diff --git a/.containerignore b/.containerignore
new file mode 100644
index 0000000000000000000000000000000000000000..6e6498aa611c4a629c3b57e30bf35ab7a8a78500
--- /dev/null
+++ b/.containerignore
@@ -1,0 +1,2 @@
+# The wrapper already stages a clean context. Apple Container 1.0.0 still
+# requires an explicit root .dockerignore to avoid treating Dockerfile as it.
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..953a7e39718c36b98d94ae589dac295155f339b7
--- /dev/null
+++ b/.gitignore
@@ -1,0 +1,2 @@
+/build/
+/sources/
diff --git a/Containerfile b/Containerfile
new file mode 100644
index 0000000000000000000000000000000000000000..f78e30d3af17de44bc4046510243793a6ba847f9
--- /dev/null
+++ b/Containerfile
@@ -1,0 +1,65 @@
+FROM alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS toolchain
+
+RUN apk add --no-cache \
+        bc=1.08.2-r1 \
+        build-base=0.5-r4 \
+        clang22=22.1.3-r2 \
+        cpio=2.15-r0 \
+        curl=8.21.0-r0 \
+        diffutils=3.12-r0 \
+        elfutils-dev=0.195-r0 \
+        file=5.47-r2 \
+        findutils=4.10.0-r1 \
+        gawk=5.3.2-r2 \
+        lld22=22.1.3-r0 \
+        linux-headers=7.0.0-r1 \
+        llvm=22-r0 \
+        patch=2.8-r0 \
+        perl=5.42.2-r0 \
+        python3=3.14.5-r0 \
+        rustup=1.29.0-r0 \
+        openssl-dev=3.5.7-r0 \
+        xz=5.8.3-r0
+
+RUN apk add --no-cache flex=2.6.4-r8
+
+ENV RUSTUP_HOME=/opt/rustup
+ENV CARGO_HOME=/opt/cargo
+ENV PATH=/opt/cargo/bin:/usr/lib/llvm22/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+RUN rustup-init -y \
+        --profile minimal \
+        --default-toolchain 1.94.0 \
+        --target x86_64-unknown-linux-musl \
+    && chmod -R a+rX /opt/rustup /opt/cargo
+
+WORKDIR /work/mouse-src
+
+COPY mouse-src/sources.lock mouse-src/scripts/fetch-sources.sh /work/mouse-src/
+RUN mkdir -p /work/mouse-src/scripts \
+    && mv /work/mouse-src/fetch-sources.sh /work/mouse-src/scripts/fetch-sources.sh \
+    && MOUSE_SOURCE_DIR=/opt/mouse-sources /work/mouse-src/scripts/fetch-sources.sh
+
+COPY mouse-src/ /work/mouse-src/
+COPY cheesed/ /work/cheesed/
+
+FROM toolchain AS kernel-builder
+
+RUN apk add --no-cache bison=3.8.2-r3
+
+RUN MOUSE_SOURCE_DIR=/opt/mouse-sources \
+    /work/mouse-src/scripts/build-kernel.sh
+
+FROM toolchain AS rootfs-builder
+
+RUN apk add --no-cache byacc=20260126-r0
+
+RUN MOUSE_SKIP_KERNEL=1 \
+    MOUSE_SOURCE_DIR=/opt/mouse-sources \
+    CHEESED_DIR=/work/cheesed \
+    /work/mouse-src/scripts/build-image.sh
+
+FROM scratch AS artifacts
+
+COPY --from=kernel-builder /work/mouse-src/build/vmlinuz-virt /
+COPY --from=rootfs-builder /work/mouse-src/build/mouse-initramfs.cpio.gz /
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000000000000000000000000000000000000..6c0fd35985808d5cf58248dfffe53df4a1778d87
--- /dev/null
+++ b/Makefile
@@ -1,0 +1,26 @@
+CHEESED_DIR ?= ../cheesed
+
+.PHONY: all audit check clean fetch image image-linux run
+
+all: image
+
+fetch:
+	./scripts/fetch-sources.sh
+
+image:
+	CHEESED_DIR="$(CHEESED_DIR)" ./scripts/build-in-container.sh
+
+image-linux:
+	CHEESED_DIR="$(CHEESED_DIR)" ./scripts/build-image.sh
+
+run: image
+	./scripts/run-qemu.sh
+
+check: image
+	./scripts/check-c0.sh
+
+audit: image
+	@printf '%s\n' "static ELF audit passed during the container build"
+
+clean:
+	rm -f build/vmlinuz-virt build/mouse-initramfs.cpio.gz
diff --git a/PLAN.md b/PLAN.md
new file mode 100644
index 0000000000000000000000000000000000000000..f82456afd8a636484921ad5db6568c7ab71ed952
--- /dev/null
+++ b/PLAN.md
@@ -1,0 +1,149 @@
+# MOUSE Plan
+
+## Project definition
+
+**MOUSE** means **Monolithic Opinionated Unix-like System Environment**. It is a
+Linux distribution with a FreeBSD-style release model: a deliberately integrated,
+versioned base system and a distinct source-based ports collection for third-party
+software.
+
+MOUSE is opinionated by design. The goal is a coherent system with clear defaults
+and boundaries, not a framework for assembling an arbitrary Linux installation.
+
+## System contract
+
+### Base system
+
+The MOUSE base system is built, tested, versioned, and released as one unit. It
+contains the Linux kernel; musl libc; ChimeraUtils; the C/C++ toolchain based on
+Clang and LLVM; the default login environment; essential system configuration;
+and the service framework.
+
+Every executable in the MOUSE base system is statically linked against musl.
+Base-image validation must reject an ELF interpreter or dynamic `NEEDED`
+entries. This policy does not automatically apply to third-party ports, whose
+linkage contract will be specified separately.
+
+Base components are not installed, upgraded, or removed through the ports tree.
+A base-system update changes the whole release in a controlled, compatible way.
+
+### Ports
+
+The MOUSE ports tree contains third-party software outside the base system. A
+port describes how to fetch, verify, patch, build, install, and remove a piece
+of software from source, including its dependencies. The first release treats
+ports as source-built software; it does not promise a public binary-package
+repository. If binary packages are added later, they must be generated from the
+same ports revision and remain an acceleration layer, not a second package
+definition system.
+
+The ports tree installs outside the base-owned paths. The precise prefix and
+package database format are implementation decisions, but both must preserve the
+rule that a port cannot overwrite a file owned by the base system.
+
+## Component choices
+
+| Component | MOUSE choice | Rationale |
+| --- | --- | --- |
+| Identity | MOUSE: Monolithic Opinionated Unix-like System Environment | States the integrated release model and deliberate system conventions. |
+| Init and supervision | `cheesed`, OpenRC, and `supervise-daemon` | `cheesed` remains PID 1 and owns early boot, signal handling, orphan reaping, and final shutdown. OpenRC orders service lifecycle actions, while one `supervise-daemon` process owns the restart policy and runtime state of each supervised service. |
+| Service policy | `/etc/rc.conf` | Persistent enablement lives only in `rc.conf`, for example `enable_sshd=YES`. `cheesed` translates that policy into disposable OpenRC runlevel state at boot. Service definitions and generated runlevels must not become a second persistent policy store. |
+| Service definitions | OpenRC service scripts | Definitions declare dependencies and lifecycle actions using OpenRC's service interface. Supervised services use `supervise-daemon`; system scripts use the base POSIX shell. |
+| Release engineering | Versioned base releases | Kernel, libc, base utilities, toolchain, and init framework are released together. |
+| Base build | Multi-stage OCI Containerfile | A digest-pinned Linux builder fetches checksum-pinned sources, builds both `mouse-src` and `cheesed`, and exports only release artifacts. Apple Container, Docker BuildKit, and Podman are interchangeable frontends. |
+| Kernel | Linux 6.18 with a MOUSE-owned config | The kernel is built from checksum-pinned kernel.org source. The initial `kernel/x86_64.config` targets QEMU's x86_64 serial-console, initramfs, ACPI, VirtIO, and ext4 path; it is versioned with the rest of the base rather than inherited from a host distribution. |
+| C library | musl | Chosen for a compact, consistent base. Port maintainers must treat musl compatibility as a first-class constraint; glibc assumptions require explicit fixes or exclusions. |
+| Base utilities | ChimeraUtils | Core command-line utilities are part of the MOUSE base, rather than a GNU coreutils package selected from ports. |
+| Default desktop | None | MOUSE starts as a text-oriented system. Desktop environments, display stacks, and related applications belong in ports. |
+| Default login shell | `tcsh` | This is an intentional interactive default inspired by historical BSD practice. System scripts must use a POSIX shell, not `tcsh`. |
+| Toolchain | Clang/LLVM | The compiler and linker toolchain are base components and are tested with each base release. |
+| Workload isolation | Incus | Incus provides containers and virtual machines as an optional, ports-provided operational layer; it is not represented as a FreeBSD-jail equivalent. |
+
+## FreeBSD influence, accurately scoped
+
+MOUSE borrows FreeBSD's separation between base and third-party software, its
+release discipline, and its `rc.conf`-centred service policy. It does not claim
+to be FreeBSD or to reproduce every FreeBSD component.
+
+In FreeBSD terminology, `rc(8)` and the scripts in `/etc/rc.d` execute service
+startup, while `/etc/rc.conf` records local policy. MOUSE should preserve that
+separation: `cheesed` translates local policy and coordinates boot, OpenRC
+executes the service graph, and `/etc/rc.conf` is the sole persistent enablement
+interface.
+
+MOUSE uses OpenRC as the execution engine for that model without adopting
+OpenRC's usual persistent runlevel administration. During boot, `cheesed`
+strictly parses `enable_${name}=YES|NO` entries and generates ephemeral OpenRC
+runlevel membership under `/run`. OpenRC starts services in dependency order and
+then exits; service definitions which require supervision use
+`supervise-daemon`. MOUSE does not ship `rc-update`, because persistent runlevel
+symlinks would compete with `/etc/rc.conf` as the enablement database.
+
+The effective runlevel tree is a complete generation below
+`/run/openrc/runlevels/generations`, exposed through an atomically replaced
+`/run/openrc/runlevels/current` link and an immutable
+`/etc/runlevels` link to that runtime path. `cheesed` rebuilds the whole tree on
+every boot from versioned base templates under `/usr/lib/mouse/runlevels` and
+optional `enable_${name}=YES` assignments. OpenRC itself is not patched to use a
+MOUSE-specific runlevel path.
+
+For the first release, `rc.conf` accepts only comments, empty lines, and unique
+`enable_${name}=YES|NO` assignments. Service names match
+`[a-z][a-z0-9_]*`; missing values mean `NO` for optional services, and required
+base services cannot be disabled through `rc.conf`. Unknown keys, duplicate
+assignments, shell syntax, and names which do not resolve to exactly one service
+definition are errors. OpenRC global settings and include files are deferred
+until they have an explicit allowlisted grammar.
+
+The administrator-facing `service` command is a symlink to `rc-service`.
+`service foo start`, `stop`, `restart`, and `status` are runtime operations and
+do not change whether `foo` starts on the next boot.
+
+FreeBSD Ports and `pkg` are complementary source and binary installation paths.
+MOUSE begins with source-built ports only. This difference is explicit and should
+not be blurred by calling the ports tree a binary package manager.
+
+## First implementation milestone
+
+The first milestone is a QEMU-bootable base image that proves the boundary and
+service model rather than attempting a broad distribution.
+
+1. Build a bootable Linux image whose base includes musl, ChimeraUtils,
+   Clang/LLVM, `tcsh`, statically linked OpenRC tools, and `cheesed`.
+2. Implement `cheesed` as PID 1 with clean shutdown, early-boot logging, orphan
+   reaping, strict `rc.conf` parsing, and ephemeral OpenRC runlevel generation.
+3. Provide one required base service and one optional supervised service.
+   Enabling the optional service must require only `enable_${name}=YES` in
+   `/etc/rc.conf`; OpenRC must order its start and `supervise-daemon` must report
+   and apply its runtime restart policy.
+4. Create a minimal ports skeleton for one non-base program. Demonstrate fetching,
+   checksum verification, source build, dependency recording, installation,
+   removal, and rejection of an attempted write into a base-owned path.
+5. Publish the base release manifest and the exact ports-tree revision used for
+   the image, so a rebuilt system has an inspectable source identity.
+
+## Acceptance gates
+
+- A clean QEMU boot reaches a usable `tcsh` login without systemd.
+- Every base executable is a static musl binary with no ELF interpreter or
+  dynamic-library dependency.
+- `cheesed` is PID 1, OpenRC starts the generated runlevel in dependency order,
+  and `supervise-daemon` supervises the proof service.
+- `/etc/rc.conf` is the only persistent place that enables or disables the
+  optional service; the image does not contain `rc-update`.
+- `service`, as the `rc-service` interface, performs runtime lifecycle actions
+  without changing next-boot enablement.
+- The base manifest lists every base-owned file or package, and the ports tool
+  refuses to replace one.
+- A source-built test port installs and removes successfully without changing
+  the base manifest.
+- The image records its MOUSE release version and ports-tree revision.
+
+## Deliberately unresolved before implementation
+
+- The base-system update mechanism.
+- The ports build sandbox, package database, installation prefix, and signing
+  format.
+- Whether Incus is supplied through the initial ports tree or deferred until the
+  base and ports contracts are proven.
+- The policy for ports that cannot be made musl-compatible.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..91168a100afba157790e77ac3f06b9d173b1d357
--- /dev/null
+++ b/README.md
@@ -1,0 +1,65 @@
+# MOUSE source tree
+
+This repository currently builds the first MOUSE boot image: Linux 6.18.35 from
+pinned kernel.org source using MOUSE's own x86_64 configuration, a MOUSE-owned
+mini rootfs with ChimeraUtils, and `cheesed` from the sibling repository as
+`/sbin/cheesed`.
+
+The mini rootfs is assembled from an explicit file list rather than inheriting
+another distribution's filesystem. The kernel, musl, NetBSD curses, `tcsh`, and
+the selected ChimeraUtils base commands are compiled locally from pinned source
+archives. No shipped runtime artifact comes from Alpine.
+
+## Build and boot
+
+The canonical build is the multi-stage `Containerfile`. It uses a
+digest-pinned Alpine build environment, builds both sibling repositories, and
+exports only the kernel and initramfs. Alpine supplies build tools only; both
+runtime artifacts are assembled entirely from MOUSE's pinned sources and
+checked-in configuration.
+
+`make image` uses Apple Container, Docker, or Podman and exports the results
+into `build/`. The builder runs natively as arm64 and cross-compiles the base
+system and `cheesed` for static x86_64 musl. Set `CONTAINER_CLI` to select a
+specific implementation. The wrapper creates a clean temporary context
+containing both sibling repositories, excluding Git metadata and prior build
+outputs. `make image-linux` runs the inner build directly on an equivalent
+Linux host. Homebrew and the macOS SDK are not used.
+
+`make run` prefers a repository-local QEMU at
+`build/tools/qemu/bin/qemu-system-x86_64`, then falls back to
+`qemu-system-x86_64` on `PATH`.
+
+```sh
+make image
+make run
+make check
+```
+
+Generated and downloaded files live under `build/` and `sources/`, both of
+which are ignored by Git. Every downloaded input is versioned and SHA-256
+verified through `sources.lock`. Before writing the initramfs, the build rejects
+any base ELF executable with an interpreter or dynamic `NEEDED` entry.
+
+`make check` requires `expect`. It boots the image twice under QEMU and verifies
+the C0 banner, PID 1 identity, MOUSE login environment, `clear`, `tcsh` job
+control, orphan reaping, absence of zombies, poweroff, and reboot.
+
+To select a container frontend explicitly:
+
+```sh
+CONTAINER_CLI=container make image
+CONTAINER_CLI=docker make image
+CONTAINER_CLI=podman make image
+```
+
+The wrapper selects `linux/arm64` or `linux/amd64` from the host architecture.
+`MOUSE_BUILDER_PLATFORM` can override that choice when the frontend provides
+cross-architecture emulation.
+
+The serial console should include:
+
+```text
+Cheesed to meet you! v0.1.0
+cheesed: C0 bootstrap complete; cheesed is PID 1
+```
diff --git a/kernel/x86_64.config b/kernel/x86_64.config
new file mode 100644
index 0000000000000000000000000000000000000000..4bbe948dac747b4de778509996796e53122ffcf1
--- /dev/null
+++ b/kernel/x86_64.config
@@ -1,0 +1,210 @@
+CONFIG_LOCALVERSION="-mouse"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_DEFAULT_HOSTNAME="mouse"
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_PREEMPT_VOLUNTARY=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_CGROUPS=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_RDMA=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_MISC=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_PROFILING=y
+CONFIG_SMP=y
+CONFIG_IOSF_MBI=y
+CONFIG_HYPERVISOR_GUEST=y
+CONFIG_PARAVIRT=y
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
+CONFIG_X86_MSR=y
+CONFIG_X86_CPUID=y
+CONFIG_NUMA=y
+CONFIG_X86_CHECK_BIOS_CORRUPTION=y
+# CONFIG_MTRR_SANITIZER is not set
+CONFIG_EFI=y
+CONFIG_EFI_STUB=y
+CONFIG_EFI_MIXED=y
+CONFIG_HZ_1000=y
+CONFIG_PM_DEBUG=y
+CONFIG_PM_TRACE_RTC=y
+CONFIG_ACPI_VIDEO=y
+CONFIG_ACPI_DOCK=y
+CONFIG_ACPI_BGRT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_X86_ACPI_CPUFREQ=y
+CONFIG_IA32_EMULATION=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_BLK_CGROUP_IOLATENCY=y
+CONFIG_BLK_CGROUP_IOCOST=y
+CONFIG_BLK_CGROUP_IOPRIO=y
+CONFIG_BINFMT_MISC=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_DIAG is not set
+CONFIG_TCP_CONG_ADVANCED=y
+# CONFIG_TCP_CONG_BIC is not set
+# CONFIG_TCP_CONG_WESTWOOD is not set
+# CONFIG_TCP_CONG_HTCP is not set
+CONFIG_TCP_MD5SIG=y
+CONFIG_INET6_AH=y
+CONFIG_INET6_ESP=y
+CONFIG_NETLABEL=y
+CONFIG_NETWORK_SECMARK=y
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_ADVANCED is not set
+CONFIG_NET_SCHED=y
+CONFIG_NET_CLS_CGROUP=y
+CONFIG_NET_EMATCH=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_DNS_RESOLVER=y
+CONFIG_CGROUP_NET_PRIO=y
+CONFIG_CFG80211=y
+CONFIG_MAC80211=y
+CONFIG_MAC80211_LEDS=y
+CONFIG_RFKILL=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_PRI=y
+CONFIG_PCI_PASID=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_CONNECTOR=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_CHR_DEV_SG=y
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_SPI_ATTRS=y
+CONFIG_SCSI_VIRTIO=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_ATA_PIIX=y
+CONFIG_PATA_AMD=y
+CONFIG_PATA_OLDPIIX=y
+CONFIG_PATA_SCH=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_MIRROR=y
+CONFIG_DM_ZERO=y
+CONFIG_NETDEVICES=y
+CONFIG_NETCONSOLE=y
+CONFIG_VIRTIO_NET=y
+CONFIG_TIGON3=y
+CONFIG_NET_TULIP=y
+CONFIG_E100=y
+CONFIG_E1000=y
+CONFIG_E1000E=y
+CONFIG_SKY2=y
+CONFIG_FORCEDETH=y
+CONFIG_8139TOO=y
+CONFIG_R8169=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_MISC=y
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_MANY_PORTS=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_DETECT_IRQ=y
+CONFIG_SERIAL_8250_RSA=y
+CONFIG_SERIAL_NONSTANDARD=y
+CONFIG_VIRTIO_CONSOLE=y
+# CONFIG_HW_RANDOM_INTEL is not set
+# CONFIG_HW_RANDOM_AMD is not set
+CONFIG_NVRAM=y
+CONFIG_HPET=y
+# CONFIG_HPET_MMAP is not set
+CONFIG_I2C=y
+CONFIG_I2C_I801=y
+CONFIG_WATCHDOG=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_HIDRAW=y
+CONFIG_HID_GYRATION=y
+CONFIG_HID_PANTHERLORD=y
+CONFIG_PANTHERLORD_FF=y
+CONFIG_HID_PETALYNX=y
+CONFIG_HID_SUNPLUS=y
+CONFIG_HID_TOPSEED=y
+# CONFIG_USB_SUPPORT is not set
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_DMADEVICES=y
+CONFIG_SYNC_FILE=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_ACPI_WMI=y
+CONFIG_EEEPC_LAPTOP=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_QUOTA=y
+CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QFMT_V2=y
+CONFIG_AUTOFS_FS=y
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_HUGETLBFS=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_UTF8=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_NETWORK=y
+CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
+CONFIG_CRYPTO_LZO=y
+CONFIG_PRINTK_TIME=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_WX=y
+CONFIG_SCHEDSTATS=y
+CONFIG_FTRACE=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_PROVIDE_OHCI1394_DMA_INIT=y
+CONFIG_EARLY_PRINTK_DBGP=y
diff --git a/patches/chimerautils-native-cdefs.patch b/patches/chimerautils-native-cdefs.patch
new file mode 100644
index 0000000000000000000000000000000000000000..7c5b548e443506fe97bc6a2382cff2ffd4158c0d
--- /dev/null
+++ b/patches/chimerautils-native-cdefs.patch
@@ -1,0 +1,36 @@
+diff --git a/include/sys/cdefs.h b/include/sys/cdefs.h
+index 2dac3f9..aa16c50 100644
+--- a/include/sys/cdefs.h
++++ b/include/sys/cdefs.h
+@@ -28,6 +28,10 @@
+ #ifndef SYS_CDEFS_H
+ #define SYS_CDEFS_H
+ 
++#ifdef __APPLE__
++#include_next <sys/cdefs.h>
++#else
++
+ #include <features.h>
+ 
+ #ifdef __GLIBC__
+@@ -53,4 +57,6 @@
+ 
+ #define __unreachable() __builtin_unreachable()
+ 
++#endif
++
+ #endif
+diff --git a/include/string.h b/include/string.h
+index 68108f6..9707bcd 100644
+--- a/include/string.h
++++ b/include/string.h
+@@ -38,7 +38,9 @@
+ extern "C" {
+ #endif
+ 
++#ifndef __APPLE__
+ void strmode(mode_t, char *);
++#endif
+ #ifndef HAVE_STRLCPY
+ size_t strlcpy(char *d, const char *s, size_t n);
+ #endif
diff --git a/patches/tcsh-gethost-native.patch b/patches/tcsh-gethost-native.patch
new file mode 100644
index 0000000000000000000000000000000000000000..1665e4099dbde7166bdf1d6f0a0cf61850d26fbc
--- /dev/null
+++ b/patches/tcsh-gethost-native.patch
@@ -1,0 +1,26 @@
+--- a/gethost.c
++++ b/gethost.c
+@@ -29,7 +29,12 @@
+  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+  * SUCH DAMAGE.
+  */
+-#include "sh.h"
++#include <assert.h>
++#include <ctype.h>
++#include <stddef.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
+ 
+ #ifdef SCO
+ # define perror __perror
+@@ -45,8 +50,7 @@
+ # undef system
+ #endif
+ 
+-#include <ctype.h>
+-#include <assert.h>
++#define INBUFSIZE 8192
+ 
+ #define ISSPACE(p)	(isspace((unsigned char) (p)) && (p) != '\n')
+ 
diff --git a/rootfs/etc/csh.cshrc b/rootfs/etc/csh.cshrc
new file mode 100644
index 0000000000000000000000000000000000000000..ce241d1f4e0351b0dc2826594ce51ac8bc33c141
--- /dev/null
+++ b/rootfs/etc/csh.cshrc
@@ -1,0 +1,5 @@
+set path = ( /sbin /bin /usr/sbin /usr/bin )
+
+if ( $?prompt ) then
+    set prompt = "mouse:%~%# "
+endif
diff --git a/rootfs/etc/csh.login b/rootfs/etc/csh.login
new file mode 100644
index 0000000000000000000000000000000000000000..6d34b767b31636aa6d14fbf186c4b3e68bc04a03
--- /dev/null
+++ b/rootfs/etc/csh.login
@@ -1,0 +1,8 @@
+umask 022
+setenv SHELL /bin/tcsh
+
+if ( -r /etc/motd ) then
+    cat /etc/motd
+endif
+
+cd
diff --git a/rootfs/etc/group b/rootfs/etc/group
new file mode 100644
index 0000000000000000000000000000000000000000..1dbf9013eeb9dd365f8dd758b61a61a6d49c2d0c
--- /dev/null
+++ b/rootfs/etc/group
@@ -1,0 +1,1 @@
+root:x:0:
diff --git a/rootfs/etc/hostname b/rootfs/etc/hostname
new file mode 100644
index 0000000000000000000000000000000000000000..3e41be967df67de6fde644b1d5dc1a813f7c59a5
--- /dev/null
+++ b/rootfs/etc/hostname
@@ -1,0 +1,1 @@
+mouse
diff --git a/rootfs/etc/hosts b/rootfs/etc/hosts
new file mode 100644
index 0000000000000000000000000000000000000000..9cc33c7a1f27bde19dbc637ac31458b14ebcceb8
--- /dev/null
+++ b/rootfs/etc/hosts
@@ -1,0 +1,2 @@
+127.0.0.1	localhost mouse
+::1		localhost mouse
diff --git a/rootfs/etc/motd b/rootfs/etc/motd
new file mode 100644
index 0000000000000000000000000000000000000000..9af29824331736ba8999158aacdd883a8e0740c9
--- /dev/null
+++ b/rootfs/etc/motd
@@ -1,0 +1,2 @@
+MOUSE 0.1.0 (x86_64)
+Monolithic Opinionated Unix-like System Environment
diff --git a/rootfs/etc/mouse-release b/rootfs/etc/mouse-release
new file mode 100644
index 0000000000000000000000000000000000000000..4121765a2c3d467ec1045944d2fcac75f7795086
--- /dev/null
+++ b/rootfs/etc/mouse-release
@@ -1,0 +1,6 @@
+NAME=MOUSE
+ID=mouse
+PRETTY_NAME="MOUSE 0.1.0"
+VERSION="0.1.0"
+VERSION_ID=0.1.0
+ARCHITECTURE=x86_64
diff --git a/rootfs/etc/passwd b/rootfs/etc/passwd
new file mode 100644
index 0000000000000000000000000000000000000000..7ab4be2985effcce67b8048ce3156f0f93416e33
--- /dev/null
+++ b/rootfs/etc/passwd
@@ -1,0 +1,1 @@
+root:x:0:0:root:/root:/bin/tcsh
diff --git a/rootfs/etc/rc.conf b/rootfs/etc/rc.conf
new file mode 100644
index 0000000000000000000000000000000000000000..ee339b781a3aa4f42074afecdaf1b135575f0679
--- /dev/null
+++ b/rootfs/etc/rc.conf
@@ -1,0 +1,1 @@
+# Persistent MOUSE service policy belongs in this file.
diff --git a/rootfs/etc/shells b/rootfs/etc/shells
new file mode 100644
index 0000000000000000000000000000000000000000..3fc22ac04366309dd6555702b1c3ca1b1621cb53
--- /dev/null
+++ b/rootfs/etc/shells
@@ -1,0 +1,2 @@
+/bin/sh
+/bin/tcsh
diff --git a/scripts/audit-static-base.sh b/scripts/audit-static-base.sh
new file mode 100755
index 0000000000000000000000000000000000000000..6e7aa716cfcaf732eefa7d8456565255812e4e88
--- /dev/null
+++ b/scripts/audit-static-base.sh
@@ -1,0 +1,38 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 1 ]; then
+    printf '%s\n' "usage: audit-static-base.sh ROOTFS" >&2
+    exit 2
+fi
+
+rootfs=$1
+failed=0
+count=0
+
+while IFS= read -r executable; do
+    description=$(file "$executable")
+    case "$description" in
+        *ELF*)
+            count=$((count + 1))
+            if objdump -p "$executable" |
+                grep -Eq '^[[:space:]]*(INTERP|NEEDED)[[:space:]]'; then
+                printf '%s\n' "dynamic base executable: $executable" >&2
+                failed=1
+            fi
+            ;;
+    esac
+done <<EOF
+$(find "$rootfs" -type f -perm -0100 -print | LC_ALL=C sort)
+EOF
+
+if [ "$count" -eq 0 ]; then
+    printf '%s\n' "no ELF executables found under $rootfs" >&2
+    exit 1
+fi
+
+if [ "$failed" -ne 0 ]; then
+    exit 1
+fi
+
+printf '%s\n' "static ELF audit passed: $count executables"
diff --git a/scripts/build-image.sh b/scripts/build-image.sh
new file mode 100755
index 0000000000000000000000000000000000000000..80b387e330d745df8fcabaef86e6f7c2b1669fc8
--- /dev/null
+++ b/scripts/build-image.sh
@@ -1,0 +1,58 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repo_dir=$(dirname "$script_dir")
+cheesed_dir=${CHEESED_DIR:-"$repo_dir/../cheesed"}
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+target=${CHEESED_TARGET:-x86_64-unknown-linux-musl}
+
+"$script_dir/fetch-sources.sh"
+if [ "${MOUSE_SKIP_KERNEL:-0}" != 1 ]; then
+    "$script_dir/build-kernel.sh"
+fi
+"$script_dir/build-static-base.sh"
+base_root="$build_dir/static/rootfs"
+cheesed_binary=$(CHEESED_TARGET="$target" "$cheesed_dir/scripts/build-static.sh")
+
+staging=$(mktemp -d "${TMPDIR:-/tmp}/mouse-rootfs.XXXXXX")
+trap 'rm -rf "$staging"' EXIT HUP INT TERM
+
+install -d -m 0755 \
+    "$staging/dev" \
+    "$staging/etc" \
+    "$staging/home" \
+    "$staging/media" \
+    "$staging/mnt" \
+    "$staging/proc" \
+    "$staging/root" \
+    "$staging/run" \
+    "$staging/sys" \
+    "$staging/usr/bin" \
+    "$staging/var"
+chmod 0755 "$staging"
+chmod 0700 "$staging/root"
+install -d -m 1777 "$staging/tmp"
+
+ln -s usr/bin "$staging/bin"
+ln -s usr/bin "$staging/sbin"
+ln -s bin "$staging/usr/sbin"
+
+cp -R "$base_root/." "$staging/"
+install -m 0755 "$cheesed_binary" "$staging/usr/bin/cheesed"
+
+cp -R "$repo_dir/rootfs/." "$staging/"
+ln -s mouse-release "$staging/etc/os-release"
+
+"$script_dir/audit-static-base.sh" "$staging"
+
+mkdir -p "$build_dir"
+(
+    cd "$staging"
+    find . -print |
+        LC_ALL=C sort |
+        cpio -o --format newc -R 0:0 2>/dev/null |
+        gzip -9
+) >"$build_dir/mouse-initramfs.cpio.gz"
+printf '%s\n' "built $build_dir/vmlinuz-virt"
+printf '%s\n' "built $build_dir/mouse-initramfs.cpio.gz"
diff --git a/scripts/build-in-container.sh b/scripts/build-in-container.sh
new file mode 100755
index 0000000000000000000000000000000000000000..dca3616632e1941d873f61fd5fca4052703c5b22
--- /dev/null
+++ b/scripts/build-in-container.sh
@@ -1,0 +1,99 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repo_dir=$(dirname "$script_dir")
+source_parent=$(dirname "$repo_dir")
+output_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+
+if [ -n "${MOUSE_BUILDER_PLATFORM:-}" ]; then
+    builder_platform=$MOUSE_BUILDER_PLATFORM
+else
+    case "$(uname -m)" in
+        arm64|aarch64) builder_platform=linux/arm64 ;;
+        x86_64|amd64) builder_platform=linux/amd64 ;;
+        *)
+            printf '%s\n' "unsupported container host architecture: $(uname -m)" >&2
+            exit 1
+            ;;
+    esac
+fi
+
+if [ ! -d "$source_parent/cheesed" ]; then
+    printf '%s\n' "cheesed source tree not found: $source_parent/cheesed" >&2
+    exit 1
+fi
+
+if [ -n "${CONTAINER_CLI:-}" ]; then
+    container_cli=$CONTAINER_CLI
+elif command -v container >/dev/null 2>&1; then
+    container_cli=$(command -v container)
+elif [ -x /usr/local/bin/container ]; then
+    container_cli=/usr/local/bin/container
+elif command -v docker >/dev/null 2>&1; then
+    container_cli=$(command -v docker)
+elif command -v podman >/dev/null 2>&1; then
+    container_cli=$(command -v podman)
+else
+    printf '%s\n' "no supported container CLI found (container, docker, or podman)" >&2
+    exit 1
+fi
+
+case "$(basename "$container_cli")" in
+    container)
+        "$container_cli" system start >/dev/null
+        ;;
+esac
+
+mkdir -p "$output_dir"
+build_context=$(mktemp -d "$output_dir/.container-context.XXXXXX")
+build_context=$(CDPATH= cd -- "$build_context" && pwd)
+export_dir=$(mktemp -d "$output_dir/.container-output.XXXXXX")
+export_dir=$(CDPATH= cd -- "$export_dir" && pwd)
+
+cleanup() {
+    rm -rf "$build_context" "$export_dir"
+}
+trap cleanup EXIT HUP INT TERM
+
+(
+    cd "$source_parent"
+    tar -cf - \
+        --exclude='mouse-src/.git/*' \
+        --exclude='mouse-src/build/*' \
+        --exclude='mouse-src/sources/*' \
+        --exclude='mouse-src/Containerfile' \
+        --exclude='mouse-src/.containerignore' \
+        --exclude='mouse-src/scripts/build-in-container.sh' \
+        --exclude='cheesed/.git/*' \
+        --exclude='cheesed/target/*' \
+        mouse-src cheesed
+) | tar -xf - -C "$build_context"
+
+cp "$repo_dir/Containerfile" "$build_context/Dockerfile"
+cp "$repo_dir/.containerignore" "$build_context/.dockerignore"
+
+(
+    cd "$build_context"
+    "$container_cli" build \
+        --platform "$builder_platform" \
+        --output "type=local,dest=$export_dir" \
+        .
+)
+
+artifacts_dir=$export_dir
+if [ ! -f "$artifacts_dir/vmlinuz-virt" ]; then
+    platform_dir=$(printf '%s\n' "$builder_platform" | tr / _)
+    artifacts_dir="$export_dir/out.tar/$platform_dir"
+fi
+
+for artifact in vmlinuz-virt mouse-initramfs.cpio.gz; do
+    if [ ! -f "$artifacts_dir/$artifact" ]; then
+        printf '%s\n' "container build did not export $artifact" >&2
+        exit 1
+    fi
+    install -m 0644 "$artifacts_dir/$artifact" "$output_dir/$artifact"
+done
+
+printf '%s\n' "exported $output_dir/vmlinuz-virt"
+printf '%s\n' "exported $output_dir/mouse-initramfs.cpio.gz"
diff --git a/scripts/build-kernel.sh b/scripts/build-kernel.sh
new file mode 100755
index 0000000000000000000000000000000000000000..23eb0d607628399580459598f29c70f5b0696a73
--- /dev/null
+++ b/scripts/build-kernel.sh
@@ -1,0 +1,50 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repo_dir=$(dirname "$script_dir")
+source_dir=${MOUSE_SOURCE_DIR:-"$repo_dir/sources"}
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+kernel_version=6.18.35
+kernel_archive="$source_dir/linux-$kernel_version.tar.xz"
+kernel_source="$build_dir/kernel/linux-$kernel_version"
+kernel_output="$build_dir/kernel/output"
+kernel_config="$repo_dir/kernel/x86_64.config"
+jobs=${MOUSE_BUILD_JOBS:-$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf '1\n')}
+
+if [ ! -f "$kernel_archive" ]; then
+    printf '%s\n' "missing $kernel_archive; run scripts/fetch-sources.sh first" >&2
+    exit 1
+fi
+
+if [ ! -f "$kernel_config" ]; then
+    printf '%s\n' "missing MOUSE kernel config: $kernel_config" >&2
+    exit 1
+fi
+
+mkdir -p "$build_dir/kernel"
+rm -rf "$kernel_source" "$kernel_output"
+tar -C "$build_dir/kernel" -xf "$kernel_archive"
+mkdir -p "$kernel_output"
+install -m 0644 "$kernel_config" "$kernel_output/.config"
+
+make -C "$kernel_source" \
+    O="$kernel_output" \
+    ARCH=x86_64 \
+    LLVM=1 \
+    olddefconfig
+
+make -C "$kernel_source" \
+    O="$kernel_output" \
+    ARCH=x86_64 \
+    LLVM=1 \
+    KBUILD_BUILD_USER=mouse \
+    KBUILD_BUILD_HOST=mouse \
+    -j"$jobs" \
+    bzImage
+
+install -m 0644 \
+    "$kernel_output/arch/x86/boot/bzImage" \
+    "$build_dir/vmlinuz-virt"
+
+printf '%s\n' "built Linux $kernel_version with $kernel_config"
diff --git a/scripts/build-static-base.sh b/scripts/build-static-base.sh
new file mode 100755
index 0000000000000000000000000000000000000000..1dfa59c63ccf2c2a19fb42aa05f37ca90b40d99c
--- /dev/null
+++ b/scripts/build-static-base.sh
@@ -1,0 +1,346 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repo_dir=$(dirname "$script_dir")
+source_dir=${MOUSE_SOURCE_DIR:-"$repo_dir/sources"}
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+static_dir="$build_dir/static"
+source_build_dir="$static_dir/src"
+sysroot="$static_dir/sysroot"
+base_root="$static_dir/rootfs"
+tools_dir="$static_dir/tools"
+jobs=${MOUSE_BUILD_JOBS:-$(getconf _NPROCESSORS_ONLN 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || printf '2')}
+
+case "$static_dir" in
+    "$repo_dir"/build/static) ;;
+    *)
+        printf '%s\n' "refusing to clear unexpected static build path: $static_dir" >&2
+        exit 1
+        ;;
+esac
+
+target_libdir=$(rustc --print target-libdir --target x86_64-unknown-linux-musl)
+builtins=$(find "$target_libdir" -maxdepth 1 -name 'libcompiler_builtins-*.rlib' -print | head -1)
+
+case "$(uname -s)" in
+    Linux)
+        lld=$(command -v ld.lld)
+        llvm_ar=$(command -v llvm-ar)
+        llvm_strip=$(command -v llvm-strip)
+        build_triplet=$(cc -dumpmachine)
+        native_cc=cc
+        ;;
+    Darwin)
+        rust_sysroot=$(rustc --print sysroot)
+        rust_toolchains_dir=$(dirname "$rust_sysroot")
+        lld="$rust_sysroot/lib/rustlib/aarch64-apple-darwin/bin/gcc-ld/ld.lld"
+        llvm_ar=$(find "$rust_toolchains_dir" -path '*/lib/rustlib/aarch64-apple-darwin/bin/llvm-ar' -print | head -1)
+        llvm_strip=$(find "$rust_toolchains_dir" -path '*/lib/rustlib/aarch64-apple-darwin/bin/llvm-strip' -print | head -1)
+        build_triplet=aarch64-apple-darwin
+        native_cc=clang
+        ;;
+    *)
+        printf '%s\n' "unsupported build host: $(uname -s)" >&2
+        exit 1
+        ;;
+esac
+
+for requirement in "$lld" "$builtins" "$llvm_ar" "$llvm_strip"; do
+    if [ ! -f "$requirement" ]; then
+        printf '%s\n' "missing LLVM/Rust cross-build component: $requirement" >&2
+        exit 1
+    fi
+done
+
+rm -rf "$static_dir"
+install -d -m 0755 "$source_build_dir" "$sysroot" "$base_root/usr/bin" "$tools_dir/bin"
+
+extract() {
+    tar -xf "$source_dir/$1" -C "$source_build_dir"
+}
+
+extract meson-1.9.1.tar.gz
+extract ninja-1.13.1.tar.gz
+extract pkgconf-2.5.1.tar.gz
+extract musl-1.2.6.tar.gz
+extract netbsd-curses-0.3.2.tar.gz
+extract attr-2.5.2.tar.gz
+extract acl-2.3.2.tar.gz
+extract libxo-1.7.5.tar.gz
+extract tcsh-6.24.16.tar.gz
+extract chimerautils-15.0.3.tar.gz
+
+patch -d "$source_build_dir/tcsh-TCSH6_24_16" -p1 \
+    <"$repo_dir/patches/tcsh-gethost-native.patch"
+patch -d "$source_build_dir/chimerautils-15.0.3" -p1 \
+    <"$repo_dir/patches/chimerautils-native-cdefs.patch"
+
+(
+    cd "$source_build_dir/ninja-1.13.1"
+    python3 configure.py --bootstrap
+    install -m 0755 ninja "$tools_dir/bin/ninja"
+)
+
+meson_source="$source_build_dir/meson-1.9.1/meson.py"
+PATH="$tools_dir/bin:$PATH"
+export PATH
+
+python3 "$meson_source" setup \
+    "$source_build_dir/pkgconf-pkgconf-2.5.1/build" \
+    "$source_build_dir/pkgconf-pkgconf-2.5.1" \
+    --prefix="$tools_dir" \
+    --buildtype=release \
+    --default-library=static
+python3 "$meson_source" compile -C "$source_build_dir/pkgconf-pkgconf-2.5.1/build"
+python3 "$meson_source" install -C "$source_build_dir/pkgconf-pkgconf-2.5.1/build"
+
+musl_cc="clang --target=x86_64-unknown-linux-musl --ld-path=$lld"
+MOUSE_LLVM_AR="$llvm_ar"
+export MOUSE_LLVM_AR
+(
+    cd "$source_build_dir/musl-1.2.6"
+    CC="$musl_cc" \
+        AR="$llvm_ar" \
+        RANLIB="$script_dir/mouse-ranlib" \
+        ./configure \
+        --target=x86_64 \
+        --prefix=/usr \
+        --syslibdir=/lib \
+        --disable-shared
+    make -s -j"$jobs"
+    make -s DESTDIR="$sysroot" install
+)
+
+install -d -m 0755 "$sysroot/usr/include/sys"
+install -m 0644 "$source_dir/cdefs.h" "$sysroot/usr/include/sys/cdefs.h"
+install -m 0644 "$source_dir/queue.h" "$sysroot/usr/include/sys/queue.h"
+install -m 0644 "$source_dir/tree.h" "$sysroot/usr/include/sys/tree.h"
+install -m 0644 "$source_dir/error.h" "$sysroot/usr/include/error.h"
+
+MOUSE_SYSROOT="$sysroot"
+MOUSE_LLD="$lld"
+MOUSE_BUILTINS="$builtins"
+MOUSE_LINK_COMPAT="$static_dir/static-link-compat.o"
+MOUSE_LLVM_AR="$llvm_ar"
+clang \
+    --target=x86_64-unknown-linux-musl \
+    --sysroot="$sysroot" \
+    -c "$repo_dir/support/static-link-compat.c" \
+    -o "$MOUSE_LINK_COMPAT"
+export MOUSE_SYSROOT MOUSE_LLD MOUSE_BUILTINS MOUSE_LINK_COMPAT MOUSE_LLVM_AR
+
+cc="$script_dir/mouse-cc"
+cxx="$script_dir/mouse-cxx"
+ranlib="$script_dir/mouse-ranlib"
+
+(
+    cd "$source_build_dir/netbsd-curses-0.3.2"
+    make -s -f GNUmakefile -j"$jobs" \
+        CC="$cc" \
+        HOSTCC="$native_cc" \
+        AR="$llvm_ar" \
+        RANLIB="$ranlib" \
+        CFLAGS="-O2" \
+        CPPFLAGS="-I. -I./libterminfo -DTERMINFO_COMPILE -DTERMINFO_DB -DTERMINFO_COMPAT" \
+        LDFLAGS="-static" \
+        PREFIX=/usr \
+        all-static
+    make -s -f GNUmakefile \
+        CC="$cc" \
+        HOSTCC="$native_cc" \
+        AR="$llvm_ar" \
+        RANLIB="$ranlib" \
+        CFLAGS="-O2" \
+        CPPFLAGS="-I. -I./libterminfo -DTERMINFO_COMPILE -DTERMINFO_DB -DTERMINFO_COMPAT" \
+        LDFLAGS="-static" \
+        PREFIX=/usr \
+        DESTDIR="$sysroot" \
+        install-static
+)
+
+build_autoconf_library() {
+    source_name=$1
+    build_target=$2
+    shift 2
+    (
+        cd "$source_build_dir/$source_name"
+        CC="$cc" \
+            AR="$llvm_ar" \
+            RANLIB="$ranlib" \
+            PKG_CONFIG="$tools_dir/bin/pkgconf" \
+            PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig" \
+            PKG_CONFIG_SYSROOT_DIR="$sysroot" \
+            ./configure \
+            --build="$build_triplet" \
+            --host=x86_64-linux-musl \
+            --prefix=/usr \
+            --disable-shared \
+            --enable-static \
+            "$@"
+        make -s -j"$jobs" "$build_target"
+        make -s DESTDIR="$sysroot" \
+            install-libLTLIBRARIES \
+            install-data-local \
+            install-pkgconfDATA
+    )
+}
+
+build_autoconf_library attr-2.5.2 libattr.la
+build_autoconf_library acl-2.3.2 libacl.la
+
+# The projects' install-time EXPORT substitution uses a GNU sed word-boundary
+# extension which macOS sed accepts but does not apply. Normalize the installed
+# public declarations for consumers of the cross-built static libraries.
+find "$sysroot/usr/include/attr" "$sysroot/usr/include/acl" \
+    "$sysroot/usr/include/sys/acl.h" \
+    -type f -exec perl -pi -e 's/\bEXPORT\b/extern/g' {} +
+
+(
+    cd "$source_build_dir/libxo-1.7.5"
+    CC="$cc" \
+        AR="$llvm_ar" \
+        RANLIB="$ranlib" \
+        ac_cv_func_malloc_0_nonnull=yes \
+        ac_cv_func_realloc_0_nonnull=yes \
+        ./configure \
+        --build="$build_triplet" \
+        --host=x86_64-linux-musl \
+        --prefix=/usr \
+        --disable-shared \
+        --enable-static \
+        --disable-libxo-options \
+        --disable-gettext \
+        --enable-text-only
+    make -s -C libxo -j"$jobs" libxo.la
+    make -s -C libxo DESTDIR="$sysroot" \
+        install-libLTLIBRARIES \
+        install-libxoincHEADERS
+    make -s DESTDIR="$sysroot" install-pkgconfigDATA
+)
+
+(
+    cd "$source_build_dir/tcsh-TCSH6_24_16"
+    CC="$cc" \
+        LIBS="-lcurses -lterminfo" \
+        ./configure \
+        --build="$build_triplet" \
+        --host=x86_64-linux-musl \
+        --prefix=/usr \
+        --disable-nls-catalogs
+    make -j"$jobs"
+    install -m 0755 tcsh "$base_root/usr/bin/tcsh"
+)
+
+cross_file="$static_dir/chimerautils.cross"
+{
+    printf '%s\n' \
+        '[binaries]' \
+        "c = '$cc'" \
+        "cpp = '$cxx'" \
+        "ar = '$llvm_ar'" \
+        "strip = '$llvm_strip'" \
+        "pkg-config = '$tools_dir/bin/pkgconf'" \
+        '' \
+        '[host_machine]' \
+        "system = 'linux'" \
+        "cpu_family = 'x86_64'" \
+        "cpu = 'x86_64'" \
+        "endian = 'little'" \
+        '' \
+        '[built-in options]' \
+        "c_args = ['-O2']" \
+        "cpp_args = ['-O2']" \
+        "c_link_args = ['-static']" \
+        "cpp_link_args = ['-static']" \
+        "default_library = 'static'" \
+        "prefer_static = true"
+} >"$cross_file"
+
+chimerautils_build="$source_build_dir/chimerautils-15.0.3/build"
+PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig:$sysroot/usr/share/pkgconfig" \
+PKG_CONFIG_SYSROOT_DIR="$sysroot" \
+    python3 "$meson_source" setup \
+    "$chimerautils_build" \
+    "$source_build_dir/chimerautils-15.0.3" \
+    --cross-file="$cross_file" \
+    --prefix=/usr \
+    --buildtype=release \
+    -Dopenssl=disabled \
+    -Dlibedit=disabled \
+    -Dzlib=disabled \
+    -Dlzma=disabled \
+    -Dbzip2=disabled \
+    -Dzstd=disabled \
+    -Dpam=disabled \
+    -Dselinux=disabled \
+    -Dchimera_realpath=disabled
+
+commands="
+cat chmod chown cp date dd df echo env find grep head hostname id kill
+ls mkdir mv pwd realpath rm rmdir sed sh sleep stat stty sync tail touch
+tty uname wc
+"
+
+targets="
+src.freebsd/coreutils/cat/cat
+src.freebsd/coreutils/chmod/chmod
+src.freebsd/coreutils/chown/chown
+src.freebsd/coreutils/cp/cp
+src.freebsd/coreutils/date/date
+src.freebsd/coreutils/dd/dd
+src.freebsd/coreutils/df/df
+src.freebsd/coreutils/echo/echo
+src.freebsd/coreutils/env/env
+src.freebsd/findutils/find/find
+src.freebsd/grep/grep
+src.freebsd/coreutils/head/head
+src.freebsd/coreutils/hostname/hostname
+src.freebsd/coreutils/id/id
+src.freebsd/miscutils/kill/kill
+src.freebsd/coreutils/ls/ls
+src.freebsd/coreutils/mkdir/mkdir
+src.freebsd/coreutils/mv/mv
+src.freebsd/coreutils/pwd/pwd
+src.freebsd/coreutils/realpath/realpath
+src.freebsd/coreutils/rm/rm
+src.freebsd/coreutils/rmdir/rmdir
+src.freebsd/sed/sed
+src.freebsd/sh/sh
+src.freebsd/coreutils/sleep/sleep
+src.freebsd/coreutils/stat/stat
+src.freebsd/coreutils/stty/stty
+src.freebsd/coreutils/sync/sync
+src.freebsd/coreutils/tail/tail
+src.freebsd/coreutils/touch/touch
+src.freebsd/coreutils/tty/tty
+src.freebsd/coreutils/uname/uname
+src.freebsd/coreutils/wc/wc
+"
+
+PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig:$sysroot/usr/share/pkgconfig" \
+PKG_CONFIG_SYSROOT_DIR="$sysroot" \
+    python3 "$meson_source" compile -C "$chimerautils_build" $targets
+
+for command in $commands; do
+    binary=$(find "$chimerautils_build" -type f -name "$command" -perm -0100 -print | head -1)
+    if [ -z "$binary" ]; then
+        printf '%s\n' "missing ChimeraUtils build output: $command" >&2
+        exit 1
+    fi
+    install -m 0755 "$binary" "$base_root/usr/bin/$command"
+done
+
+# ChimeraUtils installs whoami as an argv[0]-sensitive alias of id. A separate
+# copy keeps the initramfs self-contained without requiring a symlink utility
+# during image assembly.
+install -m 0755 "$base_root/usr/bin/id" "$base_root/usr/bin/whoami"
+
+install -m 0755 "$sysroot/usr/bin/tput" "$base_root/usr/bin/tput"
+ln -s tcsh "$base_root/usr/bin/csh"
+
+printf '%s\n' '#!/bin/sh' 'exec /usr/bin/tput clear' >"$base_root/usr/bin/clear"
+chmod 0755 "$base_root/usr/bin/clear"
+
+"$script_dir/audit-static-base.sh" "$base_root"
+printf '%s\n' "$base_root"
diff --git a/scripts/check-c0.exp b/scripts/check-c0.exp
new file mode 100755
index 0000000000000000000000000000000000000000..3dda28a8f6e1b0b4003a8e9e2aaa44edf7d73486
--- /dev/null
+++ b/scripts/check-c0.exp
@@ -1,0 +1,114 @@
+#!/usr/bin/expect -f
+
+if {$argc != 1} {
+    puts stderr "usage: check-c0.exp RUNNER"
+    exit 2
+}
+
+set runner [file normalize [lindex $argv 0]]
+set timeout 30
+
+proc fail {message} {
+    puts stderr "C0 check failed: $message"
+    exit 1
+}
+
+proc await_exact {text description} {
+    expect {
+        -exact $text {
+            return
+        }
+        timeout {
+            fail "timed out waiting for $description"
+        }
+        eof {
+            fail "QEMU exited while waiting for $description"
+        }
+    }
+}
+
+proc await_regexp {pattern description} {
+    expect {
+        -re $pattern {
+            return
+        }
+        timeout {
+            fail "timed out waiting for $description"
+        }
+        eof {
+            fail "QEMU exited while waiting for $description"
+        }
+    }
+}
+
+proc boot_mouse {runner} {
+    global spawn_id
+    spawn -noecho $runner
+    await_exact "Cheesed to meet you! v0.1.0" "the cheesed startup banner"
+    await_exact "cheesed: C0 bootstrap complete; cheesed is PID 1" "PID 1 confirmation"
+    await_exact "MOUSE 0.1.0 (x86_64)" "the MOUSE login banner"
+    await_exact "mouse:~# " "the tcsh prompt"
+}
+
+proc await_clean_exit {action} {
+    expect {
+        eof {
+            set result [wait]
+            set status [lindex $result 3]
+            if {$status != 0} {
+                fail "QEMU exited with status $status after $action"
+            }
+        }
+        timeout {
+            fail "QEMU did not exit after $action"
+        }
+    }
+}
+
+boot_mouse $runner
+
+send -- "hostname\r"
+await_exact "mouse\r" "the configured hostname"
+await_exact "mouse:~# " "the prompt after hostname"
+
+send -- "cat /proc/1/comm\r"
+await_exact "cheesed\r" "cheesed in /proc/1"
+await_exact "mouse:~# " "the prompt after the PID 1 check"
+
+send -- "sh -c 'test -c /dev/null'; echo DEV_STATUS_\$status\r"
+await_exact "DEV_STATUS_0\r" "a mounted devtmpfs"
+await_exact "mouse:~# " "the prompt after the devtmpfs check"
+
+send -- "clear; echo CLEAR_STATUS_\$status\r"
+await_exact "CLEAR_STATUS_0\r" "a successful clear command"
+await_exact "mouse:~# " "the prompt after clear"
+
+send -- "sleep 1 &\r"
+await_regexp {\[1\] [0-9]+} "a background tcsh job"
+await_exact "mouse:~# " "the prompt after starting a background job"
+send -- "jobs\r"
+await_exact "Running" "tcsh job control"
+await_exact "mouse:~# " "the prompt after jobs"
+
+send -- {sh -c 'i=0; while [ "$i" -lt 8 ]; do (sleep 1) & i=$((i + 1)); done'}
+send -- "\r"
+await_exact "mouse:~# " "the prompt after starting orphan probes"
+await_exact "cheesed: reaped orphan PID " "PID 1 orphan reaping"
+
+send -- "sleep 2\r"
+await_exact "mouse:~# " "all orphan probes to exit"
+send -- {sh -c 'if grep -l ") Z " /proc/[0-9]*/stat >/dev/null; then hostname; else cat /proc/1/comm; fi'}
+send -- "\r"
+await_exact "cheesed\r" "a zombie-free process table"
+await_exact "mouse:~# " "the prompt after the zombie check"
+
+send -- "kill -TERM 1\r"
+await_exact "cheesed: received poweroff request" "the poweroff request"
+await_clean_exit "poweroff"
+
+boot_mouse $runner
+send -- "kill -INT 1\r"
+await_exact "cheesed: received reboot request" "the reboot request"
+await_clean_exit "reboot"
+
+puts "C0 QEMU integration checks passed"
diff --git a/scripts/check-c0.sh b/scripts/check-c0.sh
new file mode 100755
index 0000000000000000000000000000000000000000..88386f8726f3be01d9eab491fa84d5a7e85dd4c2
--- /dev/null
+++ b/scripts/check-c0.sh
@@ -1,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+if ! command -v expect >/dev/null 2>&1; then
+    printf '%s\n' "expect is required for the C0 QEMU integration test" >&2
+    exit 1
+fi
+
+MOUSE_KERNEL_ARGS="console=ttyS0 rdinit=/sbin/cheesed panic=-1 quiet loglevel=3"
+export MOUSE_KERNEL_ARGS
+
+exec expect "$script_dir/check-c0.exp" "$script_dir/run-qemu.sh"
diff --git a/scripts/fetch-sources.sh b/scripts/fetch-sources.sh
new file mode 100755
index 0000000000000000000000000000000000000000..e47c91c8a80a75a0df5832354104e085b0431fbf
--- /dev/null
+++ b/scripts/fetch-sources.sh
@@ -1,0 +1,44 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repo_dir=$(dirname "$script_dir")
+source_dir=${MOUSE_SOURCE_DIR:-"$repo_dir/sources"}
+lock_file="$repo_dir/sources.lock"
+
+mkdir -p "$source_dir"
+
+while read -r expected url filename; do
+    case "$expected" in
+        ""|\#*) continue ;;
+    esac
+
+    destination="$source_dir/$filename"
+    if [ ! -f "$destination" ]; then
+        temporary="$destination.part"
+        printf '%s\n' "fetching $filename"
+        curl \
+            --fail \
+            --location \
+            --proto '=https' \
+            --tlsv1.2 \
+            --connect-timeout 20 \
+            --retry 4 \
+            --retry-all-errors \
+            "$url" \
+            -o "$temporary"
+        mv "$temporary" "$destination"
+    fi
+
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual=$(sha256sum "$destination" | awk '{print $1}')
+    else
+        actual=$(shasum -a 256 "$destination" | awk '{print $1}')
+    fi
+    if [ "$actual" != "$expected" ]; then
+        printf '%s\n' "checksum mismatch: $filename" >&2
+        printf '%s\n' "expected: $expected" >&2
+        printf '%s\n' "actual:   $actual" >&2
+        exit 1
+    fi
+done <"$lock_file"
diff --git a/scripts/mouse-cc b/scripts/mouse-cc
new file mode 100755
index 0000000000000000000000000000000000000000..5a6dc6e41dad6ba573b26462c0052bd8afce42ce
--- /dev/null
+++ b/scripts/mouse-cc
@@ -1,0 +1,42 @@
+#!/bin/sh
+set -eu
+
+: "${MOUSE_SYSROOT:?MOUSE_SYSROOT is required}"
+: "${MOUSE_LLD:?MOUSE_LLD is required}"
+: "${MOUSE_BUILTINS:?MOUSE_BUILTINS is required}"
+: "${MOUSE_LINK_COMPAT:?MOUSE_LINK_COMPAT is required}"
+
+compiler=${MOUSE_CLANG:-clang}
+link=yes
+
+for argument do
+    case "$argument" in
+        -c|-E|-M|-MM|-S|-fsyntax-only|-shared|-r)
+            link=no
+            ;;
+    esac
+done
+
+if [ "$link" = no ]; then
+    exec "$compiler" \
+        --target=x86_64-unknown-linux-musl \
+        --sysroot="$MOUSE_SYSROOT" \
+        "$@"
+fi
+
+exec "$compiler" \
+    --target=x86_64-unknown-linux-musl \
+    --sysroot="$MOUSE_SYSROOT" \
+    --ld-path="$MOUSE_LLD" \
+    -nostdlib \
+    -static \
+    "$MOUSE_SYSROOT/usr/lib/crt1.o" \
+    "$MOUSE_SYSROOT/usr/lib/crti.o" \
+    -L"$MOUSE_SYSROOT/usr/lib" \
+    "$@" \
+    -Wl,--start-group \
+    "$MOUSE_BUILTINS" \
+    "$MOUSE_LINK_COMPAT" \
+    "$MOUSE_SYSROOT/usr/lib/libc.a" \
+    -Wl,--end-group \
+    "$MOUSE_SYSROOT/usr/lib/crtn.o"
diff --git a/scripts/mouse-cxx b/scripts/mouse-cxx
new file mode 100755
index 0000000000000000000000000000000000000000..edabfba1c4657628404b1731b5335a29d3644157
--- /dev/null
+++ b/scripts/mouse-cxx
@@ -1,0 +1,8 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+MOUSE_CLANG=clang++
+export MOUSE_CLANG
+
+exec "$script_dir/mouse-cc" "$@"
diff --git a/scripts/mouse-ranlib b/scripts/mouse-ranlib
new file mode 100755
index 0000000000000000000000000000000000000000..0847b7dcc5e94bea9a9e2b3f22a384535a32b8b2
--- /dev/null
+++ b/scripts/mouse-ranlib
@@ -1,0 +1,6 @@
+#!/bin/sh
+set -eu
+
+: "${MOUSE_LLVM_AR:?MOUSE_LLVM_AR is required}"
+
+exec "$MOUSE_LLVM_AR" s "$@"
diff --git a/scripts/run-qemu.sh b/scripts/run-qemu.sh
new file mode 100755
index 0000000000000000000000000000000000000000..8bc36b8053359fbec8033988cdd9baf7ca41a755
--- /dev/null
+++ b/scripts/run-qemu.sh
@@ -1,0 +1,51 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repo_dir=$(dirname "$script_dir")
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+kernel_args=${MOUSE_KERNEL_ARGS:-"console=ttyS0 rdinit=/sbin/cheesed panic=-1"}
+local_qemu="$build_dir/tools/qemu/bin/qemu-system-x86_64"
+local_lib="$build_dir/tools/deps/lib"
+
+if [ -n "${QEMU_SYSTEM_X86_64:-}" ]; then
+    qemu=$QEMU_SYSTEM_X86_64
+elif [ -x "$local_qemu" ]; then
+    qemu=$local_qemu
+    DYLD_LIBRARY_PATH="$local_lib${DYLD_LIBRARY_PATH:+:$DYLD_LIBRARY_PATH}"
+    export DYLD_LIBRARY_PATH
+else
+    qemu=qemu-system-x86_64
+fi
+
+case "$qemu" in
+    */*)
+        if [ ! -x "$qemu" ]; then
+            printf '%s\n' "$qemu is not executable" >&2
+            exit 1
+        fi
+        ;;
+    *)
+        if ! command -v "$qemu" >/dev/null 2>&1; then
+            printf '%s\n' "qemu-system-x86_64 is required to boot the image" >&2
+            exit 1
+        fi
+        ;;
+esac
+
+if [ ! -f "$build_dir/vmlinuz-virt" ] ||
+    [ ! -f "$build_dir/mouse-initramfs.cpio.gz" ]; then
+    printf '%s\n' "run 'make image' before booting MOUSE" >&2
+    exit 1
+fi
+
+exec "$qemu" \
+    -machine accel=tcg \
+    -cpu max \
+    -m 256M \
+    -no-reboot \
+    -display none \
+    -nographic \
+    -kernel "$build_dir/vmlinuz-virt" \
+    -initrd "$build_dir/mouse-initramfs.cpio.gz" \
+    -append "$kernel_args"
diff --git a/sources.lock b/sources.lock
new file mode 100644
index 0000000000000000000000000000000000000000..d9178c140bc1ba909420db8ea8dcb47b1d765f81
--- /dev/null
+++ b/sources.lock
@@ -1,0 +1,16 @@
+# SHA-256  URL  filename
+f78602932219125e211c5f5bfd84edcfd4ec5ce88fc944f8248413f665bef236 https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.35.tar.xz linux-6.18.35.tar.xz
+d585fd3b613c66151fc3249e8ed44f77020cb5e6c1e635a616d3f9f82460512a https://musl.libc.org/releases/musl-1.2.6.tar.gz musl-1.2.6.tar.gz
+9d3ebd651e5f70b87b1327b01cbd7e0c01a0f036b4c1371f653b7704b11daf23 https://github.com/sabotage-linux/netbsd-curses/archive/refs/tags/v0.3.2.tar.gz netbsd-curses-0.3.2.tar.gz
+39bf67452fa41d0948c2197601053f48b3d78a029389734332a6309a680c6c87 https://download.savannah.nongnu.org/releases/attr/attr-2.5.2.tar.gz attr-2.5.2.tar.gz
+5f2bdbad629707aa7d85c623f994aa8a1d2dec55a73de5205bac0bf6058a2f7c https://download.savannah.nongnu.org/releases/acl/acl-2.3.2.tar.gz acl-2.3.2.tar.gz
+d12249ffad3ef04b160e6419adf1bbe7e593a60bb23f0a0a077fa780b214934a https://github.com/Juniper/libxo/releases/download/1.7.5/libxo-1.7.5.tar.gz libxo-1.7.5.tar.gz
+aa8b6eeca8b93db659a7ebf421a7089b3f7f8457deba34170cd146b92fe60546 https://github.com/tcsh-org/tcsh/archive/refs/tags/TCSH6_24_16.tar.gz tcsh-6.24.16.tar.gz
+183ad94242316cad014b54668e0b117ba4d8f6978b1229cde3fc5cd913020751 https://github.com/chimera-linux/chimerautils/archive/refs/tags/v15.0.3.tar.gz chimerautils-15.0.3.tar.gz
+b035c1aeaf82d6988e0feb9be8ac80e1825227ff01d0c7a92e4356f423db0b62 https://raw.githubusercontent.com/chimera-linux/cports/1e8911eb1bb9dc94a6734686b8327206d5ac89e0/main/musl-bsd-headers/files/cdefs.h cdefs.h
+3659cd137c320991a78413dd370a92fd18e0a8bc36d017d554f08677a37d7d5a https://raw.githubusercontent.com/chimera-linux/cports/1e8911eb1bb9dc94a6734686b8327206d5ac89e0/main/musl-bsd-headers/files/queue.h queue.h
+e1e498a79bf160a5766fa560f2b07b206fe89fe21a62600c77d72e00a6992f92 https://raw.githubusercontent.com/chimera-linux/cports/1e8911eb1bb9dc94a6734686b8327206d5ac89e0/main/musl-bsd-headers/files/tree.h tree.h
+a3c6ac4e3a3f7407760f87810e6937a213934bd8d2d7b9ea477489206d80742c https://raw.githubusercontent.com/chimera-linux/cports/1e8911eb1bb9dc94a6734686b8327206d5ac89e0/main/musl-bsd-headers/files/error.h error.h
+febaa8f7c1916521c53eb5fd11c0641b5eb4741c2c6e9b42c288ed62d9e4fd2c https://github.com/mesonbuild/meson/archive/refs/tags/1.9.1.tar.gz meson-1.9.1.tar.gz
+f0055ad0369bf2e372955ba55128d000cfcc21777057806015b45e4accbebf23 https://github.com/ninja-build/ninja/archive/refs/tags/v1.13.1.tar.gz ninja-1.13.1.tar.gz
+79721badcad1987dead9c3609eb4877ab9b58821c06bdacb824f2c8897c11f2a https://github.com/pkgconf/pkgconf/archive/refs/tags/pkgconf-2.5.1.tar.gz pkgconf-2.5.1.tar.gz
diff --git a/support/static-link-compat.c b/support/static-link-compat.c
new file mode 100644
index 0000000000000000000000000000000000000000..96315c4ad75c8ca936de4d149ee875527ad5c38f
--- /dev/null
+++ b/support/static-link-compat.c
@@ -1,0 +1,9 @@
+/*
+ * Rust's compiler-builtins archive carries an unused unwind reference on
+ * x86_64. Base C programs do not unwind through Rust, but lld still requires
+ * the personality symbol when it extracts the relevant builtins object.
+ */
+void
+rust_eh_personality(void)
+{
+}