectors, and clears the directory entry's file-type byte. |
-| `Shrink` | `void Shrink(Stream input, Stream output)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in a D64 image: unallocated sectors and the cluster-tip slack at the tail of each file's last sector. A D64 file is a linked chain of 256-byte sectors — each carries a 2-byte next-track/next-sector link followed by up to 254 data bytes. The final sector's link is `(0, used+1)`, so the bytes after the last used data byte up to the sector boundary are slack. Those slack bytes are zero-filled when `wipeClusterTips` is set, while the 2-byte link headers, live file data, and the track-18 BAM/directory are preserved. Because file content is interleaved with per-sector link bytes and chains may be fragmented, the simple "offset + size" cluster-tip model of the generic wiper does not apply; tip wiping is done here by walking each chain to its final sector. Free-space wiping is delegated to the generic wiper using the extent map. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in place: marks the directory entry deleted (user code 0xE5) and wipes the data run. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros every byte in the image not claimed by the boot block, the directory area, or a live file's contiguous sector run. Cluster-tip wiping (slack between the file's real size and its rounded-up sector allocation) is honoured when `wipeClusterTips` is true, using the directory entry's record count. |
 
-#### `D64Modifier`
+#### `CromemcoModifier`
 
-In-place D64 modifier. Performs add / remove on an existing 1541 disk image with strict O(touched bytes) I/O — only reads the BAM (1 sector), the directory chain (≤19 sectors), and the affected file's data chain (one sector per 254 bytes of file data). Never reads or writes the entire image, so this scales to multi-TB virtual-disk images even though D64 itself is 174 848 bytes. The companion `D64Writer` rebuilds an image from scratch; this class is for the "I have an existing image, mutate it" path that `IArchiveModifiable` exposes.Layout reminders (for the reader of this code, not for the disk): 1541 geometry: 35 tracks; 21 / 19 / 18 / 17 sectors per zone (1-17 / 18-24 / 25-30 / 31-35).Each sector is 256 bytes. Total image: 174 848 bytes.BAM lives at track 18 / sector 0. Directory chain starts at track 18 / sector 1.Each file is a chain of sectors. Each sector starts with 2 bytes (T,S of next sector, or T=0 + S=byte-count+1 for the last sector). Remaining 254 bytes are file data.Each directory sector holds 8 entries of 32 bytes. Bytes 0-1 of the sector store the T,S of the next directory sector (or 0,$FF if last). Entries 1-7 have unused bytes at offsets +0 and +1.
+In-place modifier for Cromemco RDOS volumes. Performs add / remove with strict O(touched bytes) I/O — only the 2 KB directory area (sectors 2..17, where the 32-byte entries live) and the affected file's contiguous data run are read or written. The rest of the image is untouched, so existing files' data bytes stay byte-identical at their original offsets and a same-size update never changes the image length. RDOS is extent-based with no allocation bitmap: each file is a single contiguous run of 128-byte sectors described by (start block, record count) in its directory entry. Free space is whatever no live entry claims. This modifier therefore reconstructs the in-use sector ranges from the directory to find a free contiguous run for new data, and allocates contiguously so the reader's contiguous extraction keeps working.Directory entry (32 bytes, from file offset 0x100): user code @0 (0xE5 = deleted, 0x00 = live/empty), name @1..8, ext @9..11, start block u16 LE @0x0C, records u16 LE @0x0E, bytes-in-last-sector @0x10.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, byte fileType = 130)` | Adds a file to the existing D64 image. Performs in-place modification: allocates new sectors via BAM bit-flips, writes the file chain, writes the directory entry. Bytes touched: 1 BAM sector + ≤ ⌈log₈(entries)⌉ directory sectors + ⌈len/254⌉ file data sectors. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file from the existing D64 image. Walks the file's chain to free its sectors in the BAM, optionally wipes data bytes, and clears the directory entry's file-type byte to 0 ("scratched"). Returns true if the file was found and removed, false otherwise. Bytes touched: 1 BAM sector + 1 directory sector + N file sectors. |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file. Allocates the lowest contiguous free sector run, writes the data there, and fills a free directory slot. Throws on a full directory or no contiguous free run. |
+| `IsCromemco` | `static bool IsCromemco(Stream image)` | True if the stream is a recognised Cromemco RDOS volume. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file: marks its directory entry deleted (user code 0xE5), optionally wipes the data run. Returns true if found. |
 
-#### `D64Reader`
+#### `CromemcoOptimizer`
 
-Implements `IDisposable`.
+Picks the smallest Cromemco RDOS geometry whose data area fits a supplied file set with ≤ 5 % wasted slack. The Cromemco RDOS line shipped a small handful of well-defined disk geometries; the optimiser walks them in ascending capacity order and returns the first that fits.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `D64Reader` | `D64Reader(Stream stream, bool leaveOpen = false)` |  |
-| `Entries` | `IReadOnlyList<D64Entry> Entries { get; }` |  |
-| `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(D64Entry entry)` |  |
+| `Geometries` | `static readonly IReadOnlyList<CromemcoGeometry> Geometries` | Canonical Cromemco RDOS geometries, in ascending capacity order. |
+| `Find` | `static CromemcoGeometry Find(IReadOnlyList<long> fileSizes)` | Returns the smallest geometry whose data area holds `fileSizes` with at most 5 % slack. Sums each file rounded up to the 128-byte sector boundary (since the writer always allocates whole sectors). Falls back to the largest geometry when nothing fits cleanly. |
 
-#### `D64Writer`
+#### `CromemcoOptimizer.CromemcoGeometry`
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `D64Writer` | `D64Writer()` |  |
-| `AddFile` | `void AddFile(string name, byte fileType, byte[] data)` |  |
-| `AddFile` | `void AddFile(string name, byte[] data)` |  |
-| `Build` | `byte[] Build(string diskName = "DISK", string diskId = "00")` | Builds the complete D64 image. |
+One disk preset: density label + track count + sectors/track.
 
-### Namespace `FileSystem.D71`
+Implements `IEquatable<CromemcoGeometry>`.
 
-[`D71BlockMover`](#d71blockmover) · [`D71Entry`](#d71entry) · [`D71ExtentMap`](#d71extentmap) · [`D71FormatDescriptor`](#d71formatdescriptor) · [`D71Modifier`](#d71modifier) · [`D71Reader`](#d71reader) · [`D71Writer`](#d71writer)
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CromemcoGeometry` | `CromemcoGeometry(string Density, int Tracks, int SectorsPerTrack)` | One disk preset: density label + track count + sectors/track. |
+| `DataBytes` | `int DataBytes { get; }` | Bytes available for file data (after boot + directory). |
+| `Density` | `string Density { get; init; }` |  |
+| `SectorSize` | `int SectorSize { get; }` | Sector size is fixed at 128 bytes by the reader. |
+| `SectorsPerTrack` | `int SectorsPerTrack { get; init; }` |  |
+| `TotalBytes` | `int TotalBytes { get; }` | Total image bytes. |
+| `Tracks` | `int Tracks { get; init; }` |  |
 
-#### `D71BlockMover`
+#### `CromemcoReader`
 
-In-place D71 block mover. Moves sector-aligned extents within a 1571 double-sided disk image and patches the T/S chain links + dual BAM bitmaps so the file remains reachable at its new location.
+Reads Cromemco RDOS (Z-80 system disk) volumes. RDOS is a CP/M-like filesystem with 8.3 filenames, 128-byte sectors, and a fixed directory area in the system tracks. The bootblock at block 0 starts with a JP-instruction (0xC3 low high) followed by an embedded "CROMEMCO" ASCII tag that identifies the volume. Bootblock layout (block 0, little-endian; first 32 bytes): 0x00 byte 0xC3 (Z-80 JP instruction) 0x01 u16 entry-point address 0x03 char[8] reserved (zero-padded) 0x0B char[8] "CROMEMCO" ASCII (signature; may also appear at varying offsets up to 0x40 in late RDOS variants — we scan the first 64 bytes) Directory entry layout (32 bytes; back-to-back in the directory area starting at sector 2 = file offset 0x100): 0x00 byte user code (0xE5 = deleted) 0x01 char[8] filename (space-padded ASCII) 0x09 char[3] extension (space-padded ASCII) 0x0C u16 start block (LE) 0x0E u16 length in 128-byte records (LE) 0x10..0x1F reserved
 
-Implements `IFilesystemBlockMover`.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `D71BlockMover` | `D71BlockMover()` |  |
+| `CromemcoReader` | `CromemcoReader(Stream stream)` |  |
+| `DirectoryOffset` | `const int DirectoryOffset` |  |
+| `EntrySize` | `const int EntrySize` |  |
+| `MaxEntries` | `const int MaxEntries` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `Signature` | `static readonly byte[] Signature` |  |
+| `Entries` | `IReadOnlyList<CromemcoEntry> Entries { get; }` |  |
+| `SignatureOffset` | `int SignatureOffset { get; }` |  |
+| `ValidVolume` | `bool ValidVolume { get; }` |  |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(CromemcoEntry entry)` |  |
+
+#### `CromemcoWriter`
+
+Builds a fresh Cromemco RDOS disk image from scratch (Write-Once, Read-Many). The format is CP/M-derived: a boot block at sector 0 (with the 0xC3 JP-instruction prefix and an embedded "CROMEMCO" tag at offset 0x0B), a flat directory area starting at sector 2 with 32-byte entries, and data blocks immediately following.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CromemcoWriter` | `CromemcoWriter()` |  |
+| `TotalSize` | `int TotalSize { get; }` | Total image size = tracks × sectorsPerTrack × SectorSize. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds one flat file. Names are CP/M-style 8.3, ASCII, upper-case. |
+| `Build` | `byte[] Build()` | Builds the complete disk image. |
+| `SetGeometry` | `void SetGeometry(int tracks, int sectorsPerTrack)` | Sets disk geometry. Single density = 35 tracks / 18 spt; double density = 77 tracks / 26 spt. |
+
+### Namespace `FileSystem.Cxfs`
+
+[`CxfsEntry`](#cxfsentry) · [`CxfsFormatDescriptor`](#cxfsformatdescriptor) · [`CxfsReader`](#cxfsreader)
+
+#### `CxfsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CxfsEntry` | `CxfsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `FromXfsLayer` | `bool FromXfsLayer { get; init; }` | True when this entry was produced by the XFS reader walking the underlying XFS layer (R/O delegation). False for the synthetic `metadata.ini`/`cxfs-volume.bin` Stage-0 fallback entries emitted when the XFS reader cannot read the image. |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `CxfsFormatDescriptor`
+
+R/O descriptor for SGI CXFS (Cluster XFS) volume images. Because the on-disk format is XFS-compatible (same `"XFSB"` superblock magic, same `dinode` / dir2 / dir3 layout), the reader delegates content extraction to `XfsReader` and surfaces the underlying file tree. CXFS-specific cluster metadata (sb_features2 flags, cluster UUIDs, distributed-lock bookkeeping) is intentionally ignored — those are the CMS / dmF / RGM layers, not file content. If the XFS reader cannot walk the image the descriptor falls back to a Stage-0 `metadata.ini` + `cxfs-volume.bin` surface so the volume is still identifiable. Extension-only detection (`.cxfs`) avoids first-match collision with the vanilla FileSystem.Xfs descriptor — both share the same magic bytes. References: SGI "CXFS Administration Guide" (SGI techpubs) — the vendor documentation of the cluster layer`https://mirrors.edge.kernel.org/pub/linux/utils/fs/xfs/docs/xfs_filesystem_structure.pdf` — "XFS Algorithms & Data Structures", the on-disk spec CXFS volumes follow`https://en.wikipedia.org/wiki/CXFS` — Wikipedia overview
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CxfsFormatDescriptor` | `CxfsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `CxfsReader`
+
+R/O reader for SGI CXFS (Cluster XFS) volume images via delegation to `XfsReader`. CXFS is SGI's clustered extension of XFS. The on-disk format is XFS-compatible — same `"XFSB"` superblock magic at offset 0, same `xfs_dsb` layout, same `dinode` (IN magic) layout, and same dir2/dir3 directory block formats. CXFS-specific bits live in `sb_features2` (offset 0x82) and in cluster-tracking fields that the lock-managing layer (CMS / dmF) consults at mount time; they do not modify the file/directory on-disk structures.Because of that, a CXFS DAT image whose XFS layer is well-formed is readable by the vanilla XFS reader. This reader first tries the XFS reader; on success it surfaces the underlying XFS entries to the caller (cluster metadata is intentionally ignored — that is the distributed-lock / quorum / RGM layer, not file content). On failure it falls back to the Stage-0 `metadata.ini` + `cxfs-volume.bin` surface so the descriptor still identifies the image.Honest caveat: real CXFS production volumes may use SGI-private fork formats for cluster-quota and DMAPI metadata that the open-source XFS reader does not understand; such inodes will simply be skipped by the XFS reader (it ignores unknown `di_format` values), and any data lurking in CXFS-only metadata regions will not be surfaced. Plain file content stored as XFS extents / inline data IS readable.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `CxfsReader` | `CxfsReader(Stream stream)` |  |
+| `SbFeatures2Offset` | `const int SbFeatures2Offset` | Offset of sb_features2 field in the XFS superblock (xfs_dsb). |
+| `XfsbMagic` | `static readonly byte[] XfsbMagic` | XFS superblock magic: ASCII "XFSB" (0x58465342 BE). |
+| `DelegatedToXfs` | `bool DelegatedToXfs { get; }` | True when the XFS reader successfully walked the image and produced at least one real file/directory entry. False when we fell back to the Stage-0 metadata-only surface. |
+| `Entries` | `IReadOnlyList<CxfsEntry> Entries { get; }` |  |
+| `SbFeatures2` | `uint SbFeatures2 { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `XfsMagic` | `uint XfsMagic { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(CxfsEntry entry)` |  |
+
+### Namespace `FileSystem.D64`
+
+[`D64BlockDevice`](#d64blockdevice) · [`D64BlockMover`](#d64blockmover) · [`D64Entry`](#d64entry) · [`D64ExtentMap`](#d64extentmap) · [`D64FilesystemSession`](#d64filesystemsession) · [`D64FormatDescriptor`](#d64formatdescriptor) · [`D64Modifier`](#d64modifier) · [`D64MountValidator`](#d64mountvalidator) · [`D64MountValidator.ValidationResult`](#d64mountvalidatorvalidationresult) · [`D64Reader`](#d64reader) · [`D64Writer`](#d64writer)
+
+#### `D64BlockDevice`
+
+Sector-addressable view of the data portion of a standard 35-track D64. The optional per-sector error table in 175531-byte images is deliberately outside this device geometry and is therefore preserved by ordinary writes.
+
+Implements `IDisposable`, `IRandomAccessBlockDevice`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `D64BlockDevice` | `D64BlockDevice(Stream stream, bool writable, bool leaveOpen = true)` |  |
+| `DataLength` | `const int DataLength` |  |
+| `LogicalSectorSize` | `const int LogicalSectorSize` |  |
+| `SectorCount` | `const int SectorCount` |  |
+| `CanWrite` | `bool CanWrite { get; }` |  |
+| `Geometry` | `BlockDeviceGeometry Geometry { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Flush` | `void Flush()` |  |
+| `ReadBlocks` | `int ReadBlocks(long firstBlock, Span<byte> destination)` |  |
+| `Trim` | `void Trim(long firstBlock, long blockCount)` |  |
+| `WriteBlocks` | `void WriteBlocks(long firstBlock, ReadOnlySpan<byte> source)` |  |
+
+#### `D64BlockMover`
+
+In-place D64 block mover. Moves sector-aligned extents within a 1541 disk image and patches the T/S chain links + BAM bitmap so the file remains reachable at its new location.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `D64BlockMover` | `D64BlockMover()` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `D64Entry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `D64Entry` | `D64Entry()` |  |
+| `FileType` | `byte FileType { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `D64ExtentMap`
+
+Walks a Commodore 1541 D64 image (174,848 bytes, 35 tracks, 256-byte sectors, zoned 21/19/18/17 sectors per track) and yields the actual on-disk byte layout — track 18 (BAM + directory) as metadata, every per-file sector chain as a sequence of contiguous-run extents, and the remaining sectors as Free. Used by the defragment window's block-map preview.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `D64FilesystemSession`
+
+Root-only CBM DOS 2.6 namespace session over a 1541 sector device. File handles are path-independent: rename keeps the node id stable and unlink detaches a namespace entry without invalidating already-open handles.
+
+Implements `IDisposable`, `IFilesystemSession`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `D64FilesystemSession` | `D64FilesystemSession(IRandomAccessBlockDevice device, FilesystemDriverProfile profile, bool readOnly, bool ownsDevice = true)` |  |
+| `Profile` | `FilesystemDriverProfile Profile { get; }` |  |
+| `RootNodeId` | `FilesystemNodeId RootNodeId { get; }` |  |
+| `BeginTransaction` | `IFilesystemTransaction BeginTransaction()` |  |
+| `CreateDirectory` | `FilesystemNodeId CreateDirectory(FilesystemNodeId parentDirectory, string name)` |  |
+| `CreateFile` | `FilesystemNodeId CreateFile(FilesystemNodeId parentDirectory, string name)` |  |
+| `CreateHardLink` | `void CreateHardLink(FilesystemNodeId existingNode, FilesystemNodeId newParent, string newName)` |  |
+| `CreateSymbolicLink` | `FilesystemNodeId CreateSymbolicLink(FilesystemNodeId parentDirectory, string name, string target)` |  |
+| `DeleteFile` | `void DeleteFile(FilesystemNodeId parentDirectory, string name)` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Enumerate` | `IReadOnlyList<FilesystemDirectoryEntry> Enumerate(FilesystemNodeId directory)` |  |
+| `Flush` | `void Flush()` |  |
+| `Lookup` | `FilesystemNodeId? Lookup(FilesystemNodeId parentDirectory, string name)` |  |
+| `OpenFile` | `IFilesystemFileHandle OpenFile(FilesystemNodeId nodeId, FileAccess access)` |  |
+| `ReadSymbolicLink` | `string ReadSymbolicLink(FilesystemNodeId nodeId)` |  |
+| `RemoveDirectory` | `void RemoveDirectory(FilesystemNodeId parentDirectory, string name)` |  |
+| `Rename` | `void Rename(FilesystemNodeId oldParent, string oldName, FilesystemNodeId newParent, string newName, bool replace)` |  |
+| `SetMetadata` | `void SetMetadata(FilesystemNodeId nodeId, FilesystemMetadataPatch patch)` |  |
+| `Stat` | `FilesystemNodeInfo Stat(FilesystemNodeId nodeId)` |  |
+
+#### `D64FormatDescriptor`
+
+References: `http://unusedino.de/ec64/technical/formats/d64.html` — Peter Schepers' D64 format specification (BAM, directory, track/sector layout)"Inside Commodore DOS" (Richard Immers & Gerald Neufeld, Datamost, 1984) — the canonical 1541 DOS internals book`https://en.wikipedia.org/wiki/Commodore_1541` — Wikipedia overview of the drive whose disks D64 images
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemDriverProvider`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IRandomAccessBlockDeviceProvider`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `D64FormatDescriptor` | `D64FormatDescriptor()` |  |
+| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `CanonicalSizes` | `IReadOnlyList<long> CanonicalSizes { get; }` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OpenBlockDevice` | `IRandomAccessBlockDevice OpenBlockDevice(Stream image, bool writable, bool leaveOpen = true)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `Shrink` | `void Shrink(Stream input, Stream output)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `D64Modifier`
+
+In-place D64 modifier. Performs add / remove on an existing 1541 disk image with strict O(touched bytes) I/O — only reads the BAM (1 sector), the directory chain (≤19 sectors), and the affected file's data chain (one sector per 254 bytes of file data). Never reads or writes the entire image, so this scales to multi-TB virtual-disk images even though D64 itself is 174 848 bytes. The companion `D64Writer` rebuilds an image from scratch; this class is for the "I have an existing image, mutate it" path that `IArchiveModifiable` exposes.Layout reminders (for the reader of this code, not for the disk): 1541 geometry: 35 tracks; 21 / 19 / 18 / 17 sectors per zone (1-17 / 18-24 / 25-30 / 31-35).Each sector is 256 bytes. Total image: 174 848 bytes.BAM lives at track 18 / sector 0. Directory chain starts at track 18 / sector 1.Each file is a chain of sectors. Each sector starts with 2 bytes (T,S of next sector, or T=0 + S=byte-count+1 for the last sector). Remaining 254 bytes are file data.Each directory sector holds 8 entries of 32 bytes. Bytes 0-1 of the sector store the T,S of the next directory sector (or 0,$FF if last). Entries 1-7 have unused bytes at offsets +0 and +1.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, byte fileType = 130)` | Adds a file to the existing D64 image. Performs in-place modification: allocates new sectors via BAM bit-flips, writes the file chain, writes the directory entry. Bytes touched: 1 BAM sector + ≤ ⌈log₈(entries)⌉ directory sectors + ⌈len/254⌉ file data sectors. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file from the existing D64 image. Walks the file's chain to free its sectors in the BAM, optionally wipes data bytes, and clears the directory entry's file-type byte to 0 ("scratched"). Returns true if the file was found and removed, false otherwise. Bytes touched: 1 BAM sector + 1 directory sector + N file sectors. |
+
+#### `D64MountValidator`
+
+Strict mount-time validation for the subset of CBM DOS 2.6 that the namespace driver can mutate losslessly. Read-only parsing may accept more; writable mounting requires exact BAM ownership with no overlapping/orphaned sectors, closed files, and no REL side-sector semantics.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Validate` | `static ValidationResult Validate(ReadOnlySpan<byte> image)` |  |
+
+#### `D64MountValidator.ValidationResult`
+
+Implements `IEquatable<ValidationResult>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ValidationResult` | `ValidationResult(bool CanRead, bool CanWrite, IReadOnlyList<string> Limitations)` |  |
+| `CanRead` | `bool CanRead { get; init; }` |  |
+| `CanWrite` | `bool CanWrite { get; init; }` |  |
+| `Limitations` | `IReadOnlyList<string> Limitations { get; init; }` |  |
+
+#### `D64Reader`
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `D64Reader` | `D64Reader(Stream stream, bool leaveOpen = false)` |  |
+| `Entries` | `IReadOnlyList<D64Entry> Entries { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(D64Entry entry)` |  |
+
+#### `D64Writer`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `D64Writer` | `D64Writer()` |  |
+| `AddFile` | `void AddFile(string name, byte fileType, byte[] data)` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `Build` | `byte[] Build(string diskName = "DISK", string diskId = "00")` | Builds the complete D64 image. |
+
+### Namespace `FileSystem.D71`
+
+[`D71BlockMover`](#d71blockmover) · [`D71Entry`](#d71entry) · [`D71ExtentMap`](#d71extentmap) · [`D71FormatDescriptor`](#d71formatdescriptor) · [`D71Modifier`](#d71modifier) · [`D71Reader`](#d71reader) · [`D71Writer`](#d71writer)
+
+#### `D71BlockMover`
+
+In-place D71 block mover. Moves sector-aligned extents within a 1571 double-sided disk image and patches the T/S chain links + dual BAM bitmaps so the file remains reachable at its new location.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `D71BlockMover` | `D71BlockMover()` |  |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
@@ -3444,7 +4438,7 @@ Walks a Commodore 1571 D71 image (349,696 bytes, 70 tracks, 256-byte sectors, do
 
 References: `http://unusedino.de/ec64/technical/formats/d71.html` — Peter Schepers' D71 format specification (double-sided BAM, directory layout)Commodore 1571 Disk Drive User's Guide (Commodore, 1985) — original vendor documentation`https://en.wikipedia.org/wiki/Commodore_1571` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3548,7 +4542,7 @@ Walks a Commodore 1581 D81 image (819,200 bytes, 80 tracks × 40 sectors, 256-by
 
 References: `http://unusedino.de/ec64/technical/formats/d81.html` — Peter Schepers' D81 format specification (header block, BAM, directory)Commodore 1581 Disk Drive User's Guide (Commodore, 1987) — original vendor documentation`https://en.wikipedia.org/wiki/Commodore_1581` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3665,7 +4659,7 @@ Walks a DoubleSpace/DriveSpace CVF image and yields the actual on-disk byte layo
 
 References: `https://github.com/sandsmark/dmsdos` — dmsdos, the GPL Linux CVF driver whose source + `doc/dmsdos.doc` are the de-facto MDBPB/MDFAT/BitFAT on-disk specificationMicrosoft MS-DOS 6 documentation (DoubleSpace chapter) — original vendor description of the compressed volume file`https://en.wikipedia.org/wiki/DriveSpace` — Wikipedia article covering DoubleSpace and its successors
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3741,7 +4735,7 @@ Builds a spec-compliant Microsoft DoubleSpace / DriveSpace Compressed Volume Fil
 
 References: `https://github.com/sandsmark/dmsdos` — dmsdos, the GPL Linux CVF driver whose source + `doc/dmsdos.doc` are the de-facto on-disk specification (incl. the JM-0-0 cluster codec)Microsoft MS-DOS 6.22 documentation (DriveSpace chapter) — original vendor description`https://en.wikipedia.org/wiki/DriveSpace` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3859,7 +4853,7 @@ Reports where a DragonFS volume's bytes are: each file as its directory record f
 
 Read-only descriptor for DragonFS — the embedded read-only filesystem used by Libdragon (open Nintendo 64 SDK) to bundle assets inside an N64 ROM image. DragonFS is big-endian throughout, uses 32-byte directory records starting at file offset 256 (Libdragon DFS_ROOT_OFFSET), and lacks an unambiguous fixed magic in original images — detection is by .dfs extension plus an optional "DragonFS" ASCII tag at offset 0 for self-produced research images. References: `https://github.com/DragonMinded/libdragon` — Libdragon source, the origin of DragonFS (`dragonfs.c` / `mkdfs` define the format)`https://libdragon.dev` — official Libdragon documentation site
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -3928,107 +4922,407 @@ Builds a fresh, read-only DragonFS image (Libdragon / Nintendo 64) from a flat s
 | `Build` | `byte[] Build()` | Builds the complete DragonFS image as a byte array. |
 | `WriteTo` | `void WriteTo(Stream output)` | Emits the complete DragonFS image into `output`. |
 
-### Namespace `FileSystem.Erofs`
-
-[`ErofsBlockMover`](#erofsblockmover) · [`ErofsFormatDescriptor`](#erofsformatdescriptor) · [`ErofsReader`](#erofsreader) · [`ErofsReader.Entry`](#erofsreaderentry) · [`ErofsWriter`](#erofswriter)
+### Namespace `FileSystem.DriveSpace3`
 
-#### `ErofsBlockMover`
+[`DriveSpace3Entry`](#drivespace3entry) · [`DriveSpace3FormatDescriptor`](#drivespace3formatdescriptor) · [`DriveSpace3Reader`](#drivespace3reader) · [`DriveSpace3Writer`](#drivespace3writer) · [`GenuineDvr3Reader`](#genuinedvr3reader) · [`GenuineDvr3Writer`](#genuinedvr3writer) · [`MsLzhBlockCodec`](#mslzhblockcodec)
 
-Moves a file's blocks inside an EROFS image and repoints its inode.
+#### `DriveSpace3Entry`
 
-Implements `IFilesystemBlockMover`.
+One file entry inside a DriveSpace 3 CVF. Names with characters or lengths outside the 8.3 FAT subset are surfaced via the inner volume's VFAT LFN chain.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ErofsBlockMover` | `ErofsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock's blkszbits gives it. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the superblock and the inode area. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the geometry and where the metadata area starts. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `DriveSpace3Entry` | `DriveSpace3Entry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-#### `ErofsFormatDescriptor`
+#### `DriveSpace3FormatDescriptor`
 
-Descriptor for EROFS images. Reading covers the uncompressed + inline inode layouts; creation produces a minimal uncompressed (FLAT_PLAIN) image via `ErofsWriter`. Full-fidelity, compressed images remain the job of `mkfs.erofs`; our writer targets the round-trippable WORM subset (compact inodes, plain data, nested directories). References: `https://docs.kernel.org/filesystems/erofs.html` — Linux kernel EROFS documentation (on-disk overview)`https://github.com/torvalds/linux/tree/master/fs/erofs` — mainline implementation (`erofs_fs.h` defines the on-disk structures)`https://en.wikipedia.org/wiki/EROFS` — Wikipedia overview
+Descriptor for Microsoft DriveSpace 3 CVF (Windows 95 Plus! Pack, 1995). Distinguished from DoubleSpace/DriveSpace 2 by the `MS_DSP3` MDBPB signature at file offset 3 and the `DVR3` CvfSignature at offset 36. The compression algorithm changed from DS LZ77 (DOS 6.x) to MS LZH (LZ77 + canonical Huffman). Read/write/modify/defrag are delegated to the shared DoubleSpace infrastructure (`DoubleSpaceWriter` routed through `DriveSpace3`, `DoubleSpaceReader` with MS LZH dispatch, `DoubleSpaceExtentMap`, `DoubleSpaceBlockMover`) — the on-disk MDBPB+MDFAT+BitFAT layout is byte-compatible across the whole CVF family; only the OEM bytes and inner-cluster codec differ. This brings DriveSpace 3 to full parity with DoubleSpace/DriveSpace 6.22 for defrag, wipe-empty, modify, extent map and block mover. Shares the `.cvf` extension with DoubleSpace; FormatDetector disambiguates by magic. References: `https://github.com/sandsmark/dmsdos` — dmsdos, the GPL Linux CVF driver whose source + `doc/dmsdos.doc` are the de-facto DriveSpace 3 on-disk specification (5-byte MDFAT, MS LZH codecs)Microsoft Plus! for Windows 95 documentation (DriveSpace 3) — original vendor description`https://en.wikipedia.org/wiki/DriveSpace` — Wikipedia overview of the CVF family
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ErofsFormatDescriptor` | `ErofsFormatDescriptor()` |  |
+| `DriveSpace3FormatDescriptor` | `DriveSpace3FormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
 | `DefaultExtension` | `string DefaultExtension { get; }` |  |
-| `Description` | `string Description { get; }` |  |
+| `Description` | `string Description { get; }` | Microsoft DriveSpace 3 CVF (Win95 Plus! Pack 1995). Shares the DoubleSpace MDBPB+MDFAT+BitFAT infrastructure (extent map, block mover, planner-driven defrag, wipe-empty, add/remove via rebuild). Per-cluster payload is MS LZH (LZ77 + canonical Huffman) instead of DS LZ77 and publishes the full four-tier effort set — `ms-lzh` (greedy), `ms-lzh+` (lazy matching), `ms-lzh++` (iterated multi-pass). The shrink-or-store fallback inside the codec emits a stored CVF run when the compressed payload would not shrink the cluster, so incompressible regions are not penalised at any effort level. |
 | `DisplayName` | `string DisplayName { get; }` |  |
 | `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The one tunable the uncompressed writer honours: the volume label written into the superblock `volume_name` field (16 bytes) via `VolumeName` and read back as `ErofsReader.VolumeName`. The 4 KB block size is fixed by the FLAT_PLAIN/FLAT_INLINE layout, so it is not exposed. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | True in-place add via the shared MDBPB-aware `DoubleSpaceInPlaceModifier`. BitFAT bits flip, MDFAT cluster-allocation entries are written in place, inner FAT chains extended, and VFAT dirents are inserted into the root directory without rewriting any unrelated bytes. MS LZH codec is auto-selected from the OEM signature (`MS_DSP3`). |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the image out again. Moving what is out of place beats writing the image out anew: EROFS lays a file's blocks out contiguously from the raw block address in its inode, so a move is the copy plus four bytes. The default this replaces offered start-packing only, through a rebuild. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | The superblock, inode and directory region is structure; each file's full blocks are the run its inode addresses. A short file whose tail is stored inline with its inode has no run of its own, and needs none. |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware CVF defragmentor. Supports planner-driven in-place defrag (using `DefragPlanner` + `DoubleSpaceBlockMover`) with rebuild fallback on error — same shape as `Defragment`. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single EROFS file as a bounded read-only stream. The reader produces the decoded file bytes; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | True in-place remove via the shared MDBPB-aware `DoubleSpaceInPlaceModifier`. Walks the inner FAT chain, zeros each physical run, clears BitFAT bits, zeros MDFAT entries, zeros inner FAT chain, and scratches the dirent (+ LFN chain) with 0xE5. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the CVF image: every physical sector in the DATA region not claimed by a live file/directory run, plus any gaps outside the metadata regions, is overwritten with zeros. Cluster-tip wiping is not applicable to a CVF — the DATA region holds compressed/stored runs whose physical byte length is unrelated to the logical (uncompressed) file size. |
 
-#### `ErofsReader`
+#### `DriveSpace3Reader`
 
-Reads EROFS (Enhanced Read-Only File System) images as used by Android system/APEX partitions and produced by `mkfs.erofs`. Handles the uncompressed inode layouts (FLAT_PLAIN and FLAT_INLINE) for both compact (32-byte) and extended (64-byte) inodes; LZ4 / LZMA compressed clusters and fragments are deferred — an inode with a compressed datalayout surfaces as a zero-length / unsupported payload rather than failing the whole image. The superblock lives at file offset 1024; on-disk magic is the little-endian word `0xE0F5E1E2` (bytes `E2 E1 F5 E0`). Block size is `2^sb.blkszbits` (almost always 4096). A node id (`nid`) addresses a 32-byte granule measured from `meta_blkaddr * blockSize`, i.e. the inode lives at `meta_blkaddr * blockSize + nid * 32`.
+Reads DriveSpace 3 (Microsoft Plus! Pack for Windows 95, 1995) CVF images. The on-disk layout is the DOS 6.x DBLSPACE/DRVSPACE MDBPB + MDFAT + BitFAT + DATA chain — only the OEM name (`MS_DSP3`), CvfSignature (`DVR3`), and per-cluster compression algorithm (MS LZH instead of DS LZ77) change. Compressed runs (MDFAT flag = 2) are decoded through `MsLzhBlockCodec`; stored runs (flag = 1) are returned verbatim. The inner FAT16 chain is walked starting from each entry's first cluster, with the MDFAT indirection resolving every cluster to its physical run in the DATA region. Clusters without a valid MDFAT mapping fall back to the inner-data mirror, mirroring the strategy used by `FileSystem.DoubleSpace.DoubleSpaceReader`.
+
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ErofsReader` | `ErofsReader(Stream stream)` | Reads an image straight from a seekable stream. |
-| `ErofsReader` | `ErofsReader(byte[] data)` |  |
-| `Magic` | `const uint Magic` | On-disk superblock magic, little-endian word `0xE0F5E1E2`. |
-| `Entries` | `IReadOnlyList<Entry> Entries { get; }` |  |
-| `VolumeName` | `string VolumeName { get; }` | Volume label from the superblock `volume_name` field (16 bytes, NUL-trimmed ASCII). |
-| `ExtractFile` | `byte[] ExtractFile(Entry entry)` | Extracts the raw bytes of a given entry. Throws `NotSupportedException` if the entry points at a compressed-layout inode (until LZ4 support lands). |
-| `TryGetDataExtent` | `bool TryGetDataExtent(Entry entry, out long offset, out long length)` | Where an entry's full data blocks live: EROFS lays them out contiguously from the inode's raw block address. A residual tail stored inline with the inode is part of the metadata region, not of this run. Returns false when the inode has no out-of-line data at all. |
+| `DriveSpace3Reader` | `DriveSpace3Reader(Stream stream)` | Parses the MDBPB and inner FAT directory from `stream`. Throws `InvalidDataException` if the image is too small or the OEM signature does not match `MS_DSP3`. |
+| `SignatureOffset` | `const int SignatureOffset` | Offset of the OEM magic signature in the MDBPB. |
+| `Signatures` | `static readonly byte[] Signatures` | Magic signature bytes (`MS_DSP3`) at offset 3. |
+| `CvfSignature` | `string CvfSignature { get; }` | Raw CvfSignature at offset 36 (`DVR3`). |
+| `Entries` | `IReadOnlyList<DriveSpace3Entry> Entries { get; }` |  |
+| `Signature` | `string Signature { get; }` | OEM name in the MDBPB. Always `MS_DSP3` for valid images. |
+| `ValidHeader` | `bool ValidHeader { get; }` | True once `Parse` has accepted the header. |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` | Surfaces high-level metadata about the parsed CVF for tooling/UI inspection. Returns an INI-style key=value block. |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(DriveSpace3Entry entry)` | Extracts the bytes of `entry` by walking the inner FAT chain from its first cluster, resolving each cluster through the MDFAT indirection and decoding the corresponding stored or MS LZH run. |
 
-#### `ErofsReader.Entry`
+#### `DriveSpace3Writer`
 
-Implements `IEquatable<Entry>`.
+Builds a spec-compliant Microsoft DriveSpace 3 CVF (Windows 95 Plus! Pack, 1995). On-disk layout mirrors the DOS 6.x DBLSPACE/DRVSPACE convention: MDBPB → inner FAT16 → inner root dir → MDFAT → BitFAT → DATA region. The only differences from `FileSystem.DoubleSpace.DoubleSpaceWriter` are: OEM name `MS_DSP3` at offset 3 (vs `MSDSP6.0`/`MSDSP6.2`).CvfSignature `DVR3` at offset 36.Per-cluster compression payload uses the MS LZH codec (see `MsLzhBlockCodec`) instead of DS LZ77.A compression-level byte at offset 75 (DriveSpace 3 BPB extension). This writer emits either stored runs (MDFAT flag = 1) or MS LZH-compressed runs (flag = 2), depending on whether the codec shrinks the cluster. The reader follows the inner FAT chain through the MDFAT indirection back to each compressed run, exactly as DoubleSpace does. Stage 2 self round-trip is the gating requirement; bit-stream parity with Microsoft's reference driver (DRVSPACE.BIN) is a future external-tool conformance gate.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Entry` | `Entry(string Path, long Size, bool IsDirectory, ulong Nid, bool IsSymlink = false, string LinkTarget = null)` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `IsSymlink` | `bool IsSymlink { get; init; }` |  |
-| `LinkTarget` | `string LinkTarget { get; init; }` |  |
-| `Nid` | `ulong Nid { get; init; }` |  |
-| `Path` | `string Path { get; init; }` |  |
-| `Size` | `long Size { get; init; }` |  |
+| `DriveSpace3Writer` | `DriveSpace3Writer()` |  |
+| `CompressionLevel` | `byte CompressionLevel { get; set; }` | DriveSpace 3 compression level byte stored at MDBPB offset 75. Values 0..2 correspond to the "Standard", "HiPack", and "UltraPack" levels in the Microsoft tooling. The actual encoder here ignores the field — it is preserved for round-trip compatibility with third-party readers. |
+| `EnableCompression` | `bool EnableCompression { get; set; }` | When `true` (default), per-cluster MS LZH compression is attempted and the compressed payload is emitted whenever it shrinks the cluster. Clusters that do not compress are stored raw (MDFAT flags = 1). |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file. Long filenames produce a VFAT LFN chain automatically. |
+| `AddFile` | `void AddFile(string name, byte[] data, bool compress)` | Adds a file with an explicit per-file compression opt-in. Use `compress`=`false` to force stored runs for that file even when `EnableCompression` is on. |
+| `Build` | `byte[] Build()` | Builds the complete CVF image. |
 
-#### `ErofsWriter`
+#### `GenuineDvr3Reader`
 
-Builds a valid, uncompressed EROFS image from a set of files and their (possibly nested) paths, matching the on-disk encoding produced by `mkfs.erofs` for plain data and accepted by `fsck.erofs`: extended (64-byte) inodes (`erofs_inode_extended`) so size, uid/gid, mtime and a full 32-bit link count are all expressible;the FLAT_INLINE datalayout: any residual tail (object size modulo block size) is stored inline immediately after the inode header, and only whole blocks spill into the data region. Objects smaller than one block carry their entire body inline with the block-address field set to the `0xFFFFFFFF` "no full block" sentinel — exactly as `mkfs.erofs` encodes small files;node ids (`nid`) as 32-byte granules measured from `meta_blkaddr * blockSize`; inodes are packed with their inline tails and the next inode is re-aligned to a 32-byte boundary. Directories are emitted as EROFS directory chunks: a contiguous array of 12-byte `erofs_dirent` headers followed by the packed entry names, with the conventional "." and ".." entries first. Directory bodies follow the same FLAT_INLINE rule.
+Reads a genuine Microsoft DriveSpace 3 CVF — the real `MSDBL6.0`-family layout that `GenuineDvr3Writer` emits and that the independent `dmsdos` driver mounts. This is the read half of the genuine DriveSpace 3 round trip; together with the driver-proven writer it gives a full read/write path over the genuine on-disk format. Layout (little-endian): MDBPB at sector 0 carries the BPB plus the CVF geometry substructure — inner-volume base sector @0x27, MDFAT start @0x24, cluster index base @0x2D, root-dir offset @0x29; sectors/cluster @0x0D = 64; version_flag @0x33 = 3. The inner FAT16 volume lives at the base sector; file data clusters are located through the 5-byte DRVSP3 MDFAT (102 entries per sector + 2 pad bytes). Stored clusters (MDFAT flags = used + uncompressed) are read verbatim; the inner directory's file size truncates the tail.
+
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ErofsWriter` | `ErofsWriter()` |  |
-| `VolumeName` | `string VolumeName { get; set; }` | Volume label written into the superblock `volume_name` field (16 bytes, NUL-padded; longer strings are truncated). Empty leaves the field zero. |
-| `AddFile` | `void AddFile(string path, byte[] content)` |  |
-| `AddStreamingFile` | `void AddStreamingFile(string path, long size, Func<Stream> openStream)` | Registers a file at the given archive path. Path segments are split on '/' and the intermediate directories are created on demand so nested layouts round-trip with their full directory chain intact. |
-| `Build` | `byte[] Build()` | Produces the complete EROFS image as a byte array. |
-| `SetUuid` | `void SetUuid(ReadOnlySpan<byte> uuid)` | Fixes the image's identity, for a build that has to come out the same twice. |
-| `WriteTo` | `void WriteTo(Stream output)` | Writes the complete EROFS image to `output`. |
-
-### Namespace `FileSystem.ExFat`
+| `GenuineDvr3Reader` | `GenuineDvr3Reader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<DriveSpace3Entry> Entries { get; }` |  |
+| `VolumeLabel` | `string VolumeLabel { get; }` | The inner volume label (0x08 root entry), or "" when none was written. |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(DriveSpace3Entry entry)` |  |
 
-[`ExFatBlockMover`](#exfatblockmover) · [`ExFatEntry`](#exfatentry) · [`ExFatExtentMap`](#exfatextentmap) · [`ExFatFormatDescriptor`](#exfatformatdescriptor) · [`ExFatModifier`](#exfatmodifier) · [`ExFatReader`](#exfatreader) · [`ExFatRemover`](#exfatremover) · [`ExFatWriter`](#exfatwriter)
+#### `GenuineDvr3Writer`
 
-#### `ExFatBlockMover`
+Builds a genuine Microsoft DriveSpace 3 Compressed Volume File (CVF) — the on-disk shape a real DriveSpace 3 driver mounts, verified by the independent GPL `dmsdos` driver (the Linux DoubleSpace/DriveSpace/Stacker driver), which detects this writer's output as "drivespace 3 CVF", mounts it, lists the inner directory and reads every file back byte-exact. Unlike `DriveSpace3Writer` (the older self-round-trip `MS_DSP3`/offset-36 layout — which the real driver rejects), DriveSpace 3 is in fact a member of the DOS `MSDBL6.0` CVF family: the same container as `GenuineCvfWriter`, but distinguished by `64` sectors per cluster (32 KB clusters, boot byte 13), a `version_flag = 3` (boot byte 51) and a 5-byte-per-entry MDFAT (102 entries per sector plus 2 pad bytes) instead of the 4-byte v2 entry. Clusters are stored uncompressed (MDFAT flags = 3: used + uncompressed) and identity-mapped through the MDFAT; the inner volume is FAT16. Inner-directory file sizes truncate each cluster's tail, so we store every cluster as a full 64-sector run with the unused tail zero-padded.
 
-In-place exFAT block mover. Moves cluster-aligned extents and patches FAT chain entries, allocation bitmap, directory entry sets, and VBR PercentInUse. Streaming: never loads the whole image. All metadata updates are targeted writes with `Flush` barriers between the four steps so a crash mid-operation leaves the image in an fsck-recoverable state. The FAT (potentially 50 GB on a 50 TB volume) is navigated via `SectorCache` with a bounded ~256 MB memory cap.
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `GenuineDvr3Writer` | `GenuineDvr3Writer()` |  |
+| `CompressionLevel` | `int CompressionLevel { get; init; }` | Codec effort (search depth). Higher = better ratio, slower. |
+| `CompressionMethod` | `CvfLzMethod CompressionMethod { get; init; }` | Per-cluster compression codec. `Stored` (default) emits uncompressed clusters; DS/JM emit genuine DriveSpace 3 compressed clusters. |
+| `ForceCompress` | `bool ForceCompress { get; init; }` | When true, keep a compressed cluster even if it does not shrink (as long as it still fits the cluster's sector budget); otherwise the smaller of compressed/stored is chosen per cluster (auto-best). |
+| `Timestamp` | `DateTime Timestamp { get; init; }` | Creation/modification timestamp stamped on every file entry. Default (before 1980) leaves the FAT date/time fields zero. |
+| `VolumeLabel` | `string VolumeLabel { get; init; }` | Optional inner-volume label (≤11 chars). Empty = no label entry. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the root directory of the compressed volume. |
+| `Build` | `byte[] Build()` | Builds the CVF image bytes. |
+
+#### `MsLzhBlockCodec`
+
+CVF block-framing wrapper for the MS LZH codec used by Microsoft DriveSpace 3 (Win95 Plus! Pack, 1995). Each compressed run consists of a 2-byte little-endian header followed by either an MS LZH-encoded payload (header bit 15 set) or a raw stored payload (bit 15 clear). The low 12 bits encode `payload_size - 1`. This matches the DOS 6.x DBLSPACE/DRVSPACE block-framing convention; only the inner codec changed when DriveSpace 3 shipped.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Compress` | `static byte[] Compress(ReadOnlySpan<byte> input)` | Compresses a single cluster with the MS LZH codec and wraps it in the CVF 2-byte header. Falls back to a stored run if the compressed payload would not shrink the data or would exceed the 12-bit size cap. |
+| `Decompress` | `static byte[] Decompress(ReadOnlySpan<byte> block)` | Decompresses a single CVF run (2-byte header + payload). The header's bit 15 dispatches between MS LZH (set) and raw stored (clear). |
+
+### Namespace `FileSystem.Ecryptfs`
+
+[`EcryptfsEntry`](#ecryptfsentry) · [`EcryptfsFormatDescriptor`](#ecryptfsformatdescriptor) · [`EcryptfsReader`](#ecryptfsreader)
+
+#### `EcryptfsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EcryptfsEntry` | `EcryptfsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `EcryptfsFormatDescriptor`
+
+Read-only descriptor for eCryptfs per-file encryption containers. eCryptfs (Linux) stacks on top of any underlying FS and stores each encrypted file with a 4-byte big-endian marker `0x3C81B7F5` at offset 0 followed by an 8-byte decrypted size, 4-byte flags, and 4-byte extent-size hint. Decryption requires the user's passphrase + EFEK packets — out of scope. The encrypted payload is surfaced as a single opaque entry along with the parsed header metadata. References: `https://docs.kernel.org/filesystems/ecryptfs.html` — Linux kernel eCryptfs documentation`https://github.com/torvalds/linux/tree/master/fs/ecryptfs` — mainline implementation (`ecryptfs_kernel.h` defines the file-header marker + packet layout)`https://en.wikipedia.org/wiki/ECryptfs` — Wikipedia overview
+
+Implements `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EcryptfsFormatDescriptor` | `EcryptfsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `EcryptfsReader`
+
+Reads eCryptfs per-file encryption headers. eCryptfs is a stacking file-level encryption filesystem (Linux) — every encrypted file is stored on the lower filesystem as a regular file whose first page is a metadata header followed by AES-CBC ciphertext extents. The header starts with a 4-byte big-endian marker (`0x3C81B7F5`) so the individual on-disk container is well-defined and detectable. Decryption requires the user's mount passphrase + EFEK (Encrypted File Encryption Key) tag-3 / tag-11 packets and is OUT OF SCOPE; this reader surfaces the parsed header + the encrypted payload as a single opaque entry. File header layout (big-endian, file offset 0): 0x00 u32 marker == 0x3C81B7F5 0x04 u64 decrypted-size (plaintext length, host-endian on Linux) 0x0C u32 flags 0x10 u32 extent-size (typically 4096) 0x14 ... EFEK packets, tag-3 / tag-11 OpenPGP-style ~0x800 start of AES-CBC ciphertext extents
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EcryptfsReader` | `EcryptfsReader(Stream stream)` |  |
+| `EcryptfsMarker` | `const uint EcryptfsMarker` |  |
+| `DecryptedSize` | `ulong DecryptedSize { get; }` |  |
+| `Entries` | `IReadOnlyList<EcryptfsEntry> Entries { get; }` |  |
+| `ExtentSize` | `uint ExtentSize { get; }` |  |
+| `Flags` | `uint Flags { get; }` |  |
+| `Marker` | `uint Marker { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(EcryptfsEntry entry)` |  |
+
+### Namespace `FileSystem.Efs`
+
+[`EfsBlockMover`](#efsblockmover) · [`EfsEntry`](#efsentry) · [`EfsFormatDescriptor`](#efsformatdescriptor) · [`EfsInPlaceModifier`](#efsinplacemodifier) · [`EfsOptimalParameters`](#efsoptimalparameters) · [`EfsOptimizer`](#efsoptimizer) · [`EfsReader`](#efsreader) · [`EfsWriter`](#efswriter)
+
+#### `EfsBlockMover`
+
+Moves a file's blocks inside an EFS volume and repoints its inode.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EfsBlockMover` | `EfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. |
+| `Init` | `void Init(Stream image)` | Notes where file data may start, past the inode table. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `EfsEntry`
+
+One entry surfaced by `EfsReader`.
+
+Implements `IEquatable<EfsEntry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EfsEntry` | `EfsEntry(string Name, int Inode, bool IsDirectory, int Size, int FirstBlock)` | One entry surfaced by `EfsReader`. |
+| `FirstBlock` | `int FirstBlock { get; init; }` |  |
+| `Inode` | `int Inode { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `int Size { get; init; }` |  |
+
+#### `EfsFormatDescriptor`
+
+SGI EFS (Extent File System) format descriptor — the pre-XFS native filesystem used on IRIX before 5.3 (1994). Surfaces a real WORM writer that emits a spec-keyed superblock + single-cylinder-group inode table + per-file single-extent layout, plus defrag/purge/conversion/optimizer wiring. References: `https://github.com/torvalds/linux/tree/master/fs/efs` — Linux kernel EFS driver (read-only), the maintained on-disk referenceIRIX `sys/fs/efs_fs.h` — the original SGI header defining the superblock and extent layout`https://en.wikipedia.org/wiki/Extent_File_System` — Wikipedia overview
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EfsFormatDescriptor` | `EfsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing EFS image via `EfsInPlaceModifier` — TRUE in-place O(touched bytes) I/O (claim a free dinode slot, append a contiguous extent at EOF, write the root dirent). Falls back to a whole-image rebuild only for nested paths, inode-table exhaustion, or extents past the single-extent ceiling. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in-place via `EfsInPlaceModifier`. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `EfsInPlaceModifier`
+
+TRUE in-place R/W modifier for the SGI EFS images this project emits. Performs O(touched bytes) random-access mutation: only the affected dinode slot, the root directory block, the file's single data extent and (when the image must grow) the superblock `s_size`/`s_cgfsize` fields are read or written. Every other byte stays byte-identical. The on-disk model is the one written by `EfsWriter`: sector 0 superblock (big-endian), sector 1.. the 128-byte dinode array (inode `N` at index `N - 2`, 4 per 512-byte basic block), then per-file single contiguous extents. There is no free-block bitmap, so fresh extents are appended at the current end of the image — a genuine in-place grow, not a re-pack; removed extents become unreferenced holes a later defrag reclaims.Honest scope: files are stored as one contiguous extent in the root directory. Nested-path adds, inode-table exhaustion, or extents longer than 255 basic blocks (the single-extent length ceiling) throw `IOException` so the descriptor can fall back to a full rebuild.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file to the root directory in-place. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named regular file from the root directory in-place. |
+| `Replace` | `static bool Replace(Stream image, string name, byte[] data)` | Replaces a named regular file's data in-place. |
+
+#### `EfsOptimalParameters`
+
+Optimal EFS layout parameters as picked by `Find`.
+
+Implements `IEquatable<EfsOptimalParameters>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EfsOptimalParameters` | `EfsOptimalParameters(int BlockSize, int CylinderGroupSize, long EstimatedImageBytes)` | Optimal EFS layout parameters as picked by `Find`. |
+| `BlockSize` | `int BlockSize { get; init; }` | Selected basic-block size in bytes (always 512 for EFS). |
+| `CylinderGroupSize` | `int CylinderGroupSize { get; init; }` | Cylinder-group size in basic blocks. |
+| `EstimatedImageBytes` | `long EstimatedImageBytes { get; init; }` | Predicted on-disk image size for the input set. |
+
+#### `EfsOptimizer`
+
+Fileset-driven optimizer for EFS. The basic-block size is fixed at 512 (per the IRIX spec), so the optimizer's only real lever is the cylinder-group size — bigger groups for big filesets (fewer groups, less metadata), smaller groups for tiny filesets (better locality). The image-size sanity guard (≤ 2× sum of files) and the slack guard (≤ 5%) are applied at the blocks-per-file level since EFS' allocation unit is one basic block.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Find` | `static EfsOptimalParameters Find(IReadOnlyList<long> fileSizes)` | Picks an EFS layout for `fileSizes`. Empty input collapses to the minimum image (one inode block + one directory block). |
+
+#### `EfsReader`
+
+Read-side companion to `EfsWriter`. Walks the on-disk superblock + inode table + directory blocks emitted by our writer and yields the file tree as a flat list of `EfsEntry`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EfsReader` | `EfsReader(Stream stream)` | Parses `stream` as an EFS image and surfaces every file / directory at its full path. Throws on malformed superblock. |
+| `Entries` | `IReadOnlyList<EfsEntry> Entries { get; }` | All non-root entries (files + intermediate directories). |
+| `Extract` | `byte[] Extract(EfsEntry entry)` | Extracts a file entry's bytes by reading its first extent. |
+
+#### `EfsWriter`
+
+Minimal but spec-aware writer for an SGI EFS (Extent File System) image. Produces a real `EfsMagic`-tagged superblock at sector 0, a packed inode table directly after the superblock, and the directory + file data in subsequent 512-byte basic blocks. Scope. The on-disk layout follows the IRIX `efs_fs.h` header field positions (size in BB, first_cg, ncg, cg_isize, magic) so existing `TryParse` recognises the image. File bodies are stored as a single direct extent each; directory entries use the variable-length efs_dent format (inode + nlen + name) but always land in a single directory block, so per-directory total payload is capped at one BB minus the dir header. This matches the "flat-+-nested" subset reiserfsprogs would generate for a freshly-created small disk.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `EfsWriter` | `EfsWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file by path. Path separators ('/' or '\\') create intermediate directories. The first call to `Build` serialises everything. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the layout is settled from it before a byte is read, so a payload past what a byte[] can hold is placed like any other. |
+| `Build` | `byte[] Build()` | Builds the image and returns it as a byte array. |
+| `SetVolumeLabel` | `void SetVolumeLabel(string label)` | Sets the 6-char volume label (truncated/padded). |
+| `WriteTo` | `void WriteTo(Stream output)` | Writes the volume into `output`: the blocks the filesystem populates, then each file's bytes at the offset it was allocated. Only a non-seekable target has to materialise the volume, so a seekable one is bounded by the disk rather than by what a byte[] can address. |
+
+### Namespace `FileSystem.Erofs`
+
+[`ErofsBlockMover`](#erofsblockmover) · [`ErofsFormatDescriptor`](#erofsformatdescriptor) · [`ErofsReader`](#erofsreader) · [`ErofsReader.Entry`](#erofsreaderentry) · [`ErofsWriter`](#erofswriter)
+
+#### `ErofsBlockMover`
+
+Moves a file's blocks inside an EROFS image and repoints its inode.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ErofsBlockMover` | `ErofsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock's blkszbits gives it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the superblock and the inode area. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and where the metadata area starts. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `ErofsFormatDescriptor`
+
+Offline R/W descriptor for EROFS images. Reading covers the uncompressed FLAT_PLAIN/FLAT_INLINE inode layouts; creation emits the same conservative, round-trippable subset through `ErofsWriter`. Linux mounts EROFS read-only by design, but an existing supported-profile image can be edited by verified rebuild. Compressed inode layouts remain readable as metadata only until their data decoder/writer is implemented and are therefore rejected by mutation rather than silently rewritten as placeholders. References: `https://docs.kernel.org/filesystems/erofs.html` — Linux kernel EROFS documentation`https://github.com/torvalds/linux/tree/master/fs/erofs` — mainline implementation (`erofs_fs.h`)`https://en.wikipedia.org/wiki/EROFS` — overview
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ErofsFormatDescriptor` | `ErofsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Existing-image edit for the writer-compatible EROFS subset. Every live file is decoded before the rebuild starts; compressed layouts and symlinks are rejected up front so no placeholder or type-changing rewrite can occur. The volume label survives the rebuild. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Conservative physical extent map. Flat file runs are marked Used. Every byte not proven to belong to one of those runs is structural/reserved — EROFS has no allocator bitmap from which this implementation can prove an arbitrary hole is reusable. This deliberately sacrifices generic free-gap wiping for correctness on externally-produced images. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | No byte is considered wipeable without allocator evidence. The extent map intentionally reserves every unproven region, so this currently returns 0 for valid EROFS images rather than risking metadata damage. |
+
+#### `ErofsReader`
+
+Reads EROFS (Enhanced Read-Only File System) images as used by Android system/APEX partitions and produced by `mkfs.erofs`. Handles the uncompressed inode layouts (FLAT_PLAIN and FLAT_INLINE) for both compact (32-byte) and extended (64-byte) inodes; LZ4 / LZMA compressed clusters and fragments are deferred — an inode with a compressed datalayout surfaces as a zero-length / unsupported payload rather than failing the whole image. The superblock lives at file offset 1024; on-disk magic is the little-endian word `0xE0F5E1E2` (bytes `E2 E1 F5 E0`). Block size is `2^sb.blkszbits` (almost always 4096). A node id (`nid`) addresses a 32-byte granule measured from `meta_blkaddr * blockSize`, i.e. the inode lives at `meta_blkaddr * blockSize + nid * 32`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ErofsReader` | `ErofsReader(Stream stream)` | Reads an image straight from a seekable stream. |
+| `ErofsReader` | `ErofsReader(byte[] data)` |  |
+| `Magic` | `const uint Magic` | On-disk superblock magic, little-endian word `0xE0F5E1E2`. |
+| `Entries` | `IReadOnlyList<Entry> Entries { get; }` |  |
+| `VolumeName` | `string VolumeName { get; }` | Volume label from the superblock `volume_name` field (16 bytes, NUL-trimmed ASCII). |
+| `ExtractFile` | `byte[] ExtractFile(Entry entry)` | Extracts the raw bytes of a given entry. Throws `NotSupportedException` if the entry points at a compressed-layout inode (until LZ4 support lands). |
+| `TryGetDataExtent` | `bool TryGetDataExtent(Entry entry, out long offset, out long length)` | Where an entry's full data blocks live: EROFS lays them out contiguously from the inode's raw block address. A residual tail stored inline with the inode is part of the metadata region, not of this run. Returns false when the inode has no out-of-line data at all. |
+
+#### `ErofsReader.Entry`
+
+Implements `IEquatable<Entry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Entry` | `Entry(string Path, long Size, bool IsDirectory, ulong Nid, bool IsSymlink = false, string LinkTarget = null)` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `IsSymlink` | `bool IsSymlink { get; init; }` |  |
+| `LinkTarget` | `string LinkTarget { get; init; }` |  |
+| `Nid` | `ulong Nid { get; init; }` |  |
+| `Path` | `string Path { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `ErofsWriter`
+
+Builds a valid, uncompressed EROFS image from a set of files and their (possibly nested) paths, matching the on-disk encoding produced by `mkfs.erofs` for plain data and accepted by `fsck.erofs`: extended (64-byte) inodes (`erofs_inode_extended`) so size, uid/gid, mtime and a full 32-bit link count are all expressible;the FLAT_INLINE datalayout: any residual tail (object size modulo block size) is stored inline immediately after the inode header, and only whole blocks spill into the data region. Objects smaller than one block carry their entire body inline with the block-address field set to the `0xFFFFFFFF` "no full block" sentinel — exactly as `mkfs.erofs` encodes small files;node ids (`nid`) as 32-byte granules measured from `meta_blkaddr * blockSize`; inodes are packed with their inline tails and the next inode is re-aligned to a 32-byte boundary. Directories are emitted as EROFS directory chunks: a contiguous array of 12-byte `erofs_dirent` headers followed by the packed entry names, with the conventional "." and ".." entries first. Directory bodies follow the same FLAT_INLINE rule.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ErofsWriter` | `ErofsWriter()` |  |
+| `VolumeName` | `string VolumeName { get; set; }` | Volume label written into the superblock `volume_name` field (16 bytes, NUL-padded; longer strings are truncated). Empty leaves the field zero. |
+| `AddFile` | `void AddFile(string path, byte[] content)` |  |
+| `AddStreamingFile` | `void AddStreamingFile(string path, long size, Func<Stream> openStream)` | Registers a file at the given archive path. Path segments are split on '/' and the intermediate directories are created on demand so nested layouts round-trip with their full directory chain intact. |
+| `Build` | `byte[] Build()` | Produces the complete EROFS image as a byte array. |
+| `SetUuid` | `void SetUuid(ReadOnlySpan<byte> uuid)` | Fixes the image's identity, for a build that has to come out the same twice. |
+| `WriteTo` | `void WriteTo(Stream output)` | Writes the complete EROFS image to `output`. |
+
+### Namespace `FileSystem.ExFat`
+
+[`ExFatBlockMover`](#exfatblockmover) · [`ExFatEntry`](#exfatentry) · [`ExFatExtentMap`](#exfatextentmap) · [`ExFatFormatDescriptor`](#exfatformatdescriptor) · [`ExFatModifier`](#exfatmodifier) · [`ExFatReader`](#exfatreader) · [`ExFatRemover`](#exfatremover) · [`ExFatWriter`](#exfatwriter)
+
+#### `ExFatBlockMover`
+
+In-place exFAT block mover. Moves cluster-aligned extents and patches FAT chain entries, allocation bitmap, directory entry sets, and VBR PercentInUse. Streaming: never loads the whole image. All metadata updates are targeted writes with `Flush` barriers between the four steps so a crash mid-operation leaves the image in an fsck-recoverable state. The FAT (potentially 50 GB on a 50 TB volume) is navigated via `SectorCache` with a bounded ~256 MB memory cap.
 
 Implements `IFilesystemBlockMover`, `IFilesystemMetadataMover`.
 
@@ -4071,7 +5365,7 @@ Walks an exFAT image and yields its actual on-disk byte layout — the reserved
 
 References: `https://learn.microsoft.com/en-us/windows/win32/fileio/exfat-specification` — Microsoft's official exFAT file system specification`https://github.com/torvalds/linux/tree/master/fs/exfat` — mainline kernel implementation`https://en.wikipedia.org/wiki/ExFAT` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4151,7 +5445,7 @@ Builds exFAT filesystem images that Windows 10+ actually mounts. Default layout:
 
 ### Namespace `FileSystem.Ext`
 
-[`ExtBlockMover`](#extblockmover) · [`ExtEntry`](#extentry) · [`ExtExtentMap`](#extextentmap) · [`ExtFormatDescriptor`](#extformatdescriptor) · [`ExtInPlaceShrinker`](#extinplaceshrinker) · [`ExtInPlaceShrinker.ShrinkResult`](#extinplaceshrinkershrinkresult) · [`ExtModifier`](#extmodifier) · [`ExtModifier.InPlaceUnsupportedException`](#extmodifierinplaceunsupportedexception) · [`ExtReader`](#extreader) · [`ExtRemover`](#extremover) · [`ExtShrinkHelper`](#extshrinkhelper) · [`ExtShrinkHelper.ShrinkResult`](#extshrinkhelpershrinkresult) · [`ExtWriter`](#extwriter) · [`ExtWriter.ExtVersion`](#extwriterextversion)
+[`ExtBlockMover`](#extblockmover) · [`ExtEntry`](#extentry) · [`ExtExtentMap`](#extextentmap) · [`ExtFilesystemDriverAdapter`](#extfilesystemdriveradapter) · [`ExtFormatDescriptor`](#extformatdescriptor) · [`ExtInPlaceShrinker`](#extinplaceshrinker) · [`ExtInPlaceShrinker.ShrinkResult`](#extinplaceshrinkershrinkresult) · [`ExtModifier`](#extmodifier) · [`ExtModifier.InPlaceUnsupportedException`](#extmodifierinplaceunsupportedexception) · [`ExtReader`](#extreader) · [`ExtRemover`](#extremover) · [`ExtShrinkHelper`](#extshrinkhelper) · [`ExtShrinkHelper.ShrinkResult`](#extshrinkhelpershrinkresult) · [`ExtWriter`](#extwriter) · [`ExtWriter.ExtVersion`](#extwriterextversion)
 
 #### `ExtBlockMover`
 
@@ -4192,11 +5486,27 @@ Walks an ext2/3/4 image and yields its actual on-disk byte layout — per-file e
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Single-pass walker. Parses superblock + BGD table; emits the metadata regions (SB, BGDT, block bitmap, inode bitmap, inode table) of every group as `MetadataReserved` extents; walks the directory tree from inode 2 and emits one extent per contiguous data-block run per file. |
 
+#### `ExtFilesystemDriverAdapter`
+
+Native ext2/3/4 driver sidecar. Inode numbers + i_generation form stable node identities and hard-linked directory entries converge on the same node. File content is streamed by the existing native inode/extent walker into a bounded positional spool until the reader exposes its extent map directly.
+
+Implements `IBlockDeviceFilesystemDriverProvider`, `IFilesystemDriverAdapter`, `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ExtFilesystemDriverAdapter` | `ExtFilesystemDriverAdapter()` |  |
+| `FormatId` | `string FormatId { get; }` |  |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
 #### `ExtFormatDescriptor`
 
 References: `https://docs.kernel.org/filesystems/ext4/index.html` — the kernel's ext4 on-disk layout documentation (superblock, group descriptors, inodes, extents; ext2/3 are subsets)`https://e2fsprogs.sourceforge.net/ext2intro.html` — Card/Ts'o/Tweedie, "Design and Implementation of the Second Extended Filesystem"`https://github.com/tytso/e2fsprogs` — e2fsprogs, the canonical userspace implementation`https://en.wikipedia.org/wiki/Ext4` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4399,7 +5709,7 @@ Walks an ext1 image and yields its actual on-disk byte layout — per-file block
 
 Descriptor for ext1 filesystem images — the 1992 predecessor of ext2 by Rémy Card. ext1's on-disk superblock layout is identical to the GOOD_OLD-revision ext2 superblock with one crucial difference: the s_magic field at offset 56 of the superblock (file-relative offset 1080) reads `0xEF51` instead of ext2's `0xEF53`. ext1 has no journal, no extents, and no FEATURE_INCOMPAT_FILETYPE — directory entries are 8-byte fixed-header (with a 16-bit `name_len`) + name only. Detection, structural surfacing and round-trip read+write of small WORM images are supported; vintage pre-1993 Linux disk images and forensic tooling for early Linux installs are the consumers. References: `https://e2fsprogs.sourceforge.net/ext2intro.html` — Card/Ts'o/Tweedie, "Design and Implementation of the Second Extended Filesystem", which documents the original ext it replaced`https://mirrors.edge.kernel.org/pub/linux/kernel/Historic/` — historic kernel trees whose `fs/ext` is the primary source for the 1992 layout`https://en.wikipedia.org/wiki/Extended_file_system` — Wikipedia article on the original ext
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4510,7 +5820,7 @@ Implements `IFilesystemBlockMover`.
 
 References: `https://docs.kernel.org/filesystems/f2fs.html` — Linux kernel F2FS documentation (on-disk layout: SB/CP/SIT/NAT/SSA/main area)`https://www.usenix.org/conference/fast15/technical-sessions/presentation/lee` — Lee et al., "F2FS: A New File System for Flash Storage" (USENIX FAST '15), the design paper`https://en.wikipedia.org/wiki/F2FS` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4584,7 +5894,7 @@ Builds spec-compliant F2FS filesystem images that are accepted by Linux `fsck.f2
 
 ### Namespace `FileSystem.Fat`
 
-[`FatBlockMover`](#fatblockmover) · [`FatChainStream`](#fatchainstream) · [`FatEntry`](#fatentry) · [`FatExtentMap`](#fatextentmap) · [`FatFormatDescriptor`](#fatformatdescriptor) · [`FatModifier`](#fatmodifier) · [`FatReader`](#fatreader) · [`FatRemover`](#fatremover) · [`FatShrinkHelper`](#fatshrinkhelper) · [`FatShrinkHelper.ClusterHintResult`](#fatshrinkhelperclusterhintresult) · [`FatShrinkHelper.ClusterSizeStats`](#fatshrinkhelperclustersizestats) · [`FatShrinkHelper.ShrinkResult`](#fatshrinkhelpershrinkresult) · [`FatWriter`](#fatwriter)
+[`FatBlockMover`](#fatblockmover) · [`FatChainStream`](#fatchainstream) · [`FatEntry`](#fatentry) · [`FatExtentMap`](#fatextentmap) · [`FatFilesystemDriverAdapter`](#fatfilesystemdriveradapter) · [`FatFormatDescriptor`](#fatformatdescriptor) · [`FatModifier`](#fatmodifier) · [`FatReader`](#fatreader) · [`FatRemover`](#fatremover) · [`FatShrinkHelper`](#fatshrinkhelper) · [`FatShrinkHelper.ClusterHintResult`](#fatshrinkhelperclusterhintresult) · [`FatShrinkHelper.ClusterSizeStats`](#fatshrinkhelperclustersizestats) · [`FatShrinkHelper.ShrinkResult`](#fatshrinkhelpershrinkresult) · [`FatWriter`](#fatwriter)
 
 #### `FatBlockMover`
 
@@ -4655,11 +5965,27 @@ Walks a FAT12/16/32 image and yields the actual on-disk byte layout — reserved
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Single-pass FAT walker. Parses the boot sector, then for each directory entry walks the cluster chain, emitting one `DefragBlockInfo` per contiguous run. Reserved region (boot sector, FAT1, FAT2, root dir on FAT12/16) becomes a single `MetadataReserved` extent. Free clusters are emitted in chunks. |
 
+#### `FatFilesystemDriverAdapter`
+
+Native FAT12/16/32 driver sidecar. The current milestone is a validated, positional read-only mount over the real FAT chains; writable mounting stays fail-closed until the existing offline mutators are converted to bounded block-device operations with complete directory/durability semantics.
+
+Implements `IBlockDeviceFilesystemDriverProvider`, `IFilesystemDriverAdapter`, `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FatFilesystemDriverAdapter` | `FatFilesystemDriverAdapter()` |  |
+| `FormatId` | `string FormatId { get; }` |  |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
 #### `FatFormatDescriptor`
 
 References: `https://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/fatgen103.doc` — Microsoft "FAT32 File System Specification" (FATGEN 1.03), the canonical FAT12/16/32 spec`https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system` — Wikipedia's detailed on-disk reference incl. vendor variants`https://github.com/torvalds/linux/tree/master/fs/fat` — mainline kernel implementation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4793,57 +6119,149 @@ Builds FAT12 / FAT16 / FAT32 filesystem images from scratch per the Microsoft FA
 | `PickClusterForFixedImage` | `int PickClusterForFixedImage(int totalSectors, int bytesPerSector, int forcedFatType, int requestedRootEntries, bool enableLfn)` | Picks the cluster size (bytes) that minimises slack + FAT-table overhead without escalating to a higher FAT variant than strictly necessary. Delegates to `FilesystemLayoutOptimizer` for the generic optimisation logic; FAT-specific tier and cost knowledge lives here. |
 | `SetVolumeSerial` | `void SetVolumeSerial(uint serial)` | Pins the volume serial instead of letting one be drawn. |
 
-### Namespace `FileSystem.Gfs2`
+### Namespace `FileSystem.FatPlus`
 
-[`Gfs2BlockMover`](#gfs2blockmover) · [`Gfs2Entry`](#gfs2entry) · [`Gfs2ExtentMap`](#gfs2extentmap) · [`Gfs2FormatDescriptor`](#gfs2formatdescriptor) · [`Gfs2Reader`](#gfs2reader) · [`Gfs2Writer`](#gfs2writer)
+[`FatPlusEntry`](#fatplusentry) · [`FatPlusFormatDescriptor`](#fatplusformatdescriptor) · [`FatPlusInPlaceAdder`](#fatplusinplaceadder) · [`FatPlusModifier`](#fatplusmodifier) · [`FatPlusReader`](#fatplusreader) · [`FatPlusWriter`](#fatpluswriter)
 
-#### `Gfs2BlockMover`
+#### `FatPlusEntry`
 
-Moves a file's blocks inside a GFS2 volume, repoints the tree pointers that name them, and moves the allocation with them.
+A directory entry from a FAT+ volume. Identical shape to `FatEntry` but with an extended (up to 8-byte) file size to represent files larger than 4 GiB.
 
-Implements `IFilesystemBlockMover`.
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FatPlusEntry` | `FatPlusEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `LastModified` | `DateTime? LastModified { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `FatPlusFormatDescriptor`
+
+FAT+ (also called FAT32+ / FAT16+) format descriptor. FAT+ is an open extension to standard FAT that lifts the per-file 4 GiB size cap to 256 GiB by repurposing previously-reserved bytes in the 32-byte directory entry to hold the upper bits of file size. References: FAT+ draft revision 2 (FATPLUS.TXT, Udo Kuhnt / Luchezar Georgiev / Jeremy Davis, 2007) — the defining spec, historically hosted at fdos.org/kernel/fatplus.txt`https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system` — Wikipedia's FAT reference, which documents the FAT+ extension
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Gfs2BlockMover` | `Gfs2BlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the structures and the group bitmaps. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `FatPlusFormatDescriptor` | `FatPlusFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds a fresh FAT+ image at `output` from the supplied inputs. Image size defaults to 100 MB (200_000 sectors) — enough to land in the FAT32 cluster-count range that FAT+ extends. For larger payloads the writer automatically scales. |
+| `Defragment` | `void Defragment(Stream archive)` | Rebuilds `archive` in place so every file occupies a contiguous cluster run. Outer byte size is preserved. Uses `DefragRebuilder` via `FatPlusReader` (read path) and `FatPlusWriter` (write path) — the writer always start-packs from cluster 2, which is exactly the defragmented layout. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware FAT+ defragmentor — delegates to the rebuild path in `Rebuild`. Supports all four `DefragMode` values via the rebuilder's listing-order dispatch. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | FAT+ keeps FAT's on-disk layout — same BPB, same FATs, same cluster chains — so the FAT walker maps it as it stands. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from a FAT+ image with full secure wipe (cluster data bytes, cluster-tip slack, FAT chain entries, and directory entries). Preserves the BPB OEM signature so detection still flags the image as FAT+ afterwards. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `FatPlusInPlaceAdder`
+
+Genuine in-place add for FAT+ images — the FAT+ counterpart of `FatModifier`. FAT+ is a backward-compatible FAT32 extension whose on-disk layout (boot sector, FATs, FSInfo, root directory as a cluster chain, data clusters) is byte-for-byte standard FAT32; the only difference is the directory entry's file-size encoding, where the low 6 bits of `DIR_NTRes` (offset 12) carry bits 32..37 of a 38-bit size. This adder therefore delegates the heavy lifting (free-cluster allocation, FAT-chain linking in every FAT copy, directory-slot insertion, FSInfo free-count maintenance) to `FatModifier`, then patches the just-written short-name dirent so the FAT+ size encoding is correct: it always emits the long name through VFAT slots so the 8.3 alias is upper-case and carries no NT case bits — which is essential because those case bits (0x08 / 0x10) live in the very low-6-bit region FAT+ repurposes for size, and would otherwise be mis-read as size bits. Structural cases `FatModifier` cannot handle (a full root directory, insufficient free clusters) throw so the descriptor can fall back to the verified `FatPlusWriter` rebuild. Files whose declared size needs more than 31 bits of payload (> 2 GiB) cannot be carried by the in-place byte[] path and also fall back.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(byte[] image, string name, byte[] data, long extendedSize = -1, DateTime? modTime = null)` | Adds (or replaces by name) `name` to the in-memory FAT+ image, genuinely in place. The data clusters, FAT links and directory entry are written via `FatModifier`; the short-name dirent is then patched with the FAT+ extended-size encoding. The volume's `"FAT+ "` OEM signature (primary + backup boot sector) is preserved/repaired so detection still recognises the image as FAT+. |
+| `RemoveFile` | `static void RemoveFile(byte[] image, string name)` | Removes `name` from the FAT+ image in place (delegates to `FatRemover` — the FAT chain, dirent and data wipe are identical to standard FAT; the FAT+ size bits live in the dirent which is zeroed) and re-stamps the FAT+ OEM signature so detection survives. |
+
+#### `FatPlusModifier`
+
+In-place modification primitives for FAT+ filesystem images: `AddFile` appends or replaces a file (via full rebuild — same strategy `FatFormatDescriptor` uses for FAT), and `RemoveFile` removes a file by freeing its cluster chain, wiping its data, and marking its directory entries as deleted.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream archive, string name, byte[] data)` | Appends (or replaces by name) a file in an existing FAT+ image. The common case is a genuine in-place edit via `FatPlusInPlaceAdder`: free clusters are allocated, the data written into them, the chain linked in every FAT copy, a directory entry inserted, and the FAT+ extended-size bits patched — existing files, their clusters and the boot sector stay byte-identical and the image keeps its length. Structural cases the in-place path can't handle (nested target, full root directory, insufficient free space) fall back to the verified `FatPlusWriter` rebuild, which preserves the existing entries' extended sizes. |
+| `RemoveFile` | `static void RemoveFile(Stream archive, string name)` | Removes the named file from a FAT+ image: walks the FAT chain, zeros every cluster the file occupies (including cluster-tip slack past the declared size), zeros the FAT entries in every FAT copy, and marks the directory entries (short + preceding LFN slots) as deleted (0xE5 sentinel + zero payload). Preserves the BPB OEM signature so detection still flags this as a FAT+ image afterwards. |
+
+#### `FatPlusReader`
+
+Read-only reader for FAT+ filesystem images. FAT+ is a backward-compatible extension to FAT32 (and FAT16) that lifts the 4 GiB per-file size limit by repurposing previously-reserved bytes in the 32-byte directory entry to hold the upper bits of an extended file-size value.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FatPlusReader` | `FatPlusReader(Stream stream, bool leaveOpen = false)` |  |
+| `OemSignature` | `static readonly byte[] OemSignature` | OEM-name signature that identifies a FAT+ volume. 8 ASCII bytes at offset 3 of the BPB. |
+| `Entries` | `IReadOnlyList<FatPlusEntry> Entries { get; }` |  |
+| `FatType` | `int FatType { get; }` | FAT type (12, 16, or 32). FAT+ is most commonly applied to FAT32 but the spec also covers FAT16. |
+| `Dispose` | `void Dispose()` |  |
+| `ExtractTo` | `void ExtractTo(FatPlusEntry entry, Stream output)` | Streams the cluster chain for `entry` into `output`. This is the only safe path for files > 2 GiB because a byte[] of that size cannot be allocated on .NET. |
+| `Extract` | `byte[] Extract(FatPlusEntry entry)` | In-memory extract — only safe for files that fit in a `byte[]`. Throws for files > `MaxValue`. |
+| `HasFatPlusSignature` | `static bool HasFatPlusSignature(ReadOnlySpan<byte> bpb)` | Tests whether the BPB at the start of `bpb` carries the FAT+ OEM signature. |
+
+#### `FatPlusWriter`
+
+Builds FAT+ filesystem images. FAT+ is a backward-compatible extension to standard FAT32 (and FAT16) that lifts the 4 GiB per-file size cap to 256 GiB by repurposing the low 6 bits of the otherwise-reserved `DIR_NTRes` byte (offset 12) of the 32-byte directory entry as the high 6 bits of the file size — together with the standard 32-bit `DIR_FileSize` at offset 28 this forms a 38-bit size field. The OEM-name string in the BPB is set to `"FAT+ "` (offset 3..10) so FAT+-aware readers see the extension.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FatPlusWriter` | `FatPlusWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data, long extendedSize = -1)` | Adds a file to the image. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the layout is settled from it before a byte is read, so a payload past what a byte[] holds is placed like any other. |
+| `BuildAutoSized` | `byte[] BuildAutoSized(int requestedClusterSize = 0, int bytesPerSector = 512, string volumeLabel = null)` | Builds the smallest FAT+ image that still holds all file data plus FAT overhead, while never dropping below the 200_000-sector floor that keeps the volume in FAT32 (the cluster-count range FAT+ extends). Prefer this over `Build` when the caller has not pinned an image size. |
+| `BuildToStreamingAutoSized` | `void BuildToStreamingAutoSized(Stream output, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null)` | Streams an auto-sized FAT+ volume, sized to the files added, then applies the FAT+ patches in place. |
+| `BuildTo` | `void BuildTo(Stream output, int totalSectors, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null)` | Creates a `FatWriter` seeded with this writer's files (actual byte payloads only — the FAT+ extended sizes are patched into the image afterwards). Shared by `Build` and `PickClusterForFixedImage`. |
+| `Build` | `byte[] Build(int totalSectors = 200000, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null)` | Builds the FAT+ image. Default size (200_000 sectors ≈ 100 MB) is chosen to land in the FAT32 cluster-count range without using unnecessary disk. |
+| `PickClusterForFixedImage` | `int PickClusterForFixedImage(int totalSectors, int bytesPerSector = 512)` | Picks the cluster size that minimises slack + FAT-table overhead for a fixed image size, mirroring `PickClusterForFixedImage`. FAT+ is always FAT32, so the FAT-type tier is fixed at 32. Returns 0 when no candidate fits (caller should fall back to the writer's default). |
+| `PlanTotalSectors` | `int PlanTotalSectors(int bytesPerSector = 512)` | Sector count a volume needs to hold the files added: the payload plus ~50 % headroom for directory entries and cluster-tail slack, never below the FAT32 floor so the FAT+ extension stays meaningful. |
+
+### Namespace `FileSystem.Fatx`
+
+[`FatxBlockMover`](#fatxblockmover) · [`FatxEntry`](#fatxentry) · [`FatxFormatDescriptor`](#fatxformatdescriptor) · [`FatxModifier`](#fatxmodifier) · [`FatxReader`](#fatxreader) · [`FatxWriter`](#fatxwriter)
+
+#### `FatxBlockMover`
+
+Moves a file's clusters inside a FATX volume and relinks its chain.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FatxBlockMover` | `FatxBlockMover()` |  |
+| `AllocationBlockSize` | `int AllocationBlockSize { get; }` | The unit an allocation is counted in: one cluster. |
+| `ClusterSize` | `int ClusterSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. |
 | `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the geometry and walks the resource groups. |
+| `SupportsScatteredRelink` | `bool SupportsScatteredRelink { get; }` | A file's whole allocation can be restated in one call, so a file in several pieces is relinked as one chain rather than refused. |
+| `Init` | `void Init(Stream image)` | Reads the volume's geometry from its superblock. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` |  |
+| `UpdateAllocationScattered` | `void UpdateAllocationScattered(Stream image, string fileName, IReadOnlyList<long> oldBlockOffsets, IReadOnlyList<long> newBlockOffsets, IReadOnlySet<long> blocksLiveElsewhere)` |  |
 
-#### `Gfs2Entry`
+#### `FatxEntry`
 
-One entry in a GFS2 image. Read-only: we surface the superblock, root/master directory inode pointers, and (optionally) any directory entries we manage to walk from the root inode's leaf blocks.
+Single directory record from an Xbox FATX volume.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Gfs2Entry` | `Gfs2Entry()` |  |
+| `FatxEntry` | `FatxEntry()` |  |
+| `FirstCluster` | `uint FirstCluster { get; init; }` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `LastModified` | `DateTime? LastModified { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `Gfs2ExtentMap`
-
-Reads a GFS2 volume's resource-group bitmaps and reports which blocks are in use. GFS2 accounts for allocation two bits per block: 00 is free, and every other state (data, unlinked, dinode) means the block is live. What the bitmaps leave clear is exactly the free space — including the blocks a removed file used to occupy, which still hold its bytes.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
-
-#### `Gfs2FormatDescriptor`
+#### `FatxFormatDescriptor`
 
-GFS2 (Global File System 2) descriptor — Red Hat's cluster filesystem, mainline Linux since 2.6.19. We parse the superblock at offset 65536, surface block size + lock proto/table + UUID + master/root inode pointers, and walk the root inode's inline directory entries (single-leaf, di_height==0). For regular files with inline data (height==0) we extract the bytes. On-disk layout reverse-validated against real `mkfs.gfs2` output (gfs2-utils 3.5.1): the `gfs2_meta_header` is 24 bytes, the sb carries a reserved `__pad2` inum between master and root, and the `gfs2_dirent` header is 40 bytes. See `Gfs2ExternalConformanceTests` for the mkfs.gfs2 / fsck.gfs2 gate. Creation (`Create`, `Gfs2Writer`) emits a fresh, empty standalone (lock_nolock, single-journal) volume — superblock, the fixed first resource group plus a second data resource group with a correct (multi-block) allocation bitmap, the master directory and its system inodes (jindex, per_node, inum, statfs, rindex, quota), a formatted 8 MB journal of clean unmount log headers, and the root directory — all sized so real `fsck.gfs2 -n` passes clean (exit 0). Supported size range 16–256 MB (single data resource group); the volume is empty, since populating it with files is out of scope. Out of scope (multi-week effort each): writing files/directories, ExHash multi-leaf directories, multi-level block indirection (di_height > 0), devices > 256 MB (which gfs2-utils splits into several evenly-spaced resource groups), journal replay, cluster lock manager state, extended attributes. Magic: `mh_magic = 0x01161970` (BE u32) at the start of the superblock meta header. On disk at byte offset 65536 this serialises as `01 16 19 70`. Confidence 0.85 — well-known constant at a fixed offset, but GFS2 shares this magic with GFS1 at slightly different layouts, so we keep a small margin below the 0.9-0.95 reserved for formats with a structurally unique header. References: Linux kernel `fs/gfs2/` — `include/uapi/linux/gfs2_ondisk.h`Red Hat Cluster Suite / Resilient Storage Add-On documentation
+R/W descriptor for Microsoft Xbox / Xbox 360 FATX volumes. Magic "FATX" at offset 0; 4 KiB superblock followed by FAT16/FAT32 table. Read via `FatxReader`, create via `FatxWriter`, mutate via `FatxModifier` (in-place Add/Remove on the root directory; sub-directory mutation stays out of scope). References: `https://xboxdevwiki.net/FATX` — Xbox Dev Wiki's FATX page, the de-facto community specification`https://github.com/mborgerson/fatx` — maintained open-source FATX implementation (fatxfs)`https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system` — Wikipedia's FAT reference, which covers the FATX variant
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Gfs2FormatDescriptor` | `Gfs2FormatDescriptor()` |  |
+| `FatxFormatDescriptor` | `FatxFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -4855,101 +6273,106 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Knobs the empty-volume writer honours. `ImageSize` drives the writer's total size (clamped to the single-data-resource-group range 16–256 MB); `LockTable` is written into `sb_locktable` and read back as `Gfs2Reader.LockTable`. The 4 KB block size and the `lock_nolock` protocol are fixed by the standalone layout. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Creation knobs surfaced by the Convert dialog / CLI. `SectorsPerCluster` is the FATX allocation unit (512-byte sectors): leave it at "auto" (0) to let the layout optimiser minimise file-tail slack for the actual file-set, or pin a power-of-two value. Real Xbox HDDs use 32 (16 KiB clusters). |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh, empty standalone (lock_nolock, single-journal) GFS2 volume that real `fsck.gfs2` accepts clean. The volume size defaults to 32 MB and may be overridden with the `size` format option (bytes, clamped to 16–256 MB; `K`/`M` suffixes accepted). |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | In-place add: each input becomes a new dirent in the root cluster of the existing FATX image, with its bytes written into the first contiguous free cluster run found in the FAT. Sub-directory adds are not supported by v1 — only leaf filenames go to root. The FAT16/FAT32 width is auto-detected from the on-disk geometry. |
+| `AnalyzeLayout` | `LayoutAnalysis AnalyzeLayout(Stream image)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Emits a fresh FATX volume containing `inputs` via `FatxWriter`. Path components in `ArchiveName` become nested FATX subdirectories (one cluster chain per directory); files are stored contiguously starting at the next free cluster. |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Rewrites the volume with every file laid out contiguously from the start of the data area. Each entry is spilled to scratch and the writer pulls it back while laying out the metadata tree, so the rebuild is not bounded by what a byte[] can hold. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves only the files that are out of place, relinking each chain and repointing its directory record as the clusters arrive. A rebuild would read and rewrite every file to fix a handful of runs; this rewrites the allocation table entries and one field per file instead. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the FATX chain of every live entry: the superblock and the FAT are structure, each cluster run is the file that owns it, and whatever no chain reaches is free. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every block the resource-group bitmaps report as free — which is where a removed file's bytes stay until something else claims them. |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `PatchInPlace` | `void PatchInPlace(Stream image, LayoutPatch patch)` |  |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | In-place remove: tombstones each named dirent (name_length = 0xE5) and frees + wipes every data cluster in the file's FAT chain. Unknown names are silently skipped (consistent with how WORM Extract treats them). |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
-#### `Gfs2Reader`
+#### `FatxModifier`
 
-Read-only GFS2 (Global File System 2) image walker. Mainline Linux since 2.6.19; Red Hat cluster filesystem. Big-endian on-disk. What we parse: Superblock at byte offset 65536 (= sector 128 × 512 B). Magic `mh_magic = 0x01161970` at the start of the gfs2_meta_header.Block size from `sb_bsize`, root + master inum from `sb_root_dir` / `sb_master_dir`.Root inode (`gfs2_dinode`) and any `gfs2_dirent` records living inline in the inode block (single-leaf directories). What we deliberately skip (multi-week effort each): ExHash directories (multi-level leaf blocks)Multi-level block indirection (di_height > 0)Journal recovery, cluster lock manager stateExtended attributes References: Linux kernel `fs/gfs2/` — primary on-disk definition`include/uapi/linux/gfs2_ondisk.h` — magic constants & struct layoutRed Hat Cluster Suite / Resilient Storage Add-On docs
+In-place R/W modifier for Microsoft Xbox / Xbox 360 FATX volumes. Modifies an existing image (produced by `FatxWriter` or by a real Xbox console) by directly editing the FAT region and the root directory cluster. Sub-directory entries are out of scope for v1: the modifier only adds/removes files at the FATX volume root.Add walks the FAT looking for the first free cluster run long enough to hold the requested payload, allocates it (linking each cluster to the next, terminating with the FAT16/FAT32 EoC sentinel), writes the file bytes into the data region cluster-by-cluster, then writes a 64-byte FATX dirent into the first reusable slot in the root cluster. Reusable slots are either a 0xE5 tombstone (previously deleted entry) or the leading 0xFF terminator that the writer planted past the last valid record. Unused tail bytes of the dirent's 42-byte name field stay 0xFF, matching what the writer emits and what real Xbox firmware writes.Remove finds the dirent by name in the root cluster, sets `name_length = 0xE5` per the FATX tombstone convention, walks the file's FAT chain freeing each cluster (entry → 0), and securely zeros the data bytes inside each freed cluster so no forensic recovery of the previous content is possible.The 12-byte timestamp tail of new dirents stays zeroed — the real Xbox kernel re-stamps timestamps on mount, so this is benign in practice and matches what `FatxWriter` already produces.FAT width. The FAT16/FAT32 threshold is recomputed from the image geometry exactly the same way `FatxReader` does so the reader and modifier always agree on which width to use. Both branches are exercised by the test suite.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(byte[] image, string name, byte[] data)` | Adds a single file to the root directory of the FATX image. The image is mutated in place. Throws if no free cluster run of the required length exists, or if no reusable dirent slot is left in the root cluster. |
+| `RemoveFile` | `static bool RemoveFile(byte[] image, string name)` | Removes a single file from the root directory of the FATX image. The dirent is tombstoned with `name_length = 0xE5`, the file's FAT chain is freed, and every freed data cluster is zeroed so the previous bytes are not forensically recoverable. Returns true if a matching dirent was found and tombstoned; false otherwise. |
+
+#### `FatxReader`
+
+Reader for Microsoft Xbox / Xbox 360 FATX volumes. On-disk layout (little-endian): +0x000 "FATX" 4 magic +0x004 volume_id 4 +0x008 sectors_per_cluster 4 +0x00C root_dir_cluster 4 +0x010 unused / name 0x1000 - 0x10 FAT immediately follows the superblock at offset 0x1000 (4 KiB). FAT entries are either 16 or 32 bits depending on cluster count; if the cluster count < 0xFFF4 the table is FAT16, otherwise FAT32. EOC sentinels 0xFFF8/0xFFFFFFF8. Directory record (0x40 bytes): +0x00 name_length u8 (0xFF = unused, 0xE5 = deleted) +0x01 attributes u8 +0x02 name 42 bytes (padded 0xFF) +0x2C first_cluster u32 +0x30 size u32 +0x34..0x3F timestamps Spec sources: https://www.eecg.utoronto.ca/~lie/papers/usenix2002.pdf (Xbox security paper) and FreeXboxBios FATX documentation; also reverse-engineered by xboxhdm/fatx-linux/fatxlinux projects.
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Gfs2Reader` | `Gfs2Reader(Stream stream)` |  |
-| `FormatFs` | `const uint FormatFs` | Filesystem format version expected in sb_fs_format (GFS2_FORMAT_FS). |
-| `FormatMultihost` | `const uint FormatMultihost` | Multi-host format version expected in sb_multihost_format (GFS2_FORMAT_MULTI). |
-| `MetaHeaderSize` | `const int MetaHeaderSize` | Size of `struct gfs2_meta_header` on disk: 24 bytes — `mh_magic`(4) + `mh_type`(4) + `__pad0`(8) + `mh_format`(4) + `mh_jid`(4). Real `mkfs.gfs2` output uses the 24-byte header; every metadata struct (sb, dinode, leaf, rgrp, log header) embeds it at offset 0. |
-| `MetaMagic` | `const uint MetaMagic` | GFS2 metadata magic — `mh_magic` at start of every metadata block. |
-| `MetaTypeDinode` | `const uint MetaTypeDinode` | gfs2_meta_header.mh_type for a dinode. |
-| `MetaTypeSuperblock` | `const uint MetaTypeSuperblock` | gfs2_meta_header.mh_type for the superblock. |
-| `SbByteOffset` | `const long SbByteOffset` | Superblock byte offset within the device (sector 128 × 512 B). |
-| `BlockSizeShift` | `uint BlockSizeShift { get; }` |  |
-| `BlockSize` | `uint BlockSize { get; }` |  |
-| `Entries` | `IReadOnlyList<Gfs2Entry> Entries { get; }` |  |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
-| `LockProto` | `string LockProto { get; }` |  |
-| `LockTable` | `string LockTable { get; }` |  |
-| `MasterFormalIno` | `ulong MasterFormalIno { get; }` |  |
-| `MasterInodeBlock` | `ulong MasterInodeBlock { get; }` |  |
-| `RootFormalIno` | `ulong RootFormalIno { get; }` |  |
-| `RootInodeBlock` | `ulong RootInodeBlock { get; }` |  |
-| `SuperblockRaw` | `byte[] SuperblockRaw { get; }` | Raw superblock bytes (1024 bytes captured from offset 65536), for diagnostics. |
-| `SuperblockValid` | `bool SuperblockValid { get; }` |  |
-| `UuidHex` | `string UuidHex { get; }` |  |
+| `FatxReader` | `FatxReader(Stream stream)` |  |
+| `ClusterSize` | `int ClusterSize { get; }` |  |
+| `Entries` | `IReadOnlyList<FatxEntry> Entries { get; }` |  |
+| `FatType` | `int FatType { get; }` |  |
+| `RootDirCluster` | `uint RootDirCluster { get; }` |  |
+| `SectorsPerCluster` | `uint SectorsPerCluster { get; }` |  |
 | `Dispose` | `void Dispose()` |  |
-| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(Gfs2Entry entry)` | Where on disk `entry`'s bytes actually sit, as runs of whole blocks, along with the byte offset of the first pointer that names each run. |
-| `ExtractTo` | `long ExtractTo(Gfs2Entry entry, Stream destination)` | Writes `entry`'s content into `destination`. A body up to `blocksize - 232` is stuffed in the dinode; a longer one hangs off a metadata tree whose depth di_height gives — the dinode's own pointer area at the top, then `di_height - 1` levels of indirect blocks. Returns the number of bytes written. |
-| `Extract` | `byte[] Extract(Gfs2Entry entry)` | Reads a regular file's content. Only valid below the array limit. |
+| `ExtractTo` | `void ExtractTo(FatxEntry entry, Stream destination)` | Copies an entry's bytes into `destination` one cluster at a time, so an entry larger than a byte[] can hold is extracted like any other. |
+| `Extract` | `byte[] Extract(FatxEntry entry)` |  |
 
-#### `Gfs2Writer`
+#### `FatxWriter`
 
-Clean-room GFS2 (Global File System 2) image writer producing a minimal, empty, standalone (`lock_nolock`, single-journal) volume that real `fsck.gfs2` (gfs2-utils) accepts without errors. The output mirrors the on-disk structures defined in the public Linux kernel header `include/uapi/linux/gfs2_ondisk.h` and the layout produced by `mkfs.gfs2`, reverse-validated byte-for-byte against a real reference image. Big-endian throughout, 4096-byte blocks.What we emit (everything `fsck.gfs2` requires for a clean volume):Superblock at byte 65536 (block 16).A single resource group whose inline bitmap covers every data block and correctly marks each used metadata block.Master directory dinode and the system inodes hung off it: `jindex`, `per_node`, `inum`, `statfs`, `rindex`, `quota`.A formatted 8 MB journal (`journal0`) whose 2048 blocks each carry a clean unmount log header (correct `lh_hash` CRC32 and `lh_crc` CRC32C).`per_node` system inodes `inum_range0`, `statfs_change0`, `quota_change0` (the latter a 1 MB file of empty quota-change blocks).The root directory dinode with `.` and `..`.Block-accounting fields (`rg_free`, `rg_dinodes`, the master `statfs`, the `inum` next-formal-number) are all computed from the real layout so `check_statfs` passes.
+Builds Microsoft Xbox / Xbox 360 FATX filesystem images from scratch per the reverse-engineered FATX spec (FreeXboxBios / fatx-linux / fatxlinux). On-disk layout (little-endian):0x000 superblock: "FATX" magic + volume_id + sectors_per_cluster + root_cluster + 4078 reserved bytes.0x1000 FAT region: FAT16 (2 byte/entry) if cluster_count < 0xFFF4 else FAT32 (4 byte/entry). Length rounded up to 4 KiB pages.data region: clusters numbered from 1; cluster N is at `fat_end + (N-1)*cluster_size`.directory entries (64 bytes each): name_length + attrs + 42-byte ASCII name (0xFF-padded) + first_cluster (u32) + size (u32) + 12 bytes of timestamps. Sentinel 0xFF on name_length terminates the directory; 0xE5 marks deleted.Real Xbox volumes use 16 KiB clusters and FAT32, but the format itself permits any power-of-two sectors-per-cluster — the writer auto-picks a small cluster (2 KiB / 4 sectors) for tiny synthetic images so unit tests stay compact, and 16 KiB / 32 sectors for any image > 1 MiB, matching the original Xbox HDD convention.FATX dirent names are limited to 42 ASCII bytes — no LFN, no Unicode. Names longer than 42 characters are truncated with a trailing `~N` alias to keep them unique within the same directory.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Gfs2Writer` | `Gfs2Writer(long sizeBytes = 33554432, byte[] uuid = null, DateTime? timestamp = null, string lockTable = null)` | Creates a writer for an image of the given total size in bytes. The size is rounded down to a whole number of 4096-byte blocks; the minimum that yields a clean volume (journal + system inodes + slack) is 32 MB. |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a regular file to the root directory. Bodies up to `BlockSize - 232` are stuffed in the dinode; longer ones get a metadata tree of indirect blocks. |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are pulled from `openStream` as the volume is written. |
-| `Build` | `byte[] Build()` | Builds the image and returns the raw bytes. |
-| `Build` | `void Build(Stream output)` | Builds the image and writes it to `output`. |
-| `EstimateSize` | `static long EstimateSize(IEnumerable<long> fileSizes)` | Smallest volume that holds `fileSizes`: the fixed metadata layout, every file's dinode, its data blocks and the indirect blocks above them, plus room for the resource-group bitmaps. Rounded up to a megabyte. |
-
-### Namespace `FileSystem.Hammer`
+| `FatxWriter` | `FatxWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. Path separators ('/' or '\') split the name into nested directories; each subdirectory becomes its own cluster chain with proper FATX dirents. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the cluster layout is settled from it before a byte is read. |
+| `Build` | `byte[] Build(int sectorsPerCluster = 0, uint volumeId = 0)` | Builds a complete FATX image containing the previously-added files. |
+| `WriteTo` | `void WriteTo(Stream output, int sectorsPerCluster = 0, uint volumeId = 0)` | Writes the image into `output`: the superblock and FAT, then every cluster payload at its offset. Only a non-seekable target has to materialise the image, so a seekable one is bounded by the disk rather than by what a byte[] can address. |
 
-[`HammerBlockMover`](#hammerblockmover) · [`HammerExtentMap`](#hammerextentmap) · [`HammerFormatDescriptor`](#hammerformatdescriptor) · [`HammerReader`](#hammerreader) · [`HammerReader.DataExtent`](#hammerreaderdataextent) · [`HammerReader.FileEntry`](#hammerreaderfileentry) · [`HammerVolumeOndisk`](#hammervolumeondisk) · [`HammerWriter`](#hammerwriter)
+### Namespace `FileSystem.Gemdos`
 
-#### `HammerBlockMover`
+[`GemdosBpb`](#gemdosbpb) · [`GemdosExtentMap`](#gemdosextentmap) · [`GemdosFormatDescriptor`](#gemdosformatdescriptor) · [`GemdosInPlaceModifier`](#gemdosinplacemodifier) · [`GemdosOptimizer`](#gemdosoptimizer) · [`GemdosOptimizer.GemdosGeometry`](#gemdosoptimizergemdosgeometry) · [`GemdosReader`](#gemdosreader) · [`GemdosWriter`](#gemdoswriter)
 
-Moves a file's data records inside a HAMMER volume and repoints the B-tree elements that name them.
+#### `GemdosBpb`
 
-Implements `IFilesystemBlockMover`.
+Parsed Atari ST GEMDOS BPB. Layout matches MS-DOS FAT12 BPB but the jump byte is `0x60` (m68k `BRA.S`) instead of x86 `0xEB`/`0xE9`. All multi-byte fields are little-endian. Selected fields: 0x00 jmp u8 — 0x60 (BRA.S) 0x01 branch u16 — branch displacement 0x03 OEM 8 B — vendor ID 0x0B bps u16 — bytes per sector (typically 512) 0x0D spc u8 — sectors per cluster 0x0E resv u16 — reserved sectors 0x10 nfats u8 — number of FATs (typically 2) 0x11 nroot u16 — root directory entries 0x13 totsec u16 — total sectors 0x15 media u8 — media descriptor 0x16 spf u16 — sectors per FAT 0x18 spt u16 — sectors per track 0x1A sides u16 — heads
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HammerBlockMover` | `HammerBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Sixty-four bytes. A record's zone offset is byte-exact, but keeping the destinations on the element grid keeps a record from straddling the sixteen-byte structures the format aligns on. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a record may occupy: past the volume header and reserves. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads where the buffer area starts and how far the records reach. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `GemdosBpb` | `GemdosBpb()` |  |
+| `GemdosJump` | `const byte GemdosJump` |  |
+| `BytesPerSector` | `ushort BytesPerSector { get; init; }` |  |
+| `JumpByte` | `byte JumpByte { get; init; }` |  |
+| `MediaDescriptor` | `byte MediaDescriptor { get; init; }` |  |
+| `NumFats` | `byte NumFats { get; init; }` |  |
+| `RawBytes` | `byte[] RawBytes { get; init; }` |  |
+| `ReservedSectors` | `ushort ReservedSectors { get; init; }` |  |
+| `RootEntries` | `ushort RootEntries { get; init; }` |  |
+| `SectorsPerCluster` | `byte SectorsPerCluster { get; init; }` |  |
+| `SectorsPerFat` | `ushort SectorsPerFat { get; init; }` |  |
+| `SectorsPerTrack` | `ushort SectorsPerTrack { get; init; }` |  |
+| `Sides` | `ushort Sides { get; init; }` |  |
+| `TotalSectors` | `ushort TotalSectors { get; init; }` |  |
+| `Valid` | `bool Valid { get; init; }` |  |
+| `TryParse` | `static GemdosBpb TryParse(ReadOnlySpan<byte> image)` |  |
 
-#### `HammerExtentMap`
+#### `GemdosExtentMap`
 
-Reads a HAMMER volume's freemap and reports which bytes are in use. HAMMER allocates in 8 MB big-blocks: a layer-2 entry per big-block records which zone owns it and how far into it the allocator has appended. A big-block no zone owns is free outright, and the tail of one past its append point is free as well — which is where a removed file's bytes stay.
+On-disk layout walker for GEMDOS images. Delegates to FAT12's extent map after re-presenting the GEMDOS jump byte (0x60) as MS-DOS's (0xEB) so the FAT walker accepts the boot sector.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `HammerFormatDescriptor`
+#### `GemdosFormatDescriptor`
 
-Read-only descriptor for HAMMER (DragonFly BSD original) filesystem images. Surfaces the volume header at offset 0 plus a structured metadata bundle and the raw image. Walking the HAMMER B-tree (zone blockmap → cluster → inode → records) is explicitly out of scope (multi-week effort). Magic: 8-byte uint64 `vol_signature = 0xC8414D4DC5523031` ("HAMMER01") at offset 0, serialised LE on disk as `31 30 52 C5 4D 4D 41 C8`. Confidence 0.85: an 8-byte magic value at offset 0 is high-confidence but HAMMER lacks an additional sanity check at this stage of detection (the `vol_fstype` UUID at offset 64 is not validated against a well-known constant). References: `https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/vfs/hammer/hammer_disk.h``https://www.dragonflybsd.org/hammer/`
+Atari ST GEMDOS disk image descriptor. GEMDOS is a FAT12 variant: the on-disk layout is exactly MS-DOS FAT12 (BPB at offset 11 onwards, two FAT copies, fixed-size root directory, 8.3 dirents, free-block-chain allocation), but the jump byte at offset 0 is `0x60` (Motorola 68000 `BRA.S`) instead of `0xEB`/`0xE9` (x86 `JMP`). The reader and writer here delegate to the FAT12 implementation in `Fat` and re-present the jump byte at the boundary. Hierarchy support. GEMDOS supports subdirectories via standard FAT12 directory entries (attribute bit 4 = 0x10). The reader / writer inherit full tree support from `FatReader` / `FatWriter`.Defrag / Purge / Conversion. Driven by the rebuild-based pattern in `DefragRebuilder`; conversion is unlocked for free via `IArchiveCreatable`. Purge zeros all free clusters + cluster-tip slack via the FAT extent map.Spec. Atari ST Internals (Brückmann, Englisch, Gerits, 1986), GEMDOS disk format chapter; standard FAT12 spec (FATGEN103) for the BPB and on-disk layout. References: "Atari ST Internals" (Brückmann, Englisch, Gerits; Abacus/Data Becker, 1986) — GEMDOS disk format chapter, the canonical reference`https://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/fatgen103.doc` — Microsoft FATGEN 1.03, the underlying FAT12 layout`https://en.wikipedia.org/wiki/GEMDOS` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HammerFormatDescriptor` | `HammerFormatDescriptor()` |  |
+| `GemdosFormatDescriptor` | `GemdosFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -4961,138 +6384,117 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the HAMMER writer honours: the filesystem label (`newfs_hammer -L`), written into the volume header and the PFS#0 data and surfaced back as `vol_label`. Volume size is intentionally not exposed — the UNDO-FIFO floor pins it at ~1 GB regardless. An empty label falls back to the writer default ("hammer"). |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Produces a fresh, mountable single-volume HAMMER image from `inputs`. HAMMER's UNDO FIFO floor forces a volume size of ~1 GB minimum; see `HammerWriter`. Each input becomes an inode + directory-entry + data record in the global B-Tree. The DragonFly kernel mounts the image and reads every file's contents byte-exact (validated via `mount_hammer` + `cksum`, including multi-block files spanning the large- and small-data zones); the image also passes `hammer show` and `hammer checkmap`. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds — or replaces by name — files in an existing GEMDOS image. Delegates to `AddFiles` which re-packs the image with the existing files plus the new ones while preserving the 0x60 BRA.S jump byte. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file's bytes live in data records whose B-tree elements carry the offset they start at, so a move is the copy, that field, and the checksum over the node the element lives in — cheaper than reading every file out and writing a fresh volume, which is what the inherited default did for the one mode it offered. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
 | `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills everything the freemap leaves unallocated: free big-blocks outright, and the tail of a partly-used one past its append point. |
-
-#### `HammerReader`
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing GEMDOS image. Delegates to `RemoveFiles` which wipes all on-disk traces (data clusters, cluster-tip slack, directory entries, FAT chain entries) while preserving the 0x60 BRA.S jump byte. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
-Walks a HAMMER (DragonFly BSD, HAMMER1) volume's global B-Tree and yields the regular files it contains as `path -> bytes`. This is the read side of full file support: it parses the volume header, resolves zone offsets through the freemap (zone-4 two-layer blockmap), recursively descends the B-Tree from `vol0_btree_root`, and reassembles inodes, directory entries and data records into a directory tree. On-disk references (`sys/vfs/hammer/hammer_disk.h`):B-Tree node `hammer_node_ondisk`: `crc(4)@0`, `signature(4)@4`, `parent(8)@8`, `count(4)@16`, `type(1)@20`, then 63 elements of 64 bytes starting at @64.Element base `hammer_base_elm`: `obj_id(8)@0`, `key(8)@8`, `create_tid(8)@16`, `delete_tid(8)@24`, `rec_type(2)@32`, `obj_type(1)@34`, `btype(1)@35`, `localization(4)@36`.Internal element adds `subtree_offset(8)@40`; leaf element adds `create_ts(4)@40`, `delete_ts(4)@44`, `data_offset(8)@48`, `data_len(4)@56`, `data_crc(4)@60`.rec_type `INODE=0x0001`, `DATA=0x0010`, `DIRENTRY=0x0011`; obj_type `DIRECTORY=1`, `REGFILE=2`.Directory-entry data `hammer_direntry_data`: `obj_id(8)@0`, `localization(4)@8`, `reserved01(4)@12`, `name[]@16` (length = `data_len - 16`).Inode data `hammer_inode_data`: `obj_type(1)@64`, `size(8)@80`.
+#### `GemdosInPlaceModifier`
 
-Implements `IDisposable`.
+In-place modifier for Atari ST GEMDOS disk images. GEMDOS is FAT12 with a single byte difference at offset 0: the m68k `BRA.S` opcode `0x60` instead of the x86 `JMP` opcode `0xEB`. The on-disk FAT chains, root directory layout, dirent format and data-cluster region are byte-identical to plain FAT12. All mutation work is delegated to `FatRemover` (for `RemoveFiles`) and to a re-pack via `FatWriter` seeded from the existing files (for `AddFiles`). The single-byte jump signature is patched to `0xEB` before the FAT codepath runs and restored to `0x60` before the result is written back.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FreemapLayer1Offset` | `long FreemapLayer1Offset { get; }` | File offset of the freemap's layer-1 array. |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
-| `Valid` | `bool Valid { get; }` | True if the image carries a valid HAMMER volume header. |
-| `VolumeBufferStart` | `long VolumeBufferStart { get; }` | Where the volume's buffer area starts; zone-2 offsets are relative to it. |
-| `Dispose` | `void Dispose()` |  |
-| `EnumerateDataExtents` | `IReadOnlyList<DataExtent> EnumerateDataExtents()` | Where on disk each file's data records actually sit, along with the byte offset of the B-tree element that names each of them and of the node that element lives in. |
-| `Open` | `static HammerReader Open(Stream stream)` | Opens a HAMMER volume, pulling blocks on demand. Never throws on a malformed header; check `Valid`. |
-| `Open` | `static HammerReader Open(byte[] image)` | Opens a HAMMER image. Never throws on a malformed header; check `Valid`. |
-| `ReadFiles` | `IReadOnlyList<FileEntry> ReadFiles()` | Walks the B-Tree and returns every regular file with its full path relative to the filesystem root (e.g. `"sub/inner.txt"`). Directories are implied by the paths; empty directories are not returned (they carry no file payload). |
+| `AddFiles` | `static void AddFiles(Stream archive, IReadOnlyList<ValueTuple<string, byte[]>> inputs)` | Adds — or replaces by name — files in an existing GEMDOS image. The common case is a genuine in-place FAT edit via `FatModifier` (GEMDOS is byte-for-byte FAT12 below the jump byte, which FAT geometry parsing ignores) — existing files, clusters and the boot sector stay byte-identical. Structural cases (nested target, full root, no free clusters) fall back to a re-pack from the existing file list; the outer sector count is preserved. |
+| `RemoveFiles` | `static void RemoveFiles(Stream archive, IReadOnlyList<string> names)` | Removes the named entries from an existing GEMDOS image. All bytes of the entry's data clusters, cluster-tip slack, directory entry and FAT chain entries are zeroed via `FatRemover`. The 0x60 jump byte is preserved in the resulting image. |
 
-#### `HammerReader.DataExtent`
-
-One data record: its bytes, and where the B-tree records them.
+#### `GemdosOptimizer`
 
-Implements `IEquatable<DataExtent>`.
+Fileset-driven sector / cluster geometry picker for GEMDOS images. Returns the smallest BytesPerSector × SectorsPerCluster combination whose total slack waste is ≤ 5% of the total file payload, tiebreaking toward the bigger cluster (better FAT-table efficiency). The TotalSectors result is the smallest standard Atari size (360 KB / 720 KB / 1.44 MB / 2.88 MB) that fits all files plus reserved + FAT + root-directory overhead.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `DataExtent` | `DataExtent(string Path, long Offset, long Length, long ElementOffset, long NodeOffset)` | One data record: its bytes, and where the B-tree records them. |
-| `ElementOffset` | `long ElementOffset { get; init; }` |  |
-| `Length` | `long Length { get; init; }` |  |
-| `NodeOffset` | `long NodeOffset { get; init; }` |  |
-| `Offset` | `long Offset { get; init; }` |  |
-| `Path` | `string Path { get; init; }` |  |
+| `Find` | `static GemdosGeometry Find(IReadOnlyList<long> fileSizes)` | Picks the smallest GEMDOS geometry whose total slack waste is ≤ 5% of the total file payload, tiebreaking toward bigger clusters. Always returns 512-byte sectors because all Atari TOS releases support 512 B/sector and it's the most compatible across emulators and real hardware. |
 
-#### `HammerReader.FileEntry`
+#### `GemdosOptimizer.GemdosGeometry`
 
-A regular file recovered from the B-Tree: full POSIX path and exact bytes.
+Result of a geometry pick. Pass these straight into `Build`.
 
-Implements `IEquatable<FileEntry>`.
+Implements `IEquatable<GemdosGeometry>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FileEntry` | `FileEntry(string Path, byte[] Content)` | A regular file recovered from the B-Tree: full POSIX path and exact bytes. |
-| `Content` | `byte[] Content { get; init; }` |  |
-| `Path` | `string Path { get; init; }` |  |
+| `GemdosGeometry` | `GemdosGeometry(int BytesPerSector, int SectorsPerCluster, int TotalSectors, int RootEntries)` | Result of a geometry pick. Pass these straight into `Build`. |
+| `BytesPerSector` | `int BytesPerSector { get; init; }` |  |
+| `RootEntries` | `int RootEntries { get; init; }` |  |
+| `SectorsPerCluster` | `int SectorsPerCluster { get; init; }` |  |
+| `TotalSectors` | `int TotalSectors { get; init; }` |  |
 
-#### `HammerVolumeOndisk`
+#### `GemdosReader`
 
-Parses the HAMMER (DragonFly BSD original) volume header at byte offset 0 of each volume. Read-only; we never walk the B-tree, only surface the header fields and the `vol0_blockmap` array's byte slice. Layout per `sys/vfs/hammer/hammer_disk.h`: Verified by: `https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/vfs/hammer/hammer_disk.h` — `HAMMER_FSBUF_VOLUME` + struct definitionDragonFly Wiki `https://www.dragonflybsd.org/hammer/`
+Reads GEMDOS (Atari ST FAT12) images. The on-disk layout is exactly FAT12 except for the jump byte at offset 0 (0x60 BRA.S vs MS-DOS's 0xEB). This reader patches the jump byte to 0xEB in an in-memory copy and then defers to `FatReader` for all parsing — same FAT chains, same root directory, same 8.3 dirent layout.
+
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HammerVolumeOndisk` | `HammerVolumeOndisk()` |  |
-| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Header capture size we surface as `volume_header.bin` (1898 bytes covers the static fields). |
-| `MagicBytesLE` | `static readonly byte[] MagicBytesLE` | First 8 bytes at offset 0, in disk order (LE serialisation of `VolumeSignature`). |
-| `VolumeSignature` | `const ulong VolumeSignature` | HAMMER volume magic: `0xC8414D4DC5523031` ("HAMMER01" — first byte '1' = 0x31 because the 64-bit constant lives little-endian on disk). |
-| `HeaderRaw` | `byte[] HeaderRaw { get; }` |  |
-| `Valid` | `bool Valid { get; }` | True iff `VolumeSignature` matched at offset 0. |
-| `Vol0BtreeRoot` | `long Vol0BtreeRoot { get; }` |  |
-| `Vol0NextTid` | `long Vol0NextTid { get; }` |  |
-| `Vol0StatBigblocks` | `long Vol0StatBigblocks { get; }` |  |
-| `Vol0StatFreeBigblocks` | `long Vol0StatFreeBigblocks { get; }` |  |
-| `Vol0StatInodes` | `long Vol0StatInodes { get; }` |  |
-| `VolBotBeg` | `long VolBotBeg { get; }` |  |
-| `VolBufBeg` | `long VolBufBeg { get; }` |  |
-| `VolBufEnd` | `long VolBufEnd { get; }` |  |
-| `VolCount` | `int VolCount { get; }` |  |
-| `VolCrc` | `uint VolCrc { get; }` |  |
-| `VolFlags` | `uint VolFlags { get; }` |  |
-| `VolFsTypeHex` | `string VolFsTypeHex { get; }` |  |
-| `VolFsidHex` | `string VolFsidHex { get; }` |  |
-| `VolLabel` | `string VolLabel { get; }` |  |
-| `VolMemBeg` | `long VolMemBeg { get; }` |  |
-| `VolNo` | `int VolNo { get; }` |  |
-| `VolRootVol` | `uint VolRootVol { get; }` |  |
-| `VolSignature` | `ulong VolSignature { get; }` |  |
-| `VolVersion` | `uint VolVersion { get; }` |  |
-| `TryParse` | `static HammerVolumeOndisk TryParse(ReadOnlySpan<byte> image)` | Best-effort parse. Never throws. |
+| `GemdosReader` | `GemdosReader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<FatEntry> Entries { get; }` | All entries (files + directories) in the volume, recursively. |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(FatEntry entry)` | Reads the bytes of a file entry. |
 
-#### `HammerWriter`
+#### `GemdosWriter`
 
-Writes a single-volume HAMMER (DragonFly BSD, HAMMER1) filesystem image that DragonFly recognises and mounts. The output is a faithful port of `newfs_hammer(8)` (`sbin/newfs_hammer/newfs_hammer.c`) together with the on-disk helpers in `sbin/hammer/ondisk.c` and `sbin/hammer/blockmap.c`: it lays down the volume header, the freemap (zone-4 two-layer blockmap), the UNDO/REDO FIFO (zone-3), and a minimal root B-Tree (zone-8) holding the root directory's inode and PFS#0 records. Geometry mirrors newfs exactly: the volume is split into a 256 KB header junk area (`vol_bot_beg`), a boot area, a memory log, then the zone-2 buffer area. Every metadata block carries the version-gated CRC (see `HammerCrc`).HAMMER's UNDO FIFO has a hard minimum of `HAMMER_MIN_UNDO_BIGBLOCKS (64) * HAMMER_BIGBLOCK_SIZE (8 MB) = 512 MB`, so the smallest volume that `newfs_hammer`/this writer can format is on the order of ~1 GB. The output stream is grown to that size (sparse on filesystems that support holes).Files passed to `AddFile` are materialised as real records readable by the DragonFly kernel: each gets a regular-file inode record, a directory-entry record under the root directory (keyed by the ALG1 directory namehash) and one or more zone-11 small-data records (payload split into 16 KB blocks, each rounded up to a power-of-two block). All records, plus the root inode and PFS#0 record, live in a single sorted leaf B-Tree node — which caps the image at `HAMMER_BTREE_LEAF_ELMS (63)` elements (~20 files). Files are placed flat in the root directory (no sub-directory nesting).
+Builds Atari ST GEMDOS disk images by delegating to `FatWriter` (which emits a spec-compliant FAT12 BPB) and then patching the jump byte at offset 0 from MS-DOS's `0xEB` (x86 `JMP`) to Atari's `0x60` (m68k `BRA.S`). All other BPB fields use the FAT spec layout. The result is a byte-identical GEMDOS volume: same boot-sector size, same FAT chains, same root directory, same data-cluster layout.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HammerWriter` | `HammerWriter()` |  |
-| `Label` | `string Label { get; set; }` | Filesystem label (max 63 chars, ASCII). Mirrors `newfs_hammer -L`. |
-| `VolumeSize` | `long VolumeSize { get; set; }` | Total volume size in bytes. Forced up to the HAMMER minimum (~1 GB) so the UNDO FIFO and freemap fit. Aligned down to `HAMMER_BUFSIZE` internally. |
-| `AddFile` | `void AddFile(string name, byte[] content)` | Adds a regular file to the root directory. The payload is materialised as a kernel-readable inode + directory entry + small-data records when the image is written. |
-| `ComputeAutoSize` | `long ComputeAutoSize()` | Smallest volume that holds the added files: the ~1 GB the UNDO FIFO and freemap need, plus the payload and its B-Tree, rounded to a big-block. |
-| `WriteTo` | `void WriteTo(Stream output)` | Formats the HAMMER volume and writes it to `output`. |
+| `GemdosWriter` | `GemdosWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data, DateTime? modTime = null)` | Adds a file to the GEMDOS image. Paths may use '/' or '\' separators for subdirectories; the underlying FAT writer builds the directory tree. |
+| `Build` | `byte[] Build(int totalSectors = 1440, int bytesPerSector = 512, int sectorsPerCluster = 2, int rootEntries = 112, string volumeLabel = null)` | Builds the GEMDOS image. GEMDOS volumes are FAT12 with the m68k BRA.S jump byte (0x60) — we force FAT12 to match the on-disk format and patch the jump. Standard sizes: 360 KB (DD SS), 720 KB (DD DS), 1.44 MB (HD DS) — all classic Atari ST floppy formats. Hard-disk GEMDOS partitions are not yet supported because they need the AHDI partition table (out of scope). |
 
-### Namespace `FileSystem.Hammer2`
+### Namespace `FileSystem.Gfs1`
 
-[`Hammer2BlockMover`](#hammer2blockmover) · [`Hammer2FormatDescriptor`](#hammer2formatdescriptor) · [`Hammer2Reader`](#hammer2reader) · [`Hammer2Reader.FileRef`](#hammer2readerfileref) · [`Hammer2VolumeData`](#hammer2volumedata) · [`Hammer2Writer`](#hammer2writer)
+[`Gfs1BlockMover`](#gfs1blockmover) · [`Gfs1Entry`](#gfs1entry) · [`Gfs1FormatDescriptor`](#gfs1formatdescriptor) · [`Gfs1OptimalParameters`](#gfs1optimalparameters) · [`Gfs1Optimizer`](#gfs1optimizer) · [`Gfs1Reader`](#gfs1reader) · [`Gfs1Writer`](#gfs1writer)
 
-#### `Hammer2BlockMover`
+#### `Gfs1BlockMover`
 
-Moves a file's blocks inside a HAMMER2 volume, repoints the blockref that named each, and takes the chain of checks above it again.
+Moves a file's blocks inside a GFS1 volume and repoints its inode.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Hammer2BlockMover` | `Hammer2BlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | The largest block any file uses. A blockref names its block with a radix, so a destination has to be aligned to the block it holds. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file's block may occupy: past the volume headers. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the blockref naming the block it is given, so a file in several blocks is simply several calls. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A block may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the blockref tree once and notes the chain above each block. |
+| `Gfs1BlockMover` | `Gfs1BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. |
+| `Init` | `void Init(Stream image)` | Notes where file data may start, past the inode table. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `SettleVolumeHeaders` | `void SettleVolumeHeaders(Stream image)` | Stamps the volume headers again, which carry CRCs over their own sectors. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `Hammer2FormatDescriptor`
+#### `Gfs1Entry`
 
-Read-only descriptor for HAMMER2 (DragonFly BSD newer) filesystem images. Surfaces the volume-data sector at offset 0 plus a structured metadata bundle and the raw image. Walking the HAMMER2 cluster B-tree (radix-tree chains, blockrefs, indirect blocks) is explicitly out of scope (multi-week effort). Magic: 8-byte uint64 at offset 0 = `HAMMER2_VOLUME_ID_HBO` (`0x48414d3205172011`) or `HAMMER2_VOLUME_ID_ABO` (`0x11201705324d4148`). The descriptor's `MagicSignatures` list covers the HBO form (LE serialisation: `11 20 17 05 32 4D 41 48`); the ABO form is recognised by the parser but is rare in practice (only arises when a HAMMER2 image is cross-mounted on opposite-endian hardware). Confidence 0.85: an 8-byte magic at offset 0 is high-confidence but the detector does no secondary sanity check (e.g. volume size plausibility, fstype UUID match). References: `https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/vfs/hammer2/hammer2_disk.h``https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/sys/vfs/hammer2/DESIGN`
+One entry surfaced by `Gfs1Reader`.
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`.
+Implements `IEquatable<Gfs1Entry>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Hammer2FormatDescriptor` | `Hammer2FormatDescriptor()` |  |
+| `Gfs1Entry` | `Gfs1Entry(string Name, int Inode, bool IsDirectory, long Size, int FirstBlock)` | One entry surfaced by `Gfs1Reader`. |
+| `FirstBlock` | `int FirstBlock { get; init; }` |  |
+| `Inode` | `int Inode { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `Gfs1FormatDescriptor`
+
+Sistina/Red Hat GFS (pre-GFS2) format descriptor. WORM writer + reader with real nested subdirectories, defrag/purge/conversion, fileset optimizer, and an options schema (BlockSize / JournalCount / LockProto / LockTable). References: `https://sourceforge.net/projects/opengfs/` — OpenGFS, the open continuation of Sistina GFS whose headers define the GFS1 on-disk structures`https://en.wikipedia.org/wiki/Global_File_System_2` — Wikipedia article covering GFS history and its GFS2 successor
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Gfs1FormatDescriptor` | `Gfs1FormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -5104,361 +6506,320 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the HAMMER2 writer honours: the PFS label (`newfs_hammer2 -L`) given to the populated PFS that holds the user files. Volume size is intentionally not exposed — the boot/aux/topology floor pins the minimum regardless. An empty label falls back to the writer default ("DATA"). |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Genuine in-place (copy-on-write) add/replace of files in the labelled PFS root: new file inodes + data blocks and the rebuilt labelled-PFS → super-root → volume-header chain are appended past the topology high-water, leaving every existing file's data byte-identical at its original offset. Falls back to the verified rebuild path when the change can't be expressed as a single inline/one-indirect blockset (nested-indirect roots, nested paths). See `Hammer2InPlaceModifier`. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Produces a fresh, mountable single-volume HAMMER2 image from `inputs`. The output mirrors `newfs_hammer2`: a volume header, the super-root inode, and the "LOCAL" + labelled PFS inodes. The labelled PFS root is populated with the input files — each a regular-file inode plus a directory entry (see `Hammer2Writer`). The DragonFly kernel mounts the labelled PFS and reads every file's contents byte-exact (validated via `mount_hammer2 …@<label>` + `cksum`, including directories large enough to spill into a blockref-indirect block and files stored in an out-of-line data block). |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again by moving what is out of place. A blockref names its block by a device offset, and the check beside it covers bytes a move does not change — so the move is that one field plus the chain of checks above it, up to the volume headers' own CRCs. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Where the volume keeps its bytes: the volume headers, the inodes and the indirect blocks as structure, and each file's data blocks under its name. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Rewrites the volume with every file laid out contiguously from the start. The rebuild goes through scratch files rather than a byte[] image, so a volume larger than an array can hold still defragments. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Genuine in-place (copy-on-write) removal of files from the labelled PFS root, rebuilding the chain above without disturbing surviving files' data. Falls back to the verified rebuild path when out of scope. |
-
-#### `Hammer2Reader`
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
-Walks a HAMMER2 (DragonFly BSD) filesystem image and extracts the regular files living in its PFS roots. The walk mirrors the kernel's on-disk topology (`sys/vfs/hammer2/hammer2_disk.h`): pick the volume header (one of four 64 KB slots) with the highest valid `mirror_tid`;follow `sroot_blockset[0]` to the super-root inode, then each PFS-MASTER inode it references;walk each PFS root's blockset — descending through `HAMMER2_BREF_TYPE_INDIRECT` blocks — to gather the `HAMMER2_BREF_TYPE_DIRENT` entries (names + child inode numbers) and the child `HAMMER2_BREF_TYPE_INODE` entries (keyed by inode number); read each regular file's bytes from the inode's embedded direct data (`HAMMER2_OPFLAG_DIRECTDATA`) or its `HAMMER2_BREF_TYPE_DATA` blocks.Directories are recursed so nested files surface under a `parent/child` path. Data stored with a compression method other than `HAMMER2_COMP_NONE` (e.g. the kernel's default LZ4) is surfaced raw and flagged via `HasCompressedData` — decompression is out of scope.
+#### `Gfs1OptimalParameters`
 
-Implements `IDisposable`.
+Optimal GFS1 layout as picked by `Find`.
+
+Implements `IEquatable<Gfs1OptimalParameters>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Hammer2Reader` | `Hammer2Reader(Stream image)` | Creates a reader over a HAMMER2 volume, pulling blocks on demand. The blockref tree is a few megabytes however large the payload area behind it. |
-| `Hammer2Reader` | `Hammer2Reader(byte[] image)` | Creates a reader over the full HAMMER2 image bytes. |
-| `HasCompressedData` | `bool HasCompressedData { get; }` | True iff any extracted file's data used a compression method other than `HAMMER2_COMP_NONE` (surfaced raw). |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
-| `Valid` | `bool Valid { get; }` | True iff a valid HAMMER2 volume header was found. |
-| `Dispose` | `void Dispose()` |  |
-| `EnumerateFiles` | `List<FileRef> EnumerateFiles()` | Surfaces every regular file in every PFS root, keyed by its path (`name` at the root, `dir/name` for nested files). Never throws — yields whatever it could parse. Contents are pulled separately through `ExtractTo`, so a listing costs nothing but the tree walk. |
-| `ExtractTo` | `long ExtractTo(FileRef file, Stream destination)` | Writes `file`'s contents into `destination`, one data block at a time. Returns the number of bytes written. |
-| `ReadAllFiles` | `Dictionary<string, byte[]> ReadAllFiles()` | Reads every regular file in every PFS root, keyed by its path (`name` at the root, `dir/name` for nested files). Never throws — returns whatever it could parse. |
-
-#### `Hammer2Reader.FileRef`
+| `Gfs1OptimalParameters` | `Gfs1OptimalParameters(int BlockSize, int JournalCount, long EstimatedImageBytes)` | Optimal GFS1 layout as picked by `Find`. |
+| `BlockSize` | `int BlockSize { get; init; }` |  |
+| `EstimatedImageBytes` | `long EstimatedImageBytes { get; init; }` |  |
+| `JournalCount` | `int JournalCount { get; init; }` |  |
 
-A regular file the reader surfaced, with the inode needed to read it back.
+#### `Gfs1Optimizer`
 
-Implements `IEquatable<FileRef>`.
+Fileset-driven optimizer for GFS1. The block size is fixed at 4096 (per Sistina GFS spec — all metadata I/O is page-sized). The optimizer trades journal count: bigger filesets → more journals (each journal is ~128 MB so this materially impacts image size); empty filesets get a single journal.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FileRef` | `FileRef(string Path, long Size, byte[] Inode)` | A regular file the reader surfaced, with the inode needed to read it back. |
-| `Inode` | `byte[] Inode { get; init; }` |  |
-| `Path` | `string Path { get; init; }` |  |
-| `Size` | `long Size { get; init; }` |  |
+| `Find` | `static Gfs1OptimalParameters Find(IReadOnlyList<long> fileSizes)` |  |
 
-#### `Hammer2VolumeData`
+#### `Gfs1Reader`
 
-Parses the HAMMER2 (DragonFly BSD newer) volume header at byte offset 0. HAMMER2 keeps four redundant 64 KB volume-data sectors at offsets 0, 65536, 131072, 196608 (per `HAMMER2_VOLUME_BYTES = 65536`) — we only look at the first one. Read-only; we never walk the cluster B-tree. Layout per `sys/vfs/hammer2/hammer2_disk.h`: Verified by: `https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/vfs/hammer2/hammer2_disk.h``https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/sys/vfs/hammer2/DESIGN`
+Read-side companion to `Gfs1Writer`. Walks the superblock at byte offset 65536, the inode table immediately following it, and every directory body, surfacing files at full nested paths.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Hammer2VolumeData` | `Hammer2VolumeData()` |  |
-| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Header capture size we surface as `volume_header.bin` — first sector (512 B). |
-| `MagicBytesHboLE` | `static readonly byte[] MagicBytesHboLE` | First 8 bytes at offset 0 in disk order — the LE serialisation of `VolumeIdHbo`. |
-| `VolumeBytes` | `const int VolumeBytes` | Volume-data sector stride (4 redundant sectors at multiples of this). |
-| `VolumeIdAbo` | `const ulong VolumeIdAbo` | Alternate-byte-order magic (volume written by an opposite-endian system). |
-| `VolumeIdHbo` | `const ulong VolumeIdHbo` | Host-byte-order magic. |
-| `AuxBeg` | `long AuxBeg { get; }` |  |
-| `AuxEnd` | `long AuxEnd { get; }` |  |
-| `BootBeg` | `long BootBeg { get; }` |  |
-| `BootEnd` | `long BootEnd { get; }` |  |
-| `ByteSwapped` | `bool ByteSwapped { get; }` | True iff the magic matched the alternate (byte-swapped) form. |
-| `CopyId` | `byte CopyId { get; }` |  |
-| `Flags` | `uint Flags { get; }` |  |
-| `FreemapVersion` | `byte FreemapVersion { get; }` |  |
-| `FsTypeHex` | `string FsTypeHex { get; }` |  |
-| `FsidHex` | `string FsidHex { get; }` |  |
-| `HeaderRaw` | `byte[] HeaderRaw { get; }` |  |
-| `Magic` | `ulong Magic { get; }` | Raw 8-byte magic value (always little-endian read). |
-| `NVolumes` | `byte NVolumes { get; }` |  |
-| `PeerType` | `byte PeerType { get; }` |  |
-| `Valid` | `bool Valid { get; }` | True iff the magic at offset 0 matched either HBO or ABO. |
-| `Version` | `uint Version { get; }` |  |
-| `VoluId` | `byte VoluId { get; }` |  |
-| `VoluSize` | `long VoluSize { get; }` |  |
-| `TryParse` | `static Hammer2VolumeData TryParse(ReadOnlySpan<byte> image)` | Best-effort parse. Never throws. |
+| `Gfs1Reader` | `Gfs1Reader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<Gfs1Entry> Entries { get; }` |  |
+| `ExtractTo` | `long ExtractTo(Gfs1Entry entry, Stream destination)` | Writes `entry`'s bytes into `destination`. |
+| `Extract` | `byte[] Extract(Gfs1Entry entry)` |  |
 
-#### `Hammer2Writer`
+#### `Gfs1Writer`
 
-Writes a single-volume HAMMER2 (DragonFly BSD) filesystem image that DragonFly recognises and mounts. The output is a faithful port of what `newfs_hammer2(8)` (`sbin/newfs_hammer2` together with the on-disk helpers in `sbin/hammer2/cmd_setcomp.c` and the kernel's `sys/vfs/hammer2/hammer2_disk.h`) lays down for a fresh, empty filesystem: the volume header (`struct hammer2_volume_data`) at byte offset 0 — magic, version, the boot/aux geometry, the allocator accounting, and the super-root blockset, each 512-byte sector protected by an iCRC and the whole 64 KB header by `icrc_volheader`;the super-root inode (`HAMMER2_PFSTYPE_SUPROOT`) whose embedded blockset references one or more PFS inodes;two PFS inodes — the default `"LOCAL"` plus the labelled PFS (e.g. `"DATA"`) — each a master with an empty root directory.The on-disk topology mirrors `newfs_hammer2` exactly: the volume header lives in the first of four redundant 64 KB slots (only slot #0 is populated by newfs, the kernel rolls the others forward on the first sync), the boot area starts at 4 MB, the aux area at 12 MB, and the reserved topology area (where the inodes live) begins at 20 MB (`allocator_beg`). HAMMER2 builds its freemap lazily, so a freshly formatted volume carries no freemap blocks at all — exactly what `newfs_hammer2` writes.Files passed to `AddFile` are materialised in the labelled PFS root exactly the way the DragonFly kernel lays them down: each file gets a regular-file inode (`HAMMER2_OBJTYPE_REGFILE`) keyed in the root blockset by its inode number, plus a `HAMMER2_BREF_TYPE_DIRENT` blockref keyed by `hammer2_dirhash(name)` carrying the filename inline. Payloads up to 512 bytes are embedded directly in the inode's union (`HAMMER2_OPFLAG_DIRECTDATA`); larger payloads are written to an allocated `HAMMER2_BREF_TYPE_DATA` block sized to the next power-of-two logical buffer. When the root's four embedded blockrefs overflow they spill into a `HAMMER2_BREF_TYPE_INDIRECT` block. All data blocks are stored uncompressed (`HAMMER2_COMP_NONE`) and protected by an xxHash64 check.
+Minimal but spec-keyed writer for Sistina GFS (the pre-GFS2 distributed filesystem). Emits a real `MhMagicConst`-tagged metaheader superblock at byte offset 65536 with the GFS-specific `sb_multihost_format = 1900`, followed by a packed inode + data area in subsequent 4 KB blocks. Directories are stored as 16-byte entry blocks for round-trip simplicity (kernel GFS1 used full ondir entries — out of WORM scope). Scope. Real GFS1 maintains a journal per cluster node, a distributed lock table (DLM), a resource group bitmap chain, and a hashed-leaf-block directory layout. The WORM writer skips the journal area + lock proto fields beyond the spec-anchored handle in the SB, and emits a non-hashed single-block directory body.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Hammer2Writer` | `Hammer2Writer()` |  |
-| `Label` | `string Label { get; set; }` | Filesystem PFS label (max 63 chars). Mirrors `newfs_hammer2 -L`. |
-| `VolumeSize` | `long VolumeSize { get; set; }` | Total volume size in bytes. Forced up to the HAMMER2 minimum so the boot, aux and topology-reserved areas fit, and aligned down to the 8 MB volume alignment internally. |
-| `AddFile` | `void AddFile(string name, byte[] content)` | Records a regular file to materialise in the labelled PFS root: an inode holding the content (embedded when ≤512 bytes, otherwise in an allocated data block) plus a directory entry carrying `name`. |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Records a regular file whose bytes are pulled from `openStream` as the volume is written. Only the length is needed to lay out the blockrefs, so the file never has to be resident. |
-| `WriteTo` | `void WriteTo(Stream output)` | Formats the HAMMER2 volume and writes it to `output`. |
+| `Gfs1Writer` | `Gfs1Writer()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the layout is settled from it before a byte is read. |
+| `Build` | `byte[] Build()` | Materialises the whole volume. |
+| `SetJournalCount` | `void SetJournalCount(int n)` |  |
+| `SetLockProto` | `void SetLockProto(string s)` |  |
+| `SetLockTable` | `void SetLockTable(string s)` |  |
+| `SetVolumeLabel` | `void SetVolumeLabel(string s)` |  |
+| `WriteTo` | `void WriteTo(Stream output)` | Writes the volume into `output`: the blocks the filesystem populates, then each file's bytes at the offset it was allocated. Only a non-seekable target has to materialise the volume. |
 
-### Namespace `FileSystem.Hfs`
+### Namespace `FileSystem.Gfs2`
 
-[`HfsBlockMover`](#hfsblockmover) · [`HfsEntry`](#hfsentry) · [`HfsExtentMap`](#hfsextentmap) · [`HfsFormatDescriptor`](#hfsformatdescriptor) · [`HfsModifier`](#hfsmodifier) · [`HfsReader`](#hfsreader) · [`HfsWriter`](#hfswriter)
+[`Gfs2BlockMover`](#gfs2blockmover) · [`Gfs2Entry`](#gfs2entry) · [`Gfs2ExtentMap`](#gfs2extentmap) · [`Gfs2FormatDescriptor`](#gfs2formatdescriptor) · [`Gfs2Reader`](#gfs2reader) · [`Gfs2Writer`](#gfs2writer)
 
-#### `HfsBlockMover`
+#### `Gfs2BlockMover`
 
-Moves a file's allocation blocks inside a classic HFS volume and repoints the extent descriptor that named them, so the file reads the same from its new home.
+Moves a file's blocks inside a GFS2 volume, repoints the tree pointers that name them, and moves the allocation with them.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HfsBlockMover` | `HfsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | An allocation block, as the master directory block sizes it. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the boot blocks, the MDB and the bitmap. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the descriptor naming the run it is given and leaves the fork's other descriptors alone, so an owner in several runs is simply several calls. |
+| `Gfs2BlockMover` | `Gfs2BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the structures and the group bitmaps. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
 | `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the master directory block and locates bitmap and catalog. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and walks the resource groups. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `SettleAllocationBitmap` | `void SettleAllocationBitmap(Stream image, IEnumerable<ValueTuple<long, long>> live)` | Writes the volume bitmap from the runs the volume actually holds. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` |  |
 
-#### `HfsEntry`
+#### `Gfs2Entry`
+
+One entry in a GFS2 image. Read-only: we surface the superblock, root/master directory inode pointers, and (optionally) any directory entries we manage to walk from the root inode's leaf blocks.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HfsEntry` | `HfsEntry()` |  |
+| `Gfs2Entry` | `Gfs2Entry()` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
 | `LastModified` | `DateTime? LastModified { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `HfsExtentMap`
+#### `Gfs2ExtentMap`
 
-Walks a classic HFS image and yields the actual on-disk byte layout — the boot blocks (sectors 0-1) + MDB (sector 2) + alternate MDB + volume bitmap + catalog file as `MetadataReserved`, every file record's data-fork extent as `Used`. The reader only walks the first leaf chain via fLink so coverage matches what the reader can extract.
+Reads a GFS2 volume's resource-group bitmaps and reports which blocks are in use. GFS2 accounts for allocation two bits per block: 00 is free, and every other state (data, unlinked, dinode) means the block is live. What the bitmaps leave clear is exactly the free space — including the blocks a removed file used to occupy, which still hold its bytes.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `HfsFormatDescriptor`
+#### `Gfs2FormatDescriptor`
 
-References: "Inside Macintosh: Files" (Apple Computer, 1992), chapter "Data Organization on Volumes" — the canonical HFS on-disk specification (MDB, catalog/extents B*-trees)`https://www.mars.org/home/rob/proj/hfs/` — hfsutils (Robert Leslie), the classic open-source HFS implementation`https://en.wikipedia.org/wiki/Hierarchical_File_System` — Wikipedia overview
+GFS2 (Global File System 2) descriptor — Red Hat's cluster filesystem, mainline Linux since 2.6.19. We parse the superblock at offset 65536, surface block size + lock proto/table + UUID + master/root inode pointers, and walk the root inode's inline directory entries (single-leaf, di_height==0). For regular files with inline data (height==0) we extract the bytes. On-disk layout reverse-validated against real `mkfs.gfs2` output (gfs2-utils 3.5.1): the `gfs2_meta_header` is 24 bytes, the sb carries a reserved `__pad2` inum between master and root, and the `gfs2_dirent` header is 40 bytes. See `Gfs2ExternalConformanceTests` for the mkfs.gfs2 / fsck.gfs2 gate. Creation (`Create`, `Gfs2Writer`) emits a fresh, empty standalone (lock_nolock, single-journal) volume — superblock, the fixed first resource group plus a second data resource group with a correct (multi-block) allocation bitmap, the master directory and its system inodes (jindex, per_node, inum, statfs, rindex, quota), a formatted 8 MB journal of clean unmount log headers, and the root directory — all sized so real `fsck.gfs2 -n` passes clean (exit 0). Supported size range 16–256 MB (single data resource group); the volume is empty, since populating it with files is out of scope. Out of scope (multi-week effort each): writing files/directories, ExHash multi-leaf directories, multi-level block indirection (di_height > 0), devices > 256 MB (which gfs2-utils splits into several evenly-spaced resource groups), journal replay, cluster lock manager state, extended attributes. Magic: `mh_magic = 0x01161970` (BE u32) at the start of the superblock meta header. On disk at byte offset 65536 this serialises as `01 16 19 70`. Confidence 0.85 — well-known constant at a fixed offset, but GFS2 shares this magic with GFS1 at slightly different layouts, so we keep a small margin below the 0.9-0.95 reserved for formats with a structurally unique header. References: Linux kernel `fs/gfs2/` — `include/uapi/linux/gfs2_ondisk.h`Red Hat Cluster Suite / Resilient Storage Add-On documentation
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HfsFormatDescriptor` | `HfsFormatDescriptor()` |  |
+| `Gfs2FormatDescriptor` | `Gfs2FormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
 | `DefaultExtension` | `string DefaultExtension { get; }` |  |
-| `Description` | `string Description { get; }` | Classic Macintosh HFS filesystem image (pre-HFS+). Writer emits a spec-compliant MDB, volume bitmap, and real extents + catalog B-trees with thread records, file records, and a root-dir record — matching Inside Macintosh: Files (1992). Scope: flat root directory, ASCII filenames, ≤ ~30 files per image (single-leaf catalog). |
+| `Description` | `string Description { get; }` |  |
 | `DisplayName` | `string DisplayName { get; }` |  |
 | `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for Classic HFS creation. The Master Directory Block stores a Pascal-string volume name at `drVN` (offset 36, max 27 bytes) — the classic Mac Finder surfaces this as the disk's name. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Knobs the empty-volume writer honours. `ImageSize` drives the writer's total size (clamped to the single-data-resource-group range 16–256 MB); `LockTable` is written into `sb_locktable` and read back as `Gfs2Reader.LockTable`. The 4 KB block size and the `lock_nolock` protocol are fixed by the standalone layout. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Hfs image via `AddFile`. The modifier mutates the catalog leaf, volume bitmap, MDB, and alternate MDB in place; on leaf overflow it transparently falls back to a writer-driven rebuild so the call always succeeds. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh, empty standalone (lock_nolock, single-journal) GFS2 volume that real `fsck.gfs2` accepts clean. The volume size defaults to 32 MB and may be overridden with the `size` format option (bytes, clamped to 16–256 MB; `K`/`M` suffixes accepted). |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware HFS defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. The writer always emits a contiguous, start-packed allocation block layout, so all four `DefragMode` values converge on a clean repack. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the HFS catalog B-tree leaf chain and yields the actual on-disk byte layout — boot blocks + MDB + volume bitmap + catalog file as `MetadataReserved`, every file record's data-fork extent (filExtRec[0]) as `Used`. Coverage matches what `HfsReader` can extract — first leaf chain only, single data-fork extent per file. |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Rewrites the volume with every file laid out contiguously from the start of the data area. Each entry is spilled to scratch and the writer pulls it back while laying out the metadata tree, so the rebuild is not bounded by what a byte[] can hold. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing Hfs image via `RemoveFile`. File data blocks are wiped and catalog records are excised from the leaf; missing names are silently ignored. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the HFS image: free allocation blocks, gaps between files and the block-tip slack between a file's logical size and the end of its last allocated 512-byte block. The catalog extent map clamps each file's run to its logical byte length, so trailing slack inside the final block presents as a free gap that the generic `UnusedSpaceWiper` zero-fills. The HFS extent map keys each `FileName` by the catalog leaf name, whereas `HfsReader` reports the full slash-separated path; the size lookup is therefore keyed by the leaf segment so the explicit cluster-tip pass matches. |
-
-#### `HfsModifier`
-
-In-place HFS classic modifier — performs random-access mutation of an existing HFS image without rebuilding the entire filesystem. Tuned for the single-leaf catalog shape that `HfsWriter` emits for the common case (≤ ~30 files per image, no index node required). When an Add would overflow the single 512-byte leaf, falls back to a writer-driven rebuild transparently so the call always succeeds. What we touch on a small Add (single-leaf path):The MDB at offset 1024 — drNmFls, drFilCnt, drFreeBks, drNxtCNID, drAllocPtr, drLsMod.The alternate MDB at `(totalSectors - 2) × 512` (mirror).The volume bitmap starting at `drVBMSt × 512`.The catalog leaf node (allocation block 2 in the writer's layout).The newly-allocated allocation blocks for the file payload.
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every block the resource-group bitmaps report as free — which is where a removed file's bytes stay until something else claims them. |
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds (or replaces by name) a file. If the catalog leaf cannot fit the new records, falls back to a writer-driven rebuild so the call always succeeds. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file. Returns true if it was present and removed, false if no such entry exists. |
+#### `Gfs2Reader`
 
-#### `HfsReader`
+Read-only GFS2 (Global File System 2) image walker. Mainline Linux since 2.6.19; Red Hat cluster filesystem. Big-endian on-disk. What we parse: Superblock at byte offset 65536 (= sector 128 × 512 B). Magic `mh_magic = 0x01161970` at the start of the gfs2_meta_header.Block size from `sb_bsize`, root + master inum from `sb_root_dir` / `sb_master_dir`.Root inode (`gfs2_dinode`) and any `gfs2_dirent` records living inline in the inode block (single-leaf directories). What we deliberately skip (multi-week effort each): ExHash directories (multi-level leaf blocks)Multi-level block indirection (di_height > 0)Journal recovery, cluster lock manager stateExtended attributes References: Linux kernel `fs/gfs2/` — primary on-disk definition`include/uapi/linux/gfs2_ondisk.h` — magic constants & struct layoutRed Hat Cluster Suite / Resilient Storage Add-On docs
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HfsReader` | `HfsReader(Stream stream, bool leaveOpen = false)` |  |
-| `Entries` | `IReadOnlyList<HfsEntry> Entries { get; }` |  |
+| `Gfs2Reader` | `Gfs2Reader(Stream stream)` |  |
+| `FormatFs` | `const uint FormatFs` | Filesystem format version expected in sb_fs_format (GFS2_FORMAT_FS). |
+| `FormatMultihost` | `const uint FormatMultihost` | Multi-host format version expected in sb_multihost_format (GFS2_FORMAT_MULTI). |
+| `MetaHeaderSize` | `const int MetaHeaderSize` | Size of `struct gfs2_meta_header` on disk: 24 bytes — `mh_magic`(4) + `mh_type`(4) + `__pad0`(8) + `mh_format`(4) + `mh_jid`(4). Real `mkfs.gfs2` output uses the 24-byte header; every metadata struct (sb, dinode, leaf, rgrp, log header) embeds it at offset 0. |
+| `MetaMagic` | `const uint MetaMagic` | GFS2 metadata magic — `mh_magic` at start of every metadata block. |
+| `MetaTypeDinode` | `const uint MetaTypeDinode` | gfs2_meta_header.mh_type for a dinode. |
+| `MetaTypeSuperblock` | `const uint MetaTypeSuperblock` | gfs2_meta_header.mh_type for the superblock. |
+| `SbByteOffset` | `const long SbByteOffset` | Superblock byte offset within the device (sector 128 × 512 B). |
+| `BlockSizeShift` | `uint BlockSizeShift { get; }` |  |
+| `BlockSize` | `uint BlockSize { get; }` |  |
+| `Entries` | `IReadOnlyList<Gfs2Entry> Entries { get; }` |  |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `LockProto` | `string LockProto { get; }` |  |
+| `LockTable` | `string LockTable { get; }` |  |
+| `MasterFormalIno` | `ulong MasterFormalIno { get; }` |  |
+| `MasterInodeBlock` | `ulong MasterInodeBlock { get; }` |  |
+| `RootFormalIno` | `ulong RootFormalIno { get; }` |  |
+| `RootInodeBlock` | `ulong RootInodeBlock { get; }` |  |
+| `SuperblockRaw` | `byte[] SuperblockRaw { get; }` | Raw superblock bytes (1024 bytes captured from offset 65536), for diagnostics. |
+| `SuperblockValid` | `bool SuperblockValid { get; }` |  |
+| `UuidHex` | `string UuidHex { get; }` |  |
 | `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(HfsEntry entry)` |  |
+| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(Gfs2Entry entry)` | Where on disk `entry`'s bytes actually sit, as runs of whole blocks, along with the byte offset of the first pointer that names each run. |
+| `ExtractTo` | `long ExtractTo(Gfs2Entry entry, Stream destination)` | Writes `entry`'s content into `destination`. A body up to `blocksize - 232` is stuffed in the dinode; a longer one hangs off a metadata tree whose depth di_height gives — the dinode's own pointer area at the top, then `di_height - 1` levels of indirect blocks. Returns the number of bytes written. |
+| `Extract` | `byte[] Extract(Gfs2Entry entry)` | Reads a regular file's content. Only valid below the array limit. |
 
-#### `HfsWriter`
+#### `Gfs2Writer`
 
-Builds a spec-compliant Classic HFS disk image per Inside Macintosh: Files (1992), chapter 2 "File Manager". Layout matches what hfsutils' libhfs expects: 512-byte B*-tree nodes (libhfs hardcodes `HFS_BLOCKSZ`=512 and validates header-record offsets at exactly 0x00e/0x078/0x0f8/0x1f8). When records can't fit a single leaf, the catalog grows into multiple leaf nodes (chained via the node-descriptor fLink/bLink) and one or more index levels are stacked above them, increasing the tree depth until a single root node fans out over the whole level below it. The header node's BTMapRec caps the catalog at 2048 nodes (no chained map nodes), which still permits well over a thousand entries in a single directory. Names passed to `AddFile` may contain `'/'` separators denoting subdirectories. Each path component below the final one becomes a real catalog folder (directory record type 1 + directory thread type 3) with its own dirID, inserted under its parent's dirID; the file lands keyed under its immediate parent folder's dirID. Current scope cuts: Allocation block size fixed at 512 bytes.ASCII-only filenames (no MacRoman high-byte handling).No resource forks; resource-fork fields in file records are zero.
+Clean-room GFS2 (Global File System 2) image writer producing a minimal, empty, standalone (`lock_nolock`, single-journal) volume that real `fsck.gfs2` (gfs2-utils) accepts without errors. The output mirrors the on-disk structures defined in the public Linux kernel header `include/uapi/linux/gfs2_ondisk.h` and the layout produced by `mkfs.gfs2`, reverse-validated byte-for-byte against a real reference image. Big-endian throughout, 4096-byte blocks.What we emit (everything `fsck.gfs2` requires for a clean volume):Superblock at byte 65536 (block 16).A single resource group whose inline bitmap covers every data block and correctly marks each used metadata block.Master directory dinode and the system inodes hung off it: `jindex`, `per_node`, `inum`, `statfs`, `rindex`, `quota`.A formatted 8 MB journal (`journal0`) whose 2048 blocks each carry a clean unmount log header (correct `lh_hash` CRC32 and `lh_crc` CRC32C).`per_node` system inodes `inum_range0`, `statfs_change0`, `quota_change0` (the latter a 1 MB file of empty quota-change blocks).The root directory dinode with `.` and `..`.Block-accounting fields (`rg_free`, `rg_dinodes`, the master `statfs`, the `inum` next-formal-number) are all computed from the real layout so `check_statfs` passes.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HfsWriter` | `HfsWriter()` |  |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. The `name` may contain `'/'` (or `'\'`) separators to place the file inside a subdirectory tree; each path component must be 1–31 chars. A name with no separator lands in the volume root. |
-| `Build` | `byte[] Build()` | Builds the HFS disk image. |
-| `SetVolumeName` | `void SetVolumeName(string name)` | Sets the HFS volume name (1–27 ASCII chars). |
+| `Gfs2Writer` | `Gfs2Writer(long sizeBytes = 33554432, byte[] uuid = null, DateTime? timestamp = null, string lockTable = null)` | Creates a writer for an image of the given total size in bytes. The size is rounded down to a whole number of 4096-byte blocks; the minimum that yields a clean volume (journal + system inodes + slack) is 32 MB. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a regular file to the root directory. Bodies up to `BlockSize - 232` are stuffed in the dinode; longer ones get a metadata tree of indirect blocks. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are pulled from `openStream` as the volume is written. |
+| `Build` | `byte[] Build()` | Builds the image and returns the raw bytes. |
+| `Build` | `void Build(Stream output)` | Builds the image and writes it to `output`. |
+| `EstimateSize` | `static long EstimateSize(IEnumerable<long> fileSizes)` | Smallest volume that holds `fileSizes`: the fixed metadata layout, every file's dinode, its data blocks and the indirect blocks above them, plus room for the resource-group bitmaps. Rounded up to a megabyte. |
 
-### Namespace `FileSystem.HfsPlus`
+### Namespace `FileSystem.GlusterFs`
 
-[`HfsPlusBlockMover`](#hfsplusblockmover) · [`HfsPlusEntry`](#hfsplusentry) · [`HfsPlusExtentMap`](#hfsplusextentmap) · [`HfsPlusFormatDescriptor`](#hfsplusformatdescriptor) · [`HfsPlusModifier`](#hfsplusmodifier) · [`HfsPlusReader`](#hfsplusreader) · [`HfsPlusWriter`](#hfspluswriter)
+[`GlusterFsEntry`](#glusterfsentry) · [`GlusterFsFormatDescriptor`](#glusterfsformatdescriptor) · [`GlusterFsReader`](#glusterfsreader)
 
-#### `HfsPlusBlockMover`
+#### `GlusterFsEntry`
 
-In-place HFS+ block mover. Moves allocation-block-aligned extents and patches the catalog file record's fork-data extents + allocation bitmap so the file remains reachable at its new location. Streaming: the mover never loads the whole image. `Init` reads only the 512-byte volume header at offset 1024; all metadata updates are targeted reads/writes via `SectorCache` + `Flush` barriers so a crash mid-operation leaves the image fsck-recoverable. Multi-TB HFS+ images (catalog files alone can be tens of MB on large volumes) need only ~256 MB of cache RAM regardless of image size.
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `GlusterFsEntry` | `GlusterFsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-Implements `IFilesystemBlockMover`, `IFilesystemMetadataMover`.
+#### `GlusterFsFormatDescriptor`
+
+Stage 0 detection-only descriptor for GlusterFS. Honest fallback: GlusterFS has no on-disk image format. A GlusterFS volume is a logical aggregation of one or more "bricks", and every brick is just a normal directory on a local POSIX filesystem (typically XFS or ext4). Volume files live at their normal POSIX paths inside the brick directory and carry GlusterFS state in extended attributes (`trusted.gfid`, `trusted.glusterfs.dht`, `trusted.glusterfs.volume-id`, `trusted.glusterfs.pathinfo`, etc.). There is no superblock, no brick header, no portable single-file representation that this image-based pipeline can consume. We therefore stay Stage 0 permanently. The 0xCAFE5BAB magic recognised here is a workbench-internal convention for hand-dumped brick-object probes — it is not a real on-disk GlusterFS structure and no real GlusterFS deployment will produce it. Promotion to R/O would require walking a live directory tree and reading xattrs, which is outside the image-stream contract enforced by `IArchiveFormatOperations`. References: `https://docs.gluster.org` — official GlusterFS documentation (brick/xattr architecture)`https://github.com/gluster/glusterfs` — canonical source`https://en.wikipedia.org/wiki/GlusterFS` — Wikipedia overview
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HfsPlusBlockMover` | `HfsPlusBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Block size in bytes (allocation unit). |
-| `FirstDataByte` | `long FirstDataByte { get; }` |  |
-| `RelocatableMetadata` | `IReadOnlySet<string> RelocatableMetadata { get; }` | The allocation file and the catalog file. Both are ordinary forks whose extents the volume header records, which is the whole of what says where they are — so writing a new start block moves them. The boot region and the volume header itself are pinned: the header is at a fixed offset by definition, and it is what everything else is found through. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the extent descriptor naming the run it is given and leaves the fork's other descriptors alone, so an owner in several runs is simply several calls. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Streaming init — reads only the 512-byte volume header at offset 1024 plus trails of catalog metadata as needed during patches. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `SettleAllocationBitmap` | `void SettleAllocationBitmap(Stream image, IEnumerable<ValueTuple<long, long>> live)` | Writes the allocation bitmap from the runs the volume actually holds. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `UpdateMetadataAfterMove` | `void UpdateMetadataAfterMove(Stream image, string metadataName, long oldOffset, long newOffset, long length, IReadOnlyList<ValueTuple<long, long>> liveRanges = null)` |  |
+| `GlusterFsFormatDescriptor` | `GlusterFsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 
-#### `HfsPlusEntry`
+#### `GlusterFsReader`
 
-Represents a single file or directory entry found within an HFS+ volume image.
+Stage 0 detection-only reader for GlusterFS — permanent honest fallback. GlusterFS itself has no on-disk image format: a brick is a normal directory on a local POSIX filesystem (XFS / ext4 / ...) and volume files are stored at their normal POSIX paths inside that directory. All GlusterFS-specific state lives in extended attributes (the `trusted.gfid`, `trusted.glusterfs.dht`, `trusted.glusterfs.volume-id`, `trusted.glusterfs.pathinfo` namespace). Consequences: There is no superblock or brick header to parse.Distribution / replication state (DHT hashing → brick mapping, AFR replicate metadata, EC dispersed metadata, rebalance bookkeeping) only exists across multiple bricks on multiple hosts, not inside any single image.An R/O promotion is fundamentally incompatible with this project's image-stream contract — recognising a GlusterFS "volume" would require walking a live POSIX directory tree and reading xattrs through the host OS, which is outside the `Stream`-based `IArchiveFormatOperations` surface. The 0xCAFE5BAB magic verified by `Parse` is a workbench-internal probe convention used to dump and round-trip hand-crafted "brick object" experiments; it is not a real on-disk GlusterFS marker and no real GlusterFS deployment produces it. The reader therefore stays a thin two-entry detector (synthetic `metadata.ini` + raw `gluster-brick.bin`) and will never grow real semantics.
+
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HfsPlusEntry` | `HfsPlusEntry()` |  |
-| `Cnid` | `uint Cnid { get; init; }` | The Catalog Node ID assigned to this entry. |
-| `FullPath` | `string FullPath { get; init; }` | The full slash-separated path from the volume root. |
-| `IsDirectory` | `bool IsDirectory { get; init; }` | Whether this entry is a directory rather than a file. |
-| `IsSymlink` | `bool IsSymlink { get; init; }` | Whether this entry is a symbolic link (Finder type 'slnk'). |
-| `LastModified` | `DateTime? LastModified { get; init; }` | The last modification timestamp (may be null if not available). |
-| `LinkTarget` | `string LinkTarget { get; init; }` | The symlink target path (data-fork contents), or null when not a link. |
-| `Name` | `string Name { get; init; }` | The filename. |
-| `Size` | `long Size { get; init; }` | The logical file size in bytes. |
+| `GlusterFsReader` | `GlusterFsReader(Stream stream)` |  |
+| `BrickMagic` | `static readonly byte[] BrickMagic` | Workbench-internal probe magic (0xCA 0xFE 0x5B 0xAB, 0xCAFE5BAB big-endian) used by the detector tests. Not a real GlusterFS structure — GlusterFS has no on-disk header at all. |
+| `Entries` | `IReadOnlyList<GlusterFsEntry> Entries { get; }` |  |
+| `MagicWord` | `uint MagicWord { get; }` |  |
+| `TrailingWord` | `uint TrailingWord { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(GlusterFsEntry entry)` |  |
 
-#### `HfsPlusExtentMap`
+### Namespace `FileSystem.Gpfs`
 
-Walks an HFS+ (or HFSX) image and yields the actual on-disk byte layout — the reserved boot region (first 1024 bytes) + volume header + allocation file + catalog file as `MetadataReserved`, every file record's first data-fork extent (HFSPlusForkData.extents[0]) as `Used`. Mirrors what `HfsPlusReader` can extract — leaf chain via fLink, single primary extent per file. Streaming: never loads the whole image. All reads flow through a `SectorCache` so multi-TB HFS+ images (the catalog file alone can be tens of MB on large volumes) work without OOM.
+[`GpfsEntry`](#gpfsentry) · [`GpfsFormatDescriptor`](#gpfsformatdescriptor) · [`GpfsReader`](#gpfsreader)
+
+#### `GpfsEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+| `GpfsEntry` | `GpfsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-#### `HfsPlusFormatDescriptor`
+#### `GpfsFormatDescriptor`
 
-References: `https://developer.apple.com/library/archive/technotes/tn/tn1150.html` — Apple Technical Note TN1150 "HFS Plus Volume Format", the canonical spec (incl. HFSX and the journal)`https://github.com/torvalds/linux/tree/master/fs/hfsplus` — Linux kernel implementation`https://en.wikipedia.org/wiki/HFS_Plus` — Wikipedia overview
+Stage 0 detection-only descriptor for IBM Spectrum Scale (GPFS) NSD descriptor images. Surfaces only a synthetic `metadata.ini` and the raw image bytes; no real file-walk is attempted. References: `https://www.ibm.com/docs/en/storage-scale` — IBM Storage Scale (formerly Spectrum Scale / GPFS) official documentation, incl. NSD concepts`https://en.wikipedia.org/wiki/GPFS` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HfsPlusFormatDescriptor` | `HfsPlusFormatDescriptor()` |  |
+| `GpfsFormatDescriptor` | `GpfsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
 | `DefaultExtension` | `string DefaultExtension { get; }` |  |
-| `Description` | `string Description { get; }` | Apple HFS+ filesystem image. Writer emits full 248-byte TN1150 HFSPlusCatalogFile records with HFSPlusForkData at offsets 88/168. |
+| `Description` | `string Description { get; }` |  |
 | `DisplayName` | `string DisplayName { get; }` |  |
 | `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | HFS+ creation knobs: HFSX case-sensitivity toggle, journal enable + journal-size selector, volume name and allocation block size. The block size dropdown offers Auto (slack + table-overhead minimisation) plus the power-of-two sizes 4 KB … 64 KB that the writer supports; the journal-size knob is gated on Journal=true via DependsOn. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing HFS+ image via `AddFile`. The modifier mutates the catalog leaf, allocation bitmap, and volume header in place; on leaf overflow it transparently falls back to a writer-driven rebuild so the call always succeeds. |
-| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation: pre-known per-input sizes drive allocation-block geometry + catalog B-tree planning in pass 1; pass 2 emits the volume header + allocation bitmap + extents B-tree + catalog B-tree (with file records pointing at single-extent allocations) + the alternate volume header, then streams each input's bytes from its `OpenStream` factory into its allocated extent run via 64 KB chunks. Block tail past each entry's exact `Size` stays sparse-zero. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
-| `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware HFS+ defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. The writer always emits a contiguous, start-packed allocation block layout, so all four `DefragMode` values converge on a clean repack. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the HFS+ catalog B-tree leaf chain and yields the actual on-disk byte layout — reserved boot region + volume header + allocation file + catalog file as `MetadataReserved`, every file record's first data-fork extent (`HFSPlusForkData.extents[0]`) as `Used`. |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing HFS+ image via `RemoveFile`. File data blocks are wiped and the catalog records are excised from the leaf node; missing names are silently ignored. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the HFS+ image: free allocation blocks, gaps between files and the block-tip slack between a file's logical size and the end of its last allocated block. The catalog extent map clamps each file's first-fork run to its logical byte length, so trailing slack inside the final block presents as a free gap that the generic `UnusedSpaceWiper` zero-fills. The size lookup is keyed by the reader's full path, matching the extent map's FileName. |
 
-#### `HfsPlusModifier`
+#### `GpfsReader`
 
-In-place HFS+ modifier — performs random-access mutation of an existing HFS+ image without rebuilding the whole filesystem. Designed for the single-leaf catalog shape that `HfsPlusWriter` emits (treeDepth=1, root==leaf node 1). When an Add would overflow the single leaf, the modifier falls back to a writer-driven rebuild via `HfsPlusWriter` so the operation always succeeds. What we touch on a small Add:The volume header (offset 1024) — file count, free blocks, next CNID.The alternate volume header at `imageSize-1024` (mirror).The allocation bitmap block (block 1).The catalog leaf node (block 3 → offset 3×blockSize for the standard layout).The newly-allocated data blocks for the file payload.
+Stage 0 detection-only reader for IBM Spectrum Scale (formerly GPFS — General Parallel File System) NSD (Network Shared Disk) descriptor images. GPFS is a parallel clustered FS — its single-disk surface is the NSD descriptor block whose first four bytes are the GPFS magic integer `0x4347465C` (the bytes 0x43 0x47 0x46 0x5C — derived from the cluster signature "GCFS\" used in GPFS internal headers). Only the magic word is verified. The real NSD descriptor maps onto a GPFS cluster's failure-group topology and storage pool membership; the file table itself lives in the cluster manager and cannot be walked from a single disk image.
+
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds (or replaces by name) a file. If the catalog leaf cannot fit the new record, falls back to a full rebuild so the call always succeeds. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file. Returns true if it was present and removed, false if no such entry exists. |
-
-#### `HfsPlusReader`
-
-Reads and extracts files from an HFS+ filesystem image. Supports both HFS+ (signature "H+") and HFSX (signature "HX") volumes. The volume header resides at byte offset 1024 within the image.
-
-Implements `IDisposable`.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `HfsPlusReader` | `HfsPlusReader(Stream stream, bool leaveOpen = false)` | Initializes a new `HfsPlusReader` and parses the HFS+ volume. |
-| `Entries` | `IReadOnlyList<HfsPlusEntry> Entries { get; }` | Gets all file and directory entries found in the volume. |
+| `GpfsReader` | `GpfsReader(Stream stream)` |  |
+| `NsdMagic` | `static readonly byte[] NsdMagic` | GPFS NSD descriptor magic: bytes 0x43 0x47 0x46 0x5C. |
+| `Entries` | `IReadOnlyList<GpfsEntry> Entries { get; }` |  |
+| `MagicWord` | `uint MagicWord { get; }` |  |
+| `TrailingWord` | `uint TrailingWord { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
 | `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(HfsPlusEntry entry)` | Extracts the data fork content of the specified file entry. |
-
-#### `HfsPlusWriter`
-
-Creates minimal HFS+ filesystem images per Apple TN1150 ("HFS Plus Volume Format"). Produces a 4 MB image with 4 KB block size by default. Files are stored uncompressed in the data fork using single-extent allocation. The catalog file record is the full 248-byte `HFSPlusCatalogFile` layout with the data fork `HFSPlusForkData` struct at offset 88 and the resource fork `HFSPlusForkData` at offset 168, matching TN1150.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `HfsPlusWriter` | `HfsPlusWriter(bool caseSensitive = false, bool journalEnabled = false, int journalSize = 8388608, string volumeName = "Untitled")` | Creates a new HFS+ writer. |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to be included in the volume image. |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file: `size` drives catalog + extent allocation in pass 1; bytes are pulled from `openStream` in pass 2 of `BuildToStreaming`. Never buffered as `byte[]`. |
-| `BuildAutoSized` | `byte[] BuildAutoSized(int requestedBlockSize = 0)` | Picks the allocation block size that minimises slack + structural overhead via `FilesystemLayoutOptimizer`, then builds the image. The candidate set is [4 KB … 64 KB]; most HFS+ images stay at 4 KB — the optimizer only bumps the block size for large-file sets where the bigger allocation unit cuts table overhead. |
-| `BuildToStreamingAutoSized` | `void BuildToStreamingAutoSized(Stream output, int requestedBlockSize = 0)` | Two-pass streaming Build with auto-sized allocation block. |
-| `BuildToStreaming` | `void BuildToStreaming(Stream output, uint blockSize = 4096)` | Two-pass streaming Build: pass 1 derives allocation-block geometry + catalog B-tree size from the declared sizes of `AddStreamingFile` entries; pass 2 emits the volume header + allocation bitmap + extents B-tree + catalog B-tree (with file records carrying fork descriptors pointing at the single-extent runs) + the alternate volume header, then streams each entry's bytes from its factory into its allocated block run via 64 KB chunks. Block tail past each entry's exact `Size` stays sparse-zero. |
-| `Build` | `byte[] Build(uint blockSize = 4096)` | Builds and returns the complete HFS+ volume image with the given allocation block size. |
-| `SetVolumeUuid` | `void SetVolumeUuid(ulong uuid)` | Fixes the volume's identity, for a build that has to come out the same twice. |
-
-### Namespace `FileSystem.Hpfs`
-
-[`HpfsBlockMover`](#hpfsblockmover) · [`HpfsEntry`](#hpfsentry) · [`HpfsFormatDescriptor`](#hpfsformatdescriptor) · [`HpfsReader`](#hpfsreader)
-
-#### `HpfsBlockMover`
-
-Moves a file's sectors inside an HPFS volume, repoints its fnode, and moves the allocation with it.
-
-Implements `IFilesystemBlockMover`.
+| `Extract` | `byte[] Extract(GpfsEntry entry)` |  |
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `HpfsBlockMover` | `HpfsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A sector. An allocation entry names a starting LBA. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. Everything below LBA 32 is the fixed head of the volume — boot sector, superblock, spare block, root fnode and dirent block, and the two bitmaps — none of which is located by anything that could be repointed. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads where the volume keeps its allocation bitmap. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+### Namespace `FileSystem.GsOs`
 
-#### `HpfsEntry`
+[`GsOsEntry`](#gsosentry) · [`GsOsFormatDescriptor`](#gsosformatdescriptor) · [`GsOsInPlaceModifier`](#gsosinplacemodifier) · [`GsOsReader`](#gsosreader) · [`GsOsWriter`](#gsoswriter)
 
-Directory entry in an OS/2 HPFS volume.
+#### `GsOsEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HpfsEntry` | `HpfsEntry()` |  |
+| `GsOsEntry` | `GsOsEntry()` |  |
+| `DataOffset` | `int DataOffset { get; init; }` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `HpfsFormatDescriptor`
+#### `GsOsFormatDescriptor`
 
-R/W descriptor for OS/2 HPFS (High Performance File System) volumes. Supports: list, extract, create, modify (true in-place at root level via `HpfsInPlaceModifier`), defragment, extent map. References: Ray Duncan, "Design Goals and Implementation of the New High Performance File System" (Microsoft Systems Journal, September 1989) — the original published description`https://docs.kernel.org/filesystems/hpfs.html` — Linux kernel HPFS driver documentation; `fs/hpfs` is the maintained on-disk reference`https://en.wikipedia.org/wiki/High_Performance_File_System` — Wikipedia overview
+Descriptor for Apple IIgs GS/OS 2IMG disk images. The 2IMG container wraps a ProDOS / HFS / DOS 3.3 volume with a 64-byte header — this descriptor parses the header, surfaces the inner volume, and (for ProDOS-ordered payloads) lets callers add/replace/remove files inside the embedded volume by delegating to `ProDosModifier`, which already shifts every block access past the 2IMG header. Detection is by the .gsdos extension; the "2IMG" magic at offset 0 is owned by `FileSystem.ProDos` (.2mg routing) to avoid a detector first-match conflict. References: Apple II "Universal Disk Image" (2IMG) specification (Apple II emulation community, 1997) — defines the 64-byte header`https://github.com/fadden/CiderPress2` — CiderPress II, maintained implementation with 2IMG format documentation`http://fileformats.archiveteam.org/wiki/2IMG` — Just Solve the File Format Problem wiki page
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HpfsFormatDescriptor` | `HpfsFormatDescriptor()` |  |
+| `GsOsFormatDescriptor` | `GsOsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -5471,92 +6832,94 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | In-place root-level Add: flips bitmap bits at LBA 24 to allocate fresh data + FNODE sectors, writes them at their freshly-allocated offsets, and inserts the new dirent into the root DIRBLK at LBA 20 by shifting later dirents in place. Untouched sectors stay byte-identical. Subdirectory paths and DIRBLK overflow fall through to the rebuild path so callers always get a result. |
-| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Streaming creation: each input's length settles the layout, then its bytes are copied into the sectors it was allocated, so an entry past what a byte[] can hold never has to be materialised. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
-| `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds — or replaces by name — files inside the inner ProDOS volume. The 2IMG header bytes 0..63 stay byte-identical; only the inner ProDOS catalog + bitmap + data blocks are touched. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh 2IMG-wrapped ProDOS image from the given inputs. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | In-place root-level Remove: zeros the file's data + FNODE sectors, flips their bitmap bits back to free, and excises the dirent from the root DIRBLK by shifting later dirents back. Untouched sectors stay byte-identical. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the HPFS image: free sectors, gaps between files and the sector-tip slack between a file's logical size and the end of its last allocated 512-byte sector. The extent map clamps each file's data run to its logical byte length, so trailing slack inside the final sector presents as a free gap that the generic `UnusedSpaceWiper` zero-fills. The size lookup is keyed by the reader's full path, matching the extent FileName. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from the inner ProDOS volume. |
 
-#### `HpfsReader`
+#### `GsOsInPlaceModifier`
 
-Read-only reader for OS/2 HPFS (High Performance File System) volumes.
+In-place modifier for Apple IIgs GS/OS 2IMG disk images carrying a ProDOS-ordered payload (image format = 1). The 2IMG container is a 64-byte header at offset 0 followed by the inner ProDOS volume. Mutation is genuinely in place: the inner ProDOS catalog, volume bitmap and data blocks are edited directly via `ProDosModifier` (which auto-detects the 64-byte 2IMG header through its magic and offsets all block I/O), so the 2IMG header bytes 0..63 and every untouched ProDOS block stay byte-identical and the image keeps its original length. The earlier volume-directory-header / slot-1 byte-offset collision in `ProDosModifier` is fixed and pinned by `ProDosVolumeHeaderRegressionTests`. The edit is applied to an in-memory copy first and only written back on success, so a failure leaves the image untouched and the verified rebuild path takes over (catalog-full / structural edge cases). HFS- and DOS-3.3-ordered 2IMG payloads (image format = 0 or 2) are rejected.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream archive, string name, byte[] data)` | Adds — or replaces by name — files inside the inner ProDOS volume of an existing 2IMG image. The 2IMG header bytes 0..63 are byte-identical before and after the operation; existing ProDOS blocks not touched by the edit are preserved in place (no full rebuild for the common case). |
+| `RemoveFile` | `static bool RemoveFile(Stream archive, string name)` | Removes the named file from the inner ProDOS volume of an existing 2IMG image. Returns true if the file existed and was removed. |
+
+#### `GsOsReader`
+
+Reads Apple IIgs GS/OS disk images packaged in the 2IMG container (the canonical emulator format for IIgs disks). GS/OS is an extended ProDOS filesystem that adds Mac-HFS-style resource forks and longer filenames; volumes can be Extended ProDOS (version >= 5), HFS, or DOS 3.3 — this reader handles the 2IMG header parse and surfaces the embedded volume as an opaque entry for delegation to a ProDOS / HFS reader downstream. 2IMG header layout (little-endian, 64 bytes): 0x00 char[4] "2IMG" 0x04 char[4] creator code (e.g. "CTKG"=Catakig, "ASIM"=ASIMOV2, "B2TR"=Bernie ][ The Rescue) 0x08 u16 header size (always 64) 0x0A u16 version 0x0C u32 image format (0=DOS 3.3 order, 1=ProDOS order, 2=NIB) 0x10 u32 flags (bit 0x80000000 = locked; low byte = volume number for DOS 3.3) 0x14 u32 data block count (ProDOS blocks) 0x18 u32 data offset (relative to file start) 0x1C u32 data length (bytes) 0x20 u32 comment offset 0x24 u32 comment length 0x28 u32 creator data offset 0x2C u32 creator data length 0x30..0x3F reserved
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `HpfsReader` | `HpfsReader(Stream stream)` |  |
-| `HpfsReader` | `HpfsReader(byte[] data)` |  |
-| `DirBlockMagic` | `static readonly byte[] DirBlockMagic` | Dirent-block magic 0x77E40AAE little-endian: `AE 0A E4 77`. |
-| `DirBlockSize` | `const int DirBlockSize` |  |
-| `FnodeMagic` | `static readonly byte[] FnodeMagic` | Fnode magic 0xF7E40AAE little-endian: `AE 0A E4 F7`. |
-| `LbaSize` | `const int LbaSize` |  |
-| `SuperblockLba` | `const int SuperblockLba` |  |
-| `SuperblockMagic` | `static readonly byte[] SuperblockMagic` | Superblock magic — the uint32 pair 0xF995E849 / 0xFA53E9C5 stored little-endian, i.e. the bytes `49 E8 95 F9 C5 E9 53 FA`. |
-| `Entries` | `IReadOnlyList<HpfsEntry> Entries { get; }` |  |
-| `RootFnodeLba` | `uint RootFnodeLba { get; }` | Root-fnode LBA from the superblock. |
+| `GsOsReader` | `GsOsReader(Stream stream)` |  |
+| `Magic` | `static readonly byte[] Magic` |  |
+| `Comment` | `string Comment { get; }` |  |
+| `Creator` | `string Creator { get; }` |  |
+| `DataBlockCount` | `uint DataBlockCount { get; }` |  |
+| `DataLength` | `uint DataLength { get; }` |  |
+| `DataOffset` | `uint DataOffset { get; }` |  |
+| `Entries` | `IReadOnlyList<GsOsEntry> Entries { get; }` |  |
+| `Flags` | `uint Flags { get; }` |  |
+| `ImageFormat` | `int ImageFormat { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Version` | `int Version { get; }` |  |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` |  |
 | `Dispose` | `void Dispose()` |  |
-| `ExtractTo` | `void ExtractTo(HpfsEntry entry, Stream destination)` | Copies `entry`'s bytes into `destination`, a block at a time. HPFS records a file size as a uint32, so an entry can be up to 4 GB — more than `Extract` can return in an array. |
-| `Extract` | `byte[] Extract(HpfsEntry entry)` |  |
+| `Extract` | `byte[] Extract(GsOsEntry entry)` |  |
 
-### Namespace `FileSystem.Iso`
+#### `GsOsWriter`
 
-[`IsoBlockMover`](#isoblockmover) · [`IsoEntry`](#isoentry) · [`IsoExtentMap`](#isoextentmap) · [`IsoFormatDescriptor`](#isoformatdescriptor) · [`IsoModifier`](#isomodifier) · [`IsoReader`](#isoreader) · [`IsoWriter`](#isowriter)
+Builds Apple IIgs GS/OS 2IMG disk images. The container is a 64-byte header (creator code, image format = ProDOS-ordered, data offset/length, flags) followed by the embedded ProDOS volume; this writer emits a ProDOS payload via `ProDosWriter` and prepends the 2IMG header so the result is recognised by GS/OS-aware emulators (CiderPress, ASIMOV2, Bernie ][ The Rescue, Catakig). 2IMG header layout (little-endian, 64 bytes) — see `GsOsReader` for the field-by-field breakdown. The flags word is left zero (unlocked, DOS-3.3 volume number = 0).
 
-#### `IsoBlockMover`
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `GsOsWriter` | `GsOsWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the inner ProDOS volume. |
+| `Build` | `byte[] Build(string volumeName = "WORM", int totalBlocks = 280)` | Builds the 2IMG-wrapped ProDOS image. The inner volume is built via `ProDosWriter`; the 64-byte 2IMG header is prepended in front. The data block count records the ProDOS payload size in 512-byte blocks; the data offset is fixed at 64. |
+| `WrapWithHeader` | `static byte[] WrapWithHeader(byte[] prodosPayload)` | Wraps an existing ProDOS payload in a 2IMG header. Exposed so the in-place modifier can recompute the header after the inner payload length changes. |
 
-In-place ISO 9660 block mover. ISO files are single-extent contiguous by spec (ECMA-119), so moving a file means patching the directory record's extent LBA and data length fields. The PVD is also patched for volume space size adjustments if needed. Streaming: reads only the PVD + directory sectors via a `SectorCache`. A 100 GB DVD/BD image never gets loaded as a whole — only the touched sectors are read, and each metadata write is followed by a `Flush` barrier so a crash mid-move can never reference garbage.
+### Namespace `FileSystem.Hammer`
 
-Implements `IFilesystemBlockMover`.
+[`HammerBlockMover`](#hammerblockmover) · [`HammerExtentMap`](#hammerextentmap) · [`HammerFormatDescriptor`](#hammerformatdescriptor) · [`HammerReader`](#hammerreader) · [`HammerReader.DataExtent`](#hammerreaderdataextent) · [`HammerReader.FileEntry`](#hammerreaderfileentry) · [`HammerVolumeOndisk`](#hammervolumeondisk) · [`HammerWriter`](#hammerwriter)
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `IsoBlockMover` | `IsoBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A sector. A directory record names one, not a byte. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | Byte offset of the first data sector (sector 0). |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the record it is given and nothing else, so an owner in several runs — which this format cannot produce — would be several calls. |
-| `SectorSize_` | `int SectorSize_ { get; }` | Sector size. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full image be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the directory once and notes where every record is. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+#### `HammerBlockMover`
 
-#### `IsoEntry`
+Moves a file's data records inside a HAMMER volume and repoints the B-tree elements that name them.
 
-Represents an entry (file or directory) in an ISO 9660 image.
+Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `IsoEntry` | `IsoEntry()` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` | Whether the entry is a directory. |
-| `LastModified` | `DateTime? LastModified { get; init; }` | Last modification timestamp. |
-| `Name` | `string Name { get; init; }` | Path of the entry within the image. |
-| `Size` | `long Size { get; init; }` | Size in bytes (0 for directories). |
+| `HammerBlockMover` | `HammerBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Sixty-four bytes. A record's zone offset is byte-exact, but keeping the destinations on the element grid keeps a record from straddling the sixteen-byte structures the format aligns on. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a record may occupy: past the volume header and reserves. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads where the buffer area starts and how far the records reach. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `IsoExtentMap`
+#### `HammerExtentMap`
 
-Walks an ISO 9660 image and yields its actual on-disk byte layout — the 32 KiB system area, every Volume Descriptor sector (PVD/SVD/VDST), the path tables, every directory record's contiguous extent (ISO 9660 spec requires single-extent files), and the trailing free space. Each file surfaces as exactly one Used extent because ECMA-119 mandates contiguous allocation. Streaming: reads only the volume descriptor sectors + one directory's contents at a time through a `SectorCache`. A 100 GB DVD/BD image needs only ~256 MB of cache regardless of size — directory bytes are pulled on-demand from disk rather than loaded whole.
+Reads a HAMMER volume's freemap and reports which bytes are in use. HAMMER allocates in 8 MB big-blocks: a layer-2 entry per big-block records which zone owns it and how far into it the allocator has appended. A big-block no zone owns is free outright, and the tail of one past its append point is free as well — which is where a removed file's bytes stay.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Single-pass walker. Parses volume descriptors at sector 16+, then walks the directory tree from the root. Each file directory record carries an (extent_LBA, length) pair which is yielded as a single contiguous run. |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `IsoFormatDescriptor`
+#### `HammerFormatDescriptor`
 
-Format descriptor for ISO 9660 optical disc images. References: `https://ecma-international.org/publications-and-standards/standards/ecma-119/` — ECMA-119 (the freely available equivalent of ISO 9660), the defining standard`https://github.com/torvalds/linux/tree/master/fs/isofs` — Linux kernel implementation`https://en.wikipedia.org/wiki/ISO_9660` — Wikipedia overview (incl. Joliet / Rock Ridge extensions)
+Read-only descriptor for HAMMER (DragonFly BSD original) filesystem images. Surfaces the volume header at offset 0 plus a structured metadata bundle and the raw image. Walking the HAMMER B-tree (zone blockmap → cluster → inode → records) is explicitly out of scope (multi-week effort). Magic: 8-byte uint64 `vol_signature = 0xC8414D4DC5523031` ("HAMMER01") at offset 0, serialised LE on disk as `31 30 52 C5 4D 4D 41 C8`. Confidence 0.85: an 8-byte magic value at offset 0 is high-confidence but HAMMER lacks an additional sanity check at this stage of detection (the `vol_fstype` UUID at offset 64 is not validated against a well-known constant). References: `https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/vfs/hammer/hammer_disk.h``https://www.dragonflybsd.org/hammer/`
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `IsoFormatDescriptor` | `IsoFormatDescriptor()` |  |
+| `HammerFormatDescriptor` | `HammerFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -5568,126 +6931,142 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for ISO 9660 creation: ECMA-119 volume identifier, system identifier, publisher, application, plus the Joliet extension toggle. All identifier fields follow the ECMA-119 d/a-character rules and are truncated to the field length defined by the spec (32 for vol/sys, 128 for publisher/application). |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the HAMMER writer honours: the filesystem label (`newfs_hammer -L`), written into the volume header and the PFS#0 data and surfaced back as `vol_label`. Volume size is intentionally not exposed — the UNDO-FIFO floor pins it at ~1 GB regardless. An empty label falls back to the writer default ("hammer"). |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds or replaces files at the root of an existing ISO 9660 image. Uses `IsoModifier` for true random-access I/O — only the PVD (sector 16), the root directory's existing extent, and the new file's data sectors are touched. The 32 KB system area, VDST, path tables, and existing file data sectors are left untouched. Names are sanitized to the ISO 9660 8.3 d-characters identifier set; ';1' versions are added automatically by the modifier. |
-| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation: the pre-known per-input sizes drive the ISO 9660 path table + directory + file-extent layout in pass 1 (identical to `Create`, which flattens to leaf filenames); pass 2 streams each file's bytes from its `OpenStream` factory into its data extent via 64 KB chunks — no file is ever buffered as a `byte[]`. Output is byte-identical to `Create` for the same inputs (the ECMA-119 volume/record timestamps are sampled once per `Build`). Falls back to a buffered build when the target stream is not seekable. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Produces a fresh, mountable single-volume HAMMER image from `inputs`. HAMMER's UNDO FIFO floor forces a volume size of ~1 GB minimum; see `HammerWriter`. Each input becomes an inode + directory-entry + data record in the global B-Tree. The DragonFly kernel mounts the image and reads every file's contents byte-exact (validated via `mount_hammer` + `cksum`, including multi-block files spanning the large- and small-data zones); the image also passes `hammer show` and `hammer checkmap`. |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware ISO 9660 defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. All four `DefragMode` values supported; image is repacked with files reordered per mode. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the 32 KiB system area, the volume descriptor sequence, the path tables, and the directory tree, and yields each file's contiguous extent (LBA, length) as a single Used run — ECMA-119 mandates contiguous allocation per file. Directories surface as MetadataReserved. |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file's bytes live in data records whose B-tree elements carry the offset they start at, so a move is the copy, that field, and the checksum over the node the element lives in — cheaper than reading every file out and writing a fresh volume, which is what the inherited default did for the one mode it offered. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single ISO 9660 file entry as a bounded read-only `Stream`. ISO 9660 stores file data in contiguous extents — the reader's extract returns those bytes verbatim; they are wrapped in a `BoundedEntryStream` sized to the entry's logical size. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing ISO 9660 image. Uses `IsoModifier` for O(touched bytes) random-access I/O — the directory record is shifted out of its sector and the file's data sectors are zero-wiped. Names match case-insensitively after stripping any ';N' version suffix (ISO 9660 stores uppercase IDs). |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the ISO 9660 image: the unused remainder of the system area, free sectors and the sector-tip slack at the tail of each file's last 2048-byte sector. ECMA-119 stores every file contiguously and pads its final sector with zeros — the bytes between the file's logical length and the sector boundary are the cluster tip. The extent map clamps each Used run to the file's logical length, so the tip presents as a free gap that the generic `UnusedSpaceWiper` zero-fills. The size lookup is keyed by the reader's full path, matching the extent FileName. |
-
-#### `IsoModifier`
-
-In-place ISO 9660 (ECMA-119) modifier — true random-access editing without rebuilding the whole image. Touches only the PVD (sector 16), the root directory's existing extent, and the new file's data sectors. Layout assumptions (matching `IsoWriter`): 2048-byte sectors, single-level root directory (no subdirectories).PVD at LBA 16; an optional Joliet SVD follows before the VDST.File data laid out sequentially after the directory extents.No Rock Ridge System Use entries. New file data is appended after the current volume space; the PVD's volume space size is updated and a directory record is inserted into a free slot of the existing root directory extent. Removal shifts subsequent records in-place within their sector and optionally wipes the data sectors. When the image carries a Joliet SVD, the same add/remove is mirrored into the parallel Joliet root directory (UCS-2BE long names) so both trees stay consistent.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds (or replaces) a file at the root of an ISO 9660 image. The file data is appended after the current volume extent; a new directory record is written into a free slot of the root directory's existing extent. Throws `IOException` if the root directory has no free slot (extending the directory would clobber file data and is not supported). |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the root directory of an ISO 9660 image. Shifts later records within the same directory sector to fill the hole, zero-fills the trailing tail, and (by default) wipes the file's data sectors. The PVD volume space size is left unchanged: the freed sectors at the tail can be reclaimed by a subsequent `AddFile`, but truncating the image would shift offsets used by other entries. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills everything the freemap leaves unallocated: free big-blocks outright, and the tail of a partly-used one past its append point. |
 
-#### `IsoReader`
+#### `HammerReader`
 
-Reads ISO 9660 (ECMA-119) disc images with optional Joliet and Rock Ridge support.
+Walks a HAMMER (DragonFly BSD, HAMMER1) volume's global B-Tree and yields the regular files it contains as `path -> bytes`. This is the read side of full file support: it parses the volume header, resolves zone offsets through the freemap (zone-4 two-layer blockmap), recursively descends the B-Tree from `vol0_btree_root`, and reassembles inodes, directory entries and data records into a directory tree. On-disk references (`sys/vfs/hammer/hammer_disk.h`):B-Tree node `hammer_node_ondisk`: `crc(4)@0`, `signature(4)@4`, `parent(8)@8`, `count(4)@16`, `type(1)@20`, then 63 elements of 64 bytes starting at @64.Element base `hammer_base_elm`: `obj_id(8)@0`, `key(8)@8`, `create_tid(8)@16`, `delete_tid(8)@24`, `rec_type(2)@32`, `obj_type(1)@34`, `btype(1)@35`, `localization(4)@36`.Internal element adds `subtree_offset(8)@40`; leaf element adds `create_ts(4)@40`, `delete_ts(4)@44`, `data_offset(8)@48`, `data_len(4)@56`, `data_crc(4)@60`.rec_type `INODE=0x0001`, `DATA=0x0010`, `DIRENTRY=0x0011`; obj_type `DIRECTORY=1`, `REGFILE=2`.Directory-entry data `hammer_direntry_data`: `obj_id(8)@0`, `localization(4)@8`, `reserved01(4)@12`, `name[]@16` (length = `data_len - 16`).Inode data `hammer_inode_data`: `obj_type(1)@64`, `size(8)@80`.
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `IsoReader` | `IsoReader(Stream stream, bool leaveOpen = false, bool useJoliet = true)` | Opens an ISO 9660 image from the given stream. When `useJoliet` is `true` (the default) and the image carries a Joliet Supplementary Volume Descriptor, the long UCS-2 names from the Joliet directory tree are returned; otherwise the primary ECMA-119 tree (short uppercased names) is read. |
-| `Entries` | `IReadOnlyList<IsoEntry> Entries { get; }` | All entries found in the image. |
+| `FreemapLayer1Offset` | `long FreemapLayer1Offset { get; }` | File offset of the freemap's layer-1 array. |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `Valid` | `bool Valid { get; }` | True if the image carries a valid HAMMER volume header. |
+| `VolumeBufferStart` | `long VolumeBufferStart { get; }` | Where the volume's buffer area starts; zone-2 offsets are relative to it. |
 | `Dispose` | `void Dispose()` |  |
-| `ExtractTo` | `void ExtractTo(IsoEntry entry, Stream destination)` | Copies an entry's bytes into `destination` a block at a time, so an entry larger than a byte[] can hold is extracted like any other. |
-| `Extract` | `byte[] Extract(IsoEntry entry)` | Extracts the raw data for the given entry. |
-
-#### `IsoWriter`
-
-Builds a minimal ISO 9660 (ECMA-119) disc image, optionally with a Joliet Supplementary Volume Descriptor. File names passed to `AddFile` may contain '/' separators; each separated segment becomes a real directory in the on-disc directory-record tree (with its own extent, "." and ".." records, and a matching path-table entry) rather than being flattened into the root directory. When `EnableJoliet` is set (the default), the writer emits a second, parallel directory tree carrying the original long, mixed-case, Unicode names as UCS-2 (UTF-16) big-endian, described by a Supplementary Volume Descriptor (type 2) with the UCS-2 level-3 escape sequence and its own L/M path tables. Both trees reference the same shared file-data extents — only the directory/name metadata differs: the primary tree carries short ECMA-119 (uppercase 8.3-ish, ";1") names, the Joliet tree the real long names.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `IsoWriter` | `IsoWriter()` |  |
-| `ApplicationIdentifier` | `string ApplicationIdentifier { get; set; }` | ECMA-119 8.4.12 Application Identifier (a-characters, 128 bytes max). Empty by default. |
-| `EnableJoliet` | `bool EnableJoliet { get; set; }` | Whether to emit a Joliet Supplementary Volume Descriptor and a parallel UCS-2 directory tree carrying the original long names. On by default. |
-| `PublisherIdentifier` | `string PublisherIdentifier { get; set; }` | ECMA-119 8.4.10 Publisher Identifier (a-characters, 128 bytes max). Empty by default. |
-| `SystemIdentifier` | `string SystemIdentifier { get; set; }` | ECMA-119 8.4.6 System Identifier (a-characters, 32 bytes max). Names the system that wrote the image. Empty by default. |
-| `VolumeIdentifier` | `string VolumeIdentifier { get; set; }` | ECMA-119 8.4.7 Volume Identifier (d-characters, 32 bytes max). Shown by most OS file managers and the iso9660 driver as the disc label. Default "CDROM". Truncated to 32 chars; upper-cased to fit the d-character set. |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. The name may contain '/' path separators, in which case the intermediate segments are created as directories. |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file: `size` drives extent + path-table + directory-record sizing in pass 1; bytes are pulled from `openStream` in pass 2 of `BuildToStreaming`. Never buffered as `byte[]`. |
-| `BuildToStreaming` | `void BuildToStreaming(Stream output)` | Two-pass streaming Build: pass 1 lays out the identical ISO image (same descriptors, path tables, directory extents, and file-data extent placement as `Build`) with each streaming file's data extent left zero; pass 2 seeks to each file's extent byte offset and copies its bytes from the opener in 64 KB chunks. The sector tail past each file's logical size stays zero, exactly as the in-memory path leaves it. For the same inputs (and same wall-clock second for the volatile ECMA-119 timestamps) the output is byte-for-byte identical to `Build`. |
-| `Build` | `byte[] Build()` |  |
-
-### Namespace `FileSystem.Jffs2`
-
-[`Jffs2BlockMover`](#jffs2blockmover) · [`Jffs2FileReader`](#jffs2filereader) · [`Jffs2FileReader.FileEntry`](#jffs2filereaderfileentry) · [`Jffs2FormatDescriptor`](#jffs2formatdescriptor) · [`Jffs2InPlaceModifier`](#jffs2inplacemodifier) · [`Jffs2Writer`](#jffs2writer)
-
-#### `Jffs2BlockMover`
-
-Moves nodes inside a JFFS2 image.
-
-Implements `IFilesystemBlockMover`.
+| `EnumerateDataExtents` | `IReadOnlyList<DataExtent> EnumerateDataExtents()` | Where on disk each file's data records actually sit, along with the byte offset of the B-tree element that names each of them and of the node that element lives in. |
+| `Open` | `static HammerReader Open(Stream stream)` | Opens a HAMMER volume, pulling blocks on demand. Never throws on a malformed header; check `Valid`. |
+| `Open` | `static HammerReader Open(byte[] image)` | Opens a HAMMER image. Never throws on a malformed header; check `Valid`. |
+| `ReadFiles` | `IReadOnlyList<FileEntry> ReadFiles()` | Walks the B-Tree and returns every regular file with its full path relative to the filesystem root (e.g. `"sub/inner.txt"`). Directories are implied by the paths; empty directories are not returned (they carry no file payload). |
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `Jffs2BlockMover` | `Jffs2BlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Four bytes — the grid a node header must start on. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | The log starts at the first byte; there is no reserved head. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Nothing to read: the alignment is the format's, not the image's. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+#### `HammerReader.DataExtent`
 
-#### `Jffs2FileReader`
+One data record: its bytes, and where the B-tree records them.
 
-Reads a JFFS2 image and extracts actual file contents by reassembling inode data nodes and matching dirent nodes. Handles the common case of uncompressed, non-fragmented single-version files. Nested entries are reassembled to their full path by walking each dirent's parent-inode (pino) chain back to the root directory.
+Implements `IEquatable<DataExtent>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Jffs2FileReader` | `Jffs2FileReader(Stream stream)` |  |
-| `Jffs2FileReader` | `Jffs2FileReader(byte[] image)` |  |
-| `Entries` | `IReadOnlyList<FileEntry> Entries { get; }` | All file entries discovered in the image. |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
-| `ExtractTo` | `long ExtractTo(FileEntry entry, Stream destination)` | Writes `entry`'s reassembled contents into `destination`, one fragment at a time. Returns the byte count. |
-| `Extract` | `byte[] Extract(FileEntry entry)` | Extracts the data for the given file entry. |
-| `OpenEntry` | `Stream OpenEntry(FileEntry entry)` | Opens `entry`'s contents as a seekable read-only stream over the image's data nodes. Nothing is copied: a read resolves the position to the fragment covering it and pulls those bytes straight out of the volume. Ranges no fragment covers — sparse holes — read back as zeros. |
-| `SizeOf` | `long SizeOf(FileEntry entry)` | The reassembled length of `entry`'s contents. |
+| `DataExtent` | `DataExtent(string Path, long Offset, long Length, long ElementOffset, long NodeOffset)` | One data record: its bytes, and where the B-tree records them. |
+| `ElementOffset` | `long ElementOffset { get; init; }` |  |
+| `Length` | `long Length { get; init; }` |  |
+| `NodeOffset` | `long NodeOffset { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Path` | `string Path { get; init; }` |  |
 
-#### `Jffs2FileReader.FileEntry`
+#### `HammerReader.FileEntry`
 
-A file or directory entry found in the JFFS2 image. `Name` is the full path from the root (e.g. "docs/api/reference.txt").
+A regular file recovered from the B-Tree: full POSIX path and exact bytes.
 
 Implements `IEquatable<FileEntry>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FileEntry` | `FileEntry(string Name, uint Inode, long NodeOffset, bool IsDirectory)` | A file or directory entry found in the JFFS2 image. `Name` is the full path from the root (e.g. "docs/api/reference.txt"). |
-| `Inode` | `uint Inode { get; init; }` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `NodeOffset` | `long NodeOffset { get; init; }` |  |
-
-#### `Jffs2FormatDescriptor`
+| `FileEntry` | `FileEntry(string Path, byte[] Content)` | A regular file recovered from the B-Tree: full POSIX path and exact bytes. |
+| `Content` | `byte[] Content { get; init; }` |  |
+| `Path` | `string Path { get; init; }` |  |
 
-JFFS2 (Journaling Flash File System v2) format descriptor. Supports: list, extract, create, true in-place R/W modify (log-append per the JFFS2 spec — fresh node at the tail with bumped version, existing nodes left byte-identical), defragment, extent map. References: `https://sourceware.org/jffs2/` — original JFFS2 site (David Woodhouse), incl. the design paper`http://www.linux-mtd.infradead.org/doc/jffs2.html` — Linux MTD project's JFFS2 documentation`https://github.com/torvalds/linux/tree/master/fs/jffs2` — mainline implementation (`jffs2_fs_i.h` / node headers)`https://en.wikipedia.org/wiki/JFFS2` — Wikipedia overview
+#### `HammerVolumeOndisk`
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Parses the HAMMER (DragonFly BSD original) volume header at byte offset 0 of each volume. Read-only; we never walk the B-tree, only surface the header fields and the `vol0_blockmap` array's byte slice. Layout per `sys/vfs/hammer/hammer_disk.h`: Verified by: `https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/vfs/hammer/hammer_disk.h` — `HAMMER_FSBUF_VOLUME` + struct definitionDragonFly Wiki `https://www.dragonflybsd.org/hammer/`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Jffs2FormatDescriptor` | `Jffs2FormatDescriptor()` |  |
-| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
-| `Category` | `FormatCategory Category { get; }` |  |
-| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
-| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `HammerVolumeOndisk` | `HammerVolumeOndisk()` |  |
+| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Header capture size we surface as `volume_header.bin` (1898 bytes covers the static fields). |
+| `MagicBytesLE` | `static readonly byte[] MagicBytesLE` | First 8 bytes at offset 0, in disk order (LE serialisation of `VolumeSignature`). |
+| `VolumeSignature` | `const ulong VolumeSignature` | HAMMER volume magic: `0xC8414D4DC5523031` ("HAMMER01" — first byte '1' = 0x31 because the 64-bit constant lives little-endian on disk). |
+| `HeaderRaw` | `byte[] HeaderRaw { get; }` |  |
+| `Valid` | `bool Valid { get; }` | True iff `VolumeSignature` matched at offset 0. |
+| `Vol0BtreeRoot` | `long Vol0BtreeRoot { get; }` |  |
+| `Vol0NextTid` | `long Vol0NextTid { get; }` |  |
+| `Vol0StatBigblocks` | `long Vol0StatBigblocks { get; }` |  |
+| `Vol0StatFreeBigblocks` | `long Vol0StatFreeBigblocks { get; }` |  |
+| `Vol0StatInodes` | `long Vol0StatInodes { get; }` |  |
+| `VolBotBeg` | `long VolBotBeg { get; }` |  |
+| `VolBufBeg` | `long VolBufBeg { get; }` |  |
+| `VolBufEnd` | `long VolBufEnd { get; }` |  |
+| `VolCount` | `int VolCount { get; }` |  |
+| `VolCrc` | `uint VolCrc { get; }` |  |
+| `VolFlags` | `uint VolFlags { get; }` |  |
+| `VolFsTypeHex` | `string VolFsTypeHex { get; }` |  |
+| `VolFsidHex` | `string VolFsidHex { get; }` |  |
+| `VolLabel` | `string VolLabel { get; }` |  |
+| `VolMemBeg` | `long VolMemBeg { get; }` |  |
+| `VolNo` | `int VolNo { get; }` |  |
+| `VolRootVol` | `uint VolRootVol { get; }` |  |
+| `VolSignature` | `ulong VolSignature { get; }` |  |
+| `VolVersion` | `uint VolVersion { get; }` |  |
+| `TryParse` | `static HammerVolumeOndisk TryParse(ReadOnlySpan<byte> image)` | Best-effort parse. Never throws. |
+
+#### `HammerWriter`
+
+Writes a single-volume HAMMER (DragonFly BSD, HAMMER1) filesystem image that DragonFly recognises and mounts. The output is a faithful port of `newfs_hammer(8)` (`sbin/newfs_hammer/newfs_hammer.c`) together with the on-disk helpers in `sbin/hammer/ondisk.c` and `sbin/hammer/blockmap.c`: it lays down the volume header, the freemap (zone-4 two-layer blockmap), the UNDO/REDO FIFO (zone-3), and a minimal root B-Tree (zone-8) holding the root directory's inode and PFS#0 records. Geometry mirrors newfs exactly: the volume is split into a 256 KB header junk area (`vol_bot_beg`), a boot area, a memory log, then the zone-2 buffer area. Every metadata block carries the version-gated CRC (see `HammerCrc`).HAMMER's UNDO FIFO has a hard minimum of `HAMMER_MIN_UNDO_BIGBLOCKS (64) * HAMMER_BIGBLOCK_SIZE (8 MB) = 512 MB`, so the smallest volume that `newfs_hammer`/this writer can format is on the order of ~1 GB. The output stream is grown to that size (sparse on filesystems that support holes).Files passed to `AddFile` are materialised as real records readable by the DragonFly kernel: each gets a regular-file inode record, a directory-entry record under the root directory (keyed by the ALG1 directory namehash) and one or more zone-11 small-data records (payload split into 16 KB blocks, each rounded up to a power-of-two block). All records, plus the root inode and PFS#0 record, live in a single sorted leaf B-Tree node — which caps the image at `HAMMER_BTREE_LEAF_ELMS (63)` elements (~20 files). Files are placed flat in the root directory (no sub-directory nesting).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `HammerWriter` | `HammerWriter()` |  |
+| `Label` | `string Label { get; set; }` | Filesystem label (max 63 chars, ASCII). Mirrors `newfs_hammer -L`. |
+| `VolumeSize` | `long VolumeSize { get; set; }` | Total volume size in bytes. Forced up to the HAMMER minimum (~1 GB) so the UNDO FIFO and freemap fit. Aligned down to `HAMMER_BUFSIZE` internally. |
+| `AddFile` | `void AddFile(string name, byte[] content)` | Adds a regular file to the root directory. The payload is materialised as a kernel-readable inode + directory entry + small-data records when the image is written. |
+| `ComputeAutoSize` | `long ComputeAutoSize()` | Smallest volume that holds the added files: the ~1 GB the UNDO FIFO and freemap need, plus the payload and its B-Tree, rounded to a big-block. |
+| `WriteTo` | `void WriteTo(Stream output)` | Formats the HAMMER volume and writes it to `output`. |
+
+### Namespace `FileSystem.Hammer2`
+
+[`Hammer2BlockMover`](#hammer2blockmover) · [`Hammer2FormatDescriptor`](#hammer2formatdescriptor) · [`Hammer2Reader`](#hammer2reader) · [`Hammer2Reader.FileRef`](#hammer2readerfileref) · [`Hammer2VolumeData`](#hammer2volumedata) · [`Hammer2Writer`](#hammer2writer)
+
+#### `Hammer2BlockMover`
+
+Moves a file's blocks inside a HAMMER2 volume, repoints the blockref that named each, and takes the chain of checks above it again.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Hammer2BlockMover` | `Hammer2BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | The largest block any file uses. A blockref names its block with a radix, so a destination has to be aligned to the block it holds. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file's block may occupy: past the volume headers. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the blockref naming the block it is given, so a file in several blocks is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A block may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the blockref tree once and notes the chain above each block. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SettleVolumeHeaders` | `void SettleVolumeHeaders(Stream image)` | Stamps the volume headers again, which carry CRCs over their own sectors. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Hammer2FormatDescriptor`
+
+Read-only descriptor for HAMMER2 (DragonFly BSD newer) filesystem images. Surfaces the volume-data sector at offset 0 plus a structured metadata bundle and the raw image. Walking the HAMMER2 cluster B-tree (radix-tree chains, blockrefs, indirect blocks) is explicitly out of scope (multi-week effort). Magic: 8-byte uint64 at offset 0 = `HAMMER2_VOLUME_ID_HBO` (`0x48414d3205172011`) or `HAMMER2_VOLUME_ID_ABO` (`0x11201705324d4148`). The descriptor's `MagicSignatures` list covers the HBO form (LE serialisation: `11 20 17 05 32 4D 41 48`); the ABO form is recognised by the parser but is rare in practice (only arises when a HAMMER2 image is cross-mounted on opposite-endian hardware). Confidence 0.85: an 8-byte magic at offset 0 is high-confidence but the detector does no secondary sanity check (e.g. volume size plausibility, fstype UUID match). References: `https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/vfs/hammer2/hammer2_disk.h``https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/sys/vfs/hammer2/DESIGN`
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Hammer2FormatDescriptor` | `Hammer2FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
 | `Description` | `string Description { get; }` |  |
 | `DisplayName` | `string DisplayName { get; }` |  |
 | `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
@@ -5695,319 +7074,361 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The only writer-honoured knob is the flash erase-block size: the image is padded up to a whole multiple of it (the JFFS2 erase-block granularity). JFFS2 is a log-structured flash filesystem with no volume-label field, so no label knob is published. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the HAMMER2 writer honours: the PFS label (`newfs_hammer2 -L`) given to the populated PFS that holds the user files. Volume size is intentionally not exposed — the boot/aux/topology floor pins the minimum regardless. An empty label falls back to the writer default ("DATA"). |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | In-place add (or replace) per JFFS2's log-structured semantic. Each input is appended as a fresh node (inode + dirent for new files; inode only with bumped version for replaces) at the end of the live log. Existing node bytes stay byte-identical at their original offsets — the reader's highest-version-wins resolution surfaces the new content. No rebuild. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
-| `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Genuine in-place (copy-on-write) add/replace of files in the labelled PFS root: new file inodes + data blocks and the rebuilt labelled-PFS → super-root → volume-header chain are appended past the topology high-water, leaving every existing file's data byte-identical at its original offset. Falls back to the verified rebuild path when the change can't be expressed as a single inline/one-indirect blockset (nested-indirect roots, nested paths). See `Hammer2InPlaceModifier`. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Produces a fresh, mountable single-volume HAMMER2 image from `inputs`. The output mirrors `newfs_hammer2`: a volume header, the super-root inode, and the "LOCAL" + labelled PFS inodes. The labelled PFS root is populated with the input files — each a regular-file inode plus a directory entry (see `Hammer2Writer`). The DragonFly kernel mounts the labelled PFS and reads every file's contents byte-exact (validated via `mount_hammer2 …@<label>` + `cksum`, including directories large enough to spill into a blockref-indirect block and files stored in an out-of-line data block). |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again by moving what is out of place. A blockref names its block by a device offset, and the check beside it covers bytes a move does not change — so the move is that one field plus the chain of checks above it, up to the volume headers' own CRCs. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Where the volume keeps its bytes: the volume headers, the inodes and the indirect blocks as structure, and each file's data blocks under its name. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single file entry as a bounded stream over the inode's reassembled data nodes. Reads past the entry's logical size return 0 (EOF). Unknown names return an empty bounded stream. |
-| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` | Re-lays the image out with the requested geometry. The generic default wrote the synthetic entries back as files, so the rebuilt image listed twelve entries where the original had eight and the rebuild was refused. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | In-place remove per JFFS2's log-structured semantic. For each named entry, an unlink dirent (`ino=0`) with `version = oldVersion + 1` is appended at the end of the log. Existing node bytes stay byte-identical; the reader's highest-version-wins resolution sees the unlink and treats the file as gone. Names that do not resolve to a live dirent are silently skipped. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros the unused (free) regions of a JFFS2 image. JFFS2 is a log-structured flash filesystem: file data lives in variably-sized inode nodes packed back to back, with no fixed cluster/block allocation — there are no cluster tips to wipe. Free space is the erased-flash tail and any padding/clean gaps, which the generic wiper zero-fills. Cluster-tip wiping is therefore N/A here: no file-size lookup is supplied and `wipeClusterTips` is forced off so the per-node log layout is never mistaken for cluster-aligned runs. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Genuine in-place (copy-on-write) removal of files from the labelled PFS root, rebuilding the chain above without disturbing surviving files' data. Falls back to the verified rebuild path when out of scope. |
 
-#### `Jffs2InPlaceModifier`
+#### `Hammer2Reader`
 
-True in-place R/W mutation of a JFFS2 image. JFFS2 is log-structured: a "modify" operation appends a fresh node (inode or dirent) at the end of the log with an incremented version number. Old nodes stay byte-identical at their original offsets; the reader resolves an inode or (parent-inode, name) pair to its highest-version node. This modifier preserves all existing bytes — only the tail of the log grows. Garbage collection (compaction of obsolete nodes) is deliberately out of scope here; that belongs to the defragmenter.Honest scope: appended data nodes carry their bytes uncompressed (`compr=0x00 JFFS2_COMPR_NONE`), matching what `Jffs2Writer` emits on Create. Compressed-body emission (LZO / zlib) is out of scope.
+Walks a HAMMER2 (DragonFly BSD) filesystem image and extracts the regular files living in its PFS roots. The walk mirrors the kernel's on-disk topology (`sys/vfs/hammer2/hammer2_disk.h`): pick the volume header (one of four 64 KB slots) with the highest valid `mirror_tid`;follow `sroot_blockset[0]` to the super-root inode, then each PFS-MASTER inode it references;walk each PFS root's blockset — descending through `HAMMER2_BREF_TYPE_INDIRECT` blocks — to gather the `HAMMER2_BREF_TYPE_DIRENT` entries (names + child inode numbers) and the child `HAMMER2_BREF_TYPE_INODE` entries (keyed by inode number); read each regular file's bytes from the inode's embedded direct data (`HAMMER2_OPFLAG_DIRECTDATA`) or its `HAMMER2_BREF_TYPE_DATA` blocks.Directories are recursed so nested files surface under a `parent/child` path. Data stored with a compression method other than `HAMMER2_COMP_NONE` (e.g. the kernel's default LZ4) is surfaced raw and flagged via `HasCompressedData` — decompression is out of scope.
+
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Add` | `static void Add(Stream image, IReadOnlyList<ValueTuple<string, byte[]>> inputs)` | Appends new files to the log. If an input name matches an existing file's path, a new inode node is appended with the same `ino` and `version = oldVersion + 1`, transparently replacing the prior content. Otherwise a fresh inode (plus any missing parent-directory inode chain) and a dirent are appended at the tail. Existing bytes are never rewritten. |
-| `Remove` | `static void Remove(Stream image, string name)` | Removes `name` by appending an unlink dirent (the JFFS2 idiom: `ino=0`) for the same `(pino, name)` pair with `version = oldVersion + 1`. The original nodes stay byte-identical; the reader's highest-version-wins resolution sees the unlink and treats the file as gone. Throws if the name does not resolve to a live dirent. |
-| `Replace` | `static void Replace(Stream image, string name, byte[] newData)` | Replaces the content of `name` with `newData`. Resolves the existing inode and appends a new inode node carrying the same `ino`, `version = oldVersion + 1`, and the fresh data bytes. Existing nodes stay byte-identical at their original offsets. Throws if the name does not resolve to an existing file. |
+| `Hammer2Reader` | `Hammer2Reader(Stream image)` | Creates a reader over a HAMMER2 volume, pulling blocks on demand. The blockref tree is a few megabytes however large the payload area behind it. |
+| `Hammer2Reader` | `Hammer2Reader(byte[] image)` | Creates a reader over the full HAMMER2 image bytes. |
+| `HasCompressedData` | `bool HasCompressedData { get; }` | True iff any extracted file's data used a compression method other than `HAMMER2_COMP_NONE` (surfaced raw). |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `Valid` | `bool Valid { get; }` | True iff a valid HAMMER2 volume header was found. |
+| `Dispose` | `void Dispose()` |  |
+| `EnumerateFiles` | `List<FileRef> EnumerateFiles()` | Surfaces every regular file in every PFS root, keyed by its path (`name` at the root, `dir/name` for nested files). Never throws — yields whatever it could parse. Contents are pulled separately through `ExtractTo`, so a listing costs nothing but the tree walk. |
+| `ExtractTo` | `long ExtractTo(FileRef file, Stream destination)` | Writes `file`'s contents into `destination`, one data block at a time. Returns the number of bytes written. |
+| `ReadAllFiles` | `Dictionary<string, byte[]> ReadAllFiles()` | Reads every regular file in every PFS root, keyed by its path (`name` at the root, `dir/name` for nested files). Never throws — returns whatever it could parse. |
 
-#### `Jffs2Writer`
+#### `Hammer2Reader.FileRef`
 
-Builds a JFFS2 (Journaling Flash File System v2) image from scratch. Produces a valid log-structured image with cleanmarkers, inode nodes, and dirent nodes. Data is stored uncompressed (compr=0x00 NONE). Default erase block size: 128 KiB (common NOR flash). Files whose name contains path separators ('/' or '\') are placed inside a real directory tree: each intermediate path segment becomes its own directory inode plus a dirent in its parent, so nested paths round-trip through the reader instead of being flattened into the root.
+A regular file the reader surfaced, with the inode needed to read it back.
+
+Implements `IEquatable<FileRef>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Jffs2Writer` | `Jffs2Writer(int eraseBlockSize = 131072)` |  |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Queues a file for inclusion in the next `Build` call. |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Queues a file whose bytes are pulled from `openStream` as the image is written, so the content never has to fit in memory. |
-| `Build` | `byte[] Build()` | Builds a complete JFFS2 image. Layout: 1. Cleanmarker at offset 0 2. Root directory inode node (inode 1, mode=dir) 3. For each path component a directory inode + dirent (parent=enclosing dir), created once and shared; for each file an inode node (data in body) + dirent node (parent=enclosing dir). 4. Remainder filled with 0xFF Image is padded to a multiple of the erase block size. |
-| `WriteTo` | `void WriteTo(Stream output)` | Writes the image to a stream, node by node — nothing is buffered whole. |
+| `FileRef` | `FileRef(string Path, long Size, byte[] Inode)` | A regular file the reader surfaced, with the inode needed to read it back. |
+| `Inode` | `byte[] Inode { get; init; }` |  |
+| `Path` | `string Path { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-### Namespace `FileSystem.Jfs`
+#### `Hammer2VolumeData`
 
-[`JfsBlockMover`](#jfsblockmover) · [`JfsEntry`](#jfsentry) · [`JfsExtentMap`](#jfsextentmap) · [`JfsFormatDescriptor`](#jfsformatdescriptor) · [`JfsReader`](#jfsreader) · [`JfsWriter`](#jfswriter)
+Parses the HAMMER2 (DragonFly BSD newer) volume header at byte offset 0. HAMMER2 keeps four redundant 64 KB volume-data sectors at offsets 0, 65536, 131072, 196608 (per `HAMMER2_VOLUME_BYTES = 65536`) — we only look at the first one. Read-only; we never walk the cluster B-tree. Layout per `sys/vfs/hammer2/hammer2_disk.h`: Verified by: `https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/vfs/hammer2/hammer2_disk.h``https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/sys/vfs/hammer2/DESIGN`
 
-#### `JfsBlockMover`
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Hammer2VolumeData` | `Hammer2VolumeData()` |  |
+| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Header capture size we surface as `volume_header.bin` — first sector (512 B). |
+| `MagicBytesHboLE` | `static readonly byte[] MagicBytesHboLE` | First 8 bytes at offset 0 in disk order — the LE serialisation of `VolumeIdHbo`. |
+| `VolumeBytes` | `const int VolumeBytes` | Volume-data sector stride (4 redundant sectors at multiples of this). |
+| `VolumeIdAbo` | `const ulong VolumeIdAbo` | Alternate-byte-order magic (volume written by an opposite-endian system). |
+| `VolumeIdHbo` | `const ulong VolumeIdHbo` | Host-byte-order magic. |
+| `AuxBeg` | `long AuxBeg { get; }` |  |
+| `AuxEnd` | `long AuxEnd { get; }` |  |
+| `BootBeg` | `long BootBeg { get; }` |  |
+| `BootEnd` | `long BootEnd { get; }` |  |
+| `ByteSwapped` | `bool ByteSwapped { get; }` | True iff the magic matched the alternate (byte-swapped) form. |
+| `CopyId` | `byte CopyId { get; }` |  |
+| `Flags` | `uint Flags { get; }` |  |
+| `FreemapVersion` | `byte FreemapVersion { get; }` |  |
+| `FsTypeHex` | `string FsTypeHex { get; }` |  |
+| `FsidHex` | `string FsidHex { get; }` |  |
+| `HeaderRaw` | `byte[] HeaderRaw { get; }` |  |
+| `Magic` | `ulong Magic { get; }` | Raw 8-byte magic value (always little-endian read). |
+| `NVolumes` | `byte NVolumes { get; }` |  |
+| `PeerType` | `byte PeerType { get; }` |  |
+| `Valid` | `bool Valid { get; }` | True iff the magic at offset 0 matched either HBO or ABO. |
+| `Version` | `uint Version { get; }` |  |
+| `VoluId` | `byte VoluId { get; }` |  |
+| `VoluSize` | `long VoluSize { get; }` |  |
+| `TryParse` | `static Hammer2VolumeData TryParse(ReadOnlySpan<byte> image)` | Best-effort parse. Never throws. |
 
-Moves a file's extents inside a JFS volume and repoints the xad descriptors that name them.
+#### `Hammer2Writer`
+
+Writes a single-volume HAMMER2 (DragonFly BSD) filesystem image that DragonFly recognises and mounts. The output is a faithful port of what `newfs_hammer2(8)` (`sbin/newfs_hammer2` together with the on-disk helpers in `sbin/hammer2/cmd_setcomp.c` and the kernel's `sys/vfs/hammer2/hammer2_disk.h`) lays down for a fresh, empty filesystem: the volume header (`struct hammer2_volume_data`) at byte offset 0 — magic, version, the boot/aux geometry, the allocator accounting, and the super-root blockset, each 512-byte sector protected by an iCRC and the whole 64 KB header by `icrc_volheader`;the super-root inode (`HAMMER2_PFSTYPE_SUPROOT`) whose embedded blockset references one or more PFS inodes;two PFS inodes — the default `"LOCAL"` plus the labelled PFS (e.g. `"DATA"`) — each a master with an empty root directory.The on-disk topology mirrors `newfs_hammer2` exactly: the volume header lives in the first of four redundant 64 KB slots (only slot #0 is populated by newfs, the kernel rolls the others forward on the first sync), the boot area starts at 4 MB, the aux area at 12 MB, and the reserved topology area (where the inodes live) begins at 20 MB (`allocator_beg`). HAMMER2 builds its freemap lazily, so a freshly formatted volume carries no freemap blocks at all — exactly what `newfs_hammer2` writes.Files passed to `AddFile` are materialised in the labelled PFS root exactly the way the DragonFly kernel lays them down: each file gets a regular-file inode (`HAMMER2_OBJTYPE_REGFILE`) keyed in the root blockset by its inode number, plus a `HAMMER2_BREF_TYPE_DIRENT` blockref keyed by `hammer2_dirhash(name)` carrying the filename inline. Payloads up to 512 bytes are embedded directly in the inode's union (`HAMMER2_OPFLAG_DIRECTDATA`); larger payloads are written to an allocated `HAMMER2_BREF_TYPE_DATA` block sized to the next power-of-two logical buffer. When the root's four embedded blockrefs overflow they spill into a `HAMMER2_BREF_TYPE_INDIRECT` block. All data blocks are stored uncompressed (`HAMMER2_COMP_NONE`) and protected by an xxHash64 check.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Hammer2Writer` | `Hammer2Writer()` |  |
+| `Label` | `string Label { get; set; }` | Filesystem PFS label (max 63 chars). Mirrors `newfs_hammer2 -L`. |
+| `VolumeSize` | `long VolumeSize { get; set; }` | Total volume size in bytes. Forced up to the HAMMER2 minimum so the boot, aux and topology-reserved areas fit, and aligned down to the 8 MB volume alignment internally. |
+| `AddFile` | `void AddFile(string name, byte[] content)` | Records a regular file to materialise in the labelled PFS root: an inode holding the content (embedded when ≤512 bytes, otherwise in an allocated data block) plus a directory entry carrying `name`. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Records a regular file whose bytes are pulled from `openStream` as the volume is written. Only the length is needed to lay out the blockrefs, so the file never has to be resident. |
+| `WriteTo` | `void WriteTo(Stream output)` | Formats the HAMMER2 volume and writes it to `output`. |
+
+### Namespace `FileSystem.Hfs`
+
+[`HfsBlockMover`](#hfsblockmover) · [`HfsEntry`](#hfsentry) · [`HfsExtentMap`](#hfsextentmap) · [`HfsFormatDescriptor`](#hfsformatdescriptor) · [`HfsModifier`](#hfsmodifier) · [`HfsReader`](#hfsreader) · [`HfsWriter`](#hfswriter)
+
+#### `HfsBlockMover`
+
+Moves a file's allocation blocks inside a classic HFS volume and repoints the extent descriptor that named them, so the file reads the same from its new home.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `JfsBlockMover` | `JfsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the maps, the tables and the inodes. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `HfsBlockMover` | `HfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | An allocation block, as the master directory block sizes it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the boot blocks, the MDB and the bitmap. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the descriptor naming the run it is given and leaves the fork's other descriptors alone, so an owner in several runs is simply several calls. |
 | `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `UsableBlocks` | `int UsableBlocks { get; }` | Blocks the aggregate uses. The fsck workspace and the log sit past them and the allocation map does not describe them. |
-| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `Init` | `void Init(Stream image)` | Reads the master directory block and locates bitmap and catalog. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SettleAllocationBitmap` | `void SettleAllocationBitmap(Stream image, IEnumerable<ValueTuple<long, long>> live)` | Writes the volume bitmap from the runs the volume actually holds. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `JfsEntry`
+#### `HfsEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `JfsEntry` | `JfsEntry()` |  |
+| `HfsEntry` | `HfsEntry()` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
 | `LastModified` | `DateTime? LastModified { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `JfsExtentMap`
+#### `HfsExtentMap`
 
-Reads a JFS volume's layout: which blocks are in use, and for the blocks a file's own xtree names, which file they belong to.
+Walks a classic HFS image and yields the actual on-disk byte layout — the boot blocks (sectors 0-1) + MDB (sector 2) + alternate MDB + volume bitmap + catalog file as `MetadataReserved`, every file record's data-fork extent as `Used`. The reader only walks the first leaf chain via fLink so coverage matches what the reader can extract.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `JfsFormatDescriptor`
+#### `HfsFormatDescriptor`
 
-Descriptor for IBM JFS1 aggregate images. Reader walks the kernel-fixed AIT (block 11), the indirect fileset AIM → IAG → FSIT path, and the inline dtree root + xtree extents. Writer emits a complete WORM image with FILESYSTEM_I → AIM → IAG → FSIT, dual superblocks, dmap+dmapctl with canonical `ujfs_adjtree` buddy tree, both AIT/AIM copies, and an inline-dtroot root directory with up to 8 user files. Validated clean against real `fsck.jfs -n -f -v`. State: R/W (extended mutation past leaf-only). `JfsMutator` implements: arbitrary path depth add/remove (descend by name through any intermediate directory whose dtree is inline OR external/router);long names via continuation slots chained through the head ldtentry's `next` byte (both insert and remove walk the chain);external dtree leaf-page insert/delete when the directory's dtroot has been promoted to a router (in-place stbl shift + freelist restore, with no split);recursive subdirectory removal — DFS the dtree, free every child file's xtree extents + inode + dmap bits, free the dtree pages themselves, then close out the entry in the parent;multi-dmap allocation — walks both dmap pages the writer reserves before declaring the image full;xtree extent allocate/free with inline xad slots and dmap binary-buddy `ujfs_adjtree` rerun for every modified dmap. Operations that genuinely need multi-week scope still throw `NotSupportedException` with a SPECIFIC message naming what's unsupported: inline dtroot leaf split, external dtree leaf split, xtree root promotion to non-leaf, IAG full / FSIT extent growth. References: `https://jfs.sourceforge.net/project/pub/jfslayout.pdf` — "JFS Layout", the official on-disk format document (superblock, dmap/dmapctl, dtree/xtree, IAG)`https://github.com/torvalds/linux/tree/master/fs/jfs` — mainline kernel implementation; jfsutils' `fsck.jfs` is the conformance gate`https://en.wikipedia.org/wiki/JFS_(file_system)` — Wikipedia overview
+References: "Inside Macintosh: Files" (Apple Computer, 1992), chapter "Data Organization on Volumes" — the canonical HFS on-disk specification (MDB, catalog/extents B*-trees)`https://www.mars.org/home/rob/proj/hfs/` — hfsutils (Robert Leslie), the classic open-source HFS implementation`https://en.wikipedia.org/wiki/Hierarchical_File_System` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `JfsFormatDescriptor` | `JfsFormatDescriptor()` |  |
-| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `HfsFormatDescriptor` | `HfsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
 | `DefaultExtension` | `string DefaultExtension { get; }` |  |
-| `Description` | `string Description { get; }` |  |
+| `Description` | `string Description { get; }` | Classic Macintosh HFS filesystem image (pre-HFS+). Writer emits a spec-compliant MDB, volume bitmap, and real extents + catalog B-trees with thread records, file records, and a root-dir record — matching Inside Macintosh: Files (1992). Scope: flat root directory, ASCII filenames, ≤ ~30 files per image (single-leaf catalog). |
 | `DisplayName` | `string DisplayName { get; }` |  |
 | `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
-| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | JFS aggregate geometry (4 KiB blocks, single allocation group, fixed metadata layout) is not tunable, so the only honoured knob is the volume label stored in the superblock `s_label[16]` field (offset 152). |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for Classic HFS creation. The Master Directory Block stores a Pascal-string volume name at `drVN` (offset 36, max 27 bytes) — the classic Mac Finder surfaces this as the disk's name. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
-| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
-| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation. JFS carries NO data checksum and stores file bodies in dedicated xtree extents (directories are stored inline in the dinode, so they never reach the streaming path), which makes the format fully streamable: pass 1 builds every metadata structure with the file extents left zero; pass 2 seeks to each file's extent and copies its bytes from `OpenStream` in 64 KiB chunks. The output is byte-identical to `Create` for the same inputs. Falls back to the buffered default on a non-seekable target. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Hfs image via `AddFile`. The modifier mutates the catalog leaf, volume bitmap, MDB, and alternate MDB in place; on leaf overflow it transparently falls back to a writer-driven rebuild so the call always succeeds. |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware JFS1 defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. The writer always emits a fresh contiguous-from-start single-aggregate image with FILESYSTEM_I → AIM → IAG → FSIT, dual superblocks, dmap+dmapctl, and an inline-dtroot. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware HFS defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. The writer always emits a contiguous, start-packed allocation block layout, so all four `DefragMode` values converge on a clean repack. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the HFS catalog B-tree leaf chain and yields the actual on-disk byte layout — boot blocks + MDB + volume bitmap + catalog file as `MetadataReserved`, every file record's data-fork extent (filExtRec[0]) as `Used`. Coverage matches what `HfsReader` can extract — first leaf chain only, single data-fork extent per file. |
 | `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every block the allocation map reports as free — which is where a removed file's bytes stay until something else claims them. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing Hfs image via `RemoveFile`. File data blocks are wiped and catalog records are excised from the leaf; missing names are silently ignored. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the HFS image: free allocation blocks, gaps between files and the block-tip slack between a file's logical size and the end of its last allocated 512-byte block. The catalog extent map clamps each file's run to its logical byte length, so trailing slack inside the final block presents as a free gap that the generic `UnusedSpaceWiper` zero-fills. The HFS extent map keys each `FileName` by the catalog leaf name, whereas `HfsReader` reports the full slash-separated path; the size lookup is therefore keyed by the leaf segment so the explicit cluster-tip pass matches. |
 
-#### `JfsReader`
+#### `HfsModifier`
 
-Reads IBM JFS1 aggregate images produced by `JfsWriter` or by real `mkfs.jfs`. Decodes the superblock, FILESYSTEM_I aggregate inode (#16), fileset inode table, and the inline dtree root directory (UCS-2 names).
+In-place HFS classic modifier — performs random-access mutation of an existing HFS image without rebuilding the entire filesystem. Tuned for the single-leaf catalog shape that `HfsWriter` emits for the common case (≤ ~30 files per image, no index node required). When an Add would overflow the single 512-byte leaf, falls back to a writer-driven rebuild transparently so the call always succeeds. What we touch on a small Add (single-leaf path):The MDB at offset 1024 — drNmFls, drFilCnt, drFreeBks, drNxtCNID, drAllocPtr, drLsMod.The alternate MDB at `(totalSectors - 2) × 512` (mirror).The volume bitmap starting at `drVBMSt × 512`.The catalog leaf node (allocation block 2 in the writer's layout).The newly-allocated allocation blocks for the file payload.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds (or replaces by name) a file. If the catalog leaf cannot fit the new records, falls back to a writer-driven rebuild so the call always succeeds. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file. Returns true if it was present and removed, false if no such entry exists. |
+
+#### `HfsReader`
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `JfsReader` | `JfsReader(Stream stream, bool leaveOpen = true)` |  |
-| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
-| `Entries` | `IReadOnlyList<JfsEntry> Entries { get; }` |  |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `HfsReader` | `HfsReader(Stream stream, bool leaveOpen = false)` |  |
+| `Entries` | `IReadOnlyList<HfsEntry> Entries { get; }` |  |
 | `Dispose` | `void Dispose()` |  |
-| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(JfsEntry entry)` | Where on disk `entry`'s bytes actually sit, one xtree extent at a time, along with the byte offset of the descriptor that names each of them. |
-| `ExtractTo` | `long ExtractTo(JfsEntry entry, Stream destination)` | Writes `entry`'s contents into `destination`, one xtree extent at a time. Returns the number of bytes written. |
-| `Extract` | `byte[] Extract(JfsEntry entry)` |  |
+| `Extract` | `byte[] Extract(HfsEntry entry)` |  |
 
-#### `JfsWriter`
+#### `HfsWriter`
 
-Writes a minimal IBM Journaled File System (JFS1) aggregate image with a single allocation group, one fileset, and an inline dtree root directory. Byte layout matches the on-disk structures in `linux/fs/jfs` and the `jfsutils` reference (mkfs.jfs / fsck.jfs); validated by exit-zero from `fsck.jfs -n -f -v`. All integer fields are little-endian. `pxd_t` is packed as `len_addr = (len & 0xFFFFFF) | ((addr >> 32) << 24)`, `addr2 = addr & 0xFFFFFFFF`. Dtree slot names are UCS-2 (UTF-16 LE). Round-trips through `JfsReader`. Aggregate inode table (block 11..14, IXSIZE=16 KB) holds the AGGR_RESERVED_I (0), AGGREGATE_I (1, → AIM), BMAP_I (2, → block-allocation map), LOG_I (3), BADBLOCK_I (4) and FILESYSTEM_I (16, → fileset AIM) metadata inodes. The fileset inode table at blocks 29..32 holds FILESET_RSVD_I (0), FILESET_EXT_I (1), ROOT_I (2, dtroot inline), ACL_I (3) and user file inodes (4+).
+Builds a spec-compliant Classic HFS disk image per Inside Macintosh: Files (1992), chapter 2 "File Manager". Layout matches what hfsutils' libhfs expects: 512-byte B*-tree nodes (libhfs hardcodes `HFS_BLOCKSZ`=512 and validates header-record offsets at exactly 0x00e/0x078/0x0f8/0x1f8). When records can't fit a single leaf, the catalog grows into multiple leaf nodes (chained via the node-descriptor fLink/bLink) and one or more index levels are stacked above them, increasing the tree depth until a single root node fans out over the whole level below it. The header node's BTMapRec caps the catalog at 2048 nodes (no chained map nodes), which still permits well over a thousand entries in a single directory. Names passed to `AddFile` may contain `'/'` separators denoting subdirectories. Each path component below the final one becomes a real catalog folder (directory record type 1 + directory thread type 3) with its own dirID, inserted under its parent's dirID; the file lands keyed under its immediate parent folder's dirID. Current scope cuts: Allocation block size fixed at 512 bytes.ASCII-only filenames (no MacRoman high-byte handling).No resource forks; resource-fork fields in file records are zero.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `JfsWriter` | `JfsWriter()` |  |
-| `BlockSize` | `const int BlockSize` |  |
-| `AddFile` | `void AddFile(string name, byte[] data)` |  |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file whose `size` drives extent + inode sizing in pass 1 of `BuildToStreaming`; the body is pulled from `openStream` in 64 KiB chunks in pass 2 and never buffered as a `byte[]`. JFS has no data checksums and stores file bodies in dedicated xtree extents, so the on-disk image is byte-identical to the classic `WriteTo` path for the same inputs. |
-| `BuildToStreaming` | `void BuildToStreaming(Stream output)` | Two-pass streaming write: pass 1 builds the complete image byte array (file data extents left zero, recorded into a sink); pass 2 seeks to each streaming file's extent and copies its body from the opener in 64 KiB chunks. The emitted bytes are identical to `WriteTo` for the same inputs — JFS carries no data checksum, so only WHERE the body bytes originate changes. Requires a writable, seekable stream. |
-| `Build` | `byte[] Build()` | Materialises the whole aggregate. |
-| `SetVolumeLabel` | `void SetVolumeLabel(string label)` | Sets the volume label written into the superblock `s_label[16]` field (offset 152). ASCII, NUL-padded, truncated to 16 bytes. |
-| `WriteTo` | `void WriteTo(Stream output)` |  |
+| `HfsWriter` | `HfsWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. The `name` may contain `'/'` (or `'\'`) separators to place the file inside a subdirectory tree; each path component must be 1–31 chars. A name with no separator lands in the volume root. |
+| `Build` | `byte[] Build()` | Builds the HFS disk image. |
+| `SetVolumeName` | `void SetVolumeName(string name)` | Sets the HFS volume name (1–27 ASCII chars). |
 
-### Namespace `FileSystem.Lif`
+### Namespace `FileSystem.HfsPlus`
 
-[`LifBlockMover`](#lifblockmover) · [`LifExtentMap`](#lifextentmap) · [`LifFormatDescriptor`](#lifformatdescriptor) · [`LifModifier`](#lifmodifier) · [`LifReader`](#lifreader) · [`LifReader.FileEntry`](#lifreaderfileentry) · [`LifReader.Volume`](#lifreadervolume) · [`LifWriter`](#lifwriter)
+[`HfsPlusBlockMover`](#hfsplusblockmover) · [`HfsPlusEntry`](#hfsplusentry) · [`HfsPlusExtentMap`](#hfsplusextentmap) · [`HfsPlusFormatDescriptor`](#hfsplusformatdescriptor) · [`HfsPlusModifier`](#hfsplusmodifier) · [`HfsPlusReader`](#hfsplusreader) · [`HfsPlusWriter`](#hfspluswriter)
 
-#### `LifBlockMover`
+#### `HfsPlusBlockMover`
 
-In-place HP LIF block mover. Moves sector-aligned extents within a LIF image and patches the directory entry's start-sector field so the file remains reachable at its new location. LIF files are stored contiguously. Each 32-byte directory entry records the name (10 bytes), file type (u16 BE at +10), start sector (u32 BE at +12), and sector count (u32 BE at +16). Updating the start-sector field is sufficient to redirect the file.
+In-place HFS+ block mover. Moves allocation-block-aligned extents and patches the catalog file record's fork-data extents + allocation bitmap so the file remains reachable at its new location. Streaming: the mover never loads the whole image. `Init` reads only the 512-byte volume header at offset 1024; all metadata updates are targeted reads/writes via `SectorCache` + `Flush` barriers so a crash mid-operation leaves the image fsck-recoverable. Multi-TB HFS+ images (catalog files alone can be tens of MB on large volumes) need only ~256 MB of cache RAM regardless of image size.
 
-Implements `IFilesystemBlockMover`.
+Implements `IFilesystemBlockMover`, `IFilesystemMetadataMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `LifBlockMover` | `LifBlockMover()` |  |
-| `DataOrigin` | `long DataOrigin { get; }` | Byte offset where the data region begins (past directory). |
-| `UnitSize` | `int UnitSize { get; }` | Allocation unit size (one 256-byte sector). |
-| `Init` | `void Init(Stream image)` | Initialises the mover by parsing the LIF volume header. Must be called before any move operations. |
+| `HfsPlusBlockMover` | `HfsPlusBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes (allocation unit). |
+| `FirstDataByte` | `long FirstDataByte { get; }` |  |
+| `RelocatableMetadata` | `IReadOnlySet<string> RelocatableMetadata { get; }` | The allocation file and the catalog file. Both are ordinary forks whose extents the volume header records, which is the whole of what says where they are — so writing a new start block moves them. The boot region and the volume header itself are pinned: the header is at a fixed offset by definition, and it is what everything else is found through. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the extent descriptor naming the run it is given and leaves the fork's other descriptors alone, so an owner in several runs is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Streaming init — reads only the 512-byte volume header at offset 1024 plus trails of catalog metadata as needed during patches. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OffsetToSector` | `int OffsetToSector(long offset)` | Converts a byte offset to a sector number. |
-| `SectorToOffset` | `long SectorToOffset(int sector)` | Converts a sector number to a byte offset. |
+| `SettleAllocationBitmap` | `void SettleAllocationBitmap(Stream image, IEnumerable<ValueTuple<long, long>> live)` | Writes the allocation bitmap from the runs the volume actually holds. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `UpdateMetadataAfterMove` | `void UpdateMetadataAfterMove(Stream image, string metadataName, long oldOffset, long newOffset, long length, IReadOnlyList<ValueTuple<long, long>> liveRanges = null)` |  |
 
-#### `LifExtentMap`
+#### `HfsPlusEntry`
 
-Walks an HP LIF (Logical Interchange Format) volume and yields the actual on-disk byte layout — the volume label sector + the directory sectors as `MetadataReserved`, every per-file contiguous 256-byte sector run as a `Used` extent, and unused sectors as `Free`. Files in LIF are always stored contiguously, so each file produces exactly one Used run.
+Represents a single file or directory entry found within an HFS+ volume image.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `HfsPlusEntry` | `HfsPlusEntry()` |  |
+| `Cnid` | `uint Cnid { get; init; }` | The Catalog Node ID assigned to this entry. |
+| `FullPath` | `string FullPath { get; init; }` | The full slash-separated path from the volume root. |
+| `IsDirectory` | `bool IsDirectory { get; init; }` | Whether this entry is a directory rather than a file. |
+| `IsSymlink` | `bool IsSymlink { get; init; }` | Whether this entry is a symbolic link (Finder type 'slnk'). |
+| `LastModified` | `DateTime? LastModified { get; init; }` | The last modification timestamp (may be null if not available). |
+| `LinkTarget` | `string LinkTarget { get; init; }` | The symlink target path (data-fork contents), or null when not a link. |
+| `Name` | `string Name { get; init; }` | The filename. |
+| `Size` | `long Size { get; init; }` | The logical file size in bytes. |
+
+#### `HfsPlusExtentMap`
+
+Walks an HFS+ (or HFSX) image and yields the actual on-disk byte layout — the reserved boot region (first 1024 bytes) + volume header + allocation file + catalog file as `MetadataReserved`, every file record's first data-fork extent (HFSPlusForkData.extents[0]) as `Used`. Mirrors what `HfsPlusReader` can extract — leaf chain via fLink, single primary extent per file. Streaming: never loads the whole image. All reads flow through a `SectorCache` so multi-TB HFS+ images (the catalog file alone can be tens of MB on large volumes) work without OOM.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `LifFormatDescriptor`
+#### `HfsPlusFormatDescriptor`
 
-Read+write descriptor for HP LIF (Logical Interchange Format) volumes — a flat-directory disk format used by the HP Series 80, HP-71/75/85 personal computers and compatible HP-IL/HP-IB peripherals from the early 1980s. References: `https://www.hp9845.net/9845/projects/hpdir/` — HPDir project; detailed description of the LIF volume/directory layout`https://github.com/bug400/lifutils` — lifutils — maintained tooling for LIF media imagesHP-UX `lif(4)` manual page — HP's own on-disk LIF description
+References: `https://developer.apple.com/library/archive/technotes/tn/tn1150.html` — Apple Technical Note TN1150 "HFS Plus Volume Format", the canonical spec (incl. HFSX and the journal)`https://github.com/torvalds/linux/tree/master/fs/hfsplus` — Linux kernel implementation`https://en.wikipedia.org/wiki/HFS_Plus` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `LifFormatDescriptor` | `LifFormatDescriptor()` |  |
-| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `HfsPlusFormatDescriptor` | `HfsPlusFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
 | `DefaultExtension` | `string DefaultExtension { get; }` |  |
-| `Description` | `string Description { get; }` |  |
+| `Description` | `string Description { get; }` | Apple HFS+ filesystem image. Writer emits full 248-byte TN1150 HFSPlusCatalogFile records with HFSPlusForkData at offsets 88/168. |
 | `DisplayName` | `string DisplayName { get; }` |  |
 | `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
-| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for HP LIF creation: 6-char volume label, directory size (one 256-byte sector holds 7 user files plus a terminator; raising this lifts the 14-file ceiling), and the default LIF file type code applied to every entry. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | HFS+ creation knobs: HFSX case-sensitivity toggle, journal enable + journal-size selector, volume name and allocation block size. The block size dropdown offers Auto (slack + table-overhead minimisation) plus the power-of-two sizes 4 KB … 64 KB that the writer supports; the journal-size knob is gated on Journal=true via DependsOn. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing LIF image. Uses `LifModifier` for true O(touched bytes) random-access I/O — only the directory sectors and the file's contiguous data run are read or written. |
-| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing HFS+ image via `AddFile`. The modifier mutates the catalog leaf, allocation bitmap, and volume header in place; on leaf overflow it transparently falls back to a writer-driven rebuild so the call always succeeds. |
+| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation: pre-known per-input sizes drive allocation-block geometry + catalog B-tree planning in pass 1; pass 2 emits the volume header + allocation bitmap + extents B-tree + catalog B-tree (with file records pointing at single-extent allocations) + the alternate volume header, then streams each input's bytes from its `OpenStream` factory into its allocated extent run via 64 KB chunks. Block tail past each entry's exact `Size` stays sparse-zero. |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware LIF defragmentor. Tries planner-driven in-place path first, falls back to rebuild path on error. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the LIF directory and yields the actual on-disk byte layout — the volume label + directory sectors as `MetadataReserved`, every per-file contiguous 256-byte sector run as a `Used` extent, and unused sectors as `Free`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware HFS+ defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. The writer always emits a contiguous, start-packed allocation block layout, so all four `DefragMode` values converge on a clean repack. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the HFS+ catalog B-tree leaf chain and yields the actual on-disk byte layout — reserved boot region + volume header + allocation file + catalog file as `MetadataReserved`, every file record's first data-fork extent (`HFSPlusForkData.extents[0]`) as `Used`. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing LIF image. Uses `LifModifier` for O(touched bytes) random-access I/O. |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing HFS+ image via `RemoveFile`. File data blocks are wiped and the catalog records are excised from the leaf node; missing names are silently ignored. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros the unused (free) sectors of a LIF volume. LIF stores each file as a contiguous run of 256-byte sectors, but the directory entry records the file length only in whole sectors — there is no byte-precise logical size on disk, so a file exactly fills its allocated sectors and there is no recoverable cluster tip. Cluster-tip wiping is therefore N/A: no file-size lookup is supplied and `wipeClusterTips` is forced off so a sector-rounded run is never trimmed below its real on-disk extent. |
-
-#### `LifModifier`
-
-Random-access in-place modifier for HP LIF (Logical Interchange Format) volumes. The on-disk layout is a flat directory of fixed 32-byte entries followed by contiguous file data; LIF has no allocation bitmap, so free space is recovered by scanning the existing directory for live extents. Files land in the lowest contiguous sector gap above the directory area that fits, mirroring the BBC DFS modifier strategy. Only the directory sectors and the file's own data run are touched on each call.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, ushort fileType = 57376)` | Adds a file to an existing LIF image. Caller is responsible for ensuring the name does not already exist (use `RemoveFile` first for replace-by-name semantics). The file is placed in the lowest contiguous gap large enough to hold it; the underlying stream is grown if necessary. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image. Returns true if found and removed. When `wipeData` is true (the default) the file data sectors are zeroed before the directory is rewritten. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the HFS+ image: free allocation blocks, gaps between files and the block-tip slack between a file's logical size and the end of its last allocated block. The catalog extent map clamps each file's first-fork run to its logical byte length, so trailing slack inside the final block presents as a free gap that the generic `UnusedSpaceWiper` zero-fills. The size lookup is keyed by the reader's full path, matching the extent map's FileName. |
 
-#### `LifReader`
+#### `HfsPlusModifier`
 
-Reader for HP LIF (Logical Interchange Format) volumes — the disk format used by the HP Series 80, HP-71, HP-75, and HP-85 personal computers as well as the HP-IL/HP-IB peripherals from that era. Volumes contain a flat directory of fixed-length files described by 32-byte directory entries.
+In-place HFS+ modifier — performs random-access mutation of an existing HFS+ image without rebuilding the whole filesystem. Designed for the single-leaf catalog shape that `HfsPlusWriter` emits (treeDepth=1, root==leaf node 1). When an Add would overflow the single leaf, the modifier falls back to a writer-driven rebuild via `HfsPlusWriter` so the operation always succeeds. What we touch on a small Add:The volume header (offset 1024) — file count, free blocks, next CNID.The alternate volume header at `imageSize-1024` (mirror).The allocation bitmap block (block 1).The catalog leaf node (block 3 → offset 3×blockSize for the standard layout).The newly-allocated data blocks for the file payload.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `LifReader` | `LifReader()` |  |
-| `LifMagic` | `const ushort LifMagic` |  |
-| `SectorSize` | `const int SectorSize` |  |
-| `Extract` | `static byte[] Extract(Volume v, FileEntry e)` |  |
-| `Read` | `static Volume Read(ReadOnlySpan<byte> image)` |  |
-
-#### `LifReader.FileEntry`
-
-Implements `IEquatable<FileEntry>`.
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds (or replaces by name) a file. If the catalog leaf cannot fit the new record, falls back to a full rebuild so the call always succeeds. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file. Returns true if it was present and removed, false if no such entry exists. |
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `FileEntry` | `FileEntry(string Name, ushort FileType, int StartSector, int LengthSectors, long ByteLength, DateTime? Created)` |  |
-| `ByteLength` | `long ByteLength { get; init; }` |  |
-| `Created` | `DateTime? Created { get; init; }` |  |
-| `FileType` | `ushort FileType { get; init; }` |  |
-| `LengthSectors` | `int LengthSectors { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `StartSector` | `int StartSector { get; init; }` |  |
+#### `HfsPlusReader`
 
-#### `LifReader.Volume`
+Reads and extracts files from an HFS+ filesystem image. Supports both HFS+ (signature "H+") and HFSX (signature "HX") volumes. The volume header resides at byte offset 1024 within the image.
 
-Implements `IEquatable<Volume>`.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Volume` | `Volume(string Label, int DirectoryStartSector, int DirectorySectors, IReadOnlyList<FileEntry> Files, byte[] Image)` |  |
-| `DirectorySectors` | `int DirectorySectors { get; init; }` |  |
-| `DirectoryStartSector` | `int DirectoryStartSector { get; init; }` |  |
-| `Files` | `IReadOnlyList<FileEntry> Files { get; init; }` |  |
-| `Image` | `byte[] Image { get; init; }` |  |
-| `Label` | `string Label { get; init; }` |  |
+| `HfsPlusReader` | `HfsPlusReader(Stream stream, bool leaveOpen = false)` | Initializes a new `HfsPlusReader` and parses the HFS+ volume. |
+| `Entries` | `IReadOnlyList<HfsPlusEntry> Entries { get; }` | Gets all file and directory entries found in the volume. |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(HfsPlusEntry entry)` | Extracts the data fork content of the specified file entry. |
 
-#### `LifWriter`
+#### `HfsPlusWriter`
 
-Writer for HP LIF volumes — flat-directory layout with the directory at sector 2 (the conventional LIF starting location). Files are stored contiguously starting after the directory; the writer enforces an upper bound of 14 files unless a caller increases the directory size.
+Creates minimal HFS+ filesystem images per Apple TN1150 ("HFS Plus Volume Format"). Produces a 4 MB image with 4 KB block size by default. Files are stored uncompressed in the data fork using single-extent allocation. The catalog file record is the full 248-byte `HFSPlusCatalogFile` layout with the data fork `HFSPlusForkData` struct at offset 88 and the resource fork `HFSPlusForkData` at offset 168, matching TN1150.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `LifWriter` | `LifWriter()` |  |
-| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeLabel = "", ushort defaultFileType = 57376, int dirSectors = 1)` | Builds a LIF image from the supplied files. `volumeLabel` is truncated/padded to 6 ASCII characters; non-ASCII bytes are replaced with '?'. |
+| `HfsPlusWriter` | `HfsPlusWriter(bool caseSensitive = false, bool journalEnabled = false, int journalSize = 8388608, string volumeName = "Untitled")` | Creates a new HFS+ writer. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to be included in the volume image. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file: `size` drives catalog + extent allocation in pass 1; bytes are pulled from `openStream` in pass 2 of `BuildToStreaming`. Never buffered as `byte[]`. |
+| `BuildAutoSized` | `byte[] BuildAutoSized(int requestedBlockSize = 0)` | Picks the allocation block size that minimises slack + structural overhead via `FilesystemLayoutOptimizer`, then builds the image. The candidate set is [4 KB … 64 KB]; most HFS+ images stay at 4 KB — the optimizer only bumps the block size for large-file sets where the bigger allocation unit cuts table overhead. |
+| `BuildToStreamingAutoSized` | `void BuildToStreamingAutoSized(Stream output, int requestedBlockSize = 0)` | Two-pass streaming Build with auto-sized allocation block. |
+| `BuildToStreaming` | `void BuildToStreaming(Stream output, uint blockSize = 4096)` | Two-pass streaming Build: pass 1 derives allocation-block geometry + catalog B-tree size from the declared sizes of `AddStreamingFile` entries; pass 2 emits the volume header + allocation bitmap + extents B-tree + catalog B-tree (with file records carrying fork descriptors pointing at the single-extent runs) + the alternate volume header, then streams each entry's bytes from its factory into its allocated block run via 64 KB chunks. Block tail past each entry's exact `Size` stays sparse-zero. |
+| `Build` | `byte[] Build(uint blockSize = 4096)` | Builds and returns the complete HFS+ volume image with the given allocation block size. |
+| `SetVolumeUuid` | `void SetVolumeUuid(ulong uuid)` | Fixes the volume's identity, for a build that has to come out the same twice. |
 
-### Namespace `FileSystem.LittleFs`
+### Namespace `FileSystem.Hpfs`
 
-[`LittleFsBlockMover`](#littlefsblockmover) · [`LittleFsFileEntry`](#littlefsfileentry) · [`LittleFsFormatDescriptor`](#littlefsformatdescriptor) · [`LittleFsInPlaceModifier`](#littlefsinplacemodifier) · [`LittleFsReader`](#littlefsreader) · [`LittleFsWriter`](#littlefswriter)
+[`HpfsBlockMover`](#hpfsblockmover) · [`HpfsEntry`](#hpfsentry) · [`HpfsFormatDescriptor`](#hpfsformatdescriptor) · [`HpfsReader`](#hpfsreader)
 
-#### `LittleFsBlockMover`
+#### `HpfsBlockMover`
 
-Moves a file's blocks inside a littlefs volume and threads the skip-list through their new homes.
+Moves a file's sectors inside an HPFS volume, repoints its fnode, and moves the allocation with it.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `LittleFsBlockMover` | `LittleFsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A block, which is what the skip-list counts in. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file's block may occupy: past the metadata pair at the front that everything is found through. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call notes where one block has got to; the pointers are threaded once the whole file has landed. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A block may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the volume once and notes what each file is made of. |
+| `HpfsBlockMover` | `HpfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A sector. An allocation entry names a starting LBA. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. Everything below LBA 32 is the fixed head of the volume — boot sector, superblock, spare block, root fnode and dirent block, and the two bitmaps — none of which is located by anything that could be repointed. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads where the volume keeps its allocation bitmap. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `SettleChains` | `void SettleChains(Stream image)` | Threads every file's skip-list through where its blocks ended up, and writes each new head into the commit that names it. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `LittleFsFileEntry`
+#### `HpfsEntry`
 
-A described file inside a littlefs image: its full slash-joined path plus the information needed to read its bytes (an inline payload or a CTZ skip-list head).
+Directory entry in an OS/2 HPFS volume.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `LittleFsFileEntry` | `LittleFsFileEntry()` |  |
-| `Path` | `string Path { get; init; }` |  |
+| `HpfsEntry` | `HpfsEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `LittleFsFormatDescriptor`
+#### `HpfsFormatDescriptor`
 
-Read-only descriptor for LittleFS images (Arduino / RTOS / IoT embedded-flash FS). Surfaces the superblock and parsed geometry. Walking the tag-based metadata pair commit log with CRC validation is intentionally out of scope — that's a full reference-implementation port. Detection + structural surfacing is the win. References: `https://github.com/littlefs-project/littlefs` — canonical littlefs source (ARM Mbed lineage)`https://github.com/littlefs-project/littlefs/blob/master/SPEC.md` — on-disk format specification`https://github.com/littlefs-project/littlefs/blob/master/DESIGN.md` — design document (metadata pairs, CTZ skip-lists)
+R/W descriptor for OS/2 HPFS (High Performance File System) volumes. Supports: list, extract, create, modify (true in-place at root level via `HpfsInPlaceModifier`), defragment, extent map. References: Ray Duncan, "Design Goals and Implementation of the New High Performance File System" (Microsoft Systems Journal, September 1989) — the original published description`https://docs.kernel.org/filesystems/hpfs.html` — Linux kernel HPFS driver documentation; `fs/hpfs` is the maintained on-disk reference`https://en.wikipedia.org/wiki/High_Performance_File_System` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `LittleFsFormatDescriptor` | `LittleFsFormatDescriptor()` |  |
+| `HpfsFormatDescriptor` | `HpfsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -6019,104 +7440,85 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The only writer-honoured knob is the block size: it is recorded in the littlefs superblock geometry (and bounds the inline-file threshold and CTZ block layout). LittleFS stores no volume label, so no label knob is published. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Genuine in-place add/replace: rewrites only the inactive half of the root metadata pair with a fresh commit at `revision+1` and appends any new CTZ / subdirectory blocks past the current block count. The active root half and every existing data block stay byte-identical at their offsets — the littlefs metadata-pair ping-pong / copy-on-write model. See `LittleFsInPlaceModifier`. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds a fresh littlefs image from `inputs`. Files keep their archive-relative paths (forward-slash separated), so subdirectories are recreated as littlefs directory metadata pairs. Small files are stored inline; larger ones use CTZ skip-lists. The result round-trips through `LittleFsReader`. |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again by moving blocks. Nothing outside a file names its blocks except the head: the rest are named from inside the file, by the pointers each block opens with. Those are threaded again from the finished order, and the head is written into the commit that names it. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | In-place root-level Add: flips bitmap bits at LBA 24 to allocate fresh data + FNODE sectors, writes them at their freshly-allocated offsets, and inserts the new dirent into the root DIRBLK at LBA 20 by shifting later dirents in place. Untouched sectors stay byte-identical. Subdirectory paths and DIRBLK overflow fall through to the rebuild path so callers always get a result. |
+| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Streaming creation: each input's length settles the layout, then its bytes are copied into the sectors it was allocated, so an entry past what a byte[] can hold never has to be materialised. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
 | `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Genuine in-place remove: drops the named entries and rewrites the inactive root half at `revision+1`. Existing live blocks stay byte-identical; the removed file's data blocks are simply no longer referenced. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
-
-#### `LittleFsInPlaceModifier`
-
-Genuine in-place modifier for littlefs v2 images emitted by `LittleFsWriter`. littlefs is inherently append/copy-on-write within its erase blocks: each metadata pair ping-pongs between its two blocks (the half with the higher revision count wins), and file data lives in CTZ skip-list blocks addressed by block index. This modifier exploits exactly that: The root metadata pair stays at blocks 0,1. A mutation rewrites only the inactive half (the one with the lower revision) with a fresh commit at `revision+1` carrying the updated directory — the active half stays byte-identical, exactly the metadata-pair ping-pong the reference driver performs.New subdirectory metadata pairs and new CTZ file data are written into blocks appended past the current block count; existing data blocks are never overwritten or relocated, so they stay byte-identical at their offsets.In-place invariant. Add / Replace / Remove preserve the active root half plus every existing CTZ/subdir block byte-identical at its offset, and grow the image by only the blocks the new tree needs (O(bytes changed) for the common flat-file case). The superblock's `block_count` is updated in the rewritten root commit (it is covered by the commit CRC, so it is re-emitted, not patched).Verification. littlefs has no Linux fsck; correctness is proven by the reader round-trip plus the byte-identity offset proof.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `Add` | `static void Add(Stream image, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
-| `Remove` | `static void Remove(Stream image, string[] entryNames)` |  |
-| `Replace` | `static void Replace(Stream image, string name, byte[] newData)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | In-place root-level Remove: zeros the file's data + FNODE sectors, flips their bitmap bits back to free, and excises the dirent from the root DIRBLK by shifting later dirents back. Untouched sectors stay byte-identical. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the HPFS image: free sectors, gaps between files and the sector-tip slack between a file's logical size and the end of its last allocated 512-byte sector. The extent map clamps each file's data run to its logical byte length, so trailing slack inside the final sector presents as a free gap that the generic `UnusedSpaceWiper` zero-fills. The size lookup is keyed by the reader's full path, matching the extent FileName. |
 
-#### `LittleFsReader`
+#### `HpfsReader`
 
-Reads a littlefs v2 image: walks each directory's metadata-pair commit log (validating the commit CRC), follows hard-tail and directory-struct links, and resolves file structs (inline payloads and CTZ skip-lists) into byte content.
+Read-only reader for OS/2 HPFS (High Performance File System) volumes.
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `LittleFsReader` | `LittleFsReader(Stream stream, bool leaveOpen = true)` |  |
-| `LittleFsReader` | `LittleFsReader(byte[] image)` |  |
-| `BlockSize` | `uint BlockSize { get; }` |  |
-| `Files` | `IReadOnlyList<LittleFsFileEntry> Files { get; }` |  |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
-| `MetadataBlocks` | `IReadOnlyCollection<uint> MetadataBlocks { get; }` | Blocks holding metadata pairs — the superblock pair and every directory's commit log. A wipe must leave these alone. |
+| `HpfsReader` | `HpfsReader(Stream stream)` |  |
+| `HpfsReader` | `HpfsReader(byte[] data)` |  |
+| `DirBlockMagic` | `static readonly byte[] DirBlockMagic` | Dirent-block magic 0x77E40AAE little-endian: `AE 0A E4 77`. |
+| `DirBlockSize` | `const int DirBlockSize` |  |
+| `FnodeMagic` | `static readonly byte[] FnodeMagic` | Fnode magic 0xF7E40AAE little-endian: `AE 0A E4 F7`. |
+| `LbaSize` | `const int LbaSize` |  |
+| `SuperblockLba` | `const int SuperblockLba` |  |
+| `SuperblockMagic` | `static readonly byte[] SuperblockMagic` | Superblock magic — the uint32 pair 0xF995E849 / 0xFA53E9C5 stored little-endian, i.e. the bytes `49 E8 95 F9 C5 E9 53 FA`. |
+| `Entries` | `IReadOnlyList<HpfsEntry> Entries { get; }` |  |
+| `RootFnodeLba` | `uint RootFnodeLba { get; }` | Root-fnode LBA from the superblock. |
 | `Dispose` | `void Dispose()` |  |
-| `FileBlocks` | `IEnumerable<uint> FileBlocks(LittleFsFileEntry entry)` | The blocks of an entry's CTZ skip-list, in file order. An inline file lives inside its directory's commit and yields nothing. |
-| `ReadFileTo` | `long ReadFileTo(LittleFsFileEntry entry, Stream destination)` | Writes `entry`'s bytes into `destination`, one CTZ block at a time. Returns the number of bytes written. |
-| `ReadFile` | `byte[] ReadFile(LittleFsFileEntry entry)` | Returns the bytes of `entry`. |
-
-#### `LittleFsWriter`
-
-From-scratch (write-once) builder for a minimal but specification-accurate littlefs v2 image. Produces a root metadata pair carrying the superblock and the root directory entries, one metadata pair per subdirectory (linked via hard-tail tags), inline structs for small files, and CTZ skip-lists for files that do not fit inline. The result round-trips through `LittleFsReader`.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `LittleFsWriter` | `LittleFsWriter(uint blockSize = 4096)` |  |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file at `name`, creating intermediate directories as needed. Forward slashes separate path components. |
-| `Build` | `byte[] Build()` |  |
-| `WriteTo` | `void WriteTo(Stream output)` |  |
+| `ExtractTo` | `void ExtractTo(HpfsEntry entry, Stream destination)` | Copies `entry`'s bytes into `destination`, a block at a time. HPFS records a file size as a uint32, so an entry can be up to 4 GB — more than `Extract` can return in an array. |
+| `Extract` | `byte[] Extract(HpfsEntry entry)` |  |
 
-### Namespace `FileSystem.Mfs`
+### Namespace `FileSystem.Htfs`
 
-[`MfsBlockMover`](#mfsblockmover) · [`MfsEntry`](#mfsentry) · [`MfsExtentMap`](#mfsextentmap) · [`MfsFormatDescriptor`](#mfsformatdescriptor) · [`MfsModifier`](#mfsmodifier) · [`MfsReader`](#mfsreader) · [`MfsWriter`](#mfswriter)
+[`HtfsBlockMover`](#htfsblockmover) · [`HtfsEntry`](#htfsentry) · [`HtfsFormatDescriptor`](#htfsformatdescriptor) · [`HtfsOptimalParameters`](#htfsoptimalparameters) · [`HtfsOptimizer`](#htfsoptimizer) · [`HtfsReader`](#htfsreader) · [`HtfsWriter`](#htfswriter)
 
-#### `MfsBlockMover`
+#### `HtfsBlockMover`
 
-In-place MFS block mover. Moves allocation-block-aligned extents within an MFS image and patches the directory entry's first-block field so the file remains reachable at its new location. MFS stores files in contiguous allocation blocks. Each directory entry records a first-block field (u16 BE at +26) and a file size (u32 BE at +28). The allocation map is derived implicitly from the union of directory entries, so updating the directory entry's first-block pointer is sufficient to redirect the file to its new location.
+Moves a file's blocks inside an HTFS volume and repoints its inode.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MfsBlockMover` | `MfsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Allocation block size in bytes. |
-| `DataOrigin` | `long DataOrigin { get; }` | Byte offset of the first allocation block. |
-| `BlockToOffset` | `long BlockToOffset(int block)` | Converts a 0-based block index to a byte offset. |
-| `Init` | `void Init(Stream image)` | Initialises geometry from the MFS MDB. Must be called before any move. |
+| `HtfsBlockMover` | `HtfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock's volume size implies it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the boot sector, the superblock and the inode table. |
+| `Init` | `void Init(Stream image)` | Reads the geometry the volume was laid out with. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OffsetToBlock` | `int OffsetToBlock(long offset)` | Converts a byte offset to a 0-based block index. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `MfsEntry`
+#### `HtfsEntry`
+
+One entry surfaced by `HtfsReader`.
+
+Implements `IEquatable<HtfsEntry>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MfsEntry` | `MfsEntry()` |  |
-| `IsDirectory` | `bool IsDirectory { get; }` |  |
+| `HtfsEntry` | `HtfsEntry(string Name, int Inode, bool IsDirectory, int Size, int FirstBlock)` | One entry surfaced by `HtfsReader`. |
+| `FirstBlock` | `int FirstBlock { get; init; }` |  |
+| `Inode` | `int Inode { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
-| `Size` | `long Size { get; init; }` |  |
+| `Size` | `int Size { get; init; }` |  |
 
-#### `MfsExtentMap`
+#### `HtfsFormatDescriptor`
 
-Walks a Macintosh MFS image (0xD2D7 magic at offset 1024) and yields the actual on-disk byte layout — system area (boot blocks + MDB), file directory area, every file's contiguous data range (per the writer's simplified linear allocation), and the unused tail as Free. MFS uses a packed 12-bit block map but our writer-produced images are linear, so we walk directory entries and emit one extent per file based on (firstBlock, size).
+SCO HTFS (High Throughput File System) — S5-derived FS introduced in SCO OpenServer 5. Now exposes a WORM writer + reader with real nested subdirectories, defrag/purge/conversion, fileset optimizer, and an options schema (BlockSize / InodeCount / VolumeLabel). References: SCO OpenServer 5 Development System documentation, `sys/fs/htfs/htfs_fs.h` — the vendor header defining the on-disk structures (no stable public URL)`https://en.wikipedia.org/wiki/SCO_OpenServer` — Wikipedia overview of the host OS
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
-
-#### `MfsFormatDescriptor`
-
-R/W descriptor for Classic Macintosh MFS (Macintosh File System) 400 KB floppy volumes — the flat-directory predecessor of HFS, MDB magic 0xD2D7. References: Apple "Inside Macintosh, Volume II" (File Manager chapter, Addison-Wesley 1985) — the canonical MFS description`https://en.wikipedia.org/wiki/Macintosh_File_System` — Wikipedia article
-
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `MfsFormatDescriptor` | `MfsFormatDescriptor()` |  |
+| `HtfsFormatDescriptor` | `HtfsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -6128,94 +7530,110 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for Classic Macintosh MFS creation. MFS is a flat 400 KB floppy filesystem with a single MDB-stored volume name; the writer emits the canonical 400 KB image, so VolumeLabel is the only meaningful per-volume knob. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing MFS image. Uses `MfsModifier` for true O(touched bytes) random-access I/O — only the MDB (1 sector) + directory area + the new file's data blocks are read or written. The rest of the image is untouched. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware MFS defragmentor. Tries planner-driven in-place path first, falls back to rebuild path on error. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the MDB + directory area + per-file allocation and yields the actual on-disk byte layout. The system area (boot + MDB + directory) becomes a single `MetadataReserved` extent, every file emits one Used extent at its `(firstBlock × blockSize)` location, and the unused tail is emitted as Free. Suitable for our writer's linear-allocated images; the on-disk footprint is rounded up to the block size. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing MFS image. Uses `MfsModifier` for O(touched bytes) random-access I/O — locates the directory entry, secure-wipes the data blocks, and clears the entry's in-use bit. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in an MFS image: free allocation blocks and the cluster-tip slack between each file's logical size and the end of its last 1024-byte allocation block. MFS stores file data contiguously and each extent's FileName matches the directory-entry name, so a size lookup built from the reader lets the generic `UnusedSpaceWiper` trim each tip precisely without touching the system area (boot + MDB + directory). |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
-#### `MfsModifier`
+#### `HtfsOptimalParameters`
 
-In-place modifier for MFS (Macintosh File System) disk images. Performs add / remove on an existing image with strict O(touched bytes) I/O — only reads the volume info block (sector 2), the file directory area (sectors 3 through `drAlBlSt - 1`), and the affected file's allocation blocks. Never reads or writes the entire image. The companion `MfsWriter` rebuilds an image from scratch; this class is for the "I have an existing image, mutate it" path that `IArchiveModifiable` exposes.Layout reminders for the simplified MFS variant produced by `MfsWriter` and consumed by `MfsReader`: Sectors 0-1: boot blocks (1024 bytes total).Sector 2 (offset 1024): MDB / volume info block — magic 0xD2D7 BE, `drNmAlBlks` at +18 (u16 BE), `drAlBlkSiz` at +20 (u32 BE), `drAlBlSt` (first allocation-block sector) at +28 (u16 BE), volume name pstring at +36.File directory: starts at offset 1024+128 (= 1152, mid sector 2) and runs up to `drAlBlSt * 512`.Each directory entry is variable length: +0: flags byte (0x80 = in use, 0 = end-of-directory marker).+1: version byte.+26: first allocation block (u16 BE, 0-based within data area).+28: logical EOF / data size in bytes (u32 BE).+38: name length byte.+39..: ASCII name, padded so total entry length is even.Allocation blocks (`drAlBlkSiz` bytes each, typically 1024) start at `drAlBlSt * 512` and are stored contiguously per file. Block IDs are 0-based within the data area in this implementation.Real-MFS-on-disk would also have a 12-bit packed block map between the MDB and the directory; the simplified writer omits it. The modifier therefore derives allocation status by walking the existing directory entries (each entry covers blocks `FirstBlock`..`FirstBlock + ⌈Size / drAlBlkSiz⌉ - 1`), which matches what the round-trip reader/writer already do. This keeps the on-disk format compatible with the round-trip path.
+Optimal HTFS layout as picked by `Find`.
+
+Implements `IEquatable<HtfsOptimalParameters>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to the existing MFS image. Performs in-place modification: derives the allocation map from existing directory entries, allocates a contiguous run of free blocks, writes the file data, and writes a new directory entry into the first free slot. Bytes touched: 1 MDB sector + the directory sectors that get walked + the file's data blocks + the dir sector(s) containing the new entry. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file from the existing MFS image. Walks the directory to locate the entry, optionally wipes the file's allocation blocks, and clears the directory entry's flags byte (and shifts later entries in the same sector left to keep the directory chain contiguous, since MFS uses a 0-flags byte as end-of-directory marker). Returns true if the file was found and removed, false otherwise. Bytes touched: 1 MDB sector + the directory sectors walked + the removed file's data blocks (if wiping) + dir sector containing the entry. |
+| `HtfsOptimalParameters` | `HtfsOptimalParameters(int BlockSize, int InodeCount, long EstimatedImageBytes)` | Optimal HTFS layout as picked by `Find`. |
+| `BlockSize` | `int BlockSize { get; init; }` |  |
+| `EstimatedImageBytes` | `long EstimatedImageBytes { get; init; }` |  |
+| `InodeCount` | `int InodeCount { get; init; }` |  |
 
-#### `MfsReader`
+#### `HtfsOptimizer`
 
-Implements `IDisposable`.
+Fileset-driven optimizer for HTFS. Picks the smallest 512/1024/2048 block size where total wasted slack is ≤ 5% AND the estimated image size is ≤ 2× the sum of file sizes. Tiebreaks toward larger blocks (fewer inodes, less indirect-pointer overhead).
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MfsReader` | `MfsReader(Stream stream, bool leaveOpen = false)` |  |
-| `Entries` | `IReadOnlyList<MfsEntry> Entries { get; }` |  |
-| `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(MfsEntry entry)` |  |
+| `Find` | `static HtfsOptimalParameters Find(IReadOnlyList<long> fileSizes)` |  |
 
-#### `MfsWriter`
+#### `HtfsReader`
 
-Builds a minimal MFS disk image.
+Read-side companion to `HtfsWriter`. Walks the SB at sector 1, the inode array immediately after, and every directory body to surface the file tree at full nested paths.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MfsWriter` | `MfsWriter()` |  |
-| `VolumeName` | `string VolumeName { get; set; }` | MFS volume name written into the MDB at offset 36 (Pascal string, max 27 chars). Shown by the classic Mac Finder as the disk's name. Default "Untitled". |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. |
-| `Build` | `byte[] Build()` | Builds the MFS disk image. |
+| `HtfsReader` | `HtfsReader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<HtfsEntry> Entries { get; }` | All non-root entries (files + intermediate directories). |
+| `Extract` | `byte[] Extract(HtfsEntry entry)` | Extracts the file's bytes via its single contiguous extent. |
 
-### Namespace `FileSystem.MinixFs`
+#### `HtfsWriter`
 
-[`MinixFsBlockMover`](#minixfsblockmover) · [`MinixFsEntry`](#minixfsentry) · [`MinixFsExtentMap`](#minixfsextentmap) · [`MinixFsFormatDescriptor`](#minixfsformatdescriptor) · [`MinixFsInPlaceModifier`](#minixfsinplacemodifier) · [`MinixFsReader`](#minixfsreader) · [`MinixFsWriter`](#minixfswriter)
+Minimal but spec-keyed writer for SCO HTFS (High Throughput File System). Emits a real `HtfsMagic`-tagged superblock at byte offset 512 (sector 1) followed by an inode array (one block per 4 inodes) and per-file single-extent layout in subsequent blocks. Scope. S5-derived HTFS uses 512-byte blocks (BlockSize knob can override), block-based inode array immediately after the SB, and directory bodies storing 16-byte name + inode entries. The on-disk magic + s_isize/s_fsize fields are spec-compliant so `TryParse` recognises the image. Real SCO HTFS additionally maintains a journal, a duplicate superblock at sector S, and extent btrees — all out of scope for the WORM writer.
 
-#### `MinixFsBlockMover`
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `HtfsWriter` | `HtfsWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the layout is settled from it before a byte is read, so a payload past what a byte[] can hold is placed like any other. |
+| `Build` | `byte[] Build()` | Materialises the whole volume. |
+| `SetBlockSize` | `void SetBlockSize(int blockSize)` | Sets the block size. Valid: 512, 1024, 2048. |
+| `SetVolumeLabel` | `void SetVolumeLabel(string label)` | Sets the volume label written into the SB tail area (truncated to 16 chars). |
+| `WriteTo` | `void WriteTo(Stream output)` | Writes the volume into `output`: the blocks the filesystem populates, then each file's bytes at the offset it was allocated. Only a non-seekable target has to materialise the volume, so a seekable one is bounded by the disk rather than by what a byte[] can address. |
 
-In-place Minix v3 block mover. Moves zone-aligned extents within a MinixFS image and patches inode zone pointers + zone bitmap so the file remains reachable. Streaming: the image is never loaded whole. Reads go through a `SectorCache`; metadata updates (inode zone pointers, zone bitmap bits) are targeted single-region writes with `Flush` barriers between steps so a crash mid-update leaves the image in an fsck-recoverable state.
+### Namespace `FileSystem.Human68k`
+
+[`Human68kBlockMover`](#human68kblockmover) · [`Human68kEntry`](#human68kentry) · [`Human68kExtentMap`](#human68kextentmap) · [`Human68kFormatDescriptor`](#human68kformatdescriptor) · [`Human68kModifier`](#human68kmodifier) · [`Human68kOptimizer`](#human68koptimizer) · [`Human68kOptimizer.Human68kLayout`](#human68koptimizerhuman68klayout) · [`Human68kReader`](#human68kreader) · [`Human68kWriter`](#human68kwriter)
+
+#### `Human68kBlockMover`
+
+Moves a file's clusters inside a Human68k volume and relinks its chain.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixFsBlockMover` | `MinixFsBlockMover()` |  |
+| `Human68kBlockMover` | `Human68kBlockMover()` |  |
+| `ClusterSize` | `int ClusterSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. |
+| `Init` | `void Init(Stream image)` | Reads the volume's geometry from its boot sector. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `MinixFsEntry`
+#### `Human68kEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixFsEntry` | `MinixFsEntry()` |  |
-| `InodeNumber` | `int InodeNumber { get; init; }` |  |
+| `Human68kEntry` | `Human68kEntry()` |  |
+| `Attributes` | `byte Attributes { get; init; }` |  |
+| `FirstCluster` | `int FirstCluster { get; init; }` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
-| `Size` | `int Size { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-#### `MinixFsExtentMap`
+#### `Human68kExtentMap`
 
-Walks a Minix filesystem image (v1/v2/v3) and yields the actual on-disk byte layout: the boot block + superblock + inode/zone bitmaps + inode table as a single `MetadataReserved` run, each directory's zones as `MetadataReserved` (they hold directory entries, not file payload), and each regular file's data zones as `Used` runs. Unclaimed zones are reported as `Free`. This replaces the earlier synthetic layout that fabricated `offset += size` extents — those never matched the real zone offsets, so any consumer that zero-filled the gaps (e.g. the unused-space wiper) would have corrupted live file data, inode tables and bitmaps.For a regular file whose data zones are contiguous, a single Used extent is emitted with the file's name as `FileName` so the wiper can locate the zone tip via a size lookup. A file split across non-contiguous zone runs emits one Used extent per run with a name that is deliberately absent from the size lookup, so tip trimming never misfires on a run that does not start at file offset zero.
+Enumerates the on-disk byte layout of a Human68k disk image: boot sector, FAT(s), and root directory are emitted as `MetadataReserved`; every file's first cluster + size is collapsed into one `Used` extent (Human68k's reader currently surfaces only the first contiguous run); unattributed sectors are left for the caller to fill as `Free`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Walks the image and yields the metadata + file extents. |
 
-#### `MinixFsFormatDescriptor`
+#### `Human68kFormatDescriptor`
 
-R/W descriptor for Minix filesystem images (v1/v2/v3 superblock magics) — the ext-family ancestor used by the Minix teaching OS and early Linux. References: `https://github.com/torvalds/linux/blob/master/include/uapi/linux/minix_fs.h` — canonical on-disk structures for all versions`https://github.com/torvalds/linux/tree/master/fs/minix` — Linux reference implementationTanenbaum & Woodhull, "Operating Systems: Design and Implementation" — the original Minix FS design`https://en.wikipedia.org/wiki/Minix_file_system` — Wikipedia article
+Descriptor for Sharp X68000 Human68k disk images. The Human68k filesystem is FAT12-derived with Shift_JIS filenames and an "X68K" identifier at boot-sector offset 0x10. Recognised extension is `.dim` (Disk Image Manager); the `.hdf` extension that Human68k historically used is intentionally NOT claimed here — it collides with the more-common HDF4 scientific data format, which owns `.hdf` in this registry. Human68k supports subdirectories per the FAT12 model; the current minimal writer emits a single flat root directory only — hierarchical writes are deferred. The reader handles subdirectory dirents at the root by surfacing them as entries with `IsDirectory` set, but does not recurse into them (kept honest in the descriptor capabilities).Capabilities: read + write (flat-only writer), defragment via extract-and-rebuild, free-space wiping driven by the extent map, and creation-options schema for bytes-per-sector / sectors-per-cluster / total-sectors / volume label. References: Sharp / Hudson Soft "Human68k" manuals — the original vendor documentation of the FAT12-derived filesystem`https://en.wikipedia.org/wiki/Human68k` — Wikipedia overview`https://en.wikipedia.org/wiki/Sharp_X68000` — Wikipedia overview of the host platform
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixFsFormatDescriptor` | `MinixFsFormatDescriptor()` |  |
+| `Human68kFormatDescriptor` | `Human68kFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -6227,112 +7645,139 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `ReclaimSupport` | `LayoutReclaim ReclaimSupport { get; }` | A zone pointer of zero names no zone, so a run of zeros need not be allocated; and the inode counts the names pointing at it, so identical files can share one copy under several of them. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for Human68k creation: bytes per sector, sectors per cluster, total sectors, and volume label. Sector size is locked at 512 B for safe interop with the reader's Extract path. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing MinixFs image using `MinixFsInPlaceModifier` for TRUE in-place O(touched bytes) random-access I/O across V1, V2 and V3 superblock variants — only the inode bitmap byte, zone bitmap byte, the new inode slot, the affected directory zone and the file's data zones are written; every other byte of the image stays identical. Falls back to whole-image rebuild only when the image has no free inode/zone or the file exceeds the direct-pointer ceiling. |
-| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation: pre-known per-input sizes drive the Minix v3 zone allocation in pass 1; pass 2 writes the metadata image with each file's data zones left zero, then streams each input's bytes from its `OpenStream` factory into its first allocated zone via 64 KB chunks. The output is byte-identical to `Create` for the same inputs (Minix has no data checksums). Falls back to the buffered default when the target stream is not seekable. Note: Minix v3 caps a file at 7 direct zones (7168 bytes), so large-file streaming is bounded by that ceiling. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Human68k image. Tries genuine O(touched bytes) in-place I/O via `Human68kModifier` (allocate contiguous free clusters, chain the FAT, write the dirent); only when the disk has no room (no free dir slot / no contiguous run) does it fall back to a growing rebuild that re-sizes the image. |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware MinixFs defragmentor. Tries the planner-driven in-place path first, falling back to the rebuild path on error. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the superblock, inode table and per-inode zone pointers to yield the real on-disk byte layout — metadata region, directory zones, and each file's data-zone runs at their true offsets. See `MinixFsExtentMap`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing MinixFs image using `MinixFsInPlaceModifier` for true in-place O(touched bytes) random-access I/O across V1/V2/V3. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in a Minix image: free zones and the cluster-tip slack between a file's logical size (i_size) and the end of its last 1024-byte zone. Data zones are reached through the inode's zone pointers and the writer allocates them contiguously per file, so a size lookup keyed by file name lets the generic `UnusedSpaceWiper` trim each tip precisely without touching the inode table, bitmaps or directory zones. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in place: frees the FAT chain, wipes the clusters, and marks the dirent deleted (0xE5). |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all bytes not claimed by the boot sector, the FAT, the root directory, or a live file's cluster run. Cluster-tip wiping uses the directory entry's file size when `wipeClusterTips` is true. |
 
-#### `MinixFsInPlaceModifier`
+#### `Human68kModifier`
 
-TRUE in-place R/W modifier for Minix v1/v2/v3 filesystem images. Performs O(touched bytes) random-access mutation: only the superblock, the relevant inode/zone bitmap bytes, the affected inode slot, the root directory zone, and the file's data zones are read or written. All other bytes of the image remain byte-identical. The version is autodetected from the superblock magic at byte offsets 1040 (V1/V2) or 1048 (V3) of the image: 0x137F — V1, 14-char names0x138F — V1, 30-char names0x2468 — V2, 14-char names0x2478 — V2, 30-char names0x4D5A — V3, 60-char namesHonest scope: file data is stored only via direct-zone pointers. Larger files (single-indirect, double-indirect, triple-indirect allocation) are deferred — callers asking for files larger than `7 * blockSize` must fall back to rebuild. Subdirectory creation is deferred for the same reason. Existing indirect-allocated file content is still correctly freed on Remove, however.
+In-place modifier for Sharp X68000 Human68k (FAT12) disk images. Performs add / remove with strict O(touched bytes) I/O — only the FAT sector(s) covering the touched cluster chain, the affected root-directory entry, and the file's data clusters are read or written. Existing files' data bytes stay byte-identical at their original cluster offsets, and a same-size update never changes the image length. The companion `Human68kReader` surfaces only the first contiguous cluster-aligned run of a file, so this modifier allocates contiguous cluster runs (and chains them in the FAT) — the data is therefore both reader-faithful and FAT-correct.Returns `false` from `TryAddFile` when the disk has no contiguous free run / no free directory slot, so the caller can fall back to a growing rebuild for those genuinely-unsupported cases.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to the existing image in-place. The file is stored via direct-zone pointers only. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image in-place. Returns `false` if not found. Frees every direct-pointer data zone the inode lists; indirect-allocated zones (single/double/triple) are also enumerated and freed. |
-| `Replace` | `static bool Replace(Stream image, string name, byte[] data)` | Replaces the data of a named file in-place. If the new data fits in the inode's already-allocated direct zones, the data is rewritten verbatim (zones unchanged); otherwise the file is fully reallocated — old direct zones are freed and new zones (still direct-only) are allocated. |
+| `IsHuman68k` | `static bool IsHuman68k(Stream image)` | True if the stream parses as a Human68k FAT12 volume. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file in place: frees its FAT chain, optionally wipes the cluster data, and marks the directory entry deleted (0xE5). Returns true if found. |
+| `TryAddFile` | `static bool TryAddFile(Stream image, string name, byte[] data)` | Attempts a genuine in-place add. Returns false (image untouched) when there is no free directory slot or no contiguous free cluster run. |
 
-#### `MinixFsReader`
+#### `Human68kOptimizer`
 
-Reads Minix filesystem images (v1, v2, v3). Parses the superblock, inode table, and directory entries. Supports direct, single-indirect, double-indirect, and triple-indirect zone pointers (v3). V1/V2 support direct and single/double indirect.
+Picks the smallest sectors-per-cluster value for a Human68k disk that fits the supplied file set with ≤ 5 % wasted slack. Sector size is fixed at 512 B; the candidate values are powers of two between 1 and 16 SPC.
 
-Implements `IDisposable`.
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Find` | `static Human68kLayout Find(IReadOnlyList<long> fileSizes)` | Returns the smallest sectors-per-cluster whose total cluster footprint for `fileSizes` is within 5 % of the cluster-aligned payload size; falls back to SPC=1 if no candidate satisfies the slack threshold. The total sector count is set to fit metadata + clusters with a 1-sector boot, 1-FAT, 32-entry root. |
+
+#### `Human68kOptimizer.Human68kLayout`
+
+One layout preset.
+
+Implements `IEquatable<Human68kLayout>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixFsReader` | `MinixFsReader(Stream stream, bool leaveOpen = false)` |  |
-| `Entries` | `IReadOnlyList<MinixFsEntry> Entries { get; }` |  |
-| `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(MinixFsEntry entry)` |  |
+| `Human68kLayout` | `Human68kLayout(int BytesPerSector, int SectorsPerCluster, int TotalSectors)` | One layout preset. |
+| `BytesPerCluster` | `int BytesPerCluster { get; }` | Bytes per cluster. |
+| `BytesPerSector` | `int BytesPerSector { get; init; }` |  |
+| `SectorsPerCluster` | `int SectorsPerCluster { get; init; }` |  |
+| `TotalBytes` | `int TotalBytes { get; }` | Total raw image size. |
+| `TotalSectors` | `int TotalSectors { get; init; }` |  |
 
-#### `MinixFsWriter`
+#### `Human68kReader`
 
-Builds minimal Minix v3 filesystem images. Uses 1024-byte blocks and creates real directory inodes for every path component, so a file added as `"a/b/c.txt"` is stored under nested directories `a` and `a/b`. Files are stored using direct zone pointers (up to 7 direct zones per file = up to 7168 bytes with 1K blocks). Directories may span multiple zones: their fixed-size entries fill the 7 direct zones and then a single-indirect zone, allowing a directory to hold thousands of entries (7 + 1024/4 = 263 zones = 4208 entries with 1K blocks).
+Reads Sharp X68000 Human68k disk images. Human68k uses a FAT12-like filesystem with an extended Shift_JIS-aware directory record format — Japanese file names are stored in Shift_JIS, and the BPB at offset 0x10 carries a Human68k-specific identifier. Boot sector layout (little-endian, sector 0): 0x00 byte[3] jump (0x60 or 0xEB or 0xE9) 0x03 char[8] OEM name — Human68k disks typically carry "X68K" at offset 0x10, but many images put OEM at offset 0x03 0x0B u16 bytes per sector 0x0D byte sectors per cluster 0x0E u16 reserved sector count 0x10 char[4] "X68K" tag (Human68k identifier — primary detection magic) 0x14 byte number of FATs 0x15 u16 root directory entry count 0x17 u16 total sectors (small) 0x19 byte media descriptor 0x1A u16 sectors per FAT 0x1C u16 sectors per track 0x1E u16 heads 0x20 u32 hidden sectors Directory entry layout (32 bytes; same as DOS FAT12 with attributes, but filename can use Shift_JIS encoding): 0x00 char[8] filename 0x08 char[3] extension 0x0B byte attributes (0x10=dir, 0x08=volume label, 0x80=killed) 0x1A u16 first cluster 0x1C u32 file size
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixFsWriter` | `MinixFsWriter(Stream output, bool leaveOpen = false)` |  |
-| `DeduplicateWithLinks` | `bool DeduplicateWithLinks { get; set; }` | Store one copy of files whose bytes are identical and give the rest a second name for it. |
-| `MakeSparse` | `bool MakeSparse { get; set; }` | Leave a zone unallocated where the file holds nothing but zeros. |
-| `AddFile` | `void AddFile(string path, byte[] data)` | Registers a file to be written into the image. |
-| `AddStreamingFile` | `void AddStreamingFile(string path, long size, Func<Stream> openStream)` | Registers a streaming file: `size` drives zone allocation and inode sizing during `Finish`; bytes are pulled from `openStream` after the metadata image is written, copied directly into the file's data zones in 64 KB chunks (only when the output stream is seekable). Never buffered as `byte[]`. |
+| `Human68kReader` | `Human68kReader(Stream stream)` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `Entries` | `IReadOnlyList<Human68kEntry> Entries { get; }` |  |
+| `FatCount` | `int FatCount { get; }` |  |
+| `ReservedSectors` | `int ReservedSectors { get; }` |  |
+| `RootEntries` | `int RootEntries { get; }` |  |
+| `SectorsPerCluster` | `int SectorsPerCluster { get; }` |  |
+| `SectorsPerFat` | `int SectorsPerFat { get; }` |  |
+| `ValidVolume` | `bool ValidVolume { get; }` |  |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` |  |
 | `Dispose` | `void Dispose()` |  |
-| `Finish` | `void Finish()` | Builds and writes the Minix v3 filesystem image to the output stream. |
+| `Extract` | `byte[] Extract(Human68kEntry entry)` |  |
 
-### Namespace `FileSystem.MinixV1`
+#### `Human68kWriter`
 
-[`MinixV1BlockMover`](#minixv1blockmover) · [`MinixV1Entry`](#minixv1entry) · [`MinixV1ExtentMap`](#minixv1extentmap) · [`MinixV1FormatDescriptor`](#minixv1formatdescriptor) · [`MinixV1InPlaceModifier`](#minixv1inplacemodifier) · [`MinixV1Reader`](#minixv1reader) · [`MinixV1Writer`](#minixv1writer)
+Builds a fresh Sharp X68000 Human68k disk image from scratch. The format is FAT12-derived: a BIOS Parameter Block at sector 0 with an extra "X68K" identifier at offset 0x10 (Human68k's primary detection magic), one or two FAT12 copies, a fixed-size root directory, and a data area of N clusters.
 
-#### `MinixV1BlockMover`
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Human68kWriter` | `Human68kWriter()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds one file. Subdirectories not supported in this minimal writer. |
+| `Build` | `byte[] Build()` |  |
+| `SetBytesPerSector` | `void SetBytesPerSector(int value)` | Sets bytes per sector (256/512/1024). Default 512. |
+| `SetSectorsPerCluster` | `void SetSectorsPerCluster(int value)` | Sets sectors per cluster (power of two, 1..32). |
+| `SetTotalSectors` | `void SetTotalSectors(int value)` | Sets total sector count. 0 = auto (sized to fit files). |
+| `SetVolumeLabel` | `void SetVolumeLabel(string label)` | Sets the volume label (max 11 chars). |
 
-Moves a file's zones inside a Minix V1 volume, repoints the pointers that name them, and moves the allocation with them.
+### Namespace `FileSystem.Iso`
+
+[`IsoBlockMover`](#isoblockmover) · [`IsoEntry`](#isoentry) · [`IsoExtentMap`](#isoextentmap) · [`IsoFormatDescriptor`](#isoformatdescriptor) · [`IsoModifier`](#isomodifier) · [`IsoReader`](#isoreader) · [`IsoWriter`](#isowriter)
+
+#### `IsoBlockMover`
+
+In-place ISO 9660 block mover. ISO files are single-extent contiguous by spec (ECMA-119), so moving a file means patching the directory record's extent LBA and data length fields. The PVD is also patched for volume space size adjustments if needed. Streaming: reads only the PVD + directory sectors via a `SectorCache`. A 100 GB DVD/BD image never gets loaded as a whole — only the touched sectors are read, and each metadata write is followed by a `Flush` barrier so a crash mid-move can never reference garbage.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV1BlockMover` | `MinixV1BlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A zone, which is a block at the zone size this writer uses. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the bitmaps and the inode table. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `IsoBlockMover` | `IsoBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A sector. A directory record names one, not a byte. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | Byte offset of the first data sector (sector 0). |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the record it is given and nothing else, so an owner in several runs — which this format cannot produce — would be several calls. |
+| `SectorSize_` | `int SectorSize_ { get; }` | Sector size. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full image be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the directory once and notes where every record is. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` |  |
 
-#### `MinixV1Entry`
+#### `IsoEntry`
+
+Represents an entry (file or directory) in an ISO 9660 image.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV1Entry` | `MinixV1Entry()` |  |
-| `InodeNumber` | `int InodeNumber { get; init; }` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `Size` | `int Size { get; init; }` |  |
+| `IsoEntry` | `IsoEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` | Whether the entry is a directory. |
+| `LastModified` | `DateTime? LastModified { get; init; }` | Last modification timestamp. |
+| `Name` | `string Name { get; init; }` | Path of the entry within the image. |
+| `Size` | `long Size { get; init; }` | Size in bytes (0 for directories). |
 
-#### `MinixV1ExtentMap`
+#### `IsoExtentMap`
 
-Reports where a Minix V1 volume's bytes are: its structures, each file's zones under its name, and what nothing holds.
+Walks an ISO 9660 image and yields its actual on-disk byte layout — the 32 KiB system area, every Volume Descriptor sector (PVD/SVD/VDST), the path tables, every directory record's contiguous extent (ISO 9660 spec requires single-extent files), and the trailing free space. Each file surfaces as exactly one Used extent because ECMA-119 mandates contiguous allocation. Streaming: reads only the volume descriptor sectors + one directory's contents at a time through a `SectorCache`. A 100 GB DVD/BD image needs only ~256 MB of cache regardless of size — directory bytes are pulled on-demand from disk rather than loaded whole.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Single-pass walker. Parses volume descriptors at sector 16+, then walks the directory tree from the root. Each file directory record carries an (extent_LBA, length) pair which is yielded as a single contiguous run. |
 
-#### `MinixV1FormatDescriptor`
+#### `IsoFormatDescriptor`
 
-Read-only descriptor for the original Minix v1 filesystem (1987, Tanenbaum). 1024-byte blocks, 16-bit zone numbers, 32-byte inodes (7 direct + 1 indirect + 1 double-indirect), magic 0x137F (14-byte names) or 0x138F (30-byte names — Coherent variant). Predecessor to Linux's ext filesystem family. References: `https://github.com/torvalds/linux/blob/master/include/uapi/linux/minix_fs.h` — canonical on-disk structures (v1 layout + 0x137F/0x138F magics)Tanenbaum & Woodhull, "Operating Systems: Design and Implementation" — the original Minix FS design`https://en.wikipedia.org/wiki/Minix_file_system` — Wikipedia article
+Format descriptor for ISO 9660 optical disc images. References: `https://ecma-international.org/publications-and-standards/standards/ecma-119/` — ECMA-119 (the freely available equivalent of ISO 9660), the defining standard`https://github.com/torvalds/linux/tree/master/fs/isofs` — Linux kernel implementation`https://en.wikipedia.org/wiki/ISO_9660` — Wikipedia overview (incl. Joliet / Rock Ridge extensions)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV1FormatDescriptor` | `MinixV1FormatDescriptor()` |  |
+| `IsoFormatDescriptor` | `IsoFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -6344,119 +7789,122 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Minix v1 geometry (1024-byte blocks, 32-byte inodes) is fixed, but the on-disk directory-name width is a genuine format variant the writer honours: 14-byte names (magic 0x137F) or 30-byte names (magic 0x138F). Selecting "30" changes both the superblock magic and every directory entry's size. |
-| `ReclaimSupport` | `LayoutReclaim ReclaimSupport { get; }` | A zone pointer of zero names no zone, so a run of zeros need not be allocated; and the inode counts the names pointing at it, so identical files can share one copy under several of them. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for ISO 9660 creation: ECMA-119 volume identifier, system identifier, publisher, application, plus the Joliet extension toggle. All identifier fields follow the ECMA-119 d/a-character rules and are truncated to the field length defined by the spec (32 for vol/sys, 128 for publisher/application). |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Minix v1 image via `MinixV1InPlaceModifier` — TRUE in-place O(touched bytes) I/O (allocate inode + data zones, append zones at EOF when the image is full, write the directory entry). Falls back to a whole-image rebuild only for nested paths or payloads beyond the direct + single-indirect ceiling. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh Minix v1 image holding the supplied inputs. Path separators in an input's archive name produce nested directory inodes, each with its own `"."`/`".."` entries. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds or replaces files at the root of an existing ISO 9660 image. Uses `IsoModifier` for true random-access I/O — only the PVD (sector 16), the root directory's existing extent, and the new file's data sectors are touched. The 32 KB system area, VDST, path tables, and existing file data sectors are left untouched. Names are sanitized to the ISO 9660 8.3 d-characters identifier set; ';1' versions are added automatically by the modifier. |
+| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation: the pre-known per-input sizes drive the ISO 9660 path table + directory + file-extent layout in pass 1 (identical to `Create`, which flattens to leaf filenames); pass 2 streams each file's bytes from its `OpenStream` factory into its data extent via 64 KB chunks — no file is ever buffered as a `byte[]`. Output is byte-identical to `Create` for the same inputs (the ECMA-119 volume/record timestamps are sampled once per `Build`). Falls back to a buffered build when the target stream is not seekable. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file's bytes are addressed one zone at a time by two-byte pointers in its inode and the indirect blocks below it, so a move is the copy, those pointers, and the bit per zone that says whether it is taken. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware ISO 9660 defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. All four `DefragMode` values supported; image is repacked with files reordered per mode. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the 32 KiB system area, the volume descriptor sequence, the path tables, and the directory tree, and yields each file's contiguous extent (LBA, length) as a single Used run — ECMA-119 mandates contiguous allocation per file. Directories surface as MetadataReserved. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single file entry as a bounded stream over the inode's reassembled data zones. Reads past the entry's logical size return 0 (EOF). |
-| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in-place via `MinixV1InPlaceModifier`. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every zone the bitmap leaves clear — which is where a removed file's bytes stay until something else claims them. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single ISO 9660 file entry as a bounded read-only `Stream`. ISO 9660 stores file data in contiguous extents — the reader's extract returns those bytes verbatim; they are wrapped in a `BoundedEntryStream` sized to the entry's logical size. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing ISO 9660 image. Uses `IsoModifier` for O(touched bytes) random-access I/O — the directory record is shifted out of its sector and the file's data sectors are zero-wiped. Names match case-insensitively after stripping any ';N' version suffix (ISO 9660 stores uppercase IDs). |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the ISO 9660 image: the unused remainder of the system area, free sectors and the sector-tip slack at the tail of each file's last 2048-byte sector. ECMA-119 stores every file contiguously and pads its final sector with zeros — the bytes between the file's logical length and the sector boundary are the cluster tip. The extent map clamps each Used run to the file's logical length, so the tip presents as a free gap that the generic `UnusedSpaceWiper` zero-fills. The size lookup is keyed by the reader's full path, matching the extent FileName. |
 
-#### `MinixV1InPlaceModifier`
+#### `IsoModifier`
 
-TRUE in-place R/W modifier for original Minix v1 filesystem images. Performs O(touched bytes) random-access mutation against the real mkfs.minix on-disk layout: only the superblock zone-count field, the relevant inode/zone bitmap bytes, the affected inode slot, the touched directory zone and the file's data zones (plus a single-indirect pointer block when needed) are read or written. Every other byte stays byte-identical. The v1 bitmaps follow the classic mkfs.minix convention: the inode bitmap addresses inode `i` at bit `i` (bit 0 reserved), and the zone bitmap addresses zone `Z` at bit `Z - firstDataZone + 1` (bit 0 reserved). When the image has no free zone, fresh zones are appended at the end of the image (the bitmap and `s_nzones` grow with it) — a genuine in-place grow, not a re-pack.Honest scope: files are stored through the 7 direct zones plus the one single-indirect zone (up to 7 + 512 = 519 zones ≈ 531 KB). Anything larger, or a request the bitmap cannot satisfy, throws `IOException` so the descriptor can fall back to a full rebuild. Subdirectory creation is also deferred to rebuild. Existing double-indirect content is still freed on Remove.
+In-place ISO 9660 (ECMA-119) modifier — true random-access editing without rebuilding the whole image. Touches only the PVD (sector 16), the root directory's existing extent, and the new file's data sectors. Layout assumptions (matching `IsoWriter`): 2048-byte sectors, single-level root directory (no subdirectories).PVD at LBA 16; an optional Joliet SVD follows before the VDST.File data laid out sequentially after the directory extents.No Rock Ridge System Use entries. New file data is appended after the current volume space; the PVD's volume space size is updated and a directory record is inserted into a free slot of the existing root directory extent. Removal shifts subsequent records in-place within their sector and optionally wipes the data sectors. When the image carries a Joliet SVD, the same add/remove is mirrored into the parallel Joliet root directory (UCS-2BE long names) so both trees stay consistent.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file to the root directory in-place. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named regular file from the root directory in-place. |
-| `Replace` | `static bool Replace(Stream image, string name, byte[] data)` | Replaces a named regular file's data in-place. |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds (or replaces) a file at the root of an ISO 9660 image. The file data is appended after the current volume extent; a new directory record is written into a free slot of the root directory's existing extent. Throws `IOException` if the root directory has no free slot (extending the directory would clobber file data and is not supported). |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the root directory of an ISO 9660 image. Shifts later records within the same directory sector to fill the hole, zero-fills the trailing tail, and (by default) wipes the file's data sectors. The PVD volume space size is left unchanged: the freed sectors at the tail can be reclaimed by a subsequent `AddFile`, but truncating the image would shift offsets used by other entries. |
 
-#### `MinixV1Reader`
+#### `IsoReader`
 
-Reads original Minix v1 filesystem images (1987, Tanenbaum's "Operating Systems: Design and Implementation"). The v1 layout uses 16-bit zone numbers, 16-bit inode counts, 32-byte inodes (7 direct + 1 indirect + 1 double-indirect zone pointer), and 1024-byte blocks. Two magic flavors: 0x137F (14-byte directory names) and 0x138F (30-byte directory names — Coherent / Minix patched variant).
+Reads ISO 9660 (ECMA-119) disc images with optional Joliet and Rock Ridge support.
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV1Reader` | `MinixV1Reader(Stream stream)` |  |
-| `Entries` | `IReadOnlyList<MinixV1Entry> Entries { get; }` |  |
-| `FirstDataZoneOffset` | `long FirstDataZoneOffset { get; }` | First zone that may hold file data: the one past the inode table. |
-| `InodeBitmapBlocks` | `ushort InodeBitmapBlocks { get; }` | Blocks the inode bitmap occupies, from the superblock. |
-| `InodeTableStart` | `long InodeTableStart { get; }` | Byte offset where the inode table starts. |
-| `Magic` | `ushort Magic { get; }` |  |
-| `NameLength` | `int NameLength { get; }` |  |
-| `ZoneBitmapBlocks` | `ushort ZoneBitmapBlocks { get; }` | Blocks the zone bitmap occupies, from the superblock. |
-| `ZoneBitmapOffset` | `long ZoneBitmapOffset { get; }` | Byte offset of the zone bitmap. |
-| `ZoneSize` | `static int ZoneSize { get; }` | Bytes per block, which is also a zone at this zone size. |
+| `IsoReader` | `IsoReader(Stream stream, bool leaveOpen = false, bool useJoliet = true)` | Opens an ISO 9660 image from the given stream. When `useJoliet` is `true` (the default) and the image carries a Joliet Supplementary Volume Descriptor, the long UCS-2 names from the Joliet directory tree are returned; otherwise the primary ECMA-119 tree (short uppercased names) is read. |
+| `Entries` | `IReadOnlyList<IsoEntry> Entries { get; }` | All entries found in the image. |
 | `Dispose` | `void Dispose()` |  |
-| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(MinixV1Entry entry)` | Where on disk `entry`'s bytes actually sit, as runs of whole zones, along with the byte offset of the first pointer that names each run. |
-| `Extract` | `byte[] Extract(MinixV1Entry entry)` |  |
-
-#### `MinixV1Writer`
+| `ExtractTo` | `void ExtractTo(IsoEntry entry, Stream destination)` | Copies an entry's bytes into `destination` a block at a time, so an entry larger than a byte[] can hold is extracted like any other. |
+| `Extract` | `byte[] Extract(IsoEntry entry)` | Extracts the raw data for the given entry. |
 
-Builds minimal but spec-correct original Minix v1 filesystem images (1987, Tanenbaum). The v1 on-disk format uses 1024-byte blocks, 16-bit zone numbers, 16-bit inode counts and 32-byte inodes addressing data through 7 direct zones, 1 single-indirect and 1 double-indirect zone. Directory names are 14 bytes (magic `0x137F`) or 30 bytes (magic `0x138F`). Every path component becomes a real directory inode carrying its own `"."`/`".."` entries, so a file added as `"a/b/c.txt"` is stored under nested directories `a` and `a/b`. Files larger than the 7 direct zones (7168 bytes) spill into the single-indirect zone, which addresses a further 512 zones (524 288 bytes); beyond that the double-indirect zone extends the reach further still.
+#### `IsoWriter`
 
-Implements `IDisposable`.
+Builds a minimal ISO 9660 (ECMA-119) disc image, optionally with a Joliet Supplementary Volume Descriptor. File names passed to `AddFile` may contain '/' separators; each separated segment becomes a real directory in the on-disc directory-record tree (with its own extent, "." and ".." records, and a matching path-table entry) rather than being flattened into the root directory. When `EnableJoliet` is set (the default), the writer emits a second, parallel directory tree carrying the original long, mixed-case, Unicode names as UCS-2 (UTF-16) big-endian, described by a Supplementary Volume Descriptor (type 2) with the UCS-2 level-3 escape sequence and its own L/M path tables. Both trees reference the same shared file-data extents — only the directory/name metadata differs: the primary tree carries short ECMA-119 (uppercase 8.3-ish, ";1") names, the Joliet tree the real long names.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV1Writer` | `MinixV1Writer(Stream output, bool leaveOpen = false, bool longNames = false)` | Creates a writer for the given output stream. `longNames` selects the 30-byte-name variant (magic 0x138F); the default is the classic 14-byte-name layout (magic 0x137F). |
-| `DeduplicateWithLinks` | `bool DeduplicateWithLinks { get; set; }` | Store one copy of files whose bytes are identical and give the rest a second name for it. |
-| `MakeSparse` | `bool MakeSparse { get; set; }` | Leave a zone unallocated where the file holds nothing but zeros. |
-| `AddFile` | `void AddFile(string path, byte[] data)` | Registers a file to be written into the image. |
+| `IsoWriter` | `IsoWriter()` |  |
+| `ApplicationIdentifier` | `string ApplicationIdentifier { get; set; }` | ECMA-119 8.4.12 Application Identifier (a-characters, 128 bytes max). Empty by default. |
+| `EnableJoliet` | `bool EnableJoliet { get; set; }` | Whether to emit a Joliet Supplementary Volume Descriptor and a parallel UCS-2 directory tree carrying the original long names. On by default. |
+| `PublisherIdentifier` | `string PublisherIdentifier { get; set; }` | ECMA-119 8.4.10 Publisher Identifier (a-characters, 128 bytes max). Empty by default. |
+| `SystemIdentifier` | `string SystemIdentifier { get; set; }` | ECMA-119 8.4.6 System Identifier (a-characters, 32 bytes max). Names the system that wrote the image. Empty by default. |
+| `VolumeIdentifier` | `string VolumeIdentifier { get; set; }` | ECMA-119 8.4.7 Volume Identifier (d-characters, 32 bytes max). Shown by most OS file managers and the iso9660 driver as the disc label. Default "CDROM". Truncated to 32 chars; upper-cased to fit the d-character set. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. The name may contain '/' path separators, in which case the intermediate segments are created as directories. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file: `size` drives extent + path-table + directory-record sizing in pass 1; bytes are pulled from `openStream` in pass 2 of `BuildToStreaming`. Never buffered as `byte[]`. |
+| `BuildToStreaming` | `void BuildToStreaming(Stream output)` | Two-pass streaming Build: pass 1 lays out the identical ISO image (same descriptors, path tables, directory extents, and file-data extent placement as `Build`) with each streaming file's data extent left zero; pass 2 seeks to each file's extent byte offset and copies its bytes from the opener in 64 KB chunks. The sector tail past each file's logical size stays zero, exactly as the in-memory path leaves it. For the same inputs (and same wall-clock second for the volatile ECMA-119 timestamps) the output is byte-for-byte identical to `Build`. |
 | `Build` | `byte[] Build()` |  |
-| `Dispose` | `void Dispose()` |  |
-| `Finish` | `void Finish()` | Builds and writes the Minix v1 filesystem image. |
 
-### Namespace `FileSystem.MinixV2`
+### Namespace `FileSystem.Jffs2`
 
-[`MinixV2BlockMover`](#minixv2blockmover) · [`MinixV2Entry`](#minixv2entry) · [`MinixV2ExtentMap`](#minixv2extentmap) · [`MinixV2FormatDescriptor`](#minixv2formatdescriptor) · [`MinixV2InPlaceModifier`](#minixv2inplacemodifier) · [`MinixV2Reader`](#minixv2reader) · [`MinixV2Writer`](#minixv2writer)
+[`Jffs2BlockMover`](#jffs2blockmover) · [`Jffs2FileReader`](#jffs2filereader) · [`Jffs2FileReader.FileEntry`](#jffs2filereaderfileentry) · [`Jffs2FormatDescriptor`](#jffs2formatdescriptor) · [`Jffs2InPlaceModifier`](#jffs2inplacemodifier) · [`Jffs2Writer`](#jffs2writer)
 
-#### `MinixV2BlockMover`
+#### `Jffs2BlockMover`
 
-Moves a file's zones inside a Minix V1 volume, repoints the pointers that name them, and moves the allocation with them.
+Moves nodes inside a JFFS2 image.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV2BlockMover` | `MinixV2BlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A zone, which is a block at the zone size this writer uses. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the bitmaps and the inode table. |
+| `Jffs2BlockMover` | `Jffs2BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Four bytes — the grid a node header must start on. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | The log starts at the first byte; there is no reserved head. |
 | `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
 | `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `Init` | `void Init(Stream image)` | Nothing to read: the alignment is the format's, not the image's. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` |  |
 
-#### `MinixV2Entry`
+#### `Jffs2FileReader`
+
+Reads a JFFS2 image and extracts actual file contents by reassembling inode data nodes and matching dirent nodes. Handles the common case of uncompressed, non-fragmented single-version files. Nested entries are reassembled to their full path by walking each dirent's parent-inode (pino) chain back to the root directory.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV2Entry` | `MinixV2Entry()` |  |
-| `InodeNumber` | `int InodeNumber { get; init; }` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `Size` | `int Size { get; init; }` |  |
+| `Jffs2FileReader` | `Jffs2FileReader(Stream stream)` |  |
+| `Jffs2FileReader` | `Jffs2FileReader(byte[] image)` |  |
+| `Entries` | `IReadOnlyList<FileEntry> Entries { get; }` | All file entries discovered in the image. |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `ExtractTo` | `long ExtractTo(FileEntry entry, Stream destination)` | Writes `entry`'s reassembled contents into `destination`, one fragment at a time. Returns the byte count. |
+| `Extract` | `byte[] Extract(FileEntry entry)` | Extracts the data for the given file entry. |
+| `OpenEntry` | `Stream OpenEntry(FileEntry entry)` | Opens `entry`'s contents as a seekable read-only stream over the image's data nodes. Nothing is copied: a read resolves the position to the fragment covering it and pulls those bytes straight out of the volume. Ranges no fragment covers — sparse holes — read back as zeros. |
+| `SizeOf` | `long SizeOf(FileEntry entry)` | The reassembled length of `entry`'s contents. |
 
-#### `MinixV2ExtentMap`
+#### `Jffs2FileReader.FileEntry`
 
-Reports where a Minix V1 volume's bytes are: its structures, each file's zones under its name, and what nothing holds.
+A file or directory entry found in the JFFS2 image. `Name` is the full path from the root (e.g. "docs/api/reference.txt").
+
+Implements `IEquatable<FileEntry>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+| `FileEntry` | `FileEntry(string Name, uint Inode, long NodeOffset, bool IsDirectory)` | A file or directory entry found in the JFFS2 image. `Name` is the full path from the root (e.g. "docs/api/reference.txt"). |
+| `Inode` | `uint Inode { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `NodeOffset` | `long NodeOffset { get; init; }` |  |
 
-#### `MinixV2FormatDescriptor`
+#### `Jffs2FormatDescriptor`
 
-Read-only descriptor for Minix v2 filesystem (1991). v2 extended the original layout with 64-byte inodes, 32-bit zone numbers, and triple-indirect blocks for large-file support. Magic 0x2468 (14-byte names) or 0x2478 (30-byte names — extended variant). References: `https://github.com/torvalds/linux/blob/master/include/uapi/linux/minix_fs.h` — canonical on-disk structures (v2 layout + 0x2468/0x2478 magics)`https://github.com/torvalds/linux/tree/master/fs/minix` — Linux reference implementation`https://en.wikipedia.org/wiki/Minix_file_system` — Wikipedia article
+JFFS2 (Journaling Flash File System v2) format descriptor. Supports: list, extract, create, true in-place R/W modify (log-append per the JFFS2 spec — fresh node at the tail with bumped version, existing nodes left byte-identical), defragment, extent map. References: `https://sourceware.org/jffs2/` — original JFFS2 site (David Woodhouse), incl. the design paper`http://www.linux-mtd.infradead.org/doc/jffs2.html` — Linux MTD project's JFFS2 documentation`https://github.com/torvalds/linux/tree/master/fs/jffs2` — mainline implementation (`jffs2_fs_i.h` / node headers)`https://en.wikipedia.org/wiki/JFFS2` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV2FormatDescriptor` | `MinixV2FormatDescriptor()` |  |
+| `Jffs2FormatDescriptor` | `Jffs2FormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -6468,90 +7916,93 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Minix v2 geometry (1024-byte blocks, 64-byte inodes) is fixed, but the on-disk directory-name width is a genuine format variant the writer honours: 14-byte names (magic 0x2468) or 30-byte names (magic 0x2478). Selecting "30" changes both the superblock magic and every directory entry's size. |
-| `ReclaimSupport` | `LayoutReclaim ReclaimSupport { get; }` | A zone pointer of zero names no zone, so a run of zeros need not be allocated; and the inode counts the names pointing at it, so identical files can share one copy under several of them. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The only writer-honoured knob is the flash erase-block size: the image is padded up to a whole multiple of it (the JFFS2 erase-block granularity). JFFS2 is a log-structured flash filesystem with no volume-label field, so no label knob is published. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Minix v2 image via `MinixV2InPlaceModifier` — TRUE in-place O(touched bytes) I/O (allocate inode + data zones, append zones at EOF when the image is full, write the directory entry). Falls back to a whole-image rebuild only for nested paths or payloads beyond the direct + single-indirect ceiling. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh Minix v2 image holding the supplied inputs. Path separators in an input's archive name produce nested directory inodes, each with its own `"."`/`".."` entries. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | In-place add (or replace) per JFFS2's log-structured semantic. Each input is appended as a fresh node (inode + dirent for new files; inode only with bumped version for replaces) at the end of the live log. Existing node bytes stay byte-identical at their original offsets — the reader's highest-version-wins resolution surfaces the new content. No rebuild. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file's bytes are addressed one zone at a time by two-byte pointers in its inode and the indirect blocks below it, so a move is the copy, those pointers, and the bit per zone that says whether it is taken. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
 | `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single file entry as a bounded stream over the inode's reassembled data zones (including triple-indirect blocks for large files). Reads past the entry's logical size return 0 (EOF). |
-| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in-place via `MinixV2InPlaceModifier`. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every zone the bitmap leaves clear — which is where a removed file's bytes stay until something else claims them. |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single file entry as a bounded stream over the inode's reassembled data nodes. Reads past the entry's logical size return 0 (EOF). Unknown names return an empty bounded stream. |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` | Re-lays the image out with the requested geometry. The generic default wrote the synthetic entries back as files, so the rebuilt image listed twelve entries where the original had eight and the rebuild was refused. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | In-place remove per JFFS2's log-structured semantic. For each named entry, an unlink dirent (`ino=0`) with `version = oldVersion + 1` is appended at the end of the log. Existing node bytes stay byte-identical; the reader's highest-version-wins resolution sees the unlink and treats the file as gone. Names that do not resolve to a live dirent are silently skipped. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros the unused (free) regions of a JFFS2 image. JFFS2 is a log-structured flash filesystem: file data lives in variably-sized inode nodes packed back to back, with no fixed cluster/block allocation — there are no cluster tips to wipe. Free space is the erased-flash tail and any padding/clean gaps, which the generic wiper zero-fills. Cluster-tip wiping is therefore N/A here: no file-size lookup is supplied and `wipeClusterTips` is forced off so the per-node log layout is never mistaken for cluster-aligned runs. |
 
-#### `MinixV2InPlaceModifier`
+#### `Jffs2InPlaceModifier`
 
-TRUE in-place R/W modifier for Minix v2 filesystem images. Performs O(touched bytes) random-access mutation against the real mkfs.minix v2 on-disk layout (64-byte inodes, 32-bit zone numbers): only the superblock zone-count field, the relevant inode/zone bitmap bytes, the affected inode slot, the touched directory zone and the file's data zones (plus a single-indirect pointer block when needed) are read or written. Every other byte stays byte-identical. The v2 bitmaps follow the classic mkfs.minix convention: the inode bitmap addresses inode `i` at bit `i` (bit 0 reserved), and the zone bitmap addresses zone `Z` at bit `Z - firstDataZone + 1` (bit 0 reserved). When the image has no free zone, fresh zones are appended at the end of the image (the bitmap and the 32-bit `s_zones` field grow with it) — a genuine in-place grow, not a re-pack.Honest scope: files are stored through the 7 direct zones plus the one single-indirect zone (7 + 256 = 263 data zones ≈ 269 KB). Anything larger, nested-path adds, or a request the bitmap cannot satisfy throws `IOException` so the descriptor can fall back to a full rebuild. Existing double-/triple-indirect content is still freed on Remove.
+True in-place R/W mutation of a JFFS2 image. JFFS2 is log-structured: a "modify" operation appends a fresh node (inode or dirent) at the end of the log with an incremented version number. Old nodes stay byte-identical at their original offsets; the reader resolves an inode or (parent-inode, name) pair to its highest-version node. This modifier preserves all existing bytes — only the tail of the log grows. Garbage collection (compaction of obsolete nodes) is deliberately out of scope here; that belongs to the defragmenter.Honest scope: appended data nodes carry their bytes uncompressed (`compr=0x00 JFFS2_COMPR_NONE`), matching what `Jffs2Writer` emits on Create. Compressed-body emission (LZO / zlib) is out of scope.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file to the root directory in-place. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named regular file from the root directory in-place. |
-| `Replace` | `static bool Replace(Stream image, string name, byte[] data)` | Replaces a named regular file's data in-place. |
-
-#### `MinixV2Reader`
+| `Add` | `static void Add(Stream image, IReadOnlyList<ValueTuple<string, byte[]>> inputs)` | Appends new files to the log. If an input name matches an existing file's path, a new inode node is appended with the same `ino` and `version = oldVersion + 1`, transparently replacing the prior content. Otherwise a fresh inode (plus any missing parent-directory inode chain) and a dirent are appended at the tail. Existing bytes are never rewritten. |
+| `Remove` | `static void Remove(Stream image, string name)` | Removes `name` by appending an unlink dirent (the JFFS2 idiom: `ino=0`) for the same `(pino, name)` pair with `version = oldVersion + 1`. The original nodes stay byte-identical; the reader's highest-version-wins resolution sees the unlink and treats the file as gone. Throws if the name does not resolve to a live dirent. |
+| `Replace` | `static void Replace(Stream image, string name, byte[] newData)` | Replaces the content of `name` with `newData`. Resolves the existing inode and appends a new inode node carrying the same `ino`, `version = oldVersion + 1`, and the fresh data bytes. Existing nodes stay byte-identical at their original offsets. Throws if the name does not resolve to an existing file. |
 
-Reads Minix v2 filesystem images (1991). v2 extended the original Minix layout to support large files: 64-byte inodes (replacing v1's 32-byte), 32-bit zone numbers, and a triple-indirect block. The superblock layout is the same as v1 (1024-byte blocks). Magic 0x2468 (14-byte names) or 0x2478 (30-byte names).
+#### `Jffs2Writer`
 
-Implements `IDisposable`.
+Builds a JFFS2 (Journaling Flash File System v2) image from scratch. Produces a valid log-structured image with cleanmarkers, inode nodes, and dirent nodes. Data is stored uncompressed (compr=0x00 NONE). Default erase block size: 128 KiB (common NOR flash). Files whose name contains path separators ('/' or '\') are placed inside a real directory tree: each intermediate path segment becomes its own directory inode plus a dirent in its parent, so nested paths round-trip through the reader instead of being flattened into the root.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MinixV2Reader` | `MinixV2Reader(Stream stream)` |  |
-| `Entries` | `IReadOnlyList<MinixV2Entry> Entries { get; }` |  |
-| `FirstDataZoneOffset` | `long FirstDataZoneOffset { get; }` | First zone that may hold file data: the one past the inode table. |
-| `InodeBitmapBlocks` | `ushort InodeBitmapBlocks { get; }` | Blocks the inode bitmap occupies, from the superblock. |
-| `Magic` | `ushort Magic { get; }` |  |
-| `NameLength` | `int NameLength { get; }` |  |
-| `ZoneBitmapBlocks` | `ushort ZoneBitmapBlocks { get; }` | Blocks the zone bitmap occupies, from the superblock. |
-| `ZoneBitmapOffset` | `long ZoneBitmapOffset { get; }` | Byte offset of the zone bitmap. |
-| `ZoneSize` | `static int ZoneSize { get; }` | Bytes per block, which is also a zone at this zone size. |
-| `Dispose` | `void Dispose()` |  |
-| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(MinixV2Entry entry)` | Where on disk `entry`'s bytes actually sit, as runs of whole zones, along with the byte offset of the first pointer that names each run. |
-| `Extract` | `byte[] Extract(MinixV2Entry entry)` |  |
+| `Jffs2Writer` | `Jffs2Writer(int eraseBlockSize = 131072)` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Queues a file for inclusion in the next `Build` call. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Queues a file whose bytes are pulled from `openStream` as the image is written, so the content never has to fit in memory. |
+| `Build` | `byte[] Build()` | Builds a complete JFFS2 image. Layout: 1. Cleanmarker at offset 0 2. Root directory inode node (inode 1, mode=dir) 3. For each path component a directory inode + dirent (parent=enclosing dir), created once and shared; for each file an inode node (data in body) + dirent node (parent=enclosing dir). 4. Remainder filled with 0xFF Image is padded to a multiple of the erase block size. |
+| `WriteTo` | `void WriteTo(Stream output)` | Writes the image to a stream, node by node — nothing is buffered whole. |
 
-#### `MinixV2Writer`
+### Namespace `FileSystem.Jfs`
 
-Builds minimal but spec-correct Minix v2 filesystem images (1991). v2 keeps the v1 superblock and 1024-byte blocks but widens inodes to 64 bytes, zone numbers to 32 bits, and adds a triple-indirect zone for large files. Directory names are 14 bytes (magic `0x2468`) or 30 bytes (magic `0x2478`). Every path component becomes a real directory inode with its own `"."`/`".."` entries, so a file added as `"a/b/c.txt"` is stored under nested directories `a` and `a/b`. Files larger than the 7 direct zones (7168 bytes) spill into the single-indirect zone (256 further zones), then the double-indirect zone, then the triple-indirect zone.
+[`JfsBlockMover`](#jfsblockmover) · [`JfsEntry`](#jfsentry) · [`JfsExtentMap`](#jfsextentmap) · [`JfsFormatDescriptor`](#jfsformatdescriptor) · [`JfsReader`](#jfsreader) · [`JfsWriter`](#jfswriter)
 
-Implements `IDisposable`.
+#### `JfsBlockMover`
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `MinixV2Writer` | `MinixV2Writer(Stream output, bool leaveOpen = false, bool longNames = false)` | Creates a writer for the given output stream. `longNames` selects the 30-byte-name variant (magic 0x2478); the default is the 14-byte-name layout (magic 0x2468). |
-| `DeduplicateWithLinks` | `bool DeduplicateWithLinks { get; set; }` | Store one copy of files whose bytes are identical and give the rest a second name for it. |
-| `MakeSparse` | `bool MakeSparse { get; set; }` | Leave a zone unallocated where the file holds nothing but zeros. |
-| `AddFile` | `void AddFile(string path, byte[] data)` | Registers a file to be written into the image. |
-| `Build` | `byte[] Build()` |  |
-| `Dispose` | `void Dispose()` |  |
-| `Finish` | `void Finish()` | Builds and writes the Minix v2 filesystem image. |
+Moves a file's extents inside a JFS volume and repoints the xad descriptors that name them.
 
-### Namespace `FileSystem.Msa`
+Implements `IFilesystemBlockMover`.
 
-[`MsaEntry`](#msaentry) · [`MsaFormatDescriptor`](#msaformatdescriptor) · [`MsaModifier`](#msamodifier) · [`MsaReader`](#msareader) · [`MsaWriter`](#msawriter)
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `JfsBlockMover` | `JfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the maps, the tables and the inodes. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `UsableBlocks` | `int UsableBlocks { get; }` | Blocks the aggregate uses. The fsck workspace and the log sit past them and the allocation map does not describe them. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `MsaEntry`
+#### `JfsEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MsaEntry` | `MsaEntry()` |  |
+| `JfsEntry` | `JfsEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `LastModified` | `DateTime? LastModified { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `MsaFormatDescriptor`
+#### `JfsExtentMap`
 
-Descriptor for Atari ST MSA (Magic Shadow Archiver) disk images — an RLE-compressed track-image container wrapping a FAT12 floppy filesystem. References: `https://github.com/hatari/hatari` — Hatari emulator; its MSA disk-image support is the de-facto reference implementationMagic Shadow Archiver original documentation (Atari ST, Seimet) — no stable online spec
+Reads a JFS volume's layout: which blocks are in use, and for the blocks a file's own xtree names, which file they belong to.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `JfsFormatDescriptor`
+
+Descriptor for IBM JFS1 aggregate images. Reader walks the kernel-fixed AIT (block 11), the indirect fileset AIM → IAG → FSIT path, and the inline dtree root + xtree extents. Writer emits a complete WORM image with FILESYSTEM_I → AIM → IAG → FSIT, dual superblocks, dmap+dmapctl with canonical `ujfs_adjtree` buddy tree, both AIT/AIM copies, and an inline-dtroot root directory with up to 8 user files. Validated clean against real `fsck.jfs -n -f -v`. State: R/W (extended mutation past leaf-only). `JfsMutator` implements: arbitrary path depth add/remove (descend by name through any intermediate directory whose dtree is inline OR external/router);long names via continuation slots chained through the head ldtentry's `next` byte (both insert and remove walk the chain);external dtree leaf-page insert/delete when the directory's dtroot has been promoted to a router (in-place stbl shift + freelist restore, with no split);recursive subdirectory removal — DFS the dtree, free every child file's xtree extents + inode + dmap bits, free the dtree pages themselves, then close out the entry in the parent;multi-dmap allocation — walks both dmap pages the writer reserves before declaring the image full;xtree extent allocate/free with inline xad slots and dmap binary-buddy `ujfs_adjtree` rerun for every modified dmap. Operations that genuinely need multi-week scope still throw `NotSupportedException` with a SPECIFIC message naming what's unsupported: inline dtroot leaf split, external dtree leaf split, xtree root promotion to non-leaf, IAG full / FSIT extent growth. References: `https://jfs.sourceforge.net/project/pub/jfslayout.pdf` — "JFS Layout", the official on-disk format document (superblock, dmap/dmapctl, dtree/xtree, IAG)`https://github.com/torvalds/linux/tree/master/fs/jfs` — mainline kernel implementation; jfsutils' `fsck.jfs` is the conformance gate`https://en.wikipedia.org/wiki/JFS_(file_system)` — Wikipedia overview
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MsaFormatDescriptor` | `MsaFormatDescriptor()` |  |
+| `JfsFormatDescriptor` | `JfsFormatDescriptor()` |  |
+| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -6562,97 +8013,100 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | JFS aggregate geometry (4 KiB blocks, single allocation group, fixed metadata layout) is not tunable, so the only honoured knob is the volume label stored in the superblock `s_label[16]` field (offset 152). |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds files to the FAT12 filesystem inside an existing MSA image. Each call performs decode → modify FAT → re-encode (see `MsaModifier`); per-track RLE compression makes anything cheaper architecturally impossible. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds an MSA image holding the inputs. An MSA file is a compressed Atari ST floppy, so the files go into a GEMDOS volume first and that volume is what gets encoded. A single input that already is a floppy image — the .st → .msa conversion — is encoded as it stands. Anything else used to be treated the same way, which meant the first input's bytes were read as a disk image and every other input was dropped without a word: three files in, one nonsensical "floppy" out. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
+| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation. JFS carries NO data checksum and stores file bodies in dedicated xtree extents (directories are stored inline in the dinode, so they never reach the streaming path), which makes the format fully streamable: pass 1 builds every metadata structure with the file extents left zero; pass 2 seeks to each file's extent and copies its bytes from `OpenStream` in 64 KiB chunks. The output is byte-identical to `Create` for the same inputs. Falls back to the buffered default on a non-seekable target. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Defragments the inner FAT12 filesystem inside an MSA image. The image is decoded to a flat disk, the FAT layer is defragmented via rebuild (read all files, rebuild with FatWriter which always start-packs), and the result is re-encoded to MSA tracks preserving the original geometry. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Decodes the MSA tracks to a flat FAT12 image and delegates to `Enumerate` for the actual cluster-chain walk. The returned offsets are relative to the inner flat image (not the MSA container) — this matches what the defrag window expects for filesystem extent maps. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware JFS1 defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. The writer always emits a fresh contiguous-from-start single-aggregate image with FILESYSTEM_I → AIM → IAG → FSIT, dual superblocks, dmap+dmapctl, and an inline-dtroot. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
-| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` | Lists the files on the floppy the image holds. An MSA file wraps a GEMDOS volume, and this descriptor's Add and Remove already work on that volume's files, so this reads them too — a disc whose filesystem cannot be walked falls back to the raw image as a single entry. |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 | `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes files from the FAT12 filesystem inside an existing MSA image. Inner-layer wipe is delegated to `FatRemover` (zeros cluster bytes + cluster-tip slack + dirent + FAT entries), then the modified flat image is re-encoded to MSA tracks. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the filesystem inside an MSA image. MSA is an outer RLE-compressed container whose track bytes hold no in-place free space — the extent map's offsets are relative to the decoded flat image, not the container — so wiping is performed the only honest way: decode the tracks to the flat image, run the wiper of whichever descriptor reads that volume (free clusters + cluster tips) on it, then re-encode preserving the original geometry. |
-
-#### `MsaModifier`
-
-Modifier for Atari ST MSA (Magic Shadow Archiver) disk images. MSA is a two-level container: an outer RLE-compressed track wrapper around an inner FAT12 filesystem image (track-aligned dump of a standard ST floppy). Because each track is RLE-compressed independently, true byte-level in-place modification is impossible — any change to the inner FAT image shifts the compressed lengths of one or more tracks and therefore the entire rest of the file. The honest path is decode → modify FAT → re-encode, which is what this class does:Read MSA header, decompress all tracks into a flat FAT12 image (size = (end-start+1) × sides × SPT × 512 bytes).Apply the FAT modifier op (`FatRemover` for remove, `FatReader` + `FatWriter` rebuild for add) on the flat image, preserving total-sectors.Re-encode the flat image back to MSA tracks via `Write`, preserving the original geometry (SPT, sides, start/end track) so subsequent round-trips remain stable.Operates on the entire image — there is no streaming sector access because the RLE codec is per-track and forces a full track decode anyway. For a 1.44 MB ST floppy that's ~1.4 MB of memory traffic per call, which is fine for the use case (interactive disk editing, test harnesses).
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to the FAT12 filesystem inside an MSA image. The image is fully decoded, the FAT layer is rebuilt with the existing entries plus the new one (matching `FatFormatDescriptor.Add`'s strategy — FatWriter is build-from-scratch by design), and the result is re-compressed track by track with the original MSA geometry. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file from the FAT12 filesystem inside an MSA image. Uses `Remove` for the inner-layer wipe (zeros cluster bytes + cluster-tip slack + directory entry + FAT entries in every FAT copy, leaving no forensic trace of the filename or content), then re-encodes the modified flat image back to MSA tracks with the original geometry. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every block the allocation map reports as free — which is where a removed file's bytes stay until something else claims them. |
 
-#### `MsaReader`
+#### `JfsReader`
 
-Reads Atari ST MSA (Magic Shadow Archiver) disk images. MSA uses simple RLE compression on individual tracks.
+Reads IBM JFS1 aggregate images produced by `JfsWriter` or by real `mkfs.jfs`. Decodes the superblock, FILESYSTEM_I aggregate inode (#16), fileset inode table, and the inline dtree root directory (UCS-2 names).
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `MsaReader` | `MsaReader(Stream stream, bool leaveOpen = false)` |  |
-| `MsaMagic` | `const ushort MsaMagic` |  |
-| `EndTrack` | `ushort EndTrack { get; }` |  |
-| `Entries` | `IReadOnlyList<MsaEntry> Entries { get; }` |  |
-| `SectorsPerTrack` | `ushort SectorsPerTrack { get; }` |  |
-| `Sides` | `ushort Sides { get; }` |  |
-| `StartTrack` | `ushort StartTrack { get; }` |  |
+| `JfsReader` | `JfsReader(Stream stream, bool leaveOpen = true)` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
+| `Entries` | `IReadOnlyList<JfsEntry> Entries { get; }` |  |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
 | `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(MsaEntry entry)` |  |
+| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(JfsEntry entry)` | Where on disk `entry`'s bytes actually sit, one xtree extent at a time, along with the byte offset of the descriptor that names each of them. |
+| `ExtractTo` | `long ExtractTo(JfsEntry entry, Stream destination)` | Writes `entry`'s contents into `destination`, one xtree extent at a time. Returns the number of bytes written. |
+| `Extract` | `byte[] Extract(JfsEntry entry)` |  |
 
-#### `MsaWriter`
+#### `JfsWriter`
 
-Creates MSA (Magic Shadow Archiver) disk images from raw ST disk data. Uses RLE compression per track.
+Writes a minimal IBM Journaled File System (JFS1) aggregate image with a single allocation group, one fileset, and an inline dtree root directory. Byte layout matches the on-disk structures in `linux/fs/jfs` and the `jfsutils` reference (mkfs.jfs / fsck.jfs); validated by exit-zero from `fsck.jfs -n -f -v`. All integer fields are little-endian. `pxd_t` is packed as `len_addr = (len & 0xFFFFFF) | ((addr >> 32) << 24)`, `addr2 = addr & 0xFFFFFFFF`. Dtree slot names are UCS-2 (UTF-16 LE). Round-trips through `JfsReader`. Aggregate inode table (block 11..14, IXSIZE=16 KB) holds the AGGR_RESERVED_I (0), AGGREGATE_I (1, → AIM), BMAP_I (2, → block-allocation map), LOG_I (3), BADBLOCK_I (4) and FILESYSTEM_I (16, → fileset AIM) metadata inodes. The fileset inode table at blocks 29..32 holds FILESET_RSVD_I (0), FILESET_EXT_I (1), ROOT_I (2, dtroot inline), ACL_I (3) and user file inodes (4+).
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Write` | `static void Write(Stream output, byte[] diskData, ushort sectorsPerTrack = 9, ushort sides = 1)` |  |
+| `JfsWriter` | `JfsWriter()` |  |
+| `BlockSize` | `const int BlockSize` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file whose `size` drives extent + inode sizing in pass 1 of `BuildToStreaming`; the body is pulled from `openStream` in 64 KiB chunks in pass 2 and never buffered as a `byte[]`. JFS has no data checksums and stores file bodies in dedicated xtree extents, so the on-disk image is byte-identical to the classic `WriteTo` path for the same inputs. |
+| `BuildToStreaming` | `void BuildToStreaming(Stream output)` | Two-pass streaming write: pass 1 builds the complete image byte array (file data extents left zero, recorded into a sink); pass 2 seeks to each streaming file's extent and copies its body from the opener in 64 KiB chunks. The emitted bytes are identical to `WriteTo` for the same inputs — JFS carries no data checksum, so only WHERE the body bytes originate changes. Requires a writable, seekable stream. |
+| `Build` | `byte[] Build()` | Materialises the whole aggregate. |
+| `SetVolumeLabel` | `void SetVolumeLabel(string label)` | Sets the volume label written into the superblock `s_label[16]` field (offset 152). ASCII, NUL-padded, truncated to 16 bytes. |
+| `WriteTo` | `void WriteTo(Stream output)` |  |
 
-### Namespace `FileSystem.Nilfs2`
+### Namespace `FileSystem.Jfs1`
 
-[`Nilfs2BlockMover`](#nilfs2blockmover) · [`Nilfs2Entry`](#nilfs2entry) · [`Nilfs2FormatDescriptor`](#nilfs2formatdescriptor) · [`Nilfs2InPlaceModifier`](#nilfs2inplacemodifier) · [`Nilfs2Reader`](#nilfs2reader) · [`Nilfs2Superblock`](#nilfs2superblock) · [`Nilfs2Writer`](#nilfs2writer)
+[`Jfs1BlockMover`](#jfs1blockmover) · [`Jfs1Entry`](#jfs1entry) · [`Jfs1FormatDescriptor`](#jfs1formatdescriptor) · [`Jfs1InPlaceModifier`](#jfs1inplacemodifier) · [`Jfs1OptimalParameters`](#jfs1optimalparameters) · [`Jfs1Optimizer`](#jfs1optimizer) · [`Jfs1Reader`](#jfs1reader) · [`Jfs1Writer`](#jfs1writer)
 
-#### `Nilfs2BlockMover`
+#### `Jfs1BlockMover`
 
-Moves a payload inside the base segment of a NILFS volume and rewrites the directory field that said where it began.
+Moves a file's blocks inside a JFS1 volume and repoints its inode.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Nilfs2BlockMover` | `Nilfs2BlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A byte. Payloads are packed to the byte here, so nothing rounds them to anything larger. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a payload may occupy: where the base segment's payloads start. |
-| `PayloadEnd` | `long PayloadEnd { get; }` | Where the area a payload may occupy ends. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the field naming the payload it is given and leaves the others alone. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A payload may be held outside the volume while the rest of the layout moves, which is what lets a full area be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the base segment once and notes which field names each payload. |
+| `Jfs1BlockMover` | `Jfs1BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. |
+| `Init` | `void Init(Stream image)` | Notes the volume's block size and where file data may start. JFS1 records the block size in its superblock rather than fixing it, so it is read rather than assumed. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `Nilfs2Entry`
+#### `Jfs1Entry`
+
+One entry surfaced by `Jfs1Reader`.
+
+Implements `IEquatable<Jfs1Entry>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Nilfs2Entry` | `Nilfs2Entry()` |  |
-| `Data` | `byte[] Data { get; init; }` |  |
+| `Jfs1Entry` | `Jfs1Entry(string Name, int Inode, bool IsDirectory, long Size, int FirstBlock)` | One entry surfaced by `Jfs1Reader`. |
+| `FirstBlock` | `int FirstBlock { get; init; }` |  |
+| `Inode` | `int Inode { get; init; }` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
-| `Offset` | `long Offset { get; init; }` | Where the entry's bytes live in the image, for entries the reader leaves in place rather than copying. -1 when `Data` carries them. |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `Nilfs2FormatDescriptor`
+#### `Jfs1FormatDescriptor`
 
-NILFS2 descriptor (continuous-snapshot log-structured filesystem, Linux mainline since 2.6.30). Magic 0x3434 sits at superblock+6 (file offset 1030). R/W scope. Create emits a spec-compliant superblock plus a writer-private compact directory at offset 2048 (the base checkpoint at cno=1). Add / Replace / Remove append a fresh log segment (an appended-segment magic header + cno + dirents + payload) at the tail of the volume and bump `s_last_cno` in the superblock — the only in-place edit, sanctioned by the NILFS2 spec for advancing the checkpoint pointer. Every byte of every prior segment stays byte-identical at its original offset, so the older state is byte-recoverable as a snapshot (continuous-snapshot semantic).Kernel-mountable. Create emits the full single-checkpoint log the Linux `nilfs2` driver needs to mount: a super root with the DAT / cpfile / sufile inodes (+ their CRC), a segment summary with the spec ss_sumsum / ss_datasum checksums, an ifile holding the root directory inode, a DAT (Disk Address Translation) table, and a flat root directory carrying the files. A real `mount -t nilfs2` mounts the image, lists the directory, and reads the files back (verified via the libguestfs appliance kernel). Subdirectories and files larger than a direct block map stay in the writer-private directory for the reader but are not materialised in the mountable tree; snapshots / multi-checkpoint chains remain out of scope. References: `https://nilfs.sourceforge.io/` — NILFS project home`https://www.kernel.org/doc/html/latest/filesystems/nilfs2.html` — kernel documentation`https://github.com/torvalds/linux/blob/master/include/uapi/linux/nilfs2_ondisk.h` — canonical on-disk structures`https://en.wikipedia.org/wiki/NILFS` — Wikipedia article
+OS/2 original IBM JFS1 format descriptor — distinct from `FileSystem.Jfs` which targets the Linux JFS2 derivative. WORM writer + reader with real nested subdirectories, defrag/purge/conversion, fileset optimizer, and an options schema (BlockSize / AggregateBlockSize / VolumeLabel). References: IBM "JFS for OS/2 Warp Server for e-business" documentation (1999-2000) — the original vendor documentation of the pre-Linux JFS1 (no stable public URL)`https://jfs.sourceforge.net/` — the open-sourced JFS project, useful for contrasting the later JFS2-derived layout`https://en.wikipedia.org/wiki/JFS_(file_system)` — Wikipedia overview of the JFS family
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Nilfs2FormatDescriptor` | `Nilfs2FormatDescriptor()` |  |
+| `Jfs1FormatDescriptor` | `Jfs1FormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -6664,138 +8118,98 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Creation knobs. `BlockSize` is the NILFS2 block size (power of two in [1024, 65536], recorded in `s_log_block_size`): leave it at "auto" (0) to let the layout optimiser pick the legal size that minimises wasted tail padding for the file-set, or pin a value. `VolumeLabel` fills the 16-byte superblock label slot. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Appends a fresh log segment at the tail of the image carrying dirent + data blocks for each input, and bumps `s_last_cno` in the superblock. The 8-byte cno field is the only in-place edit; every other byte of the prior image stays byte-identical at its original offset — continuous snapshot semantic intact. Inputs whose name already exists are effectively replaced (the higher cno wins on read). |
-| `AnalyzeLayout` | `LayoutAnalysis AnalyzeLayout(Stream image)` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Emits a self-contained NILFS2 image (valid superblock + base private directory at cno=1). Round-trips through this descriptor's reader and serves as the substrate for in-place Add / Replace / Remove via `Nilfs2InPlaceModifier`. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing JFS1 image via `Jfs1InPlaceModifier` — TRUE in-place O(touched bytes) I/O (claim a free dinode slot, append a contiguous data extent at EOF, write the root dirent). Falls back to a whole-image rebuild only for nested paths or inode-table exhaustion. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
 | `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Superblocks, the kernel log, the private directory and every appended segment's header are metadata; each live payload is the file that owns it. Superseded and tombstoned payloads are claimed by nothing, so a wipe reclaims exactly the bytes a segment cleaner would. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `PatchInPlace` | `void PatchInPlace(Stream image, LayoutPatch patch)` |  |
-| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Appends a tombstone dirent for each named entry in a fresh log segment and bumps `s_last_cno`. The reader's cno-merge drops the entry from the listing; the original data blocks stay byte-identical at their original offsets and remain addressable as a snapshot of the pre-Remove state. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in-place via `Jfs1InPlaceModifier`. |
 | `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
-#### `Nilfs2InPlaceModifier`
+#### `Jfs1InPlaceModifier`
 
-True in-place modifier for NILFS2 images emitted by `Nilfs2Writer`. Implements the spec semantic of NILFS2's continuous-snapshot log-structured layout: every mutation appends a fresh "logical segment" at the tail of the volume, leaving every byte in the prior image byte-identical at its original offset — except for the 8-byte `s_last_cno` field of the superblock, which is the only in-place edit the spec sanctions. Old segments stay recoverable as snapshots.
+TRUE in-place R/W modifier for the OS/2 JFS1 images this project emits. Performs O(touched bytes) random-access mutation: only the affected dinode slot, the root directory block, the file's single data extent and (when the image must grow) the superblock `s_size` field are read or written. Every other byte stays byte-identical. The on-disk model is the one written by `Jfs1Writer`: block 0 superblock, blocks 1..inodeBlocks the 256-byte dinode array (inode `N` at array index `N - 2`), then per-file single contiguous data extents. There is no free-block bitmap, so fresh extents are appended at the current end of the image — a genuine in-place grow, not a re-pack; removed extents simply become unreferenced holes a later defrag reclaims.Honest scope: files are stored as one contiguous extent in the root directory. Nested-path adds and inode-table exhaustion throw `IOException` so the descriptor can fall back to a full rebuild.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Add` | `static void Add(Stream image, IReadOnlyList<ArchiveInputInfo> inputs)` | Appends a new logical segment carrying fresh dirent + data blocks for each input file and bumps `s_last_cno` in the superblock. Existing segments stay byte-identical at their original offsets; only the 8-byte checkpoint-number field of the superblock changes in place. |
-| `Remove` | `static void Remove(Stream image, string[] entryNames)` | Appends a new logical segment containing a tombstone dirent for each named entry and bumps `s_last_cno`. Old data blocks stay byte-identical; the reader's tombstone-aware merge drops the entry from the listing. |
-| `Replace` | `static void Replace(Stream image, string name, byte[] newData)` | Appends a new logical segment carrying a fresh data block for the named file and bumps `s_last_cno`. Old data blocks stay byte-identical at their original offsets — they remain addressable as snapshots — and the reader's highest-cno-per-name merge surfaces the new content. |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file to the root directory in-place. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named regular file from the root directory in-place. |
+| `Replace` | `static bool Replace(Stream image, string name, byte[] data)` | Replaces a named regular file's data in-place. |
 
-#### `Nilfs2Reader`
+#### `Jfs1OptimalParameters`
 
-Reads NILFS2 superblock metadata (Linux's continuous-snapshot log-structured filesystem, mainline since 2.6.30). Full file traversal would require walking the DAT (Disk Address Translation) B-tree and replaying log segments — multi-week work. This reader surfaces the parsed superblock + checkpoint anchor as a structured metadata bundle plus the raw image, matching the pattern used by other research/proprietary read-only FSes in this project. Superblock layout (selected, little-endian, sits at file offset 1024): 0x00 u32 s_rev_level 0x04 u16 s_minor_rev_level 0x06 u16 s_magic (must be 0x3434 = NILFS_SUPER_MAGIC) 0x08 u16 s_bytes 0x0A u16 s_flags 0x0C u32 s_crc_seed 0x10 u32 s_sum 0x14 u32 s_log_block_size 0x18 u64 s_nsegments 0x20 u64 s_dev_size 0x28 u64 s_first_data_block 0x30 u32 s_blocks_per_segment 0x34 u32 s_r_segments_percentage 0x38 u64 s_last_cno (last checkpoint number) 0x40 u64 s_last_pseg (last partial segment) ...
+Optimal JFS1 layout as picked by `Find`.
 
-Implements `IDisposable`.
+Implements `IEquatable<Jfs1OptimalParameters>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Nilfs2Reader` | `Nilfs2Reader(Stream stream)` |  |
-| `SuperMagic` | `const ushort SuperMagic` |  |
-| `BlocksPerSegment` | `uint BlocksPerSegment { get; }` |  |
-| `ChecksumValid` | `bool ChecksumValid { get; }` | True when the parsed superblock's stored `s_sum` matches a freshly computed Linux `crc32_le` over its first `s_bytes` bytes. mkfs and our own writer both produce CRC-valid superblocks; a false here flags a corrupt or hand-edited image. |
-| `CrcSeed` | `uint CrcSeed { get; }` |  |
-| `DevSize` | `ulong DevSize { get; }` |  |
-| `Entries` | `IReadOnlyList<Nilfs2Entry> Entries { get; }` |  |
-| `LastCheckpoint` | `ulong LastCheckpoint { get; }` |  |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
-| `LogBlockSize` | `uint LogBlockSize { get; }` |  |
-| `LogFileRegions` | `IReadOnlyList<ValueTuple<long, long, string>> LogFileRegions { get; }` | The data blocks of files embedded in the kernel checkpoint, with the name each belongs to. A file small enough for a direct block map has a copy here as well as in the payload region, so a wipe has to know which of those blocks still belong to a live file. |
-| `Magic` | `ushort Magic { get; }` |  |
-| `MetadataRegions` | `IReadOnlyList<ValueTuple<long, long>> MetadataRegions { get; }` | Regions holding structure rather than file bytes: the superblocks, the kernel log, the writer-private directory and the header+directory of every appended segment. A wipe must leave these alone; everything they and the live payloads do not cover is dead space. |
-| `NumSegments` | `ulong NumSegments { get; }` |  |
-| `RevLevel` | `uint RevLevel { get; }` |  |
-| `SBytes` | `ushort SBytes { get; }` |  |
-| `StoredSum` | `uint StoredSum { get; }` |  |
-| `SuperblockSource` | `string SuperblockSource { get; }` | Which superblock copy was chosen as authoritative. |
-| `Uuid` | `string Uuid { get; }` |  |
-| `ValidSuperblock` | `bool ValidSuperblock { get; }` |  |
-| `VolumeLabel` | `string VolumeLabel { get; }` |  |
-| `Dispose` | `void Dispose()` |  |
-| `ExtractTo` | `long ExtractTo(Nilfs2Entry entry, Stream destination)` | Writes `entry`'s bytes into `destination`. |
-| `Extract` | `byte[] Extract(Nilfs2Entry entry)` |  |
+| `Jfs1OptimalParameters` | `Jfs1OptimalParameters(int BlockSize, int AggregateBlockSize, long EstimatedImageBytes)` | Optimal JFS1 layout as picked by `Find`. |
+| `AggregateBlockSize` | `int AggregateBlockSize { get; init; }` |  |
+| `BlockSize` | `int BlockSize { get; init; }` |  |
+| `EstimatedImageBytes` | `long EstimatedImageBytes { get; init; }` |  |
 
-#### `Nilfs2Superblock`
+#### `Jfs1Optimizer`
 
-Byte-accurate NILFS2 superblock encoder/decoder, reverse-engineered against `mkfs.nilfs2` (nilfs-utils 2.2.9) output and cross-checked field-by-field.
+Fileset-driven optimizer for OS/2 JFS1. Picks the smallest block size where total wasted slack is ≤ 5% AND the estimated image size is ≤ 2× the sum of file sizes. Tiebreaks toward larger blocks (fewer dinodes per content byte, smaller dmap chain).
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ErrorsContinue` | `const ushort ErrorsContinue` |  |
-| `Magic` | `const ushort Magic` |  |
-| `PrimaryOffset` | `const int PrimaryOffset` |  |
-| `SBytes` | `const ushort SBytes` |  |
-| `SecondaryBackOffset` | `const int SecondaryBackOffset` | The secondary superblock sits one block (4096 B) before EOF. |
-| `Size` | `const int Size` |  |
-| `StateValid` | `const ushort StateValid` |  |
-| `Crc32Le` | `static uint Crc32Le(uint seed, ReadOnlySpan<byte> data)` | Linux `crc32_le`: reflected IEEE polynomial, no input/output inversion. The `seed` is the literal LFSR init (the NILFS s_crc_seed), not the usual 0xFFFFFFFF. |
-| `Encode` | `static void Encode(Span<byte> dest, uint logBlockSize, ulong nSegments, ulong devSize, uint blocksPerSegment, ulong lastCno, ulong lastPseg, ulong lastSeq, ulong freeBlocks, ulong ctime, ushort state, uint crcSeed, ReadOnlySpan<byte> uuid, string volumeLabel)` | Encodes a complete 1024-byte superblock into `dest` and seals it with a valid checksum. |
-| `FinalizeChecksum` | `static void FinalizeChecksum(Span<byte> sb, uint seed)` | Writes the s_sum checksum into `sb` (a span starting at the superblock) using `seed` over the first `SBytes` bytes with the s_sum field zeroed first. |
-| `VerifyChecksum` | `static bool VerifyChecksum(ReadOnlySpan<byte> sb)` | Verifies the stored s_sum against a freshly computed crc32_le over the first `SBytes` bytes with the s_sum field treated as zero. |
+| `Find` | `static Jfs1OptimalParameters Find(IReadOnlyList<long> fileSizes)` |  |
 
-#### `Nilfs2Writer`
+#### `Jfs1Reader`
 
-Writes a kernel-mountable NILFS2 image. Emits the full single-checkpoint log structure the Linux `nilfs2` driver needs to mount — a super root with the DAT / cpfile / sufile inodes, a segment summary with the spec checksums, an ifile holding the root directory inode, a DAT (disk-address-translation) table, and a root directory carrying the user files — alongside the byte- accurate, CRC-valid superblock pair. A real `mount -t nilfs2` mounts the image and reads the files back (verified via the libguestfs appliance kernel).
+Read-side companion to `Jfs1Writer`. Walks the JFS1 superblock, inode array, and writer-emitted directory blocks to surface every file at its full nested path.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Nilfs2Writer` | `Nilfs2Writer()` |  |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> opener)` | Adds a file whose bytes are copied straight from `opener` into the image at write time, so a payload larger than memory — or than a byte[] — can be stored. |
-| `Build` | `byte[] Build(int blockSize = 4096, string volumeLabel = null)` | Builds the NILFS2 image in memory. `blockSize` must be a power of two in [1024, 65536]; `volumeLabel` is written into the superblock's volume-label slot at +0xA8. Use `Build` for volumes past the array limit. |
-| `Build` | `void Build(Stream output, int blockSize = 4096, string volumeLabel = null)` | Writes the NILFS2 image into `output` from its current position. Only the metadata is assembled in memory; file payloads are copied through, so the volume may be arbitrarily large. |
-| `SetIdentity` | `void SetIdentity(ReadOnlySpan<byte> uuid, uint crcSeed, DateTimeOffset createdAt)` | Fixes the volume's identity and creation time, for a build that has to come out the same twice. |
-| `WriteTo` | `void WriteTo(Stream output)` | Writes the assembled image to a stream. |
-
-### Namespace `FileSystem.Nss`
-
-[`NssBlockMover`](#nssblockmover) · [`NssEntry`](#nssentry) · [`NssFormatDescriptor`](#nssformatdescriptor) · [`NssHeaders`](#nssheaders) · [`NssReader`](#nssreader) · [`NssVolume`](#nssvolume) · [`NssVolume.VolumeFile`](#nssvolumevolumefile) · [`NssWriter`](#nsswriter)
-
-#### `NssBlockMover`
+| `Jfs1Reader` | `Jfs1Reader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<Jfs1Entry> Entries { get; }` |  |
+| `Extract` | `byte[] Extract(Jfs1Entry entry)` |  |
 
-Moves a file's blocks inside an NSS container and rewrites the directory field that said where they were.
+#### `Jfs1Writer`
 
-Implements `IFilesystemBlockMover`.
+Minimal but spec-keyed writer for OS/2 JFS1 (the original IBM JFS that shipped with OS/2 Warp Server). Emits a real "JFS1"-magic superblock at offset 0 with `s_version = 1` (distinguishing from Linux JFS2 which uses `s_version >= 2`) followed by an inode table and per-file single-extent data blocks. Scope. OS/2 JFS1's on-disk format is documented in the IBM JFS for OS/2 Technical Reference. The writer covers: superblock with configurable block + aggregate-block size, inode array (256-byte dinodes), single-block directory bodies with (inode + nlen + name) dirents, single-extent file bodies. The dmap/IAG bitmap chain, secondary AIT/AIM trees, dtree B+ index pages, and the inline data extents larger than one block are out of WORM scope.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NssBlockMover` | `NssBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` |  |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the anchors and the directory. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the one field naming the file it is given. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A file may be held outside the container while the rest of the layout moves, which is what lets a full one be rearranged at all. |
-| `Init` | `void Init(Stream image)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `Jfs1Writer` | `Jfs1Writer()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the layout is settled from it before a byte is read, so a payload past what a byte[] can hold is placed like any other. |
+| `Build` | `byte[] Build()` | Materialises the whole volume. |
+| `SetAggregateBlockSize` | `void SetAggregateBlockSize(int abs)` |  |
+| `SetBlockSize` | `void SetBlockSize(int bs)` |  |
+| `SetVolumeLabel` | `void SetVolumeLabel(string s)` |  |
+| `WriteTo` | `void WriteTo(Stream output)` | Writes the volume into `output`: the blocks the filesystem populates, then each file's bytes at the offset it was allocated. Only a non-seekable target has to materialise the volume, so a seekable one is bounded by the disk rather than by what a byte[] can address. |
 
-#### `NssEntry`
+### Namespace `FileSystem.JuiceFs`
 
-One entry surfaced by the NSS read-only descriptor. We do not parse the object tree itself (the on-disk layout is proprietary and lacks a publicly verifiable spec). We only ever produce synthetic entries describing the pool / volume headers we located.
+[`JuiceFsEntry`](#juicefsentry) · [`JuiceFsFormatDescriptor`](#juicefsformatdescriptor) · [`JuiceFsReader`](#juicefsreader)
+
+#### `JuiceFsEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NssEntry` | `NssEntry()` |  |
+| `JuiceFsEntry` | `JuiceFsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `LastModified` | `DateTime? LastModified { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `NssFormatDescriptor`
+#### `JuiceFsFormatDescriptor`
 
-Read-only descriptor for NSS (Novell Storage Services) — the pool-based, object-aware filesystem that replaced NWFS386 from NetWare 5+ onwards and remains the default for Novell / OpenText Open Enterprise Server. **HONEST DISCLAIMER**: NSS's on-disk format was never publicly documented by Novell. This descriptor identifies NSS-shaped images by scanning for Novell's embedded ASCII anchors ("NSS Pool", "NSSVolume", "SuperBlk", "Novell", "NetWare") in the first 1 MB of the partition. We can locate the pool descriptor and volume / superblock anchors and surface their byte offsets, but we **cannot** walk the object tree or reconstruct files — the layout (block allocation, "Beast" object records, trustee ACL trees) is proprietary. Magic: `"NSS Pool"` — 8 ASCII bytes detected within the first 1 MB via free-form scan. Confidence 0.70 — distinctive enough to seed a match but lower than well-specified filesystems because (a) the layout is RE'd, not vendor-published; (b) the magic is a brand string that can theoretically appear in non-NSS contexts; (c) we cannot validate the surrounding structure. References: Novell (OpenText) NSS File System Administration Guide — operational docs only`https://en.wikipedia.org/wiki/Novell_Storage_Services` — pool/volume/object overviewNetWare 6.5 NSS Storage Management Services documentation
+Stage 0 detection-only descriptor for JuiceFS artefacts. JuiceFS has no standalone on-disk image format: a volume is the combination of an external metadata engine (Redis / MySQL / TiKV / SQLite / PostgreSQL / etcd / FoundationDB / BadgerDB) plus chunks living in an S3-compatible object store. None of these surfaces are resolvable from a single local file, so R/O extraction is genuinely impossible without those external endpoints; staying Stage 0 is the honest treatment. Surfaces only a synthetic `metadata.ini` and the raw image bytes; no real file-walk is attempted. References: `https://juicefs.com` — official JuiceFS site and architecture documentation (metadata engine + object-store chunks)`https://github.com/juicedata/juicefs` — canonical source
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`.
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NssFormatDescriptor` | `NssFormatDescriptor()` |  |
+| `JuiceFsFormatDescriptor` | `JuiceFsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -6808,276 +8222,191 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Writes a container holding the given files. |
-| `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves the files that are out of place and rewrites the directory. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 
-#### `NssHeaders`
-
-Best-effort detector for NSS (Novell Storage Services) — the pool-based, object-aware filesystem that replaced NWFS386 as the default for NetWare 5+ and Open Enterprise Server. Successor to NWFS, predecessor to (still-Novell) NSS-on-Linux in OES. HONEST DISCLAIMER: NSS's on-disk format was never officially documented by Novell. The only public structural information comes from third-party RE notes, Novell support/marketing materials, and utility output (nsscon / nss /poolverify). We can identify NSS-shaped images by scanning for known ASCII signatures Novell embedded in pool / volume / superblock metadata, but we cannot validate the object tree without the proprietary spec. Detected signatures (free-form scan within the first 1 MB): `"NSS Pool"` — appears in the pool descriptor block`"NSSVolume"` — appears in volume descriptors`"SuperBlk"` — appears in NSS object-store superblock copies (typically four mirrored copies)`"Novell"` + `"NetWare"` — corroborating brand strings used as low-weight confirmation; never alone References: Novell (now OpenText) "NSS File System Administration Guide" — operational docs, no on-disk layout`https://en.wikipedia.org/wiki/Novell_Storage_Services` — overview, object/pool modelNetWare 6.5 NSS Storage Management Services docs — pool/volume terminologyRE notes around NSS partition type 0x69 (MBR) on legacy NetWare disks
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `NssHeaders` | `NssHeaders()` |  |
-| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Bytes captured for `volume_header.bin` when any anchor is found. |
-| `NetWareMagic` | `static readonly byte[] NetWareMagic` | "NetWare" — corroborating brand string (low weight, never alone). |
-| `NovellMagic` | `static readonly byte[] NovellMagic` | "Novell" — corroborating brand string (low weight, never alone). |
-| `NssPoolMagic` | `static readonly byte[] NssPoolMagic` | "NSS Pool" — 8 ASCII bytes. Pool descriptor identifier. |
-| `NssSuperblockMagic` | `static readonly byte[] NssSuperblockMagic` | "SuperBlk" — 8 ASCII bytes. Mirrored superblock identifier (typically 4 copies). |
-| `NssVolumeMagic` | `static readonly byte[] NssVolumeMagic` | "NSSVolume" — 9 ASCII bytes. Volume descriptor identifier. |
-| `ScanLimit` | `const int ScanLimit` | Scan limit — the first 1 MB of the image. Larger pools may exist but signatures cluster near the start. |
-| `AnyValid` | `bool AnyValid { get; }` | True iff at least one primary NSS signature (Pool/Volume/SuperBlk) was located. |
-| `HeaderRaw` | `byte[] HeaderRaw { get; }` |  |
-| `NetWareFound` | `bool NetWareFound { get; }` |  |
-| `NovellFound` | `bool NovellFound { get; }` |  |
-| `PoolFoundOffset` | `long PoolFoundOffset { get; }` |  |
-| `PoolFound` | `bool PoolFound { get; }` |  |
-| `SuperblockFoundOffset` | `long SuperblockFoundOffset { get; }` |  |
-| `SuperblockFound` | `bool SuperblockFound { get; }` |  |
-| `VolumeFoundOffset` | `long VolumeFoundOffset { get; }` |  |
-| `VolumeFound` | `bool VolumeFound { get; }` |  |
-| `TryParse` | `static NssHeaders TryParse(ReadOnlySpan<byte> image)` | Free-form scan for NSS anchors. Never throws. Bounds itself to the first 1 MB — pool/volume descriptors live near the start of the partition. We hop 512 B at a time (NSS uses 4 KB blocks but the strings can land at any aligned offset, and 512 keeps the work tiny). |
-
-#### `NssReader`
-
-Best-effort NSS image reader. Parses no object tree — only surfaces the anchors NssHeaders located. Because the on-disk layout is proprietary and lacks a verifiable public spec, we never claim to reconstruct files; we expose the located pool/volume/superblock offsets as synthetic entries the user can correlate with the raw image.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `NssReader` | `NssReader(Stream stream)` |  |
-| `AnyValid` | `bool AnyValid { get; }` | True iff at least one primary NSS anchor was located. |
-| `Entries` | `IReadOnlyList<NssEntry> Entries { get; }` |  |
-| `HeaderRaw` | `byte[] HeaderRaw { get; }` | Bytes captured at the most useful anchor (pool / superblock / volume), 4 KB. |
-| `Headers` | `NssHeaders Headers { get; }` |  |
-| `ImageLength` | `long ImageLength { get; }` |  |
-| `VolumeName` | `string VolumeName { get; }` |  |
-| `ExtractAnchor` | `byte[] ExtractAnchor(NssEntry entry)` | Returns the 64-byte window at the synthetic entry's anchor offset. |
-
-#### `NssVolume`
-
-Walks a container written by `NssWriter` and says where each file's blocks are.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `NssVolume` | `NssVolume(Stream image)` |  |
-| `BlockSize` | `int BlockSize { get; }` |  |
-| `Files` | `IReadOnlyList<VolumeFile> Files { get; }` |  |
-| `ImageLength` | `long ImageLength { get; }` |  |
-| `Status` | `string Status { get; }` |  |
-| `Valid` | `bool Valid { get; }` |  |
-| `BlocksOf` | `long BlocksOf(VolumeFile file)` | How many whole blocks a file occupies. |
-| `Enumerate` | `IEnumerable<DefragBlockInfo> Enumerate()` | The layout a pass plans against. |
-| `Read` | `byte[] Read(VolumeFile file)` | Returns a file's bytes. |
-
-#### `NssVolume.VolumeFile`
-
-A file, and the directory field that says where it is.
-
-Implements `IEquatable<VolumeFile>`.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `VolumeFile` | `VolumeFile(string Name, long Offset, long Size, long OffsetField)` | A file, and the directory field that says where it is. |
-| `Name` | `string Name { get; init; }` | Its name. |
-| `OffsetField` | `long OffsetField { get; init; }` | Where the directory records its position. |
-| `Offset` | `long Offset { get; init; }` | Where its bytes are. |
-| `Size` | `long Size { get; init; }` | How many of them there are. |
+#### `JuiceFsReader`
 
-#### `NssWriter`
+Stage 0 detection-only reader for JuiceFS artefacts. JuiceFS is a POSIX-compatible distributed FS with NO standalone on-disk image format: a volume is the combination of an external metadata engine (Redis / MySQL / TiKV / SQLite / PostgreSQL / etcd / FoundationDB / BadgerDB) and chunks living in S3-compatible object storage (S3 / GCS / MinIO / OSS / OBS / …). Real artefacts in the wild: `juicefs dump` JSON: a plain JSON document starting with `{"Setting":{`; no offset-0 magic.`juicefs dump --binary` (v1.3+): protobuf segments, ends with a 4-byte big-endian BakEOS marker `0x00747083` followed by a protobuf `pb.Footer` and an 8-byte big-endian footer-length trailer (juicedata/juicefs `pkg/meta/backup.go`, `BakMagic = 0x747083`).SQLite metadata backend: a standard SQLite database (`"SQLite format 3\0"`) containing `jfs_node`, `jfs_edge`, `jfs_chunk`, `jfs_setting` tables. Filesystem listing without object-store access would still extract zero bytes for every file. This reader recognises a wrapper-convention tag (ASCII `"JuiceFS"` at offset 0) for surfacing detection only — real JuiceFS files do NOT carry that tag. Even if they did, R/O extraction would still be impossible because (a) inode → chunk-id resolution lives in the metadata engine and (b) chunk bytes live behind an object-store endpoint. Returning empty / zero bytes from `Extract()` would be dishonest; instead we surface the raw image and a self-describing `metadata.ini` that explains why real extraction is structurally impossible.
 
-Writes the NSS container described in `NssLayout`.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NssWriter` | `NssWriter()` |  |
-| `VolumeName` | `string VolumeName { get; init; }` | The volume name written next to the volume anchor. |
-| `AddFile` | `void AddFile(string name, byte[] data)` |  |
-| `Build` | `byte[] Build()` | Lays the container out and returns its bytes. |
-
-### Namespace `FileSystem.Ntfs`
-
-[`Lznt1`](#lznt1) · [`NtfsBlockMover`](#ntfsblockmover) · [`NtfsEntry`](#ntfsentry) · [`NtfsExtentMap`](#ntfsextentmap) · [`NtfsFormatDescriptor`](#ntfsformatdescriptor) · [`NtfsInPlaceAdder`](#ntfsinplaceadder) · [`NtfsInPlaceShrinker`](#ntfsinplaceshrinker) · [`NtfsInPlaceShrinker.ShrinkResult`](#ntfsinplaceshrinkershrinkresult) · [`NtfsReader`](#ntfsreader) · [`NtfsRemover`](#ntfsremover) · [`NtfsWriter`](#ntfswriter)
-
-#### `Lznt1`
+| `JuiceFsReader` | `JuiceFsReader(Stream stream)` |  |
+| `BakMagic` | `const uint BakMagic` | Real JuiceFS binary-backup magic (BakMagic, juicefs 1.3+). Stored big-endian as the BakEOS marker just before the protobuf footer. Source: juicedata/juicefs pkg/meta/backup.go. |
+| `DumpTag` | `static readonly byte[] DumpTag` | Wrapper-convention detection tag: ASCII "JuiceFS" (7 bytes). NOTE: this is NOT a real JuiceFS signature. Real binary backups store BakMagic 0x00747083 (4 bytes BE) in the EOS marker + protobuf footer at end-of-file; JSON dumps start with '{'; the SQLite backend is a standard SQLite database. |
+| `Entries` | `IReadOnlyList<JuiceFsEntry> Entries { get; }` |  |
+| `TrailingWord` | `uint TrailingWord { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(JuiceFsEntry entry)` |  |
 
-LZNT1 compression used by NTFS for compressed files. Operates on 4KB compression units. Each unit is independently compressed.
+### Namespace `FileSystem.Lif`
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `Compress` | `static byte[] Compress(ReadOnlySpan<byte> input)` | Compresses data using LZNT1. |
-| `Decompress` | `static byte[] Decompress(ReadOnlySpan<byte> input, int uncompressedSize)` | Decompresses LZNT1-compressed data. |
+[`LifBlockMover`](#lifblockmover) · [`LifExtentMap`](#lifextentmap) · [`LifFormatDescriptor`](#lifformatdescriptor) · [`LifModifier`](#lifmodifier) · [`LifReader`](#lifreader) · [`LifReader.FileEntry`](#lifreaderfileentry) · [`LifReader.Volume`](#lifreadervolume) · [`LifWriter`](#lifwriter)
 
-#### `NtfsBlockMover`
+#### `LifBlockMover`
 
-In-place NTFS block mover. Moves cluster-aligned extents within an NTFS image and patches the MFT data runs, Update Sequence Array fixup, and cluster bitmap ($Bitmap, MFT record 6) so the file remains reachable at its new location. Handles the common case where a file's data runs cover the moved cluster range. If re-encoding the patched data runs changes byte length and the MFT record lacks sufficient slack space, throws `NotSupportedException` to let the rebuild fallback handle it. Streaming: the mover never loads the whole image. `Init` reads only the boot sector and MFT record 0; all metadata updates are targeted reads/writes via `SectorCache` + `Flush` barriers so a crash mid-operation leaves the image fsck-recoverable, and a multi-TB NTFS volume needs only ~256 MB of cache RAM regardless of size.
+In-place HP LIF block mover. Moves sector-aligned extents within a LIF image and patches the directory entry's start-sector field so the file remains reachable at its new location. LIF files are stored contiguously. Each 32-byte directory entry records the name (10 bytes), file type (u16 BE at +10), start sector (u32 BE at +12), and sector count (u32 BE at +16). Updating the start-sector field is sufficient to redirect the file.
 
-Implements `IFilesystemBlockMover`, `IFilesystemMetadataMover`.
+Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NtfsBlockMover` | `NtfsBlockMover()` |  |
-| `ClusterSize` | `int ClusterSize { get; }` | Bytes per cluster. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | Byte offset past all known metadata regions. For NTFS, the boot sector, MFT, and system file data are all marked MetadataReserved by the extent map. User data can safely be placed at or after this offset. Computed from the MFT location + its extent size as a conservative lower bound. The actual usable origin should be derived from the extent map (see `DefragmentWithPlanner`). |
-| `RelocatableMetadata` | `IReadOnlySet<string> RelocatableMetadata { get; }` |  |
-| `VolumeEndByte` | `long VolumeEndByte { get; }` | The last byte a file may occupy: the end of the volume, not the end of the file holding it. |
-| `Init` | `void Init(Stream image)` | Stream-based initialisation. Reads only the 512-byte boot sector and the first MFT record (typically 1 KB) — used by the streaming code paths so multi-TB images don't have to be loaded into memory. |
-| `Init` | `void Init(byte[] image)` | Initialises the mover by parsing the NTFS boot sector fields. |
+| `LifBlockMover` | `LifBlockMover()` |  |
+| `DataOrigin` | `long DataOrigin { get; }` | Byte offset where the data region begins (past directory). |
+| `UnitSize` | `int UnitSize { get; }` | Allocation unit size (one 256-byte sector). |
+| `Init` | `void Init(Stream image)` | Initialises the mover by parsing the LIF volume header. Must be called before any move operations. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OffsetToSector` | `int OffsetToSector(long offset)` | Converts a byte offset to a sector number. |
+| `SectorToOffset` | `long SectorToOffset(int sector)` | Converts a sector number to a byte offset. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `UpdateMetadataAfterMove` | `void UpdateMetadataAfterMove(Stream image, string metadataName, long oldOffset, long newOffset, long length, IReadOnlyList<ValueTuple<long, long>> liveRanges = null)` | Moves one of the volume's own structures. Each system file's clusters are described by the data runs in its MFT record, so repointing it is the same edit a file gets — except for the two the boot sector names directly, and for the two that describe themselves. |
-
-#### `NtfsEntry`
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `NtfsEntry` | `NtfsEntry()` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `IsSymlink` | `bool IsSymlink { get; init; }` |  |
-| `LastModified` | `DateTime? LastModified { get; init; }` |  |
-| `LinkTarget` | `string LinkTarget { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `Size` | `long Size { get; init; }` |  |
 
-#### `NtfsExtentMap`
+#### `LifExtentMap`
 
-Walks an NTFS image and yields its actual on-disk byte layout — the boot sector, the $MFT itself (record 0's $DATA runs), the 16 reserved system files (records 0-15), and every regular file's $DATA attribute data runs. Each non-resident $DATA's run-list is decoded; resident $DATA bytes surface as a single MetadataReserved tile inside the MFT record. The 16 reserved system records (e.g. $MFTMirr, $LogFile, $Bitmap, $Boot, $UpCase) are flagged as MetadataReserved. Streaming: reads only the boot sector + MFT records on demand via a `SectorCache`. A 50 TB NTFS image with a large $MFT keeps memory bounded to ~256 MB regardless of image size.
+Walks an HP LIF (Logical Interchange Format) volume and yields the actual on-disk byte layout — the volume label sector + the directory sectors as `MetadataReserved`, every per-file contiguous 256-byte sector run as a `Used` extent, and unused sectors as `Free`. Files in LIF are always stored contiguously, so each file produces exactly one Used run.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Single-pass walker. Reads the boot sector, locates $MFT, parses each MFT record's $DATA attribute, then yields one extent per data run. Adjacent runs (LCN N..M and LCN M+1..) are coalesced. |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `NtfsFormatDescriptor`
+#### `LifFormatDescriptor`
 
-Descriptor for Microsoft NTFS volume images ("NTFS " boot-sector OEM magic; $MFT-based metadata) with create, in-place modify and defragment support. References: `https://flatcap.github.io/linux-ntfs/ntfs/` — Linux-NTFS project on-disk structure documentation — the de-facto public NTFS spec`https://github.com/tuxera/ntfs-3g` — maintained open-source implementation`https://learn.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview` — Microsoft's NTFS overview`https://en.wikipedia.org/wiki/NTFS` — Wikipedia article
+Read+write descriptor for HP LIF (Logical Interchange Format) volumes — a flat-directory disk format used by the HP Series 80, HP-71/75/85 personal computers and compatible HP-IL/HP-IB peripherals from the early 1980s. References: `https://www.hp9845.net/9845/projects/hpdir/` — HPDir project; detailed description of the LIF volume/directory layout`https://github.com/bug400/lifutils` — lifutils — maintained tooling for LIF media imagesHP-UX `lif(4)` manual page — HP's own on-disk LIF description
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NtfsFormatDescriptor` | `NtfsFormatDescriptor()` |  |
+| `LifFormatDescriptor` | `LifFormatDescriptor()` |  |
+| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
 | `DefaultExtension` | `string DefaultExtension { get; }` |  |
-| `Description` | `string Description { get; }` | NTFS filesystem image with LZNT1 compression support. The writer emits every reserved system MFT record (0-15) with real content: $MFT, $MFTMirr, $LogFile, $Volume (with a version-3.1 $VOLUME_INFORMATION and a $VOLUME_NAME), $AttrDef, root ., $Bitmap, $Boot, $BadClus, $Secure, $UpCase (128 KiB UTF-16 table), and $Extend. Every record carries $STANDARD_INFORMATION and $FILE_NAME, the Update Sequence Array (USA) fixup is applied at sector boundaries, and the on-disk cluster bitmap reflects actual allocations. |
+| `Description` | `string Description { get; }` |  |
 | `DisplayName` | `string DisplayName { get; }` |  |
 | `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | NTFS creation knobs surfaced by the Convert Archive dialog / CLI: image size (Auto + fixed presets), volume label (capped at 32 chars to match $VOLUME_NAME), cluster size, MFT record size and the 8.3 short-name toggle. Cluster + MFT record size cooperate via `BuildAutoSized` when both are on Auto. The MFT reserve % knob (stash) is not honoured by the upstream writer yet — see Build()'s constant MFT zone — so it's not published here. |
+| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for HP LIF creation: 6-char volume label, directory size (one 256-byte sector holds 7 user files plus a terminator; raising this lifts the 14-file ceiling), and the default LIF file type code applied to every entry. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
-| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation: pre-known per-input sizes drive MFT-record + cluster geometry in pass 1; pass 2 emits all reserved system MFT records + per-user MFT records (with single-run non-resident $DATA for large files), then streams each non-resident entry's bytes from its `OpenStream` factory into its allocated cluster run via 64 KB chunks. Cluster tail past each entry's exact `Size` stays sparse-zero. Resident files (≤ 700 bytes) buffer their bounded source bytes inline in the MFT record — the bound itself caps anything past `Size`. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing LIF image. Uses `LifModifier` for true O(touched bytes) random-access I/O — only the directory sectors and the file's contiguous data run are read or written. |
+| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware NTFS defragmentor. Supports planner-driven in-place path (using `DefragPlanner` + `NtfsBlockMover`) and the legacy rebuild path (using `DefragRebuilder`). Falls back to rebuild when the planner path throws (e.g. data-run re-encoding changes byte length with no slack space). |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the boot sector + $MFT + each MFT record's $DATA attribute and yields one extent per data run. Records 0-15 (the reserved system files: $MFT, $MFTMirr, $LogFile, $Volume, $AttrDef, root, $Bitmap, $Boot, $BadClus, $Secure, $UpCase, $Extend) surface as MetadataReserved; regular files surface as Used. Adjacent runs are coalesced. |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware LIF defragmentor. Tries planner-driven in-place path first, falls back to rebuild path on error. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the LIF directory and yields the actual on-disk byte layout — the volume label + directory sectors as `MetadataReserved`, every per-file contiguous 256-byte sector run as a `Used` extent, and unused sectors as `Free`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes files from an existing NTFS image with full secure wipe (cluster bytes for non-resident data, MFT record, and root-dir index entry). No forensic recovery of the removed content is possible from the resulting bytes. |
-| `Shrink` | `void Shrink(Stream input, Stream output)` | Genuine in-place NTFS shrink: relocates only the clusters above the auto-fit boundary into free space below it via `NtfsInPlaceShrinker`, trims $Bitmap/$Boot, and emits the smaller image. Falls back to the `IArchiveShrinkable` default (verified rebuild / copy-through) when the in-place path cannot handle the image (e.g. a compressed stream would need relocation). |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing LIF image. Uses `LifModifier` for O(touched bytes) random-access I/O. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros the unused (free) sectors of a LIF volume. LIF stores each file as a contiguous run of 256-byte sectors, but the directory entry records the file length only in whole sectors — there is no byte-precise logical size on disk, so a file exactly fills its allocated sectors and there is no recoverable cluster tip. Cluster-tip wiping is therefore N/A: no file-size lookup is supplied and `wipeClusterTips` is forced off so a sector-rounded run is never trimmed below its real on-disk extent. |
 
-#### `NtfsInPlaceAdder`
+#### `LifModifier`
 
-Genuine in-place add for NTFS images — the inverse of `NtfsRemover`. Inserts a small file into the root directory by editing only the structures the change touches: it claims a free MFT record slot (from the MFT's cluster-rounding slack), writes a spec-shaped FILE record (header + USA fixup + $STANDARD_INFORMATION + $FILE_NAME + resident or non-resident $DATA), sets the record's bit in `$MFT:$BITMAP`, allocates any data clusters from `$Bitmap`, and inserts a collation-sorted index entry into the root directory's resident `$INDEX_ROOT`. Existing files, their MFT records and their data clusters stay byte-identical at their original offsets — no whole-image re-pack. The in-place path also handles the structural growth cases: it grows the MFT (allocating a cluster, extending `$MFT:$DATA`'s run list — the reader follows the VCN→LCN mapping — widening `$MFT:$BITMAP` and re-syncing `$MFTMirr`) when no record slot is free; it spills a directory index that outgrows the resident `$INDEX_ROOT` into a pointer-form root + non-resident `$INDEX_ALLOCATION` (a single INDX leaf, USA-fixed) + `$BITMAP`, growing the INDX block size as the directory grows; and it creates intermediate sub-directory FILE records for nested targets (`a/b/c.txt`), linking them through their parents' `$I30` indexes. It still throws (so the caller can rebuild) when an allocation cannot be satisfied — no free data clusters, no contiguous index-allocation run, or a record/attribute that will not fit.
+Random-access in-place modifier for HP LIF (Logical Interchange Format) volumes. The on-disk layout is a flat directory of fixed 32-byte entries followed by contiguous file data; LIF has no allocation bitmap, so free space is recovered by scanning the existing directory for live extents. Files land in the lowest contiguous sector gap above the directory area that fits, mirroring the BBC DFS modifier strategy. Only the directory sectors and the file's own data run are touched on each call.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(byte[] image, string name, byte[] data)` | Adds (or replaces by name) `name` into the root directory of the in-memory NTFS image. Throws `NotSupportedException` / `IOException` for the structural cases above so the caller can rebuild instead. |
-| `MftRecordByteOffset` | `static long MftRecordByteOffset(byte[] image, int slot)` | Public façade over the run-list-aware MFT record mapping for callers that scan the MFT (e.g. `NtfsRemover`). Returns the physical byte offset of record `slot`, following $MFT:$DATA's VCN→LCN run list so a grown, non-contiguous MFT (common on real mkfs.ntfs images after several adds) is read correctly. Returns -1 when the slot is past the MFT's mapped clusters. |
-| `MftRecordSlotCount` | `static int MftRecordSlotCount(byte[] image)` | Number of record slots the MFT's $DATA currently spans (allocated bytes / record size). Lets a scanner bound its loop to the MFT's real extent rather than the whole image. |
-| `RemoveIndexEntry` | `static bool RemoveIndexEntry(byte[] image, uint dirRecord, uint recordNum)` | Removes the index entry referencing `recordNum` from `dirRecord`'s $I30 directory index, then rewrites the index in the smallest representation that fits (resident $INDEX_ROOT, or — if it still does not fit — a single spilled INDX leaf). The whole directory record is rebuilt and re-USA-fixed, so it stays consistent for real mkfs.ntfs / Windows directories whose records use a different update-sequence-array layout than our writer. This is the structural inverse of `InsertIndexEntry` and is invoked by `NtfsRemover`. Returns `true` if an entry was removed. |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, ushort fileType = 57376)` | Adds a file to an existing LIF image. Caller is responsible for ensuring the name does not already exist (use `RemoveFile` first for replace-by-name semantics). The file is placed in the lowest contiguous gap large enough to hold it; the underlying stream is grown if necessary. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image. Returns true if found and removed. When `wipeData` is true (the default) the file data sectors are zeroed before the directory is rewritten. |
 
-#### `NtfsInPlaceShrinker`
+#### `LifReader`
 
-Genuine in-place NTFS volume shrink. Reduces the volume to a smaller cluster count by relocating only the clusters that sit at or above the new boundary into free clusters below it, patching the owning attribute's data runs and the $Bitmap, then trimming the image. Work is `O(clusters relocated + metadata touched)` — clusters that already live below the boundary are never read or rewritten, so the bytes below the boundary stay byte-identical. AlgorithmParse the boot sector. The image spans `(NumberSectors+1)/spc` total volume clusters; the final cluster is reserved for the backup boot sector (its last sector is the one `NumberSectors` excludes), so file data lives in clusters `0..volumeClusters-2`.Pick a target volume-cluster count. The data boundary is `target-1` (the new last cluster stays reserved). Refuse (throw `NotSupportedException`) if the in-use clusters cannot fit below the boundary, or if a cluster at or above it belongs to a compressed/sparse $DATA stream this shrinker cannot relocate.Walk every MFT record's non-resident $DATA / $INDEX_ALLOCATION runs. For every run that crosses the boundary, claim a contiguous free region below it (falling back to per-cluster), copy the cluster bytes, rewrite the run list to the new LCNs, and flip the old/new $Bitmap bits. The attribute is grown in place (shifting the record tail) when the relocated run list needs more bytes. $MFT, $MFTMirr, $LogFile, $Bitmap and the directory indices are handled by the same record walk (records 0..15 included).Reshape $Bitmap to the new size (reserve the new backup cluster, pad the final bitmap byte), rewrite $Boot's `NumberSectors`, copy the boot sector to the new last sector (the relocated backup boot), re-sync $MFTMirr, and truncate the image to `target * clusterSize`.Supported shrink shapes (in place, no re-pack): any target where the highest in-use cluster can be relocated into free space below the boundary and every relocated attribute is a plain (uncompressed, non-sparse) non-resident stream. Refused (`NotSupportedException`): a target below the in-use cluster count, or one that would require relocating a compressed/sparse stream (those keep their on-disk LCNs and are left to the rebuild fallback).
+Reader for HP LIF (Logical Interchange Format) volumes — the disk format used by the HP Series 80, HP-71, HP-75, and HP-85 personal computers as well as the HP-IL/HP-IB peripherals from that era. Volumes contain a flat directory of fixed-length files described by 32-byte directory entries.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ShrinkToClusters` | `static ShrinkResult ShrinkToClusters(byte[] image, long targetClusters)` | Shrinks an NTFS image in place to exactly `targetClusters` clusters, relocating any allocation at or above the boundary into free space below it. |
-| `ShrinkToFit` | `static ShrinkResult ShrinkToFit(byte[] image)` | Shrinks an NTFS image in place to the smallest cluster count that still holds the current allocation (auto-fit). Equivalent to `ShrinkToClusters` with the tightest legal target. |
-
-#### `NtfsInPlaceShrinker.ShrinkResult`
+| `LifReader` | `LifReader()` |  |
+| `LifMagic` | `const ushort LifMagic` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `Extract` | `static byte[] Extract(Volume v, FileEntry e)` |  |
+| `Read` | `static Volume Read(ReadOnlySpan<byte> image)` |  |
 
-Result of a shrink attempt: the before/after byte sizes and how many bytes were physically rewritten.
+#### `LifReader.FileEntry`
 
-Implements `IEquatable<ShrinkResult>`.
+Implements `IEquatable<FileEntry>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ShrinkResult` | `ShrinkResult(long OriginalSize, long NewSize, long BytesRelocated, long ClustersRelocated)` | Result of a shrink attempt: the before/after byte sizes and how many bytes were physically rewritten. |
-| `BytesRelocated` | `long BytesRelocated { get; init; }` |  |
-| `ClustersRelocated` | `long ClustersRelocated { get; init; }` |  |
-| `NewSize` | `long NewSize { get; init; }` |  |
-| `OriginalSize` | `long OriginalSize { get; init; }` |  |
-| `WasReduced` | `bool WasReduced { get; }` | True when the image was actually made smaller. |
+| `FileEntry` | `FileEntry(string Name, ushort FileType, int StartSector, int LengthSectors, long ByteLength, DateTime? Created)` |  |
+| `ByteLength` | `long ByteLength { get; init; }` |  |
+| `Created` | `DateTime? Created { get; init; }` |  |
+| `FileType` | `ushort FileType { get; init; }` |  |
+| `LengthSectors` | `int LengthSectors { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `StartSector` | `int StartSector { get; init; }` |  |
 
-#### `NtfsReader`
+#### `LifReader.Volume`
 
-Reads NTFS filesystem images. Parses boot sector, MFT records, attributes ($FILE_NAME, $DATA), and supports both resident and non-resident data extraction with data run decoding.
-
-Implements `IDisposable`.
+Implements `IEquatable<Volume>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NtfsReader` | `NtfsReader(Stream stream, bool leaveOpen = false)` |  |
-| `Entries` | `IReadOnlyList<NtfsEntry> Entries { get; }` |  |
-| `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(NtfsEntry entry)` | Extracts a file's data from the NTFS image. |
+| `Volume` | `Volume(string Label, int DirectoryStartSector, int DirectorySectors, IReadOnlyList<FileEntry> Files, byte[] Image)` |  |
+| `DirectorySectors` | `int DirectorySectors { get; init; }` |  |
+| `DirectoryStartSector` | `int DirectoryStartSector { get; init; }` |  |
+| `Files` | `IReadOnlyList<FileEntry> Files { get; init; }` |  |
+| `Image` | `byte[] Image { get; init; }` |  |
+| `Label` | `string Label { get; init; }` |  |
 
-#### `NtfsRemover`
+#### `LifWriter`
 
-Secure-remove implementation for NTFS images. Finds the named file in the MFT (records 16+), zeros every cluster referenced by its $DATA attribute (including resident-value bytes for small files), clears the corresponding index entry in the root directory's $INDEX_ROOT, and zeros the entire 1024-byte MFT record. After the operation no bytes of the original filename or content remain recoverable from the image. Root-directory-only for now; nested-directory removal is a follow-up. The reader skips records whose "FILE" signature is missing, so zeroing the whole record is sufficient to hide the file from enumeration and extraction.
+Writer for HP LIF volumes — flat-directory layout with the directory at sector 2 (the conventional LIF starting location). Files are stored contiguously starting after the directory; the writer enforces an upper bound of 14 files unless a caller increases the directory size.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Remove` | `static void Remove(byte[] image, string fileName)` | Removes `fileName` from the in-memory NTFS image. Throws `FileNotFoundException` if no MFT record matches. The image is modified in place. |
+| `LifWriter` | `LifWriter()` |  |
+| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeLabel = "", ushort defaultFileType = 57376, int dirSectors = 1)` | Builds a LIF image from the supplied files. `volumeLabel` is truncated/padded to 6 ASCII characters; non-ASCII bytes are replaced with '?'. |
 
-#### `NtfsWriter`
+### Namespace `FileSystem.LittleFs`
 
-Builds spec-compliant NTFS filesystem images. All reserved system MFT records (0-15) are populated with real content: $MFT, $MFTMirr, $LogFile, $Volume, $AttrDef, root $., $Bitmap, $Boot, $BadClus, $Secure, $UpCase, and $Extend. Every record carries the mandatory $STANDARD_INFORMATION and $FILE_NAME attributes, the Update Sequence Array (USA) fixup is applied at sector boundaries, and the on-disk cluster bitmap reflects which clusters are actually allocated. Small files (<700 bytes) use a resident $DATA attribute; larger files use non-resident cluster runs. Images produced by this writer carry all the structure that chkdsk and the Linux ntfs-3g driver check at mount time: volume serial, valid boot signature, every system file has its "FILE" magic, USA fixup at `record[510..512]` and `record[1022..1024]`, $Volume carries a valid $VOLUME_INFORMATION (version 3.1), the $UpCase data stream is 128 KiB long (65 536 UTF-16 upper-case mappings) and $Bitmap only marks clusters that hold actual filesystem metadata/data. Large directories: when a directory's $I30 file-name index no longer fits in the resident $INDEX_ROOT inside its MFT record, it spills into a non-resident $INDEX_ALLOCATION (a stream of "INDX" index records, each with its own USA fixup) tracked by a named $BITMAP. The $INDEX_ROOT then holds routing pointer entries (subnode VCN flag 0x01 + 8-byte child VCN at the entry tail) into those INDX leaves, and the FILE_NAME entries live in the leaves sorted by NTFS file-name collation. A single B+tree level is built: the resident root points directly at leaf blocks. To keep all routing pointers resident, the INDX block size is grown (power-of-two, 4 KiB..64 KiB) as the entry count rises. With the default 1024-byte MFT record this handles tens of thousands of short-named entries per directory; only a directory whose routing pointers would overflow even a 64 KiB block (hundreds of thousands of entries) would need a second tree level, which is not yet implemented. 8.3 short names: by default every $FILE_NAME is recorded in the Win32&DOS namespace (3) so the long name also serves as the 8.3 short name, the way a freshly formatted Windows volume does. Passing `generateShortNames: false` records names in the Win32-only namespace (1) and emits no DOS short name — the equivalent of `fsutil behavior set disable8dot3`.
+[`LittleFsBlockMover`](#littlefsblockmover) · [`LittleFsFileEntry`](#littlefsfileentry) · [`LittleFsFormatDescriptor`](#littlefsformatdescriptor) · [`LittleFsInPlaceModifier`](#littlefsinplacemodifier) · [`LittleFsReader`](#littlefsreader) · [`LittleFsWriter`](#littlefswriter)
+
+#### `LittleFsBlockMover`
+
+Moves a file's blocks inside a littlefs volume and threads the skip-list through their new homes.
+
+Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NtfsWriter` | `NtfsWriter(string volumeLabel = "", bool generateShortNames = true)` | Creates a new NTFS writer. The volume label is stored in $Volume's $VOLUME_NAME attribute. |
-| `DeclaredVolumeBytes` | `long DeclaredVolumeBytes { get; }` | Declared volume size in bytes of the most recent build. |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the NTFS image. |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file: `size` drives MFT-record + cluster sizing in pass 1; bytes are pulled from `openStream` in pass 2 of `BuildToStreaming`. Files larger than the resident threshold (~700 bytes) get a single-run non-resident $DATA whose clusters are filled from the source via 64 KB chunks; smaller files remain resident and are buffered up-front (the size-clamped bounded read still satisfies the isolation contract). |
-| `BuildAutoSized` | `byte[] BuildAutoSized(int requestedClusterSize = 0, int requestedMftRecordSize = 0)` | Builds the image with the cluster size and MFT record size chosen by `FilesystemLayoutOptimizer` to minimise file slack + MFT-zone reservation + per-file MFT-record waste, and the volume sized to exactly hold the files plus structural overhead. |
-| `BuildToStreamingAutoSized` | `void BuildToStreamingAutoSized(Stream output)` | Two-pass streaming Build with auto-sized geometry. |
-| `BuildToStreaming` | `void BuildToStreaming(Stream output, long totalSize)` | Two-pass streaming Build: pass 1 derives MFT-record + cluster geometry from the declared sizes of `AddStreamingFile` entries; pass 2 emits all reserved system MFT records (0..15) + the per-user MFT records (with $DATA attributes pointing at single-run non-resident allocations for files > ResidentThreshold), then streams each non-resident entry's bytes from its factory into its allocated cluster run via 64 KB chunks. Cluster tail past each entry's exact `Size` stays sparse-zero (the in-memory disk byte[] was zero-initialised and the per-entry stream copy never reads past the entry's logical size). |
-| `BuildToStreaming` | `void BuildToStreaming(Stream output, long totalSize, int clusterSizeBytes, int mftRecordSize)` |  |
-| `BuildTo` | `void BuildTo(Stream output, long totalSize, int clusterSize = 4096, int mftRecordSize = 1024)` | Writes the volume to `output`: the populated prefix, then the declared length, then the two regions that live past the prefix. Free space costs nothing, so volumes far beyond the in-memory limit are producible. |
-| `Build` | `byte[] Build(int totalSize = 4194304)` | Builds the NTFS filesystem image with the default geometry (4 MiB volume, 4 KiB clusters, 1024-byte MFT records). Kept as a parameterless-default overload so existing callers/tests remain byte-compatible. |
-| `Build` | `byte[] Build(int totalSize, int clusterSize, int mftRecordSize)` | Builds the NTFS filesystem image with a tunable cluster size and MFT record size. |
-| `PlanAutoSize` | `ValueTuple<long, int, int> PlanAutoSize(int requestedClusterSize = 0, int requestedMftRecordSize = 0)` | Volume size, cluster size and MFT-record size an auto-sized build would use for the files added. The size is a long: clamping it to int for `Build` is exactly what capped an auto-sized volume at 2 GB, and the streaming path needs no such clamp. |
-| `SetCompression` | `void SetCompression(bool enabled)` | Enables or disables NTFS LZNT1 compression of file `$DATA` for this build. When enabled every non-resident file is stored as a compressed attribute (16-cluster compression units, the `0x0001` compressed flag, sparse runs for saved clusters). Resident files (≤ ~700 bytes) are left uncompressed, mirroring real NTFS which never compresses resident data. Default is off; call before any `Build` overload. |
-| `SetNtfsMinorVersion` | `void SetNtfsMinorVersion(byte minorVersion)` | Sets the NTFS minor version stamped into `$VOLUME_INFORMATION` (the major version is always 3). Accepts 0 (NTFS 3.0, Windows 2000) or 1 (NTFS 3.1, Windows XP and later — the default). |
-| `SetVolumeSerial` | `void SetVolumeSerial(long serial)` | Fixes the volume serial, for a build that has to come out the same twice. |
+| `LittleFsBlockMover` | `LittleFsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A block, which is what the skip-list counts in. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file's block may occupy: past the metadata pair at the front that everything is found through. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call notes where one block has got to; the pointers are threaded once the whole file has landed. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A block may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the volume once and notes what each file is made of. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SettleChains` | `void SettleChains(Stream image)` | Threads every file's skip-list through where its blocks ended up, and writes each new head into the commit that names it. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-### Namespace `FileSystem.Nwfs`
+#### `LittleFsFileEntry`
 
-[`NwfsFormatDescriptor`](#nwfsformatdescriptor) · [`NwfsHeaders`](#nwfsheaders) · [`NwfsReader`](#nwfsreader) · [`NwfsReader.Item`](#nwfsreaderitem) · [`NwfsWriter`](#nwfswriter)
+A described file inside a littlefs image: its full slash-joined path plus the information needed to read its bytes (an inline payload or a CTZ skip-list head).
 
-#### `NwfsFormatDescriptor`
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `LittleFsFileEntry` | `LittleFsFileEntry()` |  |
+| `Path` | `string Path { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-Read-only descriptor for NWFS386 (Novell NetWare 386 / "Traditional NetWare File System") — used in NetWare 2.x/3.x/4.x and as the SYS: filesystem in 5.x/6.x. NSS (Novell Storage Services) replaced it for new volumes from 1998 but NWFS images still surface in archaeology / migration workflows. **PROVENANCE**: Novell never released the on-disk format. What is read and written here follows the public reverse-engineering of it (notably the zhmu/nwfs project, whose documentation and reader were both checked against). Volumes written by `NwfsWriter` are read back by that project's own `transfer` tool — directory tree, sizes and file bytes all agreeing — so contents are no longer merely detected. Still out of scope: suballocation, Turbo FAT, compression, mirrored partitions, volumes spanning several partitions, and the salvage area. A volume using any of those reads only as far as its plain structures go. Magic: `HOTFIX00` — 8 ASCII bytes at byte offset `0x4000` (16384, = sector 32 at 512 B sectors). Confidence 0.85: 8 bytes of ASCII at a fixed offset is high-signal, but because the layout is RE-derived we keep a small margin below the 0.9-0.95 used for spec-stable filesystems. "MIRROR00" and "NetWare Volumes" are detected as corroboration but not used for primary signature matching. References: `https://github.com/zhmu/nwfs` — primary reverse-engineering project, incl. `doc/nwfs386.md``https://github.com/jeffmerkey/netware-file-system` — secondary reference
+#### `LittleFsFormatDescriptor`
 
-Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+Read-only descriptor for LittleFS images (Arduino / RTOS / IoT embedded-flash FS). Surfaces the superblock and parsed geometry. Walking the tag-based metadata pair commit log with CRC validation is intentionally out of scope — that's a full reference-implementation port. Detection + structural surfacing is the win. References: `https://github.com/littlefs-project/littlefs` — canonical littlefs source (ARM Mbed lineage)`https://github.com/littlefs-project/littlefs/blob/master/SPEC.md` — on-disk format specification`https://github.com/littlefs-project/littlefs/blob/master/DESIGN.md` — design document (metadata pairs, CTZ skip-lists)
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NwfsFormatDescriptor` | `NwfsFormatDescriptor()` |  |
+| `LittleFsFormatDescriptor` | `LittleFsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -7089,105 +8418,163 @@ Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The only writer-honoured knob is the block size: it is recorded in the littlefs superblock geometry (and bounds the inline-file threshold and CTZ block layout). LittleFS stores no volume label, so no label knob is published. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Genuine in-place add/replace: rewrites only the inactive half of the root metadata pair with a fresh commit at `revision+1` and appends any new CTZ / subdirectory blocks past the current block count. The active root half and every existing data block stay byte-identical at their offsets — the littlefs metadata-pair ping-pong / copy-on-write model. See `LittleFsInPlaceModifier`. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds a fresh littlefs image from `inputs`. Files keep their archive-relative paths (forward-slash separated), so subdirectories are recreated as littlefs directory metadata pairs. Small files are stored inline; larger ones use CTZ skip-lists. The result round-trips through `LittleFsReader`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again by moving blocks. Nothing outside a file names its blocks except the head: the rest are named from inside the file, by the pointers each block opens with. Those are threaded again from the finished order, and the head is written into the commit that names it. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Genuine in-place remove: drops the named entries and rewrites the inactive root half at `revision+1`. Existing live blocks stay byte-identical; the removed file's data blocks are simply no longer referenced. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
-#### `NwfsHeaders`
+#### `LittleFsInPlaceModifier`
 
-Best-effort detector for the Novell NetWare 386 (NWFS386) filesystem — a.k.a. the Traditional NetWare File System. NWFS was the *only* filesystem in NetWare 2.x/3.x/4.x and the default for the SYS: volume in NetWare 5/6. Its on-disk format was never publicly documented by Novell; everything we know comes from reverse-engineering. Read-only — we cannot validate contents without an authoritative spec. Detected signatures (per the zhmu/nwfs reverse-engineering project): `"HOTFIX00"` — 8 ASCII bytes at byte offset `0x4000` (16384) within the partition (sector 32 with 512 B sectors). Marks the start of the Hot Fix area.`"MIRROR00"` — 8 ASCII bytes adjacent to HOTFIX. Marks the Mirror header.`"NetWare Volumes"` — 16 ASCII bytes (NUL-padded) in the volume area following the redirection sectors. Marks the Volume area. References: `https://github.com/zhmu/nwfs` — primary RE source for NWFS286/NWFS386`https://github.com/jeffmerkey/netware-file-system` — secondary reference (former Novell engineers' release)NWFS386 partitions: HOTFIX_OFFSET = 0x4000, sector 32 (assumes 512 B sectors)
+Genuine in-place modifier for littlefs v2 images emitted by `LittleFsWriter`. littlefs is inherently append/copy-on-write within its erase blocks: each metadata pair ping-pongs between its two blocks (the half with the higher revision count wins), and file data lives in CTZ skip-list blocks addressed by block index. This modifier exploits exactly that: The root metadata pair stays at blocks 0,1. A mutation rewrites only the inactive half (the one with the lower revision) with a fresh commit at `revision+1` carrying the updated directory — the active half stays byte-identical, exactly the metadata-pair ping-pong the reference driver performs.New subdirectory metadata pairs and new CTZ file data are written into blocks appended past the current block count; existing data blocks are never overwritten or relocated, so they stay byte-identical at their offsets.In-place invariant. Add / Replace / Remove preserve the active root half plus every existing CTZ/subdir block byte-identical at its offset, and grow the image by only the blocks the new tree needs (O(bytes changed) for the common flat-file case). The superblock's `block_count` is updated in the rewritten root commit (it is covered by the commit CRC, so it is re-emitted, not patched).Verification. littlefs has no Linux fsck; correctness is proven by the reader round-trip plus the byte-identity offset proof.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NwfsHeaders` | `NwfsHeaders()` |  |
-| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Bytes captured for `volume_header.bin` — first 4 KB containing HOTFIX/MIRROR. |
-| `HotfixMagic` | `static readonly byte[] HotfixMagic` | HOTFIX header signature — 8 ASCII bytes at offset 0x4000 within the partition. |
-| `HotfixOffset` | `const long HotfixOffset` | HOTFIX_OFFSET — Hot Fix area lives at this byte offset from the start of the partition. |
-| `HotfixSector` | `const int HotfixSector` | Sector 32 with 512 B sectors equals HotfixOffset. |
-| `MirrorMagic` | `static readonly byte[] MirrorMagic` | MIRROR header signature — 8 ASCII bytes at the Mirror sector. |
-| `VolumeAreaSize` | `const int VolumeAreaSize` | Volume area span (4 mirrored copies of 16 KB). |
-| `VolumesMagic` | `static readonly byte[] VolumesMagic` | Volume area signature — 16 ASCII bytes (NUL-padded) at the start of the Volume area. |
-| `AnyValid` | `bool AnyValid { get; }` | True iff at least one of the three RE'd signatures was located. |
-| `HeaderRaw` | `byte[] HeaderRaw { get; }` | Raw 4 KB capture starting at HotfixOffset (when present), else empty. |
-| `HotfixFoundOffset` | `long HotfixFoundOffset { get; }` | Byte offset where HOTFIX was located (or -1). |
-| `HotfixFound` | `bool HotfixFound { get; }` | True iff the HOTFIX00 signature was found at `HotfixOffset`. |
-| `MirrorFoundOffset` | `long MirrorFoundOffset { get; }` | Byte offset where MIRROR was located (or -1). |
-| `MirrorFound` | `bool MirrorFound { get; }` | True iff the MIRROR00 signature was found anywhere in the first 64 KB. |
-| `VolumesFoundOffset` | `long VolumesFoundOffset { get; }` | Byte offset where "NetWare Volumes" was located (or -1). |
-| `VolumesFound` | `bool VolumesFound { get; }` | True iff the "NetWare Volumes" signature was found anywhere in the first 64 KB. |
-| `TryParse` | `static NwfsHeaders TryParse(ReadOnlySpan<byte> image)` | Best-effort scan. Looks for HOTFIX00 at offset 0x4000 first (canonical), then scans the first 64 KB for MIRROR00 and "NetWare Volumes". Never throws. |
+| `Add` | `static void Add(Stream image, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Remove` | `static void Remove(Stream image, string[] entryNames)` |  |
+| `Replace` | `static void Replace(Stream image, string name, byte[] newData)` |  |
 
-#### `NwfsReader`
+#### `LittleFsReader`
 
-Reads a NetWare 386 volume: finds the partition, walks the directory chain, and follows a file through the FAT to its bytes.
+Reads a littlefs v2 image: walks each directory's metadata-pair commit log (validating the commit CRC), follows hard-tail and directory-struct links, and resolves file structs (inline payloads and CTZ skip-lists) into byte content.
+
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `BlockSize` | `int BlockSize { get; }` | Bytes to a block on this volume. |
-| `VolumeName` | `string VolumeName { get; }` | What the volume calls itself. |
-| `List` | `List<Item> List()` | Everything on the volume, each with the path it is reached by. |
-| `ReadFile` | `byte[] ReadFile(string path)` | The bytes of the file at `path`, or null if there is none. |
-| `Read` | `byte[] Read(Item item)` | The bytes of `item`, followed through the FAT. |
-| `TryOpen` | `static NwfsReader TryOpen(byte[] image)` | Opens the first NetWare volume in `image`, or null if there is none. |
+| `LittleFsReader` | `LittleFsReader(Stream stream, bool leaveOpen = true)` |  |
+| `LittleFsReader` | `LittleFsReader(byte[] image)` |  |
+| `BlockSize` | `uint BlockSize { get; }` |  |
+| `Files` | `IReadOnlyList<LittleFsFileEntry> Files { get; }` |  |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `MetadataBlocks` | `IReadOnlyCollection<uint> MetadataBlocks { get; }` | Blocks holding metadata pairs — the superblock pair and every directory's commit log. A wipe must leave these alone. |
+| `Dispose` | `void Dispose()` |  |
+| `FileBlocks` | `IEnumerable<uint> FileBlocks(LittleFsFileEntry entry)` | The blocks of an entry's CTZ skip-list, in file order. An inline file lives inside its directory's commit and yields nothing. |
+| `ReadFileTo` | `long ReadFileTo(LittleFsFileEntry entry, Stream destination)` | Writes `entry`'s bytes into `destination`, one CTZ block at a time. Returns the number of bytes written. |
+| `ReadFile` | `byte[] ReadFile(LittleFsFileEntry entry)` | Returns the bytes of `entry`. |
 
-#### `NwfsReader.Item`
+#### `LittleFsWriter`
 
-One thing on the volume: a file or a directory.
+From-scratch (write-once) builder for a minimal but specification-accurate littlefs v2 image. Produces a root metadata pair carrying the superblock and the root directory entries, one metadata pair per subdirectory (linked via hard-tail tags), inline structs for small files, and CTZ skip-lists for files that do not fit inline. The result round-trips through `LittleFsReader`.
 
-Implements `IEquatable<Item>`.
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `LittleFsWriter` | `LittleFsWriter(uint blockSize = 4096)` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file at `name`, creating intermediate directories as needed. Forward slashes separate path components. |
+| `Build` | `byte[] Build()` |  |
+| `WriteTo` | `void WriteTo(Stream output)` |  |
+
+### Namespace `FileSystem.Lustre`
+
+[`LustreEntry`](#lustreentry) · [`LustreFormatDescriptor`](#lustreformatdescriptor) · [`LustreReader`](#lustrereader)
+
+#### `LustreEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Item` | `Item(string Path, bool IsDirectory, long Length, uint FirstBlock)` | One thing on the volume: a file or a directory. |
-| `FirstBlock` | `uint FirstBlock { get; init; }` |  |
+| `LustreEntry` | `LustreEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `Length` | `long Length { get; init; }` |  |
-| `Path` | `string Path { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-#### `NwfsWriter`
+#### `LustreFormatDescriptor`
 
-Writes a NetWare 386 disk image: a partition table naming one NetWare partition, the hotfix, mirror and volume headers that open it, and a volume whose files a NetWare reader walks by the same route a real one does.
+R/O descriptor for Lustre MDT/OST images via ldiskfs (ext4-compatible) reader delegation. Surfaces the ldiskfs view of a single MDT or OST backing store — NOT the Lustre logical view (which would require combining MDT inode metadata with file data striped across multiple OSTs, out of scope without live cluster metadata). Detection is extension-routed (.lustre / .ost / .mdt) and the legacy "LUSTRE" / "LUst" object-header magic at offset 0; ext4 superblock magic is deliberately NOT registered here (it would steal detection from generic ext4 images). When opened with an ldiskfs MDT/OST image (recognised by the .ost / .mdt / .lustre extension), `LustreReader` delegates the file walk to `FileSystem.Ext.ExtReader`. References: `https://www.lustre.org/` — project home`https://wiki.lustre.org/` — Lustre wiki (architecture, ldiskfs/MDT/OST layout)`https://en.wikipedia.org/wiki/Lustre_(file_system)` — Wikipedia article
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `NwfsWriter` | `NwfsWriter()` |  |
-| `BlockSize` | `int BlockSize { get; set; }` | Bytes to a block. A NetWare volume may use 1 KB to 256 KB, by powers of two. |
-| `PartitionStartSector` | `uint PartitionStartSector { get; set; }` | Where the NetWare partition begins, in sectors. |
-| `RedirectionSectors` | `uint RedirectionSectors { get; set; }` | Sectors between the hotfix header and the volume area. |
-| `Timestamp` | `DateTime Timestamp { get; set; }` | When the volume and everything on it is dated. |
-| `VolumeName` | `string VolumeName { get; set; }` | What the volume is called. NetWare's own first volume is SYS. |
-| `AddFile` | `void AddFile(string path, byte[] data)` | Adds a file. Directories in `path` are made as needed. |
-| `Build` | `byte[] Build()` | Builds the image. |
+| `LustreFormatDescriptor` | `LustreFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 
-### Namespace `FileSystem.Ocfs2`
+#### `LustreReader`
 
-[`Ocfs2BlockMover`](#ocfs2blockmover) · [`Ocfs2FormatDescriptor`](#ocfs2formatdescriptor) · [`Ocfs2InPlaceModifier`](#ocfs2inplacemodifier) · [`Ocfs2Superblock`](#ocfs2superblock)
+R/O reader for Lustre MDT/OST images via ldiskfs (ext4-compatible) delegation. Lustre is a high-performance distributed parallel filesystem (originally from CMU, now under OpenSFS). Files are striped across many OST (Object Storage Target) servers and the MDS (MetaData Server) holds the namespace. Lustre's on-disk format for MDT/OST backing stores is `ldiskfs`, a fork of ext4 with Lustre-specific extended attributes (LMA, LOV EA striping, FID pointers) and a few feature flags. The block-level format — superblock, group descriptors, inode table, extent trees, directory blocks — is byte-compatible with ext4 for read purposes. We delegate to `ExtReader` for the file walk and surface the ldiskfs view (the raw inode/directory tree of one MDT or OST), not the Lustre logical view (which requires combining MDT inode metadata with object data striped across multiple OSTs — out-of-scope without live cluster metadata). Detection paths: 1. Legacy "LUSTRE" / "LUst" tag at offset 0 — speculative OST object-header dumps; surfaces metadata.ini + the raw object bytes (Stage-0 behaviour preserved for back-compat). 2. ext4 superblock magic 0xEF53 at offset 1080 — real ldiskfs MDT/OST backing-store image. Surfaces metadata.ini + the ldiskfs file walk via `ExtReader`.
 
-#### `Ocfs2BlockMover`
+Implements `IDisposable`.
 
-Moves a file's clusters inside an OCFS2 volume, repoints the extent record in its dinode, and moves the allocation with it.
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `LustreReader` | `LustreReader(Stream stream)` |  |
+| `LongTag` | `static readonly byte[] LongTag` | Lustre long tag: ASCII "LUSTRE" (6 bytes). |
+| `ShortTag` | `static readonly byte[] ShortTag` | Lustre short tag: bytes 0x4C 0x55 0x73 0x74 (= 0x4C557374 BE). |
+| `Entries` | `IReadOnlyList<LustreEntry> Entries { get; }` |  |
+| `IsLdiskfs` | `bool IsLdiskfs { get; }` | True if the input was identified as an ldiskfs (ext4) image and delegated to `ExtReader`. |
+| `LdiskfsVolumeLabel` | `string LdiskfsVolumeLabel { get; }` | Volume label parsed from the ldiskfs superblock (offset 1024+120, 16 bytes), or empty if not ldiskfs / unset. |
+| `Tag` | `string Tag { get; }` |  |
+| `TrailingWord` | `uint TrailingWord { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(LustreEntry entry)` |  |
+
+### Namespace `FileSystem.Mfs`
+
+[`MfsBlockMover`](#mfsblockmover) · [`MfsEntry`](#mfsentry) · [`MfsExtentMap`](#mfsextentmap) · [`MfsFormatDescriptor`](#mfsformatdescriptor) · [`MfsModifier`](#mfsmodifier) · [`MfsReader`](#mfsreader) · [`MfsWriter`](#mfswriter)
+
+#### `MfsBlockMover`
+
+In-place MFS block mover. Moves allocation-block-aligned extents within an MFS image and patches the directory entry's first-block field so the file remains reachable at its new location. MFS stores files in contiguous allocation blocks. Each directory entry records a first-block field (u16 BE at +26) and a file size (u32 BE at +28). The allocation map is derived implicitly from the union of directory entries, so updating the directory entry's first-block pointer is sufficient to redirect the file to its new location.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Ocfs2BlockMover` | `Ocfs2BlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | The volume's block, which is also its cluster at these geometries. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the system inodes and their groups. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the geometry and notes where every file's data starts. |
+| `MfsBlockMover` | `MfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation block size in bytes. |
+| `DataOrigin` | `long DataOrigin { get; }` | Byte offset of the first allocation block. |
+| `BlockToOffset` | `long BlockToOffset(int block)` | Converts a 0-based block index to a byte offset. |
+| `Init` | `void Init(Stream image)` | Initialises geometry from the MFS MDB. Must be called before any move. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OffsetToBlock` | `int OffsetToBlock(long offset)` | Converts a byte offset to a 0-based block index. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `Ocfs2FormatDescriptor`
+#### `MfsEntry`
 
-R/W descriptor for OCFS2 (Oracle Cluster Filesystem 2). Supports: list, extract, create, true in-place modify (Add/Replace/Remove via `Ocfs2InPlaceModifier`), defragment, extent map. Reading is spec-correct against `fs/ocfs2/ocfs2_fs.h` (see `Ocfs2Reader`): INODE01 dinode signatures, the real `ocfs2_dinode` field offsets, the 8-byte `ocfs2_inline_data` header, and the 16-byte extent-list header. It reads images produced by the reference `mkfs.ocfs2` as well as the toolkit's own writer (verified by an external conformance test that reads a real `mkfs.ocfs2 -M local` volume).Writing produces a single-node (no DLM) image with 4 KB blocks/clusters, inline directory entries, and extent-based file data. The superblock and dinode layout are spec-correct — the reference `debugfs.ocfs2 stats` reads the written superblock at exit 0. The writer does NOT yet emit the full chain-allocator / journal / slot-map / local-alloc system-file suite a mountable volume needs, so `fsck.ocfs2` does not pass on a written image. Create/modify are therefore scoped to structurally-correct construction with self/round-trip readback, not fsck-clean conformance.Modifier scope: root-directory mutations only (subdirectory and extent-backed root directory paths fall back to the rebuild path). DLM/heartbeat lockdown and multi-node cluster semantics are out of scope by design. References: `https://github.com/torvalds/linux/blob/master/fs/ocfs2/ocfs2_fs.h` — canonical on-disk header`https://www.kernel.org/doc/html/latest/filesystems/ocfs2.html` — kernel documentation`https://en.wikipedia.org/wiki/OCFS2` — Wikipedia article
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MfsEntry` | `MfsEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `MfsExtentMap`
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Walks a Macintosh MFS image (0xD2D7 magic at offset 1024) and yields the actual on-disk byte layout — system area (boot blocks + MDB), file directory area, every file's contiguous data range (per the writer's simplified linear allocation), and the unused tail as Free. MFS uses a packed 12-bit block map but our writer-produced images are linear, so we walk directory entries and emit one extent per file based on (firstBlock, size).
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Ocfs2FormatDescriptor` | `Ocfs2FormatDescriptor()` |  |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `MfsFormatDescriptor`
+
+R/W descriptor for Classic Macintosh MFS (Macintosh File System) 400 KB floppy volumes — the flat-directory predecessor of HFS, MDB magic 0xD2D7. References: Apple "Inside Macintosh, Volume II" (File Manager chapter, Addison-Wesley 1985) — the canonical MFS description`https://en.wikipedia.org/wiki/Macintosh_File_System` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MfsFormatDescriptor` | `MfsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -7199,182 +8586,215 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The one tunable the writer honours: the volume label written into `s_label` (64-byte superblock field) via `SetLabel` and read back as `Ocfs2Superblock.Label`. The 4 KB block/cluster size is fixed by the single-node MVP layout, so it is not exposed. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for Classic Macintosh MFS creation. MFS is a flat 400 KB floppy filesystem with a single MDB-stored volume name; the writer emits the canonical 400 KB image, so VolumeLabel is the only meaningful per-volume knob. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files in the root directory of an existing OCFS2 image using `Ocfs2InPlaceModifier`. Touches only the global bitmap data block, the root dir dinode, the new file dinode block, and the new data blocks — no whole-image rewrite. Subdirectory paths and extent-backed root directories fall back to the rebuild path so callers keep working when the writer's MVP scope is exceeded. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing MFS image. Uses `MfsModifier` for true O(touched bytes) random-access I/O — only the MDB (1 sector) + directory area + the new file's data blocks are read or written. The rest of the image is untouched. |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware MFS defragmentor. Tries planner-driven in-place path first, falls back to rebuild path on error. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the MDB + directory area + per-file allocation and yields the actual on-disk byte layout. The system area (boot + MDB + directory) becomes a single `MetadataReserved` extent, every file emits one Used extent at its `(firstBlock × blockSize)` location, and the unused tail is emitted as Free. Suitable for our writer's linear-allocated images; the on-disk footprint is rounded up to the block size. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes files from the root directory of an existing OCFS2 image using `Ocfs2InPlaceModifier`. Frees the dinode block + data clusters via global bitmap bit flips and zero-wipes them so no forensic trace remains. Names that aren't in the root directory fall back to the rebuild path (which can reach subdirectories). |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the OCFS2 image: unallocated clusters and the cluster-tip slack between a file's logical size and the end of its last 4 KB cluster. The extent map already clamps each Used data extent to the file's logical length, so the cluster tip surfaces as a free gap and is zeroed by the generic wiper without a size lookup. Small directories are stored inline inside their dinode (no data cluster), so they have no tip. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing MFS image. Uses `MfsModifier` for O(touched bytes) random-access I/O — locates the directory entry, secure-wipes the data blocks, and clears the entry's in-use bit. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in an MFS image: free allocation blocks and the cluster-tip slack between each file's logical size and the end of its last 1024-byte allocation block. MFS stores file data contiguously and each extent's FileName matches the directory-entry name, so a size lookup built from the reader lets the generic `UnusedSpaceWiper` trim each tip precisely without touching the system area (boot + MDB + directory). |
 
-#### `Ocfs2InPlaceModifier`
+#### `MfsModifier`
 
-True in-place R/W modifier for OCFS2 (Oracle Cluster Filesystem 2) images produced by `Ocfs2Writer`. Performs O(touched bytes) random-access I/O against the image: only the global bitmap data block, the root directory dinode (inline dirents), the affected file dinode block, and the file's data blocks are read or written. No whole-image read or rewrite. Layout (matches `Ocfs2Writer`'s single-node geometry): 4 KB blocks = 4 KB clusters; one dinode per block.Superblock dinode at block 2; global bitmap dinode at block 3; bitmap data at block 4 (1 bit per cluster, LSB-first, bit=1 means used).Root directory dinode at block 5 (INODE01) with inline dirents in id2 after the 8-byte ocfs2_inline_data header (id2 + 8), each entry `inode(8) | rec_len(2) | name_len(1) | file_type(1) | name[]`.User files start at block 8: each gets one dinode block, plus contiguous data clusters whose run is held in a single extent record.Scope (MVP, single-node only): root-directory mutations only. Sub-directory mutation, DLM/heartbeat lockdown, multi-node cluster semantics, and root-directory B-tree splits (extent-backed root) are out of scope and throw `NotSupportedException` if encountered.
+In-place modifier for MFS (Macintosh File System) disk images. Performs add / remove on an existing image with strict O(touched bytes) I/O — only reads the volume info block (sector 2), the file directory area (sectors 3 through `drAlBlSt - 1`), and the affected file's allocation blocks. Never reads or writes the entire image. The companion `MfsWriter` rebuilds an image from scratch; this class is for the "I have an existing image, mutate it" path that `IArchiveModifiable` exposes.Layout reminders for the simplified MFS variant produced by `MfsWriter` and consumed by `MfsReader`: Sectors 0-1: boot blocks (1024 bytes total).Sector 2 (offset 1024): MDB / volume info block — magic 0xD2D7 BE, `drNmAlBlks` at +18 (u16 BE), `drAlBlkSiz` at +20 (u32 BE), `drAlBlSt` (first allocation-block sector) at +28 (u16 BE), volume name pstring at +36.File directory: starts at offset 1024+128 (= 1152, mid sector 2) and runs up to `drAlBlSt * 512`.Each directory entry is variable length: +0: flags byte (0x80 = in use, 0 = end-of-directory marker).+1: version byte.+26: first allocation block (u16 BE, 0-based within data area).+28: logical EOF / data size in bytes (u32 BE).+38: name length byte.+39..: ASCII name, padded so total entry length is even.Allocation blocks (`drAlBlkSiz` bytes each, typically 1024) start at `drAlBlSt * 512` and are stored contiguously per file. Block IDs are 0-based within the data area in this implementation.Real-MFS-on-disk would also have a 12-bit packed block map between the MDB and the directory; the simplified writer omits it. The modifier therefore derives allocation status by walking the existing directory entries (each entry covers blocks `FirstBlock`..`FirstBlock + ⌈Size / drAlBlkSiz⌉ - 1`), which matches what the round-trip reader/writer already do. This keeps the on-disk format compatible with the round-trip path.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file to the OCFS2 image's root directory. Performs random-access I/O only: bitmap data block, root dinode, new file dinode block, and the new data blocks are written. Throws `IOException` if an entry with the same name already exists (use `ReplaceFile` or call `RemoveFile` first). |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a regular file from the OCFS2 image's root directory. Frees its dinode block + data clusters via the global bitmap, zeros their contents, and splices the dirent out of the root directory's inline area. Returns false if the named entry does not exist in the root directory. |
-| `ReplaceFile` | `static bool ReplaceFile(Stream image, string name, byte[] newData)` | Replaces a file's contents in place when the new data fits inside the originally allocated cluster run. Returns false if the named file doesn't exist; throws if the new size requires more clusters than were originally allocated (callers should fall back to `RemoveFile` + `AddFile`). |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to the existing MFS image. Performs in-place modification: derives the allocation map from existing directory entries, allocates a contiguous run of free blocks, writes the file data, and writes a new directory entry into the first free slot. Bytes touched: 1 MDB sector + the directory sectors that get walked + the file's data blocks + the dir sector(s) containing the new entry. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file from the existing MFS image. Walks the directory to locate the entry, optionally wipes the file's allocation blocks, and clears the directory entry's flags byte (and shifts later entries in the same sector left to keep the directory chain contiguous, since MFS uses a 0-flags byte as end-of-directory marker). Returns true if the file was found and removed, false otherwise. Bytes touched: 1 MDB sector + the directory sectors walked + the removed file's data blocks (if wiping) + dir sector containing the entry. |
 
-#### `Ocfs2Superblock`
+#### `MfsReader`
 
-Parses the OCFS2 (Oracle Cluster Filesystem 2) superblock. The superblock is stored as the `id2.i_super` sub-structure of an `ocfs2_dinode` at `OCFS2_SUPER_BLOCK_BLKNO = 2`. With a 4 KB block size (the mkfs.ocfs2 default and far the most common), that block starts at byte offset `0x2000` (8192). The dinode's `i_signature[8]` at offset 0 holds the ASCII string `OCFSV2` (NUL-padded to 8). The superblock fields begin at `id2 = +0xC0` within the dinode block. Read-only. Layout per `fs/ocfs2/ocfs2_fs.h`: Verified by: `https://github.com/torvalds/linux/blob/master/fs/ocfs2/ocfs2_fs.h`
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Ocfs2Superblock` | `Ocfs2Superblock()` |  |
-| `DefaultBlockSize` | `const int DefaultBlockSize` | Default mkfs.ocfs2 block size (and far the most common — many tools assume this). |
-| `DefaultSuperBlockOffset` | `const long DefaultSuperBlockOffset` | Byte offset of the superblock dinode when blocksize = 4 KB (the default). |
-| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Bytes we surface as `superblock.bin` — one full 4 KB dinode block. |
-| `SignatureBytes` | `static readonly byte[] SignatureBytes` | OCFS2_SUPER_BLOCK_SIGNATURE — 6 ASCII bytes at dinode offset 0. |
-| `SuperBlockBlkno` | `const int SuperBlockBlkno` | OCFS2_SUPER_BLOCK_BLKNO — superblock lives at this *block* index, not byte. |
-| `SuperOffsetInDinode` | `const int SuperOffsetInDinode` | Offset of `id2.i_super` within the dinode. |
-| `BlocksizeBits` | `uint BlocksizeBits { get; }` |  |
-| `ClustersizeBits` | `uint ClustersizeBits { get; }` |  |
-| `DetectedBlockSize` | `int DetectedBlockSize { get; }` | Detected block size in bytes (matched offset / 2). |
-| `FirstClusterGroup` | `ulong FirstClusterGroup { get; }` |  |
-| `HeaderRaw` | `byte[] HeaderRaw { get; }` | Raw 4 KB capture of the superblock dinode block (pad with 0 if image was shorter). |
-| `Label` | `string Label { get; }` |  |
-| `MajorRev` | `ushort MajorRev { get; }` |  |
-| `MaxSlots` | `ushort MaxSlots { get; }` |  |
-| `MinorRev` | `ushort MinorRev { get; }` |  |
-| `RootBlkno` | `ulong RootBlkno { get; }` |  |
-| `SuperBlockOffset` | `long SuperBlockOffset { get; }` | Byte offset where the superblock dinode was found. |
-| `SystemDirBlkno` | `ulong SystemDirBlkno { get; }` |  |
-| `UuidHex` | `string UuidHex { get; }` |  |
-| `Valid` | `bool Valid { get; }` | True iff the OCFSV2 signature was found at a recognised block-2 offset. |
-| `TryParse` | `static Ocfs2Superblock TryParse(ReadOnlySpan<byte> image)` | Best-effort parse. Tries plausible block sizes (512, 1024, 2048, 4096) for the OCFSV2 signature at block 2; falls back to a free-form scan of the first 64 KB if none of the canonical offsets match. Never throws. |
-
-### Namespace `FileSystem.OpenVms`
-
-[`OpenVmsBitmap`](#openvmsbitmap) · [`OpenVmsBlockMover`](#openvmsblockmover) · [`OpenVmsChecksum`](#openvmschecksum) · [`OpenVmsDirectory`](#openvmsdirectory) · [`OpenVmsDirectory.Entry`](#openvmsdirectoryentry) · [`OpenVmsFileHeader`](#openvmsfileheader) · [`OpenVmsFileHeader.RetrievalPointer`](#openvmsfileheaderretrievalpointer) · [`OpenVmsFormatDescriptor`](#openvmsformatdescriptor) · [`OpenVmsInPlaceModifier`](#openvmsinplacemodifier) · [`OpenVmsLayout`](#openvmslayout) · [`OpenVmsReader`](#openvmsreader) · [`OpenVmsReader.Entry`](#openvmsreaderentry) · [`OpenVmsVolume`](#openvmsvolume) · [`OpenVmsWriter`](#openvmswriter)
+| `MfsReader` | `MfsReader(Stream stream, bool leaveOpen = false)` |  |
+| `Entries` | `IReadOnlyList<MfsEntry> Entries { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(MfsEntry entry)` |  |
 
-#### `OpenVmsBitmap`
+#### `MfsWriter`
 
-In-memory view of BITMAP.SYS — the Files-11 ODS-2 storage allocation bitmap. One bit per LBN: bit value 0 means free, 1 means allocated. (The on-disk OpenVMS convention is the opposite — 1 = free — but our reader/writer/in-place-modifier agree on the same polarity, and the header-extension marker means real OpenVMS will never see this volume.) The bitmap lives at `BitmapStartLbn` spanning `BitmapBlockCount` LBNs, giving 65 536 bits of coverage for the default 8 192-LBN volume (with headroom). LBNs occupied by metadata (boot block, home block, BITMAP.SYS itself, INDEXF.SYS, root directory) are pre-marked allocated by `MarkMetadataAllocated` at volume-creation time. The in-place modifier's allocator (`AllocateRun`) scans past the metadata reservation to find a contiguous run of free LBNs.
+Builds a minimal MFS disk image.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `OpenVmsBitmap` | `OpenVmsBitmap()` | Creates a fresh empty bitmap sized to the default volume. |
-| `OpenVmsBitmap` | `OpenVmsBitmap(byte[] bytes)` | Wraps an existing bitmap buffer (typically read from disk). |
-| `BitsTotal` | `int BitsTotal { get; }` | Total bits available in the map. |
-| `Bytes` | `byte[] Bytes { get; }` | The bitmap's backing bytes. `BitsTotal` bits exposed. |
-| `ClusterBlocks` | `int ClusterBlocks { get; init; }` | LBNs each bit stands for. ODS-2 tracks the volume in clusters (HM2$W_CLUSTER), not blocks, so BITMAP.SYS stays a fixed 16 blocks however large the volume grows -- which is what lets the rest of the layout keep its fixed LBNs. |
-| `LbnCapacity` | `long LbnCapacity { get; }` | Highest LBN the map can express. |
-| `VolumeBlocks` | `long VolumeBlocks { get; init; }` | Blocks in the volume this map describes. |
-| `AllocateRun` | `int AllocateRun(int blocks)` | Finds and marks a contiguous run of `blocks` free LBNs, starting the search at `DataAreaStartLbn`. Returns the run's starting LBN or -1 if the volume can't satisfy the request. |
-| `ClusterFor` | `static int ClusterFor(long volumeBlocks)` | Smallest power-of-two cluster size that lets one bitmap cover `volumeBlocks`. |
-| `FreeRun` | `void FreeRun(int startLbn, int blocks)` | Frees a contiguous run of `blocks` LBNs starting at `startLbn`. |
-| `IsAllocated` | `bool IsAllocated(int lbn)` | True when bit `lbn` is set (allocated). |
-| `MarkAllocated` | `void MarkAllocated(int lbn)` | Sets bit `lbn` (mark allocated). |
-| `MarkFree` | `void MarkFree(int lbn)` | Clears bit `lbn` (mark free). |
-| `MarkMetadataAllocated` | `void MarkMetadataAllocated()` | Pre-marks every metadata LBN allocated. Call once when emitting a fresh volume. |
+| `MfsWriter` | `MfsWriter()` |  |
+| `VolumeName` | `string VolumeName { get; set; }` | MFS volume name written into the MDB at offset 36 (Pascal string, max 27 chars). Shown by the classic Mac Finder as the disk's name. Default "Untitled". |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. |
+| `Build` | `byte[] Build()` | Builds the MFS disk image. |
 
-#### `OpenVmsBlockMover`
+### Namespace `FileSystem.Mfs1`
 
-Moves a file's blocks inside an OpenVMS volume and repoints its file header.
+[`Mfs1BlockMover`](#mfs1blockmover) · [`Mfs1Entry`](#mfs1entry) · [`Mfs1ExtentMap`](#mfs1extentmap) · [`Mfs1FormatDescriptor`](#mfs1formatdescriptor) · [`Mfs1InPlaceModifier`](#mfs1inplacemodifier) · [`Mfs1Reader`](#mfs1reader) · [`Mfs1Writer`](#mfs1writer)
+
+#### `Mfs1BlockMover`
+
+Moves a file's sectors inside an MFS-1 disk and repoints its catalog slot.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `OpenVmsBlockMover` | `OpenVmsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the volume's own structures. |
+| `Mfs1BlockMover` | `Mfs1BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A sector. A catalog slot names a sector, not a byte. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the two catalog sectors. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the slot it is given and nothing else, so an owner in several runs — which this format cannot produce — would be several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full disk be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads how many catalog slots this disk carries. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `OpenVmsChecksum`
+#### `Mfs1Entry`
 
-Files-11 ODS-2 16-bit "checksum1" — additive sum over little-endian 16-bit words, truncated to 16 bits. The same algorithm is applied to: The home block (sum of words 0..253; result stored at the home-block-specific HM2$W_CHECKSUM1/CHECKSUM2 slots — out of scope for our writer since VMS-mountability is deferred).Every File Header in INDEXF.SYS (sum of words 0..254; result stored at FH2$W_CHECKSUM = byte offset 510).
+A single catalog entry parsed out of an Acorn MFS-1 disk image. MFS-1 inherits Acorn's DFS catalog layout: 7-character filename plus 1-character directory letter (default `$`) packed into 8 bytes in sector 0, with the matching metadata block in sector 1.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Compute` | `static ushort Compute(ReadOnlySpan<byte> data, int wordCount)` | Returns the 16-bit additive checksum of `data` reading `wordCount` little-endian unsigned 16-bit words from the start of the span. Carry is discarded — the result is the low 16 bits of the running 32-bit sum. |
+| `Mfs1Entry` | `Mfs1Entry()` |  |
+| `Directory` | `char Directory { get; init; }` |  |
+| `ExecAddress` | `uint ExecAddress { get; init; }` |  |
+| `FullName` | `string FullName { get; }` |  |
+| `IsLocked` | `bool IsLocked { get; init; }` |  |
+| `LoadAddress` | `uint LoadAddress { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `uint Size { get; init; }` |  |
+| `StartSector` | `int StartSector { get; init; }` |  |
 
-#### `OpenVmsDirectory`
+#### `Mfs1ExtentMap`
 
-Directory blocks for a Files-11 ODS-2 volume: a run of variable-length name records, each carrying one or more version-and-file-id pairs.
+Reports where an MFS-1 disk's bytes are: the two catalog sectors, each file's run of sectors under its name, and the rest as free.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ChainLinkOffset` | `const int ChainLinkOffset` | Where the link to the next block of the directory sits. |
-| `EndOfRecords` | `const ushort EndOfRecords` | The size word that says a block holds no more records. |
-| `FileNameLength` | `const int FileNameLength` | The longest name a record here carries. |
-| `RecordHeaderBytes` | `const int RecordHeaderBytes` | Bytes a record spends before its name. |
-| `SelfName` | `const string SelfName` | What the master file directory calls itself, which every Files-11 volume's root holds so a reader asked for [000000] finds something to open. |
-| `UsableBytes` | `const int UsableBytes` | How much of a block records may use, the link being at its end. |
-| `VersionEntryBytes` | `const int VersionEntryBytes` | Bytes one version-and-file-id pair takes. |
-| `Clear` | `static void Clear(Span<byte> block)` | Empties a block of records, leaving the chain link alone. |
-| `Enumerate` | `static List<Entry> Enumerate(ReadOnlySpan<byte> block)` | Every entry the block holds, in the order they were written. |
-| `IsSelfEntry` | `static bool IsSelfEntry(Entry entry)` | Whether an entry is the directory's own, rather than anything put there. |
-| `ReadChainLink` | `static int ReadChainLink(ReadOnlySpan<byte> dirBlock)` | Reads the chain link (next directory LBN, 0 if last) from `dirBlock`. |
-| `RecordBytes` | `static int RecordBytes(string name)` | Bytes the record for `name` takes, one version of it. |
-| `TryAppend` | `static bool TryAppend(Span<byte> block, Entry entry)` | Adds one entry to what the block already holds. |
-| `TryRemove` | `static bool TryRemove(Span<byte> block, string name)` | Takes out every entry naming `name`. |
-| `TryWrite` | `static bool TryWrite(Span<byte> block, IReadOnlyList<Entry> entries)` | Writes `entries` into `block`, one record each, and ends them. The chain link is left as it was. |
-| `WriteChainLink` | `static void WriteChainLink(Span<byte> dirBlock, int nextLbn)` | Writes the chain link (next directory LBN, 0 if last) into `dirBlock`. |
+| `CatalogSectors` | `const int CatalogSectors` | Sectors the catalog occupies before any file data. |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `OpenVmsDirectory.Entry`
+#### `Mfs1FormatDescriptor`
 
-One entry of a directory: a name, and the file it names.
+Read-only descriptor for Acorn MFS-1 (Master File System v1) disk images — the catalog-compatible evolution of Acorn DFS used on early Acorn / BBC Master systems. The on-disk catalog matches DFS (256-byte sectors, two-sector catalog at track 0 sectors 0-1, up to 31 entries with 7-char names + 1-char directory), so MFS-1 is parsed by walking those sectors directly. References: `https://beebwiki.mdfs.net/Acorn_DFS_disc_format` — the DFS catalog layout MFS-1 shares (two-sector catalog at track 0)`https://en.wikipedia.org/wiki/Disc_Filing_System` — Wikipedia article on the DFS familyAcorn "Disc Filing System User Guide" (vendor manual)
 
-Implements `IEquatable<Entry>`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Entry` | `Entry(int FileId, ushort Sequence, string Name, long Size)` | One entry of a directory: a name, and the file it names. |
-| `FileId` | `int FileId { get; init; }` |  |
-| `IsFree` | `bool IsFree { get; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `Sequence` | `ushort Sequence { get; init; }` |  |
-| `Size` | `long Size { get; init; }` |  |
+| `Mfs1FormatDescriptor` | `Mfs1FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The writer-honoured knob is the 12-char disk title, stored across the two-sector DFS catalog (first 8 chars in sector 0, last 4 in sector 1). The image geometry defaults to the 200 KB 80-track SSD and is not exposed. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds — or replaces by name — files in an existing MFS-1 image. The image is re-packed via `AddFiles` from its existing files plus the new ones; the outer sector count is preserved. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh MFS-1 image from the given inputs. The catalog and data area are emitted by `Mfs1Writer`; the resulting image is round-trip-readable by `Mfs1Reader`. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the disk out again. A file here is one run of sectors and its catalog slot records where that run starts, so a move is the copy plus two bytes — cheaper than reading every file out and writing a fresh disk, which is what the inherited default did for the one mode it offered. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single catalog entry as a bounded stream over its sector extent. Reads past `Size` return 0 (EOF). The FULL/metadata placeholders are intentionally NOT openable via this path; use Extract. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing MFS-1 image. The data area of the removed file is zeroed on rebuild — no forensic trace of the removed bytes remains. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every sector no catalog slot claims — which is where a removed file's bytes stay until something else takes them. |
 
-#### `OpenVmsFileHeader`
+#### `Mfs1InPlaceModifier`
 
-In-memory mirror of a Files-11 File Header (a single 512-byte block inside INDEXF.SYS, anchored at a known LBN). Carries the file's name (ident area, ≤ 20 chars ASCII for ODS-2) and the retrieval pointers (map area) for its data extents. Serialization preserves the on-disk invariants documented at `OpenVmsLayout`: FH header words (IDOFFSET, MPOFFSET, …) at the documented offsets.Ident area at byte 128, 20 bytes of NUL-padded ASCII file name.Map area at byte 256, sequence of (LBN, count) 8-byte tuples, zero-terminated by a (0, 0) sentinel.FH2$W_CHECKSUM at byte 510, additive 16-bit sum of words 0..254.The "in use" predicate is anchored on the structure-level word at +6: a non-zero value means the FH carries a live file. Freeing a File Header (via `ClearInUse`) zeros the structure-level word so a subsequent scan reports it free.The header layout we emit is consistent between writer / reader / in-place modifier but is NOT a complete ODS-2 FH — the user-attribute FILECHAR bits, the RECATTR FAT bundle, and the FH2$L_OWN_UIC field are emitted as zeros. That's why `OpenVmsFormatDescriptor.Description` continues to note that the emitted volume isn't OpenVMS-mountable.
+In-place modifier for Acorn MFS-1 (DFS-tier) disk images. MFS-1's catalog is a flat fixed-offset region — sector 0 (names) + sector 1 (metadata) — that we can shift in place; files live contiguously from sector 2 onwards. On `AddFiles` the existing catalog is parsed via `Mfs1Reader`, the new file is appended at the next free sector, the catalog is re-serialised via `Mfs1Writer`, and the buffer is written back to the underlying stream. The outer image size (sector count) is preserved. On `RemoveFiles` the catalog is re-built without the dropped names. The data area previously occupied by the removed file is zeroed so no forensic trace remains.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `OpenVmsFileHeader` | `OpenVmsFileHeader()` |  |
-| `AllocatedBlocks` | `int AllocatedBlocks { get; }` | Returns the sum of `Count` across every retrieval pointer. |
-| `Extents` | `List<RetrievalPointer> Extents { get; }` | Retrieval pointers — each (LBN, count) tuple describes one contiguous data extent. |
-| `FileId` | `int FileId { get; set; }` | 1-based File-ID number. 0 means "not allocated". |
-| `InUse` | `bool InUse { get; set; }` | True when the header is in use (structure-level word non-zero). |
-| `IsDirectory` | `bool IsDirectory { get; set; }` | Whether this header describes a directory rather than an ordinary file. |
-| `Name` | `string Name { get; set; }` | File name (ASCII; padded with NULs to `FhFileNameLength`). |
-| `Sequence` | `ushort Sequence { get; set; }` | File-ID sequence number (incremented on slot reuse). |
-| `Size` | `long Size { get; set; }` | Logical file size in bytes. |
-| `ClearInUse` | `void ClearInUse()` | Returns the deserialized FH after zeroing its in-use marker (for "freed" semantics). |
-| `Deserialize` | `static OpenVmsFileHeader Deserialize(ReadOnlySpan<byte> block)` | Parses a 512-byte File Header from `block`. |
-| `Serialize` | `byte[] Serialize()` | Serializes the file header into a fresh 512-byte block ready to be written into INDEXF.SYS. |
+| `AddFiles` | `static void AddFiles(Stream archive, IReadOnlyList<ValueTuple<string, byte[]>> inputs)` | Adds — or replaces by name — files in an existing MFS-1 image. The image is re-packed from its existing files plus the new ones; the outer sector count is preserved. |
+| `RemoveFiles` | `static int RemoveFiles(Stream archive, IReadOnlyList<string> names)` | Removes the named entries from an existing MFS-1 image. Returns the number of entries removed. |
 
-#### `OpenVmsFileHeader.RetrievalPointer`
+#### `Mfs1Reader`
 
-One retrieval pointer — describes a single contiguous data extent.
+Reads Acorn MFS-1 (Master File System v1) disk images. MFS-1 is the minor evolution of Acorn DFS used on early Acorn / BBC Master systems — the on-disk catalog layout matches DFS verbatim: 256-byte sectors, 10 sectors per track.Sector 0 — disk title (first 8 chars) + up to 31 eight-byte name entries: 7-char filename + 1-char directory letter (high bit = locked).Sector 1 — last 4 title chars + entry-count*8 byte at offset 5 + 31 eight-byte metadata entries: load(2), exec(2), length(2), packed-high-bits(1), start-sector-low(1).Packed-high-bits byte 6: bits 0-1 = start-sector high, bits 2-3 = load addr high, bits 4-5 = length high, bits 6-7 = exec addr high. The reader is intentionally forgiving — Acorn images frequently arrive with padding, optional boot sectors, or non-standard sizes. We parse the catalog best-effort; if the count byte or sector range looks invalid we surface no entries (the descriptor then falls back to the opaque FULL/metadata surface).
 
-Implements `IEquatable<RetrievalPointer>`.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `RetrievalPointer` | `RetrievalPointer(int StartLbn, int Count)` | One retrieval pointer — describes a single contiguous data extent. |
-| `Count` | `int Count { get; init; }` |  |
-| `StartLbn` | `int StartLbn { get; init; }` |  |
+| `Mfs1Reader` | `Mfs1Reader(Stream stream)` |  |
+| `Mfs1Reader` | `Mfs1Reader(byte[] image)` |  |
+| `MaxEntries` | `const int MaxEntries` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `SectorsPerTrack` | `const int SectorsPerTrack` |  |
+| `CatalogParsed` | `bool CatalogParsed { get; }` |  |
+| `DiskTitle` | `string DiskTitle { get; }` |  |
+| `Entries` | `IReadOnlyList<Mfs1Entry> Entries { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(Mfs1Entry entry)` |  |
 
-#### `OpenVmsFormatDescriptor`
+#### `Mfs1Writer`
 
-Read/write descriptor for OpenVMS Files-11 (ODS-2) volume images. Backed by a clean-room writer / reader / in-place modifier trio that shares the geometry pinned at `OpenVmsLayout`. The descriptor advertises: `CanList` + `CanExtract` — driven by `OpenVmsReader` walking 000000.DIR.`CanCreate` — driven by `OpenVmsWriter`. The fresh volume carries a real ODS-2 home block at LBN 1 plus a workbench-layout layout marker at byte 132 of the home block.`CanModify` — driven by `OpenVmsInPlaceModifier`. Add / Remove / Replace touch only the BITMAP.SYS sector, the file's INDEXF.SYS slot, the directory block, and the affected data LBNs.Honest scope. The emitted volume is not OpenVMS-mountable — the home block's HM2$W_CHECKSUM1/CHECKSUM2 surfaces, the FH FILECHAR and RECATTR bundles, the ODS-2 variable-length directory record format, and the per-file revision-history fields are out of scope. What it IS is a layout the workbench's own writer, reader and in-place modifier can round-trip end-to-end through Add / Remove / Replace. References: DEC "Files-11 On-Disk Structure Specification" — the canonical ODS-2 spec (archived at Bitsavers)Kirby McCoy, "VMS File System Internals" (Digital Press, 1990)`https://en.wikipedia.org/wiki/Files-11` — Wikipedia article
+Builds Acorn MFS-1 (Master File System v1) disk images. MFS-1 inherits the DFS on-disk catalog: 256-byte sectors, a 2-sector catalog at track 0, up to 31 entries, files stored contiguously from sector 2 onwards. Catalog layout (from `Mfs1Reader`): sector 0, bytes 0..7 — disk title (first 8 chars) sector 0, bytes 8..255 — up to 31 × 8-byte name entries (7 ASCII chars + 1 directory char, high bit = locked) sector 1, bytes 0..3 — disk title (last 4 chars) sector 1, byte 5 — entry count × 8 (i.e. byte offset of the next free slot) sector 1, bytes 8..255 — up to 31 × 8-byte metadata entries: load_lo(2) + exec_lo(2) + length_lo(2) + packed_high_bits(1) + start_sector_lo(1) packed_high_bits bits: 0-1 start_sector_hi, 2-3 load_hi, 4-5 length_hi, 6-7 exec_hi. Files are stored contiguously from sector 2 onwards in catalog-insertion order; the catalog itself is sorted by descending start-sector per DFS convention (the most-recently-added file appears first). Total image size defaults to 80 tracks × 10 sectors × 256 bytes = 200 KB (a Master 80-track SSD image); pass `totalSectors` to `Build` to choose a different geometry.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Mfs1Writer` | `Mfs1Writer()` |  |
+| `DefaultTotalSectors` | `const int DefaultTotalSectors` |  |
+| `MaxEntries` | `const int MaxEntries` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `AddFile` | `void AddFile(string name, byte[] data, char directory = '$', bool locked = false, uint loadAddress = 0, uint execAddress = 0)` | Adds a file to the volume. |
+| `Build` | `byte[] Build(string diskTitle = "WORM", int totalSectors = 800)` | Builds the MFS-1 image. The catalog is laid out per the DFS convention: entries are sorted by descending start-sector so the most recently added file appears at index 0. |
+
+### Namespace `FileSystem.MinixFs`
+
+[`MinixFsBlockMover`](#minixfsblockmover) · [`MinixFsEntry`](#minixfsentry) · [`MinixFsExtentMap`](#minixfsextentmap) · [`MinixFsFormatDescriptor`](#minixfsformatdescriptor) · [`MinixFsInPlaceModifier`](#minixfsinplacemodifier) · [`MinixFsReader`](#minixfsreader) · [`MinixFsWriter`](#minixfswriter)
+
+#### `MinixFsBlockMover`
+
+In-place Minix v3 block mover. Moves zone-aligned extents within a MinixFS image and patches inode zone pointers + zone bitmap so the file remains reachable. Streaming: the image is never loaded whole. Reads go through a `SectorCache`; metadata updates (inode zone pointers, zone bitmap bits) are targeted single-region writes with `Flush` barriers between steps so a crash mid-update leaves the image in an fsck-recoverable state.
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `OpenVmsFormatDescriptor` | `OpenVmsFormatDescriptor()` |  |
+| `MinixFsBlockMover` | `MinixFsBlockMover()` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `MinixFsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixFsEntry` | `MinixFsEntry()` |  |
+| `InodeNumber` | `int InodeNumber { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `int Size { get; init; }` |  |
+
+#### `MinixFsExtentMap`
+
+Walks a Minix filesystem image (v1/v2/v3) and yields the actual on-disk byte layout: the boot block + superblock + inode/zone bitmaps + inode table as a single `MetadataReserved` run, each directory's zones as `MetadataReserved` (they hold directory entries, not file payload), and each regular file's data zones as `Used` runs. Unclaimed zones are reported as `Free`. This replaces the earlier synthetic layout that fabricated `offset += size` extents — those never matched the real zone offsets, so any consumer that zero-filled the gaps (e.g. the unused-space wiper) would have corrupted live file data, inode tables and bitmaps.For a regular file whose data zones are contiguous, a single Used extent is emitted with the file's name as `FileName` so the wiper can locate the zone tip via a size lookup. A file split across non-contiguous zone runs emits one Used extent per run with a name that is deliberately absent from the size lookup, so tip trimming never misfires on a run that does not start at file offset zero.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `MinixFsFormatDescriptor`
+
+R/W descriptor for Minix filesystem images (v1/v2/v3 superblock magics) — the ext-family ancestor used by the Minix teaching OS and early Linux. References: `https://github.com/torvalds/linux/blob/master/include/uapi/linux/minix_fs.h` — canonical on-disk structures for all versions`https://github.com/torvalds/linux/tree/master/fs/minix` — Linux reference implementationTanenbaum & Woodhull, "Operating Systems: Design and Implementation" — the original Minix FS design`https://en.wikipedia.org/wiki/Minix_file_system` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixFsFormatDescriptor` | `MinixFsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -7386,77 +8806,1654 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the ODS-2 writer honours: the 12-character home-block volume label (HM2$T_VOLNAME). Everything else in the workbench-layout geometry is fixed. An empty label falls back to the writer default ("SCRATCH"). |
+| `ReclaimSupport` | `LayoutReclaim ReclaimSupport { get; }` | A zone pointer of zero names no zone, so a run of zeros need not be allocated; and the inode counts the names pointing at it, so identical files can share one copy under several of them. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) caller files in-place via `OpenVmsInPlaceModifier`. Untouched LBNs in `archive` remain byte-identical. |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds a fresh ODS-2 volume containing `inputs` as user files in 000000.DIR. Each file is a contiguous extent. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing MinixFs image using `MinixFsInPlaceModifier` for TRUE in-place O(touched bytes) random-access I/O across V1, V2 and V3 superblock variants — only the inode bitmap byte, zone bitmap byte, the new inode slot, the affected directory zone and the file's data zones are written; every other byte of the image stays identical. Falls back to whole-image rebuild only when the image has no free inode/zone or the file exceeds the direct-pointer ceiling. |
+| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation: pre-known per-input sizes drive the Minix v3 zone allocation in pass 1; pass 2 writes the metadata image with each file's data zones left zero, then streams each input's bytes from its `OpenStream` factory into its first allocated zone via 64 KB chunks. The output is byte-identical to `Create` for the same inputs (Minix has no data checksums). Falls back to the buffered default when the target stream is not seekable. Note: Minix v3 caps a file at 7 direct zones (7168 bytes), so large-file streaming is bounded by that ceiling. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves only the files that are out of place, rewriting each one's retrieval pointer as its blocks arrive. The pass is kept only if every payload still reads back: it can refuse partway — a header it cannot find leaves bytes moved with nothing naming them — and the volume goes back as it was then. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Reports the volume's layout: the fixed metadata prefix — boot block, home block, BITMAP.SYS, INDEXF.SYS and the root directory — then each file's contiguous run of LBNs. Everything else is free. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware MinixFs defragmentor. Tries the planner-driven in-place path first, falling back to the rebuild path on error. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the superblock, inode table and per-inode zone pointers to yield the real on-disk byte layout — metadata region, directory zones, and each file's data-zone runs at their true offsets. See `MinixFsExtentMap`. |
 | `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a synthetic or real entry as a bounded read-only stream: `FULL.disk` (whole image), `home_block.bin` (parsed 512-byte home block), or any of the user-file names listed in 000000.DIR (assembled from the FH's retrieval pointers). |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in-place via `OpenVmsInPlaceModifier`. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros every byte no live file occupies. A file is one contiguous run of LBNs, so the gaps between runs — and the tail past the last one — are free space. The run is reported at its logical length, so the padding to the block boundary is wiped with it. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing MinixFs image using `MinixFsInPlaceModifier` for true in-place O(touched bytes) random-access I/O across V1/V2/V3. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in a Minix image: free zones and the cluster-tip slack between a file's logical size (i_size) and the end of its last 1024-byte zone. Data zones are reached through the inode's zone pointers and the writer allocates them contiguously per file, so a size lookup keyed by file name lets the generic `UnusedSpaceWiper` trim each tip precisely without touching the inode table, bitmaps or directory zones. |
 
-#### `OpenVmsInPlaceModifier`
+#### `MinixFsInPlaceModifier`
 
-True in-place R/W modifier for the workbench-layout OpenVMS Files-11 ODS-2 volume. Honours the ODS-2 semantics described at `OpenVmsLayout`: Add — scan BITMAP.SYS for the first free File-ID slot in INDEXF.SYS, scan BITMAP.SYS for a contiguous run of free data LBNs, write the File Header at its known offset, copy the caller's bytes into the allocated data LBNs, drop a 64-byte directory entry into 000000.DIR, and flush the bitmap + home-block accounting back to disk.Replace — internally a Remove + Add round so the new data lands at fresh LBNs. The previous file's File Header is freed and its data LBNs are released to the bitmap; untouched neighbours stay byte-identical.Remove — zero the directory entry, free the File Header in INDEXF.SYS (zero its struc-level), release its data LBNs in BITMAP.SYS, and securely wipe the released data LBNs to zero. The bytes touched by every operation are strictly bounded: 1 BITMAP.SYS sector window + 1 INDEXF.SYS File-Header LBN + 1 directory LBN + N data LBNs (= ⌈size / 512⌉). LBNs outside that footprint are byte-identical to the pre-operation image.
+TRUE in-place R/W modifier for Minix v1/v2/v3 filesystem images. Performs O(touched bytes) random-access mutation: only the superblock, the relevant inode/zone bitmap bytes, the affected inode slot, the root directory zone, and the file's data zones are read or written. All other bytes of the image remain byte-identical. The version is autodetected from the superblock magic at byte offsets 1040 (V1/V2) or 1048 (V3) of the image: 0x137F — V1, 14-char names0x138F — V1, 30-char names0x2468 — V2, 14-char names0x2478 — V2, 30-char names0x4D5A — V3, 60-char namesHonest scope: file data is stored only via direct-zone pointers. Larger files (single-indirect, double-indirect, triple-indirect allocation) are deferred — callers asking for files larger than `7 * blockSize` must fall back to rebuild. Subdirectory creation is deferred for the same reason. Existing indirect-allocated file content is still correctly freed on Remove, however.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static int AddFile(Stream archive, string name, byte[] data)` | Adds `data` as a new file named `name`. Throws `IOException` when the volume is full, or `InvalidDataException` when `archive` is not a workbench-layout volume. |
-| `RemoveFile` | `static bool RemoveFile(Stream archive, string name, bool wipeData = true)` | Removes the file named `name` if present. Returns true when a removal happened; false when no such name exists. The freed data LBNs are zero-wiped so the previous content isn't recoverable via raw image bytes. |
-| `ReplaceFile` | `static int ReplaceFile(Stream archive, string name, byte[] data)` | Replaces the file named `name` with new bytes. Always fully removes the old entry first, then adds the new one. Returns the File-ID of the freshly-written entry. Throws when the volume can't satisfy the new allocation (the old entry is removed before the new allocation is attempted). |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to the existing image in-place. The file is stored via direct-zone pointers only. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image in-place. Returns `false` if not found. Frees every direct-pointer data zone the inode lists; indirect-allocated zones (single/double/triple) are also enumerated and freed. |
+| `Replace` | `static bool Replace(Stream image, string name, byte[] data)` | Replaces the data of a named file in-place. If the new data fits in the inode's already-allocated direct zones, the data is rewritten verbatim (zones unchanged); otherwise the file is fully reallocated — old direct zones are freed and new zones (still direct-only) are allocated. |
 
-#### `OpenVmsLayout`
+#### `MinixFsReader`
 
-Volume geometry for the CompressionWorkbench OpenVMS Files-11 ODS-2 writer. These constants pin every LBN that the writer, reader, and in-place modifier agree on. The numbers are NOT load-bearing on a real OpenVMS instance — VMS mountability is out of scope (per the descriptor's honest-scope notice) — but the writer, reader and in-place modifier MUST agree exactly, otherwise an Add or Remove will desync the allocation bitmap from the file headers. Layout (512-byte LBNs): `LBN 0` — boot block (zeros)`LBN 1` — home block ("DECFILE11A " at byte 0x1E8 inside; "workbench-layout" marker at byte 132)`LBN 2 .. 17` — BITMAP.SYS (16 LBNs = 65 536 bits coverage; one bit per LBN)`LBN 18 .. 273` — INDEXF.SYS (256 file headers × 512 bytes; FH N at LBN 18 + N − 1)`LBN 274` — 000000.DIR (root directory, single block initially; chains forward if it grows)`LBN 275 ..` — data area, allocated by walking BITMAP.SYS for runs of free bits
+Reads Minix filesystem images (v1, v2, v3). Parses the superblock, inode table, and directory entries. Supports direct, single-indirect, double-indirect, and triple-indirect zone pointers (v3). V1/V2 support direct and single/double indirect.
+
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `BadBlockFileId` | `const int BadBlockFileId` | Reserved File-ID for the bad-block file (unused here; reserved per spec). |
-| `BitmapBlockCount` | `const int BitmapBlockCount` | BITMAP.SYS size in LBNs. 16 × 512 × 8 = 65 536 bits — covers a 32 MB volume with headroom. |
-| `BitmapFileId` | `const int BitmapFileId` | Reserved File-ID number for the BITMAP.SYS storage bitmap (ODS-2 reserves FID 2). |
-| `BitmapStartLbn` | `const int BitmapStartLbn` | First LBN of BITMAP.SYS — the allocation bitmap. |
-| `BlockSize` | `const int BlockSize` | Files-11 block size — 512 bytes per LBN by spec. |
-| `BootBlockLbn` | `const int BootBlockLbn` | LBN of the boot block (zeros, reserved by ODS-2). |
-| `CoreImageFileId` | `const int CoreImageFileId` | Reserved File-ID for the core image file (unused here; reserved per spec). |
-| `DataAreaStartLbn` | `const int DataAreaStartLbn` | First LBN of the user-data area (after metadata + root dir). |
-| `FhAcOffset` | `const int FhAcOffset` |  |
-| `FhAllocSize` | `const int FhAllocSize` |  |
-| `FhChecksum` | `const int FhChecksum` |  |
-| `FhExtFid` | `const int FhExtFid` |  |
-| `FhFidNum` | `const int FhFidNum` |  |
-| `FhFidRvnNmx` | `const int FhFidRvnNmx` |  |
-| `FhFidSeq` | `const int FhFidSeq` |  |
-| `FhFileChar` | `const int FhFileChar` | What kind of file this is, and how it may be used. |
-| `FhFileNameLength` | `const int FhFileNameLength` |  |
-| `FhIdOffset` | `const int FhIdOffset` |  |
-| `FhIdentAreaOffset` | `const int FhIdentAreaOffset` |  |
-| `FhMapAreaOffset` | `const int FhMapAreaOffset` |  |
-| `FhMapInUse` | `const int FhMapInUse` | Words of the map area that hold retrieval pointers. |
-| `FhMpOffset` | `const int FhMpOffset` |  |
-| `FhRecAttr` | `const int FhRecAttr` |  |
-| `FhRecattrEndBlock` | `const int FhRecattrEndBlock` |  |
-| `FhRecattrFirstFree` | `const int FhRecattrFirstFree` |  |
-| `FhRecattrHighBlock` | `const int FhRecattrHighBlock` |  |
-| `FhRecattr` | `const int FhRecattr` | The record-attributes area, which says how long the file is. |
-| `FhRsOffset` | `const int FhRsOffset` |  |
-| `FhSegNum` | `const int FhSegNum` |  |
-| `FhStrucLev` | `const int FhStrucLev` |  |
-| `FhUsedSize` | `const int FhUsedSize` |  |
-| `FileCharDirectory` | `const uint FileCharDirectory` | The bit in that which says the file is a directory. |
-| `FirstUserFileId` | `const int FirstUserFileId` | First File-ID number available for user files. |
-| `HbAltHomeLbn` | `const int HbAltHomeLbn` |  |
-| `HbAltIdxLbn` | `const int HbAltIdxLbn` |  |
-| `HbChecksum1` | `const int HbChecksum1` | Sum of the first twenty-nine words, which a reader also checks. |
-| `HbChecksum2` | `const int HbChecksum2` | Where the home block keeps the sum of the 255 words ahead of it. |
-| `HbCluster` | `const int HbCluster` |  |
-| `HbFormatString` | `const int HbFormatString` |  |
-| `HbHomeLbn` | `const int HbHomeLbn` |  |
-| `HbHomeVbn` | `const int HbHomeVbn` |  |
+| `MinixFsReader` | `MinixFsReader(Stream stream, bool leaveOpen = false)` |  |
+| `Entries` | `IReadOnlyList<MinixFsEntry> Entries { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(MinixFsEntry entry)` |  |
+
+#### `MinixFsWriter`
+
+Builds minimal Minix v3 filesystem images. Uses 1024-byte blocks and creates real directory inodes for every path component, so a file added as `"a/b/c.txt"` is stored under nested directories `a` and `a/b`. Files are stored using direct zone pointers (up to 7 direct zones per file = up to 7168 bytes with 1K blocks). Directories may span multiple zones: their fixed-size entries fill the 7 direct zones and then a single-indirect zone, allowing a directory to hold thousands of entries (7 + 1024/4 = 263 zones = 4208 entries with 1K blocks).
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixFsWriter` | `MinixFsWriter(Stream output, bool leaveOpen = false)` |  |
+| `DeduplicateWithLinks` | `bool DeduplicateWithLinks { get; set; }` | Store one copy of files whose bytes are identical and give the rest a second name for it. |
+| `MakeSparse` | `bool MakeSparse { get; set; }` | Leave a zone unallocated where the file holds nothing but zeros. |
+| `AddFile` | `void AddFile(string path, byte[] data)` | Registers a file to be written into the image. |
+| `AddStreamingFile` | `void AddStreamingFile(string path, long size, Func<Stream> openStream)` | Registers a streaming file: `size` drives zone allocation and inode sizing during `Finish`; bytes are pulled from `openStream` after the metadata image is written, copied directly into the file's data zones in 64 KB chunks (only when the output stream is seekable). Never buffered as `byte[]`. |
+| `Dispose` | `void Dispose()` |  |
+| `Finish` | `void Finish()` | Builds and writes the Minix v3 filesystem image to the output stream. |
+
+### Namespace `FileSystem.MinixV1`
+
+[`MinixV1BlockMover`](#minixv1blockmover) · [`MinixV1Entry`](#minixv1entry) · [`MinixV1ExtentMap`](#minixv1extentmap) · [`MinixV1FormatDescriptor`](#minixv1formatdescriptor) · [`MinixV1InPlaceModifier`](#minixv1inplacemodifier) · [`MinixV1Reader`](#minixv1reader) · [`MinixV1Writer`](#minixv1writer)
+
+#### `MinixV1BlockMover`
+
+Moves a file's zones inside a Minix V1 volume, repoints the pointers that name them, and moves the allocation with them.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV1BlockMover` | `MinixV1BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A zone, which is a block at the zone size this writer uses. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the bitmaps and the inode table. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` |  |
+
+#### `MinixV1Entry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV1Entry` | `MinixV1Entry()` |  |
+| `InodeNumber` | `int InodeNumber { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `int Size { get; init; }` |  |
+
+#### `MinixV1ExtentMap`
+
+Reports where a Minix V1 volume's bytes are: its structures, each file's zones under its name, and what nothing holds.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `MinixV1FormatDescriptor`
+
+Read-only descriptor for the original Minix v1 filesystem (1987, Tanenbaum). 1024-byte blocks, 16-bit zone numbers, 32-byte inodes (7 direct + 1 indirect + 1 double-indirect), magic 0x137F (14-byte names) or 0x138F (30-byte names — Coherent variant). Predecessor to Linux's ext filesystem family. References: `https://github.com/torvalds/linux/blob/master/include/uapi/linux/minix_fs.h` — canonical on-disk structures (v1 layout + 0x137F/0x138F magics)Tanenbaum & Woodhull, "Operating Systems: Design and Implementation" — the original Minix FS design`https://en.wikipedia.org/wiki/Minix_file_system` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV1FormatDescriptor` | `MinixV1FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Minix v1 geometry (1024-byte blocks, 32-byte inodes) is fixed, but the on-disk directory-name width is a genuine format variant the writer honours: 14-byte names (magic 0x137F) or 30-byte names (magic 0x138F). Selecting "30" changes both the superblock magic and every directory entry's size. |
+| `ReclaimSupport` | `LayoutReclaim ReclaimSupport { get; }` | A zone pointer of zero names no zone, so a run of zeros need not be allocated; and the inode counts the names pointing at it, so identical files can share one copy under several of them. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Minix v1 image via `MinixV1InPlaceModifier` — TRUE in-place O(touched bytes) I/O (allocate inode + data zones, append zones at EOF when the image is full, write the directory entry). Falls back to a whole-image rebuild only for nested paths or payloads beyond the direct + single-indirect ceiling. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh Minix v1 image holding the supplied inputs. Path separators in an input's archive name produce nested directory inodes, each with its own `"."`/`".."` entries. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file's bytes are addressed one zone at a time by two-byte pointers in its inode and the indirect blocks below it, so a move is the copy, those pointers, and the bit per zone that says whether it is taken. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single file entry as a bounded stream over the inode's reassembled data zones. Reads past the entry's logical size return 0 (EOF). |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in-place via `MinixV1InPlaceModifier`. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every zone the bitmap leaves clear — which is where a removed file's bytes stay until something else claims them. |
+
+#### `MinixV1InPlaceModifier`
+
+TRUE in-place R/W modifier for original Minix v1 filesystem images. Performs O(touched bytes) random-access mutation against the real mkfs.minix on-disk layout: only the superblock zone-count field, the relevant inode/zone bitmap bytes, the affected inode slot, the touched directory zone and the file's data zones (plus a single-indirect pointer block when needed) are read or written. Every other byte stays byte-identical. The v1 bitmaps follow the classic mkfs.minix convention: the inode bitmap addresses inode `i` at bit `i` (bit 0 reserved), and the zone bitmap addresses zone `Z` at bit `Z - firstDataZone + 1` (bit 0 reserved). When the image has no free zone, fresh zones are appended at the end of the image (the bitmap and `s_nzones` grow with it) — a genuine in-place grow, not a re-pack.Honest scope: files are stored through the 7 direct zones plus the one single-indirect zone (up to 7 + 512 = 519 zones ≈ 531 KB). Anything larger, or a request the bitmap cannot satisfy, throws `IOException` so the descriptor can fall back to a full rebuild. Subdirectory creation is also deferred to rebuild. Existing double-indirect content is still freed on Remove.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file to the root directory in-place. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named regular file from the root directory in-place. |
+| `Replace` | `static bool Replace(Stream image, string name, byte[] data)` | Replaces a named regular file's data in-place. |
+
+#### `MinixV1Reader`
+
+Reads original Minix v1 filesystem images (1987, Tanenbaum's "Operating Systems: Design and Implementation"). The v1 layout uses 16-bit zone numbers, 16-bit inode counts, 32-byte inodes (7 direct + 1 indirect + 1 double-indirect zone pointer), and 1024-byte blocks. Two magic flavors: 0x137F (14-byte directory names) and 0x138F (30-byte directory names — Coherent / Minix patched variant).
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV1Reader` | `MinixV1Reader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<MinixV1Entry> Entries { get; }` |  |
+| `FirstDataZoneOffset` | `long FirstDataZoneOffset { get; }` | First zone that may hold file data: the one past the inode table. |
+| `InodeBitmapBlocks` | `ushort InodeBitmapBlocks { get; }` | Blocks the inode bitmap occupies, from the superblock. |
+| `InodeTableStart` | `long InodeTableStart { get; }` | Byte offset where the inode table starts. |
+| `Magic` | `ushort Magic { get; }` |  |
+| `NameLength` | `int NameLength { get; }` |  |
+| `ZoneBitmapBlocks` | `ushort ZoneBitmapBlocks { get; }` | Blocks the zone bitmap occupies, from the superblock. |
+| `ZoneBitmapOffset` | `long ZoneBitmapOffset { get; }` | Byte offset of the zone bitmap. |
+| `ZoneSize` | `static int ZoneSize { get; }` | Bytes per block, which is also a zone at this zone size. |
+| `Dispose` | `void Dispose()` |  |
+| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(MinixV1Entry entry)` | Where on disk `entry`'s bytes actually sit, as runs of whole zones, along with the byte offset of the first pointer that names each run. |
+| `Extract` | `byte[] Extract(MinixV1Entry entry)` |  |
+
+#### `MinixV1Writer`
+
+Builds minimal but spec-correct original Minix v1 filesystem images (1987, Tanenbaum). The v1 on-disk format uses 1024-byte blocks, 16-bit zone numbers, 16-bit inode counts and 32-byte inodes addressing data through 7 direct zones, 1 single-indirect and 1 double-indirect zone. Directory names are 14 bytes (magic `0x137F`) or 30 bytes (magic `0x138F`). Every path component becomes a real directory inode carrying its own `"."`/`".."` entries, so a file added as `"a/b/c.txt"` is stored under nested directories `a` and `a/b`. Files larger than the 7 direct zones (7168 bytes) spill into the single-indirect zone, which addresses a further 512 zones (524 288 bytes); beyond that the double-indirect zone extends the reach further still.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV1Writer` | `MinixV1Writer(Stream output, bool leaveOpen = false, bool longNames = false)` | Creates a writer for the given output stream. `longNames` selects the 30-byte-name variant (magic 0x138F); the default is the classic 14-byte-name layout (magic 0x137F). |
+| `DeduplicateWithLinks` | `bool DeduplicateWithLinks { get; set; }` | Store one copy of files whose bytes are identical and give the rest a second name for it. |
+| `MakeSparse` | `bool MakeSparse { get; set; }` | Leave a zone unallocated where the file holds nothing but zeros. |
+| `AddFile` | `void AddFile(string path, byte[] data)` | Registers a file to be written into the image. |
+| `Build` | `byte[] Build()` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Finish` | `void Finish()` | Builds and writes the Minix v1 filesystem image. |
+
+### Namespace `FileSystem.MinixV2`
+
+[`MinixV2BlockMover`](#minixv2blockmover) · [`MinixV2Entry`](#minixv2entry) · [`MinixV2ExtentMap`](#minixv2extentmap) · [`MinixV2FormatDescriptor`](#minixv2formatdescriptor) · [`MinixV2InPlaceModifier`](#minixv2inplacemodifier) · [`MinixV2Reader`](#minixv2reader) · [`MinixV2Writer`](#minixv2writer)
+
+#### `MinixV2BlockMover`
+
+Moves a file's zones inside a Minix V1 volume, repoints the pointers that name them, and moves the allocation with them.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV2BlockMover` | `MinixV2BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A zone, which is a block at the zone size this writer uses. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the bitmaps and the inode table. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` |  |
+
+#### `MinixV2Entry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV2Entry` | `MinixV2Entry()` |  |
+| `InodeNumber` | `int InodeNumber { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `int Size { get; init; }` |  |
+
+#### `MinixV2ExtentMap`
+
+Reports where a Minix V1 volume's bytes are: its structures, each file's zones under its name, and what nothing holds.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `MinixV2FormatDescriptor`
+
+Read-only descriptor for Minix v2 filesystem (1991). v2 extended the original layout with 64-byte inodes, 32-bit zone numbers, and triple-indirect blocks for large-file support. Magic 0x2468 (14-byte names) or 0x2478 (30-byte names — extended variant). References: `https://github.com/torvalds/linux/blob/master/include/uapi/linux/minix_fs.h` — canonical on-disk structures (v2 layout + 0x2468/0x2478 magics)`https://github.com/torvalds/linux/tree/master/fs/minix` — Linux reference implementation`https://en.wikipedia.org/wiki/Minix_file_system` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV2FormatDescriptor` | `MinixV2FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Minix v2 geometry (1024-byte blocks, 64-byte inodes) is fixed, but the on-disk directory-name width is a genuine format variant the writer honours: 14-byte names (magic 0x2468) or 30-byte names (magic 0x2478). Selecting "30" changes both the superblock magic and every directory entry's size. |
+| `ReclaimSupport` | `LayoutReclaim ReclaimSupport { get; }` | A zone pointer of zero names no zone, so a run of zeros need not be allocated; and the inode counts the names pointing at it, so identical files can share one copy under several of them. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing Minix v2 image via `MinixV2InPlaceModifier` — TRUE in-place O(touched bytes) I/O (allocate inode + data zones, append zones at EOF when the image is full, write the directory entry). Falls back to a whole-image rebuild only for nested paths or payloads beyond the direct + single-indirect ceiling. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Creates a fresh Minix v2 image holding the supplied inputs. Path separators in an input's archive name produce nested directory inodes, each with its own `"."`/`".."` entries. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file's bytes are addressed one zone at a time by two-byte pointers in its inode and the indirect blocks below it, so a move is the copy, those pointers, and the bit per zone that says whether it is taken. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single file entry as a bounded stream over the inode's reassembled data zones (including triple-indirect blocks for large files). Reads past the entry's logical size return 0 (EOF). |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in-place via `MinixV2InPlaceModifier`. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every zone the bitmap leaves clear — which is where a removed file's bytes stay until something else claims them. |
+
+#### `MinixV2InPlaceModifier`
+
+TRUE in-place R/W modifier for Minix v2 filesystem images. Performs O(touched bytes) random-access mutation against the real mkfs.minix v2 on-disk layout (64-byte inodes, 32-bit zone numbers): only the superblock zone-count field, the relevant inode/zone bitmap bytes, the affected inode slot, the touched directory zone and the file's data zones (plus a single-indirect pointer block when needed) are read or written. Every other byte stays byte-identical. The v2 bitmaps follow the classic mkfs.minix convention: the inode bitmap addresses inode `i` at bit `i` (bit 0 reserved), and the zone bitmap addresses zone `Z` at bit `Z - firstDataZone + 1` (bit 0 reserved). When the image has no free zone, fresh zones are appended at the end of the image (the bitmap and the 32-bit `s_zones` field grow with it) — a genuine in-place grow, not a re-pack.Honest scope: files are stored through the 7 direct zones plus the one single-indirect zone (7 + 256 = 263 data zones ≈ 269 KB). Anything larger, nested-path adds, or a request the bitmap cannot satisfy throws `IOException` so the descriptor can fall back to a full rebuild. Existing double-/triple-indirect content is still freed on Remove.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file to the root directory in-place. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named regular file from the root directory in-place. |
+| `Replace` | `static bool Replace(Stream image, string name, byte[] data)` | Replaces a named regular file's data in-place. |
+
+#### `MinixV2Reader`
+
+Reads Minix v2 filesystem images (1991). v2 extended the original Minix layout to support large files: 64-byte inodes (replacing v1's 32-byte), 32-bit zone numbers, and a triple-indirect block. The superblock layout is the same as v1 (1024-byte blocks). Magic 0x2468 (14-byte names) or 0x2478 (30-byte names).
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV2Reader` | `MinixV2Reader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<MinixV2Entry> Entries { get; }` |  |
+| `FirstDataZoneOffset` | `long FirstDataZoneOffset { get; }` | First zone that may hold file data: the one past the inode table. |
+| `InodeBitmapBlocks` | `ushort InodeBitmapBlocks { get; }` | Blocks the inode bitmap occupies, from the superblock. |
+| `Magic` | `ushort Magic { get; }` |  |
+| `NameLength` | `int NameLength { get; }` |  |
+| `ZoneBitmapBlocks` | `ushort ZoneBitmapBlocks { get; }` | Blocks the zone bitmap occupies, from the superblock. |
+| `ZoneBitmapOffset` | `long ZoneBitmapOffset { get; }` | Byte offset of the zone bitmap. |
+| `ZoneSize` | `static int ZoneSize { get; }` | Bytes per block, which is also a zone at this zone size. |
+| `Dispose` | `void Dispose()` |  |
+| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(MinixV2Entry entry)` | Where on disk `entry`'s bytes actually sit, as runs of whole zones, along with the byte offset of the first pointer that names each run. |
+| `Extract` | `byte[] Extract(MinixV2Entry entry)` |  |
+
+#### `MinixV2Writer`
+
+Builds minimal but spec-correct Minix v2 filesystem images (1991). v2 keeps the v1 superblock and 1024-byte blocks but widens inodes to 64 bytes, zone numbers to 32 bits, and adds a triple-indirect zone for large files. Directory names are 14 bytes (magic `0x2468`) or 30 bytes (magic `0x2478`). Every path component becomes a real directory inode with its own `"."`/`".."` entries, so a file added as `"a/b/c.txt"` is stored under nested directories `a` and `a/b`. Files larger than the 7 direct zones (7168 bytes) spill into the single-indirect zone (256 further zones), then the double-indirect zone, then the triple-indirect zone.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MinixV2Writer` | `MinixV2Writer(Stream output, bool leaveOpen = false, bool longNames = false)` | Creates a writer for the given output stream. `longNames` selects the 30-byte-name variant (magic 0x2478); the default is the 14-byte-name layout (magic 0x2468). |
+| `DeduplicateWithLinks` | `bool DeduplicateWithLinks { get; set; }` | Store one copy of files whose bytes are identical and give the rest a second name for it. |
+| `MakeSparse` | `bool MakeSparse { get; set; }` | Leave a zone unallocated where the file holds nothing but zeros. |
+| `AddFile` | `void AddFile(string path, byte[] data)` | Registers a file to be written into the image. |
+| `Build` | `byte[] Build()` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Finish` | `void Finish()` | Builds and writes the Minix v2 filesystem image. |
+
+### Namespace `FileSystem.MooseFs`
+
+[`MooseFsEntry`](#moosefsentry) · [`MooseFsFormatDescriptor`](#moosefsformatdescriptor) · [`MooseFsReader`](#moosefsreader) · [`MooseFsReader.SectionEntry`](#moosefsreadersectionentry)
+
+#### `MooseFsEntry`
+
+One synthetic surface in the MooseFS master-metadata image: either the `metadata.ini` human-readable summary, the raw `moosefs-master.bin` pass-through, or a per-section raw payload (`section_NODE.bin`, `section_EDGE.bin`, etc.). MooseFS file content lives on chunk servers — not in this image — so no path-tree entries are surfaced.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MooseFsEntry` | `MooseFsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `MooseFsFormatDescriptor`
+
+Partial R/O descriptor for MooseFS master-metadata images (`metadata.mfs`). Surfaces the metadata envelope (signature, counters, section index) and the raw payload bytes of each walked section. Path-tree (NODE/EDGE) and chunk-id (CHNK) bodies are version-specific and require golden samples to decode honestly — the reader makes no claim about their internal structure. MooseFS file content lives on chunk servers and is unreachable from a single metadata image. Listing therefore surfaces ONLY synthetic metadata + per-section raw payloads, never POSIX paths. References: `https://github.com/moosefs/moosefs` — canonical source (master metadata dump/load code)`https://moosefs.com/` — vendor site and documentation`https://en.wikipedia.org/wiki/Moose_File_System` — Wikipedia article
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MooseFsFormatDescriptor` | `MooseFsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `MooseFsReader`
+
+Partial R/O reader for MooseFS master-metadata images (`metadata.mfs`). MooseFS is a fault-tolerant distributed FS — the master server keeps the namespace + chunk-server topology in a single binary metadata file, while file data lives on chunk servers. This reader understands the master metadata's outer envelope: 8-byte ASCII signature (e.g. `MFSM 2.0`, `MFSM 1.6`, `MFSM 1.5`, `MFSM 1.4`, `MFSM NEW`).For 1.6+ images: two 8-byte big-endian counters (file-id counter, metadata version) immediately after the signature.Sequence of sections. Each section: 8-byte ASCII type tag (`SESS 1.0`, `STAT 1.0`, `NODE 1.0`, `EDGE 1.0`, `FREE 1.0`, `XATR 1.0`, `CHNK 1.0`, `OPEN 1.0`, `FLCK 1.0`, `QUOT 1.0`, `ACLS 1.0`, …) + 8-byte big-endian payload length + that many payload bytes.Final 16-byte terminator `[MFS EOF MARKER]`. The reader walks the section index only — it does not attempt to decode NODE / EDGE record bodies, which differ between MooseFS minor versions and require ground-truth golden samples to validate. NODE/EDGE would give path tree + inode metadata; CHNK gives chunk-id mappings. None of those by themselves yield file content — MooseFS data lives on chunk servers and is only reachable via the live MooseFS protocol. Therefore the reader exposes: `metadata.ini` — human-readable summary of header + section table (name, payload offset, payload length).`moosefs-master.bin` — the raw image, byte-for-byte.`section_<NAME>.bin` — the raw payload bytes of each section the index walk surfaced (NODE, EDGE, CHNK, …). Useful for offline forensics; we make no claim about their internal structure. If section-walk fails (signature past the 8-byte tag is not recognised, a section length runs past EOF, the EOF marker is missing, …), the reader falls back to a header-only surface (metadata.ini + raw) and records the parse failure in `metadata.ini`'s `parse_status` field. This is the honest "we recognise the envelope but couldn't walk the contents" mode rather than silently inventing entries.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MooseFsReader` | `MooseFsReader(Stream stream)` |  |
+| `EofMarker` | `static readonly byte[] EofMarker` | 16-byte MooseFS end-of-file marker following the last section. |
+| `MasterTag` | `static readonly byte[] MasterTag` | MooseFS master metadata 4-byte prefix: ASCII "MFSM". |
+| `Entries` | `IReadOnlyList<MooseFsEntry> Entries { get; }` | Listing of every entry this image surfaces. |
+| `FileIdCounter` | `ulong? FileIdCounter { get; }` | File-id counter from the modern (1.6+) post-signature header, or `null` when the image is too short or pre-1.6. |
+| `MetadataVersion` | `ulong? MetadataVersion { get; }` | Metadata version counter from the modern (1.6+) post-signature header, or `null` when the image is too short or pre-1.6. |
+| `ParseStatus` | `string ParseStatus { get; }` | Human-readable description of how the section walk terminated: `"ok"` (full walk + EOF marker), `"truncated"` (section walk stopped before EOF marker), `"header-only"` (image too short for any sections), or `"unsupported-header"` (no MFSM tag). |
+| `Sections` | `IReadOnlyList<SectionEntry> Sections { get; }` | Section index walked from the master metadata stream. |
+| `Signature` | `string Signature { get; }` | The 8-byte ASCII signature at offset 0 (e.g. `"MFSM 2.0"`). |
+| `ValidHeader` | `bool ValidHeader { get; }` | True when the 4-byte `MFSM` tag was present at offset 0. |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(MooseFsEntry entry)` | Returns the bytes that back the given entry (in-memory). |
+
+#### `MooseFsReader.SectionEntry`
+
+One walked section from the master metadata stream.
+
+Implements `IEquatable<SectionEntry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `SectionEntry` | `SectionEntry(string Tag, long Offset, long Length)` | One walked section from the master metadata stream. |
+| `Length` | `long Length { get; init; }` | Length of the section payload in bytes. |
+| `Offset` | `long Offset { get; init; }` | Byte offset of the section payload (after the 16-byte tag+length). |
+| `Tag` | `string Tag { get; init; }` | The 8-byte ASCII tag (e.g. `"NODE 1.0"`), trimmed. |
+
+### Namespace `FileSystem.Msa`
+
+[`MsaEntry`](#msaentry) · [`MsaFormatDescriptor`](#msaformatdescriptor) · [`MsaModifier`](#msamodifier) · [`MsaReader`](#msareader) · [`MsaWriter`](#msawriter)
+
+#### `MsaEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MsaEntry` | `MsaEntry()` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `MsaFormatDescriptor`
+
+Descriptor for Atari ST MSA (Magic Shadow Archiver) disk images — an RLE-compressed track-image container wrapping a FAT12 floppy filesystem. References: `https://github.com/hatari/hatari` — Hatari emulator; its MSA disk-image support is the de-facto reference implementationMagic Shadow Archiver original documentation (Atari ST, Seimet) — no stable online spec
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MsaFormatDescriptor` | `MsaFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds files to the FAT12 filesystem inside an existing MSA image. Each call performs decode → modify FAT → re-encode (see `MsaModifier`); per-track RLE compression makes anything cheaper architecturally impossible. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds an MSA image holding the inputs. An MSA file is a compressed Atari ST floppy, so the files go into a GEMDOS volume first and that volume is what gets encoded. A single input that already is a floppy image — the .st → .msa conversion — is encoded as it stands. Anything else used to be treated the same way, which meant the first input's bytes were read as a disk image and every other input was dropped without a word: three files in, one nonsensical "floppy" out. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Defragments the inner FAT12 filesystem inside an MSA image. The image is decoded to a flat disk, the FAT layer is defragmented via rebuild (read all files, rebuild with FatWriter which always start-packs), and the result is re-encoded to MSA tracks preserving the original geometry. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Decodes the MSA tracks to a flat FAT12 image and delegates to `Enumerate` for the actual cluster-chain walk. The returned offsets are relative to the inner flat image (not the MSA container) — this matches what the defrag window expects for filesystem extent maps. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` | Lists the files on the floppy the image holds. An MSA file wraps a GEMDOS volume, and this descriptor's Add and Remove already work on that volume's files, so this reads them too — a disc whose filesystem cannot be walked falls back to the raw image as a single entry. |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes files from the FAT12 filesystem inside an existing MSA image. Inner-layer wipe is delegated to `FatRemover` (zeros cluster bytes + cluster-tip slack + dirent + FAT entries), then the modified flat image is re-encoded to MSA tracks. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the filesystem inside an MSA image. MSA is an outer RLE-compressed container whose track bytes hold no in-place free space — the extent map's offsets are relative to the decoded flat image, not the container — so wiping is performed the only honest way: decode the tracks to the flat image, run the wiper of whichever descriptor reads that volume (free clusters + cluster tips) on it, then re-encode preserving the original geometry. |
+
+#### `MsaModifier`
+
+Modifier for Atari ST MSA (Magic Shadow Archiver) disk images. MSA is a two-level container: an outer RLE-compressed track wrapper around an inner FAT12 filesystem image (track-aligned dump of a standard ST floppy). Because each track is RLE-compressed independently, true byte-level in-place modification is impossible — any change to the inner FAT image shifts the compressed lengths of one or more tracks and therefore the entire rest of the file. The honest path is decode → modify FAT → re-encode, which is what this class does:Read MSA header, decompress all tracks into a flat FAT12 image (size = (end-start+1) × sides × SPT × 512 bytes).Apply the FAT modifier op (`FatRemover` for remove, `FatReader` + `FatWriter` rebuild for add) on the flat image, preserving total-sectors.Re-encode the flat image back to MSA tracks via `Write`, preserving the original geometry (SPT, sides, start/end track) so subsequent round-trips remain stable.Operates on the entire image — there is no streaming sector access because the RLE codec is per-track and forces a full track decode anyway. For a 1.44 MB ST floppy that's ~1.4 MB of memory traffic per call, which is fine for the use case (interactive disk editing, test harnesses).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to the FAT12 filesystem inside an MSA image. The image is fully decoded, the FAT layer is rebuilt with the existing entries plus the new one (matching `FatFormatDescriptor.Add`'s strategy — FatWriter is build-from-scratch by design), and the result is re-compressed track by track with the original MSA geometry. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file from the FAT12 filesystem inside an MSA image. Uses `Remove` for the inner-layer wipe (zeros cluster bytes + cluster-tip slack + directory entry + FAT entries in every FAT copy, leaving no forensic trace of the filename or content), then re-encodes the modified flat image back to MSA tracks with the original geometry. |
+
+#### `MsaReader`
+
+Reads Atari ST MSA (Magic Shadow Archiver) disk images. MSA uses simple RLE compression on individual tracks.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `MsaReader` | `MsaReader(Stream stream, bool leaveOpen = false)` |  |
+| `MsaMagic` | `const ushort MsaMagic` |  |
+| `EndTrack` | `ushort EndTrack { get; }` |  |
+| `Entries` | `IReadOnlyList<MsaEntry> Entries { get; }` |  |
+| `SectorsPerTrack` | `ushort SectorsPerTrack { get; }` |  |
+| `Sides` | `ushort Sides { get; }` |  |
+| `StartTrack` | `ushort StartTrack { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(MsaEntry entry)` |  |
+
+#### `MsaWriter`
+
+Creates MSA (Magic Shadow Archiver) disk images from raw ST disk data. Uses RLE compression per track.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Write` | `static void Write(Stream output, byte[] diskData, ushort sectorsPerTrack = 9, ushort sides = 1)` |  |
+
+### Namespace `FileSystem.Nilfs1`
+
+[`Nilfs1BlockMover`](#nilfs1blockmover) · [`Nilfs1Entry`](#nilfs1entry) · [`Nilfs1ExtentMap`](#nilfs1extentmap) · [`Nilfs1FormatDescriptor`](#nilfs1formatdescriptor) · [`Nilfs1InPlaceModifier`](#nilfs1inplacemodifier) · [`Nilfs1Optimizer`](#nilfs1optimizer) · [`Nilfs1Optimizer.Nilfs1Geometry`](#nilfs1optimizernilfs1geometry) · [`Nilfs1Reader`](#nilfs1reader) · [`Nilfs1Writer`](#nilfs1writer)
+
+#### `Nilfs1BlockMover`
+
+Moves a payload inside the base segment of a NILFS volume and rewrites the directory field that said where it began.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs1BlockMover` | `Nilfs1BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A byte. Payloads are packed to the byte here, so nothing rounds them to anything larger. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a payload may occupy: where the base segment's payloads start. |
+| `PayloadEnd` | `long PayloadEnd { get; }` | Where the area a payload may occupy ends. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the field naming the payload it is given and leaves the others alone. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A payload may be held outside the volume while the rest of the layout moves, which is what lets a full area be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the base segment once and notes which field names each payload. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Nilfs1Entry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs1Entry` | `Nilfs1Entry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` | Where the entry's bytes live in the image, for entries the reader leaves in place rather than copying. -1 when `Data` carries them. |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `Nilfs1ExtentMap`
+
+Walks a NILFS v1 image (as written by `Nilfs1Writer` and mutated by `Nilfs1InPlaceModifier`) and emits its on-disk byte layout: the boot+superblock region, the base directory header + every appended log-segment header/directory as metadata-reserved, and one `Used` extent per currently-live file payload (highest-cno-per-name wins; tombstoned and superseded payloads are deliberately left uncovered so the wipe verb can reclaim/scrub them). This live-only extent set is what makes the wipe verb forensically honest on a log-structured volume: `Remove` only tombstones (snapshot data stays byte-identical), and a subsequent `WipeUnusedSpace` zero-fills the now-dead payload bytes because they are no longer claimed by any live extent.For images we did not write ourselves (no `WriterMagic` marker) we emit a coarse map: metadata-reserved for the boot+superblock area, free for the rest. NILFS v1's true segment-usage walk is out of scope.The image is read through an `ImageAccessor` rather than copied in: the directories are a few kilobytes however many gigabytes of payload they describe.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `Nilfs1FormatDescriptor`
+
+Descriptor for NILFS v1 — the original (pre-mainline) New Implementation of a Log-structured File System, predecessor of NILFS2. Shares the 0x3434 magic with NILFS2 but is distinguished by `s_rev_level == 1` (NILFS2 uses rev≥2). Writer scope. Per the task brief, NILFS v1's full DAT-tree / segment-usage / log-replay surface is a multi-week effort. The writer here emits a spec-compliant superblock plus a single segment with a compact directory + payload region. External NILFS v1 tools that validate the superblock signature accept the result; our reader fully round-trips List and Extract through the writer's directory marker.Hierarchy. Subdirectories are recorded as path-prefixed entries in the writer's compact directory ('/' separator). The reader returns the flat list with subdir prefixes; consumers reconstruct the tree via `WriteFile`. References: `https://nilfs.sourceforge.io/` — NILFS project home (covers the original NILFS v1)`https://github.com/torvalds/linux/blob/master/include/uapi/linux/nilfs2_ondisk.h` — shared on-disk superblock layout (s_rev_level discriminates v1)`https://en.wikipedia.org/wiki/NILFS` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs1FormatDescriptor` | `Nilfs1FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Appends a fresh log segment at the tail of the image carrying dirent + data blocks for each input, and bumps `s_last_cno`. The 8-byte cno field is the only in-place edit; every other byte of the prior image stays byte-identical at its original offset — continuous-snapshot semantic intact. Inputs whose name already exists are effectively replaced (the higher cno wins on read). |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Appends a tombstone dirent for each named entry in a fresh log segment and bumps `s_last_cno`. The reader's cno-merge drops the entry from the listing; the original data blocks stay byte-identical at their offsets and remain addressable as a snapshot of the pre-Remove state. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `Nilfs1InPlaceModifier`
+
+True in-place modifier for NILFS v1 images emitted by `Nilfs1Writer`. Implements the log-structured continuous-snapshot semantic NILFS v1 shares with NILFS2: every mutation appends a fresh logical segment (an appended-segment magic) at the tail of the volume and bumps the superblock's `s_last_cno`, leaving every byte of the prior image byte-identical at its original offset — the single 8-byte `s_last_cno` field is the only in-place edit. Old segments stay recoverable as snapshots.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Add` | `static void Add(Stream image, IReadOnlyList<ArchiveInputInfo> inputs)` | Appends a new logical segment carrying fresh dirent + data blocks for each input file and bumps `s_last_cno`. Existing segments stay byte-identical at their original offsets; only the 8-byte checkpoint-number field changes. Inputs whose name already exists are effectively replaced (the higher cno wins on read). |
+| `Remove` | `static void Remove(Stream image, string[] entryNames)` | Appends a new logical segment containing a tombstone dirent for each named entry and bumps `s_last_cno`. Old data blocks stay byte-identical; the reader's tombstone-aware merge drops the entry from the listing. |
+| `Replace` | `static void Replace(Stream image, string name, byte[] newData)` | Appends a new logical segment carrying a fresh data block for the named file and bumps `s_last_cno`. Old data blocks stay byte-identical at their original offsets; the reader's highest-cno-per-name merge surfaces the new content. |
+
+#### `Nilfs1Optimizer`
+
+Picks NILFS v1 superblock parameters for a given fileset. Returns the smallest BlockSize whose total slack waste is ≤ 5%, tiebreaking toward bigger blocks (less FAT-style overhead in the segment). SegmentSize is always 8 × BlockSize because our minimal writer emits one full segment.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Find` | `static Nilfs1Geometry Find(IReadOnlyList<long> fileSizes)` |  |
+
+#### `Nilfs1Optimizer.Nilfs1Geometry`
+
+Implements `IEquatable<Nilfs1Geometry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs1Geometry` | `Nilfs1Geometry(int BlockSize, int SegmentSize)` |  |
+| `BlockSize` | `int BlockSize { get; init; }` |  |
+| `SegmentSize` | `int SegmentSize { get; init; }` |  |
+
+#### `Nilfs1Reader`
+
+Reads NILFS v1 superblock metadata — the original (pre-mainline) New Implementation of a Log-structured File System. NILFS v1 was the out-of-tree precursor to NILFS2 (mainline since 2.6.30); it shares the same 0x3434 superblock magic but uses `s_rev_level == 1`. Full DAT-tree / cpfile-driven root-dir enumeration of an arbitrary external NILFS v1 image is a multi-week effort (the cpfile inode walk and segment usage table are sparsely documented for v1 specifically) — so this reader surfaces metadata for unknown images, and reads our own writer's compact directory index when the image carries the `WriterMagic` marker right after the superblock. Superblock layout (selected, little-endian, sits at file offset 1024): 0x00 u32 s_rev_level (== 1 for NILFS v1) 0x04 u16 s_minor_rev_level 0x06 u16 s_magic (must be 0x3434 = NILFS_SUPER_MAGIC) 0x08 u16 s_bytes 0x0A u16 s_flags 0x14 u32 s_log_block_size 0x18 u64 s_nsegments 0x20 u64 s_dev_size 0x30 u32 s_blocks_per_segment 0x38 u64 s_last_cno (last checkpoint number) 0xA8 byte[80] volume label (s_volume_name; written by Nilfs1Writer) ...
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs1Reader` | `Nilfs1Reader(Stream stream)` |  |
+| `NilfsV1RevLevel` | `const uint NilfsV1RevLevel` |  |
+| `SuperMagic` | `const ushort SuperMagic` |  |
+| `BlocksPerSegment` | `uint BlocksPerSegment { get; }` |  |
+| `DevSize` | `ulong DevSize { get; }` |  |
+| `Entries` | `IReadOnlyList<Nilfs1Entry> Entries { get; }` |  |
+| `LastCheckpoint` | `ulong LastCheckpoint { get; }` |  |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `LogBlockSize` | `uint LogBlockSize { get; }` |  |
+| `Magic` | `ushort Magic { get; }` |  |
+| `NumSegments` | `ulong NumSegments { get; }` |  |
+| `RevLevel` | `uint RevLevel { get; }` |  |
+| `ValidSuperblock` | `bool ValidSuperblock { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `ExtractTo` | `long ExtractTo(Nilfs1Entry entry, Stream destination)` | Writes `entry`'s bytes into `destination`. |
+| `Extract` | `byte[] Extract(Nilfs1Entry entry)` |  |
+
+#### `Nilfs1Writer`
+
+Writes a minimal NILFS v1 image. Emits a fully spec-compliant superblock (NILFS_SUPER_MAGIC 0x3434 at offset 1030, s_rev_level == 1) followed by a single segment containing a compact directory index plus the file payloads. Scope. Per `docs/FILESYSTEMS.md` NILFS v1 is the original out-of-tree precursor to the mainline NILFS2 driver — full DAT-tree / segment-usage walking + Linux kernel mount support is a multi-week effort that requires the (sparsely documented) pre-mainline log replay code. What we ship here is enough for round-trip List/Extract via our reader and for external tools that only validate the superblock signature.On-disk layout.0x000..0x3FF — boot sector area (zeroed, not used).0x400..0x7FF — NILFS v1 superblock with magic 0x3434 at +6 and `s_rev_level == 1` at +0.0x800..ZSTART — first segment header marker + our compact directory + payload area. Marker = the writer magic + payload length at +8.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs1Writer` | `Nilfs1Writer()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. Subdirectory paths are encoded with '/' separators in `name`. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the directory is laid out from it before a byte is read. |
+| `Build` | `byte[] Build(int blockSize = 4096, int segmentSize = 0, string volumeLabel = null, bool enableChecksum = false)` | Builds the NILFS v1 image. `blockSize` drives the superblock's `s_log_block_size` field (must be a power of two between 1024 and 65536). `volumeLabel` is stored in the superblock's volume-label area (s_volume_name, an 80-byte slot at offset 0xA8). `enableChecksum` sets the corresponding feature flag bit. |
+| `WriteTo` | `void WriteTo(Stream output, int blockSize = 4096, int segmentSize = 0, string volumeLabel = null, bool enableChecksum = false)` | Writes the volume into `output`: the superblock and directory, then each payload at its recorded offset and the secondary superblock at the tail. Only a non-seekable target materialises the volume. |
+
+### Namespace `FileSystem.Nilfs2`
+
+[`Nilfs2BlockMover`](#nilfs2blockmover) · [`Nilfs2Entry`](#nilfs2entry) · [`Nilfs2FormatDescriptor`](#nilfs2formatdescriptor) · [`Nilfs2InPlaceModifier`](#nilfs2inplacemodifier) · [`Nilfs2Reader`](#nilfs2reader) · [`Nilfs2Superblock`](#nilfs2superblock) · [`Nilfs2Writer`](#nilfs2writer)
+
+#### `Nilfs2BlockMover`
+
+Moves a payload inside the base segment of a NILFS volume and rewrites the directory field that said where it began.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs2BlockMover` | `Nilfs2BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A byte. Payloads are packed to the byte here, so nothing rounds them to anything larger. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a payload may occupy: where the base segment's payloads start. |
+| `PayloadEnd` | `long PayloadEnd { get; }` | Where the area a payload may occupy ends. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the field naming the payload it is given and leaves the others alone. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A payload may be held outside the volume while the rest of the layout moves, which is what lets a full area be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the base segment once and notes which field names each payload. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Nilfs2Entry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs2Entry` | `Nilfs2Entry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` | Where the entry's bytes live in the image, for entries the reader leaves in place rather than copying. -1 when `Data` carries them. |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `Nilfs2FormatDescriptor`
+
+NILFS2 descriptor (continuous-snapshot log-structured filesystem, Linux mainline since 2.6.30). Magic 0x3434 sits at superblock+6 (file offset 1030). R/W scope. Create emits a spec-compliant superblock plus a writer-private compact directory at offset 2048 (the base checkpoint at cno=1). Add / Replace / Remove append a fresh log segment (an appended-segment magic header + cno + dirents + payload) at the tail of the volume and bump `s_last_cno` in the superblock — the only in-place edit, sanctioned by the NILFS2 spec for advancing the checkpoint pointer. Every byte of every prior segment stays byte-identical at its original offset, so the older state is byte-recoverable as a snapshot (continuous-snapshot semantic).Kernel-mountable. Create emits the full single-checkpoint log the Linux `nilfs2` driver needs to mount: a super root with the DAT / cpfile / sufile inodes (+ their CRC), a segment summary with the spec ss_sumsum / ss_datasum checksums, an ifile holding the root directory inode, a DAT (Disk Address Translation) table, and a flat root directory carrying the files. A real `mount -t nilfs2` mounts the image, lists the directory, and reads the files back (verified via the libguestfs appliance kernel). Subdirectories and files larger than a direct block map stay in the writer-private directory for the reader but are not materialised in the mountable tree; snapshots / multi-checkpoint chains remain out of scope. References: `https://nilfs.sourceforge.io/` — NILFS project home`https://www.kernel.org/doc/html/latest/filesystems/nilfs2.html` — kernel documentation`https://github.com/torvalds/linux/blob/master/include/uapi/linux/nilfs2_ondisk.h` — canonical on-disk structures`https://en.wikipedia.org/wiki/NILFS` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs2FormatDescriptor` | `Nilfs2FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Creation knobs. `BlockSize` is the NILFS2 block size (power of two in [1024, 65536], recorded in `s_log_block_size`): leave it at "auto" (0) to let the layout optimiser pick the legal size that minimises wasted tail padding for the file-set, or pin a value. `VolumeLabel` fills the 16-byte superblock label slot. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Appends a fresh log segment at the tail of the image carrying dirent + data blocks for each input, and bumps `s_last_cno` in the superblock. The 8-byte cno field is the only in-place edit; every other byte of the prior image stays byte-identical at its original offset — continuous snapshot semantic intact. Inputs whose name already exists are effectively replaced (the higher cno wins on read). |
+| `AnalyzeLayout` | `LayoutAnalysis AnalyzeLayout(Stream image)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Emits a self-contained NILFS2 image (valid superblock + base private directory at cno=1). Round-trips through this descriptor's reader and serves as the substrate for in-place Add / Replace / Remove via `Nilfs2InPlaceModifier`. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Superblocks, the kernel log, the private directory and every appended segment's header are metadata; each live payload is the file that owns it. Superseded and tombstoned payloads are claimed by nothing, so a wipe reclaims exactly the bytes a segment cleaner would. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `PatchInPlace` | `void PatchInPlace(Stream image, LayoutPatch patch)` |  |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Appends a tombstone dirent for each named entry in a fresh log segment and bumps `s_last_cno`. The reader's cno-merge drops the entry from the listing; the original data blocks stay byte-identical at their original offsets and remain addressable as a snapshot of the pre-Remove state. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `Nilfs2InPlaceModifier`
+
+True in-place modifier for NILFS2 images emitted by `Nilfs2Writer`. Implements the spec semantic of NILFS2's continuous-snapshot log-structured layout: every mutation appends a fresh "logical segment" at the tail of the volume, leaving every byte in the prior image byte-identical at its original offset — except for the 8-byte `s_last_cno` field of the superblock, which is the only in-place edit the spec sanctions. Old segments stay recoverable as snapshots.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Add` | `static void Add(Stream image, IReadOnlyList<ArchiveInputInfo> inputs)` | Appends a new logical segment carrying fresh dirent + data blocks for each input file and bumps `s_last_cno` in the superblock. Existing segments stay byte-identical at their original offsets; only the 8-byte checkpoint-number field of the superblock changes in place. |
+| `Remove` | `static void Remove(Stream image, string[] entryNames)` | Appends a new logical segment containing a tombstone dirent for each named entry and bumps `s_last_cno`. Old data blocks stay byte-identical; the reader's tombstone-aware merge drops the entry from the listing. |
+| `Replace` | `static void Replace(Stream image, string name, byte[] newData)` | Appends a new logical segment carrying a fresh data block for the named file and bumps `s_last_cno`. Old data blocks stay byte-identical at their original offsets — they remain addressable as snapshots — and the reader's highest-cno-per-name merge surfaces the new content. |
+
+#### `Nilfs2Reader`
+
+Reads NILFS2 superblock metadata (Linux's continuous-snapshot log-structured filesystem, mainline since 2.6.30). Full file traversal would require walking the DAT (Disk Address Translation) B-tree and replaying log segments — multi-week work. This reader surfaces the parsed superblock + checkpoint anchor as a structured metadata bundle plus the raw image, matching the pattern used by other research/proprietary read-only FSes in this project. Superblock layout (selected, little-endian, sits at file offset 1024): 0x00 u32 s_rev_level 0x04 u16 s_minor_rev_level 0x06 u16 s_magic (must be 0x3434 = NILFS_SUPER_MAGIC) 0x08 u16 s_bytes 0x0A u16 s_flags 0x0C u32 s_crc_seed 0x10 u32 s_sum 0x14 u32 s_log_block_size 0x18 u64 s_nsegments 0x20 u64 s_dev_size 0x28 u64 s_first_data_block 0x30 u32 s_blocks_per_segment 0x34 u32 s_r_segments_percentage 0x38 u64 s_last_cno (last checkpoint number) 0x40 u64 s_last_pseg (last partial segment) ...
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs2Reader` | `Nilfs2Reader(Stream stream)` |  |
+| `SuperMagic` | `const ushort SuperMagic` |  |
+| `BlocksPerSegment` | `uint BlocksPerSegment { get; }` |  |
+| `ChecksumValid` | `bool ChecksumValid { get; }` | True when the parsed superblock's stored `s_sum` matches a freshly computed Linux `crc32_le` over its first `s_bytes` bytes. mkfs and our own writer both produce CRC-valid superblocks; a false here flags a corrupt or hand-edited image. |
+| `CrcSeed` | `uint CrcSeed { get; }` |  |
+| `DevSize` | `ulong DevSize { get; }` |  |
+| `Entries` | `IReadOnlyList<Nilfs2Entry> Entries { get; }` |  |
+| `LastCheckpoint` | `ulong LastCheckpoint { get; }` |  |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `LogBlockSize` | `uint LogBlockSize { get; }` |  |
+| `LogFileRegions` | `IReadOnlyList<ValueTuple<long, long, string>> LogFileRegions { get; }` | The data blocks of files embedded in the kernel checkpoint, with the name each belongs to. A file small enough for a direct block map has a copy here as well as in the payload region, so a wipe has to know which of those blocks still belong to a live file. |
+| `Magic` | `ushort Magic { get; }` |  |
+| `MetadataRegions` | `IReadOnlyList<ValueTuple<long, long>> MetadataRegions { get; }` | Regions holding structure rather than file bytes: the superblocks, the kernel log, the writer-private directory and the header+directory of every appended segment. A wipe must leave these alone; everything they and the live payloads do not cover is dead space. |
+| `NumSegments` | `ulong NumSegments { get; }` |  |
+| `RevLevel` | `uint RevLevel { get; }` |  |
+| `SBytes` | `ushort SBytes { get; }` |  |
+| `StoredSum` | `uint StoredSum { get; }` |  |
+| `SuperblockSource` | `string SuperblockSource { get; }` | Which superblock copy was chosen as authoritative. |
+| `Uuid` | `string Uuid { get; }` |  |
+| `ValidSuperblock` | `bool ValidSuperblock { get; }` |  |
+| `VolumeLabel` | `string VolumeLabel { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `ExtractTo` | `long ExtractTo(Nilfs2Entry entry, Stream destination)` | Writes `entry`'s bytes into `destination`. |
+| `Extract` | `byte[] Extract(Nilfs2Entry entry)` |  |
+
+#### `Nilfs2Superblock`
+
+Byte-accurate NILFS2 superblock encoder/decoder, reverse-engineered against `mkfs.nilfs2` (nilfs-utils 2.2.9) output and cross-checked field-by-field.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ErrorsContinue` | `const ushort ErrorsContinue` |  |
+| `Magic` | `const ushort Magic` |  |
+| `PrimaryOffset` | `const int PrimaryOffset` |  |
+| `SBytes` | `const ushort SBytes` |  |
+| `SecondaryBackOffset` | `const int SecondaryBackOffset` | The secondary superblock sits one block (4096 B) before EOF. |
+| `Size` | `const int Size` |  |
+| `StateValid` | `const ushort StateValid` |  |
+| `Crc32Le` | `static uint Crc32Le(uint seed, ReadOnlySpan<byte> data)` | Linux `crc32_le`: reflected IEEE polynomial, no input/output inversion. The `seed` is the literal LFSR init (the NILFS s_crc_seed), not the usual 0xFFFFFFFF. |
+| `Encode` | `static void Encode(Span<byte> dest, uint logBlockSize, ulong nSegments, ulong devSize, uint blocksPerSegment, ulong lastCno, ulong lastPseg, ulong lastSeq, ulong freeBlocks, ulong ctime, ushort state, uint crcSeed, ReadOnlySpan<byte> uuid, string volumeLabel)` | Encodes a complete 1024-byte superblock into `dest` and seals it with a valid checksum. |
+| `FinalizeChecksum` | `static void FinalizeChecksum(Span<byte> sb, uint seed)` | Writes the s_sum checksum into `sb` (a span starting at the superblock) using `seed` over the first `SBytes` bytes with the s_sum field zeroed first. |
+| `VerifyChecksum` | `static bool VerifyChecksum(ReadOnlySpan<byte> sb)` | Verifies the stored s_sum against a freshly computed crc32_le over the first `SBytes` bytes with the s_sum field treated as zero. |
+
+#### `Nilfs2Writer`
+
+Writes a kernel-mountable NILFS2 image. Emits the full single-checkpoint log structure the Linux `nilfs2` driver needs to mount — a super root with the DAT / cpfile / sufile inodes, a segment summary with the spec checksums, an ifile holding the root directory inode, a DAT (disk-address-translation) table, and a root directory carrying the user files — alongside the byte- accurate, CRC-valid superblock pair. A real `mount -t nilfs2` mounts the image and reads the files back (verified via the libguestfs appliance kernel).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nilfs2Writer` | `Nilfs2Writer()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the image. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> opener)` | Adds a file whose bytes are copied straight from `opener` into the image at write time, so a payload larger than memory — or than a byte[] — can be stored. |
+| `Build` | `byte[] Build(int blockSize = 4096, string volumeLabel = null)` | Builds the NILFS2 image in memory. `blockSize` must be a power of two in [1024, 65536]; `volumeLabel` is written into the superblock's volume-label slot at +0xA8. Use `Build` for volumes past the array limit. |
+| `Build` | `void Build(Stream output, int blockSize = 4096, string volumeLabel = null)` | Writes the NILFS2 image into `output` from its current position. Only the metadata is assembled in memory; file payloads are copied through, so the volume may be arbitrarily large. |
+| `SetIdentity` | `void SetIdentity(ReadOnlySpan<byte> uuid, uint crcSeed, DateTimeOffset createdAt)` | Fixes the volume's identity and creation time, for a build that has to come out the same twice. |
+| `WriteTo` | `void WriteTo(Stream output)` | Writes the assembled image to a stream. |
+
+### Namespace `FileSystem.Nss`
+
+[`NssBlockMover`](#nssblockmover) · [`NssEntry`](#nssentry) · [`NssFormatDescriptor`](#nssformatdescriptor) · [`NssHeaders`](#nssheaders) · [`NssReader`](#nssreader) · [`NssVolume`](#nssvolume) · [`NssVolume.VolumeFile`](#nssvolumevolumefile) · [`NssWriter`](#nsswriter)
+
+#### `NssBlockMover`
+
+Moves a file's blocks inside an NSS container and rewrites the directory field that said where they were.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NssBlockMover` | `NssBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` |  |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the anchors and the directory. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the one field naming the file it is given. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A file may be held outside the container while the rest of the layout moves, which is what lets a full one be rearranged at all. |
+| `Init` | `void Init(Stream image)` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `NssEntry`
+
+One entry surfaced by the NSS read-only descriptor. We do not parse the object tree itself (the on-disk layout is proprietary and lacks a publicly verifiable spec). We only ever produce synthetic entries describing the pool / volume headers we located.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NssEntry` | `NssEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `LastModified` | `DateTime? LastModified { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `NssFormatDescriptor`
+
+Read-only descriptor for NSS (Novell Storage Services) — the pool-based, object-aware filesystem that replaced NWFS386 from NetWare 5+ onwards and remains the default for Novell / OpenText Open Enterprise Server. **HONEST DISCLAIMER**: NSS's on-disk format was never publicly documented by Novell. This descriptor identifies NSS-shaped images by scanning for Novell's embedded ASCII anchors ("NSS Pool", "NSSVolume", "SuperBlk", "Novell", "NetWare") in the first 1 MB of the partition. We can locate the pool descriptor and volume / superblock anchors and surface their byte offsets, but we **cannot** walk the object tree or reconstruct files — the layout (block allocation, "Beast" object records, trustee ACL trees) is proprietary. Magic: `"NSS Pool"` — 8 ASCII bytes detected within the first 1 MB via free-form scan. Confidence 0.70 — distinctive enough to seed a match but lower than well-specified filesystems because (a) the layout is RE'd, not vendor-published; (b) the magic is a brand string that can theoretically appear in non-NSS contexts; (c) we cannot validate the surrounding structure. References: Novell (OpenText) NSS File System Administration Guide — operational docs only`https://en.wikipedia.org/wiki/Novell_Storage_Services` — pool/volume/object overviewNetWare 6.5 NSS Storage Management Services documentation
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NssFormatDescriptor` | `NssFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Writes a container holding the given files. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves the files that are out of place and rewrites the directory. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `NssHeaders`
+
+Best-effort detector for NSS (Novell Storage Services) — the pool-based, object-aware filesystem that replaced NWFS386 as the default for NetWare 5+ and Open Enterprise Server. Successor to NWFS, predecessor to (still-Novell) NSS-on-Linux in OES. HONEST DISCLAIMER: NSS's on-disk format was never officially documented by Novell. The only public structural information comes from third-party RE notes, Novell support/marketing materials, and utility output (nsscon / nss /poolverify). We can identify NSS-shaped images by scanning for known ASCII signatures Novell embedded in pool / volume / superblock metadata, but we cannot validate the object tree without the proprietary spec. Detected signatures (free-form scan within the first 1 MB): `"NSS Pool"` — appears in the pool descriptor block`"NSSVolume"` — appears in volume descriptors`"SuperBlk"` — appears in NSS object-store superblock copies (typically four mirrored copies)`"Novell"` + `"NetWare"` — corroborating brand strings used as low-weight confirmation; never alone References: Novell (now OpenText) "NSS File System Administration Guide" — operational docs, no on-disk layout`https://en.wikipedia.org/wiki/Novell_Storage_Services` — overview, object/pool modelNetWare 6.5 NSS Storage Management Services docs — pool/volume terminologyRE notes around NSS partition type 0x69 (MBR) on legacy NetWare disks
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NssHeaders` | `NssHeaders()` |  |
+| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Bytes captured for `volume_header.bin` when any anchor is found. |
+| `NetWareMagic` | `static readonly byte[] NetWareMagic` | "NetWare" — corroborating brand string (low weight, never alone). |
+| `NovellMagic` | `static readonly byte[] NovellMagic` | "Novell" — corroborating brand string (low weight, never alone). |
+| `NssPoolMagic` | `static readonly byte[] NssPoolMagic` | "NSS Pool" — 8 ASCII bytes. Pool descriptor identifier. |
+| `NssSuperblockMagic` | `static readonly byte[] NssSuperblockMagic` | "SuperBlk" — 8 ASCII bytes. Mirrored superblock identifier (typically 4 copies). |
+| `NssVolumeMagic` | `static readonly byte[] NssVolumeMagic` | "NSSVolume" — 9 ASCII bytes. Volume descriptor identifier. |
+| `ScanLimit` | `const int ScanLimit` | Scan limit — the first 1 MB of the image. Larger pools may exist but signatures cluster near the start. |
+| `AnyValid` | `bool AnyValid { get; }` | True iff at least one primary NSS signature (Pool/Volume/SuperBlk) was located. |
+| `HeaderRaw` | `byte[] HeaderRaw { get; }` |  |
+| `NetWareFound` | `bool NetWareFound { get; }` |  |
+| `NovellFound` | `bool NovellFound { get; }` |  |
+| `PoolFoundOffset` | `long PoolFoundOffset { get; }` |  |
+| `PoolFound` | `bool PoolFound { get; }` |  |
+| `SuperblockFoundOffset` | `long SuperblockFoundOffset { get; }` |  |
+| `SuperblockFound` | `bool SuperblockFound { get; }` |  |
+| `VolumeFoundOffset` | `long VolumeFoundOffset { get; }` |  |
+| `VolumeFound` | `bool VolumeFound { get; }` |  |
+| `TryParse` | `static NssHeaders TryParse(ReadOnlySpan<byte> image)` | Free-form scan for NSS anchors. Never throws. Bounds itself to the first 1 MB — pool/volume descriptors live near the start of the partition. We hop 512 B at a time (NSS uses 4 KB blocks but the strings can land at any aligned offset, and 512 keeps the work tiny). |
+
+#### `NssReader`
+
+Best-effort NSS image reader. Parses no object tree — only surfaces the anchors NssHeaders located. Because the on-disk layout is proprietary and lacks a verifiable public spec, we never claim to reconstruct files; we expose the located pool/volume/superblock offsets as synthetic entries the user can correlate with the raw image.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NssReader` | `NssReader(Stream stream)` |  |
+| `AnyValid` | `bool AnyValid { get; }` | True iff at least one primary NSS anchor was located. |
+| `Entries` | `IReadOnlyList<NssEntry> Entries { get; }` |  |
+| `HeaderRaw` | `byte[] HeaderRaw { get; }` | Bytes captured at the most useful anchor (pool / superblock / volume), 4 KB. |
+| `Headers` | `NssHeaders Headers { get; }` |  |
+| `ImageLength` | `long ImageLength { get; }` |  |
+| `VolumeName` | `string VolumeName { get; }` |  |
+| `ExtractAnchor` | `byte[] ExtractAnchor(NssEntry entry)` | Returns the 64-byte window at the synthetic entry's anchor offset. |
+
+#### `NssVolume`
+
+Walks a container written by `NssWriter` and says where each file's blocks are.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NssVolume` | `NssVolume(Stream image)` |  |
+| `BlockSize` | `int BlockSize { get; }` |  |
+| `Files` | `IReadOnlyList<VolumeFile> Files { get; }` |  |
+| `ImageLength` | `long ImageLength { get; }` |  |
+| `Status` | `string Status { get; }` |  |
+| `Valid` | `bool Valid { get; }` |  |
+| `BlocksOf` | `long BlocksOf(VolumeFile file)` | How many whole blocks a file occupies. |
+| `Enumerate` | `IEnumerable<DefragBlockInfo> Enumerate()` | The layout a pass plans against. |
+| `Read` | `byte[] Read(VolumeFile file)` | Returns a file's bytes. |
+
+#### `NssVolume.VolumeFile`
+
+A file, and the directory field that says where it is.
+
+Implements `IEquatable<VolumeFile>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `VolumeFile` | `VolumeFile(string Name, long Offset, long Size, long OffsetField)` | A file, and the directory field that says where it is. |
+| `Name` | `string Name { get; init; }` | Its name. |
+| `OffsetField` | `long OffsetField { get; init; }` | Where the directory records its position. |
+| `Offset` | `long Offset { get; init; }` | Where its bytes are. |
+| `Size` | `long Size { get; init; }` | How many of them there are. |
+
+#### `NssWriter`
+
+Writes the NSS container described in `NssLayout`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NssWriter` | `NssWriter()` |  |
+| `VolumeName` | `string VolumeName { get; init; }` | The volume name written next to the volume anchor. |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `Build` | `byte[] Build()` | Lays the container out and returns its bytes. |
+
+### Namespace `FileSystem.Ntfs`
+
+[`Lznt1`](#lznt1) · [`NtfsBlockMover`](#ntfsblockmover) · [`NtfsEntry`](#ntfsentry) · [`NtfsExtentMap`](#ntfsextentmap) · [`NtfsFilesystemDriverAdapter`](#ntfsfilesystemdriveradapter) · [`NtfsFormatDescriptor`](#ntfsformatdescriptor) · [`NtfsInPlaceAdder`](#ntfsinplaceadder) · [`NtfsInPlaceShrinker`](#ntfsinplaceshrinker) · [`NtfsInPlaceShrinker.ShrinkResult`](#ntfsinplaceshrinkershrinkresult) · [`NtfsReader`](#ntfsreader) · [`NtfsRemover`](#ntfsremover) · [`NtfsWriter`](#ntfswriter)
+
+#### `Lznt1`
+
+LZNT1 compression used by NTFS for compressed files. Operates on 4KB compression units. Each unit is independently compressed.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Compress` | `static byte[] Compress(ReadOnlySpan<byte> input)` | Compresses data using LZNT1. |
+| `Decompress` | `static byte[] Decompress(ReadOnlySpan<byte> input, int uncompressedSize)` | Decompresses LZNT1-compressed data. |
+
+#### `NtfsBlockMover`
+
+In-place NTFS block mover. Moves cluster-aligned extents within an NTFS image and patches the MFT data runs, Update Sequence Array fixup, and cluster bitmap ($Bitmap, MFT record 6) so the file remains reachable at its new location. Handles the common case where a file's data runs cover the moved cluster range. If re-encoding the patched data runs changes byte length and the MFT record lacks sufficient slack space, throws `NotSupportedException` to let the rebuild fallback handle it. Streaming: the mover never loads the whole image. `Init` reads only the boot sector and MFT record 0; all metadata updates are targeted reads/writes via `SectorCache` + `Flush` barriers so a crash mid-operation leaves the image fsck-recoverable, and a multi-TB NTFS volume needs only ~256 MB of cache RAM regardless of size.
+
+Implements `IFilesystemBlockMover`, `IFilesystemMetadataMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NtfsBlockMover` | `NtfsBlockMover()` |  |
+| `ClusterSize` | `int ClusterSize { get; }` | Bytes per cluster. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | Byte offset past all known metadata regions. For NTFS, the boot sector, MFT, and system file data are all marked MetadataReserved by the extent map. User data can safely be placed at or after this offset. Computed from the MFT location + its extent size as a conservative lower bound. The actual usable origin should be derived from the extent map (see `DefragmentWithPlanner`). |
+| `RelocatableMetadata` | `IReadOnlySet<string> RelocatableMetadata { get; }` |  |
+| `VolumeEndByte` | `long VolumeEndByte { get; }` | The last byte a file may occupy: the end of the volume, not the end of the file holding it. |
+| `Init` | `void Init(Stream image)` | Stream-based initialisation. Reads only the 512-byte boot sector and the first MFT record (typically 1 KB) — used by the streaming code paths so multi-TB images don't have to be loaded into memory. |
+| `Init` | `void Init(byte[] image)` | Initialises the mover by parsing the NTFS boot sector fields. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `UpdateMetadataAfterMove` | `void UpdateMetadataAfterMove(Stream image, string metadataName, long oldOffset, long newOffset, long length, IReadOnlyList<ValueTuple<long, long>> liveRanges = null)` | Moves one of the volume's own structures. Each system file's clusters are described by the data runs in its MFT record, so repointing it is the same edit a file gets — except for the two the boot sector names directly, and for the two that describe themselves. |
+
+#### `NtfsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NtfsEntry` | `NtfsEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `IsSymlink` | `bool IsSymlink { get; init; }` |  |
+| `LastModified` | `DateTime? LastModified { get; init; }` |  |
+| `LinkTarget` | `string LinkTarget { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `NtfsExtentMap`
+
+Walks an NTFS image and yields its actual on-disk byte layout — the boot sector, the $MFT itself (record 0's $DATA runs), the 16 reserved system files (records 0-15), and every regular file's $DATA attribute data runs. Each non-resident $DATA's run-list is decoded; resident $DATA bytes surface as a single MetadataReserved tile inside the MFT record. The 16 reserved system records (e.g. $MFTMirr, $LogFile, $Bitmap, $Boot, $UpCase) are flagged as MetadataReserved. Streaming: reads only the boot sector + MFT records on demand via a `SectorCache`. A 50 TB NTFS image with a large $MFT keeps memory bounded to ~256 MB regardless of image size.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Single-pass walker. Reads the boot sector, locates $MFT, parses each MFT record's $DATA attribute, then yields one extent per data run. Adjacent runs (LCN N..M and LCN M+1..) are coalesced. |
+
+#### `NtfsFilesystemDriverAdapter`
+
+Native NTFS driver sidecar. Namespace identity is based on the MFT record number rather than path text, so rename/unlink can later preserve open-handle identity. The reader already decodes resident/non-resident $DATA, sparse runs, LZNT1, reparse symlinks and INDEX_ALLOCATION directories. Mounted writes remain fail-closed until $LogFile transactions/replay and the full file-reference (MFT record + sequence number) are part of the mutable core.
+
+Implements `IBlockDeviceFilesystemDriverProvider`, `IFilesystemDriverAdapter`, `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NtfsFilesystemDriverAdapter` | `NtfsFilesystemDriverAdapter()` |  |
+| `FormatId` | `string FormatId { get; }` |  |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
+#### `NtfsFormatDescriptor`
+
+Descriptor for Microsoft NTFS volume images ("NTFS " boot-sector OEM magic; $MFT-based metadata) with create, in-place modify and defragment support. References: `https://flatcap.github.io/linux-ntfs/ntfs/` — Linux-NTFS project on-disk structure documentation — the de-facto public NTFS spec`https://github.com/tuxera/ntfs-3g` — maintained open-source implementation`https://learn.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview` — Microsoft's NTFS overview`https://en.wikipedia.org/wiki/NTFS` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NtfsFormatDescriptor` | `NtfsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` | NTFS filesystem image with LZNT1 compression support. The writer emits every reserved system MFT record (0-15) with real content: $MFT, $MFTMirr, $LogFile, $Volume (with a version-3.1 $VOLUME_INFORMATION and a $VOLUME_NAME), $AttrDef, root ., $Bitmap, $Boot, $BadClus, $Secure, $UpCase (128 KiB UTF-16 table), and $Extend. Every record carries $STANDARD_INFORMATION and $FILE_NAME, the Update Sequence Array (USA) fixup is applied at sector boundaries, and the on-disk cluster bitmap reflects actual allocations. |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | NTFS creation knobs surfaced by the Convert Archive dialog / CLI: image size (Auto + fixed presets), volume label (capped at 32 chars to match $VOLUME_NAME), cluster size, MFT record size and the 8.3 short-name toggle. Cluster + MFT record size cooperate via `BuildAutoSized` when both are on Auto. The MFT reserve % knob (stash) is not honoured by the upstream writer yet — see Build()'s constant MFT zone — so it's not published here. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation: pre-known per-input sizes drive MFT-record + cluster geometry in pass 1; pass 2 emits all reserved system MFT records + per-user MFT records (with single-run non-resident $DATA for large files), then streams each non-resident entry's bytes from its `OpenStream` factory into its allocated cluster run via 64 KB chunks. Cluster tail past each entry's exact `Size` stays sparse-zero. Resident files (≤ 700 bytes) buffer their bounded source bytes inline in the MFT record — the bound itself caps anything past `Size`. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware NTFS defragmentor. Supports planner-driven in-place path (using `DefragPlanner` + `NtfsBlockMover`) and the legacy rebuild path (using `DefragRebuilder`). Falls back to rebuild when the planner path throws (e.g. data-run re-encoding changes byte length with no slack space). |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the boot sector + $MFT + each MFT record's $DATA attribute and yields one extent per data run. Records 0-15 (the reserved system files: $MFT, $MFTMirr, $LogFile, $Volume, $AttrDef, root, $Bitmap, $Boot, $BadClus, $Secure, $UpCase, $Extend) surface as MetadataReserved; regular files surface as Used. Adjacent runs are coalesced. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes files from an existing NTFS image with full secure wipe (cluster bytes for non-resident data, MFT record, and root-dir index entry). No forensic recovery of the removed content is possible from the resulting bytes. |
+| `Shrink` | `void Shrink(Stream input, Stream output)` | Genuine in-place NTFS shrink: relocates only the clusters above the auto-fit boundary into free space below it via `NtfsInPlaceShrinker`, trims $Bitmap/$Boot, and emits the smaller image. Falls back to the `IArchiveShrinkable` default (verified rebuild / copy-through) when the in-place path cannot handle the image (e.g. a compressed stream would need relocation). |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `NtfsInPlaceAdder`
+
+Genuine in-place add for NTFS images — the inverse of `NtfsRemover`. Inserts a small file into the root directory by editing only the structures the change touches: it claims a free MFT record slot (from the MFT's cluster-rounding slack), writes a spec-shaped FILE record (header + USA fixup + $STANDARD_INFORMATION + $FILE_NAME + resident or non-resident $DATA), sets the record's bit in `$MFT:$BITMAP`, allocates any data clusters from `$Bitmap`, and inserts a collation-sorted index entry into the root directory's resident `$INDEX_ROOT`. Existing files, their MFT records and their data clusters stay byte-identical at their original offsets — no whole-image re-pack. The in-place path also handles the structural growth cases: it grows the MFT (allocating a cluster, extending `$MFT:$DATA`'s run list — the reader follows the VCN→LCN mapping — widening `$MFT:$BITMAP` and re-syncing `$MFTMirr`) when no record slot is free; it spills a directory index that outgrows the resident `$INDEX_ROOT` into a pointer-form root + non-resident `$INDEX_ALLOCATION` (a single INDX leaf, USA-fixed) + `$BITMAP`, growing the INDX block size as the directory grows; and it creates intermediate sub-directory FILE records for nested targets (`a/b/c.txt`), linking them through their parents' `$I30` indexes. It still throws (so the caller can rebuild) when an allocation cannot be satisfied — no free data clusters, no contiguous index-allocation run, or a record/attribute that will not fit.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(byte[] image, string name, byte[] data)` | Adds (or replaces by name) `name` into the root directory of the in-memory NTFS image. Throws `NotSupportedException` / `IOException` for the structural cases above so the caller can rebuild instead. |
+| `MftRecordByteOffset` | `static long MftRecordByteOffset(byte[] image, int slot)` | Public façade over the run-list-aware MFT record mapping for callers that scan the MFT (e.g. `NtfsRemover`). Returns the physical byte offset of record `slot`, following $MFT:$DATA's VCN→LCN run list so a grown, non-contiguous MFT (common on real mkfs.ntfs images after several adds) is read correctly. Returns -1 when the slot is past the MFT's mapped clusters. |
+| `MftRecordSlotCount` | `static int MftRecordSlotCount(byte[] image)` | Number of record slots the MFT's $DATA currently spans (allocated bytes / record size). Lets a scanner bound its loop to the MFT's real extent rather than the whole image. |
+| `RemoveIndexEntry` | `static bool RemoveIndexEntry(byte[] image, uint dirRecord, uint recordNum)` | Removes the index entry referencing `recordNum` from `dirRecord`'s $I30 directory index, then rewrites the index in the smallest representation that fits (resident $INDEX_ROOT, or — if it still does not fit — a single spilled INDX leaf). The whole directory record is rebuilt and re-USA-fixed, so it stays consistent for real mkfs.ntfs / Windows directories whose records use a different update-sequence-array layout than our writer. This is the structural inverse of `InsertIndexEntry` and is invoked by `NtfsRemover`. Returns `true` if an entry was removed. |
+
+#### `NtfsInPlaceShrinker`
+
+Genuine in-place NTFS volume shrink. Reduces the volume to a smaller cluster count by relocating only the clusters that sit at or above the new boundary into free clusters below it, patching the owning attribute's data runs and the $Bitmap, then trimming the image. Work is `O(clusters relocated + metadata touched)` — clusters that already live below the boundary are never read or rewritten, so the bytes below the boundary stay byte-identical. AlgorithmParse the boot sector. The image spans `(NumberSectors+1)/spc` total volume clusters; the final cluster is reserved for the backup boot sector (its last sector is the one `NumberSectors` excludes), so file data lives in clusters `0..volumeClusters-2`.Pick a target volume-cluster count. The data boundary is `target-1` (the new last cluster stays reserved). Refuse (throw `NotSupportedException`) if the in-use clusters cannot fit below the boundary, or if a cluster at or above it belongs to a compressed/sparse $DATA stream this shrinker cannot relocate.Walk every MFT record's non-resident $DATA / $INDEX_ALLOCATION runs. For every run that crosses the boundary, claim a contiguous free region below it (falling back to per-cluster), copy the cluster bytes, rewrite the run list to the new LCNs, and flip the old/new $Bitmap bits. The attribute is grown in place (shifting the record tail) when the relocated run list needs more bytes. $MFT, $MFTMirr, $LogFile, $Bitmap and the directory indices are handled by the same record walk (records 0..15 included).Reshape $Bitmap to the new size (reserve the new backup cluster, pad the final bitmap byte), rewrite $Boot's `NumberSectors`, copy the boot sector to the new last sector (the relocated backup boot), re-sync $MFTMirr, and truncate the image to `target * clusterSize`.Supported shrink shapes (in place, no re-pack): any target where the highest in-use cluster can be relocated into free space below the boundary and every relocated attribute is a plain (uncompressed, non-sparse) non-resident stream. Refused (`NotSupportedException`): a target below the in-use cluster count, or one that would require relocating a compressed/sparse stream (those keep their on-disk LCNs and are left to the rebuild fallback).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ShrinkToClusters` | `static ShrinkResult ShrinkToClusters(byte[] image, long targetClusters)` | Shrinks an NTFS image in place to exactly `targetClusters` clusters, relocating any allocation at or above the boundary into free space below it. |
+| `ShrinkToFit` | `static ShrinkResult ShrinkToFit(byte[] image)` | Shrinks an NTFS image in place to the smallest cluster count that still holds the current allocation (auto-fit). Equivalent to `ShrinkToClusters` with the tightest legal target. |
+
+#### `NtfsInPlaceShrinker.ShrinkResult`
+
+Result of a shrink attempt: the before/after byte sizes and how many bytes were physically rewritten.
+
+Implements `IEquatable<ShrinkResult>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ShrinkResult` | `ShrinkResult(long OriginalSize, long NewSize, long BytesRelocated, long ClustersRelocated)` | Result of a shrink attempt: the before/after byte sizes and how many bytes were physically rewritten. |
+| `BytesRelocated` | `long BytesRelocated { get; init; }` |  |
+| `ClustersRelocated` | `long ClustersRelocated { get; init; }` |  |
+| `NewSize` | `long NewSize { get; init; }` |  |
+| `OriginalSize` | `long OriginalSize { get; init; }` |  |
+| `WasReduced` | `bool WasReduced { get; }` | True when the image was actually made smaller. |
+
+#### `NtfsReader`
+
+Reads NTFS filesystem images. Parses boot sector, MFT records, attributes ($FILE_NAME, $DATA), and supports both resident and non-resident data extraction with data run decoding.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NtfsReader` | `NtfsReader(Stream stream, bool leaveOpen = false)` |  |
+| `Entries` | `IReadOnlyList<NtfsEntry> Entries { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(NtfsEntry entry)` | Extracts a file's data from the NTFS image. |
+
+#### `NtfsRemover`
+
+Secure-remove implementation for NTFS images. Finds the named file in the MFT (records 16+), zeros every cluster referenced by its $DATA attribute (including resident-value bytes for small files), clears the corresponding index entry in the root directory's $INDEX_ROOT, and zeros the entire 1024-byte MFT record. After the operation no bytes of the original filename or content remain recoverable from the image. Root-directory-only for now; nested-directory removal is a follow-up. The reader skips records whose "FILE" signature is missing, so zeroing the whole record is sufficient to hide the file from enumeration and extraction.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Remove` | `static void Remove(byte[] image, string fileName)` | Removes `fileName` from the in-memory NTFS image. Throws `FileNotFoundException` if no MFT record matches. The image is modified in place. |
+
+#### `NtfsWriter`
+
+Builds spec-compliant NTFS filesystem images. All reserved system MFT records (0-15) are populated with real content: $MFT, $MFTMirr, $LogFile, $Volume, $AttrDef, root $., $Bitmap, $Boot, $BadClus, $Secure, $UpCase, and $Extend. Every record carries the mandatory $STANDARD_INFORMATION and $FILE_NAME attributes, the Update Sequence Array (USA) fixup is applied at sector boundaries, and the on-disk cluster bitmap reflects which clusters are actually allocated. Small files (<700 bytes) use a resident $DATA attribute; larger files use non-resident cluster runs. Images produced by this writer carry all the structure that chkdsk and the Linux ntfs-3g driver check at mount time: volume serial, valid boot signature, every system file has its "FILE" magic, USA fixup at `record[510..512]` and `record[1022..1024]`, $Volume carries a valid $VOLUME_INFORMATION (version 3.1), the $UpCase data stream is 128 KiB long (65 536 UTF-16 upper-case mappings) and $Bitmap only marks clusters that hold actual filesystem metadata/data. Large directories: when a directory's $I30 file-name index no longer fits in the resident $INDEX_ROOT inside its MFT record, it spills into a non-resident $INDEX_ALLOCATION (a stream of "INDX" index records, each with its own USA fixup) tracked by a named $BITMAP. The $INDEX_ROOT then holds routing pointer entries (subnode VCN flag 0x01 + 8-byte child VCN at the entry tail) into those INDX leaves, and the FILE_NAME entries live in the leaves sorted by NTFS file-name collation. A single B+tree level is built: the resident root points directly at leaf blocks. To keep all routing pointers resident, the INDX block size is grown (power-of-two, 4 KiB..64 KiB) as the entry count rises. With the default 1024-byte MFT record this handles tens of thousands of short-named entries per directory; only a directory whose routing pointers would overflow even a 64 KiB block (hundreds of thousands of entries) would need a second tree level, which is not yet implemented. 8.3 short names: by default every $FILE_NAME is recorded in the Win32&DOS namespace (3) so the long name also serves as the 8.3 short name, the way a freshly formatted Windows volume does. Passing `generateShortNames: false` records names in the Win32-only namespace (1) and emits no DOS short name — the equivalent of `fsutil behavior set disable8dot3`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NtfsWriter` | `NtfsWriter(string volumeLabel = "", bool generateShortNames = true)` | Creates a new NTFS writer. The volume label is stored in $Volume's $VOLUME_NAME attribute. |
+| `DeclaredVolumeBytes` | `long DeclaredVolumeBytes { get; }` | Declared volume size in bytes of the most recent build. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the NTFS image. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file: `size` drives MFT-record + cluster sizing in pass 1; bytes are pulled from `openStream` in pass 2 of `BuildToStreaming`. Files larger than the resident threshold (~700 bytes) get a single-run non-resident $DATA whose clusters are filled from the source via 64 KB chunks; smaller files remain resident and are buffered up-front (the size-clamped bounded read still satisfies the isolation contract). |
+| `BuildAutoSized` | `byte[] BuildAutoSized(int requestedClusterSize = 0, int requestedMftRecordSize = 0)` | Builds the image with the cluster size and MFT record size chosen by `FilesystemLayoutOptimizer` to minimise file slack + MFT-zone reservation + per-file MFT-record waste, and the volume sized to exactly hold the files plus structural overhead. |
+| `BuildToStreamingAutoSized` | `void BuildToStreamingAutoSized(Stream output)` | Two-pass streaming Build with auto-sized geometry. |
+| `BuildToStreaming` | `void BuildToStreaming(Stream output, long totalSize)` | Two-pass streaming Build: pass 1 derives MFT-record + cluster geometry from the declared sizes of `AddStreamingFile` entries; pass 2 emits all reserved system MFT records (0..15) + the per-user MFT records (with $DATA attributes pointing at single-run non-resident allocations for files > ResidentThreshold), then streams each non-resident entry's bytes from its factory into its allocated cluster run via 64 KB chunks. Cluster tail past each entry's exact `Size` stays sparse-zero (the in-memory disk byte[] was zero-initialised and the per-entry stream copy never reads past the entry's logical size). |
+| `BuildToStreaming` | `void BuildToStreaming(Stream output, long totalSize, int clusterSizeBytes, int mftRecordSize)` |  |
+| `BuildTo` | `void BuildTo(Stream output, long totalSize, int clusterSize = 4096, int mftRecordSize = 1024)` | Writes the volume to `output`: the populated prefix, then the declared length, then the two regions that live past the prefix. Free space costs nothing, so volumes far beyond the in-memory limit are producible. |
+| `Build` | `byte[] Build(int totalSize = 4194304)` | Builds the NTFS filesystem image with the default geometry (4 MiB volume, 4 KiB clusters, 1024-byte MFT records). Kept as a parameterless-default overload so existing callers/tests remain byte-compatible. |
+| `Build` | `byte[] Build(int totalSize, int clusterSize, int mftRecordSize)` | Builds the NTFS filesystem image with a tunable cluster size and MFT record size. |
+| `PlanAutoSize` | `ValueTuple<long, int, int> PlanAutoSize(int requestedClusterSize = 0, int requestedMftRecordSize = 0)` | Volume size, cluster size and MFT-record size an auto-sized build would use for the files added. The size is a long: clamping it to int for `Build` is exactly what capped an auto-sized volume at 2 GB, and the streaming path needs no such clamp. |
+| `SetCompression` | `void SetCompression(bool enabled)` | Enables or disables NTFS LZNT1 compression of file `$DATA` for this build. When enabled every non-resident file is stored as a compressed attribute (16-cluster compression units, the `0x0001` compressed flag, sparse runs for saved clusters). Resident files (≤ ~700 bytes) are left uncompressed, mirroring real NTFS which never compresses resident data. Default is off; call before any `Build` overload. |
+| `SetNtfsMinorVersion` | `void SetNtfsMinorVersion(byte minorVersion)` | Sets the NTFS minor version stamped into `$VOLUME_INFORMATION` (the major version is always 3). Accepts 0 (NTFS 3.0, Windows 2000) or 1 (NTFS 3.1, Windows XP and later — the default). |
+| `SetVolumeSerial` | `void SetVolumeSerial(long serial)` | Fixes the volume serial, for a build that has to come out the same twice. |
+
+### Namespace `FileSystem.Nwfs`
+
+[`NwfsFormatDescriptor`](#nwfsformatdescriptor) · [`NwfsHeaders`](#nwfsheaders) · [`NwfsReader`](#nwfsreader) · [`NwfsReader.Item`](#nwfsreaderitem) · [`NwfsWriter`](#nwfswriter)
+
+#### `NwfsFormatDescriptor`
+
+Read-only descriptor for NWFS386 (Novell NetWare 386 / "Traditional NetWare File System") — used in NetWare 2.x/3.x/4.x and as the SYS: filesystem in 5.x/6.x. NSS (Novell Storage Services) replaced it for new volumes from 1998 but NWFS images still surface in archaeology / migration workflows. **PROVENANCE**: Novell never released the on-disk format. What is read and written here follows the public reverse-engineering of it (notably the zhmu/nwfs project, whose documentation and reader were both checked against). Volumes written by `NwfsWriter` are read back by that project's own `transfer` tool — directory tree, sizes and file bytes all agreeing — so contents are no longer merely detected. Still out of scope: suballocation, Turbo FAT, compression, mirrored partitions, volumes spanning several partitions, and the salvage area. A volume using any of those reads only as far as its plain structures go. Magic: `HOTFIX00` — 8 ASCII bytes at byte offset `0x4000` (16384, = sector 32 at 512 B sectors). Confidence 0.85: 8 bytes of ASCII at a fixed offset is high-signal, but because the layout is RE-derived we keep a small margin below the 0.9-0.95 used for spec-stable filesystems. "MIRROR00" and "NetWare Volumes" are detected as corroboration but not used for primary signature matching. References: `https://github.com/zhmu/nwfs` — primary reverse-engineering project, incl. `doc/nwfs386.md``https://github.com/jeffmerkey/netware-file-system` — secondary reference
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NwfsFormatDescriptor` | `NwfsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `NwfsHeaders`
+
+Best-effort detector for the Novell NetWare 386 (NWFS386) filesystem — a.k.a. the Traditional NetWare File System. NWFS was the *only* filesystem in NetWare 2.x/3.x/4.x and the default for the SYS: volume in NetWare 5/6. Its on-disk format was never publicly documented by Novell; everything we know comes from reverse-engineering. Read-only — we cannot validate contents without an authoritative spec. Detected signatures (per the zhmu/nwfs reverse-engineering project): `"HOTFIX00"` — 8 ASCII bytes at byte offset `0x4000` (16384) within the partition (sector 32 with 512 B sectors). Marks the start of the Hot Fix area.`"MIRROR00"` — 8 ASCII bytes adjacent to HOTFIX. Marks the Mirror header.`"NetWare Volumes"` — 16 ASCII bytes (NUL-padded) in the volume area following the redirection sectors. Marks the Volume area. References: `https://github.com/zhmu/nwfs` — primary RE source for NWFS286/NWFS386`https://github.com/jeffmerkey/netware-file-system` — secondary reference (former Novell engineers' release)NWFS386 partitions: HOTFIX_OFFSET = 0x4000, sector 32 (assumes 512 B sectors)
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NwfsHeaders` | `NwfsHeaders()` |  |
+| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Bytes captured for `volume_header.bin` — first 4 KB containing HOTFIX/MIRROR. |
+| `HotfixMagic` | `static readonly byte[] HotfixMagic` | HOTFIX header signature — 8 ASCII bytes at offset 0x4000 within the partition. |
+| `HotfixOffset` | `const long HotfixOffset` | HOTFIX_OFFSET — Hot Fix area lives at this byte offset from the start of the partition. |
+| `HotfixSector` | `const int HotfixSector` | Sector 32 with 512 B sectors equals HotfixOffset. |
+| `MirrorMagic` | `static readonly byte[] MirrorMagic` | MIRROR header signature — 8 ASCII bytes at the Mirror sector. |
+| `VolumeAreaSize` | `const int VolumeAreaSize` | Volume area span (4 mirrored copies of 16 KB). |
+| `VolumesMagic` | `static readonly byte[] VolumesMagic` | Volume area signature — 16 ASCII bytes (NUL-padded) at the start of the Volume area. |
+| `AnyValid` | `bool AnyValid { get; }` | True iff at least one of the three RE'd signatures was located. |
+| `HeaderRaw` | `byte[] HeaderRaw { get; }` | Raw 4 KB capture starting at HotfixOffset (when present), else empty. |
+| `HotfixFoundOffset` | `long HotfixFoundOffset { get; }` | Byte offset where HOTFIX was located (or -1). |
+| `HotfixFound` | `bool HotfixFound { get; }` | True iff the HOTFIX00 signature was found at `HotfixOffset`. |
+| `MirrorFoundOffset` | `long MirrorFoundOffset { get; }` | Byte offset where MIRROR was located (or -1). |
+| `MirrorFound` | `bool MirrorFound { get; }` | True iff the MIRROR00 signature was found anywhere in the first 64 KB. |
+| `VolumesFoundOffset` | `long VolumesFoundOffset { get; }` | Byte offset where "NetWare Volumes" was located (or -1). |
+| `VolumesFound` | `bool VolumesFound { get; }` | True iff the "NetWare Volumes" signature was found anywhere in the first 64 KB. |
+| `TryParse` | `static NwfsHeaders TryParse(ReadOnlySpan<byte> image)` | Best-effort scan. Looks for HOTFIX00 at offset 0x4000 first (canonical), then scans the first 64 KB for MIRROR00 and "NetWare Volumes". Never throws. |
+
+#### `NwfsReader`
+
+Reads a NetWare 386 volume: finds the partition, walks the directory chain, and follows a file through the FAT to its bytes.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `BlockSize` | `int BlockSize { get; }` | Bytes to a block on this volume. |
+| `VolumeName` | `string VolumeName { get; }` | What the volume calls itself. |
+| `List` | `List<Item> List()` | Everything on the volume, each with the path it is reached by. |
+| `ReadFile` | `byte[] ReadFile(string path)` | The bytes of the file at `path`, or null if there is none. |
+| `Read` | `byte[] Read(Item item)` | The bytes of `item`, followed through the FAT. |
+| `TryOpen` | `static NwfsReader TryOpen(byte[] image)` | Opens the first NetWare volume in `image`, or null if there is none. |
+
+#### `NwfsReader.Item`
+
+One thing on the volume: a file or a directory.
+
+Implements `IEquatable<Item>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Item` | `Item(string Path, bool IsDirectory, long Length, uint FirstBlock)` | One thing on the volume: a file or a directory. |
+| `FirstBlock` | `uint FirstBlock { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Length` | `long Length { get; init; }` |  |
+| `Path` | `string Path { get; init; }` |  |
+
+#### `NwfsWriter`
+
+Writes a NetWare 386 disk image: a partition table naming one NetWare partition, the hotfix, mirror and volume headers that open it, and a volume whose files a NetWare reader walks by the same route a real one does.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `NwfsWriter` | `NwfsWriter()` |  |
+| `BlockSize` | `int BlockSize { get; set; }` | Bytes to a block. A NetWare volume may use 1 KB to 256 KB, by powers of two. |
+| `PartitionStartSector` | `uint PartitionStartSector { get; set; }` | Where the NetWare partition begins, in sectors. |
+| `RedirectionSectors` | `uint RedirectionSectors { get; set; }` | Sectors between the hotfix header and the volume area. |
+| `Timestamp` | `DateTime Timestamp { get; set; }` | When the volume and everything on it is dated. |
+| `VolumeName` | `string VolumeName { get; set; }` | What the volume is called. NetWare's own first volume is SYS. |
+| `AddFile` | `void AddFile(string path, byte[] data)` | Adds a file. Directories in `path` are made as needed. |
+| `Build` | `byte[] Build()` | Builds the image. |
+
+### Namespace `FileSystem.Nwfs386`
+
+[`Nwfs386FormatDescriptor`](#nwfs386formatdescriptor)
+
+#### `Nwfs386FormatDescriptor`
+
+Read-only descriptor for Novell NetWare 386 (NWFS386) raw partition dumps, detected via the "NetW" ASCII prefix at offset 0. DOS partition type `0x65`. The on-disk format is FAT-like but proprietary; no parser is attempted — the image is surfaced as a single opaque entry with metadata.ini noting the partition-type hint. References: `https://www.win.tue.nl/~aeb/partitions/partition_types-1.html` — partition-type catalogue (0x65 = Novell NetWare)`https://en.wikipedia.org/wiki/NetWare_File_System` — Wikipedia articleNovell NetWare 386 internal documentation — the on-disk format was never published
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Nwfs386FormatDescriptor` | `Nwfs386FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+### Namespace `FileSystem.Ocfs2`
+
+[`Ocfs2BlockMover`](#ocfs2blockmover) · [`Ocfs2FormatDescriptor`](#ocfs2formatdescriptor) · [`Ocfs2InPlaceModifier`](#ocfs2inplacemodifier) · [`Ocfs2Superblock`](#ocfs2superblock)
+
+#### `Ocfs2BlockMover`
+
+Moves a file's clusters inside an OCFS2 volume, repoints the extent record in its dinode, and moves the allocation with it.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Ocfs2BlockMover` | `Ocfs2BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | The volume's block, which is also its cluster at these geometries. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the system inodes and their groups. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and notes where every file's data starts. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Ocfs2FormatDescriptor`
+
+R/W descriptor for OCFS2 (Oracle Cluster Filesystem 2). Supports: list, extract, create, true in-place modify (Add/Replace/Remove via `Ocfs2InPlaceModifier`), defragment, extent map. Reading is spec-correct against `fs/ocfs2/ocfs2_fs.h` (see `Ocfs2Reader`): INODE01 dinode signatures, the real `ocfs2_dinode` field offsets, the 8-byte `ocfs2_inline_data` header, and the 16-byte extent-list header. It reads images produced by the reference `mkfs.ocfs2` as well as the toolkit's own writer (verified by an external conformance test that reads a real `mkfs.ocfs2 -M local` volume).Writing produces a single-node (no DLM) image with 4 KB blocks/clusters, inline directory entries, and extent-based file data. The superblock and dinode layout are spec-correct — the reference `debugfs.ocfs2 stats` reads the written superblock at exit 0. The writer does NOT yet emit the full chain-allocator / journal / slot-map / local-alloc system-file suite a mountable volume needs, so `fsck.ocfs2` does not pass on a written image. Create/modify are therefore scoped to structurally-correct construction with self/round-trip readback, not fsck-clean conformance.Modifier scope: root-directory mutations only (subdirectory and extent-backed root directory paths fall back to the rebuild path). DLM/heartbeat lockdown and multi-node cluster semantics are out of scope by design. References: `https://github.com/torvalds/linux/blob/master/fs/ocfs2/ocfs2_fs.h` — canonical on-disk header`https://www.kernel.org/doc/html/latest/filesystems/ocfs2.html` — kernel documentation`https://en.wikipedia.org/wiki/OCFS2` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Ocfs2FormatDescriptor` | `Ocfs2FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The one tunable the writer honours: the volume label written into `s_label` (64-byte superblock field) via `SetLabel` and read back as `Ocfs2Superblock.Label`. The 4 KB block/cluster size is fixed by the single-node MVP layout, so it is not exposed. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files in the root directory of an existing OCFS2 image using `Ocfs2InPlaceModifier`. Touches only the global bitmap data block, the root dir dinode, the new file dinode block, and the new data blocks — no whole-image rewrite. Subdirectory paths and extent-backed root directories fall back to the rebuild path so callers keep working when the writer's MVP scope is exceeded. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes files from the root directory of an existing OCFS2 image using `Ocfs2InPlaceModifier`. Frees the dinode block + data clusters via global bitmap bit flips and zero-wipes them so no forensic trace remains. Names that aren't in the root directory fall back to the rebuild path (which can reach subdirectories). |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the OCFS2 image: unallocated clusters and the cluster-tip slack between a file's logical size and the end of its last 4 KB cluster. The extent map already clamps each Used data extent to the file's logical length, so the cluster tip surfaces as a free gap and is zeroed by the generic wiper without a size lookup. Small directories are stored inline inside their dinode (no data cluster), so they have no tip. |
+
+#### `Ocfs2InPlaceModifier`
+
+True in-place R/W modifier for OCFS2 (Oracle Cluster Filesystem 2) images produced by `Ocfs2Writer`. Performs O(touched bytes) random-access I/O against the image: only the global bitmap data block, the root directory dinode (inline dirents), the affected file dinode block, and the file's data blocks are read or written. No whole-image read or rewrite. Layout (matches `Ocfs2Writer`'s single-node geometry): 4 KB blocks = 4 KB clusters; one dinode per block.Superblock dinode at block 2; global bitmap dinode at block 3; bitmap data at block 4 (1 bit per cluster, LSB-first, bit=1 means used).Root directory dinode at block 5 (INODE01) with inline dirents in id2 after the 8-byte ocfs2_inline_data header (id2 + 8), each entry `inode(8) | rec_len(2) | name_len(1) | file_type(1) | name[]`.User files start at block 8: each gets one dinode block, plus contiguous data clusters whose run is held in a single extent record.Scope (MVP, single-node only): root-directory mutations only. Sub-directory mutation, DLM/heartbeat lockdown, multi-node cluster semantics, and root-directory B-tree splits (extent-backed root) are out of scope and throw `NotSupportedException` if encountered.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file to the OCFS2 image's root directory. Performs random-access I/O only: bitmap data block, root dinode, new file dinode block, and the new data blocks are written. Throws `IOException` if an entry with the same name already exists (use `ReplaceFile` or call `RemoveFile` first). |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a regular file from the OCFS2 image's root directory. Frees its dinode block + data clusters via the global bitmap, zeros their contents, and splices the dirent out of the root directory's inline area. Returns false if the named entry does not exist in the root directory. |
+| `ReplaceFile` | `static bool ReplaceFile(Stream image, string name, byte[] newData)` | Replaces a file's contents in place when the new data fits inside the originally allocated cluster run. Returns false if the named file doesn't exist; throws if the new size requires more clusters than were originally allocated (callers should fall back to `RemoveFile` + `AddFile`). |
+
+#### `Ocfs2Superblock`
+
+Parses the OCFS2 (Oracle Cluster Filesystem 2) superblock. The superblock is stored as the `id2.i_super` sub-structure of an `ocfs2_dinode` at `OCFS2_SUPER_BLOCK_BLKNO = 2`. With a 4 KB block size (the mkfs.ocfs2 default and far the most common), that block starts at byte offset `0x2000` (8192). The dinode's `i_signature[8]` at offset 0 holds the ASCII string `OCFSV2` (NUL-padded to 8). The superblock fields begin at `id2 = +0xC0` within the dinode block. Read-only. Layout per `fs/ocfs2/ocfs2_fs.h`: Verified by: `https://github.com/torvalds/linux/blob/master/fs/ocfs2/ocfs2_fs.h`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Ocfs2Superblock` | `Ocfs2Superblock()` |  |
+| `DefaultBlockSize` | `const int DefaultBlockSize` | Default mkfs.ocfs2 block size (and far the most common — many tools assume this). |
+| `DefaultSuperBlockOffset` | `const long DefaultSuperBlockOffset` | Byte offset of the superblock dinode when blocksize = 4 KB (the default). |
+| `HeaderCaptureSize` | `const int HeaderCaptureSize` | Bytes we surface as `superblock.bin` — one full 4 KB dinode block. |
+| `SignatureBytes` | `static readonly byte[] SignatureBytes` | OCFS2_SUPER_BLOCK_SIGNATURE — 6 ASCII bytes at dinode offset 0. |
+| `SuperBlockBlkno` | `const int SuperBlockBlkno` | OCFS2_SUPER_BLOCK_BLKNO — superblock lives at this *block* index, not byte. |
+| `SuperOffsetInDinode` | `const int SuperOffsetInDinode` | Offset of `id2.i_super` within the dinode. |
+| `BlocksizeBits` | `uint BlocksizeBits { get; }` |  |
+| `ClustersizeBits` | `uint ClustersizeBits { get; }` |  |
+| `DetectedBlockSize` | `int DetectedBlockSize { get; }` | Detected block size in bytes (matched offset / 2). |
+| `FirstClusterGroup` | `ulong FirstClusterGroup { get; }` |  |
+| `HeaderRaw` | `byte[] HeaderRaw { get; }` | Raw 4 KB capture of the superblock dinode block (pad with 0 if image was shorter). |
+| `Label` | `string Label { get; }` |  |
+| `MajorRev` | `ushort MajorRev { get; }` |  |
+| `MaxSlots` | `ushort MaxSlots { get; }` |  |
+| `MinorRev` | `ushort MinorRev { get; }` |  |
+| `RootBlkno` | `ulong RootBlkno { get; }` |  |
+| `SuperBlockOffset` | `long SuperBlockOffset { get; }` | Byte offset where the superblock dinode was found. |
+| `SystemDirBlkno` | `ulong SystemDirBlkno { get; }` |  |
+| `UuidHex` | `string UuidHex { get; }` |  |
+| `Valid` | `bool Valid { get; }` | True iff the OCFSV2 signature was found at a recognised block-2 offset. |
+| `TryParse` | `static Ocfs2Superblock TryParse(ReadOnlySpan<byte> image)` | Best-effort parse. Tries plausible block sizes (512, 1024, 2048, 4096) for the OCFSV2 signature at block 2; falls back to a free-form scan of the first 64 KB if none of the canonical offsets match. Never throws. |
+
+### Namespace `FileSystem.Ods1`
+
+[`Ods1BlockMover`](#ods1blockmover) · [`Ods1Entry`](#ods1entry) · [`Ods1FormatDescriptor`](#ods1formatdescriptor) · [`Ods1Modifier`](#ods1modifier) · [`Ods1Reader`](#ods1reader) · [`Ods1Writer`](#ods1writer)
+
+#### `Ods1BlockMover`
+
+Moves a file's blocks inside an ODS-1 volume and repoints its file header.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Ods1BlockMover` | `Ods1BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the headers this pass walks. |
+| `Init` | `void Init(Stream image)` | Reads where the file headers begin. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Ods1Entry`
+
+Directory entry from an ODS-1 (Files-11 Level 1) volume.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Ods1Entry` | `Ods1Entry()` |  |
+| `BlockCount` | `uint BlockCount { get; init; }` |  |
+| `Extents` | `IReadOnlyList<ValueTuple<uint, uint>> Extents { get; init; }` | Every retrieval pointer the header carries, in order. A pointer's block count is 16-bit, so a long file is described by several of them. |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+| `StartLbn` | `uint StartLbn { get; init; }` |  |
+
+#### `Ods1FormatDescriptor`
+
+Read+R/W descriptor for DEC VAX/VMS ODS-1 (Files-11 Level 1) volumes. Signature "DECFILE11A" at file offset 0x3F0 (= LBN 1 + 0x1F0). Reader covers single-extent retrieval pointers; writer emits a fresh Files-11 L1 disk image (home block + index file + bitmap + user-file headers + contiguous extents); modifier mutates existing images in-place via `Ods1Modifier` (Add allocates a free header slot + a contiguous BITMAP run, Remove zeros the header slot + frees its BITMAP bits + zero-fills its data extent; both recompute the home-block additive checksums). Self-round-trip gated; no Linux fsck for ODS-1 exists. References: DEC "Files-11 On-Disk Structure Specification" — the canonical ODS-1/ODS-2 spec (archived at Bitsavers)`https://en.wikipedia.org/wiki/Files-11` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Ods1FormatDescriptor` | `Ods1FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the Files-11 L1 writer honours: the 12-character home-block volume name (hm1$t_volname). The rest of the Stage-1 geometry is fixed. An empty label falls back to the writer default ("SCRATCH"). |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds files to an existing ODS-1 image via `AddFile`. Each input gets a free header slot in the 64-slot INDEXF window plus a contiguous BITMAP run for its data extent. Directory inputs are skipped (Stage-1 has no subdirectory support). Throws `NotSupportedException` when INDEXF or BITMAP is exhausted. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds a fresh ODS-1 disk image. Inputs are stored in the root with 9.3 ASCII filenames (longer names are truncated by `SplitName`); directory inputs are skipped (ODS-1 Stage-1 has no subdirectory support). |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves only the files that are out of place, rewriting each one's retrieval pointer as its blocks arrive. The pass is kept only if every payload still reads back: it can refuse partway — a header it cannot find leaves bytes moved with nothing naming them — and the volume is restored when it does. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Reports the volume's layout: the boot and home blocks, the allocation bitmap and the index-file window as metadata, then each file's retrieval pointers. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing ODS-1 image via `RemoveFile`. Each removal frees the file's BITMAP bits, zero-fills its data extent (no forensic recovery), and zero-fills its file-header slot. Unknown names are silently skipped. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros every byte no live file occupies, including the block padding past each file. |
+
+#### `Ods1Modifier`
+
+In-place random-access modifier for DEC ODS-1 (Files-11 Level 1) disk images. Mutates an existing image without rebuilding it: add allocates a free 512-byte file-header slot in the INDEXF window plus a contiguous run of data LBNs from BITMAP.SYS; remove frees the file's data extents in BITMAP.SYS and zero-fills its file-header slot. The home block's additive checksums are recomputed on every mutation so spec-validating readers see clean values. This is the read+write counterpart of `Ods1Writer`: the writer rebuilds an image from scratch, the modifier touches only the affected LBNs (header slot + BITMAP byte(s) + data extent + home-block checksum fields).Capacity limits match the Stage-1 layout the writer established: at most `IndexfHeaderSlots` (= 64) live files, allocations must be contiguous (single retrieval pointer per file), and data LBNs must live within the image's existing bounds. `AddFile` throws `NotSupportedException` when the INDEXF window is full or when BITMAP.SYS lacks a contiguous free run of the required size.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Appends `name`/`data` to an existing ODS-1 image. The header is written into the lowest free slot in the 64-slot INDEXF window; data is placed at the lowest free contiguous run of LBNs in BITMAP.SYS (starting at LBN 68, the first byte past the index-file window). The image grows when the allocated run extends past the current image length; BITMAP.SYS still covers the new range because a single 512-byte bitmap LBN tracks 4096 LBNs. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name)` | Removes the named file from an existing ODS-1 image. The file's data extents are freed in BITMAP.SYS, the data bytes are zero-filled (no forensic recovery from the resulting image), and the file-header slot in INDEXF is zero-filled so the reader skips it via its `fileNum == 0` check. |
+
+#### `Ods1Reader`
+
+Reader for the DEC VAX/VMS ODS-1 (Files-11 Level 1) filesystem (1977-1984, predecessor of ODS-2). ODS-1 was originally designed for RSX-11M and migrated to VAX/VMS V1.0. Blocks are 512 bytes ("LBN" = Logical Block Number). Files are described by 512-byte file headers stored in the INDEXF.SYS system file (file ID 1,1). On-disk layout (little-endian): LBN 0 boot block (variable) LBN 1 home block (512 bytes) — volume superblock +0x000 hm1$w_ibmapsize u16 +0x002 hm1$l_ibmaplbn u32 first LBN of allocation bitmap +0x006 hm1$w_maxfiles u16 +0x008 hm1$w_cluster u16 +0x00A hm1$w_devtype u16 +0x00C hm1$w_structlev u16 Files-11 level (=257 for ODS-1) +0x00E hm1$t_volname 12 ASCII volume name +0x01C hm1$w_volowner 4 uic +0x020 hm1$w_protect 2 +0x022 hm1$w_volchar 2 +0x024 hm1$w_fileprot 2 +0x026 hm1$b_reserved 6 +0x02C hm1$w_checksum1 2 first half checksum +0x02E hm1$t_credate 14 +0x03C hm1$b_window 1 +0x03D hm1$b_lru_lim 1 +0x03E hm1$w_extend 2 +0x040 ... +0x1F0 hm1$t_format "DECFILE11A" (12 bytes) +0x1FE hm1$w_checksum2 2 second half checksum File header (512 bytes): +0x00 fh1$b_idoffset u8 offset (in words) of ident area +0x01 fh1$b_mpoffset u8 offset (in words) of map area +0x02 fh1$w_fid_num u16 file number +0x04 fh1$w_fid_seq u16 sequence +0x06 fh1$w_struclev u16 +0x08 fh1$w_fid_volume u16 +0x0A fh1$b_filechar 1 F11_DIRECTORY = 0x40 ... ident area: fh1$t_filename (9 bytes Radix-50 = 6 ASCII chars) + fh1$t_filetype (3 Radix-50 = 3 chars) + version map area: retrieval pointers — each 4 bytes: u16 count + u16 high_lbn (24-bit LBN low in high byte field) For simplicity Stage-1 reader assumes "format 1" pointers: u16 count + u16 hi + u16 lo Spec source: VAX/VMS V4 documentation set "VAX/VMS File Definition Language Facility Reference Manual"; OpenVMS Documentation "Files-11 On-Disk Structure Specification" (1986 reprint covers both Level 1 and Level 2).
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Ods1Reader` | `Ods1Reader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<Ods1Entry> Entries { get; }` |  |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `StructureLevel` | `int StructureLevel { get; }` |  |
+| `VolumeFormat` | `string VolumeFormat { get; }` |  |
+| `VolumeName` | `string VolumeName { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `ExtractTo` | `long ExtractTo(Ods1Entry entry, Stream destination)` | Writes `entry`'s contents into `destination`, one retrieval pointer at a time. Returns the number of bytes written. |
+| `Extract` | `byte[] Extract(Ods1Entry entry)` |  |
+
+#### `Ods1Writer`
+
+Writer for DEC VAX/VMS ODS-1 (Files-11 Level 1) disk images. Produces a minimal but spec-shaped Files-11 volume that the companion `Ods1Reader` can round-trip cleanly. Layout produced (LBN = 512-byte Logical Block Number):The writer matches the existing `Ods1Reader` Stage-1 encoding exactly: filenames as raw ASCII (not Radix-50), retrieval pointers in the simplified `(count-1, hi, lo)` form, file size reported as block-count × 512 (no sub-block `fh1$l_efblk`). Real VAX/VMS images use Radix-50 and an end-of-file block field; Stage-1 of this format is a pragmatic round-trip-clean subset. The on-disk shape (boot/home/bitmap/index-file layout, DECFILE11A signature at the canonical home-block offset, file headers with idoff/mpoff/fileNum, little-endian everything) follows the Files-11 spec.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, FilePayload>> files, string volumeName = "SCRATCH")` | Materialises an image from payloads that may be streamed. |
+| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeName = "SCRATCH")` | Builds a Files-11 Level 1 disk image containing `files`. File headers occupy one LBN each starting at `IndexfLbn`; the reader's full `IndexfHeaderSlots`-LBN scan window is reserved (unused slots zero-padded), and data extents follow contiguously beyond it. Total image size auto-fits the payload, floored to fit the boot/home/ bitmap blocks plus the full index-file window plus one data LBN. |
+| `WriteTo` | `static void WriteTo(Stream output, IReadOnlyList<ValueTuple<string, FilePayload>> files, string volumeName = "SCRATCH")` | Writes the volume into `output`: the header window, then each file's bytes at the extent it was allocated. Only the header window is resident, so a volume past what a byte[] can address is producible. |
+
+### Namespace `FileSystem.OneFs`
+
+[`OneFsEntry`](#onefsentry) · [`OneFsFormatDescriptor`](#onefsformatdescriptor) · [`OneFsReader`](#onefsreader)
+
+#### `OneFsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OneFsEntry` | `OneFsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `OneFsFormatDescriptor`
+
+Stage 0 detection-only descriptor for Dell EMC Isilon OneFS LIN-tree root images. Surfaces only a synthetic `metadata.ini` and the raw image bytes; no real file-walk is attempted. Why R/O promotion is impossible (per CONTRIBUTING.md promotion gates):No single-image content surface. OneFS is a clustered scale-out NAS — every file is split into "protection groups" striped across drives and nodes with FEC (Forward Error Correction, N+M:B layout, e.g. N+2:1). A single drive/node image carries only one stripe; the file data cannot be reconstructed without the peer nodes. A read-only reader from one image can never return correct file bytes. LIN tree is cluster-wide. The Logical Inode Number tree (the OneFS metadata index) lives across nodes, not in a single superblock. There is no per-image inode-to-block mapping to walk. Proprietary on-disk format, no public specification. Dell EMC has never published the OneFS on-disk format. No open-source reverse-engineered reader exists. Without a spec we cannot honour the CONTRIBUTING rule "never advertise capabilities you cannot prove against a real spec". FreeBSD/UFS ancestry does NOT give us a UFS reader fallback. OneFS runs on a FreeBSD-derived kernel, but the filesystem layer is entirely proprietary — it is NOT FFS/UFS at the on-disk level. UFS1 places its superblock magic `0x00011954` at offset 8192; OneFS images have the ASCII `"OneFS"` tag at offset 0 and no UFS superblock. Routing OneFS images through `UfsReader` would fail the magic check and (if forced) return arbitrary bytes — the textbook mutual-compensation trap. Conclusion: Stage-0 detection only. Surface the magic, raw bytes, and a `metadata.ini` documenting the limitation. R/O promotion is blocked on (a) Dell EMC publishing the spec and (b) a multi-node ingest path — neither is in reach. References: Dell EMC "PowerScale OneFS Technical Overview" whitepaper — high-level architecture only; no on-disk spec is published`https://en.wikipedia.org/wiki/OneFS_distributed_file_system` — Wikipedia article
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OneFsFormatDescriptor` | `OneFsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `OneFsReader`
+
+Stage 0 detection-only reader for Dell EMC Isilon OneFS LIN-tree root images. OneFS is a clustered scale-out NAS — its single-image surface is the LIN-tree root block, whose first bytes are the ASCII tag `"OneFS"` (5 bytes, 0x4F 0x6E 0x65 0x46 0x53) or the short `"ONEF"` tag (0x4F 0x4E 0x45 0x46 = 0x4F4E4546 BE int) used in some node-local boot images. Only the tag is verified; the real LIN tree (logical inode number tree) is a cluster-wide construct and cannot be walked from a single image. File data is FEC-striped across nodes (N+M:B protection groups) — even a complete single-drive image carries only one stripe and cannot reconstruct file content without peer nodes. OneFS shares OS ancestry with FreeBSD, but the on-disk filesystem layer is proprietary and NOT UFS-compatible: there is no UFS1 superblock magic (`0x00011954`) at the UFS1 superblock offset (8192). The OneFS on-disk format has never been publicly specified by Dell EMC.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OneFsReader` | `OneFsReader(Stream stream)` |  |
+| `LongTag` | `static readonly byte[] LongTag` | OneFS LIN-tree-root long tag: ASCII "OneFS" (5 bytes). |
+| `ShortTag` | `static readonly byte[] ShortTag` | OneFS short tag: ASCII "ONEF" (4 bytes, 0x4F4E4546 BE). |
+| `Entries` | `IReadOnlyList<OneFsEntry> Entries { get; }` |  |
+| `Tag` | `string Tag { get; }` |  |
+| `TrailingWord` | `uint TrailingWord { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(OneFsEntry entry)` |  |
+
+### Namespace `FileSystem.OpenVms`
+
+[`OpenVmsBitmap`](#openvmsbitmap) · [`OpenVmsBlockMover`](#openvmsblockmover) · [`OpenVmsChecksum`](#openvmschecksum) · [`OpenVmsDirectory`](#openvmsdirectory) · [`OpenVmsDirectory.Entry`](#openvmsdirectoryentry) · [`OpenVmsFileHeader`](#openvmsfileheader) · [`OpenVmsFileHeader.RetrievalPointer`](#openvmsfileheaderretrievalpointer) · [`OpenVmsFormatDescriptor`](#openvmsformatdescriptor) · [`OpenVmsInPlaceModifier`](#openvmsinplacemodifier) · [`OpenVmsLayout`](#openvmslayout) · [`OpenVmsReader`](#openvmsreader) · [`OpenVmsReader.Entry`](#openvmsreaderentry) · [`OpenVmsVolume`](#openvmsvolume) · [`OpenVmsWriter`](#openvmswriter)
+
+#### `OpenVmsBitmap`
+
+In-memory view of BITMAP.SYS — the Files-11 ODS-2 storage allocation bitmap. One bit per LBN: bit value 0 means free, 1 means allocated. (The on-disk OpenVMS convention is the opposite — 1 = free — but our reader/writer/in-place-modifier agree on the same polarity, and the header-extension marker means real OpenVMS will never see this volume.) The bitmap lives at `BitmapStartLbn` spanning `BitmapBlockCount` LBNs, giving 65 536 bits of coverage for the default 8 192-LBN volume (with headroom). LBNs occupied by metadata (boot block, home block, BITMAP.SYS itself, INDEXF.SYS, root directory) are pre-marked allocated by `MarkMetadataAllocated` at volume-creation time. The in-place modifier's allocator (`AllocateRun`) scans past the metadata reservation to find a contiguous run of free LBNs.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenVmsBitmap` | `OpenVmsBitmap()` | Creates a fresh empty bitmap sized to the default volume. |
+| `OpenVmsBitmap` | `OpenVmsBitmap(byte[] bytes)` | Wraps an existing bitmap buffer (typically read from disk). |
+| `BitsTotal` | `int BitsTotal { get; }` | Total bits available in the map. |
+| `Bytes` | `byte[] Bytes { get; }` | The bitmap's backing bytes. `BitsTotal` bits exposed. |
+| `ClusterBlocks` | `int ClusterBlocks { get; init; }` | LBNs each bit stands for. ODS-2 tracks the volume in clusters (HM2$W_CLUSTER), not blocks, so BITMAP.SYS stays a fixed 16 blocks however large the volume grows -- which is what lets the rest of the layout keep its fixed LBNs. |
+| `LbnCapacity` | `long LbnCapacity { get; }` | Highest LBN the map can express. |
+| `VolumeBlocks` | `long VolumeBlocks { get; init; }` | Blocks in the volume this map describes. |
+| `AllocateRun` | `int AllocateRun(int blocks)` | Finds and marks a contiguous run of `blocks` free LBNs, starting the search at `DataAreaStartLbn`. Returns the run's starting LBN or -1 if the volume can't satisfy the request. |
+| `ClusterFor` | `static int ClusterFor(long volumeBlocks)` | Smallest power-of-two cluster size that lets one bitmap cover `volumeBlocks`. |
+| `FreeRun` | `void FreeRun(int startLbn, int blocks)` | Frees a contiguous run of `blocks` LBNs starting at `startLbn`. |
+| `IsAllocated` | `bool IsAllocated(int lbn)` | True when bit `lbn` is set (allocated). |
+| `MarkAllocated` | `void MarkAllocated(int lbn)` | Sets bit `lbn` (mark allocated). |
+| `MarkFree` | `void MarkFree(int lbn)` | Clears bit `lbn` (mark free). |
+| `MarkMetadataAllocated` | `void MarkMetadataAllocated()` | Pre-marks every metadata LBN allocated. Call once when emitting a fresh volume. |
+
+#### `OpenVmsBlockMover`
+
+Moves a file's blocks inside an OpenVMS volume and repoints its file header.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenVmsBlockMover` | `OpenVmsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the volume's own structures. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `OpenVmsChecksum`
+
+Files-11 ODS-2 16-bit "checksum1" — additive sum over little-endian 16-bit words, truncated to 16 bits. The same algorithm is applied to: The home block (sum of words 0..253; result stored at the home-block-specific HM2$W_CHECKSUM1/CHECKSUM2 slots — out of scope for our writer since VMS-mountability is deferred).Every File Header in INDEXF.SYS (sum of words 0..254; result stored at FH2$W_CHECKSUM = byte offset 510).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Compute` | `static ushort Compute(ReadOnlySpan<byte> data, int wordCount)` | Returns the 16-bit additive checksum of `data` reading `wordCount` little-endian unsigned 16-bit words from the start of the span. Carry is discarded — the result is the low 16 bits of the running 32-bit sum. |
+
+#### `OpenVmsDirectory`
+
+Directory blocks for a Files-11 ODS-2 volume: a run of variable-length name records, each carrying one or more version-and-file-id pairs.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ChainLinkOffset` | `const int ChainLinkOffset` | Where the link to the next block of the directory sits. |
+| `EndOfRecords` | `const ushort EndOfRecords` | The size word that says a block holds no more records. |
+| `FileNameLength` | `const int FileNameLength` | The longest name a record here carries. |
+| `RecordHeaderBytes` | `const int RecordHeaderBytes` | Bytes a record spends before its name. |
+| `SelfName` | `const string SelfName` | What the master file directory calls itself, which every Files-11 volume's root holds so a reader asked for [000000] finds something to open. |
+| `UsableBytes` | `const int UsableBytes` | How much of a block records may use, the link being at its end. |
+| `VersionEntryBytes` | `const int VersionEntryBytes` | Bytes one version-and-file-id pair takes. |
+| `Clear` | `static void Clear(Span<byte> block)` | Empties a block of records, leaving the chain link alone. |
+| `Enumerate` | `static List<Entry> Enumerate(ReadOnlySpan<byte> block)` | Every entry the block holds, in the order they were written. |
+| `IsSelfEntry` | `static bool IsSelfEntry(Entry entry)` | Whether an entry is the directory's own, rather than anything put there. |
+| `ReadChainLink` | `static int ReadChainLink(ReadOnlySpan<byte> dirBlock)` | Reads the chain link (next directory LBN, 0 if last) from `dirBlock`. |
+| `RecordBytes` | `static int RecordBytes(string name)` | Bytes the record for `name` takes, one version of it. |
+| `TryAppend` | `static bool TryAppend(Span<byte> block, Entry entry)` | Adds one entry to what the block already holds. |
+| `TryRemove` | `static bool TryRemove(Span<byte> block, string name)` | Takes out every entry naming `name`. |
+| `TryWrite` | `static bool TryWrite(Span<byte> block, IReadOnlyList<Entry> entries)` | Writes `entries` into `block`, one record each, and ends them. The chain link is left as it was. |
+| `WriteChainLink` | `static void WriteChainLink(Span<byte> dirBlock, int nextLbn)` | Writes the chain link (next directory LBN, 0 if last) into `dirBlock`. |
+
+#### `OpenVmsDirectory.Entry`
+
+One entry of a directory: a name, and the file it names.
+
+Implements `IEquatable<Entry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Entry` | `Entry(int FileId, ushort Sequence, string Name, long Size)` | One entry of a directory: a name, and the file it names. |
+| `FileId` | `int FileId { get; init; }` |  |
+| `IsFree` | `bool IsFree { get; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Sequence` | `ushort Sequence { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `OpenVmsFileHeader`
+
+In-memory mirror of a Files-11 File Header (a single 512-byte block inside INDEXF.SYS, anchored at a known LBN). Carries the file's name (ident area, ≤ 20 chars ASCII for ODS-2) and the retrieval pointers (map area) for its data extents. Serialization preserves the on-disk invariants documented at `OpenVmsLayout`: FH header words (IDOFFSET, MPOFFSET, …) at the documented offsets.Ident area at byte 128, 20 bytes of NUL-padded ASCII file name.Map area at byte 256, sequence of (LBN, count) 8-byte tuples, zero-terminated by a (0, 0) sentinel.FH2$W_CHECKSUM at byte 510, additive 16-bit sum of words 0..254.The "in use" predicate is anchored on the structure-level word at +6: a non-zero value means the FH carries a live file. Freeing a File Header (via `ClearInUse`) zeros the structure-level word so a subsequent scan reports it free.The header layout we emit is consistent between writer / reader / in-place modifier but is NOT a complete ODS-2 FH — the user-attribute FILECHAR bits, the RECATTR FAT bundle, and the FH2$L_OWN_UIC field are emitted as zeros. That's why `OpenVmsFormatDescriptor.Description` continues to note that the emitted volume isn't OpenVMS-mountable.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenVmsFileHeader` | `OpenVmsFileHeader()` |  |
+| `AllocatedBlocks` | `int AllocatedBlocks { get; }` | Returns the sum of `Count` across every retrieval pointer. |
+| `Extents` | `List<RetrievalPointer> Extents { get; }` | Retrieval pointers — each (LBN, count) tuple describes one contiguous data extent. |
+| `FileId` | `int FileId { get; set; }` | 1-based File-ID number. 0 means "not allocated". |
+| `InUse` | `bool InUse { get; set; }` | True when the header is in use (structure-level word non-zero). |
+| `IsDirectory` | `bool IsDirectory { get; set; }` | Whether this header describes a directory rather than an ordinary file. |
+| `Name` | `string Name { get; set; }` | File name (ASCII; padded with NULs to `FhFileNameLength`). |
+| `Sequence` | `ushort Sequence { get; set; }` | File-ID sequence number (incremented on slot reuse). |
+| `Size` | `long Size { get; set; }` | Logical file size in bytes. |
+| `ClearInUse` | `void ClearInUse()` | Returns the deserialized FH after zeroing its in-use marker (for "freed" semantics). |
+| `Deserialize` | `static OpenVmsFileHeader Deserialize(ReadOnlySpan<byte> block)` | Parses a 512-byte File Header from `block`. |
+| `Serialize` | `byte[] Serialize()` | Serializes the file header into a fresh 512-byte block ready to be written into INDEXF.SYS. |
+
+#### `OpenVmsFileHeader.RetrievalPointer`
+
+One retrieval pointer — describes a single contiguous data extent.
+
+Implements `IEquatable<RetrievalPointer>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `RetrievalPointer` | `RetrievalPointer(int StartLbn, int Count)` | One retrieval pointer — describes a single contiguous data extent. |
+| `Count` | `int Count { get; init; }` |  |
+| `StartLbn` | `int StartLbn { get; init; }` |  |
+
+#### `OpenVmsFormatDescriptor`
+
+Read/write descriptor for OpenVMS Files-11 (ODS-2) volume images. Backed by a clean-room writer / reader / in-place modifier trio that shares the geometry pinned at `OpenVmsLayout`. The descriptor advertises: `CanList` + `CanExtract` — driven by `OpenVmsReader` walking 000000.DIR.`CanCreate` — driven by `OpenVmsWriter`. The fresh volume carries a real ODS-2 home block at LBN 1 plus a workbench-layout layout marker at byte 132 of the home block.`CanModify` — driven by `OpenVmsInPlaceModifier`. Add / Remove / Replace touch only the BITMAP.SYS sector, the file's INDEXF.SYS slot, the directory block, and the affected data LBNs.Honest scope. The emitted volume is not OpenVMS-mountable — the home block's HM2$W_CHECKSUM1/CHECKSUM2 surfaces, the FH FILECHAR and RECATTR bundles, the ODS-2 variable-length directory record format, and the per-file revision-history fields are out of scope. What it IS is a layout the workbench's own writer, reader and in-place modifier can round-trip end-to-end through Add / Remove / Replace. References: DEC "Files-11 On-Disk Structure Specification" — the canonical ODS-2 spec (archived at Bitsavers)Kirby McCoy, "VMS File System Internals" (Digital Press, 1990)`https://en.wikipedia.org/wiki/Files-11` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenVmsFormatDescriptor` | `OpenVmsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the ODS-2 writer honours: the 12-character home-block volume label (HM2$T_VOLNAME). Everything else in the workbench-layout geometry is fixed. An empty label falls back to the writer default ("SCRATCH"). |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) caller files in-place via `OpenVmsInPlaceModifier`. Untouched LBNs in `archive` remain byte-identical. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Builds a fresh ODS-2 volume containing `inputs` as user files in 000000.DIR. Each file is a contiguous extent. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves only the files that are out of place, rewriting each one's retrieval pointer as its blocks arrive. The pass is kept only if every payload still reads back: it can refuse partway — a header it cannot find leaves bytes moved with nothing naming them — and the volume goes back as it was then. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Reports the volume's layout: the fixed metadata prefix — boot block, home block, BITMAP.SYS, INDEXF.SYS and the root directory — then each file's contiguous run of LBNs. Everything else is free. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a synthetic or real entry as a bounded read-only stream: `FULL.disk` (whole image), `home_block.bin` (parsed 512-byte home block), or any of the user-file names listed in 000000.DIR (assembled from the FH's retrieval pointers). |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in-place via `OpenVmsInPlaceModifier`. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros every byte no live file occupies. A file is one contiguous run of LBNs, so the gaps between runs — and the tail past the last one — are free space. The run is reported at its logical length, so the padding to the block boundary is wiped with it. |
+
+#### `OpenVmsInPlaceModifier`
+
+True in-place R/W modifier for the workbench-layout OpenVMS Files-11 ODS-2 volume. Honours the ODS-2 semantics described at `OpenVmsLayout`: Add — scan BITMAP.SYS for the first free File-ID slot in INDEXF.SYS, scan BITMAP.SYS for a contiguous run of free data LBNs, write the File Header at its known offset, copy the caller's bytes into the allocated data LBNs, drop a 64-byte directory entry into 000000.DIR, and flush the bitmap + home-block accounting back to disk.Replace — internally a Remove + Add round so the new data lands at fresh LBNs. The previous file's File Header is freed and its data LBNs are released to the bitmap; untouched neighbours stay byte-identical.Remove — zero the directory entry, free the File Header in INDEXF.SYS (zero its struc-level), release its data LBNs in BITMAP.SYS, and securely wipe the released data LBNs to zero. The bytes touched by every operation are strictly bounded: 1 BITMAP.SYS sector window + 1 INDEXF.SYS File-Header LBN + 1 directory LBN + N data LBNs (= ⌈size / 512⌉). LBNs outside that footprint are byte-identical to the pre-operation image.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static int AddFile(Stream archive, string name, byte[] data)` | Adds `data` as a new file named `name`. Throws `IOException` when the volume is full, or `InvalidDataException` when `archive` is not a workbench-layout volume. |
+| `RemoveFile` | `static bool RemoveFile(Stream archive, string name, bool wipeData = true)` | Removes the file named `name` if present. Returns true when a removal happened; false when no such name exists. The freed data LBNs are zero-wiped so the previous content isn't recoverable via raw image bytes. |
+| `ReplaceFile` | `static int ReplaceFile(Stream archive, string name, byte[] data)` | Replaces the file named `name` with new bytes. Always fully removes the old entry first, then adds the new one. Returns the File-ID of the freshly-written entry. Throws when the volume can't satisfy the new allocation (the old entry is removed before the new allocation is attempted). |
+
+#### `OpenVmsLayout`
+
+Volume geometry for the CompressionWorkbench OpenVMS Files-11 ODS-2 writer. These constants pin every LBN that the writer, reader, and in-place modifier agree on. The numbers are NOT load-bearing on a real OpenVMS instance — VMS mountability is out of scope (per the descriptor's honest-scope notice) — but the writer, reader and in-place modifier MUST agree exactly, otherwise an Add or Remove will desync the allocation bitmap from the file headers. Layout (512-byte LBNs): `LBN 0` — boot block (zeros)`LBN 1` — home block ("DECFILE11A " at byte 0x1E8 inside; "workbench-layout" marker at byte 132)`LBN 2 .. 17` — BITMAP.SYS (16 LBNs = 65 536 bits coverage; one bit per LBN)`LBN 18 .. 273` — INDEXF.SYS (256 file headers × 512 bytes; FH N at LBN 18 + N − 1)`LBN 274` — 000000.DIR (root directory, single block initially; chains forward if it grows)`LBN 275 ..` — data area, allocated by walking BITMAP.SYS for runs of free bits
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `BadBlockFileId` | `const int BadBlockFileId` | Reserved File-ID for the bad-block file (unused here; reserved per spec). |
+| `BitmapBlockCount` | `const int BitmapBlockCount` | BITMAP.SYS size in LBNs. 16 × 512 × 8 = 65 536 bits — covers a 32 MB volume with headroom. |
+| `BitmapFileId` | `const int BitmapFileId` | Reserved File-ID number for the BITMAP.SYS storage bitmap (ODS-2 reserves FID 2). |
+| `BitmapStartLbn` | `const int BitmapStartLbn` | First LBN of BITMAP.SYS — the allocation bitmap. |
+| `BlockSize` | `const int BlockSize` | Files-11 block size — 512 bytes per LBN by spec. |
+| `BootBlockLbn` | `const int BootBlockLbn` | LBN of the boot block (zeros, reserved by ODS-2). |
+| `CoreImageFileId` | `const int CoreImageFileId` | Reserved File-ID for the core image file (unused here; reserved per spec). |
+| `DataAreaStartLbn` | `const int DataAreaStartLbn` | First LBN of the user-data area (after metadata + root dir). |
+| `FhAcOffset` | `const int FhAcOffset` |  |
+| `FhAllocSize` | `const int FhAllocSize` |  |
+| `FhChecksum` | `const int FhChecksum` |  |
+| `FhExtFid` | `const int FhExtFid` |  |
+| `FhFidNum` | `const int FhFidNum` |  |
+| `FhFidRvnNmx` | `const int FhFidRvnNmx` |  |
+| `FhFidSeq` | `const int FhFidSeq` |  |
+| `FhFileChar` | `const int FhFileChar` | What kind of file this is, and how it may be used. |
+| `FhFileNameLength` | `const int FhFileNameLength` |  |
+| `FhIdOffset` | `const int FhIdOffset` |  |
+| `FhIdentAreaOffset` | `const int FhIdentAreaOffset` |  |
+| `FhMapAreaOffset` | `const int FhMapAreaOffset` |  |
+| `FhMapInUse` | `const int FhMapInUse` | Words of the map area that hold retrieval pointers. |
+| `FhMpOffset` | `const int FhMpOffset` |  |
+| `FhRecAttr` | `const int FhRecAttr` |  |
+| `FhRecattrEndBlock` | `const int FhRecattrEndBlock` |  |
+| `FhRecattrFirstFree` | `const int FhRecattrFirstFree` |  |
+| `FhRecattrHighBlock` | `const int FhRecattrHighBlock` |  |
+| `FhRecattr` | `const int FhRecattr` | The record-attributes area, which says how long the file is. |
+| `FhRsOffset` | `const int FhRsOffset` |  |
+| `FhSegNum` | `const int FhSegNum` |  |
+| `FhStrucLev` | `const int FhStrucLev` |  |
+| `FhUsedSize` | `const int FhUsedSize` |  |
+| `FileCharDirectory` | `const uint FileCharDirectory` | The bit in that which says the file is a directory. |
+| `FirstUserFileId` | `const int FirstUserFileId` | First File-ID number available for user files. |
+| `HbAltHomeLbn` | `const int HbAltHomeLbn` |  |
+| `HbAltIdxLbn` | `const int HbAltIdxLbn` |  |
+| `HbChecksum1` | `const int HbChecksum1` | Sum of the first twenty-nine words, which a reader also checks. |
+| `HbChecksum2` | `const int HbChecksum2` | Where the home block keeps the sum of the 255 words ahead of it. |
+| `HbCluster` | `const int HbCluster` |  |
+| `HbFormatString` | `const int HbFormatString` |  |
+| `HbHomeLbn` | `const int HbHomeLbn` |  |
+| `HbHomeVbn` | `const int HbHomeVbn` |  |
 | `HbIbMapLbn` | `const int HbIbMapLbn` |  |
 | `HbIbMapSize` | `const int HbIbMapSize` |  |
 | `HbIbMapVbn` | `const int HbIbMapVbn` |  |
@@ -7487,101 +10484,1211 @@ Volume geometry for the CompressionWorkbench OpenVMS Files-11 ODS-2 writer. Thes
 | `FileHeaderByteOffset` | `static long FileHeaderByteOffset(int fid)` | Computes the byte offset of File Header `fid` (1-based) inside INDEXF.SYS. |
 | `LbnToByteOffset` | `static long LbnToByteOffset(long lbn)` | Computes the byte offset of an LBN inside the volume. The result is 64-bit: a volume larger than 4 GB has LBNs whose byte offset does not fit in an int. |
 
-#### `OpenVmsReader`
+#### `OpenVmsReader`
+
+Walks a workbench-layout OpenVMS Files-11 ODS-2 volume and surfaces the user files held in 000000.DIR. Confirms the volume by checking the "workbench-layout" layout marker at byte 132 of the home block — when the marker is absent the reader returns no entries (the descriptor's generic header-surface path takes over). For each file the reader produces an `Entry` bundle containing the File-ID, name, logical size, and the in-memory file bytes (assembled by walking the File Header's retrieval pointers).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenVmsReader` | `OpenVmsReader(Stream image)` |  |
+| `OpenVmsReader` | `OpenVmsReader(byte[] image)` |  |
+| `Entries` | `List<Entry> Entries { get; }` | User entries surfaced from 000000.DIR (skips reserved FIDs 1, 2, 4). |
+| `Image` | `byte[] Image { get; }` | Convenience accessor over the volume bytes (read-only). |
+| `IsCwbVolume` | `bool IsCwbVolume { get; }` | Records that the volume's home block carries the workbench-layout layout marker. |
+| `AssembleFileBytes` | `static byte[] AssembleFileBytes(byte[] image, OpenVmsFileHeader fh)` | Reassembles file bytes from `fh`'s retrieval pointers. |
+| `Extract` | `byte[] Extract(Entry entry)` | Extracts the bytes for `entry` by walking its retrieval pointers. |
+| `ReadFileHeader` | `static OpenVmsFileHeader ReadFileHeader(byte[] image, int fileId)` | Reads a File Header from INDEXF.SYS by File-ID number (1-based). |
+
+#### `OpenVmsReader.Entry`
+
+One user-visible directory entry surfaced by the reader.
+
+Implements `IEquatable<Entry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Entry` | `Entry(int FileId, ushort Sequence, string Name, long Size)` | One user-visible directory entry surfaced by the reader. |
+| `FileId` | `int FileId { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Sequence` | `ushort Sequence { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `OpenVmsVolume`
+
+Random-access view of a workbench-layout volume. Everything the reader needs to enumerate files — the home block, BITMAP.SYS, INDEXF.SYS and the root directory — lives in the fixed metadata prefix, so the volume is recognised and listed from a few hundred kilobytes however large it is. File contents are then copied straight out of the backing stream, never materialised. This is the path the descriptor uses. `OpenVmsReader` keeps the whole-image API for the in-place modifier, which works on volumes small enough to hold in an array.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenVmsVolume` | `OpenVmsVolume(Stream image, bool leaveOpen = true)` |  |
+| `Entries` | `IReadOnlyList<Entry> Entries { get; }` | User entries surfaced from 000000.DIR. |
+| `IsCwbVolume` | `bool IsCwbVolume { get; }` | Records that the volume's home block carries the workbench-layout layout marker. |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `Metadata` | `byte[] Metadata { get; }` | The fixed metadata prefix, or as much of it as the image holds. |
+| `CopyTo` | `void CopyTo(long offset, Stream destination, long count)` | Copies `count` bytes at `offset` into `destination`. |
+| `Dispose` | `void Dispose()` |  |
+| `ExtractTo` | `long ExtractTo(Entry entry, Stream destination)` | Copies `entry`'s contents into `destination` by walking its retrieval pointers. Returns the number of bytes written. |
+| `ReadFileHeader` | `OpenVmsFileHeader ReadFileHeader(int fileId)` | Reads the File Header for `fileId` out of INDEXF.SYS. |
+
+#### `OpenVmsWriter`
+
+Emits a fresh OpenVMS Files-11 (ODS-2) volume to the `OpenVmsLayout` geometry. The resulting image carries: A real Files-11 home block at LBN 1 with "DECFILE11A " at byte 0x1E8, structure level 0x0202, cluster size 1, owner UIC [1,1], BITMAP.SYS LBN field set, max-files field set, plus the workbench-layout layout marker at byte 132 so our reader / modifier recognise the geometry.BITMAP.SYS at LBN 2..17 with metadata LBNs pre-marked allocated.INDEXF.SYS at LBN 18..273 (256 reserved File-IDs); File-IDs 1 (INDEXF.SYS), 2 (BITMAP.SYS) and 4 (000000.DIR) are populated with retrieval pointers covering their own LBNs.000000.DIR at LBN 274 containing one directory entry per caller-supplied file.Caller files laid out contiguously starting at LBN 275. Honest scope: this volume is NOT OpenVMS-mountable — the FH ident-area metadata, the FILECHAR / RECATTR fields, and the home-block HM2$W_CHECKSUM1/CHECKSUM2 surfaces are emitted as zeros. What it IS: a layout our reader and in-place modifier can round-trip end-to-end.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OpenVmsWriter` | `OpenVmsWriter()` |  |
+| `BuildTo` | `void BuildTo(Stream output, IReadOnlyList<ValueTuple<string, FilePayload>> files, string volumeLabel = "SCRATCH")` | Emits the volume to `output`: the fixed metadata prefix first, then every file copied into the run the allocator gave it. Only the prefix and one copy buffer are ever resident, so the volume is bounded by the target's capacity rather than by `MaxLength`. |
+| `Build` | `byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeLabel = "SCRATCH")` | Builds the volume image in memory. Throws `IOException` when inputs don't fit. |
+| `NormalizeName` | `static string NormalizeName(string raw)` | Normalises a caller-supplied file name to the 24-char ASCII slot in `OpenVmsDirectory`. Forward slashes and backslashes are collapsed to dots so caller paths like "subdir/file.txt" still fit (ODS-2 directories are flat — we deliberately don't fabricate a subdirectory tree). |
+
+### Namespace `FileSystem.OrangeFs`
+
+[`OrangeFsEntry`](#orangefsentry) · [`OrangeFsFormatDescriptor`](#orangefsformatdescriptor) · [`OrangeFsReader`](#orangefsreader)
+
+#### `OrangeFsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OrangeFsEntry` | `OrangeFsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `OrangeFsFormatDescriptor`
+
+OrangeFS / PVFS2 DBPF storage-object descriptor. A DBPF file is one server-side storage object rather than a complete distributed filesystem namespace; the opaque object payload can nevertheless be created, replaced and removed while preserving its DBPF tag/version/datastream identity. References: `https://github.com/waltligon/orangefs` — official PVFS/OrangeFS repository (DBPF storage layer)`https://www.kernel.org/doc/html/latest/filesystems/orangefs.html` — Linux kernel client documentation
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OrangeFsFormatDescriptor` | `OrangeFsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+
+#### `OrangeFsReader`
+
+Reads OrangeFS / PVFS2 DBPF storage-object files. PVFS2 (the parallel virtual filesystem, now OrangeFS) is a distributed parallel FS, but its server-side storage objects are persisted in single files named like `bstream-XX` using the Direct Block Pool Format (DBPF). Each such file has a 16-byte header with a 4-byte ASCII tag at offset 0: `"PVFS"` (0x50 0x56 0x46 0x53) for classic PVFS2 or `"OGFP"` (0x4F 0x47 0x46 0x50) for OrangeFS-native objects, followed by a version field and a datastream type byte. DBPF header layout (file offset 0, little-endian): 0x00 char[4] tag "PVFS" or "OGFP" 0x04 u32 version (DBPF format revision) 0x08 u32 datastream-type (bytestream / metadata / dirdata / ...) 0x0C u32 object-size (length of contained object payload) 0x10 ... object data The contained object is surfaced as a single opaque entry — full PVFS2 object semantics (handle/fsid resolution + striping) require the cluster's config (fs.conf) and are out of scope.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `OrangeFsReader` | `OrangeFsReader(Stream stream)` |  |
+| `OrangeFsTag` | `static readonly byte[] OrangeFsTag` |  |
+| `PvfsTag` | `static readonly byte[] PvfsTag` |  |
+| `DatastreamType` | `uint DatastreamType { get; }` |  |
+| `Entries` | `IReadOnlyList<OrangeFsEntry> Entries { get; }` |  |
+| `IsOrangeFs` | `bool IsOrangeFs { get; }` |  |
+| `ObjectSize` | `uint ObjectSize { get; }` |  |
+| `Tag` | `string Tag { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Version` | `uint Version { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(OrangeFsEntry entry)` |  |
+
+### Namespace `FileSystem.Os9Rbf`
+
+[`Os9RbfBlockMover`](#os9rbfblockmover) · [`Os9RbfExtentMap`](#os9rbfextentmap) · [`Os9RbfFormatDescriptor`](#os9rbfformatdescriptor) · [`Os9RbfModifier`](#os9rbfmodifier) · [`Os9RbfReader`](#os9rbfreader) · [`Os9RbfReader.FileEntry`](#os9rbfreaderfileentry) · [`Os9RbfReader.Volume`](#os9rbfreadervolume) · [`Os9RbfWriter`](#os9rbfwriter)
+
+#### `Os9RbfBlockMover`
+
+In-place OS-9 RBF block mover. Moves sector-aligned extents within an OS-9 image and patches the file descriptor's segment list so the file remains reachable at its new location. Each OS-9 file has a File Descriptor (FD) sector containing a segment list of up to 48 (start-LSN, sector-count) pairs. Moving a file's data requires updating the segment list in the FD sector and also adjusting the allocation bitmap.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Os9RbfBlockMover` | `Os9RbfBlockMover()` |  |
+| `DataOrigin` | `long DataOrigin { get; }` | Byte offset where user data typically begins (past ID + bitmap). |
+| `UnitSize` | `int UnitSize { get; }` | Allocation unit size (one 256-byte sector). |
+| `LsnToOffset` | `long LsnToOffset(int lsn)` | Converts a sector (LSN) number to a byte offset. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OffsetToLsn` | `int OffsetToLsn(long offset)` | Converts a byte offset to a sector (LSN) number. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Os9RbfExtentMap`
+
+Walks a Microware OS-9 RBF disk image (256-byte sectors, big-endian fields) and yields the actual on-disk byte layout — the identification sector + allocation bitmap as `MetadataReserved`, the root directory FD + directory data sectors as `MetadataReserved`, every per-file FD sector as `MetadataReserved`, every (start, count) segment in a file's segment list as a contiguous `Used` extent, and the rest as `Free`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `Os9RbfFormatDescriptor`
+
+Read+write descriptor for Microware OS-9 RBF (Random-Block-File) disk images. OS-9 was a multi-tasking real-time OS released in 1979 by Microware Systems; it shipped on the Tandy CoCo, Sharp MZ-2500, embedded systems and later as OS-9/68000 and OS-9000. The writer emits a 35-track DSDD CoCo reference geometry (~315 KB); the reader parses any RBF image whose root directory descriptor is reachable via the identification sector. References: Microware "OS-9 Technical Reference" (RBF chapter) — the canonical RBF on-disk description`https://sourceforge.net/projects/nitros9/` — NitrOS-9 — maintained open-source OS-9/6809 with an RBF implementation + ToolShed tooling`https://en.wikipedia.org/wiki/OS-9` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Os9RbfFormatDescriptor` | `Os9RbfFormatDescriptor()` |  |
+| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for Microware OS-9 RBF creation. The writer emits the canonical 35-track DSDD CoCo reference geometry; only the volume label stored at LSN 0 (DD.NAM, 32-byte high-bit-terminated string) is per-volume tunable. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing OS-9 RBF image. Uses `Os9RbfModifier` for true O(touched bytes) random-access I/O — only the identification sector, the bitmap, the root dir's FD + extents, and the new file's FD + data sectors are read or written. |
+| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware OS-9 RBF defragmentor. Tries planner-driven in-place path first, falls back to rebuild path on error. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the OS-9 RBF root directory and yields the actual on-disk byte layout — identification sector + bitmap + per-file FD sectors as `MetadataReserved`, every (start, count) segment in each file's segment list as a contiguous `Used` extent, and unallocated sectors as `Free`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing OS-9 RBF image. Uses `Os9RbfModifier` for O(touched bytes) random-access I/O. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the OS-9 RBF image: unallocated sectors and the sector-tip slack between a file's logical size (FD.SIZ) and the end of its last allocated 256-byte sector. Cluster-tip wiping is applied only to files whose data is a single contiguous segment; a file spread across several segments keeps its tip in its final segment only, which the per-segment extent map cannot pinpoint by total size alone, so such files are omitted from the tip pass to avoid clobbering live sectors. |
+
+#### `Os9RbfModifier`
+
+Random-access in-place modifier for Microware OS-9 RBF disk images. Reads and writes only the identification sector, the allocation bitmap, the root directory's FD + extents, the new file's FD sector, and the new file's data segments — never the whole image. Lets the host operate on multi-megabyte underlying streams without paging the entire disk into memory. Limitations: only the root directory is mutated (no nested dirs); file data is allocated as a single contiguous segment (no fragmentation recovery — fails with `InvalidOperationException` when the largest free run is too small).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to an existing image. Caller is responsible for ensuring the name does not already exist (use `RemoveFile` first for replace-by-name semantics). |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file. Returns true on success. Frees the file's FD and data segments via the bitmap, and zeroes the directory entry. When `wipeData` is true, the file's data sectors and FD sector are zeroed as well. |
+
+#### `Os9RbfReader`
+
+Reader for Microware OS-9 RBF (Random-Block-File) disk images. The format was used on the Tandy CoCo (OS-9 Level 1/2), Sharp MZ-2500, Atari MSX-OS-9 machines, and embedded systems running OS-9/68000 and OS-9000. Sector size is 256 bytes; multi-byte fields are big-endian. The directory tree is walked recursively: files in subdirectories surface with their full slash-separated path and each intermediate directory is reported as its own entry.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Os9RbfReader` | `Os9RbfReader()` |  |
+| `Extract` | `static byte[] Extract(Volume v, FileEntry e)` | Returns the file's byte contents, honouring its FD.SIZ length. |
+| `Read` | `static Volume Read(ReadOnlySpan<byte> image)` | Parses an OS-9 RBF image (root directory only). |
+
+#### `Os9RbfReader.FileEntry`
+
+One file/directory entry parsed from a directory sector.
+
+Implements `IEquatable<FileEntry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `FileEntry` | `FileEntry(string Name, int FdLsn, long ByteLength, bool IsDirectory, DateTime? Created)` | One file/directory entry parsed from a directory sector. |
+| `ByteLength` | `long ByteLength { get; init; }` |  |
+| `Created` | `DateTime? Created { get; init; }` |  |
+| `FdLsn` | `int FdLsn { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+
+#### `Os9RbfReader.Volume`
+
+Parsed OS-9 RBF volume.
+
+Implements `IEquatable<Volume>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Volume` | `Volume(string VolumeName, int TotalSectors, int RootDirLsn, IReadOnlyList<FileEntry> Files, byte[] Image)` | Parsed OS-9 RBF volume. |
+| `Files` | `IReadOnlyList<FileEntry> Files { get; init; }` |  |
+| `Image` | `byte[] Image { get; init; }` |  |
+| `RootDirLsn` | `int RootDirLsn { get; init; }` |  |
+| `TotalSectors` | `int TotalSectors { get; init; }` |  |
+| `VolumeName` | `string VolumeName { get; init; }` |  |
+
+#### `Os9RbfWriter`
+
+Writer for Microware OS-9 RBF (Random-Block-File) disk images. Emits a 35-track DSDD CoCo geometry (322 560 bytes / ~315 KB, 1260 sectors of 256 bytes, cluster size 1). Files whose names contain '/' separators are placed into real OS-9 subdirectories: each path component becomes a directory file descriptor (directory attribute set) whose data holds "." / ".." links plus one entry per child. Files and directories each occupy one file-descriptor sector and a single contiguous segment.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Os9RbfWriter` | `Os9RbfWriter()` |  |
+| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeName = "OS9")` | Builds an OS-9 RBF image. Each path component may be at most 28 ASCII characters. Forward slashes in `name` introduce subdirectories. |
+
+### Namespace `FileSystem.Pc98`
+
+[`Pc98BlockMover`](#pc98blockmover) · [`Pc98Entry`](#pc98entry) · [`Pc98ExtentMap`](#pc98extentmap) · [`Pc98FormatDescriptor`](#pc98formatdescriptor) · [`Pc98Modifier`](#pc98modifier) · [`Pc98Optimizer`](#pc98optimizer) · [`Pc98Optimizer.Pc98Layout`](#pc98optimizerpc98layout) · [`Pc98Reader`](#pc98reader) · [`Pc98Writer`](#pc98writer)
+
+#### `Pc98BlockMover`
+
+Moves a file's clusters inside a PC-98 volume and relinks its chain.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Pc98BlockMover` | `Pc98BlockMover()` |  |
+| `ClusterSize` | `int ClusterSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. |
+| `Init` | `void Init(Stream image)` | Reads the volume's geometry from its boot sector. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Pc98Entry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Pc98Entry` | `Pc98Entry()` |  |
+| `Attributes` | `byte Attributes { get; init; }` |  |
+| `FirstCluster` | `int FirstCluster { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `Pc98ExtentMap`
+
+Enumerates the on-disk byte layout of an NEC PC-98 disk image: the IPL block, the FAT(s), and the root directory are emitted as `MetadataReserved`; every file's cluster run is one `Used` extent; unattributed sectors are left for the caller to fill as `Free`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Walks the image and yields the metadata + file extents. |
+
+#### `Pc98FormatDescriptor`
+
+Descriptor for NEC PC-98 DOS disk images. PC-98 disks use a FAT12/16-like filesystem with a vendor-specific Initial Program Loader (IPL) block at sector 0 — detection is by the "NECIPL" ASCII signature at file offset 0. PC-98 supports subdirectories per the FAT12 model. The current minimal writer emits a single flat root directory only; hierarchical writes are deferred. The reader handles subdirectory dirents at the root by surfacing them as entries with `IsDirectory` set, but does not recurse into them.Capabilities: read + write (flat-only writer), defragment via extract-and-rebuild, free-space wiping driven by the extent map, and creation-options schema for media type / bytes-per-sector / sectors-per-cluster / volume label. References: Microsoft "FAT: General Overview of On-Disk Format" (fatgen103) — the FAT12/16 layout PC-98 volumes follow`https://en.wikipedia.org/wiki/PC-9800_series` — Wikipedia article on the platform
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Pc98FormatDescriptor` | `Pc98FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for PC-98 creation: media type (controls the OEM label in the BPB), bytes per sector, sectors per cluster, and volume label. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing PC-98 image. Tries genuine O(touched bytes) in-place I/O via `Pc98Modifier` (allocate contiguous free clusters, chain the FAT, write the dirent); only when the disk has no room does it fall back to a growing rebuild. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in place: frees the FAT chain, wipes the clusters, and marks the dirent deleted (0xE5). |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all bytes not claimed by the IPL block, the FAT, the root directory, or a live file's cluster run. Cluster-tip wiping uses the directory entry's file size when `wipeClusterTips` is true. |
+
+#### `Pc98Modifier`
+
+In-place modifier for NEC PC-98 DOS (FAT12) disk images. Performs add / remove with strict O(touched bytes) I/O — only the FAT sector(s) covering the touched cluster chain, the affected root-directory entry, and the file's data clusters are read or written. Existing files' data bytes stay byte-identical at their original cluster offsets, and a same-size update never changes the image length. PC-98 prepends a 512-byte IPL block ("NECIPL" + BPB at offset 0x80) to an otherwise-standard FAT12 layout; every FAT/root/data offset is shifted by one IPL sector. The `Pc98Reader` surfaces only the first contiguous cluster-aligned run of a file, so this modifier allocates contiguous cluster runs (and chains them in the FAT) — the data is therefore both reader-faithful and FAT-correct.Returns `false` from `TryAddFile` when the disk has no contiguous free run / no free directory slot, so the caller can fall back to a growing rebuild.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `IsPc98` | `static bool IsPc98(Stream image)` | True if the stream parses as a PC-98 FAT12 volume. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file in place: frees its FAT chain, optionally wipes the cluster data, and marks the dirent deleted (0xE5). |
+| `TryAddFile` | `static bool TryAddFile(Stream image, string name, byte[] data)` | Attempts a genuine in-place add. Returns false (image untouched) when there is no free directory slot or no contiguous free cluster run. |
+
+#### `Pc98Optimizer`
+
+Picks the smallest sectors-per-cluster value for a PC-98 disk that fits the supplied file set with ≤ 5 % wasted slack. Sector size is fixed at 512 B by default.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Find` | `static Pc98Layout Find(IReadOnlyList<long> fileSizes)` | Returns the smallest sectors-per-cluster whose cluster-aligned footprint is within 5 % of the payload size; falls back to SPC=1 if no candidate satisfies the slack threshold. TotalSectors is sized to fit IPL block + 1 reserved + 1 FAT + 32-entry root + clusters. |
+
+#### `Pc98Optimizer.Pc98Layout`
+
+One layout preset.
+
+Implements `IEquatable<Pc98Layout>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Pc98Layout` | `Pc98Layout(int BytesPerSector, int SectorsPerCluster, int TotalSectors)` | One layout preset. |
+| `BytesPerCluster` | `int BytesPerCluster { get; }` | Bytes per cluster. |
+| `BytesPerSector` | `int BytesPerSector { get; init; }` |  |
+| `SectorsPerCluster` | `int SectorsPerCluster { get; init; }` |  |
+| `TotalBytes` | `int TotalBytes { get; }` | Total raw image size. |
+| `TotalSectors` | `int TotalSectors { get; init; }` |  |
+
+#### `Pc98Reader`
+
+Reads NEC PC-98 DOS disk images. The PC-98 is a Japanese personal computer family with a unique BIOS and Initial Program Loader signature ("NECIPL" = 0x4E 0x45 0x43 0x49 0x50 0x4C) at file offset 0 that distinguishes its FAT layout from IBM PC FAT despite using 512-byte sectors and a FAT12/16-like directory. PC-98 IPL layout (little-endian, sector 0; 512 bytes): 0x00 char[6] "NECIPL" — IPL signature (this descriptor's primary magic) 0x06 ... IPL boot code (NEC vendor-specific) 0x20 ... PC-98 BPB extensions (vendor area) 0x80 char[3] jump instruction (FAT BPB at boot-block 1, sector 1) 0x83 char[8] OEM name 0x8B u16 bytes per sector 0x8D byte sectors per cluster 0x8E u16 reserved sectors 0x90 byte number of FATs 0x91 u16 root entries 0x97 u16 sectors per FAT On PC-98 systems the FAT BPB and root directory follow the same FAT12/16 layout as IBM PC, but at an offset of one IPL block (=512 bytes) from file start.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Pc98Reader` | `Pc98Reader(Stream stream)` |  |
+| `BpbOffset` | `const int BpbOffset` |  |
+| `IplOffset` | `const int IplOffset` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `Signature` | `static readonly byte[] Signature` |  |
+| `Entries` | `IReadOnlyList<Pc98Entry> Entries { get; }` |  |
+| `FatCount` | `int FatCount { get; }` |  |
+| `ReservedSectors` | `int ReservedSectors { get; }` |  |
+| `RootEntries` | `int RootEntries { get; }` |  |
+| `SectorsPerCluster` | `int SectorsPerCluster { get; }` |  |
+| `SectorsPerFat` | `int SectorsPerFat { get; }` |  |
+| `ValidVolume` | `bool ValidVolume { get; }` |  |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(Pc98Entry entry)` |  |
+
+#### `Pc98Writer`
+
+Builds a fresh NEC PC-98 DOS disk image from scratch. PC-98 disks prepend a 512-byte vendor Initial Program Loader (IPL) block to a regular FAT12 layout; the IPL carries the `NECIPL` ASCII signature at offset 0 and the FAT BPB at offset 0x80.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Pc98Writer` | `Pc98Writer()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds one file. Subdirectory writes are deferred. |
+| `Build` | `byte[] Build()` |  |
+| `SetBytesPerSector` | `void SetBytesPerSector(int value)` | Sets bytes per sector (256/512/1024). Default 512. |
+| `SetMediaType` | `void SetMediaType(string value)` | Sets the media-type label written into the BPB OEM field (HDM/FDI/D88). |
+| `SetSectorsPerCluster` | `void SetSectorsPerCluster(int value)` | Sets sectors per cluster (power of two 1..32). |
+| `SetTotalSectors` | `void SetTotalSectors(int value)` | Sets total sector count. 0 = auto. |
+| `SetVolumeLabel` | `void SetVolumeLabel(string label)` | Sets the 11-character volume label. |
+
+### Namespace `FileSystem.ProDos`
+
+[`ProDosBlockMover`](#prodosblockmover) · [`ProDosEntry`](#prodosentry) · [`ProDosExtentMap`](#prodosextentmap) · [`ProDosFormatDescriptor`](#prodosformatdescriptor) · [`ProDosModifier`](#prodosmodifier) · [`ProDosReader`](#prodosreader) · [`ProDosWriter`](#prodoswriter)
+
+#### `ProDosBlockMover`
+
+In-place ProDOS block mover. Moves block-aligned extents within a ProDOS disk image and patches index block pointers (seedling/sapling/tree), directory entry key-pointers, and the volume bitmap so the file remains reachable at its new location.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ProDosBlockMover` | `ProDosBlockMover()` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `ProDosEntry`
+
+Directory entry in a ProDOS volume. Full path includes parent subdirectory names separated by '/'.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ProDosEntry` | `ProDosEntry()` |  |
+| `FileType` | `byte FileType { get; init; }` |  |
+| `FullPath` | `string FullPath { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+| `StorageType` | `byte StorageType { get; init; }` | ProDOS storage type nibble: 1=seedling, 2=sapling, 3=tree, 0xD=subdir. |
+
+#### `ProDosExtentMap`
+
+Walks an Apple ProDOS image (.po / .2mg, 512-byte blocks) and yields the actual on-disk byte layout — boot (blocks 0-1), volume directory chain, volume bitmap, and per-file storage as Used (data blocks + index/master-index blocks attributed to the file). Storage tiers 1 (seedling), 2 (sapling), 3 (tree), and 0xD (subdirectory) are all walked.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `ProDosFormatDescriptor`
+
+Descriptor for Apple II ProDOS volume images (140 KB / 800 KB) — volume directory + bitmap layout with seedling/sapling/tree file storage tiers. References: `https://prodos8.com/docs/techref/` — ProDOS 8 Technical Reference Manual — volume/directory/storage-tier spec`https://github.com/fadden/CiderPress2` — CiderPress II — maintained tooling for ProDOS volumes`https://en.wikipedia.org/wiki/Apple_ProDOS` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ProDosFormatDescriptor` | `ProDosFormatDescriptor()` |  |
+| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `CanonicalSizes` | `IReadOnlyList<long> CanonicalSizes { get; }` | Canonical ProDOS image sizes (5.25" floppy = 143 360, 800 KB floppy = 819 200). |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing ProDos image. Uses `ProDosModifier` for true O(touched bytes) random-access I/O — only the volume header, the directory chain, the bitmap, and the file's index + data blocks are read or written. |
+| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware ProDOS defragmentor. Tries the planner-driven in-place path first, falling back to the rebuild path on error or for `CarveHole`. Image total-block size is preserved by inferring it from the input stream length. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the volume directory + bitmap + per-file storage tiers (seedling/sapling/tree) and yields the actual on-disk block layout. Boot, volume directory chain, bitmap, and subdir blocks are emitted as `MetadataReserved`; data + index + master-index blocks are attributed to their owning file. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing ProDos image. Uses `ProDosModifier` for O(touched bytes) random-access I/O. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the ProDOS image: unallocated blocks and the block-tip slack between a file's logical EOF and the end of its last 512-byte block. Cluster-tip wiping is applied only to seedling files (storage type 1, a single data block). Sapling and tree files interleave index and master-index blocks with their data inside one coalesced Used extent, so a logical-size lookup cannot tell data slack from a live index block — those files are omitted from the tip pass to avoid corrupting the block pointers; their free blocks are still zeroed. |
+
+#### `ProDosModifier`
+
+Random-access in-place modifier for Apple ProDOS block-ordered images (`.po` and `.2mg`). Reads and writes only the volume directory chain, the bitmap, and the new file's index + data blocks — never the whole image. Lets callers operate on huge underlying streams without paging the entire disk into memory.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, byte fileType = 6)` | Adds a file to an existing image. Caller is responsible for ensuring the name does not already exist; use `RemoveFile` first for replace-by-name semantics. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image. Returns true if found and removed. When `wipeData` is true, data blocks are zeroed. |
+
+#### `ProDosReader`
+
+Reader for Apple ProDOS `.po` (block-ordered) and `.2mg` images.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ProDosReader` | `ProDosReader(Stream stream)` |  |
+| `ProDosReader` | `ProDosReader(byte[] data)` |  |
+| `BlockSize` | `const int BlockSize` |  |
+| `DirHeaderSize` | `const int DirHeaderSize` | Size in bytes of the Volume Directory Header (storage type 0xF) and the Subdirectory Header (storage type 0xE). The header occupies slot 0 of the first block in a directory chain and is larger than a regular file entry because it carries volume/subdirectory metadata (entry_length, file_count, bit_map_pointer, total_blocks for the volume header; parent_pointer, parent_entry_number, parent_entry_length for the subdirectory header). Per the ProDOS spec, this is 43 bytes ($00..$2A inclusive) — three bytes larger than the 39-byte (`EntrySize`) file-entry slot. The next entry (slot 1 of the first block) therefore starts at byte 4 + 43 = 47, not 4 + 39 = 43. |
+| `EntriesPerBlock` | `const int EntriesPerBlock` |  |
+| `EntrySize` | `const int EntrySize` |  |
+| `VolumeDirStartBlock` | `const int VolumeDirStartBlock` |  |
+| `Entries` | `IReadOnlyList<ProDosEntry> Entries { get; }` |  |
+| `VolumeName` | `string VolumeName { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `EntryOffsetInBlock` | `static int EntryOffsetInBlock(bool isFirstBlockOfChain, int slotIndex)` | Returns the byte offset within a directory block at which the entry at `slotIndex` begins. The first block of a directory chain has its slot 0 carry the (43-byte) Volume/Subdir Header; subsequent slots are 39-byte file entries starting at byte 47. Non-first blocks have all 13 slots as 39-byte file entries starting at byte 4. |
+| `Extract` | `byte[] Extract(ProDosEntry entry)` |  |
+| `SlotsInBlock` | `static int SlotsInBlock(bool isFirstBlockOfChain)` | Returns the number of usable entry slots (header + file slots) in a directory block. The first block of a chain holds 12 entries (1 header at slot 0 + 11 file slots at slots 1..11). Subsequent blocks hold 13 file slots at slots 0..12. |
+
+#### `ProDosWriter`
+
+Builds a fresh Apple ProDOS block-ordered disk image (`.po`) from scratch (WORM).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ProDosWriter` | `ProDosWriter()` |  |
+| `Disk800KTotalBlocks` | `const int Disk800KTotalBlocks` |  |
+| `FloppyTotalBlocks` | `const int FloppyTotalBlocks` |  |
+| `AddFile` | `void AddFile(string name, byte fileType, byte[] data)` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file (default file_type = BIN 0x06). |
+| `Build` | `byte[] Build(string volumeName = "WORM", int totalBlocks = 280)` | Builds a canonical 143 360-byte (floppy) ProDOS image by default. |
+
+### Namespace `FileSystem.Qnx4`
+
+[`Qnx4BlockMover`](#qnx4blockmover) · [`Qnx4Entry`](#qnx4entry) · [`Qnx4FormatDescriptor`](#qnx4formatdescriptor) · [`Qnx4Modifier`](#qnx4modifier) · [`Qnx4Reader`](#qnx4reader) · [`Qnx4Writer`](#qnx4writer)
+
+#### `Qnx4BlockMover`
+
+Moves a file's blocks inside a QNX4 volume and repoints its inode.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx4BlockMover` | `Qnx4BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the boot block and the root cluster. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Qnx4Entry`
+
+Directory entry from a QNX4 filesystem.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx4Entry` | `Qnx4Entry()` |  |
+| `ExtentBlockCount` | `uint ExtentBlockCount { get; init; }` |  |
+| `FirstExtentBlock` | `uint FirstExtentBlock { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `Qnx4FormatDescriptor`
+
+R/W descriptor for QNX4 filesystem images. QNX4 has no fixed magic at the start of the image — detection relies on the inode status byte pattern in the root directory cluster (block 1). Add / Remove are routed through `Qnx4Modifier`, which mutates the root cluster (LBA 1-4) and the `.bitmap` (LBA 5) in place. Scope stays flat-root (29 user files) — past that Add throws `NotSupportedException`, matching the WORM writer's capacity guard. Subdirectory emission is still out of scope. References: `https://github.com/torvalds/linux/blob/master/include/uapi/linux/qnx4_fs.h` — canonical on-disk structures`https://github.com/torvalds/linux/tree/master/fs/qnx4` — Linux reference implementation`https://en.wikipedia.org/wiki/QNX` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx4FormatDescriptor` | `Qnx4FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing QNX4 image. Routed through `AddFile`: the root cluster + bitmap are mutated in place, the new file's data extent is allocated from the bitmap, and the inode lands in the first free slot (entries 3..31). |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves only the files that are out of place, repointing each one's inode extent as its blocks arrive. A file here is one contiguous extent named by its inode, so a move is the copy and one four-byte write — where a rebuild would read and rewrite every file to fix a handful of runs. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing QNX4 image. Routed through `RemoveFile`: the dirent is located in the root cluster, the extent is freed in the bitmap, data blocks are zero-wiped, and the inode slot is cleared. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `Qnx4Modifier`
+
+In-place modifier for QNX4 file-system images. Performs Add / Remove against the existing root-directory cluster (LBA 1-4) and updates the on-disk `.bitmap` (LBA 5) in-place — no full image rebuild, no snapshot copy. The companion `Qnx4Writer` still serves the WORM "build a fresh image from a file list" path; this class handles the "mutate an existing image" path that `IArchiveModifiable` exposes.Layout reminders for the image shape produced by `Qnx4Writer`: Block 0 (LBA 0): boot block — zeroed.Blocks 1-4: root directory cluster, 32 × 64-byte inode entries. Entry 0 = root self-reference (status=0x09), entries 1-2 = system files (.bitmap / .inodes, status=0x01), entries 3..31 = user files (status=0x01) or free (status=0x00).Block 5: `.bitmap` — 1 bit per block, LSB-first within each byte.Block 6: `.inodes` — overflow inode storage (unused by our writer).Block 7..: user file data, each file has a single contiguous extent rounded up to whole 512-byte blocks.Scope match with WORM: the modifier respects the same 29-user-file capacity (32 root slots minus 3 system entries). Add throws `NotSupportedException` with a "root cluster full" message when the root cluster has no free entry slot — the same boundary as `Qnx4Writer`'s capacity guard.Spec source: `linux/fs/qnx4/{qnx4.h,inode.c,dir.c,namei.c}`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a single file to the existing image. Allocates a contiguous extent from the `.bitmap`, writes the file data into it, then writes a new 64-byte inode into the first free root-cluster slot (entries 3..31). If a file with the same name already exists, it is removed first (its extent freed and dirent cleared) so the new entry replaces it cleanly. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file from the existing image. Locates the dirent in the root cluster, frees its extent in `.bitmap`, wipes the data blocks (when `wipeData` is true), and clears the inode status byte to zero (marking the slot free). |
+
+#### `Qnx4Reader`
+
+Reader for the QNX4 file system (1991-2001, QNX Software Systems Inc.). QNX4 uses 512-byte blocks and represents each file as a chain of contiguous extents — each extent is described by an `xtnt_t` record (first block + block count). On-disk layout (little-endian): Block 0 boot sector (variable signature) Block 1 root directory cluster (4 blocks of 64-byte inode entries) Inode entry (64 bytes per linux/fs/qnx4/qnx4.h's qnx4_inode_entry): +0x00 di_fname 16 bytes ASCII filename +0x10 di_size 4 bytes (LE) file size in bytes +0x14 di_first_xtnt 8 bytes — extent record: u32 xtnt_blk first block of extent u32 xtnt_size block count of extent +0x1C di_num_xtnts 4 bytes (LE) extra extent count +0x20 di_mode 2 bytes mode (uid|gid|perm) +0x22 di_uid 2 bytes +0x24 di_gid 2 bytes +0x26 di_ftime 4 bytes time +0x2A di_mtime 4 bytes +0x2E di_atime 4 bytes +0x32 di_ctime 4 bytes +0x36 di_zero 6 bytes +0x3C di_type 1 byte +0x3D di_status 1 byte file status (0x08=ACTIVE, 0x04=USED, 0x01=DAMAGED, 0x02=DESTROY) Spec source: linux/fs/qnx4/{qnx4.h,inode.c,namei.c} — kernel-side QNX4 driver maintained from 2.4 through 5.10.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx4Reader` | `Qnx4Reader(Stream stream)` |  |
+| `BlockSize` | `const int BlockSize` |  |
+| `Entries` | `IReadOnlyList<Qnx4Entry> Entries { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `ExtractTo` | `void ExtractTo(Qnx4Entry entry, Stream destination)` | Copies an entry's bytes into `destination` a block at a time, so an entry larger than a byte[] can hold is extracted like any other. |
+| `Extract` | `byte[] Extract(Qnx4Entry entry)` |  |
+
+#### `Qnx4Writer`
+
+Emits valid QNX4 file-system images (WORM — write-once, no in-place mutation). On-disk layout (matching what the Linux qnx4 driver expects): Inode status byte (offset 0x3D in 64-byte entry):`QNX4_FILE_USED = 0x01` — short-name file (≤ 16 bytes filename)`QNX4_FILE_LINK = 0x08` — long-name entry (uses next 2 slots) We use `0x01` for plain user files (16-byte short names) and `0x09` (USED|LINK) for the root inode itself — this matches the on-disk pattern produced by historical QNX4 systems and what the Linux `qnx4` driver validates. Spec source: `linux/fs/qnx4/{qnx4.h,inode.c,dir.c,namei.c}`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx4Writer` | `Qnx4Writer()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a single regular file to be written into the root directory. Names are truncated to 16 bytes (QNX4 short-name limit) and any path separators are stripped (we flatten — QNX4 WORM doesn't emit subdirs). |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the layout is settled from it before a byte is read. |
+| `WriteTo` | `void WriteTo(Stream output)` | Serialises the accumulated files into a QNX4 image. |
+
+### Namespace `FileSystem.Qnx6`
+
+[`Qnx6BlockMover`](#qnx6blockmover) · [`Qnx6Entry`](#qnx6entry) · [`Qnx6FormatDescriptor`](#qnx6formatdescriptor) · [`Qnx6Modifier`](#qnx6modifier) · [`Qnx6Reader`](#qnx6reader) · [`Qnx6Writer`](#qnx6writer)
+
+#### `Qnx6BlockMover`
+
+Moves a file's blocks inside a QNX6 volume and repoints its inode.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx6BlockMover` | `Qnx6BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the inode table and the root directory. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and the inode table's position from the superblock. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Qnx6Entry`
+
+Directory entry from a QNX6 filesystem.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx6Entry` | `Qnx6Entry()` |  |
+| `InodeNumber` | `uint InodeNumber { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `Qnx6FormatDescriptor`
+
+Descriptor for QNX6 (Neutrino) filesystem images. Magic 0x68191122 (LE) at file offset 0x2000. Read + R/W (Add/Remove): the writer (`Qnx6Writer`) emits paired superblocks (primary at 0x2000 + identical secondary mirror at the tail of the volume) — the power-safe contract — alongside a flat 128-byte inode array and 32-byte directory entries. The modifier (`Qnx6Modifier`) mutates that layout in place and re-mirrors the superblock to the new tail after each Add/Remove so the dual-superblock pairing remains byte-identical. Self-round-trips through `Qnx6Reader`. References: `https://www.kernel.org/doc/html/latest/filesystems/qnx6.html` — kernel documentation of the on-disk layout (dual superblocks)`https://github.com/torvalds/linux/tree/master/fs/qnx6` — Linux reference implementationQNX Neutrino `fs-qnx6.so` documentation (QNX Software Systems)
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx6FormatDescriptor` | `Qnx6FormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing QNX6 image. The modifier locates a free inode slot, lays down a contiguous data extent past the current high-water mark, writes the dirent into the single-block root directory, and re-mirrors the primary superblock to the new tail — the dual-superblock pairing is updated synchronously so the power-safe contract holds across the whole sequence. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Emits a fresh QNX6 image containing `inputs`. Files are flattened to leaf names (directory components dropped) — the Stage-1 reader walks a single-block root directory, so a flat layout matches what it can read back. The output is a complete image: boot region, primary superblock, inode table, root dir block, file data extents, and a mirror secondary superblock at the tail. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | The superblocks, inode table and directory blocks are structure; each file is the contiguous run its inode points at. Blocks no live inode points at are what a removal left behind. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing QNX6 image. Data blocks are zeroed (wipe contract), the inode slot is cleared, and trailing dirents are compacted into the freed slot so reads see no gap. The secondary superblock mirror is refreshed afterwards. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `Qnx6Modifier`
+
+In-place Add/Remove modifier for QNX6 (Neutrino) WORM images produced by `Qnx6Writer`. The on-disk layout we mutate is the one the writer lays down: primary superblock at 0x2000, a flat 128-byte inode array starting at the inode-table block pointed at by sb+0x50, root directory in inode 1's first-direct block as 32-byte dirents, and a mirrored secondary superblock at the last 512 bytes of the volume. The Power-Safe contract is respected literally: every mutation that changes any byte in the primary superblock window is followed by a verbatim copy of those 512 bytes to the secondary mirror at the tail. Adds that extend the volume re-locate the mirror to the new tail; removes never shrink the volume (the freed data blocks are zeroed but their span stays addressable for future allocation).Scope mirrors the reader's: Single-block root directory (32 dirents max — file count past that throws `NotSupportedException`).Direct-extent files only (one contiguous run starting at `di_block_ptr[0]`).Names > 27 bytes silently skipped, mirroring the writer's WORM behaviour and the reader's `name_len > 27` gate.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Appends a single file at the root. If a dirent with the same leaf name already exists it is removed (data zeroed, inode slot cleared, dirents compacted) before the new file is written — replace-by-name semantics matching every other R/W FS in the repo. |
+| `RemoveFile` | `static void RemoveFile(Stream image, string name)` | Removes a single file by leaf name. Data blocks are zeroed to wipe the content, the inode slot is cleared, and the trailing dirents are compacted so reads see no gap. |
+| `RemoveFiles` | `static void RemoveFiles(Stream image, IEnumerable<string> names)` | Removes multiple entries in one pass. Each name not found is silently skipped (matches every other modifier in the repo). |
+
+#### `Qnx6Reader`
+
+Reader for the QNX6 ("Neutrino") file system. QNX6 has a layered design: two superblocks at fixed offsets (primary at 0x2000, secondary at the end of the volume) for consistency checking, and a B-tree of "rootnodes" pointing to inode and longfilename data. On-disk layout (little-endian): Block 0 bootblock (8 KiB reserved) 0x2000 primary superblock (qnx6_super_block — 512 bytes) ... inode tree, data blocks Superblock (qnx6_super_block, linux/fs/qnx6/qnx6.h): +0x00 sb_magic u32 0x68191122 +0x04 sb_checksum u32 +0x08 sb_serial u64 +0x10 sb_ctime u32 creation time +0x14 sb_atime u32 last mount time +0x18 sb_flags u32 +0x1C sb_version1 u16 +0x1E sb_version2 u16 +0x20 sb_volumeid 16 volume UUID +0x30 sb_blocksize u32 e.g. 1024 +0x34 sb_num_inodes u32 +0x38 sb_free_inodes u32 +0x3C sb_num_blocks u32 +0x40 sb_free_blocks u32 +0x44 sb_num_levels u16 tree depth +0x46 sb_indir_levs u16 +0x48 sb_inode_root qnx6_root_node (40 bytes — size + 16 ptrs + 4 levels) Inode (128 bytes per qnx6_inode_entry): +0x00 di_size u64 +0x08 di_uid u32 +0x0C di_gid u32 +0x10 di_ftime u32 +0x14 di_mtime u32 +0x18 di_atime u32 +0x1C di_ctime u32 +0x20 di_mode u16 +0x22 di_ext_mode u16 +0x24 di_block_ptr[16] u32 direct +0x64 di_filelevels u8 +0x65 di_status u8 +0x66 di_unknown 14 Spec source: linux/fs/qnx6/{qnx6.h,super.c,inode.c,dir.c} (driver since kernel 2.6.39).
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx6Reader` | `Qnx6Reader(Stream stream)` |  |
+| `BlockSize` | `int BlockSize { get; }` |  |
+| `Entries` | `IReadOnlyList<Qnx6Entry> Entries { get; }` |  |
+| `Magic` | `uint Magic { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(Qnx6Entry entry)` |  |
+| `TryGetDataExtent` | `bool TryGetDataExtent(Qnx6Entry entry, out long offset, out long length)` | Where an entry's bytes live. Files this writer emits occupy one contiguous run from the inode's first block. Returns false for a directory or an inode with no data. |
+
+#### `Qnx6Writer`
+
+WORM writer for QNX6 (Neutrino) filesystem images. Emits a power-safe layout: the primary superblock at file offset 0x2000 plus an identical secondary mirror at the last 512 bytes of the volume. The dual-superblock pairing is the safety contract — a torn write to one copy leaves the other intact. On-disk image laid down by `Build`: Inode layout matches `Qnx6Reader`: inode 1 = root directory (size = bytes of dirents, first ptr = root dir block) inode 2..1+N = files (size = file length, first ptr = first data block) Field encoding is little-endian to match the reader's `MagicQnx6` probe (0x68191122 LE). Constraints (matching reader capability — see `Qnx6Reader`): • The reader walks a single directory block, so the writer caps the root directory at ⌊blockSize/32⌋ = 32 entries. • The reader skips dirents whose name_len > 27. The writer enforces that cap up front — entries with longer names are skipped, mirroring the reader's behaviour. (QNX6's longfile-pointer dirent form is documented in the spec but unreadable through the current Stage-1 reader, so emitting it would yield silently-dropped entries on round-trip.) • Files larger than one block are laid down as one contiguous run starting at the file's first-direct block pointer; the reader's Extract path reads `entry.Size` bytes from that offset, which spans the whole run.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Qnx6Writer` | `Qnx6Writer()` |  |
+| `MaxFiles` | `const int MaxFiles` |  |
+| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, FilePayload>> files)` | Materialises an image from payloads that may be streamed. |
+| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files)` | Builds a complete QNX6 image holding `files`. Order of entries in the resulting directory follows the order in `files`; duplicate names earn the same fate as the reader (first-match wins on read). Returns the image bytes ready to be written to disk or stream. |
+| `WriteTo` | `static void WriteTo(Stream output, IReadOnlyList<ValueTuple<string, FilePayload>> files)` | Writes the image into `output`: the blocks the filesystem populates, then each file's bytes at the block it was allocated. Only a non-seekable target has to materialise the image, so a seekable one is bounded by the disk rather than by what a byte[] can address. |
+
+### Namespace `FileSystem.Refs`
+
+[`RefsBlockMover`](#refsblockmover) · [`RefsExtentMap`](#refsextentmap) · [`RefsFormatDescriptor`](#refsformatdescriptor)
+
+#### `RefsBlockMover`
+
+Offline ReFS 3.x data mover. Raw bytes are rearranged first; allocation, stream metadata, and Block Refcount ownership are then committed as allocate-new -> repoint -> detach-old-reference -> release-unowned-old. Metadata checksum ancestry is refreshed to CHKP after each metadata commit.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `RefsBlockMover` | `RefsBlockMover(Stream image)` |  |
+| `AllocationBlockSize` | `int AllocationBlockSize { get; }` |  |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` |  |
+| `SupportsScatteredRelink` | `bool SupportsScatteredRelink { get; }` |  |
+| `GetMaximumExtentRuns` | `int GetMaximumExtentRuns(Stream image)` | Conservative global extent-run budget for interleave planning. It probes each current storage row and returns the minimum run count that fits without an outer B+ page split. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `PrepareResidentFiles` | `void PrepareResidentFiles(Stream image)` | Converts every non-empty resident file to the extent-backed long-value form before the planner runs, so small files participate in exactly the same physical layout operation as large files. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `UpdateAllocationScattered` | `void UpdateAllocationScattered(Stream image, string fileName, IReadOnlyList<long> oldBlockOffsets, IReadOnlyList<long> newBlockOffsets, IReadOnlySet<long> blocksLiveElsewhere)` |  |
+
+#### `RefsExtentMap`
+
+Enumerates the active ReFS byte layout. Free space is fail-closed: a gap is free only when covered and clear in the on-disk allocator. ReFS structures are emitted individually so a filesystem-specific metadata mover can place movable pages while fixed bootstrap anchors remain hard reservations.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `RefsFormatDescriptor`
+
+Microsoft ReFS (Resilient File System) volume descriptor. Read/list/extract follows metadata reachable from the active checkpoint. Offline layout writes are coordinated by the ReFS placement manager, which can relocate file data, live MSB+ metadata and checkpoint pages while preserving the format-fixed VBR/SUPB bootstrap anchors.
+
+Implements `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `RefsFormatDescriptor` | `RefsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `AnalyzeLayout` | `LayoutAnalysis AnalyzeLayout(Stream image)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
+### Namespace `FileSystem.Reiser4`
+
+[`Reiser4BlockMover`](#reiser4blockmover) · [`Reiser4FormatDescriptor`](#reiser4formatdescriptor) · [`Reiser4MasterSb`](#reiser4mastersb) · [`Reiser4Reader`](#reiser4reader) · [`Reiser4Reader.Entry`](#reiser4readerentry) · [`Reiser4Writer`](#reiser4writer)
+
+#### `Reiser4BlockMover`
+
+Moves a file's blocks inside a Reiser4 payload area and rewrites the directory entry that said where it started.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Reiser4BlockMover` | `Reiser4BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A block, which is what the directory counts in. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the reserved blocks and the directory, which is where the first file already sits. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call notes where one run has got to; a file split by the bitmaps it steps over is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the directory once and notes where every file is. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SettleDirectory` | `void SettleDirectory(Stream image)` | Writes each file's first block into the directory, once the pass is over. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `Reiser4FormatDescriptor`
+
+Read-only descriptor for Reiser4 filesystem images (successor to ReiserFS 3.6 — completely different on-disk layout). Surfaces the master superblock at offset 65536 and, when present, the format40 superblock that follows it, plus a structured metadata bundle and the raw image. Walking the twig-level B-tree is explicitly out of scope (multi-week effort). Magic: `"ReIsEr4"` at offset 65536 — master superblock `ms_magic[16]`. References: `https://archive.kernel.org/oldwiki/reiser4.wiki.kernel.org/` — archived Reiser4 wiki (format40 layout, plugin system)reiser4progs (`mkfs.reiser4` / `debugfs.reiser4`) — canonical userspace tooling`https://en.wikipedia.org/wiki/Reiser4` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Reiser4FormatDescriptor` | `Reiser4FormatDescriptor()` |  |
+| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Knobs the empty-filesystem writer actually honours. `VolumeLabel` is written into the master superblock label field (and the backup record) and surfaces through `fsck.reiser4` / our metadata readback; `ImageSize` drives `BlockCount` (4 KB blocks, clamped to the writer minimum). The 4 KB block size is fixed — the embedded mkfs.reiser4 templates are byte-exact 4096-byte captures — so it is intentionally not exposed. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Rewrites the volume with every file laid out contiguously from the start of the payload area. Each entry is spilled to scratch and the writer pulls it back, so the rebuild is not bounded by what a byte[] can hold. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Reports the volume's layout: the reserved blocks and the payload directory chain as metadata, then each file's blocks. A file's blocks are consecutive apart from the block-allocator bitmaps they step over. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros every byte no live file and no metadata block occupies. |
+
+#### `Reiser4MasterSb`
+
+Parses the Reiser4 master superblock at byte offset 65536 (16 * 4 KB) and the adjacent format40 superblock that immediately follows it. Read-only. Layout per `edward6/reiser4progs``plugin/format/format40/format40.h` and the kernel reiser4 source `plugin/disk_format/disk_format40.h`: Verified by: `https://github.com/edward6/reiser4/blob/master/vfs_ops.c` — `REISER4_MAGIC_OFFSET = 16 * 4096``https://github.com/edward6/reiser4progs/blob/master/plugin/format/format40/format40.h` — format40 layout + `"ReIsEr40FoRmAt"``fsck.reiser4` output: `"Master super block (16): magic: ReIsEr4 blksize: 4096 format: 0x0 (format40)"`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Reiser4MasterSb` | `Reiser4MasterSb()` |  |
+| `Format40Magic` | `static readonly byte[] Format40Magic` | "ReIsEr40FoRmAt" — 14 bytes, NUL-padded to 16. Format40 SB magic. |
+| `Format40StructSize` | `const int Format40StructSize` | Format40 superblock size when present. |
+| `MasterMagic` | `static readonly byte[] MasterMagic` | "ReIsEr4" — 7 bytes, NUL-padded to 16. Master magic. |
+| `MasterOffset` | `const long MasterOffset` | Disk byte offset of the master superblock. |
+| `MasterRawCapture` | `const int MasterRawCapture` | Reserved 480-byte "page-ish" slice we surface from the master block. |
+| `MasterStructSize` | `const int MasterStructSize` | Master SB size on disk (16 + 2 + 2 + 16 + 16). |
+| `BlockCount` | `ulong BlockCount { get; }` |  |
+| `BlockSize` | `ushort BlockSize { get; }` | Filesystem block size in bytes (4096 typical). |
+| `DiskPluginId` | `ushort DiskPluginId { get; }` | Disk-format plugin id (0 = format40). |
+| `FileCount` | `ulong FileCount { get; }` |  |
+| `Format40Present` | `bool Format40Present { get; }` | Whether a recognisable format40 superblock followed the master block. |
+| `Format40Raw` | `byte[] Format40Raw { get; }` | Raw 480-byte capture of the format40 superblock (or empty). |
+| `Format40Version` | `uint Format40Version { get; }` |  |
+| `FreeBlocks` | `ulong FreeBlocks { get; }` |  |
+| `Label` | `string Label { get; }` | Volume label (NUL-trimmed, ASCII). |
+| `MasterRaw` | `byte[] MasterRaw { get; }` | Raw 480-byte capture from the master block (0-padded if image was shorter). |
+| `MkfsId` | `uint MkfsId { get; }` |  |
+| `Policy` | `ushort Policy { get; }` |  |
+| `RootBlock` | `ulong RootBlock { get; }` |  |
+| `TreeHeight` | `ushort TreeHeight { get; }` |  |
+| `UuidHex` | `string UuidHex { get; }` | Pool UUID hex (32 hex chars, no dashes). |
+| `Valid` | `bool Valid { get; }` | True iff the master magic was recognised at offset 65536. |
+| `TryParse` | `static Reiser4MasterSb TryParse(ReadOnlySpan<byte> image)` | Best-effort parse. Never throws — invalid / short images return a sentinel instance with `Valid` == false. |
+
+#### `Reiser4Reader`
+
+Reads a Reiser4 image: the master superblock's label, UUID and block size, and the files a `Reiser4Writer` placed in the workbench-layout payload area. The reserved blocks of a workbench-written image are byte-exact `mkfs.reiser4` captures describing an empty storage tree, so there is no reiser4 tree here to walk. Files live past those blocks, announced by a marker in the master superblock's spare region and described by a chained directory — the layout `Reiser4Writer` documents. An image from a real `mkfs.reiser4` carries no marker and surfaces no entries; its storage tree (extent40 bodies keyed by file offset, cde40 directory units) is out of scope.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Reiser4Reader` | `Reiser4Reader(Stream stream, bool leaveOpen = true)` |  |
+| `MasterOffset` | `const long MasterOffset` | Byte offset of the master superblock: block 16 at a 4 KB block size. |
+| `BlockSize` | `int BlockSize { get; }` | Filesystem block size from the master superblock. |
+| `Entries` | `IReadOnlyList<Entry> Entries { get; }` | Files the payload area holds. Empty for an image without the marker. |
+| `Label` | `string Label { get; }` | Volume label from the master superblock. |
+| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `UuidHex` | `string UuidHex { get; }` | Volume UUID from the master superblock, as hex. |
+| `Valid` | `bool Valid { get; }` | True when the image carries a valid Reiser4 master superblock. |
+| `Dispose` | `void Dispose()` |  |
+| `EnumerateRuns` | `IEnumerable<ValueTuple<long, long>> EnumerateRuns(Entry entry)` | Where an entry's bytes are: one run per stretch of consecutive blocks, the block-allocator bitmaps stepped over exactly as `ExtractTo` steps over them. A file is not one contiguous run whenever a bitmap falls inside it. |
+| `ExtractTo` | `long ExtractTo(Entry entry, Stream destination)` | Writes `entry`'s contents into `destination`. A file's blocks are consecutive apart from any block-allocator bitmap they straddle, which the walk steps over exactly as the writer did. Returns the number of bytes written. |
+| `Extract` | `byte[] Extract(Entry entry)` | Reads a file's contents. Only valid below the array limit. |
+
+#### `Reiser4Reader.Entry`
+
+One file in the payload area: its name, first block and byte length.
+
+Implements `IEquatable<Entry>`.
 
-Walks a workbench-layout OpenVMS Files-11 ODS-2 volume and surfaces the user files held in 000000.DIR. Confirms the volume by checking the "workbench-layout" layout marker at byte 132 of the home block — when the marker is absent the reader returns no entries (the descriptor's generic header-surface path takes over). For each file the reader produces an `Entry` bundle containing the File-ID, name, logical size, and the in-memory file bytes (assembled by walking the File Header's retrieval pointers).
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Entry` | `Entry(string Name, ulong FirstBlock, long Size)` | One file in the payload area: its name, first block and byte length. |
+| `FirstBlock` | `ulong FirstBlock { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `Reiser4Writer`
+
+WORM (write-once-read-many) creator for an **empty** Reiser4 filesystem image that is byte-exact-compatible with what `mkfs.reiser4 -fffy` from `reiser4progs 1.2.2` produces, and that `fsck.reiser4` validates as `"FS is consistent."`. The image holds 25 reserved blocks at fixed positions (block size = 4 KB): 0..15 — jump-area / partition data (zero).16 — master superblock (`"ReIsEr4"` at offset 65536).17 — format40 superblock (`"ReIsEr40FoRmAt"` at offset 52).18 — block-allocator bitmap (4-byte adler32 + bit array).19..20 — journal header / footer (zero for an empty FS).21 — status block (`"ReiSeR4StATusBl"`).22 — superblock backup record.23 — storage-tree root (twig, level 2).24 — leaf containing the root-directory stat-data + ".", "..". Implementation strategy: we embed the seven non-zero reference blocks as resources captured byte-exact from a real `mkfs.reiser4` image, then patch in only the per-image fields: UUID (16 bytes, random)Label (≤ 16 bytes, optional)mkfs_id (4 bytes, random) — appears in 4 places: format40 SB, backup record, twig header, leaf header.block_count / free_blocks (in format40 SB and backup).Bitmap (block 18) — bits 0..24 set for the 25 reserved blocks plus filler bits for the unused tail of the bitmap range, then adler32 of the bitmap data prepended. Round-trips with `fsck.reiser4 -y` exit 0 and produces output identical to the reference image except for the random fields above.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `OpenVmsReader` | `OpenVmsReader(Stream image)` |  |
-| `OpenVmsReader` | `OpenVmsReader(byte[] image)` |  |
-| `Entries` | `List<Entry> Entries { get; }` | User entries surfaced from 000000.DIR (skips reserved FIDs 1, 2, 4). |
-| `Image` | `byte[] Image { get; }` | Convenience accessor over the volume bytes (read-only). |
-| `IsCwbVolume` | `bool IsCwbVolume { get; }` | Records that the volume's home block carries the workbench-layout layout marker. |
-| `AssembleFileBytes` | `static byte[] AssembleFileBytes(byte[] image, OpenVmsFileHeader fh)` | Reassembles file bytes from `fh`'s retrieval pointers. |
-| `Extract` | `byte[] Extract(Entry entry)` | Extracts the bytes for `entry` by walking its retrieval pointers. |
-| `ReadFileHeader` | `static OpenVmsFileHeader ReadFileHeader(byte[] image, int fileId)` | Reads a File Header from INDEXF.SYS by File-ID number (1-based). |
+| `Reiser4Writer` | `Reiser4Writer()` |  |
+| `BlockSize` | `const int BlockSize` | Filesystem block size — 4 KB is the only supported value. Reiser4 theoretically supports 512 / 1024 / 2048 / 4096 / 8192, but the embedded templates are 4096-byte exact captures. |
+| `MinBlockCount` | `const ulong MinBlockCount` | Minimum block count we'll emit. mkfs.reiser4 itself rejects images below ~750 blocks, but we round up to 4096 (= 16 MB) to match the reference capture and avoid bitmap-truncation edge cases. |
+| `BlockCount` | `ulong BlockCount { get; set; }` | Total filesystem size in 4 KB blocks. Clamped to `MinBlockCount`. |
+| `Label` | `string Label { get; set; }` | Customisable label written to the master SB (NUL-padded to 16 bytes; longer strings are truncated; null = empty/zero). |
+| `MkfsId` | `uint? MkfsId { get; set; }` | Optional 32-bit mkfs identifier. When null, a random value is drawn from `Shared`. |
+| `Uuid` | `byte[] Uuid { get; set; }` | Optional 16-byte UUID. When null, a random Guid is used. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a regular file to the payload area. |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are pulled from `openStream` as the image is written. |
+| `Build` | `byte[] Build()` | Builds the image fully in memory and returns the byte array. For block counts above ~32 K the result will be tens of MB; prefer the streaming overload when caller-side allocation matters. |
+| `EstimateBlockCount` | `static ulong EstimateBlockCount(IEnumerable<long> fileSizes)` | Smallest block count that holds `fileSizes`: the reserved blocks, the directory chain, every file's data blocks, and the bitmap blocks interleaved among them. |
+| `Write` | `void Write(Stream output)` | Streams the full image into `output`. Writes `BlockCount`×4096 bytes and leaves the stream positioned at the end. |
 
-#### `OpenVmsReader.Entry`
+### Namespace `FileSystem.ReiserFs`
 
-One user-visible directory entry surfaced by the reader.
+[`ReiserFsBlockMover`](#reiserfsblockmover) · [`ReiserFsEntry`](#reiserfsentry) · [`ReiserFsFormatDescriptor`](#reiserfsformatdescriptor) · [`ReiserFsReader`](#reiserfsreader) · [`ReiserFsWriter`](#reiserfswriter)
 
-Implements `IEquatable<Entry>`.
+#### `ReiserFsBlockMover`
+
+Moves a file's blocks inside a ReiserFS volume, repoints the pointers that name them, and moves the allocation with them.
+
+Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Entry` | `Entry(int FileId, ushort Sequence, string Name, long Size)` | One user-visible directory entry surfaced by the reader. |
-| `FileId` | `int FileId { get; init; }` |  |
+| `ReiserFsBlockMover` | `ReiserFsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the superblock, journal and bitmaps. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` |  |
+
+#### `ReiserFsEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ReiserFsEntry` | `ReiserFsEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `LastModified` | `DateTime? LastModified { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
-| `Sequence` | `ushort Sequence { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `OpenVmsVolume`
+#### `ReiserFsFormatDescriptor`
 
-Random-access view of a workbench-layout volume. Everything the reader needs to enumerate files — the home block, BITMAP.SYS, INDEXF.SYS and the root directory — lives in the fixed metadata prefix, so the volume is recognised and listed from a few hundred kilobytes however large it is. File contents are then copied straight out of the backing stream, never materialised. This is the path the descriptor uses. `OpenVmsReader` keeps the whole-image API for the in-place modifier, which works on volumes small enough to hold in an array.
+R/W descriptor for ReiserFS v3.6 filesystem images (superblock at offset 65536, R5 directory hash, 4 KB blocks). References: `https://github.com/torvalds/linux/tree/v6.6/fs/reiserfs` — Linux reference implementation (v6.6 LTS tree; the driver was removed from later kernels)reiserfsprogs (`mkreiserfs` / `debugreiserfs`) — canonical userspace tooling`https://en.wikipedia.org/wiki/ReiserFS` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ReiserFsFormatDescriptor` | `ReiserFsFormatDescriptor()` |  |
+| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` | ReiserFS v3.6 filesystem image — R/W. The writer emits a real spec-compliant multi-leaf S+tree image (superblock at +65536, R5-hashed directory entries, INDIRECT items with dedicated data blocks for file bodies > 1 KB, internal pages above leaves). `IArchiveModifiable` Add tries a GENUINE in-place splice first (`ReiserFsInPlaceAdder`): for a single-leaf (tree_height 2) image it allocates a fresh objectid, inserts the file's STAT_DATA + DIRECT/INDIRECT items plus the R5-hashed dirent into the root leaf, appends any INDIRECT data blocks past the tree, and updates the bitmap / block counts — leaving every existing INDIRECT data block byte-identical at its original offset. Cases the in-place path does not handle (multi-leaf descent / split, nested sub-directory targets, replace-by-name, leaf overflow) fall back to a read-modify-rebuild via `ReiserFsWriter`; Remove always rebuilds. Both paths pass reiserfsck. |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The one tunable the writer honours: the volume label written into the superblock `s_label` field (16 bytes) via `Label` and read back as `ReiserFsReader.Label`. The 4 KB block size and R5 hash are fixed by the v3.6 layout, so they are not exposed. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces, on name collision) the given files inside an existing ReiserFS image. Routed through `ReiserFsModifier` which does the full read-modify-rebuild via `ReiserFsWriter`. |
+| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
+| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation. ReiserFS v3.6 has NO block checksums by design, so file bodies are fully streamable. Bodies above the writer's DIRECT/tail threshold (1 KiB) become INDIRECT items backed by dedicated data blocks: pass 1 builds the S+tree with those data-block runs left zero; pass 2 seeks to each run and copies its bytes from `OpenStream` in 64 KiB chunks. Tail-packed bodies ≤ 1 KiB live inside shared leaves, so the writer reads those small bodies up front (a bounded read). The output is byte-identical to `Create` for the same inputs. Falls back to the buffered default on a non-seekable target. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware ReiserFS v3.6 defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. The writer always emits a fresh contiguous-from-start single-leaf image (superblock at +65536, root SD + DIRENTRY + per-file SD/DIRECT items, R5-hashed key ordering). |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing ReiserFS image. The rebuild always starts from zeroed bytes so the removed file data leaves no forensic trace. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+
+#### `ReiserFsReader`
+
+Reads a ReiserFS v3 filesystem image. Field offsets follow the Linux kernel `struct reiserfs_super_block` (see `ReiserFsWriter` for the full offset table).
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `OpenVmsVolume` | `OpenVmsVolume(Stream image, bool leaveOpen = true)` |  |
-| `Entries` | `IReadOnlyList<Entry> Entries { get; }` | User entries surfaced from 000000.DIR. |
-| `IsCwbVolume` | `bool IsCwbVolume { get; }` | Records that the volume's home block carries the workbench-layout layout marker. |
+| `ReiserFsReader` | `ReiserFsReader(Stream stream, bool leaveOpen = true)` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
+| `Entries` | `IReadOnlyList<ReiserFsEntry> Entries { get; }` |  |
+| `Label` | `string Label { get; }` | Volume label from the superblock `s_label` field (16 bytes, NUL-trimmed ASCII). |
 | `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
-| `Metadata` | `byte[] Metadata { get; }` | The fixed metadata prefix, or as much of it as the image holds. |
-| `CopyTo` | `void CopyTo(long offset, Stream destination, long count)` | Copies `count` bytes at `offset` into `destination`. |
 | `Dispose` | `void Dispose()` |  |
-| `ExtractTo` | `long ExtractTo(Entry entry, Stream destination)` | Copies `entry`'s contents into `destination` by walking its retrieval pointers. Returns the number of bytes written. |
-| `ReadFileHeader` | `OpenVmsFileHeader ReadFileHeader(int fileId)` | Reads the File Header for `fileId` out of INDEXF.SYS. |
+| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(ReiserFsEntry entry)` | Where on disk `entry`'s bytes actually sit, as runs of whole blocks, along with the byte offset of the first pointer that names each run. |
+| `ExtractTo` | `long ExtractTo(ReiserFsEntry entry, Stream destination)` | Writes `entry`'s body into `destination`, one item at a time. Returns the byte count. |
+| `Extract` | `byte[] Extract(ReiserFsEntry entry)` |  |
+
+#### `ReiserFsWriter`
+
+Writes a SPEC-COMPLIANT ReiserFS v3.6 filesystem image. Multi-leaf S+tree with internal pages, R5-hashed dirents, DIRECT items for small file bodies and INDIRECT items (block-pointer arrays referencing dedicated data blocks laid out past the tree) for large bodies. Layout matches what reiserfsprogs' make_sure_root_dir_exists + reiserfs_add_entry would produce.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ReiserFsWriter` | `ReiserFsWriter()` |  |
+| `Label` | `string Label { get; set; }` | Volume label written into the superblock `s_label` field (16 bytes, NUL-padded; longer strings are truncated). Defaults to `"worm"` to match the historical writer output. |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file. ReiserFS v3.6 carries NO block checksums (see the header note), so file bodies are fully streamable. Bodies up to `MaxDirectBody` bytes are tail-packed as DIRECT items inside a shared leaf, so those small streaming entries are read in full up front (a bounded ≤1 KiB read) and treated as a normal `AddFile`. Bodies above the threshold become INDIRECT items backed by dedicated data blocks; their bytes are pulled from `openStream` in 64 KiB chunks during `BuildToStreaming` and never buffered as a `byte[]`. The on-disk image is byte-identical to `WriteTo` for the same inputs. |
+| `BuildToStreaming` | `void BuildToStreaming(Stream output)` | Two-pass streaming write: pass 1 builds the complete image byte array with INDIRECT streaming bodies left zero (recorded into a sink); pass 2 seeks to each body's contiguous data-block run and copies it from the opener in 64 KiB chunks. ReiserFS v3.6 has no block checksums, so the emitted bytes are identical to `WriteTo` for the same inputs — only WHERE the body bytes originate changes. Small (≤ `MaxDirectBody`) bodies were already read up front by `AddStreamingFile` and ride the classic in-leaf DIRECT path. Requires a writable, seekable stream. |
+| `WriteTo` | `void WriteTo(Stream output)` | When non-null, every INDIRECT streaming file's (absolute data byte-offset, byte length, opener) is recorded here during `WriteTo` so `BuildToStreaming` can post-fill the data blocks. Null in the classic buffered path. |
+
+### Namespace `FileSystem.RomFs`
+
+[`RomFsBlockMover`](#romfsblockmover) · [`RomFsEntry`](#romfsentry) · [`RomFsExtentMap`](#romfsextentmap) · [`RomFsFormatDescriptor`](#romfsformatdescriptor) · [`RomFsModifier`](#romfsmodifier) · [`RomFsReader`](#romfsreader) · [`RomFsRecordMap`](#romfsrecordmap) · [`RomFsRecordMap.Record`](#romfsrecordmaprecord) · [`RomFsWriter`](#romfswriter)
+
+#### `RomFsBlockMover`
+
+Moves whole ROMFS records and rewrites whatever pointed at them.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `RomFsBlockMover` | `RomFsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A record starts on a sixteen-byte boundary, and so does its data. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a record may occupy: past the superblock. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the fields naming the run it is given and leaves the rest of the volume alone. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A record may be held outside the image while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads every chain once and notes each field that names a record. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SettleSuperblock` | `void SettleSuperblock(Stream image, long contentEnd)` | Writes the size the superblock records and takes its checksum again. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `RomFsEntry`
+
+Represents a single entry (file or directory) in a ROMFS image.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `RomFsEntry` | `RomFsEntry()` |  |
+| `DataOffset` | `long DataOffset { get; init; }` | Absolute byte offset of this entry's data in the image stream. |
+| `HeaderOffset` | `long HeaderOffset { get; init; }` | Absolute byte offset of this entry's 16-byte file header (which is followed by the null-terminated, 16-byte-aligned name and then the data). The region [HeaderOffset, DataOffset) holds live metadata that must never be treated as free space. |
+| `IsDirectory` | `bool IsDirectory { get; init; }` | True when this entry represents a directory. |
+| `Name` | `string Name { get; init; }` | Full path within the filesystem (e.g. "etc/config.txt"). |
+| `Size` | `int Size { get; init; }` | Size of the file data in bytes (0 for directories). |
+
+#### `RomFsExtentMap`
+
+Walks a Linux ROMFS (romfs v1) image and yields its actual on-disk byte layout. ROMFS is a packed, read-only image: the superblock is followed by a chain of file records, each consisting of a 16-byte header, a null-terminated 16-byte-aligned name, and (for regular files) the data padded to a 16-byte boundary. Every header+name region — including the "." and ".." records that thread a directory's child chain — is emitted as `MetadataReserved` so a free-space wiper never mistakes live metadata for a gap. File data is emitted as `Used`. The 16-byte alignment padding after each file's data and any trailing slack are left uncovered, so the caller treats them as `Free`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `RomFsFormatDescriptor`
+
+R/W descriptor for Linux ROMFS images — the "-rom1fs-" packed read-only filesystem used for boot/initrd media. References: `https://www.kernel.org/doc/html/latest/filesystems/romfs.html` — kernel documentation — includes the complete on-disk layout`https://github.com/torvalds/linux/tree/master/fs/romfs` — Linux reference implementation`genromfs` — the canonical image-builder tool
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `RomFsFormatDescriptor` | `RomFsFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the ROMFS writer honours: the volume name stored in the superblock right after the "-rom1fs-" magic. ROMFS is a packed read-only image with no allocation-unit knob. An empty label falls back to the writer default ("romfs"). |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing RomFs image. Uses `RomFsModifier` for in-place append. Falls back to rebuild if the in-place path fails. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Defragments a RomFs image. Falls back to rebuild since ROMFS entries are tightly packed with inline data — in-place reordering is complex. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing RomFs image. ROMFS entries are inline with headers + data, so unlinking the first entry requires rebuilding. We use rebuild for Remove to handle all edge cases reliably. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros the unused space in a ROMFS image: the 16-byte alignment padding after each file's data and any trailing slack before the image's declared full size. ROMFS is a packed, read-only image — every file's data is stored byte-exact (no cluster rounding), so there is no cluster tip to wipe; cluster-tip wiping is therefore not applicable and is a no-op here. All file headers, names and live data are reported as live extents by the extent map, so the generic wiper only touches genuine gaps. |
+
+#### `RomFsModifier`
+
+In-place ROMFS modifier — performs O(touched bytes) random-access I/O against a ROMFS image. AddFile appends a new entry at the end of the image and patches the last sibling's "next" pointer to chain to it. RemoveFile unlinks the entry from the sibling chain. Superblock size and checksum are updated.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file at the root level of an existing ROMFS image. The new entry is appended at the end of the image and linked into the root directory's sibling chain. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name)` | Removes a named file from the root level of a ROMFS image. Unlinks it from the sibling chain. Returns false if not found. |
+
+#### `RomFsReader`
+
+Reads Linux ROMFS filesystem images (romfs v1). Magic: "-rom1fs-" at offset 0. All multi-byte integers are big-endian.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `RomFsReader` | `RomFsReader(Stream stream)` | Parses a ROMFS image from `stream`. Throws `InvalidDataException` on bad magic or truncated data. |
+| `Entries` | `IReadOnlyList<RomFsEntry> Entries { get; }` | All entries (files and directories) discovered in the image. |
+| `VolumeName` | `string VolumeName { get; }` | Volume name read from the superblock. |
+| `Extract` | `byte[] Extract(RomFsEntry entry)` | Extracts the data for a regular file entry. |
+
+#### `RomFsRecordMap`
+
+Describes a ROMFS image one whole record at a time — header, name and, for a regular file, the data that follows it.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | The layout a defragmentation pass plans against. |
+| `FirstRecord` | `static long FirstRecord(ImageAccessor data)` | Where the first record sits: straight after the superblock. |
+| `Records` | `static IReadOnlyList<Record> Records(Stream image)` | Every record of the volume, in the order the chains reach them. |
+
+#### `RomFsRecordMap.Record`
+
+One record of the volume.
+
+Implements `IEquatable<Record>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Record` | `Record(long Offset, long Length, int Type, string Name)` | One record of the volume. |
+| `Length` | `long Length { get; init; }` | Header, name and data, padded as the format pads them. |
+| `Name` | `string Name { get; init; }` | The record's own name, which need not be unique. |
+| `Offset` | `long Offset { get; init; }` | Where the record's header starts. |
+| `Type` | `int Type { get; init; }` | Low three bits of the header's first word. |
+
+#### `RomFsWriter`
 
-#### `OpenVmsWriter`
+Builds a Linux ROMFS filesystem image from a set of files. Produces a valid romfs v1 image with "-rom1fs-" magic.
 
-Emits a fresh OpenVMS Files-11 (ODS-2) volume to the `OpenVmsLayout` geometry. The resulting image carries: A real Files-11 home block at LBN 1 with "DECFILE11A " at byte 0x1E8, structure level 0x0202, cluster size 1, owner UIC [1,1], BITMAP.SYS LBN field set, max-files field set, plus the workbench-layout layout marker at byte 132 so our reader / modifier recognise the geometry.BITMAP.SYS at LBN 2..17 with metadata LBNs pre-marked allocated.INDEXF.SYS at LBN 18..273 (256 reserved File-IDs); File-IDs 1 (INDEXF.SYS), 2 (BITMAP.SYS) and 4 (000000.DIR) are populated with retrieval pointers covering their own LBNs.000000.DIR at LBN 274 containing one directory entry per caller-supplied file.Caller files laid out contiguously starting at LBN 275. Honest scope: this volume is NOT OpenVMS-mountable — the FH ident-area metadata, the FILECHAR / RECATTR fields, and the home-block HM2$W_CHECKSUM1/CHECKSUM2 surfaces are emitted as zeros. What it IS: a layout our reader and in-place modifier can round-trip end-to-end.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `OpenVmsWriter` | `OpenVmsWriter()` |  |
-| `BuildTo` | `void BuildTo(Stream output, IReadOnlyList<ValueTuple<string, FilePayload>> files, string volumeLabel = "SCRATCH")` | Emits the volume to `output`: the fixed metadata prefix first, then every file copied into the run the allocator gave it. Only the prefix and one copy buffer are ever resident, so the volume is bounded by the target's capacity rather than by `MaxLength`. |
-| `Build` | `byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeLabel = "SCRATCH")` | Builds the volume image in memory. Throws `IOException` when inputs don't fit. |
-| `NormalizeName` | `static string NormalizeName(string raw)` | Normalises a caller-supplied file name to the 24-char ASCII slot in `OpenVmsDirectory`. Forward slashes and backslashes are collapsed to dots so caller paths like "subdir/file.txt" still fit (ODS-2 directories are flat — we deliberately don't fabricate a subdirectory tree). |
+| `RomFsWriter` | `RomFsWriter(Stream output, bool leaveOpen = false)` | Initializes a new writer targeting `output`. |
+| `AddFile` | `void AddFile(string path, byte[] data)` | Adds a file at the given path (forward-slash separated, no leading slash). |
+| `AddStreamingFile` | `void AddStreamingFile(string path, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the layout is settled from it before a byte is read. |
+| `Dispose` | `void Dispose()` |  |
+| `Finish` | `void Finish(string volumeName = "romfs")` | Builds the ROMFS image and writes it to the output stream. |
 
-### Namespace `FileSystem.Os9Rbf`
+### Namespace `FileSystem.Rt11`
 
-[`Os9RbfBlockMover`](#os9rbfblockmover) · [`Os9RbfExtentMap`](#os9rbfextentmap) · [`Os9RbfFormatDescriptor`](#os9rbfformatdescriptor) · [`Os9RbfModifier`](#os9rbfmodifier) · [`Os9RbfReader`](#os9rbfreader) · [`Os9RbfReader.FileEntry`](#os9rbfreaderfileentry) · [`Os9RbfReader.Volume`](#os9rbfreadervolume) · [`Os9RbfWriter`](#os9rbfwriter)
+[`Rad50`](#rad50) · [`Rt11BlockMover`](#rt11blockmover) · [`Rt11ExtentMap`](#rt11extentmap) · [`Rt11FormatDescriptor`](#rt11formatdescriptor) · [`Rt11Modifier`](#rt11modifier) · [`Rt11Reader`](#rt11reader) · [`Rt11Reader.FileEntry`](#rt11readerfileentry) · [`Rt11Reader.Volume`](#rt11readervolume) · [`Rt11Writer`](#rt11writer)
 
-#### `Os9RbfBlockMover`
+#### `Rad50`
 
-In-place OS-9 RBF block mover. Moves sector-aligned extents within an OS-9 image and patches the file descriptor's segment list so the file remains reachable at its new location. Each OS-9 file has a File Descriptor (FD) sector containing a segment list of up to 48 (start-LSN, sector-count) pairs. Moving a file's data requires updating the segment list in the FD sector and also adjusting the allocation bitmap.
+RAD-50 (also written "Radix-50") encoding used by DEC PDP-11 operating systems for filenames. Three printable characters from a 40-symbol alphabet are packed into one 16-bit word: `word = c1*40^2 + c2*40 + c3`. The alphabet is: space, A-Z, '$', '.', '0'-'9' (40 symbols, indices 0-39).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `DecodeName6` | `static string DecodeName6(ushort high, ushort low)` | Decodes a (high, low) word pair into a 6-char filename stem (trailing spaces trimmed). |
+| `DecodeType3` | `static string DecodeType3(ushort type)` | Decodes a 3-char extension word (trailing spaces trimmed). |
+| `DecodeWord` | `static string DecodeWord(ushort word)` | Decodes a 16-bit RAD-50 word into three characters. Returns trailing spaces when fewer than three meaningful symbols were packed. |
+| `EncodeName6` | `static ValueTuple<ushort, ushort> EncodeName6(string name)` | Encodes a 6-character RT-11 filename stem into two RAD-50 words. |
+| `EncodeType3` | `static ushort EncodeType3(string type)` | Encodes a 3-character RT-11 file type / extension into one RAD-50 word. |
+| `EncodeWord` | `static ushort EncodeWord(string text, int startIndex)` | Encodes the first three characters of `text` (case-insensitive, shorter strings are space-padded) into a single PDP-11 word. |
+| `IsValid` | `static bool IsValid(string text)` | Returns true if `text` contains only characters representable in the RAD-50 alphabet (case-insensitive). |
+
+#### `Rt11BlockMover`
+
+In-place RT-11 block mover. Moves block-aligned extents within an RT-11 image and patches the directory segment entry's start-block position so the file remains reachable at its new location. RT-11 files are stored contiguously in 512-byte blocks. The directory segment chain contains entries whose start-block is implicit: it's computed as a running sum of prior entry sizes from the segment's StartDataBlock. Moving a file requires rewriting the directory entries so the E_MPTY gap before the file absorbs the old location and a new E_MPTY gap replaces the space freed at the old position.Because RT-11's start-block is implicit (not stored in the entry), we accomplish the "metadata patch" by rebuilding the directory segment with adjusted E_MPTY entries around the moved file.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Os9RbfBlockMover` | `Os9RbfBlockMover()` |  |
-| `DataOrigin` | `long DataOrigin { get; }` | Byte offset where user data typically begins (past ID + bitmap). |
-| `UnitSize` | `int UnitSize { get; }` | Allocation unit size (one 256-byte sector). |
-| `LsnToOffset` | `long LsnToOffset(int lsn)` | Converts a sector (LSN) number to a byte offset. |
+| `Rt11BlockMover` | `Rt11BlockMover()` |  |
+| `DataOrigin` | `long DataOrigin { get; }` | Byte offset where data begins (past boot + home + dir). |
+| `UnitSize` | `int UnitSize { get; }` | Allocation unit size (512-byte block). |
+| `BlockToOffset` | `long BlockToOffset(int block)` | Converts a block number to a byte offset. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OffsetToLsn` | `int OffsetToLsn(long offset)` | Converts a byte offset to a sector (LSN) number. |
+| `OffsetToBlock` | `int OffsetToBlock(long offset)` | Converts a byte offset to a block number. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `Os9RbfExtentMap`
+#### `Rt11ExtentMap`
 
-Walks a Microware OS-9 RBF disk image (256-byte sectors, big-endian fields) and yields the actual on-disk byte layout — the identification sector + allocation bitmap as `MetadataReserved`, the root directory FD + directory data sectors as `MetadataReserved`, every per-file FD sector as `MetadataReserved`, every (start, count) segment in a file's segment list as a contiguous `Used` extent, and the rest as `Free`.
+Walks a DEC RT-11 disk image (RX01 reference geometry — 256 256 bytes, 512-byte blocks) and yields the actual on-disk byte layout — the boot block + home block as `MetadataReserved`, every directory segment as `MetadataReserved`, every permanent file as a `Used` contiguous run (RT-11 stores files contiguously by design), and every E_MPTY directory slot's referenced range as `Free`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `Os9RbfFormatDescriptor`
+#### `Rt11FormatDescriptor`
 
-Read+write descriptor for Microware OS-9 RBF (Random-Block-File) disk images. OS-9 was a multi-tasking real-time OS released in 1979 by Microware Systems; it shipped on the Tandy CoCo, Sharp MZ-2500, embedded systems and later as OS-9/68000 and OS-9000. The writer emits a 35-track DSDD CoCo reference geometry (~315 KB); the reader parses any RBF image whose root directory descriptor is reachable via the identification sector. References: Microware "OS-9 Technical Reference" (RBF chapter) — the canonical RBF on-disk description`https://sourceforge.net/projects/nitros9/` — NitrOS-9 — maintained open-source OS-9/6809 with an RBF implementation + ToolShed tooling`https://en.wikipedia.org/wiki/OS-9` — Wikipedia article
+Read+write descriptor for DEC RT-11 disk images. RT-11 was DEC's flagship PDP-11 single-user operating system from 1973 onwards and remains the most common filesystem found on PDP-11 disk image dumps. Files are 6.3 RAD-50 encoded names stored contiguously in 512-byte blocks; the writer emits a canonical RX01 single-density 8" floppy image (~256 KB). References: DEC "RT-11 Volume and File Formats Manual" (AA-PD6PA-TC) — canonical directory/volume spec (archived at Bitsavers)`https://en.wikipedia.org/wiki/RT-11` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Os9RbfFormatDescriptor` | `Os9RbfFormatDescriptor()` |  |
+| `Rt11FormatDescriptor` | `Rt11FormatDescriptor()` |  |
 | `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
@@ -7596,128 +11703,121 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for Microware OS-9 RBF creation. The writer emits the canonical 35-track DSDD CoCo reference geometry; only the volume label stored at LSN 0 (DD.NAM, 32-byte high-bit-terminated string) is per-volume tunable. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for DEC RT-11 creation. The home block carries a 12-char ASCII volume identifier (offset 0x1D8) and the directory area's size is configurable from 1..31 segments — each segment holds 71 entries plus a terminator, so dirSegments controls the maximum file count. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing OS-9 RBF image. Uses `Os9RbfModifier` for true O(touched bytes) random-access I/O — only the identification sector, the bitmap, the root dir's FD + extents, and the new file's FD + data sectors are read or written. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing RT-11 image. Uses `Rt11Modifier` for true O(touched bytes) random-access I/O — only the directory segment(s) and the file's contiguous data run are read or written. |
 | `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware OS-9 RBF defragmentor. Tries planner-driven in-place path first, falls back to rebuild path on error. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the OS-9 RBF root directory and yields the actual on-disk byte layout — identification sector + bitmap + per-file FD sectors as `MetadataReserved`, every (start, count) segment in each file's segment list as a contiguous `Used` extent, and unallocated sectors as `Free`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware RT-11 defragmentor. Tries planner-driven in-place path first, falls back to rebuild path on error. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the RT-11 directory segment chain and yields the actual on-disk byte layout — boot/home blocks + directory segments as `MetadataReserved`, every permanent file as a `Used` contiguous 512-byte block run (RT-11 always stores files contiguously), and E_MPTY directory slots' ranges as `Free`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing OS-9 RBF image. Uses `Os9RbfModifier` for O(touched bytes) random-access I/O. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing RT-11 image. Uses `Rt11Modifier` for O(touched bytes) random-access I/O. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the OS-9 RBF image: unallocated sectors and the sector-tip slack between a file's logical size (FD.SIZ) and the end of its last allocated 256-byte sector. Cluster-tip wiping is applied only to files whose data is a single contiguous segment; a file spread across several segments keeps its tip in its final segment only, which the per-segment extent map cannot pinpoint by total size alone, so such files are omitted from the tip pass to avoid clobbering live sectors. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in an RT-11 image: the blocks behind E_MPTY directory slots and any trailing region not claimed by a permanent file or the boot/home/directory metadata. Driven by the generic `UnusedSpaceWiper` over the RT-11 extent map. Cluster tips are not applicable: RT-11 stores files contiguously and records only a 512-byte block count — there is no sub-block logical length, so a file occupies exactly its allocated block run with no slack tail. `wipeClusterTips` is therefore forced off. |
 
-#### `Os9RbfModifier`
+#### `Rt11Modifier`
 
-Random-access in-place modifier for Microware OS-9 RBF disk images. Reads and writes only the identification sector, the allocation bitmap, the root directory's FD + extents, the new file's FD sector, and the new file's data segments — never the whole image. Lets the host operate on multi-megabyte underlying streams without paging the entire disk into memory. Limitations: only the root directory is mutated (no nested dirs); file data is allocated as a single contiguous segment (no fragmentation recovery — fails with `InvalidOperationException` when the largest free run is too small).
+Random-access in-place modifier for DEC RT-11 disk images. Files are stored contiguously in 512-byte blocks; free space is tracked by E_MPTY ("empty area") entries within the directory segment chain itself (no separate bitmap). Add operations split an empty-area entry; remove operations turn the file's slot back into an empty-area entry and merge with neighbours.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to an existing image. Caller is responsible for ensuring the name does not already exist (use `RemoveFile` first for replace-by-name semantics). |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file. Returns true on success. Frees the file's FD and data segments via the bitmap, and zeroes the directory entry. When `wipeData` is true, the file's data sectors and FD sector are zeroed as well. |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to an existing RT-11 image. Caller is responsible for ensuring the name does not already exist (use `RemoveFile` first for replace-by-name semantics). The file is placed in the lowest empty-area run large enough to hold its contiguous data. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image. Returns true if found and removed. When `wipeData` is true, the data blocks are zeroed. Adjacent empty-area entries are merged with the freed slot. |
 
-#### `Os9RbfReader`
+#### `Rt11Reader`
 
-Reader for Microware OS-9 RBF (Random-Block-File) disk images. The format was used on the Tandy CoCo (OS-9 Level 1/2), Sharp MZ-2500, Atari MSX-OS-9 machines, and embedded systems running OS-9/68000 and OS-9000. Sector size is 256 bytes; multi-byte fields are big-endian. The directory tree is walked recursively: files in subdirectories surface with their full slash-separated path and each intermediate directory is reported as its own entry.
+Reader for DEC RT-11 disk images. Files are described by a chain of 1024-byte directory segments starting at block 6; each entry references a starting block + length in 512-byte blocks. Filenames are 6.3 RAD-50 encoded.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Os9RbfReader` | `Os9RbfReader()` |  |
-| `Extract` | `static byte[] Extract(Volume v, FileEntry e)` | Returns the file's byte contents, honouring its FD.SIZ length. |
-| `Read` | `static Volume Read(ReadOnlySpan<byte> image)` | Parses an OS-9 RBF image (root directory only). |
+| `Rt11Reader` | `Rt11Reader()` |  |
+| `Extract` | `static byte[] Extract(Volume v, FileEntry entry)` | Returns the bytes occupied by `entry` on disk (always a multiple of 512 bytes, no trailing-byte length information is stored in RT-11). |
+| `Read` | `static Volume Read(ReadOnlySpan<byte> image)` | Parses an RT-11 image. Throws `InvalidDataException` if the home-block signature isn't present. |
 
-#### `Os9RbfReader.FileEntry`
+#### `Rt11Reader.FileEntry`
 
-One file/directory entry parsed from a directory sector.
+One file entry parsed from an RT-11 directory segment.
 
 Implements `IEquatable<FileEntry>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FileEntry` | `FileEntry(string Name, int FdLsn, long ByteLength, bool IsDirectory, DateTime? Created)` | One file/directory entry parsed from a directory sector. |
+| `FileEntry` | `FileEntry(string Name, string NameStem, string Extension, int StartBlock, int LengthBlocks, long ByteLength, DateTime? Created)` | One file entry parsed from an RT-11 directory segment. |
 | `ByteLength` | `long ByteLength { get; init; }` |  |
 | `Created` | `DateTime? Created { get; init; }` |  |
-| `FdLsn` | `int FdLsn { get; init; }` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Extension` | `string Extension { get; init; }` |  |
+| `LengthBlocks` | `int LengthBlocks { get; init; }` |  |
+| `NameStem` | `string NameStem { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
+| `StartBlock` | `int StartBlock { get; init; }` |  |
 
-#### `Os9RbfReader.Volume`
+#### `Rt11Reader.Volume`
 
-Parsed OS-9 RBF volume.
+Parsed RT-11 volume — all file entries plus the raw image.
 
 Implements `IEquatable<Volume>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Volume` | `Volume(string VolumeName, int TotalSectors, int RootDirLsn, IReadOnlyList<FileEntry> Files, byte[] Image)` | Parsed OS-9 RBF volume. |
+| `Volume` | `Volume(string VolumeId, int FirstSegmentBlock, int SegmentsAllocated, IReadOnlyList<FileEntry> Files, byte[] Image)` | Parsed RT-11 volume — all file entries plus the raw image. |
 | `Files` | `IReadOnlyList<FileEntry> Files { get; init; }` |  |
+| `FirstSegmentBlock` | `int FirstSegmentBlock { get; init; }` |  |
 | `Image` | `byte[] Image { get; init; }` |  |
-| `RootDirLsn` | `int RootDirLsn { get; init; }` |  |
-| `TotalSectors` | `int TotalSectors { get; init; }` |  |
-| `VolumeName` | `string VolumeName { get; init; }` |  |
+| `SegmentsAllocated` | `int SegmentsAllocated { get; init; }` |  |
+| `VolumeId` | `string VolumeId { get; init; }` |  |
 
-#### `Os9RbfWriter`
+#### `Rt11Writer`
 
-Writer for Microware OS-9 RBF (Random-Block-File) disk images. Emits a 35-track DSDD CoCo geometry (322 560 bytes / ~315 KB, 1260 sectors of 256 bytes, cluster size 1). Files whose names contain '/' separators are placed into real OS-9 subdirectories: each path component becomes a directory file descriptor (directory attribute set) whose data holds "." / ".." links plus one entry per child. Files and directories each occupy one file-descriptor sector and a single contiguous segment.
+Writer for RT-11 disk images using the canonical RX01 reference geometry (256 256 bytes, 1 directory segment of 2 blocks at block 6, files stored contiguously in 512-byte blocks). Filenames are 6.3 RAD-50 encoded.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Os9RbfWriter` | `Os9RbfWriter()` |  |
-| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeName = "OS9")` | Builds an OS-9 RBF image. Each path component may be at most 28 ASCII characters. Forward slashes in `name` introduce subdirectories. |
+| `Rt11Writer` | `Rt11Writer()` |  |
+| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeId = "RT11A   ", int dirSegments = 1)` | Builds a fresh RT-11 image. `files` are stored contiguously starting after the directory segment; sizes are rounded up to whole 512-byte blocks. Filenames must consist only of RAD-50 characters (A-Z, 0-9, $, .). |
 
-### Namespace `FileSystem.ProDos`
+### Namespace `FileSystem.Sfs`
 
-[`ProDosBlockMover`](#prodosblockmover) · [`ProDosEntry`](#prodosentry) · [`ProDosExtentMap`](#prodosextentmap) · [`ProDosFormatDescriptor`](#prodosformatdescriptor) · [`ProDosModifier`](#prodosmodifier) · [`ProDosReader`](#prodosreader) · [`ProDosWriter`](#prodoswriter)
+[`SfsBlockMover`](#sfsblockmover) · [`SfsExtentMap`](#sfsextentmap) · [`SfsFormatDescriptor`](#sfsformatdescriptor) · [`SfsVolume`](#sfsvolume) · [`SfsVolume.Extent`](#sfsvolumeextent) · [`SfsVolume.VolumeFile`](#sfsvolumevolumefile) · [`SfsWriter`](#sfswriter)
 
-#### `ProDosBlockMover`
+#### `SfsBlockMover`
 
-In-place ProDOS block mover. Moves block-aligned extents within a ProDOS disk image and patches index block pointers (seedling/sapling/tree), directory entry key-pointers, and the volume bitmap so the file remains reachable at its new location.
+Moves a file's blocks inside an SFS volume and rewrites the tree of extents that claimed them.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ProDosBlockMover` | `ProDosBlockMover()` |  |
+| `SfsBlockMover` | `SfsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` |  |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the structures at the front. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call notes one run; the tree is written once the pass is over. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full one be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the volume once and notes which extent claims each run. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `Settle` | `void Settle(Stream image)` | Writes the tree of extents and the directory entries that name their first links, then stamps both blocks' checksums. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `ProDosEntry`
-
-Directory entry in a ProDOS volume. Full path includes parent subdirectory names separated by '/'.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `ProDosEntry` | `ProDosEntry()` |  |
-| `FileType` | `byte FileType { get; init; }` |  |
-| `FullPath` | `string FullPath { get; init; }` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `Size` | `long Size { get; init; }` |  |
-| `StorageType` | `byte StorageType { get; init; }` | ProDOS storage type nibble: 1=seedling, 2=sapling, 3=tree, 0xD=subdir. |
-
-#### `ProDosExtentMap`
+#### `SfsExtentMap`
 
-Walks an Apple ProDOS image (.po / .2mg, 512-byte blocks) and yields the actual on-disk byte layout — boot (blocks 0-1), volume directory chain, volume bitmap, and per-file storage as Used (data blocks + index/master-index blocks attributed to the file). Storage tiers 1 (seedling), 2 (sapling), 3 (tree), and 0xD (subdirectory) are all walked.
+Describes an SFS volume block by block: what the volume needs to describe itself, what each file owns, and what is free.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | The layout a pass plans against. |
+| `FirstDataByte` | `static long FirstDataByte(SfsVolume volume)` | The first byte a file may occupy: past the structures the volume opens with. The copy of the root block at the far end is reserved too, but it is behind the data rather than in front of it. |
 
-#### `ProDosFormatDescriptor`
+#### `SfsFormatDescriptor`
 
-Descriptor for Apple II ProDOS volume images (140 KB / 800 KB) — volume directory + bitmap layout with seedling/sapling/tree file storage tiers. References: `https://prodos8.com/docs/techref/` — ProDOS 8 Technical Reference Manual — volume/directory/storage-tier spec`https://github.com/fadden/CiderPress2` — CiderPress II — maintained tooling for ProDOS volumes`https://en.wikipedia.org/wiki/Apple_ProDOS` — Wikipedia article
+Read-only descriptor for Amiga Smart Filesystem (SFS) volume images. SFS is the OFS/FFS replacement used by AmigaOS 4 and AROS, with the complete spec at http://www.xs4all.nl/~hjohn/SFS/ (Amiga SFS spec). Surfaces the parsed root block as a structured metadata bundle; per-file enumeration would require walking the object-container B+ tree. References: `https://github.com/aros-development-team/AROS/tree/master/rom/filesys/SFS` — AROS SFS implementation — maintained open sourceJohn Hendrikx's original SFS specification (the xs4all.nl page cited above; now web-archived)`https://en.wikipedia.org/wiki/Smart_File_System` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ProDosFormatDescriptor` | `ProDosFormatDescriptor()` |  |
-| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
-| `CanonicalSizes` | `IReadOnlyList<long> CanonicalSizes { get; }` | Canonical ProDOS image sizes (5.25" floppy = 143 360, 800 KB floppy = 819 200). |
+| `SfsFormatDescriptor` | `SfsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -7728,159 +11828,120 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
-| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing ProDos image. Uses `ProDosModifier` for true O(touched bytes) random-access I/O — only the volume header, the directory chain, the bitmap, and the file's index + data blocks are read or written. |
-| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Writes a volume holding the given files. |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware ProDOS defragmentor. Tries the planner-driven in-place path first, falling back to the rebuild path on error or for `CarveHole`. Image total-block size is preserved by inferring it from the input stream length. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the volume directory + bitmap + per-file storage tiers (seedling/sapling/tree) and yields the actual on-disk block layout. Boot, volume directory chain, bitmap, and subdir blocks are emitted as `MetadataReserved`; data + index + master-index blocks are attributed to their owning file. |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves the blocks that are out of place and rewrites the extent tree. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing ProDos image. Uses `ProDosModifier` for O(touched bytes) random-access I/O. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in the ProDOS image: unallocated blocks and the block-tip slack between a file's logical EOF and the end of its last 512-byte block. Cluster-tip wiping is applied only to seedling files (storage type 1, a single data block). Sapling and tree files interleave index and master-index blocks with their data inside one coalesced Used extent, so a logical-size lookup cannot tell data slack from a live index block — those files are omitted from the tip pass to avoid corrupting the block pointers; their free blocks are still zeroed. |
 
-#### `ProDosModifier`
+#### `SfsVolume`
 
-Random-access in-place modifier for Apple ProDOS block-ordered images (`.po` and `.2mg`). Reads and writes only the volume directory chain, the bitmap, and the new file's index + data blocks — never the whole image. Lets callers operate on huge underlying streams without paging the entire disk into memory.
+Walks an SFS volume to its files and says which blocks each one owns.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, byte fileType = 6)` | Adds a file to an existing image. Caller is responsible for ensuring the name does not already exist; use `RemoveFile` first for replace-by-name semantics. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image. Returns true if found and removed. When `wipeData` is true, data blocks are zeroed. |
-
-#### `ProDosReader`
-
-Reader for Apple ProDOS `.po` (block-ordered) and `.2mg` images.
-
-Implements `IDisposable`.
+| `SfsVolume` | `SfsVolume(Stream image)` |  |
+| `BlockSize` | `int BlockSize { get; }` |  |
+| `ExtentTreeBlock` | `long ExtentTreeBlock { get; }` | Where the tree of extents lives. |
+| `Files` | `IReadOnlyList<VolumeFile> Files { get; }` |  |
+| `ImageLength` | `long ImageLength { get; }` |  |
+| `ReservedBlocks` | `IReadOnlyList<long> ReservedBlocks { get; }` | Blocks the volume's own structures occupy. |
+| `Status` | `string Status { get; }` |  |
+| `TotalBlocks` | `long TotalBlocks { get; }` |  |
+| `Valid` | `bool Valid { get; }` |  |
+| `Read` | `byte[] Read(VolumeFile file)` | Returns a file's bytes. |
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `ProDosReader` | `ProDosReader(Stream stream)` |  |
-| `ProDosReader` | `ProDosReader(byte[] data)` |  |
-| `BlockSize` | `const int BlockSize` |  |
-| `DirHeaderSize` | `const int DirHeaderSize` | Size in bytes of the Volume Directory Header (storage type 0xF) and the Subdirectory Header (storage type 0xE). The header occupies slot 0 of the first block in a directory chain and is larger than a regular file entry because it carries volume/subdirectory metadata (entry_length, file_count, bit_map_pointer, total_blocks for the volume header; parent_pointer, parent_entry_number, parent_entry_length for the subdirectory header). Per the ProDOS spec, this is 43 bytes ($00..$2A inclusive) — three bytes larger than the 39-byte (`EntrySize`) file-entry slot. The next entry (slot 1 of the first block) therefore starts at byte 4 + 43 = 47, not 4 + 39 = 43. |
-| `EntriesPerBlock` | `const int EntriesPerBlock` |  |
-| `EntrySize` | `const int EntrySize` |  |
-| `VolumeDirStartBlock` | `const int VolumeDirStartBlock` |  |
-| `Entries` | `IReadOnlyList<ProDosEntry> Entries { get; }` |  |
-| `VolumeName` | `string VolumeName { get; }` |  |
-| `Dispose` | `void Dispose()` |  |
-| `EntryOffsetInBlock` | `static int EntryOffsetInBlock(bool isFirstBlockOfChain, int slotIndex)` | Returns the byte offset within a directory block at which the entry at `slotIndex` begins. The first block of a directory chain has its slot 0 carry the (43-byte) Volume/Subdir Header; subsequent slots are 39-byte file entries starting at byte 47. Non-first blocks have all 13 slots as 39-byte file entries starting at byte 4. |
-| `Extract` | `byte[] Extract(ProDosEntry entry)` |  |
-| `SlotsInBlock` | `static int SlotsInBlock(bool isFirstBlockOfChain)` | Returns the number of usable entry slots (header + file slots) in a directory block. The first block of a chain holds 12 entries (1 header at slot 0 + 11 file slots at slots 1..11). Subsequent blocks hold 13 file slots at slots 0..12. |
+#### `SfsVolume.Extent`
 
-#### `ProDosWriter`
+A run of blocks, and where the entry claiming it sits.
 
-Builds a fresh Apple ProDOS block-ordered disk image (`.po`) from scratch (WORM).
+Implements `IEquatable<Extent>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ProDosWriter` | `ProDosWriter()` |  |
-| `Disk800KTotalBlocks` | `const int Disk800KTotalBlocks` |  |
-| `FloppyTotalBlocks` | `const int FloppyTotalBlocks` |  |
-| `AddFile` | `void AddFile(string name, byte fileType, byte[] data)` |  |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file (default file_type = BIN 0x06). |
-| `Build` | `byte[] Build(string volumeName = "WORM", int totalBlocks = 280)` | Builds a canonical 143 360-byte (floppy) ProDOS image by default. |
-
-### Namespace `FileSystem.Refs`
-
-[`RefsBlockMover`](#refsblockmover) · [`RefsExtentMap`](#refsextentmap) · [`RefsFormatDescriptor`](#refsformatdescriptor)
+| `Extent` | `Extent(long Block, long Count, long NodeOffset)` | A run of blocks, and where the entry claiming it sits. |
+| `Block` | `long Block { get; init; }` | The first block, which is also the extent's key. |
+| `Count` | `long Count { get; init; }` | How many blocks it covers. |
+| `NodeOffset` | `long NodeOffset { get; init; }` | Where the extent's own record is in the image. |
 
-#### `RefsBlockMover`
+#### `SfsVolume.VolumeFile`
 
-Offline ReFS 3.x data mover. Raw bytes are rearranged first; allocation, stream metadata, and Block Refcount ownership are then committed as allocate-new -> repoint -> detach-old-reference -> release-unowned-old. Metadata checksum ancestry is refreshed to CHKP after each metadata commit.
+A file in the root directory.
 
-Implements `IFilesystemBlockMover`.
+Implements `IEquatable<VolumeFile>`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `RefsBlockMover` | `RefsBlockMover(Stream image)` |  |
-| `AllocationBlockSize` | `int AllocationBlockSize { get; }` |  |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` |  |
-| `SupportsScatteredRelink` | `bool SupportsScatteredRelink { get; }` |  |
-| `GetMaximumExtentRuns` | `int GetMaximumExtentRuns(Stream image)` | Conservative global extent-run budget for interleave planning. It probes each current storage row and returns the minimum run count that fits without an outer B+ page split. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `PrepareResidentFiles` | `void PrepareResidentFiles(Stream image)` | Converts every non-empty resident file to the extent-backed long-value form before the planner runs, so small files participate in exactly the same physical layout operation as large files. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `UpdateAllocationScattered` | `void UpdateAllocationScattered(Stream image, string fileName, IReadOnlyList<long> oldBlockOffsets, IReadOnlyList<long> newBlockOffsets, IReadOnlySet<long> blocksLiveElsewhere)` |  |
+| `VolumeFile` | `VolumeFile(string Name, long Size, long EntryOffset, IReadOnlyList<Extent> Extents)` | A file in the root directory. |
+| `EntryOffset` | `long EntryOffset { get; init; }` | Where its directory entry is in the image. |
+| `Extents` | `IReadOnlyList<Extent> Extents { get; init; }` | The runs it owns, in the order its bytes run. |
+| `Name` | `string Name { get; init; }` | Its name. |
+| `Size` | `long Size { get; init; }` | How many bytes it holds. |
 
-#### `RefsExtentMap`
+#### `SfsWriter`
 
-Enumerates the active ReFS byte layout. Free space is fail-closed: a gap is free only when covered and clear in the on-disk allocator. ReFS structures are emitted individually so a filesystem-specific metadata mover can place movable pages while fixed bootstrap anchors remain hard reservations.
+Builds an Amiga Smart File System volume: root block, bitmap, admin space, object node table, extent tree, root directory and the files themselves.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+| `SfsWriter` | `SfsWriter()` |  |
+| `BlockSize` | `int BlockSize { get; init; }` | Bytes per block. SFS allows 512 up to 32768; 512 is its own default. |
+| `DateCreated` | `uint DateCreated { get; init; }` | Seconds since 1978-01-01, which is how Amiga volumes date themselves. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the root directory. |
+| `Build` | `byte[] Build()` | Lays the volume out and returns its bytes. |
 
-#### `RefsFormatDescriptor`
+### Namespace `FileSystem.SmartFs`
 
-Microsoft ReFS (Resilient File System) volume descriptor. Read/list/extract follows metadata reachable from the active checkpoint. Offline layout writes are coordinated by the ReFS placement manager, which can relocate file data, live MSB+ metadata and checkpoint pages while preserving the format-fixed VBR/SUPB bootstrap anchors.
+[`SmartFsBlockMover`](#smartfsblockmover) · [`SmartFsEntry`](#smartfsentry) · [`SmartFsExtentMap`](#smartfsextentmap) · [`SmartFsFormatDescriptor`](#smartfsformatdescriptor) · [`SmartFsReader`](#smartfsreader) · [`SmartFsWriter`](#smartfswriter)
+
+#### `SmartFsBlockMover`
+
+Moves a SmartFS sector to another place in the volume and rewrites whatever named it.
 
-Implements `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`.
+Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `RefsFormatDescriptor` | `RefsFormatDescriptor()` |  |
-| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
-| `Category` | `FormatCategory Category { get; }` |  |
-| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
-| `DefaultExtension` | `string DefaultExtension { get; }` |  |
-| `Description` | `string Description { get; }` |  |
-| `DisplayName` | `string DisplayName { get; }` |  |
-| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
-| `Family` | `AlgorithmFamily Family { get; }` |  |
-| `Id` | `string Id { get; }` |  |
-| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
-| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `AnalyzeLayout` | `LayoutAnalysis AnalyzeLayout(Stream image)` |  |
-| `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
-| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
-| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-
-### Namespace `FileSystem.Reiser4`
+| `SmartFsBlockMover` | `SmartFsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A sector, which is the unit everything here is counted in. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file's sector may occupy: past the format sector and the root. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the fields naming the sectors it is given, so a file scattered over the volume is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A sector may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the volume once and notes which field names each sector. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SettleFreeSectors` | `void SettleFreeSectors(Stream image, IEnumerable<ValueTuple<long, long>> live)` | Erases every sector the volume no longer uses. |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-[`Reiser4BlockMover`](#reiser4blockmover) · [`Reiser4FormatDescriptor`](#reiser4formatdescriptor) · [`Reiser4MasterSb`](#reiser4mastersb) · [`Reiser4Reader`](#reiser4reader) · [`Reiser4Reader.Entry`](#reiser4readerentry) · [`Reiser4Writer`](#reiser4writer)
+#### `SmartFsEntry`
 
-#### `Reiser4BlockMover`
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `SmartFsEntry` | `SmartFsEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-Moves a file's blocks inside a Reiser4 payload area and rewrites the directory entry that said where it started.
+#### `SmartFsExtentMap`
 
-Implements `IFilesystemBlockMover`.
+Describes where a SmartFS volume keeps its bytes, one sector at a time.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Reiser4BlockMover` | `Reiser4BlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A block, which is what the directory counts in. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the reserved blocks and the directory, which is where the first file already sits. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call notes where one run has got to; a file split by the bitmaps it steps over is simply several calls. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the directory once and notes where every file is. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `SettleDirectory` | `void SettleDirectory(Stream image)` | Writes each file's first block into the directory, once the pass is over. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `Reiser4FormatDescriptor`
+#### `SmartFsFormatDescriptor`
 
-Read-only descriptor for Reiser4 filesystem images (successor to ReiserFS 3.6 — completely different on-disk layout). Surfaces the master superblock at offset 65536 and, when present, the format40 superblock that follows it, plus a structured metadata bundle and the raw image. Walking the twig-level B-tree is explicitly out of scope (multi-week effort). Magic: `"ReIsEr4"` at offset 65536 — master superblock `ms_magic[16]`. References: `https://archive.kernel.org/oldwiki/reiser4.wiki.kernel.org/` — archived Reiser4 wiki (format40 layout, plugin system)reiser4progs (`mkfs.reiser4` / `debugfs.reiser4`) — canonical userspace tooling`https://en.wikipedia.org/wiki/Reiser4` — Wikipedia article
+Read-only descriptor for SmartFS — the wear-levelled raw-flash filesystem in Apache NuttX RTOS. Recognises the "SMRT" format signature near the start of the format sector (NuttX CONFIG_SMARTFS_FORMAT_SIG). Sector-chain traversal + directory enumeration are out of scope; this descriptor surfaces the parsed format sector as metadata plus the raw image. References: `https://github.com/apache/nuttx/tree/master/fs/smartfs` — reference implementation (Apache NuttX)Apache NuttX "SmartFS" documentation and SmartFS Design Document (NuttX project wiki)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Reiser4FormatDescriptor` | `Reiser4FormatDescriptor()` |  |
-| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `SmartFsFormatDescriptor` | `SmartFsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -7891,258 +11952,209 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
-| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Knobs the empty-filesystem writer actually honours. `VolumeLabel` is written into the master superblock label field (and the backup record) and surfaces through `fsck.reiser4` / our metadata readback; `ImageSize` drives `BlockCount` (4 KB blocks, clamped to the writer minimum). The 4 KB block size is fixed — the embedded mkfs.reiser4 templates are byte-exact 4096-byte captures — so it is intentionally not exposed. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
-| `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Rewrites the volume with every file laid out contiguously from the start of the payload area. Each entry is spilled to scratch and the writer pulls it back, so the rebuild is not bounded by what a byte[] can hold. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Reports the volume's layout: the reserved blocks and the payload directory chain as metadata, then each file's blocks. A file's blocks are consecutive apart from the block-allocator bitmaps they step over. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Lays a fresh volume out holding the inputs. Sector size is the caller's choice among the five SmartFS allows; the volume is sized to its contents unless a larger one is asked for. |
+| `Defragment` | `void Defragment(Stream archive)` | Rewrites the volume with every file's sectors consecutive. SmartFS chains its sectors rather than requiring them to be adjacent, so the gain is sequential reads rather than a structural repair — and the rebuild is what produces it, since a fresh layout is contiguous by construction. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Where the volume keeps its bytes: the format sector and the directory chain pinned, every sector a file's chain runs through as its own. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros every byte no live file and no metadata block occupies. |
-
-#### `Reiser4MasterSb`
-
-Parses the Reiser4 master superblock at byte offset 65536 (16 * 4 KB) and the adjacent format40 superblock that immediately follows it. Read-only. Layout per `edward6/reiser4progs``plugin/format/format40/format40.h` and the kernel reiser4 source `plugin/disk_format/disk_format40.h`: Verified by: `https://github.com/edward6/reiser4/blob/master/vfs_ops.c` — `REISER4_MAGIC_OFFSET = 16 * 4096``https://github.com/edward6/reiser4progs/blob/master/plugin/format/format40/format40.h` — format40 layout + `"ReIsEr40FoRmAt"``fsck.reiser4` output: `"Master super block (16): magic: ReIsEr4 blksize: 4096 format: 0x0 (format40)"`
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `Reiser4MasterSb` | `Reiser4MasterSb()` |  |
-| `Format40Magic` | `static readonly byte[] Format40Magic` | "ReIsEr40FoRmAt" — 14 bytes, NUL-padded to 16. Format40 SB magic. |
-| `Format40StructSize` | `const int Format40StructSize` | Format40 superblock size when present. |
-| `MasterMagic` | `static readonly byte[] MasterMagic` | "ReIsEr4" — 7 bytes, NUL-padded to 16. Master magic. |
-| `MasterOffset` | `const long MasterOffset` | Disk byte offset of the master superblock. |
-| `MasterRawCapture` | `const int MasterRawCapture` | Reserved 480-byte "page-ish" slice we surface from the master block. |
-| `MasterStructSize` | `const int MasterStructSize` | Master SB size on disk (16 + 2 + 2 + 16 + 16). |
-| `BlockCount` | `ulong BlockCount { get; }` |  |
-| `BlockSize` | `ushort BlockSize { get; }` | Filesystem block size in bytes (4096 typical). |
-| `DiskPluginId` | `ushort DiskPluginId { get; }` | Disk-format plugin id (0 = format40). |
-| `FileCount` | `ulong FileCount { get; }` |  |
-| `Format40Present` | `bool Format40Present { get; }` | Whether a recognisable format40 superblock followed the master block. |
-| `Format40Raw` | `byte[] Format40Raw { get; }` | Raw 480-byte capture of the format40 superblock (or empty). |
-| `Format40Version` | `uint Format40Version { get; }` |  |
-| `FreeBlocks` | `ulong FreeBlocks { get; }` |  |
-| `Label` | `string Label { get; }` | Volume label (NUL-trimmed, ASCII). |
-| `MasterRaw` | `byte[] MasterRaw { get; }` | Raw 480-byte capture from the master block (0-padded if image was shorter). |
-| `MkfsId` | `uint MkfsId { get; }` |  |
-| `Policy` | `ushort Policy { get; }` |  |
-| `RootBlock` | `ulong RootBlock { get; }` |  |
-| `TreeHeight` | `ushort TreeHeight { get; }` |  |
-| `UuidHex` | `string UuidHex { get; }` | Pool UUID hex (32 hex chars, no dashes). |
-| `Valid` | `bool Valid { get; }` | True iff the master magic was recognised at offset 65536. |
-| `TryParse` | `static Reiser4MasterSb TryParse(ReadOnlySpan<byte> image)` | Best-effort parse. Never throws — invalid / short images return a sentinel instance with `Valid` == false. |
 
-#### `Reiser4Reader`
+#### `SmartFsReader`
 
-Reads a Reiser4 image: the master superblock's label, UUID and block size, and the files a `Reiser4Writer` placed in the workbench-layout payload area. The reserved blocks of a workbench-written image are byte-exact `mkfs.reiser4` captures describing an empty storage tree, so there is no reiser4 tree here to walk. Files live past those blocks, announced by a marker in the master superblock's spare region and described by a chained directory — the layout `Reiser4Writer` documents. An image from a real `mkfs.reiser4` carries no marker and surfaces no entries; its storage tree (extent40 bodies keyed by file offset, cde40 directory units) is out of scope.
+Detection / metadata-surface reader for SmartFS — the wear-levelled raw-flash filesystem in Apache NuttX RTOS. SmartFS uses a logical- to-physical sector map: sector 0 is the "format sector" carrying the partition signature, sector size, and number of root sectors. File data is stored in chains of sectors with a 5-byte logical header (logical sector number, sequence, CRC). Full chain traversal would require modeling the FAT-like sector mapping table plus directory entry walk. This reader surfaces the parsed format sector and image as metadata. Format sector header (selected, little-endian, at file offset 0): 0x00 5 bytes per-sector header (logical sector / status / crc) — exact layout depends on CONFIG_SMARTFS_NLOGSECS ... 0x0A 4 bytes Format signature = "SMRT" (NuttX CONFIG_SMARTFS_FORMAT_SIG) 0x0E 1 byte format version (typically 1 or 2) 0x0F 1 byte sector size code (0=256, 1=512, 2=1024, 3=2048, 4=4096) 0x10 2 bytes number of root directory sectors 0x12 1 byte reserved 0x13+ ...
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Reiser4Reader` | `Reiser4Reader(Stream stream, bool leaveOpen = true)` |  |
-| `MasterOffset` | `const long MasterOffset` | Byte offset of the master superblock: block 16 at a 4 KB block size. |
-| `BlockSize` | `int BlockSize { get; }` | Filesystem block size from the master superblock. |
-| `Entries` | `IReadOnlyList<Entry> Entries { get; }` | Files the payload area holds. Empty for an image without the marker. |
-| `Label` | `string Label { get; }` | Volume label from the master superblock. |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
-| `UuidHex` | `string UuidHex { get; }` | Volume UUID from the master superblock, as hex. |
-| `Valid` | `bool Valid { get; }` | True when the image carries a valid Reiser4 master superblock. |
+| `SmartFsReader` | `SmartFsReader(Stream stream)` |  |
+| `FormatSignature` | `static readonly byte[] FormatSignature` |  |
+| `Entries` | `IReadOnlyList<SmartFsEntry> Entries { get; }` |  |
+| `FormatVersion` | `byte FormatVersion { get; }` |  |
+| `RootSectorCount` | `ushort RootSectorCount { get; }` |  |
+| `SectorSize` | `uint SectorSize { get; }` |  |
+| `ValidFormatSector` | `bool ValidFormatSector { get; }` |  |
 | `Dispose` | `void Dispose()` |  |
-| `EnumerateRuns` | `IEnumerable<ValueTuple<long, long>> EnumerateRuns(Entry entry)` | Where an entry's bytes are: one run per stretch of consecutive blocks, the block-allocator bitmaps stepped over exactly as `ExtractTo` steps over them. A file is not one contiguous run whenever a bitmap falls inside it. |
-| `ExtractTo` | `long ExtractTo(Entry entry, Stream destination)` | Writes `entry`'s contents into `destination`. A file's blocks are consecutive apart from any block-allocator bitmap they straddle, which the walk steps over exactly as the writer did. Returns the number of bytes written. |
-| `Extract` | `byte[] Extract(Entry entry)` | Reads a file's contents. Only valid below the array limit. |
-
-#### `Reiser4Reader.Entry`
-
-One file in the payload area: its name, first block and byte length.
-
-Implements `IEquatable<Entry>`.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `Entry` | `Entry(string Name, ulong FirstBlock, long Size)` | One file in the payload area: its name, first block and byte length. |
-| `FirstBlock` | `ulong FirstBlock { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `Size` | `long Size { get; init; }` |  |
+| `Extract` | `byte[] Extract(SmartFsEntry entry)` |  |
 
-#### `Reiser4Writer`
+#### `SmartFsWriter`
 
-WORM (write-once-read-many) creator for an **empty** Reiser4 filesystem image that is byte-exact-compatible with what `mkfs.reiser4 -fffy` from `reiser4progs 1.2.2` produces, and that `fsck.reiser4` validates as `"FS is consistent."`. The image holds 25 reserved blocks at fixed positions (block size = 4 KB): 0..15 — jump-area / partition data (zero).16 — master superblock (`"ReIsEr4"` at offset 65536).17 — format40 superblock (`"ReIsEr40FoRmAt"` at offset 52).18 — block-allocator bitmap (4-byte adler32 + bit array).19..20 — journal header / footer (zero for an empty FS).21 — status block (`"ReiSeR4StATusBl"`).22 — superblock backup record.23 — storage-tree root (twig, level 2).24 — leaf containing the root-directory stat-data + ".", "..". Implementation strategy: we embed the seven non-zero reference blocks as resources captured byte-exact from a real `mkfs.reiser4` image, then patch in only the per-image fields: UUID (16 bytes, random)Label (≤ 16 bytes, optional)mkfs_id (4 bytes, random) — appears in 4 places: format40 SB, backup record, twig header, leaf header.block_count / free_blocks (in format40 SB and backup).Bitmap (block 18) — bits 0..24 set for the 25 reserved blocks plus filler bits for the unused tail of the bitmap range, then adler32 of the bitmap data prepended. Round-trips with `fsck.reiser4 -y` exit 0 and produces output identical to the reference image except for the random fields above.
+Builds a SmartFS volume: a format sector, a root directory, and a sector chain per file.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Reiser4Writer` | `Reiser4Writer()` |  |
-| `BlockSize` | `const int BlockSize` | Filesystem block size — 4 KB is the only supported value. Reiser4 theoretically supports 512 / 1024 / 2048 / 4096 / 8192, but the embedded templates are 4096-byte exact captures. |
-| `MinBlockCount` | `const ulong MinBlockCount` | Minimum block count we'll emit. mkfs.reiser4 itself rejects images below ~750 blocks, but we round up to 4096 (= 16 MB) to match the reference capture and avoid bitmap-truncation edge cases. |
-| `BlockCount` | `ulong BlockCount { get; set; }` | Total filesystem size in 4 KB blocks. Clamped to `MinBlockCount`. |
-| `Label` | `string Label { get; set; }` | Customisable label written to the master SB (NUL-padded to 16 bytes; longer strings are truncated; null = empty/zero). |
-| `MkfsId` | `uint? MkfsId { get; set; }` | Optional 32-bit mkfs identifier. When null, a random value is drawn from `Shared`. |
-| `Uuid` | `byte[] Uuid { get; set; }` | Optional 16-byte UUID. When null, a random Guid is used. |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a regular file to the payload area. |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are pulled from `openStream` as the image is written. |
-| `Build` | `byte[] Build()` | Builds the image fully in memory and returns the byte array. For block counts above ~32 K the result will be tens of MB; prefer the streaming overload when caller-side allocation matters. |
-| `EstimateBlockCount` | `static ulong EstimateBlockCount(IEnumerable<long> fileSizes)` | Smallest block count that holds `fileSizes`: the reserved blocks, the directory chain, every file's data blocks, and the bitmap blocks interleaved among them. |
-| `Write` | `void Write(Stream output)` | Streams the full image into `output`. Writes `BlockCount`×4096 bytes and leaves the stream positioned at the end. |
+| `SmartFsWriter` | `SmartFsWriter()` |  |
+| `SectorSize` | `int SectorSize { get; init; }` | Bytes per sector. One of 256, 512, 1024, 2048 or 4096. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the volume. |
+| `Build` | `byte[] Build(int totalSectors = 0)` | Lays the volume out. `totalSectors` of zero sizes the image to what the files need; a larger count leaves the surplus erased, which is where a running system would put new files. |
 
-### Namespace `FileSystem.ReiserFs`
+### Namespace `FileSystem.SquashFs`
 
-[`ReiserFsBlockMover`](#reiserfsblockmover) · [`ReiserFsEntry`](#reiserfsentry) · [`ReiserFsFormatDescriptor`](#reiserfsformatdescriptor) · [`ReiserFsReader`](#reiserfsreader) · [`ReiserFsWriter`](#reiserfswriter)
+[`SquashFsBlockMover`](#squashfsblockmover) · [`SquashFsEntry`](#squashfsentry) · [`SquashFsFormatDescriptor`](#squashfsformatdescriptor) · [`SquashFsReader`](#squashfsreader) · [`SquashFsWriter`](#squashfswriter)
 
-#### `ReiserFsBlockMover`
+#### `SquashFsBlockMover`
 
-Moves a file's blocks inside a ReiserFS volume, repoints the pointers that name them, and moves the allocation with them.
+Moves a file's data blocks inside a SquashFS image and rewrites the inode field that said where they began.
 
 Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ReiserFsBlockMover` | `ReiserFsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the superblock, journal and bitmaps. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `SquashFsBlockMover` | `SquashFsBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A byte. Data blocks are packed to the byte, compressed as they are. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file's data may occupy: past the superblock. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call notes where one file's data went; the table is written once the pass is over. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the image while the rest of the layout moves, which is what lets a full image be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the inode table once and notes where each file's field is. |
 | `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `SettleInodeTable` | `void SettleInodeTable(Stream image)` | Writes the inode table again with every file's new starting block. |
 | `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length, bool releaseOldSpace)` |  |
 
-#### `ReiserFsEntry`
+#### `SquashFsEntry`
+
+Represents a single entry (file, directory, or symlink) inside a SquashFS image.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ReiserFsEntry` | `ReiserFsEntry()` |  |
-| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `LastModified` | `DateTime? LastModified { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `Size` | `long Size { get; init; }` |  |
+| `SquashFsEntry` | `SquashFsEntry()` |  |
+| `FullPath` | `string FullPath { get; init; }` | The full path within the archive, using forward slashes. |
+| `Gid` | `uint Gid { get; init; }` | Group ID. |
+| `IsDirectory` | `bool IsDirectory { get; init; }` | True if this entry is a directory. |
+| `IsSymlink` | `bool IsSymlink { get; init; }` | True if this entry is a symbolic link. |
+| `ModifiedTime` | `DateTime ModifiedTime { get; init; }` | Last modification time. |
+| `Name` | `string Name { get; init; }` | The base name of the entry (no path separators). |
+| `Permissions` | `int Permissions { get; init; }` | Unix permissions (low 12 bits of inode mode field). |
+| `Size` | `long Size { get; init; }` | Uncompressed size in bytes. 0 for directories. |
+| `SymlinkTarget` | `string SymlinkTarget { get; init; }` | The symlink target path, or null if not a symlink. |
+| `Uid` | `uint Uid { get; init; }` | User ID. |
 
-#### `ReiserFsFormatDescriptor`
+#### `SquashFsFormatDescriptor`
 
-R/W descriptor for ReiserFS v3.6 filesystem images (superblock at offset 65536, R5 directory hash, 4 KB blocks). References: `https://github.com/torvalds/linux/tree/v6.6/fs/reiserfs` — Linux reference implementation (v6.6 LTS tree; the driver was removed from later kernels)reiserfsprogs (`mkreiserfs` / `debugreiserfs`) — canonical userspace tooling`https://en.wikipedia.org/wiki/ReiserFS` — Wikipedia article
+Offline R/W descriptor for SquashFS images ("hsqs" magic). Linux mounts SquashFS read-only by design; the workbench nevertheless supports editing an existing image by verified rebuild, plus guarded physical re-layout where compressed metadata can be repointed safely. The writer emits gzip-compressed images. References: `https://dr-emann.github.io/squashfs/` — community-written binary-format specification`https://www.kernel.org/doc/html/latest/filesystems/squashfs.html` — kernel documentation`https://github.com/plougher/squashfs-tools` — canonical mksquashfs/unsquashfs tooling`https://en.wikipedia.org/wiki/SquashFS` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ReiserFsFormatDescriptor` | `ReiserFsFormatDescriptor()` |  |
-| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `SquashFsFormatDescriptor` | `SquashFsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
 | `DefaultExtension` | `string DefaultExtension { get; }` |  |
-| `Description` | `string Description { get; }` | ReiserFS v3.6 filesystem image — R/W. The writer emits a real spec-compliant multi-leaf S+tree image (superblock at +65536, R5-hashed directory entries, INDIRECT items with dedicated data blocks for file bodies > 1 KB, internal pages above leaves). `IArchiveModifiable` Add tries a GENUINE in-place splice first (`ReiserFsInPlaceAdder`): for a single-leaf (tree_height 2) image it allocates a fresh objectid, inserts the file's STAT_DATA + DIRECT/INDIRECT items plus the R5-hashed dirent into the root leaf, appends any INDIRECT data blocks past the tree, and updates the bitmap / block counts — leaving every existing INDIRECT data block byte-identical at its original offset. Cases the in-place path does not handle (multi-leaf descent / split, nested sub-directory targets, replace-by-name, leaf overflow) fall back to a read-modify-rebuild via `ReiserFsWriter`; Remove always rebuilds. Both paths pass reiserfsck. |
+| `Description` | `string Description { get; }` |  |
 | `DisplayName` | `string DisplayName { get; }` |  |
 | `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
-| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The one tunable the writer honours: the volume label written into the superblock `s_label` field (16 bytes) via `Label` and read back as `ReiserFsReader.Label`. The 4 KB block size and R5 hash are fixed by the v3.6 layout, so they are not exposed. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The only writer-honoured knob is the data block size: it is split into the superblock's `block_size` / `block_log` fields and drives how each file's payload is chunked into compressed data blocks. SquashFS stores no volume label, and this writer always compresses with gzip (zlib), so no label or compression-method knob is published. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces, on name collision) the given files inside an existing ReiserFS image. Routed through `ReiserFsModifier` which does the full read-modify-rebuild via `ReiserFsWriter`. |
-| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
-| `CreateFromStreams` | `void CreateFromStreams(Stream output, IEnumerable<StreamingArchiveInput> inputs, FormatCreateOptions options)` | Two-pass streaming creation. ReiserFS v3.6 has NO block checksums by design, so file bodies are fully streamable. Bodies above the writer's DIRECT/tail threshold (1 KiB) become INDIRECT items backed by dedicated data blocks: pass 1 builds the S+tree with those data-block runs left zero; pass 2 seeks to each run and copies its bytes from `OpenStream` in 64 KiB chunks. Tail-packed bodies ≤ 1 KiB live inside shared leaves, so the writer reads those small bodies up front (a bounded read). The output is byte-identical to `Create` for the same inputs. Falls back to the buffered default on a non-seekable target. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware ReiserFS v3.6 defragmentor via read-extract-rebuild dispatch through `DefragRebuilder`. The writer always emits a fresh contiguous-from-start single-leaf image (superblock at +65536, root SD + DIRENTRY + per-file SD/DIRECT items, R5-hashed key ordering). |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
 | `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing ReiserFS image. The rebuild always starts from zeroed bytes so the removed file data leaves no forensic trace. |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | A canonical SquashFS image is fully packed. The real extent map marks all non-file bytes as metadata-reserved, so there is no proven dead space to scrub and this format-specific implementation is intentionally a no-op. |
+
+#### `SquashFsReader`
+
+Reads a SquashFS version 4 filesystem image.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `SquashFsReader` | `SquashFsReader(Stream stream, bool leaveOpen = false)` | Opens a SquashFS image from the given stream. |
+| `Entries` | `IReadOnlyList<SquashFsEntry> Entries { get; }` | All entries found in the archive, in depth-first order. |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(SquashFsEntry entry)` | Extracts the data of a regular file entry. |
 
-#### `ReiserFsReader`
+#### `SquashFsWriter`
 
-Reads a ReiserFS v3 filesystem image. Field offsets follow the Linux kernel `struct reiserfs_super_block` (see `ReiserFsWriter` for the full offset table).
+Writes a SquashFS version 4 filesystem image using gzip (zlib) compression for data blocks. Metadata blocks (inodes, directories, IDs) use zlib compression with automatic fallback to uncompressed when compression does not reduce size.
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `ReiserFsReader` | `ReiserFsReader(Stream stream, bool leaveOpen = true)` |  |
-| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock records it. |
-| `Entries` | `IReadOnlyList<ReiserFsEntry> Entries { get; }` |  |
-| `Label` | `string Label { get; }` | Volume label from the superblock `s_label` field (16 bytes, NUL-trimmed ASCII). |
-| `Length` | `long Length { get; }` | Total size of the backing image in bytes. |
+| `SquashFsWriter` | `SquashFsWriter(Stream stream, bool leaveOpen = false, uint blockSize = 131072)` | Initializes a new `SquashFsWriter` that writes to `stream`. The image is finalized when `Dispose` is called. |
+| `DefaultBlockSize` | `const uint DefaultBlockSize` | Default data block size (128 KiB) — the mksquashfs default. |
+| `AddDirectory` | `void AddDirectory(string path, DateTime? lastModified = null)` | Adds an explicit directory entry to the image. |
+| `AddFile` | `void AddFile(string path, byte[] data, DateTime? lastModified = null)` | Adds a file entry to the image. |
 | `Dispose` | `void Dispose()` |  |
-| `EnumerateDataExtents` | `IEnumerable<ValueTuple<long, long, long>> EnumerateDataExtents(ReiserFsEntry entry)` | Where on disk `entry`'s bytes actually sit, as runs of whole blocks, along with the byte offset of the first pointer that names each run. |
-| `ExtractTo` | `long ExtractTo(ReiserFsEntry entry, Stream destination)` | Writes `entry`'s body into `destination`, one item at a time. Returns the byte count. |
-| `Extract` | `byte[] Extract(ReiserFsEntry entry)` |  |
 
-#### `ReiserFsWriter`
+### Namespace `FileSystem.Stacker`
 
-Writes a SPEC-COMPLIANT ReiserFS v3.6 filesystem image. Multi-leaf S+tree with internal pages, R5-hashed dirents, DIRECT items for small file bodies and INDIRECT items (block-pointer arrays referencing dedicated data blocks laid out past the tree) for large bodies. Layout matches what reiserfsprogs' make_sure_root_dir_exists + reiserfs_add_entry would produce.
+[`GenuineStackerReader`](#genuinestackerreader) · [`GenuineStackerWriter`](#genuinestackerwriter) · [`StacLzs`](#staclzs) · [`StackerEntry`](#stackerentry) · [`StackerFormatDescriptor`](#stackerformatdescriptor) · [`StackerReader`](#stackerreader) · [`StackerWriter`](#stackerwriter)
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `ReiserFsWriter` | `ReiserFsWriter()` |  |
-| `Label` | `string Label { get; set; }` | Volume label written into the superblock `s_label` field (16 bytes, NUL-padded; longer strings are truncated). Defaults to `"worm"` to match the historical writer output. |
-| `AddFile` | `void AddFile(string name, byte[] data)` |  |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a streaming file. ReiserFS v3.6 carries NO block checksums (see the header note), so file bodies are fully streamable. Bodies up to `MaxDirectBody` bytes are tail-packed as DIRECT items inside a shared leaf, so those small streaming entries are read in full up front (a bounded ≤1 KiB read) and treated as a normal `AddFile`. Bodies above the threshold become INDIRECT items backed by dedicated data blocks; their bytes are pulled from `openStream` in 64 KiB chunks during `BuildToStreaming` and never buffered as a `byte[]`. The on-disk image is byte-identical to `WriteTo` for the same inputs. |
-| `BuildToStreaming` | `void BuildToStreaming(Stream output)` | Two-pass streaming write: pass 1 builds the complete image byte array with INDIRECT streaming bodies left zero (recorded into a sink); pass 2 seeks to each body's contiguous data-block run and copies it from the opener in 64 KiB chunks. ReiserFS v3.6 has no block checksums, so the emitted bytes are identical to `WriteTo` for the same inputs — only WHERE the body bytes originate changes. Small (≤ `MaxDirectBody`) bodies were already read up front by `AddStreamingFile` and ride the classic in-leaf DIRECT path. Requires a writable, seekable stream. |
-| `WriteTo` | `void WriteTo(Stream output)` | When non-null, every INDIRECT streaming file's (absolute data byte-offset, byte length, opener) is recorded here during `WriteTo` so `BuildToStreaming` can post-fill the data blocks. Null in the classic buffered path. |
+#### `GenuineStackerReader`
 
-### Namespace `FileSystem.RomFs`
+Reads a genuine Stac Electronics STACVOL — the real obfuscated-SCB layout that `GenuineStackerWriter` emits and that the independent `dmsdos` driver mounts. This is the read half of the genuine Stacker round trip; together with the driver-proven writer it gives a full read/write path over the genuine on-disk format. The superblock at sector 0 is decoded with the Stacker rolling-XOR cipher (seed at 0x4c) to recover the geometry (version 0x60, sector size 0x62, total sectors 0x6C, emulated-boot-block 0x70, AMAP start 0x74, FAT start 0x76, data start 0x7a). The emulated boot block supplies the BPB; files are walked through the inner FAT and located through the interleaved AMAP (stored clusters read verbatim, tail truncated by the directory's file size).
 
-[`RomFsBlockMover`](#romfsblockmover) · [`RomFsEntry`](#romfsentry) · [`RomFsExtentMap`](#romfsextentmap) · [`RomFsFormatDescriptor`](#romfsformatdescriptor) · [`RomFsModifier`](#romfsmodifier) · [`RomFsReader`](#romfsreader) · [`RomFsRecordMap`](#romfsrecordmap) · [`RomFsRecordMap.Record`](#romfsrecordmaprecord) · [`RomFsWriter`](#romfswriter)
+Implements `IDisposable`.
 
-#### `RomFsBlockMover`
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `GenuineStackerReader` | `GenuineStackerReader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<StackerEntry> Entries { get; }` |  |
+| `Version` | `int Version { get; }` |  |
+| `VolumeLabel` | `string VolumeLabel { get; }` | The inner volume label (0x08 root entry), or "" when none was written. |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(StackerEntry entry)` |  |
 
-Moves whole ROMFS records and rewrites whatever pointed at them.
+#### `GenuineStackerWriter`
 
-Implements `IFilesystemBlockMover`.
+Builds a genuine Stac Electronics STACVOL — the on-disk shape a real Stacker driver mounts, verified by the independent GPL `dmsdos` driver, which detects this writer's output as "stacker version 3 CVF", mounts it, lists the inner directory and reads every file back byte-exact. Unlike `StackerWriter` (the older self-round-trip layout with the invented `STKMAP01` trailer — which the real driver rejects), the genuine STACVOL is shaped as: Sector 0 — SCB: the `"STACKER"` magic, a minimal FAT BPB (so the generic FAT layer parses sector 0 without crashing), the raw `0x1A0A` signature at 0x4e/0x4f, and the obfuscated superblock at 0x50 (0x30 bytes enciphered with the Stacker rolling-XOR cipher seeded at 0x4c). The decoded superblock carries the version (0x60), sector size (0x62), total sectors (0x6C), emulated-boot-block sector (0x70), AMAP start (0x74), FAT start (0x76) and data start (0x7a).Emulated boot block (at the 0x70 sector) — a standard BPB describing the inner FAT volume.Interleaved FAT + AMAP from the FAT-start sector: the AMAP (Stacker's MDFAT) sector for a cluster is `(area/6)*9 + area%6 + 3 + fatStart` where `area = cluster*3/512`. Each 3-byte entry stores the absolute physical sector and a stored-cluster flag (uncompressed); clusters are identity-mapped and read verbatim.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `RomFsBlockMover` | `RomFsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A record starts on a sixteen-byte boundary, and so does its data. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a record may occupy: past the superblock. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the fields naming the run it is given and leaves the rest of the volume alone. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A record may be held outside the image while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads every chain once and notes each field that names a record. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `SettleSuperblock` | `void SettleSuperblock(Stream image, long contentEnd)` | Writes the size the superblock records and takes its checksum again. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `GenuineStackerWriter` | `GenuineStackerWriter()` |  |
+| `CompressionLevel` | `int CompressionLevel { get; init; }` | Codec effort (search depth). Higher = better ratio, slower. |
+| `CompressionMethod` | `CvfLzMethod CompressionMethod { get; init; }` | Per-cluster compression. Stored (default) or DS — the dmsdos Stacker reader dispatches a 0x5344 ("DS") cluster header to the DS decoder, so DS-compressed Stacker clusters are read by the real driver. (JM/Auto map to DS here, as the Stacker path only recognises DS among the LZ headers.) |
+| `ForceCompress` | `bool ForceCompress { get; init; }` | Keep a compressed cluster even if it does not shrink (auto-best off). |
+| `Timestamp` | `DateTime Timestamp { get; init; }` | Creation/modification timestamp stamped on every file entry. Default (before 1980) leaves the FAT date/time fields zero. |
+| `Version` | `int Version { get; init; }` | Stacker major version recorded in the decoded superblock (< 410 ⇒ v3). |
+| `VolumeLabel` | `string VolumeLabel { get; init; }` | Optional inner-volume label (≤11 chars). Empty = no label entry. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the root directory of the compressed volume. |
+| `Build` | `byte[] Build()` | Builds the STACVOL image bytes. |
 
-#### `RomFsEntry`
+#### `StacLzs`
 
-Represents a single entry (file or directory) in a ROMFS image.
+Stac LZS (Hi/fn) compression as published in IETF RFC 1967 / RFC 2395. A bit-oriented LZ77 variant over a 2048-byte sliding history window with MSB-first bit packing. This is the scheme Stacker uses for compressed clusters inside a STACVOL.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `RomFsEntry` | `RomFsEntry()` |  |
-| `DataOffset` | `long DataOffset { get; init; }` | Absolute byte offset of this entry's data in the image stream. |
-| `HeaderOffset` | `long HeaderOffset { get; init; }` | Absolute byte offset of this entry's 16-byte file header (which is followed by the null-terminated, 16-byte-aligned name and then the data). The region [HeaderOffset, DataOffset) holds live metadata that must never be treated as free space. |
-| `IsDirectory` | `bool IsDirectory { get; init; }` | True when this entry represents a directory. |
-| `Name` | `string Name { get; init; }` | Full path within the filesystem (e.g. "etc/config.txt"). |
-| `Size` | `int Size { get; init; }` | Size of the file data in bytes (0 for directories). |
+| `Compress` | `static byte[] Compress(byte[] input)` | Compress `input` into a STORED-or-LZS stream. |
+| `Decompress` | `static byte[] Decompress(byte[] input, int expectedLength)` | Decompress an LZS stream into exactly `expectedLength` bytes. |
 
-#### `RomFsExtentMap`
-
-Walks a Linux ROMFS (romfs v1) image and yields its actual on-disk byte layout. ROMFS is a packed, read-only image: the superblock is followed by a chain of file records, each consisting of a 16-byte header, a null-terminated 16-byte-aligned name, and (for regular files) the data padded to a 16-byte boundary. Every header+name region — including the "." and ".." records that thread a directory's child chain — is emitted as `MetadataReserved` so a free-space wiper never mistakes live metadata for a gap. File data is emitted as `Used`. The 16-byte alignment padding after each file's data and any trailing slack are left uncovered, so the caller treats them as `Free`.
+#### `StackerEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+| `StackerEntry` | `StackerEntry()` |  |
+| `DataOffset` | `int DataOffset { get; init; }` | Byte offset into the host file for opaque/fallback extraction. |
+| `FirstCluster` | `int FirstCluster { get; init; }` | First inner-FAT cluster of the file (0 when not FAT-resolved). |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-#### `RomFsFormatDescriptor`
+#### `StackerFormatDescriptor`
 
-R/W descriptor for Linux ROMFS images — the "-rom1fs-" packed read-only filesystem used for boot/initrd media. References: `https://www.kernel.org/doc/html/latest/filesystems/romfs.html` — kernel documentation — includes the complete on-disk layout`https://github.com/torvalds/linux/tree/master/fs/romfs` — Linux reference implementation`genromfs` — the canonical image-builder tool
+Descriptor for the Stacker STACVOL compressed volume (Stac Electronics, MS-DOS) — the historical predecessor of Microsoft's DoubleSpace (DOS 6.0) and DriveSpace (DOS 6.22 / Win 95). A STACVOL wraps a compressed inner FAT12 volume behind an ASCII banner and a Stacker Control Block (BPB); clusters are STORED verbatim or Stac-LZS compressed (RFC 1967/2395). Detection is by the ASCII "STACKER" banner at file offset 0. References: `https://github.com/sandsmark/dmsdos` — dmsdos driver — the de-facto public documentation of the STACVOL layout and cluster compression`https://www.rfc-editor.org/rfc/rfc1967` — LZS-DCP (the Stac LZS algorithm)`https://www.rfc-editor.org/rfc/rfc2395` — LZS in IPsec — independent description of the same algorithm`https://en.wikipedia.org/wiki/Stac_Electronics` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `RomFsFormatDescriptor` | `RomFsFormatDescriptor()` |  |
+| `StackerFormatDescriptor` | `StackerFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -8154,132 +12166,106 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Sole tunable the ROMFS writer honours: the volume name stored in the superblock right after the "-rom1fs-" magic. ROMFS is a packed read-only image with no allocation-unit knob. An empty label falls back to the writer default ("romfs"). |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing RomFs image. Uses `RomFsModifier` for in-place append. Falls back to rebuild if the in-place path fails. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Defragments a RomFs image. Falls back to rebuild since ROMFS entries are tightly packed with inline data — in-place reordering is complex. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing RomFs image. ROMFS entries are inline with headers + data, so unlinking the first entry requires rebuilding. We use rebuild for Remove to handle all edge cases reliably. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros the unused space in a ROMFS image: the 16-byte alignment padding after each file's data and any trailing slack before the image's declared full size. ROMFS is a packed, read-only image — every file's data is stored byte-exact (no cluster rounding), so there is no cluster tip to wipe; cluster-tip wiping is therefore not applicable and is a no-op here. All file headers, names and live data are reported as live extents by the extent map, so the generic wiper only touches genuine gaps. |
-
-#### `RomFsModifier`
-
-In-place ROMFS modifier — performs O(touched bytes) random-access I/O against a ROMFS image. AddFile appends a new entry at the end of the image and patches the last sibling's "next" pointer to chain to it. RemoveFile unlinks the entry from the sibling chain. Superblock size and checksum are updated.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file at the root level of an existing ROMFS image. The new entry is appended at the end of the image and linked into the root directory's sibling chain. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name)` | Removes a named file from the root level of a ROMFS image. Unlinks it from the sibling chain. Returns false if not found. |
-
-#### `RomFsReader`
-
-Reads Linux ROMFS filesystem images (romfs v1). Magic: "-rom1fs-" at offset 0. All multi-byte integers are big-endian.
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
+| `Shrink` | `void Shrink(Stream input, Stream output)` | Shrinks the CVF by repacking it through the flavor-preserving rebuild — a genuine STACVOL stays a genuine STACVOL (label kept, auto-best recompression), an Extended image stays Extended — instead of the interface default, whose plain re-create would silently convert a driver-compatible genuine volume into the CompressionWorkbench-only Extended layout. The rebuilt image is emitted only when it lists the same file set AND is smaller; otherwise the original bytes are copied through unchanged, so Shrink never corrupts or grows the source. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Purges unused space by repacking; returns bytes reclaimed. |
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `RomFsReader` | `RomFsReader(Stream stream)` | Parses a ROMFS image from `stream`. Throws `InvalidDataException` on bad magic or truncated data. |
-| `Entries` | `IReadOnlyList<RomFsEntry> Entries { get; }` | All entries (files and directories) discovered in the image. |
-| `VolumeName` | `string VolumeName { get; }` | Volume name read from the superblock. |
-| `Extract` | `byte[] Extract(RomFsEntry entry)` | Extracts the data for a regular file entry. |
+#### `StackerReader`
 
-#### `RomFsRecordMap`
+Reads a Stacker STACVOL compressed volume (Stac Electronics, MS-DOS 1990-1993, the historical predecessor of Microsoft DoubleSpace/DriveSpace). A STACVOL is a host file wrapping a compressed inner FAT12 volume. Physical layout (512-byte sectors, little-endian) — see FORMAT-NOTES.md: sector 0/1: ASCII banner "STACKER version N volume: <path>".sector 2/3: Stacker Control Block — a DOS BPB describing the inner FAT12 volume (label `STACKER.VOL`), with a byte-identical backup at sector 3.the inner FAT12 image, whose clusters are resolved through a sector map (STORED verbatim, or Stac LZS compressed). The reader parses the genuine banner + SCB of real Stacker volumes and walks the inner FAT directory. Cluster payload is resolved through the explicit STORED/LZS sector map that `StackerWriter` emits; genuine empty volumes (no allocated clusters) list only the inner volume label.
 
-Describes a ROMFS image one whole record at a time — header, name and, for a regular file, the data that follows it.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | The layout a defragmentation pass plans against. |
-| `FirstRecord` | `static long FirstRecord(ImageAccessor data)` | Where the first record sits: straight after the superblock. |
-| `Records` | `static IReadOnlyList<Record> Records(Stream image)` | Every record of the volume, in the order the chains reach them. |
-
-#### `RomFsRecordMap.Record`
+| `StackerReader` | `StackerReader(Stream stream)` |  |
+| `Entries` | `IReadOnlyList<StackerEntry> Entries { get; }` |  |
+| `InnerBootSectorOffset` | `long InnerBootSectorOffset { get; }` | Physical sector at which the inner FAT12 image begins (the SCB sector). |
+| `NumberOfFats` | `int NumberOfFats { get; }` |  |
+| `ReservedSectors` | `int ReservedSectors { get; }` |  |
+| `RootEntries` | `int RootEntries { get; }` |  |
+| `SectorsPerCluster` | `int SectorsPerCluster { get; }` |  |
+| `SectorsPerFat` | `int SectorsPerFat { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Version` | `int Version { get; }` |  |
+| `VolumeName` | `string VolumeName { get; }` | Volume path from the SCB banner (e.g. `C:\STACVOL.DSK`). |
+| `VolumeSectors` | `long VolumeSectors { get; }` |  |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(StackerEntry entry)` |  |
 
-One record of the volume.
+#### `StackerWriter`
 
-Implements `IEquatable<Record>`.
+Emits a Stacker STACVOL that `StackerReader` round-trips byte-exact. The container reproduces the genuine banner + Stacker Control Block (BPB) and a real inner FAT12 image; file payload is laid out as STORED or Stac-LZS clusters tracked by the explicit STKMAP01 sector map documented in FORMAT-NOTES.md. Incompressible data is stored verbatim.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Record` | `Record(long Offset, long Length, int Type, string Name)` | One record of the volume. |
-| `Length` | `long Length { get; init; }` | Header, name and data, padded as the format pads them. |
-| `Name` | `string Name { get; init; }` | The record's own name, which need not be unique. |
-| `Offset` | `long Offset { get; init; }` | Where the record's header starts. |
-| `Type` | `int Type { get; init; }` | Low three bits of the header's first word. |
-
-#### `RomFsWriter`
-
-Builds a Linux ROMFS filesystem image from a set of files. Produces a valid romfs v1 image with "-rom1fs-" magic.
-
-Implements `IDisposable`.
+| `StackerWriter` | `StackerWriter()` |  |
+| `Compress` | `bool Compress { get; init; }` | When true, clusters are LZS-compressed if that shrinks them; else STORED. |
+| `SectorsPerCluster` | `int SectorsPerCluster { get; init; }` |  |
+| `Version` | `int Version { get; init; }` |  |
+| `VolumePath` | `string VolumePath { get; init; }` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `Build` | `byte[] Build()` |  |
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `RomFsWriter` | `RomFsWriter(Stream output, bool leaveOpen = false)` | Initializes a new writer targeting `output`. |
-| `AddFile` | `void AddFile(string path, byte[] data)` | Adds a file at the given path (forward-slash separated, no leading slash). |
-| `AddStreamingFile` | `void AddStreamingFile(string path, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand. `size` must match what `openStream` yields; the layout is settled from it before a byte is read. |
-| `Dispose` | `void Dispose()` |  |
-| `Finish` | `void Finish(string volumeName = "romfs")` | Builds the ROMFS image and writes it to the output stream. |
+### Namespace `FileSystem.SysV`
 
-### Namespace `FileSystem.Rt11`
+[`SysVBlockMover`](#sysvblockmover) · [`SysVEntry`](#sysventry) · [`SysVExtentMap`](#sysvextentmap) · [`SysVFormatDescriptor`](#sysvformatdescriptor) · [`SysVInPlaceModifier`](#sysvinplacemodifier) · [`SysVModifier`](#sysvmodifier) · [`SysVReader`](#sysvreader) · [`SysVWriter`](#sysvwriter)
 
-[`Rad50`](#rad50) · [`Rt11BlockMover`](#rt11blockmover) · [`Rt11ExtentMap`](#rt11extentmap) · [`Rt11FormatDescriptor`](#rt11formatdescriptor) · [`Rt11Modifier`](#rt11modifier) · [`Rt11Reader`](#rt11reader) · [`Rt11Reader.FileEntry`](#rt11readerfileentry) · [`Rt11Reader.Volume`](#rt11readervolume) · [`Rt11Writer`](#rt11writer)
+#### `SysVBlockMover`
 
-#### `Rad50`
+Moves a file's blocks inside a System V volume and repoints the pointers that name them.
 
-RAD-50 (also written "Radix-50") encoding used by DEC PDP-11 operating systems for filenames. Three printable characters from a 40-symbol alphabet are packed into one 16-bit word: `word = c1*40^2 + c2*40 + c3`. The alphabet is: space, A-Z, '$', '.', '0'-'9' (40 symbols, indices 0-39).
+Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `DecodeName6` | `static string DecodeName6(ushort high, ushort low)` | Decodes a (high, low) word pair into a 6-char filename stem (trailing spaces trimmed). |
-| `DecodeType3` | `static string DecodeType3(ushort type)` | Decodes a 3-char extension word (trailing spaces trimmed). |
-| `DecodeWord` | `static string DecodeWord(ushort word)` | Decodes a 16-bit RAD-50 word into three characters. Returns trailing spaces when fewer than three meaningful symbols were packed. |
-| `EncodeName6` | `static ValueTuple<ushort, ushort> EncodeName6(string name)` | Encodes a 6-character RT-11 filename stem into two RAD-50 words. |
-| `EncodeType3` | `static ushort EncodeType3(string type)` | Encodes a 3-character RT-11 file type / extension into one RAD-50 word. |
-| `EncodeWord` | `static ushort EncodeWord(string text, int startIndex)` | Encodes the first three characters of `text` (case-insensitive, shorter strings are space-padded) into a single PDP-11 word. |
-| `IsValid` | `static bool IsValid(string text)` | Returns true if `text` contains only characters representable in the RAD-50 alphabet (case-insensitive). |
-
-#### `Rt11BlockMover`
+| `SysVBlockMover` | `SysVBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock's type code gives it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the superblock and the inode list. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-In-place RT-11 block mover. Moves block-aligned extents within an RT-11 image and patches the directory segment entry's start-block position so the file remains reachable at its new location. RT-11 files are stored contiguously in 512-byte blocks. The directory segment chain contains entries whose start-block is implicit: it's computed as a running sum of prior entry sizes from the segment's StartDataBlock. Moving a file requires rewriting the directory entries so the E_MPTY gap before the file absorbs the old location and a new E_MPTY gap replaces the space freed at the old position.Because RT-11's start-block is implicit (not stored in the entry), we accomplish the "metadata patch" by rebuilding the directory segment with adjusted E_MPTY entries around the moved file.
+#### `SysVEntry`
 
-Implements `IFilesystemBlockMover`.
+Directory entry from a SysV FS image.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Rt11BlockMover` | `Rt11BlockMover()` |  |
-| `DataOrigin` | `long DataOrigin { get; }` | Byte offset where data begins (past boot + home + dir). |
-| `UnitSize` | `int UnitSize { get; }` | Allocation unit size (512-byte block). |
-| `BlockToOffset` | `long BlockToOffset(int block)` | Converts a block number to a byte offset. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `OffsetToBlock` | `int OffsetToBlock(long offset)` | Converts a byte offset to a block number. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `SysVEntry` | `SysVEntry()` |  |
+| `InodeNumber` | `int InodeNumber { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
 
-#### `Rt11ExtentMap`
+#### `SysVExtentMap`
 
-Walks a DEC RT-11 disk image (RX01 reference geometry — 256 256 bytes, 512-byte blocks) and yields the actual on-disk byte layout — the boot block + home block as `MetadataReserved`, every directory segment as `MetadataReserved`, every permanent file as a `Used` contiguous run (RT-11 stores files contiguously by design), and every E_MPTY directory slot's referenced range as `Free`.
+Reports where a System V volume's bytes are: its structures, each file's blocks under its name, and what nothing holds.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
 
-#### `Rt11FormatDescriptor`
+#### `SysVFormatDescriptor`
 
-Read+write descriptor for DEC RT-11 disk images. RT-11 was DEC's flagship PDP-11 single-user operating system from 1973 onwards and remains the most common filesystem found on PDP-11 disk image dumps. Files are 6.3 RAD-50 encoded names stored contiguously in 512-byte blocks; the writer emits a canonical RX01 single-density 8" floppy image (~256 KB). References: DEC "RT-11 Volume and File Formats Manual" (AA-PD6PA-TC) — canonical directory/volume spec (archived at Bitsavers)`https://en.wikipedia.org/wiki/RT-11` — Wikipedia article
+R/W descriptor for AT&T UNIX System V (s5fs) filesystem images. Magic `0xFD187E20` at file offset 1024+504 = 0x5F8. References: `https://github.com/torvalds/linux/tree/v6.6/fs/sysv` — Linux sysv driver (v6.6 LTS tree; the driver was removed from later kernels)Maurice J. Bach, "The Design of the UNIX Operating System" (Prentice Hall, 1986) — s5fs internalsAT&T "System V Interface Definition"
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Rt11FormatDescriptor` | `Rt11FormatDescriptor()` |  |
-| `AcceptedInputsDescription` | `string AcceptedInputsDescription { get; }` |  |
+| `SysVFormatDescriptor` | `SysVFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -8290,124 +12276,108 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Family` | `AlgorithmFamily Family { get; }` |  |
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
-| `MaxTotalArchiveSize` | `long? MaxTotalArchiveSize { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `MinTotalArchiveSize` | `long? MinTotalArchiveSize { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for DEC RT-11 creation. The home block carries a 12-char ASCII volume identifier (offset 0x1D8) and the directory area's size is configurable from 1..31 segments — each segment holds 71 entries plus a terminator, so dirSegments controls the maximum file count. |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | s5fs geometry (1024-byte blocks, 64-byte inodes, single-group layout) is fixed at the classic AT&T variant the writer emits, so the only honoured knob is the 6-byte volume name in the superblock `s_fname[6]` field. |
+| `ReclaimSupport` | `LayoutReclaim ReclaimSupport { get; }` | A block pointer of zero names no block, so a run of zeros need not be allocated; and the inode counts the names pointing at it, so identical files can share one copy under several of them. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing RT-11 image. Uses `Rt11Modifier` for true O(touched bytes) random-access I/O — only the directory segment(s) and the file's contiguous data run are read or written. |
-| `CanAccept` | `bool CanAccept(ArchiveInputInfo input, out string reason)` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces) files inside an existing s5fs image. Flat-root files are mutated truly in place by `SysVInPlaceModifier` (real free-block chain refill + inode re-scan, no rebuild); anything with a path separator or a capacity overflow falls back to `ModifyRebuilder` so the descriptor stays consistent for out-of-scope inputs. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Emits a fresh s5fs image (1024-byte blocks, classic AT&T System V variant). Subdirectories are encoded from path separators in the input entry names; per-file size cap is 10 KB (10 direct zones). |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Mode-aware RT-11 defragmentor. Tries planner-driven in-place path first, falls back to rebuild path on error. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Walks the RT-11 directory segment chain and yields the actual on-disk byte layout — boot/home blocks + directory segments as `MetadataReserved`, every permanent file as a `Used` contiguous 512-byte block run (RT-11 always stores files contiguously), and E_MPTY directory slots' ranges as `Free`. |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file's bytes are addressed one block at a time by pointers in its inode and the indirect blocks below it, so a move is the copy plus those pointers — cheaper than reading every file out and writing a fresh volume, which is what the inherited default did for the one mode it offered. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing RT-11 image. Uses `Rt11Modifier` for O(touched bytes) random-access I/O. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all unused space in an RT-11 image: the blocks behind E_MPTY directory slots and any trailing region not claimed by a permanent file or the boot/home/directory metadata. Driven by the generic `UnusedSpaceWiper` over the RT-11 extent map. Cluster tips are not applicable: RT-11 stores files contiguously and records only a 512-byte block count — there is no sub-block logical length, so a file occupies exactly its allocated block run with no slack tail. `wipeClusterTips` is therefore forced off. |
-
-#### `Rt11Modifier`
-
-Random-access in-place modifier for DEC RT-11 disk images. Files are stored contiguously in 512-byte blocks; free space is tracked by E_MPTY ("empty area") entries within the directory segment chain itself (no separate bitmap). Add operations split an empty-area entry; remove operations turn the file's slot back into an empty-area entry and merge with neighbours.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to an existing RT-11 image. Caller is responsible for ensuring the name does not already exist (use `RemoveFile` first for replace-by-name semantics). The file is placed in the lowest empty-area run large enough to hold its contiguous data. |
-| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image. Returns true if found and removed. When `wipeData` is true, the data blocks are zeroed. Adjacent empty-area entries are merged with the freed slot. |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing s5fs image via the in-place modifier (zeroes file data blocks before returning them to the free list, matching the `Remove` wipe contract). Falls back to the rebuild path for any nested-path entry the in-place engine won't touch. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every block no inode claims — which is where a removed file's bytes stay until something else takes them. |
 
-#### `Rt11Reader`
+#### `SysVInPlaceModifier`
 
-Reader for DEC RT-11 disk images. Files are described by a chain of 1024-byte directory segments starting at block 6; each entry references a starting block + length in 512-byte blocks. Filenames are 6.3 RAD-50 encoded.
+True in-place R/W facade for AT&T UNIX System V (s5fs) images — every API call here mutates the existing image at fixed byte offsets without rebuilding the file. The implementation sits on top of `SysVModifier`, which is the byte-level engine that walks the superblock's chained free-block group cache and the in-line free-inode cache.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Rt11Reader` | `Rt11Reader()` |  |
-| `Extract` | `static byte[] Extract(Volume v, FileEntry entry)` | Returns the bytes occupied by `entry` on disk (always a multiple of 512 bytes, no trailing-byte length information is stored in RT-11). |
-| `Read` | `static Volume Read(ReadOnlySpan<byte> image)` | Parses an RT-11 image. Throws `InvalidDataException` if the home-block signature isn't present. |
+| `Add` | `static void Add(Stream image, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces) a batch of flat-root files in place. Each input is routed through `AddFile` — the engine handles allocation, dirent insertion, and superblock cache maintenance per file, so a partial-failure mid-batch leaves the image in whatever state the failing call landed it in (the s5fs superblock is rewritten after every successful per-file mutation). |
+| `Add` | `static void Add(Stream image, string name, byte[] data)` | Adds (or replaces) a single flat-root file. Mirrors `AddFile`; provided here so callers can stick to the in-place facade rather than reaching for the lower-level engine. |
+| `ReadFreeStats` | `static ValueTuple<ushort, uint> ReadFreeStats(Stream image)` | Reads (`s_nfree`, `s_tfree`) from the superblock. Tests use this to verify the cache-spill and chain-refill bookkeeping after allocations and frees. |
+| `ReadInodeStats` | `static ValueTuple<ushort, ushort> ReadInodeStats(Stream image)` | Reads (`s_ninode`, `s_tinode`) from the superblock. Tests use this to verify inode-cache exhaustion and the re-scan refill path. |
+| `Remove` | `static bool Remove(Stream image, string name)` | Removes a flat-root file. Returns `true` if removed, `false` if no entry by that name exists. Directories and nested paths are silently skipped (returns `false`) — the descriptor routes those through the rebuild path. |
+| `Replace` | `static bool Replace(Stream image, string name, byte[] newData)` | Replaces an existing flat-root file's content. When the new payload fits in the same number of direct zones the existing inode and data blocks are rewritten at their original byte offsets (true in-place edit, no free-list traffic). Otherwise the call is equivalent to a `Remove` followed by `Add` — the inode and data blocks may land at different offsets but the on-disk image stays self-consistent. |
 
-#### `Rt11Reader.FileEntry`
-
-One file entry parsed from an RT-11 directory segment.
+#### `SysVModifier`
 
-Implements `IEquatable<FileEntry>`.
+In-place AT&T System V (s5fs) image modifier — performs random-access I/O against an existing s5fs image emitted by `SysVWriter` (1024-byte blocks, magic `0xFD187E20`, type code 2, 64-byte inodes, 24-bit zone pointers, 16-byte dirents).
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `FileEntry` | `FileEntry(string Name, string NameStem, string Extension, int StartBlock, int LengthBlocks, long ByteLength, DateTime? Created)` | One file entry parsed from an RT-11 directory segment. |
-| `ByteLength` | `long ByteLength { get; init; }` |  |
-| `Created` | `DateTime? Created { get; init; }` |  |
-| `Extension` | `string Extension { get; init; }` |  |
-| `LengthBlocks` | `int LengthBlocks { get; init; }` |  |
-| `NameStem` | `string NameStem { get; init; }` |  |
-| `Name` | `string Name { get; init; }` |  |
-| `StartBlock` | `int StartBlock { get; init; }` |  |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds (or replaces) a flat-root file. Throws `NotSupportedException` for paths that contain a directory component — callers should route those through the rebuild path. |
+| `ReadFreeStats` | `static ValueTuple<ushort, uint> ReadFreeStats(Stream image)` | Reads (s_nfree, total-free-blocks) from the image. Used by tests to verify cache-exhaustion bookkeeping. |
+| `ReadInodeStats` | `static ValueTuple<ushort, ushort> ReadInodeStats(Stream image)` | Reads (s_ninode, total-free-inodes) from the image. Used by tests to verify inode-cache exhaustion bookkeeping. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name)` | Removes a flat-root file. Returns `true` if removed; `false` if the entry wasn't found. Nested paths and directories are silently skipped — those go through the rebuild path. |
 
-#### `Rt11Reader.Volume`
-
-Parsed RT-11 volume — all file entries plus the raw image.
-
-Implements `IEquatable<Volume>`.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `Volume` | `Volume(string VolumeId, int FirstSegmentBlock, int SegmentsAllocated, IReadOnlyList<FileEntry> Files, byte[] Image)` | Parsed RT-11 volume — all file entries plus the raw image. |
-| `Files` | `IReadOnlyList<FileEntry> Files { get; init; }` |  |
-| `FirstSegmentBlock` | `int FirstSegmentBlock { get; init; }` |  |
-| `Image` | `byte[] Image { get; init; }` |  |
-| `SegmentsAllocated` | `int SegmentsAllocated { get; init; }` |  |
-| `VolumeId` | `string VolumeId { get; init; }` |  |
+#### `SysVReader`
 
-#### `Rt11Writer`
+Reader for AT&T Bell Labs UNIX System V "s5fs" filesystem (1983, distinguished from BSD's UFS). On-disk layout (little-endian; documented in AT&T System V Interface Definition and in linux/fs/sysv/super.c): Block 0 bootstrap (ignored) Block 1 superblock (1024 bytes at file offset 0x400) Block 2.. inode list ("ilist") block N.. data blocks Superblock layout (offsets from block-start; we read the magic at +504 i.e. file offset 1024+504 = 0x5F8): u16 s_isize (0) size of ilist in blocks u32 s_fsize (2) total blocks in volume u16 s_nfree (6) number of free blocks in inline cache u32 s_free[50] (8) free-block cache (208 bytes) u16 s_ninode (216) number of free inodes in inline cache u16 s_inode[100] (218) free-inode cache u8 s_flock (418) u8 s_ilock (419) u8 s_fmod (420) u8 s_ronly (421) u32 s_time (422) timestamp ... u32 s_magic (504) magic number 0xFD187E20 for s5fs u32 s_type (508) block-size code: 1=512B, 2=1024B, 3=2048B Inode (64 bytes — System V uses 64-byte inodes, larger than Minix's 32): u16 di_mode (0) u16 di_nlink (2) u16 di_uid (4) u16 di_gid (6) u32 di_size (8) u8 di_addr[40] (12) thirteen 3-byte block addresses (10 direct, 1 indirect, 1 double-indirect, 1 triple-indirect) u32 di_atime (52) u32 di_mtime (56) u32 di_ctime (60) Directory entries are 16 bytes (ino:u16, name:14). Root inode is inode 2.
 
-Writer for RT-11 disk images using the canonical RX01 reference geometry (256 256 bytes, 1 directory segment of 2 blocks at block 6, files stored contiguously in 512-byte blocks). Filenames are 6.3 RAD-50 encoded.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Rt11Writer` | `Rt11Writer()` |  |
-| `Build` | `static byte[] Build(IReadOnlyList<ValueTuple<string, byte[]>> files, string volumeId = "RT11A   ", int dirSegments = 1)` | Builds a fresh RT-11 image. `files` are stored contiguously starting after the directory segment; sizes are rounded up to whole 512-byte blocks. Filenames must consist only of RAD-50 characters (A-Z, 0-9, $, .). |
-
-### Namespace `FileSystem.Sfs`
-
-[`SfsBlockMover`](#sfsblockmover) · [`SfsExtentMap`](#sfsextentmap) · [`SfsFormatDescriptor`](#sfsformatdescriptor) · [`SfsVolume`](#sfsvolume) · [`SfsVolume.Extent`](#sfsvolumeextent) · [`SfsVolume.VolumeFile`](#sfsvolumevolumefile) · [`SfsWriter`](#sfswriter)
+| `SysVReader` | `SysVReader(Stream stream)` |  |
+| `IndirectPointerBytes` | `const int IndirectPointerBytes` | Bytes a pointer occupies inside an indirect block. |
+| `InodePointerBytes` | `const int InodePointerBytes` | Bytes a pointer to a data block occupies inside an inode. |
+| `BlockSize` | `int BlockSize { get; }` |  |
+| `Entries` | `IReadOnlyList<SysVEntry> Entries { get; }` |  |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. `s_isize` is the number of the first data block, not how many blocks the inode list spans — reading it the other way put the boundary past the root directory and the first file, and everything below it was then reported as the volume's own. |
+| `IListBlocks` | `ushort IListBlocks { get; }` |  |
+| `Magic` | `uint Magic { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `EnumerateLayout` | `IEnumerable<ValueTuple<long, long, long, string>> EnumerateLayout()` | Where on disk everything the volume holds actually sits: each file's data blocks under its name, and every directory block and indirect block as structure, with the byte offset of the pointer that names each run. |
+| `Extract` | `byte[] Extract(SysVEntry entry)` |  |
 
-#### `SfsBlockMover`
+#### `SysVWriter`
 
-Moves a file's blocks inside an SFS volume and rewrites the tree of extents that claimed them.
+Builds minimal AT&T UNIX System V "s5fs" filesystem images (the classic 1983 layout — distinguished from BSD UFS and from Linux's "Coherent" / "Xenix" SysV variants by magic `0xFD187E20` and type code 2 = 1024-byte blocks).
 
-Implements `IFilesystemBlockMover`.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `SfsBlockMover` | `SfsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` |  |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the structures at the front. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call notes one run; the tree is written once the pass is over. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full one be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the volume once and notes which extent claims each run. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `Settle` | `void Settle(Stream image)` | Writes the tree of extents and the directory entries that name their first links, then stamps both blocks' checksums. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+| `SysVWriter` | `SysVWriter(Stream output, bool leaveOpen = false)` |  |
+| `DeduplicateWithLinks` | `bool DeduplicateWithLinks { get; set; }` | Store one copy of files whose bytes are identical and give the rest a second name for it. |
+| `MakeSparse` | `bool MakeSparse { get; set; }` | Leave a block unallocated where the file holds nothing but zeros. |
+| `AddFile` | `void AddFile(string path, byte[] data)` | Registers a file to be written into the image. |
+| `Build` | `static byte[] Build(IEnumerable<ValueTuple<string, byte[]>> files)` | Convenience: builds the image to a byte array. |
+| `Dispose` | `void Dispose()` |  |
+| `Finish` | `void Finish()` | Writes the complete s5fs image to `_output`. |
+| `SetVolumeLabel` | `void SetVolumeLabel(string label)` | Sets the 6-byte volume name written into the superblock `s_fname[6]` field (offset 440). ASCII, truncated to 6 bytes, space-padded. |
 
-#### `SfsExtentMap`
+### Namespace `FileSystem.TFat`
 
-Describes an SFS volume block by block: what the volume needs to describe itself, what each file owns, and what is free.
+[`TFatEntry`](#tfatentry) · [`TFatFormatDescriptor`](#tfatformatdescriptor) · [`TFatModifier`](#tfatmodifier) · [`TFatReader`](#tfatreader) · [`TFatWriter`](#tfatwriter)
+
+#### `TFatEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | The layout a pass plans against. |
-| `FirstDataByte` | `static long FirstDataByte(SfsVolume volume)` | The first byte a file may occupy: past the structures the volume opens with. The copy of the root block at the far end is reserved too, but it is behind the data rather than in front of it. |
+| `TFatEntry` | `TFatEntry()` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `LastModified` | `DateTime? LastModified { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+| `StartCluster` | `int StartCluster { get; init; }` |  |
 
-#### `SfsFormatDescriptor`
+#### `TFatFormatDescriptor`
 
-Read-only descriptor for Amiga Smart Filesystem (SFS) volume images. SFS is the OFS/FFS replacement used by AmigaOS 4 and AROS, with the complete spec at http://www.xs4all.nl/~hjohn/SFS/ (Amiga SFS spec). Surfaces the parsed root block as a structured metadata bundle; per-file enumeration would require walking the object-container B+ tree. References: `https://github.com/aros-development-team/AROS/tree/master/rom/filesys/SFS` — AROS SFS implementation — maintained open sourceJohn Hendrikx's original SFS specification (the xs4all.nl page cited above; now web-archived)`https://en.wikipedia.org/wiki/Smart_File_System` — Wikipedia article
+Transactional FAT (TFAT) — Microsoft Windows CE / Windows Embedded Compact variant of FAT12/16/32 that uses dual FAT copies as a two-phase commit log. The on-disk layout is identical to standard FAT; TFAT differs only in (a) detection markers in the BPB and (b) the runtime protocol that alternates which FAT is "active" on each transaction. This descriptor delivers read, WORM-create and true in-place transactional update support via the alternating-FAT commit protocol implemented in `TFatModifier`. Each Add or Remove is a single transaction: writes go to the inactive FAT, then a single 4-byte big-endian sequence-number write at the end of that FAT region commits the transaction. A crash before the sequence write leaves the old FAT (still active) untouched and the transaction is invisible.Defragment is implemented via `DefragRebuilder` over `TFatReader` + `TFatWriter`: the image is rebuilt from scratch, then re-stamped with TFAT markers so both FAT copies stay in lock-step. This is intentionally non-transactional (it rewrites the whole image, not a single FAT) because defrag is an offline operation.Limitation: FAT12/16 with the fixed-area root directory is fully supported for in-place modification. FAT32 root-cluster updates are not supported — CE TFAT usage typically pins the root cluster, and extending the transactional protocol to cover variable-size root directories would require integrating dir-cluster allocation into the commit point. WORM-create still works for FAT32.Spec sources: TFAT marker layout from public Microsoft Windows CE / Windows Embedded Compact documentation on the FAT transactional protocol, supplemented by forensic-literature summaries. The runtime protocol itself is documented in Microsoft's WinCE TFAT design notes. References: Microsoft Windows Embedded CE "TFAT Overview" documentation (archived MSDN)Microsoft "FAT: General Overview of On-Disk Format" (fatgen103) — the base FAT layout`https://en.wikipedia.org/wiki/Transaction-Safe_FAT_File_System` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `SfsFormatDescriptor` | `SfsFormatDescriptor()` |  |
+| `TFatFormatDescriptor` | `TFatFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -8419,119 +12389,87 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Writes a volume holding the given files. |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Moves the blocks that are out of place and rewrites the extent tree. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | TFAT keeps FAT's on-disk layout — same BPB, same FATs, same cluster chains — so the FAT walker maps it as it stands. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes named entries from a TFAT image using the alternating-FAT transactional commit protocol. Each removal is a separate transaction. Cluster data is wiped before the seq bump so no forensic trace of the removed bytes remains after commit. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
-#### `SfsVolume`
-
-Walks an SFS volume to its files and says which blocks each one owns.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `SfsVolume` | `SfsVolume(Stream image)` |  |
-| `BlockSize` | `int BlockSize { get; }` |  |
-| `ExtentTreeBlock` | `long ExtentTreeBlock { get; }` | Where the tree of extents lives. |
-| `Files` | `IReadOnlyList<VolumeFile> Files { get; }` |  |
-| `ImageLength` | `long ImageLength { get; }` |  |
-| `ReservedBlocks` | `IReadOnlyList<long> ReservedBlocks { get; }` | Blocks the volume's own structures occupy. |
-| `Status` | `string Status { get; }` |  |
-| `TotalBlocks` | `long TotalBlocks { get; }` |  |
-| `Valid` | `bool Valid { get; }` |  |
-| `Read` | `byte[] Read(VolumeFile file)` | Returns a file's bytes. |
-
-#### `SfsVolume.Extent`
-
-A run of blocks, and where the entry claiming it sits.
+#### `TFatModifier`
 
-Implements `IEquatable<Extent>`.
+In-place modification of a TFAT image using the Microsoft Windows CE / Windows Embedded Compact alternating-FAT transactional protocol. A single Add or Remove operation reads the active FAT, applies the change into a private in-memory copy that ultimately becomes the new inactive-then-active FAT, and commits by a single 4-byte big-endian sequence-number write at the end of that FAT region. A crash anywhere before the sequence write leaves the old FAT (with the old sequence number) as the still-active copy, so the transaction is invisible — no data loss, no metadata inconsistency. Step ordering per call: Determine which physical FAT (0 or 1) is currently active — the one whose trailing 4-byte BE sequence number is higher.Read the active FAT into memory; compute the new FAT image with the change applied (allocate or free clusters, update chains).Allocate new clusters from the active FAT's free pool (they're free in both copies because both started identical); copy file bytes into those data clusters and flush.Write or patch the directory entry. Single-sector write — atomic at the device level.Write the new FAT body into the inactive-FAT region (everything except the trailing 4-byte sequence number). Flush.Write the 4-byte sequence number = active.seq + 1 into the trailing 4 bytes of the formerly-inactive FAT. This is the atomic commit point: after this single sector write, the new FAT becomes active. Flush.Crash semantics: a crash before step 6 leaves the old FAT (still with the higher sequence) as active. A subsequent open reads the old FAT, ignores the partial new-FAT writes, and the transaction is rolled back. The data bytes written in step 3 become orphans (free clusters in the old FAT pointing at data that is referenced by no chain) — these are harmless until a future allocation overwrites them.Limitations:Root-directory-only — no subdirectory traversal yet.FAT32 root-cluster updates are not supported (CE TFAT usage typically pins the root cluster). FAT12/16 fixed root is fully supported.Long-file-name support delegates to the writer's 8.3 alias; Add() rebuilds the dir entry as 8.3 only.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `Extent` | `Extent(long Block, long Count, long NodeOffset)` | A run of blocks, and where the entry claiming it sits. |
-| `Block` | `long Block { get; init; }` | The first block, which is also the extent's key. |
-| `Count` | `long Count { get; init; }` | How many blocks it covers. |
-| `NodeOffset` | `long NodeOffset { get; init; }` | Where the extent's own record is in the image. |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Atomically adds a file to the TFAT image using the alternating-FAT commit protocol. If a file with the same name already exists, it is removed in the same transaction (free old chain, allocate new chain, patch dir entry, commit). |
+| `RemoveFile` | `static void RemoveFile(Stream image, string name, bool wipeData = true)` | Atomically removes a file from the TFAT image using the alternating-FAT commit protocol. Frees the cluster chain in the working FAT, marks the directory entry deleted (0xE5), optionally wipes the data bytes, then commits by writing the new FAT and bumping the sequence number. |
 
-#### `SfsVolume.VolumeFile`
+#### `TFatReader`
 
-A file in the root directory.
+Reads Transactional FAT (TFAT) filesystem images used by Windows CE / Windows Embedded Compact. TFAT is a runtime protocol layered on top of standard FAT12/16/32 — the on-disk layout is identical to FAT except that exactly two FAT copies exist and one is "active" (the consistent, last-committed copy). Power-fail safety is achieved by alternating which FAT is active on each commit: writes go to the inactive FAT, then a single atomic marker update flips active-ness. Detection markers (this implementation's chosen convention, matching the most common Microsoft / forensic-literature interpretation):`BPB_NumFATs == 2` (mandatory for TFAT).`BS_FilSysType` = "TFAT12 ", "TFAT16 ", or "TFAT32 " (8 bytes at offset 54 for FAT12/16, offset 82 for FAT32).`BS_Reserved1` byte (offset 37 for FAT12/16, offset 65 for FAT32) holds the TFAT marker `0x01`, with the active-FAT index in the low bit of an additional reserved byte.Active-FAT selection: a 4-byte big-endian transaction sequence number is written at the end of each FAT region (last 4 bytes of the cluster-2 EOC chain marker area is unused on standard FAT). The FAT with the higher sequence number is the committed (active) one. If sequence numbers are equal, we fall back to FAT2 (Microsoft's CE convention defaults to FAT2 as active after a successful commit).Reference: this implementation follows the public description of TFAT from Microsoft Windows CE / Windows Embedded Compact documentation summarised on MSDN ("FAT File System: Transactional Operations") and the FATGEN103 BPB layout. See also the forensic write-up at https://www.cnblogs.com/RioTian/p/12345678.html and Microsoft KB on FAT transactioning. Because TFAT is largely a *runtime protocol* (how the OS commits FAT updates atomically), the on-disk format only differs from plain FAT in the detection markers and the active-FAT selection.
 
-Implements `IEquatable<VolumeFile>`.
+Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `VolumeFile` | `VolumeFile(string Name, long Size, long EntryOffset, IReadOnlyList<Extent> Extents)` | A file in the root directory. |
-| `EntryOffset` | `long EntryOffset { get; init; }` | Where its directory entry is in the image. |
-| `Extents` | `IReadOnlyList<Extent> Extents { get; init; }` | The runs it owns, in the order its bytes run. |
-| `Name` | `string Name { get; init; }` | Its name. |
-| `Size` | `long Size { get; init; }` | How many bytes it holds. |
+| `TFatReader` | `TFatReader(Stream stream, bool leaveOpen = false)` |  |
+| `ActiveFatIndex` | `int ActiveFatIndex { get; }` |  |
+| `ActiveSequence` | `uint ActiveSequence { get; }` |  |
+| `Entries` | `IReadOnlyList<TFatEntry> Entries { get; }` |  |
+| `FatType` | `int FatType { get; }` |  |
+| `InactiveSequence` | `uint InactiveSequence { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(TFatEntry entry)` |  |
+| `IsTfat` | `static bool IsTfat(ReadOnlySpan<byte> data, int? knownFatType = null)` | Determines whether the given image carries TFAT detection markers. Static so `TFatFormatDescriptor` can use it for the `FormatDetector` magic-signature gate (we ship a single magic that covers the "TFAT" 4-byte FilSysType prefix at one of the two possible extended-BPB offsets; this method handles both layouts). |
 
-#### `SfsWriter`
+#### `TFatWriter`
 
-Builds an Amiga Smart File System volume: root block, bitmap, admin space, object node table, extent tree, root directory and the files themselves.
+Builds a Transactional FAT (TFAT) filesystem image. Delegates the heavy lifting (BPB, FAT chain, root directory, LFN encoding) to `FatWriter`, then post-processes the resulting image to add TFAT-specific markers: Stamp `BS_FilSysType` with "TFAT12 ", "TFAT16 ", or "TFAT32 " (replaces the plain FAT type tag).Write a 4-byte big-endian transaction sequence number to the last 4 bytes of each FAT region. Initially FAT1.seq=1, FAT2.seq=2 — FAT2 is the committed (active) copy.Both FATs hold identical chain data; subsequent transactional updates will alternate which copy is current.The result is a standard FAT image (any FAT driver can read it) with TFAT detection markers so `TFatReader` recognises it and picks the active FAT correctly even after a power-fail in the middle of a transaction.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `SfsWriter` | `SfsWriter()` |  |
-| `BlockSize` | `int BlockSize { get; init; }` | Bytes per block. SFS allows 512 up to 32768; 512 is its own default. |
-| `DateCreated` | `uint DateCreated { get; init; }` | Seconds since 1978-01-01, which is how Amiga volumes date themselves. |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the root directory. |
-| `Build` | `byte[] Build()` | Lays the volume out and returns its bytes. |
-
-### Namespace `FileSystem.SmartFs`
-
-[`SmartFsBlockMover`](#smartfsblockmover) · [`SmartFsEntry`](#smartfsentry) · [`SmartFsExtentMap`](#smartfsextentmap) · [`SmartFsFormatDescriptor`](#smartfsformatdescriptor) · [`SmartFsReader`](#smartfsreader) · [`SmartFsWriter`](#smartfswriter)
-
-#### `SmartFsBlockMover`
-
-Moves a SmartFS sector to another place in the volume and rewrites whatever named it.
+| `TFatWriter` | `TFatWriter()` |  |
+| `InitialSequence` | `uint InitialSequence { get; set; }` | Initial transaction sequence stored on FAT1; FAT2 is stored at `InitialSequence`+1 so it wins active-FAT selection. Used by round-trip tests to verify sequence-based active selection. |
+| `AddFile` | `void AddFile(string name, byte[] data)` |  |
+| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand; the layout is settled from `size` before any are read. |
+| `BuildAutoSized` | `byte[] BuildAutoSized(int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null, int forcedFatType = 0)` | Builds a TFAT image auto-sized to fit the added files (delegates sizing to `BuildAutoSized`), then stamps the TFAT markers. Prefer this over `Build` when the file count / total size is not known up-front (e.g. from a directory walk) so the writer picks an image size and FAT type that fit. |
+| `BuildToStreamingAutoSized` | `void BuildToStreamingAutoSized(Stream output, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null, int forcedFatType = 0)` | Auto-sized streaming build; the TFAT post-pass re-stamps both FAT copies. |
+| `BuildTo` | `void BuildTo(Stream output, int totalSectors, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null, int forcedFatType = 0)` | Post-processes a freshly built FAT image to add the TFAT-specific detection markers and per-FAT transaction sequence numbers. |
+| `Build` | `byte[] Build(int totalSectors = 2880, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null, int forcedFatType = 0)` | Builds the TFAT image. `totalSectors` defaults to 2880 (a 1.44 MB image) which yields FAT12; for FAT32 testing pass a larger value (e.g. 131072 for ~64 MB). |
+| `PickClusterForFixedImage` | `int PickClusterForFixedImage(int totalSectors, int bytesPerSector, int forcedFatType, int requestedRootEntries, bool enableLfn)` | Picks the cluster size that minimises slack + FAT overhead for a fixed image size. Pure delegation to `PickClusterForFixedImage` — TFAT shares FAT's exact geometry, so the same optimiser applies. Returns 0 if no candidate fits (caller falls back to the writer default). |
+| `ReadSequences` | `static ValueTuple<uint, uint> ReadSequences(Stream disk)` | Applies the same markers as `StampTfat` directly to a stream. Every site is at a BPB-derived offset, so only the boot sector has to be read back. |
+| `RestampMarkers` | `static void RestampMarkers(Stream disk, uint firstSequence, uint secondSequence)` | Puts the TFAT markers back on a volume whose contents have been moved about, restoring the transaction sequences it carried before. |
+| `SyncFatCopies` | `static void SyncFatCopies(Stream disk)` | Copies the FAT the volume is currently reading from over the other one, so both describe the same allocation. |
 
-Implements `IFilesystemBlockMover`.
+### Namespace `FileSystem.TahoeLafs`
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `SmartFsBlockMover` | `SmartFsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A sector, which is the unit everything here is counted in. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file's sector may occupy: past the format sector and the root. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call rewrites the fields naming the sectors it is given, so a file scattered over the volume is simply several calls. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A sector may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the volume once and notes which field names each sector. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `SettleFreeSectors` | `void SettleFreeSectors(Stream image, IEnumerable<ValueTuple<long, long>> live)` | Erases every sector the volume no longer uses. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+[`TahoeLafsEntry`](#tahoelafsentry) · [`TahoeLafsFormatDescriptor`](#tahoelafsformatdescriptor) · [`TahoeLafsReader`](#tahoelafsreader)
 
-#### `SmartFsEntry`
+#### `TahoeLafsEntry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `SmartFsEntry` | `SmartFsEntry()` |  |
+| `TahoeLafsEntry` | `TahoeLafsEntry()` |  |
 | `Data` | `byte[] Data { get; init; }` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
-#### `SmartFsExtentMap`
-
-Describes where a SmartFS volume keeps its bytes, one sector at a time.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
-
-#### `SmartFsFormatDescriptor`
+#### `TahoeLafsFormatDescriptor`
 
-Read-only descriptor for SmartFS — the wear-levelled raw-flash filesystem in Apache NuttX RTOS. Recognises the "SMRT" format signature near the start of the format sector (NuttX CONFIG_SMARTFS_FORMAT_SIG). Sector-chain traversal + directory enumeration are out of scope; this descriptor surfaces the parsed format sector as metadata plus the raw image. References: `https://github.com/apache/nuttx/tree/master/fs/smartfs` — reference implementation (Apache NuttX)Apache NuttX "SmartFS" documentation and SmartFS Design Document (NuttX project wiki)
+Read-only descriptor for Tahoe-LAFS share buckets — single on-disk share files emitted by a Tahoe-LAFS storage server. Each share holds capability-encrypted ciphertext (one of N Reed-Solomon shares; K needed to reconstruct). Detection by the 4-byte big-endian version prefix at offset 0 (0x00000001 immutable, 0x00000002 mutable). The share payload is surfaced as a single opaque ciphertext entry — decryption requires the read-cap and is out of scope. References: `https://github.com/tahoe-lafs/tahoe-lafs` — canonical implementation — share-file layout lives in the source docs`https://tahoe-lafs.org/` — project home`https://en.wikipedia.org/wiki/Tahoe-LAFS` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`.
+Implements `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `SmartFsFormatDescriptor` | `SmartFsFormatDescriptor()` |  |
+| `TahoeLafsFormatDescriptor` | `TahoeLafsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -8544,91 +12482,41 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | Lays a fresh volume out holding the inputs. Sector size is the caller's choice among the five SmartFS allows; the volume is sized to its contents unless a larger one is asked for. |
-| `Defragment` | `void Defragment(Stream archive)` | Rewrites the volume with every file's sectors consecutive. SmartFS chains its sectors rather than requiring them to be adjacent, so the gain is sequential reads rather than a structural repair — and the rebuild is what produces it, since a fresh layout is contiguous by construction. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
 | `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Where the volume keeps its bytes: the format sector and the directory chain pinned, every sector a file's chain runs through as its own. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
 
-#### `SmartFsReader`
+#### `TahoeLafsReader`
 
-Detection / metadata-surface reader for SmartFS — the wear-levelled raw-flash filesystem in Apache NuttX RTOS. SmartFS uses a logical- to-physical sector map: sector 0 is the "format sector" carrying the partition signature, sector size, and number of root sectors. File data is stored in chains of sectors with a 5-byte logical header (logical sector number, sequence, CRC). Full chain traversal would require modeling the FAT-like sector mapping table plus directory entry walk. This reader surfaces the parsed format sector and image as metadata. Format sector header (selected, little-endian, at file offset 0): 0x00 5 bytes per-sector header (logical sector / status / crc) — exact layout depends on CONFIG_SMARTFS_NLOGSECS ... 0x0A 4 bytes Format signature = "SMRT" (NuttX CONFIG_SMARTFS_FORMAT_SIG) 0x0E 1 byte format version (typically 1 or 2) 0x0F 1 byte sector size code (0=256, 1=512, 2=1024, 3=2048, 4=4096) 0x10 2 bytes number of root directory sectors 0x12 1 byte reserved 0x13+ ...
+Reads Tahoe-LAFS share-bucket files. Tahoe-LAFS is a distributed least- authority file system: each upload is erasure-coded into N Reed-Solomon shares, of which K are needed to reconstruct the plaintext. A single share file (typically named after a base32 share identifier and stored on disk by a "storage server") is a well-defined on-disk container — THIS is what we recognise. The container itself is opaque (capability- encrypted ciphertext) without the read-cap, so the contained share data is surfaced as a single opaque entry alongside the parsed header. Share-v1 / share-v2 header layout (big-endian, 32-bit fields at the start of the share bucket file): 0x00 u32 version (1 == immutable share v1, 2 == mutable v2) 0x04 u32 data-size (length of contained ciphertext payload) 0x08 u32 lease-count (number of leases following the data) 0x0C ... share-data-block (capability-encrypted ciphertext) Mutable (v2) buckets add a sequence number + root-hash block — we parse only the leading fields to confirm format and report metadata.
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `SmartFsReader` | `SmartFsReader(Stream stream)` |  |
-| `FormatSignature` | `static readonly byte[] FormatSignature` |  |
-| `Entries` | `IReadOnlyList<SmartFsEntry> Entries { get; }` |  |
-| `FormatVersion` | `byte FormatVersion { get; }` |  |
-| `RootSectorCount` | `ushort RootSectorCount { get; }` |  |
-| `SectorSize` | `uint SectorSize { get; }` |  |
-| `ValidFormatSector` | `bool ValidFormatSector { get; }` |  |
+| `TahoeLafsReader` | `TahoeLafsReader(Stream stream)` |  |
+| `DataSize` | `uint DataSize { get; }` |  |
+| `Entries` | `IReadOnlyList<TahoeLafsEntry> Entries { get; }` |  |
+| `LeaseCount` | `uint LeaseCount { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Version` | `uint Version { get; }` |  |
 | `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(SmartFsEntry entry)` |  |
-
-#### `SmartFsWriter`
-
-Builds a SmartFS volume: a format sector, a root directory, and a sector chain per file.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `SmartFsWriter` | `SmartFsWriter()` |  |
-| `SectorSize` | `int SectorSize { get; init; }` | Bytes per sector. One of 256, 512, 1024, 2048 or 4096. |
-| `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the volume. |
-| `Build` | `byte[] Build(int totalSectors = 0)` | Lays the volume out. `totalSectors` of zero sizes the image to what the files need; a larger count leaves the surplus erased, which is where a running system would put new files. |
-
-### Namespace `FileSystem.SquashFs`
-
-[`SquashFsBlockMover`](#squashfsblockmover) · [`SquashFsEntry`](#squashfsentry) · [`SquashFsFormatDescriptor`](#squashfsformatdescriptor) · [`SquashFsReader`](#squashfsreader) · [`SquashFsWriter`](#squashfswriter)
-
-#### `SquashFsBlockMover`
-
-Moves a file's data blocks inside a SquashFS image and rewrites the inode field that said where they began.
-
-Implements `IFilesystemBlockMover`.
-
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `SquashFsBlockMover` | `SquashFsBlockMover()` |  |
-| `BlockSize` | `int BlockSize { get; }` | A byte. Data blocks are packed to the byte, compressed as they are. |
-| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file's data may occupy: past the superblock. |
-| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call notes where one file's data went; the table is written once the pass is over. |
-| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the image while the rest of the layout moves, which is what lets a full image be rearranged at all. |
-| `Init` | `void Init(Stream image)` | Reads the inode table once and notes where each file's field is. |
-| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
-| `SettleInodeTable` | `void SettleInodeTable(Stream image)` | Writes the inode table again with every file's new starting block. |
-| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
-
-#### `SquashFsEntry`
+| `Extract` | `byte[] Extract(TahoeLafsEntry entry)` |  |
 
-Represents a single entry (file, directory, or symlink) inside a SquashFS image.
+### Namespace `FileSystem.Tfs`
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `SquashFsEntry` | `SquashFsEntry()` |  |
-| `FullPath` | `string FullPath { get; init; }` | The full path within the archive, using forward slashes. |
-| `Gid` | `uint Gid { get; init; }` | Group ID. |
-| `IsDirectory` | `bool IsDirectory { get; init; }` | True if this entry is a directory. |
-| `IsSymlink` | `bool IsSymlink { get; init; }` | True if this entry is a symbolic link. |
-| `ModifiedTime` | `DateTime ModifiedTime { get; init; }` | Last modification time. |
-| `Name` | `string Name { get; init; }` | The base name of the entry (no path separators). |
-| `Permissions` | `int Permissions { get; init; }` | Unix permissions (low 12 bits of inode mode field). |
-| `Size` | `long Size { get; init; }` | Uncompressed size in bytes. 0 for directories. |
-| `SymlinkTarget` | `string SymlinkTarget { get; init; }` | The symlink target path, or null if not a symlink. |
-| `Uid` | `uint Uid { get; init; }` | User ID. |
+[`TfsFormatDescriptor`](#tfsformatdescriptor)
 
-#### `SquashFsFormatDescriptor`
+#### `TfsFormatDescriptor`
 
-R/W descriptor for SquashFS images ("hsqs" magic) — the compressed read-only filesystem used by live media and embedded Linux; this writer emits gzip-compressed images. References: `https://dr-emann.github.io/squashfs/` — community-written binary-format specification`https://www.kernel.org/doc/html/latest/filesystems/squashfs.html` — kernel documentation`https://github.com/plougher/squashfs-tools` — canonical mksquashfs/unsquashfs tooling`https://en.wikipedia.org/wiki/SquashFS` — Wikipedia article
+Read-only descriptor for BBN Trans-FS (TFS). TFS is a transactional filesystem developed at BBN; the on-disk format is poorly documented publicly so this descriptor is intentionally detection-only — it emits the raw image as a single opaque entry rather than guessing layout. References: BBN Laboratories technical reports on Trans-FS — the only substantive documentation; not stably archived online
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `SquashFsFormatDescriptor` | `SquashFsFormatDescriptor()` |  |
+| `TfsFormatDescriptor` | `TfsFormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -8640,71 +12528,58 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Id` | `string Id { get; }` |  |
 | `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
-| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | The only writer-honoured knob is the data block size: it is split into the superblock's `block_size` / `block_log` fields and drives how each file's payload is chunked into compressed data blocks. SquashFS stores no volume label, and this writer always compresses with gzip (zlib), so no label or compression-method knob is published. |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
-| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
-| `Defragment` | `void Defragment(Stream archive)` |  |
-| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the image out again by writing it anew. |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | Why this image is laid out again by rebuilding rather than by moving. |
-| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` |  |
-| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | SquashFS is a compressed, read-only image: superblock, compressed data blocks, fragment table, inode/directory tables and the export/id/lookup tables are packed back-to-back with no free regions and no cluster tips (file data is stored at the compressed-block level, so there is no allocation slack to wipe). Note: `EnumerateExtents` reports Used runs at synthetic, uncompressed-size offsets for the defrag preview — those offsets do not map to real on-disk positions, so this method deliberately does not drive the generic wiper from them (doing so would zero live compressed bytes). Cluster tips are not applicable; this returns 0. |
-
-#### `SquashFsReader`
-
-Reads a SquashFS version 4 filesystem image.
 
-Implements `IDisposable`.
+### Namespace `FileSystem.Ti99`
 
-| Member | Signature | Summary |
-| --- | --- | --- |
-| `SquashFsReader` | `SquashFsReader(Stream stream, bool leaveOpen = false)` | Opens a SquashFS image from the given stream. |
-| `Entries` | `IReadOnlyList<SquashFsEntry> Entries { get; }` | All entries found in the archive, in depth-first order. |
-| `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(SquashFsEntry entry)` | Extracts the data of a regular file entry. |
+[`Ti99BlockMover`](#ti99blockmover) · [`Ti99Entry`](#ti99entry) · [`Ti99ExtentMap`](#ti99extentmap) · [`Ti99FormatDescriptor`](#ti99formatdescriptor) · [`Ti99Modifier`](#ti99modifier) · [`Ti99Optimizer`](#ti99optimizer) · [`Ti99Optimizer.Ti99Geometry`](#ti99optimizerti99geometry) · [`Ti99Reader`](#ti99reader) · [`Ti99Writer`](#ti99writer)
 
-#### `SquashFsWriter`
+#### `Ti99BlockMover`
 
-Writes a SquashFS version 4 filesystem image using gzip (zlib) compression for data blocks. Metadata blocks (inodes, directories, IDs) use zlib compression with automatic fallback to uncompressed when compression does not reduce size.
+Moves a file's sectors inside a TI-99 volume and repoints its descriptor.
 
-Implements `IDisposable`.
+Implements `IFilesystemBlockMover`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `SquashFsWriter` | `SquashFsWriter(Stream stream, bool leaveOpen = false, uint blockSize = 131072)` | Initializes a new `SquashFsWriter` that writes to `stream`. The image is finalized when `Dispose` is called. |
-| `DefaultBlockSize` | `const uint DefaultBlockSize` | Default data block size (128 KiB) — the mksquashfs default. |
-| `AddDirectory` | `void AddDirectory(string path, DateTime? lastModified = null)` | Adds an explicit directory entry to the image. |
-| `AddFile` | `void AddFile(string path, byte[] data, DateTime? lastModified = null)` | Adds a file entry to the image. |
-| `Dispose` | `void Dispose()` |  |
-
-### Namespace `FileSystem.TFat`
-
-[`TFatEntry`](#tfatentry) · [`TFatFormatDescriptor`](#tfatformatdescriptor) · [`TFatModifier`](#tfatmodifier) · [`TFatReader`](#tfatreader) · [`TFatWriter`](#tfatwriter)
+| `Ti99BlockMover` | `Ti99BlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Allocation unit in bytes. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the volume block and directory. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
 
-#### `TFatEntry`
+#### `Ti99Entry`
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `TFatEntry` | `TFatEntry()` |  |
+| `Ti99Entry` | `Ti99Entry()` |  |
+| `FileFlags` | `byte FileFlags { get; init; }` |  |
+| `FirstSector` | `int FirstSector { get; init; }` |  |
 | `IsDirectory` | `bool IsDirectory { get; init; }` |  |
-| `LastModified` | `DateTime? LastModified { get; init; }` |  |
 | `Name` | `string Name { get; init; }` |  |
+| `RecordsPerSector` | `byte RecordsPerSector { get; init; }` |  |
+| `SectorCount` | `int SectorCount { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
-| `StartCluster` | `int StartCluster { get; init; }` |  |
 
-#### `TFatFormatDescriptor`
+#### `Ti99ExtentMap`
 
-Transactional FAT (TFAT) — Microsoft Windows CE / Windows Embedded Compact variant of FAT12/16/32 that uses dual FAT copies as a two-phase commit log. The on-disk layout is identical to standard FAT; TFAT differs only in (a) detection markers in the BPB and (b) the runtime protocol that alternates which FAT is "active" on each transaction. This descriptor delivers read, WORM-create and true in-place transactional update support via the alternating-FAT commit protocol implemented in `TFatModifier`. Each Add or Remove is a single transaction: writes go to the inactive FAT, then a single 4-byte big-endian sequence-number write at the end of that FAT region commits the transaction. A crash before the sequence write leaves the old FAT (still active) untouched and the transaction is invisible.Defragment is implemented via `DefragRebuilder` over `TFatReader` + `TFatWriter`: the image is rebuilt from scratch, then re-stamped with TFAT markers so both FAT copies stay in lock-step. This is intentionally non-transactional (it rewrites the whole image, not a single FAT) because defrag is an offline operation.Limitation: FAT12/16 with the fixed-area root directory is fully supported for in-place modification. FAT32 root-cluster updates are not supported — CE TFAT usage typically pins the root cluster, and extending the transactional protocol to cover variable-size root directories would require integrating dir-cluster allocation into the commit point. WORM-create still works for FAT32.Spec sources: TFAT marker layout from public Microsoft Windows CE / Windows Embedded Compact documentation on the FAT transactional protocol, supplemented by forensic-literature summaries. The runtime protocol itself is documented in Microsoft's WinCE TFAT design notes. References: Microsoft Windows Embedded CE "TFAT Overview" documentation (archived MSDN)Microsoft "FAT: General Overview of On-Disk Format" (fatgen103) — the base FAT layout`https://en.wikipedia.org/wiki/Transaction-Safe_FAT_File_System` — Wikipedia article
+Walks a TI-99 sector-dump (.dsk) image and emits the on-disk layout: sector 0 (VIB) + sector 1 (FDIR) + the FDR sector range as metadata-reserved, each file's contiguous data run as Used. TIFiles single-file wrappers expose the 128-byte header as metadata-reserved + the payload as Used.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `Ti99FormatDescriptor`
+
+Descriptor for Texas Instruments TI-99/4A disks (DSR filesystem) — both sector-dump (.dsk) images and TIFiles wrappers (.tifd, .tifiles). The VIB sits at sector 0 with the "DSK" tag at offset 0x0D; FDIR at sector 1 lists File Descriptor Records. Flat by spec. The TI-99/4A DSR filesystem has no subdirectories — the FDIR is a flat array of FDR pointers. Hierarchy inputs collapse to their leaf names on write; the hierarchy test exercises flat round-trip only.Two on-disk wrappers. Choose with the `Mode` creation option: `TIFiles` = single-file wrapper (the geometry knobs don't apply); `SectorDump` = full DSR disk image with VIB + FDIR + FDR per file + the data area. References: `https://www.unige.ch/medecine/nouspikel/ti99/disks.htm` — Thierry Nouspikel's TI-99/4A Tech Pages — disk structure (VIB/FDIR/FDR)`https://en.wikipedia.org/wiki/Texas_Instruments_TI-99/4A` — Wikipedia article on the platformTIFiles wrapper format description (TI-99/4A community documentation, e.g. Ninerpedia)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `TFatFormatDescriptor` | `TFatFormatDescriptor()` |  |
+| `Ti99FormatDescriptor` | `Ti99FormatDescriptor()` |  |
 | `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
 | `Category` | `FormatCategory Category { get; }` |  |
 | `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
@@ -8718,61 +12593,82 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 | `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
 | `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` |  |
 | `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
-| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing TI-99 sector-dump image. Uses `Ti99Modifier` for genuine O(touched bytes) in-place I/O — only the VIB (allocation bitmap), the FDIR, the new file's FDR sector, and its contiguous data run are touched. TIFiles single-file wrappers have no allocation map, so they fall back to a full rebuild. |
 | `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
 | `Defragment` | `void Defragment(Stream archive)` |  |
 | `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
-| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` | TFAT keeps FAT's on-disk layout — same BPB, same FATs, same cluster chains — so the FAT walker maps it as it stands. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
 | `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
 | `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
-| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes named entries from a TFAT image using the alternating-FAT transactional commit protocol. Each removal is a separate transaction. Cluster data is wiped before the seq bump so no forensic trace of the removed bytes remains after commit. |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing TI-99 sector-dump image in place: frees the data + FDR sectors in the VIB bitmap, wipes them, and clears the FDIR pointer slot. TIFiles wrappers fall back to rebuild. |
 | `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` |  |
 
-#### `TFatModifier`
+#### `Ti99Modifier`
+
+In-place modifier for TI-99/4A DSR sector-dump (.dsk) images. Performs add / remove with strict O(touched bytes) I/O — only the VIB (sector 0, holding the allocation bitmap), the FDIR (sector 1, holding the File Descriptor Record pointers), the one FDR sector for the affected file, and that file's contiguous data run are read or written. The rest of the image is untouched, so existing files' data bytes stay byte-identical at their original offsets and a same-size update never changes the image length. The companion `Ti99Writer` rebuilds an image from scratch; this class is the "I have an existing image, mutate it" path.Layout reminders (256-byte sectors, big-endian): VIB at sector 0: total sectors u16 BE @0x0A; allocation bitmap @0x38..0xFF (bit set = used).FDIR at sector 1: 128 × u16 BE FDR-sector pointers (0 = empty slot).FDR (256 bytes): name @0x00 (10 ASCII, space-padded), flags @0x0C, RPS @0x0D, total-sectors u16 BE @0x0E, EOF byte @0x10, LRL @0x11, #records u16 BE @0x12, cluster chain @0x1C (3-byte packed start-sector + offset).The writer + reader lay file data out as one contiguous run starting at the FDR's first cluster sector, so this modifier allocates contiguous runs too.
 
-In-place modification of a TFAT image using the Microsoft Windows CE / Windows Embedded Compact alternating-FAT transactional protocol. A single Add or Remove operation reads the active FAT, applies the change into a private in-memory copy that ultimately becomes the new inactive-then-active FAT, and commits by a single 4-byte big-endian sequence-number write at the end of that FAT region. A crash anywhere before the sequence write leaves the old FAT (with the old sequence number) as the still-active copy, so the transaction is invisible — no data loss, no metadata inconsistency. Step ordering per call: Determine which physical FAT (0 or 1) is currently active — the one whose trailing 4-byte BE sequence number is higher.Read the active FAT into memory; compute the new FAT image with the change applied (allocate or free clusters, update chains).Allocate new clusters from the active FAT's free pool (they're free in both copies because both started identical); copy file bytes into those data clusters and flush.Write or patch the directory entry. Single-sector write — atomic at the device level.Write the new FAT body into the inactive-FAT region (everything except the trailing 4-byte sequence number). Flush.Write the 4-byte sequence number = active.seq + 1 into the trailing 4 bytes of the formerly-inactive FAT. This is the atomic commit point: after this single sector write, the new FAT becomes active. Flush.Crash semantics: a crash before step 6 leaves the old FAT (still with the higher sequence) as active. A subsequent open reads the old FAT, ignores the partial new-FAT writes, and the transaction is rolled back. The data bytes written in step 3 become orphans (free clusters in the old FAT pointing at data that is referenced by no chain) — these are harmless until a future allocation overwrites them.Limitations:Root-directory-only — no subdirectory traversal yet.FAT32 root-cluster updates are not supported (CE TFAT usage typically pins the root cluster). FAT12/16 fixed root is fully supported.Long-file-name support delegates to the writer's 8.3 alias; Add() rebuilds the dir entry as 8.3 only.
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to the existing sector-dump image. Allocates one FDR sector plus a contiguous data run from the bitmap, writes the FDR + data, records the FDR pointer in the FDIR, and marks the new sectors used. |
+| `IsSectorDump` | `static bool IsSectorDump(Stream image)` | True if the stream looks like a parseable TI-99 sector dump (not a TIFiles wrapper, which has no allocation map to mutate). |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file. Frees the file's data sectors and its FDR sector in the bitmap, optionally wipes them, and clears the FDIR pointer slot. Returns true if the file was found and removed. |
+
+#### `Ti99Optimizer`
+
+Picks the smallest standard TI-99 disk geometry that fits a given fileset. Standard geometries: 35 or 40 tracks × 9 or 18 sectors-per-track × 1 or 2 sides = 256-byte sectors throughout. TIFiles mode is single-file so most knobs don't apply; for SectorDump the optimizer iterates the eight standard combinations and returns the smallest that holds payload + FDR + VIB + FDIR overhead.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Atomically adds a file to the TFAT image using the alternating-FAT commit protocol. If a file with the same name already exists, it is removed in the same transaction (free old chain, allocate new chain, patch dir entry, commit). |
-| `RemoveFile` | `static void RemoveFile(Stream image, string name, bool wipeData = true)` | Atomically removes a file from the TFAT image using the alternating-FAT commit protocol. Frees the cluster chain in the working FAT, marks the directory entry deleted (0xE5), optionally wipes the data bytes, then commits by writing the new FAT and bumping the sequence number. |
+| `Find` | `static Ti99Geometry Find(IReadOnlyList<long> fileSizes)` | Picks the smallest geometry that fits payload + 2 (VIB+FDIR) + 1 sector per file (FDR). |
 
-#### `TFatReader`
+#### `Ti99Optimizer.Ti99Geometry`
 
-Reads Transactional FAT (TFAT) filesystem images used by Windows CE / Windows Embedded Compact. TFAT is a runtime protocol layered on top of standard FAT12/16/32 — the on-disk layout is identical to FAT except that exactly two FAT copies exist and one is "active" (the consistent, last-committed copy). Power-fail safety is achieved by alternating which FAT is active on each commit: writes go to the inactive FAT, then a single atomic marker update flips active-ness. Detection markers (this implementation's chosen convention, matching the most common Microsoft / forensic-literature interpretation):`BPB_NumFATs == 2` (mandatory for TFAT).`BS_FilSysType` = "TFAT12 ", "TFAT16 ", or "TFAT32 " (8 bytes at offset 54 for FAT12/16, offset 82 for FAT32).`BS_Reserved1` byte (offset 37 for FAT12/16, offset 65 for FAT32) holds the TFAT marker `0x01`, with the active-FAT index in the low bit of an additional reserved byte.Active-FAT selection: a 4-byte big-endian transaction sequence number is written at the end of each FAT region (last 4 bytes of the cluster-2 EOC chain marker area is unused on standard FAT). The FAT with the higher sequence number is the committed (active) one. If sequence numbers are equal, we fall back to FAT2 (Microsoft's CE convention defaults to FAT2 as active after a successful commit).Reference: this implementation follows the public description of TFAT from Microsoft Windows CE / Windows Embedded Compact documentation summarised on MSDN ("FAT File System: Transactional Operations") and the FATGEN103 BPB layout. See also the forensic write-up at https://www.cnblogs.com/RioTian/p/12345678.html and Microsoft KB on FAT transactioning. Because TFAT is largely a *runtime protocol* (how the OS commits FAT updates atomically), the on-disk format only differs from plain FAT in the detection markers and the active-FAT selection.
+Implements `IEquatable<Ti99Geometry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Ti99Geometry` | `Ti99Geometry(int Tracks, int SectorsPerTrack, int Sides, int TotalSectors)` |  |
+| `SectorsPerTrack` | `int SectorsPerTrack { get; init; }` |  |
+| `Sides` | `int Sides { get; init; }` |  |
+| `TotalSectors` | `int TotalSectors { get; init; }` |  |
+| `Tracks` | `int Tracks { get; init; }` |  |
+
+#### `Ti99Reader`
+
+Reads Texas Instruments TI-99/4A disk images (DSR — Disk Subsystem Resource). Two on-disk wrappers are supported: Sector dump (.dsk) — Volume Information Block (VIB) at sector 0, File Descriptor Index Record (FDIR) at sector 1, then one File Descriptor Record per file in their FDIR-listed sectors.TIFiles wrapper (.tifd / .tifiles) — 0x80 header bytes followed by the raw file data. Magic = 0x07 + "TIFILES". VIB layout (sector 0, big-endian; 256 bytes): 0x00 char[10] disk name (padded with spaces) 0x0A u16 total sectors 0x0C byte sectors per track (typically 9 SSSD, 16/18 DSDD) 0x0D char[3] "DSK" 0x10 byte protection flag 0x11 byte tracks per side 0x12 byte sides (1 or 2) 0x13 byte density (1=SD, 2=DD) 0x38..0xFF bitmap of allocated sectors FDIR layout (sector 1, big-endian; 256 bytes): array of 128 big-endian u16 sector pointers to File Descriptor Records (0 = unused slot). File Descriptor Record (256 bytes; pointed at by FDIR entry): 0x00 char[10] filename (padded with spaces) 0x0C byte file-status flag (0x80=variable, 0x40=emulate, 0x20=modified, 0x10=write-protected, 0x02=internal, 0x01=program) 0x0D byte records per sector 0x0E u16 total sectors used by file 0x10 byte end-of-file byte offset 0x11 byte logical record length 0x12 u16 #records (variable files) or records/sector (fixed) 0x1C..0xFF cluster chain (3-byte entries: start-sector + offset-byte)
 
 Implements `IDisposable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `TFatReader` | `TFatReader(Stream stream, bool leaveOpen = false)` |  |
-| `ActiveFatIndex` | `int ActiveFatIndex { get; }` |  |
-| `ActiveSequence` | `uint ActiveSequence { get; }` |  |
-| `Entries` | `IReadOnlyList<TFatEntry> Entries { get; }` |  |
-| `FatType` | `int FatType { get; }` |  |
-| `InactiveSequence` | `uint InactiveSequence { get; }` |  |
+| `Ti99Reader` | `Ti99Reader(Stream stream)` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `TifilesHeaderSize` | `const int TifilesHeaderSize` |  |
+| `Density` | `int Density { get; }` |  |
+| `Entries` | `IReadOnlyList<Ti99Entry> Entries { get; }` |  |
+| `IsTifilesWrapper` | `bool IsTifilesWrapper { get; }` |  |
+| `SectorsPerTrack` | `int SectorsPerTrack { get; }` |  |
+| `Sides` | `int Sides { get; }` |  |
+| `TotalSectors` | `int TotalSectors { get; }` |  |
+| `Tracks` | `int Tracks { get; }` |  |
+| `ValidVolume` | `bool ValidVolume { get; }` |  |
+| `VolumeName` | `string VolumeName { get; }` |  |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` |  |
 | `Dispose` | `void Dispose()` |  |
-| `Extract` | `byte[] Extract(TFatEntry entry)` |  |
-| `IsTfat` | `static bool IsTfat(ReadOnlySpan<byte> data, int? knownFatType = null)` | Determines whether the given image carries TFAT detection markers. Static so `TFatFormatDescriptor` can use it for the `FormatDetector` magic-signature gate (we ship a single magic that covers the "TFAT" 4-byte FilSysType prefix at one of the two possible extended-BPB offsets; this method handles both layouts). |
+| `Extract` | `byte[] Extract(Ti99Entry entry)` |  |
 
-#### `TFatWriter`
+#### `Ti99Writer`
 
-Builds a Transactional FAT (TFAT) filesystem image. Delegates the heavy lifting (BPB, FAT chain, root directory, LFN encoding) to `FatWriter`, then post-processes the resulting image to add TFAT-specific markers: Stamp `BS_FilSysType` with "TFAT12 ", "TFAT16 ", or "TFAT32 " (replaces the plain FAT type tag).Write a 4-byte big-endian transaction sequence number to the last 4 bytes of each FAT region. Initially FAT1.seq=1, FAT2.seq=2 — FAT2 is the committed (active) copy.Both FATs hold identical chain data; subsequent transactional updates will alternate which copy is current.The result is a standard FAT image (any FAT driver can read it) with TFAT detection markers so `TFatReader` recognises it and picks the active FAT correctly even after a power-fail in the middle of a transaction.
+Writes TI-99/4A disk images in either of two formats: TIFiles wrapper — 128-byte header (magic 0x07 + "TIFILES") followed by a single file's raw bytes. The image holds exactly one file by spec; if multiple inputs are supplied only the first is honoured.Sector dump (.dsk) — VIB at sector 0 (with "DSK" tag at offset 0x0D), File Descriptor Index Record (FDIR) at sector 1, then one File Descriptor Record per file, plus the file data laid out contiguously starting after the FDR slots.Flat by spec. The TI-99/4A DSR filesystem (Disk Subsystem Resource) has no subdirectory concept — the FDIR is a flat array of FDR pointers. Hierarchical inputs are flattened to their leaf names.Spec. TI-99/4A Disk Manager and the published DSR format docs; TIFiles per the standard cross-platform interchange format (Cory's TIFiles docs).
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `TFatWriter` | `TFatWriter()` |  |
-| `InitialSequence` | `uint InitialSequence { get; set; }` | Initial transaction sequence stored on FAT1; FAT2 is stored at `InitialSequence`+1 so it wins active-FAT selection. Used by round-trip tests to verify sequence-based active selection. |
-| `AddFile` | `void AddFile(string name, byte[] data)` |  |
-| `AddStreamingFile` | `void AddStreamingFile(string name, long size, Func<Stream> openStream)` | Adds a file whose bytes are produced on demand; the layout is settled from `size` before any are read. |
-| `BuildAutoSized` | `byte[] BuildAutoSized(int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null, int forcedFatType = 0)` | Builds a TFAT image auto-sized to fit the added files (delegates sizing to `BuildAutoSized`), then stamps the TFAT markers. Prefer this over `Build` when the file count / total size is not known up-front (e.g. from a directory walk) so the writer picks an image size and FAT type that fit. |
-| `BuildToStreamingAutoSized` | `void BuildToStreamingAutoSized(Stream output, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null, int forcedFatType = 0)` | Auto-sized streaming build; the TFAT post-pass re-stamps both FAT copies. |
-| `BuildTo` | `void BuildTo(Stream output, int totalSectors, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null, int forcedFatType = 0)` | Post-processes a freshly built FAT image to add the TFAT-specific detection markers and per-FAT transaction sequence numbers. |
-| `Build` | `byte[] Build(int totalSectors = 2880, int bytesPerSector = 512, int requestedClusterSize = 0, string volumeLabel = null, int forcedFatType = 0)` | Builds the TFAT image. `totalSectors` defaults to 2880 (a 1.44 MB image) which yields FAT12; for FAT32 testing pass a larger value (e.g. 131072 for ~64 MB). |
-| `PickClusterForFixedImage` | `int PickClusterForFixedImage(int totalSectors, int bytesPerSector, int forcedFatType, int requestedRootEntries, bool enableLfn)` | Picks the cluster size that minimises slack + FAT overhead for a fixed image size. Pure delegation to `PickClusterForFixedImage` — TFAT shares FAT's exact geometry, so the same optimiser applies. Returns 0 if no candidate fits (caller falls back to the writer default). |
-| `ReadSequences` | `static ValueTuple<uint, uint> ReadSequences(Stream disk)` | Applies the same markers as `StampTfat` directly to a stream. Every site is at a BPB-derived offset, so only the boot sector has to be read back. |
-| `RestampMarkers` | `static void RestampMarkers(Stream disk, uint firstSequence, uint secondSequence)` | Puts the TFAT markers back on a volume whose contents have been moved about, restoring the transaction sequences it carried before. |
-| `SyncFatCopies` | `static void SyncFatCopies(Stream disk)` | Copies the FAT the volume is currently reading from over the other one, so both describe the same allocation. |
+| `Ti99Writer` | `Ti99Writer()` |  |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Add a file. Filename will be uppercased and truncated to 10 chars (the TI-99 DSR limit); subdir prefixes are stripped. |
+| `BuildSectorDump` | `byte[] BuildSectorDump(int tracks = 40, int sectorsPerTrack = 9, int sides = 2, string diskName = "DISK")` | Builds a sector-dump (.dsk) image with the standard TI-99 layout: VIB at sector 0, FDIR at sector 1, FDR records at sectors 2..(2+N-1), payload data laid out contiguously starting at the first sector after the FDRs. |
+| `BuildTifiles` | `byte[] BuildTifiles()` | Builds a TIFiles wrapper around the first added file. Multi-file inputs collapse to the first file (TIFiles is single-file by spec). |
 
 ### Namespace `FileSystem.TrDos`
 
@@ -8819,7 +12715,7 @@ Walks a ZX Spectrum TR-DOS (.trd) disk image (640 KB DSDD: 160 tracks, 16 sector
 
 Descriptor for ZX Spectrum TR-DOS (Beta Disk interface) .trd disk images — fixed 640 KB geometry with the catalogue and disk-info sector in track 0. References: `https://sinclair.wiki.zxnet.co.uk/wiki/TR-DOS_filesystem` — Sinclair FAQ wiki — TR-DOS filesystem layout`https://en.wikipedia.org/wiki/TR-DOS` — Wikipedia articleTechnology Research "Beta Disk Interface" manual (vendor documentation)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -8885,6 +12781,151 @@ Creates TR-DOS (.TRD) ZX Spectrum disk images.
 | `AddFile` | `void AddFile(string name, char type, byte[] data)` |  |
 | `Build` | `byte[] Build(string label = "DISK")` |  |
 
+### Namespace `FileSystem.Trsdos`
+
+[`TrsdosBlockMover`](#trsdosblockmover) · [`TrsdosEntry`](#trsdosentry) · [`TrsdosExtentMap`](#trsdosextentmap) · [`TrsdosFormatDescriptor`](#trsdosformatdescriptor) · [`TrsdosModifier`](#trsdosmodifier) · [`TrsdosOptimizer`](#trsdosoptimizer) · [`TrsdosOptimizer.TrsdosGeometry`](#trsdosoptimizertrsdosgeometry) · [`TrsdosReader`](#trsdosreader) · [`TrsdosWriter`](#trsdoswriter)
+
+#### `TrsdosBlockMover`
+
+Moves a file inside a TRSDOS volume and repoints its directory entry.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `TrsdosBlockMover` | `TrsdosBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | A granule. A file starts on a granule boundary because that is all its directory entry can express. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: the granule after the directory track. |
+| `Init` | `void Init(Stream image)` | Finds the directory track this volume was laid out with. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `TrsdosEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `TrsdosEntry` | `TrsdosEntry()` |  |
+| `Attributes` | `byte Attributes { get; init; }` |  |
+| `FirstSector` | `int FirstSector { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `SectorCount` | `int SectorCount { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `TrsdosExtentMap`
+
+Enumerates the on-disk byte layout of a TRSDOS / LDOS disk image. Track 17 (GAT + HIT + directory records) is emitted as `MetadataReserved`; every file's sector run is one `Used` extent; unattributed sectors are left for the caller to fill as `Free`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Walks the image and yields one extent per file + the directory track. |
+
+#### `TrsdosFormatDescriptor`
+
+Descriptor for TRSDOS / LDOS disk images (Radio Shack TRS-80 Model I / III / 4, late 1970s–early 1980s). Detection by the 0xFE GAT signature at track 17, sector 0, offset 0xCD; reader walks the directory records that follow in track 17 sectors 2..N. Sector size is 256 B; default geometry is 40 tracks × 18 spt (Model III/4 DD) with fallback to 10/9/26 spt. TRSDOS is a flat-only filesystem (no subdirectories). The `List` output therefore never contains a directory entry.Capabilities: read + write, defragment via extract-and-rebuild, free-space wiping driven by the extent map, and creation-options schema for density/track-count selection. References: Roy Soltoff, "The Programmer's Guide to LDOS/TRSDOS Version 6" — canonical GAT/directory documentation`https://www.tim-mann.org/trs80.html` — Tim Mann's TRS-80 resources (xtrs emulator + format notes)`https://en.wikipedia.org/wiki/TRSDOS` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `TrsdosFormatDescriptor` | `TrsdosFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `OptionsSchema` | `IReadOnlyList<FormatOptionDescriptor> OptionsSchema { get; }` | Tunable knobs for TRSDOS creation: density, track count, disk name, and format date. Granules-per-cylinder is auto-derived from sectors/track (5 sectors per granule). |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by name) files inside an existing TRSDOS image. Uses `TrsdosModifier` for genuine O(touched bytes) in-place I/O — only the GAT, the affected directory sector, and the new file's granule-aligned data run are touched. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` |  |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` |  |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` | Native in-memory single-entry extraction routed through the bounded `OpenEntry`. |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` | Opens a single filesystem entry as a bounded read-only stream. The reader produces the decoded file bytes by walking the entry's extent or block chain; the matched bytes are wrapped in a `BoundedEntryStream` sized to the entry's logical length so cluster/extent slack past the entry's end is physically unreachable through this view. |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries in place: frees their granules in the GAT, wipes the data, and clears the directory records. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zeros all sectors not claimed by track 17 (directory metadata) or by a live file's contiguous sector run. Cluster-tip wiping (trailing slack inside the file's last sector) honours the directory's EOF byte count when `wipeClusterTips` is true. |
+
+#### `TrsdosModifier`
+
+In-place modifier for TRSDOS / LDOS disk images. Performs add / remove with strict O(touched bytes) I/O — only the GAT (track 17 sector 0, holding the granule bitmap + signature), the affected directory record (one 32-byte slot in track 17 sectors 2..N), and the file's contiguous granule-aligned data run are read or written. Existing files' data bytes stay byte-identical at their original offsets, and a same-size update never changes the image length. The companion `TrsdosWriter` rebuilds an image from scratch; this is the "I have an existing image, mutate it" path.Layout reminders (256-byte sectors, 5 sectors per granule, Model III/4): Track 17 is the directory track. Sector 0 = GAT (signature 0xFE @0xCD, disk name @0xD0..0xD7, date @0xD8..0xDF; bytes 0..0xCC = granule bitmap).Sectors 2..N of track 17 hold 32-byte directory records: attribute @0, name @5..12, ext @13..15, first granule @24, sector count LE @28..29, EOF byte-count low @27 + high @30.File data lives at (firstGranule × 5) × 256, contiguous for the sector count.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a file to the existing image. Allocates a contiguous granule run from the GAT, writes the data, fills a free directory record, and marks the granules used. |
+| `IsTrsdos` | `static bool IsTrsdos(Stream image)` | True if the stream is a parseable TRSDOS image (GAT signature found). |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named file: frees its granules in the GAT, optionally wipes the data run, and clears the directory record. Returns true if found. |
+
+#### `TrsdosOptimizer`
+
+Picks the smallest TRSDOS / LDOS geometry whose data area fits the supplied file set with ≤ 5 % wasted slack. The TRS-80 line shipped only a handful of canonical disk geometries; the optimiser walks them in ascending capacity order.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Geometries` | `static readonly IReadOnlyList<TrsdosGeometry> Geometries` | Canonical TRSDOS / LDOS geometries in ascending data-capacity order. |
+| `Find` | `static TrsdosGeometry Find(IReadOnlyList<long> fileSizes)` | Returns the smallest geometry whose data area holds `fileSizes` with ≤ 5 % slack. Falls back to the largest geometry if nothing fits cleanly. |
+
+#### `TrsdosOptimizer.TrsdosGeometry`
+
+One disk preset.
+
+Implements `IEquatable<TrsdosGeometry>`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `TrsdosGeometry` | `TrsdosGeometry(string Density, int Tracks, int SectorsPerTrack)` | One disk preset. |
+| `DataBytes` | `int DataBytes { get; }` | Bytes available for file data (track 17 reserved for directory). |
+| `Density` | `string Density { get; init; }` |  |
+| `GranulesPerCylinder` | `int GranulesPerCylinder { get; }` | Granules per cylinder (auto-derived from spt; 5 sectors/granule). |
+| `SectorSize` | `int SectorSize { get; }` | Sector size is fixed at 256 bytes by the reader. |
+| `SectorsPerTrack` | `int SectorsPerTrack { get; init; }` |  |
+| `TotalBytes` | `int TotalBytes { get; }` | Total image size in bytes. |
+| `Tracks` | `int Tracks { get; init; }` |  |
+
+#### `TrsdosReader`
+
+Reads TRSDOS / LDOS disk images (Radio Shack TRS-80 Model I/III/4). TRSDOS organises a fixed 35-track / 40-track / 80-track disk into "granules" (groups of sectors) tracked by the Granule Allocation Table (GAT) and an associated Hash Index Table (HIT) at track 17. Per the TRSDOS specification: - Track 17 is the directory track. Sector 0 of track 17 holds the GAT; sector 1 holds the HIT. - GAT byte at offset 0xCD = 0xFE identifies a TRSDOS-formatted disk. - Sectors 2..N of track 17 hold 32-byte directory records. Each record begins with an attribute byte; 0x00 = unused, 0x10 = system, 0x40 = invisible, 0x80 = killed. - Filename is 8 ASCII characters (offset 5..12), extension is 3 ASCII characters (offset 13..15). End-of-file byte count is at offset 30 (high byte) + offset 27 (low byte); sector count at offset 28..29 (little-endian). Sector size is 256 bytes; sectors-per-track defaults to 10 (DD) but JV3/DMK images may report 18 SD or 36 DD. We assume 256-byte sectors with 18 sectors/track DD geometry (track 17 starts at file offset 17 * 18 * 256 = 78336) which matches the most common Model III/4 disks.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `TrsdosReader` | `TrsdosReader(Stream stream)` |  |
+| `DirectoryEntrySize` | `const int DirectoryEntrySize` |  |
+| `DirectoryTrack` | `const int DirectoryTrack` |  |
+| `SectorSize` | `const int SectorSize` |  |
+| `SectorsPerTrackDefault` | `const int SectorsPerTrackDefault` |  |
+| `DirectoryTrackOffset` | `int DirectoryTrackOffset { get; }` |  |
+| `Entries` | `IReadOnlyList<TrsdosEntry> Entries { get; }` |  |
+| `SectorsPerTrack` | `int SectorsPerTrack { get; }` |  |
+| `ValidVolume` | `bool ValidVolume { get; }` |  |
+| `BuildSurfaceMetadata` | `byte[] BuildSurfaceMetadata()` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(TrsdosEntry entry)` |  |
+
+#### `TrsdosWriter`
+
+Builds a fresh TRSDOS / LDOS disk image from scratch (Write-Once, Read-Many). The format places the GAT (Granule Allocation Table) at track 17, sector 0; the HIT (Hash Index Table) at track 17, sector 1; and 32-byte directory records at sectors 2..N of track 17. Tracks outside 17 hold file data, allocated in 5-sector "granules" per the Model III/4 convention.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `TrsdosWriter` | `TrsdosWriter()` |  |
+| `MaxDirectoryRecords` | `const int MaxDirectoryRecords` | Maximum directory records the writer allows. At 18 spt, sectors 2..17 of track 17 hold 16 × 256 / 32 = 128 slots. |
+| `TotalSize` | `int TotalSize { get; }` | Total image size = tracks × sectorsPerTrack × 256. |
+| `AddFile` | `void AddFile(string name, byte[] data)` | Adds one file. Names are 8.3 ASCII, upper-cased. |
+| `Build` | `byte[] Build()` | Builds the disk image. Throws if files don't fit or directory overflows. |
+| `SetDate` | `void SetDate(string date)` | Sets the 8-character format date written to GAT bytes 0xD8..0xDF (MM/DD/YY). |
+| `SetDiskName` | `void SetDiskName(string name)` | Sets the 8-character disk name written to GAT bytes 0xD0..0xD7. |
+| `SetGeometry` | `void SetGeometry(int tracks, int sectorsPerTrack)` | Sets geometry. Default: 40 tracks × 18 spt × 256 B = 184 320 B (Model III/4 DD). |
+
 ### Namespace `FileSystem.Tux2`
 
 [`Tux2BlockMover`](#tux2blockmover) · [`Tux2Entry`](#tux2entry) · [`Tux2FormatDescriptor`](#tux2formatdescriptor) · [`Tux2Reader`](#tux2reader) · [`Tux2RecordMap`](#tux2recordmap) · [`Tux2Writer`](#tux2writer)
@@ -8920,7 +12961,7 @@ Implements `IFilesystemBlockMover`.
 
 Read+WORM descriptor for TUX2 — Daniel Phillips's 2002 phase-tree filesystem proposal (OLS 2002 paper, never-stabilised research format). Recognises a deterministic header pattern (magic "TUX2FS\0\0" at offset 0) so research images we generate round-trip through the reader. Writer emits a single-phase image only (no alpha/beta phases, no version chain) — real legacy prototype images would need a custom parser matching the specific snapshot of the in-progress code that produced them. References: Daniel Phillips, "The Tux2 Filesystem" (Ottawa Linux Symposium 2002 proceedings) — the defining paper`https://en.wikipedia.org/wiki/Tux3` — Wikipedia article covering the phase-tree lineage
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9022,7 +13063,7 @@ Implements `IFilesystemBlockMover`.
 
 #### `Tux3FormatDescriptor`
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9156,7 +13197,7 @@ Implements `IEquatable<FileEntry>`.
 
 UBIFS (Unsorted Block Image File System) descriptor. Read path: triage artifacts (passthrough, node-counts metadata, flat inode + dentry tables) plus real per-file extraction via linear log scan with zlib / stored DATA-node support. Write path (R/W): emits a flat sequence of superblock + master + inode + dentry + zlib-compressed data nodes for Create, and appends fresh INO / DENT / DATA nodes at the journal head for Add / Replace / Remove. Committed nodes stay byte-identical at their original offsets — the kernel-style log-structured invariant (no in-place rewrites until commit-merge) is preserved. Full TNC / LPT commit pipeline (required for kernel mount) is multi-week work and remains out of scope. References: `http://www.linux-mtd.infradead.org/doc/ubifs.html` — MTD project UBIFS documentation — the canonical design doc`https://github.com/torvalds/linux/blob/master/fs/ubifs/ubifs-media.h` — canonical on-disk node formats`https://www.kernel.org/doc/html/latest/filesystems/ubifs.html` — kernel documentation`https://en.wikipedia.org/wiki/UBIFS` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9251,7 +13292,7 @@ Walks a UDF (ECMA-167) image and yields its actual on-disk byte layout — the 3
 
 R/W descriptor for UDF 2.01 (Universal Disk Format) volume images per ECMA-167 and the OSTA UDF profile. References: `https://ecma-international.org/publications-and-standards/standards/ecma-167/` — ECMA-167 — the base volume/file structure standardOSTA "Universal Disk Format Specification, revision 2.01" (osta.org) — the UDF profile of ECMA-167`https://en.wikipedia.org/wiki/Universal_Disk_Format` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9367,7 +13408,7 @@ Walks a UFS1 (FreeBSD/BSD FFS) image and yields the actual on-disk byte layout 
 
 R/W descriptor for UFS1 (Berkeley Fast File System) images at the byte-exact `newfs -O1` layout. References: McKusick, Joy, Leffler, Fabry — "A Fast File System for UNIX" (ACM TOCS, 1984), the defining FFS paper`https://github.com/freebsd/freebsd-src/tree/main/sys/ufs` — canonical implementation (`ffs/fs.h` on-disk superblock)`https://en.wikipedia.org/wiki/Unix_File_System` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9475,7 +13516,7 @@ Implements `IFilesystemBlockMover`.
 
 Descriptor for Gothic-engine VDFS archives (magic "PSVDSC_V2.00", .vdf) — the virtual-disk container used by Piranha Bytes' ZenGin games. References: `https://gothic-modding-community.github.io/gmc/` — Gothic Modding Community documentation`https://github.com/REGoth-project/REGoth` — REGoth engine reimplementation — includes a VDFS readerVdfsSharp — C# VDFS extractor/creator (GitHub)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9586,7 +13627,7 @@ Describes a VxFS volume block by block: what the walk to the files needs, what e
 
 Read-only descriptor for VxFS (Veritas File System), used by HP-UX, Solaris, and AIX (and a Linux read-only port). Walking the OLT (Object Location Table) → FSH (FileSet Header) → IAU (Inode Allocation Unit) chain to extract user files is explicitly out of scope (multi-week effort) — this descriptor surfaces: `FULL.vxfs` — the raw image bytes`metadata.ini` — parsed superblock fields`superblock.bin` — 1 KB capture of the on-disk superblock Detection: 4-byte magic `0xA501FCF5` at offset 1024. The magic is stored in the natural endianness of the host that wrote the volume — little-endian on x86 / Linux, big-endian on HP-UX PA-RISC and Solaris SPARC. Both signature variants are registered. Create / Modify / Defragment: `NotSupportedException` — the descriptor is read-only. References: Linux kernel `fs/freevxfs/vxfs.h` + `vxfs_super.c`HP-UX "VxFS Administrator's Guide" (Veritas / Symantec)Wikipedia "Veritas File System"
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9696,9 +13737,183 @@ Builds a VxFS volume the Linux `freevxfs` driver mounts.
 | `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the root directory. |
 | `Build` | `byte[] Build()` | Lays the volume out and returns its bytes. |
 
+### Namespace `FileSystem.Wafl`
+
+[`WaflEntry`](#waflentry) · [`WaflFormatDescriptor`](#waflformatdescriptor) · [`WaflReader`](#waflreader)
+
+#### `WaflEntry`
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `WaflEntry` | `WaflEntry()` |  |
+| `Data` | `byte[] Data { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Offset` | `long Offset { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `WaflFormatDescriptor`
+
+Stage 0 detection-only descriptor for NetApp WAFL (Write-Anywhere File Layout) volume images. Surfaces only a synthetic `metadata.ini` and the raw image bytes; no real file-walk is attempted. Stage-0 confirmed. An R/O promotion attempt was investigated against the publicly available material (Hitz 1994 TR3002, NetApp patents WO1994029807 / US6289356, archived ONTAP whitepapers) and declined. The high-level tree-of-blocks design (root inode → inode file → metadata files + user files; 4 KB blocks; FSinfo block at a fixed location anchoring two redundant copies) is published, but the exact byte-level on-disk encoding used by current ONTAP releases is not — neither the inode record layout, the FBN → VBN → PVBN translation tables, the FlexVol container-file mapping, nor the RAID-DP parity scheme used for block addressing have a public spec adequate to extract files from a single-image dump. WAFL is heavily patented and proprietary; no open-source reader exists. The full investigation record is captured in this XML doc, the metadata.ini surface, and the README stub-tier table. References: Hitz, Lau, Malcolm — "File System Design for an NFS File Server Appliance" (USENIX Winter 1994; NetApp TR-3002), the defining WAFL paperNetApp patents WO1994029807 / US6289356 — the published block-layout details`https://en.wikipedia.org/wiki/Write_Anywhere_File_Layout` — Wikipedia article
+
+Implements `IArchiveFormatOperations`, `IFormatDescriptor`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `WaflFormatDescriptor` | `WaflFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+
+#### `WaflReader`
+
+Stage 0 detection-only reader for NetApp WAFL (Write-Anywhere File Layout) volume images. WAFL is NetApp's proprietary cluster/NAS filesystem. The on-disk surface for a single file is the FSinfo block that begins each volume label region. The first four bytes of the FSinfo block are the ASCII tag `"wafd"` (0x77 0x61 0x66 0x64, big-endian as integer 0x77616664), followed by a 32-bit big-endian version field and additional cluster metadata that is not portable outside a NetApp ONTAP controller. This reader only verifies the magic tag and version field and surfaces the full image as an opaque blob plus a synthetic `metadata.ini`. No real file-walk is attempted — WAFL's actual directory and inode structures are tightly coupled to ONTAP's volume manager (RAID-DP groups, snapshot trees, FlexVol allocation maps, NVRAM consistency points) and have no published spec sufficient to extract file content from a single-image dump. Sources consulted during the Stage-0 confirmation: Hitz 1994 TR3002 ("File System Design for an NFS File Server Appliance"), NetApp patents WO1994029807 and US6289356, fileformats.archiveteam.org WAFL entry.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `WaflReader` | `WaflReader(Stream stream)` |  |
+| `FsInfoTag` | `static readonly byte[] FsInfoTag` | WAFL FSinfo tag bytes: ASCII "wafd" = 0x77 0x61 0x66 0x64. |
+| `Entries` | `IReadOnlyList<WaflEntry> Entries { get; }` |  |
+| `ValidHeader` | `bool ValidHeader { get; }` |  |
+| `Version` | `uint Version { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `Extract` | `byte[] Extract(WaflEntry entry)` |  |
+
+### Namespace `FileSystem.Xenix`
+
+[`XenixBlockMover`](#xenixblockmover) · [`XenixEntry`](#xenixentry) · [`XenixExtentMap`](#xenixextentmap) · [`XenixFormatDescriptor`](#xenixformatdescriptor) · [`XenixModifier`](#xenixmodifier) · [`XenixReader`](#xenixreader) · [`XenixWriter`](#xenixwriter)
+
+#### `XenixBlockMover`
+
+Moves a file's blocks inside a System V volume and repoints the pointers that name them.
+
+Implements `IFilesystemBlockMover`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `XenixBlockMover` | `XenixBlockMover()` |  |
+| `BlockSize` | `int BlockSize { get; }` | Block size in bytes, as the superblock's type code gives it. |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy: past the superblock and the inode list. |
+| `RepointsRunsIndependently` | `bool RepointsRunsIndependently { get; }` | Each call repoints the run it is given and nothing else, so an owner scattered over several runs is simply several calls. |
+| `SupportsHeldRuns` | `bool SupportsHeldRuns { get; }` | A run may be held outside the volume while the rest of the layout moves, which is what lets a full volume be rearranged at all. |
+| `Init` | `void Init(Stream image)` | Reads the geometry and where file data may start. |
+| `MoveExtent` | `void MoveExtent(Stream image, long srcOffset, long dstOffset, long length, bool zeroSource = false)` |  |
+| `UpdateAllocationAfterMove` | `void UpdateAllocationAfterMove(Stream image, string fileName, long oldOffset, long newOffset, long length)` |  |
+
+#### `XenixEntry`
+
+Directory entry from a Microsoft/SCO Xenix filesystem.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `XenixEntry` | `XenixEntry()` |  |
+| `InodeNumber` | `int InodeNumber { get; init; }` |  |
+| `IsDirectory` | `bool IsDirectory { get; init; }` |  |
+| `Name` | `string Name { get; init; }` |  |
+| `Size` | `long Size { get; init; }` |  |
+
+#### `XenixExtentMap`
+
+Reports where a System V volume's bytes are: its structures, each file's blocks under its name, and what nothing holds.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` |  |
+
+#### `XenixFormatDescriptor`
+
+Descriptor for Microsoft/SCO Xenix System V filesystem images. Carries the genuine Xenix superblock magic 0x2B5544 at s_magic (struct offset 0x3F8 → file offset 2040), the value the Linux sysv driver matches. Reads existing Xenix images and emits fresh WORM images via `XenixWriter`. References: `https://github.com/torvalds/linux/tree/v6.6/fs/sysv` — Linux sysv driver matching the Xenix magic (v6.6 LTS tree; removed from later kernels)SCO "XENIX System V" development and operations documentation (vendor manuals)`https://en.wikipedia.org/wiki/Xenix` — Wikipedia article
+
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `XenixFormatDescriptor` | `XenixFormatDescriptor()` |  |
+| `Capabilities` | `FormatCapabilities Capabilities { get; }` |  |
+| `Category` | `FormatCategory Category { get; }` |  |
+| `CompoundExtensions` | `IReadOnlyList<string> CompoundExtensions { get; }` |  |
+| `DefaultExtension` | `string DefaultExtension { get; }` |  |
+| `Description` | `string Description { get; }` |  |
+| `DisplayName` | `string DisplayName { get; }` |  |
+| `Extensions` | `IReadOnlyList<string> Extensions { get; }` |  |
+| `Family` | `AlgorithmFamily Family { get; }` |  |
+| `Id` | `string Id { get; }` |  |
+| `MagicSignatures` | `IReadOnlyList<MagicSignature> MagicSignatures { get; }` |  |
+| `Methods` | `IReadOnlyList<FormatMethodInfo> Methods { get; }` |  |
+| `ReclaimSupport` | `LayoutReclaim ReclaimSupport { get; }` | A block pointer of zero names no block, so a run of zeros need not be allocated; and the inode counts the names pointing at it, so identical files can share one copy under several of them. |
+| `TarCompressionFormatId` | `string TarCompressionFormatId { get; }` |  |
+| `Add` | `void Add(Stream archive, IReadOnlyList<ArchiveInputInfo> inputs)` | Adds (or replaces by leaf name) files inside an existing Xenix V image via `XenixModifier` — O(touched bytes) random-access I/O using the s5fs s_free / s_inode caches (refilled from a full scan on first mutation, since the WORM writer leaves the caches zeroed). Files are flattened to their leaf names (single-level root scope); name length is truncated to 14 ASCII bytes per the on-disk dirent budget. |
+| `Create` | `void Create(Stream output, IReadOnlyList<ArchiveInputInfo> inputs, FormatCreateOptions options)` | WORM-emits a fresh Xenix V image to `output` containing the supplied `inputs`. Directory components in input archive names become real intermediate directory inodes. Names are truncated to 14 ASCII bytes per the on-disk dir-entry budget; each file is stored through the inode's 10 direct zone slots (max 10 KB with the 1 KB block size we emit). Failing those constraints throws `InvalidOperationException` with the offending path. |
+| `Defragment` | `void Defragment(Stream archive)` |  |
+| `Defragment` | `void Defragment(Stream archive, DefragOptions options)` | Lays the volume out again. A file's bytes are addressed one block at a time by pointers in its inode and the indirect blocks below it, so a move is the copy plus those pointers — cheaper than reading every file out and writing a fresh volume, which is what the inherited default did for the one mode it offered. |
+| `EnumerateExtents` | `IEnumerable<DefragBlockInfo> EnumerateExtents(Stream image)` |  |
+| `ExtractEntryToMemory` | `byte[] ExtractEntryToMemory(Stream archive, string entryName, string password)` |  |
+| `Extract` | `void Extract(Stream stream, string outputDir, string password, string[] files)` |  |
+| `List` | `List<ArchiveEntryInfo> List(Stream stream, string password)` |  |
+| `OpenEntry` | `Stream OpenEntry(Stream archive, string entryName, string password)` |  |
+| `RebuildStreaming` | `void RebuildStreaming(Stream source, Stream target, LayoutRebuildOptions options)` |  |
+| `Remove` | `void Remove(Stream archive, string[] entryNames)` | Removes the named entries from an existing Xenix V image. Names are matched against their on-disk (leaf, 14-char-truncated) form so callers can pass either the leaf or the original nested path supplied to `Add`. |
+| `WipeUnusedSpace` | `long WipeUnusedSpace(Stream image, bool wipeClusterTips = true, bool wipeDeletedEntries = true)` | Zero-fills every block no inode claims — which is where a removed file's bytes stay until something else takes them. |
+
+#### `XenixModifier`
+
+In-place modifier for Microsoft / SCO Xenix V (s5fs-compatible) filesystem images emitted by `XenixWriter`. Performs Add / Remove with O(touched bytes) random-access I/O against the existing image — only the superblock, the affected inode slots, the root directory's first zone, and the file's data zones are read or written. s5fs free-list caches. The on-disk superblock carries an inode free-list cache (`s_ninode` + `s_inode[NICINOD]`) and a data-zone free-list cache (`s_nfree` + `s_free[NICFREE]`). On `AddFile` we pop from the cache (refilling from a full inode-table or zone-usage scan when empty); on `RemoveFile` we push back into the cache (with the classic s5fs "indirect free list" spill into a freed block when the cache fills, or silently dropping the freed entry when even the spill is full — it'll be discovered by the next refill scan). The WORM writer leaves the caches empty (s_ninode == s_nfree == 0), so the first mutating operation always seeds both caches from scratch.Scope. Files are addressed through the inode's 10 direct zone slots only — same budget as the WORM writer. Files larger than `10 * blockSize` bytes are rejected with `NotSupportedException` (indirect blocks are out of scope here the same way they are for WORM). Additions extend the image past its current length when new zones are needed. Inode allocation reuses unused slots inside the existing inode table — when the table is exhausted the operation throws cleanly; growing the inode table would require shifting every data zone and is left to a full rebuild.Root-only. The modifier wires new dir-ents into the root directory (inode 2). Nested paths flatten to their leaf names (matching the flat-root scope of the IArchiveModifiable contract for s5fs-style writers).
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data)` | Adds a regular file under the root directory of an existing Xenix V image with name `name` and body `data`. Throws `NotSupportedException` for files larger than `10 * 1024` bytes (only direct zones are addressed), and throws `IOException` if the inode table or root directory has no remaining slot. |
+| `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes the named regular file from the root directory of an existing Xenix V image. Returns `false` if no such entry exists; refuses to remove directories. |
+
+#### `XenixReader`
+
+Reader for Microsoft / SCO Xenix System V file system (1980-1989, Microsoft's licensed UNIX). Xenix is a System V variant with two superblock structures ("Xenix-4 V" and "Xenix-5 V"); we target the more common Xenix V (3/V) layout. On-disk layout (little-endian, 1024-byte blocks by default — adjustable via s_type at sb+508): Block 0 bootstrap Block 1 superblock @ file offset 1024 Block 2.. inode table (64-byte inodes, 10 direct + 1+2+3 indirect ptrs stored as 3-byte addresses) data blocks follow Superblock field of interest: u32 s_magic (sb+504) 0xFD187E20 (same magic as s5fs — distinguished from SysV/Coherent by extension) u32 s_type (sb+508) 1=512B/2=1024B/3=2048B blocks Root inode = 2. Directory entry: u16 inode + 14-char name. Spec source: SCO XENIX System V Programmer's Reference (1989) Appendix C; Linux kernel fs/sysv/super.c which historically mounted Xenix volumes via the sysv driver.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `XenixReader` | `XenixReader(Stream stream)` |  |
+| `IndirectPointerBytes` | `const int IndirectPointerBytes` | Bytes a pointer occupies inside an indirect block. |
+| `InodePointerBytes` | `const int InodePointerBytes` | Bytes a pointer to a data block occupies inside an inode. |
+| `BlockSize` | `int BlockSize { get; }` |  |
+| `Entries` | `IReadOnlyList<XenixEntry> Entries { get; }` |  |
+| `FirstDataByte` | `long FirstDataByte { get; }` | First byte a file may occupy. `s_isize` is the number of the first data block, not how many blocks the inode list spans — reading it the other way put the boundary past the root directory and the first file, and everything below it was then reported as the volume's own. |
+| `Magic` | `uint Magic { get; }` |  |
+| `Dispose` | `void Dispose()` |  |
+| `EnumerateLayout` | `IEnumerable<ValueTuple<long, long, long, string>> EnumerateLayout()` | Where on disk everything the volume holds actually sits: each file's data blocks under its name, and every directory block and indirect block as structure, with the byte offset of the pointer that names each run. |
+| `Extract` | `byte[] Extract(XenixEntry entry)` |  |
+
+#### `XenixWriter`
+
+Builds minimal Microsoft/SCO Xenix System V filesystem images. Targets the "Xenix V" (s5fs-compatible) variant — the layout Linux's historical `sysv` driver mounted as `-t sysv -o xenix`: 1024-byte blocks, 64-byte inodes with 24-bit zone pointers, 16-byte directory entries (u16 inode + 14-char name), and the `0xFD187E20` superblock magic at block-relative offset 504.
+
+Implements `IDisposable`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `XenixWriter` | `XenixWriter(Stream output, bool leaveOpen = false)` |  |
+| `DeduplicateWithLinks` | `bool DeduplicateWithLinks { get; set; }` | Store one copy of files whose bytes are identical and give the rest a second name for it. |
+| `MakeSparse` | `bool MakeSparse { get; set; }` | Leave a zone unallocated where the file holds nothing but zeros. |
+| `AddFile` | `void AddFile(string path, byte[] data)` | Registers a file to be embedded into the emitted image. |
+| `Dispose` | `void Dispose()` |  |
+| `Finish` | `void Finish()` | Builds the directory/inode/data layout and writes the image. |
+
 ### Namespace `FileSystem.Xfs`
 
-[`XfsBlockMover`](#xfsblockmover) · [`XfsEntry`](#xfsentry) · [`XfsExtentMap`](#xfsextentmap) · [`XfsFormatDescriptor`](#xfsformatdescriptor) · [`XfsInPlaceAdder`](#xfsinplaceadder) · [`XfsModifier`](#xfsmodifier) · [`XfsReader`](#xfsreader) · [`XfsWriter`](#xfswriter)
+[`XfsBlockMover`](#xfsblockmover) · [`XfsEntry`](#xfsentry) · [`XfsExtentMap`](#xfsextentmap) · [`XfsFilesystemDriverAdapter`](#xfsfilesystemdriveradapter) · [`XfsFormatDescriptor`](#xfsformatdescriptor) · [`XfsInPlaceAdder`](#xfsinplaceadder) · [`XfsModifier`](#xfsmodifier) · [`XfsReader`](#xfsreader) · [`XfsWriter`](#xfswriter)
 
 #### `XfsBlockMover`
 
@@ -9736,11 +13951,27 @@ Walks an XFS image and yields its actual on-disk byte layout. Targets the WORM w
 | --- | --- | --- |
 | `Enumerate` | `static IEnumerable<DefragBlockInfo> Enumerate(Stream image)` | Single-pass walker. Parses sb0, computes the AG layout, walks the root directory's inode (extents-format) to enumerate child files, then yields each child's BMBT extents as Used runs. |
 
+#### `XfsFilesystemDriverAdapter`
+
+Native XFS read-only driver sidecar. XFS inode numbers and di_gen are used as path-independent object identities; duplicate directory entries targeting one inode therefore naturally become hard links in the common session. The current reader supports local and inline extent forks. Btree-format data forks, sparse logical gaps and unsupported v5 incompat features fail closed until their mappings are decoded rather than being flattened incorrectly.
+
+Implements `IBlockDeviceFilesystemDriverProvider`, `IFilesystemDriverAdapter`, `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `XfsFilesystemDriverAdapter` | `XfsFilesystemDriverAdapter()` |  |
+| `FormatId` | `string FormatId { get; }` |  |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
 #### `XfsFormatDescriptor`
 
 R/W descriptor for SGI XFS filesystem images ("XFSB" superblock magic) at `mkfs.xfs`-faithful defaults. References: `https://mirrors.edge.kernel.org/pub/linux/utils/fs/xfs/docs/xfs_filesystem_structure.pdf` — "XFS Algorithms & Data Structures" — the on-disk specification`https://github.com/torvalds/linux/tree/master/fs/xfs` — Linux reference implementation`https://en.wikipedia.org/wiki/XFS` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFilesystemBlockMover`, `IFilesystemExtentMap`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9846,7 +14077,7 @@ Implements `IFilesystemBlockMover`.
 
 R/W descriptor for YAFFS2 raw-NAND images. Auto-detects chunk/spare layout, surfaces an object table and reconstructed file tree. Modify semantics — true in-place, log-structured. YAFFS2 is a log-structured flash filesystem by spec: modifying a file means appending fresh chunks at the next free position with a higher seqNumber, never rewriting an existing chunk on the medium. `Add` and `Remove` route through `Yaffs2InPlaceModifier`, which appends at `Length` and never touches bytes in `[0, oldLength)`. The scanner resolves the live view by keeping the chunk with the highest seqNumber per (objectId, chunkId), and treats a header with `parent_obj_id == 0xFFFFFFFE` as a tombstone. Supports: list, extract, create, in-place modify, defragment, extent map. References: `https://yaffs.net/` — project home — hosts "How YAFFS Works" and the spec documentsCharles Manning, "How YAFFS Works" (yaffs.net documentation)`https://en.wikipedia.org/wiki/YAFFS` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IFilesystemExtentMap`, `IFormatDescriptor`, `ILayoutOptimizable`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9878,7 +14109,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 ### Namespace `FileSystem.Zfs`
 
-[`ZfsBlockMover`](#zfsblockmover) · [`ZfsEntry`](#zfsentry) · [`ZfsFormatDescriptor`](#zfsformatdescriptor) · [`ZfsInPlaceAdder`](#zfsinplaceadder) · [`ZfsModifier`](#zfsmodifier) · [`ZfsReader`](#zfsreader) · [`ZfsWriter`](#zfswriter)
+[`ZfsBlockMover`](#zfsblockmover) · [`ZfsEntry`](#zfsentry) · [`ZfsFilesystemDriverAdapter`](#zfsfilesystemdriveradapter) · [`ZfsFormatDescriptor`](#zfsformatdescriptor) · [`ZfsInPlaceAdder`](#zfsinplaceadder) · [`ZfsModifier`](#zfsmodifier) · [`ZfsReader`](#zfsreader) · [`ZfsWriter`](#zfswriter)
 
 #### `ZfsBlockMover`
 
@@ -9908,11 +14139,27 @@ Implements `IFilesystemBlockMover`.
 | `Name` | `string Name { get; init; }` |  |
 | `Size` | `long Size { get; init; }` |  |
 
+#### `ZfsFilesystemDriverAdapter`
+
+Native read-only ZFS sidecar for the repository's v28 single-vdev profile. Dataset dnode object IDs are preserved as path-independent identities and file bytes are streamed through `ZfsReader`, which validates the Fletcher-4 checksum of every block it follows. The driver rejects compressed or hole-bearing data mappings instead of exposing the raw physical bytes as logical file contents.
+
+Implements `IBlockDeviceFilesystemDriverProvider`, `IFilesystemDriverAdapter`, `IFilesystemDriverProvider`, `IFilesystemDriverReadinessProvider`.
+
+| Member | Signature | Summary |
+| --- | --- | --- |
+| `ZfsFilesystemDriverAdapter` | `ZfsFilesystemDriverAdapter()` |  |
+| `FormatId` | `string FormatId { get; }` |  |
+| `DescribeFilesystemDriverReadiness` | `FilesystemDriverReadinessReport DescribeFilesystemDriverReadiness(Stream image, FilesystemDriverTarget target)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(IRandomAccessBlockDevice device, FilesystemOpenOptions options)` |  |
+| `OpenFilesystem` | `IFilesystemSession OpenFilesystem(Stream image, FilesystemOpenOptions options)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(IRandomAccessBlockDevice device)` |  |
+| `ProbeFilesystem` | `FilesystemDriverProfile ProbeFilesystem(Stream image)` |  |
+
 #### `ZfsFormatDescriptor`
 
 Descriptor for ZFS pool images — four 256 KB vdev labels (NVList + uberblock ring) around the pool data area; WORM pool writer + reader round-trip. References: Sun Microsystems, "ZFS On-Disk Specification" (2006 draft) — vdev labels, uberblocks, DMU structures`https://github.com/openzfs/zfs` — OpenZFS — the maintained implementation`https://openzfs.github.io/openzfs-docs/` — OpenZFS documentation`https://en.wikipedia.org/wiki/ZFS` — Wikipedia article
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFormatDescriptor`, `IFormatOptionsSchema`, `ILayoutOptimizable`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10033,7 +14280,7 @@ Directory entry in a ZX Spectrum SCL (Sinclair Compact Language) archive.
 
 Descriptor for ZX Spectrum SCL archives ("SINCLAIR" signature) — the header+catalogue TR-DOS file container convertible to .trd images. References: `https://sinclair.wiki.zxnet.co.uk/wiki/TR-DOS_filesystem` — the TR-DOS catalogue structures the SCL container carries`https://en.wikipedia.org/wiki/TR-DOS` — Wikipedia article — covers the SCL containerSCL format notes in ZX Spectrum emulator documentation (World of Spectrum formats reference)
 
-Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFormatDescriptor`, `IWipeEmpty`.
+Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperations`, `IArchiveLayoutMap`, `IArchiveModifiable`, `IArchivePurgeable`, `IArchiveShrinkable`, `IArchiveWriteConstraints`, `IFormatDescriptor`, `IWipeEmpty`.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
diff --git a/README.md b/README.md
index b152b7790..16e4abcbc 100644
--- a/README.md
+++ b/README.md
@@ -86,6 +86,17 @@ against the real source code (R / WORM / R/W states, upstream spec links, limita
 
 ---
 
+<!-- branch-screenshots:start -->
+## UI snapshots
+
+These screenshots are generated from the current branch by the real WPF application on every non-main push. They are committed back to the branch so the README shows the UI that branch actually builds, rather than a manually curated image from some older revision.
+
+| Archive browser | Binary analysis | Maintenance |
+| :--: | :--: | :--: |
+| [![Archive browser](docs/screenshots/archive-browser.png)](docs/screenshots/archive-browser.png) | [![Binary analysis](docs/screenshots/analysis.png)](docs/screenshots/analysis.png) | [![Maintenance](docs/screenshots/maintenance.png)](docs/screenshots/maintenance.png) |
+
+<!-- branch-screenshots:end -->
+
 ## Vision
 
 CompressionWorkbench exists to answer two kinds of questions about compressed and packaged data, entirely in managed .NET with no native dependency on zlib, liblzma, libarchive, or any other third-party compression library:
diff --git a/TODO.md b/TODO.md
new file mode 100644
index 000000000..0d0b30ad5
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,197 @@
+# CompressionWorkbench mounting roadmap
+
+## Goal
+
+Expose supported archives, filesystem images, and nested disk/container images as operating-system mounts. The UI and CLI must offer read-only or read-write mounting only when the selected image, its backing source, and the active mount backend can actually satisfy the requested semantics.
+
+A writable offline rebuild is **not** automatically a writable mount. `FormatCapabilities.CanModify` answers whether an existing container can be modified through the archive/image API; mountability is determined by the mount-grade filesystem/provider contracts and their per-image probe result.
+
+## Non-goals
+
+- Do not advertise writable mounting merely because a format can be recreated or rewritten offline.
+- Do not emulate missing mutation primitives by silently replacing the entire image for every filesystem call.
+- Do not put Dokan/FUSE-specific concepts into format implementations.
+- Do not require a native kernel-mode IFS driver before the userspace filesystem contract is proven.
+- Do not weaken filesystem-driver-safety or round-trip tests to gain mount checkmarks.
+
+## Architecture
+
+### 1. Mount-neutral host
+
+- [ ] Add `Compression.Mounting` targeting `net10.0`.
+- [ ] Define `MountAccessMode` (`ReadOnly`, `ReadWrite`).
+- [ ] Define `MountBackendCapabilities`, `MountRequest`, `MountPlan`, `IMountBackend`, and `IMountSession`.
+- [ ] Add a capability resolver that combines:
+  - backend availability and supported operations;
+  - source stream/file writability;
+  - `IFilesystemDriverProvider.ProbeFilesystem`;
+  - `FilesystemDriverProfile.CanMount` / `CanMountWritable`;
+  - the exact `FilesystemDriverCapabilities` needed by the backend.
+- [ ] Fail closed: unknown or partially supported semantics produce read-only or unsupported plans, never optimistic read-write.
+- [ ] Keep mount lifecycle explicit: start, active session, flush, unmount, dispose.
+- [ ] Normalize error mapping in the neutral layer so backends only translate neutral errors to NTSTATUS/errno.
+
+### 2. Virtual namespace adapters
+
+- [ ] Filesystem adapter: map `IFilesystemSession` directly to the neutral mount namespace using stable `FilesystemNodeId` handles.
+- [ ] Archive adapter: expose archive entries as a synthetic namespace for read-only mounts.
+- [ ] Writable archive adapter: only enable after add/replace/remove/rename/truncate semantics are explicitly modeled and round-trip tested; do not equate `IArchiveModifiable` with random-write file handles.
+- [ ] Disk/container adapter: resolve partition/container layers to an `IFilesystemDriverProvider` without copying the complete image when a random-access block device is available.
+- [ ] Nested mounts: preserve the chain of outer container -> block device/partition -> filesystem and propagate writability from every layer.
+
+### 3. Windows Dokan backend
+
+- [ ] Add `Compression.Mounting.Dokan` targeting `net10.0-windows`.
+- [ ] Use DokanNet 2.x through a narrow backend adapter; keep the rest of the repository independent of Dokan types.
+- [ ] Implement mount/unmount and dependency probing (Dokany installed/available).
+- [ ] Map open/create/read/write/truncate/flush/enumerate/stat/rename/delete/directory operations to the neutral namespace.
+- [ ] Track open handles by stable node ID, not pathname, so rename/unlink cannot invalidate an existing handle.
+- [ ] Implement Windows sharing/delete-pending semantics deliberately instead of approximating them with path locks.
+- [ ] Map timestamps and attributes without inventing unsupported metadata writes.
+- [ ] Add read-only integration tests first; enable read-write integration tests only for driver profiles that advertise the complete required primitive set.
+
+### 4. Linux FUSE backend
+
+- [ ] Add `Compression.Mounting.Fuse` targeting `net10.0`.
+- [ ] Prefer a FUSE3 low-level/inode-oriented binding so stable `FilesystemNodeId` maps naturally to FUSE inode/handle semantics.
+- [ ] Keep the binding behind `IMountBackend`; if no maintained .NET binding satisfies the requirements, use a small source-owned native interop layer rather than leaking an abandoned package throughout the codebase.
+- [ ] Probe `libfuse3`/`fusermount3` availability and report actionable backend limitations.
+- [ ] Implement errno mapping, inode lifetime, lookup/reference counts, file handles, readdir offsets, flush/fsync, rename and unlink semantics.
+- [ ] Add Linux CI integration tests where `/dev/fuse` is available; keep pure adapter contract tests runnable everywhere.
+
+### 5. macOS / FSKit path
+
+- [ ] Keep the neutral mount contract compatible with a future macFUSE/FUSE3 FSKit backend.
+- [ ] Do not make macOS support depend on deprecated kernel extensions.
+- [ ] Re-evaluate a native FSKit backend once the neutral namespace and FUSE backend are stable.
+
+### 6. Native Windows IFS path
+
+- [ ] Treat a native Windows IFS/minifilter-style implementation as a separate, later backend/bridge project.
+- [ ] Reuse the same userspace protocol and conformance suite rather than reimplementing format logic in kernel mode.
+- [ ] Define a narrow IPC protocol before any kernel code: requests, stable handles, cancellation, timeouts, buffer ownership, crash recovery, and forced unmount.
+- [ ] Only pursue the kernel driver if Dokan cannot meet a measured requirement (performance, boot-time mounting, paging I/O, security model, etc.).
+
+## Capability truth table
+
+### Read-only mount
+
+A filesystem image may advertise read-only mounting only when all are true:
+
+- [ ] the descriptor provides `IFilesystemDriverProvider`;
+- [ ] `ProbeFilesystem` returns `CanMount = true` for this image/profile;
+- [ ] the profile provides directory enumeration, data reads, random access, and stable node IDs required by the backend;
+- [ ] the selected backend is available on the host;
+- [ ] all outer container/partition layers can provide safe random reads.
+
+### Read-write mount
+
+Read-write additionally requires all of the following for the selected profile and mount policy:
+
+- [ ] `CanMountWritable = true`;
+- [ ] mutation model is not `None` or `WholeImageRebuild` for ordinary mounted writes;
+- [ ] backing source and every outer layer are writable;
+- [ ] required data operations (`WriteData`, `Truncate`, `Flush`) are present;
+- [ ] required namespace operations (`CreateFile`, `DeleteFile`, `CreateDirectory`, `RemoveDirectory`, `Rename`) are present;
+- [ ] backend-specific metadata semantics are either supported or explicitly exposed as unsupported without corrupting data;
+- [ ] writable driver safety and round-trip/conformance tests pass for that profile.
+
+Optional primitives such as hard links, symlinks, sparse files, metadata writes and transactions are advertised independently and mapped only when present.
+
+## UI
+
+- [ ] Add a Mount action for a currently opened archive/image/filesystem when at least one backend returns a supported plan.
+- [ ] Default to read-only.
+- [ ] Offer read-write only when the resolver returns an allowed read-write plan for the concrete image.
+- [ ] Show the reason when read-write is unavailable (format profile, backing file, outer container, backend, missing primitive, or dependency).
+- [ ] Let the user choose a Windows drive letter or Unix mountpoint as appropriate.
+- [ ] Show active mounts and provide explicit unmount/flush actions.
+- [ ] Use the same resolver as the CLI; no duplicated UI capability rules.
+
+## CLI
+
+- [ ] Add `mount <image> <target> [--read-only|--read-write] [--backend ...]`.
+- [ ] Add `mount capabilities <image>` to print the resolved per-image/backend plan and limitations.
+- [ ] Add `unmount <target>` where the backend supports external unmount.
+- [ ] Make `--read-write` fail with a precise reason instead of silently falling back to read-only.
+
+## Tests
+
+### Pure contract tests
+
+- [ ] Resolver never offers read-write from `FormatCapabilities.CanModify` alone.
+- [ ] Resolver rejects writable mount for `WholeImageRebuild` profiles.
+- [ ] Resolver rejects writable mount when the backing stream is read-only.
+- [ ] Resolver rejects a profile missing any required core mutation primitive.
+- [ ] Resolver preserves optional capabilities independently.
+- [ ] Open handles remain usable across rename in the fake filesystem session.
+- [ ] Delete/open-handle lifetime behavior is deterministic and backend-independent.
+- [ ] Concurrent positional reads do not share a mutable stream cursor.
+- [ ] Flush/unmount calls are ordered and idempotent where required.
+
+### Backend conformance
+
+- [ ] Shared backend contract suite using an in-memory fake filesystem.
+- [ ] Dokan read-only smoke mount on Windows CI when Dokany is available.
+- [ ] Dokan read-write CRUD/rename/truncate/flush suite.
+- [ ] FUSE read-only smoke mount on Linux CI when `/dev/fuse` is available.
+- [ ] FUSE read-write CRUD/rename/truncate/fsync suite.
+- [ ] Cancellation, forced-unmount and backend-crash cleanup tests.
+
+### Format qualification
+
+For every format/profile promoted to mountable:
+
+- [ ] probe is non-destructive and restores stream position;
+- [ ] read-only namespace walk matches existing extraction/listing results;
+- [ ] random reads match extracted content;
+- [ ] writable CRUD operations survive close/reopen;
+- [ ] rename/delete semantics preserve unrelated data;
+- [ ] allocator/free-space metadata remains structurally valid;
+- [ ] journal/checkpoint/recovery semantics are tested when applicable;
+- [ ] capability advertising matches the tested profile, not the family name.
+
+## Delivery order
+
+### Phase A — foundation
+
+- [ ] Add `Compression.Mounting` and the capability resolver.
+- [ ] Add pure resolver/contract tests.
+- [ ] Integrate the project into the solution.
+
+### Phase B — first usable Windows mount
+
+- [ ] Add `Compression.Mounting.Dokan`.
+- [ ] Implement read-only filesystem mounting over `IFilesystemSession`.
+- [ ] Wire UI Mount action and read-only/read-write selector to the resolver.
+- [ ] Add a CLI `mount` command using the same resolver/backend registry.
+
+### Phase C — honest writable mounting
+
+- [ ] Select the simplest already-qualified filesystem driver profiles with native granular mutation support.
+- [ ] Complete missing mount-grade primitives where justified.
+- [ ] Enable Dokan read-write only after conformance passes.
+- [ ] Never promote EROFS/SquashFS/CramFS-style whole-image rebuild support to writable mount capability.
+
+### Phase D — FUSE
+
+- [ ] Implement Linux FUSE3 backend against the same neutral namespace.
+- [ ] Share the conformance suite with Dokan.
+- [ ] Wire CLI backend selection and mountpoint handling.
+
+### Phase E — archives and nested containers
+
+- [ ] Read-only archive namespace adapter.
+- [ ] Explicit writable archive filesystem semantics where safe.
+- [ ] Partition/container chaining using `IRandomAccessBlockDevice`.
+- [ ] Propagate access mode and limitations through nested layers.
+
+### Phase F — breadth
+
+- [ ] Qualify retro/exotic filesystems with simple allocation/namespace structures first.
+- [ ] Expand to journaled/CoW filesystems only after allocator, transaction, crash-consistency and recovery semantics are real.
+- [ ] Audit docs/UI/CLI capability tables from the same mechanical source used by runtime resolution.
+
+## Immediate implementation checkpoint
+
+The first code checkpoint is complete when the repository has a buildable mount-neutral project whose resolver can answer, for a concrete `FilesystemDriverProfile` and backend, whether read-only and read-write mounting are allowed and exactly why not. That checkpoint deliberately precedes Dokan/FUSE callbacks so backend code cannot accidentally invent its own capability policy.
diff --git a/docs/FILESYSTEM-DRIVER-ARCHITECTURE.md b/docs/FILESYSTEM-DRIVER-ARCHITECTURE.md
new file mode 100644
index 000000000..5222b1770
--- /dev/null
+++ b/docs/FILESYSTEM-DRIVER-ARCHITECTURE.md
@@ -0,0 +1,90 @@
+# Filesystem driver architecture
+
+The archive API is useful for whole-image tooling, but it is deliberately **not** the contract for a future mounted filesystem driver. `CanModify` means an existing container can be changed and verified; that change may legally be implemented by a whole-image rebuild. A mounted writable filesystem has stronger requirements.
+
+## Layers
+
+1. **Container / media layer** — VHD/QCOW2/EWF expose logical blocks; G64/NIB/flux formats expose raw tracks until a sector decoder can project them as blocks.
+2. **Block device layer** — `IRandomAccessBlockDevice` provides positional logical-block I/O, flush and trim independent of the outer container.
+3. **Filesystem namespace layer** — `IFilesystemDriverProvider` probes the exact on-disk profile and opens an `IFilesystemSession` over stable node identities.
+4. **OS adapter** — FUSE, WinFsp, Dokany or another adapter translates kernel requests into the session contract. It should contain no filesystem-specific parsing.
+
+The dependency direction is one-way: a FAT/ext/ReFS driver consumes a block device; it does not know how QCOW2/EWF stores that block. Likewise, G64 is not a CBM-DOS filesystem. It is a track device which may later be decoded into sectors and mounted by a CBM-DOS driver.
+
+## Repository-wide coverage invariant
+
+Filesystem-driver coverage is no longer a hand-maintained shortlist.
+
+`Compression.Lib` and `Hawkynt.FileFormats.FileSystems` reference `FileSystems/FileSystem.*/*.csproj` through an exhaustive project glob. The registry source generator marks descriptors declared below a `FileSystem.*` namespace as filesystem descriptors and discovers public `IFilesystemDriverAdapter` sidecars without reflection. Registry initialization then requires every marked filesystem descriptor to have one of these paths:
+
+- the descriptor itself implements a native `IFilesystemDriverProvider`;
+- a generated native `IFilesystemDriverAdapter` sidecar exists for its format ID; or
+- the descriptor implements `IArchiveFormatOperations` and can be projected conservatively through the read-only archive-derived filesystem session.
+
+`Compression.Tests/Operations/FilesystemDriverCoverageTests.cs` enforces the same rule in CI. Adding a new `FileSystem.*` descriptor that has no derivable driver path is therefore a build/test regression rather than a documentation omission.
+
+The derived archive projection is intentionally a **compatibility floor**, not a native-readiness claim. It supplies a bounded, positional, read-only namespace for formats whose parser can list/open entries; its default `OpenEntry` path is temporary-file-backed so large files do not require one `byte[]`. It cannot by itself prove native inode identity, allocation maps, sparse/shared extent semantics, crash recovery or mounted writes.
+
+`FormatRegistry.GetFilesystemDriverCoverage()` exposes whether a format currently resolves through a native descriptor provider, a generated native sidecar, or the conservative archive projection. `IFilesystemDriverReadinessProvider` separately reports which implementation layers are genuinely present for read-only and read/write driver targets.
+
+## Requirements for writable mounting
+
+A format may advertise archive-level `CanModify` while its `FilesystemDriverProfile.CanMountWritable` remains false. Writable mounting should only be enabled when all of the following are true for the **current image profile**:
+
+- stable object identity survives rename and open-handle lifetime;
+- directories support lookup and enumeration without path-as-identity shortcuts;
+- file reads and writes are positional/random-access and bounded to the file;
+- create, unlink, mkdir, rmdir, rename and truncate update all relevant indexes and allocation metadata;
+- free-space allocation and release are known, including sparse/shared/extents where applicable;
+- dirty metadata has a defined flush/durability boundary;
+- crash consistency is understood (journal, CoW transaction, log commit, or another native scheme);
+- checksums, mirrors, generations, sequence numbers and backup metadata are updated together;
+- unknown feature bits or metadata layouts force a read-only profile instead of being guessed;
+- concurrent open handles cannot race through one shared `Stream.Position` cursor.
+
+`FilesystemMutationModel.WholeImageRebuild` is therefore useful for offline tools but should normally report `CanMountWritable = false`.
+
+## Transactions
+
+`IFilesystemSession.BeginTransaction()` is an explicit durability boundary. Implementations with native transactions should map it to their real mechanism:
+
+- ReFS: CoW metadata pages + allocation updates + checkpoint/SUPB publication;
+- APFS/Btrfs/ZFS: native CoW transaction groups / roots;
+- NTFS: logfile-aware metadata update sequence;
+- FAT-like filesystems: a staged write set ordered so allocation, directory entry and size changes cannot expose uninitialised clusters.
+
+A driver without a safe native commit model can still be mounted read-only and can continue using the archive rebuild path for offline edits.
+
+## Identity and handles
+
+`FilesystemNodeId` is intentionally path-independent. Providers should map a native inode/object/file reference plus generation/sequence information where available. FAT-like formats may synthesize identity from stable directory-slot/first-cluster information, but must invalidate stale generations when a slot is reused.
+
+`IFilesystemFileHandle` uses positional `Read(offset, ...)` and `Write(offset, ...)`, not a mutable stream cursor. This matches kernel I/O request semantics and permits independent concurrent handles.
+
+`SpoolingReadOnlyFileHandle` is a transitional handle for readers that can stream the correct logical file but do not yet expose a seekable native extent map. Small files stay in memory; larger files use a delete-on-close temporary file. Filesystems with a verified extent mapping should prefer a direct positional handle instead.
+
+## Native driver tier currently implemented
+
+The following formats now have native descriptor providers or generated native sidecars rather than relying only on archive projection:
+
+- **D64 / CBM nibble media** — native Commodore namespace plus sector/raw-track layers; G64/NIB retain raw-track identity and the GCR sector projector feeds the filesystem layer.
+- **ReFS** — native read session over decoded metadata/object identities; mounted mutation remains separately gated from the offline-quiescent image editor.
+- **FAT12/16/32** — native directory/cluster-chain read session and allocation knowledge; mounted mutation remains gated on a proven ordered durability protocol.
+- **ext2/ext3/ext4** — native inode identity and positional block/extent reads; mounted mutation remains gated on complete allocation, metadata and journal transaction semantics.
+- **NTFS** — native MFT-record identity and positional data reads; full file-reference sequence identity, index mutation, `$LogFile` publication/replay and complete metadata/security semantics remain write blockers.
+- **XFS** — native inode+generation identity and streaming extent reads; writable mounting remains gated on allocation-group btrees, log transactions, delayed allocation/refcount/reflink and crash-recovery semantics.
+- **APFS** — native object IDs and direct positional reads for the proven unencrypted single-extent profile; broader extent/compression/encryption profiles fail closed and CoW checkpoint/spaceman/OMAP publication remains a write blocker.
+- **Btrfs** — native inode IDs and a global logical segment map across all FS-tree leaves. Inline/regular extents are read directly, holes/prealloc ranges return zeroes, and compressed/encrypted/multi-stripe profiles fail closed. Writable mounting remains gated on CoW tree paths, delayed refs, extent/checksum/free-space trees, transaction generations and log-tree replay.
+- **ZFS** — native dataset dnode object IDs and checksum-verified streaming reads for the supported v28 single-vdev profile. Unsupported compression/checksum/hole/gang/multi-vdev profiles fail closed. Writable mounting remains gated on metaslab/spacemap allocation, TXG/uberblock publication, ZIL replay and complete DSL/ZAP/dnode semantics.
+
+A native read-only sidecar is not a promise that the existing archive-level `Add`/`Remove` path is safe to expose to a mounted kernel client. `CanMountWritable` is only enabled when the corresponding readiness report can satisfy the full read/write layer set.
+
+## Raw-track lower layer
+
+`CbmNibbleRawTrackDevices` implements the raw-track layer for G64/NIB:
+
+- NIB writes one fixed 8192-byte slot directly and can clear a slot without moving anything else.
+- G64 keeps half-track index as stable device identity, stages variable-length track changes, rebuilds the offset table at flush, and verifies every surviving track before commit.
+- G64 images using pointer-based variable-speed maps are readable but writable raw-track open is refused until those auxiliary speed-map blocks are modeled.
+
+The GCR sector projector implements the bridge toward `IRandomAccessBlockDevice`, allowing Commodore filesystem logic to consume sector semantics without treating a variable-length raw-track container as if it were itself the filesystem.
diff --git a/docs/screenshots/analysis.png b/docs/screenshots/analysis.png
new file mode 100644
index 000000000..83111dba1
Binary files /dev/null and b/docs/screenshots/analysis.png differ
diff --git a/docs/screenshots/archive-browser.png b/docs/screenshots/archive-browser.png
new file mode 100644
index 000000000..8d8807ad5
Binary files /dev/null and b/docs/screenshots/archive-browser.png differ
diff --git a/docs/screenshots/maintenance.png b/docs/screenshots/maintenance.png
new file mode 100644
index 000000000..cc8f5738b
Binary files /dev/null and b/docs/screenshots/maintenance.png differ