diff --git a/.gitignore b/.gitignore
index 5e6198d2..7d6b71a4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,3 @@ lib/__pycache__/
 target/
 k230-build*.log
 *.log
-Cargo.lock
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 00000000..8e19375f
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,2710 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+
+[[package]]
+name = "atomic-polyfill"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
+dependencies = [
+ "critical-section",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+
+[[package]]
+name = "bon"
+version = "3.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a602c73c7b0148ec6d12af6fd5cc7a46e2eacc8878271a999abac56eed12f561"
+dependencies = [
+ "bon-macros",
+ "rustversion",
+]
+
+[[package]]
+name = "bon-macros"
+version = "3.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dee98b0db6a962de883bf5d20362dee4d7ca0d12fe39a7c6c73c844e1cd7c1f"
+dependencies = [
+ "darling",
+ "ident_case",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "camino"
+version = "1.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f2d30e4173c4026932d51d31d6b0613b1fd3014bf3f9f8943d4ba139c437ba0"
+
+[[package]]
+name = "caps"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd1ddba47aba30b6a889298ad0109c3b8dcb0e8fc993b459daa7067d46f865e0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.66"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5d6cac793997bd970000024b2934968efe83b382de4fdcf4fcb46b6ee4ad996"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex 2.0.1",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "close_fds"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bc416f33de9d59e79e57560f450d21ff8393adcf1cdfc3e6d8fb93d5f88a2ed"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crossdev-stages"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "camino",
+ "chrono",
+ "clap",
+ "gentoo-stages",
+ "hakoniwa",
+ "libc",
+ "num_cpus",
+ "portage-atom",
+ "serde",
+ "sokgi",
+ "thiserror 2.0.18",
+ "tokio",
+ "toml",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dashmap"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
+name = "embedded-io"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "gentoo-core"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "682c2890e9701c8f677d1f4a3b70766faaf86d91b1a875d1509aba125653d948"
+dependencies = [
+ "gentoo-interner",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "gentoo-interner"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f5b129d74ee6ab777ffa9052a2e80a39891f31e5173e6d92e99e78db23ca114"
+dependencies = [
+ "lasso",
+]
+
+[[package]]
+name = "gentoo-stages"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89ccf2a10dc9880ddd4a0a3c96ee647c0b2f79306e2b9fa1eadf25222adb394"
+dependencies = [
+ "bon",
+ "futures",
+ "gentoo-core",
+ "reqwest",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "rand_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hakoniwa"
+version = "1.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f07d75a391ae6a5ed931e4ede1e706a22660378e0a1afb6678499102f5008fe"
+dependencies = [
+ "bitflags",
+ "caps",
+ "close_fds",
+ "libc",
+ "log",
+ "nix",
+ "postcard",
+ "procfs",
+ "serde",
+ "tempfile",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "hash32"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heapless"
+version = "0.7.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
+dependencies = [
+ "atomic-polyfill",
+ "hash32",
+ "rustc_version",
+ "serde",
+ "spin",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lasso"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e14eda50a3494b3bf7b9ce51c52434a761e383d7238ce1dd5dcec2fbc13e9fb"
+dependencies = [
+ "dashmap",
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nix"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "portage-atom"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bf6a03ebda8cc182287466f6d86a614f25505f7c78782783900344b0fa78197"
+dependencies = [
+ "gentoo-interner",
+ "thiserror 2.0.18",
+ "winnow",
+]
+
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "embedded-io 0.4.0",
+ "embedded-io 0.6.1",
+ "heapless",
+ "serde",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "procfs"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25485360a54d6861439d60facef26de713b1e126bf015ec8f98239467a2b82f7"
+dependencies = [
+ "bitflags",
+ "chrono",
+ "flate2",
+ "procfs-core",
+ "rustix",
+]
+
+[[package]]
+name = "procfs-core"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6401bf7b6af22f78b563665d15a22e9aef27775b79b149a66ca022468a4e405"
+dependencies = [
+ "bitflags",
+ "chrono",
+ "hex",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f388202e4b80542a0921078cc23b6333bcf1409c1e3f86404cae4766a6131db"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "reqwest"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+dependencies = [
+ "base64",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+dependencies = [
+ "aws-lc-rs",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "sokgi"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3e52d71fd0b0009322d3a7a36e8a5081b2a1b78cadf6666a77331fdd7f03f3"
+dependencies = [
+ "shlex 1.3.0",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/README.md b/README.md
index 377fb8a1..dad3cce5 100644
--- a/README.md
+++ b/README.md
@@ -120,12 +120,29 @@ eselect repository create crossdev
 Each board lives in `boards/<name>/` with:
 - `board.conf` -- variables read by Rust and bash scripts
 - `genimage.cfg` -- disk image layout
+- `sandbox-packages.txt` -- extra host packages for the sandbox (optional)
+- `sandbox-packages.use` -- USE flags for those packages (optional)
+- `target-packages.txt` -- extra packages cross-emerged into the image (optional)
 - `pre-{step}.sh` -- runs before Rust default (optional)
 - `post-{step}.sh` -- runs after Rust default (optional)
 - `override-{step}.sh` -- replaces Rust default entirely (optional)
 
 Steps: `deps`, `checkout`, `bootloader`, `kernel`, `assemble`, `pack`
 
+Package lists in `defaults/` apply to every sandbox
+(`defaults/sandbox-packages.txt`) and every image
+(`defaults/target-packages.txt`).  The effective target set is
+`defaults/target-packages.txt` UNION `boards/<name>/target-packages.txt`
+MINUS the board's `-atom` lines (e.g. `-app-misc/fastfetch` drops a
+default) -- every part is a plain file.  Subtracting an atom not in the
+set warns and does nothing; `-atom` lines in the defaults file itself
+are an error.  Heavy extras (mold, go, cmake, rust, iw, wpa_supplicant)
+stay out of the defaults -- boards opt in via their own list.
+List lines are `atom [keywords]` -- a keyword override (e.g.
+`sys-boot/syslinux **`) lands in `etc/portage/package.accept_keywords/`.
+Portage config files under `defaults/portage/` are overlaid onto the
+sandbox's `etc/portage/` during prepare.
+
 ### Build step execution
 
 ```
diff --git a/boards/blackhole/target-packages.txt b/boards/blackhole/target-packages.txt
deleted file mode 100644
index b9f5fc48..00000000
--- a/boards/blackhole/target-packages.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-# Packages for Blackhole target
-net-misc/openssh
diff --git a/boards/k1/target-packages.txt b/boards/k1/target-packages.txt
deleted file mode 100644
index 2a6a932b..00000000
--- a/boards/k1/target-packages.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-# Packages to cross-install into the target sysroot for the K1 image
-
-# Services enabled by default
-net-misc/openssh
-app-admin/metalog
-net-misc/ntp
-
-# Initramfs / boot
-sys-apps/busybox
diff --git a/boards/k230/target-packages.txt b/boards/k230/target-packages.txt
deleted file mode 100644
index 6219278a..00000000
--- a/boards/k230/target-packages.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-# Packages to cross-install into the target sysroot for K230
-
-net-misc/openssh
-sys-apps/busybox
diff --git a/boards/k3/target-packages.txt b/boards/k3/target-packages.txt
index b970abdf..2c7d07db 100644
--- a/boards/k3/target-packages.txt
+++ b/boards/k3/target-packages.txt
@@ -1,26 +1,14 @@
-# Packages to cross-install into the target sysroot for the K3 image
+# K3 extras on top of defaults/target-packages.txt
 
-# Services
-net-misc/openssh
-app-admin/metalog
-net-misc/ntp
-
-# Initramfs / boot
-sys-apps/busybox
-
-# Dev tools
-app-editors/vim
-dev-vcs/git
+# Dev tools (git is in defaults)
 dev-debug/strace
 dev-debug/gdb
 net-misc/curl
 net-misc/wget
 
 # System tools
-sys-process/htop
 sys-process/lsof
 sys-apps/file
-app-misc/fastfetch
 app-misc/screen
 
 # Build systems
diff --git a/boards/ky-x1/target-packages.txt b/boards/ky-x1/target-packages.txt
deleted file mode 100644
index 5f90432d..00000000
--- a/boards/ky-x1/target-packages.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-# Packages to cross-install into the target sysroot for KY-X1
-
-net-misc/openssh
-app-admin/metalog
-net-misc/ntp
-sys-apps/busybox
diff --git a/boards/odroid-m1/target-packages.txt b/boards/odroid-m1/target-packages.txt
deleted file mode 100644
index d55b4501..00000000
--- a/boards/odroid-m1/target-packages.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-net-misc/openssh
-sys-apps/busybox
diff --git a/boards/odroid-m1s/target-packages.txt b/boards/odroid-m1s/target-packages.txt
deleted file mode 100644
index d55b4501..00000000
--- a/boards/odroid-m1s/target-packages.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-net-misc/openssh
-sys-apps/busybox
diff --git a/boards/odroid-m2/target-packages.txt b/boards/odroid-m2/target-packages.txt
deleted file mode 100644
index d55b4501..00000000
--- a/boards/odroid-m2/target-packages.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-net-misc/openssh
-sys-apps/busybox
diff --git a/boards/pentium-mmx/target-packages.txt b/boards/pentium-mmx/target-packages.txt
index c98692a4..1d28cbb9 100644
--- a/boards/pentium-mmx/target-packages.txt
+++ b/boards/pentium-mmx/target-packages.txt
@@ -1,12 +1,7 @@
-# Packages cross-installed into the i586 target sysroot
+# pentium-mmx extras on top of defaults/target-packages.txt
 
-# Network & remote access (services enabled in BOOT_SERVICES)
-net-misc/openssh
+# Network (service enabled in BOOT_SERVICES)
 net-misc/dhcpcd
 
 # Disk utilities required by the grow-rootfs first-boot service
-sys-block/parted
 sys-fs/e2fsprogs
-
-# Minimal shell utilities
-sys-apps/busybox
diff --git a/crossdev-stages/Cargo.toml b/crossdev-stages/Cargo.toml
index 27cdf3ec..5fe9fc63 100644
--- a/crossdev-stages/Cargo.toml
+++ b/crossdev-stages/Cargo.toml
@@ -23,3 +23,4 @@ chrono       = "0.4"
 num_cpus     = "1"
 libc         = "0.2"
 portage-atom = "0.5.1"
+sokgi        = "0.2"
diff --git a/crossdev-stages/src/cflags.rs b/crossdev-stages/src/cflags.rs
new file mode 100644
index 00000000..7ae4dd09
--- /dev/null
+++ b/crossdev-stages/src/cflags.rs
@@ -0,0 +1,72 @@
+use sokgi::{Dialect, FlagSet};
+
+/// Canonicalize a CFLAGS string and hash it into a short stable id.
+///
+/// Returns `(canonical, hash)`.  The hash is sokgi's frozen 16-hex FNV-1a
+/// digest of the canonical bytes — independent of rustc version, platform
+/// and sokgi release, so it is safe as a persistent content-addressed
+/// store key.
+///
+/// No call sites yet; this is the foundation Phase 3 uses to key the
+/// content-addressed crossdev prefix store and per-(chost, cflags-hash)
+/// binpkg cache.
+#[allow(dead_code)]
+pub fn canonicalize(cflags: &str) -> (String, String) {
+    match FlagSet::parse(cflags, Dialect::C) {
+        Ok((set, _warnings)) => (set.canonical(), set.stable_hash_hex()),
+        // sokgi is permissive (unknown flags warn, not error), so this
+        // branch is rare.  Hash the trimmed input with sokgi's frozen
+        // FNV-1a constants so the fallback keys the same store.
+        Err(_) => {
+            let canonical = cflags.trim().to_string();
+            let hash = fnv1a_hex(canonical.as_bytes());
+            (canonical, hash)
+        }
+    }
+}
+
+/// FNV-1a-64 with sokgi's frozen constants, 16 hex chars — matches
+/// `FlagSet::stable_hash_hex` so both code paths key the same store.  Only
+/// the parse-error fallback needs it, as that path has no `FlagSet` to call
+/// `stable_hash_hex` on.
+fn fnv1a_hex(bytes: &[u8]) -> String {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for &b in bytes {
+        h ^= b as u64;
+        h = h.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    format!("{h:016x}")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reordering_yields_same_hash() {
+        let (_, a) = canonicalize("-O2 -g -march=cortex-a76+crc");
+        let (_, b) = canonicalize("-march=cortex-a76+crc -g -O2");
+        assert_eq!(a, b);
+    }
+
+    #[test]
+    fn different_arch_differs() {
+        let (_, a) = canonicalize("-O2 -march=cortex-a55");
+        let (_, b) = canonicalize("-O2 -march=cortex-a76");
+        assert_ne!(a, b);
+    }
+
+    #[test]
+    fn last_wins_o_level() {
+        let (_, a) = canonicalize("-O3 -O2 -march=cortex-a55");
+        let (_, b) = canonicalize("-O2 -march=cortex-a55");
+        assert_eq!(a, b);
+    }
+
+    #[test]
+    fn hash_is_16_lowercase_hex() {
+        let (_, h) = canonicalize("-O2 -march=rv64gc_zba_zbb");
+        assert_eq!(h.len(), 16);
+        assert!(h.bytes().all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase()));
+    }
+}
diff --git a/crossdev-stages/src/cli/image.rs b/crossdev-stages/src/cli/image.rs
index c2c28850..33ca502f 100644
--- a/crossdev-stages/src/cli/image.rs
+++ b/crossdev-stages/src/cli/image.rs
@@ -8,6 +8,7 @@ pub async fn run(
     ws: &Workspace,
     cmd: ImageCmd,
     boards_root: &Utf8Path,
+    defaults_root: &Utf8Path,
     mirror: Option<&str>,
     dry_run: bool,
 ) -> Result<()> {
@@ -72,6 +73,7 @@ pub async fn run(
                 sandbox.as_deref(),
                 &board_cfg.arch,
                 &board_cfg,
+                defaults_root,
                 mirror,
                 None,
             )
@@ -93,7 +95,15 @@ pub async fn run(
             } else {
                 Some(steps.as_slice())
             };
-            image::build(ws, &sb, &tgt, &board_cfg, boards_root, steps_opt)?;
+            image::build(
+                ws,
+                &sb,
+                &tgt,
+                &board_cfg,
+                boards_root,
+                defaults_root,
+                steps_opt,
+            )?;
         }
         ImageCmd::Prune => {
             let builds = ws.list_builds()?;
diff --git a/crossdev-stages/src/cli/sandbox.rs b/crossdev-stages/src/cli/sandbox.rs
index 86ac35fa..c7fedc46 100644
--- a/crossdev-stages/src/cli/sandbox.rs
+++ b/crossdev-stages/src/cli/sandbox.rs
@@ -7,6 +7,7 @@ pub async fn run(
     ws: &Workspace,
     cmd: SandboxCmd,
     boards_root: &camino::Utf8Path,
+    defaults_root: &camino::Utf8Path,
     mirror: Option<&str>,
 ) -> Result<()> {
     match cmd {
@@ -33,7 +34,7 @@ pub async fn run(
         SandboxCmd::Prepare { name, bare } => {
             let dir = ws.resolve_sandbox(name.as_deref())?;
             let sb = sandbox::Sandbox::open(dir)?;
-            sb.prepare(mirror, bare)?;
+            sb.prepare(mirror, defaults_root, bare)?;
         }
         SandboxCmd::Crossdev {
             arch,
@@ -51,6 +52,7 @@ pub async fn run(
                 name.as_deref(),
                 &arch,
                 &board_cfg,
+                defaults_root,
                 mirror,
                 gcc_version.as_deref(),
             )
diff --git a/crossdev-stages/src/cli/target.rs b/crossdev-stages/src/cli/target.rs
index fd6f54cc..5bc5bde3 100644
--- a/crossdev-stages/src/cli/target.rs
+++ b/crossdev-stages/src/cli/target.rs
@@ -2,7 +2,7 @@ use crate::cli::util::{default_board_config, ensure_crossdev, ensure_target};
 use crate::cli::TargetCmd;
 use crate::error::Result;
 use crate::{container, stage, target, workspace::Workspace};
-use camino::Utf8PathBuf;
+use camino::{Utf8Path, Utf8PathBuf};
 
 pub async fn run(
     ws: &Workspace,
@@ -10,6 +10,7 @@ pub async fn run(
     sandbox: Option<String>,
     target_name: Option<String>,
     cmd: TargetCmd,
+    defaults_root: &Utf8Path,
     mirror: Option<&str>,
 ) -> Result<()> {
     match cmd {
@@ -51,6 +52,7 @@ pub async fn run(
                 sandbox.as_deref(),
                 &resolved_arch,
                 &default_board_config(&resolved_arch),
+                defaults_root,
                 mirror,
                 None,
             )
@@ -62,6 +64,7 @@ pub async fn run(
                 target_name.as_deref(),
                 arch.as_deref(),
                 sandbox.as_deref(),
+                defaults_root,
                 mirror,
             )
             .await?;
@@ -73,6 +76,7 @@ pub async fn run(
                 target_name.as_deref(),
                 arch.as_deref(),
                 sandbox.as_deref(),
+                defaults_root,
                 mirror,
             )
             .await?;
@@ -84,6 +88,7 @@ pub async fn run(
                 target_name.as_deref(),
                 arch.as_deref(),
                 sandbox.as_deref(),
+                defaults_root,
                 mirror,
             )
             .await?;
@@ -96,6 +101,7 @@ pub async fn run(
                 target_name.as_deref(),
                 arch.as_deref(),
                 sandbox.as_deref(),
+                defaults_root,
                 mirror,
             )
             .await?;
diff --git a/crossdev-stages/src/cli/util.rs b/crossdev-stages/src/cli/util.rs
index 169f15ed..85a94240 100644
--- a/crossdev-stages/src/cli/util.rs
+++ b/crossdev-stages/src/cli/util.rs
@@ -1,3 +1,5 @@
+use camino::Utf8Path;
+
 use crate::error::Result;
 use crate::workspace::Workspace;
 use crate::{board, error, sandbox, stage, target};
@@ -9,6 +11,7 @@ pub async fn ensure_crossdev(
     sandbox_name: Option<&str>,
     arch: &str,
     board_cfg: &board::BoardConfig,
+    defaults_root: &Utf8Path,
     mirror: Option<&str>,
     gcc_version: Option<&str>,
 ) -> Result<sandbox::Sandbox> {
@@ -27,7 +30,7 @@ pub async fn ensure_crossdev(
         }
     };
     let sb = sandbox::Sandbox::open(sd)?;
-    sb.prepare(mirror, false)?;
+    sb.prepare(mirror, defaults_root, false)?;
     sb.setup_crossdev(arch, board_cfg, gcc_version)?;
     Ok(sb)
 }
@@ -39,6 +42,7 @@ pub async fn ensure_target(
     target_name: Option<&str>,
     arch_override: Option<&str>,
     sandbox_name: Option<&str>,
+    defaults_root: &Utf8Path,
     mirror: Option<&str>,
 ) -> Result<(target::Target, sandbox::Sandbox)> {
     let (tgt, resolved_arch) = match ws.resolve_target(target_name) {
@@ -67,6 +71,7 @@ pub async fn ensure_target(
         sandbox_name,
         &resolved_arch,
         &default_board_config(&resolved_arch),
+        defaults_root,
         mirror,
         None,
     )
diff --git a/crossdev-stages/src/error.rs b/crossdev-stages/src/error.rs
index 56de69f2..0e7115b5 100644
--- a/crossdev-stages/src/error.rs
+++ b/crossdev-stages/src/error.rs
@@ -26,6 +26,15 @@ pub enum Error {
     #[error("command failed (exit {code}): {reason}")]
     CommandFailed { code: i32, reason: String },
 
+    #[error("required package list not found: {0}")]
+    PackageListNotFound(camino::Utf8PathBuf),
+
+    #[error("subtraction line '-{atom}' not allowed in defaults list {file} (only board lists may subtract)")]
+    SubtractionInDefaults {
+        file: camino::Utf8PathBuf,
+        atom: String,
+    },
+
     #[error("io error: {0}")]
     Io(#[from] std::io::Error),
 }
diff --git a/crossdev-stages/src/image.rs b/crossdev-stages/src/image.rs
index 0f817d78..dd44156e 100644
--- a/crossdev-stages/src/image.rs
+++ b/crossdev-stages/src/image.rs
@@ -133,74 +133,39 @@ fn default_deps(
     target: &Target,
     board: &BoardConfig,
     boards_root: &Utf8Path,
+    defaults_root: &Utf8Path,
 ) -> Result<()> {
-    let sandbox_pkgs = boards_root.join(&board.name).join("sandbox-packages.txt");
-    if sandbox_pkgs.exists() {
+    // Sandbox extras: defaults are already installed during prepare; only the
+    // board's own extras (e.g. grub for pentium-mmx) need emerging here.
+    // merge() with an empty base means a `-atom` line here can only cancel
+    // the board's own extras, never uninstall a prepare-time default.
+    let board_dir = boards_root.join(&board.name);
+    let board_sandbox = crate::package_list::merge(
+        Vec::new(),
+        crate::package_list::read_optional(&board_dir.join("sandbox-packages.txt"))?,
+    );
+    if !board_sandbox.is_empty() {
+        let portage_dir = sandbox.dir.join("etc/portage");
+        crate::package_list::write_accept_keywords(&board_sandbox, &portage_dir)?;
+        // USE overrides from sandbox-packages.use, e.g. "sys-boot/grub grub_platforms_pc"
+        crate::package_list::write_package_use(
+            &board_dir.join("sandbox-packages.use"),
+            &portage_dir,
+        )?;
         let host_runner = board_runner(sandbox, board);
         let portage = Portage::new(&host_runner);
-        let content = std::fs::read_to_string(&sandbox_pkgs)?;
-        let lines: Vec<&str> = content
-            .lines()
-            .map(str::trim)
-            .filter(|l| !l.is_empty() && !l.starts_with('#'))
-            .collect();
-
-        // Write package.accept_keywords entries for packages with keyword overrides.
-        // Format: "atom [keywords]" — e.g. "sys-boot/syslinux **" or "dev-libs/foo ~amd64"
-        let accept_keywords_dir = sandbox.dir.join("etc/portage/package.accept_keywords");
-        std::fs::create_dir_all(&accept_keywords_dir)?;
-        let mut pkgs: Vec<&str> = Vec::new();
-        for line in &lines {
-            let parts: Vec<&str> = line.splitn(2, char::is_whitespace).collect();
-            let atom = parts[0];
-            pkgs.push(atom);
-            if parts.len() > 1 {
-                let keywords = parts[1].trim();
-                let safe_name = atom.replace('/', "_");
-                std::fs::write(
-                    accept_keywords_dir.join(&safe_name),
-                    format!("{atom} {keywords}\n"),
-                )?;
-            }
-        }
-
-        // Write package.use entries from sandbox-packages.use.
-        // Format: "atom use_flags..." — e.g. "sys-boot/syslinux bios -uefi"
-        let sandbox_use = boards_root.join(&board.name).join("sandbox-packages.use");
-        if sandbox_use.exists() {
-            let use_dir = sandbox.dir.join("etc/portage/package.use");
-            std::fs::create_dir_all(&use_dir)?;
-            let use_content = std::fs::read_to_string(&sandbox_use)?;
-            for line in use_content.lines() {
-                let line = line.trim();
-                if line.is_empty() || line.starts_with('#') {
-                    continue;
-                }
-                let parts: Vec<&str> = line.splitn(2, char::is_whitespace).collect();
-                let atom = parts[0];
-                let safe_name = atom.replace('/', "_");
-                std::fs::write(use_dir.join(&safe_name), format!("{line}\n"))?;
-            }
-        }
-
-        if !pkgs.is_empty() {
-            portage.emerge(&pkgs)?;
-        }
+        portage.emerge(&crate::package_list::atoms(&board_sandbox))?;
     }
 
-    let target_pkgs = boards_root.join(&board.name).join("target-packages.txt");
-    if target_pkgs.exists() {
-        let content = std::fs::read_to_string(&target_pkgs)?;
-        let pkgs: Vec<&str> = content
-            .lines()
-            .map(str::trim)
-            .filter(|l| !l.is_empty() && !l.starts_with('#'))
-            .collect();
-        if !pkgs.is_empty() {
-            let target_runner = board_runner(sandbox, board).with_target(&target.dir);
-            let portage = Portage::new(&target_runner);
-            portage.cross_emerge(&board.chost(), &pkgs)?;
-        }
+    // Target packages: defaults UNION board extras MINUS board `-atom` lines.
+    let target_pkgs = crate::package_list::merge(
+        crate::package_list::read_required(&defaults_root.join("target-packages.txt"))?,
+        crate::package_list::read_optional(&board_dir.join("target-packages.txt"))?,
+    );
+    if !target_pkgs.is_empty() {
+        let target_runner = board_runner(sandbox, board).with_target(&target.dir);
+        let portage = Portage::new(&target_runner);
+        portage.cross_emerge(&board.chost(), &crate::package_list::atoms(&target_pkgs))?;
     }
 
     Ok(())
@@ -407,6 +372,7 @@ pub fn build(
     target: &Target,
     board: &BoardConfig,
     boards_root: &Utf8Path,
+    defaults_root: &Utf8Path,
     steps: Option<&[String]>,
 ) -> Result<()> {
     let bld = Build::create(ws, &board.name)?;
@@ -442,7 +408,7 @@ pub fn build(
 
         let result = match *step {
             "deps" => run_step("deps", "deps", &bld, &runner, boards_root, board, |_r| {
-                default_deps(_r, sandbox, target, board, boards_root)
+                default_deps(_r, sandbox, target, board, boards_root, defaults_root)
             }),
             "checkout" => run_step(
                 "checkout",
diff --git a/crossdev-stages/src/main.rs b/crossdev-stages/src/main.rs
index 78ac5247..7e43a11f 100644
--- a/crossdev-stages/src/main.rs
+++ b/crossdev-stages/src/main.rs
@@ -1,9 +1,11 @@
 mod board;
 mod bootloader;
+mod cflags;
 mod cli;
 mod container;
 mod error;
 mod image;
+mod package_list;
 mod portage;
 mod sandbox;
 mod source_cache;
@@ -27,11 +29,12 @@ async fn main() -> anyhow::Result<()> {
     let ws = crate::workspace::Workspace::open()?;
     ws.ensure_dirs()?;
 
-    let boards_root = {
-        let p = std::fs::canonicalize(cli.project_dir.join("boards"))
-            .unwrap_or_else(|_| cli.project_dir.join("boards"));
-        Utf8PathBuf::try_from(p).expect("boards path is not UTF-8")
+    let project_dir = {
+        let p = std::fs::canonicalize(&cli.project_dir).unwrap_or_else(|_| cli.project_dir.clone());
+        Utf8PathBuf::try_from(p).expect("project path is not UTF-8")
     };
+    let boards_root = project_dir.join("boards");
+    let defaults_root = project_dir.join("defaults");
     let mirror = cli.mirror.as_deref();
     let dry_run = cli.dry_run;
 
@@ -40,7 +43,7 @@ async fn main() -> anyhow::Result<()> {
             cli::stages::run(&ws, cmd, mirror).await?;
         }
         Commands::Sandbox(cmd) => {
-            cli::sandbox::run(&ws, cmd, &boards_root, mirror).await?;
+            cli::sandbox::run(&ws, cmd, &boards_root, &defaults_root, mirror).await?;
         }
         Commands::Target {
             arch,
@@ -48,13 +51,13 @@ async fn main() -> anyhow::Result<()> {
             target,
             command,
         } => {
-            cli::target::run(&ws, arch, sandbox, target, command, mirror).await?;
+            cli::target::run(&ws, arch, sandbox, target, command, &defaults_root, mirror).await?;
         }
         Commands::Board(cmd) => {
             cli::board::run(&boards_root, cmd)?;
         }
         Commands::Image(cmd) => {
-            cli::image::run(&ws, cmd, &boards_root, mirror, dry_run).await?;
+            cli::image::run(&ws, cmd, &boards_root, &defaults_root, mirror, dry_run).await?;
         }
         Commands::Maint(cmd) => {
             cli::maint::run(&ws, cmd, &boards_root, dry_run)?;
diff --git a/crossdev-stages/src/package_list.rs b/crossdev-stages/src/package_list.rs
new file mode 100644
index 00000000..1938cc7e
--- /dev/null
+++ b/crossdev-stages/src/package_list.rs
@@ -0,0 +1,199 @@
+//! Read portage atom lists from text files (`#` comments, blank lines skipped).
+//!
+//! Line format: `atom [keywords]` — e.g. `sys-boot/syslinux **` or
+//! `dev-libs/foo ~amd64`. Keyword overrides are written to
+//! `package.accept_keywords/` via [`write_accept_keywords`].
+//!
+//! Board lists may subtract from the defaults with a `-atom` line
+//! (e.g. `-app-editors/vim`); see [`merge`]. Defaults files define the
+//! base set, so `-atom` lines in them are rejected by [`read_required`].
+
+use std::io::ErrorKind;
+
+use camino::Utf8Path;
+
+use crate::error::{Error, Result};
+
+#[derive(Debug)]
+pub struct Entry {
+    pub atom: String,
+    /// Optional ACCEPT_KEYWORDS override from the `atom [keywords]` syntax.
+    pub keywords: Option<String>,
+    /// `-atom` line: remove `atom` from the merged set (board lists only).
+    pub remove: bool,
+}
+
+/// Read a defaults package list. Errors if the file is missing or contains
+/// `-atom` subtraction lines (defaults define the base set; only board
+/// lists may subtract).
+pub fn read_required(path: &Utf8Path) -> Result<Vec<Entry>> {
+    match std::fs::read_to_string(path) {
+        Ok(content) => parse_base(&content, path),
+        Err(e) if e.kind() == ErrorKind::NotFound => Err(Error::PackageListNotFound(path.into())),
+        Err(e) => Err(e.into()),
+    }
+}
+
+fn parse_base(content: &str, path: &Utf8Path) -> Result<Vec<Entry>> {
+    let entries = parse(content);
+    if let Some(e) = entries.iter().find(|e| e.remove) {
+        return Err(Error::SubtractionInDefaults {
+            file: path.into(),
+            atom: e.atom.clone(),
+        });
+    }
+    Ok(entries)
+}
+
+/// Merge board `overlay` entries into the `base` defaults, in order:
+/// additions append, `-atom` entries remove the atom from the set built so
+/// far. Subtracting an atom that is not in the set is a no-op with a
+/// warning (not an error), so a board list survives a default being
+/// dropped from `defaults/`.
+pub fn merge(mut base: Vec<Entry>, overlay: Vec<Entry>) -> Vec<Entry> {
+    for e in overlay {
+        if e.remove {
+            let before = base.len();
+            base.retain(|b| b.atom != e.atom);
+            if base.len() == before {
+                tracing::warn!("package list: -{} removes nothing (not in set)", e.atom);
+            }
+        } else {
+            base.push(e);
+        }
+    }
+    base
+}
+
+/// Read a package list if the file exists, otherwise return an empty list.
+pub fn read_optional(path: &Utf8Path) -> Result<Vec<Entry>> {
+    match std::fs::read_to_string(path) {
+        Ok(content) => Ok(parse(&content)),
+        Err(e) if e.kind() == ErrorKind::NotFound => Ok(Vec::new()),
+        Err(e) => Err(e.into()),
+    }
+}
+
+/// Borrow just the atoms, e.g. for an emerge command line.
+pub fn atoms(entries: &[Entry]) -> Vec<&str> {
+    entries.iter().map(|e| e.atom.as_str()).collect()
+}
+
+/// Write `package.accept_keywords/` entries under `portage_dir` (an
+/// `etc/portage` directory) for atoms with keyword overrides.
+pub fn write_accept_keywords(entries: &[Entry], portage_dir: &Utf8Path) -> Result<()> {
+    let dir = portage_dir.join("package.accept_keywords");
+    for e in entries {
+        if let Some(keywords) = &e.keywords {
+            std::fs::create_dir_all(&dir)?;
+            let safe_name = e.atom.replace('/', "_");
+            std::fs::write(dir.join(safe_name), format!("{} {keywords}\n", e.atom))?;
+        }
+    }
+    Ok(())
+}
+
+/// Copy `atom use_flags...` lines from `path` (if present) into
+/// `portage_dir/package.use/`, one file per atom.
+/// Format: e.g. `sys-boot/grub grub_platforms_pc -grub_platforms_efi-64`.
+pub fn write_package_use(path: &Utf8Path, portage_dir: &Utf8Path) -> Result<()> {
+    let content = match std::fs::read_to_string(path) {
+        Ok(c) => c,
+        Err(e) if e.kind() == ErrorKind::NotFound => return Ok(()),
+        Err(e) => return Err(e.into()),
+    };
+    let dir = portage_dir.join("package.use");
+    for line in content.lines() {
+        let line = line.trim();
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        std::fs::create_dir_all(&dir)?;
+        let atom = line.split_whitespace().next().unwrap_or(line);
+        let safe_name = atom.replace('/', "_");
+        std::fs::write(dir.join(safe_name), format!("{line}\n"))?;
+    }
+    Ok(())
+}
+
+fn parse(content: &str) -> Vec<Entry> {
+    content
+        .lines()
+        .map(str::trim)
+        .filter(|l| !l.is_empty() && !l.starts_with('#'))
+        .map(|line| {
+            let mut parts = line.splitn(2, char::is_whitespace);
+            let atom = parts.next().unwrap_or(line);
+            let (atom, remove) = match atom.strip_prefix('-') {
+                Some(stripped) => (stripped.to_string(), true),
+                None => (atom.to_string(), false),
+            };
+            let keywords = parts
+                .next()
+                .map(|k| k.trim().to_string())
+                .filter(|k| !k.is_empty());
+            Entry {
+                atom,
+                keywords,
+                remove,
+            }
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn atoms_owned(entries: &[Entry]) -> Vec<String> {
+        entries.iter().map(|e| e.atom.clone()).collect()
+    }
+
+    #[test]
+    fn parse_subtraction_line() {
+        let entries = parse("-app-editors/vim\nsys-process/htop\n");
+        assert_eq!(entries[0].atom, "app-editors/vim");
+        assert!(entries[0].remove);
+        assert_eq!(entries[1].atom, "sys-process/htop");
+        assert!(!entries[1].remove);
+    }
+
+    #[test]
+    fn merge_subtracts_default() {
+        let base = parse("app-editors/vim\nsys-process/htop\n");
+        let overlay = parse("-app-editors/vim\nnet-analyzer/nmap\n");
+        let merged = merge(base, overlay);
+        assert_eq!(
+            atoms_owned(&merged),
+            vec!["sys-process/htop", "net-analyzer/nmap"]
+        );
+    }
+
+    #[test]
+    fn merge_subtracting_unlisted_atom_is_noop() {
+        // Documented behavior: warning, not an error — the merged set is
+        // unchanged if the subtracted atom was never in it.
+        let base = parse("app-editors/vim\n");
+        let overlay = parse("-net-misc/curl\n");
+        let merged = merge(base, overlay);
+        assert_eq!(atoms_owned(&merged), vec!["app-editors/vim"]);
+    }
+
+    #[test]
+    fn defaults_reject_subtraction() {
+        let path = Utf8Path::new("defaults/target-packages.txt");
+        let err = parse_base("net-misc/openssh\n-app-editors/vim\n", path).unwrap_err();
+        assert!(matches!(
+            err,
+            Error::SubtractionInDefaults { ref atom, .. } if atom == "app-editors/vim"
+        ));
+    }
+
+    #[test]
+    fn keywords_still_parse() {
+        let entries = parse("sys-boot/syslinux **\n");
+        assert_eq!(entries[0].atom, "sys-boot/syslinux");
+        assert_eq!(entries[0].keywords.as_deref(), Some("**"));
+        assert!(!entries[0].remove);
+    }
+}
diff --git a/crossdev-stages/src/portage.rs b/crossdev-stages/src/portage.rs
index 0f185455..263be584 100644
--- a/crossdev-stages/src/portage.rs
+++ b/crossdev-stages/src/portage.rs
@@ -146,12 +146,6 @@ impl<'a> Portage<'a> {
         Ok(())
     }
 
-    /// Emerge packages from binary packages only (`-G`).
-    pub fn emerge_binary(&self, packages: &[&str]) -> Result<()> {
-        let pkgs = packages.join(" ");
-        self.runner.run(&format!("emerge -G {pkgs}"))
-    }
-
     /// Emerge packages, using binary if available (`-b -k`).
     pub fn emerge(&self, packages: &[&str]) -> Result<()> {
         let pkgs = packages.join(" ");
@@ -202,32 +196,28 @@ pub fn sync_portage_tree(runner: &SandboxRunner) -> Result<()> {
 }
 
 /// Install all host-side dependencies required for cross-compilation.
-pub fn install_host_deps(runner: &SandboxRunner) -> Result<()> {
+///
+/// Reads the package list from `<defaults_root>/sandbox-packages.txt`. Per-board
+/// extras (boards/<board>/sandbox-packages.txt) are emerged separately during
+/// image build via `image::default_deps`. Keyword overrides (`atom [keywords]`
+/// lines) are written to `<portage_dir>/package.accept_keywords/`.
+pub fn install_host_deps(
+    runner: &SandboxRunner,
+    defaults_root: &Utf8Path,
+    portage_dir: &Utf8Path,
+) -> Result<()> {
     sync_portage_tree(runner)?;
     let portage = Portage::new(runner);
 
-    let bin_packages = ["app-arch/zstd", "app-arch/bzip2", "app-arch/xz-utils"];
-    tracing::info!("Installing binary packages…");
-    portage.emerge_binary(&bin_packages)?;
-
-    let packages = [
-        "sys-devel/crossdev",
-        "sys-devel/bc",
-        "sys-apps/merge-usr",
-        "dev-vcs/git",
-        "dev-embedded/u-boot-tools",
-        "sys-apps/dtc",
-        "sys-kernel/dracut",
-        "sys-apps/busybox",
-        "sys-fs/genimage",
-        "sys-fs/dosfstools",
-        "sys-fs/mtools",
-        "app-eselect/eselect-repository",
-        "dev-lang/rust",
-        "dev-python/pyelftools",
-    ];
-    tracing::info!("Installing build dependencies…");
-    portage.emerge(&packages)?;
+    let path = defaults_root.join("sandbox-packages.txt");
+    let packages = crate::package_list::read_required(&path)?;
+    crate::package_list::write_accept_keywords(&packages, portage_dir)?;
+
+    tracing::info!(
+        "Installing host build dependencies ({} packages)…",
+        packages.len()
+    );
+    portage.emerge(&crate::package_list::atoms(&packages))?;
 
     tracing::info!("Installing Rust ldconfig…");
     runner.run("cargo install --root /usr/local ldconfig")?;
diff --git a/crossdev-stages/src/sandbox.rs b/crossdev-stages/src/sandbox.rs
index e9310134..7f252a23 100644
--- a/crossdev-stages/src/sandbox.rs
+++ b/crossdev-stages/src/sandbox.rs
@@ -48,7 +48,7 @@ impl Sandbox {
     /// Idempotent: skips if `.prepared` marker exists (or `.prepared-bare` when `bare`).
     ///
     /// With `bare`, writes `make.conf` and syncs the portage tree but does not emerge packages.
-    pub fn prepare(&self, mirror: Option<&str>, bare: bool) -> Result<()> {
+    pub fn prepare(&self, mirror: Option<&str>, defaults_root: &Utf8Path, bare: bool) -> Result<()> {
         if self.dir.join(".prepared").exists() {
             tracing::info!("Sandbox already prepared, skipping.");
             return Ok(());
@@ -67,13 +67,22 @@ impl Sandbox {
         }
         .write(&self.dir.join("etc/portage"))?;
 
+        // Overlay any user-provided portage config from defaults/portage/
+        // onto the sandbox's /etc/portage/.  Lets boards declare USE flags
+        // (e.g. sys-fs/dosfstools compat) and other portage tweaks as files
+        // rather than hardcoded strings.
+        let portage_src = defaults_root.join("portage");
+        if portage_src.is_dir() {
+            copy_tree(&portage_src, &self.dir.join("etc/portage"))?;
+        }
+
         if bare {
             sync_portage_tree(&self.runner())?;
             std::fs::write(self.dir.join(".prepared-bare"), "")?;
             tracing::info!("Sandbox bare-prepared.");
         } else {
             tracing::info!("Installing host dependencies…");
-            install_host_deps(&self.runner())?;
+            install_host_deps(&self.runner(), defaults_root, &self.dir.join("etc/portage"))?;
             std::fs::write(self.dir.join(".prepared"), "")?;
             let _ = std::fs::remove_file(self.dir.join(".prepared-bare"));
             tracing::info!("Sandbox prepared.");
@@ -355,9 +364,7 @@ impl Sandbox {
         let Some(ref platforms) = board.grub_platforms else {
             return Ok(());
         };
-        let grub_mods = self
-            .dir
-            .join(format!("usr/{chost}/usr/lib/grub/i386-pc"));
+        let grub_mods = self.dir.join(format!("usr/{chost}/usr/lib/grub/i386-pc"));
         if grub_mods.exists() {
             return Ok(());
         }
@@ -368,7 +375,9 @@ impl Sandbox {
             .split_whitespace()
             .map(|p| format!("grub_platforms_{p}"))
             .collect();
-        let use_dir = self.dir.join(format!("usr/{chost}/etc/portage/package.use"));
+        let use_dir = self
+            .dir
+            .join(format!("usr/{chost}/etc/portage/package.use"));
         std::fs::create_dir_all(&use_dir)?;
         std::fs::write(
             use_dir.join("grub"),
@@ -513,3 +522,29 @@ pub struct SandboxInfo {
     pub prepared: bool,
     pub bare_prepared: bool,
 }
+
+/// Recursively copy directory `src` into `dst`, overwriting files.
+/// Symlinks and other special entries are rejected.
+fn copy_tree(src: &Utf8Path, dst: &Utf8Path) -> Result<()> {
+    std::fs::create_dir_all(dst)?;
+    for entry in std::fs::read_dir(src)? {
+        let entry = entry?;
+        let kind = entry.file_type()?;
+        let from = Utf8PathBuf::try_from(entry.path()).map_err(|e| Error::CommandFailed {
+            code: 1,
+            reason: e.to_string(),
+        })?;
+        let to = dst.join(from.file_name().unwrap_or_default());
+        if kind.is_dir() {
+            copy_tree(&from, &to)?;
+        } else if kind.is_file() {
+            std::fs::copy(&from, &to)?;
+        } else {
+            return Err(Error::CommandFailed {
+                code: 1,
+                reason: format!("unsupported entry in portage overlay (symlink?): {from}"),
+            });
+        }
+    }
+    Ok(())
+}
diff --git a/defaults/sandbox-packages.txt b/defaults/sandbox-packages.txt
new file mode 100644
index 00000000..a39ce2b2
--- /dev/null
+++ b/defaults/sandbox-packages.txt
@@ -0,0 +1,32 @@
+# Host build deps installed into every sandbox during prepare.
+# Per-board extras can be added in boards/<board>/sandbox-packages.txt
+# (additive — both lists are emerged).
+
+# Bootstrap: compression tools for portage tree snapshot
+app-arch/zstd
+app-arch/bzip2
+app-arch/xz-utils
+
+# Cross-toolchain + portage utilities
+sys-devel/crossdev
+sys-devel/bc
+sys-apps/merge-usr
+app-eselect/eselect-repository
+
+# Source / VCS
+dev-vcs/git
+
+# Boot / firmware
+dev-embedded/u-boot-tools
+sys-apps/dtc
+sys-kernel/dracut
+sys-apps/busybox
+
+# Image generation
+sys-fs/genimage
+sys-fs/dosfstools
+sys-fs/mtools
+
+# Languages used during build
+dev-lang/rust
+dev-python/pyelftools
diff --git a/defaults/target-packages.txt b/defaults/target-packages.txt
new file mode 100644
index 00000000..06655c99
--- /dev/null
+++ b/defaults/target-packages.txt
@@ -0,0 +1,39 @@
+# Default packages cross-emerged into every image's sysroot.
+# Lifted from cross-stage.sh ADDITIONAL_PACKAGES, trimmed to light
+# essentials.  Per-board extras go in boards/<board>/target-packages.txt;
+# a board can drop a default with a `-atom` line (e.g. `-app-misc/fastfetch`).
+#
+# Deliberately NOT here (boards opt in via their own list):
+# - heavy toolchains: sys-devel/mold, dev-lang/go, dev-build/cmake,
+#   dev-lang/rust
+# - wireless: net-wireless/iw, net-wireless/wpa_supplicant
+# - app-misc/screen: cross-emerge fails at fowners root:utmp (utmp user
+#   missing from the cross-prefix passwd) — do not re-add here
+# - dev-build/meson: PEP517 wheel build is fragile under cross-compilation
+#   (host/target python paths confused) — do not re-add here
+
+# Networking / remote access
+net-misc/openssh
+net-misc/ntp
+
+# Logging
+app-admin/metalog
+
+# Initramfs / minimal userland
+sys-apps/busybox
+
+# Basic interactive tools
+app-editors/vim
+sys-process/htop
+app-misc/fastfetch
+
+# Disk utilities
+sys-block/parted
+
+# Dev / diagnostics
+dev-vcs/git
+net-analyzer/nmap
+
+# Portage helpers (equery, genlop)
+app-portage/gentoolkit
+app-portage/genlop
diff --git a/docs/design.md b/docs/design.md
index 7d5c986b..282970c5 100644
--- a/docs/design.md
+++ b/docs/design.md
@@ -120,7 +120,7 @@ and per-package CFLAGS workarounds.
 Steps run in order (configurable via `BUILD_STEPS` in `board.conf`):
 
 ```
-deps       Install extra sandbox packages + cross-emerge target-packages.txt.
+deps       Cross-emerge defaults + per-board package lists into the target.
 checkout   Clone/update kernel, opensbi, u-boot source via git source cache.
 bootloader Build opensbi and/or u-boot inside the sandbox container.
 kernel     Build Linux kernel + modules; install modules into target stage.
@@ -143,6 +143,37 @@ sibling helpers.
 
 ---
 
+## Package lists
+
+`defaults/` holds package lists applied everywhere:
+
+- `defaults/sandbox-packages.txt` — host build deps emerged during
+  `sandbox prepare` (required).
+- `defaults/target-packages.txt` — packages cross-emerged into every
+  image's sysroot during `deps` (required).
+
+Per-board lists (`boards/<name>/sandbox-packages.txt`, `target-packages.txt`)
+overlay the defaults.  The effective target set is
+`defaults/target-packages.txt` UNION `boards/<name>/target-packages.txt`
+MINUS the board's `-atom` lines (e.g. `-app-misc/fastfetch`) — every part
+is a plain file.  Subtracting an atom not in the merged set warns and does
+nothing; `-atom` lines in a defaults file are rejected with an error, since
+defaults define the base and only boards subtract.  Heavy per-board opt-ins
+(mold, go, cmake, rust, iw, wpa_supplicant) are deliberately not defaults.
+Sandbox defaults are installed at prepare time, so a `-atom` in a board's
+`sandbox-packages.txt` can only cancel the board's own extras.
+
+List lines are `atom [keywords]`: an optional keyword override (e.g.
+`sys-boot/syslinux **`) is written to `etc/portage/package.accept_keywords/`
+before emerging.  A board's `sandbox-packages.use` (`atom use_flags...`
+lines) is written to `etc/portage/package.use/` the same way.
+
+Files under `defaults/portage/` are overlaid onto the sandbox's
+`etc/portage/` during prepare.  Prepare is idempotent (`.prepared`
+marker), so later changes do not reach already-prepared sandboxes.
+
+---
+
 ## Sandboxing approach
 
 hakoniwa creates a user-namespace container (unshares Mount, User, Pid, Ipc,