diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index aa29989..d714f41 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -1,5 +1,6 @@
-# The checks of the Makefile; the QEMU boots, which need KVM and apt packages, and
-# the unit tests on macOS and Windows in jobs of their own.
+# The checks of the Makefile in a job per kind: lint, which reads the source of every system on
+# one host, and the unit tests and the QEMU tests, which run make -k <check> for each system in
+# a matrix entry named after its operating system and architecture.
 name: ci
 
 on:
@@ -17,8 +18,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # The image of test-e2e-qemu too: one image, one migration.
-  lint-and-test:
+  # The Ubuntu release of the other Linux jobs too, ubuntu-26.04-arm on arm64: one release, one migration.
+  lint:
     runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
@@ -26,48 +27,46 @@ jobs:
         with:
           persist-credentials: false
 
-      # gcc's 32-bit libraries, which test-i686 links with.
-      - run: |
-          sudo apt-get update
-          sudo apt-get install --yes gcc-multilib
-
       - run: make setup
 
       # After setup: the key covers installed toolchains.
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
-      # Every check but the boots.
-      - run: make -k lint test test-i686
+      - run: make -k lint
 
-  # The unit tests of the macOS build on both of its targets; lint-and-test lints them.
-  test-macos:
+  # The unit tests of each system on a runner of that system: test runs those of the host's
+  # build, and test-i686 those of the 32-bit glibc build on x86_64 Linux. The Windows build's
+  # firmware calls run against fakes.
+  test:
+    name: test (${{ matrix.system }})
     strategy:
       fail-fast: false
       matrix:
-        runner: [macos-latest, macos-15-intel]
+        include:
+          - system: linux-x86_64
+            runner: ubuntu-26.04
+            check: test
+          - system: linux-i686
+            runner: ubuntu-26.04
+            check: test-i686
+          - system: linux-aarch64
+            runner: ubuntu-26.04-arm
+            check: test
+          - system: macos-aarch64
+            runner: macos-26
+            check: test
+          - system: macos-x86_64
+            runner: macos-15-intel
+            check: test
+          - system: windows-x86_64
+            runner: windows-2025
+            check: test
+          - system: windows-aarch64
+            runner: windows-11-arm
+            check: test
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      # GNU make 4 as gmake: Apple's make 3.81 ignores the Makefile's .SHELLFLAGS (3.82).
-      - run: brew install make
-
-      - run: gmake setup
-
-      # After setup: the key covers installed toolchains.
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-
-      - run: gmake -k test
-
-  # The unit tests of the Windows build on x86_64, whose firmware calls run against
-  # fakes; lint-and-test lints both of its targets.
-  test-windows:
-    runs-on: windows-2025
-    timeout-minutes: 60
-    # Git for Windows' bash, which the Makefile's recipes and scripts need.
+    # Git for Windows' bash on Windows, which the Makefile's recipes and scripts need.
     defaults:
       run:
         shell: bash
@@ -76,19 +75,56 @@ jobs:
         with:
           persist-credentials: false
 
+      # gcc's 32-bit libraries, which test-i686 links with.
+      - if: matrix.check == 'test-i686'
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes gcc-multilib
+
+      # GNU make 4, ahead of Apple's make 3.81 on PATH, which ignores the Makefile's
+      # .SHELLFLAGS (3.82).
+      - if: runner.os == 'macOS'
+        run: |
+          brew install make
+          echo "$(brew --prefix make)/libexec/gnubin" >>"$GITHUB_PATH"
+
       # GNU make, which the image lacks.
-      - run: choco install make --yes --no-progress
+      - if: runner.os == 'Windows'
+        run: choco install make --yes --no-progress
 
       - run: make setup
 
-      # After setup: the key covers installed toolchains.
+      # After setup: the key covers installed toolchains. The system tells apart the entries
+      # of one runner image.
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: ${{ matrix.system }}
 
-      - run: make -k test
+      - run: make -k "$CHECK"
+        env:
+          CHECK: ${{ matrix.check }}
 
+  # Each system that the QEMU tests boot, Linux or the UEFI Shell, on each architecture.
   # QEMU 9.0 and newer fault unaligned loads from Device memory as arm64 does, which the
   # aarch64 guests check; Ubuntu 24.04 has QEMU 8.2.
   test-e2e-qemu:
+    name: test-e2e-qemu (${{ matrix.system }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - system: linux-x86_64
+            check: test-e2e-qemu-x86_64
+          - system: linux-i686
+            check: test-e2e-qemu-i686
+          - system: linux-aarch64
+            check: test-e2e-qemu-aarch64
+          - system: uefi-shell-x86_64
+            check: test-e2e-qemu-shell-x86_64
+          - system: uefi-shell-i686
+            check: test-e2e-qemu-shell-i686
+          - system: uefi-shell-aarch64
+            check: test-e2e-qemu-shell-aarch64
     runs-on: ubuntu-26.04
     timeout-minutes: 120
     steps:
@@ -109,27 +145,31 @@ jobs:
           sudo udevadm trigger --name-match=kvm
 
       # No rust-cache: its cleanup takes run.sh's initramfs/tests for a cargo
-      # profile and logs errors; the builds take about a minute without it.
+      # profile and logs errors; the builds take about 2.5 minutes without it.
       - run: make setup
 
-      # The guests' packages, each architecture's DriverSample.efi and Secure Boot firmware,
-      # keyed also on the apt packages, the pinned iasl and the runner image (this file) that
-      # build them. Saved only on success, as run.sh reuses DriverSample.efi and the firmware
-      # unchecked.
+      # The system's guest packages, DriverSample.efi and Secure Boot firmware, keyed also on
+      # the apt packages, the pinned iasl and the runner image (this file) that build them. Per
+      # system, not per architecture: the Linux scenarios also boot the guests of
+      # guest-packages-<arch>-unfixed*, which a key that the UEFI Shell entry saved first would
+      # lack until the key changes. Saved only on success, as run.sh reuses DriverSample.efi and
+      # the firmware unchecked.
       - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             target/qemu-test/packages
             target/qemu-test/*/driver-sample
             target/qemu-test/*/secboot-firmware
-          key: qemu-inputs-${{ hashFiles('tests/qemu/guest-packages-*', 'tests/qemu/build-driver-sample.sh', 'tests/qemu/build-secboot-firmware.sh', 'tests/qemu/host-packages', 'tests/qemu/ubuntu-packages', '.github/workflows/checks.yml') }}
+          key: qemu-inputs-${{ matrix.system }}-${{ hashFiles('tests/qemu/guest-packages-*', 'tests/qemu/build-driver-sample.sh', 'tests/qemu/build-secboot-firmware.sh', 'tests/qemu/host-packages', 'tests/qemu/ubuntu-packages', '.github/workflows/checks.yml') }}
 
-      - run: make -k test-e2e-qemu
+      - run: make -k "$CHECK"
+        env:
+          CHECK: ${{ matrix.check }}
 
       - if: failure()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: qemu-test-logs
+          name: qemu-test-logs-${{ matrix.system }}
           path: |
             target/qemu-test/*/*/*/*.log
             target/qemu-test/*/*/executables
diff --git a/Cargo.lock b/Cargo.lock
index 9593168..bb0d7f3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1295,6 +1295,7 @@ dependencies = [
  "bitflags 2.4.1",
  "clap",
  "cms",
+ "crc32fast",
  "der",
  "env_logger",
  "fbthrift-git",
diff --git a/Cargo.toml b/Cargo.toml
index 706b9f9..410a13f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,6 +44,13 @@ der = { version = "0.7", features = ["alloc", "pem", "std"] }
 rand_core = { version = "0.6", default-features = false }
 # The RNG of RSA blinding on every target, seeded once from the platform's source.
 rand_chacha = { version = "0.3", default-features = false }
+# BootOptionCrc, the CRC-32 of the Boot#### variable that a Key#### hot key starts, and the
+# CRC32s of the GPT on which the Linux and Windows builds find the ESP.
+crc32fast = "1.5.2"
+
+# The Linux and Windows builds stage a set for the next boot under a random nonce.
+[target.'cfg(any(target_os = "linux", target_os = "windows"))'.dependencies]
+rand = { version = "0.8", features = ["small_rng"] }
 
 # Only the Linux build uses these: efivarfs, the HiiDB in sysfs, iLO through
 # ilorest_chif.so, and the CLI's logging.
@@ -52,7 +59,6 @@ libc = "0.2"
 nix = { version = "0.27", features = ["fs", "ioctl", "mount"] }
 libloading = "0.8"
 httparse = "1.8"
-rand = { version = "0.8", features = ["small_rng"] }
 proc-mounts = "0.3"
 env_logger = "0.10"
 
diff --git a/Makefile b/Makefile
index c1d8704..60a4f7d 100644
--- a/Makefile
+++ b/Makefile
@@ -10,9 +10,9 @@
 #
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-# The checks of uefisettings. They need GNU make and bash, rustup while
-# RUST_TOOLCHAIN is set, as it is by default, for test-i686 an x86 host with
-# gcc's 32-bit libraries, which README.md names, and for test-e2e-qemu an
+# The checks of uefisettings. They need GNU make 3.82 or newer and bash, rustup
+# while RUST_TOOLCHAIN is set, as it is by default, for test-i686 an x86 host
+# with gcc's 32-bit libraries, which README.md names, and for test-e2e-qemu an
 # x86_64 host with /dev/kvm and what tests/qemu/README.md lists:
 #   make                 every check of CHECKS, stopping at the first that fails
 #   make -k              every check of CHECKS, even after one fails
@@ -39,6 +39,10 @@
 
 SHELL := bash
 .SHELLFLAGS := -euo pipefail -c
+# GNU make 3.81, macOS's make, ignores .SHELLFLAGS, which came with .ONESHELL in 3.82.
+ifeq ($(filter oneshell,$(.FEATURES)),)
+$(error GNU make 3.82 or newer runs the checks, e.g. Homebrew's gmake on macOS)
+endif
 
 # The Rust release that the checks run on: newer releases bring lints that the
 # code does not satisfy yet. make setup installs it; while RUST_TOOLCHAIN is set,
@@ -65,15 +69,16 @@ unexport CARGO_ENCODED_RUSTFLAGS
 TARGETS := x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,i686-unknown-linux-gnu,x86_64-unknown-linux-musl,x86_64-unknown-uefi,i686-unknown-linux-musl,i686-unknown-uefi,aarch64-unknown-linux-musl,aarch64-unknown-uefi,x86_64-apple-darwin,aarch64-apple-darwin,x86_64-pc-windows-msvc,aarch64-pc-windows-msvc
 comma := ,
 
-# CI runs lint test test-i686 and test-e2e-qemu, and test on macOS and Windows: a
-# new check joins LINTS or QEMU_TESTS or CI runs it too.
-LINTS := fmt clippy-x86_64 clippy-aarch64 clippy-i686 clippy-uefi clippy-macos clippy-windows doc
+# CI runs LINTS as one check, lint: a new check joins LINTS, or ci-jobs fails until the workflow names it.
+LINTS := fmt clippy-x86_64 clippy-aarch64 clippy-i686 clippy-uefi clippy-macos clippy-windows doc ci-jobs
 QEMU_LINUX_TESTS := test-e2e-qemu-x86_64 test-e2e-qemu-i686 test-e2e-qemu-aarch64
 QEMU_SHELL_TESTS := test-e2e-qemu-shell-x86_64 test-e2e-qemu-shell-i686 test-e2e-qemu-shell-aarch64
 QEMU_TESTS := $(QEMU_LINUX_TESTS) $(QEMU_SHELL_TESTS)
 # The scenarios of tests/qemu/scenarios.tsv: those named shell-* boot the UEFI Shell.
 SCENARIOS := $(shell awk -F '\t' '$$1 ~ /^[a-z]/ { print $$1 }' tests/qemu/scenarios.tsv)
 CHECKS := $(LINTS) test test-i686 test-e2e-qemu
+# The checks that CI runs as make -k <check>, each in a job or job entry of its own.
+CI_CHECKS := lint $(filter-out $(LINTS) test-e2e-qemu,$(CHECKS)) $(QEMU_TESTS)
 
 .PHONY: check lint help setup toolchain $(CHECKS) $(QEMU_TESTS)
 
@@ -135,6 +140,11 @@ clippy-windows: toolchain
 	cargo clippy --locked -p uefisettings --lib --bins --all-targets --target x86_64-pc-windows-msvc \
 		--target aarch64-pc-windows-msvc -- -D warnings
 
+# The workflow names every check of CI_CHECKS and no other, as scripts/check-ci-jobs.sh reads
+# it; which systems run a check is the workflow's alone. Needs no toolchain.
+ci-jobs:
+	scripts/check-ci-jobs.sh .github/workflows/checks.yml $(CI_CHECKS)
+
 test: toolchain
 	scripts/assert-tests-ran.sh cargo test --locked
 
diff --git a/README.md b/README.md
index d2d5ed2..cf4a507 100644
--- a/README.md
+++ b/README.md
@@ -113,8 +113,16 @@ write no variable of a HiiDB with one, nor do `hii list-questions` and `hii show
 its Config Keyword Handler takes, counts as one outside any FormSet, also for the password questions
 of FormSets of its VarStoreId. IFR after an op that does not fit its form
 package has no op boundary, so they read and write no variable of such a HiiDB, nor do
-`hii list-questions` and `hii show-ifr` but with `--no-efivars`. A password question whose VarStore
-uefisettings cannot find withholds no bytes, which they warn of. A password question that edk2 may
+`hii list-questions` and `hii show-ifr` but with `--no-efivars`. A password question of a VarStoreId
+that no VarStore of its form package that decodes declares names no VarStore (UEFI 2.11
+§33.3.8.2.2 asks for "a previously declared variable store"), and edk2's Forms Browser finds none
+for it but a VarStore op of its FormSet, outside an unknown opcode's scope, that does not decode,
+whose fields it reads past the op's end, so they read and write no variable of a HiiDB with one,
+nor do `hii list-questions` and
+`hii show-ifr` but with `--no-efivars`; one whose FormSet declares no VarStore of its VarStoreId,
+which another VarStore of its form package declares, keeps its password at its offset in the first
+of those, which edk2's Config Keyword Handler takes, where `get` withholds it, and they warn of it.
+A password question that edk2 may
 route to a VARSTORE_NAME_VALUE, whose values its driver exposes, as UEFI 2.11 §33.2.5.6 says,
 through EFI_HII_CONFIG_ACCESS_PROTOCOL, in storage of its own choosing, may keep its password in any
 variable, so they read and write no variable of a HiiDB with one, as for IFR without an op boundary,
@@ -132,18 +140,30 @@ writes no variable of a HiiDB with such a password question or with IFR that it
 
 ```plain
 Commands:
-  get           Show the attributes and the decoded value of a global variable of UEFI 2.11 section
-                3.3, but its load options, hot keys and device paths, or of a signature database, or
-                that it is absent
-  help          Print this message or the help of the given subcommand(s)
-  info          Show the attributes and the size of an EFI variable, never its data
-  list          List the name and vendor GUID of every EFI variable, never its data
-  set           Set a global variable of UEFI 2.11 section 3.3 that the OS may write: Timeout,
-                BootOrder, DriverOrder, SysPrepOrder, BootNext, PlatformLang or OsIndications
-  storage       Show the storage space of the EFI variables of some attributes, and how much of it
-                is left
-  write-signed  Write an EFI variable from a signed payload, or from new data that a key signs; the
-                firmware verifies the signature
+  create-key          Create a Key#### that does not exist: a hot key that starts a Boot####
+  create-load-option  Create a Boot####, Driver#### or SysPrep#### that does not exist, from device
+                      paths as text or files of their bytes
+  get                 Show the attributes and the decoded value of a global variable of UEFI 2.11
+                      section 3.3, its load options, hot keys and device paths as text among them,
+                      or of a signature database, or that it is absent
+  help                Print this message or the help of the given subcommand(s)
+  info                Show the attributes and the size of an EFI variable, and the
+                      EFI_VARIABLE_AUTHENTICATION_3 metadata of one with
+                      enhanced-authenticated-access, never its data
+  list                List the name and vendor GUID of every EFI variable, never its data
+  set                 Set a global variable of UEFI 2.11 section 3.3 that the OS may write: Timeout,
+                      BootOrder, DriverOrder, SysPrepOrder, BootNext, PlatformLang or OsIndications;
+                      or, in the UEFI Shell, AuditMode and DeployedMode with
+                      --i-am-fine-to-brick-this-system
+  set-attributes      Set and clear the flags and set the category of a Boot####, Driver#### or
+                      SysPrep####, keeping its other bits and bytes, and the Key#### of a Boot####
+                      following it
+  set-device-path     Set ConIn, ConOut or ErrOut to a device path, as text or a file of its bytes,
+                      keeping its attributes
+  storage             Show the storage space of the EFI variables of some attributes, and how much
+                      of it is left
+  write-signed        Write an EFI variable from a signed payload, or from new data that a key
+                      signs; the firmware verifies the signature
 ```
 
 `capsule`:
@@ -180,8 +200,9 @@ Commands:
 and the `hii` commands but `extract-db` and `dump-efivars` in the UEFI Shell, before an OS boots;
 it also reaches boot-service-only variables and the Time Services, which date and time questions
 of EFI Date/Time Storage read and write, and has no `-f` or `--efivars`. It reads the HiiDB
-through the HII Database Protocol, and accepts `--hii-source` and `--efivar-memory` only to ignore
-them.
+through the HII Database Protocol, and refuses `--hii-source` and `--efivar-memory` as unexpected
+arguments. Its `apply-staged` applies a set that `set` staged from Linux or Windows for the next
+boot: see the [appendix](#appendix).
 
 ```sh
 rustup target add x86_64-unknown-uefi  # or i686-unknown-uefi, aarch64-unknown-uefi
@@ -192,8 +213,8 @@ cargo build --release --target x86_64-unknown-uefi
 FS0:\> uefisettings.efi hii get --json "Activate this check box"
 ```
 
-Exit statuses, setup passwords, `variable`, capsules and Secure Boot: see the
-[appendix](#appendix).
+Exit statuses, setup passwords, `variable`, capsules, Secure Boot and sets staged for the next
+boot: see the [appendix](#appendix).
 
 ---
 
@@ -207,12 +228,13 @@ be assigned to the process token; running elevated alone does not guarantee it.
 Pass `--no-efivars` to read no variables. No driver is shipped with this repository,
 and none has been tested here. Without a driver, `-f` still reads a HiiDB file, and,
 when such a driver is installed, `hii extract-db` writes its HiiDB to a file. `--hii-source` and
-`--efivar-memory` are accepted and ignored.
+`--efivar-memory` are refused as unexpected arguments.
 `variable list` and `variable storage` fail there: the firmware environment calls reach a
 variable by its name only, and have no QueryVariableInfo(). So does `capsule deliver`: those calls
 reach EFI variables only. `capsule config-data` and `capsule result-table` fail too:
 `uefisettings` reads the configuration tables of the EFI System Table only in the UEFI Shell, and on
-Linux on x86, x86_64 and aarch64.
+Linux on x86, x86_64 and aarch64. As on Linux, `set` stages a question whose value only its driver
+holds for the next boot, through the ESP's volume: see the [appendix](#appendix).
 
 ---
 
@@ -223,8 +245,8 @@ and writes nothing: `hii get`, `hii list-questions` and `hii show-ifr` read ques
 an efivars dump that `hii dump-efivars` wrote on Linux (`--efivars DIR`, with its HiiDB unless
 `-f` names one) or from none (`--no-efivars`, with `-f`), and `hii list-strings` reads the HiiDB
 file of `-f`. It has no `get`, `set`, `identify`, `ilo`, `variable`, `capsule`, `hii set`,
-`hii extract-db` or `hii dump-efivars`; it accepts `--hii-source` and `--efivar-memory` and ignores
-them. Dumps: see the [appendix](#appendix).
+`hii extract-db` or `hii dump-efivars`; it refuses `--hii-source` and `--efivar-memory` as
+unexpected arguments. Dumps: see the [appendix](#appendix).
 
 ---
 
@@ -251,6 +273,7 @@ otherwise.
 | Operation | Commands | Build | Consequence |
 |---|---|---|---|
 | A write in a HiiDB that declares a setup password question | `set`, `hii set`, `hii keyword set` | UEFI Shell | No password is asked or checked, as the UEFI Shell runs no setup browser |
+| A set staged for the next boot in a HiiDB that declares a setup password question | `set`, `hii set`, which record the flag for `apply-staged` | Linux, Windows | The next boot applies it before the OS, where no setup browser asks for or checks the password |
 | A write of a question that `EFI_IFR_FLAG_READ_ONLY` makes read-only | `set`, `hii set` | Linux, UEFI Shell, Windows | A value changes that the firmware declares read-only; the Keyword Handler refuses it as "a violation of system policy" (UEFI 2.11 §35.3.2) |
 | A signed write of a Secure Boot policy variable (PK, KEK, OsRecoveryOrder, OsRecovery####, any variable of EFI_IMAGE_SECURITY_DATABASE_GUID) while SetupMode is 1, cannot be read or holds other than a UINT8 of 0 or 1 | `variable write-signed` | Linux, UEFI Shell, Windows | The firmware writes it without checking the signature (UEFI 2.11 §3.3, §32.3) |
 | A signed write of a device signature database (any variable of EFI_DEVICE_SECURITY_DATABASE_GUID) while SetupMode is 1, cannot be read or holds other than a UINT8 of 0 or 1 | `variable write-signed` | Linux, UEFI Shell, Windows | The firmware may write it without checking the signature (UEFI 2.11 §32.6.3) |
@@ -262,6 +285,16 @@ otherwise.
 which UEFI 2.11 has check it against a schema and answer per capsule (§8.5.6.1.3), unlike
 SetVariable(), which stores bytes with "no read, write, or delete security protection" (§8.2.3).
 
+The boot manager's writes take no flag either: `variable set` of its variables and `variable
+set-attributes`, `create-load-option`, `set-device-path` and `create-key` write variables of UEFI
+2.11 Table 3.1 that the OS writes, and another write or a deletion undoes each (§8.2.3); each
+`warning:` line they print names what the boot manager may ignore, not a harm to the machine.
+
+`get` of a question whose value only its driver keeps takes no flag either: it restores any store
+that its RETRIEVE Callback() changed, which undoes only the driver's own change, and its
+ExtractConfig() reads of the FormSet's Buffer and Name/Value stores reach the driver without the
+flag too (see the UEFI Shell details).
+
 ---
 
 ## Changing UEFI settings with automation
@@ -286,12 +319,12 @@ But this tool is an unified opensource approach to manipulate UEFI settings on a
   * `systab`, on x86, x86_64 and aarch64: read the HII database export that the firmware lists as the EFI configuration table of `EFI_HII_DATABASE_PROTOCOL_GUID` (UEFI 2.11 §33.2.11.1), as EDK2 does where `PcdHiiOsRuntimeSupport` is TRUE, from `/dev/mem`, as `capsule config-data` reads its table: the package lists from the buffer's start up to a package list header of zeros, which EDK2 leaves after them, refusing fewer zero bytes than a header before other bytes, which EDK2's export into its old buffer can leave, or up to the end of the buffer's EFI runtime region, each whole inside that region and ending with an EFI_HII_PACKAGE_END package exactly at its PackageLength (UEFI 2.11 §33.3.1.1), which the other ways do not require, at most 16 MiB in all. It takes the table's address as physical first, then as virtual. It does not support Xen: on aarch64, where `/chosen` has no `linux,uefi-system-table` and `/hypervisor/uefi` holds Xen's `xen,uefi-system-table`, it fails. On x86 it reads only where Linux exports /sys/firmware/efi/runtime-map (CONFIG_EFI_RUNTIME_MAP, which CONFIG_EFI selects with CONFIG_KEXEC_CORE: Linux v6.11 arch/x86/Kconfig:2001, :2054), which bounds its reads.
     The configuration that the firmware exports with HII ExportConfig() and lists as the EFI configuration table of `EFI_HII_CONFIG_ROUTING_PROTOCOL_GUID` (UEFI 2.11 §33.2.11.1) is read the same way: its text up to its first NUL CHAR16, inside the buffer's EFI runtime region.
 
-  `auto` moves on while a way finds its source absent (no vendor ACPI table file, no `HiiDB` variable, no EFI System Table that Linux locates, as on a BIOS boot or an aarch64 boot without UEFI, or no such configuration table) or fails otherwise, such as a table that fails its checks or a missing memory map, and stops at a refusal: kernel lockdown, the kernel refusing `/dev/mem` or `/proc/kcore` (no `CAP_SYS_RAWIO`, `CONFIG_STRICT_DEVMEM`), a file that the user may not read, or an unsafe operation without `--i-am-fine-to-brick-this-system`. Its error names each way that it tried, in order, with why, absent apart from refused; with `RUST_LOG=warn`, `uefisettings` logs each way that failed before the one that gave the HiiDB, and with `RUST_LOG=debug` also that way. A named way is the only one tried. `identify` checks the same ways for the HII backend: it finds none where each way finds its source absent, and assumes it, with a warning that `RUST_LOG=warn` shows, where a way's check fails or is refused, such as under kernel lockdown or without `CAP_SYS_RAWIO`. `--hii-source` and `--efivar-memory` may also follow the command; the UEFI Shell, Windows and macOS builds accept both and ignore them.
+  `auto` moves on while a way finds its source absent (no vendor ACPI table file, no `HiiDB` variable, no EFI System Table that Linux locates, as on a BIOS boot or an aarch64 boot without UEFI, or no such configuration table) or fails otherwise, such as a table that fails its checks or a missing memory map, and stops at a refusal: kernel lockdown, the kernel refusing `/dev/mem` or `/proc/kcore` (no `CAP_SYS_RAWIO`, `CONFIG_STRICT_DEVMEM`), a file that the user may not read, or an unsafe operation without `--i-am-fine-to-brick-this-system`. Its error names each way that it tried, in order, with why, absent apart from refused; with `RUST_LOG=warn`, `uefisettings` logs each way that failed before the one that gave the HiiDB, and with `RUST_LOG=debug` also that way. A named way is the only one tried. `identify` checks the same ways for the HII backend: it finds none where each way finds its source absent, and assumes it, with a warning that `RUST_LOG=warn` shows, where a way's check fails or is refused, such as under kernel lockdown or without `CAP_SYS_RAWIO`. `--hii-source` and `--efivar-memory` may also follow the command; the UEFI Shell, Windows and macOS builds refuse both as unexpected arguments. Linux refuses either where it reads no HiiDB of this machine: in `show-translations`, `variable`, `capsule` and `ilo`, in `get` and `set` where they take the Ilo backend, and where `-f` or the efivars dump of `--efivars` gives the HiiDB; and it refuses `--efivar-memory` in `identify`, whose efivar method only checks that the `HiiDB` variable exists, and with `--hii-source acpi` or `systab`, which never read that memory.
 * Library (`hii`) in Rust partially implements the UEFI Hii specification.
 * It parses the HiiDB op-codes into a DOM tree like representation which can be read by machines and humans.
 * It can ask questions about UEFI settings from HiiDB and get their answers.
 * The texts of a HiiDB and of EFI variables, such as prompts, helps and option texts, can hold characters that a terminal takes as commands, as a reordering of the text after them or as line breaks. The text output shows each control character (Unicode Cc), Bidi_Control character, U+2028 and U+2029 escaped as Rust's `char::escape_debug` spells it, such as `\u{1b}`, `\r` and `\u{202e}`, and `\` as `\\`, so that no text shows as another's escape; `hii show-ifr` shows a text's own line break as `\n` inside its line. A console that shows a character as another, such as edk2's VT100 terminal showing U+2510 as `\`, can still make a text look like an escape. `--json` keeps each text exact, and spells U+007F to U+009F, Bidi_Control characters, U+2028 and U+2029 as JSON `\u` escapes, which JSON parsers read back as those characters. `set` and `hii set` match VALUE and `--item` against the raw texts only, whether a prompt, a QuestionId or a keyword selects the question: a shown text that holds an escape matches only an option whose raw text is that text. The UEFI Shell build also escapes each character that `EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL.TestString()` of the console it prints to refuses, as `\u{10d}` in text and as a JSON escape in a JSON string, as edk2's VT100 and PC-ANSI terminals would write such a character's low byte, such as CR for U+010D; it fails rather than print where that call fails. Every build escapes U+FFF0 and U+FFF1, which edk2's GraphicsConsole takes as a lasting change of the width of the characters after them, as `\u{fff0}` and `\u{fff1}` in text and as JSON escapes.
-* `get`, `set` and `hii list-questions` evaluate the `suppressif`, `grayoutif` and `disableif` conditions of questions as EDK2's setup browser does, and select only questions that none of them suppresses, grays out or disables, unless `--include` names that state (`grayed-out`, `suppressed`, `disabled`); an answer ends with the state of a question that is not selectable. Where a condition cannot be evaluated from Linux, `set` refuses the question, while `get` and `hii list-questions` show it with the states it may be in and why. A one-of option in a `suppressif` counts as suppressed, and a question that a `locked` (`EFI_IFR_LOCKED`) locks as grayed out. UEFI 2.11 §33.3.8.3.37 addresses LOCKED to Forms Editors; uefisettings follows edk2-stable202608 SetupBrowserDxe, which grays out a locked statement and every statement of a locked form (Presentation.c InitializeDisplayStatement, IfrParse.c ParseOpCodes).
+* `get`, `set` and `hii list-questions` evaluate the `suppressif`, `grayoutif` and `disableif` conditions of questions as EDK2's setup browser does, and select only questions that none of them suppresses, grays out or disables, unless `--include` names that state (`grayed-out`, `suppressed`, `disabled`); an answer ends with the state of a question that is not selectable. A form under a `disableif` outside forms whose condition is true holds no question, as UEFI 2.11 §33.3.8.3.14 has a Forms Processor not process it, evaluated once at its initialization (§33.2.5.2.1), and edk2-stable202608 SetupBrowserDxe does not parse it: no `--include` selects its questions; only `--keyword` finds them, as edk2's keyword handler does, and a condition that refers to one finds no such question, which edk2 evaluates as UNDEFINED. Where the `disableif`'s condition relies on more than constants (§33.3.8.3.14), or a true or non-constant `suppressif` or `grayoutif`, or another op whose expression edk2 evaluates there, such as a `value`, comes before the form in its scope with no `disableif` ending between them, which edk2 takes for the `disableif`'s, the questions of the form may be disabled. Where a condition cannot be evaluated from Linux, `set` refuses the question, while `get` and `hii list-questions` show it with the states it may be in and why. A one-of option in a `suppressif` counts as suppressed, and a question that a `locked` (`EFI_IFR_LOCKED`) locks as grayed out. UEFI 2.11 §33.3.8.3.37 addresses LOCKED to Forms Editors; uefisettings follows edk2-stable202608 SetupBrowserDxe, which grays out a locked statement and every statement of a locked form (Presentation.c InitializeDisplayStatement, IfrParse.c ParseOpCodes).
 * `set` refuses a question that `EFI_IFR_FLAG_READ_ONLY` makes read-only (UEFI 2.11 §33.3.8.2.2), as EDK2's keyword handler does, unless `--i-am-fine-to-brick-this-system` is given (see [Unsafe operations](#unsafe-operations)), and always one that an `EFI_IFR_VALUE` makes read-only (§33.3.8.3.88), before it writes any question; the refusal names the states to include to select a question of the same text that `set` writes, if any: a writable one, and, with that flag, one that `EFI_IFR_FLAG_READ_ONLY` makes read-only. Of questions with the same text, `get` and `set` pick a writable one first among matches equally certain to be selected. `get`, `hii get` and `hii list-questions` show read-only questions.
 * Where efivarfs lacks the variable of a question, as the firmware has not created it or gives it no runtime access, `get`, `hii list-questions` and `hii show-ifr` take its value from the current configuration that edk2 firmware exports with `ExportConfig()` at ReadyToBoot when built with `PcdHiiOsRuntimeSupport`, its default (UEFI 2.11 §33.2.11.1); so do the questions of name/value storage, which no EFI variable holds. uefisettings reads that snapshot on x86, x86_64 and arm64 from `/dev/mem`, as it reads the HiiDB that the configuration table lists. A value from it ends with ` <snapshot>`, as does the option of a ONE_OF that such a value in the EFI_IFR_VALUE of an option of Type OTHER decides, and so does the state that a condition decides from such a value, even selectable (` <selectable> <snapshot>`); `get` refuses a question that such a state excludes, naming the snapshot. `set` never reads the snapshot: it refuses those questions as without it. No snapshot is read with `--efivars` or `--no-efivars`, where the firmware lists none, or where `/dev/mem` cannot be read (without root, or under a kernel lockdown). The bytes of PASSWORD questions are dropped from it, so a question over them shows withheld, and a PASSWORD question whose VarStore is unknown, or IFR that uefisettings ignores, which may hold one, keeps the whole snapshot off, as uefisettings could not withhold the bytes of that password.
 * Each question that `get`, `set` and `hii list-questions` print lists the Flags of its question header that are set (UEFI 2.11 §33.3.8.2.2), such as `READ_ONLY` and `RESET_REQUIRED`, in `flags`. A question of a FormSet whose ClassGuids hold `EFI_HII_REST_STYLE_FORMSET_GUID` lists `REST_STYLE`, which its Flags can then omit.
@@ -305,7 +338,7 @@ But this tool is an unified opensource approach to manipulate UEFI settings on a
 * A date or time question whose UEFI Storage is the system time or the wake-up time, its EFI Date/Time Storage (UEFI 2.11 §33.2.5.6), keeps its value there, in addition to its VarStore, if any. In the UEFI Shell, `get` shows the fields of GetTime()'s or GetWakeupTime()'s time, or the status of the service that fails, and `set` reads that time first, changes the question's fields, keeps the others, the TimeZone and Daylight too, and writes it back with SetTime() or SetWakeupTime(TRUE, …), then writes the question's VarStore, if any; where that write fails, the error names the time written. `set` of a wake-up time thus arms the alarm, which "causes the system to wake up or power on at the set time" (UEFI 2.11 §8.3.4), as EDK2's setup browser does (edk2-stable202608 SetupBrowserDxe/Setup.c:2051). Before any write, `set` refuses a time outside the ranges of UEFI 2.11 §8.3.1, such as a year before 1900. A GET or SET of a date or time without a VarStore, which conditions and WRITE expressions may hold, reads or writes a field of GetTime()'s time, as EDK2's setup browser does. On Linux, Windows and macOS, which reach no Time Services, `get` shows `<ValueUnavailable: EFI Date/Time Storage (UEFI 2.11 §33.2.5.6) is read only through GetTime(); run uefisettings.efi in the UEFI Shell>` (GetWakeupTime() for a wake-up time), also where the ExportConfig snapshot holds the bytes of its VarStore, as that snapshot holds no EFI_TIME, and `set` refuses the question, with every other question that it selects, before any write.
 * An ordered-list question (UEFI 2.11 §33.2.5.4.8, §33.3.8.3.53) holds its items in up to MaxContainers containers, each as wide as the Type of its first option, as EDK2's setup browser sizes them (edk2-stable202608 SetupBrowserDxe/IfrParse.c), and a container of 0 ends them. `get` and `hii list-questions` show the texts of the options of its items in order, joined by `, `, each with the state of its option, such as `USB <option suppressed>`, and `--json` lists them without states as `items`; without a value they show its default, whose missing containers are empty. An option flagged as a default gives that default instead of an option, as in EDK2's setup browser. `set` takes the items with `--item TEXT`, once per container, in order, instead of VALUE, and writes the rest of the containers empty. Before any write, it refuses more items than MaxContainers, fewer under `EFI_IFR_NO_EMPTY_SET`, an option twice under `EFI_IFR_UNIQUE_SET`, an item whose option conditions hide unless `--include` selects its state, and a list that drops a stored item whose option conditions hide: `--include suppressed` with that item keeps it.
 * A cross-reference question (UEFI 2.11 §33.2.5.4.10, §33.3.8.3.59) on a VarStore holds an `EFI_HII_REF`, which `get` and `hii list-questions` show as `QuestionId 0x0005, FormId 0x0001, FormSetGuid 8C78A505-BAA0-4C4A-869F-000000000502, DevicePath "PciRoot(0x0)/Pci(0x1,0x0)"`: the DevicePath as the text of its string in the language of the other texts, `DevicePath none` for string 0, which links within the device path of the question's form set, or `DevicePath string 0x0063 not found` for a string without a text in that language or a display language; without a value they show its default of Type `EFI_IFR_TYPE_REF`. Any of `EFI_IFR_REF` to `EFI_IFR_REF5` holds one on a VarStore, as in EDK2's setup browser (edk2-stable202608 SetupBrowserDxe/IfrParse.c), though the spec gives storage to `EFI_IFR_REF5` only. The value is the target of the question's link, not a setting, so `set` refuses it before any write: `cannot set question "…": set does not write the EFI_HII_REF of a cross-reference question, the target of its link (UEFI 2.11 §33.2.5.4.10)`. A cross-reference question without a VarStore is a link with no value, which is not listed.
-* A string question (UEFI 2.11 §33.2.5.4.9, §33.3.8.3.70) holds MaxSize CHAR16s of UCS-2 (UEFI 2.11 §33.2.6), as EDK2's setup browser sizes them (edk2-stable202608 SetupBrowserDxe/IfrParse.c:2225). `get` and `hii list-questions` show its characters up to the first NULL, all MaxSize of them without one, and refuse a UTF-16 surrogate, which UCS-2 has no character for; without a value they show its default, the text of its string in the language of the other texts, cut to MaxSize characters, or `unknown (…)` for a string that the package list lacks or that holds a character beyond UCS-2: the string of an `EFI_IFR_DEFAULT`, else of a flagged `EFI_IFR_ONE_OF_OPTION` of Type `EFI_IFR_TYPE_STRING` that no `EFI_IFR_SUPPRESS_IF` hides, as EFI_IFR_STRING (UEFI 2.11 §33.3.8.3.70) orders them; EDK2's setup browser takes them from the ALTCFG defaults that HiiDatabaseDxe/ConfigRouting.c builds (:3218-3235) for storage other than a VARSTORE_EFI before UEFI 2.3.1 (EFI_HII_VARSTORE_EFI_VARIABLE, edk2-stable202608 SetupBrowserDxe/Setup.h:104, IfrParse.c:1901-1910), in a form set with EFI_HII_CONFIG_ACCESS_PROTOCOL (Setup.c:4449), and skips them for that storage (Setup.c:4140); its fallback takes the options of one-of questions alone (Setup.c:4525). `set` writes at most MaxSize − 1 characters of VALUE, NULL-padded to MaxSize CHAR16s, so that a NULL ends them: UEFI 2.11 §33.2.5.4.9 says "the buffer size must exceed the size of the NULL-terminated string". EDK2's setup browser takes MaxSize characters (edk2-stable202608 DisplayEngineDxe/InputHandler.c:260), which its Library/UefiHiiLib/HiiLib.c:1833 then reads past, so that DriverSampleDxe/DriverSample.c:2012-2022 unloads the driver, and on which MdePkg BaseLib/SafeString.c:256-259 StrCpyS fails. Before any write, `set` refuses more characters than that, fewer than MinSize, as EDK2's setup browser does, every VALUE of a string question of MaxSize 0 or of a MinSize above MaxSize − 1, a NULL, a character beyond UCS-2, a character of the Private Use Area U+E000..U+F8FF, of which UEFI 2.11 §33.2.6.2.1 says "UEFI prohibits use of this area in a UEFI environment.", other than the Common Control Codes U+F620..U+F62B and U+F700..U+F8FF, font display hints that UEFI 2.11 §33.2.6.2.4 Table 33.3 allows within strings, and a Mandatory Break of UEFI 2.11 §33.2.6.2.5 Table 33.4 (U+000A, U+000C, U+000D, U+2028 or U+2029) without the flag `EFI_IFR_STRING_MULTI_LINE` of EFI_IFR_STRING (UEFI 2.11 §33.3.8.3.70), which says "If it is clear, then multi-line editing should not be allowed." EDK2's setup browser ignores that flag, ends input at a carriage return and stores any other character typed, a line feed and the Private Use Area too (InputHandler.c:208, :256-262). A string question of name/value storage shows no value from the `ExportConfig()` snapshot, whose settings of that storage uefisettings keeps as numbers only.
+* A string question (UEFI 2.11 §33.2.5.4.9, §33.3.8.3.70) holds MaxSize CHAR16s of UCS-2 (UEFI 2.11 §33.2.6), as EDK2's setup browser sizes them (edk2-stable202608 SetupBrowserDxe/IfrParse.c:2225). `get` and `hii list-questions` show its characters up to the first NULL, all MaxSize of them without one, and refuse a UTF-16 surrogate, which UCS-2 has no character for; without a value they show its default, the text of its string in the language of the other texts, cut to MaxSize characters, or `unknown (…)` for a string that the package list lacks or that holds a character beyond UCS-2: the string of an `EFI_IFR_DEFAULT`, else of a flagged `EFI_IFR_ONE_OF_OPTION` of Type `EFI_IFR_TYPE_STRING` that no `EFI_IFR_SUPPRESS_IF` hides, as EFI_IFR_STRING (UEFI 2.11 §33.3.8.3.70) orders them; EDK2's setup browser takes them from the ALTCFG defaults that HiiDatabaseDxe/ConfigRouting.c builds (:3218-3235) for storage other than a VARSTORE_EFI before UEFI 2.3.1 (EFI_HII_VARSTORE_EFI_VARIABLE, edk2-stable202608 SetupBrowserDxe/Setup.h:104, IfrParse.c:1901-1910), in a form set with EFI_HII_CONFIG_ACCESS_PROTOCOL (Setup.c:4449), and skips them for that storage (Setup.c:4140); its fallback takes the options of one-of questions alone (Setup.c:4525). `set` writes at most MaxSize − 1 characters of VALUE, NULL-padded to MaxSize CHAR16s, so that a NULL ends them: UEFI 2.11 §33.2.5.4.9 says "the buffer size must exceed the size of the NULL-terminated string". EDK2's setup browser takes MaxSize characters (edk2-stable202608 DisplayEngineDxe/InputHandler.c:260), which its Library/UefiHiiLib/HiiLib.c:1833 then reads past, so that DriverSampleDxe/DriverSample.c:2012-2022 unloads the driver, and on which MdePkg BaseLib/SafeString.c:256-259 StrCpyS fails. Before any write, `set` refuses more characters than that, fewer than MinSize, as EDK2's setup browser does, every VALUE of a string question of MaxSize 0 or of a MinSize above MaxSize − 1, a NULL, a character beyond UCS-2, a character of the Private Use Area U+E000..U+F8FF, of which UEFI 2.11 §33.2.6.2.1 says "UEFI prohibits use of this area in a UEFI environment.", other than the Common Control Codes U+F620..U+F62B and U+F700..U+F8FF, font display hints that UEFI 2.11 §33.2.6.2.4 Table 33.3 allows within strings, and a Mandatory Break of UEFI 2.11 §33.2.6.2.5 Table 33.4 (U+000A, U+000C, U+000D, U+2028 or U+2029) without the flag `EFI_IFR_STRING_MULTI_LINE` of EFI_IFR_STRING (UEFI 2.11 §33.3.8.3.70), which says "If it is clear, then multi-line editing should not be allowed." EDK2's setup browser ignores that flag, ends input at a carriage return and stores any other character typed, a line feed and the Private Use Area too (InputHandler.c:208, :256-262). A string question of name/value storage takes its characters from its setting in the `ExportConfig()` snapshot, 4 hex digits each, most significant first, as EDK2's setup browser reads them (edk2-stable202608 SetupBrowserDxe/Setup.c:1564-1579): up to a NULL, as UEFI 2.11 §33.2.5.4.9 ends the hex dump, or MaxSize characters, as Setup.c writes them without one (:2139-2148); an empty setting is an empty string. A setting whose digits are no `<String>` (UEFI 2.11 §35.2.1.2), whose last CHAR16 Setup.c would take from fewer than 4 digits (:1571-1573), or that holds characters other than NULL past MaxSize, which Setup.c would cut (:1557-1561), gives no value.
 * `set` gives one value to every question that it selects, so where it selects questions of more than one kind, such as a numeric question and a date, it refuses them all before any write, naming each kind and the package lists of its questions.
 * Before the first write, `set` checks that it cannot crash Linux: Linux v5.8 (f88814cc2578; stable 5.7.11) to v6.7 without the upstream fix 0e8d2444168d crash on an efivarfs write when the firmware's `EFI_RT_PROPERTIES_TABLE` leaves out `SetVariable()`. It writes when `/proc/kallsyms` names `efivarfs_reconfigure`, the function of that fix, or, on x86_64 and on aarch64 from Linux v5.14, when the `set_variable` of Linux's `generic_ops`, which it reads through `/proc/kcore` (unless `lockdown=confidentiality`) at the address that `/proc/kallsyms` gives, is a `*_set_variable` function, and refuses when that `set_variable` is NULL. Where neither tells, it writes when the kernel log (`/dev/kmsg`, or `syslog(2)` under `printk.devkmsg=off`) names no such table that Linux applied, and else, on x86, x86_64 and aarch64, reads the table itself from `/dev/mem` as `capsule config-data` reads its table, unless the kernel lockdown mode refuses `/dev/mem`: it writes when the table lists `SetVariable()`, or the firmware lists no such table, and refuses when the table leaves it out. Otherwise it refuses, and `uefisettings.efi` in the UEFI Shell can change the setting.
 * Questions read and set their EFI variable by its own attributes, as efivarfs gives them, since firmware may give a variable runtime access that its form does not declare. The attributes that the form (`VARSTORE_EFI`) declares explain only a variable that efivarfs does not list, or none read under `--no-efivars`.
@@ -357,7 +390,7 @@ make help            # lists the checks
 
 On macOS, whose make 3.81 ignores the `Makefile`'s `.SHELLFLAGS`, `brew install make` installs GNU make as `gmake`: `gmake setup test` runs the unit tests.
 
-GitHub Actions runs the checks, and the unit tests on arm64 and Intel Macs and on x86_64 Windows, on every pull request and every push to main, as [`.github/workflows/checks.yml`](.github/workflows/checks.yml) describes.
+GitHub Actions runs the checks on every pull request and every push to main, as [`.github/workflows/checks.yml`](.github/workflows/checks.yml) describes: `lint`, and each system's tests as a check of its own, named after the system: the unit tests on x86_64, i686 and aarch64 Linux, arm64 and Intel Macs and x86_64 and aarch64 Windows, and the QEMU tests of Linux and of the UEFI Shell on each of their 3 architectures.
 
 ## QEMU tests
 
@@ -411,26 +444,45 @@ they would create absent variables and overwrite writable ones, such as BootOrde
 </details>
 
 <details>
-<summary>AMI Setup access level</summary>
+<summary>Stated VarStore bytes</summary>
 
-AMI firmware's Setup grays out or hides some questions by the access level of its session, which
-it keeps in the VarStore `SystemAccess` (E770BB69-BCB4-4D04-9E97-23FF9456FEAC: 0 Administrator,
-1 User). Where Linux cannot read that variable, those questions are undetermined, and `set`
-refuses them unless `--include` selects their states, such as `grayed-out`.
-`--access-level administrator|user`, on `get`, `set`, `hii get`, `hii set` and
-`hii list-questions`, evaluates those conditions at the stated level instead, and fails on a
-HiiDB that declares no `SystemAccess`:
+Conditions that read bytes the OS cannot read, such as those of a buffer VarStore that only its
+driver's `EFI_HII_CONFIG_ACCESS_PROTOCOL` holds, or of an EFI variable without runtime access, are
+undetermined, and `set` refuses the questions they may gray out or hide unless `--include` selects
+those states. The reason names the bytes:
 
-```sh
-uefisettings hii list-questions --access-level administrator
+```text
+<ValueUnavailable: no EFI variable Setup-8be4df61-93ca-11d2-aa0d-00e098032b8c; HII buffer varstore
+requires EFI_HII_CONFIG_ACCESS_PROTOCOL; --assume-var-store
+Setup-8be4df61-93ca-11d2-aa0d-00e098032b8c+5=<HEX of 1 byte> states it>
 ```
 
-`--access-level` changes no variable: the questions on `SystemAccess` itself still answer with its
-stored value, or why it cannot be read.
+`--assume-var-store NAME-GUID[+OFFSET]=HEX`, on `get`, `set`, `hii get`, `hii set` and
+`hii list-questions`, evaluates conditions as if that VarStore held the bytes HEX, two hex digits
+each, from byte OFFSET of its payload on (decimal, or hexadecimal after `0x`; default 0). NAME-GUID
+is the name of the variable's efivar file, as the reason prints it. Repeat it to state more bytes.
+It refuses a VarStore that no FormSet of the HiiDB declares, bytes past its Size, and bytes stated
+twice.
+
+Stated bytes change states, and the option lists and defaults that conditions pick, never a write:
+the questions on those bytes still answer with what their variable holds, or why it cannot be
+read, and `set` writes the variable, never the stated bytes. A question whose `EFI_IFR_VALUE` or
+`READ` expression reads them answers with what it computes from them, and the `EFI_IFR_WRITE`
+expression of a question that `set` writes reads them as conditions do, as does an `EFI_IFR_GET`.
+
+For example, AMI firmware's Setup grays out or hides some questions by the access level of its
+session, which it keeps at byte 0 of the VarStore `SystemAccess`
+(E770BB69-BCB4-4D04-9E97-23FF9456FEAC: 0 Administrator, 1 User). To list the questions of an
+Administrator session:
+
+```sh
+uefisettings hii list-questions \
+  --assume-var-store SystemAccess-e770bb69-bcb4-4d04-9e97-23ff9456feac=00
+```
 
 uefisettings never takes, checks or circumvents a firmware password, because UEFI variable writes
-carry none. With an Administrator password installed, `administrator` lets root select from the OS
-the questions that the firmware's Setup reserves for Administrator sessions, as
+carry none. With an Administrator password installed, stating `00` there lets root select from the
+OS the questions that the firmware's Setup reserves for Administrator sessions, as
 `--include grayed-out` already does more broadly.
 
 </details>
@@ -544,17 +596,18 @@ and `set` refuses it, with or without a VarStore:
 | READ only | the value of READ | refused: nothing keeps a changed value |
 | WRITE only | refused: no value to retrieve | through WRITE |
 | neither, nor EFI_IFR_FLAG_CALLBACK | refused: one of them is required | refused |
-| EFI_IFR_FLAG_CALLBACK only | refused: its driver keeps the value | refused |
-| EFI_IFR_FLAG_CALLBACK with READ (get) or WRITE (set) | refused: its driver's CallBack() may override the expression | refused |
+| EFI_IFR_FLAG_CALLBACK only | its driver's CallBack(): see below | its driver's CallBack(): see below |
+| EFI_IFR_FLAG_CALLBACK with READ (get) or WRITE (set) | as above, but refused where RETRIEVE fails: uefisettings does not evaluate READ beside CallBack() | refused before any write: uefisettings does not evaluate WRITE beside CallBack() |
 
 `get` refuses too where READ gives no value, as no stored value takes its place, and `set` where
 WRITE sets no VarStore. A browser lets the driver override READ with
 CallBack(EFI_BROWSER_ACTION_RETRIEVE) and calls CallBack() around WRITE, so a question with
 EFI_IFR_FLAG_CALLBACK is its driver's to answer. On Linux, Windows and macOS, which run after
-ExitBootServices(), when no EFI device-handle-based protocol may be used (UEFI 2.11 §7.4.6), the
-refusal points to `uefisettings.efi` in the UEFI Shell, which calls no CallBack() yet and refuses
-it as well. `hii list-questions` and `hii show-ifr` never call CallBack(): they show such a
-question with the refusal of `get`.
+ExitBootServices(), when no EFI device-handle-based protocol may be used (UEFI 2.11 §7.4.6), `get`
+refuses such a question and points to `uefisettings.efi` in the UEFI Shell, which calls CallBack():
+see the UEFI Shell details; `set` on Linux and Windows stages it for the next boot instead: see the
+sets staged for the next boot. `hii list-questions` and `hii show-ifr` never call CallBack(): they
+show such a question with the refusal of `get`.
 
 </details>
 
@@ -583,6 +636,13 @@ of the file only when it lists or writes the variable but reads the variable fro
 each read; a variable without runtime access is missing there, and so is one that the firmware
 dropped after efivarfs listed it. On Windows it reads all of the data through
 GetFirmwareEnvironmentVariableExW, which tells the size no other way, and prints none of it.
+Of a variable with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS, it also prints `metadata`, the
+EFI_VARIABLE_AUTHENTICATION_3 headers that GetVariable() returns before the data (UEFI 2.11 §8.2.1),
+which `size` counts: `version`, `type`, 1 for a TimeStamp or 2 for a nonce, `metadata_size`,
+`flags`, then `time_stamp` as YYYY-MM-DDTHH:MM:SSZ, or `nonce`, the current nonce, which the next
+update signs (§8.2.5), as `{"hex": ...}`, then `cert_id`, its `type` and `id`; metadata that
+uefisettings does not take shows as `{"refused": WHY}`. In the UEFI Shell it reads the data of such
+a variable for it, and of no other.
 `uefisettings.efi` keeps `hii variable-info` for it.
 
 ```plain
@@ -603,8 +663,11 @@ and each reserved bit in hex; `SecureBoot`, `SetupMode`, `AuditMode`, `DeployedM
 `devAuthBoot` and `HwErrRecSupport` are their number; `BootOptionSupport` lists its flags and its
 key press `count`; `SignatureSupport` and `OsRecoveryOrder` list their GUIDs; `PK`, `KEK`, the
 signature databases and their `*Default` list their EFI_SIGNATURE_LISTs, each a `type` GUID and its
-`signatures`, each an `owner` GUID and the `sha256` of its data. The load options, hot keys and
-device paths of §3.3 are left to `variable info`.
+`signatures`, each an `owner` GUID and the `sha256` of its data. Boot####, Driver####, SysPrep####,
+PlatformRecovery#### and, of the GUID given, OsRecovery#### show `attributes`, `category`,
+`description`, `device_paths` as text and `optional_data` in hex; Key#### shows `revision`,
+`modifiers`, `keys`, `boot_option` and `crc_matches`; ConIn, ConOut, ErrOut and their *Dev show
+their device path as text.
 
 ```sh
 uefisettings variable get SecureBoot
@@ -658,6 +721,93 @@ firmware departure that set reports as returned.
 FS0:\> uefisettings.efi variable set DeployedMode 1 --i-am-fine-to-brick-this-system
 ```
 
+`variable set-attributes NAME [--set FLAGS] [--clear FLAGS] [--category CATEGORY]` changes the
+Attributes (UEFI 2.11 §3.1.3) of a Boot####, Driver#### or SysPrep#### of EFI_GLOBAL_VARIABLE:
+`--set` and `--clear` take the flags `active`, `force-reconnect` and `hidden`, comma-separated, and
+`--category` `boot` or `app` gives the LOAD_OPTION_CATEGORY field a value, clearing the whole field
+first, a reserved value too; no flag names the bit of LOAD_OPTION_CATEGORY_APP. It patches the
+Attributes in place: "When updating a load option, all undefined attribute bits must be preserved",
+and every other byte stays as read, which a decode and encode would not keep for a Description
+holding a surrogate. The variable keeps its attributes. It prints the load option as `variable get`
+shows it. A Key#### starts its Boot#### only while its BootOptionCrc is the CRC-32 of that Boot####
+(§3.1.6), so after writing a Boot####, set-attributes sets the BootOptionCrc of each Key#### whose
+BootOption names it and whose BootOptionCrc was the CRC-32 of its old bytes to that of the new ones,
+every other byte kept, and prints each Key#### updated on stderr. A Key#### that is malformed, names
+another Boot#### or was already stale stays as it was. A Key#### write that fails names the Boot####
+as written, the Key#### updated and each one left with the old BootOptionCrc. Windows, whose calls
+cannot list variables, finds none, and set-attributes warns that the Key#### that name the Boot####
+are now ignored there. It refuses, before any write, PlatformRecovery####, which "are only modified
+by firmware and are read-only to the OS" (§3.3), OsRecovery####, a Secure Boot Policy Variable that
+needs EFI_VARIABLE_AUTHENTICATION_2 (§3.3), any other variable, an absent load option, a change of
+nothing and a flag both to set and to clear. It refuses too a load option, or a Key#### following
+it, whose attributes hold EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS or
+EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS, which only an EFI_VARIABLE_AUTHENTICATION_3 or
+_2 descriptor writes (§8.2.3).
+
+```sh
+uefisettings variable set-attributes Boot0001 --clear active
+```
+
+`variable create-load-option NAME --description TEXT (--device-path TEXT... | --device-path-file
+FILE...) [--optional-data-file FILE] [--flags FLAGS] [--category CATEGORY]` creates a Boot####,
+Driver#### or SysPrep#### of EFI_GLOBAL_VARIABLE that does not exist, with NV+BS+RT (UEFI 2.11 Table
+3.1): `--description` takes its Description, UCS-2 text without Null; `--device-path` takes a device
+path as `variable get` shows it, read back to bytes, once per device path of its FilePathList, the
+first of which locates the image; `--device-path-file` takes instead a file of the bytes of one, an
+EFI_DEVICE_PATH_PROTOCOL, which the FilePathList decoder checks and nothing changes;
+`--optional-data-file` takes its OptionalData, bytes never decoded, none if not given; `--flags` and
+`--category` take its Attributes, `active` and `boot` if not given, and `--flags none` no flag, so
+that an app that is not active, Attributes 0x100, takes one write: "When creating a new load option,
+all undefined attribute bits must be written as zero" (§3.1.3). It refuses an existing load option:
+`variable set-attributes` changes one, and `variable set BootOrder` its place in BootOrder, which a
+new one stays out of. A SysPrep#### while BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_SYSPREP,
+and an app Boot#### while it lacks EFI_BOOT_OPTION_SUPPORT_APP, get a warning on stderr and are
+written all the same (§3.1.4); an absent BootOptionSupport supports neither. The category "is
+ignored for variables of the form Driver####, SysPrep####, or OsRecovery####" (§3.1.3), so theirs
+gets none. It prints what it wrote as `variable get` shows it, and refuses, before any write, a path
+that does not read or decode.
+
+```sh
+uefisettings variable create-load-option Boot0005 --description UiApp --device-path 'Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)'
+```
+
+`variable set-device-path NAME (--device-path TEXT | --device-path-file FILE)` sets ConIn, ConOut or
+ErrOut to one device path, from text or a file of its bytes, keeping the variable's attributes, or
+with NV+BS+RT if it is missing. ConIn, ConOut and ErrOut "are always proper subsets of ConInDev,
+ConOutDev, and ErrOutDev" (UEFI 2.11 §3.3), so each instance that the `*Dev` variable lacks gets a
+warning on stderr, but one holding a USB Class or USB WWID node, which the firmware matches to the
+devices of that class or WWID (edk2-stable202608 ConPlatformDxe MatchUsbShortformDevicePath()); the
+write still proceeds. It refuses ConInDev, ConOutDev and ErrOutDev, which "are volatile, and are set
+dynamically on every boot". It prints what it wrote as `variable get` shows it, and refuses, before
+any write, a path that does not read or decode, and alike a console variable whose attributes hold
+EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
+which only an EFI_VARIABLE_AUTHENTICATION_3 or _2 descriptor writes (§8.2.3).
+
+```sh
+uefisettings variable set-device-path ConOut --device-path 'PciRoot(0x0)/Pci(0x1F,0x0)/Serial(0x0)/Uart(115200,8,N,1)/VenUtf8()'
+```
+
+`variable create-key NAME --boot BOOT [--modifiers MODIFIERS] [--key KEY]...` creates a Key#### of
+EFI_GLOBAL_VARIABLE that does not exist, with NV+BS+RT, a hot key that starts a Boot#### (UEFI 2.11
+§3.1.6): `--boot` takes the Boot####, which must exist; BootOptionCrc gets the CRC-32 of its
+EFI_LOAD_OPTION, the bytes after any EFI_VARIABLE_AUTHENTICATION_3 metadata (§8.2.1), without which
+the boot manager ignores the key; `--modifiers` takes the shift states to hold, of `shift`,
+`control`, `alt`, `logo`, `menu` and `sys-req`, comma-separated, none if not given; `--key` takes
+each key, 0 to 3, as InputKeyCount counts them, by the name after `SCAN_` of its scan code in edk2's
+SimpleTextIn.h and SimpleTextInEx.h, such as `F2`, `ESC` or `EJECT`, else by its one UCS-2
+character, else as `ScanCode=0x####,UnicodeChar=0x####`, which `variable get` shows for any other
+key. KeyData gets Revision 0 and no Reserved bits, as the spec's examples. It prints the key as
+`variable get` shows it. It refuses, before any write, an existing Key####, a missing Boot####, a
+BootOptionSupport without EFI_BOOT_OPTION_SUPPORT_KEY or with an EFI_BOOT_OPTION_SUPPORT_COUNT below
+the keys (§3.1.4), an absent one supporting none, and the shift states and keys of a Key#### that
+the boot manager takes, as its Boot#### exists and its BootOptionCrc matches: edk2-stable202608
+EfiBootManagerAddKeyOptionVariable() (BmHotkey.c) refuses those too. Windows, whose calls cannot
+list variables, cannot check the last; create-key warns there and writes the key all the same.
+
+```sh
+uefisettings variable create-key Key0005 --boot Boot0001 --modifiers alt --key F11
+```
+
 `variable storage [--attributes ATTRIBUTES]` prints what QueryVariableInfo() (UEFI 2.10 §8.2.4)
 tells of the storage of the variables of those attributes, by default the non-volatile ones that
 the OS reaches (`non-volatile,bootservice-access,runtime-access`), as a JSON object of its own:
@@ -742,11 +892,17 @@ certificate a WIN_CERTIFICATE_UEFI_GUID of PKCS #7 on a 4-byte boundary after ze
 the structures out, and MetadataSize their size, then the data. With `--data-file`, KEY signs over
 SHA-256 or the `--digest`, as above, and `--timestamp TIME` or `--nonce HEX` gives the Type; the
 firmware takes only a TimeStamp later than the variable's, or a nonce other than its own, and makes
-one for an all-zero nonce where it can. `--current-nonce HEX`, the variable's nonce, is required to
+one for an all-zero nonce where it can. `--current-nonce HEX`, the variable's nonce, which by
+default is the one that its metadata holds (§8.2.1), is signed to
 update a NONCE variable, and `--new-signing-key-file KEY2 --new-signing-certificate-file
 CERTIFICATES2` adds a NewCert, which KEY2 signs over the same digest and which hands the variable
-to KEY2; with it, the data may be empty, to change the certificate alone. uefisettings does not
-compare these with the stored variable: the firmware does. Before it seeds or writes, it refuses a
+to KEY2; with it, the data may be empty, to change the certificate alone. With `--data-file`,
+uefisettings reads the variable first and refuses, as the firmware would, attributes other than
+its own but `append` (§8.2.3), another Type, a TimeStamp not later than its own, its own nonce
+unless all zero, and a `--current-nonce` other than its nonce or for a variable that does not
+exist (§8.2.5); it checks neither the payload of `--payload-file` against the variable nor the
+signer: the firmware does. A variable that it cannot read, or whose metadata it does not take, it
+does not write. Before it seeds or writes, it also refuses a
 write without data or NewCert, which would delete the variable, a Secure Boot policy variable,
 which takes only an EFI_VARIABLE_AUTHENTICATION_2, a device signature database while SetupMode is
 1, as above, and on Linux every such write, as efivarfs lacks the attribute (EFI_VARIABLE_MASK in
@@ -856,7 +1012,13 @@ A failing command returns EFI_ABORTED, which `%lasterror%` shows as 0x15 (0x8000
 
 The UEFI Shell runs no setup browser, so nothing there asks for or checks a setup password: in a
 HiiDB that declares a password question, `set` writes nothing unless
-`--i-am-fine-to-brick-this-system` is given (see [Unsafe operations](#unsafe-operations)).
+`--i-am-fine-to-brick-this-system` is given (see [Unsafe operations](#unsafe-operations)). A set
+staged for the next boot follows the same rule, as `apply-staged` applies it before the OS: on
+Linux and Windows, `set` stages a question whose value only its driver holds in such a HiiDB only
+with `--i-am-fine-to-brick-this-system`, which it records with the question and which
+`apply-staged` honours. Under Secure Boot, any `uefisettings.efi` that db trusts thus lets an OS
+administrator stage requests with `--i-am-fine-to-brick-this-system` that `apply-staged` honours
+before the OS, with no setup password: sign it only with keys whose machines accept that.
 
 `set` refuses a variable without EFI_VARIABLE_NON_VOLATILE unless `--allow-volatile` is given.
 The UEFI Shell runs before ExitBootServices, when SetVariable() still sets volatile variables
@@ -896,6 +1058,9 @@ written, as a number. It never writes a read-only question, which the Keyword Ha
 even with `--i-am-fine-to-brick-this-system`; else `--include`, that flag and `--allow-volatile`
 work as for `set`: the `<KeywordResp>` of a keyword whose variable is volatile
 ends with ` <volatile: lasts until the next reset or power cycle>`. `-j` prints JSON instead.
+`get` and `set` fail where GetData(), or SetData() and its read-back, changed the bytes of a
+password question, which uefisettings never writes back, or where it cannot compare those bytes
+across them, as it compares them across a Callback() sequence (below).
 A VALUE holds every byte that SetData() writes, last byte first, as edk2's GetValueOfNumber
 (ConfigRouting.c:518) and UEFI 2.11 §35.4.6's example read it, where §35.2.1.5 lists a
 `<Number>`'s bytes in memory order: of a DATE or TIME each field, which `set` takes as the digits
@@ -904,15 +1069,153 @@ ORDERED_LIST each container, whose options up to the first empty one `set` takes
 every container after it empty. A container is as wide as the Type of the ONE_OF_OPTION right
 after the ORDERED_LIST, as edk2's GetWidth takes it, where UEFI 2.11 §33.2.5.4.8 gives it one
 byte; a VALUE is refused where `set` writes containers of another width, that of the first option
-that is no default. A REF, whose EFI_HII_REF `set` does not write, and a STRING are refused.
+that is no default. A REF, whose EFI_HII_REF `set` does not write, is refused. Of a STRING, a
+VALUE holds all MaxSize CHAR16s, as edk2's GetWidth takes them, so `AB` of MaxSize 4 is
+`0000000000420041`; UEFI 2.11 §33.2.5.4.9 represents a STRING's result as "hex dump of the
+string, including the terminating NULL character", but a VALUE of fewer bytes is refused, as
+edk2-stable202608 ConfigRouting.c HiiConfigToBlock copies the question's width (:6353) from a
+buffer of half the VALUE's digits (:508-509): `set`'s checks take its text up to the first NULL,
+and a VALUE that is not the bytes that `set` writes for that text, NULL-padded (UEFI 2.11
+§33.2.5.4.9), or that holds a UTF-16 surrogate is refused.
 
 ```plain
 FS0:\> uefisettings.efi hii keyword get --namespace x-UEFI-ns KEYWORD=<keyword>
 FS0:\> uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=<hex digits>&KEYWORD=<keyword>&VALUE=<hex digits>"
 ```
 
+A question without a VarStore whose value only its driver keeps (EFI_IFR_FLAG_CALLBACK, UEFI 2.11
+§33.2.5.6) is reached through that driver's EFI_HII_CONFIG_ACCESS_PROTOCOL.Callback(), with the
+browser actions that a forms browser sends, as no forms browser runs. `get` sends FORM_OPEN,
+RETRIEVE and FORM_CLOSE, and shows the value that RETRIEVE gave. Only `get` and `set` call a driver:
+`list-questions`, `show-ifr`, the dumps and `get --no-efivars` show why such a question has no
+value, and so does `get` on Linux, Windows and macOS, while `set` on Linux and Windows stages it for
+the next boot.
+
+uefisettings exchanges a value with Callback() only for a one-of, numeric or checkbox question: it
+refuses an ordered-list or string question, or a date or time question outside EFI Date/Time
+Storage, with EFI_IFR_FLAG_CALLBACK and no VarStore, and names its op. A Callback() names its question by
+QuestionId alone, "The unique value that identifies the particular question" (UEFI 2.11
+§33.3.8.2.2), so uefisettings calls none for a question whose QuestionId another question of its
+FormSet also has, such as a password question: it refuses that question and names the other's op.
+
+Each Callback() sequence runs between reads of the stores of the question's FormSet: of its Buffer
+and Name/Value stores by EFI_HII_CONFIG_ROUTING_PROTOCOL.ExtractConfig() of the settings that a
+forms browser requests, and of its EFI variable stores. A store that cannot be read refuses before
+the first Callback(). Settings that change between two reads before it, as a timestamp does, are
+listed and not compared. A store that the Callback()s changed is restored, a Buffer or Name/Value
+store by one RouteConfig() of all its settings, and the answer is refused: the driver has already
+acted on the change, and any effect outside the FormSet's stores stays. The reads never request the
+bytes of a PASSWORD question, and read them as zero in an EFI variable store, so a changed store
+that holds one is not restored, as a RouteConfig() without the password bytes may clear it and
+SetVariable() would write zeros over them. uefisettings compares those bytes apart, without showing
+them: in each EFI variable that holds one, listed by GetNextVariableName() or not, it reads them
+before the stores' first reads, refusing the answer where they cannot be read or listed, and again
+after the sequence, or after the reads that ran where a store cannot be read, and after a
+reconnection that a Callback() asks for. As uefisettings never writes a password byte, a change,
+or bytes that cannot be compared, then fails `get`, and `set` reports the change not applied, or
+applied and then refused by the reconnection.
+`get` of a question with a READ expression shows RETRIEVE's value, as a forms browser does. Where
+RETRIEVE fails, a forms browser keeps READ's value, but uefisettings does not evaluate READ beside
+a driver's Callback()s, so `get` refuses and says so. A Callback() that asks the forms browser to
+save the FormSet's modified values, which only a forms browser's edit buffer holds, or returns an
+ActionRequest that UEFI 2.11 §35.5.4 does not define refuses the answer too; a request for a
+platform reset or to discard modified values is noted.
+
+`set` sends FORM_OPEN, RETRIEVE, CHANGING with the new value, CHANGED and FORM_CLOSE, then reads the
+value back with FORM_OPEN, RETRIEVE and FORM_CLOSE, and answers `applied`, `applied; the driver now
+reports <value>` for a driver that resets a transient value, or `applied; the driver offers no
+read-back`. A forms browser never sends SUBMITTED for a question without storage, so `set` does not
+either. `set` refuses the change when CHANGING refuses the value or CHANGED fails, and, before any
+write, a question with a WRITE expression, which a forms browser evaluates between CHANGING and
+CHANGED and uefisettings does not evaluate beside a driver's Callback()s. A RECONNECT request after
+an applied change disconnects and reconnects the driver's controller.
+`set` sends the value to the drivers of the matches after it writes the EFI variables of the
+others, in order, and stops at the first driver that refuses it, as at a failed write: its error
+names each driver by the package list of its question, followed by `(its driver)`. In a HiiDB that
+declares a setup password question, and for a question that EFI_IFR_FLAG_READ_ONLY makes
+read-only, `set` through a driver is an unsafe operation, as for a stored question, which only
+`--i-am-fine-to-brick-this-system` lets through, before the first Callback() (see
+[Unsafe operations](#unsafe-operations)).
+
+`get` and `set` list every EFI variable that the sequence changed, as a Callback() may act outside
+the FormSet's stores, where nothing here can see it.
+
 With Secure Boot enabled, the firmware starts an image only if its signature database (db) holds
 the certificate of its signature or its hash, so sign `uefisettings.efi` with a key that the
 machine's db trusts.
 
 </details>
+
+<details>
+<summary>Sets staged for the next boot</summary>
+
+Boot services, and with them every driver's EFI_HII_CONFIG_ACCESS_PROTOCOL.Callback(), end at
+ExitBootServices(), so from Linux or Windows `set` cannot reach a question whose value only its
+driver holds. It stages the request instead: the next boot starts `uefisettings.efi` from the EFI
+system partition (ESP) before the OS, from a Boot#### load option that BootNext names (UEFI 2.11
+§3.1.2), and that applies the set as `set` in the UEFI Shell does.
+
+```sh
+uefisettings set "<question>" "<value>" --image uefisettings.efi
+```
+
+`--image` names the `uefisettings.efi` to stage; under Secure Boot it must be signed for db, as the
+firmware starts no image whose signature db lacks (UEFI 2.11 §32.4.2). `set` copies it to
+`\EFI\uefisettings\uefisettings.efi` on the ESP, only as a new file, and reads the copy back to
+compare its SHA-256; a file there already, which a `set` running at the same time may have placed,
+fails `set` and stays. Then it records the set in the EFI variable `UefisettingsStagedSet` of
+uefisettings' own vendor GUID, writes the lowest Boot#### that neither exists nor BootOrder or
+BootNext names, ACTIVE and HIDDEN and in no BootOrder, so that no boot starts it unattended, whose
+device path is the ESP's Hard Drive node and the image's File Path node, and last writes BootNext. A
+step that fails undoes the ones before it. A `set` before that boot appends its request to the
+staged set and needs no `--image`.
+
+The ESP is the partition that the Hard Drive node of BootCurrent's Boot#### names: a GPT partition
+by its UniquePartitionGUID, an MBR one by its disk signature and partition number. When that
+Boot#### has no Hard Drive node, it is the only ESP. Staging refuses when no partition or several
+match, and names each one and why it is no match. On Linux the ESP must be mounted, at a mount point
+that no later mount shadows. On Windows `set` finds it among the volumes and writes through its
+volume GUID path; where Windows does not let it, mount the ESP with `mountvol S: /s` and pass `--esp
+S:`, and `set` checks that the volume there is that ESP. Windows refuses these calls without
+Administrator, and `set` says so.
+
+`set` does not stage while BootNext names another Boot####, which staging would replace, while
+OsIndications asks the next boot for the firmware's user interface or for recovery, which would not
+start BootNext's option unattended (UEFI 2.11 §8.5.4), while OsIndications has
+FILE_CAPSULE_DELIVERY_SUPPORTED and `\EFI\UpdateCapsule` on the ESP holds a file, as processing that
+capsule on disk clears BootNext without starting its option (UEFI 2.11 §8.5.5), or while
+`\EFI\uefisettings` holds a file that the staged set does not name. `set` checks these, the ESP and
+`--image` before it writes any question. It stages after it writes the EFI variables of the other
+matches, as the UEFI Shell build sends the value to the drivers after them, and its error names a
+staged question by its package list, followed by `(staged for the next boot)`.
+
+Staging and `apply-staged` write no byte of a password question: a write over one fails, staging
+then undoes the steps before it, and `apply-staged` applies no request if it could not record its
+start. Where `apply-staged` cannot tell those bytes, as for a password question whose VarStore it
+does not find, it writes nothing, so `set` refuses to stage that set.
+
+Before the OS, `uefisettings.efi apply-staged <nonce>` records in `UefisettingsStagedOutcome` that
+it started, before the first Callback(), then sets each request's question through its driver's
+Callback()s, but none after one refused as driver code changed password bytes, or they could not
+be compared across it, and records each result. It checks each request as `set` does, against
+`--i-am-fine-to-brick-this-system` as `set` recorded it with the request (see
+[Unsafe operations](#unsafe-operations)): a question that `EFI_IFR_FLAG_READ_ONLY` makes read-only
+by then, or a HiiDB that declares a setup password question, is applied only with it, and the
+result keeps a warning for each operation that the flag let through. A nonce whose outcome is
+recorded already applies nothing again, as when its Boot#### starts a second time after a crash or
+a failed deletion. It deletes the set's Boot#### and a BootNext that names it, but no other tool's
+BootNext, prints each result after its `warning:` lines and each deletion, and resets the platform
+cold, so that the OS starts in a boot whose boot path holds no `uefisettings.efi`. On Linux and
+Windows, `get` of such a question then shows what the records tell: its value staged for the next
+boot, or what the last staged boot did, which is applied, refused with the reason, stopped while it
+applied the set, which may then be partly applied, or never started, with the warnings of an
+applied or refused request.
+The next `set` that stages settles the old set: it records its outcome, which `get` keeps showing,
+and deletes its image and its record. The firmware may remove a Boot#### that nothing references
+(UEFI 2.11 §3.1.1); `set` deletes it otherwise, but not one that no longer holds the set's command
+line, nor an image whose SHA-256 changed.
+
+[UNVERIFIED] No firmware here has booted a copy that Windows staged, and `--esp` has not run through
+a real `mountvol` mount point.
+
+</details>
diff --git a/scripts/check-ci-jobs.sh b/scripts/check-ci-jobs.sh
new file mode 100755
index 0000000..bd597f5
--- /dev/null
+++ b/scripts/check-ci-jobs.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Copyright 2023 Meta Platforms, Inc. and affiliates.
+#
+# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+#
+# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+#
+# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Fails unless a GitHub Actions workflow runs each named check of the Makefile and no other:
+# the workflow runs a check where one of its lines is "run: make -k <check>", or
+# "check: <check>", a matrix entry's check, which its job runs as make -k "$CHECK". Each
+# missing or unknown check has its own message.
+# It does not check which systems run a check, nor that a job runs its entries' checks.
+#
+# Usage: scripts/check-ci-jobs.sh <workflow> <check>...
+
+set -euo pipefail
+
+workflow=$1
+shift
+# Words, not an array: macOS's bash 3.2 has no mapfile.
+workflow_checks=$(sed -nE 's/^ *(- )?(run: make -k|check:) ([a-z0-9_-]+)$/\3/p' "$workflow" | sort -u | tr '\n' ' ')
+failed=0
+for check in "$@"; do
+    if [[ " $workflow_checks " != *" $check "* ]]; then
+        echo "$workflow has no line \"run: make -k $check\" or \"check: $check\"" >&2
+        failed=1
+    fi
+done
+for check in $workflow_checks; do
+    if [[ " $* " != *" $check "* ]]; then
+        echo "$workflow names $check, which is not one of the checks: $*" >&2
+        failed=1
+    fi
+done
+exit "$failed"
diff --git a/scripts/check-toolchain.sh b/scripts/check-toolchain.sh
index 42e75fe..8205a85 100755
--- a/scripts/check-toolchain.sh
+++ b/scripts/check-toolchain.sh
@@ -12,10 +12,10 @@
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 # Checks that the Rust toolchain of the checks is there, and installs nothing. With a
-# toolchain name, the cargo on PATH must be the one of rustup, and rustup must have that
-# toolchain, a release toolchain for its default host, with clippy, rustfmt and every target
-# of the list; with an empty name, PATH must have a cargo. Each missing piece has its own
-# message.
+# toolchain name, rustup must have that toolchain, a release toolchain for its default
+# host, with clippy, rustfmt and every target of the list, and the cargo on PATH must run
+# the cargo of that toolchain, as the cargo of rustup does; with an empty name, PATH must
+# have a cargo. Each missing piece has its own message.
 #
 # Usage: scripts/check-toolchain.sh <toolchain name, or empty> <target>[,<target>...]
 
@@ -52,19 +52,14 @@ if ! command -v rustup >/dev/null; then
     exit 1
 fi
 
-# The cargo of rustup is a link to rustup itself, which runs the cargo of the toolchain;
-# another cargo would ignore the toolchain.
+# Whether this cargo runs the cargo of the toolchain is checked once rustup has the
+# toolchain, below.
 cargo=$(command -v cargo || true)
 if [[ -z $cargo ]]; then
     echo "the checks run Rust $toolchain through the cargo of rustup," \
         "and PATH has no cargo" >&2
     exit 1
 fi
-if [[ ! $cargo -ef $(command -v rustup) ]]; then
-    echo "the checks run Rust $toolchain through the cargo of rustup, and the cargo on" \
-        "PATH, $cargo, is another one; make RUST_TOOLCHAIN= runs them on that cargo" >&2
-    exit 1
-fi
 
 # rustup show prints the default host first, and then fails when RUSTUP_TOOLCHAIN names a
 # missing toolchain.
@@ -108,6 +103,26 @@ if ! grep --quiet --line-regexp --fixed-strings "rustc-$host" <<<"$listed_compon
     exit 1
 fi
 
+# The cargo of rustup runs the cargo of the toolchain that RUSTUP_TOOLCHAIN names, whatever
+# file it is: a link to rustup, a copy of it, or a script that runs it, as Homebrew installs
+# it. Another cargo ignores RUSTUP_TOOLCHAIN and prints its own version. rustup run runs the
+# cargo of the toolchain itself; -- hands rustup a name that starts with - as the toolchain.
+if ! toolchain_cargo=$(rustup run -- "$toolchain" cargo --version 2>&1); then
+    echo "rustup cannot run the cargo of Rust $toolchain; rustup run prints:" >&2
+    printf '%s\n' "$toolchain_cargo" >&2
+    exit 1
+fi
+path_cargo=$(RUSTUP_TOOLCHAIN=$toolchain "$cargo" --version 2>&1 || true)
+if [[ $path_cargo != "$toolchain_cargo" ]]; then
+    echo "the checks run Rust $toolchain through the cargo of rustup, and the cargo on" \
+        "PATH, $cargo, runs another one; make RUST_TOOLCHAIN= runs them on that cargo." \
+        "With RUSTUP_TOOLCHAIN=$toolchain it prints:" >&2
+    printf '%s\n' "$path_cargo" >&2
+    echo "and the cargo of Rust $toolchain prints:" >&2
+    printf '%s\n' "$toolchain_cargo" >&2
+    exit 1
+fi
+
 missing=()
 IFS=, read -ra wanted <<<"$targets"
 for target in "${wanted[@]}"; do
diff --git a/src/lib/chattr.rs b/src/lib/chattr.rs
index a8d6119..b72d913 100644
--- a/src/lib/chattr.rs
+++ b/src/lib/chattr.rs
@@ -146,6 +146,18 @@ impl EfivarsImmutabilityGuard {
             path,
         })
     }
+
+    /// Ends the guard of a file that was removed meanwhile: no file is left to make immutable.
+    #[cfg_attr(
+        not(test),
+        allow(
+            dead_code,
+            reason = "only the UEFI Shell build restores a FormSet's stores"
+        )
+    )]
+    pub fn file_removed(mut self) {
+        self.attrs_before_writing &= !FS_IMMUTABLE_FL;
+    }
 }
 
 impl Drop for EfivarsImmutabilityGuard {
diff --git a/src/lib/efi_status.rs b/src/lib/efi_status.rs
new file mode 100644
index 0000000..7d67d25
--- /dev/null
+++ b/src/lib/efi_status.rs
@@ -0,0 +1,86 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! EFI_STATUS (UEFI 2.11 Appendix D) as the code that drives protocol calls handles it on every
+//! host: the firmware's calls run only in the UEFI Shell build, their logic everywhere.
+
+use std::fmt;
+
+/// An EFI_STATUS: a UINTN whose top bit marks an error.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub(crate) struct EfiStatus(pub(crate) usize);
+
+impl EfiStatus {
+    const ERROR_BIT: usize = 1 << (usize::BITS - 1);
+
+    pub(crate) const SUCCESS: Self = Self(0);
+    pub(crate) const INVALID_PARAMETER: Self = Self(Self::ERROR_BIT | 2);
+    pub(crate) const UNSUPPORTED: Self = Self(Self::ERROR_BIT | 3);
+    pub(crate) const BUFFER_TOO_SMALL: Self = Self(Self::ERROR_BIT | 5);
+    pub(crate) const DEVICE_ERROR: Self = Self(Self::ERROR_BIT | 7);
+    pub(crate) const WRITE_PROTECTED: Self = Self(Self::ERROR_BIT | 8);
+    pub(crate) const OUT_OF_RESOURCES: Self = Self(Self::ERROR_BIT | 9);
+    pub(crate) const NOT_FOUND: Self = Self(Self::ERROR_BIT | 14);
+    pub(crate) const ACCESS_DENIED: Self = Self(Self::ERROR_BIT | 15);
+    pub(crate) const ABORTED: Self = Self(Self::ERROR_BIT | 21);
+    pub(crate) const SECURITY_VIOLATION: Self = Self(Self::ERROR_BIT | 26);
+
+    /// The names of the statuses above, which Display writes.
+    const NAMES: [(Self, &'static str); 11] = [
+        (Self::SUCCESS, "EFI_SUCCESS"),
+        (Self::INVALID_PARAMETER, "EFI_INVALID_PARAMETER"),
+        (Self::UNSUPPORTED, "EFI_UNSUPPORTED"),
+        (Self::BUFFER_TOO_SMALL, "EFI_BUFFER_TOO_SMALL"),
+        (Self::DEVICE_ERROR, "EFI_DEVICE_ERROR"),
+        (Self::WRITE_PROTECTED, "EFI_WRITE_PROTECTED"),
+        (Self::OUT_OF_RESOURCES, "EFI_OUT_OF_RESOURCES"),
+        (Self::NOT_FOUND, "EFI_NOT_FOUND"),
+        (Self::ACCESS_DENIED, "EFI_ACCESS_DENIED"),
+        (Self::ABORTED, "EFI_ABORTED"),
+        (Self::SECURITY_VIOLATION, "EFI_SECURITY_VIOLATION"),
+    ];
+}
+
+/// The status's name for those that NAMES lists, else its value in hex, as EFI_STATUS names a
+/// status by its value.
+impl fmt::Display for EfiStatus {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match Self::NAMES.iter().find(|(status, _)| status == self) {
+            Some((_, name)) => f.write_str(name),
+            None => write!(f, "EFI_STATUS {:#x}", self.0),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn names_known_statuses_and_shows_others_in_hex() {
+        let error_bit = 1usize << (usize::BITS - 1);
+        let cases = [
+            (EfiStatus(0), "EFI_SUCCESS".to_string()),
+            (EfiStatus(error_bit | 3), "EFI_UNSUPPORTED".to_string()),
+            (EfiStatus(error_bit | 14), "EFI_NOT_FOUND".to_string()),
+            (EfiStatus(error_bit | 21), "EFI_ABORTED".to_string()),
+            (
+                EfiStatus(error_bit | 30),
+                format!("EFI_STATUS {:#x}", error_bit | 30),
+            ),
+            (EfiStatus(7), "EFI_STATUS 0x7".to_string()),
+        ];
+        for (status, want) in cases {
+            assert_eq!(status.to_string(), want, "status {:#x}", status.0);
+        }
+    }
+}
diff --git a/src/lib/efi_variables.rs b/src/lib/efi_variables.rs
index 8f1026c..960804b 100644
--- a/src/lib/efi_variables.rs
+++ b/src/lib/efi_variables.rs
@@ -29,9 +29,12 @@ mod capsule_delivery;
 #[cfg(variable_data)]
 mod capsule_result;
 pub(crate) mod enhanced_authenticated;
-#[cfg(variable_data)]
+#[cfg(any(variable_data, variable_info))]
 mod json_bytes;
 
+#[cfg(any(variable_data, variable_info))]
+use std::fmt;
+
 #[cfg(all(variable_names, any(target_os = "uefi", test)))]
 use anyhow::anyhow;
 #[cfg(any(variable_names, variable_info))]
@@ -93,6 +96,8 @@ pub use capsule_result::ResultName;
 pub use capsule_result::Undecoded;
 #[cfg(configuration_tables)]
 pub(crate) use capsule_result::EFI_JSON_CAPSULE_RESULT_TABLE_GUID;
+#[cfg(variable_info)]
+pub use enhanced_authenticated::MetadataInfo;
 #[cfg(variable_data)]
 pub use json_bytes::TextOrHex;
 
@@ -113,9 +118,24 @@ use crate::hii::VariableInterface;
 #[cfg(any(variable_names, variable_info, variable_data))]
 use crate::hii::VariableKey;
 
+#[cfg(variable_data)]
+pub(crate) mod boot_manager;
+#[cfg(variable_data)]
+pub(crate) mod device_path;
 #[cfg(variable_data)]
 pub(crate) mod globals;
 #[cfg(variable_data)]
+pub(crate) mod key_option;
+#[cfg(variable_data)]
+#[cfg_attr(
+    not(any(target_os = "linux", target_os = "windows", test)),
+    allow(
+        dead_code,
+        reason = "only the Linux and Windows builds stage a set in a load option"
+    )
+)]
+pub(crate) mod load_option;
+#[cfg(variable_data)]
 pub(crate) mod secure_boot_mode;
 
 /// The size of EFI_TIME (UEFI 2.11 §8.3.1).
@@ -130,6 +150,41 @@ fn is_gmt_time_stamp(time_stamp: &[u8; EFI_TIME_SIZE]) -> bool {
     gmt_fields.iter().all(|&byte| byte == 0)
 }
 
+/// An EFI_TIME in GMT (is_gmt_time_stamp), as the TimeStamp of an authentication descriptor holds
+/// it.
+#[cfg(any(variable_data, variable_info))]
+#[derive(Debug, Clone, Copy)]
+struct GmtTime<'a>(&'a [u8; EFI_TIME_SIZE]);
+
+#[cfg(any(variable_data, variable_info))]
+impl GmtTime<'_> {
+    /// Its Year, Month, Day, Hour, Minute and Second, the fields that a time in GMT sets, in the
+    /// order that orders them chronologically.
+    fn fields(self) -> (u16, u8, u8, u8, u8, u8) {
+        let [y0, y1, month, day, hour, minute, second, ..] = *self.0;
+        (
+            u16::from_le_bytes([y0, y1]),
+            month,
+            day,
+            hour,
+            minute,
+            second,
+        )
+    }
+}
+
+/// As YYYY-MM-DDTHH:MM:SSZ.
+#[cfg(any(variable_data, variable_info))]
+impl fmt::Display for GmtTime<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let (year, month, day, hour, minute, second) = self.fields();
+        write!(
+            f,
+            "{year:04}-{month:02}-{day:02}T{hour:02}:{minute:02}:{second:02}Z"
+        )
+    }
+}
+
 /// EFI_JSON_CAPSULE_ID_GUID, the CapsuleGuid of a JSON capsule (UEFI 2.11 §23.5.1), which the
 /// result of its processing names too (§8.5.6.1.3).
 #[cfg(any(capsule_delivery, configuration_tables, variable_data))]
@@ -140,6 +195,15 @@ const EFI_JSON_CAPSULE_ID_GUID: Guid = Guid {
     data4: [0xbf, 0x4a, 0xde, 0x5e, 0x25, 0x2d, 0x61, 0xae],
 };
 
+/// The vendor GUID of uefisettings' own EFI variables.
+#[cfg(variable_data)]
+pub(crate) const UEFISETTINGS_VENDOR_GUID: Guid = Guid {
+    data1: 0xdd16_f539,
+    data2: 0x09ed,
+    data3: 0x41b9,
+    data4: [0x8b, 0x64, 0xd8, 0x5d, 0x6c, 0xd9, 0x3a, 0x8e],
+};
+
 /// GetNextVariableName() (UEFI 2.10 §8.2.2): the variables that a backend reaches, by name and
 /// vendor GUID.
 #[cfg(variable_names)]
@@ -148,6 +212,13 @@ pub(crate) trait VariableNames {
     fn variable_names(&self) -> Result<Vec<VariableKey>>;
 }
 
+#[cfg(variable_names)]
+impl<T: VariableNames + ?Sized> VariableNames for &T {
+    fn variable_names(&self) -> Result<Vec<VariableKey>> {
+        (**self).variable_names()
+    }
+}
+
 /// What one GetNextVariableName() call (UEFI 2.10 §8.2.2) did.
 #[cfg(all(variable_names, any(target_os = "uefi", test)))]
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -252,6 +323,25 @@ pub struct VariableInfo {
     pub attributes: u32,
     /// The size of its data, in bytes
     pub size: usize,
+    /// The EFI_VARIABLE_AUTHENTICATION_3 metadata before its data, if it has
+    /// EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS (UEFI 2.11 §8.2.1)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub metadata: Option<MetadataInfo>,
+}
+
+#[cfg(variable_info)]
+impl VariableInfo {
+    /// The VariableInfo of `key` from the `attributes` and `data` that GetVariable() returns
+    /// (UEFI 2.10 §8.2.1): their size, and the metadata that starts `data` if `attributes` say so
+    /// (MetadataInfo::of), but never `data`.
+    pub(crate) fn from_data(key: &VariableKey, attributes: u32, data: &[u8]) -> Self {
+        Self {
+            variable: key.to_string(),
+            attributes,
+            size: data.len(),
+            metadata: MetadataInfo::of(attributes, data),
+        }
+    }
 }
 
 /// GetVariable() (UEFI 2.10 §8.2.1) with the data, and SetVariable() (§8.2.3): a variable that a
@@ -265,6 +355,35 @@ pub(crate) trait VariableData {
     fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>>;
     /// Sets `key` to `contents`, creating it if missing.
     fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()>;
+    /// Deletes `key`, as SetVariable() without data does (UEFI 2.11 §8.2.3); fails with
+    /// VariableNotFound if the backend reaches no such variable.
+    #[cfg_attr(
+        not(any(target_os = "uefi", test)),
+        allow(
+            dead_code,
+            reason = "only the UEFI Shell build restores a FormSet's stores"
+        )
+    )]
+    fn delete_variable(&self, key: &VariableKey) -> Result<()>;
+}
+
+#[cfg(variable_data)]
+impl<T: VariableData + ?Sized> VariableData for &T {
+    fn interface(&self) -> VariableInterface {
+        (**self).interface()
+    }
+
+    fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
+        (**self).variable_data(key)
+    }
+
+    fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()> {
+        (**self).set_variable(key, contents)
+    }
+
+    fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+        (**self).delete_variable(key)
+    }
 }
 
 /// What SetVariable() returned, but EFI_SUCCESS, for a Secure Boot Mode transition that the
@@ -317,6 +436,11 @@ impl VariableContents {
     pub(crate) fn data(&self) -> &[u8] {
         &self.data
     }
+
+    /// Its data, moved out.
+    pub(crate) fn into_data(self) -> Vec<u8> {
+        self.data
+    }
 }
 
 /// Data that VariableContents refuses.
@@ -756,6 +880,7 @@ mod tests {
             variable: "MyIfrNVData-a04a27f4-df00-4d42-b552-39511302113d".to_string(),
             attributes: 7,
             size: 220,
+            metadata: None,
         };
 
         assert_eq!(
diff --git a/src/lib/efi_variables/authenticated.rs b/src/lib/efi_variables/authenticated.rs
index 0d7a625..45a9fac 100644
--- a/src/lib/efi_variables/authenticated.rs
+++ b/src/lib/efi_variables/authenticated.rs
@@ -30,6 +30,7 @@ pub(crate) mod signing;
 
 use std::fmt;
 
+use anyhow::Context;
 use anyhow::Result;
 use thiserror::Error;
 
@@ -41,8 +42,12 @@ pub use self::signing::SignatureDigest;
 use self::signing::Signer;
 pub use self::signing::TimeStamp;
 pub use self::signing::TimeStampError;
+use super::enhanced_authenticated::authentication_3_metadata;
 use super::enhanced_authenticated::authentication_3_value;
 use super::enhanced_authenticated::Freshness;
+use super::enhanced_authenticated::MetadataRefusal;
+use super::enhanced_authenticated::Nonce;
+use super::enhanced_authenticated::StoredFreshness;
 use super::globals::EFI_DEVICE_SECURITY_DATABASE;
 use super::globals::EFI_GLOBAL_VARIABLE;
 use super::globals::EFI_IMAGE_SECURITY_DATABASE;
@@ -196,7 +201,8 @@ pub(crate) struct EnhancedSignedWrite<'a> {
 
 /// Signs `write` with `signer` into an EFI_VARIABLE_AUTHENTICATION_3 (UEFI 2.11 §8.2.5) that
 /// carries the NewCert of `new_authority` if given, blinded over a ChaCha20Rng that `seed` seeds,
-/// and writes it, then the data. It refuses what write_enhanced refuses before it seeds, but its
+/// and writes it, then the data. It refuses what write_enhanced refuses, and what
+/// checked_freshness refuses against the variable, before it seeds, but its
 /// unsafe operations, which it checks after it signs, and returns as write_enhanced does; a
 /// failing seed source refuses before any write.
 pub(crate) fn sign_and_write_enhanced(
@@ -213,12 +219,16 @@ pub(crate) fn sign_and_write_enhanced(
     )?;
     refuse_enhanced_write(variables, write.key)?;
     refuse_enhanced_deletion(write.key, write.data, new_authority.is_some())?;
+    let stored = variables
+        .variable_data(write.key)
+        .with_context(|| format!("cannot check the write against EFI variable {}", write.key))?;
+    let freshness = checked_freshness(write.key, attributes, write.freshness, stored.as_ref())?;
     let mut rng = seeded_rng(seed)?;
     let payload = signer.authentication_3(
         &EnhancedWrite {
             key: write.key,
             attributes,
-            freshness: write.freshness,
+            freshness: &freshness,
             data: write.data,
         },
         new_authority,
@@ -228,6 +238,81 @@ pub(crate) fn sign_and_write_enhanced(
     write_checked(variables, write.key, &contents, write.unsafe_operations)
 }
 
+/// `freshness`, checked against `stored`, the variable `key` as GetVariable() returns it (UEFI
+/// 2.11 §8.2.1), before a write with `attributes`, as the firmware checks it: the same attributes
+/// but EFI_VARIABLE_APPEND_WRITE (§8.2.3), the same Type, a later TimeStamp and a nonce other
+/// than the variable's, unless all zero (§8.2.5). A nonce update signs the variable's nonce, the
+/// current one if not given (§8.2.5 step 3c); a create signs none.
+fn checked_freshness(
+    key: &VariableKey,
+    attributes: VariableAttributes,
+    freshness: &Freshness,
+    stored: Option<&VariableContents>,
+) -> Result<Freshness> {
+    let Some(stored) = stored else {
+        return match freshness.current_nonce() {
+            Some(_) => Err(SignedWriteRefusal::CurrentNonceOfCreate(key.clone()).into()),
+            None => Ok(freshness.clone()),
+        };
+    };
+    let held = stored
+        .attributes()
+        .difference(VariableAttributes::APPEND_WRITE);
+    let written = attributes.difference(VariableAttributes::APPEND_WRITE);
+    if held != written {
+        return Err(SignedWriteRefusal::OtherAttributes {
+            key: key.clone(),
+            held,
+            written,
+        }
+        .into());
+    }
+    let metadata = authentication_3_metadata(stored.data()).map_err(|refusal| {
+        SignedWriteRefusal::StoredMetadata {
+            key: key.clone(),
+            refusal,
+        }
+    })?;
+    match (freshness, metadata.freshness) {
+        (Freshness::TimeStamp(time_stamp), StoredFreshness::TimeStamp(time)) => {
+            let held =
+                TimeStamp::from_efi_time(time).ok_or(SignedWriteRefusal::StoredMetadata {
+                    key: key.clone(),
+                    refusal: MetadataRefusal::TimeStamp,
+                })?;
+            match *time_stamp > held {
+                true => Ok(freshness.clone()),
+                false => Err(SignedWriteRefusal::NotLater {
+                    key: key.clone(),
+                    held,
+                    written: *time_stamp,
+                }
+                .into()),
+            }
+        }
+        (Freshness::Nonce { nonce, current }, StoredFreshness::Nonce(held)) => {
+            let asks_the_firmware = nonce.as_ref().iter().all(|&byte| byte == 0);
+            if nonce.as_ref() == held.as_slice() && !asks_the_firmware {
+                return Err(SignedWriteRefusal::HeldNonce(key.clone()).into());
+            }
+            match current {
+                None => Ok(Freshness::Nonce {
+                    nonce: nonce.clone(),
+                    current: Some(Nonce::new(held)?),
+                }),
+                Some(current) if current.as_ref() == held.as_slice() => Ok(freshness.clone()),
+                Some(_) => Err(SignedWriteRefusal::OtherCurrentNonce(key.clone()).into()),
+            }
+        }
+        (Freshness::Nonce { .. }, StoredFreshness::TimeStamp(_)) => {
+            Err(SignedWriteRefusal::HeldTimeStampType(key.clone()).into())
+        }
+        (Freshness::TimeStamp(_), StoredFreshness::Nonce(_)) => {
+            Err(SignedWriteRefusal::HeldNonceType(key.clone()).into())
+        }
+    }
+}
+
 /// Refuses an EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS write of `key` through Linux's
 /// efivarfs, which refuses the attribute before the firmware sees it, and one of a Secure Boot
 /// Policy Variable, which takes only an EFI_VARIABLE_AUTHENTICATION_2 (UEFI 2.11 §3.3, §8.2.3).
@@ -403,6 +488,58 @@ enum SignedWriteRefusal {
          write does not do"
     )]
     EnhancedDelete(VariableKey),
+    #[error(
+        "EFI variable {key} has the attributes {held}, not {written}: SetVariable() refuses a \
+         rewrite with attributes other than these but APPEND_WRITE with EFI_INVALID_PARAMETER \
+         (UEFI 2.11 section 8.2.3)"
+    )]
+    OtherAttributes {
+        key: VariableKey,
+        held: VariableAttributes,
+        written: VariableAttributes,
+    },
+    #[error(
+        "EFI variable {key} holds EFI_VARIABLE_AUTHENTICATION_3 metadata that uefisettings does \
+         not take, so it cannot check the write against it: {refusal}"
+    )]
+    StoredMetadata {
+        key: VariableKey,
+        refusal: MetadataRefusal,
+    },
+    #[error(
+        "EFI variable {0} holds an EFI_VARIABLE_AUTHENTICATION_3 of Type TIMESTAMP (1), not NONCE \
+         (2), and the firmware verifies that the Types match (UEFI 2.11 section 8.2.5)"
+    )]
+    HeldTimeStampType(VariableKey),
+    #[error(
+        "EFI variable {0} holds an EFI_VARIABLE_AUTHENTICATION_3 of Type NONCE (2), not TIMESTAMP \
+         (1), and the firmware verifies that the Types match (UEFI 2.11 section 8.2.5)"
+    )]
+    HeldNonceType(VariableKey),
+    #[error(
+        "the TimeStamp {written} is not later than {held}, that of EFI variable {key}, as the \
+         firmware requires (UEFI 2.11 section 8.2.5)"
+    )]
+    NotLater {
+        key: VariableKey,
+        held: TimeStamp,
+        written: TimeStamp,
+    },
+    #[error(
+        "the nonce is the one that EFI variable {0} holds, for which SetVariable() returns \
+         EFI_INVALID_PARAMETER (UEFI 2.11 sections 8.2.3 and 8.2.5)"
+    )]
+    HeldNonce(VariableKey),
+    #[error(
+        "the current nonce given is not the one that EFI variable {0} holds, so the firmware \
+         would not verify the signature over it (UEFI 2.11 section 8.2.5)"
+    )]
+    OtherCurrentNonce(VariableKey),
+    #[error(
+        "EFI variable {0} does not exist, so its create signs no current nonce (UEFI 2.11 section \
+         8.2.5), and the firmware would not verify the signature over the one given"
+    )]
+    CurrentNonceOfCreate(VariableKey),
     #[error(
         "the payload holds {0} bytes, fewer than the {} of the TimeStamp and the AuthInfo header \
          of an EFI_VARIABLE_AUTHENTICATION_2 (UEFI 2.11 section 8.2.3)",
@@ -547,6 +684,9 @@ mod tests {
 
     use super::*;
     use crate::efi_variables::enhanced_authenticated::authentication_3_payload;
+    use crate::efi_variables::enhanced_authenticated::fixture::nonce_metadata;
+    use crate::efi_variables::enhanced_authenticated::fixture::nonce_metadata_of;
+    use crate::efi_variables::enhanced_authenticated::fixture::timestamp_metadata;
     use crate::efi_variables::enhanced_authenticated::fixture::win_certificate_of;
     use crate::efi_variables::enhanced_authenticated::Nonce;
     use crate::efi_variables::globals::tests::key;
@@ -1247,24 +1387,32 @@ mod tests {
         }
     }
 
-    /// VariableData whose every read fails, and which hold what is set.
-    struct UnreadableVariables(HeldVariables);
+    /// VariableData that hold what HeldVariables hold, but whose read of the variable named the
+    /// second field fails.
+    struct UnreadableVariable(HeldVariables, &'static str);
 
-    impl VariableData for UnreadableVariables {
+    impl VariableData for UnreadableVariable {
         fn interface(&self) -> VariableInterface {
             self.0.interface()
         }
 
         fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
-            Err(anyhow::anyhow!("cannot read EFI variable {key}"))
+            match key.name == self.1 {
+                true => Err(anyhow::anyhow!("cannot read EFI variable {key}")),
+                false => self.0.variable_data(key),
+            }
         }
 
         fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()> {
             self.0.set_variable(key, contents)
         }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            self.0.delete_variable(key)
+        }
     }
 
-    impl RecordsSets for UnreadableVariables {
+    impl RecordsSets for UnreadableVariable {
         fn sets(&self) -> Vec<VariableKey> {
             self.0.sets()
         }
@@ -1282,7 +1430,7 @@ mod tests {
             key("devdb", DEVDB_VENDOR),
         ] {
             check_setup_mode_writes(
-                || UnreadableVariables(HeldVariables::default()),
+                || UnreadableVariable(HeldVariables::default(), SETUP_MODE),
                 &key,
                 SetupModeReading::Unreadable(reason.to_owned()),
                 "SetupMode could not be read",
@@ -1305,6 +1453,10 @@ mod tests {
         fn set_variable(&self, key: &VariableKey, _contents: &VariableContents) -> Result<()> {
             Err(anyhow::anyhow!("cannot write EFI variable {key}"))
         }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            Err(anyhow::anyhow!("cannot delete EFI variable {key}"))
+        }
     }
 
     impl RecordsSets for FailingWrites {
@@ -1905,7 +2057,8 @@ mod tests {
 
     /// sign_and_write_enhanced writes, with ENHANCED_AUTHENTICATED_ACCESS added, the
     /// EFI_VARIABLE_AUTHENTICATION_3 that the key signs, with the NewCert of a new authority if
-    /// given, and then the data, which a certificate-only update leaves empty.
+    /// given, and then the data, which a certificate-only update leaves empty; a nonce update
+    /// updates a variable that holds the current nonce.
     #[test]
     fn sign_and_write_enhanced_writes_what_the_key_signs() {
         let signed = key("Signed", VENDOR);
@@ -1923,14 +2076,32 @@ mod tests {
             SignatureDigest::Sha256,
         )
         .expect("the new authority");
+        let current = nonce_metadata_of(&[7; 3], &[0], 60);
         let cases = [
-            ("timestamp", &timestamp, VALUE, None),
-            ("nonce update", &update, VALUE, None),
-            ("new authority", &update, VALUE, Some(&authority)),
-            ("certificate only", &update, &[][..], Some(&authority)),
+            ("timestamp", &timestamp, None, VALUE, None),
+            ("nonce update", &update, Some(&current), VALUE, None),
+            (
+                "new authority",
+                &update,
+                Some(&current),
+                VALUE,
+                Some(&authority),
+            ),
+            (
+                "certificate only",
+                &update,
+                Some(&current),
+                &[][..],
+                Some(&authority),
+            ),
         ];
-        for (case, freshness, data, new_authority) in cases {
-            let variables = firmware(Some(&[0]));
+        for (case, freshness, stored, data, new_authority) in cases {
+            let variables = match stored {
+                Some(metadata) => {
+                    holding(firmware(Some(&[0])), &signed, NV_BS_RT_ENHANCED, metadata)
+                }
+                None => firmware(Some(&[0])),
+            };
 
             sign_and_write_enhanced(
                 &variables,
@@ -2050,6 +2221,411 @@ mod tests {
         }
     }
 
+    /// `variables` holding, as `key` with `attributes`, `metadata` and then VALUE, as GetVariable()
+    /// returns a variable with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS (UEFI 2.11 §8.2.1).
+    fn holding(
+        variables: HeldVariables,
+        key: &VariableKey,
+        attributes: VariableAttributes,
+        metadata: &[u8],
+    ) -> HeldVariables {
+        let contents =
+            VariableContents::new(attributes, [metadata, VALUE].concat()).expect("hold data");
+        variables
+            .variables
+            .borrow_mut()
+            .insert(key.clone(), contents);
+        variables
+    }
+
+    /// The test nonce of `bytes`.
+    fn test_nonce(bytes: &[u8]) -> Nonce {
+        Nonce::new(bytes.to_vec()).expect("a test nonce")
+    }
+
+    /// The metadata of a nonce-type variable whose current nonce is 8 bytes of 0xA5.
+    fn stored_nonce_metadata() -> Vec<u8> {
+        nonce_metadata()
+    }
+
+    /// sign_and_write_enhanced checks the write against the variable before it seeds, as
+    /// GetVariable() returns its attributes and metadata (UEFI 2.11 §8.2.1): it refuses other
+    /// attributes than the variable's but EFI_VARIABLE_APPEND_WRITE (§8.2.3), metadata that it does
+    /// not take, another Type, a TimeStamp that is not later, with APPEND_WRITE too, which §8.2.5
+    /// does not exempt, and a nonce that is the variable's unless all zero (§8.2.5), a current
+    /// nonce other than the variable's, and one for a variable that does not exist; a write that it
+    /// takes, APPEND_WRITE too, then fails at the seed, and nothing is written.
+    #[test]
+    fn sign_and_write_enhanced_checks_the_stored_variable_before_seeding() {
+        let signed = key("Signed", VENDOR);
+        let time = |text: &str| Freshness::TimeStamp(text.parse().expect("a test TimeStamp"));
+        let nonce = |bytes: &[u8], current: Option<&[u8]>| Freshness::Nonce {
+            nonce: test_nonce(bytes),
+            current: current.map(test_nonce),
+        };
+        let stored_time = timestamp_metadata();
+        let stored_nonce = stored_nonce_metadata();
+        let stored_zero = nonce_metadata_of(&[0; 8], &[], 64);
+        let stored_part_zero = nonce_metadata_of(&[0, 0xA5, 0, 0], &[], 60);
+        let mut other_version = timestamp_metadata();
+        *other_version.first_mut().expect("a Version") = 2;
+        let nv_bs_enhanced = VariableAttributes::NON_VOLATILE
+            | VariableAttributes::BOOTSERVICE_ACCESS
+            | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS;
+        let unseeded =
+            "cannot seed RSA blinding from EFI_RNG_PROTOCOL: no handle has it: NOT_FOUND"
+                .to_owned();
+        let cases = [
+            (
+                "a create",
+                None,
+                time(signing::tests::TIME),
+                unseeded.clone(),
+            ),
+            (
+                "a later TimeStamp",
+                Some((NV_BS_RT_ENHANCED, &stored_time)),
+                time(signing::tests::TIME),
+                unseeded.clone(),
+            ),
+            (
+                "another nonce, the current one by default",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                nonce(&[9; 5], None),
+                unseeded.clone(),
+            ),
+            (
+                "another nonce and the current one",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                nonce(&[9; 5], Some(&[0xA5; 8])),
+                unseeded.clone(),
+            ),
+            (
+                "an all-zero nonce of the current one's size",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                nonce(&[0; 8], None),
+                unseeded.clone(),
+            ),
+            (
+                "an all-zero nonce, which asks the firmware for one, as the variable's",
+                Some((NV_BS_RT_ENHANCED, &stored_zero)),
+                nonce(&[0; 8], None),
+                unseeded.clone(),
+            ),
+            (
+                "the start of the variable's nonce",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                nonce(&[0xA5; 4], None),
+                unseeded.clone(),
+            ),
+            (
+                "other attributes",
+                Some((nv_bs_enhanced, &stored_time)),
+                time(signing::tests::TIME),
+                format!(
+                    "EFI variable {signed} has the attributes NON_VOLATILE | BOOTSERVICE_ACCESS | \
+                     ENHANCED_AUTHENTICATED_ACCESS, not NON_VOLATILE | BOOTSERVICE_ACCESS | \
+                     RUNTIME_ACCESS | ENHANCED_AUTHENTICATED_ACCESS: SetVariable() refuses a \
+                     rewrite with attributes other than these but APPEND_WRITE with \
+                     EFI_INVALID_PARAMETER (UEFI 2.11 section 8.2.3)"
+                ),
+            ),
+            (
+                "metadata that it does not take",
+                Some((NV_BS_RT_ENHANCED, &other_version)),
+                time(signing::tests::TIME),
+                format!(
+                    "EFI variable {signed} holds EFI_VARIABLE_AUTHENTICATION_3 metadata that \
+                     uefisettings does not take, so it cannot check the write against it: \
+                     EFI_VARIABLE_AUTHENTICATION_3 Version 2, not 1"
+                ),
+            ),
+            (
+                "a nonce for a timestamp-type variable",
+                Some((NV_BS_RT_ENHANCED, &stored_time)),
+                nonce(&[9; 5], None),
+                format!(
+                    "EFI variable {signed} holds an EFI_VARIABLE_AUTHENTICATION_3 of Type \
+                     TIMESTAMP (1), not NONCE (2), and the firmware verifies that the Types match \
+                     (UEFI 2.11 section 8.2.5)"
+                ),
+            ),
+            (
+                "a TimeStamp for a nonce-type variable",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                time(signing::tests::TIME),
+                format!(
+                    "EFI variable {signed} holds an EFI_VARIABLE_AUTHENTICATION_3 of Type NONCE \
+                     (2), not TIMESTAMP (1), and the firmware verifies that the Types match (UEFI \
+                     2.11 section 8.2.5)"
+                ),
+            ),
+            (
+                "the variable's TimeStamp",
+                Some((NV_BS_RT_ENHANCED, &stored_time)),
+                time("2026-11-06T12:00:00Z"),
+                format!(
+                    "the TimeStamp 2026-11-06T12:00:00Z is not later than \
+                     2026-11-06T12:00:00Z, that of EFI variable {signed}, as the firmware \
+                     requires (UEFI 2.11 section 8.2.5)"
+                ),
+            ),
+            (
+                "an earlier TimeStamp",
+                Some((NV_BS_RT_ENHANCED, &stored_time)),
+                time("2026-11-06T11:59:59Z"),
+                format!(
+                    "the TimeStamp 2026-11-06T11:59:59Z is not later than \
+                     2026-11-06T12:00:00Z, that of EFI variable {signed}, as the firmware \
+                     requires (UEFI 2.11 section 8.2.5)"
+                ),
+            ),
+            (
+                "the variable's nonce",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                nonce(&[0xA5; 8], None),
+                format!(
+                    "the nonce is the one that EFI variable {signed} holds, for which \
+                     SetVariable() returns EFI_INVALID_PARAMETER (UEFI 2.11 sections 8.2.3 and \
+                     8.2.5)"
+                ),
+            ),
+            (
+                "the variable's nonce, of zero and nonzero bytes",
+                Some((NV_BS_RT_ENHANCED, &stored_part_zero)),
+                nonce(&[0, 0xA5, 0, 0], None),
+                format!(
+                    "the nonce is the one that EFI variable {signed} holds, for which \
+                     SetVariable() returns EFI_INVALID_PARAMETER (UEFI 2.11 sections 8.2.3 and \
+                     8.2.5)"
+                ),
+            ),
+            (
+                "another current nonce",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                nonce(&[9; 5], Some(&[1; 8])),
+                format!(
+                    "the current nonce given is not the one that EFI variable {signed} holds, so \
+                     the firmware would not verify the signature over it (UEFI 2.11 section \
+                     8.2.5)"
+                ),
+            ),
+            (
+                "the start of the current nonce",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                nonce(&[9; 5], Some(&[0xA5; 4])),
+                format!(
+                    "the current nonce given is not the one that EFI variable {signed} holds, so \
+                     the firmware would not verify the signature over it (UEFI 2.11 section \
+                     8.2.5)"
+                ),
+            ),
+            (
+                "another nonce of the current one's size",
+                Some((NV_BS_RT_ENHANCED, &stored_nonce)),
+                nonce(&[0x5A; 8], None),
+                unseeded.clone(),
+            ),
+            (
+                "a current nonce for a create",
+                None,
+                nonce(&[9; 5], Some(&[0xA5; 8])),
+                format!(
+                    "EFI variable {signed} does not exist, so its create signs no current nonce \
+                     (UEFI 2.11 section 8.2.5), and the firmware would not verify the signature \
+                     over the one given"
+                ),
+            ),
+        ];
+        let signer = signing::tests::test_signer();
+        for (case, stored, freshness, refusal) in cases {
+            let variables = match stored {
+                Some((attributes, metadata)) => {
+                    holding(firmware(Some(&[0])), &signed, attributes, metadata)
+                }
+                None => firmware(Some(&[0])),
+            };
+
+            let error = sign_and_write_enhanced(
+                &variables,
+                &enhanced_signed_write(&signed, NV_BS_RT, VALUE, &freshness),
+                &signer,
+                None,
+                &mut signing::tests::FakeSeed(None),
+            )
+            .expect_err(case);
+
+            assert_eq!(format!("{error:#}"), refusal, "{case}");
+            assert_eq!(*variables.set.borrow(), [], "{case}: writes");
+        }
+
+        let appended = holding(
+            firmware(Some(&[0])),
+            &signed,
+            NV_BS_RT_ENHANCED,
+            &stored_time,
+        );
+        let error = sign_and_write_enhanced(
+            &appended,
+            &enhanced_signed_write(
+                &signed,
+                NV_BS_RT | VariableAttributes::APPEND_WRITE,
+                VALUE,
+                &time(signing::tests::TIME),
+            ),
+            &signer,
+            None,
+            &mut signing::tests::FakeSeed(None),
+        )
+        .expect_err("APPEND_WRITE");
+        assert_eq!(
+            format!("{error:#}"),
+            unseeded,
+            "APPEND_WRITE besides the variable's attributes"
+        );
+
+        let error = sign_and_write_enhanced(
+            &appended,
+            &enhanced_signed_write(
+                &signed,
+                NV_BS_RT | VariableAttributes::APPEND_WRITE,
+                VALUE,
+                &time("2026-11-06T12:00:00Z"),
+            ),
+            &signer,
+            None,
+            &mut signing::tests::FakeSeed(None),
+        )
+        .expect_err("APPEND_WRITE with the variable's TimeStamp");
+        assert_eq!(
+            format!("{error:#}"),
+            format!(
+                "the TimeStamp 2026-11-06T12:00:00Z is not later than 2026-11-06T12:00:00Z, that \
+                 of EFI variable {signed}, as the firmware requires (UEFI 2.11 section 8.2.5)"
+            ),
+            "APPEND_WRITE with the variable's TimeStamp, which section 8.2.5 does not exempt"
+        );
+
+        let error = sign_and_write_enhanced(
+            &appended,
+            &enhanced_signed_write(
+                &signed,
+                VariableAttributes::NON_VOLATILE | VariableAttributes::BOOTSERVICE_ACCESS,
+                VALUE,
+                &time(signing::tests::TIME),
+            ),
+            &signer,
+            None,
+            &mut signing::tests::FakeSeed(None),
+        )
+        .expect_err("fewer attributes");
+        assert_eq!(
+            format!("{error:#}"),
+            format!(
+                "EFI variable {signed} has the attributes NON_VOLATILE | BOOTSERVICE_ACCESS | \
+                 RUNTIME_ACCESS | ENHANCED_AUTHENTICATED_ACCESS, not NON_VOLATILE | \
+                 BOOTSERVICE_ACCESS | ENHANCED_AUTHENTICATED_ACCESS: SetVariable() refuses a \
+                 rewrite with attributes other than these but APPEND_WRITE with \
+                 EFI_INVALID_PARAMETER (UEFI 2.11 section 8.2.3)"
+            ),
+            "attributes of the variable that the write lacks"
+        );
+        assert_eq!(*appended.set.borrow(), [], "fewer attributes: writes");
+    }
+
+    /// sign_and_write_enhanced refuses a write of a variable that it cannot read, as it checks
+    /// the write against it, with the flag too, and writes nothing.
+    #[test]
+    fn sign_and_write_enhanced_refuses_a_variable_that_it_cannot_read() {
+        let signed = key("Signed", VENDOR);
+        let freshness =
+            Freshness::TimeStamp(signing::tests::TIME.parse().expect("the test TimeStamp"));
+        let signer = signing::tests::test_signer();
+        for grant in GRANTS {
+            let variables = UnreadableVariable(firmware(Some(&[0])), "Signed");
+
+            let error = sign_and_write_enhanced(
+                &variables,
+                &EnhancedSignedWrite {
+                    unsafe_operations: grant,
+                    ..enhanced_signed_write(&signed, NV_BS_RT, VALUE, &freshness)
+                },
+                &signer,
+                None,
+                &mut signing::tests::FakeSeed(Some(1)),
+            )
+            .expect_err("an unreadable variable");
+
+            assert_eq!(
+                format!("{error:#}"),
+                format!(
+                    "cannot check the write against EFI variable {signed}: cannot read EFI \
+                     variable {signed}"
+                ),
+                "{grant:?}"
+            );
+            assert_eq!(variables.sets(), [], "{grant:?}: writes");
+        }
+    }
+
+    /// sign_and_write_enhanced signs, after the data of a nonce-type update without a current
+    /// nonce, the one that the variable holds (UEFI 2.11 §8.2.5 step 3c), as its metadata gives it
+    /// (§8.2.1), not none.
+    #[test]
+    fn sign_and_write_enhanced_signs_the_stored_nonce_by_default() {
+        let signed = key("Signed", VENDOR);
+        let signer = signing::tests::test_signer();
+        let variables = holding(
+            firmware(Some(&[0])),
+            &signed,
+            NV_BS_RT_ENHANCED,
+            &stored_nonce_metadata(),
+        );
+        let given = Freshness::Nonce {
+            nonce: test_nonce(&[9; 5]),
+            current: None,
+        };
+
+        sign_and_write_enhanced(
+            &variables,
+            &enhanced_signed_write(&signed, NV_BS_RT, VALUE, &given),
+            &signer,
+            None,
+            &mut signing::tests::FakeSeed(Some(1)),
+        )
+        .expect("the update");
+
+        let signed_with = |current: Option<&[u8]>| {
+            let freshness = Freshness::Nonce {
+                nonce: test_nonce(&[9; 5]),
+                current: current.map(test_nonce),
+            };
+            signer
+                .authentication_3(
+                    &EnhancedWrite {
+                        key: &signed,
+                        attributes: NV_BS_RT_ENHANCED,
+                        freshness: &freshness,
+                        data: VALUE,
+                    },
+                    None,
+                    &mut rand_chacha::ChaCha20Rng::seed_from_u64(0),
+                )
+                .expect("sign")
+        };
+        let held_payload = held(&variables, &signed);
+        assert_eq!(
+            held_payload,
+            written(0x87, &signed_with(Some(&[0xA5; 8]))),
+            "signed over the current nonce"
+        );
+        assert_ne!(
+            held_payload,
+            written(0x87, &signed_with(None)),
+            "not signed without it"
+        );
+    }
+
     /// The refusal of a write of `key`, a device signature database, while SetupMode is 1.
     fn device_database_refusal(key: &VariableKey) -> String {
         format!(
@@ -2124,7 +2700,8 @@ mod tests {
 
     /// sign_and_write_enhanced refuses devdb while SetupMode is 1 unless allowed, after it signs,
     /// as write_signed does: the firmware may not check the signature (UEFI 2.11 §32.6.3).
-    /// Without a seed source it fails at the seed, with the flag and without, reading no
+    /// Without a seed source it fails at the seed, with the flag and without, reading devdb, which
+    /// it checks the write against, and no
     /// SetupMode. It writes devdb when SetupMode is 0 or absent, lifting nothing, or when
     /// allowed, lifting the write.
     #[test]
@@ -2167,7 +2744,7 @@ mod tests {
             );
             assert_eq!(
                 *unseeded.read.borrow(),
-                [],
+                std::slice::from_ref(&devdb),
                 "{grant:?} without a seed source: reads"
             );
         }
diff --git a/src/lib/efi_variables/authenticated/signing.rs b/src/lib/efi_variables/authenticated/signing.rs
index ed65fad..f764b89 100644
--- a/src/lib/efi_variables/authenticated/signing.rs
+++ b/src/lib/efi_variables/authenticated/signing.rs
@@ -22,6 +22,7 @@
 //! decoded bytes in freed memory, as pem-rfc7468 0.7 decodes into a plain Vec that der 0.7 drops
 //! on the error: accepted residuals.
 
+use std::cmp::Ordering;
 use std::fmt;
 use std::str::FromStr;
 use std::time::Duration;
@@ -68,6 +69,7 @@ use x509_cert::spki::AlgorithmIdentifierOwned;
 use x509_cert::Certificate;
 use zeroize::Zeroizing;
 
+use super::is_gmt_time_stamp;
 use super::CERTIFICATE_HEADER_SIZE;
 use super::EFI_CERT_TYPE_PKCS7_GUID;
 use super::EFI_TIME_SIZE;
@@ -76,6 +78,7 @@ use super::WIN_CERT_TYPE_EFI_GUID;
 use crate::efi_variables::enhanced_authenticated::authentication_3_payload;
 use crate::efi_variables::enhanced_authenticated::Freshness;
 use crate::efi_variables::enhanced_authenticated::MetadataTooLarge;
+use crate::efi_variables::GmtTime;
 use crate::hii::VariableAttributes;
 use crate::hii::VariableKey;
 use crate::secret_file::Secret;
@@ -126,11 +129,21 @@ impl TimeStamp {
         ))
     }
 
+    /// The EFI_TIME `time` if in GMT, as the metadata of a variable holds it (UEFI 2.11 §8.2.1).
+    pub(crate) fn from_efi_time(time: [u8; EFI_TIME_SIZE]) -> Option<Self> {
+        is_gmt_time_stamp(&time).then_some(Self(time))
+    }
+
     /// The EFI_TIME.
     pub(crate) fn as_bytes(&self) -> &[u8; EFI_TIME_SIZE] {
         &self.0
     }
 
+    /// The EFI_TIME, in GMT.
+    fn gmt_time(&self) -> GmtTime<'_> {
+        GmtTime(&self.0)
+    }
+
     /// The EFI_TIME of `year` and its month, day, hour, minute and second, in GMT.
     fn of(year: u16, [month, day, hour, minute, second]: [u8; 5]) -> Self {
         let [y0, y1] = year.to_le_bytes();
@@ -187,14 +200,25 @@ impl FromStr for TimeStamp {
     }
 }
 
+/// Chronological, as SetVariable() wants a TimeStamp "chronologically greater" than the variable's
+/// (UEFI 2.11 §8.2.5). It compares GmtTime::fields only, while the derived Eq compares all 16
+/// bytes: the two agree because every constructor (of, ZERO, from_efi_time) leaves Pad1 through
+/// Pad2 zero.
+impl Ord for TimeStamp {
+    fn cmp(&self, other: &Self) -> Ordering {
+        self.gmt_time().fields().cmp(&other.gmt_time().fields())
+    }
+}
+
+impl PartialOrd for TimeStamp {
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
 impl fmt::Display for TimeStamp {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let [y0, y1, month, day, hour, minute, second, ..] = self.0;
-        let year = u16::from_le_bytes([y0, y1]);
-        write!(
-            f,
-            "{year:04}-{month:02}-{day:02}T{hour:02}:{minute:02}:{second:02}Z"
-        )
+        self.gmt_time().fmt(f)
     }
 }
 
@@ -1002,6 +1026,40 @@ pub(crate) mod tests {
         );
     }
 
+    /// TimeStamps order chronologically, by Year as a number, then Month, Day, Hour, Minute and
+    /// Second, and from_efi_time takes an EFI_TIME in GMT only.
+    #[test]
+    fn time_stamps_order_chronologically() {
+        let stamp = |text: &str| text.parse::<TimeStamp>().expect("a test TimeStamp");
+        for (earlier, later) in [
+            ("2026-11-07T00:00:00Z", "2026-11-07T00:00:01Z"),
+            ("2026-11-07T00:00:59Z", "2026-11-07T00:01:00Z"),
+            ("2026-11-07T00:59:59Z", "2026-11-07T01:00:00Z"),
+            ("2026-11-06T23:59:59Z", "2026-11-07T00:00:00Z"),
+            ("2026-01-31T00:00:00Z", "2026-02-01T00:00:00Z"),
+            ("2026-12-31T23:59:59Z", "2027-01-01T00:00:00Z"),
+            ("2303-12-31T23:59:59Z", "2304-01-01T00:00:00Z"),
+        ] {
+            assert!(stamp(earlier) < stamp(later), "{earlier} before {later}");
+            assert!(stamp(later) > stamp(earlier), "{later} after {earlier}");
+        }
+        assert_eq!(
+            stamp(TIME).cmp(&stamp(TIME)),
+            Ordering::Equal,
+            "{TIME} and itself"
+        );
+
+        let gmt = TimeStamp::from_efi_time(*stamp(TIME).as_bytes());
+        let mut zoned = *stamp(TIME).as_bytes();
+        zoned[12] = 60;
+        assert_eq!(gmt, Some(stamp(TIME)), "{TIME} as an EFI_TIME");
+        assert_eq!(
+            TimeStamp::from_efi_time(zoned),
+            None,
+            "an EFI_TIME with a TimeZone"
+        );
+    }
+
     /// digest_input serializes VariableName as UCS-2 without its NUL, VendorGuid in EFI_GUID
     /// order, Attributes, TimeStamp and the data, and refuses a name outside UCS-2.
     #[test]
diff --git a/src/lib/efi_variables/boot_manager.rs b/src/lib/efi_variables/boot_manager.rs
new file mode 100644
index 0000000..c622438
--- /dev/null
+++ b/src/lib/efi_variables/boot_manager.rs
@@ -0,0 +1,1247 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The variables of the boot manager (UEFI 2.11 §3.1) that globals.rs leaves out, decoded as
+//! variable get prints them: the load options Boot####, Driver####, SysPrep####,
+//! PlatformRecovery#### and OsRecovery#### (§3.1.3, §3.4.1), the hot keys Key#### (§3.1.6) and
+//! the console device paths ConIn, ConOut, ErrOut, ConInDev, ConOutDev and ErrOutDev (§3.3);
+//! and those that the OS writes, as attributes.rs writes them.
+
+mod attributes;
+mod consoles;
+mod creation;
+mod hot_keys;
+
+use std::fmt;
+
+use anyhow::anyhow;
+use anyhow::Context;
+use anyhow::Result;
+use serde::ser::SerializeMap;
+use serde::Serialize;
+use serde::Serializer;
+use thiserror::Error;
+
+use super::device_path;
+use super::enhanced_authenticated::metadata_end;
+use super::enhanced_authenticated::MetadataRefusal;
+use super::globals::lower_hex;
+use super::globals::read_global;
+use super::globals::serialize_bits;
+use super::globals::BootOptionSupport;
+use super::globals::GlobalContents;
+use super::globals::GlobalValue;
+use super::globals::GlobalVariable;
+use super::globals::LoadOptionKind;
+use super::globals::LoadOptionName;
+use super::globals::EFI_GLOBAL_VARIABLE;
+use super::key_option::InputKey;
+use super::key_option::KeyModifier;
+use super::key_option::KeyModifiers;
+use super::key_option::KeyOption;
+use super::load_option::FilePathList;
+use super::load_option::LoadOption;
+use super::load_option::LoadOptionAttributes;
+use super::VariableContents;
+use super::VariableData;
+#[cfg(variable_names)]
+use super::VariableNames;
+use crate::hii::package::Guid;
+use crate::hii::VariableAttributes;
+use crate::hii::VariableKey;
+
+pub(crate) use attributes::set_attributes;
+pub use attributes::AttributeChange;
+pub use attributes::AttributesSet;
+pub use attributes::HotKeysFollowing;
+pub(crate) use consoles::set_device_path;
+pub use consoles::DevicePathSet;
+pub(crate) use creation::create_load_option;
+pub use creation::LoadOptionCreated;
+pub use creation::NewLoadOption;
+pub(crate) use hot_keys::create_key;
+pub use hot_keys::HotKeyCreated;
+pub use hot_keys::NewHotKey;
+
+/// The name of the hot key variables before their option number (UEFI 2.11 §3.1.6)
+const HOT_KEY_PREFIX: &str = "Key";
+/// The Attributes bits of a load option that UEFI 2.11 §3.1.3 defines: LOAD_OPTION_ACTIVE,
+/// LOAD_OPTION_FORCE_RECONNECT, LOAD_OPTION_HIDDEN and the LOAD_OPTION_CATEGORY field
+const DEFINED_ATTRIBUTES: LoadOptionAttributes =
+    LoadOptionAttributes::from_bits_retain(0x0000_1F0B);
+/// LOAD_OPTION_CATEGORY, a field whose values but LOAD_OPTION_CATEGORY_BOOT (0) and
+/// LOAD_OPTION_CATEGORY_APP (0x100) are reserved
+const CATEGORY: LoadOptionAttributes = LoadOptionAttributes::from_bits_retain(0x0000_1F00);
+/// NV, BS, RT: the attributes of the load options, hot keys, ConIn, ConOut and ErrOut in UEFI 2.11
+/// Table 3.1, which the subcommands create them with
+const BOOT_MANAGER_ATTRIBUTES: VariableAttributes = VariableAttributes::NON_VOLATILE
+    .union(VariableAttributes::BOOTSERVICE_ACCESS)
+    .union(VariableAttributes::RUNTIME_ACCESS);
+/// The variable that tells what the boot manager supports (UEFI 2.11 §3.1.4)
+const BOOT_OPTION_SUPPORT: &str = "BootOptionSupport";
+
+/// The kinds of load option variables (UEFI 2.11 §3.1.3).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum OptionKind {
+    /// Boot####, Driver#### and SysPrep####, which the order variables list
+    Ordered(LoadOptionKind),
+    /// PlatformRecovery####, which "are only modified by firmware and are read-only to the OS"
+    /// (UEFI 2.11 §3.3)
+    PlatformRecovery,
+    /// OsRecovery####, of the vendor GUIDs that OsRecoveryOrder lists (UEFI 2.11 §3.4.1)
+    OsRecovery,
+}
+
+impl OptionKind {
+    const ALL: [Self; 5] = [
+        Self::Ordered(LoadOptionKind::Boot),
+        Self::Ordered(LoadOptionKind::Driver),
+        Self::Ordered(LoadOptionKind::SysPrep),
+        Self::PlatformRecovery,
+        Self::OsRecovery,
+    ];
+
+    /// The name of the variables of this kind before their option number.
+    fn prefix(self) -> &'static str {
+        match self {
+            Self::Ordered(kind) => kind.prefix(),
+            Self::PlatformRecovery => "PlatformRecovery",
+            Self::OsRecovery => "OsRecovery",
+        }
+    }
+}
+
+/// A load option variable, such as Boot0001.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct OptionName {
+    pub(crate) kind: OptionKind,
+    pub(crate) number: u16,
+}
+
+impl fmt::Display for OptionName {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}{:04X}", self.kind.prefix(), self.number)
+    }
+}
+
+/// A variable that holds a console device path (UEFI 2.11 §3.3).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Console {
+    ConIn,
+    ConOut,
+    ErrOut,
+    /// ConInDev, ConOutDev and ErrOutDev, which "are volatile, and are set dynamically on every
+    /// boot" (UEFI 2.11 §3.3)
+    ConInDev,
+    ConOutDev,
+    ErrOutDev,
+}
+
+impl Console {
+    const ALL: [Self; 6] = [
+        Self::ConIn,
+        Self::ConOut,
+        Self::ErrOut,
+        Self::ConInDev,
+        Self::ConOutDev,
+        Self::ErrOutDev,
+    ];
+
+    fn name(self) -> &'static str {
+        match self {
+            Self::ConIn => "ConIn",
+            Self::ConOut => "ConOut",
+            Self::ErrOut => "ErrOut",
+            Self::ConInDev => "ConInDev",
+            Self::ConOutDev => "ConOutDev",
+            Self::ErrOutDev => "ErrOutDev",
+        }
+    }
+}
+
+/// A variable that this module decodes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum BootManagerVariable {
+    LoadOption(OptionName),
+    /// Key####, by its option number
+    HotKey(u16),
+    Console(Console),
+}
+
+impl BootManagerVariable {
+    /// The variable that `name` names, if this module decodes it.
+    pub(crate) fn parse(name: &str) -> Option<Self> {
+        if let Some(console) = Console::ALL
+            .into_iter()
+            .find(|console| console.name() == name)
+        {
+            return Some(Self::Console(console));
+        }
+        if let Some(number) = option_number(name, HOT_KEY_PREFIX) {
+            return Some(Self::HotKey(number));
+        }
+        OptionKind::ALL.into_iter().find_map(|kind| {
+            option_number(name, kind.prefix())
+                .map(|number| Self::LoadOption(OptionName { kind, number }))
+        })
+    }
+
+    /// The variable's key: of the vendor GUID `vendor`, which an OsRecovery#### needs and any
+    /// other may give if it is EFI_GLOBAL_VARIABLE.
+    fn key(self, vendor: Option<Guid>) -> Result<VariableKey, VendorError> {
+        let name = self.to_string();
+        let guid = match (self, vendor) {
+            (
+                Self::LoadOption(OptionName {
+                    kind: OptionKind::OsRecovery,
+                    ..
+                }),
+                vendor,
+            ) => vendor.ok_or(VendorError::Missing(name.clone()))?,
+            (_, Some(vendor)) if vendor != EFI_GLOBAL_VARIABLE => {
+                return Err(VendorError::Foreign { name, vendor });
+            }
+            (_, Some(_) | None) => EFI_GLOBAL_VARIABLE,
+        };
+        Ok(VariableKey { name, guid })
+    }
+}
+
+impl fmt::Display for BootManagerVariable {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::LoadOption(option) => option.fmt(f),
+            Self::HotKey(number) => write!(f, "{HOT_KEY_PREFIX}{number:04X}"),
+            Self::Console(console) => f.write_str(console.name()),
+        }
+    }
+}
+
+/// The Boot####, Driver#### or SysPrep#### that `name` names, which `command` writes.
+fn written_option(name: &str, command: &'static str) -> Result<LoadOptionName, OptionRefusal> {
+    let refused = name.to_owned();
+    match BootManagerVariable::parse(name) {
+        Some(BootManagerVariable::LoadOption(OptionName {
+            kind: OptionKind::Ordered(kind),
+            number,
+        })) => Ok(LoadOptionName { kind, number }),
+        Some(BootManagerVariable::LoadOption(OptionName {
+            kind: OptionKind::PlatformRecovery,
+            ..
+        })) => Err(OptionRefusal::PlatformRecovery(command, refused)),
+        Some(BootManagerVariable::LoadOption(OptionName {
+            kind: OptionKind::OsRecovery,
+            ..
+        })) => Err(OptionRefusal::OsRecovery(command, refused)),
+        Some(BootManagerVariable::HotKey(_) | BootManagerVariable::Console(_)) | None => {
+            Err(OptionRefusal::NotLoadOption(command, refused))
+        }
+    }
+}
+
+/// Refuses `key`, before any write, if `attributes` hold
+/// EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS or
+/// EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS: SetVariable() then takes only an
+/// EFI_VARIABLE_AUTHENTICATION_3 or EFI_VARIABLE_AUTHENTICATION_2 descriptor (UEFI 2.11 §8.2.3).
+fn refuse_authenticated(
+    key: &VariableKey,
+    attributes: VariableAttributes,
+) -> Result<(), AuthenticatedRefusal> {
+    match attributes.intersects(
+        VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS
+            | VariableAttributes::TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
+    ) {
+        true => Err(AuthenticatedRefusal(key.clone())),
+        false => Ok(()),
+    }
+}
+
+/// A variable that the boot manager's writes refuse, as only a signed write sets it.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error(
+    "EFI variable {0} has ENHANCED_AUTHENTICATED_ACCESS or TIME_BASED_AUTHENTICATED_WRITE_ACCESS: \
+     SetVariable() writes it only with an EFI_VARIABLE_AUTHENTICATION_3 or \
+     EFI_VARIABLE_AUTHENTICATION_2 descriptor (UEFI 2.11 section 8.2.3), as variable write-signed \
+     writes it"
+)]
+struct AuthenticatedRefusal(VariableKey);
+
+/// The option number of `text`, `prefix` and then four digits "in printable hexadecimal
+/// representation using the digits 0-9, and the upper case versions of the characters A-F"
+/// (UEFI 2.11 §3.1.1), as Boot0001 has.
+pub(super) fn option_number(text: &str, prefix: &str) -> Option<u16> {
+    text.strip_prefix(prefix)
+        .filter(|digits| {
+            digits.len() == 4
+                && digits
+                    .bytes()
+                    .all(|byte| matches!(byte, b'0'..=b'9' | b'A'..=b'F'))
+        })
+        .and_then(|digits| u16::from_str_radix(digits, 16).ok())
+}
+
+/// The names of the variables of this module, comma-separated, such as Boot####.
+pub(super) fn variable_names() -> String {
+    OptionKind::ALL
+        .map(OptionKind::prefix)
+        .into_iter()
+        .chain([HOT_KEY_PREFIX])
+        .map(|prefix| format!("{prefix}####"))
+        .chain(Console::ALL.map(|console| console.name().to_owned()))
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
+/// The Key#### variable `number`.
+fn hot_key_variable(number: u16) -> VariableKey {
+    VariableKey {
+        name: format!("{HOT_KEY_PREFIX}{number:04X}"),
+        guid: EFI_GLOBAL_VARIABLE,
+    }
+}
+
+/// The Key#### variables that a backend reaches, by option number, or that it cannot list them.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum HotKeyListing {
+    #[cfg_attr(
+        all(not(variable_names), not(test)),
+        allow(dead_code, reason = "the Windows build cannot list them")
+    )]
+    Listed(Vec<u16>),
+    /// On Windows, whose calls reach a variable by its name only
+    #[cfg_attr(
+        all(variable_names, not(test)),
+        allow(dead_code, reason = "only the Windows build cannot list them")
+    )]
+    Unlisted,
+}
+
+/// The Key#### variables of EFI_GLOBAL_VARIABLE that `names` list.
+#[cfg(variable_names)]
+pub(crate) fn hot_key_listing(names: &impl VariableNames) -> Result<HotKeyListing> {
+    Ok(HotKeyListing::Listed(
+        names
+            .variable_names()?
+            .into_iter()
+            .filter(|key| key.guid == EFI_GLOBAL_VARIABLE)
+            .filter_map(|key| option_number(&key.name, HOT_KEY_PREFIX))
+            .collect(),
+    ))
+}
+
+/// The variable `variable` that `variables` hold, of the vendor GUID `vendor` if given, decoded:
+/// the bytes after the metadata that metadata_end finds by its attributes, as read_global
+/// decodes the others (UEFI 2.11 §8.2.1).
+pub(crate) fn read(
+    variables: &impl VariableData,
+    variable: BootManagerVariable,
+    vendor: Option<Guid>,
+) -> Result<GlobalVariable> {
+    let key = variable.key(vendor)?;
+    let contents = variables
+        .variable_data(&key)?
+        .map(|contents| {
+            let value = value_after_metadata(&contents)
+                .map_err(anyhow::Error::from)
+                .and_then(|data| match variable {
+                    BootManagerVariable::LoadOption(_) => {
+                        load_option_data(data).map(GlobalValue::LoadOptionData)
+                    }
+                    BootManagerVariable::HotKey(_) => {
+                        hot_key(variables, data).map(GlobalValue::HotKey)
+                    }
+                    BootManagerVariable::Console(_) => {
+                        console_path(data).map(GlobalValue::DevicePath)
+                    }
+                })
+                .with_context(|| format!("EFI variable {key} is malformed"))?;
+            anyhow::Ok(GlobalContents {
+                attributes: contents.attributes().bits(),
+                value,
+            })
+        })
+        .transpose()?;
+    Ok(GlobalVariable {
+        variable: key.to_string(),
+        contents,
+    })
+}
+
+/// The value of `contents`, a variable of the boot manager: its data after the
+/// EFI_VARIABLE_AUTHENTICATION_3 metadata that metadata_end finds by its attributes (UEFI 2.11
+/// §8.2.1).
+fn value_after_metadata(contents: &VariableContents) -> Result<&[u8], MetadataRefusal> {
+    let data = contents.data();
+    metadata_end(contents.attributes().bits(), data)
+        .and_then(|end| data.get(end..).ok_or(MetadataRefusal::truncated(data)))
+}
+
+/// What BootOptionSupport tells that `variables` hold; when it is absent, no flag and a count of
+/// 0, as of a boot manager that supports none of what it tells.
+fn boot_option_support(variables: &impl VariableData) -> Result<BootOptionSupport> {
+    let global = read_global(variables, BOOT_OPTION_SUPPORT, None)?;
+    match global.contents.map(|contents| contents.value) {
+        None => Ok(BootOptionSupport::from(0)),
+        Some(GlobalValue::BootOptionSupport(support)) => Ok(support),
+        Some(other) => Err(anyhow!("{BOOT_OPTION_SUPPORT} decoded as {other:?}")),
+    }
+}
+
+/// The device paths of a load option or console variable: texts, as variable get shows them, or
+/// files of their bytes, an EFI_DEVICE_PATH_PROTOCOL each, written as they are.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum DevicePathSource {
+    Texts(Vec<String>),
+    Bytes(Vec<Vec<u8>>),
+}
+
+impl DevicePathSource {
+    /// Their bytes, packed as a FilePathList; each file's must be device paths that decode.
+    fn file_path_list(&self) -> Result<FilePathList> {
+        let mut bytes = Vec::new();
+        match self {
+            Self::Texts(texts) => {
+                for text in texts {
+                    let path = device_path::from_text(text)
+                        .with_context(|| format!("--device-path {text:?}"))?;
+                    bytes.extend(path);
+                }
+            }
+            Self::Bytes(paths) => {
+                for (index, path) in paths.iter().enumerate() {
+                    FilePathList::try_from(path.as_slice())
+                        .with_context(|| format!("--device-path-file #{}", index + 1))?;
+                    bytes.extend(path);
+                }
+            }
+        }
+        Ok(FilePathList::try_from(bytes.as_slice())?)
+    }
+}
+
+/// The EFI_LOAD_OPTION of `data`, as variable get shows it.
+fn load_option_data(data: &[u8]) -> Result<LoadOptionData> {
+    let option = LoadOption::decode(data)?;
+    let device_paths = device_path::device_paths(option.file_paths.as_ref())?
+        .into_iter()
+        .map(DevicePathText::of)
+        .collect();
+    Ok(LoadOptionData {
+        attributes: option.attributes.bits(),
+        description: option.description.as_ref().to_owned(),
+        device_paths,
+        optional_data: option.optional_data,
+    })
+}
+
+/// The EFI_KEY_OPTION of `data`, as variable get shows it, its BootOptionCrc checked against the
+/// Boot#### that `variables` hold.
+fn hot_key(variables: &impl VariableData, data: &[u8]) -> Result<HotKey> {
+    let option = KeyOption::decode(data)?;
+    let boot_option = LoadOptionName {
+        kind: LoadOptionKind::Boot,
+        number: option.boot_option,
+    };
+    let crc_matches = variables
+        .variable_data(&boot_option.key())?
+        .is_some_and(|boot| value_after_metadata(&boot).is_ok_and(|value| option.matches(value)));
+    Ok(HotKey {
+        revision: option.revision(),
+        modifiers: option.modifiers().bits(),
+        keys: option.keys,
+        boot_option,
+        crc_matches,
+    })
+}
+
+/// The one device path of a console variable's `data`.
+fn console_path(data: &[u8]) -> Result<DevicePathText> {
+    match device_path::device_paths(data)?.as_slice() {
+        [path] => Ok(DevicePathText::of(path)),
+        paths => Err(MalformedConsole(paths.len()).into()),
+    }
+}
+
+/// A load option as variable get shows it (UEFI 2.11 §3.1.3).
+#[non_exhaustive]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct LoadOptionData {
+    /// Attributes, its reserved bits kept
+    pub attributes: u32,
+    /// Description, each CHAR16 that is a surrogate as U+FFFD
+    pub description: String,
+    /// The device paths of FilePathList
+    pub device_paths: Vec<DevicePathText>,
+    /// OptionalData, the bytes that the boot manager passes to the image
+    pub optional_data: Vec<u8>,
+}
+
+/// Attributes as the names of LoadOptionFlag, then each undefined bit in hex, and the
+/// LOAD_OPTION_CATEGORY field as the name of its LoadOptionCategory, else in hex; OptionalData
+/// in hex.
+impl Serialize for LoadOptionData {
+    fn serialize<S: Serializer>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error> {
+        let mut map = serializer.serialize_map(None)?;
+        map.serialize_entry("attributes", &LoadOptionFlags(self.attributes))?;
+        map.serialize_entry("category", &category_text(self.attributes))?;
+        map.serialize_entry("description", &self.description)?;
+        map.serialize_entry("device_paths", &self.device_paths)?;
+        map.serialize_entry("optional_data", &lower_hex(&self.optional_data))?;
+        map.end()
+    }
+}
+
+/// The flags of a load option's Attributes (UEFI 2.11 §3.1.3), LOAD_OPTION_ and these names.
+#[non_exhaustive]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum LoadOptionFlag {
+    Active,
+    ForceReconnect,
+    Hidden,
+}
+
+impl LoadOptionFlag {
+    const ALL: [Self; 3] = [Self::Active, Self::ForceReconnect, Self::Hidden];
+
+    /// The name that variable get prints and set-attributes takes.
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Active => "active",
+            Self::ForceReconnect => "force-reconnect",
+            Self::Hidden => "hidden",
+        }
+    }
+
+    pub(crate) fn attribute(self) -> LoadOptionAttributes {
+        match self {
+            Self::Active => LoadOptionAttributes::ACTIVE,
+            Self::ForceReconnect => LoadOptionAttributes::FORCE_RECONNECT,
+            Self::Hidden => LoadOptionAttributes::HIDDEN,
+        }
+    }
+}
+
+/// The values of the LOAD_OPTION_CATEGORY field that UEFI 2.11 §3.1.3 defines, LOAD_OPTION_CATEGORY_
+/// and these names.
+#[non_exhaustive]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum LoadOptionCategory {
+    Boot,
+    App,
+}
+
+impl LoadOptionCategory {
+    const ALL: [Self; 2] = [Self::Boot, Self::App];
+
+    /// The name that variable get prints and set-attributes takes.
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Boot => "boot",
+            Self::App => "app",
+        }
+    }
+
+    /// The value of the field.
+    pub(crate) fn attributes(self) -> LoadOptionAttributes {
+        match self {
+            Self::Boot => LoadOptionAttributes::empty(),
+            Self::App => LoadOptionAttributes::CATEGORY_APP,
+        }
+    }
+}
+
+/// A load option's Attributes, which serializes as the names of its LoadOptionFlags, then each
+/// undefined bit in hex.
+struct LoadOptionFlags(u32);
+
+impl Serialize for LoadOptionFlags {
+    fn serialize<S: Serializer>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error> {
+        let attributes = LoadOptionAttributes::from_bits_retain(self.0);
+        serialize_bits(
+            serializer,
+            LoadOptionFlag::ALL
+                .into_iter()
+                .filter(|flag| attributes.contains(flag.attribute()))
+                .map(LoadOptionFlag::name),
+            u64::from((attributes - DEFINED_ATTRIBUTES).bits()),
+        )
+    }
+}
+
+/// The name of the LoadOptionCategory of `attributes`, else its reserved value in hex.
+fn category_text(attributes: u32) -> String {
+    let field = LoadOptionAttributes::from_bits_retain(attributes) & CATEGORY;
+    match LoadOptionCategory::ALL
+        .into_iter()
+        .find(|category| category.attributes() == field)
+    {
+        Some(category) => category.name().to_owned(),
+        None => format!("{:#X}", field.bits()),
+    }
+}
+
+/// A hot key as variable get shows it (UEFI 2.11 §3.1.6).
+#[non_exhaustive]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct HotKey {
+    /// KeyData's Revision, which "should be 0"
+    pub revision: u8,
+    /// KeyData's shift states and Reserved bits, where KeyData holds them
+    pub modifiers: u32,
+    /// Keys
+    pub keys: Vec<InputKey>,
+    /// The Boot#### that the key starts
+    pub boot_option: LoadOptionName,
+    /// Whether that Boot#### exists and BootOptionCrc is its CRC-32: else the boot manager
+    /// ignores the key
+    pub crc_matches: bool,
+}
+
+/// The shift states as the names of KeyModifier, then each Reserved bit in hex.
+impl Serialize for HotKey {
+    fn serialize<S: Serializer>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error> {
+        let mut map = serializer.serialize_map(None)?;
+        map.serialize_entry("revision", &self.revision)?;
+        map.serialize_entry("modifiers", &ModifierNames(self.modifiers))?;
+        map.serialize_entry("keys", &self.keys)?;
+        map.serialize_entry("boot_option", &self.boot_option)?;
+        map.serialize_entry("crc_matches", &self.crc_matches)?;
+        map.end()
+    }
+}
+
+/// KeyData's shift states and Reserved bits, which serialize as the names of the KeyModifiers,
+/// then each Reserved bit in hex.
+struct ModifierNames(u32);
+
+impl Serialize for ModifierNames {
+    fn serialize<S: Serializer>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error> {
+        let modifiers = KeyModifiers::from_bits_retain(self.0);
+        serialize_bits(
+            serializer,
+            KeyModifier::ALL
+                .into_iter()
+                .filter(|modifier| modifiers.contains(modifier.modifiers()))
+                .map(KeyModifier::name),
+            u64::from((modifiers - KeyModifiers::all()).bits()),
+        )
+    }
+}
+
+/// A device path as variable get shows it (UEFI 2.11 §10.6).
+#[non_exhaustive]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum DevicePathText {
+    /// Its text, which reads back to its bytes
+    Text(String),
+    /// A device path that no text reads back to: its bytes, with the End Entire Device Path
+    /// node, and why
+    NoText { bytes: Vec<u8>, reason: String },
+}
+
+impl DevicePathText {
+    /// The text of `path`, one device path with its End Entire Device Path node, if it has one.
+    fn of(path: &[u8]) -> Self {
+        match device_path::to_text(path) {
+            Ok(text) => Self::Text(text),
+            Err(error) => Self::NoText {
+                bytes: path.to_vec(),
+                reason: error.to_string(),
+            },
+        }
+    }
+}
+
+/// Its text, else its bytes in hex.
+impl fmt::Display for DevicePathText {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Text(text) => f.write_str(text),
+            Self::NoText { bytes, .. } => f.write_str(&lower_hex(bytes)),
+        }
+    }
+}
+
+/// Text as a string; else an object of the bytes in hex and the reason.
+impl Serialize for DevicePathText {
+    fn serialize<S: Serializer>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error> {
+        match self {
+            Self::Text(text) => serializer.serialize_str(text),
+            Self::NoText { bytes, reason } => {
+                let mut map = serializer.serialize_map(Some(2))?;
+                map.serialize_entry("bytes", &lower_hex(bytes))?;
+                map.serialize_entry("no_text", reason)?;
+                map.end()
+            }
+        }
+    }
+}
+
+/// A vendor GUID that variable get refuses for a variable of this module.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+enum VendorError {
+    #[error(
+        "{0} needs its vendor GUID, one that OsRecoveryOrder lists (UEFI 2.11 section 3.4.1): \
+         `uefisettings variable get {0} GUID`"
+    )]
+    Missing(String),
+    #[error(
+        "{name} of vendor {vendor} is not the {name} that variable get decodes, of vendor \
+         {EFI_GLOBAL_VARIABLE}; `uefisettings variable info {name} {vendor}` shows its \
+         attributes and size"
+    )]
+    Foreign { name: String, vendor: Guid },
+}
+
+/// A name of a load option that a subcommand does not write, which it refuses before any read.
+/// The messages spell "section", as edk2's terminals but VT-UTF8 show '?' for '§'.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+enum OptionRefusal {
+    #[error("{0} takes a Boot####, Driver#### or SysPrep####, not {1}")]
+    NotLoadOption(&'static str, String),
+    #[error(
+        "{0} does not write {1}: \"These variables are only modified by firmware and are \
+         read-only to the OS.\" (UEFI 2.11 section 3.3)"
+    )]
+    PlatformRecovery(&'static str, String),
+    #[error(
+        "{0} does not write {1}, a Secure Boot Policy Variable: \"Secure Boot Policy Variables \
+         must be created using the EFI_VARIABLE_AUTHENTICATION_2 structure.\" (UEFI 2.11 section \
+         3.3); variable write-signed writes a payload signed so"
+    )]
+    OsRecovery(&'static str, String),
+}
+
+/// The data of a console variable, which holds one device path (UEFI 2.11 §3.3).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+#[error("{0} device paths, not the one of a console variable")]
+struct MalformedConsole(usize);
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+    use crate::efi_variables::device_path::tests::bytes;
+    use crate::efi_variables::device_path::tests::path;
+    use crate::efi_variables::device_path::tests::X64_BOOT0000;
+    use crate::efi_variables::device_path::tests::X64_BOOT0001;
+    use crate::efi_variables::device_path::tests::X64_CONOUT;
+    use crate::efi_variables::enhanced_authenticated::fixture::timestamp_metadata;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::tests::NV_BS_RT;
+    use crate::efi_variables::key_option::boot_option_crc;
+    use crate::efi_variables::key_option::tests::X64_KEY0000;
+
+    /// A vendor GUID of OsRecovery####: the formset GUID of EDK2's DriverSample
+    const RECOVERY_VENDOR: &str = "A04A27F4-DF00-4D42-B552-39511302113D";
+    /// The text of the device path of OVMF's x86_64 Boot0000, UiApp
+    const UI_APP: &str =
+        "Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)";
+    /// The End Device Path node that ends an instance
+    const END_INSTANCE: [u8; 4] = [0x7F, 0x01, 0x04, 0x00];
+    /// Pci(0x1,0x0): Function 0 of Device 1 (UEFI 2.11 Table 10.6)
+    const PCI_1_0: [u8; 6] = [0x01, 0x01, 0x06, 0x00, 0x00, 0x01];
+
+    fn vendor(text: &str) -> Guid {
+        text.parse()
+            .unwrap_or_else(|error| panic!("parse GUID {text}: {error}"))
+    }
+
+    /// The JSON that variable get prints of the variable `name` of `vendor` that `variables`
+    /// hold.
+    fn printed(variables: &HeldVariables, name: &str, vendor: Option<Guid>) -> serde_json::Value {
+        let variable = BootManagerVariable::parse(name).unwrap_or_else(|| panic!("parse {name}"));
+        let read = read(variables, variable, vendor)
+            .unwrap_or_else(|error| panic!("read {name}: {error:#}"));
+        serde_json::to_value(&read).expect("serialize the variable")
+    }
+
+    /// `option` with its Attributes replaced by `attributes`.
+    fn with_attributes(option: &str, attributes: u32) -> Vec<u8> {
+        let mut option = bytes(option);
+        option[..4].copy_from_slice(&attributes.to_le_bytes());
+        option
+    }
+
+    /// An EFI_LOAD_OPTION of Attributes 1, Description "A" and `file_paths`.
+    fn load_option(file_paths: &[u8]) -> Vec<u8> {
+        let length = u16::try_from(file_paths.len()).expect("a short FilePathList");
+        [
+            &1_u32.to_le_bytes()[..],
+            &length.to_le_bytes(),
+            &[0x41, 0, 0, 0],
+            file_paths,
+        ]
+        .concat()
+    }
+
+    #[test]
+    fn names_parse_as_boot_manager_variables_or_fall_to_globals() {
+        let boot = |kind, number| {
+            Some(BootManagerVariable::LoadOption(OptionName {
+                kind: OptionKind::Ordered(kind),
+                number,
+            }))
+        };
+        let cases = [
+            ("Boot0001", boot(LoadOptionKind::Boot, 1)),
+            ("DriverFFFF", boot(LoadOptionKind::Driver, 0xFFFF)),
+            ("SysPrep00A1", boot(LoadOptionKind::SysPrep, 0xA1)),
+            (
+                "PlatformRecovery0000",
+                Some(BootManagerVariable::LoadOption(OptionName {
+                    kind: OptionKind::PlatformRecovery,
+                    number: 0,
+                })),
+            ),
+            (
+                "OsRecovery0002",
+                Some(BootManagerVariable::LoadOption(OptionName {
+                    kind: OptionKind::OsRecovery,
+                    number: 2,
+                })),
+            ),
+            ("Key000B", Some(BootManagerVariable::HotKey(0xB))),
+            ("ConIn", Some(BootManagerVariable::Console(Console::ConIn))),
+            (
+                "ErrOutDev",
+                Some(BootManagerVariable::Console(Console::ErrOutDev)),
+            ),
+            ("Boot001", None),
+            ("Boot00001", None),
+            ("Boot00a1", None),
+            ("boot0001", None),
+            ("Boot+001", None),
+            ("BootNext", None),
+            ("BootOrder", None),
+            ("BootCurrent", None),
+            ("KEK", None),
+            ("ConInDevX", None),
+            ("Key", None),
+        ];
+        for (name, want) in cases {
+            let variable = BootManagerVariable::parse(name);
+
+            assert_eq!(variable, want, "{name}");
+            if let Some(variable) = variable {
+                assert_eq!(variable.to_string(), name, "{name} written back");
+            }
+        }
+    }
+
+    /// Attributes as names, each undefined bit in hex, the category by name or in hex, each
+    /// device path as text and OptionalData in hex, for every kind of load option.
+    #[test]
+    fn load_options_read_as_variable_get_prints_them() {
+        let recovery = vendor(RECOVERY_VENDOR);
+        let variables = HeldVariables::default()
+            .with("Boot0000", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0000))
+            .with(
+                "Driver0001",
+                EFI_GLOBAL_VARIABLE,
+                &with_attributes(X64_BOOT0001, 0x8000_0003),
+            )
+            .with(
+                "SysPrep0002",
+                EFI_GLOBAL_VARIABLE,
+                &with_attributes(X64_BOOT0001, 0x0000_0308),
+            )
+            .with(
+                "PlatformRecovery0000",
+                EFI_GLOBAL_VARIABLE,
+                &bytes(X64_BOOT0001),
+            )
+            .with("OsRecovery0000", recovery, &bytes(X64_BOOT0001));
+        let misc_device = |attributes: serde_json::Value, category: &str| {
+            json!({
+                "attributes": attributes,
+                "category": category,
+                "description": "UEFI Misc Device",
+                "device_paths": ["PciRoot(0x0)/Pci(0x1,0x0)"],
+                "optional_data": "4eac0881119f594d850ee21a522c59b2",
+            })
+        };
+        let cases = [
+            (
+                "Boot0000",
+                None,
+                "Boot0000-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                json!({
+                    "attributes": ["active", "hidden"],
+                    "category": "app",
+                    "description": "UiApp",
+                    "device_paths": [UI_APP],
+                    "optional_data": "",
+                }),
+            ),
+            (
+                "Driver0001",
+                Some(EFI_GLOBAL_VARIABLE),
+                "Driver0001-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                misc_device(json!(["active", "force-reconnect", "0x80000000"]), "boot"),
+            ),
+            (
+                "SysPrep0002",
+                None,
+                "SysPrep0002-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                misc_device(json!(["hidden"]), "0x300"),
+            ),
+            (
+                "PlatformRecovery0000",
+                None,
+                "PlatformRecovery0000-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                misc_device(json!(["active"]), "boot"),
+            ),
+            (
+                "OsRecovery0000",
+                Some(recovery),
+                "OsRecovery0000-a04a27f4-df00-4d42-b552-39511302113d",
+                misc_device(json!(["active"]), "boot"),
+            ),
+        ];
+        for (name, vendor, variable, value) in cases {
+            assert_eq!(
+                printed(&variables, name, vendor),
+                json!({"variable": variable, "attributes": 7, "value": value}),
+                "{name}"
+            );
+        }
+        assert_eq!(
+            variables.read.into_inner(),
+            [
+                key("Boot0000", EFI_GLOBAL_VARIABLE),
+                key("Driver0001", EFI_GLOBAL_VARIABLE),
+                key("SysPrep0002", EFI_GLOBAL_VARIABLE),
+                key("PlatformRecovery0000", EFI_GLOBAL_VARIABLE),
+                key("OsRecovery0000", recovery),
+            ],
+            "keys read"
+        );
+    }
+
+    /// read decodes the value after the EFI_VARIABLE_AUTHENTICATION_3 metadata that GetVariable()
+    /// returns first for a variable with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS (UEFI 2.11
+    /// §8.2.1), as it decodes that value alone, and refuses data that ends inside the metadata.
+    #[test]
+    fn variables_decode_after_enhanced_authenticated_metadata() {
+        let enhanced = NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS;
+        let decode = |attributes, data: &[u8]| {
+            let variables = HeldVariables::default().with_attributes(
+                "Boot0000",
+                EFI_GLOBAL_VARIABLE,
+                attributes,
+                data,
+            );
+            let variable = BootManagerVariable::parse("Boot0000").expect("parse Boot0000");
+            read(&variables, variable, None).map_err(|error| format!("{error:#}"))
+        };
+        let alone = decode(NV_BS_RT, &bytes(X64_BOOT0000))
+            .expect("read Boot0000")
+            .contents
+            .expect("Boot0000 held");
+
+        let after_metadata = decode(
+            enhanced,
+            &[timestamp_metadata(), bytes(X64_BOOT0000)].concat(),
+        )
+        .expect("read Boot0000 after its metadata")
+        .contents
+        .expect("Boot0000 held");
+
+        assert_eq!(after_metadata.value, alone.value, "value");
+        assert_eq!(after_metadata.attributes, enhanced.bits(), "attributes");
+        assert_eq!(
+            decode(enhanced, &timestamp_metadata()[..10]),
+            Err(
+                "EFI variable Boot0000-8be4df61-93ca-11d2-aa0d-00e098032b8c is malformed: its 10 \
+                 bytes of data end inside its metadata"
+                    .to_string()
+            ),
+            "data ending inside the metadata"
+        );
+    }
+
+    /// A device path that no text reads back to shows its bytes and why, and the others of the
+    /// variable still show as text.
+    #[test]
+    fn device_paths_of_no_text_show_their_bytes() {
+        let empty_instance = [&END_INSTANCE[..], &path(&[PCI_1_0.to_vec()])].concat();
+        let pci = path(&[PCI_1_0.to_vec()]);
+        let variables = HeldVariables::default()
+            .with(
+                "Boot0003",
+                EFI_GLOBAL_VARIABLE,
+                &load_option(&[&pci[..], &empty_instance].concat()),
+            )
+            .with("ConIn", EFI_GLOBAL_VARIABLE, &empty_instance);
+        let no_text = json!({
+            "bytes": "7f0104000101060000017fff0400",
+            "no_text": device_path::to_text(&empty_instance)
+                .expect_err("an empty instance")
+                .to_string(),
+        });
+
+        assert_eq!(
+            printed(&variables, "Boot0003", None)["value"]["device_paths"],
+            json!(["Pci(0x1,0x0)", no_text]),
+            "Boot0003"
+        );
+        assert_eq!(
+            printed(&variables, "ConIn", None)["value"],
+            no_text,
+            "ConIn"
+        );
+    }
+
+    /// Key#### shows its shift states by name, Reserved bits in hex, each key by its scan code
+    /// name or character, and whether BootOptionCrc is the CRC-32 of its Boot#### as held.
+    #[test]
+    fn hot_keys_read_with_whether_their_crc_matches() {
+        let mut ctrl_alt_p_r = bytes(X64_KEY0000);
+        ctrl_alt_p_r[..4].copy_from_slice(&0x8000_4601_u32.to_le_bytes());
+        ctrl_alt_p_r.splice(10..14, [0, 0, 0x70, 0, 0, 0, 0x72, 0]);
+        let mut of_boot0005 = bytes(X64_KEY0000);
+        of_boot0005[8] = 5;
+        let f2 = |boot_option: &str, crc_matches: bool| {
+            json!({
+                "revision": 0,
+                "modifiers": [],
+                "keys": ["F2"],
+                "boot_option": boot_option,
+                "crc_matches": crc_matches,
+            })
+        };
+        // Boot0000 with LOAD_OPTION_ACTIVE cleared, whose CRC-32 differs
+        let inactive = with_attributes(X64_BOOT0000, 0x0000_0108);
+        let cases = [
+            (
+                "Key0000",
+                bytes(X64_KEY0000),
+                bytes(X64_BOOT0000),
+                f2("Boot0000", true),
+            ),
+            (
+                "Key0000",
+                bytes(X64_KEY0000),
+                inactive,
+                f2("Boot0000", false),
+            ),
+            (
+                "Key0001",
+                ctrl_alt_p_r,
+                bytes(X64_BOOT0000),
+                json!({
+                    "revision": 1,
+                    "modifiers": ["control", "alt", "0x4000"],
+                    "keys": ["p", "r"],
+                    "boot_option": "Boot0000",
+                    "crc_matches": true,
+                }),
+            ),
+            (
+                "Key0002",
+                of_boot0005,
+                bytes(X64_BOOT0000),
+                f2("Boot0005", false),
+            ),
+        ];
+        for (name, key_option, boot0000, value) in cases {
+            let variables = HeldVariables::default()
+                .with("Boot0000", EFI_GLOBAL_VARIABLE, &boot0000)
+                .with(name, EFI_GLOBAL_VARIABLE, &key_option);
+
+            assert_eq!(
+                printed(&variables, name, None)["value"],
+                value,
+                "{name} of Boot0000 {boot0000:02x?}"
+            );
+        }
+    }
+
+    /// Of a Boot#### with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS, a Key#### matches the CRC-32
+    /// of the EFI_LOAD_OPTION after the metadata (UEFI 2.11 §3.1.6, §8.2.1), not of the data.
+    #[test]
+    fn hot_keys_match_the_crc_of_the_load_option_after_its_metadata() {
+        let data = [timestamp_metadata(), bytes(X64_BOOT0000)].concat();
+        let mut of_the_data = bytes(X64_KEY0000);
+        of_the_data[4..8].copy_from_slice(&boot_option_crc(&data).to_le_bytes());
+        let cases = [
+            ("load option", bytes(X64_KEY0000), true),
+            ("data", of_the_data, false),
+        ];
+        for (crc_of, key_option, crc_matches) in cases {
+            let variables = HeldVariables::default()
+                .with_attributes(
+                    "Boot0000",
+                    EFI_GLOBAL_VARIABLE,
+                    NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS,
+                    &data,
+                )
+                .with("Key0000", EFI_GLOBAL_VARIABLE, &key_option);
+
+            assert_eq!(
+                printed(&variables, "Key0000", None)["value"]["crc_matches"],
+                json!(crc_matches),
+                "Key0000 of the CRC-32 of the {crc_of}"
+            );
+        }
+    }
+
+    #[test]
+    fn consoles_read_as_one_device_path() {
+        let conout = bytes(X64_CONOUT);
+        let serial = |n: u8| {
+            format!("PciRoot(0x0)/Pci(0x1F,0x0)/Serial(0x{n})/Uart(115200,8,N,1)/VenUtf8()")
+        };
+        let variables = HeldVariables::default()
+            .with("ConOut", EFI_GLOBAL_VARIABLE, &conout)
+            .with(
+                "ConOutDev",
+                EFI_GLOBAL_VARIABLE,
+                &[&conout[..], &conout].concat(),
+            );
+
+        assert_eq!(
+            printed(&variables, "ConOut", None),
+            json!({
+                "variable": "ConOut-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                "attributes": 7,
+                "value": format!("{},/{}", serial(0), serial(1)),
+            }),
+            "ConOut"
+        );
+        let error = read(
+            &variables,
+            BootManagerVariable::Console(Console::ConOutDev),
+            None,
+        )
+        .expect_err("read two device paths");
+        assert_eq!(
+            format!("{error:#}"),
+            "EFI variable ConOutDev-8be4df61-93ca-11d2-aa0d-00e098032b8c is malformed: 2 device \
+             paths, not the one of a console variable",
+            "ConOutDev"
+        );
+        assert_eq!(
+            read(
+                &variables,
+                BootManagerVariable::Console(Console::ErrOut),
+                None
+            )
+            .expect("read ErrOut")
+            .contents,
+            None,
+            "ErrOut is absent"
+        );
+    }
+
+    /// An OsRecovery#### without its vendor GUID, or another variable of a vendor GUID other than
+    /// EFI_GLOBAL_VARIABLE, is refused before any read.
+    #[test]
+    fn vendors_other_than_their_own_are_refused_unread() {
+        let foreign = vendor(RECOVERY_VENDOR);
+        let variables = HeldVariables::default()
+            .with("OsRecovery0000", foreign, &bytes(X64_BOOT0001))
+            .with("Boot0001", foreign, &bytes(X64_BOOT0001));
+        let cases = [
+            (
+                "OsRecovery0000",
+                None,
+                "OsRecovery0000 needs its vendor GUID, one that OsRecoveryOrder lists (UEFI 2.11 \
+                 section 3.4.1): `uefisettings variable get OsRecovery0000 GUID`",
+            ),
+            (
+                "Boot0001",
+                Some(foreign),
+                "Boot0001 of vendor A04A27F4-DF00-4D42-B552-39511302113D is not the Boot0001 that \
+                 variable get decodes, of vendor 8BE4DF61-93CA-11D2-AA0D-00E098032B8C; \
+                 `uefisettings variable info Boot0001 A04A27F4-DF00-4D42-B552-39511302113D` shows \
+                 its attributes and size",
+            ),
+            (
+                "Key0001",
+                Some(foreign),
+                "Key0001 of vendor A04A27F4-DF00-4D42-B552-39511302113D is not the Key0001 that \
+                 variable get decodes, of vendor 8BE4DF61-93CA-11D2-AA0D-00E098032B8C; \
+                 `uefisettings variable info Key0001 A04A27F4-DF00-4D42-B552-39511302113D` shows \
+                 its attributes and size",
+            ),
+        ];
+        for (name, vendor, want) in cases {
+            let variable = BootManagerVariable::parse(name).expect("a boot manager variable");
+            let error = read(&variables, variable, vendor).expect_err("read with a wrong vendor");
+
+            assert_eq!(error.to_string(), want, "{name} {vendor:?}");
+        }
+        assert_eq!(variables.read.into_inner(), [], "keys read");
+    }
+
+    #[test]
+    fn malformed_variables_are_refused() {
+        let mut short_key = bytes(X64_KEY0000);
+        short_key.pop();
+        let variables = HeldVariables::default()
+            .with("Boot0000", EFI_GLOBAL_VARIABLE, &[1, 0, 0, 0])
+            .with("Key0000", EFI_GLOBAL_VARIABLE, &short_key)
+            .with("ConIn", EFI_GLOBAL_VARIABLE, &PCI_1_0);
+        for name in ["Boot0000", "Key0000", "ConIn"] {
+            let variable = BootManagerVariable::parse(name).expect("a boot manager variable");
+            let error = read(&variables, variable, None).expect_err("read malformed data");
+
+            assert!(
+                format!("{error:#}").starts_with(&format!(
+                    "EFI variable {} is malformed: ",
+                    key(name, EFI_GLOBAL_VARIABLE)
+                )),
+                "{name}: {error:#}"
+            );
+        }
+    }
+
+    /// The names that variable get prints for the flags, categories and shift states are those
+    /// of their constants in UEFI 2.11 §3.1.3 and §3.1.6, lowercase, "-" for "_".
+    #[test]
+    fn names_are_those_of_the_spec_constants() {
+        let names = |names: &[&str]| -> Vec<String> {
+            names
+                .iter()
+                .map(|name| name.to_ascii_lowercase().replace('_', "-"))
+                .collect()
+        };
+        assert_eq!(
+            LoadOptionFlag::ALL.map(LoadOptionFlag::name),
+            names(&["ACTIVE", "FORCE_RECONNECT", "HIDDEN"]).as_slice(),
+            "LOAD_OPTION_"
+        );
+        assert_eq!(
+            LoadOptionCategory::ALL.map(LoadOptionCategory::name),
+            names(&["BOOT", "APP"]).as_slice(),
+            "LOAD_OPTION_CATEGORY_"
+        );
+        assert_eq!(
+            KeyModifier::ALL.map(KeyModifier::name),
+            names(&["SHIFT", "CONTROL", "ALT", "LOGO", "MENU", "SYS_REQ"]).as_slice(),
+            "the Pressed fields of EFI_BOOT_KEY_DATA"
+        );
+        assert_eq!(
+            LoadOptionFlag::ALL
+                .map(|flag| flag.attribute().bits())
+                .into_iter()
+                .chain(LoadOptionCategory::ALL.map(|category| category.attributes().bits()))
+                .collect::<Vec<_>>(),
+            [0x1, 0x2, 0x8, 0x0, 0x100],
+            "values"
+        );
+    }
+}
diff --git a/src/lib/efi_variables/boot_manager/attributes.rs b/src/lib/efi_variables/boot_manager/attributes.rs
new file mode 100644
index 0000000..2e45e08
--- /dev/null
+++ b/src/lib/efi_variables/boot_manager/attributes.rs
@@ -0,0 +1,852 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! variable set-attributes: the flags and category of a Boot####, Driver#### or SysPrep####
+//! (UEFI 2.11 §3.1.3), changed in place, and the BootOptionCrc of each Key#### that followed
+//! a Boot#### (§3.1.6), updated to follow it still.
+
+use anyhow::Context;
+use anyhow::Result;
+use thiserror::Error;
+
+use super::hot_key_variable;
+use super::load_option_data;
+use super::refuse_authenticated;
+use super::value_after_metadata;
+use super::written_option;
+use super::HotKeyListing;
+use super::LoadOptionCategory;
+use super::LoadOptionFlag;
+use super::CATEGORY;
+use crate::efi_variables::globals::GlobalContents;
+use crate::efi_variables::globals::GlobalValue;
+use crate::efi_variables::globals::GlobalVariable;
+use crate::efi_variables::globals::LoadOptionKind;
+use crate::efi_variables::globals::LoadOptionName;
+use crate::efi_variables::key_option::boot_option_crc;
+use crate::efi_variables::key_option::with_boot_option_crc;
+use crate::efi_variables::key_option::KeyOption;
+use crate::efi_variables::load_option::LoadOption;
+use crate::efi_variables::load_option::LoadOptionAttributes;
+use crate::efi_variables::load_option::LoadOptionError;
+use crate::efi_variables::VariableContents;
+use crate::efi_variables::VariableData;
+
+/// The size of Attributes, which starts an EFI_LOAD_OPTION
+const ATTRIBUTES_SIZE: usize = 4;
+/// The subcommand, which the refusals name
+const SET_ATTRIBUTES: &str = "set-attributes";
+
+/// A change of a load option's Attributes: the flags to set and to clear, and the
+/// LOAD_OPTION_CATEGORY to give it, a value of that field rather than a bit.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Hash)]
+pub struct AttributeChange {
+    pub set: Vec<LoadOptionFlag>,
+    pub clear: Vec<LoadOptionFlag>,
+    pub category: Option<LoadOptionCategory>,
+}
+
+impl AttributeChange {
+    /// Refuses a change of nothing, and a flag both to set and to clear.
+    fn check(&self) -> Result<(), AttributeRefusal> {
+        let both: Vec<&str> = self
+            .set
+            .iter()
+            .filter(|flag| self.clear.contains(flag))
+            .map(|flag| flag.name())
+            .collect();
+        match (both.is_empty(), self.is_empty()) {
+            (false, _) => Err(AttributeRefusal::SetAndClear(both.join(","))),
+            (true, true) => Err(AttributeRefusal::NoChange),
+            (true, false) => Ok(()),
+        }
+    }
+
+    fn is_empty(&self) -> bool {
+        self.set.is_empty() && self.clear.is_empty() && self.category.is_none()
+    }
+
+    /// `attributes` changed, every other bit kept: "When updating a load option, all undefined
+    /// attribute bits must be preserved" (UEFI 2.11 §3.1.3). A category clears the
+    /// LOAD_OPTION_CATEGORY field, then gives it its value.
+    fn apply(&self, attributes: LoadOptionAttributes) -> LoadOptionAttributes {
+        let bits = |flags: &[LoadOptionFlag]| {
+            flags
+                .iter()
+                .map(|flag| flag.attribute())
+                .fold(LoadOptionAttributes::empty(), LoadOptionAttributes::union)
+        };
+        let flagged = (attributes - bits(&self.clear)) | bits(&self.set);
+        match self.category {
+            Some(category) => (flagged - CATEGORY) | category.attributes(),
+            None => flagged,
+        }
+    }
+}
+
+/// `bytes`, an EFI_LOAD_OPTION, with `change` applied to its Attributes and every other byte as
+/// read: decoding and encoding it would turn each surrogate of its Description into U+FFFD.
+pub(crate) fn with_attributes(
+    bytes: &[u8],
+    change: &AttributeChange,
+) -> Result<Vec<u8>, LoadOptionError> {
+    let attributes = change.apply(LoadOption::decode(bytes)?.attributes);
+    let mut changed = bytes.to_vec();
+    if let Some(field) = changed.get_mut(..ATTRIBUTES_SIZE) {
+        field.copy_from_slice(&attributes.bits().to_le_bytes());
+    }
+    Ok(changed)
+}
+
+/// What variable set-attributes wrote: the load option, as variable get shows it, and what
+/// became of the Key#### that followed it.
+#[non_exhaustive]
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AttributesSet {
+    pub option: GlobalVariable,
+    pub hot_keys: HotKeysFollowing,
+}
+
+/// The Key#### that followed a Boot####: those whose BootOption named it and whose
+/// BootOptionCrc was the CRC-32 of its bytes before the change.
+#[non_exhaustive]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum HotKeysFollowing {
+    /// Those whose BootOptionCrc set-attributes updated, by option number: none for a
+    /// Driver#### or SysPrep####, or when the bytes did not change
+    Updated(Vec<u16>),
+    /// None could be found, as the backend cannot list EFI variables: the boot manager now
+    /// ignores each Key#### that followed this Boot####
+    Unlisted(LoadOptionName),
+}
+
+/// Sets and clears the flags and sets the category of the load option `name` that `variables`
+/// hold, as `change` says, every other bit and byte kept, and keeps its attributes; then sets the
+/// BootOptionCrc of each Key#### of `hot_keys` that followed a Boot#### to the CRC-32 of its new
+/// bytes. Refuses, before any write, a variable other than a Boot####, Driver#### or
+/// SysPrep####, an absent one, a change of nothing, and a load option or following Key#### that
+/// refuse_authenticated refuses. A Key#### write that fails names the Boot#### as written, the
+/// Key#### updated and those left with the CRC-32 of its old bytes.
+pub(crate) fn set_attributes(
+    variables: &impl VariableData,
+    hot_keys: &HotKeyListing,
+    name: &str,
+    change: &AttributeChange,
+) -> Result<AttributesSet> {
+    let option = written_option(name, SET_ATTRIBUTES)?;
+    change.check()?;
+    let key = option.key();
+    let current = variables
+        .variable_data(&key)?
+        .ok_or(AttributeRefusal::Absent(option))?;
+    refuse_authenticated(&key, current.attributes())?;
+    let malformed = || format!("EFI variable {key} is malformed");
+    let bytes = with_attributes(current.data(), change).with_context(malformed)?;
+    let value = load_option_data(&bytes).with_context(malformed)?;
+
+    let changed = bytes.as_slice() != current.data();
+    let (hot_keys, followers) = match (option.kind, hot_keys, changed) {
+        (LoadOptionKind::Boot, HotKeyListing::Listed(numbers), true) => {
+            let followers = followers(variables, numbers, option.number, current.data(), &bytes)?;
+            let numbers = followers.iter().map(|(number, _)| *number).collect();
+            (HotKeysFollowing::Updated(numbers), followers)
+        }
+        (LoadOptionKind::Boot, HotKeyListing::Unlisted, true) => {
+            (HotKeysFollowing::Unlisted(option), Vec::new())
+        }
+        (LoadOptionKind::Boot, _, false)
+        | (LoadOptionKind::Driver | LoadOptionKind::SysPrep, _, _) => {
+            (HotKeysFollowing::Updated(Vec::new()), Vec::new())
+        }
+    };
+    if changed {
+        let contents = VariableContents::new(current.attributes(), bytes)
+            .with_context(|| format!("EFI variable {key}"))?;
+        variables.set_variable(&key, &contents)?;
+        let numbers: Vec<u16> = followers.iter().map(|(number, _)| *number).collect();
+        for (written, (number, contents)) in followers.iter().enumerate() {
+            variables
+                .set_variable(&hot_key_variable(*number), contents)
+                .with_context(|| stale_keys(option, &numbers[..written], &numbers[written..]))?;
+        }
+    }
+    Ok(AttributesSet {
+        option: GlobalVariable {
+            variable: key.to_string(),
+            contents: Some(GlobalContents {
+                attributes: current.attributes().bits(),
+                value: GlobalValue::LoadOptionData(value),
+            }),
+        },
+        hot_keys,
+    })
+}
+
+/// The Key#### of `numbers` that `variables` hold that follow the Boot#### `boot_option` of
+/// `old` bytes, each with its BootOptionCrc set to that of the `new` bytes; refuses one that
+/// refuse_authenticated refuses. A Key#### that is malformed or absent follows none: the boot
+/// manager ignores it (edk2-stable202608 BmIsKeyOptionValid(), BmHotkey.c).
+fn followers(
+    variables: &impl VariableData,
+    numbers: &[u16],
+    boot_option: u16,
+    old: &[u8],
+    new: &[u8],
+) -> Result<Vec<(u16, VariableContents)>> {
+    let (old_crc, new_crc) = (boot_option_crc(old), boot_option_crc(new));
+    let mut followers = Vec::new();
+    for &number in numbers {
+        let key = hot_key_variable(number);
+        let Some(contents) = variables.variable_data(&key)? else {
+            continue;
+        };
+        let Ok(value) = value_after_metadata(&contents) else {
+            continue;
+        };
+        let follows = KeyOption::decode(value).is_ok_and(|option| {
+            option.boot_option == boot_option && option.boot_option_crc == old_crc
+        });
+        if follows {
+            refuse_authenticated(&key, contents.attributes())?;
+            let data = with_boot_option_crc(value, new_crc);
+            let contents = VariableContents::new(contents.attributes(), data)
+                .with_context(|| format!("EFI variable {key}"))?;
+            followers.push((number, contents));
+        }
+    }
+    Ok(followers)
+}
+
+/// What set-attributes wrote before a Key#### write failed: the Boot#### `option`, the Key####
+/// of `updated` that follow it, and those of `stale` that the boot manager now ignores.
+fn stale_keys(option: LoadOptionName, updated: &[u16], stale: &[u16]) -> String {
+    format!(
+        "{option} is written; the BootOptionCrc of {} is updated, but that of {} keeps the \
+         CRC-32 of {option}'s old bytes, so the boot manager ignores those keys (UEFI 2.11 \
+         section 3.1.6)",
+        key_names(updated),
+        key_names(stale)
+    )
+}
+
+/// The Key#### of `numbers`, comma-separated.
+fn key_names(numbers: &[u16]) -> String {
+    match numbers {
+        [] => "no Key####".to_owned(),
+        numbers => numbers
+            .iter()
+            .map(|number| format!("Key{number:04X}"))
+            .collect::<Vec<_>>()
+            .join(", "),
+    }
+}
+
+/// A change or variable that set-attributes refuses, before it writes anything, but those of
+/// written_option and refuse_authenticated.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+enum AttributeRefusal {
+    #[error("{0} is absent")]
+    Absent(LoadOptionName),
+    #[error("set-attributes cannot both set and clear {0}")]
+    SetAndClear(String),
+    #[error("set-attributes needs --set, --clear or --category")]
+    NoChange,
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use serde_json::json;
+
+    use super::*;
+    use crate::efi_variables::boot_manager::AuthenticatedRefusal;
+    use crate::efi_variables::device_path::tests::bytes;
+    use crate::efi_variables::device_path::tests::X64_BOOT0000;
+    use crate::efi_variables::device_path::tests::X64_BOOT0001;
+    use crate::efi_variables::device_path::tests::X64_BOOT0002;
+    use crate::efi_variables::enhanced_authenticated::fixture::timestamp_metadata;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::tests::NV_BS_RT;
+    use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+    use crate::efi_variables::key_option::tests::X64_KEY0000;
+    use crate::hii::VariableAttributes;
+    use crate::hii::VariableInterface;
+    use crate::hii::VariableKey;
+
+    /// HeldVariables whose SetVariable() fails for the variable `.1`.
+    struct UnwritableVariable(HeldVariables, VariableKey);
+
+    impl VariableData for UnwritableVariable {
+        fn interface(&self) -> VariableInterface {
+            self.0.interface()
+        }
+
+        fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
+            self.0.variable_data(key)
+        }
+
+        fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()> {
+            match *key == self.1 {
+                true => Err(anyhow::anyhow!("cannot write EFI variable {key}")),
+                false => self.0.set_variable(key, contents),
+            }
+        }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            self.0.delete_variable(key)
+        }
+    }
+
+    /// `option` with its Attributes replaced by `attributes`.
+    fn with_attributes_bits(option: &str, attributes: u32) -> Vec<u8> {
+        let mut option = bytes(option);
+        option[..4].copy_from_slice(&attributes.to_le_bytes());
+        option
+    }
+
+    /// An EFI_KEY_OPTION of one key, F2, to Boot#### `boot_option` with BootOptionCrc `crc`.
+    fn key_option(boot_option: u16, crc: u32) -> Vec<u8> {
+        [
+            &0x4000_0000_u32.to_le_bytes()[..],
+            &crc.to_le_bytes(),
+            &boot_option.to_le_bytes(),
+            &[0x0C, 0, 0, 0],
+        ]
+        .concat()
+    }
+
+    fn change(set: &[LoadOptionFlag], clear: &[LoadOptionFlag]) -> AttributeChange {
+        AttributeChange {
+            set: set.to_vec(),
+            clear: clear.to_vec(),
+            category: None,
+        }
+    }
+
+    fn held(variables: &HeldVariables) -> BTreeMap<VariableKey, VariableContents> {
+        variables.variables.borrow().clone()
+    }
+
+    fn data(variables: &HeldVariables, name: &str) -> Vec<u8> {
+        variables.variables.borrow()[&key(name, EFI_GLOBAL_VARIABLE)]
+            .data()
+            .to_vec()
+    }
+
+    /// Only Attributes change: the undefined bits stay, and so does a Description whose surrogate
+    /// a decode and encode would turn into U+FFFD, byte for byte.
+    #[test]
+    fn set_attributes_changes_only_attributes_and_keeps_undefined_bits() {
+        let mut surrogate = with_attributes_bits(X64_BOOT0001, 0x4000_0001);
+        // the Description's first CHAR16, "U", becomes a lone high surrogate
+        surrogate[6..8].copy_from_slice(&0xD800_u16.to_le_bytes());
+        let variables = HeldVariables::default()
+            .with("Boot0001", EFI_GLOBAL_VARIABLE, &surrogate)
+            .with("Boot0002", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0002));
+
+        let set = set_attributes(
+            &variables,
+            &HotKeyListing::Listed(Vec::new()),
+            "Boot0001",
+            &change(
+                &[LoadOptionFlag::Hidden, LoadOptionFlag::ForceReconnect],
+                &[LoadOptionFlag::Active],
+            ),
+        )
+        .expect("set Boot0001's attributes");
+
+        let written = data(&variables, "Boot0001");
+        assert_eq!(
+            written[..4],
+            0x4000_000A_u32.to_le_bytes(),
+            "Attributes: hidden and force-reconnect, not active, the undefined bit kept"
+        );
+        assert_eq!(written[4..], surrogate[4..], "every other byte");
+        assert_eq!(
+            serde_json::to_value(&set.option).expect("serialize")["value"]["attributes"],
+            json!(["force-reconnect", "hidden", "0x40000000"]),
+            "what set-attributes prints"
+        );
+        assert_eq!(
+            set.hot_keys,
+            HotKeysFollowing::Updated(Vec::new()),
+            "hot keys"
+        );
+        assert_eq!(
+            variables.set.into_inner(),
+            [key("Boot0001", EFI_GLOBAL_VARIABLE)],
+            "keys set"
+        );
+    }
+
+    /// A category is a value of the LOAD_OPTION_CATEGORY field: giving one clears the field, a
+    /// reserved value too, then sets LOAD_OPTION_CATEGORY_BOOT (0) or LOAD_OPTION_CATEGORY_APP
+    /// (0x100); the flags and undefined bits stay.
+    #[test]
+    fn categories_are_values_of_their_field() {
+        let cases = [
+            (0x0000_0301, LoadOptionCategory::App, 0x0000_0101),
+            (0x0000_0301, LoadOptionCategory::Boot, 0x0000_0001),
+            (0x8000_1F08, LoadOptionCategory::App, 0x8000_0108),
+            (0x0000_0100, LoadOptionCategory::Boot, 0x0000_0000),
+            (0x0000_0000, LoadOptionCategory::App, 0x0000_0100),
+        ];
+        for (before, category, after) in cases {
+            let change = AttributeChange {
+                category: Some(category),
+                ..AttributeChange::default()
+            };
+
+            let changed = with_attributes(&with_attributes_bits(X64_BOOT0001, before), &change)
+                .expect("change the category");
+
+            assert_eq!(
+                changed,
+                with_attributes_bits(X64_BOOT0001, after),
+                "{before:#010x} to {category:?}"
+            );
+        }
+    }
+
+    /// After a Boot#### changes, each Key#### whose BootOption names it and whose BootOptionCrc
+    /// was the CRC-32 of its old bytes gets that of the new ones, every other byte kept; a key
+    /// of another Boot####, a stale one, a malformed one and an absent one stay as they were.
+    #[test]
+    fn hot_keys_that_followed_a_boot_option_follow_it_still() {
+        let boot0001 = bytes(X64_BOOT0001);
+        let boot0002 = bytes(X64_BOOT0002);
+        let follower = key_option(1, boot_option_crc(&boot0001));
+        let variables = || {
+            HeldVariables::default()
+                .with("Boot0001", EFI_GLOBAL_VARIABLE, &boot0001)
+                .with("Boot0002", EFI_GLOBAL_VARIABLE, &boot0002)
+                .with("Key0001", EFI_GLOBAL_VARIABLE, &follower)
+                .with("Key0002", EFI_GLOBAL_VARIABLE, &key_option(1, 0x1234_5678))
+                .with(
+                    "Key0003",
+                    EFI_GLOBAL_VARIABLE,
+                    &key_option(2, boot_option_crc(&boot0002)),
+                )
+                .with("Key0004", EFI_GLOBAL_VARIABLE, &follower[..12])
+                .with("Key000A", EFI_GLOBAL_VARIABLE, &follower)
+        };
+        let listed = HotKeyListing::Listed(vec![1, 2, 3, 4, 5, 0xA]);
+        let clear_active = change(&[], &[LoadOptionFlag::Active]);
+
+        let variables_listed = variables();
+        let before = held(&variables_listed);
+        let set = set_attributes(&variables_listed, &listed, "Boot0001", &clear_active)
+            .expect("clear Boot0001's active flag");
+
+        let new_crc = boot_option_crc(&data(&variables_listed, "Boot0001"));
+        let mut want = before.clone();
+        for name in ["Key0001", "Key000A"] {
+            let mut followed = follower.clone();
+            followed[4..8].copy_from_slice(&new_crc.to_le_bytes());
+            want.insert(
+                key(name, EFI_GLOBAL_VARIABLE),
+                VariableContents::new(
+                    before[&key(name, EFI_GLOBAL_VARIABLE)].attributes(),
+                    followed,
+                )
+                .expect("hold the key"),
+            );
+        }
+        want.insert(
+            key("Boot0001", EFI_GLOBAL_VARIABLE),
+            variables_listed.variables.borrow()[&key("Boot0001", EFI_GLOBAL_VARIABLE)].clone(),
+        );
+        assert_ne!(new_crc, boot_option_crc(&boot0001), "the CRC-32 changes");
+        assert_eq!(
+            set.hot_keys,
+            HotKeysFollowing::Updated(vec![1, 0xA]),
+            "listed"
+        );
+        assert_eq!(held(&variables_listed), want, "listed: the variables");
+        assert_eq!(
+            variables_listed.set.into_inner(),
+            [
+                key("Boot0001", EFI_GLOBAL_VARIABLE),
+                key("Key0001", EFI_GLOBAL_VARIABLE),
+                key("Key000A", EFI_GLOBAL_VARIABLE),
+            ],
+            "listed: keys set"
+        );
+
+        let variables_unlisted = variables();
+        let set = set_attributes(
+            &variables_unlisted,
+            &HotKeyListing::Unlisted,
+            "Boot0001",
+            &clear_active,
+        )
+        .expect("clear Boot0001's active flag without a listing");
+        assert_eq!(
+            set.hot_keys,
+            HotKeysFollowing::Unlisted(LoadOptionName {
+                kind: LoadOptionKind::Boot,
+                number: 1,
+            }),
+            "unlisted"
+        );
+        assert_eq!(
+            variables_unlisted.set.into_inner(),
+            [key("Boot0001", EFI_GLOBAL_VARIABLE)],
+            "unlisted: keys set"
+        );
+
+        // a Driver#### has no hot keys, and an unchanged Boot#### is not written
+        let variables_other = variables().with("Driver0001", EFI_GLOBAL_VARIABLE, &boot0001);
+        let driver = set_attributes(&variables_other, &listed, "Driver0001", &clear_active)
+            .expect("clear Driver0001's active flag");
+        let unchanged = set_attributes(
+            &variables_other,
+            &listed,
+            "Boot0001",
+            &change(&[LoadOptionFlag::Active], &[]),
+        )
+        .expect("set Boot0001's active flag again");
+        assert_eq!(
+            driver.hot_keys,
+            HotKeysFollowing::Updated(Vec::new()),
+            "Driver0001"
+        );
+        assert_eq!(
+            unchanged.hot_keys,
+            HotKeysFollowing::Updated(Vec::new()),
+            "unchanged"
+        );
+        assert_eq!(
+            variables_other.set.into_inner(),
+            [key("Driver0001", EFI_GLOBAL_VARIABLE)],
+            "Driver0001 and unchanged Boot0001: keys set"
+        );
+    }
+
+    /// The Boot#### and the Key#### that follows it are each written with the attributes that
+    /// they held: SetVariable() refuses a rewrite with others (UEFI 2.11 §8.2).
+    #[test]
+    fn set_attributes_keeps_the_attributes_of_each_variable() {
+        let boot0001 = bytes(X64_BOOT0001);
+        let bs_rt = VariableAttributes::BOOTSERVICE_ACCESS | VariableAttributes::RUNTIME_ACCESS;
+        let nv_bs = VariableAttributes::NON_VOLATILE | VariableAttributes::BOOTSERVICE_ACCESS;
+        let variables = HeldVariables::default()
+            .with_attributes("Boot0001", EFI_GLOBAL_VARIABLE, bs_rt, &boot0001)
+            .with_attributes(
+                "Key0001",
+                EFI_GLOBAL_VARIABLE,
+                nv_bs,
+                &key_option(1, boot_option_crc(&boot0001)),
+            );
+
+        let set = set_attributes(
+            &variables,
+            &HotKeyListing::Listed(vec![1]),
+            "Boot0001",
+            &change(&[], &[LoadOptionFlag::Active]),
+        )
+        .expect("clear Boot0001's active flag");
+
+        let held = held(&variables);
+        assert_eq!(
+            [
+                held[&key("Boot0001", EFI_GLOBAL_VARIABLE)].attributes(),
+                held[&key("Key0001", EFI_GLOBAL_VARIABLE)].attributes(),
+            ],
+            [bs_rt, nv_bs],
+            "Boot0001 and Key0001: their attributes"
+        );
+        assert_eq!(
+            set.option.contents.map(|contents| contents.attributes),
+            Some(bs_rt.bits()),
+            "what set-attributes prints"
+        );
+        assert_eq!(set.hot_keys, HotKeysFollowing::Updated(vec![1]), "hot keys");
+        assert_eq!(
+            variables.set.into_inner(),
+            [
+                key("Boot0001", EFI_GLOBAL_VARIABLE),
+                key("Key0001", EFI_GLOBAL_VARIABLE),
+            ],
+            "keys set"
+        );
+    }
+
+    /// A Key#### write that fails after the Boot#### write names the Boot#### as written, the
+    /// Key#### updated before it, and it and those after it, left with the old BootOptionCrc.
+    #[test]
+    fn a_failed_key_write_names_what_was_written_and_the_stale_keys() {
+        let boot0001 = bytes(X64_BOOT0001);
+        let follower = key_option(1, boot_option_crc(&boot0001));
+        let cases = [
+            (
+                "Key0001",
+                "Boot0001 is written; the BootOptionCrc of no Key#### is updated, but that of \
+                 Key0001, Key0002, Key000A keeps the CRC-32 of Boot0001's old bytes, so the boot \
+                 manager ignores those keys (UEFI 2.11 section 3.1.6): cannot write EFI variable \
+                 Key0001-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                vec!["Boot0001"],
+            ),
+            (
+                "Key0002",
+                "Boot0001 is written; the BootOptionCrc of Key0001 is updated, but that of \
+                 Key0002, Key000A keeps the CRC-32 of Boot0001's old bytes, so the boot manager \
+                 ignores those keys (UEFI 2.11 section 3.1.6): cannot write EFI variable \
+                 Key0002-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                vec!["Boot0001", "Key0001"],
+            ),
+            (
+                "Key000A",
+                "Boot0001 is written; the BootOptionCrc of Key0001, Key0002 is updated, but that \
+                 of Key000A keeps the CRC-32 of Boot0001's old bytes, so the boot manager ignores \
+                 those keys (UEFI 2.11 section 3.1.6): cannot write EFI variable \
+                 Key000A-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                vec!["Boot0001", "Key0001", "Key0002"],
+            ),
+        ];
+        for (failing, want, written) in cases {
+            let variables = UnwritableVariable(
+                HeldVariables::default()
+                    .with("Boot0001", EFI_GLOBAL_VARIABLE, &boot0001)
+                    .with("Key0001", EFI_GLOBAL_VARIABLE, &follower)
+                    .with("Key0002", EFI_GLOBAL_VARIABLE, &follower)
+                    .with("Key000A", EFI_GLOBAL_VARIABLE, &follower),
+                key(failing, EFI_GLOBAL_VARIABLE),
+            );
+
+            let error = set_attributes(
+                &variables,
+                &HotKeyListing::Listed(vec![1, 2, 0xA]),
+                "Boot0001",
+                &change(&[], &[LoadOptionFlag::Active]),
+            )
+            .expect_err("a Key#### write fails");
+
+            assert_eq!(format!("{error:#}"), want, "{failing}");
+            assert_eq!(
+                variables.0.set.into_inner(),
+                written
+                    .iter()
+                    .map(|name| key(name, EFI_GLOBAL_VARIABLE))
+                    .collect::<Vec<_>>(),
+                "{failing}: keys set"
+            );
+        }
+    }
+
+    /// PlatformRecovery####, read-only to the OS, OsRecovery####, a Secure Boot Policy Variable,
+    /// any variable but a Boot####, Driver#### or SysPrep####, an absent one, a change of nothing
+    /// and one that both sets and clears a flag are refused before any write; a malformed load
+    /// option is refused before any write too.
+    #[test]
+    fn set_attributes_refuses_other_variables_and_changes_unwritten() {
+        let variables = HeldVariables::default()
+            .with("Boot0001", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0001))
+            .with("Boot0003", EFI_GLOBAL_VARIABLE, &[1, 0, 0, 0])
+            .with(
+                "PlatformRecovery0000",
+                EFI_GLOBAL_VARIABLE,
+                &bytes(X64_BOOT0001),
+            )
+            .with("OsRecovery0000", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0001))
+            .with("Key0001", EFI_GLOBAL_VARIABLE, &key_option(1, 0));
+        let before = held(&variables);
+        let active = change(&[LoadOptionFlag::Active], &[]);
+        let cases = [
+            (
+                "PlatformRecovery0000",
+                active.clone(),
+                "set-attributes does not write PlatformRecovery0000: \"These variables are only \
+                 modified by firmware and are read-only to the OS.\" (UEFI 2.11 section 3.3)",
+            ),
+            (
+                "OsRecovery0000",
+                active.clone(),
+                "set-attributes does not write OsRecovery0000, a Secure Boot Policy Variable: \
+                 \"Secure Boot Policy Variables must be created using the \
+                 EFI_VARIABLE_AUTHENTICATION_2 structure.\" (UEFI 2.11 section 3.3); variable \
+                 write-signed writes a payload signed so",
+            ),
+            (
+                "Key0001",
+                active.clone(),
+                "set-attributes takes a Boot####, Driver#### or SysPrep####, not Key0001",
+            ),
+            (
+                "ConOut",
+                active.clone(),
+                "set-attributes takes a Boot####, Driver#### or SysPrep####, not ConOut",
+            ),
+            (
+                "Boot001",
+                active.clone(),
+                "set-attributes takes a Boot####, Driver#### or SysPrep####, not Boot001",
+            ),
+            ("Boot1234", active.clone(), "Boot1234 is absent"),
+            (
+                "Boot0001",
+                AttributeChange::default(),
+                "set-attributes needs --set, --clear or --category",
+            ),
+            (
+                "Boot0001",
+                change(
+                    &[LoadOptionFlag::Active, LoadOptionFlag::Hidden],
+                    &[LoadOptionFlag::Hidden, LoadOptionFlag::Active],
+                ),
+                "set-attributes cannot both set and clear active,hidden",
+            ),
+        ];
+        for (name, change, want) in cases {
+            let error = set_attributes(&variables, &HotKeyListing::Listed(vec![1]), name, &change)
+                .expect_err("set refused attributes");
+
+            assert_eq!(error.to_string(), want, "{name} {change:?}");
+        }
+        let malformed = set_attributes(
+            &variables,
+            &HotKeyListing::Listed(vec![1]),
+            "Boot0003",
+            &active,
+        )
+        .expect_err("set the attributes of a malformed load option");
+
+        assert!(
+            format!("{malformed:#}").starts_with(
+                "EFI variable Boot0003-8be4df61-93ca-11d2-aa0d-00e098032b8c is malformed: "
+            ),
+            "malformed: {malformed:#}"
+        );
+        assert_eq!(held(&variables), before, "the variables");
+        assert_eq!(variables.set.into_inner(), [], "keys set");
+    }
+
+    /// Asserts that clearing LOAD_OPTION_ACTIVE of the Boot0000 that `variables` hold, which
+    /// Key0000 may follow, refuses `refused` as only a signed write sets it, and writes nothing.
+    fn assert_refused_as_authenticated(variables: &HeldVariables, refused: &str) {
+        let before = held(variables);
+
+        let error = set_attributes(
+            variables,
+            &HotKeyListing::Listed(vec![0]),
+            "Boot0000",
+            &change(&[], &[LoadOptionFlag::Active]),
+        )
+        .expect_err("set-attributes refused");
+
+        let refused_key = key(refused, EFI_GLOBAL_VARIABLE);
+        assert_eq!(
+            error.to_string(),
+            format!(
+                "EFI variable {refused_key} has ENHANCED_AUTHENTICATED_ACCESS or \
+                 TIME_BASED_AUTHENTICATED_WRITE_ACCESS: SetVariable() writes it only with an \
+                 EFI_VARIABLE_AUTHENTICATION_3 or EFI_VARIABLE_AUTHENTICATION_2 descriptor (UEFI \
+                 2.11 section 8.2.3), as variable write-signed writes it"
+            ),
+            "{refused} refused"
+        );
+        assert_eq!(
+            error.downcast_ref(),
+            Some(&AuthenticatedRefusal(refused_key)),
+            "{refused} refused"
+        );
+        assert_eq!(held(variables), before, "the variables, {refused} refused");
+        assert_eq!(*variables.set.borrow(), [], "keys set, {refused} refused");
+    }
+
+    /// A Boot#### with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS, which get decodes after its
+    /// metadata, or with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is refused before any
+    /// write: only an EFI_VARIABLE_AUTHENTICATION_3 or _2 descriptor writes it (UEFI 2.11 §8.2.3).
+    #[test]
+    fn set_attributes_refuses_an_authenticated_load_option() {
+        let cases = [
+            (
+                NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS,
+                [timestamp_metadata(), bytes(X64_BOOT0000)].concat(),
+            ),
+            (
+                NV_BS_RT | VariableAttributes::TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
+                bytes(X64_BOOT0000),
+            ),
+        ];
+        for (attributes, data) in cases {
+            let variables = HeldVariables::default().with_attributes(
+                "Boot0000",
+                EFI_GLOBAL_VARIABLE,
+                attributes,
+                &data,
+            );
+
+            assert_refused_as_authenticated(&variables, "Boot0000");
+        }
+    }
+
+    /// A Key#### with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS that follows the Boot####, as
+    /// its value after the metadata tells (UEFI 2.11 §8.2.1), is refused before any write.
+    #[test]
+    fn set_attributes_refuses_an_enhanced_key_that_follows() {
+        let variables = HeldVariables::default()
+            .with("Boot0000", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0000))
+            .with_attributes(
+                "Key0000",
+                EFI_GLOBAL_VARIABLE,
+                NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS,
+                &[timestamp_metadata(), bytes(X64_KEY0000)].concat(),
+            );
+
+        assert_refused_as_authenticated(&variables, "Key0000");
+    }
+
+    /// A Key#### with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS that follows the
+    /// Boot#### is refused before the Boot#### is written, which would leave it stale (UEFI 2.11
+    /// §8.2.3); one that follows another Boot#### is no matter.
+    #[test]
+    fn set_attributes_refuses_a_time_based_key_that_follows() {
+        let time_based = NV_BS_RT | VariableAttributes::TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+        let variables = HeldVariables::default()
+            .with("Boot0000", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0000))
+            .with_attributes(
+                "Key0000",
+                EFI_GLOBAL_VARIABLE,
+                time_based,
+                &bytes(X64_KEY0000),
+            );
+
+        assert_refused_as_authenticated(&variables, "Key0000");
+
+        let crc = boot_option_crc(&bytes(X64_BOOT0000));
+        let variables = HeldVariables::default()
+            .with("Boot0000", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0000))
+            .with_attributes(
+                "Key0001",
+                EFI_GLOBAL_VARIABLE,
+                time_based,
+                &key_option(5, crc),
+            );
+        let set = set_attributes(
+            &variables,
+            &HotKeyListing::Listed(vec![1]),
+            "Boot0000",
+            &change(&[], &[LoadOptionFlag::Active]),
+        )
+        .expect("set the attributes of Boot0000, which a time-based Key0001 does not follow");
+
+        assert_eq!(set.hot_keys, HotKeysFollowing::Updated(Vec::new()), "keys");
+        assert_eq!(
+            variables.set.into_inner(),
+            [key("Boot0000", EFI_GLOBAL_VARIABLE)],
+            "variables set"
+        );
+    }
+}
diff --git a/src/lib/efi_variables/boot_manager/consoles.rs b/src/lib/efi_variables/boot_manager/consoles.rs
new file mode 100644
index 0000000..c86806d
--- /dev/null
+++ b/src/lib/efi_variables/boot_manager/consoles.rs
@@ -0,0 +1,448 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! variable set-device-path: the device path of ConIn, ConOut or ErrOut (UEFI 2.11 §3.3).
+
+use anyhow::Context;
+use anyhow::Result;
+use thiserror::Error;
+
+use super::console_path;
+use super::refuse_authenticated;
+use super::value_after_metadata;
+use super::BootManagerVariable;
+use super::Console;
+use super::DevicePathSource;
+use super::DevicePathText;
+use super::BOOT_MANAGER_ATTRIBUTES;
+use crate::efi_variables::device_path;
+use crate::efi_variables::globals::GlobalContents;
+use crate::efi_variables::globals::GlobalValue;
+use crate::efi_variables::globals::GlobalVariable;
+use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+use crate::efi_variables::VariableContents;
+use crate::efi_variables::VariableData;
+use crate::hii::VariableKey;
+
+/// What variable set-device-path wrote: the console variable, as variable get shows it, and why
+/// the boot manager may not take it.
+#[non_exhaustive]
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DevicePathSet {
+    pub console: GlobalVariable,
+    pub warnings: Vec<String>,
+}
+
+/// Sets the console variable `name`, ConIn, ConOut or ErrOut, to the one device path of `path`,
+/// keeping its attributes, or with NV+BS+RT if it is missing; refuses, before any write, ConInDev,
+/// ConOutDev and ErrOutDev, which the firmware sets, any other variable, one that
+/// refuse_authenticated refuses, and a path that does not read or decode, or that holds more than
+/// one device path. It warns, and writes still, for each
+/// instance of the path that the matching *Dev variable lacks: ConIn, ConOut and ErrOut "are
+/// always proper subsets" of those (UEFI 2.11 §3.3); but for an instance of a USB Class or USB
+/// WWID node, which the firmware matches to the devices of that class or WWID.
+pub(crate) fn set_device_path(
+    variables: &impl VariableData,
+    name: &str,
+    path: &DevicePathSource,
+) -> Result<DevicePathSet> {
+    let (console, devices) = match BootManagerVariable::parse(name) {
+        Some(BootManagerVariable::Console(console @ Console::ConIn)) => {
+            (console, Console::ConInDev)
+        }
+        Some(BootManagerVariable::Console(console @ Console::ConOut)) => {
+            (console, Console::ConOutDev)
+        }
+        Some(BootManagerVariable::Console(console @ Console::ErrOut)) => {
+            (console, Console::ErrOutDev)
+        }
+        Some(BootManagerVariable::Console(
+            console @ (Console::ConInDev | Console::ConOutDev | Console::ErrOutDev),
+        )) => return Err(ConsoleRefusal::Volatile(console.name()).into()),
+        Some(BootManagerVariable::LoadOption(_) | BootManagerVariable::HotKey(_)) | None => {
+            return Err(ConsoleRefusal::NotConsole(name.to_owned()).into());
+        }
+    };
+    let bytes = path.file_path_list()?.as_ref().to_vec();
+    let value = console_path(&bytes)?;
+    let key = console_key(console);
+    let attributes = variables
+        .variable_data(&key)?
+        .map_or(BOOT_MANAGER_ATTRIBUTES, |current| current.attributes());
+    refuse_authenticated(&key, attributes)?;
+
+    let devices_key = console_key(devices);
+    let known = match variables.variable_data(&devices_key)? {
+        Some(contents) => value_after_metadata(&contents)
+            .map_err(anyhow::Error::from)
+            .and_then(|value| device_path::instances(value).map_err(anyhow::Error::from))
+            .with_context(|| format!("EFI variable {devices_key} is malformed"))?
+            .into_iter()
+            .map(<[u8]>::to_vec)
+            .collect(),
+        None => Vec::new(),
+    };
+    let mut warnings = Vec::new();
+    for instance in device_path::instances(&bytes)? {
+        if known.iter().any(|known| known == instance)
+            || device_path::holds_usb_short_form(instance)?
+        {
+            continue;
+        }
+        warnings.push(format!(
+            "{} lacks the instance {} that {} gets: ConIn, ConOut and ErrOut \"are always proper \
+             subsets of ConInDev, ConOutDev, and ErrOutDev\" (UEFI 2.11 section 3.3), so the \
+             firmware may not use it",
+            devices.name(),
+            DevicePathText::of(&device_path::ended(instance)),
+            console.name()
+        ));
+    }
+
+    let contents =
+        VariableContents::new(attributes, bytes).with_context(|| format!("EFI variable {key}"))?;
+    variables.set_variable(&key, &contents)?;
+    Ok(DevicePathSet {
+        console: GlobalVariable {
+            variable: key.to_string(),
+            contents: Some(GlobalContents {
+                attributes: attributes.bits(),
+                value: GlobalValue::DevicePath(value),
+            }),
+        },
+        warnings,
+    })
+}
+
+fn console_key(console: Console) -> VariableKey {
+    VariableKey {
+        name: console.name().to_owned(),
+        guid: EFI_GLOBAL_VARIABLE,
+    }
+}
+
+/// A variable that set-device-path refuses before any read. The messages spell "section", as
+/// edk2's terminals but VT-UTF8 show '?' for '§'.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+enum ConsoleRefusal {
+    #[error("set-device-path takes ConIn, ConOut or ErrOut, not {0}")]
+    NotConsole(String),
+    #[error(
+        "set-device-path does not write {0}: \"These variables are volatile, and are set \
+         dynamically on every boot.\" (UEFI 2.11 section 3.3)"
+    )]
+    Volatile(&'static str),
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use super::*;
+    use crate::efi_variables::boot_manager::AuthenticatedRefusal;
+    use crate::efi_variables::device_path::tests::bytes;
+    use crate::efi_variables::device_path::tests::node;
+    use crate::efi_variables::device_path::tests::X64_CONIN;
+    use crate::efi_variables::device_path::tests::X64_CONOUT;
+    use crate::efi_variables::enhanced_authenticated::fixture::timestamp_metadata;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::tests::NV_BS_RT;
+    use crate::hii::VariableAttributes;
+
+    /// The text of OVMF's x86_64 ConOut: its two serial ports.
+    fn con_out_text() -> String {
+        let serial = |n: u8| {
+            format!("PciRoot(0x0)/Pci(0x1F,0x0)/Serial(0x{n})/Uart(115200,8,N,1)/VenUtf8()")
+        };
+        format!("{},/{}", serial(0), serial(1))
+    }
+
+    fn held(variables: &HeldVariables) -> BTreeMap<VariableKey, VariableContents> {
+        variables.variables.borrow().clone()
+    }
+
+    fn texts(texts: &[&str]) -> DevicePathSource {
+        DevicePathSource::Texts(texts.iter().map(|text| text.to_string()).collect())
+    }
+
+    /// The warning that `devices` lacks the instance of text `instance` that `console` gets.
+    fn lacks(devices: &str, instance: &str, console: &str) -> String {
+        format!(
+            "{devices} lacks the instance {instance} that {console} gets: ConIn, ConOut and ErrOut \
+             \"are always proper subsets of ConInDev, ConOutDev, and ErrOutDev\" (UEFI 2.11 \
+             section 3.3), so the firmware may not use it"
+        )
+    }
+
+    /// ConOut set to its own text, or to its own bytes, stays the same bytes and keeps its
+    /// attributes; a missing ErrOut is created with NV+BS+RT; each instance that the *Dev
+    /// variable lacks gets a warning, and is written all the same.
+    #[test]
+    fn set_device_path_writes_one_device_path() {
+        let con_out = bytes(X64_CONOUT);
+        let bs_rt = VariableAttributes::BOOTSERVICE_ACCESS | VariableAttributes::RUNTIME_ACCESS;
+        let variables = || {
+            HeldVariables::default()
+                .with("ConOut", EFI_GLOBAL_VARIABLE, &con_out)
+                .with("ConOutDev", EFI_GLOBAL_VARIABLE, &con_out)
+        };
+        let serial0 = "PciRoot(0x0)/Pci(0x1F,0x0)/Serial(0x0)/Uart(115200,8,N,1)/VenUtf8()";
+        let cases = [
+            (
+                "ConOut",
+                texts(&[&con_out_text()]),
+                BOOT_MANAGER_ATTRIBUTES,
+                con_out.clone(),
+                vec![],
+            ),
+            (
+                "ConOut",
+                DevicePathSource::Bytes(vec![con_out.clone()]),
+                BOOT_MANAGER_ATTRIBUTES,
+                con_out.clone(),
+                vec![],
+            ),
+            (
+                "ErrOut",
+                texts(&[serial0]),
+                BOOT_MANAGER_ATTRIBUTES,
+                device_path::from_text(serial0).expect("a serial port"),
+                vec![lacks("ErrOutDev", serial0, "ErrOut")],
+            ),
+            (
+                "ConOut",
+                texts(&[&format!("{serial0},/Pci(0x1,0x0)")]),
+                BOOT_MANAGER_ATTRIBUTES,
+                device_path::from_text(&format!("{serial0},/Pci(0x1,0x0)")).expect("two instances"),
+                vec![lacks("ConOutDev", "Pci(0x1,0x0)", "ConOut")],
+            ),
+        ];
+        for (name, path, attributes, want, warnings) in cases {
+            let variables = variables();
+
+            let set = set_device_path(&variables, name, &path)
+                .unwrap_or_else(|error| panic!("set {name} to {path:?}: {error:#}"));
+
+            let written = variables.variables.borrow()[&key(name, EFI_GLOBAL_VARIABLE)].clone();
+            assert_eq!(
+                (written.attributes(), written.data()),
+                (attributes, want.as_slice()),
+                "{name} {path:?}"
+            );
+            assert_eq!(set.warnings, warnings, "{name} {path:?}: warnings");
+            assert_eq!(
+                set.console.contents.map(|contents| contents.attributes),
+                Some(attributes.bits()),
+                "{name} {path:?}: what set-device-path prints"
+            );
+        }
+
+        // an existing variable keeps its attributes
+        let variables = HeldVariables::default();
+        variables.variables.borrow_mut().insert(
+            key("ConIn", EFI_GLOBAL_VARIABLE),
+            VariableContents::new(bs_rt, con_out.clone()).expect("hold ConIn"),
+        );
+        set_device_path(&variables, "ConIn", &texts(&[serial0])).expect("set ConIn");
+        assert_eq!(
+            variables.variables.borrow()[&key("ConIn", EFI_GLOBAL_VARIABLE)].attributes(),
+            bs_rt,
+            "ConIn's attributes"
+        );
+    }
+
+    /// OVMF's ConIn, with an instance of a USB WWID node after its parent's nodes, gets a warning
+    /// for its serial port 1 only, which ConInDev lacks; not for its instances of a USB Class or
+    /// USB WWID node, which the firmware matches to the devices of that class or WWID
+    /// (edk2-stable202608 ConPlatform.c MatchUsbShortformDevicePath()).
+    #[test]
+    fn set_device_path_warns_of_no_usb_short_form() {
+        let end_instance: &[u8] = &[0x7F, 0x01, 0x04, 0x00];
+        let end_entire: &[u8] = &[0x7F, 0xFF, 0x04, 0x00];
+        let con_in = bytes(X64_CONIN);
+        // its PS/2 keyboard, serial ports 0 and 1, and USB Class instance
+        let instances = device_path::instances(&con_in).expect("OVMF's ConIn");
+        let con_in_dev = [instances[0], end_instance, instances[1], end_entire].concat();
+        let controller =
+            device_path::from_text("PciRoot(0x0)/Pci(0x1D,0x0)").expect("a USB controller");
+        let serial: Vec<u16> = "4C530001".encode_utf16().collect();
+        let wwid = node(
+            0x03,
+            0x10,
+            &[
+                &0_u16.to_le_bytes(),
+                &0x0781_u16.to_le_bytes(),
+                &0x5581_u16.to_le_bytes(),
+                &serial
+                    .iter()
+                    .copied()
+                    .flat_map(u16::to_le_bytes)
+                    .collect::<Vec<_>>(),
+            ],
+        );
+        let path = [
+            &con_in[..con_in.len() - 4],
+            end_instance,
+            &controller[..controller.len() - 4],
+            &wwid,
+            end_entire,
+        ]
+        .concat();
+        let variables = HeldVariables::default().with("ConInDev", EFI_GLOBAL_VARIABLE, &con_in_dev);
+
+        let set = set_device_path(&variables, "ConIn", &DevicePathSource::Bytes(vec![path]))
+            .expect("set ConIn");
+
+        assert_eq!(
+            set.warnings,
+            [lacks(
+                "ConInDev",
+                "PciRoot(0x0)/Pci(0x1F,0x0)/Serial(0x1)/Uart(115200,8,N,1)/VenUtf8()",
+                "ConIn"
+            )],
+            "warnings"
+        );
+        assert_eq!(
+            variables.set.into_inner(),
+            [key("ConIn", EFI_GLOBAL_VARIABLE)],
+            "keys set"
+        );
+    }
+
+    /// ConInDev, ConOutDev and ErrOutDev, which the firmware sets, any variable but ConIn,
+    /// ConOut and ErrOut, a path that does not read or decode and bytes of two device paths are
+    /// refused before any write.
+    #[test]
+    fn set_device_path_refuses_dev_variables_and_bad_paths_unwritten() {
+        let variables = HeldVariables::default()
+            .with("ConOut", EFI_GLOBAL_VARIABLE, &bytes(X64_CONOUT))
+            .with("ConOutDev", EFI_GLOBAL_VARIABLE, &bytes(X64_CONOUT));
+        let before = held(&variables);
+        let con_out = bytes(X64_CONOUT);
+        let cases = [
+            (
+                "ConOutDev",
+                texts(&["Pci(0x1,0x0)"]),
+                "set-device-path does not write ConOutDev: \"These variables are volatile, and \
+                 are set dynamically on every boot.\" (UEFI 2.11 section 3.3)",
+            ),
+            (
+                "ErrOutDev",
+                texts(&["Pci(0x1,0x0)"]),
+                "set-device-path does not write ErrOutDev: \"These variables are volatile, and \
+                 are set dynamically on every boot.\" (UEFI 2.11 section 3.3)",
+            ),
+            (
+                "Boot0001",
+                texts(&["Pci(0x1,0x0)"]),
+                "set-device-path takes ConIn, ConOut or ErrOut, not Boot0001",
+            ),
+            (
+                "ConOut",
+                texts(&["Pci(0x1,0x0"]),
+                "--device-path \"Pci(0x1,0x0\": ",
+            ),
+            (
+                "ConOut",
+                texts(&["Pci(0x1,0x0),"]),
+                "--device-path \"Pci(0x1,0x0),\": ",
+            ),
+            (
+                "ConOut",
+                DevicePathSource::Bytes(vec![con_out[..con_out.len() - 4].to_vec()]),
+                "--device-path-file #1: ",
+            ),
+            (
+                "ConOut",
+                DevicePathSource::Bytes(vec![[&con_out[..], &con_out].concat()]),
+                "2 device paths, not the one of a console variable",
+            ),
+        ];
+        for (name, path, want) in cases {
+            let error = set_device_path(&variables, name, &path).expect_err("set refused");
+
+            assert!(
+                format!("{error:#}").starts_with(want),
+                "{name} {path:?}: {error:#}"
+            );
+        }
+        assert_eq!(held(&variables), before, "the variables");
+        assert_eq!(variables.set.into_inner(), [], "keys set");
+    }
+
+    /// The instances of a ConOutDev with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS are those of
+    /// its value after the metadata (UEFI 2.11 §8.2.1): ConOut's own give no warning, and only
+    /// an instance that it lacks does.
+    #[test]
+    fn set_device_path_takes_the_instances_of_a_dev_variable_after_its_metadata() {
+        let serial0 = "PciRoot(0x0)/Pci(0x1F,0x0)/Serial(0x0)/Uart(115200,8,N,1)/VenUtf8()";
+        let cases = [
+            (con_out_text(), vec![]),
+            (
+                format!("{serial0},/Pci(0x1,0x0)"),
+                vec![lacks("ConOutDev", "Pci(0x1,0x0)", "ConOut")],
+            ),
+        ];
+        for (text, warnings) in cases {
+            let variables = HeldVariables::default().with_attributes(
+                "ConOutDev",
+                EFI_GLOBAL_VARIABLE,
+                NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS,
+                &[timestamp_metadata(), bytes(X64_CONOUT)].concat(),
+            );
+
+            let set = set_device_path(&variables, "ConOut", &texts(&[&text]))
+                .unwrap_or_else(|error| panic!("set ConOut to {text}: {error:#}"));
+
+            assert_eq!(set.warnings, warnings, "ConOut {text}: warnings");
+        }
+    }
+
+    /// A ConOut with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS or
+    /// EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS is refused before any write: only a signed
+    /// write sets it (UEFI 2.11 §8.2.3).
+    #[test]
+    fn set_device_path_refuses_an_authenticated_console_unwritten() {
+        let con_out = bytes(X64_CONOUT);
+        let cases = [
+            (
+                NV_BS_RT | VariableAttributes::TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
+                con_out.clone(),
+            ),
+            (
+                NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS,
+                [timestamp_metadata(), con_out.clone()].concat(),
+            ),
+        ];
+        for (attributes, data) in cases {
+            let variables = HeldVariables::default().with_attributes(
+                "ConOut",
+                EFI_GLOBAL_VARIABLE,
+                attributes,
+                &data,
+            );
+            let before = held(&variables);
+
+            let error = set_device_path(&variables, "ConOut", &texts(&[&con_out_text()]))
+                .expect_err("set an authenticated ConOut");
+
+            assert_eq!(
+                error.downcast_ref(),
+                Some(&AuthenticatedRefusal(key("ConOut", EFI_GLOBAL_VARIABLE))),
+                "ConOut of {attributes:?}: {error:#}"
+            );
+            assert_eq!(held(&variables), before, "the variables, {attributes:?}");
+            assert_eq!(variables.set.into_inner(), [], "keys set, {attributes:?}");
+        }
+    }
+}
diff --git a/src/lib/efi_variables/boot_manager/creation.rs b/src/lib/efi_variables/boot_manager/creation.rs
new file mode 100644
index 0000000..2ec1390
--- /dev/null
+++ b/src/lib/efi_variables/boot_manager/creation.rs
@@ -0,0 +1,500 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! variable create-load-option: a new Boot####, Driver#### or SysPrep#### (UEFI 2.11 §3.1.3).
+
+use anyhow::Context;
+use anyhow::Result;
+use thiserror::Error;
+
+use super::boot_option_support;
+use super::load_option_data;
+use super::written_option;
+use super::DevicePathSource;
+use super::LoadOptionCategory;
+use super::LoadOptionFlag;
+use super::BOOT_MANAGER_ATTRIBUTES;
+use crate::efi_variables::globals::BootOptionFlags;
+use crate::efi_variables::globals::GlobalContents;
+use crate::efi_variables::globals::GlobalValue;
+use crate::efi_variables::globals::GlobalVariable;
+use crate::efi_variables::globals::LoadOptionKind;
+use crate::efi_variables::globals::LoadOptionName;
+use crate::efi_variables::load_option::LoadOption;
+use crate::efi_variables::load_option::LoadOptionAttributes;
+use crate::efi_variables::load_option::Ucs2String;
+use crate::efi_variables::VariableContents;
+use crate::efi_variables::VariableData;
+
+/// The subcommand, which the refusals name
+const CREATE_LOAD_OPTION: &str = "create-load-option";
+
+/// A load option to create: its flags and category, its Description, its device paths, the first
+/// of which locates the image, and its OptionalData, the bytes that the boot manager passes to
+/// the image.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct NewLoadOption {
+    pub flags: Vec<LoadOptionFlag>,
+    pub category: LoadOptionCategory,
+    pub description: String,
+    pub device_paths: DevicePathSource,
+    pub optional_data: Vec<u8>,
+}
+
+impl NewLoadOption {
+    /// Its EFI_LOAD_OPTION: "When creating a new load option, all undefined attribute bits must
+    /// be written as zero" (UEFI 2.11 §3.1.3), so its Attributes hold its flags and category
+    /// only.
+    fn load_option(&self) -> Result<LoadOption> {
+        let attributes = self
+            .flags
+            .iter()
+            .map(|flag| flag.attribute())
+            .fold(self.category.attributes(), LoadOptionAttributes::union);
+        let description = Ucs2String::try_from(self.description.as_str())
+            .context("--description takes UCS-2 text without Null")?;
+        Ok(LoadOption {
+            attributes,
+            description,
+            file_paths: self.device_paths.file_path_list()?,
+            optional_data: self.optional_data.clone(),
+        })
+    }
+}
+
+/// What variable create-load-option wrote: the load option, as variable get shows it, and why
+/// the boot manager may not take it.
+#[non_exhaustive]
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LoadOptionCreated {
+    pub option: GlobalVariable,
+    pub warnings: Vec<String>,
+}
+
+/// Creates the load option `name`, a Boot####, Driver#### or SysPrep#### of EFI_GLOBAL_VARIABLE,
+/// with NV+BS+RT, as `new` says; refuses, before any write, another variable, an existing one, a
+/// Description other than UCS-2 and device paths that do not read or decode. It warns, and
+/// writes still, when BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_SYSPREP for a SysPrep####
+/// or EFI_BOOT_OPTION_SUPPORT_APP for an app Boot#### (UEFI 2.11 §3.1.4); LOAD_OPTION_CATEGORY "is
+/// ignored for variables of the form Driver####, SysPrep####, or OsRecovery####" (§3.1.3).
+pub(crate) fn create_load_option(
+    variables: &impl VariableData,
+    name: &str,
+    new: &NewLoadOption,
+) -> Result<LoadOptionCreated> {
+    let option = written_option(name, CREATE_LOAD_OPTION)?;
+    let load_option = new.load_option()?;
+    let key = option.key();
+    if variables.variable_data(&key)?.is_some() {
+        return Err(CreationRefusal::Exists(option).into());
+    }
+    let support = boot_option_support(variables)?.flags;
+    let warnings = [
+        (
+            option.kind == LoadOptionKind::SysPrep,
+            BootOptionFlags::SYSPREP,
+            "SysPrep#### load options",
+        ),
+        (
+            option.kind == LoadOptionKind::Boot && new.category == LoadOptionCategory::App,
+            BootOptionFlags::APP,
+            "load options of LOAD_OPTION_CATEGORY_APP",
+        ),
+    ]
+    .into_iter()
+    .filter(|(wanted, flag, _)| *wanted && !support.contains(*flag))
+    .map(|(_, flag, what)| unsupported(option, flag, what))
+    .collect();
+
+    let bytes = load_option.encode();
+    let value = load_option_data(&bytes).with_context(|| format!("EFI variable {key}"))?;
+    let contents = VariableContents::new(BOOT_MANAGER_ATTRIBUTES, bytes)
+        .with_context(|| format!("EFI variable {key}"))?;
+    variables.set_variable(&key, &contents)?;
+    Ok(LoadOptionCreated {
+        option: GlobalVariable {
+            variable: key.to_string(),
+            contents: Some(GlobalContents {
+                attributes: BOOT_MANAGER_ATTRIBUTES.bits(),
+                value: GlobalValue::LoadOptionData(value),
+            }),
+        },
+        warnings,
+    })
+}
+
+/// The warning that BootOptionSupport lacks `flag`, without which the boot manager supports no
+/// `what`.
+fn unsupported(option: LoadOptionName, flag: BootOptionFlags, what: &str) -> String {
+    let flag = flag.iter_names().map(|(name, _)| name).collect::<String>();
+    format!(
+        "BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_{flag}: the boot manager may ignore \
+         {option}, as it supports no {what} (UEFI 2.11 section 3.1.4)"
+    )
+}
+
+/// What create-load-option refuses before any write, but the names of written_option.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+enum CreationRefusal {
+    #[error(
+        "{0} exists: create-load-option creates load options; set-attributes changes the \
+         Attributes of one, and variable set BootOrder its place in BootOrder"
+    )]
+    Exists(LoadOptionName),
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use super::*;
+    use crate::efi_variables::boot_manager::read;
+    use crate::efi_variables::boot_manager::BootManagerVariable;
+    use crate::efi_variables::device_path::tests::bytes;
+    use crate::efi_variables::device_path::tests::X64_BOOT0000;
+    use crate::efi_variables::device_path::tests::X64_BOOT0001;
+    use crate::efi_variables::device_path::tests::X64_BOOT0002;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+    use crate::efi_variables::load_option::LoadOption;
+    use crate::hii::VariableKey;
+
+    /// The text of the device path of OVMF's x86_64 Boot0002, its UEFI Shell.
+    const SHELL: &str =
+        "Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(7C04A583-9E3E-4F1C-AD65-E05268D0B4D1)";
+
+    /// A load option of `flags`, category `category` and `description`, of the device paths of
+    /// `texts` and no OptionalData.
+    fn new(
+        flags: &[LoadOptionFlag],
+        category: LoadOptionCategory,
+        description: &str,
+        texts: &[&str],
+    ) -> NewLoadOption {
+        NewLoadOption {
+            flags: flags.to_vec(),
+            category,
+            description: description.to_owned(),
+            device_paths: DevicePathSource::Texts(
+                texts.iter().map(|text| text.to_string()).collect(),
+            ),
+            optional_data: Vec::new(),
+        }
+    }
+
+    fn held(variables: &HeldVariables) -> BTreeMap<VariableKey, VariableContents> {
+        variables.variables.borrow().clone()
+    }
+
+    /// The load options that OVMF's boot manager wrote, created again from what variable get
+    /// shows of them, are the same bytes: Attributes of the flags and category only, the
+    /// Description, the FilePathList from text or from bytes, and OptionalData as given.
+    #[test]
+    fn create_load_option_writes_new_options_byte_for_byte() {
+        let boot0001 = LoadOption::decode(&bytes(X64_BOOT0001)).expect("OVMF's Boot0001");
+        let cases = [
+            (
+                "Boot0000",
+                new(
+                    &[LoadOptionFlag::Active, LoadOptionFlag::Hidden],
+                    LoadOptionCategory::App,
+                    "UiApp",
+                    &["Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)"],
+                ),
+                X64_BOOT0000,
+            ),
+            (
+                "Boot0001",
+                NewLoadOption {
+                    optional_data: boot0001.optional_data.clone(),
+                    ..new(
+                        &[LoadOptionFlag::Active],
+                        LoadOptionCategory::Boot,
+                        "UEFI Misc Device",
+                        &["PciRoot(0x0)/Pci(0x1,0x0)"],
+                    )
+                },
+                X64_BOOT0001,
+            ),
+            (
+                "Driver0001",
+                NewLoadOption {
+                    optional_data: boot0001.optional_data.clone(),
+                    device_paths: DevicePathSource::Bytes(vec![boot0001.file_paths.as_ref().to_vec()]),
+                    ..new(&[LoadOptionFlag::Active], LoadOptionCategory::Boot, "UEFI Misc Device", &[])
+                },
+                X64_BOOT0001,
+            ),
+            (
+                "SysPrep0002",
+                new(
+                    &[LoadOptionFlag::Active],
+                    LoadOptionCategory::Boot,
+                    "EFI Internal Shell",
+                    &[SHELL],
+                ),
+                X64_BOOT0002,
+            ),
+        ];
+        for (name, new, want) in cases {
+            let variables = HeldVariables::default().with(
+                "BootOptionSupport",
+                EFI_GLOBAL_VARIABLE,
+                &0x313_u32.to_le_bytes(),
+            );
+
+            let created = create_load_option(&variables, name, &new)
+                .unwrap_or_else(|error| panic!("create {name}: {error:#}"));
+
+            let written = variables.variables.borrow()[&key(name, EFI_GLOBAL_VARIABLE)].clone();
+            assert_eq!(written.data(), bytes(want), "{name}: bytes");
+            assert_eq!(
+                written.attributes(),
+                BOOT_MANAGER_ATTRIBUTES,
+                "{name}: NV+BS+RT"
+            );
+            assert_eq!(created.warnings, Vec::<String>::new(), "{name}: warnings");
+            assert_eq!(
+                Some(created.option),
+                read(
+                    &variables,
+                    BootManagerVariable::parse(name).expect("a load option"),
+                    None
+                )
+                .ok(),
+                "{name}: what create-load-option prints is what get shows"
+            );
+        }
+
+        // two device paths, packed in order
+        let variables = HeldVariables::default();
+        create_load_option(
+            &variables,
+            "Boot0003",
+            &new(
+                &[],
+                LoadOptionCategory::Boot,
+                "two",
+                &[SHELL, "PciRoot(0x0)/Pci(0x1,0x0)"],
+            ),
+        )
+        .expect("create Boot0003");
+        let boot0003 = LoadOption::decode(
+            variables.variables.borrow()[&key("Boot0003", EFI_GLOBAL_VARIABLE)].data(),
+        )
+        .expect("decode Boot0003");
+        let shell = LoadOption::decode(&bytes(X64_BOOT0002)).expect("OVMF's Boot0002");
+        assert_eq!(
+            boot0003.file_paths.as_ref(),
+            [shell.file_paths.as_ref(), boot0001.file_paths.as_ref()].concat(),
+            "Boot0003: FilePathList"
+        );
+        assert_eq!(boot0003.attributes.bits(), 0, "Boot0003: no flag");
+
+        // an app of no flag: Attributes 0x100, else OVMF's Boot0000
+        let variables = HeldVariables::default();
+        create_load_option(
+            &variables,
+            "Boot0000",
+            &new(
+                &[],
+                LoadOptionCategory::App,
+                "UiApp",
+                &["Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)"],
+            ),
+        )
+        .expect("create Boot0000");
+        let want = [&0x100_u32.to_le_bytes()[..], &bytes(X64_BOOT0000)[4..]].concat();
+        assert_eq!(
+            variables.variables.borrow()[&key("Boot0000", EFI_GLOBAL_VARIABLE)].data(),
+            want,
+            "Boot0000: an app of no flag"
+        );
+    }
+
+    /// An existing load option, a Description other than UCS-2 text without Null, device paths
+    /// that do not read or decode, and a name of no Boot####, Driver#### or SysPrep#### are
+    /// refused before any write.
+    #[test]
+    fn create_load_option_refuses_existing_options_and_bad_input_unwritten() {
+        let variables = HeldVariables::default()
+            .with("Boot0001", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0001))
+            .with("SysPrep0001", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0001));
+        let before = held(&variables);
+        let shell = new(
+            &[LoadOptionFlag::Active],
+            LoadOptionCategory::Boot,
+            "Shell",
+            &[SHELL],
+        );
+        let path = LoadOption::decode(&bytes(X64_BOOT0002))
+            .expect("OVMF's Boot0002")
+            .file_paths;
+        let cases = [
+            (
+                "Boot0001",
+                shell.clone(),
+                "Boot0001 exists: create-load-option creates load options; set-attributes changes \
+                 the Attributes of one, and variable set BootOrder its place in BootOrder",
+            ),
+            (
+                "SysPrep0001",
+                shell.clone(),
+                "SysPrep0001 exists: create-load-option creates load options; set-attributes \
+                 changes the Attributes of one, and variable set BootOrder its place in BootOrder",
+            ),
+            (
+                "Boot0002",
+                NewLoadOption {
+                    description: "Shell \u{1F41A}".to_owned(),
+                    ..shell.clone()
+                },
+                "--description takes UCS-2 text without Null: ",
+            ),
+            (
+                "Boot0002",
+                NewLoadOption {
+                    description: "Sh\0ell".to_owned(),
+                    ..shell.clone()
+                },
+                "--description takes UCS-2 text without Null: ",
+            ),
+            (
+                "Boot0002",
+                new(
+                    &[],
+                    LoadOptionCategory::Boot,
+                    "Shell",
+                    &["Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1"],
+                ),
+                "--device-path \"Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1\": ",
+            ),
+            (
+                "Boot0002",
+                new(&[], LoadOptionCategory::Boot, "Shell", &["Shell(1)"]),
+                "--device-path \"Shell(1)\": ",
+            ),
+            (
+                "Boot0002",
+                NewLoadOption {
+                    device_paths: DevicePathSource::Bytes(vec![path.as_ref()
+                        [..path.as_ref().len() - 4]
+                        .to_vec()]),
+                    ..shell.clone()
+                },
+                "--device-path-file #1: ",
+            ),
+            (
+                "Boot0002",
+                NewLoadOption {
+                    device_paths: DevicePathSource::Bytes(vec![
+                        path.as_ref().to_vec(),
+                        vec![0x7F, 0xFF, 0x03, 0x00],
+                    ]),
+                    ..shell.clone()
+                },
+                "--device-path-file #2: ",
+            ),
+            (
+                "PlatformRecovery0000",
+                shell.clone(),
+                "create-load-option does not write PlatformRecovery0000: ",
+            ),
+            (
+                "OsRecovery0000",
+                shell.clone(),
+                "create-load-option does not write OsRecovery0000, a Secure Boot Policy Variable: ",
+            ),
+            (
+                "Key0001",
+                shell.clone(),
+                "create-load-option takes a Boot####, Driver#### or SysPrep####, not Key0001",
+            ),
+        ];
+        for (name, new, want) in cases {
+            let error = create_load_option(&variables, name, &new).expect_err("create refused");
+
+            assert!(format!("{error:#}").starts_with(want), "{name}: {error:#}");
+        }
+        assert_eq!(held(&variables), before, "the variables");
+        assert_eq!(variables.set.into_inner(), [], "keys set");
+    }
+
+    /// A SysPrep#### while BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_SYSPREP, and an app
+    /// Boot#### while it lacks EFI_BOOT_OPTION_SUPPORT_APP, each get a warning, and are written
+    /// all the same; an absent BootOptionSupport supports neither. A Driver#### or SysPrep####
+    /// gets none for its category, which the boot manager ignores.
+    #[test]
+    fn create_load_option_warns_of_what_boot_option_support_lacks() {
+        let sysprep = "BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_SYSPREP: the boot manager \
+                       may ignore SysPrep0001, as it supports no SysPrep#### load options (UEFI \
+                       2.11 section 3.1.4)";
+        let app = |option: &str| {
+            format!(
+                "BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_APP: the boot manager may \
+                 ignore {option}, as it supports no load options of LOAD_OPTION_CATEGORY_APP \
+                 (UEFI 2.11 section 3.1.4)"
+            )
+        };
+        let cases: [(Option<u32>, &str, LoadOptionCategory, Vec<String>); 7] = [
+            (
+                None,
+                "SysPrep0001",
+                LoadOptionCategory::Boot,
+                vec![sysprep.to_owned()],
+            ),
+            (None, "Boot0001", LoadOptionCategory::Boot, vec![]),
+            (
+                None,
+                "Boot0001",
+                LoadOptionCategory::App,
+                vec![app("Boot0001")],
+            ),
+            (
+                Some(0x301),
+                "SysPrep0001",
+                LoadOptionCategory::App,
+                vec![sysprep.to_owned()],
+            ),
+            (Some(0x012), "SysPrep0001", LoadOptionCategory::App, vec![]),
+            (Some(0x010), "Driver0001", LoadOptionCategory::App, vec![]),
+            (
+                Some(0x010),
+                "Boot0001",
+                LoadOptionCategory::App,
+                vec![app("Boot0001")],
+            ),
+        ];
+        for (support, name, category, want) in cases {
+            let variables = match support {
+                Some(support) => HeldVariables::default().with(
+                    "BootOptionSupport",
+                    EFI_GLOBAL_VARIABLE,
+                    &support.to_le_bytes(),
+                ),
+                None => HeldVariables::default(),
+            };
+
+            let created =
+                create_load_option(&variables, name, &new(&[], category, "Shell", &[SHELL]))
+                    .unwrap_or_else(|error| panic!("create {name}: {error:#}"));
+
+            assert_eq!(created.warnings, want, "{support:?} {name} {category:?}");
+            assert_eq!(
+                variables.set.into_inner(),
+                [key(name, EFI_GLOBAL_VARIABLE)],
+                "{support:?} {name} {category:?}: keys set"
+            );
+        }
+    }
+}
diff --git a/src/lib/efi_variables/boot_manager/hot_keys.rs b/src/lib/efi_variables/boot_manager/hot_keys.rs
new file mode 100644
index 0000000..da0b6e8
--- /dev/null
+++ b/src/lib/efi_variables/boot_manager/hot_keys.rs
@@ -0,0 +1,564 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! variable create-key: a new Key####, a hot key that starts a Boot#### (UEFI 2.11 §3.1.6).
+
+use anyhow::Context;
+use anyhow::Result;
+use thiserror::Error;
+
+use super::boot_option_support;
+use super::hot_key_variable;
+use super::option_number;
+use super::value_after_metadata;
+use super::BootManagerVariable;
+use super::HotKeyListing;
+use super::KeyModifier;
+use super::BOOT_MANAGER_ATTRIBUTES;
+use crate::efi_variables::globals::BootOptionFlags;
+use crate::efi_variables::globals::GlobalContents;
+use crate::efi_variables::globals::GlobalValue;
+use crate::efi_variables::globals::GlobalVariable;
+use crate::efi_variables::globals::LoadOptionKind;
+use crate::efi_variables::globals::LoadOptionName;
+use crate::efi_variables::key_option::InputKey;
+use crate::efi_variables::key_option::KeyModifiers;
+use crate::efi_variables::key_option::KeyOption;
+use crate::efi_variables::VariableContents;
+use crate::efi_variables::VariableData;
+use crate::hii::VariableKey;
+
+/// A hot key to create: the Boot#### that it starts, such as Boot0001, and the keys that start it,
+/// pressed with exactly the shift states `modifiers`.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct NewHotKey {
+    pub boot_option: String,
+    pub modifiers: Vec<KeyModifier>,
+    pub keys: Vec<InputKey>,
+}
+
+/// What variable create-key wrote: the hot key, as variable get shows it, and what it could not
+/// check.
+#[non_exhaustive]
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct HotKeyCreated {
+    pub key: GlobalVariable,
+    pub warnings: Vec<String>,
+}
+
+/// Creates the hot key `name`, a Key#### of EFI_GLOBAL_VARIABLE that does not exist, with
+/// NV+BS+RT, as `new` says, its BootOptionCrc the CRC-32 of the Boot####'s value after any
+/// EFI_VARIABLE_AUTHENTICATION_3 metadata (UEFI 2.11 §8.2.1). Refuses, before any write, another
+/// variable, an existing one, a missing Boot####, one whose metadata metadata_end refuses, more
+/// keys than InputKeyCount counts, a BootOptionSupport without EFI_BOOT_OPTION_SUPPORT_KEY or with
+/// an EFI_BOOT_OPTION_SUPPORT_COUNT below the keys, an absent one supporting none (§3.1.4), and
+/// the shift states and keys of a Key#### of `hot_keys` that the boot manager takes, which it
+/// refuses too (edk2-stable202608 EfiBootManagerAddKeyOptionVariable(), BmHotkey.c). Where
+/// `hot_keys` are unlisted, it warns that it could not check them.
+pub(crate) fn create_key(
+    variables: &impl VariableData,
+    hot_keys: &HotKeyListing,
+    name: &str,
+    new: &NewHotKey,
+) -> Result<HotKeyCreated> {
+    let Some(BootManagerVariable::HotKey(number)) = BootManagerVariable::parse(name) else {
+        return Err(HotKeyRefusal::NotHotKey(name.to_owned()).into());
+    };
+    let boot_option = option_number(&new.boot_option, LoadOptionKind::Boot.prefix())
+        .map(|number| LoadOptionName {
+            kind: LoadOptionKind::Boot,
+            number,
+        })
+        .ok_or_else(|| HotKeyRefusal::NotBootOption(new.boot_option.clone()))?;
+    let key = hot_key_variable(number);
+    if variables.variable_data(&key)?.is_some() {
+        return Err(HotKeyRefusal::Exists(name.to_owned()).into());
+    }
+    let boot = variables
+        .variable_data(&boot_option.key())?
+        .ok_or(HotKeyRefusal::Absent(boot_option))?;
+    let load_option = value_after_metadata(&boot)
+        .with_context(|| format!("EFI variable {} is malformed", boot_option.key()))?;
+    let modifiers = new
+        .modifiers
+        .iter()
+        .map(|modifier| modifier.modifiers())
+        .fold(KeyModifiers::empty(), KeyModifiers::union);
+    let option = KeyOption::new(modifiers, new.keys.clone(), boot_option.number, load_option)?;
+
+    let support = boot_option_support(variables)?;
+    if !support.flags.contains(BootOptionFlags::KEY) {
+        return Err(HotKeyRefusal::Unsupported.into());
+    }
+    if usize::try_from(support.count).is_ok_and(|count| count < option.keys.len()) {
+        return Err(HotKeyRefusal::TooManyKeys {
+            count: support.count,
+            keys: option.keys.len(),
+        }
+        .into());
+    }
+    let warnings = match hot_keys {
+        HotKeyListing::Listed(numbers) => {
+            if let Some(taken) = taken_by(variables, numbers, &option)? {
+                return Err(HotKeyRefusal::Taken(taken).into());
+            }
+            Vec::new()
+        }
+        HotKeyListing::Unlisted => vec![format!(
+            "EFI variables cannot be listed here, so create-key cannot tell whether a Key#### \
+             that the boot manager takes holds the same shift states and keys as {name}, which \
+             the boot manager would then ignore"
+        )],
+    };
+
+    let contents = VariableContents::new(BOOT_MANAGER_ATTRIBUTES, option.encode())
+        .with_context(|| format!("EFI variable {key}"))?;
+    variables.set_variable(&key, &contents)?;
+    Ok(HotKeyCreated {
+        key: GlobalVariable {
+            variable: key.to_string(),
+            contents: Some(GlobalContents {
+                attributes: BOOT_MANAGER_ATTRIBUTES.bits(),
+                value: GlobalValue::HotKey(super::HotKey {
+                    revision: option.revision(),
+                    modifiers: option.modifiers().bits(),
+                    keys: option.keys,
+                    boot_option,
+                    crc_matches: true,
+                }),
+            }),
+        },
+        warnings,
+    })
+}
+
+/// The Key#### of `numbers` that `variables` hold, that the boot manager takes, as its Boot####
+/// exists and BootOptionCrc is its CRC-32, and whose KeyData and keys are those of `option`.
+fn taken_by(
+    variables: &impl VariableData,
+    numbers: &[u16],
+    option: &KeyOption,
+) -> Result<Option<VariableKey>> {
+    for &number in numbers {
+        let key = hot_key_variable(number);
+        let Some(contents) = variables.variable_data(&key)? else {
+            continue;
+        };
+        let Ok(value) = value_after_metadata(&contents) else {
+            continue;
+        };
+        let Ok(held) = KeyOption::decode(value) else {
+            continue;
+        };
+        if (held.key_data, &held.keys) != (option.key_data, &option.keys) {
+            continue;
+        }
+        let boot = LoadOptionName {
+            kind: LoadOptionKind::Boot,
+            number: held.boot_option,
+        };
+        if variables
+            .variable_data(&boot.key())?
+            .is_some_and(|boot| value_after_metadata(&boot).is_ok_and(|value| held.matches(value)))
+        {
+            return Ok(Some(key));
+        }
+    }
+    Ok(None)
+}
+
+/// What create-key refuses before any write. The messages spell "section", as edk2's terminals
+/// but VT-UTF8 show '?' for '§'.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+enum HotKeyRefusal {
+    #[error("create-key takes a Key####, not {0}")]
+    NotHotKey(String),
+    #[error("--boot takes a Boot####, not {0}")]
+    NotBootOption(String),
+    #[error("{0} exists: create-key creates hot keys")]
+    Exists(String),
+    #[error("{0} is absent")]
+    Absent(LoadOptionName),
+    #[error(
+        "BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_KEY, so the boot manager supports no hot \
+         keys (UEFI 2.11 section 3.1.4)"
+    )]
+    Unsupported,
+    #[error(
+        "BootOptionSupport's EFI_BOOT_OPTION_SUPPORT_COUNT is {count}, so the boot manager \
+         ignores a hot key of {keys} keys (UEFI 2.11 section 3.1.4)"
+    )]
+    TooManyKeys { count: u32, keys: usize },
+    #[error(
+        "{} holds these shift states and keys, and the boot manager takes it; it refuses another \
+         of the same",
+        .0.name
+    )]
+    Taken(VariableKey),
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use serde_json::json;
+
+    use super::*;
+    use crate::efi_variables::device_path::tests::bytes;
+    use crate::efi_variables::device_path::tests::X64_BOOT0001;
+    use crate::efi_variables::device_path::tests::X64_BOOT0002;
+    use crate::efi_variables::enhanced_authenticated::fixture::timestamp_metadata;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::tests::NV_BS_RT;
+    use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+    use crate::efi_variables::key_option::boot_option_crc;
+    use crate::hii::VariableAttributes;
+
+    /// BootOptionSupport of EFI_BOOT_OPTION_SUPPORT_KEY and an EFI_BOOT_OPTION_SUPPORT_COUNT of
+    /// 3, as OVMF's
+    const KEY_COUNT_3: u32 = 0x0000_0301;
+
+    fn input_key(text: &str) -> InputKey {
+        text.parse().expect("a key")
+    }
+
+    fn new(boot_option: &str, modifiers: &[KeyModifier], keys: &[&str]) -> NewHotKey {
+        NewHotKey {
+            boot_option: boot_option.to_owned(),
+            modifiers: modifiers.to_vec(),
+            keys: keys.iter().map(|key| input_key(key)).collect(),
+        }
+    }
+
+    /// Boot0001, Boot0002, and BootOptionSupport of `support`, if any.
+    fn variables(support: Option<u32>) -> HeldVariables {
+        let variables = HeldVariables::default()
+            .with("Boot0001", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0001))
+            .with("Boot0002", EFI_GLOBAL_VARIABLE, &bytes(X64_BOOT0002));
+        match support {
+            Some(support) => variables.with(
+                "BootOptionSupport",
+                EFI_GLOBAL_VARIABLE,
+                &support.to_le_bytes(),
+            ),
+            None => variables,
+        }
+    }
+
+    fn held(variables: &HeldVariables) -> BTreeMap<VariableKey, VariableContents> {
+        variables.variables.borrow().clone()
+    }
+
+    /// The EFI_KEY_OPTION of KeyData `key_data`, to Boot#### `boot_option` of BootOptionCrc
+    /// `crc`, of `keys`.
+    fn key_option(key_data: u32, crc: u32, boot_option: u16, keys: &[(u16, u16)]) -> Vec<u8> {
+        let mut bytes = [
+            &key_data.to_le_bytes()[..],
+            &crc.to_le_bytes(),
+            &boot_option.to_le_bytes(),
+        ]
+        .concat();
+        for (scan_code, unicode_char) in keys {
+            bytes.extend(scan_code.to_le_bytes());
+            bytes.extend(unicode_char.to_le_bytes());
+        }
+        bytes
+    }
+
+    /// A new Key#### holds KeyData of its shift states and InputKeyCount, the CRC-32 of its
+    /// Boot#### as held, the Boot####'s number and its keys, with NV+BS+RT; a stale Key#### of
+    /// the same keys, which the boot manager ignores, does not stand in its way.
+    #[test]
+    fn create_key_writes_a_key_that_its_boot_option_starts() {
+        let crc = boot_option_crc(&bytes(X64_BOOT0001));
+        let variables = variables(Some(KEY_COUNT_3)).with(
+            "Key0001",
+            EFI_GLOBAL_VARIABLE,
+            &key_option(0x4000_0200, crc ^ 1, 1, &[(0x000B, 0)]),
+        );
+
+        let created = create_key(
+            &variables,
+            &HotKeyListing::Listed(vec![1]),
+            "Key000A",
+            &new("Boot0001", &[KeyModifier::Control], &["F1"]),
+        )
+        .expect("create Key000A");
+        let three = create_key(
+            &variables,
+            &HotKeyListing::Listed(vec![1, 0xA]),
+            "Key000B",
+            &new(
+                "Boot0001",
+                &[KeyModifier::Alt, KeyModifier::SysReq],
+                &["p", "r", "ESC"],
+            ),
+        )
+        .expect("create Key000B");
+
+        let held = held(&variables);
+        assert_eq!(
+            (
+                held[&key("Key000A", EFI_GLOBAL_VARIABLE)].attributes(),
+                held[&key("Key000A", EFI_GLOBAL_VARIABLE)].data()
+            ),
+            (
+                BOOT_MANAGER_ATTRIBUTES,
+                key_option(0x4000_0200, crc, 1, &[(0x000B, 0)]).as_slice()
+            ),
+            "Key000A"
+        );
+        assert_eq!(
+            held[&key("Key000B", EFI_GLOBAL_VARIABLE)].data(),
+            key_option(0xC000_2400, crc, 1, &[(0, 0x70), (0, 0x72), (0x0017, 0)]),
+            "Key000B"
+        );
+        assert_eq!(
+            serde_json::to_value(&created.key).expect("serialize"),
+            json!({
+                "variable": "Key000A-8be4df61-93ca-11d2-aa0d-00e098032b8c",
+                "attributes": 7,
+                "value": {
+                    "revision": 0,
+                    "modifiers": ["control"],
+                    "keys": ["F1"],
+                    "boot_option": "Boot0001",
+                    "crc_matches": true,
+                },
+            }),
+            "what create-key prints"
+        );
+        assert_eq!(
+            (created.warnings, three.warnings),
+            (Vec::new(), Vec::new()),
+            "warnings"
+        );
+    }
+
+    /// An existing Key####, a missing Boot####, a --boot of no Boot####, a name of no Key####, a
+    /// BootOptionSupport without EFI_BOOT_OPTION_SUPPORT_KEY, absent too, or with an
+    /// EFI_BOOT_OPTION_SUPPORT_COUNT below the keys, 4 keys, and the shift states and keys of a
+    /// Key#### that the boot manager takes, of any Boot####, are refused before any write.
+    #[test]
+    fn create_key_refuses_unwritten() {
+        let f1 = new("Boot0001", &[KeyModifier::Control], &["F1"]);
+        let two = new("Boot0001", &[], &["a", "b"]);
+        let taken = key_option(
+            0x4000_0200,
+            boot_option_crc(&bytes(X64_BOOT0002)),
+            2,
+            &[(0x000B, 0)],
+        );
+        let cases = [
+            (
+                Some(KEY_COUNT_3),
+                "Key0003",
+                f1.clone(),
+                "Key0003 exists: create-key creates hot keys",
+            ),
+            (
+                Some(KEY_COUNT_3),
+                "Key0004",
+                new("Boot1234", &[], &["F1"]),
+                "Boot1234 is absent",
+            ),
+            (
+                Some(KEY_COUNT_3),
+                "Key0004",
+                new("Driver0001", &[], &["F1"]),
+                "--boot takes a Boot####, not Driver0001",
+            ),
+            (
+                Some(KEY_COUNT_3),
+                "Boot0004",
+                f1.clone(),
+                "create-key takes a Key####, not Boot0004",
+            ),
+            (
+                None,
+                "Key0004",
+                f1.clone(),
+                "BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_KEY, so the boot manager \
+                 supports no hot keys (UEFI 2.11 section 3.1.4)",
+            ),
+            (
+                Some(0x0000_0312),
+                "Key0004",
+                f1.clone(),
+                "BootOptionSupport lacks EFI_BOOT_OPTION_SUPPORT_KEY, so the boot manager \
+                 supports no hot keys (UEFI 2.11 section 3.1.4)",
+            ),
+            (
+                Some(0x0000_0101),
+                "Key0004",
+                two.clone(),
+                "BootOptionSupport's EFI_BOOT_OPTION_SUPPORT_COUNT is 1, so the boot manager \
+                 ignores a hot key of 2 keys (UEFI 2.11 section 3.1.4)",
+            ),
+            (
+                Some(KEY_COUNT_3),
+                "Key0004",
+                new("Boot0001", &[], &["a", "b", "c", "d"]),
+                "a hot key takes 0 to 3 keys, which InputKeyCount counts, not 4",
+            ),
+            (
+                Some(KEY_COUNT_3),
+                "Key0004",
+                f1.clone(),
+                "Key0002 holds these shift states and keys, and the boot manager takes it; it \
+                 refuses another of the same",
+            ),
+        ];
+        for (support, name, new, want) in cases {
+            let variables = variables(support)
+                .with("Key0002", EFI_GLOBAL_VARIABLE, &taken)
+                .with("Key0003", EFI_GLOBAL_VARIABLE, &taken[..12]);
+            let before = held(&variables);
+
+            let error = create_key(&variables, &HotKeyListing::Listed(vec![2, 3]), name, &new)
+                .expect_err("create a refused hot key");
+
+            assert_eq!(error.to_string(), want, "{support:?} {name} {new:?}");
+            assert_eq!(held(&variables), before, "{name}: the variables");
+            assert_eq!(variables.set.into_inner(), [], "{name}: keys set");
+        }
+    }
+
+    /// Of a Boot#### with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS, BootOptionCrc is "the CRC-32
+    /// of the entire EFI_LOAD_OPTION" (UEFI 2.11 §3.1.6), its value after the metadata (§8.2.1);
+    /// one whose data ends inside its metadata is refused before any write.
+    #[test]
+    fn create_key_takes_the_crc_of_the_load_option_after_its_metadata() {
+        let enhanced = NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS;
+        let data = [timestamp_metadata(), bytes(X64_BOOT0001)].concat();
+        let crc = boot_option_crc(&bytes(X64_BOOT0001));
+        assert_ne!(crc, boot_option_crc(&data), "premise: the CRC-32s differ");
+        let f2 = new("Boot0001", &[], &["F2"]);
+        let whole = variables(Some(KEY_COUNT_3)).with_attributes(
+            "Boot0001",
+            EFI_GLOBAL_VARIABLE,
+            enhanced,
+            &data,
+        );
+        let truncated = variables(Some(KEY_COUNT_3)).with_attributes(
+            "Boot0001",
+            EFI_GLOBAL_VARIABLE,
+            enhanced,
+            &timestamp_metadata()[..10],
+        );
+
+        create_key(&whole, &HotKeyListing::Listed(Vec::new()), "Key0001", &f2)
+            .expect("create Key0001");
+        let error = create_key(
+            &truncated,
+            &HotKeyListing::Listed(Vec::new()),
+            "Key0001",
+            &f2,
+        )
+        .expect_err("create a Key#### of a Boot#### that ends inside its metadata");
+
+        assert_eq!(
+            held(&whole)[&key("Key0001", EFI_GLOBAL_VARIABLE)].data(),
+            key_option(0x4000_0000, crc, 1, &[(0x000C, 0)]),
+            "Key0001"
+        );
+        assert_eq!(
+            format!("{error:#}"),
+            "EFI variable Boot0001-8be4df61-93ca-11d2-aa0d-00e098032b8c is malformed: its 10 \
+             bytes of data end inside its metadata",
+            "a Boot#### that ends inside its metadata"
+        );
+        assert_eq!(truncated.set.into_inner(), [], "keys set");
+    }
+
+    /// A Key#### that the boot manager takes holds the same shift states and keys, as its value
+    /// after the metadata tells, or as the CRC-32 of its Boot####'s value after the metadata
+    /// tells, of a Key#### or Boot#### with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS (UEFI 2.11
+    /// §8.2.1): create-key refuses the same keys before any write.
+    #[test]
+    fn create_key_refuses_the_keys_of_a_key_taken_after_metadata() {
+        let enhanced = NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS;
+        let after_metadata = |value: Vec<u8>| [timestamp_metadata(), value].concat();
+        let taken = key_option(
+            0x4000_0200,
+            boot_option_crc(&bytes(X64_BOOT0002)),
+            2,
+            &[(0x000B, 0)],
+        );
+        let cases = [
+            (
+                "an enhanced Key0002",
+                (NV_BS_RT, bytes(X64_BOOT0002)),
+                (enhanced, after_metadata(taken.clone())),
+            ),
+            (
+                "an enhanced Boot0002",
+                (enhanced, after_metadata(bytes(X64_BOOT0002))),
+                (NV_BS_RT, taken.clone()),
+            ),
+        ];
+        for (case, (boot_attributes, boot), (key_attributes, hot_key)) in cases {
+            let variables = variables(Some(KEY_COUNT_3))
+                .with_attributes("Boot0002", EFI_GLOBAL_VARIABLE, boot_attributes, &boot)
+                .with_attributes("Key0002", EFI_GLOBAL_VARIABLE, key_attributes, &hot_key);
+            let before = held(&variables);
+
+            let error = create_key(
+                &variables,
+                &HotKeyListing::Listed(vec![2]),
+                "Key0004",
+                &new("Boot0001", &[KeyModifier::Control], &["F1"]),
+            )
+            .expect_err("create the keys of a taken Key0002");
+
+            assert_eq!(
+                error.to_string(),
+                "Key0002 holds these shift states and keys, and the boot manager takes it; it \
+                 refuses another of the same",
+                "{case}"
+            );
+            assert_eq!(held(&variables), before, "{case}: the variables");
+            assert_eq!(variables.set.into_inner(), [], "{case}: keys set");
+        }
+    }
+
+    /// Where the Key#### variables cannot be listed, create-key writes the hot key and warns
+    /// that it could not check them.
+    #[test]
+    fn create_key_warns_where_hot_keys_are_unlisted() {
+        let variables = variables(Some(KEY_COUNT_3));
+
+        let created = create_key(
+            &variables,
+            &HotKeyListing::Unlisted,
+            "Key0004",
+            &new("Boot0001", &[], &["F1"]),
+        )
+        .expect("create Key0004");
+
+        assert_eq!(
+            created.warnings,
+            [
+                "EFI variables cannot be listed here, so create-key cannot tell whether a Key#### \
+              that the boot manager takes holds the same shift states and keys as Key0004, which \
+              the boot manager would then ignore"
+            ],
+            "warnings"
+        );
+        assert_eq!(
+            variables.set.into_inner(),
+            [key("Key0004", EFI_GLOBAL_VARIABLE)],
+            "keys set"
+        );
+    }
+}
diff --git a/src/lib/efi_variables/device_path.rs b/src/lib/efi_variables/device_path.rs
new file mode 100644
index 0000000..c899baa
--- /dev/null
+++ b/src/lib/efi_variables/device_path.rs
@@ -0,0 +1,1980 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! Device paths as text (UEFI 2.11 §10.6): each node in the form that edk2-stable202608's
+//! ConvertDevicePathToText() writes with DisplayOnly FALSE and AllowShortcuts TRUE, for each
+//! Type/Sub-Type row and named form of UEFI 2.11 Table 10.67, read back as its
+//! ConvertTextToDevicePath() reads it. NvdimmAcpiAdr, NVDIMM, RestService and NVMEoF, which edk2
+//! lacks, take the forms that Table 10.67 gives them. A node whose form would not read back to its
+//! bytes is written in the form that edk2 writes without the shortcut, if that does, else in the
+//! generic form of Table 10.67, Path() or that of its Type, which always does: the text that
+//! to_text writes reads back by from_text to the same bytes, as §10.6.1.3 requires. A device path
+//! holding an instance of no node has no text, as no text reads back to it.
+//!
+//! Where the form of edk2 would not read back, to_text differs from it by design:
+//! - a UART of BaudRate or DataBits 0 is written Uart(0,0,…), where edk2 writes DEFAULT
+//!   (DevicePathToText.c DevPathToTextUart()) and reads DEFAULT back as 115200 and 8
+//!   (DevicePathFromText.c DevPathFromTextUart()), so from_text refuses DEFAULT;
+//! - an ACPI node whose _HID is not a PNP one is written Acpi(HWP0002,…), its EISA ID as edk2
+//!   writes those of AcpiEx, where edk2 writes Acpi(0x%08x,…), which its EisaIdFromText() does
+//!   not read;
+//! - an ACPI Expanded node of UIDSTR alone and a UID other than 0 is written AcpiEx(…), where
+//!   edk2 writes AcpiExp(…), which has no UID;
+//! - a Messaging Vendor node of a GUID that edk2 names, VenPcAnsi() and DebugPort() among them,
+//!   with data that the name does not show is written VenMsg(GUID,data), where edk2 writes the
+//!   name and drops the data;
+//! - a Hard Drive node of a partition number from 2^31 is written unsigned, where edk2's "%d"
+//!   writes it negative;
+//! - every other node whose form would not read back is written in its generic form. Among them,
+//!   each with a row in node_cases: a value that its keywords map back to another, such as an
+//!   ATAPI controller of 2; a field that the form does not show, such as a Reserved one, the
+//!   ports of IPv4 and IPv6 or the bytes of a MAC address past 6 for IfType 0 and 1; data past
+//!   the fields, or short of them; a string holding "/", ",", "(" or ")", a byte outside ASCII or,
+//!   where edk2 writes one, no Null at its end, such as a URI holding ","; a File Path holding
+//!   "/" or reading as a node, which edk2 writes as it is; a partition of mixed formats; an
+//!   NVMe-oF NID other than a UUID, which Table 10.67 gives no text.
+//!
+//! from_text reads each text that to_text writes as edk2 does. Where edk2 reads another text
+//! than Tables 10.66 and 10.67 say, from_text follows the tables: an omitted BaudRate, DataBits,
+//! IPv4 or IPv6 Protocol, iSCSI Authentication or HD Type reads as 115200, 8, UDP, None and GPT,
+//! an omitted HID or CID of AcpiEx and an EISAID of 0 as 0, HD's Type 1 and 2 as MBR and GPT, a
+//! BMC Address without "0x" as decimal, UartFlowCtrl's integers as their values, an IPv4
+//! GatewayIPAddress or SubnetMask, or an IPv6 PrefixLength or GatewayIPAddress, given alone as
+//! given, and an IPv4 or IPv6 Address may hold a port, or brackets. It refuses what edk2 drops or
+//! reads to another node: a name of no form, text after a form's ")", a value that does not fit
+//! its field, Uart DEFAULT, a Parity keyword next to a StopBits integer or the reverse, which
+//! "Mixing formats is prohibited" forbids and edk2 accepts.
+//!
+//! Firmware logs show the edk2 form there.
+
+mod acpi;
+mod bbs;
+mod hardware;
+mod media;
+mod network;
+mod parameters;
+mod serial;
+mod storage;
+mod usb;
+mod vendor;
+
+use thiserror::Error;
+
+use super::load_option::LoadOptionError;
+use super::load_option::RawNode;
+use super::load_option::RawNodes;
+use crate::hii::package::Guid;
+use parameters::upper_hex;
+use parameters::Parameters;
+
+/// Type, Sub-Type and Length, which every device path node starts with
+const NODE_HEADER_SIZE: usize = 4;
+/// The device path Types of UEFI 2.11 Table 10.1
+const HARDWARE: u8 = 0x01;
+const ACPI: u8 = 0x02;
+const MESSAGING: u8 = 0x03;
+const MEDIA: u8 = 0x04;
+const BBS: u8 = 0x05;
+const END: u8 = 0x7F;
+/// The Sub-Types of an End node: End This Instance and End Entire Device Path (UEFI 2.11
+/// Table 10.2)
+const END_INSTANCE: u8 = 0x01;
+const END_ENTIRE: u8 = 0xFF;
+/// The separators of a text device path: "/" between nodes, "," between instances, and the
+/// parentheses of a node's parameters, which edk2's GetNextDeviceNodeStr() skips before a node
+const SEPARATORS: [char; 4] = ['/', ',', '(', ')'];
+
+/// The generic form of a node of each Type of UEFI 2.11 Table 10.67, which to_text writes for a
+/// Sub-Type that the table names no form of (Hardware 0 and 7 to 255, ACPI 0 and 5 to 255,
+/// Messaging 0, 7, 8 and 35 to 255, Media 0 and 10 to 255, BBS 0 and 2 to 255) and for a node
+/// whose form would not read back; Path() for every other Type
+const GENERIC_NAMES: [(u8, &str); 5] = [
+    (HARDWARE, "HardwarePath"),
+    (ACPI, "AcpiPath"),
+    (MESSAGING, "Msg"),
+    (MEDIA, "MediaPath"),
+    (BBS, "BbsPath"),
+];
+
+const fn guid(data1: u32, data2: u16, data3: u16, data4: [u8; 8]) -> Guid {
+    Guid {
+        data1,
+        data2,
+        data3,
+        data4,
+    }
+}
+
+/// The device paths that `bytes` pack, as a FilePathList does, each with its End Entire Device
+/// Path node; ConIn, ConOut and ErrOut hold one.
+pub(crate) fn device_paths(bytes: &[u8]) -> Result<Vec<&[u8]>, DevicePathTextError> {
+    let mut paths = Vec::new();
+    let mut start = 0;
+    let mut end = 0;
+    for node in RawNodes::new(bytes) {
+        let node = node?;
+        end += NODE_HEADER_SIZE + node.data.len();
+        if (node.node_type, node.sub_type) == (END, END_ENTIRE) {
+            paths.push(bytes.get(start..end).ok_or(DevicePathTextError::NoEnd)?);
+            start = end;
+        }
+    }
+    match (start == bytes.len(), paths.is_empty()) {
+        (true, false) => Ok(paths),
+        (false, _) | (_, true) => Err(DevicePathTextError::NoEnd),
+    }
+}
+
+/// The instances of `path`, one device path that its End Entire Device Path node ends, each
+/// without the End node that ends it.
+pub(crate) fn instances(path: &[u8]) -> Result<Vec<&[u8]>, DevicePathTextError> {
+    let mut instances = Vec::new();
+    let (mut start, mut end) = (0, 0);
+    for node in RawNodes::new(path) {
+        let node = node?;
+        if node.node_type == END {
+            instances.push(path.get(start..end).ok_or(DevicePathTextError::NoEnd)?);
+            start = end + NODE_HEADER_SIZE + node.data.len();
+        }
+        end += NODE_HEADER_SIZE + node.data.len();
+    }
+    Ok(instances)
+}
+
+/// The device path of the one instance `instance`, ended by an End Entire Device Path node.
+pub(crate) fn ended(instance: &[u8]) -> Vec<u8> {
+    [instance, &end_node(END_ENTIRE)].concat()
+}
+
+/// Whether `instance` holds a USB Class or USB WWID node: a short form, which edk2-stable202608's
+/// ConPlatformDxe matches to a device by its class or WWID, not by bytes
+/// (MatchUsbShortformDevicePath()).
+pub(crate) fn holds_usb_short_form(instance: &[u8]) -> Result<bool, DevicePathTextError> {
+    for node in RawNodes::new(instance) {
+        let node = node?;
+        if node.node_type == MESSAGING && matches!(node.sub_type, usb::USB_CLASS | usb::USB_WWID) {
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+/// The text of `path`, one device path that its End Entire Device Path node ends: nodes
+/// separated by "/", instances by ",/" as edk2 writes them.
+pub(crate) fn to_text(path: &[u8]) -> Result<String, DevicePathTextError> {
+    let mut text = String::new();
+    let mut nodes_of_instance = 0_usize;
+    let mut ended = false;
+    let mut nodes = RawNodes::new(path);
+    for node in nodes.by_ref() {
+        let node = node?;
+        match (node.node_type, node.sub_type, nodes_of_instance) {
+            (END, END_ENTIRE | END_INSTANCE, 0) => return Err(DevicePathTextError::EmptyInstance),
+            (END, END_ENTIRE, _) => {
+                ended = true;
+                break;
+            }
+            (END, END_INSTANCE, _) => {
+                text.push(',');
+                nodes_of_instance = 0;
+            }
+            (END, sub_type, _) => return Err(DevicePathTextError::EndSubType(sub_type)),
+            (_, _, _) => {
+                // as edk2 writes it: "/" before each node but the first, after "," too
+                if !text.is_empty() {
+                    text.push('/');
+                }
+                text.push_str(&node_text(&node));
+                nodes_of_instance += 1;
+            }
+        }
+    }
+    match (ended, nodes.next()) {
+        (true, None) => Ok(text),
+        (true, Some(_)) => Err(DevicePathTextError::AfterEnd),
+        (false, _) => Err(DevicePathTextError::NoEnd),
+    }
+}
+
+/// The bytes of the device path that `text` writes, ended by an End Entire Device Path node:
+/// nodes separated by "/", instances by ",", as edk2's ConvertTextToDevicePath() reads them, but
+/// for the texts that it reads to a node of another form or to an instance of no node, which
+/// from_text refuses.
+pub(crate) fn from_text(text: &str) -> Result<Vec<u8>, DevicePathTextError> {
+    let nodes = node_texts(text)?;
+    if nodes.is_empty() {
+        return Err(DevicePathTextError::NoNodeText(text.to_owned()));
+    }
+    let mut bytes = Vec::new();
+    let mut nodes = nodes.into_iter().peekable();
+    while let Some((node, instance_ends)) = nodes.next() {
+        bytes.extend(node_from_text(node)?);
+        match (instance_ends, nodes.peek()) {
+            (true, None) => return Err(DevicePathTextError::NoNodeText(text.to_owned())),
+            (true, Some(_)) => bytes.extend(end_node(END_INSTANCE)),
+            (false, _) => {}
+        }
+    }
+    bytes.extend(end_node(END_ENTIRE));
+    Ok(bytes)
+}
+
+fn end_node(sub_type: u8) -> [u8; NODE_HEADER_SIZE] {
+    [END, sub_type, 4, 0]
+}
+
+/// The text of a node: its named form if that reads back to its bytes, else the form without the
+/// shortcut if that does, else its generic form.
+fn node_text(node: &RawNode<'_>) -> String {
+    let bytes = node_bytes(node.node_type, node.sub_type, node.data);
+    [named_text(node), longer_text(node)]
+        .into_iter()
+        .flatten()
+        .find(|text| {
+            matches!(node_texts(text).as_deref(), Ok([(single, false)]) if single == text)
+                && bytes
+                    .as_ref()
+                    .is_ok_and(|bytes| node_from_text(text).as_ref() == Ok(bytes))
+        })
+        .unwrap_or_else(|| generic_text(node))
+}
+
+/// The form that edk2's ConvertDeviceNodeToText() writes for the node's Type and Sub-Type, as its
+/// mUefiDevicePathLibToTextTable picks it, or Table 10.67's for the four forms that edk2 lacks.
+fn named_text(node: &RawNode<'_>) -> Option<String> {
+    let data = node.data;
+    match (node.node_type, node.sub_type) {
+        (HARDWARE, hardware::PCI) => hardware::pci_text(data),
+        (HARDWARE, hardware::PCCARD) => hardware::pc_card_text(data),
+        (HARDWARE, hardware::MEMORY_MAPPED) => hardware::memory_mapped_text(data),
+        (HARDWARE, hardware::VENDOR) => vendor::text("Hw", data),
+        (HARDWARE, hardware::CONTROLLER) => hardware::controller_text(data),
+        (HARDWARE, hardware::BMC) => hardware::bmc_text(data),
+        (ACPI, acpi::HID) => acpi::hid_text(data),
+        (ACPI, acpi::EXTENDED) => acpi::extended_text(data),
+        (ACPI, acpi::ADR) => acpi::adr_text(data),
+        (ACPI, acpi::NVDIMM) => acpi::nvdimm_text(data),
+        (MESSAGING, storage::ATAPI) => storage::atapi_text(data),
+        (MESSAGING, storage::SCSI) => storage::scsi_text(data),
+        (MESSAGING, storage::FIBRE_CHANNEL) => storage::fibre_channel_text(data),
+        (MESSAGING, storage::FIBRE_CHANNEL_EX) => storage::fibre_channel_ex_text(data),
+        (MESSAGING, storage::SAS_EX) => storage::sas_ex_text(data),
+        (MESSAGING, storage::NVME) => storage::nvme_text(data),
+        (MESSAGING, storage::UFS) => storage::ufs_text(data),
+        (MESSAGING, storage::SD) => storage::slot_text("SD", data),
+        (MESSAGING, storage::EMMC) => storage::slot_text("eMMC", data),
+        (MESSAGING, storage::F1394) => storage::f1394_text(data),
+        (MESSAGING, usb::USB) => usb::usb_text(data),
+        (MESSAGING, usb::USB_WWID) => usb::wwid_text(data),
+        (MESSAGING, storage::LOGICAL_UNIT) => storage::logical_unit_text(data),
+        (MESSAGING, usb::USB_CLASS) => usb::class_text(data),
+        (MESSAGING, storage::SATA) => storage::sata_text(data),
+        (MESSAGING, storage::I2O) => storage::i2o_text(data),
+        (MESSAGING, network::MAC_ADDRESS) => network::mac_text(data),
+        (MESSAGING, network::IPV4) => network::ipv4_text_of(data),
+        (MESSAGING, network::IPV6) => network::ipv6_text_of(data),
+        (MESSAGING, network::INFINIBAND) => network::infiniband_text(data),
+        (MESSAGING, serial::UART) => serial::uart_text(data),
+        (MESSAGING, vendor::MESSAGING_VENDOR) => vendor::messaging_text(data),
+        (MESSAGING, storage::ISCSI) => storage::iscsi_text(data),
+        (MESSAGING, network::VLAN) => network::vlan_text(data),
+        (MESSAGING, network::DNS) => network::dns_text(data),
+        (MESSAGING, network::URI) => network::uri_text(data),
+        (MESSAGING, network::BLUETOOTH) => network::bluetooth_text(data),
+        (MESSAGING, network::WIFI) => network::wifi_text(data),
+        (MESSAGING, network::BLUETOOTH_LE) => network::bluetooth_le_text(data),
+        (MESSAGING, storage::NVDIMM) => storage::nvdimm_text(data),
+        (MESSAGING, network::REST_SERVICE) => network::rest_service_text(data),
+        (MESSAGING, storage::NVME_OF) => storage::nvme_of_text(data),
+        (MEDIA, media::HARD_DRIVE) => media::hard_drive_text(data),
+        (MEDIA, media::CDROM) => media::cdrom_text(data),
+        (MEDIA, media::VENDOR) => vendor::text("Media", data),
+        (MEDIA, media::PROTOCOL) => media::guid_text("Media", data),
+        (MEDIA, media::FILE_PATH) => media::file_path_text(data),
+        (MEDIA, media::FIRMWARE_VOLUME) => media::guid_text("Fv", data),
+        (MEDIA, media::FIRMWARE_FILE) => media::guid_text("FvFile", data),
+        (MEDIA, media::OFFSET) => media::offset_text(data),
+        (MEDIA, media::RAM_DISK) => media::ram_disk_text(data),
+        (BBS, bbs::BBS_101) => bbs::bbs_text(data),
+        (_, _) => None,
+    }
+}
+
+/// The form that edk2 writes without the shortcut that named_text may write, which can drop a
+/// field: VenMsg for a Messaging Vendor node, AcpiEx for an ACPI Expanded one.
+fn longer_text(node: &RawNode<'_>) -> Option<String> {
+    match (node.node_type, node.sub_type) {
+        (MESSAGING, vendor::MESSAGING_VENDOR) => vendor::text("Msg", node.data),
+        (ACPI, acpi::EXTENDED) => acpi::extended_full_text(node.data),
+        (_, _) => None,
+    }
+}
+
+/// Path(Type,Sub-Type,data), or the generic form of the node's Type: decimal Type and Sub-Type,
+/// then the data as a hex dump.
+fn generic_text(node: &RawNode<'_>) -> String {
+    let mut text = match GENERIC_NAMES
+        .iter()
+        .find(|(kind, _)| *kind == node.node_type)
+    {
+        Some((_, name)) => format!("{name}({}", node.sub_type),
+        None => format!("Path({},{}", node.node_type, node.sub_type),
+    };
+    if !node.data.is_empty() {
+        text.push(',');
+        text.push_str(&upper_hex(node.data));
+    }
+    text.push(')');
+    text
+}
+
+/// The fields of a node's data, read in order; None once the data runs out.
+struct Fields<'a>(&'a [u8]);
+
+impl Fields<'_> {
+    fn take<const N: usize>(&mut self) -> Option<[u8; N]> {
+        let (head, rest) = self.0.split_first_chunk::<N>()?;
+        self.0 = rest;
+        Some(*head)
+    }
+
+    fn u8(&mut self) -> Option<u8> {
+        self.take::<1>().map(|[byte]| byte)
+    }
+
+    fn u16(&mut self) -> Option<u16> {
+        self.take().map(u16::from_le_bytes)
+    }
+
+    fn u32(&mut self) -> Option<u32> {
+        self.take().map(u32::from_le_bytes)
+    }
+
+    fn u64(&mut self) -> Option<u64> {
+        self.take().map(u64::from_le_bytes)
+    }
+
+    fn guid(&mut self) -> Option<Guid> {
+        self.take::<16>().map(Guid::from)
+    }
+}
+
+/// The text of each node, and whether a "," ends its instance, as edk2's GetNextDeviceNodeStr()
+/// (DevicePathFromText.c) splits a text device path: it skips SEPARATORS before a node, then
+/// takes the node up to a "/" or "," outside parentheses.
+fn node_texts(text: &str) -> Result<Vec<(&str, bool)>, DevicePathTextError> {
+    let mut nodes = Vec::new();
+    let mut rest = text;
+    loop {
+        rest = rest.trim_start_matches(SEPARATORS);
+        if rest.is_empty() {
+            return Ok(nodes);
+        }
+        let unpaired = || DevicePathTextError::Parentheses(rest.to_owned());
+        let mut depth = 0_usize;
+        let mut end = None;
+        for (at, c) in rest.char_indices() {
+            match c {
+                '(' => depth += 1,
+                ')' => depth = depth.checked_sub(1).ok_or_else(unpaired)?,
+                '/' | ',' if depth == 0 => {
+                    end = Some((at, c));
+                    break;
+                }
+                _ => {}
+            }
+        }
+        if depth != 0 {
+            return Err(unpaired());
+        }
+        match end {
+            Some((at, separator)) => {
+                let (node, after) = rest.split_at(at);
+                nodes.push((node, separator == ','));
+                rest = after.get(separator.len_utf8()..).unwrap_or_default();
+            }
+            None => {
+                nodes.push((rest, false));
+                return Ok(nodes);
+            }
+        }
+    }
+}
+
+/// The bytes of the node that `text` writes: a form of a Name that from_text knows, its
+/// parameters up to the first ")" as edk2's GetParamByNodeName() takes them, else a File Path
+/// whose Path Name is the text. Unlike edk2, it refuses text after that ")", which edk2 drops; a
+/// Name(...) of no form it knows, which edk2 reads as a File Path, as a typo there would become
+/// one; and an End node, as only "," and the end of the text write those.
+fn node_from_text(text: &str) -> Result<Vec<u8>, DevicePathTextError> {
+    let form = text
+        .split_once('(')
+        .filter(|(name, _)| {
+            !name.is_empty() && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-')
+        })
+        .and_then(|(name, rest)| {
+            rest.split_once(')')
+                .map(|(parameters, after)| (name, parameters, after))
+        });
+    let Some((name, parameters, after)) = form else {
+        return file_path(text);
+    };
+    let mut parameters = Parameters::new(parameters);
+    match (form_node(name, &mut parameters, text)?, after) {
+        (Some((node_type, sub_type, data)), "") => {
+            parameters.finish(text)?;
+            node_bytes(node_type, sub_type, &data)
+        }
+        (Some(_), _) => Err(DevicePathTextError::AfterParentheses(text.to_owned())),
+        (None, "") => Err(DevicePathTextError::UnknownName(text.to_owned())),
+        (None, _) => file_path(text),
+    }
+}
+
+/// The Type, Sub-Type and data of the node that the form `name` writes from `p`, as edk2's
+/// mUefiDevicePathLibDevPathFromTextTable reads each, and Table 10.67 the four forms that edk2
+/// lacks; None for a name of no form.
+fn form_node(
+    name: &str,
+    p: &mut Parameters<'_>,
+    text: &str,
+) -> Result<Option<(u8, u8, Vec<u8>)>, DevicePathTextError> {
+    let node = match name {
+        "Path" => match p.integer()? {
+            END => return Err(DevicePathTextError::EndNodeText(text.to_owned())),
+            node_type => (node_type, p.integer()?, p.hex()?),
+        },
+        "HardwarePath" => (HARDWARE, p.integer()?, p.hex()?),
+        "Pci" => (HARDWARE, hardware::PCI, hardware::pci(p)?),
+        "PcCard" => (HARDWARE, hardware::PCCARD, hardware::pc_card(p)?),
+        "MemoryMapped" => (
+            HARDWARE,
+            hardware::MEMORY_MAPPED,
+            hardware::memory_mapped(p)?,
+        ),
+        "VenHw" => (HARDWARE, hardware::VENDOR, vendor::vendor(p)?),
+        "Ctrl" => (HARDWARE, hardware::CONTROLLER, hardware::controller(p)?),
+        "BMC" => (HARDWARE, hardware::BMC, hardware::bmc(p)?),
+        "AcpiPath" => (ACPI, p.integer()?, p.hex()?),
+        "Acpi" => (ACPI, acpi::HID, acpi::hid(p)?),
+        "AcpiEx" => (ACPI, acpi::EXTENDED, acpi::extended(p)?),
+        "AcpiExp" => (ACPI, acpi::EXTENDED, acpi::expanded(p)?),
+        "AcpiAdr" => (ACPI, acpi::ADR, acpi::adr(p, text)?),
+        "NvdimmAcpiAdr" => (ACPI, acpi::NVDIMM, acpi::nvdimm(p)?),
+        "Msg" => (MESSAGING, p.integer()?, p.hex()?),
+        "Ata" => (MESSAGING, storage::ATAPI, storage::atapi(p)?),
+        "Scsi" => (MESSAGING, storage::SCSI, storage::scsi(p)?),
+        "Fibre" => (
+            MESSAGING,
+            storage::FIBRE_CHANNEL,
+            storage::fibre_channel(p)?,
+        ),
+        "FibreEx" => (
+            MESSAGING,
+            storage::FIBRE_CHANNEL_EX,
+            storage::fibre_channel_ex(p)?,
+        ),
+        "I1394" => (MESSAGING, storage::F1394, storage::f1394(p)?),
+        "USB" => (MESSAGING, usb::USB, usb::usb(p)?),
+        "I2O" => (MESSAGING, storage::I2O, storage::i2o(p)?),
+        "Infiniband" => (MESSAGING, network::INFINIBAND, network::infiniband(p)?),
+        "VenMsg" => (MESSAGING, vendor::MESSAGING_VENDOR, vendor::vendor(p)?),
+        "UartFlowCtrl" => (
+            MESSAGING,
+            vendor::MESSAGING_VENDOR,
+            vendor::flow_control(p)?,
+        ),
+        "SAS" => (MESSAGING, vendor::MESSAGING_VENDOR, vendor::sas(p)?),
+        "SasEx" => (MESSAGING, storage::SAS_EX, storage::sas_ex(p)?),
+        "NVMe" => (MESSAGING, storage::NVME, storage::nvme(p)?),
+        "UFS" => (MESSAGING, storage::UFS, storage::ufs(p)?),
+        "SD" => (MESSAGING, storage::SD, storage::slot(p)?),
+        "eMMC" => (MESSAGING, storage::EMMC, storage::slot(p)?),
+        "MAC" => (MESSAGING, network::MAC_ADDRESS, network::mac(p, text)?),
+        "IPv4" => (MESSAGING, network::IPV4, network::ipv4_node(p)?),
+        "IPv6" => (MESSAGING, network::IPV6, network::ipv6_node(p)?),
+        "Uart" => (MESSAGING, serial::UART, serial::uart(p, text)?),
+        "UsbClass" => (MESSAGING, usb::USB_CLASS, usb::class(p)?),
+        "UsbWwid" => (MESSAGING, usb::USB_WWID, usb::wwid(p)?),
+        "Unit" => (MESSAGING, storage::LOGICAL_UNIT, storage::logical_unit(p)?),
+        "iSCSI" => (MESSAGING, storage::ISCSI, storage::iscsi(p)?),
+        "Vlan" => (MESSAGING, network::VLAN, network::vlan(p)?),
+        "Dns" => (MESSAGING, network::DNS, network::dns(p, text)?),
+        "Uri" => (MESSAGING, network::URI, network::uri(p)?),
+        "Bluetooth" => (MESSAGING, network::BLUETOOTH, network::bluetooth(p)?),
+        "Wi-Fi" => (MESSAGING, network::WIFI, network::wifi(p)?),
+        "BluetoothLE" => (MESSAGING, network::BLUETOOTH_LE, network::bluetooth_le(p)?),
+        "NVDIMM" => (MESSAGING, storage::NVDIMM, storage::nvdimm(p)?),
+        "RestService" => (MESSAGING, network::REST_SERVICE, network::rest_service(p)?),
+        "NVMEoF" => (MESSAGING, storage::NVME_OF, storage::nvme_of(p)?),
+        "Sata" => (MESSAGING, storage::SATA, storage::sata(p)?),
+        "MediaPath" => (MEDIA, p.integer()?, p.hex()?),
+        "HD" => (MEDIA, media::HARD_DRIVE, media::hard_drive(p)?),
+        "CDROM" => (MEDIA, media::CDROM, media::cdrom(p)?),
+        "VenMedia" => (MEDIA, media::VENDOR, vendor::vendor(p)?),
+        "Media" => (MEDIA, media::PROTOCOL, media::guid_node(p)?),
+        "Fv" => (MEDIA, media::FIRMWARE_VOLUME, media::guid_node(p)?),
+        "FvFile" => (MEDIA, media::FIRMWARE_FILE, media::guid_node(p)?),
+        "Offset" => (MEDIA, media::OFFSET, media::offset(p)?),
+        "RamDisk" => (MEDIA, media::RAM_DISK, media::ram_disk(p)?),
+        "BbsPath" => (BBS, p.integer()?, p.hex()?),
+        "BBS" => (BBS, bbs::BBS_101, bbs::bbs(p)?),
+        name => {
+            let pnp = acpi::PNP_NAMES.iter().find(|(_, named)| *named == name);
+            let vendor = vendor::NAMES.iter().find(|(_, named)| *named == name);
+            let class = usb::CLASS_NAMES.iter().find(|(_, named)| *named == name);
+            let subclass = usb::SUBCLASS_NAMES.iter().find(|(_, named)| *named == name);
+            let ram_disk = media::RAM_DISK_NAMES
+                .iter()
+                .find(|(_, named)| *named == name);
+            match (pnp, vendor, class, subclass, ram_disk) {
+                (Some((number, _)), _, _, _, _) => (ACPI, acpi::HID, acpi::pnp(p, *number)?),
+                (None, Some((guid, _)), _, _, _) => (
+                    MESSAGING,
+                    vendor::MESSAGING_VENDOR,
+                    <[u8; 16]>::from(*guid).to_vec(),
+                ),
+                (None, None, Some((class, _)), _, _) => {
+                    (MESSAGING, usb::USB_CLASS, usb::named_class(p, *class)?)
+                }
+                (None, None, None, Some((subclass, _)), _) => (
+                    MESSAGING,
+                    usb::USB_CLASS,
+                    usb::named_subclass(p, *subclass)?,
+                ),
+                (None, None, None, None, Some((disk_type, _))) => (
+                    MEDIA,
+                    media::RAM_DISK,
+                    media::named_ram_disk(p, *disk_type)?,
+                ),
+                (None, None, None, None, None) => return Ok(None),
+            }
+        }
+    };
+    Ok(Some(node))
+}
+
+/// A node's bytes: Type, Sub-Type, Length, then `data`.
+fn node_bytes(node_type: u8, sub_type: u8, data: &[u8]) -> Result<Vec<u8>, DevicePathTextError> {
+    let length = NODE_HEADER_SIZE + data.len();
+    let length = u16::try_from(length).map_err(|_| DevicePathTextError::TooLong(length))?;
+    Ok([&[node_type, sub_type][..], &length.to_le_bytes(), data].concat())
+}
+
+/// A File Path node of `name`, UCS-2 and then Null.
+fn file_path(name: &str) -> Result<Vec<u8>, DevicePathTextError> {
+    if name.chars().any(|c| c == '\0' || c.len_utf16() != 1) {
+        return Err(DevicePathTextError::NotUcs2(name.to_owned()));
+    }
+    let data: Vec<u8> = name
+        .encode_utf16()
+        .chain([0])
+        .flat_map(u16::to_le_bytes)
+        .collect();
+    node_bytes(MEDIA, media::FILE_PATH, &data)
+}
+
+/// Why bytes are no device path or have no text, or text writes none.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub(crate) enum DevicePathTextError {
+    #[error(transparent)]
+    Node(#[from] LoadOptionError),
+    #[error("the device path does not end with an End Entire Device Path node")]
+    NoEnd,
+    #[error("nodes follow the End Entire Device Path node of the device path")]
+    AfterEnd,
+    #[error(
+        "the device path holds an instance of no node, which no text reads back to (UEFI 2.11 \
+         section 10.6.1.3)"
+    )]
+    EmptyInstance,
+    #[error("the device path holds an End node of Sub-Type 0x{0:02X}, which no text writes")]
+    EndSubType(u8),
+    #[error("{0:?} writes an instance of no node")]
+    NoNodeText(String),
+    #[error("{0:?} has unpaired parentheses")]
+    Parentheses(String),
+    #[error("{0:?} is no Integer or keyword that fits the field (UEFI 2.11 Table 10.66)")]
+    Value(String),
+    #[error(
+        "a UART's BaudRate and DataBits take a number: edk2 writes {} for 0 and reads it back \
+         as 115200 and 8",
+        serial::UART_DEFAULT
+    )]
+    UartDefault,
+    #[error(
+        "{0:?} writes Parity and StopBits as a keyword and an integer: \"Mixing formats is \
+         prohibited.\" (UEFI 2.11 Table 10.67)"
+    )]
+    UartMixedFormats(String),
+    #[error("{0:?} is no Hex Dump of whole bytes (UEFI 2.11 Table 10.66)")]
+    HexDump(String),
+    #[error("{0:?} is no GUID (UEFI 2.11 Table 10.66)")]
+    Guid(String),
+    #[error("{0:?} is no EISAID (UEFI 2.11 Table 10.66)")]
+    EisaId(String),
+    #[error("{0:?} has more parameters than its form")]
+    Parameters(String),
+    #[error("{0:?} has text after the \")\" of its parameters, which edk2 drops")]
+    AfterParentheses(String),
+    #[error("{0:?} lists no value, where its form takes one or more")]
+    EmptyList(String),
+    #[error("{0:?} is no IP address of UEFI 2.11 Table 10.66 that fits the field")]
+    IpAddress(String),
+    #[error("{0:?} holds Null or a character outside ASCII, which the field holds none of")]
+    NotAscii(String),
+    #[error("{0:?} is longer than the {1} bytes of its field")]
+    TooLongString(String, usize),
+    #[error(
+        "{0:?} gives a Location, Connect or DriveBay, which UEFI 2.11 Table 10.67 prohibits \
+         for NoTopology and an integer topology"
+    )]
+    SasTopology(String),
+    #[error(
+        "{0:?} names no device node form that uefisettings reads; write the node in the generic \
+         form of UEFI 2.11 Table 10.67, such as Path(Type,SubType,HexDump)"
+    )]
+    UnknownName(String),
+    #[error("{0:?} writes an End node: \",\" ends an instance, and the end of the text the path")]
+    EndNodeText(String),
+    #[error("{0:?} holds Null or a character outside UCS-2")]
+    NotUcs2(String),
+    #[error("a device path node of {0} bytes does not fit its Length")]
+    TooLong(usize),
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use std::net::Ipv6Addr;
+    use std::str::FromStr;
+
+    use super::*;
+    use crate::efi_variables::load_option::LoadOption;
+
+    pub(crate) fn bytes(hex: &str) -> Vec<u8> {
+        hex.as_bytes()
+            .chunks_exact(2)
+            .map(|pair| {
+                u8::from_str_radix(std::str::from_utf8(pair).expect("ASCII"), 16).expect("hex")
+            })
+            .collect()
+    }
+
+    // Variables that OVMF's boot manager wrote, read from the vars.fd of QEMU runs of Ubuntu's
+    // edk2 2024.02 builds (i686 equals x86_64)
+    pub(crate) const X64_BOOT0000: &str = "090100002c0055006900410070007000000004071400c9bdb87cebf8344faaea3ee4af6516a10406140021aa2c4614760345836e8ab6f46623317fff0400";
+    pub(crate) const X64_BOOT0001: &str = "010000001600550045004600490020004d006900730063002000440065007600690063006500000002010c00d041030a000000000101060000017fff04004eac0881119f594d850ee21a522c59b2";
+    pub(crate) const X64_BOOT0002: &str = "010000002c00450046004900200049006e007400650072006e0061006c0020005300680065006c006c00000004071400c9bdb87cebf8344faaea3ee4af6516a10406140083a5047c3e9e1c4fad65e05268d0b4d17fff0400";
+    pub(crate) const X64_CONOUT: &str = "02010c00d041030a0000000001010600001f02010c00d041010500000000030e13000000000000c2010000000000080101030a1400d6a015adec8bcf4aa073d01de77e2d887f01040002010c00d041030a0000000001010600001f02010c00d041010501000000030e13000000000000c2010000000000080101030a1400d6a015adec8bcf4aa073d01de77e2d887fff0400";
+    pub(crate) const X64_CONIN: &str = "02010c00d041030a0000000001010600001f02010c00d0410303000000007f01040002010c00d041030a0000000001010600001f02010c00d041010500000000030e13000000000000c2010000000000080101030a1400d6a015adec8bcf4aa073d01de77e2d887f01040002010c00d041030a0000000001010600001f02010c00d041010501000000030e13000000000000c2010000000000080101030a1400d6a015adec8bcf4aa073d01de77e2d887f010400030f0b00ffffffff0301017fff0400";
+    pub(crate) const AA64_BOOT0000: &str = "090100002c0055006900410070007000000004071400fe4a07640a34e64b94ba91b5b4d0f71e0406140021aa2c4614760345836e8ab6f46623317fff0400";
+    const AA64_BOOT0001: &str = "010000001600550045004600490020004d006900730063002000440065007600690063006500000002010c00d041030a000000000101060000027fff04004eac0881119f594d850ee21a522c59b2";
+    const AA64_BOOT0002: &str = "010000002c00450046004900200049006e007400650072006e0061006c0020005300680065006c006c00000004071400fe4a07640a34e64b94ba91b5b4d0f71e0406140083a5047c3e9e1c4fad65e05268d0b4d17fff0400";
+    const AA64_CONOUT: &str = "010414004b7d98d31a975f438caf4967eb627241030e1300000000000096000000000000080101030a14006560a6df19b4d3119a2d0090273fc14d7f01040002010c00d041030a0000000001010600000102010c00d041010500000000030e13000000000000c2010000000000080101030a14006560a6df19b4d3119a2d0090273fc14d7fff0400";
+
+    const ESP: &str = "C12A7328-F81F-11D2-BA4B-00A0C93EC93B";
+    /// The Messaging Vendor GUIDs of a debug port, UART flow control and SAS (UEFI 2.11 Table
+    /// 10.67; edk2-stable202608 MdePkg.dec)
+    const DEBUG_PORT_GUID: &str = "EBA4E8D2-3858-41EC-A281-2647BA9660D0";
+    const FLOW_CONTROL_GUID: &str = "37499A9D-542F-4C89-A026-35DA142094E4";
+    const SAS_GUID: &str = "D487DDB4-008B-11D9-AFDC-001083FFCA4D";
+    /// The forms of UEFI 2.11 Table 10.67 that edk2 lacks, whose texts its DevicePath tool reads
+    /// as File Paths
+    const TABLE_ONLY_FORMS: [&str; 4] = ["NvdimmAcpiAdr(", "NVDIMM(", "RestService(", "NVMEoF("];
+    /// Texts that edk2's GetNextDeviceNodeStr() reads past their leading separators, and what
+    /// from_text reads each to
+    const SEPARATOR_TEXTS: [&str; 3] = [
+        ",/Pci(0x1,0x0)",
+        "),/(Pci(0x1,0x0)",
+        "Pci(0x1,0x0),,Pci(0x1,0x0)",
+    ];
+
+    /// A node of `node_type` and `sub_type` whose data is `fields` concatenated, as the tables
+    /// of UEFI 2.11 §10.3 lay it out.
+    pub(crate) fn node(node_type: u8, sub_type: u8, fields: &[&[u8]]) -> Vec<u8> {
+        let data = fields.concat();
+        let length = u16::try_from(4 + data.len()).expect("a short node");
+        [&[node_type, sub_type][..], &length.to_le_bytes(), &data].concat()
+    }
+
+    fn guid_bytes(text: &str) -> [u8; 16] {
+        Guid::from_str(text).expect("a GUID").into()
+    }
+
+    /// One device path of `nodes`, ended by an End Entire Device Path node.
+    pub(crate) fn path(nodes: &[Vec<u8>]) -> Vec<u8> {
+        [nodes.concat(), end_node(END_ENTIRE).to_vec()].concat()
+    }
+
+    /// A File Path node of `name`, as UEFI 2.11 Table 10.57 lays it out.
+    fn file(name: &str) -> Vec<u8> {
+        let name: Vec<u8> = name
+            .encode_utf16()
+            .chain([0])
+            .flat_map(u16::to_le_bytes)
+            .collect();
+        node(MEDIA, 0x04, &[&name])
+    }
+
+    /// The text of each device path of `bytes`.
+    fn texts(bytes: &[u8]) -> Result<Vec<String>, DevicePathTextError> {
+        device_paths(bytes)?.into_iter().map(to_text).collect()
+    }
+
+    /// Each node of the named and generic forms, field by field as the tables of UEFI 2.11 §10.3
+    /// lay them out, and its text: a row of each named form of Table 10.67, of each departure
+    /// from edk2 that the module documentation names, and of each class of node whose named form
+    /// would not read back to its bytes, which takes the generic form.
+    fn node_cases() -> Vec<(&'static str, Vec<u8>, &'static str)> {
+        let mac = |address: &[u8], if_type: u8| {
+            let mut field = [0; 32];
+            field[..address.len()].copy_from_slice(address);
+            node(MESSAGING, 0x0B, &[&field, &[if_type]])
+        };
+        let uart = |baud: u64, data_bits: u8, parity: u8, stop: u8| {
+            node(
+                MESSAGING,
+                0x0E,
+                &[&[0; 4], &baud.to_le_bytes(), &[data_bits, parity, stop]],
+            )
+        };
+        let hd = |number: u32, signature: [u8; 16], format: u8, kind: u8| {
+            node(
+                MEDIA,
+                0x01,
+                &[
+                    &number.to_le_bytes(),
+                    &0x800_u64.to_le_bytes(),
+                    &0x10_0000_u64.to_le_bytes(),
+                    &signature,
+                    &[format, kind],
+                ],
+            )
+        };
+        let acpi = |hid: u32, uid: u32| node(ACPI, 0x01, &[&hid.to_le_bytes(), &uid.to_le_bytes()]);
+        let acpi_ex = |[hid, uid, cid]: [u32; 3], strings: [&str; 3]| {
+            let strings: Vec<u8> = strings
+                .iter()
+                .flat_map(|text| [text.as_bytes(), &[0]].concat())
+                .collect();
+            node(
+                ACPI,
+                0x02,
+                &[
+                    &hid.to_le_bytes(),
+                    &uid.to_le_bytes(),
+                    &cid.to_le_bytes(),
+                    &strings,
+                ],
+            )
+        };
+        let vendor = |guid: &str, data: &[u8]| node(MESSAGING, 0x0A, &[&guid_bytes(guid), data]);
+        let usb_class = |class: u8, subclass: u8, protocol: u8| {
+            node(MESSAGING, 0x0F, &[&[0xFF; 4], &[class, subclass, protocol]])
+        };
+        let sas_address = 0x5000_C500_1234_5678_u64;
+        let sas = |topology: u16, port: u16, lun: u64| {
+            vendor(
+                SAS_GUID,
+                &[
+                    &0_u32.to_le_bytes()[..],
+                    &sas_address.to_le_bytes(),
+                    &lun.to_le_bytes(),
+                    &topology.to_le_bytes(),
+                    &port.to_le_bytes(),
+                ]
+                .concat(),
+            )
+        };
+        let sas_ex = |topology: u16| {
+            node(
+                MESSAGING,
+                0x16,
+                &[
+                    &sas_address.to_be_bytes(),
+                    &[0; 8],
+                    &topology.to_le_bytes(),
+                    &1_u16.to_le_bytes(),
+                ],
+            )
+        };
+        let iscsi = |protocol: u16, options: u16, lun: [u8; 8], name: &[u8]| {
+            node(
+                MESSAGING,
+                0x13,
+                &[
+                    &protocol.to_le_bytes(),
+                    &options.to_le_bytes(),
+                    &lun,
+                    &1_u16.to_le_bytes(),
+                    name,
+                ],
+            )
+        };
+        let ipv4 = |[local, remote]: [[u8; 4]; 2],
+                    [local_port, remote_port, protocol]: [u16; 3],
+                    kind: u8,
+                    rest: &[u8]| {
+            node(
+                MESSAGING,
+                0x0C,
+                &[
+                    &local,
+                    &remote,
+                    &local_port.to_le_bytes(),
+                    &remote_port.to_le_bytes(),
+                    &protocol.to_le_bytes(),
+                    &[kind],
+                    rest,
+                ],
+            )
+        };
+        let ram_disk = |disk_type: &str, instance: u16| {
+            node(
+                MEDIA,
+                0x09,
+                &[
+                    &0x1000_u64.to_le_bytes(),
+                    &0x1FFF_u64.to_le_bytes(),
+                    &guid_bytes(disk_type),
+                    &instance.to_le_bytes(),
+                ],
+            )
+        };
+        let mut mbr = [0; 16];
+        mbr[..4].copy_from_slice(&0x1234_5678_u32.to_le_bytes());
+        let mut padded = [0; 32];
+        padded[31] = 0xAA;
+        let mut ssid = [0; 32];
+        ssid[..4].copy_from_slice(b"home");
+        let bluetooth = [0x00, 0x1A, 0x7D, 0xDA, 0x71, 0x13];
+        let mut dns_ipv4 = vec![0];
+        for address in [[8, 8, 8, 8], [1, 1, 1, 1]] {
+            dns_ipv4.extend(address);
+            dns_ipv4.extend([0; 12]);
+        }
+        let dns_ipv6 = [
+            &[1][..],
+            &[
+                0x20, 0x01, 0x48, 0x60, 0x48, 0x60, 0, 0, 0, 0, 0, 0, 0, 0, 0x88, 0x88,
+            ],
+        ]
+        .concat();
+        // the example of UEFI 2.11 Table 10.53, its NIDT, NID and SubsystemNQN
+        let nvme_of_nid = [
+            0x4E, 0xFF, 0x7F, 0x8E, 0xD3, 0x53, 0x4E, 0x9B, 0xA4, 0xEC, 0xDE, 0xEA, 0x8E, 0xAB,
+            0x84, 0xD7,
+        ];
+        let nqn = b"nqn.1991-05.org.uefi:nvmeoftarget-nvmeofdisk-target\0";
+        let serial: Vec<u8> = "4C530001"
+            .encode_utf16()
+            .flat_map(u16::to_le_bytes)
+            .collect();
+        let ipv6_remote = [0x20, 0x01, 0x0D, 0xB8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1];
+        let ipv6_gateway = [0xFE, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1];
+        vec![
+            // Hardware
+            ("PCI", node(HARDWARE, 0x01, &[&[0x02, 0x1F]]), "Pci(0x1F,0x2)"),
+            ("PC Card", node(HARDWARE, 0x02, &[&[0x05]]), "PcCard(0x5)"),
+            (
+                "memory mapped",
+                node(HARDWARE, 0x03, &[&11_u32.to_le_bytes(), &0xFED0_0000_u64.to_le_bytes(), &0xFED0_0FFF_u64.to_le_bytes()]),
+                "MemoryMapped(0xB,0xFED00000,0xFED00FFF)",
+            ),
+            (
+                "Vendor hardware with data",
+                node(HARDWARE, 0x04, &[&guid_bytes(ESP), &[0x01, 0xAB]]),
+                "VenHw(C12A7328-F81F-11D2-BA4B-00A0C93EC93B,01AB)",
+            ),
+            ("controller", node(HARDWARE, 0x05, &[&2_u32.to_le_bytes()]), "Ctrl(0x2)"),
+            ("BMC", node(HARDWARE, 0x06, &[&[0x01], &0xCA2_u64.to_le_bytes()]), "BMC(0x1,0xCA2)"),
+            ("hardware node of no named Sub-Type", node(HARDWARE, 0x77, &[&[0xAB]]), "HardwarePath(119,AB)"),
+            // ACPI
+            ("PCI root", acpi(0x0A03_41D0, 0), "PciRoot(0x0)"),
+            ("PCIe root", acpi(0x0A08_41D0, 1), "PcieRoot(0x1)"),
+            ("floppy", acpi(0x0604_41D0, 0), "Floppy(0x0)"),
+            ("keyboard", acpi(0x0301_41D0, 1), "Keyboard(0x1)"),
+            ("serial port", acpi(0x0501_41D0, 2), "Serial(0x2)"),
+            ("parallel port", acpi(0x0401_41D0, 0), "ParallelPort(0x0)"),
+            ("ACPI PNP device without a name", acpi(0x0C0A_41D0, 0), "Acpi(PNP0C0A,0x0)"),
+            ("ACPI non-PNP EISA ID", acpi(0x0002_22F0, 3), "Acpi(HWP0002,0x3)"),
+            ("ACPI _HID 0, an EISA ID of no letters", acpi(0, 0), "Acpi(@@@0000,0x0)"),
+            ("ACPI _HID of no EISA ID", acpi(0x0000_8000, 0), "AcpiPath(1,0080000000000000)"),
+            (
+                "ACPI expanded",
+                acpi_ex([0x0A08_41D0, 0, 0x0A03_41D0], ["", "", ""]),
+                "AcpiEx(PNP0A08,PNP0A03,0x0,,,)",
+            ),
+            (
+                "ACPI expanded of a _HID string",
+                acpi_ex([0, 0, 0], ["ACPI0004", "", ""]),
+                "AcpiEx(@@@0000,@@@0000,0x0,ACPI0004,,)",
+            ),
+            ("ACPI expanded of UIDSTR", acpi_ex([0x0A03_41D0, 0, 0], ["", "PCI0", ""]), "AcpiExp(PNP0A03,0,PCI0)"),
+            (
+                "ACPI expanded of a _CID and UIDSTR",
+                acpi_ex([0x0002_22F0, 0, 0x0A03_41D0], ["", "PCI1", ""]),
+                "AcpiExp(HWP0002,PNP0A03,PCI1)",
+            ),
+            (
+                "ACPI expanded of UIDSTR and a UID, which AcpiExp drops",
+                acpi_ex([0x0A03_41D0, 5, 0], ["", "PCI0", ""]),
+                "AcpiEx(PNP0A03,@@@0000,0x5,,,PCI0)",
+            ),
+            (
+                "ACPI expanded without its strings",
+                node(ACPI, 0x02, &[&0x0A03_41D0_u32.to_le_bytes(), &[0; 4], &0x0A08_41D0_u32.to_le_bytes()]),
+                "AcpiPath(2,D041030A00000000D041080A)",
+            ),
+            (
+                "ACPI _ADR",
+                node(ACPI, 0x03, &[&0x8000_0100_u32.to_le_bytes(), &0x8000_0200_u32.to_le_bytes()]),
+                "AcpiAdr(0x80000100,0x80000200)",
+            ),
+            ("ACPI _ADR of a part of one", node(ACPI, 0x03, &[&[0x00, 0x01, 0x00, 0x80, 0x01, 0x02]]), "AcpiPath(3,000100800102)"),
+            ("NVDIMM device", node(ACPI, 0x04, &[&0x0001_0203_u32.to_le_bytes()]), "NvdimmAcpiAdr(0x10203)"),
+            ("ACPI node of no named Sub-Type", node(ACPI, 0x05, &[&[0x01]]), "AcpiPath(5,01)"),
+            // Messaging
+            ("ATAPI", node(MESSAGING, 0x01, &[&[1, 0], &3_u16.to_le_bytes()]), "Ata(Secondary,Master,0x3)"),
+            ("ATAPI of controller 2, which reads as Primary", node(MESSAGING, 0x01, &[&[2, 1, 0, 0]]), "Msg(1,02010000)"),
+            ("SCSI", node(MESSAGING, 0x02, &[&1_u16.to_le_bytes(), &0_u16.to_le_bytes()]), "Scsi(0x1,0x0)"),
+            (
+                "Fibre Channel",
+                node(MESSAGING, 0x03, &[&[0; 4], &0x2000_0025_B500_A01F_u64.to_le_bytes(), &1_u64.to_le_bytes()]),
+                "Fibre(0x20000025B500A01F,0x1)",
+            ),
+            (
+                "Fibre Channel of a Reserved field set",
+                node(MESSAGING, 0x03, &[&1_u32.to_le_bytes(), &0x2000_0025_B500_A01F_u64.to_le_bytes(), &1_u64.to_le_bytes()]),
+                "Msg(3,010000001FA000B5250000200100000000000000)",
+            ),
+            (
+                "Fibre Channel Ex",
+                node(MESSAGING, 0x15, &[&[0; 4], &[0x20, 0, 0, 0x25, 0xB5, 0, 0xA0, 0x1F], &[0, 1, 0, 0, 0, 0, 0, 0]]),
+                "FibreEx(0x20000025B500A01F,0x0001000000000000)",
+            ),
+            ("1394", node(MESSAGING, 0x04, &[&[0; 4], &0x0001_0203_0405_0607_u64.to_le_bytes()]), "I1394(0001020304050607)"),
+            ("USB", node(MESSAGING, 0x05, &[&[0x02, 0x00]]), "USB(0x2,0x0)"),
+            ("I2O", node(MESSAGING, 0x06, &[&0x10_u32.to_le_bytes()]), "I2O(0x10)"),
+            ("Messaging node of no named Sub-Type", node(MESSAGING, 0x07, &[&[0x01]]), "Msg(7,01)"),
+            (
+                "InfiniBand",
+                node(MESSAGING, 0x09, &[&1_u32.to_le_bytes(), &guid_bytes(ESP), &2_u64.to_le_bytes(), &3_u64.to_le_bytes(), &4_u64.to_le_bytes()]),
+                "Infiniband(0x1,C12A7328-F81F-11D2-BA4B-00A0C93EC93B,0x2,0x3,0x4)",
+            ),
+            ("PC-ANSI terminal", vendor("E0C14753-F9BE-11D2-9A0C-0090273FC14D", &[]), "VenPcAnsi()"),
+            ("VT-100 terminal", vendor("DFA66065-B419-11D3-9A2D-0090273FC14D", &[]), "VenVt100()"),
+            ("VT-100+ terminal", vendor("7BAEC70B-57E0-4C76-8E87-2F9E28088343", &[]), "VenVt100Plus()"),
+            ("VT-UTF8 terminal", vendor("AD15A0D6-8BEC-4ACF-A073-D01DE77E2D88", &[]), "VenUtf8()"),
+            ("debug port", vendor(DEBUG_PORT_GUID, &[]), "DebugPort()"),
+            (
+                "PC-ANSI terminal with data",
+                vendor("E0C14753-F9BE-11D2-9A0C-0090273FC14D", &[0x01]),
+                "VenMsg(E0C14753-F9BE-11D2-9A0C-0090273FC14D,01)",
+            ),
+            ("debug port with data", vendor(DEBUG_PORT_GUID, &[0xAA]), "VenMsg(EBA4E8D2-3858-41EC-A281-2647BA9660D0,AA)"),
+            ("UART flow control XON/XOFF", vendor(FLOW_CONTROL_GUID, &2_u32.to_le_bytes()), "UartFlowCtrl(XonXoff)"),
+            ("UART flow control by hardware", vendor(FLOW_CONTROL_GUID, &1_u32.to_le_bytes()), "UartFlowCtrl(Hardware)"),
+            ("UART without flow control", vendor(FLOW_CONTROL_GUID, &0_u32.to_le_bytes()), "UartFlowCtrl(None)"),
+            (
+                "UART flow control of both bits, which edk2 writes no text for",
+                vendor(FLOW_CONTROL_GUID, &3_u32.to_le_bytes()),
+                "VenMsg(37499A9D-542F-4C89-A026-35DA142094E4,03000000)",
+            ),
+            (
+                "SAS of an internal SATA device in drive bay 1",
+                sas(0x0012, 0, 0),
+                "SAS(0x5000C50012345678,0x0,0x0,SATA,Internal,Direct,0x1,0x0)",
+            ),
+            ("SAS of no topology", sas(0x0000, 2, 1), "SAS(0x5000C50012345678,0x1,0x2,NoTopology,0,0,0,0x0)"),
+            ("Ethernet MAC", mac(&[0x52, 0x54, 0x00, 0x12, 0x34, 0x56], 1), "MAC(525400123456,0x1)"),
+            (
+                "Ethernet MAC with padding",
+                mac(&padded, 1),
+                "Msg(11,00000000000000000000000000000000000000000000000000000000000000AA01)",
+            ),
+            (
+                "IPv4 static TCP",
+                ipv4([[192, 168, 0, 2], [192, 168, 0, 1]], [0, 0, 6], 1, &[192, 168, 0, 254, 255, 255, 255, 0]),
+                "IPv4(192.168.0.1,TCP,Static,192.168.0.2,192.168.0.254,255.255.255.0)",
+            ),
+            ("IPv4 by DHCP", ipv4([[0; 4], [0; 4]], [0, 0, 17], 0, &[0; 8]), "IPv4(0.0.0.0,UDP,DHCP,0.0.0.0,0.0.0.0,0.0.0.0)"),
+            (
+                "IPv4 of a port, which the form does not show",
+                ipv4([[0; 4], [192, 168, 0, 1]], [0, 69, 17], 0, &[0; 8]),
+                "Msg(12,00000000C0A80001000045001100000000000000000000)",
+            ),
+            (
+                "IPv4 without a gateway, of UEFI 2.0",
+                ipv4([[0; 4], [192, 168, 0, 1]], [0, 0, 6], 1, &[]),
+                "Msg(12,00000000C0A8000100000000060001)",
+            ),
+            (
+                "IPv6",
+                node(
+                    MESSAGING,
+                    0x0D,
+                    &[&[0; 16], &ipv6_remote, &[0; 4], &17_u16.to_le_bytes(), &[1, 64], &ipv6_gateway],
+                ),
+                "IPv6(2001:0DB8:0000:0000:0000:0000:0000:0001,UDP,StatelessAutoConfigure,\
+                 0000:0000:0000:0000:0000:0000:0000:0000,0x40,FE80:0000:0000:0000:0000:0000:0000:0001)",
+            ),
+            ("UART", uart(115_200, 8, 1, 1), "Uart(115200,8,N,1)"),
+            ("UART of even parity and 1.5 stop bits", uart(115_200, 8, 2, 2), "Uart(115200,8,E,1.5)"),
+            ("UART of odd parity and 2 stop bits", uart(9600, 7, 3, 3), "Uart(9600,7,O,2)"),
+            ("UART of mark parity", uart(57_600, 8, 4, 1), "Uart(57600,8,M,1)"),
+            ("UART of space parity and default stop bits", uart(38_400, 8, 5, 0), "Uart(38400,8,S,D)"),
+            ("UART of baud rate 0", uart(0, 0, 0, 0), "Uart(0,0,D,D)"),
+            ("UART parity as an integer", uart(9600, 7, 6, 4), "Uart(9600,7,6,4)"),
+            (
+                "UART of integers that read as keywords",
+                uart(9600, 7, 6, 2),
+                "Msg(14,000000008025000000000000070602)",
+            ),
+            (
+                "USB class",
+                node(MESSAGING, 0x0F, &[&0x1234_u16.to_le_bytes(), &0x5678_u16.to_le_bytes(), &[0x12, 0x34, 0x56]]),
+                "UsbClass(0x1234,0x5678,0x12,0x34,0x56)",
+            ),
+            ("USB audio", usb_class(1, 1, 2), "UsbAudio(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB CDC control", usb_class(2, 1, 2), "UsbCDCControl(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB HID", usb_class(3, 1, 1), "UsbHID(0xFFFF,0xFFFF,0x1,0x1)"),
+            ("USB image", usb_class(6, 1, 2), "UsbImage(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB printer", usb_class(7, 1, 2), "UsbPrinter(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB mass storage", usb_class(8, 6, 0x50), "UsbMassStorage(0xFFFF,0xFFFF,0x6,0x50)"),
+            ("USB hub", usb_class(9, 0, 0), "UsbHub(0xFFFF,0xFFFF,0x0,0x0)"),
+            ("USB CDC data", usb_class(10, 1, 2), "UsbCDCData(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB smart card", usb_class(11, 1, 2), "UsbSmartCard(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB video", usb_class(14, 1, 2), "UsbVideo(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB diagnostic", usb_class(220, 1, 2), "UsbDiagnostic(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB wireless", usb_class(224, 1, 2), "UsbWireless(0xFFFF,0xFFFF,0x1,0x2)"),
+            ("USB device firmware update", usb_class(254, 1, 2), "UsbDeviceFirmwareUpdate(0xFFFF,0xFFFF,0x2)"),
+            ("USB IrDA bridge", usb_class(254, 2, 2), "UsbIrdaBridge(0xFFFF,0xFFFF,0x2)"),
+            ("USB test and measurement", usb_class(254, 3, 2), "UsbTestAndMeasurement(0xFFFF,0xFFFF,0x2)"),
+            ("USB application-specific subclass of no name", usb_class(254, 4, 0), "UsbClass(0xFFFF,0xFFFF,0xFE,0x4,0x0)"),
+            (
+                "USB WWID",
+                node(MESSAGING, 0x10, &[&0_u16.to_le_bytes(), &0x0781_u16.to_le_bytes(), &0x5581_u16.to_le_bytes(), &serial]),
+                "UsbWwid(0x781,0x5581,0x0,\"4C530001\")",
+            ),
+            ("logical unit", node(MESSAGING, 0x11, &[&[0x03]]), "Unit(0x3)"),
+            (
+                "SATA",
+                node(MESSAGING, 0x12, &[&0_u16.to_le_bytes(), &0xFFFF_u16.to_le_bytes(), &[0, 0]]),
+                "Sata(0x0,0xFFFF,0x0)",
+            ),
+            (
+                "iSCSI of a header digest",
+                iscsi(0, 0x0802, [0, 1, 0, 0, 0, 0, 0, 0], b"iqn.2001-04.com.example:storage\0"),
+                "iSCSI(iqn.2001-04.com.example:storage,0x1,0x0001000000000000,CRC32C,None,None,TCP)",
+            ),
+            (
+                "iSCSI of a data digest, CHAP_UNI and a reserved protocol",
+                iscsi(1, 0x1008, [0; 8], b"t\0"),
+                "iSCSI(t,0x1,0x0000000000000000,None,CRC32C,CHAP_UNI,reserved)",
+            ),
+            ("iSCSI of CHAP_BI", iscsi(0, 0, [0; 8], b"t\0"), "iSCSI(t,0x1,0x0000000000000000,None,None,CHAP_BI,TCP)"),
+            ("iSCSI of a name without Null", iscsi(0, 0x0800, [0; 8], b"t"), "Msg(19,000000080000000000000000010074)"),
+            ("VLAN", node(MESSAGING, 0x14, &[&100_u16.to_le_bytes()]), "Vlan(100)"),
+            (
+                "SAS Ex of an external SAS device through an expander",
+                sas_ex(0x0061),
+                "SasEx(0x5000C50012345678,0x0000000000000000,0x1,SAS,External,Expanded,0)",
+            ),
+            ("SAS Ex of a topology integer", sas_ex(0x0083), "SasEx(0x5000C50012345678,0x0000000000000000,0x1,0x83,0,0,0)"),
+            (
+                "NVMe",
+                node(MESSAGING, 0x17, &[&1_u32.to_le_bytes(), &[1, 2, 3, 4, 5, 6, 7, 8]]),
+                "NVMe(0x1,08-07-06-05-04-03-02-01)",
+            ),
+            ("URI", node(MESSAGING, 0x18, &[b"http://host/boot.efi"]), "Uri(http://host/boot.efi)"),
+            ("URI with a comma", node(MESSAGING, 0x18, &[b"a,b"]), "Msg(24,612C62)"),
+            ("URI outside ASCII", node(MESSAGING, 0x18, &["\u{E9}".as_bytes()]), "Msg(24,C3A9)"),
+            ("UFS", node(MESSAGING, 0x19, &[&[0, 0x81]]), "UFS(0x0,0x81)"),
+            ("SD", node(MESSAGING, 0x1A, &[&[1]]), "SD(0x1)"),
+            ("Bluetooth", node(MESSAGING, 0x1B, &[&bluetooth]), "Bluetooth(001A7DDA7113)"),
+            ("Wi-Fi", node(MESSAGING, 0x1C, &[&ssid]), "Wi-Fi(home)"),
+            (
+                "Wi-Fi of bytes after a Null",
+                node(MESSAGING, 0x1C, &[b"ab\0c", &[0; 28]]),
+                "Msg(28,6162006300000000000000000000000000000000000000000000000000000000)",
+            ),
+            ("eMMC", node(MESSAGING, 0x1D, &[&[0]]), "eMMC(0x0)"),
+            ("BluetoothLE", node(MESSAGING, 0x1E, &[&bluetooth, &[1]]), "BluetoothLE(001A7DDA7113,0x01)"),
+            ("DNS over IPv4", node(MESSAGING, 0x1F, &[&dns_ipv4]), "Dns(8.8.8.8,1.1.1.1)"),
+            ("DNS over IPv6", node(MESSAGING, 0x1F, &[&dns_ipv6]), "Dns(2001:4860:4860:0000:0000:0000:0000:8888)"),
+            ("NVDIMM namespace", node(MESSAGING, 0x20, &[&guid_bytes(ESP)]), "NVDIMM(C12A7328-F81F-11D2-BA4B-00A0C93EC93B)"),
+            ("Redfish out-of-band REST service", node(MESSAGING, 0x21, &[&[1, 2]]), "RestService(1,2)"),
+            (
+                "vendor-specific REST service",
+                node(MESSAGING, 0x21, &[&[0xFF, 1], &guid_bytes(ESP), &[0xAB]]),
+                "RestService(255,1,C12A7328-F81F-11D2-BA4B-00A0C93EC93B,AB)",
+            ),
+            (
+                "NVMe-oF namespace, the example of UEFI 2.11 Table 10.53",
+                node(MESSAGING, 0x22, &[&[0x03], &nvme_of_nid, nqn]),
+                "NVMEoF(nqn.1991-05.org.uefi:nvmeoftarget-nvmeofdisk-target,\
+                 urn:uuid:4eff7f8e-d353-4e9b-a4ec-deea8eab84d7)",
+            ),
+            (
+                "NVMe-oF namespace of an NGUID",
+                node(MESSAGING, 0x22, &[&[0x02], &[1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], b"a\0"]),
+                "Msg(34,020102030405060708090A0B0C0D0E0F106100)",
+            ),
+            // Media
+            (
+                "GPT partition",
+                hd(1, guid_bytes(ESP), 0x02, 0x02),
+                "HD(1,GPT,C12A7328-F81F-11D2-BA4B-00A0C93EC93B,0x800,0x100000)",
+            ),
+            ("MBR partition", hd(2, mbr, 0x01, 0x01), "HD(2,MBR,0x12345678,0x800,0x100000)"),
+            ("partition without a signature", hd(3, [0; 16], 0x00, 0x00), "HD(3,0,0,0x800,0x100000)"),
+            (
+                "partition of mixed formats",
+                hd(4, mbr, 0x02, 0x01),
+                "MediaPath(1,0400000000080000000000000000100000000000785634120000000000000000000000000201)",
+            ),
+            (
+                "partition numbered from 2^31",
+                hd(0x8000_0000, guid_bytes(ESP), 0x02, 0x02),
+                "HD(2147483648,GPT,C12A7328-F81F-11D2-BA4B-00A0C93EC93B,0x800,0x100000)",
+            ),
+            (
+                "CD-ROM",
+                node(MEDIA, 0x02, &[&0_u32.to_le_bytes(), &0x10_u64.to_le_bytes(), &0x20_u64.to_le_bytes()]),
+                "CDROM(0x0,0x10,0x20)",
+            ),
+            (
+                "Vendor media",
+                node(MEDIA, 0x03, &[&guid_bytes(ESP)]),
+                "VenMedia(C12A7328-F81F-11D2-BA4B-00A0C93EC93B)",
+            ),
+            ("file path", file("\\EFI\\BOOT\\BOOTX64.EFI"), "\\EFI\\BOOT\\BOOTX64.EFI"),
+            ("file path with a slash", file("a/b"), "MediaPath(4,61002F0062000000)"),
+            ("file path that reads as a node", file("Pci(0x1,0x0)"), "MediaPath(4,50006300690028003000780031002C0030007800300029000000)"),
+            (
+                "file path that edk2 reads as a node and the text after it",
+                file("Pci(0x1,0x0)abc"),
+                "MediaPath(4,50006300690028003000780031002C0030007800300029006100620063000000)",
+            ),
+            (
+                "file path named as a node of no known form",
+                file("PciRot(0x0)"),
+                "MediaPath(4,50006300690052006F007400280030007800300029000000)",
+            ),
+            ("file path that starts with a separator", file("(a"), "MediaPath(4,280061000000)"),
+            (
+                "media protocol",
+                node(MEDIA, 0x05, &[&guid_bytes("7C04A583-9E3E-4F1C-AD65-E05268D0B4D1")]),
+                "Media(7C04A583-9E3E-4F1C-AD65-E05268D0B4D1)",
+            ),
+            (
+                "firmware volume",
+                node(MEDIA, 0x07, &[&guid_bytes("7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1")]),
+                "Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)",
+            ),
+            (
+                "firmware file",
+                node(MEDIA, 0x06, &[&guid_bytes("7C04A583-9E3E-4F1C-AD65-E05268D0B4D1")]),
+                "FvFile(7C04A583-9E3E-4F1C-AD65-E05268D0B4D1)",
+            ),
+            (
+                "relative offset range",
+                node(MEDIA, 0x08, &[&[0; 4], &0_u64.to_le_bytes(), &0xFFF_u64.to_le_bytes()]),
+                "Offset(0x0,0xFFF)",
+            ),
+            ("RAM disk", ram_disk(ESP, 1), "RamDisk(0x1000,0x1FFF,1,C12A7328-F81F-11D2-BA4B-00A0C93EC93B)"),
+            ("virtual disk", ram_disk("77AB535A-45FC-624B-5560-F7B281D1F96E", 0), "VirtualDisk(0x1000,0x1FFF,0)"),
+            ("virtual CD", ram_disk("3D5ABD30-4175-87CE-6D64-D2ADE523C4BB", 0), "VirtualCD(0x1000,0x1FFF,0)"),
+            (
+                "persistent virtual disk",
+                ram_disk("5CEA02C9-4D07-69D3-269F-4496FBE096F9", 2),
+                "PersistentVirtualDisk(0x1000,0x1FFF,2)",
+            ),
+            (
+                "persistent virtual CD",
+                ram_disk("08018188-42CD-BB48-100F-5387D53DED3D", 0),
+                "PersistentVirtualCD(0x1000,0x1FFF,0)",
+            ),
+            ("Media node of no named Sub-Type", node(MEDIA, 0x0A, &[&[0x01]]), "MediaPath(10,01)"),
+            // BIOS Boot Specification
+            ("BBS hard drive", node(BBS, 0x01, &[&2_u16.to_le_bytes(), &0_u16.to_le_bytes(), b"SATA0\0"]), "BBS(HD,SATA0,0x0)"),
+            ("BBS of a type of no keyword", node(BBS, 0x01, &[&0x80_u16.to_le_bytes(), &1_u16.to_le_bytes(), b"PXE\0"]), "BBS(0x80,PXE,0x1)"),
+            ("BBS node of no named Sub-Type", node(BBS, 0x02, &[&[0x01]]), "BbsPath(2,01)"),
+            ("node of no named Type", node(0x09, 0x09, &[&[0x01, 0x02]]), "Path(9,9,0102)"),
+        ]
+    }
+
+    #[test]
+    fn ovmf_load_options_read_as_its_boot_manager_writes_them() {
+        // the text of BdsDxe's "loading Boot####" and "failed to load Boot####" lines in the
+        // console logs of the same runs
+        let cases = [
+            ("x86_64 Boot0001", X64_BOOT0001, "PciRoot(0x0)/Pci(0x1,0x0)"),
+            (
+                "x86_64 Boot0002",
+                X64_BOOT0002,
+                "Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(7C04A583-9E3E-4F1C-AD65-E05268D0B4D1)",
+            ),
+            ("aarch64 Boot0001", AA64_BOOT0001, "PciRoot(0x0)/Pci(0x2,0x0)"),
+            (
+                "aarch64 Boot0002",
+                AA64_BOOT0002,
+                "Fv(64074AFE-340A-4BE6-94BA-91B5B4D0F71E)/FvFile(7C04A583-9E3E-4F1C-AD65-E05268D0B4D1)",
+            ),
+        ];
+        for (name, option, want) in cases {
+            let option = LoadOption::decode(&bytes(option)).expect("an OVMF load option");
+            assert_eq!(
+                texts(option.file_paths.as_ref()),
+                Ok(vec![want.to_owned()]),
+                "{name}: the text that OVMF's BdsDxe logged"
+            );
+            assert_eq!(
+                from_text(want).as_deref(),
+                Ok(option.file_paths.as_ref()),
+                "{name}: read back to its bytes"
+            );
+        }
+    }
+
+    #[test]
+    fn ovmf_console_paths_read_back_to_their_bytes() {
+        let serial = |n: u8| {
+            format!("PciRoot(0x0)/Pci(0x1F,0x0)/Serial(0x{n})/Uart(115200,8,N,1)/VenUtf8()")
+        };
+        let cases = [
+            (
+                "x86_64 ConOut",
+                X64_CONOUT,
+                format!("{},/{}", serial(0), serial(1)),
+            ),
+            (
+                "x86_64 ConIn",
+                X64_CONIN,
+                format!(
+                    "PciRoot(0x0)/Pci(0x1F,0x0)/Acpi(PNP0303,0x0),/{},/{},/UsbHID(0xFFFF,0xFFFF,0x1,0x1)",
+                    serial(0),
+                    serial(1)
+                ),
+            ),
+            (
+                "aarch64 ConOut",
+                AA64_CONOUT,
+                "VenHw(D3987D4B-971A-435F-8CAF-4967EB627241)/Uart(38400,8,N,1)/VenVt100(),/\
+                 PciRoot(0x0)/Pci(0x1,0x0)/Serial(0x0)/Uart(115200,8,N,1)/VenVt100()"
+                    .to_owned(),
+            ),
+        ];
+        for (name, variable, want) in cases {
+            let variable = bytes(variable);
+            assert_eq!(texts(&variable), Ok(vec![want.clone()]), "{name}: as text");
+            assert_eq!(
+                from_text(&want),
+                Ok(variable),
+                "{name}: read back to its bytes"
+            );
+        }
+    }
+
+    #[test]
+    fn each_node_reads_as_its_form_and_back_to_its_bytes() {
+        for (name, node, want) in node_cases() {
+            let path = path(std::slice::from_ref(&node));
+            assert_eq!(to_text(&path), Ok(want.to_owned()), "{name}: as text");
+            assert_eq!(from_text(want), Ok(path), "{name}: read back to its bytes");
+        }
+    }
+
+    /// Texts that to_text does not write, each read as UEFI 2.11 Tables 10.66 and 10.67 give it:
+    /// omitted parameters as their defaults, keywords and integers, an IP address with its port,
+    /// and a text that names no form but holds text after its ")", which edk2 reads as a File
+    /// Path too.
+    #[test]
+    fn texts_read_as_tables_10_66_and_10_67_give_them() {
+        let esp = guid_bytes(ESP);
+        let ipv4 = |[local, remote]: [[u8; 4]; 2],
+                    [local_port, remote_port, protocol]: [u16; 3],
+                    kind: u8,
+                    gateway: [u8; 4]| {
+            node(
+                MESSAGING,
+                0x0C,
+                &[
+                    &local,
+                    &remote,
+                    &local_port.to_le_bytes(),
+                    &remote_port.to_le_bytes(),
+                    &protocol.to_le_bytes(),
+                    &[kind],
+                    &gateway,
+                    &[0; 4],
+                ],
+            )
+        };
+        let ipv6 =
+            |remote: [u8; 16], remote_port: u16, protocol: u16, [origin, prefix]: [u8; 2]| {
+                node(
+                    MESSAGING,
+                    0x0D,
+                    &[
+                        &[0; 16],
+                        &remote,
+                        &0_u16.to_le_bytes(),
+                        &remote_port.to_le_bytes(),
+                        &protocol.to_le_bytes(),
+                        &[origin, prefix],
+                        &[0; 16],
+                    ],
+                )
+            };
+        let hd =
+            |number: u32, signature: [u8; 16], [format, kind]: [u8; 2], [start, size]: [u64; 2]| {
+                node(
+                    MEDIA,
+                    0x01,
+                    &[
+                        &number.to_le_bytes(),
+                        &start.to_le_bytes(),
+                        &size.to_le_bytes(),
+                        &signature,
+                        &[format, kind],
+                    ],
+                )
+            };
+        let acpi_ex = |[hid, uid, cid]: [u32; 3], strings: &[u8]| {
+            node(
+                ACPI,
+                0x02,
+                &[
+                    &hid.to_le_bytes(),
+                    &uid.to_le_bytes(),
+                    &cid.to_le_bytes(),
+                    strings,
+                ],
+            )
+        };
+        let uart = |parity: u8, stop: u8| {
+            node(
+                MESSAGING,
+                0x0E,
+                &[&[0; 4], &9600_u64.to_le_bytes(), &[8, parity, stop]],
+            )
+        };
+        let usb_class = |vendor: u16, product: u16, codes: [u8; 3]| {
+            node(
+                MESSAGING,
+                0x0F,
+                &[&vendor.to_le_bytes(), &product.to_le_bytes(), &codes],
+            )
+        };
+        let ram_disk = |disk_type: [u8; 16]| {
+            node(
+                MEDIA,
+                0x09,
+                &[
+                    &0x1000_u64.to_le_bytes(),
+                    &0x1FFF_u64.to_le_bytes(),
+                    &disk_type,
+                    &0_u16.to_le_bytes(),
+                ],
+            )
+        };
+        let mut mbr = [0; 16];
+        mbr[..4].copy_from_slice(&0x1234_5678_u32.to_le_bytes());
+        let ipv6_remote = [0x20, 0x01, 0x0D, 0xB8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1];
+        let nvme_of_nid = [
+            0x4E, 0xFF, 0x7F, 0x8E, 0xD3, 0x53, 0x4E, 0x9B, 0xA4, 0xEC, 0xDE, 0xEA, 0x8E, 0xAB,
+            0x84, 0xD7,
+        ];
+        let serial: Vec<u8> = "4C530001"
+            .encode_utf16()
+            .flat_map(u16::to_le_bytes)
+            .collect();
+        let sas_address = 0x5000_C500_1234_5678_u64;
+        let cases: Vec<(&str, Vec<u8>)> = vec![
+            (
+                "Floppy()",
+                node(ACPI, 0x01, &[&0x0604_41D0_u32.to_le_bytes(), &[0; 4]]),
+            ),
+            (
+                "Keyboard(5)",
+                node(
+                    ACPI,
+                    0x01,
+                    &[&0x0301_41D0_u32.to_le_bytes(), &5_u32.to_le_bytes()],
+                ),
+            ),
+            ("Acpi(0)", node(ACPI, 0x01, &[&[0; 8]])),
+            (
+                "AcpiEx(,,,ACPI0004,,)",
+                acpi_ex([0, 0, 0], b"ACPI0004\0\0\0"),
+            ),
+            (
+                "AcpiEx(PNP0A03,PNP0A08,0x1,,,PCI0)",
+                acpi_ex([0x0A03_41D0, 1, 0x0A08_41D0], b"\0PCI0\0\0"),
+            ),
+            (
+                "AcpiExp(PNP0A03,,PCI0)",
+                acpi_ex([0x0A03_41D0, 0, 0], b"\0PCI0\0\0"),
+            ),
+            (
+                "AcpiAdr(1,2,3)",
+                node(
+                    ACPI,
+                    0x03,
+                    &[
+                        &1_u32.to_le_bytes(),
+                        &2_u32.to_le_bytes(),
+                        &3_u32.to_le_bytes(),
+                    ],
+                ),
+            ),
+            (
+                "BMC(1,16)",
+                node(HARDWARE, 0x06, &[&[1], &16_u64.to_le_bytes()]),
+            ),
+            ("Ata(0,1,0x0)", node(MESSAGING, 0x01, &[&[0, 1, 0, 0]])),
+            (
+                "Uart()",
+                node(
+                    MESSAGING,
+                    0x0E,
+                    &[&[0; 4], &115_200_u64.to_le_bytes(), &[8, 0, 0]],
+                ),
+            ),
+            ("Uart(9600,8,N,)", uart(1, 0)),
+            ("Uart(9600,8,2,1)", uart(2, 1)),
+            ("Uart(9600,8,,2)", uart(0, 3)),
+            (
+                "UartFlowCtrl(1)",
+                node(
+                    MESSAGING,
+                    0x0A,
+                    &[&guid_bytes(FLOW_CONTROL_GUID), &1_u32.to_le_bytes()],
+                ),
+            ),
+            (
+                "SAS(0x5000C50012345678)",
+                node(
+                    MESSAGING,
+                    0x0A,
+                    &[
+                        &guid_bytes(SAS_GUID),
+                        &[0; 4],
+                        &sas_address.to_le_bytes(),
+                        &[0; 8],
+                        &[0; 4],
+                    ],
+                ),
+            ),
+            (
+                "SasEx(0x5000C50012345678,,,SATA,External,Direct,0x2)",
+                node(
+                    MESSAGING,
+                    0x16,
+                    &[
+                        &sas_address.to_be_bytes(),
+                        &[0; 8],
+                        &0x0132_u16.to_le_bytes(),
+                        &[0; 2],
+                    ],
+                ),
+            ),
+            (
+                "IPv4(192.168.0.1)",
+                ipv4([[0; 4], [192, 168, 0, 1]], [0, 0, 17], 0, [0; 4]),
+            ),
+            (
+                "IPv4(192.168.0.1:69,TCP,Static,10.0.0.2:1024)",
+                ipv4([[10, 0, 0, 2], [192, 168, 0, 1]], [1024, 69, 6], 1, [0; 4]),
+            ),
+            (
+                "IPv4(192.168.0.1,UDP,DHCP,0.0.0.0,192.168.0.254)",
+                ipv4(
+                    [[0; 4], [192, 168, 0, 1]],
+                    [0, 0, 17],
+                    0,
+                    [192, 168, 0, 254],
+                ),
+            ),
+            ("IPv6([2001:db8::1]:69)", ipv6(ipv6_remote, 69, 17, [2, 0])),
+            (
+                "IPv6(2001:db8::1,TCP,Static,,64)",
+                ipv6(ipv6_remote, 0, 6, [0, 64]),
+            ),
+            ("UsbHID()", usb_class(0xFFFF, 0xFFFF, [3, 0xFF, 0xFF])),
+            ("UsbClass(,,3)", usb_class(0xFFFF, 0xFFFF, [3, 0xFF, 0xFF])),
+            (
+                "UsbTestAndMeasurement(0x1,0x2)",
+                usb_class(1, 2, [0xFE, 3, 0xFF]),
+            ),
+            (
+                "UsbWwid(0x781,0x5581,0x0,4C530001)",
+                node(
+                    MESSAGING,
+                    0x10,
+                    &[
+                        &[0; 2],
+                        &0x0781_u16.to_le_bytes(),
+                        &0x5581_u16.to_le_bytes(),
+                        &serial,
+                    ],
+                ),
+            ),
+            (
+                "Sata(0x1,,0x0)",
+                node(
+                    MESSAGING,
+                    0x12,
+                    &[&1_u16.to_le_bytes(), &0xFFFF_u16.to_le_bytes(), &[0; 2]],
+                ),
+            ),
+            (
+                "iSCSI(t,0x1,0x0)",
+                node(
+                    MESSAGING,
+                    0x13,
+                    &[
+                        &[0; 2],
+                        &0x0800_u16.to_le_bytes(),
+                        &[0; 8],
+                        &1_u16.to_le_bytes(),
+                        b"t\0",
+                    ],
+                ),
+            ),
+            ("SD()", node(MESSAGING, 0x1A, &[&[0]])),
+            (
+                "Dns(::1)",
+                node(MESSAGING, 0x1F, &[&[1], &Ipv6Addr::LOCALHOST.octets()]),
+            ),
+            (
+                "RestService(0xFF,2,C12A7328-F81F-11D2-BA4B-00A0C93EC93B)",
+                node(MESSAGING, 0x21, &[&[0xFF, 2], &esp]),
+            ),
+            (
+                "NVMEoF(nqn.x,URN:UUID:4EFF7F8E-D353-4E9B-A4EC-DEEA8EAB84D7)",
+                node(MESSAGING, 0x22, &[&[3], &nvme_of_nid, b"nqn.x\0"]),
+            ),
+            (
+                "HD(1,,C12A7328-F81F-11D2-BA4B-00A0C93EC93B,0x800,0x100000)",
+                hd(1, esp, [0x02, 0x02], [0x800, 0x10_0000]),
+            ),
+            (
+                "HD(1,1,0x12345678,0x800,0x100000)",
+                hd(1, mbr, [0x01, 0x01], [0x800, 0x10_0000]),
+            ),
+            (
+                "HD(0,GPT,C12A7328-F81F-11D2-BA4B-00A0C93EC93B)",
+                hd(0, esp, [0x02, 0x02], [0, 0]),
+            ),
+            (
+                "CDROM(,0x10,0x20)",
+                node(
+                    MEDIA,
+                    0x02,
+                    &[&[0; 4], &0x10_u64.to_le_bytes(), &0x20_u64.to_le_bytes()],
+                ),
+            ),
+            (
+                "RamDisk(0x1000,0x1FFF,,C12A7328-F81F-11D2-BA4B-00A0C93EC93B)",
+                ram_disk(esp),
+            ),
+            (
+                "VirtualCD(0x1000,0x1FFF)",
+                ram_disk(guid_bytes("3D5ABD30-4175-87CE-6D64-D2ADE523C4BB")),
+            ),
+            (
+                "BBS(2,X)",
+                node(BBS, 0x01, &[&2_u16.to_le_bytes(), &[0; 2], b"X\0"]),
+            ),
+            ("a(b)c", file("a(b)c")),
+        ];
+        for (text, node) in cases {
+            assert_eq!(from_text(text), Ok(path(&[node])), "{text}");
+        }
+    }
+
+    #[test]
+    fn instances_and_device_paths_split_as_edk2_writes_them() {
+        let pci = node(HARDWARE, 0x01, &[&[0x00, 0x01]]);
+        let two_instances = [pci.clone(), end_node(END_INSTANCE).to_vec(), pci.clone()].concat();
+        let two_paths = [
+            path(std::slice::from_ref(&pci)),
+            path(std::slice::from_ref(&pci)),
+        ]
+        .concat();
+        assert_eq!(
+            texts(&path(std::slice::from_ref(&two_instances))),
+            Ok(vec!["Pci(0x1,0x0),/Pci(0x1,0x0)".to_owned()]),
+            "two instances, \",/\" between them as edk2 writes it"
+        );
+        assert_eq!(
+            from_text("Pci(0x1,0x0),Pci(0x1,0x0)"),
+            Ok(path(&[two_instances])),
+            "two instances without the \"/\" after \",\""
+        );
+        assert_eq!(
+            texts(&two_paths),
+            Ok(vec!["Pci(0x1,0x0)".to_owned(), "Pci(0x1,0x0)".to_owned()]),
+            "two device paths, as a FilePathList packs them"
+        );
+        assert_eq!(
+            from_text("/PciRoot(0x0)/Pci(0x1,0x0)"),
+            from_text("PciRoot(0x0)/Pci(0x1,0x0)"),
+            "a leading \"/\""
+        );
+    }
+
+    /// An instance of no node has no text, as no text reads back to it, and from_text writes
+    /// none; before each node it skips "/", ",", "(" and ")" as edk2's GetNextDeviceNodeStr()
+    /// does, so "," before a node ends no instance.
+    #[test]
+    fn empty_instances_have_no_text_and_leading_separators_are_skipped() {
+        let pci = node(HARDWARE, 0x01, &[&[0x00, 0x01]]);
+        let end_instance = end_node(END_INSTANCE).to_vec();
+        for (name, bytes) in [
+            (
+                "an empty first instance",
+                path(&[end_instance.clone(), pci.clone()]),
+            ),
+            (
+                "an empty last instance",
+                path(&[pci.clone(), end_instance.clone()]),
+            ),
+            (
+                "an empty middle instance",
+                path(&[
+                    pci.clone(),
+                    end_instance.clone(),
+                    end_instance.clone(),
+                    pci.clone(),
+                ]),
+            ),
+            ("no node", path(&[])),
+        ] {
+            assert_eq!(
+                to_text(&bytes),
+                Err(DevicePathTextError::EmptyInstance),
+                "{name}"
+            );
+        }
+        let one = path(std::slice::from_ref(&pci));
+        let two = path(&[pci.clone(), end_instance.clone(), pci.clone()]);
+        for (text, want) in SEPARATOR_TEXTS.into_iter().zip([&one, &one, &two]) {
+            assert_eq!(from_text(text).as_ref(), Ok(want), "{text}");
+        }
+        for text in ["Pci(0x1,0x0),", "", "/,()"] {
+            assert_eq!(
+                from_text(text),
+                Err(DevicePathTextError::NoNodeText(text.to_owned())),
+                "{text:?}"
+            );
+        }
+    }
+
+    /// from_text refuses a Name(...) of no form it knows, where edk2 would write a File Path of
+    /// that name, and a Path() of an End node, where only "," and the end of the text write End
+    /// nodes; to_text writes such a File Path in its generic form.
+    #[test]
+    fn unknown_names_and_end_nodes_are_refused() {
+        for (text, want) in [
+            (
+                "PciRot(0x0)/Pci(0x1,0x0)",
+                DevicePathTextError::UnknownName("PciRot(0x0)".into()),
+            ),
+            (
+                "WiFi(home)",
+                DevicePathTextError::UnknownName("WiFi(home)".into()),
+            ),
+            (
+                "Pci(0x1,0x0)/Path(127,255)/Pci(0x2,0x0)",
+                DevicePathTextError::EndNodeText("Path(127,255)".into()),
+            ),
+            (
+                "Path(127,1)",
+                DevicePathTextError::EndNodeText("Path(127,1)".into()),
+            ),
+            (
+                "Path(0x7F,0xFF)",
+                DevicePathTextError::EndNodeText("Path(0x7F,0xFF)".into()),
+            ),
+        ] {
+            assert_eq!(from_text(text), Err(want), "{text}");
+        }
+        let unknown = path(&[file("PciRot(0x0)")]);
+        let text = to_text(&unknown).expect("a text");
+        assert_eq!(
+            text, "MediaPath(4,50006300690052006F007400280030007800300029000000)",
+            "a File Path named as a node of no known form"
+        );
+        assert_eq!(from_text(&text), Ok(unknown), "read back to its bytes");
+    }
+
+    #[test]
+    fn malformed_device_paths_and_texts_are_refused() {
+        let pci = node(HARDWARE, 0x01, &[&[0x00, 0x01]]);
+        assert_eq!(
+            device_paths(&pci),
+            Err(DevicePathTextError::NoEnd),
+            "no End node"
+        );
+        assert_eq!(
+            device_paths(&[]),
+            Err(DevicePathTextError::NoEnd),
+            "no node"
+        );
+        assert!(
+            matches!(
+                device_paths(&[0x01, 0x01, 0x02, 0x00]),
+                Err(DevicePathTextError::Node(_))
+            ),
+            "a node Length below 4"
+        );
+        assert_eq!(
+            to_text(&pci),
+            Err(DevicePathTextError::NoEnd),
+            "a path without End"
+        );
+        assert_eq!(
+            to_text(&[path(std::slice::from_ref(&pci)), pci.clone()].concat()),
+            Err(DevicePathTextError::AfterEnd),
+            "a node after the End"
+        );
+        assert_eq!(
+            to_text(&path(&[pci.clone(), end_node(0x02).to_vec(), pci.clone()])),
+            Err(DevicePathTextError::EndSubType(0x02)),
+            "an End node of a reserved Sub-Type"
+        );
+        let cases = [
+            (
+                "Pci(0x1,0x0",
+                DevicePathTextError::Parentheses("Pci(0x1,0x0".into()),
+            ),
+            (
+                "Pci(0x1,0x0))/Pci(0x2,0x0)",
+                DevicePathTextError::Parentheses("Pci(0x1,0x0))/Pci(0x2,0x0)".into()),
+            ),
+            (
+                "Pci(0x1F,0x2,0x3)",
+                DevicePathTextError::Parameters("Pci(0x1F,0x2,0x3)".into()),
+            ),
+            ("Pci(0x100,0x0)", DevicePathTextError::Value("0x100".into())),
+            ("Pci(+1,0x0)", DevicePathTextError::Value("+1".into())),
+            ("Pci(1F,0x0)", DevicePathTextError::Value("1F".into())),
+            (
+                "MAC(5254,0x1)",
+                DevicePathTextError::Value("MAC(5254,0x1)".into()),
+            ),
+            ("Uart(DEFAULT,8,N,1)", DevicePathTextError::UartDefault),
+            ("Uart(115200,DEFAULT,N,1)", DevicePathTextError::UartDefault),
+            (
+                "VenHw(C12A7328-F81F-11D2-BA4B-00A0C93EC93B,ABC)",
+                DevicePathTextError::HexDump("ABC".into()),
+            ),
+            (
+                "Fv(not-a-guid)",
+                DevicePathTextError::Guid("not-a-guid".into()),
+            ),
+            (
+                "Acpi(PN0A03,0)",
+                DevicePathTextError::EisaId("PN0A03".into()),
+            ),
+            (
+                "\\EFI\u{1F600}",
+                DevicePathTextError::NotUcs2("\\EFI\u{1F600}".into()),
+            ),
+            (
+                "Acpi(PNP+123,0)",
+                DevicePathTextError::EisaId("PNP+123".into()),
+            ),
+            (
+                "VenHw(C12A7328-F81F-11D2-BA4B-00A0C93EC93B,+1)",
+                DevicePathTextError::HexDump("+1".into()),
+            ),
+            (
+                "NVMe(0x1,+1-02-03-04-05-06-07-08)",
+                DevicePathTextError::Value("+1-02-03-04-05-06-07-08".into()),
+            ),
+            (
+                "Uart(115200,8,N,0)",
+                DevicePathTextError::UartMixedFormats("Uart(115200,8,N,0)".into()),
+            ),
+            (
+                "Uart(115200,8,2,1.5)",
+                DevicePathTextError::UartMixedFormats("Uart(115200,8,2,1.5)".into()),
+            ),
+            (
+                "Uart(115200,8,3,2)",
+                DevicePathTextError::UartMixedFormats("Uart(115200,8,3,2)".into()),
+            ),
+            (
+                "Pci(0x1,0x0)abc",
+                DevicePathTextError::AfterParentheses("Pci(0x1,0x0)abc".into()),
+            ),
+            (
+                "Uri(a(b))",
+                DevicePathTextError::AfterParentheses("Uri(a(b))".into()),
+            ),
+            (
+                "AcpiAdr()",
+                DevicePathTextError::EmptyList("AcpiAdr()".into()),
+            ),
+            ("Dns()", DevicePathTextError::EmptyList("Dns()".into())),
+            (
+                "IPv4(1.2.3.4,UDP,DHCP,0.0.0.0,1.2.3.4:5)",
+                DevicePathTextError::IpAddress("1.2.3.4:5".into()),
+            ),
+            (
+                "IPv4(256.0.0.1)",
+                DevicePathTextError::IpAddress("256.0.0.1".into()),
+            ),
+            ("IPv4()", DevicePathTextError::IpAddress("".into())),
+            (
+                "IPv6(::ffff:1.2.3.4)",
+                DevicePathTextError::IpAddress("::ffff:1.2.3.4".into()),
+            ),
+            (
+                "IPv6([::1]:80,UDP,Static,::,0x40,[::2]:80)",
+                DevicePathTextError::IpAddress("[::2]:80".into()),
+            ),
+            (
+                "Dns(1.2.3.4,::1)",
+                DevicePathTextError::IpAddress("::1".into()),
+            ),
+            (
+                "Wi-Fi(abcdefghijklmnopqrstuvwxyz0123456)",
+                DevicePathTextError::TooLongString("abcdefghijklmnopqrstuvwxyz0123456".into(), 32),
+            ),
+            (
+                "Uri(\u{E9})",
+                DevicePathTextError::NotAscii("\u{E9}".into()),
+            ),
+            (
+                "SAS(0x1,0,0,NoTopology,1)",
+                DevicePathTextError::SasTopology("1".into()),
+            ),
+            (
+                "SasEx(0x1,0,0,0x83,0,0,1)",
+                DevicePathTextError::SasTopology("1".into()),
+            ),
+            (
+                "SasEx(0x1,0,0,SAS,2)",
+                DevicePathTextError::Value("2".into()),
+            ),
+            (
+                "SasEx(0x1,0,0,SAS,0,4)",
+                DevicePathTextError::Value("4".into()),
+            ),
+            (
+                "SasEx(0x1,0,0,SAS,0,0,257)",
+                DevicePathTextError::Value("257".into()),
+            ),
+            ("UartFlowCtrl(3)", DevicePathTextError::Value("3".into())),
+            ("UartFlowCtrl()", DevicePathTextError::Value("".into())),
+            (
+                "HD(1,3,0x1,0x800,0x1000)",
+                DevicePathTextError::Value("0x1".into()),
+            ),
+            ("HD(1,MBR,0x1)", DevicePathTextError::Value("".into())),
+            ("I1394(xyz)", DevicePathTextError::Value("xyz".into())),
+            (
+                "NVMEoF(nqn.x,urn:uuid:zz)",
+                DevicePathTextError::Value("urn:uuid:zz".into()),
+            ),
+            (
+                "NVMEoF(nqn.x,4EFF7F8E-D353-4E9B-A4EC-DEEA8EAB84D7)",
+                DevicePathTextError::Value("4EFF7F8E-D353-4E9B-A4EC-DEEA8EAB84D7".into()),
+            ),
+            (
+                "UsbWwid(0x1,0x2,0x3,)",
+                DevicePathTextError::Value("".into()),
+            ),
+            (
+                "Ata(Tertiary,Master,0x0)",
+                DevicePathTextError::Value("Tertiary".into()),
+            ),
+            (
+                "iSCSI(t,0x1,0x0,MD5)",
+                DevicePathTextError::Value("MD5".into()),
+            ),
+            (
+                "IPv6(::1,UDP,Dynamic)",
+                DevicePathTextError::Value("Dynamic".into()),
+            ),
+            (
+                "RestService(1,2,C12A7328-F81F-11D2-BA4B-00A0C93EC93B)",
+                DevicePathTextError::Parameters(
+                    "RestService(1,2,C12A7328-F81F-11D2-BA4B-00A0C93EC93B)".into(),
+                ),
+            ),
+            (
+                "VenPcAnsi(01)",
+                DevicePathTextError::Parameters("VenPcAnsi(01)".into()),
+            ),
+        ];
+        for (text, want) in cases {
+            assert_eq!(from_text(text), Err(want), "{text}");
+        }
+    }
+
+    /// Writes `<hex>\t<text>` lines to $VECTORS_DIR/vectors.tsv, the bytes of each node case and
+    /// OVMF device path and the text that to_text writes, but those of the forms that edk2 lacks,
+    /// which go to $VECTORS_DIR/table-only.tsv, and to $VECTORS_DIR/separators.tsv, the bytes that
+    /// from_text reads SEPARATOR_TEXTS to. The oracle that checks them is BaseTools' port of
+    /// edk2's DevicePathFromText.c, its DevicePath tool, which reads each text: it checks text to
+    /// bytes only, and reads the forms that it lacks as File Paths.
+    #[test]
+    #[ignore = "writes the vectors that edk2's DevicePath tool checks"]
+    fn writes_device_path_vectors() {
+        let out = std::env::var("VECTORS_DIR").expect("VECTORS_DIR names the output directory");
+        let mut lines = String::new();
+        let mut table_only = String::new();
+        let mut add = |bytes: &[u8]| {
+            for path in device_paths(bytes).expect("device paths") {
+                let text = to_text(path).expect("a text");
+                let line = format!("{}\t{text}\n", upper_hex(path));
+                match TABLE_ONLY_FORMS.iter().any(|form| text.starts_with(form)) {
+                    true => table_only.push_str(&line),
+                    false => lines.push_str(&line),
+                }
+            }
+        };
+        for (_, node, _) in node_cases() {
+            add(&path(&[node]));
+        }
+        for variable in [X64_CONOUT, X64_CONIN, AA64_CONOUT] {
+            add(&bytes(variable));
+        }
+        for option in [
+            X64_BOOT0000,
+            X64_BOOT0001,
+            X64_BOOT0002,
+            AA64_BOOT0000,
+            AA64_BOOT0001,
+            AA64_BOOT0002,
+        ] {
+            add(LoadOption::decode(&bytes(option))
+                .expect("an option")
+                .file_paths
+                .as_ref());
+        }
+        std::fs::write(format!("{out}/vectors.tsv"), lines).expect("write vectors.tsv");
+        std::fs::write(format!("{out}/table-only.tsv"), table_only).expect("write table-only.tsv");
+        let separators: String = SEPARATOR_TEXTS
+            .iter()
+            .map(|text| format!("{}\t{text}\n", upper_hex(&from_text(text).expect("bytes"))))
+            .collect();
+        std::fs::write(format!("{out}/separators.tsv"), separators).expect("write separators.tsv");
+    }
+}
diff --git a/src/lib/efi_variables/device_path/acpi.rs b/src/lib/efi_variables/device_path/acpi.rs
new file mode 100644
index 0000000..add6f4d
--- /dev/null
+++ b/src/lib/efi_variables/device_path/acpi.rs
@@ -0,0 +1,216 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The ACPI Device Path nodes (UEFI 2.11 §10.3.3) of named forms in Table 10.67.
+
+use super::parameters::ascii_text;
+use super::parameters::eisa_id;
+use super::parameters::eisa_id_text;
+use super::parameters::integer;
+use super::parameters::Parameters;
+use super::DevicePathTextError;
+use super::Fields;
+
+/// The Sub-Types of UEFI 2.11 §10.3.3
+pub(super) const HID: u8 = 0x01;
+pub(super) const EXTENDED: u8 = 0x02;
+pub(super) const ADR: u8 = 0x03;
+pub(super) const NVDIMM: u8 = 0x04;
+/// "PNP" compressed as an EISA ID, the low 16 bits of a PNP device's _HID (edk2
+/// PNP_EISA_ID_CONST)
+const PNP_EISA_ID: u32 = 0x41D0;
+
+/// The PNP devices whose ACPI nodes UEFI 2.11 Table 10.67 names, by the device number of their
+/// _HID
+pub(super) const PNP_NAMES: [(u32, &str); 6] = [
+    (0x0A03, "PciRoot"),
+    (0x0A08, "PcieRoot"),
+    (0x0604, "Floppy"),
+    (0x0301, "Keyboard"),
+    (0x0501, "Serial"),
+    (0x0401, "ParallelPort"),
+];
+
+/// The name that UEFI 2.11 Table 10.67 gives the PNP device, else Acpi(HID,UID). edk2 writes a
+/// _HID other than a PNP one as Acpi(0x%08x,…), which its EisaIdFromText() does not read; this
+/// writes its EISA ID as edk2 writes those of AcpiEx.
+pub(super) fn hid_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (hid, uid) = (fields.u32()?, fields.u32()?);
+    let name = (hid & 0xFFFF == PNP_EISA_ID)
+        .then(|| PNP_NAMES.iter().find(|(number, _)| *number == hid >> 16))
+        .flatten();
+    match name {
+        Some((_, name)) => Some(format!("{name}(0x{uid:X})")),
+        None => Some(format!("Acpi({},0x{uid:X})", eisa_id_text(hid)?)),
+    }
+}
+
+/// Acpi(HID,UID).
+pub(super) fn hid(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let hid = eisa_id(p.next())?;
+    Ok([hid, p.integer_or(0)?].map(u32::to_le_bytes).concat())
+}
+
+/// A name of PNP_NAMES, as `Acpi(PNP<number>,UID)`.
+pub(super) fn pnp(p: &mut Parameters<'_>, number: u32) -> Result<Vec<u8>, DevicePathTextError> {
+    let hid = PNP_EISA_ID | number << 16;
+    Ok([hid, p.integer_or(0)?].map(u32::to_le_bytes).concat())
+}
+
+/// An ACPI Expanded node: HID, UID, CID, then HIDSTR, UIDSTR and CIDSTR, each ended by Null.
+struct Expanded<'a> {
+    hid: u32,
+    uid: u32,
+    cid: u32,
+    hid_str: &'a str,
+    uid_str: &'a str,
+    cid_str: &'a str,
+}
+
+impl<'a> Expanded<'a> {
+    /// None unless `data` holds exactly the fields and three strings of ASCII, as edk2's
+    /// DevPathFromTextAcpiEx() writes them.
+    fn read(data: &'a [u8]) -> Option<Self> {
+        let mut fields = Fields(data);
+        let (hid, uid, cid) = (fields.u32()?, fields.u32()?, fields.u32()?);
+        let strings: Option<Vec<&str>> = fields
+            .0
+            .strip_suffix(&[0])?
+            .split(|byte| *byte == 0)
+            .map(ascii_text)
+            .collect();
+        let [hid_str, uid_str, cid_str] = strings?[..] else {
+            return None;
+        };
+        Some(Self {
+            hid,
+            uid,
+            cid,
+            hid_str,
+            uid_str,
+            cid_str,
+        })
+    }
+
+    /// AcpiEx(HID,CID,UID,HIDSTR,CIDSTR,UIDSTR).
+    fn full_text(&self) -> Option<String> {
+        Some(format!(
+            "AcpiEx({},{},0x{:X},{},{},{})",
+            eisa_id_text(self.hid)?,
+            eisa_id_text(self.cid)?,
+            self.uid,
+            self.hid_str,
+            self.cid_str,
+            self.uid_str
+        ))
+    }
+
+    fn data(&self) -> Vec<u8> {
+        let ids = [self.hid, self.uid, self.cid].map(u32::to_le_bytes);
+        let strings =
+            [self.hid_str, self.uid_str, self.cid_str].map(|text| [text.as_bytes(), &[0]].concat());
+        [ids.concat(), strings.concat()].concat()
+    }
+}
+
+/// AcpiExp(HID,CID,UIDSTR) where only UIDSTR is set, else AcpiEx(HID,CID,UID,HIDSTR,CIDSTR,
+/// UIDSTR), as edk2 chooses.
+pub(super) fn extended_text(data: &[u8]) -> Option<String> {
+    let node = Expanded::read(data)?;
+    match (node.hid_str, node.cid_str, node.uid_str) {
+        ("", "", uid_str) if !uid_str.is_empty() => {
+            let cid = match node.cid {
+                0 => "0".to_owned(),
+                cid => eisa_id_text(cid)?,
+            };
+            Some(format!(
+                "AcpiExp({},{cid},{uid_str})",
+                eisa_id_text(node.hid)?
+            ))
+        }
+        _ => node.full_text(),
+    }
+}
+
+/// AcpiEx(HID,CID,UID,HIDSTR,CIDSTR,UIDSTR), which a node whose AcpiExp would drop its UID takes:
+/// edk2 writes AcpiExp whatever the UID.
+pub(super) fn extended_full_text(data: &[u8]) -> Option<String> {
+    Expanded::read(data)?.full_text()
+}
+
+/// AcpiEx(HID,CID,UID,HIDSTR,CIDSTR,UIDSTR), each 0 or empty if omitted, as Table 10.67 gives
+/// them: edk2's EisaIdFromText() reads an omitted HID or CID from the characters after it.
+pub(super) fn extended(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (hid, cid) = (p.eisa_id_or(0)?, p.eisa_id_or(0)?);
+    let uid = p.integer_or(0)?;
+    let (hid_str, cid_str, uid_str) = (p.ascii()?, p.ascii()?, p.ascii()?);
+    Ok(Expanded {
+        hid,
+        uid,
+        cid,
+        hid_str,
+        uid_str,
+        cid_str,
+    }
+    .data())
+}
+
+/// AcpiExp(HID,CID,UIDSTR): UID 0, HIDSTR and CIDSTR empty, CID 0 if omitted.
+pub(super) fn expanded(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let hid = eisa_id(p.next())?;
+    let cid = p.eisa_id_or(0)?;
+    let uid_str = p.ascii()?;
+    Ok(Expanded {
+        hid,
+        uid: 0,
+        cid,
+        hid_str: "",
+        uid_str,
+        cid_str: "",
+    }
+    .data())
+}
+
+/// AcpiAdr(ADR,…), each _ADR of the node.
+pub(super) fn adr_text(data: &[u8]) -> Option<String> {
+    let (adrs, []) = data.as_chunks::<4>() else {
+        return None;
+    };
+    let adrs: Vec<String> = adrs
+        .iter()
+        .map(|adr| format!("0x{:X}", u32::from_le_bytes(*adr)))
+        .collect();
+    (!adrs.is_empty()).then(|| format!("AcpiAdr({})", adrs.join(",")))
+}
+
+/// AcpiAdr(DisplayDevice,…), one or more.
+pub(super) fn adr(p: &mut Parameters<'_>, text: &str) -> Result<Vec<u8>, DevicePathTextError> {
+    let adrs = p
+        .rest()
+        .map(|adr| integer::<u32>(adr).map(u32::to_le_bytes))
+        .collect::<Result<Vec<_>, _>>()?;
+    match adrs.is_empty() {
+        true => Err(DevicePathTextError::EmptyList(text.to_owned())),
+        false => Ok(adrs.concat()),
+    }
+}
+
+/// NvdimmAcpiAdr(NFIT Device Handle), as Table 10.67 gives it: edk2 has no form for it. The
+/// handle, an _ADR, is hexadecimal as AcpiAdr's.
+pub(super) fn nvdimm_text(data: &[u8]) -> Option<String> {
+    Some(format!("NvdimmAcpiAdr(0x{:X})", Fields(data).u32()?))
+}
+
+pub(super) fn nvdimm(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(p.integer::<u32>()?.to_le_bytes().to_vec())
+}
diff --git a/src/lib/efi_variables/device_path/bbs.rs b/src/lib/efi_variables/device_path/bbs.rs
new file mode 100644
index 0000000..1de7c09
--- /dev/null
+++ b/src/lib/efi_variables/device_path/bbs.rs
@@ -0,0 +1,57 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The BIOS Boot Specification Device Path node (UEFI 2.11 §10.3.6), BBS of Table 10.67.
+
+use super::parameters::ascii_text;
+use super::parameters::Parameters;
+use super::DevicePathTextError;
+use super::Fields;
+
+/// The Sub-Type of a BBS 1.01 node
+pub(super) const BBS_101: u8 = 0x01;
+/// The Device Type keywords of UEFI 2.11 Table 10.67
+const DEVICE_TYPES: [(&str, u16); 6] = [
+    ("Floppy", 0x01),
+    ("HD", 0x02),
+    ("CDROM", 0x03),
+    ("PCMCIA", 0x04),
+    ("USB", 0x05),
+    ("Network", 0x06),
+];
+
+/// BBS(Type,Id,Flags), of Device Type, Status Flag and the Description String, ASCII ended by
+/// Null.
+pub(super) fn bbs_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (device_type, flags) = (fields.u16()?, fields.u16()?);
+    let id = ascii_text(fields.0.strip_suffix(&[0])?)?;
+    let device_type = match DEVICE_TYPES.iter().find(|(_, value)| *value == device_type) {
+        Some((name, _)) => (*name).to_owned(),
+        None => format!("0x{device_type:X}"),
+    };
+    Some(format!("BBS({device_type},{id},0x{flags:X})"))
+}
+
+/// BBS(Type,Id,Flags), Flags 0 if omitted.
+pub(super) fn bbs(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let device_type = p.keyword_or_integer(&DEVICE_TYPES)?;
+    let id = p.ascii()?;
+    let flags: u16 = p.integer_or(0)?;
+    let data = [
+        &device_type.to_le_bytes()[..],
+        &flags.to_le_bytes(),
+        id.as_bytes(),
+        &[0],
+    ];
+    Ok(data.concat())
+}
diff --git a/src/lib/efi_variables/device_path/hardware.rs b/src/lib/efi_variables/device_path/hardware.rs
new file mode 100644
index 0000000..240b467
--- /dev/null
+++ b/src/lib/efi_variables/device_path/hardware.rs
@@ -0,0 +1,87 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The Hardware Device Path nodes (UEFI 2.11 §10.3.2) of named forms in Table 10.67, but Vendor's,
+//! which vendor.rs writes for each Type.
+
+use super::parameters::Parameters;
+use super::DevicePathTextError;
+use super::Fields;
+
+/// The Sub-Types of UEFI 2.11 §10.3.2
+pub(super) const PCI: u8 = 0x01;
+pub(super) const PCCARD: u8 = 0x02;
+pub(super) const MEMORY_MAPPED: u8 = 0x03;
+pub(super) const VENDOR: u8 = 0x04;
+pub(super) const CONTROLLER: u8 = 0x05;
+pub(super) const BMC: u8 = 0x06;
+
+pub(super) fn pci_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (function, device) = (fields.u8()?, fields.u8()?);
+    Some(format!("Pci(0x{device:X},0x{function:X})"))
+}
+
+/// Pci(Device,Function), into Function then Device.
+pub(super) fn pci(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let device: u8 = p.integer()?;
+    Ok(vec![p.integer()?, device])
+}
+
+pub(super) fn pc_card_text(data: &[u8]) -> Option<String> {
+    Some(format!("PcCard(0x{:X})", Fields(data).u8()?))
+}
+
+pub(super) fn pc_card(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(vec![p.integer()?])
+}
+
+pub(super) fn memory_mapped_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (memory_type, start, end) = (fields.u32()?, fields.u64()?, fields.u64()?);
+    Some(format!(
+        "MemoryMapped(0x{memory_type:X},0x{start:X},0x{end:X})"
+    ))
+}
+
+pub(super) fn memory_mapped(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let memory_type: u32 = p.integer()?;
+    let (start, end): (u64, u64) = (p.integer()?, p.integer()?);
+    Ok([
+        &memory_type.to_le_bytes()[..],
+        &start.to_le_bytes(),
+        &end.to_le_bytes(),
+    ]
+    .concat())
+}
+
+pub(super) fn controller_text(data: &[u8]) -> Option<String> {
+    Some(format!("Ctrl(0x{:X})", Fields(data).u32()?))
+}
+
+pub(super) fn controller(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(p.integer::<u32>()?.to_le_bytes().to_vec())
+}
+
+pub(super) fn bmc_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (interface_type, address) = (fields.u8()?, fields.u64()?);
+    Some(format!("BMC(0x{interface_type:X},0x{address:X})"))
+}
+
+/// BMC(Type,Address); an Address without "0x" is decimal, as Table 10.66 makes an Integer, where
+/// edk2's DevPathFromTextBmc() reads it as hexadecimal.
+pub(super) fn bmc(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let interface_type: u8 = p.integer()?;
+    let address: u64 = p.integer()?;
+    Ok([&[interface_type][..], &address.to_le_bytes()].concat())
+}
diff --git a/src/lib/efi_variables/device_path/media.rs b/src/lib/efi_variables/device_path/media.rs
new file mode 100644
index 0000000..dc688c0
--- /dev/null
+++ b/src/lib/efi_variables/device_path/media.rs
@@ -0,0 +1,240 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The Media Device Path nodes (UEFI 2.11 §10.3.5) of named forms in Table 10.67, but Vendor's,
+//! which vendor.rs writes for each Type, and File Path's, the text of its path.
+
+use super::guid;
+use super::parameters::integer;
+use super::parameters::Parameters;
+use super::DevicePathTextError;
+use super::Fields;
+use crate::hii::package::Guid;
+
+/// The Sub-Types of UEFI 2.11 §10.3.5
+pub(super) const HARD_DRIVE: u8 = 0x01;
+pub(super) const CDROM: u8 = 0x02;
+pub(super) const VENDOR: u8 = 0x03;
+pub(super) const FILE_PATH: u8 = 0x04;
+pub(super) const PROTOCOL: u8 = 0x05;
+pub(super) const FIRMWARE_FILE: u8 = 0x06;
+pub(super) const FIRMWARE_VOLUME: u8 = 0x07;
+pub(super) const OFFSET: u8 = 0x08;
+pub(super) const RAM_DISK: u8 = 0x09;
+
+/// The Hard Drive Partition Format and Signature Type of an MBR and a GPT partition (UEFI 2.11
+/// §10.3.5.1), the values of the keywords MBR and GPT
+const MBR: u8 = 0x01;
+const GPT: u8 = 0x02;
+/// The RAM Disk types that UEFI 2.11 Table 10.67 names, by their Disk Type GUID
+pub(super) const RAM_DISK_NAMES: [(Guid, &str); 4] = [
+    (
+        guid(
+            0x77AB535A,
+            0x45FC,
+            0x624B,
+            [0x55, 0x60, 0xF7, 0xB2, 0x81, 0xD1, 0xF9, 0x6E],
+        ),
+        "VirtualDisk",
+    ),
+    (
+        guid(
+            0x3D5ABD30,
+            0x4175,
+            0x87CE,
+            [0x6D, 0x64, 0xD2, 0xAD, 0xE5, 0x23, 0xC4, 0xBB],
+        ),
+        "VirtualCD",
+    ),
+    (
+        guid(
+            0x5CEA02C9,
+            0x4D07,
+            0x69D3,
+            [0x26, 0x9F, 0x44, 0x96, 0xFB, 0xE0, 0x96, 0xF9],
+        ),
+        "PersistentVirtualDisk",
+    ),
+    (
+        guid(
+            0x08018188,
+            0x42CD,
+            0xBB48,
+            [0x10, 0x0F, 0x53, 0x87, 0xD5, 0x3D, 0xED, 0x3D],
+        ),
+        "PersistentVirtualCD",
+    ),
+];
+
+/// HD(Partition,Type,Signature,Start,Size): MBR and its signature, GPT and its GUID, else the
+/// Signature Type and 0. edk2 writes the partition number with "%d", negative from 2^31; this
+/// writes it unsigned, as its StrDecimalToUintn() reads it.
+pub(super) fn hard_drive_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let number = fields.u32()?;
+    let (start, size) = (fields.u64()?, fields.u64()?);
+    let signature = fields.take::<16>()?;
+    let (_format, signature_type) = (fields.u8()?, fields.u8()?);
+    let signature = match signature_type {
+        MBR => format!(
+            "MBR,0x{:08X}",
+            u32::from_le_bytes(*signature.first_chunk()?)
+        ),
+        GPT => format!("GPT,{}", Guid::from(signature)),
+        other => format!("{other},0"),
+    };
+    Some(format!("HD({number},{signature},0x{start:X},0x{size:X})"))
+}
+
+/// HD(…): Partition 0 and Type GPT if omitted, as Table 10.67 gives them, where edk2 reads an
+/// omitted Type as 0; the Type 1 and 2 as MBR and GPT, whose values they are, where edk2 drops
+/// their Signature; another Type of Signature 0, as no Signature fits it. Start and Size are
+/// required, but 0 if omitted for Partition 0, which "prohibits" them.
+pub(super) fn hard_drive(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let number: u32 = p.integer_or(0)?;
+    let kind = p.next();
+    let signature_text = p.next();
+    let signature_type = match kind {
+        "MBR" => MBR,
+        "GPT" | "" => GPT,
+        other => integer(other)?,
+    };
+    let (format, signature) = match signature_type {
+        MBR => {
+            let [a, b, c, d] = integer::<u32>(signature_text)?.to_le_bytes();
+            (MBR, [a, b, c, d, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
+        }
+        GPT => (
+            GPT,
+            <[u8; 16]>::from(super::parameters::guid(signature_text)?),
+        ),
+        _ => match integer::<u64>(signature_text)? {
+            0 => (0, [0; 16]),
+            _ => return Err(DevicePathTextError::Value(signature_text.to_owned())),
+        },
+    };
+    let (start, size): (u64, u64) = match number {
+        0 => (p.integer_or(0)?, p.integer_or(0)?),
+        _ => (p.integer()?, p.integer()?),
+    };
+    let data = [
+        &number.to_le_bytes()[..],
+        &start.to_le_bytes(),
+        &size.to_le_bytes(),
+        &signature,
+        &[format, signature_type],
+    ];
+    Ok(data.concat())
+}
+
+pub(super) fn cdrom_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let entry = fields.u32()?;
+    let (start, size) = (fields.u64()?, fields.u64()?);
+    Some(format!("CDROM(0x{entry:X},0x{start:X},0x{size:X})"))
+}
+
+/// CDROM(Entry,Start,Size), Entry 0 if omitted.
+pub(super) fn cdrom(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let entry: u32 = p.integer_or(0)?;
+    let (start, size): (u64, u64) = (p.integer()?, p.integer()?);
+    Ok([
+        &entry.to_le_bytes()[..],
+        &start.to_le_bytes(),
+        &size.to_le_bytes(),
+    ]
+    .concat())
+}
+
+/// A File Path node's path: UCS-2, then Null.
+pub(super) fn file_path_text(data: &[u8]) -> Option<String> {
+    let (units, []) = data.as_chunks::<2>() else {
+        return None;
+    };
+    let units: Vec<u16> = units.iter().map(|unit| u16::from_le_bytes(*unit)).collect();
+    let (&0, name) = units.split_last()? else {
+        return None;
+    };
+    String::from_utf16(name).ok()
+}
+
+/// Media(Guid), Fv(Guid) or FvFile(Guid).
+pub(super) fn guid_text(name: &str, data: &[u8]) -> Option<String> {
+    Some(format!("{name}({})", Fields(data).guid()?))
+}
+
+pub(super) fn guid_node(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(p.guid()?.to_vec())
+}
+
+/// Offset(StartingOffset,EndingOffset), after a Reserved field that the text leaves 0.
+pub(super) fn offset_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let _reserved = fields.u32()?;
+    let (start, end) = (fields.u64()?, fields.u64()?);
+    Some(format!("Offset(0x{start:X},0x{end:X})"))
+}
+
+pub(super) fn offset(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (start, end): (u64, u64) = (p.integer()?, p.integer()?);
+    Ok([
+        &0_u32.to_le_bytes()[..],
+        &start.to_le_bytes(),
+        &end.to_le_bytes(),
+    ]
+    .concat())
+}
+
+/// The name of the node's Disk Type of RAM_DISK_NAMES, or RamDisk: (StartingAddress,
+/// EndingAddress,DiskInstance), the Disk Type GUID last for RamDisk.
+pub(super) fn ram_disk_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (start, end) = (fields.u64()?, fields.u64()?);
+    let (disk_type, instance) = (fields.guid()?, fields.u16()?);
+    let addresses = format!("0x{start:X},0x{end:X},{instance}");
+    Some(
+        match RAM_DISK_NAMES.iter().find(|(named, _)| *named == disk_type) {
+            Some((_, name)) => format!("{name}({addresses})"),
+            None => format!("RamDisk({addresses},{disk_type})"),
+        },
+    )
+}
+
+/// RamDisk(StartingAddress,EndingAddress,DiskInstance,DiskTypeGuid), DiskInstance 0 if omitted.
+pub(super) fn ram_disk(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (start, end, instance) = ram_disk_range(p)?;
+    Ok(ram_disk_data(start, end, p.guid()?, instance))
+}
+
+/// A name of RAM_DISK_NAMES: (StartingAddress,EndingAddress,DiskInstance), DiskInstance 0 if
+/// omitted.
+pub(super) fn named_ram_disk(
+    p: &mut Parameters<'_>,
+    disk_type: Guid,
+) -> Result<Vec<u8>, DevicePathTextError> {
+    let (start, end, instance) = ram_disk_range(p)?;
+    Ok(ram_disk_data(start, end, disk_type.into(), instance))
+}
+
+fn ram_disk_range(p: &mut Parameters<'_>) -> Result<(u64, u64, u16), DevicePathTextError> {
+    Ok((p.integer()?, p.integer()?, p.integer_or(0)?))
+}
+
+fn ram_disk_data(start: u64, end: u64, disk_type: [u8; 16], instance: u16) -> Vec<u8> {
+    [
+        &start.to_le_bytes()[..],
+        &end.to_le_bytes(),
+        &disk_type,
+        &instance.to_le_bytes(),
+    ]
+    .concat()
+}
diff --git a/src/lib/efi_variables/device_path/network.rs b/src/lib/efi_variables/device_path/network.rs
new file mode 100644
index 0000000..4ba70b4
--- /dev/null
+++ b/src/lib/efi_variables/device_path/network.rs
@@ -0,0 +1,364 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The Messaging Device Path nodes of networks (UEFI 2.11 §10.3.4) of named forms in Table
+//! 10.67: InfiniBand, MAC Address, IPv4, IPv6, VLAN, URI, Bluetooth, Wi-Fi, BluetoothLE, DNS and
+//! REST Service.
+
+use super::parameters::ascii_text;
+use super::parameters::ipv4;
+use super::parameters::ipv4_text;
+use super::parameters::ipv6;
+use super::parameters::ipv6_text;
+use super::parameters::keyword_or_integer;
+use super::parameters::upper_hex;
+use super::parameters::Parameters;
+use super::DevicePathTextError;
+use super::Fields;
+
+/// The Sub-Types of UEFI 2.11 §10.3.4
+pub(super) const INFINIBAND: u8 = 0x09;
+pub(super) const MAC_ADDRESS: u8 = 0x0B;
+pub(super) const IPV4: u8 = 0x0C;
+pub(super) const IPV6: u8 = 0x0D;
+pub(super) const VLAN: u8 = 0x14;
+pub(super) const URI: u8 = 0x18;
+pub(super) const BLUETOOTH: u8 = 0x1B;
+pub(super) const WIFI: u8 = 0x1C;
+pub(super) const BLUETOOTH_LE: u8 = 0x1E;
+pub(super) const DNS: u8 = 0x1F;
+pub(super) const REST_SERVICE: u8 = 0x21;
+
+/// The MAC Address field of a MAC Address node, padded with zeros (UEFI 2.11 §10.3.4.10)
+const MAC_ADDRESS_SIZE: usize = 32;
+/// The IfTypes whose MAC address is 6 bytes long (UEFI 2.11 Table 10.67)
+const SIX_BYTE_IF_TYPES: [u8; 2] = [0, 1];
+/// The data of the IPv4 and IPv6 nodes of UEFI 2.11, with their gateway fields; edk2's
+/// DevPathToTextIPv4() and DevPathToTextIPv6() write those only for nodes this long
+const IPV4_SIZE: usize = 23;
+const IPV6_SIZE: usize = 56;
+/// The Protocol keywords of RFC 1700 (UEFI 2.11 Table 10.67), UDP if omitted
+const PROTOCOLS: [(&str, u16); 2] = [("UDP", 17), ("TCP", 6)];
+const UDP: u16 = 17;
+/// The IPv4 Type keywords, DHCP if omitted
+const IPV4_TYPES: [(&str, u8); 2] = [("Static", 1), ("DHCP", 0)];
+/// The IPv6 IPAddressOrigin keywords; edk2 writes StatefulAutoConfigure for any value above 1,
+/// and reads an omitted one as it
+const IPV6_ORIGINS: [(&str, u8); 3] = [
+    ("Static", 0),
+    ("StatelessAutoConfigure", 1),
+    ("StatefulAutoConfigure", 2),
+];
+const STATEFUL_AUTO_CONFIGURE: u8 = 2;
+/// An EFI_IP_ADDRESS of a DNS node, which holds an IPv4 address in its first 4 bytes
+const IP_ADDRESS_SIZE: usize = 16;
+/// The SSId of a Wi-Fi node
+const SSID_SIZE: usize = 32;
+/// The REST Service of a vendor-specific REST Service node (UEFI 2.11 Table 10.51)
+const VENDOR_REST_SERVICE: u8 = 0xFF;
+
+/// Infiniband(Flags,Guid,ServiceId,TargetId,DeviceId), the port GID written as a GUID.
+pub(super) fn infiniband_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (flags, gid) = (fields.u32()?, fields.guid()?);
+    let (service, target, device) = (fields.u64()?, fields.u64()?, fields.u64()?);
+    Some(format!(
+        "Infiniband(0x{flags:X},{gid},0x{service:X},0x{target:X},0x{device:X})"
+    ))
+}
+
+pub(super) fn infiniband(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let flags: u32 = p.integer()?;
+    let gid = p.guid()?;
+    let ids: [u64; 3] = [p.integer()?, p.integer()?, p.integer()?];
+    Ok([
+        &flags.to_le_bytes()[..],
+        &gid,
+        &ids.map(u64::to_le_bytes).concat(),
+    ]
+    .concat())
+}
+
+/// MAC(MacAddr,IfType): the 6 bytes of the address for IfType 0 and 1, else all 32.
+pub(super) fn mac_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let address = fields.take::<MAC_ADDRESS_SIZE>()?;
+    let if_type = fields.u8()?;
+    let shown = match SIX_BYTE_IF_TYPES.contains(&if_type) {
+        true => address.get(..6)?,
+        false => &address[..],
+    };
+    Some(format!("MAC({},0x{if_type:X})", upper_hex(shown)))
+}
+
+/// MAC(MacAddr,IfType), IfType 0 if omitted; the address exactly as long as mac_text writes it.
+pub(super) fn mac(p: &mut Parameters<'_>, text: &str) -> Result<Vec<u8>, DevicePathTextError> {
+    let mut data = p.hex()?;
+    let if_type: u8 = p.integer_or(0)?;
+    let shown = match SIX_BYTE_IF_TYPES.contains(&if_type) {
+        true => 6,
+        false => MAC_ADDRESS_SIZE,
+    };
+    if data.len() != shown {
+        return Err(DevicePathTextError::Value(text.to_owned()));
+    }
+    data.resize(MAC_ADDRESS_SIZE, 0);
+    data.push(if_type);
+    Ok(data)
+}
+
+/// The Protocol as edk2's CatNetworkProtocol() writes it.
+fn protocol_text(protocol: u16) -> String {
+    match PROTOCOLS.iter().find(|(_, value)| *value == protocol) {
+        Some((name, _)) => (*name).to_owned(),
+        None => format!("0x{protocol:X}"),
+    }
+}
+
+/// The Protocol, UDP if omitted, as Table 10.67 gives it: edk2 reads an omitted one as 0.
+fn protocol(p: &mut Parameters<'_>) -> Result<u16, DevicePathTextError> {
+    p.optional()
+        .map_or(Ok(UDP), |text| keyword_or_integer(text, &PROTOCOLS))
+}
+
+/// IPv4(RemoteIp,Protocol,Type,LocalIp,GatewayIPAddress,SubnetMask), of LocalIp, RemoteIp,
+/// LocalPort, RemotePort, Protocol, StaticIpAddress, GatewayIpAddress and SubnetMask; the ports
+/// have no text, and a node without the last two writes none of them, as edk2 writes it.
+pub(super) fn ipv4_text_of(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (local, remote) = (fields.take::<4>()?, fields.take::<4>()?);
+    let _ports = (fields.u16()?, fields.u16()?);
+    let (protocol, static_address) = (fields.u16()?, fields.u8()?);
+    let kind = if static_address != 0 {
+        "Static"
+    } else {
+        "DHCP"
+    };
+    let mut text = format!(
+        "IPv4({},{},{kind},{}",
+        ipv4_text(remote),
+        protocol_text(protocol),
+        ipv4_text(local)
+    );
+    if data.len() == IPV4_SIZE {
+        let (gateway, mask) = (fields.take::<4>()?, fields.take::<4>()?);
+        text.push_str(&format!(",{},{}", ipv4_text(gateway), ipv4_text(mask)));
+    }
+    text.push(')');
+    Some(text)
+}
+
+/// IPv4(…): the Protocol UDP, the Type DHCP and the other addresses all zeros if omitted, each
+/// alone as Table 10.67 gives them, where edk2 zeros GatewayIPAddress and SubnetMask unless both
+/// are given; RemoteIp and LocalIp may hold their port, as Table 10.66 writes an IPv4 Address.
+pub(super) fn ipv4_node(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let remote = ipv4(p.next(), true)?;
+    let protocol = protocol(p)?;
+    let static_address = p.keyword_or(&IPV4_TYPES, 0)?;
+    let local = p.ipv4_or_zero(true)?;
+    let (gateway, mask) = (p.ipv4_or_zero(false)?, p.ipv4_or_zero(false)?);
+    let data = [
+        &local.address[..],
+        &remote.address,
+        &local.port.to_le_bytes(),
+        &remote.port.to_le_bytes(),
+        &protocol.to_le_bytes(),
+        &[static_address],
+        &gateway.address,
+        &mask.address,
+    ];
+    Ok(data.concat())
+}
+
+/// IPv6(RemoteIp,Protocol,IPAddressOrigin,LocalIp,PrefixLength,GatewayIPAddress), of LocalIp,
+/// RemoteIp, LocalPort, RemotePort, Protocol, IpAddressOrigin, PrefixLength and
+/// GatewayIpAddress; the ports have no text, and a node without the last two writes none of
+/// them, as edk2 writes it.
+pub(super) fn ipv6_text_of(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (local, remote) = (fields.take::<16>()?, fields.take::<16>()?);
+    let _ports = (fields.u16()?, fields.u16()?);
+    let (protocol, origin) = (fields.u16()?, fields.u8()?);
+    let origin = match origin {
+        0 => "Static",
+        1 => "StatelessAutoConfigure",
+        _ => "StatefulAutoConfigure",
+    };
+    let mut text = format!(
+        "IPv6({},{},{origin},{}",
+        ipv6_text(remote),
+        protocol_text(protocol),
+        ipv6_text(local)
+    );
+    if data.len() == IPV6_SIZE {
+        let (prefix, gateway) = (fields.u8()?, fields.take::<16>()?);
+        text.push_str(&format!(",0x{prefix:X},{}", ipv6_text(gateway)));
+    }
+    text.push(')');
+    Some(text)
+}
+
+/// IPv6(…): the Protocol UDP, the IPAddressOrigin StatefulAutoConfigure as edk2 reads it, the
+/// PrefixLength 0 and the other addresses all zeros if omitted, each alone as Table 10.67 gives
+/// them, where edk2 zeros PrefixLength and GatewayIPAddress unless both are given; RemoteIp and
+/// LocalIp may hold their port, as Table 10.66 writes an IPv6 Address.
+pub(super) fn ipv6_node(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let remote = ipv6(p.next(), true)?;
+    let protocol = protocol(p)?;
+    let origin = p.keyword_or(&IPV6_ORIGINS, STATEFUL_AUTO_CONFIGURE)?;
+    let local = p.ipv6_or_zero(true)?;
+    let prefix: u8 = p.integer_or(0)?;
+    let gateway = p.ipv6_or_zero(false)?;
+    let data = [
+        &local.address[..],
+        &remote.address,
+        &local.port.to_le_bytes(),
+        &remote.port.to_le_bytes(),
+        &protocol.to_le_bytes(),
+        &[origin, prefix],
+        &gateway.address,
+    ];
+    Ok(data.concat())
+}
+
+/// Vlan(VlanId), in decimal as edk2 writes it.
+pub(super) fn vlan_text(data: &[u8]) -> Option<String> {
+    Some(format!("Vlan({})", Fields(data).u16()?))
+}
+
+pub(super) fn vlan(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(p.integer::<u16>()?.to_le_bytes().to_vec())
+}
+
+/// Uri(Uri), of ASCII, as edk2 writes each byte as a character and reads each character back as
+/// a byte.
+pub(super) fn uri_text(data: &[u8]) -> Option<String> {
+    Some(format!("Uri({})", ascii_text(data)?))
+}
+
+pub(super) fn uri(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(p.ascii()?.as_bytes().to_vec())
+}
+
+pub(super) fn bluetooth_text(data: &[u8]) -> Option<String> {
+    Some(format!(
+        "Bluetooth({})",
+        upper_hex(&Fields(data).take::<6>()?)
+    ))
+}
+
+pub(super) fn bluetooth(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(p.hex_array::<6>()?.to_vec())
+}
+
+/// Wi-Fi(SSID): the SSId up to its first Null, as edk2 writes it.
+pub(super) fn wifi_text(data: &[u8]) -> Option<String> {
+    let ssid = Fields(data).take::<SSID_SIZE>()?;
+    let length = ssid.iter().position(|byte| *byte == 0).unwrap_or(SSID_SIZE);
+    Some(format!("Wi-Fi({})", ascii_text(ssid.get(..length)?)?))
+}
+
+/// Wi-Fi(SSID): ASCII, padded with Null to its 32 bytes; a longer one, which edk2 cuts, is
+/// refused.
+pub(super) fn wifi(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let mut ssid = p.ascii_up_to(SSID_SIZE)?.as_bytes().to_vec();
+    ssid.resize(SSID_SIZE, 0);
+    Ok(ssid)
+}
+
+pub(super) fn bluetooth_le_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (address, address_type) = (fields.take::<6>()?, fields.u8()?);
+    Some(format!(
+        "BluetoothLE({},0x{address_type:02X})",
+        upper_hex(&address)
+    ))
+}
+
+pub(super) fn bluetooth_le(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let address = p.hex_array::<6>()?;
+    Ok([&address[..], &[p.integer()?]].concat())
+}
+
+/// Dns(DnsServerIp,…), IPv4 addresses if IsIPv6 is 0, else IPv6 ones, as edk2 writes them.
+pub(super) fn dns_text(data: &[u8]) -> Option<String> {
+    let (&is_ipv6, addresses) = data.split_first()?;
+    let (addresses, []) = addresses.as_chunks::<IP_ADDRESS_SIZE>() else {
+        return None;
+    };
+    let addresses: Vec<String> = addresses
+        .iter()
+        .map(|address| match is_ipv6 {
+            0 => address
+                .first_chunk::<4>()
+                .map(|address| ipv4_text(*address)),
+            _ => Some(ipv6_text(*address)),
+        })
+        .collect::<Option<_>>()?;
+    (!addresses.is_empty()).then(|| format!("Dns({})", addresses.join(",")))
+}
+
+/// Dns(DnsServerIp,…): one or more, all IPv4 if the first is, else all IPv6. edk2 writes no
+/// node for none.
+pub(super) fn dns(p: &mut Parameters<'_>, text: &str) -> Result<Vec<u8>, DevicePathTextError> {
+    let addresses: Vec<&str> = p.rest().collect();
+    let first = addresses
+        .first()
+        .ok_or_else(|| DevicePathTextError::EmptyList(text.to_owned()))?;
+    let is_ipv6 = u8::from(ipv4(first, false).is_err());
+    let addresses = addresses
+        .iter()
+        .map(|address| dns_address(address, is_ipv6))
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok([vec![is_ipv6], addresses.concat()].concat())
+}
+
+/// A DNS server's EFI_IP_ADDRESS: an IPv6 address if `is_ipv6` is set, else an IPv4 one padded
+/// with zeros.
+fn dns_address(text: &str, is_ipv6: u8) -> Result<Vec<u8>, DevicePathTextError> {
+    match is_ipv6 {
+        0 => ipv4(text, false).map(|ip| [&ip.address[..], &[0; IP_ADDRESS_SIZE - 4]].concat()),
+        _ => ipv6(text, false).map(|ip| ip.address.to_vec()),
+    }
+}
+
+/// RestService(RestExServiceType,AccessMode), or for the vendor-specific 0xFF
+/// RestService(RestExServiceType,AccessMode,VendorRestServiceGuid,VendorDefinedData), as Table
+/// 10.67 gives them: edk2 has no form for them. The integers are decimal, as in the example of
+/// UEFI 2.11 §10.3.4.31; the data is a Hex Dump, none if omitted, as a Vendor node's.
+pub(super) fn rest_service_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (service, mode) = (fields.u8()?, fields.u8()?);
+    match (service, fields.0) {
+        (VENDOR_REST_SERVICE, _) => {
+            let vendor = fields.guid()?;
+            Some(match fields.0 {
+                [] => format!("RestService({service},{mode},{vendor})"),
+                defined => format!(
+                    "RestService({service},{mode},{vendor},{})",
+                    upper_hex(defined)
+                ),
+            })
+        }
+        (_, []) => Some(format!("RestService({service},{mode})")),
+        (_, _) => None,
+    }
+}
+
+pub(super) fn rest_service(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (service, mode): (u8, u8) = (p.integer()?, p.integer()?);
+    let vendor = match service {
+        VENDOR_REST_SERVICE => [&p.guid()?[..], &p.hex()?].concat(),
+        _ => Vec::new(),
+    };
+    Ok([&[service, mode][..], &vendor].concat())
+}
diff --git a/src/lib/efi_variables/device_path/parameters.rs b/src/lib/efi_variables/device_path/parameters.rs
new file mode 100644
index 0000000..96894e2
--- /dev/null
+++ b/src/lib/efi_variables/device_path/parameters.rs
@@ -0,0 +1,333 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The option parameters of a named form (UEFI 2.11 §10.6.1.5): read from its text as Table 10.66
+//! types them, and written into it as edk2-stable202608's DevicePathToText.c writes them.
+
+use std::net::Ipv4Addr;
+use std::net::Ipv6Addr;
+use std::str::FromStr;
+
+use super::DevicePathTextError;
+use crate::hii::package::Guid;
+
+/// An IP address parameter as Table 10.66 writes one: the address, then the port after ":", 0
+/// if none.
+pub(super) struct IpParameter<const N: usize> {
+    pub(super) address: [u8; N],
+    pub(super) port: u16,
+}
+
+impl<const N: usize> IpParameter<N> {
+    /// All zeros, an omitted address
+    const ZERO: Self = Self {
+        address: [0; N],
+        port: 0,
+    };
+}
+
+/// The parameters of a named form, comma-separated as edk2's GetNextParamStr() splits them; a
+/// missing one reads as "".
+pub(super) struct Parameters<'a>(std::vec::IntoIter<&'a str>);
+
+impl<'a> Parameters<'a> {
+    /// The parameters between a form's parentheses: "Name()" has none, not one empty one.
+    pub(super) fn new(text: &'a str) -> Self {
+        let parameters = match text {
+            "" => Vec::new(),
+            text => text.split(',').collect(),
+        };
+        Self(parameters.into_iter())
+    }
+
+    pub(super) fn next(&mut self) -> &'a str {
+        self.0.next().unwrap_or("")
+    }
+
+    /// The next parameter, None if omitted.
+    pub(super) fn optional(&mut self) -> Option<&'a str> {
+        Some(self.next()).filter(|text| !text.is_empty())
+    }
+
+    /// The parameters not read yet.
+    pub(super) fn rest(&mut self) -> impl Iterator<Item = &'a str> + '_ {
+        self.0.by_ref()
+    }
+
+    pub(super) fn integer<T: TryFrom<u64>>(&mut self) -> Result<T, DevicePathTextError> {
+        integer(self.next())
+    }
+
+    /// An Integer, `default` if omitted.
+    pub(super) fn integer_or<T: TryFrom<u64>>(
+        &mut self,
+        default: T,
+    ) -> Result<T, DevicePathTextError> {
+        match self.next() {
+            "" => Ok(default),
+            text => integer(text),
+        }
+    }
+
+    /// The value of one of `keywords`, `default` if omitted.
+    pub(super) fn keyword_or<T: Copy>(
+        &mut self,
+        keywords: &[(&str, T)],
+        default: T,
+    ) -> Result<T, DevicePathTextError> {
+        self.optional()
+            .map_or(Ok(default), |text| keyword(text, keywords))
+    }
+
+    /// The value of one of `keywords`, else an Integer.
+    pub(super) fn keyword_or_integer<T: Copy + TryFrom<u64>>(
+        &mut self,
+        keywords: &[(&str, T)],
+    ) -> Result<T, DevicePathTextError> {
+        keyword_or_integer(self.next(), keywords)
+    }
+
+    /// A Hex Dump, none if omitted.
+    pub(super) fn hex(&mut self) -> Result<Vec<u8>, DevicePathTextError> {
+        hex_dump(self.next())
+    }
+
+    /// A Hex Dump of exactly N bytes.
+    pub(super) fn hex_array<const N: usize>(&mut self) -> Result<[u8; N], DevicePathTextError> {
+        let text = self.next();
+        hex_dump(text)?
+            .try_into()
+            .map_err(|_| DevicePathTextError::HexDump(text.to_owned()))
+    }
+
+    /// An 8-byte array that edk2 writes as "0x" and its bytes in order, byte 0 first, and reads as
+    /// an Integer whose bytes it swaps.
+    pub(super) fn byte_array(&mut self) -> Result<[u8; 8], DevicePathTextError> {
+        self.integer::<u64>().map(u64::to_be_bytes)
+    }
+
+    pub(super) fn guid(&mut self) -> Result<[u8; 16], DevicePathTextError> {
+        guid(self.next()).map(<[u8; 16]>::from)
+    }
+
+    /// An EISAID, `default` if omitted.
+    pub(super) fn eisa_id_or(&mut self, default: u32) -> Result<u32, DevicePathTextError> {
+        match self.next() {
+            "" => Ok(default),
+            text => eisa_id(text),
+        }
+    }
+
+    /// A String of ASCII characters but Null, as edk2 copies each character into a CHAR8.
+    pub(super) fn ascii(&mut self) -> Result<&'a str, DevicePathTextError> {
+        let text = self.next();
+        match text.chars().all(|c| c.is_ascii() && c != '\0') {
+            true => Ok(text),
+            false => Err(DevicePathTextError::NotAscii(text.to_owned())),
+        }
+    }
+
+    /// A String of ASCII characters but Null that fits a field of `max` bytes.
+    pub(super) fn ascii_up_to(&mut self, max: usize) -> Result<&'a str, DevicePathTextError> {
+        let text = self.ascii()?;
+        match text.len() <= max {
+            true => Ok(text),
+            false => Err(DevicePathTextError::TooLongString(text.to_owned(), max)),
+        }
+    }
+
+    /// An IPv4 Address, its port too if `with_port`, all zeros if omitted.
+    pub(super) fn ipv4_or_zero(
+        &mut self,
+        with_port: bool,
+    ) -> Result<IpParameter<4>, DevicePathTextError> {
+        self.optional()
+            .map_or(Ok(IpParameter::ZERO), |text| ipv4(text, with_port))
+    }
+
+    /// An IPv6 Address, its port too if `with_port`, all zeros if omitted.
+    pub(super) fn ipv6_or_zero(
+        &mut self,
+        with_port: bool,
+    ) -> Result<IpParameter<16>, DevicePathTextError> {
+        self.optional()
+            .map_or(Ok(IpParameter::ZERO), |text| ipv6(text, with_port))
+    }
+
+    /// Fails if parameters are left.
+    pub(super) fn finish(mut self, text: &str) -> Result<(), DevicePathTextError> {
+        match self.0.next() {
+            None => Ok(()),
+            Some(_) => Err(DevicePathTextError::Parameters(text.to_owned())),
+        }
+    }
+}
+
+/// An Integer of UEFI 2.11 Table 10.66: hexadecimal after "0x" or "0X", else decimal.
+pub(super) fn integer<T: TryFrom<u64>>(text: &str) -> Result<T, DevicePathTextError> {
+    let (digits, radix) = match text.strip_prefix("0x").or_else(|| text.strip_prefix("0X")) {
+        Some(digits) => (digits, 16),
+        None => (text, 10),
+    };
+    digits
+        .chars()
+        .all(|c| c.is_digit(radix))
+        .then(|| u64::from_str_radix(digits, radix).ok())
+        .flatten()
+        .and_then(|value| T::try_from(value).ok())
+        .ok_or_else(|| DevicePathTextError::Value(text.to_owned()))
+}
+
+/// The value of one of `keywords`, as edk2 compares them: case-sensitive.
+pub(super) fn keyword<T: Copy>(
+    text: &str,
+    keywords: &[(&str, T)],
+) -> Result<T, DevicePathTextError> {
+    keywords
+        .iter()
+        .find(|(keyword, _)| *keyword == text)
+        .map(|(_, value)| *value)
+        .ok_or_else(|| DevicePathTextError::Value(text.to_owned()))
+}
+
+/// The value of one of `keywords`, else an Integer.
+pub(super) fn keyword_or_integer<T: Copy + TryFrom<u64>>(
+    text: &str,
+    keywords: &[(&str, T)],
+) -> Result<T, DevicePathTextError> {
+    keyword(text, keywords).or_else(|_| integer(text))
+}
+
+/// An IPv4 Address of UEFI 2.11 Table 10.66, and its port after ":", 0 if none, which only
+/// `with_port` takes.
+pub(super) fn ipv4(text: &str, with_port: bool) -> Result<IpParameter<4>, DevicePathTextError> {
+    let invalid = || DevicePathTextError::IpAddress(text.to_owned());
+    let (address, port) = match text.split_once(':') {
+        Some((address, port)) if with_port => (address, integer(port)?),
+        Some(_) => return Err(invalid()),
+        None => (text, 0),
+    };
+    Ipv4Addr::from_str(address)
+        .map(|address| IpParameter {
+            address: address.octets(),
+            port,
+        })
+        .map_err(|_| invalid())
+}
+
+/// An IPv6 Address of UEFI 2.11 Table 10.66, `[address]:port` or `[address]`, or the bare
+/// address as edk2 writes it; the port, 0 if none, only `with_port` takes. The address is
+/// hexadecimal pieces as edk2's StrToIpv6Address() reads them, "::" too, but no dotted IPv4
+/// tail, which it does not read.
+pub(super) fn ipv6(text: &str, with_port: bool) -> Result<IpParameter<16>, DevicePathTextError> {
+    let invalid = || DevicePathTextError::IpAddress(text.to_owned());
+    let (address, port) = match text.strip_prefix('[') {
+        Some(bracketed) => match bracketed.split_once(']').ok_or_else(invalid)? {
+            (address, "") => (address, 0),
+            (address, port) => match port.strip_prefix(':') {
+                Some(port) if with_port => (address, integer(port)?),
+                Some(_) | None => return Err(invalid()),
+            },
+        },
+        None => (text, 0),
+    };
+    match address.contains('.') {
+        true => Err(invalid()),
+        false => Ipv6Addr::from_str(address)
+            .map(|address| IpParameter {
+                address: address.octets(),
+                port,
+            })
+            .map_err(|_| invalid()),
+    }
+}
+
+/// A Hex Dump of UEFI 2.11 Table 10.66: two hexadecimal digits a byte.
+fn hex_dump(text: &str) -> Result<Vec<u8>, DevicePathTextError> {
+    let digits = text.as_bytes();
+    match digits.len().is_multiple_of(2) && digits.iter().all(u8::is_ascii_hexdigit) {
+        true => Ok(digits
+            .chunks_exact(2)
+            .filter_map(|pair| std::str::from_utf8(pair).ok())
+            .filter_map(|pair| u8::from_str_radix(pair, 16).ok())
+            .collect()),
+        false => Err(DevicePathTextError::HexDump(text.to_owned())),
+    }
+}
+
+pub(super) fn guid(text: &str) -> Result<Guid, DevicePathTextError> {
+    Guid::from_str(text).map_err(|_| DevicePathTextError::Guid(text.to_owned()))
+}
+
+/// An EISAID of UEFI 2.11 Table 10.66: three letters and four hexadecimal digits, or 0. The
+/// letters may also be "@" and "[" to "_", the 5-bit values 0 and 27 to 31 that edk2 writes as
+/// "@" + value and its EisaIdFromText() reads back.
+pub(super) fn eisa_id(text: &str) -> Result<u32, DevicePathTextError> {
+    if text == "0" {
+        return Ok(0);
+    }
+    let invalid = || DevicePathTextError::EisaId(text.to_owned());
+    let (letters, number) = text.split_at_checked(3).ok_or_else(invalid)?;
+    let letters: Option<Vec<u32>> = letters
+        .bytes()
+        .map(|letter| match letter.to_ascii_uppercase() {
+            letter @ b'@'..=b'_' => Some(u32::from(letter - b'@')),
+            _ => None,
+        })
+        .collect();
+    let compressed = letters
+        .ok_or_else(invalid)?
+        .into_iter()
+        .fold(0, |id, letter| id << 5 | letter);
+    if number.len() != 4 || !number.bytes().all(|digit| digit.is_ascii_hexdigit()) {
+        return Err(invalid());
+    }
+    let number = u32::from_str_radix(number, 16).map_err(|_| invalid())?;
+    Ok(compressed | number << 16)
+}
+
+/// An EISA ID as edk2 writes one: each 5-bit letter as "@" + its value, then the high 16 bits in
+/// hexadecimal; None if bit 15, outside the letters, is set, as no text holds it.
+pub(super) fn eisa_id_text(id: u32) -> Option<String> {
+    let letters: String = [10, 5, 0]
+        .map(|shift| (id >> shift) & 0x1F)
+        .iter()
+        .filter_map(|letter| char::from_u32(u32::from(b'@') + letter))
+        .collect();
+    (id & 0x8000 == 0).then(|| format!("{letters}{:04X}", id >> 16))
+}
+
+/// `bytes` in uppercase hex, two digits a byte, as edk2's PrintLib writes "%02x".
+pub(super) fn upper_hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02X}")).collect()
+}
+
+/// `bytes` as a String if each is an ASCII character but Null, as edk2's "%a" writes them and its
+/// StrToAscii() reads them back.
+pub(super) fn ascii_text(bytes: &[u8]) -> Option<&str> {
+    bytes
+        .iter()
+        .all(|byte| byte.is_ascii() && *byte != 0)
+        .then(|| std::str::from_utf8(bytes).ok())
+        .flatten()
+}
+
+/// An IPv4 address as edk2's CatIPv4Address() writes it.
+pub(super) fn ipv4_text(address: [u8; 4]) -> String {
+    Ipv4Addr::from(address).to_string()
+}
+
+/// An IPv6 address as edk2's CatIPv6Address() writes it: 8 pieces of 4 hexadecimal digits.
+pub(super) fn ipv6_text(address: [u8; 16]) -> String {
+    let pieces: Vec<String> = address.chunks_exact(2).map(upper_hex).collect();
+    pieces.join(":")
+}
diff --git a/src/lib/efi_variables/device_path/serial.rs b/src/lib/efi_variables/device_path/serial.rs
new file mode 100644
index 0000000..63ae0dd
--- /dev/null
+++ b/src/lib/efi_variables/device_path/serial.rs
@@ -0,0 +1,136 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The UART node (UEFI 2.11 §10.3.4.15) and the flow control of a UART Flow Control node
+//! (§10.3.4.17).
+
+use super::parameters::integer;
+use super::parameters::keyword_or_integer;
+use super::parameters::Parameters;
+use super::DevicePathTextError;
+use super::Fields;
+
+/// The Sub-Type of a UART node
+pub(super) const UART: u8 = 0x0E;
+/// What edk2 writes for a UART's BaudRate or DataBits of 0, and reads back as 115200 or 8
+pub(super) const UART_DEFAULT: &str = "DEFAULT";
+/// The UART Parity and Stop Bits keywords, by value (UEFI 2.11 Table 10.67)
+const PARITY_NAMES: [&str; 6] = ["D", "N", "E", "O", "M", "S"];
+const STOP_BITS_NAMES: [&str; 4] = ["D", "1", "1.5", "2"];
+/// The FlowControlMap values that UartFlowCtrl names (UEFI 2.11 Table 10.67)
+const FLOW_CONTROLS: [(&str, u32); 3] = [("None", 0), ("Hardware", 1), ("XonXoff", 2)];
+/// The bits of FlowControlMap that edk2's DevPathToTextVendor() names
+const FLOW_CONTROL_MASK: u32 = 0x3;
+
+/// Uart(BaudRate,DataBits,Parity,StopBits): Parity and StopBits both keywords, or both integers,
+/// as "Mixing formats is prohibited" (UEFI 2.11 Table 10.67). edk2 writes a BaudRate or DataBits
+/// of 0 as DEFAULT, which it reads back as 115200 or 8; this writes 0.
+pub(super) fn uart_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let _reserved = fields.u32()?;
+    let (baud, data_bits) = (fields.u64()?, fields.u8()?);
+    let (parity, stop_bits) = (fields.u8()?, fields.u8()?);
+    let keywords = PARITY_NAMES
+        .get(usize::from(parity))
+        .zip(STOP_BITS_NAMES.get(usize::from(stop_bits)));
+    Some(match keywords {
+        Some((parity, stop_bits)) => format!("Uart({baud},{data_bits},{parity},{stop_bits})"),
+        None => format!("Uart({baud},{data_bits},{parity},{stop_bits})"),
+    })
+}
+
+/// Uart(BaudRate,DataBits,Parity,StopBits), 115200, 8, D and D if omitted; refuses DEFAULT,
+/// which to_text never writes, and a keyword next to an integer, which edk2 reads all the same.
+pub(super) fn uart(p: &mut Parameters<'_>, text: &str) -> Result<Vec<u8>, DevicePathTextError> {
+    let baud: u64 = uart_integer_or(p, 115_200)?;
+    let data_bits: u8 = uart_integer_or(p, 8)?;
+    let parity = UartField::read(p.next(), &PARITY_NAMES)?;
+    let stop_bits = UartField::read(p.next(), &STOP_BITS_NAMES)?;
+    if let (UartFormat::Keyword, UartFormat::Integer) | (UartFormat::Integer, UartFormat::Keyword) =
+        (parity.format, stop_bits.format)
+    {
+        return Err(DevicePathTextError::UartMixedFormats(text.to_owned()));
+    }
+    let data = [
+        &0_u32.to_le_bytes()[..],
+        &baud.to_le_bytes(),
+        &[data_bits, parity.value, stop_bits.value],
+    ];
+    Ok(data.concat())
+}
+
+/// A UART's BaudRate or DataBits: an Integer, `default` if omitted, but never UART_DEFAULT.
+fn uart_integer_or<T: TryFrom<u64>>(
+    p: &mut Parameters<'_>,
+    default: T,
+) -> Result<T, DevicePathTextError> {
+    match p.next() {
+        "" => Ok(default),
+        UART_DEFAULT => Err(DevicePathTextError::UartDefault),
+        text => integer(text),
+    }
+}
+
+/// How a UART's Parity or StopBits is written.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum UartFormat {
+    Keyword,
+    Integer,
+    /// Omitted, or "1" of StopBits, which is both a keyword and the integer of its value
+    Either,
+}
+
+/// A UART's Parity or StopBits: its value and how it is written.
+struct UartField {
+    value: u8,
+    format: UartFormat,
+}
+
+impl UartField {
+    /// A keyword of `names`, as its index, or an Integer; 0 if omitted.
+    fn read(text: &str, names: &[&str]) -> Result<Self, DevicePathTextError> {
+        let keyword = names
+            .iter()
+            .position(|name| *name == text)
+            .map(u8::try_from)
+            .transpose()
+            .map_err(|_| DevicePathTextError::Value(text.to_owned()))?;
+        let number = integer::<u8>(text).ok();
+        let (value, format) = match (text, keyword, number) {
+            ("", _, _) => (0, UartFormat::Either),
+            (_, Some(keyword), Some(number)) if keyword == number => (keyword, UartFormat::Either),
+            (_, Some(keyword), _) => (keyword, UartFormat::Keyword),
+            (_, None, Some(number)) => (number, UartFormat::Integer),
+            (_, None, None) => return Err(DevicePathTextError::Value(text.to_owned())),
+        };
+        Ok(Self { value, format })
+    }
+}
+
+/// UartFlowCtrl(Value), of the FlowControlMap that follows the GUID, by the bits that edk2
+/// names.
+pub(super) fn flow_control_text(data: &[u8]) -> Option<String> {
+    let map = Fields(data).u32()? & FLOW_CONTROL_MASK;
+    let (name, _) = FLOW_CONTROLS.iter().find(|(_, value)| *value == map)?;
+    Some(format!("UartFlowCtrl({name})"))
+}
+
+/// The FlowControlMap of UartFlowCtrl(Value): a keyword, or the integer 0, 1 or 2 that Table
+/// 10.67 allows and edk2's DevPathFromTextUartFlowCtrl() reads as 0.
+pub(super) fn flow_control(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let text = p.next();
+    let map: u32 = keyword_or_integer(text, &FLOW_CONTROLS)?;
+    match FLOW_CONTROLS.iter().any(|(_, value)| *value == map) {
+        true => Ok(map.to_le_bytes().to_vec()),
+        false => Err(DevicePathTextError::Value(text.to_owned())),
+    }
+}
diff --git a/src/lib/efi_variables/device_path/storage.rs b/src/lib/efi_variables/device_path/storage.rs
new file mode 100644
index 0000000..5fee504
--- /dev/null
+++ b/src/lib/efi_variables/device_path/storage.rs
@@ -0,0 +1,485 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The Messaging Device Path nodes of storage buses and devices (UEFI 2.11 §10.3.4) of named
+//! forms in Table 10.67: ATAPI, SCSI, Fibre Channel, 1394, I2O, Device Logical Unit, SATA, SAS,
+//! iSCSI, NVM Express, UFS, SD, eMMC, NVDIMM Namespace and NVMe-oF Namespace.
+
+use super::parameters::ascii_text;
+use super::parameters::integer;
+use super::parameters::keyword;
+use super::parameters::upper_hex;
+use super::parameters::Parameters;
+use super::DevicePathTextError;
+use super::Fields;
+use crate::hii::package::Guid;
+
+/// The Sub-Types of UEFI 2.11 §10.3.4
+pub(super) const ATAPI: u8 = 0x01;
+pub(super) const SCSI: u8 = 0x02;
+pub(super) const FIBRE_CHANNEL: u8 = 0x03;
+pub(super) const F1394: u8 = 0x04;
+pub(super) const I2O: u8 = 0x06;
+pub(super) const LOGICAL_UNIT: u8 = 0x11;
+pub(super) const SATA: u8 = 0x12;
+pub(super) const ISCSI: u8 = 0x13;
+pub(super) const FIBRE_CHANNEL_EX: u8 = 0x15;
+pub(super) const SAS_EX: u8 = 0x16;
+pub(super) const NVME: u8 = 0x17;
+pub(super) const UFS: u8 = 0x19;
+pub(super) const SD: u8 = 0x1A;
+pub(super) const EMMC: u8 = 0x1D;
+pub(super) const NVDIMM: u8 = 0x20;
+pub(super) const NVME_OF: u8 = 0x22;
+
+/// The ATAPI PrimarySecondary and SlaveMaster keywords (UEFI 2.11 Table 10.67)
+const CONTROLLERS: [(&str, u8); 2] = [("Primary", 0), ("Secondary", 1)];
+const DRIVES: [(&str, u8); 2] = [("Master", 0), ("Slave", 1)];
+/// The SAS Location and Connect keywords, and the bits of SAS Device and Topology Info that
+/// they, SATA and the drive bay take (UEFI 2.11 §10.3.4.18.1, edk2-stable202608
+/// DevPathFromTextSasEx())
+const LOCATIONS: [(&str, u16); 2] = [("Internal", 0), ("External", 1)];
+const CONNECTIONS: [(&str, u16); 2] = [("Direct", 0), ("Expanded", 1)];
+const TOPOLOGY_KIND: u16 = 0x000F;
+const TOPOLOGY_SATA: u16 = 0x0010;
+const TOPOLOGY_EXTERNAL: u16 = 0x0020;
+const TOPOLOGY_EXPANDED: u16 = 0x0040;
+const TOPOLOGY_INTEGER: u16 = 0x0080;
+/// The largest Connect, 2 bits
+const MAX_CONNECT: u16 = 3;
+/// The largest DriveBay, 1 more than its byte
+const MAX_DRIVE_BAY: u16 = 256;
+/// The iSCSI Login Options bits (UEFI 2.11 §10.3.4.20.1) and their keywords in Table 10.67
+const HEADER_DIGESTS: [(&str, u16); 2] = [("None", 0), ("CRC32C", 0x0002)];
+const DATA_DIGESTS: [(&str, u16); 2] = [("None", 0), ("CRC32C", 0x0008)];
+const AUTH_NONE: u16 = 0x0800;
+const AUTH_CHAP_UNI: u16 = 0x1000;
+const AUTHENTICATIONS: [(&str, u16); 3] = [
+    ("None", AUTH_NONE),
+    ("CHAP_UNI", AUTH_CHAP_UNI),
+    ("CHAP_BI", 0),
+];
+/// The iSCSI Network Protocol as edk2 writes it: TCP for 0, "reserved" for any other, which it
+/// reads back as 1
+const NETWORK_PROTOCOLS: [(&str, u16); 2] = [("TCP", 0), ("reserved", 1)];
+/// The longest iSCSI Target Name (UEFI 2.11 §10.3.4.20.1) and NVMe-oF SubsystemNQN without its
+/// Null (§10.3.4.32)
+const MAX_TARGET_NAME: usize = 223;
+const MAX_SUBSYSTEM_NQN: usize = 223;
+/// The NVMe-oF NIDT of a namespace UUID, the NID that Table 10.67 writes as an RFC 4122 URN
+const NIDT_UUID: u8 = 0x03;
+const UUID_URN_PREFIX: &str = "urn:uuid:";
+
+pub(super) fn atapi_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (controller, drive, lun) = (fields.u8()?, fields.u8()?, fields.u16()?);
+    // edk2's DevPathToTextAtapi(): 1 is Secondary or Slave, any other value Primary or Master
+    let controller = if controller == 1 {
+        "Secondary"
+    } else {
+        "Primary"
+    };
+    let drive = if drive == 1 { "Slave" } else { "Master" };
+    Some(format!("Ata({controller},{drive},0x{lun:X})"))
+}
+
+pub(super) fn atapi(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let controller = p.keyword_or_integer(&CONTROLLERS)?;
+    let drive = p.keyword_or_integer(&DRIVES)?;
+    let lun: u16 = p.integer()?;
+    Ok([&[controller, drive][..], &lun.to_le_bytes()].concat())
+}
+
+pub(super) fn scsi_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (pun, lun) = (fields.u16()?, fields.u16()?);
+    Some(format!("Scsi(0x{pun:X},0x{lun:X})"))
+}
+
+pub(super) fn scsi(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (pun, lun): (u16, u16) = (p.integer()?, p.integer()?);
+    Ok([pun, lun].map(u16::to_le_bytes).concat())
+}
+
+/// Fibre(WWN,LUN), after a Reserved field that the text leaves 0.
+pub(super) fn fibre_channel_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let _reserved = fields.u32()?;
+    let (wwn, lun) = (fields.u64()?, fields.u64()?);
+    Some(format!("Fibre(0x{wwn:X},0x{lun:X})"))
+}
+
+pub(super) fn fibre_channel(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (wwn, lun): (u64, u64) = (p.integer()?, p.integer()?);
+    Ok([
+        &0_u32.to_le_bytes()[..],
+        &wwn.to_le_bytes(),
+        &lun.to_le_bytes(),
+    ]
+    .concat())
+}
+
+/// FibreEx(WWN,LUN): 8-byte arrays, byte 0 first.
+pub(super) fn fibre_channel_ex_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let _reserved = fields.u32()?;
+    let (wwn, lun) = (fields.take::<8>()?, fields.take::<8>()?);
+    Some(format!(
+        "FibreEx(0x{},0x{})",
+        upper_hex(&wwn),
+        upper_hex(&lun)
+    ))
+}
+
+pub(super) fn fibre_channel_ex(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (wwn, lun) = (p.byte_array()?, p.byte_array()?);
+    Ok([&0_u32.to_le_bytes()[..], &wwn, &lun].concat())
+}
+
+/// I1394(GUID): the 1394 GUID is a UINT64, which edk2 writes as 16 hexadecimal digits, as a GUID
+/// of Table 10.66 could not hold it.
+pub(super) fn f1394_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let _reserved = fields.u32()?;
+    Some(format!("I1394({:016X})", fields.u64()?))
+}
+
+/// The 1394 GUID in hexadecimal, after "0x" or not, as edk2's DevPathFromText1394() reads it.
+pub(super) fn f1394(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let text = p.next();
+    let digits = text
+        .strip_prefix("0x")
+        .or_else(|| text.strip_prefix("0X"))
+        .unwrap_or(text);
+    let guid = match !digits.is_empty() && digits.bytes().all(|digit| digit.is_ascii_hexdigit()) {
+        true => u64::from_str_radix(digits, 16).ok(),
+        false => None,
+    }
+    .ok_or_else(|| DevicePathTextError::Value(text.to_owned()))?;
+    Ok([&0_u32.to_le_bytes()[..], &guid.to_le_bytes()].concat())
+}
+
+pub(super) fn i2o_text(data: &[u8]) -> Option<String> {
+    Some(format!("I2O(0x{:X})", Fields(data).u32()?))
+}
+
+pub(super) fn i2o(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(p.integer::<u32>()?.to_le_bytes().to_vec())
+}
+
+pub(super) fn logical_unit_text(data: &[u8]) -> Option<String> {
+    Some(format!("Unit(0x{:X})", Fields(data).u8()?))
+}
+
+pub(super) fn logical_unit(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(vec![p.integer()?])
+}
+
+pub(super) fn sata_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (hba, multiplier, lun) = (fields.u16()?, fields.u16()?, fields.u16()?);
+    Some(format!("Sata(0x{hba:X},0x{multiplier:X},0x{lun:X})"))
+}
+
+/// Sata(HPN,PMPN,LUN), PMPN 0xFFFF, no port multiplier, if omitted.
+pub(super) fn sata(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let hba: u16 = p.integer()?;
+    let multiplier: u16 = p.integer_or(0xFFFF)?;
+    let lun: u16 = p.integer()?;
+    Ok([hba, multiplier, lun].map(u16::to_le_bytes).concat())
+}
+
+/// SasEx(Address,LUN,RTP,SASSATA,Location,Connect,DriveBay): 8-byte arrays, byte 0 first, then
+/// the relative target port and the topology.
+pub(super) fn sas_ex_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (address, lun) = (fields.take::<8>()?, fields.take::<8>()?);
+    let (topology, port) = (fields.u16()?, fields.u16()?);
+    Some(format!(
+        "SasEx(0x{},0x{},0x{port:X},{})",
+        upper_hex(&address),
+        upper_hex(&lun),
+        topology_text(topology)
+    ))
+}
+
+/// SasEx(…), LUN, RTP and the topology 0 if omitted.
+pub(super) fn sas_ex(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let address = p.byte_array()?;
+    let lun = p.integer_or(0_u64)?.to_be_bytes();
+    let port: u16 = p.integer_or(0)?;
+    let topology = topology(p)?;
+    Ok([
+        &address[..],
+        &lun,
+        &topology.to_le_bytes(),
+        &port.to_le_bytes(),
+    ]
+    .concat())
+}
+
+/// SAS(Address,LUN,RTP,SASSATA,Location,Connect,DriveBay,Reserved), of the data that follows the
+/// GUID of a SAS node: Reserved, the address, the LUN, the topology, the relative target port.
+pub(super) fn sas_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let reserved = fields.u32()?;
+    let (address, lun) = (fields.u64()?, fields.u64()?);
+    let (topology, port) = (fields.u16()?, fields.u16()?);
+    Some(format!(
+        "SAS(0x{address:X},0x{lun:X},0x{port:X},{},0x{reserved:X})",
+        topology_text(topology)
+    ))
+}
+
+/// The data after the GUID of SAS(…): LUN, RTP, the topology and Reserved 0 if omitted.
+pub(super) fn sas(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let address: u64 = p.integer()?;
+    let lun: u64 = p.integer_or(0)?;
+    let port: u16 = p.integer_or(0)?;
+    let topology = topology(p)?;
+    let reserved: u32 = p.integer_or(0)?;
+    let data = [
+        &reserved.to_le_bytes()[..],
+        &address.to_le_bytes(),
+        &lun.to_le_bytes(),
+        &topology.to_le_bytes(),
+        &port.to_le_bytes(),
+    ];
+    Ok(data.concat())
+}
+
+/// SASSATA,Location,Connect,DriveBay as edk2's DevPathToTextSasEx() writes them.
+fn topology_text(topology: u16) -> String {
+    let kind = topology & TOPOLOGY_KIND;
+    match (kind, topology & TOPOLOGY_INTEGER) {
+        (0, 0) => "NoTopology,0,0,0".to_owned(),
+        (1 | 2, 0) => {
+            let pick = |bit, set, clear| if topology & bit != 0 { set } else { clear };
+            let drive_bay = match kind {
+                1 => "0".to_owned(),
+                _ => format!("0x{:X}", (topology >> 8) + 1),
+            };
+            format!(
+                "{},{},{},{drive_bay}",
+                pick(TOPOLOGY_SATA, "SATA", "SAS"),
+                pick(TOPOLOGY_EXTERNAL, "External", "Internal"),
+                pick(TOPOLOGY_EXPANDED, "Expanded", "Direct")
+            )
+        }
+        _ => format!("0x{topology:X},0,0,0"),
+    }
+}
+
+/// SAS Device and Topology Info from SASSATA,Location,Connect,DriveBay: NoTopology if omitted.
+/// NoTopology and an integer take no Location, Connect or DriveBay, "0" too as edk2 writes them;
+/// SAS and SATA take a DriveBay of 0, none, as edk2 writes it, or 1 to 256.
+fn topology(p: &mut Parameters<'_>) -> Result<u16, DevicePathTextError> {
+    let kind = p.next();
+    let (location, connect, drive_bay) = (p.next(), p.next(), p.next());
+    let sata = match kind {
+        "NoTopology" | "" => return none_set([location, connect, drive_bay]).map(|()| 0),
+        "SAS" => 0,
+        "SATA" => TOPOLOGY_SATA,
+        integer_text => {
+            let topology = integer(integer_text)?;
+            return none_set([location, connect, drive_bay]).map(|()| topology);
+        }
+    };
+    let location = bounded(location, &LOCATIONS, 1)?;
+    let connect = bounded(connect, &CONNECTIONS, MAX_CONNECT)?;
+    let bay = match drive_bay {
+        "" => 0,
+        text => integer::<u16>(text)?,
+    };
+    let kind = match bay {
+        0 => 1,
+        1..=MAX_DRIVE_BAY => 2 | (bay - 1) << 8,
+        _ => return Err(DevicePathTextError::Value(drive_bay.to_owned())),
+    };
+    Ok(kind | sata | location << 5 | connect << 6)
+}
+
+/// A keyword of `keywords` or an Integer up to `max`, 0 if omitted.
+fn bounded(text: &str, keywords: &[(&str, u16)], max: u16) -> Result<u16, DevicePathTextError> {
+    let value = match text {
+        "" => 0,
+        text => keyword(text, keywords).or_else(|_| integer(text))?,
+    };
+    match value <= max {
+        true => Ok(value),
+        false => Err(DevicePathTextError::Value(text.to_owned())),
+    }
+}
+
+/// Fails unless each of `texts` is omitted or 0.
+fn none_set(texts: [&str; 3]) -> Result<(), DevicePathTextError> {
+    match texts
+        .iter()
+        .find(|text| !text.is_empty() && integer::<u64>(text) != Ok(0))
+    {
+        Some(text) => Err(DevicePathTextError::SasTopology((*text).to_owned())),
+        None => Ok(()),
+    }
+}
+
+/// iSCSI(TargetName,PortalGroup,LUN,HeaderDigest,DataDigest,Authentication,Protocol), of a
+/// Target Name ended by Null, as edk2 writes it.
+pub(super) fn iscsi_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (protocol, options) = (fields.u16()?, fields.u16()?);
+    let (lun, tag) = (fields.take::<8>()?, fields.u16()?);
+    let name = ascii_text(fields.0.strip_suffix(&[0])?)?;
+    let pick = |bit, set, clear| if options & bit != 0 { set } else { clear };
+    let authentication = match (options & AUTH_NONE, options & AUTH_CHAP_UNI) {
+        (AUTH_NONE, _) => "None",
+        (_, AUTH_CHAP_UNI) => "CHAP_UNI",
+        _ => "CHAP_BI",
+    };
+    let protocol = if protocol == 0 { "TCP" } else { "reserved" };
+    Some(format!(
+        "iSCSI({name},0x{tag:X},0x{},{},{},{authentication},{protocol})",
+        upper_hex(&lun),
+        pick(0x0002, "CRC32C", "None"),
+        pick(0x0008, "CRC32C", "None")
+    ))
+}
+
+/// iSCSI(…): the digests None, the Authentication None and the Protocol TCP if omitted, as Table
+/// 10.67 gives them, where edk2 reads an omitted Authentication as CHAP_BI.
+pub(super) fn iscsi(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let name = p.ascii_up_to(MAX_TARGET_NAME)?;
+    let tag: u16 = p.integer()?;
+    let lun = p.byte_array()?;
+    let header_digest = p.keyword_or(&HEADER_DIGESTS, 0)?;
+    let data_digest = p.keyword_or(&DATA_DIGESTS, 0)?;
+    let authentication = p.keyword_or(&AUTHENTICATIONS, AUTH_NONE)?;
+    let protocol = p.keyword_or(&NETWORK_PROTOCOLS, 0)?;
+    let options = header_digest | data_digest | authentication;
+    let data = [
+        &protocol.to_le_bytes()[..],
+        &options.to_le_bytes(),
+        &lun,
+        &tag.to_le_bytes(),
+        name.as_bytes(),
+        &[0],
+    ];
+    Ok(data.concat())
+}
+
+/// NVMe(NSID,EUI): the EUI-64 as edk2 writes it, its octets from the last, separated by "-".
+pub(super) fn nvme_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let namespace = fields.u32()?;
+    let eui: Vec<String> = fields
+        .take::<8>()?
+        .iter()
+        .rev()
+        .map(|byte| format!("{byte:02X}"))
+        .collect();
+    Some(format!("NVMe(0x{namespace:X},{})", eui.join("-")))
+}
+
+pub(super) fn nvme(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let namespace: u32 = p.integer()?;
+    let text = p.next();
+    let octet = |octet: &str| match (1..=2).contains(&octet.len())
+        && octet.bytes().all(|digit| digit.is_ascii_hexdigit())
+    {
+        true => u8::from_str_radix(octet, 16).ok(),
+        false => None,
+    };
+    let mut eui = text
+        .split('-')
+        .map(octet)
+        .collect::<Option<Vec<u8>>>()
+        .filter(|eui| eui.len() == 8)
+        .ok_or_else(|| DevicePathTextError::Value(text.to_owned()))?;
+    eui.reverse();
+    Ok([&namespace.to_le_bytes()[..], &eui].concat())
+}
+
+pub(super) fn ufs_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (pun, lun) = (fields.u8()?, fields.u8()?);
+    Some(format!("UFS(0x{pun:X},0x{lun:X})"))
+}
+
+pub(super) fn ufs(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(vec![p.integer()?, p.integer()?])
+}
+
+/// SD(SlotNumber) or eMMC(SlotNumber).
+pub(super) fn slot_text(name: &str, data: &[u8]) -> Option<String> {
+    Some(format!("{name}(0x{:X})", Fields(data).u8()?))
+}
+
+/// SD(SlotNumber) or eMMC(SlotNumber), slot 0 if omitted.
+pub(super) fn slot(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(vec![p.integer_or(0)?])
+}
+
+/// NVDIMM(UUID), as Table 10.67 gives it: edk2 has no form for it. The UUID is an EFI_GUID, as
+/// edk2-stable202608 NvdimmLabel.h types the label's Uuid.
+pub(super) fn nvdimm_text(data: &[u8]) -> Option<String> {
+    Some(format!("NVDIMM({})", Fields(data).guid()?))
+}
+
+pub(super) fn nvdimm(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(p.guid()?.to_vec())
+}
+
+/// NVMEoF(SubsystemNQN,NID), as Table 10.67 gives it: edk2 has no form for it. Table 10.67 gives
+/// the NID no text but the RFC 4122 URN of a namespace UUID, NIDT 3h, in its example (UEFI 2.11
+/// §10.3.4.33); a node of another NIDT has no named form.
+pub(super) fn nvme_of_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (nidt, nid) = (fields.u8()?, fields.take::<16>()?);
+    let nqn = std::str::from_utf8(fields.0.strip_suffix(&[0])?).ok()?;
+    (nidt == NIDT_UUID).then(|| format!("NVMEoF({nqn},{UUID_URN_PREFIX}{})", uuid_text(nid)))
+}
+
+/// NVMEoF(SubsystemNQN,NID): the NQN, of UTF-8, ended by Null, and the NID, the URN of a
+/// namespace UUID, whose octets the NID holds in order, big-endian.
+pub(super) fn nvme_of(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let nqn = p.next();
+    if nqn.contains('\0') || nqn.is_empty() {
+        return Err(DevicePathTextError::Value(nqn.to_owned()));
+    }
+    if nqn.len() > MAX_SUBSYSTEM_NQN {
+        return Err(DevicePathTextError::TooLongString(
+            nqn.to_owned(),
+            MAX_SUBSYSTEM_NQN,
+        ));
+    }
+    let text = p.next();
+    let uuid = text
+        .get(..UUID_URN_PREFIX.len())
+        .filter(|prefix| prefix.eq_ignore_ascii_case(UUID_URN_PREFIX))
+        .and_then(|_| text.get(UUID_URN_PREFIX.len()..))
+        .and_then(|uuid| uuid.parse::<Guid>().ok())
+        .ok_or_else(|| DevicePathTextError::Value(text.to_owned()))?;
+    let nid = [
+        &uuid.data1.to_be_bytes()[..],
+        &uuid.data2.to_be_bytes(),
+        &uuid.data3.to_be_bytes(),
+        &uuid.data4,
+    ];
+    Ok([&[NIDT_UUID][..], &nid.concat(), nqn.as_bytes(), &[0]].concat())
+}
+
+/// A UUID's octets in order as RFC 4122 writes them: lowercase, 8-4-4-4-12.
+fn uuid_text(octets: [u8; 16]) -> String {
+    let hex: String = octets.iter().map(|octet| format!("{octet:02x}")).collect();
+    let pieces =
+        [0..8, 8..12, 12..16, 16..20, 20..32].map(|range| hex.get(range).unwrap_or_default());
+    pieces.join("-")
+}
diff --git a/src/lib/efi_variables/device_path/usb.rs b/src/lib/efi_variables/device_path/usb.rs
new file mode 100644
index 0000000..9bf8d8a
--- /dev/null
+++ b/src/lib/efi_variables/device_path/usb.rs
@@ -0,0 +1,162 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The USB nodes (UEFI 2.11 §10.3.4.5, §10.3.4.7) of named forms in Table 10.67: USB, USB Class
+//! with the shortcuts of the classes it names, and USB WWID.
+
+use super::parameters::Parameters;
+use super::DevicePathTextError;
+use super::Fields;
+
+/// The Sub-Types of UEFI 2.11 §10.3.4
+pub(super) const USB: u8 = 0x05;
+pub(super) const USB_CLASS: u8 = 0x0F;
+pub(super) const USB_WWID: u8 = 0x10;
+
+/// The USB classes that UEFI 2.11 Table 10.67 names a form of, by their class code
+pub(super) const CLASS_NAMES: [(u8, &str); 12] = [
+    (1, "UsbAudio"),
+    (2, "UsbCDCControl"),
+    (3, "UsbHID"),
+    (6, "UsbImage"),
+    (7, "UsbPrinter"),
+    (8, "UsbMassStorage"),
+    (9, "UsbHub"),
+    (10, "UsbCDCData"),
+    (11, "UsbSmartCard"),
+    (14, "UsbVideo"),
+    (220, "UsbDiagnostic"),
+    (224, "UsbWireless"),
+];
+/// The class of the application-specific subclasses that UEFI 2.11 Table 10.67 names a form of,
+/// by their subclass code
+const APPLICATION_SPECIFIC: u8 = 254;
+pub(super) const SUBCLASS_NAMES: [(u8, &str); 3] = [
+    (1, "UsbDeviceFirmwareUpdate"),
+    (2, "UsbIrdaBridge"),
+    (3, "UsbTestAndMeasurement"),
+];
+/// What an omitted VID, PID, class, subclass or protocol of a USB Class form reads as: any
+const ANY_ID: u16 = 0xFFFF;
+const ANY_CODE: u8 = 0xFF;
+
+/// USB(Port,Interface).
+pub(super) fn usb_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (port, interface) = (fields.u8()?, fields.u8()?);
+    Some(format!("USB(0x{port:X},0x{interface:X})"))
+}
+
+pub(super) fn usb(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok(vec![p.integer()?, p.integer()?])
+}
+
+/// The form of the node's class or subclass that UEFI 2.11 Table 10.67 names, as edk2's
+/// DevPathToTextUsbClass() picks it, else UsbClass(VID,PID,Class,SubClass,Protocol).
+pub(super) fn class_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (vendor, product) = (fields.u16()?, fields.u16()?);
+    let (class, subclass, protocol) = (fields.u8()?, fields.u8()?, fields.u8()?);
+    let class_name = CLASS_NAMES.iter().find(|(code, _)| *code == class);
+    let subclass_name = SUBCLASS_NAMES
+        .iter()
+        .find(|(code, _)| class == APPLICATION_SPECIFIC && *code == subclass);
+    Some(match (class_name, subclass_name) {
+        (Some((_, name)), _) => {
+            format!("{name}(0x{vendor:X},0x{product:X},0x{subclass:X},0x{protocol:X})")
+        }
+        (None, Some((_, name))) => format!("{name}(0x{vendor:X},0x{product:X},0x{protocol:X})"),
+        (None, None) => format!(
+            "UsbClass(0x{vendor:X},0x{product:X},0x{class:X},0x{subclass:X},0x{protocol:X})"
+        ),
+    })
+}
+
+/// UsbClass(VID,PID,Class,SubClass,Protocol), each any if omitted.
+pub(super) fn class(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (vendor, product) = (p.integer_or(ANY_ID)?, p.integer_or(ANY_ID)?);
+    let class = p.integer_or(ANY_CODE)?;
+    let (subclass, protocol) = (p.integer_or(ANY_CODE)?, p.integer_or(ANY_CODE)?);
+    Ok(class_data(vendor, product, [class, subclass, protocol]))
+}
+
+/// The form of CLASS_NAMES of `class`: `Usb<Class>(VID,PID,SubClass,Protocol)`, each any if
+/// omitted.
+pub(super) fn named_class(
+    p: &mut Parameters<'_>,
+    class: u8,
+) -> Result<Vec<u8>, DevicePathTextError> {
+    let (vendor, product) = (p.integer_or(ANY_ID)?, p.integer_or(ANY_ID)?);
+    let (subclass, protocol) = (p.integer_or(ANY_CODE)?, p.integer_or(ANY_CODE)?);
+    Ok(class_data(vendor, product, [class, subclass, protocol]))
+}
+
+/// The form of SUBCLASS_NAMES of `subclass`: `Usb<Subclass>(VID,PID,Protocol)`, each any if
+/// omitted.
+pub(super) fn named_subclass(
+    p: &mut Parameters<'_>,
+    subclass: u8,
+) -> Result<Vec<u8>, DevicePathTextError> {
+    let (vendor, product) = (p.integer_or(ANY_ID)?, p.integer_or(ANY_ID)?);
+    let protocol = p.integer_or(ANY_CODE)?;
+    Ok(class_data(
+        vendor,
+        product,
+        [APPLICATION_SPECIFIC, subclass, protocol],
+    ))
+}
+
+fn class_data(vendor: u16, product: u16, codes: [u8; 3]) -> Vec<u8> {
+    [&vendor.to_le_bytes()[..], &product.to_le_bytes(), &codes].concat()
+}
+
+/// UsbWwid(VID,PID,InterfaceNumber,"WWID"), of InterfaceNumber, VID and PID, then the serial
+/// number, CHAR16s without Null, as edk2 writes and reads them.
+pub(super) fn wwid_text(data: &[u8]) -> Option<String> {
+    let mut fields = Fields(data);
+    let (interface, vendor, product) = (fields.u16()?, fields.u16()?, fields.u16()?);
+    let (units, []) = fields.0.as_chunks::<2>() else {
+        return None;
+    };
+    let units: Vec<u16> = units.iter().map(|unit| u16::from_le_bytes(*unit)).collect();
+    let serial = String::from_utf16(&units)
+        .ok()
+        .filter(|serial| !serial.contains('\0'))?;
+    Some(format!(
+        "UsbWwid(0x{vendor:X},0x{product:X},0x{interface:X},\"{serial}\")"
+    ))
+}
+
+/// UsbWwid(VID,PID,InterfaceNumber,"WWID"): the WWID without its quotes, if quoted, as edk2's
+/// DevPathFromTextUsbWwid() takes it, of UCS-2 but Null.
+pub(super) fn wwid(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    let (vendor, product, interface): (u16, u16, u16) = (p.integer()?, p.integer()?, p.integer()?);
+    let text = p.next();
+    let serial = match text
+        .strip_prefix('"')
+        .and_then(|text| text.strip_suffix('"'))
+    {
+        Some(quoted) => quoted,
+        None if !text.is_empty() => text,
+        None => return Err(DevicePathTextError::Value(text.to_owned())),
+    };
+    if serial.chars().any(|c| c == '\0' || c.len_utf16() != 1) {
+        return Err(DevicePathTextError::NotUcs2(serial.to_owned()));
+    }
+    let serial: Vec<u8> = serial.encode_utf16().flat_map(u16::to_le_bytes).collect();
+    Ok([interface, vendor, product]
+        .map(u16::to_le_bytes)
+        .concat()
+        .into_iter()
+        .chain(serial)
+        .collect())
+}
diff --git a/src/lib/efi_variables/device_path/vendor.rs b/src/lib/efi_variables/device_path/vendor.rs
new file mode 100644
index 0000000..f1498be
--- /dev/null
+++ b/src/lib/efi_variables/device_path/vendor.rs
@@ -0,0 +1,132 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The Vendor nodes of the Hardware, Messaging and Media Types (UEFI 2.11 §10.3.2.4, §10.3.4.16,
+//! §10.3.5.3), and the Messaging Vendor nodes that UEFI 2.11 Table 10.67 names by their GUID.
+
+use super::guid;
+use super::parameters::upper_hex;
+use super::parameters::Parameters;
+use super::serial;
+use super::storage;
+use super::DevicePathTextError;
+use crate::hii::package::Guid;
+
+/// The Sub-Type of a Messaging Vendor node (UEFI 2.11 §10.3.4.16)
+pub(super) const MESSAGING_VENDOR: u8 = 0x0A;
+/// DEVICE_PATH_MESSAGING_UART_FLOW_CONTROL (UEFI 2.11 §10.3.4.17)
+const UART_FLOW_CONTROL: Guid = guid(
+    0x37499A9D,
+    0x542F,
+    0x4C89,
+    [0xA0, 0x26, 0x35, 0xDA, 0x14, 0x20, 0x94, 0xE4],
+);
+/// The Vendor GUID of the Serial Attached SCSI (SAS) Device Path (UEFI 2.11 §10.3.4.18, Table 10.35),
+/// edk2-stable202608 DEVICE_PATH_MESSAGING_SAS (MdePkg/Include/Protocol/DevicePath.h:773)
+const SAS: Guid = guid(
+    0xD487DDB4,
+    0x008B,
+    0x11D9,
+    [0xAF, 0xDC, 0x00, 0x10, 0x83, 0xFF, 0xCA, 0x4D],
+);
+/// The Messaging Vendor nodes without data that UEFI 2.11 Table 10.67 names, by their GUID
+pub(super) const NAMES: [(Guid, &str); 5] = [
+    (
+        guid(
+            0xE0C14753,
+            0xF9BE,
+            0x11D2,
+            [0x9A, 0x0C, 0x00, 0x90, 0x27, 0x3F, 0xC1, 0x4D],
+        ),
+        "VenPcAnsi",
+    ),
+    (
+        guid(
+            0xDFA66065,
+            0xB419,
+            0x11D3,
+            [0x9A, 0x2D, 0x00, 0x90, 0x27, 0x3F, 0xC1, 0x4D],
+        ),
+        "VenVt100",
+    ),
+    (
+        guid(
+            0x7BAEC70B,
+            0x57E0,
+            0x4C76,
+            [0x8E, 0x87, 0x2F, 0x9E, 0x28, 0x08, 0x83, 0x43],
+        ),
+        "VenVt100Plus",
+    ),
+    (
+        guid(
+            0xAD15A0D6,
+            0x8BEC,
+            0x4ACF,
+            [0xA0, 0x73, 0xD0, 0x1D, 0xE7, 0x7E, 0x2D, 0x88],
+        ),
+        "VenUtf8",
+    ),
+    // EFI_DEBUGPORT_PROTOCOL_GUID, edk2-stable202608 MdePkg.dec gEfiDebugPortProtocolGuid
+    (
+        guid(
+            0xEBA4E8D2,
+            0x3858,
+            0x41EC,
+            [0xA2, 0x81, 0x26, 0x47, 0xBA, 0x96, 0x60, 0xD0],
+        ),
+        "DebugPort",
+    ),
+];
+
+/// VenHw, VenMsg or VenMedia: the GUID, then any data as a Hex Dump.
+pub(super) fn text(kind: &str, data: &[u8]) -> Option<String> {
+    let (guid, rest) = data.split_first_chunk::<16>()?;
+    let guid = Guid::from(*guid);
+    Some(match rest.is_empty() {
+        true => format!("Ven{kind}({guid})"),
+        false => format!("Ven{kind}({guid},{})", upper_hex(rest)),
+    })
+}
+
+/// A Vendor node's data: its GUID, then a Hex Dump, none if omitted.
+pub(super) fn vendor(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok([&p.guid()?[..], &p.hex()?].concat())
+}
+
+/// The form that edk2 writes a Messaging Vendor node in: the name of its GUID, whatever the data,
+/// UartFlowCtrl or SAS for theirs, else VenMsg.
+pub(super) fn messaging_text(data: &[u8]) -> Option<String> {
+    let (guid, rest) = data.split_first_chunk::<16>()?;
+    let guid = Guid::from(*guid);
+    match NAMES.iter().find(|(named, _)| *named == guid) {
+        Some((_, name)) => Some(format!("{name}()")),
+        None if guid == UART_FLOW_CONTROL => serial::flow_control_text(rest),
+        None if guid == SAS => storage::sas_text(rest),
+        None => text("Msg", data),
+    }
+}
+
+/// UartFlowCtrl(Value): the node of DEVICE_PATH_MESSAGING_UART_FLOW_CONTROL.
+pub(super) fn flow_control(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok([
+        &<[u8; 16]>::from(UART_FLOW_CONTROL)[..],
+        &serial::flow_control(p)?,
+    ]
+    .concat())
+}
+
+/// SAS(Address,LUN,RTP,SASSATA,Location,Connect,DriveBay,Reserved): the node of
+/// DEVICE_PATH_MESSAGING_SAS.
+pub(super) fn sas(p: &mut Parameters<'_>) -> Result<Vec<u8>, DevicePathTextError> {
+    Ok([&<[u8; 16]>::from(SAS)[..], &storage::sas(p)?].concat())
+}
diff --git a/src/lib/efi_variables/enhanced_authenticated.rs b/src/lib/efi_variables/enhanced_authenticated.rs
index e327072..94e72b9 100644
--- a/src/lib/efi_variables/enhanced_authenticated.rs
+++ b/src/lib/efi_variables/enhanced_authenticated.rs
@@ -30,6 +30,12 @@
 #[cfg(variable_data)]
 use std::str::FromStr;
 
+#[cfg(variable_info)]
+use serde::ser::SerializeMap;
+#[cfg(variable_info)]
+use serde::Serialize;
+#[cfg(variable_info)]
+use serde::Serializer;
 use thiserror::Error;
 
 #[cfg(variable_data)]
@@ -43,6 +49,10 @@ use super::authenticated::WIN_CERT_REVISION;
 #[cfg(variable_data)]
 use super::authenticated::WIN_CERT_TYPE_EFI_GUID;
 use super::is_gmt_time_stamp;
+#[cfg(variable_info)]
+use super::json_bytes::Hex;
+#[cfg(variable_info)]
+use super::GmtTime;
 use super::EFI_TIME_SIZE;
 #[cfg(variable_data)]
 use crate::hex_digits::hex_bytes;
@@ -72,6 +82,8 @@ const NONCE_HEADER_SIZE: usize = UINT32_SIZE;
 /// is aligned to its UINT32 IdSize, and a WIN_CERTIFICATE_UEFI_GUID on SetVariable() to the UINT32
 /// dwLength of its Hdr and the UINT32 Data1 of its CertType.
 const CERTIFICATE_ALIGNMENT: usize = UINT32_SIZE;
+/// The Flags of the metadata that GetVariable() returns: none, as all are reserved there.
+const GET_VARIABLE_FLAGS: u32 = 0;
 /// EFI_VARIABLE_ENHANCED_AUTH_FLAG_UPDATE_CERT, "the only defined value" of Flags on SetVariable()
 /// (UEFI 2.11 §8.2.3): a NewCert precedes the SigningCert.
 #[cfg(variable_data)]
@@ -87,7 +99,7 @@ const CERT_ID_SHA256: u8 = 1;
 const SHA256_DIGEST_SIZE: usize = 32;
 
 /// Why the EFI_VARIABLE_AUTHENTICATION_3 metadata of a variable is refused.
-#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Error)]
 pub(crate) enum MetadataRefusal {
     #[error(
         "it also has EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS, which SetVariable() \
@@ -145,16 +157,62 @@ pub(crate) fn has_metadata(attributes: u32) -> Result<bool, MetadataRefusal> {
 /// after its metadata (has_metadata), else at 0.
 pub(crate) fn metadata_end(attributes: u32, data: &[u8]) -> Result<usize, MetadataRefusal> {
     match has_metadata(attributes)? {
-        true => authentication_3_metadata_size(data),
+        true => authentication_3_metadata(data).map(|metadata| metadata.size),
         false => Ok(0),
     }
 }
 
-/// The size of the metadata that starts `data`, checked strictly: Version 1, Flags 0, a
+/// The EFI_VARIABLE_AUTHENTICATION_3 metadata of a variable, as GetVariable() returns it before
+/// the value (UEFI 2.11 §8.2.1), which authentication_3_metadata takes only of Version 1 and
+/// Flags 0.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub(crate) struct Metadata {
+    /// Its size: where the value starts, and its MetadataSize
+    pub(crate) size: usize,
+    /// Its Secondary Descriptor, of its Type
+    #[cfg_attr(
+        not(any(variable_data, variable_info)),
+        allow(
+            dead_code,
+            reason = "only the signed writes and variable info of builds with VariableData and \
+                      VariableInfo read it"
+        )
+    )]
+    pub(crate) freshness: StoredFreshness,
+    /// The Id of its EFI_VARIABLE_AUTHENTICATION_3_CERT_ID, of CERT_ID_SHA256
+    #[cfg_attr(
+        not(variable_info),
+        allow(
+            dead_code,
+            reason = "only variable info of builds with VariableInfo reads it"
+        )
+    )]
+    pub(crate) cert_id: [u8; SHA256_DIGEST_SIZE],
+}
+
+/// The Secondary Descriptor in the metadata of a variable (UEFI 2.11 §8.2.1), against which the
+/// firmware checks the next write (§8.2.5).
+#[cfg_attr(
+    not(any(variable_data, variable_info)),
+    allow(
+        dead_code,
+        reason = "only the signed writes and variable info of builds with VariableData and \
+                  VariableInfo read it"
+    )
+)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub(crate) enum StoredFreshness {
+    /// EFI_VARIABLE_AUTHENTICATION_3_TIMESTAMP_TYPE: the variable's EFI_TIME, in GMT
+    TimeStamp([u8; EFI_TIME_SIZE]),
+    /// EFI_VARIABLE_AUTHENTICATION_3_NONCE_TYPE: the variable's current nonce, of 1 byte or more
+    Nonce(Vec<u8>),
+}
+
+/// The metadata that starts `data`, checked strictly: Version 1, Flags 0, a
 /// TimeStamp in GMT or a NonceSize other than 0, CERT_ID_SHA256 with IdSize 32, and a
 /// MetadataSize where these descriptors end, as GetVariable() returns no
 /// WIN_CERTIFICATE_UEFI_GUID (UEFI 2.11 §8.2.1).
-fn authentication_3_metadata_size(data: &[u8]) -> Result<usize, MetadataRefusal> {
+pub(crate) fn authentication_3_metadata(data: &[u8]) -> Result<Metadata, MetadataRefusal> {
     match byte(data, 0)? {
         AUTHENTICATION_3_VERSION => {}
         version => return Err(MetadataRefusal::Version(version)),
@@ -162,10 +220,10 @@ fn authentication_3_metadata_size(data: &[u8]) -> Result<usize, MetadataRefusal>
     let type_ = byte(data, 1)?;
     let declared = le_u32(data, METADATA_SIZE_OFFSET)?;
     match le_u32(data, FLAGS_OFFSET)? {
-        0 => {}
+        GET_VARIABLE_FLAGS => {}
         flags => return Err(MetadataRefusal::Flags(flags)),
     }
-    let cert_id = match type_ {
+    let (cert_id, freshness) = match type_ {
         AUTHENTICATION_3_TIMESTAMP_TYPE => {
             let time_stamp = data
                 .get(AUTHENTICATION_3_SIZE..)
@@ -174,7 +232,10 @@ fn authentication_3_metadata_size(data: &[u8]) -> Result<usize, MetadataRefusal>
             if !is_gmt_time_stamp(time_stamp) {
                 return Err(MetadataRefusal::TimeStamp);
             }
-            AUTHENTICATION_3_SIZE + EFI_TIME_SIZE
+            (
+                AUTHENTICATION_3_SIZE + EFI_TIME_SIZE,
+                StoredFreshness::TimeStamp(*time_stamp),
+            )
         }
         AUTHENTICATION_3_NONCE_TYPE => {
             let nonce_size = match le_u32(data, AUTHENTICATION_3_SIZE)? {
@@ -194,7 +255,10 @@ fn authentication_3_metadata_size(data: &[u8]) -> Result<usize, MetadataRefusal>
             if padding.iter().any(|&byte| byte != 0) {
                 return Err(MetadataRefusal::NoncePadding);
             }
-            cert_id
+            let nonce = data
+                .get(AUTHENTICATION_3_SIZE + NONCE_HEADER_SIZE..nonce_end)
+                .ok_or(MetadataRefusal::truncated(data))?;
+            (cert_id, StoredFreshness::Nonce(nonce.to_vec()))
         }
         type_ => return Err(MetadataRefusal::Type(type_)),
     };
@@ -215,10 +279,91 @@ fn authentication_3_metadata_size(data: &[u8]) -> Result<usize, MetadataRefusal>
     if usize::try_from(declared) != Ok(computed) {
         return Err(MetadataRefusal::MetadataSize { declared, computed });
     }
-    if data.len() < computed {
-        return Err(MetadataRefusal::truncated(data));
+    let id = data
+        .get(cert_id + CERT_ID_HEADER_SIZE..)
+        .and_then(<[u8]>::first_chunk::<SHA256_DIGEST_SIZE>)
+        .ok_or(MetadataRefusal::truncated(data))?;
+    Ok(Metadata {
+        size: computed,
+        freshness,
+        cert_id: *id,
+    })
+}
+
+/// The EFI_VARIABLE_AUTHENTICATION_3 metadata of a variable with
+/// EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS as `variable info` shows it (UEFI 2.11 §8.2.1): its
+/// headers, decoded, or why uefisettings does not take them, never their bytes.
+#[cfg(variable_info)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct MetadataInfo(Result<Metadata, MetadataRefusal>);
+
+#[cfg(variable_info)]
+impl MetadataInfo {
+    /// The metadata that starts `data`, the GetVariable() data of a variable with `attributes`,
+    /// if it has metadata or claims to (has_metadata).
+    pub(crate) fn of(attributes: u32, data: &[u8]) -> Option<Self> {
+        match has_metadata(attributes) {
+            Ok(true) => Some(Self(authentication_3_metadata(data))),
+            Ok(false) => None,
+            Err(refusal) => Some(Self(Err(refusal))),
+        }
+    }
+}
+
+/// As {"version", "type", "metadata_size", "flags", then "time_stamp", YYYY-MM-DDTHH:MM:SSZ, or
+/// "nonce", {"hex"}, as its Type says, then "cert_id": {"type", "id": {"hex"}}}, the fields of
+/// UEFI 2.11 §8.2.1, or as {"refused": why}.
+#[cfg(variable_info)]
+impl Serialize for MetadataInfo {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let metadata = match &self.0 {
+            Ok(metadata) => metadata,
+            Err(refusal) => {
+                let mut map = serializer.serialize_map(Some(1))?;
+                map.serialize_entry("refused", &refusal.to_string())?;
+                return map.end();
+            }
+        };
+        let mut map = serializer.serialize_map(Some(6))?;
+        map.serialize_entry("version", &AUTHENTICATION_3_VERSION)?;
+        map.serialize_entry("type", &metadata.freshness.type_code())?;
+        map.serialize_entry("metadata_size", &metadata.size)?;
+        map.serialize_entry("flags", &GET_VARIABLE_FLAGS)?;
+        match &metadata.freshness {
+            StoredFreshness::TimeStamp(time) => {
+                map.serialize_entry("time_stamp", &GmtTime(time).to_string())?
+            }
+            StoredFreshness::Nonce(nonce) => map.serialize_entry("nonce", &Hex(nonce))?,
+        }
+        map.serialize_entry(
+            "cert_id",
+            &CertIdInfo {
+                type_: CERT_ID_SHA256,
+                id: Hex(&metadata.cert_id),
+            },
+        )?;
+        map.end()
+    }
+}
+
+/// An EFI_VARIABLE_AUTHENTICATION_3_CERT_ID as MetadataInfo shows it: its Type and Id.
+#[cfg(variable_info)]
+#[derive(Serialize)]
+struct CertIdInfo<'a> {
+    #[serde(rename = "type")]
+    type_: u8,
+    id: Hex<'a>,
+}
+
+#[cfg(variable_info)]
+impl StoredFreshness {
+    /// The Type of the metadata: EFI_VARIABLE_AUTHENTICATION_3_TIMESTAMP_TYPE or _NONCE_TYPE.
+    fn type_code(&self) -> u8 {
+        match self {
+            Self::TimeStamp(_) => AUTHENTICATION_3_TIMESTAMP_TYPE,
+            Self::Nonce(_) => AUTHENTICATION_3_NONCE_TYPE,
+        }
     }
-    Ok(computed)
 }
 
 /// The little-endian UINT32 at `at` of `data`.
@@ -621,7 +766,7 @@ pub(crate) mod fixture {
     /// EFI_VARIABLE_AUTHENTICATION_3 of MetadataSize `metadata_size` ‖
     /// EFI_VARIABLE_AUTHENTICATION_3_NONCE with `nonce` ‖ `padding` ‖
     /// EFI_VARIABLE_AUTHENTICATION_3_CERT_ID.
-    #[cfg(efivar_dumps)]
+    #[cfg(any(efivar_dumps, variable_data))]
     pub(crate) fn nonce_metadata_of(nonce: &[u8], padding: &[u8], metadata_size: u32) -> Vec<u8> {
         let nonce_size = u32::try_from(nonce.len()).expect("test nonce fits NonceSize");
         [
@@ -637,7 +782,7 @@ pub(crate) mod fixture {
     }
 
     /// nonce_metadata_of 8 Nonce bytes, which need no padding: 64 bytes.
-    #[cfg(efivar_dumps)]
+    #[cfg(any(efivar_dumps, variable_data))]
     pub(crate) fn nonce_metadata() -> Vec<u8> {
         nonce_metadata_of(&[0xA5; 8], &[], 64)
     }
@@ -671,6 +816,43 @@ mod tests {
     /// authenticated access.
     const NV_BS_RT_ENHANCED: u32 = 0x87;
 
+    /// authentication_3_metadata gives the Secondary Descriptor: the EFI_TIME, or the Nonce
+    /// without its NonceSize and padding, and the Id of the CERT_ID.
+    #[test]
+    #[cfg(any(efivar_dumps, variable_data))]
+    fn authentication_3_metadata_gives_the_secondary_descriptor() {
+        use super::fixture::nonce_metadata_of;
+
+        let cases = [
+            (
+                "timestamp",
+                timestamp_metadata(),
+                68,
+                StoredFreshness::TimeStamp([
+                    0xEA, 0x07, 11, 6, 12, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                ]),
+            ),
+            (
+                "a nonce of 3 bytes and 1 padding byte",
+                nonce_metadata_of(&[7; 3], &[0], 60),
+                60,
+                StoredFreshness::Nonce(vec![7; 3]),
+            ),
+        ];
+        let cert_id = std::array::from_fn(|at| u8::try_from(at).expect("an Id byte"));
+        for (case, data, size, freshness) in cases {
+            assert_eq!(
+                authentication_3_metadata(&data),
+                Ok(Metadata {
+                    size,
+                    freshness,
+                    cert_id
+                }),
+                "{case}"
+            );
+        }
+    }
+
     /// metadata_end takes metadata that ends the data, and refuses data that ends inside it.
     #[test]
     fn metadata_end_takes_metadata_that_ends_the_data() {
diff --git a/src/lib/efi_variables/globals.rs b/src/lib/efi_variables/globals.rs
index fe54fdc..cfded4a 100644
--- a/src/lib/efi_variables/globals.rs
+++ b/src/lib/efi_variables/globals.rs
@@ -27,6 +27,11 @@ use sha2::Digest;
 use sha2::Sha256;
 use thiserror::Error;
 
+use crate::efi_variables::boot_manager;
+use crate::efi_variables::boot_manager::BootManagerVariable;
+use crate::efi_variables::boot_manager::DevicePathText;
+use crate::efi_variables::boot_manager::HotKey;
+use crate::efi_variables::boot_manager::LoadOptionData;
 use crate::efi_variables::enhanced_authenticated::metadata_end;
 use crate::efi_variables::enhanced_authenticated::MetadataRefusal;
 use crate::efi_variables::secure_boot_mode::ModeTransition;
@@ -37,7 +42,7 @@ use crate::hii::VariableAttributes;
 use crate::hii::VariableKey;
 
 /// EFI_GLOBAL_VARIABLE, the vendor GUID of the global variables (UEFI 2.11 §3.3).
-pub(super) const EFI_GLOBAL_VARIABLE: Guid = Guid {
+pub(crate) const EFI_GLOBAL_VARIABLE: Guid = Guid {
     data1: 0x8BE4_DF61,
     data2: 0x93CA,
     data3: 0x11D2,
@@ -74,7 +79,7 @@ const NO_OS_INDICATIONS: &str = "none";
 const BOOT_OPTION_SUPPORT_COUNT: u32 = 0x0000_0300;
 /// NV, BS, RT: the attributes of each variable of UEFI 2.11 Table 3.1 that the OS may write, which
 /// variable set creates a missing one with.
-const WRITABLE_ATTRIBUTES: VariableAttributes = VariableAttributes::NON_VOLATILE
+pub(crate) const WRITABLE_ATTRIBUTES: VariableAttributes = VariableAttributes::NON_VOLATILE
     .union(VariableAttributes::BOOTSERVICE_ACCESS)
     .union(VariableAttributes::RUNTIME_ACCESS);
 /// Why the OS does not write a variable, in the words of UEFI 2.11 §3.3: those of Table 3.1 for
@@ -98,8 +103,9 @@ const DEVICE_SIGNATURE_DATABASE: Quote = Quote {
     section: "32.6.3",
 };
 
-/// The variables that variable get decodes: those of UEFI 2.11 Table 3.1 but the load options,
-/// hot keys and device paths, and the signature databases; and whether variable set writes them.
+/// The variables that variable get decodes here: those of UEFI 2.11 Table 3.1 but the load
+/// options, hot keys and device paths, which boot_manager.rs decodes, and the signature databases;
+/// and whether variable set writes them.
 const GLOBALS: [Global; 34] = [
     Global::mode_transition(ModeTransition::EnterAuditModeClearingPk),
     Global::read_only("BootCurrent", Codec::BootOption, BOOT_CURRENT_READ_ONLY),
@@ -213,6 +219,12 @@ pub enum GlobalValue {
     Guids(Vec<Guid>),
     /// PK, KEK, db, dbx, dbt, dbr and the defaults of the signature databases
     SignatureLists(Vec<SignatureList>),
+    /// Boot####, Driver####, SysPrep####, PlatformRecovery#### and OsRecovery####
+    LoadOptionData(LoadOptionData),
+    /// Key####
+    HotKey(HotKey),
+    /// ConIn, ConOut, ErrOut, ConInDev, ConOutDev and ErrOutDev
+    DevicePath(DevicePathText),
 }
 
 /// What Timeout tells: "the number of seconds that the firmware will wait before initiating the
@@ -262,7 +274,7 @@ pub enum LoadOptionKind {
 
 impl LoadOptionKind {
     /// The name of the variables of this kind before their option number.
-    fn prefix(self) -> &'static str {
+    pub(crate) fn prefix(self) -> &'static str {
         match self {
             Self::Boot => "Boot",
             Self::Driver => "Driver",
@@ -283,14 +295,7 @@ pub struct LoadOptionName {
 impl LoadOptionName {
     /// The load option of `kind` that `text` names as Display writes it, such as Boot0001.
     fn parse(kind: LoadOptionKind, text: &str) -> std::result::Result<Self, SetRefusal> {
-        text.strip_prefix(kind.prefix())
-            .filter(|digits| {
-                digits.len() == 4
-                    && digits
-                        .bytes()
-                        .all(|byte| matches!(byte, b'0'..=b'9' | b'A'..=b'F'))
-            })
-            .and_then(|digits| u16::from_str_radix(digits, 16).ok())
+        boot_manager::option_number(text, kind.prefix())
             .map(|number| Self { kind, number })
             .ok_or_else(|| SetRefusal::OptionName {
                 kind,
@@ -299,7 +304,7 @@ impl LoadOptionName {
     }
 
     /// The variable of this load option.
-    fn key(self) -> VariableKey {
+    pub(crate) fn key(self) -> VariableKey {
         VariableKey {
             name: self.to_string(),
             guid: EFI_GLOBAL_VARIABLE,
@@ -412,6 +417,9 @@ pub(crate) fn read_global(
     name: &str,
     vendor: Option<Guid>,
 ) -> Result<GlobalVariable> {
+    if let Some(variable) = BootManagerVariable::parse(name) {
+        return boot_manager::read(variables, variable, vendor);
+    }
     let global = Global::named(name, vendor)?;
     let key = global.key();
     let contents = variables
@@ -574,9 +582,10 @@ impl Global {
 #[derive(Debug, Clone, PartialEq, Eq, Error)]
 enum NoGlobal {
     #[error(
-        "variable get decodes {}, not {0}; `uefisettings variable info {0} GUID` shows the \
+        "variable get decodes {}, {}, not {0}; `uefisettings variable info {0} GUID` shows the \
          attributes and size of any EFI variable",
-        global_names()
+        global_names(),
+        boot_manager::variable_names()
     )]
     Unknown(String),
     #[error(
@@ -775,6 +784,67 @@ impl Setter {
     }
 }
 
+/// The Boot#### that BootCurrent names, if present.
+#[cfg_attr(
+    not(any(target_os = "linux", target_os = "windows", target_os = "uefi")),
+    allow(
+        dead_code,
+        reason = "only the Linux and Windows builds stage a set for the next boot, and \
+                  uefisettings.efi applies it"
+    )
+)]
+pub(crate) fn boot_current(variables: &impl VariableData) -> Result<Option<LoadOptionName>> {
+    read_decoded(variables, "BootCurrent", boot_option)
+}
+
+/// What BootOptionSupport tells, if present.
+pub(crate) fn boot_option_support(
+    variables: &impl VariableData,
+) -> Result<Option<BootOptionSupport>> {
+    read_decoded(variables, "BootOptionSupport", |data| {
+        Ok(u32::from_le_bytes(exact(data, "a UINT32")?).into())
+    })
+}
+
+/// SecureBoot, 1 while the platform firmware operates in Secure Boot mode (UEFI 2.11 §3.3), if
+/// present.
+#[cfg_attr(
+    not(any(target_os = "linux", target_os = "windows")),
+    allow(
+        dead_code,
+        reason = "only the Linux and Windows builds stage a set for the next boot"
+    )
+)]
+pub(crate) fn secure_boot(variables: &impl VariableData) -> Result<Option<u8>> {
+    read_decoded(variables, "SecureBoot", |data| {
+        Ok(u8::from_le_bytes(exact(data, "a UINT8")?))
+    })
+}
+
+/// The Boot#### that BootNext names, if present.
+pub(crate) fn boot_next(variables: &impl VariableData) -> Result<Option<LoadOptionName>> {
+    read_decoded(variables, "BootNext", boot_option)
+}
+
+/// The Boot#### options that BootOrder lists, in its order, if present.
+#[cfg_attr(
+    not(any(target_os = "linux", target_os = "windows")),
+    allow(
+        dead_code,
+        reason = "only the Linux and Windows builds stage a set for the next boot"
+    )
+)]
+pub(crate) fn boot_order(variables: &impl VariableData) -> Result<Option<Vec<LoadOptionName>>> {
+    read_decoded(variables, "BootOrder", |data| {
+        load_options(LoadOptionKind::Boot, data)
+    })
+}
+
+/// The bits of OsIndications, if present.
+pub(crate) fn read_os_indications(variables: &impl VariableData) -> Result<Option<OsIndications>> {
+    read_decoded(variables, "OsIndications", os_indications)
+}
+
 /// The global variable `name` that `variables` hold, decoded with `decode`, if present.
 fn read_decoded<T>(
     variables: &impl VariableData,
@@ -885,7 +955,7 @@ fn os_indication_names() -> String {
 }
 
 /// The names of `bits`, comma-separated.
-fn bit_names(bits: OsIndications) -> String {
+pub(crate) fn bit_names(bits: OsIndications) -> String {
     bits.iter_names()
         .map(|(name, _)| name)
         .collect::<Vec<_>>()
@@ -924,18 +994,8 @@ impl Codec {
             Self::Timeout => {
                 GlobalValue::Timeout(u16::from_le_bytes(exact(data, "a UINT16")?).into())
             }
-            Self::Order(kind) => GlobalValue::LoadOptions(
-                items::<2>(data, "UINT16")?
-                    .map(|number| LoadOptionName {
-                        kind,
-                        number: u16::from_le_bytes(number),
-                    })
-                    .collect(),
-            ),
-            Self::BootOption => GlobalValue::LoadOption(LoadOptionName {
-                kind: LoadOptionKind::Boot,
-                number: u16::from_le_bytes(exact(data, "a UINT16")?),
-            }),
+            Self::Order(kind) => GlobalValue::LoadOptions(load_options(kind, data)?),
+            Self::BootOption => GlobalValue::LoadOption(boot_option(data)?),
             Self::Ascii => GlobalValue::Ascii(ascii(data)?),
             Self::OsIndications => GlobalValue::OsIndications(os_indications(data)?),
             Self::Byte => GlobalValue::Byte(u8::from_le_bytes(exact(data, "a UINT8")?)),
@@ -1032,6 +1092,27 @@ fn items<'a, const N: usize>(
     }
 }
 
+/// The load options of `kind` that `data`, an array of UINT16 (UEFI 2.11 §3.3), lists.
+fn load_options(
+    kind: LoadOptionKind,
+    data: &[u8],
+) -> std::result::Result<Vec<LoadOptionName>, MalformedData> {
+    Ok(items::<2>(data, "UINT16")?
+        .map(|number| LoadOptionName {
+            kind,
+            number: u16::from_le_bytes(number),
+        })
+        .collect())
+}
+
+/// The Boot#### that `data`, "a single UINT16" (UEFI 2.11 §3.3), names.
+fn boot_option(data: &[u8]) -> std::result::Result<LoadOptionName, MalformedData> {
+    Ok(LoadOptionName {
+        kind: LoadOptionKind::Boot,
+        number: u16::from_le_bytes(exact(data, "a UINT16")?),
+    })
+}
+
 /// The bits of OsIndications or OsIndicationsSupported in `data`, "a UINT64 bitmask" (UEFI 2.11
 /// §8.5.4).
 fn os_indications(data: &[u8]) -> std::result::Result<OsIndications, MalformedData> {
@@ -1131,7 +1212,7 @@ fn take<const N: usize>(data: &mut &[u8]) -> Option<[u8; N]> {
 }
 
 /// `names`, then each bit of `reserved` in hex, such as 0x100.
-fn serialize_bits<S: Serializer>(
+pub(super) fn serialize_bits<S: Serializer>(
     serializer: S,
     names: impl Iterator<Item = &'static str>,
     reserved: u64,
@@ -1154,8 +1235,12 @@ fn serialize_hex<S: Serializer>(
     bytes: &[u8; 32],
     serializer: S,
 ) -> std::result::Result<S::Ok, S::Error> {
-    let hex: String = bytes.iter().map(|byte| format!("{byte:02x}")).collect();
-    serializer.serialize_str(&hex)
+    serializer.serialize_str(&lower_hex(bytes))
+}
+
+/// `bytes` in lowercase hex, two digits a byte.
+pub(super) fn lower_hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
 }
 
 #[cfg(test)]
@@ -1171,6 +1256,7 @@ pub(crate) mod tests {
     use crate::efi_variables::VariableContents;
     use crate::hii::VariableAttributes;
     use crate::hii::VariableInterface;
+    use crate::hii::VariableNotFound;
 
     /// EFI_CERT_SHA256_GUID (UEFI 2.11 §32.4.1) as its bytes.
     const EFI_CERT_SHA256: [u8; 16] = [
@@ -1208,6 +1294,7 @@ pub(crate) mod tests {
         pub(crate) variables: RefCell<BTreeMap<VariableKey, VariableContents>>,
         pub(crate) read: RefCell<Vec<VariableKey>>,
         pub(crate) set: RefCell<Vec<VariableKey>>,
+        pub(crate) deleted: RefCell<Vec<VariableKey>>,
         interface: VariableInterface,
     }
 
@@ -1217,6 +1304,7 @@ pub(crate) mod tests {
                 variables: RefCell::default(),
                 read: RefCell::default(),
                 set: RefCell::default(),
+                deleted: RefCell::default(),
                 interface: VariableInterface::VariableServices,
             }
         }
@@ -1234,7 +1322,7 @@ pub(crate) mod tests {
         }
 
         /// Holds `data` with `attributes` as the variable `name` of `vendor`.
-        fn with_attributes(
+        pub(crate) fn with_attributes(
             self,
             name: &str,
             vendor: Guid,
@@ -1274,6 +1362,21 @@ pub(crate) mod tests {
                 .insert(key.clone(), contents.clone());
             Ok(())
         }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            self.deleted.borrow_mut().push(key.clone());
+            match self.variables.borrow_mut().remove(key) {
+                Some(_) => Ok(()),
+                None => Err(VariableNotFound(key.clone()).into()),
+            }
+        }
+    }
+
+    #[cfg(variable_names)]
+    impl crate::efi_variables::VariableNames for HeldVariables {
+        fn variable_names(&self) -> Result<Vec<VariableKey>> {
+            Ok(self.variables.borrow().keys().cloned().collect())
+        }
     }
 
     pub(crate) fn key(name: &str, vendor: Guid) -> VariableKey {
@@ -1687,7 +1790,7 @@ pub(crate) mod tests {
     #[test]
     fn read_global_refuses_other_variables_unread() {
         let variables = HeldVariables::default()
-            .with("Boot0001", EFI_GLOBAL_VARIABLE, &[1])
+            .with("Boot001", EFI_GLOBAL_VARIABLE, &[1])
             .with(
                 "Timeout",
                 vendor("A04A27F4-DF00-4D42-B552-39511302113D"),
@@ -1702,7 +1805,7 @@ pub(crate) mod tests {
         .expect_err("read the Timeout of another vendor");
         let foreign_devdb = read_global(&variables, "devdb", Some(EFI_IMAGE_SECURITY_DATABASE))
             .expect_err("read the devdb of EFI_IMAGE_SECURITY_DATABASE_GUID");
-        let unknown = read_global(&variables, "Boot0001", None).expect_err("read Boot0001");
+        let unknown = read_global(&variables, "Boot001", None).expect_err("read Boot001");
 
         assert_eq!(
             foreign.to_string(),
@@ -1723,8 +1826,10 @@ pub(crate) mod tests {
         assert!(
             unknown.starts_with("variable get decodes AuditMode, BootCurrent, BootNext, ")
                 && unknown.ends_with(
-                    ", dbr, devdb, not Boot0001; `uefisettings variable info Boot0001 GUID` shows \
-                     the attributes and size of any EFI variable"
+                    ", dbr, devdb, Boot####, Driver####, SysPrep####, PlatformRecovery####, \
+                     OsRecovery####, Key####, ConIn, ConOut, ErrOut, ConInDev, ConOutDev, \
+                     ErrOutDev, not Boot001; `uefisettings variable info Boot001 GUID` shows the \
+                     attributes and size of any EFI variable"
                 ),
             "unknown name: {unknown}"
         );
@@ -1732,7 +1837,7 @@ pub(crate) mod tests {
     }
 
     /// GLOBALS holds each name once, those of UEFI 2.11 Table 3.1 but its load options, hot keys
-    /// and device paths among them.
+    /// and device paths among them, and boot_manager.rs decodes the others.
     #[test]
     fn globals_are_table_3_1_but_load_options_hot_keys_and_device_paths() {
         let table_3_1 = [
@@ -1797,11 +1902,24 @@ pub(crate) mod tests {
             GLOBALS.len(),
             "unique names"
         );
+        let others: Vec<&str> = table_3_1
+            .into_iter()
+            .filter(|name| !globals.contains(name))
+            .collect();
+        assert!(
+            others
+                .iter()
+                .all(|name| BootManagerVariable::parse(&name.replace("####", "00A1")).is_some()),
+            "Table 3.1 names that boot_manager.rs decodes: {others:?}"
+        );
+        assert!(
+            globals
+                .iter()
+                .all(|name| BootManagerVariable::parse(name).is_none()),
+            "names that both decode: {globals:?}"
+        );
         assert_eq!(
-            table_3_1
-                .into_iter()
-                .filter(|name| !globals.contains(name))
-                .collect::<Vec<_>>(),
+            others,
             [
                 "Boot####",
                 "ConIn",
@@ -1815,7 +1933,7 @@ pub(crate) mod tests {
                 "PlatformRecovery####",
                 "SysPrep####",
             ],
-            "Table 3.1 names that variable get leaves to variable info"
+            "Table 3.1 names that GLOBALS leaves out"
         );
         assert!(
             globals.iter().all(|name| table_3_1.contains(name)),
@@ -2338,6 +2456,10 @@ pub(crate) mod tests {
         fn set_variable(&self, key: &VariableKey, _contents: &VariableContents) -> Result<()> {
             panic!("set EFI variable {key}")
         }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            panic!("delete EFI variable {key}")
+        }
     }
 
     /// platform_lang fails with a read's error, which is no malformed PlatformLang.
diff --git a/src/lib/efi_variables/key_option.rs b/src/lib/efi_variables/key_option.rs
new file mode 100644
index 0000000..ab3dc0c
--- /dev/null
+++ b/src/lib/efi_variables/key_option.rs
@@ -0,0 +1,608 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! EFI_KEY_OPTION (UEFI 2.11 §3.1.6), what a Key#### variable holds: a hot key that starts a
+//! Boot#### load option, which the boot manager takes only while its BootOptionCrc is the CRC-32
+//! of that Boot#### variable.
+
+use std::fmt;
+use std::str::FromStr;
+
+use serde::Serialize;
+use serde::Serializer;
+use thiserror::Error;
+
+/// KeyData, BootOptionCrc and BootOption, before the keys
+const KEY_OPTION_HEADER_SIZE: usize = 10;
+/// Where BootOptionCrc starts, after KeyData, and where BootOption starts, after BootOptionCrc
+const BOOT_OPTION_CRC_OFFSET: usize = 4;
+const BOOT_OPTION_OFFSET: usize = 8;
+/// ScanCode and UnicodeChar, the fields of an EFI_INPUT_KEY
+const INPUT_KEY_SIZE: usize = 4;
+/// The shift states and Reserved bits of KeyData, between Revision, its low byte, and
+/// InputKeyCount, its top 2 bits
+const MODIFIERS_MASK: u32 = 0x3FFF_FF00;
+/// InputKeyCount, the top 2 bits of KeyData
+const INPUT_KEY_COUNT_SHIFT: u32 = 30;
+/// The most keys that InputKeyCount, 2 bits, counts
+const MAX_KEYS: usize = 3;
+
+/// The scan codes of EFI_INPUT_KEY by their names after SCAN_, as edk2-stable202608
+/// MdePkg/Include/Protocol/SimpleTextIn.h and SimpleTextInEx.h define them
+const SCAN_CODES: [(u16, &str); 46] = [
+    (0x0001, "UP"),
+    (0x0002, "DOWN"),
+    (0x0003, "RIGHT"),
+    (0x0004, "LEFT"),
+    (0x0005, "HOME"),
+    (0x0006, "END"),
+    (0x0007, "INSERT"),
+    (0x0008, "DELETE"),
+    (0x0009, "PAGE_UP"),
+    (0x000A, "PAGE_DOWN"),
+    (0x000B, "F1"),
+    (0x000C, "F2"),
+    (0x000D, "F3"),
+    (0x000E, "F4"),
+    (0x000F, "F5"),
+    (0x0010, "F6"),
+    (0x0011, "F7"),
+    (0x0012, "F8"),
+    (0x0013, "F9"),
+    (0x0014, "F10"),
+    (0x0015, "F11"),
+    (0x0016, "F12"),
+    (0x0017, "ESC"),
+    (0x0048, "PAUSE"),
+    (0x0068, "F13"),
+    (0x0069, "F14"),
+    (0x006A, "F15"),
+    (0x006B, "F16"),
+    (0x006C, "F17"),
+    (0x006D, "F18"),
+    (0x006E, "F19"),
+    (0x006F, "F20"),
+    (0x0070, "F21"),
+    (0x0071, "F22"),
+    (0x0072, "F23"),
+    (0x0073, "F24"),
+    (0x007F, "MUTE"),
+    (0x0080, "VOLUME_UP"),
+    (0x0081, "VOLUME_DOWN"),
+    (0x0100, "BRIGHTNESS_UP"),
+    (0x0101, "BRIGHTNESS_DOWN"),
+    (0x0102, "SUSPEND"),
+    (0x0103, "HIBERNATE"),
+    (0x0104, "TOGGLE_DISPLAY"),
+    (0x0105, "RECOVERY"),
+    (0x0106, "EJECT"),
+];
+
+bitflags::bitflags! {
+    /// The shift states of EFI_BOOT_KEY_DATA, each of which "must be pressed (1) or must not be
+    /// pressed (0)" (UEFI 2.11 §3.1.6), and its Reserved bits, kept as read.
+    #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    pub(crate) struct KeyModifiers: u32 {
+        const SHIFT = 1 << 8;
+        const CONTROL = 1 << 9;
+        const ALT = 1 << 10;
+        const LOGO = 1 << 11;
+        const MENU = 1 << 12;
+        const SYS_REQ = 1 << 13;
+    }
+}
+
+/// The shift states of EFI_BOOT_KEY_DATA, these names and Pressed (UEFI 2.11 §3.1.6).
+#[non_exhaustive]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum KeyModifier {
+    Shift,
+    Control,
+    Alt,
+    Logo,
+    Menu,
+    SysReq,
+}
+
+impl KeyModifier {
+    pub(crate) const ALL: [Self; 6] = [
+        Self::Shift,
+        Self::Control,
+        Self::Alt,
+        Self::Logo,
+        Self::Menu,
+        Self::SysReq,
+    ];
+
+    /// The name that variable get prints and create-key takes.
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Shift => "shift",
+            Self::Control => "control",
+            Self::Alt => "alt",
+            Self::Logo => "logo",
+            Self::Menu => "menu",
+            Self::SysReq => "sys-req",
+        }
+    }
+
+    pub(crate) fn modifiers(self) -> KeyModifiers {
+        match self {
+            Self::Shift => KeyModifiers::SHIFT,
+            Self::Control => KeyModifiers::CONTROL,
+            Self::Alt => KeyModifiers::ALT,
+            Self::Logo => KeyModifiers::LOGO,
+            Self::Menu => KeyModifiers::MENU,
+            Self::SysReq => KeyModifiers::SYS_REQ,
+        }
+    }
+}
+
+/// EFI_INPUT_KEY: a scan code, or a character with scan code 0 (edk2-stable202608
+/// MdePkg/Include/Protocol/SimpleTextIn.h).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct InputKey {
+    pub scan_code: u16,
+    pub unicode_char: u16,
+}
+
+/// The name of its scan code after SCAN_, such as F2, or its character; else
+/// ScanCode=0x####,UnicodeChar=0x####.
+impl fmt::Display for InputKey {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let name = SCAN_CODES
+            .iter()
+            .find(|(scan_code, _)| *scan_code == self.scan_code)
+            .map(|(_, name)| *name);
+        let character = char::from_u32(u32::from(self.unicode_char)).filter(|c| *c != '\0');
+        match (self.scan_code, self.unicode_char, name, character) {
+            (_, 0, Some(name), _) => f.write_str(name),
+            (0, _, _, Some(character)) => write!(f, "{character}"),
+            _ => write!(
+                f,
+                "ScanCode=0x{:04X},UnicodeChar=0x{:04X}",
+                self.scan_code, self.unicode_char
+            ),
+        }
+    }
+}
+
+/// The key that `text` names: the name after SCAN_ of its scan code, such as F2, else its one
+/// character, of UCS-2 but Null, else ScanCode=0x####,UnicodeChar=0x####, as Display writes it.
+impl FromStr for InputKey {
+    type Err = KeyNameError;
+
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        if let Some((scan_code, _)) = SCAN_CODES.iter().find(|(_, name)| *name == text) {
+            return Ok(Self {
+                scan_code: *scan_code,
+                unicode_char: 0,
+            });
+        }
+        if let Some((scan_code, unicode_char)) = text
+            .strip_prefix("ScanCode=0x")
+            .and_then(|codes| codes.split_once(",UnicodeChar=0x"))
+        {
+            return match (four_hex_digits(scan_code), four_hex_digits(unicode_char)) {
+                (Some(scan_code), Some(unicode_char)) => Ok(Self {
+                    scan_code,
+                    unicode_char,
+                }),
+                (None, _) | (_, None) => Err(KeyNameError(text.to_owned())),
+            };
+        }
+        let mut units = text.encode_utf16();
+        match (units.next(), units.next()) {
+            (Some(unit), None) if unit != 0 && char::from_u32(u32::from(unit)).is_some() => {
+                Ok(Self {
+                    scan_code: 0,
+                    unicode_char: unit,
+                })
+            }
+            (Some(_) | None, _) => Err(KeyNameError(text.to_owned())),
+        }
+    }
+}
+
+/// The value of `digits`, four hex digits.
+fn four_hex_digits(digits: &str) -> Option<u16> {
+    match digits.len() == 4 && digits.bytes().all(|digit| digit.is_ascii_hexdigit()) {
+        true => u16::from_str_radix(digits, 16).ok(),
+        false => None,
+    }
+}
+
+/// As Display writes it.
+impl Serialize for InputKey {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.collect_str(self)
+    }
+}
+
+/// An EFI_KEY_OPTION, what a Key#### variable holds.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct KeyOption {
+    /// KeyData.PackedValue, as read: Revision, the shift states, Reserved, InputKeyCount
+    pub(crate) key_data: u32,
+    /// The CRC-32 of the whole Boot#### variable that the key starts
+    pub(crate) boot_option_crc: u32,
+    /// The #### of the Boot#### that the key starts
+    pub(crate) boot_option: u16,
+    pub(crate) keys: Vec<InputKey>,
+}
+
+impl KeyOption {
+    /// A hot key of Revision 0 that starts the Boot#### `boot_option`, whose variable holds
+    /// `boot_option_bytes`, when `keys` are pressed with exactly the shift states `modifiers`.
+    pub(crate) fn new(
+        modifiers: KeyModifiers,
+        keys: Vec<InputKey>,
+        boot_option: u16,
+        boot_option_bytes: &[u8],
+    ) -> Result<Self, KeyOptionError> {
+        let count = u8::try_from(keys.len())
+            .ok()
+            .filter(|count| usize::from(*count) <= MAX_KEYS)
+            .ok_or(KeyOptionError::KeyCount(keys.len()))?;
+        Ok(Self {
+            key_data: (modifiers & KeyModifiers::all()).bits()
+                | u32::from(count) << INPUT_KEY_COUNT_SHIFT,
+            boot_option_crc: boot_option_crc(boot_option_bytes),
+            boot_option,
+            keys,
+        })
+    }
+
+    /// The bytes of the EFI_KEY_OPTION.
+    pub(crate) fn encode(&self) -> Vec<u8> {
+        let mut bytes = self.key_data.to_le_bytes().to_vec();
+        bytes.extend(self.boot_option_crc.to_le_bytes());
+        bytes.extend(self.boot_option.to_le_bytes());
+        for key in &self.keys {
+            bytes.extend(key.scan_code.to_le_bytes());
+            bytes.extend(key.unicode_char.to_le_bytes());
+        }
+        bytes
+    }
+
+    /// The EFI_KEY_OPTION that `bytes` hold: exactly InputKeyCount keys after its header, as
+    /// edk2-stable202608 BmIsKeyOptionValid() (BmHotkey.c) requires.
+    pub(crate) fn decode(bytes: &[u8]) -> Result<Self, KeyOptionError> {
+        let (header, keys) =
+            bytes
+                .split_first_chunk::<KEY_OPTION_HEADER_SIZE>()
+                .ok_or(KeyOptionError::Length {
+                    length: bytes.len(),
+                    want: KEY_OPTION_HEADER_SIZE,
+                })?;
+        let [a, b, c, d, e, f, g, h, i, j] = *header;
+        let key_data = u32::from_le_bytes([a, b, c, d]);
+        let [count, ..] = (key_data >> INPUT_KEY_COUNT_SHIFT).to_le_bytes();
+        let count = usize::from(count);
+        match keys.as_chunks::<INPUT_KEY_SIZE>() {
+            (keys, []) if keys.len() == count => Ok(Self {
+                key_data,
+                boot_option_crc: u32::from_le_bytes([e, f, g, h]),
+                boot_option: u16::from_le_bytes([i, j]),
+                keys: keys
+                    .iter()
+                    .map(|&[a, b, c, d]| InputKey {
+                        scan_code: u16::from_le_bytes([a, b]),
+                        unicode_char: u16::from_le_bytes([c, d]),
+                    })
+                    .collect(),
+            }),
+            _ => Err(KeyOptionError::Length {
+                length: bytes.len(),
+                want: KEY_OPTION_HEADER_SIZE + INPUT_KEY_SIZE * count,
+            }),
+        }
+    }
+
+    /// KeyData's Revision, which "should be 0" (UEFI 2.11 §3.1.6).
+    pub(crate) fn revision(&self) -> u8 {
+        let [revision, ..] = self.key_data.to_le_bytes();
+        revision
+    }
+
+    /// KeyData's shift states and Reserved bits.
+    pub(crate) fn modifiers(&self) -> KeyModifiers {
+        KeyModifiers::from_bits_retain(self.key_data & MODIFIERS_MASK)
+    }
+
+    /// Whether the boot manager takes the key for the Boot#### that holds `boot_option_bytes`:
+    /// "If the CRC-32s do not match this value, then this key option is ignored."
+    pub(crate) fn matches(&self, boot_option_bytes: &[u8]) -> bool {
+        self.boot_option_crc == boot_option_crc(boot_option_bytes)
+    }
+}
+
+/// `bytes`, an EFI_KEY_OPTION, with BootOptionCrc `crc` and every other byte as read.
+pub(crate) fn with_boot_option_crc(bytes: &[u8], crc: u32) -> Vec<u8> {
+    let mut changed = bytes.to_vec();
+    if let Some(field) = changed.get_mut(BOOT_OPTION_CRC_OFFSET..BOOT_OPTION_OFFSET) {
+        field.copy_from_slice(&crc.to_le_bytes());
+    }
+    changed
+}
+
+/// BootOptionCrc: "the CRC-32 of the entire EFI_LOAD_OPTION", the Boot#### variable's value,
+/// after any EFI_VARIABLE_AUTHENTICATION_3 metadata (UEFI 2.11 §8.2.1), which edk2-stable202608
+/// BmIsKeyOptionValid() hands to CalculateCrc32(): the CRC-32 of polynomial 0xEDB88320,
+/// reflected, as crc32fast computes it.
+pub(crate) fn boot_option_crc(boot_option_bytes: &[u8]) -> u32 {
+    crc32fast::hash(boot_option_bytes)
+}
+
+/// Why bytes are no EFI_KEY_OPTION, or keys no hot key.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub(crate) enum KeyOptionError {
+    #[error("an EFI_KEY_OPTION of {length} bytes is not the {want} that InputKeyCount gives")]
+    Length { length: usize, want: usize },
+    #[error("a hot key takes 0 to {MAX_KEYS} keys, which InputKeyCount counts, not {0}")]
+    KeyCount(usize),
+}
+
+/// A text that names no key.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error(
+    "{0:?} is neither the name after SCAN_ of a scan code, such as F2, ESC or PAGE_UP, one \
+     character of UCS-2, nor ScanCode=0x####,UnicodeChar=0x####"
+)]
+pub struct KeyNameError(String);
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use crate::efi_variables::device_path::tests::bytes;
+    use crate::efi_variables::device_path::tests::AA64_BOOT0000;
+    use crate::efi_variables::device_path::tests::X64_BOOT0000;
+
+    /// The Key0000 that OVMF's boot manager wrote, F2 to Boot0000, read from the vars.fd of QEMU
+    /// runs of Ubuntu's edk2 2024.02 builds (i686 equals x86_64)
+    pub(crate) const X64_KEY0000: &str = "0000004051d7979f00000c000000";
+    const AA64_KEY0000: &str = "000000405d4d80dd00000c000000";
+    /// SCAN_F2 (edk2-stable202608 MdePkg/Include/Protocol/SimpleTextIn.h)
+    const SCAN_F2: u16 = 0x000C;
+
+    #[test]
+    fn ovmf_hot_keys_carry_the_crc_32_of_their_whole_boot_option() {
+        for (name, key, boot0000, other) in [
+            ("x86_64", X64_KEY0000, X64_BOOT0000, AA64_BOOT0000),
+            ("aarch64", AA64_KEY0000, AA64_BOOT0000, X64_BOOT0000),
+        ] {
+            let key = KeyOption::decode(&bytes(key)).expect("an OVMF Key0000");
+            assert_eq!(key.key_data, 0x4000_0000, "{name}: one key, no shift state");
+            assert_eq!(
+                (key.revision(), key.modifiers()),
+                (0, KeyModifiers::empty()),
+                "{name}: revision and shift states"
+            );
+            assert_eq!(key.boot_option, 0, "{name}: Boot0000");
+            assert_eq!(
+                key.keys,
+                [InputKey {
+                    scan_code: SCAN_F2,
+                    unicode_char: 0
+                }],
+                "{name}: F2"
+            );
+            assert!(
+                key.matches(&bytes(boot0000)),
+                "{name}: BootOptionCrc of its Boot0000"
+            );
+            assert!(
+                !key.matches(&bytes(other)),
+                "{name}: not of the other Boot0000"
+            );
+        }
+    }
+
+    /// KeyData's Revision, shift states, Reserved bits and InputKeyCount each land where
+    /// EFI_BOOT_KEY_DATA puts them, as UEFI 2.11 §3.1.6 Example #2, CTRL-ALT-P-R, packs them.
+    #[test]
+    fn key_data_splits_into_its_fields() {
+        let mut key = bytes(X64_KEY0000);
+        key[..4].copy_from_slice(&0x8000_0600_u32.to_le_bytes());
+        key.extend([0, 0, 0x72, 0]);
+        key.splice(10..14, [0, 0, 0x70, 0]);
+        let key = KeyOption::decode(&key).expect("CTRL-ALT-P-R");
+        assert_eq!(
+            (key.revision(), key.modifiers()),
+            (0, KeyModifiers::CONTROL | KeyModifiers::ALT),
+            "CTRL-ALT"
+        );
+        assert_eq!(
+            key.keys.iter().map(ToString::to_string).collect::<Vec<_>>(),
+            ["p", "r"],
+            "P-R"
+        );
+
+        let mut odd = bytes(X64_KEY0000);
+        odd[..4].copy_from_slice(&0x3FFF_C001_u32.to_le_bytes());
+        odd.truncate(10);
+        let odd = KeyOption::decode(&odd).expect("no key, every Reserved bit, revision 1");
+        assert_eq!(odd.revision(), 1, "revision");
+        assert_eq!(
+            odd.modifiers().bits(),
+            0x3FFF_C000,
+            "the Reserved bits, outside the shift states"
+        );
+    }
+
+    #[test]
+    fn input_keys_read_as_their_scan_code_name_or_character() {
+        for (scan_code, unicode_char, want) in [
+            (0x000C, 0, "F2"),
+            (0x0017, 0, "ESC"),
+            (0x0105, 0, "RECOVERY"),
+            (0x0106, 0, "EJECT"),
+            (0, 0x0070, "p"),
+            (0, 0x00E9, "\u{E9}"),
+            (0x0099, 0, "ScanCode=0x0099,UnicodeChar=0x0000"),
+            (0x000C, 0x0070, "ScanCode=0x000C,UnicodeChar=0x0070"),
+            (0, 0xD800, "ScanCode=0x0000,UnicodeChar=0xD800"),
+            (0, 0, "ScanCode=0x0000,UnicodeChar=0x0000"),
+        ] {
+            let key = InputKey {
+                scan_code,
+                unicode_char,
+            };
+            assert_eq!(key.to_string(), want, "{key:?}");
+        }
+    }
+
+    #[test]
+    fn key_options_refuse_a_length_other_than_input_key_count_gives() {
+        let key = bytes(X64_KEY0000);
+        for (name, bytes, want) in [
+            ("a key more", [&key[..], &[0; 4]].concat(), 14),
+            ("a key less", key[..10].to_vec(), 14),
+            ("half a key more", [&key[..], &[0; 2]].concat(), 14),
+            ("no header", key[..9].to_vec(), 10),
+        ] {
+            assert_eq!(
+                KeyOption::decode(&bytes),
+                Err(KeyOptionError::Length {
+                    length: bytes.len(),
+                    want
+                }),
+                "{name}"
+            );
+        }
+    }
+
+    /// KeyOption::new packs KeyData as UEFI 2.11 §3.1.6's examples do, without Reserved bits,
+    /// and its bytes decode back to it; 4 keys are more than InputKeyCount counts.
+    #[test]
+    fn key_options_build_the_spec_examples() {
+        let key = |text: &str| text.parse::<InputKey>().expect("a key");
+        let boot = bytes(X64_BOOT0000);
+        let cases = [
+            ("ALT", KeyModifiers::ALT, vec![], 0x0000_0400),
+            (
+                "CTRL-ALT-P-R",
+                KeyModifiers::CONTROL | KeyModifiers::ALT,
+                vec![key("p"), key("r")],
+                0x8000_0600,
+            ),
+            (
+                "CTRL-F1",
+                KeyModifiers::CONTROL,
+                vec![key("F1")],
+                0x4000_0200,
+            ),
+            (
+                "CTRL with a Reserved bit",
+                KeyModifiers::CONTROL | KeyModifiers::from_bits_retain(1 << 14),
+                vec![key("F1")],
+                0x4000_0200,
+            ),
+        ];
+        for (name, modifiers, keys, key_data) in cases {
+            let option = KeyOption::new(modifiers, keys.clone(), 0x99, &boot).expect("a hot key");
+
+            assert_eq!(option.key_data, key_data, "{name}: KeyData");
+            assert_eq!(
+                (option.boot_option, option.boot_option_crc, &option.keys),
+                (0x99, 0x9F97_D751, &keys),
+                "{name}: BootOption, BootOptionCrc and keys"
+            );
+            assert_eq!(
+                KeyOption::decode(&option.encode()),
+                Ok(option.clone()),
+                "{name}: decoded back"
+            );
+            assert_eq!(option.encode().len(), 10 + 4 * keys.len(), "{name}: length");
+        }
+        assert_eq!(
+            KeyOption::new(KeyModifiers::empty(), vec![key("a"); 4], 0, &boot),
+            Err(KeyOptionError::KeyCount(4)),
+            "4 keys"
+        );
+    }
+
+    #[test]
+    fn input_keys_parse_from_their_scan_code_names_or_characters() {
+        for (text, want) in [
+            ("F2", Some((0x000C, 0))),
+            ("PAGE_UP", Some((0x0009, 0))),
+            ("TOGGLE_DISPLAY", Some((0x0104, 0))),
+            ("q", Some((0, 0x0071))),
+            ("\u{E9}", Some((0, 0x00E9))),
+            ("F", Some((0, 0x0046))),
+            ("ScanCode=0x0099,UnicodeChar=0x0000", Some((0x0099, 0))),
+            ("ScanCode=0x000C,UnicodeChar=0x0070", Some((0x000C, 0x0070))),
+            ("ScanCode=0x0000,UnicodeChar=0xD800", Some((0, 0xD800))),
+            ("", None),
+            ("pq", None),
+            ("f2", None),
+            ("SCAN_F2", None),
+            ("\u{1F41A}", None),
+            ("\0", None),
+            ("ScanCode=0x99,UnicodeChar=0x0000", None),
+            ("ScanCode=0x0099,UnicodeChar=0x00000", None),
+            ("ScanCode=0x+099,UnicodeChar=0x0000", None),
+            ("ScanCode=0x0099,UnicodeChar=0xG000", None),
+            ("ScanCode=0x0099", None),
+            ("ScanCode=0x0099,UnicodeChar=0x0000,", None),
+        ] {
+            let parsed = text.parse::<InputKey>();
+
+            assert_eq!(
+                parsed
+                    .clone()
+                    .map(|key| (key.scan_code, key.unicode_char))
+                    .ok(),
+                want,
+                "{text:?}"
+            );
+            match parsed {
+                Ok(key) => assert_eq!(key.to_string(), text, "{text:?} written back"),
+                Err(error) => {
+                    assert_eq!(error, KeyNameError(text.to_owned()), "{text:?}: the error")
+                }
+            }
+        }
+    }
+
+    /// What Display writes of any key reads back to that key: every scan code with no character,
+    /// every character with scan code 0, and both together.
+    #[test]
+    fn input_keys_read_back_from_what_display_writes() {
+        let keys = (0..=u16::MAX)
+            .flat_map(|code| [(code, 0), (0, code), (code, 0x0070), (0x000C, code)])
+            .map(|(scan_code, unicode_char)| InputKey {
+                scan_code,
+                unicode_char,
+            });
+        for key in keys {
+            let text = key.to_string();
+
+            assert_eq!(text.parse::<InputKey>(), Ok(key), "{key:?} as {text:?}");
+        }
+    }
+
+    #[test]
+    fn boot_option_crc_is_the_crc_32_of_the_variable_as_read() {
+        assert_eq!(
+            boot_option_crc(b"123456789"),
+            0xCBF4_3926,
+            "the CRC-32 check value"
+        );
+        assert_eq!(
+            boot_option_crc(&bytes(X64_BOOT0000)),
+            0x9F97_D751,
+            "the BootOptionCrc of OVMF's x86_64 Key0000"
+        );
+    }
+}
diff --git a/src/lib/efi_variables/load_option.rs b/src/lib/efi_variables/load_option.rs
new file mode 100644
index 0000000..e0ba0b3
--- /dev/null
+++ b/src/lib/efi_variables/load_option.rs
@@ -0,0 +1,907 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! EFI_LOAD_OPTION (UEFI 2.11 §3.1.3), what a Boot#### variable holds, and the device path nodes
+//! of its FilePathList that uefisettings writes or looks for: the Hard Drive and File Path media
+//! nodes (UEFI 2.11 §10.3.5.1, §10.3.5.4), each device path ended by an End Entire Device Path
+//! node (UEFI 2.11 §10.3.1).
+
+use thiserror::Error;
+
+use crate::hii::package::Guid;
+
+/// Attributes and FilePathListLength, the fixed fields of an EFI_LOAD_OPTION
+const LOAD_OPTION_HEADER_SIZE: usize = 6;
+/// Type, Sub-Type and Length, which every device path node starts with
+const NODE_HEADER_SIZE: usize = 4;
+/// Type 4 (Media Device Path) and its Sub-Types 1 (Hard Drive) and 4 (File Path)
+const MEDIA_DEVICE_PATH: u8 = 0x04;
+const MEDIA_HARD_DRIVE: u8 = 0x01;
+const MEDIA_FILE_PATH: u8 = 0x04;
+/// Type 0x7F (End of Hardware Device Path) and its Sub-Type 0xFF (End Entire Device Path)
+const END_DEVICE_PATH: u8 = 0x7F;
+const END_ENTIRE: u8 = 0xFF;
+/// Partition Format 0x01 (legacy MBR) and 0x02 (GPT), and Signature Type 0x01 (32-bit MBR
+/// signature) and 0x02 (GUID) of a Hard Drive node
+const FORMAT_MBR: u8 = 0x01;
+const FORMAT_GPT: u8 = 0x02;
+const SIGNATURE_MBR: u8 = 0x01;
+const SIGNATURE_GUID: u8 = 0x02;
+/// What lossy decoding puts for a CHAR16 that is no character, a surrogate
+const REPLACEMENT: char = '\u{FFFD}';
+
+bitflags::bitflags! {
+    /// The Attributes of an EFI_LOAD_OPTION, LOAD_OPTION_ and these names (UEFI 2.11 §3.1.3),
+    /// and any reserved bits, kept as read.
+    #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+    pub(crate) struct LoadOptionAttributes: u32 {
+        const ACTIVE = 0x0000_0001;
+        const FORCE_RECONNECT = 0x0000_0002;
+        const HIDDEN = 0x0000_0008;
+        /// LOAD_OPTION_CATEGORY_APP in the LOAD_OPTION_CATEGORY field (0x1F00), where
+        /// LOAD_OPTION_CATEGORY_BOOT is 0
+        const CATEGORY_APP = 0x0000_0100;
+        const _ = !0;
+    }
+}
+
+/// An EFI_LOAD_OPTION.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct LoadOption {
+    pub(crate) attributes: LoadOptionAttributes,
+    /// Description, without its Null character
+    pub(crate) description: Ucs2String,
+    pub(crate) file_paths: FilePathList,
+    /// The bytes that the boot manager passes to the image as its LoadOptions
+    pub(crate) optional_data: Vec<u8>,
+}
+
+impl LoadOption {
+    /// The EFI_LOAD_OPTION that `bytes` hold; a Description that is not UCS-2 is decoded with
+    /// U+FFFD for each surrogate.
+    pub(crate) fn decode(bytes: &[u8]) -> Result<Self, LoadOptionError> {
+        let (header, rest) = bytes
+            .split_first_chunk::<LOAD_OPTION_HEADER_SIZE>()
+            .ok_or(LoadOptionError::Short(bytes.len()))?;
+        let [a, b, c, d, e, f] = *header;
+        let attributes = LoadOptionAttributes::from_bits_retain(u32::from_le_bytes([a, b, c, d]));
+        let file_path_list_length = usize::from(u16::from_le_bytes([e, f]));
+
+        let units = char16_units(rest);
+        let (description, rest) = units
+            .iter()
+            .position(|unit| *unit == 0)
+            .and_then(|null| Some((units.get(..null)?, rest.get(2 * (null + 1)..)?)))
+            .ok_or(LoadOptionError::UnterminatedDescription)?;
+        let description = Ucs2String::from_units_lossy(description);
+
+        let (file_paths, optional_data) = rest.split_at_checked(file_path_list_length).ok_or(
+            LoadOptionError::FilePathListBeyondEnd {
+                length: file_path_list_length,
+                left: rest.len(),
+            },
+        )?;
+        Ok(Self {
+            attributes,
+            description,
+            file_paths: FilePathList::parse(file_paths)?,
+            optional_data: optional_data.to_vec(),
+        })
+    }
+
+    /// The bytes of the EFI_LOAD_OPTION.
+    pub(crate) fn encode(&self) -> Vec<u8> {
+        let mut bytes = self.attributes.bits().to_le_bytes().to_vec();
+        bytes.extend(self.file_paths.length().to_le_bytes());
+        bytes.extend(self.description.to_char16_bytes());
+        bytes.extend(&self.file_paths.0);
+        bytes.extend(&self.optional_data);
+        bytes
+    }
+}
+
+/// The little-endian CHAR16s of `bytes`, without an odd last byte.
+fn char16_units(bytes: &[u8]) -> Vec<u16> {
+    bytes
+        .chunks_exact(2)
+        .filter_map(|unit| unit.try_into().ok())
+        .map(u16::from_le_bytes)
+        .collect()
+}
+
+/// A string of UCS-2 characters other than Null, as a Description or a Path Name holds them.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct Ucs2String(String);
+
+impl Ucs2String {
+    /// The string of these CHAR16s, U+FFFD for each surrogate.
+    fn from_units_lossy(units: &[u16]) -> Self {
+        Self(
+            units
+                .iter()
+                .map(|unit| char::from_u32(u32::from(*unit)).unwrap_or(REPLACEMENT))
+                .collect(),
+        )
+    }
+
+    /// The CHAR16s of the string, then a Null character.
+    pub(crate) fn to_char16_bytes(&self) -> Vec<u8> {
+        self.0
+            .encode_utf16()
+            .chain([0])
+            .flat_map(u16::to_le_bytes)
+            .collect()
+    }
+}
+
+impl TryFrom<&str> for Ucs2String {
+    type Error = LoadOptionError;
+
+    fn try_from(text: &str) -> Result<Self, Self::Error> {
+        match text.chars().all(|c| c != '\0' && c.len_utf16() == 1) {
+            true => Ok(Self(text.to_string())),
+            false => Err(LoadOptionError::NotUcs2(text.to_string())),
+        }
+    }
+}
+
+impl AsRef<str> for Ucs2String {
+    fn as_ref(&self) -> &str {
+        &self.0
+    }
+}
+
+/// FilePathList: device paths, packed, each ended by an End Entire Device Path node; the first
+/// describes the device and location of the image.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct FilePathList(Vec<u8>);
+
+impl FilePathList {
+    /// The FilePathList of one device path of `nodes`, ended by an End Entire Device Path node.
+    pub(crate) fn of(nodes: &[DevicePathNode]) -> Result<Self, LoadOptionError> {
+        let mut bytes = Vec::new();
+        for node in nodes {
+            bytes.extend(node.encode()?);
+        }
+        bytes.extend(end_node(END_ENTIRE));
+        if u16::try_from(bytes.len()).is_err() {
+            return Err(LoadOptionError::FilePathListTooLong(bytes.len()));
+        }
+        Ok(Self(bytes))
+    }
+
+    /// `bytes` as a FilePathList: at least one node, each within the bytes, the last an End
+    /// Entire Device Path node.
+    fn parse(bytes: &[u8]) -> Result<Self, LoadOptionError> {
+        let mut last = None;
+        for node in RawNodes::new(bytes) {
+            last = Some(node?);
+        }
+        match last {
+            Some(RawNode {
+                node_type: END_DEVICE_PATH,
+                sub_type: END_ENTIRE,
+                ..
+            }) => Ok(Self(bytes.to_vec())),
+            Some(_) => Err(LoadOptionError::NoEnd),
+            None => Err(LoadOptionError::EmptyFilePathList),
+        }
+    }
+
+    /// FilePathListLength, which `of` and `parse` keep within a UINT16.
+    fn length(&self) -> u16 {
+        u16::try_from(self.0.len()).unwrap_or(u16::MAX)
+    }
+
+    /// The nodes of the first instance of the first device path, which locates the image: up to
+    /// its End This Instance (Sub-Type 0x01) or End Entire Device Path node.
+    pub(crate) fn image_path(&self) -> Result<Vec<DevicePathNode>, LoadOptionError> {
+        let mut nodes = Vec::new();
+        for node in RawNodes::new(&self.0) {
+            let node = node?;
+            if node.node_type == END_DEVICE_PATH {
+                break;
+            }
+            nodes.push(DevicePathNode::decode(&node)?);
+        }
+        Ok(nodes)
+    }
+
+    /// The first Hard Drive node of image_path, if any.
+    pub(crate) fn hard_drive(&self) -> Result<Option<HardDrive>, LoadOptionError> {
+        Ok(self.image_path()?.into_iter().find_map(|node| match node {
+            DevicePathNode::HardDrive(hard_drive) => Some(hard_drive),
+            DevicePathNode::FilePath(_) | DevicePathNode::Other { .. } => None,
+        }))
+    }
+}
+
+/// `bytes` as a FilePathList, as parse checks them, and short enough for FilePathListLength.
+impl TryFrom<&[u8]> for FilePathList {
+    type Error = LoadOptionError;
+
+    fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
+        let list = Self::parse(bytes)?;
+        match u16::try_from(bytes.len()) {
+            Ok(_) => Ok(list),
+            Err(_) => Err(LoadOptionError::FilePathListTooLong(bytes.len())),
+        }
+    }
+}
+
+impl AsRef<[u8]> for FilePathList {
+    fn as_ref(&self) -> &[u8] {
+        &self.0
+    }
+}
+
+/// An End of Hardware Device Path node of `sub_type`.
+fn end_node(sub_type: u8) -> [u8; NODE_HEADER_SIZE] {
+    [END_DEVICE_PATH, sub_type, 0x04, 0x00]
+}
+
+/// A device path node as found: its Type, Sub-Type and data.
+pub(super) struct RawNode<'a> {
+    pub(super) node_type: u8,
+    pub(super) sub_type: u8,
+    pub(super) data: &'a [u8],
+}
+
+/// The nodes of packed device paths, each checked to lie within them.
+pub(super) struct RawNodes<'a> {
+    bytes: &'a [u8],
+    offset: usize,
+}
+
+impl<'a> RawNodes<'a> {
+    pub(super) fn new(bytes: &'a [u8]) -> Self {
+        Self { bytes, offset: 0 }
+    }
+}
+
+impl<'a> Iterator for RawNodes<'a> {
+    type Item = Result<RawNode<'a>, LoadOptionError>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        let left = self
+            .bytes
+            .get(self.offset..)
+            .filter(|left| !left.is_empty())?;
+        let node = match left.split_first_chunk::<NODE_HEADER_SIZE>() {
+            Some((&[node_type, sub_type, low, high], _)) => {
+                let length = usize::from(u16::from_le_bytes([low, high]));
+                // None for a Length below 4, or beyond the bytes left
+                match left.get(NODE_HEADER_SIZE..length) {
+                    Some(data) => Ok((
+                        RawNode {
+                            node_type,
+                            sub_type,
+                            data,
+                        },
+                        length,
+                    )),
+                    None => Err(LoadOptionError::NodeLength {
+                        offset: self.offset,
+                        length,
+                        left: left.len(),
+                    }),
+                }
+            }
+            None => Err(LoadOptionError::NodeLength {
+                offset: self.offset,
+                length: left.len(),
+                left: left.len(),
+            }),
+        };
+        match node {
+            Ok((node, length)) => {
+                self.offset += length;
+                Some(Ok(node))
+            }
+            Err(error) => {
+                // nothing after a malformed node is a node
+                self.offset = self.bytes.len();
+                Some(Err(error))
+            }
+        }
+    }
+}
+
+/// A device path node of the image's device path.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum DevicePathNode {
+    HardDrive(HardDrive),
+    /// A File Path node's Path Name, without its Null character
+    FilePath(Ucs2String),
+    /// Any other node but an End node: its Type, Sub-Type and data
+    Other {
+        node_type: u8,
+        sub_type: u8,
+        data: Vec<u8>,
+    },
+}
+
+impl DevicePathNode {
+    fn decode(node: &RawNode<'_>) -> Result<Self, LoadOptionError> {
+        Ok(match (node.node_type, node.sub_type) {
+            (MEDIA_DEVICE_PATH, MEDIA_HARD_DRIVE) => Self::HardDrive(HardDrive::decode(node.data)?),
+            (MEDIA_DEVICE_PATH, MEDIA_FILE_PATH) => {
+                let units = char16_units(node.data);
+                match (node.data.len() % 2, units.split_last()) {
+                    (0, Some((&0, name))) => Self::FilePath(Ucs2String::from_units_lossy(name)),
+                    _ => return Err(LoadOptionError::FilePathName),
+                }
+            }
+            (node_type, sub_type) => Self::Other {
+                node_type,
+                sub_type,
+                data: node.data.to_vec(),
+            },
+        })
+    }
+
+    /// The node's bytes, Type, Sub-Type and Length first.
+    fn encode(&self) -> Result<Vec<u8>, LoadOptionError> {
+        let (node_type, sub_type, data) = match self {
+            Self::HardDrive(hard_drive) => {
+                (MEDIA_DEVICE_PATH, MEDIA_HARD_DRIVE, hard_drive.encode())
+            }
+            Self::FilePath(name) => (MEDIA_DEVICE_PATH, MEDIA_FILE_PATH, name.to_char16_bytes()),
+            Self::Other {
+                node_type,
+                sub_type,
+                data,
+            } => (*node_type, *sub_type, data.clone()),
+        };
+        let length = NODE_HEADER_SIZE + data.len();
+        let length_field =
+            u16::try_from(length).map_err(|_| LoadOptionError::NodeTooLong(length))?;
+        let mut bytes = vec![node_type, sub_type];
+        bytes.extend(length_field.to_le_bytes());
+        bytes.extend(data);
+        Ok(bytes)
+    }
+}
+
+/// A Hard Drive media node: a partition of a disk, by its entry in the partition table.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct HardDrive {
+    /// The partition table entry, starting with 1
+    pub(crate) partition_number: u32,
+    /// Partition Start, in logical blocks
+    pub(crate) start: u64,
+    /// Partition Size, in logical blocks
+    pub(crate) size: u64,
+    pub(crate) signature: PartitionSignature,
+}
+
+/// A Hard Drive node's Partition Format, Signature Type and Partition Signature.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum PartitionSignature {
+    /// A legacy MBR partition of the disk whose 32-bit signature at address 0x1B8 of its MBR is
+    /// this
+    Mbr(u32),
+    /// A GPT partition whose UniquePartitionGUID is this
+    Gpt(Guid),
+    /// Any other Partition Format and Signature Type, with the Partition Signature
+    Other {
+        format: u8,
+        signature_type: u8,
+        signature: [u8; 16],
+    },
+}
+
+impl HardDrive {
+    /// The Hard Drive node of these data, the node's bytes after its Length.
+    fn decode(data: &[u8]) -> Result<Self, LoadOptionError> {
+        let fields = HardDriveFields::read(data).ok_or(LoadOptionError::HardDriveLength(
+            NODE_HEADER_SIZE + data.len(),
+        ))?;
+        let signature = match (fields.format, fields.signature_type) {
+            (FORMAT_GPT, SIGNATURE_GUID) => PartitionSignature::Gpt(Guid::from(fields.signature)),
+            (FORMAT_MBR, SIGNATURE_MBR) => match fields.signature.split_first_chunk::<4>() {
+                Some((mbr, rest)) if rest.iter().all(|byte| *byte == 0) => {
+                    PartitionSignature::Mbr(u32::from_le_bytes(*mbr))
+                }
+                Some(_) | None => fields.other_signature(),
+            },
+            _ => fields.other_signature(),
+        };
+        Ok(Self {
+            partition_number: fields.partition_number,
+            start: fields.start,
+            size: fields.size,
+            signature,
+        })
+    }
+
+    /// The node's data, after its Length.
+    fn encode(&self) -> Vec<u8> {
+        let (signature, format, signature_type) = match self.signature {
+            PartitionSignature::Mbr(mbr) => {
+                let mut signature = [0; 16];
+                signature
+                    .iter_mut()
+                    .zip(mbr.to_le_bytes())
+                    .for_each(|(byte, mbr)| *byte = mbr);
+                (signature, FORMAT_MBR, SIGNATURE_MBR)
+            }
+            PartitionSignature::Gpt(guid) => (<[u8; 16]>::from(guid), FORMAT_GPT, SIGNATURE_GUID),
+            PartitionSignature::Other {
+                format,
+                signature_type,
+                signature,
+            } => (signature, format, signature_type),
+        };
+        [
+            &self.partition_number.to_le_bytes()[..],
+            &self.start.to_le_bytes(),
+            &self.size.to_le_bytes(),
+            &signature,
+            &[format, signature_type],
+        ]
+        .concat()
+    }
+}
+
+/// The fields of a Hard Drive node after its Length, at their byte offsets 4 to 41.
+struct HardDriveFields {
+    partition_number: u32,
+    start: u64,
+    size: u64,
+    signature: [u8; 16],
+    format: u8,
+    signature_type: u8,
+}
+
+impl HardDriveFields {
+    /// The fields that `data` holds, None unless it has exactly their 38 bytes.
+    fn read(data: &[u8]) -> Option<Self> {
+        let (partition_number, rest) = data.split_first_chunk::<4>()?;
+        let (start, rest) = rest.split_first_chunk::<8>()?;
+        let (size, rest) = rest.split_first_chunk::<8>()?;
+        let (signature, rest) = rest.split_first_chunk::<16>()?;
+        let &[format, signature_type] = rest else {
+            return None;
+        };
+        Some(Self {
+            partition_number: u32::from_le_bytes(*partition_number),
+            start: u64::from_le_bytes(*start),
+            size: u64::from_le_bytes(*size),
+            signature: *signature,
+            format,
+            signature_type,
+        })
+    }
+
+    /// The signature of a Partition Format and Signature Type that PartitionSignature does not
+    /// name.
+    fn other_signature(&self) -> PartitionSignature {
+        PartitionSignature::Other {
+            format: self.format,
+            signature_type: self.signature_type,
+            signature: self.signature,
+        }
+    }
+}
+
+/// Why bytes are no EFI_LOAD_OPTION, or a value cannot be one.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub(crate) enum LoadOptionError {
+    #[error("{0} bytes are fewer than an EFI_LOAD_OPTION's Attributes and FilePathListLength")]
+    Short(usize),
+    #[error("the Description has no Null character")]
+    UnterminatedDescription,
+    #[error("FilePathListLength {length} exceeds the {left} bytes after the Description")]
+    FilePathListBeyondEnd { length: usize, left: usize },
+    #[error("the FilePathList holds no device path")]
+    EmptyFilePathList,
+    #[error(
+        "the device path node at byte {offset} of the FilePathList has Length {length}, outside \
+         4 to the {left} bytes left"
+    )]
+    NodeLength {
+        offset: usize,
+        length: usize,
+        left: usize,
+    },
+    #[error("the FilePathList does not end with an End Entire Device Path node")]
+    NoEnd,
+    #[error("a Hard Drive node has Length {0}, not 42")]
+    HardDriveLength(usize),
+    #[error("a File Path node's Path Name is no Null-terminated CHAR16 string")]
+    FilePathName,
+    #[error("{0:?} holds Null or a character outside UCS-2")]
+    NotUcs2(String),
+    #[error("a FilePathList of {0} bytes does not fit FilePathListLength")]
+    FilePathListTooLong(usize),
+    #[error("a device path node of {0} bytes does not fit its Length")]
+    NodeTooLong(usize),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const ESP_GUID: [u8; 16] = [
+        0x28, 0x73, 0x2A, 0xC1, 0x1F, 0xF8, 0xD2, 0x11, 0xBA, 0x4B, 0x00, 0xA0, 0xC9, 0x3E, 0xC9,
+        0x3B,
+    ];
+
+    /// `text` as CHAR16s with a Null character, as the spec lays out a Description or Path Name.
+    fn char16(text: &str) -> Vec<u8> {
+        text.encode_utf16()
+            .chain([0])
+            .flat_map(u16::to_le_bytes)
+            .collect()
+    }
+
+    /// A Hard Drive node, field by field as UEFI 2.11 Table 10.54 lays it out.
+    fn hard_drive_bytes(
+        number: u32,
+        start: u64,
+        size: u64,
+        signature: [u8; 16],
+        format: u8,
+        kind: u8,
+    ) -> Vec<u8> {
+        [
+            &[0x04, 0x01, 42, 0][..],
+            &number.to_le_bytes(),
+            &start.to_le_bytes(),
+            &size.to_le_bytes(),
+            &signature,
+            &[format, kind],
+        ]
+        .concat()
+    }
+
+    /// A File Path node of `name`, as UEFI 2.11 Table 10.57 lays it out.
+    fn file_path_bytes(name: &str) -> Vec<u8> {
+        let name = char16(name);
+        let length = u16::try_from(4 + name.len()).expect("a short name");
+        [&[0x04, 0x04][..], &length.to_le_bytes(), &name].concat()
+    }
+
+    /// An EFI_LOAD_OPTION, field by field as UEFI 2.11 §3.1.3 lays it out.
+    fn load_option_bytes(
+        attributes: u32,
+        description: &str,
+        file_paths: &[u8],
+        optional: &[u8],
+    ) -> Vec<u8> {
+        let length = u16::try_from(file_paths.len()).expect("a short FilePathList");
+        [
+            &attributes.to_le_bytes()[..],
+            &length.to_le_bytes(),
+            &char16(description),
+            file_paths,
+            optional,
+        ]
+        .concat()
+    }
+
+    const END: [u8; 4] = [0x7F, 0xFF, 0x04, 0x00];
+
+    fn ucs2(text: &str) -> Ucs2String {
+        Ucs2String::try_from(text).expect("UCS-2")
+    }
+
+    fn gpt_partition() -> HardDrive {
+        HardDrive {
+            partition_number: 2,
+            start: 0x800,
+            size: 0x10_0000,
+            signature: PartitionSignature::Gpt(Guid::from(ESP_GUID)),
+        }
+    }
+
+    #[test]
+    fn a_load_option_encodes_as_the_spec_lays_it_out_and_decodes_back() {
+        let option = LoadOption {
+            attributes: LoadOptionAttributes::ACTIVE
+                | LoadOptionAttributes::HIDDEN
+                | LoadOptionAttributes::CATEGORY_APP,
+            description: ucs2("uefisettings"),
+            file_paths: FilePathList::of(&[
+                DevicePathNode::HardDrive(gpt_partition()),
+                DevicePathNode::FilePath(ucs2(r"\EFI\uefisettings\uefisettings.efi")),
+            ])
+            .expect("a FilePathList"),
+            optional_data: vec![1, 2, 3],
+        };
+        let file_paths = [
+            hard_drive_bytes(2, 0x800, 0x10_0000, ESP_GUID, 0x02, 0x02),
+            file_path_bytes(r"\EFI\uefisettings\uefisettings.efi"),
+            END.to_vec(),
+        ]
+        .concat();
+        let want = load_option_bytes(0x109, "uefisettings", &file_paths, &[1, 2, 3]);
+
+        assert_eq!(option.encode(), want, "the bytes");
+        assert_eq!(LoadOption::decode(&want), Ok(option), "decoded back");
+    }
+
+    #[test]
+    fn the_image_path_is_the_first_instance_and_its_hard_drive_node_is_found() {
+        // PciRoot(0x0)/Pci(0x1F,0x2)/Sata(0x0,0xFFFF,0x0)/HD(...)/File(...), then a second
+        // instance and a second device path
+        let acpi = [0x02, 0x01, 0x0C, 0x00, 0xD0, 0x41, 0x03, 0x0A, 0, 0, 0, 0];
+        let pci = [0x01, 0x01, 0x06, 0x00, 0x02, 0x1F];
+        let sata = [0x03, 0x12, 0x0A, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00];
+        let file_paths = [
+            &acpi[..],
+            &pci,
+            &sata,
+            &hard_drive_bytes(1, 0x800, 0x8_0000, ESP_GUID, 0x02, 0x02),
+            &file_path_bytes(r"\EFI\os\loader.efi"),
+            &[0x7F, 0x01, 0x04, 0x00],
+            &hard_drive_bytes(3, 0x9000, 0x100, [0x33; 16], 0x02, 0x02),
+            &END,
+            &file_path_bytes(r"\second.efi"),
+            &END,
+        ]
+        .concat();
+        let option = LoadOption::decode(&load_option_bytes(1, "OS", &file_paths, &[]))
+            .expect("a load option");
+
+        let nodes = option.file_paths.image_path().expect("the image path");
+        assert_eq!(
+            nodes,
+            [
+                DevicePathNode::Other {
+                    node_type: 0x02,
+                    sub_type: 0x01,
+                    data: acpi[4..].to_vec()
+                },
+                DevicePathNode::Other {
+                    node_type: 0x01,
+                    sub_type: 0x01,
+                    data: pci[4..].to_vec()
+                },
+                DevicePathNode::Other {
+                    node_type: 0x03,
+                    sub_type: 0x12,
+                    data: sata[4..].to_vec()
+                },
+                DevicePathNode::HardDrive(HardDrive {
+                    partition_number: 1,
+                    start: 0x800,
+                    size: 0x8_0000,
+                    signature: PartitionSignature::Gpt(Guid::from(ESP_GUID)),
+                }),
+                DevicePathNode::FilePath(ucs2(r"\EFI\os\loader.efi")),
+            ],
+            "the nodes of the first instance only"
+        );
+        assert_eq!(
+            option
+                .file_paths
+                .hard_drive()
+                .expect("decoded")
+                .map(|hd| hd.partition_number),
+            Some(1),
+            "the image's partition"
+        );
+        assert!(option.optional_data.is_empty(), "no OptionalData");
+    }
+
+    #[test]
+    fn mbr_and_other_signatures_keep_their_bytes() {
+        let mbr = HardDrive {
+            signature: PartitionSignature::Mbr(0x1234_5678),
+            ..gpt_partition()
+        };
+        let mbr_bytes = hard_drive_bytes(
+            2,
+            0x800,
+            0x10_0000,
+            [0x78, 0x56, 0x34, 0x12, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+            0x01,
+            0x01,
+        );
+        let path = FilePathList::of(&[DevicePathNode::HardDrive(mbr)]).expect("a path");
+        assert_eq!(
+            path.as_ref(),
+            [mbr_bytes.clone(), END.to_vec()].concat(),
+            "MBR signature bytes"
+        );
+
+        let cases = [
+            // a signature MBR with bytes beyond its 4, no signature, and a reserved format
+            (
+                [0x78, 0x56, 0x34, 0x12, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+                0x01,
+                0x01,
+            ),
+            ([0; 16], 0x01, 0x00),
+            ([0x44; 16], 0x03, 0x02),
+        ];
+        for (signature, format, kind) in cases {
+            let bytes = [
+                hard_drive_bytes(2, 0x800, 0x10_0000, signature, format, kind),
+                END.to_vec(),
+            ]
+            .concat();
+            let path = FilePathList::parse(&bytes).expect("a FilePathList");
+            let hard_drive = path
+                .hard_drive()
+                .expect("decoded")
+                .expect("a Hard Drive node");
+            assert_eq!(
+                hard_drive.signature,
+                PartitionSignature::Other {
+                    format,
+                    signature_type: kind,
+                    signature
+                },
+                "format {format:#x}, type {kind:#x}"
+            );
+            assert_eq!(
+                FilePathList::of(&[DevicePathNode::HardDrive(hard_drive)])
+                    .expect("a path")
+                    .as_ref(),
+                bytes,
+                "format {format:#x}, type {kind:#x} encodes back"
+            );
+        }
+    }
+
+    #[test]
+    fn reserved_attribute_bits_are_kept() {
+        let bytes = load_option_bytes(0x8000_0201, "", &END, &[]);
+        let option = LoadOption::decode(&bytes).expect("a load option");
+        assert_eq!(option.attributes.bits(), 0x8000_0201, "the attributes");
+        assert_eq!(option.encode(), bytes, "encoded back");
+    }
+
+    #[test]
+    fn malformed_load_options_are_refused() {
+        let hard_drive = hard_drive_bytes(1, 0, 1, ESP_GUID, 0x02, 0x02);
+        let cases = [
+            (vec![1, 0, 0, 0, 4], LoadOptionError::Short(5)),
+            (
+                [&[1, 0, 0, 0, 4, 0][..], &[0x41, 0x00, 0x42]].concat(),
+                LoadOptionError::UnterminatedDescription,
+            ),
+            (
+                load_option_bytes(1, "x", &END, &[])[..11].to_vec(),
+                LoadOptionError::FilePathListBeyondEnd { length: 4, left: 1 },
+            ),
+            (
+                load_option_bytes(1, "x", &[], &[]),
+                LoadOptionError::EmptyFilePathList,
+            ),
+            (
+                load_option_bytes(
+                    1,
+                    "x",
+                    &[0x01, 0x01, 0x03, 0x00, 0x7F, 0xFF, 0x04, 0x00],
+                    &[],
+                ),
+                LoadOptionError::NodeLength {
+                    offset: 0,
+                    length: 3,
+                    left: 8,
+                },
+            ),
+            (
+                load_option_bytes(
+                    1,
+                    "x",
+                    &[0x01, 0x01, 0x10, 0x00, 0x7F, 0xFF, 0x04, 0x00],
+                    &[],
+                ),
+                LoadOptionError::NodeLength {
+                    offset: 0,
+                    length: 16,
+                    left: 8,
+                },
+            ),
+            (
+                load_option_bytes(1, "x", &[0x7F, 0xFF, 0x04], &[]),
+                LoadOptionError::NodeLength {
+                    offset: 0,
+                    length: 3,
+                    left: 3,
+                },
+            ),
+            (
+                load_option_bytes(1, "x", &hard_drive, &[]),
+                LoadOptionError::NoEnd,
+            ),
+            (
+                load_option_bytes(
+                    1,
+                    "x",
+                    &[&[0x7F, 0x01, 0x04, 0x00][..], &END[..2]].concat(),
+                    &[],
+                ),
+                LoadOptionError::NodeLength {
+                    offset: 4,
+                    length: 2,
+                    left: 2,
+                },
+            ),
+        ];
+        for (bytes, want) in cases {
+            assert_eq!(LoadOption::decode(&bytes), Err(want.clone()), "{want}");
+        }
+    }
+
+    #[test]
+    fn malformed_image_path_nodes_are_refused() {
+        let short_hard_drive = [&[0x04, 0x01, 41, 0][..], &[0; 37], &END].concat();
+        let odd_name = [&[0x04, 0x04, 0x07, 0x00][..], &[0x41, 0x00, 0x00], &END].concat();
+        let unterminated = [&[0x04, 0x04, 0x06, 0x00][..], &[0x41, 0x00], &END].concat();
+        let cases = [
+            (short_hard_drive, LoadOptionError::HardDriveLength(41)),
+            (odd_name, LoadOptionError::FilePathName),
+            (unterminated, LoadOptionError::FilePathName),
+        ];
+        for (bytes, want) in cases {
+            let path = FilePathList::parse(&bytes).expect("well-formed nodes");
+            assert_eq!(path.image_path(), Err(want.clone()), "{want}");
+        }
+    }
+
+    #[test]
+    fn ucs2_strings_hold_no_null_or_surrogate_pair_and_decode_lossily() {
+        assert_eq!(
+            Ucs2String::try_from("A\u{0}B"),
+            Err(LoadOptionError::NotUcs2("A\u{0}B".to_string())),
+            "Null"
+        );
+        assert_eq!(
+            Ucs2String::try_from("\u{1F600}"),
+            Err(LoadOptionError::NotUcs2("\u{1F600}".to_string())),
+            "outside the BMP"
+        );
+        assert_eq!(
+            Ucs2String::from_units_lossy(&[0x41, 0xD800, 0x42]).as_ref(),
+            "A\u{FFFD}B",
+            "a surrogate"
+        );
+        let bytes = load_option_bytes(1, "", &END, &[]);
+        let mut description = bytes.clone();
+        description.splice(6..6, [0x00, 0xD8]);
+        assert_eq!(
+            LoadOption::decode(&description).map(|option| option.description),
+            Ok(Ucs2String("\u{FFFD}".to_string())),
+            "a Description with a surrogate"
+        );
+    }
+
+    #[test]
+    fn nodes_and_lists_that_do_not_fit_their_length_are_refused() {
+        let long = DevicePathNode::Other {
+            node_type: 0x01,
+            sub_type: 0x01,
+            data: vec![0; 65532],
+        };
+        assert_eq!(
+            FilePathList::of(std::slice::from_ref(&long)),
+            Err(LoadOptionError::NodeTooLong(65536)),
+            "a node"
+        );
+        let half = DevicePathNode::Other {
+            node_type: 0x01,
+            sub_type: 0x01,
+            data: vec![0; 32766],
+        };
+        assert_eq!(
+            FilePathList::of(&[half.clone(), half]),
+            Err(LoadOptionError::FilePathListTooLong(65544)),
+            "a list"
+        );
+    }
+}
diff --git a/src/lib/efi_variables/secure_boot_mode.rs b/src/lib/efi_variables/secure_boot_mode.rs
index 93731d9..305203c 100644
--- a/src/lib/efi_variables/secure_boot_mode.rs
+++ b/src/lib/efi_variables/secure_boot_mode.rs
@@ -624,6 +624,11 @@ mod tests {
                 )),
             }
         }
+
+        /// set_mode deletes no variable, so this firmware refuses any deletion.
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            Err(anyhow!("deletion of EFI variable {key}: unexpected"))
+        }
     }
 
     /// What set_mode writes to `name` and tells of the write, as variable get prints it.
diff --git a/src/lib/esp.rs b/src/lib/esp.rs
new file mode 100644
index 0000000..ed9ee7b
--- /dev/null
+++ b/src/lib/esp.rs
@@ -0,0 +1,1709 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The EFI System Partition (ESP) of a disk, from the disk's partition table, and the Hard Drive
+//! node (UEFI 2.11 §10.3.5.1) that names it to firmware. The table is the primary GPT (UEFI 2.11
+//! §5.3) behind a protective MBR (UEFI 2.11 §5.2.3), or a legacy MBR (UEFI 2.11 §5.2.1).
+
+use std::fs;
+use std::fs::File;
+use std::io;
+use std::io::Write;
+use std::path::Path;
+use std::path::PathBuf;
+
+use anyhow::anyhow;
+use anyhow::Context;
+use anyhow::Result;
+use sha2::Digest;
+use sha2::Sha256;
+use thiserror::Error;
+
+use crate::efi_variables::globals::boot_current;
+use crate::efi_variables::load_option::HardDrive;
+use crate::efi_variables::load_option::LoadOption;
+use crate::efi_variables::load_option::PartitionSignature;
+use crate::efi_variables::VariableData;
+use crate::hii::package::Guid;
+use crate::staged_set::Sha256Digest;
+use crate::staged_set::StagedFiles;
+use crate::staged_set::CAPSULE_DIRECTORY;
+use crate::staged_set::IMAGE_DIRECTORY;
+
+#[cfg(target_os = "linux")]
+pub(crate) mod linux;
+#[cfg(test)]
+mod sfdisk_images;
+// The Win32 calls, built for Windows alone; the locator builds for the tests of every host too.
+#[cfg(target_os = "windows")]
+pub(crate) mod win32_calls;
+#[cfg(any(target_os = "windows", test))]
+pub(crate) mod windows;
+
+/// UniqueMBRDiskSignature, the four partition records and Signature of an MBR (UEFI 2.11
+/// Table 5.1)
+const MBR_DISK_SIGNATURE: usize = 440;
+const MBR_PARTITION_RECORDS: usize = 446;
+const MBR_PARTITION_RECORD_SIZE: usize = 16;
+const MBR_SIGNATURE_OFFSET: usize = 510;
+const MBR_SIGNATURE: u16 = 0xAA55;
+/// OSType 0xEF, a UEFI system partition, and 0xEE, GPT Protective (UEFI 2.11 §5.2.2)
+const OS_TYPE_ESP: u8 = 0xEF;
+const OS_TYPE_GPT_PROTECTIVE: u8 = 0xEE;
+/// The LBA of the primary GPT header
+const PRIMARY_GPT_HEADER: u64 = 1;
+/// "EFI PART", a GPT header's Signature
+const GPT_SIGNATURE: u64 = 0x5452_4150_2049_4645;
+/// Revision 1.0, the GPT header that UEFI 2.11 Table 5.5 lays out
+const GPT_REVISION: u32 = 0x0001_0000;
+/// The bytes of the fields that UEFI 2.11 Table 5.5 defines, the least HeaderSize
+const GPT_HEADER_SIZE: usize = 92;
+/// The byte offset of HeaderCRC32, which is zero while the header's CRC32 is computed
+const GPT_HEADER_CRC32: usize = 16;
+/// The bytes of a GPT entry's fields (UEFI 2.11 Table 5.6), the least SizeOfPartitionEntry
+const GPT_ENTRY_SIZE: u32 = 128;
+/// The largest entry array that uefisettings reads, 8192 entries of 128 bytes
+const MAX_ENTRY_ARRAY: usize = 1 << 20;
+/// Attributes bit 1 of a GPT entry, No Block IO Protocol (UEFI 2.11 Table 5.8)
+const NO_BLOCK_IO_PROTOCOL: u64 = 1 << 1;
+/// The PartitionTypeGUID of an unused GPT entry (UEFI 2.11 Table 5.7)
+const UNUSED_ENTRY: Guid = Guid {
+    data1: 0,
+    data2: 0,
+    data3: 0,
+    data4: [0; 8],
+};
+/// The PartitionTypeGUID of an ESP (UEFI 2.11 Table 5.7)
+const ESP_TYPE: Guid = Guid {
+    data1: 0xC12A_7328,
+    data2: 0xF81F,
+    data3: 0x11D2,
+    data4: [0xBA, 0x4B, 0x00, 0xA0, 0xC9, 0x3E, 0xC9, 0x3B],
+};
+
+/// A disk, read in logical blocks.
+pub(crate) trait BlockDevice {
+    /// The logical block size, in bytes
+    fn block_size(&self) -> u32;
+
+    /// Fills `blocks`, whole logical blocks, from LBA `lba` on.
+    fn read_blocks(&self, lba: u64, blocks: &mut [u8]) -> io::Result<()>;
+}
+
+/// Where a volume's partition lies on its disk, in bytes, as the OS reports it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct PartitionExtent {
+    pub(crate) offset: u64,
+    pub(crate) length: u64,
+}
+
+/// A disk's partition table.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct PartitionTable {
+    /// The logical block size, in bytes, at least 512
+    block_size: u64,
+    layout: Layout,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Layout {
+    Gpt(Gpt),
+    Mbr(Mbr),
+}
+
+impl PartitionTable {
+    /// The partition table of `disk`: its primary GPT if LBA 0 holds a GPT Protective record
+    /// that starts at LBA 1, else LBA 0's legacy MBR, as edk2-stable202608
+    /// PartitionDxe/Gpt.c PartitionInstallGptChildHandles tells them apart.
+    pub(crate) fn read(disk: &impl BlockDevice) -> Result<Self, PartitionTableError> {
+        let block_size = disk.block_size();
+        let block_len =
+            usize::try_from(block_size).map_err(|_| PartitionTableError::BlockSize(block_size))?;
+
+        let lba0 = read_blocks(disk, 0, block_len)?;
+        let signature = bytes_at(&lba0, MBR_SIGNATURE_OFFSET)
+            .map(u16::from_le_bytes)
+            .ok_or(PartitionTableError::BlockSize(block_size))?;
+        if signature != MBR_SIGNATURE {
+            return Err(PartitionTableError::MbrSignature(signature));
+        }
+        let mbr = Mbr::parse(&lba0).ok_or(PartitionTableError::BlockSize(block_size))?;
+
+        let layout = if mbr.protects_gpt() {
+            Layout::Gpt(Gpt::read(disk, block_len)?)
+        } else {
+            Layout::Mbr(mbr)
+        };
+        Ok(Self {
+            block_size: u64::from(block_size),
+            layout,
+        })
+    }
+
+    /// The Hard Drive node of the ESP at `extent`: the partition table entry that starts there,
+    /// refused unless it is an ESP that spans exactly `extent`.
+    pub(crate) fn esp_hard_drive(
+        &self,
+        extent: PartitionExtent,
+    ) -> Result<HardDrive, PartitionTableError> {
+        let (Some(start), Some(size)) = (self.blocks(extent.offset), self.blocks(extent.length))
+        else {
+            return Err(PartitionTableError::NotInBlocks {
+                offset: extent.offset,
+                length: extent.length,
+                block_size: self.block_size,
+            });
+        };
+        match &self.layout {
+            Layout::Gpt(gpt) => gpt.esp_hard_drive(start, size),
+            Layout::Mbr(mbr) => mbr.esp_hard_drive(start, size),
+        }
+    }
+
+    /// The logical blocks that `bytes` make, None unless whole.
+    fn blocks(&self, bytes: u64) -> Option<u64> {
+        bytes
+            .is_multiple_of(self.block_size)
+            .then(|| bytes / self.block_size)
+    }
+}
+
+/// `len` bytes, whole logical blocks, of `disk` from LBA `lba` on.
+fn read_blocks(
+    disk: &impl BlockDevice,
+    lba: u64,
+    len: usize,
+) -> Result<Vec<u8>, PartitionTableError> {
+    let mut blocks = vec![0; len];
+    disk.read_blocks(lba, &mut blocks)
+        .map_err(|error| PartitionTableError::Read { lba, len, error })?;
+    Ok(blocks)
+}
+
+/// The `N` bytes at byte `offset` of `bytes`.
+fn bytes_at<const N: usize>(bytes: &[u8], offset: usize) -> Option<[u8; N]> {
+    bytes.get(offset..)?.first_chunk().copied()
+}
+
+/// A partition table entry: a GPT entry or an MBR partition record.
+trait TableEntry {
+    /// The Partition Number of the entry's Hard Drive node, starting with 1
+    fn number(&self) -> u32;
+
+    /// The first and last LBA of the entry's partition, None if the entry is not in use.
+    fn lbas(&self) -> Option<(u64, u64)>;
+}
+
+/// The entry in use that starts at LBA `start` and its last LBA, refused unless it is the only
+/// one.
+fn entry_starting_at<E: TableEntry>(
+    entries: &[E],
+    start: u64,
+) -> Result<(&E, u64), PartitionTableError> {
+    let starting: Vec<(&E, u64)> = entries
+        .iter()
+        .filter_map(|entry| match entry.lbas()? {
+            (first, last) if first == start => Some((entry, last)),
+            _ => None,
+        })
+        .collect();
+    match starting.as_slice() {
+        [entry] => Ok(*entry),
+        [] => Err(PartitionTableError::NoPartitionAt(start)),
+        several => Err(PartitionTableError::SeveralPartitionsAt {
+            lba: start,
+            numbers: several.iter().map(|(entry, _)| entry.number()).collect(),
+        }),
+    }
+}
+
+/// Refuses the partition of `entry`, LBAs `first` to `last`, unless it spans the volume's `size`
+/// logical blocks and overlaps no other entry in use: GPT partitions must not overlap (UEFI 2.11
+/// §5.3.1), and edk2-stable202608 PartitionDxe makes no partition of overlapping GPT entries,
+/// nor of any record of an MBR with overlapping records.
+fn check_extent<E: TableEntry>(
+    entries: &[E],
+    entry: &E,
+    (first, last): (u64, u64),
+    size: u64,
+) -> Result<(), PartitionTableError> {
+    let overlapping: Vec<u32> = entries
+        .iter()
+        .filter(|other| other.number() != entry.number())
+        .filter_map(|other| match other.lbas()? {
+            (other_first, other_last) if other_first <= last && first <= other_last => {
+                Some(other.number())
+            }
+            _ => None,
+        })
+        .collect();
+    if !overlapping.is_empty() {
+        return Err(PartitionTableError::Overlap {
+            number: entry.number(),
+            overlapping,
+        });
+    }
+
+    match last.checked_sub(first).and_then(|span| span.checked_add(1)) {
+        Some(blocks) if blocks == size => Ok(()),
+        Some(_) | None => Err(PartitionTableError::SizeMismatch {
+            number: entry.number(),
+            first,
+            last,
+            volume_blocks: size,
+        }),
+    }
+}
+
+/// LBA 0's MBR: its UniqueMBRDiskSignature and its four partition records.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Mbr {
+    disk_signature: u32,
+    records: Vec<MbrRecord>,
+}
+
+/// A partition record of an MBR (UEFI 2.11 Table 5.2) and its slot, 1 to 4.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct MbrRecord {
+    slot: u32,
+    os_type: u8,
+    starting_lba: u32,
+    size_in_lba: u32,
+}
+
+impl Mbr {
+    /// The MBR in `lba0`, None if it is shorter than the 510 bytes before Signature.
+    fn parse(lba0: &[u8]) -> Option<Self> {
+        let records = lba0
+            .get(MBR_PARTITION_RECORDS..MBR_SIGNATURE_OFFSET)?
+            .chunks_exact(MBR_PARTITION_RECORD_SIZE)
+            .zip(1..)
+            .map(|(record, slot)| {
+                let [_, _, _, _, os_type, _, _, _, a, b, c, d, e, f, g, h] =
+                    <[u8; MBR_PARTITION_RECORD_SIZE]>::try_from(record).ok()?;
+                Some(MbrRecord {
+                    slot,
+                    os_type,
+                    starting_lba: u32::from_le_bytes([a, b, c, d]),
+                    size_in_lba: u32::from_le_bytes([e, f, g, h]),
+                })
+            })
+            .collect::<Option<_>>()?;
+        Some(Self {
+            disk_signature: bytes_at(lba0, MBR_DISK_SIGNATURE).map(u32::from_le_bytes)?,
+            records,
+        })
+    }
+
+    /// Whether the MBR is a protective MBR, with a GPT Protective record that starts at the
+    /// primary GPT header.
+    fn protects_gpt(&self) -> bool {
+        self.records.iter().any(|record| {
+            record.os_type == OS_TYPE_GPT_PROTECTIVE
+                && u64::from(record.starting_lba) == PRIMARY_GPT_HEADER
+        })
+    }
+
+    /// The Hard Drive node of the ESP of `size` logical blocks from LBA `start` on: its
+    /// partition record's slot, with Signature Type 0x01 (UEFI 2.11 §10.3.5.1).
+    fn esp_hard_drive(&self, start: u64, size: u64) -> Result<HardDrive, PartitionTableError> {
+        let (record, last) = entry_starting_at(&self.records, start)?;
+        if record.os_type != OS_TYPE_ESP {
+            return Err(PartitionTableError::MbrNotEsp {
+                slot: record.slot,
+                os_type: record.os_type,
+            });
+        }
+        check_extent(&self.records, record, (start, last), size)?;
+        Ok(HardDrive {
+            partition_number: record.slot,
+            start,
+            size,
+            signature: PartitionSignature::Mbr(self.disk_signature),
+        })
+    }
+}
+
+impl TableEntry for MbrRecord {
+    fn number(&self) -> u32 {
+        self.slot
+    }
+
+    /// edk2-stable202608 PartitionDxe/Mbr.c skips a record whose OSType or SizeInLBA is 0, and a
+    /// GPT Protective one.
+    fn lbas(&self) -> Option<(u64, u64)> {
+        let span = self.size_in_lba.checked_sub(1)?;
+        let first = u64::from(self.starting_lba);
+        match self.os_type {
+            0 | OS_TYPE_GPT_PROTECTIVE => None,
+            _ => Some((first, first + u64::from(span))),
+        }
+    }
+}
+
+/// The primary GPT: the usable LBAs that its header declares and its entries.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Gpt {
+    first_usable_lba: u64,
+    last_usable_lba: u64,
+    entries: Vec<GptEntry>,
+}
+
+impl Gpt {
+    /// The primary GPT of `disk`, refused unless its header and entry array pass the tests of
+    /// UEFI 2.11 §5.3.2; the backup GPT is not read.
+    fn read(disk: &impl BlockDevice, block_len: usize) -> Result<Self, PartitionTableError> {
+        let block = read_blocks(disk, PRIMARY_GPT_HEADER, block_len)?;
+        let header = GptHeader::read(&block)
+            .ok_or_else(|| PartitionTableError::BlockSize(disk.block_size()))?;
+        header.check(&block)?;
+        Ok(Self {
+            first_usable_lba: header.first_usable_lba,
+            last_usable_lba: header.last_usable_lba,
+            entries: header.read_entries(disk, block_len)?,
+        })
+    }
+
+    /// The Hard Drive node of the ESP of `size` logical blocks from LBA `start` on: its GPT
+    /// entry's index plus 1, as edk2-stable202608 PartitionDxe/Gpt.c numbers it, with its
+    /// UniquePartitionGUID (UEFI 2.11 §10.3.5.1).
+    fn esp_hard_drive(&self, start: u64, size: u64) -> Result<HardDrive, PartitionTableError> {
+        let (entry, last) = entry_starting_at(&self.entries, start)?;
+        if entry.partition_type != ESP_TYPE {
+            return Err(PartitionTableError::GptNotEsp {
+                number: entry.number,
+                partition_type: entry.partition_type,
+            });
+        }
+        // firmware must not produce an EFI_BLOCK_IO_PROTOCOL device for such a partition, so
+        // UEFI makes no file system mapping for it (UEFI 2.11 Table 5.8)
+        if entry.attributes & NO_BLOCK_IO_PROTOCOL != 0 {
+            return Err(PartitionTableError::GptNoBlockIo(entry.number));
+        }
+        let usable = self.first_usable_lba..=self.last_usable_lba;
+        if start > last || !usable.contains(&start) || !usable.contains(&last) {
+            return Err(PartitionTableError::GptOutsideUsable {
+                number: entry.number,
+                first: start,
+                last,
+                first_usable: self.first_usable_lba,
+                last_usable: self.last_usable_lba,
+            });
+        }
+        check_extent(&self.entries, entry, (start, last), size)?;
+        Ok(HardDrive {
+            partition_number: entry.number,
+            start,
+            size,
+            signature: PartitionSignature::Gpt(entry.unique_partition),
+        })
+    }
+}
+
+/// The fields of a GPT header (UEFI 2.11 Table 5.5) that it is checked by, that locate its
+/// entry array and that bound the partitions.
+struct GptHeader {
+    signature: u64,
+    revision: u32,
+    header_size: u32,
+    header_crc32: u32,
+    my_lba: u64,
+    first_usable_lba: u64,
+    last_usable_lba: u64,
+    partition_entry_lba: u64,
+    number_of_partition_entries: u32,
+    size_of_partition_entry: u32,
+    partition_entry_array_crc32: u32,
+}
+
+impl GptHeader {
+    /// The fields at their byte offsets in `block`, None if it is shorter than 92 bytes.
+    fn read(block: &[u8]) -> Option<Self> {
+        let u32_at = |offset| bytes_at(block, offset).map(u32::from_le_bytes);
+        let u64_at = |offset| bytes_at(block, offset).map(u64::from_le_bytes);
+        Some(Self {
+            signature: u64_at(0)?,
+            revision: u32_at(8)?,
+            header_size: u32_at(12)?,
+            header_crc32: u32_at(GPT_HEADER_CRC32)?,
+            my_lba: u64_at(24)?,
+            first_usable_lba: u64_at(40)?,
+            last_usable_lba: u64_at(48)?,
+            partition_entry_lba: u64_at(72)?,
+            number_of_partition_entries: u32_at(80)?,
+            size_of_partition_entry: u32_at(84)?,
+            partition_entry_array_crc32: u32_at(88)?,
+        })
+    }
+
+    /// Refuses the header in `block` unless it is a revision 1.0 header that covers its fields
+    /// and fits the block, and passes the header tests of UEFI 2.11 §5.3.2: its Signature,
+    /// HeaderCRC32 and MyLBA. SizeOfPartitionEntry must be 128 × 2^n.
+    fn check(&self, block: &[u8]) -> Result<(), PartitionTableError> {
+        if self.signature != GPT_SIGNATURE {
+            return Err(PartitionTableError::GptSignature(self.signature));
+        }
+        if self.revision != GPT_REVISION {
+            return Err(PartitionTableError::GptRevision(self.revision));
+        }
+        let header = usize::try_from(self.header_size)
+            .ok()
+            .filter(|size| *size >= GPT_HEADER_SIZE)
+            .and_then(|size| block.get(..size))
+            .ok_or(PartitionTableError::GptHeaderSize {
+                size: self.header_size,
+                block_size: block.len(),
+            })?;
+
+        let mut zeroed = header.to_vec();
+        zeroed
+            .iter_mut()
+            .skip(GPT_HEADER_CRC32)
+            .take(size_of::<u32>())
+            .for_each(|byte| *byte = 0);
+        let computed = crc32fast::hash(&zeroed);
+        if computed != self.header_crc32 {
+            return Err(PartitionTableError::GptHeaderCrc {
+                stored: self.header_crc32,
+                computed,
+            });
+        }
+
+        if self.my_lba != PRIMARY_GPT_HEADER {
+            return Err(PartitionTableError::GptMyLba(self.my_lba));
+        }
+        if self.size_of_partition_entry < GPT_ENTRY_SIZE
+            || !self.size_of_partition_entry.is_power_of_two()
+        {
+            return Err(PartitionTableError::GptEntrySize(
+                self.size_of_partition_entry,
+            ));
+        }
+        Ok(())
+    }
+
+    /// The entries of the entry array, refused unless the array's CRC32 is
+    /// PartitionEntryArrayCRC32 (UEFI 2.11 §5.3.2).
+    fn read_entries(
+        &self,
+        disk: &impl BlockDevice,
+        block_len: usize,
+    ) -> Result<Vec<GptEntry>, PartitionTableError> {
+        let entry_size = usize::try_from(self.size_of_partition_entry)
+            .map_err(|_| self.entry_array_too_large())?;
+        let array_len = usize::try_from(self.number_of_partition_entries)
+            .ok()
+            .and_then(|entries| entries.checked_mul(entry_size))
+            .filter(|len| *len <= MAX_ENTRY_ARRAY)
+            .ok_or_else(|| self.entry_array_too_large())?;
+        let blocks_len = array_len
+            .div_ceil(block_len)
+            .checked_mul(block_len)
+            .ok_or_else(|| self.entry_array_too_large())?;
+
+        let mut array = read_blocks(disk, self.partition_entry_lba, blocks_len)?;
+        array.truncate(array_len);
+        let computed = crc32fast::hash(&array);
+        if computed != self.partition_entry_array_crc32 {
+            return Err(PartitionTableError::GptEntryArrayCrc {
+                stored: self.partition_entry_array_crc32,
+                computed,
+            });
+        }
+
+        array
+            .chunks_exact(entry_size)
+            .zip(1..)
+            .map(|(entry, number)| {
+                GptEntry::read(entry, number).ok_or(PartitionTableError::GptEntrySize(
+                    self.size_of_partition_entry,
+                ))
+            })
+            .collect()
+    }
+
+    /// The refusal of an entry array larger than uefisettings reads.
+    fn entry_array_too_large(&self) -> PartitionTableError {
+        PartitionTableError::GptEntryArrayTooLarge {
+            entries: self.number_of_partition_entries,
+            entry_size: self.size_of_partition_entry,
+        }
+    }
+}
+
+/// A GPT entry (UEFI 2.11 Table 5.6) and its Partition Number, its index in the array plus 1.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct GptEntry {
+    number: u32,
+    partition_type: Guid,
+    unique_partition: Guid,
+    starting_lba: u64,
+    ending_lba: u64,
+    attributes: u64,
+}
+
+impl GptEntry {
+    /// The entry whose fields start `bytes`, None if it is shorter than the 56 bytes before
+    /// PartitionName.
+    fn read(bytes: &[u8], number: u32) -> Option<Self> {
+        let u64_at = |offset| bytes_at(bytes, offset).map(u64::from_le_bytes);
+        Some(Self {
+            number,
+            partition_type: bytes_at(bytes, 0).map(Guid::from)?,
+            unique_partition: bytes_at(bytes, 16).map(Guid::from)?,
+            starting_lba: u64_at(32)?,
+            ending_lba: u64_at(40)?,
+            attributes: u64_at(48)?,
+        })
+    }
+}
+
+impl TableEntry for GptEntry {
+    fn number(&self) -> u32 {
+        self.number
+    }
+
+    /// An entry whose PartitionTypeGUID is zero is not in use (UEFI 2.11 Table 5.6).
+    fn lbas(&self) -> Option<(u64, u64)> {
+        (self.partition_type != UNUSED_ENTRY).then_some((self.starting_lba, self.ending_lba))
+    }
+}
+
+/// Why a disk's partition table cannot be read, or names no ESP at a volume's extent.
+#[derive(Debug, Error)]
+pub(crate) enum PartitionTableError {
+    #[error("a logical block of {0} bytes is shorter than the 512 bytes of an MBR")]
+    BlockSize(u32),
+    #[error("cannot read {len} bytes of the disk from LBA {lba}: {error}")]
+    Read {
+        lba: u64,
+        len: usize,
+        error: io::Error,
+    },
+    #[error("LBA 0 holds no MBR: its Signature is {0:#06X}, not 0xAA55")]
+    MbrSignature(u16),
+    #[error("the primary GPT header's Signature is {0:#018X}, not \"EFI PART\"")]
+    GptSignature(u64),
+    #[error("the primary GPT header's Revision is {0:#010X}, not 1.0 (0x00010000)")]
+    GptRevision(u32),
+    #[error(
+        "the primary GPT header's HeaderSize {size} is outside 92 to the {block_size} bytes of a \
+         logical block"
+    )]
+    GptHeaderSize { size: u32, block_size: usize },
+    #[error(
+        "the primary GPT header's HeaderCRC32 is {stored:#010X}, but the header's CRC32 is \
+         {computed:#010X}"
+    )]
+    GptHeaderCrc { stored: u32, computed: u32 },
+    #[error("the primary GPT header's MyLBA is {0}, not 1")]
+    GptMyLba(u64),
+    #[error("the primary GPT header's SizeOfPartitionEntry {0} is not 128 × 2^n")]
+    GptEntrySize(u32),
+    #[error(
+        "the GPT entry array of {entries} entries of {entry_size} bytes exceeds the {limit} \
+         bytes that uefisettings reads",
+        limit = MAX_ENTRY_ARRAY
+    )]
+    GptEntryArrayTooLarge { entries: u32, entry_size: u32 },
+    #[error(
+        "the primary GPT header's PartitionEntryArrayCRC32 is {stored:#010X}, but the entry \
+         array's CRC32 is {computed:#010X}"
+    )]
+    GptEntryArrayCrc { stored: u32, computed: u32 },
+    #[error(
+        "the partition at byte {offset} of its disk, {length} bytes long, is no whole number of \
+         the disk's {block_size}-byte logical blocks"
+    )]
+    NotInBlocks {
+        offset: u64,
+        length: u64,
+        block_size: u64,
+    },
+    #[error("no partition table entry in use starts at LBA {0}")]
+    NoPartitionAt(u64),
+    #[error("partition table entries {numbers:?} all start at LBA {lba}")]
+    SeveralPartitionsAt { lba: u64, numbers: Vec<u32> },
+    #[error(
+        "GPT entry {number} has PartitionTypeGUID {partition_type}, not the EFI System \
+         Partition's {ESP_TYPE}"
+    )]
+    GptNotEsp { number: u32, partition_type: Guid },
+    #[error(
+        "MBR partition record {slot} has OSType {os_type:#04X}, not 0xEF (UEFI system partition)"
+    )]
+    MbrNotEsp { slot: u32, os_type: u8 },
+    #[error(
+        "GPT entry {0} has Attributes bit 1 (No Block IO Protocol) set, so firmware makes no \
+         EFI_BLOCK_IO_PROTOCOL for its partition"
+    )]
+    GptNoBlockIo(u32),
+    #[error(
+        "GPT entry {number} spans LBA {first} to {last}, which is no range inside the usable \
+         LBAs {first_usable} to {last_usable}"
+    )]
+    GptOutsideUsable {
+        number: u32,
+        first: u64,
+        last: u64,
+        first_usable: u64,
+        last_usable: u64,
+    },
+    #[error("partition table entry {number} overlaps entries {overlapping:?}")]
+    Overlap { number: u32, overlapping: Vec<u32> },
+    #[error(
+        "partition table entry {number} spans LBA {first} to {last}, but the volume spans \
+         {volume_blocks} logical blocks from LBA {first}"
+    )]
+    SizeMismatch {
+        number: u32,
+        first: u64,
+        last: u64,
+        volume_blocks: u64,
+    },
+}
+
+/// A mounted EFI system partition: its mount point and the Hard Drive node of its partition.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct MountedEsp {
+    pub(crate) mount_point: PathBuf,
+    pub(crate) hard_drive: HardDrive,
+}
+
+impl MountedEsp {
+    /// Writes the entries of uefisettings' directory to the disk.
+    #[cfg(unix)]
+    fn sync_directory(&self) -> io::Result<()> {
+        File::open(self.directory())?.sync_all()
+    }
+
+    /// Nothing: on Windows, the file's sync_all already wrote its directory entry, those of its
+    /// parent directories and the FAT (FatCommonFlushBuffers of a UserFileOpen, filesys/fastfat/
+    /// flush.c of Microsoft's Windows-driver-samples).
+    #[cfg(windows)]
+    fn sync_directory(&self) -> io::Result<()> {
+        Ok(())
+    }
+
+    /// uefisettings' directory on the ESP.
+    fn directory(&self) -> PathBuf {
+        self.path_of(IMAGE_DIRECTORY)
+    }
+
+    /// The path through the mount point of the directory that the File Path `directory` names.
+    fn path_of(&self, directory: &str) -> PathBuf {
+        directory
+            .split('\\')
+            .fold(self.mount_point.clone(), |path, component| {
+                path.join(component)
+            })
+    }
+
+    /// The File Paths of the files in the directory that the File Path `directory` names; none
+    /// if it is missing.
+    fn files_in(&self, directory: &str) -> Result<Vec<String>> {
+        let path = self.path_of(directory);
+        let entries = match fs::read_dir(&path) {
+            Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(Vec::new()),
+            entries => entries.with_context(|| format!("read {}", path.display()))?,
+        };
+        entries
+            .map(|entry| {
+                let name = entry
+                    .with_context(|| format!("read {}", path.display()))?
+                    .file_name();
+                let name = name.to_str().ok_or_else(|| {
+                    anyhow!(
+                        "{} holds a file named in no UTF-8: {name:?}",
+                        path.display()
+                    )
+                })?;
+                Ok(format!("{directory}\\{name}"))
+            })
+            .collect()
+    }
+
+    /// The file that the File Path `path` names, refused unless it names a file of uefisettings'
+    /// directory.
+    fn file(&self, path: &str) -> Result<PathBuf> {
+        path.strip_prefix(IMAGE_DIRECTORY)
+            .and_then(|rest| rest.strip_prefix('\\'))
+            .filter(|name| !matches!(*name, "" | "." | "..") && !name.contains(['\\', '/']))
+            .map(|name| self.directory().join(name))
+            .ok_or_else(|| anyhow!("{path:?} names no file of {IMAGE_DIRECTORY}"))
+    }
+}
+
+impl StagedFiles for MountedEsp {
+    fn list(&self) -> Result<Vec<String>> {
+        self.files_in(IMAGE_DIRECTORY)
+    }
+
+    /// The FAT file system of the ESP ignores letter case, as UEFI 2.11 §8.5.5 does for
+    /// CAPSULE_DIRECTORY.
+    fn capsules(&self) -> Result<Vec<String>> {
+        self.files_in(CAPSULE_DIRECTORY)
+    }
+
+    fn sha256(&self, path: &str) -> Result<Option<Sha256Digest>> {
+        let file = self.file(path)?;
+        match fs::read(&file) {
+            Ok(bytes) => Ok(Some(Sha256Digest(Sha256::digest(bytes).into()))),
+            Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(None),
+            Err(error) => Err(error).with_context(|| format!("read {}", file.display())),
+        }
+    }
+
+    fn delete(&self, path: &str) -> Result<()> {
+        let file = self.file(path)?;
+        fs::remove_file(&file).with_context(|| format!("delete {}", file.display()))?;
+        let directory = self.directory();
+        match fs::remove_dir(&directory) {
+            Err(error) if error.kind() == io::ErrorKind::DirectoryNotEmpty => Ok(()),
+            removed => removed.with_context(|| format!("delete {}", directory.display())),
+        }
+    }
+
+    fn place(&self, path: &str, image: &[u8]) -> Result<Sha256Digest> {
+        let file = self.file(path)?;
+        let directory = self.directory();
+        fs::create_dir_all(&directory)
+            .with_context(|| format!("create {}", directory.display()))?;
+        let mut created = File::options()
+            .write(true)
+            .create_new(true)
+            .open(&file)
+            .with_context(|| format!("create {}", file.display()))?;
+        let written = created
+            .write_all(image)
+            .and_then(|()| created.sync_all())
+            .and_then(|()| self.sync_directory())
+            .and_then(|()| fs::read(&file));
+        match written {
+            Ok(bytes) => Ok(Sha256Digest(Sha256::digest(bytes).into())),
+            Err(error) => {
+                let removed = match fs::remove_file(&file) {
+                    Ok(()) => "deleted it".to_owned(),
+                    Err(error) => format!("could not delete it: {error}"),
+                };
+                Err(error).with_context(|| format!("write {}, then {removed}", file.display()))
+            }
+        }
+    }
+}
+
+/// The Hard Drive node of the device path of the Boot#### that BootCurrent names; None without
+/// BootCurrent, or if that device path holds no Hard Drive node.
+pub(crate) fn boot_current_hard_drive(variables: &impl VariableData) -> Result<Option<HardDrive>> {
+    let Some(option) = boot_current(variables)? else {
+        return Ok(None);
+    };
+    let contents = variables
+        .variable_data(&option.key())?
+        .ok_or_else(|| anyhow!("BootCurrent names {option}, which is absent"))?;
+    LoadOption::decode(contents.data())
+        .and_then(|load_option| load_option.file_paths.hard_drive())
+        .with_context(|| format!("BootCurrent names {option}, which is malformed"))
+}
+
+/// Whether the Hard Drive node `named` names the partition of `hard_drive`.
+fn names_partition(named: &HardDrive, hard_drive: &HardDrive) -> bool {
+    match (named.signature, hard_drive.signature) {
+        (PartitionSignature::Gpt(named), PartitionSignature::Gpt(partition)) => named == partition,
+        (PartitionSignature::Mbr(named_disk), PartitionSignature::Mbr(disk)) => {
+            named_disk == disk && named.partition_number == hard_drive.partition_number
+        }
+        (
+            PartitionSignature::Gpt(_),
+            PartitionSignature::Mbr(_) | PartitionSignature::Other { .. },
+        )
+        | (
+            PartitionSignature::Mbr(_),
+            PartitionSignature::Gpt(_) | PartitionSignature::Other { .. },
+        )
+        | (
+            PartitionSignature::Other { .. },
+            PartitionSignature::Gpt(_)
+            | PartitionSignature::Mbr(_)
+            | PartitionSignature::Other { .. },
+        ) => false,
+    }
+}
+
+/// The partition that `hard_drive` names, in words.
+pub(crate) fn described(hard_drive: &HardDrive) -> String {
+    match hard_drive.signature {
+        PartitionSignature::Gpt(guid) => format!("GPT partition {guid}"),
+        PartitionSignature::Mbr(disk) => format!(
+            "MBR partition {} of disk {disk:#010X}",
+            hard_drive.partition_number
+        ),
+        PartitionSignature::Other {
+            format,
+            signature_type,
+            ..
+        } => format!(
+            "partition {} of Partition Format {format:#04X} and Signature Type \
+             {signature_type:#04X}",
+            hard_drive.partition_number
+        ),
+    }
+}
+
+/// What finds the mounted ESP that staging writes to.
+pub(crate) trait EspLocator {
+    /// The ESP whose partition the Hard Drive node of BootCurrent's Boot#### names, else, if it
+    /// names none, the only ESP; refused unless exactly one volume is that.
+    fn locate(&self, variables: &impl VariableData) -> Result<MountedEsp>;
+
+    /// `esp`, whose files staging writes through `mount_point`, where the user mounted it; refused
+    /// unless the volume there is `esp`'s.
+    fn mounted_at(&self, esp: MountedEsp, mount_point: &Path) -> Result<MountedEsp>;
+}
+
+/// Whether the partition of `hard_drive` is the ESP that staging writes to: the one that
+/// BootCurrent's Hard Drive node `named` names, else, if it names none, any ESP.
+pub(crate) fn is_wanted(named: Option<&HardDrive>, hard_drive: &HardDrive) -> bool {
+    named.is_none_or(|named| names_partition(named, hard_drive))
+}
+
+/// The ESP that staging writes to, in words, for refusals.
+pub(crate) fn wanted(named: Option<&HardDrive>) -> String {
+    match named {
+        Some(named) => format!(
+            "the EFI system partition that BootCurrent names, {}",
+            described(named)
+        ),
+        None => "an EFI system partition".to_owned(),
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use tempfile::TempDir;
+
+    use super::sfdisk_images::SfdiskImage;
+    use super::sfdisk_images::GPT_4096;
+    use super::sfdisk_images::GPT_512;
+    use super::sfdisk_images::MBR_512;
+    use super::sfdisk_images::QEMU_ESP_DISK;
+    use super::*;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+    use crate::efi_variables::load_option::DevicePathNode;
+    use crate::efi_variables::load_option::FilePathList;
+    use crate::efi_variables::load_option::LoadOptionAttributes;
+    use crate::efi_variables::load_option::Ucs2String;
+
+    const LINUX_TYPE: &str = "0FC63DAF-8483-4772-8E79-3D69D8477DE4";
+    const ESP_UNIQUE: &str = "8C78A505-BAA0-4C4A-869F-000000001A0D";
+    const OTHER_UNIQUE: &str = "8C78A505-BAA0-4C4A-869F-000000001A07";
+    /// The LastUsableLBA of gpt_disk's header
+    const LAST_USABLE: u64 = 999_998;
+
+    /// GPT_512's ESP, as its Hard Drive node names it.
+    pub(crate) fn gpt_512_esp() -> HardDrive {
+        HardDrive {
+            partition_number: 3,
+            start: 2048,
+            size: 2048,
+            signature: PartitionSignature::Gpt(
+                "8C78A505-BAA0-4C4A-869F-000000001A0E"
+                    .parse()
+                    .expect("a GUID"),
+            ),
+        }
+    }
+
+    /// Variables whose BootCurrent names Boot0001, which starts \EFI\BOOT\BOOTX64.EFI on the
+    /// partition of `hard_drive` if given.
+    pub(crate) fn booted_from(hard_drive: Option<HardDrive>) -> HeldVariables {
+        let file = DevicePathNode::FilePath(
+            Ucs2String::try_from("\\EFI\\BOOT\\BOOTX64.EFI").expect("a path"),
+        );
+        let nodes = match hard_drive {
+            Some(hard_drive) => vec![DevicePathNode::HardDrive(hard_drive), file],
+            None => vec![file],
+        };
+        let load_option = LoadOption {
+            attributes: LoadOptionAttributes::ACTIVE,
+            description: Ucs2String::try_from("an OS").expect("a description"),
+            file_paths: FilePathList::of(&nodes).expect("a FilePathList"),
+            optional_data: Vec::new(),
+        };
+        HeldVariables::default()
+            .with("BootCurrent", EFI_GLOBAL_VARIABLE, &[1, 0])
+            .with("Boot0001", EFI_GLOBAL_VARIABLE, &load_option.encode())
+    }
+
+    /// An ESP's Hard Drive node, or why there is none
+    type EspLookup = Result<HardDrive, String>;
+    /// The OSType, StartingLBA and SizeInLBA of each partition record of an MBR
+    type MbrRecords = [(u8, u32, u32); 4];
+
+    /// A disk image in memory.
+    struct DiskImage {
+        block_size: u32,
+        bytes: Vec<u8>,
+    }
+
+    impl BlockDevice for DiskImage {
+        fn block_size(&self) -> u32 {
+            self.block_size
+        }
+
+        fn read_blocks(&self, lba: u64, blocks: &mut [u8]) -> io::Result<()> {
+            let len = blocks.len();
+            let bytes = usize::try_from(lba)
+                .ok()
+                .and_then(|lba| lba.checked_mul(usize::try_from(self.block_size).ok()?))
+                .and_then(|start| self.bytes.get(start..start.checked_add(len)?))
+                .ok_or(io::ErrorKind::UnexpectedEof)?;
+            blocks.copy_from_slice(bytes);
+            Ok(())
+        }
+    }
+
+    impl From<&SfdiskImage> for DiskImage {
+        fn from(image: &SfdiskImage) -> Self {
+            Self {
+                block_size: image.block_size,
+                bytes: image.bytes(),
+            }
+        }
+    }
+
+    /// A GPT entry that gpt_disk writes at its index in the array.
+    struct Entry {
+        index: usize,
+        partition_type: &'static str,
+        unique: &'static str,
+        first: u64,
+        last: u64,
+        attributes: u64,
+    }
+
+    fn esp_entry(index: usize, first: u64, last: u64) -> Entry {
+        Entry {
+            index,
+            partition_type: "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
+            unique: ESP_UNIQUE,
+            first,
+            last,
+            attributes: 0,
+        }
+    }
+
+    fn linux_entry(index: usize, first: u64, last: u64) -> Entry {
+        Entry {
+            index,
+            partition_type: LINUX_TYPE,
+            unique: OTHER_UNIQUE,
+            first,
+            last,
+            attributes: 0,
+        }
+    }
+
+    fn guid(text: &str) -> Guid {
+        text.parse().expect("a GUID in registry format")
+    }
+
+    /// A disk of `block_size`-byte blocks: a protective MBR, the primary GPT header in LBA 1
+    /// and from LBA 2 on an array of `count` entries of `entry_size` bytes that holds
+    /// `entries`, with both CRC32s computed.
+    fn gpt_disk(
+        block_size: usize,
+        entry_size: usize,
+        count: usize,
+        entries: &[Entry],
+    ) -> DiskImage {
+        let array_len = count * entry_size;
+        let array_blocks = array_len.div_ceil(block_size);
+        let mut bytes = vec![0; (2 + array_blocks) * block_size];
+
+        // the GPT Protective record, from LBA 1 over the whole disk, and the Signature 0xAA55
+        bytes[450] = 0xEE;
+        bytes[454..458].copy_from_slice(&1u32.to_le_bytes());
+        bytes[458..462].copy_from_slice(&u32::MAX.to_le_bytes());
+        bytes[510..512].copy_from_slice(&[0x55, 0xAA]);
+
+        let mut array = vec![0; array_len];
+        for entry in entries {
+            let fields = [
+                &<[u8; 16]>::from(guid(entry.partition_type))[..],
+                &<[u8; 16]>::from(guid(entry.unique)),
+                &entry.first.to_le_bytes(),
+                &entry.last.to_le_bytes(),
+                &entry.attributes.to_le_bytes(),
+            ]
+            .concat();
+            let at = entry.index * entry_size;
+            array[at..at + fields.len()].copy_from_slice(&fields);
+        }
+        bytes[2 * block_size..2 * block_size + array_len].copy_from_slice(&array);
+
+        let first_usable = u64::try_from(2 + array_blocks).expect("the first usable LBA");
+        let header = [
+            &b"EFI PART"[..],
+            &0x0001_0000u32.to_le_bytes(),
+            &92u32.to_le_bytes(),
+            &[0; 8],
+            &1u64.to_le_bytes(),
+            &(LAST_USABLE + 1).to_le_bytes(),
+            &first_usable.to_le_bytes(),
+            &LAST_USABLE.to_le_bytes(),
+            &<[u8; 16]>::from(guid("8C78A505-BAA0-4C4A-869F-000000001A00")),
+            &2u64.to_le_bytes(),
+            &u32::try_from(count).expect("the entry count").to_le_bytes(),
+            &u32::try_from(entry_size)
+                .expect("the entry size")
+                .to_le_bytes(),
+            &crc32fast::hash(&array).to_le_bytes(),
+        ]
+        .concat();
+        bytes[block_size..block_size + header.len()].copy_from_slice(&header);
+        set_header_crc32(&mut bytes[block_size..2 * block_size]);
+        DiskImage {
+            block_size: u32::try_from(block_size).expect("the block size"),
+            bytes,
+        }
+    }
+
+    /// An MBR disk whose four partition records are these OSTypes, StartingLBAs and SizeInLBAs.
+    fn mbr_disk(records: MbrRecords) -> DiskImage {
+        let mut bytes = vec![0; 512];
+        bytes[440..444].copy_from_slice(&0x1234_5678u32.to_le_bytes());
+        for (record, (os_type, starting_lba, size_in_lba)) in
+            bytes[446..510].chunks_exact_mut(16).zip(records)
+        {
+            record[4] = os_type;
+            record[8..12].copy_from_slice(&starting_lba.to_le_bytes());
+            record[12..16].copy_from_slice(&size_in_lba.to_le_bytes());
+        }
+        bytes[510..512].copy_from_slice(&[0x55, 0xAA]);
+        DiskImage {
+            block_size: 512,
+            bytes,
+        }
+    }
+
+    /// Sets the HeaderCRC32 of the GPT header that starts `block` to the CRC32 of its HeaderSize
+    /// bytes with HeaderCRC32 zero, if they fit the block.
+    fn set_header_crc32(block: &mut [u8]) {
+        let size = u32::from_le_bytes(block[12..16].try_into().expect("HeaderSize's 4 bytes"));
+        let Some(header) = block.get(..usize::try_from(size).expect("HeaderSize")) else {
+            return;
+        };
+        let mut zeroed = header.to_vec();
+        zeroed[16..20].fill(0);
+        let crc32 = crc32fast::hash(&zeroed);
+        block[16..20].copy_from_slice(&crc32.to_le_bytes());
+    }
+
+    /// GPT_512 with `edit` applied to its primary GPT header block, LBA 1, whose HeaderCRC32 is
+    /// then computed again.
+    fn gpt_512_with_header(edit: impl FnOnce(&mut [u8])) -> DiskImage {
+        let mut disk = DiskImage::from(&GPT_512);
+        let block = &mut disk.bytes[512..1024];
+        edit(block);
+        set_header_crc32(block);
+        disk
+    }
+
+    /// The `size` blocks of `block_size` bytes from LBA `start` on, in bytes.
+    fn extent(block_size: u64, start: u64, size: u64) -> PartitionExtent {
+        PartitionExtent {
+            offset: start * block_size,
+            length: size * block_size,
+        }
+    }
+
+    /// The Hard Drive node of the ESP of `disk` at `extent`, or why there is none.
+    fn esp_of(disk: &DiskImage, extent: PartitionExtent) -> EspLookup {
+        let table = PartitionTable::read(disk).map_err(|err| err.to_string())?;
+        table.esp_hard_drive(extent).map_err(|err| err.to_string())
+    }
+
+    /// The Hard Drive node of a GPT disk's ESP, with ESP_UNIQUE.
+    fn gpt_esp(partition_number: u32, start: u64, size: u64) -> EspLookup {
+        Ok(HardDrive {
+            partition_number,
+            start,
+            size,
+            signature: PartitionSignature::Gpt(guid(ESP_UNIQUE)),
+        })
+    }
+
+    #[test]
+    fn the_esp_type_guid_is_what_sfdisk_writes_as_an_esp_entry_s_type() {
+        let type_bytes = |offset: usize| -> [u8; 16] {
+            let (_, run) = GPT_512
+                .runs
+                .iter()
+                .find(|(at, _)| *at == offset)
+                .expect("the entry's run");
+            run[..16].try_into().expect("PartitionTypeGUID's 16 bytes")
+        };
+        // GPT_512's entry 3, at byte 0x500, is the ESP; entry 1, at byte 0x400, is not
+        let esp = type_bytes(0x500);
+        let linux = type_bytes(0x400);
+
+        assert_eq!(Guid::from(esp), ESP_TYPE, "entry 3's PartitionTypeGUID");
+        assert_eq!(<[u8; 16]>::from(ESP_TYPE), esp, "ESP_TYPE's bytes");
+        assert_eq!(
+            ESP_TYPE.to_string(),
+            "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
+            "ESP_TYPE in registry format"
+        );
+        assert_eq!(
+            Guid::from(linux),
+            guid(LINUX_TYPE),
+            "entry 1's PartitionTypeGUID"
+        );
+        assert_ne!(Guid::from(linux), ESP_TYPE, "entry 1 is no ESP");
+    }
+
+    #[test]
+    fn sfdisk_gpt_disks_name_their_esp_by_its_entry_s_index() {
+        let disk = DiskImage::from(&GPT_512);
+        // entry 3, after the unused entry 2, is the first partition by offset
+        assert_eq!(
+            esp_of(&disk, extent(512, 2048, 2048)),
+            Ok(HardDrive {
+                partition_number: 3,
+                start: 2048,
+                size: 2048,
+                signature: PartitionSignature::Gpt(guid("8C78A505-BAA0-4C4A-869F-000000001A0E")),
+            }),
+            "GPT_512's ESP"
+        );
+        assert_eq!(
+            esp_of(&disk, extent(512, 4096, 2048)),
+            Err(format!(
+                "GPT entry 1 has PartitionTypeGUID {LINUX_TYPE}, not the EFI System Partition's \
+                 C12A7328-F81F-11D2-BA4B-00A0C93EC93B"
+            )),
+            "GPT_512's Linux partition"
+        );
+
+        let disk = DiskImage::from(&GPT_4096);
+        assert_eq!(
+            esp_of(&disk, extent(4096, 512, 256)),
+            Ok(HardDrive {
+                partition_number: 1,
+                start: 512,
+                size: 256,
+                signature: PartitionSignature::Gpt(guid("8C78A505-BAA0-4C4A-869F-000000001A0A")),
+            }),
+            "GPT_4096's ESP"
+        );
+
+        // the QEMU tests' disk, whose firmware starts a staged image by this node
+        let disk = DiskImage::from(&QEMU_ESP_DISK);
+        assert_eq!(
+            esp_of(&disk, extent(512, 2048, 81920)),
+            Ok(HardDrive {
+                partition_number: 2,
+                start: 2048,
+                size: 81920,
+                signature: PartitionSignature::Gpt(guid("8C78A505-BAA0-4C4A-869F-000000001A10")),
+            }),
+            "QEMU_ESP_DISK's ESP"
+        );
+    }
+
+    #[test]
+    fn an_sfdisk_mbr_disk_names_its_esp_by_its_record_s_slot() {
+        let disk = DiskImage::from(&MBR_512);
+
+        assert_eq!(
+            esp_of(&disk, extent(512, 4096, 2048)),
+            Ok(HardDrive {
+                partition_number: 2,
+                start: 4096,
+                size: 2048,
+                signature: PartitionSignature::Mbr(0x5EC7_A1B2),
+            }),
+            "MBR_512's ESP"
+        );
+        assert_eq!(
+            esp_of(&disk, extent(512, 2048, 2048)),
+            Err("MBR partition record 1 has OSType 0x83, not 0xEF (UEFI system partition)".into()),
+            "MBR_512's Linux partition"
+        );
+    }
+
+    #[test]
+    fn a_gpt_header_that_fails_a_test_refuses_the_disk() {
+        type Edit = fn(&mut [u8]);
+        let cases: [(&str, Edit, &str); 9] = [
+            (
+                "Signature",
+                |block| block[0] = b'F',
+                "the primary GPT header's Signature is 0x5452415020494646, not \"EFI PART\"",
+            ),
+            (
+                "Revision",
+                |block| block[8] = 0x01,
+                "the primary GPT header's Revision is 0x00010001, not 1.0 (0x00010000)",
+            ),
+            (
+                "HeaderSize below 92",
+                |block| block[12] = 91,
+                "the primary GPT header's HeaderSize 91 is outside 92 to the 512 bytes of a \
+                 logical block",
+            ),
+            (
+                "HeaderSize past the block",
+                |block| block[12..14].copy_from_slice(&513u16.to_le_bytes()),
+                "the primary GPT header's HeaderSize 513 is outside 92 to the 512 bytes of a \
+                 logical block",
+            ),
+            (
+                "MyLBA",
+                |block| block[24] = 2,
+                "the primary GPT header's MyLBA is 2, not 1",
+            ),
+            (
+                "SizeOfPartitionEntry a multiple of 8",
+                |block| block[84] = 136,
+                "the primary GPT header's SizeOfPartitionEntry 136 is not 128 × 2^n",
+            ),
+            (
+                "SizeOfPartitionEntry below 128",
+                |block| block[84] = 64,
+                "the primary GPT header's SizeOfPartitionEntry 64 is not 128 × 2^n",
+            ),
+            (
+                "NumberOfPartitionEntries past the limit",
+                |block| block[80..84].copy_from_slice(&8193u32.to_le_bytes()),
+                "the GPT entry array of 8193 entries of 128 bytes exceeds the 1048576 bytes \
+                 that uefisettings reads",
+            ),
+            (
+                "NumberOfPartitionEntries at the limit, past the disk",
+                |block| block[80..84].copy_from_slice(&8192u32.to_le_bytes()),
+                "cannot read 1048576 bytes of the disk from LBA 2: unexpected end of file",
+            ),
+        ];
+        for (field, edit, want) in cases {
+            let disk = gpt_512_with_header(edit);
+
+            let got = PartitionTable::read(&disk).map(|_| ());
+
+            assert_eq!(
+                got.map_err(|err| err.to_string()),
+                Err(want.into()),
+                "{field}"
+            );
+        }
+
+        // HeaderSize may be the whole block
+        let disk =
+            gpt_512_with_header(|block| block[12..14].copy_from_slice(&512u16.to_le_bytes()));
+        assert!(
+            matches!(
+                esp_of(&disk, extent(512, 2048, 2048)),
+                Ok(HardDrive {
+                    partition_number: 3,
+                    ..
+                })
+            ),
+            "HeaderSize 512"
+        );
+    }
+
+    #[test]
+    fn a_gpt_whose_stored_crc32s_differ_from_its_bytes_is_refused() {
+        // GPT_512's HeaderCRC32 and PartitionEntryArrayCRC32, as sfdisk computed them
+        const HEADER_CRC32: u32 = 0x9757_2999;
+        const ENTRY_ARRAY_CRC32: u32 = 0xEE74_E86A;
+        let crc32_at = |disk: &DiskImage, offset: usize| {
+            u32::from_le_bytes(disk.bytes[offset..offset + 4].try_into().expect("4 bytes"))
+        };
+        let sfdisk = DiskImage::from(&GPT_512);
+        assert_eq!(
+            crc32_at(&sfdisk, 512 + 16),
+            HEADER_CRC32,
+            "GPT_512's HeaderCRC32"
+        );
+        assert_eq!(
+            crc32_at(&sfdisk, 512 + 88),
+            ENTRY_ARRAY_CRC32,
+            "GPT_512's array CRC32"
+        );
+
+        // a DiskGUID byte, inside HeaderSize
+        let mut disk = DiskImage::from(&GPT_512);
+        disk.bytes[512 + 56] ^= 1;
+        let got = PartitionTable::read(&disk);
+        assert!(
+            matches!(
+                got,
+                Err(PartitionTableError::GptHeaderCrc { stored: HEADER_CRC32, computed })
+                    if computed != HEADER_CRC32
+            ),
+            "a changed DiskGUID: {got:?}"
+        );
+
+        // a reserved byte past HeaderSize is outside the header's CRC32
+        let mut disk = DiskImage::from(&GPT_512);
+        disk.bytes[512 + 100] = 1;
+        assert!(
+            matches!(
+                esp_of(&disk, extent(512, 2048, 2048)),
+                Ok(HardDrive {
+                    partition_number: 3,
+                    ..
+                })
+            ),
+            "a changed byte past HeaderSize"
+        );
+
+        // the unused entry 2's PartitionName
+        let mut disk = DiskImage::from(&GPT_512);
+        disk.bytes[1024 + 128 + 56] = b'x';
+        let got = PartitionTable::read(&disk);
+        assert!(
+            matches!(
+                got,
+                Err(PartitionTableError::GptEntryArrayCrc { stored: ENTRY_ARRAY_CRC32, computed })
+                    if computed != ENTRY_ARRAY_CRC32
+            ),
+            "a changed unused entry: {got:?}"
+        );
+    }
+
+    #[test]
+    fn entries_of_256_bytes_are_read_and_the_rest_of_the_array_s_last_block_is_not() {
+        // 5 entries of 256 bytes end 256 bytes into the array's third block
+        let mut disk = gpt_disk(
+            512,
+            256,
+            5,
+            &[linux_entry(0, 10, 99), esp_entry(4, 100, 199)],
+        );
+        disk.bytes[2 * 512 + 5 * 256..5 * 512].fill(0xA5);
+
+        assert_eq!(
+            esp_of(&disk, extent(512, 100, 100)),
+            gpt_esp(5, 100, 100),
+            "entry 5"
+        );
+    }
+
+    #[test]
+    fn a_gpt_esp_must_be_a_partition_that_firmware_makes() {
+        let esp_with = |attributes| Entry {
+            attributes,
+            ..esp_entry(0, 100, 199)
+        };
+        let unused = Entry {
+            partition_type: "00000000-0000-0000-0000-000000000000",
+            ..linux_entry(2, 150, 160)
+        };
+        let cases: [(&str, Vec<Entry>, PartitionExtent, EspLookup); 13] = [
+            (
+                "Required Partition, Legacy BIOS Bootable and a type-specific bit",
+                vec![esp_with(1 | (1 << 2) | (1 << 60))],
+                extent(512, 100, 100),
+                gpt_esp(1, 100, 100),
+            ),
+            (
+                "No Block IO Protocol",
+                vec![esp_with(1 << 1)],
+                extent(512, 100, 100),
+                Err(
+                    "GPT entry 1 has Attributes bit 1 (No Block IO Protocol) set, so firmware \
+                     makes no EFI_BLOCK_IO_PROTOCOL for its partition"
+                        .into(),
+                ),
+            ),
+            (
+                "below FirstUsableLBA",
+                vec![esp_entry(0, 5, 99)],
+                extent(512, 5, 95),
+                Err(
+                    "GPT entry 1 spans LBA 5 to 99, which is no range inside the usable LBAs 6 \
+                     to 999998"
+                        .into(),
+                ),
+            ),
+            (
+                "past LastUsableLBA",
+                vec![esp_entry(0, 999_990, 999_999)],
+                extent(512, 999_990, 10),
+                Err(
+                    "GPT entry 1 spans LBA 999990 to 999999, which is no range inside the \
+                     usable LBAs 6 to 999998"
+                        .into(),
+                ),
+            ),
+            (
+                "EndingLBA before StartingLBA",
+                vec![esp_entry(0, 100, 99)],
+                extent(512, 100, 1),
+                Err(
+                    "GPT entry 1 spans LBA 100 to 99, which is no range inside the usable LBAs \
+                     6 to 999998"
+                        .into(),
+                ),
+            ),
+            (
+                "overlapping a later partition",
+                vec![esp_entry(0, 100, 199), linux_entry(1, 199, 299)],
+                extent(512, 100, 100),
+                Err("partition table entry 1 overlaps entries [2]".into()),
+            ),
+            (
+                "overlapping an earlier partition",
+                vec![linux_entry(0, 10, 100), esp_entry(1, 100, 199)],
+                extent(512, 100, 100),
+                Err("partition table entry 2 overlaps entries [1]".into()),
+            ),
+            (
+                "between adjacent partitions and over an unused entry's LBAs",
+                vec![
+                    linux_entry(0, 10, 99),
+                    esp_entry(1, 100, 199),
+                    unused,
+                    linux_entry(3, 200, 299),
+                ],
+                extent(512, 100, 100),
+                gpt_esp(2, 100, 100),
+            ),
+            (
+                "starting where another partition starts",
+                vec![esp_entry(0, 100, 199), esp_entry(3, 100, 149)],
+                extent(512, 100, 100),
+                Err("partition table entries [1, 4] all start at LBA 100".into()),
+            ),
+            (
+                "where only an unused entry starts",
+                vec![esp_entry(0, 100, 199), unused_at(150)],
+                extent(512, 150, 11),
+                Err("no partition table entry in use starts at LBA 150".into()),
+            ),
+            (
+                "smaller than the volume",
+                vec![esp_entry(0, 100, 199)],
+                extent(512, 100, 101),
+                Err(
+                    "partition table entry 1 spans LBA 100 to 199, but the volume spans 101 \
+                     logical blocks from LBA 100"
+                        .into(),
+                ),
+            ),
+            (
+                "a volume offset in no whole block",
+                vec![esp_entry(0, 100, 199)],
+                PartitionExtent {
+                    offset: 100 * 512 + 1,
+                    length: 100 * 512,
+                },
+                Err(
+                    "the partition at byte 51201 of its disk, 51200 bytes long, is no whole \
+                     number of the disk's 512-byte logical blocks"
+                        .into(),
+                ),
+            ),
+            (
+                "a volume length in no whole block",
+                vec![esp_entry(0, 100, 199)],
+                PartitionExtent {
+                    offset: 100 * 512,
+                    length: 100 * 512 - 256,
+                },
+                Err(
+                    "the partition at byte 51200 of its disk, 50944 bytes long, is no whole \
+                     number of the disk's 512-byte logical blocks"
+                        .into(),
+                ),
+            ),
+        ];
+        for (case, entries, extent, want) in cases {
+            let disk = gpt_disk(512, 128, 16, &entries);
+
+            assert_eq!(esp_of(&disk, extent), want, "{case}");
+        }
+    }
+
+    /// An unused entry, PartitionTypeGUID zero, whose other fields name a partition from LBA
+    /// `first` on.
+    fn unused_at(first: u64) -> Entry {
+        Entry {
+            partition_type: "00000000-0000-0000-0000-000000000000",
+            ..linux_entry(2, first, first + 10)
+        }
+    }
+
+    #[test]
+    fn an_mbr_esp_must_be_a_record_in_use_alone_that_spans_the_volume() {
+        let esp_at_100 = Ok(HardDrive {
+            partition_number: 2,
+            start: 100,
+            size: 100,
+            signature: PartitionSignature::Mbr(0x1234_5678),
+        });
+        let empty = (0, 0, 0);
+        let cases: [(&str, MbrRecords, EspLookup); 7] = [
+            (
+                "beside others, after an empty slot",
+                [empty, (0xEF, 100, 100), (0x83, 200, 50), (0x07, 1, 99)],
+                esp_at_100.clone(),
+            ),
+            (
+                "beside a GPT Protective record that does not start at LBA 1",
+                [(0xEE, 2, 1000), (0xEF, 100, 100), empty, empty],
+                esp_at_100.clone(),
+            ),
+            (
+                "overlapping another partition",
+                [empty, (0xEF, 100, 100), (0x83, 199, 50), empty],
+                Err("partition table entry 2 overlaps entries [3]".into()),
+            ),
+            (
+                "smaller than the volume",
+                [empty, (0xEF, 100, 99), empty, empty],
+                Err(
+                    "partition table entry 2 spans LBA 100 to 198, but the volume spans 100 \
+                     logical blocks from LBA 100"
+                        .into(),
+                ),
+            ),
+            (
+                "of SizeInLBA 0",
+                [empty, (0xEF, 100, 0), empty, empty],
+                Err("no partition table entry in use starts at LBA 100".into()),
+            ),
+            (
+                "of OSType 0",
+                [empty, (0x00, 100, 100), empty, empty],
+                Err("no partition table entry in use starts at LBA 100".into()),
+            ),
+            (
+                "behind a GPT Protective record that starts at LBA 1",
+                [(0xEE, 1, 1000), (0xEF, 100, 100), empty, empty],
+                Err(
+                    "the primary GPT header's Signature is 0x0000000000000000, not \"EFI PART\""
+                        .into(),
+                ),
+            ),
+        ];
+        for (case, records, want) in cases {
+            let mut disk = mbr_disk(records);
+            // LBA 1, read as a GPT header behind a protective MBR
+            disk.bytes.resize(1024, 0);
+
+            assert_eq!(esp_of(&disk, extent(512, 100, 100)), want, "{case}");
+        }
+    }
+
+    #[test]
+    fn a_disk_whose_blocks_cannot_hold_its_table_or_be_read_is_refused() {
+        for block_size in [0, 256, 511] {
+            let disk = DiskImage {
+                block_size,
+                ..DiskImage::from(&GPT_512)
+            };
+
+            let got = PartitionTable::read(&disk).map(|_| ());
+
+            assert_eq!(
+                got.map_err(|err| err.to_string()),
+                Err(format!(
+                    "a logical block of {block_size} bytes is shorter than the 512 bytes of an MBR"
+                )),
+                "block size {block_size}"
+            );
+        }
+
+        let mut disk = mbr_disk([
+            (0x83, 1, 99),
+            (0x07, 100, 100),
+            (0x0C, 200, 100),
+            (0xEF, 300, 100),
+        ]);
+        disk.bytes[510] = 0;
+        assert_eq!(
+            esp_of(&disk, extent(512, 300, 100)),
+            Err("LBA 0 holds no MBR: its Signature is 0xAA00, not 0xAA55".into()),
+            "LBA 0 without 0xAA55"
+        );
+
+        for (blocks, lba, len) in [(1, 1, 512), (2, 2, 16384)] {
+            let mut disk = DiskImage::from(&GPT_512);
+            disk.bytes.truncate(blocks * 512);
+
+            let got = PartitionTable::read(&disk);
+
+            assert!(
+                matches!(
+                    &got,
+                    Err(PartitionTableError::Read { lba: got_lba, len: got_len, error })
+                        if (*got_lba, *got_len) == (lba, len)
+                            && error.kind() == io::ErrorKind::UnexpectedEof
+                ),
+                "a disk of {blocks} blocks: {got:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn the_esp_s_files_are_those_of_uefisettings_directory() {
+        let root = TempDir::new().expect("a temporary directory");
+        let mount_point = root.path().to_path_buf();
+        let esp = MountedEsp {
+            mount_point: mount_point.clone(),
+            hard_drive: gpt_512_esp(),
+        };
+        let image = "\\EFI\\uefisettings\\uefisettings.efi";
+        let directory = mount_point.join("EFI").join("uefisettings");
+        let digest = Sha256Digest(Sha256::digest(b"an image").into());
+
+        assert_eq!(esp.list().ok(), Some(Vec::new()), "no directory");
+        assert_eq!(esp.place(image, b"an image").ok(), Some(digest), "placed");
+        assert_eq!(
+            fs::read(directory.join("uefisettings.efi")).ok(),
+            Some(b"an image".to_vec()),
+            "its bytes"
+        );
+        assert!(esp.place(image, b"another").is_err(), "placed again");
+        assert_eq!(esp.sha256(image).ok(), Some(Some(digest)), "kept");
+        assert_eq!(esp.list().ok(), Some(vec![image.to_owned()]), "listed");
+
+        fs::write(directory.join("other.efi"), b"other").expect("another file");
+        esp.delete(image).expect("delete the image");
+        assert_eq!(esp.sha256(image).ok(), Some(None), "deleted");
+        assert!(directory.is_dir(), "a directory of another file stays");
+        esp.delete("\\EFI\\uefisettings\\other.efi")
+            .expect("delete the other file");
+        assert!(!directory.exists(), "an empty directory goes");
+
+        for path in [
+            "\\EFI\\other\\uefisettings.efi",
+            "\\EFI\\uefisettings",
+            "\\EFI\\uefisettings\\",
+            "\\EFI\\uefisettings\\.",
+            "\\EFI\\uefisettings\\..",
+            "\\EFI\\uefisettings\\a\\b",
+            "\\EFI\\uefisettings\\a/b",
+        ] {
+            assert_eq!(
+                esp.sha256(path).map_err(|err| err.to_string()),
+                Err(format!("{path:?} names no file of \\EFI\\uefisettings")),
+                "{path}"
+            );
+        }
+    }
+}
diff --git a/src/lib/esp/linux.rs b/src/lib/esp/linux.rs
new file mode 100644
index 0000000..eec42a5
--- /dev/null
+++ b/src/lib/esp/linux.rs
@@ -0,0 +1,735 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The EFI system partition that staging writes to on Linux: a mounted vfat volume whose partition
+//! is an ESP in its disk's partition table, the one that BootCurrent's Hard Drive node names.
+
+use std::collections::BTreeMap;
+use std::ffi::OsString;
+use std::fs;
+use std::fs::File;
+use std::io;
+use std::os::unix::ffi::OsStringExt;
+use std::os::unix::fs::FileExt;
+use std::os::unix::fs::MetadataExt;
+use std::path::Path;
+use std::path::PathBuf;
+
+use anyhow::anyhow;
+use anyhow::Context;
+use anyhow::Result;
+
+use super::boot_current_hard_drive;
+use super::described;
+use super::is_wanted;
+use super::wanted;
+use super::BlockDevice;
+use super::EspLocator;
+use super::MountedEsp;
+use super::PartitionExtent;
+use super::PartitionTable;
+use crate::efi_variables::load_option::HardDrive;
+use crate::efi_variables::VariableData;
+
+/// The sector of Linux's block layer, which sysfs counts a partition's start and size in
+const SECTOR_SIZE: u64 = 512;
+/// The type that Linux mounts a FAT file system as, the ESP's (UEFI 2.11 §13.3)
+const VFAT: &[u8] = b"vfat";
+
+/// Where Linux tells of mounts and block devices, and what tells the device that a path reaches.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct LinuxPaths<D = Stat> {
+    /// proc_pid_mountinfo(5)
+    pub(crate) mountinfo: PathBuf,
+    /// A directory of each block device's sysfs directory, by major:minor
+    pub(crate) sys_dev_block: PathBuf,
+    /// The device files
+    pub(crate) dev: PathBuf,
+    pub(crate) devices: D,
+}
+
+impl Default for LinuxPaths {
+    fn default() -> Self {
+        Self {
+            mountinfo: PathBuf::from("/proc/self/mountinfo"),
+            sys_dev_block: PathBuf::from("/sys/dev/block"),
+            dev: PathBuf::from("/dev"),
+            devices: Stat,
+        }
+    }
+}
+
+/// What tells the device whose file system a path reaches.
+pub(crate) trait PathDevices {
+    /// The major:minor of the device whose file system holds `path`, as mountinfo writes it.
+    fn device_of(&self, path: &Path) -> Result<String>;
+}
+
+/// stat(2): st_dev is the major:minor that mountinfo writes for a file system
+/// (proc_pid_mountinfo(5)).
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(crate) struct Stat;
+
+impl PathDevices for Stat {
+    fn device_of(&self, path: &Path) -> Result<String> {
+        let device = fs::metadata(path)
+            .with_context(|| format!("stat {}", path.display()))?
+            .dev();
+        Ok(format!("{}:{}", libc::major(device), libc::minor(device)))
+    }
+}
+
+impl<D: PathDevices> EspLocator for LinuxPaths<D> {
+    /// The mounted ESP that staging writes to: the mounted vfat volume whose partition the Hard
+    /// Drive node of BootCurrent's Boot#### names, else, if it names none, the only mounted ESP;
+    /// refused unless exactly one volume is that. A GPT partition matches by its
+    /// UniquePartitionGUID; an MBR one by its disk signature and partition number. A volume
+    /// counts only if its mount point reaches it.
+    fn locate(&self, variables: &impl VariableData) -> Result<MountedEsp> {
+        let named = boot_current_hard_drive(variables)?;
+        let volumes: Vec<(PathBuf, Result<HardDrive>)> = vfat_mounts(&self.mountinfo)?
+            .into_iter()
+            .map(|(device, mount_point)| {
+                let hard_drive = mounted_partition(self, &device, &mount_point);
+                (mount_point, hard_drive)
+            })
+            .collect();
+        let matching: Vec<MountedEsp> = volumes
+            .iter()
+            .filter_map(|(mount_point, hard_drive)| {
+                let hard_drive = *hard_drive.as_ref().ok()?;
+                is_wanted(named.as_ref(), &hard_drive).then(|| MountedEsp {
+                    mount_point: mount_point.clone(),
+                    hard_drive,
+                })
+            })
+            .collect();
+
+        let wanted = wanted(named.as_ref());
+        match matching.as_slice() {
+            [esp] => Ok(esp.clone()),
+            [] => Err(anyhow!(
+                "no mounted vfat volume is {wanted}; mount it. Mounted: {}",
+                listed(&volumes)
+            )),
+            several => Err(anyhow!(
+                "several mounted vfat volumes are {wanted}: {}",
+                several
+                    .iter()
+                    .map(|esp| esp.mount_point.display().to_string())
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            )),
+        }
+    }
+
+    /// Refused: Linux writes through the mount point where it finds the ESP mounted.
+    fn mounted_at(&self, esp: MountedEsp, mount_point: &Path) -> Result<MountedEsp> {
+        Err(anyhow!(
+            "an ESP mount point, {}, applies to Windows; Linux writes through {}, where it finds \
+             the ESP mounted",
+            mount_point.display(),
+            esp.mount_point.display()
+        ))
+    }
+}
+
+/// The mounted vfat volumes, each with its partition or why it is no ESP, in words.
+fn listed(volumes: &[(PathBuf, Result<HardDrive>)]) -> String {
+    match volumes {
+        [] => "none".to_owned(),
+        _ => volumes
+            .iter()
+            .map(|(mount_point, hard_drive)| match hard_drive {
+                Ok(hard_drive) => format!("{} ({})", mount_point.display(), described(hard_drive)),
+                Err(error) => format!("{} ({error:#})", mount_point.display()),
+            })
+            .collect::<Vec<_>>()
+            .join("; "),
+    }
+}
+
+/// The vfat volumes mounted whole, each by its device's major:minor and the first mount point,
+/// from `mountinfo` (proc_pid_mountinfo(5)).
+fn vfat_mounts(mountinfo: &Path) -> Result<Vec<(String, PathBuf)>> {
+    let text = fs::read(mountinfo).with_context(|| format!("read {}", mountinfo.display()))?;
+    let mut mounts: BTreeMap<String, PathBuf> = BTreeMap::new();
+    for line in text
+        .split(|byte| *byte == b'\n')
+        .filter(|line| !line.is_empty())
+    {
+        if let Some((device, mount_point)) = vfat_mount(line).with_context(|| {
+            format!(
+                "{} holds a malformed line: {}",
+                mountinfo.display(),
+                String::from_utf8_lossy(line)
+            )
+        })? {
+            mounts.entry(device).or_insert(mount_point);
+        }
+    }
+    Ok(mounts.into_iter().collect())
+}
+
+/// The device's major:minor and mount point of the mountinfo line `line` if it mounts a vfat
+/// volume whole, from its root; None for another type, or for a directory of a volume.
+fn vfat_mount(line: &[u8]) -> Result<Option<(String, PathBuf)>> {
+    let mut fields = line.split(|byte| *byte == b' ');
+    let (Some(_id), Some(_parent), Some(device), Some(root), Some(mount_point)) = (
+        fields.next(),
+        fields.next(),
+        fields.next(),
+        fields.next(),
+        fields.next(),
+    ) else {
+        return Err(anyhow!("fewer than 5 fields"));
+    };
+    // optional fields end with a "-" field, then the type
+    let mut after_separator = fields.skip_while(|field| *field != b"-").skip(1);
+    let fs_type = after_separator
+        .next()
+        .ok_or_else(|| anyhow!("no file system type after a \"-\" field"))?;
+    if fs_type != VFAT || root != b"/" {
+        return Ok(None);
+    }
+    let device = std::str::from_utf8(device)
+        .context("a major:minor in no UTF-8")?
+        .to_owned();
+    Ok(Some((
+        device,
+        PathBuf::from(OsString::from_vec(unescaped(mount_point)?)),
+    )))
+}
+
+/// `field` with each octal escape \ooo, which mountinfo writes for a space, tab, newline or
+/// backslash, replaced by its byte.
+fn unescaped(field: &[u8]) -> Result<Vec<u8>> {
+    let mut bytes = Vec::with_capacity(field.len());
+    let mut rest = field;
+    while let Some((&byte, after)) = rest.split_first() {
+        match (byte, after.split_first_chunk::<3>()) {
+            (b'\\', Some((digits, after)))
+                if digits.iter().all(|digit| matches!(digit, b'0'..=b'7')) =>
+            {
+                let value = digits
+                    .iter()
+                    .fold(0u16, |value, digit| value * 8 + u16::from(digit - b'0'));
+                bytes.push(u8::try_from(value).context("an octal escape past 0o377")?);
+                rest = after;
+            }
+            (b'\\', _) => return Err(anyhow!("a backslash without 3 octal digits")),
+            (byte, _) => {
+                bytes.push(byte);
+                rest = after;
+            }
+        }
+    }
+    Ok(bytes)
+}
+
+/// The Hard Drive node of the partition of the block device `device`, a major:minor, that
+/// mountinfo mounts at `mount_point`, refused unless partition_hard_drive allows it and
+/// `mount_point` reaches its file system, which a later mount on it or on a directory above it
+/// shadows.
+fn mounted_partition(
+    paths: &LinuxPaths<impl PathDevices>,
+    device: &str,
+    mount_point: &Path,
+) -> Result<HardDrive> {
+    let hard_drive = partition_hard_drive(paths, device)?;
+    let reached = paths.devices.device_of(mount_point)?;
+    match reached == device {
+        true => Ok(hard_drive),
+        false => Err(anyhow!(
+            "it reaches device {reached}, not {device}: a later mount shadows it"
+        )),
+    }
+}
+
+/// The Hard Drive node of the partition of the block device `device`, a major:minor, from its
+/// disk's partition table, refused unless that is an ESP's.
+fn partition_hard_drive<D>(paths: &LinuxPaths<D>, device: &str) -> Result<HardDrive> {
+    let partition = paths.sys_dev_block.join(device);
+    match fs::metadata(partition.join("partition")) {
+        Ok(_) => {}
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {
+            return Err(anyhow!("block device {device} is no partition of a disk"))
+        }
+        Err(error) => return Err(error).with_context(|| format!("read {}", partition.display())),
+    }
+    let disk = partition.join("..");
+    let extent = PartitionExtent {
+        offset: sectors(&partition.join("start"))?,
+        length: sectors(&partition.join("size"))?,
+    };
+    let block_size = number(&disk.join("queue").join("logical_block_size"))?;
+    let device_file = paths.dev.join(device_name(&disk.join("uevent"))?);
+    let file =
+        File::open(&device_file).with_context(|| format!("open {}", device_file.display()))?;
+    let table = PartitionTable::read(&DiskFile {
+        file,
+        block_size: u32::try_from(block_size).context("a logical block size past 4 GiB")?,
+    })
+    .with_context(|| format!("read the partition table of {}", device_file.display()))?;
+    table
+        .esp_hard_drive(extent)
+        .with_context(|| format!("in the partition table of {}", device_file.display()))
+}
+
+/// The bytes of the sectors that the sysfs file `path` counts.
+fn sectors(path: &Path) -> Result<u64> {
+    number(path)?.checked_mul(SECTOR_SIZE).ok_or_else(|| {
+        anyhow!(
+            "{} counts more sectors than 64 bits of bytes",
+            path.display()
+        )
+    })
+}
+
+/// The decimal number that the sysfs file `path` holds.
+fn number(path: &Path) -> Result<u64> {
+    let text = fs::read_to_string(path).with_context(|| format!("read {}", path.display()))?;
+    text.trim_end()
+        .parse()
+        .with_context(|| format!("{} holds no number: {text:?}", path.display()))
+}
+
+/// The DEVNAME that the sysfs uevent file `path` tells, the device file's name.
+fn device_name(path: &Path) -> Result<String> {
+    let text = fs::read_to_string(path).with_context(|| format!("read {}", path.display()))?;
+    text.lines()
+        .find_map(|line| line.strip_prefix("DEVNAME="))
+        .filter(|name| !name.split('/').any(|part| matches!(part, "" | "." | "..")))
+        .map(str::to_owned)
+        .ok_or_else(|| anyhow!("{} tells no DEVNAME", path.display()))
+}
+
+/// A disk's device file, read in logical blocks.
+struct DiskFile {
+    file: File,
+    block_size: u32,
+}
+
+impl BlockDevice for DiskFile {
+    fn block_size(&self) -> u32 {
+        self.block_size
+    }
+
+    fn read_blocks(&self, lba: u64, blocks: &mut [u8]) -> io::Result<()> {
+        let offset = lba.checked_mul(u64::from(self.block_size)).ok_or_else(|| {
+            io::Error::new(io::ErrorKind::InvalidInput, "LBA past 64 bits of bytes")
+        })?;
+        self.file.read_exact_at(blocks, offset)
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use std::cell::RefCell;
+    use std::os::unix::fs::symlink;
+
+    use tempfile::TempDir;
+
+    use super::super::sfdisk_images::SfdiskImage;
+    use super::super::sfdisk_images::GPT_4096;
+    use super::super::sfdisk_images::GPT_512;
+    use super::super::sfdisk_images::MBR_512;
+    use super::super::tests::booted_from;
+    use super::super::tests::gpt_512_esp;
+    use super::*;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::load_option::PartitionSignature;
+
+    /// GPT_512's ESP, entry 3, and its Linux partition, entry 1, as sysfs counts them
+    const GPT_512_ESP: (u64, u64) = (2048, 2048);
+    const GPT_512_LINUX: (u64, u64) = (4096, 2048);
+
+    /// A Linux system in a directory: its mountinfo, sysfs block devices and device files.
+    pub(crate) struct FakeLinux {
+        root: TempDir,
+        pub(crate) paths: LinuxPaths<FakeDevices>,
+    }
+
+    /// The mounts of a FakeLinux, in order, each by mount point and device: a path reaches the
+    /// device of the last mount on it or on a directory above it.
+    #[derive(Debug, Default)]
+    pub(crate) struct FakeDevices(RefCell<Vec<(PathBuf, String)>>);
+
+    impl PathDevices for FakeDevices {
+        fn device_of(&self, path: &Path) -> Result<String> {
+            self.0
+                .borrow()
+                .iter()
+                .rev()
+                .find(|(mount_point, _)| path.starts_with(mount_point))
+                .map(|(_, device)| device.clone())
+                .ok_or_else(|| anyhow!("no mount holds {}", path.display()))
+        }
+    }
+
+    impl FakeLinux {
+        pub(crate) fn new() -> Self {
+            let root = TempDir::new().expect("a temporary directory");
+            let paths = LinuxPaths {
+                mountinfo: root.path().join("mountinfo"),
+                sys_dev_block: root.path().join("sys").join("dev").join("block"),
+                dev: root.path().join("dev"),
+                devices: FakeDevices::default(),
+            };
+            fs::create_dir_all(&paths.sys_dev_block).expect("sys/dev/block");
+            fs::create_dir_all(&paths.dev).expect("dev");
+            fs::write(&paths.mountinfo, "").expect("mountinfo");
+            Self { root, paths }
+        }
+
+        /// A disk named `name` of major `major`, minor 0, whose device file holds `image`, and
+        /// its partitions, each of a minor and the start and size that sysfs counts in sectors.
+        fn disk(
+            &self,
+            name: &str,
+            major: u32,
+            image: &SfdiskImage,
+            partitions: &[(u32, (u64, u64))],
+        ) {
+            let disk = self.root.path().join("sys").join("devices").join(name);
+            fs::create_dir_all(disk.join("queue")).expect("the disk's queue");
+            fs::write(
+                disk.join("queue").join("logical_block_size"),
+                format!("{}\n", image.block_size),
+            )
+            .expect("logical_block_size");
+            fs::write(
+                disk.join("uevent"),
+                format!("MAJOR={major}\nMINOR=0\nDEVNAME={name}\nDEVTYPE=disk\n"),
+            )
+            .expect("uevent");
+            symlink(
+                format!("../../devices/{name}"),
+                self.paths.sys_dev_block.join(format!("{major}:0")),
+            )
+            .expect("the disk's link");
+            for (minor, (start, size)) in partitions {
+                let partition = disk.join(format!("{name}{minor}"));
+                fs::create_dir_all(&partition).expect("the partition");
+                for (file, value) in [
+                    ("partition", minor.to_string()),
+                    ("start", start.to_string()),
+                    ("size", size.to_string()),
+                ] {
+                    fs::write(partition.join(file), format!("{value}\n")).expect(file);
+                }
+                symlink(
+                    format!("../../devices/{name}/{name}{minor}"),
+                    self.paths.sys_dev_block.join(format!("{major}:{minor}")),
+                )
+                .expect("the partition's link");
+            }
+            fs::write(self.paths.dev.join(name), image.bytes()).expect("the device file");
+        }
+
+        /// Mounts `device`, a major:minor, from `root` as `fs_type` at the directory `name`, which
+        /// mountinfo writes as `escaped`; returns the mount point.
+        fn mount_as(
+            &self,
+            device: &str,
+            root: &str,
+            fs_type: &str,
+            name: &str,
+            escaped: &str,
+        ) -> PathBuf {
+            let mount_point = self.root.path().join(name);
+            fs::create_dir_all(&mount_point).expect("the mount point");
+            let line = format!(
+                "29 1 {device} {root} {}/{escaped} rw,relatime shared:1 - {fs_type} /dev/x rw\n",
+                self.root.path().display()
+            );
+            let mut mountinfo = fs::read(&self.paths.mountinfo).expect("mountinfo");
+            mountinfo.extend(line.as_bytes());
+            fs::write(&self.paths.mountinfo, mountinfo).expect("mountinfo");
+            self.paths
+                .devices
+                .0
+                .borrow_mut()
+                .push((mount_point.clone(), device.to_owned()));
+            mount_point
+        }
+
+        fn mount(&self, device: &str, name: &str) -> PathBuf {
+            self.mount_as(device, "/", "vfat", name, name)
+        }
+
+        /// GPT_512 as disk sda, its ESP 8:3 mounted at esp, and its Linux partition 8:1.
+        pub(crate) fn with_esp() -> (Self, PathBuf) {
+            let linux = Self::new();
+            linux.disk("sda", 8, &GPT_512, &[(1, GPT_512_LINUX), (3, GPT_512_ESP)]);
+            let esp = linux.mount("8:3", "esp");
+            (linux, esp)
+        }
+    }
+
+    fn located(linux: &FakeLinux, variables: &HeldVariables) -> Result<MountedEsp, String> {
+        linux
+            .paths
+            .locate(variables)
+            .map_err(|err| format!("{err:#}"))
+    }
+
+    #[test]
+    fn the_esp_is_the_mounted_partition_that_boot_current_names() {
+        let (linux, esp) = FakeLinux::with_esp();
+        linux.mount("8:1", "linux");
+        linux.mount_as("8:3", "/EFI", "vfat", "esp-efi", "esp-efi");
+        linux.mount_as("8:1", "/", "ext4", "ext4", "ext4");
+        let want = Ok(MountedEsp {
+            mount_point: esp.clone(),
+            hard_drive: gpt_512_esp(),
+        });
+
+        assert_eq!(
+            located(&linux, &booted_from(Some(gpt_512_esp()))),
+            want,
+            "named"
+        );
+        assert_eq!(
+            located(&linux, &booted_from(None)),
+            want,
+            "no Hard Drive node"
+        );
+        assert_eq!(
+            located(&linux, &HeldVariables::default()),
+            want,
+            "no BootCurrent"
+        );
+
+        // mounted twice, at its first mount point
+        linux.mount("8:3", "again");
+        assert_eq!(
+            located(&linux, &booted_from(Some(gpt_512_esp()))),
+            want,
+            "mounted twice"
+        );
+
+        // a directory of the ESP mounted before the ESP itself
+        let linux = FakeLinux::new();
+        linux.disk("sda", 8, &GPT_512, &[(3, GPT_512_ESP)]);
+        linux.mount_as("8:3", "/EFI", "vfat", "esp-efi", "esp-efi");
+        let esp = linux.mount("8:3", "esp");
+        assert_eq!(
+            located(&linux, &booted_from(Some(gpt_512_esp()))).map(|esp| esp.mount_point),
+            Ok(esp),
+            "a directory mounted first"
+        );
+
+        // a mount point that mountinfo escapes
+        let linux = FakeLinux::new();
+        linux.disk("sda", 8, &GPT_512, &[(3, GPT_512_ESP)]);
+        let spaced = linux.mount_as("8:3", "/", "vfat", "an esp", "an\\040esp");
+        assert_eq!(
+            located(&linux, &booted_from(Some(gpt_512_esp()))).map(|esp| esp.mount_point),
+            Ok(spaced),
+            "escaped"
+        );
+    }
+
+    #[test]
+    fn exactly_one_mounted_volume_must_be_the_esp() {
+        let other_esp = HardDrive {
+            signature: PartitionSignature::Gpt(
+                "8C78A505-BAA0-4C4A-869F-000000001A05"
+                    .parse()
+                    .expect("a GUID"),
+            ),
+            ..gpt_512_esp()
+        };
+        let (linux, esp) = FakeLinux::with_esp();
+        let linux_partition = linux.mount("8:1", "linux");
+        assert_eq!(
+            located(&linux, &booted_from(Some(other_esp))),
+            Err(format!(
+                "no mounted vfat volume is the EFI system partition that BootCurrent names, GPT \
+                 partition 8C78A505-BAA0-4C4A-869F-000000001A05; mount it. Mounted: {} (in the \
+                 partition table of {}: GPT entry 1 has PartitionTypeGUID \
+                 0FC63DAF-8483-4772-8E79-3D69D8477DE4, not the EFI System Partition's \
+                 C12A7328-F81F-11D2-BA4B-00A0C93EC93B); {} (GPT partition \
+                 8C78A505-BAA0-4C4A-869F-000000001A0E)",
+                linux_partition.display(),
+                linux.paths.dev.join("sda").display(),
+                esp.display()
+            )),
+            "another partition named"
+        );
+
+        // a second ESP, of another disk
+        linux.disk("sdb", 16, &GPT_4096, &[(1, (512 * 8, 256 * 8))]);
+        let second = linux.mount("16:1", "second");
+        assert_eq!(
+            located(&linux, &booted_from(None)),
+            Err(format!(
+                "several mounted vfat volumes are an EFI system partition: {}, {}",
+                second.display(),
+                esp.display()
+            )),
+            "two ESPs, none named"
+        );
+        assert!(
+            located(&linux, &booted_from(Some(gpt_512_esp()))).is_ok(),
+            "two ESPs, one named"
+        );
+
+        let linux = FakeLinux::new();
+        assert_eq!(
+            located(&linux, &booted_from(None)),
+            Err(
+                "no mounted vfat volume is an EFI system partition; mount it. Mounted: none".into()
+            ),
+            "nothing mounted"
+        );
+        linux.disk("sda", 8, &GPT_512, &[(3, GPT_512_ESP)]);
+        linux.mount_as("8:3", "/", "ext4", "ext4", "ext4");
+        assert_eq!(
+            located(&linux, &booted_from(Some(gpt_512_esp()))),
+            Err(
+                "no mounted vfat volume is the EFI system partition that BootCurrent names, GPT \
+                 partition 8C78A505-BAA0-4C4A-869F-000000001A0E; mount it. Mounted: none"
+                    .into()
+            ),
+            "the ESP mounted as another type"
+        );
+        let whole = linux.mount("8:0", "whole");
+        assert_eq!(
+            located(&linux, &booted_from(None)),
+            Err(format!(
+                "no mounted vfat volume is an EFI system partition; mount it. Mounted: {} (block \
+                 device 8:0 is no partition of a disk)",
+                whole.display()
+            )),
+            "a whole disk mounted"
+        );
+    }
+
+    /// A mount on a directory above the ESP's mount point shadows it: writes there would reach
+    /// the later mount's file system.
+    #[test]
+    fn a_mount_point_that_a_later_mount_shadows_is_refused() {
+        let linux = FakeLinux::new();
+        linux.disk("sda", 8, &GPT_512, &[(3, GPT_512_ESP)]);
+        let esp = linux.mount_as("8:3", "/", "vfat", "boot/efi", "boot/efi");
+        linux.mount_as("0:42", "/", "tmpfs", "boot", "boot");
+        assert_eq!(
+            located(&linux, &booted_from(Some(gpt_512_esp()))),
+            Err(format!(
+                "no mounted vfat volume is the EFI system partition that BootCurrent names, GPT \
+                 partition 8C78A505-BAA0-4C4A-869F-000000001A0E; mount it. Mounted: {} (it \
+                 reaches device 0:42, not 8:3: a later mount shadows it)",
+                esp.display()
+            )),
+            "shadowed"
+        );
+
+        let linux = FakeLinux::new();
+        linux.disk("sda", 8, &GPT_512, &[(3, GPT_512_ESP)]);
+        linux.mount_as("0:42", "/", "tmpfs", "boot", "boot");
+        let esp = linux.mount_as("8:3", "/", "vfat", "boot/efi", "boot/efi");
+        assert_eq!(
+            located(&linux, &booted_from(Some(gpt_512_esp()))).map(|esp| esp.mount_point),
+            Ok(esp),
+            "mounted over another mount"
+        );
+    }
+
+    #[test]
+    fn a_devname_names_a_file_below_the_device_directory() {
+        let directory = TempDir::new().expect("a temporary directory");
+        let uevent = directory.path().join("uevent");
+        let refused = format!("{} tells no DEVNAME", uevent.display());
+        for (devname, want) in [
+            ("sda", Ok("sda")),
+            ("mapper/x", Ok("mapper/x")),
+            ("", Err(&refused)),
+            ("../sda", Err(&refused)),
+            ("a/./b", Err(&refused)),
+            ("a//b", Err(&refused)),
+        ] {
+            fs::write(
+                &uevent,
+                format!("MAJOR=8\nMINOR=0\nDEVNAME={devname}\nDEVTYPE=disk\n"),
+            )
+            .expect("uevent");
+            assert_eq!(
+                device_name(&uevent).map_err(|err| format!("{err:#}")),
+                want.map(str::to_owned).map_err(String::clone),
+                "DEVNAME={devname:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn an_mbr_esp_is_named_by_its_disk_signature_and_partition_number() {
+        let linux = FakeLinux::new();
+        linux.disk("sda", 8, &MBR_512, &[(2, (4096, 2048))]);
+        let esp = linux.mount("8:2", "esp");
+        let mbr_esp = HardDrive {
+            partition_number: 2,
+            start: 4096,
+            size: 2048,
+            signature: PartitionSignature::Mbr(0x5EC7_A1B2),
+        };
+
+        assert_eq!(
+            located(&linux, &booted_from(Some(mbr_esp))),
+            Ok(MountedEsp {
+                mount_point: esp,
+                hard_drive: mbr_esp,
+            }),
+            "named"
+        );
+        for (case, named) in [
+            (
+                "another partition number",
+                HardDrive {
+                    partition_number: 1,
+                    ..mbr_esp
+                },
+            ),
+            (
+                "another disk signature",
+                HardDrive {
+                    signature: PartitionSignature::Mbr(0x5EC7_A1B3),
+                    ..mbr_esp
+                },
+            ),
+            ("a GPT partition", gpt_512_esp()),
+        ] {
+            assert!(
+                located(&linux, &booted_from(Some(named))).is_err(),
+                "{case}"
+            );
+        }
+    }
+
+    #[test]
+    fn mountinfo_lines_that_are_not_mounts_are_refused() {
+        for line in [
+            "29 1 8:3 / /esp",
+            "29 1 8:3 / /esp rw shared:1",
+            "29 1 8:3 / /e\\04sp rw - vfat /dev/sda3 rw",
+            "29 1 8:3 / /e\\777sp rw - vfat /dev/sda3 rw",
+        ] {
+            assert!(vfat_mount(line.as_bytes()).is_err(), "{line}");
+        }
+        assert_eq!(
+            vfat_mount(b"29 1 8:3 / /e\\134sp\\011 rw - vfat /dev/sda3 rw").ok(),
+            Some(Some(("8:3".to_owned(), PathBuf::from("/e\\sp\t")))),
+            "escaped backslash and tab"
+        );
+    }
+}
diff --git a/src/lib/esp/sfdisk_images.rs b/src/lib/esp/sfdisk_images.rs
new file mode 100644
index 0000000..315e691
--- /dev/null
+++ b/src/lib/esp/sfdisk_images.rs
@@ -0,0 +1,218 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! Disk images that sfdisk partitioned, as the bytes of them that PartitionTable::read reads:
+//! LBA 0 and, on a GPT disk, the primary GPT header and its entry array. Their CRC32s are
+//! sfdisk's, not the code's under test.
+
+/// The first `length` bytes of a disk image of `block_size`-byte logical blocks: zero but for
+/// the runs, each a byte offset and the bytes there.
+pub(super) struct SfdiskImage {
+    pub(super) block_size: u32,
+    pub(super) length: usize,
+    pub(super) runs: &'static [(usize, &'static [u8])],
+}
+
+impl SfdiskImage {
+    /// The bytes of the image.
+    pub(super) fn bytes(&self) -> Vec<u8> {
+        let mut bytes = vec![0; self.length];
+        for (offset, run) in self.runs {
+            bytes[*offset..offset + run.len()].copy_from_slice(run);
+        }
+        bytes
+    }
+}
+
+/// The first 17408 bytes of a disk image that `sfdisk` (util-linux 2.41.6) partitioned
+/// with this script:
+///
+/// ```text
+/// label: gpt
+/// label-id: 8C78A505-BAA0-4C4A-869F-000000001A0C
+/// first-lba: 34
+/// disk512.img1 : start=4096, size=2048, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, uuid=8C78A505-BAA0-4C4A-869F-000000001A06, name="data"
+/// disk512.img3 : start=2048, size=2048, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, uuid=8C78A505-BAA0-4C4A-869F-000000001A0E, name="esp"
+/// ```
+pub(super) const GPT_512: SfdiskImage = SfdiskImage {
+    block_size: 512,
+    length: 17408,
+    runs: &[
+        (
+            0x01c0,
+            &[
+                0x02, 0x00, 0xee, 0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0xff, 0x1f,
+            ],
+        ),
+        (0x01fe, &[0x55, 0xaa]),
+        (
+            0x0200,
+            &[
+                0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54, 0x00, 0x00, 0x01, 0x00, 0x5c, 0x00,
+                0x00, 0x00, 0x99, 0x29, 0x57, 0x97, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0x1f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x22, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xde, 0x1f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00, 0x00, 0x00,
+                0x1a, 0x0c, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00,
+                0x80, 0x00, 0x00, 0x00, 0x6a, 0xe8, 0x74, 0xee,
+            ],
+        ),
+        (
+            0x0400,
+            &[
+                0xaf, 0x3d, 0xc6, 0x0f, 0x83, 0x84, 0x72, 0x47, 0x8e, 0x79, 0x3d, 0x69, 0xd8, 0x47,
+                0x7d, 0xe4, 0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00,
+                0x00, 0x00, 0x1a, 0x06, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x17,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x64, 0x00, 0x61, 0x00, 0x74, 0x00, 0x61,
+            ],
+        ),
+        (
+            0x0500,
+            &[
+                0x28, 0x73, 0x2a, 0xc1, 0x1f, 0xf8, 0xd2, 0x11, 0xba, 0x4b, 0x00, 0xa0, 0xc9, 0x3e,
+                0xc9, 0x3b, 0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00,
+                0x00, 0x00, 0x1a, 0x0e, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x0f,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x65, 0x00, 0x73, 0x00, 0x70,
+            ],
+        ),
+    ],
+};
+
+/// The first 24576 bytes of a disk image that `sfdisk --sector-size 4096` (util-linux 2.41.6) partitioned
+/// with this script:
+///
+/// ```text
+/// label: gpt
+/// label-id: 8C78A505-BAA0-4C4A-869F-000000001A01
+/// disk4096.img1 : start=512, size=256, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, uuid=8C78A505-BAA0-4C4A-869F-000000001A0A, name="esp"
+/// disk4096.img2 : start=768, size=256, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, uuid=8C78A505-BAA0-4C4A-869F-000000001A0F, name="data"
+/// ```
+pub(super) const GPT_4096: SfdiskImage = SfdiskImage {
+    block_size: 4096,
+    length: 24576,
+    runs: &[
+        (
+            0x01c0,
+            &[
+                0x02, 0x00, 0xee, 0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0xff, 0x07,
+            ],
+        ),
+        (0x01fe, &[0x55, 0xaa]),
+        (
+            0x1000,
+            &[
+                0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54, 0x00, 0x00, 0x01, 0x00, 0x5c, 0x00,
+                0x00, 0x00, 0x5d, 0x91, 0x64, 0xfc, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfa, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00, 0x00, 0x00,
+                0x1a, 0x01, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00,
+                0x80, 0x00, 0x00, 0x00, 0x60, 0x77, 0xb1, 0xfb,
+            ],
+        ),
+        (
+            0x2000,
+            &[
+                0x28, 0x73, 0x2a, 0xc1, 0x1f, 0xf8, 0xd2, 0x11, 0xba, 0x4b, 0x00, 0xa0, 0xc9, 0x3e,
+                0xc9, 0x3b, 0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00,
+                0x00, 0x00, 0x1a, 0x0a, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x65, 0x00, 0x73, 0x00, 0x70,
+            ],
+        ),
+        (
+            0x2080,
+            &[
+                0xaf, 0x3d, 0xc6, 0x0f, 0x83, 0x84, 0x72, 0x47, 0x8e, 0x79, 0x3d, 0x69, 0xd8, 0x47,
+                0x7d, 0xe4, 0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00,
+                0x00, 0x00, 0x1a, 0x0f, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x03,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x64, 0x00, 0x61, 0x00, 0x74, 0x00, 0x61,
+            ],
+        ),
+    ],
+};
+
+/// The first 512 bytes of a disk image that `sfdisk` (util-linux 2.41.6) partitioned
+/// with this script:
+///
+/// ```text
+/// label: dos
+/// label-id: 0x5ec7a1b2
+/// mbr512.img1 : start=2048, size=2048, type=83
+/// mbr512.img2 : start=4096, size=2048, type=ef
+/// ```
+pub(super) const MBR_512: SfdiskImage = SfdiskImage {
+    block_size: 512,
+    length: 512,
+    runs: &[
+        (
+            0x01b8,
+            &[
+                0xb2, 0xa1, 0xc7, 0x5e, 0x00, 0x00, 0x00, 0x20, 0x21, 0x00, 0x83, 0x41, 0x01, 0x00,
+                0x00, 0x08, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x41, 0x02, 0x00, 0xef, 0x61,
+                0x21, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x08,
+            ],
+        ),
+        (0x01fe, &[0x55, 0xaa]),
+    ],
+};
+
+/// The first 17408 bytes of the 64 MiB disk image of devices=esp-disk in the QEMU tests,
+/// which `sfdisk` (util-linux 2.41.6) partitioned with tests/qemu/esp-disk.sfdisk.
+pub(super) const QEMU_ESP_DISK: SfdiskImage = SfdiskImage {
+    block_size: 512,
+    length: 17408,
+    runs: &[
+        (
+            0x01c0,
+            &[
+                0x02, 0x00, 0xee, 0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0xff, 0xff, 0x01,
+            ],
+        ),
+        (0x01fe, &[0x55, 0xaa]),
+        (
+            0x0200,
+            &[
+                0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54, 0x00, 0x00, 0x01, 0x00, 0x5c, 0x00,
+                0x00, 0x00, 0xde, 0x22, 0x31, 0xc2, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x22, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xde, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00, 0x00, 0x00,
+                0x1a, 0x0b, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00,
+                0x80, 0x00, 0x00, 0x00, 0x9a, 0x8e, 0xfc, 0x3f,
+            ],
+        ),
+        (
+            0x0400,
+            &[
+                0xaf, 0x3d, 0xc6, 0x0f, 0x83, 0x84, 0x72, 0x47, 0x8e, 0x79, 0x3d, 0x69, 0xd8, 0x47,
+                0x7d, 0xe4, 0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00,
+                0x00, 0x00, 0x1a, 0x08, 0x00, 0x48, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xc7,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x64, 0x00, 0x61, 0x00, 0x74, 0x00, 0x61,
+            ],
+        ),
+        (
+            0x0480,
+            &[
+                0x28, 0x73, 0x2a, 0xc1, 0x1f, 0xf8, 0xd2, 0x11, 0xba, 0x4b, 0x00, 0xa0, 0xc9, 0x3e,
+                0xc9, 0x3b, 0x05, 0xa5, 0x78, 0x8c, 0xa0, 0xba, 0x4a, 0x4c, 0x86, 0x9f, 0x00, 0x00,
+                0x00, 0x00, 0x1a, 0x10, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x47,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x65, 0x00, 0x73, 0x00, 0x70,
+            ],
+        ),
+    ],
+};
diff --git a/src/lib/esp/win32_calls.rs b/src/lib/esp/win32_calls.rs
new file mode 100644
index 0000000..522958c
--- /dev/null
+++ b/src/lib/esp/win32_calls.rs
@@ -0,0 +1,327 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The Win32 calls that find the EFI system partition. A volume or disk opens as Microsoft Learn's
+//! CreateFileW page, "Physical Disks and Volumes", tells: OPEN_EXISTING, FILE_SHARE_WRITE, by
+//! Administrators.
+
+use std::mem::offset_of;
+use std::mem::size_of;
+use std::os::windows::io::AsRawHandle;
+use std::os::windows::io::FromRawHandle;
+use std::os::windows::io::OwnedHandle;
+use std::ptr;
+
+use log::warn;
+use windows_sys::Win32::Foundation::ERROR_INVALID_NAME;
+use windows_sys::Win32::Foundation::ERROR_MORE_DATA;
+use windows_sys::Win32::Foundation::GENERIC_READ;
+use windows_sys::Win32::Foundation::HANDLE;
+use windows_sys::Win32::Foundation::INVALID_HANDLE_VALUE;
+use windows_sys::Win32::Foundation::MAX_PATH;
+use windows_sys::Win32::Storage::FileSystem::CreateFileW;
+use windows_sys::Win32::Storage::FileSystem::FindFirstVolumeW;
+use windows_sys::Win32::Storage::FileSystem::FindNextVolumeW;
+use windows_sys::Win32::Storage::FileSystem::FindVolumeClose;
+use windows_sys::Win32::Storage::FileSystem::GetVolumeNameForVolumeMountPointW;
+use windows_sys::Win32::Storage::FileSystem::ReadFile;
+use windows_sys::Win32::Storage::FileSystem::FILE_SHARE_READ;
+use windows_sys::Win32::Storage::FileSystem::FILE_SHARE_WRITE;
+use windows_sys::Win32::Storage::FileSystem::IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS;
+use windows_sys::Win32::Storage::FileSystem::OPEN_EXISTING;
+use windows_sys::Win32::System::Ioctl::DISK_EXTENT;
+use windows_sys::Win32::System::Ioctl::DISK_GEOMETRY;
+use windows_sys::Win32::System::Ioctl::IOCTL_DISK_GET_DRIVE_GEOMETRY;
+use windows_sys::Win32::System::Ioctl::VOLUME_DISK_EXTENTS;
+use windows_sys::Win32::System::IO::DeviceIoControl;
+use windows_sys::Win32::System::IO::OVERLAPPED;
+
+use super::windows::CallFailed;
+use super::windows::DiskExtent;
+use super::windows::EspCalls;
+use crate::hii::win32::nul_terminated_utf16;
+use crate::hii::win32::Win32Error;
+
+/// The calls that name failures
+const EXTENTS_CALL: &str = "DeviceIoControl(IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS)";
+const GEOMETRY_CALL: &str = "DeviceIoControl(IOCTL_DISK_GET_DRIVE_GEOMETRY)";
+const MOUNT_POINT_CALL: &str = "GetVolumeNameForVolumeMountPointW";
+/// The failure of the extents' call whose count no buffer that it takes can hold
+const EXTENTS_UNHELD: CallFailed = CallFailed {
+    call: EXTENTS_CALL,
+    code: Win32Error::INSUFFICIENT_BUFFER,
+};
+/// The CHAR16s of a buffer for a volume GUID path, \\?\Volume{GUID}\ and a NUL, with room
+const VOLUME_NAME_CAPACITY: u32 = MAX_PATH;
+
+/// The Win32 calls themselves.
+#[derive(Debug)]
+pub(crate) struct RealEspCalls;
+
+/// A volume search of FindFirstVolumeW, which FindVolumeClose ends when it drops.
+pub(crate) struct VolumeSearch(HANDLE);
+
+impl Drop for VolumeSearch {
+    fn drop(&mut self) {
+        // SAFETY: FindFirstVolumeW opened the search handle, which only this value holds and
+        // nothing closed yet.
+        if unsafe { FindVolumeClose(self.0) } == 0 {
+            warn!("FindVolumeClose failed: {}", Win32Error::last());
+        }
+    }
+}
+
+impl EspCalls for RealEspCalls {
+    type Search = VolumeSearch;
+    type Disk = OwnedHandle;
+
+    fn find_first_volume(&self) -> Result<(VolumeSearch, String), CallFailed> {
+        let mut name = [0u16; VOLUME_NAME_CAPACITY as usize];
+        // SAFETY: FindFirstVolumeW with a buffer of VOLUME_NAME_CAPACITY CHAR16s and that count,
+        // which it writes at most.
+        let search = unsafe { FindFirstVolumeW(name.as_mut_ptr(), VOLUME_NAME_CAPACITY) };
+        if search == INVALID_HANDLE_VALUE {
+            return Err(failed("FindFirstVolumeW"));
+        }
+        Ok((VolumeSearch(search), up_to_nul(&name)))
+    }
+
+    fn find_next_volume(&self, search: &mut VolumeSearch) -> Result<String, CallFailed> {
+        let mut name = [0u16; VOLUME_NAME_CAPACITY as usize];
+        // SAFETY: FindNextVolumeW with the open search handle and a buffer of
+        // VOLUME_NAME_CAPACITY CHAR16s and that count, which it writes at most.
+        let found = unsafe { FindNextVolumeW(search.0, name.as_mut_ptr(), VOLUME_NAME_CAPACITY) };
+        if found == 0 {
+            return Err(failed("FindNextVolumeW"));
+        }
+        Ok(up_to_nul(&name))
+    }
+
+    fn volume_disk_extents(&self, device: &str) -> Result<Vec<DiskExtent>, CallFailed> {
+        let volume = open(device, 0)?;
+        let mut capacity = 1;
+        loop {
+            let mut buffer = vec![0u8; extents_size(capacity).ok_or(EXTENTS_UNHELD)?];
+            let size = u32::try_from(buffer.len()).map_err(|_| EXTENTS_UNHELD)?;
+            let mut returned = 0u32;
+            // SAFETY: DeviceIoControl on the open volume handle with no input, an output buffer
+            // of `size` writable bytes, a place for the bytes returned, and no OVERLAPPED, as
+            // the handle is synchronous.
+            let done = unsafe {
+                DeviceIoControl(
+                    volume.as_raw_handle(),
+                    IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS,
+                    ptr::null(),
+                    0,
+                    buffer.as_mut_ptr().cast(),
+                    size,
+                    &mut returned,
+                    ptr::null_mut(),
+                )
+            };
+            let code = match done {
+                0 => Win32Error::last(),
+                _ => Win32Error::SUCCESS,
+            };
+            let count = field::<4>(
+                &buffer,
+                offset_of!(VOLUME_DISK_EXTENTS, NumberOfDiskExtents),
+            )
+            .map(u32::from_ne_bytes)
+            .and_then(|count| usize::try_from(count).ok())
+            .ok_or(EXTENTS_UNHELD)?;
+            if code == Win32Error::SUCCESS {
+                let extents = buffer
+                    .get(offset_of!(VOLUME_DISK_EXTENTS, Extents)..)
+                    .unwrap_or_default()
+                    .chunks_exact(size_of::<DISK_EXTENT>())
+                    .take(count)
+                    .map(disk_extent)
+                    .collect::<Option<Vec<_>>>()
+                    .ok_or(EXTENTS_UNHELD)?;
+                return match extents.len() == count {
+                    true => Ok(extents),
+                    false => Err(EXTENTS_UNHELD),
+                };
+            }
+            // NumberOfDiskExtents tells the room that a volume of more extents needs (Microsoft
+            // Learn, VOLUME_DISK_EXTENTS)
+            if code.0 != ERROR_MORE_DATA || count <= capacity {
+                return Err(CallFailed {
+                    call: EXTENTS_CALL,
+                    code,
+                });
+            }
+            capacity = count;
+        }
+    }
+
+    fn open_disk(&self, number: u32) -> Result<OwnedHandle, CallFailed> {
+        open(&format!(r"\\.\PhysicalDrive{number}"), GENERIC_READ)
+    }
+
+    fn disk_block_size(&self, disk: &OwnedHandle) -> Result<u32, CallFailed> {
+        let mut geometry = DISK_GEOMETRY::default();
+        let mut returned = 0u32;
+        let size = u32::try_from(size_of::<DISK_GEOMETRY>()).map_err(|_| CallFailed {
+            call: GEOMETRY_CALL,
+            code: Win32Error::INSUFFICIENT_BUFFER,
+        })?;
+        // SAFETY: DeviceIoControl on the open disk handle with no input, a DISK_GEOMETRY of
+        // `size` bytes as its output, a place for the bytes returned, and no OVERLAPPED, as the
+        // handle is synchronous.
+        let done = unsafe {
+            DeviceIoControl(
+                disk.as_raw_handle(),
+                IOCTL_DISK_GET_DRIVE_GEOMETRY,
+                ptr::null(),
+                0,
+                ptr::from_mut(&mut geometry).cast(),
+                size,
+                &mut returned,
+                ptr::null_mut(),
+            )
+        };
+        match done {
+            0 => Err(failed(GEOMETRY_CALL)),
+            _ => Ok(geometry.BytesPerSector),
+        }
+    }
+
+    fn read_disk(
+        &self,
+        disk: &OwnedHandle,
+        offset: u64,
+        buffer: &mut [u8],
+    ) -> Result<usize, CallFailed> {
+        let size = u32::try_from(buffer.len()).map_err(|_| CallFailed {
+            call: "ReadFile",
+            code: Win32Error::INSUFFICIENT_BUFFER,
+        })?;
+        // On a synchronous handle, ReadFile reads at the offset of the OVERLAPPED (Microsoft
+        // Learn, ReadFile, "Synchronization and File Position").
+        let mut at = OVERLAPPED::default();
+        let [b0, b1, b2, b3, b4, b5, b6, b7] = offset.to_le_bytes();
+        at.Anonymous.Anonymous.Offset = u32::from_le_bytes([b0, b1, b2, b3]);
+        at.Anonymous.Anonymous.OffsetHigh = u32::from_le_bytes([b4, b5, b6, b7]);
+        let mut read = 0u32;
+        // SAFETY: ReadFile on the open disk handle into `size` writable bytes of `buffer`, with
+        // a place for the bytes read and an OVERLAPPED that holds the offset and lives through
+        // the call, which returns when the read is done.
+        let done = unsafe {
+            ReadFile(
+                disk.as_raw_handle(),
+                buffer.as_mut_ptr(),
+                size,
+                &mut read,
+                &mut at,
+            )
+        };
+        match done {
+            0 => Err(failed("ReadFile")),
+            _ => usize::try_from(read).map_err(|_| CallFailed {
+                call: "ReadFile",
+                code: Win32Error::INSUFFICIENT_BUFFER,
+            }),
+        }
+    }
+
+    fn volume_name(&self, mount_point: &str) -> Result<String, CallFailed> {
+        // what the call gives for a name that it cannot take
+        let root = nul_terminated_utf16(mount_point).ok_or(CallFailed {
+            call: MOUNT_POINT_CALL,
+            code: Win32Error(ERROR_INVALID_NAME),
+        })?;
+        let mut name = [0u16; VOLUME_NAME_CAPACITY as usize];
+        // SAFETY: GetVolumeNameForVolumeMountPointW with a NUL-terminated mount point and a buffer
+        // of VOLUME_NAME_CAPACITY CHAR16s and that count, which it writes at most.
+        let found = unsafe {
+            GetVolumeNameForVolumeMountPointW(
+                root.as_ptr(),
+                name.as_mut_ptr(),
+                VOLUME_NAME_CAPACITY,
+            )
+        };
+        match found {
+            0 => Err(failed(MOUNT_POINT_CALL)),
+            _ => Ok(up_to_nul(&name)),
+        }
+    }
+}
+
+/// Opens the volume or disk `device` with `access`: CreateFileW.
+fn open(device: &str, access: u32) -> Result<OwnedHandle, CallFailed> {
+    // what CreateFileW gives for a name that it cannot take
+    let name = nul_terminated_utf16(device).ok_or(CallFailed {
+        call: "CreateFileW",
+        code: Win32Error(ERROR_INVALID_NAME),
+    })?;
+    // SAFETY: CreateFileW with a NUL-terminated name, the access, both shares that a volume or
+    // disk needs, no security attributes, OPEN_EXISTING, no flags and no template.
+    let handle = unsafe {
+        CreateFileW(
+            name.as_ptr(),
+            access,
+            FILE_SHARE_READ | FILE_SHARE_WRITE,
+            ptr::null(),
+            OPEN_EXISTING,
+            0,
+            ptr::null_mut(),
+        )
+    };
+    if handle == INVALID_HANDLE_VALUE {
+        return Err(failed("CreateFileW"));
+    }
+    // SAFETY: CreateFileW succeeded, so `handle` is a handle that it opened for this call, which
+    // nothing else owns or closes.
+    Ok(unsafe { OwnedHandle::from_raw_handle(handle) })
+}
+
+/// The failure of `call`, with the calling thread's last error.
+fn failed(call: &'static str) -> CallFailed {
+    CallFailed {
+        call,
+        code: Win32Error::last(),
+    }
+}
+
+/// The CHAR16s of `buffer` before the first NUL, as text. Volume GUID paths hold ASCII alone
+/// (Microsoft Learn, Naming a Volume); any other CHAR16 shows as U+FFFD, and the call that takes
+/// that text fails on it.
+fn up_to_nul(buffer: &[u16]) -> String {
+    let end = buffer
+        .iter()
+        .position(|&unit| unit == 0)
+        .unwrap_or(buffer.len());
+    String::from_utf16_lossy(buffer.get(..end).unwrap_or_default())
+}
+
+/// The bytes of a VOLUME_DISK_EXTENTS of `count` extents, None past usize.
+fn extents_size(count: usize) -> Option<usize> {
+    size_of::<DISK_EXTENT>()
+        .checked_mul(count)?
+        .checked_add(offset_of!(VOLUME_DISK_EXTENTS, Extents))
+}
+
+/// The DISK_EXTENT that `bytes` hold, None if they end before it.
+fn disk_extent(bytes: &[u8]) -> Option<DiskExtent> {
+    Some(DiskExtent {
+        disk_number: u32::from_ne_bytes(field(bytes, offset_of!(DISK_EXTENT, DiskNumber))?),
+        starting_offset: i64::from_ne_bytes(field(bytes, offset_of!(DISK_EXTENT, StartingOffset))?),
+        extent_length: i64::from_ne_bytes(field(bytes, offset_of!(DISK_EXTENT, ExtentLength))?),
+    })
+}
+
+/// The `N` bytes at byte `at` of `buffer`, None if `buffer` ends before them.
+fn field<const N: usize>(buffer: &[u8], at: usize) -> Option<[u8; N]> {
+    buffer.get(at..at.checked_add(N)?)?.try_into().ok()
+}
diff --git a/src/lib/esp/windows.rs b/src/lib/esp/windows.rs
new file mode 100644
index 0000000..5993e39
--- /dev/null
+++ b/src/lib/esp/windows.rs
@@ -0,0 +1,864 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The EFI system partition on Windows, which mounts it without a drive letter: the volume of
+//! FindFirstVolumeW and FindNextVolumeW whose partition is an ESP in its disk's partition table,
+//! the one that BootCurrent's Hard Drive node names. Its volume GUID path names its root
+//! directory (Microsoft Learn, Naming a Volume). Opening volumes and disks needs Administrator.
+
+use std::fmt;
+use std::io;
+use std::path::Path;
+use std::path::PathBuf;
+
+use anyhow::anyhow;
+use anyhow::Result;
+use thiserror::Error;
+
+use super::boot_current_hard_drive;
+use super::described;
+use super::is_wanted;
+use super::wanted;
+use super::BlockDevice;
+use super::EspLocator;
+use super::MountedEsp;
+use super::PartitionExtent;
+use super::PartitionTable;
+use super::PartitionTableError;
+use crate::efi_variables::load_option::HardDrive;
+use crate::efi_variables::VariableData;
+use crate::hii::win32::Win32Error;
+
+/// A Win32 call that failed, and the code that it left.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct CallFailed {
+    pub(crate) call: &'static str,
+    pub(crate) code: Win32Error,
+}
+
+impl fmt::Display for CallFailed {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{} failed: {}", self.call, self.code)?;
+        if self.code == Win32Error::ACCESS_DENIED {
+            write!(
+                f,
+                " (ERROR_ACCESS_DENIED): uefisettings needs Administrator"
+            )?;
+        }
+        Ok(())
+    }
+}
+
+impl std::error::Error for CallFailed {}
+
+/// A run of a volume on a disk, in bytes, as DISK_EXTENT holds it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct DiskExtent {
+    pub(crate) disk_number: u32,
+    pub(crate) starting_offset: i64,
+    pub(crate) extent_length: i64,
+}
+
+impl fmt::Display for DiskExtent {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "{} bytes at byte {} of disk {}",
+            self.extent_length, self.starting_offset, self.disk_number
+        )
+    }
+}
+
+/// The Win32 calls that locate reads volumes and disks through, behind which tests fake them.
+pub(crate) trait EspCalls {
+    /// The volume search of FindFirstVolumeW, which FindVolumeClose ends
+    type Search;
+    /// An open \\.\PhysicalDriveN
+    type Disk;
+
+    /// FindFirstVolumeW: the search and the first volume GUID path, which ends in a backslash.
+    fn find_first_volume(&self) -> Result<(Self::Search, String), CallFailed>;
+
+    /// FindNextVolumeW: the next volume GUID path; ERROR_NO_MORE_FILES after the last.
+    fn find_next_volume(&self, search: &mut Self::Search) -> Result<String, CallFailed>;
+
+    /// The extents of the volume that `device`, a volume GUID path without its trailing
+    /// backslash, opens: CreateFileW, then IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS.
+    fn volume_disk_extents(&self, device: &str) -> Result<Vec<DiskExtent>, CallFailed>;
+
+    /// Opens \\.\PhysicalDrive`number` to read: CreateFileW.
+    fn open_disk(&self, number: u32) -> Result<Self::Disk, CallFailed>;
+
+    /// The logical block size of `disk`: IOCTL_DISK_GET_DRIVE_GEOMETRY.
+    fn disk_block_size(&self, disk: &Self::Disk) -> Result<u32, CallFailed>;
+
+    /// Reads `buffer` from byte `offset` of `disk`: ReadFile. Returns the bytes read.
+    fn read_disk(
+        &self,
+        disk: &Self::Disk,
+        offset: u64,
+        buffer: &mut [u8],
+    ) -> Result<usize, CallFailed>;
+
+    /// The volume GUID path, which ends in a backslash, of the volume mounted at `mount_point`,
+    /// which ends in one too: GetVolumeNameForVolumeMountPointW.
+    fn volume_name(&self, mount_point: &str) -> Result<String, CallFailed>;
+}
+
+impl<C: EspCalls> EspLocator for C {
+    /// The ESP that staging writes to: the volume whose partition the Hard Drive node of
+    /// BootCurrent's Boot#### names, else, if it names none, the only ESP; refused unless exactly
+    /// one volume is that, and if Windows denies a volume or disk to this process. A GPT partition
+    /// matches by its UniquePartitionGUID; an MBR one by its disk signature and partition number.
+    fn locate(&self, variables: &impl VariableData) -> Result<MountedEsp> {
+        let named = boot_current_hard_drive(variables)?;
+        let volumes: Vec<(String, Result<HardDrive, VolumeError>)> = volume_paths(self)
+            .map_err(|failed| anyhow!("cannot list the volumes: {failed}"))?
+            .into_iter()
+            .map(|path| {
+                let hard_drive = volume_hard_drive(self, &path);
+                (path, hard_drive)
+            })
+            .collect();
+        if let Some((path, failed)) = volumes.iter().find_map(|(path, hard_drive)| {
+            let failed = hard_drive.as_ref().err()?.denied()?;
+            Some((path, failed))
+        }) {
+            return Err(anyhow!("cannot read volume {path}: {failed}"));
+        }
+
+        let matching: Vec<MountedEsp> = volumes
+            .iter()
+            .filter_map(|(path, hard_drive)| {
+                let hard_drive = *hard_drive.as_ref().ok()?;
+                is_wanted(named.as_ref(), &hard_drive).then(|| MountedEsp {
+                    mount_point: PathBuf::from(path),
+                    hard_drive,
+                })
+            })
+            .collect();
+        let wanted = wanted(named.as_ref());
+        match matching.as_slice() {
+            [esp] => Ok(esp.clone()),
+            [] => Err(anyhow!(
+                "no volume is {wanted}. Volumes: {}",
+                listed(&volumes)
+            )),
+            several => Err(anyhow!(
+                "several volumes are {wanted}: {}",
+                several
+                    .iter()
+                    .map(|esp| esp.mount_point.display().to_string())
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            )),
+        }
+    }
+
+    /// `esp`, written through `mount_point`, where the user mounted it, as `mountvol S: /s` does:
+    /// refused unless the volume there is `esp`'s.
+    fn mounted_at(&self, esp: MountedEsp, mount_point: &Path) -> Result<MountedEsp> {
+        let text = mount_point
+            .to_str()
+            .ok_or_else(|| anyhow!("{} is no Unicode mount point", mount_point.display()))?;
+        // GetVolumeNameForVolumeMountPointW takes a mount point that ends in a backslash
+        let root = match text.ends_with('\\') {
+            true => text.to_owned(),
+            false => format!("{text}\\"),
+        };
+        let volume = self
+            .volume_name(&root)
+            .map_err(|failed| anyhow!("cannot find the volume at {root}: {failed}"))?;
+        let esp_volume = esp.mount_point.display().to_string();
+        // the hexadecimal digits of a GUID match in either case
+        match volume.eq_ignore_ascii_case(&esp_volume) {
+            true => Ok(MountedEsp {
+                mount_point: PathBuf::from(root),
+                hard_drive: esp.hard_drive,
+            }),
+            false => Err(anyhow!(
+                "{root} is volume {volume}, not the EFI system partition, volume {esp_volume}"
+            )),
+        }
+    }
+}
+
+/// The volume GUID paths that FindFirstVolumeW and FindNextVolumeW list. Only
+/// ERROR_NO_MORE_FILES ends the list; any other failure refuses it.
+fn volume_paths(calls: &impl EspCalls) -> Result<Vec<String>, CallFailed> {
+    let (mut search, first) = match calls.find_first_volume() {
+        Ok(found) => found,
+        Err(failed) if failed.code == Win32Error::NO_MORE_FILES => return Ok(Vec::new()),
+        Err(failed) => return Err(failed),
+    };
+    let mut paths = vec![first];
+    loop {
+        match calls.find_next_volume(&mut search) {
+            Ok(path) => paths.push(path),
+            Err(failed) if failed.code == Win32Error::NO_MORE_FILES => return Ok(paths),
+            Err(failed) => return Err(failed),
+        }
+    }
+}
+
+/// Why a volume is no ESP that staging can write to.
+#[derive(Debug, Error)]
+enum VolumeError {
+    #[error(transparent)]
+    Call(#[from] CallFailed),
+    #[error("its volume GUID path ends in no backslash")]
+    NoRootBackslash,
+    #[error("it spans no disk extent")]
+    NoExtent,
+    #[error("it spans {} disk extents, not one: {}", .0.len(), extents(.0))]
+    Extents(Vec<DiskExtent>),
+    #[error("its disk extent, {0}, has a negative offset or length")]
+    NegativeExtent(DiskExtent),
+    #[error(transparent)]
+    Table(#[from] PartitionTableError),
+}
+
+impl VolumeError {
+    /// The call that Windows denied to this process, if that is why.
+    fn denied(&self) -> Option<&CallFailed> {
+        match self {
+            Self::Call(failed) => (failed.code == Win32Error::ACCESS_DENIED).then_some(failed),
+            Self::NoRootBackslash
+            | Self::NoExtent
+            | Self::Extents(_)
+            | Self::NegativeExtent(_)
+            | Self::Table(_) => None,
+        }
+    }
+}
+
+/// `extents`, in words.
+fn extents(extents: &[DiskExtent]) -> String {
+    extents
+        .iter()
+        .map(DiskExtent::to_string)
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
+/// The Hard Drive node of the ESP that the volume GUID path `path` names: its one disk extent must
+/// be an ESP of its disk's partition table, as PartitionTable::esp_hard_drive checks it.
+fn volume_hard_drive(calls: &impl EspCalls, path: &str) -> Result<HardDrive, VolumeError> {
+    let device = path
+        .strip_suffix('\\')
+        .ok_or(VolumeError::NoRootBackslash)?;
+    let disk_extents = calls.volume_disk_extents(device)?;
+    let extent = match disk_extents.as_slice() {
+        [extent] => extent,
+        [] => return Err(VolumeError::NoExtent),
+        [_, _, ..] => return Err(VolumeError::Extents(disk_extents)),
+    };
+    let (Ok(offset), Ok(length)) = (
+        u64::try_from(extent.starting_offset),
+        u64::try_from(extent.extent_length),
+    ) else {
+        return Err(VolumeError::NegativeExtent(*extent));
+    };
+    let disk = calls.open_disk(extent.disk_number)?;
+    let block_size = calls.disk_block_size(&disk)?;
+    let table = PartitionTable::read(&PhysicalDisk {
+        calls,
+        disk: &disk,
+        block_size,
+    })?;
+    Ok(table.esp_hard_drive(PartitionExtent { offset, length })?)
+}
+
+/// A disk that `calls` opened, read in logical blocks.
+struct PhysicalDisk<'a, C: EspCalls> {
+    calls: &'a C,
+    disk: &'a C::Disk,
+    block_size: u32,
+}
+
+impl<C: EspCalls> BlockDevice for PhysicalDisk<'_, C> {
+    fn block_size(&self) -> u32 {
+        self.block_size
+    }
+
+    fn read_blocks(&self, lba: u64, blocks: &mut [u8]) -> io::Result<()> {
+        let offset = lba
+            .checked_mul(u64::from(self.block_size))
+            .ok_or_else(|| io::Error::other(format!("LBA {lba} lies past 2^64 bytes")))?;
+        let read = self
+            .calls
+            .read_disk(self.disk, offset, blocks)
+            .map_err(io::Error::other)?;
+        match read == blocks.len() {
+            true => Ok(()),
+            false => Err(io::Error::new(
+                io::ErrorKind::UnexpectedEof,
+                format!(
+                    "ReadFile read {read} of {} bytes at byte {offset}",
+                    blocks.len()
+                ),
+            )),
+        }
+    }
+}
+
+/// The volumes, each with its partition or why it is no ESP, in words.
+fn listed(volumes: &[(String, Result<HardDrive, VolumeError>)]) -> String {
+    match volumes {
+        [] => "none".to_owned(),
+        _ => volumes
+            .iter()
+            .map(|(path, hard_drive)| match hard_drive {
+                Ok(hard_drive) => format!("{path} ({})", described(hard_drive)),
+                Err(error) => format!("{path} ({error})"),
+            })
+            .collect::<Vec<_>>()
+            .join("; "),
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use std::collections::BTreeMap;
+
+    use super::super::sfdisk_images::SfdiskImage;
+    use super::super::sfdisk_images::GPT_4096;
+    use super::super::sfdisk_images::GPT_512;
+    use super::super::sfdisk_images::MBR_512;
+    use super::super::sfdisk_images::QEMU_ESP_DISK;
+    use super::super::tests::booted_from;
+    use super::super::tests::gpt_512_esp;
+    use super::*;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::load_option::PartitionSignature;
+
+    /// Volume GUID paths, of an ESP, of a partition that is none, and of another ESP
+    const ESP: &str = r"\\?\Volume{8c78a505-baa0-4c4a-869f-000000001a03}\";
+    const DATA: &str = r"\\?\Volume{8c78a505-baa0-4c4a-869f-000000001a02}\";
+    const OTHER_ESP: &str = r"\\?\Volume{8c78a505-baa0-4c4a-869f-000000001a04}\";
+    /// The disk numbers of the fixtures
+    const GPT_512_DISK: u32 = 0;
+    const QEMU_DISK: u32 = 2;
+    /// A failure of a call that no other code names
+    const DEVICE_FAILED: Win32Error = Win32Error::INVALID_FUNCTION;
+
+    /// A disk: its logical block size, its bytes, and what reading it fails with, if it does.
+    struct FakeDisk {
+        block_size: u32,
+        bytes: Vec<u8>,
+        read_failure: Option<CallFailed>,
+    }
+
+    /// A Windows machine's volumes and disks, as the Win32 calls see them.
+    #[derive(Default)]
+    pub(crate) struct FakeWindows {
+        /// Each volume GUID path with the extents of its volume, or how getting them fails
+        volumes: Vec<(String, Result<Vec<DiskExtent>, CallFailed>)>,
+        /// How FindFirstVolumeW fails, if it does
+        first_failure: Option<CallFailed>,
+        /// How FindNextVolumeW fails after the last volume, if not with ERROR_NO_MORE_FILES
+        last_failure: Option<CallFailed>,
+        /// The disks by number, or how opening one fails
+        disks: BTreeMap<u32, Result<FakeDisk, CallFailed>>,
+        /// How IOCTL_DISK_GET_DRIVE_GEOMETRY fails, if it does
+        block_size_failure: Option<CallFailed>,
+        /// Each mount point with the volume GUID path of the volume mounted there
+        mount_points: BTreeMap<String, String>,
+    }
+
+    impl FakeWindows {
+        /// Adds disk `number` holding `image`.
+        fn disk(mut self, number: u32, image: &SfdiskImage) -> Self {
+            let disk = FakeDisk {
+                block_size: image.block_size,
+                bytes: image.bytes(),
+                read_failure: None,
+            };
+            self.disks.insert(number, Ok(disk));
+            self
+        }
+
+        /// Adds the volume `path` of the partition of disk `disk` from LBA `start` on, `size`
+        /// logical blocks long.
+        pub(crate) fn volume(mut self, path: &str, disk: u32, (start, size): (u64, u64)) -> Self {
+            let block_size = match self.disks.get(&disk) {
+                Some(Ok(disk)) => u64::from(disk.block_size),
+                Some(Err(_)) | None => 512,
+            };
+            let bytes = |blocks: u64| i64::try_from(blocks * block_size).expect("an offset");
+            let extent = DiskExtent {
+                disk_number: disk,
+                starting_offset: bytes(start),
+                extent_length: bytes(size),
+            };
+            self.volumes.push((path.to_owned(), Ok(vec![extent])));
+            self
+        }
+
+        /// GPT_512 as disk 0, with volumes of its ESP and its Linux partition.
+        pub(crate) fn with_esp() -> Self {
+            Self::with_esp_volume(ESP).volume(DATA, GPT_512_DISK, (4096, 2048))
+        }
+
+        /// Mounts the volume `volume` at `mount_point`.
+        pub(crate) fn mount(mut self, mount_point: &str, volume: &str) -> Self {
+            self.mount_points
+                .insert(mount_point.to_owned(), volume.to_owned());
+            self
+        }
+
+        /// GPT_512 as disk 0, with the volume `path` of its ESP.
+        pub(crate) fn with_esp_volume(path: &str) -> Self {
+            Self::default()
+                .disk(GPT_512_DISK, &GPT_512)
+                .volume(path, GPT_512_DISK, (2048, 2048))
+        }
+    }
+
+    impl EspCalls for FakeWindows {
+        type Search = usize;
+        type Disk = u32;
+
+        fn find_first_volume(&self) -> Result<(usize, String), CallFailed> {
+            if let Some(failed) = self.first_failure {
+                return Err(failed);
+            }
+            match self.volumes.first() {
+                Some((path, _)) => Ok((1, path.clone())),
+                None => Err(CallFailed {
+                    call: "FindFirstVolumeW",
+                    code: Win32Error::NO_MORE_FILES,
+                }),
+            }
+        }
+
+        fn find_next_volume(&self, search: &mut usize) -> Result<String, CallFailed> {
+            let Some((path, _)) = self.volumes.get(*search) else {
+                return Err(self.last_failure.unwrap_or(CallFailed {
+                    call: "FindNextVolumeW",
+                    code: Win32Error::NO_MORE_FILES,
+                }));
+            };
+            *search += 1;
+            Ok(path.clone())
+        }
+
+        fn volume_disk_extents(&self, device: &str) -> Result<Vec<DiskExtent>, CallFailed> {
+            let (_, extents) = self
+                .volumes
+                .iter()
+                .find(|(path, _)| path.strip_suffix('\\') == Some(device))
+                .unwrap_or_else(|| panic!("no volume {device}"));
+            extents.clone()
+        }
+
+        fn open_disk(&self, number: u32) -> Result<u32, CallFailed> {
+            match self.disks.get(&number) {
+                Some(Ok(_)) => Ok(number),
+                Some(Err(failed)) => Err(*failed),
+                None => Err(CallFailed {
+                    call: "CreateFileW",
+                    code: Win32Error::FILE_NOT_FOUND,
+                }),
+            }
+        }
+
+        fn disk_block_size(&self, disk: &u32) -> Result<u32, CallFailed> {
+            if let Some(failed) = self.block_size_failure {
+                return Err(failed);
+            }
+            Ok(self.fake_disk(*disk).block_size)
+        }
+
+        fn read_disk(
+            &self,
+            disk: &u32,
+            offset: u64,
+            buffer: &mut [u8],
+        ) -> Result<usize, CallFailed> {
+            let disk = self.fake_disk(*disk);
+            if let Some(failed) = disk.read_failure {
+                return Err(failed);
+            }
+            let start = usize::try_from(offset).expect("an offset in memory");
+            let available = disk.bytes.get(start..).unwrap_or_default();
+            let read = available.len().min(buffer.len());
+            buffer[..read].copy_from_slice(&available[..read]);
+            Ok(read)
+        }
+
+        fn volume_name(&self, mount_point: &str) -> Result<String, CallFailed> {
+            self.mount_points
+                .get(mount_point)
+                .cloned()
+                .ok_or(CallFailed {
+                    call: "GetVolumeNameForVolumeMountPointW",
+                    code: Win32Error::FILE_NOT_FOUND,
+                })
+        }
+    }
+
+    impl FakeWindows {
+        fn fake_disk(&self, number: u32) -> &FakeDisk {
+            match self.disks.get(&number) {
+                Some(Ok(disk)) => disk,
+                Some(Err(_)) | None => panic!("disk {number} is not open"),
+            }
+        }
+    }
+
+    /// QEMU_ESP_DISK's ESP, entry 2, the first partition on its disk.
+    fn qemu_esp() -> HardDrive {
+        HardDrive {
+            partition_number: 2,
+            start: 2048,
+            size: 81920,
+            signature: PartitionSignature::Gpt(
+                "8C78A505-BAA0-4C4A-869F-000000001A10"
+                    .parse()
+                    .expect("a GUID"),
+            ),
+        }
+    }
+
+    fn located(windows: &FakeWindows, variables: &HeldVariables) -> Result<MountedEsp, String> {
+        windows.locate(variables).map_err(|err| format!("{err:#}"))
+    }
+
+    fn mounted(path: &str, hard_drive: HardDrive) -> Result<MountedEsp, String> {
+        Ok(MountedEsp {
+            mount_point: PathBuf::from(path),
+            hard_drive,
+        })
+    }
+
+    /// The reason why GPT_512's Linux partition, entry 1, is no ESP.
+    const DATA_IS_NO_ESP: &str = "GPT entry 1 has PartitionTypeGUID \
+         0FC63DAF-8483-4772-8E79-3D69D8477DE4, not the EFI System Partition's \
+         C12A7328-F81F-11D2-BA4B-00A0C93EC93B";
+
+    #[test]
+    fn the_esp_is_the_volume_that_boot_current_names() {
+        // a mirrored boot configuration: an ESP on each of two disks
+        let windows = FakeWindows::with_esp()
+            .disk(QEMU_DISK, &QEMU_ESP_DISK)
+            .volume(OTHER_ESP, QEMU_DISK, (2048, 81920));
+
+        assert_eq!(
+            located(&windows, &booted_from(Some(qemu_esp()))),
+            mounted(OTHER_ESP, qemu_esp()),
+            "BootCurrent names QEMU_ESP_DISK's ESP"
+        );
+        assert_eq!(
+            located(&windows, &booted_from(Some(gpt_512_esp()))),
+            mounted(ESP, gpt_512_esp()),
+            "BootCurrent names GPT_512's ESP"
+        );
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            Err(format!(
+                "several volumes are an EFI system partition: {ESP}, {OTHER_ESP}"
+            )),
+            "BootCurrent names no partition"
+        );
+        assert_eq!(
+            located(&windows, &HeldVariables::default()),
+            Err(format!(
+                "several volumes are an EFI system partition: {ESP}, {OTHER_ESP}"
+            )),
+            "no BootCurrent"
+        );
+
+        let elsewhere = HardDrive {
+            signature: PartitionSignature::Gpt(
+                "8C78A505-BAA0-4C4A-869F-000000001A06"
+                    .parse()
+                    .expect("a GUID"),
+            ),
+            ..gpt_512_esp()
+        };
+        assert_eq!(
+            located(&windows, &booted_from(Some(elsewhere))),
+            Err(format!(
+                "no volume is the EFI system partition that BootCurrent names, GPT partition \
+                 8C78A505-BAA0-4C4A-869F-000000001A06. Volumes: {ESP} (GPT partition \
+                 8C78A505-BAA0-4C4A-869F-000000001A0E); {DATA} ({DATA_IS_NO_ESP}); {OTHER_ESP} \
+                 (GPT partition 8C78A505-BAA0-4C4A-869F-000000001A10)"
+            )),
+            "BootCurrent names an ESP that no volume is"
+        );
+    }
+
+    #[test]
+    fn exactly_one_volume_must_be_an_esp_when_boot_current_names_none() {
+        let windows = FakeWindows::with_esp();
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            mounted(ESP, gpt_512_esp()),
+            "one ESP"
+        );
+
+        let windows = FakeWindows::default().disk(GPT_512_DISK, &GPT_512).volume(
+            DATA,
+            GPT_512_DISK,
+            (4096, 2048),
+        );
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            Err(format!(
+                "no volume is an EFI system partition. Volumes: {DATA} ({DATA_IS_NO_ESP})"
+            )),
+            "no ESP"
+        );
+
+        assert_eq!(
+            located(&FakeWindows::default(), &booted_from(None)),
+            Err("no volume is an EFI system partition. Volumes: none".to_owned()),
+            "no volume"
+        );
+    }
+
+    #[test]
+    fn esps_are_named_as_firmware_names_them() {
+        let windows = FakeWindows::default()
+            .disk(4, &GPT_4096)
+            .volume(ESP, 4, (512, 256));
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            mounted(
+                ESP,
+                HardDrive {
+                    partition_number: 1,
+                    start: 512,
+                    size: 256,
+                    signature: PartitionSignature::Gpt(
+                        "8C78A505-BAA0-4C4A-869F-000000001A0A"
+                            .parse()
+                            .expect("a GUID"),
+                    ),
+                }
+            ),
+            "GPT_4096's ESP, in 4096-byte blocks"
+        );
+
+        let windows = FakeWindows::default()
+            .disk(1, &MBR_512)
+            .volume(ESP, 1, (4096, 2048));
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            mounted(
+                ESP,
+                HardDrive {
+                    partition_number: 2,
+                    start: 4096,
+                    size: 2048,
+                    signature: PartitionSignature::Mbr(0x5EC7_A1B2),
+                }
+            ),
+            "MBR_512's ESP, by its record's slot"
+        );
+
+        // the GPT entry's index, not its place on the disk
+        let windows = FakeWindows::default()
+            .disk(QEMU_DISK, &QEMU_ESP_DISK)
+            .volume(ESP, QEMU_DISK, (2048, 81920));
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            mounted(ESP, qemu_esp()),
+            "QEMU_ESP_DISK's ESP"
+        );
+    }
+
+    #[test]
+    fn a_volume_is_an_esp_only_if_one_disk_extent_is_an_esp_partition() {
+        let extent = |start: i64, length: i64| DiskExtent {
+            disk_number: GPT_512_DISK,
+            starting_offset: start,
+            extent_length: length,
+        };
+        let cases = [
+            (
+                "two extents",
+                Ok(vec![extent(1_048_576, 1_048_576), extent(2_097_152, 512)]),
+                "it spans 2 disk extents, not one: 1048576 bytes at byte 1048576 of disk 0, 512 \
+                 bytes at byte 2097152 of disk 0",
+            ),
+            ("no extent", Ok(Vec::new()), "it spans no disk extent"),
+            (
+                "a negative offset",
+                Ok(vec![extent(-512, 1_048_576)]),
+                "its disk extent, 1048576 bytes at byte -512 of disk 0, has a negative offset or \
+                 length",
+            ),
+            (
+                "a part of the ESP",
+                Ok(vec![extent(1_048_576, 512)]),
+                "partition table entry 3 spans LBA 2048 to 4095, but the volume spans 1 logical \
+                 blocks from LBA 2048",
+            ),
+            (
+                "no whole blocks",
+                Ok(vec![extent(1_048_577, 1_048_576)]),
+                "the partition at byte 1048577 of its disk, 1048576 bytes long, is no whole number \
+                 of the disk's 512-byte logical blocks",
+            ),
+            (
+                "a failed IOCTL",
+                Err(CallFailed {
+                    call: "DeviceIoControl(IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS)",
+                    code: DEVICE_FAILED,
+                }),
+                "DeviceIoControl(IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS) failed: Win32 error 1",
+            ),
+        ];
+        for (case, extents, reason) in cases {
+            let mut windows = FakeWindows::default().disk(GPT_512_DISK, &GPT_512);
+            windows.volumes.push((ESP.to_owned(), extents));
+            assert_eq!(
+                located(&windows, &booted_from(None)),
+                Err(format!(
+                    "no volume is an EFI system partition. Volumes: {ESP} ({reason})"
+                )),
+                "{case}"
+            );
+        }
+    }
+
+    #[test]
+    fn each_failed_win32_call_is_named() {
+        let failed = |call| CallFailed {
+            call,
+            code: DEVICE_FAILED,
+        };
+
+        let mut windows = FakeWindows::with_esp();
+        windows.first_failure = Some(failed("FindFirstVolumeW"));
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            Err("cannot list the volumes: FindFirstVolumeW failed: Win32 error 1".to_owned()),
+            "FindFirstVolumeW"
+        );
+
+        // only ERROR_NO_MORE_FILES ends the list
+        let mut windows = FakeWindows::with_esp();
+        windows.last_failure = Some(failed("FindNextVolumeW"));
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            Err("cannot list the volumes: FindNextVolumeW failed: Win32 error 1".to_owned()),
+            "FindNextVolumeW"
+        );
+
+        /// The disk's step that fails
+        #[derive(Clone, Copy, Debug)]
+        enum Step {
+            Open,
+            BlockSize,
+            Read,
+        }
+        for step in [Step::Open, Step::BlockSize, Step::Read] {
+            let mut windows = FakeWindows::with_esp();
+            let reason = match step {
+                Step::Open => {
+                    windows
+                        .disks
+                        .insert(GPT_512_DISK, Err(failed("CreateFileW")));
+                    "CreateFileW failed: Win32 error 1"
+                }
+                Step::BlockSize => {
+                    windows.block_size_failure =
+                        Some(failed("DeviceIoControl(IOCTL_DISK_GET_DRIVE_GEOMETRY)"));
+                    "DeviceIoControl(IOCTL_DISK_GET_DRIVE_GEOMETRY) failed: Win32 error 1"
+                }
+                Step::Read => {
+                    if let Some(Ok(disk)) = windows.disks.get_mut(&GPT_512_DISK) {
+                        disk.read_failure = Some(failed("ReadFile"));
+                    }
+                    "cannot read 512 bytes of the disk from LBA 0: ReadFile failed: Win32 error 1"
+                }
+            };
+            assert_eq!(
+                located(&windows, &booted_from(None)),
+                Err(format!(
+                    "no volume is an EFI system partition. Volumes: {ESP} ({reason}); {DATA} \
+                     ({reason})"
+                )),
+                "{step:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_short_read_is_no_partition_table() {
+        let mut windows = FakeWindows::default().disk(GPT_512_DISK, &GPT_512).volume(
+            ESP,
+            GPT_512_DISK,
+            (2048, 2048),
+        );
+        if let Some(Ok(disk)) = windows.disks.get_mut(&GPT_512_DISK) {
+            disk.bytes.truncate(1000);
+        }
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            Err(format!(
+                "no volume is an EFI system partition. Volumes: {ESP} (cannot read 512 bytes of \
+                 the disk from LBA 1: ReadFile read 488 of 512 bytes at byte 512)"
+            )),
+            "a disk of 1000 bytes"
+        );
+    }
+
+    #[test]
+    fn a_denied_volume_or_disk_asks_for_administrator() {
+        let denied = CallFailed {
+            call: "CreateFileW",
+            code: Win32Error::ACCESS_DENIED,
+        };
+        let refused = |path: &str| {
+            Err(format!(
+                "cannot read volume {path}: CreateFileW failed: Win32 error 5 \
+                 (ERROR_ACCESS_DENIED): uefisettings needs Administrator"
+            ))
+        };
+
+        let mut windows = FakeWindows::with_esp();
+        windows.disks.insert(GPT_512_DISK, Err(denied));
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            refused(ESP),
+            "CreateFileW of the disk"
+        );
+
+        // though another volume is the one ESP
+        let mut windows = FakeWindows::with_esp();
+        if let Some((_, extents)) = windows.volumes.iter_mut().find(|(path, _)| path == DATA) {
+            *extents = Err(denied);
+        }
+        assert_eq!(
+            located(&windows, &booted_from(None)),
+            refused(DATA),
+            "CreateFileW of a volume"
+        );
+    }
+
+    /// One fixture through the Linux and the Windows locators gives one Hard Drive node.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn linux_and_windows_name_one_esp_alike() {
+        let (linux, _mount_point) = crate::esp::linux::tests::FakeLinux::with_esp();
+        let variables = booted_from(None);
+        let on_linux = linux.paths.locate(&variables).expect("the ESP on Linux");
+        let on_windows = FakeWindows::with_esp()
+            .locate(&variables)
+            .expect("the ESP on Windows");
+        assert_eq!(on_windows.hard_drive, on_linux.hard_drive, "GPT_512's ESP");
+    }
+}
diff --git a/src/lib/exports.rs b/src/lib/exports.rs
index f0fdb23..2248a79 100644
--- a/src/lib/exports.rs
+++ b/src/lib/exports.rs
@@ -11,8 +11,10 @@
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 use std::collections::BTreeSet;
+use std::path::PathBuf;
 use std::rc::Rc;
 
+use anyhow::anyhow;
 use anyhow::Context;
 use anyhow::Result;
 #[cfg(firmware_memory_maps)]
@@ -53,6 +55,46 @@ use crate::efi_variables::authenticated::SignedWrite;
 pub use crate::efi_variables::authenticated::TimeStamp;
 #[cfg(variable_data)]
 pub use crate::efi_variables::authenticated::TimeStampError;
+#[cfg(variable_data)]
+use crate::efi_variables::boot_manager::create_key;
+#[cfg(variable_data)]
+use crate::efi_variables::boot_manager::create_load_option;
+#[cfg(variable_names)]
+use crate::efi_variables::boot_manager::hot_key_listing;
+#[cfg(variable_data)]
+use crate::efi_variables::boot_manager::set_attributes;
+#[cfg(variable_data)]
+use crate::efi_variables::boot_manager::set_device_path;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::AttributeChange;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::AttributesSet;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::DevicePathSet;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::DevicePathSource;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::DevicePathText;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::HotKey;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::HotKeyCreated;
+#[cfg(variable_data)]
+use crate::efi_variables::boot_manager::HotKeyListing;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::HotKeysFollowing;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::LoadOptionCategory;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::LoadOptionCreated;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::LoadOptionData;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::LoadOptionFlag;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::NewHotKey;
+#[cfg(variable_data)]
+pub use crate::efi_variables::boot_manager::NewLoadOption;
 #[cfg(capsule_delivery)]
 use crate::efi_variables::deliver_json_capsule;
 #[cfg(variable_data)]
@@ -87,6 +129,12 @@ pub use crate::efi_variables::globals::Signature;
 pub use crate::efi_variables::globals::SignatureList;
 #[cfg(variable_data)]
 pub use crate::efi_variables::globals::Timeout;
+#[cfg(variable_data)]
+pub use crate::efi_variables::key_option::InputKey;
+#[cfg(variable_data)]
+pub use crate::efi_variables::key_option::KeyModifier;
+#[cfg(variable_data)]
+pub use crate::efi_variables::key_option::KeyNameError;
 #[cfg(variable_names)]
 use crate::efi_variables::list_capsule_results;
 #[cfg(variable_names)]
@@ -167,10 +215,16 @@ use crate::hii::forms::keywords::KeywordStatement;
 use crate::hii::forms::list_questions;
 use crate::hii::forms::Choice;
 use crate::hii::forms::DeclaredDefault;
+use crate::hii::forms::DriverHeldQuestion;
+use crate::hii::forms::DriverStore;
 use crate::hii::forms::Exclusion;
+use crate::hii::forms::ExpressionBesideCallback;
 use crate::hii::forms::PasswordQuestions;
+use crate::hii::forms::QuestionDescriptor;
+use crate::hii::forms::QuestionExpression;
 use crate::hii::forms::QuestionFlags;
 use crate::hii::package;
+use crate::hii::package::DevicePath;
 #[cfg(any(variable_names, variable_info, variable_data))]
 pub use crate::hii::package::Guid;
 use crate::hii::time_services::TimeServices;
@@ -201,6 +255,7 @@ pub use crate::hii::KeywordValues;
 pub use crate::hii::LockdownMode;
 #[cfg(target_os = "linux")]
 pub use crate::hii::LockdownUnknown;
+use crate::hii::MatchTier;
 #[cfg(target_os = "linux")]
 pub use crate::hii::MemoryAccessDenied;
 #[cfg(target_os = "linux")]
@@ -222,16 +277,21 @@ pub use crate::hii::SystemTableError;
 pub use crate::hii::VariableAttributes;
 #[cfg(any(variable_names, variable_info))]
 pub use crate::hii::VariableKey;
+use crate::hii::VariableReach;
+use crate::hii::WithholdingVariables;
 use crate::hii::VOLATILE_ANNOTATION;
 #[cfg(variable_data)]
 use crate::secret_file::Secret;
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+use crate::staged_set::StagedRequest;
 use crate::terminal_text::TextLines;
 use crate::translation::get_qa_variations_hii;
 use crate::translation::translate_response;
 use crate::translation::HiiTranslation;
 use crate::unsafe_operations::PendingOperations;
 
-pub use crate::hii::forms::AccessLevel;
+pub use crate::hii::forms::AssumedVarStore;
+pub use crate::hii::forms::AssumedVarStoreError;
 pub use crate::hii::forms::IgnoredIfr;
 pub use crate::hii::forms::IncludedStates;
 pub use crate::hii::forms::KeywordError;
@@ -260,6 +320,8 @@ mod uefi;
 #[cfg(target_os = "windows")]
 mod windows;
 
+#[cfg(variable_info)]
+pub use crate::efi_variables::MetadataInfo;
 #[cfg(variable_info)]
 pub use crate::efi_variables::VariableInfo;
 #[cfg(target_os = "linux")]
@@ -299,8 +361,9 @@ impl VariableBackend {
 #[cfg(variable_info)]
 impl VariableBackend {
     /// The VariableInfo of the EFI variable `name` of the vendor GUID `vendor`, such as
-    /// "8BE4DF61-93CA-11D2-AA0D-00E098032B8C", without its data, which only the Windows build
-    /// reads.
+    /// "8BE4DF61-93CA-11D2-AA0D-00E098032B8C", without its data, of which it shows only the
+    /// EFI_VARIABLE_AUTHENTICATION_3 metadata of a variable with
+    /// EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS (VariableInfo::metadata).
     pub fn info(name: &str, vendor: &str) -> Result<VariableInfo> {
         let key = VariableKey {
             name: name.to_owned(),
@@ -314,7 +377,8 @@ impl VariableBackend {
 impl VariableBackend {
     /// The global variable `name` of UEFI 2.11 §3.3, or the signature database `name` of §32.7.1
     /// or §32.7.2, decoded, or that it is absent; of the vendor GUID `vendor`, such as
-    /// "8BE4DF61-93CA-11D2-AA0D-00E098032B8C", if given, which must be its own.
+    /// "8BE4DF61-93CA-11D2-AA0D-00E098032B8C", if given, which must be its own. An OsRecovery####
+    /// needs it, as each vendor has its own (§3.4.1).
     pub fn get(name: &str, vendor: Option<&str>) -> Result<GlobalVariable> {
         let vendor = vendor.map(parse_vendor).transpose()?;
         read_global(&Self::system_variable_data()?, name, vendor)
@@ -515,6 +579,59 @@ pub struct SignedVariableWrite<'a> {
     pub unsafe_operations: UnsafeOperations,
 }
 
+/// The variables of the boot manager that the OS writes (UEFI 2.11 §3.1).
+#[cfg(variable_data)]
+impl VariableBackend {
+    /// Sets and clears the flags and sets the category of the load option `name`, a Boot####,
+    /// Driver#### or SysPrep#### of EFI_GLOBAL_VARIABLE, as `change` says, every other bit and
+    /// byte kept, and updates the BootOptionCrc of each Key#### that followed a Boot#### to
+    /// follow it still; returns what it wrote.
+    pub fn set_attributes(name: &str, change: &AttributeChange) -> Result<AttributesSet> {
+        set_attributes(
+            &Self::system_variable_data()?,
+            &Self::hot_key_listing()?,
+            name,
+            change,
+        )
+    }
+
+    /// Creates the load option `name`, a Boot####, Driver#### or SysPrep#### of
+    /// EFI_GLOBAL_VARIABLE that does not exist, as `new` says; returns what it wrote and why the
+    /// boot manager may not take it.
+    pub fn create_load_option(name: &str, new: &NewLoadOption) -> Result<LoadOptionCreated> {
+        create_load_option(&Self::system_variable_data()?, name, new)
+    }
+
+    /// Sets the console variable `name`, ConIn, ConOut or ErrOut, to the one device path of
+    /// `path`; returns what it wrote and why the firmware may not use it.
+    pub fn set_device_path(name: &str, path: &DevicePathSource) -> Result<DevicePathSet> {
+        set_device_path(&Self::system_variable_data()?, name, path)
+    }
+
+    /// Creates the hot key `name`, a Key#### of EFI_GLOBAL_VARIABLE that does not exist, as
+    /// `new` says; returns what it wrote and what it could not check.
+    pub fn create_key(name: &str, new: &NewHotKey) -> Result<HotKeyCreated> {
+        create_key(
+            &Self::system_variable_data()?,
+            &Self::hot_key_listing()?,
+            name,
+            new,
+        )
+    }
+
+    /// The Key#### variables of this machine.
+    #[cfg(variable_names)]
+    fn hot_key_listing() -> Result<HotKeyListing> {
+        hot_key_listing(&Self::system_variable_names())
+    }
+
+    /// That the Key#### variables cannot be listed, as Windows gives programs no names.
+    #[cfg(not(variable_names))]
+    fn hot_key_listing() -> Result<HotKeyListing> {
+        Ok(HotKeyListing::Unlisted)
+    }
+}
+
 #[cfg(variable_storage_info)]
 impl VariableBackend {
     /// What QueryVariableInfo() tells of the storage of this machine's EFI variables of
@@ -588,8 +705,9 @@ pub struct GetOptions {
     pub include: IncludedStates,
     /// Where to read question values
     pub efivars: EfivarSource,
-    /// The AMI Setup access level that conditions read instead of the stored one, if stated
-    pub access_level: Option<AccessLevel>,
+    /// The VarStore bytes that conditions read in place of those their variables hold, as
+    /// --assume-var-store states them
+    pub assume_var_stores: Vec<AssumedVarStore>,
     /// The language to show texts in instead of the platform language (PlatformLang), if stated
     pub language: Option<String>,
 }
@@ -610,8 +728,9 @@ pub enum SetValue {
 pub struct SetOptions {
     /// The states of the questions and options to select too
     pub include: IncludedStates,
-    /// The AMI Setup access level that conditions read instead of the stored one, if stated
-    pub access_level: Option<AccessLevel>,
+    /// The VarStore bytes that conditions read in place of those their variables hold, as
+    /// --assume-var-store states them
+    pub assume_var_stores: Vec<AssumedVarStore>,
     /// Whether set does the unsafe operations that it meets, which it returns: in the UEFI
     /// Shell, a write in a HiiDB that declares a setup password question; a write of a question
     /// that EFI_IFR_FLAG_READ_ONLY makes read-only
@@ -621,6 +740,13 @@ pub struct SetOptions {
     pub volatile: VolatileWrites,
     /// The language to show texts in instead of the platform language (PlatformLang), if stated
     pub language: Option<String>,
+    /// On Linux and Windows, the uefisettings.efi that set copies to the EFI system partition when
+    /// it stages a question that its driver holds for the next boot
+    pub staging_image: Option<PathBuf>,
+    /// On Windows, where the user mounted the EFI system partition, such as S:\ after
+    /// `mountvol S: /s`: set writes the staged files through it instead of the partition's volume
+    /// GUID path, once it checks that the volume there is the ESP that it finds
+    pub staging_esp: Option<PathBuf>,
 }
 
 /// The options of HiiBackend::list_questions_using.
@@ -631,8 +757,9 @@ pub struct ListQuestionsOptions {
     pub include: IncludedStates,
     /// Where to read question values
     pub efivars: EfivarSource,
-    /// The AMI Setup access level that conditions read instead of the stored one, if stated
-    pub access_level: Option<AccessLevel>,
+    /// The VarStore bytes that conditions read in place of those their variables hold, as
+    /// --assume-var-store states them
+    pub assume_var_stores: Vec<AssumedVarStore>,
     /// The language to show texts in instead of the platform language (PlatformLang), if stated
     pub language: Option<String>,
 }
@@ -666,6 +793,87 @@ impl From<TextLines> for HiiShowIfrResponse {
     }
 }
 
+/// Where set reads and writes the values of the questions it selects.
+struct SetAccess<'a> {
+    reads: Box<dyn FirmwareVariables>,
+    writes: &'a dyn FirmwareVariables,
+    /// The drivers of the questions whose value only their driver holds, where this build
+    /// reaches them
+    held: Option<&'a dyn DriverHeldValues>,
+}
+
+/// The package list of a question in the HiiDB that get and set read.
+#[cfg_attr(
+    not(target_os = "uefi"),
+    allow(
+        dead_code,
+        reason = "only the UEFI Shell build reaches the list's driver"
+    )
+)]
+pub(crate) struct QuestionList<'a> {
+    /// Its index in the HiiDB
+    pub(crate) index: usize,
+    /// The device path of the driver handle that registered it, from its device path package
+    pub(crate) device_path: Option<&'a DevicePath>,
+}
+
+/// What get and set do with a question whose value only its driver holds (UEFI 2.11 §33.2.5.6),
+/// which each build reaches in its own way, if at all.
+pub(crate) trait DriverHeldValues {
+    /// How set's errors name the store of a question that this holds, after the selector of its
+    /// package list: `its driver`, or where set puts the value instead.
+    fn store_name(&self) -> &'static str;
+
+    /// get's answer for `question` of `list`, or why get fails.
+    fn get(
+        &self,
+        list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+    ) -> Result<String>;
+
+    /// Refuses what set of `question` of `list` would refuse before it reaches the driver, with
+    /// set's refusal, so that set refuses it before its first write.
+    fn check_set(
+        &self,
+        list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+    ) -> Result<()>;
+
+    /// Sets `question` of `list` to `value`, which driver_held_value and check_set checked;
+    /// returns the annotation of set's answer.
+    fn set(
+        &self,
+        list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+        value: u64,
+    ) -> Result<String>;
+}
+
+/// The refusal of set of `question` for `reason`.
+#[cfg_attr(
+    not(any(target_os = "uefi", target_os = "linux", target_os = "windows")),
+    allow(
+        dead_code,
+        reason = "only the UEFI Shell build reaches a question's driver, and only the Linux and \
+                  Windows builds stage a set for it"
+    )
+)]
+pub(crate) fn set_refusal(question: &str, reason: impl std::fmt::Display) -> anyhow::Error {
+    anyhow!("cannot set question {question:?}: {reason}")
+}
+
+/// The driver that holds the value of `descriptor`, through `held`, and what it needs; None if
+/// get and set read and write its VarStore, or, without one, show and refuse it (storageless.rs).
+fn driver_of<'h, 'd>(
+    held: Option<&'h dyn DriverHeldValues>,
+    descriptor: &'d QuestionDescriptor,
+) -> Option<(&'h dyn DriverHeldValues, &'d DriverHeldQuestion)> {
+    held.zip(descriptor.driver_held())
+}
+
 impl HiiBackend {
     /// show_ifr returns a human readable representation of the forms in Hii
     ///
@@ -844,9 +1052,9 @@ impl HiiBackend {
             .iter()
             .flat_map(package::ParsedPackageList::ignored_records)
             .collect();
-        forms::check_access_level(
+        let assumed = forms::check_assumed(
             parsed_db.iter().flat_map(|list| &list.forms),
-            options.access_level,
+            &options.assume_var_stores,
         )?;
         let requested = text_languages(options.language.as_deref(), platform_lang);
         for list in parsed_db {
@@ -857,13 +1065,9 @@ impl HiiBackend {
             for root in &list.forms {
                 //  TODO: show form name, package list guid in the final response as well
 
-                for (question_descriptor, state) in list_questions(
-                    Rc::clone(root),
-                    &texts,
-                    include,
-                    options.access_level,
-                    &mut reader,
-                ) {
+                for (question_descriptor, state) in
+                    list_questions(Rc::clone(root), &texts, include, assumed, &mut reader)
+                {
                     let annotation = String::from(question_descriptor.value_source.annotation())
                         + &question_descriptor.value_state.option_annotation()
                         + &state.annotation();
@@ -930,14 +1134,18 @@ impl HiiBackend {
         selector: Option<&str>,
         options: &SetOptions,
     ) -> Result<(SetResponseList, Vec<UnsafeOperation>)> {
+        let held = Self::driver_held_setter(db_bytes, options)?;
         Self::set_in(
             db_bytes,
             question,
             value,
             selector,
             options,
-            EfivarSource::System.into_variables()?,
-            &Self::system_variables()?,
+            SetAccess {
+                reads: EfivarSource::System.into_variables()?,
+                writes: &Self::system_variables()?,
+                held: held.as_deref(),
+            },
             EfivarSource::System.platform_lang()?.as_deref(),
         )
     }
@@ -945,11 +1153,12 @@ impl HiiBackend {
     /// set of the questions that `question` selects in the HiiDB `db_bytes` with `options`,
     /// selecting by the values of `reads`, which it reads before the first write, and writing
     /// through `writes`, neither of them the bytes of password questions
-    /// (PasswordQuestions::reader and withholding), on a platform of PlatformLang
-    /// `platform_lang`, if any: fails with SelectionError::NotFound when it selects none, and
-    /// unless every selected match is written, also after writing the others. It checks its unsafe
-    /// operations against `options` after every refusal that they cannot lift, right before its
-    /// first write, and returns those that it lifted.
+    /// (PasswordQuestions::reader and withholding), and a question whose driver holds its value
+    /// through `held`, on a platform of PlatformLang `platform_lang`, if any: fails with
+    /// SelectionError::NotFound when it selects none, and unless every selected match is written,
+    /// also after writing the others. It checks its unsafe operations against `options` after
+    /// every refusal that they cannot lift, right before its first write, which for a question
+    /// whose driver holds its value is its first Callback(), and returns those that it lifted.
     #[cfg_attr(
         not(system_variables),
         allow(
@@ -957,21 +1166,20 @@ impl HiiBackend {
             reason = "set writes only the variables of the machine, which this build does not reach"
         )
     )]
-    #[expect(
-        clippy::too_many_arguments,
-        reason = "set's inputs: the HiiDB, the question, the value, the selector, the options, the \
-                  variables to read and write, and the platform language"
-    )]
     fn set_in(
         db_bytes: &[u8],
         question: impl Into<QuestionSelector>,
         value: &SetValue,
         _selector: Option<&str>,
         options: &SetOptions,
-        reads: Box<dyn FirmwareVariables>,
-        writes: &dyn FirmwareVariables,
+        access: SetAccess<'_>,
         platform_lang: Option<&str>,
     ) -> Result<(SetResponseList, Vec<UnsafeOperation>)> {
+        let SetAccess {
+            reads,
+            writes,
+            held,
+        } = access;
         // TODO: use selector to only change values which match question + selector
         let include = options.include;
 
@@ -997,7 +1205,7 @@ impl HiiBackend {
         let (question_variations, new_value_variations, is_translated) =
             spellings(&question, new_value);
 
-        let selected = select_for_set(
+        let (selected, assumed) = select_for_set(
             &parsed_db,
             &question,
             &question_variations,
@@ -1005,8 +1213,19 @@ impl HiiBackend {
             &text_languages(options.language.as_deref(), platform_lang),
             &mut unsafe_operations,
             &mut reader,
+            held,
         )?;
 
+        // From an OS, set stages a question that its driver holds for the next boot
+        // (staged_set.rs); in the UEFI Shell, setup_password_bypass above took the setup password
+        // in.
+        let stages = writes.reach() == VariableReach::Runtime
+            && selected
+                .iter()
+                .any(|selected| driver_of(held, &selected.descriptor).is_some());
+        if let Some(staged) = passwords.staged_setup_password().filter(|_| stages) {
+            unsafe_operations.add(staged);
+        }
         let answer = match value {
             SetValue::Text(text) => forms::NewAnswer::Text {
                 text,
@@ -1014,34 +1233,34 @@ impl HiiBackend {
             },
             SetValue::Items(items) => forms::NewAnswer::Items(items),
         };
-        let (written, lifted) = forms::set_questions(
+        let (written, lifted) = set_selected(
             &name,
-            &selected
-                .iter()
-                .map(|(guid, question_descriptor, _)| (guid.as_str(), question_descriptor))
-                .collect::<Vec<_>>(),
+            &selected,
             answer,
             include,
             &mut reader,
-            options.access_level,
+            assumed,
             options.volatile,
             unsafe_operations,
             &writes,
+            held,
         )?;
-        let written: Vec<(String, Option<Vec<String>>, bool)> = written
-            .iter()
-            .map(|written| {
-                (
-                    written.given.answer(new_value),
-                    written.given.items(),
-                    written.volatile,
-                )
-            })
-            .collect();
 
-        for ((guid, question_descriptor, state), (answer, items, volatile)) in
-            selected.into_iter().zip(written)
+        for (
+            selected,
+            SetAnswer {
+                answer,
+                items,
+                volatile,
+            },
+        ) in selected.into_iter().zip(written)
         {
+            let Selected {
+                guid,
+                descriptor: question_descriptor,
+                state,
+                ..
+            } = selected;
             let volatile_annotation = match volatile {
                 true => VOLATILE_ANNOTATION,
                 false => "",
@@ -1091,12 +1310,18 @@ impl HiiBackend {
             options.efivars.clone().into_variables()?,
             system_snapshot(&options.efivars),
             options.efivars.platform_lang()?.as_deref(),
+            Self::driver_held_values(db_bytes, &options.efivars).as_deref(),
         )
     }
 
     /// get with `options`, reading question values from `variables`, or from the snapshot
     /// `exported` where they miss a variable, on a platform of PlatformLang `platform_lang`, if
-    /// any
+    /// any, and a question whose driver holds its value through `held`
+    #[expect(
+        clippy::too_many_arguments,
+        reason = "get's inputs: the HiiDB, the question, the selector, the options, the variables, \
+                  the snapshot, the platform language and the driver-held values"
+    )]
     fn get_in(
         db_bytes: &[u8],
         question: impl Into<QuestionSelector>,
@@ -1105,6 +1330,7 @@ impl HiiBackend {
         variables: Box<dyn FirmwareVariables>,
         exported: Option<ExportedConfig>,
         platform_lang: Option<&str>,
+        held: Option<&dyn DriverHeldValues>,
     ) -> Result<GetResponseList> {
         // TODO: use selector to only get questions which match question + selector
         // TODO: take a form@packagelist selector to pick one of the FormSets that select
@@ -1118,17 +1344,18 @@ impl HiiBackend {
         let (question_variations, _, is_translated) = spellings(&question, "");
 
         let (parsed_db, mut reader) = read_db_withholding(db_bytes, variables, exported)?;
-        forms::check_access_level(
+        let assumed = forms::check_assumed(
             parsed_db.iter().flat_map(|list| &list.forms),
-            options.access_level,
+            &options.assume_var_stores,
         )?;
         let ignored_ifr = listed_ignored_ifr(&parsed_db)?;
-        check_unambiguous(&parsed_db, &question, &question_variations)?;
+        let tier = prompt_tier(&parsed_db, &question_variations);
+        check_unambiguous(&parsed_db, &question, &question_variations, tier)?;
         let statements = keyword_statements(&parsed_db, &question)?;
 
         let requested = text_languages(options.language.as_deref(), platform_lang);
         let mut excluded = Exclusion::NONE;
-        for list in &parsed_db {
+        for (index, list) in parsed_db.iter().enumerate() {
             list.check_form_strings()?;
             let texts = list.texts(&requested);
             reader.enter_package_list(list, &texts);
@@ -1137,9 +1364,9 @@ impl HiiBackend {
                 let selection = forms::find_question(
                     Rc::clone(root),
                     &texts,
-                    &question.matching(&question_variations, &statements),
+                    &question.matching(&question_variations, tier, &statements),
                     include,
-                    options.access_level,
+                    assumed,
                     &mut reader,
                 );
                 let (question_descriptor, state) = match selection.for_get() {
@@ -1151,11 +1378,24 @@ impl HiiBackend {
                 };
                 let source_annotation = question_descriptor.value_source.annotation();
                 let option_annotation = question_descriptor.value_state.option_annotation();
+                let answer = match driver_of(held, &question_descriptor) {
+                    Some((held, driver_held)) => {
+                        let list = QuestionList {
+                            index,
+                            device_path: list.device_path.as_ref(),
+                        };
+                        held.get(&list, &question_descriptor, driver_held)?
+                    }
+                    None => question_descriptor.value.clone(),
+                };
                 let mut get_resp = GetResponse {
                     selector: list.guid.to_string(),
                     backend: Backend::Hii,
                     is_translated,
-                    question: question_of(question_descriptor, include),
+                    question: Question {
+                        answer,
+                        ..question_of(question_descriptor, include)
+                    },
                     ..Default::default()
                 };
 
@@ -1275,14 +1515,35 @@ fn spellings(
     }
 }
 
+/// The tier in which a prompt of `variations` selects questions in `parsed_db`: Stored where the
+/// prompt as stored of a listed question of any FormSet is one of them, else Displayed. So a
+/// text that reads otherwise than the firmware holds it never selects a question, in any FormSet,
+/// where a text as stored selects one.
+fn prompt_tier(
+    parsed_db: &[package::ParsedPackageList],
+    variations: &BTreeSet<String>,
+) -> MatchTier {
+    let stored = parsed_db.iter().any(|list| {
+        let texts = list.texts(&[]);
+        list.forms.iter().any(|root| {
+            !forms::prompt_matches(root, &texts, variations, MatchTier::Stored).is_empty()
+        })
+    });
+    match stored {
+        true => MatchTier::Stored,
+        false => MatchTier::Displayed,
+    }
+}
+
 /// Refuses a `question` that names questions ambiguously in `parsed_db`: by prompt, unless one
-/// language holds it as the prompt of every question that its `variations` name
-/// (forms::check_prompt_language); by address, if two questions of one FormSet hold it
+/// language holds it as the prompt, as `tier` takes it, of every question that its `variations`
+/// name (forms::check_prompt_language); by address, if two questions of one FormSet hold it
 /// (forms::check_address_unique). keyword_statements refuses a keyword's.
 fn check_unambiguous(
     parsed_db: &[package::ParsedPackageList],
     question: &QuestionSelector,
     variations: &BTreeSet<String>,
+    tier: MatchTier,
 ) -> Result<()> {
     let mut matches = Vec::new();
     for list in parsed_db {
@@ -1291,7 +1552,7 @@ fn check_unambiguous(
         for root in &list.forms {
             match question {
                 QuestionSelector::Prompt(_) => {
-                    matches.extend(forms::prompt_matches(root, &texts, variations));
+                    matches.extend(forms::prompt_matches(root, &texts, variations, tier));
                 }
                 QuestionSelector::Address(address) => {
                     forms::check_address_unique(root, &texts, address)?;
@@ -1343,61 +1604,93 @@ fn time_services() -> Option<Rc<dyn TimeServices>> {
     None
 }
 
+/// A question that set writes, with its package list.
+struct Selected<'a> {
+    /// The GUID of its package list
+    guid: String,
+    list: QuestionList<'a>,
+    descriptor: QuestionDescriptor,
+    state: forms::StateEvaluation,
+}
+
 /// set's phase before its first write, so that no error follows a write: checks every package
-/// list of `parsed_db`, the stated access level and that `question` is unambiguous
-/// (check_unambiguous), then
+/// list of `parsed_db`, the stated VarStore bytes (check_assumed) and that `question` is
+/// unambiguous (check_unambiguous), then
 /// selects, in each FormSet, the question of `question` that set writes, by prompt any of
 /// `question_variations`, its texts shown in the languages `requested` takes
-/// (ParsedPackageList::texts), reading each range once with `reader`; returns them with the
-/// GUID of their package list, or SelectionError::Excluded for `question` if each FormSet skips
-/// it for its states, or else MaybeInIgnoredIfr if none holds it and read_db ignores IFR of
-/// `parsed_db`. It takes the write of each that EFI_IFR_FLAG_READ_ONLY makes read-only into
-/// `unsafe_operations`.
-fn select_for_set(
-    parsed_db: &[package::ParsedPackageList],
+/// (ParsedPackageList::texts), reading each range once with `reader`; returns them with their
+/// package list, and those bytes checked, or SelectionError::Excluded for `question` if each
+/// FormSet skips it for its states, or else MaybeInIgnoredIfr if none holds it and read_db
+/// ignores IFR of `parsed_db`. It takes the write of each that EFI_IFR_FLAG_READ_ONLY makes
+/// read-only into `unsafe_operations`.
+#[expect(
+    clippy::too_many_arguments,
+    reason = "select's inputs, the unsafe operations it takes in, and the driver that holds the \
+              values of the others"
+)]
+fn select_for_set<'a, 'o>(
+    parsed_db: &'a [package::ParsedPackageList],
     question: &QuestionSelector,
     question_variations: &BTreeSet<String>,
-    options: &SetOptions,
+    options: &'o SetOptions,
     requested: &[&str],
     unsafe_operations: &mut PendingOperations,
     reader: &mut EfivarReader,
-) -> Result<Vec<(String, forms::QuestionDescriptor, forms::StateEvaluation)>> {
-    forms::check_access_level(
+    held: Option<&dyn DriverHeldValues>,
+) -> Result<(Vec<Selected<'a>>, forms::CheckedVarStores<'o>)> {
+    let assumed = forms::check_assumed(
         parsed_db.iter().flat_map(|list| &list.forms),
-        options.access_level,
+        &options.assume_var_stores,
     )?;
     parsed_db
         .iter()
         .try_for_each(package::ParsedPackageList::check_form_strings)?;
-    check_unambiguous(parsed_db, question, question_variations)?;
+    let tier = prompt_tier(parsed_db, question_variations);
+    check_unambiguous(parsed_db, question, question_variations, tier)?;
     let statements = keyword_statements(parsed_db, question)?;
 
     // Every FormSet selects its question and option before the first write, so that a
     // selection error leaves every variable unchanged.
     let mut selected = Vec::new();
     let mut excluded = Exclusion::NONE;
-    for list in parsed_db {
+    for (index, list) in parsed_db.iter().enumerate() {
         let texts = list.texts(requested);
         for root in &list.forms {
             // try to find the question
             let selection = forms::find_question(
                 Rc::clone(root),
                 &texts,
-                &question.matching(question_variations, &statements),
+                &question.matching(question_variations, tier, &statements),
                 options.include,
-                options.access_level,
+                assumed,
                 reader,
             );
-            match forms::choice_for_set(
-                selection,
-                &question.to_string(),
-                options,
-                forms::ReadOnlyWriter::Set(&mut *unsafe_operations),
-                reader,
-            )? {
-                Choice::Chosen(question_descriptor, state) => {
-                    selected.push((list.guid.to_string(), question_descriptor, state));
-                }
+            // its driver takes the value of a question that set may write, whatever the reach
+            // of `reader`
+            let through_driver = selection
+                .written_or_likely()
+                .is_some_and(|((candidate, _), _)| driver_of(held, candidate).is_some());
+            let writer = forms::ReadOnlyWriter::Set(&mut *unsafe_operations);
+            let choice = match through_driver {
+                true => forms::read_only_choice(selection, &question.to_string(), writer)?,
+                false => forms::choice_for_set(
+                    selection,
+                    &question.to_string(),
+                    options,
+                    writer,
+                    reader,
+                )?,
+            };
+            match choice {
+                Choice::Chosen(descriptor, state) => selected.push(Selected {
+                    guid: list.guid.to_string(),
+                    list: QuestionList {
+                        index,
+                        device_path: list.device_path.as_ref(),
+                    },
+                    descriptor,
+                    state,
+                }),
                 // question not found in this FormSet
                 // or only in states that `include` does not allow
                 Choice::Skipped(exclusion) => excluded |= exclusion,
@@ -1418,7 +1711,7 @@ fn select_for_set(
         }
         .into());
     }
-    Ok(selected)
+    Ok((selected, assumed))
 }
 
 /// The Question of `descriptor` that get, set and list-questions show, its answer the value as
@@ -1497,8 +1790,250 @@ fn listed_defaults(defaults: Vec<DeclaredDefault>) -> Option<Vec<QuestionDefault
     })
 }
 
+/// Sets each of the `selected` questions to `answer` with `include`, through set_questions with
+/// `reader`, `assumed`, `volatile`, `unsafe_operations` and `writes`: those with a VarStore
+/// in their variables, then each of those whose driver holds the value through `held`
+/// (DriverHeldSet), after refusing questions of more than one kind (check_one_kind) and checking
+/// every value and what each driver would refuse first, and the unsafe operations before the
+/// first write, also before the first Callback(). Returns the SetAnswer of each, in `selected`
+/// order, and the unsafe operations that it lifted.
+#[expect(
+    clippy::too_many_arguments,
+    reason = "set_questions' inputs, and the driver that holds the values of the others"
+)]
+fn set_selected(
+    question: &str,
+    selected: &[Selected<'_>],
+    answer: forms::NewAnswer<'_>,
+    include: IncludedStates,
+    reader: &mut EfivarReader,
+    assumed: forms::CheckedVarStores<'_>,
+    volatile: VolatileWrites,
+    unsafe_operations: PendingOperations,
+    writes: &WithholdingVariables<impl FirmwareVariables>,
+    held: Option<&dyn DriverHeldValues>,
+) -> Result<(Vec<SetAnswer>, Vec<UnsafeOperation>)> {
+    forms::check_one_kind(
+        question,
+        &selected
+            .iter()
+            .map(|selected| (selected.guid.as_str(), &selected.descriptor))
+            .collect::<Vec<_>>(),
+    )?;
+    let held_sets = selected
+        .iter()
+        .filter_map(|selected| {
+            let (held, driver_held) = driver_of(held, &selected.descriptor)?;
+            // refused before any write, as the driver's Callback()s would refuse it
+            let value = match driver_held.write_expression {
+                true => Err(ExpressionBesideCallback(QuestionExpression::Write).into()),
+                false => selected
+                    .descriptor
+                    .driver_held_value(answer, include)
+                    .map_err(anyhow::Error::from),
+            };
+            Some(value.and_then(|value| {
+                held.check_set(&selected.list, &selected.descriptor, driver_held)?;
+                Ok(DriverHeldSet {
+                    selected,
+                    held,
+                    driver_held,
+                    value,
+                })
+            }))
+        })
+        .collect::<Result<Vec<_>>>()?;
+    let stored: Vec<(&str, &QuestionDescriptor)> = selected
+        .iter()
+        .filter(|selected| driver_of(held, &selected.descriptor).is_none())
+        .map(|selected| (selected.guid.as_str(), &selected.descriptor))
+        .collect();
+    let drivers: Vec<&dyn DriverStore> = held_sets
+        .iter()
+        .map(|held_set| held_set as &dyn DriverStore)
+        .collect();
+
+    let (written, held_annotations, lifted) = forms::set_questions(
+        question,
+        &stored,
+        answer,
+        include,
+        reader,
+        assumed,
+        volatile,
+        unsafe_operations,
+        writes,
+        &drivers,
+    )?;
+    let text = match answer {
+        forms::NewAnswer::Text { text, .. } => text,
+        forms::NewAnswer::Items(_) => "",
+    };
+    let mut stored_answers = written.iter().map(|written| SetAnswer {
+        answer: written.given.answer(text),
+        items: written.given.items(),
+        volatile: written.volatile,
+    });
+    // a driver keeps the value, in no variable
+    let mut held_answers = held_annotations.into_iter().map(|annotation| SetAnswer {
+        answer: text.to_owned() + &annotation,
+        items: None,
+        volatile: false,
+    });
+    let answers = selected
+        .iter()
+        .map(|selected| {
+            let answer = match driver_of(held, &selected.descriptor) {
+                Some(_) => held_answers.next(),
+                None => stored_answers.next(),
+            };
+            answer.unwrap_or_default()
+        })
+        .collect();
+    Ok((answers, lifted))
+}
+
+/// What set shows of a question that it set: its answer, the items of an ORDERED_LIST, and whether
+/// set wrote a volatile variable for it.
+#[derive(Default)]
+struct SetAnswer {
+    answer: String,
+    items: Option<Vec<String>>,
+    volatile: bool,
+}
+
+/// A question whose driver holds its value, with the value that set checked for it: set
+/// applies it through `held` after the variable writes.
+struct DriverHeldSet<'s> {
+    selected: &'s Selected<'s>,
+    held: &'s dyn DriverHeldValues,
+    driver_held: &'s DriverHeldQuestion,
+    value: u64,
+}
+
+impl DriverStore for DriverHeldSet<'_> {
+    fn label(&self) -> String {
+        format!("{} ({})", self.selected.guid, self.held.store_name())
+    }
+
+    fn apply(&self) -> Result<String> {
+        self.held.set(
+            &self.selected.list,
+            &self.selected.descriptor,
+            self.driver_held,
+            self.value,
+        )
+    }
+}
+
+/// The question that apply-staged sets for `request` in `parsed_db`: the one whose driver holds its
+/// value as QuestionId `request.question_id` of the FormSet `request.form_set`, with its package
+/// list and how its driver holds it, and the unsafe operations that setting it lifts. Refused
+/// unless exactly one question is that, the states of `request.include` cover each state it may be
+/// in, with conditions reading the VarStore bytes that `request.assume_var_stores` states, as set's
+/// selection reads them with `reader`, it takes the request's value type, and no EFI_IFR_VALUE
+/// makes it read-only. A HiiDB
+/// that declares a setup password question, and a question that EFI_IFR_FLAG_READ_ONLY makes
+/// read-only, are unsafe operations, checked against `request.unsafe_operations`, set's grant, as
+/// set checks them. Its texts show in the languages `requested` takes (ParsedPackageList::texts).
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+fn staged_question<'a>(
+    parsed_db: &'a [package::ParsedPackageList],
+    request: &StagedRequest,
+    requested: &[&str],
+    reader: &mut EfivarReader,
+) -> Result<(
+    QuestionList<'a>,
+    QuestionDescriptor,
+    DriverHeldQuestion,
+    Vec<UnsafeOperation>,
+)> {
+    let mut unsafe_operations = PendingOperations::new(request.unsafe_operations);
+    if let Some(staged) = PasswordQuestions::of_lists(parsed_db).staged_setup_password() {
+        unsafe_operations.add(staged);
+    }
+    let assumed = forms::check_assumed(
+        parsed_db.iter().flat_map(|list| &list.forms),
+        &request.assume_var_stores,
+    )?;
+    let mut found = Vec::new();
+    for (index, list) in parsed_db.iter().enumerate() {
+        let texts = list.texts(requested);
+        for root in &list.forms {
+            let questions = list_questions(
+                Rc::clone(root),
+                &texts,
+                IncludedStates::all(),
+                assumed,
+                reader,
+            );
+            found.extend(
+                questions
+                    .into_iter()
+                    .filter(|(descriptor, _)| {
+                        descriptor.driver_held().is_some_and(|held| {
+                            held.form_set == request.form_set
+                                && held.question_id == request.question_id
+                        })
+                    })
+                    .map(|(descriptor, state)| {
+                        let list = QuestionList {
+                            index,
+                            device_path: list.device_path.as_ref(),
+                        };
+                        (list, descriptor, state)
+                    }),
+            );
+        }
+    }
+
+    let named = format!(
+        "question {:?}, QuestionId {:#06x} of FormSet {}",
+        request.question, request.question_id, request.form_set
+    );
+    let (list, descriptor, state) = match <[_; 1]>::try_from(found) {
+        Ok([question]) => question,
+        Err(found) if found.is_empty() => {
+            return Err(anyhow!(
+                "the HII database holds no {named} whose driver holds its value"
+            ))
+        }
+        Err(found) => {
+            return Err(anyhow!(
+                "{} package lists of the HII database hold {named}",
+                found.len()
+            ))
+        }
+    };
+    if !state.is_allowed(request.include) {
+        return Err(anyhow!(
+            "{named} is{} now, which set did not include",
+            state.annotation()
+        ));
+    }
+    let held = match descriptor.driver_held() {
+        Some(held) if held.value_type == request.value_type => held.clone(),
+        Some(held) => {
+            return Err(anyhow!(
+                "{named} takes {} now, not {}",
+                held.value_type,
+                request.value_type
+            ))
+        }
+        None => return Err(anyhow!("{named} has a VarStore now")),
+    };
+    forms::check_staged_read_only(
+        descriptor.question.clone(),
+        state.read_only(),
+        forms::ReadOnlyWriter::Set(&mut unsafe_operations),
+    )?;
+    let lifted = unsafe_operations.check()?;
+    Ok((list, descriptor, held, lifted))
+}
+
 #[cfg(test)]
 mod tests {
+    use std::cell::RefCell;
     use std::collections::BTreeMap;
     #[cfg(efivar_dumps)]
     use std::fs;
@@ -1580,13 +2115,17 @@ mod tests {
     use crate::hii::forms::ifr_fixtures::SHORT_VAR_STORE_GUID;
     use crate::hii::forms::ifr_fixtures::SUBTITLE;
     use crate::hii::forms::ifr_fixtures::SUPPRESS_IF;
-    use crate::hii::forms::ifr_fixtures::SYSTEM_ACCESS_GUID;
     use crate::hii::forms::ifr_fixtures::THIS;
     use crate::hii::forms::ifr_fixtures::TIME;
     use crate::hii::forms::ifr_fixtures::VALUE;
     use crate::hii::forms::ifr_fixtures::VAR_STORE;
     use crate::hii::forms::ifr_fixtures::VAR_STORE_EFI;
     use crate::hii::forms::ifr_fixtures::VAR_STORE_NAME_VALUE;
+    #[cfg(variable_data)]
+    use crate::hii::forms::ifr_fixtures::WRITE;
+    #[cfg(variable_data)]
+    use crate::hii::forms::IfrValueType;
+    use crate::hii::forms::StoragelessRefusal;
     use crate::hii::forms::MAX_SCOPE_NESTING;
     use crate::hii::package::hiidb_fixtures::device_path_package;
     use crate::hii::package::hiidb_fixtures::en_strings_list;
@@ -1614,18 +2153,13 @@ mod tests {
     use super::*;
 
     /// HiiBackend::set_in, without the unsafe operations that it lifted.
-    #[expect(
-        clippy::too_many_arguments,
-        reason = "the arguments of HiiBackend::set_in, which it passes on"
-    )]
     fn set_responses(
         db_bytes: &[u8],
         question: impl Into<QuestionSelector>,
         new_value: &SetValue,
         selector: Option<&str>,
         options: &SetOptions,
-        reads: Box<dyn FirmwareVariables>,
-        writes: &dyn FirmwareVariables,
+        access: SetAccess<'_>,
         platform_lang: Option<&str>,
     ) -> Result<SetResponseList> {
         HiiBackend::set_in(
@@ -1634,8 +2168,7 @@ mod tests {
             new_value,
             selector,
             options,
-            reads,
-            writes,
+            access,
             platform_lang,
         )
         .map(|(responses, _)| responses)
@@ -2106,6 +2639,7 @@ mod tests {
             shared(&variables),
             None,
             None,
+            None,
         )
         .expect("get BootEnable");
         let set = set_responses(
@@ -2114,8 +2648,11 @@ mod tests {
             &SetValue::Text("1".to_owned()),
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         );
         let keyword_writes = variables.writes_to(&setup());
@@ -2125,8 +2662,11 @@ mod tests {
             &SetValue::Text("1".to_owned()),
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         )
         .expect("set Boot 1");
@@ -2403,6 +2943,7 @@ mod tests {
             shared(&variables),
             None,
             None,
+            None,
         );
         let set = set_responses(
             &crossed_prompts_hiidb(),
@@ -2410,8 +2951,11 @@ mod tests {
             &SetValue::Text("1".to_owned()),
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         );
         let started = HiiBackend::get_in(
@@ -2422,6 +2966,7 @@ mod tests {
             shared(&variables),
             None,
             Some("fr-FR"),
+            None,
         )
         .expect("get Start");
 
@@ -2444,77 +2989,309 @@ mod tests {
         assert_eq!(names, ["Boot"], "get Start shows its fr-FR prompt");
     }
 
-    /// A HiiDB whose ONE_OF "Mode" at byte 0 of Setup has the options 0 and 1, of strings 2 and
-    /// 3, which `en_us` and `fr_fr` translate.
-    fn mode_hiidb(en_us: [&str; 3], fr_fr: [&str; 3]) -> Vec<u8> {
+    /// The prompts of the questions that list-questions lists from `hiidb`, without EFI
+    /// variables.
+    fn listed_prompts(hiidb: &[u8]) -> Vec<String> {
+        let options = ListQuestionsOptions {
+            efivars: EfivarSource::Disabled,
+            ..ListQuestionsOptions::default()
+        };
+        HiiBackend::list_questions_using(hiidb, &options)
+            .expect("list the questions")
+            .into_iter()
+            .map(|question| question.name)
+            .collect()
+    }
+
+    /// get and list-questions show and match a prompt without the common control codes that it
+    /// holds, display hints that "different platforms may ignore" (UEFI 2.11 §33.2.6.2.4);
+    /// list-strings shows the string as it is.
+    #[test]
+    fn texts_show_and_match_without_their_control_codes() {
         let packages = [
             form_package(&[
                 var_store_efi(1, "Setup", NV_BS_RT, 1),
-                form(1, &[one_of_at(1, 1, 1, 0, &[(2, 0), (3, 1)])]),
+                form(1, &[checkbox_on(1, 1, 1)]),
             ]),
-            strings_package_of(b"en-US", &en_us),
-            strings_package_of(b"fr-FR", &fr_fr),
+            en_strings_package_of(&["\u{F620}Q\u{F621}"]),
             END_PACKAGE.to_vec(),
         ];
-        package_list_with_guid([0x68; 16], &packages.concat())
-    }
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
 
-    /// On a platform of PlatformLang fr-FR, set selects a question and an option by their
-    /// en-US texts and writes the option's value, and get shows their fr-FR texts.
-    #[test]
-    fn english_question_and_value_select_on_a_french_platform() {
-        let hiidb = mode_hiidb(
-            ["Mode", "Disabled", "Enabled"],
-            [
-                "Mode de d\u{e9}marrage",
-                "D\u{e9}sactiv\u{e9}",
-                "Activ\u{e9}",
-            ],
+        let get_options = GetOptions {
+            efivars: EfivarSource::Disabled,
+            ..GetOptions::default()
+        };
+        let got = HiiBackend::get_using(&hiidb, "Q", None, &get_options).map(|got| {
+            got.responses
+                .into_iter()
+                .map(|response| response.question.name)
+                .collect::<Vec<_>>()
+        });
+        assert_eq!(
+            (
+                listed_prompts(&hiidb),
+                got.map_err(|error| error.to_string())
+            ),
+            (vec!["Q".to_string()], Ok(vec!["Q".to_string()])),
+            "list-questions, and get Q"
         );
-        let variables = Rc::new(MemoryVariables::default());
-        variables.insert(setup(), 7, &[0]);
-
-        set_responses(
-            &hiidb,
-            "Mode",
-            &SetValue::Text("Enabled".to_owned()),
-            None,
-            &SetOptions::default(),
-            shared(&variables),
-            &*variables,
-            Some("fr-FR"),
-        )
-        .expect("set Mode Enabled");
-        let got = HiiBackend::get_in(
-            &hiidb,
-            "Mode",
-            None,
-            &GetOptions::default(),
-            shared(&variables),
-            None,
-            Some("fr-FR"),
-        )
-        .expect("get Mode");
 
-        assert_eq!(variables.writes_to(&setup()), [(0, vec![1])], "set writes");
-        let shown: Vec<(&str, &str)> = got
-            .responses
+        let strings = HiiBackend::list_strings(&hiidb).expect("list the strings");
+        let listed: Vec<&str> = strings
             .iter()
-            .map(|response| {
-                (
-                    response.question.name.as_str(),
-                    response.question.answer.as_str(),
-                )
-            })
+            .flat_map(|package| package.string_package.values())
+            .map(String::as_str)
             .collect();
-        assert_eq!(
-            shown,
-            [("Mode de d\u{e9}marrage", "Activ\u{e9}")],
-            "get Mode"
-        );
+        assert_eq!(listed, ["\u{F620}Q\u{F621}"], "list-strings");
     }
 
-    /// set matches VALUE against raw option texts only: a VALUE that holds an escape, as pasted
+    /// Prompts that differ only in private use characters (UEFI 2.11 §33.2.6.2.1), which read as
+    /// U+FFFD, or only in common control codes (§33.2.6.2.4), show the same text. Where no prompt
+    /// as stored is that text, set writes the first match in IFR order, as select takes the first
+    /// on a tie, and the other question is no longer addressable by its prompt; where one is, set
+    /// writes its question.
+    #[test]
+    fn prompts_that_differ_only_in_ruled_out_characters_collide() {
+        let cases = [
+            (
+                "private use",
+                ["A\u{E000}", "A\u{E001}"],
+                "A\u{FFFD}",
+                (0, vec![1]),
+            ),
+            (
+                "control codes",
+                ["\u{F620}Q\u{F621}", "Q"],
+                "Q",
+                (1, vec![1]),
+            ),
+        ];
+        for (case, prompts, shown, written) in cases {
+            let packages = [
+                two_checkboxes(),
+                en_strings_package_of(&prompts),
+                END_PACKAGE.to_vec(),
+            ];
+            let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+            assert_eq!(
+                listed_prompts(&hiidb),
+                [shown, shown],
+                "{case}: list-questions"
+            );
+
+            assert_eq!(
+                writes_of_set(&packages, &[0, 0], shown, "1"),
+                Ok(vec![written]),
+                "{case}: set writes the first match, or the question of the stored prompt"
+            );
+        }
+    }
+
+    /// Of the prompts "<Bold On>Q<Bold Off>" and "Q", `set Q 1` writes the question whose prompt
+    /// as stored is "Q", byte 1, never the one that reads so only once display has taken out its
+    /// common control codes (UEFI 2.11 §33.2.6.2.4).
+    #[test]
+    fn set_q_writes_the_question_whose_stored_prompt_is_q() {
+        let packages = [
+            two_checkboxes(),
+            en_strings_package_of(&["\u{F620}Q\u{F621}", "Q"]),
+            END_PACKAGE.to_vec(),
+        ];
+
+        assert_eq!(
+            writes_of_set(&packages, &[0, 0], "Q", "1"),
+            Ok(vec![(1, vec![1])]),
+            "set Q writes byte 1"
+        );
+    }
+
+    /// Of the ONE_OF options "<Bold On>Enabled<Bold Off>" (1) and "Enabled" (2), `set Q Enabled`
+    /// writes 2, the option whose text as stored is "Enabled".
+    #[test]
+    fn set_enabled_writes_the_option_whose_stored_text_is_enabled() {
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 1),
+                form(1, &[one_of_at(1, 1, 1, 0, &[(2, 1), (3, 2)])]),
+            ]),
+            en_strings_package_of(&["Q", "\u{F620}Enabled\u{F621}", "Enabled", "Help"]),
+            END_PACKAGE.to_vec(),
+        ];
+
+        assert_eq!(
+            writes_of_set(&packages, &[0], "Q", "Enabled"),
+            Ok(vec![(0, vec![2])]),
+            "set Q Enabled writes 2"
+        );
+    }
+
+    /// FormSet 11..11 prompts "Q" at byte 0 and FormSet 12..12 "<Bold On>Q<Bold Off>" at byte 1,
+    /// in one package list: `set Q 1` writes byte 0 alone, as the prompt as stored of a question of
+    /// FormSet 11..11 is "Q", so no FormSet selects a prompt that reads so only once display has
+    /// taken out its common control codes.
+    #[test]
+    fn set_q_writes_no_form_set_whose_prompt_only_reads_alike() {
+        let form_set = |guid, prompt| {
+            form_package_with_guid(
+                guid,
+                &[
+                    var_store_efi(1, "Setup", NV_BS_RT, 2),
+                    form(1, &[checkbox_at(1, prompt, 1, prompt - 1)]),
+                ],
+            )
+        };
+        let packages = [
+            form_set([0x11; 16], 1),
+            form_set([0x12; 16], 2),
+            en_strings_package_of(&["Q", "\u{F620}Q\u{F621}"]),
+            END_PACKAGE.to_vec(),
+        ];
+
+        assert_eq!(
+            writes_of_set(&packages, &[0, 0], "Q", "1"),
+            Ok(vec![(0, vec![1])]),
+            "set Q writes byte 0 of FormSet 11..11 alone"
+        );
+    }
+
+    /// ONE_OF option texts and help texts show and match without their common control codes, as
+    /// prompts do: list-questions shows both stripped, and set takes the stripped option text.
+    #[test]
+    fn option_and_help_texts_without_control_codes() {
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 1),
+                // one_of_at's help is string 4
+                form(1, &[one_of_at(1, 1, 1, 0, &[(2, 1), (3, 0)])]),
+            ]),
+            en_strings_package_of(&[
+                "Q",
+                "\u{F620}Enabled\u{F621}",
+                "Disabled",
+                "\u{F622}Help\u{F623}",
+            ]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let options = ListQuestionsOptions {
+            efivars: EfivarSource::Disabled,
+            ..ListQuestionsOptions::default()
+        };
+        let listed: Vec<(String, Vec<String>, String)> =
+            HiiBackend::list_questions_using(&hiidb, &options)
+                .expect("list the questions")
+                .into_iter()
+                .map(|question| (question.name, question.options, question.help))
+                .collect();
+        assert_eq!(
+            listed,
+            [(
+                "Q".to_string(),
+                vec!["Enabled".to_string(), "Disabled".to_string()],
+                "Help".to_string()
+            )],
+            "list-questions options and help"
+        );
+
+        let variables = Rc::new(MemoryVariables::default());
+        variables.insert(setup(), NV_BS_RT, &[0]);
+        let set = set_responses(
+            &hiidb,
+            "Q",
+            &SetValue::Text("Enabled".to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
+            None,
+        );
+        assert_eq!(
+            set.map(drop).map_err(|error| format!("{error:#}")),
+            Ok(()),
+            "set Q Enabled"
+        );
+        assert_eq!(variables.writes_to(&setup()), [(0, vec![1])], "writes");
+    }
+
+    /// A HiiDB whose ONE_OF "Mode" at byte 0 of Setup has the options 0 and 1, of strings 2 and
+    /// 3, which `en_us` and `fr_fr` translate.
+    fn mode_hiidb(en_us: [&str; 3], fr_fr: [&str; 3]) -> Vec<u8> {
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 1),
+                form(1, &[one_of_at(1, 1, 1, 0, &[(2, 0), (3, 1)])]),
+            ]),
+            strings_package_of(b"en-US", &en_us),
+            strings_package_of(b"fr-FR", &fr_fr),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x68; 16], &packages.concat())
+    }
+
+    /// On a platform of PlatformLang fr-FR, set selects a question and an option by their
+    /// en-US texts and writes the option's value, and get shows their fr-FR texts.
+    #[test]
+    fn english_question_and_value_select_on_a_french_platform() {
+        let hiidb = mode_hiidb(
+            ["Mode", "Disabled", "Enabled"],
+            [
+                "Mode de d\u{e9}marrage",
+                "D\u{e9}sactiv\u{e9}",
+                "Activ\u{e9}",
+            ],
+        );
+        let variables = Rc::new(MemoryVariables::default());
+        variables.insert(setup(), 7, &[0]);
+
+        set_responses(
+            &hiidb,
+            "Mode",
+            &SetValue::Text("Enabled".to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
+            Some("fr-FR"),
+        )
+        .expect("set Mode Enabled");
+        let got = HiiBackend::get_in(
+            &hiidb,
+            "Mode",
+            None,
+            &GetOptions::default(),
+            shared(&variables),
+            None,
+            Some("fr-FR"),
+            None,
+        )
+        .expect("get Mode");
+
+        assert_eq!(variables.writes_to(&setup()), [(0, vec![1])], "set writes");
+        let shown: Vec<(&str, &str)> = got
+            .responses
+            .iter()
+            .map(|response| {
+                (
+                    response.question.name.as_str(),
+                    response.question.answer.as_str(),
+                )
+            })
+            .collect();
+        assert_eq!(
+            shown,
+            [("Mode de d\u{e9}marrage", "Activ\u{e9}")],
+            "get Mode"
+        );
+    }
+
+    /// set matches VALUE against raw option texts only: a VALUE that holds an escape, as pasted
     /// from TerminalText's spelling of an option's text, names only an option whose raw text it
     /// is, which a HiiDB may hold, and never the option that shows so.
     #[test]
@@ -2540,8 +3317,11 @@ mod tests {
                 &SetValue::Text(value.to_owned()),
                 None,
                 &SetOptions::default(),
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             );
 
@@ -2567,8 +3347,11 @@ mod tests {
             &SetValue::Text("Off".to_owned()),
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         );
 
@@ -2653,6 +3436,7 @@ mod tests {
             shared(&variables),
             None,
             None,
+            None,
         )
         .expect("get Keyed");
         let set = set_responses(
@@ -2661,8 +3445,11 @@ mod tests {
             &SetValue::Text("1".to_owned()),
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         )
         .expect("set Keyed 1");
@@ -2760,6 +3547,7 @@ mod tests {
             shared(&variables),
             None,
             None,
+            None,
         )
         .unwrap_or_else(|error| panic!("get {question}: {error}"));
         let set = set_responses(
@@ -2768,8 +3556,11 @@ mod tests {
             &SetValue::Text("1".to_owned()),
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         );
 
@@ -2905,6 +3696,7 @@ mod tests {
                 shared(&variables),
                 None,
                 None,
+                None,
             )
             .map(|got| got.responses.len())
             .map_err(|error| format!("{error:#}"));
@@ -2914,8 +3706,11 @@ mod tests {
                 &SetValue::Text("1".to_owned()),
                 None,
                 &SetOptions::default(),
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             )
             .map(|set| set.responses.len())
@@ -3006,6 +3801,7 @@ mod tests {
                 shared(&variables),
                 None,
                 None,
+                None,
             )
             .map(|got| got.responses.len())
             .map_err(|error| format!("{error:#}"));
@@ -3015,8 +3811,11 @@ mod tests {
                 &value,
                 None,
                 &SetOptions::default(),
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             )
             .map(|set| set.responses.len())
@@ -3185,6 +3984,7 @@ mod tests {
                 shared(&variables),
                 None,
                 None,
+                None,
             )
             .unwrap_or_else(|error| panic!("get {question}: {error}"));
             // each answer shows the QuestionId, the FormSet's GUID and the keyword of 0x8001
@@ -3207,8 +4007,11 @@ mod tests {
                 value,
                 None,
                 &SetOptions::default(),
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             );
             let answered = Answered {
@@ -3286,6 +4089,7 @@ mod tests {
                     shared(&variables),
                     None,
                     None,
+                    None,
                 )
                 .unwrap_or_else(|error| panic!("get {question}: {error}"));
                 let set = HiiBackend::set_in(
@@ -3294,8 +4098,11 @@ mod tests {
                     &SetValue::Text("1".to_owned()),
                     None,
                     &SetOptions::default(),
-                    shared(&variables),
-                    &*variables,
+                    SetAccess {
+                        reads: shared(&variables),
+                        writes: &*variables,
+                        held: None,
+                    },
                     None,
                 );
                 let not_found = format!("no question {:?} in the HiiDB", question.to_string());
@@ -3398,8 +4205,11 @@ mod tests {
             &SetValue::Items(vec!["Second".to_owned(), "First".to_owned()]),
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             Some("fr-FR"),
         )
         .expect("set Order");
@@ -3506,63 +4316,198 @@ mod tests {
         );
     }
 
-    /// A HiiDB whose FormSet holds the CHECKBOXes 0xA at byte 0 and 0x14 at byte 1 of Setup,
-    /// prompted "First" and "Second" in en-US, of which x-UEFI-ns names 0xA "Foo" and x-UEFI-AMI
-    /// names 0x14 "Foo".
-    fn crossed_keywords_hiidb() -> Vec<u8> {
+    /// The GUID of driver_held_keyed_hiidb's FormSet.
+    const HELD_FORM_SET: &str = "8C78A505-BAA0-4C4A-869F-000000001A13";
+
+    /// A HiiDB whose FormSet of Guid HELD_FORM_SET holds the CHECKBOX of QuestionId 7 without a
+    /// VarStore, flagged EFI_IFR_FLAG_CALLBACK, prompted "Held" in en-US, "Tenu" in fr-FR and
+    /// "Keyword:5" in x-UEFI-ns.
+    fn driver_held_keyed_hiidb() -> Vec<u8> {
+        let storageless = [
+            &1u16.to_le_bytes()[..],  // Prompt
+            &2u16.to_le_bytes(),      // Help
+            &7u16.to_le_bytes(),      // QuestionId
+            &0u16.to_le_bytes(),      // VarStoreId
+            &0xFFFFu16.to_le_bytes(), // VarStoreInfo
+            &[0x04, 0x00],            // EFI_IFR_FLAG_CALLBACK, CHECKBOX Flags
+        ]
+        .concat();
         let packages = [
-            form_package(&[
-                var_store_efi(1, "Setup", NV_BS_RT, 2),
-                form(1, &[checkbox_at(0xA, 1, 1, 0), checkbox_at(0x14, 2, 1, 1)]),
-            ]),
-            strings_package_of(b"en-US", &["First", "Second"]),
-            strings_package_of(b"x-UEFI-ns", &["Foo", ""]),
-            strings_package_of(b"x-UEFI-AMI", &["", "Foo"]),
+            form_package_with_guid(
+                guid_bytes(HELD_FORM_SET),
+                &[form(1, &[operation(CHECKBOX, false, &storageless)])],
+            ),
+            strings_package_of(b"en-US", &["Held", "Help"]),
+            strings_package_of(b"fr-FR", &["Tenu", "Aide"]),
+            strings_package_of(b"x-UEFI-ns", &["Keyword:5", ""]),
             END_PACKAGE.to_vec(),
         ];
-        package_list_with_guid([0x6A; 16], &packages.concat())
-    }
-
-    /// A HiiDB of two package lists, whose FormSets of GUIDs KEYED_FORM_SET and
-    /// 8C78A505-BAA0-4C4A-869F-000000000803 hold the CHECKBOX 0xA, at byte 0 and byte 1 of
-    /// Setup, prompted "First" and "Second" in en-US, and named "Foo" in the configuration
-    /// languages `first` and `second`.
-    fn keyword_in_two_lists_hiidb(first: &[u8], second: &[u8]) -> Vec<u8> {
-        keyword_in_two_lists_hiidb_of(first, second, 2, |offset| checkbox_at(0xA, 1, 1, offset))
+        package_list_with_guid([0x66; 16], &packages.concat())
     }
 
-    /// keyword_in_two_lists_hiidb with `question(offset)`, an op of QuestionId 0xA and prompt
-    /// string 1 at byte `offset` of Setup, in place of each CHECKBOX, Setup a VarStore of `size`
-    /// bytes, and the en-US string 2 "On".
-    fn keyword_in_two_lists_hiidb_of(
-        first: &[u8],
-        second: &[u8],
-        size: u16,
-        question: impl Fn(u16) -> Vec<u8>,
-    ) -> Vec<u8> {
-        let list = |form_set: &str, offset: u16, prompt: &str, namespace: &[u8], guid: u8| {
-            let packages = [
-                form_package_with_guid(
-                    guid_bytes(form_set),
-                    &[
-                        var_store_efi(1, "Setup", NV_BS_RT, size),
-                        form(1, &[question(offset)]),
-                    ],
-                ),
-                strings_package_of(b"en-US", &[prompt, "On"]),
-                strings_package_of(namespace, &["Foo"]),
-                END_PACKAGE.to_vec(),
-            ];
-            package_list_with_guid([guid; 16], &packages.concat())
-        };
-        [
-            list(KEYED_FORM_SET, 0, "First", first, 0x6B),
-            list(
-                "8C78A505-BAA0-4C4A-869F-000000000803",
-                1,
-                "Second",
-                second,
-                0x6C,
+    /// list-questions, get and set show a question whose driver holds its value as any other:
+    /// with its QuestionId, its FormSet's GUID and its keywords, and its prompt and help in the
+    /// language that ParsedPackageList::texts picks for --language. get and set select it by its
+    /// QuestionId, its keyword or its prompt in any language, and take it to its driver.
+    #[test]
+    fn driver_held_questions_show_their_identity_and_texts_and_select_by_question_id() {
+        let identity = [
+            Some(serde_json::json!(7)),
+            Some(serde_json::json!(HELD_FORM_SET)),
+            Some(serde_json::json!([
+                {"namespace_id": "x-UEFI-ns", "keyword": "Keyword:5"},
+            ])),
+        ];
+        let hiidb = driver_held_keyed_hiidb();
+        let english = ("Held", "Help");
+        let french = ("Tenu", "Aide");
+        for (question, language, (prompt, help)) in [
+            (QuestionSelector::from("Held"), None, english),
+            (by_address(&format!("{HELD_FORM_SET}:7")), None, english),
+            (by_keyword("Keyword:5", None), None, english),
+            (QuestionSelector::from("Held"), Some("fr-FR"), french),
+            (
+                by_address(&format!("{HELD_FORM_SET}:0x7")),
+                Some("fr-FR"),
+                french,
+            ),
+            (QuestionSelector::from("Tenu"), Some("fr-FR"), french),
+            (QuestionSelector::from("Tenu"), None, english),
+        ] {
+            let case = format!("{question:?} under --language {language:?}");
+            let shown = |question: &Question, answer: &str| {
+                assert_eq!(
+                    (question.name.as_str(), question.help.as_str()),
+                    (prompt, help),
+                    "{case}: texts"
+                );
+                assert_eq!(question.answer, answer, "{case}: answer");
+                assert_eq!(identity_json(question), identity, "{case}: identity");
+            };
+            let language = language.map(str::to_owned);
+            let driver = RecordingDriver::default();
+            let variables = Rc::new(MemoryVariables::default());
+
+            let listed = HiiBackend::list_questions_in(
+                &hiidb,
+                &ListQuestionsOptions {
+                    language: language.clone(),
+                    ..ListQuestionsOptions::default()
+                },
+                shared(&variables),
+                None,
+                None,
+            )
+            .unwrap_or_else(|error| panic!("{case}: list the questions: {error:#}"));
+            let got = HiiBackend::get_in(
+                &hiidb,
+                question.clone(),
+                None,
+                &GetOptions {
+                    language: language.clone(),
+                    ..GetOptions::default()
+                },
+                shared(&variables),
+                None,
+                None,
+                Some(&driver),
+            )
+            .unwrap_or_else(|error| panic!("{case}: get: {error:#}"));
+            let set = set_responses(
+                &hiidb,
+                question.clone(),
+                &SetValue::Text("1".to_owned()),
+                None,
+                &SetOptions {
+                    language,
+                    ..SetOptions::default()
+                },
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: Some(&driver),
+                },
+                None,
+            )
+            .unwrap_or_else(|error| panic!("{case}: set 1: {error:#}"));
+
+            assert_eq!(listed.len(), 1, "{case}: listed questions");
+            let unreached = listed[0].answer.clone();
+            assert!(
+                unreached.starts_with("<ValueUnavailable: question has no VarStore"),
+                "{case}: list-questions reaches no driver: {unreached}"
+            );
+            shown(&listed[0], &unreached);
+            assert_eq!(got.responses.len(), 1, "{case}: get answers");
+            shown(&got.responses[0].question, "from the driver");
+            assert_eq!(set.responses.len(), 1, "{case}: set answers");
+            shown(
+                &set.responses[0].question,
+                "1 <set by the driver of QuestionId 7>",
+            );
+            assert_eq!(*driver.gets.borrow(), [7], "{case}: the driver's gets");
+            assert_eq!(*driver.sets.borrow(), [(7, 1)], "{case}: the driver's sets");
+            assert_eq!(variables.writes_to(&setup()), [], "{case}: writes");
+        }
+    }
+
+    /// A HiiDB whose FormSet holds the CHECKBOXes 0xA at byte 0 and 0x14 at byte 1 of Setup,
+    /// prompted "First" and "Second" in en-US, of which x-UEFI-ns names 0xA "Foo" and x-UEFI-AMI
+    /// names 0x14 "Foo".
+    fn crossed_keywords_hiidb() -> Vec<u8> {
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 2),
+                form(1, &[checkbox_at(0xA, 1, 1, 0), checkbox_at(0x14, 2, 1, 1)]),
+            ]),
+            strings_package_of(b"en-US", &["First", "Second"]),
+            strings_package_of(b"x-UEFI-ns", &["Foo", ""]),
+            strings_package_of(b"x-UEFI-AMI", &["", "Foo"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x6A; 16], &packages.concat())
+    }
+
+    /// A HiiDB of two package lists, whose FormSets of GUIDs KEYED_FORM_SET and
+    /// 8C78A505-BAA0-4C4A-869F-000000000803 hold the CHECKBOX 0xA, at byte 0 and byte 1 of
+    /// Setup, prompted "First" and "Second" in en-US, and named "Foo" in the configuration
+    /// languages `first` and `second`.
+    fn keyword_in_two_lists_hiidb(first: &[u8], second: &[u8]) -> Vec<u8> {
+        keyword_in_two_lists_hiidb_of(first, second, 2, |offset| checkbox_at(0xA, 1, 1, offset))
+    }
+
+    /// keyword_in_two_lists_hiidb with `question(offset)`, an op of QuestionId 0xA and prompt
+    /// string 1 at byte `offset` of Setup, in place of each CHECKBOX, Setup a VarStore of `size`
+    /// bytes, and the en-US string 2 "On".
+    fn keyword_in_two_lists_hiidb_of(
+        first: &[u8],
+        second: &[u8],
+        size: u16,
+        question: impl Fn(u16) -> Vec<u8>,
+    ) -> Vec<u8> {
+        let list = |form_set: &str, offset: u16, prompt: &str, namespace: &[u8], guid: u8| {
+            let packages = [
+                form_package_with_guid(
+                    guid_bytes(form_set),
+                    &[
+                        var_store_efi(1, "Setup", NV_BS_RT, size),
+                        form(1, &[question(offset)]),
+                    ],
+                ),
+                strings_package_of(b"en-US", &[prompt, "On"]),
+                strings_package_of(namespace, &["Foo"]),
+                END_PACKAGE.to_vec(),
+            ];
+            package_list_with_guid([guid; 16], &packages.concat())
+        };
+        [
+            list(KEYED_FORM_SET, 0, "First", first, 0x6B),
+            list(
+                "8C78A505-BAA0-4C4A-869F-000000000803",
+                1,
+                "Second",
+                second,
+                0x6C,
             ),
         ]
         .concat()
@@ -3593,6 +4538,7 @@ mod tests {
             shared(&variables),
             None,
             None,
+            None,
         );
         let set = set_responses(
             hiidb,
@@ -3600,8 +4546,11 @@ mod tests {
             value,
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         );
 
@@ -4033,6 +4982,7 @@ mod tests {
             shared(&variables),
             None,
             None,
+            None,
         );
         let set = set_responses(
             &conditioned_keyed_hiidb(),
@@ -4043,8 +4993,11 @@ mod tests {
                 include,
                 ..SetOptions::default()
             },
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         );
 
@@ -4456,8 +5409,11 @@ mod tests {
                     unsafe_operations: grant,
                     ..SetOptions::default()
                 },
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             )
             .map(|(_, lifted)| lifted)
@@ -4508,8 +5464,11 @@ mod tests {
             &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
             None,
             &SetOptions::default(),
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         )
         .map(|(_, lifted)| lifted)
@@ -4753,6 +5712,7 @@ mod tests {
                 shared(&variables),
                 None,
                 None,
+                None,
             )
             .expect("get");
             let answers: Vec<&str> = got
@@ -4801,6 +5761,7 @@ mod tests {
             shared(&variables),
             None,
             None,
+            None,
         )
         .expect("get T");
         let answers: Vec<Option<&str>> = got
@@ -4896,6 +5857,7 @@ mod tests {
             shared(&Rc::new(variables)),
             None,
             None,
+            None,
         )
         .expect("get T");
         let answers: Vec<&str> = got
@@ -5038,8 +6000,11 @@ mod tests {
                 &SetValue::Text("300".to_owned()),
                 None,
                 &options,
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             )
             .map(drop)
@@ -5452,8 +6417,11 @@ mod tests {
                 &SetValue::Text("3".to_owned()),
                 None,
                 &SetOptions::default(),
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             )
             .unwrap_or_else(|error| panic!("set {name}: {error:#}"));
@@ -5548,8 +6516,11 @@ mod tests {
                 unsafe_operations: grant,
                 ..SetOptions::default()
             },
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         );
         (
@@ -5676,8 +6647,11 @@ mod tests {
                 &SetValue::Text("9".to_owned()),
                 None,
                 &options,
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             )
             .unwrap_or_else(|error| panic!("set {prompt}: {error:#}"));
@@ -5757,6 +6731,7 @@ mod tests {
                 shared(&variables),
                 None,
                 None,
+                None,
             )
             .expect("get");
             let listed = HiiBackend::list_questions_in(
@@ -5915,8 +6890,11 @@ mod tests {
                 &SetValue::Text(value.to_owned()),
                 None,
                 &options,
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             );
 
@@ -5973,8 +6951,11 @@ mod tests {
                     &SetValue::Text(value.to_owned()),
                     None,
                     &options,
-                    shared(&variables),
-                    &*variables,
+                    SetAccess {
+                        reads: shared(&variables),
+                        writes: &*variables,
+                        held: None,
+                    },
                     None,
                 )
                 .map(drop)
@@ -6032,6 +7013,7 @@ mod tests {
             shared(variables),
             None,
             None,
+            None,
         )
         .unwrap_or_else(|error| panic!("get {question}: {error:#}"))
         .responses
@@ -6058,8 +7040,11 @@ mod tests {
             &SetValue::Text(value.to_owned()),
             None,
             &options,
-            shared(variables),
-            &**variables,
+            SetAccess {
+                reads: shared(variables),
+                writes: &**variables,
+                held: None,
+            },
             None,
         )
         .map(drop)
@@ -6420,6 +7405,7 @@ mod tests {
                 shared(&variables),
                 None,
                 None,
+                None,
             )
             .map(|got| {
                 got.responses
@@ -6434,8 +7420,11 @@ mod tests {
                 &SetValue::Text("1".to_owned()),
                 None,
                 &options,
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             )
             .map(|_| ())
@@ -7005,6 +7994,7 @@ mod tests {
                 variables(),
                 None,
                 None,
+                None,
             )
             .unwrap_or_else(|error| panic!("get {question}: {error:#}"))
             .responses
@@ -7108,8 +8098,11 @@ mod tests {
                     &SetValue::Text("1".to_owned()),
                     None,
                     &SetOptions::default(),
-                    shared(&variables),
-                    &*variables,
+                    SetAccess {
+                        reads: shared(&variables),
+                        writes: &*variables,
+                        held: None,
+                    },
                     None,
                 );
 
@@ -7156,8 +8149,11 @@ mod tests {
                 &SetValue::Text("1".to_owned()),
                 None,
                 &options,
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             );
 
@@ -7226,8 +8222,11 @@ mod tests {
                 &SetValue::Text("1".to_owned()),
                 None,
                 &options,
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             );
 
@@ -7284,8 +8283,11 @@ mod tests {
                 &SetValue::Text("1".to_owned()),
                 None,
                 &options,
-                shared(&reads),
-                &writes,
+                SetAccess {
+                    reads: shared(&reads),
+                    writes: &writes,
+                    held: None,
+                },
                 None,
             );
 
@@ -7359,8 +8361,11 @@ mod tests {
                 &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
                 None,
                 &options,
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             );
 
@@ -7422,8 +8427,11 @@ mod tests {
             &SetValue::Text("1".to_owned()),
             None,
             &options,
-            shared(&variables),
-            &*variables,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
             None,
         );
 
@@ -7440,6539 +8448,10424 @@ mod tests {
         assert_eq!(variables.writes_to(&signed), vec![], "writes of Signed");
     }
 
-    /// Through variables that reach BootServices, a HiiDB with a PASSWORD op whose VarStore is
-    /// unknown has get, list-questions, show-ifr and set read and write no variable, even with
-    /// UnsafeOperations::Allow, which lifts no refusal that would disclose a password; through
-    /// those that reach Runtime they work, as before.
+    /// A driver that records each get and set it is asked for, and fails get of the QuestionId
+    /// `refused_get`, refuses the QuestionId `refused_check` before it reaches the driver, and
+    /// `refused_set` when it sets it.
+    #[derive(Default)]
+    struct RecordingDriver {
+        gets: RefCell<Vec<u16>>,
+        sets: RefCell<Vec<(u16, u64)>>,
+        refused_get: Option<u16>,
+        refused_check: Option<u16>,
+        refused_set: Option<u16>,
+    }
+
+    impl DriverHeldValues for RecordingDriver {
+        fn store_name(&self) -> &'static str {
+            "its driver"
+        }
+
+        fn get(
+            &self,
+            _list: &QuestionList<'_>,
+            question: &QuestionDescriptor,
+            held: &DriverHeldQuestion,
+        ) -> Result<String> {
+            self.gets.borrow_mut().push(held.question_id);
+            match self.refused_get == Some(held.question_id) {
+                true => Err(anyhow!("cannot get question {:?}", question.question)),
+                false => Ok("from the driver".to_string()),
+            }
+        }
+
+        fn check_set(
+            &self,
+            _list: &QuestionList<'_>,
+            question: &QuestionDescriptor,
+            held: &DriverHeldQuestion,
+        ) -> Result<()> {
+            match self.refused_check == Some(held.question_id) {
+                true => Err(set_refusal(&question.question, "the driver is unreachable")),
+                false => Ok(()),
+            }
+        }
+
+        fn set(
+            &self,
+            _list: &QuestionList<'_>,
+            question: &QuestionDescriptor,
+            held: &DriverHeldQuestion,
+            value: u64,
+        ) -> Result<String> {
+            self.sets.borrow_mut().push((held.question_id, value));
+            match self.refused_set == Some(held.question_id) {
+                true => Err(set_refusal(
+                    &question.question,
+                    format!("the driver refused QuestionId {}", held.question_id),
+                )),
+                false => Ok(format!(
+                    " <set by the driver of QuestionId {}>",
+                    held.question_id
+                )),
+            }
+        }
+    }
+
+    /// A package list of GUID `guid` whose FormSet holds `children`, its string 1 "Q".
+    fn q_list(guid: [u8; 16], children: &[Vec<u8>]) -> Vec<u8> {
+        let packages = [
+            form_package(children),
+            en_strings_package_of(&["Q"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid(guid, &packages.concat())
+    }
+
+    /// The package list of GUID `guid` with the CHECKBOX Q of QuestionId 7 without a VarStore,
+    /// flagged EFI_IFR_FLAG_CALLBACK.
+    fn driver_held_list(guid: [u8; 16]) -> Vec<u8> {
+        let storageless = [
+            &1u16.to_le_bytes()[..],  // Prompt
+            &1u16.to_le_bytes(),      // Help
+            &7u16.to_le_bytes(),      // QuestionId
+            &0u16.to_le_bytes(),      // VarStoreId
+            &0xFFFFu16.to_le_bytes(), // VarStoreInfo
+            &[0x04, 0x00],            // EFI_IFR_FLAG_CALLBACK, CHECKBOX Flags
+        ]
+        .concat();
+        q_list(
+            guid,
+            &[form(1, &[operation(CHECKBOX, false, &storageless)])],
+        )
+    }
+
+    /// A HiiDB of two FormSets with the CHECKBOX Q: driver_held_list's of GUID [0x66; 16], then
+    /// one at byte 0 of the EFI variable Setup.
+    fn driver_held_hiidb() -> Vec<u8> {
+        [
+            driver_held_list([0x66; 16]),
+            q_list(
+                [0x55; 16],
+                &[
+                    var_store_efi(1, "Setup", NV_BS_RT, 1),
+                    form(1, &[checkbox_on(1, 1, 1)]),
+                ],
+            ),
+        ]
+        .concat()
+    }
+
+    /// set refuses a question whose driver holds its value and that has a WRITE expression before
+    /// any write, whatever the variables' reach: uefisettings does not evaluate WRITE beside the
+    /// driver's Callback()s.
+    #[cfg(variable_data)]
     #[test]
-    fn unresolved_password_closes_every_variable_to_boot_services() {
-        let hiidb = password_hiidb_with(password_on(3, 3, 9, 0));
-        let closed = "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: \
-                      no supported varstore with matching id 0x0009 found; as the variable of \
-                      that password is unknown, the UEFI Shell build reads and writes no variable \
-                      of this HiiDB";
-        let set = |variables: &Rc<MemoryVariables>, unsafe_operations| {
-            let options = SetOptions {
-                unsafe_operations,
-                ..SetOptions::default()
-            };
-            set_responses(
+    fn set_refuses_a_write_expression_beside_callbacks_before_any_write() {
+        let storageless = [
+            &1u16.to_le_bytes()[..],  // Prompt
+            &1u16.to_le_bytes(),      // Help
+            &7u16.to_le_bytes(),      // QuestionId
+            &0u16.to_le_bytes(),      // VarStoreId
+            &0xFFFFu16.to_le_bytes(), // VarStoreInfo
+            &[0x04, 0x00],            // EFI_IFR_FLAG_CALLBACK, CHECKBOX Flags
+        ]
+        .concat();
+        let with_write = [
+            operation(CHECKBOX, true, &storageless),
+            operation(WRITE, false, &[]),
+            ifr_true(),
+            END.to_vec(),
+        ]
+        .concat();
+        let hiidb = [
+            package_list_with_guid(
+                [0x66; 16],
+                &[
+                    form_package(&[form(1, &[with_write])]),
+                    en_strings_package_of(&["Q"]),
+                    END_PACKAGE.to_vec(),
+                ]
+                .concat(),
+            ),
+            package_list_with_guid(
+                [0x55; 16],
+                &[
+                    form_package(&[
+                        var_store_efi(1, "Setup", NV_BS_RT, 1),
+                        form(1, &[checkbox_on(1, 1, 1)]),
+                    ]),
+                    en_strings_package_of(&["Q"]),
+                    END_PACKAGE.to_vec(),
+                ]
+                .concat(),
+            ),
+        ]
+        .concat();
+        for (reach, interface) in [
+            (VariableReach::Runtime, VariableInterface::Efivarfs),
+            (
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            ),
+        ] {
+            let driver = RecordingDriver::default();
+            let variables = MemoryVariables::new(reach, interface);
+            variables.insert(setup(), NV_BS_RT, &[0]);
+            let variables = Rc::new(variables);
+
+            let set = HiiBackend::set_in(
                 &hiidb,
                 "Q",
                 &SetValue::Text("1".to_owned()),
                 None,
-                &options,
-                shared(variables),
-                &**variables,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: Some(&driver),
+                },
                 None,
-            )
-            .map(drop)
-            .map_err(|error| error.to_string())
-        };
+            );
 
-        let variables = password_variables(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        let got = HiiBackend::get_in(
-            &hiidb,
-            "Q",
-            None,
-            &GetOptions::default(),
-            shared(&variables),
-            None,
-            None,
-        );
-        let listed = HiiBackend::list_questions_in(
-            &hiidb,
-            &ListQuestionsOptions::default(),
-            shared(&variables),
-            None,
-            None,
-        );
-        let shown = HiiBackend::show_ifr_in(
-            &hiidb,
-            &ShowIfrOptions::default(),
-            shared(&variables),
-            None,
-            None,
-        );
-        assert_eq!(
-            got.map(drop).map_err(|error| error.to_string()),
-            Err(closed.to_string()),
-            "BootServices: get"
-        );
-        assert_eq!(
-            listed.map(drop).map_err(|error| error.to_string()),
-            Err(closed.to_string()),
-            "BootServices: list-questions"
+            assert_eq!(
+                set.map(drop).map_err(|error| format!("{error:#}")),
+                Err(ExpressionBesideCallback(QuestionExpression::Write).to_string()),
+                "{reach:?}"
+            );
+            assert!(driver.sets.borrow().is_empty(), "{reach:?}: no driver set");
+            assert!(
+                variables.writes_to(&setup()).is_empty(),
+                "{reach:?}: Setup unwritten"
+            );
+        }
+    }
+
+    /// The refusal, without --i-am-fine-to-brick-this-system, of a set staged for the next boot
+    /// in a HiiDB that declares a setup password question.
+    const STAGED_PASSWORD_REFUSAL: &str = "this HiiDB declares a setup password question, and a \
+                                           set staged for the next boot is applied before the \
+                                           OS, where no setup browser asks for or checks the \
+                                           password; pass --i-am-fine-to-brick-this-system to \
+                                           stage it";
+
+    /// apply-staged finds a staged request's question by its FormSet GUID and QuestionId among
+    /// those that their driver holds, and refuses one that is gone, held twice, in a state that
+    /// set did not include, or of another value type.
+    #[cfg(variable_data)]
+    #[test]
+    fn apply_staged_finds_the_question_of_a_request_as_set_selected_it() {
+        // FormSet 11111111-…: Q (QuestionId 7) and, grayed out, R (8), both held by their
+        // driver; a FormSet whose Q (1) is at byte 0 of Setup
+        let held = |guid| {
+            let packages = [
+                form_package(&[form(
+                    1,
+                    &[
+                        callback_checkbox(7, 1),
+                        conditional(GRAY_OUT_IF, ifr_true(), &[callback_checkbox(8, 2)]),
+                    ],
+                )]),
+                en_strings_package_of(&["Q", "R"]),
+                strings_package_of(b"fr-FR", &["Q-fr", "R-fr"]),
+                END_PACKAGE.to_vec(),
+            ];
+            package_list_with_guid(guid, &packages.concat())
+        };
+        let stored = package_list_with_guid(
+            [0x55; 16],
+            &[
+                form_package(&[
+                    var_store_efi(1, "Setup", NV_BS_RT, 1),
+                    form(1, &[checkbox_on(1, 1, 1)]),
+                ]),
+                en_strings_package_of(&["Q"]),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
         );
-        assert_eq!(
-            shown.map(drop).map_err(|error| error.to_string()),
-            Err(closed.to_string()),
-            "BootServices: show-ifr"
+        let form_set: Guid = "11111111-1111-1111-1111-111111111111"
+            .parse()
+            .expect("a GUID");
+        let request = |question_id, include| StagedRequest {
+            question: "Q".to_owned(),
+            form_set,
+            question_id,
+            value_type: IfrValueType::Boolean,
+            value: 1,
+            include,
+            assume_var_stores: Vec::new(),
+            unsafe_operations: UnsafeOperations::Refuse,
+        };
+        let found = |hiidb: &[u8], request: &StagedRequest| {
+            let parsed = package::read_db(hiidb).expect("the HiiDB");
+            let mut reader = EfivarReader::with_variables(Box::new(MemoryVariables::new(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            )));
+            staged_question(&parsed, request, &[], &mut reader)
+                .map(|(list, descriptor, _, _)| (list.index, descriptor.question))
+                .map_err(|error| format!("{error:#}"))
+        };
+        let hiidb = [stored.clone(), held([0x66; 16])].concat();
+        let named = |id: u16| format!("question \"Q\", QuestionId {id:#06x} of FormSet {form_set}");
+
+        let cases = [
+            (
+                "Q",
+                request(7, IncludedStates::empty()),
+                Ok((1, "Q".to_owned())),
+            ),
+            (
+                "grayed-out R, included",
+                request(8, IncludedStates::GRAYED_OUT),
+                Ok((1, "R".to_owned())),
+            ),
+            (
+                "grayed-out R",
+                request(8, IncludedStates::empty()),
+                Err(format!(
+                    "{} is <grayed-out> now, which set did not include",
+                    named(8)
+                )),
+            ),
+            (
+                "a QuestionId that no driver holds",
+                request(1, IncludedStates::empty()),
+                Err(format!(
+                    "the HII database holds no {} whose driver holds its value",
+                    named(1)
+                )),
+            ),
+            (
+                "another FormSet",
+                StagedRequest {
+                    form_set: "22222222-2222-2222-2222-222222222222"
+                        .parse()
+                        .expect("a GUID"),
+                    ..request(7, IncludedStates::empty())
+                },
+                Err(
+                    "the HII database holds no question \"Q\", QuestionId 0x0007 of FormSet \
+                     22222222-2222-2222-2222-222222222222 whose driver holds its value"
+                        .to_owned(),
+                ),
+            ),
+            (
+                "another value type",
+                StagedRequest {
+                    value_type: IfrValueType::NumSize8,
+                    ..request(7, IncludedStates::empty())
+                },
+                Err(format!(
+                    "{} takes EFI_IFR_TYPE_BOOLEAN now, not EFI_IFR_TYPE_NUM_SIZE_8",
+                    named(7)
+                )),
+            ),
+            (
+                "bytes of an undeclared VarStore",
+                StagedRequest {
+                    assume_var_stores: vec!["Undeclared-00000000-0000-0000-0000-000000000001=00"
+                        .parse()
+                        .expect("a statement")],
+                    ..request(7, IncludedStates::empty())
+                },
+                Err("no FormSet of this HiiDB declares a VarStore \
+                     Undeclared-00000000-0000-0000-0000-000000000001"
+                    .to_owned()),
+            ),
+        ];
+        for (case, request, want) in cases {
+            assert_eq!(found(&hiidb, &request), want, "{case}");
+        }
+        // its texts show in the languages requested (ParsedPackageList::texts), as set's do
+        let parsed = package::read_db(&hiidb).expect("the HiiDB");
+        let mut reader = EfivarReader::with_variables(Box::new(MemoryVariables::new(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        )));
+        let (_, descriptor, _, _) = staged_question(
+            &parsed,
+            &request(7, IncludedStates::empty()),
+            &["fr-FR"],
+            &mut reader,
+        )
+        .expect("Q under fr-FR");
+        assert_eq!(descriptor.question, "Q-fr", "Q under fr-FR");
+        // a PASSWORD outside any FormSet declares a password too
+        let outside_password = package_list_with_guid(
+            [0x77; 16],
+            &[
+                form_package_of(
+                    &[
+                        password_on(3, 3, 2, 0),
+                        // the fixture, which `form_set` shadows here
+                        crate::hii::forms::ifr_fixtures::form_set(&[
+                            var_store(2, [0x44; 16], "AMITSESetup", 81),
+                            form(1, &[checkbox_at(2, 2, 2, 80)]),
+                        ]),
+                    ]
+                    .concat(),
+                ),
+                en_strings_package_of(&["Q", "P", "Password"]),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
         );
         assert_eq!(
-            set(&variables, UnsafeOperations::Refuse),
-            Err(closed.to_string()),
-            "BootServices: set"
+            found(
+                &[held([0x66; 16]), outside_password].concat(),
+                &request(7, IncludedStates::empty())
+            ),
+            Err(STAGED_PASSWORD_REFUSAL.to_owned()),
+            "a HiiDB with a PASSWORD outside any FormSet"
         );
         assert_eq!(
-            set(&variables, UnsafeOperations::Allow),
-            Err(closed.to_string()),
-            "BootServices: set with UnsafeOperations::Allow"
+            found(
+                &[held([0x66; 16]), password_hiidb()].concat(),
+                &request(7, IncludedStates::empty())
+            ),
+            Err(STAGED_PASSWORD_REFUSAL.to_owned()),
+            "a HiiDB that declares a setup password question"
         );
-        assert_eq!(variables.reads(), [], "BootServices: reads");
-        assert_eq!(variables.writes_to(&setup()), [], "BootServices: writes");
-
-        let variables = password_variables(VariableReach::Runtime, VariableInterface::Efivarfs);
-        let got = HiiBackend::get_in(
-            &hiidb,
-            "Q",
-            None,
-            &GetOptions::default(),
-            shared(&variables),
-            None,
-            None,
-        )
-        .expect("get through Runtime");
-        let answers: Vec<&str> = got
-            .responses
-            .iter()
-            .map(|response| response.question.answer.as_str())
-            .collect();
-        assert_eq!(answers, ["0"], "Runtime: get");
+        // staged with --i-am-fine-to-brick-this-system, which lifts the setup password
+        let password_db = [held([0x66; 16]), password_hiidb()].concat();
+        let parsed = package::read_db(&password_db).expect("the HiiDB");
+        let allowed = StagedRequest {
+            unsafe_operations: UnsafeOperations::Allow,
+            ..request(7, IncludedStates::empty())
+        };
+        let (list, descriptor, _, lifted) = staged_question(&parsed, &allowed, &[], &mut reader)
+            .expect("Q staged with --i-am-fine-to-brick-this-system");
         assert_eq!(
-            set(&variables, UnsafeOperations::Refuse),
-            Ok(()),
-            "Runtime: set"
+            (list.index, descriptor.question, lifted),
+            (
+                0,
+                "Q".to_owned(),
+                vec![UnsafeOperation::StagedSetupPassword]
+            ),
+            "a HiiDB that declares a setup password question, staged with \
+             --i-am-fine-to-brick-this-system"
         );
         assert_eq!(
-            variables.writes_to(&setup()),
-            [(0, vec![1])],
-            "Runtime: writes"
+            found(
+                &[held([0x66; 16]), held([0x77; 16])].concat(),
+                &request(7, IncludedStates::empty())
+            ),
+            Err(format!(
+                "2 package lists of the HII database hold {}",
+                named(7)
+            )),
+            "Q in two package lists"
         );
     }
 
-    /// The Guid of dropped_password_store, as stored.
-    const DROPPED_PASSWORD_STORE_GUID: [u8; 16] = [0x88; 16];
-
-    /// The GUID of the package list of dropped_password_hiidb, as stored.
-    const DROPPED_PASSWORD_LIST_GUID: [u8; 16] = [0x99; 16];
+    /// apply-staged checks again whether a request's question is read-only: one that
+    /// EFI_IFR_FLAG_READ_ONLY makes read-only is an unsafe operation, lifted only by the grant
+    /// that set recorded with the request, and one that an EFI_IFR_VALUE makes read-only, which
+    /// no driver holds then, is refused with either grant; a writable one lifts nothing.
+    #[cfg(variable_data)]
+    #[test]
+    fn apply_staged_checks_a_read_only_question_against_set_s_grant() {
+        // W (QuestionId 6), Q (7), flagged EFI_IFR_FLAG_READ_ONLY, and V (8), which an
+        // EFI_IFR_VALUE makes read-only, each held by its driver
+        let header = |question_id: u16, prompt: u16, flags: u8| {
+            [
+                &prompt.to_le_bytes()[..],
+                &1u16.to_le_bytes(),        // Help
+                &question_id.to_le_bytes(), // QuestionId
+                &0u16.to_le_bytes(),        // VarStoreId
+                &0xFFFFu16.to_le_bytes(),   // VarStoreInfo
+                &[flags, 0x00],             // question flags, CHECKBOX Flags
+            ]
+            .concat()
+        };
+        let hiidb = package_list_with_guid(
+            [0x66; 16],
+            &[
+                form_package(&[form(
+                    1,
+                    &[
+                        callback_checkbox(6, 3),
+                        // EFI_IFR_FLAG_CALLBACK | EFI_IFR_FLAG_READ_ONLY
+                        operation(CHECKBOX, false, &header(7, 1, 0x05)),
+                        [
+                            operation(CHECKBOX, true, &header(8, 2, 0x04)),
+                            value_of(ifr_true()),
+                            END.to_vec(),
+                        ]
+                        .concat(),
+                    ],
+                )]),
+                en_strings_package_of(&["Q", "V", "W"]),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
+        );
+        let parsed = package::read_db(&hiidb).expect("the HiiDB");
+        let lifted = |question_id, grant| {
+            let request = StagedRequest {
+                question: "Q".to_owned(),
+                form_set: "11111111-1111-1111-1111-111111111111"
+                    .parse()
+                    .expect("a GUID"),
+                question_id,
+                value_type: IfrValueType::Boolean,
+                value: 1,
+                include: IncludedStates::empty(),
+                assume_var_stores: Vec::new(),
+                unsafe_operations: grant,
+            };
+            let mut reader = EfivarReader::with_variables(Box::new(MemoryVariables::new(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            )));
+            staged_question(&parsed, &request, &[], &mut reader)
+                .map(|(_, _, _, lifted)| lifted)
+                .map_err(|error| format!("{error:#}"))
+        };
+        let read_only_q = UnsafeOperation::ReadOnlyQuestion {
+            question: "Q".to_owned(),
+            writable: IncludedStates::empty(),
+        };
+        // its EFI_IFR_VALUE gives V's value, so no driver holds it (StoragelessQuestion::route)
+        let no_driver_held_v = "the HII database holds no question \"Q\", QuestionId 0x0008 of \
+                                FormSet 11111111-1111-1111-1111-111111111111 whose driver holds \
+                                its value"
+            .to_owned();
 
-    /// The EFI variable that both FormSets of dropped_password_hiidb name.
-    fn dropped_password_store() -> VariableKey {
-        VariableKey {
-            name: "UefisettingsTest".to_string(),
-            guid: Guid::from(DROPPED_PASSWORD_STORE_GUID),
+        let cases = [
+            ("W", 6, UnsafeOperations::Refuse, Ok(Vec::new())),
+            ("W, allowed", 6, UnsafeOperations::Allow, Ok(Vec::new())),
+            (
+                "Q",
+                7,
+                UnsafeOperations::Refuse,
+                flag_refusal("Q", "").map(|()| Vec::new()),
+            ),
+            (
+                "Q, allowed",
+                7,
+                UnsafeOperations::Allow,
+                Ok(vec![read_only_q]),
+            ),
+            (
+                "V",
+                8,
+                UnsafeOperations::Refuse,
+                Err(no_driver_held_v.clone()),
+            ),
+            (
+                "V, allowed",
+                8,
+                UnsafeOperations::Allow,
+                Err(no_driver_held_v),
+            ),
+        ];
+        for (case, question_id, grant, want) in cases {
+            assert_eq!(lifted(question_id, grant), want, "{case}");
         }
     }
 
-    /// The VARSTORE_EFI of dropped_password_store, VarStore 1.
-    fn dropped_password_var_store() -> Vec<u8> {
-        var_store_efi_of(
-            1,
-            DROPPED_PASSWORD_STORE_GUID,
-            "UefisettingsTest",
-            NV_BS_RT,
-            20,
-        )
-    }
-
-    /// The Guid of the variable of ignored_form_set_var_store, as stored.
-    const IGNORED_FORM_SET_STORE_GUID: [u8; 16] = [0x7A; 16];
+    /// apply-staged finds no question whose driver holds its value for a request of C or L of
+    /// callback_and_strings_list, a STRING and an ORDERED_LIST flagged EFI_IFR_FLAG_CALLBACK and
+    /// without a VarStore, which no driver holds: it refuses the request with either grant, before
+    /// any Callback(). That of Q, which its driver holds, it finds.
+    #[cfg(variable_data)]
+    #[test]
+    fn apply_staged_finds_no_driver_for_a_string_or_an_ordered_list() {
+        let parsed = package::read_db(&callback_and_strings_list()).expect("the HiiDB");
+        let found = |question: &str, question_id, grant| {
+            let request = StagedRequest {
+                question: question.to_owned(),
+                form_set: "11111111-1111-1111-1111-111111111111"
+                    .parse()
+                    .expect("a GUID"),
+                question_id,
+                value_type: IfrValueType::Boolean,
+                value: 1,
+                include: IncludedStates::empty(),
+                assume_var_stores: Vec::new(),
+                unsafe_operations: grant,
+            };
+            let mut reader = EfivarReader::with_variables(Box::new(MemoryVariables::new(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            )));
+            staged_question(&parsed, &request, &[], &mut reader)
+                .map(|(_, descriptor, held, lifted)| {
+                    (descriptor.question, held.question_id, lifted)
+                })
+                .map_err(|error| format!("{error:#}"))
+        };
 
-    /// The VARSTORE_EFI, VarStore 2, of a variable apart from dropped_password_store, for a
-    /// FormSet that uefisettings ignores beside questions on dropped_password_store that read:
-    /// each variable that an ignored FormSet declares is withheld whole, and a PASSWORD there is
-    /// withheld in each VarStore of its VarStoreId in the form package too.
-    fn ignored_form_set_var_store() -> Vec<u8> {
-        var_store_efi_of(
-            2,
-            IGNORED_FORM_SET_STORE_GUID,
-            "UefisettingsIgnored",
-            NV_BS_RT,
-            20,
-        )
+        for grant in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
+            for (question, question_id) in [("C", 10), ("L", 11)] {
+                assert_eq!(
+                    found(question, question_id, grant),
+                    Err(format!(
+                        "the HII database holds no question {question:?}, QuestionId \
+                         {question_id:#06x} of FormSet 11111111-1111-1111-1111-111111111111 whose \
+                         driver holds its value"
+                    )),
+                    "{question}, {grant:?}"
+                );
+            }
+            assert_eq!(
+                found("Q", 9, grant),
+                Ok(("Q".to_owned(), 9, Vec::new())),
+                "Q, {grant:?}"
+            );
+        }
     }
 
-    /// The first FormSet of dropped_password_hiidb, with the CHECKBOX Q at byte 0 of
-    /// dropped_password_store.
-    fn dropped_password_first_form_set() -> Vec<u8> {
-        form_set(&[
-            dropped_password_var_store(),
-            form(1, &[checkbox_on(1, 1, 1)]),
-        ])
-    }
-
-    /// The ops of a second FormSet of dropped_password_hiidb: a form, a form with a PASSWORD at
-    /// byte 0 of dropped_password_store, and then `tail`, outside its forms.
-    fn dropped_password_second_ops(tail: Vec<u8>) -> [Vec<u8>; 4] {
-        [
-            dropped_password_var_store(),
-            form(1, &[]),
-            form(2, &[password_on(2, 2, 1, 0)]),
-            tail,
-        ]
-    }
-
-    /// A HiiDB of one package list holding dropped_password_first_form_set, the ops `between`
-    /// and then the FormSet `second`.
-    fn dropped_password_hiidb(between: Vec<u8>, second: Vec<u8>) -> Vec<u8> {
-        let first = dropped_password_first_form_set();
-        let packages = [
-            form_package_of(&[first, between, second].concat()),
-            en_strings_package_of(&["Q", "Password"]),
-            END_PACKAGE.to_vec(),
-        ];
-        package_list_with_guid(DROPPED_PASSWORD_LIST_GUID, &packages.concat())
-    }
-
-    /// A HiiDB of two FormSets with dropped_password_store of 60 bytes, each 0x01, and these
-    /// CHECKBOXes on it: in the first, Q1 at byte 50 in form 1, Q2 at byte 52 then `ops` in form
-    /// 2, and Q3 at byte 51 in form 3; in the second, O at byte 10; and the offset of form 2 in
-    /// its form package.
-    fn disabled_form_hiidb(ops: Vec<u8>) -> (Vec<u8>, usize) {
-        let store = var_store_efi_of(
-            1,
-            DROPPED_PASSWORD_STORE_GUID,
-            "UefisettingsTest",
-            NV_BS_RT,
-            60,
-        );
-        let first = [store.clone(), form(1, &[checkbox_at(1, 1, 1, 50)])];
-        let ifr = [
-            form_set(&[
-                first[0].clone(),
-                first[1].clone(),
-                form(2, &[checkbox_at(2, 2, 1, 52), ops]),
-                form(3, &[checkbox_at(3, 3, 1, 51)]),
-            ]),
-            form_set(&[store, form(1, &[checkbox_at(5, 5, 1, 10)])]),
-        ]
-        .concat();
-        let packages = [
-            form_package_of(&ifr),
-            en_strings_package_of(&["Q1", "Q2", "Q3", "Password", "O"]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid(DROPPED_PASSWORD_LIST_GUID, &packages.concat());
-        (hiidb, form_set(&first).len() - END.len())
-    }
-
-    /// The variables of disabled_form_hiidb, of `reach` through `interface`.
-    fn disabled_form_variables(
-        reach: VariableReach,
-        interface: VariableInterface,
-    ) -> Rc<MemoryVariables> {
-        let variables = MemoryVariables::new(reach, interface);
-        variables.insert(dropped_password_store(), NV_BS_RT, &[0x01; 60]);
-        Rc::new(variables)
-    }
-
-    /// A form that a malformed op disables is dropped (UEFI 2.11 §33.2.5.10.1): through variables
-    /// of either reach, get and list-questions read the questions of the forms beside it, not its
-    /// own, and list its record, which show-ifr prints and set's refusal of its question names;
-    /// its PASSWORD stays known, so O, over that password's bytes, reads no value. Where the
-    /// FormSet of that form was ignored, variables that reach Runtime withheld none of them.
+    /// set gives one value to questions of one kind, and items to an ORDERED_LIST only, also where
+    /// a driver holds a question's value: a CHECKBOX that its driver holds and a DATE on Setup of
+    /// its prompt are refused as two kinds, and --item for that CHECKBOX as for any other, before
+    /// its driver applies a value and before any write.
     #[test]
-    fn a_disabled_form_is_dropped_and_its_password_withheld() {
-        let (hiidb, offset) = disabled_form_hiidb(
-            [
-                password_on(4, 4, 1, 0),
-                operation(CHECKBOX, false, &[0x00; 4]),
-            ]
-            .concat(),
+    fn set_refuses_two_kinds_and_items_beside_a_driver_held_question() {
+        let date = operation(
+            DATE,
+            false,
+            &[question_header_with(1, 1, 1, 0, 0x00), vec![0x00]].concat(),
         );
-        let record = format!(
-            "the form 2 of the FormSet {}, whose EFI_IFR_CHECKBOX op is malformed; UEFI 2.11 \
-             §33.2.5.10.1 disables the form of a malformed op: the EFI_IFR_CHECKBOX op at offset ",
-            Guid::from([0x11; 16])
+        let date_list = q_list(
+            [0x55; 16],
+            &[var_store_efi(1, "Setup", NV_BS_RT, 4), form(1, &[date])],
         );
-        let list = Guid::from(DROPPED_PASSWORD_LIST_GUID).to_string();
-        let records_of = |ignored: Option<Vec<HiiIgnoredIfr>>| -> Vec<(String, i64, bool)> {
-            ignored
-                .unwrap_or_default()
-                .into_iter()
-                .map(|ignored| {
-                    (
-                        ignored.package_list,
-                        ignored.offset,
-                        ignored.reason.starts_with(&record),
-                    )
-                })
-                .collect()
-        };
-        let want_records = vec![(list, i64::try_from(offset).expect("offset"), true)];
-        for (reach, interface) in [
-            (VariableReach::Runtime, VariableInterface::Efivarfs),
+        let cases = [
             (
-                VariableReach::BootServices,
-                VariableInterface::VariableServices,
+                "a DATE beside",
+                [driver_held_list([0x44; 16]), date_list].concat(),
+                SetValue::Text("2027-01-02".to_owned()),
+                "question \"Q\" selects questions of more than one kind: ONE_OF, NUMERIC or \
+                 CHECKBOX (in 44444444-4444-4444-4444-444444444444), DATE (in \
+                 55555555-5555-5555-5555-555555555555); set gives one value to questions of one \
+                 kind",
             ),
-        ] {
-            let variables = disabled_form_variables(reach, interface);
-            for (question, want) in [
-                ("O", vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]),
-                ("Q1", vec!["1".to_string()]),
-                ("Q2", vec![]),
-                ("Q3", vec!["1".to_string()]),
-            ] {
-                let got = HiiBackend::get_in(
-                    &hiidb,
-                    question,
-                    None,
-                    &GetOptions::default(),
-                    shared(&variables),
-                    None,
-                    None,
-                )
-                .unwrap_or_else(|error| panic!("{reach:?}: get {question}: {error:#}"));
-                let answers: Vec<String> = got
-                    .responses
-                    .into_iter()
-                    .map(|response| response.question.answer)
-                    .collect();
-                assert_eq!(answers, want, "{reach:?}: get {question}");
-                assert_eq!(
-                    records_of(got.ignored_ifr),
-                    want_records,
-                    "{reach:?}: get {question}: ignored_ifr"
-                );
-            }
-            let (listed, records) = HiiBackend::list_questions_and_ignored_ifr_in(
+            (
+                "--item",
+                driver_held_list([0x44; 16]),
+                SetValue::Items(vec!["1".to_owned()]),
+                "cannot set question \"Q\": --item gives the options of an ORDERED_LIST; this \
+                 question takes VALUE",
+            ),
+        ];
+        for (case, hiidb, value, want) in cases {
+            let driver = RecordingDriver::default();
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            variables.insert(setup(), NV_BS_RT, &[0x00, 0x00, 0x01, 0x01]);
+            let variables = Rc::new(variables);
+
+            let set = HiiBackend::set_in(
                 &hiidb,
-                &ListQuestionsOptions::default(),
-                shared(&variables),
+                "Q",
+                &value,
                 None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: Some(&driver),
+                },
                 None,
-            )
-            .unwrap_or_else(|error| panic!("{reach:?}: list-questions: {error:#}"));
-            let names: Vec<String> = listed.into_iter().map(|question| question.name).collect();
-            let records: Vec<(u64, bool)> = records
-                .iter()
-                .map(|ignored| (ignored.offset, ignored.reason.starts_with(&record)))
-                .collect();
+            );
+
             assert_eq!(
-                (names, records),
-                (
-                    vec!["Q1".to_string(), "Q3".to_string(), "O".to_string()],
-                    vec![(u64::try_from(offset).expect("offset"), true)]
-                ),
-                "{reach:?}: list-questions"
+                set.map(drop).map_err(|error| format!("{error:#}")),
+                Err(want.to_owned()),
+                "{case}"
             );
-            let set = set_bypassing(&hiidb, "Q2", "0", &variables);
             assert!(
-                set.as_ref()
-                    .is_err_and(|error| error.contains(&format!("offset {offset}"))
-                        && error.contains(&record)),
-                "{reach:?}: set Q2: {set:?}"
+                driver.sets.borrow().is_empty(),
+                "{case}: no set by the driver"
             );
-            assert_eq!(
-                variables.writes_to(&dropped_password_store()),
-                [],
-                "{reach:?}: writes"
+            assert!(
+                variables.writes_to(&setup()).is_empty(),
+                "{case}: the refusal comes before any write"
             );
         }
-
-        let shown = HiiBackend::show_ifr_using(
-            &hiidb,
-            &ShowIfrOptions {
-                efivars: EfivarSource::Disabled,
-                ..Default::default()
-            },
-        )
-        .expect("show-ifr")
-        .readable_representation;
-        assert!(
-            shown.contains(&format!("Disabled at offset {offset}: {record}")),
-            "show-ifr: {shown}"
-        );
     }
 
-    /// A PASSWORD op of a disabled form without its question header is unresolved: edk2 reads
-    /// that header from the bytes after the op, here those of its form's End and the next FORM,
-    /// QuestionId 0x0229 and VarStoreId 0x8601, which no VarStore declares. Through variables that
-    /// reach BootServices, get reads no variable; through those that reach Runtime it reads the
-    /// questions of the other forms, O too.
+    /// get and set take a question whose driver holds its value to that driver where one is
+    /// reached; elsewhere get shows why it has no value, and set refuses it before any write.
     #[test]
-    fn a_headless_password_in_a_disabled_form_closes_boot_services() {
-        let (hiidb, _) = disabled_form_hiidb(operation(PASSWORD, false, &[3, 0, 4, 0]));
+    fn driver_held_questions_go_to_their_driver_only_where_one_is_reached() {
+        let unreached = "question has no VarStore; its driver keeps the value, which only \
+                         EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() reaches (UEFI 2.11 §33.2.5.6), \
+                         and after ExitBootServices() no EFI device-handle-based protocol may be \
+                         used (UEFI 2.11 §7.4.6); use uefisettings.efi in the UEFI Shell";
+        let hiidb = driver_held_hiidb();
+        for reached in [true, false] {
+            let driver = RecordingDriver::default();
+            let held = reached.then_some(&driver as &dyn DriverHeldValues);
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            variables.insert(setup(), NV_BS_RT, &[0]);
+            let variables = Rc::new(variables);
 
-        let boot_services = disabled_form_variables(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        let want = format!(
-            "PASSWORD question 0x0229 in FormSet {}: its op ends before its question header",
-            Guid::from([0x11; 16])
-        );
-        for question in ["Q1", "Q3"] {
             let got = HiiBackend::get_in(
                 &hiidb,
-                question,
+                "Q",
                 None,
                 &GetOptions::default(),
-                shared(&boot_services),
+                shared(&variables),
                 None,
                 None,
+                held,
             )
-            .map(drop)
-            .map_err(|error| error.to_string());
-            assert!(
-                got.as_ref().is_err_and(|error| error.starts_with(&want)),
-                "BootServices: get {question}: {got:?}"
+            .expect("get Q");
+            let set = set_responses(
+                &hiidb,
+                "Q",
+                &SetValue::Text("1".to_owned()),
+                None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held,
+                },
+                None,
             );
-        }
-        assert_eq!(boot_services.reads(), [], "BootServices: reads");
 
-        let runtime = disabled_form_variables(VariableReach::Runtime, VariableInterface::Efivarfs);
-        for (question, want) in [
-            ("Q1", vec!["1"]),
-            ("Q2", vec![]),
-            ("Q3", vec!["1"]),
-            ("O", vec!["1"]),
-        ] {
-            assert_eq!(
-                answers_of(&hiidb, question, &runtime),
-                want,
-                "Runtime: get {question}"
-            );
+            let answer = &got.responses[0].question.answer;
+            let answers = set.map(|set| {
+                set.responses
+                    .into_iter()
+                    .map(|response| response.question.answer)
+                    .collect::<Vec<_>>()
+            });
+            match reached {
+                true => {
+                    assert_eq!(answer, "from the driver", "get through the driver");
+                    assert_eq!(
+                        answers.map_err(|error| error.to_string()),
+                        Ok(vec![
+                            "1 <set by the driver of QuestionId 7>".to_string(),
+                            "1".to_string()
+                        ]),
+                        "set through the driver"
+                    );
+                    assert_eq!(*driver.gets.borrow(), [7], "the driver's gets");
+                    assert_eq!(*driver.sets.borrow(), [(7, 1)], "the driver's sets");
+                    assert_eq!(
+                        variables.writes_to(&setup()),
+                        [(0, vec![1])],
+                        "Setup written"
+                    );
+                }
+                false => {
+                    assert!(
+                        answer.starts_with(&format!("<ValueUnavailable: {unreached}>")),
+                        "get without a driver: {answer}"
+                    );
+                    assert_eq!(
+                        answers.map_err(|error| error.to_string()),
+                        Err(format!("cannot set question \"Q\": {unreached}")),
+                        "set without a driver"
+                    );
+                    assert!(driver.gets.borrow().is_empty(), "no get by the driver");
+                    assert!(driver.sets.borrow().is_empty(), "no set by the driver");
+                    assert!(
+                        variables.writes_to(&setup()).is_empty(),
+                        "the refusal comes before any write"
+                    );
+                }
+            }
         }
     }
 
-    /// The variables of password_store_hiidb, of `reach`, each byte 0x01.
-    fn password_store_variables(reach: VariableReach) -> Rc<MemoryVariables> {
-        let interface = match reach {
-            VariableReach::Runtime => VariableInterface::Efivarfs,
-            VariableReach::BootServices => VariableInterface::VariableServices,
-        };
-        let variables = MemoryVariables::new(reach, interface);
-        variables.insert(password_store(), NV_BS_RT, &[0x01; 60]);
-        variables.insert(other_store(), NV_BS_RT, &[0x01]);
-        Rc::new(variables)
+    /// A package list with GUID `guid` whose form holds the CHECKBOX Q, QuestionId
+    /// `question_id`, without a VarStore and with the question flags `flags`.
+    fn storageless_checkbox_list(guid: [u8; 16], question_id: u16, flags: u8) -> Vec<u8> {
+        let storageless = [
+            &1u16.to_le_bytes()[..],    // Prompt
+            &1u16.to_le_bytes(),        // Help
+            &question_id.to_le_bytes(), // QuestionId
+            &0u16.to_le_bytes(),        // VarStoreId
+            &0xFFFFu16.to_le_bytes(),   // VarStoreInfo
+            &[flags, 0x00],             // question flags, CHECKBOX Flags
+        ]
+        .concat();
+        let packages = [
+            form_package(&[form(1, &[operation(CHECKBOX, false, &storageless)])]),
+            en_strings_package_of(&["Q"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid(guid, &packages.concat())
     }
 
-    /// A PASSWORD op that ends after its question header and MinSize disables its form (UEFI 2.11
-    /// §33.2.5.10.1) but still names its VarStore and VarOffset: through variables that reach
-    /// Runtime, every byte of its variable from there on is withheld, so O, over its first byte,
-    /// and Q1, past it, read no value, while Q2, before it, and Q3, on another variable, read;
-    /// through variables that reach BootServices it is unresolved, so get reads no variable. The
-    /// whole PASSWORD withholds its 40 bytes alone.
+    /// set writes a question that its driver holds and that EFI_IFR_FLAG_READ_ONLY makes
+    /// read-only only as an unsafe operation, as a stored one: refused before its driver unless
+    /// UnsafeOperations::Allow lifts it, which set then returns as lifted. So it does through
+    /// either reach: in the UEFI Shell, where the driver's Callback() takes the value, and from an
+    /// OS, where set stages it for the next boot.
     #[test]
-    fn a_password_without_max_size_withholds_its_variable_from_its_var_offset_on() {
-        let without_max_size = operation(
-            PASSWORD,
-            false,
-            &[
-                question_header_with(4, 4, 1, 10, 0x00),
-                1u16.to_le_bytes().to_vec(), // MinSize
-            ]
-            .concat(),
-        );
-        let read = || Ok(vec!["1".to_string()]);
-        let withheld = || Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
-        // each with what Runtime get of Q1 answers, and the start of BootServices get's refusal
-        for (case, password, q1, refusal) in [
-            ("the whole PASSWORD", password_on(4, 4, 1, 10), read(), None),
+    fn set_refuses_a_read_only_question_that_its_driver_holds_unless_the_flag_allows_it() {
+        // EFI_IFR_FLAG_CALLBACK | EFI_IFR_FLAG_READ_ONLY
+        let hiidb = storageless_checkbox_list([0x66; 16], 7, 0x05);
+        let read_only = UnsafeOperation::ReadOnlyQuestion {
+            question: "Q".to_owned(),
+            writable: IncludedStates::empty(),
+        };
+        for (reach, interface, unsafe_operations, want, want_sets) in [
             (
-                "a PASSWORD without MaxSize",
-                without_max_size,
-                withheld(),
-                Some("PASSWORD question 0x0004 without MaxSize in FormSet "),
+                VariableReach::Runtime,
+                VariableInterface::Efivarfs,
+                UnsafeOperations::Refuse,
+                flag_refusal("Q", ""),
+                vec![],
+            ),
+            (
+                VariableReach::Runtime,
+                VariableInterface::Efivarfs,
+                UnsafeOperations::Allow,
+                Ok(()),
+                vec![(7, 1)],
+            ),
+            (
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+                UnsafeOperations::Refuse,
+                flag_refusal("Q", ""),
+                vec![],
+            ),
+            (
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+                UnsafeOperations::Allow,
+                Ok(()),
+                vec![(7, 1)],
             ),
         ] {
-            let hiidb = password_store_hiidb(Vec::new(), password);
-
-            let runtime = password_store_variables(VariableReach::Runtime);
-            for (question, want) in [
-                ("O", withheld()),
-                ("Q1", q1.clone()),
-                ("Q2", read()),
-                ("Q3", read()),
-            ] {
-                assert_eq!(
-                    answers_or_error_of(&hiidb, question, &runtime),
-                    want,
-                    "{case}: Runtime: get {question}"
-                );
-            }
-
-            let boot_services = password_store_variables(VariableReach::BootServices);
-            let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
-            match refusal {
-                None => assert_eq!(got, read(), "{case}: BootServices: get Q3"),
-                Some(refusal) => {
-                    assert!(
-                        got.as_ref().is_err_and(|error| error.starts_with(refusal)),
-                        "{case}: BootServices: get Q3: {got:?}"
-                    );
-                    assert_eq!(boot_services.reads(), [], "{case}: BootServices: reads");
-                }
-            }
+            let driver = RecordingDriver::default();
+            let variables = Rc::new(MemoryVariables::new(reach, interface));
+            let got = HiiBackend::set_in(
+                &hiidb,
+                "Q",
+                &SetValue::Text("1".to_owned()),
+                None,
+                &SetOptions {
+                    unsafe_operations,
+                    ..SetOptions::default()
+                },
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: Some(&driver),
+                },
+                None,
+            );
+            assert_eq!(
+                got.as_ref()
+                    .map(|(_, lifted)| lifted.clone())
+                    .map_err(|error| error.to_string()),
+                want.map(|()| vec![read_only.clone()]),
+                "set through {reach:?} with {unsafe_operations:?}"
+            );
+            assert_eq!(
+                *driver.sets.borrow(),
+                want_sets,
+                "the driver's sets through {reach:?} with {unsafe_operations:?}"
+            );
         }
     }
 
-    /// Each variable that a VARSTORE or VARSTORE_EFI op of a FormSet that uefisettings ignores
-    /// declares is withheld whole through variables that reach Runtime, as a PASSWORD in that
-    /// FormSet may name any of them: O and Q2, on the variable of its VarStore 1, read no
-    /// value and that variable is never read, while Q3, on another variable, reads; through
-    /// variables that reach BootServices get reads no variable.
+    /// In the UEFI Shell, in a HiiDB that declares a setup password question, set of a question
+    /// that its driver holds is an unsafe operation, as that of a stored one: refused before any
+    /// Callback() unless UnsafeOperations::Allow lifts it, which set then returns as lifted.
     #[test]
-    fn the_variables_that_an_ignored_form_set_declares_are_withheld_whole() {
-        // a DEFAULTSTORE op of 4 bytes, shorter than its minimum of 6, outside the forms
-        let short_default_store = operation(DEFAULT_STORE, false, &[0x00, 0x00]);
-        let hiidb = password_store_hiidb(short_default_store, password_on(4, 4, 1, 10));
-
-        let runtime = password_store_variables(VariableReach::Runtime);
-        let withheld = Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
-        for (question, want) in [
-            ("O", withheld.clone()),
-            ("Q2", withheld),
-            ("Q3", Ok(vec!["1".to_string()])),
+    fn set_through_a_driver_beside_a_setup_password_takes_the_flag() {
+        let storageless = [
+            &4u16.to_le_bytes()[..],  // Prompt
+            &4u16.to_le_bytes(),      // Help
+            &9u16.to_le_bytes(),      // QuestionId
+            &0u16.to_le_bytes(),      // VarStoreId
+            &0xFFFFu16.to_le_bytes(), // VarStoreInfo
+            &[0x04, 0x00],            // EFI_IFR_FLAG_CALLBACK, CHECKBOX Flags
+        ]
+        .concat();
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 1),
+                var_store(2, [0x44; 16], "AMITSESetup", 81),
+                form(
+                    1,
+                    &[
+                        checkbox_on(1, 1, 1),
+                        password_on(3, 3, 2, 0),
+                        operation(CHECKBOX, false, &storageless),
+                    ],
+                ),
+            ]),
+            en_strings_package_of(&["Q", "P", "Password", "D"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let refusal = "this HiiDB declares a setup password question, and the UEFI Shell runs no \
+                       setup browser, so no password is asked or checked; pass \
+                       --i-am-fine-to-brick-this-system to write without it";
+        for (unsafe_operations, want, want_sets) in [
+            (UnsafeOperations::Refuse, Err(refusal.to_owned()), vec![]),
+            (
+                UnsafeOperations::Allow,
+                Ok(vec![UnsafeOperation::SetupPassword]),
+                vec![(9, 1)],
+            ),
         ] {
+            let driver = RecordingDriver::default();
+            let variables = password_variables(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            );
+            let got = HiiBackend::set_in(
+                &hiidb,
+                "D",
+                &SetValue::Text("1".to_owned()),
+                None,
+                &SetOptions {
+                    unsafe_operations,
+                    ..SetOptions::default()
+                },
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: Some(&driver),
+                },
+                None,
+            );
             assert_eq!(
-                answers_or_error_of(&hiidb, question, &runtime),
+                got.map(|(_, lifted)| lifted)
+                    .map_err(|error| error.to_string()),
                 want,
-                "Runtime: get {question}"
+                "set with {unsafe_operations:?}"
+            );
+            assert_eq!(
+                *driver.sets.borrow(),
+                want_sets,
+                "the driver's sets with {unsafe_operations:?}"
+            );
+            assert_eq!(
+                variables.writes_to(&amitse_setup()),
+                vec![],
+                "no write of the password's VarStore with {unsafe_operations:?}"
             );
         }
-        assert_eq!(runtime.reads(), [(other_store(), 1)], "Runtime: reads");
-
-        let boot_services = password_store_variables(VariableReach::BootServices);
-        let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
-        assert!(
-            got.as_ref()
-                .is_err_and(|error| error.starts_with("PASSWORD questions of package list ")),
-            "BootServices: get Q3: {got:?}"
-        );
-        assert_eq!(boot_services.reads(), [], "BootServices: reads");
     }
 
-    /// IFR past an op where the walk for FormSets ends has no op boundary, so a PASSWORD in it may
-    /// name any variable: through variables of either reach, get and list-questions read no
-    /// variable of the HiiDB and refuse, naming that IFR; list-questions and show-ifr without
-    /// efivars still list the questions of the FormSets that uefisettings reads.
+    /// A question without a VarStore, flagged EFI_IFR_FLAG_CALLBACK, whose QuestionId a PASSWORD
+    /// of its FormSet also has, never goes to its driver: a CallBack() names its question only
+    /// by QuestionId, so its driver could take it for the PASSWORD. get shows why, set refuses
+    /// it, and the driver is asked for nothing.
     #[test]
-    fn ifr_past_the_end_of_the_form_set_walk_closes_every_variable() {
-        let hiidb = password_past_the_walk_hiidb();
-        let want = format!(
-            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
-             offset 0 of a form package, which has no op boundary, so in any variable: an op that \
-             does not fit the form package, and the bytes after it: ",
-            Guid::from(PAST_THE_WALK_LIST_GUID)
-        );
-        for reach in [VariableReach::Runtime, VariableReach::BootServices] {
-            let variables = password_store_variables(reach);
-            for question in ["O", "Q3"] {
-                let got = answers_or_error_of(&hiidb, question, &variables);
-                assert!(
-                    got.as_ref().is_err_and(|error| error.starts_with(&want)),
-                    "{reach:?}: get {question}: {got:?}"
-                );
-            }
-            let listed = HiiBackend::list_questions_and_ignored_ifr_in(
-                &hiidb,
-                &ListQuestionsOptions::default(),
-                shared(&variables),
-                None,
-                None,
-            )
-            .map(drop)
-            .map_err(|error| error.to_string());
-            assert!(
-                listed.as_ref().is_err_and(|error| error.starts_with(&want)),
-                "{reach:?}: list-questions: {listed:?}"
-            );
-            assert_eq!(variables.reads(), [], "{reach:?}: reads");
-        }
+    fn a_question_that_shares_its_question_id_with_a_password_never_goes_to_its_driver() {
+        let storageless = [
+            &1u16.to_le_bytes()[..],  // Prompt
+            &1u16.to_le_bytes(),      // Help
+            &7u16.to_le_bytes(),      // QuestionId
+            &0u16.to_le_bytes(),      // VarStoreId
+            &0xFFFFu16.to_le_bytes(), // VarStoreInfo
+            &[0x04, 0x00],            // EFI_IFR_FLAG_CALLBACK, CHECKBOX Flags
+        ]
+        .concat();
+        let packages = [
+            form_package(&[
+                var_store(1, [0x77; 16], "PasswordStore", 40),
+                form(
+                    1,
+                    &[
+                        operation(CHECKBOX, false, &storageless),
+                        // on a VarStore: one of VarStoreId 0 closes every variable
+                        password_on(7, 2, 1, 0),
+                    ],
+                ),
+            ]),
+            en_strings_package_of(&["Q", "P"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x66; 16], &packages.concat());
+        let refusal = StoragelessRefusal::CallbackSharedQuestionId("EFI_IFR_PASSWORD");
+        let driver = RecordingDriver::default();
+        let variables = Rc::new(MemoryVariables::new(
+            VariableReach::Runtime,
+            VariableInterface::Efivarfs,
+        ));
 
-        let (listed, _) = HiiBackend::list_questions_and_ignored_ifr_in(
+        let got = HiiBackend::get_in(
             &hiidb,
-            &ListQuestionsOptions::default(),
-            EfivarSource::Disabled
-                .into_variables()
-                .expect("variables that read nothing"),
+            "Q",
+            None,
+            &GetOptions::default(),
+            shared(&variables),
             None,
             None,
+            Some(&driver as &dyn DriverHeldValues),
         )
-        .expect("list-questions without efivars");
-        let names: Vec<String> = listed.into_iter().map(|question| question.name).collect();
-        assert_eq!(
-            names,
-            ["Q1", "O", "Q2", "Q3"],
-            "list-questions without efivars"
-        );
-        let shown = HiiBackend::show_ifr_using(
+        .expect("get Q");
+        let set = HiiBackend::set_in(
             &hiidb,
-            &ShowIfrOptions {
-                efivars: EfivarSource::Disabled,
-                ..Default::default()
+            "Q",
+            &SetValue::Text("1".to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: Some(&driver),
             },
-        )
-        .expect("show-ifr without efivars")
-        .readable_representation;
-        assert!(shown.contains("Q3"), "show-ifr without efivars: {shown}");
-    }
+            None,
+        );
 
-    /// Through variables that reach BootServices, a HiiDB whose form package holds IFR that
-    /// uefisettings ignores, a FormSet that does not parse or nests too deep, the ops after one
-    /// where its walk for FormSets ends or a FormSet without its Scope bit, whose second form edk2
-    /// parses into it, has get and set read and write no variable: a PASSWORD question in it
-    /// could name any variable. A HiiDB without that IFR withholds the PASSWORD's bytes as
-    /// before. Through variables that reach Runtime, the variables that an ignored FormSet or the
-    /// FormSet without its Scope bit declares are withheld whole, and the ops after an op where
-    /// the walk ends close every variable.
-    #[test]
-    fn ignored_ifr_closes_every_variable_to_boot_services() {
-        let offset = dropped_password_first_form_set().len();
-        let ignored = format!(
-            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
-             offset {offset} of a form package: ",
-            Guid::from(DROPPED_PASSWORD_LIST_GUID)
+        let answer = &got.responses[0].question.answer;
+        assert!(
+            answer.starts_with(&format!("<ValueUnavailable: {refusal}>")),
+            "get: {answer}"
         );
-        let second = "the FormSet 11111111-1111-1111-1111-111111111111";
-        let past_the_walk = format!(
-            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
-             offset {offset} of a form package, which has no op boundary, so in any variable: ",
-            Guid::from(DROPPED_PASSWORD_LIST_GUID)
+        assert!(driver.gets.borrow().is_empty(), "no get by the driver");
+        assert!(driver.sets.borrow().is_empty(), "no set by the driver");
+        assert_eq!(
+            set.map(drop).map_err(|error| error.to_string()),
+            Err(format!("cannot set question \"Q\": {refusal}")),
+            "set"
         );
-        let closed = "; as the variable of that password is unknown, the UEFI Shell build reads \
-                      and writes no variable of this HiiDB";
-        let refused = "; as a PASSWORD there may keep its password in any variable, uefisettings \
-                       reads and writes no variable of this HiiDB";
-        let withheld = Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
-        // a VARSTORE op that ends after 4 of the 20 bytes before its Name
-        let malformed = operation(VAR_STORE, false, &[0x00; 4]);
-        // the FormSet's own scope and these
-        let too_deep = nested(&subtitle_scope(5), MAX_SCOPE_NESTING, &[]);
-        // the Subtitle past the limit, after the second FormSet's other ops
-        let too_deep_at = offset + form_set(&dropped_password_second_ops(Vec::new())).len()
-            - END.len()
-            + (MAX_SCOPE_NESTING - 1) * subtitle_scope(5).len();
-        let dropped = [
-            (
-                "malformed",
-                Vec::new(),
-                form_set(&dropped_password_second_ops(malformed)),
-                format!(
-                    "{ignored}{second}, which holds, outside its forms, an op shorter than its \
-                     minimum, which UEFI 2.11 §33.2.5.10.1 calls malformed, in no form for that \
-                     section to disable: the EFI_IFR_VARSTORE op at offset "
-                ),
-                (withheld.clone(), &[][..]),
-            ),
-            (
-                "nested too deep",
-                Vec::new(),
-                form_set(&dropped_password_second_ops(too_deep)),
-                format!(
-                    "{ignored}{second}, which nests too deep: IFR scopes nest deeper than \
-                     {MAX_SCOPE_NESTING} at offset {too_deep_at} of a form package{closed}"
-                ),
-                (withheld.clone(), &[]),
-            ),
-            (
-                "an End op of Length 1 before it",
-                vec![0x29, 0x01],
-                form_set(&dropped_password_second_ops(Vec::new())),
-                format!(
-                    "{past_the_walk}an op that does not fit the form package, and the bytes after \
-                     it: invalid IFR operation length 1"
-                ),
-                (
-                    Err(format!(
-                        "{past_the_walk}an op that does not fit the form package, and the bytes \
-                         after it: invalid IFR operation length 1 at {offset:#x}{refused}"
-                    )),
-                    &[],
-                ),
-            ),
-            (
-                "without its Scope bit",
-                Vec::new(),
-                scopeless_form_set(&dropped_password_second_ops(Vec::new())),
-                format!(
-                    "{ignored}{second} opens no scope, so edk2 parses its ops on to the end of the \
-                     form package, past the End where uefisettings ends it (edk2-stable202211 \
-                     SetupBrowserDxe IfrParse.c ParseOpCodes pushes a scope only for Scope != 0, \
-                     and ends a FormSet only at the End of a FORM_SET scope){closed}"
+    }
+
+    /// The package list of a form that holds the CHECKBOX Q, QuestionId 9, which its driver holds
+    /// (callback_checkbox), and, flagged EFI_IFR_FLAG_CALLBACK and without a VarStore, the STRING
+    /// C, QuestionId 10, and the ORDERED_LIST L, QuestionId 11, which EFI_IFR_FLAG_READ_ONLY makes
+    /// read-only; then the STRINGs of MaxSize 4 on the EFI variable Setup: S, QuestionId 1, at
+    /// byte 0, and R, QuestionId 2, at byte 8, which EFI_IFR_FLAG_READ_ONLY makes read-only.
+    fn callback_and_strings_list() -> Vec<u8> {
+        // EFI_IFR_FLAG_CALLBACK | EFI_IFR_FLAG_READ_ONLY; MaxContainers 2, no Flags
+        let ordered_list = [question_header_with(11, 3, 0, 0, 0x05), vec![2, 0x00]].concat();
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 16),
+                form(
+                    1,
+                    &[
+                        callback_checkbox(9, 1),
+                        // EFI_IFR_FLAG_CALLBACK
+                        flagged_string_on(10, 2, (0, 0), (0, 4), (0x04, 0x00), &[]),
+                        [
+                            operation(ORDERED_LIST, true, &ordered_list),
+                            flagged_option(6, 0x00, 1),
+                            flagged_option(7, 0x00, 2),
+                            END.to_vec(),
+                        ]
+                        .concat(),
+                        string_on(1, 4, (1, 0), (0, 4), &[]),
+                        // EFI_IFR_FLAG_READ_ONLY
+                        flagged_string_on(2, 5, (1, 8), (0, 4), (0x01, 0x00), &[]),
+                    ],
                 ),
-                (withheld, &[]),
-            ),
+            ]),
+            en_strings_package_of(&["Q", "C", "L", "S", "R", "A", "B"]),
+            END_PACKAGE.to_vec(),
         ];
-        let get = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
-            HiiBackend::get_in(
-                hiidb,
-                "Q",
-                None,
-                &GetOptions::default(),
-                shared(variables),
-                None,
-                None,
-            )
-            .map(|got| {
-                got.responses
-                    .iter()
-                    .map(|response| response.question.answer.clone())
-                    .collect::<Vec<_>>()
-            })
-        };
-        let set = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
-            set_responses(
-                hiidb,
-                "Q",
-                &SetValue::Text("0".to_owned()),
-                None,
-                &SetOptions::default(),
-                shared(variables),
-                &**variables,
-                None,
-            )
-            .map(drop)
-        };
-        let variables_of = |reach, interface| {
-            let variables = MemoryVariables::new(reach, interface);
-            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-            Rc::new(variables)
+        package_list_with_guid([0x5D; 16], &packages.concat())
+    }
+
+    /// The variables of callback_and_strings_list through `reach`, Setup holding "AB" for S and
+    /// "CD" for R.
+    fn strings_beside_a_driver(reach: VariableReach) -> Rc<MemoryVariables> {
+        let interface = match reach {
+            VariableReach::BootServices => VariableInterface::VariableServices,
+            VariableReach::Runtime => VariableInterface::Efivarfs,
         };
+        let variables = MemoryVariables::new(reach, interface);
+        let stored = [
+            [0x41, 0, 0x42, 0, 0, 0, 0, 0],
+            [0x43, 0, 0x44, 0, 0, 0, 0, 0],
+        ]
+        .concat();
+        variables.insert(setup(), NV_BS_RT, &stored);
+        Rc::new(variables)
+    }
 
-        for (case, between, second_form_set, want, (runtime, reads)) in dropped {
-            let hiidb = dropped_password_hiidb(between, second_form_set);
-            let variables = variables_of(
-                VariableReach::BootServices,
-                VariableInterface::VariableServices,
-            );
-            for (command, got) in [
-                (
-                    "get",
-                    get(&hiidb, &variables).map(|answers| format!("{answers:?}")),
-                ),
-                ("set", set(&hiidb, &variables).map(|()| String::new())),
-            ] {
-                let got = got.map_err(|error| error.to_string());
-                assert!(
-                    got.as_ref()
-                        .is_err_and(|error| error.starts_with(&want) && error.ends_with(closed)),
-                    "{case}: BootServices: {command}: {got:?}, reads {:?}",
-                    variables.reads()
+    /// get of a STRING beside a question that its driver holds asks no driver, and answers as
+    /// without one, through either reach: C, flagged EFI_IFR_FLAG_CALLBACK and without a
+    /// VarStore, shows why it has no value, as uefisettings exchanges no STRING with a CallBack()
+    /// (StoragelessRefusal::CallbackUndecoded), and S and R show the characters of Setup. get of
+    /// Q asks the driver.
+    #[test]
+    fn get_asks_no_driver_for_a_string() {
+        let hiidb = callback_and_strings_list();
+        let undecoded = format!(
+            "<ValueUnavailable: {}>",
+            StoragelessRefusal::CallbackUndecoded("EFI_IFR_STRING")
+        );
+        for reach in [VariableReach::Runtime, VariableReach::BootServices] {
+            let driver = RecordingDriver::default();
+            let get = |question: &str, held: Option<&dyn DriverHeldValues>| {
+                HiiBackend::get_in(
+                    &hiidb,
+                    question,
+                    None,
+                    &GetOptions::default(),
+                    shared(&strings_beside_a_driver(reach)),
+                    None,
+                    None,
+                    held,
+                )
+                .map(|response| {
+                    response
+                        .responses
+                        .into_iter()
+                        .map(|response| response.question.answer)
+                        .collect::<Vec<_>>()
+                })
+                .map_err(|error| format!("{error:#}"))
+            };
+
+            for (question, want) in [("C", undecoded.as_str()), ("S", "AB"), ("R", "CD")] {
+                let got = get(question, Some(&driver));
+                assert_eq!(got, Ok(vec![want.to_owned()]), "{reach:?}: get {question}");
+                assert_eq!(
+                    got,
+                    get(question, None),
+                    "{reach:?}: get {question} without a driver"
                 );
             }
-            assert_eq!(variables.reads(), [], "{case}: BootServices: reads");
-            assert_eq!(
-                variables.writes_to(&dropped_password_store()),
-                [],
-                "{case}: BootServices: writes"
+            assert!(
+                driver.gets.borrow().is_empty(),
+                "{reach:?}: no get by the driver"
             );
-
-            let variables = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
             assert_eq!(
-                get(&hiidb, &variables).map_err(|error| error.to_string()),
-                runtime,
-                "{case}: Runtime: get"
+                get("Q", Some(&driver)),
+                Ok(vec!["from the driver".to_owned()]),
+                "{reach:?}: get Q"
             );
-            let reads: Vec<(VariableKey, u16)> = reads
-                .iter()
-                .map(|&size| (dropped_password_store(), size))
-                .collect();
-            assert_eq!(variables.reads(), reads, "{case}: Runtime: reads");
+            assert_eq!(*driver.gets.borrow(), [9], "{reach:?}: the driver's gets");
         }
-
-        let variables = variables_of(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        assert_eq!(
-            get(
-                &dropped_password_hiidb(
-                    Vec::new(),
-                    form_set(&dropped_password_second_ops(Vec::new())),
-                ),
-                &variables
-            )
-            .map_err(|error| error.to_string()),
-            Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]),
-            "no drop: BootServices: get"
-        );
-        assert_eq!(variables.reads(), [], "no drop: BootServices: reads");
     }
 
-    /// A HiiDB of one package list, of DROPPED_PASSWORD_LIST_GUID, holding a form package of
-    /// `ifr` and the strings Q1, Password and Q3 of string IDs 1 to 3.
-    fn three_questions_hiidb(ifr: &[u8]) -> Vec<u8> {
-        let packages = [
-            form_package_of(ifr),
-            en_strings_package_of(&["Q1", "Password", "Q3"]),
-            END_PACKAGE.to_vec(),
-        ];
-        package_list_with_guid(DROPPED_PASSWORD_LIST_GUID, &packages.concat())
+    /// set of a STRING beside a question that its driver holds asks no driver, and does as
+    /// without one, through either reach and with either grant: C, flagged EFI_IFR_FLAG_CALLBACK
+    /// and without a VarStore, is refused before any write, as get_asks_no_driver_for_a_string
+    /// shows it; S is written to Setup; R, which EFI_IFR_FLAG_READ_ONLY makes read-only, is
+    /// refused unless UnsafeOperations::Allow, then written and returned as lifted. L, an
+    /// ORDERED_LIST of C's flags that EFI_IFR_FLAG_READ_ONLY makes read-only, is refused as C is
+    /// with either grant: no driver holds an ORDERED_LIST.
+    #[test]
+    fn set_asks_no_driver_for_a_string_or_an_ordered_list() {
+        let hiidb = callback_and_strings_list();
+        let undecoded = |question: &str, op| {
+            Err(format!(
+                "cannot set question {question:?}: {}",
+                StoragelessRefusal::CallbackUndecoded(op)
+            ))
+        };
+        let xyz = SetValue::Text("XYZ".to_owned());
+        let items = SetValue::Items(vec!["B".to_owned(), "A".to_owned()]);
+        let written = vec![0x58, 0, 0x59, 0, 0x5A, 0, 0, 0];
+        let read_only_r = UnsafeOperation::ReadOnlyQuestion {
+            question: "R".to_owned(),
+            writable: IncludedStates::empty(),
+        };
+        for reach in [VariableReach::Runtime, VariableReach::BootServices] {
+            for unsafe_operations in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
+                let driver = RecordingDriver::default();
+                let set =
+                    |question: &str, value: &SetValue, held: Option<&dyn DriverHeldValues>| {
+                        let variables = strings_beside_a_driver(reach);
+                        let set = HiiBackend::set_in(
+                            &hiidb,
+                            question,
+                            value,
+                            None,
+                            &SetOptions {
+                                unsafe_operations,
+                                ..SetOptions::default()
+                            },
+                            SetAccess {
+                                reads: shared(&variables),
+                                writes: &*variables,
+                                held,
+                            },
+                            None,
+                        )
+                        .map(|(_, lifted)| lifted)
+                        .map_err(|error| format!("{error:#}"));
+                        (set, variables.writes_to(&setup()))
+                    };
+                let r = match unsafe_operations {
+                    UnsafeOperations::Refuse => {
+                        (flag_refusal("R", "").map(|()| Vec::new()), vec![])
+                    }
+                    UnsafeOperations::Allow => {
+                        (Ok(vec![read_only_r.clone()]), vec![(8, written.clone())])
+                    }
+                };
+                let cases = [
+                    ("C", &xyz, (undecoded("C", "EFI_IFR_STRING"), vec![])),
+                    (
+                        "L",
+                        &items,
+                        (undecoded("L", "EFI_IFR_ORDERED_LIST"), vec![]),
+                    ),
+                    ("S", &xyz, (Ok(Vec::new()), vec![(0, written.clone())])),
+                    ("R", &xyz, r),
+                ];
+
+                let case = format!("{reach:?}, {unsafe_operations:?}");
+                for (question, value, want) in cases {
+                    let got = set(question, value, Some(&driver));
+                    assert_eq!(got, want, "{case}: set {question}");
+                    assert_eq!(
+                        got,
+                        set(question, value, None),
+                        "{case}: set {question} without a driver"
+                    );
+                }
+                assert!(
+                    driver.sets.borrow().is_empty(),
+                    "{case}: no set by the driver"
+                );
+            }
+        }
     }
 
-    /// The answers of get of `question` in `hiidb`, reading `variables`, or its error.
-    fn answers_or_error_of(
-        hiidb: &[u8],
-        question: &str,
-        variables: &Rc<MemoryVariables>,
-    ) -> Result<Vec<String>, String> {
-        HiiBackend::get_in(
-            hiidb,
-            question,
-            None,
-            &GetOptions::default(),
-            shared(variables),
-            None,
-            None,
-        )
-        .map(|got| {
-            got.responses
-                .iter()
-                .map(|response| response.question.answer.clone())
-                .collect()
-        })
-        .map_err(|error| error.to_string())
+    /// A CHECKBOX of QuestionId `question_id` prompted by string `prompt`, without a VarStore,
+    /// flagged EFI_IFR_FLAG_CALLBACK.
+    fn callback_checkbox(question_id: u16, prompt: u16) -> Vec<u8> {
+        let data = [
+            &prompt.to_le_bytes()[..],
+            &1u16.to_le_bytes(),        // Help
+            &question_id.to_le_bytes(), // QuestionId
+            &0u16.to_le_bytes(),        // VarStoreId
+            &0xFFFFu16.to_le_bytes(),   // VarStoreInfo
+            &[0x04, 0x00],              // EFI_IFR_FLAG_CALLBACK, CHECKBOX Flags
+        ]
+        .concat();
+        operation(CHECKBOX, false, &data)
     }
 
-    /// The number of questions that set of `question` to "0" in `hiidb` under `policy` sets,
-    /// reading and writing `variables`, or its error.
-    fn set_count_of(
-        hiidb: &[u8],
-        question: &str,
-        policy: UnsafeOperations,
-        variables: &Rc<MemoryVariables>,
-    ) -> Result<usize, String> {
-        let options = SetOptions {
-            unsafe_operations: policy,
-            ..SetOptions::default()
-        };
-        set_responses(
-            hiidb,
-            question,
-            &SetValue::Text("0".to_owned()),
-            None,
-            &options,
-            shared(variables),
-            &**variables,
-            None,
-        )
-        .map(|got| got.responses.len())
-        .map_err(|error| error.to_string())
+    /// The IFR of name_value_hiidb's first list with a CHECKBOX C of its own, QuestionId 9, which
+    /// its driver holds (callback_checkbox), beside the VARSTORE_NAME_VALUE of VarStoreId 3 and B
+    /// on Backing, and with the PASSWORD on Pin of VarStoreId `password`, if any, in a form of
+    /// its own: edk2 may route one of VarStoreId 3 to the VARSTORE_NAME_VALUE, one of VarStoreId
+    /// 0 names no VarStore, and one of VarStoreId 1 is on Backing.
+    fn name_value_callback_ifr(password: Option<u16>) -> Vec<Vec<u8>> {
+        type I = NameValueIfr;
+        let mut children = vec![
+            I::name_value(),
+            I::backing(),
+            form(1, &[callback_checkbox(9, 1), I::b()]),
+        ];
+        if let Some(var_store_id) = password {
+            children.push(form(2, &[I::password(var_store_id)]));
+        }
+        vec![form_set(&children)]
     }
 
-    /// A VARSTORE op that ends after 4 of the 20 bytes before its Name: UEFI 2.11 §33.2.5.10.1
-    /// calls it malformed.
-    fn short_var_store() -> Vec<u8> {
-        operation(VAR_STORE, false, &[0x00; 4])
-    }
+    /// What the refusal of a HiiDB with a PASSWORD of VarStoreId 0 says of it, after its
+    /// QuestionId and FormSet.
+    const VAR_STORE_ID_0: &str = ": VarStoreId 0 names no VarStore, so its callbacks or READ and \
+                                  WRITE ops keep its password where uefisettings cannot tell";
 
-    /// The prefix of the refusal, through variables that reach BootServices, of a HiiDB of
-    /// three_questions_hiidb with IFR that uefisettings ignores.
-    fn three_questions_refusal() -> String {
-        format!(
-            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
-             offset ",
-            Guid::from(DROPPED_PASSWORD_LIST_GUID)
-        )
+    /// In a HiiDB with a PASSWORD that its driver may keep in any variable, one of VarStoreId 0,
+    /// which names no VarStore, or one that edk2 may route to a VARSTORE_NAME_VALUE, get of a
+    /// question that its driver holds asks that driver nothing and reads no variable: through
+    /// variables that reach Runtime it refuses the HiiDB as such (AnyVariablePasswords), through
+    /// those that reach BootServices as the password is unresolved. Beside a PASSWORD on Backing,
+    /// or none, get asks the driver.
+    #[test]
+    fn get_asks_no_driver_where_a_driver_may_keep_a_password_in_any_variable() {
+        for (reach, refusal) in [
+            (VariableReach::Runtime, ANY_VARIABLE),
+            (VariableReach::BootServices, BOOT_SERVICES_REFUSAL),
+        ] {
+            for password in [Some(0), Some(3), Some(1), None] {
+                let hiidb = name_value_hiidb(&name_value_callback_ifr(password));
+                let variables = name_value_variables(reach);
+                let driver = RecordingDriver::default();
+
+                let got = HiiBackend::get_in(
+                    &hiidb,
+                    "C",
+                    None,
+                    &GetOptions::default(),
+                    shared(&variables),
+                    None,
+                    None,
+                    Some(&driver as &dyn DriverHeldValues),
+                )
+                .map(|response| {
+                    response
+                        .responses
+                        .into_iter()
+                        .map(|response| response.question.answer)
+                        .collect::<Vec<_>>()
+                })
+                .map_err(|error| format!("{error:#}"));
+
+                let case = format!("{reach:?}, the PASSWORD of VarStoreId {password:?}");
+                match password {
+                    Some(var_store_id @ (0 | 3)) => {
+                        assert!(
+                            got.as_ref().is_err_and(|error| {
+                                error.starts_with("PASSWORD question 0x0003 in FormSet ")
+                                    && error.ends_with(refusal)
+                                    && (var_store_id == 3 || error.contains(VAR_STORE_ID_0))
+                            }),
+                            "{case}: get C: {got:?}"
+                        );
+                        assert!(
+                            driver.gets.borrow().is_empty(),
+                            "{case}: no get by the driver"
+                        );
+                        assert_eq!(variables.reads(), [], "{case}: no variable read");
+                    }
+                    Some(_) | None => {
+                        assert_eq!(got, Ok(vec!["from the driver".to_owned()]), "{case}: get C");
+                        assert_eq!(*driver.gets.borrow(), [9], "{case}: the driver's gets");
+                    }
+                }
+            }
+        }
     }
 
-    /// Through variables that reach Runtime, get reads the questions of a FormSet after one that
-    /// uefisettings ignores, as edk2-stable202608 GetIfrBinaryData finds it, and those before, on
-    /// a variable that the ignored one does not declare; through variables that reach
-    /// BootServices, the PASSWORD of the ignored FormSet still closes every variable of the HiiDB.
+    /// In a HiiDB with a PASSWORD that its driver may keep in any variable, of VarStoreId 0 or one
+    /// that edk2 may route to a VARSTORE_NAME_VALUE, set of a question that its driver holds asks
+    /// that driver nothing and reads and writes no variable, as
+    /// get_asks_no_driver_where_a_driver_may_keep_a_password_in_any_variable refuses, also with
+    /// UnsafeOperations::Allow, which lifts no withholding and which the refusal does not name.
+    /// Without a PASSWORD, set asks the driver, lifting nothing.
     #[test]
-    fn form_sets_after_an_ignored_one_are_read() {
-        let ifr = [
-            form_set(&[
-                dropped_password_var_store(),
-                form(1, &[checkbox_on(1, 1, 1)]),
-            ]),
-            form_set(&[
-                ignored_form_set_var_store(),
-                form(1, &[password_on(2, 2, 2, 0)]),
-                short_var_store(),
-            ]),
-            form_set(&[
-                dropped_password_var_store(),
-                form(1, &[checkbox_on(3, 3, 1)]),
-            ]),
-        ]
-        .concat();
-        let hiidb = three_questions_hiidb(&ifr);
-        let variables_of = |reach, interface| {
-            let variables = MemoryVariables::new(reach, interface);
-            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-            Rc::new(variables)
-        };
+    fn set_asks_no_driver_where_a_driver_may_keep_a_password_in_any_variable() {
+        for (reach, refusal) in [
+            (VariableReach::Runtime, ANY_VARIABLE),
+            (VariableReach::BootServices, BOOT_SERVICES_REFUSAL),
+        ] {
+            for unsafe_operations in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
+                for password in [Some(0), Some(3), None] {
+                    let hiidb = name_value_hiidb(&name_value_callback_ifr(password));
+                    let variables = name_value_variables(reach);
+                    let driver = RecordingDriver::default();
+                    let options = SetOptions {
+                        unsafe_operations,
+                        ..SetOptions::default()
+                    };
 
-        let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
-        for question in ["Q1", "Q3"] {
-            assert_eq!(
-                answers_or_error_of(&hiidb, question, &runtime),
-                Ok(vec!["1".to_string()]),
-                "Runtime: get {question}"
-            );
-        }
+                    let set = HiiBackend::set_in(
+                        &hiidb,
+                        "C",
+                        &SetValue::Text("1".to_owned()),
+                        None,
+                        &options,
+                        SetAccess {
+                            reads: shared(&variables),
+                            writes: &*variables,
+                            held: Some(&driver),
+                        },
+                        None,
+                    )
+                    .map(|(_, lifted)| lifted)
+                    .map_err(|error| format!("{error:#}"));
 
-        let boot_services = variables_of(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        for question in ["Q1", "Q3"] {
-            let got = answers_or_error_of(&hiidb, question, &boot_services);
-            assert!(
-                got.as_ref()
-                    .is_err_and(|error| error.starts_with(&three_questions_refusal())),
-                "BootServices: get {question}: {got:?}"
-            );
+                    let case = format!(
+                        "{reach:?}, {unsafe_operations:?}, the PASSWORD of VarStoreId {password:?}"
+                    );
+                    match password {
+                        Some(var_store_id) => {
+                            assert!(
+                                set.as_ref().is_err_and(|error| {
+                                    error.starts_with("PASSWORD question 0x0003 in FormSet ")
+                                        && error.ends_with(refusal)
+                                        && (var_store_id != 0 || error.contains(VAR_STORE_ID_0))
+                                        && !error.contains(UNSAFE_OPERATIONS_FLAG)
+                                }),
+                                "{case}: set C: {set:?}"
+                            );
+                            assert!(
+                                driver.sets.borrow().is_empty(),
+                                "{case}: no set by the driver"
+                            );
+                            assert_eq!(variables.reads(), [], "{case}: no variable read");
+                        }
+                        None => {
+                            assert_eq!(set, Ok(Vec::new()), "{case}: set C");
+                            assert_eq!(
+                                *driver.sets.borrow(),
+                                [(9, 1)],
+                                "{case}: the driver's sets"
+                            );
+                        }
+                    }
+                    for (name, guid) in [("Backing", P_GUID), ("Other", OTHER_GUID)] {
+                        let key = VariableKey {
+                            name: name.to_owned(),
+                            guid: Guid::from(guid),
+                        };
+                        assert_eq!(variables.writes_to(&key), [], "{case}: writes to {name}");
+                    }
+                }
+            }
         }
-        assert_eq!(boot_services.reads(), [], "BootServices: reads");
     }
 
-    /// Through variables that reach Runtime, the variables that the ops from the FORM_SET op of a
-    /// FormSet without its Scope bit to the next FORM_SET op declare, past its End too, are withheld
-    /// whole, as edk2 parses a PASSWORD there into that FormSet; a question on a variable that the
-    /// next FormSet declares reads. Through variables that reach BootServices, get refuses.
+    /// set writes the stored matches, then asks each driver that holds a match, in order, and
+    /// stops at the first one that refuses, as at a failed variable write: its refusal names the
+    /// stores written and applied before it and those not attempted after it.
     #[test]
-    fn variables_past_the_end_of_a_scopeless_form_set_are_withheld() {
-        const OTHER_STORE_GUID: [u8; 16] = [0x5B; 16];
-        let other_key = VariableKey {
-            name: "UefisettingsOther".to_string(),
-            guid: Guid::from(OTHER_STORE_GUID),
-        };
-        let ifr = [
-            // which uefisettings ends at the End of form 1
-            scopeless_form_set(&[
-                form(1, &[]),
-                dropped_password_var_store(),
-                form(2, &[password_on(2, 2, 1, 0)]),
-            ]),
-            form_set_with_guid(
-                [0x22; 16],
-                &[
-                    dropped_password_var_store(),
-                    var_store_efi_of(2, OTHER_STORE_GUID, "UefisettingsOther", NV_BS_RT, 20),
-                    form(1, &[checkbox_on(1, 1, 1), checkbox_on(3, 3, 2)]),
-                ],
-            ),
+    fn set_stops_at_the_first_driver_that_refuses() {
+        let applying: Guid = "8C78A505-BAA0-4C4A-869F-000000001A11"
+            .parse()
+            .expect("a GUID");
+        let refusing: Guid = "8C78A505-BAA0-4C4A-869F-000000001A12"
+            .parse()
+            .expect("a GUID");
+        // the list of driver_held_hiidb whose driver holds Q
+        let held = Guid::from([0x66; 16]);
+        let hiidb = [
+            storageless_checkbox_list(applying.into(), 7, 0x04),
+            storageless_checkbox_list(refusing.into(), 8, 0x04),
+            driver_held_hiidb(),
         ]
         .concat();
-        let hiidb = three_questions_hiidb(&ifr);
-        let variables_of = |reach, interface| {
-            let variables = MemoryVariables::new(reach, interface);
-            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-            variables.insert(other_key.clone(), NV_BS_RT, &[0xAA; 20]);
-            Rc::new(variables)
+        let driver = RecordingDriver {
+            refused_set: Some(8),
+            ..RecordingDriver::default()
         };
+        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+        variables.insert(setup(), NV_BS_RT, &[0]);
+        let variables = Rc::new(variables);
 
-        let boot_services = variables_of(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
-        assert!(
-            got.as_ref()
-                .is_err_and(|error| error.starts_with(&three_questions_refusal())),
-            "BootServices: get Q3: {got:?}"
+        let got = HiiBackend::set_in(
+            &hiidb,
+            "Q",
+            &SetValue::Text("1".to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: Some(&driver),
+            },
+            None,
         );
-        assert_eq!(boot_services.reads(), [], "BootServices: reads");
 
-        let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
         assert_eq!(
-            answers_or_error_of(&hiidb, "Q1", &runtime),
-            Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]),
-            "Runtime: get Q1"
+            got.map(drop).map_err(|error| error.to_string()),
+            Err(format!(
+                "question \"Q\" was not set everywhere: cannot set question \"Q\": the driver \
+                 refused QuestionId 8 (in {refusing} (its driver)); written in: \
+                 55555555-5555-5555-5555-555555555555 (EFI variable {}), {applying} (its \
+                 driver); not attempted: {held} (its driver)",
+                setup()
+            )),
+            "the refusal"
         );
         assert_eq!(
-            answers_or_error_of(&hiidb, "Q3", &runtime),
-            Ok(vec!["1".to_string()]),
-            "Runtime: get Q3"
+            *driver.sets.borrow(),
+            [(7, 1), (8, 1)],
+            "the drivers asked, in order, up to the refusing one"
+        );
+        assert_eq!(
+            variables.writes_to(&setup()),
+            [(0, vec![1])],
+            "Setup written"
         );
-        assert_eq!(runtime.reads(), [(other_key, 20)], "Runtime: reads");
     }
 
-    /// Through variables that reach Runtime, every variable of the GUID of a VARSTORE_EFI of the
-    /// form before UEFI 2.3.1 in a FormSet that uefisettings ignores is withheld whole, as the
-    /// VarName of a PASSWORD on it, which is not read, names its variable by any string: a
-    /// question on another variable of that GUID shows none, one on a variable of another GUID
-    /// reads. Every variable is withheld where the Guid of that VARSTORE_EFI runs past the form
-    /// package, so is unknown. Through variables that reach BootServices, get refuses.
+    /// set of one question, whose driver refuses it, fails with that refusal alone, as set of
+    /// one stored question fails with its write's error.
     #[test]
-    fn every_variable_of_a_short_var_store_in_ignored_ifr_is_withheld() {
-        let short_store_variable = VariableKey {
-            name: "UefisettingsShort".to_string(),
-            guid: Guid::from(SHORT_VAR_STORE_GUID),
+    fn set_of_one_driver_held_question_fails_with_its_refusal() {
+        let hiidb = storageless_checkbox_list([0x77; 16], 8, 0x04);
+        let driver = RecordingDriver {
+            refused_set: Some(8),
+            ..RecordingDriver::default()
         };
-        let parsed = form_set(&[
-            var_store_efi_of(1, SHORT_VAR_STORE_GUID, "UefisettingsShort", NV_BS_RT, 20),
-            var_store_efi_of(
-                2,
-                DROPPED_PASSWORD_STORE_GUID,
-                "UefisettingsTest",
-                NV_BS_RT,
-                20,
-            ),
-            form(1, &[checkbox_on(1, 1, 1), checkbox_on(3, 3, 2)]),
-        ]);
-        // VarName 2, "Password"
-        let password = form(1, &[password_on(2, 2, 1, 2)]);
-        let withheld = Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
-        let cases = [
-            (
-                "a short CHECKBOX outside its forms",
-                [
-                    form_set_with_guid(
-                        [0x44; 16],
-                        &[
-                            short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                            password.clone(),
-                            operation(CHECKBOX, false, &[0x00; 4]),
-                        ],
-                    ),
-                    parsed.clone(),
-                ]
-                .concat(),
-                Ok(vec!["1".to_string()]),
-                vec![(dropped_password_store(), 20)],
+        let variables = Rc::new(MemoryVariables::new(
+            VariableReach::Runtime,
+            VariableInterface::Efivarfs,
+        ));
+
+        let got = HiiBackend::set_in(
+            &hiidb,
+            "Q",
+            &SetValue::Text("1".to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: Some(&driver),
+            },
+            None,
+        );
+
+        assert_eq!(
+            got.map(drop).map_err(|error| error.to_string()),
+            Err("cannot set question \"Q\": the driver refused QuestionId 8".to_string()),
+            "the refusal"
+        );
+        assert_eq!(*driver.sets.borrow(), [(8, 1)], "the driver asked");
+    }
+
+    /// get of a question whose driver fails get fails with that error, as where driver code
+    /// changed password bytes.
+    #[test]
+    fn get_of_a_driver_held_question_fails_with_its_driver_s_error() {
+        let hiidb = storageless_checkbox_list([0x77; 16], 8, 0x04);
+        let driver = RecordingDriver {
+            refused_get: Some(8),
+            ..RecordingDriver::default()
+        };
+        let variables = Rc::new(MemoryVariables::new(
+            VariableReach::Runtime,
+            VariableInterface::Efivarfs,
+        ));
+
+        let got = HiiBackend::get_in(
+            &hiidb,
+            "Q",
+            None,
+            &GetOptions::default(),
+            shared(&variables),
+            None,
+            None,
+            Some(&driver),
+        );
+
+        assert_eq!(
+            got.map(drop).map_err(|error| error.to_string()),
+            Err("cannot get question \"Q\"".to_string()),
+            "the error"
+        );
+        assert_eq!(*driver.gets.borrow(), [8], "the driver asked");
+    }
+
+    /// set answers each match that a driver holds with that driver's own annotation, in the order
+    /// of the matches, among the stored ones.
+    #[test]
+    fn each_driver_held_answer_carries_its_own_driver_s_annotation() {
+        let hiidb = [
+            storageless_checkbox_list([0x77; 16], 8, 0x04),
+            driver_held_hiidb(),
+            storageless_checkbox_list([0x88; 16], 9, 0x04),
+        ]
+        .concat();
+        let driver = RecordingDriver::default();
+        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+        variables.insert(setup(), NV_BS_RT, &[0]);
+        let variables = Rc::new(variables);
+
+        let got = set_responses(
+            &hiidb,
+            "Q",
+            &SetValue::Text("1".to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: Some(&driver),
+            },
+            None,
+        );
+
+        assert_eq!(
+            got.map(|set| {
+                set.responses
+                    .into_iter()
+                    .map(|response| response.question.answer)
+                    .collect::<Vec<_>>()
+            })
+            .map_err(|error| error.to_string()),
+            Ok(vec![
+                "1 <set by the driver of QuestionId 8>".to_owned(),
+                "1 <set by the driver of QuestionId 7>".to_owned(),
+                "1".to_owned(),
+                "1 <set by the driver of QuestionId 9>".to_owned(),
+            ]),
+            "the answers, in the order of the matches"
+        );
+        assert_eq!(
+            *driver.sets.borrow(),
+            [(8, 1), (7, 1), (9, 1)],
+            "the drivers asked, in order"
+        );
+    }
+
+    /// set names a question that it stages for the next boot, in its errors, by its package list
+    /// followed by `(staged for the next boot)`.
+    #[cfg(any(target_os = "linux", target_os = "windows"))]
+    #[test]
+    fn a_staged_question_s_store_is_named_staged_for_the_next_boot() {
+        let parsed = package::read_db(&storageless_checkbox_list([0x77; 16], 7, 0x04))
+            .expect("parse the HiiDB");
+        let staging =
+            crate::staged_set::next_boot::NextBootStaging::of(&SetOptions::default(), &parsed);
+        let (selected, _) = select_for_set(
+            &parsed,
+            &QuestionSelector::from("Q"),
+            &BTreeSet::from(["Q".to_string()]),
+            &SetOptions::default(),
+            &[],
+            &mut PendingOperations::new(UnsafeOperations::Refuse),
+            &mut EfivarReader::with_variables(Box::new(MemoryVariables::default())),
+            Some(&staging),
+        )
+        .expect("select Q");
+        let [question] = selected.as_slice() else {
+            panic!("one match of Q, not {}", selected.len());
+        };
+        let driver_held = question
+            .descriptor
+            .driver_held()
+            .expect("held by its driver");
+        let store = DriverHeldSet {
+            selected: question,
+            held: &staging,
+            driver_held,
+            value: 1,
+        };
+
+        assert_eq!(
+            store.label(),
+            format!("{} (staged for the next boot)", question.guid),
+            "the label of Q's store"
+        );
+    }
+
+    /// set refuses before any write when a driver-held match would be refused before its driver,
+    /// also when a stored match comes first.
+    #[test]
+    fn set_checks_every_driver_held_match_before_the_first_write() {
+        let hiidb = [
+            storageless_checkbox_list([0x77; 16], 8, 0x04),
+            driver_held_hiidb(),
+        ]
+        .concat();
+        let driver = RecordingDriver {
+            refused_check: Some(8),
+            ..RecordingDriver::default()
+        };
+        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+        variables.insert(setup(), NV_BS_RT, &[0]);
+        let variables = Rc::new(variables);
+
+        let got = HiiBackend::set_in(
+            &hiidb,
+            "Q",
+            &SetValue::Text("1".to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: Some(&driver),
+            },
+            None,
+        );
+
+        assert_eq!(
+            got.map(drop).map_err(|error| error.to_string()),
+            Err("cannot set question \"Q\": the driver is unreachable".to_string()),
+            "the refusal"
+        );
+        assert!(driver.sets.borrow().is_empty(), "no driver asked to set");
+        assert!(variables.writes_to(&setup()).is_empty(), "Setup unwritten");
+    }
+
+    /// In a HiiDB that declares a setup password question, set from an OS stages a question that
+    /// its driver holds only with --i-am-fine-to-brick-this-system, which lifts
+    /// UnsafeOperation::StagedSetupPassword, as the next boot applies it where no setup browser
+    /// asks for the password, and no other option lifts it; set of a stored one from an OS
+    /// writes as before, the flag lifting nothing, and in the UEFI Shell with the flag, lifting
+    /// UnsafeOperation::SetupPassword.
+    #[test]
+    fn set_from_an_os_stages_beside_a_setup_password_question_only_with_the_flag() {
+        let callback = package_list_with_guid(
+            [0x66; 16],
+            &[
+                form_package(&[form(1, &[callback_checkbox(7, 1)])]),
+                en_strings_package_of(&["Q"]),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
+        );
+        let through_driver = || {
+            vec![
+                "1 <set by the driver of QuestionId 7>".to_owned(),
+                "1".to_owned(),
+            ]
+        };
+        let granting = |unsafe_operations| SetOptions {
+            unsafe_operations,
+            ..SetOptions::default()
+        };
+        let cases = [
+            (
+                "from an OS",
+                [callback.clone(), password_hiidb()].concat(),
+                VariableReach::Runtime,
+                granting(UnsafeOperations::Refuse),
+                Err(STAGED_PASSWORD_REFUSAL.to_owned()),
+                Vec::new(),
             ),
             (
-                "a VARSTORE_EFI that ends after its VarStoreId, last",
-                [
-                    parsed,
-                    form_set_with_guid(
-                        [0x44; 16],
-                        &[
-                            password,
-                            operation(VAR_STORE_EFI, false, &1u16.to_le_bytes()),
-                        ],
-                    ),
-                ]
-                .concat(),
-                withheld.clone(),
-                vec![],
+                "from an OS, with every other option",
+                [callback.clone(), password_hiidb()].concat(),
+                VariableReach::Runtime,
+                SetOptions {
+                    include: IncludedStates::all(),
+                    assume_var_stores: statements(&[
+                        "Setup-00000000-0000-0000-0000-000000000000=00",
+                    ]),
+                    volatile: VolatileWrites::Allow,
+                    language: Some("en-US".to_owned()),
+                    staging_image: Some(PathBuf::from("uefisettings.efi")),
+                    ..granting(UnsafeOperations::Refuse)
+                },
+                Err(STAGED_PASSWORD_REFUSAL.to_owned()),
+                Vec::new(),
+            ),
+            (
+                "from an OS, allowed",
+                [callback.clone(), password_hiidb()].concat(),
+                VariableReach::Runtime,
+                granting(UnsafeOperations::Allow),
+                Ok((through_driver(), vec![UnsafeOperation::StagedSetupPassword])),
+                vec![(7, 1)],
+            ),
+            (
+                "from an OS, without a question that its driver holds",
+                password_hiidb(),
+                VariableReach::Runtime,
+                granting(UnsafeOperations::Refuse),
+                Ok((vec!["1".to_owned()], Vec::new())),
+                Vec::new(),
+            ),
+            (
+                "from an OS, allowed, without a question that its driver holds",
+                password_hiidb(),
+                VariableReach::Runtime,
+                granting(UnsafeOperations::Allow),
+                Ok((vec!["1".to_owned()], Vec::new())),
+                Vec::new(),
+            ),
+            (
+                "in the UEFI Shell, allowed",
+                [callback, password_hiidb()].concat(),
+                VariableReach::BootServices,
+                granting(UnsafeOperations::Allow),
+                Ok((through_driver(), vec![UnsafeOperation::SetupPassword])),
+                vec![(7, 1)],
             ),
         ];
-        for (case, ifr, q3, reads) in cases {
-            let hiidb = three_questions_hiidb(&ifr);
-            let variables_of = |reach, interface| {
-                let variables = MemoryVariables::new(reach, interface);
-                variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-                variables.insert(short_store_variable.clone(), NV_BS_RT, &[0xAA; 20]);
-                Rc::new(variables)
-            };
+        for (case, hiidb, reach, options, want, sets) in cases {
+            let driver = RecordingDriver::default();
+            let variables = password_variables(reach, VariableInterface::VariableServices);
 
-            let boot_services = variables_of(
-                VariableReach::BootServices,
-                VariableInterface::VariableServices,
-            );
-            let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
-            assert!(
-                got.as_ref()
-                    .is_err_and(|error| error.starts_with(&three_questions_refusal())),
-                "{case}: BootServices: get Q3: {got:?}"
+            let set = HiiBackend::set_in(
+                &hiidb,
+                "Q",
+                &SetValue::Text("1".to_owned()),
+                None,
+                &options,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: Some(&driver),
+                },
+                None,
             );
-            assert_eq!(boot_services.reads(), [], "{case}: BootServices: reads");
 
-            let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
             assert_eq!(
-                answers_or_error_of(&hiidb, "Q1", &runtime),
-                withheld,
-                "{case}: Runtime: get Q1"
+                set.map(|(set, lifted)| {
+                    let answers = set
+                        .responses
+                        .into_iter()
+                        .map(|response| response.question.answer)
+                        .collect::<Vec<_>>();
+                    (answers, lifted)
+                })
+                .map_err(|error| format!("{error:#}")),
+                want,
+                "{case}"
             );
+            assert_eq!(*driver.sets.borrow(), sets, "{case}: the driver's sets");
             assert_eq!(
-                answers_or_error_of(&hiidb, "Q3", &runtime),
-                q3,
-                "{case}: Runtime: get Q3"
+                variables.writes_to(&setup()).is_empty(),
+                want.is_err(),
+                "{case}: Setup written unless refused"
             );
-            assert_eq!(runtime.reads(), reads, "{case}: Runtime: reads");
         }
     }
 
-    /// By QuestionId, a question of a disabled form or of an ignored FormSet is refused as by its
-    /// prompt: get answers none and lists the same records, and set's MaybeInIgnoredIfr names
-    /// them.
+    /// Through variables that reach BootServices, a HiiDB with a PASSWORD op whose VarStore is
+    /// unknown has get, list-questions, show-ifr and set read and write no variable, even with
+    /// UnsafeOperations::Allow, which lifts no refusal that would disclose a password; through
+    /// those that reach Runtime they work, as before.
     #[test]
-    fn question_ids_in_ignored_ifr_are_refused_as_prompts() {
-        let (disabled_form, _) = disabled_form_hiidb(operation(CHECKBOX, false, &[0x00; 4]));
-        let ignored_form_set = three_questions_hiidb(
-            &[
-                form_set(&[
-                    dropped_password_var_store(),
-                    form(1, &[checkbox_on(1, 1, 1)]),
-                ]),
-                form_set_with_guid(
-                    [0x33; 16],
+    fn unresolved_password_closes_every_variable_to_boot_services() {
+        // VarStoreId 9 of the VARSTORE AMITSESetup that another FormSet of the form package
+        // declares, which the Forms Browser of edk2-stable202608 does not find for the PASSWORD
+        // (SetupBrowserDxe/IfrParse.c:136-148), while FindStorageFromVarId of its
+        // HiiDatabaseDxe/ConfigKeywordHandler.c does (:1520-1569)
+        let hiidb = {
+            let packages = [
+                form_package_of(
                     &[
-                        dropped_password_var_store(),
-                        form(1, &[checkbox_on(3, 3, 1)]),
-                        short_var_store(),
-                    ],
+                        form_set_with_guid(
+                            [0x11; 16],
+                            &[
+                                var_store_efi(1, "Setup", NV_BS_RT, 1),
+                                var_store(2, [0x44; 16], "AMITSESetup", 81),
+                                form(
+                                    1,
+                                    &[
+                                        checkbox_on(1, 1, 1),
+                                        password_on(3, 3, 9, 0),
+                                        checkbox_at(2, 2, 2, 80),
+                                    ],
+                                ),
+                            ],
+                        ),
+                        form_set_with_guid(
+                            [0x13; 16],
+                            &[var_store(9, [0x44; 16], "AMITSESetup", 81), form(3, &[])],
+                        ),
+                    ]
+                    .concat(),
                 ),
-            ]
-            .concat(),
-        );
-        let options = SetOptions {
-            unsafe_operations: UnsafeOperations::Allow,
-            ..SetOptions::default()
+                en_strings_package_of(&["Q", "P", "Password"]),
+                END_PACKAGE.to_vec(),
+            ];
+            package_list_with_guid([0x55; 16], &packages.concat())
         };
-        let cases = [
-            ("a disabled form", disabled_form, "Q2", [0x11; 16], 2),
-            ("an ignored FormSet", ignored_form_set, "Q3", [0x33; 16], 3),
-        ];
-        for (case, hiidb, prompt, form_set, question_id) in cases {
-            let refusals = [
-                QuestionSelector::from(prompt),
-                by_address(&format!("{}:{question_id}", Guid::from(form_set))),
-            ]
-            .map(|question| {
-                let variables =
-                    disabled_form_variables(VariableReach::Runtime, VariableInterface::Efivarfs);
-                let got = HiiBackend::get_in(
-                    &hiidb,
-                    question.clone(),
+        let closed = "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: \
+                      no supported varstore with matching id 0x0009 found; as the variable of \
+                      that password is unknown, the UEFI Shell build reads and writes no variable \
+                      of this HiiDB";
+        let set = |variables: &Rc<MemoryVariables>, unsafe_operations| {
+            let options = SetOptions {
+                unsafe_operations,
+                ..SetOptions::default()
+            };
+            set_responses(
+                &hiidb,
+                "Q",
+                &SetValue::Text("1".to_owned()),
+                None,
+                &options,
+                SetAccess {
+                    reads: shared(variables),
+                    writes: &**variables,
+                    held: None,
+                },
+                None,
+            )
+            .map(drop)
+            .map_err(|error| error.to_string())
+        };
+
+        let variables = password_variables(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        let got = HiiBackend::get_in(
+            &hiidb,
+            "Q",
+            None,
+            &GetOptions::default(),
+            shared(&variables),
+            None,
+            None,
+            None,
+        );
+        let listed = HiiBackend::list_questions_in(
+            &hiidb,
+            &ListQuestionsOptions::default(),
+            shared(&variables),
+            None,
+            None,
+        );
+        let shown = HiiBackend::show_ifr_in(
+            &hiidb,
+            &ShowIfrOptions::default(),
+            shared(&variables),
+            None,
+            None,
+        );
+        assert_eq!(
+            got.map(drop).map_err(|error| error.to_string()),
+            Err(closed.to_string()),
+            "BootServices: get"
+        );
+        assert_eq!(
+            listed.map(drop).map_err(|error| error.to_string()),
+            Err(closed.to_string()),
+            "BootServices: list-questions"
+        );
+        assert_eq!(
+            shown.map(drop).map_err(|error| error.to_string()),
+            Err(closed.to_string()),
+            "BootServices: show-ifr"
+        );
+        assert_eq!(
+            set(&variables, UnsafeOperations::Refuse),
+            Err(closed.to_string()),
+            "BootServices: set"
+        );
+        assert_eq!(
+            set(&variables, UnsafeOperations::Allow),
+            Err(closed.to_string()),
+            "BootServices: set with UnsafeOperations::Allow"
+        );
+        assert_eq!(variables.reads(), [], "BootServices: reads");
+        assert_eq!(variables.writes_to(&setup()), [], "BootServices: writes");
+
+        let variables = password_variables(VariableReach::Runtime, VariableInterface::Efivarfs);
+        let got = HiiBackend::get_in(
+            &hiidb,
+            "Q",
+            None,
+            &GetOptions::default(),
+            shared(&variables),
+            None,
+            None,
+            None,
+        )
+        .expect("get through Runtime");
+        let answers: Vec<&str> = got
+            .responses
+            .iter()
+            .map(|response| response.question.answer.as_str())
+            .collect();
+        assert_eq!(answers, ["0"], "Runtime: get");
+        assert_eq!(
+            set(&variables, UnsafeOperations::Refuse),
+            Ok(()),
+            "Runtime: set"
+        );
+        assert_eq!(
+            variables.writes_to(&setup()),
+            [(0, vec![1])],
+            "Runtime: writes"
+        );
+    }
+
+    /// The Guid of dropped_password_store, as stored.
+    const DROPPED_PASSWORD_STORE_GUID: [u8; 16] = [0x88; 16];
+
+    /// The GUID of the package list of dropped_password_hiidb, as stored.
+    const DROPPED_PASSWORD_LIST_GUID: [u8; 16] = [0x99; 16];
+
+    /// The EFI variable that both FormSets of dropped_password_hiidb name.
+    fn dropped_password_store() -> VariableKey {
+        VariableKey {
+            name: "UefisettingsTest".to_string(),
+            guid: Guid::from(DROPPED_PASSWORD_STORE_GUID),
+        }
+    }
+
+    /// The VARSTORE_EFI of dropped_password_store, VarStore 1.
+    fn dropped_password_var_store() -> Vec<u8> {
+        var_store_efi_of(
+            1,
+            DROPPED_PASSWORD_STORE_GUID,
+            "UefisettingsTest",
+            NV_BS_RT,
+            20,
+        )
+    }
+
+    /// The Guid of the variable of ignored_form_set_var_store, as stored.
+    const IGNORED_FORM_SET_STORE_GUID: [u8; 16] = [0x7A; 16];
+
+    /// The VARSTORE_EFI, VarStore 2, of a variable apart from dropped_password_store, for a
+    /// FormSet that uefisettings ignores beside questions on dropped_password_store that read:
+    /// each variable that an ignored FormSet declares is withheld whole, and a PASSWORD there is
+    /// withheld in each VarStore of its VarStoreId in the form package too.
+    fn ignored_form_set_var_store() -> Vec<u8> {
+        var_store_efi_of(
+            2,
+            IGNORED_FORM_SET_STORE_GUID,
+            "UefisettingsIgnored",
+            NV_BS_RT,
+            20,
+        )
+    }
+
+    /// The first FormSet of dropped_password_hiidb, with the CHECKBOX Q at byte 0 of
+    /// dropped_password_store.
+    fn dropped_password_first_form_set() -> Vec<u8> {
+        form_set(&[
+            dropped_password_var_store(),
+            form(1, &[checkbox_on(1, 1, 1)]),
+        ])
+    }
+
+    /// The ops of a second FormSet of dropped_password_hiidb: a form, a form with a PASSWORD at
+    /// byte 0 of dropped_password_store, and then `tail`, outside its forms.
+    fn dropped_password_second_ops(tail: Vec<u8>) -> [Vec<u8>; 4] {
+        [
+            dropped_password_var_store(),
+            form(1, &[]),
+            form(2, &[password_on(2, 2, 1, 0)]),
+            tail,
+        ]
+    }
+
+    /// A HiiDB of one package list holding dropped_password_first_form_set, the ops `between`
+    /// and then the FormSet `second`.
+    fn dropped_password_hiidb(between: Vec<u8>, second: Vec<u8>) -> Vec<u8> {
+        let first = dropped_password_first_form_set();
+        let packages = [
+            form_package_of(&[first, between, second].concat()),
+            en_strings_package_of(&["Q", "Password"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid(DROPPED_PASSWORD_LIST_GUID, &packages.concat())
+    }
+
+    /// A HiiDB of two FormSets with dropped_password_store of 60 bytes, each 0x01, and these
+    /// CHECKBOXes on it: in the first, Q1 at byte 50 in form 1, Q2 at byte 52 then `ops` in form
+    /// 2, and Q3 at byte 51 in form 3; in the second, O at byte 10; and the offset of form 2 in
+    /// its form package.
+    fn disabled_form_hiidb(ops: Vec<u8>) -> (Vec<u8>, usize) {
+        let store = var_store_efi_of(
+            1,
+            DROPPED_PASSWORD_STORE_GUID,
+            "UefisettingsTest",
+            NV_BS_RT,
+            60,
+        );
+        let first = [store.clone(), form(1, &[checkbox_at(1, 1, 1, 50)])];
+        let ifr = [
+            form_set(&[
+                first[0].clone(),
+                first[1].clone(),
+                form(2, &[checkbox_at(2, 2, 1, 52), ops]),
+                form(3, &[checkbox_at(3, 3, 1, 51)]),
+            ]),
+            form_set(&[store, form(1, &[checkbox_at(5, 5, 1, 10)])]),
+        ]
+        .concat();
+        let packages = [
+            form_package_of(&ifr),
+            en_strings_package_of(&["Q1", "Q2", "Q3", "Password", "O"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid(DROPPED_PASSWORD_LIST_GUID, &packages.concat());
+        (hiidb, form_set(&first).len() - END.len())
+    }
+
+    /// The variables of disabled_form_hiidb, of `reach` through `interface`.
+    fn disabled_form_variables(
+        reach: VariableReach,
+        interface: VariableInterface,
+    ) -> Rc<MemoryVariables> {
+        let variables = MemoryVariables::new(reach, interface);
+        variables.insert(dropped_password_store(), NV_BS_RT, &[0x01; 60]);
+        Rc::new(variables)
+    }
+
+    /// A form that a malformed op disables is dropped (UEFI 2.11 §33.2.5.10.1): through variables
+    /// of either reach, get and list-questions read the questions of the forms beside it, not its
+    /// own, and list its record, which show-ifr prints and set's refusal of its question names;
+    /// its PASSWORD stays known, so O, over that password's bytes, reads no value. Where the
+    /// FormSet of that form was ignored, variables that reach Runtime withheld none of them.
+    #[test]
+    fn a_disabled_form_is_dropped_and_its_password_withheld() {
+        let (hiidb, offset) = disabled_form_hiidb(
+            [
+                password_on(4, 4, 1, 0),
+                operation(CHECKBOX, false, &[0x00; 4]),
+            ]
+            .concat(),
+        );
+        let record = format!(
+            "the form 2 of the FormSet {}, whose EFI_IFR_CHECKBOX op is malformed; UEFI 2.11 \
+             §33.2.5.10.1 disables the form of a malformed op: the EFI_IFR_CHECKBOX op at offset ",
+            Guid::from([0x11; 16])
+        );
+        let list = Guid::from(DROPPED_PASSWORD_LIST_GUID).to_string();
+        let records_of = |ignored: Option<Vec<HiiIgnoredIfr>>| -> Vec<(String, i64, bool)> {
+            ignored
+                .unwrap_or_default()
+                .into_iter()
+                .map(|ignored| {
+                    (
+                        ignored.package_list,
+                        ignored.offset,
+                        ignored.reason.starts_with(&record),
+                    )
+                })
+                .collect()
+        };
+        let want_records = vec![(list, i64::try_from(offset).expect("offset"), true)];
+        for (reach, interface) in [
+            (VariableReach::Runtime, VariableInterface::Efivarfs),
+            (
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            ),
+        ] {
+            let variables = disabled_form_variables(reach, interface);
+            for (question, want) in [
+                ("O", vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]),
+                ("Q1", vec!["1".to_string()]),
+                ("Q2", vec![]),
+                ("Q3", vec!["1".to_string()]),
+            ] {
+                let got = HiiBackend::get_in(
+                    &hiidb,
+                    question,
+                    None,
+                    &GetOptions::default(),
+                    shared(&variables),
+                    None,
+                    None,
+                    None,
+                )
+                .unwrap_or_else(|error| panic!("{reach:?}: get {question}: {error:#}"));
+                let answers: Vec<String> = got
+                    .responses
+                    .into_iter()
+                    .map(|response| response.question.answer)
+                    .collect();
+                assert_eq!(answers, want, "{reach:?}: get {question}");
+                assert_eq!(
+                    records_of(got.ignored_ifr),
+                    want_records,
+                    "{reach:?}: get {question}: ignored_ifr"
+                );
+            }
+            let (listed, records) = HiiBackend::list_questions_and_ignored_ifr_in(
+                &hiidb,
+                &ListQuestionsOptions::default(),
+                shared(&variables),
+                None,
+                None,
+            )
+            .unwrap_or_else(|error| panic!("{reach:?}: list-questions: {error:#}"));
+            let names: Vec<String> = listed.into_iter().map(|question| question.name).collect();
+            let records: Vec<(u64, bool)> = records
+                .iter()
+                .map(|ignored| (ignored.offset, ignored.reason.starts_with(&record)))
+                .collect();
+            assert_eq!(
+                (names, records),
+                (
+                    vec!["Q1".to_string(), "Q3".to_string(), "O".to_string()],
+                    vec![(u64::try_from(offset).expect("offset"), true)]
+                ),
+                "{reach:?}: list-questions"
+            );
+            let set = set_bypassing(&hiidb, "Q2", "0", &variables);
+            assert!(
+                set.as_ref()
+                    .is_err_and(|error| error.contains(&format!("offset {offset}"))
+                        && error.contains(&record)),
+                "{reach:?}: set Q2: {set:?}"
+            );
+            assert_eq!(
+                variables.writes_to(&dropped_password_store()),
+                [],
+                "{reach:?}: writes"
+            );
+        }
+
+        let shown = HiiBackend::show_ifr_using(
+            &hiidb,
+            &ShowIfrOptions {
+                efivars: EfivarSource::Disabled,
+                ..Default::default()
+            },
+        )
+        .expect("show-ifr")
+        .readable_representation;
+        assert!(
+            shown.contains(&format!("Disabled at offset {offset}: {record}")),
+            "show-ifr: {shown}"
+        );
+    }
+
+    /// A PASSWORD op of a disabled form without its question header is unresolved: edk2 reads
+    /// that header from the bytes after the op, here those of its form's End and the next FORM,
+    /// QuestionId 0x0229 and VarStoreId 0x8601, which no VarStore declares, so its password may be
+    /// in any variable: through variables of either reach, get reads no variable.
+    #[test]
+    fn a_headless_password_in_a_disabled_form_closes_every_variable() {
+        let (hiidb, _) = disabled_form_hiidb(operation(PASSWORD, false, &[3, 0, 4, 0]));
+
+        let boot_services = disabled_form_variables(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        let want = format!(
+            "PASSWORD question 0x0229 in FormSet {}: its op ends before its question header",
+            Guid::from([0x11; 16])
+        );
+        for question in ["Q1", "Q3"] {
+            let got = HiiBackend::get_in(
+                &hiidb,
+                question,
+                None,
+                &GetOptions::default(),
+                shared(&boot_services),
+                None,
+                None,
+                None,
+            )
+            .map(drop)
+            .map_err(|error| error.to_string());
+            assert!(
+                got.as_ref().is_err_and(|error| error.starts_with(&want)),
+                "BootServices: get {question}: {got:?}"
+            );
+        }
+        assert_eq!(boot_services.reads(), [], "BootServices: reads");
+
+        let runtime = disabled_form_variables(VariableReach::Runtime, VariableInterface::Efivarfs);
+        for question in ["Q1", "Q3", "O"] {
+            let got = HiiBackend::get_in(
+                &hiidb,
+                question,
+                None,
+                &GetOptions::default(),
+                shared(&runtime),
+                None,
+                None,
+                None,
+            )
+            .map(drop)
+            .map_err(|error| error.to_string());
+            assert!(
+                got.as_ref()
+                    .is_err_and(|error| error.starts_with(&want) && error.ends_with(ANY_VARIABLE)),
+                "Runtime: get {question}: {got:?}"
+            );
+        }
+        assert_eq!(runtime.reads(), [], "Runtime: reads");
+    }
+
+    /// The variables of password_store_hiidb, of `reach`, each byte 0x01.
+    fn password_store_variables(reach: VariableReach) -> Rc<MemoryVariables> {
+        let interface = match reach {
+            VariableReach::Runtime => VariableInterface::Efivarfs,
+            VariableReach::BootServices => VariableInterface::VariableServices,
+        };
+        let variables = MemoryVariables::new(reach, interface);
+        variables.insert(password_store(), NV_BS_RT, &[0x01; 60]);
+        variables.insert(other_store(), NV_BS_RT, &[0x01]);
+        Rc::new(variables)
+    }
+
+    /// A PASSWORD op that ends after its question header and MinSize disables its form (UEFI 2.11
+    /// §33.2.5.10.1) but still names its VarStore and VarOffset: through variables that reach
+    /// Runtime, every byte of its variable from there on is withheld, so O, over its first byte,
+    /// and Q1, past it, read no value, while Q2, before it, and Q3, on another variable, read;
+    /// through variables that reach BootServices it is unresolved, so get reads no variable. The
+    /// whole PASSWORD withholds its 40 bytes alone.
+    #[test]
+    fn a_password_without_max_size_withholds_its_variable_from_its_var_offset_on() {
+        let without_max_size = operation(
+            PASSWORD,
+            false,
+            &[
+                question_header_with(4, 4, 1, 10, 0x00),
+                1u16.to_le_bytes().to_vec(), // MinSize
+            ]
+            .concat(),
+        );
+        let read = || Ok(vec!["1".to_string()]);
+        let withheld = || Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
+        // each with what Runtime get of Q1 answers, and the start of BootServices get's refusal
+        for (case, password, q1, refusal) in [
+            ("the whole PASSWORD", password_on(4, 4, 1, 10), read(), None),
+            (
+                "a PASSWORD without MaxSize",
+                without_max_size,
+                withheld(),
+                Some("PASSWORD question 0x0004 without MaxSize in FormSet "),
+            ),
+        ] {
+            let hiidb = password_store_hiidb(Vec::new(), password);
+
+            let runtime = password_store_variables(VariableReach::Runtime);
+            for (question, want) in [
+                ("O", withheld()),
+                ("Q1", q1.clone()),
+                ("Q2", read()),
+                ("Q3", read()),
+            ] {
+                assert_eq!(
+                    answers_or_error_of(&hiidb, question, &runtime),
+                    want,
+                    "{case}: Runtime: get {question}"
+                );
+            }
+
+            let boot_services = password_store_variables(VariableReach::BootServices);
+            let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
+            match refusal {
+                None => assert_eq!(got, read(), "{case}: BootServices: get Q3"),
+                Some(refusal) => {
+                    assert!(
+                        got.as_ref().is_err_and(|error| error.starts_with(refusal)),
+                        "{case}: BootServices: get Q3: {got:?}"
+                    );
+                    assert_eq!(boot_services.reads(), [], "{case}: BootServices: reads");
+                }
+            }
+        }
+    }
+
+    /// Each variable that a VARSTORE or VARSTORE_EFI op of a FormSet that uefisettings ignores
+    /// declares is withheld whole through variables that reach Runtime, as a PASSWORD in that
+    /// FormSet may name any of them: O and Q2, on the variable of its VarStore 1, read no
+    /// value and that variable is never read, while Q3, on another variable, reads; through
+    /// variables that reach BootServices get reads no variable.
+    #[test]
+    fn the_variables_that_an_ignored_form_set_declares_are_withheld_whole() {
+        // a DEFAULTSTORE op of 4 bytes, shorter than its minimum of 6, outside the forms
+        let short_default_store = operation(DEFAULT_STORE, false, &[0x00, 0x00]);
+        let hiidb = password_store_hiidb(short_default_store, password_on(4, 4, 1, 10));
+
+        let runtime = password_store_variables(VariableReach::Runtime);
+        let withheld = Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
+        for (question, want) in [
+            ("O", withheld.clone()),
+            ("Q2", withheld),
+            ("Q3", Ok(vec!["1".to_string()])),
+        ] {
+            assert_eq!(
+                answers_or_error_of(&hiidb, question, &runtime),
+                want,
+                "Runtime: get {question}"
+            );
+        }
+        assert_eq!(runtime.reads(), [(other_store(), 1)], "Runtime: reads");
+
+        let boot_services = password_store_variables(VariableReach::BootServices);
+        let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
+        assert!(
+            got.as_ref()
+                .is_err_and(|error| error.starts_with("PASSWORD questions of package list ")),
+            "BootServices: get Q3: {got:?}"
+        );
+        assert_eq!(boot_services.reads(), [], "BootServices: reads");
+    }
+
+    /// IFR past an op where the walk for FormSets ends has no op boundary, so a PASSWORD in it may
+    /// name any variable: through variables of either reach, get and list-questions read no
+    /// variable of the HiiDB and refuse, naming that IFR; list-questions and show-ifr without
+    /// efivars still list the questions of the FormSets that uefisettings reads.
+    #[test]
+    fn ifr_past_the_end_of_the_form_set_walk_closes_every_variable() {
+        let hiidb = password_past_the_walk_hiidb();
+        let want = format!(
+            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
+             offset 0 of a form package, which has no op boundary, so in any variable: an op that \
+             does not fit the form package, and the bytes after it: ",
+            Guid::from(PAST_THE_WALK_LIST_GUID)
+        );
+        for reach in [VariableReach::Runtime, VariableReach::BootServices] {
+            let variables = password_store_variables(reach);
+            for question in ["O", "Q3"] {
+                let got = answers_or_error_of(&hiidb, question, &variables);
+                assert!(
+                    got.as_ref().is_err_and(|error| error.starts_with(&want)),
+                    "{reach:?}: get {question}: {got:?}"
+                );
+            }
+            let listed = HiiBackend::list_questions_and_ignored_ifr_in(
+                &hiidb,
+                &ListQuestionsOptions::default(),
+                shared(&variables),
+                None,
+                None,
+            )
+            .map(drop)
+            .map_err(|error| error.to_string());
+            assert!(
+                listed.as_ref().is_err_and(|error| error.starts_with(&want)),
+                "{reach:?}: list-questions: {listed:?}"
+            );
+            assert_eq!(variables.reads(), [], "{reach:?}: reads");
+        }
+
+        let (listed, _) = HiiBackend::list_questions_and_ignored_ifr_in(
+            &hiidb,
+            &ListQuestionsOptions::default(),
+            EfivarSource::Disabled
+                .into_variables()
+                .expect("variables that read nothing"),
+            None,
+            None,
+        )
+        .expect("list-questions without efivars");
+        let names: Vec<String> = listed.into_iter().map(|question| question.name).collect();
+        assert_eq!(
+            names,
+            ["Q1", "O", "Q2", "Q3"],
+            "list-questions without efivars"
+        );
+        let shown = HiiBackend::show_ifr_using(
+            &hiidb,
+            &ShowIfrOptions {
+                efivars: EfivarSource::Disabled,
+                ..Default::default()
+            },
+        )
+        .expect("show-ifr without efivars")
+        .readable_representation;
+        assert!(shown.contains("Q3"), "show-ifr without efivars: {shown}");
+    }
+
+    /// Through variables that reach BootServices, a HiiDB whose form package holds IFR that
+    /// uefisettings ignores, a FormSet that does not parse or nests too deep, the ops after one
+    /// where its walk for FormSets ends or a FormSet without its Scope bit, whose second form edk2
+    /// parses into it, has get and set read and write no variable: a PASSWORD question in it
+    /// could name any variable. A HiiDB without that IFR withholds the PASSWORD's bytes as
+    /// before. Through variables that reach Runtime, the variables that an ignored FormSet or the
+    /// FormSet without its Scope bit declares are withheld whole, and the ops after an op where
+    /// the walk ends close every variable.
+    #[test]
+    fn ignored_ifr_closes_every_variable_to_boot_services() {
+        let offset = dropped_password_first_form_set().len();
+        let ignored = format!(
+            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
+             offset {offset} of a form package: ",
+            Guid::from(DROPPED_PASSWORD_LIST_GUID)
+        );
+        let second = "the FormSet 11111111-1111-1111-1111-111111111111";
+        let past_the_walk = format!(
+            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
+             offset {offset} of a form package, which has no op boundary, so in any variable: ",
+            Guid::from(DROPPED_PASSWORD_LIST_GUID)
+        );
+        let closed = "; as the variable of that password is unknown, the UEFI Shell build reads \
+                      and writes no variable of this HiiDB";
+        let refused = "; as a PASSWORD there may keep its password in any variable, uefisettings \
+                       reads and writes no variable of this HiiDB";
+        let withheld = Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
+        // a VARSTORE op that ends after 4 of the 20 bytes before its Name
+        let malformed = operation(VAR_STORE, false, &[0x00; 4]);
+        // the FormSet's own scope and these
+        let too_deep = nested(&subtitle_scope(5), MAX_SCOPE_NESTING, &[]);
+        // the Subtitle past the limit, after the second FormSet's other ops
+        let too_deep_at = offset + form_set(&dropped_password_second_ops(Vec::new())).len()
+            - END.len()
+            + (MAX_SCOPE_NESTING - 1) * subtitle_scope(5).len();
+        let dropped = [
+            (
+                "malformed",
+                Vec::new(),
+                form_set(&dropped_password_second_ops(malformed)),
+                format!(
+                    "{ignored}{second}, which holds, outside its forms, an op shorter than its \
+                     minimum, which UEFI 2.11 §33.2.5.10.1 calls malformed, in no form for that \
+                     section to disable: the EFI_IFR_VARSTORE op at offset "
+                ),
+                (withheld.clone(), &[][..]),
+            ),
+            (
+                "nested too deep",
+                Vec::new(),
+                form_set(&dropped_password_second_ops(too_deep)),
+                format!(
+                    "{ignored}{second}, which nests too deep: IFR scopes nest deeper than \
+                     {MAX_SCOPE_NESTING} at offset {too_deep_at} of a form package{closed}"
+                ),
+                (withheld.clone(), &[]),
+            ),
+            (
+                "an End op of Length 1 before it",
+                vec![0x29, 0x01],
+                form_set(&dropped_password_second_ops(Vec::new())),
+                format!(
+                    "{past_the_walk}an op that does not fit the form package, and the bytes after \
+                     it: invalid IFR operation length 1"
+                ),
+                (
+                    Err(format!(
+                        "{past_the_walk}an op that does not fit the form package, and the bytes \
+                         after it: invalid IFR operation length 1 at {offset:#x}{refused}"
+                    )),
+                    &[],
+                ),
+            ),
+            (
+                "without its Scope bit",
+                Vec::new(),
+                scopeless_form_set(&dropped_password_second_ops(Vec::new())),
+                format!(
+                    "{ignored}{second} opens no scope, so edk2 parses its ops on to the end of the \
+                     form package, past the End where uefisettings ends it (edk2-stable202211 \
+                     SetupBrowserDxe IfrParse.c ParseOpCodes pushes a scope only for Scope != 0, \
+                     and ends a FormSet only at the End of a FORM_SET scope){closed}"
+                ),
+                (withheld, &[]),
+            ),
+        ];
+        let get = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
+            HiiBackend::get_in(
+                hiidb,
+                "Q",
+                None,
+                &GetOptions::default(),
+                shared(variables),
+                None,
+                None,
+                None,
+            )
+            .map(|got| {
+                got.responses
+                    .iter()
+                    .map(|response| response.question.answer.clone())
+                    .collect::<Vec<_>>()
+            })
+        };
+        let set = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
+            set_responses(
+                hiidb,
+                "Q",
+                &SetValue::Text("0".to_owned()),
+                None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(variables),
+                    writes: &**variables,
+                    held: None,
+                },
+                None,
+            )
+            .map(drop)
+        };
+        let variables_of = |reach, interface| {
+            let variables = MemoryVariables::new(reach, interface);
+            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+            Rc::new(variables)
+        };
+
+        for (case, between, second_form_set, want, (runtime, reads)) in dropped {
+            let hiidb = dropped_password_hiidb(between, second_form_set);
+            let variables = variables_of(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            );
+            for (command, got) in [
+                (
+                    "get",
+                    get(&hiidb, &variables).map(|answers| format!("{answers:?}")),
+                ),
+                ("set", set(&hiidb, &variables).map(|()| String::new())),
+            ] {
+                let got = got.map_err(|error| error.to_string());
+                assert!(
+                    got.as_ref()
+                        .is_err_and(|error| error.starts_with(&want) && error.ends_with(closed)),
+                    "{case}: BootServices: {command}: {got:?}, reads {:?}",
+                    variables.reads()
+                );
+            }
+            assert_eq!(variables.reads(), [], "{case}: BootServices: reads");
+            assert_eq!(
+                variables.writes_to(&dropped_password_store()),
+                [],
+                "{case}: BootServices: writes"
+            );
+
+            let variables = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
+            assert_eq!(
+                get(&hiidb, &variables).map_err(|error| error.to_string()),
+                runtime,
+                "{case}: Runtime: get"
+            );
+            let reads: Vec<(VariableKey, u16)> = reads
+                .iter()
+                .map(|&size| (dropped_password_store(), size))
+                .collect();
+            assert_eq!(variables.reads(), reads, "{case}: Runtime: reads");
+        }
+
+        let variables = variables_of(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        assert_eq!(
+            get(
+                &dropped_password_hiidb(
+                    Vec::new(),
+                    form_set(&dropped_password_second_ops(Vec::new())),
+                ),
+                &variables
+            )
+            .map_err(|error| error.to_string()),
+            Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]),
+            "no drop: BootServices: get"
+        );
+        assert_eq!(variables.reads(), [], "no drop: BootServices: reads");
+    }
+
+    /// A HiiDB of one package list, of DROPPED_PASSWORD_LIST_GUID, holding a form package of
+    /// `ifr` and the strings Q1, Password and Q3 of string IDs 1 to 3.
+    fn three_questions_hiidb(ifr: &[u8]) -> Vec<u8> {
+        let packages = [
+            form_package_of(ifr),
+            en_strings_package_of(&["Q1", "Password", "Q3"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid(DROPPED_PASSWORD_LIST_GUID, &packages.concat())
+    }
+
+    /// The answers of get of `question` in `hiidb`, reading `variables`, or its error.
+    fn answers_or_error_of(
+        hiidb: &[u8],
+        question: &str,
+        variables: &Rc<MemoryVariables>,
+    ) -> Result<Vec<String>, String> {
+        HiiBackend::get_in(
+            hiidb,
+            question,
+            None,
+            &GetOptions::default(),
+            shared(variables),
+            None,
+            None,
+            None,
+        )
+        .map(|got| {
+            got.responses
+                .iter()
+                .map(|response| response.question.answer.clone())
+                .collect()
+        })
+        .map_err(|error| error.to_string())
+    }
+
+    /// The number of questions that set of `question` to "0" in `hiidb` under `policy` sets,
+    /// reading and writing `variables`, or its error.
+    fn set_count_of(
+        hiidb: &[u8],
+        question: &str,
+        policy: UnsafeOperations,
+        variables: &Rc<MemoryVariables>,
+    ) -> Result<usize, String> {
+        let options = SetOptions {
+            unsafe_operations: policy,
+            ..SetOptions::default()
+        };
+        set_responses(
+            hiidb,
+            question,
+            &SetValue::Text("0".to_owned()),
+            None,
+            &options,
+            SetAccess {
+                reads: shared(variables),
+                writes: &**variables,
+                held: None,
+            },
+            None,
+        )
+        .map(|got| got.responses.len())
+        .map_err(|error| error.to_string())
+    }
+
+    /// A VARSTORE op that ends after 4 of the 20 bytes before its Name: UEFI 2.11 §33.2.5.10.1
+    /// calls it malformed.
+    fn short_var_store() -> Vec<u8> {
+        operation(VAR_STORE, false, &[0x00; 4])
+    }
+
+    /// The prefix of the refusal, through variables that reach BootServices, of a HiiDB of
+    /// three_questions_hiidb with IFR that uefisettings ignores.
+    fn three_questions_refusal() -> String {
+        format!(
+            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
+             offset ",
+            Guid::from(DROPPED_PASSWORD_LIST_GUID)
+        )
+    }
+
+    /// Through variables that reach Runtime, get reads the questions of a FormSet after one that
+    /// uefisettings ignores, as edk2-stable202608 GetIfrBinaryData finds it, and those before, on
+    /// a variable that the ignored one does not declare; through variables that reach
+    /// BootServices, the PASSWORD of the ignored FormSet still closes every variable of the HiiDB.
+    #[test]
+    fn form_sets_after_an_ignored_one_are_read() {
+        let ifr = [
+            form_set(&[
+                dropped_password_var_store(),
+                form(1, &[checkbox_on(1, 1, 1)]),
+            ]),
+            form_set(&[
+                ignored_form_set_var_store(),
+                form(1, &[password_on(2, 2, 2, 0)]),
+                short_var_store(),
+            ]),
+            form_set(&[
+                dropped_password_var_store(),
+                form(1, &[checkbox_on(3, 3, 1)]),
+            ]),
+        ]
+        .concat();
+        let hiidb = three_questions_hiidb(&ifr);
+        let variables_of = |reach, interface| {
+            let variables = MemoryVariables::new(reach, interface);
+            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+            Rc::new(variables)
+        };
+
+        let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
+        for question in ["Q1", "Q3"] {
+            assert_eq!(
+                answers_or_error_of(&hiidb, question, &runtime),
+                Ok(vec!["1".to_string()]),
+                "Runtime: get {question}"
+            );
+        }
+
+        let boot_services = variables_of(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        for question in ["Q1", "Q3"] {
+            let got = answers_or_error_of(&hiidb, question, &boot_services);
+            assert!(
+                got.as_ref()
+                    .is_err_and(|error| error.starts_with(&three_questions_refusal())),
+                "BootServices: get {question}: {got:?}"
+            );
+        }
+        assert_eq!(boot_services.reads(), [], "BootServices: reads");
+    }
+
+    /// Through variables that reach Runtime, the variables that the ops from the FORM_SET op of a
+    /// FormSet without its Scope bit to the next FORM_SET op declare, past its End too, are withheld
+    /// whole, as edk2 parses a PASSWORD there into that FormSet; a question on a variable that the
+    /// next FormSet declares reads. Through variables that reach BootServices, get refuses.
+    #[test]
+    fn variables_past_the_end_of_a_scopeless_form_set_are_withheld() {
+        const OTHER_STORE_GUID: [u8; 16] = [0x5B; 16];
+        let other_key = VariableKey {
+            name: "UefisettingsOther".to_string(),
+            guid: Guid::from(OTHER_STORE_GUID),
+        };
+        let ifr = [
+            // which uefisettings ends at the End of form 1
+            scopeless_form_set(&[
+                form(1, &[]),
+                dropped_password_var_store(),
+                form(2, &[password_on(2, 2, 1, 0)]),
+            ]),
+            form_set_with_guid(
+                [0x22; 16],
+                &[
+                    dropped_password_var_store(),
+                    var_store_efi_of(2, OTHER_STORE_GUID, "UefisettingsOther", NV_BS_RT, 20),
+                    form(1, &[checkbox_on(1, 1, 1), checkbox_on(3, 3, 2)]),
+                ],
+            ),
+        ]
+        .concat();
+        let hiidb = three_questions_hiidb(&ifr);
+        let variables_of = |reach, interface| {
+            let variables = MemoryVariables::new(reach, interface);
+            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+            variables.insert(other_key.clone(), NV_BS_RT, &[0xAA; 20]);
+            Rc::new(variables)
+        };
+
+        let boot_services = variables_of(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
+        assert!(
+            got.as_ref()
+                .is_err_and(|error| error.starts_with(&three_questions_refusal())),
+            "BootServices: get Q3: {got:?}"
+        );
+        assert_eq!(boot_services.reads(), [], "BootServices: reads");
+
+        let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
+        assert_eq!(
+            answers_or_error_of(&hiidb, "Q1", &runtime),
+            Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]),
+            "Runtime: get Q1"
+        );
+        assert_eq!(
+            answers_or_error_of(&hiidb, "Q3", &runtime),
+            Ok(vec!["1".to_string()]),
+            "Runtime: get Q3"
+        );
+        assert_eq!(runtime.reads(), [(other_key, 20)], "Runtime: reads");
+    }
+
+    /// Through variables that reach Runtime, every variable of the GUID of a VARSTORE_EFI of the
+    /// form before UEFI 2.3.1 in a FormSet that uefisettings ignores is withheld whole, as the
+    /// VarName of a PASSWORD on it, which is not read, names its variable by any string: a
+    /// question on another variable of that GUID shows none, one on a variable of another GUID
+    /// reads. Every variable is withheld where the Guid of that VARSTORE_EFI runs past the form
+    /// package, so is unknown. Through variables that reach BootServices, get refuses.
+    #[test]
+    fn every_variable_of_a_short_var_store_in_ignored_ifr_is_withheld() {
+        let short_store_variable = VariableKey {
+            name: "UefisettingsShort".to_string(),
+            guid: Guid::from(SHORT_VAR_STORE_GUID),
+        };
+        let parsed = form_set(&[
+            var_store_efi_of(1, SHORT_VAR_STORE_GUID, "UefisettingsShort", NV_BS_RT, 20),
+            var_store_efi_of(
+                2,
+                DROPPED_PASSWORD_STORE_GUID,
+                "UefisettingsTest",
+                NV_BS_RT,
+                20,
+            ),
+            form(1, &[checkbox_on(1, 1, 1), checkbox_on(3, 3, 2)]),
+        ]);
+        // VarName 2, "Password"
+        let password = form(1, &[password_on(2, 2, 1, 2)]);
+        let withheld = Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
+        let cases = [
+            (
+                "a short CHECKBOX outside its forms",
+                [
+                    form_set_with_guid(
+                        [0x44; 16],
+                        &[
+                            short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                            password.clone(),
+                            operation(CHECKBOX, false, &[0x00; 4]),
+                        ],
+                    ),
+                    parsed.clone(),
+                ]
+                .concat(),
+                Ok(vec!["1".to_string()]),
+                vec![(dropped_password_store(), 20)],
+            ),
+            (
+                "a VARSTORE_EFI that ends after its VarStoreId, last",
+                [
+                    parsed,
+                    form_set_with_guid(
+                        [0x44; 16],
+                        &[
+                            password,
+                            operation(VAR_STORE_EFI, false, &1u16.to_le_bytes()),
+                        ],
+                    ),
+                ]
+                .concat(),
+                withheld.clone(),
+                vec![],
+            ),
+        ];
+        for (case, ifr, q3, reads) in cases {
+            let hiidb = three_questions_hiidb(&ifr);
+            let variables_of = |reach, interface| {
+                let variables = MemoryVariables::new(reach, interface);
+                variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+                variables.insert(short_store_variable.clone(), NV_BS_RT, &[0xAA; 20]);
+                Rc::new(variables)
+            };
+
+            let boot_services = variables_of(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            );
+            let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
+            assert!(
+                got.as_ref()
+                    .is_err_and(|error| error.starts_with(&three_questions_refusal())),
+                "{case}: BootServices: get Q3: {got:?}"
+            );
+            assert_eq!(boot_services.reads(), [], "{case}: BootServices: reads");
+
+            let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
+            assert_eq!(
+                answers_or_error_of(&hiidb, "Q1", &runtime),
+                withheld,
+                "{case}: Runtime: get Q1"
+            );
+            assert_eq!(
+                answers_or_error_of(&hiidb, "Q3", &runtime),
+                q3,
+                "{case}: Runtime: get Q3"
+            );
+            assert_eq!(runtime.reads(), reads, "{case}: Runtime: reads");
+        }
+    }
+
+    /// By QuestionId, a question of a disabled form or of an ignored FormSet is refused as by its
+    /// prompt: get answers none and lists the same records, and set's MaybeInIgnoredIfr names
+    /// them.
+    #[test]
+    fn question_ids_in_ignored_ifr_are_refused_as_prompts() {
+        let (disabled_form, _) = disabled_form_hiidb(operation(CHECKBOX, false, &[0x00; 4]));
+        let ignored_form_set = three_questions_hiidb(
+            &[
+                form_set(&[
+                    dropped_password_var_store(),
+                    form(1, &[checkbox_on(1, 1, 1)]),
+                ]),
+                form_set_with_guid(
+                    [0x33; 16],
+                    &[
+                        dropped_password_var_store(),
+                        form(1, &[checkbox_on(3, 3, 1)]),
+                        short_var_store(),
+                    ],
+                ),
+            ]
+            .concat(),
+        );
+        let options = SetOptions {
+            unsafe_operations: UnsafeOperations::Allow,
+            ..SetOptions::default()
+        };
+        let cases = [
+            ("a disabled form", disabled_form, "Q2", [0x11; 16], 2),
+            ("an ignored FormSet", ignored_form_set, "Q3", [0x33; 16], 3),
+        ];
+        for (case, hiidb, prompt, form_set, question_id) in cases {
+            let refusals = [
+                QuestionSelector::from(prompt),
+                by_address(&format!("{}:{question_id}", Guid::from(form_set))),
+            ]
+            .map(|question| {
+                let variables =
+                    disabled_form_variables(VariableReach::Runtime, VariableInterface::Efivarfs);
+                let got = HiiBackend::get_in(
+                    &hiidb,
+                    question.clone(),
                     None,
                     &GetOptions::default(),
                     shared(&variables),
                     None,
                     None,
+                    None,
                 )
                 .unwrap_or_else(|error| panic!("{case}: get {question}: {error:#}"));
                 let set = set_responses(
                     &hiidb,
-                    question.clone(),
-                    &SetValue::Text("0".to_owned()),
-                    None,
-                    &options,
-                    shared(&variables),
-                    &*variables,
-                    None,
+                    question.clone(),
+                    &SetValue::Text("0".to_owned()),
+                    None,
+                    &options,
+                    SetAccess {
+                        reads: shared(&variables),
+                        writes: &*variables,
+                        held: None,
+                    },
+                    None,
+                )
+                .map(drop)
+                .map_err(|error| error.to_string());
+                let records = set.as_ref().err().and_then(|error| {
+                    error
+                        .strip_prefix(&format!(
+                            "no question {:?} in the HiiDB, but it may be in ",
+                            question.to_string()
+                        ))
+                        .map(str::to_owned)
+                });
+                assert!(records.is_some(), "{case}: set {question}: {set:?}");
+                (got.responses.len(), got.ignored_ifr, records)
+            });
+            let [by_prompt, by_question_id] = refusals;
+            assert_eq!(by_prompt.0, 0, "{case}: get by prompt");
+            assert!(
+                by_prompt
+                    .1
+                    .as_ref()
+                    .is_some_and(|records| !records.is_empty()),
+                "{case}: get by prompt: ignored_ifr"
+            );
+            assert_eq!(by_question_id, by_prompt, "{case}: by QuestionId");
+        }
+    }
+
+    /// Through variables that reach BootServices, get and set, with and without the setup
+    /// password bypass, refuse and touch no variable when a PASSWORD may sit in IFR that the
+    /// parser does not read: a FormSet that it ignores, a FormSet after one, and a FormSet in one
+    /// that has its End, which edk2's walk for FormSets finds. Through variables that reach
+    /// Runtime, the questions around that IFR read, but those on a variable that a VARSTORE or
+    /// VARSTORE_EFI op in an ignored FormSet declares, which is withheld whole. Without IFR that it
+    /// ignores, the PASSWORD that it reads leaves get and the bypassed set open.
+    #[test]
+    fn unread_password_regions_close_boot_services() {
+        const PASSWORD_STORE_GUID: [u8; 16] = [0x5A; 16];
+        let password_key = VariableKey {
+            name: "UefisettingsPw".to_string(),
+            guid: Guid::from(PASSWORD_STORE_GUID),
+        };
+        let password_store =
+            || var_store_efi_of(2, PASSWORD_STORE_GUID, "UefisettingsPw", NV_BS_RT, 20);
+        let q1 = form_set(&[
+            dropped_password_var_store(),
+            form(1, &[checkbox_on(1, 1, 1)]),
+        ]);
+        let q3 = form_set(&[
+            dropped_password_var_store(),
+            form(1, &[checkbox_on(3, 3, 1)]),
+        ]);
+        // Q3 and a PASSWORD on the variable of password_key
+        let q3_and_password = || {
+            form_set(&[
+                dropped_password_var_store(),
+                password_store(),
+                form(1, &[checkbox_on(3, 3, 1), password_on(2, 2, 2, 0)]),
+            ])
+        };
+        let read = Ok(vec!["1".to_string()]);
+        let withheld = Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
+        // each with what get of Q1 and Q3 answers through variables that reach Runtime
+        let cases: [(&str, Vec<u8>, _); 4] = [
+            (
+                "a PASSWORD in an ignored FormSet",
+                [
+                    q1.clone(),
+                    form_set(&[
+                        password_store(),
+                        form(1, &[password_on(2, 2, 2, 0)]),
+                        short_var_store(),
+                    ]),
+                    q3,
+                ]
+                .concat(),
+                read.clone(),
+            ),
+            (
+                "a PASSWORD in a FormSet after an ignored one",
+                [
+                    q1.clone(),
+                    form_set(&[password_store(), short_var_store()]),
+                    q3_and_password(),
+                ]
+                .concat(),
+                read.clone(),
+            ),
+            (
+                // the nested FormSet's VARSTORE_EFI of dropped_password_store is in the ignored one
+                "a PASSWORD in a FormSet in an ignored one that has its End",
+                [
+                    q1.clone(),
+                    form_set(&[
+                        dropped_password_var_store(),
+                        short_var_store(),
+                        q3_and_password(),
+                    ]),
+                ]
+                .concat(),
+                withheld,
+            ),
+            (
+                "control: a PASSWORD in a FormSet after a FormSet that parses",
+                [
+                    q1,
+                    form_set(&[dropped_password_var_store()]),
+                    q3_and_password(),
+                ]
+                .concat(),
+                read,
+            ),
+        ];
+        let variables_of = |reach, interface| {
+            let variables = MemoryVariables::new(reach, interface);
+            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+            variables.insert(password_key.clone(), NV_BS_RT, &[0x00; 20]);
+            Rc::new(variables)
+        };
+        let refused = three_questions_refusal();
+        for (name, ifr, runtime_answers) in cases {
+            let hiidb = three_questions_hiidb(&ifr);
+
+            let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
+            for question in ["Q1", "Q3"] {
+                assert_eq!(
+                    answers_or_error_of(&hiidb, question, &runtime),
+                    runtime_answers,
+                    "{name}: Runtime: get {question}"
+                );
+            }
+
+            let control = name.starts_with("control");
+            for question in ["Q1", "Q3"] {
+                // each question on its own variables: a bypassed set writes byte 0, which both
+                // CHECKBOXes read
+                let boot_services = variables_of(
+                    VariableReach::BootServices,
+                    VariableInterface::VariableServices,
+                );
+                let got = answers_or_error_of(&hiidb, question, &boot_services);
+                match control {
+                    false => assert!(
+                        got.as_ref().is_err_and(|error| error.starts_with(&refused)),
+                        "{name}: BootServices: get {question}: {got:?}"
+                    ),
+                    true => assert_eq!(
+                        got,
+                        Ok(vec!["1".to_string()]),
+                        "{name}: BootServices: get {question}"
+                    ),
+                }
+                for policy in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
+                    let got = set_count_of(&hiidb, question, policy, &boot_services);
+                    match (control, policy) {
+                        (false, _) => assert!(
+                            got.as_ref().is_err_and(|error| error.starts_with(&refused)),
+                            "{name}: BootServices: set {question} {policy:?}: {got:?}"
+                        ),
+                        (true, UnsafeOperations::Refuse) => assert!(
+                            got.as_ref().is_err_and(|error| error
+                                .starts_with("this HiiDB declares a setup password question")),
+                            "{name}: BootServices: set {question} {policy:?}: {got:?}"
+                        ),
+                        (true, _) => assert_eq!(
+                            got,
+                            Ok(1),
+                            "{name}: BootServices: set {question} {policy:?}"
+                        ),
+                    }
+                }
+                match control {
+                    false => {
+                        assert_eq!(
+                            boot_services.reads(),
+                            [],
+                            "{name}: BootServices: {question}: reads"
+                        );
+                        assert_eq!(
+                            boot_services.writes_to(&dropped_password_store()),
+                            [],
+                            "{name}: BootServices: {question}: writes"
+                        );
+                    }
+                    true => assert_eq!(
+                        boot_services.writes_to(&dropped_password_store()),
+                        [(0, vec![0])],
+                        "{name}: BootServices: {question}: the bypassed set writes"
+                    ),
+                }
+                assert_eq!(
+                    boot_services.reads_of(&password_key),
+                    Vec::<u16>::new(),
+                    "{name}: BootServices: {question}: the PASSWORD's variable stays unread"
+                );
+                assert_eq!(
+                    boot_services.writes_to(&password_key),
+                    [],
+                    "{name}: BootServices: {question}: no PASSWORD write"
+                );
+            }
+        }
+    }
+
+    /// A first FormSet that does not parse or nests too deep is ignored like a later one: through
+    /// variables that reach Runtime the FormSet after it reads, and through variables that reach
+    /// BootServices a PASSWORD in it still closes get and set, bypassed or not, with no variable
+    /// read or written.
+    #[test]
+    fn a_malformed_first_form_set_is_ignored_like_a_later_one() {
+        // the FormSet's own scope and these
+        let too_deep = nested(&subtitle_scope(5), MAX_SCOPE_NESTING, &[]);
+        let q3 = form_set(&[
+            dropped_password_var_store(),
+            form(1, &[checkbox_on(3, 3, 1)]),
+        ]);
+        let cases = [
+            (
+                "a first FormSet that does not parse",
+                form_set(&[
+                    ignored_form_set_var_store(),
+                    form(1, &[password_on(2, 2, 2, 0)]),
+                    short_var_store(),
+                ]),
+            ),
+            (
+                "a first FormSet nested too deep",
+                form_set(&[
+                    ignored_form_set_var_store(),
+                    form(1, &[password_on(2, 2, 2, 0)]),
+                    too_deep,
+                ]),
+            ),
+        ];
+        let refused = format!("{}0 of a form package: ", three_questions_refusal());
+        let variables_of = |reach, interface| {
+            let variables = MemoryVariables::new(reach, interface);
+            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+            Rc::new(variables)
+        };
+        for (name, first) in cases {
+            let hiidb = three_questions_hiidb(&[first, q3.clone()].concat());
+
+            let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
+            assert_eq!(
+                answers_or_error_of(&hiidb, "Q3", &runtime),
+                Ok(vec!["1".to_string()]),
+                "{name}: Runtime: get Q3"
+            );
+
+            let boot_services = variables_of(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            );
+            let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
+            assert!(
+                got.as_ref().is_err_and(|error| error.starts_with(&refused)),
+                "{name}: BootServices: get Q3: {got:?}"
+            );
+            for policy in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
+                let got = set_count_of(&hiidb, "Q3", policy, &boot_services);
+                assert!(
+                    got.as_ref().is_err_and(|error| error.starts_with(&refused)),
+                    "{name}: BootServices: set Q3 {policy:?}: {got:?}"
+                );
+            }
+            assert_eq!(boot_services.reads(), [], "{name}: BootServices: reads");
+            assert_eq!(
+                boot_services.writes_to(&dropped_password_store()),
+                [],
+                "{name}: BootServices: writes"
+            );
+        }
+    }
+
+    /// The offsets of the records of IFR that uefisettings ignores that `error` names, in order.
+    fn offsets_named(error: &str) -> Vec<String> {
+        error
+            .split("uefisettings ignores at offset ")
+            .skip(1)
+            .map(|rest| rest.split(' ').next().unwrap_or_default().to_string())
+            .collect()
+    }
+
+    /// Through variables that reach BootServices, get's refusal names each FormSet that
+    /// uefisettings ignores, at its offset.
+    #[test]
+    fn the_refusal_names_every_ignored_form_set() {
+        let q1 = form_set(&[
+            dropped_password_var_store(),
+            form(1, &[checkbox_on(1, 1, 1)]),
+        ]);
+        let ignored = form_set(&[dropped_password_var_store(), short_var_store()]);
+        let hiidb = three_questions_hiidb(&[q1.clone(), ignored.clone(), ignored.clone()].concat());
+        let variables = MemoryVariables::new(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+        let error = answers_or_error_of(&hiidb, "Q1", &Rc::new(variables))
+            .expect_err("BootServices: get Q1");
+        let want = [q1.len(), q1.len() + ignored.len()].map(|offset| offset.to_string());
+        assert_eq!(offsets_named(&error), want, "{error}");
+    }
+
+    /// The refusals that name the IFR that uefisettings ignores name its first 16 records and
+    /// count the rest: get's through variables that reach BootServices, and set's of a question
+    /// that no FormSet that it reads holds, through variables that reach Runtime.
+    #[test]
+    fn refusals_name_16_ignored_form_sets_and_count_the_rest() {
+        let q1 = form_set(&[
+            dropped_password_var_store(),
+            form(1, &[checkbox_on(1, 1, 1)]),
+        ]);
+        let ignored = form_set(&[dropped_password_var_store(), short_var_store()]);
+        let hiidb = three_questions_hiidb(&[q1.clone(), ignored.repeat(17)].concat());
+        let want: Vec<String> = (0..16)
+            .map(|index| (q1.len() + index * ignored.len()).to_string())
+            .collect();
+        let variables_of = |reach, interface| {
+            let variables = MemoryVariables::new(reach, interface);
+            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+            Rc::new(variables)
+        };
+
+        let boot_services = variables_of(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        let error =
+            answers_or_error_of(&hiidb, "Q1", &boot_services).expect_err("BootServices: get Q1");
+        assert_eq!(offsets_named(&error), want, "BootServices: get Q1: {error}");
+        assert!(
+            error.contains("; and 1 more; as the variable of that password is unknown"),
+            "BootServices: get Q1: {error}"
+        );
+
+        let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
+        let error = set_count_of(&hiidb, "Q2", UnsafeOperations::Refuse, &runtime)
+            .expect_err("Runtime: set Q2");
+        assert_eq!(offsets_named(&error), want, "Runtime: set Q2: {error}");
+        assert!(error.ends_with("; and 1 more"), "Runtime: set Q2: {error}");
+    }
+
+    /// get and set name the IFR that uefisettings ignores in a HiiDB, through variables that
+    /// reach Runtime too, where it closes nothing: get and set list it in the ignored_ifr of their
+    /// answer, a question in it or not, and set's refusal of a question that no FormSet it reads
+    /// holds names it. Without such IFR, neither answer has an ignored_ifr and the refusal names
+    /// the question alone.
+    #[test]
+    fn get_and_set_name_the_ifr_that_uefisettings_ignores() {
+        let q1 = form_set(&[
+            dropped_password_var_store(),
+            form(1, &[checkbox_on(1, 1, 1)]),
+        ]);
+        // a FormSet that uefisettings ignores, with the CHECKBOX Q2 of string ID 2
+        let ignored = form_set(&[
+            ignored_form_set_var_store(),
+            form(1, &[checkbox_on(2, 2, 2)]),
+            short_var_store(),
+        ]);
+        let q3 = form_set(&[
+            dropped_password_var_store(),
+            form(1, &[checkbox_on(3, 3, 1)]),
+        ]);
+        let hiidb = three_questions_hiidb(&[q1.clone(), ignored, q3.clone()].concat());
+        let without = three_questions_hiidb(&[q1.clone(), q3].concat());
+        let list = Guid::from(DROPPED_PASSWORD_LIST_GUID).to_string();
+        let reason = format!(
+            "the FormSet {}, which holds, outside its forms, an op shorter than its minimum, which \
+             UEFI 2.11 §33.2.5.10.1 calls malformed, in no form for that section to disable: the \
+             EFI_IFR_VARSTORE op at offset ",
+            Guid::from([0x11; 16])
+        );
+        let offset = q1.len();
+        let variables = || {
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
+            Rc::new(variables)
+        };
+        // the ignored_ifr of the JSON of `answer`: (package list, offset, whether the reason is
+        // `reason`), None if unset
+        let ignored_ifr_of = |answer: Vec<u8>| -> Option<Vec<(String, u64, bool)>> {
+            let answer: serde_json::Value =
+                serde_json::from_slice(&answer).expect("parse the JSON of an answer");
+            let records = answer.get("ignored_ifr")?.as_array()?;
+            Some(
+                records
+                    .iter()
+                    .map(|record| {
+                        (
+                            record["package_list"]
+                                .as_str()
+                                .unwrap_or_default()
+                                .to_string(),
+                            record["offset"].as_u64().unwrap_or(u64::MAX),
+                            record["reason"]
+                                .as_str()
+                                .is_some_and(|got| got.starts_with(&reason)),
+                        )
+                    })
+                    .collect(),
+            )
+        };
+        let want = Some(vec![(
+            list.clone(),
+            u64::try_from(offset).expect("offset"),
+            true,
+        )]);
+        let get = |hiidb: &[u8], question: &str| {
+            HiiBackend::get_in(
+                hiidb,
+                question,
+                None,
+                &GetOptions::default(),
+                shared(&variables()),
+                None,
+                None,
+                None,
+            )
+            .unwrap_or_else(|error| panic!("get {question}: {error:#}"))
+        };
+        let set = |hiidb: &[u8], question: &str| {
+            let variables = variables();
+            set_responses(
+                hiidb,
+                question,
+                &SetValue::Text("0".to_owned()),
+                None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
+                None,
+            )
+            .map_err(|error| error.to_string())
+        };
+
+        for (question, answers) in [("Q3", vec!["1"]), ("Q2", vec![])] {
+            let got = get(&hiidb, question);
+            let got_answers: Vec<&str> = got
+                .responses
+                .iter()
+                .map(|response| response.question.answer.as_str())
+                .collect();
+            assert_eq!(got_answers, answers, "get {question}: answers");
+            assert_eq!(
+                ignored_ifr_of(simplejson_protocol::serialize(&got).to_vec()),
+                want,
+                "get {question}: ignored_ifr"
+            );
+        }
+        assert_eq!(
+            ignored_ifr_of(simplejson_protocol::serialize(get(&without, "Q3")).to_vec()),
+            None,
+            "get Q3 without ignored IFR: ignored_ifr"
+        );
+
+        let set_q3 = set(&hiidb, "Q3").unwrap_or_else(|error| panic!("set Q3: {error}"));
+        assert_eq!(set_q3.responses.len(), 1, "set Q3: responses");
+        assert_eq!(
+            ignored_ifr_of(simplejson_protocol::serialize(&set_q3).to_vec()),
+            want,
+            "set Q3: ignored_ifr"
+        );
+        let set_q3 = set(&without, "Q3").unwrap_or_else(|error| panic!("set Q3: {error}"));
+        assert_eq!(
+            ignored_ifr_of(simplejson_protocol::serialize(&set_q3).to_vec()),
+            None,
+            "set Q3 without ignored IFR: ignored_ifr"
+        );
+
+        let got = set(&hiidb, "Q2");
+        let refusal = format!(
+            "no question \"Q2\" in the HiiDB, but it may be in the IFR that uefisettings ignores \
+             at offset {offset} of a form package of package list {list}: {reason}"
+        );
+        assert!(
+            got.as_ref().is_err_and(|error| error.starts_with(&refusal)),
+            "set Q2: {got:?}"
+        );
+        assert_eq!(
+            set(&without, "Q2").map(drop),
+            Err("no question \"Q2\" in the HiiDB".to_string()),
+            "set Q2 without ignored IFR"
+        );
+    }
+
+    /// 11111111-1111-1111-1111-111111111111, as stored: the GUID of the VarStore Mode of
+    /// stated_var_store_hiidb.
+    const MODE_GUID: [u8; 16] = [0x11; 16];
+    /// The efivar file of the VarStore Mode of stated_var_store_hiidb.
+    const MODE: &str = "Mode-11111111-1111-1111-1111-111111111111";
+
+    /// A HiiDB of two package lists: one whose FormSet declares no VarStore, then one whose
+    /// question Q, at byte 0 of the EFI variable Setup, a GRAY_OUT_IF grays out while question 2,
+    /// at byte 0 of the 1-byte buffer VarStore Mode, is 1.
+    fn stated_var_store_hiidb() -> Vec<u8> {
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 1),
+                var_store(2, MODE_GUID, "Mode", 1),
+                form(
+                    1,
+                    &[
+                        checkbox_on(2, 2, 2),
+                        conditional(GRAY_OUT_IF, eq_id_val_of(2, 1), &[checkbox_on(1, 1, 1)]),
+                    ],
+                ),
+            ]),
+            en_strings_package(b'Q'),
+            END_PACKAGE.to_vec(),
+        ];
+        [
+            form_set_list([0x33; 16], b'A'),
+            package_list_with_guid([0x55; 16], &packages.concat()),
+        ]
+        .concat()
+    }
+
+    /// `texts` as --assume-var-store takes them.
+    fn statements(texts: &[&str]) -> Vec<AssumedVarStore> {
+        texts
+            .iter()
+            .map(|text| {
+                text.parse()
+                    .unwrap_or_else(|error| panic!("parse {text:?}: {error}"))
+            })
+            .collect()
+    }
+
+    /// set selects by the VarStore bytes stated, before any write, and refuses statements of a
+    /// VarStore that the HiiDB does not declare, or past its Size.
+    #[cfg(efivar_dumps)]
+    #[test]
+    fn set_selects_by_the_stated_var_store_bytes() {
+        let hiidb = stated_var_store_hiidb();
+        let efivars = tempfile::tempdir().expect("create efivars directory");
+        fs::write(
+            efivars
+                .path()
+                .join("Setup-00000000-0000-0000-0000-000000000000"),
+            [7, 0, 0, 0, 1],
+        )
+        .expect("write efivar file");
+        let select = |stated: &[&str]| {
+            let options = SetOptions {
+                assume_var_stores: statements(stated),
+                ..SetOptions::default()
+            };
+            select_for_set(
+                &package::read_db(&hiidb).expect("parse the HiiDB"),
+                &QuestionSelector::from("Q"),
+                &BTreeSet::from(["Q".to_string()]),
+                &options,
+                &[],
+                &mut PendingOperations::new(UnsafeOperations::Refuse),
+                &mut EfivarReader::new(EfivarSource::Directory(efivars.path().to_path_buf()))
+                    .expect("create a reader of the efivars directory"),
+                None,
+            )
+            .map(|(selected, _)| {
+                selected
+                    .into_iter()
+                    .map(|selected| selected.descriptor.question)
+                    .collect::<Vec<_>>()
+            })
+        };
+
+        assert_eq!(
+            select(&[&format!("{MODE}=00")]).expect("select with 00 stated"),
+            ["Q"],
+            "00 stated"
+        );
+        let grayed_out = select(&[&format!("{MODE}=01")]).expect_err("select with 01 stated");
+        assert_eq!(
+            grayed_out.downcast_ref::<SelectionError>(),
+            Some(&SelectionError::Excluded {
+                question: "Q".to_string(),
+                states: IncludedStates::GRAYED_OUT,
+            }),
+            "01 stated: {grayed_out:#}"
+        );
+        let unstated = select(&[]).expect_err("select with none stated");
+        assert!(
+            matches!(
+                unstated.downcast_ref::<SelectionError>(),
+                Some(SelectionError::Undetermined { states, reasons, .. })
+                    if *states == IncludedStates::GRAYED_OUT
+                        && reasons.iter().all(|reason| reason.ends_with(&format!(
+                            "; --assume-var-store {MODE}+0=<HEX of 1 byte> states it>"
+                        )))
+            ),
+            "none stated: {unstated:#}"
+        );
+        let refusals = [
+            (
+                vec!["Undeclared-00000000-0000-0000-0000-000000000001=00".to_string()],
+                "no FormSet of this HiiDB declares a VarStore \
+                 Undeclared-00000000-0000-0000-0000-000000000001",
+            ),
+            (
+                vec![format!("{MODE}+1=00")],
+                "bytes 1..2 pass the Size 1 that VarStore \
+                 Mode-11111111-1111-1111-1111-111111111111 declares",
+            ),
+            (
+                vec![format!("{MODE}=00"), format!("{MODE}=01")],
+                "--assume-var-store states bytes 0..1 of VarStore \
+                 Mode-11111111-1111-1111-1111-111111111111 twice",
+            ),
+        ];
+        for (stated, want) in refusals {
+            let stated: Vec<&str> = stated.iter().map(String::as_str).collect();
+            assert_eq!(
+                select(&stated).map_err(|error| error.to_string()),
+                Err(want.to_string()),
+                "{stated:?}"
+            );
+        }
+    }
+
+    /// set evaluates the WRITE expression of the question that it writes with the VarStore bytes
+    /// stated: that of the NUMERIC W, at byte 0 of the EFI variable Setup, sets byte 1 of Setup
+    /// to question 2, at byte 0 of the buffer VarStore Mode, which no variable holds. With 01
+    /// stated set writes 1 there; with none stated it refuses before any write.
+    #[test]
+    fn set_evaluates_write_expressions_with_the_stated_bytes() {
+        const AND: u8 = 0x15;
+        const SET: u8 = 0x2C;
+        const THIS: u8 = 0x58;
+        const WRITE: u8 = 0x2E;
+        // a SET of a UINT8 (EFI_IFR_TYPE_NUM_SIZE_8) at `offset` of Setup
+        let set = |offset: u16| {
+            let data = [&1u16.to_le_bytes()[..], &offset.to_le_bytes(), &[0x00]].concat();
+            operation(SET, false, &data)
+        };
+        let numeric = [
+            operation(
+                NUMERIC,
+                true,
+                &[
+                    question_header_with(4, 4, 1, 0, 0x00),
+                    // EFI_IFR_NUMERIC_SIZE_1 | EFI_IFR_DISPLAY_UINT_DEC, from 0 to 255, step 1
+                    vec![0x10, 0, 255, 1],
+                ]
+                .concat(),
+            ),
+            operation(WRITE, false, &[]),
+            operation(THIS, true, &[]),
+            set(0),
+            operation(QUESTION_REF1, false, &2u16.to_le_bytes()),
+            set(1),
+            operation(AND, false, &[]),
+            END.to_vec(),
+            END.to_vec(),
+        ]
+        .concat();
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 2),
+                var_store(2, MODE_GUID, "Mode", 1),
+                form(1, &[checkbox_on(2, 2, 2), numeric]),
+            ]),
+            en_strings_package_of(&["S", "M", "T", "W"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let set_w = |stated: &[&str]| {
+            let variables = Rc::new(MemoryVariables::new(
+                VariableReach::Runtime,
+                VariableInterface::Efivarfs,
+            ));
+            variables.insert(setup(), NV_BS_RT, &[0, 0]);
+            let options = SetOptions {
+                assume_var_stores: statements(stated),
+                ..SetOptions::default()
+            };
+            let set = set_responses(
+                &hiidb,
+                "W",
+                &SetValue::Text("5".to_owned()),
+                None,
+                &options,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
+                None,
+            )
+            .map(drop)
+            .map_err(|error| format!("{error:#}"));
+            (set, variables.writes_to(&setup()))
+        };
+
+        let (set, writes) = set_w(&[&format!("{MODE}=01")]);
+        assert_eq!(set, Ok(()), "01 stated");
+        assert_eq!(writes, [(0, vec![5, 1])], "01 stated: writes to Setup");
+        let (set, writes) = set_w(&[]);
+        assert!(
+            set.as_ref().is_err_and(|error| error.ends_with(&format!(
+                "; --assume-var-store {MODE}+0=<HEX of 1 byte> states it>"
+            ))),
+            "none stated: {set:?}"
+        );
+        assert_eq!(writes, [], "none stated: writes to Setup");
+    }
+
+    /// get and list-questions evaluate conditions with the VarStore bytes stated, and refuse
+    /// statements of a VarStore that the HiiDB does not declare.
+    #[test]
+    fn options_state_var_store_bytes() {
+        let hiidb = stated_var_store_hiidb();
+        let get = |stated: &[&str]| {
+            let options = GetOptions {
+                efivars: EfivarSource::Disabled,
+                assume_var_stores: statements(stated),
+                ..GetOptions::default()
+            };
+            HiiBackend::get_using(&hiidb, "Q", None, &options).map(|got| {
+                got.responses
+                    .into_iter()
+                    .map(|response| response.question.answer)
+                    .collect::<Vec<_>>()
+            })
+        };
+        let list = |stated: &[&str]| {
+            let options = ListQuestionsOptions {
+                efivars: EfivarSource::Disabled,
+                assume_var_stores: statements(stated),
+                ..ListQuestionsOptions::default()
+            };
+            HiiBackend::list_questions_using(&hiidb, &options).map(|listed| {
+                listed
+                    .into_iter()
+                    .filter(|question| question.name == "Q")
+                    .map(|question| question.answer)
+                    .collect::<Vec<_>>()
+            })
+        };
+        let not_read = "<ValueUnavailable: EFI variables not read> <IFR default: 0>";
+
+        let selectable = format!("{MODE}=00");
+        assert_eq!(
+            get(&[&selectable]).expect("get with 00 stated"),
+            [not_read],
+            "get with 00 stated"
+        );
+        assert_eq!(
+            list(&[&selectable]).expect("list with 00 stated"),
+            [not_read],
+            "list-questions with 00 stated"
+        );
+        let grayed_out = format!("{MODE}=01");
+        let error = get(&[&grayed_out]).expect_err("get with 01 stated");
+        assert_eq!(
+            error.downcast_ref::<SelectionError>(),
+            Some(&SelectionError::Excluded {
+                question: "Q".to_string(),
+                states: IncludedStates::GRAYED_OUT,
+            }),
+            "get with 01 stated: {error:#}"
+        );
+        assert_eq!(
+            list(&[&grayed_out]).expect("list with 01 stated"),
+            Vec::<String>::new(),
+            "list-questions with 01 stated"
+        );
+        assert_eq!(
+            list(&[]).expect("list with none stated"),
+            [format!(
+                "{not_read} <selectable or grayed-out: EFI_IFR_EQ_ID_VAL of question 0x0002: \
+                 <ValueUnavailable: EFI variables not read; --assume-var-store \
+                 {MODE}+0=<HEX of 1 byte> states it>>"
+            )],
+            "list-questions with none stated"
+        );
+
+        let undeclared = "Undeclared-00000000-0000-0000-0000-000000000001=00";
+        let refusal = "no FormSet of this HiiDB declares a VarStore \
+                       Undeclared-00000000-0000-0000-0000-000000000001";
+        assert_eq!(
+            get(&[undeclared]).map_err(|error| error.to_string()),
+            Err(refusal.to_string()),
+            "get, an undeclared VarStore"
+        );
+        assert_eq!(
+            list(&[undeclared]).map_err(|error| error.to_string()),
+            Err(refusal.to_string()),
+            "list-questions, an undeclared VarStore"
+        );
+    }
+
+    /// apply-staged selects a staged request's question with the VarStore bytes that set stated:
+    /// R, which a GRAY_OUT_IF grays out while question 3 on Mode is 1, is found with 00 stated and
+    /// refused as grayed out with 01.
+    #[cfg(variable_data)]
+    #[test]
+    fn apply_staged_reads_the_stated_var_store_bytes() {
+        let hiidb = package_list_with_guid(
+            [0x66; 16],
+            &[
+                form_package(&[
+                    var_store(2, MODE_GUID, "Mode", 1),
+                    form(
+                        1,
+                        &[
+                            checkbox_on(3, 1, 2),
+                            conditional(
+                                GRAY_OUT_IF,
+                                eq_id_val_of(3, 1),
+                                &[callback_checkbox(9, 2)],
+                            ),
+                        ],
+                    ),
+                ]),
+                en_strings_package_of(&["Q", "R"]),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
+        );
+        let parsed = package::read_db(&hiidb).expect("the HiiDB");
+        let found = |stated: &str| {
+            let request = StagedRequest {
+                question: "R".to_owned(),
+                form_set: "11111111-1111-1111-1111-111111111111"
+                    .parse()
+                    .expect("a GUID"),
+                question_id: 9,
+                value_type: IfrValueType::Boolean,
+                value: 1,
+                include: IncludedStates::empty(),
+                assume_var_stores: statements(&[stated]),
+                unsafe_operations: UnsafeOperations::Refuse,
+            };
+            let mut reader = EfivarReader::with_variables(Box::new(MemoryVariables::new(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            )));
+            staged_question(&parsed, &request, &[], &mut reader)
+                .map(|(_, descriptor, _, _)| descriptor.question)
+                .map_err(|error| format!("{error:#}"))
+        };
+        assert_eq!(
+            found(&format!("{MODE}=00")),
+            Ok("R".to_owned()),
+            "00 stated"
+        );
+        assert_eq!(
+            found(&format!("{MODE}=01")),
+            Err("question \"R\", QuestionId 0x0009 of FormSet \
+                 11111111-1111-1111-1111-111111111111 is <grayed-out> now, which set did not \
+                 include"
+                .to_owned()),
+            "01 stated"
+        );
+    }
+
+    /// get, list-questions and show-ifr refuse an efivars directory that is not one, rather
+    /// than read every question as missing.
+    #[cfg(efivar_dumps)]
+    #[test]
+    fn options_refuse_an_efivars_directory_that_is_not_one() {
+        let hiidb = package_list_with_guid(
+            [0x55; 16],
+            &[
+                form_set_package(),
+                en_strings_package(b'Q'),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
+        );
+        let missing = tempfile::tempdir()
+            .expect("create directory")
+            .path()
+            .join("missing");
+        let want = format!("efivars directory {} is not a directory", missing.display());
+        let efivars = EfivarSource::Directory(missing);
+        let get_options = GetOptions {
+            efivars: efivars.clone(),
+            ..GetOptions::default()
+        };
+        let list_options = ListQuestionsOptions {
+            efivars: efivars.clone(),
+            ..ListQuestionsOptions::default()
+        };
+
+        let errors = [
+            (
+                "get",
+                HiiBackend::get_using(&hiidb, "Q", None, &get_options).map(drop),
+            ),
+            (
+                "list-questions",
+                HiiBackend::list_questions_using(&hiidb, &list_options).map(drop),
+            ),
+            (
+                "show-ifr",
+                HiiBackend::show_ifr_using(
+                    &hiidb,
+                    &ShowIfrOptions {
+                        efivars,
+                        ..Default::default()
+                    },
                 )
-                .map(drop)
-                .map_err(|error| error.to_string());
-                let records = set.as_ref().err().and_then(|error| {
-                    error
-                        .strip_prefix(&format!(
-                            "no question {:?} in the HiiDB, but it may be in ",
-                            question.to_string()
-                        ))
-                        .map(str::to_owned)
+                .map(drop),
+            ),
+        ];
+        for (case, result) in errors {
+            let error = result.expect_err("read from a directory that is not one");
+
+            assert_eq!(error.to_string(), want, "{case}");
+        }
+    }
+
+    /// show_ifr and list_questions fail for a package list with forms but no
+    /// strings packages, rather than use those of a list of the same GUID.
+    #[test]
+    fn test_forms_without_strings_are_an_error() {
+        let forms_only = [&form_set_package()[..], &END_PACKAGE].concat();
+        let hiidb = [
+            package_list_with_guid([0x44; 16], &forms_only),
+            en_strings_list([0x44; 16], b'S'),
+        ]
+        .concat();
+        let want = "Failed to get string packages using GUID 44444444-4444-4444-4444-444444444444";
+        // no variables: on Windows, System enables a privilege that needs elevation
+        let efivars = EfivarSource::Disabled;
+        let show_options = ShowIfrOptions {
+            efivars: efivars.clone(),
+            ..Default::default()
+        };
+        let list_options = ListQuestionsOptions {
+            efivars,
+            ..ListQuestionsOptions::default()
+        };
+
+        let Err(err) = HiiBackend::show_ifr_using(&hiidb, &show_options) else {
+            panic!("show_ifr used the strings of another list");
+        };
+        assert_eq!(format!("{err:#}"), want, "show_ifr");
+
+        let Err(err) = HiiBackend::list_questions_using(&hiidb, &list_options) else {
+            panic!("list_questions used the strings of another list");
+        };
+        assert_eq!(format!("{err:#}"), want, "list_questions");
+    }
+
+    /// The scopes of the FormSet and the Form of nested_subtitles_hiidb
+    const FORM_SCOPES: usize = 2;
+
+    /// A HiiDB whose Form nests `subtitles` Subtitle scopes around a CheckBox prompted "Deep", in
+    /// the scope of an unknown op if `in_unknown_scope`.
+    fn nested_subtitles_hiidb(subtitles: usize, in_unknown_scope: bool) -> Vec<u8> {
+        let nested = nested(&subtitle_scope(2), subtitles, &[checkbox_on(1, 2, 0)]);
+        let body = match in_unknown_scope {
+            true => [unknown_scope(), nested, END.to_vec()].concat(),
+            false => nested,
+        };
+        let packages = [
+            en_strings_package_of(&["FormSet", "Deep"]),
+            form_package(&[form(1, &[body])]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x55; 16], &packages.concat())
+    }
+
+    /// An op of the unknown opcode 0x70 opening a scope.
+    fn unknown_scope() -> Vec<u8> {
+        operation(0x70, true, &[])
+    }
+
+    /// Every command ignores the FormSet of a HiiDB whose VarStore op ends inside its Name, and
+    /// the record of that FormSet, which list-questions prints on stderr and refusals name, gives
+    /// the error on one line: the fields being parsed, without the Rust source locations of
+    /// binrw's backtrace frames.
+    #[test]
+    fn commands_ignore_a_truncated_var_store_and_name_it_on_one_line() {
+        // EFI_IFR_VARSTORE of the Length of an empty Name, whose last byte is no NUL
+        let var_store = operation(0x24, false, &[&[0x11; 20][..], b"A"].concat());
+        let packages = [
+            en_strings_package_of(&["FormSet"]),
+            form_package(&[var_store]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let want = format!(
+            "the IFR that uefisettings ignores at offset 0 of a form package of package list \
+             55555555-5555-5555-5555-555555555555: the FormSet {}, which holds, outside its \
+             forms, an op that uefisettings does not decode: the EFI_IFR_VARSTORE op at offset \
+             39 of a form package: failed to parse op_code VarStore properly: failed to parse \
+             VarStore's data: failed to fill whole buffer (While parsing field 'name' in \
+             VarStore)",
+            Guid::from([0x11; 16])
+        );
+        for (name, command) in commands() {
+            let got = command(&hiidb).unwrap_or_else(|error| panic!("{name}: {error:#}"));
+            let want: &[&str] = match name {
+                "list-strings" => &["FormSet"],
+                _ => &[],
+            };
+            assert_eq!(got, want, "{name}");
+        }
+        let records: Vec<String> = HiiBackend::ignored_ifr(&hiidb)
+            .unwrap_or_else(|error| panic!("ignored_ifr: {error:#}"))
+            .iter()
+            .map(ToString::to_string)
+            .collect();
+        for record in &records {
+            assert!(
+                !record.contains('\n') && !record.contains("src/"),
+                "{record:?}"
+            );
+        }
+        assert_eq!(records, [want], "ignored_ifr");
+    }
+
+    /// A command of the tests below: what it prints of a HiiDB, line by line.
+    type Command = fn(&[u8]) -> Result<Vec<String>>;
+
+    /// The commands of the tests below, each with its name.
+    fn commands() -> [(&'static str, Command); 4] {
+        [
+            ("list-strings", |hiidb| {
+                let strings = HiiBackend::list_strings(hiidb)?;
+                Ok(strings
+                    .into_iter()
+                    .flat_map(|package| package.string_package.into_values())
+                    .collect())
+            }),
+            ("list-questions", |hiidb| {
+                let options = ListQuestionsOptions {
+                    efivars: EfivarSource::Disabled,
+                    include: IncludedStates::CONDITIONS,
+                    ..Default::default()
+                };
+                let questions = HiiBackend::list_questions_using(hiidb, &options)?;
+                Ok(questions
+                    .into_iter()
+                    .map(|question| question.name)
+                    .collect())
+            }),
+            ("show-ifr", |hiidb| {
+                let options = ShowIfrOptions {
+                    efivars: EfivarSource::Disabled,
+                    ..Default::default()
+                };
+                let shown = HiiBackend::show_ifr_using(hiidb, &options)?;
+                Ok(shown
+                    .readable_representation
+                    .lines()
+                    .filter(|line| line.contains("CheckBox"))
+                    .map(|line| line.trim().to_string())
+                    .collect())
+            }),
+            ("get", |hiidb| {
+                let options = GetOptions {
+                    efivars: EfivarSource::Disabled,
+                    ..Default::default()
+                };
+                let got = HiiBackend::get_using(hiidb, "Deep", None, &options)?;
+                Ok(got
+                    .responses
+                    .into_iter()
+                    .map(|response| response.question.name)
+                    .collect())
+            }),
+        ]
+    }
+
+    /// Every command reads a HiiDB whose IFR scopes nest MAX_SCOPE_NESTING deep, unknown ones
+    /// counted, on SMALL_STACK, and shows its CheckBox, unless an unknown op's scope, which edk2
+    /// skips, holds it.
+    #[test]
+    fn commands_read_scopes_nested_to_the_limit_on_a_small_stack() {
+        for in_unknown_scope in [false, true] {
+            let subtitles = MAX_SCOPE_NESTING - FORM_SCOPES - usize::from(in_unknown_scope);
+            let hiidb = nested_subtitles_hiidb(subtitles, in_unknown_scope);
+            for (name, command) in commands() {
+                let got = on_small_stack(name, || command(&hiidb)).unwrap_or_else(|error| {
+                    panic!("{name}, in an unknown scope: {in_unknown_scope}: {error:#}")
                 });
-                assert!(records.is_some(), "{case}: set {question}: {set:?}");
-                (got.responses.len(), got.ignored_ifr, records)
-            });
-            let [by_prompt, by_question_id] = refusals;
-            assert_eq!(by_prompt.0, 0, "{case}: get by prompt");
+                let want: &[&str] = match (name, in_unknown_scope) {
+                    ("list-strings", _) => &["FormSet", "Deep"],
+                    (_, true) => &[],
+                    ("show-ifr", false) => &["OpCode: CheckBox - Q: - Deep - Help: -"],
+                    (_, false) => &["Deep"],
+                };
+                assert_eq!(got, want, "{name}, in an unknown scope: {in_unknown_scope}");
+            }
+        }
+    }
+
+    /// Every command reads a HiiDB whose only FormSet nests IFR scopes deeper than
+    /// MAX_SCOPE_NESTING, unknown ones counted, by one or by 20000 Subtitles, on SMALL_STACK, and
+    /// ignores that FormSet, as a later one: it shows no question, and names the FormSet and the
+    /// op past the limit as the IFR that it ignores at offset 0. Through variables that reach
+    /// BootServices, get refuses the HiiDB.
+    #[test]
+    fn commands_ignore_a_form_set_nested_past_the_limit_on_a_small_stack() {
+        let form_set_op = form_set(&[]).len() - END.len();
+        let form_op = form(1, &[]).len() - END.len();
+        let subtitle_op = subtitle_scope(2).len();
+        for in_unknown_scope in [false, true] {
+            let outer = FORM_SCOPES + usize::from(in_unknown_scope);
+            let past_limit = form_set_op
+                + form_op
+                + usize::from(in_unknown_scope) * unknown_scope().len()
+                + (MAX_SCOPE_NESTING - outer) * subtitle_op;
+            let ignored = format!(
+                "the FormSet {}, which nests too deep: IFR scopes nest deeper than \
+                 {MAX_SCOPE_NESTING} at offset {past_limit} of a form package",
+                Guid::from([0x11; 16])
+            );
+            for subtitles in [MAX_SCOPE_NESTING - outer + 1, 20_000] {
+                let hiidb = nested_subtitles_hiidb(subtitles, in_unknown_scope);
+                let case =
+                    format!("{subtitles} Subtitles, in an unknown scope: {in_unknown_scope}");
+                for (name, command) in commands() {
+                    let got = on_small_stack(name, || command(&hiidb))
+                        .unwrap_or_else(|error| panic!("{name}, {case}: {error:#}"));
+                    let want: &[&str] = match name {
+                        "list-strings" => &["FormSet", "Deep"],
+                        _ => &[],
+                    };
+                    assert_eq!(got, want, "{name}, {case}");
+                }
+
+                let records: Vec<(u64, String)> =
+                    on_small_stack("ignored_ifr", || HiiBackend::ignored_ifr(&hiidb))
+                        .unwrap_or_else(|error| panic!("ignored_ifr, {case}: {error:#}"))
+                        .into_iter()
+                        .map(|ignored| (ignored.offset, ignored.reason))
+                        .collect();
+                assert_eq!(records, [(0, ignored.clone())], "ignored_ifr, {case}");
+
+                let variables = Rc::new(MemoryVariables::new(
+                    VariableReach::BootServices,
+                    VariableInterface::VariableServices,
+                ));
+                assert_eq!(
+                    answers_or_error_of(&hiidb, "Deep", &variables),
+                    Err(format!(
+                        "PASSWORD questions of package list 55555555-5555-5555-5555-555555555555 \
+                         may be in the IFR that uefisettings ignores at offset 0 of a form \
+                         package: {ignored}; as the variable of that password is unknown, the \
+                         UEFI Shell build reads and writes no variable of this HiiDB"
+                    )),
+                    "BootServices: get, {case}"
+                );
+            }
+        }
+    }
+
+    /// The device path of the driver of snapshot_hiidb.
+    const DRIVER_PATH: [u8; 16] = crate::hii::config_snapshot::tests::DRIVER_PATH;
+    /// The GUIDs, as stored, of NStore and AMITSESetup.
+    const N_GUID: [u8; 16] = crate::hii::config_snapshot::tests::N_GUID;
+    const P_GUID: [u8; 16] = crate::hii::config_snapshot::tests::P_GUID;
+    /// The answer of N of snapshot_hiidb without a variable or snapshot value.
+    const MISSING_N_STORE: &str = "<ValueUnavailable: no EFI variable \
+        NStore-8c78a505-baa0-4c4a-869f-000000001401; HII buffer varstore requires \
+        EFI_HII_CONFIG_ACCESS_PROTOCOL> <IFR default: 0>";
+    /// The answer of X of snapshot_hiidb, over the password's bytes; the NUMERIC declares no
+    /// default.
+    const WITHHELD: &str = "<ValueUnavailable: its bytes hold a password>";
+
+    /// A UINT16 NUMERIC of QuestionId `question_id`, prompted string `prompt`, from 0 to 65535,
+    /// at VarOffset, or VarName, `info` of VarStore `var_store_id`.
+    fn uint16_numeric(question_id: u16, prompt: u16, var_store_id: u16, info: u16) -> Vec<u8> {
+        let data = [
+            question_header_with(question_id, prompt, var_store_id, info, 0x00),
+            // Flags EFI_IFR_NUMERIC_SIZE_2, MinValue, MaxValue, Step
+            vec![0x01, 0x00, 0x00, 0xFF, 0xFF, 0x01, 0x00],
+        ]
+        .concat();
+        operation(NUMERIC, false, &data)
+    }
+
+    /// A UINT8 ONE_OF of QuestionId `question_id`, prompted string `prompt`, at VarOffset
+    /// `offset` of VarStore `var_store_id`, with `options`.
+    fn uint8_one_of(
+        question_id: u16,
+        prompt: u16,
+        var_store_id: u16,
+        offset: u16,
+        options: &[Vec<u8>],
+    ) -> Vec<u8> {
+        let data = [
+            question_header_with(question_id, prompt, var_store_id, offset, 0x00),
+            // Flags EFI_IFR_NUMERIC_SIZE_1, MinValue, MaxValue, Step
+            vec![0x00, 0x00, 0xFF, 0x01],
+        ]
+        .concat();
+        [
+            operation(ONE_OF, true, &data),
+            options.concat(),
+            END.to_vec(),
+        ]
+        .concat()
+    }
+
+    /// The variable of NStore.
+    fn n_store() -> VariableKey {
+        VariableKey {
+            name: "NStore".to_owned(),
+            guid: Guid::from(N_GUID),
+        }
+    }
+
+    /// A HiiDB of the driver at DRIVER_PATH, whose FormSet has the CHECKBOX N at byte 0, the
+    /// UINT16 NUMERIC W at byte 1 and the ONE_OF O of "Off" 0 and "On" 1 at byte 0 of the buffer
+    /// VarStore NStore, then, on the buffer VarStore AMITSESetup of AMI's layout, `password`, the
+    /// CHECKBOX P at byte 80, and the UINT16 NUMERICs S at byte 40 and X at byte 38.
+    fn snapshot_hiidb_with(password: Vec<u8>) -> Vec<u8> {
+        snapshot_hiidb_beside(password, &[])
+    }
+
+    /// snapshot_hiidb_with `password`, with the FormSets `form_sets` after its FormSet in its form
+    /// package.
+    fn snapshot_hiidb_beside(password: Vec<u8>, form_sets: &[Vec<u8>]) -> Vec<u8> {
+        let form_set = form_set_with_guid(
+            [0x11; 16],
+            &[
+                var_store(1, N_GUID, "NStore", 3),
+                var_store(2, P_GUID, "AMITSESetup", 81),
+                form(
+                    1,
+                    &[
+                        checkbox_on(1, 1, 1),
+                        uint16_numeric(2, 2, 1, 1),
+                        uint8_one_of(
+                            5,
+                            5,
+                            1,
+                            0,
+                            &[flagged_option(6, 0x00, 0), flagged_option(7, 0x00, 1)],
+                        ),
+                        password,
+                        checkbox_at(4, 3, 2, 80),
+                        uint16_numeric(8, 8, 2, 40),
+                        uint16_numeric(9, 9, 2, 38),
+                    ],
+                ),
+            ],
+        );
+        let packages = [
+            device_path_package(&DRIVER_PATH),
+            form_package_of(&[form_set, form_sets.concat()].concat()),
+            en_strings_package_of(&["N", "W", "P", "Password", "O", "Off", "On", "S", "X"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x55; 16], &packages.concat())
+    }
+
+    /// snapshot_hiidb_with a PASSWORD of 20 CHAR16s at byte 0 of AMITSESetup: X's bytes end in
+    /// its last 2, and S's follow them.
+    fn snapshot_hiidb() -> Vec<u8> {
+        snapshot_hiidb_with(password_on(3, 4, 2, 0))
+    }
+
+    /// The snapshot of snapshot_hiidb's driver: NStore holds 1, then 0x1234; AMITSESetup 40
+    /// bytes of 0xA5 for the password, then S's 0x5678, zeros, and P's 1.
+    fn snapshot_text() -> String {
+        let mut amitse_setup = [0; 81];
+        amitse_setup[..40].fill(0xA5);
+        amitse_setup[40..42].copy_from_slice(&[0x78, 0x56]);
+        amitse_setup[80] = 1;
+        [
+            block_resp(
+                &config_hdr(N_GUID, "NStore", &DRIVER_PATH),
+                0,
+                &[1, 0x34, 0x12],
+            ),
+            block_resp(
+                &config_hdr(P_GUID, "AMITSESetup", &DRIVER_PATH),
+                0,
+                &amitse_setup,
+            ),
+        ]
+        .join("&")
+    }
+
+    /// Variables that reach Runtime through efivarfs and hold none of snapshot_hiidb's.
+    fn no_variables() -> Rc<MemoryVariables> {
+        Rc::new(MemoryVariables::new(
+            VariableReach::Runtime,
+            VariableInterface::Efivarfs,
+        ))
+    }
+
+    /// The answers that get and list-questions give for each question of `names` of `hiidb`
+    /// through `variables` with the snapshot `text`, and what show-ifr shows; each response as
+    /// text and as JSON, after them.
+    fn answers_with_snapshot(
+        hiidb: &[u8],
+        names: &[&str],
+        variables: &Rc<MemoryVariables>,
+        text: &str,
+    ) -> (Vec<String>, Vec<String>, String, Vec<String>) {
+        let exported = || Some(ExportedConfig::new(text.to_owned()));
+        let mut outputs = Vec::new();
+        let mut got = Vec::new();
+        for name in names {
+            let response = HiiBackend::get_in(
+                hiidb,
+                *name,
+                None,
+                &GetOptions::default(),
+                shared(variables),
+                exported(),
+                None,
+                None,
+            )
+            .unwrap_or_else(|error| panic!("get {name}: {error:#}"));
+            got.extend(
+                response
+                    .responses
+                    .iter()
+                    .map(|response| response.question.answer.clone()),
+            );
+            outputs.push(format!("{response:#?}"));
+            outputs
+                .push(String::from_utf8_lossy(&simplejson_protocol::serialize(&response)).into());
+        }
+        let questions = HiiBackend::list_questions_in(
+            hiidb,
+            &ListQuestionsOptions::default(),
+            shared(variables),
+            exported(),
+            None,
+        )
+        .expect("list questions");
+        let listed = names
+            .iter()
+            .flat_map(|name| {
+                questions
+                    .iter()
+                    .filter(move |question| question.name == *name)
+                    .map(|question| question.answer.clone())
+            })
+            .collect();
+        for question in &questions {
+            outputs.push(format!("{question:#?}"));
+            outputs.push(String::from_utf8_lossy(&simplejson_protocol::serialize(question)).into());
+        }
+        let ifr = HiiShowIfrResponse::from(
+            HiiBackend::show_ifr_in(
+                hiidb,
+                &ShowIfrOptions::default(),
+                shared(variables),
+                exported(),
+                None,
+            )
+            .expect("show the IFR"),
+        );
+        outputs.push(format!("{ifr:#?}"));
+        outputs.push(String::from_utf8_lossy(&simplejson_protocol::serialize(&ifr)).into());
+        (got, listed, ifr.readable_representation, outputs)
+    }
+
+    /// Asserts that no output of `outputs` shows a byte of the 0xA5 of a password.
+    #[track_caller]
+    fn assert_no_password_byte(outputs: &[String]) {
+        for output in outputs {
+            for needle in ["a5a5", "A5A5", "165"] {
+                assert!(!output.contains(needle), "{needle} in {output}");
+            }
+        }
+    }
+
+    /// get, list-questions and show-ifr, as text and as JSON, take the values of questions whose
+    /// variable is missing from the ExportConfig snapshot, tagged, also of those beside a password
+    /// in its VarStore, but show a question over the password's bytes withheld, and never those
+    /// bytes.
+    #[test]
+    fn missing_variables_show_snapshot_values_but_password_bytes_stay_withheld() {
+        let (got, listed, ifr, outputs) = answers_with_snapshot(
+            &snapshot_hiidb(),
+            &["N", "W", "O", "P", "S", "X"],
+            &no_variables(),
+            &snapshot_text(),
+        );
+
+        let want = [
+            "1 <snapshot>",
+            "4660 <snapshot>",
+            "On <snapshot>",
+            "1 <snapshot>",
+            "22136 <snapshot>",
+            WITHHELD,
+        ];
+        assert_eq!(got, want, "get");
+        assert_eq!(listed, want, "list-questions");
+        for shown in [
+            "1 <snapshot>",
+            "4660 <snapshot>",
+            "22136 <snapshot>",
+            WITHHELD,
+        ] {
             assert!(
-                by_prompt
-                    .1
-                    .as_ref()
-                    .is_some_and(|records| !records.is_empty()),
-                "{case}: get by prompt: ignored_ifr"
+                ifr.contains(&format!("-Answer: {shown}\n")),
+                "show-ifr lacks {shown:?}: {ifr}"
             );
-            assert_eq!(by_question_id, by_prompt, "{case}: by QuestionId");
         }
+        assert_no_password_byte(&outputs);
     }
 
-    /// Through variables that reach BootServices, get and set, with and without the setup
-    /// password bypass, refuse and touch no variable when a PASSWORD may sit in IFR that the
-    /// parser does not read: a FormSet that it ignores, a FormSet after one, and a FormSet in one
-    /// that has its End, which edk2's walk for FormSets finds. Through variables that reach
-    /// Runtime, the questions around that IFR read, but those on a variable that a VARSTORE or
-    /// VARSTORE_EFI op in an ignored FormSet declares, which is withheld whole. Without IFR that it
-    /// ignores, the PASSWORD that it reads leaves get and the bypassed set open.
+    /// The snapshot fills in only missing variables of the package list's driver, and none in a
+    /// HiiDB with a PASSWORD op whose VarStore is unknown, which could be any, or with IFR that the
+    /// parser drops, which could hold one: the warning says that the password cannot be withheld.
     #[test]
-    fn unread_password_regions_close_boot_services() {
-        const PASSWORD_STORE_GUID: [u8; 16] = [0x5A; 16];
-        let password_key = VariableKey {
-            name: "UefisettingsPw".to_string(),
-            guid: Guid::from(PASSWORD_STORE_GUID),
+    fn snapshot_values_show_only_for_missing_variables_of_their_driver() {
+        const REFUSED: &str = "; as the VarStore of that password is unknown, uefisettings \
+            cannot withhold its bytes, so no value is shown from the ExportConfig snapshot";
+        let with_n_store = no_variables();
+        with_n_store.insert(n_store(), NV_BS_RT, &[0, 0, 0]);
+        let short_n_store = no_variables();
+        short_n_store.insert(n_store(), NV_BS_RT, &[0]);
+        let without_path = {
+            let packages = [
+                form_package(&[
+                    var_store(1, N_GUID, "NStore", 3),
+                    form(1, &[checkbox_on(1, 1, 1)]),
+                ]),
+                en_strings_package_of(&["N"]),
+                END_PACKAGE.to_vec(),
+            ];
+            package_list_with_guid([0x55; 16], &packages.concat())
         };
-        let password_store =
-            || var_store_efi_of(2, PASSWORD_STORE_GUID, "UefisettingsPw", NV_BS_RT, 20);
-        let q1 = form_set(&[
-            dropped_password_var_store(),
-            form(1, &[checkbox_on(1, 1, 1)]),
-        ]);
-        let q3 = form_set(&[
-            dropped_password_var_store(),
-            form(1, &[checkbox_on(3, 3, 1)]),
-        ]);
-        // Q3 and a PASSWORD on the variable of password_key
-        let q3_and_password = || {
-            form_set(&[
-                dropped_password_var_store(),
-                password_store(),
-                form(1, &[checkbox_on(3, 3, 1), password_on(2, 2, 2, 0)]),
-            ])
+        let other_driver = snapshot_text().replace(
+            &config_hdr(N_GUID, "NStore", &DRIVER_PATH),
+            &config_hdr(N_GUID, "NStore", &[0x7F, 0xFF, 0x04, 0x00]),
+        );
+        let withheld_n = format!("{PASSWORD_BYTES} <IFR default: 0>");
+        let dropped_form_set = {
+            // a VARSTORE op that ends after 4 of the 20 bytes before its Name
+            let malformed = operation(VAR_STORE, false, &[0x00; 4]);
+            let packages = [
+                device_path_package(&DRIVER_PATH),
+                form_package_of(
+                    &[
+                        form_set(&[
+                            var_store(1, N_GUID, "NStore", 3),
+                            form(1, &[checkbox_on(1, 1, 1)]),
+                        ]),
+                        form_set(&dropped_password_second_ops(malformed)),
+                    ]
+                    .concat(),
+                ),
+                en_strings_package_of(&["N", "Password"]),
+                END_PACKAGE.to_vec(),
+            ];
+            package_list_with_guid([0x55; 16], &packages.concat())
         };
-        let read = Ok(vec!["1".to_string()]);
-        let withheld = Ok(vec![format!("{PASSWORD_BYTES} <IFR default: 0>")]);
-        // each with what get of Q1 and Q3 answers through variables that reach Runtime
-        let cases: [(&str, Vec<u8>, _); 4] = [
+        for (case, hiidb, variables, text, want, refused) in [
             (
-                "a PASSWORD in an ignored FormSet",
-                [
-                    q1.clone(),
-                    form_set(&[
-                        password_store(),
-                        form(1, &[password_on(2, 2, 2, 0)]),
-                        short_var_store(),
-                    ]),
-                    q3,
-                ]
-                .concat(),
-                read.clone(),
+                "a variable that exists",
+                snapshot_hiidb(),
+                with_n_store,
+                snapshot_text(),
+                "0",
+                false,
             ),
             (
-                "a PASSWORD in a FormSet after an ignored one",
-                [
-                    q1.clone(),
-                    form_set(&[password_store(), short_var_store()]),
-                    q3_and_password(),
-                ]
-                .concat(),
-                read.clone(),
+                "a variable shorter than its VarStore",
+                snapshot_hiidb(),
+                short_n_store,
+                snapshot_text(),
+                "<VStoreError: EFI variable NStore-8c78a505-baa0-4c4a-869f-000000001401 \
+                 holds 1 data bytes, fewer than the 3 of its VarStore> <IFR default: 0>",
+                false,
             ),
             (
-                // the nested FormSet's VARSTORE_EFI of dropped_password_store is in the ignored one
-                "a PASSWORD in a FormSet in an ignored one that has its End",
-                [
-                    q1.clone(),
-                    form_set(&[
-                        dropped_password_var_store(),
-                        short_var_store(),
-                        q3_and_password(),
-                    ]),
-                ]
-                .concat(),
-                withheld,
+                "a list without a device path package",
+                without_path,
+                no_variables(),
+                snapshot_text(),
+                MISSING_N_STORE,
+                false,
+            ),
+            (
+                "another driver's NStore",
+                snapshot_hiidb(),
+                no_variables(),
+                other_driver,
+                MISSING_N_STORE,
+                false,
+            ),
+            (
+                "a PASSWORD op on VarStore 9, which only another FormSet declares",
+                snapshot_hiidb_beside(
+                    password_on(3, 4, 9, 0),
+                    &[form_set_with_guid(
+                        [0x13; 16],
+                        &[var_store(9, P_GUID, "AMITSESetup", 81), form(3, &[])],
+                    )],
+                ),
+                no_variables(),
+                snapshot_text(),
+                MISSING_N_STORE,
+                true,
+            ),
+            (
+                "a FormSet that the parser drops, whose PASSWORD ops are unknown, and whose \
+                 VARSTORE's Guid runs past the form package, so every variable is withheld",
+                dropped_form_set,
+                no_variables(),
+                snapshot_text(),
+                withheld_n.as_str(),
+                true,
+            ),
+        ] {
+            let mut answers = None;
+            let logged = logged_by(|| {
+                answers = Some(answers_with_snapshot(&hiidb, &["N"], &variables, &text));
+            });
+            let (got, listed, _, outputs) = answers.expect("the answers");
+
+            assert_eq!(got, [want], "{case}: get");
+            assert_eq!(listed, [want], "{case}: list-questions");
+            assert_no_password_byte(&outputs);
+            assert_eq!(
+                logged.iter().any(|message| message.ends_with(REFUSED)),
+                refused,
+                "{case}: the refusal in {logged:?}"
+            );
+        }
+    }
+
+    /// The snapshot drops the passwords of IFR outside any FormSet as get withholds them
+    /// (PasswordQuestions::of_lists). The FormSet of snapshot_hiidb's N and its PASSWORD on
+    /// AMITSESetup, VarStoreId 2, follows `outside`, then a FormSet whose UINT16 NUMERIC T is at
+    /// byte 0 of Shadow, whose 40 snapshot bytes are 0xA5 too:
+    /// - a VARSTORE outside any FormSet of VarStoreId 2 for Shadow keeps the password there too, so
+    ///   T shows withheld while N shows its snapshot value;
+    /// - a PASSWORD outside any FormSet leaves the password's bytes unknown, so the snapshot shows
+    ///   nothing, which the warning says;
+    /// - a VARSTORE_NAME_VALUE there of VarStoreId 2, whose driver may keep the password in any
+    ///   variable, closes every variable, and the snapshot with them.
+    #[test]
+    fn the_snapshot_drops_the_passwords_of_ifr_outside_any_form_set() {
+        const REFUSED: &str = "; as the VarStore of that password is unknown, uefisettings \
+            cannot withhold its bytes, so no value is shown from the ExportConfig snapshot";
+        let hiidb = |outside: Vec<u8>| {
+            let packages = [
+                device_path_package(&DRIVER_PATH),
+                form_package_of(
+                    &[
+                        outside,
+                        form_set(&[
+                            var_store(1, N_GUID, "NStore", 3),
+                            var_store(2, P_GUID, "AMITSESetup", 81),
+                            form(1, &[checkbox_on(1, 1, 1), password_on(3, 4, 2, 0)]),
+                        ]),
+                        form_set(&[
+                            var_store(7, OTHER_GUID, "Shadow", 81),
+                            form(2, &[uint16_numeric(8, 8, 7, 0)]),
+                        ]),
+                    ]
+                    .concat(),
+                ),
+                en_strings_package_of(&["N", "W", "P", "Password", "O", "Off", "On", "T"]),
+                END_PACKAGE.to_vec(),
+            ];
+            package_list_with_guid([0x55; 16], &packages.concat())
+        };
+        let text = [
+            snapshot_text(),
+            block_resp(
+                &config_hdr(OTHER_GUID, "Shadow", &DRIVER_PATH),
+                0,
+                &[[0xA5; 40].as_slice(), &[0; 41]].concat(),
+            ),
+        ]
+        .join("&");
+        for (case, outside, want, refused) in [
+            (
+                "a VARSTORE of VarStoreId 2 for Shadow",
+                var_store(2, OTHER_GUID, "Shadow", 81),
+                ["1 <snapshot>", WITHHELD],
+                false,
             ),
             (
-                "control: a PASSWORD in a FormSet after a FormSet that parses",
+                "a PASSWORD",
+                password_on(9, 4, 2, 0),
                 [
-                    q1,
-                    form_set(&[dropped_password_var_store()]),
-                    q3_and_password(),
-                ]
-                .concat(),
-                read,
+                    MISSING_N_STORE,
+                    "<ValueUnavailable: no EFI variable \
+                  Shadow-33333333-3333-3333-3333-333333333333; HII buffer varstore requires \
+                  EFI_HII_CONFIG_ACCESS_PROTOCOL>",
+                ],
+                true,
             ),
-        ];
-        let variables_of = |reach, interface| {
-            let variables = MemoryVariables::new(reach, interface);
-            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-            variables.insert(password_key.clone(), NV_BS_RT, &[0x00; 20]);
-            Rc::new(variables)
-        };
-        let refused = three_questions_refusal();
-        for (name, ifr, runtime_answers) in cases {
-            let hiidb = three_questions_hiidb(&ifr);
+        ] {
+            let mut answers = None;
+            let logged = logged_by(|| {
+                answers = Some(answers_with_snapshot(
+                    &hiidb(outside),
+                    &["N", "T"],
+                    &no_variables(),
+                    &text,
+                ));
+            });
+            let (got, listed, _, outputs) = answers.expect("the answers");
 
-            let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
-            for question in ["Q1", "Q3"] {
-                assert_eq!(
-                    answers_or_error_of(&hiidb, question, &runtime),
-                    runtime_answers,
-                    "{name}: Runtime: get {question}"
-                );
-            }
+            assert_eq!(got, want, "{case}: get");
+            assert_eq!(listed, want, "{case}: list-questions");
+            assert_no_password_byte(&outputs);
+            assert_eq!(
+                logged.iter().any(|message| message.ends_with(REFUSED)),
+                refused,
+                "{case}: the refusal in {logged:?}"
+            );
+        }
 
-            let control = name.starts_with("control");
-            for question in ["Q1", "Q3"] {
-                // each question on its own variables: a bypassed set writes byte 0, which both
-                // CHECKBOXes read
-                let boot_services = variables_of(
-                    VariableReach::BootServices,
-                    VariableInterface::VariableServices,
-                );
-                let got = answers_or_error_of(&hiidb, question, &boot_services);
-                match control {
-                    false => assert!(
-                        got.as_ref().is_err_and(|error| error.starts_with(&refused)),
-                        "{name}: BootServices: get {question}: {got:?}"
-                    ),
-                    true => assert_eq!(
-                        got,
-                        Ok(vec!["1".to_string()]),
-                        "{name}: BootServices: get {question}"
-                    ),
-                }
-                for policy in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
-                    let got = set_count_of(&hiidb, question, policy, &boot_services);
-                    match (control, policy) {
-                        (false, _) => assert!(
-                            got.as_ref().is_err_and(|error| error.starts_with(&refused)),
-                            "{name}: BootServices: set {question} {policy:?}: {got:?}"
-                        ),
-                        (true, UnsafeOperations::Refuse) => assert!(
-                            got.as_ref().is_err_and(|error| error
-                                .starts_with("this HiiDB declares a setup password question")),
-                            "{name}: BootServices: set {question} {policy:?}: {got:?}"
-                        ),
-                        (true, _) => assert_eq!(
-                            got,
-                            Ok(1),
-                            "{name}: BootServices: set {question} {policy:?}"
-                        ),
-                    }
-                }
-                match control {
-                    false => {
-                        assert_eq!(
-                            boot_services.reads(),
-                            [],
-                            "{name}: BootServices: {question}: reads"
-                        );
-                        assert_eq!(
-                            boot_services.writes_to(&dropped_password_store()),
-                            [],
-                            "{name}: BootServices: {question}: writes"
-                        );
-                    }
-                    true => assert_eq!(
-                        boot_services.writes_to(&dropped_password_store()),
-                        [(0, vec![0])],
-                        "{name}: BootServices: {question}: the bypassed set writes"
-                    ),
-                }
-                assert_eq!(
-                    boot_services.reads_of(&password_key),
-                    Vec::<u16>::new(),
-                    "{name}: BootServices: {question}: the PASSWORD's variable stays unread"
-                );
-                assert_eq!(
-                    boot_services.writes_to(&password_key),
-                    [],
-                    "{name}: BootServices: {question}: no PASSWORD write"
-                );
-            }
+        let hiidb = hiidb(var_store_name_value(2, OTHER_GUID));
+        for name in ["N", "T"] {
+            let got = HiiBackend::get_in(
+                &hiidb,
+                name,
+                None,
+                &GetOptions::default(),
+                shared(&no_variables()),
+                Some(ExportedConfig::new(text.clone())),
+                None,
+                None,
+            )
+            .map(|response| format!("{response:#?}"))
+            .map_err(|error| format!("{error:#}"));
+            assert!(
+                got.as_ref()
+                    .is_err_and(|error| error.ends_with(ANY_VARIABLE)),
+                "a VARSTORE_NAME_VALUE of VarStoreId 2: get {name}: {got:?}"
+            );
+            assert_no_password_byte(&[got.unwrap_or_else(|error| error)]);
         }
     }
 
-    /// A first FormSet that does not parse or nests too deep is ignored like a later one: through
-    /// variables that reach Runtime the FormSet after it reads, and through variables that reach
-    /// BootServices a PASSWORD in it still closes get and set, bypassed or not, with no variable
-    /// read or written.
+    /// A form that a malformed op disables (UEFI 2.11 §33.2.5.10.1) has no question that the
+    /// snapshot answers, and the snapshot withholds the bytes of its PASSWORD as get does: a
+    /// question over them shows none, the other bytes of that storage show. A PASSWORD op there
+    /// without its question header leaves its bytes unknown, so the snapshot is not read.
     #[test]
-    fn a_malformed_first_form_set_is_ignored_like_a_later_one() {
-        // the FormSet's own scope and these
-        let too_deep = nested(&subtitle_scope(5), MAX_SCOPE_NESTING, &[]);
-        let q3 = form_set(&[
-            dropped_password_var_store(),
-            form(1, &[checkbox_on(3, 3, 1)]),
-        ]);
-        let cases = [
-            (
-                "a first FormSet that does not parse",
-                form_set(&[
-                    ignored_form_set_var_store(),
-                    form(1, &[password_on(2, 2, 2, 0)]),
-                    short_var_store(),
+    fn the_snapshot_answers_no_question_of_a_disabled_form_and_withholds_its_password() {
+        const REFUSED: &str = "; as the VarStore of that password is unknown, uefisettings \
+            cannot withhold its bytes, so no value is shown from the ExportConfig snapshot";
+        // the forms of snapshot_hiidb, with W and the PASSWORD in a form 2 that a CHECKBOX op
+        // ending after 4 of the 12 bytes of its data disables, whose first 2 give VarStoreId 2 to
+        // the question header of a PASSWORD op that runs on into it
+        let hiidb_with = |password: Vec<u8>| {
+            let packages = [
+                device_path_package(&DRIVER_PATH),
+                form_package(&[
+                    var_store(1, N_GUID, "NStore", 3),
+                    var_store(2, P_GUID, "AMITSESetup", 81),
+                    form(
+                        1,
+                        &[
+                            checkbox_on(1, 1, 1),
+                            uint16_numeric(8, 8, 2, 40),
+                            uint16_numeric(9, 9, 2, 38),
+                        ],
+                    ),
+                    form(
+                        2,
+                        &[
+                            uint16_numeric(2, 2, 1, 1),
+                            password,
+                            operation(CHECKBOX, false, &[0x02, 0x00, 0x00, 0x00]),
+                        ],
+                    ),
                 ]),
+                en_strings_package_of(&["N", "W", "P", "Password", "O", "Off", "On", "S", "X"]),
+                END_PACKAGE.to_vec(),
+            ];
+            package_list_with_guid([0x55; 16], &packages.concat())
+        };
+        for (case, password, names, want, refused) in [
+            (
+                "a PASSWORD",
+                password_on(3, 4, 2, 0),
+                &["N", "W", "S", "X"][..],
+                &["1 <snapshot>", "22136 <snapshot>", WITHHELD][..],
+                false,
             ),
             (
-                "a first FormSet nested too deep",
-                form_set(&[
-                    ignored_form_set_var_store(),
-                    form(1, &[password_on(2, 2, 2, 0)]),
-                    too_deep,
-                ]),
+                "a PASSWORD op without its question header",
+                operation(PASSWORD, false, &[3, 0, 4, 0]),
+                &["N", "W"],
+                &[MISSING_N_STORE],
+                true,
             ),
-        ];
-        let refused = format!("{}0 of a form package: ", three_questions_refusal());
-        let variables_of = |reach, interface| {
-            let variables = MemoryVariables::new(reach, interface);
-            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-            Rc::new(variables)
-        };
-        for (name, first) in cases {
-            let hiidb = three_questions_hiidb(&[first, q3.clone()].concat());
-
-            let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
-            assert_eq!(
-                answers_or_error_of(&hiidb, "Q3", &runtime),
-                Ok(vec!["1".to_string()]),
-                "{name}: Runtime: get Q3"
-            );
+        ] {
+            let mut answers = None;
+            let logged = logged_by(|| {
+                answers = Some(answers_with_snapshot(
+                    &hiidb_with(password),
+                    names,
+                    &no_variables(),
+                    &snapshot_text(),
+                ));
+            });
+            let (got, listed, ifr, outputs) = answers.expect("the answers");
 
-            let boot_services = variables_of(
-                VariableReach::BootServices,
-                VariableInterface::VariableServices,
-            );
-            let got = answers_or_error_of(&hiidb, "Q3", &boot_services);
+            assert_eq!(got, want, "{case}: get");
+            assert_eq!(listed, want, "{case}: list-questions");
             assert!(
-                got.as_ref().is_err_and(|error| error.starts_with(&refused)),
-                "{name}: BootServices: get Q3: {got:?}"
+                !ifr.contains("4660"),
+                "{case}: show-ifr shows W's snapshot value: {ifr}"
             );
-            for policy in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
-                let got = set_count_of(&hiidb, "Q3", policy, &boot_services);
-                assert!(
-                    got.as_ref().is_err_and(|error| error.starts_with(&refused)),
-                    "{name}: BootServices: set Q3 {policy:?}: {got:?}"
-                );
-            }
-            assert_eq!(boot_services.reads(), [], "{name}: BootServices: reads");
+            assert_no_password_byte(&outputs);
             assert_eq!(
-                boot_services.writes_to(&dropped_password_store()),
-                [],
-                "{name}: BootServices: writes"
+                logged.iter().any(|message| message.ends_with(REFUSED)),
+                refused,
+                "{case}: the refusal in {logged:?}"
             );
         }
     }
 
-    /// The offsets of the records of IFR that uefisettings ignores that `error` names, in order.
-    fn offsets_named(error: &str) -> Vec<String> {
-        error
-            .split("uefisettings ignores at offset ")
-            .skip(1)
-            .map(|rest| rest.split(' ').next().unwrap_or_default().to_string())
-            .collect()
-    }
-
-    /// Through variables that reach BootServices, get's refusal names each FormSet that
-    /// uefisettings ignores, at its offset.
-    #[test]
-    fn the_refusal_names_every_ignored_form_set() {
-        let q1 = form_set(&[
-            dropped_password_var_store(),
-            form(1, &[checkbox_on(1, 1, 1)]),
-        ]);
-        let ignored = form_set(&[dropped_password_var_store(), short_var_store()]);
-        let hiidb = three_questions_hiidb(&[q1.clone(), ignored.clone(), ignored.clone()].concat());
-        let variables = MemoryVariables::new(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-        let error = answers_or_error_of(&hiidb, "Q1", &Rc::new(variables))
-            .expect_err("BootServices: get Q1");
-        let want = [q1.len(), q1.len() + ignored.len()].map(|offset| offset.to_string());
-        assert_eq!(offsets_named(&error), want, "{error}");
-    }
-
-    /// The refusals that name the IFR that uefisettings ignores name its first 16 records and
-    /// count the rest: get's through variables that reach BootServices, and set's of a question
-    /// that no FormSet that it reads holds, through variables that reach Runtime.
+    /// The questions of a VARSTORE_EFI without runtime access, whose variable Linux does not
+    /// see, take their values from the snapshot.
     #[test]
-    fn refusals_name_16_ignored_form_sets_and_count_the_rest() {
-        let q1 = form_set(&[
-            dropped_password_var_store(),
-            form(1, &[checkbox_on(1, 1, 1)]),
-        ]);
-        let ignored = form_set(&[dropped_password_var_store(), short_var_store()]);
-        let hiidb = three_questions_hiidb(&[q1.clone(), ignored.repeat(17)].concat());
-        let want: Vec<String> = (0..16)
-            .map(|index| (q1.len() + index * ignored.len()).to_string())
-            .collect();
-        let variables_of = |reach, interface| {
-            let variables = MemoryVariables::new(reach, interface);
-            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-            Rc::new(variables)
-        };
+    fn boot_service_only_efi_variables_show_snapshot_values() {
+        let packages = [
+            device_path_package(&DRIVER_PATH),
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS, 1),
+                form(1, &[checkbox_on(1, 1, 1)]),
+            ]),
+            en_strings_package_of(&["Q"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let text = block_resp(&config_hdr([0; 16], "Setup", &DRIVER_PATH), 0, &[1]);
 
-        let boot_services = variables_of(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        let error =
-            answers_or_error_of(&hiidb, "Q1", &boot_services).expect_err("BootServices: get Q1");
-        assert_eq!(offsets_named(&error), want, "BootServices: get Q1: {error}");
-        assert!(
-            error.contains("; and 1 more; as the variable of that password is unknown"),
-            "BootServices: get Q1: {error}"
-        );
+        let (got, listed, ifr, _) = answers_with_snapshot(&hiidb, &["Q"], &no_variables(), &text);
 
-        let runtime = variables_of(VariableReach::Runtime, VariableInterface::Efivarfs);
-        let error = set_count_of(&hiidb, "Q2", UnsafeOperations::Refuse, &runtime)
-            .expect_err("Runtime: set Q2");
-        assert_eq!(offsets_named(&error), want, "Runtime: set Q2: {error}");
-        assert!(error.ends_with("; and 1 more"), "Runtime: set Q2: {error}");
+        assert_eq!(got, ["1 <snapshot>"], "get");
+        assert_eq!(listed, ["1 <snapshot>"], "list-questions");
+        assert!(ifr.contains("-Answer: 1 <snapshot>\n"), "show-ifr: {ifr}");
     }
 
-    /// get and set name the IFR that uefisettings ignores in a HiiDB, through variables that
-    /// reach Runtime too, where it closes nothing: get and set list it in the ignored_ifr of their
-    /// answer, a question in it or not, and set's refusal of a question that no FormSet it reads
-    /// holds names it. Without such IFR, neither answer has an ignored_ifr and the refusal names
-    /// the question alone.
+    /// A value that an EFI_IFR_VALUE or READ expression gives is tagged when the snapshot gave
+    /// THIS or a value that the expression took, and only then.
     #[test]
-    fn get_and_set_name_the_ifr_that_uefisettings_ignores() {
-        let q1 = form_set(&[
-            dropped_password_var_store(),
-            form(1, &[checkbox_on(1, 1, 1)]),
-        ]);
-        // a FormSet that uefisettings ignores, with the CHECKBOX Q2 of string ID 2
-        let ignored = form_set(&[
-            ignored_form_set_var_store(),
-            form(1, &[checkbox_on(2, 2, 2)]),
-            short_var_store(),
-        ]);
-        let q3 = form_set(&[
-            dropped_password_var_store(),
-            form(1, &[checkbox_on(3, 3, 1)]),
-        ]);
-        let hiidb = three_questions_hiidb(&[q1.clone(), ignored, q3.clone()].concat());
-        let without = three_questions_hiidb(&[q1.clone(), q3].concat());
-        let list = Guid::from(DROPPED_PASSWORD_LIST_GUID).to_string();
-        let reason = format!(
-            "the FormSet {}, which holds, outside its forms, an op shorter than its minimum, which \
-             UEFI 2.11 §33.2.5.10.1 calls malformed, in no form for that section to disable: the \
-             EFI_IFR_VARSTORE op at offset ",
-            Guid::from([0x11; 16])
-        );
-        let offset = q1.len();
-        let variables = || {
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-            variables.insert(dropped_password_store(), NV_BS_RT, &[0xAA; 20]);
-            Rc::new(variables)
-        };
-        // the ignored_ifr of the JSON of `answer`: (package list, offset, whether the reason is
-        // `reason`), None if unset
-        let ignored_ifr_of = |answer: Vec<u8>| -> Option<Vec<(String, u64, bool)>> {
-            let answer: serde_json::Value =
-                serde_json::from_slice(&answer).expect("parse the JSON of an answer");
-            let records = answer.get("ignored_ifr")?.as_array()?;
-            Some(
-                records
-                    .iter()
-                    .map(|record| {
-                        (
-                            record["package_list"]
-                                .as_str()
-                                .unwrap_or_default()
-                                .to_string(),
-                            record["offset"].as_u64().unwrap_or(u64::MAX),
-                            record["reason"]
-                                .as_str()
-                                .is_some_and(|got| got.starts_with(&reason)),
-                        )
-                    })
-                    .collect(),
-            )
-        };
-        let want = Some(vec![(
-            list.clone(),
-            u64::try_from(offset).expect("offset"),
-            true,
-        )]);
-        let get = |hiidb: &[u8], question: &str| {
-            HiiBackend::get_in(
-                hiidb,
-                question,
-                None,
-                &GetOptions::default(),
-                shared(&variables()),
-                None,
-                None,
-            )
-            .unwrap_or_else(|error| panic!("get {question}: {error:#}"))
+    fn expression_values_show_whether_the_snapshot_gave_them() {
+        const LIVE: u16 = 2;
+        let live = VariableKey {
+            name: "Live".to_owned(),
+            guid: Guid::from(N_GUID),
         };
-        let set = |hiidb: &[u8], question: &str| {
-            let variables = variables();
-            set_responses(
-                hiidb,
-                question,
-                &SetValue::Text("0".to_owned()),
-                None,
-                &SetOptions::default(),
-                shared(&variables),
-                &*variables,
-                None,
-            )
-            .map_err(|error| error.to_string())
+        let variables = no_variables();
+        variables.insert(live, NV_BS_RT, &[0; 4]);
+        // a UINT8 NUMERIC of QuestionId and prompt `id` at VarOffset `offset` of `var_store_id`,
+        // whose `expression` op holds `ops`
+        let numeric = |id: u16, var_store_id: u16, offset: u16, expression: u8, ops: Vec<u8>| {
+            let data = [
+                question_header_with(id, id, var_store_id, offset, 0x00),
+                vec![0x00, 0, 255, 1], // Flags, MinValue, MaxValue, Step
+            ]
+            .concat();
+            [
+                operation(NUMERIC, true, &data),
+                operation(expression, true, &[]),
+                ops,
+                END.to_vec(),
+                END.to_vec(),
+            ]
+            .concat()
         };
+        let n = || operation(QUESTION_REF1, false, &1u16.to_le_bytes());
+        let packages = [
+            device_path_package(&DRIVER_PATH),
+            form_package(&[
+                var_store(1, N_GUID, "NStore", 3),
+                var_store(LIVE, N_GUID, "Live", 4),
+                form(
+                    1,
+                    &[
+                        checkbox_on(1, 1, 1),
+                        numeric(2, LIVE, 0, VALUE, n()),
+                        numeric(3, LIVE, 1, VALUE, uint8(7)),
+                        numeric(4, LIVE, 2, READ, n()),
+                        numeric(5, LIVE, 3, READ, uint8(5)),
+                        numeric(6, 1, 1, READ, operation(THIS, false, &[])),
+                    ],
+                ),
+            ]),
+            en_strings_package_of(&["N", "VN", "VC", "RN", "RC", "RT"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
 
-        for (question, answers) in [("Q3", vec!["1"]), ("Q2", vec![])] {
-            let got = get(&hiidb, question);
-            let got_answers: Vec<&str> = got
-                .responses
-                .iter()
-                .map(|response| response.question.answer.as_str())
-                .collect();
-            assert_eq!(got_answers, answers, "get {question}: answers");
-            assert_eq!(
-                ignored_ifr_of(simplejson_protocol::serialize(&got).to_vec()),
-                want,
-                "get {question}: ignored_ifr"
+        let (got, listed, ifr, _) = answers_with_snapshot(
+            &hiidb,
+            &["N", "VN", "VC", "RN", "RC", "RT"],
+            &variables,
+            &snapshot_text(),
+        );
+
+        let want = [
+            "1 <snapshot>",
+            "1 <snapshot>",
+            "7",
+            "1 <snapshot>",
+            "5",
+            "52 <snapshot>",
+        ];
+        assert_eq!(got, want, "get");
+        assert_eq!(listed, want, "list-questions");
+        for shown in want {
+            assert!(
+                ifr.contains(&format!("-Answer: {shown}\n")),
+                "show-ifr lacks {shown:?}: {ifr}"
             );
         }
-        assert_eq!(
-            ignored_ifr_of(simplejson_protocol::serialize(get(&without, "Q3")).to_vec()),
-            None,
-            "get Q3 without ignored IFR: ignored_ifr"
-        );
+    }
 
-        let set_q3 = set(&hiidb, "Q3").unwrap_or_else(|error| panic!("set Q3: {error}"));
-        assert_eq!(set_q3.responses.len(), 1, "set Q3: responses");
-        assert_eq!(
-            ignored_ifr_of(simplejson_protocol::serialize(&set_q3).to_vec()),
-            want,
-            "set Q3: ignored_ifr"
-        );
-        let set_q3 = set(&without, "Q3").unwrap_or_else(|error| panic!("set Q3: {error}"));
-        assert_eq!(
-            ignored_ifr_of(simplejson_protocol::serialize(&set_q3).to_vec()),
-            None,
-            "set Q3 without ignored IFR: ignored_ifr"
+    /// The questions of name/value storage take their numbers from the snapshot by the labels
+    /// that their VarName strings give, unless a number does not fit the question; zeros before
+    /// its digits do.
+    #[test]
+    fn name_value_questions_show_snapshot_numbers() {
+        let packages = [
+            device_path_package(&DRIVER_PATH),
+            form_package(&[
+                var_store_name_value(3, N_GUID),
+                form(
+                    1,
+                    &[
+                        checkbox_at(1, 1, 3, 5),
+                        uint16_numeric(2, 2, 3, 6),
+                        checkbox_at(3, 3, 3, 7),
+                        checkbox_at(4, 4, 3, 8),
+                        checkbox_at(5, 9, 3, 10),
+                    ],
+                ),
+            ]),
+            en_strings_package_of(&[
+                "C", "V", "X", "U", "Flag", "Word", "Wide", "Unset", "Z", "Padded",
+            ]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let text = format!(
+            "{}&Flag=01&Word=1234&Wide=0102&Padded=0001",
+            config_hdr(N_GUID, "", &DRIVER_PATH)
         );
 
-        let got = set(&hiidb, "Q2");
-        let refusal = format!(
-            "no question \"Q2\" in the HiiDB, but it may be in the IFR that uefisettings ignores \
-             at offset {offset} of a form package of package list {list}: {reason}"
-        );
-        assert!(
-            got.as_ref().is_err_and(|error| error.starts_with(&refusal)),
-            "set Q2: {got:?}"
-        );
-        assert_eq!(
-            set(&without, "Q2").map(drop),
-            Err("no question \"Q2\" in the HiiDB".to_string()),
-            "set Q2 without ignored IFR"
-        );
+        let (got, listed, ifr, _) =
+            answers_with_snapshot(&hiidb, &["C", "V", "X", "U", "Z"], &no_variables(), &text);
+
+        let want = [
+            "1 <snapshot>",
+            "4660 <snapshot>",
+            "<ValueUnavailable: its number in the ExportConfig snapshot does not fit in 8 bits> \
+             <IFR default: 0>",
+            "<ValueUnavailable: HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL> \
+             <IFR default: 0>",
+            "1 <snapshot>",
+        ];
+        assert_eq!(got, want, "get");
+        assert_eq!(listed, want, "list-questions");
+        for shown in ["1 <snapshot>", "4660 <snapshot>"] {
+            assert!(
+                ifr.contains(&format!("-Answer: {shown}\n")),
+                "show-ifr lacks {shown:?}: {ifr}"
+            );
+        }
     }
 
-    /// A HiiDB of two package lists: one whose FormSet declares no VarStore, then one whose
-    /// question Q, on the EFI variable Setup, is grayed out when question 2, on `var_store`, is 1.
-    fn access_level_hiidb(var_store: Vec<u8>) -> Vec<u8> {
+    /// A STRING of name/value storage, of MaxSize 4, takes its characters from its snapshot
+    /// setting, 4 hex digits each, as edk2-stable202608 SetupBrowserDxe/Setup.c BufferToValue
+    /// reads them (:1564-1579), while a CHECKBOX there takes its number: up to a NULL, as UEFI
+    /// 2.11 §33.2.5.4.9 ends the hex dump, or MaxSize characters, as Setup.c sets its own
+    /// (:2139-2148), and NULLs past them; an empty setting is an empty string, as Setup.c writes
+    /// one. A setting of digits that are no `<String>` (UEFI 2.11 §35.2.1.2) or of more than
+    /// MaxSize characters gives none, where Setup.c would cut them (:1557-1561); one that the
+    /// snapshot lacks says why it has no value, as a CHECKBOX does, and so does a CHECKBOX of an
+    /// empty setting, whose number Setup.c would not write (:1580-1590). An ORDERED_LIST there
+    /// takes its setting as a number, least significant byte first, as BufferToValue reads every
+    /// question that holds no string (:1505, :1580-1590).
+    #[test]
+    fn name_value_strings_take_their_characters_from_the_snapshot() {
+        let ordered_list = [
+            operation(
+                ORDERED_LIST,
+                true,
+                &[question_header_with(21, 21, 3, 22, 0x00), vec![4, 0x00]].concat(),
+            ),
+            flagged_option(23, 0x00, 1),
+            flagged_option(24, 0x00, 2),
+            flagged_option(25, 0x00, 3),
+            flagged_option(26, 0x00, 4),
+            END.to_vec(),
+        ]
+        .concat();
         let packages = [
+            device_path_package(&DRIVER_PATH),
             form_package(&[
-                var_store_efi(1, "Setup", NV_BS_RT, 1),
-                var_store,
+                var_store_name_value(3, N_GUID),
                 form(
                     1,
                     &[
-                        checkbox_on(2, 2, 2),
-                        conditional(GRAY_OUT_IF, eq_id_val_of(2, 1), &[checkbox_on(1, 1, 1)]),
+                        string_on(1, 1, (3, 3), (0, 4), &[]),
+                        checkbox_at(2, 2, 3, 4),
+                        string_on(5, 5, (3, 6), (0, 4), &[]),
+                        string_on(7, 7, (3, 8), (0, 4), &[]),
+                        string_on(9, 9, (3, 10), (0, 4), &[]),
+                        string_on(11, 11, (3, 12), (0, 4), &[]),
+                        string_on(13, 13, (3, 14), (0, 4), &[]),
+                        string_on(15, 15, (3, 16), (0, 4), &[]),
+                        string_on(17, 17, (3, 18), (0, 4), &[]),
+                        checkbox_at(19, 19, 3, 20),
+                        ordered_list,
                     ],
                 ),
             ]),
-            en_strings_package(b'Q'),
+            en_strings_package_of(&[
+                "S",
+                "C",
+                "Text",
+                "Flag",
+                "Unset",
+                "Gone",
+                "Nul",
+                "NulText",
+                "Odd",
+                "OddText",
+                "Long",
+                "LongText",
+                "Full",
+                "FullText",
+                "Padded",
+                "PaddedText",
+                "Empty",
+                "EmptyText",
+                "Cl",
+                "Cleared",
+                "L",
+                "Order",
+                "One",
+                "Two",
+                "Three",
+                "Four",
+            ]),
             END_PACKAGE.to_vec(),
         ];
-        [
-            form_set_list([0x33; 16], b'A'),
-            package_list_with_guid([0x55; 16], &packages.concat()),
-        ]
-        .concat()
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let text = format!(
+            "{}&Text=00410042&Flag=01&NulText=004100420000&OddText=004100\
+             &LongText=00410042004300440045&FullText=0041004200430044\
+             &PaddedText=00410042004300440000&EmptyText=&Cleared=&Order=01020304",
+            config_hdr(N_GUID, "", &DRIVER_PATH)
+        );
+        let names = [
+            "S", "C", "Unset", "Nul", "Odd", "Long", "Full", "Padded", "Empty", "Cl", "L",
+        ];
+
+        let (got, listed, ifr, _) = answers_with_snapshot(&hiidb, &names, &no_variables(), &text);
+
+        let want = [
+            "AB <snapshot>",
+            "1 <snapshot>",
+            "<ValueUnavailable: HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL>",
+            "AB <snapshot>",
+            "<ValueUnavailable: its setting in the ExportConfig snapshot is no <String>: 4 hex \
+             digits per CHAR16>",
+            "<ValueUnavailable: its setting in the ExportConfig snapshot holds more than its \
+             MaxSize of 4 characters>",
+            "ABCD <snapshot>",
+            "ABCD <snapshot>",
+            " <snapshot>",
+            "<ValueUnavailable: HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL> \
+             <IFR default: 0>",
+            "Four, Three, Two, One <snapshot>",
+        ];
+        assert_eq!(got, want, "get");
+        assert_eq!(listed, want, "list-questions");
+        for shown in [
+            "AB <snapshot>",
+            "ABCD <snapshot>",
+            "Four, Three, Two, One <snapshot>",
+        ] {
+            assert!(
+                ifr.contains(&format!("-Answer: {shown}\n")),
+                "show-ifr lacks {shown:?}: {ifr}"
+            );
+        }
     }
 
-    /// set selects at a stated access level, before any write, and refuses one for a HiiDB that
-    /// declares no SystemAccess.
-    #[cfg(efivar_dumps)]
+    /// A STRING of name/value storage shows its snapshot characters, in get, list-questions and
+    /// show-ifr, only where a PASSWORD lets the snapshot be read: beside none, or one on the
+    /// buffer VarStore Backing, it shows them through variables of either kind, also on a second
+    /// VARSTORE_NAME_VALUE and on Pin, the name that the PASSWORD is on; beside one that edk2 may
+    /// route to a VARSTORE_NAME_VALUE, also in another package list of its driver, through
+    /// variables that read anything the HiiDB is refused, and through those that read
+    /// nothing it takes nothing from the snapshot, which stays off: on that VARSTORE_NAME_VALUE,
+    /// on the PASSWORD's own name there, and on a second VARSTORE_NAME_VALUE, as its driver may
+    /// keep the password in any of its settings; so it does beside a PASSWORD of VarStoreId 0, in
+    /// its form or outside any FormSet, whose callbacks or READ and WRITE ops may keep it in any of
+    /// them, and beside one whose VarStoreId no VarStore declares, which refuses the HiiDB through
+    /// variables that read anything too; through BootServices the HiiDB is refused.
     #[test]
-    fn set_selects_at_the_stated_access_level() {
-        let ami = access_level_hiidb(var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 1));
-        let other = access_level_hiidb(var_store(2, [0; 16], "SystemAccess", 1));
-        let efivars = tempfile::tempdir().expect("create efivars directory");
-        fs::write(
-            efivars
-                .path()
-                .join("Setup-00000000-0000-0000-0000-000000000000"),
-            [7, 0, 0, 0, 1],
-        )
-        .expect("write efivar file");
-        let select = |hiidb: &[u8], access_level| {
-            let options = SetOptions {
-                access_level,
-                ..SetOptions::default()
+    fn name_value_strings_keep_to_the_password_refusals() {
+        type I = NameValueIfr;
+        /// The GUID of the second VARSTORE_NAME_VALUE, VarStoreId 4.
+        const SECOND_NAME_VALUE_GUID: [u8; 16] = [0x57; 16];
+        /// The labels Pin and Flag: strings 4 and 5 of NAME_VALUE_STRINGS.
+        const PIN: u16 = 4;
+        const FLAG: u16 = 5;
+        /// Where the PASSWORD on Pin of a VarStoreId is.
+        enum Password {
+            Absent,
+            InForm(u16),
+            BeforeFormSet(u16),
+            /// In a FormSet of the first VARSTORE_NAME_VALUE in a third package list of the driver
+            InAnotherList(u16),
+        }
+        /// What get of W gives through variables of either kind.
+        enum Want {
+            /// Its snapshot characters
+            Shown,
+            /// A refusal through variables that read anything, no value through those that read
+            /// nothing
+            Refused,
+        }
+        // a package list of the driver whose FormSet holds the PASSWORD on Pin of VarStoreId `id`
+        // beside the first VARSTORE_NAME_VALUE
+        let another_list = |id: u16| {
+            let form_set =
+                form_set_with_guid([0x59; 16], &[I::name_value(), form(1, &[I::password(id)])]);
+            package_list_with_guid(
+                [0x58; 16],
+                &[
+                    device_path_package(&DRIVER_PATH),
+                    form_package_of(&form_set),
+                    en_strings_package_of(&NAME_VALUE_STRINGS),
+                    END_PACKAGE.to_vec(),
+                ]
+                .concat(),
+            )
+        };
+        // the STRING W, of MaxSize 4, on the label `label` of the VARSTORE_NAME_VALUE
+        // `var_store_id`: 3, which the PASSWORD's VarStoreId 3 names, or the second, 4
+        let hiidb = |(var_store_id, label): (u16, u16), password: &Password| {
+            let string = string_on(9, 2, (var_store_id, label), (0, 4), &[]);
+            let (in_form, outside, other_list) = match *password {
+                Password::Absent => (vec![], vec![], vec![]),
+                Password::InForm(id) => (vec![I::password(id)], vec![], vec![]),
+                Password::BeforeFormSet(id) => (vec![], vec![I::password(id)], vec![]),
+                Password::InAnotherList(id) => (vec![], vec![], another_list(id)),
             };
-            select_for_set(
-                &package::read_db(hiidb).expect("parse the HiiDB"),
-                &QuestionSelector::from("Q"),
-                &BTreeSet::from(["Q".to_string()]),
-                &options,
-                &[],
-                &mut PendingOperations::new(UnsafeOperations::Refuse),
-                &mut EfivarReader::new(EfivarSource::Directory(efivars.path().to_path_buf()))
-                    .expect("create a reader of the efivars directory"),
+            let questions = [vec![I::b(), I::p(), string], in_form].concat();
+            let forms = form_set(&[
+                I::name_value(),
+                var_store_name_value(4, SECOND_NAME_VALUE_GUID),
+                I::backing(),
+                form(1, &questions),
+            ]);
+            [
+                name_value_hiidb(&[outside, vec![forms]].concat()),
+                other_list,
+            ]
+            .concat()
+        };
+        let snapshot = format!(
+            "{}&Flag=00410042&Pin=7a5b&{}&Flag=00410042",
+            config_hdr(N_GUID, "", &DRIVER_PATH),
+            config_hdr(SECOND_NAME_VALUE_GUID, "", &DRIVER_PATH)
+        );
+        let pin_snapshot = format!("{}&Pin=00410042", config_hdr(N_GUID, "", &DRIVER_PATH));
+        let unread = |hiidb: &[u8], snapshot: &str| {
+            HiiBackend::get_in(
+                hiidb,
+                "W",
+                None,
+                &GetOptions::default(),
+                EfivarSource::Disabled
+                    .into_variables()
+                    .expect("variables that read nothing"),
+                Some(ExportedConfig::new(snapshot.to_owned())),
+                None,
+                None,
             )
-            .map(|selected| {
-                selected
+            .map(|response| {
+                response
+                    .responses
+                    .into_iter()
+                    .map(|response| response.question.answer)
+                    .collect::<Vec<_>>()
+            })
+            .map_err(|error| format!("{error:#}"))
+        };
+        // list-questions' answers of W through `variables`, or the error
+        let listed = |hiidb: &[u8], variables: Box<dyn FirmwareVariables>, snapshot: &str| {
+            HiiBackend::list_questions_in(
+                hiidb,
+                &ListQuestionsOptions::default(),
+                variables,
+                Some(ExportedConfig::new(snapshot.to_owned())),
+                None,
+            )
+            .map(|questions| {
+                questions
                     .into_iter()
-                    .map(|(_, question, _)| question.question)
+                    .filter(|question| question.name == "W")
+                    .map(|question| question.answer)
                     .collect::<Vec<_>>()
             })
+            .map_err(|error| format!("{error:#}"))
+        };
+        // what show-ifr shows through `variables`, or the error
+        let shown_ifr = |hiidb: &[u8], variables: Box<dyn FirmwareVariables>, snapshot: &str| {
+            HiiBackend::show_ifr_in(
+                hiidb,
+                &ShowIfrOptions::default(),
+                variables,
+                Some(ExportedConfig::new(snapshot.to_owned())),
+                None,
+            )
+            .map(|ifr| HiiShowIfrResponse::from(ifr).readable_representation)
+            .map_err(|error| format!("{error:#}"))
+        };
+        let read_nothing = || {
+            EfivarSource::Disabled
+                .into_variables()
+                .expect("variables that read nothing")
         };
+        let shown = Ok(vec!["AB <snapshot>".to_owned()]);
+        let no_value_text =
+            "<ValueUnavailable: HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL>";
+        let no_value = Ok(vec![no_value_text.to_owned()]);
+        let runtime = name_value_variables(VariableReach::Runtime);
+        let boot_services = name_value_variables(VariableReach::BootServices);
+
+        for (case, location, password, snapshot, want) in [
+            (
+                "no PASSWORD",
+                (3, FLAG),
+                Password::Absent,
+                &snapshot,
+                Want::Shown,
+            ),
+            (
+                "on Backing",
+                (3, FLAG),
+                Password::InForm(1),
+                &snapshot,
+                Want::Shown,
+            ),
+            (
+                "the second VARSTORE_NAME_VALUE, no PASSWORD",
+                (4, FLAG),
+                Password::Absent,
+                &snapshot,
+                Want::Shown,
+            ),
+            (
+                "on Pin, the PASSWORD on Backing",
+                (3, PIN),
+                Password::InForm(1),
+                &pin_snapshot,
+                Want::Shown,
+            ),
+            (
+                "on the VARSTORE_NAME_VALUE",
+                (3, FLAG),
+                Password::InForm(3),
+                &snapshot,
+                Want::Refused,
+            ),
+            (
+                "the second VARSTORE_NAME_VALUE, on the first",
+                (4, FLAG),
+                Password::InForm(3),
+                &snapshot,
+                Want::Refused,
+            ),
+            (
+                "on Pin, the PASSWORD's own name",
+                (3, PIN),
+                Password::InForm(3),
+                &pin_snapshot,
+                Want::Refused,
+            ),
+            (
+                "of VarStoreId 0 in the form",
+                (3, FLAG),
+                Password::InForm(0),
+                &snapshot,
+                Want::Refused,
+            ),
+            (
+                "of VarStoreId 0 outside any FormSet",
+                (3, FLAG),
+                Password::BeforeFormSet(0),
+                &snapshot,
+                Want::Refused,
+            ),
+            (
+                "in another package list of the driver",
+                (3, FLAG),
+                Password::InAnotherList(3),
+                &snapshot,
+                Want::Refused,
+            ),
+        ] {
+            let hiidb = hiidb(location, &password);
+            let got = name_value_get(&hiidb, "W", &runtime, Some(snapshot));
+            let unread_got = unread(&hiidb, snapshot);
+            let runtime_listed = listed(&hiidb, shared(&runtime), snapshot);
+            let unread_listed = listed(&hiidb, read_nothing(), snapshot);
+            let runtime_ifr = shown_ifr(&hiidb, shared(&runtime), snapshot);
+            let unread_ifr = shown_ifr(&hiidb, read_nothing(), snapshot);
+            match want {
+                Want::Shown => {
+                    assert_eq!(got, shown, "{case}: Runtime");
+                    assert_eq!(unread_got, shown, "{case}: variables that read nothing");
+                    assert_eq!(runtime_listed, shown, "{case}: list-questions, Runtime");
+                    assert_eq!(
+                        unread_listed, shown,
+                        "{case}: list-questions, variables that read nothing"
+                    );
+                    for (variables, ifr) in [
+                        ("Runtime", &runtime_ifr),
+                        ("variables that read nothing", &unread_ifr),
+                    ] {
+                        assert!(
+                            ifr.as_ref()
+                                .is_ok_and(|ifr| ifr.contains("-Answer: AB <snapshot>\n")),
+                            "{case}: show-ifr, {variables}: {ifr:?}"
+                        );
+                    }
+                }
+                Want::Refused => {
+                    assert!(
+                        got.as_ref()
+                            .is_err_and(|error| error.ends_with(ANY_VARIABLE)),
+                        "{case}: Runtime: {got:?}"
+                    );
+                    assert_eq!(unread_got, no_value, "{case}: variables that read nothing");
+                    assert!(
+                        runtime_listed
+                            .as_ref()
+                            .is_err_and(|error| error.ends_with(ANY_VARIABLE)),
+                        "{case}: list-questions, Runtime: {runtime_listed:?}"
+                    );
+                    assert_eq!(
+                        unread_listed, no_value,
+                        "{case}: list-questions, variables that read nothing"
+                    );
+                    assert!(
+                        runtime_ifr
+                            .as_ref()
+                            .is_err_and(|error| error.ends_with(ANY_VARIABLE)),
+                        "{case}: show-ifr, Runtime: {runtime_ifr:?}"
+                    );
+                    assert!(
+                        unread_ifr.as_ref().is_ok_and(|ifr| {
+                            ifr.contains(&format!("-Answer: {no_value_text}\n"))
+                                && !ifr.contains("AB <snapshot>")
+                        }),
+                        "{case}: show-ifr, variables that read nothing: {unread_ifr:?}"
+                    );
+                }
+            }
+        }
 
-        assert_eq!(
-            select(&ami, Some(AccessLevel::Administrator)).expect("select as Administrator"),
-            ["Q"],
-            "Administrator"
-        );
-        let user = select(&ami, Some(AccessLevel::User)).expect_err("select as User");
-        assert_eq!(
-            user.downcast_ref::<SelectionError>(),
-            Some(&SelectionError::Excluded {
-                question: "Q".to_string(),
-                states: IncludedStates::GRAYED_OUT,
-            }),
-            "User: {user:#}"
-        );
-        let no_level = select(&ami, None).expect_err("select without a level");
+        let routed = hiidb((3, FLAG), &Password::InForm(3));
+        let got = name_value_get(&routed, "W", &boot_services, Some(&snapshot));
         assert!(
-            matches!(
-                no_level.downcast_ref::<SelectionError>(),
-                Some(SelectionError::Undetermined { states, .. })
-                    if *states == IncludedStates::GRAYED_OUT
-            ),
-            "no level: {no_level:#}"
+            got.as_ref()
+                .is_err_and(|error| error.ends_with(BOOT_SERVICES_REFUSAL)),
+            "on the VARSTORE_NAME_VALUE: BootServices: {got:?}"
         );
-        for level in [AccessLevel::Administrator, AccessLevel::User] {
-            assert_eq!(
-                select(&other, Some(level)).map_err(|error| error.to_string()),
-                Err(
-                    "--access-level applies to AMI firmware whose HiiDB declares the \
-                     SystemAccess VarStore; this HiiDB declares none"
-                        .to_string()
-                ),
-                "{level:?}, SystemAccess of NIL_GUID"
-            );
-        }
-    }
-
-    /// get and list-questions evaluate the conditions on AMI firmware's SystemAccess at a
-    /// stated access level, and refuse one for a HiiDB that declares no SystemAccess.
-    #[test]
-    fn options_state_the_access_level() {
-        let ami = access_level_hiidb(var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 1));
-        let other = access_level_hiidb(var_store(2, [0; 16], "SystemAccess", 1));
-        let get = |hiidb: &[u8], access_level| {
-            let options = GetOptions {
-                efivars: EfivarSource::Disabled,
-                access_level,
-                ..GetOptions::default()
-            };
-            HiiBackend::get_using(hiidb, "Q", None, &options).map(|got| {
-                got.responses
-                    .into_iter()
-                    .map(|response| response.question.answer)
-                    .collect::<Vec<_>>()
-            })
-        };
-        let list = |hiidb: &[u8], access_level| {
-            let options = ListQuestionsOptions {
-                efivars: EfivarSource::Disabled,
-                access_level,
-                ..ListQuestionsOptions::default()
-            };
-            HiiBackend::list_questions_using(hiidb, &options).map(|listed| {
-                listed
-                    .into_iter()
-                    .filter(|question| question.name == "Q")
-                    .map(|question| question.answer)
-                    .collect::<Vec<_>>()
-            })
-        };
-        let not_read = "<ValueUnavailable: EFI variables not read> <IFR default: 0>";
 
-        let administrator = Some(AccessLevel::Administrator);
-        assert_eq!(
-            get(&ami, administrator).expect("get as Administrator"),
-            [not_read],
-            "get as Administrator"
+        let unknown = hiidb((3, FLAG), &Password::InForm(9));
+        let got = name_value_get(&unknown, "W", &runtime, Some(&snapshot));
+        assert!(
+            got.as_ref()
+                .is_err_and(|error| error.contains(UNDECLARED_9) && error.ends_with(ANY_VARIABLE)),
+            "of an undeclared VarStoreId: Runtime: {got:?}"
         );
         assert_eq!(
-            list(&ami, administrator).expect("list as Administrator"),
-            [not_read],
-            "list-questions as Administrator"
+            unread(&unknown, &snapshot),
+            no_value,
+            "of an undeclared VarStoreId: variables that read nothing"
         );
-        let user = Some(AccessLevel::User);
-        let error = get(&ami, user).expect_err("get as User");
-        assert_eq!(
-            error.downcast_ref::<SelectionError>(),
-            Some(&SelectionError::Excluded {
-                question: "Q".to_string(),
-                states: IncludedStates::GRAYED_OUT,
-            }),
-            "get as User: {error:#}"
+        let runtime_listed = listed(&unknown, shared(&runtime), &snapshot);
+        assert!(
+            runtime_listed
+                .as_ref()
+                .is_err_and(|error| error.contains(UNDECLARED_9) && error.ends_with(ANY_VARIABLE)),
+            "of an undeclared VarStoreId: list-questions, Runtime: {runtime_listed:?}"
         );
         assert_eq!(
-            list(&ami, user).expect("list as User"),
-            Vec::<String>::new(),
-            "list-questions as User"
+            listed(&unknown, read_nothing(), &snapshot),
+            no_value,
+            "of an undeclared VarStoreId: list-questions, variables that read nothing"
+        );
+        let runtime_ifr = shown_ifr(&unknown, shared(&runtime), &snapshot);
+        assert!(
+            runtime_ifr
+                .as_ref()
+                .is_err_and(|error| error.contains(UNDECLARED_9) && error.ends_with(ANY_VARIABLE)),
+            "of an undeclared VarStoreId: show-ifr, Runtime: {runtime_ifr:?}"
+        );
+        let unread_ifr = shown_ifr(&unknown, read_nothing(), &snapshot);
+        assert!(
+            unread_ifr
+                .as_ref()
+                .is_ok_and(|ifr| ifr.contains(&format!("-Answer: {no_value_text}\n"))
+                    && !ifr.contains("AB <snapshot>")),
+            "of an undeclared VarStoreId: show-ifr, variables that read nothing: {unread_ifr:?}"
         );
-
-        let refusal = "--access-level applies to AMI firmware whose HiiDB declares the \
-                       SystemAccess VarStore; this HiiDB declares none";
-        for level in [administrator, user] {
-            assert_eq!(
-                get(&other, level).map_err(|error| error.to_string()),
-                Err(refusal.to_string()),
-                "get, {level:?}, SystemAccess of NIL_GUID"
-            );
-            assert_eq!(
-                list(&other, level).map_err(|error| error.to_string()),
-                Err(refusal.to_string()),
-                "list-questions, {level:?}, SystemAccess of NIL_GUID"
-            );
-        }
-        assert!(get(&other, None).is_ok(), "get, no level");
-        assert!(list(&other, None).is_ok(), "list-questions, no level");
     }
 
-    /// get, list-questions and show-ifr refuse an efivars directory that is not one, rather
-    /// than read every question as missing.
-    #[cfg(efivar_dumps)]
+    /// A name/value question takes its snapshot number by the label that its VarName string
+    /// shows in the language of the other texts: PlatformLang, or --language before it.
     #[test]
-    fn options_refuse_an_efivars_directory_that_is_not_one() {
-        let hiidb = package_list_with_guid(
-            [0x55; 16],
-            &[
-                form_set_package(),
-                en_strings_package(b'Q'),
-                END_PACKAGE.to_vec(),
-            ]
-            .concat(),
+    fn snapshot_labels_follow_the_text_language() {
+        let packages = [
+            device_path_package(&DRIVER_PATH),
+            form_package(&[
+                var_store_name_value(3, N_GUID),
+                form(1, &[checkbox_at(1, 1, 3, 2)]),
+            ]),
+            strings_package_of(b"en-US", &["C", "Flag"]),
+            strings_package_of(b"fr-FR", &["C", "Drapeau"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let text = format!(
+            "{}&Flag=00&Drapeau=01",
+            config_hdr(N_GUID, "", &DRIVER_PATH)
         );
-        let missing = tempfile::tempdir()
-            .expect("create directory")
-            .path()
-            .join("missing");
-        let want = format!("efivars directory {} is not a directory", missing.display());
-        let efivars = EfivarSource::Directory(missing);
-        let get_options = GetOptions {
-            efivars: efivars.clone(),
-            ..GetOptions::default()
-        };
-        let list_options = ListQuestionsOptions {
-            efivars: efivars.clone(),
-            ..ListQuestionsOptions::default()
-        };
+        let exported = || Some(ExportedConfig::new(text.clone()));
+        let variables = no_variables();
 
-        let errors = [
-            (
-                "get",
-                HiiBackend::get_using(&hiidb, "Q", None, &get_options).map(drop),
-            ),
-            (
-                "list-questions",
-                HiiBackend::list_questions_using(&hiidb, &list_options).map(drop),
-            ),
+        for (case, language, platform, want) in [
+            ("no language", None, None, "0 <snapshot>"),
+            ("PlatformLang fr-FR", None, Some("fr-FR"), "1 <snapshot>"),
             (
-                "show-ifr",
-                HiiBackend::show_ifr_using(
-                    &hiidb,
-                    &ShowIfrOptions {
-                        efivars,
-                        ..Default::default()
-                    },
-                )
-                .map(drop),
+                "--language fr-FR",
+                Some("fr-FR"),
+                Some("en-US"),
+                "1 <snapshot>",
             ),
-        ];
-        for (case, result) in errors {
-            let error = result.expect_err("read from a directory that is not one");
+        ] {
+            let language = language.map(str::to_owned);
+            let got = HiiBackend::get_in(
+                &hiidb,
+                "C",
+                None,
+                &GetOptions {
+                    language: language.clone(),
+                    ..GetOptions::default()
+                },
+                shared(&variables),
+                exported(),
+                platform,
+                None,
+            )
+            .unwrap_or_else(|error| panic!("{case}: get: {error:#}"));
+            let listed = HiiBackend::list_questions_in(
+                &hiidb,
+                &ListQuestionsOptions {
+                    language: language.clone(),
+                    ..ListQuestionsOptions::default()
+                },
+                shared(&variables),
+                exported(),
+                platform,
+            )
+            .unwrap_or_else(|error| panic!("{case}: list-questions: {error:#}"));
+            let ifr = HiiBackend::show_ifr_in(
+                &hiidb,
+                &ShowIfrOptions {
+                    language,
+                    ..ShowIfrOptions::default()
+                },
+                shared(&variables),
+                exported(),
+                platform,
+            )
+            .unwrap_or_else(|error| panic!("{case}: show-ifr: {error:#}"))
+            .to_string();
 
-            assert_eq!(error.to_string(), want, "{case}");
+            let answers = |questions: Vec<&Question>| {
+                questions
+                    .into_iter()
+                    .map(|question| question.answer.clone())
+                    .collect::<Vec<_>>()
+            };
+            assert_eq!(
+                answers(
+                    got.responses
+                        .iter()
+                        .map(|response| &response.question)
+                        .collect()
+                ),
+                [want],
+                "{case}: get"
+            );
+            assert_eq!(
+                answers(listed.iter().collect()),
+                [want],
+                "{case}: list-questions"
+            );
+            assert!(
+                ifr.contains(&format!("-Answer: {want}\n")),
+                "{case}: show-ifr lacks {want:?}: {ifr}"
+            );
         }
     }
 
-    /// show_ifr and list_questions fail for a package list with forms but no
-    /// strings packages, rather than use those of a list of the same GUID.
+    /// A storage's later <BlockConfig> past the end of the bytes so far, as ExportConfig() gives
+    /// a buffer of one block per question, extends it.
     #[test]
-    fn test_forms_without_strings_are_an_error() {
-        let forms_only = [&form_set_package()[..], &END_PACKAGE].concat();
-        let hiidb = [
-            package_list_with_guid([0x44; 16], &forms_only),
-            en_strings_list([0x44; 16], b'S'),
-        ]
-        .concat();
-        let want = "Failed to get string packages using GUID 44444444-4444-4444-4444-444444444444";
-        // no variables: on Windows, System enables a privilege that needs elevation
-        let efivars = EfivarSource::Disabled;
-        let show_options = ShowIfrOptions {
-            efivars: efivars.clone(),
-            ..Default::default()
-        };
-        let list_options = ListQuestionsOptions {
-            efivars,
-            ..ListQuestionsOptions::default()
-        };
-
-        let Err(err) = HiiBackend::show_ifr_using(&hiidb, &show_options) else {
-            panic!("show_ifr used the strings of another list");
-        };
-        assert_eq!(format!("{err:#}"), want, "show_ifr");
+    fn snapshot_blocks_past_the_end_extend_their_storage() {
+        let hdr = config_hdr(N_GUID, "NStore", &DRIVER_PATH);
+        let text = format!("{}&OFFSET=1&WIDTH=2&VALUE=1234", block_resp(&hdr, 0, &[1]));
 
-        let Err(err) = HiiBackend::list_questions_using(&hiidb, &list_options) else {
-            panic!("list_questions used the strings of another list");
-        };
-        assert_eq!(format!("{err:#}"), want, "list_questions");
-    }
+        let (got, listed, ifr, _) =
+            answers_with_snapshot(&snapshot_hiidb(), &["N", "W"], &no_variables(), &text);
 
-    /// The scopes of the FormSet and the Form of nested_subtitles_hiidb
-    const FORM_SCOPES: usize = 2;
+        let want = ["1 <snapshot>", "4660 <snapshot>"];
+        assert_eq!(got, want, "get");
+        assert_eq!(listed, want, "list-questions");
+        assert!(
+            ifr.contains("-Answer: 4660 <snapshot>\n"),
+            "show-ifr: {ifr}"
+        );
+    }
 
-    /// A HiiDB whose Form nests `subtitles` Subtitle scopes around a CheckBox prompted "Deep", in
-    /// the scope of an unknown op if `in_unknown_scope`.
-    fn nested_subtitles_hiidb(subtitles: usize, in_unknown_scope: bool) -> Vec<u8> {
-        let nested = nested(&subtitle_scope(2), subtitles, &[checkbox_on(1, 2, 0)]);
-        let body = match in_unknown_scope {
-            true => [unknown_scope(), nested, END.to_vec()].concat(),
-            false => nested,
-        };
+    /// A HiiDB of the driver at DRIVER_PATH whose FormSet has the CHECKBOX P on the VarStore
+    /// `p_store`, of id 1, and `question`, prompted string 2, on the VARSTORE_EFI Other of id 2,
+    /// whose variable holds 0; its strings are P, Q, Off and On.
+    fn condition_hiidb(p_store: Vec<u8>, question: Vec<u8>) -> Vec<u8> {
         let packages = [
-            en_strings_package_of(&["FormSet", "Deep"]),
-            form_package(&[form(1, &[body])]),
+            device_path_package(&DRIVER_PATH),
+            form_package(&[
+                p_store,
+                var_store_efi_of(2, N_GUID, "Other", NV_BS_RT, 1),
+                form(1, &[checkbox_on(1, 1, 1), question]),
+            ]),
+            en_strings_package_of(&["P", "Q", "Off", "On"]),
             END_PACKAGE.to_vec(),
         ];
         package_list_with_guid([0x55; 16], &packages.concat())
     }
 
-    /// An op of the unknown opcode 0x70 opening a scope.
-    fn unknown_scope() -> Vec<u8> {
-        operation(0x70, true, &[])
+    /// Variables that hold condition_hiidb's Other, 0, and none of its P.
+    fn other_variables() -> Rc<MemoryVariables> {
+        other_variables_holding(0)
     }
 
-    /// Every command ignores the FormSet of a HiiDB whose VarStore op ends inside its Name, and
-    /// the record of that FormSet, which list-questions prints on stderr and refusals name, gives
-    /// the error on one line: the fields being parsed, without the Rust source locations of
-    /// binrw's backtrace frames.
-    #[test]
-    fn commands_ignore_a_truncated_var_store_and_name_it_on_one_line() {
-        // EFI_IFR_VARSTORE of the Length of an empty Name, whose last byte is no NUL
-        let var_store = operation(0x24, false, &[&[0x11; 20][..], b"A"].concat());
-        let packages = [
-            en_strings_package_of(&["FormSet"]),
-            form_package(&[var_store]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let want = format!(
-            "the IFR that uefisettings ignores at offset 0 of a form package of package list \
-             55555555-5555-5555-5555-555555555555: the FormSet {}, which holds, outside its \
-             forms, an op that uefisettings does not decode: the EFI_IFR_VARSTORE op at offset \
-             39 of a form package: failed to parse op_code VarStore properly: failed to parse \
-             VarStore's data: failed to fill whole buffer (While parsing field 'name' in \
-             VarStore)",
-            Guid::from([0x11; 16])
-        );
-        for (name, command) in commands() {
-            let got = command(&hiidb).unwrap_or_else(|error| panic!("{name}: {error:#}"));
-            let want: &[&str] = match name {
-                "list-strings" => &["FormSet"],
-                _ => &[],
-            };
-            assert_eq!(got, want, "{name}");
-        }
-        let records: Vec<String> = HiiBackend::ignored_ifr(&hiidb)
-            .unwrap_or_else(|error| panic!("ignored_ifr: {error:#}"))
-            .iter()
-            .map(ToString::to_string)
-            .collect();
-        for record in &records {
-            assert!(
-                !record.contains('\n') && !record.contains("src/"),
-                "{record:?}"
-            );
-        }
-        assert_eq!(records, [want], "ignored_ifr");
+    /// Variables that hold condition_hiidb's Other, `value`, and none of its P.
+    fn other_variables_holding(value: u8) -> Rc<MemoryVariables> {
+        let variables = no_variables();
+        let other = VariableKey {
+            name: "Other".to_owned(),
+            guid: Guid::from(N_GUID),
+        };
+        variables.insert(other, NV_BS_RT, &[value]);
+        variables
     }
 
-    /// A command of the tests below: what it prints of a HiiDB, line by line.
-    type Command = fn(&[u8]) -> Result<Vec<String>>;
-
-    /// The commands of the tests below, each with its name.
-    fn commands() -> [(&'static str, Command); 4] {
-        [
-            ("list-strings", |hiidb| {
-                let strings = HiiBackend::list_strings(hiidb)?;
-                Ok(strings
-                    .into_iter()
-                    .flat_map(|package| package.string_package.into_values())
-                    .collect())
-            }),
-            ("list-questions", |hiidb| {
-                let options = ListQuestionsOptions {
-                    efivars: EfivarSource::Disabled,
-                    include: IncludedStates::CONDITIONS,
-                    ..Default::default()
-                };
-                let questions = HiiBackend::list_questions_using(hiidb, &options)?;
-                Ok(questions
-                    .into_iter()
-                    .map(|question| question.name)
-                    .collect())
-            }),
-            ("show-ifr", |hiidb| {
-                let options = ShowIfrOptions {
-                    efivars: EfivarSource::Disabled,
-                    ..Default::default()
-                };
-                let shown = HiiBackend::show_ifr_using(hiidb, &options)?;
-                Ok(shown
-                    .readable_representation
-                    .lines()
-                    .filter(|line| line.contains("CheckBox"))
-                    .map(|line| line.trim().to_string())
-                    .collect())
-            }),
-            ("get", |hiidb| {
-                let options = GetOptions {
-                    efivars: EfivarSource::Disabled,
-                    ..Default::default()
-                };
-                let got = HiiBackend::get_using(hiidb, "Deep", None, &options)?;
-                Ok(got
-                    .responses
-                    .into_iter()
-                    .map(|response| response.question.name)
-                    .collect())
-            }),
-        ]
+    /// What get of question Q of `hiidb` gives with `include` through `variables` and the
+    /// snapshot `text`, if any, and the answers that list-questions gives for it.
+    fn condition_answers(
+        hiidb: &[u8],
+        include: IncludedStates,
+        variables: &Rc<MemoryVariables>,
+        text: Option<&str>,
+    ) -> (Result<Vec<String>, String>, Vec<String>) {
+        let exported = || text.map(|text| ExportedConfig::new(text.to_owned()));
+        let got = HiiBackend::get_in(
+            hiidb,
+            "Q",
+            None,
+            &GetOptions {
+                include,
+                ..GetOptions::default()
+            },
+            shared(variables),
+            exported(),
+            None,
+            None,
+        )
+        .map(|got| {
+            got.responses
+                .iter()
+                .map(|response| response.question.answer.clone())
+                .collect()
+        })
+        .map_err(|error| format!("{error:#}"));
+        let listed = HiiBackend::list_questions_in(
+            hiidb,
+            &ListQuestionsOptions {
+                include,
+                ..ListQuestionsOptions::default()
+            },
+            shared(variables),
+            exported(),
+            None,
+        )
+        .expect("list questions")
+        .into_iter()
+        .filter(|question| question.name == "Q")
+        .map(|question| question.answer)
+        .collect();
+        (got, listed)
     }
 
-    /// Every command reads a HiiDB whose IFR scopes nest MAX_SCOPE_NESTING deep, unknown ones
-    /// counted, on SMALL_STACK, and shows its CheckBox, unless an unknown op's scope, which edk2
-    /// skips, holds it.
+    /// A state that a condition decides from a value of the snapshot is tagged, as values are:
+    /// get's refusal names the snapshot, and so do the answers of get and list-questions that
+    /// include the state. Without the snapshot, the condition cannot be evaluated.
     #[test]
-    fn commands_read_scopes_nested_to_the_limit_on_a_small_stack() {
-        for in_unknown_scope in [false, true] {
-            let subtitles = MAX_SCOPE_NESTING - FORM_SCOPES - usize::from(in_unknown_scope);
-            let hiidb = nested_subtitles_hiidb(subtitles, in_unknown_scope);
-            for (name, command) in commands() {
-                let got = on_small_stack(name, || command(&hiidb)).unwrap_or_else(|error| {
-                    panic!("{name}, in an unknown scope: {in_unknown_scope}: {error:#}")
-                });
-                let want: &[&str] = match (name, in_unknown_scope) {
-                    ("list-strings", _) => &["FormSet", "Deep"],
-                    (_, true) => &[],
-                    ("show-ifr", false) => &["OpCode: CheckBox - Q: - Deep - Help: -"],
-                    (_, false) => &["Deep"],
-                };
-                assert_eq!(got, want, "{name}, in an unknown scope: {in_unknown_scope}");
+    fn states_that_snapshot_values_decide_are_tagged() {
+        let variables = other_variables();
+        let setup = block_resp(&config_hdr([0; 16], "Setup", &DRIVER_PATH), 0, &[1]);
+        for (case, p_store, text) in [
+            (
+                "a missing variable",
+                var_store(1, N_GUID, "NStore", 3),
+                snapshot_text(),
+            ),
+            (
+                "a variable without runtime access",
+                var_store_efi(1, "Setup", NV_BS, 1),
+                setup,
+            ),
+        ] {
+            // the CHECKBOX Q on Other under GRAY_OUT_IF P == 1, where only the snapshot holds
+            // P, 1
+            let hiidb = condition_hiidb(
+                p_store,
+                conditional(GRAY_OUT_IF, eq_id_val_of(1, 1), &[checkbox_on(2, 2, 2)]),
+            );
+
+            let (got, listed) =
+                condition_answers(&hiidb, IncludedStates::empty(), &variables, Some(&text));
+            assert_eq!(
+                got,
+                Err(
+                    "question \"Q\" is grayed-out by a value of the ExportConfig snapshot; also \
+                     include grayed-out questions to select it"
+                        .to_owned()
+                ),
+                "{case}: get"
+            );
+            assert_eq!(listed, Vec::<String>::new(), "{case}: list-questions");
+
+            let (got, listed) =
+                condition_answers(&hiidb, IncludedStates::GRAYED_OUT, &variables, Some(&text));
+            let want = ["0 <grayed-out> <snapshot>"];
+            assert_eq!(
+                got,
+                Ok(want.map(str::to_owned).to_vec()),
+                "{case}: get, grayed-out"
+            );
+            assert_eq!(listed, want, "{case}: list-questions, grayed-out");
+
+            for include in [IncludedStates::empty(), IncludedStates::GRAYED_OUT] {
+                let (got, listed) = condition_answers(&hiidb, include, &variables, None);
+                let got = got.unwrap_or_else(|error| panic!("{case}: get without it: {error}"));
+                for answers in [got, listed] {
+                    let [answer] = answers.as_slice() else {
+                        panic!("{case}: {include:?} without the snapshot: {answers:?}");
+                    };
+                    assert!(
+                        answer.starts_with(
+                            "0 <selectable or grayed-out: EFI_IFR_EQ_ID_VAL of question 0x0001: \
+                             <ValueUnavailable: "
+                        ) && !answer.contains("snapshot"),
+                        "{case}: {include:?} without the snapshot: {answer}"
+                    );
+                }
             }
         }
     }
 
-    /// Every command reads a HiiDB whose only FormSet nests IFR scopes deeper than
-    /// MAX_SCOPE_NESTING, unknown ones counted, by one or by 20000 Subtitles, on SMALL_STACK, and
-    /// ignores that FormSet, as a later one: it shows no question, and names the FormSet and the
-    /// op past the limit as the IFR that it ignores at offset 0. Through variables that reach
-    /// BootServices, get refuses the HiiDB.
+    /// The snapshot tags just the states that its values decide: a false condition on one leaves
+    /// the question selectable by the snapshot, a condition on one under a true DISABLE_IF
+    /// decides nothing, and the stored option of a ONE_OF under a SUPPRESS_IF on one is tagged
+    /// as its question is.
     #[test]
-    fn commands_ignore_a_form_set_nested_past_the_limit_on_a_small_stack() {
-        let form_set_op = form_set(&[]).len() - END.len();
-        let form_op = form(1, &[]).len() - END.len();
-        let subtitle_op = subtitle_scope(2).len();
-        for in_unknown_scope in [false, true] {
-            let outer = FORM_SCOPES + usize::from(in_unknown_scope);
-            let past_limit = form_set_op
-                + form_op
-                + usize::from(in_unknown_scope) * unknown_scope().len()
-                + (MAX_SCOPE_NESTING - outer) * subtitle_op;
-            let ignored = format!(
-                "the FormSet {}, which nests too deep: IFR scopes nest deeper than \
-                 {MAX_SCOPE_NESTING} at offset {past_limit} of a form package",
-                Guid::from([0x11; 16])
-            );
-            for subtitles in [MAX_SCOPE_NESTING - outer + 1, 20_000] {
-                let hiidb = nested_subtitles_hiidb(subtitles, in_unknown_scope);
-                let case =
-                    format!("{subtitles} Subtitles, in an unknown scope: {in_unknown_scope}");
-                for (name, command) in commands() {
-                    let got = on_small_stack(name, || command(&hiidb))
-                        .unwrap_or_else(|error| panic!("{name}, {case}: {error:#}"));
-                    let want: &[&str] = match name {
-                        "list-strings" => &["FormSet", "Deep"],
-                        _ => &[],
-                    };
-                    assert_eq!(got, want, "{name}, {case}");
-                }
+    fn snapshot_tags_just_the_states_that_its_values_decide() {
+        let variables = other_variables();
+        let check_box = || checkbox_on(2, 2, 2);
+        let one_of = uint8_one_of(
+            2,
+            2,
+            2,
+            0,
+            &[
+                conditional(
+                    SUPPRESS_IF,
+                    eq_id_val_of(1, 1),
+                    &[flagged_option(3, 0x00, 0)],
+                ),
+                flagged_option(4, 0x00, 1),
+            ],
+        );
+        for (case, question, include, want) in [
+            (
+                "a false condition",
+                conditional(GRAY_OUT_IF, eq_id_val_of(1, 0), &[check_box()]),
+                IncludedStates::empty(),
+                "0 <selectable> <snapshot>",
+            ),
+            (
+                "a condition under a true DISABLE_IF",
+                conditional(
+                    DISABLE_IF,
+                    ifr_true(),
+                    &[conditional(GRAY_OUT_IF, eq_id_val_of(1, 1), &[check_box()])],
+                ),
+                IncludedStates::GRAYED_OUT | IncludedStates::DISABLED,
+                "0 <disabled>",
+            ),
+            (
+                "the stored option under a SUPPRESS_IF",
+                one_of,
+                IncludedStates::empty(),
+                "Off <option suppressed> <snapshot>",
+            ),
+        ] {
+            let hiidb = condition_hiidb(var_store(1, N_GUID, "NStore", 3), question);
 
-                let records: Vec<(u64, String)> =
-                    on_small_stack("ignored_ifr", || HiiBackend::ignored_ifr(&hiidb))
-                        .unwrap_or_else(|error| panic!("ignored_ifr, {case}: {error:#}"))
-                        .into_iter()
-                        .map(|ignored| (ignored.offset, ignored.reason))
-                        .collect();
-                assert_eq!(records, [(0, ignored.clone())], "ignored_ifr, {case}");
+            let (got, listed) =
+                condition_answers(&hiidb, include, &variables, Some(&snapshot_text()));
 
-                let variables = Rc::new(MemoryVariables::new(
-                    VariableReach::BootServices,
-                    VariableInterface::VariableServices,
-                ));
-                assert_eq!(
-                    answers_or_error_of(&hiidb, "Deep", &variables),
-                    Err(format!(
-                        "PASSWORD questions of package list 55555555-5555-5555-5555-555555555555 \
-                         may be in the IFR that uefisettings ignores at offset 0 of a form \
-                         package: {ignored}; as the variable of that password is unknown, the \
-                         UEFI Shell build reads and writes no variable of this HiiDB"
-                    )),
-                    "BootServices: get, {case}"
-                );
-            }
+            assert_eq!(got, Ok(vec![want.to_owned()]), "{case}: get");
+            assert_eq!(listed, [want], "{case}: list-questions");
         }
     }
 
-    /// The device path of the driver of snapshot_hiidb.
-    const DRIVER_PATH: [u8; 16] = crate::hii::config_snapshot::tests::DRIVER_PATH;
-    /// The GUIDs, as stored, of NStore and AMITSESetup.
-    const N_GUID: [u8; 16] = crate::hii::config_snapshot::tests::N_GUID;
-    const P_GUID: [u8; 16] = crate::hii::config_snapshot::tests::P_GUID;
-    /// The answer of N of snapshot_hiidb without a variable or snapshot value.
-    const MISSING_N_STORE: &str = "<ValueUnavailable: no EFI variable \
-        NStore-8c78a505-baa0-4c4a-869f-000000001401; HII buffer varstore requires \
-        EFI_HII_CONFIG_ACCESS_PROTOCOL> <IFR default: 0>";
-    /// The answer of X of snapshot_hiidb, over the password's bytes; the NUMERIC declares no
-    /// default.
-    const WITHHELD: &str = "<ValueUnavailable: its bytes hold a password>";
+    /// show-ifr shows the condition ops of a question by their OpCode, untagged, beside the values
+    /// that it tags: P's from the snapshot, and that of Q, under a GRAY_OUT_IF on P, from its
+    /// variable.
+    #[test]
+    fn show_ifr_tags_snapshot_values_beside_condition_ops() {
+        let hiidb = condition_hiidb(
+            var_store(1, N_GUID, "NStore", 3),
+            conditional(GRAY_OUT_IF, eq_id_val_of(1, 1), &[checkbox_on(2, 2, 2)]),
+        );
 
-    /// A UINT16 NUMERIC of QuestionId `question_id`, prompted string `prompt`, from 0 to 65535,
-    /// at VarOffset, or VarName, `info` of VarStore `var_store_id`.
-    fn uint16_numeric(question_id: u16, prompt: u16, var_store_id: u16, info: u16) -> Vec<u8> {
-        let data = [
-            question_header_with(question_id, prompt, var_store_id, info, 0x00),
-            // Flags EFI_IFR_NUMERIC_SIZE_2, MinValue, MaxValue, Step
-            vec![0x01, 0x00, 0x00, 0xFF, 0xFF, 0x01, 0x00],
-        ]
-        .concat();
-        operation(NUMERIC, false, &data)
+        let (_, _, ifr, _) =
+            answers_with_snapshot(&hiidb, &[], &other_variables(), &snapshot_text());
+
+        let shown: Vec<&str> = ifr
+            .lines()
+            .map(str::trim_start)
+            .skip_while(|line| *line != "OpCode: Form")
+            .map(|line| line.split(" - ").next().unwrap_or(line))
+            .collect();
+        assert_eq!(
+            shown,
+            [
+                "OpCode: Form",
+                "OpCode: CheckBox",
+                "-Answer: 1 <snapshot>",
+                "OpCode: GrayOutIf",
+                "OpCode: EqIdVal",
+                "OpCode: CheckBox",
+                "-Answer: 0",
+            ],
+            "{ifr}"
+        );
     }
 
-    /// A UINT8 ONE_OF of QuestionId `question_id`, prompted string `prompt`, at VarOffset
-    /// `offset` of VarStore `var_store_id`, with `options`.
-    fn uint8_one_of(
-        question_id: u16,
-        prompt: u16,
-        var_store_id: u16,
-        offset: u16,
-        options: &[Vec<u8>],
-    ) -> Vec<u8> {
-        let data = [
-            question_header_with(question_id, prompt, var_store_id, offset, 0x00),
-            // Flags EFI_IFR_NUMERIC_SIZE_1, MinValue, MaxValue, Step
-            vec![0x00, 0x00, 0xFF, 0x01],
-        ]
-        .concat();
-        [
-            operation(ONE_OF, true, &data),
-            options.concat(),
-            END.to_vec(),
-        ]
-        .concat()
+    /// The option that a ONE_OF answers is tagged when values that options of Type OTHER took
+    /// from the snapshot decide it: the option took its value from there, or one before it that
+    /// did would show if it matched, or none shows; one after it decides nothing. A stored value
+    /// from the snapshot tags an OTHER option of a constant VALUE as it tags any option.
+    #[test]
+    fn options_whose_values_the_snapshot_gives_tag_the_one_of_answer() {
+        // EFI_IFR_QUESTION_REF1 of P, which only the snapshot holds: 1
+        let p = || vec![operation(QUESTION_REF1, false, &1u16.to_le_bytes())];
+        let off = || flagged_option(3, 0x00, 0);
+        let on_p = || other_option(4, 0x00, &p());
+        for (case, var_store_id, stored, options, want) in [
+            (
+                "the shown option's VALUE takes P",
+                2,
+                1,
+                [off(), on_p()],
+                "On <snapshot>",
+            ),
+            (
+                "an option before the shown one takes P",
+                2,
+                0,
+                [on_p(), off()],
+                "Off <snapshot>",
+            ),
+            (
+                "an option after the shown one takes P",
+                2,
+                0,
+                [off(), on_p()],
+                "Off",
+            ),
+            (
+                "no option shows, one takes P",
+                2,
+                2,
+                [off(), on_p()],
+                "2 (no matching option) <snapshot>",
+            ),
+            (
+                "a stored value from the snapshot, an OTHER option of VALUE 1",
+                1,
+                0,
+                [off(), other_option(4, 0x00, &[uint8(1)])],
+                "On <snapshot>",
+            ),
+        ] {
+            let hiidb = condition_hiidb(
+                var_store(1, N_GUID, "NStore", 3),
+                uint8_one_of(2, 2, var_store_id, 0, &options),
+            );
+
+            let (got, listed) = condition_answers(
+                &hiidb,
+                IncludedStates::empty(),
+                &other_variables_holding(stored),
+                Some(&snapshot_text()),
+            );
+
+            assert_eq!(got, Ok(vec![want.to_owned()]), "{case}: get");
+            assert_eq!(listed, [want], "{case}: list-questions");
+        }
     }
 
-    /// The variable of NStore.
-    fn n_store() -> VariableKey {
-        VariableKey {
-            name: "NStore".to_owned(),
-            guid: Guid::from(N_GUID),
-        }
+    /// set never takes a value from the snapshot: on a question whose value only the snapshot
+    /// holds, it refuses as without one, and writes nothing.
+    #[test]
+    fn set_refuses_a_question_whose_value_only_the_snapshot_holds() {
+        let variables = no_variables();
+        let (got, _, _, _) =
+            answers_with_snapshot(&snapshot_hiidb(), &["N"], &variables, &snapshot_text());
+        assert_eq!(got, ["1 <snapshot>"], "get");
+
+        let error = set_responses(
+            &snapshot_hiidb(),
+            "N",
+            &SetValue::Text("0".to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
+            None,
+        )
+        .expect_err("set N");
+
+        assert_eq!(
+            format!("{error:#}"),
+            "no EFI variable NStore-8c78a505-baa0-4c4a-869f-000000001401: the firmware has not \
+             created it or does not expose it to the OS, so its questions cannot be set from \
+             Linux; change them in the firmware setup, or ask the board vendor for firmware that \
+             exposes it; see https://github.com/linuxboot/uefisettings/issues/2",
+            "set N"
+        );
+        assert_eq!(variables.writes_to(&n_store()), [], "writes");
     }
 
-    /// A HiiDB of the driver at DRIVER_PATH, whose FormSet has the CHECKBOX N at byte 0, the
-    /// UINT16 NUMERIC W at byte 1 and the ONE_OF O of "Off" 0 and "On" 1 at byte 0 of the buffer
-    /// VarStore NStore, then, on the buffer VarStore AMITSESetup of AMI's layout, `password`, the
-    /// CHECKBOX P at byte 80, and the UINT16 NUMERICs S at byte 40 and X at byte 38.
-    fn snapshot_hiidb_with(password: Vec<u8>) -> Vec<u8> {
+    /// set's refusal of a question of NStore, whose variable only the snapshot holds.
+    const N_STORE_NOT_EXPOSED: &str = "no EFI variable \
+        NStore-8c78a505-baa0-4c4a-869f-000000001401: the firmware has not created it or does not \
+        expose it to the OS, so its questions cannot be set from Linux; change them in the \
+        firmware setup, or ask the board vendor for firmware that exposes it; see \
+        https://github.com/linuxboot/uefisettings/issues/2";
+
+    /// A HiiDB of the driver at DRIVER_PATH whose FormSet has `body` after the buffer VarStore
+    /// NStore of `size` bytes, of id 1; its strings are `strings`.
+    fn n_store_hiidb(size: u16, body: &[Vec<u8>], strings: &[&str]) -> Vec<u8> {
         let packages = [
             device_path_package(&DRIVER_PATH),
-            form_package(&[
-                var_store(1, N_GUID, "NStore", 3),
-                var_store(2, P_GUID, "AMITSESetup", 81),
-                form(
-                    1,
-                    &[
-                        checkbox_on(1, 1, 1),
-                        uint16_numeric(2, 2, 1, 1),
-                        uint8_one_of(
-                            5,
-                            5,
-                            1,
-                            0,
-                            &[flagged_option(6, 0x00, 0), flagged_option(7, 0x00, 1)],
-                        ),
-                        password,
-                        checkbox_at(4, 3, 2, 80),
-                        uint16_numeric(8, 8, 2, 40),
-                        uint16_numeric(9, 9, 2, 38),
-                    ],
-                ),
-            ]),
-            en_strings_package_of(&["N", "W", "P", "Password", "O", "Off", "On", "S", "X"]),
+            form_package(&[var_store(1, N_GUID, "NStore", size), form(1, body)]),
+            en_strings_package_of(strings),
             END_PACKAGE.to_vec(),
         ];
         package_list_with_guid([0x55; 16], &packages.concat())
     }
 
-    /// snapshot_hiidb_with a PASSWORD of 20 CHAR16s at byte 0 of AMITSESetup: X's bytes end in
-    /// its last 2, and S's follow them.
-    fn snapshot_hiidb() -> Vec<u8> {
-        snapshot_hiidb_with(password_on(3, 4, 2, 0))
+    /// The snapshot of the driver of n_store_hiidb, whose NStore holds `bytes`.
+    fn n_store_snapshot(bytes: &[u8]) -> String {
+        block_resp(&config_hdr(N_GUID, "NStore", &DRIVER_PATH), 0, bytes)
     }
 
-    /// The snapshot of snapshot_hiidb's driver: NStore holds 1, then 0x1234; AMITSESetup 40
-    /// bytes of 0xA5 for the password, then S's 0x5678, zeros, and P's 1.
-    fn snapshot_text() -> String {
-        let mut amitse_setup = [0; 81];
-        amitse_setup[..40].fill(0xA5);
-        amitse_setup[40..42].copy_from_slice(&[0x78, 0x56]);
-        amitse_setup[80] = 1;
-        [
-            block_resp(
-                &config_hdr(N_GUID, "NStore", &DRIVER_PATH),
-                0,
-                &[1, 0x34, 0x12],
-            ),
-            block_resp(
-                &config_hdr(P_GUID, "AMITSESetup", &DRIVER_PATH),
-                0,
-                &amitse_setup,
-            ),
-        ]
-        .join("&")
+    /// The error of set of `question` of `hiidb` to `value` through no variables, after
+    /// asserting that it wrote nothing.
+    #[track_caller]
+    fn set_error_without_variables(hiidb: &[u8], question: &str, value: SetValue) -> String {
+        let variables = no_variables();
+        let error = HiiBackend::set_in(
+            hiidb,
+            question,
+            &value,
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
+            None,
+        )
+        .expect_err(question);
+        assert_eq!(variables.writes_to(&n_store()), [], "{question}: writes");
+        format!("{error:#}")
     }
 
-    /// Variables that reach Runtime through efivarfs and hold none of snapshot_hiidb's.
-    fn no_variables() -> Rc<MemoryVariables> {
-        Rc::new(MemoryVariables::new(
-            VariableReach::Runtime,
-            VariableInterface::Efivarfs,
-        ))
-    }
+    /// A NUMERIC that displays hexadecimal shows its value from the snapshot in decimal, tagged,
+    /// as get shows any NUMERIC; set refuses a hexadecimal value of it as a decimal one, as it
+    /// never takes the snapshot.
+    #[test]
+    fn hexadecimal_numerics_show_snapshot_values_and_set_refuses_them() {
+        // a UINT16 NUMERIC at byte 1, EFI_IFR_DISPLAY_UINT_HEX, from 0 to 65535
+        let data = [
+            question_header_with(1, 1, 1, 1, 0x00),
+            vec![0x21, 0x00, 0x00, 0xFF, 0xFF, 0x01, 0x00],
+        ]
+        .concat();
+        let hiidb = n_store_hiidb(3, &[operation(NUMERIC, false, &data)], &["H"]);
+        let text = n_store_snapshot(&[0, 0x34, 0x12]);
 
-    /// The answers that get and list-questions give for each question of `names` of `hiidb`
-    /// through `variables` with the snapshot `text`, and what show-ifr shows; each response as
-    /// text and as JSON, after them.
-    fn answers_with_snapshot(
-        hiidb: &[u8],
-        names: &[&str],
-        variables: &Rc<MemoryVariables>,
-        text: &str,
-    ) -> (Vec<String>, Vec<String>, String, Vec<String>) {
-        let exported = || Some(ExportedConfig::new(text.to_owned()));
-        let mut outputs = Vec::new();
-        let mut got = Vec::new();
-        for name in names {
-            let response = HiiBackend::get_in(
-                hiidb,
-                *name,
-                None,
-                &GetOptions::default(),
-                shared(variables),
-                exported(),
-                None,
-            )
-            .unwrap_or_else(|error| panic!("get {name}: {error:#}"));
-            got.extend(
-                response
-                    .responses
-                    .iter()
-                    .map(|response| response.question.answer.clone()),
+        let (got, listed, ifr, _) = answers_with_snapshot(&hiidb, &["H"], &no_variables(), &text);
+
+        assert_eq!(got, ["4660 <snapshot>"], "get");
+        assert_eq!(listed, ["4660 <snapshot>"], "list-questions");
+        assert!(
+            ifr.contains("-Answer: 4660 <snapshot>\n"),
+            "show-ifr: {ifr}"
+        );
+        for value in ["0x1E", "30"] {
+            assert_eq!(
+                set_error_without_variables(&hiidb, "H", SetValue::Text(value.to_owned())),
+                N_STORE_NOT_EXPOSED,
+                "set {value}"
             );
-            outputs.push(format!("{response:#?}"));
-            outputs
-                .push(String::from_utf8_lossy(&simplejson_protocol::serialize(&response)).into());
-        }
-        let questions = HiiBackend::list_questions_in(
-            hiidb,
-            &ListQuestionsOptions::default(),
-            shared(variables),
-            exported(),
-            None,
-        )
-        .expect("list questions");
-        let listed = names
-            .iter()
-            .flat_map(|name| {
-                questions
-                    .iter()
-                    .filter(move |question| question.name == *name)
-                    .map(|question| question.answer.clone())
-            })
-            .collect();
-        for question in &questions {
-            outputs.push(format!("{question:#?}"));
-            outputs.push(String::from_utf8_lossy(&simplejson_protocol::serialize(question)).into());
         }
-        let ifr = HiiShowIfrResponse::from(
-            HiiBackend::show_ifr_in(
-                hiidb,
-                &ShowIfrOptions::default(),
-                shared(variables),
-                exported(),
-                None,
-            )
-            .expect("show the IFR"),
-        );
-        outputs.push(format!("{ifr:#?}"));
-        outputs.push(String::from_utf8_lossy(&simplejson_protocol::serialize(&ifr)).into());
-        (got, listed, ifr.readable_representation, outputs)
     }
 
-    /// Asserts that no output of `outputs` shows a byte of the 0xA5 of a password.
-    #[track_caller]
-    fn assert_no_password_byte(outputs: &[String]) {
-        for output in outputs {
-            for needle in ["a5a5", "A5A5", "165"] {
-                assert!(!output.contains(needle), "{needle} in {output}");
-            }
+    /// A DATE and a TIME on a VarStore whose variable is missing show their values from the
+    /// snapshot, tagged, as get shows a NUMERIC's; set refuses them, as it never takes the
+    /// snapshot.
+    #[test]
+    fn dates_and_times_show_snapshot_values_and_set_refuses_them() {
+        let date = [question_header_with(1, 1, 1, 0, 0x00), vec![0x00]].concat();
+        let time = [question_header_with(2, 2, 1, 4, 0x00), vec![0x00]].concat();
+        let hiidb = n_store_hiidb(
+            7,
+            &[operation(DATE, false, &date), operation(TIME, false, &time)],
+            &["D", "T"],
+        );
+        // the EFI_HII_DATE 2026-11-10 and the EFI_HII_TIME 12:34:56
+        let text = n_store_snapshot(&[0xEA, 0x07, 11, 10, 12, 34, 56]);
+
+        let (got, listed, ifr, _) =
+            answers_with_snapshot(&hiidb, &["D", "T"], &no_variables(), &text);
+
+        let want = ["2026-11-10 <snapshot>", "12:34:56 <snapshot>"];
+        assert_eq!(got, want, "get");
+        assert_eq!(listed, want, "list-questions");
+        for shown in want {
+            assert!(
+                ifr.contains(&format!("-Answer: {shown}\n")),
+                "show-ifr lacks {shown:?}: {ifr}"
+            );
+        }
+        for (question, value) in [("D", "2027-01-02"), ("T", "01:02:03")] {
+            assert_eq!(
+                set_error_without_variables(&hiidb, question, SetValue::Text(value.to_owned())),
+                N_STORE_NOT_EXPOSED,
+                "set {question}"
+            );
         }
     }
 
-    /// get, list-questions and show-ifr, as text and as JSON, take the values of questions whose
-    /// variable is missing from the ExportConfig snapshot, tagged, also of those beside a password
-    /// in its VarStore, but show a question over the password's bytes withheld, and never those
-    /// bytes.
-    #[test]
-    fn missing_variables_show_snapshot_values_but_password_bytes_stay_withheld() {
-        let (got, listed, ifr, outputs) = answers_with_snapshot(
-            &snapshot_hiidb(),
-            &["N", "W", "O", "P", "S", "X"],
-            &no_variables(),
-            &snapshot_text(),
+    /// A DATE or TIME of EFI Date/Time Storage keeps its value there (UEFI 2.11 §33.2.5.6), not
+    /// in the snapshot, which holds the bytes of VarStores only: on Linux, which reaches no Time
+    /// Services, it shows why it has no value, untagged, also when the snapshot holds the bytes
+    /// of its VarStore.
+    #[test]
+    fn dates_and_times_of_time_storage_take_no_snapshot_value() {
+        // the system time's date at byte 0 of NStore, the wake-up time's time at byte 4, and the
+        // system time's date without a VarStore
+        let date = [question_header_with(1, 1, 1, 0, 0x00), vec![0x10]].concat();
+        let time = [question_header_with(2, 2, 1, 4, 0x00), vec![0x20]].concat();
+        let only = [question_header_with(3, 3, 0, 0, 0x00), vec![0x10]].concat();
+        let hiidb = n_store_hiidb(
+            7,
+            &[
+                operation(DATE, false, &date),
+                operation(TIME, false, &time),
+                operation(DATE, false, &only),
+            ],
+            &["D", "W", "S"],
         );
+        let text = n_store_snapshot(&[0xEA, 0x07, 11, 10, 12, 34, 56]);
+
+        let (got, listed, ifr, outputs) =
+            answers_with_snapshot(&hiidb, &["D", "W", "S"], &no_variables(), &text);
 
+        let unread = |service: &str| {
+            format!(
+                "<ValueUnavailable: EFI Date/Time Storage (UEFI 2.11 §33.2.5.6) is read only \
+                 through {service}; run uefisettings.efi in the UEFI Shell>"
+            )
+        };
         let want = [
-            "1 <snapshot>",
-            "4660 <snapshot>",
-            "On <snapshot>",
-            "1 <snapshot>",
-            "22136 <snapshot>",
-            WITHHELD,
+            unread("GetTime()"),
+            unread("GetWakeupTime()"),
+            unread("GetTime()"),
         ];
         assert_eq!(got, want, "get");
         assert_eq!(listed, want, "list-questions");
-        for shown in [
-            "1 <snapshot>",
-            "4660 <snapshot>",
-            "22136 <snapshot>",
-            WITHHELD,
-        ] {
+        for shown in &want {
             assert!(
                 ifr.contains(&format!("-Answer: {shown}\n")),
                 "show-ifr lacks {shown:?}: {ifr}"
             );
         }
-        assert_no_password_byte(&outputs);
+        for output in outputs {
+            assert!(!output.contains("<snapshot>"), "{output}");
+        }
     }
 
-    /// The snapshot fills in only missing variables of the package list's driver, and none in a
-    /// HiiDB with a PASSWORD op whose VarStore is unknown, which could be any, or with IFR that the
-    /// parser drops, which could hold one: the warning says that the password cannot be withheld.
+    /// An ORDERED_LIST on a VarStore whose variable is missing shows its items from the snapshot,
+    /// tagged, as get shows a ONE_OF's option; set refuses new items, as it never takes the
+    /// snapshot.
     #[test]
-    fn snapshot_values_show_only_for_missing_variables_of_their_driver() {
-        const REFUSED: &str = "; as the VarStore of that password is unknown, uefisettings \
-            cannot withhold its bytes, so no value is shown from the ExportConfig snapshot";
-        let with_n_store = no_variables();
-        with_n_store.insert(n_store(), NV_BS_RT, &[0, 0, 0]);
-        let short_n_store = no_variables();
-        short_n_store.insert(n_store(), NV_BS_RT, &[0]);
-        let without_path = {
-            let packages = [
-                form_package(&[
-                    var_store(1, N_GUID, "NStore", 3),
-                    form(1, &[checkbox_on(1, 1, 1)]),
-                ]),
-                en_strings_package_of(&["N"]),
-                END_PACKAGE.to_vec(),
-            ];
-            package_list_with_guid([0x55; 16], &packages.concat())
-        };
-        let other_driver = snapshot_text().replace(
-            &config_hdr(N_GUID, "NStore", &DRIVER_PATH),
-            &config_hdr(N_GUID, "NStore", &[0x7F, 0xFF, 0x04, 0x00]),
-        );
-        let withheld_n = format!("{PASSWORD_BYTES} <IFR default: 0>");
-        let dropped_form_set = {
-            // a VARSTORE op that ends after 4 of the 20 bytes before its Name
-            let malformed = operation(VAR_STORE, false, &[0x00; 4]);
-            let packages = [
-                device_path_package(&DRIVER_PATH),
-                form_package_of(
-                    &[
-                        form_set(&[
-                            var_store(1, N_GUID, "NStore", 3),
-                            form(1, &[checkbox_on(1, 1, 1)]),
-                        ]),
-                        form_set(&dropped_password_second_ops(malformed)),
-                    ]
-                    .concat(),
-                ),
-                en_strings_package_of(&["N", "Password"]),
-                END_PACKAGE.to_vec(),
-            ];
-            package_list_with_guid([0x55; 16], &packages.concat())
-        };
-        for (case, hiidb, variables, text, want, refused) in [
-            (
-                "a variable that exists",
-                snapshot_hiidb(),
-                with_n_store,
-                snapshot_text(),
-                "0",
-                false,
-            ),
-            (
-                "a variable shorter than its VarStore",
-                snapshot_hiidb(),
-                short_n_store,
-                snapshot_text(),
-                "<VStoreError: EFI variable NStore-8c78a505-baa0-4c4a-869f-000000001401 \
-                 holds 1 data bytes, fewer than the 3 of its VarStore> <IFR default: 0>",
-                false,
-            ),
-            (
-                "a list without a device path package",
-                without_path,
-                no_variables(),
-                snapshot_text(),
-                MISSING_N_STORE,
-                false,
-            ),
-            (
-                "another driver's NStore",
-                snapshot_hiidb(),
-                no_variables(),
-                other_driver,
-                MISSING_N_STORE,
-                false,
-            ),
-            (
-                "a PASSWORD op on VarStore 9, which the FormSet does not declare",
-                snapshot_hiidb_with(password_on(3, 4, 9, 0)),
-                no_variables(),
-                snapshot_text(),
-                MISSING_N_STORE,
-                true,
-            ),
-            (
-                "a FormSet that the parser drops, whose PASSWORD ops are unknown, and whose \
-                 VARSTORE's Guid runs past the form package, so every variable is withheld",
-                dropped_form_set,
-                no_variables(),
-                snapshot_text(),
-                withheld_n.as_str(),
+    fn ordered_lists_show_snapshot_items_and_set_refuses_them() {
+        let list = [
+            operation(
+                ORDERED_LIST,
                 true,
+                &[question_header_with(1, 1, 1, 0, 0x00), vec![2, 0x00]].concat(),
             ),
-        ] {
-            let mut answers = None;
-            let logged = logged_by(|| {
-                answers = Some(answers_with_snapshot(&hiidb, &["N"], &variables, &text));
-            });
-            let (got, listed, _, outputs) = answers.expect("the answers");
+            flagged_option(2, 0x00, 1),
+            flagged_option(3, 0x00, 2),
+            END.to_vec(),
+        ]
+        .concat();
+        let hiidb = n_store_hiidb(2, &[list], &["L", "A", "B"]);
 
-            assert_eq!(got, [want], "{case}: get");
-            assert_eq!(listed, [want], "{case}: list-questions");
-            assert_no_password_byte(&outputs);
-            assert_eq!(
-                logged.iter().any(|message| message.ends_with(REFUSED)),
-                refused,
-                "{case}: the refusal in {logged:?}"
-            );
+        let (got, listed, ifr, _) =
+            answers_with_snapshot(&hiidb, &["L"], &no_variables(), &n_store_snapshot(&[2, 1]));
+
+        assert_eq!(got, ["B, A <snapshot>"], "get");
+        assert_eq!(listed, ["B, A <snapshot>"], "list-questions");
+        assert!(
+            ifr.contains("-Answer: B, A <snapshot>\n"),
+            "show-ifr: {ifr}"
+        );
+        let items = SetValue::Items(vec!["A".to_owned(), "B".to_owned()]);
+        assert_eq!(
+            set_error_without_variables(&hiidb, "L", items),
+            N_STORE_NOT_EXPOSED,
+            "set"
+        );
+    }
+
+    /// A REF on a VarStore whose variable is missing shows the EFI_HII_REF that the snapshot
+    /// holds, tagged, as get shows other values.
+    #[test]
+    fn cross_references_show_snapshot_values() {
+        // an EFI_IFR_REF5 at byte 0 of NStore
+        let reference = operation(REF, false, &question_header_with(1, 1, 1, 0, 0x00));
+        let hiidb = n_store_hiidb(22, &[reference], &["R"]);
+        // QuestionId 5, FormId 1, FormSetGuid N_GUID, DevicePath 0
+        let stored = [
+            &5u16.to_le_bytes()[..],
+            &1u16.to_le_bytes(),
+            &N_GUID,
+            &0u16.to_le_bytes(),
+        ]
+        .concat();
+
+        let (got, listed, ifr, _) =
+            answers_with_snapshot(&hiidb, &["R"], &no_variables(), &n_store_snapshot(&stored));
+
+        let want = "QuestionId 0x0005, FormId 0x0001, FormSetGuid \
+            8C78A505-BAA0-4C4A-869F-000000001401, DevicePath none <snapshot>";
+        assert_eq!(got, [want], "get");
+        assert_eq!(listed, [want], "list-questions");
+        assert!(
+            ifr.contains(&format!("-Answer: {want}\n")),
+            "show-ifr: {ifr}"
+        );
+    }
+
+    /// The records of staged sets that NextBootStaging's get reads, as `0` holds them.
+    #[cfg(target_os = "linux")]
+    struct StagingRecords<'a>(&'a crate::efi_variables::globals::tests::HeldVariables);
+
+    #[cfg(target_os = "linux")]
+    impl DriverHeldValues for StagingRecords<'_> {
+        fn store_name(&self) -> &'static str {
+            "staged for the next boot"
+        }
+
+        fn get(
+            &self,
+            _list: &QuestionList<'_>,
+            question: &QuestionDescriptor,
+            held: &DriverHeldQuestion,
+        ) -> Result<String> {
+            Ok(crate::staged_set::next_boot::NextBootStaging::answer(
+                Ok(self.0),
+                question,
+                held,
+            ))
+        }
+
+        fn check_set(
+            &self,
+            _list: &QuestionList<'_>,
+            _question: &QuestionDescriptor,
+            _held: &DriverHeldQuestion,
+        ) -> Result<()> {
+            Err(anyhow!("get only"))
+        }
+
+        fn set(
+            &self,
+            _list: &QuestionList<'_>,
+            _question: &QuestionDescriptor,
+            _held: &DriverHeldQuestion,
+            _value: u64,
+        ) -> Result<String> {
+            Err(anyhow!("get only"))
         }
     }
 
-    /// The snapshot drops the passwords of IFR outside any FormSet as get withholds them
-    /// (PasswordQuestions::of_lists). The FormSet of snapshot_hiidb's N and its PASSWORD on
-    /// AMITSESetup, VarStoreId 2, follows `outside`, then a FormSet whose UINT16 NUMERIC T is at
-    /// byte 0 of Shadow, whose 40 snapshot bytes are 0xA5 too:
-    /// - a VARSTORE outside any FormSet of VarStoreId 2 for Shadow keeps the password there too, so
-    ///   T shows withheld while N shows its snapshot value;
-    /// - a PASSWORD outside any FormSet leaves the password's bytes unknown, so the snapshot shows
-    ///   nothing, which the warning says;
-    /// - a VARSTORE_NAME_VALUE there of VarStoreId 2, whose driver may keep the password in any
-    ///   variable, closes every variable, and the snapshot with them.
+    /// On Linux, get of a question whose driver holds its value reads nothing of the ExportConfig
+    /// snapshot, whose <ConfigResp>s hold the bytes of VarStores only: beside the snapshot, as
+    /// without it, it shows why the question has no value and its IFR default, with what the
+    /// records of staged sets tell of it, and no `<snapshot>` mark, while a stored question of the
+    /// same prompt reads the snapshot.
+    #[cfg(target_os = "linux")]
     #[test]
-    fn the_snapshot_drops_the_passwords_of_ifr_outside_any_form_set() {
-        const REFUSED: &str = "; as the VarStore of that password is unknown, uefisettings \
-            cannot withhold its bytes, so no value is shown from the ExportConfig snapshot";
-        let hiidb = |outside: Vec<u8>| {
-            let packages = [
-                device_path_package(&DRIVER_PATH),
-                form_package_of(
-                    &[
-                        outside,
-                        form_set(&[
-                            var_store(1, N_GUID, "NStore", 3),
-                            var_store(2, P_GUID, "AMITSESetup", 81),
-                            form(1, &[checkbox_on(1, 1, 1), password_on(3, 4, 2, 0)]),
-                        ]),
-                        form_set(&[
-                            var_store(7, OTHER_GUID, "Shadow", 81),
-                            form(2, &[uint16_numeric(8, 8, 7, 0)]),
-                        ]),
-                    ]
-                    .concat(),
-                ),
-                en_strings_package_of(&["N", "W", "P", "Password", "O", "Off", "On", "T"]),
+    fn linux_get_of_a_driver_held_question_reads_nothing_of_the_snapshot() {
+        use crate::efi_variables::globals::tests::HeldVariables;
+        use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+        use crate::staged_set::record_set;
+        use crate::staged_set::Nonce;
+        use crate::staged_set::Sha256Digest;
+        use crate::staged_set::StagedImage;
+        use crate::staged_set::StagedRequest;
+        use crate::staged_set::StagedSet;
+
+        // snapshot_hiidb's N, at byte 0 of NStore, which the snapshot holds as 1; then N of
+        // FormSet 11111111-…, QuestionId 7, held by its driver
+        let held = package_list_with_guid(
+            [0x66; 16],
+            &[
+                form_package(&[form(1, &[callback_checkbox(7, 1)])]),
+                en_strings_package_of(&["N"]),
                 END_PACKAGE.to_vec(),
-            ];
-            package_list_with_guid([0x55; 16], &packages.concat())
+            ]
+            .concat(),
+        );
+        let hiidb = [snapshot_hiidb(), held].concat();
+        // a set that waits for its boot, Boot0007, with a request of 1 for the held N
+        let records =
+            HeldVariables::default().with("BootNext", EFI_GLOBAL_VARIABLE, &7u16.to_le_bytes());
+        let request = StagedRequest {
+            question: "N".to_owned(),
+            form_set: "11111111-1111-1111-1111-111111111111"
+                .parse()
+                .expect("a GUID"),
+            question_id: 7,
+            value_type: IfrValueType::Boolean,
+            value: 1,
+            include: IncludedStates::empty(),
+            assume_var_stores: Vec::new(),
+            unsafe_operations: UnsafeOperations::Refuse,
         };
-        let text = [
-            snapshot_text(),
-            block_resp(
-                &config_hdr(OTHER_GUID, "Shadow", &DRIVER_PATH),
-                0,
-                &[[0xA5; 40].as_slice(), &[0; 41]].concat(),
-            ),
-        ]
-        .join("&");
-        for (case, outside, want, refused) in [
-            (
-                "a VARSTORE of VarStoreId 2 for Shadow",
-                var_store(2, OTHER_GUID, "Shadow", 81),
-                ["1 <snapshot>", WITHHELD],
-                false,
-            ),
+        let staged = StagedSet {
+            nonce: Nonce([0x5A; 16]),
+            boot_option: 7,
+            image: StagedImage {
+                path: "\\EFI\\uefisettings\\uefisettings.efi".to_owned(),
+                sha256: Sha256Digest([0x42; 32]),
+            },
+            requests: vec![request],
+        };
+        record_set(&records, &staged).expect("record the staged set");
+        let unreached = "question has no VarStore; its driver keeps the value, which only \
+                         EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() reaches (UEFI 2.11 §33.2.5.6), \
+                         and after ExitBootServices() no EFI device-handle-based protocol may be \
+                         used (UEFI 2.11 §7.4.6); use uefisettings.efi in the UEFI Shell";
+
+        let held_answer = format!(
+            "<ValueUnavailable: {unreached}> <IFR default: 0> <1 is staged for the next boot, as \
+             Boot0007: restart to apply>"
+        );
+
+        for (case, exported, stored_from_snapshot) in [
             (
-                "a PASSWORD",
-                password_on(9, 4, 2, 0),
-                [
-                    MISSING_N_STORE,
-                    "<ValueUnavailable: no EFI variable \
-                  Shadow-33333333-3333-3333-3333-333333333333; HII buffer varstore requires \
-                  EFI_HII_CONFIG_ACCESS_PROTOCOL>",
-                ],
+                "beside the snapshot",
+                Some(ExportedConfig::new(snapshot_text())),
                 true,
             ),
+            ("without the snapshot", None, false),
         ] {
-            let mut answers = None;
-            let logged = logged_by(|| {
-                answers = Some(answers_with_snapshot(
-                    &hiidb(outside),
-                    &["N", "T"],
-                    &no_variables(),
-                    &text,
-                ));
-            });
-            let (got, listed, _, outputs) = answers.expect("the answers");
-
-            assert_eq!(got, want, "{case}: get");
-            assert_eq!(listed, want, "{case}: list-questions");
-            assert_no_password_byte(&outputs);
-            assert_eq!(
-                logged.iter().any(|message| message.ends_with(REFUSED)),
-                refused,
-                "{case}: the refusal in {logged:?}"
-            );
-        }
-
-        let hiidb = hiidb(var_store_name_value(2, OTHER_GUID));
-        for name in ["N", "T"] {
             let got = HiiBackend::get_in(
                 &hiidb,
-                name,
+                "N",
                 None,
                 &GetOptions::default(),
                 shared(&no_variables()),
-                Some(ExportedConfig::new(text.clone())),
+                exported,
                 None,
+                Some(&StagingRecords(&records)),
             )
-            .map(|response| format!("{response:#?}"))
-            .map_err(|error| format!("{error:#}"));
-            assert!(
-                got.as_ref()
-                    .is_err_and(|error| error.ends_with(ANY_VARIABLE)),
-                "a VARSTORE_NAME_VALUE of VarStoreId 2: get {name}: {got:?}"
+            .unwrap_or_else(|error| panic!("get N {case}: {error:#}"));
+
+            let answers: Vec<&str> = got
+                .responses
+                .iter()
+                .map(|response| response.question.answer.as_str())
+                .collect();
+            assert_eq!(answers.len(), 2, "the stored N and the held N {case}");
+            assert_eq!(answers[1], held_answer, "the held N {case}");
+            assert_eq!(
+                answers[0] == "1 <snapshot>",
+                stored_from_snapshot,
+                "the stored N {case}: {}",
+                answers[0]
             );
-            assert_no_password_byte(&[got.unwrap_or_else(|error| error)]);
         }
     }
 
-    /// A form that a malformed op disables (UEFI 2.11 §33.2.5.10.1) has no question that the
-    /// snapshot answers, and the snapshot withholds the bytes of its PASSWORD as get does: a
-    /// question over them shows none, the other bytes of that storage show. A PASSWORD op there
-    /// without its question header leaves its bytes unknown, so the snapshot is not read.
+    /// Reading a snapshot logs none of its bytes, at any level, also when it is no
+    /// <MultiConfigAltResp> or holds a <ConfigAltResp> that does not parse.
     #[test]
-    fn the_snapshot_answers_no_question_of_a_disabled_form_and_withholds_its_password() {
-        const REFUSED: &str = "; as the VarStore of that password is unknown, uefisettings \
-            cannot withhold its bytes, so no value is shown from the ExportConfig snapshot";
-        // the forms of snapshot_hiidb, with W and the PASSWORD in a form 2 that a CHECKBOX op
-        // ending after 4 of the 12 bytes of its data disables, whose first 2 give VarStoreId 2 to
-        // the question header of a PASSWORD op that runs on into it
-        let hiidb_with = |password: Vec<u8>| {
-            let packages = [
-                device_path_package(&DRIVER_PATH),
-                form_package(&[
-                    var_store(1, N_GUID, "NStore", 3),
-                    var_store(2, P_GUID, "AMITSESetup", 81),
-                    form(
-                        1,
-                        &[
-                            checkbox_on(1, 1, 1),
-                            uint16_numeric(8, 8, 2, 40),
-                            uint16_numeric(9, 9, 2, 38),
-                        ],
-                    ),
-                    form(
-                        2,
-                        &[
-                            uint16_numeric(2, 2, 1, 1),
-                            password,
-                            operation(CHECKBOX, false, &[0x02, 0x00, 0x00, 0x00]),
-                        ],
-                    ),
-                ]),
-                en_strings_package_of(&["N", "W", "P", "Password", "O", "Off", "On", "S", "X"]),
-                END_PACKAGE.to_vec(),
-            ];
-            package_list_with_guid([0x55; 16], &packages.concat())
-        };
-        for (case, password, names, want, refused) in [
+    fn snapshot_bytes_are_never_logged() {
+        let malformed = format!(
+            "{}&OFFSET=0&VALUE={}",
+            config_hdr(P_GUID, "AMITSESetup", &DRIVER_PATH),
+            "a5".repeat(81)
+        );
+        let partly_malformed = format!("{}&{malformed}", snapshot_text());
+
+        let logged = logged_by(|| {
+            for text in [snapshot_text(), malformed, partly_malformed] {
+                answers_with_snapshot(&snapshot_hiidb(), &["N", "P"], &no_variables(), &text);
+            }
+        });
+
+        for (what, logs) in [
             (
-                "a PASSWORD",
-                password_on(3, 4, 2, 0),
-                &["N", "W", "S", "X"][..],
-                &["1 <snapshot>", "22136 <snapshot>", WITHHELD][..],
-                false,
+                "the refusal of the malformed snapshot",
+                "not a <MultiConfigAltResp>",
             ),
             (
-                "a PASSWORD op without its question header",
-                operation(PASSWORD, false, &[3, 0, 4, 0]),
-                &["N", "W"],
-                &[MISSING_N_STORE],
-                true,
+                "the storage that does not parse",
+                "1 of the 3 <ConfigAltResp>s",
             ),
         ] {
-            let mut answers = None;
-            let logged = logged_by(|| {
-                answers = Some(answers_with_snapshot(
-                    &hiidb_with(password),
-                    names,
-                    &no_variables(),
-                    &snapshot_text(),
-                ));
-            });
-            let (got, listed, ifr, outputs) = answers.expect("the answers");
+            assert!(
+                logged.iter().any(|message| message.contains(logs)),
+                "{what} is not logged: {logged:?}"
+            );
+        }
+        assert_no_password_byte(&logged);
+    }
+
+    /// The strings of short_store_hiidb from ID 1: the prompts of the questions A to F, the
+    /// VarNames of A to E, and the texts of the options of C.
+    const SHORT_STRINGS: [&str; 13] = [
+        "A",
+        "B",
+        "C",
+        "D",
+        "E",
+        "F",
+        "ShortVarA",
+        "ShortVarB",
+        "ShortVarC",
+        "ShortVarD",
+        "ShortVarE",
+        "Off",
+        "On",
+    ];
+    /// The VarNames of the questions A to E of short_store_hiidb.
+    const SHORT_VAR_NAMES: [&str; 5] = [
+        "ShortVarA",
+        "ShortVarB",
+        "ShortVarC",
+        "ShortVarD",
+        "ShortVarE",
+    ];
+
+    /// A NUMERIC of QuestionId `question_id`, prompted string `prompt`, on VarStore 1 with VarName
+    /// `var_name`, of Flags `flags` and the MinValue, MaxValue and Step `range`.
+    fn short_numeric(
+        question_id: u16,
+        prompt: u16,
+        var_name: u16,
+        flags: u8,
+        range: &[u8],
+    ) -> Vec<u8> {
+        let data = [
+            question_header_with(question_id, prompt, 1, var_name, 0x00),
+            vec![flags],
+            range.to_vec(),
+        ]
+        .concat();
+        operation(NUMERIC, false, &data)
+    }
+
+    /// The UINT8 NUMERIC A, from 0 to 255, on VarName 7, ShortVarA.
+    fn short_numeric_a() -> Vec<u8> {
+        // EFI_IFR_NUMERIC_SIZE_1 | EFI_IFR_DISPLAY_UINT_DEC
+        short_numeric(1, 1, 7, 0x10, &[0, 255, 1])
+    }
+
+    /// The questions A to E of short_store_hiidb, each on the VarName that SHORT_VAR_NAMES names
+    /// in its place: the NUMERIC A, the CHECKBOX B, the ONE_OF C of Off (0) and On (1), the
+    /// UINT16 NUMERIC D and the UINT32 NUMERIC E.
+    fn short_questions() -> Vec<Vec<u8>> {
+        let one_of = [question_header_with(3, 3, 1, 9, 0x00), vec![0x10, 0, 1, 1]].concat();
+        let uint16_range = [0, u16::MAX, 1].map(u16::to_le_bytes).concat();
+        let uint32_range = [0, u32::MAX, 1].map(u32::to_le_bytes).concat();
+        vec![
+            short_numeric_a(),
+            checkbox_at(2, 2, 1, 8),
+            [
+                operation(ONE_OF, true, &one_of),
+                flagged_option(12, 0x00, 0),
+                flagged_option(13, 0x00, 1),
+                END.to_vec(),
+            ]
+            .concat(),
+            // EFI_IFR_NUMERIC_SIZE_2 | EFI_IFR_DISPLAY_UINT_DEC
+            short_numeric(4, 4, 10, 0x11, &uint16_range),
+            // EFI_IFR_NUMERIC_SIZE_4 | EFI_IFR_DISPLAY_UINT_DEC
+            short_numeric(5, 5, 11, 0x12, &uint32_range),
+        ]
+    }
+
+    /// A package list holding a FormSet of `children` and the strings packages `strings`.
+    fn short_store_list(children: &[Vec<u8>], strings: &[Vec<u8>]) -> Vec<u8> {
+        let packages = [
+            form_package(children),
+            strings.concat(),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x55; 16], &packages.concat())
+    }
+
+    /// A HiiDB whose FormSet declares the VARSTORE_EFI before UEFI 2.3.1 of VarStoreId 1,
+    /// SHORT_VAR_STORE_GUID and `attributes`, then holds `questions` in a form, with the strings
+    /// SHORT_STRINGS.
+    fn short_store_hiidb(attributes: u32, questions: &[Vec<u8>]) -> Vec<u8> {
+        short_store_list(
+            &[
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, attributes),
+                form(1, questions),
+            ],
+            &[en_strings_package_of(&SHORT_STRINGS)],
+        )
+    }
 
-            assert_eq!(got, want, "{case}: get");
-            assert_eq!(listed, want, "{case}: list-questions");
-            assert!(
-                !ifr.contains("4660"),
-                "{case}: show-ifr shows W's snapshot value: {ifr}"
-            );
-            assert_no_password_byte(&outputs);
-            assert_eq!(
-                logged.iter().any(|message| message.ends_with(REFUSED)),
-                refused,
-                "{case}: the refusal in {logged:?}"
-            );
+    /// The EFI variable `name` of SHORT_VAR_STORE_GUID.
+    fn short_key(name: &str) -> VariableKey {
+        VariableKey {
+            name: name.to_string(),
+            guid: Guid::from(SHORT_VAR_STORE_GUID),
         }
     }
 
-    /// The questions of a VARSTORE_EFI without runtime access, whose variable Linux does not
-    /// see, take their values from the snapshot.
-    #[test]
-    fn boot_service_only_efi_variables_show_snapshot_values() {
-        let packages = [
-            device_path_package(&DRIVER_PATH),
-            form_package(&[
-                var_store_efi(1, "Setup", NV_BS, 1),
-                form(1, &[checkbox_on(1, 1, 1)]),
-            ]),
-            en_strings_package_of(&["Q"]),
-            END_PACKAGE.to_vec(),
+    /// The variables of the questions A to E of short_store_hiidb, each NV|BS|RT, which reach
+    /// `reach` through `interface`: A holds 5, B 1, C 0, D 0x1234 and E 0x12345678.
+    fn short_variables(reach: VariableReach, interface: VariableInterface) -> Rc<MemoryVariables> {
+        let variables = MemoryVariables::new(reach, interface);
+        let values = [
+            vec![5],
+            vec![1],
+            vec![0],
+            0x1234u16.to_le_bytes().to_vec(),
+            0x1234_5678u32.to_le_bytes().to_vec(),
         ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let text = block_resp(&config_hdr([0; 16], "Setup", &DRIVER_PATH), 0, &[1]);
+        for (name, value) in SHORT_VAR_NAMES.into_iter().zip(values) {
+            variables.insert(short_key(name), NV_BS_RT, &value);
+        }
+        Rc::new(variables)
+    }
 
-        let (got, listed, ifr, _) = answers_with_snapshot(&hiidb, &["Q"], &no_variables(), &text);
+    /// short_variables through efivarfs.
+    fn short_efivarfs_variables() -> Rc<MemoryVariables> {
+        short_variables(VariableReach::Runtime, VariableInterface::Efivarfs)
+    }
 
-        assert_eq!(got, ["1 <snapshot>"], "get");
-        assert_eq!(listed, ["1 <snapshot>"], "list-questions");
-        assert!(ifr.contains("-Answer: 1 <snapshot>\n"), "show-ifr: {ifr}");
+    /// set of `question` to `value` in the HiiDB `hiidb` through `variables`, as the CLI prints an
+    /// error.
+    fn set_of(
+        hiidb: &[u8],
+        question: &str,
+        value: &str,
+        variables: &Rc<MemoryVariables>,
+    ) -> Result<(), String> {
+        set_responses(
+            hiidb,
+            question,
+            &SetValue::Text(value.to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(variables),
+                writes: &**variables,
+                held: None,
+            },
+            None,
+        )
+        .map(drop)
+        .map_err(|error| format!("{error:#}"))
     }
 
-    /// A value that an EFI_IFR_VALUE or READ expression gives is tagged when the snapshot gave
-    /// THIS or a value that the expression took, and only then.
+    /// Each ONE_OF, NUMERIC and CHECKBOX on a VARSTORE_EFI before UEFI 2.3.1 reads and sets the
+    /// EFI variable that its VarName names, of the store's Guid, from byte 0 as wide as its value,
+    /// as edk2-stable202608 SetupBrowserDxe/Setup.c GetQuestionValue and SetQuestionValue do; set
+    /// writes no other variable.
     #[test]
-    fn expression_values_show_whether_the_snapshot_gave_them() {
-        const LIVE: u16 = 2;
-        let live = VariableKey {
-            name: "Live".to_owned(),
-            guid: Guid::from(N_GUID),
-        };
-        let variables = no_variables();
-        variables.insert(live, NV_BS_RT, &[0; 4]);
-        // a UINT8 NUMERIC of QuestionId and prompt `id` at VarOffset `offset` of `var_store_id`,
-        // whose `expression` op holds `ops`
-        let numeric = |id: u16, var_store_id: u16, offset: u16, expression: u8, ops: Vec<u8>| {
-            let data = [
-                question_header_with(id, id, var_store_id, offset, 0x00),
-                vec![0x00, 0, 255, 1], // Flags, MinValue, MaxValue, Step
-            ]
-            .concat();
-            [
-                operation(NUMERIC, true, &data),
-                operation(expression, true, &[]),
-                ops,
-                END.to_vec(),
-                END.to_vec(),
-            ]
-            .concat()
-        };
-        let n = || operation(QUESTION_REF1, false, &1u16.to_le_bytes());
-        let packages = [
-            device_path_package(&DRIVER_PATH),
-            form_package(&[
-                var_store(1, N_GUID, "NStore", 3),
-                var_store(LIVE, N_GUID, "Live", 4),
-                form(
-                    1,
-                    &[
-                        checkbox_on(1, 1, 1),
-                        numeric(2, LIVE, 0, VALUE, n()),
-                        numeric(3, LIVE, 1, VALUE, uint8(7)),
-                        numeric(4, LIVE, 2, READ, n()),
-                        numeric(5, LIVE, 3, READ, uint8(5)),
-                        numeric(6, 1, 1, READ, operation(THIS, false, &[])),
-                    ],
-                ),
-            ]),
-            en_strings_package_of(&["N", "VN", "VC", "RN", "RC", "RT"]),
-            END_PACKAGE.to_vec(),
+    fn questions_of_a_short_var_store_read_and_set_the_variables_of_their_var_names() {
+        let hiidb = short_store_hiidb(NV_BS_RT, &short_questions());
+        let cases = [
+            ("A", "5", "9", vec![9]),
+            ("B", "1", "0", vec![0]),
+            ("C", "Off", "On", vec![1]),
+            ("D", "4660", "513", vec![0x01, 0x02]),
+            ("E", "305419896", "70000", 70_000u32.to_le_bytes().to_vec()),
         ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        for ((question, value, new_value, written), name) in cases.into_iter().zip(SHORT_VAR_NAMES)
+        {
+            let variables = short_efivarfs_variables();
 
-        let (got, listed, ifr, _) = answers_with_snapshot(
-            &hiidb,
-            &["N", "VN", "VC", "RN", "RC", "RT"],
-            &variables,
-            &snapshot_text(),
-        );
+            assert_eq!(
+                answers_of(&hiidb, question, &variables),
+                [value],
+                "get {question}"
+            );
+            assert_eq!(
+                set_of(&hiidb, question, new_value, &variables),
+                Ok(()),
+                "set {question}"
+            );
 
-        let want = [
-            "1 <snapshot>",
-            "1 <snapshot>",
-            "7",
-            "1 <snapshot>",
-            "5",
-            "52 <snapshot>",
-        ];
-        assert_eq!(got, want, "get");
-        assert_eq!(listed, want, "list-questions");
-        for shown in want {
-            assert!(
-                ifr.contains(&format!("-Answer: {shown}\n")),
-                "show-ifr lacks {shown:?}: {ifr}"
+            for other in SHORT_VAR_NAMES {
+                let want = match other == name {
+                    true => vec![(0, written.clone())],
+                    false => vec![],
+                };
+                assert_eq!(
+                    variables.writes_to(&short_key(other)),
+                    want,
+                    "set {question}: writes of {other}"
+                );
+            }
+            assert_eq!(
+                answers_of(&hiidb, question, &variables),
+                [new_value],
+                "get {question} after set"
             );
         }
     }
 
-    /// The questions of name/value storage take their numbers from the snapshot by the labels
-    /// that their VarName strings give, unless a number does not fit the question; zeros before
-    /// its digits do.
+    /// A question on a VARSTORE_EFI before UEFI 2.3.1 whose VarName no string holds names no
+    /// variable, where edk2-stable202608 SetupBrowserDxe/Setup.c GetToken takes the unknown string
+    /// "!": get shows why and set refuses it, while the question beside it reads.
     #[test]
-    fn name_value_questions_show_snapshot_numbers() {
-        let packages = [
-            device_path_package(&DRIVER_PATH),
-            form_package(&[
-                var_store_name_value(3, N_GUID),
-                form(
-                    1,
-                    &[
-                        checkbox_at(1, 1, 3, 5),
-                        uint16_numeric(2, 2, 3, 6),
-                        checkbox_at(3, 3, 3, 7),
-                        checkbox_at(4, 4, 3, 8),
-                        checkbox_at(5, 9, 3, 10),
-                    ],
-                ),
-            ]),
-            en_strings_package_of(&[
-                "C", "V", "X", "U", "Flag", "Word", "Wide", "Unset", "Z", "Padded",
-            ]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let text = format!(
-            "{}&Flag=01&Word=1234&Wide=0102&Padded=0001",
-            config_hdr(N_GUID, "", &DRIVER_PATH)
+    fn a_short_var_store_question_without_a_var_name_string_is_refused() {
+        let hiidb = short_store_hiidb(
+            NV_BS_RT,
+            &[
+                short_numeric_a(),
+                short_numeric(6, 6, 99, 0x10, &[0, 255, 1]),
+            ],
         );
+        let variables = short_efivarfs_variables();
+        let why =
+            "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): no string 0x0063 holds \
+                   its VarName";
 
-        let (got, listed, ifr, _) =
-            answers_with_snapshot(&hiidb, &["C", "V", "X", "U", "Z"], &no_variables(), &text);
-
-        let want = [
-            "1 <snapshot>",
-            "4660 <snapshot>",
-            "<ValueUnavailable: its number in the ExportConfig snapshot does not fit in 8 bits> \
-             <IFR default: 0>",
-            "<ValueUnavailable: HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL> \
-             <IFR default: 0>",
-            "1 <snapshot>",
-        ];
-        assert_eq!(got, want, "get");
-        assert_eq!(listed, want, "list-questions");
-        for shown in ["1 <snapshot>", "4660 <snapshot>"] {
-            assert!(
-                ifr.contains(&format!("-Answer: {shown}\n")),
-                "show-ifr lacks {shown:?}: {ifr}"
-            );
-        }
+        assert_eq!(
+            answers_of(&hiidb, "F", &variables),
+            [format!("<ValueUnavailable: {why}>")],
+            "get F"
+        );
+        assert_eq!(
+            set_of(&hiidb, "F", "1", &variables),
+            Err(format!("cannot set question \"F\": {why}")),
+            "set F"
+        );
+        assert_eq!(answers_of(&hiidb, "A", &variables), ["5"], "get A");
+        assert_eq!(
+            variables.writes_to(&short_key("ShortVarA")),
+            vec![],
+            "writes of ShortVarA"
+        );
     }
 
-    /// A STRING of name/value storage takes no value from the snapshot, whose settings of that
-    /// storage uefisettings keeps as numbers only, while a CHECKBOX there takes its number; one
-    /// whose setting the snapshot lacks says why it has no value, as a CHECKBOX does.
+    /// A question on a VARSTORE_EFI before UEFI 2.3.1 is shown and selected as any question:
+    /// list-questions shows its QuestionId, its FormSet's GUID and its keyword, show-ifr its
+    /// FormSet's GUID and its answer, and get and set select it by QuestionId and by keyword, and
+    /// read and set its variable. Here the NUMERIC A, of QuestionId 1 in form_package's FormSet,
+    /// whose prompt x-UEFI-ns names "ShortKeyA", on ShortVarA, which holds 5.
     #[test]
-    fn name_value_strings_take_no_snapshot_value() {
-        let packages = [
-            device_path_package(&DRIVER_PATH),
-            form_package(&[
-                var_store_name_value(3, N_GUID),
-                form(
-                    1,
-                    &[
-                        string_on(1, 1, (3, 3), (0, 4), &[]),
-                        checkbox_at(2, 2, 3, 4),
-                        string_on(5, 5, (3, 6), (0, 4), &[]),
-                    ],
-                ),
-            ]),
-            en_strings_package_of(&["S", "C", "Text", "Flag", "Unset", "Gone"]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let text = format!(
-            "{}&Text=00410042&Flag=01",
-            config_hdr(N_GUID, "", &DRIVER_PATH)
+    fn short_var_store_questions_show_their_identity_and_select_by_question_id_or_keyword() {
+        let hiidb = short_store_list(
+            &[
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                form(1, &[short_numeric_a()]),
+            ],
+            &[
+                en_strings_package_of(&SHORT_STRINGS),
+                strings_package_of(b"x-UEFI-ns", &["ShortKeyA"]),
+            ],
         );
+        let form_set = Guid::from([0x11; 16]).to_string();
+        let variables = short_efivarfs_variables();
 
-        let (got, listed, _, _) =
-            answers_with_snapshot(&hiidb, &["S", "C", "Unset"], &no_variables(), &text);
-
-        let want = [
-            "<ValueUnavailable: uefisettings keeps the ExportConfig snapshot's settings of a \
-             VARSTORE_NAME_VALUE as numbers only, so it takes no string from them>",
-            "1 <snapshot>",
-            "<ValueUnavailable: HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL>",
-        ];
-        assert_eq!(got, want, "get");
-        assert_eq!(listed, want, "list-questions");
-    }
+        let listed = HiiBackend::list_questions_in(
+            &hiidb,
+            &ListQuestionsOptions::default(),
+            shared(&variables),
+            None,
+            None,
+        )
+        .expect("list the questions");
+        let ifr = HiiBackend::show_ifr_in(
+            &hiidb,
+            &ShowIfrOptions::default(),
+            shared(&variables),
+            None,
+            None,
+        )
+        .expect("show the IFR")
+        .to_string();
 
-    /// A name/value question takes its snapshot number by the label that its VarName string
-    /// shows in the language of the other texts: PlatformLang, or --language before it.
-    #[test]
-    fn snapshot_labels_follow_the_text_language() {
-        let packages = [
-            device_path_package(&DRIVER_PATH),
-            form_package(&[
-                var_store_name_value(3, N_GUID),
-                form(1, &[checkbox_at(1, 1, 3, 2)]),
-            ]),
-            strings_package_of(b"en-US", &["C", "Flag"]),
-            strings_package_of(b"fr-FR", &["C", "Drapeau"]),
-            END_PACKAGE.to_vec(),
+        let listed: Vec<(&str, &str, [Option<serde_json::Value>; 3])> = listed
+            .iter()
+            .map(|question| {
+                (
+                    question.name.as_str(),
+                    question.answer.as_str(),
+                    identity_json(question),
+                )
+            })
+            .collect();
+        let identity = [
+            Some(serde_json::json!(1)),
+            Some(serde_json::json!(form_set)),
+            Some(serde_json::json!([{"namespace_id": "x-UEFI-ns", "keyword": "ShortKeyA"}])),
         ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let text = format!(
-            "{}&Flag=00&Drapeau=01",
-            config_hdr(N_GUID, "", &DRIVER_PATH)
+        assert_eq!(listed, [("A", "5", identity)], "list-questions");
+        assert!(
+            ifr.contains(&format!("GUID {form_set}")) && ifr.contains("Q: A - Help:"),
+            "show-ifr: {ifr}"
         );
-        let exported = || Some(ExportedConfig::new(text.clone()));
-        let variables = no_variables();
-
-        for (case, language, platform, want) in [
-            ("no language", None, None, "0 <snapshot>"),
-            ("PlatformLang fr-FR", None, Some("fr-FR"), "1 <snapshot>"),
-            (
-                "--language fr-FR",
-                Some("fr-FR"),
-                Some("en-US"),
-                "1 <snapshot>",
-            ),
+        assert!(ifr.contains("-Answer: 5\n"), "show-ifr: {ifr}");
+        for (question, value) in [
+            (by_address(&format!("{form_set}:1")), 9),
+            (by_keyword("ShortKeyA", None), 10),
         ] {
-            let language = language.map(str::to_owned);
+            let variables = short_efivarfs_variables();
+
             let got = HiiBackend::get_in(
                 &hiidb,
-                "C",
+                question.clone(),
                 None,
-                &GetOptions {
-                    language: language.clone(),
-                    ..GetOptions::default()
-                },
-                shared(&variables),
-                exported(),
-                platform,
-            )
-            .unwrap_or_else(|error| panic!("{case}: get: {error:#}"));
-            let listed = HiiBackend::list_questions_in(
-                &hiidb,
-                &ListQuestionsOptions {
-                    language: language.clone(),
-                    ..ListQuestionsOptions::default()
-                },
+                &GetOptions::default(),
                 shared(&variables),
-                exported(),
-                platform,
+                None,
+                None,
+                None,
             )
-            .unwrap_or_else(|error| panic!("{case}: list-questions: {error:#}"));
-            let ifr = HiiBackend::show_ifr_in(
+            .unwrap_or_else(|error| panic!("get {question}: {error:#}"));
+            let set = set_responses(
                 &hiidb,
-                &ShowIfrOptions {
-                    language,
-                    ..ShowIfrOptions::default()
+                question.clone(),
+                &SetValue::Text(value.to_string()),
+                None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
                 },
-                shared(&variables),
-                exported(),
-                platform,
+                None,
             )
-            .unwrap_or_else(|error| panic!("{case}: show-ifr: {error:#}"))
-            .to_string();
+            .map(drop)
+            .map_err(|error| format!("{error:#}"));
 
-            let answers = |questions: Vec<&Question>| {
-                questions
-                    .into_iter()
-                    .map(|question| question.answer.clone())
-                    .collect::<Vec<_>>()
-            };
+            let got: Vec<&str> = got
+                .responses
+                .iter()
+                .map(|response| response.question.answer.as_str())
+                .collect();
+            assert_eq!(got, ["5"], "get {question}");
+            assert_eq!(set, Ok(()), "set {question} {value}");
             assert_eq!(
-                answers(
-                    got.responses
-                        .iter()
-                        .map(|response| &response.question)
-                        .collect()
+                variables.writes_to(&short_key("ShortVarA")),
+                [(0, vec![value])],
+                "set {question} {value}: writes of ShortVarA"
+            );
+        }
+    }
+
+    /// A question on a VARSTORE_EFI before UEFI 2.3.1 takes no value from the ExportConfig
+    /// snapshot, as edk2-stable202608 ExportConfig() asks a driver's ExtractConfig() only for the
+    /// storages that HiiDatabaseDxe/ConfigRouting.c ParseIfrData finds, which skips the short op
+    /// (:2485): no <ConfigResp> holds the variable of a VarName, and one under the VarName's name
+    /// and the store's Guid is another storage. get, list-questions and show-ifr show the
+    /// variable, or why it has no value, untagged, here beside such a <ConfigResp> of 7.
+    #[test]
+    fn short_var_store_questions_take_no_snapshot_value() {
+        let key = "ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01";
+        let text = block_resp(
+            &config_hdr(SHORT_VAR_STORE_GUID, "ShortVarA", &DRIVER_PATH),
+            0,
+            &[7],
+        );
+        let cases = [
+            (
+                NV_BS_RT,
+                None,
+                format!("<ValueUnavailable: no EFI variable {key}>"),
+            ),
+            (
+                NV_BS,
+                None,
+                format!(
+                    "<ValueUnavailable: EFI variable {key} is not present at OS runtime: efivarfs \
+                     does not list it, and its form declares it boot-service-only (no \
+                     EFI_VARIABLE_RUNTIME_ACCESS)>"
+                ),
+            ),
+            (NV_BS_RT, Some(5), "5".to_string()),
+        ];
+        for (attributes, held, want) in cases {
+            let packages = [
+                device_path_package(&DRIVER_PATH),
+                form_package(&[
+                    short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, attributes),
+                    form(1, &[short_numeric_a()]),
+                ]),
+                en_strings_package_of(&SHORT_STRINGS),
+                END_PACKAGE.to_vec(),
+            ];
+            let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+            let variables = no_variables();
+            if let Some(value) = held {
+                variables.insert(short_key("ShortVarA"), attributes, &[value]);
+            }
+
+            let (got, listed, ifr, _) = answers_with_snapshot(&hiidb, &["A"], &variables, &text);
+
+            let case = format!("attributes {attributes:#x}, ShortVarA {held:?}");
+            assert_eq!(got, [want], "get, {case}");
+            assert_eq!(listed, got, "list-questions, {case}");
+            assert!(!ifr.contains("<snapshot>"), "show-ifr, {case}: {ifr}");
+        }
+    }
+
+    /// get shows a missing per-question variable as missing, through variables that reach Runtime
+    /// in the words of the runtime access that its VARSTORE_EFI declares: one declared without
+    /// EFI_VARIABLE_RUNTIME_ACCESS is not present at OS runtime.
+    #[test]
+    fn a_missing_per_question_variable_is_shown_as_its_var_store_declares_it() {
+        let key = "ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01";
+        let cases = [
+            (NV_BS_RT, format!("no EFI variable {key}")),
+            (
+                NV_BS,
+                format!(
+                    "EFI variable {key} is not present at OS runtime: efivarfs does not list it, \
+                     and its form declares it boot-service-only (no EFI_VARIABLE_RUNTIME_ACCESS)"
                 ),
-                [want],
-                "{case}: get"
-            );
+            ),
+        ];
+        for (attributes, why) in cases {
+            let hiidb = short_store_hiidb(attributes, &[short_numeric_a()]);
+            let variables = Rc::new(MemoryVariables::default());
+
             assert_eq!(
-                answers(listed.iter().collect()),
-                [want],
-                "{case}: list-questions"
-            );
-            assert!(
-                ifr.contains(&format!("-Answer: {want}\n")),
-                "{case}: show-ifr lacks {want:?}: {ifr}"
+                answers_of(&hiidb, "A", &variables),
+                [format!("<ValueUnavailable: {why}>")],
+                "get, attributes {attributes:#x}"
             );
         }
     }
 
-    /// A storage's later <BlockConfig> past the end of the bytes so far, as ExportConfig() gives
-    /// a buffer of one block per question, extends it.
+    /// set creates a missing per-question variable with the Attributes of its VARSTORE_EFI, as
+    /// edk2-stable202608 SetupBrowserDxe/Setup.c SetQuestionValue does ("This service can be used
+    /// to create a new variable", UEFI 2.11 §8.2.3 SetVariable), of its question's width, through
+    /// efivarfs and Variable Services; get then reads it. It refuses, creating nothing, through
+    /// variables that reach Runtime a store without EFI_VARIABLE_RUNTIME_ACCESS, whose variable no
+    /// SetVariable() sets once ExitBootServices() is performed (§8.2.3), the Attributes of a
+    /// volatile or authenticated variable, as of an existing one, and creation through the
+    /// firmware environment calls of Windows.
     #[test]
-    fn snapshot_blocks_past_the_end_extend_their_storage() {
-        let hdr = config_hdr(N_GUID, "NStore", &DRIVER_PATH);
-        let text = format!("{}&OFFSET=1&WIDTH=2&VALUE=1234", block_resp(&hdr, 0, &[1]));
-
-        let (got, listed, ifr, _) =
-            answers_with_snapshot(&snapshot_hiidb(), &["N", "W"], &no_variables(), &text);
-
-        let want = ["1 <snapshot>", "4660 <snapshot>"];
-        assert_eq!(got, want, "get");
-        assert_eq!(listed, want, "list-questions");
-        assert!(
-            ifr.contains("-Answer: 4660 <snapshot>\n"),
-            "show-ifr: {ifr}"
+    fn set_creates_a_missing_per_question_variable_with_the_attributes_of_its_var_store() {
+        // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
+        const TIME_BASED_AUTHENTICATED: u32 = 0x20;
+        let linux = (VariableReach::Runtime, VariableInterface::Efivarfs);
+        let shell = (
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
         );
-    }
-
-    /// A HiiDB of the driver at DRIVER_PATH whose FormSet has the CHECKBOX P on the VarStore
-    /// `p_store`, of id 1, and `question`, prompted string 2, on the VARSTORE_EFI Other of id 2,
-    /// whose variable holds 0; its strings are P, Q, Off and On.
-    fn condition_hiidb(p_store: Vec<u8>, question: Vec<u8>) -> Vec<u8> {
-        let packages = [
-            device_path_package(&DRIVER_PATH),
-            form_package(&[
-                p_store,
-                var_store_efi_of(2, N_GUID, "Other", NV_BS_RT, 1),
-                form(1, &[checkbox_on(1, 1, 1), question]),
-            ]),
-            en_strings_package_of(&["P", "Q", "Off", "On"]),
-            END_PACKAGE.to_vec(),
+        let windows = (
+            VariableReach::Runtime,
+            VariableInterface::FirmwareEnvironment,
+        );
+        let key = "ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01";
+        let created =
+            |attributes: u32, value: &[u8]| Ok([&attributes.to_ne_bytes()[..], value].concat());
+        let cases = [
+            (linux, NV_BS_RT, "A", "9", created(NV_BS_RT, &[9])),
+            (linux, NV_BS_RT, "D", "513", created(NV_BS_RT, &[1, 2])),
+            (shell, NV_BS, "A", "9", created(NV_BS, &[9])),
+            (shell, NV_BS_RT, "D", "513", created(NV_BS_RT, &[1, 2])),
+            (
+                linux,
+                NV_BS,
+                "A",
+                "9",
+                Err(format!(
+                    "EFI variable {key} is not present at OS runtime: efivarfs does not list it, \
+                     and its form declares it boot-service-only (no EFI_VARIABLE_RUNTIME_ACCESS)"
+                )),
+            ),
+            (
+                linux,
+                BS_RT,
+                "A",
+                "9",
+                Err(format!(
+                    "EFI variable {key} is volatile (no EFI_VARIABLE_NON_VOLATILE) and cannot be \
+                     written through efivarfs"
+                )),
+            ),
+            (
+                linux,
+                NV_BS_RT | TIME_BASED_AUTHENTICATED,
+                "A",
+                "9",
+                Err(format!(
+                    "EFI variable {key} has authenticated access (attributes 0x27), which \
+                     uefisettings does not write"
+                )),
+            ),
+            (
+                windows,
+                NV_BS_RT,
+                "A",
+                "9",
+                Err(format!(
+                    "no EFI variable {key}: the firmware has not created it or does not expose it \
+                     to the OS, so its questions cannot be set from Windows; change them in the \
+                     firmware setup, or ask the board vendor for firmware that exposes it; see \
+                     https://github.com/linuxboot/uefisettings/issues/2"
+                )),
+            ),
         ];
-        package_list_with_guid([0x55; 16], &packages.concat())
-    }
-
-    /// Variables that hold condition_hiidb's Other, 0, and none of its P.
-    fn other_variables() -> Rc<MemoryVariables> {
-        other_variables_holding(0)
-    }
+        for ((reach, interface), attributes, question, value, want) in cases {
+            let hiidb = short_store_hiidb(attributes, &short_questions());
+            let variables = Rc::new(MemoryVariables::new(reach, interface));
+            let name = match question {
+                "A" => "ShortVarA",
+                _ => "ShortVarD",
+            };
+            let case = format!("{interface:?}, attributes {attributes:#x}, set {question}");
 
-    /// Variables that hold condition_hiidb's Other, `value`, and none of its P.
-    fn other_variables_holding(value: u8) -> Rc<MemoryVariables> {
-        let variables = no_variables();
-        let other = VariableKey {
-            name: "Other".to_owned(),
-            guid: Guid::from(N_GUID),
-        };
-        variables.insert(other, NV_BS_RT, &[value]);
-        variables
-    }
+            let set = set_of(&hiidb, question, value, &variables);
 
-    /// What get of question Q of `hiidb` gives with `include` through `variables` and the
-    /// snapshot `text`, if any, and the answers that list-questions gives for it.
-    fn condition_answers(
-        hiidb: &[u8],
-        include: IncludedStates,
-        variables: &Rc<MemoryVariables>,
-        text: Option<&str>,
-    ) -> (Result<Vec<String>, String>, Vec<String>) {
-        let exported = || text.map(|text| ExportedConfig::new(text.to_owned()));
-        let got = HiiBackend::get_in(
-            hiidb,
-            "Q",
-            None,
-            &GetOptions {
-                include,
-                ..GetOptions::default()
-            },
-            shared(variables),
-            exported(),
-            None,
-        )
-        .map(|got| {
-            got.responses
-                .iter()
-                .map(|response| response.question.answer.clone())
-                .collect()
-        })
-        .map_err(|error| format!("{error:#}"));
-        let listed = HiiBackend::list_questions_in(
-            hiidb,
-            &ListQuestionsOptions {
-                include,
-                ..ListQuestionsOptions::default()
-            },
-            shared(variables),
-            exported(),
-            None,
-        )
-        .expect("list questions")
-        .into_iter()
-        .filter(|question| question.name == "Q")
-        .map(|question| question.answer)
-        .collect();
-        (got, listed)
+            assert_eq!(
+                set.map(|()| variables.bytes(&short_key(name))),
+                want.clone().map(Some),
+                "{case}"
+            );
+            if want.is_ok() {
+                assert_eq!(
+                    answers_of(&hiidb, question, &variables),
+                    [value],
+                    "{case}: get"
+                );
+            }
+            for other in SHORT_VAR_NAMES.into_iter().filter(|&other| other != name) {
+                assert_eq!(variables.bytes(&short_key(other)), None, "{case}: {other}");
+            }
+        }
     }
 
-    /// A state that a condition decides from a value of the snapshot is tagged, as values are:
-    /// get's refusal names the snapshot, and so do the answers of get and list-questions that
-    /// include the state. Without the snapshot, the condition cannot be evaluated.
+    /// set creates a missing per-question variable at one width: where a question's WRITE SETs
+    /// its own VarName at another width, set refuses to create it, as the variable would hold the
+    /// value of neither; where the variable holds the question's value, the SET of another width
+    /// stores nothing, as edk2-stable202608 would resize it, and set writes the question's value.
     #[test]
-    fn states_that_snapshot_values_decide_are_tagged() {
-        let variables = other_variables();
-        let setup = block_resp(&config_hdr([0; 16], "Setup", &DRIVER_PATH), 0, &[1]);
-        for (case, p_store, text) in [
-            (
-                "a missing variable",
-                var_store(1, N_GUID, "NStore", 3),
-                snapshot_text(),
-            ),
-            (
-                "a variable without runtime access",
-                var_store_efi(1, "Setup", NV_BS, 1),
-                setup,
+    fn set_creates_a_per_question_variable_at_one_width() {
+        const SET: u8 = 0x2C;
+        const WRITE: u8 = 0x2E;
+        const THIS: u8 = 0x58;
+        // the UINT8 NUMERIC A on ShortVarA, whose WRITE sets ShortVarA as a UINT16
+        // (EFI_IFR_TYPE_NUM_SIZE_16)
+        let set_as_uint16 = operation(
+            SET,
+            false,
+            &[&1u16.to_le_bytes()[..], &7u16.to_le_bytes(), &[0x01]].concat(),
+        );
+        let numeric_a = [
+            operation(
+                NUMERIC,
+                true,
+                &[
+                    question_header_with(1, 1, 1, 7, 0x00),
+                    // EFI_IFR_NUMERIC_SIZE_1 | EFI_IFR_DISPLAY_UINT_DEC, from 0 to 255, step 1
+                    vec![0x10, 0, 255, 1],
+                ]
+                .concat(),
             ),
-        ] {
-            // the CHECKBOX Q on Other under GRAY_OUT_IF P == 1, where only the snapshot holds
-            // P, 1
-            let hiidb = condition_hiidb(
-                p_store,
-                conditional(GRAY_OUT_IF, eq_id_val_of(1, 1), &[checkbox_on(2, 2, 2)]),
-            );
+            operation(WRITE, false, &[]),
+            [operation(THIS, true, &[]), set_as_uint16, END.to_vec()].concat(),
+            END.to_vec(),
+        ]
+        .concat();
+        let hiidb = short_store_hiidb(NV_BS_RT, &[numeric_a]);
+        let shell = (
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        for (reach, interface) in [(VariableReach::Runtime, VariableInterface::Efivarfs), shell] {
+            let variables = Rc::new(MemoryVariables::new(reach, interface));
 
-            let (got, listed) =
-                condition_answers(&hiidb, IncludedStates::empty(), &variables, Some(&text));
             assert_eq!(
-                got,
+                set_of(&hiidb, "A", "9", &variables),
                 Err(
-                    "question \"Q\" is grayed-out by a value of the ExportConfig snapshot; also \
-                     include grayed-out questions to select it"
-                        .to_owned()
+                    "EFI variable ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01 holds the value \
+                     of one question, which set would write as 2 bytes and as 1"
+                        .to_string()
                 ),
-                "{case}: get"
+                "{interface:?}: set A without ShortVarA"
             );
-            assert_eq!(listed, Vec::<String>::new(), "{case}: list-questions");
-
-            let (got, listed) =
-                condition_answers(&hiidb, IncludedStates::GRAYED_OUT, &variables, Some(&text));
-            let want = ["0 <grayed-out> <snapshot>"];
             assert_eq!(
-                got,
-                Ok(want.map(str::to_owned).to_vec()),
-                "{case}: get, grayed-out"
+                variables.bytes(&short_key("ShortVarA")),
+                None,
+                "{interface:?}: ShortVarA"
             );
-            assert_eq!(listed, want, "{case}: list-questions, grayed-out");
 
-            for include in [IncludedStates::empty(), IncludedStates::GRAYED_OUT] {
-                let (got, listed) = condition_answers(&hiidb, include, &variables, None);
-                let got = got.unwrap_or_else(|error| panic!("{case}: get without it: {error}"));
-                for answers in [got, listed] {
-                    let [answer] = answers.as_slice() else {
-                        panic!("{case}: {include:?} without the snapshot: {answers:?}");
-                    };
-                    assert!(
-                        answer.starts_with(
-                            "0 <selectable or grayed-out: EFI_IFR_EQ_ID_VAL of question 0x0001: \
-                             <ValueUnavailable: "
-                        ) && !answer.contains("snapshot"),
-                        "{case}: {include:?} without the snapshot: {answer}"
-                    );
-                }
-            }
+            variables.insert(short_key("ShortVarA"), NV_BS_RT, &[5]);
+            assert_eq!(
+                set_of(&hiidb, "A", "9", &variables),
+                Ok(()),
+                "{interface:?}: set A"
+            );
+            assert_eq!(
+                variables.writes_to(&short_key("ShortVarA")),
+                [(0, vec![9])],
+                "{interface:?}: writes of ShortVarA"
+            );
         }
     }
 
-    /// The snapshot tags just the states that its values decide: a false condition on one leaves
-    /// the question selectable by the snapshot, a condition on one under a true DISABLE_IF
-    /// decides nothing, and the stored option of a ONE_OF under a SUPPRESS_IF on one is tagged
-    /// as its question is.
+    /// set of a question whose VARSTORE_EFI before UEFI 2.3.1 lacks EFI_VARIABLE_NON_VOLATILE
+    /// creates its volatile variable through Variable Services only with VolatileWrites::Allow,
+    /// and its answer says that the value is volatile.
     #[test]
-    fn snapshot_tags_just_the_states_that_its_values_decide() {
-        let variables = other_variables();
-        let check_box = || checkbox_on(2, 2, 2);
-        let one_of = uint8_one_of(
-            2,
-            2,
-            2,
-            0,
-            &[
-                conditional(
-                    SUPPRESS_IF,
-                    eq_id_val_of(1, 1),
-                    &[flagged_option(3, 0x00, 0)],
-                ),
-                flagged_option(4, 0x00, 1),
-            ],
-        );
-        for (case, question, include, want) in [
+    fn set_creates_a_volatile_per_question_variable_if_allowed() {
+        // EFI_VARIABLE_BOOTSERVICE_ACCESS alone
+        const BS: u32 = 0x02;
+        let hiidb = short_store_hiidb(BS, &[short_numeric_a()]);
+        let cases = [
             (
-                "a false condition",
-                conditional(GRAY_OUT_IF, eq_id_val_of(1, 0), &[check_box()]),
-                IncludedStates::empty(),
-                "0 <selectable> <snapshot>",
+                VolatileWrites::Allow,
+                Ok(vec![format!("9{VOLATILE_ANNOTATION}")]),
+                Some([&BS.to_ne_bytes()[..], &[9]].concat()),
             ),
             (
-                "a condition under a true DISABLE_IF",
-                conditional(
-                    DISABLE_IF,
-                    ifr_true(),
-                    &[conditional(GRAY_OUT_IF, eq_id_val_of(1, 1), &[check_box()])],
+                VolatileWrites::Refuse,
+                Err(
+                    "EFI variable ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01 is volatile (no \
+                     EFI_VARIABLE_NON_VOLATILE), so a write would not outlast a power cycle; pass \
+                     --allow-volatile to write it anyway"
+                        .to_string(),
                 ),
-                IncludedStates::GRAYED_OUT | IncludedStates::DISABLED,
-                "0 <disabled>",
-            ),
-            (
-                "the stored option under a SUPPRESS_IF",
-                one_of,
-                IncludedStates::empty(),
-                "Off <option suppressed> <snapshot>",
+                None,
             ),
-        ] {
-            let hiidb = condition_hiidb(var_store(1, N_GUID, "NStore", 3), question);
+        ];
+        for (volatile, want, bytes) in cases {
+            let variables = Rc::new(MemoryVariables::new(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            ));
+            let options = SetOptions {
+                volatile,
+                ..SetOptions::default()
+            };
 
-            let (got, listed) =
-                condition_answers(&hiidb, include, &variables, Some(&snapshot_text()));
+            let got = set_responses(
+                &hiidb,
+                "A",
+                &SetValue::Text("9".to_owned()),
+                None,
+                &options,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
+                None,
+            );
 
-            assert_eq!(got, Ok(vec![want.to_owned()]), "{case}: get");
-            assert_eq!(listed, [want], "{case}: list-questions");
+            let answers = got.map(|list| {
+                list.responses
+                    .into_iter()
+                    .map(|response| response.question.answer)
+                    .collect::<Vec<_>>()
+            });
+            assert_eq!(
+                answers.map_err(|error| format!("{error:#}")),
+                want,
+                "{volatile:?}: answers"
+            );
+            assert_eq!(
+                variables.bytes(&short_key("ShortVarA")),
+                bytes,
+                "{volatile:?}: ShortVarA"
+            );
         }
     }
 
-    /// show-ifr shows the condition ops of a question by their OpCode, untagged, beside the values
-    /// that it tags: P's from the snapshot, and that of Q, under a GRAY_OUT_IF on P, from its
-    /// variable.
+    /// get and set refuse a per-question variable whose data is not exactly as wide as its
+    /// question's value, naming both sizes, where edk2-stable202608 SetupBrowserDxe/Setup.c
+    /// GetQuestionValue would show a value that it did not read, or a part of one, and
+    /// SetQuestionValue would change the variable's size; set writes nothing.
     #[test]
-    fn show_ifr_tags_snapshot_values_beside_condition_ops() {
-        let hiidb = condition_hiidb(
-            var_store(1, N_GUID, "NStore", 3),
-            conditional(GRAY_OUT_IF, eq_id_val_of(1, 1), &[checkbox_on(2, 2, 2)]),
-        );
-
-        let (_, _, ifr, _) =
-            answers_with_snapshot(&hiidb, &[], &other_variables(), &snapshot_text());
+    fn a_per_question_variable_of_another_size_is_refused() {
+        let hiidb = short_store_hiidb(NV_BS_RT, &short_questions());
+        let cases: [(&str, &[u8], usize, u8); 3] =
+            [("A", &[5, 0], 2, 1), ("A", &[], 0, 1), ("D", &[0x34], 1, 2)];
+        for (question, data, held, width) in cases {
+            let name = format!("ShortVar{question}");
+            let variables = Rc::new(MemoryVariables::default());
+            variables.insert(short_key(&name), NV_BS_RT, data);
+            let case = format!("{question} on {held} bytes");
+            let why = format!(
+                "EFI variable {name}-8c78a505-baa0-4c4a-869f-000000000b01 holds {held} bytes; the \
+                 question takes {width}"
+            );
 
-        let shown: Vec<&str> = ifr
-            .lines()
-            .map(str::trim_start)
-            .skip_while(|line| *line != "OpCode: Form")
-            .map(|line| line.split(" - ").next().unwrap_or(line))
-            .collect();
-        assert_eq!(
-            shown,
-            [
-                "OpCode: Form",
-                "OpCode: CheckBox",
-                "-Answer: 1 <snapshot>",
-                "OpCode: GrayOutIf",
-                "OpCode: EqIdVal",
-                "OpCode: CheckBox",
-                "-Answer: 0",
-            ],
-            "{ifr}"
-        );
+            assert_eq!(
+                answers_of(&hiidb, question, &variables),
+                [format!("<ValueUnavailable: {why}>")],
+                "{case}: get"
+            );
+            assert_eq!(
+                set_of(&hiidb, question, "1", &variables),
+                Err(why),
+                "{case}: set"
+            );
+            assert_eq!(
+                variables.writes_to(&short_key(&name)),
+                vec![],
+                "{case}: writes"
+            );
+        }
     }
 
-    /// The option that a ONE_OF answers is tagged when values that options of Type OTHER took
-    /// from the snapshot decide it: the option took its value from there, or one before it that
-    /// did would show if it matched, or none shows; one after it decides nothing. A stored value
-    /// from the snapshot tags an OTHER option of a constant VALUE as it tags any option.
+    /// A question in a FormSet's own scope, outside any form, reads its value from a VARSTORE_EFI
+    /// before UEFI 2.3.1 and from one of UEFI 2.3.1 alike, without a panic, and one there whose
+    /// VarStore no op declares has no value.
     #[test]
-    fn options_whose_values_the_snapshot_gives_tag_the_one_of_answer() {
-        // EFI_IFR_QUESTION_REF1 of P, which only the snapshot holds: 1
-        let p = || vec![operation(QUESTION_REF1, false, &1u16.to_le_bytes())];
-        let off = || flagged_option(3, 0x00, 0);
-        let on_p = || other_option(4, 0x00, &p());
-        for (case, var_store_id, stored, options, want) in [
-            (
-                "the shown option's VALUE takes P",
-                2,
-                1,
-                [off(), on_p()],
-                "On <snapshot>",
-            ),
-            (
-                "an option before the shown one takes P",
-                2,
-                0,
-                [on_p(), off()],
-                "Off <snapshot>",
-            ),
+    fn a_question_outside_a_form_reads_its_var_store() {
+        let variables = short_efivarfs_variables();
+        let long = VariableKey {
+            name: "Long".to_string(),
+            guid: NIL_GUID,
+        };
+        variables.insert(long, NV_BS_RT, &[7]);
+        let on_var_store_9 = [
+            question_header_with(1, 1, 9, 7, 0x00),
+            vec![0x10, 0, 255, 1],
+        ]
+        .concat();
+        let cases = [
             (
-                "an option after the shown one takes P",
-                2,
-                0,
-                [off(), on_p()],
-                "Off",
+                "before UEFI 2.3.1",
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                short_numeric_a(),
+                "5",
             ),
             (
-                "no option shows, one takes P",
-                2,
-                2,
-                [off(), on_p()],
-                "2 (no matching option) <snapshot>",
+                "UEFI 2.3.1",
+                var_store_efi(1, "Long", NV_BS_RT, 1),
+                short_numeric(1, 1, 0, 0x10, &[0, 255, 1]),
+                "7",
             ),
             (
-                "a stored value from the snapshot, an OTHER option of VALUE 1",
-                1,
-                0,
-                [off(), other_option(4, 0x00, &[uint8(1)])],
-                "On <snapshot>",
+                "undeclared",
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                operation(NUMERIC, false, &on_var_store_9),
+                "<ValueUnavailable: no supported varstore with matching id 0x0009 found>",
             ),
-        ] {
-            let hiidb = condition_hiidb(
-                var_store(1, N_GUID, "NStore", 3),
-                uint8_one_of(2, 2, var_store_id, 0, &options),
-            );
-
-            let (got, listed) = condition_answers(
-                &hiidb,
-                IncludedStates::empty(),
-                &other_variables_holding(stored),
-                Some(&snapshot_text()),
-            );
+        ];
+        for (case, store, question, value) in cases {
+            let hiidb =
+                short_store_list(&[store, question], &[en_strings_package_of(&SHORT_STRINGS)]);
 
-            assert_eq!(got, Ok(vec![want.to_owned()]), "{case}: get");
-            assert_eq!(listed, [want], "{case}: list-questions");
+            assert_eq!(answers_of(&hiidb, "A", &variables), [value], "{case}");
         }
     }
 
-    /// set never takes a value from the snapshot: on a question whose value only the snapshot
-    /// holds, it refuses as without one, and writes nothing.
+    /// A VarName whose strings differ between the strings packages of its package list names no
+    /// variable, as edk2-stable202608 SetupBrowserDxe/Setup.c GetToken takes the string in the
+    /// platform language, which uefisettings does not know: its question refuses, naming the
+    /// VarName and the languages. One that every package holding it agrees on names its variable,
+    /// also when a package, as an x-UEFI-ns one, lacks it.
     #[test]
-    fn set_refuses_a_question_whose_value_only_the_snapshot_holds() {
-        let variables = no_variables();
-        let (got, _, _, _) =
-            answers_with_snapshot(&snapshot_hiidb(), &["N"], &variables, &snapshot_text());
-        assert_eq!(got, ["1 <snapshot>"], "get");
-
-        let error = set_responses(
-            &snapshot_hiidb(),
-            "N",
-            &SetValue::Text("0".to_owned()),
-            None,
-            &SetOptions::default(),
-            shared(&variables),
-            &*variables,
-            None,
-        )
-        .expect_err("set N");
+    fn strings_packages_that_differ_on_a_var_name_refuse_its_question() {
+        let mut french = SHORT_STRINGS;
+        french[6] = "VarCourteA";
+        let hiidb = short_store_list(
+            &[
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                form(1, &short_questions()[..2]),
+            ],
+            &[
+                strings_package_of(b"en", &SHORT_STRINGS),
+                strings_package_of(b"fr", &french),
+                strings_package_of(b"x-UEFI-ns", &SHORT_STRINGS[..6]),
+            ],
+        );
+        let variables = short_efivarfs_variables();
+        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): the strings packages \
+                   differ on its VarName 0x0007: \"ShortVarA\" in en, \"VarCourteA\" in fr";
 
         assert_eq!(
-            format!("{error:#}"),
-            "no EFI variable NStore-8c78a505-baa0-4c4a-869f-000000001401: the firmware has not \
-             created it or does not expose it to the OS, so its questions cannot be set from \
-             Linux; change them in the firmware setup, or ask the board vendor for firmware that \
-             exposes it; see https://github.com/linuxboot/uefisettings/issues/2",
-            "set N"
+            answers_of(&hiidb, "A", &variables),
+            [format!("<ValueUnavailable: {why}>")],
+            "get A"
         );
-        assert_eq!(variables.writes_to(&n_store()), [], "writes");
+        assert_eq!(
+            set_of(&hiidb, "A", "9", &variables),
+            Err(format!("cannot set question \"A\": {why}")),
+            "set A"
+        );
+        assert_eq!(answers_of(&hiidb, "B", &variables), ["1"], "get B");
     }
 
-    /// set's refusal of a question of NStore, whose variable only the snapshot holds.
-    const N_STORE_NOT_EXPOSED: &str = "no EFI variable \
-        NStore-8c78a505-baa0-4c4a-869f-000000001401: the firmware has not created it or does not \
-        expose it to the OS, so its questions cannot be set from Linux; change them in the \
-        firmware setup, or ask the board vendor for firmware that exposes it; see \
-        https://github.com/linuxboot/uefisettings/issues/2";
+    /// A question in the scope of the GUID op of an EDKII bit varstore field, on a VARSTORE_EFI
+    /// before UEFI 2.3.1, is refused by name: there its VarStoreInfo is a VarName, not the bit
+    /// offset that the field takes it for.
+    #[test]
+    fn an_edkii_bit_field_on_a_short_var_store_is_refused() {
+        let uint32_range = [0, u32::MAX, 1].map(u32::to_le_bytes).concat();
+        let bit_field = [
+            operation(GUID, true, &BIT_VARSTORE_GUID),
+            // a field of 8 bits
+            short_numeric(1, 1, 7, 0x08, &uint32_range),
+            END.to_vec(),
+        ]
+        .concat();
+        let hiidb = short_store_hiidb(NV_BS_RT, &[bit_field]);
+        let variables = short_efivarfs_variables();
+        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): the question is an \
+                   EDKII bit varstore field, whose VarStoreInfo is a bit offset, not a VarName";
 
-    /// A HiiDB of the driver at DRIVER_PATH whose FormSet has `body` after the buffer VarStore
-    /// NStore of `size` bytes, of id 1; its strings are `strings`.
-    fn n_store_hiidb(size: u16, body: &[Vec<u8>], strings: &[&str]) -> Vec<u8> {
-        let packages = [
-            device_path_package(&DRIVER_PATH),
-            form_package(&[var_store(1, N_GUID, "NStore", size), form(1, body)]),
-            en_strings_package_of(strings),
-            END_PACKAGE.to_vec(),
-        ];
-        package_list_with_guid([0x55; 16], &packages.concat())
+        assert_eq!(
+            answers_of(&hiidb, "A", &variables),
+            [format!("<ValueUnavailable: {why}>")],
+            "get A"
+        );
+        assert_eq!(
+            set_of(&hiidb, "A", "9", &variables),
+            Err(format!("cannot set question \"A\": {why}")),
+            "set A"
+        );
+        assert_eq!(
+            variables.writes_to(&short_key("ShortVarA")),
+            vec![],
+            "writes of ShortVarA"
+        );
     }
 
-    /// The snapshot of the driver of n_store_hiidb, whose NStore holds `bytes`.
-    fn n_store_snapshot(bytes: &[u8]) -> String {
-        block_resp(&config_hdr(N_GUID, "NStore", &DRIVER_PATH), 0, bytes)
-    }
+    /// A question that precedes the VARSTORE_EFI before UEFI 2.3.1 that it names is refused by
+    /// name: it took its VarStoreInfo for a VarOffset, as its VarStoreId names a previously
+    /// declared variable store (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER).
+    #[test]
+    fn a_question_before_its_short_var_store_is_refused() {
+        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): declared after the \
+                   question, which took its VarStoreInfo for a VarOffset; a question names a \
+                   previously declared VarStore (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER)";
+        // VarStoreInfo 7 and 0, which the question takes for VarOffsets
+        for var_store_info in [7, 0] {
+            let hiidb = short_store_list(
+                &[
+                    form(
+                        1,
+                        &[short_numeric(1, 1, var_store_info, 0x10, &[0, 255, 1])],
+                    ),
+                    short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                ],
+                &[en_strings_package_of(&SHORT_STRINGS)],
+            );
+            let variables = short_efivarfs_variables();
 
-    /// The error of set of `question` of `hiidb` to `value` through no variables, after
-    /// asserting that it wrote nothing.
-    #[track_caller]
-    fn set_error_without_variables(hiidb: &[u8], question: &str, value: SetValue) -> String {
-        let variables = no_variables();
-        let error = HiiBackend::set_in(
-            hiidb,
-            question,
-            &value,
-            None,
-            &SetOptions::default(),
-            shared(&variables),
-            &*variables,
-            None,
-        )
-        .expect_err(question);
-        assert_eq!(variables.writes_to(&n_store()), [], "{question}: writes");
-        format!("{error:#}")
+            assert_eq!(
+                answers_of(&hiidb, "A", &variables),
+                [format!("<ValueUnavailable: {why}>")],
+                "VarStoreInfo {var_store_info}: get A"
+            );
+            assert_eq!(
+                set_of(&hiidb, "A", "9", &variables),
+                Err(format!("cannot set question \"A\": {why}")),
+                "VarStoreInfo {var_store_info}: set A"
+            );
+        }
     }
 
-    /// A NUMERIC that displays hexadecimal shows its value from the snapshot in decimal, tagged,
-    /// as get shows any NUMERIC; set refuses a hexadecimal value of it as a decimal one, as it
-    /// never takes the snapshot.
-    #[test]
-    fn hexadecimal_numerics_show_snapshot_values_and_set_refuses_them() {
-        // a UINT16 NUMERIC at byte 1, EFI_IFR_DISPLAY_UINT_HEX, from 0 to 65535
-        let data = [
-            question_header_with(1, 1, 1, 1, 0x00),
-            vec![0x21, 0x00, 0x00, 0xFF, 0xFF, 0x01, 0x00],
-        ]
-        .concat();
-        let hiidb = n_store_hiidb(3, &[operation(NUMERIC, false, &data)], &["H"]);
-        let text = n_store_snapshot(&[0, 0x34, 0x12]);
+    /// A DATE and a TIME on a VARSTORE_EFI before UEFI 2.3.1 read and set the EFI variable that
+    /// their VarName names, their EFI_HII_DATE or EFI_HII_TIME from byte 0, as a NUMERIC there
+    /// does; set writes no other variable. A DATE before the store took its VarStoreInfo for a
+    /// VarOffset and is refused as a NUMERIC is.
+    #[test]
+    fn dates_and_times_of_a_short_var_store_read_and_set_the_variables_of_their_var_names() {
+        // prompts "Day" and "Hour", strings 1 and 2, on the VarNames 3 and 4
+        let date = operation(
+            DATE,
+            false,
+            &[question_header_with(1, 1, 1, 3, 0x00), vec![0x00]].concat(),
+        );
+        let time = operation(
+            TIME,
+            false,
+            &[question_header_with(2, 2, 1, 4, 0x00), vec![0x00]].concat(),
+        );
+        let strings = [en_strings_package_of(&[
+            "Day",
+            "Hour",
+            "ShortDate",
+            "ShortTime",
+        ])];
+        let short_store = short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT);
+        let hiidb = short_store_list(
+            &[short_store.clone(), form(1, &[date.clone(), time])],
+            &strings,
+        );
+        // the EFI_HII_DATE 2026-11-10 and the EFI_HII_TIME 12:34:56
+        let stored = [
+            ("ShortDate", vec![0xEA, 0x07, 11, 10]),
+            ("ShortTime", vec![12, 34, 56]),
+        ];
+        let variables = || {
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            for (name, value) in &stored {
+                variables.insert(short_key(name), NV_BS_RT, value);
+            }
+            Rc::new(variables)
+        };
+        let cases = [
+            (
+                "Day",
+                "2026-11-10",
+                "2027-01-02",
+                "ShortDate",
+                vec![0xEB, 0x07, 1, 2],
+            ),
+            ("Hour", "12:34:56", "01:02:03", "ShortTime", vec![1, 2, 3]),
+        ];
+
+        for (question, value, new_value, name, written) in cases {
+            let variables = variables();
 
-        let (got, listed, ifr, _) = answers_with_snapshot(&hiidb, &["H"], &no_variables(), &text);
+            assert_eq!(
+                answers_of(&hiidb, question, &variables),
+                [value],
+                "get {question}"
+            );
+            assert_eq!(
+                set_of(&hiidb, question, new_value, &variables),
+                Ok(()),
+                "set {question}"
+            );
 
-        assert_eq!(got, ["4660 <snapshot>"], "get");
-        assert_eq!(listed, ["4660 <snapshot>"], "list-questions");
-        assert!(
-            ifr.contains("-Answer: 4660 <snapshot>\n"),
-            "show-ifr: {ifr}"
-        );
-        for value in ["0x1E", "30"] {
+            for (other, _) in &stored {
+                let want = match *other == name {
+                    true => vec![(0, written.clone())],
+                    false => vec![],
+                };
+                assert_eq!(
+                    variables.writes_to(&short_key(other)),
+                    want,
+                    "set {question}: writes of {other}"
+                );
+            }
             assert_eq!(
-                set_error_without_variables(&hiidb, "H", SetValue::Text(value.to_owned())),
-                N_STORE_NOT_EXPOSED,
-                "set {value}"
+                answers_of(&hiidb, question, &variables),
+                [new_value],
+                "get {question} after set"
             );
         }
+
+        let declared_after = short_store_list(&[form(1, &[date]), short_store], &strings);
+        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): declared after the \
+                   question, which took its VarStoreInfo for a VarOffset; a question names a \
+                   previously declared VarStore (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER)";
+        let variables = variables();
+        assert_eq!(
+            answers_of(&declared_after, "Day", &variables),
+            [format!("<ValueUnavailable: {why}>")],
+            "get of the DATE before its store"
+        );
+        assert_eq!(
+            set_of(&declared_after, "Day", "2027-01-02", &variables),
+            Err(format!("cannot set question \"Day\": {why}")),
+            "set of the DATE before its store"
+        );
     }
 
-    /// A DATE and a TIME on a VarStore whose variable is missing show their values from the
-    /// snapshot, tagged, as get shows a NUMERIC's; set refuses them, as it never takes the
-    /// snapshot.
+    /// A DATE and a TIME over the bytes of a PASSWORD outside any FormSet of their VarStoreId keep
+    /// them withheld, as a NUMERIC does: get answers that their bytes hold a password, and set
+    /// refuses them and writes nothing.
     #[test]
-    fn dates_and_times_show_snapshot_values_and_set_refuses_them() {
-        let date = [question_header_with(1, 1, 1, 0, 0x00), vec![0x00]].concat();
-        let time = [question_header_with(2, 2, 1, 4, 0x00), vec![0x00]].concat();
-        let hiidb = n_store_hiidb(
-            7,
-            &[operation(DATE, false, &date), operation(TIME, false, &time)],
-            &["D", "T"],
-        );
-        // the EFI_HII_DATE 2026-11-10 and the EFI_HII_TIME 12:34:56
-        let text = n_store_snapshot(&[0xEA, 0x07, 11, 10, 12, 34, 56]);
+    fn dates_and_times_keep_an_outside_password_withheld() {
+        let date = [question_header_with(4, 4, 2, 0, 0x00), vec![0x00]].concat();
+        let time = [question_header_with(5, 5, 2, 4, 0x00), vec![0x00]].concat();
+        let packages = [
+            form_package_of(
+                &[
+                    password_on(3, 3, 2, 0),
+                    form_set(&[
+                        var_store(2, [0x44; 16], "AMITSESetup", 81),
+                        form(
+                            1,
+                            &[operation(DATE, false, &date), operation(TIME, false, &time)],
+                        ),
+                    ]),
+                ]
+                .concat(),
+            ),
+            en_strings_package_of(&["Q", "P", "Password", "D", "T"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let stored = [plaintext_password().as_slice(), &[0xAA; 40], &[1]].concat();
 
-        let (got, listed, ifr, _) =
-            answers_with_snapshot(&hiidb, &["D", "T"], &no_variables(), &text);
+        for (question, value) in [("D", "2027-01-02"), ("T", "01:02:03")] {
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            variables.insert(amitse_setup(), NV_BS_RT, &stored);
+            let variables = Rc::new(variables);
 
-        let want = ["2026-11-10 <snapshot>", "12:34:56 <snapshot>"];
-        assert_eq!(got, want, "get");
-        assert_eq!(listed, want, "list-questions");
-        for shown in want {
+            assert_eq!(
+                answers_of(&hiidb, question, &variables),
+                [PASSWORD_BYTES],
+                "get {question}"
+            );
+            let set = set_bypassing(&hiidb, question, value, &variables);
             assert!(
-                ifr.contains(&format!("-Answer: {shown}\n")),
-                "show-ifr lacks {shown:?}: {ifr}"
+                set.as_ref().is_err_and(|error| error
+                    .contains("holds a password at bytes 0..40, which set never writes")),
+                "set {question}: {set:?}"
             );
-        }
-        for (question, value) in [("D", "2027-01-02"), ("T", "01:02:03")] {
             assert_eq!(
-                set_error_without_variables(&hiidb, question, SetValue::Text(value.to_owned())),
-                N_STORE_NOT_EXPOSED,
-                "set {question}"
+                variables.writes_to(&amitse_setup()),
+                [],
+                "set {question}: writes to AMITSESetup"
             );
         }
     }
 
-    /// A DATE or TIME of EFI Date/Time Storage keeps its value there (UEFI 2.11 §33.2.5.6), not
-    /// in the snapshot, which holds the bytes of VarStores only: on Linux, which reaches no Time
-    /// Services, it shows why it has no value, untagged, also when the snapshot holds the bytes
-    /// of its VarStore.
+    /// An ORDERED_LIST on a VARSTORE_EFI before UEFI 2.3.1 reads and sets its MaxContainers
+    /// containers, of UINT8 or UINT16 options, as the whole EFI variable that its VarName names,
+    /// as edk2-stable202608 SetupBrowserDxe/Setup.c GetQuestionValue and SetQuestionValue do
+    /// through its BufferValue; a variable of another size is refused and not written. One before
+    /// the store took its VarStoreInfo for a VarOffset and is refused as a NUMERIC is.
     #[test]
-    fn dates_and_times_of_time_storage_take_no_snapshot_value() {
-        // the system time's date at byte 0 of NStore, the wake-up time's time at byte 4, and the
-        // system time's date without a VarStore
-        let date = [question_header_with(1, 1, 1, 0, 0x00), vec![0x10]].concat();
-        let time = [question_header_with(2, 2, 1, 4, 0x00), vec![0x20]].concat();
-        let only = [question_header_with(3, 3, 0, 0, 0x00), vec![0x10]].concat();
-        let hiidb = n_store_hiidb(
-            7,
-            &[
-                operation(DATE, false, &date),
-                operation(TIME, false, &time),
-                operation(DATE, false, &only),
-            ],
-            &["D", "W", "S"],
+    fn ordered_lists_of_a_short_var_store_read_and_set_the_variables_of_their_var_names() {
+        // prompt "L", string 1, on the VarName 4
+        let list = [
+            operation(
+                ORDERED_LIST,
+                true,
+                &[question_header_with(1, 1, 1, 4, 0x00), vec![2, 0x00]].concat(),
+            ),
+            flagged_option(2, 0x00, 1),
+            flagged_option(3, 0x00, 2),
+            END.to_vec(),
+        ]
+        .concat();
+        let strings = [en_strings_package_of(&["L", "A", "B", "ShortList"])];
+        let short_store = short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT);
+        let hiidb = short_store_list(
+            &[short_store.clone(), form(1, std::slice::from_ref(&list))],
+            &strings,
         );
-        let text = n_store_snapshot(&[0xEA, 0x07, 11, 10, 12, 34, 56]);
-
-        let (got, listed, ifr, outputs) =
-            answers_with_snapshot(&hiidb, &["D", "W", "S"], &no_variables(), &text);
-
-        let unread = |service: &str| {
-            format!(
-                "<ValueUnavailable: EFI Date/Time Storage (UEFI 2.11 §33.2.5.6) is read only \
-                 through {service}; run uefisettings.efi in the UEFI Shell>"
+        let variables = |value: &[u8]| {
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            variables.insert(short_key("ShortList"), NV_BS_RT, value);
+            Rc::new(variables)
+        };
+        let set_items = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
+            HiiBackend::set_in(
+                hiidb,
+                "L",
+                &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
+                None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(variables),
+                    writes: &**variables,
+                    held: None,
+                },
+                None,
             )
+            .map(drop)
+            .map_err(|error| format!("{error:#}"))
         };
-        let want = [
-            unread("GetTime()"),
-            unread("GetWakeupTime()"),
-            unread("GetTime()"),
-        ];
-        assert_eq!(got, want, "get");
-        assert_eq!(listed, want, "list-questions");
-        for shown in &want {
-            assert!(
-                ifr.contains(&format!("-Answer: {shown}\n")),
-                "show-ifr lacks {shown:?}: {ifr}"
-            );
-        }
-        for output in outputs {
-            assert!(!output.contains("<snapshot>"), "{output}");
-        }
-    }
 
-    /// An ORDERED_LIST on a VarStore whose variable is missing shows its items from the snapshot,
-    /// tagged, as get shows a ONE_OF's option; set refuses new items, as it never takes the
-    /// snapshot.
-    #[test]
-    fn ordered_lists_show_snapshot_items_and_set_refuses_them() {
-        let list = [
+        let stored = variables(&[1, 2]);
+        assert_eq!(answers_of(&hiidb, "L", &stored), ["A, B"], "get");
+        assert_eq!(set_items(&hiidb, &stored), Ok(()), "set");
+        assert_eq!(
+            stored.writes_to(&short_key("ShortList")),
+            [(0, vec![2, 1])],
+            "writes of ShortList"
+        );
+        assert_eq!(answers_of(&hiidb, "L", &stored), ["B, A"], "get after set");
+
+        let wider = variables(&[1, 2, 0]);
+        let why = "EFI variable ShortList-8c78a505-baa0-4c4a-869f-000000000b01 holds 3 bytes; \
+                   the question takes 2";
+        assert_eq!(
+            answers_of(&hiidb, "L", &wider),
+            [format!("<ValueUnavailable: {why}>")],
+            "get of 3 bytes"
+        );
+        let set = set_items(&hiidb, &wider);
+        assert!(
+            set.as_ref().is_err_and(|error| error.ends_with(why)),
+            "set of 3 bytes: {set:?}"
+        );
+        assert_eq!(
+            wider.writes_to(&short_key("ShortList")),
+            [],
+            "writes of 3 bytes"
+        );
+
+        // 2 containers of EFI_IFR_TYPE_NUM_SIZE_16 options, 4 bytes
+        let wide_list = [
             operation(
                 ORDERED_LIST,
                 true,
-                &[question_header_with(1, 1, 1, 0, 0x00), vec![2, 0x00]].concat(),
+                &[question_header_with(1, 1, 1, 4, 0x00), vec![2, 0x00]].concat(),
             ),
-            flagged_option(2, 0x00, 1),
-            flagged_option(3, 0x00, 2),
+            uint16_option(2, 1),
+            uint16_option(3, 2),
             END.to_vec(),
         ]
         .concat();
-        let hiidb = n_store_hiidb(2, &[list], &["L", "A", "B"]);
-
-        let (got, listed, ifr, _) =
-            answers_with_snapshot(&hiidb, &["L"], &no_variables(), &n_store_snapshot(&[2, 1]));
-
-        assert_eq!(got, ["B, A <snapshot>"], "get");
-        assert_eq!(listed, ["B, A <snapshot>"], "list-questions");
-        assert!(
-            ifr.contains("-Answer: B, A <snapshot>\n"),
-            "show-ifr: {ifr}"
+        let wide = short_store_list(&[short_store.clone(), form(1, &[wide_list])], &strings);
+        let stored = variables(&[1, 0, 2, 0]);
+        assert_eq!(
+            answers_of(&wide, "L", &stored),
+            ["A, B"],
+            "get of UINT16 items"
         );
-        let items = SetValue::Items(vec!["A".to_owned(), "B".to_owned()]);
+        assert_eq!(set_items(&wide, &stored), Ok(()), "set of UINT16 items");
         assert_eq!(
-            set_error_without_variables(&hiidb, "L", items),
-            N_STORE_NOT_EXPOSED,
-            "set"
+            stored.writes_to(&short_key("ShortList")),
+            [(0, vec![2, 0, 1, 0])],
+            "writes of UINT16 items"
         );
-    }
-
-    /// A REF on a VarStore whose variable is missing shows the EFI_HII_REF that the snapshot
-    /// holds, tagged, as get shows other values.
-    #[test]
-    fn cross_references_show_snapshot_values() {
-        // an EFI_IFR_REF5 at byte 0 of NStore
-        let reference = operation(REF, false, &question_header_with(1, 1, 1, 0, 0x00));
-        let hiidb = n_store_hiidb(22, &[reference], &["R"]);
-        // QuestionId 5, FormId 1, FormSetGuid N_GUID, DevicePath 0
-        let stored = [
-            &5u16.to_le_bytes()[..],
-            &1u16.to_le_bytes(),
-            &N_GUID,
-            &0u16.to_le_bytes(),
-        ]
-        .concat();
-
-        let (got, listed, ifr, _) =
-            answers_with_snapshot(&hiidb, &["R"], &no_variables(), &n_store_snapshot(&stored));
 
-        let want = "QuestionId 0x0005, FormId 0x0001, FormSetGuid \
-            8C78A505-BAA0-4C4A-869F-000000001401, DevicePath none <snapshot>";
-        assert_eq!(got, [want], "get");
-        assert_eq!(listed, [want], "list-questions");
-        assert!(
-            ifr.contains(&format!("-Answer: {want}\n")),
-            "show-ifr: {ifr}"
+        let declared_after = short_store_list(&[form(1, &[list]), short_store], &strings);
+        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): declared after the \
+                   question, which took its VarStoreInfo for a VarOffset; a question names a \
+                   previously declared VarStore (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER)";
+        let stored = variables(&[1, 2]);
+        assert_eq!(
+            answers_of(&declared_after, "L", &stored),
+            [format!("<ValueUnavailable: {why}>")],
+            "get of the ORDERED_LIST before its store"
+        );
+        assert_eq!(
+            set_items(&declared_after, &stored),
+            Err(format!("cannot set question \"L\": {why}")),
+            "set of the ORDERED_LIST before its store"
         );
     }
 
-    /// Reading a snapshot logs none of its bytes, at any level, also when it is no
-    /// <MultiConfigAltResp> or holds a <ConfigAltResp> that does not parse.
+    /// A STRING on a VARSTORE_EFI before UEFI 2.3.1 reads and sets its MaxSize CHAR16s as the
+    /// whole EFI variable that its VarName names, as an ORDERED_LIST does; a variable of another
+    /// size is refused, and one before the store took its VarStoreInfo for a VarOffset and is
+    /// refused as declared after it.
     #[test]
-    fn snapshot_bytes_are_never_logged() {
-        let malformed = format!(
-            "{}&OFFSET=0&VALUE={}",
-            config_hdr(P_GUID, "AMITSESetup", &DRIVER_PATH),
-            "a5".repeat(81)
+    fn strings_of_a_short_var_store_read_and_set_the_variables_of_their_var_names() {
+        // prompt "S", string 1, on the VarName 2; MinSize 0, MaxSize 4
+        let string = flagged_string_on(1, 1, (1, 2), (0, 4), (0x00, 0x00), &[]);
+        let strings = [en_strings_package_of(&["S", "ShortStr"])];
+        let short_store = short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT);
+        let hiidb = short_store_list(
+            &[short_store.clone(), form(1, std::slice::from_ref(&string))],
+            &strings,
         );
-        let partly_malformed = format!("{}&{malformed}", snapshot_text());
-
-        let logged = logged_by(|| {
-            for text in [snapshot_text(), malformed, partly_malformed] {
-                answers_with_snapshot(&snapshot_hiidb(), &["N", "P"], &no_variables(), &text);
-            }
-        });
-
-        for (what, logs) in [
-            (
-                "the refusal of the malformed snapshot",
-                "not a <MultiConfigAltResp>",
-            ),
-            (
-                "the storage that does not parse",
-                "1 of the 3 <ConfigAltResp>s",
-            ),
-        ] {
-            assert!(
-                logged.iter().any(|message| message.contains(logs)),
-                "{what} is not logged: {logged:?}"
-            );
-        }
-        assert_no_password_byte(&logged);
-    }
-
-    /// The strings of short_store_hiidb from ID 1: the prompts of the questions A to F, the
-    /// VarNames of A to E, and the texts of the options of C.
-    const SHORT_STRINGS: [&str; 13] = [
-        "A",
-        "B",
-        "C",
-        "D",
-        "E",
-        "F",
-        "ShortVarA",
-        "ShortVarB",
-        "ShortVarC",
-        "ShortVarD",
-        "ShortVarE",
-        "Off",
-        "On",
-    ];
-    /// The VarNames of the questions A to E of short_store_hiidb.
-    const SHORT_VAR_NAMES: [&str; 5] = [
-        "ShortVarA",
-        "ShortVarB",
-        "ShortVarC",
-        "ShortVarD",
-        "ShortVarE",
-    ];
-
-    /// A NUMERIC of QuestionId `question_id`, prompted string `prompt`, on VarStore 1 with VarName
-    /// `var_name`, of Flags `flags` and the MinValue, MaxValue and Step `range`.
-    fn short_numeric(
-        question_id: u16,
-        prompt: u16,
-        var_name: u16,
-        flags: u8,
-        range: &[u8],
-    ) -> Vec<u8> {
-        let data = [
-            question_header_with(question_id, prompt, 1, var_name, 0x00),
-            vec![flags],
-            range.to_vec(),
-        ]
-        .concat();
-        operation(NUMERIC, false, &data)
-    }
-
-    /// The UINT8 NUMERIC A, from 0 to 255, on VarName 7, ShortVarA.
-    fn short_numeric_a() -> Vec<u8> {
-        // EFI_IFR_NUMERIC_SIZE_1 | EFI_IFR_DISPLAY_UINT_DEC
-        short_numeric(1, 1, 7, 0x10, &[0, 255, 1])
-    }
-
-    /// The questions A to E of short_store_hiidb, each on the VarName that SHORT_VAR_NAMES names
-    /// in its place: the NUMERIC A, the CHECKBOX B, the ONE_OF C of Off (0) and On (1), the
-    /// UINT16 NUMERIC D and the UINT32 NUMERIC E.
-    fn short_questions() -> Vec<Vec<u8>> {
-        let one_of = [question_header_with(3, 3, 1, 9, 0x00), vec![0x10, 0, 1, 1]].concat();
-        let uint16_range = [0, u16::MAX, 1].map(u16::to_le_bytes).concat();
-        let uint32_range = [0, u32::MAX, 1].map(u32::to_le_bytes).concat();
-        vec![
-            short_numeric_a(),
-            checkbox_at(2, 2, 1, 8),
-            [
-                operation(ONE_OF, true, &one_of),
-                flagged_option(12, 0x00, 0),
-                flagged_option(13, 0x00, 1),
-                END.to_vec(),
-            ]
-            .concat(),
-            // EFI_IFR_NUMERIC_SIZE_2 | EFI_IFR_DISPLAY_UINT_DEC
-            short_numeric(4, 4, 10, 0x11, &uint16_range),
-            // EFI_IFR_NUMERIC_SIZE_4 | EFI_IFR_DISPLAY_UINT_DEC
-            short_numeric(5, 5, 11, 0x12, &uint32_range),
-        ]
-    }
-
-    /// A package list holding a FormSet of `children` and the strings packages `strings`.
-    fn short_store_list(children: &[Vec<u8>], strings: &[Vec<u8>]) -> Vec<u8> {
-        let packages = [
-            form_package(children),
-            strings.concat(),
-            END_PACKAGE.to_vec(),
-        ];
-        package_list_with_guid([0x55; 16], &packages.concat())
-    }
-
-    /// A HiiDB whose FormSet declares the VARSTORE_EFI before UEFI 2.3.1 of VarStoreId 1,
-    /// SHORT_VAR_STORE_GUID and `attributes`, then holds `questions` in a form, with the strings
-    /// SHORT_STRINGS.
-    fn short_store_hiidb(attributes: u32, questions: &[Vec<u8>]) -> Vec<u8> {
-        short_store_list(
-            &[
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, attributes),
-                form(1, questions),
-            ],
-            &[en_strings_package_of(&SHORT_STRINGS)],
-        )
-    }
-
-    /// The EFI variable `name` of SHORT_VAR_STORE_GUID.
-    fn short_key(name: &str) -> VariableKey {
-        VariableKey {
-            name: name.to_string(),
-            guid: Guid::from(SHORT_VAR_STORE_GUID),
-        }
-    }
-
-    /// The variables of the questions A to E of short_store_hiidb, each NV|BS|RT, which reach
-    /// `reach` through `interface`: A holds 5, B 1, C 0, D 0x1234 and E 0x12345678.
-    fn short_variables(reach: VariableReach, interface: VariableInterface) -> Rc<MemoryVariables> {
-        let variables = MemoryVariables::new(reach, interface);
-        let values = [
-            vec![5],
-            vec![1],
-            vec![0],
-            0x1234u16.to_le_bytes().to_vec(),
-            0x1234_5678u32.to_le_bytes().to_vec(),
-        ];
-        for (name, value) in SHORT_VAR_NAMES.into_iter().zip(values) {
-            variables.insert(short_key(name), NV_BS_RT, &value);
-        }
-        Rc::new(variables)
-    }
+        let variables = |value: &[u8]| {
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            variables.insert(short_key("ShortStr"), NV_BS_RT, value);
+            Rc::new(variables)
+        };
 
-    /// short_variables through efivarfs.
-    fn short_efivarfs_variables() -> Rc<MemoryVariables> {
-        short_variables(VariableReach::Runtime, VariableInterface::Efivarfs)
-    }
+        let stored = variables(&[0x41, 0, 0x42, 0, 0, 0, 0, 0]);
+        assert_eq!(answers_of(&hiidb, "S", &stored), ["AB"], "get");
+        assert_eq!(set_of(&hiidb, "S", "XYZ", &stored), Ok(()), "set");
+        assert_eq!(
+            stored.writes_to(&short_key("ShortStr")),
+            [(0, vec![0x58, 0, 0x59, 0, 0x5A, 0, 0, 0])],
+            "writes of ShortStr"
+        );
 
-    /// set of `question` to `value` in the HiiDB `hiidb` through `variables`, as the CLI prints an
-    /// error.
-    fn set_of(
-        hiidb: &[u8],
-        question: &str,
-        value: &str,
-        variables: &Rc<MemoryVariables>,
-    ) -> Result<(), String> {
-        set_responses(
-            hiidb,
-            question,
-            &SetValue::Text(value.to_owned()),
-            None,
-            &SetOptions::default(),
-            shared(variables),
-            &**variables,
-            None,
-        )
-        .map(drop)
-        .map_err(|error| format!("{error:#}"))
+        let wider = variables(&[0x41, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+        let why = "EFI variable ShortStr-8c78a505-baa0-4c4a-869f-000000000b01 holds 10 bytes; \
+                   the question takes 8";
+        assert_eq!(
+            answers_of(&hiidb, "S", &wider),
+            [format!("<ValueUnavailable: {why}>")],
+            "get of 10 bytes"
+        );
+        assert_eq!(
+            set_of(&hiidb, "S", "XYZ", &wider),
+            Err(why.to_owned()),
+            "set of 10 bytes"
+        );
+        assert_eq!(
+            wider.writes_to(&short_key("ShortStr")),
+            Vec::<(u16, Vec<u8>)>::new(),
+            "writes of 10 bytes"
+        );
+
+        let declared_after = short_store_list(&[form(1, &[string]), short_store], &strings);
+        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): declared after the \
+                   question, which took its VarStoreInfo for a VarOffset; a question names a \
+                   previously declared VarStore (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER)";
+        let stored = variables(&[0x41, 0, 0, 0, 0, 0, 0, 0]);
+        assert_eq!(
+            answers_of(&declared_after, "S", &stored),
+            [format!("<ValueUnavailable: {why}>")],
+            "get of the STRING before its store"
+        );
+        assert_eq!(
+            set_of(&declared_after, "S", "XYZ", &stored),
+            Err(format!("cannot set question \"S\": {why}")),
+            "set of the STRING before its store"
+        );
+        assert_eq!(
+            stored.writes_to(&short_key("ShortStr")),
+            Vec::<(u16, Vec<u8>)>::new(),
+            "writes of the STRING before its store"
+        );
     }
 
-    /// Each ONE_OF, NUMERIC and CHECKBOX on a VARSTORE_EFI before UEFI 2.3.1 reads and sets the
-    /// EFI variable that its VarName names, of the store's Guid, from byte 0 as wide as its value,
-    /// as edk2-stable202608 SetupBrowserDxe/Setup.c GetQuestionValue and SetQuestionValue do; set
-    /// writes no other variable.
+    /// set of an ORDERED_LIST on a VARSTORE_EFI before UEFI 2.3.1 whose variable is missing
+    /// creates it with the store's Attributes, holding the new items and empty containers after
+    /// them, as edk2-stable202608 SetupBrowserDxe writes the zeroed BufferValue that it keeps
+    /// (IfrParse.c:2493; Setup.c:1779-1782, :5725-5727, :2069-2075), while get answers the
+    /// variable missing and lists no items. It creates none at OS runtime without
+    /// EFI_VARIABLE_RUNTIME_ACCESS, nor through Windows, and writes nothing then. A variable of
+    /// another size, and the missing variable of a VARSTORE_EFI of Name and Size, still refuse
+    /// set before any write.
     #[test]
-    fn questions_of_a_short_var_store_read_and_set_the_variables_of_their_var_names() {
-        let hiidb = short_store_hiidb(NV_BS_RT, &short_questions());
+    fn set_of_an_ordered_list_creates_its_missing_short_var_store_variable() {
+        // prompt "L", string 1, on the VarName 4: 3 containers of UINT8 options
+        let list = [
+            operation(
+                ORDERED_LIST,
+                true,
+                &[question_header_with(1, 1, 1, 4, 0x00), vec![3, 0x00]].concat(),
+            ),
+            flagged_option(2, 0x00, 1),
+            flagged_option(3, 0x00, 2),
+            END.to_vec(),
+        ]
+        .concat();
+        let strings = [en_strings_package_of(&["L", "A", "B", "ShortList"])];
+        let short_store_hiidb = |attributes: u32| {
+            short_store_list(
+                &[
+                    short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, attributes),
+                    form(1, std::slice::from_ref(&list)),
+                ],
+                &strings,
+            )
+        };
+        let get = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
+            HiiBackend::get_in(
+                hiidb,
+                "L",
+                None,
+                &GetOptions::default(),
+                shared(variables),
+                None,
+                None,
+                None,
+            )
+            .expect("get L")
+            .responses
+            .into_iter()
+            .map(|response| (response.question.answer, response.question.items))
+            .collect::<Vec<_>>()
+        };
+        let set_items = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
+            HiiBackend::set_in(
+                hiidb,
+                "L",
+                &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
+                None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(variables),
+                    writes: &**variables,
+                    held: None,
+                },
+                None,
+            )
+            .map(drop)
+            .map_err(|error| format!("{error:#}"))
+        };
+        let linux = (VariableReach::Runtime, VariableInterface::Efivarfs);
+        let shell = (
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        let windows = (
+            VariableReach::Runtime,
+            VariableInterface::FirmwareEnvironment,
+        );
+        let key = "ShortList-8c78a505-baa0-4c4a-869f-000000000b01";
+        let missing = format!("<ValueUnavailable: no EFI variable {key}>");
+        let created = |attributes: u32| Ok([&attributes.to_ne_bytes()[..], &[2, 1, 0]].concat());
         let cases = [
-            ("A", "5", "9", vec![9]),
-            ("B", "1", "0", vec![0]),
-            ("C", "Off", "On", vec![1]),
-            ("D", "4660", "513", vec![0x01, 0x02]),
-            ("E", "305419896", "70000", 70_000u32.to_le_bytes().to_vec()),
+            (linux, NV_BS_RT, missing.clone(), created(NV_BS_RT)),
+            (shell, NV_BS, missing.clone(), created(NV_BS)),
+            (
+                linux,
+                NV_BS,
+                format!(
+                    "<ValueUnavailable: EFI variable {key} is not present at OS runtime: \
+                     efivarfs does not list it, and its form declares it boot-service-only (no \
+                     EFI_VARIABLE_RUNTIME_ACCESS)>"
+                ),
+                Err(format!(
+                    "EFI variable {key} is not present at OS runtime: efivarfs does not list it, \
+                     and its form declares it boot-service-only (no EFI_VARIABLE_RUNTIME_ACCESS)"
+                )),
+            ),
+            (
+                windows,
+                NV_BS_RT,
+                missing,
+                Err(format!(
+                    "no EFI variable {key}: the firmware has not created it or does not expose it \
+                     to the OS, so its questions cannot be set from Windows; change them in the \
+                     firmware setup, or ask the board vendor for firmware that exposes it; see \
+                     https://github.com/linuxboot/uefisettings/issues/2"
+                )),
+            ),
         ];
-        for ((question, value, new_value, written), name) in cases.into_iter().zip(SHORT_VAR_NAMES)
-        {
-            let variables = short_efivarfs_variables();
+        for ((reach, interface), attributes, answer, want) in cases {
+            let hiidb = short_store_hiidb(attributes);
+            let variables = Rc::new(MemoryVariables::new(reach, interface));
+            let case = format!("{interface:?}, attributes {attributes:#x}");
+
+            assert_eq!(get(&hiidb, &variables), [(answer, None)], "{case}: get");
+            let set = set_items(&hiidb, &variables);
 
             assert_eq!(
-                answers_of(&hiidb, question, &variables),
-                [value],
-                "get {question}"
-            );
-            assert_eq!(
-                set_of(&hiidb, question, new_value, &variables),
-                Ok(()),
-                "set {question}"
+                set.map(|()| variables.bytes(&short_key("ShortList"))),
+                want.clone().map(Some),
+                "{case}: set"
             );
-
-            for other in SHORT_VAR_NAMES {
-                let want = match other == name {
-                    true => vec![(0, written.clone())],
-                    false => vec![],
-                };
+            if want.is_ok() {
+                let items = Some(vec!["B".to_owned(), "A".to_owned()]);
                 assert_eq!(
-                    variables.writes_to(&short_key(other)),
-                    want,
-                    "set {question}: writes of {other}"
+                    get(&hiidb, &variables),
+                    [("B, A".to_owned(), items)],
+                    "{case}: get after set"
                 );
             }
-            assert_eq!(
-                answers_of(&hiidb, question, &variables),
-                [new_value],
-                "get {question} after set"
-            );
         }
-    }
 
-    /// A question on a VARSTORE_EFI before UEFI 2.3.1 whose VarName no string holds names no
-    /// variable, where edk2-stable202608 SetupBrowserDxe/Setup.c GetToken takes the unknown string
-    /// "!": get shows why and set refuses it, while the question beside it reads.
-    #[test]
-    fn a_short_var_store_question_without_a_var_name_string_is_refused() {
-        let hiidb = short_store_hiidb(
-            NV_BS_RT,
-            &[
-                short_numeric_a(),
-                short_numeric(6, 6, 99, 0x10, &[0, 255, 1]),
-            ],
+        let wider = Rc::new(MemoryVariables::new(linux.0, linux.1));
+        wider.insert(short_key("ShortList"), NV_BS_RT, &[1, 2, 0, 0]);
+        assert_eq!(
+            set_items(&short_store_hiidb(NV_BS_RT), &wider),
+            Err(format!(
+                "EFI variable {key} holds 4 bytes; the question takes 3"
+            )),
+            "set of 4 bytes"
         );
-        let variables = short_efivarfs_variables();
-        let why =
-            "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): no string 0x0063 holds \
-                   its VarName";
-
         assert_eq!(
-            answers_of(&hiidb, "F", &variables),
-            [format!("<ValueUnavailable: {why}>")],
-            "get F"
+            wider.writes_to(&short_key("ShortList")),
+            [],
+            "writes of 4 bytes"
+        );
+
+        // the VARSTORE_EFI ShortList of Size 3, whose variable holds the containers at VarOffset 0
+        let named = short_store_list(
+            &[
+                var_store_efi_of(1, SHORT_VAR_STORE_GUID, "ShortList", NV_BS_RT, 3),
+                form(1, &[list]),
+            ],
+            &strings,
         );
+        let variables = Rc::new(MemoryVariables::new(linux.0, linux.1));
         assert_eq!(
-            set_of(&hiidb, "F", "1", &variables),
-            Err(format!("cannot set question \"F\": {why}")),
-            "set F"
+            set_items(&named, &variables),
+            Err(format!(
+                "no EFI variable {key}: the firmware has not created it or does not expose it to \
+                 the OS, so its questions cannot be set from Linux; change them in the firmware \
+                 setup, or ask the board vendor for firmware that exposes it; see \
+                 https://github.com/linuxboot/uefisettings/issues/2"
+            )),
+            "set of a missing variable of a VARSTORE_EFI of Name and Size"
         );
-        assert_eq!(answers_of(&hiidb, "A", &variables), ["5"], "get A");
         assert_eq!(
-            variables.writes_to(&short_key("ShortVarA")),
-            vec![],
-            "writes of ShortVarA"
+            variables.bytes(&short_key("ShortList")),
+            None,
+            "the variable of a VARSTORE_EFI of Name and Size"
         );
     }
 
-    /// A question on a VARSTORE_EFI before UEFI 2.3.1 is shown and selected as any question:
-    /// list-questions shows its QuestionId, its FormSet's GUID and its keyword, show-ifr its
-    /// FormSet's GUID and its answer, and get and set select it by QuestionId and by keyword, and
-    /// read and set its variable. Here the NUMERIC A, of QuestionId 1 in form_package's FormSet,
-    /// whose prompt x-UEFI-ns names "ShortKeyA", on ShortVarA, which holds 5.
+    /// An ORDERED_LIST without options on a VARSTORE_EFI before UEFI 2.3.1, to which
+    /// edk2-stable202608 SetupBrowserDxe/IfrParse.c gives no StorageWidth, is refused for that
+    /// cause by get and set, whether the variable of its VarName exists or not, and set writes
+    /// nothing.
     #[test]
-    fn short_var_store_questions_show_their_identity_and_select_by_question_id_or_keyword() {
+    fn ordered_lists_without_options_of_a_short_var_store_are_refused() {
+        // prompt "L", string 1, on the VarName 2: 2 containers, no option
+        let list = [
+            operation(
+                ORDERED_LIST,
+                true,
+                &[question_header_with(1, 1, 1, 2, 0x00), vec![2, 0x00]].concat(),
+            ),
+            END.to_vec(),
+        ]
+        .concat();
         let hiidb = short_store_list(
             &[
                 short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                form(1, &[short_numeric_a()]),
-            ],
-            &[
-                en_strings_package_of(&SHORT_STRINGS),
-                strings_package_of(b"x-UEFI-ns", &["ShortKeyA"]),
+                form(1, &[list]),
             ],
+            &[en_strings_package_of(&["L", "ShortList"])],
         );
-        let form_set = Guid::from([0x11; 16]).to_string();
-        let variables = short_efivarfs_variables();
-
-        let listed = HiiBackend::list_questions_in(
-            &hiidb,
-            &ListQuestionsOptions::default(),
-            shared(&variables),
-            None,
-            None,
-        )
-        .expect("list the questions");
-        let ifr = HiiBackend::show_ifr_in(
-            &hiidb,
-            &ShowIfrOptions::default(),
-            shared(&variables),
-            None,
-            None,
-        )
-        .expect("show the IFR")
-        .to_string();
-
-        let listed: Vec<(&str, &str, [Option<serde_json::Value>; 3])> = listed
-            .iter()
-            .map(|question| {
-                (
-                    question.name.as_str(),
-                    question.answer.as_str(),
-                    identity_json(question),
-                )
-            })
-            .collect();
-        let identity = [
-            Some(serde_json::json!(1)),
-            Some(serde_json::json!(form_set)),
-            Some(serde_json::json!([{"namespace_id": "x-UEFI-ns", "keyword": "ShortKeyA"}])),
-        ];
-        assert_eq!(listed, [("A", "5", identity)], "list-questions");
-        assert!(
-            ifr.contains(&format!("GUID {form_set}")) && ifr.contains("Q: A - Help:"),
-            "show-ifr: {ifr}"
-        );
-        assert!(ifr.contains("-Answer: 5\n"), "show-ifr: {ifr}");
-        for (question, value) in [
-            (by_address(&format!("{form_set}:1")), 9),
-            (by_keyword("ShortKeyA", None), 10),
-        ] {
-            let variables = short_efivarfs_variables();
+        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): the ORDERED_LIST has \
+                   no option, so its containers have no width";
+        for stored in [Some(&[1, 2][..]), None] {
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            if let Some(value) = stored {
+                variables.insert(short_key("ShortList"), NV_BS_RT, value);
+            }
+            let variables = Rc::new(variables);
 
-            let got = HiiBackend::get_in(
-                &hiidb,
-                question.clone(),
-                None,
-                &GetOptions::default(),
-                shared(&variables),
-                None,
-                None,
-            )
-            .unwrap_or_else(|error| panic!("get {question}: {error:#}"));
-            let set = set_responses(
+            assert_eq!(
+                answers_of(&hiidb, "L", &variables),
+                [format!("<ValueUnavailable: {why}>")],
+                "get, variable {stored:?}"
+            );
+            let set = HiiBackend::set_in(
                 &hiidb,
-                question.clone(),
-                &SetValue::Text(value.to_string()),
+                "L",
+                &SetValue::Items(vec![]),
                 None,
                 &SetOptions::default(),
-                shared(&variables),
-                &*variables,
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
                 None,
             )
             .map(drop)
             .map_err(|error| format!("{error:#}"));
-
-            let got: Vec<&str> = got
-                .responses
-                .iter()
-                .map(|response| response.question.answer.as_str())
-                .collect();
-            assert_eq!(got, ["5"], "get {question}");
-            assert_eq!(set, Ok(()), "set {question} {value}");
             assert_eq!(
-                variables.writes_to(&short_key("ShortVarA")),
-                [(0, vec![value])],
-                "set {question} {value}: writes of ShortVarA"
+                set,
+                Err(format!("cannot set question \"L\": {why}")),
+                "set, variable {stored:?}"
+            );
+            assert_eq!(
+                variables.writes_to(&short_key("ShortList")),
+                [],
+                "writes, variable {stored:?}"
             );
         }
     }
 
-    /// A question on a VARSTORE_EFI before UEFI 2.3.1 takes no value from the ExportConfig
-    /// snapshot, as edk2-stable202608 ExportConfig() asks a driver's ExtractConfig() only for the
-    /// storages that HiiDatabaseDxe/ConfigRouting.c ParseIfrData finds, which skips the short op
-    /// (:2485): no <ConfigResp> holds the variable of a VarName, and one under the VarName's name
-    /// and the store's Guid is another storage. get, list-questions and show-ifr show the
-    /// variable, or why it has no value, untagged, here beside such a <ConfigResp> of 7.
+    /// set of an ORDERED_LIST of MaxContainers 0 on a VARSTORE_EFI before UEFI 2.3.1, whose
+    /// StorageWidth is 0, to no items refuses to create its missing variable of no bytes, as a
+    /// SetVariable() of DataSize 0 deletes a variable (UEFI 2.11 §8.2.3), and writes nothing,
+    /// through efivarfs and through GetVariable() and SetVariable().
     #[test]
-    fn short_var_store_questions_take_no_snapshot_value() {
-        let key = "ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01";
-        let text = block_resp(
-            &config_hdr(SHORT_VAR_STORE_GUID, "ShortVarA", &DRIVER_PATH),
-            0,
-            &[7],
-        );
-        let cases = [
-            (
-                NV_BS_RT,
-                None,
-                format!("<ValueUnavailable: no EFI variable {key}>"),
+    fn set_creates_no_short_var_store_variable_of_no_bytes() {
+        // prompt "L", string 1, on the VarName 3: no container, one UINT8 option
+        let list = [
+            operation(
+                ORDERED_LIST,
+                true,
+                &[question_header_with(1, 1, 1, 3, 0x00), vec![0, 0x00]].concat(),
             ),
+            flagged_option(2, 0x00, 1),
+            END.to_vec(),
+        ]
+        .concat();
+        let hiidb = short_store_list(
+            &[
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                form(1, &[list]),
+            ],
+            &[en_strings_package_of(&["L", "A", "ShortList"])],
+        );
+        for (reach, interface) in [
+            (VariableReach::Runtime, VariableInterface::Efivarfs),
             (
-                NV_BS,
-                None,
-                format!(
-                    "<ValueUnavailable: EFI variable {key} is not present at OS runtime: efivarfs \
-                     does not list it, and its form declares it boot-service-only (no \
-                     EFI_VARIABLE_RUNTIME_ACCESS)>"
-                ),
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
             ),
-            (NV_BS_RT, Some(5), "5".to_string()),
-        ];
-        for (attributes, held, want) in cases {
-            let packages = [
-                device_path_package(&DRIVER_PATH),
-                form_package(&[
-                    short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, attributes),
-                    form(1, &[short_numeric_a()]),
-                ]),
-                en_strings_package_of(&SHORT_STRINGS),
-                END_PACKAGE.to_vec(),
-            ];
-            let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-            let variables = no_variables();
-            if let Some(value) = held {
-                variables.insert(short_key("ShortVarA"), attributes, &[value]);
-            }
-
-            let (got, listed, ifr, _) = answers_with_snapshot(&hiidb, &["A"], &variables, &text);
-
-            let case = format!("attributes {attributes:#x}, ShortVarA {held:?}");
-            assert_eq!(got, [want], "get, {case}");
-            assert_eq!(listed, got, "list-questions, {case}");
-            assert!(!ifr.contains("<snapshot>"), "show-ifr, {case}: {ifr}");
-        }
-    }
+        ] {
+            let variables = Rc::new(MemoryVariables::new(reach, interface));
 
-    /// get shows a missing per-question variable as missing, through variables that reach Runtime
-    /// in the words of the runtime access that its VARSTORE_EFI declares: one declared without
-    /// EFI_VARIABLE_RUNTIME_ACCESS is not present at OS runtime.
-    #[test]
-    fn a_missing_per_question_variable_is_shown_as_its_var_store_declares_it() {
-        let key = "ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01";
-        let cases = [
-            (NV_BS_RT, format!("no EFI variable {key}")),
-            (
-                NV_BS,
-                format!(
-                    "EFI variable {key} is not present at OS runtime: efivarfs does not list it, \
-                     and its form declares it boot-service-only (no EFI_VARIABLE_RUNTIME_ACCESS)"
-                ),
-            ),
-        ];
-        for (attributes, why) in cases {
-            let hiidb = short_store_hiidb(attributes, &[short_numeric_a()]);
-            let variables = Rc::new(MemoryVariables::default());
+            let set = HiiBackend::set_in(
+                &hiidb,
+                "L",
+                &SetValue::Items(vec![]),
+                None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(&variables),
+                    writes: &*variables,
+                    held: None,
+                },
+                None,
+            )
+            .map(drop)
+            .map_err(|error| format!("{error:#}"));
 
             assert_eq!(
-                answers_of(&hiidb, "A", &variables),
-                [format!("<ValueUnavailable: {why}>")],
-                "get, attributes {attributes:#x}"
+                set,
+                Err("a variable write without bytes".to_owned()),
+                "{interface:?}: set"
+            );
+            assert_eq!(
+                variables.bytes(&short_key("ShortList")),
+                None,
+                "{interface:?}: ShortList"
             );
         }
     }
 
-    /// set creates a missing per-question variable with the Attributes of its VARSTORE_EFI, as
-    /// edk2-stable202608 SetupBrowserDxe/Setup.c SetQuestionValue does ("This service can be used
-    /// to create a new variable", UEFI 2.11 §8.2.3 SetVariable), of its question's width, through
-    /// efivarfs and Variable Services; get then reads it. It refuses, creating nothing, through
-    /// variables that reach Runtime a store without EFI_VARIABLE_RUNTIME_ACCESS, whose variable no
-    /// SetVariable() sets once ExitBootServices() is performed (§8.2.3), the Attributes of a
-    /// volatile or authenticated variable, as of an existing one, and creation through the
-    /// firmware environment calls of Windows.
+    /// An ORDERED_LIST on the VarName of a PASSWORD on a VARSTORE_EFI before UEFI 2.3.1 reads
+    /// none of the password's variable, which get and set withhold whole: get answers that its
+    /// bytes hold a password, and set refuses new items and writes nothing. The list is as wide
+    /// as the variable, and its VarName, read as a VarOffset, as large, so that only the
+    /// withholding of bytes 0..40 refuses it.
     #[test]
-    fn set_creates_a_missing_per_question_variable_with_the_attributes_of_its_var_store() {
-        // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
-        const TIME_BASED_AUTHENTICATED: u32 = 0x20;
-        let linux = (VariableReach::Runtime, VariableInterface::Efivarfs);
-        let shell = (
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        let windows = (
-            VariableReach::Runtime,
-            VariableInterface::FirmwareEnvironment,
-        );
-        let key = "ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01";
-        let created =
-            |attributes: u32, value: &[u8]| Ok([&attributes.to_ne_bytes()[..], value].concat());
-        let cases = [
-            (linux, NV_BS_RT, "A", "9", created(NV_BS_RT, &[9])),
-            (linux, NV_BS_RT, "D", "513", created(NV_BS_RT, &[1, 2])),
-            (shell, NV_BS, "A", "9", created(NV_BS, &[9])),
-            (shell, NV_BS_RT, "D", "513", created(NV_BS_RT, &[1, 2])),
-            (
-                linux,
-                NV_BS,
-                "A",
-                "9",
-                Err(format!(
-                    "EFI variable {key} is not present at OS runtime: efivarfs does not list it, \
-                     and its form declares it boot-service-only (no EFI_VARIABLE_RUNTIME_ACCESS)"
-                )),
+    fn an_ordered_list_on_the_var_name_of_a_short_var_store_password_keeps_it_withheld() {
+        // prompt "L", string 1, on the VarName 40 of the PASSWORD's prompt 4: 40 containers
+        let list = [
+            operation(
+                ORDERED_LIST,
+                true,
+                &[question_header_with(1, 1, 1, 40, 0x00), vec![40, 0x00]].concat(),
             ),
-            (
-                linux,
-                BS_RT,
-                "A",
-                "9",
-                Err(format!(
-                    "EFI variable {key} is volatile (no EFI_VARIABLE_NON_VOLATILE) and cannot be \
-                     written through efivarfs"
-                )),
+            flagged_option(2, 0x00, 1),
+            flagged_option(3, 0x00, 2),
+            END.to_vec(),
+        ]
+        .concat();
+        let mut strings = vec!["L", "A", "B", "Password"];
+        strings.resize(39, "Unused");
+        strings.push("ShortVarPw");
+        let hiidb = short_store_list(
+            &[
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                form(1, &[password_on(6, 4, 1, 40), list]),
+            ],
+            &[en_strings_package_of(&strings)],
+        );
+        let password = short_key("ShortVarPw");
+        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+        variables.insert(password.clone(), NV_BS_RT, &plaintext_password());
+        let variables = Rc::new(variables);
+
+        assert_eq!(answers_of(&hiidb, "L", &variables), [PASSWORD_BYTES], "get");
+        let set = HiiBackend::set_in(
+            &hiidb,
+            "L",
+            &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
+            None,
+            &SetOptions {
+                unsafe_operations: UnsafeOperations::Allow,
+                ..SetOptions::default()
+            },
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
+            None,
+        )
+        .map(drop)
+        .map_err(|error| format!("{error:#}"));
+        assert_eq!(
+            set,
+            Err(
+                "cannot set question \"L\": its items cannot be read, so set cannot keep those of \
+                 hidden options: its bytes hold a password"
+                    .to_owned()
             ),
-            (
-                linux,
-                NV_BS_RT | TIME_BASED_AUTHENTICATED,
-                "A",
-                "9",
-                Err(format!(
-                    "EFI variable {key} has authenticated access (attributes 0x27), which \
-                     uefisettings does not write"
-                )),
+            "set"
+        );
+        assert_eq!(variables.writes_to(&password), [], "writes of ShortVarPw");
+    }
+
+    /// An ORDERED_LIST over the bytes of a PASSWORD outside any FormSet of its VarStoreId keeps
+    /// them withheld, as a NUMERIC does: get answers that its bytes hold a password, and set
+    /// refuses new items, whose hidden ones it cannot keep unread, and writes nothing.
+    #[test]
+    fn ordered_lists_keep_an_outside_password_withheld() {
+        let list = [
+            operation(
+                ORDERED_LIST,
+                true,
+                &[question_header_with(4, 4, 2, 0, 0x00), vec![2, 0x00]].concat(),
             ),
-            (
-                windows,
-                NV_BS_RT,
-                "A",
-                "9",
-                Err(format!(
-                    "no EFI variable {key}: the firmware has not created it or does not expose it \
-                     to the OS, so its questions cannot be set from Windows; change them in the \
-                     firmware setup, or ask the board vendor for firmware that exposes it; see \
-                     https://github.com/linuxboot/uefisettings/issues/2"
-                )),
+            flagged_option(5, 0x00, 1),
+            flagged_option(6, 0x00, 2),
+            END.to_vec(),
+        ]
+        .concat();
+        let packages = [
+            form_package_of(
+                &[
+                    password_on(3, 3, 2, 0),
+                    form_set(&[
+                        var_store(2, [0x44; 16], "AMITSESetup", 81),
+                        form(1, &[list]),
+                    ]),
+                ]
+                .concat(),
             ),
+            en_strings_package_of(&["Q", "P", "Password", "L", "A", "B"]),
+            END_PACKAGE.to_vec(),
         ];
-        for ((reach, interface), attributes, question, value, want) in cases {
-            let hiidb = short_store_hiidb(attributes, &short_questions());
-            let variables = Rc::new(MemoryVariables::new(reach, interface));
-            let name = match question {
-                "A" => "ShortVarA",
-                _ => "ShortVarD",
-            };
-            let case = format!("{interface:?}, attributes {attributes:#x}, set {question}");
-
-            let set = set_of(&hiidb, question, value, &variables);
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let stored = [plaintext_password().as_slice(), &[0xAA; 40], &[1]].concat();
+        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+        variables.insert(amitse_setup(), NV_BS_RT, &stored);
+        let variables = Rc::new(variables);
+        let options = SetOptions {
+            unsafe_operations: UnsafeOperations::Allow,
+            ..SetOptions::default()
+        };
 
-            assert_eq!(
-                set.map(|()| variables.bytes(&short_key(name))),
-                want.clone().map(Some),
-                "{case}"
-            );
-            if want.is_ok() {
-                assert_eq!(
-                    answers_of(&hiidb, question, &variables),
-                    [value],
-                    "{case}: get"
-                );
-            }
-            for other in SHORT_VAR_NAMES.into_iter().filter(|&other| other != name) {
-                assert_eq!(variables.bytes(&short_key(other)), None, "{case}: {other}");
-            }
-        }
+        assert_eq!(answers_of(&hiidb, "L", &variables), [PASSWORD_BYTES], "get");
+        let set = HiiBackend::set_in(
+            &hiidb,
+            "L",
+            &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
+            None,
+            &options,
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
+            None,
+        )
+        .map(drop)
+        .map_err(|error| format!("{error:#}"));
+        assert_eq!(
+            set,
+            Err(
+                "cannot set question \"L\": its items cannot be read, so set cannot keep those of \
+                 hidden options: its bytes hold a password"
+                    .to_owned()
+            ),
+            "set"
+        );
+        assert_eq!(
+            variables.writes_to(&amitse_setup()),
+            [],
+            "writes to AMITSESetup"
+        );
     }
 
-    /// set creates a missing per-question variable at one width: where a question's WRITE SETs
-    /// its own VarName at another width, set refuses to create it, as the variable would hold the
-    /// value of neither; where the variable holds the question's value, the SET of another width
-    /// stores nothing, as edk2-stable202608 would resize it, and set writes the question's value.
+    /// A REF on a VARSTORE_EFI before UEFI 2.3.1 shows the EFI_HII_REF that the whole EFI
+    /// variable of its VarName holds, its StorageWidth in edk2-stable202608
+    /// SetupBrowserDxe/IfrParse.c, as Setup.c GetQuestionValue reads it there; a variable of
+    /// another size is refused, and set refuses the REF as on any VarStore, writing nothing. One
+    /// before the store took its VarStoreInfo for a VarOffset and is refused as a NUMERIC is.
     #[test]
-    fn set_creates_a_per_question_variable_at_one_width() {
-        const SET: u8 = 0x2C;
-        const WRITE: u8 = 0x2E;
-        const THIS: u8 = 0x58;
-        // the UINT8 NUMERIC A on ShortVarA, whose WRITE sets ShortVarA as a UINT16
-        // (EFI_IFR_TYPE_NUM_SIZE_16)
-        let set_as_uint16 = operation(
-            SET,
-            false,
-            &[&1u16.to_le_bytes()[..], &7u16.to_le_bytes(), &[0x01]].concat(),
+    fn cross_references_of_a_short_var_store_show_the_hii_refs_of_their_var_names() {
+        // an EFI_IFR_REF5 of prompt "R", string 1, on the VarName 2
+        let reference = operation(REF, false, &question_header_with(1, 1, 1, 2, 0x00));
+        let strings = [en_strings_package_of(&["R", "ShortRef"])];
+        let short_store = short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT);
+        let hiidb = short_store_list(
+            &[
+                short_store.clone(),
+                form(1, std::slice::from_ref(&reference)),
+            ],
+            &strings,
+        );
+        let variables = |value: &[u8]| {
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+            variables.insert(short_key("ShortRef"), NV_BS_RT, value);
+            Rc::new(variables)
+        };
+        // QuestionId 5, FormId 1, FormSetGuid 0x11 × 16, DevicePath string 0
+        let stored = [&[5, 0, 1, 0][..], &[0x11; 16], &[0, 0]].concat();
+
+        let short = variables(&stored);
+        assert_eq!(
+            answers_of(&hiidb, "R", &short),
+            ["QuestionId 0x0005, FormId 0x0001, FormSetGuid \
+                 11111111-1111-1111-1111-111111111111, DevicePath none"],
+            "get"
         );
-        let numeric_a = [
-            operation(
-                NUMERIC,
-                true,
-                &[
-                    question_header_with(1, 1, 1, 7, 0x00),
-                    // EFI_IFR_NUMERIC_SIZE_1 | EFI_IFR_DISPLAY_UINT_DEC, from 0 to 255, step 1
-                    vec![0x10, 0, 255, 1],
-                ]
-                .concat(),
-            ),
-            operation(WRITE, false, &[]),
-            [operation(THIS, true, &[]), set_as_uint16, END.to_vec()].concat(),
-            END.to_vec(),
-        ]
-        .concat();
-        let hiidb = short_store_hiidb(NV_BS_RT, &[numeric_a]);
-        let shell = (
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
+        let set = set_of(&hiidb, "R", "0", &short);
+        assert!(
+            set.as_ref()
+                .is_err_and(|error| error.contains("set does not write the EFI_HII_REF")),
+            "set: {set:?}"
         );
-        for (reach, interface) in [(VariableReach::Runtime, VariableInterface::Efivarfs), shell] {
-            let variables = Rc::new(MemoryVariables::new(reach, interface));
+        assert_eq!(short.writes_to(&short_key("ShortRef")), [], "writes");
 
-            assert_eq!(
-                set_of(&hiidb, "A", "9", &variables),
-                Err(
-                    "EFI variable ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01 holds the value \
-                     of one question, which set would write as 2 bytes and as 1"
-                        .to_string()
-                ),
-                "{interface:?}: set A without ShortVarA"
-            );
-            assert_eq!(
-                variables.bytes(&short_key("ShortVarA")),
-                None,
-                "{interface:?}: ShortVarA"
-            );
+        let longer = variables(&[stored.as_slice(), &[0]].concat());
+        assert_eq!(
+            answers_of(&hiidb, "R", &longer),
+            [
+                "<ValueUnavailable: EFI variable ShortRef-8c78a505-baa0-4c4a-869f-000000000b01 \
+                 holds 23 bytes; the question takes 22>"
+            ],
+            "get of 23 bytes"
+        );
 
-            variables.insert(short_key("ShortVarA"), NV_BS_RT, &[5]);
-            assert_eq!(
-                set_of(&hiidb, "A", "9", &variables),
-                Ok(()),
-                "{interface:?}: set A"
-            );
-            assert_eq!(
-                variables.writes_to(&short_key("ShortVarA")),
-                [(0, vec![9])],
-                "{interface:?}: writes of ShortVarA"
-            );
-        }
+        let declared_after = short_store_list(&[form(1, &[reference]), short_store], &strings);
+        assert_eq!(
+            answers_of(&declared_after, "R", &short),
+            [
+                "<ValueUnavailable: VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): \
+                 declared after the question, which took its VarStoreInfo for a VarOffset; a \
+                 question names a previously declared VarStore (UEFI 2.11 §33.3.8.2.2 \
+                 EFI_IFR_QUESTION_HEADER)>"
+            ],
+            "get of the REF before its store"
+        );
     }
 
-    /// set of a question whose VARSTORE_EFI before UEFI 2.3.1 lacks EFI_VARIABLE_NON_VOLATILE
-    /// creates its volatile variable through Variable Services only with VolatileWrites::Allow,
-    /// and its answer says that the value is volatile.
+    /// A REF over the bytes of a PASSWORD outside any FormSet of its VarStoreId keeps them
+    /// withheld, as a NUMERIC does: get answers that its bytes hold a password.
     #[test]
-    fn set_creates_a_volatile_per_question_variable_if_allowed() {
-        // EFI_VARIABLE_BOOTSERVICE_ACCESS alone
-        const BS: u32 = 0x02;
-        let hiidb = short_store_hiidb(BS, &[short_numeric_a()]);
-        let cases = [
-            (
-                VolatileWrites::Allow,
-                Ok(vec![format!("9{VOLATILE_ANNOTATION}")]),
-                Some([&BS.to_ne_bytes()[..], &[9]].concat()),
-            ),
-            (
-                VolatileWrites::Refuse,
-                Err(
-                    "EFI variable ShortVarA-8c78a505-baa0-4c4a-869f-000000000b01 is volatile (no \
-                     EFI_VARIABLE_NON_VOLATILE), so a write would not outlast a power cycle; pass \
-                     --allow-volatile to write it anyway"
-                        .to_string(),
-                ),
-                None,
+    fn cross_references_keep_an_outside_password_withheld() {
+        // an EFI_IFR_REF5 at byte 0 of AMITSESetup
+        let reference = operation(REF, false, &question_header_with(4, 4, 2, 0, 0x00));
+        let packages = [
+            form_package_of(
+                &[
+                    password_on(3, 3, 2, 0),
+                    form_set(&[
+                        var_store(2, [0x44; 16], "AMITSESetup", 81),
+                        form(1, &[reference]),
+                    ]),
+                ]
+                .concat(),
             ),
+            en_strings_package_of(&["Q", "P", "Password", "R"]),
+            END_PACKAGE.to_vec(),
         ];
-        for (volatile, want, bytes) in cases {
-            let variables = Rc::new(MemoryVariables::new(
-                VariableReach::BootServices,
-                VariableInterface::VariableServices,
-            ));
-            let options = SetOptions {
-                volatile,
-                ..SetOptions::default()
-            };
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let stored = [plaintext_password().as_slice(), &[0xAA; 40], &[1]].concat();
+        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+        variables.insert(amitse_setup(), NV_BS_RT, &stored);
+        let variables = Rc::new(variables);
 
-            let got = set_responses(
-                &hiidb,
-                "A",
-                &SetValue::Text("9".to_owned()),
-                None,
-                &options,
-                shared(&variables),
-                &*variables,
-                None,
-            );
+        assert_eq!(answers_of(&hiidb, "R", &variables), [PASSWORD_BYTES], "get");
+    }
 
-            let answers = got.map(|list| {
-                list.responses
-                    .into_iter()
-                    .map(|response| response.question.answer)
-                    .collect::<Vec<_>>()
-            });
-            assert_eq!(
-                answers.map_err(|error| format!("{error:#}")),
-                want,
-                "{volatile:?}: answers"
-            );
-            assert_eq!(
-                variables.bytes(&short_key("ShortVarA")),
-                bytes,
-                "{volatile:?}: ShortVarA"
-            );
-        }
+    /// A package list with GUID `guid` whose form holds the STRING "S", string 1, of MinSize and
+    /// MaxSize `sizes` and the Flags `flags`, holding `children`, at byte 0 of the EFI variable
+    /// Setup of `var_size` bytes, with the texts `strings`.
+    fn string_list_of(
+        guid: [u8; 16],
+        (sizes, flags): ((u8, u8), u8),
+        children: &[Vec<u8>],
+        var_size: u16,
+        strings: &[&str],
+    ) -> Vec<u8> {
+        let string = flagged_string_on(1, 1, (1, 0), sizes, (0x00, flags), children);
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, var_size),
+                form(1, &[string]),
+            ]),
+            en_strings_package_of(strings),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid(guid, &packages.concat())
     }
 
-    /// get and set refuse a per-question variable whose data is not exactly as wide as its
-    /// question's value, naming both sizes, where edk2-stable202608 SetupBrowserDxe/Setup.c
-    /// GetQuestionValue would show a value that it did not read, or a part of one, and
-    /// SetQuestionValue would change the variable's size; set writes nothing.
-    #[test]
-    fn a_per_question_variable_of_another_size_is_refused() {
-        let hiidb = short_store_hiidb(NV_BS_RT, &short_questions());
-        let cases: [(&str, &[u8], usize, u8); 3] =
-            [("A", &[5, 0], 2, 1), ("A", &[], 0, 1), ("D", &[0x34], 1, 2)];
-        for (question, data, held, width) in cases {
-            let name = format!("ShortVar{question}");
-            let variables = Rc::new(MemoryVariables::default());
-            variables.insert(short_key(&name), NV_BS_RT, data);
-            let case = format!("{question} on {held} bytes");
-            let why = format!(
-                "EFI variable {name}-8c78a505-baa0-4c4a-869f-000000000b01 holds {held} bytes; the \
-                 question takes {width}"
-            );
+    /// string_list_of without Flags, its Setup of MaxSize CHAR16s, string 2 "Hello".
+    fn string_list(guid: [u8; 16], sizes: (u8, u8), children: &[Vec<u8>]) -> Vec<u8> {
+        let var_size = u16::from(sizes.1) * 2;
+        string_list_of(guid, (sizes, 0x00), children, var_size, &["S", "Hello"])
+    }
 
-            assert_eq!(
-                answers_of(&hiidb, question, &variables),
-                [format!("<ValueUnavailable: {why}>")],
-                "{case}: get"
-            );
-            assert_eq!(
-                set_of(&hiidb, question, "1", &variables),
-                Err(why),
-                "{case}: set"
-            );
-            assert_eq!(
-                variables.writes_to(&short_key(&name)),
-                vec![],
-                "{case}: writes"
-            );
-        }
+    /// The variables of a HiiDB that reach Runtime through efivarfs, Setup holding `stored`.
+    fn setup_holding(stored: &[u8]) -> Rc<MemoryVariables> {
+        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+        variables.insert(setup(), NV_BS_RT, stored);
+        Rc::new(variables)
     }
 
-    /// A question in a FormSet's own scope, outside any form, reads its value from a VARSTORE_EFI
-    /// before UEFI 2.3.1 and from one of UEFI 2.3.1 alike, without a panic, and one there whose
-    /// VarStore no op declares has no value.
-    #[test]
-    fn a_question_outside_a_form_reads_its_var_store() {
-        let variables = short_efivarfs_variables();
-        let long = VariableKey {
-            name: "Long".to_string(),
-            guid: NIL_GUID,
-        };
-        variables.insert(long, NV_BS_RT, &[7]);
-        let on_var_store_9 = [
-            question_header_with(1, 1, 9, 7, 0x00),
-            vec![0x10, 0, 255, 1],
-        ]
-        .concat();
-        let cases = [
-            (
-                "before UEFI 2.3.1",
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                short_numeric_a(),
-                "5",
-            ),
-            (
-                "UEFI 2.3.1",
-                var_store_efi(1, "Long", NV_BS_RT, 1),
-                short_numeric(1, 1, 0, 0x10, &[0, 255, 1]),
-                "7",
-            ),
+    /// The answer of a STRING without its variable Setup.
+    const MISSING_SETUP: &str =
+        "<ValueUnavailable: no EFI variable Setup-00000000-0000-0000-0000-000000000000>";
+
+    /// get, list-questions and show-ifr show a STRING on a VarStore as the UCS-2 characters of its
+    /// MaxSize CHAR16s up to the first NULL, all of them without one, as edk2-stable202608
+    /// SetupBrowserDxe/IfrParse.c:2229 keeps one more CHAR16, zero, after them; a UTF-16
+    /// surrogate, which UCS-2 has no character for (UEFI 2.11 §33.2.6.2.2), gives no value.
+    #[test]
+    fn strings_show_their_characters_up_to_the_first_null() {
+        let hiidb = string_list([0x71; 16], (0, 4), &[]);
+        let surrogate = "<ValueUnavailable: its character 1 is CHAR16 0xd83d, a UTF-16 surrogate, \
+                         which UCS-2 has no character for (UEFI 2.11 §33.2.6.2.2)>";
+        let cases: [(&str, [u8; 8], &str); 6] = [
+            ("null-terminated", [0x41, 0, 0x42, 0, 0, 0, 0, 0], "AB"),
+            ("no null", [0x41, 0, 0x42, 0, 0x43, 0, 0x44, 0], "ABCD"),
+            ("empty", [0; 8], ""),
+            ("after the null", [0x41, 0, 0, 0, 0x43, 0, 0x44, 0], "A"),
+            ("beyond ASCII", [0xE9, 0, 0xAC, 0x20, 0, 0, 0, 0], "é€"),
             (
-                "undeclared",
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                operation(NUMERIC, false, &on_var_store_9),
-                "<ValueUnavailable: no supported varstore with matching id 0x0009 found>",
+                "surrogate",
+                [0x41, 0, 0x3D, 0xD8, 0x00, 0xDE, 0, 0],
+                surrogate,
             ),
         ];
-        for (case, store, question, value) in cases {
-            let hiidb =
-                short_store_list(&[store, question], &[en_strings_package_of(&SHORT_STRINGS)]);
+        for (case, stored, answer) in cases {
+            let (listed, shown) = listed_and_shown(&hiidb, &stored, None);
+            let listed: Vec<(&str, &str)> = listed
+                .iter()
+                .map(|question| (&*question.name, &*question.answer))
+                .collect();
 
-            assert_eq!(answers_of(&hiidb, "A", &variables), [value], "{case}");
+            assert_eq!(
+                answers_of(&hiidb, "S", &setup_holding(&stored)),
+                [answer],
+                "{case}: get"
+            );
+            assert_eq!(listed, [("S", answer)], "{case}: list-questions");
+            assert!(
+                shown.contains(&format!("-Answer: {answer}\n")),
+                "{case}: show-ifr: {shown}"
+            );
         }
     }
 
-    /// A VarName whose strings differ between the strings packages of its package list names no
-    /// variable, as edk2-stable202608 SetupBrowserDxe/Setup.c GetToken takes the string in the
-    /// platform language, which uefisettings does not know: its question refuses, naming the
-    /// VarName and the languages. One that every package holding it agrees on names its variable,
-    /// also when a package, as an x-UEFI-ns one, lacks it.
-    #[test]
-    fn strings_packages_that_differ_on_a_var_name_refuse_its_question() {
-        let mut french = SHORT_STRINGS;
-        french[6] = "VarCourteA";
-        let hiidb = short_store_list(
-            &[
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                form(1, &short_questions()[..2]),
-            ],
-            &[
-                strings_package_of(b"en", &SHORT_STRINGS),
-                strings_package_of(b"fr", &french),
-                strings_package_of(b"x-UEFI-ns", &SHORT_STRINGS[..6]),
-            ],
-        );
-        let variables = short_efivarfs_variables();
-        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): the strings packages \
-                   differ on its VarName 0x0007: \"ShortVarA\" in en, \"VarCourteA\" in fr";
-
-        assert_eq!(
-            answers_of(&hiidb, "A", &variables),
-            [format!("<ValueUnavailable: {why}>")],
-            "get A"
-        );
-        assert_eq!(
-            set_of(&hiidb, "A", "9", &variables),
-            Err(format!("cannot set question \"A\": {why}")),
-            "set A"
-        );
-        assert_eq!(answers_of(&hiidb, "B", &variables), ["1"], "get B");
-    }
-
-    /// A question in the scope of the GUID op of an EDKII bit varstore field, on a VARSTORE_EFI
-    /// before UEFI 2.3.1, is refused by name: there its VarStoreInfo is a VarName, not the bit
-    /// offset that the field takes it for.
+    /// A STRING of MaxSize 4 reads its 8 bytes alone of a variable of 12 whose characters go on
+    /// past them without a NULL.
     #[test]
-    fn an_edkii_bit_field_on_a_short_var_store_is_refused() {
-        let uint32_range = [0, u32::MAX, 1].map(u32::to_le_bytes).concat();
-        let bit_field = [
-            operation(GUID, true, &BIT_VARSTORE_GUID),
-            // a field of 8 bits
-            short_numeric(1, 1, 7, 0x08, &uint32_range),
-            END.to_vec(),
-        ]
-        .concat();
-        let hiidb = short_store_hiidb(NV_BS_RT, &[bit_field]);
-        let variables = short_efivarfs_variables();
-        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): the question is an \
-                   EDKII bit varstore field, whose VarStoreInfo is a bit offset, not a VarName";
+    fn strings_read_no_character_past_their_max_size() {
+        let hiidb = string_list_of([0x77; 16], ((0, 4), 0x00), &[], 12, &["S", "Hello"]);
+        let stored = [0x41, 0, 0x42, 0, 0x43, 0, 0x44, 0, 0x45, 0, 0x46, 0];
+        let (listed, shown) = listed_and_shown(&hiidb, &stored, None);
+        let listed: Vec<(&str, &str)> = listed
+            .iter()
+            .map(|question| (&*question.name, &*question.answer))
+            .collect();
 
         assert_eq!(
-            answers_of(&hiidb, "A", &variables),
-            [format!("<ValueUnavailable: {why}>")],
-            "get A"
-        );
-        assert_eq!(
-            set_of(&hiidb, "A", "9", &variables),
-            Err(format!("cannot set question \"A\": {why}")),
-            "set A"
-        );
-        assert_eq!(
-            variables.writes_to(&short_key("ShortVarA")),
-            vec![],
-            "writes of ShortVarA"
+            answers_of(&hiidb, "S", &setup_holding(&stored)),
+            ["ABCD"],
+            "get"
         );
+        assert_eq!(listed, [("S", "ABCD")], "list-questions");
+        assert!(shown.contains("-Answer: ABCD\n"), "show-ifr: {shown}");
     }
 
-    /// A question that precedes the VARSTORE_EFI before UEFI 2.3.1 that it names is refused by
-    /// name: it took its VarStoreInfo for a VarOffset, as its VarStoreId names a previously
-    /// declared variable store (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER).
+    /// A STRING without a value shows its default of Type STRING, the text of that string, cut to
+    /// MaxSize characters, as edk2-stable202608 SetupBrowserDxe/Setup.c:4507-4511
+    /// GetQuestionDefault copies at most StorageWidth bytes of it; a string that the package list
+    /// lacks gives no default, and neither do the surrogates of a character beyond UCS-2, which
+    /// UEFI 2.11 §33.2.6.2.2 rules out of strings: the default holds them as the string did, and
+    /// shows as a STRING value of them does.
     #[test]
-    fn a_question_before_its_short_var_store_is_refused() {
-        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): declared after the \
-                   question, which took its VarStoreInfo for a VarOffset; a question names a \
-                   previously declared VarStore (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER)";
-        // VarStoreInfo 7 and 0, which the question takes for VarOffsets
-        for var_store_info in [7, 0] {
-            let hiidb = short_store_list(
-                &[
-                    form(
-                        1,
-                        &[short_numeric(1, 1, var_store_info, 0x10, &[0, 255, 1])],
-                    ),
-                    short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                ],
-                &[en_strings_package_of(&SHORT_STRINGS)],
+    fn strings_without_a_variable_show_their_string_default() {
+        let cases = [
+            ("MaxSize 8", 8, 2, ["S", "Hello"], "Hello"),
+            ("MaxSize 4", 4, 2, ["S", "Hello"], "Hell"),
+            ("MaxSize 5", 5, 2, ["S", "Hello"], "Hello"),
+            (
+                "missing string",
+                8,
+                9,
+                ["S", "Hello"],
+                "unknown (EFI_IFR_TYPE_STRING default: string 0x0009 not found)",
+            ),
+            (
+                "beyond UCS-2",
+                8,
+                2,
+                ["S", "A\u{1F600}"],
+                "unknown (EFI_IFR_TYPE_STRING default: its character 1 is CHAR16 0xd83d, a \
+                 UTF-16 surrogate, which UCS-2 has no character for (UEFI 2.11 §33.2.6.2.2))",
+            ),
+        ];
+        for (case, max_size, string_id, strings, default) in cases {
+            let hiidb = string_list_of(
+                [0x72; 16],
+                ((0, max_size), 0x00),
+                &[string_default(0, string_id)],
+                u16::from(max_size) * 2,
+                &strings,
             );
-            let variables = short_efivarfs_variables();
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
 
             assert_eq!(
-                answers_of(&hiidb, "A", &variables),
-                [format!("<ValueUnavailable: {why}>")],
-                "VarStoreInfo {var_store_info}: get A"
-            );
-            assert_eq!(
-                set_of(&hiidb, "A", "9", &variables),
-                Err(format!("cannot set question \"A\": {why}")),
-                "VarStoreInfo {var_store_info}: set A"
+                answers_of(&hiidb, "S", &Rc::new(variables)),
+                [format!("{MISSING_SETUP} <IFR default: {default}>")],
+                "{case}"
             );
         }
     }
 
-    /// A DATE and a TIME on a VARSTORE_EFI before UEFI 2.3.1 read and set the EFI variable that
-    /// their VarName names, their EFI_HII_DATE or EFI_HII_TIME from byte 0, as a NUMERIC there
-    /// does; set writes no other variable. A DATE before the store took its VarStoreInfo for a
-    /// VarOffset and is refused as a NUMERIC is.
+    /// The writes of `set <question> <value>` to Setup, which holds `stored`, in the HiiDB of
+    /// `packages`, each FormSet of which declares Setup, and the strings packages that follow.
+    fn writes_of_set(
+        packages: &[Vec<u8>],
+        stored: &[u8],
+        question: &str,
+        value: &str,
+    ) -> Result<Vec<(u16, Vec<u8>)>, String> {
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let variables = Rc::new(MemoryVariables::default());
+        variables.insert(setup(), NV_BS_RT, stored);
+        set_responses(
+            &hiidb,
+            question,
+            &SetValue::Text(value.to_owned()),
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
+            None,
+        )
+        .map(|_| variables.writes_to(&setup()))
+        .map_err(|error| format!("{error:#}"))
+    }
+
+    /// The form package of the CHECKBOXes 1 and 2 at bytes 0 and 1 of Setup, prompted by strings
+    /// 1 and 2.
+    fn two_checkboxes() -> Vec<u8> {
+        form_package(&[
+            var_store_efi(1, "Setup", NV_BS_RT, 2),
+            form(1, &[checkbox_at(1, 1, 1, 0), checkbox_at(2, 2, 1, 1)]),
+        ])
+    }
+
+    /// Of the prompts "A<U+E000>", private use (UEFI 2.11 §33.2.6.2.1), which reads as
+    /// "A<U+FFFD>", and "A<U+FFFD>", whose U+FFFD is a character that strings may hold, `set
+    /// A<U+FFFD>` writes the question whose prompt is so stored: a text as stored names a question
+    /// before one that reads alike only once a character of it is replaced, in any FormSet. With
+    /// no such stored prompt, it writes the question whose prompt reads so.
     #[test]
-    fn dates_and_times_of_a_short_var_store_read_and_set_the_variables_of_their_var_names() {
-        // prompts "Day" and "Hour", strings 1 and 2, on the VarNames 3 and 4
-        let date = operation(
-            DATE,
-            false,
-            &[question_header_with(1, 1, 1, 3, 0x00), vec![0x00]].concat(),
-        );
-        let time = operation(
-            TIME,
-            false,
-            &[question_header_with(2, 2, 1, 4, 0x00), vec![0x00]].concat(),
-        );
-        let strings = [en_strings_package_of(&[
-            "Day",
-            "Hour",
-            "ShortDate",
-            "ShortTime",
-        ])];
-        let short_store = short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT);
-        let hiidb = short_store_list(
-            &[short_store.clone(), form(1, &[date.clone(), time])],
-            &strings,
-        );
-        // the EFI_HII_DATE 2026-11-10 and the EFI_HII_TIME 12:34:56
-        let stored = [
-            ("ShortDate", vec![0xEA, 0x07, 11, 10]),
-            ("ShortTime", vec![12, 34, 56]),
-        ];
-        let variables = || {
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-            for (name, value) in &stored {
-                variables.insert(short_key(name), NV_BS_RT, value);
-            }
-            Rc::new(variables)
-        };
+    fn set_of_a_stored_replacement_character_writes_its_question() {
         let cases = [
-            (
-                "Day",
-                "2026-11-10",
-                "2027-01-02",
-                "ShortDate",
-                vec![0xEB, 0x07, 1, 2],
-            ),
-            ("Hour", "12:34:56", "01:02:03", "ShortTime", vec![1, 2, 3]),
+            ("stored second", ["A\u{E000}", "A\u{FFFD}"], (1, vec![1])),
+            ("replaced alone", ["A\u{E000}", "B"], (0, vec![1])),
         ];
+        for (case, prompts, written) in cases {
+            let packages = [
+                two_checkboxes(),
+                en_strings_package_of(&prompts),
+                END_PACKAGE.to_vec(),
+            ];
 
-        for (question, value, new_value, name, written) in cases {
-            let variables = variables();
-
-            assert_eq!(
-                answers_of(&hiidb, question, &variables),
-                [value],
-                "get {question}"
-            );
             assert_eq!(
-                set_of(&hiidb, question, new_value, &variables),
-                Ok(()),
-                "set {question}"
+                writes_of_set(&packages, &[0, 0], "A\u{FFFD}", "1"),
+                Ok(vec![written]),
+                "{case}: set A<U+FFFD>"
             );
+        }
+    }
+
+    /// Of the prompts "A<U+E000>", which reads as "A<U+FFFD>", and "A<U+FFFD>", `get A<U+FFFD>`
+    /// answers the question whose prompt is so stored alone, as set selects it.
+    #[test]
+    fn get_of_a_stored_replacement_character_answers_its_question() {
+        let packages = [
+            two_checkboxes(),
+            en_strings_package_of(&["A\u{E000}", "A\u{FFFD}"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let variables = Rc::new(MemoryVariables::default());
+        variables.insert(setup(), NV_BS_RT, &[0, 0]);
+
+        let got = HiiBackend::get_in(
+            &hiidb,
+            "A\u{FFFD}",
+            None,
+            &GetOptions::default(),
+            shared(&variables),
+            None,
+            None,
+            None,
+        )
+        .expect("get A<U+FFFD>");
+
+        let question_ids: Vec<Option<serde_json::Value>> = got
+            .responses
+            .iter()
+            .map(|response| json_field(&response.question, "question_id"))
+            .collect();
+        assert_eq!(
+            question_ids,
+            [Some(serde_json::json!(2))],
+            "get A<U+FFFD> answers question 2"
+        );
+    }
+
+    /// Of the ONE_OF options "A<U+E000>" (1), which reads as "A<U+FFFD>", and "A<U+FFFD>" (2), `set
+    /// Q A<U+FFFD>` writes 2, the option whose text is so stored; with no such stored option, it
+    /// writes the option whose text reads so.
+    #[test]
+    fn set_of_a_stored_replacement_character_writes_its_option() {
+        let cases = [
+            ("stored second", ["A\u{E000}", "A\u{FFFD}"], 2),
+            ("replaced alone", ["A\u{E000}", "B"], 1),
+        ];
+        for (case, [first, second], written) in cases {
+            let packages = [
+                form_package(&[
+                    var_store_efi(1, "Setup", NV_BS_RT, 1),
+                    form(1, &[one_of_at(1, 1, 1, 0, &[(2, 1), (3, 2)])]),
+                ]),
+                en_strings_package_of(&["Q", first, second, "Help"]),
+                END_PACKAGE.to_vec(),
+            ];
 
-            for (other, _) in &stored {
-                let want = match *other == name {
-                    true => vec![(0, written.clone())],
-                    false => vec![],
-                };
-                assert_eq!(
-                    variables.writes_to(&short_key(other)),
-                    want,
-                    "set {question}: writes of {other}"
-                );
-            }
             assert_eq!(
-                answers_of(&hiidb, question, &variables),
-                [new_value],
-                "get {question} after set"
+                writes_of_set(&packages, &[0], "Q", "A\u{FFFD}"),
+                Ok(vec![(0, vec![written])]),
+                "{case}: set Q A<U+FFFD>"
             );
         }
+    }
+
+    /// The prompt "A<U+FFFD>" of question 1 in "en" is no ambiguous QUESTION beside the "fr"
+    /// prompt "A<U+E000>" of question 2, which reads alike only once its private use character is
+    /// replaced: set takes the stored prompt alone, of one language.
+    #[test]
+    fn a_stored_prompt_is_unambiguous_beside_a_replaced_one_of_another_language() {
+        let packages = [
+            two_checkboxes(),
+            en_strings_package_of(&["A\u{FFFD}", "Two"]),
+            strings_package_of(b"fr", &["Un", "A\u{E000}"]),
+            END_PACKAGE.to_vec(),
+        ];
 
-        let declared_after = short_store_list(&[form(1, &[date]), short_store], &strings);
-        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): declared after the \
-                   question, which took its VarStoreInfo for a VarOffset; a question names a \
-                   previously declared VarStore (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER)";
-        let variables = variables();
-        assert_eq!(
-            answers_of(&declared_after, "Day", &variables),
-            [format!("<ValueUnavailable: {why}>")],
-            "get of the DATE before its store"
-        );
         assert_eq!(
-            set_of(&declared_after, "Day", "2027-01-02", &variables),
-            Err(format!("cannot set question \"Day\": {why}")),
-            "set of the DATE before its store"
+            writes_of_set(&packages, &[0, 0], "A\u{FFFD}", "1"),
+            Ok(vec![(0, vec![1])]),
+            "set A<U+FFFD> writes byte 0"
         );
     }
 
-    /// A DATE and a TIME over the bytes of a PASSWORD outside any FormSet of their VarStoreId keep
-    /// them withheld, as a NUMERIC does: get answers that their bytes hold a password, and set
-    /// refuses them and writes nothing.
+    /// A STRING without a value shows the default of a flagged EFI_IFR_ONE_OF_OPTION of Type
+    /// EFI_IFR_TYPE_STRING in its scope, the text of the option's Value, below an EFI_IFR_DEFAULT,
+    /// as EFI_IFR_STRING (UEFI 2.11 §33.3.8.3.70) orders them; an option of no default flag, or one
+    /// that a SUPPRESS_IF hides, gives none.
     #[test]
-    fn dates_and_times_keep_an_outside_password_withheld() {
-        let date = [question_header_with(4, 4, 2, 0, 0x00), vec![0x00]].concat();
-        let time = [question_header_with(5, 5, 2, 4, 0x00), vec![0x00]].concat();
-        let packages = [
-            form_package_of(
-                &[
-                    password_on(3, 3, 2, 0),
-                    form_set(&[
-                        var_store(2, [0x44; 16], "AMITSESetup", 81),
-                        form(
-                            1,
-                            &[operation(DATE, false, &date), operation(TIME, false, &time)],
-                        ),
-                    ]),
-                ]
-                .concat(),
+    fn strings_show_the_defaults_of_their_flagged_options() {
+        const OPTION_DEFAULT: u8 = 0x10;
+        let option = || string_option(3, OPTION_DEFAULT, 4);
+        let cases = [
+            ("flagged option", vec![option()], " <IFR default: Bonjour>"),
+            (
+                "flagged option and EFI_IFR_DEFAULT",
+                vec![option(), string_default(0, 2)],
+                " <IFR default: Hello>",
+            ),
+            ("option of no flag", vec![string_option(3, 0x00, 4)], ""),
+            (
+                "suppressed flagged option",
+                vec![conditional(SUPPRESS_IF, ifr_true(), &[option()])],
+                "",
             ),
-            en_strings_package_of(&["Q", "P", "Password", "D", "T"]),
-            END_PACKAGE.to_vec(),
         ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let stored = [plaintext_password().as_slice(), &[0xAA; 40], &[1]].concat();
-
-        for (question, value) in [("D", "2027-01-02"), ("T", "01:02:03")] {
+        for (case, children, default) in cases {
+            let hiidb = string_list_of(
+                [0x7F; 16],
+                ((0, 8), 0x00),
+                &children,
+                16,
+                &["S", "Hello", "Option", "Bonjour"],
+            );
             let variables =
                 MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-            variables.insert(amitse_setup(), NV_BS_RT, &stored);
-            let variables = Rc::new(variables);
 
             assert_eq!(
-                answers_of(&hiidb, question, &variables),
-                [PASSWORD_BYTES],
-                "get {question}"
-            );
-            let set = set_bypassing(&hiidb, question, value, &variables);
-            assert!(
-                set.as_ref().is_err_and(|error| error
-                    .contains("holds a password at bytes 0..40, which set never writes")),
-                "set {question}: {set:?}"
-            );
-            assert_eq!(
-                variables.writes_to(&amitse_setup()),
-                [],
-                "set {question}: writes to AMITSESetup"
+                answers_of(&hiidb, "S", &Rc::new(variables)),
+                [format!("{MISSING_SETUP}{default}")],
+                "{case}"
             );
         }
     }
 
-    /// An ORDERED_LIST on a VARSTORE_EFI before UEFI 2.3.1 reads and sets its MaxContainers
-    /// containers, of UINT8 or UINT16 options, as the whole EFI variable that its VarName names,
-    /// as edk2-stable202608 SetupBrowserDxe/Setup.c GetQuestionValue and SetQuestionValue do
-    /// through its BufferValue; a variable of another size is refused and not written. One before
-    /// the store took its VarStoreInfo for a VarOffset and is refused as a NUMERIC is.
+    /// A ONE_OF whose flagged EFI_IFR_ONE_OF_OPTION is of Type EFI_IFR_TYPE_STRING shows its
+    /// default as unknown, naming the Type mismatch: a ONE_OF stores a number.
     #[test]
-    fn ordered_lists_of_a_short_var_store_read_and_set_the_variables_of_their_var_names() {
-        // prompt "L", string 1, on the VarName 4
-        let list = [
-            operation(
-                ORDERED_LIST,
-                true,
-                &[question_header_with(1, 1, 1, 4, 0x00), vec![2, 0x00]].concat(),
-            ),
-            flagged_option(2, 0x00, 1),
-            flagged_option(3, 0x00, 2),
-            END.to_vec(),
+    fn one_ofs_show_a_string_option_default_as_unknown() {
+        let data = [
+            question_header_with(1, 1, 1, 0, 0x00),
+            // Flags EFI_IFR_NUMERIC_SIZE_1, MinValue, MaxValue, Step
+            vec![0x00, 0x00, 0xFF, 0x01],
         ]
         .concat();
-        let strings = [en_strings_package_of(&["L", "A", "B", "ShortList"])];
-        let short_store = short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT);
-        let hiidb = short_store_list(
-            &[short_store.clone(), form(1, std::slice::from_ref(&list))],
-            &strings,
-        );
-        let variables = |value: &[u8]| {
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-            variables.insert(short_key("ShortList"), NV_BS_RT, value);
-            Rc::new(variables)
-        };
-        let set_items = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
-            HiiBackend::set_in(
-                hiidb,
-                "L",
-                &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
-                None,
-                &SetOptions::default(),
-                shared(variables),
-                &**variables,
-                None,
-            )
-            .map(drop)
-            .map_err(|error| format!("{error:#}"))
-        };
-
-        let stored = variables(&[1, 2]);
-        assert_eq!(answers_of(&hiidb, "L", &stored), ["A, B"], "get");
-        assert_eq!(set_items(&hiidb, &stored), Ok(()), "set");
-        assert_eq!(
-            stored.writes_to(&short_key("ShortList")),
-            [(0, vec![2, 1])],
-            "writes of ShortList"
-        );
-        assert_eq!(answers_of(&hiidb, "L", &stored), ["B, A"], "get after set");
-
-        let wider = variables(&[1, 2, 0]);
-        let why = "EFI variable ShortList-8c78a505-baa0-4c4a-869f-000000000b01 holds 3 bytes; \
-                   the question takes 2";
-        assert_eq!(
-            answers_of(&hiidb, "L", &wider),
-            [format!("<ValueUnavailable: {why}>")],
-            "get of 3 bytes"
-        );
-        let set = set_items(&hiidb, &wider);
-        assert!(
-            set.as_ref().is_err_and(|error| error.ends_with(why)),
-            "set of 3 bytes: {set:?}"
-        );
-        assert_eq!(
-            wider.writes_to(&short_key("ShortList")),
-            [],
-            "writes of 3 bytes"
-        );
-
-        // 2 containers of EFI_IFR_TYPE_NUM_SIZE_16 options, 4 bytes
-        let wide_list = [
-            operation(
-                ORDERED_LIST,
-                true,
-                &[question_header_with(1, 1, 1, 4, 0x00), vec![2, 0x00]].concat(),
-            ),
-            uint16_option(2, 1),
-            uint16_option(3, 2),
+        let one_of = [
+            operation(ONE_OF, true, &data),
+            string_option(2, 0x10, 2),
             END.to_vec(),
         ]
         .concat();
-        let wide = short_store_list(&[short_store.clone(), form(1, &[wide_list])], &strings);
-        let stored = variables(&[1, 0, 2, 0]);
-        assert_eq!(
-            answers_of(&wide, "L", &stored),
-            ["A, B"],
-            "get of UINT16 items"
-        );
-        assert_eq!(set_items(&wide, &stored), Ok(()), "set of UINT16 items");
-        assert_eq!(
-            stored.writes_to(&short_key("ShortList")),
-            [(0, vec![2, 0, 1, 0])],
-            "writes of UINT16 items"
-        );
+        let packages = [
+            form_package(&[var_store_efi(1, "Setup", NV_BS_RT, 1), form(1, &[one_of])]),
+            en_strings_package_of(&["O", "Hello"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x5F; 16], &packages.concat());
+        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
 
-        let declared_after = short_store_list(&[form(1, &[list]), short_store], &strings);
-        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): declared after the \
-                   question, which took its VarStoreInfo for a VarOffset; a question names a \
-                   previously declared VarStore (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER)";
-        let stored = variables(&[1, 2]);
         assert_eq!(
-            answers_of(&declared_after, "L", &stored),
-            [format!("<ValueUnavailable: {why}>")],
-            "get of the ORDERED_LIST before its store"
-        );
-        assert_eq!(
-            set_items(&declared_after, &stored),
-            Err(format!("cannot set question \"L\": {why}")),
-            "set of the ORDERED_LIST before its store"
+            answers_of(&hiidb, "O", &Rc::new(variables)),
+            [format!(
+                "{MISSING_SETUP} <IFR default: unknown (a default of EFI_IFR_TYPE_STRING where the \
+                 question stores a number)>"
+            )],
+            "get"
         );
     }
 
-    /// A STRING on a VARSTORE_EFI before UEFI 2.3.1 reads and sets its MaxSize CHAR16s as the
-    /// whole EFI variable that its VarName names, as an ORDERED_LIST does; a variable of another
-    /// size is refused, and one before the store took its VarStoreInfo for a VarOffset and is
-    /// refused as declared after it.
+    /// set writes at most MaxSize − 1 characters of a STRING as UCS-2, NULL-padded to its MaxSize
+    /// CHAR16s, so that a NULL ends them (UEFI 2.11 §33.2.5.4.9); get shows them then.
     #[test]
-    fn strings_of_a_short_var_store_read_and_set_the_variables_of_their_var_names() {
-        // prompt "S", string 1, on the VarName 2; MinSize 0, MaxSize 4
-        let string = flagged_string_on(1, 1, (1, 2), (0, 4), (0x00, 0x00), &[]);
-        let strings = [en_strings_package_of(&["S", "ShortStr"])];
-        let short_store = short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT);
-        let hiidb = short_store_list(
-            &[short_store.clone(), form(1, std::slice::from_ref(&string))],
-            &strings,
-        );
-        let variables = |value: &[u8]| {
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-            variables.insert(short_key("ShortStr"), NV_BS_RT, value);
-            Rc::new(variables)
+    fn set_writes_a_string_null_padded_to_max_size() {
+        let hiidb = string_list([0x73; 16], (0, 4), &[]);
+        let cases: [(&str, [u8; 8]); 5] = [
+            ("Hi", [0x48, 0, 0x69, 0, 0, 0, 0, 0]),
+            ("é€", [0xE9, 0, 0xAC, 0x20, 0, 0, 0, 0]),
+            ("XYZ", [0x58, 0, 0x59, 0, 0x5A, 0, 0, 0]),
+            ("\u{F900}", [0x00, 0xF9, 0, 0, 0, 0, 0, 0]),
+            ("", [0; 8]),
+        ];
+        for (text, written) in cases {
+            let variables = setup_holding(&[0x41, 0, 0x42, 0, 0x43, 0, 0x44, 0]);
+
+            assert_eq!(
+                set_of(&hiidb, "S", text, &variables),
+                Ok(()),
+                "set {text:?}"
+            );
+            assert_eq!(
+                variables.writes_to(&setup()),
+                [(0, written.to_vec())],
+                "set {text:?}: writes"
+            );
+            assert_eq!(
+                answers_of(&hiidb, "S", &variables),
+                [text],
+                "set {text:?}: get"
+            );
+        }
+    }
+
+    /// set --keyword selects a STRING by its keyword as set by its prompt does, and writes its
+    /// text with set's checks: NULL-padded to MaxSize CHAR16s, and nothing for a text that set
+    /// refuses.
+    #[test]
+    fn strings_set_by_keyword_as_by_prompt() {
+        let string = flagged_string_on(1, 1, (1, 0), (0, 4), (0x00, 0x00), &[]);
+        let packages = [
+            form_package(&[var_store_efi(1, "Setup", NV_BS_RT, 8), form(1, &[string])]),
+            en_strings_package_of(&["S"]),
+            strings_package_of(b"x-UEFI-ns", &["KString"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x62; 16], &packages.concat());
+        let set = |text: &str, variables: &Rc<MemoryVariables>| {
+            let by_keyword = QuestionSelector::Keyword {
+                keyword: "KString".parse().expect("parse the keyword"),
+                namespace: None,
+            };
+            set_responses(
+                &hiidb,
+                by_keyword,
+                &SetValue::Text(text.to_owned()),
+                None,
+                &SetOptions::default(),
+                SetAccess {
+                    reads: shared(variables),
+                    writes: &**variables,
+                    held: None,
+                },
+                None,
+            )
+            .map(drop)
+            .map_err(|error| format!("{error:#}"))
         };
 
-        let stored = variables(&[0x41, 0, 0x42, 0, 0, 0, 0, 0]);
-        assert_eq!(answers_of(&hiidb, "S", &stored), ["AB"], "get");
-        assert_eq!(set_of(&hiidb, "S", "XYZ", &stored), Ok(()), "set");
+        let variables = setup_holding(&[0; 8]);
+        assert_eq!(set("AB", &variables), Ok(()), "set AB");
         assert_eq!(
-            stored.writes_to(&short_key("ShortStr")),
-            [(0, vec![0x58, 0, 0x59, 0, 0x5A, 0, 0, 0])],
-            "writes of ShortStr"
+            variables.writes_to(&setup()),
+            [(0, vec![0x41, 0, 0x42, 0, 0, 0, 0, 0])],
+            "writes of AB"
         );
 
-        let wider = variables(&[0x41, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        let why = "EFI variable ShortStr-8c78a505-baa0-4c4a-869f-000000000b01 holds 10 bytes; \
-                   the question takes 8";
-        assert_eq!(
-            answers_of(&hiidb, "S", &wider),
-            [format!("<ValueUnavailable: {why}>")],
-            "get of 10 bytes"
-        );
+        let refused = setup_holding(&[0; 8]);
         assert_eq!(
-            set_of(&hiidb, "S", "XYZ", &wider),
-            Err(why.to_owned()),
-            "set of 10 bytes"
+            set("ABCD", &refused),
+            Err(
+                "cannot set question \"S\": the STRING takes at most 3 characters, its last \
+                 CHAR16 of MaxSize 4 holding the NULL (UEFI 2.11 §33.2.5.4.9), not 4"
+                    .to_owned()
+            ),
+            "set ABCD"
         );
         assert_eq!(
-            wider.writes_to(&short_key("ShortStr")),
+            refused.writes_to(&setup()),
             Vec::<(u16, Vec<u8>)>::new(),
-            "writes of 10 bytes"
+            "writes of ABCD"
         );
+    }
 
-        let declared_after = short_store_list(&[form(1, &[string]), short_store], &strings);
-        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): declared after the \
-                   question, which took its VarStoreInfo for a VarOffset; a question names a \
-                   previously declared VarStore (UEFI 2.11 §33.3.8.2.2 EFI_IFR_QUESTION_HEADER)";
-        let stored = variables(&[0x41, 0, 0, 0, 0, 0, 0, 0]);
-        assert_eq!(
-            answers_of(&declared_after, "S", &stored),
-            [format!("<ValueUnavailable: {why}>")],
-            "get of the STRING before its store"
-        );
-        assert_eq!(
-            set_of(&declared_after, "S", "XYZ", &stored),
-            Err(format!("cannot set question \"S\": {why}")),
-            "set of the STRING before its store"
-        );
-        assert_eq!(
-            stored.writes_to(&short_key("ShortStr")),
-            Vec::<(u16, Vec<u8>)>::new(),
-            "writes of the STRING before its store"
-        );
+    /// set of a STRING through `hiidb`'s variables with `value`, as the CLI prints an error, and
+    /// what it wrote to Setup, which held `stored`.
+    fn string_set(hiidb: &[u8], value: &SetValue, stored: &[u8]) -> SetOutcome {
+        let variables = setup_holding(stored);
+        let got = HiiBackend::set_in(
+            hiidb,
+            "S",
+            value,
+            None,
+            &SetOptions::default(),
+            SetAccess {
+                reads: shared(&variables),
+                writes: &*variables,
+                held: None,
+            },
+            None,
+        )
+        .map(drop)
+        .map_err(|error| format!("{error:#}"));
+        (got, variables.writes_to(&setup()))
     }
 
-    /// set of an ORDERED_LIST on a VARSTORE_EFI before UEFI 2.3.1 whose variable is missing
-    /// creates it with the store's Attributes, holding the new items and empty containers after
-    /// them, as edk2-stable202608 SetupBrowserDxe writes the zeroed BufferValue that it keeps
-    /// (IfrParse.c:2493; Setup.c:1779-1782, :5725-5727, :2069-2075), while get answers the
-    /// variable missing and lists no items. It creates none at OS runtime without
-    /// EFI_VARIABLE_RUNTIME_ACCESS, nor through Windows, and writes nothing then. A variable of
-    /// another size, and the missing variable of a VARSTORE_EFI of Name and Size, still refuse
-    /// set before any write.
+    /// set refuses, before any write, MaxSize characters, which leave no CHAR16 for the NULL
+    /// (UEFI 2.11 §33.2.5.4.9), fewer than MinSize, as edk2-stable202608
+    /// DisplayEngineDxe/InputHandler.c:209 does, a character that UCS-2 has none for, one of the
+    /// Private Use Area (UEFI 2.11 §33.2.6.2.1), a line break without EFI_IFR_STRING_MULTI_LINE, a
+    /// NULL, which ends a STRING, and items.
     #[test]
-    fn set_of_an_ordered_list_creates_its_missing_short_var_store_variable() {
-        // prompt "L", string 1, on the VarName 4: 3 containers of UINT8 options
-        let list = [
-            operation(
-                ORDERED_LIST,
-                true,
-                &[question_header_with(1, 1, 1, 4, 0x00), vec![3, 0x00]].concat(),
-            ),
-            flagged_option(2, 0x00, 1),
-            flagged_option(3, 0x00, 2),
-            END.to_vec(),
-        ]
-        .concat();
-        let strings = [en_strings_package_of(&["L", "A", "B", "ShortList"])];
-        let short_store_hiidb = |attributes: u32| {
-            short_store_list(
-                &[
-                    short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, attributes),
-                    form(1, std::slice::from_ref(&list)),
-                ],
-                &strings,
-            )
-        };
-        let get = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
-            HiiBackend::get_in(
-                hiidb,
-                "L",
-                None,
-                &GetOptions::default(),
-                shared(variables),
-                None,
-                None,
-            )
-            .expect("get L")
-            .responses
-            .into_iter()
-            .map(|response| (response.question.answer, response.question.items))
-            .collect::<Vec<_>>()
-        };
-        let set_items = |hiidb: &[u8], variables: &Rc<MemoryVariables>| {
-            HiiBackend::set_in(
-                hiidb,
-                "L",
-                &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
-                None,
-                &SetOptions::default(),
-                shared(variables),
-                &**variables,
-                None,
-            )
-            .map(drop)
-            .map_err(|error| format!("{error:#}"))
-        };
-        let linux = (VariableReach::Runtime, VariableInterface::Efivarfs);
-        let shell = (
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        let windows = (
-            VariableReach::Runtime,
-            VariableInterface::FirmwareEnvironment,
-        );
-        let key = "ShortList-8c78a505-baa0-4c4a-869f-000000000b01";
-        let missing = format!("<ValueUnavailable: no EFI variable {key}>");
-        let created = |attributes: u32| Ok([&attributes.to_ne_bytes()[..], &[2, 1, 0]].concat());
+    fn set_refuses_a_string_that_its_sizes_or_ucs_2_cannot_hold() {
+        let hiidb = string_list([0x74; 16], (2, 4), &[]);
+        let refusal = |reason: &str| Err(format!("cannot set question \"S\": {reason}"));
+        let line_break = "the STRING is single-line (no EFI_IFR_STRING_MULTI_LINE, UEFI 2.11 \
+                          §33.3.8.3.70), so it takes no line break";
         let cases = [
-            (linux, NV_BS_RT, missing.clone(), created(NV_BS_RT)),
-            (shell, NV_BS, missing.clone(), created(NV_BS)),
             (
-                linux,
-                NV_BS,
-                format!(
-                    "<ValueUnavailable: EFI variable {key} is not present at OS runtime: \
-                     efivarfs does not list it, and its form declares it boot-service-only (no \
-                     EFI_VARIABLE_RUNTIME_ACCESS)>"
+                SetValue::Text("ABCD".to_owned()),
+                refusal(
+                    "the STRING takes at most 3 characters, its last CHAR16 of MaxSize 4 holding \
+                     the NULL (UEFI 2.11 §33.2.5.4.9), not 4",
+                ),
+            ),
+            (
+                SetValue::Text("A".to_owned()),
+                refusal("the STRING takes at least 2 characters (MinSize), not 1"),
+            ),
+            (
+                SetValue::Text("A\u{1F600}".to_owned()),
+                refusal(
+                    "'\u{1F600}' (U+1F600) has no UCS-2 character, which the STRING stores \
+                     (UEFI 2.11 §33.2.6.2.2)",
+                ),
+            ),
+            (
+                SetValue::Text("A\u{E000}".to_owned()),
+                refusal(
+                    "'\\u{e000}' (U+E000) lies in the Private Use Area, U+E000..U+F8FF, which \
+                     UEFI 2.11 §33.2.6.2.1 prohibits",
+                ),
+            ),
+            (
+                SetValue::Text("\u{F6FF}B".to_owned()),
+                refusal(
+                    "'\\u{f6ff}' (U+F6FF) lies in the Private Use Area, U+E000..U+F8FF, which \
+                     UEFI 2.11 §33.2.6.2.1 prohibits",
                 ),
-                Err(format!(
-                    "EFI variable {key} is not present at OS runtime: efivarfs does not list it, \
-                     and its form declares it boot-service-only (no EFI_VARIABLE_RUNTIME_ACCESS)"
-                )),
             ),
+            (SetValue::Text("A\nB".to_owned()), refusal(line_break)),
+            (SetValue::Text("A\rB".to_owned()), refusal(line_break)),
             (
-                windows,
-                NV_BS_RT,
-                missing,
-                Err(format!(
-                    "no EFI variable {key}: the firmware has not created it or does not expose it \
-                     to the OS, so its questions cannot be set from Windows; change them in the \
-                     firmware setup, or ask the board vendor for firmware that exposes it; see \
-                     https://github.com/linuxboot/uefisettings/issues/2"
-                )),
+                SetValue::Text("A\0B".to_owned()),
+                refusal(
+                    "a NULL character ends a STRING, which takes none within (UEFI 2.11 \
+                     §33.2.5.4.9)",
+                ),
+            ),
+            (
+                SetValue::Items(vec!["AB".to_owned()]),
+                refusal("--item gives the options of an ORDERED_LIST; this question takes VALUE"),
             ),
         ];
-        for ((reach, interface), attributes, answer, want) in cases {
-            let hiidb = short_store_hiidb(attributes);
-            let variables = Rc::new(MemoryVariables::new(reach, interface));
-            let case = format!("{interface:?}, attributes {attributes:#x}");
-
-            assert_eq!(get(&hiidb, &variables), [(answer, None)], "{case}: get");
-            let set = set_items(&hiidb, &variables);
-
+        for (value, want) in cases {
             assert_eq!(
-                set.map(|()| variables.bytes(&short_key("ShortList"))),
-                want.clone().map(Some),
-                "{case}: set"
+                string_set(&hiidb, &value, &[0; 8]),
+                (want, Vec::new()),
+                "set {value:?}"
             );
-            if want.is_ok() {
-                let items = Some(vec!["B".to_owned(), "A".to_owned()]);
-                assert_eq!(
-                    get(&hiidb, &variables),
-                    [("B, A".to_owned(), items)],
-                    "{case}: get after set"
-                );
-            }
         }
-
-        let wider = Rc::new(MemoryVariables::new(linux.0, linux.1));
-        wider.insert(short_key("ShortList"), NV_BS_RT, &[1, 2, 0, 0]);
-        assert_eq!(
-            set_items(&short_store_hiidb(NV_BS_RT), &wider),
-            Err(format!(
-                "EFI variable {key} holds 4 bytes; the question takes 3"
-            )),
-            "set of 4 bytes"
-        );
-        assert_eq!(
-            wider.writes_to(&short_key("ShortList")),
-            [],
-            "writes of 4 bytes"
-        );
-
-        // the VARSTORE_EFI ShortList of Size 3, whose variable holds the containers at VarOffset 0
-        let named = short_store_list(
-            &[
-                var_store_efi_of(1, SHORT_VAR_STORE_GUID, "ShortList", NV_BS_RT, 3),
-                form(1, &[list]),
-            ],
-            &strings,
-        );
-        let variables = Rc::new(MemoryVariables::new(linux.0, linux.1));
-        assert_eq!(
-            set_items(&named, &variables),
-            Err(format!(
-                "no EFI variable {key}: the firmware has not created it or does not expose it to \
-                 the OS, so its questions cannot be set from Linux; change them in the firmware \
-                 setup, or ask the board vendor for firmware that exposes it; see \
-                 https://github.com/linuxboot/uefisettings/issues/2"
-            )),
-            "set of a missing variable of a VARSTORE_EFI of Name and Size"
-        );
-        assert_eq!(
-            variables.bytes(&short_key("ShortList")),
-            None,
-            "the variable of a VARSTORE_EFI of Name and Size"
-        );
     }
 
-    /// An ORDERED_LIST without options on a VARSTORE_EFI before UEFI 2.3.1, to which
-    /// edk2-stable202608 SetupBrowserDxe/IfrParse.c gives no StorageWidth, is refused for that
-    /// cause by get and set, whether the variable of its VarName exists or not, and set writes
-    /// nothing.
+    /// set refuses, before any write, every VALUE of a STRING of MaxSize 0, which has no CHAR16
+    /// for the NULL, and of one whose MinSize is above MaxSize − 1, naming both bounds.
     #[test]
-    fn ordered_lists_without_options_of_a_short_var_store_are_refused() {
-        // prompt "L", string 1, on the VarName 2: 2 containers, no option
-        let list = [
-            operation(
-                ORDERED_LIST,
-                true,
-                &[question_header_with(1, 1, 1, 2, 0x00), vec![2, 0x00]].concat(),
-            ),
-            END.to_vec(),
-        ]
-        .concat();
-        let hiidb = short_store_list(
-            &[
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                form(1, &[list]),
-            ],
-            &[en_strings_package_of(&["L", "ShortList"])],
+    fn set_refuses_every_value_of_a_string_without_a_length() {
+        let refusal = |reason: &str| Err(format!("cannot set question \"S\": {reason}"));
+        let no_null = refusal(
+            "the STRING of MaxSize 0 has no CHAR16 for the NULL that ends it (UEFI 2.11 \
+             §33.2.5.4.9), so it takes no VALUE",
         );
-        let why = "VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): the ORDERED_LIST has \
-                   no option, so its containers have no width";
-        for stored in [Some(&[1, 2][..]), None] {
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-            if let Some(value) = stored {
-                variables.insert(short_key("ShortList"), NV_BS_RT, value);
-            }
-            let variables = Rc::new(variables);
+        let no_length = refusal(
+            "the STRING takes at least 4 characters (MinSize) and at most 3, its last CHAR16 of \
+             MaxSize 4 holding the NULL (UEFI 2.11 §33.2.5.4.9), so it takes no VALUE",
+        );
+        let cases = [
+            ("MaxSize 0", (0, 0), 2, "", no_null.clone()),
+            ("MaxSize 0", (0, 0), 2, "A", no_null),
+            ("MinSize 4 MaxSize 4", (4, 4), 8, "ABC", no_length.clone()),
+            ("MinSize 4 MaxSize 4", (4, 4), 8, "ABCD", no_length),
+        ];
+        for (case, sizes, var_size, text, want) in cases {
+            let hiidb = string_list_of([0x78; 16], (sizes, 0x00), &[], var_size, &["S"]);
+            let value = SetValue::Text(text.to_owned());
 
             assert_eq!(
-                answers_of(&hiidb, "L", &variables),
-                [format!("<ValueUnavailable: {why}>")],
-                "get, variable {stored:?}"
-            );
-            let set = HiiBackend::set_in(
-                &hiidb,
-                "L",
-                &SetValue::Items(vec![]),
-                None,
-                &SetOptions::default(),
-                shared(&variables),
-                &*variables,
-                None,
-            )
-            .map(drop)
-            .map_err(|error| format!("{error:#}"));
-            assert_eq!(
-                set,
-                Err(format!("cannot set question \"L\": {why}")),
-                "set, variable {stored:?}"
-            );
-            assert_eq!(
-                variables.writes_to(&short_key("ShortList")),
-                [],
-                "writes, variable {stored:?}"
+                string_set(&hiidb, &value, &vec![0x41; usize::from(var_size)]),
+                (want, Vec::new()),
+                "{case}: set {text:?}"
             );
         }
     }
 
-    /// set of an ORDERED_LIST of MaxContainers 0 on a VARSTORE_EFI before UEFI 2.3.1, whose
-    /// StorageWidth is 0, to no items refuses to create its missing variable of no bytes, as a
-    /// SetVariable() of DataSize 0 deletes a variable (UEFI 2.11 §8.2.3), and writes nothing,
-    /// through efivarfs and through GetVariable() and SetVariable().
+    /// set writes line breaks into a STRING with EFI_IFR_STRING_MULTI_LINE (UEFI 2.11
+    /// §33.3.8.3.70) in its Flags, and refuses them before any write into one without.
     #[test]
-    fn set_creates_no_short_var_store_variable_of_no_bytes() {
-        // prompt "L", string 1, on the VarName 3: no container, one UINT8 option
-        let list = [
-            operation(
-                ORDERED_LIST,
-                true,
-                &[question_header_with(1, 1, 1, 3, 0x00), vec![0, 0x00]].concat(),
+    fn set_writes_line_breaks_with_multi_line_alone() {
+        let text = SetValue::Text("A\r\nB".to_owned());
+        let multi_line = string_list_of([0x79; 16], ((0, 8), 0x01), &[], 16, &["S"]);
+        let single_line = string_list_of([0x7A; 16], ((0, 8), 0xFE), &[], 16, &["S"]);
+        let written = [0x41, 0, 0x0D, 0, 0x0A, 0, 0x42, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+
+        assert_eq!(
+            string_set(&multi_line, &text, &[0; 16]),
+            (Ok(()), vec![(0, written.to_vec())]),
+            "Flags 0x01"
+        );
+        assert_eq!(
+            string_set(&single_line, &text, &[0; 16]),
+            (
+                Err("cannot set question \"S\": the STRING is single-line (no \
+                     EFI_IFR_STRING_MULTI_LINE, UEFI 2.11 §33.3.8.3.70), so it takes no line \
+                     break"
+                    .to_owned()),
+                Vec::new()
             ),
-            flagged_option(2, 0x00, 1),
-            END.to_vec(),
-        ]
-        .concat();
-        let hiidb = short_store_list(
-            &[
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                form(1, &[list]),
-            ],
-            &[en_strings_package_of(&["L", "A", "ShortList"])],
+            "Flags 0xFE"
         );
-        for (reach, interface) in [
-            (VariableReach::Runtime, VariableInterface::Efivarfs),
+    }
+
+    /// set refuses a STRING with a WRITE expression, which takes its characters, before any write,
+    /// and get shows why one with a READ expression has no value: uefisettings evaluates neither.
+    #[test]
+    fn strings_with_read_or_write_expressions_take_no_value() {
+        const WRITE: u8 = 0x2E;
+        let expression =
+            |op_code| [operation(op_code, true, &[]), ifr_true(), END.to_vec()].concat();
+        let write = string_list([0x7B; 16], (0, 4), &[expression(WRITE)]);
+        let read = string_list([0x7C; 16], (0, 4), &[expression(READ)]);
+
+        assert_eq!(
+            string_set(&write, &SetValue::Text("AB".to_owned()), &[0; 8]),
             (
-                VariableReach::BootServices,
-                VariableInterface::VariableServices,
+                Err(
+                    "cannot set question \"S\": its WRITE expression takes the CHAR16s of a \
+                     STRING, which uefisettings does not evaluate"
+                        .to_owned()
+                ),
+                Vec::new()
             ),
-        ] {
-            let variables = Rc::new(MemoryVariables::new(reach, interface));
+            "set with a WRITE expression"
+        );
+        assert_eq!(
+            answers_of(&read, "S", &setup_holding(&[0x41, 0, 0, 0, 0, 0, 0, 0])),
+            [
+                "<ValueUnavailable: its READ expression gives the CHAR16s of a STRING, which \
+              uefisettings does not evaluate>"
+            ],
+            "get with a READ expression"
+        );
+    }
 
-            let set = HiiBackend::set_in(
-                &hiidb,
-                "L",
-                &SetValue::Items(vec![]),
-                None,
-                &SetOptions::default(),
-                shared(&variables),
-                &*variables,
-                None,
-            )
-            .map(drop)
-            .map_err(|error| format!("{error:#}"));
+    /// A STRING whose EFI_IFR_DEFAULT, or flagged option, is of a numeric Type shows that default
+    /// as unknown, naming the Type mismatch, and takes no string of that number for its id.
+    #[test]
+    fn strings_show_a_numeric_default_as_unknown() {
+        let unknown = " <IFR default: unknown (a default of a number where the question stores a \
+                       string)>";
+        for (case, child) in [
+            ("UINT8 EFI_IFR_DEFAULT", ifr_default(0, 2)),
+            ("flagged UINT8 option", flagged_option(2, 0x10, 2)),
+        ] {
+            let hiidb = string_list_of([0x60; 16], ((0, 8), 0x00), &[child], 16, &["S", "Hello"]);
+            let variables =
+                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
 
             assert_eq!(
-                set,
-                Err("a variable write without bytes".to_owned()),
-                "{interface:?}: set"
-            );
-            assert_eq!(
-                variables.bytes(&short_key("ShortList")),
-                None,
-                "{interface:?}: ShortList"
+                answers_of(&hiidb, "S", &Rc::new(variables)),
+                [format!("{MISSING_SETUP}{unknown}")],
+                "{case}"
             );
         }
     }
 
-    /// An ORDERED_LIST on the VarName of a PASSWORD on a VARSTORE_EFI before UEFI 2.3.1 reads
-    /// none of the password's variable, which get and set withhold whole: get answers that its
-    /// bytes hold a password, and set refuses new items and writes nothing. The list is as wide
-    /// as the variable, and its VarName, read as a VarOffset, as large, so that only the
-    /// withholding of bytes 0..40 refuses it.
+    /// A STRING without a VarStore is listed with why it has no value, and set refuses it before
+    /// any write.
     #[test]
-    fn an_ordered_list_on_the_var_name_of_a_short_var_store_password_keeps_it_withheld() {
-        // prompt "L", string 1, on the VarName 40 of the PASSWORD's prompt 4: 40 containers
-        let list = [
-            operation(
-                ORDERED_LIST,
-                true,
-                &[question_header_with(1, 1, 1, 40, 0x00), vec![40, 0x00]].concat(),
-            ),
-            flagged_option(2, 0x00, 1),
-            flagged_option(3, 0x00, 2),
-            END.to_vec(),
-        ]
-        .concat();
-        let mut strings = vec!["L", "A", "B", "Password"];
-        strings.resize(39, "Unused");
-        strings.push("ShortVarPw");
-        let hiidb = short_store_list(
-            &[
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                form(1, &[password_on(6, 4, 1, 40), list]),
-            ],
-            &[en_strings_package_of(&strings)],
-        );
-        let password = short_key("ShortVarPw");
-        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-        variables.insert(password.clone(), NV_BS_RT, &plaintext_password());
-        let variables = Rc::new(variables);
+    fn storageless_strings_are_listed_and_refused() {
+        let reason = "question has no VarStore, READ or WRITE expression, or \
+                      EFI_IFR_FLAG_CALLBACK, one of which UEFI 2.11 §33.2.5.6 requires";
+        let string = flagged_string_on(1, 1, (0, 0), (0, 4), (0x00, 0x00), &[]);
+        let packages = [
+            form_package(&[var_store_efi(1, "Setup", NV_BS_RT, 8), form(1, &[string])]),
+            en_strings_package_of(&["S"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x61; 16], &packages.concat());
+        let variables = setup_holding(&[0; 8]);
+        let (listed, _) = listed_and_shown(&hiidb, &[0; 8], None);
+        let listed: Vec<(&str, &str)> = listed
+            .iter()
+            .map(|question| (&*question.name, &*question.answer))
+            .collect();
 
-        assert_eq!(answers_of(&hiidb, "L", &variables), [PASSWORD_BYTES], "get");
-        let set = HiiBackend::set_in(
-            &hiidb,
-            "L",
-            &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
-            None,
-            &SetOptions {
-                unsafe_operations: UnsafeOperations::Allow,
-                ..SetOptions::default()
-            },
-            shared(&variables),
-            &*variables,
-            None,
-        )
-        .map(drop)
-        .map_err(|error| format!("{error:#}"));
         assert_eq!(
-            set,
-            Err(
-                "cannot set question \"L\": its items cannot be read, so set cannot keep those of \
-                 hidden options: its bytes hold a password"
-                    .to_owned()
-            ),
-            "set"
+            listed,
+            [("S", &*format!("<ValueUnavailable: {reason}>"))],
+            "list-questions"
+        );
+        assert_eq!(
+            set_of(&hiidb, "S", "AB", &variables),
+            Err(format!("cannot set question \"S\": {reason}")),
+            "set AB"
+        );
+        assert_eq!(
+            variables.writes_to(&setup()),
+            Vec::<(u16, Vec<u8>)>::new(),
+            "set AB: writes"
         );
-        assert_eq!(variables.writes_to(&password), [], "writes of ShortVarPw");
     }
 
-    /// An ORDERED_LIST over the bytes of a PASSWORD outside any FormSet of its VarStoreId keeps
-    /// them withheld, as a NUMERIC does: get answers that its bytes hold a password, and set
-    /// refuses new items, whose hidden ones it cannot keep unread, and writes nothing.
+    /// A HiiDB whose form holds the STRING "S" of MaxSize 4 at byte 0 of the EFI variable Setup,
+    /// of the question Flags `flags`, and password_hiidb's PASSWORD on the buffer VarStore
+    /// AMITSESetup.
+    fn string_and_password_list(flags: u8) -> Vec<u8> {
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 8),
+                var_store(2, [0x44; 16], "AMITSESetup", 81),
+                form(
+                    1,
+                    &[
+                        flagged_string_on(1, 1, (1, 0), (0, 4), (flags, 0x00), &[]),
+                        password_on(3, 3, 2, 0),
+                    ],
+                ),
+            ]),
+            en_strings_package_of(&["S", "Hello", "Password"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x7D; 16], &packages.concat())
+    }
+
+    /// set of a STRING takes UnsafeOperations as the other kinds do. One that
+    /// EFI_IFR_FLAG_READ_ONLY makes read-only it refuses before any write, and writes with
+    /// UnsafeOperations::Allow, which it returns as lifted. Through variables that reach
+    /// BootServices, in a HiiDB that declares a password question, it refuses unless Allow, and
+    /// then returns UnsafeOperation::SetupPassword, lifted before the read-only flag. A VALUE that
+    /// the STRING cannot hold it refuses before either, with and without Allow.
     #[test]
-    fn ordered_lists_keep_an_outside_password_withheld() {
-        let list = [
-            operation(
-                ORDERED_LIST,
-                true,
-                &[question_header_with(4, 4, 2, 0, 0x00), vec![2, 0x00]].concat(),
+    fn string_set_follows_the_unsafe_operations_grant() {
+        let read_only = UnsafeOperation::ReadOnlyQuestion {
+            question: "S".to_owned(),
+            writable: IncludedStates::empty(),
+        };
+        let password = "this HiiDB declares a setup password question, and the UEFI Shell runs no \
+                        setup browser, so no password is asked or checked; pass \
+                        --i-am-fine-to-brick-this-system to write without it"
+            .to_owned();
+        let too_long = "cannot set question \"S\": the STRING takes at most 3 characters, its \
+                        last CHAR16 of MaxSize 4 holding the NULL (UEFI 2.11 §33.2.5.4.9), not 4"
+            .to_owned();
+        let runtime = (VariableReach::Runtime, VariableInterface::Efivarfs);
+        let boot_services = (
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        // (variables, question Flags, VALUE, what set gives with UnsafeOperations::Refuse, Allow)
+        let cases = [
+            (
+                runtime,
+                0x01,
+                "AB",
+                [
+                    flag_refusal("S", "").map(|()| vec![]),
+                    Ok(vec![read_only.clone()]),
+                ],
             ),
-            flagged_option(5, 0x00, 1),
-            flagged_option(6, 0x00, 2),
-            END.to_vec(),
-        ]
-        .concat();
+            (
+                runtime,
+                0x01,
+                "ABCD",
+                [Err(too_long.clone()), Err(too_long.clone())],
+            ),
+            (
+                boot_services,
+                0x00,
+                "AB",
+                [
+                    Err(password.clone()),
+                    Ok(vec![UnsafeOperation::SetupPassword]),
+                ],
+            ),
+            (
+                boot_services,
+                0x01,
+                "AB",
+                [
+                    Err(password),
+                    Ok(vec![UnsafeOperation::SetupPassword, read_only]),
+                ],
+            ),
+            (
+                boot_services,
+                0x00,
+                "ABCD",
+                [Err(too_long.clone()), Err(too_long)],
+            ),
+        ];
+        for ((reach, interface), flags, text, wants) in cases {
+            let grants = [UnsafeOperations::Refuse, UnsafeOperations::Allow];
+            for (grant, want) in grants.into_iter().zip(wants) {
+                let variables = password_variables(reach, interface);
+                variables.insert(setup(), NV_BS_RT, &[0; 8]);
+                let want_writes = match want {
+                    Ok(_) => vec![(0, vec![0x41, 0, 0x42, 0, 0, 0, 0, 0])],
+                    Err(_) => vec![],
+                };
+
+                let got = HiiBackend::set_in(
+                    &string_and_password_list(flags),
+                    "S",
+                    &SetValue::Text(text.to_owned()),
+                    None,
+                    &SetOptions {
+                        unsafe_operations: grant,
+                        ..SetOptions::default()
+                    },
+                    SetAccess {
+                        reads: shared(&variables),
+                        writes: &*variables,
+                        held: None,
+                    },
+                    None,
+                )
+                .map(|(_, lifted)| lifted)
+                .map_err(|error| format!("{error:#}"));
+
+                let case =
+                    format!("{reach:?}, question Flags {flags:#04x}, set S {text}, {grant:?}");
+                assert_eq!(got, want, "{case}");
+                assert_eq!(variables.writes_to(&setup()), want_writes, "{case}: writes");
+            }
+        }
+    }
+
+    /// A STRING over the bytes of a PASSWORD keeps them withheld, as a NUMERIC does: get answers
+    /// that its bytes hold a password and set writes nothing, while a STRING after them is read
+    /// and written; the PASSWORD, whose characters a STRING would show, stays no question that
+    /// get selects.
+    #[test]
+    fn strings_keep_the_bytes_of_a_password_withheld() {
         let packages = [
-            form_package_of(
-                &[
-                    password_on(3, 3, 2, 0),
-                    form_set(&[
-                        var_store(2, [0x44; 16], "AMITSESetup", 81),
-                        form(1, &[list]),
-                    ]),
-                ]
-                .concat(),
-            ),
-            en_strings_package_of(&["Q", "P", "Password", "L", "A", "B"]),
+            form_package_of(&form_set(&[
+                var_store(2, [0x44; 16], "AMITSESetup", 81),
+                form(
+                    1,
+                    &[
+                        password_on(3, 3, 2, 0),
+                        string_on(4, 4, (2, 10), (0, 4), &[]),
+                        string_on(5, 5, (2, 40), (0, 4), &[]),
+                    ],
+                ),
+            ])),
+            en_strings_package_of(&["Q", "P", "Password", "Over", "After"]),
             END_PACKAGE.to_vec(),
         ];
         let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let stored = [plaintext_password().as_slice(), &[0xAA; 40], &[1]].concat();
+        let after: Vec<u8> = [0x41, 0, 0x42, 0, 0, 0, 0, 0].into();
+        let stored = [plaintext_password().as_slice(), &after, &[0; 33]].concat();
         let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
         variables.insert(amitse_setup(), NV_BS_RT, &stored);
         let variables = Rc::new(variables);
-        let options = SetOptions {
-            unsafe_operations: UnsafeOperations::Allow,
-            ..SetOptions::default()
-        };
 
-        assert_eq!(answers_of(&hiidb, "L", &variables), [PASSWORD_BYTES], "get");
-        let set = HiiBackend::set_in(
-            &hiidb,
-            "L",
-            &SetValue::Items(vec!["B".to_owned(), "A".to_owned()]),
-            None,
-            &options,
-            shared(&variables),
-            &*variables,
-            None,
-        )
-        .map(drop)
-        .map_err(|error| format!("{error:#}"));
         assert_eq!(
-            set,
-            Err(
-                "cannot set question \"L\": its items cannot be read, so set cannot keep those of \
-                 hidden options: its bytes hold a password"
-                    .to_owned()
-            ),
-            "set"
+            answers_of(&hiidb, "Over", &variables),
+            [PASSWORD_BYTES],
+            "get Over"
+        );
+        assert_eq!(answers_of(&hiidb, "After", &variables), ["AB"], "get After");
+        assert_eq!(
+            answers_of(&hiidb, "Password", &variables),
+            Vec::<String>::new(),
+            "get Password"
+        );
+        let set = set_bypassing(&hiidb, "Over", "ab", &variables);
+        assert!(
+            set.as_ref()
+                .is_err_and(|error| error
+                    .contains("holds a password at bytes 0..40, which set never writes")),
+            "set Over: {set:?}"
+        );
+        assert_eq!(variables.writes_to(&amitse_setup()), [], "set Over: writes");
+        assert_eq!(
+            set_bypassing(&hiidb, "After", "Z", &variables),
+            Ok(()),
+            "set After"
         );
         assert_eq!(
             variables.writes_to(&amitse_setup()),
-            [],
-            "writes to AMITSESetup"
+            [(40, vec![0x5A, 0, 0, 0, 0, 0, 0, 0])],
+            "set After: writes"
         );
     }
 
-    /// A REF on a VARSTORE_EFI before UEFI 2.3.1 shows the EFI_HII_REF that the whole EFI
-    /// variable of its VarName holds, its StorageWidth in edk2-stable202608
-    /// SetupBrowserDxe/IfrParse.c, as Setup.c GetQuestionValue reads it there; a variable of
-    /// another size is refused, and set refuses the REF as on any VarStore, writing nothing. One
-    /// before the store took its VarStoreInfo for a VarOffset and is refused as a NUMERIC is.
+    /// list-questions and show-ifr withhold the bytes of a PASSWORD under a STRING, and show no
+    /// character of the password, while they show a STRING after it.
     #[test]
-    fn cross_references_of_a_short_var_store_show_the_hii_refs_of_their_var_names() {
-        // an EFI_IFR_REF5 of prompt "R", string 1, on the VarName 2
-        let reference = operation(REF, false, &question_header_with(1, 1, 1, 2, 0x00));
-        let strings = [en_strings_package_of(&["R", "ShortRef"])];
-        let short_store = short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT);
-        let hiidb = short_store_list(
-            &[
-                short_store.clone(),
-                form(1, std::slice::from_ref(&reference)),
-            ],
-            &strings,
-        );
-        let variables = |value: &[u8]| {
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-            variables.insert(short_key("ShortRef"), NV_BS_RT, value);
-            Rc::new(variables)
-        };
-        // QuestionId 5, FormId 1, FormSetGuid 0x11 × 16, DevicePath string 0
-        let stored = [&[5, 0, 1, 0][..], &[0x11; 16], &[0, 0]].concat();
+    fn strings_list_and_show_no_password_character() {
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 48),
+                form(
+                    1,
+                    &[
+                        password_on(3, 3, 1, 0),
+                        string_on(4, 4, (1, 2), (0, 4), &[]),
+                        string_on(5, 5, (1, 40), (0, 4), &[]),
+                    ],
+                ),
+            ]),
+            en_strings_package_of(&["Q", "P", "Password", "Over", "After"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x7D; 16], &packages.concat());
+        let stored = [
+            plaintext_password().as_slice(),
+            &[0x41, 0, 0x42, 0, 0, 0, 0, 0],
+        ]
+        .concat();
 
-        let short = variables(&stored);
+        let (listed, shown) = listed_and_shown(&hiidb, &stored, None);
+
+        let listed: Vec<(&str, &str)> = listed
+            .iter()
+            .map(|question| (&*question.name, &*question.answer))
+            .collect();
         assert_eq!(
-            answers_of(&hiidb, "R", &short),
-            ["QuestionId 0x0005, FormId 0x0001, FormSetGuid \
-                 11111111-1111-1111-1111-111111111111, DevicePath none"],
-            "get"
+            listed,
+            [("Over", PASSWORD_BYTES), ("After", "AB")],
+            "list-questions"
         );
-        let set = set_of(&hiidb, "R", "0", &short);
         assert!(
-            set.as_ref()
-                .is_err_and(|error| error.contains("set does not write the EFI_HII_REF")),
-            "set: {set:?}"
+            shown.contains(&format!("-Answer: {PASSWORD_BYTES}\n")),
+            "show-ifr: {shown}"
         );
-        assert_eq!(short.writes_to(&short_key("ShortRef")), [], "writes");
+        assert!(shown.contains("-Answer: AB\n"), "show-ifr: {shown}");
+        for output in [format!("{listed:?}"), shown] {
+            assert!(
+                !output.contains("unter"),
+                "a password character in {output}"
+            );
+        }
+    }
 
-        let longer = variables(&[stored.as_slice(), &[0]].concat());
-        assert_eq!(
-            answers_of(&hiidb, "R", &longer),
-            [
-                "<ValueUnavailable: EFI variable ShortRef-8c78a505-baa0-4c4a-869f-000000000b01 \
-                 holds 23 bytes; the question takes 22>"
-            ],
-            "get of 23 bytes"
+    /// A STRING of a VARSTORE whose bytes the ExportConfig snapshot holds shows " <snapshot>" in
+    /// get, list-questions and show-ifr, and one over a PASSWORD's bytes in the snapshot shows
+    /// none of them, as bytes or as characters, in any text or JSON output.
+    #[test]
+    fn snapshot_strings_show_their_source_and_no_password() {
+        let packages = [
+            device_path_package(&DRIVER_PATH),
+            form_package(&[
+                var_store(1, N_GUID, "NStore", 8),
+                var_store(2, P_GUID, "AMITSESetup", 81),
+                form(
+                    1,
+                    &[
+                        string_on(1, 1, (1, 0), (0, 4), &[]),
+                        password_on(3, 4, 2, 0),
+                        string_on(5, 5, (2, 2), (0, 4), &[]),
+                    ],
+                ),
+            ]),
+            en_strings_package_of(&["S", "W", "P", "Password", "Over"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x7E; 16], &packages.concat());
+        let mut amitse_setup = [0; 81];
+        amitse_setup[..40].fill(0xA5);
+        let text = [
+            block_resp(
+                &config_hdr(N_GUID, "NStore", &DRIVER_PATH),
+                0,
+                &[0x41, 0, 0x42, 0, 0, 0, 0, 0],
+            ),
+            block_resp(
+                &config_hdr(P_GUID, "AMITSESetup", &DRIVER_PATH),
+                0,
+                &amitse_setup,
+            ),
+        ]
+        .join("&");
+
+        let (got, listed, shown, outputs) =
+            answers_with_snapshot(&hiidb, &["S", "Over"], &no_variables(), &text);
+
+        assert_eq!(got, ["AB <snapshot>", PASSWORD_BYTES], "get");
+        assert_eq!(listed, got, "list-questions");
+        assert!(
+            shown.contains("-Answer: AB <snapshot>\n"),
+            "show-ifr: {shown}"
+        );
+        assert!(
+            shown.contains(&format!("-Answer: {PASSWORD_BYTES}\n")),
+            "show-ifr: {shown}"
         );
+        assert_no_password_byte(&outputs);
+        for output in &outputs {
+            assert!(!output.contains('\u{A5A5}'), "U+A5A5 in {output}");
+        }
+    }
 
-        let declared_after = short_store_list(&[form(1, &[reference]), short_store], &strings);
-        assert_eq!(
-            answers_of(&declared_after, "R", &short),
-            [
-                "<ValueUnavailable: VarStore 0x0001 (EFI_IFR_VARSTORE_EFI before UEFI 2.3.1): \
-                 declared after the question, which took its VarStoreInfo for a VarOffset; a \
-                 question names a previously declared VarStore (UEFI 2.11 §33.3.8.2.2 \
-                 EFI_IFR_QUESTION_HEADER)>"
+    /// set refuses a STRING and a NUMERIC that one prompt selects in two FormSets before it
+    /// writes either: it gives one value to questions of one kind.
+    #[test]
+    fn set_refuses_a_string_and_a_numeric_of_one_prompt() {
+        let hiidb = [
+            string_list([0x75; 16], (0, 1), &[]),
+            one_form_list([0x76; 16], "S", &[numeric_at(1, 0, 0)]),
+        ]
+        .concat();
+        let variables = setup_holding(&[0; 3]);
+
+        let set = set_of(&hiidb, "S", "1", &variables);
+        assert!(
+            set.as_ref()
+                .is_err_and(|error| error.contains("STRING (in ")
+                    && error.contains("set gives one value to questions of one kind")),
+            "set S: {set:?}"
+        );
+        assert_eq!(variables.writes_to(&setup()), [], "set S: writes");
+    }
+
+    /// Two VARSTORE_EFIs before UEFI 2.3.1 of two Guids each take the VarNames of their questions
+    /// from the strings of the package list: the NUMERIC A, inside a SUPPRESS_IF and a
+    /// GRAY_OUT_IF, reads and sets ShortVarA of the first store's Guid, the CHECKBOX B ShortVarB
+    /// of the second's, and set writes no variable of the other Guid.
+    #[test]
+    fn two_short_var_stores_set_the_variables_of_their_own_guids() {
+        let nested_a = conditional(
+            SUPPRESS_IF,
+            ifr_false(),
+            &[conditional(GRAY_OUT_IF, ifr_false(), &[short_numeric_a()])],
+        );
+        let hiidb = short_store_list(
+            &[
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                short_var_store_efi_of(2, OTHER_GUID, NV_BS_RT),
+                form(1, &[nested_a, checkbox_at(2, 2, 2, 8)]),
             ],
-            "get of the REF before its store"
+            &[en_strings_package_of(&SHORT_STRINGS)],
         );
-    }
+        let other = |name: &str| VariableKey {
+            name: name.to_string(),
+            guid: Guid::from(OTHER_GUID),
+        };
+        let variables = short_efivarfs_variables();
+        variables.insert(other("ShortVarB"), NV_BS_RT, &[0]);
 
-    /// A REF over the bytes of a PASSWORD outside any FormSet of its VarStoreId keeps them
-    /// withheld, as a NUMERIC does: get answers that its bytes hold a password.
-    #[test]
-    fn cross_references_keep_an_outside_password_withheld() {
-        // an EFI_IFR_REF5 at byte 0 of AMITSESetup
-        let reference = operation(REF, false, &question_header_with(4, 4, 2, 0, 0x00));
-        let packages = [
-            form_package_of(
-                &[
-                    password_on(3, 3, 2, 0),
-                    form_set(&[
-                        var_store(2, [0x44; 16], "AMITSESetup", 81),
-                        form(1, &[reference]),
-                    ]),
-                ]
-                .concat(),
-            ),
-            en_strings_package_of(&["Q", "P", "Password", "R"]),
-            END_PACKAGE.to_vec(),
+        assert_eq!(answers_of(&hiidb, "A", &variables), ["5"], "get A");
+        assert_eq!(answers_of(&hiidb, "B", &variables), ["0"], "get B");
+        assert_eq!(set_of(&hiidb, "A", "9", &variables), Ok(()), "set A");
+        assert_eq!(set_of(&hiidb, "B", "1", &variables), Ok(()), "set B");
+        let writes = [
+            (short_key("ShortVarA"), vec![(0, vec![9])]),
+            (other("ShortVarA"), vec![]),
+            (other("ShortVarB"), vec![(0, vec![1])]),
+            (short_key("ShortVarB"), vec![]),
         ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let stored = [plaintext_password().as_slice(), &[0xAA; 40], &[1]].concat();
-        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-        variables.insert(amitse_setup(), NV_BS_RT, &stored);
-        let variables = Rc::new(variables);
-
-        assert_eq!(answers_of(&hiidb, "R", &variables), [PASSWORD_BYTES], "get");
+        for (key, want) in writes {
+            assert_eq!(variables.writes_to(&key), want, "writes of {key}");
+        }
     }
 
-    /// A package list with GUID `guid` whose form holds the STRING "S", string 1, of MinSize and
-    /// MaxSize `sizes` and the Flags `flags`, holding `children`, at byte 0 of the EFI variable
-    /// Setup of `var_size` bytes, with the texts `strings`.
-    fn string_list_of(
-        guid: [u8; 16],
-        (sizes, flags): ((u8, u8), u8),
-        children: &[Vec<u8>],
-        var_size: u16,
-        strings: &[&str],
-    ) -> Vec<u8> {
-        let string = flagged_string_on(1, 1, (1, 0), sizes, (0x00, flags), children);
+    /// The PASSWORD on a VARSTORE_EFI before UEFI 2.3.1 keeps its password in the EFI variable of
+    /// its VarName, which get and set through variables of either reach withhold: the CHECKBOX B
+    /// on that VarName is neither read nor written, the NUMERIC A beside it is, and the variable
+    /// keeps the password. Through variables that reach BootServices, set refuses the HiiDB
+    /// without UnsafeOperations::Allow.
+    #[test]
+    fn the_variable_of_a_short_var_store_password_is_withheld() {
+        // "Password" is string 14 and "ShortVarPw" string 15
+        let strings = [&SHORT_STRINGS[..], &["Password", "ShortVarPw"]].concat();
         let packages = [
             form_package(&[
-                var_store_efi(1, "Setup", NV_BS_RT, var_size),
-                form(1, &[string]),
+                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
+                form(
+                    1,
+                    &[
+                        short_numeric_a(),
+                        password_on(6, 14, 1, 15),
+                        checkbox_at(2, 2, 1, 15),
+                    ],
+                ),
             ]),
-            en_strings_package_of(strings),
+            en_strings_package_of(&strings),
             END_PACKAGE.to_vec(),
         ];
-        package_list_with_guid(guid, &packages.concat())
-    }
-
-    /// string_list_of without Flags, its Setup of MaxSize CHAR16s, string 2 "Hello".
-    fn string_list(guid: [u8; 16], sizes: (u8, u8), children: &[Vec<u8>]) -> Vec<u8> {
-        let var_size = u16::from(sizes.1) * 2;
-        string_list_of(guid, (sizes, 0x00), children, var_size, &["S", "Hello"])
-    }
-
-    /// The variables of a HiiDB that reach Runtime through efivarfs, Setup holding `stored`.
-    fn setup_holding(stored: &[u8]) -> Rc<MemoryVariables> {
-        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-        variables.insert(setup(), NV_BS_RT, stored);
-        Rc::new(variables)
-    }
-
-    /// The answer of a STRING without its variable Setup.
-    const MISSING_SETUP: &str =
-        "<ValueUnavailable: no EFI variable Setup-00000000-0000-0000-0000-000000000000>";
-
-    /// get, list-questions and show-ifr show a STRING on a VarStore as the UCS-2 characters of its
-    /// MaxSize CHAR16s up to the first NULL, all of them without one, as edk2-stable202608
-    /// SetupBrowserDxe/IfrParse.c:2229 keeps one more CHAR16, zero, after them; a UTF-16
-    /// surrogate, which UCS-2 has no character for (UEFI 2.11 §33.2.6.2.2), gives no value.
-    #[test]
-    fn strings_show_their_characters_up_to_the_first_null() {
-        let hiidb = string_list([0x71; 16], (0, 4), &[]);
-        let surrogate = "<ValueUnavailable: its character 1 is CHAR16 0xd83d, a UTF-16 surrogate, \
-                         which UCS-2 has no character for (UEFI 2.11 §33.2.6.2.2)>";
-        let cases: [(&str, [u8; 8], &str); 6] = [
-            ("null-terminated", [0x41, 0, 0x42, 0, 0, 0, 0, 0], "AB"),
-            ("no null", [0x41, 0, 0x42, 0, 0x43, 0, 0x44, 0], "ABCD"),
-            ("empty", [0; 8], ""),
-            ("after the null", [0x41, 0, 0, 0, 0x43, 0, 0x44, 0], "A"),
-            ("beyond ASCII", [0xE9, 0, 0xAC, 0x20, 0, 0, 0, 0], "é€"),
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let password = short_key("ShortVarPw");
+        let password_variable = [&NV_BS_RT.to_ne_bytes()[..], &plaintext_password()].concat();
+        let refusal = "cannot set question \"B\": EFI variable \
+                       ShortVarPw-8c78a505-baa0-4c4a-869f-000000000b01 holds a password at bytes \
+                       0..40, which set never writes";
+        let reaches = [
+            (VariableReach::Runtime, VariableInterface::Efivarfs),
             (
-                "surrogate",
-                [0x41, 0, 0x3D, 0xD8, 0x00, 0xDE, 0, 0],
-                surrogate,
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
             ),
         ];
-        for (case, stored, answer) in cases {
-            let (listed, shown) = listed_and_shown(&hiidb, &stored, None);
-            let listed: Vec<(&str, &str)> = listed
-                .iter()
-                .map(|question| (&*question.name, &*question.answer))
-                .collect();
+        for (reach, interface) in reaches {
+            let variables = short_variables(reach, interface);
+            variables.insert(password.clone(), NV_BS_RT, &plaintext_password());
 
             assert_eq!(
-                answers_of(&hiidb, "S", &setup_holding(&stored)),
-                [answer],
-                "{case}: get"
+                answers_of(&hiidb, "B", &variables),
+                [format!("{PASSWORD_BYTES} <IFR default: 0>")],
+                "{reach:?}: get B"
             );
-            assert_eq!(listed, [("S", answer)], "{case}: list-questions");
-            assert!(
-                shown.contains(&format!("-Answer: {answer}\n")),
-                "{case}: show-ifr: {shown}"
+            assert_eq!(
+                answers_of(&hiidb, "A", &variables),
+                ["5"],
+                "{reach:?}: get A"
             );
-        }
-    }
-
-    /// A STRING of MaxSize 4 reads its 8 bytes alone of a variable of 12 whose characters go on
-    /// past them without a NULL.
-    #[test]
-    fn strings_read_no_character_past_their_max_size() {
-        let hiidb = string_list_of([0x77; 16], ((0, 4), 0x00), &[], 12, &["S", "Hello"]);
-        let stored = [0x41, 0, 0x42, 0, 0x43, 0, 0x44, 0, 0x45, 0, 0x46, 0];
-        let (listed, shown) = listed_and_shown(&hiidb, &stored, None);
-        let listed: Vec<(&str, &str)> = listed
-            .iter()
-            .map(|question| (&*question.name, &*question.answer))
-            .collect();
-
-        assert_eq!(
-            answers_of(&hiidb, "S", &setup_holding(&stored)),
-            ["ABCD"],
-            "get"
-        );
-        assert_eq!(listed, [("S", "ABCD")], "list-questions");
-        assert!(shown.contains("-Answer: ABCD\n"), "show-ifr: {shown}");
-    }
-
-    /// A STRING without a value shows its default of Type STRING, the text of that string, cut to
-    /// MaxSize characters, as edk2-stable202608 SetupBrowserDxe/Setup.c:4507-4511
-    /// GetQuestionDefault copies at most StorageWidth bytes of it; a string that the package list
-    /// lacks, or one with a character beyond UCS-2 (UEFI 2.11 §33.2.6.2.2), gives no default.
-    #[test]
-    fn strings_without_a_variable_show_their_string_default() {
-        let unknown_text = "unknown (EFI_IFR_TYPE_STRING default: string 0x0002 holds \
-                            '\u{1F600}' (U+1F600), which UCS-2 has no character for (UEFI 2.11 \
-                            §33.2.6.2.2))";
-        let cases = [
-            ("MaxSize 8", 8, 2, ["S", "Hello"], "Hello"),
-            ("MaxSize 4", 4, 2, ["S", "Hello"], "Hell"),
-            ("MaxSize 5", 5, 2, ["S", "Hello"], "Hello"),
-            (
-                "missing string",
-                8,
-                9,
-                ["S", "Hello"],
-                "unknown (EFI_IFR_TYPE_STRING default: string 0x0009 not found)",
-            ),
-            ("beyond UCS-2", 8, 2, ["S", "A\u{1F600}"], unknown_text),
-        ];
-        for (case, max_size, string_id, strings, default) in cases {
-            let hiidb = string_list_of(
-                [0x72; 16],
-                ((0, max_size), 0x00),
-                &[string_default(0, string_id)],
-                u16::from(max_size) * 2,
-                &strings,
+            assert_eq!(
+                set_bypassing(&hiidb, "B", "1", &variables),
+                Err(refusal.to_string()),
+                "{reach:?}: set B"
             );
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-
             assert_eq!(
-                answers_of(&hiidb, "S", &Rc::new(variables)),
-                [format!("{MISSING_SETUP} <IFR default: {default}>")],
-                "{case}"
+                set_bypassing(&hiidb, "A", "9", &variables),
+                Ok(()),
+                "{reach:?}: set A"
             );
-        }
-    }
-
-    /// A STRING without a value shows the default of a flagged EFI_IFR_ONE_OF_OPTION of Type
-    /// EFI_IFR_TYPE_STRING in its scope, the text of the option's Value, below an EFI_IFR_DEFAULT,
-    /// as EFI_IFR_STRING (UEFI 2.11 §33.3.8.3.70) orders them; an option of no default flag, or one
-    /// that a SUPPRESS_IF hides, gives none.
-    #[test]
-    fn strings_show_the_defaults_of_their_flagged_options() {
-        const OPTION_DEFAULT: u8 = 0x10;
-        let option = || string_option(3, OPTION_DEFAULT, 4);
-        let cases = [
-            ("flagged option", vec![option()], " <IFR default: Bonjour>"),
-            (
-                "flagged option and EFI_IFR_DEFAULT",
-                vec![option(), string_default(0, 2)],
-                " <IFR default: Hello>",
-            ),
-            ("option of no flag", vec![string_option(3, 0x00, 4)], ""),
-            (
-                "suppressed flagged option",
-                vec![conditional(SUPPRESS_IF, ifr_true(), &[option()])],
-                "",
-            ),
-        ];
-        for (case, children, default) in cases {
-            let hiidb = string_list_of(
-                [0x7F; 16],
-                ((0, 8), 0x00),
-                &children,
-                16,
-                &["S", "Hello", "Option", "Bonjour"],
+            assert_eq!(
+                variables.writes_to(&password),
+                vec![],
+                "{reach:?}: writes of ShortVarPw"
             );
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-
             assert_eq!(
-                answers_of(&hiidb, "S", &Rc::new(variables)),
-                [format!("{MISSING_SETUP}{default}")],
-                "{case}"
+                variables.bytes(&password),
+                Some(password_variable.clone()),
+                "{reach:?}: ShortVarPw keeps its password"
             );
         }
+
+        let variables = short_variables(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        );
+        variables.insert(password, NV_BS_RT, &plaintext_password());
+        assert_eq!(
+            set_of(&hiidb, "A", "9", &variables),
+            Err(
+                "this HiiDB declares a setup password question, and the UEFI Shell runs no setup \
+                 browser, so no password is asked or checked; pass \
+                 --i-am-fine-to-brick-this-system to write without it"
+                    .to_string()
+            ),
+            "set A without UnsafeOperations::Allow"
+        );
     }
 
-    /// A ONE_OF whose flagged EFI_IFR_ONE_OF_OPTION is of Type EFI_IFR_TYPE_STRING shows its
-    /// default as unknown, naming the Type mismatch: a ONE_OF stores a number.
+    /// A GET and a SET of the VARSTORE_EFI before UEFI 2.3.1 reach the EFI variables of their
+    /// VarNames through set, through variables of either reach: set refuses the CHECKBOX F, which
+    /// a SUPPRESS_IF hides while the GET of ShortVarA gives 5, and sets it once set of A wrote 9
+    /// there; that set writes ShortVarD by the SET of A's WRITE expression, then ShortVarA, and,
+    /// without ShortVarD, creates it with the store's Attributes, as edk2-stable202608
+    /// SetupBrowserDxe/Expression.c EvaluateExpression does by SetVariable(). Through the firmware
+    /// environment calls of Windows, which create no variable, that SET stores nothing.
     #[test]
-    fn one_ofs_show_a_string_option_default_as_unknown() {
-        let data = [
-            question_header_with(1, 1, 1, 0, 0x00),
-            // Flags EFI_IFR_NUMERIC_SIZE_1, MinValue, MaxValue, Step
-            vec![0x00, 0x00, 0xFF, 0x01],
-        ]
-        .concat();
-        let one_of = [
-            operation(ONE_OF, true, &data),
-            string_option(2, 0x10, 2),
+    fn get_and_set_of_a_short_var_store_reach_the_variables_of_their_var_names() {
+        const GET: u8 = 0x2B;
+        const SET: u8 = 0x2C;
+        const WRITE: u8 = 0x2E;
+        const EQUAL: u8 = 0x2F;
+        const THIS: u8 = 0x58;
+        // a GET or SET of VarStore 1 at VarName `var_name`, of VarStoreType `value_type`
+        let store_op = |op_code: u8, var_name: u16, value_type: u8| {
+            let data = [
+                &1u16.to_le_bytes()[..],
+                &var_name.to_le_bytes(),
+                &[value_type],
+            ]
+            .concat();
+            operation(op_code, false, &data)
+        };
+        // the UINT8 NUMERIC A on ShortVarA, whose WRITE sets ShortVarD, a UINT16
+        // (EFI_IFR_TYPE_NUM_SIZE_16), to its value
+        let numeric_a = [
+            operation(
+                NUMERIC,
+                true,
+                &[
+                    question_header_with(1, 1, 1, 7, 0x00),
+                    // EFI_IFR_NUMERIC_SIZE_1 | EFI_IFR_DISPLAY_UINT_DEC, from 0 to 255, step 1
+                    vec![0x10, 0, 255, 1],
+                ]
+                .concat(),
+            ),
+            operation(WRITE, false, &[]),
+            scoped_expression(&[operation(THIS, false, &[]), store_op(SET, 10, 0x01)], 0),
             END.to_vec(),
         ]
         .concat();
-        let packages = [
-            form_package(&[var_store_efi(1, "Setup", NV_BS_RT, 1), form(1, &[one_of])]),
-            en_strings_package_of(&["O", "Hello"]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x5F; 16], &packages.concat());
-        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-
-        assert_eq!(
-            answers_of(&hiidb, "O", &Rc::new(variables)),
-            [format!(
-                "{MISSING_SETUP} <IFR default: unknown (a default of EFI_IFR_TYPE_STRING where the \
-                 question stores a number)>"
-            )],
-            "get"
+        // the CHECKBOX F on ShortVarC, suppressed where ShortVarA holds the UINT8
+        // (EFI_IFR_TYPE_NUM_SIZE_8) 5
+        let hidden_f = conditional(
+            SUPPRESS_IF,
+            scoped_expression(
+                &[
+                    store_op(GET, 7, 0x00),
+                    uint8(5),
+                    operation(EQUAL, false, &[]),
+                ],
+                0,
+            ),
+            &[checkbox_at(6, 6, 1, 9)],
         );
-    }
-
-    /// set writes at most MaxSize − 1 characters of a STRING as UCS-2, NULL-padded to its MaxSize
-    /// CHAR16s, so that a NULL ends them (UEFI 2.11 §33.2.5.4.9); get shows them then.
-    #[test]
-    fn set_writes_a_string_null_padded_to_max_size() {
-        let hiidb = string_list([0x73; 16], (0, 4), &[]);
-        let cases: [(&str, [u8; 8]); 5] = [
-            ("Hi", [0x48, 0, 0x69, 0, 0, 0, 0, 0]),
-            ("é€", [0xE9, 0, 0xAC, 0x20, 0, 0, 0, 0]),
-            ("XYZ", [0x58, 0, 0x59, 0, 0x5A, 0, 0, 0]),
-            ("\u{F900}", [0x00, 0xF9, 0, 0, 0, 0, 0, 0]),
-            ("", [0; 8]),
+        let hiidb = short_store_hiidb(NV_BS_RT, &[numeric_a, hidden_f]);
+        let reaches = [
+            (VariableReach::Runtime, VariableInterface::Efivarfs),
+            (
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            ),
         ];
-        for (text, written) in cases {
-            let variables = setup_holding(&[0x41, 0, 0x42, 0, 0x43, 0, 0x44, 0]);
+        for (reach, interface) in reaches {
+            let variables = short_variables(reach, interface);
 
             assert_eq!(
-                set_of(&hiidb, "S", text, &variables),
+                set_of(&hiidb, "F", "1", &variables),
+                Err(
+                    "question \"F\" is suppressed; also include suppressed questions to select it"
+                        .to_string()
+                ),
+                "{reach:?}: set F while ShortVarA holds 5"
+            );
+            assert_eq!(
+                set_of(&hiidb, "A", "9", &variables),
                 Ok(()),
-                "set {text:?}"
+                "{reach:?}: set A"
             );
             assert_eq!(
-                variables.writes_to(&setup()),
-                [(0, written.to_vec())],
-                "set {text:?}: writes"
+                variables.writes_to(&short_key("ShortVarD")),
+                [(0, vec![9, 0])],
+                "{reach:?}: set A: writes of ShortVarD"
             );
             assert_eq!(
-                answers_of(&hiidb, "S", &variables),
-                [text],
-                "set {text:?}: get"
+                variables.writes_to(&short_key("ShortVarA")),
+                [(0, vec![9])],
+                "{reach:?}: set A: writes of ShortVarA"
+            );
+            assert_eq!(
+                set_of(&hiidb, "F", "1", &variables),
+                Ok(()),
+                "{reach:?}: set F once ShortVarA holds 9"
+            );
+            assert_eq!(
+                variables.writes_to(&short_key("ShortVarC")),
+                [(0, vec![1])],
+                "{reach:?}: set F: writes of ShortVarC"
+            );
+
+            let variables = MemoryVariables::new(reach, interface);
+            variables.insert(short_key("ShortVarA"), NV_BS_RT, &[5]);
+            let variables = Rc::new(variables);
+            assert_eq!(
+                set_of(&hiidb, "A", "9", &variables),
+                Ok(()),
+                "{reach:?}: set A without ShortVarD"
+            );
+            assert_eq!(
+                variables.writes_to(&short_key("ShortVarA")),
+                [(0, vec![9])],
+                "{reach:?}: set A without ShortVarD: writes of ShortVarA"
+            );
+            assert_eq!(
+                variables.bytes(&short_key("ShortVarD")),
+                Some([&NV_BS_RT.to_ne_bytes()[..], &[9, 0]].concat()),
+                "{reach:?}: set A without ShortVarD: ShortVarD"
             );
         }
+
+        let variables = MemoryVariables::new(
+            VariableReach::Runtime,
+            VariableInterface::FirmwareEnvironment,
+        );
+        variables.insert(short_key("ShortVarA"), NV_BS_RT, &[5]);
+        let variables = Rc::new(variables);
+        assert_eq!(
+            set_of(&hiidb, "A", "9", &variables),
+            Ok(()),
+            "Windows: set A without ShortVarD"
+        );
+        assert_eq!(
+            variables.writes_to(&short_key("ShortVarA")),
+            [(0, vec![9])],
+            "Windows: set A without ShortVarD: writes of ShortVarA"
+        );
+        assert_eq!(
+            variables.bytes(&short_key("ShortVarD")),
+            None,
+            "Windows: set A without ShortVarD: ShortVarD"
+        );
     }
 
-    /// set of a STRING through `hiidb`'s variables with `value`, as the CLI prints an error, and
-    /// what it wrote to Setup, which held `stored`.
-    fn string_set(hiidb: &[u8], value: &SetValue, stored: &[u8]) -> SetOutcome {
-        let variables = setup_holding(stored);
-        let got = HiiBackend::set_in(
+    /// set writes an existing per-question variable at its question's width with the variable's
+    /// own attributes, not those that the VARSTORE_EFI declares: "If a preexisting variable is
+    /// rewritten with different attributes, SetVariable() shall not modify the variable" (UEFI
+    /// 2.11 §8.2.3 SetVariable).
+    #[test]
+    fn set_keeps_the_attributes_of_a_per_question_variable() {
+        let hiidb = short_store_hiidb(NV_BS_RT, &[short_numeric_a()]);
+        let variables = Rc::new(MemoryVariables::new(
+            VariableReach::BootServices,
+            VariableInterface::VariableServices,
+        ));
+        variables.insert(short_key("ShortVarA"), NV_BS, &[5]);
+
+        assert_eq!(set_of(&hiidb, "A", "9", &variables), Ok(()), "set A");
+        assert_eq!(
+            variables.bytes(&short_key("ShortVarA")),
+            Some([&NV_BS.to_ne_bytes()[..], &[9]].concat()),
+            "ShortVarA"
+        );
+    }
+
+    /// Two FormSets that declare AMITSESetup: the first at its top, with the UINT64 NUMERIC N0
+    /// over bytes 0..8, shown in hex; the second after `declarations`, with a PASSWORD at bytes
+    /// 0..40.
+    fn password_after_hiidb(declarations: &[Vec<u8>]) -> Vec<u8> {
+        let numeric = [
+            question_header_with(4, 4, 2, 0, 0x00),
+            vec![0x23], // EFI_IFR_NUMERIC_SIZE_8 | EFI_IFR_DISPLAY_UINT_HEX
+            0u64.to_le_bytes().to_vec(),
+            u64::MAX.to_le_bytes().to_vec(),
+            1u64.to_le_bytes().to_vec(),
+        ]
+        .concat();
+        let packages = [
+            form_package_of(
+                &[
+                    form_set(&[
+                        var_store(2, [0x44; 16], "AMITSESetup", 81),
+                        form(1, &[operation(NUMERIC, false, &numeric)]),
+                    ]),
+                    form_set(&[declarations.concat(), form(1, &[password_on(3, 3, 2, 0)])]),
+                ]
+                .concat(),
+            ),
+            en_strings_package_of(&["Q", "P", "Password", "N0"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x55; 16], &packages.concat())
+    }
+
+    /// get of N0 in `hiidb` through variables of `reach`, AMITSESetup holding a password in its
+    /// bytes 0..40: its answers, or why it refuses.
+    fn get_over_password(hiidb: &[u8], reach: VariableReach) -> Result<Vec<String>, String> {
+        let interface = match reach {
+            VariableReach::Runtime => VariableInterface::Efivarfs,
+            VariableReach::BootServices => VariableInterface::VariableServices,
+        };
+        let variables = MemoryVariables::new(reach, interface);
+        variables.insert(
+            amitse_setup(),
+            NV_BS_RT,
+            &[plaintext_password().as_slice(), &[0xAA; 40], &[1]].concat(),
+        );
+        HiiBackend::get_in(
             hiidb,
-            "S",
-            value,
+            "N0",
+            None,
+            &GetOptions::default(),
+            shared(&Rc::new(variables)),
+            None,
             None,
-            &SetOptions::default(),
-            shared(&variables),
-            &*variables,
             None,
         )
-        .map(drop)
-        .map_err(|error| format!("{error:#}"));
-        (got, variables.writes_to(&setup()))
+        .map(|got| {
+            got.responses
+                .iter()
+                .map(|response| response.question.answer.clone())
+                .collect()
+        })
+        .map_err(|error| error.to_string())
     }
 
-    /// set refuses, before any write, MaxSize characters, which leave no CHAR16 for the NULL
-    /// (UEFI 2.11 §33.2.5.4.9), fewer than MinSize, as edk2-stable202608
-    /// DisplayEngineDxe/InputHandler.c:209 does, a character that UCS-2 has none for, one of the
-    /// Private Use Area (UEFI 2.11 §33.2.6.2.1), a line break without EFI_IFR_STRING_MULTI_LINE, a
-    /// NULL, which ends a STRING, and items.
+    /// Through variables of either reach, a NUMERIC over a password whose VarStore a SUPPRESS_IF
+    /// of its FormSet declares shows none of its bytes: get answers that they hold a password.
     #[test]
-    fn set_refuses_a_string_that_its_sizes_or_ucs_2_cannot_hold() {
-        let hiidb = string_list([0x74; 16], (2, 4), &[]);
-        let refusal = |reason: &str| Err(format!("cannot set question \"S\": {reason}"));
-        let line_break = "the STRING is single-line (no EFI_IFR_STRING_MULTI_LINE, UEFI 2.11 \
-                          §33.3.8.3.70), so it takes no line break";
+    fn a_password_on_a_var_store_under_a_suppress_if_withholds_its_bytes() {
+        let hiidb = password_after_hiidb(&[conditional(
+            SUPPRESS_IF,
+            ifr_true(),
+            &[var_store(2, [0x44; 16], "AMITSESetup", 81)],
+        )]);
+        for reach in [VariableReach::Runtime, VariableReach::BootServices] {
+            assert_eq!(
+                get_over_password(&hiidb, reach),
+                Ok(vec![PASSWORD_BYTES.to_string()]),
+                "{reach:?}"
+            );
+        }
+    }
+
+    /// A VarStore of a PASSWORD's VarStoreId whose EFI variable is unknown never drops the known
+    /// VarStore of the id beside it: through Runtime, a NUMERIC over the password shows none of
+    /// its bytes; through BootServices, get refuses the HiiDB as the password is unresolved. A
+    /// VARSTORE_NAME_VALUE of the id in the PASSWORD's FormSet, whose driver may keep the password
+    /// in any variable, has get refuse the HiiDB through Runtime too.
+    #[test]
+    fn a_store_of_an_unknown_variable_keeps_a_password_withheld_through_runtime() {
+        let amitse = || var_store(2, [0x44; 16], "AMITSESetup", 81);
+        let withheld = Ok(vec![PASSWORD_BYTES.to_string()]);
         let cases = [
             (
-                SetValue::Text("ABCD".to_owned()),
-                refusal(
-                    "the STRING takes at most 3 characters, its last CHAR16 of MaxSize 4 holding \
-                     the NULL (UEFI 2.11 §33.2.5.4.9), not 4",
-                ),
-            ),
-            (
-                SetValue::Text("A".to_owned()),
-                refusal("the STRING takes at least 2 characters (MinSize), not 1"),
-            ),
-            (
-                SetValue::Text("A\u{1F600}".to_owned()),
-                refusal(
-                    "'\u{1F600}' (U+1F600) has no UCS-2 character, which the STRING stores \
-                     (UEFI 2.11 §33.2.6.2.2)",
-                ),
-            ),
-            (
-                SetValue::Text("A\u{E000}".to_owned()),
-                refusal(
-                    "'\\u{e000}' (U+E000) lies in the Private Use Area, U+E000..U+F8FF, which \
-                     UEFI 2.11 §33.2.6.2.1 prohibits",
-                ),
+                "a VarStore op that does not decode, in an unknown op",
+                vec![
+                    nested(
+                        &operation(0x70, true, &[]),
+                        1,
+                        &[operation(VAR_STORE, false, &[0x00; 3])],
+                    ),
+                    amitse(),
+                ],
+                withheld.clone(),
             ),
             (
-                SetValue::Text("\u{F6FF}B".to_owned()),
-                refusal(
-                    "'\\u{f6ff}' (U+F6FF) lies in the Private Use Area, U+E000..U+F8FF, which \
-                     UEFI 2.11 §33.2.6.2.1 prohibits",
-                ),
+                "a VARSTORE_NAME_VALUE in a form",
+                vec![amitse(), form(7, &[var_store_name_value(2, [0x66; 16])])],
+                Err(ANY_VARIABLE),
             ),
-            (SetValue::Text("A\nB".to_owned()), refusal(line_break)),
-            (SetValue::Text("A\rB".to_owned()), refusal(line_break)),
             (
-                SetValue::Text("A\0B".to_owned()),
-                refusal(
-                    "a NULL character ends a STRING, which takes none within (UEFI 2.11 \
-                     §33.2.5.4.9)",
-                ),
+                "a VARSTORE_NAME_VALUE under DISABLE_IF TRUE",
+                vec![
+                    conditional(
+                        DISABLE_IF,
+                        ifr_true(),
+                        &[var_store_name_value(2, [0x66; 16])],
+                    ),
+                    conditional(DISABLE_IF, ifr_false(), &[amitse()]),
+                ],
+                Err(ANY_VARIABLE),
             ),
             (
-                SetValue::Items(vec!["AB".to_owned()]),
-                refusal("--item gives the options of an ORDERED_LIST; this question takes VALUE"),
+                "a short VARSTORE_EFI under DISABLE_IF TRUE",
+                vec![
+                    conditional(DISABLE_IF, ifr_true(), &[short_var_store_efi(2)]),
+                    conditional(DISABLE_IF, ifr_false(), &[amitse()]),
+                ],
+                withheld,
             ),
         ];
-        for (value, want) in cases {
-            assert_eq!(
-                string_set(&hiidb, &value, &[0; 8]),
-                (want, Vec::new()),
-                "set {value:?}"
+        for (case, declarations, runtime) in cases {
+            let hiidb = password_after_hiidb(&declarations);
+            let got = get_over_password(&hiidb, VariableReach::Runtime);
+            match &runtime {
+                Ok(want) => assert_eq!(got.as_ref(), Ok(want), "{case}: Runtime"),
+                Err(suffix) => assert!(
+                    got.as_ref().is_err_and(|error| error.ends_with(suffix)),
+                    "{case}: Runtime: {got:?}"
+                ),
+            }
+            let refusal = get_over_password(&hiidb, VariableReach::BootServices);
+            assert!(
+                matches!(&refusal, Err(reason) if reason.contains(
+                    "the UEFI Shell build reads and writes no variable of this HiiDB"
+                )),
+                "{case}: BootServices: {refusal:?}"
             );
         }
     }
 
-    /// set refuses, before any write, every VALUE of a STRING of MaxSize 0, which has no CHAR16
-    /// for the NULL, and of one whose MinSize is above MaxSize − 1, naming both bounds.
-    #[test]
-    fn set_refuses_every_value_of_a_string_without_a_length() {
-        let refusal = |reason: &str| Err(format!("cannot set question \"S\": {reason}"));
-        let no_null = refusal(
-            "the STRING of MaxSize 0 has no CHAR16 for the NULL that ends it (UEFI 2.11 \
-             §33.2.5.4.9), so it takes no VALUE",
+    /// The end of the refusal through variables that reach BootServices of a HiiDB with a
+    /// PASSWORD whose VarStore is unknown (UnresolvedPasswords).
+    const BOOT_SERVICES_REFUSAL: &str = "; as the variable of that password is unknown, the UEFI \
+                                         Shell build reads and writes no variable of this HiiDB";
+
+    /// Strings 1 C, 2 W, 3 Password, 4 Pin, 5 Flag, 6 B, 7 O and 8 P of the package lists of
+    /// name_value_hiidb.
+    const NAME_VALUE_STRINGS: [&str; 8] = ["C", "W", "Password", "Pin", "Flag", "B", "O", "P"];
+
+    /// The ExportConfig snapshot of name_value_hiidb: Pin 0x7A5B, Flag 1.
+    fn name_value_snapshot() -> String {
+        format!("{}&Pin=7a5b&Flag=01", config_hdr(N_GUID, "", &DRIVER_PATH))
+    }
+
+    /// A HiiDB of two package lists of the driver at DRIVER_PATH, with NAME_VALUE_STRINGS: the
+    /// first of the IFR `ifr`, the second with the UINT16 NUMERIC O at byte 0 of the buffer
+    /// VarStore Other, VarStoreId 2.
+    fn name_value_hiidb(ifr: &[Vec<u8>]) -> Vec<u8> {
+        name_value_hiidb_of_packages(&[ifr.concat()])
+    }
+
+    /// name_value_hiidb with a form package in the first list for each IFR of `packages`.
+    fn name_value_hiidb_of_packages(packages: &[Vec<u8>]) -> Vec<u8> {
+        let list = |guid: [u8; 16], forms: &[Vec<u8>]| {
+            let packages = [
+                vec![device_path_package(&DRIVER_PATH)],
+                forms.iter().map(|ifr| form_package_of(ifr)).collect(),
+                vec![
+                    en_strings_package_of(&NAME_VALUE_STRINGS),
+                    END_PACKAGE.to_vec(),
+                ],
+            ];
+            package_list_with_guid(guid, &packages.concat().concat())
+        };
+        let other = form_set_with_guid(
+            OTHER_GUID,
+            &[
+                var_store(2, OTHER_GUID, "Other", 2),
+                form(1, &[uint16_numeric(1, 7, 2, 0)]),
+            ],
         );
-        let no_length = refusal(
-            "the STRING takes at least 4 characters (MinSize) and at most 3, its last CHAR16 of \
-             MaxSize 4 holding the NULL (UEFI 2.11 §33.2.5.4.9), so it takes no VALUE",
+        [list([0x55; 16], packages), list([0x56; 16], &[other])].concat()
+    }
+
+    /// Variables of `reach` with Backing of name_value_hiidb, B 0x7A5B at bytes 0..2 and 0x2211
+    /// at bytes 4..6, and Other, O 0x1122.
+    fn name_value_variables(reach: VariableReach) -> Rc<MemoryVariables> {
+        let interface = match reach {
+            VariableReach::BootServices => VariableInterface::VariableServices,
+            VariableReach::Runtime => VariableInterface::Efivarfs,
+        };
+        let variables = MemoryVariables::new(reach, interface);
+        let key = |name: &str, guid| VariableKey {
+            name: name.to_owned(),
+            guid: Guid::from(guid),
+        };
+        variables.insert(
+            key("Backing", P_GUID),
+            NV_BS_RT,
+            &[0x5B, 0x7A, 0, 0, 0x11, 0x22, 0, 0],
         );
-        let cases = [
-            ("MaxSize 0", (0, 0), 2, "", no_null.clone()),
-            ("MaxSize 0", (0, 0), 2, "A", no_null),
-            ("MinSize 4 MaxSize 4", (4, 4), 8, "ABC", no_length.clone()),
-            ("MinSize 4 MaxSize 4", (4, 4), 8, "ABCD", no_length),
-        ];
-        for (case, sizes, var_size, text, want) in cases {
-            let hiidb = string_list_of([0x78; 16], (sizes, 0x00), &[], var_size, &["S"]);
-            let value = SetValue::Text(text.to_owned());
+        variables.insert(key("Other", OTHER_GUID), NV_BS_RT, &[0x22, 0x11]);
+        Rc::new(variables)
+    }
 
-            assert_eq!(
-                string_set(&hiidb, &value, &vec![0x41; usize::from(var_size)]),
-                (want, Vec::new()),
-                "{case}: set {text:?}"
-            );
-        }
+    /// get of `question` in `hiidb` through `variables`, with the ExportConfig snapshot `exported`
+    /// if any: the answers, or the error.
+    fn name_value_get(
+        hiidb: &[u8],
+        question: &str,
+        variables: &Rc<MemoryVariables>,
+        exported: Option<&str>,
+    ) -> Result<Vec<String>, String> {
+        HiiBackend::get_in(
+            hiidb,
+            question,
+            None,
+            &GetOptions::default(),
+            shared(variables),
+            exported.map(|text| ExportedConfig::new(text.to_owned())),
+            None,
+            None,
+        )
+        .map(|response| {
+            response
+                .responses
+                .into_iter()
+                .map(|response| response.question.answer)
+                .collect()
+        })
+        .map_err(|error| format!("{error:#}"))
     }
 
-    /// set writes line breaks into a STRING with EFI_IFR_STRING_MULTI_LINE (UEFI 2.11
-    /// §33.3.8.3.70) in its Flags, and refuses them before any write into one without.
-    #[test]
-    fn set_writes_line_breaks_with_multi_line_alone() {
-        let text = SetValue::Text("A\r\nB".to_owned());
-        let multi_line = string_list_of([0x79; 16], ((0, 8), 0x01), &[], 16, &["S"]);
-        let single_line = string_list_of([0x7A; 16], ((0, 8), 0xFE), &[], 16, &["S"]);
-        let written = [0x41, 0, 0x0D, 0, 0x0A, 0, 0x42, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+    /// The IFR of the questions and stores of name_value_hiidb's first list: the CHECKBOX C on
+    /// the label Flag and the UINT16 NUMERIC W on the label Pin of the VARSTORE_NAME_VALUE of
+    /// VarStoreId 3, the UINT16 NUMERIC B at byte 0 and P at byte 4 of the buffer VarStore
+    /// Backing, VarStoreId 1, and the PASSWORD on Pin.
+    struct NameValueIfr;
 
-        assert_eq!(
-            string_set(&multi_line, &text, &[0; 16]),
-            (Ok(()), vec![(0, written.to_vec())]),
-            "Flags 0x01"
-        );
-        assert_eq!(
-            string_set(&single_line, &text, &[0; 16]),
-            (
-                Err("cannot set question \"S\": the STRING is single-line (no \
-                     EFI_IFR_STRING_MULTI_LINE, UEFI 2.11 §33.3.8.3.70), so it takes no line \
-                     break"
-                    .to_owned()),
-                Vec::new()
-            ),
-            "Flags 0xFE"
-        );
-    }
+    impl NameValueIfr {
+        fn c() -> Vec<u8> {
+            checkbox_at(1, 1, 3, 5)
+        }
 
-    /// set refuses a STRING with a WRITE expression, which takes its characters, before any write,
-    /// and get shows why one with a READ expression has no value: uefisettings evaluates neither.
-    #[test]
-    fn strings_with_read_or_write_expressions_take_no_value() {
-        const WRITE: u8 = 0x2E;
-        let expression =
-            |op_code| [operation(op_code, true, &[]), ifr_true(), END.to_vec()].concat();
-        let write = string_list([0x7B; 16], (0, 4), &[expression(WRITE)]);
-        let read = string_list([0x7C; 16], (0, 4), &[expression(READ)]);
+        fn w() -> Vec<u8> {
+            uint16_numeric(2, 2, 3, 4)
+        }
 
-        assert_eq!(
-            string_set(&write, &SetValue::Text("AB".to_owned()), &[0; 8]),
-            (
-                Err(
-                    "cannot set question \"S\": its WRITE expression takes the CHAR16s of a \
-                     STRING, which uefisettings does not evaluate"
-                        .to_owned()
-                ),
-                Vec::new()
-            ),
-            "set with a WRITE expression"
-        );
-        assert_eq!(
-            answers_of(&read, "S", &setup_holding(&[0x41, 0, 0, 0, 0, 0, 0, 0])),
-            [
-                "<ValueUnavailable: its READ expression gives the CHAR16s of a STRING, which \
-              uefisettings does not evaluate>"
-            ],
-            "get with a READ expression"
-        );
-    }
+        fn b() -> Vec<u8> {
+            uint16_numeric(6, 6, 1, 0)
+        }
 
-    /// A STRING whose EFI_IFR_DEFAULT, or flagged option, is of a numeric Type shows that default
-    /// as unknown, naming the Type mismatch, and takes no string of that number for its id.
-    #[test]
-    fn strings_show_a_numeric_default_as_unknown() {
-        let unknown = " <IFR default: unknown (a default of a number where the question stores a \
-                       string)>";
-        for (case, child) in [
-            ("UINT8 EFI_IFR_DEFAULT", ifr_default(0, 2)),
-            ("flagged UINT8 option", flagged_option(2, 0x10, 2)),
-        ] {
-            let hiidb = string_list_of([0x60; 16], ((0, 8), 0x00), &[child], 16, &["S", "Hello"]);
-            let variables =
-                MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
+        fn p() -> Vec<u8> {
+            uint16_numeric(8, 8, 1, 4)
+        }
 
-            assert_eq!(
-                answers_of(&hiidb, "S", &Rc::new(variables)),
-                [format!("{MISSING_SETUP}{unknown}")],
-                "{case}"
-            );
+        fn backing() -> Vec<u8> {
+            var_store(1, P_GUID, "Backing", 8)
         }
-    }
 
-    /// A STRING without a VarStore is listed with why it has no value, and set refuses it before
-    /// any write.
-    #[test]
-    fn storageless_strings_are_listed_and_refused() {
-        let reason = "question has no VarStore, READ or WRITE expression, or \
-                      EFI_IFR_FLAG_CALLBACK, one of which UEFI 2.11 §33.2.5.6 requires";
-        let string = flagged_string_on(1, 1, (0, 0), (0, 4), (0x00, 0x00), &[]);
-        let packages = [
-            form_package(&[var_store_efi(1, "Setup", NV_BS_RT, 8), form(1, &[string])]),
-            en_strings_package_of(&["S"]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x61; 16], &packages.concat());
-        let variables = setup_holding(&[0; 8]);
-        let (listed, _) = listed_and_shown(&hiidb, &[0; 8], None);
-        let listed: Vec<(&str, &str)> = listed
-            .iter()
-            .map(|question| (&*question.name, &*question.answer))
-            .collect();
+        fn name_value() -> Vec<u8> {
+            var_store_name_value(3, N_GUID)
+        }
 
-        assert_eq!(
-            listed,
-            [("S", &*format!("<ValueUnavailable: {reason}>"))],
-            "list-questions"
-        );
-        assert_eq!(
-            set_of(&hiidb, "S", "AB", &variables),
-            Err(format!("cannot set question \"S\": {reason}")),
-            "set AB"
-        );
-        assert_eq!(
-            variables.writes_to(&setup()),
-            Vec::<(u16, Vec<u8>)>::new(),
-            "set AB: writes"
-        );
-    }
+        /// The PASSWORD on Pin, VarStoreId `var_store_id`.
+        fn password(var_store_id: u16) -> Vec<u8> {
+            password_on(3, 3, var_store_id, 4)
+        }
 
-    /// A HiiDB whose form holds the STRING "S" of MaxSize 4 at byte 0 of the EFI variable Setup,
-    /// of the question Flags `flags`, and password_hiidb's PASSWORD on the buffer VarStore
-    /// AMITSESetup.
-    fn string_and_password_list(flags: u8) -> Vec<u8> {
-        let packages = [
-            form_package(&[
-                var_store_efi(1, "Setup", NV_BS_RT, 8),
-                var_store(2, [0x44; 16], "AMITSESetup", 81),
-                form(
-                    1,
-                    &[
-                        flagged_string_on(1, 1, (1, 0), (0, 4), (flags, 0x00), &[]),
-                        password_on(3, 3, 2, 0),
-                    ],
-                ),
-            ]),
-            en_strings_package_of(&["S", "Hello", "Password"]),
-            END_PACKAGE.to_vec(),
-        ];
-        package_list_with_guid([0x7D; 16], &packages.concat())
+        /// A VARSTORE_NAME_VALUE op that ends after its VarStoreId 3, before its Guid.
+        fn short_name_value() -> Vec<u8> {
+            operation(VAR_STORE_NAME_VALUE, false, &3u16.to_le_bytes())
+        }
     }
 
-    /// set of a STRING takes UnsafeOperations as the other kinds do. One that
-    /// EFI_IFR_FLAG_READ_ONLY makes read-only it refuses before any write, and writes with
-    /// UnsafeOperations::Allow, which it returns as lifted. Through variables that reach
-    /// BootServices, in a HiiDB that declares a password question, it refuses unless Allow, and
-    /// then returns UnsafeOperation::SetupPassword, lifted before the read-only flag. A VALUE that
-    /// the STRING cannot hold it refuses before either, with and without Allow.
+    /// A PASSWORD that edk2 may route to a VARSTORE_NAME_VALUE, whose values its driver exposes,
+    /// as UEFI 2.11 §33.2.5.6 says, through EFI_HII_CONFIG_ACCESS_PROTOCOL, in storage of its own
+    /// choosing, may keep its password in any variable, also one that another package list
+    /// declares, as one driver may publish several (edk2-stable202608 DriverSample.c installs one
+    /// EFI_HII_CONFIG_ACCESS_PROTOCOL for two package lists, :1870-1918). So
+    /// through variables that read anything, get, set and the snapshot refuse the whole HiiDB, as
+    /// for IFR without an op boundary, set writing nothing, also with UnsafeOperations::Allow,
+    /// whose flag lifts no withholding and which the refusal does not name; list-questions reads
+    /// without efivars; through BootServices the HiiDB is refused as before. Each layout names the
+    /// record that the refusal holds. edk2 routes the PASSWORD there by a VARSTORE_NAME_VALUE of
+    /// its VarStoreId in its FormSet, before or after it, under a condition, beside it in a
+    /// disabled form, also after a VarStore of its id outside any FormSet, and for one whose
+    /// question header lies past its op; by the first VarStore of its id in its form package, in
+    /// another FormSet, outside any FormSet, before or after every FormSet, or in an unknown scope,
+    /// also for a PASSWORD outside any FormSet, in IFR that uefisettings ignores, or whose question
+    /// header lies past its op; for one without a header, by one of any id in its FormSet or the
+    /// first of any id in its form package, in a FormSet or outside any; and by one that does not
+    /// decode, as edk2 creates its storage whatever its Length
+    /// (SetupBrowserDxe/IfrParse.c:1885-1895, ConfigKeywordHandler.c:1547-1550): in an unknown op
+    /// of its FormSet, outside any FormSet, or in IFR that uefisettings ignores.
     #[test]
-    fn string_set_follows_the_unsafe_operations_grant() {
-        let read_only = UnsafeOperation::ReadOnlyQuestion {
-            question: "S".to_owned(),
-            writable: IncludedStates::empty(),
+    fn passwords_that_edk2_may_route_to_a_name_value_store_close_every_variable() {
+        type I = NameValueIfr;
+        // a CHECKBOX op ending after 4 of the 12 bytes of its data, which disables its form
+        let disabler = || operation(CHECKBOX, false, &[0x00; 4]);
+        // a PASSWORD op of Prompt 3 and Help 4 whose question header runs on into the SUBTITLE
+        // after it, VarStoreId 3 and VarStoreInfo 4 (QuestionId 0x0702: the SUBTITLE's header)
+        let header_past_op = || {
+            [
+                operation(PASSWORD, false, &[3, 0, 4, 0]),
+                operation(SUBTITLE, false, &[3, 0, 4, 0, 0]),
+            ]
+            .concat()
         };
-        let password = "this HiiDB declares a setup password question, and the UEFI Shell runs no \
-                        setup browser, so no password is asked or checked; pass \
-                        --i-am-fine-to-brick-this-system to write without it"
-            .to_owned();
-        let too_long = "cannot set question \"S\": the STRING takes at most 3 characters, its \
-                        last CHAR16 of MaxSize 4 holding the NULL (UEFI 2.11 §33.2.5.4.9), not 4"
-            .to_owned();
-        let runtime = (VariableReach::Runtime, VariableInterface::Efivarfs);
-        let boot_services = (
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        // (variables, question Flags, VALUE, what set gives with UnsafeOperations::Refuse, Allow)
+        let in_its_form_set = "PASSWORD question 0x0003 in FormSet \
+            11111111-1111-1111-1111-111111111111: HII name/value varstore requires \
+            EFI_HII_CONFIG_ACCESS_PROTOCOL";
         let cases = [
             (
-                runtime,
-                0x01,
-                "AB",
-                [
-                    flag_refusal("S", "").map(|()| vec![]),
-                    Ok(vec![read_only.clone()]),
+                "in its FormSet, before it",
+                vec![form_set(&[
+                    I::name_value(),
+                    I::backing(),
+                    form(1, &[I::c(), I::w(), I::b(), I::password(3)]),
+                ])],
+                in_its_form_set,
+            ),
+            (
+                "in its FormSet, after a VARSTORE of its id outside any FormSet",
+                vec![
+                    var_store(3, P_GUID, "Backing", 8),
+                    form_set(&[
+                        I::name_value(),
+                        I::backing(),
+                        form(1, &[I::c(), I::w(), I::b(), I::password(3)]),
+                    ]),
+                ],
+                in_its_form_set,
+            ),
+            (
+                "in its FormSet, after it",
+                vec![form_set(&[
+                    I::backing(),
+                    form(1, &[I::b(), I::password(3)]),
+                    I::name_value(),
+                    form(2, &[I::c(), I::w()]),
+                ])],
+                in_its_form_set,
+            ),
+            (
+                "under a SUPPRESS_IF of its FormSet",
+                vec![form_set(&[
+                    I::backing(),
+                    form(1, &[I::b(), I::password(3)]),
+                    conditional(SUPPRESS_IF, ifr_true(), &[I::name_value()]),
+                ])],
+                in_its_form_set,
+            ),
+            (
+                "beside it in a disabled form",
+                vec![form_set(&[
+                    I::name_value(),
+                    I::backing(),
+                    form(1, &[I::c(), I::w(), I::b()]),
+                    form(2, &[I::password(3), disabler()]),
+                ])],
+                in_its_form_set,
+            ),
+            (
+                "beside its form under a SUPPRESS_IF of its FormSet",
+                vec![form_set(&[
+                    I::name_value(),
+                    I::backing(),
+                    form(1, &[I::c(), I::w(), I::b()]),
+                    conditional(SUPPRESS_IF, ifr_true(), &[form(2, &[I::password(3)])]),
+                ])],
+                in_its_form_set,
+            ),
+            (
+                "the first VarStore of its id in its form package, in another FormSet",
+                vec![
+                    form_set_with_guid(
+                        [0x12; 16],
+                        &[
+                            I::name_value(),
+                            I::backing(),
+                            form(1, &[I::c(), I::w(), I::b()]),
+                        ],
+                    ),
+                    form_set(&[
+                        var_store(3, P_GUID, "Backing", 8),
+                        form(2, &[I::password(3)]),
+                    ]),
                 ],
+                "the first VarStore of its VarStoreId in its form package, which edk2's Config \
+                 Keyword Handler takes, is a VARSTORE_NAME_VALUE",
             ),
             (
-                runtime,
-                0x01,
-                "ABCD",
-                [Err(too_long.clone()), Err(too_long.clone())],
+                "outside any FormSet",
+                vec![
+                    I::name_value(),
+                    form_set(&[
+                        I::backing(),
+                        var_store(3, P_GUID, "Backing", 8),
+                        form(1, &[I::b(), I::password(3)]),
+                    ]),
+                ],
+                "a VARSTORE_NAME_VALUE outside a FormSet, at offset 0 of a form package, \
+                 declares its VarStoreId",
             ),
             (
-                boot_services,
-                0x00,
-                "AB",
-                [
-                    Err(password.clone()),
-                    Ok(vec![UnsafeOperation::SetupPassword]),
+                "in an unknown scope of another FormSet",
+                vec![
+                    form_set_with_guid(
+                        [0x12; 16],
+                        &[in_unknown_scope(&I::name_value()), form(1, &[])],
+                    ),
+                    form_set(&[
+                        I::backing(),
+                        var_store(3, P_GUID, "Backing", 8),
+                        form(1, &[I::b(), I::password(3)]),
+                    ]),
                 ],
+                "a VARSTORE_NAME_VALUE in the scope of an unknown opcode",
             ),
             (
-                boot_services,
-                0x01,
-                "AB",
-                [
-                    Err(password),
-                    Ok(vec![UnsafeOperation::SetupPassword, read_only]),
+                "an undecodable one in an unknown op of its FormSet, beside a PASSWORD on Backing",
+                vec![form_set(&[
+                    nested(&operation(0x70, true, &[]), 1, &[I::short_name_value()]),
+                    I::backing(),
+                    form(1, &[I::b(), I::password(1)]),
+                ])],
+                "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: \
+                 failed to parse VarStoreNameValue's data",
+            ),
+            (
+                "of its id, the PASSWORD outside any FormSet",
+                vec![
+                    I::password(3),
+                    form_set(&[
+                        I::name_value(),
+                        I::backing(),
+                        form(1, &[I::c(), I::w(), I::b()]),
+                    ]),
                 ],
+                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
+                 FormSet, at offset 0 of a form package",
             ),
             (
-                boot_services,
-                0x00,
-                "ABCD",
-                [Err(too_long.clone()), Err(too_long)],
+                "of its id outside any FormSet, the PASSWORD outside any FormSet too",
+                vec![
+                    I::name_value(),
+                    I::password(3),
+                    form_set(&[I::backing(), form(1, &[I::b(), I::p()])]),
+                ],
+                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
+                 FormSet, at offset 20 of a form package",
+            ),
+            (
+                "of its id after every FormSet, the PASSWORD outside any FormSet",
+                vec![
+                    form_set(&[I::backing(), form(1, &[I::b(), I::p()])]),
+                    I::password(3),
+                    I::name_value(),
+                ],
+                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
+                 FormSet, at offset ",
+            ),
+            (
+                "of its id, the PASSWORD's question header past its op",
+                vec![form_set(&[
+                    I::name_value(),
+                    I::backing(),
+                    form(1, &[I::c(), I::w(), I::b()]),
+                    form(2, &[header_past_op()]),
+                ])],
+                "PASSWORD question 0x0702 in FormSet 11111111-1111-1111-1111-111111111111: its \
+                 op ends before its question header",
+            ),
+            (
+                "of its id in its FormSet, after a VARSTORE of its id outside any FormSet, the \
+                 PASSWORD's question header past its op",
+                vec![
+                    var_store(3, P_GUID, "Backing", 8),
+                    form_set(&[
+                        I::name_value(),
+                        I::backing(),
+                        form(1, &[I::c(), I::w(), I::b()]),
+                        form(2, &[header_past_op()]),
+                    ]),
+                ],
+                "PASSWORD question 0x0702 in FormSet 11111111-1111-1111-1111-111111111111: its \
+                 op ends before its question header",
+            ),
+            (
+                "beside a PASSWORD without its question header",
+                vec![form_set(&[
+                    I::name_value(),
+                    I::backing(),
+                    form(1, &[I::c(), I::w(), I::b()]),
+                    form(2, &[operation(PASSWORD, false, &[3, 0, 4, 0])]),
+                ])],
+                "PASSWORD op without a question header in FormSet \
+                 11111111-1111-1111-1111-111111111111",
+            ),
+            (
+                "beside a PASSWORD without its question header, after a VARSTORE of its id \
+                 outside any FormSet",
+                vec![
+                    var_store(3, P_GUID, "Backing", 8),
+                    form_set(&[
+                        I::name_value(),
+                        I::backing(),
+                        form(1, &[I::c(), I::w(), I::b()]),
+                        form(2, &[operation(PASSWORD, false, &[3, 0, 4, 0])]),
+                    ]),
+                ],
+                "PASSWORD op without a question header in FormSet \
+                 11111111-1111-1111-1111-111111111111",
+            ),
+            (
+                "beside a PASSWORD outside any FormSet without its question header",
+                vec![
+                    form_set(&[I::name_value(), I::backing(), form(1, &[I::b(), I::p()])]),
+                    operation(PASSWORD, false, &[3, 0, 4, 0]),
+                ],
+                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
+                 FormSet, at offset ",
+            ),
+            (
+                "an undecodable one outside any FormSet, beside a PASSWORD on Backing",
+                vec![
+                    I::short_name_value(),
+                    form_set(&[I::backing(), form(1, &[I::b(), I::password(1)])]),
+                ],
+                "may name the VarStoreId of the op at offset 0 of a form package, a malformed \
+                 EFI_IFR_VARSTORE_NAME_VALUE outside a FormSet",
+            ),
+            (
+                "an undecodable one in a FormSet that uefisettings ignores",
+                vec![
+                    form_set(&[I::backing(), form(1, &[I::b()])]),
+                    form_set_with_guid(
+                        [0x12; 16],
+                        &[I::short_name_value(), form(2, &[I::password(3)])],
+                    ),
+                ],
+                "the EFI_IFR_VARSTORE_NAME_VALUE op at offset",
+            ),
+            (
+                "of its id, the PASSWORD in a FormSet that uefisettings ignores",
+                vec![
+                    form_set(&[
+                        I::name_value(),
+                        I::backing(),
+                        form(1, &[I::c(), I::w(), I::b()]),
+                    ]),
+                    form_set_with_guid(
+                        [0x12; 16],
+                        &[
+                            operation(DEFAULT_STORE, false, &[0x00, 0x00]),
+                            form(2, &[I::password(3)]),
+                        ],
+                    ),
+                ],
+                "the PASSWORD op there, which edk2 may route to a VARSTORE_NAME_VALUE of its \
+                 form package",
             ),
         ];
-        for ((reach, interface), flags, text, wants) in cases {
-            let grants = [UnsafeOperations::Refuse, UnsafeOperations::Allow];
-            for (grant, want) in grants.into_iter().zip(wants) {
-                let variables = password_variables(reach, interface);
-                variables.insert(setup(), NV_BS_RT, &[0; 8]);
-                let want_writes = match want {
-                    Ok(_) => vec![(0, vec![0x41, 0, 0x42, 0, 0, 0, 0, 0])],
-                    Err(_) => vec![],
-                };
-
-                let got = HiiBackend::set_in(
-                    &string_and_password_list(flags),
-                    "S",
-                    &SetValue::Text(text.to_owned()),
-                    None,
-                    &SetOptions {
-                        unsafe_operations: grant,
-                        ..SetOptions::default()
-                    },
-                    shared(&variables),
-                    &*variables,
-                    None,
-                )
-                .map(|(_, lifted)| lifted)
-                .map_err(|error| format!("{error:#}"));
-
-                let case =
-                    format!("{reach:?}, question Flags {flags:#04x}, set S {text}, {grant:?}");
-                assert_eq!(got, want, "{case}");
-                assert_eq!(variables.writes_to(&setup()), want_writes, "{case}: writes");
-            }
-        }
-    }
-
-    /// A STRING over the bytes of a PASSWORD keeps them withheld, as a NUMERIC does: get answers
-    /// that its bytes hold a password and set writes nothing, while a STRING after them is read
-    /// and written; the PASSWORD, whose characters a STRING would show, stays no question that
-    /// get selects.
-    #[test]
-    fn strings_keep_the_bytes_of_a_password_withheld() {
-        let packages = [
-            form_package_of(&form_set(&[
-                var_store(2, [0x44; 16], "AMITSESetup", 81),
-                form(
-                    1,
-                    &[
-                        password_on(3, 3, 2, 0),
-                        string_on(4, 4, (2, 10), (0, 4), &[]),
-                        string_on(5, 5, (2, 40), (0, 4), &[]),
-                    ],
-                ),
-            ])),
-            en_strings_package_of(&["Q", "P", "Password", "Over", "After"]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let after: Vec<u8> = [0x41, 0, 0x42, 0, 0, 0, 0, 0].into();
-        let stored = [plaintext_password().as_slice(), &after, &[0; 33]].concat();
-        let variables = MemoryVariables::new(VariableReach::Runtime, VariableInterface::Efivarfs);
-        variables.insert(amitse_setup(), NV_BS_RT, &stored);
-        let variables = Rc::new(variables);
-
-        assert_eq!(
-            answers_of(&hiidb, "Over", &variables),
-            [PASSWORD_BYTES],
-            "get Over"
-        );
-        assert_eq!(answers_of(&hiidb, "After", &variables), ["AB"], "get After");
-        assert_eq!(
-            answers_of(&hiidb, "Password", &variables),
-            Vec::<String>::new(),
-            "get Password"
-        );
-        let set = set_bypassing(&hiidb, "Over", "ab", &variables);
-        assert!(
-            set.as_ref()
-                .is_err_and(|error| error
-                    .contains("holds a password at bytes 0..40, which set never writes")),
-            "set Over: {set:?}"
-        );
-        assert_eq!(variables.writes_to(&amitse_setup()), [], "set Over: writes");
-        assert_eq!(
-            set_bypassing(&hiidb, "After", "Z", &variables),
-            Ok(()),
-            "set After"
-        );
-        assert_eq!(
-            variables.writes_to(&amitse_setup()),
-            [(40, vec![0x5A, 0, 0, 0, 0, 0, 0, 0])],
-            "set After: writes"
-        );
+        for (case, ifr, record) in cases {
+            assert_closes_every_variable(case, &ifr, record);
+        }
     }
 
-    /// list-questions and show-ifr withhold the bytes of a PASSWORD under a STRING, and show no
-    /// character of the password, while they show a STRING after it.
-    #[test]
-    fn strings_list_and_show_no_password_character() {
-        let packages = [
-            form_package(&[
-                var_store_efi(1, "Setup", NV_BS_RT, 48),
-                form(
-                    1,
-                    &[
-                        password_on(3, 3, 1, 0),
-                        string_on(4, 4, (1, 2), (0, 4), &[]),
-                        string_on(5, 5, (1, 40), (0, 4), &[]),
-                    ],
-                ),
-            ]),
-            en_strings_package_of(&["Q", "P", "Password", "Over", "After"]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x7D; 16], &packages.concat());
-        let stored = [
-            plaintext_password().as_slice(),
-            &[0x41, 0, 0x42, 0, 0, 0, 0, 0],
-        ]
-        .concat();
-
-        let (listed, shown) = listed_and_shown(&hiidb, &stored, None);
+    /// Through Runtime, get of B and O of the name_value_hiidb of `ifr`, from the snapshot too,
+    /// show-ifr, and set of O with UnsafeOperations::Allow refuse the HiiDB with
+    /// AnyVariablePasswords naming `record`, set writing nothing; list-questions reads without
+    /// efivars; through BootServices
+    /// get refuses it as for a PASSWORD whose VarStore is unknown.
+    /// Through Runtime list-questions refuses it too.
+    fn assert_closes_every_variable(case: &str, ifr: &[Vec<u8>], record: &str) {
+        let hiidb = name_value_hiidb(ifr);
+        let runtime = name_value_variables(VariableReach::Runtime);
+        let refused = |error: Option<&String>| {
+            error.is_some_and(|error| error.contains(record) && error.ends_with(ANY_VARIABLE))
+        };
 
-        let listed: Vec<(&str, &str)> = listed
-            .iter()
-            .map(|question| (&*question.name, &*question.answer))
-            .collect();
-        assert_eq!(
-            listed,
-            [("Over", PASSWORD_BYTES), ("After", "AB")],
-            "list-questions"
-        );
-        assert!(
-            shown.contains(&format!("-Answer: {PASSWORD_BYTES}\n")),
-            "show-ifr: {shown}"
-        );
-        assert!(shown.contains("-Answer: AB\n"), "show-ifr: {shown}");
-        for output in [format!("{listed:?}"), shown] {
+        for question in ["B", "O"] {
+            let got = name_value_get(&hiidb, question, &runtime, None);
             assert!(
-                !output.contains("unter"),
-                "a password character in {output}"
+                refused(got.as_ref().err()),
+                "{case}: Runtime: get {question}: {got:?}"
+            );
+            let snapshot = name_value_snapshot();
+            let got = name_value_get(&hiidb, question, &runtime, Some(&snapshot));
+            assert!(
+                refused(got.as_ref().err())
+                    && got.as_ref().is_err_and(|error| !error.contains("31323")),
+                "{case}: Runtime, with the snapshot: get {question}: {got:?}"
             );
         }
-    }
-
-    /// A STRING of a VARSTORE whose bytes the ExportConfig snapshot holds shows " <snapshot>" in
-    /// get, list-questions and show-ifr, and one over a PASSWORD's bytes in the snapshot shows
-    /// none of them, as bytes or as characters, in any text or JSON output.
-    #[test]
-    fn snapshot_strings_show_their_source_and_no_password() {
-        let packages = [
-            device_path_package(&DRIVER_PATH),
-            form_package(&[
-                var_store(1, N_GUID, "NStore", 8),
-                var_store(2, P_GUID, "AMITSESetup", 81),
-                form(
-                    1,
-                    &[
-                        string_on(1, 1, (1, 0), (0, 4), &[]),
-                        password_on(3, 4, 2, 0),
-                        string_on(5, 5, (2, 2), (0, 4), &[]),
-                    ],
-                ),
-            ]),
-            en_strings_package_of(&["S", "W", "P", "Password", "Over"]),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x7E; 16], &packages.concat());
-        let mut amitse_setup = [0; 81];
-        amitse_setup[..40].fill(0xA5);
-        let text = [
-            block_resp(
-                &config_hdr(N_GUID, "NStore", &DRIVER_PATH),
-                0,
-                &[0x41, 0, 0x42, 0, 0, 0, 0, 0],
-            ),
-            block_resp(
-                &config_hdr(P_GUID, "AMITSESetup", &DRIVER_PATH),
-                0,
-                &amitse_setup,
-            ),
-        ]
-        .join("&");
-
-        let (got, listed, shown, outputs) =
-            answers_with_snapshot(&hiidb, &["S", "Over"], &no_variables(), &text);
-
-        assert_eq!(got, ["AB <snapshot>", PASSWORD_BYTES], "get");
-        assert_eq!(listed, got, "list-questions");
+        let set = set_bypassing(&hiidb, "O", "5", &runtime);
         assert!(
-            shown.contains("-Answer: AB <snapshot>\n"),
-            "show-ifr: {shown}"
+            refused(set.as_ref().err())
+                && set
+                    .as_ref()
+                    .is_err_and(|error| !error.contains(UNSAFE_OPERATIONS_FLAG)),
+            "{case}: Runtime, with UnsafeOperations::Allow: set O: {set:?}"
         );
+        let shown = HiiBackend::show_ifr_in(
+            &hiidb,
+            &ShowIfrOptions::default(),
+            shared(&runtime),
+            None,
+            None,
+        )
+        .map(drop)
+        .map_err(|error| format!("{error:#}"));
         assert!(
-            shown.contains(&format!("-Answer: {PASSWORD_BYTES}\n")),
-            "show-ifr: {shown}"
+            refused(shown.as_ref().err()),
+            "{case}: Runtime: show-ifr: {shown:?}"
         );
-        assert_no_password_byte(&outputs);
-        for output in &outputs {
-            assert!(!output.contains('\u{A5A5}'), "U+A5A5 in {output}");
+        let listed_at_runtime = HiiBackend::list_questions_in(
+            &hiidb,
+            &ListQuestionsOptions::default(),
+            shared(&runtime),
+            None,
+            None,
+        )
+        .map(drop)
+        .map_err(|error| format!("{error:#}"));
+        assert!(
+            refused(listed_at_runtime.as_ref().err()),
+            "{case}: Runtime: list-questions: {listed_at_runtime:?}"
+        );
+        for (name, guid) in [("Backing", P_GUID), ("Other", OTHER_GUID)] {
+            let key = VariableKey {
+                name: name.to_owned(),
+                guid: Guid::from(guid),
+            };
+            assert_eq!(runtime.writes_to(&key), [], "{case}: writes to {name}");
         }
-    }
-
-    /// set refuses a STRING and a NUMERIC that one prompt selects in two FormSets before it
-    /// writes either: it gives one value to questions of one kind.
-    #[test]
-    fn set_refuses_a_string_and_a_numeric_of_one_prompt() {
-        let hiidb = [
-            string_list([0x75; 16], (0, 1), &[]),
-            one_form_list([0x76; 16], "S", &[numeric_at(1, 0, 0)]),
-        ]
-        .concat();
-        let variables = setup_holding(&[0; 3]);
-
-        let set = set_of(&hiidb, "S", "1", &variables);
+        let listed = HiiBackend::list_questions_in(
+            &hiidb,
+            &ListQuestionsOptions::default(),
+            EfivarSource::Disabled
+                .into_variables()
+                .expect("variables that read nothing"),
+            None,
+            None,
+        )
+        .map(|questions| {
+            questions
+                .into_iter()
+                .map(|question| question.name)
+                .filter(|name| ["B", "O"].contains(&name.as_str()))
+                .collect::<Vec<_>>()
+        })
+        .map_err(|error| format!("{error:#}"));
+        assert_eq!(
+            listed,
+            Ok(vec!["B".to_owned(), "O".to_owned()]),
+            "{case}: list-questions without efivars"
+        );
+        let boot_services = name_value_variables(VariableReach::BootServices);
+        let got = name_value_get(&hiidb, "O", &boot_services, None);
         assert!(
-            set.as_ref()
-                .is_err_and(|error| error.contains("STRING (in ")
-                    && error.contains("set gives one value to questions of one kind")),
-            "set S: {set:?}"
+            got.as_ref()
+                .is_err_and(|error| error.ends_with(BOOT_SERVICES_REFUSAL)),
+            "{case}: BootServices: get O: {got:?}"
         );
-        assert_eq!(variables.writes_to(&setup()), [], "set S: writes");
     }
 
-    /// Two VARSTORE_EFIs before UEFI 2.3.1 of two Guids each take the VarNames of their questions
-    /// from the strings of the package list: the NUMERIC A, inside a SUPPRESS_IF and a
-    /// GRAY_OUT_IF, reads and sets ShortVarA of the first store's Guid, the CHECKBOX B ShortVarB
-    /// of the second's, and set writes no variable of the other Guid.
+    /// The middle of the record of a PASSWORD of VarStoreId 0 (UnresolvedPassword::OwnDriver).
+    const OWN_DRIVER: &str =
+        "VarStoreId 0 names no VarStore, so its callbacks or READ and WRITE ops \
+         keep its password where uefisettings cannot tell";
+
+    /// A PASSWORD of VarStoreId 0 names no VarStore (UEFI 2.11 §33.3.8.2.2): its callbacks or READ
+    /// and WRITE ops (§33.2.5.6) keep its password where uefisettings cannot tell, so in any
+    /// variable, EFI_IFR_FLAG_CALLBACK or not, with no VARSTORE_NAME_VALUE in the HiiDB. So get,
+    /// set and the snapshot refuse the whole HiiDB as for a PASSWORD that edk2 may route to a
+    /// VARSTORE_NAME_VALUE: one in a form or a disabled form of its FormSet, one without MaxSize,
+    /// outside any FormSet, in a FormSet that uefisettings ignores, one whose question header past
+    /// its op names VarStoreId 0, and one without a question header, whose VarStoreId may be 0,
+    /// also in a FormSet that uefisettings ignores. Each names its record.
     #[test]
-    fn two_short_var_stores_set_the_variables_of_their_own_guids() {
-        let nested_a = conditional(
-            SUPPRESS_IF,
-            ifr_false(),
-            &[conditional(GRAY_OUT_IF, ifr_false(), &[short_numeric_a()])],
-        );
-        let hiidb = short_store_list(
-            &[
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                short_var_store_efi_of(2, OTHER_GUID, NV_BS_RT),
-                form(1, &[nested_a, checkbox_at(2, 2, 2, 8)]),
-            ],
-            &[en_strings_package_of(&SHORT_STRINGS)],
-        );
-        let other = |name: &str| VariableKey {
-            name: name.to_string(),
-            guid: Guid::from(OTHER_GUID),
+    fn passwords_of_var_store_id_0_close_every_variable() {
+        type I = NameValueIfr;
+        let password_of = |flags: u8, sizes: &[u16]| {
+            let sizes = sizes.iter().flat_map(|size| size.to_le_bytes());
+            let data = [question_header_with(3, 3, 0, 0, flags), sizes.collect()].concat();
+            operation(PASSWORD, false, &data)
         };
-        let variables = short_efivarfs_variables();
-        variables.insert(other("ShortVarB"), NV_BS_RT, &[0]);
-
-        assert_eq!(answers_of(&hiidb, "A", &variables), ["5"], "get A");
-        assert_eq!(answers_of(&hiidb, "B", &variables), ["0"], "get B");
-        assert_eq!(set_of(&hiidb, "A", "9", &variables), Ok(()), "set A");
-        assert_eq!(set_of(&hiidb, "B", "1", &variables), Ok(()), "set B");
-        let writes = [
-            (short_key("ShortVarA"), vec![(0, vec![9])]),
-            (other("ShortVarA"), vec![]),
-            (other("ShortVarB"), vec![(0, vec![1])]),
-            (short_key("ShortVarB"), vec![]),
+        // a CHECKBOX op ending after 4 of the 12 bytes of its data, which disables its form
+        let disabler = || operation(CHECKBOX, false, &[0x00; 4]);
+        // a PASSWORD op of Prompt 3 and Help 4 whose question header runs on into the SUBTITLE
+        // after it, VarStoreId 0 and VarStoreInfo 4 (QuestionId 0x0702: the SUBTITLE's header)
+        let header_past_op = [
+            operation(PASSWORD, false, &[3, 0, 4, 0]),
+            operation(SUBTITLE, false, &[0, 0, 4, 0, 0]),
+        ]
+        .concat();
+        let backing_with = |forms: &[Vec<u8>]| {
+            let first = form(1, &[I::b(), I::p()]);
+            form_set(&[[I::backing(), first].as_slice(), forms].concat())
+        };
+        // a FormSet that uefisettings ignores, for its short DEFAULTSTORE op, with `password`
+        let ignored_with = |password: Vec<u8>| {
+            form_set_with_guid(
+                [0x12; 16],
+                &[
+                    operation(DEFAULT_STORE, false, &[0x00, 0x00]),
+                    form(2, &[password]),
+                ],
+            )
+        };
+        let in_its_form_set: &str = &format!(
+            "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: {OWN_DRIVER}"
+        );
+        let outside: &str = &format!("PASSWORD question 0x0003 in FormSet ?: {OWN_DRIVER}");
+        let cases = [
+            (
+                "in its form",
+                vec![form_set(&[
+                    I::backing(),
+                    form(1, &[I::b(), I::p(), I::password(0)]),
+                ])],
+                in_its_form_set,
+            ),
+            (
+                "of EFI_IFR_FLAG_CALLBACK",
+                vec![backing_with(&[form(2, &[password_of(0x04, &[1, 20])])])],
+                in_its_form_set,
+            ),
+            (
+                "without MaxSize",
+                vec![backing_with(&[form(2, &[password_of(0x00, &[1])])])],
+                in_its_form_set,
+            ),
+            (
+                "in a disabled form",
+                vec![backing_with(&[form(2, &[I::password(0), disabler()])])],
+                in_its_form_set,
+            ),
+            (
+                "outside any FormSet",
+                vec![I::password(0), backing_with(&[])],
+                outside,
+            ),
+            (
+                "in a FormSet that uefisettings ignores",
+                vec![backing_with(&[]), ignored_with(I::password(0))],
+                outside,
+            ),
+            (
+                "its question header past its op",
+                vec![backing_with(&[form(2, &[header_past_op])])],
+                "PASSWORD question 0x0702 in FormSet 11111111-1111-1111-1111-111111111111: its \
+                 op ends before its question header",
+            ),
+            (
+                "without its question header",
+                vec![backing_with(&[form(
+                    2,
+                    &[operation(PASSWORD, false, &[3, 0, 4, 0])],
+                )])],
+                "PASSWORD op without a question header in FormSet \
+                 11111111-1111-1111-1111-111111111111",
+            ),
+            (
+                "without its question header, in a FormSet that uefisettings ignores",
+                vec![
+                    backing_with(&[]),
+                    ignored_with(operation(PASSWORD, false, &[3, 0, 4, 0])),
+                ],
+                "the PASSWORD op there, whose question header does not parse, so whose \
+                 VarStoreId may be 0, which names no VarStore",
+            ),
         ];
-        for (key, want) in writes {
-            assert_eq!(variables.writes_to(&key), want, "writes of {key}");
+        for (case, ifr, record) in cases {
+            assert_closes_every_variable(case, &ifr, record);
         }
     }
 
-    /// The PASSWORD on a VARSTORE_EFI before UEFI 2.3.1 keeps its password in the EFI variable of
-    /// its VarName, which get and set through variables of either reach withhold: the CHECKBOX B
-    /// on that VarName is neither read nor written, the NUMERIC A beside it is, and the variable
-    /// keeps the password. Through variables that reach BootServices, set refuses the HiiDB
-    /// without UnsafeOperations::Allow.
+    /// A STRING beside a PASSWORD of VarStoreId 0, EFI_IFR_FLAG_CALLBACK or not, is refused like the
+    /// NUMERICs: get, also with the ExportConfig snapshot, and set with UnsafeOperations::Allow
+    /// fail before any variable read, through Runtime naming the PASSWORD's record and through
+    /// BootServices as for a PASSWORD whose VarStore is unknown; beside a PASSWORD on Backing that
+    /// ends before it, get reads it.
     #[test]
-    fn the_variable_of_a_short_var_store_password_is_withheld() {
-        // "Password" is string 14 and "ShortVarPw" string 15
-        let strings = [&SHORT_STRINGS[..], &["Password", "ShortVarPw"]].concat();
-        let packages = [
-            form_package(&[
-                short_var_store_efi_of(1, SHORT_VAR_STORE_GUID, NV_BS_RT),
-                form(
-                    1,
-                    &[
-                        short_numeric_a(),
-                        password_on(6, 14, 1, 15),
-                        checkbox_at(2, 2, 1, 15),
-                    ],
-                ),
-            ]),
-            en_strings_package_of(&strings),
-            END_PACKAGE.to_vec(),
-        ];
-        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
-        let password = short_key("ShortVarPw");
-        let password_variable = [&NV_BS_RT.to_ne_bytes()[..], &plaintext_password()].concat();
-        let refusal = "cannot set question \"B\": EFI variable \
-                       ShortVarPw-8c78a505-baa0-4c4a-869f-000000000b01 holds a password at bytes \
-                       0..40, which set never writes";
-        let reaches = [
-            (VariableReach::Runtime, VariableInterface::Efivarfs),
-            (
-                VariableReach::BootServices,
-                VariableInterface::VariableServices,
-            ),
-        ];
-        for (reach, interface) in reaches {
-            let variables = short_variables(reach, interface);
-            variables.insert(password.clone(), NV_BS_RT, &plaintext_password());
+    fn a_string_beside_a_password_of_var_store_id_0_reads_no_variable() {
+        type I = NameValueIfr;
+        // the STRING P at bytes 4..8 of Backing, of 0 to 2 characters
+        let string = || string_on(8, 8, (1, 4), (0, 2), &[]);
+        let hiidb_beside = |var_store_id: u16, flags: u8| {
+            let password = [
+                question_header_with(3, 3, var_store_id, 0, flags),
+                [1u16, 2]
+                    .iter()
+                    .flat_map(|size| size.to_le_bytes())
+                    .collect(), // MinSize, MaxSize
+            ]
+            .concat();
+            let password = operation(PASSWORD, false, &password);
+            name_value_hiidb(&[form_set(&[
+                I::backing(),
+                form(1, &[I::b(), string(), password]),
+            ])])
+        };
+        let record = format!(
+            "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: {OWN_DRIVER}"
+        );
 
-            assert_eq!(
-                answers_of(&hiidb, "B", &variables),
-                [format!("{PASSWORD_BYTES} <IFR default: 0>")],
-                "{reach:?}: get B"
-            );
-            assert_eq!(
-                answers_of(&hiidb, "A", &variables),
-                ["5"],
-                "{reach:?}: get A"
-            );
-            assert_eq!(
-                set_bypassing(&hiidb, "B", "1", &variables),
-                Err(refusal.to_string()),
-                "{reach:?}: set B"
-            );
-            assert_eq!(
-                set_bypassing(&hiidb, "A", "9", &variables),
-                Ok(()),
-                "{reach:?}: set A"
-            );
-            assert_eq!(
-                variables.writes_to(&password),
-                vec![],
-                "{reach:?}: writes of ShortVarPw"
-            );
-            assert_eq!(
-                variables.bytes(&password),
-                Some(password_variable.clone()),
-                "{reach:?}: ShortVarPw keeps its password"
-            );
+        for flags in [0x00, 0x04] {
+            let hiidb = hiidb_beside(0, flags);
+            for (reach, end) in [
+                (VariableReach::Runtime, ANY_VARIABLE),
+                (VariableReach::BootServices, BOOT_SERVICES_REFUSAL),
+            ] {
+                let case = format!("Flags {flags:#04x}, {reach:?}");
+                let refused = |error: Option<&String>| {
+                    error.is_some_and(|error| error.contains(&record) && error.ends_with(end))
+                };
+                let variables = name_value_variables(reach);
+                let got = name_value_get(&hiidb, "P", &variables, None);
+                assert!(refused(got.as_ref().err()), "{case}: get P: {got:?}");
+                let snapshot = name_value_snapshot();
+                let got = name_value_get(&hiidb, "P", &variables, Some(&snapshot));
+                assert!(
+                    refused(got.as_ref().err()),
+                    "{case}, with the snapshot: get P: {got:?}"
+                );
+                let set = set_bypassing(&hiidb, "P", "ab", &variables);
+                assert!(refused(set.as_ref().err()), "{case}: set P: {set:?}");
+                assert_eq!(variables.reads(), [], "{case}: reads");
+                for (name, guid) in [("Backing", P_GUID), ("Other", OTHER_GUID)] {
+                    let key = VariableKey {
+                        name: name.to_owned(),
+                        guid: Guid::from(guid),
+                    };
+                    assert_eq!(variables.writes_to(&key), [], "{case}: writes to {name}");
+                }
+            }
         }
 
-        let variables = short_variables(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        );
-        variables.insert(password, NV_BS_RT, &plaintext_password());
+        let variables = name_value_variables(VariableReach::Runtime);
         assert_eq!(
-            set_of(&hiidb, "A", "9", &variables),
-            Err(
-                "this HiiDB declares a setup password question, and the UEFI Shell runs no setup \
-                 browser, so no password is asked or checked; pass \
-                 --i-am-fine-to-brick-this-system to write without it"
-                    .to_string()
-            ),
-            "set A without UnsafeOperations::Allow"
+            name_value_get(&hiidb_beside(1, 0x00), "P", &variables, None),
+            Ok(vec!["\u{2211}".to_owned()]),
+            "beside a password on Backing: get P"
         );
     }
 
-    /// A GET and a SET of the VARSTORE_EFI before UEFI 2.3.1 reach the EFI variables of their
-    /// VarNames through set, through variables of either reach: set refuses the CHECKBOX F, which
-    /// a SUPPRESS_IF hides while the GET of ShortVarA gives 5, and sets it once set of A wrote 9
-    /// there; that set writes ShortVarD by the SET of A's WRITE expression, then ShortVarA, and,
-    /// without ShortVarD, creates it with the store's Attributes, as edk2-stable202608
-    /// SetupBrowserDxe/Expression.c EvaluateExpression does by SetVariable(). Through the firmware
-    /// environment calls of Windows, which create no variable, that SET stores nothing.
+    /// The middle of the record of a PASSWORD in a FormSet whose VarStoreId 9 no VarStore declares.
+    const UNDECLARED_9: &str = "PASSWORD question 0x0003 in FormSet \
+                                11111111-1111-1111-1111-111111111111: no supported varstore with \
+                                matching id 0x0009 found";
+
+    /// A PASSWORD whose VarStoreId no VarStore of its form package that decodes declares names no
+    /// VarStore: UEFI 2.11 §33.3.8.2.2 asks for "a previously declared variable store", and
+    /// edk2-stable202608 finds none for it in the Forms Browser (SetupBrowserDxe/IfrParse.c
+    /// CreateQuestion, :136-148) nor in the Config Keyword Handler (ConfigKeywordHandler.c
+    /// FindStorageFromVarId, :1520-1569) but a VarStore op that does not decode, which each reads
+    /// whatever the op's Length: the Forms Browser one of its FormSet outside an unknown opcode's
+    /// scope (IfrParse.c ParseOpCodes, :1873-1918), FindStorageFromVarId the first in the form
+    /// package (:1538-1555), so its password may be in any variable, as for VarStoreId 0. So get,
+    /// set and the snapshot refuse the whole HiiDB, EFI_IFR_FLAG_CALLBACK or not: one in its form,
+    /// in a disabled form, outside any FormSet, in a FormSet that uefisettings ignores, one whose
+    /// question header past its op names such an id, one whose id only a VarStore op that does not
+    /// decode names, in an unknown opcode's scope or in its FormSet, which uefisettings ignores
+    /// for that op, one in a form package that declares no VarStore, and one whose id only another
+    /// package list declares. Each names its record.
     #[test]
-    fn get_and_set_of_a_short_var_store_reach_the_variables_of_their_var_names() {
-        const GET: u8 = 0x2B;
-        const SET: u8 = 0x2C;
-        const WRITE: u8 = 0x2E;
-        const EQUAL: u8 = 0x2F;
-        const THIS: u8 = 0x58;
-        // a GET or SET of VarStore 1 at VarName `var_name`, of VarStoreType `value_type`
-        let store_op = |op_code: u8, var_name: u16, value_type: u8| {
+    fn passwords_of_undeclared_var_store_ids_close_every_variable() {
+        type I = NameValueIfr;
+        let callback = || {
             let data = [
-                &1u16.to_le_bytes()[..],
-                &var_name.to_le_bytes(),
-                &[value_type],
+                question_header_with(3, 3, 9, 4, 0x04),
+                [1u8, 0, 20, 0].to_vec(),
             ]
             .concat();
-            operation(op_code, false, &data)
+            operation(PASSWORD, false, &data)
         };
-        // the UINT8 NUMERIC A on ShortVarA, whose WRITE sets ShortVarD, a UINT16
-        // (EFI_IFR_TYPE_NUM_SIZE_16), to its value
-        let numeric_a = [
-            operation(
-                NUMERIC,
-                true,
-                &[
-                    question_header_with(1, 1, 1, 7, 0x00),
-                    // EFI_IFR_NUMERIC_SIZE_1 | EFI_IFR_DISPLAY_UINT_DEC, from 0 to 255, step 1
-                    vec![0x10, 0, 255, 1],
-                ]
-                .concat(),
-            ),
-            operation(WRITE, false, &[]),
-            scoped_expression(&[operation(THIS, false, &[]), store_op(SET, 10, 0x01)], 0),
-            END.to_vec(),
+        // a CHECKBOX op ending after 4 of the 12 bytes of its data, which disables its form
+        let disabler = || operation(CHECKBOX, false, &[0x00; 4]);
+        // a PASSWORD op of Prompt 3 and Help 4 whose question header runs on into the SUBTITLE
+        // after it, VarStoreId 9 and VarStoreInfo 4 (QuestionId 0x0702: the SUBTITLE's header)
+        let header_past_op = [
+            operation(PASSWORD, false, &[3, 0, 4, 0]),
+            operation(SUBTITLE, false, &[9, 0, 4, 0, 0]),
         ]
         .concat();
-        // the CHECKBOX F on ShortVarC, suppressed where ShortVarA holds the UINT8
-        // (EFI_IFR_TYPE_NUM_SIZE_8) 5
-        let hidden_f = conditional(
-            SUPPRESS_IF,
-            scoped_expression(
+        let backing_with = |forms: &[Vec<u8>]| {
+            let first = form(1, &[I::b(), I::p()]);
+            form_set(&[[I::backing(), first].as_slice(), forms].concat())
+        };
+        // a FormSet that uefisettings ignores, for its short DEFAULTSTORE op, with `password`
+        let ignored_with = |password: Vec<u8>| {
+            form_set_with_guid(
+                [0x12; 16],
                 &[
-                    store_op(GET, 7, 0x00),
-                    uint8(5),
-                    operation(EQUAL, false, &[]),
+                    operation(DEFAULT_STORE, false, &[0x00, 0x00]),
+                    form(2, &[password]),
                 ],
-                0,
+            )
+        };
+        let cases = [
+            (
+                "in its form",
+                vec![form_set(&[
+                    I::backing(),
+                    form(1, &[I::b(), I::p(), I::password(9)]),
+                ])],
+                UNDECLARED_9,
             ),
-            &[checkbox_at(6, 6, 1, 9)],
-        );
-        let hiidb = short_store_hiidb(NV_BS_RT, &[numeric_a, hidden_f]);
-        let reaches = [
-            (VariableReach::Runtime, VariableInterface::Efivarfs),
             (
-                VariableReach::BootServices,
-                VariableInterface::VariableServices,
+                "of EFI_IFR_FLAG_CALLBACK",
+                vec![backing_with(&[form(2, &[callback()])])],
+                UNDECLARED_9,
+            ),
+            (
+                "in a disabled form",
+                vec![backing_with(&[form(2, &[I::password(9), disabler()])])],
+                UNDECLARED_9,
+            ),
+            (
+                "outside any FormSet",
+                vec![I::password(9), backing_with(&[])],
+                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
+                 FormSet, at offset 0 of a form package",
+            ),
+            (
+                "in a FormSet that uefisettings ignores",
+                vec![backing_with(&[]), ignored_with(I::password(9))],
+                "the PASSWORD op there, whose VarStoreId 0x0009 names no VarStore of its form \
+                 package",
+            ),
+            (
+                "its question header past its op",
+                vec![backing_with(&[form(2, &[header_past_op])])],
+                "PASSWORD question 0x0702 in FormSet 11111111-1111-1111-1111-111111111111: its \
+                 op ends before its question header",
+            ),
+            (
+                "its id only of a VarStore op that does not decode",
+                vec![form_set(&[
+                    I::backing(),
+                    in_unknown_scope(&operation(
+                        VAR_STORE,
+                        false,
+                        &[&OTHER_GUID[..], &9u16.to_le_bytes()].concat(),
+                    )),
+                    form(1, &[I::b(), I::p(), I::password(9)]),
+                ])],
+                "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: \
+                 failed to parse VarStore's data",
+            ),
+            (
+                "its id only of a VarStore op of its FormSet that does not decode",
+                vec![
+                    backing_with(&[]),
+                    form_set_with_guid(
+                        [0x12; 16],
+                        &[
+                            operation(
+                                VAR_STORE,
+                                false,
+                                &[&OTHER_GUID[..], &9u16.to_le_bytes()].concat(),
+                            ),
+                            form(2, &[I::password(9)]),
+                        ],
+                    ),
+                ],
+                "the PASSWORD op there, whose VarStoreId 0x0009 names no VarStore of its form \
+                 package",
+            ),
+            (
+                "in a form package that declares no VarStore",
+                vec![form_set(&[form(1, &[I::b(), I::p(), I::password(9)])])],
+                UNDECLARED_9,
+            ),
+            (
+                "its id declared only by another package list",
+                vec![backing_with(&[form(2, &[I::password(2)])])],
+                "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: no \
+                 supported varstore with matching id 0x0002 found",
             ),
         ];
-        for (reach, interface) in reaches {
-            let variables = short_variables(reach, interface);
-
-            assert_eq!(
-                set_of(&hiidb, "F", "1", &variables),
-                Err(
-                    "question \"F\" is suppressed; also include suppressed questions to select it"
-                        .to_string()
-                ),
-                "{reach:?}: set F while ShortVarA holds 5"
-            );
-            assert_eq!(
-                set_of(&hiidb, "A", "9", &variables),
-                Ok(()),
-                "{reach:?}: set A"
-            );
-            assert_eq!(
-                variables.writes_to(&short_key("ShortVarD")),
-                [(0, vec![9, 0])],
-                "{reach:?}: set A: writes of ShortVarD"
-            );
-            assert_eq!(
-                variables.writes_to(&short_key("ShortVarA")),
-                [(0, vec![9])],
-                "{reach:?}: set A: writes of ShortVarA"
-            );
-            assert_eq!(
-                set_of(&hiidb, "F", "1", &variables),
-                Ok(()),
-                "{reach:?}: set F once ShortVarA holds 9"
-            );
-            assert_eq!(
-                variables.writes_to(&short_key("ShortVarC")),
-                [(0, vec![1])],
-                "{reach:?}: set F: writes of ShortVarC"
-            );
-
-            let variables = MemoryVariables::new(reach, interface);
-            variables.insert(short_key("ShortVarA"), NV_BS_RT, &[5]);
-            let variables = Rc::new(variables);
-            assert_eq!(
-                set_of(&hiidb, "A", "9", &variables),
-                Ok(()),
-                "{reach:?}: set A without ShortVarD"
-            );
-            assert_eq!(
-                variables.writes_to(&short_key("ShortVarA")),
-                [(0, vec![9])],
-                "{reach:?}: set A without ShortVarD: writes of ShortVarA"
-            );
-            assert_eq!(
-                variables.bytes(&short_key("ShortVarD")),
-                Some([&NV_BS_RT.to_ne_bytes()[..], &[9, 0]].concat()),
-                "{reach:?}: set A without ShortVarD: ShortVarD"
-            );
-        }
-
-        let variables = MemoryVariables::new(
-            VariableReach::Runtime,
-            VariableInterface::FirmwareEnvironment,
-        );
-        variables.insert(short_key("ShortVarA"), NV_BS_RT, &[5]);
-        let variables = Rc::new(variables);
-        assert_eq!(
-            set_of(&hiidb, "A", "9", &variables),
-            Ok(()),
-            "Windows: set A without ShortVarD"
-        );
-        assert_eq!(
-            variables.writes_to(&short_key("ShortVarA")),
-            [(0, vec![9])],
-            "Windows: set A without ShortVarD: writes of ShortVarA"
-        );
-        assert_eq!(
-            variables.bytes(&short_key("ShortVarD")),
-            None,
-            "Windows: set A without ShortVarD: ShortVarD"
-        );
-    }
-
-    /// set writes an existing per-question variable at its question's width with the variable's
-    /// own attributes, not those that the VARSTORE_EFI declares: "If a preexisting variable is
-    /// rewritten with different attributes, SetVariable() shall not modify the variable" (UEFI
-    /// 2.11 §8.2.3 SetVariable).
-    #[test]
-    fn set_keeps_the_attributes_of_a_per_question_variable() {
-        let hiidb = short_store_hiidb(NV_BS_RT, &[short_numeric_a()]);
-        let variables = Rc::new(MemoryVariables::new(
-            VariableReach::BootServices,
-            VariableInterface::VariableServices,
-        ));
-        variables.insert(short_key("ShortVarA"), NV_BS, &[5]);
-
-        assert_eq!(set_of(&hiidb, "A", "9", &variables), Ok(()), "set A");
-        assert_eq!(
-            variables.bytes(&short_key("ShortVarA")),
-            Some([&NV_BS.to_ne_bytes()[..], &[9]].concat()),
-            "ShortVarA"
-        );
+        for (case, ifr, record) in cases {
+            assert_closes_every_variable(case, &ifr, record);
+        }
     }
 
-    /// Two FormSets that declare AMITSESetup: the first at its top, with the UINT64 NUMERIC N0
-    /// over bytes 0..8, shown in hex; the second after `declarations`, with a PASSWORD at bytes
-    /// 0..40.
-    fn password_after_hiidb(declarations: &[Vec<u8>]) -> Vec<u8> {
-        let numeric = [
-            question_header_with(4, 4, 2, 0, 0x00),
-            vec![0x23], // EFI_IFR_NUMERIC_SIZE_8 | EFI_IFR_DISPLAY_UINT_HEX
-            0u64.to_le_bytes().to_vec(),
-            u64::MAX.to_le_bytes().to_vec(),
-            1u64.to_le_bytes().to_vec(),
+    /// Of a package list with two form packages, a PASSWORD whose VarStoreId only the other
+    /// package declares names no VarStore of its own: neither the Forms Browser nor
+    /// FindStorageFromVarId, which walks one form package, finds one, so get refuses the HiiDB,
+    /// for one in its form, one whose question header past its op names the id, and one outside
+    /// any FormSet.
+    #[test]
+    fn a_password_of_an_id_that_only_another_form_package_declares_closes_every_variable() {
+        type I = NameValueIfr;
+        // a PASSWORD op of Prompt 3 and Help 4 whose question header runs on into the SUBTITLE
+        // after it, VarStoreId 9 and VarStoreInfo 4 (QuestionId 0x0702: the SUBTITLE's header)
+        let header_past_op = [
+            operation(PASSWORD, false, &[3, 0, 4, 0]),
+            operation(SUBTITLE, false, &[9, 0, 4, 0, 0]),
         ]
         .concat();
-        let packages = [
-            form_package_of(
-                &[
-                    form_set(&[
-                        var_store(2, [0x44; 16], "AMITSESetup", 81),
-                        form(1, &[operation(NUMERIC, false, &numeric)]),
-                    ]),
-                    form_set(&[declarations.concat(), form(1, &[password_on(3, 3, 2, 0)])]),
+        let cases = [
+            (
+                "in its form",
+                form_set(&[I::backing(), form(1, &[I::b(), I::p(), I::password(9)])]),
+                UNDECLARED_9,
+            ),
+            (
+                "its question header past its op",
+                form_set(&[
+                    I::backing(),
+                    form(1, &[I::b(), I::p()]),
+                    form(2, &[header_past_op]),
+                ]),
+                "PASSWORD question 0x0702 in FormSet 11111111-1111-1111-1111-111111111111: its \
+                 op ends before its question header",
+            ),
+            (
+                "outside any FormSet",
+                [
+                    I::password(9),
+                    form_set(&[I::backing(), form(1, &[I::b(), I::p()])]),
                 ]
                 .concat(),
+                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
+                 FormSet, at offset 0 of a form package",
             ),
-            en_strings_package_of(&["Q", "P", "Password", "N0"]),
-            END_PACKAGE.to_vec(),
         ];
-        package_list_with_guid([0x55; 16], &packages.concat())
-    }
+        let runtime = name_value_variables(VariableReach::Runtime);
 
-    /// get of N0 in `hiidb` through variables of `reach`, AMITSESetup holding a password in its
-    /// bytes 0..40: its answers, or why it refuses.
-    fn get_over_password(hiidb: &[u8], reach: VariableReach) -> Result<Vec<String>, String> {
-        let interface = match reach {
-            VariableReach::Runtime => VariableInterface::Efivarfs,
-            VariableReach::BootServices => VariableInterface::VariableServices,
-        };
-        let variables = MemoryVariables::new(reach, interface);
-        variables.insert(
-            amitse_setup(),
-            NV_BS_RT,
-            &[plaintext_password().as_slice(), &[0xAA; 40], &[1]].concat(),
-        );
-        HiiBackend::get_in(
-            hiidb,
-            "N0",
-            None,
-            &GetOptions::default(),
-            shared(&Rc::new(variables)),
-            None,
-            None,
-        )
-        .map(|got| {
-            got.responses
-                .iter()
-                .map(|response| response.question.answer.clone())
-                .collect()
-        })
-        .map_err(|error| error.to_string())
+        for (case, ifr, record) in cases {
+            let hiidb = name_value_hiidb_of_packages(&[
+                ifr,
+                form_set_with_guid(
+                    [0x14; 16],
+                    &[var_store(9, P_GUID, "Backing", 8), form(3, &[])],
+                ),
+            ]);
+            for question in ["B", "O"] {
+                let got = name_value_get(&hiidb, question, &runtime, None);
+                assert!(
+                    got.as_ref().is_err_and(
+                        |error| error.contains(record) && error.ends_with(ANY_VARIABLE)
+                    ),
+                    "{case}: get {question}: {got:?}"
+                );
+            }
+        }
     }
 
-    /// Through variables of either reach, a NUMERIC over a password whose VarStore a SUPPRESS_IF
-    /// of its FormSet declares shows none of its bytes: get answers that they hold a password.
+    /// A PASSWORD whose VarStoreId a VarStore of its form package declares, though not one of its
+    /// FormSet before it, stays bounded: FindStorageFromVarId takes that VarStore, the first of
+    /// the id in the form package (edk2-stable202608 ConfigKeywordHandler.c:1520-1569), so
+    /// through Runtime the password's bytes there are withheld and the others read, its id declared
+    /// by another FormSet, by its own after it, or outside any FormSet.
     #[test]
-    fn a_password_on_a_var_store_under_a_suppress_if_withholds_its_bytes() {
-        let hiidb = password_after_hiidb(&[conditional(
-            SUPPRESS_IF,
-            ifr_true(),
-            &[var_store(2, [0x44; 16], "AMITSESetup", 81)],
-        )]);
-        for reach in [VariableReach::Runtime, VariableReach::BootServices] {
+    fn passwords_of_ids_that_their_form_package_declares_stay_bounded() {
+        type I = NameValueIfr;
+        let backing_9 = || var_store(9, P_GUID, "Backing", 8);
+        let in_its_form = || form(1, &[I::b(), I::p(), I::password(9)]);
+        let cases = [
+            (
+                "by another FormSet",
+                vec![
+                    form_set(&[I::backing(), in_its_form()]),
+                    form_set_with_guid([0x13; 16], &[backing_9(), form(3, &[])]),
+                ],
+            ),
+            (
+                "by its FormSet after it",
+                vec![form_set(&[I::backing(), in_its_form(), backing_9()])],
+            ),
+            (
+                "outside any FormSet",
+                vec![backing_9(), form_set(&[I::backing(), in_its_form()])],
+            ),
+        ];
+        let runtime = name_value_variables(VariableReach::Runtime);
+
+        for (case, ifr) in cases {
+            let hiidb = name_value_hiidb(&ifr);
             assert_eq!(
-                get_over_password(&hiidb, reach),
-                Ok(vec![PASSWORD_BYTES.to_string()]),
-                "{reach:?}"
+                name_value_get(&hiidb, "B", &runtime, None),
+                Ok(vec!["31323".to_owned()]),
+                "{case}: get B"
+            );
+            assert_eq!(
+                name_value_get(&hiidb, "P", &runtime, None),
+                Ok(vec![PASSWORD_BYTES.to_owned()]),
+                "{case}: get P"
             );
         }
     }
 
-    /// A VarStore of a PASSWORD's VarStoreId whose EFI variable is unknown never drops the known
-    /// VarStore of the id beside it: through Runtime, a NUMERIC over the password shows none of
-    /// its bytes; through BootServices, get refuses the HiiDB as the password is unresolved. A
-    /// VARSTORE_NAME_VALUE of the id in the PASSWORD's FormSet, whose driver may keep the password
-    /// in any variable, has get refuse the HiiDB through Runtime too.
+    /// A PASSWORD that edk2 does not route to a VARSTORE_NAME_VALUE keeps its password where its
+    /// IFR says, so through Runtime its bytes alone are withheld, beside one: one on its FormSet's
+    /// VARSTORE of an id that a VARSTORE_NAME_VALUE of a later FormSet declares (VarStoreIds are
+    /// unique within a form set, §33.3.8.3.90), which edk2 takes first, or one outside any FormSet
+    /// after it: edk2-stable202608 SetupBrowserDxe/IfrParse.c gives a question the VarStore of its
+    /// id in its FormSet (:136-146), and ConfigKeywordHandler.c FindStorageFromVarId the first of
+    /// the id in its form package (:1520-1567); one outside any FormSet of an id whose first
+    /// VarStore in its form package is a VARSTORE, beside a VARSTORE_NAME_VALUE of the id in
+    /// another form package, which FindStorageFromVarId does not walk; one on a buffer VarStore
+    /// beside a VARSTORE_NAME_VALUE of another id, in its FormSet or, for a PASSWORD outside any
+    /// FormSet, in its form package, in a FormSet or outside any. P over the password's bytes
+    /// shows withheld, B beside them and O of the other list show. The snapshot answers the
+    /// questions of the VARSTORE_NAME_VALUE, where the layout has W, unless the PASSWORD is
+    /// unresolved, and so does BootServices.
     #[test]
-    fn a_store_of_an_unknown_variable_keeps_a_password_withheld_through_runtime() {
-        let amitse = || var_store(2, [0x44; 16], "AMITSESetup", 81);
-        let withheld = Ok(vec![PASSWORD_BYTES.to_string()]);
+    fn passwords_that_edk2_does_not_route_to_a_name_value_store_keep_withholding_their_bytes() {
+        type I = NameValueIfr;
+        let unavailable = "<ValueUnavailable: HII name/value varstore requires \
+                           EFI_HII_CONFIG_ACCESS_PROTOCOL>";
+        let shown = "31323 <snapshot>";
+        // FormSet 0x11 with the PASSWORD of VarStoreId 3 on its VARSTORE 3, Backing too
+        let own_var_store = || {
+            form_set(&[
+                I::backing(),
+                var_store(3, P_GUID, "Backing", 8),
+                form(1, &[I::b(), I::p(), I::password(3)]),
+            ])
+        };
         let cases = [
             (
-                "a VarStore op that does not decode, in an unknown op",
-                vec![
-                    nested(
-                        &operation(0x70, true, &[]),
-                        1,
-                        &[operation(VAR_STORE, false, &[0x00; 3])],
-                    ),
-                    amitse(),
-                ],
-                withheld.clone(),
+                "its FormSet's VARSTORE first, a later FormSet's VARSTORE_NAME_VALUE",
+                name_value_hiidb(&[
+                    own_var_store(),
+                    form_set_with_guid([0x12; 16], &[I::name_value(), form(2, &[I::w()])]),
+                ]),
+                ["31323", WITHHELD],
+                Some(shown),
             ),
             (
-                "a VARSTORE_NAME_VALUE in a form",
-                vec![amitse(), form(7, &[var_store_name_value(2, [0x66; 16])])],
-                Err(ANY_VARIABLE),
+                "its FormSet's VARSTORE first, a VARSTORE_NAME_VALUE outside any FormSet after it",
+                name_value_hiidb(&[own_var_store(), I::name_value()]),
+                ["31323", WITHHELD],
+                None,
             ),
             (
-                "a VARSTORE_NAME_VALUE under DISABLE_IF TRUE",
-                vec![
-                    conditional(
-                        DISABLE_IF,
-                        ifr_true(),
-                        &[var_store_name_value(2, [0x66; 16])],
-                    ),
-                    conditional(DISABLE_IF, ifr_false(), &[amitse()]),
-                ],
-                Err(ANY_VARIABLE),
+                "outside any FormSet, its form package's VARSTORE first, a VARSTORE_NAME_VALUE in \
+                 another form package",
+                name_value_hiidb_of_packages(&[
+                    [
+                        I::password(3),
+                        form_set(&[
+                            I::backing(),
+                            var_store(3, P_GUID, "Backing", 8),
+                            form(1, &[I::b(), I::p()]),
+                        ]),
+                    ]
+                    .concat(),
+                    form_set_with_guid([0x12; 16], &[I::name_value(), form(2, &[I::w()])]),
+                ]),
+                ["31323", WITHHELD],
+                Some(unavailable),
             ),
             (
-                "a short VARSTORE_EFI under DISABLE_IF TRUE",
-                vec![
-                    conditional(DISABLE_IF, ifr_true(), &[short_var_store_efi(2)]),
-                    conditional(DISABLE_IF, ifr_false(), &[amitse()]),
-                ],
-                withheld,
+                "on Backing, a VARSTORE_NAME_VALUE of another id in its FormSet",
+                name_value_hiidb(&[form_set(&[
+                    I::name_value(),
+                    I::backing(),
+                    form(1, &[I::c(), I::w(), I::b(), I::p(), I::password(1)]),
+                ])]),
+                ["31323", WITHHELD],
+                Some(shown),
+            ),
+            (
+                "on Backing outside any FormSet, a VARSTORE_NAME_VALUE of another id",
+                name_value_hiidb(&[
+                    I::password(1),
+                    form_set(&[
+                        I::name_value(),
+                        I::backing(),
+                        form(1, &[I::c(), I::w(), I::b(), I::p()]),
+                    ]),
+                ]),
+                ["31323", WITHHELD],
+                Some(unavailable),
+            ),
+            (
+                "on Backing outside any FormSet, a VARSTORE_NAME_VALUE of another id outside any \
+                 FormSet before it",
+                name_value_hiidb(&[
+                    I::name_value(),
+                    I::password(1),
+                    form_set(&[I::backing(), form(1, &[I::b(), I::p()])]),
+                ]),
+                ["31323", WITHHELD],
+                None,
             ),
         ];
-        for (case, declarations, runtime) in cases {
-            let hiidb = password_after_hiidb(&declarations);
-            let got = get_over_password(&hiidb, VariableReach::Runtime);
-            match &runtime {
-                Ok(want) => assert_eq!(got.as_ref(), Ok(want), "{case}: Runtime"),
-                Err(suffix) => assert!(
-                    got.as_ref().is_err_and(|error| error.ends_with(suffix)),
-                    "{case}: Runtime: {got:?}"
+        for (case, hiidb, [b, p], w) in cases {
+            let runtime = name_value_variables(VariableReach::Runtime);
+            let snapshot = name_value_snapshot();
+            let resolved = w == Some(shown);
+
+            for (question, want) in [("B", b), ("P", p), ("O", "4386")] {
+                assert_eq!(
+                    name_value_get(&hiidb, question, &runtime, None),
+                    Ok(vec![want.to_owned()]),
+                    "{case}: Runtime: get {question}"
+                );
+            }
+            if let Some(w) = w {
+                assert_eq!(
+                    name_value_get(&hiidb, "W", &runtime, Some(&snapshot)),
+                    Ok(vec![w.to_owned()]),
+                    "{case}: Runtime, with the snapshot: get W"
+                );
+            }
+            let boot_services = name_value_variables(VariableReach::BootServices);
+            let got = name_value_get(&hiidb, "O", &boot_services, None);
+            match resolved {
+                true => assert_eq!(got, Ok(vec!["4386".to_owned()]), "{case}: BootServices"),
+                false => assert!(
+                    got.as_ref()
+                        .is_err_and(|error| error.ends_with(BOOT_SERVICES_REFUSAL)),
+                    "{case}: BootServices: {got:?}"
                 ),
             }
-            let refusal = get_over_password(&hiidb, VariableReach::BootServices);
-            assert!(
-                matches!(&refusal, Err(reason) if reason.contains(
-                    "the UEFI Shell build reads and writes no variable of this HiiDB"
-                )),
-                "{case}: BootServices: {refusal:?}"
-            );
         }
     }
 
-    /// The end of the refusal through variables that reach BootServices of a HiiDB with a
-    /// PASSWORD whose VarStore is unknown (UnresolvedPasswords).
-    const BOOT_SERVICES_REFUSAL: &str = "; as the variable of that password is unknown, the UEFI \
-                                         Shell build reads and writes no variable of this HiiDB";
-
-    /// Strings 1 C, 2 W, 3 Password, 4 Pin, 5 Flag, 6 B, 7 O and 8 P of the package lists of
-    /// name_value_hiidb.
-    const NAME_VALUE_STRINGS: [&str; 8] = ["C", "W", "Password", "Pin", "Flag", "B", "O", "P"];
-
-    /// The ExportConfig snapshot of name_value_hiidb: Pin 0x7A5B, Flag 1.
-    fn name_value_snapshot() -> String {
-        format!("{}&Pin=7a5b&Flag=01", config_hdr(N_GUID, "", &DRIVER_PATH))
-    }
-
-    /// A HiiDB of two package lists of the driver at DRIVER_PATH, with NAME_VALUE_STRINGS: the
-    /// first of the IFR `ifr`, the second with the UINT16 NUMERIC O at byte 0 of the buffer
-    /// VarStore Other, VarStoreId 2.
-    fn name_value_hiidb(ifr: &[Vec<u8>]) -> Vec<u8> {
-        name_value_hiidb_of_packages(&[ifr.concat()])
-    }
-
-    /// name_value_hiidb with a form package in the first list for each IFR of `packages`.
-    fn name_value_hiidb_of_packages(packages: &[Vec<u8>]) -> Vec<u8> {
-        let list = |guid: [u8; 16], forms: &[Vec<u8>]| {
-            let packages = [
-                vec![device_path_package(&DRIVER_PATH)],
-                forms.iter().map(|ifr| form_package_of(ifr)).collect(),
-                vec![
-                    en_strings_package_of(&NAME_VALUE_STRINGS),
-                    END_PACKAGE.to_vec(),
-                ],
-            ];
-            package_list_with_guid(guid, &packages.concat().concat())
-        };
-        let other = form_set_with_guid(
-            OTHER_GUID,
-            &[
-                var_store(2, OTHER_GUID, "Other", 2),
-                form(1, &[uint16_numeric(1, 7, 2, 0)]),
-            ],
-        );
-        [list([0x55; 16], packages), list([0x56; 16], &[other])].concat()
+    /// A HiiDB whose FormSet holds the VARSTORE_EFI Setup of id 1, over 4 bytes, and then the ops
+    /// `list` of its form-set-list; its strings are Hidden, Shown, Gate, After, First and Outside.
+    fn form_set_list_hiidb(list: &[Vec<u8>]) -> Vec<u8> {
+        let children = [vec![var_store_efi(1, "Setup", NV_BS_RT, 4)], list.to_vec()].concat();
+        let packages = [
+            form_package(&children),
+            en_strings_package_of(&["Hidden", "Shown", "Gate", "After", "First", "Outside"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x55; 16], &packages.concat())
     }
 
-    /// Variables of `reach` with Backing of name_value_hiidb, B 0x7A5B at bytes 0..2 and 0x2211
-    /// at bytes 4..6, and Other, O 0x1122.
-    fn name_value_variables(reach: VariableReach) -> Rc<MemoryVariables> {
-        let interface = match reach {
-            VariableReach::BootServices => VariableInterface::VariableServices,
-            VariableReach::Runtime => VariableInterface::Efivarfs,
-        };
-        let variables = MemoryVariables::new(reach, interface);
-        let key = |name: &str, guid| VariableKey {
-            name: name.to_owned(),
-            guid: Guid::from(guid),
+    /// The names and answers of the questions that list-questions lists in `hiidb` with
+    /// `include` through `variables`.
+    fn names_and_answers(
+        hiidb: &[u8],
+        include: IncludedStates,
+        variables: &Rc<MemoryVariables>,
+    ) -> Vec<(String, String)> {
+        let options = ListQuestionsOptions {
+            include,
+            ..ListQuestionsOptions::default()
         };
-        variables.insert(
-            key("Backing", P_GUID),
-            NV_BS_RT,
-            &[0x5B, 0x7A, 0, 0, 0x11, 0x22, 0, 0],
-        );
-        variables.insert(key("Other", OTHER_GUID), NV_BS_RT, &[0x22, 0x11]);
-        Rc::new(variables)
+        HiiBackend::list_questions_in(hiidb, &options, shared(variables), None, None)
+            .expect("list the questions")
+            .into_iter()
+            .map(|question| (question.name, question.answer))
+            .collect()
     }
 
-    /// get of `question` in `hiidb` through `variables`, with the ExportConfig snapshot `exported`
-    /// if any: the answers, or the error.
-    fn name_value_get(
+    /// What get of `question` in `hiidb` gives with `include` through `variables`.
+    fn got_with(
         hiidb: &[u8],
         question: &str,
+        include: IncludedStates,
         variables: &Rc<MemoryVariables>,
-        exported: Option<&str>,
     ) -> Result<Vec<String>, String> {
+        let options = GetOptions {
+            include,
+            ..GetOptions::default()
+        };
         HiiBackend::get_in(
             hiidb,
             question,
             None,
-            &GetOptions::default(),
+            &options,
             shared(variables),
-            exported.map(|text| ExportedConfig::new(text.to_owned())),
+            None,
+            None,
             None,
         )
-        .map(|response| {
-            response
-                .responses
+        .map(|got| {
+            got.responses
                 .into_iter()
                 .map(|response| response.question.answer)
                 .collect()
@@ -13980,719 +18873,752 @@ mod tests {
         .map_err(|error| format!("{error:#}"))
     }
 
-    /// The IFR of the questions and stores of name_value_hiidb's first list: the CHECKBOX C on
-    /// the label Flag and the UINT16 NUMERIC W on the label Pin of the VARSTORE_NAME_VALUE of
-    /// VarStoreId 3, the UINT16 NUMERIC B at byte 0 and P at byte 4 of the buffer VarStore
-    /// Backing, VarStoreId 1, and the PASSWORD on Pin.
-    struct NameValueIfr;
+    /// What set of `question` in `hiidb` to 1 gives with `include` and UnsafeOperations::Allow
+    /// through `variables`, as the CLI prints an error.
+    fn set_with(
+        hiidb: &[u8],
+        question: &str,
+        include: IncludedStates,
+        variables: &Rc<MemoryVariables>,
+    ) -> Result<(), String> {
+        let options = SetOptions {
+            include,
+            unsafe_operations: UnsafeOperations::Allow,
+            ..SetOptions::default()
+        };
+        set_responses(
+            hiidb,
+            question,
+            &SetValue::Text("1".to_owned()),
+            None,
+            &options,
+            SetAccess {
+                reads: shared(variables),
+                writes: &**variables,
+                held: None,
+            },
+            None,
+        )
+        .map(drop)
+        .map_err(|error| format!("{error:#}"))
+    }
 
-    impl NameValueIfr {
-        fn c() -> Vec<u8> {
-            checkbox_at(1, 1, 3, 5)
+    /// edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes skips a FORM under a true
+    /// DISABLE_IF outside forms, so no --include and no unsafe operation offers its question
+    /// Hidden: get and set answer as for Absent, which the FormSet does not have. Shown, in a form
+    /// after it, stays a question.
+    #[test]
+    fn questions_under_a_true_form_set_disable_if_are_none_of_its_questions() {
+        let hiidb = form_set_list_hiidb(&[
+            conditional(
+                DISABLE_IF,
+                ifr_true(),
+                &[form(1, &[checkbox_at(1, 1, 1, 0)])],
+            ),
+            form(2, &[checkbox_at(2, 2, 1, 1)]),
+        ]);
+        for include in [IncludedStates::empty(), IncludedStates::all()] {
+            let variables = setup_holding(&[0; 4]);
+
+            assert_eq!(
+                names_and_answers(&hiidb, include, &variables),
+                [("Shown".to_owned(), "0".to_owned())],
+                "{include:?}: list-questions"
+            );
+            assert_eq!(
+                got_with(&hiidb, "Hidden", include, &variables),
+                got_with(&hiidb, "Absent", include, &variables),
+                "{include:?}: get Hidden"
+            );
+            assert_eq!(
+                got_with(&hiidb, "Shown", include, &variables),
+                Ok(vec!["0".to_owned()]),
+                "{include:?}: get Shown"
+            );
+            let set = set_with(&hiidb, "Hidden", include, &variables);
+            assert!(set.is_err(), "{include:?}: set Hidden: {set:?}");
+            assert_eq!(
+                set.map_err(|error| error.replace("Hidden", "Absent")),
+                set_with(&hiidb, "Absent", include, &variables),
+                "{include:?}: set Hidden"
+            );
+            assert_eq!(
+                variables.writes_to(&setup()),
+                [],
+                "{include:?}: writes of set Hidden"
+            );
+            assert_eq!(
+                set_with(&hiidb, "Shown", include, &variables),
+                Ok(()),
+                "{include:?}: set Shown"
+            );
+            assert_eq!(
+                variables.writes_to(&setup()),
+                [(1, vec![1])],
+                "{include:?}: writes of set Shown"
+            );
         }
+    }
 
-        fn w() -> Vec<u8> {
-            uint16_numeric(2, 2, 3, 4)
+    /// --keyword finds a statement in a form under a true DISABLE_IF outside forms, also in a
+    /// false SUPPRESS_IF there, as edk2-stable202608 HiiDatabaseDxe/ConfigKeywordHandler.c, which
+    /// evaluates no condition, finds it: get and set select it as a disabled question.
+    #[test]
+    fn a_keyword_selects_a_question_under_a_true_form_set_disable_if_as_disabled() {
+        let hidden = || form(1, &[checkbox_at(1, 1, 1, 0)]);
+        for (shape, held) in [
+            ("in the DISABLE_IF", hidden()),
+            (
+                "in a false SUPPRESS_IF in the DISABLE_IF",
+                conditional(SUPPRESS_IF, ifr_false(), &[hidden()]),
+            ),
+        ] {
+            let packages = [
+                form_package(&[
+                    var_store_efi(1, "Setup", NV_BS_RT, 4),
+                    conditional(DISABLE_IF, ifr_true(), &[held]),
+                ]),
+                en_strings_package_of(&["Hidden"]),
+                strings_package_of(b"x-UEFI-ns", &["HiddenKeyword"]),
+                END_PACKAGE.to_vec(),
+            ];
+            let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+            for (include, selected) in [
+                (IncludedStates::empty(), false),
+                (IncludedStates::DISABLED, true),
+            ] {
+                let variables = setup_holding(&[0; 4]);
+                let options = GetOptions {
+                    include,
+                    ..GetOptions::default()
+                };
+                let got = HiiBackend::get_in(
+                    &hiidb,
+                    by_keyword("HiddenKeyword", None),
+                    None,
+                    &options,
+                    shared(&variables),
+                    None,
+                    None,
+                    None,
+                )
+                .map(|got| {
+                    got.responses
+                        .into_iter()
+                        .map(|response| response.question.answer)
+                        .collect::<Vec<_>>()
+                });
+                let options = SetOptions {
+                    include,
+                    ..SetOptions::default()
+                };
+                let set = set_responses(
+                    &hiidb,
+                    by_keyword("HiddenKeyword", None),
+                    &SetValue::Text("1".to_owned()),
+                    None,
+                    &options,
+                    SetAccess {
+                        reads: shared(&variables),
+                        writes: &*variables,
+                        held: None,
+                    },
+                    None,
+                );
+                match selected {
+                    true => {
+                        assert_eq!(
+                            got.map_err(|error| format!("{error:#}")),
+                            Ok(vec!["0 <disabled>".to_owned()]),
+                            "{shape}: {include:?}: get"
+                        );
+                        assert!(set.is_ok(), "{shape}: {include:?}: set: {set:?}");
+                        assert_eq!(
+                            variables.writes_to(&setup()),
+                            [(0, vec![1])],
+                            "{shape}: {include:?}: writes"
+                        );
+                    }
+                    false => {
+                        assert!(got.is_err(), "{shape}: {include:?}: get: {got:?}");
+                        assert!(set.is_err(), "{shape}: {include:?}: set: {set:?}");
+                        assert_eq!(
+                            variables.writes_to(&setup()),
+                            [],
+                            "{shape}: {include:?}: writes"
+                        );
+                    }
+                }
+            }
         }
+    }
 
-        fn b() -> Vec<u8> {
-            uint16_numeric(6, 6, 1, 0)
+    /// A condition on a question that ParseOpCodes skips under a true DISABLE_IF outside forms
+    /// gives UNDEFINED, as edk2-stable202608 SetupBrowserDxe/Expression.c IdToQuestion finds no
+    /// such question, which IsTrue takes as FALSE: Shown is not suppressed, though Hidden's
+    /// variable holds 1. Under a false DISABLE_IF, Hidden is a question and Shown suppressed.
+    #[test]
+    fn a_reference_to_a_question_under_a_true_form_set_disable_if_is_undefined() {
+        for (case, disable_if, want_listed) in [
+            ("a true DISABLE_IF", ifr_true(), vec![("Shown", "1")]),
+            ("a false DISABLE_IF", ifr_false(), vec![("Hidden", "1")]),
+        ] {
+            let hiidb = form_set_list_hiidb(&[
+                conditional(
+                    DISABLE_IF,
+                    disable_if,
+                    &[form(1, &[checkbox_at(1, 1, 1, 0)])],
+                ),
+                form(
+                    2,
+                    &[conditional(
+                        SUPPRESS_IF,
+                        eq_id_val_of(1, 1),
+                        &[checkbox_at(2, 2, 1, 1)],
+                    )],
+                ),
+            ]);
+            let variables = setup_holding(&[1, 1, 0, 0]);
+
+            let want: Vec<(String, String)> = want_listed
+                .iter()
+                .map(|&(name, answer)| (name.to_owned(), answer.to_owned()))
+                .collect();
+            assert_eq!(
+                names_and_answers(&hiidb, IncludedStates::empty(), &variables),
+                want,
+                "{case}: list-questions"
+            );
         }
+    }
+
+    /// Why a DISABLE_IF outside forms on Gate, by an EQ_ID_VAL, may skip the questions in it.
+    const NOT_CONSTANT: &str = "it relies on EFI_IFR_EQ_ID_VAL, where a DISABLE_IF outside forms \
+                                must only rely on constants (UEFI 2.11 §33.3.8.3.14)";
+
+    /// The refusal of set of After, which conditions may disable for `reason`.
+    fn after_undetermined(reason: &str) -> String {
+        undetermined_refusal("After", reason)
+    }
+
+    /// The refusal of set of `question`, which conditions may disable for `reason`.
+    fn undetermined_refusal(question: &str, reason: &str) -> String {
+        format!(
+            "cannot tell whether question {question:?} is disabled: {reason}; also include \
+             disabled questions to select it regardless"
+        )
+    }
+
+    /// UEFI 2.11 §33.3.8.3.14 has a DISABLE_IF outside forms rely on constants only, and
+    /// ParseOpCodes evaluates one on a question before it reads any value: whatever Gate holds,
+    /// whether a browser parses After, in a form, Outside, outside forms, or First, in a form in a
+    /// false SUPPRESS_IF there, is not known, so set refuses to write any of them unless --include
+    /// names the disabled state, and get shows both states.
+    #[test]
+    fn a_form_set_disable_if_that_is_not_constant_leaves_its_questions_undetermined() {
+        let hiidb = form_set_list_hiidb(&[
+            form(1, &[checkbox_at(3, 3, 1, 0)]),
+            conditional(
+                DISABLE_IF,
+                eq_id_val_of(3, 1),
+                &[
+                    form(2, &[checkbox_at(4, 4, 1, 1)]),
+                    checkbox_at(6, 6, 1, 2),
+                    conditional(
+                        SUPPRESS_IF,
+                        ifr_false(),
+                        &[form(3, &[checkbox_at(5, 5, 1, 3)])],
+                    ),
+                ],
+            ),
+        ]);
+        for gate in [0, 1] {
+            for (question, offset) in [("After", 1), ("Outside", 2), ("First", 3)] {
+                let variables = setup_holding(&[gate, 0, 0, 0]);
 
-        fn p() -> Vec<u8> {
-            uint16_numeric(8, 8, 1, 4)
+                assert_eq!(
+                    set_with(&hiidb, question, IncludedStates::empty(), &variables),
+                    Err(undetermined_refusal(question, NOT_CONSTANT)),
+                    "Gate {gate}: set {question}"
+                );
+                assert_eq!(
+                    variables.writes_to(&setup()),
+                    [],
+                    "Gate {gate}: writes of set {question}"
+                );
+                assert_eq!(
+                    got_with(&hiidb, question, IncludedStates::empty(), &variables),
+                    Ok(vec![format!("0 <selectable or disabled: {NOT_CONSTANT}>")]),
+                    "Gate {gate}: get {question}"
+                );
+                assert_eq!(
+                    set_with(&hiidb, question, IncludedStates::DISABLED, &variables),
+                    Ok(()),
+                    "Gate {gate}: set {question}, including disabled questions"
+                );
+                assert_eq!(
+                    variables.writes_to(&setup()),
+                    [(offset, vec![1])],
+                    "Gate {gate}: writes of set {question}, including disabled questions"
+                );
+            }
         }
+    }
 
-        fn backing() -> Vec<u8> {
-            var_store(1, P_GUID, "Backing", 8)
-        }
+    /// A condition in a form that ParseOpCodes may skip reads a question of that form, which
+    /// ParseOpCodes parses with it: After, grayed out where First holds 1, is undetermined by the
+    /// DISABLE_IF around its form alone, as where First is in a form before it, and set writes it
+    /// with disabled questions included.
+    #[test]
+    fn a_condition_in_an_undetermined_form_reads_a_question_of_that_form() {
+        for (case, same_form) in [
+            ("First in After's form", true),
+            ("First in the form before", false),
+        ] {
+            let gate = checkbox_at(3, 3, 1, 0);
+            let first = checkbox_at(5, 5, 1, 2);
+            let after = conditional(GRAY_OUT_IF, eq_id_val_of(5, 1), &[checkbox_at(4, 4, 1, 1)]);
+            let (gate_form, after_form) = match same_form {
+                true => (form(1, &[gate]), form(2, &[first, after])),
+                false => (form(1, &[gate, first]), form(2, &[after])),
+            };
+            let hiidb = form_set_list_hiidb(&[
+                gate_form,
+                conditional(DISABLE_IF, eq_id_val_of(3, 1), &[after_form]),
+            ]);
+            let variables = setup_holding(&[0; 4]);
 
-        fn name_value() -> Vec<u8> {
-            var_store_name_value(3, N_GUID)
+            assert_eq!(
+                got_with(&hiidb, "After", IncludedStates::empty(), &variables),
+                Ok(vec![format!("0 <selectable or disabled: {NOT_CONSTANT}>")]),
+                "{case}: get After"
+            );
+            assert_eq!(
+                set_with(&hiidb, "After", IncludedStates::DISABLED, &variables),
+                Ok(()),
+                "{case}: set After, including disabled questions"
+            );
+            assert_eq!(
+                variables.writes_to(&setup()),
+                [(1, vec![1])],
+                "{case}: writes"
+            );
         }
+    }
 
-        /// The PASSWORD on Pin, VarStoreId `var_store_id`.
-        fn password(var_store_id: u16) -> Vec<u8> {
-            password_on(3, 3, var_store_id, 4)
-        }
+    /// Why After may be skipped after a true `op`, which UEFI 2.11 has do `role` instead.
+    fn after_true(op: &str, role: &str) -> String {
+        after_hiding(op, "TRUE", role)
+    }
 
-        /// A VARSTORE_NAME_VALUE op that ends after its VarStoreId 3, before its Guid.
-        fn short_name_value() -> Vec<u8> {
-            operation(VAR_STORE_NAME_VALUE, false, &3u16.to_le_bytes())
-        }
+    /// Why After may be skipped after an `op` whose condition is `condition`, which UEFI 2.11 has
+    /// do `role` instead.
+    fn after_hiding(op: &str, condition: &str, role: &str) -> String {
+        format!(
+            "it is after an {op} in the scope of a DISABLE_IF of its FormSet, whose condition is \
+             {condition}: edk2-stable202608 SetupBrowserDxe/IfrParse.c takes that condition for \
+             the DISABLE_IF's, which may skip the rest of its scope (:1690-1704, :3045-3059), \
+             where UEFI 2.11 {role}"
+        )
     }
 
-    /// A PASSWORD that edk2 may route to a VARSTORE_NAME_VALUE, whose values its driver exposes,
-    /// as UEFI 2.11 §33.2.5.6 says, through EFI_HII_CONFIG_ACCESS_PROTOCOL, in storage of its own
-    /// choosing, may keep its password in any variable, also one that another package list
-    /// declares, as one driver may publish several (edk2-stable202608 DriverSample.c installs one
-    /// EFI_HII_CONFIG_ACCESS_PROTOCOL for two package lists, :1870-1918). So
-    /// through variables that read anything, get, set and the snapshot refuse the whole HiiDB, as
-    /// for IFR without an op boundary, set writing nothing, also with UnsafeOperations::Allow,
-    /// whose flag lifts no withholding and which the refusal does not name; list-questions reads
-    /// without efivars; through BootServices the HiiDB is refused as before. Each layout names the
-    /// record that the refusal holds. edk2 routes the PASSWORD there by a VARSTORE_NAME_VALUE of
-    /// its VarStoreId in its FormSet, before or after it, under a condition, beside it in a
-    /// disabled form, also after a VarStore of its id outside any FormSet, and for one whose
-    /// question header lies past its op; by the first VarStore of its id in its form package, in
-    /// another FormSet, outside any FormSet, before or after every FormSet, or in an unknown scope,
-    /// also for a PASSWORD outside any FormSet, in IFR that uefisettings ignores, or whose question
-    /// header lies past its op; for one without a header, by one of any id in its FormSet or the
-    /// first of any id in its form package, in a FormSet or outside any; and by one that does not
-    /// decode, as edk2 creates its storage whatever its Length
-    /// (SetupBrowserDxe/IfrParse.c:1885-1895, ConfigKeywordHandler.c:1547-1550): in an unknown op
-    /// of its FormSet, outside any FormSet, or in IFR that uefisettings ignores.
+    /// ParseOpCodes takes the condition of a SUPPRESS_IF, GRAY_OUT_IF or VALUE in the scope of a
+    /// DISABLE_IF outside forms for the DISABLE_IF's, so a true one skips the rest of that scope,
+    /// After, in the DISABLE_IFs nested there too, unless a DISABLE_IF ends between them
+    /// (:2654-2655, :3007-3014), where UEFI 2.11 has it only hide, gray out or give a value; so
+    /// may one whose condition is not known: whether a browser parses After is not known, so set
+    /// refuses to write it. First, before it, is a question, as After is after a false
+    /// SUPPRESS_IF, without one, and after a DISABLE_IF that holds a true one, as ParseOpCodes
+    /// skips to that DISABLE_IF's END only (:1395-1410).
     #[test]
-    fn passwords_that_edk2_may_route_to_a_name_value_store_close_every_variable() {
-        type I = NameValueIfr;
-        // a CHECKBOX op ending after 4 of the 12 bytes of its data, which disables its form
-        let disabler = || operation(CHECKBOX, false, &[0x00; 4]);
-        // a PASSWORD op of Prompt 3 and Help 4 whose question header runs on into the SUBTITLE
-        // after it, VarStoreId 3 and VarStoreInfo 4 (QuestionId 0x0702: the SUBTITLE's header)
-        let header_past_op = || {
-            [
-                operation(PASSWORD, false, &[3, 0, 4, 0]),
-                operation(SUBTITLE, false, &[3, 0, 4, 0, 0]),
-            ]
-            .concat()
+    fn a_suppress_if_in_a_form_set_disable_if_leaves_the_forms_after_it_undetermined() {
+        let first = || form(1, &[checkbox_at(5, 5, 1, 0)]);
+        let after = || form(2, &[checkbox_at(4, 4, 1, 1)]);
+        let after_suppress_if = after_true("EFI_IFR_SUPPRESS_IF", "§33.3.8.3.75 has it only hide");
+        let after_value = after_true("EFI_IFR_VALUE", "§33.3.8.3.88 has it only give a value");
+        // Outside, a CHECKBOX outside forms whose scope holds a VALUE of TRUE
+        let outside_with_value = || {
+            let mut outside = checkbox_at(6, 6, 1, 2);
+            outside[1] |= 0x80;
+            [outside, value_of(ifr_true()), END.to_vec()].concat()
         };
-        let in_its_form_set = "PASSWORD question 0x0003 in FormSet \
-            11111111-1111-1111-1111-111111111111: HII name/value varstore requires \
-            EFI_HII_CONFIG_ACCESS_PROTOCOL";
-        let cases = [
-            (
-                "in its FormSet, before it",
-                vec![form_set(&[
-                    I::name_value(),
-                    I::backing(),
-                    form(1, &[I::c(), I::w(), I::b(), I::password(3)]),
-                ])],
-                in_its_form_set,
-            ),
-            (
-                "in its FormSet, after a VARSTORE of its id outside any FormSet",
-                vec![
-                    var_store(3, P_GUID, "Backing", 8),
-                    form_set(&[
-                        I::name_value(),
-                        I::backing(),
-                        form(1, &[I::c(), I::w(), I::b(), I::password(3)]),
-                    ]),
-                ],
-                in_its_form_set,
-            ),
-            (
-                "in its FormSet, after it",
-                vec![form_set(&[
-                    I::backing(),
-                    form(1, &[I::b(), I::password(3)]),
-                    I::name_value(),
-                    form(2, &[I::c(), I::w()]),
-                ])],
-                in_its_form_set,
-            ),
-            (
-                "under a SUPPRESS_IF of its FormSet",
-                vec![form_set(&[
-                    I::backing(),
-                    form(1, &[I::b(), I::password(3)]),
-                    conditional(SUPPRESS_IF, ifr_true(), &[I::name_value()]),
-                ])],
-                in_its_form_set,
-            ),
-            (
-                "beside it in a disabled form",
-                vec![form_set(&[
-                    I::name_value(),
-                    I::backing(),
-                    form(1, &[I::c(), I::w(), I::b()]),
-                    form(2, &[I::password(3), disabler()]),
-                ])],
-                in_its_form_set,
-            ),
-            (
-                "beside its form under a SUPPRESS_IF of its FormSet",
-                vec![form_set(&[
-                    I::name_value(),
-                    I::backing(),
-                    form(1, &[I::c(), I::w(), I::b()]),
-                    conditional(SUPPRESS_IF, ifr_true(), &[form(2, &[I::password(3)])]),
-                ])],
-                in_its_form_set,
-            ),
-            (
-                "the first VarStore of its id in its form package, in another FormSet",
-                vec![
-                    form_set_with_guid(
-                        [0x12; 16],
-                        &[
-                            I::name_value(),
-                            I::backing(),
-                            form(1, &[I::c(), I::w(), I::b()]),
-                        ],
-                    ),
-                    form_set(&[
-                        var_store(3, P_GUID, "Backing", 8),
-                        form(2, &[I::password(3)]),
-                    ]),
-                ],
-                "the first VarStore of its VarStoreId in its form package, which edk2's Config \
-                 Keyword Handler takes, is a VARSTORE_NAME_VALUE",
-            ),
-            (
-                "outside any FormSet",
-                vec![
-                    I::name_value(),
-                    form_set(&[
-                        I::backing(),
-                        var_store(3, P_GUID, "Backing", 8),
-                        form(1, &[I::b(), I::password(3)]),
-                    ]),
-                ],
-                "a VARSTORE_NAME_VALUE outside a FormSet, at offset 0 of a form package, \
-                 declares its VarStoreId",
-            ),
-            (
-                "in an unknown scope of another FormSet",
-                vec![
-                    form_set_with_guid(
-                        [0x12; 16],
-                        &[in_unknown_scope(&I::name_value()), form(1, &[])],
-                    ),
-                    form_set(&[
-                        I::backing(),
-                        var_store(3, P_GUID, "Backing", 8),
-                        form(1, &[I::b(), I::password(3)]),
-                    ]),
-                ],
-                "a VARSTORE_NAME_VALUE in the scope of an unknown opcode",
-            ),
-            (
-                "an undecodable one in an unknown op of its FormSet, beside a PASSWORD on Backing",
-                vec![form_set(&[
-                    nested(&operation(0x70, true, &[]), 1, &[I::short_name_value()]),
-                    I::backing(),
-                    form(1, &[I::b(), I::password(1)]),
-                ])],
-                "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: \
-                 failed to parse VarStoreNameValue's data",
-            ),
-            (
-                "of its id, the PASSWORD outside any FormSet",
-                vec![
-                    I::password(3),
-                    form_set(&[
-                        I::name_value(),
-                        I::backing(),
-                        form(1, &[I::c(), I::w(), I::b()]),
-                    ]),
-                ],
-                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
-                 FormSet, at offset 0 of a form package",
-            ),
-            (
-                "of its id outside any FormSet, the PASSWORD outside any FormSet too",
-                vec![
-                    I::name_value(),
-                    I::password(3),
-                    form_set(&[I::backing(), form(1, &[I::b(), I::p()])]),
-                ],
-                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
-                 FormSet, at offset 20 of a form package",
-            ),
-            (
-                "of its id after every FormSet, the PASSWORD outside any FormSet",
-                vec![
-                    form_set(&[I::backing(), form(1, &[I::b(), I::p()])]),
-                    I::password(3),
-                    I::name_value(),
-                ],
-                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
-                 FormSet, at offset ",
-            ),
-            (
-                "of its id, the PASSWORD's question header past its op",
-                vec![form_set(&[
-                    I::name_value(),
-                    I::backing(),
-                    form(1, &[I::c(), I::w(), I::b()]),
-                    form(2, &[header_past_op()]),
-                ])],
-                "PASSWORD question 0x0702 in FormSet 11111111-1111-1111-1111-111111111111: its \
-                 op ends before its question header",
-            ),
-            (
-                "of its id in its FormSet, after a VARSTORE of its id outside any FormSet, the \
-                 PASSWORD's question header past its op",
-                vec![
-                    var_store(3, P_GUID, "Backing", 8),
-                    form_set(&[
-                        I::name_value(),
-                        I::backing(),
-                        form(1, &[I::c(), I::w(), I::b()]),
-                        form(2, &[header_past_op()]),
-                    ]),
-                ],
-                "PASSWORD question 0x0702 in FormSet 11111111-1111-1111-1111-111111111111: its \
-                 op ends before its question header",
+        for (case, list, want_set) in [
+            (
+                "after a true SUPPRESS_IF",
+                vec![first(), conditional(SUPPRESS_IF, ifr_true(), &[]), after()],
+                Err(after_undetermined(&after_suppress_if)),
             ),
             (
-                "beside a PASSWORD without its question header",
-                vec![form_set(&[
-                    I::name_value(),
-                    I::backing(),
-                    form(1, &[I::c(), I::w(), I::b()]),
-                    form(2, &[operation(PASSWORD, false, &[3, 0, 4, 0])]),
-                ])],
-                "PASSWORD op without a question header in FormSet \
-                 11111111-1111-1111-1111-111111111111",
+                "after a true GRAY_OUT_IF",
+                vec![first(), conditional(GRAY_OUT_IF, ifr_true(), &[]), after()],
+                Err(after_undetermined(&after_true(
+                    "EFI_IFR_GRAY_OUT_IF",
+                    "§33.3.8.3.28 has it only gray out",
+                ))),
             ),
             (
-                "beside a PASSWORD without its question header, after a VARSTORE of its id \
-                 outside any FormSet",
+                "a true SUPPRESS_IF, then After in an inner DISABLE_IF",
                 vec![
-                    var_store(3, P_GUID, "Backing", 8),
-                    form_set(&[
-                        I::name_value(),
-                        I::backing(),
-                        form(1, &[I::c(), I::w(), I::b()]),
-                        form(2, &[operation(PASSWORD, false, &[3, 0, 4, 0])]),
-                    ]),
+                    first(),
+                    conditional(SUPPRESS_IF, ifr_true(), &[]),
+                    conditional(DISABLE_IF, ifr_false(), &[after()]),
                 ],
-                "PASSWORD op without a question header in FormSet \
-                 11111111-1111-1111-1111-111111111111",
+                Err(after_undetermined(&after_suppress_if)),
             ),
             (
-                "beside a PASSWORD outside any FormSet without its question header",
+                "a true SUPPRESS_IF in an inner DISABLE_IF, then After",
                 vec![
-                    form_set(&[I::name_value(), I::backing(), form(1, &[I::b(), I::p()])]),
-                    operation(PASSWORD, false, &[3, 0, 4, 0]),
+                    first(),
+                    conditional(
+                        DISABLE_IF,
+                        ifr_false(),
+                        &[conditional(SUPPRESS_IF, ifr_true(), &[])],
+                    ),
+                    after(),
                 ],
-                "PASSWORD op of package list 55555555-5555-5555-5555-555555555555 outside a \
-                 FormSet, at offset ",
+                Ok(()),
             ),
             (
-                "an undecodable one outside any FormSet, beside a PASSWORD on Backing",
+                "a DISABLE_IF ends, then a true SUPPRESS_IF, then After",
                 vec![
-                    I::short_name_value(),
-                    form_set(&[I::backing(), form(1, &[I::b(), I::password(1)])]),
+                    conditional(DISABLE_IF, ifr_false(), &[first()]),
+                    conditional(SUPPRESS_IF, ifr_true(), &[]),
+                    after(),
                 ],
-                "may name the VarStoreId of the op at offset 0 of a form package, a malformed \
-                 EFI_IFR_VARSTORE_NAME_VALUE outside a FormSet",
+                Ok(()),
             ),
             (
-                "an undecodable one in a FormSet that uefisettings ignores",
+                "a DISABLE_IF in First's form ends, then a true SUPPRESS_IF, then After",
                 vec![
-                    form_set(&[I::backing(), form(1, &[I::b()])]),
-                    form_set_with_guid(
-                        [0x12; 16],
-                        &[I::short_name_value(), form(2, &[I::password(3)])],
+                    form(
+                        1,
+                        &[conditional(
+                            DISABLE_IF,
+                            ifr_false(),
+                            &[checkbox_at(5, 5, 1, 0)],
+                        )],
                     ),
+                    conditional(SUPPRESS_IF, ifr_true(), &[]),
+                    after(),
                 ],
-                "the EFI_IFR_VARSTORE_NAME_VALUE op at offset",
+                Ok(()),
             ),
             (
-                "of its id, the PASSWORD in a FormSet that uefisettings ignores",
+                "a true DISABLE_IF ends, then a true SUPPRESS_IF, then After",
                 vec![
-                    form_set(&[
-                        I::name_value(),
-                        I::backing(),
-                        form(1, &[I::c(), I::w(), I::b()]),
-                    ]),
-                    form_set_with_guid(
-                        [0x12; 16],
-                        &[
-                            operation(DEFAULT_STORE, false, &[0x00, 0x00]),
-                            form(2, &[I::password(3)]),
-                        ],
+                    first(),
+                    conditional(
+                        DISABLE_IF,
+                        ifr_true(),
+                        &[form(3, &[checkbox_at(1, 1, 1, 2)])],
                     ),
+                    conditional(SUPPRESS_IF, ifr_true(), &[]),
+                    after(),
                 ],
-                "the PASSWORD op there, which edk2 may route to a VARSTORE_NAME_VALUE of its \
-                 form package",
-            ),
-        ];
-        for (case, ifr, record) in cases {
-            assert_closes_every_variable(case, &ifr, record);
-        }
-    }
-
-    /// Through Runtime, get of B and O of the name_value_hiidb of `ifr`, from the snapshot too, and
-    /// set of O with UnsafeOperations::Allow refuse the HiiDB with AnyVariablePasswords naming
-    /// `record`, set writing nothing; list-questions reads without efivars; through BootServices
-    /// get refuses it as for a PASSWORD whose VarStore is unknown.
-    fn assert_closes_every_variable(case: &str, ifr: &[Vec<u8>], record: &str) {
-        let hiidb = name_value_hiidb(ifr);
-        let runtime = name_value_variables(VariableReach::Runtime);
-        let refused = |error: Option<&String>| {
-            error.is_some_and(|error| error.contains(record) && error.ends_with(ANY_VARIABLE))
-        };
-
-        for question in ["B", "O"] {
-            let got = name_value_get(&hiidb, question, &runtime, None);
-            assert!(
-                refused(got.as_ref().err()),
-                "{case}: Runtime: get {question}: {got:?}"
-            );
-            let snapshot = name_value_snapshot();
-            let got = name_value_get(&hiidb, question, &runtime, Some(&snapshot));
-            assert!(
-                refused(got.as_ref().err())
-                    && got.as_ref().is_err_and(|error| !error.contains("31323")),
-                "{case}: Runtime, with the snapshot: get {question}: {got:?}"
-            );
-        }
-        let set = set_bypassing(&hiidb, "O", "5", &runtime);
-        assert!(
-            refused(set.as_ref().err())
-                && set
-                    .as_ref()
-                    .is_err_and(|error| !error.contains(UNSAFE_OPERATIONS_FLAG)),
-            "{case}: Runtime, with UnsafeOperations::Allow: set O: {set:?}"
-        );
-        for (name, guid) in [("Backing", P_GUID), ("Other", OTHER_GUID)] {
-            let key = VariableKey {
-                name: name.to_owned(),
-                guid: Guid::from(guid),
-            };
-            assert_eq!(runtime.writes_to(&key), [], "{case}: writes to {name}");
-        }
-        let listed = HiiBackend::list_questions_in(
-            &hiidb,
-            &ListQuestionsOptions::default(),
-            EfivarSource::Disabled
-                .into_variables()
-                .expect("variables that read nothing"),
-            None,
-            None,
-        )
-        .map(|questions| {
-            questions
-                .into_iter()
-                .map(|question| question.name)
-                .filter(|name| ["B", "O"].contains(&name.as_str()))
-                .collect::<Vec<_>>()
-        })
-        .map_err(|error| format!("{error:#}"));
-        assert_eq!(
-            listed,
-            Ok(vec!["B".to_owned(), "O".to_owned()]),
-            "{case}: list-questions without efivars"
-        );
-        let boot_services = name_value_variables(VariableReach::BootServices);
-        let got = name_value_get(&hiidb, "O", &boot_services, None);
-        assert!(
-            got.as_ref()
-                .is_err_and(|error| error.ends_with(BOOT_SERVICES_REFUSAL)),
-            "{case}: BootServices: get O: {got:?}"
-        );
-    }
-
-    /// The middle of the record of a PASSWORD of VarStoreId 0 (UnresolvedPassword::OwnDriver).
-    const OWN_DRIVER: &str =
-        "VarStoreId 0 names no VarStore, so its callbacks or READ and WRITE ops \
-         keep its password where uefisettings cannot tell";
-
-    /// A PASSWORD of VarStoreId 0 names no VarStore (UEFI 2.11 §33.3.8.2.2): its callbacks or READ
-    /// and WRITE ops (§33.2.5.6) keep its password where uefisettings cannot tell, so in any
-    /// variable, EFI_IFR_FLAG_CALLBACK or not, with no VARSTORE_NAME_VALUE in the HiiDB. So get,
-    /// set and the snapshot refuse the whole HiiDB as for a PASSWORD that edk2 may route to a
-    /// VARSTORE_NAME_VALUE: one in a form or a disabled form of its FormSet, one without MaxSize,
-    /// outside any FormSet, in a FormSet that uefisettings ignores, one whose question header past
-    /// its op names VarStoreId 0, and one without a question header, whose VarStoreId may be 0,
-    /// also in a FormSet that uefisettings ignores. Each names its record.
-    #[test]
-    fn passwords_of_var_store_id_0_close_every_variable() {
-        type I = NameValueIfr;
-        let password_of = |flags: u8, sizes: &[u16]| {
-            let sizes = sizes.iter().flat_map(|size| size.to_le_bytes());
-            let data = [question_header_with(3, 3, 0, 0, flags), sizes.collect()].concat();
-            operation(PASSWORD, false, &data)
-        };
-        // a CHECKBOX op ending after 4 of the 12 bytes of its data, which disables its form
-        let disabler = || operation(CHECKBOX, false, &[0x00; 4]);
-        // a PASSWORD op of Prompt 3 and Help 4 whose question header runs on into the SUBTITLE
-        // after it, VarStoreId 0 and VarStoreInfo 4 (QuestionId 0x0702: the SUBTITLE's header)
-        let header_past_op = [
-            operation(PASSWORD, false, &[3, 0, 4, 0]),
-            operation(SUBTITLE, false, &[0, 0, 4, 0, 0]),
-        ]
-        .concat();
-        let backing_with = |forms: &[Vec<u8>]| {
-            let first = form(1, &[I::b(), I::p()]);
-            form_set(&[[I::backing(), first].as_slice(), forms].concat())
-        };
-        // a FormSet that uefisettings ignores, for its short DEFAULTSTORE op, with `password`
-        let ignored_with = |password: Vec<u8>| {
-            form_set_with_guid(
-                [0x12; 16],
-                &[
-                    operation(DEFAULT_STORE, false, &[0x00, 0x00]),
-                    form(2, &[password]),
-                ],
-            )
-        };
-        let in_its_form_set: &str = &format!(
-            "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: {OWN_DRIVER}"
-        );
-        let outside: &str = &format!("PASSWORD question 0x0003 in FormSet ?: {OWN_DRIVER}");
-        let cases = [
-            (
-                "in its form",
-                vec![form_set(&[
-                    I::backing(),
-                    form(1, &[I::b(), I::p(), I::password(0)]),
-                ])],
-                in_its_form_set,
-            ),
-            (
-                "of EFI_IFR_FLAG_CALLBACK",
-                vec![backing_with(&[form(2, &[password_of(0x04, &[1, 20])])])],
-                in_its_form_set,
-            ),
-            (
-                "without MaxSize",
-                vec![backing_with(&[form(2, &[password_of(0x00, &[1])])])],
-                in_its_form_set,
+                Ok(()),
             ),
             (
-                "in a disabled form",
-                vec![backing_with(&[form(2, &[I::password(0), disabler()])])],
-                in_its_form_set,
+                "a true SUPPRESS_IF, then a DISABLE_IF ends, then After",
+                vec![
+                    first(),
+                    conditional(SUPPRESS_IF, ifr_true(), &[]),
+                    conditional(
+                        DISABLE_IF,
+                        ifr_false(),
+                        &[form(3, &[checkbox_at(1, 1, 1, 2)])],
+                    ),
+                    after(),
+                ],
+                Err(after_undetermined(&after_suppress_if)),
             ),
             (
-                "outside any FormSet",
-                vec![I::password(0), backing_with(&[])],
-                outside,
+                "a DISABLE_IF ends, then After after a true SUPPRESS_IF in another",
+                vec![
+                    first(),
+                    conditional(
+                        DISABLE_IF,
+                        ifr_false(),
+                        &[form(3, &[checkbox_at(1, 1, 1, 2)])],
+                    ),
+                    conditional(
+                        DISABLE_IF,
+                        ifr_false(),
+                        &[conditional(SUPPRESS_IF, ifr_true(), &[]), after()],
+                    ),
+                ],
+                Err(after_undetermined(&after_suppress_if)),
             ),
             (
-                "in a FormSet that uefisettings ignores",
-                vec![backing_with(&[]), ignored_with(I::password(0))],
-                outside,
+                "after a VALUE of TRUE in a question outside forms",
+                vec![first(), outside_with_value(), after()],
+                Err(after_undetermined(&after_value)),
             ),
             (
-                "its question header past its op",
-                vec![backing_with(&[form(2, &[header_past_op])])],
-                "PASSWORD question 0x0702 in FormSet 11111111-1111-1111-1111-111111111111: its \
-                 op ends before its question header",
+                "after a VALUE of TRUE outside forms",
+                vec![first(), value_of(ifr_true()), after()],
+                Err(after_undetermined(&after_value)),
             ),
             (
-                "without its question header",
-                vec![backing_with(&[form(
-                    2,
-                    &[operation(PASSWORD, false, &[3, 0, 4, 0])],
-                )])],
-                "PASSWORD op without a question header in FormSet \
-                 11111111-1111-1111-1111-111111111111",
+                "a DISABLE_IF ends, then a VALUE of TRUE outside forms, then After",
+                vec![
+                    first(),
+                    conditional(
+                        DISABLE_IF,
+                        ifr_false(),
+                        &[form(3, &[checkbox_at(1, 1, 1, 2)])],
+                    ),
+                    value_of(ifr_true()),
+                    after(),
+                ],
+                Ok(()),
             ),
             (
-                "without its question header, in a FormSet that uefisettings ignores",
+                "after a SUPPRESS_IF that is not constant",
                 vec![
-                    backing_with(&[]),
-                    ignored_with(operation(PASSWORD, false, &[3, 0, 4, 0])),
+                    first(),
+                    conditional(SUPPRESS_IF, eq_id_val_of(5, 1), &[]),
+                    after(),
                 ],
-                "the PASSWORD op there, whose question header does not parse, so whose \
-                 VarStoreId may be 0, which names no VarStore",
+                Err(after_undetermined(&after_hiding(
+                    "EFI_IFR_SUPPRESS_IF",
+                    &format!("not known: {NOT_CONSTANT}"),
+                    "§33.3.8.3.75 has it only hide",
+                ))),
             ),
-        ];
-        for (case, ifr, record) in cases {
-            assert_closes_every_variable(case, &ifr, record);
+            (
+                "after a false SUPPRESS_IF",
+                vec![first(), conditional(SUPPRESS_IF, ifr_false(), &[]), after()],
+                Ok(()),
+            ),
+            ("without a SUPPRESS_IF", vec![first(), after()], Ok(())),
+        ] {
+            let hiidb = form_set_list_hiidb(&[conditional(DISABLE_IF, ifr_false(), &list)]);
+            let variables = setup_holding(&[0; 4]);
+
+            assert_eq!(
+                set_with(&hiidb, "First", IncludedStates::empty(), &variables),
+                Ok(()),
+                "{case}: set First"
+            );
+            let want_writes = match want_set {
+                Ok(()) => vec![(0, vec![1]), (1, vec![1])],
+                Err(_) => vec![(0, vec![1])],
+            };
+            assert_eq!(
+                set_with(&hiidb, "After", IncludedStates::empty(), &variables),
+                want_set,
+                "{case}: set After"
+            );
+            assert_eq!(variables.writes_to(&setup()), want_writes, "{case}: writes");
         }
     }
 
-    /// A STRING beside a PASSWORD of VarStoreId 0, EFI_IFR_FLAG_CALLBACK or not, is refused like the
-    /// NUMERICs: get, also with the ExportConfig snapshot, and set with UnsafeOperations::Allow
-    /// fail before any variable read, through Runtime naming the PASSWORD's record and through
-    /// BootServices as for a PASSWORD whose VarStore is unknown; beside a PASSWORD on Backing that
-    /// ends before it, get reads it.
-    #[test]
-    fn a_string_beside_a_password_of_var_store_id_0_reads_no_variable() {
-        type I = NameValueIfr;
-        // the STRING P at bytes 4..8 of Backing, of 0 to 2 characters
-        let string = || string_on(8, 8, (1, 4), (0, 2), &[]);
-        let hiidb_beside = |var_store_id: u16, flags: u8| {
-            let password = [
-                question_header_with(3, 3, var_store_id, 0, flags),
-                [1u16, 2]
-                    .iter()
-                    .flat_map(|size| size.to_le_bytes())
-                    .collect(), // MinSize, MaxSize
-            ]
-            .concat();
-            let password = operation(PASSWORD, false, &password);
-            name_value_hiidb(&[form_set(&[
-                I::backing(),
-                form(1, &[I::b(), string(), password]),
-            ])])
+    /// A HiiDB with a PASSWORD on AMITSESetup at bytes 0..40 in a form under a true DISABLE_IF
+    /// outside forms, and Q, P at byte 80 and O at byte 10, inside the password's bytes, in a form
+    /// after it. `password_store` declares AMITSESetup as VarStore 2 in that DISABLE_IF's scope,
+    /// or before it if None; then VarStore 5 declares it again after the DISABLE_IF, for P. O is
+    /// on VarStore `o_store`. Its keywords are its prompts with "Key" after them.
+    fn disabled_password_hiidb(password_store: Option<PasswordStore>, o_store: u16) -> Vec<u8> {
+        let amitse_setup = |id| var_store(id, [0x44; 16], "AMITSESetup", 81);
+        let password_form = form(2, &[password_on(3, 3, 2, 0)]);
+        let (before, disabled, after, p_store) = match password_store {
+            None => (
+                vec![amitse_setup(2)],
+                conditional(DISABLE_IF, ifr_true(), &[password_form]),
+                vec![],
+                2,
+            ),
+            Some(PasswordStore::InTheDisableIf) => (
+                vec![],
+                conditional(DISABLE_IF, ifr_true(), &[amitse_setup(2), password_form]),
+                vec![amitse_setup(5)],
+                5,
+            ),
+            Some(PasswordStore::InANestedDisableIf) => (
+                vec![],
+                conditional(
+                    DISABLE_IF,
+                    ifr_false(),
+                    &[conditional(
+                        DISABLE_IF,
+                        ifr_true(),
+                        &[amitse_setup(2), password_form],
+                    )],
+                ),
+                vec![amitse_setup(5)],
+                5,
+            ),
         };
-        let record = format!(
-            "PASSWORD question 0x0003 in FormSet 11111111-1111-1111-1111-111111111111: {OWN_DRIVER}"
+        let questions = form(
+            1,
+            &[
+                checkbox_on(1, 1, 1),
+                checkbox_at(2, 2, p_store, 80),
+                checkbox_at(4, 4, o_store, 10),
+            ],
         );
+        let ifr = [
+            vec![var_store_efi(1, "Setup", NV_BS_RT, 1)],
+            before,
+            vec![disabled],
+            after,
+            vec![questions],
+        ]
+        .concat();
+        let packages = [
+            form_package(&ifr),
+            en_strings_package_of(&["Q", "P", "Password", "O"]),
+            strings_package_of(b"x-UEFI-ns", &["QKey", "PKey", "PasswordKey", "OKey"]),
+            END_PACKAGE.to_vec(),
+        ];
+        package_list_with_guid([0x55; 16], &packages.concat())
+    }
 
-        for flags in [0x00, 0x04] {
-            let hiidb = hiidb_beside(0, flags);
-            for (reach, end) in [
-                (VariableReach::Runtime, ANY_VARIABLE),
-                (VariableReach::BootServices, BOOT_SERVICES_REFUSAL),
-            ] {
-                let case = format!("Flags {flags:#04x}, {reach:?}");
-                let refused = |error: Option<&String>| {
-                    error.is_some_and(|error| error.contains(&record) && error.ends_with(end))
-                };
-                let variables = name_value_variables(reach);
-                let got = name_value_get(&hiidb, "P", &variables, None);
-                assert!(refused(got.as_ref().err()), "{case}: get P: {got:?}");
-                let snapshot = name_value_snapshot();
-                let got = name_value_get(&hiidb, "P", &variables, Some(&snapshot));
-                assert!(
-                    refused(got.as_ref().err()),
-                    "{case}, with the snapshot: get P: {got:?}"
-                );
-                let set = set_bypassing(&hiidb, "P", "ab", &variables);
-                assert!(refused(set.as_ref().err()), "{case}: set P: {set:?}");
-                assert_eq!(variables.reads(), [], "{case}: reads");
-                for (name, guid) in [("Backing", P_GUID), ("Other", OTHER_GUID)] {
-                    let key = VariableKey {
-                        name: name.to_owned(),
-                        guid: Guid::from(guid),
-                    };
-                    assert_eq!(variables.writes_to(&key), [], "{case}: writes to {name}");
-                }
-            }
-        }
-
-        let variables = name_value_variables(VariableReach::Runtime);
-        assert_eq!(
-            name_value_get(&hiidb_beside(1, 0x00), "P", &variables, None),
-            Ok(vec!["\u{2211}".to_owned()]),
-            "beside a password on Backing: get P"
-        );
+    /// Where disabled_password_hiidb declares the PASSWORD's VarStore.
+    #[derive(Debug, Clone, Copy)]
+    enum PasswordStore {
+        /// In the true DISABLE_IF's scope
+        InTheDisableIf,
+        /// In the scope of a true DISABLE_IF nested in a false one
+        InANestedDisableIf,
     }
 
-    /// A PASSWORD that edk2 does not route to a VARSTORE_NAME_VALUE keeps its password where its
-    /// IFR says, so through Runtime its bytes alone are withheld, beside one: one on its FormSet's
-    /// VARSTORE of an id that a VARSTORE_NAME_VALUE of a later FormSet declares (VarStoreIds are
-    /// unique within a form set, §33.3.8.3.90), which edk2 takes first, or one outside any FormSet
-    /// after it: edk2-stable202608 SetupBrowserDxe/IfrParse.c gives a question the VarStore of its
-    /// id in its FormSet (:136-146), and ConfigKeywordHandler.c FindStorageFromVarId the first of
-    /// the id in its form package (:1520-1567); one outside any FormSet of an id whose first
-    /// VarStore in its form package is a VARSTORE, beside a VARSTORE_NAME_VALUE of the id in
-    /// another form package, which FindStorageFromVarId does not walk; one on a buffer VarStore
-    /// beside a VARSTORE_NAME_VALUE of another id, in its FormSet or, for a PASSWORD outside any
-    /// FormSet, in its form package, in a FormSet or outside any. P over the password's bytes
-    /// shows withheld, B beside them and O of the other list show. The snapshot answers the
-    /// questions of the VARSTORE_NAME_VALUE, where the layout has W, unless the PASSWORD is
-    /// unresolved, and so does BootServices.
+    /// A PASSWORD in a form under a true DISABLE_IF outside forms keeps its bytes withheld,
+    /// whatever the reach and wherever its VarStore is declared: O, whose bytes overlap them, is
+    /// read and written by no prompt and no keyword, with every --include and
+    /// UnsafeOperations::Allow, while P is.
     #[test]
-    fn passwords_that_edk2_does_not_route_to_a_name_value_store_keep_withholding_their_bytes() {
-        type I = NameValueIfr;
-        let unavailable = "<ValueUnavailable: HII name/value varstore requires \
-                           EFI_HII_CONFIG_ACCESS_PROTOCOL>";
-        let shown = "31323 <snapshot>";
-        // FormSet 0x11 with the PASSWORD of VarStoreId 3 on its VARSTORE 3, Backing too
-        let own_var_store = || {
-            form_set(&[
-                I::backing(),
-                var_store(3, P_GUID, "Backing", 8),
-                form(1, &[I::b(), I::p(), I::password(3)]),
-            ])
-        };
-        let cases = [
-            (
-                "its FormSet's VARSTORE first, a later FormSet's VARSTORE_NAME_VALUE",
-                name_value_hiidb(&[
-                    own_var_store(),
-                    form_set_with_guid([0x12; 16], &[I::name_value(), form(2, &[I::w()])]),
-                ]),
-                ["31323", WITHHELD],
-                Some(shown),
-            ),
+    fn a_password_under_a_true_form_set_disable_if_stays_withheld() {
+        let withheld = format!("{PASSWORD_BYTES} <IFR default: 0>");
+        let no_store_2 = "<ValueUnavailable: no supported varstore with matching id 0x0002 found> \
+                          <IFR default: 0>";
+        let password_bytes = "holds a password at bytes 0..40, which set never writes";
+        let no_var_store = "no supported varstore with matching id 0x0002";
+        for (case, password_store, o_store, want_o, want_refusal) in [
             (
-                "its FormSet's VARSTORE first, a VARSTORE_NAME_VALUE outside any FormSet after it",
-                name_value_hiidb(&[own_var_store(), I::name_value()]),
-                ["31323", WITHHELD],
+                "its VarStore before the DISABLE_IF",
                 None,
+                2,
+                withheld.as_str(),
+                password_bytes,
             ),
             (
-                "outside any FormSet, its form package's VARSTORE first, a VARSTORE_NAME_VALUE in \
-                 another form package",
-                name_value_hiidb_of_packages(&[
-                    [
-                        I::password(3),
-                        form_set(&[
-                            I::backing(),
-                            var_store(3, P_GUID, "Backing", 8),
-                            form(1, &[I::b(), I::p()]),
-                        ]),
-                    ]
-                    .concat(),
-                    form_set_with_guid([0x12; 16], &[I::name_value(), form(2, &[I::w()])]),
-                ]),
-                ["31323", WITHHELD],
-                Some(unavailable),
+                "its VarStore in the DISABLE_IF, O on the later one",
+                Some(PasswordStore::InTheDisableIf),
+                5,
+                withheld.as_str(),
+                password_bytes,
             ),
             (
-                "on Backing, a VARSTORE_NAME_VALUE of another id in its FormSet",
-                name_value_hiidb(&[form_set(&[
-                    I::name_value(),
-                    I::backing(),
-                    form(1, &[I::c(), I::w(), I::b(), I::p(), I::password(1)]),
-                ])]),
-                ["31323", WITHHELD],
-                Some(shown),
+                "its VarStore in the DISABLE_IF, O on it",
+                Some(PasswordStore::InTheDisableIf),
+                2,
+                no_store_2,
+                no_var_store,
             ),
             (
-                "on Backing outside any FormSet, a VARSTORE_NAME_VALUE of another id",
-                name_value_hiidb(&[
-                    I::password(1),
-                    form_set(&[
-                        I::name_value(),
-                        I::backing(),
-                        form(1, &[I::c(), I::w(), I::b(), I::p()]),
-                    ]),
-                ]),
-                ["31323", WITHHELD],
-                Some(unavailable),
+                "its VarStore in a nested DISABLE_IF, O on the later one",
+                Some(PasswordStore::InANestedDisableIf),
+                5,
+                withheld.as_str(),
+                password_bytes,
             ),
             (
-                "on Backing outside any FormSet, a VARSTORE_NAME_VALUE of another id outside any \
-                 FormSet before it",
-                name_value_hiidb(&[
-                    I::name_value(),
-                    I::password(1),
-                    form_set(&[I::backing(), form(1, &[I::b(), I::p()])]),
-                ]),
-                ["31323", WITHHELD],
-                None,
+                "its VarStore in a nested DISABLE_IF, O on it",
+                Some(PasswordStore::InANestedDisableIf),
+                2,
+                no_store_2,
+                no_var_store,
             ),
-        ];
-        for (case, hiidb, [b, p], w) in cases {
-            let runtime = name_value_variables(VariableReach::Runtime);
-            let snapshot = name_value_snapshot();
-            let resolved = w == Some(shown);
+        ] {
+            let hiidb = disabled_password_hiidb(password_store, o_store);
+            for (reach, interface) in [
+                (VariableReach::Runtime, VariableInterface::Efivarfs),
+                (
+                    VariableReach::BootServices,
+                    VariableInterface::VariableServices,
+                ),
+            ] {
+                let variables = password_variables(reach, interface);
+                let options = GetOptions {
+                    include: IncludedStates::all(),
+                    ..GetOptions::default()
+                };
+                let keyword_got = HiiBackend::get_in(
+                    &hiidb,
+                    by_keyword("OKey", None),
+                    None,
+                    &options,
+                    shared(&variables),
+                    None,
+                    None,
+                    None,
+                )
+                .map(|got| {
+                    got.responses
+                        .into_iter()
+                        .map(|response| response.question.answer)
+                        .collect::<Vec<_>>()
+                })
+                .map_err(|error| format!("{error:#}"));
+                let options = SetOptions {
+                    include: IncludedStates::all(),
+                    unsafe_operations: UnsafeOperations::Allow,
+                    ..SetOptions::default()
+                };
+                let keyword_set = set_responses(
+                    &hiidb,
+                    by_keyword("OKey", None),
+                    &SetValue::Text("1".to_owned()),
+                    None,
+                    &options,
+                    SetAccess {
+                        reads: shared(&variables),
+                        writes: &*variables,
+                        held: None,
+                    },
+                    None,
+                )
+                .map(drop)
+                .map_err(|error| format!("{error:#}"));
 
-            for (question, want) in [("B", b), ("P", p), ("O", "4386")] {
                 assert_eq!(
-                    name_value_get(&hiidb, question, &runtime, None),
-                    Ok(vec![want.to_owned()]),
-                    "{case}: Runtime: get {question}"
+                    got_with(&hiidb, "O", IncludedStates::all(), &variables),
+                    Ok(vec![want_o.to_owned()]),
+                    "{case}, {reach:?}: get O"
                 );
-            }
-            if let Some(w) = w {
                 assert_eq!(
-                    name_value_get(&hiidb, "W", &runtime, Some(&snapshot)),
-                    Ok(vec![w.to_owned()]),
-                    "{case}: Runtime, with the snapshot: get W"
+                    keyword_got,
+                    Ok(vec![want_o.to_owned()]),
+                    "{case}, {reach:?}: get OKey"
+                );
+                let listed = names_and_answers(&hiidb, IncludedStates::all(), &variables);
+                assert!(
+                    listed.contains(&("O".to_owned(), want_o.to_owned())),
+                    "{case}, {reach:?}: list-questions O: {listed:?}"
+                );
+                let set = set_with(&hiidb, "O", IncludedStates::all(), &variables);
+                assert!(
+                    set.as_ref()
+                        .is_err_and(|error| error.contains(want_refusal)),
+                    "{case}, {reach:?}: set O: {set:?}"
+                );
+                assert!(
+                    keyword_set
+                        .as_ref()
+                        .is_err_and(|error| error.contains(want_refusal)),
+                    "{case}, {reach:?}: set OKey: {keyword_set:?}"
+                );
+                assert_eq!(
+                    set_with(&hiidb, "P", IncludedStates::all(), &variables),
+                    Ok(()),
+                    "{case}, {reach:?}: set P"
+                );
+                assert_eq!(
+                    variables.bytes(&amitse_setup()),
+                    Some([&NV_BS_RT.to_ne_bytes()[..], &[0xAA; 80], &[1]].concat()),
+                    "{case}, {reach:?}: AMITSESetup keeps its password bytes"
                 );
-            }
-            let boot_services = name_value_variables(VariableReach::BootServices);
-            let got = name_value_get(&hiidb, "O", &boot_services, None);
-            match resolved {
-                true => assert_eq!(got, Ok(vec!["4386".to_owned()]), "{case}: BootServices"),
-                false => assert!(
-                    got.as_ref()
-                        .is_err_and(|error| error.ends_with(BOOT_SERVICES_REFUSAL)),
-                    "{case}: BootServices: {got:?}"
-                ),
             }
         }
     }
diff --git a/src/lib/exports/linux.rs b/src/lib/exports/linux.rs
index a2acbb2..a37019f 100644
--- a/src/lib/exports/linux.rs
+++ b/src/lib/exports/linux.rs
@@ -34,6 +34,7 @@ use uefisettings_backend_thrift::SetResponse;
 use uefisettings_backend_thrift::SetResponseList;
 
 use super::CapsuleBackend;
+use super::DriverHeldValues;
 use super::DumpEfivarsOptions;
 use super::HiiBackend;
 use super::LiftedOperations;
@@ -61,6 +62,9 @@ use crate::firmware_width::FirmwareWidth;
 use crate::firmware_width::FW_PLATFORM_SIZE_PATH;
 use crate::hii::extract;
 use crate::hii::extract::HiiSourceOptions;
+use crate::hii::forms::IncludedStates;
+use crate::hii::forms::PasswordQuestions;
+use crate::hii::package;
 #[cfg(configuration_tables)]
 use crate::hii::system_vendor_table;
 use crate::hii::EfivarDump;
@@ -77,6 +81,7 @@ use crate::ilorest::requests;
 use crate::ilorest::requests::Ilo5Dev;
 use crate::ilorest::requests::IloDevice;
 use crate::ilorest::requests::RedfishAttributes;
+use crate::staged_set::next_boot::NextBootStaging;
 use crate::translation::ilo::get_qa_variations_ilo;
 use crate::translation::ilo::IloTranslation;
 use crate::translation::translate_response;
@@ -199,12 +204,22 @@ impl HiiBackend {
         source: &HiiSourceOptions,
         unsafe_operations: UnsafeOperations,
     ) -> Result<(Vec<u8>, Vec<UnsafeOperation>)> {
-        match SavedDump::read_given_hiidb(filename, efivars)? {
+        match Self::read_given_hiidb(filename, efivars)? {
             Some(db) => Ok((db, Vec::new())),
             None => extract::extract_db_from(source, unsafe_operations),
         }
     }
 
+    /// The HiiDB that read_hiidb reads without this machine: the file `filename` if given, else
+    /// the one that an efivars dump in `efivars` saved; None if neither gives one. A redacted dump
+    /// refuses another `filename`, as in read_hiidb.
+    pub fn read_given_hiidb(
+        filename: Option<&Path>,
+        efivars: &EfivarSource,
+    ) -> Result<Option<Vec<u8>>> {
+        SavedDump::read_given_hiidb(filename, efivars)
+    }
+
     /// set_using, in this machine's HiiDB read as `source` says, firmware-reserved memory only if
     /// options.unsafe_operations allows it, which it returns as lifted too, also with the error of
     /// what fails after the read (LiftedOperations); except that set and hii set on Linux with
@@ -581,3 +596,34 @@ fn compare_redfish_attributes(
     }
     map
 }
+
+/// What get and set do with a question whose driver holds its value: get reaches no driver here,
+/// and shows what the records of staged sets tell of it, which this machine's EFI variables hold;
+/// set stages it for the next boot.
+impl HiiBackend {
+    pub(super) fn driver_held_values(
+        _hiidb: &[u8],
+        efivars: &EfivarSource,
+    ) -> Option<Box<dyn DriverHeldValues>> {
+        match efivars {
+            EfivarSource::System => Some(Box::new(NextBootStaging {
+                image: None,
+                esp: None,
+                include: IncludedStates::empty(),
+                assume_var_stores: Vec::new(),
+                unsafe_operations: UnsafeOperations::Refuse,
+                // get writes nothing
+                passwords: PasswordQuestions::default(),
+            })),
+            EfivarSource::Directory(_) | EfivarSource::Disabled => None,
+        }
+    }
+
+    pub(super) fn driver_held_setter(
+        hiidb: &[u8],
+        options: &SetOptions,
+    ) -> Result<Option<Box<dyn DriverHeldValues>>> {
+        let lists = package::read_db(hiidb)?;
+        Ok(Some(Box::new(NextBootStaging::of(options, &lists))))
+    }
+}
diff --git a/src/lib/exports/macos.rs b/src/lib/exports/macos.rs
index bcc3991..6c276a1 100644
--- a/src/lib/exports/macos.rs
+++ b/src/lib/exports/macos.rs
@@ -18,6 +18,7 @@ use std::path::Path;
 use anyhow::anyhow;
 use anyhow::Result;
 
+use super::DriverHeldValues;
 use super::HiiBackend;
 use crate::hii::package::db_file;
 use crate::hii::EfivarSource;
@@ -41,3 +42,13 @@ impl HiiBackend {
         })
     }
 }
+
+/// What get and set do with a question whose driver holds its value: no driver is reached here.
+impl HiiBackend {
+    pub(super) fn driver_held_values(
+        _hiidb: &[u8],
+        _efivars: &EfivarSource,
+    ) -> Option<Box<dyn DriverHeldValues>> {
+        None
+    }
+}
diff --git a/src/lib/exports/uefi.rs b/src/lib/exports/uefi.rs
index ef65416..058892f 100644
--- a/src/lib/exports/uefi.rs
+++ b/src/lib/exports/uefi.rs
@@ -19,13 +19,20 @@
 //! panics unless the image has initialized it: uefi::table::set_system_table, then
 //! uefi::boot::set_image_handle, as uefisettings.efi's entry point uefi_std_entry does.
 
+use anyhow::anyhow;
 use anyhow::Result;
+use log::debug;
 
+use super::set_refusal;
+use super::staged_question;
 use super::text_languages;
 use super::CapsuleBackend;
+use super::DriverHeldValues;
 use super::EfivarSource;
 use super::HiiBackend;
 use super::IncludedStates;
+use super::QuestionList;
+use super::SetOptions;
 use super::UnsafeOperation;
 use super::UnsafeOperations;
 use super::VariableBackend;
@@ -42,10 +49,23 @@ use crate::efi_variables::VendorTable;
 use crate::efi_variables::EFI_JSON_CAPSULE_RESULT_TABLE_GUID;
 use crate::efi_variables::EFI_JSON_CONFIG_DATA_TABLE_GUID;
 use crate::firmware_width::FirmwareWidth;
+use crate::hii::config_access::ConfigAccessDriver;
+use crate::hii::config_routing::RoutingProtocol;
+use crate::hii::database_protocol::PackageLists;
 use crate::hii::export_package_lists;
-use crate::hii::get_keywords;
+use crate::hii::form_set_stores::FormSetStore;
+use crate::hii::forms::DriverHeldQuestion;
+use crate::hii::forms::PasswordQuestions;
+use crate::hii::forms::QuestionDescriptor;
+use crate::hii::get_keywords_witnessed;
 use crate::hii::package;
-use crate::hii::set_keywords;
+use crate::hii::question_callbacks::change;
+use crate::hii::question_callbacks::retrieve;
+use crate::hii::question_callbacks::Call;
+use crate::hii::question_callbacks::DriverQuestion;
+use crate::hii::question_callbacks::FormSetAccess;
+use crate::hii::question_callbacks::IfrValue;
+use crate::hii::set_keywords_witnessed;
 use crate::hii::time_services::TimeServices;
 use crate::hii::FirmwareKeywordHandler;
 use crate::hii::FirmwareVariables;
@@ -53,8 +73,14 @@ use crate::hii::KeywordGetOptions;
 use crate::hii::KeywordValues;
 use crate::hii::VariableReach;
 use crate::hii::VariableServices;
+use crate::hii::WithholdingVariables;
 use crate::runtime_time_services::RuntimeTimeServices;
+use crate::staged_set::apply::apply_staged_withholding;
+use crate::staged_set::apply::Application;
+use crate::staged_set::apply::StagedRequestDriver;
+use crate::staged_set::StagedRequest;
 use crate::uefi_config_table::SystemConfigurationTable;
+use crate::unsafe_operations::LiftedOperations;
 
 /// What set and get read and write when no file names them: this firmware's HII database and
 /// variables, through boot services.
@@ -132,8 +158,8 @@ impl HiiBackend {
     }
 
     /// The VariableInfo of the EFI variable `name` of the vendor GUID `vendor`, such as
-    /// "8C78A505-BAA0-4C4A-869F-000000000101", whose data it never reads: as
-    /// VariableBackend::info.
+    /// "8C78A505-BAA0-4C4A-869F-000000000101", whose data it reads only for the metadata of a
+    /// variable with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS: as VariableBackend::info.
     pub fn variable_info(name: &str, vendor: &str) -> Result<VariableInfo> {
         VariableBackend::info(name, vendor)
     }
@@ -145,7 +171,8 @@ impl HiiBackend {
     /// per package list of this firmware's HiiDB whose question of the keyword get would read as
     /// GetData() does and that passes the `<Filter>`, which `options.filter_by` applies, with the
     /// `<KeywordInfoResp>` of KEYWORDINFO from `options.info_source`: the HiiDB's IFR, its texts
-    /// in the language that PlatformLang picks, or GetData().
+    /// in the language that PlatformLang picks, or GetData(). It fails where GetData() changed
+    /// the bytes of a PASSWORD question in an EFI variable, which uefisettings never writes back.
     pub fn keyword_get(
         requests: &str,
         namespace: Option<&str>,
@@ -153,13 +180,13 @@ impl HiiBackend {
     ) -> Result<KeywordValues> {
         let lists = package::read_db(&Self::export_hiidb()?)?;
         let platform_lang = EfivarSource::System.platform_lang()?;
-        get_keywords(
+        get_keywords_witnessed(
             &lists,
             requests,
             namespace,
             &text_languages(None, platform_lang.as_deref()),
             options,
-            Box::new(VariableServices),
+            VariableServices,
             &FirmwareKeywordHandler,
         )
     }
@@ -168,19 +195,20 @@ impl HiiBackend {
     /// EFI_CONFIG_KEYWORD_HANDLER_PROTOCOL, unless set, with `options`, would refuse a keyword's
     /// question or value in this firmware's HiiDB and variables; then returns what GetData() reads
     /// back, which must hold each VALUE written, as a number, and the unsafe operations that it
-    /// lifted.
+    /// lifted. It fails where SetData() or that GetData() changed the bytes of a PASSWORD
+    /// question in an EFI variable, which uefisettings never writes back.
     pub fn keyword_set(
         keywords: &str,
         options: &KeywordSetOptions,
     ) -> Result<(KeywordValues, Vec<UnsafeOperation>)> {
         let lists = package::read_db(&Self::export_hiidb()?)?;
-        set_keywords(
+        set_keywords_witnessed(
             &lists,
             keywords,
             options.include,
             options.unsafe_operations,
             options.volatile,
-            Box::new(VariableServices),
+            VariableServices,
             &FirmwareKeywordHandler,
         )
     }
@@ -200,3 +228,218 @@ pub struct KeywordSetOptions {
     /// SetOptions::volatile
     pub volatile: VolatileWrites,
 }
+
+/// What get and set do with a question whose driver holds its value: call that driver's
+/// Callback() for it, unless --no-efivars keeps get from this firmware's state.
+impl HiiBackend {
+    pub(super) fn driver_held_values<'a>(
+        hiidb: &'a [u8],
+        efivars: &EfivarSource,
+    ) -> Option<Box<dyn DriverHeldValues + 'a>> {
+        match efivars {
+            EfivarSource::System => Some(Box::new(DriverCallbacks { hiidb })),
+            EfivarSource::Disabled => None,
+        }
+    }
+
+    /// set calls the driver's Callback()s, as get does.
+    pub(super) fn driver_held_setter<'a>(
+        hiidb: &'a [u8],
+        _options: &SetOptions,
+    ) -> Result<Option<Box<dyn DriverHeldValues + 'a>>> {
+        Ok(Self::driver_held_values(hiidb, &EfivarSource::System))
+    }
+}
+
+/// The Callback()s of the drivers of the package lists of `hiidb`, the HiiDB that get and set
+/// read.
+struct DriverCallbacks<'a> {
+    hiidb: &'a [u8],
+}
+
+/// What a Callback() sequence reaches: the driver, the stores of the question's FormSet, and the
+/// variables without the bytes of PASSWORD questions, which no sequence reads or writes.
+struct Reached {
+    driver: ConfigAccessDriver,
+    stores: Vec<FormSetStore>,
+    variables: WithholdingVariables<VariableServices>,
+}
+
+impl DriverCallbacks<'_> {
+    /// What the sequence for `held` of `list` reaches, after checking that the HII database still
+    /// exports `hiidb`, so that the list's index names its handle.
+    fn reach(&self, list: &QuestionList<'_>, held: &DriverHeldQuestion) -> Result<Reached> {
+        let lists = PackageLists::export()?;
+        if lists.hiidb() != self.hiidb {
+            return Err(anyhow!(
+                "the HII database changed since uefisettings read it; run the command again"
+            ));
+        }
+        let parsed = package::read_db(self.hiidb)?;
+        let package_list = parsed
+            .get(list.index)
+            .ok_or_else(|| no_package_list(list.index))?;
+        held.check_disabled_forms(&package_list.disabled_forms)?;
+        let variables = PasswordQuestions::of_lists(&parsed).withholding(VariableServices)?;
+        let handle = lists
+            .handle(list.index)
+            .ok_or_else(|| no_package_list(list.index))?;
+        let driver = ConfigAccessDriver::of_package_list(handle)?;
+        let stores = held
+            .stores
+            .iter()
+            .filter_map(|declaration| FormSetStore::of(declaration, list.device_path).transpose())
+            .collect::<Result<Vec<_>, _>>()?;
+        Ok(Reached {
+            driver,
+            stores,
+            variables,
+        })
+    }
+}
+
+impl DriverHeldValues for DriverCallbacks<'_> {
+    fn store_name(&self) -> &'static str {
+        "its driver"
+    }
+
+    fn get(
+        &self,
+        list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+    ) -> Result<String> {
+        let reached = match self.reach(list, held) {
+            Ok(reached) => reached,
+            Err(error) => return Ok(format!("<ValueUnavailable: {error:#}>")),
+        };
+        let routing = RoutingProtocol::open();
+        let access = FormSetAccess {
+            stores: reached.stores,
+            routing: &routing,
+            variables: &reached.variables,
+        };
+        let retrieval = retrieve(&reached.driver, driver_question(held), access);
+        log_calls(&retrieval.calls);
+        retrieval.answer(&question.question, |value| shown(question, value))
+    }
+
+    /// set reaches the question's driver, its stores and the variables, as `reach` finds them.
+    fn check_set(
+        &self,
+        list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+    ) -> Result<()> {
+        self.reach(list, held)
+            .map(drop)
+            .map_err(|error| set_refusal(&question.question, format!("{error:#}")))
+    }
+
+    fn set(
+        &self,
+        list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+        value: u64,
+    ) -> Result<String> {
+        let reached = self
+            .reach(list, held)
+            .map_err(|error| set_refusal(&question.question, format!("{error:#}")))?;
+        let routing = RoutingProtocol::open();
+        let access = FormSetAccess {
+            stores: reached.stores,
+            routing: &routing,
+            variables: &reached.variables,
+        };
+        let new_value = IfrValue {
+            value_type: held.value_type,
+            value,
+        };
+        let changed = change(&reached.driver, driver_question(held), new_value, access);
+        log_calls(&changed.calls);
+        changed.annotation(&question.question, |value| shown(question, value))
+    }
+}
+
+/// The error of a package list `index` that the HII database does not have.
+fn no_package_list(index: usize) -> anyhow::Error {
+    anyhow!("the HII database has no package list {index}")
+}
+
+impl HiiBackend {
+    /// apply-staged of `nonce`, which ends the command line of the staged set's Boot####: applies
+    /// the staged set of `nonce` through the drivers of this firmware's HII database, records its
+    /// outcome and deletes its Boot####, as staged_set::apply::apply_staged_withholding does, writing no byte
+    /// of a PASSWORD question; where it cannot tell those bytes, as for a PASSWORD question whose
+    /// VarStore it does not find, it writes nothing. Returns what it did, in lines, for
+    /// uefisettings.efi to print before it resets.
+    pub fn apply_staged(nonce: &str) -> Vec<String> {
+        match Self::apply_staged_set(nonce) {
+            Ok(application) => application.lines(),
+            Err(error) => vec![format!("failed: {error:#}")],
+        }
+    }
+
+    /// apply_staged_withholding of `nonce` through this firmware's variables, without the bytes of
+    /// the PASSWORD questions of its HII database.
+    fn apply_staged_set(nonce: &str) -> Result<Application> {
+        let lists = package::read_db(&Self::export_hiidb()?)?;
+        apply_staged_withholding(&lists, VariableServices, nonce, &StagedCallbacks)
+    }
+}
+
+/// The drivers of this firmware's HII database, as apply-staged reaches them.
+struct StagedCallbacks;
+
+impl StagedRequestDriver for StagedCallbacks {
+    /// Sets the question of `request` as set does, in the HII database as exported now, as the
+    /// Callback()s of a request before may have changed it.
+    fn apply(&self, request: &StagedRequest) -> Result<(String, Vec<UnsafeOperation>)> {
+        let hiidb = HiiBackend::export_hiidb()?;
+        let parsed = package::read_db(&hiidb)?;
+        let mut reader = PasswordQuestions::of_lists(&parsed).reader(Box::new(VariableServices))?;
+        let platform_lang = EfivarSource::System.platform_lang()?;
+        let (list, question, held, lifted) = staged_question(
+            &parsed,
+            request,
+            &text_languages(None, platform_lang.as_deref()),
+            &mut reader,
+        )?;
+        let set = DriverCallbacks { hiidb: &hiidb }
+            .set(&list, &question, &held, request.value)
+            .map(|annotation| annotation.trim_start().to_owned());
+        LiftedOperations::after(lifted, set)
+    }
+}
+
+/// The DriverQuestion of `held`.
+fn driver_question(held: &DriverHeldQuestion) -> DriverQuestion {
+    DriverQuestion {
+        question_id: held.question_id,
+        initial: IfrValue {
+            value_type: held.value_type,
+            value: held.initial,
+        },
+        form_set_has_stores: !held.stores.is_empty(),
+        read_expression: held.read_expression,
+        write_expression: held.write_expression,
+    }
+}
+
+/// `value` of `question` as get shows it.
+fn shown(question: &QuestionDescriptor, value: IfrValue) -> String {
+    question
+        .driver_held_text(value.value)
+        .unwrap_or_else(|| value.value.to_string())
+}
+
+/// Logs each Callback() of a sequence.
+fn log_calls(calls: &[Call]) {
+    for call in calls {
+        debug!(
+            "Callback({}) with {:#x}: {}, {}",
+            call.action, call.value.value, call.returned.status, call.returned.request
+        );
+    }
+}
diff --git a/src/lib/exports/windows.rs b/src/lib/exports/windows.rs
index b49319d..f871984 100644
--- a/src/lib/exports/windows.rs
+++ b/src/lib/exports/windows.rs
@@ -18,11 +18,17 @@ use std::path::Path;
 use anyhow::Result;
 
 use super::CapsuleBackend;
+use super::DriverHeldValues;
 use super::HiiBackend;
+use super::SetOptions;
+use super::UnsafeOperations;
 use super::VariableBackend;
 use crate::efi_variables::VariableData;
 use crate::efi_variables::VariableInfoSource;
 use crate::firmware_width::FirmwareWidth;
+use crate::hii::forms::IncludedStates;
+use crate::hii::forms::PasswordQuestions;
+use crate::hii::package;
 use crate::hii::package::db_file;
 use crate::hii::read_hiidb;
 use crate::hii::EfivarSource;
@@ -30,6 +36,7 @@ use crate::hii::FirmwareEnvironment;
 use crate::hii::FirmwareVariables;
 use crate::hii::RealFirmwareEnvironmentCalls;
 use crate::hii::VariableReach;
+use crate::staged_set::next_boot::NextBootStaging;
 
 /// What set and get read and write when no file names them: this machine's HiiDB, through
 /// the HiiDB driver, and its firmware environment variables.
@@ -91,3 +98,34 @@ impl HiiBackend {
         }
     }
 }
+
+/// What get and set do with a question whose driver holds its value: get reaches no driver here,
+/// and shows what the records of staged sets tell of it, which this machine's firmware
+/// environment variables hold; set stages it for the next boot.
+impl HiiBackend {
+    pub(super) fn driver_held_values(
+        _hiidb: &[u8],
+        efivars: &EfivarSource,
+    ) -> Option<Box<dyn DriverHeldValues>> {
+        match efivars {
+            EfivarSource::System => Some(Box::new(NextBootStaging {
+                image: None,
+                esp: None,
+                include: IncludedStates::empty(),
+                assume_var_stores: Vec::new(),
+                unsafe_operations: UnsafeOperations::Refuse,
+                // get writes nothing
+                passwords: PasswordQuestions::default(),
+            })),
+            EfivarSource::Disabled => None,
+        }
+    }
+
+    pub(super) fn driver_held_setter(
+        hiidb: &[u8],
+        options: &SetOptions,
+    ) -> Result<Option<Box<dyn DriverHeldValues>>> {
+        let lists = package::read_db(hiidb)?;
+        Ok(Some(Box::new(NextBootStaging::of(options, &lists))))
+    }
+}
diff --git a/src/lib/hii.rs b/src/lib/hii.rs
index 3ab3bec..4deee41 100644
--- a/src/lib/hii.rs
+++ b/src/lib/hii.rs
@@ -18,13 +18,21 @@ pub(crate) mod config_snapshot;
     not(test),
     expect(
         dead_code,
-        reason = "no Config Routing caller builds or parses these strings yet, and only the UEFI \
-                  Shell build's Keyword Handler caller does some"
+        reason = "only the UEFI Shell build routes <ConfigRequest>s and calls the Keyword Handler \
+                  with these strings"
     )
 )]
 mod config_string;
+// EFI_HII_CONFIG_ACCESS_PROTOCOL of a package list's driver, whose Callback() question_callbacks
+// runs.
 #[cfg(target_os = "uefi")]
-mod database_protocol;
+pub(crate) mod config_access;
+// The Buffer and Name/Value stores of a FormSet, which only the UEFI Shell build reaches; the
+// tests run on every host with variables.
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+pub(crate) mod config_routing;
+#[cfg(target_os = "uefi")]
+pub(crate) mod database_protocol;
 #[cfg(efivar_dumps)]
 mod efivar_dump;
 #[cfg(target_os = "linux")]
@@ -41,6 +49,8 @@ mod firmware_environment;
 // parses arm64's EFI memory map with.
 #[cfg(target_os = "linux")]
 pub(crate) mod firmware_memory;
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+pub(crate) mod form_set_stores;
 pub mod forms;
 #[cfg(any(target_os = "windows", test))]
 mod hiidb_driver;
@@ -57,6 +67,10 @@ mod lockdown;
 #[cfg(target_os = "linux")]
 mod memory_access_denied;
 pub mod package;
+// Callback() of the driver of a question without a VarStore, which only the UEFI Shell build
+// calls; the tests run on every host that lists variables.
+#[cfg(all(variable_data, variable_names, any(target_os = "uefi", test)))]
+pub(crate) mod question_callbacks;
 mod scsu;
 mod strings;
 pub(crate) mod time_services;
@@ -64,11 +78,13 @@ pub(crate) mod time_services;
 // memory where a firmware memory map bounds the reads.
 #[cfg(firmware_memory_maps)]
 mod system_table;
+#[cfg(all(variable_data, variable_names, any(target_os = "uefi", test)))]
+mod variable_changes;
 #[cfg(target_os = "uefi")]
 mod variable_services;
 mod variables;
 #[cfg(any(target_os = "windows", test))]
-mod win32;
+pub(crate) mod win32;
 // UEFI HII Library
 
 // Implements (partial) decoding of the Form and Strings packages.
@@ -106,9 +122,9 @@ pub use firmware_memory::MemoryMapUnavailable;
 #[cfg(target_os = "windows")]
 pub(crate) use hiidb_driver::read_hiidb;
 #[cfg(target_os = "uefi")]
-pub(crate) use keyword_access::get_keywords;
+pub(crate) use keyword_access::get_keywords_witnessed;
 #[cfg(target_os = "uefi")]
-pub(crate) use keyword_access::set_keywords;
+pub(crate) use keyword_access::set_keywords_witnessed;
 #[cfg(target_os = "uefi")]
 pub use keyword_access::KeywordFilterBy;
 #[cfg(target_os = "uefi")]
@@ -131,6 +147,8 @@ pub use memory_access_denied::MemoryAccessDenied;
 pub use memory_access_denied::MemoryDevice;
 #[cfg(target_os = "linux")]
 pub use memory_access_denied::MemoryOperation;
+pub(crate) use strings::MatchTier;
+pub(crate) use strings::PRIVATE_USE_AREA;
 #[cfg(firmware_memory_maps)]
 pub(crate) use system_table::system_vendor_table;
 #[cfg(firmware_memory_maps)]
@@ -146,12 +164,16 @@ pub(crate) use variable_services::VariableServices;
 pub(crate) use variables::EfivarReader;
 pub use variables::EfivarSource;
 pub(crate) use variables::FirmwareVariables;
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+pub(crate) use variables::PasswordBytesRefusal;
 pub use variables::VariableAttributes;
 #[cfg(variable_data)]
 pub(crate) use variables::VariableInterface;
 #[cfg(any(variable_names, variable_info, variable_data))]
 pub use variables::VariableKey;
-#[cfg(variable_data)]
+#[cfg(all(variable_data, test))]
+pub(crate) use variables::VariableNotFound;
 pub(crate) use variables::VariableReach;
 pub use variables::VolatileWrites;
+pub(crate) use variables::WithholdingVariables;
 pub(crate) use variables::VOLATILE_ANNOTATION;
diff --git a/src/lib/hii/config_access.rs b/src/lib/hii/config_access.rs
new file mode 100644
index 0000000..14e56d4
--- /dev/null
+++ b/src/lib/hii/config_access.rs
@@ -0,0 +1,126 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The EFI_HII_CONFIG_ACCESS_PROTOCOL of the driver that registered a package list (UEFI 2.11
+//! §35.5): its Callback(), called as the protocol defines it, through the uefi crate, which the
+//! image's entry point initializes. Nothing here replaces or hooks a protocol: a Callback() that
+//! needs a forms browser's session finds none.
+
+use anyhow::anyhow;
+use anyhow::Context;
+use anyhow::Result;
+use uefi::boot;
+use uefi::boot::OpenProtocolAttributes;
+use uefi::boot::OpenProtocolParams;
+use uefi::boot::ScopedProtocol;
+use uefi::proto::unsafe_protocol;
+use uefi::Handle;
+use uefi_raw::protocol::hii::config::BrowserAction as RawBrowserAction;
+use uefi_raw::protocol::hii::config::HiiConfigAccessProtocol;
+use uefi_raw::protocol::hii::form_browser::BrowserActionRequest;
+use uefi_raw::protocol::hii::HiiHandle;
+
+use crate::efi_status::EfiStatus;
+use crate::hii::database_protocol::driver_handle;
+use crate::hii::forms::StoragelessRefusal;
+use crate::hii::question_callbacks::ActionRequest;
+use crate::hii::question_callbacks::BrowserAction;
+use crate::hii::question_callbacks::CallbackReturn;
+use crate::hii::question_callbacks::DriverCallback;
+use crate::hii::question_callbacks::IfrValue;
+
+/// EFI_HII_CONFIG_ACCESS_PROTOCOL, whose functions uefi's HiiConfigAccess keeps private.
+#[repr(transparent)]
+// SAFETY: uefi-raw's GUID of the struct this wraps with repr(transparent)
+#[unsafe_protocol(HiiConfigAccessProtocol::GUID)]
+struct ConfigAccessFunctions(HiiConfigAccessProtocol);
+
+/// The driver of a package list: its handle and the EFI_HII_CONFIG_ACCESS_PROTOCOL on it,
+/// opened GetProtocol for as long as this lives.
+pub(crate) struct ConfigAccessDriver {
+    handle: Handle,
+    protocol: ScopedProtocol<ConfigAccessFunctions>,
+}
+
+impl ConfigAccessDriver {
+    /// The driver that registered the package list of `hii_handle`, as GetPackageListHandle()
+    /// names it (UEFI 2.11 §34.8.12), as a forms browser finds it (edk2-stable202608
+    /// SetupBrowserDxe Setup.c:6187-6204).
+    pub(crate) fn of_package_list(hii_handle: HiiHandle) -> Result<Self> {
+        let handle = driver_handle(hii_handle)?
+            .ok_or_else(|| anyhow!("GetPackageListHandle() names no driver handle"))
+            .context(StoragelessRefusal::NoConfigAccess)?;
+        let params = OpenProtocolParams {
+            handle,
+            agent: boot::image_handle(),
+            controller: None,
+        };
+        // GetProtocol, as a forms browser takes it (HandleProtocol), and as Exclusive would stop
+        // the driver
+        // SAFETY: the protocol stays installed while the ScopedProtocol lives: only Callback()s of
+        // the one question run meanwhile, and a driver installs its EFI_HII_CONFIG_ACCESS_PROTOCOL
+        // with its package list
+        let protocol = unsafe {
+            boot::open_protocol::<ConfigAccessFunctions>(
+                params,
+                OpenProtocolAttributes::GetProtocol,
+            )
+        }
+        .map_err(|error| anyhow!("OpenProtocol() returned {:?}", error.status()))
+        .context(StoragelessRefusal::NoConfigAccess)?;
+        Ok(Self { handle, protocol })
+    }
+}
+
+impl DriverCallback for ConfigAccessDriver {
+    fn callback(
+        &self,
+        action: BrowserAction,
+        question_id: u16,
+        value: &mut IfrValue,
+    ) -> CallbackReturn {
+        let Some(functions) = self.protocol.get().map(|protocol| &protocol.0) else {
+            return CallbackReturn {
+                status: EfiStatus::NOT_FOUND,
+                request: ActionRequest::NONE,
+            };
+        };
+        let mut union = value.to_union();
+        let mut request = BrowserActionRequest::NONE;
+        // SAFETY: Callback() of the protocol's own instance with a Value of the union's size and
+        // alignment, which it may change, and an ActionRequest that it may set
+        let status = unsafe {
+            (functions.callback)(
+                functions,
+                RawBrowserAction(action as usize),
+                question_id,
+                value.value_type as u8,
+                union.as_mut_ptr().cast(),
+                &mut request,
+            )
+        };
+        *value = IfrValue::from_union(value.value_type, &union);
+        CallbackReturn {
+            status: EfiStatus(status.0),
+            request: ActionRequest(request.0),
+        }
+    }
+
+    /// As a forms browser does for EFI_BROWSER_ACTION_REQUEST_RECONNECT (edk2-stable202608
+    /// SetupBrowserDxe Presentation.c:1997-2009).
+    fn reconnect(&self) -> Result<(), EfiStatus> {
+        boot::disconnect_controller(self.handle, None, None)
+            .map_err(|error| EfiStatus(error.status().0))?;
+        boot::connect_controller(self.handle, &[], None, true)
+            .map_err(|error| EfiStatus(error.status().0))
+    }
+}
diff --git a/src/lib/hii/config_routing.rs b/src/lib/hii/config_routing.rs
new file mode 100644
index 0000000..13cee98
--- /dev/null
+++ b/src/lib/hii/config_routing.rs
@@ -0,0 +1,258 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The settings of Buffer and Name/Value storage, which only their driver holds: read by
+//! EFI_HII_CONFIG_ROUTING_PROTOCOL.ExtractConfig() of a `<ConfigRequest>` and written by its
+//! RouteConfig() of a `<ConfigResp>` (UEFI 2.11 §35.4.2, §35.4.4), which route each string to
+//! the driver whose device path its `<ConfigHdr>` names. The strings are those of
+//! config_string.rs.
+
+use thiserror::Error;
+
+use crate::efi_status::EfiStatus;
+use crate::hii::config_string::ConfigRequest;
+use crate::hii::config_string::ConfigResp;
+use crate::hii::config_string::ConfigStringError;
+use crate::hii::config_string::MultiConfigAltResp;
+
+/// ExtractConfig() and RouteConfig() of EFI_HII_CONFIG_ROUTING_PROTOCOL.
+pub(crate) trait ConfigRouting {
+    /// The `<MultiConfigAltResp>` that ExtractConfig() returns for `request`.
+    fn extract_config(
+        &self,
+        request: &ConfigRequest,
+    ) -> Result<MultiConfigAltResp, ConfigRoutingError>;
+
+    /// Has RouteConfig() write the settings of `resp`.
+    fn route_config(&self, resp: &ConfigResp) -> Result<(), ConfigRoutingError>;
+}
+
+/// Why ExtractConfig() or RouteConfig() gave no settings or wrote none.
+#[derive(Debug, Error)]
+#[cfg_attr(
+    not(target_os = "uefi"),
+    allow(dead_code, reason = "only the UEFI Shell build's protocol makes some")
+)]
+pub(crate) enum ConfigRoutingError {
+    /// The firmware has no EFI_HII_CONFIG_ROUTING_PROTOCOL, or OpenProtocol() of it failed
+    #[error("EFI_HII_CONFIG_ROUTING_PROTOCOL: {0}")]
+    Protocol(EfiStatus),
+    /// The call returned an error; Progress pointed `progress` CHAR16 into its string
+    #[error("{function}() returned {status} at CHAR16 {progress} of its string")]
+    Status {
+        function: &'static str,
+        status: EfiStatus,
+        progress: usize,
+    },
+    /// ExtractConfig() succeeded without a Results string
+    #[error("ExtractConfig() returned {0} without Results")]
+    NoResults(EfiStatus),
+    /// ExtractConfig()'s Results are no UTF-16
+    #[error("ExtractConfig() returned Results that are not UTF-16: {0}")]
+    NotUtf16(std::string::FromUtf16Error),
+    /// ExtractConfig()'s Results are no `<MultiConfigAltResp>`
+    #[error("ExtractConfig() returned Results that are not a <MultiConfigAltResp>: {0}")]
+    Results(ConfigStringError),
+}
+
+#[cfg(target_os = "uefi")]
+pub(crate) use uefi_protocol::RoutingProtocol;
+
+/// The firmware's EFI_HII_CONFIG_ROUTING_PROTOCOL, through the uefi crate.
+#[cfg(target_os = "uefi")]
+mod uefi_protocol {
+    use std::ptr;
+    use std::ptr::NonNull;
+
+    use uefi::boot;
+    use uefi::boot::OpenProtocolAttributes;
+    use uefi::boot::OpenProtocolParams;
+    use uefi::boot::ScopedProtocol;
+    use uefi::proto::unsafe_protocol;
+    use uefi_raw::protocol::hii::config::HiiConfigRoutingProtocol;
+    use uefi_raw::Char16;
+    use uefi_raw::Status;
+    use zeroize::Zeroize;
+    use zeroize::Zeroizing;
+
+    use super::ConfigRouting;
+    use super::ConfigRoutingError;
+    use crate::efi_status::EfiStatus;
+    use crate::hii::config_string::ConfigRequest;
+    use crate::hii::config_string::ConfigResp;
+    use crate::hii::config_string::MultiConfigAltResp;
+
+    /// EFI_HII_CONFIG_ROUTING_PROTOCOL, whose functions uefi's HiiConfigRouting keeps private.
+    #[repr(transparent)]
+    // SAFETY: uefi-raw's GUID of the struct this wraps with repr(transparent)
+    #[unsafe_protocol(HiiConfigRoutingProtocol::GUID)]
+    struct ConfigRoutingFunctions(HiiConfigRoutingProtocol);
+
+    /// The protocol, opened GetProtocol for as long as this lives, or why it could not be: each
+    /// call fails with that status then.
+    pub(crate) struct RoutingProtocol(Result<ScopedProtocol<ConfigRoutingFunctions>, EfiStatus>);
+
+    impl RoutingProtocol {
+        pub(crate) fn open() -> Self {
+            Self(open_protocol())
+        }
+
+        fn functions(&self) -> Result<&HiiConfigRoutingProtocol, ConfigRoutingError> {
+            let protocol = self
+                .0
+                .as_ref()
+                .map_err(|&status| ConfigRoutingError::Protocol(status))?;
+            protocol
+                .get()
+                .map(|functions| &functions.0)
+                .ok_or(ConfigRoutingError::Protocol(EfiStatus::NOT_FOUND))
+        }
+    }
+
+    /// OpenProtocol() of the firmware's EFI_HII_CONFIG_ROUTING_PROTOCOL.
+    fn open_protocol() -> Result<ScopedProtocol<ConfigRoutingFunctions>, EfiStatus> {
+        let handle = boot::get_handle_for_protocol::<ConfigRoutingFunctions>()
+            .map_err(|error| EfiStatus(error.status().0))?;
+        let params = OpenProtocolParams {
+            handle,
+            agent: boot::image_handle(),
+            controller: None,
+        };
+        // GetProtocol, as Exclusive would disconnect the drivers that opened it BY_DRIVER.
+        // SAFETY: the protocol stays installed while the ScopedProtocol lives: edk2's
+        // HiiDatabaseDxe (edk2-stable202608 HiiDatabaseEntry.c) installs it and uninstalls it
+        // nowhere
+        unsafe {
+            boot::open_protocol::<ConfigRoutingFunctions>(
+                params,
+                OpenProtocolAttributes::GetProtocol,
+            )
+        }
+        .map_err(|error| EfiStatus(error.status().0))
+    }
+
+    impl ConfigRouting for RoutingProtocol {
+        fn extract_config(
+            &self,
+            request: &ConfigRequest,
+        ) -> Result<MultiConfigAltResp, ConfigRoutingError> {
+            let functions = self.functions()?;
+            let text = ucs2(&request.to_string());
+            let mut progress: *const Char16 = ptr::null();
+            let mut results: *mut Char16 = ptr::null_mut();
+            // SAFETY: ExtractConfig() of a NUL-terminated request, which stores a pointer into
+            // it in Progress and a pool allocation, or NULL, in Results
+            let status = unsafe {
+                (functions.extract_config)(
+                    functions,
+                    text.as_ptr().cast(),
+                    &mut progress,
+                    &mut results,
+                )
+            };
+            // Results is the caller's to free, also with an error
+            let results = PoolString::new(results);
+            if status.is_error() {
+                return Err(ConfigRoutingError::Status {
+                    function: "ExtractConfig",
+                    status: EfiStatus(status.0),
+                    progress: offset_in(&text, progress),
+                });
+            }
+            let results = results
+                .ok_or(ConfigRoutingError::NoResults(EfiStatus(status.0)))?
+                .read()?;
+            results
+                .parse::<MultiConfigAltResp>()
+                .map_err(ConfigRoutingError::Results)
+        }
+
+        fn route_config(&self, resp: &ConfigResp) -> Result<(), ConfigRoutingError> {
+            let functions = self.functions()?;
+            let text = ucs2(&resp.to_string());
+            let mut progress: *const Char16 = ptr::null();
+            // SAFETY: RouteConfig() of a NUL-terminated configuration, which stores a pointer
+            // into it in Progress
+            let status =
+                unsafe { (functions.route_config)(functions, text.as_ptr().cast(), &mut progress) };
+            match status {
+                Status::SUCCESS => Ok(()),
+                status => Err(ConfigRoutingError::Status {
+                    function: "RouteConfig",
+                    status: EfiStatus(status.0),
+                    progress: offset_in(&text, progress),
+                }),
+            }
+        }
+    }
+
+    /// `text` as a NUL-terminated UCS-2 string; config strings are ASCII (UEFI 2.11 §35.2.1).
+    fn ucs2(text: &str) -> Vec<u16> {
+        text.encode_utf16().chain([0]).collect()
+    }
+
+    /// How many CHAR16 of `text` lie before `progress`, or its length if `progress` points
+    /// elsewhere.
+    fn offset_in(text: &[u16], progress: *const Char16) -> usize {
+        let start = text.as_ptr().addr();
+        let unit = size_of::<u16>();
+        progress
+            .addr()
+            .checked_sub(start)
+            .map(|bytes| bytes / unit)
+            .filter(|&units| units < text.len())
+            .unwrap_or(text.len())
+    }
+
+    /// A NUL-terminated string in pool memory that the firmware allocated for the caller, which
+    /// drop zeroes and frees.
+    struct PoolString(NonNull<u16>);
+
+    impl PoolString {
+        fn new(pointer: *mut Char16) -> Option<Self> {
+            NonNull::new(pointer.cast()).map(Self)
+        }
+
+        /// The string, as many CHAR16 as precede its NUL.
+        fn units(&self) -> &[u16] {
+            let mut len = 0;
+            // SAFETY: the firmware's NUL-terminated string, read up to its NUL
+            while unsafe { self.0.add(len).read() } != 0 {
+                len += 1;
+            }
+            // SAFETY: the `len` CHAR16 before the NUL, which live as long as `self`
+            unsafe { std::slice::from_raw_parts(self.0.as_ptr(), len) }
+        }
+
+        /// The string up to its NUL.
+        fn read(&self) -> Result<Zeroizing<String>, ConfigRoutingError> {
+            String::from_utf16(self.units())
+                .map(Zeroizing::new)
+                .map_err(ConfigRoutingError::NotUtf16)
+        }
+    }
+
+    impl Drop for PoolString {
+        fn drop(&mut self) {
+            let len = self.units().len();
+            // SAFETY: the string's CHAR16 before its NUL, which nothing else references now
+            unsafe { std::slice::from_raw_parts_mut(self.0.as_ptr(), len) }.zeroize();
+            // SAFETY: a pool allocation of the firmware that nothing else frees
+            if let Err(error) = unsafe { boot::free_pool(self.0.cast()) } {
+                log::warn!(
+                    "FreePool() of ExtractConfig()'s Results: {:?}",
+                    error.status()
+                );
+            }
+        }
+    }
+}
diff --git a/src/lib/hii/config_snapshot.rs b/src/lib/hii/config_snapshot.rs
index 4b0dbd8..b5303fe 100644
--- a/src/lib/hii/config_snapshot.rs
+++ b/src/lib/hii/config_snapshot.rs
@@ -27,7 +27,7 @@ use crate::hii::config_string::BlockConfig;
 use crate::hii::config_string::ConfigAltResp;
 use crate::hii::config_string::ConfigElement;
 use crate::hii::config_string::MultiConfigAltResp;
-use crate::hii::config_string::Number;
+use crate::hii::config_string::NvConfig;
 use crate::hii::forms::PasswordQuestions;
 use crate::hii::forms::UnresolvedPassword;
 use crate::hii::package::DevicePath;
@@ -77,8 +77,9 @@ struct StorageKey {
 struct StorageValues {
     /// The bytes of its `<BlockConfig>`s
     buffer: SnapshotBuffer,
-    /// The number of each `<NvConfig>` that holds one, by label
-    numbers: BTreeMap<String, Number>,
+    /// Its last `<NvConfig>` of each label, whose digits a question reads as a number or, for a
+    /// string question, as a string
+    settings: BTreeMap<String, NvConfig>,
 }
 
 /// The bytes of buffer storage that `<BlockConfig>`s set, by offset, and only those: a block
@@ -152,10 +153,7 @@ impl ConfigSnapshot {
                     ConfigElement::Block(block) => values.buffer.write(block, &passwords),
                     ConfigElement::Nv(setting) => {
                         let label = setting.label().to_string();
-                        match setting.number() {
-                            Some(number) => values.numbers.insert(label, number),
-                            None => values.numbers.remove(&label),
-                        };
+                        values.settings.insert(label, setting.clone());
                     }
                 }
             }
@@ -185,22 +183,22 @@ impl ConfigSnapshot {
             .get(range)
     }
 
-    /// The number that the name/value storage of `guid` of the driver at `device_path` holds
+    /// The setting that the name/value storage of `guid` of the driver at `device_path` holds
     /// under `label`, if any.
-    fn number(&self, device_path: &DevicePath, guid: Guid, label: &str) -> Option<&Number> {
+    fn setting(&self, device_path: &DevicePath, guid: Guid, label: &str) -> Option<&NvConfig> {
         let variable = VariableKey {
             name: String::new(),
             guid,
         };
-        self.storage(device_path, variable)?.numbers.get(label)
+        self.storage(device_path, variable)?.settings.get(label)
     }
 
-    /// The labels of the numbers of the name/value storages of the driver at `device_path`.
+    /// The labels of the settings of the name/value storages of the driver at `device_path`.
     fn labels(&self, device_path: &DevicePath) -> BTreeSet<&str> {
         self.storages
             .iter()
             .filter(|(key, _)| key.device_path == *device_path && key.variable.name.is_empty())
-            .flat_map(|(_, values)| values.numbers.keys().map(String::as_str))
+            .flat_map(|(_, values)| values.settings.keys().map(String::as_str))
             .collect()
     }
 }
@@ -254,7 +252,7 @@ impl SnapshotLookup {
     }
 
     /// Looks up the storages of `list` from now on: those of the driver at its device path, and
-    /// the labels that its strings give in `texts`, the texts that its questions show, as
+    /// the labels that its strings give in `texts`, the stored texts that its questions show, as
     /// edk2-stable202608 SetupBrowserDxe IfrParse.c takes a VarName through GetToken, as
     /// DisplayEngineDxe FormDisplay.c takes a prompt.
     fn enter(&mut self, list: &ParsedPackageList, texts: &ListTexts<'_>) {
@@ -272,7 +270,7 @@ impl SnapshotLookup {
             .collect();
         self.labels = ids
             .into_iter()
-            .map(|id| (id, texts.display(id)))
+            .map(|id| (id, texts.stored(id)))
             .filter(|&(_, text)| labels.contains(text))
             .map(|(id, text)| (id, Rc::from(text)))
             .collect();
@@ -290,12 +288,12 @@ impl SnapshotLookup {
         self.snapshot.buffer(device_path, variable, range)
     }
 
-    /// The number of the setting that the string `name` of the package list being read labels in
-    /// its name/value storage of `guid`, if the snapshot holds one.
-    pub(crate) fn number(&self, guid: Guid, name: u16) -> Option<&Number> {
+    /// The setting that the string `name` of the package list being read labels in its
+    /// name/value storage of `guid`, if the snapshot holds one.
+    pub(crate) fn setting(&self, guid: Guid, name: u16) -> Option<&NvConfig> {
         let device_path = self.device_path.as_ref()?;
         self.snapshot
-            .number(device_path, guid, self.labels.get(&name)?)
+            .setting(device_path, guid, self.labels.get(&name)?)
     }
 }
 
@@ -327,6 +325,7 @@ pub(crate) mod tests {
     use std::sync::Once;
 
     use super::*;
+    use crate::hii::config_string::Number;
     use crate::hii::forms::ifr_fixtures::en_us_package;
     use crate::hii::strings::Language;
     use crate::hii::strings::StringMap;
@@ -432,6 +431,7 @@ pub(crate) mod tests {
             .map(|(language, label)| StringPackage {
                 language: Language(language.to_vec()),
                 strings: StringMap::from([(1, Rc::from(*label))]),
+                replaced: Default::default(),
             })
             .collect();
         list
@@ -599,13 +599,17 @@ pub(crate) mod tests {
         let guid = Guid::from(N_GUID);
         assert_eq!(
             snapshot
-                .number(&driver_path(), guid, "Var0")
+                .setting(&driver_path(), guid, "Var0")
+                .and_then(NvConfig::number)
+                .as_ref()
                 .map(Number::as_bytes),
             Some(&[2, 1][..]),
             "Var0"
         );
         assert_eq!(
-            snapshot.number(&driver_path(), guid, "Gone"),
+            snapshot
+                .setting(&driver_path(), guid, "Gone")
+                .and_then(NvConfig::number),
             None,
             "Gone, emptied"
         );
@@ -679,11 +683,15 @@ pub(crate) mod tests {
 
             assert_eq!(lookup.buffer(&store, 0..1), want_buffer, "{case}: NStore");
             assert_eq!(
-                lookup.number(guid, 1).map(Number::as_bytes),
+                lookup
+                    .setting(guid, 1)
+                    .and_then(NvConfig::number)
+                    .as_ref()
+                    .map(Number::as_bytes),
                 want_var0,
                 "{case}: string 1"
             );
-            assert_eq!(lookup.number(guid, 2), None, "{case}: string 2");
+            assert_eq!(lookup.setting(guid, 2), None, "{case}: string 2");
         }
     }
 
@@ -700,12 +708,32 @@ pub(crate) mod tests {
         lookup.enter(&list, &list.texts(&[]));
 
         assert_eq!(
-            lookup.number(Guid::from(N_GUID), 1).map(Number::as_bytes),
+            lookup
+                .setting(Guid::from(N_GUID), 1)
+                .and_then(NvConfig::number)
+                .as_ref()
+                .map(Number::as_bytes),
             Some(&[8][..]),
             "string 1"
         );
     }
 
+    /// A name/value setting takes the label of its string as stored, with the common control
+    /// codes that only the texts that questions show drop: a string that holds them labels no
+    /// setting of the label without them.
+    #[test]
+    fn lookup_labels_settings_by_their_stored_texts() {
+        let text = format!("{}&Var0=07", config_hdr(N_GUID, "", &DRIVER_PATH));
+        let mut lookup =
+            SnapshotLookup::new(&ExportedConfig::new(text), &PasswordQuestions::default())
+                .expect("look up the snapshot");
+        let list = labelled_list(&[(b"en-US", "\u{F620}Var0")]);
+
+        lookup.enter(&list, &list.texts(&[]));
+
+        assert!(lookup.setting(Guid::from(N_GUID), 1).is_none(), "string 1");
+    }
+
     thread_local! {
         /// What the test logger keeps of this thread's messages, with their levels, while it
         /// keeps them.
diff --git a/src/lib/hii/config_string.rs b/src/lib/hii/config_string.rs
index 4cb1aff..e6e21a0 100644
--- a/src/lib/hii/config_string.rs
+++ b/src/lib/hii/config_string.rs
@@ -24,6 +24,7 @@ use std::str::Split;
 
 use bitflags::bitflags;
 use thiserror::Error;
+use zeroize::Zeroizing;
 
 use crate::hex_digits::hex_byte;
 use crate::hex_digits::hex_bytes;
@@ -45,7 +46,7 @@ const MIN_DEVICE_PATH_LEN: usize = 4;
 
 // What a value or an element should have been, for ConfigStringError
 const GUID: &str = "<Guid>: 32 hex digits";
-const STRING: &str = "<String>: 4 hex digits per CHAR16";
+pub(crate) const STRING: &str = "<String>: 4 hex digits per CHAR16";
 const DEVICE_PATH: &str = "a device path: 2 hex digits per byte";
 const NUMBER: &str = "<Number>: hex digits";
 const SIZE_NUMBER: &str = "<Number>: hex digits of a value that fits usize";
@@ -292,6 +293,16 @@ impl ConfigRequest {
         }
         Ok(Self { header, elements })
     }
+
+    #[cfg(variable_data)]
+    pub(crate) fn header(&self) -> &ConfigHdr {
+        &self.header
+    }
+
+    #[cfg(variable_data)]
+    pub(crate) fn elements(&self) -> &[RequestElement] {
+        &self.elements
+    }
 }
 
 impl fmt::Display for ConfigRequest {
@@ -303,15 +314,17 @@ impl fmt::Display for ConfigRequest {
     }
 }
 
-/// `<BlockConfig>`: the bytes of a block of buffer storage, at most up to MAX_BLOCK_END.
+/// `<BlockConfig>`: the bytes of a block of buffer storage, at most up to MAX_BLOCK_END, which
+/// drop zeroes.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct BlockConfig {
     offset: usize,
-    value: Vec<u8>,
+    value: Zeroizing<Vec<u8>>,
 }
 
 impl BlockConfig {
     pub(crate) fn new(offset: usize, value: Vec<u8>) -> Result<Self, ConfigStringError> {
+        let value = Zeroizing::new(value);
         let width = NonZeroUsize::new(value.len()).ok_or(ConfigStringError::EmptyValue)?;
         check_block_end(offset, width)?;
         Ok(Self { offset, value })
@@ -362,16 +375,23 @@ impl BlockConfig {
         check_block_end(offset, width)?;
 
         let value_digits = elements.required_value("VALUE=")?;
-        let mut value =
-            hex_number(value_digits).ok_or_else(|| invalid_number("VALUE", value_digits))?;
-        let beyond_width = value.get(width.get()..);
+        let digits = Zeroizing::new(
+            hex_number(value_digits).ok_or_else(|| invalid_number("VALUE", value_digits))?,
+        );
+        let beyond_width = digits.get(width.get()..);
         if beyond_width.is_some_and(|bytes| bytes.iter().any(|byte| *byte != 0)) {
             return Err(ConfigStringError::ValueWiderThanWidth {
                 digits: value_digits.len(),
                 width: width.get(),
             });
         }
-        value.resize(width.get(), 0);
+        // a fresh buffer of the width, so that no reallocation leaves the bytes behind
+        let mut value = Zeroizing::new(vec![0; width.get()]);
+        // the digits past `width` are zero, as checked above
+        value
+            .iter_mut()
+            .zip(digits.iter())
+            .for_each(|(byte, digit)| *byte = *digit);
         Ok(Self { offset, value })
     }
 }
@@ -392,11 +412,12 @@ impl fmt::Display for BlockConfig {
 /// `<NvConfig>`: a setting of name/value storage. Its value is a `<String>` for a string question
 /// and a `<Number>` else, as EDK2's SetupBrowserDxe BufferToValue reads it; both are hex digits.
 /// It is empty for an empty string, as EDK2's DriverSample ExtractConfig and SetupBrowserDxe
-/// SetQuestionValue write it, although `<String>` has at least one `<Char>`.
+/// SetQuestionValue write it, although `<String>` has at least one `<Char>`. Drop zeroes the
+/// value.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct NvConfig {
     label: Label,
-    value: String,
+    value: Zeroizing<String>,
 }
 
 impl NvConfig {
@@ -406,7 +427,7 @@ impl NvConfig {
         }
         Ok(Self {
             label,
-            value: value.to_ascii_lowercase(),
+            value: Zeroizing::new(value.to_ascii_lowercase()),
         })
     }
 
@@ -424,11 +445,18 @@ impl NvConfig {
     pub(crate) fn number(&self) -> Option<Number> {
         hex_number(&self.value).map(Number)
     }
+
+    /// The value as a `<String>`'s CHAR16s, as edk2-stable202608 SetupBrowserDxe/Setup.c
+    /// BufferToValue reads that of a string question (:1564-1579): none if the digits are no
+    /// `<String>`, no CHAR16 if it is empty.
+    pub(crate) fn string(&self) -> Option<Vec<u16>> {
+        string_units(&self.value)
+    }
 }
 
 impl fmt::Display for NvConfig {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}={}", self.label, self.value)
+        write!(f, "{}={}", self.label, *self.value)
     }
 }
 
@@ -1444,12 +1472,13 @@ fn parse_optional_number(
 
 /// The CHAR16s of a `<String>`, 4 hex digits each.
 fn parse_string(name: &str, digits: &str) -> Result<Vec<u16>, ConfigStringError> {
-    digits
-        .as_bytes()
-        .chunks(4)
-        .map(hex_unit)
-        .collect::<Option<_>>()
-        .ok_or_else(|| invalid_value(name, digits, STRING))
+    string_units(digits).ok_or_else(|| invalid_value(name, digits, STRING))
+}
+
+/// The CHAR16s of a `<String>`'s `digits`, 4 hex digits each, most significant first: none if
+/// they are no `<String>`.
+fn string_units(digits: &str) -> Option<Vec<u16>> {
+    digits.as_bytes().chunks(4).map(hex_unit).collect()
 }
 
 fn write_string(f: &mut fmt::Formatter<'_>, units: &[u16]) -> fmt::Result {
@@ -1831,6 +1860,23 @@ mod tests {
         );
     }
 
+    /// A setting reads as a string 4 hex digits per CHAR16, most significant first, a surrogate
+    /// too, and empty as no CHAR16; digits that no `<Char>`s fill read as none.
+    #[test]
+    fn nv_config_reads_its_digits_as_a_string() {
+        for (digits, want) in [
+            ("", Some(vec![])),
+            ("00410042", Some(vec![0x41, 0x42])),
+            ("00410042000000", None),
+            ("d8000041", Some(vec![0xD800, 0x41])),
+            ("004", None),
+            ("0041004", None),
+        ] {
+            let config = NvConfig::new(label("fred"), digits).expect("hex digits");
+            assert_eq!(config.string(), want, "{digits:?}");
+        }
+    }
+
     #[test]
     fn block_beyond_the_buffer_is_refused() {
         let config = BlockConfig::new(5, vec![0xAA, 0x55]).expect("nonempty value");
diff --git a/src/lib/hii/database_protocol.rs b/src/lib/hii/database_protocol.rs
index ce35862..c67dadd 100644
--- a/src/lib/hii/database_protocol.rs
+++ b/src/lib/hii/database_protocol.rs
@@ -13,17 +13,98 @@
 //! The HII database of the UEFI Shell build, from EFI_HII_DATABASE_PROTOCOL through the uefi
 //! crate, which the image's entry point initializes.
 
+use std::ptr;
+
 use anyhow::anyhow;
 use anyhow::Result;
 use uefi::boot;
 use uefi::boot::OpenProtocolAttributes;
 use uefi::boot::OpenProtocolParams;
-use uefi::proto::hii::database::HiiDatabase;
+use uefi::boot::ScopedProtocol;
+use uefi::proto::unsafe_protocol;
+use uefi::Handle;
+use uefi::Status;
+use uefi_raw::protocol::hii::database::HiiDatabaseProtocol;
+use uefi_raw::protocol::hii::HiiHandle;
+
+/// EFI_HII_PACKAGE_TYPE_ALL (UEFI 2.11 §33.3.1.1): ListPackageLists() lists every package list.
+const EFI_HII_PACKAGE_TYPE_ALL: u8 = 0x00;
+
+/// EFI_HII_DATABASE_PROTOCOL, whose ListPackageLists(), ExportPackageLists() of one handle and
+/// GetPackageListHandle() uefi's HiiDatabase does not wrap.
+#[repr(transparent)]
+// SAFETY: uefi-raw's GUID of the struct this wraps with repr(transparent)
+#[unsafe_protocol(HiiDatabaseProtocol::GUID)]
+struct HiiDatabaseFunctions(HiiDatabaseProtocol);
+
+/// The package lists of the HII database, each exported by itself, in ListPackageLists() order,
+/// with its EFI_HII_HANDLE: the i-th package list of their HiiDB is that of the i-th handle.
+pub(crate) struct PackageLists {
+    lists: Vec<(HiiHandle, Vec<u8>)>,
+}
+
+impl PackageLists {
+    /// ListPackageLists() of every type, then ExportPackageLists() of each handle (UEFI 2.11
+    /// §34.8.5, §34.8.6).
+    pub(crate) fn export() -> Result<Self> {
+        let database = open_database()?;
+        let functions = database
+            .get()
+            .map(|database| &database.0)
+            .ok_or_else(|| anyhow!("EFI_HII_DATABASE_PROTOCOL has no interface"))?;
+        let lists = list_handles(functions)?
+            .into_iter()
+            .map(|handle| Ok((handle, export_list(functions, handle)?)))
+            .collect::<Result<_>>()?;
+        Ok(Self { lists })
+    }
+
+    /// The HiiDB of the package lists, in the format of the Linux build: each list whole, one
+    /// after the other.
+    pub(crate) fn hiidb(&self) -> Vec<u8> {
+        self.lists
+            .iter()
+            .flat_map(|(_, list)| list)
+            .copied()
+            .collect()
+    }
+
+    /// The EFI_HII_HANDLE of the `index`-th package list.
+    pub(crate) fn handle(&self, index: usize) -> Option<HiiHandle> {
+        self.lists.get(index).map(|(handle, _)| *handle)
+    }
+}
+
+/// The driver handle that registered the package list of `handle`: GetPackageListHandle()
+/// (UEFI 2.11 §34.8.12), None if it names none.
+pub(crate) fn driver_handle(handle: HiiHandle) -> Result<Option<Handle>> {
+    let database = open_database()?;
+    let functions = database
+        .get()
+        .map(|database| &database.0)
+        .ok_or_else(|| anyhow!("EFI_HII_DATABASE_PROTOCOL has no interface"))?;
+    let mut driver: uefi_raw::Handle = ptr::null_mut();
+    // SAFETY: GetPackageListHandle() of a handle that ListPackageLists() gave, which stores a
+    // handle in `driver`
+    let status = unsafe { (functions.get_package_list_handle)(functions, handle, &mut driver) };
+    if status.is_error() {
+        return Err(anyhow!("GetPackageListHandle(): {status:?}"));
+    }
+    // SAFETY: the handle that the HII database returned, or NULL
+    Ok(unsafe { Handle::from_ptr(driver) })
+}
 
 /// Every package list of the HII database, as ExportPackageLists() with a NULL Handle gives
 /// them (UEFI 2.10 §34.8.6), in the HiiDB format of the Linux build.
+/// Each list is exported by its own handle, so that the i-th list is that of the i-th handle of
+/// ListPackageLists().
 pub(crate) fn export_package_lists() -> Result<Vec<u8>> {
-    let handle = boot::get_handle_for_protocol::<HiiDatabase>()
+    Ok(PackageLists::export()?.hiidb())
+}
+
+/// EFI_HII_DATABASE_PROTOCOL, opened GetProtocol for as long as the result lives.
+fn open_database() -> Result<ScopedProtocol<HiiDatabaseFunctions>> {
+    let handle = boot::get_handle_for_protocol::<HiiDatabaseFunctions>()
         .map_err(|error| anyhow!("EFI_HII_DATABASE_PROTOCOL: {:?}", error.status()))?;
     let params = OpenProtocolParams {
         handle,
@@ -31,20 +112,78 @@ pub(crate) fn export_package_lists() -> Result<Vec<u8>> {
         controller: None,
     };
     // GetProtocol, as Exclusive would disconnect the drivers that opened the protocol BY_DRIVER.
-    // SAFETY: the protocol stays installed while the ScopedProtocol, which ends in this
-    // function, lives: only ExportPackageLists() runs meanwhile, and nothing here uninstalls
-    // protocols. edk2's HiiDatabaseDxe (edk2-stable202508 HiiDatabaseEntry.c) also installs it and
-    // uninstalls it nowhere.
-    let database =
-        unsafe { boot::open_protocol::<HiiDatabase>(params, OpenProtocolAttributes::GetProtocol) }
-            .map_err(|error| {
-                anyhow!(
-                    "OpenProtocol() of EFI_HII_DATABASE_PROTOCOL: {:?}",
-                    error.status()
-                )
-            })?;
-    let lists = database
-        .export_all_raw()
-        .map_err(|error| anyhow!("ExportPackageLists(): {:?}", error.status()))?;
-    Ok(lists.into_vec())
+    // SAFETY: the protocol stays installed while the ScopedProtocol lives: edk2's HiiDatabaseDxe
+    // (edk2-stable202508 HiiDatabaseEntry.c) installs it and uninstalls it nowhere.
+    unsafe {
+        boot::open_protocol::<HiiDatabaseFunctions>(params, OpenProtocolAttributes::GetProtocol)
+    }
+    .map_err(|error| {
+        anyhow!(
+            "OpenProtocol() of EFI_HII_DATABASE_PROTOCOL: {:?}",
+            error.status()
+        )
+    })
+}
+
+/// ListPackageLists() of every type: a size probe, then the handles.
+fn list_handles(functions: &HiiDatabaseProtocol) -> Result<Vec<HiiHandle>> {
+    let mut size = 0;
+    // SAFETY: ListPackageLists() with a HandleBufferLength of 0 and no buffer, which stores the
+    // size it needs
+    let status = unsafe {
+        (functions.list_package_lists)(
+            functions,
+            EFI_HII_PACKAGE_TYPE_ALL,
+            ptr::null(),
+            &mut size,
+            ptr::null_mut(),
+        )
+    };
+    match status {
+        Status::BUFFER_TOO_SMALL => {}
+        // "No matching handles were found" (UEFI 2.11 §34.8.5)
+        Status::NOT_FOUND => return Ok(Vec::new()),
+        status => return Err(anyhow!("ListPackageLists(): {status:?}")),
+    }
+    let mut handles: Vec<HiiHandle> = vec![ptr::null_mut(); size.div_ceil(size_of::<HiiHandle>())];
+    let mut size = handles.len() * size_of::<HiiHandle>();
+    // SAFETY: ListPackageLists() into a buffer of `size` bytes of handles
+    let status = unsafe {
+        (functions.list_package_lists)(
+            functions,
+            EFI_HII_PACKAGE_TYPE_ALL,
+            ptr::null(),
+            &mut size,
+            handles.as_mut_ptr(),
+        )
+    };
+    if status.is_error() {
+        return Err(anyhow!("ListPackageLists(): {status:?}"));
+    }
+    handles.truncate(size / size_of::<HiiHandle>());
+    Ok(handles)
+}
+
+/// ExportPackageLists() of the package list of `handle`: a size probe, then the list.
+fn export_list(functions: &HiiDatabaseProtocol, handle: HiiHandle) -> Result<Vec<u8>> {
+    let mut size = 0;
+    // SAFETY: ExportPackageLists() with a BufferSize of 0 and no buffer, which stores the size
+    // it needs
+    let status =
+        unsafe { (functions.export_package_lists)(functions, handle, &mut size, ptr::null_mut()) };
+    match status {
+        Status::BUFFER_TOO_SMALL => {}
+        status => return Err(anyhow!("ExportPackageLists() size: {status:?}")),
+    }
+    let mut list = vec![0u8; size];
+    // SAFETY: ExportPackageLists() into a buffer of `size` bytes
+    let status = unsafe {
+        (functions.export_package_lists)(functions, handle, &mut size, list.as_mut_ptr().cast())
+    };
+    if status.is_error() {
+        return Err(anyhow!("ExportPackageLists(): {status:?}"));
+    }
+    // the firmware may write less than it announced, as uefi's export_all_raw keeps
+    list.truncate(size);
+    Ok(list)
 }
diff --git a/src/lib/hii/efivar_dump/write.rs b/src/lib/hii/efivar_dump/write.rs
index e9385d9..64711b4 100644
--- a/src/lib/hii/efivar_dump/write.rs
+++ b/src/lib/hii/efivar_dump/write.rs
@@ -40,7 +40,7 @@ use crate::hii::efivarfs::EFIVARS_MOUNT_POINT;
 use crate::hii::efivarfs_format::open_efivar;
 use crate::hii::efivarfs_format::read_efivar_file_of;
 use crate::hii::efivarfs_format::EfivarNotFound;
-use crate::hii::forms::list_questions;
+use crate::hii::forms::list_reachable_questions;
 use crate::hii::forms::IncludedStates;
 use crate::hii::forms::PasswordQuestions;
 #[cfg(target_os = "linux")]
@@ -80,13 +80,16 @@ pub(crate) fn dump_efivars(
     )
 }
 
-/// The payload bytes that the questions of `package_lists`, in any state, decode, by efivar
-/// file, found without reading any, which the dump copies; none that a PASSWORD question that
-/// uefisettings finds holds, nor any of a variable that an ignored FormSet declares. One whose
-/// VarStore is unknown withholds no bytes: of_lists warns of each. IFR past an op where the walk
+/// The payload bytes that the questions of `package_lists`, in any state, those that only
+/// --keyword reads too, decode, by efivar file, found without reading any, which the dump copies;
+/// none that a PASSWORD question that uefisettings finds holds, nor any of a variable that an
+/// ignored FormSet declares. One whose FormSet declares no VarStore of its VarStoreId, which
+/// another VarStore of its form package declares, withholds its bytes in the first of those,
+/// which FindStorageFromVarId takes: of_lists warns of each. IFR past an op where the walk
 /// for FormSets ends, or the driver of a VARSTORE_NAME_VALUE that edk2 may route a PASSWORD to,
-/// or the callbacks or READ and WRITE ops of a PASSWORD of VarStoreId 0, may keep a password in
-/// any variable, so a HiiDB with any of them fails (check_bounded).
+/// or the callbacks or READ and WRITE ops of a PASSWORD of VarStoreId 0, or of a VarStoreId that
+/// no VarStore of its form package declares, may keep a password in any variable, so a HiiDB with
+/// any of them fails (check_bounded).
 fn decoded_bytes(
     package_lists: Vec<ParsedPackageList>,
 ) -> Result<BTreeMap<EfivarFileName, Vec<DecodedValue>>> {
@@ -98,11 +101,10 @@ fn decoded_bytes(
         // which questions read which bytes holds in every language
         let texts = list.texts(&[]);
         for root in &list.forms {
-            list_questions(
+            list_reachable_questions(
                 Rc::clone(root),
                 &texts,
                 IncludedStates::CONDITIONS,
-                None,
                 &mut reader,
             );
         }
@@ -295,6 +297,9 @@ mod tests {
     use super::super::tests::HIIDB;
     use super::*;
     use crate::efi_variables::enhanced_authenticated::fixture::timestamp_metadata;
+    use crate::exports::GetOptions;
+    use crate::exports::HiiBackend;
+    use crate::exports::QuestionSelector;
     use crate::hii::efivarfs_format::tests::SETUP;
     use crate::hii::forms::handle_form_set;
     use crate::hii::forms::ifr_fixtures::checkbox;
@@ -322,6 +327,8 @@ mod tests {
     use crate::hii::forms::ifr_fixtures::PASSWORD;
     use crate::hii::forms::ifr_fixtures::SHORT_VAR_STORE_GUID;
     use crate::hii::forms::ifr_fixtures::SUPPRESS_IF;
+    use crate::hii::forms::list_questions;
+    use crate::hii::forms::CheckedVarStores;
     use crate::hii::forms::IFROperation;
     use crate::hii::package::hiidb_fixtures::en_strings_package_of;
     use crate::hii::package::hiidb_fixtures::form_package;
@@ -619,6 +626,7 @@ mod tests {
             strings: vec![StringPackage {
                 language: Language::default(),
                 strings: BTreeMap::new(),
+                replaced: Default::default(),
             }],
             forms: vec![Rc::clone(root)],
             ignored_ifr: Vec::new(),
@@ -637,7 +645,7 @@ mod tests {
             Rc::clone(root),
             &ListTexts::new(&[], &[]),
             IncludedStates::CONDITIONS,
-            None,
+            CheckedVarStores::NONE,
             &mut EfivarReader::new(source).expect("create a reader of the efivars directory"),
         )
         .into_iter()
@@ -1537,6 +1545,79 @@ mod tests {
         );
     }
 
+    /// A dump keeps the bytes of a question in a form that a true DISABLE_IF outside forms
+    /// disables, which edk2-stable202608 SetupBrowserDxe/IfrParse.c does not parse but --keyword
+    /// reads, as the edk2 keyword handler does: get of Hidden and Shown by keyword answers from
+    /// the dump as from its source.
+    #[test]
+    fn a_dump_keeps_the_bytes_of_questions_that_only_keywords_read() {
+        let packages = [
+            form_package(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 2),
+                conditional(
+                    DISABLE_IF,
+                    ifr_true(),
+                    &[form(1, &[checkbox_at(1, 1, 1, 1)])],
+                ),
+                form(2, &[checkbox_at(2, 2, 1, 0)]),
+            ]),
+            en_strings_package_of(&["Hidden", "Shown"]),
+            strings_package_of(b"x-UEFI-ns", &["HiddenKeyword", "ShownKeyword"]),
+            END_PACKAGE.to_vec(),
+        ];
+        let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+        let live = efivars(&[(&efivar("Setup"), &[7, 0, 0, 0, 1, 1])]);
+        let (_parent, dir) = dump_dir();
+
+        let decoded = decoded_bytes(read_db(&hiidb).expect("read the HiiDB"))
+            .expect("find the decoded bytes");
+        write_dump(
+            &hiidb,
+            &decoded,
+            live.path(),
+            &dir,
+            EfivarRedaction::DecodedBytes,
+        )
+        .expect("dump efivars");
+
+        assert_eq!(
+            fs::read(dir.join(efivar("Setup"))).expect("read the dumped file"),
+            [7, 0, 0, 0, 1, 1],
+            "dumped Setup"
+        );
+        let answer = |keyword: &str, efivars: &Path| {
+            let options = GetOptions {
+                include: IncludedStates::DISABLED,
+                efivars: EfivarSource::Directory(efivars.to_path_buf()),
+                ..GetOptions::default()
+            };
+            let question = QuestionSelector::Keyword {
+                keyword: keyword.parse().expect("parse the keyword"),
+                namespace: None,
+            };
+            HiiBackend::get_using(&hiidb, question, None, &options)
+                .map(|got| {
+                    got.responses
+                        .into_iter()
+                        .map(|response| response.question.answer)
+                        .collect::<Vec<_>>()
+                })
+                .map_err(|error| format!("{error:#}"))
+        };
+        for (keyword, want) in [("ShownKeyword", "1"), ("HiddenKeyword", "1 <disabled>")] {
+            assert_eq!(
+                answer(keyword, &dir),
+                Ok(vec![want.to_owned()]),
+                "{keyword} from the dump"
+            );
+            assert_eq!(
+                answer(keyword, live.path()),
+                Ok(vec![want.to_owned()]),
+                "{keyword} from its source"
+            );
+        }
+    }
+
     /// A dump copies the variables of VARSTORE_EFIs that declare them boot-service-only, as get
     /// reads those that efivarfs lists, and lists those that it does not as missing.
     #[test]
@@ -1711,4 +1792,52 @@ mod tests {
             "the STRING After's bytes in the dump"
         );
     }
+
+    /// A PASSWORD whose VarStoreId 9 no VarStore declares names no VarStore, so its password may be
+    /// in any variable: the dump fails before it copies any; one on Backing leaves the CHECKBOX B
+    /// on Backing to copy.
+    #[test]
+    fn dump_refuses_a_hiidb_with_a_password_of_an_undeclared_var_store_id() {
+        let decoded = |var_store_id| {
+            let password = [
+                question_header_with(3, 3, var_store_id, 4, 0x00),
+                [&1u16.to_le_bytes()[..], &20u16.to_le_bytes()].concat(), // MinSize, MaxSize
+            ]
+            .concat();
+            let packages = [
+                form_package(&[
+                    var_store(1, [0x44; 16], "Backing", 4),
+                    form(
+                        1,
+                        &[
+                            checkbox_at(1, 1, 1, 0),
+                            operation(PASSWORD, false, &password),
+                        ],
+                    ),
+                ]),
+                en_strings_package_of(&["B", "x", "Password", "Pin"]),
+                END_PACKAGE.to_vec(),
+            ];
+            let hiidb = package_list_with_guid([0x55; 16], &packages.concat());
+            decoded_bytes(read_db(&hiidb).expect("read the HiiDB"))
+                .map(|decoded| decoded.keys().map(ToString::to_string).collect::<Vec<_>>())
+                .map_err(|error| format!("{error:#}"))
+        };
+
+        let refused = decoded(9);
+        assert!(
+            refused.as_ref().is_err_and(|error| error.ends_with(
+                "; as a PASSWORD there may keep its password in any variable, uefisettings \
+                 reads and writes no variable of this HiiDB"
+            )),
+            "VarStoreId 9: {refused:?}"
+        );
+        assert_eq!(
+            decoded(1),
+            Ok(vec![
+                "Backing-44444444-4444-4444-4444-444444444444".to_owned()
+            ]),
+            "VarStoreId 1"
+        );
+    }
 }
diff --git a/src/lib/hii/efivarfs.rs b/src/lib/hii/efivarfs.rs
index 5af9e9f..f14666f 100644
--- a/src/lib/hii/efivarfs.rs
+++ b/src/lib/hii/efivarfs.rs
@@ -926,11 +926,11 @@ fn efivar_info(key: &VariableKey, bytes: &[u8]) -> Result<VariableInfo> {
                 bytes.len()
             )
         })?;
-    Ok(VariableInfo {
-        variable: key.to_string(),
-        attributes: u32::from_ne_bytes(*attributes),
-        size: data.len(),
-    })
+    Ok(VariableInfo::from_data(
+        key,
+        u32::from_ne_bytes(*attributes),
+        data,
+    ))
 }
 
 impl VariableData for EfivarFiles {
@@ -987,6 +987,37 @@ impl VariableData for EfivarFiles {
         debug!("Writing value to {}", path.display());
         write_efivar_file(&path, &efivar_file_bytes(contents))
     }
+
+    /// Removes the efivar file of `key`, which efivarfs turns into SetVariable() without data
+    /// (Linux v6.17 fs/efivarfs/inode.c efivarfs_unlink()).
+    fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+        let mut lock = FileLock::new(&self.remount_lock);
+        lock.lock()?;
+
+        let path = self.dir.join(EfivarFileName::from(key));
+        match fs::symlink_metadata(&path) {
+            Ok(metadata) => check_regular_file(&path, &metadata, "efivar file")?,
+            Err(error) if error.kind() == io::ErrorKind::NotFound => {
+                return Err(VariableNotFound(key.clone()).into())
+            }
+            Err(error) => {
+                return Err(error)
+                    .with_context(|| format!("failed to stat efivar file '{}'", path.display()))
+            }
+        }
+
+        let survives = self.survives()?;
+        let _efifs = EfivarsMountGuard::new(&self.dir, survives)
+            .context("Failed to create efivars fs mount guard")?;
+        let immutability_attribute_guard = EfivarsImmutabilityGuard::new(&path)
+            .context("failed to create immutability attribute guard")?;
+
+        debug!("Removing {}", path.display());
+        fs::remove_file(&path)
+            .with_context(|| format!("failed to remove efivar file '{}'", path.display()))?;
+        immutability_attribute_guard.file_removed();
+        Ok(())
+    }
 }
 
 /// The bytes of the efivar file of `contents`, as efivar_contents reads them.
@@ -1514,6 +1545,7 @@ mod tests {
                 variable: "Setup-00000000-0000-0000-0000-000000000000".to_string(),
                 attributes: NV_BS_RT,
                 size: SETUP.len() - EFIVARFS_HEADER_SIZE,
+                metadata: None,
             },
             "info"
         );
@@ -1534,6 +1566,113 @@ mod tests {
         }
     }
 
+    /// efivar_info shows the EFI_VARIABLE_AUTHENTICATION_3 metadata of a variable with
+    /// EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS (UEFI 2.11 §8.2.1), of either Type, or why it
+    /// does not take it, but none of a variable without that attribute, and none of the data.
+    #[test]
+    fn efivar_info_shows_the_metadata_of_enhanced_authenticated_access() {
+        use crate::efi_variables::enhanced_authenticated::fixture::nonce_metadata_of;
+        use crate::efi_variables::enhanced_authenticated::fixture::timestamp_metadata;
+
+        const VALUE: &[u8] = b"value";
+        const CERT_ID: &str = "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f";
+        let key = variable_key("Setup");
+        let variable = "Setup-00000000-0000-0000-0000-000000000000";
+        let mut other_version = timestamp_metadata();
+        *other_version.first_mut().expect("a Version") = 2;
+        let cases = [
+            (
+                "TimeStamp",
+                0x87,
+                [&timestamp_metadata()[..], VALUE].concat(),
+                serde_json::json!({
+                    "variable": variable,
+                    "attributes": 0x87,
+                    "size": 73,
+                    "metadata": {
+                        "version": 1,
+                        "type": 1,
+                        "metadata_size": 68,
+                        "flags": 0,
+                        "time_stamp": "2026-11-06T12:00:00Z",
+                        "cert_id": {"type": 1, "id": {"hex": CERT_ID}},
+                    },
+                }),
+            ),
+            (
+                "nonce",
+                0x87,
+                [&nonce_metadata_of(&[7, 8, 9], &[0], 60)[..], VALUE].concat(),
+                serde_json::json!({
+                    "variable": variable,
+                    "attributes": 0x87,
+                    "size": 65,
+                    "metadata": {
+                        "version": 1,
+                        "type": 2,
+                        "metadata_size": 60,
+                        "flags": 0,
+                        "nonce": {"hex": "070809"},
+                        "cert_id": {"type": 1, "id": {"hex": CERT_ID}},
+                    },
+                }),
+            ),
+            (
+                "Version 2",
+                0x87,
+                [&other_version[..], VALUE].concat(),
+                serde_json::json!({
+                    "variable": variable,
+                    "attributes": 0x87,
+                    "size": 73,
+                    "metadata": {"refused": "EFI_VARIABLE_AUTHENTICATION_3 Version 2, not 1"},
+                }),
+            ),
+            (
+                "data ending inside the metadata",
+                0x87,
+                timestamp_metadata()[..67].to_vec(),
+                serde_json::json!({
+                    "variable": variable,
+                    "attributes": 0x87,
+                    "size": 67,
+                    "metadata": {"refused": "its 67 bytes of data end inside its metadata"},
+                }),
+            ),
+            (
+                "time-based too",
+                0xA7,
+                [&timestamp_metadata()[..], VALUE].concat(),
+                serde_json::json!({
+                    "variable": variable,
+                    "attributes": 0xA7,
+                    "size": 73,
+                    "metadata": {
+                        "refused": "it also has EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS, \
+                                    which SetVariable() refuses with it (UEFI 2.11 section 8.2.3)",
+                    },
+                }),
+            ),
+            (
+                "no enhanced authenticated access",
+                0x07,
+                [&timestamp_metadata()[..], VALUE].concat(),
+                serde_json::json!({"variable": variable, "attributes": 0x07, "size": 73}),
+            ),
+        ];
+        for (case, attributes, data, want) in cases {
+            let bytes = [&u32::to_ne_bytes(attributes)[..], &data].concat();
+
+            let info = efivar_info(&key, &bytes).expect("tell the variable");
+
+            assert_eq!(
+                serde_json::to_value(&info).expect("serialize the info"),
+                want,
+                "{case}"
+            );
+        }
+    }
+
     /// efivar_info tells a variable that the firmware dropped since efivarfs listed it as
     /// missing: its file keeps its size, but a read gives no bytes (Linux v6.17
     /// fs/efivarfs/file.c efivarfs_file_read()).
@@ -1573,6 +1712,7 @@ mod tests {
                 variable: "Setup-00000000-0000-0000-0000-000000000000".to_string(),
                 attributes: NV_BS_RT,
                 size: SETUP.len() - EFIVARFS_HEADER_SIZE,
+                metadata: None,
             },
             "Setup"
         );
diff --git a/src/lib/hii/efivarfs_format.rs b/src/lib/hii/efivarfs_format.rs
index 70261b5..e3156ed 100644
--- a/src/lib/hii/efivarfs_format.rs
+++ b/src/lib/hii/efivarfs_format.rs
@@ -430,6 +430,10 @@ impl VariableData for EfivarCopy {
     fn set_variable(&self, _key: &VariableKey, _contents: &VariableContents) -> Result<()> {
         Err(CopyOfEfivars.into())
     }
+
+    fn delete_variable(&self, _key: &VariableKey) -> Result<()> {
+        Err(CopyOfEfivars.into())
+    }
 }
 
 /// The contents of `key` from the `bytes` of its efivar file: its attributes word, then its data.
diff --git a/src/lib/hii/firmware_environment.rs b/src/lib/hii/firmware_environment.rs
index 0333222..596e5a3 100644
--- a/src/lib/hii/firmware_environment.rs
+++ b/src/lib/hii/firmware_environment.rs
@@ -233,16 +233,12 @@ impl<C: FirmwareEnvironmentCalls> FirmwareVariables for FirmwareEnvironment<C> {
 
 #[cfg(variable_info)]
 impl<C: FirmwareEnvironmentCalls> VariableInfoSource for FirmwareEnvironment<C> {
-    /// The VariableInfo of `key`, from all of its data, which is dropped:
+    /// The VariableInfo of `key`, from all of its data, which is dropped but for its metadata:
     /// GetFirmwareEnvironmentVariableExW tells the size only as "the number of bytes stored in
     /// the pValue buffer" (Microsoft Learn, updated 2024-11-20).
     fn variable_info(&self, key: &VariableKey) -> Result<VariableInfo> {
         let (attributes, data) = self.read_all(key)?;
-        Ok(VariableInfo {
-            variable: key.to_string(),
-            attributes,
-            size: data.len(),
-        })
+        Ok(VariableInfo::from_data(key, attributes, &data))
     }
 }
 
@@ -273,6 +269,22 @@ impl<C: FirmwareEnvironmentCalls> VariableData for FirmwareEnvironment<C> {
                 )
             })
     }
+
+    /// A zero-size SetFirmwareEnvironmentVariableExW of the variable's attributes, which
+    /// deletes it (Microsoft Learn, SetFirmwareEnvironmentVariableExW, updated 2024-11-20).
+    fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+        let (attributes, _) = self.read_all(key)?;
+        let name = variable_name(key)?;
+        let guid = variable_guid(key)?;
+        self.calls
+            .set_variable(&name, &guid, &[], attributes)
+            .map_err(|code| {
+                anyhow!(
+                    "SetFirmwareEnvironmentVariableExW deleting EFI variable {key} failed with \
+                     {code}"
+                )
+            })
+    }
 }
 
 /// The UTF-16 NUL-terminated name of `key`, for the Win32 calls: an interior NUL is an
@@ -959,6 +971,7 @@ mod tests {
                 variable: "Setup-00000000-0000-0000-0000-000000000000".to_string(),
                 attributes: NV_BS_RT,
                 size: 300,
+                metadata: None,
             }),
             "a variable of 300 bytes"
         );
@@ -977,6 +990,47 @@ mod tests {
         );
     }
 
+    /// variable_info shows the EFI_VARIABLE_AUTHENTICATION_3 metadata of a variable with
+    /// EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS (UEFI 2.11 §8.2.1), but none of its data.
+    #[cfg(variable_info)]
+    #[test]
+    fn variable_info_shows_the_metadata_of_enhanced_authenticated_access() {
+        use crate::efi_variables::enhanced_authenticated::fixture::nonce_metadata_of;
+
+        let calls = FakeFirmwareEnvironmentCalls::new();
+        let data = [&nonce_metadata_of(&[7, 8, 9], &[0], 60)[..], b"value"].concat();
+        calls.queue_get(got(0x87, &data));
+        let environment = fake_environment(&calls);
+
+        let info = environment
+            .variable_info(&variable_key("Setup"))
+            .expect("info of a variable with metadata");
+
+        assert_eq!(
+            serde_json::to_value(&info).expect("serialize the info"),
+            serde_json::json!({
+                "variable": "Setup-00000000-0000-0000-0000-000000000000",
+                "attributes": 0x87,
+                "size": 65,
+                "metadata": {
+                    "version": 1,
+                    "type": 2,
+                    "metadata_size": 60,
+                    "flags": 0,
+                    "nonce": {"hex": "070809"},
+                    "cert_id": {
+                        "type": 1,
+                        "id": {
+                            "hex": "000102030405060708090a0b0c0d0e0f\
+                                    101112131415161718191a1b1c1d1e1f",
+                        },
+                    },
+                },
+            }),
+            "a nonce-type variable"
+        );
+    }
+
     /// variable_data reads the attributes and all the data of a variable larger than the first
     /// buffer, writing nothing, None for ERROR_ENVVAR_NOT_FOUND, and an error for other codes.
     #[cfg(variable_data)]
diff --git a/src/lib/hii/form_set_stores.rs b/src/lib/hii/form_set_stores.rs
new file mode 100644
index 0000000..de126b0
--- /dev/null
+++ b/src/lib/hii/form_set_stores.rs
@@ -0,0 +1,1575 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The stores that a FormSet declares (UEFI 2.11 §33.3.8.3.89-§33.3.8.3.91), read before a
+//! driver's Callback() runs outside a forms browser and after, so that whatever the Callback()s
+//! changed in them is found and restored.
+//!
+//! A forms browser holds the FormSet's stores in its edit buffer while its Callback()s run, and a
+//! Callback() reaches them only through EFI_FORM_BROWSER2_PROTOCOL.BrowserCallback(), which
+//! no browser serves here; a Callback() that writes a store directly instead is caught here.
+//! Buffer and Name/Value stores are read as a browser reads them before it opens a form: by
+//! EFI_HII_CONFIG_ROUTING_PROTOCOL.ExtractConfig() of a `<ConfigRequest>` naming each question's
+//! setting (edk2-stable202608 SetupBrowserDxe IfrParse.c InitializeRequestElement); EFI
+//! variable stores by GetVariable(). Settings that differ between two reads back-to-back change
+//! on their own, as a timestamp does, so they are left out of the comparison.
+
+use std::collections::BTreeMap;
+use std::collections::BTreeSet;
+use std::fmt;
+
+use thiserror::Error;
+use zeroize::Zeroizing;
+
+use crate::efi_variables::VariableContents;
+use crate::efi_variables::VariableData;
+use crate::hii::config_routing::ConfigRouting;
+use crate::hii::config_routing::ConfigRoutingError;
+use crate::hii::config_string::BlockConfig;
+use crate::hii::config_string::BlockName;
+use crate::hii::config_string::ConfigElement;
+use crate::hii::config_string::ConfigHdr;
+use crate::hii::config_string::ConfigRequest;
+use crate::hii::config_string::ConfigResp;
+use crate::hii::config_string::ConfigStringError;
+use crate::hii::config_string::Label;
+use crate::hii::config_string::NvConfig;
+use crate::hii::config_string::RequestElement;
+use crate::hii::forms::DeclaredKind;
+use crate::hii::forms::StoreDeclaration;
+use crate::hii::package::DevicePath;
+use crate::hii::VariableKey;
+
+/// A store whose settings this module reads and restores.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum FormSetStore {
+    /// A Buffer or Name/Value store: the settings that `request` names, which are all but those
+    /// of PASSWORD questions, if `holds_password`
+    Config {
+        id: u16,
+        kind: ConfigKind,
+        request: ConfigRequest,
+        holds_password: bool,
+    },
+    /// An EFI variable store, whose PASSWORD questions' bytes, if `holds_password`, read as zero
+    /// through withholding variables
+    EfiVariable {
+        id: u16,
+        key: VariableKey,
+        holds_password: bool,
+    },
+}
+
+/// The kind of a FormSetStore::Config, which labels name.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ConfigKind {
+    Buffer,
+    NameValue,
+}
+
+impl FormSetStore {
+    /// The store of `declaration`, in a package list whose driver handle has the device path of
+    /// `device_path`, which a `<ConfigHdr>` names; None for a Buffer or Name/Value store that no
+    /// question requests a setting of.
+    pub(crate) fn of(
+        declaration: &StoreDeclaration,
+        device_path: Option<&DevicePath>,
+    ) -> Result<Option<Self>, StoreRefusal> {
+        let id = declaration.id;
+        let (kind, name, elements) = match &declaration.kind {
+            DeclaredKind::EfiVariable { name } => {
+                let key = VariableKey {
+                    name: name.clone(),
+                    guid: declaration.guid,
+                };
+                return Ok(Some(Self::EfiVariable {
+                    id,
+                    key,
+                    holds_password: declaration.holds_password,
+                }));
+            }
+            DeclaredKind::Buffer { name, blocks } => {
+                let elements = blocks
+                    .iter()
+                    .map(|&(offset, width)| {
+                        BlockName::new(usize::from(offset), width).map(RequestElement::Block)
+                    })
+                    .collect::<Result<Vec<_>, _>>();
+                (ConfigKind::Buffer, name.encode_utf16().collect(), elements)
+            }
+            // A NULL Name, as a forms browser names Name/Value storage (edk2-stable202608
+            // SetupBrowserDxe IfrParse.c CreateStorage)
+            DeclaredKind::NameValue { names } => {
+                let elements = names
+                    .iter()
+                    .map(|name| Label::try_from(name.as_str()).map(RequestElement::Label))
+                    .collect::<Result<Vec<_>, _>>();
+                (ConfigKind::NameValue, Vec::new(), elements)
+            }
+        };
+        let label = StoreLabel::of(id, kind, &name);
+        let elements = elements.map_err(|error| StoreRefusal::Element {
+            store: label.clone(),
+            error,
+        })?;
+        if elements.is_empty() {
+            return Ok(None);
+        }
+        // A forms browser builds no <ConfigHdr> for a driver handle without a device path
+        // (edk2-stable202608 UefiHiiLib HiiLib.c HiiConstructConfigHdr), which the HII database
+        // keeps as the list's device path package (UEFI 2.11 §33.3.4)
+        let device_path = device_path.ok_or(StoreRefusal::NoDevicePath(label))?;
+        let header = ConfigHdr {
+            guid: declaration.guid,
+            name,
+            device_path: device_path.clone(),
+        };
+        let request =
+            ConfigRequest::new(header, elements).map_err(|error| StoreRefusal::Element {
+                store: StoreLabel::of(id, kind, &[]),
+                error,
+            })?;
+        Ok(Some(Self::Config {
+            id,
+            kind,
+            request,
+            holds_password: declaration.holds_password,
+        }))
+    }
+
+    /// How messages name the store.
+    pub(crate) fn label(&self) -> StoreLabel {
+        match self {
+            Self::Config {
+                id, kind, request, ..
+            } => StoreLabel::of(*id, *kind, &request.header().name),
+            Self::EfiVariable { id, key, .. } => {
+                StoreLabel(format!("VARSTORE_EFI {id:#06x} {key}"))
+            }
+        }
+    }
+
+    /// The settings of the store now: ExtractConfig() of its request, whose `<ConfigResp>` for
+    /// the request's `<ConfigHdr>` must give exactly the requested settings, its `<AltResp>`s
+    /// aside; or GetVariable().
+    pub(crate) fn read(
+        &self,
+        routing: &impl ConfigRouting,
+        variables: &impl VariableData,
+    ) -> Result<Settings, StoreError> {
+        let request = match self {
+            Self::EfiVariable { key, .. } => {
+                let contents = variables
+                    .variable_data(key)
+                    .map_err(|error| StoreError::Variable(format!("{error:#}")))?;
+                return Ok(Settings::from([(
+                    SettingKey::Variable,
+                    Setting::Variable(contents),
+                )]));
+            }
+            Self::Config { request, .. } => request,
+        };
+        let results = routing
+            .extract_config(request)
+            .map_err(StoreError::Routing)?;
+        let resp = results
+            .as_slice()
+            .iter()
+            .map(|alt| &alt.resp)
+            .find(|resp| resp.header == *request.header())
+            .ok_or(StoreError::NoResp)?;
+        requested_settings(request, resp)
+    }
+}
+
+/// The `<ConfigResp>` that writes `settings` to the Buffer or Name/Value store of `request`: one
+/// element per setting of the request, in its order, as a forms browser routes a whole store.
+pub(crate) fn config_resp(
+    request: &ConfigRequest,
+    settings: &Settings,
+) -> Result<ConfigResp, StoreError> {
+    let body = request
+        .elements()
+        .iter()
+        .map(|element| {
+            let key = SettingKey::of(element);
+            let element = match (element, settings.get(&key)) {
+                (RequestElement::Block(block), Some(Setting::Bytes(bytes))) => {
+                    BlockConfig::new(block.offset(), bytes.to_vec()).map(ConfigElement::Block)
+                }
+                (RequestElement::Label(label), Some(Setting::Digits(digits))) => {
+                    NvConfig::new(label.clone(), digits).map(ConfigElement::Nv)
+                }
+                (
+                    RequestElement::Block(_),
+                    Some(Setting::Digits(_) | Setting::Variable(_)) | None,
+                )
+                | (
+                    RequestElement::Label(_),
+                    Some(Setting::Bytes(_) | Setting::Variable(_)) | None,
+                ) => return Err(StoreError::SettingMissing(key)),
+            };
+            element.map_err(StoreError::Resp)
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(ConfigResp {
+        header: request.header().clone(),
+        body,
+    })
+}
+
+/// The settings that `resp` gives for `request`: each requested block at the same OFFSET and
+/// WIDTH and each requested name once, and nothing else.
+fn requested_settings(request: &ConfigRequest, resp: &ConfigResp) -> Result<Settings, StoreError> {
+    let requested: BTreeSet<SettingKey> = request.elements().iter().map(SettingKey::of).collect();
+    let mut settings = Settings::new();
+    for element in &resp.body {
+        let (key, setting) = match element {
+            ConfigElement::Block(config) => (
+                SettingKey::Block {
+                    offset: config.offset(),
+                    width: config.value().len(),
+                },
+                Setting::Bytes(Zeroizing::new(config.value().to_vec())),
+            ),
+            ConfigElement::Nv(config) => (
+                SettingKey::Name(config.label().to_string()),
+                Setting::Digits(Zeroizing::new(config.value().to_owned())),
+            ),
+        };
+        if !requested.contains(&key) {
+            return Err(StoreError::Unrequested(key));
+        }
+        if let Some(_repeated) = settings.insert(key.clone(), setting) {
+            return Err(StoreError::Repeated(key));
+        }
+    }
+    match requested
+        .into_iter()
+        .find(|key| !settings.contains_key(key))
+    {
+        Some(missing) => Err(StoreError::SettingMissing(missing)),
+        None => Ok(settings),
+    }
+}
+
+/// How messages name a store: its IFR op, VarStoreId and name.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct StoreLabel(String);
+
+impl StoreLabel {
+    fn of(id: u16, kind: ConfigKind, name: &[u16]) -> Self {
+        let name = String::from_utf16_lossy(name);
+        Self(match kind {
+            ConfigKind::Buffer => format!("VARSTORE {id:#06x} {name}"),
+            ConfigKind::NameValue => format!("VARSTORE_NAME_VALUE {id:#06x}"),
+        })
+    }
+}
+
+impl fmt::Display for StoreLabel {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+/// A setting of a store: a block or a name of its request, or the whole EFI variable.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub(crate) enum SettingKey {
+    Block { offset: usize, width: usize },
+    Name(String),
+    Variable,
+}
+
+impl SettingKey {
+    /// The setting that `element` requests.
+    fn of(element: &RequestElement) -> Self {
+        match element {
+            RequestElement::Block(block) => Self::Block {
+                offset: block.offset(),
+                width: block.width().get(),
+            },
+            RequestElement::Label(label) => Self::Name(label.to_string()),
+        }
+    }
+}
+
+impl fmt::Display for SettingKey {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Block { offset, width } => write!(f, "OFFSET={offset:04x}&WIDTH={width:04x}"),
+            Self::Name(name) => f.write_str(name),
+            Self::Variable => f.write_str("its data and attributes"),
+        }
+    }
+}
+
+/// The value of a setting.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum Setting {
+    /// A block's bytes, as they lie in the buffer
+    Bytes(Zeroizing<Vec<u8>>),
+    /// A name's hex digits
+    Digits(Zeroizing<String>),
+    /// The variable's data and attributes, or None if it is absent
+    Variable(Option<VariableContents>),
+}
+
+/// The settings of a store, by key.
+pub(crate) type Settings = BTreeMap<SettingKey, Setting>;
+
+/// Why the settings of a store were not read, or no `<ConfigResp>` of them was built.
+#[derive(Debug, Error)]
+pub(crate) enum StoreError {
+    #[error("{0}")]
+    Routing(ConfigRoutingError),
+    #[error("ExtractConfig() returned no <ConfigResp> for its <ConfigHdr>")]
+    NoResp,
+    #[error("ExtractConfig() returned no value for {0}")]
+    SettingMissing(SettingKey),
+    #[error("ExtractConfig() returned {0}, which its <ConfigRequest> did not request")]
+    Unrequested(SettingKey),
+    #[error("ExtractConfig() returned {0} twice")]
+    Repeated(SettingKey),
+    #[error("the <ConfigResp> of its settings: {0}")]
+    Resp(ConfigStringError),
+    /// GetVariable()'s error, as `{:#}` shows it
+    #[error("{0}")]
+    Variable(String),
+}
+
+/// Why no Callback() runs: a store that cannot be read, so that a change to it would go unseen.
+#[derive(Debug, Error)]
+pub(crate) enum StoreRefusal {
+    #[error("cannot snapshot store {store}: {error}")]
+    Unreadable {
+        store: StoreLabel,
+        error: StoreError,
+    },
+    #[error(
+        "cannot snapshot store {0}: its package list has no device path package, so no \
+         <ConfigHdr> names its driver for EFI_HII_CONFIG_ROUTING_PROTOCOL"
+    )]
+    NoDevicePath(StoreLabel),
+    #[error("cannot snapshot store {store}: {error}")]
+    Element {
+        store: StoreLabel,
+        error: ConfigStringError,
+    },
+}
+
+/// The settings of the FormSet's stores before the first Callback(), without those that changed
+/// between two reads back-to-back.
+pub(crate) struct Baseline {
+    stores: Vec<(FormSetStore, Settings)>,
+    /// The settings left out of the comparison, by store label
+    dynamic: Vec<(StoreLabel, SettingKey)>,
+}
+
+impl Baseline {
+    /// Reads each of `stores` twice, back-to-back; refuses if any read fails.
+    pub(crate) fn take(
+        stores: Vec<FormSetStore>,
+        routing: &impl ConfigRouting,
+        variables: &impl VariableData,
+    ) -> Result<Self, StoreRefusal> {
+        let first = read_all(&stores, routing, variables)?;
+        let second = read_all(&stores, routing, variables)?;
+        let mut dynamic = Vec::new();
+        let stores = stores
+            .into_iter()
+            .zip(first.into_iter().zip(second))
+            .map(|(store, (first, mut second))| {
+                second.retain(|key, setting| {
+                    let same = first.get(key) == Some(setting);
+                    if !same {
+                        dynamic.push((store.label(), key.clone()));
+                    }
+                    same
+                });
+                (store, second)
+            })
+            .collect();
+        Ok(Self { stores, dynamic })
+    }
+
+    /// The settings left out of the comparison, as `"<store>: <setting>"`.
+    pub(crate) fn dynamic(&self) -> Vec<String> {
+        self.dynamic
+            .iter()
+            .map(|(store, key)| format!("{store}: {key}"))
+            .collect()
+    }
+
+    /// Reads the stores again; restores, through `routing` and `variables`, each store whose
+    /// settings differ from the baseline, then reads it once more to verify.
+    pub(crate) fn check(
+        &self,
+        routing: &impl ConfigRouting,
+        variables: &impl VariableData,
+    ) -> StoresCheck {
+        let mut changed = Vec::new();
+        let mut unreadable = Vec::new();
+        for (store, baseline) in &self.stores {
+            match store.read(routing, variables) {
+                Ok(now) => {
+                    let keys = changed_settings(baseline, &now);
+                    if !keys.is_empty() {
+                        changed.push(ChangedStore {
+                            store: store.clone(),
+                            baseline: baseline.clone(),
+                            now,
+                            keys,
+                        });
+                    }
+                }
+                Err(error) => unreadable.push((store.label(), error)),
+            }
+        }
+        let (withheld, restorable): (Vec<_>, Vec<_>) =
+            changed
+                .into_iter()
+                .partition(|changed| match changed.store {
+                    FormSetStore::Config { holds_password, .. }
+                    | FormSetStore::EfiVariable { holds_password, .. } => holds_password,
+                });
+        let restoration =
+            (!restorable.is_empty()).then(|| restore(&restorable, routing, variables));
+        StoresCheck {
+            changed: restorable.iter().map(|store| store.store.label()).collect(),
+            unrestored: withheld.into_iter().map(|store| store.store).collect(),
+            unreadable,
+            restoration,
+        }
+    }
+}
+
+/// The settings of each of `stores`, read once; refuses if any read fails.
+fn read_all(
+    stores: &[FormSetStore],
+    routing: &impl ConfigRouting,
+    variables: &impl VariableData,
+) -> Result<Vec<Settings>, StoreRefusal> {
+    stores
+        .iter()
+        .map(|store| {
+            store
+                .read(routing, variables)
+                .map_err(|error| StoreRefusal::Unreadable {
+                    store: store.label(),
+                    error,
+                })
+        })
+        .collect()
+}
+
+/// The keys of `baseline` whose settings `now` holds otherwise, or lacks.
+fn changed_settings(baseline: &Settings, now: &Settings) -> BTreeSet<SettingKey> {
+    baseline
+        .iter()
+        .filter(|(key, setting)| now.get(*key) != Some(*setting))
+        .map(|(key, _)| key.clone())
+        .collect()
+}
+
+/// A store whose settings `keys` changed from `baseline` to `now`.
+struct ChangedStore {
+    store: FormSetStore,
+    baseline: Settings,
+    now: Settings,
+    keys: BTreeSet<SettingKey>,
+}
+
+/// Writes each changed store back, then reads the stores to verify.
+fn restore(
+    changed: &[ChangedStore],
+    routing: &impl ConfigRouting,
+    variables: &impl VariableData,
+) -> Restoration {
+    let failures: Vec<String> = changed
+        .iter()
+        .filter_map(|store| {
+            restore_store(store, routing, variables)
+                .err()
+                .map(|error| format!("{}: {error}", store.store.label()))
+        })
+        .collect();
+    if !failures.is_empty() {
+        return Restoration::Failed(failures);
+    }
+    let unverified: Vec<String> = changed
+        .iter()
+        .filter_map(|store| match store.store.read(routing, variables) {
+            Ok(now) => {
+                let still = changed_settings(&store.baseline, &now);
+                let still: Vec<String> = still
+                    .intersection(&store.keys)
+                    .map(SettingKey::to_string)
+                    .collect();
+                (!still.is_empty())
+                    .then(|| format!("{}: {} differ", store.store.label(), still.join(", ")))
+            }
+            Err(error) => Some(format!("{}: {error}", store.store.label())),
+        })
+        .collect();
+    match unverified.is_empty() {
+        true => Restoration::Verified,
+        false => Restoration::NotVerified(unverified),
+    }
+}
+
+/// Writes `changed` back. A Buffer or Name/Value store gets RouteConfig() of one `<ConfigResp>`
+/// of every setting of its request, as a forms browser routes a whole store, and as a driver that
+/// zeroes its copy before ConfigToBlock() needs (edk2-stable202608 HttpBootConfig.c:441-449):
+/// the changed settings take their baseline values, the others, those left out as dynamic among
+/// them, the values read after the Callback()s. An EFI variable store gets SetVariable() of the
+/// saved data and attributes, deleting the variable first only when its attributes changed, as
+/// SetVariable() cannot change them, or deleting it when it was absent (UEFI 2.11 §8.2.3).
+fn restore_store(
+    changed: &ChangedStore,
+    routing: &impl ConfigRouting,
+    variables: &impl VariableData,
+) -> Result<(), RestoreError> {
+    let request = match &changed.store {
+        FormSetStore::EfiVariable { key, .. } => {
+            let saved = match changed.baseline.get(&SettingKey::Variable) {
+                Some(Setting::Variable(saved)) => saved,
+                Some(Setting::Bytes(_) | Setting::Digits(_)) | None => {
+                    return Err(RestoreError::NoBaseline(SettingKey::Variable))
+                }
+            };
+            let now = match changed.now.get(&SettingKey::Variable) {
+                Some(Setting::Variable(now)) => now.as_ref(),
+                Some(Setting::Bytes(_) | Setting::Digits(_)) | None => None,
+            };
+            return restore_variable(key, saved.as_ref(), now, variables);
+        }
+        FormSetStore::Config { request, .. } => request,
+    };
+    let mut settings = changed.now.clone();
+    for key in &changed.keys {
+        let saved = changed
+            .baseline
+            .get(key)
+            .ok_or_else(|| RestoreError::NoBaseline(key.clone()))?;
+        settings.insert(key.clone(), saved.clone());
+    }
+    let resp = config_resp(request, &settings).map_err(RestoreError::Resp)?;
+    routing.route_config(&resp).map_err(RestoreError::Routing)
+}
+
+/// SetVariable() of `saved` over `now`, as restore_store describes.
+fn restore_variable(
+    key: &VariableKey,
+    saved: Option<&VariableContents>,
+    now: Option<&VariableContents>,
+    variables: &impl VariableData,
+) -> Result<(), RestoreError> {
+    match (saved, now) {
+        (None, Some(_)) => variables
+            .delete_variable(key)
+            .map_err(RestoreError::variable),
+        (None, None) => Ok(()),
+        (Some(saved), now) => {
+            if now.is_some_and(|now| now.attributes() != saved.attributes()) {
+                variables
+                    .delete_variable(key)
+                    .map_err(RestoreError::variable)?;
+            }
+            variables
+                .set_variable(key, saved)
+                .map_err(RestoreError::variable)
+        }
+    }
+}
+
+/// Why a restore failed.
+#[derive(Debug, Error)]
+enum RestoreError {
+    #[error("{0}")]
+    Routing(ConfigRoutingError),
+    #[error("{0}")]
+    Resp(StoreError),
+    #[error("no saved value of {0}")]
+    NoBaseline(SettingKey),
+    /// SetVariable()'s error, as `{:#}` shows it
+    #[error("{0}")]
+    Variable(String),
+}
+
+impl RestoreError {
+    /// SetVariable()'s or the deletion's `error`, as Variable holds it.
+    fn variable(error: anyhow::Error) -> Self {
+        Self::Variable(format!("{error:#}"))
+    }
+}
+
+/// What Baseline::check found.
+#[derive(Debug)]
+pub(crate) struct StoresCheck {
+    /// The stores whose settings changed, which were restored
+    pub(crate) changed: Vec<StoreLabel>,
+    /// The stores whose settings changed but that hold a password, which were not restored
+    pub(crate) unrestored: Vec<FormSetStore>,
+    /// The stores that could not be read after the Callback()s, so were not compared
+    pub(crate) unreadable: Vec<(StoreLabel, StoreError)>,
+    /// The restore of the changed stores, if any changed
+    pub(crate) restoration: Option<Restoration>,
+}
+
+/// How the restore of changed stores ended.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum Restoration {
+    Verified,
+    /// A read after the restore still differs, or failed
+    NotVerified(Vec<String>),
+    Failed(Vec<String>),
+}
+
+impl StoresCheck {
+    /// Why the change is not applied, if the Callback()s changed a store or one could not be
+    /// read again: `"the Callback sequence changed stores of the FormSet: <stores>; restored
+    /// and verified"`, or how the restore failed, each store left as changed because it holds a
+    /// password, and the unreadable stores.
+    pub(crate) fn refusal(&self) -> Option<String> {
+        let mut reasons = Vec::new();
+        if let Some(restoration) = &self.restoration {
+            let stores: Vec<String> = self.changed.iter().map(StoreLabel::to_string).collect();
+            let restored = match restoration {
+                Restoration::Verified => "restored and verified".to_string(),
+                Restoration::NotVerified(stores) => {
+                    format!("restore did not verify: {}", stores.join("; "))
+                }
+                Restoration::Failed(errors) => format!("restore failed: {}", errors.join("; ")),
+            };
+            reasons.push(format!(
+                "the Callback sequence changed stores of the FormSet: {}; {restored}",
+                stores.join(", ")
+            ));
+        }
+        reasons.extend(self.unrestored.iter().map(|store| match store {
+            FormSetStore::Config { id, .. } => format!(
+                "the Callback sequence changed VarStore {id:#06x}, which holds a PASSWORD \
+                 question; it was not restored, because a RouteConfig() without the password \
+                 bytes may clear it"
+            ),
+            FormSetStore::EfiVariable { id, .. } => format!(
+                "the Callback sequence changed VarStore {id:#06x}, which holds a PASSWORD \
+                 question; it was not restored, because SetVariable() writes every byte of the \
+                 variable, the password's too, which uefisettings never writes"
+            ),
+        }));
+        reasons.extend(self.unreadable.iter().map(|(store, error)| {
+            format!(
+                "cannot snapshot store {store} after the Callback sequence: {error}; its \
+                 settings were not compared"
+            )
+        }));
+        (!reasons.is_empty()).then(|| reasons.join("; "))
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use std::cell::Cell;
+    use std::cell::RefCell;
+    use std::num::NonZeroUsize;
+
+    use super::*;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::tests::NV_BS_RT;
+    use crate::hii::config_string::MultiConfigAltResp;
+    use crate::hii::package::Guid;
+    use crate::hii::VariableAttributes;
+
+    pub(crate) const STORE_GUID: Guid = Guid {
+        data1: 0x8c78_a505,
+        data2: 0xbaa0,
+        data3: 0x4c4a,
+        data4: [0x86, 0x9f, 0, 0, 0, 0, 0x02, 0x01],
+    };
+    /// A vendor device path node of the test GUID, then an End node: what a driver installs on
+    /// its handle.
+    pub(crate) fn device_path() -> DevicePath {
+        let mut path = vec![0x01, 0x04, 0x14, 0x00];
+        path.extend(<[u8; 16]>::from(STORE_GUID));
+        path.extend([0x7F, 0xFF, 0x04, 0x00]);
+        path.into()
+    }
+
+    /// Buffer and Name/Value storage that a driver holds, behind a fake
+    /// EFI_HII_CONFIG_ROUTING_PROTOCOL: per <ConfigHdr>, its bytes and its names' digits.
+    #[derive(Default)]
+    pub(crate) struct FakeRouting {
+        pub(crate) buffers: RefCell<BTreeMap<String, Vec<u8>>>,
+        pub(crate) names: RefCell<BTreeMap<String, BTreeMap<String, String>>>,
+        /// Headers that ExtractConfig() answers with another <ConfigHdr>
+        pub(crate) answers_other: RefCell<BTreeSet<String>>,
+        /// The offsets of the requested blocks that ExtractConfig() leaves out
+        pub(crate) omitted: RefCell<BTreeSet<usize>>,
+        /// Elements that ExtractConfig() adds to its answer
+        pub(crate) extra: RefCell<Vec<String>>,
+        /// ExtractConfig() fails from this call on, counting from 0
+        pub(crate) extract_fails_from: Cell<Option<usize>>,
+        /// Bytes that each ExtractConfig() increments, as a timestamp changes
+        pub(crate) ticking: RefCell<Vec<usize>>,
+        pub(crate) route_fails: Cell<bool>,
+        /// RouteConfig() writes nothing but succeeds
+        pub(crate) route_ignored: Cell<bool>,
+        pub(crate) extracts: Cell<usize>,
+        pub(crate) routed: RefCell<Vec<String>>,
+    }
+
+    impl FakeRouting {
+        pub(crate) fn with_buffer(self, header: &ConfigHdr, bytes: &[u8]) -> Self {
+            self.buffers
+                .borrow_mut()
+                .insert(header.to_string(), bytes.to_vec());
+            self
+        }
+
+        pub(crate) fn with_names(self, header: &ConfigHdr, names: &[(&str, &str)]) -> Self {
+            let names = names
+                .iter()
+                .map(|(name, digits)| (name.to_string(), digits.to_string()))
+                .collect();
+            self.names.borrow_mut().insert(header.to_string(), names);
+            self
+        }
+
+        pub(crate) fn buffer(&self, header: &ConfigHdr) -> Vec<u8> {
+            self.buffers.borrow()[&header.to_string()].clone()
+        }
+    }
+
+    impl ConfigRouting for FakeRouting {
+        fn extract_config(
+            &self,
+            request: &ConfigRequest,
+        ) -> Result<MultiConfigAltResp, ConfigRoutingError> {
+            let call = self.extracts.get();
+            self.extracts.set(call + 1);
+            if self
+                .extract_fails_from
+                .get()
+                .is_some_and(|from| call >= from)
+            {
+                return Err(ConfigRoutingError::Status {
+                    function: "ExtractConfig",
+                    status: crate::efi_status::EfiStatus::NOT_FOUND,
+                    progress: 0,
+                });
+            }
+            let header = request.header().to_string();
+            for &at in self.ticking.borrow().iter() {
+                if let Some(bytes) = self.buffers.borrow_mut().get_mut(&header) {
+                    bytes[at] = bytes[at].wrapping_add(1);
+                }
+            }
+            let mut body = Vec::new();
+            for element in request.elements() {
+                match element {
+                    RequestElement::Block(block) => {
+                        if self.omitted.borrow().contains(&block.offset()) {
+                            continue;
+                        }
+                        let buffers = self.buffers.borrow();
+                        let bytes = &buffers[&header][block.offset()..][..block.width().get()];
+                        // most significant first, as edk2's BlockToConfig writes VALUE
+                        let value: String = bytes
+                            .iter()
+                            .rev()
+                            .map(|byte| format!("{byte:02x}"))
+                            .collect();
+                        body.push(format!(
+                            "OFFSET={:04x}&WIDTH={:04x}&VALUE={value}",
+                            block.offset(),
+                            block.width()
+                        ));
+                    }
+                    RequestElement::Label(label) => {
+                        let names = self.names.borrow();
+                        body.push(format!("{label}={}", names[&header][&label.to_string()]));
+                    }
+                }
+            }
+            body.extend(self.extra.borrow().iter().cloned());
+            let shown = match self.answers_other.borrow().contains(&header) {
+                true => header.replacen("GUID=0", "GUID=f", 1),
+                false => header,
+            };
+            let text = format!("{shown}&{}", body.join("&"));
+            Ok(text.parse().expect("a <MultiConfigAltResp>"))
+        }
+
+        fn route_config(&self, resp: &ConfigResp) -> Result<(), ConfigRoutingError> {
+            self.routed.borrow_mut().push(resp.to_string());
+            if self.route_fails.get() {
+                return Err(ConfigRoutingError::Status {
+                    function: "RouteConfig",
+                    status: crate::efi_status::EfiStatus::DEVICE_ERROR,
+                    progress: 0,
+                });
+            }
+            if self.route_ignored.get() {
+                return Ok(());
+            }
+            let header = resp.header.to_string();
+            for element in &resp.body {
+                match element {
+                    ConfigElement::Block(config) => {
+                        let mut buffers = self.buffers.borrow_mut();
+                        let bytes = buffers.get_mut(&header).expect("a known buffer");
+                        config.write_to(bytes).expect("block inside the buffer");
+                    }
+                    ConfigElement::Nv(config) => {
+                        self.names
+                            .borrow_mut()
+                            .get_mut(&header)
+                            .expect("known names")
+                            .insert(config.label().to_string(), config.value().to_string());
+                    }
+                }
+            }
+            Ok(())
+        }
+    }
+
+    pub(crate) fn width(width: usize) -> NonZeroUsize {
+        NonZeroUsize::new(width).expect("nonzero width")
+    }
+
+    pub(crate) fn buffer_declaration(
+        id: u16,
+        name: &str,
+        blocks: &[(u16, usize)],
+    ) -> StoreDeclaration {
+        StoreDeclaration {
+            id,
+            guid: STORE_GUID,
+            kind: DeclaredKind::Buffer {
+                name: name.to_string(),
+                blocks: blocks
+                    .iter()
+                    .map(|&(offset, size)| (offset, width(size)))
+                    .collect(),
+            },
+            holds_password: false,
+        }
+    }
+
+    fn name_value_declaration(id: u16, names: &[&str]) -> StoreDeclaration {
+        StoreDeclaration {
+            id,
+            guid: STORE_GUID,
+            kind: DeclaredKind::NameValue {
+                names: names.iter().map(|name| name.to_string()).collect(),
+            },
+            holds_password: false,
+        }
+    }
+
+    pub(crate) fn efi_declaration(id: u16, name: &str) -> StoreDeclaration {
+        StoreDeclaration {
+            id,
+            guid: STORE_GUID,
+            kind: DeclaredKind::EfiVariable {
+                name: name.to_string(),
+            },
+            holds_password: false,
+        }
+    }
+
+    pub(crate) fn store(declaration: &StoreDeclaration) -> FormSetStore {
+        FormSetStore::of(declaration, Some(&device_path()))
+            .expect("a store")
+            .expect("a store with settings")
+    }
+
+    pub(crate) fn header_of(store: &FormSetStore) -> ConfigHdr {
+        match store {
+            FormSetStore::Config { request, .. } => request.header().clone(),
+            FormSetStore::EfiVariable { .. } => panic!("an EFI variable store has no header"),
+        }
+    }
+
+    /// The fixture of most tests: a 4-byte Buffer store whose questions request bytes 0-1 and
+    /// 3, a Name/Value store of "Mode" and "Level", and an EFI variable store; with their routing
+    /// and variables.
+    struct Fixture {
+        stores: Vec<FormSetStore>,
+        buffer: ConfigHdr,
+        names: ConfigHdr,
+        variable: VariableKey,
+        routing: FakeRouting,
+        variables: HeldVariables,
+    }
+
+    fn fixture() -> Fixture {
+        let stores = vec![
+            store(&buffer_declaration(2, "Buffer", &[(0, 2), (3, 1)])),
+            store(&name_value_declaration(3, &["Mode", "Level"])),
+            store(&efi_declaration(1, "Store")),
+        ];
+        let buffer = header_of(&stores[0]);
+        let names = header_of(&stores[1]);
+        let routing = FakeRouting::default()
+            .with_buffer(&buffer, &[0x10, 0x11, 0x12, 0x13])
+            .with_names(&names, &[("Mode", "1"), ("Level", "5")]);
+        let variables = HeldVariables::default().with("Store", STORE_GUID, &[0x5A; 4]);
+        Fixture {
+            stores,
+            buffer,
+            names,
+            variable: key("Store", STORE_GUID),
+            routing,
+            variables,
+        }
+    }
+
+    fn baseline(fixture: &Fixture) -> Baseline {
+        Baseline::take(fixture.stores.clone(), &fixture.routing, &fixture.variables)
+            .expect("read every store")
+    }
+
+    fn variable_data(variables: &HeldVariables, key: &VariableKey) -> Option<(u32, Vec<u8>)> {
+        variables
+            .variables
+            .borrow()
+            .get(key)
+            .map(|contents| (contents.attributes().bits(), contents.data().to_vec()))
+    }
+
+    #[test]
+    fn request_names_each_question_setting_of_a_buffer_store() {
+        let store = store(&buffer_declaration(2, "Buffer", &[(0, 2), (3, 1)]));
+        let FormSetStore::Config { request, .. } = &store else {
+            panic!("a Buffer store is a Config store");
+        };
+        let path: String = device_path()
+            .as_ref()
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect();
+        assert_eq!(
+            request.to_string(),
+            format!(
+                "GUID=05a5788ca0ba4a4c869f000000000201&NAME=004200750066006600650072&PATH={path}\
+                 &OFFSET=0000&WIDTH=0002&OFFSET=0003&WIDTH=0001"
+            ),
+            "the <ConfigRequest> of a Buffer store"
+        );
+    }
+
+    #[test]
+    fn request_names_each_question_name_of_a_name_value_store_with_a_null_name() {
+        let store = store(&name_value_declaration(3, &["Mode", "Level"]));
+        let FormSetStore::Config { request, .. } = &store else {
+            panic!("a Name/Value store is a Config store");
+        };
+        assert!(
+            request.to_string().contains("&NAME=&PATH=")
+                && request.to_string().ends_with("&Mode&Level"),
+            "the <ConfigRequest> of a Name/Value store: {request}"
+        );
+    }
+
+    #[test]
+    fn config_store_without_device_path_is_refused_and_one_without_settings_skipped() {
+        let declaration = buffer_declaration(2, "Buffer", &[(0, 1)]);
+        let refused = FormSetStore::of(&declaration, None).expect_err("no device path");
+        assert_eq!(
+            refused.to_string(),
+            "cannot snapshot store VARSTORE 0x0002 Buffer: its package list has no device path \
+             package, so no <ConfigHdr> names its driver for EFI_HII_CONFIG_ROUTING_PROTOCOL",
+            "a Buffer store without a device path"
+        );
+        let empty = buffer_declaration(2, "Buffer", &[]);
+        assert_eq!(
+            FormSetStore::of(&empty, None).expect("no settings to read"),
+            None,
+            "a Buffer store that no question requests"
+        );
+        let efi = FormSetStore::of(&efi_declaration(1, "Store"), None).expect("no path needed");
+        assert!(
+            matches!(efi, Some(FormSetStore::EfiVariable { .. })),
+            "an EFI variable store needs no device path: {efi:?}"
+        );
+    }
+
+    #[test]
+    fn unchanged_stores_pass_and_nothing_is_written() {
+        let fixture = fixture();
+        let baseline = baseline(&fixture);
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(check.refusal(), None, "unchanged stores: {check:?}");
+        assert!(check.restoration.is_none(), "no restore");
+        assert!(
+            fixture.routing.routed.borrow().is_empty(),
+            "no RouteConfig()"
+        );
+        assert!(
+            fixture.variables.set.borrow().is_empty(),
+            "no SetVariable()"
+        );
+    }
+
+    #[test]
+    fn a_changed_buffer_store_is_restored_whole_and_verified() {
+        let fixture = fixture();
+        let baseline = baseline(&fixture);
+        // the Callback writes byte 1, which a question requests, and byte 2, which none does
+        fixture
+            .routing
+            .buffers
+            .borrow_mut()
+            .get_mut(&fixture.buffer.to_string())
+            .expect("buffer")[1..3]
+            .copy_from_slice(&[0xB1, 0xB2]);
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            check.refusal().as_deref(),
+            Some(
+                "the Callback sequence changed stores of the FormSet: VARSTORE 0x0002 Buffer; \
+                 restored and verified"
+            ),
+            "a changed Buffer store"
+        );
+        assert_eq!(
+            *fixture.routing.routed.borrow(),
+            [format!(
+                "{}&OFFSET=0000&WIDTH=0002&VALUE=1110&OFFSET=0003&WIDTH=0001&VALUE=13",
+                fixture.buffer
+            )],
+            "RouteConfig() of every setting of the store, the changed one saved"
+        );
+        assert_eq!(
+            fixture.routing.buffer(&fixture.buffer),
+            [0x10, 0x11, 0xB2, 0x13],
+            "the requested bytes restored, the others as the Callback left them"
+        );
+    }
+
+    #[test]
+    fn a_changed_name_is_restored() {
+        let fixture = fixture();
+        let baseline = baseline(&fixture);
+        fixture
+            .routing
+            .names
+            .borrow_mut()
+            .get_mut(&fixture.names.to_string())
+            .expect("names")
+            .insert("Mode".into(), "2".into());
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            check.restoration,
+            Some(Restoration::Verified),
+            "a changed name: {check:?}"
+        );
+        assert_eq!(
+            *fixture.routing.routed.borrow(),
+            [format!("{}&Mode=1&Level=5", fixture.names)],
+            "RouteConfig() of every name, the changed one's saved digits"
+        );
+    }
+
+    #[test]
+    fn a_changed_variable_is_set_back_without_a_delete() {
+        let fixture = fixture();
+        let baseline = baseline(&fixture);
+        fixture
+            .variables
+            .set_variable(
+                &fixture.variable,
+                &VariableContents::new(NV_BS_RT, vec![1, 0xC1, 0xC2, 0xC3]).expect("data"),
+            )
+            .expect("the Callback writes");
+        fixture.variables.set.borrow_mut().clear();
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            check.refusal().as_deref(),
+            Some(&*format!(
+                "the Callback sequence changed stores of the FormSet: VARSTORE_EFI 0x0001 {}; \
+                 restored and verified",
+                fixture.variable
+            )),
+            "a changed EFI variable store"
+        );
+        assert_eq!(
+            variable_data(&fixture.variables, &fixture.variable),
+            Some((NV_BS_RT.bits(), vec![0x5A; 4])),
+            "the saved data and attributes"
+        );
+        assert!(
+            fixture.variables.deleted.borrow().is_empty(),
+            "no delete with the same attributes"
+        );
+    }
+
+    #[test]
+    fn a_variable_whose_attributes_changed_is_deleted_then_set() {
+        let fixture = fixture();
+        let baseline = baseline(&fixture);
+        let nv_bs = VariableAttributes::NON_VOLATILE | VariableAttributes::BOOTSERVICE_ACCESS;
+        fixture
+            .variables
+            .set_variable(
+                &fixture.variable,
+                &VariableContents::new(nv_bs, vec![1]).expect("data"),
+            )
+            .expect("the Callback writes");
+
+        baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            *fixture.variables.deleted.borrow(),
+            std::slice::from_ref(&fixture.variable),
+            "deleted first"
+        );
+        assert_eq!(
+            variable_data(&fixture.variables, &fixture.variable),
+            Some((NV_BS_RT.bits(), vec![0x5A; 4])),
+            "then set with the saved attributes"
+        );
+    }
+
+    #[test]
+    fn a_variable_that_was_absent_is_deleted_and_a_deleted_one_set_back() {
+        let fixture = fixture();
+        let absent = key("Absent", STORE_GUID);
+        let stores = vec![
+            store(&efi_declaration(4, "Absent")),
+            fixture.stores[2].clone(),
+        ];
+        let baseline = Baseline::take(stores, &fixture.routing, &fixture.variables).expect("read");
+        fixture
+            .variables
+            .set_variable(
+                &absent,
+                &VariableContents::new(NV_BS_RT, vec![9]).expect("data"),
+            )
+            .expect("the Callback creates it");
+        fixture
+            .variables
+            .delete_variable(&fixture.variable)
+            .expect("the Callback deletes it");
+        fixture.variables.deleted.borrow_mut().clear();
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(check.restoration, Some(Restoration::Verified), "{check:?}");
+        assert_eq!(
+            variable_data(&fixture.variables, &absent),
+            None,
+            "created one deleted"
+        );
+        assert_eq!(
+            variable_data(&fixture.variables, &fixture.variable),
+            Some((NV_BS_RT.bits(), vec![0x5A; 4])),
+            "deleted one set back"
+        );
+    }
+
+    #[test]
+    fn a_failed_restore_is_reported_with_its_error() {
+        let fixture = fixture();
+        let baseline = baseline(&fixture);
+        fixture
+            .routing
+            .buffers
+            .borrow_mut()
+            .get_mut(&fixture.buffer.to_string())
+            .expect("buffer")[0] = 0;
+        fixture.routing.route_fails.set(true);
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            check.refusal().as_deref(),
+            Some(
+                "the Callback sequence changed stores of the FormSet: VARSTORE 0x0002 Buffer; \
+                 restore failed: VARSTORE 0x0002 Buffer: RouteConfig() returned \
+                 EFI_DEVICE_ERROR at CHAR16 0 of its string"
+            ),
+            "a failed RouteConfig()"
+        );
+    }
+
+    /// The variables `0`, whose SetVariable() and deletions fail.
+    struct WriteProtected<'a>(&'a HeldVariables);
+
+    impl VariableData for WriteProtected<'_> {
+        fn interface(&self) -> crate::hii::VariableInterface {
+            self.0.interface()
+        }
+
+        fn variable_data(&self, key: &VariableKey) -> anyhow::Result<Option<VariableContents>> {
+            self.0.variable_data(key)
+        }
+
+        fn set_variable(
+            &self,
+            key: &VariableKey,
+            _contents: &VariableContents,
+        ) -> anyhow::Result<()> {
+            Err(anyhow::anyhow!(
+                "SetVariable() of {key}: EFI_WRITE_PROTECTED"
+            ))
+        }
+
+        fn delete_variable(&self, key: &VariableKey) -> anyhow::Result<()> {
+            Err(anyhow::anyhow!("deletion of {key}: EFI_WRITE_PROTECTED"))
+        }
+    }
+
+    /// A restore whose deletion of a variable that the Callback()s created fails, or whose
+    /// SetVariable() of the saved data fails, is reported with that error, each by its store.
+    #[test]
+    fn a_failed_deletion_or_set_variable_of_a_restore_is_reported_with_its_error() {
+        let fixture = fixture();
+        let absent = key("Absent", STORE_GUID);
+        let stores = vec![
+            store(&efi_declaration(4, "Absent")),
+            fixture.stores[2].clone(),
+        ];
+        let baseline = Baseline::take(stores, &fixture.routing, &fixture.variables).expect("read");
+        fixture
+            .variables
+            .set_variable(
+                &absent,
+                &VariableContents::new(NV_BS_RT, vec![9]).expect("data"),
+            )
+            .expect("the Callback creates it");
+        fixture
+            .variables
+            .set_variable(
+                &fixture.variable,
+                &VariableContents::new(NV_BS_RT, vec![1]).expect("data"),
+            )
+            .expect("the Callback writes");
+
+        let check = baseline.check(&fixture.routing, &WriteProtected(&fixture.variables));
+
+        assert_eq!(
+            check.refusal().as_deref(),
+            Some(&*format!(
+                "the Callback sequence changed stores of the FormSet: VARSTORE_EFI 0x0004 \
+                 {absent}, VARSTORE_EFI 0x0001 {variable}; restore failed: VARSTORE_EFI 0x0004 \
+                 {absent}: deletion of {absent}: EFI_WRITE_PROTECTED; VARSTORE_EFI 0x0001 \
+                 {variable}: SetVariable() of {variable}: EFI_WRITE_PROTECTED",
+                variable = fixture.variable
+            )),
+            "a failed deletion and a failed SetVariable()"
+        );
+    }
+
+    #[test]
+    fn a_restore_that_writes_nothing_does_not_verify() {
+        let fixture = fixture();
+        let baseline = baseline(&fixture);
+        fixture
+            .routing
+            .buffers
+            .borrow_mut()
+            .get_mut(&fixture.buffer.to_string())
+            .expect("buffer")[3] = 0;
+        fixture.routing.route_ignored.set(true);
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            check.restoration,
+            Some(Restoration::NotVerified(vec![
+                "VARSTORE 0x0002 Buffer: OFFSET=0003&WIDTH=0001 differ".to_string()
+            ])),
+            "a RouteConfig() that ignores the settings"
+        );
+    }
+
+    #[test]
+    fn settings_that_change_between_two_reads_are_left_out() {
+        let fixture = fixture();
+        // byte 3 ticks at every ExtractConfig(), as a timestamp would
+        fixture.routing.ticking.borrow_mut().push(3);
+        let baseline = baseline(&fixture);
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            baseline.dynamic(),
+            ["VARSTORE 0x0002 Buffer: OFFSET=0003&WIDTH=0001"],
+            "the ticking setting"
+        );
+        assert_eq!(
+            check.refusal(),
+            None,
+            "a ticking setting is no change: {check:?}"
+        );
+        assert!(
+            fixture.routing.routed.borrow().is_empty(),
+            "nothing restored"
+        );
+    }
+
+    #[test]
+    fn a_changed_setting_beside_a_dynamic_one_is_still_caught() {
+        let fixture = fixture();
+        fixture.routing.ticking.borrow_mut().push(3);
+        let baseline = baseline(&fixture);
+        fixture
+            .routing
+            .buffers
+            .borrow_mut()
+            .get_mut(&fixture.buffer.to_string())
+            .expect("buffer")[0] = 0;
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(check.changed.len(), 1, "the changed store: {check:?}");
+        let routed = fixture.routing.routed.borrow();
+        // byte 3 ticked at the two reads of the baseline and the one after the Callback()s
+        assert!(
+            routed.len() == 1
+                && routed[0].ends_with(
+                    "&OFFSET=0000&WIDTH=0002&VALUE=1110&OFFSET=0003&WIDTH=0001&VALUE=16"
+                ),
+            "the changed setting saved, the dynamic one as read after the Callback()s: \
+             {routed:?}"
+        );
+    }
+
+    #[test]
+    fn an_unreadable_store_refuses_before_any_callback() {
+        let fixture = fixture();
+        fixture.routing.extract_fails_from.set(Some(0));
+
+        let refusal = Baseline::take(fixture.stores.clone(), &fixture.routing, &fixture.variables)
+            .err()
+            .expect("ExtractConfig() fails");
+
+        assert_eq!(
+            refusal.to_string(),
+            "cannot snapshot store VARSTORE 0x0002 Buffer: ExtractConfig() returned \
+             EFI_NOT_FOUND at CHAR16 0 of its string",
+            "the store that failed"
+        );
+    }
+
+    #[test]
+    fn a_store_missing_from_the_result_refuses() {
+        let fixture = fixture();
+        fixture
+            .routing
+            .answers_other
+            .borrow_mut()
+            .insert(fixture.buffer.to_string());
+
+        let refusal = Baseline::take(fixture.stores.clone(), &fixture.routing, &fixture.variables)
+            .err()
+            .expect("no <ConfigResp> for the store");
+
+        assert_eq!(
+            refusal.to_string(),
+            "cannot snapshot store VARSTORE 0x0002 Buffer: ExtractConfig() returned no \
+             <ConfigResp> for its <ConfigHdr>",
+            "a result without the store"
+        );
+    }
+
+    #[test]
+    fn a_setting_missing_from_the_result_refuses() {
+        let fixture = fixture();
+        fixture.routing.omitted.borrow_mut().insert(0);
+
+        let refusal = Baseline::take(fixture.stores.clone(), &fixture.routing, &fixture.variables)
+            .err()
+            .expect("a setting missing");
+
+        assert_eq!(
+            refusal.to_string(),
+            "cannot snapshot store VARSTORE 0x0002 Buffer: ExtractConfig() returned no value \
+             for OFFSET=0000&WIDTH=0002",
+            "a result without one requested setting"
+        );
+    }
+
+    #[test]
+    fn a_setting_beyond_the_request_or_repeated_refuses() {
+        let cases = [
+            (
+                "OFFSET=0002&WIDTH=0001&VALUE=12",
+                "ExtractConfig() returned OFFSET=0002&WIDTH=0001, which its <ConfigRequest> did \
+                 not request",
+            ),
+            (
+                "OFFSET=0000&WIDTH=0001&VALUE=10",
+                "ExtractConfig() returned OFFSET=0000&WIDTH=0001, which its <ConfigRequest> did \
+                 not request",
+            ),
+            (
+                "OFFSET=0003&WIDTH=0001&VALUE=13",
+                "ExtractConfig() returned OFFSET=0003&WIDTH=0001 twice",
+            ),
+        ];
+        for (extra, want) in cases {
+            let fixture = fixture();
+            fixture.routing.extra.borrow_mut().push(extra.to_string());
+
+            let refusal =
+                Baseline::take(fixture.stores.clone(), &fixture.routing, &fixture.variables)
+                    .err()
+                    .unwrap_or_else(|| panic!("{extra} refuses"));
+
+            assert_eq!(
+                refusal.to_string(),
+                format!("cannot snapshot store VARSTORE 0x0002 Buffer: {want}"),
+                "an answer with {extra}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_changed_store_holding_a_password_is_not_restored() {
+        let fixture = fixture();
+        let declaration = StoreDeclaration {
+            holds_password: true,
+            ..buffer_declaration(2, "Buffer", &[(0, 2), (3, 1)])
+        };
+        let baseline = Baseline::take(
+            vec![store(&declaration), fixture.stores[2].clone()],
+            &fixture.routing,
+            &fixture.variables,
+        )
+        .expect("read");
+        fixture
+            .routing
+            .buffers
+            .borrow_mut()
+            .get_mut(&fixture.buffer.to_string())
+            .expect("buffer")[0] = 0;
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            check.refusal().as_deref(),
+            Some(
+                "the Callback sequence changed VarStore 0x0002, which holds a PASSWORD question; \
+                 it was not restored, because a RouteConfig() without the password bytes may \
+                 clear it"
+            ),
+            "the store with a password"
+        );
+        assert!(
+            fixture.routing.routed.borrow().is_empty(),
+            "no RouteConfig() of a store with a password"
+        );
+        assert_eq!(
+            fixture.routing.buffer(&fixture.buffer)[0],
+            0,
+            "the change stays"
+        );
+    }
+
+    /// An EFI variable store whose PASSWORD question's bytes the withholding variables read as
+    /// zero is not set back, which would write those zeros over the password.
+    #[test]
+    fn a_changed_efi_variable_store_holding_a_password_is_not_set_back() {
+        let fixture = fixture();
+        let declaration = StoreDeclaration {
+            holds_password: true,
+            ..efi_declaration(1, "Store")
+        };
+        let baseline = Baseline::take(
+            vec![store(&declaration)],
+            &fixture.routing,
+            &fixture.variables,
+        )
+        .expect("read");
+        fixture
+            .variables
+            .set_variable(
+                &fixture.variable,
+                &VariableContents::new(NV_BS_RT, vec![1, 0xC1, 0xC2, 0xC3]).expect("data"),
+            )
+            .expect("the Callback writes");
+        fixture.variables.set.borrow_mut().clear();
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            check.refusal().as_deref(),
+            Some(
+                "the Callback sequence changed VarStore 0x0001, which holds a PASSWORD question; \
+                 it was not restored, because SetVariable() writes every byte of the variable, \
+                 the password's too, which uefisettings never writes"
+            ),
+            "the EFI variable store with a password"
+        );
+        assert!(
+            fixture.variables.set.borrow().is_empty()
+                && fixture.variables.deleted.borrow().is_empty(),
+            "no SetVariable() or deletion of a store with a password"
+        );
+        assert_eq!(
+            variable_data(&fixture.variables, &fixture.variable),
+            Some((NV_BS_RT.bits(), vec![1, 0xC1, 0xC2, 0xC3])),
+            "the change stays"
+        );
+    }
+
+    #[test]
+    fn a_store_unreadable_after_the_callbacks_is_reported_and_others_still_restored() {
+        let fixture = fixture();
+        let baseline = baseline(&fixture);
+        fixture
+            .variables
+            .set_variable(
+                &fixture.variable,
+                &VariableContents::new(NV_BS_RT, vec![1]).expect("data"),
+            )
+            .expect("the Callback writes");
+        // both reads of the baseline took 2 ExtractConfig()s each
+        fixture.routing.extract_fails_from.set(Some(4));
+
+        let check = baseline.check(&fixture.routing, &fixture.variables);
+
+        assert_eq!(
+            check.refusal().as_deref(),
+            Some(&*format!(
+                "the Callback sequence changed stores of the FormSet: VARSTORE_EFI 0x0001 {}; \
+                 restored and verified; cannot snapshot store VARSTORE 0x0002 Buffer after the \
+                 Callback sequence: ExtractConfig() returned EFI_NOT_FOUND at CHAR16 0 of its \
+                 string; its settings were not compared; cannot snapshot store \
+                 VARSTORE_NAME_VALUE 0x0003 after the Callback sequence: ExtractConfig() \
+                 returned EFI_NOT_FOUND at CHAR16 0 of its string; its settings were not \
+                 compared",
+                fixture.variable
+            )),
+            "an unreadable store beside a restored one"
+        );
+        assert_eq!(
+            variable_data(&fixture.variables, &fixture.variable),
+            Some((NV_BS_RT.bits(), vec![0x5A; 4])),
+            "the readable store restored"
+        );
+    }
+}
diff --git a/src/lib/hii/forms.rs b/src/lib/hii/forms.rs
index 3185c2c..fadc398 100644
--- a/src/lib/hii/forms.rs
+++ b/src/lib/hii/forms.rs
@@ -10,6 +10,7 @@
 //
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+use std::borrow::Cow;
 use std::cell::RefCell;
 use std::collections::BTreeMap;
 use std::collections::BTreeSet;
@@ -35,6 +36,7 @@ use crate::hii::package::is_padding;
 use crate::hii::package::Guid;
 use crate::hii::strings::Language;
 use crate::hii::strings::ListTexts;
+use crate::hii::strings::MatchTier;
 use crate::hii::strings::StringPackage;
 use crate::hii::variables::check_runtime_writable;
 use crate::hii::variables::check_unauthenticated;
@@ -61,9 +63,9 @@ use conditions::parse_question_header;
 use conditions::question_state;
 use conditions::retrieve_question_value;
 use conditions::select;
+use conditions::skips_questions;
 use conditions::skips_scope;
 use conditions::ExpressionInputs;
-use conditions::QuestionExpression;
 use conditions::QuestionValues;
 use conditions::Truth;
 use conditions::VarStoreValues;
@@ -122,38 +124,51 @@ use storage::VariableNotExported;
 use storage::VariableStore;
 use storageless::NoVarStore;
 use storageless::StoragelessQuestion;
-use storageless::StoragelessRefusal;
-use storageless::StoragelessRoute;
 use string_question::display_string_answer;
 use string_question::StringInput;
 use string_question::StringQuestion;
 use time_storage::TimeStorage;
 use time_storage::TimeStorageOnly;
 
-pub use ami_access_level::AccessLevel;
+pub use assumed_var_store::AssumedVarStore;
+pub use assumed_var_store::AssumedVarStoreError;
 pub use conditions::IncludedStates;
 pub use conditions::QuestionState;
 pub use conditions::SelectionError;
 
-pub(crate) use ami_access_level::check_access_level;
+pub(crate) use assumed_var_store::check_assumed;
+pub(crate) use assumed_var_store::CheckedVarStores;
 pub(crate) use conditions::Choice;
 pub(crate) use conditions::Exclusion;
+pub(crate) use conditions::QuestionExpression;
 pub(crate) use conditions::RankedBefore;
 pub(crate) use conditions::ReadOnlyCause;
 pub(crate) use conditions::Selection;
 pub(crate) use conditions::StateEvaluation;
 pub(crate) use defaults::DeclaredDefault;
 pub(crate) use defaults::DefaultId;
+pub(crate) use driver_held::DriverHeldQuestion;
+pub(crate) use driver_held::ExpressionBesideCallback;
+#[cfg(variable_data)]
+pub(crate) use driver_held::IfrValueType;
+pub(crate) use set::check_one_kind;
 pub(crate) use set::set_questions;
+pub(crate) use set::DriverStore;
 pub(crate) use set::NewAnswer;
 pub(crate) use setup_password::PasswordQuestions;
 pub(crate) use setup_password::UnresolvedPassword;
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+pub(crate) use storage::DeclaredKind;
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+pub(crate) use storage::StoreDeclaration;
+pub(crate) use storageless::StoragelessRefusal;
 
-mod ami_access_level;
+mod assumed_var_store;
 mod conditions;
 mod cross_reference;
 mod date_time;
 mod defaults;
+mod driver_held;
 #[cfg(test)]
 pub(crate) mod ifr_fixtures;
 #[cfg_attr(
@@ -1047,6 +1062,20 @@ pub struct FormSet {
     /// declared_var_store refuses a lookup of such an id
     #[br(default)]
     pub(super) var_stores_in_disabled_forms: BTreeSet<u16>,
+    /// The FORM_SET op that its package list starts with, which edk2-stable202608
+    /// SetupBrowserDxe/Setup.c GetIfrBinaryData takes for a Nil FormSet GUID (:6075):
+    /// read_package_list marks it, else None
+    #[br(default)]
+    pub(super) package_list_first: Option<PackageListFirst>,
+}
+
+/// The FORM_SET op that a package list starts with, as one of its FormSets sees it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum PackageListFirst {
+    /// Its own
+    Own,
+    /// Another, of this GUID, if the op holds one
+    Other(Option<Guid>),
 }
 
 impl FormSet {
@@ -1290,7 +1319,7 @@ impl NumericRange {
 
 /// The stored width in bits, 1 to 64, of a NUMERIC or ONE_OF value, and, if
 /// EFI_IFR_DISPLAY_INT_DEC signs it, the width of its type.
-#[derive(Clone, Copy)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
 struct NumericFormat {
     bits: u32,
     signed_type_bits: Option<u32>,
@@ -1995,6 +2024,7 @@ pub(super) fn parse_form_sets(
     // the ops outside a FormSet that the walk steps over, and the VarStores in the scope of an
     // unknown opcode in a FormSet that parses, by offset
     let mut walked = Vec::new();
+    let mut first_form_set = None;
     let package_length = u64::try_from(package_cursor.get_ref().len())
         .context("failed to convert form package length into u64")?;
     while package_cursor.position() < package_length {
@@ -2037,6 +2067,14 @@ pub(super) fn parse_form_sets(
         if let Some(start) = open_past_end.take() {
             past_end.push(start..offset);
         }
+        // GetIfrBinaryData takes the first FORM_SET op for a Nil GUID, whether it parses or not
+        let first_op = first_form_set.is_none();
+        if first_op {
+            first_form_set = Some(FirstFormSet {
+                guid: op.data.first_chunk().map(|&guid| Guid::from(guid)),
+                parses: false,
+            });
+        }
         let failure = match failing_alike.remove(&offset) {
             Some(failure) => failure,
             None => {
@@ -2052,6 +2090,9 @@ pub(super) fn parse_form_sets(
                         var_stores.extend(parsed.var_stores);
                         let roots_before = roots.len();
                         roots.push(parsed.root);
+                        if let (true, Some(first)) = (first_op, &mut first_form_set) {
+                            first.parses = true;
+                        }
                         disabled_forms.extend(
                             parsed
                                 .disabled_forms
@@ -2121,7 +2162,7 @@ pub(super) fn parse_form_sets(
             &mut malformed_stores,
         );
     }
-    let (first_var_stores, name_value_first) = first_var_stores(&var_stores, &outside);
+    let (first_var_stores, name_value_first, declared) = first_var_stores(&var_stores, &outside);
     Ok(FormSets {
         roots,
         ignored,
@@ -2130,6 +2171,8 @@ pub(super) fn parse_form_sets(
         malformed_stores,
         first_var_stores,
         name_value_first,
+        declared,
+        first_form_set,
     })
 }
 
@@ -2142,11 +2185,16 @@ pub(super) fn parse_form_sets(
 /// the package, as it walks the package op by op (:1520-1567), FORM_SET ops or not, so a FormSet
 /// nested in another is another FormSet, and steps into the scope of an unknown opcode as into any
 /// (:1566). An id whose first VarStore is outside any FormSet or in such a scope has no FormSet's:
-/// PasswordQuestions withholds those as VarStores outside any FormSet.
+/// PasswordQuestions withholds those as VarStores outside any FormSet. Every id of those
+/// VarStores comes third: for a question of the package of an id of none, the Forms Browser and
+/// FindStorageFromVarId find none but a VarStore op that does not decode, which each reads
+/// whatever the op's Length: the Forms Browser one of the question's FormSet outside an unknown
+/// opcode's scope (SetupBrowserDxe/IfrParse.c ParseOpCodes, :1873-1918), FindStorageFromVarId the
+/// first in the package (:1538-1555).
 fn first_var_stores(
     var_stores: &[(u64, Rc<RefCell<IFROperation>>)],
     outside: &[OutsideOp],
-) -> (BTreeMap<u16, FirstVarStore>, BTreeSet<u16>) {
+) -> (BTreeMap<u16, FirstVarStore>, BTreeSet<u16>, BTreeSet<u16>) {
     let in_form_sets = var_stores.iter().filter_map(|(offset, store)| {
         let (var_store_id, declared) = declared_store(&store.borrow().parsed_data)?;
         Some((*offset, var_store_id, declared, Some(store)))
@@ -2175,11 +2223,12 @@ fn first_var_stores(
         });
         first.insert(var_store_id, declared_by);
     }
+    let declared = first.keys().copied().collect();
     let first = first
         .into_iter()
         .filter_map(|(var_store_id, first)| Some((var_store_id, first?)))
         .collect();
-    (first, name_value_first)
+    (first, name_value_first, declared)
 }
 
 /// Where an op that parse_form_sets records outside the FormSets that it parses sits.
@@ -2565,8 +2614,9 @@ fn form_set_name(op: &IFROperation) -> String {
 /// The FormSets of a form package: a root for each that parse_form_sets parses, the IFR that it
 /// ignores, the forms that it drops from those roots, the VarStores and statements outside the
 /// FormSets that it parses, with the VarStores in the scope of an unknown opcode in those,
-/// malformed VarStores apart, the first VarStore of each VarStoreId that a FormSet declares, and
-/// the VarStoreIds whose first VarStore is a VARSTORE_NAME_VALUE (first_var_stores).
+/// malformed VarStores apart, the first VarStore of each VarStoreId that a FormSet declares, the
+/// VarStoreIds whose first VarStore is a VARSTORE_NAME_VALUE, and every VarStoreId that a VarStore
+/// that decodes declares (first_var_stores), and its first FORM_SET op (first_form_set).
 pub(super) struct FormSets {
     pub(super) roots: Vec<Rc<RefCell<IFROperation>>>,
     pub(super) ignored: Vec<IgnoredIfr>,
@@ -2575,6 +2625,39 @@ pub(super) struct FormSets {
     pub(super) malformed_stores: Vec<IgnoredIfr>,
     pub(super) first_var_stores: BTreeMap<u16, FirstVarStore>,
     pub(super) name_value_first: BTreeSet<u16>,
+    pub(super) declared: BTreeSet<u16>,
+    pub(super) first_form_set: Option<FirstFormSet>,
+}
+
+/// The first FORM_SET op of a form package.
+#[derive(Debug, Clone, Copy)]
+pub(super) struct FirstFormSet {
+    /// Its GUID, if the op holds one
+    pub(super) guid: Option<Guid>,
+    /// Whether its FormSet parses, as the first of FormSets::roots
+    pub(super) parses: bool,
+}
+
+/// Marks the FormSet of each of `roots`, those of one package list, with the FORM_SET op that the
+/// list starts with: `first`, of the form package whose roots start at the index it pairs with.
+pub(super) fn mark_package_list_first(
+    roots: &[Rc<RefCell<IFROperation>>],
+    first: Option<(usize, FirstFormSet)>,
+) {
+    let Some((at, first)) = first else {
+        return;
+    };
+    for (index, root) in roots.iter().enumerate() {
+        let mark = match (first.parses, index == at) {
+            (true, true) => PackageListFirst::Own,
+            (true, false) | (false, _) => PackageListFirst::Other(first.guid),
+        };
+        for child in &root.borrow().children {
+            if let ParsedOperation::FormSet(form_set) = &mut child.borrow_mut().parsed_data {
+                form_set.package_list_first = Some(mark);
+            }
+        }
+    }
 }
 
 /// The FormSets of a form package of a package list, by index in its forms, which the forms that
@@ -2591,6 +2674,8 @@ pub(crate) struct FirstVarStores {
     /// The VarStoreIds whose first VarStore in the package, in a FormSet or not, is a
     /// VARSTORE_NAME_VALUE
     pub(crate) name_value_first: BTreeSet<u16>,
+    /// Every VarStoreId that a VarStore of the package that decodes declares, in a FormSet or not
+    pub(crate) declared: BTreeSet<u16>,
 }
 
 /// The first VarStore op of a VarStoreId of a form package, `store`, and the FORM_SET op nearest
@@ -2650,6 +2735,9 @@ pub struct DisabledForm {
     /// The index of the root of its FormSet among the roots that its parse returns: in the forms
     /// of its package list (ParsedPackageList::forms) for read_db
     pub root_index: usize,
+    /// The name of its first PASSWORD or VarStore op, which record_disabled_var_stores finds
+    /// (DriverHeldQuestion::check_disabled_forms)
+    pub(crate) store_op: Option<&'static str>,
 }
 
 impl DisabledForm {
@@ -2849,7 +2937,7 @@ fn handle_form_set_within(
                 }
                 None => debug!("IFR:End when parent_ref is none"),
             };
-            if let Some(disabled) =
+            if let Some(mut disabled) =
                 disabling.take_if(|disabled| Rc::ptr_eq(&disabled.form, &current_scope_clone))
             {
                 // every op after the form went into its scope, so it is its parent's last child
@@ -2867,7 +2955,7 @@ fn handle_form_set_within(
                     }
                 }
                 drop(parent);
-                record_disabled_var_stores(&disabled.form);
+                disabled.store_op = record_disabled_var_stores(&disabled.form);
                 disabled_forms.push(disabled);
             }
 
@@ -2934,6 +3022,8 @@ fn handle_form_set_within(
                     form,
                     // the one root that this parse returns
                     root_index: 0,
+                    // record_disabled_var_stores finds it once the form's End is read
+                    store_op: None,
                 };
                 debug!(
                     "disabling, at offset {}, {}",
@@ -3271,10 +3361,23 @@ fn record_var_store_in_form(op: &IFROperation) {
 }
 
 /// Records the VarStoreId of each VarStore op of the disabled form `form` in the FormSet that
-/// holds it (FormSet::var_stores_in_disabled_forms).
-fn record_disabled_var_stores(form: &Rc<RefCell<IFROperation>>) {
+/// holds it (FormSet::var_stores_in_disabled_forms); returns the name of its first PASSWORD or
+/// VarStore op (DisabledForm::store_op).
+fn record_disabled_var_stores(form: &Rc<RefCell<IFROperation>>) -> Option<&'static str> {
+    let mut store_op = None;
     walk_scopes(std::slice::from_ref(form), (), |node, ()| {
         let op = node.borrow();
+        if store_op.is_none()
+            && matches!(
+                op.op_code,
+                IFROpCode::Password
+                    | IFROpCode::VarStore
+                    | IFROpCode::VarStoreNameValue
+                    | IFROpCode::VarStoreEfi
+            )
+        {
+            store_op = Some(op.op_code.spec_name());
+        }
         if let (Some((var_store_id, _)), Some(form_set)) =
             (declared_store(&op.parsed_data), form_set_of_form(&op))
         {
@@ -3284,6 +3387,7 @@ fn record_disabled_var_stores(form: &Rc<RefCell<IFROperation>>) {
         }
         Walk::Enter(())
     });
+    store_op
 }
 
 /// The FormSet that holds `op` if a FORM or FORM_MAP of that FormSet holds `op`.
@@ -3487,6 +3591,8 @@ pub struct QuestionDescriptor {
     pub(crate) value_source: ValueSource,
     /// The question's op, whose WRITE expression set evaluates
     node: Rc<RefCell<IFROperation>>,
+    /// What get and set need if no VarStore but the question's driver holds its value
+    driver_held: Option<DriverHeldQuestion>,
 }
 impl fmt::Debug for QuestionDescriptor {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
@@ -3516,15 +3622,62 @@ enum TextInput {
 }
 
 impl TextInput {
-    /// The name of its variant, which an internal inconsistency names.
-    fn kind(&self) -> &'static str {
+    /// Its variant, which an internal inconsistency names.
+    fn kind(&self) -> TextInputKind {
         match self {
-            Self::Range(_) => "Range",
-            Self::Maximum(_) => "Maximum",
-            Self::DateTime(_) => "DateTime",
-            Self::OrderedList(_) => "OrderedList",
+            Self::Range(_) => TextInputKind::Range,
+            Self::Maximum(_) => TextInputKind::Maximum,
+            Self::DateTime(_) => TextInputKind::DateTime,
+            Self::OrderedList(_) => TextInputKind::OrderedList,
+            Self::CrossReference => TextInputKind::CrossReference,
+            Self::String(_) => TextInputKind::String,
+        }
+    }
+}
+
+/// The variant of a TextInput.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum TextInputKind {
+    Range,
+    Maximum,
+    DateTime,
+    OrderedList,
+    CrossReference,
+    String,
+}
+
+impl fmt::Display for TextInputKind {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let name = match self {
+            Self::Range => "Range",
+            Self::Maximum => "Maximum",
+            Self::DateTime => "DateTime",
+            Self::OrderedList => "OrderedList",
             Self::CrossReference => "CrossReference",
-            Self::String(_) => "String",
+            Self::String => "String",
+        };
+        write!(f, "TextInput::{name}")
+    }
+}
+
+/// How a VALUE matches the text of an option (QuestionDescriptor::select_option).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum TextMatch {
+    /// Ignoring ASCII case
+    Exact,
+    /// Ignoring ASCII case and surrounding whitespace, as get shows the text trimmed
+    Trimmed,
+}
+
+impl TextMatch {
+    /// The ways, in the order that select_option tries them.
+    const ALL: [Self; 2] = [Self::Exact, Self::Trimmed];
+
+    /// Whether `named`, a VALUE, names `text` this way.
+    fn matches(self, named: &str, text: &str) -> bool {
+        match self {
+            Self::Exact => named.eq_ignore_ascii_case(text),
+            Self::Trimmed => named.trim().eq_ignore_ascii_case(text.trim()),
         }
     }
 }
@@ -3533,9 +3686,12 @@ impl TextInput {
 pub struct AnswerOption {
     /// The option's text, as get shows it
     pub value: String,
-    /// The option's text in each strings package of no configuration language that holds it,
-    /// with its language: those that VALUE matches
+    /// The option's text as stored in each strings package of no configuration language that
+    /// holds it, with its language (ListTexts::matching): those that VALUE matches first
     texts: Vec<(Language, String)>,
+    /// The option's text that display shows in those packages (ListTexts::matching_displayed):
+    /// those that VALUE matches where no text as stored of an option does
+    displayed_texts: Vec<(Language, String)>,
     /// The option's EFI_IFR_ONE_OF_OPTION Type
     value_type: u8,
     /// The option's value, or why it is not known
@@ -3554,6 +3710,16 @@ impl AnswerOption {
             .copied()
             .and_then(TypeValue::as_u64)
     }
+
+    /// The texts of the option string `id` in `texts` that VALUE matches in `tier`, with their
+    /// languages: AnswerOption's texts or displayed_texts.
+    fn texts_in(texts: &ListTexts<'_>, id: u16, tier: MatchTier) -> Vec<(Language, String)> {
+        texts
+            .matching_in(id, tier)
+            .into_iter()
+            .map(|(language, text)| (language.clone(), text.into_owned()))
+            .collect()
+    }
 }
 
 impl QuestionDescriptor {
@@ -3595,23 +3761,6 @@ impl QuestionDescriptor {
         }
     }
 
-    /// How get (`Read`) or set (`Write`) reaches the value of a question without a VarStore;
-    /// None for one with a VarStore.
-    #[cfg_attr(
-        not(test),
-        expect(
-            dead_code,
-            reason = "for the CallBack() sequence of the UEFI Shell build, which does not exist yet"
-        )
-    )]
-    pub(crate) fn storageless_route(
-        &self,
-        expression: QuestionExpression,
-    ) -> Option<std::result::Result<StoragelessRoute, StoragelessRefusal>> {
-        let NoVarStore(storageless) = self.varstore.as_ref().err()?.downcast_ref::<NoVarStore>()?;
-        Some(storageless.route(expression))
-    }
-
     /// The texts of the options of the stored items of an ORDERED_LIST, in order, as get shows
     /// them without their states; None for another question, or one whose items cannot be read.
     pub(crate) fn items(&self) -> Option<Vec<String>> {
@@ -3636,16 +3785,24 @@ impl QuestionDescriptor {
             .ok_or_else(|| ChangeValueError::InvalidOption.into())
     }
 
-    /// The options of a text in a language of no configuration language that `names` takes,
-    /// each with those languages.
-    fn options_named(&self, names: impl Fn(&str) -> bool) -> Vec<(&AnswerOption, OptionMatch)> {
+    /// The options of a text, as `tier` takes the texts, in a language of no configuration
+    /// language that `text_match` takes for one of `texts`, each with those languages.
+    fn options_named(
+        &self,
+        tier: MatchTier,
+        text_match: TextMatch,
+        texts: &BTreeSet<String>,
+    ) -> Vec<(&AnswerOption, OptionMatch)> {
         self.possible_options
             .iter()
             .filter_map(|option| {
-                let languages: Vec<String> = option
-                    .texts
+                let option_texts = match tier {
+                    MatchTier::Stored => &option.texts,
+                    MatchTier::Displayed => &option.displayed_texts,
+                };
+                let languages: Vec<String> = option_texts
                     .iter()
-                    .filter(|(_, text)| names(text))
+                    .filter(|(_, text)| texts.iter().any(|named| text_match.matches(named, text)))
                     .map(|(language, _)| language.to_string())
                     .collect();
                 let named = OptionMatch {
@@ -3671,27 +3828,24 @@ impl QuestionDescriptor {
     }
 
     /// Returns the option that select() picks with `include` among those whose text in a
-    /// language of no configuration language is one of `texts` ignoring ASCII case, or, if there
-    /// are none, among those whose text is one of `texts` ignoring surrounding whitespace too
-    /// (get shows the text trimmed), or None if there are none either. So a text as stored never
-    /// picks an option that differs from it only by such whitespace. Refuses with
-    /// SelectionError::AmbiguousOption options that no one language names all.
+    /// language of no configuration language is one of `texts`, in the first of these ways that
+    /// names any, or None if none does: of the texts as stored, then of those that display shows
+    /// (MatchTier), each ignoring ASCII case, then ignoring surrounding whitespace too (get shows
+    /// the text trimmed). So a text as stored never picks an option that differs from it only by
+    /// such whitespace, or that reads alike only once a character of it is replaced or its common
+    /// control codes are taken out. Refuses with SelectionError::AmbiguousOption options that no
+    /// one language names all.
     pub(crate) fn select_option(
         &self,
         texts: &BTreeSet<String>,
         include: IncludedStates,
     ) -> std::result::Result<Option<&AnswerOption>, SelectionError> {
-        let stored =
-            self.options_named(|text| texts.iter().any(|named| named.eq_ignore_ascii_case(text)));
-        let candidates = if stored.is_empty() {
-            self.options_named(|text| {
-                texts
-                    .iter()
-                    .any(|named| named.trim().eq_ignore_ascii_case(text.trim()))
-            })
-        } else {
-            stored
-        };
+        let candidates = MatchTier::ALL
+            .into_iter()
+            .flat_map(|tier| TextMatch::ALL.map(|text_match| (tier, text_match)))
+            .map(|(tier, text_match)| self.options_named(tier, text_match, texts))
+            .find(|candidates| !candidates.is_empty())
+            .unwrap_or_default();
         let language_sets: Vec<&[String]> = candidates
             .iter()
             .map(|(_, named)| named.languages.as_slice())
@@ -3750,17 +3904,37 @@ impl QuestionDescriptor {
 // list_questions returns a list of QuestionDescriptors in a FormSet
 // with their states, of the questions in a state that `include` may allow
 // node should be the root of a FormSet
-// conditions read `access_level`, if stated, for AMI_ACCESS_LEVEL instead of its value
+// conditions read the VarStore bytes that `assumed` states in place of those their variables hold
 pub(crate) fn list_questions(
     node: Rc<RefCell<IFROperation>>,
     texts: &ListTexts<'_>,
     include: IncludedStates,
-    access_level: Option<AccessLevel>,
+    assumed: CheckedVarStores<'_>,
+    reader: &mut EfivarReader,
+) -> Vec<(QuestionDescriptor, StateEvaluation)> {
+    let values = VarStoreValues::new(&node, assumed);
+    list_questions_in(
+        &node,
+        skips_questions,
+        &mut FormSetWalk::new(texts, reader, &values, include),
+    )
+}
+
+/// Lists questions as list_questions does, those in forms that edk2-stable202608
+/// SetupBrowserDxe/IfrParse.c ParseOpCodes does not parse too, where --keyword finds statements,
+/// as the edk2 keyword handler does.
+// for dump-efivars, which only Linux and the tests build
+#[cfg(all(efivar_dumps, any(target_os = "linux", test)))]
+pub(crate) fn list_reachable_questions(
+    node: Rc<RefCell<IFROperation>>,
+    texts: &ListTexts<'_>,
+    include: IncludedStates,
     reader: &mut EfivarReader,
 ) -> Vec<(QuestionDescriptor, StateEvaluation)> {
-    let values = VarStoreValues::new(&node, access_level);
+    let values = VarStoreValues::new(&node, CheckedVarStores::NONE);
     list_questions_in(
         &node,
+        skips_scope,
         &mut FormSetWalk::new(texts, reader, &values, include),
     )
 }
@@ -3790,14 +3964,16 @@ impl<'a, V> FormSetWalk<'a, V> {
     }
 }
 
-/// Lists questions as list_questions does, with `walk`.
+/// Lists questions as list_questions does, with `walk`, but those in the scopes that `skips`
+/// skips.
 fn list_questions_in(
     node: &Rc<RefCell<IFROperation>>,
+    skips: impl Fn(&IFROperation) -> bool,
     walk: &mut FormSetWalk<'_, impl QuestionValues>,
 ) -> Vec<(QuestionDescriptor, StateEvaluation)> {
     let mut res = Vec::new();
     walk_scopes(std::slice::from_ref(node), (), |node, ()| {
-        if skips_scope(&node.borrow()) {
+        if skips(&node.borrow()) {
             return Walk::Skip;
         }
         res.extend(listed_question(node, walk));
@@ -3825,20 +4001,20 @@ fn listed_question(
 /// find_question accepts the root node, texts and what to match questions by: by prompt, a set
 /// of strings which represent variations of the same question, so if a single phrase matches
 /// then we assume that we have the answer; or by QuestionId or keyword (QuestionMatch).
-/// Of the matching questions, it selects one as select does, with conditions reading
-/// `access_level`, if stated, for AMI_ACCESS_LEVEL instead of its value.
+/// Of the matching questions, it selects one as select does, with conditions reading the
+/// VarStore bytes that `assumed` states in place of those their variables hold.
 pub(crate) fn find_question<T>(
     node: Rc<RefCell<IFROperation>>,
     texts: &ListTexts<'_>,
     matching: &QuestionMatch<'_, T>,
     include: IncludedStates,
-    access_level: Option<AccessLevel>,
+    assumed: CheckedVarStores<'_>,
     reader: &mut EfivarReader,
 ) -> Selection<QuestionDescriptor>
 where
     T: AsRef<str>,
 {
-    let values = VarStoreValues::new(&node, access_level);
+    let values = VarStoreValues::new(&node, assumed);
     find_question_in(
         &node,
         matching,
@@ -3871,18 +4047,19 @@ where
         .map(|(question, listed)| describe_question(question, listed, walk))
 }
 
-/// The questions under the root `node` of a FormSet whose prompt is one of
+/// The questions under the root `node` of a FormSet whose prompt, as `tier` takes it, is one of
 /// `possible_question_phrases` in a language of `texts`, as find_question finds them, for
-/// check_prompt_language.
+/// check_prompt_language and the choice of the tier.
 pub(crate) fn prompt_matches<T>(
     node: &Rc<RefCell<IFROperation>>,
     texts: &ListTexts<'_>,
     possible_question_phrases: &BTreeSet<T>,
+    tier: MatchTier,
 ) -> Vec<PromptMatch>
 where
     T: AsRef<str>,
 {
-    questions_named(node, texts, possible_question_phrases)
+    questions_named(node, texts, possible_question_phrases, tier)
         .into_iter()
         .map(|named| named.prompt)
         .collect()
@@ -3939,7 +4116,7 @@ pub(crate) fn check_address_unique(
                 ListedQuestion::of(&op)
                     .map(|question| texts.display(question.header().prompt_string_id))
             })
-            .map(str::to_owned)
+            .map(Cow::into_owned)
             .collect(),
     })
 }
@@ -4028,22 +4205,29 @@ pub(crate) fn choice_for_set(
     writer: ReadOnlyWriter<'_>,
     reader: &EfivarReader,
 ) -> Result<Choice<QuestionDescriptor>> {
-    let ((descriptor, evaluation), ranked_before) = match &selection {
-        Selection::Picked {
-            picked,
-            ranked_before,
-        } => (picked, *ranked_before),
-        Selection::Undetermined {
-            likely,
-            ranked_before,
-            ..
-        } => (likely, *ranked_before),
-        Selection::Excluded(_) | Selection::NotFound => return Ok(selection.for_set(question)?),
-    };
     // the WRITE expression of a question without a VarStore names the stores that set writes
-    if let Some(store) = descriptor.store(reader.reach())? {
-        check_writable(store, reader, options.volatile)?;
+    if let Some(((descriptor, _), _)) = selection.written_or_likely() {
+        if let Some(store) = descriptor.store(reader.reach())? {
+            check_writable(store, reader, options.volatile)?;
+        }
     }
+    read_only_choice(selection, question, writer)
+}
+
+/// The choice of Selection::for_set, unless the match that set would write, or the likely match,
+/// is read-only by an EFI_IFR_VALUE, which nothing makes writable: then
+/// ChangeValueError::ReadOnly. A chosen match that EFI_IFR_FLAG_READ_ONLY makes read-only goes to
+/// `writer` after these refusals and those of Selection::for_set. choice_for_set checks the
+/// efivar of the match first; set takes this choice alone for a question whose driver holds its
+/// value, which has none.
+pub(crate) fn read_only_choice(
+    selection: Selection<QuestionDescriptor>,
+    question: &str,
+    writer: ReadOnlyWriter<'_>,
+) -> Result<Choice<QuestionDescriptor>> {
+    let Some(((descriptor, evaluation), ranked_before)) = selection.written_or_likely() else {
+        return Ok(selection.for_set(question)?);
+    };
     let name = descriptor.question.clone();
     match evaluation.read_only() {
         Some(cause @ ReadOnlyCause::ValueExpression) => Err(ChangeValueError::ReadOnly {
@@ -4061,6 +4245,27 @@ pub(crate) fn choice_for_set(
     }
 }
 
+/// apply-staged's check of `question`, the one question of a staged request, which `cause` makes
+/// read-only, if anything does, as read_only_choice's of a match that no other ranks before:
+/// ChangeValueError::ReadOnly where an EFI_IFR_VALUE gives its value, and to `writer` where
+/// EFI_IFR_FLAG_READ_ONLY makes it read-only.
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+pub(crate) fn check_staged_read_only(
+    question: String,
+    cause: Option<ReadOnlyCause>,
+    writer: ReadOnlyWriter<'_>,
+) -> std::result::Result<(), ChangeValueError> {
+    match cause {
+        Some(cause @ ReadOnlyCause::ValueExpression) => Err(ChangeValueError::ReadOnly {
+            question,
+            cause,
+            ranked_before: IncludedStates::empty(),
+        }),
+        Some(ReadOnlyCause::Flag) => writer.write_read_only(question, IncludedStates::empty()),
+        None => Ok(()),
+    }
+}
+
 /// Refuses `store` unless set may write its variable, which `reader` has read (check_read).
 fn check_writable(
     store: &dyn VariableStore,
@@ -4159,13 +4364,14 @@ mod choice_for_set_tests {
     const MISSING_NOT_FOUND: &str = "no EFI variable Missing-00000000-0000-0000-0000-000000000000";
     /// Why the EQ_ID_VAL on question 2, on the efivar Missing, is not evaluated.
     const MISSING_INPUT: &str = "EFI_IFR_EQ_ID_VAL of question 0x0002: <ValueUnavailable: no EFI \
-        variable Missing-00000000-0000-0000-0000-000000000000>";
-    /// Why the EQ_ID_VAL on question 2, on AMI firmware's buffer VarStore SystemAccess without
-    /// an efivar, is not evaluated.
-    const SYSTEM_ACCESS_INPUT: &str = "EFI_IFR_EQ_ID_VAL of question 0x0002: <ValueUnavailable: \
-        no EFI variable SystemAccess-e770bb69-bcb4-4d04-9e97-23ff9456feac; HII buffer varstore \
-        requires EFI_HII_CONFIG_ACCESS_PROTOCOL; the AMI setup browser keeps its access level \
-        there (0 Administrator, 1 User); --access-level administrator|user states one>";
+        variable Missing-00000000-0000-0000-0000-000000000000; --assume-var-store \
+        Missing-00000000-0000-0000-0000-000000000000+0=<HEX of 1 byte> states it>";
+    /// Why the EQ_ID_VAL on question 2, on the buffer VarStore Mode without an efivar, is not
+    /// evaluated.
+    const MODE_INPUT: &str = "EFI_IFR_EQ_ID_VAL of question 0x0002: <ValueUnavailable: no EFI \
+        variable Mode-11111111-1111-1111-1111-111111111111; HII buffer varstore requires \
+        EFI_HII_CONFIG_ACCESS_PROTOCOL; --assume-var-store \
+        Mode-11111111-1111-1111-1111-111111111111+0=<HEX of 1 byte> states it>";
 
     /// set's choice for PROMPT in the FormSet `root`, where only the efivar Present, of
     /// 1 byte, exists.
@@ -4188,29 +4394,29 @@ mod choice_for_set_tests {
         root: &Rc<RefCell<IFROperation>>,
         efivars: &Efivars,
     ) -> Result<Choice<QuestionDescriptor>> {
-        choice_reading(root, efivars, None)
+        choice_reading(root, efivars, &[])
     }
 
-    /// choice_with, with conditions reading `access_level`, if stated, for SystemAccess instead of
-    /// its value.
+    /// choice_with, with conditions reading the VarStore bytes that `assumed` states.
     fn choice_reading(
         root: &Rc<RefCell<IFROperation>>,
         efivars: &Efivars,
-        access_level: Option<AccessLevel>,
+        assumed: &[AssumedVarStore],
     ) -> Result<Choice<QuestionDescriptor>> {
-        choice_by(root, efivars.reader(), access_level)
+        choice_by(root, efivars.reader(), assumed)
     }
 
     /// choice_reading, with `reader` instead of a reader of efivar files.
     fn choice_by(
         root: &Rc<RefCell<IFROperation>>,
         mut reader: EfivarReader,
-        access_level: Option<AccessLevel>,
+        assumed: &[AssumedVarStore],
     ) -> Result<Choice<QuestionDescriptor>> {
-        let values = VarStoreValues::new(root, access_level);
+        let assumed = check_assumed([root], assumed).expect("check the statements");
+        let values = VarStoreValues::new(root, assumed);
         let selection = find_question_in(
             root,
-            &QuestionMatch::Prompt(&BTreeSet::from([PROMPT])),
+            &QuestionMatch::Prompt(&BTreeSet::from([PROMPT]), MatchTier::Stored),
             &mut FormSetWalk::new(
                 &ListTexts::new(&strings(), &[]),
                 &mut reader,
@@ -4302,12 +4508,12 @@ mod choice_for_set_tests {
         );
     }
 
-    /// The FormSet of PROMPT, question 1 on VarStore 1, which AMI firmware grays out for a
-    /// User session: SystemAccess, question 2, being 1.
-    fn grayed_out_for_users() -> Rc<RefCell<IFROperation>> {
+    /// The FormSet of PROMPT, question 1 on VarStore 1, which a GRAY_OUT_IF grays out while
+    /// question 2, at byte 0 of the buffer VarStore Mode, is 1.
+    fn grayed_out_by_mode() -> Rc<RefCell<IFROperation>> {
         parse_form_set(&[
             var_store_efi(1, "Present", NV_BS_RT, 1),
-            var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 1),
+            var_store(2, [0x11; 16], "Mode", 1),
             form(
                 1,
                 &[
@@ -4318,42 +4524,46 @@ mod choice_for_set_tests {
         ])
     }
 
-    /// set's refusal of a question that AMI firmware grays out for a User session names where
-    /// the access level is kept.
+    /// set's refusal of a question that a condition on an unreadable buffer VarStore may gray out
+    /// names the flag that states the byte it reads.
     #[test]
-    fn undetermined_match_on_the_ami_access_level_names_it() {
-        let error = choice_in(&grayed_out_for_users()).expect_err("set refuses question 1");
+    fn undetermined_match_on_a_buffer_var_store_names_the_flag() {
+        let error = choice_in(&grayed_out_by_mode()).expect_err("set refuses question 1");
         assert_eq!(
             error.downcast_ref::<SelectionError>(),
             Some(&SelectionError::Undetermined {
                 question: PROMPT.to_string(),
                 states: IncludedStates::GRAYED_OUT,
-                reasons: vec![SYSTEM_ACCESS_INPUT.to_string()],
+                reasons: vec![MODE_INPUT.to_string()],
             }),
-            "question 1 under a GRAY_OUT_IF on the access level: {error:#}"
+            "question 1 under a GRAY_OUT_IF on Mode: {error:#}"
         );
     }
 
-    /// set chooses a question that AMI firmware grays out for a User session at a stated
-    /// Administrator level, and skips it as grayed out at a stated User level.
+    /// set chooses a question by the VarStore bytes stated: with 00 stated for the byte that its
+    /// GRAY_OUT_IF reads, and skips it as grayed out with 01.
     #[test]
-    fn stated_access_level_decides_the_choice() {
-        let root = grayed_out_for_users();
+    fn stated_var_store_bytes_decide_the_choice() {
+        let root = grayed_out_by_mode();
         let efivars = Efivars::new();
         efivars.write(&efi_variable("Present", 1), &[0]);
+        let stated = |text: &str| {
+            let assumed: AssumedVarStore = text.parse().expect("a statement");
+            choice_reading(&root, &efivars, &[assumed])
+        };
 
-        let administrator = choice_reading(&root, &efivars, Some(AccessLevel::Administrator));
+        let selectable = stated("Mode-11111111-1111-1111-1111-111111111111=00");
         assert!(
-            matches!(administrator, Ok(Choice::Chosen(..))),
-            "Administrator: {administrator:?}"
+            matches!(selectable, Ok(Choice::Chosen(..))),
+            "00 stated: {selectable:?}"
         );
-        let user = choice_reading(&root, &efivars, Some(AccessLevel::User));
+        let grayed_out = stated("Mode-11111111-1111-1111-1111-111111111111=01");
         assert!(
             matches!(
-                user,
+                grayed_out,
                 Ok(Choice::Skipped(exclusion)) if exclusion.states == IncludedStates::GRAYED_OUT
             ),
-            "User: {user:?}"
+            "01 stated: {grayed_out:?}"
         );
     }
 
@@ -4505,7 +4715,7 @@ mod choice_for_set_tests {
             let variables = Rc::new(MemoryVariables::new(reach, interface));
             variables.insert(variable_key("Present"), NV_BS, &[0]);
             let reader = EfivarReader::with_variables(Box::new(Rc::clone(&variables)));
-            (choice_by(&root, reader, None), variables.reads())
+            (choice_by(&root, reader, &[]), variables.reads())
         };
 
         let (choice, reads) = choose(
@@ -4547,11 +4757,7 @@ mod choice_for_set_tests {
                 VariableInterface::FirmwareEnvironment,
             );
             variables.insert(variable_key("Present"), attributes, &[0]);
-            choice_by(
-                root,
-                EfivarReader::with_variables(Box::new(variables)),
-                None,
-            )
+            choice_by(root, EfivarReader::with_variables(Box::new(variables)), &[])
         };
         let refusal = |choice: Result<Choice<QuestionDescriptor>>| {
             choice.map_err(|error| error.to_string()).err()
@@ -4639,7 +4845,7 @@ mod choice_for_set_tests {
             let read = read_current_value_bytes(&Ok(Box::new(store)), 0..1, &mut reader)
                 .map(<[u8]>::to_vec)
                 .map_err(|reason| reason.to_answer());
-            let error = choice_by(&root, reader, None).expect_err("set refuses the ONE_OF");
+            let error = choice_by(&root, reader, &[]).expect_err("set refuses the ONE_OF");
 
             let not_exported = error
                 .downcast_ref::<VariableNotExported>()
@@ -4690,7 +4896,7 @@ mod choice_for_set_tests {
         for (reach, interface, refusal) in cases {
             let reader =
                 EfivarReader::with_variables(Box::new(MemoryVariables::new(reach, interface)));
-            let error = choice_by(&root, reader, None).expect_err("set refuses the ONE_OF");
+            let error = choice_by(&root, reader, &[]).expect_err("set refuses the ONE_OF");
 
             let text = error.to_string();
             assert!(
@@ -4721,7 +4927,7 @@ mod choice_for_set_tests {
                 let choice = choice_by(
                     &root,
                     EfivarReader::with_variables(Box::new(variables)),
-                    None,
+                    &[],
                 );
 
                 let chosen = matches!(choice, Ok(Choice::Chosen(..)));
@@ -4776,7 +4982,7 @@ mod choice_for_set_tests {
             let read = read_current_value_bytes(&Ok(Box::new(store)), 0..1, &mut reader)
                 .map(<[u8]>::to_vec)
                 .map_err(|reason| reason.to_answer());
-            let error = choice_by(&root, reader, None).expect_err("set refuses the ONE_OF");
+            let error = choice_by(&root, reader, &[]).expect_err("set refuses the ONE_OF");
 
             match reach {
                 VariableReach::Runtime => {
@@ -4836,7 +5042,7 @@ mod choice_for_set_tests {
                 let reader = EfivarReader::with_variables(Box::new(variables));
 
                 let error =
-                    choice_by(&root, reader, None).expect_err("set refuses a volatile efivar");
+                    choice_by(&root, reader, &[]).expect_err("set refuses a volatile efivar");
 
                 assert_eq!(
                     error.to_string(),
@@ -4921,7 +5127,7 @@ pub(crate) fn display(
     reader: &mut EfivarReader,
 ) -> Result<TextLines> {
     let mut lines = Vec::new();
-    let values = VarStoreValues::new(&node, None);
+    let values = VarStoreValues::new(&node, CheckedVarStores::NONE);
     let mut inputs = ExpressionInputs {
         reader,
         values: &values,
@@ -5352,14 +5558,9 @@ fn declared_var_store(form_set: &IFROperation, var_store_id: u16) -> Result<Opti
             "VarStore {var_store_id:#06x} is declared in the scope of a DISABLE_IF of its FormSet \
              whose condition is not known: {reason}"
         )),
-        Creation::Undetermined(Undetermined::Hiding(hiding)) => Err(anyhow!(
-            "VarStore {var_store_id:#06x} follows an {} in the scope of a DISABLE_IF of its \
-             FormSet, whose condition is {}: edk2-stable202608 SetupBrowserDxe/IfrParse.c takes \
-             that condition for the DISABLE_IF's, which may skip the rest of its scope \
-             (:1690-1704, :3045-3059), where UEFI 2.11 §33.3.8.3.75 has it only hide",
-            hiding.op,
-            hiding.condition()
-        )),
+        Creation::Undetermined(Undetermined::Hiding(hiding)) => {
+            Err(anyhow!("VarStore {var_store_id:#06x} follows {hiding}"))
+        }
     }
 }
 
@@ -5474,36 +5675,48 @@ fn decoded_store(op: &IFROperation) -> Result<Option<(u16, DeclaredStore)>> {
     Ok(decode_var_store(op)?.and_then(|parsed| declared_store(&parsed)))
 }
 
-/// Whether edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes creates the store of a
-/// VarStore op of a form-set-list (CreateStorage, :1873-1913); form_set_list_var_stores never meets
-/// one that it skips.
+/// Whether edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes parses an op of a
+/// form-set-list, as it creates the store of a VarStore op (CreateStorage, :1873-1913);
+/// form_set_list_ops never meets one that it skips.
 #[derive(Debug, Clone, PartialEq, Eq)]
 enum Creation {
     Created,
     Undetermined(Undetermined),
 }
 
-/// Why ParseOpCodes may skip a VarStore op of a form-set-list.
+/// Why ParseOpCodes may skip an op of a form-set-list.
 #[derive(Debug, Clone, PartialEq, Eq)]
 enum Undetermined {
     /// In the scope of a DISABLE_IF whose condition is not known: why
     DisableIf(Rc<str>),
-    /// After a SUPPRESS_IF or GRAY_OUT_IF in the scope of a DISABLE_IF, whose condition is TRUE or
-    /// not known
+    /// After an op of hiding_role in the scope of a DISABLE_IF, whose condition is TRUE or not
+    /// known
     Hiding(Hiding),
 }
 
-/// A SUPPRESS_IF or GRAY_OUT_IF of a form-set-list in the scope of a DISABLE_IF, whose condition
+/// An op of hiding_role of a form-set-list in the scope of a DISABLE_IF, whose condition
 /// ParseOpCodes takes for the DISABLE_IF's (:1690-1704, :3045-3059): TRUE skips the rest of that
 /// DISABLE_IF's scope (:1390-1413).
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct Hiding {
     /// Its spec name
     op: &'static str,
+    /// What UEFI 2.11 has it do instead
+    role: &'static str,
     /// Why its condition is not known; None if it is TRUE
     unknown: Option<Rc<str>>,
 }
 
+impl Undetermined {
+    /// Why ParseOpCodes may skip an op that this leaves undetermined, for a question there.
+    fn reason(&self) -> String {
+        match self {
+            Undetermined::DisableIf(reason) => reason.to_string(),
+            Undetermined::Hiding(hiding) => format!("it is after {hiding}"),
+        }
+    }
+}
+
 impl Hiding {
     /// Its condition, as text.
     fn condition(&self) -> String {
@@ -5514,19 +5727,37 @@ impl Hiding {
     }
 }
 
-/// The scopes around an op of a form-set-list, as form_set_list_var_stores walks them.
+impl fmt::Display for Hiding {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "an {} in the scope of a DISABLE_IF of its FormSet, whose condition is {}: \
+             edk2-stable202608 SetupBrowserDxe/IfrParse.c takes that condition for the \
+             DISABLE_IF's, which may skip the rest of its scope (:1690-1704, :3045-3059), where \
+             UEFI 2.11 {}",
+            self.op,
+            self.condition(),
+            self.role
+        )
+    }
+}
+
+/// The scopes around an op of a form-set-list, as form_set_list_ops walks them.
 #[derive(Clone, Default)]
 struct ListScopes {
     /// Why the first DISABLE_IF around, outermost first, whose condition is not known, may skip it
     unknown_disable_if: Option<Rc<str>>,
-    /// In the scope of a DISABLE_IF: the first SUPPRESS_IF or GRAY_OUT_IF met so far in the scope
-    /// of the outermost one whose condition is TRUE or not known, shared by every op in that scope
+    /// In the scope of a DISABLE_IF: the first op of hiding_role whose condition is TRUE or not
+    /// known met so far in its scope before any DISABLE_IF ends there, or in those around it
+    /// before it, shared by every op in its scope but those in DISABLE_IFs that it nests:
+    /// ParseOpCodes skips to the END of the innermost DISABLE_IF around, counting those nested in
+    /// it (:1395-1410)
     hiding: Option<Rc<RefCell<Option<Hiding>>>>,
 }
 
 impl ListScopes {
-    /// Whether ParseOpCodes creates the store of a VarStore op in these scopes: the DISABLE_IFs
-    /// first, then the SUPPRESS_IFs and GRAY_OUT_IFs.
+    /// Whether ParseOpCodes parses an op in these scopes: the DISABLE_IFs first, then the ops of
+    /// hiding_role.
     fn creation(&self) -> Creation {
         let hiding = self
             .hiding
@@ -5541,39 +5772,82 @@ impl ListScopes {
 }
 
 /// Visits the VarStore ops in the form-set-list of `form_set` (UEFI 2.11 §33.2.5.1), where
-/// VfrCompile declares VarStores, in IFR order, each with whether edk2-stable202608
-/// SetupBrowserDxe/IfrParse.c ParseOpCodes creates its store and the FORMs and FORM_MAPs before
-/// it, until `visit` gives Some. It meets none in the scope of a FORM or FORM_MAP, outside the
-/// form-set-list, nor of an unknown op (IsUnKnownOpCode), nor of a DISABLE_IF whose condition is
-/// TRUE, which ParseOpCodes skips whatever DISABLE_IFs it nests (:1390-1413). It evaluates each
-/// DISABLE_IF, SUPPRESS_IF and GRAY_OUT_IF of the form-set-list once, the latter only in the scope
-/// of a DISABLE_IF.
+/// VfrCompile declares VarStores, as form_set_list_ops meets them, until `visit` gives Some.
 fn form_set_list_var_stores<T>(
     form_set: &IFROperation,
     mut visit: impl FnMut(&IFROperation, &Creation, &[Rc<RefCell<IFROperation>>]) -> Option<T>,
+) -> Option<T> {
+    form_set_list_ops(form_set, |node, creation, forms| {
+        let op = node.borrow();
+        let var_store = matches!(
+            op.op_code,
+            IFROpCode::VarStore | IFROpCode::VarStoreEfi | IFROpCode::VarStoreNameValue
+        );
+        var_store.then(|| visit(&op, creation, forms)).flatten()
+    })
+}
+
+/// The ops of the form-set-list of `form_set` and its FORMs and FORM_MAPs, each with whether
+/// ParseOpCodes parses it, with its scope, as form_set_list_ops meets them; it skips the others.
+fn list_creations(form_set: &IFROperation) -> Vec<(Rc<RefCell<IFROperation>>, Creation)> {
+    let mut met = Vec::new();
+    form_set_list_ops(form_set, |node, creation, _| -> Option<Infallible> {
+        met.push((Rc::clone(node), creation.clone()));
+        None
+    });
+    met
+}
+
+/// Visits the ops in the form-set-list of `form_set` and its FORMs and FORM_MAPs, in IFR order,
+/// each with whether edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes parses it, as it
+/// creates the store of a VarStore op, and the FORMs and FORM_MAPs before it, until `visit` gives
+/// Some. It meets none in the scope of a FORM or FORM_MAP, outside the form-set-list, nor of an
+/// unknown op (IsUnKnownOpCode), nor of a DISABLE_IF whose condition is TRUE, which ParseOpCodes
+/// skips whatever DISABLE_IFs it nests (:1390-1413). It evaluates each DISABLE_IF and each op of
+/// hiding_role of the form-set-list once, the latter only in the scope of a DISABLE_IF.
+fn form_set_list_ops<T>(
+    form_set: &IFROperation,
+    mut visit: impl FnMut(
+        &Rc<RefCell<IFROperation>>,
+        &Creation,
+        &[Rc<RefCell<IFROperation>>],
+    ) -> Option<T>,
 ) -> Option<T> {
     let mut forms = Vec::new();
+    // the hiding of the DISABLE_IF met last, None after one that ParseOpCodes leaves before the
+    // next op: it takes a condition for a DISABLE_IF's only until the END of any DISABLE_IF, in a
+    // FORM too (:2654-2655, :3007-3014)
+    let mut open_hiding: Option<Rc<RefCell<Option<Hiding>>>> = None;
     let walked = try_walk_scopes(&form_set.children, ListScopes::default(), |node, scopes| {
         let op = node.borrow();
         if skips_scope(&op) {
             return Ok(Walk::Skip);
         }
+        if let Some(found) = visit(node, &scopes.creation(), &forms) {
+            return Err(found);
+        }
         match op.op_code {
-            IFROpCode::VarStore | IFROpCode::VarStoreEfi | IFROpCode::VarStoreNameValue => {
-                match visit(&op, &scopes.creation(), &forms) {
-                    Some(found) => Err(found),
-                    None => Ok(Walk::Enter(scopes.clone())),
-                }
-            }
             IFROpCode::Form | IFROpCode::FormMap => {
                 forms.push(Rc::clone(node));
+                if holds_disable_if(node) {
+                    open_hiding = None;
+                }
                 Ok(Walk::Skip)
             }
             IFROpCode::DisableIf => {
                 let mut inner = scopes.clone();
-                inner.hiding.get_or_insert_with(Rc::default);
+                let start = scopes
+                    .hiding
+                    .as_ref()
+                    .and_then(|hiding| hiding.borrow().clone());
+                let hiding = Rc::new(RefCell::new(start));
+                open_hiding = Some(Rc::clone(&hiding));
+                inner.hiding = Some(hiding);
                 match constant_condition(&op) {
-                    Truth::Known(true) => return Ok(Walk::Skip),
+                    Truth::Known(true) => {
+                        open_hiding = None;
+                        return Ok(Walk::Skip);
+                    }
                     Truth::Known(false) => {}
                     Truth::Unknown(reason) => {
                         inner.unknown_disable_if.get_or_insert(reason.into());
@@ -5581,8 +5855,13 @@ fn form_set_list_var_stores<T>(
                 }
                 Ok(Walk::Enter(inner))
             }
-            IFROpCode::SuppressIf | IFROpCode::GrayOutIf => {
-                if let Some(hiding) = &scopes.hiding {
+            code => {
+                let open = scopes.hiding.as_ref().filter(|hiding| {
+                    open_hiding
+                        .as_ref()
+                        .is_some_and(|open| Rc::ptr_eq(open, hiding))
+                });
+                if let (Some(hiding), Some(role)) = (open, hiding_role(code)) {
                     let unknown = match constant_condition(&op) {
                         Truth::Known(true) => Some(None),
                         Truth::Known(false) => None,
@@ -5591,18 +5870,53 @@ fn form_set_list_var_stores<T>(
                     if let Some(unknown) = unknown {
                         hiding.borrow_mut().get_or_insert(Hiding {
                             op: op.op_code.spec_name(),
+                            role,
                             unknown,
                         });
                     }
                 }
                 Ok(Walk::Enter(scopes.clone()))
             }
-            _ => Ok(Walk::Enter(scopes.clone())),
         }
     });
     walked.err()
 }
 
+/// Whether ParseOpCodes meets a DISABLE_IF in the scope of `form`, outside an unknown op's.
+fn holds_disable_if(form: &Rc<RefCell<IFROperation>>) -> bool {
+    let mut held = false;
+    walk_scopes(&form.borrow().children, (), |node, ()| {
+        let op = node.borrow();
+        held |= op.op_code == IFROpCode::DisableIf;
+        if skips_scope(&op) {
+            Walk::Skip
+        } else {
+            Walk::Enter(())
+        }
+    });
+    held
+}
+
+/// What UEFI 2.11 has `code` do, if ParseOpCodes opens an expression for an op of it outside
+/// forms, which it takes for the condition of the DISABLE_IF around (:1690-1704, :3045-3059):
+/// edk2-stable202608 IfrParse.c opens one for NO_SUBMIT_IF and INCONSISTENT_IF at :2515,
+/// WARNING_IF at :2548, SUPPRESS_IF at :2574, GRAY_OUT_IF at :2609, VALUE at :2670, RULE at
+/// :2713, READ at :2736 and WRITE at :2767.
+fn hiding_role(code: IFROpCode) -> Option<&'static str> {
+    match code {
+        IFROpCode::SuppressIf => Some("§33.3.8.3.75 has it only hide"),
+        IFROpCode::GrayOutIf => Some("§33.3.8.3.28 has it only gray out"),
+        IFROpCode::Value => Some("§33.3.8.3.88 has it only give a value"),
+        IFROpCode::Read => Some("§33.3.8.3.58 has it only give a value"),
+        IFROpCode::Write => Some("§33.3.8.3.94 has it only change a value"),
+        IFROpCode::Rule => Some("§33.3.8.3.63 has it only name a rule"),
+        IFROpCode::InconsistentIf => Some("§33.3.8.3.33 has it only validate a question"),
+        IFROpCode::NoSubmitIf => Some("§33.3.8.3.46 has it only validate a question"),
+        IFROpCode::WarningIf => Some("§33.3.8.3.96 has it only validate a question"),
+        _ => None,
+    }
+}
+
 /// Fills the VarName strings of the VARSTORE_EFIs before UEFI 2.3.1 of the FormSets of `roots`,
 /// one package list's, from `string_packages`, its strings packages, as edk2-stable202608
 /// SetupBrowserDxe/IfrParse.c takes the string of each VarName (GetToken): for each op with a
@@ -5761,7 +6075,7 @@ mod tests {
                 root,
                 &ListTexts::new(&[], &[]),
                 IncludedStates::empty(),
-                None,
+                CheckedVarStores::NONE,
                 &mut Efivars::new().reader(),
             );
 
@@ -5783,12 +6097,12 @@ mod tests {
     #[test]
     fn questions_are_found_by_their_listed_name() {
         let root = parse_form_set(&[form(1, &[checkbox_op(1, 0)])]);
-        let values = VarStoreValues::new(&root, None);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
         let prompted = |prompt: &str| vec![en_us_package(StringMap::from([(3, prompt.into())]))];
         let find = |prompt: &str, phrase: &str| {
             find_question_in(
                 &root,
-                &QuestionMatch::Prompt(&BTreeSet::from([phrase])),
+                &QuestionMatch::Prompt(&BTreeSet::from([phrase]), MatchTier::Stored),
                 &mut FormSetWalk::new(
                     &ListTexts::new(&prompted(prompt), &[]),
                     &mut Efivars::new().reader(),
@@ -5802,7 +6116,7 @@ mod tests {
             Rc::clone(&root),
             &ListTexts::new(&prompted("  Prompt "), &[]),
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut Efivars::new().reader(),
         );
         let name = &listed[0].0.question;
@@ -6591,7 +6905,7 @@ mod tests {
                 root,
                 &ListTexts::new(&strings(), &[]),
                 IncludedStates::empty(),
-                None,
+                CheckedVarStores::NONE,
                 &mut disabled_reader(),
             );
 
@@ -6855,7 +7169,7 @@ mod nesting_tests {
         on_small_stack("VarStoreValues::new", || {
             let root = parse_deep(DEEP, DEEP, false);
             let deep = op_like(&root, &deep_checkbox());
-            let values = VarStoreValues::new(&root, None);
+            let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
             let mut reader = disabled_reader();
             for (id, indexed) in [(1, true), (9, false)] {
                 assert_eq!(
@@ -6877,7 +7191,7 @@ mod nesting_tests {
                     parse_deep(DEEP, DEEP, false),
                     &ListTexts::new(&deep_strings(), &[]),
                     include,
-                    None,
+                    CheckedVarStores::NONE,
                     &mut disabled_reader(),
                 );
                 let names: Vec<String> = listed
@@ -6893,9 +7207,9 @@ mod nesting_tests {
                 let selection = find_question(
                     parse_deep(DEEP, DEEP, false),
                     &ListTexts::new(&deep_strings(), &[]),
-                    &QuestionMatch::Prompt(&BTreeSet::from([name])),
+                    &QuestionMatch::Prompt(&BTreeSet::from([name]), MatchTier::Stored),
                     IncludedStates::GRAYED_OUT,
-                    None,
+                    CheckedVarStores::NONE,
                     &mut disabled_reader(),
                 );
                 assert_eq!(
@@ -6944,7 +7258,7 @@ mod nesting_tests {
                     .as_ref()
                     .and_then(Weak::upgrade)
                     .expect("the SUPPRESS_IF");
-                let values = VarStoreValues::new(&root, None);
+                let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
                 let mut reader = disabled_reader();
                 let mut inputs = ExpressionInputs {
                     reader: &mut reader,
diff --git a/src/lib/hii/forms/ami_access_level.rs b/src/lib/hii/forms/ami_access_level.rs
deleted file mode 100644
index ad5d850..0000000
--- a/src/lib/hii/forms/ami_access_level.rs
+++ /dev/null
@@ -1,221 +0,0 @@
-// Copyright 2023 Meta Platforms, Inc. and affiliates.
-//
-// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-//
-// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-//
-// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-//
-// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-//! The access level of a Setup session of AMI firmware, which its IFR conditions read from the
-//! VarStore SystemAccess.
-
-use std::cell::RefCell;
-use std::rc::Rc;
-
-use thiserror::Error;
-
-use super::form_set_list_var_stores;
-use super::storage::VarStoreVariable;
-use super::Creation;
-use super::Guid;
-use super::IFROpCode;
-use super::IFROperation;
-use super::ParsedOperation;
-
-/// Where AMI firmware's setup browser keeps the access level of its session: its IFR shows
-/// Access Level Administrator at 0 and User at 1.
-pub(super) const AMI_ACCESS_LEVEL: VarStoreVariable = VarStoreVariable {
-    name: "SystemAccess",
-    guid: Guid {
-        data1: 0xE770_BB69,
-        data2: 0xBCB4,
-        data3: 0x4D04,
-        data4: [0x9E, 0x97, 0x23, 0xFF, 0x94, 0x56, 0xFE, 0xAC],
-    },
-};
-
-/// The access level that AMI firmware's Setup keeps in the VarStore SystemAccess,
-/// E770BB69-BCB4-4D04-9E97-23FF9456FEAC.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-#[repr(u8)]
-#[non_exhaustive]
-pub enum AccessLevel {
-    Administrator = 0,
-    User = 1,
-}
-
-impl From<AccessLevel> for u8 {
-    fn from(level: AccessLevel) -> Self {
-        level as u8
-    }
-}
-
-/// An AccessLevel stated for a HiiDB whose FormSets declare no AMI_ACCESS_LEVEL.
-#[derive(Debug, Error)]
-#[error(
-    "--access-level applies to AMI firmware whose HiiDB declares the SystemAccess VarStore; this \
-     HiiDB declares none"
-)]
-pub(crate) struct NoAccessLevelVarStore;
-
-/// Refuses `access_level` if stated for a HiiDB whose FormSets, `roots`, declare no
-/// AMI_ACCESS_LEVEL.
-pub(crate) fn check_access_level<'a>(
-    roots: impl IntoIterator<Item = &'a Rc<RefCell<IFROperation>>>,
-    access_level: Option<AccessLevel>,
-) -> Result<(), NoAccessLevelVarStore> {
-    match access_level {
-        None => Ok(()),
-        Some(_) if roots.into_iter().any(form_set_declares_ami_access_level) => Ok(()),
-        Some(_) => Err(NoAccessLevelVarStore),
-    }
-}
-
-/// Whether a FormSet of `root` declares AMI_ACCESS_LEVEL among the VarStores where
-/// find_corresponding_varstore finds those of its questions: those that edk2 creates.
-fn form_set_declares_ami_access_level(root: &Rc<RefCell<IFROperation>>) -> bool {
-    root.borrow().children.iter().any(|form_set| {
-        let form_set = form_set.borrow();
-        form_set.op_code == IFROpCode::FormSet
-            && form_set_list_var_stores(&form_set, |op, creation, _| {
-                (declares_ami_access_level(op) && *creation == Creation::Created).then_some(())
-            })
-            .is_some()
-    })
-}
-
-/// Whether `op` declares AMI_ACCESS_LEVEL, as a buffer or EFI variable VarStore.
-fn declares_ami_access_level(op: &IFROperation) -> bool {
-    match &op.parsed_data {
-        ParsedOperation::VarStore(store) => AMI_ACCESS_LEVEL.identifies(store),
-        ParsedOperation::VarStoreEfi(store) => AMI_ACCESS_LEVEL.identifies(store),
-        ParsedOperation::FormSet(_)
-        | ParsedOperation::OneOf(_)
-        | ParsedOperation::CheckBox(_)
-        | ParsedOperation::OneOfOption(_)
-        | ParsedOperation::VarStoreNameValue(_)
-        | ParsedOperation::ShortVarStoreEfi(_)
-        | ParsedOperation::DefaultStore(_)
-        | ParsedOperation::IFRDefault(_)
-        | ParsedOperation::Form(_)
-        | ParsedOperation::Text(_)
-        | ParsedOperation::Subtitle(_)
-        | ParsedOperation::Numeric(_)
-        | ParsedOperation::QuestionRef1(_)
-        | ParsedOperation::EqIdVal(_)
-        | ParsedOperation::EqIdId(_)
-        | ParsedOperation::EqIdValList(_)
-        | ParsedOperation::Get(_)
-        | ParsedOperation::Set(_)
-        | ParsedOperation::FormMap(_)
-        | ParsedOperation::Date(_)
-        | ParsedOperation::Time(_)
-        | ParsedOperation::OrderedList(_)
-        | ParsedOperation::Ref(_)
-        | ParsedOperation::String(_)
-        | ParsedOperation::Placeholder => false,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::super::ifr_fixtures::*;
-    use super::*;
-
-    /// check_access_level takes a stated level for a HiiDB with a FormSet that declares
-    /// SystemAccess, buffer or EFI variable, and refuses it for one without.
-    #[test]
-    fn stated_access_level_needs_a_system_access_var_store() {
-        let setup = || var_store_efi(1, "Setup", NV_BS_RT, 1);
-        let cases = [
-            ("no VarStore", vec![], false),
-            ("Setup", vec![setup()], false),
-            (
-                "SystemAccess of NIL_GUID",
-                vec![var_store(2, [0; 16], "SystemAccess", 1)],
-                false,
-            ),
-            (
-                "Setup of the SystemAccess Guid",
-                vec![var_store(2, SYSTEM_ACCESS_GUID, "Setup", 1)],
-                false,
-            ),
-            (
-                "buffer SystemAccess",
-                vec![setup(), var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 1)],
-                true,
-            ),
-            (
-                "EFI variable SystemAccess",
-                vec![var_store_efi_of(
-                    2,
-                    SYSTEM_ACCESS_GUID,
-                    "SystemAccess",
-                    NV_BS,
-                    1,
-                )],
-                true,
-            ),
-        ];
-        let without = parse_form_set(&[setup()]);
-        for (name, declarations, declares) in cases {
-            let with = parse_form_set(&declarations);
-            for level in [AccessLevel::Administrator, AccessLevel::User] {
-                let checked = check_access_level([&without, &with], Some(level))
-                    .map_err(|error| error.to_string());
-                let want = match declares {
-                    true => Ok(()),
-                    false => Err(
-                        "--access-level applies to AMI firmware whose HiiDB declares \
-                         the SystemAccess VarStore; this HiiDB declares none"
-                            .to_string(),
-                    ),
-                };
-                assert_eq!(checked, want, "{name}, {level:?}");
-            }
-            assert!(
-                check_access_level([&without, &with], None).is_ok(),
-                "{name}, no level"
-            );
-        }
-    }
-
-    /// check_access_level takes SystemAccess where edk2 creates it: under a SUPPRESS_IF of the
-    /// FormSet, or a DISABLE_IF of it whose constant condition is FALSE; not under one whose
-    /// condition is TRUE or not constant.
-    #[test]
-    fn a_system_access_var_store_counts_where_edk2_creates_it() {
-        let system_access = || var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 1);
-        let cases = [
-            (
-                "SUPPRESS_IF TRUE",
-                conditional(SUPPRESS_IF, ifr_true(), &[system_access()]),
-                true,
-            ),
-            (
-                "DISABLE_IF FALSE",
-                conditional(DISABLE_IF, ifr_false(), &[system_access()]),
-                true,
-            ),
-            (
-                "DISABLE_IF TRUE",
-                conditional(DISABLE_IF, ifr_true(), &[system_access()]),
-                false,
-            ),
-            (
-                "DISABLE_IF not constant",
-                conditional(DISABLE_IF, eq_id_val_of(1, 0), &[system_access()]),
-                false,
-            ),
-        ];
-        for (name, declaration, declares) in cases {
-            let root = parse_form_set(&[declaration]);
-            let checked = check_access_level([&root], Some(AccessLevel::User)).is_ok();
-            assert_eq!(checked, declares, "{name}");
-        }
-    }
-}
diff --git a/src/lib/hii/forms/assumed_var_store.rs b/src/lib/hii/forms/assumed_var_store.rs
new file mode 100644
index 0000000..aadafdb
--- /dev/null
+++ b/src/lib/hii/forms/assumed_var_store.rs
@@ -0,0 +1,792 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! Bytes of a VarStore that the user states with --assume-var-store, which conditions read in
+//! place of those its variable holds: what a setup browser holds where the OS cannot read it,
+//! such as a buffer VarStore that only the driver's EFI_HII_CONFIG_ACCESS_PROTOCOL reaches.
+
+use std::cell::RefCell;
+use std::fmt;
+use std::ops::Range;
+use std::rc::Rc;
+use std::str::FromStr;
+
+use thiserror::Error;
+
+use super::form_set_list_var_stores;
+use super::Creation;
+use super::Guid;
+use super::IFROpCode;
+use super::IFROperation;
+use super::ParsedOperation;
+use super::VariableStore;
+use crate::hex_digits::hex_bytes;
+use crate::hii::variables::VariableKey;
+use crate::hii::variables::VariableLayout;
+
+/// "8BE4DF61-93CA-11D2-AA0D-00E098032B8C"
+const GUID_TEXT_LEN: usize = 36;
+/// The bytes of a VarStore's payload: its Size is a UINT16 (UEFI 2.11 §33.3.8.3.89)
+const PAYLOAD_LIMIT: usize = 1 << 16;
+
+/// `bytes` that conditions read from byte `offset` of the payload of the VarStore whose variable
+/// is `variable`, in place of those the variable holds. It writes nothing.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct AssumedVarStore {
+    /// Named as its efivar file names it: '!' for each '/'
+    variable: VariableKey,
+    offset: u16,
+    bytes: Vec<u8>,
+}
+
+/// Why a text is no NAME-GUID[+OFFSET]=HEX.
+#[derive(Debug, Clone, Error, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum AssumedVarStoreError {
+    #[error("expected NAME-GUID[+OFFSET]=HEX, got {0:?}")]
+    Syntax(String),
+    #[error("invalid GUID {0:?}")]
+    Guid(String),
+    #[error("invalid OFFSET {0:?}: give a decimal number, or a hexadecimal one after 0x")]
+    Offset(String),
+    #[error("invalid HEX {0:?}: give two hex digits per byte, at least one byte")]
+    Bytes(String),
+    #[error("{bytes} bytes from byte {offset} pass the 65536 bytes that a VarStore can hold")]
+    Size { offset: u16, bytes: usize },
+}
+
+/// `variable` named as its efivar file names it: '!' for each '/'.
+fn efivar_file_named(variable: VariableKey) -> VariableKey {
+    VariableKey {
+        name: variable.name.replace('/', "!"),
+        ..variable
+    }
+}
+
+impl AssumedVarStore {
+    /// The payload bytes that it states.
+    fn range(&self) -> Range<usize> {
+        let start = usize::from(self.offset);
+        start..start + self.bytes.len()
+    }
+}
+
+/// NAME-GUID[+OFFSET]=HEX: the name of the efivar file of the VarStore's variable, as the reasons
+/// of unreadable values print it, then the first byte stated and the bytes.
+impl FromStr for AssumedVarStore {
+    type Err = AssumedVarStoreError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let syntax = || AssumedVarStoreError::Syntax(s.to_owned());
+        let (key, hex) = s.rsplit_once('=').ok_or_else(syntax)?;
+        let (key, offset) = match key.rsplit_once('+') {
+            Some((key, offset)) if ends_in_guid(key) => (key, parse_offset(offset)?),
+            Some(_) | None => (key, 0),
+        };
+        let split = key
+            .len()
+            .checked_sub(GUID_TEXT_LEN + 1)
+            .ok_or_else(syntax)?;
+        let (Some(name), Some("-"), Some(guid)) = (
+            key.get(..split),
+            key.get(split..=split),
+            key.get(split + 1..),
+        ) else {
+            return Err(syntax());
+        };
+        if name.is_empty() {
+            return Err(syntax());
+        }
+        let guid = Guid::from_str(guid).map_err(|_| AssumedVarStoreError::Guid(guid.to_owned()))?;
+        let bytes = hex_bytes::<Vec<u8>>(hex)
+            .filter(|bytes| !bytes.is_empty())
+            .ok_or_else(|| AssumedVarStoreError::Bytes(hex.to_owned()))?;
+        if usize::from(offset) + bytes.len() > PAYLOAD_LIMIT {
+            return Err(AssumedVarStoreError::Size {
+                offset,
+                bytes: bytes.len(),
+            });
+        }
+        let variable = VariableKey {
+            name: name.to_owned(),
+            guid,
+        };
+        Ok(Self {
+            variable: efivar_file_named(variable),
+            offset,
+            bytes,
+        })
+    }
+}
+
+/// Whether `key` ends in a GUID.
+fn ends_in_guid(key: &str) -> bool {
+    key.len()
+        .checked_sub(GUID_TEXT_LEN)
+        .and_then(|start| key.get(start..))
+        .is_some_and(|guid| Guid::from_str(guid).is_ok())
+}
+
+/// The OFFSET `text`: decimal digits, or hex digits after 0x.
+fn parse_offset(text: &str) -> Result<u16, AssumedVarStoreError> {
+    let (digits, radix) = match text.strip_prefix("0x").or_else(|| text.strip_prefix("0X")) {
+        Some(digits) => (digits, 16),
+        None => (text, 10),
+    };
+    let parsed = match digits.chars().all(|digit| digit.is_digit(radix)) {
+        true => u16::from_str_radix(digits, radix).ok(),
+        false => None,
+    };
+    parsed.ok_or_else(|| AssumedVarStoreError::Offset(text.to_owned()))
+}
+
+/// NAME-GUID+OFFSET=HEX, as FromStr reads it: the name of its efivar file, then the decimal
+/// offset and two lowercase hex digits per byte.
+impl fmt::Display for AssumedVarStore {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}+{}=", self.variable, self.offset)?;
+        self.bytes
+            .iter()
+            .try_for_each(|byte| write!(f, "{byte:02x}"))
+    }
+}
+
+/// Why check_assumed refuses a statement.
+#[derive(Debug, Clone, Error, PartialEq, Eq)]
+pub(crate) enum AssumedVarStoreRefusal {
+    #[error("no FormSet of this HiiDB declares a VarStore {0}")]
+    Undeclared(VariableKey),
+    #[error(
+        "--assume-var-store states bytes {}..{} of VarStore {key} twice",
+        .bytes.start,
+        .bytes.end
+    )]
+    Twice {
+        key: VariableKey,
+        bytes: Range<usize>,
+    },
+    #[error(
+        "bytes {}..{} pass the Size {size} that VarStore {key} declares",
+        .bytes.start,
+        .bytes.end
+    )]
+    PastSize {
+        key: VariableKey,
+        bytes: Range<usize>,
+        size: u16,
+    },
+}
+
+/// The refusals of check_assumed, in the order of the statements.
+#[derive(Debug, Clone, Error, PartialEq, Eq)]
+#[error("{}", .0.iter().map(ToString::to_string).collect::<Vec<_>>().join("; "))]
+pub(crate) struct AssumedVarStoresRefused(Vec<AssumedVarStoreRefusal>);
+
+/// Statements that check_assumed takes: no two of them state one byte.
+#[derive(Debug, Clone, Copy)]
+pub(crate) struct CheckedVarStores<'a>(&'a [AssumedVarStore]);
+
+impl CheckedVarStores<'static> {
+    /// Of no statement.
+    pub(crate) const NONE: Self = Self(&[]);
+}
+
+#[cfg(test)]
+#[cfg(efivar_dumps)]
+impl<'a> CheckedVarStores<'a> {
+    /// `assumed`, unchecked, for tests of VarStores that no FormSet declares.
+    pub(super) fn unchecked(assumed: &'a [AssumedVarStore]) -> Self {
+        Self(assumed)
+    }
+}
+
+/// Refuses each of `assumed` whose VarStore no FormSet of `roots` declares as a VARSTORE or
+/// VARSTORE_EFI where edk2 creates it, whose bytes pass the Size of every such declaration, or
+/// whose bytes another of them states too.
+pub(crate) fn check_assumed<'a, 's>(
+    roots: impl IntoIterator<Item = &'a Rc<RefCell<IFROperation>>>,
+    assumed: &'s [AssumedVarStore],
+) -> Result<CheckedVarStores<'s>, AssumedVarStoresRefused> {
+    let declared = declared_sizes(roots);
+    let mut refusals = Vec::new();
+    for (index, statement) in assumed.iter().enumerate() {
+        let size = declared
+            .iter()
+            .filter(|(key, _)| *key == statement.variable)
+            .map(|&(_, size)| size)
+            .max();
+        match size {
+            None => refusals.push(AssumedVarStoreRefusal::Undeclared(
+                statement.variable.clone(),
+            )),
+            Some(size) if statement.range().end > usize::from(size) => {
+                refusals.push(AssumedVarStoreRefusal::PastSize {
+                    key: statement.variable.clone(),
+                    bytes: statement.range(),
+                    size,
+                });
+            }
+            Some(_) => {}
+        }
+        let twice = assumed
+            .iter()
+            .take(index)
+            .filter(|earlier| earlier.variable == statement.variable)
+            .filter_map(|earlier| {
+                let (earlier, later) = (earlier.range(), statement.range());
+                let bytes = earlier.start.max(later.start)..earlier.end.min(later.end);
+                (!bytes.is_empty()).then(|| AssumedVarStoreRefusal::Twice {
+                    key: statement.variable.clone(),
+                    bytes,
+                })
+            });
+        refusals.extend(twice);
+    }
+    match refusals.is_empty() {
+        true => Ok(CheckedVarStores(assumed)),
+        false => Err(AssumedVarStoresRefused(refusals)),
+    }
+}
+
+/// The variable, named as its efivar file names it, and the Size of each VARSTORE and
+/// VARSTORE_EFI that a FormSet of `roots` declares where edk2 creates it, as
+/// find_corresponding_varstore finds those of its questions.
+fn declared_sizes<'a>(
+    roots: impl IntoIterator<Item = &'a Rc<RefCell<IFROperation>>>,
+) -> Vec<(VariableKey, u16)> {
+    let mut declared = Vec::new();
+    for root in roots {
+        for form_set in &root.borrow().children {
+            let form_set = form_set.borrow();
+            if form_set.op_code != IFROpCode::FormSet {
+                continue;
+            }
+            form_set_list_var_stores(&form_set, |op, creation, _| {
+                if *creation == Creation::Created {
+                    declared.extend(declared_size(op));
+                }
+                None::<()>
+            });
+        }
+    }
+    declared
+}
+
+/// The variable, named as its efivar file names it, and the Size of the VARSTORE or
+/// VARSTORE_EFI `op`; None for another op.
+fn declared_size(op: &IFROperation) -> Option<(VariableKey, u16)> {
+    let store: &dyn VariableStore = match &op.parsed_data {
+        ParsedOperation::VarStore(store) => store,
+        ParsedOperation::VarStoreEfi(store) => store,
+        ParsedOperation::FormSet(_)
+        | ParsedOperation::OneOf(_)
+        | ParsedOperation::CheckBox(_)
+        | ParsedOperation::OneOfOption(_)
+        | ParsedOperation::VarStoreNameValue(_)
+        | ParsedOperation::ShortVarStoreEfi(_)
+        | ParsedOperation::DefaultStore(_)
+        | ParsedOperation::IFRDefault(_)
+        | ParsedOperation::Form(_)
+        | ParsedOperation::Text(_)
+        | ParsedOperation::Subtitle(_)
+        | ParsedOperation::Numeric(_)
+        | ParsedOperation::QuestionRef1(_)
+        | ParsedOperation::EqIdVal(_)
+        | ParsedOperation::EqIdId(_)
+        | ParsedOperation::EqIdValList(_)
+        | ParsedOperation::Get(_)
+        | ParsedOperation::Set(_)
+        | ParsedOperation::FormMap(_)
+        | ParsedOperation::Date(_)
+        | ParsedOperation::Time(_)
+        | ParsedOperation::OrderedList(_)
+        | ParsedOperation::Ref(_)
+        | ParsedOperation::String(_)
+        | ParsedOperation::Placeholder => return None,
+    };
+    Some((efivar_file_named(store.variable_key()), store.size()))
+}
+
+/// Those of `assumed` that state bytes of `store`, by the name of its efivar file; none of a
+/// store whose variable holds the value of one question (VariableLayout::OneValue).
+pub(super) fn statements_of<'a>(
+    assumed: CheckedVarStores<'a>,
+    store: &dyn VariableStore,
+) -> StoreStatements<'a> {
+    match store.layout() {
+        VariableLayout::Offsets => {}
+        VariableLayout::OneValue => return StoreStatements::default(),
+    }
+    let variable = efivar_file_named(store.variable_key());
+    StoreStatements(
+        assumed
+            .0
+            .iter()
+            .filter(|statement| statement.variable == variable)
+            .collect(),
+    )
+}
+
+/// The statements of one VarStore, of CheckedVarStores.
+#[derive(Debug, Default)]
+pub(super) struct StoreStatements<'a>(Vec<&'a AssumedVarStore>);
+
+impl StoreStatements<'_> {
+    /// The bytes of `range` of the payload that these state, None where none of them does.
+    pub(super) fn bytes(&self, range: Range<usize>) -> Vec<Option<u8>> {
+        range
+            .map(|at| {
+                self.0.iter().find_map(|statement| {
+                    let index = at.checked_sub(usize::from(statement.offset))?;
+                    statement.bytes.get(index).copied()
+                })
+            })
+            .collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::ifr_fixtures::*;
+    use super::super::storage::VariableStoreKind;
+    use super::*;
+
+    /// 11111111-1111-1111-1111-111111111111, as stored
+    const MODE_GUID: [u8; 16] = [0x11; 16];
+    const KEY: &str = "Mode-11111111-1111-1111-1111-111111111111";
+
+    /// The statement of `text`.
+    fn stated(text: &str) -> AssumedVarStore {
+        text.parse()
+            .unwrap_or_else(|error| panic!("parse {text:?}: {error}"))
+    }
+
+    /// FromStr reads NAME-GUID[+OFFSET]=HEX: the name before the last "-GUID" ahead of the
+    /// last '=' or of a '+' before it, a GUID of either case, a decimal OFFSET or a hexadecimal
+    /// one after 0x, and two hex digits of either case per byte, at least one; the name keeps
+    /// '!' and takes '!' for '/', as its efivar file does. Display writes it back with its
+    /// offset, the GUID and the digits in lowercase.
+    #[test]
+    fn assumed_var_store_reads_its_efivar_file_name() {
+        let guid = Guid::from_str("11111111-1111-1111-1111-111111111111").expect("parse GUID");
+        let taken = [
+            (
+                format!("{KEY}=00"),
+                "Mode",
+                0,
+                vec![0x00],
+                format!("{KEY}+0=00"),
+            ),
+            (
+                format!("{KEY}+3=0aFF"),
+                "Mode",
+                3,
+                vec![0x0A, 0xFF],
+                format!("{KEY}+3=0aff"),
+            ),
+            (
+                format!("{KEY}+0x1F=01"),
+                "Mode",
+                31,
+                vec![0x01],
+                format!("{KEY}+31=01"),
+            ),
+            (
+                format!("{KEY}+0X10=01"),
+                "Mode",
+                16,
+                vec![0x01],
+                format!("{KEY}+16=01"),
+            ),
+            (
+                "Mode-8BE4DF61-93CA-11D2-AA0D-00E098032B8C=01".to_string(),
+                "Mode",
+                0,
+                vec![0x01],
+                "Mode-8be4df61-93ca-11d2-aa0d-00e098032b8c+0=01".to_string(),
+            ),
+            (
+                "A-b+c=d-11111111-1111-1111-1111-111111111111=01".to_string(),
+                "A-b+c=d",
+                0,
+                vec![0x01],
+                "A-b+c=d-11111111-1111-1111-1111-111111111111+0=01".to_string(),
+            ),
+            (
+                "a!b-11111111-1111-1111-1111-111111111111+2=01".to_string(),
+                "a!b",
+                2,
+                vec![0x01],
+                "a!b-11111111-1111-1111-1111-111111111111+2=01".to_string(),
+            ),
+            (
+                "a/b-11111111-1111-1111-1111-111111111111=01".to_string(),
+                "a!b",
+                0,
+                vec![0x01],
+                "a!b-11111111-1111-1111-1111-111111111111+0=01".to_string(),
+            ),
+            (
+                format!("{KEY}+65535=00"),
+                "Mode",
+                65535,
+                vec![0x00],
+                format!("{KEY}+65535=00"),
+            ),
+        ];
+        for (text, name, offset, bytes, written) in taken {
+            let guid = match text.contains("8BE4DF61") {
+                true => Guid::from_str("8BE4DF61-93CA-11D2-AA0D-00E098032B8C").expect("parse GUID"),
+                false => guid,
+            };
+            let want = AssumedVarStore {
+                variable: VariableKey {
+                    name: name.to_string(),
+                    guid,
+                },
+                offset,
+                bytes,
+            };
+            assert_eq!(text.parse::<AssumedVarStore>(), Ok(want.clone()), "{text}");
+            assert_eq!(want.to_string(), written, "{text}: Display");
+            assert_eq!(
+                written.parse::<AssumedVarStore>(),
+                Ok(want),
+                "{text}: Display read back"
+            );
+        }
+
+        let refused = [
+            (
+                KEY.to_string(),
+                AssumedVarStoreError::Syntax(KEY.to_string()),
+            ),
+            (
+                format!("{KEY}=0"),
+                AssumedVarStoreError::Bytes("0".to_string()),
+            ),
+            (
+                format!("{KEY}="),
+                AssumedVarStoreError::Bytes(String::new()),
+            ),
+            (
+                format!("{KEY}=0g"),
+                AssumedVarStoreError::Bytes("0g".to_string()),
+            ),
+            (
+                format!("{KEY}+x=00"),
+                AssumedVarStoreError::Offset("x".to_string()),
+            ),
+            (
+                format!("{KEY}+=00"),
+                AssumedVarStoreError::Offset(String::new()),
+            ),
+            (
+                format!("{KEY}+0x=00"),
+                AssumedVarStoreError::Offset("0x".to_string()),
+            ),
+            (
+                format!("{KEY}+-1=00"),
+                AssumedVarStoreError::Offset("-1".to_string()),
+            ),
+            (
+                format!("{KEY}+65536=00"),
+                AssumedVarStoreError::Offset("65536".to_string()),
+            ),
+            (
+                "-11111111-1111-1111-1111-111111111111=00".to_string(),
+                AssumedVarStoreError::Syntax(
+                    "-11111111-1111-1111-1111-111111111111=00".to_string(),
+                ),
+            ),
+            (
+                "Mode11111111-1111-1111-1111-111111111111=00".to_string(),
+                AssumedVarStoreError::Syntax(
+                    "Mode11111111-1111-1111-1111-111111111111=00".to_string(),
+                ),
+            ),
+            (
+                "Mode-1111111X-2222-3333-4444-555555555555=00".to_string(),
+                AssumedVarStoreError::Guid("1111111X-2222-3333-4444-555555555555".to_string()),
+            ),
+            (
+                format!("{KEY}+65535=0000"),
+                AssumedVarStoreError::Size {
+                    offset: 65535,
+                    bytes: 2,
+                },
+            ),
+        ];
+        for (text, want) in refused {
+            assert_eq!(text.parse::<AssumedVarStore>(), Err(want), "{text}");
+        }
+    }
+
+    /// FormSets declaring Mode, a 4-byte buffer VarStore, Other, a 2-byte EFI variable one, and
+    /// a!b, a 1-byte buffer one, all of MODE_GUID; the second FormSet declares Mode again with 8
+    /// bytes.
+    fn declaring() -> [Rc<RefCell<IFROperation>>; 2] {
+        [
+            parse_form_set(&[
+                var_store(1, MODE_GUID, "Mode", 4),
+                var_store_efi_of(2, MODE_GUID, "Other", NV_BS_RT, 2),
+                var_store(3, MODE_GUID, "a!b", 1),
+            ]),
+            parse_form_set(&[var_store(1, MODE_GUID, "Mode", 8)]),
+        ]
+    }
+
+    /// check_assumed's refusals of `texts` in `roots`, as they show.
+    fn refused(roots: &[Rc<RefCell<IFROperation>>], texts: &[String]) -> Result<(), String> {
+        let assumed: Vec<AssumedVarStore> = texts.iter().map(|text| stated(text)).collect();
+        check_assumed(roots, &assumed)
+            .map(|_| ())
+            .map_err(|refused| refused.to_string())
+    }
+
+    /// check_assumed takes statements of VarStores that a FormSet declares, within the greatest
+    /// Size declared, and refuses, naming each in order, one of an undeclared VarStore, of a
+    /// name/value one, of another name or GUID, one past every Size declared, and two whose bytes
+    /// overlap, naming the bytes stated twice.
+    #[test]
+    fn check_assumed_refuses_what_no_var_store_takes() {
+        let roots = declaring();
+        let mode = |rest: &str| format!("{KEY}{rest}");
+        let other = |rest: &str| format!("Other-11111111-1111-1111-1111-111111111111{rest}");
+        let taken = [
+            vec![],
+            vec![mode("=00")],
+            vec![mode("+7=00")],
+            vec![mode("=0001020304050607")],
+            vec![mode("=00"), mode("+1=01")],
+            vec![mode("+2=0000"), mode("=0000"), other("=0000")],
+            vec![other("+1=00"), mode("+1=00")],
+            vec!["a/b-11111111-1111-1111-1111-111111111111=01".to_string()],
+            vec!["a!b-11111111-1111-1111-1111-111111111111=01".to_string()],
+        ];
+        for texts in taken {
+            assert_eq!(refused(&roots, &texts), Ok(()), "{texts:?}");
+        }
+
+        let refusals = [
+            (
+                vec!["Undeclared-00000000-0000-0000-0000-000000000001=00".to_string()],
+                "no FormSet of this HiiDB declares a VarStore \
+                 Undeclared-00000000-0000-0000-0000-000000000001",
+            ),
+            (
+                vec!["Mode-22222222-2222-2222-2222-222222222222=00".to_string()],
+                "no FormSet of this HiiDB declares a VarStore \
+                 Mode-22222222-2222-2222-2222-222222222222",
+            ),
+            (
+                vec!["MODE-11111111-1111-1111-1111-111111111111=00".to_string()],
+                "no FormSet of this HiiDB declares a VarStore \
+                 MODE-11111111-1111-1111-1111-111111111111",
+            ),
+            (
+                vec![mode("+8=00")],
+                "bytes 8..9 pass the Size 8 that VarStore \
+                 Mode-11111111-1111-1111-1111-111111111111 declares",
+            ),
+            (
+                vec![mode("+6=000000")],
+                "bytes 6..9 pass the Size 8 that VarStore \
+                 Mode-11111111-1111-1111-1111-111111111111 declares",
+            ),
+            (
+                vec![other("+1=0000")],
+                "bytes 1..3 pass the Size 2 that VarStore \
+                 Other-11111111-1111-1111-1111-111111111111 declares",
+            ),
+            (
+                vec![mode("=00"), mode("=01")],
+                "--assume-var-store states bytes 0..1 of VarStore \
+                 Mode-11111111-1111-1111-1111-111111111111 twice",
+            ),
+            (
+                vec![mode("+1=000000"), mode("=0000")],
+                "--assume-var-store states bytes 1..2 of VarStore \
+                 Mode-11111111-1111-1111-1111-111111111111 twice",
+            ),
+            (
+                vec![
+                    "a/b-11111111-1111-1111-1111-111111111111=01".to_string(),
+                    "a!b-11111111-1111-1111-1111-111111111111=00".to_string(),
+                ],
+                "--assume-var-store states bytes 0..1 of VarStore \
+                 a!b-11111111-1111-1111-1111-111111111111 twice",
+            ),
+            (
+                vec![
+                    "Undeclared-00000000-0000-0000-0000-000000000001=00".to_string(),
+                    mode("=00"),
+                    "Undeclared-33333333-3333-3333-3333-333333333333=00".to_string(),
+                    mode("+9=00"),
+                    mode("=0101"),
+                ],
+                "no FormSet of this HiiDB declares a VarStore \
+                 Undeclared-00000000-0000-0000-0000-000000000001; no FormSet of this HiiDB \
+                 declares a VarStore Undeclared-33333333-3333-3333-3333-333333333333; bytes 9..10 \
+                 pass the Size 8 that VarStore Mode-11111111-1111-1111-1111-111111111111 \
+                 declares; --assume-var-store states bytes 0..1 of VarStore \
+                 Mode-11111111-1111-1111-1111-111111111111 twice",
+            ),
+        ];
+        for (texts, want) in refusals {
+            assert_eq!(refused(&roots, &texts), Err(want.to_string()), "{texts:?}");
+        }
+
+        let name_value = parse_form_set(&[var_store_name_value(1, MODE_GUID)]);
+        assert_eq!(
+            refused(&[name_value], &[mode("=00")]),
+            Err("no FormSet of this HiiDB declares a VarStore \
+                 Mode-11111111-1111-1111-1111-111111111111"
+                .to_string()),
+            "a name/value VarStore of the GUID"
+        );
+    }
+
+    /// check_assumed takes a VarStore where edk2 creates it: under a SUPPRESS_IF of the FormSet,
+    /// or a DISABLE_IF of it whose constant condition is FALSE; not under one whose condition is
+    /// TRUE or not constant.
+    #[test]
+    fn a_stated_var_store_counts_where_edk2_creates_it() {
+        let mode = || var_store(2, MODE_GUID, "Mode", 1);
+        let cases = [
+            (
+                "SUPPRESS_IF TRUE",
+                conditional(SUPPRESS_IF, ifr_true(), &[mode()]),
+                true,
+            ),
+            (
+                "DISABLE_IF FALSE",
+                conditional(DISABLE_IF, ifr_false(), &[mode()]),
+                true,
+            ),
+            (
+                "DISABLE_IF TRUE",
+                conditional(DISABLE_IF, ifr_true(), &[mode()]),
+                false,
+            ),
+            (
+                "DISABLE_IF not constant",
+                conditional(DISABLE_IF, eq_id_val_of(1, 0), &[mode()]),
+                false,
+            ),
+        ];
+        for (name, declaration, declares) in cases {
+            let root = parse_form_set(&[declaration]);
+            let checked = refused(&[root], &[format!("{KEY}=00")]).is_ok();
+            assert_eq!(checked, declares, "{name}");
+        }
+    }
+
+    /// A VarStore of NIL_GUID whose variable holds the value of one question.
+    struct OneValueStore;
+
+    impl VariableStore for OneValueStore {
+        fn name(&self) -> String {
+            "Mode".to_string()
+        }
+
+        fn guid(&self) -> Guid {
+            NIL_GUID
+        }
+
+        fn size(&self) -> u16 {
+            1
+        }
+
+        fn kind(&self) -> VariableStoreKind {
+            VariableStoreKind::EfiVariable
+        }
+
+        fn is_runtime_accessible(&self) -> bool {
+            true
+        }
+
+        fn layout(&self) -> VariableLayout {
+            VariableLayout::OneValue
+        }
+    }
+
+    /// StoreStatements::bytes gives each byte of a range from the statement that covers it, and
+    /// None for the others; statements_of keeps those of the store, by the name of its efivar
+    /// file, and none of a store whose variable holds one value.
+    #[test]
+    fn stated_bytes_patch_only_the_stated_offsets() {
+        let nil = |name: &str, bytes: &str| {
+            stated(&format!(
+                "{name}-00000000-0000-0000-0000-000000000000={bytes}"
+            ))
+        };
+        let roots = [parse_form_set(&[
+            var_store(1, [0; 16], "Mode", 6),
+            var_store(2, MODE_GUID, "Mode", 1),
+            var_store(3, [0; 16], "Other", 1),
+            var_store(4, [0; 16], "a/b", 1),
+        ])];
+
+        let assumed = [
+            nil("Mode", "0a0b"),
+            stated("Mode-00000000-0000-0000-0000-000000000000+5=0c"),
+        ];
+        let checked = check_assumed(&roots, &assumed).expect("check the statements of Mode");
+        let statements = statements_of(checked, &buffer("Mode", 6));
+        let cases = [
+            (0..2, vec![Some(0x0A), Some(0x0B)]),
+            (1..3, vec![Some(0x0B), None]),
+            (2..5, vec![None, None, None]),
+            (4..7, vec![None, Some(0x0C), None]),
+            (
+                0..6,
+                vec![Some(0x0A), Some(0x0B), None, None, None, Some(0x0C)],
+            ),
+        ];
+        for (range, want) in cases {
+            assert_eq!(statements.bytes(range.clone()), want, "{range:?}");
+        }
+
+        let assumed = [
+            nil("Mode", "01"),
+            stated("Mode-11111111-1111-1111-1111-111111111111=02"),
+            nil("Other", "03"),
+            nil("a/b", "04"),
+            stated("Mode-00000000-0000-0000-0000-000000000000+1=05"),
+        ];
+        let checked = check_assumed(&roots, &assumed).expect("check the statements of each store");
+        let stores: [(&str, &dyn VariableStore, Vec<u8>); 5] = [
+            ("Mode", &buffer("Mode", 2), vec![0x01, 0x05]),
+            (
+                "EFI variable Mode",
+                &efi_variable("Mode", 2),
+                vec![0x01, 0x05],
+            ),
+            ("a/b", &buffer("a/b", 1), vec![0x04]),
+            ("a!b", &buffer("a!b", 1), vec![0x04]),
+            ("one value", &OneValueStore, vec![]),
+        ];
+        for (name, store, want) in stores {
+            let got: Vec<u8> = statements_of(checked, store)
+                .0
+                .iter()
+                .flat_map(|statement| statement.bytes.clone())
+                .collect();
+            assert_eq!(got, want, "{name}");
+        }
+        assert!(
+            statements_of(checked, &buffer("mode", 1)).0.is_empty(),
+            "another case of the name"
+        );
+    }
+}
diff --git a/src/lib/hii/forms/conditions.rs b/src/lib/hii/forms/conditions.rs
index 28bdbc8..c86dab6 100644
--- a/src/lib/hii/forms/conditions.rs
+++ b/src/lib/hii/forms/conditions.rs
@@ -18,7 +18,10 @@
 //! decide which questions a user sees and sets, as the platform's setup browser, mostly edk2's,
 //! shows them, and the spec would make every EQ_ID_VAL of a CHECKBOX, which holds a BOOLEAN,
 //! UNDEFINED. Where edk2 ASSERTs, the result is not evaluated; where a CONDITIONAL drops an
-//! UNDEFINED and the two results differ in effect, it is undetermined, naming both. Lines are of
+//! UNDEFINED and the two results differ in effect, QUESTION_REF3 takes a question from another
+//! FormSet or, without a Guid in the WRITE of that question, its value before the write, RULE_REF
+//! one of two rules or, in a SUPPRESS_IF around FORMs, a FORM's rule, or THIS in a rule another
+//! statement than the current question, it is undetermined, naming both. Lines are of
 //! edk2-stable202608.
 //!
 //! | Operation | UEFI 2.11 | edk2 | Here |
@@ -29,7 +32,13 @@
 //! | Two DATEs, TIMEs or buffers compared | UNDEFINED, as no strings, Booleans or unsigned integers (§33.2.5.7.4, §33.3.8.3.18) | by their bytes, then the longer greater (IsTypeInBuffer, Expression.c:985-1000, :2295-2319) | edk2 |
 //! | The right operand of MULTIPLY, DIVIDE and MODULO | 64 bits (§33.3.8.3.43, §33.3.8.3.15, §33.3.8.3.42) | its low 32 bits (Expression.c:3398-3406) | edk2 |
 //! | EQ_ID_VAL_LIST | the question's value in the list (§33.3.8.3.20) | its low 16 bits (Expression.c:2716) | edk2 |
-//! | An UNDEFINED that a CONDITIONAL drops | a value, which the CONDITIONAL drops, pushing the other one (§33.2.5.7.4, §33.3.8.3.10) | the end of the expression, whose result it is (Expression.c:3713-3715) | undetermined, but where both have one effect: a condition FALSE, a READ the stored value's value (no value only where the whole expression diverges), a match expression no match, an EFI_IFR_VALUE no UINT64, a WRITE the same SETs, where the spec goes on to the end with no SET, op not evaluated or malformed op past edk2's end, or that of an expression of a MAP in it; a return expression of a MAP that gives a value ends the expression at the MAP, which the spec's value goes on in |
+//! | An UNDEFINED that a CONDITIONAL drops | a value, which the CONDITIONAL drops, pushing the other one (§33.2.5.7.4, §33.3.8.3.10) | the end of the expression, whose result it is (Expression.c:3713-3715) | undetermined, but where both have one effect: a condition FALSE, a READ the stored value's value (no value only where the whole expression diverges), a match expression no match, an EFI_IFR_VALUE no UINT64, a WRITE the same SETs, where the spec goes on to the end with no SET, op not evaluated or malformed op past edk2's end, or that of an expression of a MAP or rule in it; a return expression of a MAP, or the expression of a rule, that gives a value ends the expression at the MAP or RULE_REF, which the spec's value goes on in |
+//! | QUESTION_REF3 with the Guid of another FormSet and DevicePath 0 | the question of that FormSet (§33.3.8.3.57) | that of the current FormSet (Expression.c:2924-2934) | undetermined |
+//! | QUESTION_REF3 without a Guid and DevicePath 0, in a FormSet that its package list does not start with | the question of the current FormSet (§33.3.8.3.57) | that of the package list's first FormSet (Expression.c:2917-2923, Setup.c:6075) | undetermined |
+//! | QUESTION_REF3 without a Guid and DevicePath 0, in the WRITE of the question that it takes | the question of the current FormSet (§33.3.8.3.57), whose value is THIS in its WRITE (§33.3.8.3.94) | the question's value retrieved anew, before the WRITE writes it (Expression.c:2561-2567, Setup.c:1995-1998) | undetermined |
+//! | Two RULEs of one RuleId in a form, which a RULE_REF refers to | none: the form is invalid (§33.3.8.3.63) | the first's (Expression.c RuleIdToExpression :907-916) | undetermined |
+//! | THIS in a rule | the current question's value (§33.3.8.3.77), that of the expression that holds the outermost RULE_REF, as rules are sub-expressions of the form's expressions (§33.2.5.7.3) | that of the innermost statement whose scope holds the THIS op, which IfrParse.c ParseOpCodes binds as it parses the rule, which fails where it has no QuestionId (Expression.c:808-813, :2733-2738); an ASSERT where none holds it (IfrParse.c:1461-1466) | not evaluated where no statement holds it; else undetermined, but where both take one question |
+//! | A RULE_REF in a SUPPRESS_IF around FORMs, which no FORM holds | UNDEFINED: rules are of the expressions within a form's scope (§33.2.5.7.3, §33.3.8.3.64) | the RULE of that RuleId of each FORM, whose SuppressExpression the SUPPRESS_IF is, evaluated with that FORM (IfrParse.c:2592, :1758-1774; Presentation.c:1522-1523, :2511-2512) | undetermined where the FORM has such a RULE |
 //! | A zero divisor; a shift of 64 bits or more | UNDEFINED, as DIVIDE and MODULO push (§33.3.8.3.15, §33.3.8.3.42); no limit (§33.3.8.3.67, §33.3.8.3.68) | an ASSERT (MdePkg/Library/BaseLib/DivU64x32.c:34, DivU64x32Remainder.c:38, LShiftU64.c:33, RShiftU64.c:33) | not evaluated |
 //! | A SET after an UNDEFINED | EFI_IFR_SET (§33.3.8.3.66) stores its value and pushes TRUE or FALSE | never reached, as the expression ends at the UNDEFINED (Expression.c:3713-3715) | edk2: no SET planned |
 
@@ -45,7 +54,9 @@ use binrw::io::Cursor;
 use log::warn;
 use thiserror::Error;
 
-use super::ami_access_level::AMI_ACCESS_LEVEL;
+use super::assumed_var_store::statements_of;
+use super::assumed_var_store::CheckedVarStores;
+use super::assumed_var_store::StoreStatements;
 use super::date_time::widened_date;
 use super::date_time::widened_time;
 use super::date_time::DateTimeKind;
@@ -54,6 +65,7 @@ use super::declared_var_store;
 use super::defaults::is_parent_statement;
 use super::defaults::question_scope;
 use super::find_corresponding_varstore;
+use super::list_creations;
 use super::named_records;
 use super::question_values::value_question;
 use super::question_values::ListedQuestion;
@@ -61,8 +73,9 @@ use super::question_values::OptionMatch;
 use super::question_values::PromptMatch;
 use super::question_values::ValueQuestion;
 use super::storage::read_current_value_bytes;
-use super::storage::read_question_value;
+use super::storage::read_stated_question_value;
 use super::storage::read_stored_bytes;
+use super::storage::stated_ranges;
 use super::storage::stored_value;
 use super::storage::RetrievedValue;
 use super::storage::ShortVarStoreEfi;
@@ -79,12 +92,13 @@ use super::time_storage::FieldChange;
 use super::time_storage::TimeStorage;
 use super::time_storage::TimeStorageUnread;
 use super::walk_scopes;
-use super::AccessLevel;
+use super::Creation;
 use super::DeclaredStore;
 use super::EfivarReader;
 use super::IFROpCode;
 use super::IFROperation;
 use super::IgnoredIfr;
+use super::PackageListFirst;
 use super::ParsedOperation;
 use super::QuestionFlags;
 use super::QuestionHeader;
@@ -99,6 +113,7 @@ use super::EFI_IFR_TYPE_NUM_SIZE_8;
 use super::EFI_IFR_TYPE_REF;
 use super::EFI_IFR_TYPE_STRING;
 use super::EFI_IFR_TYPE_TIME;
+use crate::hii::package::Guid;
 use crate::hii::variables::UnreadVariables;
 use crate::hii::variables::VariableInterface;
 use crate::hii::variables::VariableLayout;
@@ -116,6 +131,12 @@ const EFI_IFR_MATCH2_OP: u8 = 0x64;
 /// DXE (edk2-stable202608 MdeModulePkg/Core/DxeIplPeim/DxeIpl.h STACK_SIZE) holds 8 of them.
 pub(super) const MAX_READ_DEPTH: usize = 8;
 
+/// The rules that RULE_REFs start in one expression at most: each evaluates its rule anew, so
+/// rules that each refer twice to the one before double the work per rule. Each READ that an
+/// expression retrieves a value through is an expression of its own, up to MAX_READ_DEPTH deep,
+/// so one chain of them starts at most (MAX_READ_DEPTH + 1) × MAX_RULE_EVALUATIONS.
+const MAX_RULE_EVALUATIONS: usize = 4096;
+
 /// What its conditions leave of a question in the setup browser, lowest priority first, as
 /// edk2-stable202608 SetupBrowserDxe/Expression.c EvaluateExpressionList ranks them:
 /// DisableIf > SuppressIf > GrayOutIf.
@@ -407,15 +428,20 @@ impl StateEvaluation {
     }
 
     /// Takes in the condition of the SUPPRESS_IF, GRAY_OUT_IF or DISABLE_IF `scope`, which gives
-    /// `state` when true, with where the values that it takes come from.
+    /// `state` when true, with where the values that it takes come from: a SUPPRESS_IF around
+    /// FORMs as the SuppressExpression of `form`, if given.
     fn evaluate(
         &mut self,
         state: QuestionState,
         scope: &IFROperation,
+        form: Option<Rc<RefCell<IFROperation>>>,
         inputs: &mut ExpressionInputs<'_, impl QuestionValues>,
     ) {
         let taken = inputs.reader.snapshot_values_taken();
-        let truth = evaluate_condition(scope, inputs);
+        let truth = match form {
+            Some(form) => evaluate_suppression_of(form, scope, inputs),
+            None => evaluate_condition(scope, inputs),
+        };
         self.add(state, truth, ValueSource::since(taken, inputs.reader));
     }
 
@@ -805,6 +831,23 @@ impl<T> Selection<T> {
         }
     }
 
+    /// The match that set would write, else the likely one, with the states that select a match
+    /// ranked before it; None for none.
+    pub(crate) fn written_or_likely(&self) -> Option<(&(T, StateEvaluation), RankedBefore)> {
+        match self {
+            Selection::Picked {
+                picked,
+                ranked_before,
+            } => Some((picked, *ranked_before)),
+            Selection::Undetermined {
+                likely,
+                ranked_before,
+                ..
+            } => Some((likely, *ranked_before)),
+            Selection::Excluded(_) | Selection::NotFound => None,
+        }
+    }
+
     /// set writes only a match that `include` certainly allows, and fails rather than guess.
     pub(crate) fn for_set(self, question: &str) -> Result<Choice<T>, SelectionError> {
         match self {
@@ -863,17 +906,106 @@ pub(crate) fn question_state(
             ValueSource::Current,
         );
     }
+    let form = enclosing_form(question);
+    let mut in_form = form.is_some();
     let mut scope = question.parent.as_ref().and_then(Weak::upgrade);
     while let Some(op) = scope {
         let op = op.borrow();
-        if let OpRole::Scope(state) = OpRole::of(op.op_code) {
-            evaluation.evaluate(state, &op, inputs);
+        match OpRole::of(op.op_code) {
+            // a DISABLE_IF outside forms, which FormSetParse takes in
+            OpRole::Scope(QuestionState::Disabled) if !in_form => {}
+            OpRole::Scope(state) => {
+                let around_forms =
+                    op.op_code == IFROpCode::SuppressIf && enclosing_form(&op).is_none();
+                evaluation.evaluate(state, &op, form.clone().filter(|_| around_forms), inputs);
+            }
+            OpRole::Question
+            | OpRole::Expression(_)
+            | OpRole::Map
+            | OpRole::RuleRef
+            | OpRole::Other => {}
         }
+        in_form &= !matches!(op.op_code, IFROpCode::Form | IFROpCode::FormMap);
         scope = op.parent.as_ref().and_then(Weak::upgrade);
     }
+    evaluation.add(
+        QuestionState::Disabled,
+        inputs.values.parse_skips(question),
+        ValueSource::Current,
+    );
     evaluation
 }
 
+/// The ops of the form-set-list of the FormSet of the last question asked about, with whether
+/// edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes parses each (list_creations):
+/// questions come FormSet by FormSet, so that a FormSet's conditions are evaluated once per run
+/// of its questions.
+#[derive(Default)]
+struct FormSetParse(RefCell<Option<FormSetCreations>>);
+
+/// list_creations of a FormSet.
+struct FormSetCreations {
+    form_set: Rc<RefCell<IFROperation>>,
+    creations: Vec<(Rc<RefCell<IFROperation>>, Creation)>,
+}
+
+impl FormSetParse {
+    /// Whether ParseOpCodes skips `question` in the scope of a DISABLE_IF outside forms, which
+    /// it evaluates once, as it parses the FormSet, and never again (UEFI 2.11 §33.2.5.2.1),
+    /// as form_set_list_ops finds: with the FORM or FORM_MAP that holds it, else alone. FALSE
+    /// outside the scope of any; not known where no FormSet holds it.
+    fn skips(&self, question: &IFROperation) -> Truth {
+        let form = enclosing_form(question);
+        let held = match &form {
+            Some(form) => in_form_set_disable_if(&form.borrow()),
+            None => in_form_set_disable_if(question),
+        };
+        if !held {
+            return Truth::Known(false);
+        }
+        let Some(form_set) = enclosing_form_set(question) else {
+            return Truth::Unknown("no FormSet holds it".to_owned());
+        };
+        let parsed: *const IFROperation = match &form {
+            Some(form) => form.as_ptr(),
+            None => question,
+        };
+        let mut cache = self.0.borrow_mut();
+        let known = match cache.take() {
+            Some(last) if Rc::ptr_eq(&last.form_set, &form_set) => cache.insert(last),
+            _ => {
+                let creations = list_creations(&form_set.borrow());
+                cache.insert(FormSetCreations {
+                    form_set,
+                    creations,
+                })
+            }
+        };
+        let creation = known
+            .creations
+            .iter()
+            .find(|(op, _)| std::ptr::eq(op.as_ptr(), parsed))
+            .map(|(_, creation)| creation);
+        match creation {
+            None => Truth::Known(true),
+            Some(Creation::Created) => Truth::Known(false),
+            Some(Creation::Undetermined(undetermined)) => Truth::Unknown(undetermined.reason()),
+        }
+    }
+}
+
+/// Whether a DISABLE_IF holds `op`, an op outside forms or a FORM or FORM_MAP.
+fn in_form_set_disable_if(op: &IFROperation) -> bool {
+    let mut scope = op.parent.as_ref().and_then(Weak::upgrade);
+    while let Some(op) = scope {
+        if op.borrow().op_code == IFROpCode::DisableIf {
+            return true;
+        }
+        scope = op.borrow().parent.as_ref().and_then(Weak::upgrade);
+    }
+    false
+}
+
 /// Why set refuses to write `question`, if it does: an EFI_IFR_VALUE gives its value
 /// (question_value_expression), else EFI_IFR_FLAG_READ_ONLY.
 fn read_only(question: &IFROperation) -> Option<ReadOnlyCause> {
@@ -930,13 +1062,14 @@ pub(crate) fn option_state(
         match OpRole::of(op.op_code) {
             OpRole::Question => break,
             OpRole::Scope(state @ QuestionState::Suppressed) => {
-                evaluation.evaluate(state, &op, inputs);
+                evaluation.evaluate(state, &op, None, inputs);
             }
             OpRole::Scope(
                 QuestionState::Selectable | QuestionState::GrayedOut | QuestionState::Disabled,
             )
             | OpRole::Expression(_)
             | OpRole::Map
+            | OpRole::RuleRef
             | OpRole::Other => {}
         }
         scope = op.parent.as_ref().and_then(Weak::upgrade);
@@ -957,14 +1090,13 @@ struct IndexedQuestion {
 }
 
 impl QuestionIndex {
-    // TODO: leave out the questions under a true DISABLE_IF outside forms, which
-    // edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes does not parse, so that a
-    // reference to one gives UNDEFINED.
+    /// Leaves out the questions that edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes
+    /// does not parse (skips_questions), so that a reference to one gives UNDEFINED.
     pub(crate) fn new(root: &Rc<RefCell<IFROperation>>) -> Self {
         let mut index: BTreeMap<u16, Vec<IndexedQuestion>> = BTreeMap::new();
         walk_scopes(std::slice::from_ref(root), None, |node, form| {
             let op = node.borrow();
-            if skips_scope(&op) {
+            if skips_questions(&op) {
                 return Walk::Skip;
             }
             // reserved (UEFI 2.10 §33.3.8.2.2)
@@ -1010,6 +1142,17 @@ pub(super) fn skips_scope(op: &IFROperation) -> bool {
         && matches!(op.op_code, IFROpCode::Unknown(code) if code > EFI_IFR_MATCH2_OP)
 }
 
+/// Whether edk2 skips `op` with its scope, and so every question in it: skips_scope, or a
+/// DISABLE_IF outside forms whose condition is TRUE, which edk2-stable202608
+/// SetupBrowserDxe/IfrParse.c ParseOpCodes evaluates as it parses the FormSet (:1690-1704,
+/// :3045-3059) and skips to its END (:1390-1413).
+pub(super) fn skips_questions(op: &IFROperation) -> bool {
+    skips_scope(op)
+        || (op.op_code == IFROpCode::DisableIf
+            && enclosing_form(op).is_none()
+            && constant_condition(op) == Truth::Known(true))
+}
+
 /// Returns the FORM or FORM_MAP that holds `op`.
 fn enclosing_form(op: &IFROperation) -> Option<Rc<RefCell<IFROperation>>> {
     let mut parent = op.parent.as_ref().and_then(Weak::upgrade);
@@ -1034,6 +1177,25 @@ pub(super) fn enclosing_form_set(op: &IFROperation) -> Option<Rc<RefCell<IFROper
     None
 }
 
+/// Returns the QuestionId that edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes gives
+/// THIS `op` (:1461-1466), with the opcode of the statement it takes it from: that of
+/// ParentStatement, the innermost statement whose scope holds `op` (IsStatementOpCode
+/// :1154-1176; :3082-3090), 0 for a SUBTITLE, TEXT, RESET_BUTTON or GUID op, which
+/// CreateStatement gives no QuestionId (:1960-1990, :2932-2933), but for the GUID op of an EDKII
+/// bit varstore field, whose Scope ParseOpCodes clears (:2934-2937); None where no statement
+/// holds it.
+fn this_binding(op: &IFROperation) -> Option<(u16, IFROpCode)> {
+    let mut parent = op.parent.as_ref().and_then(Weak::upgrade);
+    while let Some(op) = parent {
+        let statement = op.borrow();
+        if is_parent_statement(&statement) {
+            return Some((question_id(&statement).unwrap_or(0), statement.op_code));
+        }
+        parent = statement.parent.as_ref().and_then(Weak::upgrade);
+    }
+    None
+}
+
 /// Returns the QuestionId of the question that holds `op` in its scope.
 fn enclosing_question_id(op: &IFROperation) -> Option<u16> {
     let mut parent = op.parent.as_ref().and_then(Weak::upgrade);
@@ -1072,28 +1234,30 @@ pub(super) fn is_question(op_code: IFROpCode) -> bool {
 
 /// Reads the values of the questions that conditions refer to from their VarStores, as get
 /// does.
-pub(crate) struct VarStoreValues {
+pub(crate) struct VarStoreValues<'a> {
     index: QuestionIndex,
-    /// What conditions read from AMI_ACCESS_LEVEL instead of its value, if stated
-    access_level: Option<AccessLevel>,
+    /// The VarStore bytes that conditions read in place of those their variables hold
+    assumed: CheckedVarStores<'a>,
     /// The questions whose values are being retrieved, innermost last: a READ expression that
     /// refers to one of them needs the value that it is to give
     retrieving: RefCell<Vec<Rc<RefCell<IFROperation>>>>,
+    parse: FormSetParse,
 }
 
-impl VarStoreValues {
-    /// Finds the questions in the FormSet of `root`, reading `access_level`, if stated, for
-    /// AMI_ACCESS_LEVEL instead of its value.
-    pub(crate) fn new(root: &Rc<RefCell<IFROperation>>, access_level: Option<AccessLevel>) -> Self {
+impl<'a> VarStoreValues<'a> {
+    /// Finds the questions in the FormSet of `root`, reading the bytes that `assumed` states in
+    /// place of those their variables hold.
+    pub(crate) fn new(root: &Rc<RefCell<IFROperation>>, assumed: CheckedVarStores<'a>) -> Self {
         VarStoreValues {
             index: QuestionIndex::new(root),
-            access_level,
+            assumed,
             retrieving: RefCell::default(),
+            parse: FormSetParse::default(),
         }
     }
 }
 
-impl QuestionValues for VarStoreValues {
+impl QuestionValues for VarStoreValues<'_> {
     fn value(
         &self,
         referrer: &IFROperation,
@@ -1108,6 +1272,18 @@ impl QuestionValues for VarStoreValues {
                 reason: ValueUnavailable::NotDecoded(op.op_code).to_answer(),
             });
         };
+        // IdToQuestion finds no question where ParseOpCodes skips it, and EQ_ID_VAL gives
+        // UNDEFINED (Expression.c:2659-2663); ParseOpCodes parses it with the referrer if both
+        // are in one form
+        let same_form = enclosing_form(referrer)
+            .zip(enclosing_form(&op))
+            .is_some_and(|(a, b)| Rc::ptr_eq(&a, &b));
+        if let (Truth::Unknown(reason), false) = (self.parse_skips(&op), same_form) {
+            return Some(QuestionValue::Unreadable {
+                kind: value_kind(value_question),
+                reason: format!("edk2 may not parse it: {reason}"),
+            });
+        }
         if self.retrieving.borrow().len() >= MAX_READ_DEPTH {
             return Some(QuestionValue::Unreadable {
                 kind: value_kind(value_question),
@@ -1132,7 +1308,7 @@ impl QuestionValues for VarStoreValues {
             question,
             value_question,
             &varstore,
-            self.access_level,
+            self.assumed,
             &mut ExpressionInputs {
                 reader,
                 values: self,
@@ -1141,6 +1317,14 @@ impl QuestionValues for VarStoreValues {
         self.retrieving.borrow_mut().pop();
         Some(value)
     }
+
+    fn parse_skips(&self, question: &IFROperation) -> Truth {
+        self.parse.skips(question)
+    }
+
+    fn assumed(&self) -> CheckedVarStores<'_> {
+        self.assumed
+    }
 }
 
 /// The EFI_HII_VALUE type of `value_question`'s value.
@@ -1162,11 +1346,24 @@ fn value_kind(value_question: ValueQuestion) -> ValueKind {
 /// question without a VarStore has none then. A question with an EFI_IFR_VALUE has the value of
 /// its expression instead, which GetQuestionValue takes before any READ or storage. The value of
 /// an EFI_IFR_VALUE or READ expression comes from the snapshot if THIS or a value that the
-/// expression took does.
+/// expression took does. Stated VarStore bytes never reach THIS: conditions read them
+/// (retrieve_stated_question_value), writes do not; an EFI_IFR_VALUE or READ expression reads
+/// those of the questions it refers to through `inputs`, as conditions do.
 pub(super) fn retrieve_question_value(
     question: &Rc<RefCell<IFROperation>>,
     varstore: &Result<Box<dyn VariableStore>>,
     inputs: &mut ExpressionInputs<'_, impl QuestionValues>,
+) -> std::result::Result<RetrievedValue, ValueUnavailable> {
+    retrieve_stated_question_value(question, varstore, &StoreStatements::default(), inputs)
+}
+
+/// retrieve_question_value, with the bytes of `stated`, statements of `varstore`, as its payload
+/// in place of those its variable holds (read_stated_question_value).
+fn retrieve_stated_question_value(
+    question: &Rc<RefCell<IFROperation>>,
+    varstore: &Result<Box<dyn VariableStore>>,
+    stated: &StoreStatements<'_>,
+    inputs: &mut ExpressionInputs<'_, impl QuestionValues>,
 ) -> std::result::Result<RetrievedValue, ValueUnavailable> {
     let op = question.borrow();
     let Some(value_question) = value_question(&op) else {
@@ -1186,7 +1383,7 @@ pub(super) fn retrieve_question_value(
             })
             .map_err(ValueUnavailable::ValueExpression);
     }
-    let stored = read_question_value(&op, varstore, inputs.reader);
+    let stored = read_stated_question_value(&op, varstore, stated, inputs.reader);
     let storageless = varstore
         .as_ref()
         .err()
@@ -1228,38 +1425,53 @@ pub(super) fn retrieve_question_value(
 
 /// Returns the value of `question`, which is `value_question`, as retrieve_question_value
 /// retrieves it from `varstore`, typed as edk2-stable202608 SetupBrowserDxe/IfrParse.c
-/// ParseOpCodes types it: on AMI_ACCESS_LEVEL, `access_level` instead, if stated.
+/// ParseOpCodes types it, with the bytes that `assumed` states for `varstore` as its payload.
 fn question_value(
     question: &Rc<RefCell<IFROperation>>,
     value_question: ValueQuestion,
     varstore: &Result<Box<dyn VariableStore>>,
-    access_level: Option<AccessLevel>,
+    assumed: CheckedVarStores<'_>,
     inputs: &mut ExpressionInputs<'_, impl QuestionValues>,
 ) -> QuestionValue {
     let kind = value_kind(value_question);
-    // the level is the one byte of SystemAccess that AMI IFR reads
-    let on_access_level = value_question.location()
-        == (ValueLocation::Bytes { offset: 0, size: 1 })
-        && matches!(varstore, Ok(store) if AMI_ACCESS_LEVEL.identifies(store.as_ref()));
-    let value = match (on_access_level, access_level) {
-        // AMI IFR also compares the level with 85, of unknown meaning, in a SUPPRESS_IF NOT
-        // around a REF, which either stated level suppresses
-        (true, Some(level)) => Ok(u64::from(u8::from(level))),
-        (true, None) | (false, Some(_) | None) => {
-            retrieve_question_value(question, varstore, inputs).map(|retrieved| retrieved.value)
-        }
+    let stated = match varstore {
+        Ok(store) => statements_of(assumed, store.as_ref()),
+        Err(_) => StoreStatements::default(),
     };
+    let value = retrieve_stated_question_value(question, varstore, &stated, inputs)
+        .map(|retrieved| retrieved.value);
     let reason = match value.and_then(|value| typed_value(value_question, value)) {
         Ok(value) => return value,
         Err(reason) => reason,
     };
-    let reason = match on_access_level {
-        true => ValueUnavailable::AmiAccessLevel(Box::new(reason)),
-        false => reason,
-    };
     QuestionValue::Unreadable {
         kind,
-        reason: reason.to_answer(),
+        reason: unstated(reason, varstore, value_question.location()).to_answer(),
+    }
+}
+
+/// `reason`, why a condition reads no value at `location` of `varstore`, with the bytes that
+/// --assume-var-store would state there where the store's variable is why (stateable_bytes); a
+/// store whose variable holds one value takes no statement (statements_of).
+fn unstated(
+    reason: ValueUnavailable,
+    varstore: &Result<Box<dyn VariableStore>>,
+    location: ValueLocation,
+) -> ValueUnavailable {
+    let Ok(store) = varstore else {
+        return reason;
+    };
+    match store.layout() {
+        VariableLayout::Offsets => {}
+        VariableLayout::OneValue => return reason,
+    }
+    match reason.stateable_bytes(location) {
+        Some(bytes) => ValueUnavailable::Unstated {
+            reason: Box::new(reason),
+            key: store.variable_key(),
+            bytes,
+        },
+        None => reason,
     }
 }
 
@@ -1327,7 +1539,7 @@ pub(crate) enum QuestionValue {
     },
 }
 
-/// Finds the values of the questions that conditions refer to.
+/// Finds the values of the questions that conditions refer to, and whether edk2 parses them.
 pub(crate) trait QuestionValues {
     /// Returns the value of question `id` as `referrer` sees it, read through `reader`, or None
     /// if no question has `id`.
@@ -1337,6 +1549,18 @@ pub(crate) trait QuestionValues {
         id: u16,
         reader: &mut EfivarReader,
     ) -> Option<QuestionValue>;
+
+    /// FormSetParse::skips of `question`, which an implementation may keep from question to
+    /// question.
+    fn parse_skips(&self, question: &IFROperation) -> Truth {
+        FormSetParse::default().skips(question)
+    }
+
+    /// The VarStore bytes that a GET reads in place of those their variables hold, as `value`
+    /// reads them for the questions on them.
+    fn assumed(&self) -> CheckedVarStores<'_> {
+        CheckedVarStores::NONE
+    }
 }
 
 /// What expressions take the values of questions from: `values` finds the question that an
@@ -1350,8 +1574,29 @@ pub(crate) struct ExpressionInputs<'a, V> {
 pub(crate) fn evaluate_condition(
     scope: &IFROperation,
     inputs: &mut ExpressionInputs<'_, impl QuestionValues>,
+) -> Truth {
+    condition_truth(Evaluation::new(inputs, Role::Reads), scope)
+}
+
+/// Returns the truth of the condition of `scope`, a SUPPRESS_IF around FORMs, as the
+/// SuppressExpression of `form`, one of those FORMs, that edk2-stable202608
+/// SetupBrowserDxe/IfrParse.c ParseOpCodes makes it (:2592, :1758-1774): Presentation.c evaluates
+/// it with that FORM (:1522-1523, :2511-2512), whose RULEs its RULE_REFs take.
+fn evaluate_suppression_of(
+    form: Rc<RefCell<IFROperation>>,
+    scope: &IFROperation,
+    inputs: &mut ExpressionInputs<'_, impl QuestionValues>,
 ) -> Truth {
     let mut evaluation = Evaluation::new(inputs, Role::Reads);
+    evaluation.suppression_form = Some(form);
+    condition_truth(evaluation, scope)
+}
+
+/// Returns the truth of the condition of `scope` that `evaluation` evaluates.
+fn condition_truth(
+    mut evaluation: Evaluation<'_, impl QuestionValues>,
+    scope: &IFROperation,
+) -> Truth {
     match evaluation.run(scope) {
         Ok(operand) => match operand.is_true() {
             Some(truth) => Truth::Known(truth),
@@ -1362,7 +1607,9 @@ pub(crate) fn evaluate_condition(
         Err(Abort::Undefined) => Truth::Known(false),
         // edk2-stable202608 SetupBrowserDxe/Presentation.c EvaluateFormExpressions refuses to
         // show the form
-        Err(Abort::Malformed(reason)) => Truth::Unknown(format!("malformed condition: {reason}")),
+        Err(Abort::Malformed(reason) | Abort::RuleCycle(reason)) => {
+            Truth::Unknown(format!("malformed condition: {reason}"))
+        }
         Err(Abort::NotEvaluated(reason)) => Truth::Unknown(reason),
         Err(Abort::Diverged(divergence)) => divergence.truth(),
     }
@@ -1394,6 +1641,8 @@ pub(crate) fn constant_condition(scope: &IFROperation) -> Truth {
             | ExpressionOp::EqIdId
             | ExpressionOp::EqIdValList
             | ExpressionOp::QuestionRef1
+            | ExpressionOp::QuestionRef2
+            | ExpressionOp::QuestionRef3
             | ExpressionOp::This
             | ExpressionOp::Get
             | ExpressionOp::Set,
@@ -1447,7 +1696,9 @@ pub(crate) fn evaluate_value(
     match evaluation.run(scope).and_then(|operand| operand.as_u64()) {
         Ok(value) => value.ok_or_else(|| evaluation.into_unknown()),
         Err(Abort::Undefined) => Err(UNDEFINED_RESULT.to_string()),
-        Err(Abort::Malformed(reason)) => Err(format!("malformed expression: {reason}")),
+        Err(Abort::Malformed(reason) | Abort::RuleCycle(reason)) => {
+            Err(format!("malformed expression: {reason}"))
+        }
         Err(Abort::NotEvaluated(reason)) => Err(reason),
         Err(Abort::Diverged(divergence)) => Err(divergence.why_no_value()),
     }
@@ -1481,7 +1732,15 @@ pub(crate) fn evaluate_read(
         return ReadOutcome::NoRead;
     };
     let stored = stored_operand(&this);
-    let mut evaluation = Evaluation::new(inputs, Role::Read(this));
+    let mut evaluation = Evaluation::new(
+        inputs,
+        Role::Read {
+            // reserved (UEFI 2.11 §33.3.8.2.2): edk2-stable202608 SetupBrowserDxe/Expression.c
+            // IdToQuestion2 finds no question of it (:808-813)
+            question: question_id(&question.borrow()).filter(|&id| id != 0),
+            this,
+        },
+    );
     match evaluation.run_ops(&expression) {
         Ok(Operand::Undefined) | Err(Abort::Undefined | Abort::Malformed(_)) => ReadOutcome::Stored,
         Ok(operand) => match ExpressionValue::of(&operand) {
@@ -1493,6 +1752,11 @@ pub(crate) fn evaluate_read(
         Err(Abort::NotEvaluated(reason)) => {
             ReadOutcome::Refused(evaluation.into_refusal(QuestionExpression::Read, reason))
         }
+        // edk2 recurses without end, so it keeps no stored value either
+        Err(Abort::RuleCycle(reason)) => ReadOutcome::Refused(ExpressionRefusal::Malformed {
+            expression: QuestionExpression::Read,
+            reason,
+        }),
         Err(Abort::Diverged(divergence)) => divergence.read(stored.as_ref()),
     }
 }
@@ -1524,13 +1788,15 @@ pub(crate) fn evaluate_write(
     let mut evaluation = Evaluation::new(
         inputs,
         Role::Write {
+            // reserved, as for a READ
+            question: question_id(&question.borrow()).filter(|&id| id != 0),
             this,
             sets: &mut sets,
         },
     );
     match evaluation.run_ops(&expression) {
         Ok(_) | Err(Abort::Undefined) => {}
-        Err(Abort::Malformed(reason)) => {
+        Err(Abort::Malformed(reason) | Abort::RuleCycle(reason)) => {
             return Err(ExpressionRefusal::Malformed {
                 expression: QuestionExpression::Write,
                 reason,
@@ -1968,7 +2234,8 @@ pub(crate) enum ExpressionRefusal {
         expression: QuestionExpression,
         reason: String,
     },
-    /// A WRITE that edk2-stable202608 SetupBrowserDxe/Setup.c SetQuestionValue fails on
+    /// A WRITE that edk2-stable202608 SetupBrowserDxe/Setup.c SetQuestionValue fails on, or a
+    /// READ or WRITE with a RULE_REF within the evaluation of its own rule
     #[error("its {expression} expression is malformed: {reason}")]
     Malformed {
         expression: QuestionExpression,
@@ -2032,15 +2299,41 @@ enum Role<'a> {
     /// A condition, a default or an EFI_IFR_VALUE: THIS is the value of the question that holds
     /// it, and a SET is not evaluated
     Reads,
-    /// The READ of a question: THIS is its stored value (UEFI 2.11 §33.2.5.4.1)
-    Read(QuestionValue),
-    /// The WRITE of a question: THIS is its new value, and each SET joins `sets`
+    /// The READ of the question of QuestionId `question`: THIS is its stored value (UEFI 2.11
+    /// §33.2.5.4.1)
+    Read {
+        question: Option<u16>,
+        this: QuestionValue,
+    },
+    /// The WRITE of the question of QuestionId `question`: THIS is its new value, and each SET
+    /// joins `sets`
     Write {
+        question: Option<u16>,
         this: QuestionValue,
         sets: &'a mut PlannedSets,
     },
 }
 
+impl Role<'_> {
+    /// THIS, where question `id` is the one whose READ or WRITE is evaluated.
+    fn this_of(&self, id: u16) -> Option<&QuestionValue> {
+        match self {
+            Self::Reads => None,
+            Self::Read { question, this } | Self::Write { question, this, .. } => {
+                (*question == Some(id)).then_some(this)
+            }
+        }
+    }
+
+    /// Whether this is the WRITE of question `id`.
+    fn writes(&self, id: u16) -> bool {
+        match self {
+            Self::Write { question, .. } => *question == Some(id),
+            Self::Reads | Self::Read { .. } => false,
+        }
+    }
+}
+
 /// The kind of value that a GET reads or a SET writes.
 #[derive(Clone, Copy)]
 enum OperandKind {
@@ -2215,13 +2508,75 @@ enum Abort {
     NotEvaluated(String),
     /// edk2 and UEFI 2.11 give the expression two results
     Diverged(Box<Divergence>),
+    /// A RULE_REF within the evaluation of its own rule, where edk2-stable202608
+    /// SetupBrowserDxe/Expression.c EvaluateExpression recurses without end: malformed, also
+    /// inside a rule
+    RuleCycle(String),
+}
+
+/// Where edk2-stable202608 SetupBrowserDxe and UEFI 2.11 give an expression two results.
+#[derive(Debug, PartialEq, Eq)]
+enum Divergence {
+    Dropped(DroppedUndefined),
+    /// The two evaluate an op apart, as the text names both results; one of them is not looked
+    /// up here, so no effect is known to both
+    Op(String),
+}
+
+impl Divergence {
+    /// Names both results, with edk2's `consequence` where it ends the whole expression at an
+    /// UNDEFINED.
+    fn text(&self, consequence: &str) -> String {
+        match self {
+            Divergence::Dropped(dropped) => dropped.text(consequence),
+            Divergence::Op(text) => text.clone(),
+        }
+    }
+
+    fn truth(&self) -> Truth {
+        match self {
+            Divergence::Dropped(dropped) => dropped.truth(),
+            Divergence::Op(text) => Truth::Unknown(text.clone()),
+        }
+    }
+
+    fn why_no_value(&self) -> String {
+        match self {
+            Divergence::Dropped(dropped) => dropped.why_no_value(),
+            Divergence::Op(text) => text.clone(),
+        }
+    }
+
+    fn read(&self, stored: Option<&Operand>) -> ReadOutcome {
+        match self {
+            Divergence::Dropped(dropped) => dropped.read(stored),
+            Divergence::Op(text) => ReadOutcome::Refused(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Read,
+                reason: text.clone(),
+            }),
+        }
+    }
+
+    fn misses(&self, checked: &Operand) -> bool {
+        match self {
+            Divergence::Dropped(dropped) => dropped.misses(checked),
+            Divergence::Op(_) => false,
+        }
+    }
+
+    fn keeps_sets(&self) -> bool {
+        match self {
+            Divergence::Dropped(dropped) => dropped.keeps_sets(),
+            Divergence::Op(_) => false,
+        }
+    }
 }
 
 /// Where edk2-stable202608 SetupBrowserDxe/Expression.c EvaluateExpression ends an expression at
 /// an UNDEFINED, while UEFI 2.11 makes UNDEFINED a value that later ops take (§33.2.5.7.4), which
 /// a CONDITIONAL drops (§33.3.8.3.10), and gives another result.
 #[derive(Debug, PartialEq, Eq)]
-struct Divergence {
+struct DroppedUndefined {
     /// The op that gives the UNDEFINED
     ended: &'static str,
     /// The expression that edk2 ends there
@@ -2230,7 +2585,7 @@ struct Divergence {
     spec: SpecResult,
 }
 
-impl Divergence {
+impl DroppedUndefined {
     /// Names both results: edk2's, with its `consequence` where it ends the whole expression, and
     /// the spec's.
     fn text(&self, consequence: &str) -> String {
@@ -2244,6 +2599,10 @@ impl Divergence {
                 "a return expression of EFI_IFR_MAP",
                 ", which the MAP gives",
             ),
+            Place::Rule => (
+                "the expression of an EFI_IFR_RULE",
+                ", which the RULE_REF gives",
+            ),
         };
         format!(
             "edk2-stable202608 SetupBrowserDxe ends {place} at the UNDEFINED of {}{consequence}, \
@@ -2259,7 +2618,7 @@ impl Divergence {
             (Place::Whole, SpecResult::Value(value)) => Some(value),
             (Place::Whole, SpecResult::Unread(_) | SpecResult::Failed(_))
             | (
-                Place::Match | Place::Return,
+                Place::Match | Place::Return | Place::Rule,
                 SpecResult::Value(_) | SpecResult::Unread(_) | SpecResult::Failed(_),
             ) => None,
         }
@@ -2291,9 +2650,9 @@ impl Divergence {
     /// :1676-1700): that value where UEFI 2.11 gives the READ the same value, as
     /// retrieve_question_value takes it, or where the whole expression diverges and neither can
     /// be read, as the stored value then says why; else refused, naming both. So is a divergence
-    /// in a match or return expression of a MAP over a stored value that cannot be read: edk2
-    /// takes the next pair there (Expression.c:3664, CompareHiiValue :2338), and the spec's ops
-    /// after the MAP may drop its value.
+    /// in a match or return expression of a MAP, or in a rule, over a stored value that cannot be
+    /// read: edk2 takes the next pair there (Expression.c:3664, CompareHiiValue :2338), and the
+    /// spec's ops after the MAP or RULE_REF may drop its value.
     fn read(&self, stored: Option<&Operand>) -> ReadOutcome {
         let kept = match (self.spec_value(), stored) {
             (Some(spec), Some(stored)) => ExpressionValue::read_from(spec)
@@ -2341,7 +2700,7 @@ impl Divergence {
             (Place::Whole, SpecResult::Value(_) | SpecResult::Unread(_)) => true,
             (Place::Whole, SpecResult::Failed(_))
             | (
-                Place::Match | Place::Return,
+                Place::Match | Place::Return | Place::Rule,
                 SpecResult::Value(_) | SpecResult::Unread(_) | SpecResult::Failed(_),
             ) => false,
         }
@@ -2357,6 +2716,8 @@ enum Place {
     Match,
     /// A return expression of a MAP
     Return,
+    /// The expression of a rule
+    Rule,
 }
 
 /// What UEFI 2.11 gives where edk2 gives UNDEFINED.
@@ -2402,6 +2763,8 @@ enum OpRole {
     Expression(ExpressionOp),
     /// EFI_IFR_MAP, the expression op whose scope holds expressions that it evaluates itself
     Map,
+    /// EFI_IFR_RULE_REF, the expression op that evaluates the expression of a rule of the form
+    RuleRef,
     /// An op with an EFI_IFR_QUESTION_HEADER
     Question,
     /// A SUPPRESS_IF, GRAY_OUT_IF or DISABLE_IF, and the state its true condition gives
@@ -2416,6 +2779,8 @@ enum ExpressionOp {
     EqIdId,
     EqIdValList,
     QuestionRef1,
+    QuestionRef2,
+    QuestionRef3,
     Constant(Operand),
     Uint8,
     Uint16,
@@ -2434,6 +2799,9 @@ enum ExpressionOp {
     This,
     Get,
     Set,
+    /// The version of UEFI that the Forms Processor conforms to (UEFI 2.11 §33.3.8.3.93), from
+    /// the revision of the EFI System Table, which is not read here
+    Version,
     /// Evaluated by edk2-stable202608 SetupBrowserDxe/Expression.c EvaluateExpression but not
     /// here
     NotEvaluated,
@@ -2470,6 +2838,8 @@ impl OpRole {
             IFROpCode::EqIdId => Self::Expression(E::EqIdId),
             IFROpCode::EqIdValList => Self::Expression(E::EqIdValList),
             IFROpCode::QuestionRef1 => Self::Expression(E::QuestionRef1),
+            IFROpCode::QuestionRef2 => Self::Expression(E::QuestionRef2),
+            IFROpCode::QuestionRef3 => Self::Expression(E::QuestionRef3),
             IFROpCode::True => Self::Expression(E::Constant(Operand::Boolean(Some(1)))),
             IFROpCode::False => Self::Expression(E::Constant(Operand::Boolean(Some(0)))),
             IFROpCode::One => Self::Expression(E::Constant(Operand::Uint(Some(1)))),
@@ -2505,11 +2875,10 @@ impl OpRole {
             IFROpCode::This => Self::Expression(E::This),
             IFROpCode::Get => Self::Expression(E::Get),
             IFROpCode::Set => Self::Expression(E::Set),
+            IFROpCode::Version => Self::Expression(E::Version),
             IFROpCode::Map => Self::Map,
+            IFROpCode::RuleRef => Self::RuleRef,
             IFROpCode::Match
-            | IFROpCode::RuleRef
-            | IFROpCode::QuestionRef2
-            | IFROpCode::QuestionRef3
             | IFROpCode::ToUint
             | IFROpCode::ToString
             | IFROpCode::Mid
@@ -2522,7 +2891,6 @@ impl OpRole {
             | IFROpCode::Catenate
             | IFROpCode::ToLower
             | IFROpCode::ToUpper
-            | IFROpCode::Version
             | IFROpCode::Security
             | IFROpCode::Match2 => Self::Expression(E::NotEvaluated),
             IFROpCode::Form
@@ -2582,6 +2950,13 @@ struct Evaluation<'a, V> {
     unknown: Option<String>,
     /// The first VarStore that it cannot reach, or op that is not evaluated
     gap: Option<Gap>,
+    /// The FORM whose SuppressExpression a SUPPRESS_IF around FORMs is evaluated as, whose RULEs
+    /// edk2-stable202608 SetupBrowserDxe takes for the RULE_REFs in it, which no FORM holds
+    suppression_form: Option<Rc<RefCell<IFROperation>>>,
+    /// The rules that RULE_REFs started, up to MAX_RULE_EVALUATIONS
+    rules_started: usize,
+    /// The RULEs of the form that the last RULE_REF looked its rule up in
+    form_rules: Option<FormRules>,
 }
 
 /// The stack of an expression that an evaluation is in: the whole one, or an expression of a MAP,
@@ -2604,18 +2979,31 @@ struct Frame {
     /// expression that holds it, cannot be
     spec_unknown: Option<String>,
     /// Why the first SET, op not evaluated or malformed op fails that UEFI 2.11 reaches past where
-    /// EvaluateExpression ends it, or an expression of a MAP in it, and that aborted() skips as no
-    /// CONDITIONAL there may drop that UNDEFINED: where this expression diverges, the spec's
-    /// result fails there
+    /// EvaluateExpression ends it, or an expression of a MAP or rule in it, and that aborted()
+    /// skips as no CONDITIONAL there may drop that UNDEFINED: where this expression diverges, the
+    /// spec's result fails there
     skipped: Option<String>,
+    /// The outermost RULE_REF whose rule it is of, or within: UEFI 2.11 takes THIS in the rule
+    /// as of the question of that RULE_REF's expression
+    in_rule: Option<Rc<RefCell<IFROperation>>>,
+    /// Whether a match expression of a MAP holds it, within the innermost rule that holds it:
+    /// edk2-stable202608 SetupBrowserDxe/Expression.c fails a MAP whose match expression fails
+    /// (:3656-3658), where an UNDEFINED one takes the next pair
+    in_match: bool,
 }
 
 impl Frame {
-    /// The frame of the expression of a MAP at `place` in the expression of `outer`.
+    /// The frame of the expression of a MAP or rule at `place` in the expression of `outer`.
     fn nested(outer: &Frame, place: Place) -> Self {
         Frame {
             place,
             within_ended: outer.past_end(),
+            in_rule: outer.in_rule.clone(),
+            in_match: match place {
+                Place::Match => true,
+                Place::Return => outer.in_match,
+                Place::Whole | Place::Rule => false,
+            },
             ..Frame::default()
         }
     }
@@ -2635,6 +3023,9 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
             frame: Frame::default(),
             unknown: None,
             gap: None,
+            suppression_form: None,
+            rules_started: 0,
+            form_rules: None,
         }
     }
 
@@ -2666,6 +3057,9 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
                 Pending::Op(op) => self.visit(&op, &mut pending),
                 Pending::Match(progress) => self.matched(progress, &mut pending),
                 Pending::Return { map, outer } => self.returned(&map, outer),
+                Pending::Rule {
+                    rule_ref, outer, ..
+                } => self.rule_returned(&rule_ref, outer),
             };
             if let Err(abort) = done {
                 self.aborted(abort, &mut pending)?;
@@ -2677,8 +3071,9 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
     /// Takes `abort` of the op that the evaluation is at. Past where edk2-stable202608
     /// SetupBrowserDxe/Expression.c EvaluateExpression ends an expression at an UNDEFINED, it
     /// ends what UEFI 2.11 gives there: where no CONDITIONAL drops that UNDEFINED, before or in
-    /// the ops left, the expression gives it, as in edk2; else the results diverge. Elsewhere the
-    /// abort ends the evaluation.
+    /// the ops left, the expression gives it, as in edk2; else the results diverge. Inside a
+    /// rule, a malformed expression gives UNDEFINED in both readings (edk2 Expression.c:2952-2956).
+    /// Elsewhere the abort ends the evaluation.
     fn aborted(&mut self, abort: Abort, pending: &mut Vec<Pending>) -> Result<(), Abort> {
         if matches!(abort, Abort::Undefined | Abort::Diverged(_)) {
             return Err(abort);
@@ -2687,12 +3082,21 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
         let ended = loop {
             match (self.frame.ended, self.frame.within_ended) {
                 (Some(ended), false) => break ended,
-                (None, false) => return Err(abort),
+                (None, false) => return self.reached_failure(abort, pending),
                 (_, true) => match pending.pop() {
                     None => return Err(abort),
                     Some(Pending::Op(_)) => {}
                     Some(Pending::Match(progress)) => self.frame = progress.outer,
                     Some(Pending::Return { outer, .. }) => self.frame = outer,
+                    Some(Pending::Rule {
+                        rule_ref, outer, ..
+                    }) => {
+                        self.frame = outer;
+                        if let Abort::Malformed(_) = abort {
+                            self.push_undefined(&rule_ref.borrow());
+                            return Ok(());
+                        }
+                    }
                 },
             }
         };
@@ -2702,24 +3106,66 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
             pending.pop();
         }
         match (abort, droppable) {
-            (Abort::NotEvaluated(reason) | Abort::Malformed(reason), false) => {
-                self.frame.skipped.get_or_insert(reason);
+            (Abort::Malformed(_), _) if self.frame.place == Place::Rule => {
                 self.frame.stack = vec![Operand::Undefined];
                 Ok(())
             }
-            (Abort::NotEvaluated(reason) | Abort::Malformed(reason), true) => {
-                Err(self.diverged(ended, SpecResult::Failed(reason)))
+            (
+                Abort::NotEvaluated(reason) | Abort::Malformed(reason) | Abort::RuleCycle(reason),
+                false,
+            ) => {
+                self.frame.skipped.get_or_insert(reason);
+                self.frame.stack = vec![Operand::Undefined];
+                Ok(())
             }
+            (
+                Abort::NotEvaluated(reason) | Abort::Malformed(reason) | Abort::RuleCycle(reason),
+                true,
+            ) => Err(self.diverged(ended, SpecResult::Failed(reason))),
             (abort, _) => Err(abort),
         }
     }
 
+    /// Takes `abort` of an op that edk2-stable202608 SetupBrowserDxe/Expression.c
+    /// EvaluateExpression reaches: inside a rule, a malformed expression ends the rule, whose
+    /// RULE_REF gives UNDEFINED (:2952-2956), with the first op skipped in the frames it leaves;
+    /// else the abort ends the evaluation.
+    fn reached_failure(&mut self, abort: Abort, pending: &mut Vec<Pending>) -> Result<(), Abort> {
+        if let Abort::Malformed(_) = abort {
+            let mut skipped = self.frame.skipped.take();
+            while let Some(next) = pending.pop() {
+                match next {
+                    Pending::Op(_) => {}
+                    Pending::Match(progress) => skipped = progress.outer.skipped.or(skipped),
+                    Pending::Return { outer, .. } => skipped = outer.skipped.or(skipped),
+                    Pending::Rule {
+                        rule_ref, outer, ..
+                    } => {
+                        self.frame = outer;
+                        if let Some(reason) = skipped {
+                            self.frame.skipped.get_or_insert(reason);
+                        }
+                        self.push_undefined(&rule_ref.borrow());
+                        return Ok(());
+                    }
+                }
+            }
+        }
+        Err(abort)
+    }
+
     /// The value that the expression of the frame leaves: its one value; where edk2-stable202608
     /// SetupBrowserDxe/Expression.c EvaluateExpression ended it, that UNDEFINED, if UEFI 2.11
     /// gives UNDEFINED too, or leaves more values and no CONDITIONAL dropped an UNDEFINED; else
     /// the results diverge.
     fn frame_value(&mut self) -> Result<Operand, Abort> {
         let value = self.sole_value();
+        self.resolved(value)
+    }
+
+    /// The value that the expression of the frame leaves, as frame_value takes it, where it leaves
+    /// `value` alone.
+    fn resolved(&mut self, value: Result<Operand, Abort>) -> Result<Operand, Abort> {
         let (Some(ended), false) = (self.frame.ended, self.frame.within_ended) else {
             return value;
         };
@@ -2753,11 +3199,11 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
             Some(reason) => SpecResult::Failed(reason),
             None => spec,
         };
-        Abort::Diverged(Box::new(Divergence {
+        Abort::Diverged(Box::new(Divergence::Dropped(DroppedUndefined {
             ended,
             place: self.frame.place,
             spec,
-        }))
+        })))
     }
 
     /// Pops the one value that the stack holds, as an expression leaves it.
@@ -2793,6 +3239,10 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
             };
             return self.next_pair(progress, pending);
         }
+        if let OpRole::RuleRef = OpRole::of(borrowed.op_code) {
+            drop(borrowed);
+            return self.rule_ref(op, pending);
+        }
         match self.step(&borrowed) {
             Ok(value) => self.push(&borrowed, value)?,
             Err(Abort::Undefined) => self.push_undefined(&borrowed),
@@ -2902,22 +3352,34 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
     }
 
     /// Takes the value of the return expression of `map` as the MAP's, in `outer`, the frame of
-    /// the MAP; one that cannot be read carries why, if noted past the end, to `outer`. An op
-    /// skipped past the end goes there too, whatever the value, as from a match expression.
+    /// the MAP.
     fn returned(&mut self, map: &Rc<RefCell<IFROperation>>, outer: Frame) -> Result<(), Abort> {
         let value = self.frame_value();
-        let returned = std::mem::replace(&mut self.frame, outer);
-        if let Some(reason) = returned.skipped {
+        self.leave_frame(&map.borrow(), value, outer)
+    }
+
+    /// Pushes `value`, which the frame that the evaluation is in gives `op`, on `outer`, the frame
+    /// of `op`, as diverged_return takes a divergence; one that cannot be read carries why, if
+    /// noted past the end, to `outer`. An op skipped past the end goes there too, whatever the
+    /// value, as from a match expression.
+    fn leave_frame(
+        &mut self,
+        op: &IFROperation,
+        value: Result<Operand, Abort>,
+        outer: Frame,
+    ) -> Result<(), Abort> {
+        let left = std::mem::replace(&mut self.frame, outer);
+        if let Some(reason) = left.skipped {
             self.frame.skipped.get_or_insert(reason);
         }
         let value = match value {
-            Err(Abort::Diverged(divergence)) => self.diverged_return(&map.borrow(), *divergence),
+            Err(Abort::Diverged(divergence)) => self.diverged_return(op, *divergence),
             value => value,
         };
         match value? {
-            Operand::Undefined => self.push_undefined(&map.borrow()),
+            Operand::Undefined => self.push_undefined(op),
             value => {
-                if let (None, Some(reason)) = (value.shown(), returned.spec_unknown) {
+                if let (None, Some(reason)) = (value.shown(), left.spec_unknown) {
                     self.frame.spec_unknown.get_or_insert(reason);
                 }
                 self.frame.stack.push(value);
@@ -2926,27 +3388,153 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
         Ok(())
     }
 
-    /// The value of the return expression of `map` that diverged, where UEFI 2.11 gives one that
-    /// can be read: edk2 gives the MAP's UNDEFINED, which ends the MAP's expression
-    /// (Expression.c:3713-3715), so that expression ends there, marked dropped, and takes the
-    /// spec's value, which its ops after the MAP may drop; else the divergence.
+    /// The value of the return expression of MAP `op`, or of the expression of the rule of RULE_REF
+    /// `op`, that diverged, where UEFI 2.11 gives one that can be read: edk2 gives `op` UNDEFINED
+    /// (for RULE_REF, Expression.c:2952-2956), which ends the expression that holds `op`
+    /// (:3713-3715), so that expression ends there, marked dropped, and takes the spec's value,
+    /// which its ops after `op` may drop; else the divergence.
     fn diverged_return(
         &mut self,
-        map: &IFROperation,
+        op: &IFROperation,
         divergence: Divergence,
     ) -> Result<Operand, Abort> {
-        let Divergence { ended, place, spec } = divergence;
-        match (place, spec) {
-            (Place::Return, SpecResult::Value(value)) => {
-                self.frame.ended.get_or_insert(map.op_code.spec_name());
+        match divergence {
+            Divergence::Dropped(DroppedUndefined {
+                place: Place::Return | Place::Rule,
+                spec: SpecResult::Value(value),
+                ..
+            }) => {
+                self.frame.ended.get_or_insert(op.op_code.spec_name());
                 self.frame.dropped = true;
                 Ok(value)
             }
-            (
-                Place::Whole | Place::Match | Place::Return,
-                spec @ (SpecResult::Value(_) | SpecResult::Unread(_) | SpecResult::Failed(_)),
-            ) => Err(Abort::Diverged(Box::new(Divergence { ended, place, spec }))),
+            divergence @ (Divergence::Dropped(DroppedUndefined {
+                place: Place::Whole | Place::Match | Place::Return | Place::Rule,
+                spec: SpecResult::Value(_) | SpecResult::Unread(_) | SpecResult::Failed(_),
+                ..
+            })
+            | Divergence::Op(_)) => Err(Abort::Diverged(Box::new(divergence))),
+        }
+    }
+
+    /// Starts the expression of the rule that RULE_REF `op` refers to, of the FORM or FORM_MAP
+    /// that holds it, on a stack of its own, as edk2-stable202608 SetupBrowserDxe/Expression.c
+    /// EvaluateExpression evaluates it (:2939-2959), then the ops in the RULE_REF's scope; without
+    /// the rule, the RULE_REF gives UNDEFINED, as UEFI 2.11 §33.3.8.3.64 says. Past
+    /// MAX_RULE_EVALUATIONS rules, it is not evaluated.
+    fn rule_ref(
+        &mut self,
+        op: &Rc<RefCell<IFROperation>>,
+        pending: &mut Vec<Pending>,
+    ) -> Result<(), Abort> {
+        let borrowed = op.borrow();
+        let name = borrowed.op_code.spec_name();
+        let &rule_id = borrowed
+            .data
+            .first()
+            .ok_or_else(|| not_decoded(&borrowed))?;
+        let rules = match (enclosing_form(&borrowed), &self.suppression_form) {
+            (Some(form), _) => FormRules::of(&mut self.form_rules, &form, rule_id),
+            (None, Some(form)) => {
+                if !FormRules::of(&mut self.form_rules, form, rule_id).is_empty() {
+                    let form = form.borrow();
+                    let text = format!(
+                        "{name} of RuleId {rule_id} in a SUPPRESS_IF around FORMs: \
+                         edk2-stable202608 SetupBrowserDxe/Presentation.c evaluates it as the \
+                         SuppressExpression of {} {}, with that FORM (:1522-1523, :2511-2512), \
+                         whose RULE of that RuleId Expression.c RuleIdToExpression takes \
+                         (:895-919), while UEFI 2.11 keeps rules to the expressions within a \
+                         form's scope (§33.2.5.7.3) and pushes UNDEFINED without the rule \
+                         (§33.3.8.3.64)",
+                        form.op_code.spec_name(),
+                        form.data.first_chunk().map_or(
+                            "with no FormId".to_string(),
+                            |&id| format!("{:#06x}", u16::from_le_bytes(id))
+                        ),
+                    );
+                    return Err(match self.frame.past_end() {
+                        false => Abort::Diverged(Box::new(Divergence::Op(text))),
+                        true => Abort::NotEvaluated(text),
+                    });
+                }
+                &[]
+            }
+            (None, None) => &[],
+        };
+        let rule = match rules {
+            [] => None,
+            [rule] => Some(Rc::clone(rule)),
+            rules @ [_, _, ..] => {
+                let text = format!(
+                    "{name} of RuleId {rule_id}, which {} EFI_IFR_RULEs of its form have: \
+                     edk2-stable202608 SetupBrowserDxe/Expression.c RuleIdToExpression takes the \
+                     first (:907-916), while UEFI 2.11 marks the form invalid (§33.3.8.3.63)",
+                    rules.len()
+                );
+                return Err(match self.frame.past_end() {
+                    false => Abort::Diverged(Box::new(Divergence::Op(text))),
+                    true => Abort::NotEvaluated(text),
+                });
+            }
+        };
+        let evaluating = |rule: &Rc<RefCell<IFROperation>>| {
+            pending.iter().any(|next| {
+                matches!(next, Pending::Rule { rule: active, .. } if Rc::ptr_eq(active, rule))
+            })
+        };
+        if rule.as_ref().is_some_and(evaluating) {
+            return Err(Abort::RuleCycle(format!(
+                "{name} of RuleId {rule_id} within the evaluation of that rule"
+            )));
         }
+        if rule.is_some() {
+            if self.rules_started == MAX_RULE_EVALUATIONS {
+                return Err(self.not_evaluated(format!(
+                    "{name} of RuleId {rule_id} past {MAX_RULE_EVALUATIONS} rules in one \
+                     expression"
+                )));
+            }
+            self.rules_started += 1;
+        }
+        pending.extend(
+            borrowed
+                .children
+                .iter()
+                .rev()
+                .map(|child| Pending::Op(Rc::clone(child))),
+        );
+        let Some(rule) = rule else {
+            self.push_undefined(&borrowed);
+            return Ok(());
+        };
+        let expression = leading_expression(&rule.borrow().children);
+        let outer = std::mem::take(&mut self.frame);
+        self.frame = Frame::nested(&outer, Place::Rule);
+        self.frame.in_rule.get_or_insert_with(|| Rc::clone(op));
+        pending.push(Pending::Rule {
+            rule_ref: Rc::clone(op),
+            rule,
+            outer,
+        });
+        pending.extend(expression.iter().rev().map(|op| Pending::Op(Rc::clone(op))));
+        Ok(())
+    }
+
+    /// Takes the value of the expression of the rule of `rule_ref` as the RULE_REF's, in `outer`,
+    /// the frame of the RULE_REF: a malformed expression gives UNDEFINED, as edk2-stable202608
+    /// SetupBrowserDxe/Expression.c gives for a rule that fails (:2952-2956), in UEFI 2.11's
+    /// reading too.
+    fn rule_returned(
+        &mut self,
+        rule_ref: &Rc<RefCell<IFROperation>>,
+        outer: Frame,
+    ) -> Result<(), Abort> {
+        let value = match self.sole_value() {
+            Err(Abort::Malformed(_)) => Ok(Operand::Undefined),
+            value => value,
+        };
+        let value = self.resolved(value);
+        self.leave_frame(&rule_ref.borrow(), value, outer)
     }
 
     /// The refusal of the READ or WRITE `expression` that this evaluated, whose evaluation ended
@@ -3097,19 +3685,18 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
                 let ParsedOperation::QuestionRef1(parsed) = &op.parsed_data else {
                     return Err(not_decoded(op));
                 };
-                // edk2-stable202608 SetupBrowserDxe/Expression.c EvaluateExpression fails,
-                // rather than gives UNDEFINED, without the question
-                self.question(op, parsed.question_id)
-                    .map_err(|abort| match abort {
-                        Abort::Undefined => Abort::Malformed(format!(
-                            "{} of missing question {:#06x}",
-                            op.op_code.spec_name(),
-                            parsed.question_id
-                        )),
-                        abort => abort,
-                    })?
-                    .decoded()
+                // in a rule, edk2-stable202608 SetupBrowserDxe/Expression.c gives the RULE_REF
+                // UNDEFINED where the rule fails as where it gives UNDEFINED (:2952-2956), and
+                // UEFI 2.11 pushes UNDEFINED without the question (§33.3.8.3.55); but not in a
+                // match expression of a MAP
+                match (&self.frame.in_rule, self.frame.in_match) {
+                    (Some(_), false) => self.question(op, parsed.question_id)?.decoded(),
+                    (Some(_), true) => self.question_in_match(op, parsed.question_id),
+                    (None, _) => self.referenced_question(op, parsed.question_id)?.decoded(),
+                }
             }
+            ExpressionOp::QuestionRef2 => self.question_ref2(op),
+            ExpressionOp::QuestionRef3 => self.question_ref3(op),
             ExpressionOp::Constant(value) => Ok(value),
             ExpressionOp::Uint8 => op
                 .data
@@ -3153,6 +3740,10 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
             ExpressionOp::This => self.this(op),
             ExpressionOp::Get => self.get(op),
             ExpressionOp::Set => self.set(op),
+            ExpressionOp::Version => Err(self.not_evaluated(format!(
+                "{} (the revision of the EFI System Table)",
+                op.op_code.spec_name()
+            ))),
             ExpressionOp::NotEvaluated => {
                 Err(self.not_evaluated(op.op_code.spec_name().to_string()))
             }
@@ -3246,24 +3837,226 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
         Ok(selected)
     }
 
-    /// Returns the value of question `id`, which `op` refers to; edk2-stable202608
-    /// SetupBrowserDxe/Expression.c EvaluateExpression gives UNDEFINED without the question.
-    fn question(&mut self, op: &IFROperation, id: u16) -> Result<QuestionOperand, Abort> {
+    /// Returns the value of the question of the id that QUESTION_REF2 `op` pops (UEFI 2.11
+    /// §33.3.8.3.56; edk2-stable202608 SetupBrowserDxe/Expression.c:3029-3053).
+    fn question_ref2(&mut self, op: &IFROperation) -> Result<Operand, Abort> {
+        let id = self.popped_question_id(op)?;
+        self.question(op, id)?.decoded()
+    }
+
+    /// Returns the value of the question of the id that QUESTION_REF3 `op` pops, from the FormSet
+    /// that its DevicePath and Guid name (UEFI 2.11 §33.3.8.3.57; edk2-stable202608
+    /// SetupBrowserDxe/Expression.c:2881-2937), as UEFI 2.11 and edk2 agree on it. Without a Guid,
+    /// the spec takes the current FormSet, edk2 the first of the package list; with the Guid of
+    /// another FormSet, the spec takes that one, edk2 the current one; without a Guid, in the
+    /// WRITE of the question of the popped id, edk2 retrieves it anew, before the write, the spec
+    /// takes THIS: where they differ, the result is undetermined, naming both, but past where
+    /// edk2 ends the expression, it is the spec's. Another FormSet is not looked up here, nor is
+    /// a DevicePath.
+    fn question_ref3(&mut self, op: &IFROperation) -> Result<Operand, Abort> {
+        let id = self.popped_question_id(op)?;
+        let name = op.op_code.spec_name();
+        // EFI_IFR_QUESTION_REF3_2 adds DevicePath, _3 then Guid (edk2 IfrParse.c:1566-1573)
+        let device_path = op
+            .data
+            .first_chunk()
+            .map_or(0, |&bytes| u16::from_le_bytes(bytes));
+        let guid = op
+            .data
+            .get(2..)
+            .and_then(<[u8]>::first_chunk)
+            .map(|&bytes| Guid::from(bytes))
+            .filter(|&guid| guid != Guid::from([0; 16]));
+        if device_path != 0 {
+            return Err(self.not_evaluated(format!(
+                "{name} with a DevicePath (a device path converted from text)"
+            )));
+        }
+        let form_set = enclosing_form_set(op)
+            .ok_or_else(|| Abort::Malformed(format!("{name} outside a FormSet")))?;
+        let (current, first) = {
+            let form_set = form_set.borrow();
+            let ParsedOperation::FormSet(parsed) = &form_set.parsed_data else {
+                return Err(not_decoded(&form_set));
+            };
+            (parsed.guid, parsed.package_list_first)
+        };
+        match (guid, first) {
+            (Some(guid), _) if guid == current => self.question(op, id)?.decoded(),
+            (Some(guid), _) if self.frame.past_end() => Err(Abort::NotEvaluated(format!(
+                "{name} of question {id:#06x} of FormSet {guid}, another FormSet"
+            ))),
+            (Some(guid), _) => {
+                let edk2 = self.reading(op, id)?;
+                Err(Abort::Diverged(Box::new(Divergence::Op(format!(
+                    "{name} of question {id:#06x} of FormSet {guid}: edk2-stable202608 \
+                     SetupBrowserDxe/Expression.c takes it from the current FormSet (:2924-2934), \
+                     which gives {edk2}, while UEFI 2.11 takes it from FormSet {guid} \
+                     (§33.3.8.3.57)"
+                )))))
+            }
+            (None, Some(PackageListFirst::Own)) if !self.role.writes(id) => self
+                .form_set_question(op, &form_set.borrow(), id)?
+                .decoded(),
+            (None, Some(PackageListFirst::Own)) if self.frame.past_end() => {
+                self.question(op, id)?.decoded()
+            }
+            (None, Some(PackageListFirst::Own)) => {
+                let edk2 = named(self.form_set_question(op, &form_set.borrow(), id))?;
+                let spec = self.reading(op, id)?;
+                Err(Abort::Diverged(Box::new(Divergence::Op(format!(
+                    "{name} of question {id:#06x} without a FormSet GUID, in the WRITE of that \
+                     question: edk2-stable202608 SetupBrowserDxe/Expression.c \
+                     GetQuestionValueFromForm retrieves it anew (:2561-2567) before Setup.c \
+                     SetQuestionValue writes it (:1995-1998), which gives {edk2}, while UEFI 2.11 \
+                     takes the question of the current FormSet (§33.3.8.3.57), whose value is THIS \
+                     in its WRITE (§33.3.8.3.94), which gives {spec}"
+                )))))
+            }
+            (None, Some(PackageListFirst::Other(_))) if self.frame.past_end() => {
+                self.question(op, id)?.decoded()
+            }
+            (None, Some(PackageListFirst::Other(first))) => {
+                let first = match first {
+                    Some(first) => format!("FormSet {first}"),
+                    None => "a FORM_SET op too short for a GUID".to_string(),
+                };
+                let spec = self.reading(op, id)?;
+                Err(Abort::Diverged(Box::new(Divergence::Op(format!(
+                    "{name} of question {id:#06x} without a FormSet GUID: edk2-stable202608 \
+                     SetupBrowserDxe/Expression.c GetQuestionValueFromForm takes it from {first}, \
+                     the first of the package list (:2917-2923; Setup.c:6075), while UEFI 2.11 \
+                     takes it from the current FormSet (§33.3.8.3.57), which gives {spec}"
+                )))))
+            }
+            (None, None) => {
+                // read_package_list marks each FORM_SET op of a package list, but for one in
+                // another's scope
+                let place = match enclosing_form_set(&form_set.borrow()) {
+                    Some(_) => "nested in another FormSet",
+                    None => "of an unknown package list",
+                };
+                Err(self.not_evaluated(format!(
+                    "{name} without a FormSet GUID in a FormSet {place}"
+                )))
+            }
+        }
+    }
+
+    /// Returns the value of question `id` of `form_set`, which `op` refers to, as
+    /// edk2-stable202608 SetupBrowserDxe/Expression.c GetQuestionValueFromForm finds it with
+    /// IdToQuestion (FormSet, NULL, ...) (:2524): in FormSet order, as `form_set`, in no form,
+    /// refers to it; UNDEFINED without the question.
+    fn form_set_question(
+        &mut self,
+        op: &IFROperation,
+        form_set: &IFROperation,
+        id: u16,
+    ) -> Result<QuestionOperand, Abort> {
         let value = self
             .values
-            .value(op, id, self.reader)
+            .value(form_set, id, self.reader)
             .ok_or(Abort::Undefined)?;
         Ok(self.operand_of(value, || {
             format!("{} of question {id:#06x}", op.op_code.spec_name())
         }))
     }
 
-    /// Returns `value` as an operand; for one that cannot be read, notes why, after `subject`.
-    fn operand_of(
-        &mut self,
-        value: QuestionValue,
-        subject: impl FnOnce() -> String,
-    ) -> QuestionOperand {
+    /// Names the value of question `id` of the current FormSet, which `op` refers to, for a
+    /// divergence: UNDEFINED without the question.
+    fn reading(&mut self, op: &IFROperation, id: u16) -> Result<String, Abort> {
+        named(self.question(op, id))
+    }
+
+    /// Pops the question id of `op`: an unsigned integer up to 0xFFFF, else UNDEFINED, as
+    /// edk2-stable202608 SetupBrowserDxe/Expression.c takes no type above
+    /// EFI_IFR_TYPE_NUM_SIZE_64 (:2894, :3041).
+    fn popped_question_id(&mut self, op: &IFROperation) -> Result<u16, Abort> {
+        match self.pop(op)? {
+            // above 0xFFFF
+            Operand::Uint(Some(value)) => {
+                u16::try_from(value).map_err(|_: std::num::TryFromIntError| Abort::Undefined)
+            }
+            Operand::Uint(None) => Err(Abort::NotEvaluated(format!(
+                "{} on a value that cannot be read",
+                op.op_code.spec_name()
+            ))),
+            Operand::Boolean(_)
+            | Operand::Date(_)
+            | Operand::Time(_)
+            | Operand::String(_)
+            | Operand::Buffer(_)
+            | Operand::Undefined => Err(Abort::Undefined),
+        }
+    }
+
+    /// Returns the value of question `id`, which `op` refers to: THIS for the question whose READ
+    /// or WRITE is evaluated, as edk2-stable202608 SetupBrowserDxe/Expression.c IdToQuestion finds
+    /// it in the form first (:853), so `op` pushes the HiiValue that THIS pushes (:2733-2741), and
+    /// UEFI 2.11 sets THIS to the question's value before a READ (§33.3.8.3.58) or a WRITE
+    /// (§33.3.8.3.94); EvaluateExpression gives UNDEFINED without the question.
+    fn question(&mut self, op: &IFROperation, id: u16) -> Result<QuestionOperand, Abort> {
+        let value = match self.role.this_of(id) {
+            Some(this) => this.clone(),
+            None => self
+                .values
+                .value(op, id, self.reader)
+                .ok_or(Abort::Undefined)?,
+        };
+        Ok(self.operand_of(value, || {
+            format!("{} of question {id:#06x}", op.op_code.spec_name())
+        }))
+    }
+
+    /// Returns question `id`, which QUESTION_REF1 or THIS `op` refers to: edk2-stable202608
+    /// SetupBrowserDxe/Expression.c EvaluateExpression fails, rather than gives UNDEFINED, without
+    /// the question (:2733-2738).
+    fn referenced_question(
+        &mut self,
+        op: &IFROperation,
+        id: u16,
+    ) -> Result<QuestionOperand, Abort> {
+        self.question(op, id).map_err(|abort| match abort {
+            Abort::Undefined => Abort::Malformed(format!(
+                "{} of missing question {id:#06x}",
+                op.op_code.spec_name()
+            )),
+            abort => abort,
+        })
+    }
+
+    /// Returns the value of question `id`, which QUESTION_REF1 `op` in a match expression of a
+    /// MAP in a rule refers to. Without the question, edk2-stable202608
+    /// SetupBrowserDxe/Expression.c fails (:2733-2738), and with it the MAP (:3656-3658) and the
+    /// rule, whose RULE_REF gives UNDEFINED (:2952-2956), while UEFI 2.11 pushes UNDEFINED without
+    /// the question (§33.3.8.3.55), and the MAP goes on to its next pair: the two readings are not
+    /// evaluated apart here, so it is undetermined, and past where edk2 ends the expression, not
+    /// evaluated.
+    fn question_in_match(&mut self, op: &IFROperation, id: u16) -> Result<Operand, Abort> {
+        match self.question(op, id) {
+            Err(Abort::Undefined) => {}
+            found => return found?.decoded(),
+        }
+        let text = format!(
+            "{} of missing question {id:#06x} in a match expression of EFI_IFR_MAP in a rule: \
+             edk2-stable202608 SetupBrowserDxe/Expression.c fails it (:2733-2738), and with it the \
+             MAP (:3656-3658) and the rule, whose RULE_REF gives UNDEFINED (:2952-2956), while UEFI \
+             2.11 pushes UNDEFINED without the question (§33.3.8.3.55), and the MAP goes on to its \
+             next pair",
+            op.op_code.spec_name()
+        );
+        Err(match self.frame.past_end() {
+            false => Abort::Diverged(Box::new(Divergence::Op(text))),
+            true => Abort::NotEvaluated(text),
+        })
+    }
+
+    /// Returns `value` as an operand; for one that cannot be read, notes why, after `subject`.
+    fn operand_of(
+        &mut self,
+        value: QuestionValue,
+        subject: impl FnOnce() -> String,
+    ) -> QuestionOperand {
         let (kind, reason) = match value {
             QuestionValue::Boolean(value) => {
                 return QuestionOperand::Value(Operand::Boolean(Some(value)))
@@ -3302,28 +4095,93 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
         }
     }
 
-    /// Returns the value of THIS: the one that the role gives, else that of the question that
-    /// holds `op`, which edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes reads as a
-    /// QUESTION_REF1 of it.
+    /// Returns the value of THIS `op`: outside rules, of the current question; in a rule, as
+    /// this_in_rule says.
     fn this(&mut self, op: &IFROperation) -> Result<Operand, Abort> {
+        match self.frame.in_rule.clone() {
+            None => self.current_this(op, op),
+            Some(rule_ref) => self.this_in_rule(op, &rule_ref.borrow()),
+        }
+    }
+
+    /// Returns the value of the current question at `at`, which THIS `op` takes: the one that the
+    /// role gives, else that of the question that holds `at`, which edk2-stable202608
+    /// SetupBrowserDxe/IfrParse.c ParseOpCodes reads as a QUESTION_REF1 of it.
+    fn current_this(&mut self, op: &IFROperation, at: &IFROperation) -> Result<Operand, Abort> {
         let value = match &self.role {
-            Role::Read(this) | Role::Write { this, .. } => this.clone(),
+            Role::Read { this, .. } | Role::Write { this, .. } => this.clone(),
             Role::Reads => {
-                let id = enclosing_question_id(op).ok_or_else(|| {
+                let id = enclosing_question_id(at).ok_or_else(|| {
                     Abort::Malformed(format!("{} outside a question", op.op_code.spec_name()))
                 })?;
-                return self.question(op, id)?.decoded();
+                return self.referenced_question(op, id)?.decoded();
             }
         };
         self.operand_of(value, || op.op_code.spec_name().to_string())
             .decoded()
     }
 
+    /// Returns the value of THIS `op` in a rule that `rule_ref`, the outermost RULE_REF, refers
+    /// to. edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes binds it, as it parses the
+    /// rule, to the innermost statement whose scope holds the THIS op, which fails where it has
+    /// no QuestionId, and ASSERTs where none does (:1461-1466); UEFI 2.11 takes the current
+    /// question (§33.3.8.3.77), that of the expression that holds `rule_ref`, as rules are
+    /// sub-expressions of the form's expressions (§33.2.5.7.3). Without a statement that holds
+    /// it, it is not evaluated; where that statement is the current question, it is that
+    /// question's value; else undetermined, naming both.
+    fn this_in_rule(
+        &mut self,
+        op: &IFROperation,
+        rule_ref: &IFROperation,
+    ) -> Result<Operand, Abort> {
+        let name = op.op_code.spec_name();
+        let Some((holder, statement)) = this_binding(op) else {
+            return Err(self.not_evaluated(format!(
+                "{name} in a rule that no statement holds (an ASSERT of edk2-stable202608 \
+                 SetupBrowserDxe/IfrParse.c ParseOpCodes, :1461-1466)"
+            )));
+        };
+        let current = enclosing_question_id(rule_ref);
+        if holder != 0 && current == Some(holder) {
+            return self.current_this(op, rule_ref);
+        }
+        let edk2 = match holder {
+            0 => format!(
+                "{} holds: edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes binds it to \
+                 that statement (:1461-1466), of QuestionId 0, which Expression.c IdToQuestion2 \
+                 never finds (:808-813), so it fails (:2733-2738) and the RULE_REF gives \
+                 UNDEFINED (:2952-2956)",
+                statement.spec_name()
+            ),
+            holder => format!(
+                "question {holder:#06x} holds: edk2-stable202608 SetupBrowserDxe/IfrParse.c \
+                 ParseOpCodes binds it to that question (:1461-1466), which gives {}",
+                self.reading(op, holder)?
+            ),
+        };
+        let spec = match current {
+            None => "but no question holds the RULE_REF".to_string(),
+            Some(id) => format!("question {id:#06x}, which gives {}", self.reading(op, id)?),
+        };
+        let text = format!(
+            "{name} in a rule that {edk2}, while UEFI 2.11 takes the current question \
+             (§33.3.8.3.77), {spec}"
+        );
+        Err(match self.frame.past_end() {
+            false => Abort::Diverged(Box::new(Divergence::Op(text))),
+            true => Abort::NotEvaluated(text),
+        })
+    }
+
     /// Returns the value that the GET `op` reads from its VarStore (edk2-stable202608
     /// SetupBrowserDxe/Expression.c EvaluateExpression); one that this backend cannot read is
     /// unknown. A missing variable of a VarName, or one of another size, gives UNDEFINED, as a
     /// value that could not be retrieved (UEFI 2.11 §33.3.8.3.27): edk2 gives it where
-    /// GetVariable fails, and reads a smaller variable zero-extended.
+    /// GetVariable fails, and reads a smaller variable zero-extended. Bytes that
+    /// --assume-var-store states replace those of the variable, as edk2 reads the edit buffer of
+    /// a buffer or EFI variable VarStore (Expression.c:2756-2763); where they state only some,
+    /// the others come from the variable, and if it cannot give them, the value is unknown and
+    /// PartlyStated.
     fn get(&mut self, op: &IFROperation) -> Result<Operand, Abort> {
         let ParsedOperation::Get(operand) = &op.parsed_data else {
             return Err(not_decoded(op));
@@ -3344,17 +4202,41 @@ impl<'a, V: QuestionValues> Evaluation<'a, V> {
         let layout = store.layout();
         let range = operand_range(op, operand, kind, store.as_ref())?;
         let offset = range.start;
+        let patch = statements_of(self.values.assumed(), store.as_ref()).bytes(range.clone());
+        if let Some(bytes) = patch.iter().copied().collect::<Option<Vec<u8>>>() {
+            return Ok(kind.operand(&bytes));
+        }
+        let key = store.variable_key();
         let varstore = Ok(store);
-        let read =
-            read_current_value_bytes(&varstore, range.clone(), self.reader).and_then(|bytes| {
+        let read = read_current_value_bytes(&varstore, range.clone(), self.reader)
+            .and_then(|bytes| {
                 bytes
                     .get(EFIVARFS_HEADER_SIZE..)
-                    .and_then(|payload| payload.get(range))
+                    .and_then(|payload| payload.get(range.clone()))
                     .map(<[u8]>::to_vec)
                     .ok_or(ValueUnavailable::Truncated {
                         offset,
                         len: bytes.len(),
                     })
+            })
+            .map(|read| {
+                patch
+                    .iter()
+                    .zip(read)
+                    .map(|(stated, read)| stated.unwrap_or(read))
+                    .collect::<Vec<u8>>()
+            })
+            .map_err(|reason| match patch.iter().any(Option::is_some) {
+                true => {
+                    let (stated, unstated) = stated_ranges(&patch, range.start);
+                    ValueUnavailable::PartlyStated {
+                        reason: Box::new(reason),
+                        key,
+                        stated,
+                        unstated,
+                    }
+                }
+                false => reason,
             });
         match (read, layout) {
             (Ok(bytes), _) => Ok(kind.operand(&bytes)),
@@ -3589,6 +4471,13 @@ enum Pending {
         map: Rc<RefCell<IFROperation>>,
         outer: Frame,
     },
+    /// `rule_ref`, which awaits the value of the expression of `rule`; `outer` is the frame of
+    /// the RULE_REF
+    Rule {
+        rule_ref: Rc<RefCell<IFROperation>>,
+        rule: Rc<RefCell<IFROperation>>,
+        outer: Frame,
+    },
 }
 
 /// A MAP partway through its pairs.
@@ -3660,7 +4549,11 @@ fn holds_conditional(op: &Rc<RefCell<IFROperation>>) -> bool {
         match OpRole::of(op.op_code) {
             OpRole::Expression(ExpressionOp::Conditional) => return true,
             OpRole::Map => {}
-            OpRole::Expression(_) | OpRole::Question | OpRole::Scope(_) | OpRole::Other => {
+            OpRole::Expression(_)
+            | OpRole::RuleRef
+            | OpRole::Question
+            | OpRole::Scope(_)
+            | OpRole::Other => {
                 ops.extend(op.children.iter().cloned());
             }
         }
@@ -3668,6 +4561,53 @@ fn holds_conditional(op: &Rc<RefCell<IFROperation>>) -> bool {
     false
 }
 
+/// The RULEs of a FORM or FORM_MAP by RuleId, each in IFR order, which edk2-stable202608
+/// SetupBrowserDxe/IfrParse.c ParseOpCodes attaches to that form (:2712-2724).
+struct FormRules {
+    form: Rc<RefCell<IFROperation>>,
+    by_id: BTreeMap<u8, Vec<Rc<RefCell<IFROperation>>>>,
+}
+
+impl FormRules {
+    fn new(form: &Rc<RefCell<IFROperation>>) -> Self {
+        let mut by_id: BTreeMap<u8, Vec<_>> = BTreeMap::new();
+        walk_scopes(&form.borrow().children, (), |node, ()| {
+            let op = node.borrow();
+            if skips_scope(&op) {
+                return Walk::Skip;
+            }
+            if let (IFROpCode::Rule, Some(&rule_id)) = (op.op_code, op.data.first()) {
+                by_id.entry(rule_id).or_default().push(Rc::clone(node));
+            }
+            Walk::Enter(())
+        });
+        FormRules {
+            form: Rc::clone(form),
+            by_id,
+        }
+    }
+
+    /// The RULEs of RuleId `rule_id` of `form`, from `index`, which is built anew where it is of
+    /// another form: a walk of the form per RULE_REF would grow with the form, not with the rules
+    /// started.
+    fn of<'a>(
+        index: &'a mut Option<FormRules>,
+        form: &Rc<RefCell<IFROperation>>,
+        rule_id: u8,
+    ) -> &'a [Rc<RefCell<IFROperation>>] {
+        let rules = match index.take() {
+            Some(rules) if Rc::ptr_eq(&rules.form, form) => rules,
+            Some(_) | None => FormRules::new(form),
+        };
+        index
+            .insert(rules)
+            .by_id
+            .get(&rule_id)
+            .map(Vec::as_slice)
+            .unwrap_or_default()
+    }
+}
+
 /// The leading expression ops of `ops`, each with the ops of its own scope, in IFR order: for
 /// well-formed IFR, the first op holding the rest, as edk2-stable202608
 /// SetupBrowserDxe/IfrParse.c ParseOpCodes takes them. AMI firmware sets the Scope bit on a later
@@ -3680,7 +4620,7 @@ fn leading_expression(ops: &[Rc<RefCell<IFROperation>>]) -> Vec<Rc<RefCell<IFROp
         .take_while(|op| {
             matches!(
                 OpRole::of(op.borrow().op_code),
-                OpRole::Expression(_) | OpRole::Map
+                OpRole::Expression(_) | OpRole::Map | OpRole::RuleRef
             )
         })
         .cloned()
@@ -3695,6 +4635,20 @@ enum QuestionOperand {
     Undecoded(String),
 }
 
+/// Names `operand`, the value of a question, for a divergence: UNDEFINED without the question.
+fn named(operand: Result<QuestionOperand, Abort>) -> Result<String, Abort> {
+    Ok(match operand {
+        Ok(QuestionOperand::Value(value)) => value
+            .shown()
+            .unwrap_or_else(|| "a value that cannot be read".to_string()),
+        Ok(QuestionOperand::Undecoded(reason)) => {
+            format!("a value that uefisettings cannot evaluate: {reason}")
+        }
+        Err(Abort::Undefined) => "UNDEFINED".to_string(),
+        Err(abort) => return Err(abort),
+    })
+}
+
 impl QuestionOperand {
     /// Returns the value, or NotEvaluated if not decoded.
     fn decoded(self) -> Result<Operand, Abort> {
@@ -3774,16 +4728,19 @@ mod tests {
     use std::collections::BTreeMap;
     use std::collections::BTreeSet;
 
+    use super::super::check_assumed;
     use super::super::find_question_in;
     use super::super::handle_form_set;
     use super::super::ifr_fixtures::*;
     use super::super::list_questions;
     use super::super::storage::ValueLocation;
+    use super::super::AssumedVarStore;
     use super::super::Cursor;
     use super::super::FormSetWalk;
     use super::super::QuestionDescriptor;
     use super::super::QuestionMatch;
     use super::*;
+    use crate::hii::strings::MatchTier;
 
     const EQ_ID_ID: u8 = 0x13;
     const EQ_ID_VAL_LIST: u8 = 0x14;
@@ -3814,6 +4771,9 @@ mod tests {
     const ONE: u8 = 0x53;
     const UNDEFINED: u8 = 0x55;
     const DUP: u8 = 0x57;
+    const QUESTION_REF2: u8 = 0x41;
+    const QUESTION_REF3: u8 = 0x51;
+    const UINT32: u8 = 0x44;
 
     fn unreadable(kind: ValueKind) -> QuestionValue {
         QuestionValue::Unreadable {
@@ -5736,7 +6696,7 @@ mod tests {
         let root = parse_form_set(forms);
         find_question_in(
             &root,
-            &QuestionMatch::Prompt(&BTreeSet::from([PROMPT])),
+            &QuestionMatch::Prompt(&BTreeSet::from([PROMPT]), MatchTier::Stored),
             &mut FormSetWalk::new(
                 &ListTexts::new(&strings(), &[]),
                 &mut Efivars::new().reader(),
@@ -6405,7 +7365,7 @@ mod tests {
             let root = parse_form_set(&[form(1, &[body, referrer.clone()])]);
             let referrer = find_op(&root, &referrer[2..])
                 .unwrap_or_else(|| panic!("{name}: find the referrer"));
-            let value = VarStoreValues::new(&root, None).value(
+            let value = VarStoreValues::new(&root, CheckedVarStores::NONE).value(
                 &referrer.borrow(),
                 1,
                 &mut Efivars::new().reader(),
@@ -6439,7 +7399,7 @@ mod tests {
                 Rc::clone(&root),
                 &ListTexts::new(&strings(), &[]),
                 IncludedStates::empty(),
-                None,
+                CheckedVarStores::NONE,
                 &mut Efivars::new().reader(),
             )
             .into_iter()
@@ -6542,6 +7502,150 @@ mod tests {
         assert_eq!(found_offset(&root, &referrer, 7), Some(0), "question 7");
     }
 
+    /// QuestionIndex leaves out a question that edk2-stable202608 SetupBrowserDxe/IfrParse.c
+    /// ParseOpCodes skips under a true DISABLE_IF outside forms, so that a reference to it gives
+    /// UNDEFINED, and keeps one under a false one, or under a true one in its form, which
+    /// ParseOpCodes parses.
+    #[test]
+    fn question_index_leaves_out_questions_that_edk2_does_not_parse() {
+        let referrer = eq_id_val_of(7, 1);
+        for (case, ifr, want) in [
+            (
+                "a true DISABLE_IF outside forms",
+                conditional(DISABLE_IF, ifr_true(), &[form(1, &[checkbox_op(7, 0)])]),
+                None,
+            ),
+            (
+                "a false DISABLE_IF outside forms",
+                conditional(DISABLE_IF, ifr_false(), &[form(1, &[checkbox_op(7, 0)])]),
+                Some(0),
+            ),
+            (
+                "a true DISABLE_IF in its form",
+                form(
+                    1,
+                    &[conditional(DISABLE_IF, ifr_true(), &[checkbox_op(7, 0)])],
+                ),
+                Some(0),
+            ),
+        ] {
+            let root = parse_form_set(&[ifr, form(2, std::slice::from_ref(&referrer))]);
+            assert_eq!(found_offset(&root, &referrer, 7), want, "{case}");
+        }
+    }
+
+    /// A question that ParseOpCodes may skip, in the scope of a DISABLE_IF outside forms whose
+    /// condition is not known or after a true SUPPRESS_IF there, has no known value: IdToQuestion
+    /// finds no question where ParseOpCodes skips it. After a false SUPPRESS_IF, its value is read,
+    /// and so it is from its own form, which ParseOpCodes parses with it.
+    #[test]
+    fn a_question_that_edk2_may_not_parse_has_no_known_value() {
+        let referrer = eq_id_val_of(7, 1);
+        let question = || form(1, &[checkbox_op(7, 0)]);
+        let elsewhere = || form(2, std::slice::from_ref(&referrer));
+        for (case, ifr, may_be_skipped) in [
+            (
+                "a DISABLE_IF that is not constant",
+                vec![
+                    conditional(DISABLE_IF, eq_id_val_of(9, 1), &[question()]),
+                    elsewhere(),
+                ],
+                true,
+            ),
+            (
+                "after a true SUPPRESS_IF",
+                vec![
+                    conditional(
+                        DISABLE_IF,
+                        ifr_false(),
+                        &[conditional(SUPPRESS_IF, ifr_true(), &[]), question()],
+                    ),
+                    elsewhere(),
+                ],
+                true,
+            ),
+            (
+                "after a false SUPPRESS_IF",
+                vec![
+                    conditional(
+                        DISABLE_IF,
+                        ifr_false(),
+                        &[conditional(SUPPRESS_IF, ifr_false(), &[]), question()],
+                    ),
+                    elsewhere(),
+                ],
+                false,
+            ),
+            (
+                "a DISABLE_IF that is not constant, the referrer in the question's form",
+                vec![conditional(
+                    DISABLE_IF,
+                    eq_id_val_of(9, 1),
+                    &[form(1, &[checkbox_op(7, 0), referrer.clone()])],
+                )],
+                false,
+            ),
+        ] {
+            let root = parse_form_set(&ifr);
+            let found = find_op(&root, &referrer[2..]).expect("find the referrer");
+            let value = VarStoreValues::new(&root, CheckedVarStores::NONE).value(
+                &found.borrow(),
+                7,
+                &mut Efivars::new().reader(),
+            );
+            let skipped = matches!(
+                &value,
+                Some(QuestionValue::Unreadable { kind: ValueKind::Boolean, reason })
+                    if reason.starts_with("edk2 may not parse it: ")
+            );
+            assert_eq!(skipped, may_be_skipped, "{case}: {value:?}");
+            assert!(value.is_some(), "{case}: question 7 is found");
+        }
+    }
+
+    /// The conditions of a FormSet's form-set-list are evaluated as many times for 40 questions
+    /// in the scope of a DISABLE_IF there, each grayed out by a question in another form in that
+    /// scope, as for one: FormSetParse keeps the walk of the form-set-list from question to
+    /// question. Their VarStore comes first, so that its lookups evaluate none.
+    #[test]
+    fn form_set_conditions_are_evaluated_as_often_whatever_the_questions() {
+        let evaluated = |questions: u16| {
+            let grayed_out: Vec<Vec<u8>> = (1..=questions)
+                .map(|id| conditional(GRAY_OUT_IF, eq_id_val_of(500, 1), &[checkbox_op(id, 0)]))
+                .collect();
+            let root = parse_form_set(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 2),
+                conditional(
+                    DISABLE_IF,
+                    eq_id_val_of(600, 1),
+                    &[
+                        conditional(SUPPRESS_IF, eq_id_val_of(600, 1), &[]),
+                        form(1, &grayed_out),
+                        form(2, &[checkbox_op(500, 1)]),
+                    ],
+                ),
+            ]);
+            let before = CONSTANT_CONDITIONS.with(std::cell::Cell::get);
+            let listed = list_questions(
+                root,
+                &ListTexts::new(&[], &[]),
+                IncludedStates::all(),
+                CheckedVarStores::NONE,
+                &mut Efivars::new().reader(),
+            );
+            (
+                listed.len(),
+                CONSTANT_CONDITIONS.with(std::cell::Cell::get) - before,
+            )
+        };
+
+        let (listed_of_1, for_1) = evaluated(1);
+        let (listed_of_40, for_40) = evaluated(40);
+
+        assert_eq!((listed_of_1, listed_of_40), (2, 41), "questions listed");
+        assert_eq!(for_40, for_1, "conditions evaluated");
+    }
+
     /// QuestionId 0 is reserved (UEFI 2.10 §33.3.8.2.2): edk2-stable202608
     /// SetupBrowserDxe/Expression.c IdToQuestion2 finds no question of it.
     #[test]
@@ -6549,7 +7653,7 @@ mod tests {
         let referrer = checkbox_op(1, 1);
         let root = parse_form_set(&[form(1, &[checkbox_op(0, 0), referrer.clone()])]);
         let referrer = find_op(&root, &referrer[2..]).expect("find the referrer");
-        let values = VarStoreValues::new(&root, None);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
         let mut reader = Efivars::new().reader();
         assert_eq!(
             values.value(&referrer.borrow(), 0, &mut reader),
@@ -6594,7 +7698,7 @@ mod tests {
                     &scope.borrow(),
                     &mut ExpressionInputs {
                         reader: &mut Efivars::new().reader(),
-                        values: &VarStoreValues::new(&root, None),
+                        values: &VarStoreValues::new(&root, CheckedVarStores::NONE),
                     },
                 ),
                 Truth::Known(false),
@@ -6609,7 +7713,7 @@ mod tests {
         let root = two_forms();
         let referrer = find_op(&root, &eq_id_val_of(7, 1)[2..]).expect("find the referrer");
         let referrer = referrer.borrow();
-        let values = VarStoreValues::new(&root, None);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
 
         assert_eq!(
             values.value(&referrer, 9, &mut Efivars::new().reader()),
@@ -6649,7 +7753,7 @@ mod tests {
         let efivars = Efivars::new();
         efivars.write(store.as_ref(), &[1, 0]);
         let mut reader = efivars.reader();
-        let values = VarStoreValues::new(&root, None);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
         let referrer = question.borrow();
 
         assert_eq!(
@@ -6670,139 +7774,98 @@ mod tests {
         );
     }
 
-    /// The reason that a question on the level byte of AMI firmware's VarStore SystemAccess,
-    /// buffer or EFI variable, has no value says what the setup browser keeps there; a question
-    /// on another byte of it or of another width, or on a VarStore of another name or Guid,
-    /// keeps its reason, and a readable SystemAccess its value.
+    /// 11111111-1111-1111-1111-111111111111, as stored: the GUID of the VarStores that tests of
+    /// stated bytes declare.
+    const MODE_GUID: [u8; 16] = [0x11; 16];
+    /// The efivar file of the buffer VarStore Mode of MODE_GUID.
+    const MODE: &str = "Mode-11111111-1111-1111-1111-111111111111";
+
+    /// The reason that a question on a buffer or EFI variable VarStore has no value names, in
+    /// conditions, the flag that states its bytes; on a name/value VarStore it does not, and a
+    /// readable VarStore gives its value.
     #[test]
-    fn unreadable_ami_access_level_is_named() {
+    fn unreadable_var_store_values_name_the_flag() {
         let cases = [
             (
-                "buffer SystemAccess",
-                var_store(1, SYSTEM_ACCESS_GUID, "SystemAccess", 1),
-                "<ValueUnavailable: no EFI variable \
-                 SystemAccess-e770bb69-bcb4-4d04-9e97-23ff9456feac; HII buffer varstore requires \
-                 EFI_HII_CONFIG_ACCESS_PROTOCOL; the AMI setup browser keeps its access level \
-                 there (0 Administrator, 1 User); \
-                 --access-level administrator|user states one>",
-            ),
-            (
-                "EFI variable SystemAccess",
-                var_store_efi_of(1, SYSTEM_ACCESS_GUID, "SystemAccess", NV_BS_RT, 1),
-                "<ValueUnavailable: no EFI variable \
-                 SystemAccess-e770bb69-bcb4-4d04-9e97-23ff9456feac; the AMI setup browser keeps \
-                 its access level there (0 Administrator, 1 User); \
-                 --access-level administrator|user states one>",
-            ),
-            (
-                "boot-service-only EFI variable SystemAccess",
-                var_store_efi_of(1, SYSTEM_ACCESS_GUID, "SystemAccess", NV_BS, 1),
-                "<ValueUnavailable: EFI variable SystemAccess-e770bb69-bcb4-4d04-9e97-23ff9456feac \
-                 is not present at OS runtime: efivarfs does not list it, and its form declares it \
-                 boot-service-only (no EFI_VARIABLE_RUNTIME_ACCESS); the AMI setup browser keeps \
-                 its access level there (0 Administrator, 1 User); \
-                 --access-level administrator|user states one>",
-            ),
-            (
-                "buffer SystemAccess of NIL_GUID",
-                var_store(1, [0; 16], "SystemAccess", 1),
-                "<ValueUnavailable: no EFI variable \
-                 SystemAccess-00000000-0000-0000-0000-000000000000; HII buffer varstore requires \
-                 EFI_HII_CONFIG_ACCESS_PROTOCOL>",
+                "buffer Mode",
+                var_store(1, MODE_GUID, "Mode", 1),
+                format!(
+                    "<ValueUnavailable: no EFI variable {MODE}; HII buffer varstore requires \
+                     EFI_HII_CONFIG_ACCESS_PROTOCOL; --assume-var-store {MODE}+0=<HEX of 1 byte> \
+                     states it>"
+                ),
             ),
             (
-                "buffer Setup of the SystemAccess Guid",
-                var_store(1, SYSTEM_ACCESS_GUID, "Setup", 1),
-                "<ValueUnavailable: no EFI variable Setup-e770bb69-bcb4-4d04-9e97-23ff9456feac; \
-                 HII buffer varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL>",
+                "EFI variable Mode",
+                var_store_efi_of(1, MODE_GUID, "Mode", NV_BS_RT, 1),
+                format!(
+                    "<ValueUnavailable: no EFI variable {MODE}; --assume-var-store \
+                     {MODE}+0=<HEX of 1 byte> states it>"
+                ),
             ),
             (
-                "buffer Setup of NIL_GUID",
-                var_store(1, [0; 16], "Setup", 1),
-                "<ValueUnavailable: no EFI variable Setup-00000000-0000-0000-0000-000000000000; \
-                 HII buffer varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL>",
+                "boot-service-only EFI variable Mode",
+                var_store_efi_of(1, MODE_GUID, "Mode", NV_BS, 1),
+                format!(
+                    "<ValueUnavailable: EFI variable {MODE} is not present at OS runtime: \
+                     efivarfs does not list it, and its form declares it boot-service-only (no \
+                     EFI_VARIABLE_RUNTIME_ACCESS); --assume-var-store {MODE}+0=<HEX of 1 byte> \
+                     states it>"
+                ),
             ),
         ];
         for (name, declaration, want) in cases {
             let root = parse_form_set(&[declaration, form(1, &[checkbox_op(1, 0)])]);
             let question = find_op(&root, &checkbox_op(1, 0)[2..]).expect("find question 1");
             assert_eq!(
-                VarStoreValues::new(&root, None).value(
+                VarStoreValues::new(&root, CheckedVarStores::NONE).value(
                     &question.borrow(),
                     1,
                     &mut Efivars::new().reader()
                 ),
                 Some(QuestionValue::Unreadable {
                     kind: ValueKind::Boolean,
-                    reason: want.to_string(),
+                    reason: want,
                 }),
                 "{name}"
             );
         }
 
-        let checkbox_at_1 = checkbox_op(1, 1);
-        let uint16_at_0 = operation(
-            NUMERIC,
-            false,
-            &[
-                question_header_on(2, 5, 1, 0),
-                vec![0x01, 0, 0, 0xFF, 0xFF, 1, 0],
-            ]
-            .concat(),
-        );
         let root = parse_form_set(&[
-            var_store(1, SYSTEM_ACCESS_GUID, "SystemAccess", 2),
-            form(1, &[checkbox_at_1.clone(), uint16_at_0.clone()]),
+            var_store_name_value(1, MODE_GUID),
+            form(1, &[checkbox_op(1, 0)]),
         ]);
-        let others = [
-            (
-                "VarOffset 1 of a 2-byte buffer SystemAccess",
-                &checkbox_at_1,
-                1,
-                ValueKind::Boolean,
-            ),
-            (
-                "UINT16 NUMERIC at VarOffset 0 of a 2-byte buffer SystemAccess",
-                &uint16_at_0,
-                2,
-                ValueKind::Uint,
+        let question = find_op(&root, &checkbox_op(1, 0)[2..]).expect("find question 1");
+        let value = VarStoreValues::new(&root, CheckedVarStores::NONE).value(
+            &question.borrow(),
+            1,
+            &mut Efivars::new().reader(),
+        );
+        assert!(
+            matches!(
+                &value,
+                Some(QuestionValue::Unreadable { reason, .. })
+                    if !reason.contains("--assume-var-store")
             ),
-        ];
-        for (name, op, id, kind) in others {
-            let question = find_op(&root, &op[2..]).expect("find the question");
-            assert_eq!(
-                VarStoreValues::new(&root, None).value(
-                    &question.borrow(),
-                    id,
-                    &mut Efivars::new().reader()
-                ),
-                Some(QuestionValue::Unreadable {
-                    kind,
-                    reason: "<ValueUnavailable: no EFI variable \
-                             SystemAccess-e770bb69-bcb4-4d04-9e97-23ff9456feac; HII buffer \
-                             varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL>"
-                        .to_string(),
-                }),
-                "{name}"
-            );
-        }
+            "name/value Mode: {value:?}"
+        );
 
         let root = parse_form_set(&[
-            var_store(1, SYSTEM_ACCESS_GUID, "SystemAccess", 1),
+            var_store(1, MODE_GUID, "Mode", 1),
             form(1, &[checkbox_op(1, 0)]),
         ]);
         let question = find_op(&root, &checkbox_op(1, 0)[2..]).expect("find question 1");
-        let values = VarStoreValues::new(&root, None);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
         assert_eq!(
             values.value(&question.borrow(), 1, &mut disabled_reader()),
             Some(QuestionValue::Unreadable {
                 kind: ValueKind::Boolean,
-                reason: "<ValueUnavailable: EFI variables not read; the AMI setup browser keeps \
-                         its access level there (0 Administrator, 1 User); \
-                         --access-level administrator|user states one>"
-                    .to_string(),
+                reason: format!(
+                    "<ValueUnavailable: EFI variables not read; --assume-var-store \
+                     {MODE}+0=<HEX of 1 byte> states it>"
+                ),
             }),
-            "buffer SystemAccess without reading efivars"
+            "buffer Mode without reading efivars"
         );
         let store = find_corresponding_varstore(Rc::clone(&question), 1);
         let efivars = Efivars::new();
@@ -6810,28 +7873,90 @@ mod tests {
         assert_eq!(
             values.value(&question.borrow(), 1, &mut efivars.reader()),
             Some(QuestionValue::Boolean(1)),
-            "readable buffer SystemAccess"
+            "readable buffer Mode"
+        );
+    }
+
+    /// The reason that a question on an EFI variable VarStore has no value, its variable having
+    /// enhanced authenticated access with metadata that uefisettings refuses, names the flag that
+    /// states its bytes.
+    #[test]
+    fn an_enhanced_authenticated_var_store_value_names_the_flag() {
+        let root = parse_form_set(&[
+            var_store_efi_of(1, MODE_GUID, "Mode", NV_BS_RT, 1),
+            form(1, &[checkbox_op(1, 0)]),
+        ]);
+        let question = find_op(&root, &checkbox_op(1, 0)[2..]).expect("find question 1");
+        let store = find_corresponding_varstore(Rc::clone(&question), 1);
+        let efivars = Efivars::new();
+        efivars.write_attributed(
+            store.as_ref().expect("find VarStore 1").as_ref(),
+            NV_BS_RT | 0x80,
+            &[1],
+        );
+        let value = VarStoreValues::new(&root, CheckedVarStores::NONE).value(
+            &question.borrow(),
+            1,
+            &mut efivars.reader(),
+        );
+        let Some(QuestionValue::Unreadable { reason, .. }) = value else {
+            panic!("a value of a refused enhanced authenticated variable: {value:?}");
+        };
+        assert!(
+            reason.starts_with(&format!(
+                "<ValueUnavailable: EFI variable {MODE} has enhanced authenticated access"
+            )),
+            "{reason}"
+        );
+        assert!(
+            reason.ends_with(&format!(
+                "; --assume-var-store {MODE}+0=<HEX of 1 byte> states it>"
+            )),
+            "{reason}"
         );
     }
 
-    /// The state of question 1 in the scope `scope` of `condition`, which reads question 2,
-    /// `access_level_question`, on AMI firmware's buffer VarStore SystemAccess, whose efivar
-    /// holds `stored` if any, with conditions reading `stated`, if stated, instead of its value.
-    fn access_level_state(
-        access_level_question: &[u8],
-        (scope, condition): (u8, Vec<u8>),
-        stored: Option<u8>,
-        stated: Option<AccessLevel>,
-    ) -> StateEvaluation {
+    /// `texts` as --assume-var-store takes them.
+    fn statements(texts: &[String]) -> Vec<AssumedVarStore> {
+        texts
+            .iter()
+            .map(|text| {
+                text.parse()
+                    .unwrap_or_else(|error| panic!("parse {text:?}: {error}"))
+            })
+            .collect()
+    }
+
+    /// `assumed`, as check_assumed takes it in the FormSet of `root`.
+    fn checked_in<'s>(
+        root: &Rc<RefCell<IFROperation>>,
+        assumed: &'s [AssumedVarStore],
+    ) -> CheckedVarStores<'s> {
+        check_assumed([root], assumed)
+            .unwrap_or_else(|refused| panic!("check {assumed:?}: {refused}"))
+    }
+
+    /// The state of question 1 in the scope of a SUPPRESS_IF on question 2, `on_mode`, which is on
+    /// byte 0 of the 2-byte buffer VarStore Mode, whose efivar holds `stored` if any, with
+    /// conditions reading the bytes that `stated` states. The FormSet declares the VarStores of
+    /// another GUID and of other names too, for check_assumed to take their statements.
+    fn mode_state(on_mode: &[u8], stored: Option<&[u8]>, stated: &[String]) -> StateEvaluation {
         let question = checkbox_on(1, 3, 1);
         let root = parse_form_set(&[
             var_store_efi(1, "Present", NV_BS_RT, 1),
-            var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 1),
+            var_store(2, MODE_GUID, "Mode", 2),
+            var_store(3, [0x22; 16], "Mode", 1),
+            var_store(4, MODE_GUID, "Other", 1),
+            var_store(5, MODE_GUID, "mode", 1),
             form(
                 1,
                 &[
-                    access_level_question.to_vec(),
-                    conditional(scope, condition, std::slice::from_ref(&question)),
+                    on_mode.to_vec(),
+                    conditional(
+                        SUPPRESS_IF,
+                        eq_id_val_of(2, 1),
+                        std::slice::from_ref(&question),
+                    ),
                 ],
             ),
         ]);
@@ -6839,271 +7964,551 @@ mod tests {
         let efivars = Efivars::new();
         if let Some(stored) = stored {
             let store = find_corresponding_varstore(Rc::clone(&question), 2);
-            efivars.write(store.as_ref().expect("find VarStore 2").as_ref(), &[stored]);
+            efivars.write(store.as_ref().expect("find VarStore 2").as_ref(), stored);
         }
+        let assumed = statements(stated);
         let question = question.borrow();
         question_state(
             &question,
             &mut ExpressionInputs {
                 reader: &mut efivars.reader(),
-                values: &VarStoreValues::new(&root, stated),
+                values: &VarStoreValues::new(&root, checked_in(&root, &assumed)),
             },
         )
     }
 
-    /// A stated access level replaces the level byte of SystemAccess in every condition,
-    /// whether or not its efivar can be read; without one, and for a question on another byte
-    /// or of another width, conditions read the efivar.
+    /// Bytes stated for a VarStore decide a condition on a question on them, whether or not its
+    /// efivar can be read; statements of other bytes, another GUID or another name leave the
+    /// condition on the efivar, and one that cannot be read names the flag that states it.
     #[test]
-    fn stated_access_level_replaces_the_stored_one() {
+    fn stated_var_store_bytes_decide_conditions() {
         const UNREAD: &str = "EFI_IFR_EQ_ID_VAL of question 0x0002: <ValueUnavailable: no EFI \
-            variable SystemAccess-e770bb69-bcb4-4d04-9e97-23ff9456feac; HII buffer varstore \
-            requires EFI_HII_CONFIG_ACCESS_PROTOCOL; the AMI setup browser keeps its access level \
-            there (0 Administrator, 1 User); --access-level administrator|user states one>";
-        let user_only = || (GRAY_OUT_IF, eq_id_val_of(2, 1));
-        // the one comparison with 85 in the HiiDBs of AMI firmware read so far
-        let not_85 = || {
-            (
-                SUPPRESS_IF,
-                [eq_id_val_of(2, 85), operation(NOT, false, &[])].concat(),
-            )
-        };
+            variable Mode-11111111-1111-1111-1111-111111111111; HII buffer varstore requires \
+            EFI_HII_CONFIG_ACCESS_PROTOCOL; --assume-var-store \
+            Mode-11111111-1111-1111-1111-111111111111+0=<HEX of 1 byte> states it>";
         let undetermined = StateEvaluation {
             current: QuestionState::Selectable,
-            unknown: vec![(QuestionState::GrayedOut, UNREAD.to_string())],
+            unknown: vec![(QuestionState::Suppressed, UNREAD.to_string())],
             read_only: None,
             from_snapshot: Vec::new(),
         };
+        let mode = |rest: &str| format!("{MODE}{rest}");
+        let one: &[u8] = &[1, 0];
+        let zero: &[u8] = &[0, 0];
         let cases = [
+            ("no efivar, none stated", None, vec![], undetermined.clone()),
             (
-                "Administrator, no efivar",
-                user_only(),
-                None,
-                Some(AccessLevel::Administrator),
-                known(QuestionState::Selectable),
+                "stored 1, none stated",
+                Some(one),
+                vec![],
+                known(QuestionState::Suppressed),
             ),
             (
-                "User, no efivar",
-                user_only(),
-                None,
-                Some(AccessLevel::User),
-                known(QuestionState::GrayedOut),
+                "stored 0, none stated",
+                Some(zero),
+                vec![],
+                known(QuestionState::Selectable),
             ),
-            ("no level, no efivar", user_only(), None, None, undetermined),
             (
-                "Administrator over a stored 1",
-                user_only(),
-                Some(1),
-                Some(AccessLevel::Administrator),
+                "stored 1, 00 stated",
+                Some(one),
+                vec![mode("=00")],
                 known(QuestionState::Selectable),
             ),
             (
-                "User over a stored 0",
-                user_only(),
-                Some(0),
-                Some(AccessLevel::User),
-                known(QuestionState::GrayedOut),
+                "stored 1, 0000 stated",
+                Some(one),
+                vec![mode("=0000")],
+                known(QuestionState::Selectable),
             ),
             (
-                "no level, stored 1",
-                user_only(),
-                Some(1),
-                None,
-                known(QuestionState::GrayedOut),
+                "stored 0, 01 stated",
+                Some(zero),
+                vec![mode("=01")],
+                known(QuestionState::Suppressed),
             ),
             (
-                "no level, stored 0",
-                user_only(),
-                Some(0),
+                "no efivar, 00 stated",
                 None,
+                vec![mode("=00")],
                 known(QuestionState::Selectable),
             ),
             (
-                "Administrator, NOT 85",
-                not_85(),
+                "no efivar, 01 stated",
                 None,
-                Some(AccessLevel::Administrator),
+                vec![mode("=01")],
+                known(QuestionState::Suppressed),
+            ),
+            (
+                "stored 1, 00 stated at byte 1",
+                Some(one),
+                vec![mode("+1=00")],
                 known(QuestionState::Suppressed),
             ),
             (
-                "User, NOT 85",
-                not_85(),
+                "no efivar, 01 stated at byte 1",
                 None,
-                Some(AccessLevel::User),
+                vec![mode("+1=01")],
+                undetermined,
+            ),
+            (
+                "stored 1, 00 stated for another GUID",
+                Some(one),
+                vec!["Mode-22222222-2222-2222-2222-222222222222=00".to_string()],
+                known(QuestionState::Suppressed),
+            ),
+            (
+                "stored 1, 00 stated for another name",
+                Some(one),
+                vec!["Other-11111111-1111-1111-1111-111111111111=00".to_string()],
+                known(QuestionState::Suppressed),
+            ),
+            (
+                "stored 1, 00 stated for another case of the name",
+                Some(one),
+                vec!["mode-11111111-1111-1111-1111-111111111111=00".to_string()],
                 known(QuestionState::Suppressed),
             ),
         ];
-        let access_level_questions = [
+        let on_mode = [
             ("CHECKBOX", checkbox_on(2, 5, 2)),
             ("UINT8 NUMERIC", uint8_numeric_on(2, 5, 2)),
         ];
-        for (kind, access_level_question) in &access_level_questions {
-            for (name, scope, stored, stated, want) in cases.clone() {
-                assert_eq!(
-                    access_level_state(access_level_question, scope, stored, stated),
-                    want,
-                    "{kind}: {name}"
-                );
+        for (kind, on_mode) in &on_mode {
+            for (name, stored, stated, want) in cases.clone() {
+                assert_eq!(mode_state(on_mode, stored, &stated), want, "{kind}: {name}");
             }
         }
+    }
 
-        let checkbox_at_1 = operation(
-            CHECKBOX,
+    /// The value that a condition reads of `question`, of QuestionId `id`, on the 4-byte buffer
+    /// VarStore Mode, whose efivar holds `stored` if any, with the bytes that `stated` states.
+    fn mode_value(
+        question: &[u8],
+        id: u16,
+        stored: Option<&[u8]>,
+        stated: &[String],
+    ) -> Option<QuestionValue> {
+        let root = parse_form_set(&[
+            var_store(2, MODE_GUID, "Mode", 4),
+            form(1, &[question.to_vec()]),
+        ]);
+        let found = find_op(&root, &question[2..]).expect("find the question");
+        let efivars = Efivars::new();
+        if let Some(stored) = stored {
+            let store = find_corresponding_varstore(Rc::clone(&found), 2);
+            efivars.write(store.as_ref().expect("find VarStore 2").as_ref(), stored);
+        }
+        let assumed = statements(stated);
+        let question = found.borrow();
+        VarStoreValues::new(&root, checked_in(&root, &assumed)).value(
+            &question,
+            id,
+            &mut efivars.reader(),
+        )
+    }
+
+    /// Stated bytes patch the bytes of a value read from its efivar, those of one statement or
+    /// of several; a value they state whole needs no efivar, and one of whose bytes the efivar
+    /// cannot give the others is unreadable, naming the bytes stated, those not and the flag
+    /// that states them.
+    #[test]
+    fn stated_bytes_patch_a_straddling_value() {
+        let mode = |rest: &str| format!("{MODE}{rest}");
+        let uint16_at_1 = operation(
+            NUMERIC,
             false,
-            &[question_header_on(2, 5, 2, 1), vec![0x00]].concat(),
+            &[
+                question_header_on(2, 5, 2, 1),
+                vec![0x01, 0, 0, 0xFF, 0xFF, 1, 0],
+            ]
+            .concat(),
         );
-        let uint16_at_0 = operation(
+        let stored: &[u8] = &[0x10, 0x20, 0x30, 0x40];
+        let unread = |stated: &str, unstated: &str, flags: &str| QuestionValue::Unreadable {
+            kind: ValueKind::Uint,
+            reason: format!(
+                "<ValueUnavailable: no EFI variable {MODE}; HII buffer varstore requires \
+                 EFI_HII_CONFIG_ACCESS_PROTOCOL; bytes {stated} of {MODE} stated, {unstated} not; \
+                 {flags}>"
+            ),
+        };
+        let cases = [
+            (
+                "none stated",
+                Some(stored),
+                vec![],
+                QuestionValue::Uint(0x3020),
+            ),
+            (
+                "byte 1 stated",
+                Some(stored),
+                vec![mode("+1=aa")],
+                QuestionValue::Uint(0x30AA),
+            ),
+            (
+                "byte 2 stated",
+                Some(stored),
+                vec![mode("+2=bb")],
+                QuestionValue::Uint(0xBB20),
+            ),
+            (
+                "bytes 1 and 2 stated",
+                Some(stored),
+                vec![mode("+1=aabb")],
+                QuestionValue::Uint(0xBBAA),
+            ),
+            (
+                "bytes 0 and 1 stated",
+                Some(stored),
+                vec![mode("=00aa")],
+                QuestionValue::Uint(0x30AA),
+            ),
+            (
+                "bytes 2 and 3 stated",
+                Some(stored),
+                vec![mode("+2=bbcc")],
+                QuestionValue::Uint(0xBB20),
+            ),
+            (
+                "byte 1 and byte 2 stated apart",
+                Some(stored),
+                vec![mode("=0011"), mode("+2=22")],
+                QuestionValue::Uint(0x2211),
+            ),
+            (
+                "byte 3 stated",
+                Some(stored),
+                vec![mode("+3=cc")],
+                QuestionValue::Uint(0x3020),
+            ),
+            (
+                "no efivar, bytes 1 and 2 stated",
+                None,
+                vec![mode("+1=aabb")],
+                QuestionValue::Uint(0xBBAA),
+            ),
+            (
+                "no efivar, byte 1 and byte 2 stated apart",
+                None,
+                vec![mode("=00aa"), mode("+2=bb")],
+                QuestionValue::Uint(0xBBAA),
+            ),
+            (
+                "no efivar, byte 1 stated",
+                None,
+                vec![mode("+1=aa")],
+                unread(
+                    "1..2",
+                    "2..3",
+                    &format!("--assume-var-store {MODE}+2=<HEX of 1 byte> states it"),
+                ),
+            ),
+            (
+                "no efivar, byte 2 stated",
+                None,
+                vec![mode("+2=bb")],
+                unread(
+                    "2..3",
+                    "1..2",
+                    &format!("--assume-var-store {MODE}+1=<HEX of 1 byte> states it"),
+                ),
+            ),
+        ];
+        for (name, stored, stated, want) in cases {
+            assert_eq!(
+                mode_value(&uint16_at_1, 2, stored, &stated),
+                Some(want),
+                "UINT16 at VarOffset 1: {name}"
+            );
+        }
+
+        let uint32_at_0 = operation(
             NUMERIC,
             false,
             &[
                 question_header_on(3, 5, 2, 0),
-                vec![0x01, 0, 0, 0xFF, 0xFF, 1, 0],
+                vec![0x02],
+                0u32.to_le_bytes().to_vec(),
+                u32::MAX.to_le_bytes().to_vec(),
+                1u32.to_le_bytes().to_vec(),
             ]
             .concat(),
         );
-        let root = parse_form_set(&[
-            var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 1),
-            form(1, &[checkbox_at_1.clone(), uint16_at_0.clone()]),
-        ]);
-        let others = [
+        let cases = [
             (
-                "CHECKBOX at VarOffset 1",
-                &checkbox_at_1,
-                2,
-                ValueKind::Boolean,
-                "<ExtractEFIDataError: failed to fill whole buffer (offset: 1; buflen: 5)>",
+                "none stated",
+                vec![],
+                QuestionValue::Unreadable {
+                    kind: ValueKind::Uint,
+                    reason: format!(
+                        "<ValueUnavailable: no EFI variable {MODE}; HII buffer varstore requires \
+                         EFI_HII_CONFIG_ACCESS_PROTOCOL; --assume-var-store \
+                         {MODE}+0=<HEX of 4 bytes> states it>"
+                    ),
+                },
             ),
             (
-                "UINT16 NUMERIC at VarOffset 0",
-                &uint16_at_0,
-                3,
-                ValueKind::Uint,
-                "<ExtractEFIDataError: failed to fill whole buffer (offset: 0; buflen: 5)>",
+                "bytes 1 and 3 stated",
+                vec![mode("+1=aa"), mode("+3=cc")],
+                unread(
+                    "1..2, 3..4",
+                    "0..1, 2..3",
+                    &format!(
+                        "--assume-var-store {MODE}+0=<HEX of 1 byte> and --assume-var-store \
+                         {MODE}+2=<HEX of 1 byte> state them"
+                    ),
+                ),
+            ),
+            (
+                "every byte stated",
+                vec![mode("+1=aabbcc"), mode("=dd")],
+                QuestionValue::Uint(0xCCBB_AADD),
             ),
         ];
-        for (name, op, id, kind, reason) in others {
-            let question = find_op(&root, &op[2..]).expect("find the question");
-            let store = find_corresponding_varstore(Rc::clone(&question), 2);
-            let efivars = Efivars::new();
-            efivars.write(store.as_ref().expect("find VarStore 2").as_ref(), &[1]);
+        for (name, stated, want) in cases {
             assert_eq!(
-                VarStoreValues::new(&root, Some(AccessLevel::User)).value(
-                    &question.borrow(),
-                    id,
-                    &mut efivars.reader()
+                mode_value(&uint32_at_0, 3, None, &stated),
+                Some(want),
+                "UINT32 at VarOffset 0, no efivar: {name}"
+            );
+        }
+        let Some(QuestionValue::Unreadable {
+            kind: ValueKind::Uint,
+            reason,
+        }) = mode_value(&uint32_at_0, 3, Some(&[0x10, 0x20]), &[mode("=aa")])
+        else {
+            panic!("UINT32 at VarOffset 0, a 2-byte efivar, byte 0 stated: a value");
+        };
+        assert!(
+            reason.ends_with(&format!(
+                "; bytes 0..1 of {MODE} stated, 1..4 not; --assume-var-store {MODE}+1=<HEX of 3 \
+                 bytes> states it>"
+            )),
+            "UINT32 at VarOffset 0, a 2-byte efivar, byte 0 stated: {reason}"
+        );
+
+        // a UINT16 at VarOffset 1 of an EFI variable VarStore whose efivar holds 2 bytes
+        let uint16_one_of = [&question_header(1)[..], &[0x01], &[0x00; 6]].concat();
+        let cases = [
+            (
+                "byte 1 stated",
+                "+1=aa",
+                QuestionValue::Unreadable {
+                    kind: ValueKind::Uint,
+                    reason:
+                        "<ExtractEFIDataError: failed to fill whole buffer (offset: 1; buflen: \
+                             6); bytes 1..2 of VarStore-00000000-0000-0000-0000-000000000000 \
+                             stated, 2..3 not; --assume-var-store \
+                             VarStore-00000000-0000-0000-0000-000000000000+2=<HEX of 1 byte> \
+                             states it>"
+                            .to_string(),
+                },
+            ),
+            (
+                "bytes 1 and 2 stated",
+                "+1=aabb",
+                QuestionValue::Uint(0xBBAA),
+            ),
+        ];
+        for (name, stated, want) in cases {
+            assert_eq!(
+                value_in(
+                    ONE_OF,
+                    &uint16_one_of,
+                    var_store_of(&[0x00, 0x34]),
+                    &statements(&[format!(
+                        "VarStore-00000000-0000-0000-0000-000000000000{stated}"
+                    )]),
                 ),
-                Some(QuestionValue::Unreadable {
-                    kind,
-                    reason: reason.to_string(),
-                }),
-                "{name}, User"
+                want,
+                "UINT16 past a 2-byte efivar: {name}"
             );
         }
     }
 
-    /// A stated level replaces only the level byte: question 2 at VarOffset 1 of a 2-byte
-    /// SystemAccess is read as stored.
+    /// A condition reads only the bits of an EDKII bit varstore field from stated bytes, as from
+    /// its efivar: each case's efivar holds the stated byte's complement, or its other bytes.
     #[test]
-    fn stated_access_level_replaces_only_the_level_byte() {
-        let at_offset_1 = operation(
-            NUMERIC,
-            false,
-            &[question_header_on(2, 5, 2, 1), vec![0x00, 0, 255, 1]].concat(),
-        );
-        let question = checkbox_on(1, 3, 1);
-        let root = parse_form_set(&[
-            var_store_efi(1, "Present", NV_BS_RT, 1),
-            var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 2),
-            form(
-                1,
-                &[
-                    at_offset_1,
-                    conditional(
-                        SUPPRESS_IF,
-                        eq_id_val_of(2, 7),
-                        std::slice::from_ref(&question),
-                    ),
-                ],
+    fn stated_bit_field_reads_only_its_bits() {
+        let key = "VarStore-00000000-0000-0000-0000-000000000000";
+        let cases = [
+            (
+                "bit-field CHECKBOX set",
+                CHECKBOX,
+                checkbox(1, 0x00),
+                vec![0xFD],
+                format!("{key}=02"),
+                QuestionValue::Boolean(1),
             ),
-        ]);
-        let question = find_op(&root, &question[2..]).expect("find question 1");
-        let store = find_corresponding_varstore(Rc::clone(&question), 2);
-        let efivars = Efivars::new();
-        efivars.write(store.as_ref().expect("find VarStore 2").as_ref(), &[1, 7]);
-        let question = question.borrow();
-        for level in [
-            None,
-            Some(AccessLevel::Administrator),
-            Some(AccessLevel::User),
-        ] {
+            (
+                "bit-field CHECKBOX clear",
+                CHECKBOX,
+                checkbox(1, 0x00),
+                vec![0x02],
+                format!("{key}=fd"),
+                QuestionValue::Boolean(0),
+            ),
+            (
+                "3-bit NUMERIC at bit 2",
+                NUMERIC,
+                uint32_range_question(2, 0x43),
+                vec![0b0000_1000],
+                format!("{key}=f7"),
+                QuestionValue::Uint(0b101),
+            ),
+            (
+                "12-bit NUMERIC at bit 4, its second byte stated",
+                NUMERIC,
+                uint32_range_question(4, 0x4C),
+                vec![0x0F, 0xF0],
+                format!("{key}+1=ab"),
+                QuestionValue::Uint(0xAB0),
+            ),
+        ];
+        for (name, op_code, data, stored, stated, want) in cases {
+            let (_root, node) = parse_question_in_guid(BIT_VARSTORE_GUID, op_code, &data, &[]);
+            let bit_field = node.borrow();
+            let value_question = value_question(&bit_field).expect("a NUMERIC or CHECKBOX");
+            let VarStoreFixture { store, efivars } = var_store_of(&stored);
+            let assumed = statements(&[stated]);
             assert_eq!(
-                question_state(
-                    &question,
+                question_value(
+                    &node,
+                    value_question,
+                    &store,
+                    CheckedVarStores::unchecked(&assumed),
                     &mut ExpressionInputs {
                         reader: &mut efivars.reader(),
-                        values: &VarStoreValues::new(&root, level),
+                        values: &MapValues(BTreeMap::new()),
                     },
                 ),
-                known(QuestionState::Suppressed),
-                "{level:?}"
+                want,
+                "{name}"
+            );
+        }
+
+        // the flag names the StorageWidth bytes of a bit field
+        let cases = [
+            (
+                "bit 1",
+                checkbox(1, 0x00),
+                CHECKBOX,
+                1,
+                "+0=<HEX of 1 byte>",
+            ),
+            (
+                "3 bits at bit 10",
+                uint32_range_question(10, 0x43),
+                NUMERIC,
+                2,
+                "+1=<HEX of 1 byte>",
+            ),
+            (
+                "8 bits at bit 4",
+                uint32_range_question(4, 0x48),
+                NUMERIC,
+                2,
+                "+0=<HEX of 2 bytes>",
+            ),
+        ];
+        for (name, data, op_code, size, flag) in cases {
+            let (_root, node) = parse_question_in_guid(BIT_VARSTORE_GUID, op_code, &data, &[]);
+            let bit_field = node.borrow();
+            let value_question = value_question(&bit_field).expect("a NUMERIC or CHECKBOX");
+            let store: Result<Box<dyn VariableStore>> =
+                Ok(Box::new(efi_variable("VarStore", size)));
+            let QuestionValue::Unreadable { reason, .. } = question_value(
+                &node,
+                value_question,
+                &store,
+                CheckedVarStores::NONE,
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &MapValues(BTreeMap::new()),
+                },
+            ) else {
+                panic!("{name}: a value without an efivar");
+            };
+            assert!(
+                reason.ends_with(&format!("; --assume-var-store {key}{flag} states it>")),
+                "{name}: {reason}"
             );
         }
     }
 
-    /// A stated access level leaves a condition on another VarStore's question as its efivar
-    /// holds it.
+    /// Stated bytes change the states that list_questions lists, never an answer: the question
+    /// on them answers with its efivar's value, or with why it has none, without the flag.
     #[test]
-    fn stated_access_level_reads_other_var_stores() {
+    fn stated_bytes_leave_answers_as_stored() {
+        let mode = |rest: &str| format!("{MODE}{rest}");
         let question = checkbox_on(1, 3, 1);
         let root = parse_form_set(&[
             var_store_efi(1, "Present", NV_BS_RT, 1),
-            var_store(2, SYSTEM_ACCESS_GUID, "SystemAccess", 1),
-            var_store_efi(3, "Other", NV_BS_RT, 1),
+            var_store(2, MODE_GUID, "Mode", 2),
             form(
                 1,
                 &[
-                    checkbox_on(2, 5, 2),
-                    checkbox_on(3, 6, 3),
+                    checkbox_on(2, 7, 2),
                     conditional(
-                        GRAY_OUT_IF,
-                        eq_id_val_of(3, 1),
+                        SUPPRESS_IF,
+                        eq_id_val_of(2, 1),
                         std::slice::from_ref(&question),
                     ),
                 ],
             ),
         ]);
-        let question = find_op(&root, &question[2..]).expect("find question 1");
-        let efivars = Efivars::new();
-        efivars.write(&efi_variable("Other", 1), &[0]);
-        for level in [
-            None,
-            Some(AccessLevel::Administrator),
-            Some(AccessLevel::User),
-        ] {
-            assert_eq!(
-                question_state(
-                    &question.borrow(),
-                    &mut ExpressionInputs {
-                        reader: &mut efivars.reader(),
-                        values: &VarStoreValues::new(&root, level),
-                    },
-                ),
-                StateEvaluation {
-                    current: QuestionState::Selectable,
-                    unknown: Vec::new(),
-                    read_only: None,
-                    from_snapshot: Vec::new(),
-                },
-                "{level:?}"
-            );
-        }
+        let found = find_op(&root, &question[2..]).expect("find question 1");
+        let stored = Efivars::new();
+        let store = find_corresponding_varstore(Rc::clone(&found), 2);
+        stored.write(store.as_ref().expect("find VarStore 2").as_ref(), &[1, 0]);
+        stored.write(&efi_variable("Present", 1), &[0]);
+        let unread = Efivars::new();
+        let listed = |efivars: &Efivars, stated: &[String]| -> Vec<(String, String)> {
+            let assumed = statements(stated);
+            list_questions(
+                Rc::clone(&root),
+                &ListTexts::new(&strings(), &[]),
+                IncludedStates::empty(),
+                checked_in(&root, &assumed),
+                &mut efivars.reader(),
+            )
+            .into_iter()
+            .map(|(question, _)| (question.question, question.value))
+            .collect()
+        };
+        assert_eq!(
+            listed(&stored, &[]),
+            [("AllOnes".to_string(), "1".to_string())],
+            "stored 1, none stated"
+        );
+        assert_eq!(
+            listed(&stored, &[mode("=00")]),
+            [
+                ("AllOnes".to_string(), "1".to_string()),
+                (PROMPT.to_string(), "0".to_string())
+            ],
+            "stored 1, 00 stated: the question on Mode answers 1"
+        );
+        let unread_answer = format!(
+            "<ValueUnavailable: no EFI variable {MODE}; HII buffer varstore requires \
+             EFI_HII_CONFIG_ACCESS_PROTOCOL> <IFR default: 0>"
+        );
+        let unlisted = listed(&unread, &[mode("=00")]);
+        assert_eq!(
+            unlisted.first(),
+            Some(&("AllOnes".to_string(), unread_answer)),
+            "no efivar, 00 stated: the question on Mode has no answer"
+        );
     }
 
-    /// The value of a parsed question in `var_store`.
+    /// The value of a parsed question in `var_store`, with the bytes that `assumed` states,
+    /// unchecked: no FormSet declares `var_store`.
     fn value_in(
         op_code: u8,
         data: &[u8],
         VarStoreFixture { store, efivars }: VarStoreFixture,
+        assumed: &[AssumedVarStore],
     ) -> QuestionValue {
         let (_root, node) = parse_question(&[], op_code, data, &[]);
         let question = node.borrow();
@@ -7112,7 +8517,7 @@ mod tests {
             &node,
             value_question,
             &store,
-            None,
+            CheckedVarStores::unchecked(assumed),
             &mut ExpressionInputs {
                 reader: &mut efivars.reader(),
                 values: &MapValues(BTreeMap::new()),
@@ -7126,7 +8531,12 @@ mod tests {
         let cases = [
             (
                 "CHECKBOX byte as is",
-                value_in(CHECKBOX, &checkbox(1, 0x00), var_store_of(&[0x00, 0x02])),
+                value_in(
+                    CHECKBOX,
+                    &checkbox(1, 0x00),
+                    var_store_of(&[0x00, 0x02]),
+                    &[],
+                ),
                 QuestionValue::Boolean(2),
             ),
             (
@@ -7135,6 +8545,7 @@ mod tests {
                     ONE_OF,
                     &uint16_one_of,
                     var_store_of(&[0x00, 0x34, 0x12, 0xFF]),
+                    &[],
                 ),
                 QuestionValue::Uint(0x1234),
             ),
@@ -7144,22 +8555,25 @@ mod tests {
                     NUMERIC,
                     &uint32_range_question(1, 0x12),
                     var_store_of(&[0xFF, 0x01, 0x00, 0x00, 0x80, 0xFF]),
+                    &[],
                 ),
                 QuestionValue::Uint(0x8000_0001),
             ),
             (
                 "UINT16 ONE_OF past the VarStore",
-                value_in(ONE_OF, &uint16_one_of, var_store_of(&[0x00, 0x34])),
+                value_in(ONE_OF, &uint16_one_of, var_store_of(&[0x00, 0x34]), &[]),
                 QuestionValue::Unreadable {
                     kind: ValueKind::Uint,
                     reason: "<ExtractEFIDataError: failed to fill whole buffer (offset: 1; \
-                             buflen: 6)>"
+                             buflen: 6); --assume-var-store \
+                             VarStore-00000000-0000-0000-0000-000000000000+1=<HEX of 2 bytes> \
+                             states it>"
                         .to_string(),
                 },
             ),
             (
                 "CHECKBOX without a VarStore",
-                value_in(CHECKBOX, &checkbox(0, 0x00), unavailable()),
+                value_in(CHECKBOX, &checkbox(0, 0x00), unavailable(), &[]),
                 QuestionValue::Unreadable {
                     kind: ValueKind::Boolean,
                     reason: UNAVAILABLE.to_string(),
@@ -7204,7 +8618,7 @@ mod tests {
                     &node,
                     value_question,
                     &store,
-                    None,
+                    CheckedVarStores::NONE,
                     &mut ExpressionInputs {
                         reader: &mut efivars.reader(),
                         values: &MapValues(BTreeMap::new()),
@@ -7215,29 +8629,164 @@ mod tests {
             );
         }
     }
-}
 
-#[cfg(test)]
-#[cfg(efivar_dumps)]
-mod store_expression_tests {
-    use std::collections::BTreeMap;
+    /// The value of the EFI_IFR_VALUE expression `expression` with `values`.
+    fn value_with(
+        expression: Vec<u8>,
+        values: &impl QuestionValues,
+    ) -> std::result::Result<u64, String> {
+        let data = [operation(VALUE, true, &[]), expression, END.to_vec()].concat();
+        let root = handle_form_set(&mut Cursor::new(&[data, END.to_vec()].concat()))
+            .expect("parse the VALUE");
+        let scope = Rc::clone(&root.borrow().children[0]);
+        let scope = scope.borrow();
+        evaluate_value(
+            &scope,
+            &mut ExpressionInputs {
+                reader: &mut Efivars::new().reader(),
+                values,
+            },
+        )
+    }
 
-    use super::super::display_answer;
-    use super::super::ifr_fixtures::*;
-    use super::super::resolve_short_var_names;
-    use super::super::setup_password::PasswordQuestions;
-    use super::super::MAX_SCOPE_NESTING;
-    use super::*;
-    use crate::hii::config_snapshot::tests::warned_by;
-    use crate::hii::package::Guid;
-    use crate::hii::strings::StringMap;
-    use crate::hii::time_services::tests::FakeTimeServices;
-    use crate::hii::time_services::tests::TimeService;
-    use crate::hii::time_services::TimeServices;
-    use crate::hii::variables::VariableKey;
+    /// EFI_IFR_VERSION, the version of UEFI that the Forms Processor conforms to, comes from the
+    /// revision of the EFI System Table (UEFI 2.11 §33.3.8.3.93), which this does not read yet:
+    /// not evaluated, naming it.
+    #[test]
+    fn version_is_not_evaluated_naming_what_it_needs() {
+        const VERSION: u8 = 0x28;
+        assert_eq!(
+            value_with(op(VERSION), &values()),
+            Err("EFI_IFR_VERSION (the revision of the EFI System Table) not evaluated".to_string())
+        );
+    }
 
-    const MAP: u8 = 0x22;
-    const GET: u8 = 0x2B;
+    /// values(), with question 8 the DATE 2026-11-10.
+    fn values_with_a_date() -> MapValues {
+        let MapValues(mut values) = values();
+        values.insert(8, QuestionValue::Date([0xEA, 0x07, 11, 10]));
+        MapValues(values)
+    }
+
+    /// QUESTION_REF2 pushes the value of the question whose id it pops; an id that is no
+    /// unsigned integer up to 0xFFFF, or no question's, gives UNDEFINED, as both UEFI 2.11
+    /// §33.3.8.3.56 and edk2-stable202608 SetupBrowserDxe/Expression.c:3029-3053 say.
+    #[test]
+    fn question_ref2_pushes_the_value_of_the_question_of_the_popped_id() {
+        let undefined = Err("UNDEFINED result".to_string());
+        let unread = |id: u16| {
+            Err(format!(
+                "EFI_IFR_QUESTION_REF2 of question {id:#06x}: <ValueUnavailable: test>"
+            ))
+        };
+        let ref2 = |id: Vec<u8>| scoped_expression(&[id, op(QUESTION_REF2)], 0);
+        let cases = [
+            ("id 1, a UINT", ref2(uint8(1)), Ok(1)),
+            ("id 3, a BOOLEAN", ref2(uint8(3)), Ok(2)),
+            ("id 8, a DATE", ref2(uint8(8)), Ok(0x0A0B_07EA)),
+            (
+                "id 4, a UINT that cannot be read",
+                ref2(uint8(4)),
+                unread(4),
+            ),
+            ("id 6, of another type", ref2(uint8(6)), unread(6)),
+            ("id 9, of no question", ref2(uint8(9)), undefined.clone()),
+            ("id 0, reserved", ref2(uint8(0)), undefined.clone()),
+            (
+                "id 0x10001, over 0xFFFF",
+                ref2(operation(UINT32, false, &0x1_0001u32.to_le_bytes())),
+                undefined.clone(),
+            ),
+            (
+                "the UINT 0x10001 of question 2",
+                ref2(question_ref1(2)),
+                undefined.clone(),
+            ),
+            ("a BOOLEAN", ref2(ifr_true()), undefined.clone()),
+            ("a DATE", ref2(question_ref1(8)), undefined.clone()),
+            ("UNDEFINED", ref2(op(UNDEFINED)), undefined.clone()),
+            (
+                "an id that cannot be read",
+                ref2(question_ref1(4)),
+                Err("EFI_IFR_QUESTION_REF2 on a value that cannot be read".to_string()),
+            ),
+        ];
+        for (name, expression, want) in cases {
+            assert_eq!(
+                value_with(expression, &values_with_a_date()),
+                want,
+                "{name}"
+            );
+        }
+    }
+
+    /// A DISABLE_IF outside forms that relies on a question's value is not known, as UEFI 2.11
+    /// §33.3.8.3.14 allows it constants only; one of constants is.
+    #[test]
+    fn a_disable_if_outside_forms_is_not_known_where_it_relies_on_a_question() {
+        let constant = |condition: Vec<u8>| {
+            let body = operation(CHECKBOX, false, &checkbox(0, 0x00));
+            let data = conditional(DISABLE_IF, condition, &[body]);
+            let root = handle_form_set(&mut Cursor::new(&[data, END.to_vec()].concat()))
+                .expect("parse the DISABLE_IF");
+            let scope = Rc::clone(&root.borrow().children[0]);
+            let scope = scope.borrow();
+            constant_condition(&scope)
+        };
+        let relies_on = |name: &str| {
+            Truth::Unknown(format!(
+                "it relies on EFI_IFR_{name}, where a DISABLE_IF outside forms must only rely on \
+                 constants (UEFI 2.11 §33.3.8.3.14)"
+            ))
+        };
+        let cases = [
+            (
+                "QUESTION_REF2",
+                scoped_expression(&[uint8(1), op(QUESTION_REF2)], 0),
+                relies_on("QUESTION_REF2"),
+            ),
+            (
+                "QUESTION_REF3",
+                scoped_expression(&[uint8(1), op(QUESTION_REF3)], 0),
+                relies_on("QUESTION_REF3"),
+            ),
+            (
+                "QUESTION_REF1",
+                question_ref1(1),
+                relies_on("QUESTION_REF1"),
+            ),
+            ("TRUE", ifr_true(), Truth::Known(true)),
+        ];
+        for (name, condition, want) in cases {
+            assert_eq!(constant(condition), want, "{name}");
+        }
+    }
+}
+
+#[cfg(test)]
+#[cfg(efivar_dumps)]
+mod store_expression_tests {
+    use std::collections::BTreeMap;
+
+    use super::super::check_assumed;
+    use super::super::display_answer;
+    use super::super::ifr_fixtures::*;
+    use super::super::resolve_short_var_names;
+    use super::super::setup_password::PasswordQuestions;
+    use super::super::AssumedVarStore;
+    use super::super::PackageListFirst;
+    use super::super::MAX_SCOPE_NESTING;
+    use super::*;
+    use crate::hii::config_snapshot::tests::warned_by;
+    use crate::hii::package::Guid;
+    use crate::hii::strings::StringMap;
+    use crate::hii::time_services::tests::FakeTimeServices;
+    use crate::hii::time_services::tests::TimeService;
+    use crate::hii::time_services::TimeServices;
+    use crate::hii::variables::VariableKey;
+
+    const MAP: u8 = 0x22;
+    const GET: u8 = 0x2B;
     const SET: u8 = 0x2C;
     const AND: u8 = 0x15;
     const NOT_EQUAL: u8 = 0x30;
@@ -7258,6 +8807,9 @@ mod store_expression_tests {
     const VALUE: u8 = 0x5A;
     const GREATER_THAN: u8 = 0x31;
     const LESS_THAN: u8 = 0x33;
+    const EQ_ID_ID: u8 = 0x13;
+    const EQ_ID_VAL_LIST: u8 = 0x14;
+    const QUESTION_REF2: u8 = 0x41;
 
     /// The VARSTORE_EFI of the tests, of 5 bytes.
     const STORE: u16 = 2;
@@ -7429,8 +8981,17 @@ mod store_expression_tests {
         efivars: &Efivars,
     ) -> std::result::Result<Option<Vec<ComparedSet>>, ExpressionRefusal> {
         let (_root, question) = question_holding(children);
+        question_writes(&question, this, efivars)
+    }
+
+    /// The SETs of the WRITE of `question`, with THIS `this`, reading `efivars`.
+    fn question_writes(
+        question: &Rc<RefCell<IFROperation>>,
+        this: QuestionValue,
+        efivars: &Efivars,
+    ) -> std::result::Result<Option<Vec<ComparedSet>>, ExpressionRefusal> {
         let sets = evaluate_write(
-            &question,
+            question,
             this,
             &mut ExpressionInputs {
                 reader: &mut efivars.reader(),
@@ -7479,6 +9040,62 @@ mod store_expression_tests {
         );
     }
 
+    /// THIS in the EFI_IFR_VALUE of a question pushes that question's value, of each kind that
+    /// a question gives (UEFI 2.11 §33.3.8.3.77); without the question, edk2-stable202608
+    /// SetupBrowserDxe/Expression.c:2733-2738 fails.
+    #[test]
+    fn this_pushes_each_kind_of_question_value() {
+        let value = |values: MapValues| {
+            let (_root, question) = question_holding(&[value_of(op(THIS))]);
+            let scope = Rc::clone(&question.borrow().children[0]);
+            let scope = scope.borrow();
+            evaluate_value(
+                &scope,
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values,
+                },
+            )
+        };
+        let of = |value: QuestionValue| MapValues(BTreeMap::from([(1, value)]));
+        let unreadable = |kind: ValueKind| QuestionValue::Unreadable {
+            kind,
+            reason: "<ValueUnavailable: test>".to_string(),
+        };
+        let cases = [
+            ("a UINT", of(QuestionValue::Uint(3)), Ok(3)),
+            ("a BOOLEAN", of(QuestionValue::Boolean(1)), Ok(1)),
+            (
+                "a DATE",
+                of(QuestionValue::Date([0xEA, 0x07, 11, 10])),
+                Ok(0x0A0B_07EA),
+            ),
+            (
+                "a TIME",
+                of(QuestionValue::Time([23, 59, 58])),
+                Ok(0x3A_3B17),
+            ),
+            (
+                "a UINT that cannot be read",
+                of(unreadable(ValueKind::Uint)),
+                Err("EFI_IFR_THIS of question 0x0001: <ValueUnavailable: test>".to_string()),
+            ),
+            (
+                "a value of another kind",
+                of(unreadable(ValueKind::Other)),
+                Err("EFI_IFR_THIS of question 0x0001: <ValueUnavailable: test>".to_string()),
+            ),
+            (
+                "no question",
+                MapValues(BTreeMap::new()),
+                Err("malformed expression: EFI_IFR_THIS of missing question 0x0001".to_string()),
+            ),
+        ];
+        for (name, values, want) in cases {
+            assert_eq!(value(values), want, "{name}");
+        }
+    }
+
     /// THIS outside a question has no question to push, which edk2 fails on.
     #[test]
     fn this_outside_a_question_is_malformed() {
@@ -7581,6 +9198,113 @@ mod store_expression_tests {
         );
     }
 
+    /// A GET reads the bytes that --assume-var-store states of its VarStore in place of those of
+    /// the variable, as edk2-stable202608 SetupBrowserDxe/Expression.c reads the edit buffer of a
+    /// buffer VarStore; of a value that they state in part, the other bytes come from the
+    /// variable, and one that cannot give them leaves the value unknown, naming the bytes stated
+    /// and those not.
+    #[test]
+    fn get_reads_the_stated_var_store_bytes() {
+        const KEY: &str = "Buffer-00000000-0000-0000-0000-000000000000";
+        let byte_is_1 = scoped_expression(
+            &[get(BUFFER, 0, EFI_IFR_TYPE_NUM_SIZE_8), uint8(1), op(EQUAL)],
+            0,
+        );
+        let word_is_0x0201 = scoped_expression(
+            &[
+                get(BUFFER, 0, EFI_IFR_TYPE_NUM_SIZE_16),
+                uint16(0x0201),
+                op(EQUAL),
+            ],
+            0,
+        );
+        let stored = Efivars::new();
+        stored.write(&buffer_store("Buffer", 2), &[1, 2]);
+        let missing = Efivars::new();
+        let root = parse_form_set(&declarations());
+        let truth = |condition: &[u8], efivars: &Efivars, stated: &[&str]| {
+            let assumed: Vec<AssumedVarStore> = stated
+                .iter()
+                .map(|rest| format!("{KEY}{rest}").parse().expect("a statement"))
+                .collect();
+            let assumed = check_assumed([&root], &assumed).expect("check the statements");
+            truth_in(
+                condition.to_vec(),
+                efivars,
+                &VarStoreValues::new(&root, assumed),
+            )
+        };
+        let cases = [
+            (
+                "stored 01 02, none stated",
+                &byte_is_1,
+                &stored,
+                vec![],
+                true,
+            ),
+            (
+                "stored 01 02, 00 stated",
+                &byte_is_1,
+                &stored,
+                vec!["=00"],
+                false,
+            ),
+            (
+                "no efivar, 01 stated",
+                &byte_is_1,
+                &missing,
+                vec!["=01"],
+                true,
+            ),
+            (
+                "stored 01 02, 01 stated at byte 1",
+                &byte_is_1,
+                &stored,
+                vec!["+1=01"],
+                true,
+            ),
+            (
+                "stored 01 02, word, 00 stated at byte 1",
+                &word_is_0x0201,
+                &stored,
+                vec!["+1=00"],
+                false,
+            ),
+            (
+                "stored 01 02, word, 02 stated at byte 1",
+                &word_is_0x0201,
+                &stored,
+                vec!["+1=02"],
+                true,
+            ),
+            (
+                "no efivar, word, 0102 stated",
+                &word_is_0x0201,
+                &missing,
+                vec!["=0102"],
+                true,
+            ),
+        ];
+        for (name, condition, efivars, stated, want) in cases {
+            assert_eq!(
+                truth(condition, efivars, &stated),
+                Truth::Known(want),
+                "{name}"
+            );
+        }
+
+        let Truth::Unknown(reason) = truth(&word_is_0x0201, &missing, &["+1=02"]) else {
+            panic!("no efivar, word, 02 stated at byte 1: a value");
+        };
+        assert!(
+            reason.starts_with(
+                "EFI_IFR_GET of VarStore 0x0004 (EFI_IFR_VARSTORE \"Buffer\"), which cannot be \
+                 read: "
+            ) && reason.ends_with(&format!("; bytes 1..2 of {KEY} stated, 0..1 not")),
+            "no efivar, word, 02 stated at byte 1: {reason}"
+        );
+    }
+
     /// A GET reads no byte of the password of a PASSWORD question, through variables of either
     /// reach; a GET of the other bytes of its VarStore, or of another VarStore, reads them.
     #[test]
@@ -7644,6 +9368,73 @@ mod store_expression_tests {
         }
     }
 
+    /// The reason that a condition cannot read bytes that hold a password names no
+    /// --assume-var-store, which would put the password on a command line, nor does that of a
+    /// question on a VARSTORE_EFI before UEFI 2.3.1, whose variable holds that question's value
+    /// alone; that of a byte beside the password names it.
+    #[test]
+    fn unstateable_values_name_no_flag() {
+        let root = parse_form_set(&[
+            declarations().concat(),
+            form(
+                1,
+                &[
+                    password_on(9, 3, STORE, 1),
+                    checkbox_at(1, 1, STORE, 0),
+                    checkbox_at(2, 2, STORE, 1),
+                ],
+            ),
+        ]);
+        let mut reader = PasswordQuestions::of([&root])
+            .reader(Box::new(MemoryVariables::new(
+                VariableReach::Runtime,
+                VariableInterface::Efivarfs,
+            )))
+            .expect("resolve the VarStore of the PASSWORD question");
+        let referrer = find_op(&root, &checkbox_at(1, 1, STORE, 0)[2..]).expect("find question 1");
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+        let unreadable = |reason: &str| {
+            Some(QuestionValue::Unreadable {
+                kind: ValueKind::Boolean,
+                reason: reason.to_string(),
+            })
+        };
+        assert_eq!(
+            values.value(&referrer.borrow(), 1, &mut reader),
+            unreadable(
+                "<ValueUnavailable: no EFI variable Store-00000000-0000-0000-0000-000000000000; \
+                 --assume-var-store Store-00000000-0000-0000-0000-000000000000+0=<HEX of 1 byte> \
+                 states it>"
+            ),
+            "byte 0, before the password"
+        );
+        assert_eq!(
+            values.value(&referrer.borrow(), 2, &mut reader),
+            unreadable("<ValueUnavailable: its bytes hold a password>"),
+            "byte 1, of the password"
+        );
+
+        let missing = checkbox_at(1, 1, SHORT_EFI, 10);
+        let root = short_store_root(NV_BS_RT, &[form(1, std::slice::from_ref(&missing))]);
+        let referrer = find_op(&root, &missing[2..]).expect("find the question on ShortVarMissing");
+        let value = VarStoreValues::new(&root, CheckedVarStores::NONE).value(
+            &referrer.borrow(),
+            1,
+            &mut EfivarReader::with_variables(Box::new(short_variables(
+                VariableReach::Runtime,
+                VariableInterface::Efivarfs,
+            ))),
+        );
+        assert!(
+            matches!(
+                &value,
+                Some(QuestionValue::Unreadable { reason, .. })
+                    if reason.contains("ShortVarMissing") && !reason.contains("--assume-var-store")
+            ),
+            "ShortVarMissing: {value:?}"
+        );
+    }
+
     /// edk2 fails the FormSet of a GET of an undeclared VarStore or of a type that names no
     /// stored value, and the expression of an integer GET without a VarStore; a GET past the
     /// Size of its VarStore is malformed here too.
@@ -8018,6 +9809,13 @@ mod store_expression_tests {
     const RETURN_ENDS: &str = "edk2-stable202608 SetupBrowserDxe ends a return expression of \
                                EFI_IFR_MAP at the UNDEFINED of EFI_IFR_UNDEFINED, which the MAP \
                                gives";
+    /// EDK2_ENDS where a RULE_REF gives the UNDEFINED.
+    const RULE_REF_ENDS: &str = "edk2-stable202608 SetupBrowserDxe ends the expression at the \
+                                 UNDEFINED of EFI_IFR_RULE_REF";
+    /// EDK2_ENDS in the expression of a rule, whose RULE_REF gives that UNDEFINED.
+    const RULE_ENDS: &str = "edk2-stable202608 SetupBrowserDxe ends the expression of an \
+                             EFI_IFR_RULE at the UNDEFINED of EFI_IFR_UNDEFINED, which the \
+                             RULE_REF gives";
     /// What such refusals say of UEFI 2.11, before its result.
     const SPEC_DROPS: &str = "while UEFI 2.11 takes UNDEFINED as a value, which an \
                               EFI_IFR_CONDITIONAL drops (§33.2.5.7.4, §33.3.8.3.10), and gives";
@@ -8582,11 +10380,11 @@ mod store_expression_tests {
             ),
         ];
         for (name, value, shown) in spec_values {
-            let divergence = Divergence {
+            let divergence = Divergence::Dropped(DroppedUndefined {
                 ended: "EFI_IFR_UNDEFINED",
                 place: Place::Whole,
                 spec: SpecResult::Value(value),
-            };
+            });
             assert_eq!(divergence.truth(), Truth::Known(false), "condition, {name}");
             assert_eq!(
                 divergence.why_no_value(),
@@ -9586,61 +11384,273 @@ mod store_expression_tests {
         );
     }
 
-    /// What `run` gives of the first op of the WRITE expression `write`, with THIS 3, on a stack
-    /// that holds `operands`; with the refusal that the evaluation leaves, and the number of SETs
-    /// that it plans.
-    fn with_write_op<T>(
-        write: Vec<u8>,
-        operands: Vec<Operand>,
-        run: impl FnOnce(&mut Evaluation<'_, MapValues>, &IFROperation) -> T,
-    ) -> (T, ExpressionRefusal, usize) {
-        let (_root, question) = question_holding(&[op(WRITE), write]);
-        let expression = question_expression(&question, QuestionExpression::Write)
-            .expect("the question has a WRITE expression");
-        let first = expression.first().expect("the WRITE expression has an op");
-        let efivars = store_holding(&[0; 5]);
-        let mut reader = efivars.reader();
-        let values = no_values();
-        let mut inputs = ExpressionInputs {
-            reader: &mut reader,
-            values: &values,
+    /// A reference to the question whose READ or WRITE is evaluated pushes THIS: its stored value
+    /// in a READ, its new value in a WRITE, not the value that the question has elsewhere, as THIS
+    /// and that reference push the same HiiValue in edk2-stable202608 SetupBrowserDxe/Expression.c
+    /// (:853, :2733-2741) and UEFI 2.11 sets THIS to the question's value before the READ
+    /// (§33.3.8.3.58) or WRITE (§33.3.8.3.94). A reference to another question pushes that one's
+    /// value. QuestionId 0 is reserved (UEFI 2.11 §33.3.8.2.2), so in the READ or WRITE of a
+    /// question of QuestionId 0 a reference to that id finds no question (Expression.c:808-813).
+    #[test]
+    fn a_reference_to_the_question_that_is_read_or_written_pushes_this() {
+        let values = MapValues(BTreeMap::from([
+            (1, QuestionValue::Uint(2)),
+            (2, QuestionValue::Uint(9)),
+            (3, QuestionValue::Uint(3)),
+        ]));
+        let eq_id_id = |first: u16, second: u16| {
+            let data = [first.to_le_bytes(), second.to_le_bytes()].concat();
+            operation(EQ_ID_ID, false, &data)
         };
-        let mut sets = PlannedSets::default();
-        let mut evaluation = Evaluation::new(
-            &mut inputs,
-            Role::Write {
-                this: QuestionValue::Uint(3),
-                sets: &mut sets,
-            },
+        let eq_id_val_list = |id: u16, value: u16| {
+            let data = [id.to_le_bytes(), 1u16.to_le_bytes(), value.to_le_bytes()].concat();
+            operation(EQ_ID_VAL_LIST, false, &data)
+        };
+        let plus_one = |reference: Vec<u8>| scoped_expression(&[reference, op(ONE), op(ADD)], 0);
+        let current_ref3 = |id: u8| {
+            let data = [&[0, 0][..], &[0x11; 16]].concat();
+            [uint8(id), operation(QUESTION_REF3, false, &data)].concat()
+        };
+        let (root, questions) = form_set_of(&[one_of_with(
+            1,
+            STORE,
+            &[op(READ), plus_one(question_ref1(1))],
+        )]);
+        let referrer = questions[0].borrow();
+        assert_eq!(
+            VarStoreValues::new(&root, CheckedVarStores::NONE).value(
+                &referrer,
+                1,
+                &mut store_holding(&[5, 0, 0, 0, 0]).reader()
+            ),
+            Some(QuestionValue::Uint(6)),
+            "the value of a question of 5 whose READ is QUESTION_REF1 of itself plus 1"
         );
-        evaluation.frame.stack = operands;
-        let got = run(&mut evaluation, &first.borrow());
-        let refusal = evaluation.into_refusal(QuestionExpression::Write, "no gap".to_string());
-        (got, refusal, sets.var_store.len())
-    }
-
-    /// TO_BOOLEAN and SET do not evaluate a STRING or buffer here: they are refused as such,
-    /// and no SET is planned.
-    #[test]
-    fn to_boolean_and_set_refuse_strings_and_buffers() {
-        let string = Operand::String(Some("1".encode_utf16().collect()));
-        let buffer = Operand::Buffer(Some([1].into()));
-        let set_of_store = || set(STORE, 0, EFI_IFR_TYPE_NUM_SIZE_8);
-        let cases = [
+        let of_question_0 = |expression: &[Vec<u8>]| {
+            let (root, questions) = form_set_of(&[one_of_with(0, STORE, expression)]);
             (
-                op(TO_BOOLEAN),
-                string.clone(),
-                "EFI_IFR_TO_BOOLEAN of a STRING",
+                VarStoreValues::new(&root, CheckedVarStores::NONE),
+                Rc::clone(&questions[0]),
+            )
+        };
+        let (values_of_0, question) = of_question_0(&[op(READ), plus_one(question_ref1(0))]);
+        assert_eq!(
+            evaluate_read(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values_of_0,
+                },
             ),
-            (
-                op(TO_BOOLEAN),
-                buffer.clone(),
-                "EFI_IFR_TO_BOOLEAN of a buffer",
+            ReadOutcome::Stored,
+            "a READ of a question of QuestionId 0, QUESTION_REF1 of QuestionId 0"
+        );
+        let (values_of_0, question) = of_question_0(&[
+            op(WRITE),
+            scoped_expression(
+                &[question_ref1(0), set(STORE, 0, EFI_IFR_TYPE_NUM_SIZE_8)],
+                0,
             ),
-            (set_of_store(), string, "EFI_IFR_SET of a STRING"),
-            (set_of_store(), buffer, "EFI_IFR_SET of a buffer"),
-        ];
-        for (write, operand, what) in cases {
+        ]);
+        assert_eq!(
+            evaluate_write(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut store_holding(&[0; 5]).reader(),
+                    values: &values_of_0,
+                },
+            )
+            .map(|sets| sets.map(|sets| sets.var_store.len())),
+            Err(ExpressionRefusal::Malformed {
+                expression: QuestionExpression::Write,
+                reason: "EFI_IFR_QUESTION_REF1 of missing question 0x0000".to_string(),
+            }),
+            "a WRITE of a question of QuestionId 0, QUESTION_REF1 of QuestionId 0"
+        );
+        let read = |expression: Vec<u8>| {
+            let (_root, question) = question_holding(&[op(READ), expression]);
+            evaluate_read(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values,
+                },
+            )
+        };
+        let cases = [
+            (
+                "QUESTION_REF1 of the read question",
+                plus_one(question_ref1(1)),
+                ExpressionValue::Uint(4),
+            ),
+            (
+                "QUESTION_REF1 of another question",
+                plus_one(question_ref1(2)),
+                ExpressionValue::Uint(10),
+            ),
+            (
+                "EQ_ID_VAL of the read question",
+                eq_id_val_of(1, 3),
+                ExpressionValue::Boolean(1),
+            ),
+            (
+                "EQ_ID_VAL of another question",
+                eq_id_val_of(2, 3),
+                ExpressionValue::Boolean(0),
+            ),
+            (
+                "EQ_ID_ID of the read question",
+                eq_id_id(1, 3),
+                ExpressionValue::Boolean(1),
+            ),
+            (
+                "EQ_ID_ID of another question",
+                eq_id_id(2, 3),
+                ExpressionValue::Boolean(0),
+            ),
+            (
+                "EQ_ID_VAL_LIST of the read question",
+                eq_id_val_list(1, 3),
+                ExpressionValue::Boolean(1),
+            ),
+            (
+                "EQ_ID_VAL_LIST of another question",
+                eq_id_val_list(2, 3),
+                ExpressionValue::Boolean(0),
+            ),
+            (
+                "QUESTION_REF2 of the read question",
+                scoped_expression(&[uint8(1), op(QUESTION_REF2), op(ONE), op(ADD)], 0),
+                ExpressionValue::Uint(4),
+            ),
+            (
+                "QUESTION_REF2 of another question",
+                scoped_expression(&[uint8(2), op(QUESTION_REF2), op(ONE), op(ADD)], 0),
+                ExpressionValue::Uint(10),
+            ),
+            (
+                "QUESTION_REF3 of the current FormSet's Guid and the read question",
+                scoped_expression(&[current_ref3(1), op(ONE), op(ADD)], 0),
+                ExpressionValue::Uint(4),
+            ),
+            (
+                "QUESTION_REF3 of the current FormSet's Guid and another question",
+                scoped_expression(&[current_ref3(2), op(ONE), op(ADD)], 0),
+                ExpressionValue::Uint(10),
+            ),
+        ];
+        for (name, expression, want) in cases {
+            assert_eq!(read(expression), ReadOutcome::Value(want), "a READ, {name}");
+        }
+
+        let efivars = store_holding(&[0; 5]);
+        let write = |reference: Vec<u8>| {
+            let expression =
+                scoped_expression(&[reference, set(STORE, 0, EFI_IFR_TYPE_NUM_SIZE_8)], 0);
+            let (_root, question) = question_holding(&[op(WRITE), expression]);
+            let sets = evaluate_write(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            );
+            sets.map(|sets| {
+                sets.map(|sets| sets.var_store.into_iter().map(|set| set.bytes).collect())
+            })
+        };
+        assert_eq!(
+            write(question_ref1(1)),
+            Ok(Some(vec![vec![3]])),
+            "a WRITE, QUESTION_REF1 of the written question"
+        );
+        assert_eq!(
+            write(question_ref1(2)),
+            Ok(Some(vec![vec![9]])),
+            "a WRITE, QUESTION_REF1 of another question"
+        );
+        assert_eq!(
+            write([uint8(1), op(QUESTION_REF2)].concat()),
+            Ok(Some(vec![vec![3]])),
+            "a WRITE, QUESTION_REF2 of the written question"
+        );
+        assert_eq!(
+            write([uint8(2), op(QUESTION_REF2)].concat()),
+            Ok(Some(vec![vec![9]])),
+            "a WRITE, QUESTION_REF2 of another question"
+        );
+        assert_eq!(
+            write(current_ref3(1)),
+            Ok(Some(vec![vec![3]])),
+            "a WRITE, QUESTION_REF3 of the current FormSet's Guid and the written question"
+        );
+        assert_eq!(
+            write(current_ref3(2)),
+            Ok(Some(vec![vec![9]])),
+            "a WRITE, QUESTION_REF3 of the current FormSet's Guid and another question"
+        );
+    }
+
+    /// What `run` gives of the first op of the WRITE expression `write`, with THIS 3, on a stack
+    /// that holds `operands`; with the refusal that the evaluation leaves, and the number of SETs
+    /// that it plans.
+    fn with_write_op<T>(
+        write: Vec<u8>,
+        operands: Vec<Operand>,
+        run: impl FnOnce(&mut Evaluation<'_, MapValues>, &IFROperation) -> T,
+    ) -> (T, ExpressionRefusal, usize) {
+        let (_root, question) = question_holding(&[op(WRITE), write]);
+        let expression = question_expression(&question, QuestionExpression::Write)
+            .expect("the question has a WRITE expression");
+        let first = expression.first().expect("the WRITE expression has an op");
+        let efivars = store_holding(&[0; 5]);
+        let mut reader = efivars.reader();
+        let values = no_values();
+        let mut inputs = ExpressionInputs {
+            reader: &mut reader,
+            values: &values,
+        };
+        let mut sets = PlannedSets::default();
+        let mut evaluation = Evaluation::new(
+            &mut inputs,
+            Role::Write {
+                question: Some(1),
+                this: QuestionValue::Uint(3),
+                sets: &mut sets,
+            },
+        );
+        evaluation.frame.stack = operands;
+        let got = run(&mut evaluation, &first.borrow());
+        let refusal = evaluation.into_refusal(QuestionExpression::Write, "no gap".to_string());
+        (got, refusal, sets.var_store.len())
+    }
+
+    /// TO_BOOLEAN and SET do not evaluate a STRING or buffer here: they are refused as such,
+    /// and no SET is planned.
+    #[test]
+    fn to_boolean_and_set_refuse_strings_and_buffers() {
+        let string = Operand::String(Some("1".encode_utf16().collect()));
+        let buffer = Operand::Buffer(Some([1].into()));
+        let set_of_store = || set(STORE, 0, EFI_IFR_TYPE_NUM_SIZE_8);
+        let cases = [
+            (
+                op(TO_BOOLEAN),
+                string.clone(),
+                "EFI_IFR_TO_BOOLEAN of a STRING",
+            ),
+            (
+                op(TO_BOOLEAN),
+                buffer.clone(),
+                "EFI_IFR_TO_BOOLEAN of a buffer",
+            ),
+            (set_of_store(), string, "EFI_IFR_SET of a STRING"),
+            (set_of_store(), buffer, "EFI_IFR_SET of a buffer"),
+        ];
+        for (write, operand, what) in cases {
             let (got, refusal, sets) =
                 with_write_op(write, vec![operand], |evaluation, op| evaluation.step(op));
             assert_eq!(
@@ -10411,7 +12421,7 @@ mod store_expression_tests {
         let question = &questions[0];
         let id = value_question(&question.borrow()).map(|question| question.header().var_store_id);
         let store = || find_corresponding_varstore(Rc::clone(question), id.unwrap_or_default());
-        let values = VarStoreValues::new(&root, None);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
         let shown = display_answer(
             question,
             &store(),
@@ -10506,7 +12516,7 @@ mod store_expression_tests {
             &find_corresponding_varstore(Rc::clone(question), id.unwrap_or_default()),
             &mut ExpressionInputs {
                 reader: &mut reader(),
-                values: &VarStoreValues::new(&root, None),
+                values: &VarStoreValues::new(&root, CheckedVarStores::NONE),
             },
         );
         let strings = strings();
@@ -10515,7 +12525,7 @@ mod store_expression_tests {
             Rc::clone(&root),
             &texts,
             IncludedStates::all(),
-            None,
+            CheckedVarStores::NONE,
             &mut reader(),
         )
         .into_iter()
@@ -10733,7 +12743,7 @@ mod store_expression_tests {
             one_of_with(2, 0, &[op(READ), question_ref1(3)]),
             one_of_with(3, 0, &[op(READ), question_ref1(2)]),
         ]);
-        let values = VarStoreValues::new(&root, None);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
         let efivars = store_holding(&[0, 3, 0, 0, 0]);
         let mut reader = efivars.reader();
         let referrer = questions[0].borrow();
@@ -10778,7 +12788,7 @@ mod store_expression_tests {
                         })
                         .collect();
                     let (root, questions) = form_set_of(&questions);
-                    let values = VarStoreValues::new(&root, None);
+                    let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
                     let efivars = store_holding(&[0, 3, 0, 0, 0]);
                     let referrer = questions[0].borrow();
                     values.value(&referrer, 1, &mut efivars.reader())
@@ -10801,4 +12811,1964 @@ mod store_expression_tests {
             "reason of a chain of 50: {reason}"
         );
     }
+
+    const QUESTION_REF3: u8 = 0x51;
+
+    /// Without a FormSet GUID, edk2-stable202608 SetupBrowserDxe/Expression.c
+    /// GetQuestionValueFromForm takes the question in FormSet order, with IdToQuestion (FormSet,
+    /// NULL, ...) (:2524), while with the Guid of the current FormSet it takes it from the
+    /// referrer's form first (:2925), as QUESTION_REF1 does (:2735); UEFI 2.11 gives each
+    /// question of a FormSet its own QuestionId (§33.2.5.4).
+    #[test]
+    fn question_ref3_without_a_guid_takes_the_question_in_form_set_order() {
+        let numeric = |offset: u16| {
+            let data = [
+                question_header_on(1, 3, STORE, offset),
+                vec![0x00, 0, 255, 1],
+            ]
+            .concat();
+            operation(NUMERIC, false, &data)
+        };
+        let value = |expression: Vec<u8>| {
+            let declarations = declarations();
+            let root = parse_form_set(&[
+                declarations.concat(),
+                form(1, &[numeric(0)]),
+                form(2, &[numeric(1), value_of(expression)]),
+            ]);
+            let form_set = marked(&root, Some(PackageListFirst::Own));
+            let form = Rc::clone(&form_set.borrow().children[declarations.len() + 1]);
+            let scope = Rc::clone(&form.borrow().children[1]);
+            let scope = scope.borrow();
+            evaluate_value(
+                &scope,
+                &mut ExpressionInputs {
+                    reader: &mut store_holding(&[7, 9, 0, 0, 0]).reader(),
+                    values: &VarStoreValues::new(&root, CheckedVarStores::NONE),
+                },
+            )
+        };
+        let ref3 =
+            |data: &[u8]| scoped_expression(&[uint8(1), operation(QUESTION_REF3, false, data)], 0);
+        assert_eq!(value(ref3(&[])), Ok(7), "QUESTION_REF3 without a Guid");
+        assert_eq!(
+            value(ref3(&[&[0, 0][..], &[0x11; 16]].concat())),
+            Ok(9),
+            "QUESTION_REF3 with the Guid of the current FormSet"
+        );
+        assert_eq!(
+            value(operation(QUESTION_REF1, false, &1u16.to_le_bytes())),
+            Ok(9),
+            "QUESTION_REF1"
+        );
+    }
+
+    /// The FORM_SET op of `root`, marked with `first`, as read_package_list would mark it.
+    fn marked(
+        root: &Rc<RefCell<IFROperation>>,
+        first: Option<PackageListFirst>,
+    ) -> Rc<RefCell<IFROperation>> {
+        let form_set = Rc::clone(&root.borrow().children[0]);
+        {
+            let mut borrowed = form_set.borrow_mut();
+            let ParsedOperation::FormSet(parsed) = &mut borrowed.parsed_data else {
+                panic!("a FORM_SET op first");
+            };
+            parsed.package_list_first = first;
+        }
+        form_set
+    }
+
+    /// The value of `expression` in an EFI_IFR_VALUE of a FormSet of Guid 0x11 bytes, which
+    /// read_package_list would mark with `first`, with `values`.
+    fn value_in_form_set(
+        expression: Vec<u8>,
+        first: Option<PackageListFirst>,
+        values: &impl QuestionValues,
+    ) -> std::result::Result<u64, String> {
+        let root = parse_form_set(&[value_of(expression)]);
+        let form_set = marked(&root, first);
+        let scope = Rc::clone(&form_set.borrow().children[0]);
+        let scope = scope.borrow();
+        evaluate_value(
+            &scope,
+            &mut ExpressionInputs {
+                reader: &mut Efivars::new().reader(),
+                values,
+            },
+        )
+    }
+
+    /// QUESTION_REF3 pushes the value of the question whose id it pops, from the FormSet that its
+    /// DevicePath and Guid name. Without them, UEFI 2.11 §33.3.8.3.57 takes the current FormSet,
+    /// edk2-stable202608 SetupBrowserDxe/Expression.c (:2917-2923) the first of the package list;
+    /// with the Guid of another FormSet, the spec takes that one, edk2 the current one
+    /// (:2924-2934); without them, in the WRITE of the question, edk2 retrieves it anew, before
+    /// the write (:2561-2567; Setup.c:1995-1998), the spec takes THIS, which EFI_IFR_WRITE sets
+    /// (§33.3.8.3.94). Where they differ, the result is undetermined, naming both: a condition is
+    /// unknown, a READ and a WRITE are refused, the WRITE before any SET; past where edk2 ends the
+    /// expression, it is the spec's. A DevicePath is not evaluated.
+    #[test]
+    fn question_ref3_takes_the_question_from_the_form_set_that_it_names() {
+        let values = MapValues(BTreeMap::from([
+            (1, QuestionValue::Uint(3)),
+            (
+                4,
+                QuestionValue::Unreadable {
+                    kind: ValueKind::Uint,
+                    reason: "<ValueUnavailable: test>".to_string(),
+                },
+            ),
+        ]));
+        let ref3 = |id: Vec<u8>, data: &[u8]| {
+            scoped_expression(&[id, operation(QUESTION_REF3, false, data)], 0)
+        };
+        let path = |device_path: u16| device_path.to_le_bytes().to_vec();
+        let path_and_guid = |guid: u8| [path(0), vec![guid; 16]].concat();
+        let own = Some(PackageListFirst::Own);
+        let first_other = Some(PackageListFirst::Other(Some(Guid::from([0x22; 16]))));
+        let first_other_guid = "FormSet 22222222-2222-2222-2222-222222222222";
+        let without_guid = |id: u16, first: &str, spec: &str| {
+            Err(format!(
+                "EFI_IFR_QUESTION_REF3 of question {id:#06x} without a FormSet GUID: \
+                 edk2-stable202608 SetupBrowserDxe/Expression.c GetQuestionValueFromForm takes it \
+                 from {first}, the first of the package list (:2917-2923; Setup.c:6075), while \
+                 UEFI 2.11 takes it from the current FormSet (§33.3.8.3.57), which gives {spec}"
+            ))
+        };
+        let other_guid = |id: u16, edk2: &str| {
+            Err(format!(
+                "EFI_IFR_QUESTION_REF3 of question {id:#06x} of FormSet \
+                 33333333-3333-3333-3333-333333333333: edk2-stable202608 \
+                 SetupBrowserDxe/Expression.c takes it from the current FormSet (:2924-2934), \
+                 which gives {edk2}, while UEFI 2.11 takes it from FormSet \
+                 33333333-3333-3333-3333-333333333333 (§33.3.8.3.57)"
+            ))
+        };
+        let undefined = Err("UNDEFINED result".to_string());
+        let cases = [
+            (
+                "no DevicePath, the first FormSet",
+                ref3(uint8(1), &[]),
+                own,
+                Ok(3),
+            ),
+            (
+                "DevicePath 0, the first FormSet",
+                ref3(uint8(1), &path(0)),
+                own,
+                Ok(3),
+            ),
+            (
+                "DevicePath 0, a Nil Guid, the first FormSet",
+                ref3(uint8(1), &path_and_guid(0)),
+                own,
+                Ok(3),
+            ),
+            (
+                "the Guid of the current FormSet, not the first",
+                ref3(uint8(1), &path_and_guid(0x11)),
+                first_other,
+                Ok(3),
+            ),
+            (
+                "no DevicePath, not the first FormSet",
+                ref3(uint8(1), &[]),
+                first_other,
+                without_guid(1, first_other_guid, "3"),
+            ),
+            (
+                "no DevicePath, after a FORM_SET op without a GUID",
+                ref3(uint8(1), &[]),
+                Some(PackageListFirst::Other(None)),
+                without_guid(1, "a FORM_SET op too short for a GUID", "3"),
+            ),
+            (
+                "no DevicePath, not the first FormSet, no question",
+                ref3(uint8(9), &[]),
+                first_other,
+                without_guid(9, first_other_guid, "UNDEFINED"),
+            ),
+            (
+                "the Guid of another FormSet",
+                ref3(uint8(1), &path_and_guid(0x33)),
+                own,
+                other_guid(1, "3"),
+            ),
+            (
+                "the Guid of another FormSet, no question",
+                ref3(uint8(9), &path_and_guid(0x33)),
+                own,
+                other_guid(9, "UNDEFINED"),
+            ),
+            (
+                "the Guid of another FormSet, a question that cannot be read",
+                ref3(uint8(4), &path_and_guid(0x33)),
+                own,
+                other_guid(4, "a value that cannot be read"),
+            ),
+            (
+                "a DevicePath",
+                ref3(uint8(1), &path(5)),
+                own,
+                Err(
+                    "EFI_IFR_QUESTION_REF3 with a DevicePath (a device path converted from \
+                     text) not evaluated"
+                        .to_string(),
+                ),
+            ),
+            (
+                "a DevicePath, id 0x10001",
+                ref3(
+                    operation(UINT32, false, &0x1_0001u32.to_le_bytes()),
+                    &path(5),
+                ),
+                own,
+                undefined.clone(),
+            ),
+            ("no question", ref3(uint8(9), &[]), own, undefined.clone()),
+            (
+                "a BOOLEAN id",
+                ref3(ifr_true(), &[]),
+                own,
+                undefined.clone(),
+            ),
+            (
+                "an id that cannot be read",
+                ref3(operation(QUESTION_REF1, false, &4u16.to_le_bytes()), &[]),
+                own,
+                Err("EFI_IFR_QUESTION_REF3 on a value that cannot be read".to_string()),
+            ),
+            (
+                "no DevicePath, a FormSet of an unknown package list",
+                ref3(uint8(1), &[]),
+                None,
+                Err(
+                    "EFI_IFR_QUESTION_REF3 without a FormSet GUID in a FormSet of an unknown \
+                     package list not evaluated"
+                        .to_string(),
+                ),
+            ),
+            (
+                "not the first FormSet, past an UNDEFINED that a CONDITIONAL drops",
+                scoped_expression(
+                    &[
+                        ifr_true(),
+                        op(UNDEFINED),
+                        uint8(1),
+                        operation(QUESTION_REF3, false, &[]),
+                        op(CONDITIONAL),
+                    ],
+                    0,
+                ),
+                first_other,
+                Err(format!("{EDK2_ENDS}, {SPEC_DROPS} 3")),
+            ),
+            (
+                "the Guid of another FormSet, past an UNDEFINED that a CONDITIONAL drops",
+                scoped_expression(
+                    &[
+                        ifr_true(),
+                        op(UNDEFINED),
+                        uint8(1),
+                        operation(QUESTION_REF3, false, &path_and_guid(0x33)),
+                        op(CONDITIONAL),
+                    ],
+                    0,
+                ),
+                own,
+                Err(format!(
+                    "{EDK2_ENDS}, {SPEC_DROPS} a value that uefisettings cannot evaluate: \
+                     EFI_IFR_QUESTION_REF3 of question 0x0001 of FormSet \
+                     33333333-3333-3333-3333-333333333333, another FormSet"
+                )),
+            ),
+        ];
+        for (name, expression, first, want) in cases {
+            assert_eq!(
+                value_in_form_set(expression, first, &values),
+                want,
+                "{name}"
+            );
+        }
+        let root = parse_form_set(&[form_set_with_guid(
+            [0xB0; 16],
+            &[value_of(ref3(uint8(1), &[]))],
+        )]);
+        let nested = Rc::clone(&root.borrow().children[0].borrow().children[0]);
+        let scope = Rc::clone(&nested.borrow().children[0]);
+        assert_eq!(
+            evaluate_value(
+                &scope.borrow(),
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values,
+                },
+            ),
+            Err(
+                "EFI_IFR_QUESTION_REF3 without a FormSet GUID in a FormSet nested in another \
+                 FormSet not evaluated"
+                    .to_string()
+            ),
+            "no DevicePath, a FormSet nested in another FormSet"
+        );
+
+        assert_eq!(
+            read_of(
+                &[op(READ), ref3(uint8(1), &path_and_guid(0x33))],
+                QuestionValue::Uint(3),
+                &Efivars::new()
+            ),
+            ReadOutcome::Refused(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Read,
+                reason: other_guid(1, "3").expect_err("a refusal"),
+            }),
+            "a READ, the Guid of another FormSet"
+        );
+        assert_eq!(
+            truth_in(
+                ref3(uint8(1), &path_and_guid(0x33)),
+                &Efivars::new(),
+                &no_values()
+            ),
+            Truth::Unknown(other_guid(1, "UNDEFINED").expect_err("a divergence")),
+            "a condition, the Guid of another FormSet"
+        );
+
+        let write = |first: Option<PackageListFirst>, this: u8, ops: &[Vec<u8>]| {
+            let (root, question) = question_holding(&[op(WRITE), scoped_expression(ops, 0)]);
+            marked(&root, first);
+            let sets = evaluate_write(
+                &question,
+                QuestionValue::Uint(this.into()),
+                &mut ExpressionInputs {
+                    reader: &mut store_holding(&[0; 5]).reader(),
+                    values: &values,
+                },
+            );
+            sets.map(|sets| {
+                sets.map(|sets| {
+                    let sets = sets.var_store.into_iter();
+                    sets.map(|set| (set.offset, set.bytes)).collect::<Vec<_>>()
+                })
+            })
+        };
+        let this_set = [op(THIS), set(STORE, 0, EFI_IFR_TYPE_NUM_SIZE_8)].concat();
+        let set_of = |id: Vec<u8>, data: &[u8]| {
+            [
+                this_set.clone(),
+                id,
+                operation(QUESTION_REF3, false, data),
+                op(AND),
+            ]
+        };
+        let refused = |reason: String| {
+            Err(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Write,
+                reason,
+            })
+        };
+        assert_eq!(
+            write(own, 3, &set_of(uint8(1), &path_and_guid(0x33))),
+            refused(other_guid(1, "3").expect_err("a divergence")),
+            "a WRITE, a SET, then the Guid of another FormSet"
+        );
+        assert_eq!(
+            write(own, 3, &set_of(uint8(1), &path_and_guid(0x11))),
+            Ok(Some(vec![(0, vec![3])])),
+            "a WRITE, a SET, then the Guid of the current FormSet"
+        );
+        assert_eq!(
+            write(own, 5, &set_of(uint8(1), &[])),
+            refused(
+                "EFI_IFR_QUESTION_REF3 of question 0x0001 without a FormSet GUID, in the WRITE of \
+                 that question: edk2-stable202608 SetupBrowserDxe/Expression.c \
+                 GetQuestionValueFromForm retrieves it anew (:2561-2567) before Setup.c \
+                 SetQuestionValue writes it (:1995-1998), which gives 3, while UEFI 2.11 takes \
+                 the question of the current FormSet (§33.3.8.3.57), whose value is THIS in its \
+                 WRITE (§33.3.8.3.94), which gives 5"
+                    .to_string()
+            ),
+            "a WRITE, a SET, then no Guid and the written question, the first FormSet"
+        );
+        assert_eq!(
+            write(own, 5, &set_of(uint8(2), &[])),
+            Ok(Some(vec![(0, vec![5])])),
+            "a WRITE, a SET, then no Guid and another question, the first FormSet"
+        );
+        assert_eq!(
+            write(first_other, 5, &set_of(uint8(1), &[])),
+            refused(without_guid(1, first_other_guid, "5").expect_err("a divergence")),
+            "a WRITE, a SET, then no Guid and the written question, not the first FormSet"
+        );
+        assert_eq!(
+            write(
+                own,
+                5,
+                &[
+                    ifr_true(),
+                    op(UNDEFINED),
+                    uint8(1),
+                    operation(QUESTION_REF3, false, &[]),
+                    op(CONDITIONAL),
+                ]
+            ),
+            Ok(Some(Vec::new())),
+            "a WRITE, no Guid and the written question past an UNDEFINED that a CONDITIONAL \
+             drops, the first FormSet"
+        );
+    }
+
+    const RULE: u8 = 0x18;
+    const RULE_REF: u8 = 0x3F;
+
+    /// An EFI_IFR_RULE of `rule_id` whose expression is `expression`.
+    fn rule(rule_id: u8, expression: Vec<u8>) -> Vec<u8> {
+        [operation(RULE, true, &[rule_id]), expression, END.to_vec()].concat()
+    }
+
+    fn rule_ref(rule_id: u8) -> Vec<u8> {
+        operation(RULE_REF, false, &[rule_id])
+    }
+
+    /// The value of `expression` in an EFI_IFR_VALUE of FORM 1, after `rules`, with `values`.
+    fn value_in_form(
+        rules: &[Vec<u8>],
+        expression: Vec<u8>,
+        values: &impl QuestionValues,
+    ) -> std::result::Result<u64, String> {
+        let root = parse_form_set(&[form(1, &[rules.concat(), value_of(expression)])]);
+        let form_set = Rc::clone(&root.borrow().children[0]);
+        let form = Rc::clone(&form_set.borrow().children[0]);
+        let scope = Rc::clone(&form.borrow().children[rules.len()]);
+        let scope = scope.borrow();
+        evaluate_value(
+            &scope,
+            &mut ExpressionInputs {
+                reader: &mut Efivars::new().reader(),
+                values,
+            },
+        )
+    }
+
+    /// RULE_REF pushes the value of the expression of the rule of its RuleId in the form that holds
+    /// it, evaluated on a stack of its own (UEFI 2.11 §33.3.8.3.64; edk2-stable202608
+    /// SetupBrowserDxe/Expression.c:2939-2959); without the rule, UNDEFINED. Inside a rule, a
+    /// malformed expression gives UNDEFINED, also past the rule's own UNDEFINED, as edk2 gives for
+    /// a rule that fails (:2952-2956), while an op that is not evaluated and a value that cannot be
+    /// read are as elsewhere; a RULE_REF within the evaluation of its own rule, where edk2 recurses
+    /// without end, is malformed, also past where edk2 ends the expression. Two rules of one
+    /// RuleId, where UEFI 2.11 §33.3.8.3.63 marks the form invalid and edk2 takes the first, are
+    /// undetermined, a READ of them refused; past where edk2 ends the expression, the spec's result
+    /// is not evaluated. A rule in the scope of an opcode above EFI_IFR_MATCH2_OP, which edk2
+    /// SetupBrowserDxe/IfrParse.c ParseOpCodes skips (:1374-1381), is no rule of the form.
+    #[test]
+    fn rule_ref_pushes_the_value_of_its_rule() {
+        let values = MapValues(BTreeMap::from([(
+            4,
+            QuestionValue::Unreadable {
+                kind: ValueKind::Uint,
+                reason: "<ValueUnavailable: test>".to_string(),
+            },
+        )]));
+        let rules = [
+            rule(1, uint8(5)),
+            rule(2, scoped_expression(&[rule_ref(1), uint8(1), op(ADD)], 0)),
+            rule(3, op(UNDEFINED)),
+            rule(4, scoped_expression(&[op(ONE), op(ONE)], 0)),
+            rule(5, rule_ref(5)),
+            rule(6, rule_ref(7)),
+            rule(7, rule_ref(6)),
+            rule(8, op(TO_UINT)),
+            rule(9, operation(QUESTION_REF1, false, &4u16.to_le_bytes())),
+            rule(
+                10,
+                scoped_expression(&[ifr_true(), op(UNDEFINED), op(ONE), op(CONDITIONAL)], 0),
+            ),
+            rule(11, uint8(1)),
+            rule(11, uint8(2)),
+            rule(12, op(THIS)),
+            rule(13, scoped_expression(&[op(ONE), op(ADD)], 0)),
+            rule(
+                14,
+                scoped_expression(
+                    &[
+                        uint8(1),
+                        map(&[(scoped_expression(&[op(ONE), op(ONE)], 0), uint8(10))]),
+                    ],
+                    0,
+                ),
+            ),
+            [operation(0x70, true, &[]), rule(15, uint8(3)), END.to_vec()].concat(),
+            rule(17, scoped_expression(&[op(UNDEFINED), op(ADD)], 0)),
+            rule(
+                18,
+                scoped_expression(
+                    &[ifr_true(), op(UNDEFINED), op(ONE), op(CONDITIONAL), op(ADD)],
+                    0,
+                ),
+            ),
+            [operation(0x00, true, &[]), rule(16, uint8(4)), END.to_vec()].concat(),
+        ];
+        let undefined = Err("UNDEFINED result".to_string());
+        let cycle = |rule_id: u8| {
+            Err(format!(
+                "malformed expression: EFI_IFR_RULE_REF of RuleId {rule_id} within the \
+                 evaluation of that rule"
+            ))
+        };
+        let two_rules = "EFI_IFR_RULE_REF of RuleId 11, which 2 EFI_IFR_RULEs of its form have: \
+                         edk2-stable202608 SetupBrowserDxe/Expression.c RuleIdToExpression takes \
+                         the first (:907-916), while UEFI 2.11 marks the form invalid \
+                         (§33.3.8.3.63)";
+        let cases = [
+            ("a rule", rule_ref(1), Ok(5)),
+            (
+                "a rule in the scope of the expression's first op",
+                scoped_expression(&[rule_ref(1), uint8(2), op(ADD)], 0),
+                Ok(7),
+            ),
+            ("a rule of a rule", rule_ref(2), Ok(6)),
+            ("no rule", rule_ref(99), undefined.clone()),
+            (
+                "a rule in the scope of opcode 0x70",
+                rule_ref(15),
+                undefined.clone(),
+            ),
+            ("a rule in the scope of opcode 0x00", rule_ref(16), Ok(4)),
+            ("a rule of UNDEFINED", rule_ref(3), undefined.clone()),
+            ("a rule of two values", rule_ref(4), undefined.clone()),
+            (
+                "a rule of an op on an empty stack",
+                rule_ref(13),
+                undefined.clone(),
+            ),
+            (
+                "a rule of a MAP with a malformed match expression",
+                rule_ref(14),
+                undefined.clone(),
+            ),
+            (
+                "a rule of THIS, in no question",
+                rule_ref(12),
+                Err(format!("{THIS_WITHOUT_STATEMENT} not evaluated")),
+            ),
+            ("a rule of itself", rule_ref(5), cycle(5)),
+            (
+                "a rule of itself past an UNDEFINED that a CONDITIONAL may drop",
+                scoped_expression(
+                    &[ifr_true(), op(UNDEFINED), rule_ref(5), op(CONDITIONAL)],
+                    0,
+                ),
+                Err(format!(
+                    "{EDK2_ENDS}, {SPEC_DROPS} a value that uefisettings cannot evaluate: \
+                     EFI_IFR_RULE_REF of RuleId 5 within the evaluation of that rule"
+                )),
+            ),
+            ("rules of each other", rule_ref(6), cycle(6)),
+            (
+                "a rule of an op that is not evaluated",
+                rule_ref(8),
+                Err("EFI_IFR_TO_UINT not evaluated".to_string()),
+            ),
+            (
+                "a rule of a value that cannot be read",
+                rule_ref(9),
+                Err(
+                    "EFI_IFR_QUESTION_REF1 of question 0x0004: <ValueUnavailable: test>"
+                        .to_string(),
+                ),
+            ),
+            (
+                "a rule whose CONDITIONAL drops an UNDEFINED",
+                rule_ref(10),
+                Err(format!("{RULE_REF_ENDS}, {SPEC_DROPS} 1")),
+            ),
+            (
+                "two rules of one RuleId",
+                rule_ref(11),
+                Err(two_rules.to_string()),
+            ),
+            (
+                "two rules of one RuleId past an UNDEFINED that a CONDITIONAL may drop",
+                scoped_expression(
+                    &[ifr_true(), op(UNDEFINED), rule_ref(11), op(CONDITIONAL)],
+                    0,
+                ),
+                Err(format!(
+                    "{EDK2_ENDS}, {SPEC_DROPS} a value that uefisettings cannot evaluate: \
+                     {two_rules}"
+                )),
+            ),
+            (
+                "a CONDITIONAL that drops the UNDEFINED of a rule",
+                scoped_expression(&[ifr_true(), rule_ref(3), op(ONE), op(CONDITIONAL)], 0),
+                Err(format!("{RULE_REF_ENDS}, {SPEC_DROPS} 1")),
+            ),
+            (
+                "a CONDITIONAL that drops the UNDEFINED of a rule malformed past it",
+                scoped_expression(&[ifr_true(), rule_ref(17), op(ONE), op(CONDITIONAL)], 0),
+                Err(format!("{RULE_REF_ENDS}, {SPEC_DROPS} 1")),
+            ),
+            (
+                "a rule malformed past an UNDEFINED that its CONDITIONAL drops",
+                rule_ref(18),
+                undefined.clone(),
+            ),
+            (
+                "a rule past an UNDEFINED that a CONDITIONAL drops",
+                scoped_expression(
+                    &[ifr_true(), op(UNDEFINED), rule_ref(1), op(CONDITIONAL)],
+                    0,
+                ),
+                Err(format!("{EDK2_ENDS}, {SPEC_DROPS} 5")),
+            ),
+            (
+                "a rule of an op on an empty stack past an UNDEFINED, both UNDEFINED",
+                scoped_expression(
+                    &[ifr_true(), op(UNDEFINED), rule_ref(13), op(CONDITIONAL)],
+                    0,
+                ),
+                undefined.clone(),
+            ),
+            (
+                "a rule of an op not evaluated past an UNDEFINED that a CONDITIONAL may drop",
+                scoped_expression(
+                    &[ifr_true(), op(UNDEFINED), rule_ref(8), op(CONDITIONAL)],
+                    0,
+                ),
+                Err(format!(
+                    "{EDK2_ENDS}, {SPEC_DROPS} a value that uefisettings cannot evaluate: \
+                     EFI_IFR_TO_UINT not evaluated"
+                )),
+            ),
+            (
+                "an op not evaluated past an UNDEFINED that a CONDITIONAL in the scope of a \
+                 later RULE_REF may drop",
+                scoped_expression(
+                    &[
+                        ifr_true(),
+                        op(UNDEFINED),
+                        op(TO_UINT),
+                        rule_ref(1),
+                        op(ONE),
+                        op(CONDITIONAL),
+                    ],
+                    3,
+                ),
+                Err(format!(
+                    "{EDK2_ENDS}, {SPEC_DROPS} a value that uefisettings cannot evaluate: \
+                     EFI_IFR_TO_UINT not evaluated"
+                )),
+            ),
+        ];
+        for (name, expression, want) in cases {
+            assert_eq!(value_in_form(&rules, expression, &values), want, "{name}");
+        }
+        let in_form = |children: &[Vec<u8>]| {
+            question_in(|body| form(1, &[body, &rules[..]].concat()), children)
+        };
+        let read = |rule_id: u8| {
+            let (_root, question) = in_form(&[op(READ), rule_ref(rule_id)]);
+            evaluate_read(
+                &question,
+                QuestionValue::Uint(1),
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values,
+                },
+            )
+        };
+        assert_eq!(
+            read(11),
+            ReadOutcome::Refused(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Read,
+                reason: two_rules.to_string(),
+            }),
+            "a READ of two rules of one RuleId"
+        );
+        let itself = "EFI_IFR_RULE_REF of RuleId 5 within the evaluation of that rule";
+        assert_eq!(
+            read(5),
+            ReadOutcome::Refused(ExpressionRefusal::Malformed {
+                expression: QuestionExpression::Read,
+                reason: itself.to_string(),
+            }),
+            "a READ of a rule of itself"
+        );
+        let (_root, question) = in_form(&[op(WRITE), rule_ref(5)]);
+        assert_eq!(
+            question_writes(&question, QuestionValue::Uint(1), &Efivars::new()),
+            Err(ExpressionRefusal::Malformed {
+                expression: QuestionExpression::Write,
+                reason: itself.to_string(),
+            }),
+            "a WRITE of a rule of itself"
+        );
+        let (_root, suppress_if) = op_in_form(
+            &[
+                &[conditional(
+                    SUPPRESS_IF,
+                    scoped_expression(&[rule_ref(5)], 0),
+                    &[one_of_holding(2, &[])],
+                )][..],
+                &rules[..],
+            ]
+            .concat(),
+            &[0],
+        );
+        assert_eq!(
+            evaluate_condition(
+                &suppress_if.borrow(),
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values,
+                },
+            ),
+            Truth::Unknown(format!("malformed condition: {itself}")),
+            "a SUPPRESS_IF of a rule of itself"
+        );
+
+        assert_eq!(
+            value_in(rule_ref(1), &Efivars::new()),
+            undefined,
+            "outside forms"
+        );
+    }
+
+    /// A RULE_REF evaluates its rule anew each time, so rules that each refer twice to the one
+    /// before double the rules that an expression starts per rule: past MAX_RULE_EVALUATIONS of
+    /// them, the RULE_REF that would start one more is not evaluated, also in a chain of 256. A
+    /// RULE_REF of no rule starts none.
+    #[test]
+    fn an_expression_starts_at_most_max_rule_evaluations_rules() {
+        let rules = |depth: u8| {
+            let mut rules = vec![rule(0, op(ONE))];
+            rules.extend((1..=depth).map(|id| {
+                rule(
+                    id,
+                    scoped_expression(&[rule_ref(id - 1), rule_ref(id - 1), op(ADD)], 0),
+                )
+            }));
+            rules
+        };
+        let chain = |depth: u8| value_in_form(&rules(depth), rule_ref(depth), &no_values());
+        // rule 11 starts 2^12 - 1 = 4095 rules
+        assert_eq!(chain(11), Ok(2048), "a chain of 12 rules");
+        // rule 12 starts rule 11, which starts 4095, then the second RULE_REF of rule 11
+        assert_eq!(
+            chain(12),
+            Err(format!(
+                "EFI_IFR_RULE_REF of RuleId 11 past {MAX_RULE_EVALUATIONS} rules in one \
+                 expression not evaluated"
+            )),
+            "a chain of 13 rules"
+        );
+        let got = chain(255);
+        assert!(
+            got.as_ref().is_err_and(|reason| reason.ends_with(&format!(
+                " past {MAX_RULE_EVALUATIONS} rules in one expression not evaluated"
+            ))),
+            "a chain of 256 rules: {got:?}"
+        );
+        let no_rule = map(&[(rule_ref(99), uint8(5)), (rule_ref(99), uint8(6))]);
+        assert_eq!(
+            value_in_form(
+                &rules(11),
+                scoped_expression(&[op(ZERO), rule_ref(11), op(ADD), no_rule], 0),
+                &no_values()
+            ),
+            Err("UNDEFINED result".to_string()),
+            "two RULE_REFs of no rule after a chain of 12 rules"
+        );
+    }
+
+    /// The expression of a rule whose CONDITIONAL drops an UNDEFINED, where UEFI 2.11 gives a
+    /// value, ends the expression that holds the RULE_REF at the RULE_REF, as edk2 gives the
+    /// RULE_REF's UNDEFINED there (SetupBrowserDxe/Expression.c:2952-2956), and the spec's value
+    /// goes on: the whole expression decides, by its effect, as past a return expression of a
+    /// MAP. Where the spec's value cannot be read, the divergence stays the rule's.
+    #[test]
+    fn a_rule_that_drops_an_undefined_hands_its_value_on() {
+        let efivars = store_holding(&[0; 5]);
+        let in_form = |value: Vec<u8>, children: &[Vec<u8>]| {
+            let dropping = scoped_expression(
+                &[ifr_true(), op(UNDEFINED), value.clone(), op(CONDITIONAL)],
+                0,
+            );
+            question_in(
+                |body| form(1, &[body, &[rule(1, dropping.clone())][..]].concat()),
+                children,
+            )
+        };
+        let unreadable = || get(NAME_VALUE, 0, EFI_IFR_TYPE_NUM_SIZE_8);
+        let unreadable_reason = "a value that cannot be read: EFI_IFR_GET of VarStore 0x0003 \
+                                 (EFI_IFR_VARSTORE_NAME_VALUE), which only the driver's \
+                                 EFI_HII_CONFIG_ACCESS_PROTOCOL reaches";
+
+        let truth = |value: Vec<u8>, condition: Vec<u8>| {
+            let (_root, question) = in_form(
+                value,
+                &[conditional(
+                    SUPPRESS_IF,
+                    condition,
+                    &[one_of_option(5, EFI_IFR_TYPE_NUM_SIZE_8, &[0])],
+                )],
+            );
+            let scope = Rc::clone(&question.borrow().children[0]);
+            let scope = scope.borrow();
+            evaluate_condition(
+                &scope,
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &no_values(),
+                },
+            )
+        };
+        assert_eq!(
+            truth(ifr_false(), rule_ref(1)),
+            Truth::Known(false),
+            "FALSE"
+        );
+        assert_eq!(
+            truth(ifr_false(), scoped_expression(&[rule_ref(1), op(NOT)], 0)),
+            Truth::Unknown(format!(
+                "{RULE_REF_ENDS}, which it takes as FALSE, {SPEC_DROPS} TRUE"
+            )),
+            "FALSE, then NOT"
+        );
+
+        let read = |value: Vec<u8>, this| {
+            let (_root, question) = in_form(value, &[op(READ), rule_ref(1)]);
+            evaluate_read(
+                &question,
+                this,
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &no_values(),
+                },
+            )
+        };
+        let unreadable_this = || QuestionValue::Unreadable {
+            kind: ValueKind::Uint,
+            reason: "<ValueUnavailable: test>".to_string(),
+        };
+        let refused = |reason: String| {
+            ReadOutcome::Refused(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Read,
+                reason,
+            })
+        };
+        let refused_3 = |stored: &str| {
+            refused(format!(
+                "{RULE_REF_ENDS}, keeping the stored value {stored}, {SPEC_DROPS} 3"
+            ))
+        };
+        assert_eq!(
+            read(uint8(3), QuestionValue::Uint(3)),
+            ReadOutcome::Stored,
+            "3, stored 3"
+        );
+        assert_eq!(
+            read(uint8(3), QuestionValue::Uint(0)),
+            refused_3("0"),
+            "3, stored 0"
+        );
+        assert_eq!(
+            read(uint8(3), unreadable_this()),
+            refused_3("that cannot be read"),
+            "3, stored that cannot be read"
+        );
+        assert_eq!(
+            read(unreadable(), unreadable_this()),
+            refused(format!("{RULE_ENDS}, {SPEC_DROPS} {unreadable_reason}")),
+            "a value that cannot be read, stored that cannot be read"
+        );
+
+        let this_set = |offset| [op(THIS), set(STORE, offset, EFI_IFR_TYPE_NUM_SIZE_8)].concat();
+        let write = |value: Vec<u8>, ops: &[Vec<u8>]| {
+            let (_root, question) = in_form(value, &[op(WRITE), scoped_expression(ops, 0)]);
+            question_writes(&question, QuestionValue::Uint(3), &efivars)
+        };
+        let undetermined = |reason: String| -> std::result::Result<_, ExpressionRefusal> {
+            Err(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Write,
+                reason,
+            })
+        };
+        assert_eq!(
+            write(op(ONE), &[this_set(0), rule_ref(1), op(AND)]),
+            Ok(Some(vec![(STORE, "Store".to_string(), 0, vec![0x03])])),
+            "SETs only before it"
+        );
+        assert_eq!(
+            write(
+                op(ONE),
+                &[this_set(0), rule_ref(1), this_set(1), op(AND), op(AND)]
+            ),
+            undetermined(format!(
+                "{RULE_REF_ENDS}, after the SETs before it, {SPEC_DROPS} a value that uefisettings \
+                 cannot evaluate: EFI_IFR_SET past where edk2-stable202608 SetupBrowserDxe ends \
+                 the expression (UEFI 2.11 stores its value and pushes TRUE or FALSE: \
+                 EFI_IFR_SET, §33.3.8.3.66) not evaluated"
+            )),
+            "then a SET"
+        );
+        assert_eq!(
+            write(unreadable(), &[this_set(0), rule_ref(1), op(AND)]),
+            undetermined(format!("{RULE_ENDS}, {SPEC_DROPS} {unreadable_reason}")),
+            "a value that cannot be read"
+        );
+    }
+
+    /// QUESTION_REF1 of a missing question in a rule gives UNDEFINED, which a CONDITIONAL may
+    /// drop: edk2-stable202608 SetupBrowserDxe/Expression.c fails it (:2733-2738), and gives the
+    /// RULE_REF UNDEFINED where the rule fails as where it gives UNDEFINED (:2952-2956), while UEFI
+    /// 2.11 pushes UNDEFINED without the question (§33.3.8.3.55). Outside rules, it stays
+    /// malformed.
+    #[test]
+    fn question_ref1_of_a_missing_question_in_a_rule_gives_undefined() {
+        let efivars = store_holding(&[0; 5]);
+        let dropping = |kept: Vec<u8>| {
+            scoped_expression(&[ifr_true(), question_ref1(0x99), kept, op(CONDITIONAL)], 0)
+        };
+        let truth = |rules: Vec<Vec<u8>>, condition: Vec<u8>| {
+            let suppressed = conditional(
+                SUPPRESS_IF,
+                condition,
+                &[one_of_option(5, EFI_IFR_TYPE_NUM_SIZE_8, &[0])],
+            );
+            let mut body = rules;
+            body.push(one_of_holding(1, &[suppressed]));
+            let path = [body.len() - 1, 0];
+            let (root, scope) = op_in_form(&body, &path);
+            let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+            let scope = scope.borrow();
+            evaluate_condition(
+                &scope,
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            )
+        };
+        assert_eq!(
+            truth(vec![rule(1, dropping(ifr_true()))], rule_ref(1)),
+            Truth::Unknown(format!(
+                "{RULE_REF_ENDS}, which it takes as FALSE, {SPEC_DROPS} TRUE"
+            )),
+            "a SUPPRESS_IF of a rule of TRUE QUESTION_REF1 of a missing question TRUE CONDITIONAL"
+        );
+        assert_eq!(
+            truth(vec![rule(1, question_ref1(0x99))], rule_ref(1)),
+            Truth::Known(false),
+            "a SUPPRESS_IF of a rule of QUESTION_REF1 of a missing question"
+        );
+        assert_eq!(
+            truth(vec![], dropping(ifr_true())),
+            Truth::Unknown(
+                "malformed condition: EFI_IFR_QUESTION_REF1 of missing question 0x0099".to_string()
+            ),
+            "a SUPPRESS_IF of TRUE QUESTION_REF1 of a missing question TRUE CONDITIONAL"
+        );
+
+        let in_question = |children: Vec<Vec<u8>>| {
+            let body = vec![one_of_holding(1, &children)];
+            op_in_form(&body, &[0])
+        };
+        let (root, question) =
+            in_question(vec![rule(1, dropping(uint8(7))), op(READ), rule_ref(1)]);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+        assert_eq!(
+            evaluate_read(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            ),
+            ReadOutcome::Refused(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Read,
+                reason: format!("{RULE_REF_ENDS}, keeping the stored value 3, {SPEC_DROPS} 7"),
+            }),
+            "a READ, stored 3, of a rule of TRUE QUESTION_REF1 of a missing question UINT8 7 \
+             CONDITIONAL"
+        );
+        let (root, question) = in_question(vec![
+            rule(1, dropping(uint8(7))),
+            op(WRITE),
+            scoped_expression(
+                &[
+                    uint8(5),
+                    set(STORE, 0, EFI_IFR_TYPE_NUM_SIZE_8),
+                    rule_ref(1),
+                    set(STORE, 1, EFI_IFR_TYPE_NUM_SIZE_8),
+                    op(AND),
+                ],
+                0,
+            ),
+        ]);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+        assert_eq!(
+            evaluate_write(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            )
+            .map(|sets| sets.map(|sets| sets.var_store.len())),
+            Err(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Write,
+                reason: format!(
+                    "{RULE_REF_ENDS}, after the SETs before it, {SPEC_DROPS} a value that \
+                     uefisettings cannot evaluate: EFI_IFR_SET past where edk2-stable202608 \
+                     SetupBrowserDxe ends the expression (UEFI 2.11 stores its value and pushes \
+                     TRUE or FALSE: EFI_IFR_SET, §33.3.8.3.66) not evaluated"
+                ),
+            }),
+            "a WRITE of UINT8 5 SET, then a SET of that rule"
+        );
+    }
+
+    /// Why QUESTION_REF1 of missing question 0x0099 in a match expression of a MAP in a rule is
+    /// undetermined.
+    const REF1_IN_MATCH: &str = "EFI_IFR_QUESTION_REF1 of missing question 0x0099 in a match \
+                                 expression of EFI_IFR_MAP in a rule: edk2-stable202608 \
+                                 SetupBrowserDxe/Expression.c fails it (:2733-2738), and with it \
+                                 the MAP (:3656-3658) and the rule, whose RULE_REF gives UNDEFINED \
+                                 (:2952-2956), while UEFI 2.11 pushes UNDEFINED without the \
+                                 question (§33.3.8.3.55), and the MAP goes on to its next pair";
+
+    /// In a match expression of a MAP in a rule, also in a return expression of a MAP there,
+    /// QUESTION_REF1 of a missing question is undetermined: edk2-stable202608
+    /// SetupBrowserDxe/Expression.c fails it (:2733-2738), and with it the MAP (:3656-3658) and
+    /// the rule, whose RULE_REF gives UNDEFINED (:2952-2956), while UEFI 2.11 pushes UNDEFINED
+    /// without the question (§33.3.8.3.55), and the MAP takes the next pair; past where edk2 ends
+    /// the rule, it is not evaluated. In a return expression of a MAP in a rule, and in a rule
+    /// that a match expression holds, the failure and UNDEFINED have one effect, as elsewhere in
+    /// a rule.
+    #[test]
+    fn question_ref1_of_a_missing_question_in_a_match_expression_in_a_rule_is_undetermined() {
+        let efivars = store_holding(&[0; 5]);
+        // UINT8 1 MAP of (`matched`, `returned`), then (UINT8 1, `other`)
+        let pairs = |matched: Vec<u8>, returned: Vec<u8>, other: Vec<u8>| {
+            map(&[(matched, returned), (uint8(1), other)])
+        };
+        let missing_first = |returned: Vec<u8>, other: Vec<u8>| {
+            scoped_expression(&[uint8(1), pairs(question_ref1(0x99), returned, other)], 0)
+        };
+        let read = |children: Vec<Vec<u8>>| {
+            let (root, question) = op_in_form(&[one_of_holding(1, &children)], &[0]);
+            let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+            evaluate_read(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            )
+        };
+        let read_of_rule =
+            |expression: Vec<u8>| read(vec![rule(1, expression), op(READ), rule_ref(1)]);
+        let undetermined = |reason: String| {
+            ReadOutcome::Refused(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Read,
+                reason,
+            })
+        };
+        assert_eq!(
+            read_of_rule(missing_first(uint8(5), uint8(7))),
+            undetermined(REF1_IN_MATCH.to_string()),
+            "a READ, stored 3, of a rule of UINT8 1 MAP of (QUESTION_REF1 of a missing question, \
+             5), then (1, 7)"
+        );
+        let in_return = scoped_expression(&[uint8(2), map(&[(uint8(2), question_ref1(0x99))])], 0);
+        assert_eq!(
+            read_of_rule(scoped_expression(
+                &[uint8(1), pairs(in_return, uint8(5), uint8(7))],
+                0
+            )),
+            undetermined(REF1_IN_MATCH.to_string()),
+            "a READ, stored 3, of a rule of UINT8 1 MAP of (UINT8 2 MAP of (2, QUESTION_REF1 of a \
+             missing question), 5), then (1, 7)"
+        );
+        let past_end = scoped_expression(
+            &[
+                ifr_true(),
+                op(UNDEFINED),
+                missing_first(uint8(5), uint8(7)),
+                op(CONDITIONAL),
+            ],
+            0,
+        );
+        assert_eq!(
+            read_of_rule(past_end),
+            undetermined(format!(
+                "{RULE_ENDS}, {SPEC_DROPS} a value that uefisettings cannot evaluate: \
+                 {REF1_IN_MATCH}"
+            )),
+            "a READ, stored 3, of a rule of TRUE UNDEFINED (that MAP) CONDITIONAL"
+        );
+        let dropping = scoped_expression(
+            &[ifr_true(), question_ref1(0x99), uint8(7), op(CONDITIONAL)],
+            0,
+        );
+        assert_eq!(
+            read_of_rule(scoped_expression(
+                &[uint8(1), map(&[(uint8(1), dropping)])],
+                0
+            )),
+            undetermined(format!(
+                "{RULE_REF_ENDS}, keeping the stored value 3, {SPEC_DROPS} 7"
+            )),
+            "a READ, stored 3, of a rule of UINT8 1 MAP of (1, TRUE QUESTION_REF1 of a missing \
+             question UINT8 7 CONDITIONAL)"
+        );
+        assert_eq!(
+            read(vec![
+                rule(1, question_ref1(0x99)),
+                op(READ),
+                scoped_expression(&[uint8(1), pairs(rule_ref(1), uint8(5), uint8(7))], 0),
+            ]),
+            ReadOutcome::Value(ExpressionValue::Uint(7)),
+            "a READ of UINT8 1 MAP of (RULE_REF 1, 5), then (1, 7), RULE 1 QUESTION_REF1 of a \
+             missing question"
+        );
+
+        let suppressed = conditional(
+            SUPPRESS_IF,
+            rule_ref(1),
+            &[one_of_option(5, EFI_IFR_TYPE_NUM_SIZE_8, &[0])],
+        );
+        let body = [
+            rule(1, missing_first(ifr_false(), ifr_true())),
+            one_of_holding(1, &[suppressed]),
+        ];
+        let (root, scope) = op_in_form(&body, &[1, 0]);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+        let scope = scope.borrow();
+        assert_eq!(
+            evaluate_condition(
+                &scope,
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            ),
+            Truth::Unknown(REF1_IN_MATCH.to_string()),
+            "a SUPPRESS_IF of a rule of UINT8 1 MAP of (QUESTION_REF1 of a missing question, \
+             FALSE), then (1, TRUE)"
+        );
+    }
+
+    /// A SET past the end of a rule's expression, or of an expression of a MAP in it, goes out
+    /// with the RULE_REF's UNDEFINED, as out of a return expression of a MAP: also where a
+    /// malformed op ends the rule, which gives UNDEFINED in both readings. Where a CONDITIONAL
+    /// drops that UNDEFINED, the WRITE is refused before any SET, naming the first op skipped;
+    /// else edk2's SETs stay.
+    #[test]
+    fn a_set_skipped_in_a_rule_goes_out_with_its_rule_ref() {
+        let efivars = store_holding(&[0; 5]);
+        let constant_set = [uint8(7), set(STORE, 0, EFI_IFR_TYPE_NUM_SIZE_8)].concat();
+        let skipping = scoped_expression(&[op(UNDEFINED), constant_set.clone(), op(AND)], 0);
+        // ends where an op is skipped in a match expression of a MAP in it
+        let malformed_past_a_skip = scoped_expression(
+            &[
+                uint8(1),
+                map(&[
+                    (
+                        scoped_expression(&[op(UNDEFINED), op(TO_UINT)], 0),
+                        uint8(5),
+                    ),
+                    (uint8(1), uint8(1)),
+                ]),
+                op(ADD),
+            ],
+            0,
+        );
+        let rules = [
+            rule(1, skipping.clone()),
+            rule(
+                2,
+                scoped_expression(
+                    &[
+                        uint8(1),
+                        map(&[(skipping.clone(), uint8(5)), (uint8(1), ifr_true())]),
+                        op(AND),
+                    ],
+                    0,
+                ),
+            ),
+            rule(
+                3,
+                scoped_expression(
+                    &[
+                        uint8(1),
+                        map(&[
+                            (skipping.clone(), uint8(5)),
+                            (malformed_past_a_skip.clone(), uint8(6)),
+                        ]),
+                    ],
+                    0,
+                ),
+            ),
+            rule(
+                4,
+                scoped_expression(
+                    &[
+                        uint8(1),
+                        map(&[(skipping, uint8(5)), (uint8(1), malformed_past_a_skip)]),
+                    ],
+                    0,
+                ),
+            ),
+        ];
+        let write = |ops: &[Vec<u8>]| {
+            let (_root, question) = question_in(
+                |body| form(1, &[body, &rules[..]].concat()),
+                &[op(WRITE), scoped_expression(ops, 0)],
+            );
+            question_writes(&question, QuestionValue::Uint(3), &efivars)
+        };
+        let this_set = [op(THIS), set(STORE, 1, EFI_IFR_TYPE_NUM_SIZE_8)].concat();
+        let refused = Err(ExpressionRefusal::Undetermined {
+            expression: QuestionExpression::Write,
+            reason: format!(
+                "{RULE_REF_ENDS}, after the SETs before it, {SPEC_DROPS} a value that \
+                 uefisettings cannot evaluate: EFI_IFR_SET past where edk2-stable202608 \
+                 SetupBrowserDxe ends the expression (UEFI 2.11 stores its value and pushes TRUE \
+                 or FALSE: EFI_IFR_SET, §33.3.8.3.66) not evaluated"
+            ),
+        });
+        assert_eq!(
+            write(&[ifr_true(), rule_ref(1), op(ONE), op(CONDITIONAL)]),
+            refused,
+            "past the end of the rule, the RULE_REF's UNDEFINED dropped"
+        );
+        assert_eq!(
+            write(&[ifr_true(), rule_ref(2), op(ONE), op(CONDITIONAL)]),
+            refused,
+            "past the end of a match expression in a rule that a malformed op ends, the \
+             RULE_REF's UNDEFINED dropped"
+        );
+        assert_eq!(
+            write(&[ifr_true(), rule_ref(3), op(ONE), op(CONDITIONAL)]),
+            refused,
+            "a SET skipped before a match expression that a malformed op ends, with an op \
+             skipped in that expression"
+        );
+        assert_eq!(
+            write(&[ifr_true(), rule_ref(4), op(ONE), op(CONDITIONAL)]),
+            refused,
+            "a SET skipped before a return expression that a malformed op ends, with an op \
+             skipped in that expression"
+        );
+        assert_eq!(
+            write(&[this_set.clone(), rule_ref(1), op(AND)]),
+            Ok(Some(vec![(STORE, "Store".to_string(), 1, vec![0x03])])),
+            "past the end of the rule, the RULE_REF's UNDEFINED kept"
+        );
+        assert_eq!(
+            write(&[this_set, rule_ref(2), op(AND)]),
+            Ok(Some(vec![(STORE, "Store".to_string(), 1, vec![0x03])])),
+            "past the end of a match expression in a rule that a malformed op ends, the \
+             RULE_REF's UNDEFINED kept"
+        );
+    }
+
+    /// A RULE_REF in a SUPPRESS_IF around FORMs, which no FORM holds: edk2-stable202608
+    /// SetupBrowserDxe makes the SUPPRESS_IF each FORM's SuppressExpression (IfrParse.c:2592,
+    /// :1758-1774) and evaluates it with that FORM (Presentation.c:1522-1523, :2511-2512), so
+    /// Expression.c RuleIdToExpression takes that FORM's rule, while UEFI 2.11 keeps rules to the
+    /// expressions within a form's scope (§33.2.5.7.3) and pushes UNDEFINED without the rule
+    /// (§33.3.8.3.64). Where the FORM has a RULE of the RuleId, the suppression is undetermined;
+    /// without one, both give UNDEFINED. A GRAY_OUT_IF around FORMs takes no FORM's rule.
+    #[test]
+    fn a_rule_ref_in_a_suppress_if_around_forms_is_undetermined_where_the_form_has_the_rule() {
+        let question = checkbox_op(9, 0);
+        let state_of = |root: Rc<RefCell<IFROperation>>| {
+            let found = find_op(&root, &question[2..]).expect("find the CHECKBOX");
+            let state = question_state(
+                &found.borrow(),
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &no_values(),
+                },
+            );
+            state
+        };
+        let around = |scope: u8, condition: Vec<u8>, body: Vec<Vec<u8>>| {
+            parse_form_set(&[conditional(
+                scope,
+                condition,
+                &[form(1, &[body, vec![question.clone()]].concat())],
+            )])
+        };
+        let form_rule = "EFI_IFR_RULE_REF of RuleId 1 in a SUPPRESS_IF around FORMs: \
+                         edk2-stable202608 SetupBrowserDxe/Presentation.c evaluates it as the \
+                         SuppressExpression of EFI_IFR_FORM 0x0001, with that FORM (:1522-1523, \
+                         :2511-2512), whose RULE of that RuleId Expression.c RuleIdToExpression \
+                         takes (:895-919), while UEFI 2.11 keeps rules to the expressions within \
+                         a form's scope (§33.2.5.7.3) and pushes UNDEFINED without the rule \
+                         (§33.3.8.3.64)";
+        let unknown = |reason: String| StateEvaluation {
+            unknown: vec![(QuestionState::Suppressed, reason)],
+            ..StateEvaluation::selectable()
+        };
+        assert_eq!(
+            state_of(around(SUPPRESS_IF, rule_ref(1), vec![rule(1, ifr_true())])),
+            unknown(form_rule.to_string()),
+            "a SUPPRESS_IF around a FORM whose rule 1 is TRUE"
+        );
+        assert_eq!(
+            state_of(around(SUPPRESS_IF, rule_ref(1), vec![rule(2, ifr_true())])),
+            StateEvaluation::selectable(),
+            "a SUPPRESS_IF around a FORM without rule 1"
+        );
+        assert_eq!(
+            state_of(around(
+                SUPPRESS_IF,
+                scoped_expression(
+                    &[ifr_true(), op(UNDEFINED), rule_ref(1), op(CONDITIONAL)],
+                    0
+                ),
+                vec![rule(1, ifr_true())]
+            )),
+            unknown(format!(
+                "{EDK2_ENDS}, which it takes as FALSE, {SPEC_DROPS} a value that uefisettings \
+                 cannot evaluate: {form_rule}"
+            )),
+            "a SUPPRESS_IF around a FORM whose rule 1 is TRUE, past an UNDEFINED that a \
+             CONDITIONAL may drop"
+        );
+        assert_eq!(
+            state_of(around(GRAY_OUT_IF, rule_ref(1), vec![rule(1, ifr_true())])),
+            StateEvaluation::selectable(),
+            "a GRAY_OUT_IF around a FORM whose rule 1 is TRUE"
+        );
+        assert_eq!(
+            state_of(parse_form_set(&[form(
+                1,
+                &[
+                    rule(1, ifr_true()),
+                    conditional(SUPPRESS_IF, rule_ref(1), std::slice::from_ref(&question)),
+                ],
+            )])),
+            StateEvaluation {
+                current: QuestionState::Suppressed,
+                ..StateEvaluation::selectable()
+            },
+            "a SUPPRESS_IF in the FORM whose rule 1 is TRUE"
+        );
+    }
+
+    /// QuestionId 0 is reserved (UEFI 2.11 §33.3.8.2.2), so edk2-stable202608
+    /// SetupBrowserDxe/Expression.c IdToQuestion2 finds no question of it (:808-813), also in the
+    /// READ or WRITE of a question of QuestionId 0: QUESTION_REF2 and QUESTION_REF3 of the current
+    /// FormSet's Guid give UNDEFINED, which ends the WRITE before its SET and keeps the READ's
+    /// stored value, and QUESTION_REF1 fails (:2733-2738).
+    #[test]
+    fn a_reference_to_question_id_0_finds_no_question() {
+        let values = MapValues(BTreeMap::new());
+        let efivars = store_holding(&[0; 5]);
+        let ref3 = || {
+            let data = [&[0, 0][..], &[0x11; 16]].concat();
+            [uint8(0), operation(QUESTION_REF3, false, &data)].concat()
+        };
+        let missing = "EFI_IFR_QUESTION_REF1 of missing question 0x0000";
+        let cases = [
+            (
+                "QUESTION_REF2",
+                [uint8(0), op(QUESTION_REF2)].concat(),
+                Ok(Some(vec![])),
+                ReadOutcome::Stored,
+            ),
+            (
+                "QUESTION_REF3 of the current FormSet's Guid",
+                ref3(),
+                Ok(Some(vec![])),
+                ReadOutcome::Stored,
+            ),
+            (
+                "QUESTION_REF1",
+                question_ref1(0),
+                Err(ExpressionRefusal::Malformed {
+                    expression: QuestionExpression::Write,
+                    reason: missing.to_string(),
+                }),
+                ReadOutcome::Stored,
+            ),
+        ];
+        for (name, reference, write_want, read_want) in cases {
+            let set_by_reference = scoped_expression(
+                &[
+                    ifr_true(),
+                    reference.clone(),
+                    set(STORE, 1, EFI_IFR_TYPE_NUM_SIZE_8),
+                    op(AND),
+                ],
+                0,
+            );
+            let body = [one_of_holding(0, &[op(WRITE), set_by_reference])];
+            let (_root, question) = op_in_form(&body, &[0]);
+            let written = evaluate_write(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            )
+            .map(|sets| {
+                sets.map(|sets| {
+                    sets.var_store
+                        .into_iter()
+                        .map(|set| set.bytes)
+                        .collect::<Vec<_>>()
+                })
+            });
+            assert_eq!(written, write_want, "a WRITE, {name}");
+            let read_by_reference = scoped_expression(&[op(ONE), reference, op(ADD)], 0);
+            let body = [one_of_holding(0, &[op(READ), read_by_reference])];
+            let (_root, question) = op_in_form(&body, &[0]);
+            let read = evaluate_read(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values,
+                },
+            );
+            assert_eq!(read, read_want, "a READ, {name}");
+        }
+    }
+
+    /// In the READ or WRITE of a question of QuestionId 0, which UEFI 2.11 reserves
+    /// (§33.3.8.2.2) and edk2-stable202608 SetupBrowserDxe/Expression.c IdToQuestion2 never finds
+    /// (:808-813), a QUESTION_REF1, QUESTION_REF2 or EQ_ID_VAL of 0 takes no THIS, and THIS in a
+    /// rule that the question holds is undetermined; in a question of QuestionId 1, each takes
+    /// THIS.
+    #[test]
+    fn references_in_a_question_of_question_id_0_find_no_question() {
+        let efivars = store_holding(&[0; 5]);
+        let in_question = |id: u16, children: Vec<Vec<u8>>| {
+            let body = vec![one_of_holding(id, &children)];
+            op_in_form(&body, &[0])
+        };
+        let write = |id: u16, expression: Vec<u8>, rules: Vec<Vec<u8>>| {
+            let (root, question) = in_question(id, [rules, vec![op(WRITE), expression]].concat());
+            let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+            evaluate_write(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            )
+            .map(|sets| {
+                sets.map(|sets| {
+                    sets.var_store
+                        .into_iter()
+                        .map(|set| set.bytes)
+                        .collect::<Vec<_>>()
+                })
+            })
+        };
+        let read = |id: u16, expression: Vec<u8>| {
+            let (root, question) = in_question(id, vec![op(READ), expression]);
+            let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+            evaluate_read(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            )
+        };
+        let set_0 = || set(STORE, 0, EFI_IFR_TYPE_NUM_SIZE_8);
+        let undetermined = |reason: String| -> std::result::Result<_, ExpressionRefusal> {
+            Err(ExpressionRefusal::Undetermined {
+                expression: QuestionExpression::Write,
+                reason,
+            })
+        };
+        let cases = [
+            (
+                0,
+                Err(ExpressionRefusal::Malformed {
+                    expression: QuestionExpression::Write,
+                    reason: "EFI_IFR_QUESTION_REF1 of missing question 0x0000".to_string(),
+                }),
+                Ok(Some(vec![])),
+                undetermined(this_of_question_id_0(
+                    "EFI_IFR_ONE_OF",
+                    "question 0x0000, which gives UNDEFINED",
+                )),
+                ReadOutcome::Stored,
+                ReadOutcome::Stored,
+            ),
+            (
+                1,
+                Ok(Some(vec![vec![3]])),
+                Ok(Some(vec![vec![3]])),
+                Ok(Some(vec![vec![3]])),
+                ReadOutcome::Value(ExpressionValue::Uint(4)),
+                ReadOutcome::Value(ExpressionValue::Boolean(1)),
+            ),
+        ];
+        for (id, by_ref1, by_ref2, by_rule, read_by_ref1, read_by_eq) in cases {
+            let byte = u8::try_from(id).expect("a UINT8 QuestionId");
+            assert_eq!(
+                write(
+                    id,
+                    scoped_expression(&[question_ref1(id), set_0()], 0),
+                    vec![]
+                ),
+                by_ref1,
+                "question {id}: a WRITE of QUESTION_REF1 {id}, then SET"
+            );
+            assert_eq!(
+                write(
+                    id,
+                    scoped_expression(&[uint8(byte), op(QUESTION_REF2), set_0()], 0),
+                    vec![]
+                ),
+                by_ref2,
+                "question {id}: a WRITE of UINT8 {id} QUESTION_REF2, then SET"
+            );
+            assert_eq!(
+                write(
+                    id,
+                    scoped_expression(&[ifr_true(), rule_ref(1), set_0(), op(AND)], 0),
+                    vec![rule(1, op(THIS))]
+                ),
+                by_rule,
+                "question {id}: a WRITE of TRUE, RULE_REF 1, SET, AND, with RULE 1 THIS in it"
+            );
+            assert_eq!(
+                read(
+                    id,
+                    scoped_expression(&[question_ref1(id), op(ONE), op(ADD)], 0)
+                ),
+                read_by_ref1,
+                "question {id}: a READ of QUESTION_REF1 {id} ONE ADD"
+            );
+            assert_eq!(
+                read(id, eq_id_val_of(id, 3)),
+                read_by_eq,
+                "question {id}: a READ of EQ_ID_VAL {id} 3"
+            );
+        }
+    }
+
+    /// Why THIS in a rule that no statement holds is not evaluated.
+    const THIS_WITHOUT_STATEMENT: &str = "EFI_IFR_THIS in a rule that no statement holds (an \
+                                          ASSERT of edk2-stable202608 \
+                                          SetupBrowserDxe/IfrParse.c ParseOpCodes, :1461-1466)";
+
+    /// Why THIS in a rule that question `holder` holds, which gives `edk2`, is undetermined
+    /// where UEFI 2.11 takes the current question `current`.
+    fn this_of_another_question(holder: u16, edk2: &str, current: &str) -> String {
+        format!(
+            "EFI_IFR_THIS in a rule that question {holder:#06x} holds: edk2-stable202608 \
+             SetupBrowserDxe/IfrParse.c ParseOpCodes binds it to that question (:1461-1466), \
+             which gives {edk2}, while UEFI 2.11 takes the current question (§33.3.8.3.77), \
+             {current}"
+        )
+    }
+
+    /// Why THIS in a rule that `statement`, of QuestionId 0, holds is undetermined where UEFI 2.11
+    /// takes the current question `current`.
+    fn this_of_question_id_0(statement: &str, current: &str) -> String {
+        format!(
+            "EFI_IFR_THIS in a rule that {statement} holds: edk2-stable202608 \
+             SetupBrowserDxe/IfrParse.c ParseOpCodes binds it to that statement (:1461-1466), of \
+             QuestionId 0, which Expression.c IdToQuestion2 never finds (:808-813), so it fails \
+             (:2733-2738) and the RULE_REF gives UNDEFINED (:2952-2956), while UEFI 2.11 takes the \
+             current question (§33.3.8.3.77), {current}"
+        )
+    }
+
+    /// A storage-less UINT8 ONE_OF of QuestionId `id`, holding `children`.
+    fn one_of_holding(id: u16, children: &[Vec<u8>]) -> Vec<u8> {
+        [
+            operation(
+                ONE_OF,
+                true,
+                &[question_header_on(id, 3, 0, 0), vec![0x00, 0, 4, 1]].concat(),
+            ),
+            children.concat(),
+            END.to_vec(),
+        ]
+        .concat()
+    }
+
+    /// The root of a FormSet of declarations() and FORM 1 holding `body`, and the op at `path`,
+    /// the indexes of the children that lead to it from that FORM.
+    fn op_in_form(body: &[Vec<u8>], path: &[usize]) -> RootAndQuestion {
+        let declarations = declarations();
+        let root = parse_form_set(&[declarations.concat(), form(1, body)]);
+        let form_set = Rc::clone(&root.borrow().children[0]);
+        let mut op = Rc::clone(&form_set.borrow().children[declarations.len()]);
+        for &index in path {
+            let child = Rc::clone(&op.borrow().children[index]);
+            op = child;
+        }
+        (root, op)
+    }
+
+    /// THIS in a rule has two readings. edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes
+    /// binds it, as it parses the rule, to the innermost statement whose scope holds the THIS
+    /// op, which fails where it has no QuestionId, and ASSERTs where none does (:1461-1466);
+    /// UEFI 2.11 takes the current question (§33.3.8.3.77), that of the expression that holds
+    /// the RULE_REF, as rules are sub-expressions of the form's expressions (§33.2.5.7.3). Where
+    /// no statement holds it, THIS is not evaluated, also in a MAP in the rule; where the
+    /// statement that holds it is the current question, it is that question's value, THIS of
+    /// the READ or WRITE of that question, as is a QUESTION_REF1, QUESTION_REF2 or QUESTION_REF3
+    /// of the current FormSet's Guid of it in a rule; else it is undetermined, naming both, also
+    /// where a SUBTITLE or a GUID op in the current question holds it, but for the GUID op of an
+    /// EDKII bit varstore field, and past where edk2 ends the expression, the spec's result is
+    /// not evaluated. So in a READ, a WRITE and a SUPPRESS_IF. Where the READ's THIS cannot be
+    /// read, the reason names THIS, as outside rules.
+    #[test]
+    fn this_in_a_rule_is_of_the_current_question_where_edk2_binds_the_same() {
+        let without_statement = format!("{THIS_WITHOUT_STATEMENT} not evaluated");
+        let in_map = |value: Vec<u8>| scoped_expression(&[uint8(1), map(&[(uint8(1), value)])], 0);
+
+        let ref2 = |id: u8| scoped_expression(&[uint8(id), op(QUESTION_REF2)], 0);
+        let current_ref3 = |id: u8| {
+            let data = [&[0, 0][..], &[0x11; 16]].concat();
+            scoped_expression(&[uint8(id), operation(QUESTION_REF3, false, &data)], 0)
+        };
+        // THIS of the READ or WRITE of question 1 is 3; elsewhere, question 1 has 2, question 2 9
+        let values = MapValues(BTreeMap::from([
+            (1, QuestionValue::Uint(2)),
+            (2, QuestionValue::Uint(9)),
+        ]));
+        // where RULE 1 is
+        #[derive(Clone, Copy)]
+        enum Holder {
+            // before question 1, in no statement
+            Nothing,
+            // in the scope of the question of this QuestionId
+            Question(u16),
+            // in the scope of an op of this opcode and data, in question 1
+            InCurrent(u8, &'static [u8]),
+        }
+        // RULE 1 of `expression` where `holder` says, then question 1 holding `children`
+        let body = |holder: Holder, expression: Vec<u8>, children: &[Vec<u8>]| {
+            let rule = rule(1, expression);
+            match holder {
+                Holder::Nothing => vec![rule, one_of_holding(1, children)],
+                Holder::Question(1) => vec![one_of_holding(1, &[&[rule][..], children].concat())],
+                Holder::Question(id) => {
+                    vec![one_of_holding(id, &[rule]), one_of_holding(1, children)]
+                }
+                Holder::InCurrent(op_code, data) => {
+                    let scope = [operation(op_code, true, data), rule, END.to_vec()].concat();
+                    vec![one_of_holding(1, &[&[scope][..], children].concat())]
+                }
+            }
+        };
+        let read_of = |this: QuestionValue, holder: Holder, expression: Vec<u8>| {
+            let read_by_rule = scoped_expression(&[op(ONE), rule_ref(1), op(ADD)], 0);
+            let body = body(holder, expression, &[op(READ), read_by_rule]);
+            let (_root, question) = op_in_form(&body, &[body.len() - 1]);
+            evaluate_read(
+                &question,
+                this,
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values,
+                },
+            )
+        };
+        let read = |holder: Holder, expression: Vec<u8>| {
+            read_of(QuestionValue::Uint(3), holder, expression)
+        };
+        let efivars = store_holding(&[0; 5]);
+        let write = |holder: Holder, expression: Vec<u8>| {
+            let set_by_rule = scoped_expression(
+                &[
+                    ifr_true(),
+                    rule_ref(1),
+                    set(STORE, 1, EFI_IFR_TYPE_NUM_SIZE_8),
+                    op(AND),
+                ],
+                0,
+            );
+            let body = body(holder, expression, &[op(WRITE), set_by_rule]);
+            let (_root, question) = op_in_form(&body, &[body.len() - 1]);
+            let sets = evaluate_write(
+                &question,
+                QuestionValue::Uint(3),
+                &mut ExpressionInputs {
+                    reader: &mut efivars.reader(),
+                    values: &values,
+                },
+            );
+            sets.map(|sets| {
+                sets.map(|sets| sets.var_store.into_iter().map(|set| set.bytes).collect())
+            })
+        };
+        let truth = |holder: Holder, expression: Vec<u8>| {
+            let suppressed_by_rule = conditional(
+                SUPPRESS_IF,
+                scoped_expression(&[uint8(2), rule_ref(1), op(EQUAL)], 0),
+                &[one_of_option(5, EFI_IFR_TYPE_NUM_SIZE_8, &[0])],
+            );
+            let body = body(holder, expression, &[suppressed_by_rule]);
+            let in_current = matches!(holder, Holder::Question(1) | Holder::InCurrent(..));
+            let path = [body.len() - 1, usize::from(in_current)];
+            let (_root, scope) = op_in_form(&body, &path);
+            let scope = scope.borrow();
+            evaluate_condition(
+                &scope,
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &values,
+                },
+            )
+        };
+        let not_evaluated = || {
+            (
+                ReadOutcome::Refused(ExpressionRefusal::NotEvaluated {
+                    expression: QuestionExpression::Read,
+                    what: THIS_WITHOUT_STATEMENT.to_string(),
+                }),
+                Err(ExpressionRefusal::NotEvaluated {
+                    expression: QuestionExpression::Write,
+                    what: THIS_WITHOUT_STATEMENT.to_string(),
+                }),
+                Truth::Unknown(without_statement.clone()),
+            )
+        };
+        // the rule gives `value` in a READ and a WRITE, and is 2 in a SUPPRESS_IF if `equal`
+        let taken = |value: u8, equal: bool| {
+            (
+                ReadOutcome::Value(ExpressionValue::Uint(u64::from(value) + 1)),
+                Ok(Some(vec![vec![value]])),
+                Truth::Known(equal),
+            )
+        };
+        // undetermined for the reason that `reason` gives with the current question's value
+        let undetermined = |reason: &dyn Fn(&str) -> String| {
+            (
+                ReadOutcome::Refused(ExpressionRefusal::Undetermined {
+                    expression: QuestionExpression::Read,
+                    reason: reason("question 0x0001, which gives 3"),
+                }),
+                Err(ExpressionRefusal::Undetermined {
+                    expression: QuestionExpression::Write,
+                    reason: reason("question 0x0001, which gives 3"),
+                }),
+                Truth::Unknown(reason("question 0x0001, which gives 2")),
+            )
+        };
+        let cases = [
+            (
+                "THIS in a rule that no question holds",
+                Holder::Nothing,
+                op(THIS),
+                not_evaluated(),
+            ),
+            (
+                "THIS in a MAP in a rule that no question holds",
+                Holder::Nothing,
+                in_map(op(THIS)),
+                not_evaluated(),
+            ),
+            (
+                "THIS in a rule that the current question holds",
+                Holder::Question(1),
+                op(THIS),
+                taken(3, true),
+            ),
+            (
+                "THIS in a MAP in a rule that the current question holds",
+                Holder::Question(1),
+                in_map(op(THIS)),
+                taken(3, true),
+            ),
+            (
+                "QUESTION_REF1 of the current question in a rule",
+                Holder::Nothing,
+                question_ref1(1),
+                taken(3, true),
+            ),
+            (
+                "QUESTION_REF2 of the current question in a rule",
+                Holder::Nothing,
+                ref2(1),
+                taken(3, true),
+            ),
+            (
+                "QUESTION_REF3 of the current FormSet's Guid and question in a rule",
+                Holder::Nothing,
+                current_ref3(1),
+                taken(3, true),
+            ),
+            (
+                "QUESTION_REF2 of another question in a rule",
+                Holder::Nothing,
+                ref2(2),
+                taken(9, false),
+            ),
+            (
+                "THIS in a rule that another question holds",
+                Holder::Question(2),
+                op(THIS),
+                undetermined(&|current| this_of_another_question(2, "9", current)),
+            ),
+            (
+                "THIS in a rule in a SUBTITLE scope of the current question",
+                Holder::InCurrent(SUBTITLE, &[2, 0, 0, 0, 0]),
+                op(THIS),
+                undetermined(&|current| this_of_question_id_0("EFI_IFR_SUBTITLE", current)),
+            ),
+            (
+                "THIS in a rule in a GUID op scope of the current question",
+                Holder::InCurrent(GUID, &OTHER_GUID),
+                op(THIS),
+                undetermined(&|current| this_of_question_id_0("EFI_IFR_GUID", current)),
+            ),
+            (
+                "THIS in a rule in the scope of the GUID op of an EDKII bit varstore field of the \
+                 current question",
+                Holder::InCurrent(GUID, &BIT_VARSTORE_GUID),
+                op(THIS),
+                taken(3, true),
+            ),
+        ];
+        for (name, holder, expression, (read_want, write_want, truth_want)) in cases {
+            assert_eq!(
+                read(holder, expression.clone()),
+                read_want,
+                "a READ, {name}"
+            );
+            assert_eq!(
+                write(holder, expression.clone()),
+                write_want,
+                "a WRITE, {name}"
+            );
+            assert_eq!(
+                truth(holder, expression),
+                truth_want,
+                "a SUPPRESS_IF, {name}"
+            );
+        }
+        let unreadable = QuestionValue::Unreadable {
+            kind: ValueKind::Uint,
+            reason: "<ValueUnavailable: test>".to_string(),
+        };
+        assert_eq!(
+            read_of(unreadable, Holder::Question(1), op(THIS)),
+            ReadOutcome::Refused(ExpressionRefusal::Unread {
+                expression: QuestionExpression::Read,
+                reason: "EFI_IFR_THIS: <ValueUnavailable: test>".to_string(),
+            }),
+            "a READ whose THIS cannot be read, THIS in a rule that the current question holds"
+        );
+
+        let value = |body: &[Vec<u8>], path: &[usize]| {
+            let (_root, scope) = op_in_form(body, path);
+            let scope = scope.borrow();
+            evaluate_value(
+                &scope,
+                &mut ExpressionInputs {
+                    reader: &mut Efivars::new().reader(),
+                    values: &MapValues(BTreeMap::from([
+                        (1, QuestionValue::Uint(5)),
+                        (2, QuestionValue::Uint(9)),
+                    ])),
+                },
+            )
+        };
+        assert_eq!(
+            value(
+                &[
+                    rule(1, op(THIS)),
+                    one_of_holding(1, &[value_of(rule_ref(1))])
+                ],
+                &[1, 0]
+            ),
+            Err(without_statement.clone()),
+            "an EFI_IFR_VALUE, THIS in a rule that no question holds"
+        );
+        assert_eq!(
+            value(
+                &[one_of_holding(
+                    1,
+                    &[rule(1, op(THIS)), value_of(rule_ref(1))]
+                )],
+                &[0, 1]
+            ),
+            Ok(5),
+            "an EFI_IFR_VALUE, THIS in a rule that its question holds"
+        );
+        assert_eq!(
+            value(
+                &[
+                    rule(2, rule_ref(1)),
+                    one_of_holding(1, &[rule(1, op(THIS)), value_of(rule_ref(2))]),
+                ],
+                &[1, 1]
+            ),
+            Ok(5),
+            "an EFI_IFR_VALUE, THIS in a rule that its question holds, through a rule that no \
+             question holds"
+        );
+        let held_by_1 = one_of_holding(1, &[rule(1, op(THIS))]);
+        assert_eq!(
+            value(
+                &[
+                    held_by_1.clone(),
+                    one_of_holding(2, &[value_of(rule_ref(1))])
+                ],
+                &[1, 0]
+            ),
+            Err(this_of_another_question(
+                1,
+                "5",
+                "question 0x0002, which gives 9"
+            )),
+            "an EFI_IFR_VALUE, THIS in a rule that another question holds"
+        );
+        assert_eq!(
+            value(&[held_by_1.clone(), value_of(rule_ref(1))], &[1]),
+            Err(this_of_another_question(
+                1,
+                "5",
+                "but no question holds the RULE_REF"
+            )),
+            "an EFI_IFR_VALUE in no question, THIS in a rule that a question holds"
+        );
+        assert_eq!(
+            value(
+                &[
+                    held_by_1,
+                    one_of_holding(
+                        2,
+                        &[value_of(scoped_expression(
+                            &[ifr_true(), op(UNDEFINED), rule_ref(1), op(CONDITIONAL)],
+                            0
+                        ))]
+                    ),
+                ],
+                &[1, 0]
+            ),
+            Err(format!(
+                "{EDK2_ENDS}, {SPEC_DROPS} a value that uefisettings cannot evaluate: {}",
+                this_of_another_question(1, "5", "question 0x0002, which gives 9")
+            )),
+            "an EFI_IFR_VALUE, THIS in a rule that another question holds, past an UNDEFINED \
+             that a CONDITIONAL may drop"
+        );
+    }
 }
diff --git a/src/lib/hii/forms/cross_reference.rs b/src/lib/hii/forms/cross_reference.rs
index 41bc95d..0916658 100644
--- a/src/lib/hii/forms/cross_reference.rs
+++ b/src/lib/hii/forms/cross_reference.rs
@@ -157,6 +157,8 @@ pub(super) fn handle_cross_reference(
             .display(reference.question_header.help_string_id)
             .to_string(),
         possible_options: Vec::new(),
+        // a REF without a VarStore is no listed question
+        driver_held: None,
         varstore,
         location: reference.location(),
         input: TextInput::CrossReference,
@@ -183,6 +185,7 @@ mod tests {
     use super::super::set::NewAnswer;
     use super::super::set_questions;
     use super::super::storageless::StoragelessQuestion;
+    use super::super::CheckedVarStores;
     use super::super::DefaultId;
     use super::hii_ref;
     use super::ref_text;
@@ -236,7 +239,7 @@ mod tests {
             Rc::clone(&root),
             &ListTexts::new(&strings(), &[]),
             IncludedStates::all(),
-            None,
+            CheckedVarStores::NONE,
             &mut efivars.reader(),
         )
         .into_iter()
@@ -304,6 +307,7 @@ mod tests {
                 .iter()
                 .map(|&(id, text)| (id, text.into()))
                 .collect(),
+            replaced: Default::default(),
         };
         let packages = [
             package(b"x-UEFI-ns", &[(3, "Keyword"), (9, "OnlyKeyword")]),
@@ -515,10 +519,11 @@ mod tests {
                 answer,
                 IncludedStates::empty(),
                 &mut reader,
-                None,
+                CheckedVarStores::NONE,
                 VolatileWrites::Refuse,
                 PendingOperations::new(UnsafeOperations::Refuse),
                 &WithholdingVariables::new(&variables, WithheldBytes::default()),
+                &[],
             )
             .map(drop)
             .map_err(|error| format!("{error:#}"));
diff --git a/src/lib/hii/forms/defaults.rs b/src/lib/hii/forms/defaults.rs
index 238700c..1f1e6b6 100644
--- a/src/lib/hii/forms/defaults.rs
+++ b/src/lib/hii/forms/defaults.rs
@@ -46,6 +46,7 @@ use super::Range;
 use super::TypeValue;
 use super::Walk;
 use crate::hii::strings::ListTexts;
+use crate::hii::strings::ScsuRuledOut;
 
 // UEFI 2.10 §33.3.8.3.9, §33.3.8.3.51
 const EFI_IFR_CHECKBOX_DEFAULT: u8 = 0x01;
@@ -188,11 +189,10 @@ pub(super) enum DefaultError {
     #[error("EFI_IFR_TYPE_STRING default: string {0:#06x} not found")]
     StringNotFound(u16),
     #[error(
-        "EFI_IFR_TYPE_STRING default: string {id:#06x} holds {character:?} (U+{code:04X}), which \
-         UCS-2 has no character for (UEFI 2.11 §33.2.6.2.2)",
-        code = u32::from(*.character)
+        "EFI_IFR_TYPE_STRING default: string {id:#06x} is SCSU text with a character that UEFI \
+         rules out of strings, which holds no CHAR16s to copy"
     )]
-    StringNotUcs2 { id: u16, character: char },
+    StringRuledOut { id: u16 },
     #[error("EFI_IFR_TYPE_STRING default: {0}")]
     StringText(NotUcs2),
     #[error("EFI_IFR_DEFAULT value missing")]
@@ -667,6 +667,21 @@ fn takes_option_defaults(op_code: IFROpCode) -> bool {
     }
 }
 
+/// Returns the question's standard default, which a forms browser gives a question without
+/// storage before it reads it (edk2-stable202608 SetupBrowserDxe Setup.c:5956).
+pub(super) fn standard_default(
+    question: &IFROperation,
+    inputs: &mut ExpressionInputs<'_, impl QuestionValues>,
+) -> Option<Result<u64, DefaultError>> {
+    default_for_id(
+        question,
+        &question_scope(question),
+        DefaultId::STANDARD,
+        inputs,
+    )
+    .map(|value| value.and_then(TypedDefault::number))
+}
+
 /// Returns the question's default for `default_id`: EFI_IFR_DEFAULT, then a flagged
 /// EFI_IFR_ONE_OF_OPTION, then CHECKBOX Flags (UEFI 2.10 §33.3.8.3.9, §33.3.8.3.47). A flagged
 /// option of an ORDERED_LIST gives its Value's bytes, whatever SUPPRESS_IF is around it, as
@@ -823,20 +838,16 @@ pub(super) fn buffer_defaults(
         .collect()
 }
 
-/// The little-endian CHAR16s of the text of the string `id` that `texts` show, as
-/// edk2-stable202608 SetupBrowserDxe/Setup.c GetQuestionDefault takes a default of Type STRING
-/// through HiiGetString in the platform language, refused with a character beyond UCS-2.
+/// The little-endian CHAR16s of the string `id` that `texts` show, as the firmware holds them
+/// (ListTexts::shown_units), as edk2-stable202608 SetupBrowserDxe/Setup.c GetQuestionDefault
+/// copies a default of Type STRING from HiiGetString in the platform language; refused for an
+/// SCSU string with a character that UEFI rules out of strings, which holds none.
 pub(super) fn string_bytes(texts: &ListTexts<'_>, id: u16) -> Result<Vec<u8>, DefaultError> {
-    let text = texts
-        .shown_text(id)
-        .ok_or(DefaultError::StringNotFound(id))?;
-    if let Some(character) = text
-        .chars()
-        .find(|&character| u16::try_from(u32::from(character)).is_err())
-    {
-        return Err(DefaultError::StringNotUcs2 { id, character });
-    }
-    Ok(text.encode_utf16().flat_map(u16::to_le_bytes).collect())
+    let units = texts
+        .shown_units(id)
+        .ok_or(DefaultError::StringNotFound(id))?
+        .map_err(|ScsuRuledOut| DefaultError::StringRuledOut { id })?;
+    Ok(units.into_iter().flat_map(u16::to_le_bytes).collect())
 }
 
 /// Returns the text of the first option in the question's scope with `value` that no
@@ -888,14 +899,21 @@ mod tests {
     use super::super::handle_form_set;
     use super::super::ifr_fixtures::*;
     use super::super::list_questions;
+    use super::super::CheckedVarStores;
     use super::super::IncludedStates;
     use super::super::QuestionMatch;
     use super::super::Selection;
+    use super::string_bytes;
     use super::DeclaredDefault;
     use super::DefaultError;
     use super::DefaultId;
     use super::DefaultValue;
     use super::OptionValueError;
+    use crate::hii::package::hiidb_fixtures::en_strings_package_with_blocks;
+    use crate::hii::package::hiidb_fixtures::package_list_with_guid;
+    use crate::hii::package::hiidb_fixtures::END_PACKAGE;
+    use crate::hii::package::read_db;
+    use crate::hii::strings::MatchTier;
 
     /// The MethodIdentifier of the test EFI_IFR_FORM_MAP method.
     const METHOD_IDENTIFIER: [u8; 16] = [0x33; 16];
@@ -1210,7 +1228,7 @@ mod tests {
             Rc::clone(&root),
             &ListTexts::new(&strings(), &[]),
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut efivars.reader(),
         );
         let Selection::Picked {
@@ -1218,9 +1236,9 @@ mod tests {
         } = find_question(
             root,
             &ListTexts::new(&strings(), &[]),
-            &QuestionMatch::Prompt(&BTreeSet::from([PROMPT])),
+            &QuestionMatch::Prompt(&BTreeSet::from([PROMPT]), MatchTier::Stored),
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut efivars.reader(),
         )
         else {
@@ -1251,7 +1269,7 @@ mod tests {
             root,
             &ListTexts::new(&strings(), &[]),
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut Efivars::new().reader(),
         );
 
@@ -1294,7 +1312,7 @@ mod tests {
             root,
             &ListTexts::new(&strings(), &[]),
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut Efivars::new().reader(),
         );
 
@@ -1337,7 +1355,7 @@ mod tests {
             root,
             &ListTexts::new(&strings(), &[]),
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut Efivars::new().reader(),
         );
 
@@ -1979,4 +1997,52 @@ mod tests {
             assert_eq!(flagged, declared, "{name}: as an EFI_IFR_DEFAULT");
         }
     }
+
+    /// string_bytes gives the CHAR16s that a string held, as edk2-stable202608
+    /// SetupBrowserDxe/Setup.c GetQuestionDefault copies them from HiiGetString, also where a
+    /// character of it reads as U+FFFD: a surrogate pair or a private use character of a UCS-2
+    /// string, or of its DUPLICATE. An SCSU string with SQU U+E000 holds none and refuses.
+    #[test]
+    fn string_bytes_are_the_char16s_that_strings_held() {
+        let blocks = [
+            // EFI_HII_SIBT_STRING_UCS2 "A", U+D83D U+DE00: 1
+            &[0x14, 0x41, 0x00, 0x3D, 0xD8, 0x00, 0xDE, 0x00, 0x00][..],
+            // EFI_HII_SIBT_STRING_UCS2 "A", U+E000: 2
+            &[0x14, 0x41, 0x00, 0x00, 0xE0, 0x00, 0x00],
+            // EFI_HII_SIBT_STRING_SCSU of SQU U+E000, then U+0000: 3
+            &[0x10, 0x0E, 0xE0, 0x00, 0x00],
+            // EFI_HII_SIBT_DUPLICATE of string 1: 4
+            &[0x20, 0x01, 0x00],
+            // EFI_HII_SIBT_STRING_UCS2 "B": 5
+            &[0x14, 0x42, 0x00, 0x00, 0x00],
+            // EFI_HII_SIBT_END
+            &[0x00],
+        ]
+        .concat();
+        let hiidb = package_list_with_guid(
+            [0x22; 16],
+            &[
+                en_strings_package_with_blocks(&blocks),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
+        );
+        let lists = read_db(&hiidb).expect("read the HiiDB");
+        let [list] = lists.as_slice() else {
+            panic!("{} package lists, not 1", lists.len());
+        };
+        let texts = ListTexts::new(&list.strings, &[]);
+        let surrogate_pair = vec![0x41, 0x00, 0x3D, 0xD8, 0x00, 0xDE];
+        let cases = [
+            (1, Ok(surrogate_pair.clone())),
+            (2, Ok(vec![0x41, 0x00, 0x00, 0xE0])),
+            (3, Err(DefaultError::StringRuledOut { id: 3 })),
+            (4, Ok(surrogate_pair)),
+            (5, Ok(vec![0x42, 0x00])),
+            (9, Err(DefaultError::StringNotFound(9))),
+        ];
+        for (id, want) in cases {
+            assert_eq!(string_bytes(&texts, id), want, "string {id}");
+        }
+    }
 }
diff --git a/src/lib/hii/forms/driver_held.rs b/src/lib/hii/forms/driver_held.rs
new file mode 100644
index 0000000..a9ec3ac
--- /dev/null
+++ b/src/lib/hii/forms/driver_held.rs
@@ -0,0 +1,736 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! Questions whose value only their driver holds: a ONE_OF, NUMERIC or CHECKBOX without a VarStore
+//! that storageless.rs routes through its driver's EFI_HII_CONFIG_ACCESS_PROTOCOL.Callback()
+//! (UEFI 2.11 §33.2.5.6): what get and set need to reach it through the driver, and the stores
+//! that the question's FormSet declares, with the settings that a forms browser requests of each.
+
+use std::fmt;
+use std::str::FromStr;
+
+use thiserror::Error;
+
+use super::conditions::enclosing_form_set;
+use super::defaults::standard_default;
+use super::ordered_list::ListRefusal;
+#[cfg(any(
+    target_os = "uefi",
+    target_os = "linux",
+    target_os = "windows",
+    all(test, efivar_dumps)
+))]
+use super::question_values::checkbox_text;
+use super::question_values::form_set_guid;
+#[cfg(any(
+    target_os = "uefi",
+    target_os = "linux",
+    target_os = "windows",
+    all(test, efivar_dumps)
+))]
+use super::question_values::one_of_text;
+use super::question_values::ValueQuestion;
+use super::set::option_value;
+use super::set::text_value;
+use super::set::ChangeValueError;
+use super::set::NewAnswer;
+use super::storage::store_declarations;
+use super::storage::StoreDeclaration;
+use super::storage::VariableStore;
+use super::storageless::NoVarStore;
+use super::storageless::StoragelessQuestion;
+use super::storageless::StoragelessRoute;
+use super::DisabledForm;
+use super::FormSetWalk;
+use super::IFROperation;
+use super::IncludedStates;
+use super::NumericFormat;
+use super::ParsedOperation;
+use super::QuestionDescriptor;
+use super::QuestionExpression;
+use super::QuestionValues;
+use crate::hii::package::Guid;
+
+/// EFI_IFR_TYPE_x (UEFI 2.11 §33.3.8.3.51) of the values of the questions that this module
+/// describes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[repr(u8)]
+pub(crate) enum IfrValueType {
+    NumSize8 = 0x00,
+    NumSize16 = 0x01,
+    NumSize32 = 0x02,
+    NumSize64 = 0x03,
+    Boolean = 0x04,
+}
+
+impl IfrValueType {
+    /// The type of a ONE_OF or NUMERIC value of `size` bytes.
+    fn of_size(size: u8) -> Option<Self> {
+        match size {
+            1 => Some(Self::NumSize8),
+            2 => Some(Self::NumSize16),
+            4 => Some(Self::NumSize32),
+            8 => Some(Self::NumSize64),
+            _ => None,
+        }
+    }
+
+    /// The bits of a u64 that a value of the type uses.
+    pub(crate) fn mask(self) -> u64 {
+        match self {
+            Self::NumSize8 | Self::Boolean => u64::from(u8::MAX),
+            Self::NumSize16 => u64::from(u16::MAX),
+            Self::NumSize32 => u64::from(u32::MAX),
+            Self::NumSize64 => u64::MAX,
+        }
+    }
+}
+
+/// A question whose value only its driver holds.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct DriverHeldQuestion {
+    /// The GUID of its FormSet
+    pub(crate) form_set: Guid,
+    pub(crate) question_id: u16,
+    pub(crate) value_type: IfrValueType,
+    /// Its value before the driver's: its standard default, else 0, as a forms browser starts a
+    /// question without storage (edk2-stable202608 SetupBrowserDxe Setup.c:5956)
+    pub(crate) initial: u64,
+    /// The stores its FormSet declares
+    pub(crate) stores: Vec<StoreDeclaration>,
+    /// The READ (get) and WRITE (set) expressions that a forms browser evaluates beside its
+    /// Callback()s, which uefisettings does not apply
+    pub(crate) read_expression: bool,
+    pub(crate) write_expression: bool,
+    /// How get shows a value
+    display: ValueDisplay,
+}
+
+/// How get shows a value of a question, as it shows a stored one.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum ValueDisplay {
+    OneOf(NumericFormat),
+    Numeric(NumericFormat),
+    CheckBox,
+}
+
+impl fmt::Display for IfrValueType {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Self::NumSize8 => "EFI_IFR_TYPE_NUM_SIZE_8",
+            Self::NumSize16 => "EFI_IFR_TYPE_NUM_SIZE_16",
+            Self::NumSize32 => "EFI_IFR_TYPE_NUM_SIZE_32",
+            Self::NumSize64 => "EFI_IFR_TYPE_NUM_SIZE_64",
+            Self::Boolean => "EFI_IFR_TYPE_BOOLEAN",
+        })
+    }
+}
+
+/// The EFI_IFR_TYPE_x name that Display writes.
+impl FromStr for IfrValueType {
+    type Err = UnknownValueType;
+
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        [
+            Self::NumSize8,
+            Self::NumSize16,
+            Self::NumSize32,
+            Self::NumSize64,
+            Self::Boolean,
+        ]
+        .into_iter()
+        .find(|value_type| value_type.to_string() == text)
+        .ok_or_else(|| UnknownValueType(text.to_owned()))
+    }
+}
+
+/// The refusal of a question whose READ or WRITE expression a forms browser evaluates beside its
+/// driver's Callback()s: uefisettings evaluates them only for questions without
+/// EFI_IFR_FLAG_CALLBACK.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+#[error(
+    "question has no VarStore, and uefisettings does not apply its {0} expression beside its \
+     driver's Callback()s"
+)]
+pub(crate) struct ExpressionBesideCallback(pub(crate) QuestionExpression);
+
+/// The refusal of a question whose FormSet has a form that read_db disables, as UEFI 2.11
+/// §33.2.5.10.1 disables the form of a malformed op, holding a PASSWORD or VarStore op: read_db
+/// drops that form from the FormSet's tree, so store_declarations sees neither, and uefisettings
+/// cannot tell which stores a restore through RouteConfig() would change.
+#[cfg_attr(
+    not(any(target_os = "uefi", all(test, efivar_dumps))),
+    allow(
+        dead_code,
+        reason = "only the UEFI Shell build calls a driver's Callback()"
+    )
+)]
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error(
+    "{reason}; that form holds an {op}, so uefisettings cannot tell which stores a restore \
+     through RouteConfig() would change"
+)]
+pub(crate) struct DisabledFormStore {
+    /// The form's DisabledForm reason: its FormId, its FormSet and why read_db disables it
+    reason: String,
+    op: &'static str,
+}
+
+/// A name of no IfrValueType.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("{0:?} names no EFI_IFR_TYPE_x of a question that its driver holds")]
+pub(crate) struct UnknownValueType(String);
+
+/// The DriverHeldQuestion of the question op `op`, which is `value_question` of `varstore`, if
+/// it has no VarStore and get or set reaches its value through its driver's Callback().
+pub(super) fn driver_held(
+    op: &IFROperation,
+    varstore: &Result<Box<dyn VariableStore>, anyhow::Error>,
+    value_question: ValueQuestion<'_>,
+    walk: &mut FormSetWalk<'_, impl QuestionValues>,
+) -> Option<DriverHeldQuestion> {
+    let NoVarStore(storageless) = varstore.as_ref().err()?.downcast_ref::<NoVarStore>()?;
+    // StoragelessQuestion::refusal refuses it: no CallBack() could name it alone
+    if storageless.shares_question_id() {
+        return None;
+    }
+    let (read_expression, write_expression) = (
+        callback_expression(*storageless, QuestionExpression::Read)?,
+        callback_expression(*storageless, QuestionExpression::Write)?,
+    );
+    let header = value_question.header();
+    let form_set = enclosing_form_set(op)?;
+    let ParsedOperation::FormSet(parsed_form_set) = &form_set.borrow().parsed_data else {
+        return None;
+    };
+    let form_set_guid = parsed_form_set.guid;
+    let (value_type, display) = match value_question {
+        ValueQuestion::OneOf(parsed) => (
+            IfrValueType::of_size(parsed.data.size())?,
+            ValueDisplay::OneOf(NumericFormat::from_ifr(&parsed.data, parsed.flags)),
+        ),
+        ValueQuestion::Numeric(parsed) => (
+            IfrValueType::of_size(parsed.data.size())?,
+            ValueDisplay::Numeric(NumericFormat::from_ifr(&parsed.data, parsed.flags)),
+        ),
+        ValueQuestion::CheckBox(_) => (IfrValueType::Boolean, ValueDisplay::CheckBox),
+        // StoragelessQuestion::refusal refuses it by its op
+        ValueQuestion::DateTime(_) => return None,
+    };
+    let initial = match standard_default(op, &mut walk.inputs) {
+        Some(Ok(value)) => value & value_type.mask(),
+        Some(Err(_)) | None => 0,
+    };
+    let stores = store_declarations(&form_set.borrow(), walk.texts);
+    Some(DriverHeldQuestion {
+        form_set: form_set_guid,
+        question_id: header.question_id,
+        value_type,
+        initial,
+        stores,
+        read_expression,
+        write_expression,
+        display,
+    })
+}
+
+/// Whether a browser evaluates the `expression` of `storageless` beside its driver's Callback()s;
+/// None unless get or set reaches its value through them.
+fn callback_expression(
+    storageless: StoragelessQuestion,
+    expression: QuestionExpression,
+) -> Option<bool> {
+    match storageless.route(expression) {
+        Ok(StoragelessRoute::DriverCallback) => Some(false),
+        Ok(StoragelessRoute::Expression { callback: true }) => Some(true),
+        Ok(StoragelessRoute::Expression { callback: false } | StoragelessRoute::Value) | Err(_) => {
+            None
+        }
+    }
+}
+
+impl DriverHeldQuestion {
+    /// Refuses the question if one of `disabled`, the forms that read_db drops from its package
+    /// list, is a form of its FormSet, of another of its GUID there, or of no FormSet whose GUID
+    /// is known, that holds a PASSWORD or VarStore op (DisabledFormStore).
+    #[cfg_attr(
+        not(any(target_os = "uefi", all(test, efivar_dumps))),
+        allow(
+            dead_code,
+            reason = "only the UEFI Shell build calls a driver's Callback()"
+        )
+    )]
+    pub(crate) fn check_disabled_forms(
+        &self,
+        disabled: &[DisabledForm],
+    ) -> Result<(), DisabledFormStore> {
+        let held_store = disabled
+            .iter()
+            .filter(|disabled| {
+                form_set_guid(&disabled.form.borrow()).is_none_or(|guid| guid == self.form_set)
+            })
+            .find_map(|disabled| Some((disabled, disabled.store_op?)));
+        match held_store {
+            Some((disabled, op)) => Err(DisabledFormStore {
+                reason: disabled.reason.clone(),
+                op,
+            }),
+            None => Ok(()),
+        }
+    }
+}
+
+impl QuestionDescriptor {
+    /// What get and set need of a question whose value only its driver holds, if it is one.
+    pub(crate) fn driver_held(&self) -> Option<&DriverHeldQuestion> {
+        self.driver_held.as_ref()
+    }
+
+    /// The value of a question whose driver holds it that the text of `answer`, or the option of
+    /// one of its variations that chosen_option picks with `include`, names, as set takes it;
+    /// items are refused, as for a stored question other than an ORDERED_LIST.
+    pub(crate) fn driver_held_value(
+        &self,
+        answer: NewAnswer<'_>,
+        include: IncludedStates,
+    ) -> Result<u64, ChangeValueError> {
+        let (text, variations) = match answer {
+            NewAnswer::Text { text, variations } => (text, variations),
+            NewAnswer::Items(_) => return Err(ListRefusal::Items.of(self)),
+        };
+        let value = match self.possible_options.is_empty() {
+            true => text_value(self, text)?,
+            false => option_value(self, self.chosen_option(variations, include)?)?,
+        };
+        value.as_u64().ok_or(ChangeValueError::InvalidOption)
+    }
+
+    /// `value`, of a question whose driver holds it, as get shows a stored value: the option's
+    /// text, the number, or 0 or 1; None for another question.
+    #[cfg(any(
+        target_os = "uefi",
+        target_os = "linux",
+        target_os = "windows",
+        all(test, efivar_dumps)
+    ))]
+    pub(crate) fn driver_held_text(&self, value: u64) -> Option<String> {
+        let held = self.driver_held.as_ref()?;
+        Some(match held.display {
+            ValueDisplay::OneOf(format) => {
+                let options: Vec<_> = self
+                    .possible_options
+                    .iter()
+                    .filter(|option| option.as_u64() == Some(value))
+                    .collect();
+                // the first that may be shown, as handle_oneof picks it
+                let option = options
+                    .iter()
+                    .find(|option| option.state.may_be_allowed(IncludedStates::empty()))
+                    .or(options.first());
+                one_of_text(value, format, option.map(|option| option.value.trim()))
+            }
+            ValueDisplay::Numeric(format) => format.decode(value).to_string(),
+            ValueDisplay::CheckBox => checkbox_text(value),
+        })
+    }
+}
+
+#[cfg(all(test, any(target_os = "linux", target_os = "windows")))]
+impl DriverHeldQuestion {
+    /// A CHECKBOX whose driver holds its value: QuestionId `question_id` of the FormSet
+    /// `form_set`, which declares no store.
+    pub(crate) fn checkbox(form_set: Guid, question_id: u16) -> Self {
+        Self {
+            form_set,
+            question_id,
+            value_type: IfrValueType::Boolean,
+            initial: 0,
+            stores: Vec::new(),
+            read_expression: false,
+            write_expression: false,
+            display: ValueDisplay::CheckBox,
+        }
+    }
+}
+
+#[cfg(test)]
+#[cfg(efivar_dumps)]
+mod tests {
+    use std::collections::BTreeSet;
+    use std::num::NonZeroUsize;
+    use std::rc::Rc;
+
+    use super::super::ifr_fixtures::*;
+    use super::super::storage::DeclaredKind;
+    use super::super::walk_scopes;
+    use super::super::Walk;
+    use super::*;
+
+    /// EFI_IFR_FLAG_CALLBACK (UEFI 2.11 §33.3.8.2.2)
+    const EFI_IFR_FLAG_CALLBACK: u8 = 0x04;
+
+    /// A question header of QuestionId `id` on VarStore `var_store_id` at VarOffset `info`, with
+    /// `flags`.
+    fn header(id: u16, var_store_id: u16, info: u16, flags: u8) -> Vec<u8> {
+        [
+            &3u16.to_le_bytes()[..],
+            &4u16.to_le_bytes(),
+            &id.to_le_bytes(),
+            &var_store_id.to_le_bytes(),
+            &info.to_le_bytes(),
+            &[flags],
+        ]
+        .concat()
+    }
+
+    /// A UINT8 ONE_OF without a VarStore, with `flags` and options 0 and 1, the second the
+    /// standard default.
+    fn storage_less_one_of(id: u16, flags: u8) -> Vec<u8> {
+        storage_less_one_of_with(id, flags, &[])
+    }
+
+    /// storage_less_one_of, with `children` after its options.
+    fn storage_less_one_of_with(id: u16, flags: u8, children: &[Vec<u8>]) -> Vec<u8> {
+        [
+            operation(
+                ONE_OF,
+                true,
+                &[header(id, 0, 0xFFFF, flags), vec![0x00, 0, 1, 1]].concat(),
+            ),
+            one_of_option(5, 0x00, &[0]),
+            // EFI_IFR_OPTION_DEFAULT
+            operation(
+                ONE_OF_OPTION,
+                false,
+                &[&6u16.to_le_bytes()[..], &[0x10, 0x00, 1]].concat(),
+            ),
+            children.concat(),
+            END.to_vec(),
+        ]
+        .concat()
+    }
+
+    /// A READ or WRITE expression of TRUE.
+    fn expression(op_code: u8) -> Vec<u8> {
+        [operation(op_code, false, &[]), ifr_true()].concat()
+    }
+
+    fn descriptor_of(body: &[Vec<u8>], question_id: u16) -> QuestionDescriptor {
+        let root = parse_form_set(body);
+        let mut found = None;
+        walk_scopes(std::slice::from_ref(&root), (), |node, ()| {
+            let matches = super::super::question_values::value_question(&node.borrow())
+                .is_some_and(|question| question.header().question_id == question_id);
+            if matches && found.is_none() {
+                found = Some(Rc::clone(node));
+            }
+            Walk::Enter(())
+        });
+        let node = found.expect("the question");
+        let var_store_id = super::super::question_values::value_question(&node.borrow())
+            .expect("a value question")
+            .header()
+            .var_store_id;
+        let fixture = VarStoreFixture {
+            store: super::super::find_corresponding_varstore(Rc::clone(&node), var_store_id),
+            efivars: Efivars::new(),
+        };
+        question_descriptor(&node, fixture)
+    }
+
+    #[test]
+    fn a_storage_less_callback_question_is_driver_held_with_its_form_set_stores() {
+        let body = [
+            var_store(2, [0x22; 16], "Buffer", 8),
+            var_store_efi(1, "Store", NV_BS_RT, 4),
+            form(
+                1,
+                &[
+                    storage_less_one_of(0x0201, EFI_IFR_FLAG_CALLBACK),
+                    checkbox_at(0x0301, 7, 2, 3),
+                    uint8_numeric_on(0x0302, 7, 2),
+                    checkbox_at(0x0303, 7, 1, 0),
+                ],
+            ),
+        ];
+
+        let descriptor = descriptor_of(&body, 0x0201);
+        let held = descriptor.driver_held().expect("driver held");
+
+        assert_eq!(
+            (held.question_id, held.value_type, held.initial),
+            (0x0201, IfrValueType::NumSize8, 1),
+            "QuestionId, type, standard default"
+        );
+        assert_eq!(
+            held.stores,
+            [
+                StoreDeclaration {
+                    id: 2,
+                    guid: [0x22; 16].into(),
+                    kind: DeclaredKind::Buffer {
+                        name: "Buffer".into(),
+                        blocks: vec![
+                            (3, NonZeroUsize::new(1).expect("1")),
+                            (0, NonZeroUsize::new(1).expect("1"))
+                        ],
+                    },
+                    holds_password: false,
+                },
+                StoreDeclaration {
+                    id: 1,
+                    guid: [0; 16].into(),
+                    kind: DeclaredKind::EfiVariable {
+                        name: "Store".into()
+                    },
+                    holds_password: false,
+                },
+            ],
+            "the FormSet's stores, the Buffer one with its questions' blocks"
+        );
+    }
+
+    #[test]
+    fn a_question_with_a_varstore_or_without_callback_is_not_driver_held() {
+        let body = [
+            var_store_efi(1, "Store", NV_BS_RT, 4),
+            form(
+                1,
+                &[
+                    storage_less_one_of(0x0201, 0),
+                    storage_less_one_of_with(0x0202, 0, &[expression(READ), expression(WRITE)]),
+                    checkbox_at(0x0301, 7, 1, 0),
+                    operation(
+                        CHECKBOX,
+                        false,
+                        &[header(0x0302, 1, 1, EFI_IFR_FLAG_CALLBACK), vec![0x00]].concat(),
+                    ),
+                ],
+            ),
+        ];
+        for id in [0x0201, 0x0202, 0x0301, 0x0302] {
+            assert_eq!(
+                descriptor_of(&body, id).driver_held(),
+                None,
+                "question {id:#06x}"
+            );
+        }
+    }
+
+    /// No CallBack() names a PASSWORD question: a PASSWORD is no ValueQuestion, of which only a
+    /// ONE_OF, NUMERIC or CHECKBOX is driver held, and a storage-less CALLBACK question whose
+    /// QuestionId a PASSWORD of its FormSet also has is not driver held either, as its driver
+    /// could take a CallBack() for it for one of the PASSWORD; with a QuestionId of its own it
+    /// is.
+    #[test]
+    fn no_callback_names_a_password_question() {
+        for (password_id, held) in [(0x0201, false), (0x0202, true)] {
+            let password = password_on(password_id, 0, 0, 0);
+            let body = [form(
+                1,
+                &[
+                    storage_less_one_of(0x0201, EFI_IFR_FLAG_CALLBACK),
+                    password.clone(),
+                ],
+            )];
+            let root = parse_form_set(&body);
+            let password_op = find_op(&root, &password[2..]).expect("the PASSWORD");
+            assert!(
+                super::super::question_values::value_question(&password_op.borrow()).is_none(),
+                "the PASSWORD is no ValueQuestion"
+            );
+            assert_eq!(
+                descriptor_of(&body, 0x0201).driver_held().is_some(),
+                held,
+                "with a PASSWORD of QuestionId {password_id:#06x}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_storage_less_callback_numeric_or_checkbox_is_driver_held() {
+        let numeric = operation(
+            NUMERIC,
+            false,
+            &[
+                header(0x0401, 0, 0xFFFF, EFI_IFR_FLAG_CALLBACK),
+                // EFI_IFR_NUMERIC_SIZE_2 with EFI_IFR_DISPLAY_INT_DEC; MinValue, MaxValue, Step
+                vec![0x01],
+                [0u16, 300, 1]
+                    .iter()
+                    .flat_map(|v| v.to_le_bytes())
+                    .collect(),
+            ]
+            .concat(),
+        );
+        let checkbox = operation(
+            CHECKBOX,
+            false,
+            &[header(0x0402, 0, 0xFFFF, EFI_IFR_FLAG_CALLBACK), vec![0x00]].concat(),
+        );
+        let body = [form(1, &[numeric, checkbox])];
+        let cases = [
+            (0x0401, IfrValueType::NumSize16, 0xFFFF, "-1"),
+            (0x0402, IfrValueType::Boolean, 1, "1"),
+        ];
+        for (id, value_type, value, shown) in cases {
+            let descriptor = descriptor_of(&body, id);
+            let held = descriptor.driver_held().expect("driver held");
+            assert_eq!(held.value_type, value_type, "question {id:#06x}'s type");
+            assert_eq!(
+                descriptor.driver_held_text(value).as_deref(),
+                Some(shown),
+                "question {id:#06x} shows {value:#x} as get shows a stored value"
+            );
+        }
+    }
+
+    #[test]
+    fn a_callback_question_records_its_read_and_write_expressions() {
+        let cases = [
+            (0x0201, Vec::new(), (false, false)),
+            (0x0202, vec![expression(READ)], (true, false)),
+            (0x0203, vec![expression(WRITE)], (false, true)),
+            (
+                0x0204,
+                vec![expression(READ), expression(WRITE)],
+                (true, true),
+            ),
+        ];
+        let questions: Vec<Vec<u8>> = cases
+            .iter()
+            .map(|(id, children, _)| storage_less_one_of_with(*id, EFI_IFR_FLAG_CALLBACK, children))
+            .collect();
+        let body = [form(1, &questions)];
+        for (id, _, want) in cases {
+            let descriptor = descriptor_of(&body, id);
+            let held = descriptor.driver_held().expect("driver held");
+            assert_eq!(
+                (held.read_expression, held.write_expression),
+                want,
+                "question {id:#06x}"
+            );
+        }
+    }
+
+    /// A question whose FormSet has a form that UEFI 2.11 §33.2.5.10.1 disables holding a
+    /// PASSWORD or VarStore op, or whose disabled form's FormSet is unknown, is refused, as
+    /// store_declarations sees neither, with the form's DisabledForm reason, which names the form,
+    /// its FormSet and why it is disabled; one whose disabled form holds neither, or is of another
+    /// FormSet, is not.
+    #[test]
+    fn a_disabled_form_with_a_password_or_var_store_refuses_the_driver() {
+        let short_checkbox = operation(CHECKBOX, false, &[0x00]);
+        let cases = [
+            (
+                "PASSWORD",
+                vec![password_on(0x0501, 3, 2, 4), short_checkbox.clone()],
+                Some("EFI_IFR_PASSWORD"),
+            ),
+            (
+                "VARSTORE",
+                vec![var_store(4, [0x44; 16], "Inner", 8), short_checkbox.clone()],
+                Some("EFI_IFR_VARSTORE"),
+            ),
+            (
+                "neither",
+                vec![checkbox_at(0x0502, 7, 2, 0), short_checkbox.clone()],
+                None,
+            ),
+        ];
+        for (case, disabled_body, want) in cases {
+            let body = [
+                var_store(2, [0x22; 16], "Buffer", 8),
+                form(1, &[storage_less_one_of(0x0201, EFI_IFR_FLAG_CALLBACK)]),
+                form(2, &disabled_body),
+            ];
+            let descriptor = descriptor_of(&body, 0x0201);
+            let held = descriptor.driver_held().expect("driver held");
+            let (root, disabled) = parse_form_set_dropping(&body);
+            assert_eq!(disabled.len(), 1, "{case}: the disabled forms");
+            let refusal = want.map(|op| DisabledFormStore {
+                reason: disabled[0].reason.clone(),
+                op,
+            });
+            if let Some(refusal) = &refusal {
+                let text = refusal.to_string();
+                assert!(
+                    text.starts_with(
+                        "the form 2 of the FormSet 11111111-1111-1111-1111-111111111111, whose \
+                         EFI_IFR_CHECKBOX op is malformed; UEFI 2.11 §33.2.5.10.1 disables the \
+                         form of a malformed op: "
+                    ) && text.ends_with(&format!(
+                        "; that form holds an {}, so uefisettings cannot tell which stores a \
+                         restore through RouteConfig() would change",
+                        refusal.op
+                    )),
+                    "{case}: the refusal names the form, its FormSet and why: {text}"
+                );
+            }
+
+            assert_eq!(
+                held.check_disabled_forms(&disabled),
+                refusal.clone().map_or(Ok(()), Err),
+                "{case}"
+            );
+            let other = DriverHeldQuestion {
+                form_set: [0x33; 16].into(),
+                ..held.clone()
+            };
+            assert_eq!(
+                other.check_disabled_forms(&disabled),
+                Ok(()),
+                "{case}: of another FormSet"
+            );
+            drop(root);
+            assert_eq!(
+                other.check_disabled_forms(&disabled),
+                refusal.map_or(Ok(()), Err),
+                "{case}: of no FormSet whose GUID is known"
+            );
+        }
+    }
+
+    #[test]
+    fn values_show_as_get_shows_them_and_parse_as_set_takes_them() {
+        let body = [form(
+            1,
+            &[storage_less_one_of(0x0201, EFI_IFR_FLAG_CALLBACK)],
+        )];
+        let descriptor = descriptor_of(&body, 0x0201);
+        let option = descriptor.possible_options[1].value.clone();
+
+        assert_eq!(
+            descriptor.driver_held_text(1),
+            Some(option.trim().to_string()),
+            "an option's value shows its text"
+        );
+        assert_eq!(
+            descriptor.driver_held_text(7).as_deref(),
+            Some("7 (no matching option)"),
+            "another value shows its number"
+        );
+        assert_eq!(
+            descriptor
+                .driver_held_value(
+                    NewAnswer::Text {
+                        text: &option,
+                        variations: &BTreeSet::from([option.clone()]),
+                    },
+                    IncludedStates::empty()
+                )
+                .expect("the option"),
+            1,
+            "the option's text sets its value"
+        );
+    }
+}
diff --git a/src/lib/hii/forms/ifr_fixtures.rs b/src/lib/hii/forms/ifr_fixtures.rs
index f4e1864..acdd5e2 100644
--- a/src/lib/hii/forms/ifr_fixtures.rs
+++ b/src/lib/hii/forms/ifr_fixtures.rs
@@ -98,7 +98,7 @@ pub(crate) const DISABLE_IF: u8 = 0x1E;
 pub(super) const FORM: u8 = 0x01;
 pub(crate) const SUBTITLE: u8 = 0x02;
 pub(crate) const LOCKED: u8 = 0x0B;
-const ONE_OF_OPTION: u8 = 0x09;
+pub(super) const ONE_OF_OPTION: u8 = 0x09;
 const FORM_SET: u8 = 0x0E;
 const EQ_ID_VAL: u8 = 0x12;
 pub(super) const NOT: u8 = 0x17;
@@ -122,13 +122,7 @@ pub(crate) const VAR_STORE: u8 = 0x24;
 pub(crate) const VAR_STORE_NAME_VALUE: u8 = 0x25;
 pub(crate) const VAR_STORE_EFI: u8 = 0x26;
 pub(crate) const READ: u8 = 0x2D;
-pub(super) const WRITE: u8 = 0x2E;
-
-/// The Guid E770BB69-BCB4-4D04-9E97-23FF9456FEAC of AMI firmware's VarStore SystemAccess, as
-/// stored.
-pub(crate) const SYSTEM_ACCESS_GUID: [u8; 16] = [
-    0x69, 0xBB, 0x70, 0xE7, 0xB4, 0xBC, 0x04, 0x4D, 0x9E, 0x97, 0x23, 0xFF, 0x94, 0x56, 0xFE, 0xAC,
-];
+pub(crate) const WRITE: u8 = 0x2E;
 
 pub(crate) const GUID: u8 = 0x5F;
 
@@ -357,6 +351,7 @@ pub(crate) fn en_us_package(strings: StringMap) -> StringPackage {
     StringPackage {
         language: Language(b"en-US".to_vec()),
         strings,
+        replaced: Default::default(),
     }
 }
 
@@ -790,9 +785,20 @@ pub(crate) fn password_on(
     prompt: u16,
     var_store_id: u16,
     offset: u16,
+) -> Vec<u8> {
+    flagged_password_on(question_id, prompt, var_store_id, offset, 0x00)
+}
+
+/// password_on, with the question Flags `flags`: 0x04 is EFI_IFR_FLAG_CALLBACK.
+pub(crate) fn flagged_password_on(
+    question_id: u16,
+    prompt: u16,
+    var_store_id: u16,
+    offset: u16,
+    flags: u8,
 ) -> Vec<u8> {
     let data = [
-        question_header_on(question_id, prompt, var_store_id, offset),
+        question_header_with(question_id, prompt, var_store_id, offset, flags),
         [&1u16.to_le_bytes()[..], &20u16.to_le_bytes()].concat(), // MinSize, MaxSize
     ]
     .concat();
@@ -1033,7 +1039,11 @@ pub(super) fn question_descriptor(
     node: &Rc<RefCell<IFROperation>>,
     var_store: VarStoreFixture,
 ) -> QuestionDescriptor {
-    question_descriptor_with(node, var_store, &VarStoreValues::new(&root_of(node), None))
+    question_descriptor_with(
+        node,
+        var_store,
+        &VarStoreValues::new(&root_of(node), CheckedVarStores::NONE),
+    )
 }
 
 /// Returns the root of the tree of `node`.
@@ -1066,7 +1076,7 @@ pub(super) fn question_descriptor_timed(
     VarStoreFixture { store, efivars }: VarStoreFixture,
     time_services: Option<Rc<dyn TimeServices>>,
 ) -> QuestionDescriptor {
-    let values = VarStoreValues::new(&root_of(node), None);
+    let values = VarStoreValues::new(&root_of(node), CheckedVarStores::NONE);
     let mut reader = efivars.reader().with_time_services(time_services);
     describe(node, store, &values, &mut reader)
 }
diff --git a/src/lib/hii/forms/keywords.rs b/src/lib/hii/forms/keywords.rs
index fafe47c..fdd18df 100644
--- a/src/lib/hii/forms/keywords.rs
+++ b/src/lib/hii/forms/keywords.rs
@@ -64,10 +64,14 @@ use super::set::own_write;
 use super::set::ChangeValueError;
 use super::set::NewValue;
 use super::set::VarStoreWrite;
+use super::string_question::stored_text;
+use super::string_question::StringInput;
 use super::try_walk_scopes;
 use super::walk_scopes;
 use super::write_plan::list_own_write;
+use super::write_plan::string_own_write;
 use super::AnswerOption;
+use super::CheckedVarStores;
 use super::Choice;
 use super::DeclaredStore;
 use super::DisabledForm;
@@ -88,6 +92,7 @@ use super::ReadOnlyWriter;
 use super::SelectionError;
 use super::ShortVarStoreEfi;
 use super::TextInput;
+use super::TextInputKind;
 use super::TimeStorage;
 use super::TypeValue;
 use super::Walk;
@@ -121,6 +126,7 @@ use crate::hii::config_string::ValueRange;
 use crate::hii::package::ParsedPackageList;
 use crate::hii::strings::Language;
 use crate::hii::strings::ListTexts;
+use crate::hii::strings::ScsuRuledOut;
 use crate::hii::variables::is_volatile;
 use crate::hii::variables::DataPatch;
 use crate::hii::variables::EfivarReader;
@@ -246,17 +252,18 @@ pub(crate) enum KeywordRefusal {
         storage_width: usize,
         question: String,
     },
-    /// An ORDERED_LIST whose description holds no ListInput, which describe_question always
-    /// gives it (handle_ordered_list)
+    /// An ORDERED_LIST or STRING whose description holds another TextInput than its own, which
+    /// describe_question always gives it (handle_ordered_list, handle_string)
     #[error(
-        "keyword {keyword}: internal inconsistency: question \"{question}\" is an \
-         EFI_IFR_ORDERED_LIST, but its description holds set's TextInput::{input}, not a \
-         ListInput"
+        "keyword {keyword}: internal inconsistency: question \"{question}\" is an {op}, but its \
+         description holds set's {input}, not {expected}"
     )]
-    ListInputMismatch {
+    InputMismatch {
         keyword: String,
         question: String,
-        input: &'static str,
+        op: &'static str,
+        input: TextInputKind,
+        expected: TextInputKind,
     },
     #[error("keyword {keyword}: VALUE={value} {reason} question \"{question}\"")]
     Value {
@@ -404,6 +411,11 @@ pub(crate) enum KeywordInfoRefusal {
     },
     #[error("keyword {keyword}: no strings package of a display language holds its string {id}")]
     NoText { keyword: String, id: u16 },
+    #[error(
+        "keyword {keyword}: its string {id} is SCSU text with a character that UEFI rules out of \
+         strings, which holds no CHAR16s to copy"
+    )]
+    RuledOutText { keyword: String, id: u16 },
     #[error(transparent)]
     ConfigString(#[from] ConfigStringError),
 }
@@ -829,10 +841,10 @@ impl<'a> KeywordQuestion<'a> {
     /// `include`, `volatile` and the variables of `reader`: the question's state, whether it is
     /// read-only, which no `include` lifts, its option of the VALUE or the VALUE's range, the
     /// fields of a DATE or TIME (DateTimeInput::number_value), the items of an ORDERED_LIST
-    /// (list_write), the EFI_HII_REF of a REF, which set does not write, the variable's, and
-    /// whether the bytes written overlap those that `reader` withholds, which hold a password
-    /// (ChangeValueError::PasswordBytes); and refuses a VALUE that is not the bytes that set
-    /// writes. Returns what SetData() writes.
+    /// (list_write), the text of a STRING (string_write), the EFI_HII_REF of a REF, which set
+    /// does not write, the variable's, and whether the bytes written overlap those that `reader`
+    /// withholds, which hold a password (ChangeValueError::PasswordBytes); and refuses a VALUE
+    /// that is not the bytes that set writes. Returns what SetData() writes.
     pub(crate) fn check_set(
         &self,
         resp: &KeywordResp,
@@ -848,11 +860,7 @@ impl<'a> KeywordQuestion<'a> {
         let Some(listed) = ListedQuestion::of(&op) else {
             return Err(self.unchecked(&op).into());
         };
-        // set takes a STRING, but keyword set takes none yet: refused before its VALUE
-        if let ListedQuestion::String(_) = listed {
-            return Err(self.unchecked(&op).into());
-        }
-        let prompt = self.texts.display(header.prompt_string_id);
+        let prompt: &str = &self.texts.display(header.prompt_string_id);
         if keyword_width(&op) != Some(resp.value.as_bytes().len()) {
             return Err(self.value_refusal(resp, prompt, ValueRefusal::Width).into());
         }
@@ -865,15 +873,20 @@ impl<'a> KeywordQuestion<'a> {
             }
             ListedQuestion::OrderedList(_) => {
                 let TextInput::OrderedList(input) = &descriptor.input else {
-                    return Err(KeywordRefusal::ListInputMismatch {
-                        keyword: self.keyword.to_string(),
-                        question: descriptor.question.clone(),
-                        input: descriptor.input.kind(),
-                    }
-                    .into());
+                    return Err(self
+                        .input_mismatch(&op, &descriptor, TextInputKind::OrderedList)
+                        .into());
                 };
                 Some(self.list_write(input, &descriptor, resp, prompt, include, reader)?)
             }
+            ListedQuestion::String(_) => {
+                let TextInput::String(input) = &descriptor.input else {
+                    return Err(self
+                        .input_mismatch(&op, &descriptor, TextInputKind::String)
+                        .into());
+                };
+                Some(self.string_write(input, &descriptor, resp, prompt, reader)?)
+            }
             // as set refuses it, after its choice (plan_question)
             ListedQuestion::Ref(_) => {
                 return Err(ChangeValueError::CrossReference {
@@ -881,8 +894,6 @@ impl<'a> KeywordQuestion<'a> {
                 })
                 .with_context(|| format!("keyword {}", self.keyword));
             }
-            // refused before its VALUE, above
-            ListedQuestion::String(_) => return Err(self.unchecked(&op).into()),
         };
         let write =
             write.ok_or_else(|| self.question_refusal(&header, QuestionRefusal::Storageless))?;
@@ -936,7 +947,7 @@ impl<'a> KeywordQuestion<'a> {
         reader: &mut EfivarReader,
     ) -> Result<KeywordInfo, KeywordInfoRefusal> {
         let op = self.op.borrow();
-        let values = VarStoreValues::new(self.root, None);
+        let values = VarStoreValues::new(self.root, CheckedVarStores::NONE);
         let mut walk = FormSetWalk::new(&self.texts, reader, &values, IncludedStates::empty());
         let mut info = KeywordInfo::default();
         if filter.contains(KeywordInfoFilter::DATA_TYPE) {
@@ -1215,18 +1226,22 @@ impl<'a> KeywordQuestion<'a> {
         }
     }
 
-    /// The text of string `id` that display shows, as a `<String>`'s CHAR16s, refused unless a
-    /// strings package of a display language holds it (ListTexts::shown_text), and if empty, as
-    /// `<String> ::= [<Char>]+` (UEFI 2.11 §35.2.1.2).
+    /// The CHAR16s of string `id` that display shows, as the firmware holds them, as a
+    /// `<String>`'s (ListTexts::shown_units), refused unless a strings package of a display
+    /// language holds it, and if empty, as `<String> ::= [<Char>]+` (UEFI 2.11 §35.2.1.2), or if
+    /// it is SCSU text with a character that UEFI rules out of strings, which holds none.
     fn text(&self, id: u16) -> Result<Vec<u16>, KeywordInfoRefusal> {
-        self.texts
-            .shown_text(id)
-            .filter(|text| !text.is_empty())
-            .map(|text| text.encode_utf16().collect())
-            .ok_or_else(|| KeywordInfoRefusal::NoText {
+        match self.texts.shown_units(id) {
+            Some(Ok(units)) if !units.is_empty() => Ok(units),
+            Some(Err(ScsuRuledOut)) => Err(KeywordInfoRefusal::RuledOutText {
                 keyword: self.keyword.to_string(),
                 id,
-            })
+            }),
+            Some(Ok(_)) | None => Err(KeywordInfoRefusal::NoText {
+                keyword: self.keyword.to_string(),
+                id,
+            }),
+        }
     }
 
     /// The question header of the question, refused unless GetData() (`Read`) or SetData()
@@ -1397,7 +1412,7 @@ impl<'a> KeywordQuestion<'a> {
         reader: &mut EfivarReader,
     ) -> Result<QuestionDescriptor> {
         let selection = {
-            let values = VarStoreValues::new(self.root, None);
+            let values = VarStoreValues::new(self.root, CheckedVarStores::NONE);
             let mut walk = FormSetWalk::new(&self.texts, reader, &values, include);
             let state = question_state(&self.op.borrow(), &mut walk.inputs);
             select(vec![(question, state)], include)
@@ -1514,6 +1529,29 @@ impl<'a> KeywordQuestion<'a> {
             .with_context(|| self.value_context(resp, prompt))
     }
 
+    /// set's write of `resp`, a keyword VALUE of every CHAR16 of the STRING of `descriptor`, of
+    /// `input`, prompted by `prompt`, through variables of `reader`: the text of the VALUE up to
+    /// its first NULL, as get reads it (stored_text), written as set writes a text
+    /// (StringInput::write, string_own_write), so that set's refusals of it apply. Refuses a VALUE
+    /// that holds a UTF-16 surrogate there, which get does not read either.
+    fn string_write<'d>(
+        &self,
+        input: &StringInput,
+        descriptor: &'d QuestionDescriptor,
+        resp: &KeywordResp,
+        prompt: &str,
+        reader: &EfivarReader,
+    ) -> Result<VarStoreWrite<'d>> {
+        let text =
+            stored_text(resp.value.as_bytes()).with_context(|| self.value_context(resp, prompt))?;
+        let write = input
+            .write(&text)
+            .map_err(|refusal| refusal.of(descriptor))
+            .with_context(|| self.value_context(resp, prompt))?;
+        string_own_write(descriptor, write, reader.reach())
+            .with_context(|| self.value_context(resp, prompt))
+    }
+
     /// What names `resp`, the keyword's VALUE, for the question prompted by `prompt`, in the errors
     /// of set's checks of it.
     fn value_context(&self, resp: &KeywordResp, prompt: &str) -> String {
@@ -1575,10 +1613,27 @@ impl<'a> KeywordQuestion<'a> {
         }
     }
 
+    /// The refusal of the question `op` of `descriptor`, whose description holds another
+    /// TextInput than its `expected` one.
+    fn input_mismatch(
+        &self,
+        op: &IFROperation,
+        descriptor: &QuestionDescriptor,
+        expected: TextInputKind,
+    ) -> KeywordRefusal {
+        KeywordRefusal::InputMismatch {
+            keyword: self.keyword.to_string(),
+            question: descriptor.question.clone(),
+            op: op.op_code.spec_name(),
+            input: descriptor.input.kind(),
+            expected,
+        }
+    }
+
     fn question_refusal(&self, header: &QuestionHeader, reason: QuestionRefusal) -> KeywordRefusal {
         KeywordRefusal::Question {
             keyword: self.keyword.to_string(),
-            question: self.texts.display(header.prompt_string_id).to_owned(),
+            question: self.texts.display(header.prompt_string_id).into_owned(),
             reason,
         }
     }
@@ -1838,6 +1893,7 @@ mod tests {
     use super::super::ifr_fixtures::conditional;
     use super::super::ifr_fixtures::eq_id_val_of;
     use super::super::ifr_fixtures::flagged_option;
+    use super::super::ifr_fixtures::flagged_string_on;
     use super::super::ifr_fixtures::form;
     use super::super::ifr_fixtures::form_set;
     use super::super::ifr_fixtures::form_set_with_guid;
@@ -1885,6 +1941,7 @@ mod tests {
     use super::super::PasswordQuestions;
     use super::*;
     use crate::hii::config_string::MultiKeywordResp;
+    use crate::hii::package::hiidb_fixtures::en_strings_package_with_blocks;
     use crate::hii::package::hiidb_fixtures::form_package_of;
     use crate::hii::package::hiidb_fixtures::package_list_with_guid;
     use crate::hii::package::hiidb_fixtures::END_PACKAGE;
@@ -1951,11 +2008,13 @@ mod tests {
         let mut strings = vec![StringPackage {
             language: Language(b"en-US".to_vec()),
             strings: BTreeMap::from([(PROMPT, QUESTION.into())]),
+            replaced: Default::default(),
         }];
         for (language, text) in keywords {
             strings.push(StringPackage {
                 language: Language(language.as_bytes().to_vec()),
                 strings: BTreeMap::from([(PROMPT, (*text).into())]),
+                replaced: Default::default(),
             });
         }
         ParsedPackageList {
@@ -2821,8 +2880,8 @@ mod tests {
     }
 
     /// GetData() reads a STRING, DATE, TIME or ORDERED_LIST as stored, which check_get takes;
-    /// check_set refuses a STRING, as keyword set of it is not implemented yet, and a VALUE of a
-    /// byte for the others, which it takes as wide as GetWidth; both refuse a PASSWORD.
+    /// check_set refuses a VALUE of a byte for each, which it takes as wide as GetWidth; both
+    /// refuse a PASSWORD.
     #[test]
     fn check_get_takes_string_date_time_and_ordered_list_but_not_password() {
         let question = |op_code: u8| {
@@ -2833,12 +2892,12 @@ mod tests {
             .concat();
             operation(op_code, false, &data)
         };
-        let unchecked = |op: &'static str| KeywordRefusal::Unchecked {
-            keyword: KEYWORD.to_owned(),
-            op,
-        };
         for (op_code, op, refusal) in [
-            (STRING, "EFI_IFR_STRING", unchecked("EFI_IFR_STRING")),
+            (
+                STRING,
+                "EFI_IFR_STRING",
+                value_refusal("03", ValueRefusal::Width),
+            ),
             (
                 DATE,
                 "EFI_IFR_DATE",
@@ -2871,10 +2930,6 @@ mod tests {
                 "{op}: set"
             );
         }
-        assert_eq!(
-            unchecked("EFI_IFR_STRING").to_string(),
-            format!("keyword {KEYWORD}: uefisettings does not yet implement keyword set of EFI_IFR_STRING")
-        );
         let password = password_on(1, PROMPT, 1, 5);
         let lists = [list(PATH, &[(NAMESPACE, KEYWORD)], password.clone())];
         assert_eq!(
@@ -3558,6 +3613,222 @@ mod tests {
         );
     }
 
+    /// A STRING of MaxSize 4, of MinSize `min_size`, question Flags `question_flags` and STRING
+    /// Flags `flags`, prompted by PROMPT at OFFSET of VarStore 1.
+    fn string_of(min_size: u8, question_flags: u8, flags: u8) -> Vec<u8> {
+        flagged_string_on(
+            1,
+            PROMPT,
+            (1, 5),
+            (min_size, 4),
+            (question_flags, flags),
+            &[],
+        )
+    }
+
+    /// SetData() writes a STRING's VALUE, its MaxSize CHAR16s last byte first, as given, so
+    /// check_set takes the text that the VALUE holds up to its first NULL, as get reads it, as
+    /// set takes that text, where the VALUE is the bytes that set writes for it: NULL-padded.
+    #[test]
+    fn check_set_takes_a_string_value_as_set_takes_its_text() {
+        const MULTI_LINE: u8 = 0x01;
+        let string = OFFSET..OFFSET + 8;
+        for (name, ops, value) in [
+            ("no character", string_of(0, 0, 0), "0000000000000000"),
+            ("AB", string_of(0, 0, 0), "0000000000420041"),
+            (
+                "MaxSize - 1 characters",
+                string_of(0, 0, 0),
+                "0000004300420041",
+            ),
+            (
+                "a line feed, multi-line",
+                string_of(0, 0, MULTI_LINE),
+                "00000042000a0041",
+            ),
+            (
+                "a Common Control Code",
+                string_of(0, 0, 0),
+                "000000000000f620",
+            ),
+            ("spaces", string_of(0, 0, 0), "0000002000410020"),
+        ] {
+            assert_eq!(
+                keyword_set(ops, value, &[0; 8]),
+                Ok(vec![string.clone()]),
+                "{name}"
+            );
+        }
+    }
+
+    /// check_set refuses a STRING's VALUE whose text set refuses, with set's refusal, one whose
+    /// text holds a UTF-16 surrogate, which get does not read either, one that is not the bytes
+    /// that set writes for its text, one of fewer bytes than MaxSize CHAR16s (GetWidth), a
+    /// read-only STRING, one of EFI_IFR_FLAG_CALLBACK, one whose <KeywordResp> has &READONLY, one
+    /// with a WRITE expression, and one of name/value storage, which no variable holds.
+    #[test]
+    fn check_set_refuses_a_string_value_that_set_refuses_or_would_not_write() {
+        use super::super::string_question::StringRefusal;
+        use std::num::NonZeroU8;
+        let refused = |value: &str, refusal: StringRefusal| {
+            value_error(
+                value,
+                ChangeValueError::String {
+                    question: QUESTION.to_owned(),
+                    refusal,
+                },
+            )
+        };
+        let max_size = NonZeroU8::new(4).expect("MaxSize 4");
+        let private_use = char::from_u32(0xE000).expect("U+E000");
+        let cases = [
+            (
+                "no NULL",
+                string_of(0, 0, 0),
+                "0044004300420041",
+                refused(
+                    "0044004300420041",
+                    StringRefusal::TooLong { max_size, given: 4 },
+                ),
+            ),
+            (
+                "fewer characters than MinSize",
+                string_of(2, 0, 0),
+                "0000000000000041",
+                refused(
+                    "0000000000000041",
+                    StringRefusal::TooShort { min: 2, given: 1 },
+                ),
+            ),
+            (
+                "a line feed, single-line",
+                string_of(0, 0, 0),
+                "00000042000a0041",
+                refused("00000042000a0041", StringRefusal::LineBreak),
+            ),
+            (
+                "the Private Use Area",
+                string_of(0, 0, 0),
+                "000000000000e000",
+                refused("000000000000e000", StringRefusal::PrivateUse(private_use)),
+            ),
+            (
+                "a surrogate",
+                string_of(0, 0, 0),
+                "000000000000d800",
+                value_error(
+                    "000000000000d800",
+                    "its character 0 is CHAR16 0xd800, a UTF-16 surrogate, which UCS-2 has no \
+                     character for (UEFI 2.11 §33.2.6.2.2)",
+                ),
+            ),
+            (
+                "a character after the NULL",
+                string_of(0, 0, 0),
+                "0000004200000041",
+                Err(KeywordRefusal::Unwritten {
+                    keyword: KEYWORD.to_owned(),
+                    value: "0000004200000041".to_owned(),
+                    written: "0000000000000041 at VarOffset 5".to_owned(),
+                    question: QUESTION.to_owned(),
+                }
+                .to_string()),
+            ),
+            (
+                "fewer bytes than MaxSize CHAR16s",
+                string_of(0, 0, 0),
+                "00420041",
+                Err(value_refusal("00420041", ValueRefusal::Width).to_string()),
+            ),
+            (
+                "read-only",
+                string_of(0, QuestionFlags::READ_ONLY.bits(), 0),
+                "0000000000420041",
+                Err(format!(
+                    "keyword {KEYWORD}: cannot set question {QUESTION:?}: EFI_IFR_FLAG_READ_ONLY \
+                     makes it read-only (UEFI 2.11 §33.3.8.2.2)"
+                )),
+            ),
+            (
+                "EFI_IFR_FLAG_CALLBACK",
+                string_of(0, QuestionFlags::CALLBACK.bits(), 0),
+                "0000000000420041",
+                Err(question_refusal(QuestionRefusal::Callback).to_string()),
+            ),
+            (
+                "&READONLY",
+                string_of(0, 0, 0),
+                "0000000000420041&READONLY",
+                Err(KeywordRefusal::ReadOnlyResp(KEYWORD.to_owned()).to_string()),
+            ),
+            (
+                "a WRITE expression",
+                flagged_string_on(
+                    1,
+                    PROMPT,
+                    (1, 5),
+                    (0, 4),
+                    (0x00, 0x00),
+                    &[operation(WRITE, true, &[]), uint8(1), END.to_vec()],
+                ),
+                "0000000000420041",
+                Err(question_refusal(QuestionRefusal::Write).to_string()),
+            ),
+        ];
+        for (name, ops, value, want) in cases {
+            assert_eq!(keyword_set(ops, value, &[0; 8]), want, "{name}");
+        }
+        let name_value = [
+            operation(
+                VAR_STORE_NAME_VALUE,
+                false,
+                &[2_u16.to_le_bytes().to_vec(), vec![0x55; 16]].concat(),
+            ),
+            flagged_string_on(1, PROMPT, (2, 7), (0, 4), (0x00, 0x00), &[]),
+        ]
+        .concat();
+        assert_eq!(
+            keyword_set(name_value, "0000000000420041", &[0; 8]),
+            Err(format!(
+                "keyword {KEYWORD}: question {QUESTION:?} has no VarStore that uefisettings reads: \
+                 HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL"
+            )),
+            "name/value storage"
+        );
+    }
+
+    /// SetData() writes every byte of a STRING's MaxSize CHAR16s, so check_set refuses a STRING
+    /// whose CHAR16s overlap the bytes of a password, which the reader withholds, at their last
+    /// byte, and takes one beside them.
+    #[test]
+    fn check_set_refuses_a_string_over_the_bytes_of_a_password() {
+        let lists = [list(PATH, &[(NAMESPACE, KEYWORD)], string_of(0, 0, 0))];
+        let question = question_of(&lists);
+        let set = |password: Range<usize>| {
+            question
+                .check_set(
+                    &resp("0000000000420041"),
+                    IncludedStates::empty(),
+                    VolatileWrites::Refuse,
+                    &mut withholding(password),
+                )
+                .map(|write| write.bytes)
+                .map_err(|error| format!("{error:#}"))
+        };
+
+        assert_eq!(
+            set(OFFSET + 7..OFFSET + 9),
+            Err(format!(
+                "keyword {KEYWORD}: cannot set question {QUESTION:?}: EFI variable {} holds a \
+                 password at bytes 12..14, which set never writes",
+                store_key()
+            )),
+            "the last byte"
+        );
+        let string = OFFSET..OFFSET + 8;
+        assert_eq!(set(OFFSET + 8..OFFSET + 10), Ok(vec![string]), "beside");
+    }
+
     /// SetData() writes every byte of a question's storage, so check_set refuses a write over
     /// those of a password, which the reader withholds, as set does, and takes one beside them.
     #[test]
@@ -4421,12 +4692,14 @@ mod tests {
         let package = |language: &[u8], texts: &[(u16, &str)]| StringPackage {
             language: Language(language.to_vec()),
             strings: texts.iter().map(|&(id, text)| (id, text.into())).collect(),
+            replaced: Default::default(),
         };
         let mut list = list(PATH, &[], ops);
         list.strings = vec![
             StringPackage {
                 language: Language(NAMESPACE.as_bytes().to_vec()),
                 strings: BTreeMap::from([(PROMPT, KEYWORD.into()), (8, "eight".into())]),
+                replaced: Default::default(),
             },
             package(
                 b"en-US",
@@ -4934,7 +5207,7 @@ mod tests {
             Rc::clone(&lists[0].forms[0]),
             &texts,
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut reader(1),
         )
         .into_iter()
@@ -4987,7 +5260,7 @@ mod tests {
             Rc::clone(&lists[0].forms[0]),
             &texts,
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut reader(1),
         )
         .into_iter()
@@ -5115,6 +5388,107 @@ mod tests {
         );
     }
 
+    /// A STRING's default and an OPTIONSTRING are the CHAR16s that their strings held, as
+    /// edk2-stable202608 SetupBrowserDxe/Setup.c GetQuestionDefault copies a string from
+    /// HiiGetString, also where a character of it reads as U+FFFD: string 6, "A" and a surrogate
+    /// pair. String 7, SCSU text of SQU U+E000, holds no CHAR16s, so its default and its option
+    /// refuse.
+    #[test]
+    fn info_takes_the_char16s_that_strings_held() {
+        let blocks = [
+            // EFI_HII_SIBT_SKIP1 of 5: string 6 next
+            &[0x22, 0x05][..],
+            // EFI_HII_SIBT_STRING_UCS2 "A", U+D83D U+DE00: 6
+            &[0x14, 0x41, 0x00, 0x3D, 0xD8, 0x00, 0xDE, 0x00, 0x00],
+            // EFI_HII_SIBT_STRING_SCSU of SQU U+E000, then U+0000: 7
+            &[0x10, 0x0E, 0xE0, 0x00, 0x00],
+            // EFI_HII_SIBT_END
+            &[0x00],
+        ]
+        .concat();
+        let hiidb = package_list_with_guid(
+            [0x22; 16],
+            &[
+                en_strings_package_with_blocks(&blocks),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
+        );
+        let read = read_db(&hiidb).expect("read the HiiDB");
+        let [read] = read.as_slice() else {
+            panic!("{} package lists, not 1", read.len());
+        };
+        // info_in with the en-US package of info_list in place of one read from `blocks`
+        let info = |ops: Vec<u8>, filter: KeywordInfoFilter| {
+            let mut list = info_list(ops);
+            list.strings[1] = read.strings[0].clone();
+            let lists = [list];
+            let mut questions = KeywordQuestion::resolve(
+                &lists,
+                Some(&namespace(NAMESPACE)),
+                Some(&path_of(PATH)),
+                &keyword(KEYWORD),
+                &[],
+            )
+            .expect("the keyword");
+            questions.remove(0).info(filter, &mut reader(1))
+        };
+        // MinSize 1, MaxSize 4, Flags, the default of Type EFI_IFR_TYPE_STRING of `id`
+        let string = |id: u16| {
+            let data = [question_header_with(1, PROMPT, 1, 5, 0), vec![1, 4, 0]].concat();
+            [
+                operation(STRING, true, &data),
+                typed_default(0x0000, 0x07, &id.to_le_bytes()),
+                END.to_vec(),
+            ]
+            .concat()
+        };
+        let one_of = |string_id: u16| {
+            [
+                operation(ONE_OF, true, &uint8_question(1, 0)),
+                flagged_option(string_id, 0, 0),
+                END.to_vec(),
+            ]
+            .concat()
+        };
+
+        assert_eq!(
+            info(string(6), KeywordInfoFilter::DEFAULT),
+            Ok(KeywordInfo {
+                standard_default: Some(number(&[0x41, 0x00, 0x3D, 0xD8, 0x00, 0xDE, 0x00, 0x00])),
+                ..KeywordInfo::default()
+            }),
+            "the default of string 6"
+        );
+        assert_eq!(
+            info(one_of(6), KeywordInfoFilter::VALUE_ATTRIBUTE),
+            Ok(KeywordInfo {
+                options: vec![option(&[0], "A\u{1F600}", None)],
+                ..KeywordInfo::default()
+            }),
+            "the option of string 6"
+        );
+        assert_eq!(
+            info(string(7), KeywordInfoFilter::DEFAULT),
+            Err(KeywordInfoRefusal::Default {
+                keyword: KEYWORD.to_owned(),
+                default_id: DefaultId::STANDARD,
+                reason: "EFI_IFR_TYPE_STRING default: string 0x0007 is SCSU text with a character \
+                         that UEFI rules out of strings, which holds no CHAR16s to copy"
+                    .to_owned(),
+            }),
+            "the default of string 7"
+        );
+        assert_eq!(
+            info(one_of(7), KeywordInfoFilter::VALUE_ATTRIBUTE),
+            Err(KeywordInfoRefusal::RuledOutText {
+                keyword: KEYWORD.to_owned(),
+                id: 7,
+            }),
+            "the option of string 7"
+        );
+    }
+
     /// What the IFR does not tell refuses the items that need it, and only those: a default
     /// wider than the question; an option text in no display language, unless the option is
     /// suppressed; an option under a SUPPRESS_IF on a question of a VarStore that no variable
diff --git a/src/lib/hii/forms/ordered_list.rs b/src/lib/hii/forms/ordered_list.rs
index 84add68..65d4086 100644
--- a/src/lib/hii/forms/ordered_list.rs
+++ b/src/lib/hii/forms/ordered_list.rs
@@ -54,6 +54,7 @@ use super::EFI_IFR_TYPE_NUM_SIZE_16;
 use super::EFI_IFR_TYPE_NUM_SIZE_32;
 use super::EFI_IFR_TYPE_NUM_SIZE_64;
 use crate::hii::strings::ListTexts;
+use crate::hii::strings::MatchTier;
 use crate::hii::variables::VariableLayout;
 
 /// EFI_IFR_UNIQUE_SET and EFI_IFR_NO_EMPTY_SET (UEFI 2.11 §33.3.8.3.53).
@@ -521,10 +522,12 @@ fn list_options(
                 // ONE_OF only, so no option of an ORDERED_LIST takes a snapshot value
                 source: ValueSource::Current,
                 value: texts.display(option.option_string_id).to_string(),
-                texts: texts
-                    .matching(option.option_string_id)
-                    .map(|(language, text)| (language.clone(), text.to_string()))
-                    .collect(),
+                texts: AnswerOption::texts_in(texts, option.option_string_id, MatchTier::Stored),
+                displayed_texts: AnswerOption::texts_in(
+                    texts,
+                    option.option_string_id,
+                    MatchTier::Displayed,
+                ),
                 state: option_state(&op, inputs),
             })
         })
@@ -615,6 +618,8 @@ pub(super) fn handle_ordered_list(
             .display(list.question_header().help_string_id)
             .to_string(),
         possible_options,
+        // StoragelessQuestion::refusal refuses one that its driver holds
+        driver_held: None,
         varstore,
         location: question.location(),
         input: TextInput::OrderedList(ListInput {
@@ -643,6 +648,7 @@ mod tests {
     use super::super::display;
     use super::super::ifr_fixtures::*;
     use super::super::list_questions;
+    use super::super::CheckedVarStores;
     use super::super::DefaultId;
     use super::super::EFI_IFR_TYPE_BOOLEAN;
     use super::super::EFI_IFR_TYPE_NUM_SIZE_16;
@@ -687,7 +693,7 @@ mod tests {
             Rc::clone(&root),
             &ListTexts::new(&strings(), &[]),
             IncludedStates::all(),
-            None,
+            CheckedVarStores::NONE,
             &mut efivars.reader(),
         )
         .into_iter()
@@ -1009,7 +1015,7 @@ mod tests {
             root,
             &ListTexts::new(&strings(), &[]),
             IncludedStates::all(),
-            None,
+            CheckedVarStores::NONE,
             &mut efivars.reader(),
         )
         .into_iter()
@@ -1036,6 +1042,7 @@ mod write_tests {
     use super::super::ifr_fixtures::*;
     use super::super::set::NewAnswer;
     use super::super::set_questions;
+    use super::super::CheckedVarStores;
     use super::super::IFROperation;
     use super::super::QuestionDescriptor;
     use super::super::EFI_IFR_TYPE_NUM_SIZE_16;
@@ -1116,12 +1123,13 @@ mod write_tests {
             answer,
             include,
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             VolatileWrites::Refuse,
             PendingOperations::new(UnsafeOperations::Refuse),
             &WithholdingVariables::new(variables, WithheldBytes::default()),
+            &[],
         )
-        .map(|(written, _)| {
+        .map(|(written, _, _)| {
             let [written] = written.as_slice() else {
                 panic!("one question written");
             };
diff --git a/src/lib/hii/forms/question_values.rs b/src/lib/hii/forms/question_values.rs
index 6e18a09..093adac 100644
--- a/src/lib/hii/forms/question_values.rs
+++ b/src/lib/hii/forms/question_values.rs
@@ -27,7 +27,7 @@ use thiserror::Error;
 use super::conditions::enclosing_form_set;
 use super::conditions::option_state;
 use super::conditions::retrieve_question_value;
-use super::conditions::skips_scope;
+use super::conditions::skips_questions;
 use super::conditions::IncludedStates;
 use super::conditions::QuestionValues;
 use super::conditions::StateEvaluation;
@@ -42,6 +42,7 @@ use super::defaults::option_value;
 use super::defaults::push_default;
 use super::defaults::question_defaults;
 use super::defaults::question_scope;
+use super::driver_held;
 use super::find_corresponding_varstore;
 use super::keywords::keyword_of;
 use super::keywords::KeywordStatement;
@@ -81,6 +82,7 @@ use crate::hii::config_string::Namespace;
 use crate::hii::package::Guid;
 use crate::hii::strings::is_configuration_language;
 use crate::hii::strings::ListTexts;
+use crate::hii::strings::MatchTier;
 
 /// A question whose value get reads and set writes.
 #[derive(Clone, Copy)]
@@ -380,12 +382,13 @@ pub(super) struct NamedQuestion {
 }
 
 /// Returns the ListedQuestions under `node`, in IFR order, whose prompt in a language of `texts`
-/// of no configuration language is one of `phrases`, ignoring ASCII case and surrounding
-/// whitespace, with those languages.
+/// of no configuration language, as `tier` takes it, is one of `phrases`, ignoring ASCII case and
+/// surrounding whitespace, with those languages.
 pub(super) fn questions_named<T>(
     node: &Rc<RefCell<IFROperation>>,
     texts: &ListTexts<'_>,
     phrases: &BTreeSet<T>,
+    tier: MatchTier,
 ) -> Vec<NamedQuestion>
 where
     T: AsRef<str>,
@@ -393,7 +396,8 @@ where
     let mut found = Vec::new();
     visit_listed_questions(node, |node, form_set, header| {
         let languages: Vec<String> = texts
-            .matching(header.prompt_string_id)
+            .matching_in(header.prompt_string_id, tier)
+            .into_iter()
             .filter(|(_, prompt)| {
                 phrases
                     .iter()
@@ -423,7 +427,7 @@ fn visit_listed_questions(
 ) {
     walk_scopes(std::slice::from_ref(node), None, |node, &form_set| {
         let op = node.borrow();
-        if skips_scope(&op) {
+        if skips_questions(&op) {
             return Walk::Skip;
         }
         let form_set = match &op.parsed_data {
@@ -440,8 +444,9 @@ fn visit_listed_questions(
 
 /// What find_question selects questions by, in one FormSet.
 pub(crate) enum QuestionMatch<'a, T> {
-    /// The questions whose prompt is one of these phrases, as questions_named finds them
-    Prompt(&'a BTreeSet<T>),
+    /// The questions whose prompt, as the tier takes it, is one of these phrases, as
+    /// questions_named finds them
+    Prompt(&'a BTreeSet<T>, MatchTier),
     /// The question of this address
     Address(&'a QuestionAddress),
     /// The questions of these statements of a keyword, those of the FormSet
@@ -459,7 +464,7 @@ where
     T: AsRef<str>,
 {
     match *matching {
-        QuestionMatch::Prompt(phrases) => questions_named(node, texts, phrases)
+        QuestionMatch::Prompt(phrases, tier) => questions_named(node, texts, phrases, tier)
             .into_iter()
             .map(|named| named.node)
             .collect(),
@@ -644,15 +649,16 @@ pub enum QuestionSelector {
 }
 
 impl QuestionSelector {
-    /// What find_question selects by: by Prompt, any of `variations`, the spellings of its text;
-    /// by Keyword, `statements`, its statements in the HiiDB.
+    /// What find_question selects by: by Prompt, any of `variations`, the spellings of its text,
+    /// as `tier` takes the prompts; by Keyword, `statements`, its statements in the HiiDB.
     pub(crate) fn matching<'a, T>(
         &'a self,
         variations: &'a BTreeSet<T>,
+        tier: MatchTier,
         statements: &'a [KeywordStatement<'a>],
     ) -> QuestionMatch<'a, T> {
         match self {
-            Self::Prompt(_) => QuestionMatch::Prompt(variations),
+            Self::Prompt(_) => QuestionMatch::Prompt(variations, tier),
             Self::Address(address) => QuestionMatch::Address(address),
             Self::Keyword { .. } => QuestionMatch::Keyword(statements),
         }
@@ -833,7 +839,7 @@ pub(super) fn describe_question(
     walk: &mut FormSetWalk<'_, impl QuestionValues>,
 ) -> QuestionDescriptor {
     let header = listed.header();
-    let prompt = walk.texts.display(header.prompt_string_id);
+    let prompt: &str = &walk.texts.display(header.prompt_string_id);
     let flags = header.flags() | class_question_flags(&question.borrow());
     let varstore = find_corresponding_varstore(Rc::clone(question), header.var_store_id);
     match listed {
@@ -874,13 +880,13 @@ fn class_question_flags(question: &IFROperation) -> QuestionFlags {
 /// Returns `value`, a current value or IFR default of a CHECKBOX, as list-questions and get show
 /// it: FALSE or TRUE (UEFI 2.10 §33.3.8.3.9) as 0 or 1, any nonzero value as 1, as
 /// edk2-stable202608 ProcessOptions.c shows it on.
-fn checkbox_text(value: u64) -> String {
+pub(super) fn checkbox_text(value: u64) -> String {
     u8::from(value != 0).to_string()
 }
 
 /// Returns `value`, a current value or IFR default of a ONE_OF in `format`, as list-questions and
 /// get show it: `option`, the text of the option that holds it, else its number.
-fn one_of_text(value: u64, format: NumericFormat, option: Option<&str>) -> String {
+pub(super) fn one_of_text(value: u64, format: NumericFormat, option: Option<&str>) -> String {
     match option {
         Some(text) => text.to_string(),
         None => format!("{} (no matching option)", format.decode(value)),
@@ -926,6 +932,12 @@ pub(super) fn handle_checkbox(
             .display(parsed.question_header().help_string_id)
             .to_string(),
         possible_options: Vec::new(),
+        driver_held: driver_held::driver_held(
+            current_node,
+            &varstore,
+            ValueQuestion::CheckBox(parsed),
+            walk,
+        ),
         varstore,
         location: parsed.location,
         input: TextInput::Maximum(RangeType::NumSize8(1)),
@@ -990,11 +1002,12 @@ pub(super) fn handle_oneof(
                 raw_value,
                 source: ValueSource::since(taken, walk.inputs.reader),
                 value: walk.texts.display(o.option_string_id).to_string(),
-                texts: walk
-                    .texts
-                    .matching(o.option_string_id)
-                    .map(|(language, text)| (language.clone(), text.to_string()))
-                    .collect(),
+                texts: AnswerOption::texts_in(walk.texts, o.option_string_id, MatchTier::Stored),
+                displayed_texts: AnswerOption::texts_in(
+                    walk.texts,
+                    o.option_string_id,
+                    MatchTier::Displayed,
+                ),
                 state: option_state(&op, &mut walk.inputs),
             });
         }
@@ -1028,6 +1041,12 @@ pub(super) fn handle_oneof(
             .display(parsed.question_header().help_string_id)
             .to_string(),
         possible_options,
+        driver_held: driver_held::driver_held(
+            current_node,
+            &varstore,
+            ValueQuestion::OneOf(parsed),
+            walk,
+        ),
         varstore,
         location: parsed.location,
         input: TextInput::Maximum(maximum(&parsed.data)),
@@ -1124,6 +1143,12 @@ pub(super) fn handle_numeric(
             .display(parsed.question_header().help_string_id)
             .to_string(),
         possible_options: Vec::new(),
+        driver_held: driver_held::driver_held(
+            current_node,
+            &varstore,
+            ValueQuestion::Numeric(parsed),
+            walk,
+        ),
         varstore,
         location: parsed.location,
         // set refuses bit fields, whose Flags from_ifr would misread
@@ -1196,6 +1221,8 @@ pub(super) fn handle_date_time(
             .display(parsed.question_header().help_string_id)
             .to_string(),
         possible_options: Vec::new(),
+        // StoragelessQuestion::refusal refuses one that its driver holds
+        driver_held: None,
         varstore,
         location: parsed.location(),
         input: TextInput::DateTime(DateTimeInput { format, stored }),
@@ -1223,6 +1250,7 @@ mod question_value_tests {
     use super::super::default_value_parser;
     use super::super::display_answer;
     use super::super::ifr_fixtures::*;
+    use super::super::CheckedVarStores;
     use super::super::DefaultId;
     use super::super::IfrDefaultValue;
     use super::super::Range16;
@@ -1387,7 +1415,7 @@ mod question_value_tests {
                 root,
                 &ListTexts::new(&strings(), &[]),
                 IncludedStates::all(),
-                None,
+                CheckedVarStores::NONE,
                 &mut efivars.reader(),
             );
             assert_eq!(questions.len(), listed, "{name}");
@@ -1460,7 +1488,7 @@ mod question_value_tests {
                 root,
                 &ListTexts::new(&strings(), &[]),
                 IncludedStates::all(),
-                None,
+                CheckedVarStores::NONE,
                 &mut disabled_reader(),
             );
             assert_eq!(questions.len(), 1, "{op_code:#04x}: the CHECKBOX");
diff --git a/src/lib/hii/forms/set.rs b/src/lib/hii/forms/set.rs
index 046140b..aba79af 100644
--- a/src/lib/hii/forms/set.rs
+++ b/src/lib/hii/forms/set.rs
@@ -21,7 +21,7 @@ use anyhow::Context;
 use anyhow::Result;
 use thiserror::Error;
 
-use super::ami_access_level::AccessLevel;
+use super::assumed_var_store::CheckedVarStores;
 use super::conditions::ExpressionRefusal;
 use super::conditions::IncludedStates;
 use super::conditions::ReadOnlyCause;
@@ -454,7 +454,7 @@ pub(super) fn own_write<'a>(
 
 /// The value that set writes for `option` of the ONE_OF `question`, or why it has none: a number,
 /// which a ONE_OF stores.
-fn option_value(
+pub(super) fn option_value(
     question: &QuestionDescriptor,
     option: &AnswerOption,
 ) -> Result<TypeValue, ChangeValueError> {
@@ -491,7 +491,7 @@ fn number_value(question: &QuestionDescriptor, number: u64) -> Result<TypeValue,
 
 /// The value that `new_value` gives `question`, which takes no option: of a NUMERIC or CHECKBOX
 /// within its range, of a DATE or TIME a calendar date or a time.
-fn text_value(
+pub(super) fn text_value(
     question: &QuestionDescriptor,
     new_value: &str,
 ) -> Result<TypeValue, ChangeValueError> {
@@ -554,27 +554,41 @@ pub(crate) struct WrittenQuestion<'a> {
     pub(crate) volatile: bool,
 }
 
+/// A selected question's driver, which keeps the question's value in no variable (UEFI 2.11
+/// §33.2.5.6), with the value that set applies through it.
+pub(crate) trait DriverStore {
+    /// The store as set's errors name it: the selector of the question's package list, then how
+    /// the value is applied, such as `(its driver)`
+    fn label(&self) -> String;
+
+    /// Applies the value; returns the annotation of set's answer.
+    fn apply(&self) -> Result<String>;
+}
+
 /// Sets each of the `selected` questions, by the selector of its package list, to `answer`, in
 /// `variables`: an ORDERED_LIST to its items, each an option that select_option picks with
 /// `include`, another question to the text or to its option of one of the variations that
 /// chosen_option picks with `include`; writes a volatile variable only if `volatile` allows it,
-/// and returns a WrittenQuestion per selected question, in its order; fails with
-/// SelectionError::NotFound when nothing is selected, and with MixedKinds for questions of more
-/// than one QuestionKind.
+/// and returns a WrittenQuestion per selected question, in its order, and the annotation of each
+/// of `drivers`' answers, in theirs; fails with SelectionError::NotFound when nothing is selected,
+/// and with MixedKinds for questions of more than one QuestionKind.
 /// It builds the WritePlan of every question before the first write, reading with `reader`, whose
-/// conditions read `access_level`, if stated, for AMI_ACCESS_LEVEL, so that a value or a SET that
-/// one question refuses leaves every variable unchanged; then it writes the system or wake-up time
+/// conditions read the VarStore bytes that `assumed` states, so that a value or a SET that one
+/// question refuses leaves every variable unchanged; then it writes the system or wake-up time
 /// of each question of EFI Date/Time Storage, in question order, then each variable once, with
-/// the changes of every question to it (batched_writes), in order, and stops at the first write
-/// that fails, with its error unchanged if it is the only write, else with NotSetEverywhere.
+/// the changes of every question to it (batched_writes), in order, then applies each of the
+/// `drivers`' values, and stops at the first store that fails, with its error unchanged if it is
+/// the only store, else with NotSetEverywhere. The drivers come after the variables because no
+/// browser answers a driver's BrowserCallback(), so the variables written first are the only view
+/// its Callback()s have of the values of this set.
 /// Through efivarfs it refuses, before any write, two variables of one efivar file
 /// (check_efivar_files). It checks `unsafe_operations` after all of these refusals, right before
 /// the first write, and returns the operations that it lifted, with the error of a failed write
 /// too (LiftedOperations).
 #[expect(
     clippy::too_many_arguments,
-    reason = "set's inputs: the question, its matches, the value, how to pick an option, and the \
-              variables to read and write"
+    reason = "set's inputs: the question, its matches, the value, how to pick an option, the \
+              variables to read and write, and the drivers that keep the values of the others"
 )]
 pub(crate) fn set_questions<'a>(
     question: &str,
@@ -582,12 +596,13 @@ pub(crate) fn set_questions<'a>(
     answer: NewAnswer<'_>,
     include: IncludedStates,
     reader: &mut EfivarReader,
-    access_level: Option<AccessLevel>,
+    assumed: CheckedVarStores<'_>,
     volatile: VolatileWrites,
     unsafe_operations: PendingOperations,
     variables: &WithholdingVariables<impl FirmwareVariables>,
-) -> Result<(Vec<WrittenQuestion<'a>>, Vec<UnsafeOperation>)> {
-    if selected.is_empty() {
+    drivers: &[&dyn DriverStore],
+) -> Result<(Vec<WrittenQuestion<'a>>, Vec<String>, Vec<UnsafeOperation>)> {
+    if selected.is_empty() && drivers.is_empty() {
         return Err(SelectionError::NotFound {
             question: question.to_owned(),
         }
@@ -598,8 +613,7 @@ pub(crate) fn set_questions<'a>(
     let mut plans = Vec::new();
     let mut given = Vec::new();
     for &(selector, descriptor) in selected {
-        let (plan, written) =
-            plan_question(descriptor, answer, include, through, reader, access_level)?;
+        let (plan, written) = plan_question(descriptor, answer, include, through, reader, assumed)?;
         plans.push((selector, plan));
         given.push(written);
     }
@@ -638,13 +652,16 @@ pub(crate) fn set_questions<'a>(
     let stores: Vec<BatchedStore<'_, '_>> = times
         .into_iter()
         .chain(batch.iter().map(BatchedStore::Variable))
+        .chain(drivers.iter().map(|&driver| BatchedStore::Driver(driver)))
         .collect();
     let mut written = Vec::new();
+    let mut annotations = Vec::new();
     let mut unwritten = stores.iter();
     while let Some(store) = unwritten.next() {
         let error = match store.write(&variables) {
-            Ok(label) => {
+            Ok((label, annotation)) => {
                 written.push(label);
+                annotations.extend(annotation);
                 continue;
             }
             Err(error) => error,
@@ -668,7 +685,7 @@ pub(crate) fn set_questions<'a>(
         };
         return Err(LiftedOperations::attach(lifted, error.into()));
     }
-    Ok((written_questions, lifted))
+    Ok((written_questions, annotations, lifted))
 }
 
 /// The WritePlan that gives `question` `answer` through variables of `through`, as set_questions
@@ -679,7 +696,7 @@ fn plan_question<'a>(
     include: IncludedStates,
     through: (VariableReach, VariableInterface),
     reader: &mut EfivarReader,
-    access_level: Option<AccessLevel>,
+    assumed: CheckedVarStores<'_>,
 ) -> Result<(WritePlan<'a>, Written<'a>)> {
     match (&question.input, answer) {
         (TextInput::CrossReference, NewAnswer::Items(_) | NewAnswer::Text { .. }) => {
@@ -721,7 +738,7 @@ fn plan_question<'a>(
                     (NewValue::Option(option), Written::Option(option))
                 }
             };
-            let plan = WritePlan::new(question, value, through, reader, access_level)?;
+            let plan = WritePlan::new(question, value, through, reader, assumed)?;
             Ok((plan, written))
         }
     }
@@ -729,7 +746,10 @@ fn plan_question<'a>(
 
 /// Refuses `selected`, the questions that the text `question` selects, by selector, unless they
 /// are all of one QuestionKind: set gives one value to all of them.
-fn check_one_kind(question: &str, selected: &[(&str, &QuestionDescriptor)]) -> Result<()> {
+pub(crate) fn check_one_kind(
+    question: &str,
+    selected: &[(&str, &QuestionDescriptor)],
+) -> Result<()> {
     let mut kinds: Vec<(QuestionKind, Vec<String>)> = Vec::new();
     for &(selector, descriptor) in selected {
         let kind = QuestionKind::of(descriptor.opcode)
@@ -814,6 +834,7 @@ impl fmt::Display for Outcome {
 #[cfg(test)]
 #[cfg(efivar_dumps)]
 mod set_questions_tests {
+    use std::cell::Cell;
     use std::collections::BTreeMap;
 
     use super::super::ifr_fixtures::*;
@@ -915,6 +936,26 @@ mod set_questions_tests {
         new_value: &str,
         texts: &[&str],
     ) -> std::result::Result<Vec<Option<String>>, String> {
+        set_through_drivers(variables, selected, new_value, texts, &[]).map(|(written, _)| {
+            written
+                .into_iter()
+                .map(|question| match question.given {
+                    Written::Option(option) => Some(option.value.clone()),
+                    Written::Text | Written::Items(_) => None,
+                })
+                .collect()
+        })
+    }
+
+    /// set_questions of PROMPT to `new_value`, or to an option of the texts `texts`, in
+    /// `variables`, then through `drivers`: its answer, or its error as the CLI prints it.
+    fn set_through_drivers<'a>(
+        variables: &impl FirmwareVariables,
+        selected: &[(&str, &'a QuestionDescriptor)],
+        new_value: &str,
+        texts: &[&str],
+        drivers: &[&dyn DriverStore],
+    ) -> std::result::Result<(Vec<WrittenQuestion<'a>>, Vec<String>), String> {
         set_pending(
             variables,
             selected,
@@ -923,26 +964,21 @@ mod set_questions_tests {
                 variations: &texts.iter().map(|text| text.to_string()).collect(),
             },
             PendingOperations::new(UnsafeOperations::Refuse),
+            drivers,
         )
-        .map(|(written, _)| {
-            written
-                .into_iter()
-                .map(|question| match question.given {
-                    Written::Option(option) => Some(option.value.clone()),
-                    Written::Text | Written::Items(_) => None,
-                })
-                .collect()
-        })
+        .map(|(written, annotations, _)| (written, annotations))
         .map_err(|error| format!("{error:#}"))
     }
 
-    /// set_questions of PROMPT to `answer` in `variables`, with the unsafe operations `pending`.
+    /// set_questions of PROMPT to `answer` in `variables`, then through `drivers`, with the
+    /// unsafe operations `pending`.
     fn set_pending<'a>(
         variables: &impl FirmwareVariables,
         selected: &[(&str, &'a QuestionDescriptor)],
         answer: NewAnswer<'_>,
         pending: PendingOperations,
-    ) -> Result<(Vec<WrittenQuestion<'a>>, Vec<UnsafeOperation>)> {
+        drivers: &[&dyn DriverStore],
+    ) -> Result<(Vec<WrittenQuestion<'a>>, Vec<String>, Vec<UnsafeOperation>)> {
         // no question here has a WRITE expression, whose GETs and merges would read
         let mut reader = EfivarReader::with_variables(Box::new(MemoryVariables::new(
             variables.reach(),
@@ -954,10 +990,11 @@ mod set_questions_tests {
             answer,
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             VolatileWrites::Refuse,
             pending,
             &WithholdingVariables::new(variables, WithheldBytes::default()),
+            drivers,
         )
     }
 
@@ -1106,6 +1143,43 @@ mod set_questions_tests {
         }
     }
 
+    /// A driver of a question of the selector "D", which records each value it applies.
+    #[derive(Default)]
+    struct RecordingStore {
+        applied: Cell<usize>,
+    }
+
+    impl DriverStore for RecordingStore {
+        fn label(&self) -> String {
+            "D (its driver)".to_owned()
+        }
+
+        fn apply(&self) -> Result<String> {
+            self.applied.set(self.applied.get() + 1);
+            Ok(" <applied>".to_owned())
+        }
+    }
+
+    /// set stops at a failed variable write before the drivers too: a driver after it is not
+    /// attempted, and never applies its value.
+    #[test]
+    fn a_failed_variable_write_leaves_the_drivers_after_it_unapplied() {
+        let mut variables = MemoryVariables::default();
+        let a = checkbox_on_store(failing_var_store("A", WRITE_ERROR, &mut variables));
+        let driver = RecordingStore::default();
+        let in_a = label("A");
+
+        assert_eq!(
+            set_through_drivers(&variables, &[("A", &a)], "1", &[], &[&driver]).map(drop),
+            Err(format!(
+                "question \"Prompt\" was not set everywhere: write failed (in {in_a}); written in: \
+                 none; not attempted: D (its driver)"
+            )),
+            "a failed write of A before the driver of D"
+        );
+        assert_eq!(driver.applied.get(), 0, "the driver of D never applied");
+    }
+
     #[test]
     fn the_failed_write_of_a_single_match_is_its_error() {
         let mut variables = MemoryVariables::default();
@@ -1148,7 +1222,7 @@ mod set_questions_tests {
                 pending.add(operation.clone());
             }
 
-            let error = set_pending(&variables, &selected, ONE, pending)
+            let error = set_pending(&variables, &selected, ONE, pending, &[])
                 .map(drop)
                 .expect_err("A fails");
 
@@ -1662,10 +1736,11 @@ mod set_questions_tests {
                 },
                 IncludedStates::empty(),
                 &mut reader,
-                None,
+                CheckedVarStores::NONE,
                 VolatileWrites::Refuse,
                 PendingOperations::new(UnsafeOperations::Refuse),
                 &WithholdingVariables::new(&variables, withheld),
+                &[],
             )
             .map(drop)
             .map_err(|error| format!("{error:#}"));
@@ -1927,7 +2002,7 @@ mod set_questions_tests {
 
             let selected = [("slash", &slash), ("bang", &bang)];
 
-            let got = set_pending(&variables, &selected, ONE, pending)
+            let got = set_pending(&variables, &selected, ONE, pending, &[])
                 .map(drop)
                 .map_err(|error| format!("{error:#}"));
 
@@ -2991,10 +3066,11 @@ mod date_time_write_tests {
             },
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             VolatileWrites::Refuse,
             PendingOperations::new(UnsafeOperations::Refuse),
             &WithholdingVariables::new(&variables, WithheldBytes::default()),
+            &[],
         )
         .map(drop)
         .map_err(|error| format!("{error:#}"));
@@ -3023,10 +3099,11 @@ mod date_time_write_tests {
             },
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             VolatileWrites::Refuse,
             PendingOperations::new(UnsafeOperations::Refuse),
             &WithholdingVariables::new(&variables, WithheldBytes::default()),
+            &[],
         )
         .map(drop)
         .map_err(|error| format!("{error:#}"));
@@ -3148,10 +3225,11 @@ mod time_storage_write_tests {
             },
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             VolatileWrites::Refuse,
             PendingOperations::new(UnsafeOperations::Refuse),
             &WithholdingVariables::new(variables, WithheldBytes::default()),
+            &[],
         )
         .map(drop)
         .map_err(|error| format!("{error:#}"));
@@ -3580,12 +3658,13 @@ mod time_storage_write_tests {
             },
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             volatile,
             PendingOperations::new(UnsafeOperations::Refuse),
             &WithholdingVariables::new(&variables, withheld),
+            &[],
         )
-        .map(|(written, _)| written.iter().map(|question| question.volatile).collect())
+        .map(|(written, _, _)| written.iter().map(|question| question.volatile).collect())
         .map_err(|error| format!("{error:#}"));
         let calls = services.calls.borrow()[calls_before..].to_vec();
         (
diff --git a/src/lib/hii/forms/setup_password.rs b/src/lib/hii/forms/setup_password.rs
index b2f950f..d1a0d15 100644
--- a/src/lib/hii/forms/setup_password.rs
+++ b/src/lib/hii/forms/setup_password.rs
@@ -79,8 +79,9 @@ pub(crate) struct PasswordQuestions {
     /// The records of the PASSWORDs that edk2 may route to a VARSTORE_NAME_VALUE, whose values
     /// its driver exposes, as UEFI 2.11 §33.2.5.6 says, through EFI_HII_CONFIG_ACCESS_PROTOCOL,
     /// in storage of its own choosing, so in any variable (Keeper::NameValueDriver), and of those
-    /// of VarStoreId 0, whose callbacks or READ and WRITE ops keep their passwords where
-    /// uefisettings cannot tell (Keeper::OwnDriver)
+    /// of VarStoreId 0, or of a VarStoreId that no VarStore of their form package declares, whose
+    /// callbacks or READ and WRITE ops keep their passwords where uefisettings cannot tell
+    /// (Keeper::OwnDriver)
     driver_held: Vec<UnresolvedPassword>,
     candidates: Vec<PasswordQuestion>,
     /// The storage that IFR that read_db ignores, or a VarStore outside any FormSet that does not
@@ -528,8 +529,17 @@ impl VarStoreIds {
     /// Who keeps the password of a PASSWORD of this package list whose VarStore is unknown, of
     /// VarStoreId `id`, in the FormSet of root `root` if any, of the form package of the
     /// FirstVarStores `package`: Keeper::OwnDriver for VarStoreId 0, which names no VarStore
-    /// (UEFI 2.11 §33.3.8.2.2), as for one without a question header, whose callers take it;
-    /// else the driver of a VARSTORE_NAME_VALUE that edk2 may route it to, else its IFR. The
+    /// (UEFI 2.11 §33.3.8.2.2), as for one without a question header, whose callers take it, and
+    /// for an id that no VarStore of its form package that decodes declares, which names none
+    /// either: §33.3.8.2.2 asks for "a previously declared variable store", and edk2-stable202608
+    /// finds none for it in the Forms Browser (SetupBrowserDxe/IfrParse.c CreateQuestion,
+    /// :136-148) nor in the Config Keyword Handler (ConfigKeywordHandler.c FindStorageFromVarId,
+    /// :1520-1569, :2108-2109) but a VarStore op that does not decode, which each reads whatever
+    /// the op's Length: the Forms Browser one of the question's FormSet outside an unknown
+    /// opcode's scope (IfrParse.c ParseOpCodes, :1873-1918), FindStorageFromVarId the first in the
+    /// form package (:1538-1555), so this fails closed for such an op too;
+    /// without `package`, by no VarStore of its package list; else the driver of a
+    /// VARSTORE_NAME_VALUE that edk2 may route it to, else its IFR. The
     /// Forms Browser gives a
     /// question of a FormSet the VarStore of its id there (SetupBrowserDxe/IfrParse.c
     /// CreateQuestion, :136-146), so a VARSTORE_NAME_VALUE of that id there counts, which
@@ -539,7 +549,11 @@ impl VarStoreIds {
     /// first that is a VARSTORE_NAME_VALUE counts, in a FormSet or not, and none of another form
     /// package.
     fn keeper(&self, id: u16, root: Option<usize>, package: Option<&FirstVarStores>) -> Keeper {
-        if id == 0 {
+        let declared = package.map_or_else(
+            || self.ids.contains_key(&id),
+            |package| package.declared.contains(&id),
+        );
+        if id == 0 || !declared {
             return Keeper::OwnDriver;
         }
         let undecoded = root
@@ -772,8 +786,8 @@ impl PasswordQuestions {
     /// Only one that passes those checks is added in the FormSet of its root (password_questions),
     /// with the storage of its VarStore ops that do not decode (withhold_undecoded). An unresolved
     /// one that edk2 may route to a VARSTORE_NAME_VALUE, in its FormSet or as the first VarStore
-    /// of its id in its form package, is driver-held, and so is one of VarStoreId 0
-    /// (VarStoreIds::keeper).
+    /// of its id in its form package, is driver-held, and so is one of VarStoreId 0, or of one that
+    /// no VarStore of its form package declares (VarStoreIds::keeper).
     fn add_form_set_password(
         &mut self,
         op: &IFROperation,
@@ -899,7 +913,8 @@ impl PasswordQuestions {
     /// of each variable that its VarName may name on a VARSTORE_EFI before UEFI 2.3.1 of that id.
     /// One of VarStoreId 0 names no VarStore, as one in a FormSet does not, and the Keyword
     /// Handler skips it (ExtractConfigRequest): it is driver-held (Keeper::OwnDriver), with a
-    /// record of its own in ignored IFR. One whose op ends before its MaxSize keeps every
+    /// record of its own in ignored IFR, and so is one whose VarStoreId no VarStore of its form
+    /// package declares (VarStoreIds::keeper). One whose op ends before its MaxSize keeps every
     /// byte from its VarOffset on, and from byte 0 of each such variable. One in ignored IFR
     /// (OutsideOp::in_ignored_ifr) is withheld so too, as the Keyword Handler finds it there, and
     /// its record counts it already. One whose question header lies past its op is read there
@@ -916,7 +931,7 @@ impl PasswordQuestions {
         ids: &mut VarStoreIds,
     ) {
         self.declared = true;
-        let keeper = match PasswordFields::of(&outside.op) {
+        let (keeper, held_because) = match PasswordFields::of(&outside.op) {
             Ok(password) if password.question.var_store_id == 0 => {
                 let unresolved = UnresolvedPassword::OwnDriver {
                     form_set: None,
@@ -930,7 +945,12 @@ impl PasswordQuestions {
             }
             Ok(password) => {
                 self.add_in_package_list(&password, ids, &list.strings);
-                ids.keeper(password.question.var_store_id, None, package)
+                let id = password.question.var_store_id;
+                let held_because = format!(
+                    "the PASSWORD op there, whose VarStoreId {id:#06x} names no VarStore of its \
+                     form package"
+                );
+                (ids.keeper(id, None, package), held_because)
             }
             Err(error) => {
                 debug!(
@@ -938,7 +958,10 @@ impl PasswordQuestions {
                     outside.offset
                 );
                 self.storage.extend(&ids.storage());
-                Keeper::OwnDriver
+                let held_because = "the PASSWORD op there, whose question header does not parse, \
+                                    so whose VarStoreId may be 0, which names no VarStore"
+                    .to_owned();
+                (Keeper::OwnDriver, held_because)
             }
         };
         let (package_list, offset) = (list.guid, outside.offset);
@@ -963,9 +986,7 @@ impl PasswordQuestions {
             (true, Keeper::OwnDriver) => self.driver_held.push(UnresolvedPassword::InIgnoredIfr {
                 package_list,
                 offset,
-                reason: "the PASSWORD op there, whose question header does not parse, so whose \
-                         VarStoreId may be 0, which names no VarStore"
-                    .to_owned(),
+                reason: held_because,
             }),
         }
     }
@@ -1015,35 +1036,60 @@ impl PasswordQuestions {
     /// password, where they are known, unless IFR past an op where the walk for FormSets ends may
     /// hold one, as read_db failed for such IFR before the first FormSet, or the driver of a
     /// VARSTORE_NAME_VALUE, or the callbacks or READ and WRITE ops of a PASSWORD of VarStoreId 0,
-    /// may keep one (driver_held): AnyVariablePasswords; variables that read nothing are not
+    /// or of a VarStoreId that no VarStore of its form package declares, may keep one
+    /// (driver_held): AnyVariablePasswords; variables that read nothing are not
     /// refused so.
     fn withheld(
         &self,
         variables: &dyn FirmwareVariables,
     ) -> Result<WithheldBytes, WithholdingRefusal> {
-        match (variables.reach(), self.unresolved.as_slice()) {
+        match (
+            self.withheld_reaching(variables.reach()),
+            variables.reads_nothing(),
+        ) {
+            (Err(WithholdingRefusal::AnyVariable(_)), true) => {
+                Ok(self.password_and_candidate_bytes())
+            }
+            (Ok(withheld), _) => Ok(withheld),
+            (
+                Err(
+                    refusal @ (WithholdingRefusal::BootServices(_)
+                    | WithholdingRefusal::AnyVariable(_)),
+                ),
+                _,
+            ) => Err(refusal),
+        }
+    }
+
+    /// withheld, of variables that reach `reach` and read something.
+    fn withheld_reaching(&self, reach: VariableReach) -> Result<WithheldBytes, WithholdingRefusal> {
+        match (reach, self.unresolved.as_slice()) {
             (VariableReach::BootServices, [_, ..]) => Err(WithholdingRefusal::BootServices(
                 UnresolvedPasswords(self.unresolved.clone()),
             )),
             (VariableReach::Runtime, _) | (VariableReach::BootServices, []) => {
-                match (self.check_bounded(), variables.reads_nothing()) {
-                    (Err(refusal), false) => Err(WithholdingRefusal::AnyVariable(refusal)),
-                    (Ok(()), _) | (Err(_), true) => {
-                        let mut withheld = self.password_bytes();
-                        for candidate in &self.candidates {
-                            withheld.insert(candidate.key.clone(), candidate.bytes());
-                        }
-                        Ok(withheld)
-                    }
-                }
+                self.check_bounded()
+                    .map_err(WithholdingRefusal::AnyVariable)?;
+                Ok(self.password_and_candidate_bytes())
             }
         }
     }
 
+    /// The bytes of password_bytes, and those of the variables that may hold the password of a
+    /// PASSWORD op whose VarStore is unknown.
+    fn password_and_candidate_bytes(&self) -> WithheldBytes {
+        let mut withheld = self.password_bytes();
+        for candidate in &self.candidates {
+            withheld.insert(candidate.key.clone(), candidate.bytes());
+        }
+        withheld
+    }
+
     /// Refuses a HiiDB with IFR past an op where the walk for FormSets ends, whose PASSWORD ops,
     /// with no op boundary, may keep their passwords in any variable, or with a PASSWORD that edk2
     /// may route to a VARSTORE_NAME_VALUE, whose driver may keep it in any variable, or of
-    /// VarStoreId 0, whose callbacks or READ and WRITE ops may (driver_held).
+    /// VarStoreId 0, or of one that no VarStore of its form package declares, whose callbacks or
+    /// READ and WRITE ops may (driver_held).
     pub(crate) fn check_bounded(&self) -> Result<(), AnyVariablePasswords> {
         let unbounded: Vec<UnresolvedPassword> = self
             .unresolved
@@ -1106,6 +1152,25 @@ impl PasswordQuestions {
         Ok(WithholdingVariables::new(variables, withheld))
     }
 
+    /// `variables`, which reach `reach` and read something, without the bytes that questions set
+    /// through them withhold, as withholding gives them.
+    #[cfg_attr(
+        not(variable_data),
+        allow(
+            dead_code,
+            reason = "only the Linux and Windows builds stage a set for the next boot, and only \
+                      the UEFI Shell build applies one"
+        )
+    )]
+    pub(crate) fn withholding_of<V>(
+        &self,
+        variables: V,
+        reach: VariableReach,
+    ) -> Result<WithholdingVariables<V>, WithholdingRefusal> {
+        let withheld = self.withheld_reaching(reach)?;
+        Ok(WithholdingVariables::new(variables, withheld))
+    }
+
     /// A reader of `variables` without the bytes that questions read through them withhold,
     /// which no value decodes.
     pub(crate) fn reader(
@@ -1126,6 +1191,15 @@ impl PasswordQuestions {
             (VariableReach::BootServices, false) | (VariableReach::Runtime, _) => None,
         }
     }
+
+    /// The unsafe operation of a set staged for the next boot in this HiiDB, both of staging it and
+    /// of applying it, if any: UnsafeOperation::StagedSetupPassword where the HiiDB declares a
+    /// PASSWORD question, as the next boot applies the set before the OS, where no setup browser
+    /// asks for the password either.
+    pub(crate) fn staged_setup_password(&self) -> Option<UnsafeOperation> {
+        self.declared
+            .then_some(UnsafeOperation::StagedSetupPassword)
+    }
 }
 
 /// The GUID of the FormSet that `op` opens, if it is a decoded FORM_SET op.
@@ -1161,6 +1235,20 @@ fn package_of(
         .filter(|package| of(package).contains(&index))
 }
 
+impl PasswordQuestions {
+    /// Refuses what withholding_of refuses through variables that reach `reach`.
+    #[cfg_attr(
+        not(any(target_os = "linux", target_os = "windows")),
+        allow(
+            dead_code,
+            reason = "only the Linux and Windows builds stage a set for the next boot"
+        )
+    )]
+    pub(crate) fn check_withholding(&self, reach: VariableReach) -> Result<(), WithholdingRefusal> {
+        self.withheld_reaching(reach).map(drop)
+    }
+}
+
 /// The PASSWORD `op`, of the FormSet `form_set`, of the root `root` of its package list, whose
 /// VarStores of each VarStoreId `ids` holds: every VARSTORE and VARSTORE_EFI of its VarStoreId in
 /// its FormSet, whatever the ops around it, in the forms that read_db disables too, holds its
@@ -1738,21 +1826,23 @@ mod tests {
     }
 
     /// A PASSWORD op whose question header does not parse, or whose VarStoreId names no VarStore,
-    /// leaves its variable unknown.
+    /// leaves its variable unknown; one whose VarStoreId no VarStore declares is driver-held too
+    /// (Keeper::OwnDriver).
     #[test]
     fn password_without_a_known_var_store_is_unresolved() {
+        let record = UnresolvedPassword::NoVarStore {
+            form_set: Some(FORM_SET_GUID),
+            question_id: 2,
+            reason: "no supported varstore with matching id 0x0009 found".to_string(),
+        };
         assert_eq!(
             password_questions(&[password_on(2, 3, 9, 0)]),
             PasswordQuestions {
                 declared: true,
                 questions: vec![],
                 shared: vec![],
-                unresolved: vec![UnresolvedPassword::NoVarStore {
-                    form_set: Some(FORM_SET_GUID),
-                    question_id: 2,
-                    reason: "no supported varstore with matching id 0x0009 found".to_string(),
-                }],
-                driver_held: vec![],
+                unresolved: vec![record.clone()],
+                driver_held: vec![record],
                 candidates: vec![],
                 storage: DeclaredStorage::default(),
             },
@@ -1920,10 +2010,14 @@ mod tests {
 
     /// Through variables that reach BootServices, a PASSWORD op whose VarStore is unknown could
     /// keep its password in any variable: withheld fails. Through those that reach Runtime the
-    /// bytes of the passwords with a known VarStore are withheld.
+    /// bytes of the passwords with a known VarStore are withheld. Here its VarStoreId 9 is of a
+    /// VarStore of another FormSet only, which edk2's Forms Browser does not find for it.
     #[test]
     fn boot_services_fail_closed_on_an_unresolved_password() {
-        let passwords = password_questions(&[password_on(2, 3, 9, 0), password_on(3, 3, 2, 0)]);
+        let passwords = PasswordQuestions::of([
+            &form_set_of(&[password_on(2, 3, 9, 0), password_on(3, 3, 2, 0)]),
+            &parse_form_set(&[var_store(9, TSE_GUID, "Shadow", 81)]),
+        ]);
 
         assert_eq!(
             passwords
@@ -2255,6 +2349,28 @@ mod tests {
         }
     }
 
+    /// A set staged for the next boot in a HiiDB that declares a password question is an unsafe
+    /// operation, as an OS stages it and uefisettings.efi applies it; in a HiiDB without one it is
+    /// none.
+    #[test]
+    fn a_staged_set_beside_a_declared_password_is_unsafe() {
+        let cases = [
+            (
+                "declared",
+                password_questions(&[password_on(2, 3, 0, 0)]),
+                Some(UnsafeOperation::StagedSetupPassword),
+            ),
+            (
+                "undeclared",
+                password_questions(&[checkbox_on(1, 3, 1)]),
+                None,
+            ),
+        ];
+        for (case, passwords, want) in cases {
+            assert_eq!(passwords.staged_setup_password(), want, "{case}");
+        }
+    }
+
     /// The package list that read_db reads from a HiiDB of one list whose form package holds
     /// `ifr`, FormSets and ops outside them.
     fn list_of(ifr: &[Vec<u8>]) -> ParsedPackageList {
@@ -2433,6 +2549,71 @@ mod tests {
         }
     }
 
+    /// A Callback() restore in the UEFI Shell, which sets back or deletes a FormSet's EFI variable
+    /// store whole through the withholding variables (VariableData), never replaces a variable that
+    /// a VarStore outside any FormSet of a PASSWORD's VarStoreId names: it fails with
+    /// WithheldPassword before the variables see it, and the password stays.
+    #[cfg(variable_data)]
+    #[test]
+    fn a_callback_restore_never_replaces_an_outside_var_store_of_a_password_s_id() {
+        use crate::efi_variables::globals::tests::HeldVariables;
+        use crate::efi_variables::VariableContents;
+        use crate::efi_variables::VariableData;
+        use crate::hii::form_set_stores::tests::efi_declaration;
+        use crate::hii::form_set_stores::tests::store;
+        use crate::hii::form_set_stores::tests::FakeRouting;
+        use crate::hii::form_set_stores::tests::STORE_GUID;
+        use crate::hii::form_set_stores::Baseline;
+
+        // bytes 0..40 of Shadow, which a FormSet declares as its VARSTORE_EFI 4, hold the password
+        let outside = var_store(2, STORE_GUID.into(), "Shadow", 81);
+        let withheld = passwords_of(&[outside, form_set_with(&[password_on(2, 3, 2, 0)])])
+            .withheld(&reaching(VariableReach::BootServices))
+            .expect("every password resolved");
+        let shadow = VariableKey {
+            name: "Shadow".to_string(),
+            guid: STORE_GUID,
+        };
+        let held = HeldVariables::default().with("Shadow", STORE_GUID, &[0xAA; 41]);
+        let variables = WithholdingVariables::new(&held, withheld);
+        let routing = FakeRouting::default();
+        let baseline = Baseline::take(
+            vec![store(&efi_declaration(4, "Shadow"))],
+            &routing,
+            &variables,
+        )
+        .expect("read Shadow");
+        let written = VariableContents::new(
+            crate::efi_variables::globals::tests::NV_BS_RT,
+            vec![0xBB; 41],
+        )
+        .expect("data");
+        held.set_variable(&shadow, &written)
+            .expect("the Callback writes");
+        held.set.borrow_mut().clear();
+
+        let check = baseline.check(&routing, &variables);
+
+        assert_eq!(
+            check.refusal().as_deref(),
+            Some(&*format!(
+                "the Callback sequence changed stores of the FormSet: VARSTORE_EFI 0x0004 \
+                 {shadow}; restore failed: VARSTORE_EFI 0x0004 {shadow}: EFI variable {shadow} \
+                 holds a password at bytes 0..40, which set never writes"
+            )),
+            "the restore of Shadow"
+        );
+        assert!(
+            held.set.borrow().is_empty() && held.deleted.borrow().is_empty(),
+            "Shadow neither set nor deleted"
+        );
+        assert_eq!(
+            held.variables.borrow()[&shadow].data(),
+            [0xBB; 41],
+            "the Callback's write stays"
+        );
+    }
+
     /// Asserts that the VarStore ops `outside`, outside any FormSet, before a FormSet with a
     /// PASSWORD of its VarStoreId 2 and VarStoreInfo 0, leaves that password `unresolved`, naming
     /// no variable that withholding could name: through variables that reach BootServices, fail
diff --git a/src/lib/hii/forms/storage.rs b/src/lib/hii/forms/storage.rs
index 707b7e5..8ad7e21 100644
--- a/src/lib/hii/forms/storage.rs
+++ b/src/lib/hii/forms/storage.rs
@@ -12,37 +12,58 @@
 
 //! The VarStores that IFR questions keep their values in, and the reads of those values from
 //! the EFI variables behind them.
+//!
+//! The stores that a FormSet declares (UEFI 2.11 §33.3.8.3.89-§33.3.8.3.91) and the settings
+//! that its questions request of each, as a forms browser builds a store's `<ConfigRequest>`
+//! (edk2-stable202608 SetupBrowserDxe IfrParse.c InitializeRequestElement), without the bytes or
+//! names of PASSWORD questions, which uefisettings never requests.
+
+use std::num::NonZeroUsize;
 
 use std::cell::RefCell;
 use std::collections::BTreeMap;
 use std::fmt;
+use std::ops::Range;
 use std::rc::Rc;
 
 use anyhow::Result;
 use binrw::BinRead;
 use thiserror::Error;
 
+use super::assumed_var_store::StoreStatements;
 use super::bit_field_bits;
 use super::conditions::question_expression;
 use super::conditions::question_value_expression;
+use super::conditions::skips_questions;
+use super::conditions::skips_scope;
 use super::conditions::ExpressionRefusal;
 use super::conditions::QuestionExpression;
 use super::conditions::MAX_READ_DEPTH;
+use super::defaults::question_scope;
 use super::ordered_list::ListRefusal;
 use super::question_values::value_question;
 use super::question_values::ListedQuestion;
+use super::refers_to_bit_field;
 use super::storageless::NoVarStore;
 use super::storageless::StoragelessRefusal;
 use super::string_question::NotUcs2;
 use super::time_storage::question_value;
 use super::time_storage::TimeStorageUnread;
+use super::walk_scopes;
 use super::IFROpCode;
 use super::IFROperation;
 use super::NumericFormatError;
+use super::ParsedOperation;
+use super::TypeValue;
+use super::Walk;
 use super::DECLARED_BOOT_SERVICE_ONLY;
 use super::EDKII_BIT_FIELD_VALUE_BITS;
+use super::EDKII_IFR_NUMERIC_SIZE_BIT;
+use super::EFI_IFR_NUMERIC_SIZE;
 use crate::hii::config_string::Number;
+use crate::hii::config_string::STRING;
 use crate::hii::package::Guid;
+use crate::hii::strings::ListTexts;
 use crate::hii::variables::efivar_attributes;
 use crate::hii::variables::EfivarRange;
 use crate::hii::variables::EfivarReader;
@@ -57,6 +78,17 @@ use crate::hii::variables::VariableSizeMismatch;
 use crate::hii::variables::EFIVARFS_HEADER_SIZE;
 use crate::hii::variables::EFI_VARIABLE_RUNTIME_ACCESS;
 
+/// EFI_QF_DATE_STORAGE, QF_TIME_STORAGE and their _NORMAL values (UEFI 2.11 §33.3.8.3.11,
+/// §33.3.8.3.78): only a DATE or TIME with normal storage has a VarStore setting.
+const QF_STORAGE: u8 = 0x30;
+const QF_STORAGE_NORMAL: u8 = 0x00;
+/// sizeof(EFI_HII_DATE), sizeof(EFI_HII_TIME), sizeof(EFI_HII_REF) (UEFI 2.11 §33.3.8.3.51)
+const DATE_WIDTH: usize = 4;
+const TIME_WIDTH: usize = 3;
+const REF_WIDTH: usize = 22;
+/// The size of EFI_IFR_QUESTION_HEADER, which every question op's data starts with
+const QUESTION_HEADER_SIZE: usize = 11;
+
 pub(super) trait VariableStore {
     fn name(&self) -> String;
     fn guid(&self) -> Guid;
@@ -169,19 +201,6 @@ pub(super) enum VariableStoreKind {
     EfiVariable,
 }
 
-/// The Name and Guid of a VarStore, which name its variable whatever its kind.
-#[derive(Debug, PartialEq, Eq, Clone, Copy)]
-pub(super) struct VarStoreVariable {
-    pub(super) name: &'static str,
-    pub(super) guid: Guid,
-}
-
-impl VarStoreVariable {
-    pub(super) fn identifies(self, store: &dyn VariableStore) -> bool {
-        store.guid() == self.guid && store.name() == self.name
-    }
-}
-
 #[cfg(test)]
 #[cfg(efivar_dumps)]
 mod non_efi_varstore_tests {
@@ -965,20 +984,33 @@ mod non_efi_varstore_tests {
                 "<ValueUnavailable: CHECKBOX value 256 over a byte>",
             ),
             (
-                ValueUnavailable::AmiAccessLevel(Box::new(ValueUnavailable::NotRead(
-                    EfivarsNotRead,
-                ))),
-                "<ValueUnavailable: EFI variables not read; the AMI setup browser keeps its \
-                 access level there (0 Administrator, 1 User); \
-                 --access-level administrator|user states one>",
+                ValueUnavailable::Unstated {
+                    reason: Box::new(ValueUnavailable::ReadError(
+                        "failed to read bytes: entity not found".into(),
+                    )),
+                    key: variable_key("Setup"),
+                    bytes: vec![Range { start: 2, end: 4 }],
+                },
+                "<VStoreError: failed to read bytes: entity not found; --assume-var-store \
+                 Setup-00000000-0000-0000-0000-000000000000+2=<HEX of 2 bytes> states it>",
             ),
             (
-                ValueUnavailable::AmiAccessLevel(Box::new(ValueUnavailable::ReadError(
-                    "failed to read bytes: entity not found".into(),
-                ))),
-                "<VStoreError: failed to read bytes: entity not found; the AMI setup browser \
-                 keeps its access level there (0 Administrator, 1 User); \
-                 --access-level administrator|user states one>",
+                ValueUnavailable::Unstated {
+                    reason: Box::new(ValueUnavailable::PartlyStated {
+                        reason: Box::new(ValueUnavailable::Truncated { offset: 0, len: 6 }),
+                        key: variable_key("a/b"),
+                        stated: vec![1..2, 3..4],
+                        unstated: vec![0..1, 2..3, 4..5],
+                    }),
+                    key: variable_key("a/b"),
+                    bytes: vec![0..1, 2..3, 4..5],
+                },
+                "<ExtractEFIDataError: failed to fill whole buffer (offset: 0; buflen: 6); bytes \
+                 1..2, 3..4 of a!b-00000000-0000-0000-0000-000000000000 stated, 0..1, 2..3, 4..5 \
+                 not; --assume-var-store a!b-00000000-0000-0000-0000-000000000000+0=<HEX of 1 \
+                 byte>, --assume-var-store a!b-00000000-0000-0000-0000-000000000000+2=<HEX of 1 \
+                 byte> and --assume-var-store a!b-00000000-0000-0000-0000-000000000000+4=<HEX of \
+                 1 byte> state them>",
             ),
         ];
         for (reason, want) in cases {
@@ -1082,6 +1114,7 @@ mod non_efi_varstore_tests {
             possible_options: vec![AnswerOption {
                 value: "Enabled".to_string(),
                 texts: vec![(Language(b"en-US".to_vec()), "Enabled".to_string())],
+                displayed_texts: vec![(Language(b"en-US".to_vec()), "Enabled".to_string())],
                 value_type: super::super::EFI_IFR_TYPE_NUM_SIZE_8,
                 raw_value: Ok(TypeValue::NumSize8(1)),
                 source: ValueSource::Current,
@@ -1103,6 +1136,7 @@ mod non_efi_varstore_tests {
                 parsed_data: ParsedOperation::Placeholder,
                 header_past_length: Vec::new(),
             })),
+            driver_held: None,
         };
 
         let variables = test_var_store_variables();
@@ -1277,19 +1311,38 @@ pub(super) enum ValueUnavailable {
     /// The CHAR16s of a STRING, one of which no UCS-2 character is
     #[error("{0}")]
     StoredString(NotUcs2),
-    /// A STRING of a VARSTORE_NAME_VALUE, whose setting ConfigSnapshot keeps as a number only
+    /// The setting of a STRING of a VARSTORE_NAME_VALUE in the ExportConfig snapshot, whose
+    /// digits are no `<String>` (UEFI 2.11 §35.2.1.2)
+    #[error("its setting in the ExportConfig snapshot is no {}", STRING)]
+    SnapshotStringDigits,
+    /// The setting of a STRING of a VARSTORE_NAME_VALUE in the ExportConfig snapshot, which holds
+    /// characters other than NULL past the question's MaxSize
     #[error(
-        "uefisettings keeps the ExportConfig snapshot's settings of a VARSTORE_NAME_VALUE as \
-         numbers only, so it takes no string from them"
+        "its setting in the ExportConfig snapshot holds more than its MaxSize of {max_size} \
+         characters"
     )]
-    NameValueString,
-    /// Why a condition cannot read AMI_ACCESS_LEVEL; answers keep the plain reason, since a stated
-    /// level replaces it only in conditions
+    SnapshotStringLength { max_size: usize },
+    /// A value of which --assume-var-store states the bytes `stated` of the variable `key` but
+    /// not `unstated`, which `reason` keeps from being read
     #[error(
-        "{0}; the AMI setup browser keeps its access level there (0 Administrator, 1 User); \
-         --access-level administrator|user states one"
+        "{reason}; bytes {} of {key} stated, {} not",
+        byte_ranges(.stated),
+        byte_ranges(.unstated)
     )]
-    AmiAccessLevel(Box<ValueUnavailable>),
+    PartlyStated {
+        reason: Box<ValueUnavailable>,
+        key: VariableKey,
+        stated: Vec<Range<usize>>,
+        unstated: Vec<Range<usize>>,
+    },
+    /// Why a condition cannot read the `bytes` of the variable `key`, which --assume-var-store
+    /// states in place of them; answers keep `reason`, since stated bytes reach only conditions
+    #[error("{reason}{}", stating(.key, .bytes))]
+    Unstated {
+        reason: Box<ValueUnavailable>,
+        key: VariableKey,
+        bytes: Vec<Range<usize>>,
+    },
 }
 
 impl ValueUnavailable {
@@ -1314,6 +1367,44 @@ impl ValueUnavailable {
         }
     }
 
+    /// The bytes of a value at `location` that --assume-var-store would state in place of those
+    /// its variable cannot give, as this says: those that a PartlyStated value lacks, else the
+    /// location's; None where its variable is not why it has no value. PasswordBytes is None:
+    /// stating them would put a password on a command line.
+    pub(super) fn stateable_bytes(&self, location: ValueLocation) -> Option<Vec<Range<usize>>> {
+        match self {
+            Self::PartlyStated {
+                reason, unstated, ..
+            } => reason.stateable_bytes(location).map(|_| unstated.clone()),
+            Self::DeclaredBootServiceOnly(_)
+            | Self::EnhancedAuthenticated(_)
+            | Self::NotRead(_)
+            | Self::Missing(_)
+            | Self::Size(_)
+            | Self::MissingBuffer(_)
+            | Self::ReadError(_)
+            | Self::Truncated { .. } => Some(vec![location.bytes()]),
+            Self::NoVarStore(_)
+            | Self::Storageless(_)
+            | Self::Expression(_)
+            | Self::ReadCycle(_)
+            | Self::ReadDepth(_)
+            | Self::ValueExpression(_)
+            | Self::PasswordBytes
+            | Self::BitField(_)
+            | Self::NotDecoded(_)
+            | Self::CheckboxOverByte(_)
+            | Self::SnapshotNumber { .. }
+            | Self::TimeStorageUnread(_)
+            | Self::TimeService(_)
+            | Self::BufferExpression(_)
+            | Self::StoredString(_)
+            | Self::SnapshotStringDigits
+            | Self::SnapshotStringLength { .. }
+            | Self::Unstated { .. } => None,
+        }
+    }
+
     /// The text that get, list-questions and show-ifr show for the value: the reason, tagged
     /// VStoreError for a read error, ExtractEFIDataError for a short variable, else
     /// ValueUnavailable.
@@ -1321,12 +1412,12 @@ impl ValueUnavailable {
         format!("<{}: {self}>", self.tag())
     }
 
-    /// to_answer's tag: AmiAccessLevel keeps the tag of its reason.
+    /// to_answer's tag: PartlyStated and Unstated keep the tag of their reason.
     fn tag(&self) -> &'static str {
         match self {
             Self::ReadError(_) => "VStoreError",
             Self::Truncated { .. } => "ExtractEFIDataError",
-            Self::AmiAccessLevel(reason) => reason.tag(),
+            Self::PartlyStated { reason, .. } | Self::Unstated { reason, .. } => reason.tag(),
             Self::NoVarStore(_)
             | Self::Storageless(_)
             | Self::Expression(_)
@@ -1348,7 +1439,8 @@ impl ValueUnavailable {
             | Self::TimeService(_)
             | Self::BufferExpression(_)
             | Self::StoredString(_)
-            | Self::NameValueString => "ValueUnavailable",
+            | Self::SnapshotStringDigits
+            | Self::SnapshotStringLength { .. } => "ValueUnavailable",
         }
     }
 }
@@ -1399,7 +1491,7 @@ pub(super) enum ValueLocation {
 
 impl ValueLocation {
     /// The payload bytes that hold the value: for Bits, the StorageWidth bytes of IfrParse.c.
-    fn bytes(self) -> std::ops::Range<usize> {
+    pub(super) fn bytes(self) -> Range<usize> {
         match self {
             Self::Bytes { offset, size } => {
                 usize::from(offset)..usize::from(offset) + usize::from(size)
@@ -1564,6 +1656,113 @@ pub(super) fn read_question_value(
     })
 }
 
+/// read_question_value, with the bytes of `stated`, statements of `varstore`, in place of those
+/// its variable holds: a value of EFI Date/Time Storage reads none of them. Where they state only
+/// some bytes of the value, the others come from read_sourced_bytes, and if it fails, the value
+/// is PartlyStated.
+pub(super) fn read_stated_question_value(
+    question: &IFROperation,
+    varstore: &Result<Box<dyn VariableStore>>,
+    stated: &StoreStatements<'_>,
+    reader: &mut EfivarReader,
+) -> std::result::Result<RetrievedValue, ValueUnavailable> {
+    let Some(value_question) = value_question(question) else {
+        return Err(ValueUnavailable::NotDecoded(question.op_code));
+    };
+    let location = value_question
+        .location()
+        .check()
+        .map_err(ValueUnavailable::BitField)?;
+    let range = location.0.bytes();
+    let patch = stated.bytes(range.clone());
+    let (Ok(store), None) = (varstore, value_question.time_storage()) else {
+        return read_question_value(question, varstore, reader);
+    };
+    if patch.iter().all(Option::is_none) {
+        return read_question_value(question, varstore, reader);
+    }
+    let (bytes, source) = match patch.iter().copied().collect::<Option<Vec<u8>>>() {
+        Some(bytes) => (bytes, ValueSource::Current),
+        None => {
+            let (read, source) =
+                read_sourced_bytes(question, varstore, reader).map_err(|reason| {
+                    let (stated, unstated) = stated_ranges(&patch, range.start);
+                    ValueUnavailable::PartlyStated {
+                        reason: Box::new(reason),
+                        key: store.variable_key(),
+                        stated,
+                        unstated,
+                    }
+                })?;
+            let bytes = patch
+                .iter()
+                .zip(read)
+                .map(|(stated, read)| stated.unwrap_or(read))
+                .collect();
+            (bytes, source)
+        }
+    };
+    Ok(RetrievedValue {
+        location,
+        value: location.read(&bytes),
+        source,
+    })
+}
+
+/// The ranges of payload bytes that `patch`, the stated bytes from byte `start` on, states, and
+/// those it does not.
+pub(super) fn stated_ranges(
+    patch: &[Option<u8>],
+    start: usize,
+) -> (Vec<Range<usize>>, Vec<Range<usize>>) {
+    let mut stated: Vec<Range<usize>> = Vec::new();
+    let mut unstated: Vec<Range<usize>> = Vec::new();
+    for (at, byte) in (start..).zip(patch) {
+        let ranges = match byte {
+            Some(_) => &mut stated,
+            None => &mut unstated,
+        };
+        match ranges.last_mut() {
+            Some(last) if last.end == at => last.end = at + 1,
+            Some(_) | None => ranges.push(at..at + 1),
+        }
+    }
+    (stated, unstated)
+}
+
+/// "; " and the --assume-var-store of each of `ranges` of the variable `key`, which states the
+/// bytes there; nothing for no range.
+fn stating(key: &VariableKey, ranges: &[Range<usize>]) -> String {
+    let flags: Vec<String> = ranges
+        .iter()
+        .map(|range| {
+            let unit = match range.len() {
+                1 => "byte",
+                _ => "bytes",
+            };
+            format!(
+                "--assume-var-store {key}+{}=<HEX of {} {unit}>",
+                range.start,
+                range.len()
+            )
+        })
+        .collect();
+    match flags.as_slice() {
+        [flag] => format!("; {flag} states it"),
+        [first @ .., last] => format!("; {} and {last} state them", first.join(", ")),
+        [] => String::new(),
+    }
+}
+
+/// `ranges` of payload bytes as A..B, in order, separated by ", ".
+pub(super) fn byte_ranges(ranges: &[Range<usize>]) -> String {
+    ranges
+        .iter()
+        .map(|range| format!("{}..{}", range.start, range.end))
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
 /// Returns the value_bytes of the question and where they come from, or why they cannot be read:
 /// from the ExportConfig snapshot of `reader`, if any, where the question's variable is missing
 /// or its storage is name/value (snapshot_bytes).
@@ -1622,16 +1821,23 @@ fn snapshot_bytes(
             let Some(NameValueStore { guid }) = error.downcast_ref() else {
                 return Err(unread);
             };
-            let number = snapshot
-                .number(*guid, question.header().var_store_info)
-                .ok_or(unread)?;
+            let Some(setting) = snapshot.setting(*guid, question.header().var_store_info) else {
+                return Err(unread);
+            };
             match question {
-                ListedQuestion::String(_) => return Err(ValueUnavailable::NameValueString),
+                ListedQuestion::String(_) => {
+                    let units = setting
+                        .string()
+                        .ok_or(ValueUnavailable::SnapshotStringDigits)?;
+                    string_bytes(&units, value.len())
+                }
                 ListedQuestion::Value(_)
                 | ListedQuestion::OrderedList(_)
-                | ListedQuestion::Ref(_) => {}
+                | ListedQuestion::Ref(_) => match setting.number() {
+                    Some(number) => number_bytes(&number, value.len()),
+                    None => Err(unread),
+                },
             }
-            number_bytes(number, value.len())
         }
     }
 }
@@ -1651,6 +1857,24 @@ fn number_bytes(number: &Number, size: usize) -> std::result::Result<Vec<u8>, Va
     Ok(bytes)
 }
 
+/// The `size` bytes of the STRING whose CHAR16s are `units`, NULL-padded, as EDK2's
+/// SetupBrowserDxe BufferToValue takes them (edk2-stable202608 Setup.c:1557-1579), or why they
+/// cannot hold them: where it drops the CHAR16s past MaxSize, `size` / 2, this refuses those that
+/// are not NULL.
+fn string_bytes(units: &[u16], size: usize) -> std::result::Result<Vec<u8>, ValueUnavailable> {
+    let max_size = size / 2;
+    if units.iter().skip(max_size).any(|unit| *unit != 0) {
+        return Err(ValueUnavailable::SnapshotStringLength { max_size });
+    }
+    let mut bytes: Vec<u8> = units
+        .iter()
+        .take(max_size)
+        .flat_map(|unit| unit.to_le_bytes())
+        .collect();
+    bytes.resize(size, 0);
+    Ok(bytes)
+}
+
 /// Returns the value_bytes of the question, or why its value cannot be read.
 fn read_question_bytes<'a>(
     question: &IFROperation,
@@ -1728,6 +1952,7 @@ mod efivar_reader_tests {
     use super::super::handle_form_set;
     use super::super::ifr_fixtures::*;
     use super::super::list_questions;
+    use super::super::CheckedVarStores;
     use super::super::EFI_IFR_NUMERIC_SIZE_2;
     use super::super::EFI_IFR_NUMERIC_SIZE_4;
     use super::super::EFI_IFR_TYPE_NUM_SIZE_16;
@@ -1946,7 +2171,7 @@ mod efivar_reader_tests {
             root,
             &ListTexts::new(&strings(), &[]),
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut disabled_reader(),
         )
         .into_iter()
@@ -1979,7 +2204,7 @@ mod efivar_reader_tests {
             root,
             &ListTexts::new(&strings(), &[]),
             IncludedStates::CONDITIONS,
-            None,
+            CheckedVarStores::NONE,
             reader,
         )
         .into_iter()
@@ -1991,7 +2216,8 @@ mod efivar_reader_tests {
     fn disabled_source_leaves_value_conditions_undetermined() {
         let efivars = Efivars::new();
         let undetermined = " <selectable or suppressed: EFI_IFR_EQ_ID_VAL of question 0x0002: \
-            <ValueUnavailable: EFI variables not read>>";
+            <ValueUnavailable: EFI variables not read; --assume-var-store \
+            Setup-00000000-0000-0000-0000-000000000000+0=<HEX of 1 byte> states it>>";
 
         efivars.write(&efi_variable("Setup", 2), &[1, 0]);
         assert_eq!(
@@ -2039,7 +2265,7 @@ mod efivar_reader_tests {
             Rc::clone(&root),
             &ListTexts::new(&strings(), &[]),
             IncludedStates::empty(),
-            None,
+            CheckedVarStores::NONE,
             &mut reader,
         )
         .into_iter()
@@ -2206,7 +2432,7 @@ mod efivar_reader_tests {
                     Rc::clone(&root),
                     &ListTexts::new(&strings(), &[]),
                     IncludedStates::empty(),
-                    None,
+                    CheckedVarStores::NONE,
                     &mut reader,
                 )
                 .into_iter()
@@ -2583,3 +2809,664 @@ pub(super) enum ShortEfiReason {
     #[error("{}", ListRefusal::NoOptions)]
     NoOptions,
 }
+
+/// A store as a FormSet's IFR declares it, with the settings of its questions that a forms
+/// browser requests, but those of PASSWORD questions.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct StoreDeclaration {
+    /// Its VarStoreId
+    pub(crate) id: u16,
+    pub(crate) guid: Guid,
+    pub(crate) kind: DeclaredKind,
+    /// Whether a PASSWORD question names it: its bytes are never requested, and a RouteConfig()
+    /// without them may clear them
+    pub(crate) holds_password: bool,
+}
+
+/// The kind of a StoreDeclaration, with what a forms browser requests of it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum DeclaredKind {
+    /// EFI_IFR_VARSTORE `name`: `width` bytes at VarOffset `offset` per question, without any
+    /// block that overlaps a PASSWORD question's bytes
+    Buffer {
+        name: String,
+        blocks: Vec<(u16, NonZeroUsize)>,
+    },
+    /// EFI_IFR_VARSTORE_NAME_VALUE: the VarName of each question but a PASSWORD question's
+    NameValue { names: Vec<String> },
+    /// EFI_IFR_VARSTORE_EFI `name`: the EFI variable of that name and the store's GUID; of an
+    /// EFI_IFR_VARSTORE_EFI before UEFI 2.3.1, the EFI variable that a VarName names
+    EfiVariable { name: String },
+}
+
+/// The stores that `form_set` declares, in IFR order, each with the settings that the questions
+/// of its forms request of it, without repeats, as a forms browser adds them to the store's
+/// `<ConfigRequest>` (only questions in a form reach InitializeRequestElement): a Buffer store's
+/// by VarOffset and width, a Name/Value store's by VarName, its text in `texts`, as
+/// edk2-stable202608 SetupBrowserDxe IfrParse.c takes a VarName through GetToken. A PASSWORD
+/// question's bytes or name are withheld: no setting that covers them is requested, and its store
+/// holds a password. In place of a VARSTORE_EFI before UEFI 2.3.1, each EFI variable that the
+/// VarName of one of its questions names (ShortVarStoreEfi::candidate_variables), once, which
+/// holds a password if a PASSWORD question names it. It leaves out what IfrParse.c ParseOpCodes
+/// skips with a DISABLE_IF outside forms (skips_questions): the VarStore ops there, whose stores
+/// it never creates, and the settings of the questions there, but the bytes of a PASSWORD there
+/// stay withheld. What ParseOpCodes may skip counts as parsed.
+pub(crate) fn store_declarations(
+    form_set: &IFROperation,
+    texts: &ListTexts<'_>,
+) -> Vec<StoreDeclaration> {
+    /// A VarStore op: its store, or a VARSTORE_EFI before UEFI 2.3.1, whose questions' VarNames
+    /// name the EFI variables
+    enum Declared {
+        Store(StoreDeclaration),
+        ShortEfi(ShortVarStoreEfi),
+    }
+
+    /// Where an op is: in a form, and in the scope of a DISABLE_IF that skips_questions names
+    #[derive(Clone, Copy)]
+    struct Place {
+        in_form: bool,
+        skipped: bool,
+    }
+
+    let mut declared = Vec::new();
+    let mut storages = Vec::new();
+    let root = Place {
+        in_form: false,
+        skipped: false,
+    };
+    walk_scopes(&form_set.children, root, |child, &place| {
+        let op = child.borrow();
+        if skips_scope(&op) {
+            return Walk::Skip;
+        }
+        match &op.parsed_data {
+            _ if place.skipped => storages
+                .extend(question_storage(&op).filter(|storage| place.in_form && storage.password)),
+            ParsedOperation::VarStore(store) => {
+                declared.push(Declared::Store(StoreDeclaration::new(
+                    store.var_store_id,
+                    store.guid,
+                    DeclaredKind::Buffer {
+                        name: store.name.to_string(),
+                        blocks: Vec::new(),
+                    },
+                )));
+            }
+            ParsedOperation::VarStoreNameValue(store) => {
+                declared.push(Declared::Store(StoreDeclaration::new(
+                    store.var_store_id,
+                    store.guid,
+                    DeclaredKind::NameValue { names: Vec::new() },
+                )));
+            }
+            ParsedOperation::VarStoreEfi(store) => {
+                declared.push(Declared::Store(StoreDeclaration::new(
+                    store.var_store_id,
+                    store.guid,
+                    DeclaredKind::EfiVariable {
+                        name: store.name.to_string(),
+                    },
+                )));
+            }
+            ParsedOperation::ShortVarStoreEfi(store) => {
+                declared.push(Declared::ShortEfi(store.clone()));
+            }
+            _ if place.in_form => storages.extend(question_storage(&op)),
+            _ => {}
+        }
+        Walk::Enter(Place {
+            in_form: place.in_form || matches!(op.op_code, IFROpCode::Form | IFROpCode::FormMap),
+            skipped: place.skipped || skips_questions(&op),
+        })
+    });
+    let stores = declared.iter_mut().filter_map(|declared| match declared {
+        Declared::Store(declaration) => Some(declaration),
+        Declared::ShortEfi(_) => None,
+    });
+    for declaration in stores {
+        let on_store: Vec<&QuestionStorage> = storages
+            .iter()
+            .filter(|storage| storage.var_store_id == declaration.id)
+            .collect();
+        let by_name = matches!(declaration.kind, DeclaredKind::NameValue { .. });
+        let withheld: Vec<&QuestionStorage> = on_store
+            .iter()
+            .copied()
+            .filter(|storage| storage.password)
+            .collect();
+        declaration.holds_password = !withheld.is_empty();
+        let requested = on_store.into_iter().filter(|storage| {
+            !withheld
+                .iter()
+                .any(|password| password.overlaps(storage, by_name))
+        });
+        for storage in requested {
+            match &mut declaration.kind {
+                DeclaredKind::Buffer { blocks, .. } => {
+                    if !blocks.contains(&storage.block) {
+                        blocks.push(storage.block);
+                    }
+                }
+                DeclaredKind::NameValue { names } => {
+                    let name = texts.stored(storage.var_store_info).to_owned();
+                    if !names.contains(&name) {
+                        names.push(name);
+                    }
+                }
+                DeclaredKind::EfiVariable { .. } => {}
+            }
+        }
+    }
+    declared
+        .into_iter()
+        .flat_map(|declared| match declared {
+            Declared::Store(declaration) => vec![declaration],
+            Declared::ShortEfi(store) => {
+                let mut variables: Vec<StoreDeclaration> = Vec::new();
+                let on_store = storages
+                    .iter()
+                    .filter(|storage| storage.var_store_id == store.var_store_id);
+                for storage in on_store {
+                    for key in store.candidate_variables(storage.var_store_info) {
+                        let kind = DeclaredKind::EfiVariable { name: key.name };
+                        match variables.iter_mut().find(|variable| variable.kind == kind) {
+                            Some(variable) => variable.holds_password |= storage.password,
+                            None => variables.push(StoreDeclaration {
+                                id: store.var_store_id,
+                                guid: key.guid,
+                                kind,
+                                holds_password: storage.password,
+                            }),
+                        }
+                    }
+                }
+                variables
+            }
+        })
+        .collect()
+}
+
+/// The storage of a question: its VarStoreId and VarStoreInfo, the block it spans in a Buffer
+/// store, and whether it is a PASSWORD question's.
+struct QuestionStorage {
+    var_store_id: u16,
+    var_store_info: u16,
+    block: (u16, NonZeroUsize),
+    password: bool,
+}
+
+impl QuestionStorage {
+    /// Whether this storage covers any of `other`'s: the same VarName in a Name/Value store,
+    /// whose settings go `by_name`, a common byte in a Buffer store.
+    fn overlaps(&self, other: &Self, by_name: bool) -> bool {
+        match by_name {
+            true => self.var_store_info == other.var_store_info,
+            false => {
+                let (mine, theirs) = (self.span(), other.span());
+                mine.start < theirs.end && theirs.start < mine.end
+            }
+        }
+    }
+
+    /// The bytes of its block.
+    fn span(&self) -> std::ops::Range<usize> {
+        let (offset, width) = self.block;
+        let start = usize::from(offset);
+        start..start + width.get()
+    }
+}
+
+impl StoreDeclaration {
+    /// A store of `kind`, as its VARSTORE op declares it, before its questions are added.
+    fn new(id: u16, guid: Guid, kind: DeclaredKind) -> Self {
+        Self {
+            id,
+            guid,
+            kind,
+            holds_password: false,
+        }
+    }
+}
+
+/// The storage of the question op `op`, with the StorageWidth of edk2-stable202608
+/// SetupBrowserDxe IfrParse.c for its kind; None for an op without storage and a DATE or TIME
+/// kept elsewhere. A PASSWORD spans its MaxSize CHAR16s, also with EFI_IFR_FLAG_CALLBACK, whose
+/// driver keeps it encoded there and a forms browser requests nothing of (IfrParse.c:684-690).
+fn question_storage(op: &IFROperation) -> Option<QuestionStorage> {
+    let data = &op.data;
+    // Prompt, Help and QuestionId, then VarStoreId and VarStoreInfo (UEFI 2.11 §33.3.8.2.2)
+    let &[_, _, _, _, _, _, id_low, id_high, info_low, info_high, ..] =
+        data.first_chunk::<QUESTION_HEADER_SIZE>()?;
+    let var_store_id = u16::from_le_bytes([id_low, id_high]);
+    let var_store_info = u16::from_le_bytes([info_low, info_high]);
+    if var_store_id == 0 {
+        return None;
+    }
+    let bit_field = refers_to_bit_field(op);
+    let width = match op.op_code {
+        IFROpCode::OneOf | IFROpCode::Numeric if bit_field => {
+            let bits = after_header(data, 0)? & EDKII_IFR_NUMERIC_SIZE_BIT;
+            return bit_field_storage(var_store_id, var_store_info, bits);
+        }
+        IFROpCode::CheckBox if bit_field => {
+            return bit_field_storage(var_store_id, var_store_info, 1);
+        }
+        IFROpCode::OneOf | IFROpCode::Numeric => {
+            1usize << (after_header(data, 0)? & EFI_IFR_NUMERIC_SIZE)
+        }
+        IFROpCode::CheckBox => 1,
+        IFROpCode::String => usize::from(after_header(data, 1)?) * size_of::<u16>(),
+        IFROpCode::Password => {
+            let max_size = u16::from_le_bytes([after_header(data, 2)?, after_header(data, 3)?]);
+            return Some(QuestionStorage {
+                var_store_id,
+                var_store_info,
+                block: (
+                    var_store_info,
+                    NonZeroUsize::new(usize::from(max_size) * size_of::<u16>())?,
+                ),
+                password: true,
+            });
+        }
+        IFROpCode::Date if after_header(data, 0)? & QF_STORAGE == QF_STORAGE_NORMAL => DATE_WIDTH,
+        IFROpCode::Time if after_header(data, 0)? & QF_STORAGE == QF_STORAGE_NORMAL => TIME_WIDTH,
+        IFROpCode::OrderedList => {
+            usize::from(after_header(data, 0)?) * ordered_list_element_width(op)?
+        }
+        IFROpCode::Ref => REF_WIDTH,
+        _ => return None,
+    };
+    Some(QuestionStorage {
+        var_store_id,
+        var_store_info,
+        block: (var_store_info, NonZeroUsize::new(width)?),
+        password: false,
+    })
+}
+
+/// The byte `at` of the fields that follow the question header in `data`, a question op's data.
+fn after_header(data: &[u8], at: usize) -> Option<u8> {
+    data.get(QUESTION_HEADER_SIZE + at).copied()
+}
+
+/// The storage of an EDKII bit varstore field of `bits` bits at bit `bit_offset`: the bytes it
+/// spans (IfrParse.c, QuestionReferBitField).
+fn bit_field_storage(var_store_id: u16, bit_offset: u16, bits: u8) -> Option<QuestionStorage> {
+    let width = (usize::from(bit_offset % 8) + usize::from(bits)).div_ceil(8);
+    Some(QuestionStorage {
+        var_store_id,
+        var_store_info: bit_offset,
+        block: (bit_offset / 8, NonZeroUsize::new(width)?),
+        password: false,
+    })
+}
+
+/// The width of an ORDERED_LIST's element: that of its first ONE_OF_OPTION's value type, 1 for
+/// another type, as IfrParse.c takes it.
+fn ordered_list_element_width(op: &IFROperation) -> Option<usize> {
+    question_scope(op).iter().find_map(|option| {
+        let ParsedOperation::OneOfOption(parsed) = &option.borrow().parsed_data else {
+            return None;
+        };
+        Some(match parsed.value {
+            TypeValue::NumSize16(_) => 2,
+            TypeValue::NumSize32(_) => 4,
+            TypeValue::NumSize64(_) => 8,
+            TypeValue::NumSize8(_)
+            | TypeValue::Boolean(_)
+            | TypeValue::Time(_)
+            | TypeValue::Date(_)
+            | TypeValue::StringID(_)
+            | TypeValue::Other
+            | TypeValue::Undefined
+            | TypeValue::Action(_)
+            | TypeValue::Ref(_)
+            | TypeValue::Unknown(_) => 1,
+        })
+    })
+}
+
+#[cfg(test)]
+#[cfg(efivar_dumps)]
+mod store_request_tests {
+    use super::super::ifr_fixtures::*;
+    use super::super::resolve_short_var_names;
+    use super::*;
+    use crate::hii::strings::Language;
+    use crate::hii::strings::StringMap;
+    use crate::hii::strings::StringPackage;
+
+    /// EFI_IFR_FLAG_CALLBACK (UEFI 2.11 §33.3.8.2.2)
+    const EFI_IFR_FLAG_CALLBACK: u8 = 0x04;
+
+    /// A question header of QuestionId `id` on VarStore `var_store_id` at VarOffset `info`, with
+    /// `flags`.
+    fn header(id: u16, var_store_id: u16, info: u16, flags: u8) -> Vec<u8> {
+        [
+            &3u16.to_le_bytes()[..],
+            &4u16.to_le_bytes(),
+            &id.to_le_bytes(),
+            &var_store_id.to_le_bytes(),
+            &info.to_le_bytes(),
+            &[flags],
+        ]
+        .concat()
+    }
+
+    fn width(bytes: usize) -> NonZeroUsize {
+        NonZeroUsize::new(bytes).expect("nonzero")
+    }
+
+    fn declarations(body: &[Vec<u8>]) -> Vec<StoreDeclaration> {
+        store_declarations(
+            &parse_form_set(body).borrow(),
+            &ListTexts::new(&strings(), &[]),
+        )
+    }
+
+    /// The VarName of a name/value storage keeps the common control codes of its string, which
+    /// only the texts that questions show drop: it must match the firmware's own name.
+    #[test]
+    fn name_value_names_keep_their_control_codes() {
+        let named = operation(0x06, false, &[header(0x15, 3, 5, 0), vec![0x00]].concat());
+        let body = [
+            operation(
+                0x25,
+                false,
+                &[&3u16.to_le_bytes()[..], &[0x33; 16]].concat(),
+            ),
+            form(1, &[named]),
+        ];
+        let strings = [en_us_package(StringMap::from([(5, "\u{F620}Name".into())]))];
+
+        let stores = store_declarations(
+            &parse_form_set(&body).borrow(),
+            &ListTexts::new(&strings, &[]),
+        );
+
+        assert_eq!(
+            stores,
+            [StoreDeclaration {
+                id: 3,
+                guid: [0x33; 16].into(),
+                kind: DeclaredKind::NameValue {
+                    names: vec!["\u{F620}Name".to_string()]
+                },
+                holds_password: false,
+            }],
+            "the VarName as stored"
+        );
+    }
+
+    #[test]
+    fn store_settings_follow_the_widths_a_forms_browser_requests() {
+        let string = operation(
+            0x1C,
+            false,
+            &[header(0x10, 2, 0x10, 0), vec![1, 4, 0]].concat(),
+        );
+        let date_rtc = operation(
+            0x1A,
+            false,
+            &[header(0x12, 2, 0x30, 0), vec![0x10]].concat(),
+        );
+        let time = operation(
+            0x1B,
+            false,
+            &[header(0x13, 2, 0x34, 0), vec![0x00]].concat(),
+        );
+        let uint16 = operation(
+            0x07,
+            false,
+            &[header(0x14, 2, 0x38, 0), vec![0x01], vec![0; 6]].concat(),
+        );
+        let named = operation(0x06, false, &[header(0x15, 3, 5, 0), vec![0x00]].concat());
+        let body = [
+            var_store(2, [0x22; 16], "Buffer", 0x40),
+            operation(
+                0x25,
+                false,
+                &[&3u16.to_le_bytes()[..], &[0x33; 16]].concat(),
+            ),
+            var_store_efi(1, "Store", NV_BS_RT, 4),
+            form(1, &[string, date_rtc, time, uint16, named]),
+            // outside any form: no browser requests it
+            checkbox_at(0x16, 7, 2, 0x3F),
+        ];
+
+        let stores = declarations(&body);
+
+        assert_eq!(
+            stores,
+            [
+                StoreDeclaration {
+                    id: 2,
+                    guid: [0x22; 16].into(),
+                    kind: DeclaredKind::Buffer {
+                        name: "Buffer".into(),
+                        blocks: vec![(0x10, width(8)), (0x34, width(3)), (0x38, width(2))],
+                    },
+                    holds_password: false,
+                },
+                StoreDeclaration {
+                    id: 3,
+                    guid: [0x33; 16].into(),
+                    kind: DeclaredKind::NameValue {
+                        names: vec![ListTexts::new(&strings(), &[]).stored(5).to_owned()]
+                    },
+                    holds_password: false,
+                },
+                StoreDeclaration {
+                    id: 1,
+                    guid: [0; 16].into(),
+                    kind: DeclaredKind::EfiVariable {
+                        name: "Store".into()
+                    },
+                    holds_password: false,
+                },
+            ],
+            "STRING of 4 CHAR16, TIME, UINT16 NUMERIC, no RTC DATE; the VarName on the \
+             Name/Value store; the EFI variable store"
+        );
+    }
+
+    #[test]
+    fn password_bytes_and_names_are_withheld_and_mark_their_store() {
+        // a PASSWORD of 20 CHAR16 at bytes 0x10-0x37 of the Buffer store
+        let password = password_on(0x11, 4, 2, 0x10);
+        let callback_password = operation(
+            PASSWORD,
+            false,
+            &[
+                header(0x12, 2, 0x40, EFI_IFR_FLAG_CALLBACK),
+                [&1u16.to_le_bytes()[..], &8u16.to_le_bytes()].concat(),
+            ]
+            .concat(),
+        );
+        let before = checkbox_at(0x13, 7, 2, 0x0F);
+        let inside = checkbox_at(0x14, 7, 2, 0x20);
+        let straddling = operation(
+            NUMERIC,
+            false,
+            &[header(0x15, 2, 0x36, 0), vec![0x01], vec![0; 6]].concat(),
+        );
+        let after = checkbox_at(0x16, 7, 2, 0x38);
+        let inside_callback = checkbox_at(0x17, 7, 2, 0x4F);
+        let named_password = password_on(0x18, 4, 3, 5);
+        let named = operation(0x06, false, &[header(0x19, 3, 5, 0), vec![0x00]].concat());
+        let other_name = operation(0x06, false, &[header(0x1A, 3, 6, 0), vec![0x00]].concat());
+        let body = [
+            var_store(2, [0x22; 16], "Buffer", 0x60),
+            operation(
+                0x25,
+                false,
+                &[&3u16.to_le_bytes()[..], &[0x33; 16]].concat(),
+            ),
+            var_store(4, [0x44; 16], "Other", 1),
+            form(
+                1,
+                &[
+                    password,
+                    callback_password,
+                    before,
+                    inside,
+                    straddling,
+                    after,
+                    inside_callback,
+                    named_password,
+                    named,
+                    other_name,
+                    checkbox_at(0x1B, 7, 4, 0),
+                ],
+            ),
+        ];
+
+        let stores = declarations(&body);
+
+        assert_eq!(
+            stores[0].kind,
+            DeclaredKind::Buffer {
+                name: "Buffer".into(),
+                blocks: vec![(0x0F, width(1)), (0x38, width(1))],
+            },
+            "only the bytes outside both PASSWORDs, with or without EFI_IFR_FLAG_CALLBACK"
+        );
+        assert_eq!(
+            stores[1].kind,
+            DeclaredKind::NameValue {
+                names: vec![ListTexts::new(&strings(), &[]).stored(6).to_owned()]
+            },
+            "only the VarName that no PASSWORD names"
+        );
+        assert_eq!(
+            stores
+                .iter()
+                .map(|store| (store.id, store.holds_password))
+                .collect::<Vec<_>>(),
+            [(2, true), (3, true), (4, false)],
+            "the stores that PASSWORD questions name hold a password, the other not"
+        );
+    }
+
+    /// edk2-stable202608 SetupBrowserDxe/IfrParse.c ParseOpCodes skips a DISABLE_IF outside forms
+    /// whose condition is TRUE to its END (:1390-1413), with the VarStore ops and questions in
+    /// it: no setting of those questions is requested and no store of those VarStore ops
+    /// declared, but the bytes of a PASSWORD there stay withheld and mark its store. A DISABLE_IF
+    /// whose condition is FALSE or not known leaves its questions requested.
+    #[test]
+    fn a_true_form_set_disable_if_requests_no_setting_and_declares_no_store_in_it() {
+        let body = [
+            var_store(2, [0x22; 16], "Buffer", 0x60),
+            form(1, &[checkbox_at(0x10, 7, 2, 0x00)]),
+            conditional(
+                DISABLE_IF,
+                ifr_true(),
+                &[
+                    var_store(3, [0x33; 16], "Hidden", 1),
+                    form(
+                        2,
+                        &[
+                            checkbox_at(0x11, 7, 2, 0x01),
+                            checkbox_at(0x12, 7, 3, 0),
+                            // a PASSWORD of 20 CHAR16 at bytes 0x10-0x37
+                            password_on(0x13, 4, 2, 0x10),
+                        ],
+                    ),
+                ],
+            ),
+            form(3, &[checkbox_at(0x14, 7, 2, 0x20)]),
+            conditional(
+                DISABLE_IF,
+                ifr_false(),
+                &[form(4, &[checkbox_at(0x15, 7, 2, 0x02)])],
+            ),
+            conditional(
+                DISABLE_IF,
+                eq_id_val_of(0x10, 1),
+                &[form(5, &[checkbox_at(0x16, 7, 2, 0x03)])],
+            ),
+        ];
+
+        assert_eq!(
+            declarations(&body),
+            [StoreDeclaration {
+                id: 2,
+                guid: [0x22; 16].into(),
+                kind: DeclaredKind::Buffer {
+                    name: "Buffer".into(),
+                    blocks: vec![(0x00, width(1)), (0x02, width(1)), (0x03, width(1))],
+                },
+                holds_password: true,
+            }],
+            "bytes 0x00, 0x02 and 0x03, of the questions outside the TRUE DISABLE_IF; none of \
+             its questions, nor its VarStore 3, nor byte 0x20, a byte of the PASSWORD in it"
+        );
+    }
+
+    /// A VARSTORE_EFI before UEFI 2.3.1 declares, in its place, the EFI variable of its Guid that
+    /// the VarName of each of its questions names, once, which holds a password if a PASSWORD
+    /// names it, whatever other question names it too; for a VarName that the strings packages
+    /// differ on, the variable of each string.
+    #[test]
+    fn a_short_var_store_declares_the_variable_of_each_var_name() {
+        let body = [
+            var_store_efi(1, "Store", NV_BS_RT, 4),
+            short_var_store_efi(2),
+            var_store(3, [0x33; 16], "Buffer", 1),
+            form(
+                1,
+                &[
+                    checkbox_at(0x10, 3, 2, 10),
+                    password_on(0x11, 3, 2, 11),
+                    checkbox_at(0x12, 3, 2, 10),
+                    checkbox_at(0x15, 3, 2, 11),
+                    checkbox_at(0x13, 3, 2, 12),
+                    checkbox_at(0x14, 3, 3, 0),
+                ],
+            ),
+        ];
+        let root = parse_form_set(&body);
+        let packages =
+            [("en-US", "Differs"), ("fr-FR", "Differe")].map(|(language, differs)| StringPackage {
+                language: Language(language.as_bytes().to_vec()),
+                strings: StringMap::from([
+                    (10, Rc::from("Value")),
+                    (11, Rc::from("Password")),
+                    (12, Rc::from(differs)),
+                ]),
+                replaced: Default::default(),
+            });
+        resolve_short_var_names(&[Rc::clone(&root)], &packages);
+        let variable = |id, guid: [u8; 16], name: &str, holds_password| StoreDeclaration {
+            id,
+            guid: guid.into(),
+            kind: DeclaredKind::EfiVariable { name: name.into() },
+            holds_password,
+        };
+
+        let stores = store_declarations(&root.borrow(), &ListTexts::new(&strings(), &[]));
+
+        assert_eq!(
+            stores,
+            [
+                variable(1, [0; 16], "Store", false),
+                variable(2, SHORT_VAR_STORE_GUID, "Value", false),
+                variable(2, SHORT_VAR_STORE_GUID, "Password", true),
+                variable(2, SHORT_VAR_STORE_GUID, "Differs", false),
+                variable(2, SHORT_VAR_STORE_GUID, "Differe", false),
+                StoreDeclaration {
+                    id: 3,
+                    guid: [0x33; 16].into(),
+                    kind: DeclaredKind::Buffer {
+                        name: "Buffer".into(),
+                        blocks: vec![(0, width(1))],
+                    },
+                    holds_password: false,
+                },
+            ],
+            "the VARSTORE_EFI; Value once, Password, which a CHECKBOX names after the PASSWORD, \
+             both strings of VarName 12, in IFR order; the VARSTORE after them"
+        );
+    }
+}
diff --git a/src/lib/hii/forms/storageless.rs b/src/lib/hii/forms/storageless.rs
index 076e2a2..97e9542 100644
--- a/src/lib/hii/forms/storageless.rs
+++ b/src/lib/hii/forms/storageless.rs
@@ -20,13 +20,18 @@ use std::rc::Rc;
 
 use thiserror::Error;
 
+use super::conditions::enclosing_form_set;
+use super::conditions::parse_question_header;
 use super::conditions::question_expression;
 use super::conditions::question_value_expression;
 use super::conditions::QuestionExpression;
 use super::conditions::VALUE_MAKES_READ_ONLY;
 use super::question_values::ListedQuestion;
+use super::question_values::ValueQuestion;
+use super::walk_scopes;
 use super::IFROperation;
 use super::QuestionFlags;
+use super::Walk;
 use crate::hii::variables::VariableReach;
 
 /// What a question without a VarStore declares for its value.
@@ -40,6 +45,12 @@ pub(crate) struct StoragelessQuestion {
     callback: bool,
     /// An EFI_IFR_VALUE, which gives the value and makes the question read-only
     value: bool,
+    /// The name of the op of a DATE, TIME, ORDERED_LIST or STRING, whose value uefisettings
+    /// exchanges with no driver's CallBack(); None for a ONE_OF, NUMERIC or CHECKBOX
+    undecoded: Option<&'static str>,
+    /// With EFI_IFR_FLAG_CALLBACK, the op of another question of its FormSet that has its
+    /// QuestionId, by which alone its driver's CallBack() tells questions apart; None if none has
+    shared_question_id: Option<&'static str>,
 }
 
 impl StoragelessQuestion {
@@ -51,15 +62,35 @@ impl StoragelessQuestion {
         if listed.time_storage().is_some() {
             return None;
         }
+        let undecoded = match listed {
+            ListedQuestion::Value(
+                ValueQuestion::OneOf(_) | ValueQuestion::Numeric(_) | ValueQuestion::CheckBox(_),
+            ) => None,
+            ListedQuestion::Value(ValueQuestion::DateTime(_))
+            | ListedQuestion::OrderedList(_)
+            | ListedQuestion::Ref(_)
+            | ListedQuestion::String(_) => Some(op.op_code.spec_name()),
+        };
         let header = listed.header();
+        let callback = header.flags().contains(QuestionFlags::CALLBACK);
         (header.var_store_id == 0).then(|| Self {
             read: question_expression(question, QuestionExpression::Read).is_some(),
             write: question_expression(question, QuestionExpression::Write).is_some(),
-            callback: header.flags().contains(QuestionFlags::CALLBACK),
+            callback,
             value: question_value_expression(&question.borrow()).is_some(),
+            undecoded,
+            shared_question_id: callback
+                .then(|| sharing_question_id(question, header.question_id))
+                .flatten(),
         })
     }
 
+    /// Whether another question of its FormSet has its QuestionId, so that no CallBack() for it
+    /// reaches its driver (StoragelessRefusal::CallbackSharedQuestionId).
+    pub(crate) fn shares_question_id(self) -> bool {
+        self.shared_question_id.is_some()
+    }
+
     /// How get (`Read`) or set (`Write`) reaches the value.
     pub(crate) fn route(
         self,
@@ -88,23 +119,66 @@ impl StoragelessQuestion {
 
     /// Why get (`Read`) or set (`Write`) on a backend of `reach` gives or takes no value
     /// without the expression; None if the expression alone does: a route through CallBack()
-    /// waits for a caller that calls it.
+    /// waits for a caller that calls it, which none does for a DATE, TIME, ORDERED_LIST or
+    /// STRING.
     pub(crate) fn refusal(
         self,
         expression: QuestionExpression,
         reach: VariableReach,
     ) -> Option<StoragelessRefusal> {
-        match self.route(expression) {
-            Ok(StoragelessRoute::Expression { callback: false } | StoragelessRoute::Value) => None,
-            Ok(StoragelessRoute::Expression { callback: true }) => {
+        match (
+            self.route(expression),
+            self.undecoded,
+            self.shared_question_id,
+        ) {
+            (
+                Ok(StoragelessRoute::Expression { callback: false } | StoragelessRoute::Value),
+                _,
+                _,
+            ) => None,
+            (
+                Ok(
+                    StoragelessRoute::Expression { callback: true }
+                    | StoragelessRoute::DriverCallback,
+                ),
+                Some(op),
+                _,
+            ) => Some(StoragelessRefusal::CallbackUndecoded(op)),
+            (
+                Ok(
+                    StoragelessRoute::Expression { callback: true }
+                    | StoragelessRoute::DriverCallback,
+                ),
+                None,
+                Some(op),
+            ) => Some(StoragelessRefusal::CallbackSharedQuestionId(op)),
+            (Ok(StoragelessRoute::Expression { callback: true }), None, None) => {
                 Some(StoragelessRefusal::CallbackDecides(expression, reach))
             }
-            Ok(StoragelessRoute::DriverCallback) => Some(StoragelessRefusal::DriverHeld(reach)),
-            Err(refusal) => Some(refusal),
+            (Ok(StoragelessRoute::DriverCallback), None, None) => {
+                Some(StoragelessRefusal::DriverHeld(reach))
+            }
+            (Err(refusal), _, _) => Some(refusal),
         }
     }
 }
 
+/// The op of the first question of the FormSet of `question` other than `question` whose
+/// QuestionId is `id`.
+fn sharing_question_id(question: &Rc<RefCell<IFROperation>>, id: u16) -> Option<&'static str> {
+    let form_set = enclosing_form_set(&question.borrow())?;
+    let mut shared = None;
+    walk_scopes(std::slice::from_ref(&form_set), (), |op, ()| {
+        let other = !Rc::ptr_eq(op, question)
+            && parse_question_header(&op.borrow()).is_some_and(|header| header.question_id == id);
+        if other && shared.is_none() {
+            shared = Some(op.borrow().op_code.spec_name());
+        }
+        Walk::Enter(())
+    });
+    shared
+}
+
 /// find_corresponding_varstore's error for a question without a VarStore, which get and set
 /// turn into a StoragelessRefusal.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
@@ -172,14 +246,34 @@ pub(crate) enum StoragelessRefusal {
     /// value before WRITE (UEFI 2.11 §35.5.4)
     #[error("{}", CallbackDecides(*.0, *.1))]
     CallbackDecides(QuestionExpression, VariableReach),
+    /// get or set of a DATE, TIME, ORDERED_LIST or STRING, named by its op, with
+    /// EFI_IFR_FLAG_CALLBACK and no expression that alone reaches the value: uefisettings calls no
+    /// CallBack() for it
+    #[error(
+        "question has no VarStore, and its driver's EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() \
+         keeps or may change its value (UEFI 2.11 §33.2.5.6, §35.5.4), which uefisettings \
+         exchanges with CallBack() only for an EFI_IFR_ONE_OF, EFI_IFR_NUMERIC or \
+         EFI_IFR_CHECKBOX, not for an {0}"
+    )]
+    CallbackUndecoded(&'static str),
+    /// get or set of a question with EFI_IFR_FLAG_CALLBACK whose QuestionId another question of
+    /// its FormSet, named by its op, also has: a CallBack() names its question only by
+    /// QuestionId, so uefisettings calls none for it
+    #[error(
+        "question has no VarStore, and its driver's EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() \
+         keeps or may change its value (UEFI 2.11 §33.2.5.6, §35.5.4) by its QuestionId, which an \
+         {0} of its FormSet also has, though a QuestionId is \"The unique value that identifies \
+         the particular question\" (§33.3.8.2.2), so uefisettings calls no CallBack() for it"
+    )]
+    CallbackSharedQuestionId(&'static str),
     /// set of a question with an EFI_IFR_VALUE
     #[error("{}", VALUE_MAKES_READ_ONLY)]
     ReadOnly,
     #[cfg_attr(
-        not(test),
+        not(any(target_os = "uefi", test)),
         expect(
             dead_code,
-            reason = "for the CallBack() sequence of the UEFI Shell build, which does not exist yet"
+            reason = "only the UEFI Shell build calls a driver's CallBack()"
         )
     )]
     #[error(
@@ -189,10 +283,10 @@ pub(crate) enum StoragelessRefusal {
     )]
     NoConfigAccess,
     #[cfg_attr(
-        not(test),
+        not(any(target_os = "uefi", test)),
         expect(
             dead_code,
-            reason = "for the CallBack() sequence of the UEFI Shell build, which does not exist yet"
+            reason = "only the UEFI Shell build calls a driver's CallBack()"
         )
     )]
     /// get of a question on StoragelessRoute::DriverCallback whose
@@ -204,66 +298,15 @@ pub(crate) enum StoragelessRefusal {
     )]
     RetrieveFailed { status: String },
     #[cfg_attr(
-        not(test),
+        not(any(target_os = "uefi", test)),
         expect(
             dead_code,
-            reason = "for the CallBack() sequence of the UEFI Shell build, which does not exist yet"
+            reason = "only the UEFI Shell build calls a driver's CallBack()"
         )
     )]
     /// `status`: the EFI_STATUS that CallBack(EFI_BROWSER_ACTION_CHANGING) returned
     #[error("its driver's CallBack(EFI_BROWSER_ACTION_CHANGING) refused the value: {status}")]
     ChangingRefused { status: String },
-    #[cfg_attr(
-        not(test),
-        expect(
-            dead_code,
-            reason = "for the CallBack() sequence of the UEFI Shell build, which does not exist yet"
-        )
-    )]
-    /// `status`: the EFI_STATUS of the read of VarStore `var_store_id` before the first CallBack()
-    #[error("cannot snapshot store {var_store_id:#06x}: {status}")]
-    SnapshotFailed { var_store_id: u16, status: String },
-    #[cfg_attr(
-        not(test),
-        expect(
-            dead_code,
-            reason = "for the CallBack() sequence of the UEFI Shell build, which does not exist yet"
-        )
-    )]
-    /// The VarStores of the FormSet that differ after the CallBack() sequence, and their restore
-    #[error(
-        "the Callback sequence changed stores of the FormSet: {}; {restore}",
-        .stores.join(", ")
-    )]
-    StoresChanged {
-        stores: Vec<String>,
-        restore: StoreRestore,
-    },
-}
-
-/// How restoring the VarStores that a CallBack() sequence changed ended.
-#[derive(Debug, Clone, PartialEq, Eq)]
-#[cfg_attr(
-    not(test),
-    expect(
-        dead_code,
-        reason = "for the CallBack() sequence of the UEFI Shell build, which does not exist yet"
-    )
-)]
-pub(crate) enum StoreRestore {
-    /// Every store reads back as before the sequence
-    Verified,
-    /// Why a restore failed
-    Failed(String),
-}
-
-impl fmt::Display for StoreRestore {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Verified => f.write_str("restored and verified"),
-            Self::Failed(reason) => write!(f, "restore failed: {reason}"),
-        }
-    }
 }
 
 /// StoragelessRefusal::DriverHeld's text: where the question's value is, and why this run does not
@@ -303,14 +346,14 @@ impl fmt::Display for CallbackDecides {
 }
 
 /// Why a run of `reach` calls no CallBack(): after ExitBootServices() no EFI device-handle-based
-/// protocol may be used; uefisettings.efi does not call it yet.
+/// protocol may be used; in uefisettings.efi only get, without --no-efivars, and set call it.
 fn no_callback(reach: VariableReach) -> &'static str {
     match reach {
         VariableReach::Runtime => {
             ", and after ExitBootServices() no EFI device-handle-based protocol may be used (UEFI \
              2.11 §7.4.6); use uefisettings.efi in the UEFI Shell"
         }
-        VariableReach::BootServices => ", which uefisettings.efi does not call yet",
+        VariableReach::BootServices => ", which only get (without --no-efivars) and set call",
     }
 }
 
@@ -646,6 +689,127 @@ mod tests {
         }
     }
 
+    /// A DATE, TIME, ORDERED_LIST or STRING without a VarStore flagged EFI_IFR_FLAG_CALLBACK,
+    /// with or without a READ and a WRITE expression, is refused by its op through either
+    /// reach: its driver's CallBack() keeps or may change its value, and uefisettings calls none
+    /// for it.
+    #[test]
+    fn callback_dates_times_ordered_lists_and_strings_are_refused_by_their_op() {
+        use QuestionExpression::Read;
+        use QuestionExpression::Write;
+        let header = question_header_with(1, 3, 0, 0, QuestionFlags::CALLBACK.bits());
+        let cases = [
+            ("EFI_IFR_DATE", DATE, vec![0x00], Vec::new()),
+            ("EFI_IFR_TIME", TIME, vec![0x00], Vec::new()),
+            (
+                "EFI_IFR_ORDERED_LIST",
+                ORDERED_LIST,
+                vec![4, 0x00],
+                one_of_option(5, 0x00, &[1]),
+            ),
+            // MinSize 0, MaxSize 4, no Flags
+            ("EFI_IFR_STRING", STRING, vec![0, 4, 0x00], Vec::new()),
+        ];
+        for (name, op_code, fields, option) in cases {
+            for expressions in [false, true] {
+                let data = [header.clone(), fields.clone()].concat();
+                let read_write = match expressions {
+                    true => [expression_of(READ), expression_of(WRITE)].concat(),
+                    false => Vec::new(),
+                };
+                let question = [
+                    operation(op_code, true, &data),
+                    option.clone(),
+                    read_write,
+                    END.to_vec(),
+                ]
+                .concat();
+                let root = parse_form_set(&[form(1, &[question])]);
+                let question = find_op(&root, &data).expect("the question");
+                let question = StoragelessQuestion::of(&question)
+                    .unwrap_or_else(|| panic!("{name}: classified as having a VarStore"));
+                for reach in [VariableReach::Runtime, VariableReach::BootServices] {
+                    let want = Some(StoragelessRefusal::CallbackUndecoded(name));
+                    assert_eq!(
+                        (
+                            question.refusal(Read, reach),
+                            question.refusal(Write, reach)
+                        ),
+                        (want.clone(), want),
+                        "{name}, READ and WRITE {expressions}, through {reach:?}"
+                    );
+                }
+            }
+        }
+    }
+
+    /// A ONE_OF without a VarStore flagged EFI_IFR_FLAG_CALLBACK, with or without a READ and a
+    /// WRITE expression, whose QuestionId a PASSWORD of its FormSet also has, is refused through
+    /// either reach, naming the PASSWORD: a CallBack() names its question only by QuestionId.
+    /// One whose QuestionId no other question has, or that has no EFI_IFR_FLAG_CALLBACK, is
+    /// refused as before; a PASSWORD is no StoragelessQuestion.
+    #[test]
+    fn callback_questions_that_share_their_question_id_are_refused() {
+        use QuestionExpression::Read;
+        use QuestionExpression::Write;
+        let shared = Some(StoragelessRefusal::CallbackSharedQuestionId(
+            "EFI_IFR_PASSWORD",
+        ));
+        for expressions in [false, true] {
+            let read_write = match expressions {
+                true => [expression_of(READ), expression_of(WRITE)].concat(),
+                false => Vec::new(),
+            };
+            for (password_id, flags) in [(1, 0x04), (2, 0x04), (1, 0x00)] {
+                let data = storageless_one_of(flags);
+                let one_of = [
+                    operation(ONE_OF, true, &data),
+                    one_of_option(5, 0x00, &[1]),
+                    read_write.clone(),
+                    END.to_vec(),
+                ]
+                .concat();
+                let password = password_on(password_id, 6, 0, 0);
+                let root = parse_form_set(&[form(1, &[one_of, password.clone()])]);
+                let question = find_op(&root, &data).expect("the ONE_OF");
+                let classified = StoragelessQuestion::of(&question).expect("storageless");
+                let password_op = find_op(&root, &password[2..]).expect("the PASSWORD");
+                assert_eq!(
+                    StoragelessQuestion::of(&password_op),
+                    None,
+                    "the PASSWORD is no StoragelessQuestion"
+                );
+                for reach in [VariableReach::Runtime, VariableReach::BootServices] {
+                    let want = match (password_id, flags, expressions) {
+                        (1, 0x04, _) => shared.clone(),
+                        (_, 0x04, false) => Some(StoragelessRefusal::DriverHeld(reach)),
+                        (_, 0x04, true) => Some(StoragelessRefusal::CallbackDecides(Read, reach)),
+                        (_, _, false) => Some(StoragelessRefusal::NoValueSource),
+                        (_, _, true) => None,
+                    };
+                    assert_eq!(
+                        classified.refusal(Read, reach),
+                        want,
+                        "READ: PASSWORD {password_id}, flags {flags:#04x}, expressions \
+                         {expressions}, through {reach:?}"
+                    );
+                    assert_eq!(
+                        classified.shares_question_id(),
+                        (password_id, flags) == (1, 0x04),
+                        "shares: PASSWORD {password_id}, flags {flags:#04x}"
+                    );
+                }
+                if (password_id, flags) == (1, 0x04) {
+                    assert_eq!(
+                        classified.refusal(Write, VariableReach::BootServices),
+                        shared,
+                        "WRITE, expressions {expressions}"
+                    );
+                }
+            }
+        }
+    }
+
     /// Each refusal names what the question lacks or what its driver answered, in UEFI terms.
     #[test]
     fn refusals_say_why_in_uefi_terms() {
@@ -686,7 +850,7 @@ mod tests {
                 StoragelessRefusal::DriverHeld(VariableReach::BootServices),
                 "question has no VarStore; its driver keeps the value, which only \
                  EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() reaches (UEFI 2.11 §33.2.5.6), which \
-                 uefisettings.efi does not call yet",
+                 only get (without --no-efivars) and set call",
             ),
             (
                 StoragelessRefusal::CallbackDecides(
@@ -717,8 +881,15 @@ mod tests {
                 ),
                 "question has no VarStore, and its driver's \
                  EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack(EFI_BROWSER_ACTION_RETRIEVE) may replace \
-                 the value of its READ expression (UEFI 2.11 §35.5.4), which uefisettings.efi does \
-                 not call yet",
+                 the value of its READ expression (UEFI 2.11 §35.5.4), which only get (without \
+                 --no-efivars) and set call",
+            ),
+            (
+                StoragelessRefusal::CallbackUndecoded("EFI_IFR_DATE"),
+                "question has no VarStore, and its driver's \
+                 EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() keeps or may change its value (UEFI \
+                 2.11 §33.2.5.6, §35.5.4), which uefisettings exchanges with CallBack() only for \
+                 an EFI_IFR_ONE_OF, EFI_IFR_NUMERIC or EFI_IFR_CHECKBOX, not for an EFI_IFR_DATE",
             ),
             (
                 StoragelessRefusal::ReadOnly,
@@ -751,29 +922,6 @@ mod tests {
                 "its driver's CallBack(EFI_BROWSER_ACTION_CHANGING) refused the value: \
                  EFI_ACCESS_DENIED",
             ),
-            (
-                StoragelessRefusal::SnapshotFailed {
-                    var_store_id: 0x1234,
-                    status: "EFI_NOT_FOUND".to_string(),
-                },
-                "cannot snapshot store 0x1234: EFI_NOT_FOUND",
-            ),
-            (
-                StoragelessRefusal::StoresChanged {
-                    stores: vec!["0x0001".to_string(), "0x0002".to_string()],
-                    restore: StoreRestore::Verified,
-                },
-                "the Callback sequence changed stores of the FormSet: 0x0001, 0x0002; restored \
-                 and verified",
-            ),
-            (
-                StoragelessRefusal::StoresChanged {
-                    stores: vec!["0x0001".to_string()],
-                    restore: StoreRestore::Failed("EFI_WRITE_PROTECTED".to_string()),
-                },
-                "the Callback sequence changed stores of the FormSet: 0x0001; restore failed: \
-                 EFI_WRITE_PROTECTED",
-            ),
         ];
         for (refusal, want) in cases {
             assert_eq!(refusal.to_string(), want, "{refusal:?}");
@@ -905,7 +1053,7 @@ mod get_and_set_tests {
                 Rc::clone(&root),
                 &ListTexts::new(&strings, &[]),
                 IncludedStates::empty(),
-                None,
+                CheckedVarStores::NONE,
                 &mut reader,
             )
             .into_iter()
@@ -947,10 +1095,10 @@ mod get_and_set_tests {
             for (prompt, callback, read, write) in QUESTIONS {
                 let refusal = refusal((callback, read, write), QuestionExpression::Write, reach);
                 let mut reader = reader_reaching(reach);
-                let values = VarStoreValues::new(&root, None);
+                let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
                 let selection = find_question_in(
                     &root,
-                    &QuestionMatch::Prompt(&BTreeSet::from([prompt])),
+                    &QuestionMatch::Prompt(&BTreeSet::from([prompt]), MatchTier::Stored),
                     &mut FormSetWalk::new(
                         &ListTexts::new(&strings, &[]),
                         &mut reader,
@@ -975,10 +1123,11 @@ mod get_and_set_tests {
                     },
                     IncludedStates::empty(),
                     &mut reader,
-                    None,
+                    CheckedVarStores::NONE,
                     VolatileWrites::Refuse,
                     PendingOperations::new(UnsafeOperations::Refuse),
                     &WithholdingVariables::new(&variables, WithheldBytes::default()),
+                    &[],
                 )
                 .map(|_| ())
                 .map_err(|error| error.to_string());
@@ -1009,47 +1158,116 @@ mod get_and_set_tests {
         }
     }
 
-    /// QuestionDescriptor::storageless_route gives the classifier's routes of a question
-    /// without a VarStore, and nothing for one with a VarStore.
+    /// A DATE or TIME without a VarStore, flagged EFI_IFR_FLAG_CALLBACK, whose option flagged
+    /// DEFAULT gives its standard default, shows that default beside the refusal of its value,
+    /// through either reach: the IFR gives the default, but the driver keeps the value, which
+    /// uefisettings exchanges with no CallBack() for a DATE or TIME; set refuses it.
     #[test]
-    fn descriptors_give_the_routes_of_storageless_questions() {
-        let root = storageless_form_set();
-        let mut reader = reader_reaching(VariableReach::BootServices);
-        let listed: BTreeMap<String, QuestionDescriptor> = list_questions(
-            Rc::clone(&root),
-            &ListTexts::new(&string_packages(), &[]),
-            IncludedStates::empty(),
-            None,
-            &mut reader,
-        )
-        .into_iter()
-        .map(|(question, _)| (question.question.clone(), question))
-        .collect();
-        for (prompt, callback, read, write) in QUESTIONS {
-            let routes = [QuestionExpression::Read, QuestionExpression::Write].map(|expression| {
-                listed
+    fn a_callback_date_or_time_shows_its_option_default_beside_its_refusal() {
+        // EFI_IFR_OPTION_DEFAULT
+        const DEFAULT: u8 = 0x10;
+        let question = |id: u16, op_code, option: Vec<u8>| {
+            let data = [
+                question_header_with(id, 20 + id, 0, 0, QuestionFlags::CALLBACK.bits()),
+                vec![0x00],
+            ]
+            .concat();
+            [operation(op_code, true, &data), option, END.to_vec()].concat()
+        };
+        let root = parse_form_set(&[
+            default_store(0x0000),
+            form(
+                1,
+                &[
+                    question(1, DATE, typed_option(5, DEFAULT, 0x06, &[0xD4, 0x07, 1, 2])),
+                    question(2, TIME, typed_option(5, DEFAULT, 0x05, &[15, 33, 34])),
+                ],
+            ),
+        ]);
+        let strings = vec![en_us_package(
+            [(21, Rc::from("Date")), (22, Rc::from("Time"))]
+                .into_iter()
+                .collect(),
+        )];
+        let cases = [
+            ("Date", "EFI_IFR_DATE", "2004-01-02", "2027-01-02"),
+            ("Time", "EFI_IFR_TIME", "15:33:34", "01:02:03"),
+        ];
+        for reach in [VariableReach::Runtime, VariableReach::BootServices] {
+            let mut reader = reader_reaching(reach);
+            let listed: BTreeMap<String, QuestionDescriptor> = list_questions(
+                Rc::clone(&root),
+                &ListTexts::new(&strings, &[]),
+                IncludedStates::empty(),
+                CheckedVarStores::NONE,
+                &mut reader,
+            )
+            .into_iter()
+            .map(|(question, _)| (question.question.clone(), question))
+            .collect();
+            for (prompt, op, default, new_value) in cases {
+                let refusal = StoragelessRefusal::CallbackUndecoded(op);
+                let listed = listed
                     .get(prompt)
-                    .and_then(|descriptor| descriptor.storageless_route(expression))
-            });
-            let want = [(read, write), (write, read)].map(|(this, other)| {
-                Some(match (this, callback, other) {
-                    (true, callback, _) => Ok(StoragelessRoute::Expression { callback }),
-                    (false, true, _) => Ok(StoragelessRoute::DriverCallback),
-                    (false, false, _) => Err(()),
-                })
-            });
-            assert_eq!(
-                routes.map(|route| route.map(|route| route.map_err(|_| ()))),
-                want,
-                "{prompt}"
-            );
+                    .unwrap_or_else(|| panic!("{prompt}: not listed through {reach:?}"));
+                assert_eq!(
+                    listed.value,
+                    format!("<ValueUnavailable: {refusal}> <IFR default: {default}>"),
+                    "{prompt} through {reach:?}"
+                );
+                let defaults: Vec<(DefaultId, String)> = listed
+                    .defaults
+                    .iter()
+                    .map(|declared| (declared.default_id, declared.value.to_string()))
+                    .collect();
+                assert_eq!(
+                    defaults,
+                    [(DefaultId::STANDARD, default.to_string())],
+                    "{prompt} through {reach:?}: defaults"
+                );
+
+                let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
+                let selection = find_question_in(
+                    &root,
+                    &QuestionMatch::Prompt(&BTreeSet::from([prompt]), MatchTier::Stored),
+                    &mut FormSetWalk::new(
+                        &ListTexts::new(&strings, &[]),
+                        &mut reader,
+                        &values,
+                        IncludedStates::empty(),
+                    ),
+                );
+                let Selection::Picked {
+                    picked: (descriptor, _),
+                    ..
+                } = &selection
+                else {
+                    panic!("{prompt}: not picked through {reach:?}");
+                };
+                let variables = MemoryVariables::new(reach, reader.interface());
+                let set = set_questions(
+                    prompt,
+                    &[("selector", descriptor)],
+                    NewAnswer::Text {
+                        text: new_value,
+                        variations: &BTreeSet::from([new_value.to_string()]),
+                    },
+                    IncludedStates::empty(),
+                    &mut reader,
+                    CheckedVarStores::NONE,
+                    VolatileWrites::Refuse,
+                    PendingOperations::new(UnsafeOperations::Refuse),
+                    &WithholdingVariables::new(&variables, WithheldBytes::default()),
+                    &[],
+                )
+                .map(|_| ())
+                .map_err(|error| error.to_string());
+                assert_eq!(
+                    set,
+                    Err(format!("cannot set question {prompt:?}: {refusal}")),
+                    "{prompt}: set through {reach:?}"
+                );
+            }
         }
-        assert_eq!(
-            listed
-                .get(STORED)
-                .map(|descriptor| descriptor.storageless_route(QuestionExpression::Read)),
-            Some(None),
-            "{STORED}"
-        );
     }
 }
diff --git a/src/lib/hii/forms/string_question.rs b/src/lib/hii/forms/string_question.rs
index eee4c8b..9acd4a6 100644
--- a/src/lib/hii/forms/string_question.rs
+++ b/src/lib/hii/forms/string_question.rs
@@ -15,7 +15,6 @@
 
 use std::cell::RefCell;
 use std::num::NonZeroU8;
-use std::ops::RangeInclusive;
 use std::rc::Rc;
 
 use binrw::BinRead;
@@ -43,6 +42,8 @@ use super::QuestionFlags;
 use super::QuestionHeader;
 use super::QuestionIdentity;
 use super::TextInput;
+use crate::hii::strings::is_control_character;
+use crate::hii::strings::PRIVATE_USE_AREA;
 use crate::hii::variables::VariableLayout;
 
 /// The bytes of a CHAR16, a character of a string (UEFI 2.11 §33.2.6).
@@ -52,15 +53,6 @@ const CHAR16_SIZE: u16 = 2;
 /// allowed" (UEFI 2.11 §33.3.8.3.70).
 const EFI_IFR_STRING_MULTI_LINE: u8 = 0x01;
 
-/// The Private Use Area of the BMP, of which UEFI 2.11 §33.2.6.2.1 says "UEFI prohibits use of
-/// this area in a UEFI environment."
-const PRIVATE_USE_AREA: RangeInclusive<char> = '\u{E000}'..='\u{F8FF}';
-
-/// The double-byte Common Control Codes of UEFI 2.11 §33.2.6.2.4 Table 33.3, font display hints
-/// that strings may hold, which lie in the Private Use Area.
-const COMMON_CONTROL_CODES: [RangeInclusive<char>; 2] =
-    ['\u{F620}'..='\u{F62B}', '\u{F700}'..='\u{F8FF}'];
-
 /// The Mandatory Breaks of UEFI 2.11 §33.2.6.2.5 Table 33.4, which force a line break.
 const MANDATORY_BREAKS: [char; 5] = ['\u{A}', '\u{C}', '\u{D}', '\u{2028}', '\u{2029}'];
 
@@ -135,7 +127,7 @@ fn stored_units(bytes: &[u8]) -> impl Iterator<Item = u16> + '_ {
 }
 
 /// The text of `bytes`, the CHAR16s of a STRING that stored_units takes.
-fn stored_text(bytes: &[u8]) -> Result<String, NotUcs2> {
+pub(super) fn stored_text(bytes: &[u8]) -> Result<String, NotUcs2> {
     stored_units(bytes)
         .enumerate()
         .map(|(index, unit)| char::from_u32(u32::from(unit)).ok_or(NotUcs2 { index, unit }))
@@ -290,10 +282,8 @@ impl StringInput {
                 Err(StringRefusal::LineBreak)
             }
             character
-                if PRIVATE_USE_AREA.contains(&character)
-                    && !COMMON_CONTROL_CODES
-                        .iter()
-                        .any(|codes| codes.contains(&character)) =>
+                if PRIVATE_USE_AREA.contains(&u32::from(character))
+                    && !is_control_character(character) =>
             {
                 Err(StringRefusal::PrivateUse(character))
             }
@@ -365,6 +355,8 @@ pub(super) fn handle_string(
         value: answer,
         help: texts.display(header.help_string_id).to_string(),
         possible_options: Vec::new(),
+        // StoragelessQuestion::refusal refuses one that its driver holds
+        driver_held: None,
         varstore,
         location: question.location(),
         input: TextInput::String(StringInput {
diff --git a/src/lib/hii/forms/write_plan.rs b/src/lib/hii/forms/write_plan.rs
index 0a14682..8faad6a 100644
--- a/src/lib/hii/forms/write_plan.rs
+++ b/src/lib/hii/forms/write_plan.rs
@@ -40,6 +40,7 @@ use super::ordered_list::ListRefusal;
 use super::ordered_list::ListWrite;
 use super::set::own_write;
 use super::set::ChangeValueError;
+use super::set::DriverStore;
 use super::set::NewValue;
 use super::set::VarStoreWrite;
 use super::storage::BufferExpression;
@@ -51,7 +52,7 @@ use super::time_storage::value_changes;
 use super::time_storage::FieldChange;
 use super::time_storage::TimeStorage;
 use super::time_storage::TimeWrite;
-use super::AccessLevel;
+use super::CheckedVarStores;
 use super::EfivarReader;
 use super::IFROpCode;
 use super::IFROperation;
@@ -85,19 +86,20 @@ pub(super) struct QuestionWrites<'p> {
 impl<'a> WritePlan<'a> {
     /// The plan that sets `question` to `new_value` through variables of `reach` and
     /// `interface`, evaluating its WRITE expression with values read through `reader`, whose
-    /// conditions read `access_level`, if stated, for AMI_ACCESS_LEVEL.
+    /// conditions read the VarStore bytes that `assumed` states in place of those their variables
+    /// hold.
     pub(super) fn new(
         question: &'a QuestionDescriptor,
         new_value: NewValue<'_>,
         (reach, interface): (VariableReach, VariableInterface),
         reader: &mut EfivarReader,
-        access_level: Option<AccessLevel>,
+        assumed: CheckedVarStores<'_>,
     ) -> Result<Self, ChangeValueError> {
         let (value, own) = own_write(question, new_value, reach, interface)?;
         let Some(this) = this_value(question.opcode, value) else {
             return Err(anyhow!("unsupported value type for {}", interface.write()).into());
         };
-        let values = VarStoreValues::new(&root_of(&question.node), access_level);
+        let values = VarStoreValues::new(&root_of(&question.node), assumed);
         let sets = evaluate_write(
             &question.node,
             this,
@@ -257,7 +259,7 @@ pub(super) fn list_own_write<'a>(
 
 /// The write of `write`, the CHAR16s of the STRING `question`, through variables of `reach`:
 /// refuses one with a WRITE expression, which takes its characters, or without a VarStore.
-fn string_own_write<'a>(
+pub(super) fn string_own_write<'a>(
     question: &'a QuestionDescriptor,
     StringWrite { offset, bytes }: StringWrite,
     reach: VariableReach,
@@ -397,34 +399,43 @@ impl BatchedWrite<'_> {
     }
 }
 
-/// A write of set's batch: of EFI Date/Time Storage for the question of a selector, or of a
-/// variable.
+/// A write of set's batch: of EFI Date/Time Storage for the question of a selector, of a
+/// variable, or of a driver that applies a value.
 pub(super) enum BatchedStore<'b, 'a> {
     Time {
         selector: &'a str,
         write: &'b TimeWrite,
     },
     Variable(&'b BatchedWrite<'a>),
+    Driver(&'b dyn DriverStore),
 }
 
 impl BatchedStore<'_, '_> {
-    /// The write as set's errors name it: its selectors and its storage or variable.
+    /// The write as set's errors name it: its selectors and its storage or variable, or its
+    /// driver's label.
     pub(super) fn label(&self) -> String {
         match self {
             Self::Time { selector, write } => format!("{selector} ({})", write.storage()),
             Self::Variable(batched) => batched.label(),
+            Self::Driver(driver) => driver.label(),
         }
     }
 
     /// Writes it, a variable through `variables`, and returns its label with the EFI_TIME that a
-    /// write of EFI Date/Time Storage wrote.
-    pub(super) fn write(&self, variables: &dyn FirmwareVariables) -> Result<String> {
+    /// write of EFI Date/Time Storage wrote, and a driver's annotation of set's answer.
+    pub(super) fn write(
+        &self,
+        variables: &dyn FirmwareVariables,
+    ) -> Result<(String, Option<String>)> {
         match self {
-            Self::Time { selector, write } => Ok(format!("{selector} ({})", write.write()?)),
+            Self::Time { selector, write } => {
+                Ok((format!("{selector} ({})", write.write()?), None))
+            }
             Self::Variable(batched) => {
                 batched.write.write(variables)?;
-                Ok(batched.label())
+                Ok((batched.label(), None))
             }
+            Self::Driver(driver) => Ok((driver.label(), Some(driver.apply()?))),
         }
     }
 }
@@ -841,10 +852,10 @@ mod tests {
     ) -> Result<Vec<bool>, String> {
         let through = (writes.reach(), writes.interface());
         let mut reader = EfivarReader::with_variables(Box::new(variables(through)));
-        let values = VarStoreValues::new(root, None);
+        let values = VarStoreValues::new(root, CheckedVarStores::NONE);
         let selection = find_question_in(
             root,
-            &QuestionMatch::Prompt(&BTreeSet::from([prompt])),
+            &QuestionMatch::Prompt(&BTreeSet::from([prompt]), MatchTier::Stored),
             &mut FormSetWalk::new(
                 &ListTexts::new(strings, &[]),
                 &mut reader,
@@ -875,12 +886,13 @@ mod tests {
             },
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             volatile,
             pending,
             &WithholdingVariables::new(writes, WithheldBytes::default()),
+            &[],
         )
-        .map(|(written, _)| written.iter().map(|question| question.volatile).collect())
+        .map(|(written, _, _)| written.iter().map(|question| question.volatile).collect())
         .map_err(|error| format!("{error:#}"))
     }
 
@@ -1022,10 +1034,10 @@ mod tests {
             let mut reader = passwords
                 .reader(Box::new(variables(through)))
                 .expect("resolve the VarStore of the PASSWORD question");
-            let values = VarStoreValues::new(&root, None);
+            let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
             let selection = find_question_in(
                 &root,
-                &QuestionMatch::Prompt(&BTreeSet::from(["Around"])),
+                &QuestionMatch::Prompt(&BTreeSet::from(["Around"]), MatchTier::Stored),
                 &mut FormSetWalk::new(
                     &ListTexts::new(&strings, &[]),
                     &mut reader,
@@ -1062,12 +1074,13 @@ mod tests {
                 },
                 IncludedStates::empty(),
                 &mut reader,
-                None,
+                CheckedVarStores::NONE,
                 VolatileWrites::Refuse,
                 PendingOperations::new(UnsafeOperations::Refuse),
                 &passwords
                     .withholding(&writes)
                     .expect("resolve the VarStore of the PASSWORD question"),
+                &[],
             )
             .map(|_| ())
             .map_err(|error| format!("{error:#}"));
@@ -1152,10 +1165,10 @@ mod tests {
         let mut reader = passwords
             .reader(Box::new(variables(through)))
             .expect("resolve the VarStore of the PASSWORD question");
-        let values = VarStoreValues::new(&root, None);
+        let values = VarStoreValues::new(&root, CheckedVarStores::NONE);
         let selection = find_question_in(
             &root,
-            &QuestionMatch::Prompt(&BTreeSet::from(["Around"])),
+            &QuestionMatch::Prompt(&BTreeSet::from(["Around"]), MatchTier::Stored),
             &mut FormSetWalk::new(
                 &ListTexts::new(&strings, &[]),
                 &mut reader,
@@ -1180,12 +1193,13 @@ mod tests {
             },
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             VolatileWrites::Refuse,
             PendingOperations::new(UnsafeOperations::Refuse),
             &passwords
                 .withholding(&writes)
                 .expect("resolve the VarStore of the PASSWORD question"),
+            &[],
         )
         .map(|_| ())
         .map_err(|error| format!("{error:#}"));
@@ -1301,10 +1315,10 @@ mod tests {
         strings: &[StringPackage],
         reader: &mut EfivarReader,
     ) -> QuestionDescriptor {
-        let values = VarStoreValues::new(root, None);
+        let values = VarStoreValues::new(root, CheckedVarStores::NONE);
         let selection = find_question_in(
             root,
-            &QuestionMatch::Prompt(&BTreeSet::from(["Around"])),
+            &QuestionMatch::Prompt(&BTreeSet::from(["Around"]), MatchTier::Stored),
             &mut FormSetWalk::new(
                 &ListTexts::new(strings, &[]),
                 reader,
@@ -1342,12 +1356,13 @@ mod tests {
             answer,
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             VolatileWrites::Refuse,
             PendingOperations::new(UnsafeOperations::Refuse),
             &passwords
                 .withholding(&writes)
                 .expect("resolve the VarStore of the PASSWORD question"),
+            &[],
         )
         .map(|_| ())
         .map_err(|error| format!("{error:#}"));
@@ -1709,10 +1724,10 @@ mod tests {
         let mut reader = EfivarReader::with_variables(Box::new(variables(EFIVARFS)));
         let mut selections = Vec::new();
         for root in &roots {
-            let values = VarStoreValues::new(root, None);
+            let values = VarStoreValues::new(root, CheckedVarStores::NONE);
             selections.push(find_question_in(
                 root,
-                &QuestionMatch::Prompt(&BTreeSet::from(["Dup"])),
+                &QuestionMatch::Prompt(&BTreeSet::from(["Dup"]), MatchTier::Stored),
                 &mut FormSetWalk::new(
                     &ListTexts::new(&strings, &[]),
                     &mut reader,
@@ -1743,10 +1758,11 @@ mod tests {
             },
             IncludedStates::empty(),
             &mut reader,
-            None,
+            CheckedVarStores::NONE,
             VolatileWrites::Refuse,
             PendingOperations::new(UnsafeOperations::Refuse),
             &WithholdingVariables::new(&writes, WithheldBytes::default()),
+            &[],
         )
         .expect("set both questions");
 
diff --git a/src/lib/hii/keyword_access.rs b/src/lib/hii/keyword_access.rs
index a84adc6..301dced 100644
--- a/src/lib/hii/keyword_access.rs
+++ b/src/lib/hii/keyword_access.rs
@@ -41,10 +41,18 @@ use super::forms::keywords::KeywordWrite;
 use super::forms::IncludedStates;
 use super::forms::PasswordQuestions;
 use super::package::ParsedPackageList;
+#[cfg(all(variable_data, variable_names))]
+use super::variable_changes::DriverCode;
+#[cfg(all(variable_data, variable_names))]
+use super::variable_changes::VariableSnapshot;
 use super::variables::EfivarReader;
 use super::variables::FirmwareVariables;
 use super::variables::VolatileWrites;
 use super::variables::VOLATILE_ANNOTATION;
+#[cfg(all(variable_data, variable_names))]
+use crate::efi_variables::VariableData;
+#[cfg(all(variable_data, variable_names))]
+use crate::efi_variables::VariableNames;
 use crate::unsafe_operations::LiftedOperations;
 use crate::unsafe_operations::PendingOperations;
 use crate::unsafe_operations::UnsafeOperation;
@@ -409,6 +417,44 @@ pub(crate) fn get_keywords(
     })
 }
 
+/// get_keywords through `variables`, with the bytes of the PASSWORD questions of `lists` in them
+/// compared across it, as the drivers that GetData() reaches may write them: a change, or bytes
+/// that cannot be compared, fail it (VariableSnapshot), with its own error as the cause.
+#[cfg(all(variable_data, variable_names))]
+pub(crate) fn get_keywords_witnessed<V>(
+    lists: &[ParsedPackageList],
+    requests: &str,
+    namespace: Option<&str>,
+    requested: &[&str],
+    options: KeywordGetOptions,
+    variables: V,
+    handler: &impl KeywordData,
+) -> Result<KeywordValues>
+where
+    V: FirmwareVariables + VariableData + VariableNames + Clone + 'static,
+{
+    let withholding = PasswordQuestions::of_lists(lists).withholding(variables.clone())?;
+    let before =
+        VariableSnapshot::take(&withholding, DriverCode::GetData).map_err(anyhow::Error::msg)?;
+    let got = get_keywords(
+        lists,
+        requests,
+        namespace,
+        requested,
+        options,
+        Box::new(variables),
+        handler,
+    );
+    match (
+        before.changes(&withholding).refusal(DriverCode::GetData),
+        got,
+    ) {
+        (None, got) => got,
+        (Some(refusal), Ok(_)) => Err(anyhow!(refusal)),
+        (Some(refusal), Err(error)) => Err(error.context(refusal)),
+    }
+}
+
 /// A question that get reads, the request that names it, and the `<KeywordInfoResp>` of its
 /// KEYWORDINFO from the IFR, if it takes one.
 struct KeywordRead<'q, 'a> {
@@ -654,6 +700,45 @@ pub(crate) fn set_keywords(
     Ok((KeywordValues { resps, volatile }, lifted))
 }
 
+/// set_keywords through `variables`, with the bytes of the PASSWORD questions of `lists` in them
+/// compared across it, as the drivers that SetData() and its read-back reach may write them: a
+/// change, or bytes that cannot be compared, fail it (VariableSnapshot), with its own error as
+/// the cause.
+#[cfg(all(variable_data, variable_names))]
+pub(crate) fn set_keywords_witnessed<V>(
+    lists: &[ParsedPackageList],
+    keywords: &str,
+    include: IncludedStates,
+    unsafe_operations: UnsafeOperations,
+    volatile: VolatileWrites,
+    variables: V,
+    handler: &impl KeywordData,
+) -> Result<(KeywordValues, Vec<UnsafeOperation>)>
+where
+    V: FirmwareVariables + VariableData + VariableNames + Clone + 'static,
+{
+    let withholding = PasswordQuestions::of_lists(lists).withholding(variables.clone())?;
+    let before =
+        VariableSnapshot::take(&withholding, DriverCode::SetData).map_err(anyhow::Error::msg)?;
+    let set = set_keywords(
+        lists,
+        keywords,
+        include,
+        unsafe_operations,
+        volatile,
+        Box::new(variables),
+        handler,
+    );
+    match (
+        before.changes(&withholding).refusal(DriverCode::SetData),
+        set,
+    ) {
+        (None, set) => set,
+        (Some(refusal), Ok((_, lifted))) => Err(LiftedOperations::attach(lifted, anyhow!(refusal))),
+        (Some(refusal), Err(error)) => Err(error.context(refusal)),
+    }
+}
+
 /// Writes `resps` with one SetData() of `handler` and reads each keyword back with GetData(),
 /// which must hold the number written; when SetData() fails, it reads them back too and reports
 /// each with the error.
@@ -906,6 +991,7 @@ mod tests {
     use crate::hii::forms::ifr_fixtures::conditional;
     use crate::hii::forms::ifr_fixtures::eq_id_val_of;
     use crate::hii::forms::ifr_fixtures::flagged_option;
+    use crate::hii::forms::ifr_fixtures::flagged_password_on;
     use crate::hii::forms::ifr_fixtures::form_set;
     use crate::hii::forms::ifr_fixtures::form_set_with_guid;
     use crate::hii::forms::ifr_fixtures::in_unknown_scope;
@@ -1156,6 +1242,7 @@ mod tests {
         let strings = |language: &[u8], first: &str, second: &str| StringPackage {
             language: Language(language.to_vec()),
             strings: BTreeMap::from([(3, first.into()), (5, second.into())]),
+            replaced: Default::default(),
         };
         let device_path = path.parse::<KeywordPath>().expect("a device path");
         ParsedPackageList {
@@ -1712,37 +1799,75 @@ mod tests {
         assert_eq!(got, Ok(vec![]), "no password: lifted");
     }
 
-    /// In a HiiDB that declares a PASSWORD question, set refuses a keyword of a STRING, whose
-    /// keyword set uefisettings does not implement yet, before the setup password, with and
-    /// without UnsafeOperations::Allow, and calls no SetData().
+    /// keyword set of a STRING in a HiiDB that declares a PASSWORD question takes UnsafeOperations
+    /// as the other kinds do: set's refusal of the VALUE's text, a character of the Private Use
+    /// Area, comes before the setup password's, which refuses before any call unless
+    /// UnsafeOperations allows it; then SetData() writes the VALUE as given, GetData() reads it
+    /// back and UnsafeOperation::SetupPassword returns, lifted.
     #[test]
-    fn set_refuses_a_string_before_the_setup_password() {
+    fn set_of_a_string_with_a_declared_password_needs_the_flag() {
         let lists = [list(
             PATH,
             &[vec![string_on(3, 3, (1, 8), (0, 4), &[])], password()].concat(),
         )];
-        for grant in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
-            let handler = MemoryKeywordHandler::with(&[(PATH, KEYWORD, "4100000000000000")]);
+        let written = resp(PATH, KEYWORD, "0000000000420041");
+        let private_use = resp(PATH, KEYWORD, "000000000000e000");
 
-            let got = set(
-                &lists,
-                &resp(PATH, KEYWORD, "4100420000000000"),
-                grant,
-                &handler,
-            )
-            .map(|values| values.to_string())
-            .map_err(|error| format!("{error:#}"));
+        let refused = MemoryKeywordHandler::default();
+        let password = set(&lists, &written, UnsafeOperations::Refuse, &refused)
+            .expect_err("a declared setup password");
+        let string = set(&lists, &private_use, UnsafeOperations::Allow, &refused)
+            .expect_err("the Private Use Area");
+        let string_refused = set(&lists, &private_use, UnsafeOperations::Refuse, &refused)
+            .expect_err("the Private Use Area, refused");
+        assert_eq!(
+            format!("{string_refused:#}"),
+            format!("{string:#}"),
+            "the STRING's refusal before the setup password's"
+        );
+        let allowed = MemoryKeywordHandler::default();
+        let (values, lifted) = set_keywords(
+            &lists,
+            &written,
+            IncludedStates::empty(),
+            UnsafeOperations::Allow,
+            VolatileWrites::Refuse,
+            variables(),
+            &allowed,
+        )
+        .expect("allowed");
 
-            assert_eq!(
-                got,
-                Err(format!(
-                    "keyword {KEYWORD}: uefisettings does not yet implement keyword set of \
-                     EFI_IFR_STRING"
-                )),
-                "{grant:?}"
-            );
-            assert_eq!(handler.calls(), [], "{grant:?}: calls");
-        }
+        assert_eq!(
+            format!("{password:#}"),
+            "this HiiDB declares a setup password question, and the UEFI Shell runs no setup \
+             browser, so no password is asked or checked; pass --i-am-fine-to-brick-this-system \
+             to write without it",
+            "refused"
+        );
+        assert_eq!(
+            format!("{string:#}"),
+            format!(
+                "keyword {KEYWORD}: VALUE=000000000000e000 of question \"Keyword question\": \
+                 cannot set question \"Keyword question\": '\\u{{e000}}' (U+E000) lies in the \
+                 Private Use Area, U+E000..U+F8FF, which UEFI 2.11 §33.2.6.2.1 prohibits"
+            ),
+            "the STRING's refusal, whatever the grant"
+        );
+        assert_eq!(refused.calls(), vec![], "no call when refused");
+        assert_eq!(values.to_string(), written, "allowed: the value read back");
+        assert_eq!(
+            lifted,
+            vec![UnsafeOperation::SetupPassword],
+            "allowed: lifted"
+        );
+        assert_eq!(
+            allowed.calls(),
+            vec![
+                KeywordCall::SetData(written.clone()),
+                get_call(PATH, KEYWORD)
+            ],
+            "allowed: one SetData(), then a GetData()"
+        );
     }
 
     /// set refuses a keyword whose question EFI_IFR_FLAG_READ_ONLY makes read-only, under a
@@ -4315,6 +4440,84 @@ mod tests {
         );
     }
 
+    /// Set by keyword of a STRING beside a PASSWORD of VarStoreId 0, EFI_IFR_FLAG_CALLBACK or not,
+    /// fails before any variable read or call through variables of either reach, with
+    /// UnsafeOperations::Allow too, as set does; beside a PASSWORD on Store that ends before it,
+    /// SetData() writes the STRING's VALUE.
+    #[test]
+    fn set_refuses_a_string_beside_a_password_of_var_store_id_0() {
+        let written = resp(PATH, KEYWORD, "0000000000420041");
+        let set_of = |password: Vec<u8>, reach| {
+            let ifr = form_set(&[
+                var_store(1, STORE_GUID, "Store", 48),
+                password,
+                string_on(7, 3, (1, 40), (0, 4), &[]),
+            ]);
+            let interface = match reach {
+                VariableReach::BootServices => VariableInterface::VariableServices,
+                VariableReach::Runtime => VariableInterface::Efivarfs,
+            };
+            let variables = Rc::new(MemoryVariables::new(reach, interface));
+            let key = VariableKey {
+                name: "Store".to_owned(),
+                guid: Guid::from(STORE_GUID),
+            };
+            variables.insert(key, ATTRIBUTES, &[0; 48]);
+            let handler = MemoryKeywordHandler::default();
+            let got = set_keywords(
+                &[list_of_ifr(PATH, &ifr)],
+                &written,
+                IncludedStates::empty(),
+                UnsafeOperations::Allow,
+                VolatileWrites::Refuse,
+                Box::new(Rc::clone(&variables)),
+                &handler,
+            )
+            .map(|(values, _)| values.to_string())
+            .map_err(|error| format!("{error:#}"));
+            (got, variables.reads().len(), handler.calls())
+        };
+        let record = "PASSWORD question 0x0009 in FormSet 11111111-1111-1111-1111-111111111111: \
+                      VarStoreId 0 names no VarStore";
+
+        for flags in [0x00, 0x04] {
+            for (reach, end) in [
+                (
+                    VariableReach::BootServices,
+                    "; as the variable of that password is unknown, the UEFI Shell build reads \
+                     and writes no variable of this HiiDB",
+                ),
+                (
+                    VariableReach::Runtime,
+                    "; as a PASSWORD there may keep its password in any variable, uefisettings \
+                     reads and writes no variable of this HiiDB",
+                ),
+            ] {
+                let (got, reads, calls) = set_of(flagged_password_on(9, 9, 0, 0, flags), reach);
+                assert!(
+                    got.as_ref()
+                        .is_err_and(|error| error.contains(record) && error.ends_with(end)),
+                    "Flags {flags:#04x}, {reach:?}: {got:?}"
+                );
+                assert_eq!(reads, 0, "Flags {flags:#04x}, {reach:?}: reads");
+                assert_eq!(calls, vec![], "Flags {flags:#04x}, {reach:?}: calls");
+            }
+        }
+        let (got, _, calls) = set_of(
+            flagged_password_on(9, 9, 1, 0, 0x00),
+            VariableReach::BootServices,
+        );
+        assert_eq!(got, Ok(written.clone()), "beside a password on Store");
+        assert_eq!(
+            calls,
+            vec![
+                KeywordCall::SetData(written.clone()),
+                get_call(PATH, KEYWORD)
+            ],
+            "beside a password on Store: calls"
+        );
+    }
+
     /// Beside a PASSWORD of VarStoreId 0, whose password may be in any variable,
     /// EFI_IFR_FLAG_CALLBACK or not, get and set by keyword refuse the HiiDB before any call, as
     /// get and set do, set with UnsafeOperations::Allow too; beside one on Store they read the
@@ -4378,4 +4581,351 @@ mod tests {
             "beside a password on Store"
         );
     }
+
+    /// Beside a PASSWORD whose VarStoreId 9 no VarStore declares, whose password may be in any
+    /// variable, get and set by keyword refuse the HiiDB before any call through variables of
+    /// either reach, set with UnsafeOperations::Allow too; beside one on Store they read the
+    /// question.
+    #[test]
+    fn get_and_set_refuse_beside_a_password_of_an_undeclared_var_store_id() {
+        let lists = |var_store_id| {
+            let password = [
+                question_header_with(9, 9, var_store_id, 6, 0x00),
+                [&1u16.to_le_bytes()[..], &20u16.to_le_bytes()].concat(), // MinSize, MaxSize
+            ]
+            .concat();
+            let password = operation(crate::hii::forms::ifr_fixtures::PASSWORD, false, &password);
+            [list(PATH, &[questions(), vec![password]].concat())]
+        };
+        let variables_of = |reach, interface| -> Box<dyn FirmwareVariables> {
+            let variables = MemoryVariables::new(reach, interface);
+            let mut data = [0; 16];
+            data[5] = 1;
+            data[6] = 1;
+            let key = VariableKey {
+                name: "Store".to_owned(),
+                guid: Guid::from(STORE_GUID),
+            };
+            variables.insert(key, ATTRIBUTES, &data);
+            Box::new(variables)
+        };
+        let get_through =
+            |lists: &[ParsedPackageList], variables, handler: &MemoryKeywordHandler| {
+                get_keywords(
+                    lists,
+                    &format!("KEYWORD={KEYWORD}"),
+                    None,
+                    &[],
+                    KeywordGetOptions::default(),
+                    variables,
+                    handler,
+                )
+                .map(|values| values.to_string())
+                .map_err(|error| format!("{error:#}"))
+            };
+        let handler =
+            || MemoryKeywordHandler::with(&[(PATH, KEYWORD, "01"), (PATH, SECOND_KEYWORD, "01")]);
+        let record = "PASSWORD question 0x0009 in FormSet 11111111-1111-1111-1111-111111111111: \
+                      no supported varstore with matching id 0x0009 found; ";
+
+        for (reach, interface) in [
+            (VariableReach::Runtime, VariableInterface::Efivarfs),
+            (
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            ),
+        ] {
+            let refused = handler();
+            let got = get_through(&lists(9), variables_of(reach, interface), &refused);
+            assert!(
+                got.as_ref().is_err_and(|error| error.starts_with(record)),
+                "{reach:?}: get: {got:?}"
+            );
+            let written = set_keywords(
+                &lists(9),
+                &resp(PATH, KEYWORD, "03"),
+                IncludedStates::empty(),
+                UnsafeOperations::Allow,
+                VolatileWrites::Refuse,
+                variables_of(reach, interface),
+                &refused,
+            )
+            .map(|(values, _)| values.to_string())
+            .map_err(|error| format!("{error:#}"));
+            assert!(
+                written
+                    .as_ref()
+                    .is_err_and(|error| error.starts_with(record)),
+                "{reach:?}: set: {written:?}"
+            );
+            assert_eq!(refused.calls(), vec![], "{reach:?}: calls");
+        }
+        assert_eq!(
+            get_through(
+                &lists(1),
+                variables_of(VariableReach::Runtime, VariableInterface::Efivarfs),
+                &handler()
+            ),
+            Ok(resp(PATH, KEYWORD, "01")),
+            "beside a password on Store"
+        );
+    }
+
+    /// The bytes of a password compared across SetData() and GetData().
+    #[cfg(all(variable_data, variable_names))]
+    mod witnessed {
+        use super::*;
+
+        /// Which call of a PasswordOverwritingHandler writes the password of password().
+        #[derive(Clone, Copy)]
+        enum PasswordOverwrite {
+            InSetData,
+            InGetData,
+            Never,
+        }
+
+        /// A MemoryKeywordHandler whose SetData() or GetData(), as `overwrite` says, also writes
+        /// bytes 0 and 1 of the variable Password, which the PASSWORD question of password()
+        /// holds, as a driver's RouteConfig() or ExtractConfig() may write its variables.
+        struct PasswordOverwritingHandler {
+            inner: MemoryKeywordHandler,
+            variables: Rc<MemoryVariables>,
+            overwrite: PasswordOverwrite,
+        }
+
+        impl KeywordData for PasswordOverwritingHandler {
+            fn get_data(
+                &self,
+                namespace_id: &str,
+                keyword_string: &str,
+            ) -> Result<String, GetDataError> {
+                let got = self.inner.get_data(namespace_id, keyword_string);
+                if matches!(self.overwrite, PasswordOverwrite::InGetData) {
+                    overwrite_password(&self.variables);
+                }
+                got
+            }
+
+            fn set_data(&self, keyword_string: &str) -> Result<()> {
+                let set = self.inner.set_data(keyword_string);
+                if matches!(self.overwrite, PasswordOverwrite::InSetData) {
+                    overwrite_password(&self.variables);
+                }
+                set
+            }
+        }
+
+        /// The variable of the VarStore of password().
+        fn password_key() -> VariableKey {
+            VariableKey {
+                name: "Password".to_owned(),
+                guid: Guid::from([0x44; 16]),
+            }
+        }
+
+        fn overwrite_password(variables: &MemoryVariables) {
+            let mut data = [0; 40];
+            data[..2].copy_from_slice(&[0x5A, 0xA5]);
+            variables.insert(password_key(), ATTRIBUTES, &data);
+        }
+
+        /// The variables of variables(), and the variable of password() holding zeros.
+        fn variables_with_password() -> Rc<MemoryVariables> {
+            let variables = MemoryVariables::new(
+                VariableReach::BootServices,
+                VariableInterface::VariableServices,
+            );
+            let mut data = [0; 16];
+            data[5] = 1;
+            data[6] = 1;
+            let store = VariableKey {
+                name: "Store".to_owned(),
+                guid: Guid::from(STORE_GUID),
+            };
+            variables.insert(store, ATTRIBUTES, &data);
+            variables.insert(password_key(), ATTRIBUTES, &[0; 40]);
+            Rc::new(variables)
+        }
+
+        /// The handler of KEYWORD and SECOND_KEYWORD that overwrites the password as `overwrite`
+        /// says, in `variables`.
+        fn overwriting(
+            variables: &Rc<MemoryVariables>,
+            overwrite: PasswordOverwrite,
+        ) -> PasswordOverwritingHandler {
+            PasswordOverwritingHandler {
+                inner: MemoryKeywordHandler::with(&[
+                    (PATH, KEYWORD, "01"),
+                    (PATH, SECOND_KEYWORD, "01"),
+                ]),
+                variables: Rc::clone(variables),
+                overwrite,
+            }
+        }
+
+        #[test]
+        fn keyword_set_fails_where_set_data_changes_withheld_bytes() {
+            let lists = [list(PATH, &[questions(), password()].concat())];
+            let refusal = format!(
+                "SetData() changed the password bytes of EFI variable {}; they were not \
+                 restored, as uefisettings never writes a password byte",
+                password_key()
+            );
+            let failure = "EFI_DEVICE_ERROR";
+            let cases = [
+                (
+                    "overwritten by SetData()",
+                    PasswordOverwrite::InSetData,
+                    None,
+                    Some(vec![refusal.as_str()]),
+                ),
+                (
+                    "overwritten by the read-back",
+                    PasswordOverwrite::InGetData,
+                    None,
+                    Some(vec![refusal.as_str()]),
+                ),
+                (
+                    "overwritten by a SetData() that fails",
+                    PasswordOverwrite::InSetData,
+                    Some(failure),
+                    Some(vec![refusal.as_str(), failure]),
+                ),
+                (
+                    "kept by a SetData() that fails",
+                    PasswordOverwrite::Never,
+                    Some(failure),
+                    Some(vec![failure]),
+                ),
+                ("kept", PasswordOverwrite::Never, None, None),
+            ];
+            for (name, overwrite, set_failure, want) in cases {
+                let variables = variables_with_password();
+                let handler = PasswordOverwritingHandler {
+                    inner: MemoryKeywordHandler {
+                        set_failure,
+                        ..MemoryKeywordHandler::with(&[
+                            (PATH, KEYWORD, "01"),
+                            (PATH, SECOND_KEYWORD, "01"),
+                        ])
+                    },
+                    ..overwriting(&variables, overwrite)
+                };
+
+                let set = set_keywords_witnessed(
+                    &lists,
+                    &resp(PATH, KEYWORD, "03"),
+                    IncludedStates::empty(),
+                    UnsafeOperations::Allow,
+                    VolatileWrites::Refuse,
+                    Rc::clone(&variables),
+                    &handler,
+                )
+                .map(drop);
+                let lifted = set
+                    .as_ref()
+                    .err()
+                    .and_then(|error| error.downcast_ref::<LiftedOperations>())
+                    .cloned();
+                let set = set.map_err(|error| format!("{error:#}"));
+
+                match want {
+                    Some(parts) => {
+                        assert_eq!(
+                            lifted,
+                            Some(LiftedOperations(vec![UnsafeOperation::SetupPassword])),
+                            "{name}: the unsafe operation lifted before it, kept"
+                        );
+                        let error = set.expect_err(name);
+                        for part in &parts {
+                            assert!(error.contains(part), "{name}: {part}: {error}");
+                        }
+                        assert_eq!(
+                            error.contains("password bytes"),
+                            parts.contains(&refusal.as_str()),
+                            "{name}: the refusal where the password changed only: {error}"
+                        );
+                    }
+                    None => assert_eq!(set, Ok(()), "{name}"),
+                }
+            }
+        }
+
+        #[test]
+        fn keyword_get_fails_where_get_data_changes_withheld_bytes() {
+            let lists = [list(PATH, &[questions(), password()].concat())];
+            let cases = [
+                (
+                    "overwritten by GetData()",
+                    PasswordOverwrite::InGetData,
+                    Err(format!(
+                        "GetData() changed the password bytes of EFI variable {}; they were not \
+                         restored, as uefisettings never writes a password byte",
+                        password_key()
+                    )),
+                ),
+                (
+                    "kept",
+                    PasswordOverwrite::Never,
+                    Ok(resp(PATH, KEYWORD, "01")),
+                ),
+            ];
+            for (name, overwrite, want) in cases {
+                let variables = variables_with_password();
+                let handler = overwriting(&variables, overwrite);
+
+                let got = get_keywords_witnessed(
+                    &lists,
+                    &format!("KEYWORD={KEYWORD}"),
+                    None,
+                    &[],
+                    KeywordGetOptions::default(),
+                    Rc::clone(&variables),
+                    &handler,
+                )
+                .map(|values| values.to_string())
+                .map_err(|error| format!("{error:#}"));
+
+                match want {
+                    Err(refusal) => assert!(
+                        matches!(&got, Err(error) if error.contains(&refusal)),
+                        "{name}: {got:?}"
+                    ),
+                    Ok(value) => assert_eq!(got, Ok(value), "{name}"),
+                }
+            }
+        }
+
+        #[test]
+        fn keyword_get_that_fails_still_refuses_where_get_data_changes_withheld_bytes() {
+            let lists = [list(PATH, &[questions(), password()].concat())];
+            let variables = variables_with_password();
+            let handler = PasswordOverwritingHandler {
+                inner: MemoryKeywordHandler::with(&[(PATH, KEYWORD, "01")]),
+                ..overwriting(&variables, PasswordOverwrite::InGetData)
+            };
+
+            let got = get_keywords_witnessed(
+                &lists,
+                &format!("KEYWORD={SECOND_KEYWORD}"),
+                None,
+                &[],
+                KeywordGetOptions::default(),
+                Rc::clone(&variables),
+                &handler,
+            )
+            .map(|values| values.to_string())
+            .map_err(|error| format!("{error:#}"));
+
+            let refusal = format!(
+                "GetData() changed the password bytes of EFI variable {}; they were not \
+                 restored, as uefisettings never writes a password byte",
+                password_key()
+            );
+            assert!(
+                matches!(&got, Err(error) if error.contains(&refusal) && error.contains("KEYWORD_NOT_FOUND")),
+                "the refusal beside GetData()'s own error: {got:?}"
+            );
+        }
+    }
 }
diff --git a/src/lib/hii/package.rs b/src/lib/hii/package.rs
index 21f70d6..17a4947 100644
--- a/src/lib/hii/package.rs
+++ b/src/lib/hii/package.rs
@@ -466,6 +466,8 @@ fn read_package_list(package_list: &PackageList) -> Result<ParsedPackageList> {
     let mut disabled_forms = Vec::new();
     let mut first_var_stores = Vec::new();
     let mut device_path = None;
+    // the first FORM_SET op of the list, with the index of the first root of its form package
+    let mut first_form_set = None;
 
     for package in get_packages(package_list)? {
         let mut package_cursor = Cursor::new(&package.data);
@@ -484,11 +486,15 @@ fn read_package_list(package_list: &PackageList) -> Result<ParsedPackageList> {
                     .context("failed to parse a form package")?;
                 let roots_before = roots.len();
                 let outside_before = outside_ifr.len();
+                if first_form_set.is_none() {
+                    first_form_set = form_sets.first_form_set.map(|first| (roots_before, first));
+                }
                 first_var_stores.push(forms::FirstVarStores {
                     form_sets: roots_before..roots_before + form_sets.roots.len(),
                     outside: outside_before..outside_before + form_sets.outside.len(),
                     declared_by: form_sets.first_var_stores,
                     name_value_first: form_sets.name_value_first,
+                    declared: form_sets.declared,
                 });
                 roots.extend(form_sets.roots);
                 ignored_ifr.extend(form_sets.ignored);
@@ -516,6 +522,7 @@ fn read_package_list(package_list: &PackageList) -> Result<ParsedPackageList> {
         }
     }
 
+    forms::mark_package_list_first(&roots, first_form_set);
     // the PASSWORD ops of disabled forms keep their passwords in the variables of their VarNames
     let named: Vec<IFRNodeLink> = roots
         .iter()
@@ -559,6 +566,7 @@ mod tests {
 
     use super::hiidb_fixtures::*;
     use super::*;
+    use crate::hii::config_snapshot::tests::logged_by;
     use crate::hii::forms::ifr_fixtures::form;
     use crate::hii::forms::ifr_fixtures::form_set;
     use crate::hii::forms::ifr_fixtures::nested;
@@ -567,6 +575,8 @@ mod tests {
     use crate::hii::forms::ifr_fixtures::subtitle_scope;
     use crate::hii::forms::ifr_fixtures::CHECKBOX;
     use crate::hii::forms::ifr_fixtures::END;
+    use crate::hii::forms::PackageListFirst;
+    use crate::hii::forms::ParsedOperation;
     use crate::hii::forms::MAX_SCOPE_NESTING;
     use crate::hii::scsu::tests::EDK2_LANGUAGE_WINDOW;
     use crate::hii::strings::StringMap;
@@ -1276,6 +1286,67 @@ mod tests {
         }
     }
 
+    /// read_db marks each FormSet with the FORM_SET op that its package list starts with, which
+    /// edk2-stable202608 SetupBrowserDxe/Setup.c GetIfrBinaryData takes for a Nil FormSet GUID
+    /// (:6075): the first FormSet its own, the others that one, also in a later form package, and
+    /// every FormSet one that does not parse.
+    #[test]
+    fn read_db_marks_the_form_set_that_each_package_list_starts_with() {
+        let short_checkbox = [CHECKBOX, 0x03, 0x00]; // 1 of its data bytes
+        let form_sets = |guids: &[u8]| -> Vec<u8> {
+            guids
+                .iter()
+                .flat_map(|&guid| form_set_of_guid(guid, &[]))
+                .collect()
+        };
+        let marks = |packages: Vec<Vec<u8>>| -> Vec<Option<PackageListFirst>> {
+            let hiidb = package_list_with_guid(
+                [0x22; 16],
+                &[packages.concat(), END_PACKAGE.to_vec()].concat(),
+            );
+            let lists = read_db(&hiidb).expect("read the HiiDB");
+            lists[0]
+                .forms
+                .iter()
+                .map(|root| {
+                    let form_set = Rc::clone(&root.borrow().children[0]);
+                    let form_set = form_set.borrow();
+                    match &form_set.parsed_data {
+                        ParsedOperation::FormSet(form_set) => form_set.package_list_first,
+                        other => panic!("a FORM_SET op first: {other:?}"),
+                    }
+                })
+                .collect()
+        };
+        let own = Some(PackageListFirst::Own);
+        let other = |guid: u8| Some(PackageListFirst::Other(Some(Guid::from([guid; 16]))));
+        let cases = [
+            (
+                "two FormSets of one form package",
+                vec![form_package_of(&form_sets(&[0xA0, 0xB0]))],
+                vec![own, other(0xA0)],
+            ),
+            (
+                "a FormSet in each of two form packages",
+                vec![
+                    form_package_of(&form_sets(&[0xA0])),
+                    form_package_of(&form_sets(&[0xB0, 0xC0])),
+                ],
+                vec![own, other(0xA0), other(0xA0)],
+            ),
+            (
+                "a first FormSet that does not parse",
+                vec![form_package_of(
+                    &[form_set_of_guid(0xA0, &short_checkbox), form_sets(&[0xB0])].concat(),
+                )],
+                vec![other(0xA0)],
+            ),
+        ];
+        for (name, packages, want) in cases {
+            assert_eq!(marks(packages), want, "{name}");
+        }
+    }
+
     /// read_db reads the FormSets after one that it ignores, as GetIfrBinaryData's walk finds
     /// them op by op (UEFI 2.11 §33.2.5.10.1 ignores only a malformed forms set), a FormSet in an
     /// ignored one too, with or without its Scope bit, and lists each ignored FormSet at its
@@ -2162,6 +2233,7 @@ mod tests {
         let want = [strings::StringPackage {
             language: strings::Language(b"en-\xe9".to_vec()),
             strings: StringMap::from([(1, "A".into())]),
+            replaced: Default::default(),
         }];
         assert_eq!(list.strings, want, "the strings packages");
     }
@@ -3077,6 +3149,32 @@ mod tests {
         );
     }
 
+    /// read_db reads a FontName as it reads strings, a private use character (UEFI 2.11
+    /// §33.2.6.2.1) as U+FFFD, which only its debug log shows.
+    #[test]
+    fn font_names_read_ruled_out_characters_as_replacement_characters() {
+        // FONT_1 of Length 17 with FontName "A", U+E000, then EFI_HII_SIBT_END
+        let blocks = [
+            &[0x31, 0x40, 0x11, 0x00][..],
+            &FONT_1[4..11],
+            &[0x41, 0x00, 0x00, 0xE0, 0x00, 0x00],
+            &[0x00],
+        ]
+        .concat();
+        let mut got = Vec::new();
+
+        let logged = logged_by(|| {
+            got = strings_packages_of(&[en_strings_package_with_blocks(&blocks)]);
+        });
+
+        assert_eq!(got, [(language("en"), StringMap::new())], "strings");
+        let font = format!("EFI_HII_SIBT_FONT FontId 1: {:?}, ", "A\u{FFFD}");
+        assert!(
+            logged.iter().any(|message| message.starts_with(&font)),
+            "the FontName as read: {logged:?}"
+        );
+    }
+
     /// read_db shares the text of a DUPLICATE's string with the string that it names, "a
     /// previously defined string with the exact same string text" (UEFI 2.11 §33.3.6.2.1),
     /// copying none.
@@ -3604,4 +3702,135 @@ mod tests {
             );
         }
     }
+
+    /// The string blocks of an EFI_HII_SIBT_STRING_UCS2 of the CHAR16s `units`, string 1.
+    fn ucs2_string_block(units: &[u16]) -> Vec<u8> {
+        let text: Vec<u8> = units
+            .iter()
+            .chain(&[0])
+            .flat_map(|unit| unit.to_le_bytes())
+            .collect();
+        [&[0x14][..], &text].concat()
+    }
+
+    /// read_db reads as U+FFFD each character that UEFI 2.11 rules out of a string: a surrogate,
+    /// paired or not (§33.2.6.2.2 "UEFI does not support surrogate characters"), a private use
+    /// character (§33.2.6.2.1 "UEFI prohibits use of this area") and one between 0xF000 and
+    /// 0xFCFF (§33.3.6.3.2 "should be rejected"), in UCS-2 and SCSU strings alike. It keeps the
+    /// common control codes 0xF620-0xF62B, 0xF7zz and 0xF8zz (§33.2.6.2.4, Table 33.3) and a
+    /// U+FFFD that the string holds.
+    #[test]
+    fn characters_that_uefi_rules_out_read_as_replacement_characters() {
+        let blocks = [
+            // EFI_HII_SIBT_STRING_UCS2: 1
+            &ucs2_string_block(&[
+                0x0041, 0xE000, 0xD83D, 0xDE00, 0xDC00, 0xF900, 0xF62C, 0xF620, 0xF7AB, 0xF801,
+                0xFFFD, 0x0042,
+            ])[..],
+            // EFI_HII_SIBT_STRING_SCSU of SQU U+E000, then U+0000: 2
+            &[0x10, 0x0E, 0xE0, 0x00, 0x00],
+            // EFI_HII_SIBT_END
+            &[0x00],
+        ]
+        .concat();
+
+        let want = StringMap::from([
+            (
+                1,
+                "A\u{FFFD}\u{FFFD}\u{FFFD}\u{FFFD}\u{FFFD}\u{FFFD}\u{F620}\u{F7AB}\u{F801}\u{FFFD}B"
+                    .into(),
+            ),
+            (2, "\u{FFFD}".into()),
+        ]);
+        assert_eq!(
+            strings_packages_of(&[en_strings_package_with_blocks(&blocks)]),
+            [(language("en"), want)],
+            "a surrogate pair, a lone surrogate, private use, 0xF900 and 0xF62C read as U+FFFD"
+        );
+    }
+
+    /// Each rule ends at its bounds: 0xD7FF, 0xF62B, 0xF700, 0xF8FF, 0xFD00 and 0xFDFF stay;
+    /// 0xEFFF, 0xF000, 0xF61F, 0xF6FF, 0xFBFF, 0xFC00 and 0xFCFF read as U+FFFD.
+    #[test]
+    fn rule_bounds() {
+        let blocks = [
+            &ucs2_string_block(&[
+                0xD7FF, 0xEFFF, 0xF000, 0xF61F, 0xF62B, 0xF6FF, 0xF700, 0xF8FF, 0xFBFF, 0xFC00,
+                0xFCFF, 0xFD00, 0xFDFF,
+            ])[..],
+            &[0x00],
+        ]
+        .concat();
+
+        let want = StringMap::from([(
+            1,
+            "\u{D7FF}\u{FFFD}\u{FFFD}\u{FFFD}\u{F62B}\u{FFFD}\u{F700}\u{F8FF}\u{FFFD}\u{FFFD}\
+             \u{FFFD}\u{FD00}\u{FDFF}"
+                .into(),
+        )]);
+        assert_eq!(
+            strings_packages_of(&[en_strings_package_with_blocks(&blocks)]),
+            [(language("en"), want)],
+            "rule bounds"
+        );
+    }
+
+    /// read_db reads as U+FFFD, warning once per string, the SCSU characters that UEFI 2.11 rules
+    /// out of strings, as it does those of UCS-2 strings, and reads the strings after them: SQU
+    /// 0xF000, between 0xF000 and 0xFCFF (§33.3.6.3.1) and private use (§33.2.6.2.1), SQU 0xD800,
+    /// a surrogate, and U+10000, which SDX reaches, outside UCS-2 (§33.2.6.2.2). A control code
+    /// through 0x7F stays a control code without a warning (§33.2.6.2.4); SCSU encodes control
+    /// codes through 0x7F alone, so SQU 0xF620, a control code's 0xFxyy form, is ruled out
+    /// (§33.3.6.3.1).
+    #[test]
+    fn scsu_characters_that_uefi_rules_out_read_as_replacement_characters() {
+        let blocks = [
+            // EFI_HII_SIBT_STRING_SCSU of "A", SQU U+F000, then U+0000: 1
+            &[0x10, 0x41, 0x0E, 0xF0, 0x00, 0x00][..],
+            // EFI_HII_SIBT_STRING_SCSU of SQU U+D800, then U+0000: 2
+            &[0x10, 0x0E, 0xD8, 0x00, 0x00],
+            // EFI_HII_SIBT_STRING_SCSU of SDX of window 0 at 0x10000, 0x80, then U+0000: 3
+            &[0x10, 0x0B, 0x00, 0x00, 0x80, 0x00],
+            // EFI_HII_SIBT_STRING_UCS2 "Z": 4
+            &ucs2_string_block(&[0x5A]),
+            // EFI_HII_SIBT_STRING_SCSU of 0x7F 0x20, SQU U+F620, then U+0000: 5
+            &[0x10, 0x7F, 0x20, 0x0E, 0xF6, 0x20, 0x00],
+            // EFI_HII_SIBT_END
+            &[0x00],
+        ]
+        .concat();
+        let mut got = Vec::new();
+
+        let logged = logged_by(|| {
+            got = strings_packages_of(&[en_strings_package_with_blocks(&blocks)]);
+        });
+
+        let want = StringMap::from([
+            (1, "A\u{FFFD}".into()),
+            (2, "\u{FFFD}".into()),
+            (3, "\u{FFFD}".into()),
+            (4, "Z".into()),
+            (5, "\u{F620}\u{FFFD}".into()),
+        ]);
+        assert_eq!(got, [(language("en"), want)], "strings");
+        let warnings: Vec<&str> = logged
+            .iter()
+            .map(String::as_str)
+            .filter(|message| message.ends_with("it reads as U+FFFD"))
+            .collect();
+        assert_eq!(
+            warnings,
+            [
+                "string 1 of the \"en\" strings package holds U+F000, which is in the private \
+                 use area (UEFI 2.11 §33.2.6.2.1): it reads as U+FFFD",
+                "string 2 of the \"en\" strings package holds U+D800, which is a surrogate (UEFI \
+                 2.11 §33.2.6.2.2): it reads as U+FFFD",
+                "string 3 of the \"en\" strings package holds U+10000, which is outside UCS-2 \
+                 (UEFI 2.11 §33.2.6.2.2): it reads as U+FFFD",
+                "string 5 of the \"en\" strings package holds U+F620, which is in the private \
+                 use area (UEFI 2.11 §33.2.6.2.1): it reads as U+FFFD",
+            ],
+            "warnings"
+        );
+    }
 }
diff --git a/src/lib/hii/package/hiidb_fixtures.rs b/src/lib/hii/package/hiidb_fixtures.rs
index e39fb3e..d9c21d7 100644
--- a/src/lib/hii/package/hiidb_fixtures.rs
+++ b/src/lib/hii/package/hiidb_fixtures.rs
@@ -115,7 +115,7 @@ pub(crate) fn strings_package_of(language: &[u8], strings: &[&str]) -> Vec<u8> {
 }
 
 /// An "en" strings package whose string blocks are `blocks`, valid or not.
-pub(super) fn en_strings_package_with_blocks(blocks: &[u8]) -> Vec<u8> {
+pub(crate) fn en_strings_package_with_blocks(blocks: &[u8]) -> Vec<u8> {
     strings_package_with_blocks(b"en", blocks)
 }
 
diff --git a/src/lib/hii/question_callbacks.rs b/src/lib/hii/question_callbacks.rs
new file mode 100644
index 0000000..1bdc85d
--- /dev/null
+++ b/src/lib/hii/question_callbacks.rs
@@ -0,0 +1,2522 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The value of a question without a VarStore, which only its driver keeps: get and set call the
+//! driver's EFI_HII_CONFIG_ACCESS_PROTOCOL.Callback() for that one question, with the browser
+//! actions a forms browser sends (UEFI 2.11 §35.5.4), as no forms browser runs: get sends
+//! FORM_OPEN, RETRIEVE and FORM_CLOSE; set sends FORM_OPEN, RETRIEVE, CHANGING with the new
+//! value, CHANGED and FORM_CLOSE, then reads the value back. A browser never sends SUBMITTED
+//! for a question without storage (edk2-stable202608 SetupBrowserDxe Setup.c:2690-2691), so set
+//! sends none either.
+//!
+//! Each sequence runs between two reads of the stores that the question's FormSet declares
+//! (form_set_stores.rs): a store that cannot be read refuses before the first Callback(), and a
+//! store that the Callback()s changed is restored and refuses the change, which the driver has
+//! already acted on. Every EFI variable that the sequence changed is listed too, as a
+//! Callback() may act on zeros outside the stores when the BrowserCallback() it calls fails,
+//! which nothing here can see.
+
+use std::fmt;
+
+use anyhow::Result;
+
+use crate::efi_status::EfiStatus;
+use crate::efi_variables::VariableData;
+use crate::efi_variables::VariableNames;
+use crate::exports::set_refusal;
+use crate::hii::config_routing::ConfigRouting;
+use crate::hii::form_set_stores::Baseline;
+use crate::hii::form_set_stores::FormSetStore;
+use crate::hii::form_set_stores::StoresCheck;
+use crate::hii::forms::ExpressionBesideCallback;
+pub(crate) use crate::hii::forms::IfrValueType;
+use crate::hii::forms::QuestionExpression;
+use crate::hii::forms::StoragelessRefusal;
+use crate::hii::variable_changes::DriverCode;
+use crate::hii::variable_changes::VariableChanges;
+use crate::hii::variable_changes::VariableSnapshot;
+use crate::hii::PasswordBytesRefusal;
+use crate::hii::WithholdingVariables;
+
+/// EFI_BROWSER_ACTION (UEFI 2.11 §35.5.4): what a Callback() is told happened.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[repr(usize)]
+pub(crate) enum BrowserAction {
+    Changing = 0,
+    Changed = 1,
+    Retrieve = 2,
+    FormOpen = 3,
+    FormClose = 4,
+}
+
+/// Its name without EFI_BROWSER_ACTION_, as messages write Callback(CHANGING).
+impl fmt::Display for BrowserAction {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Self::Changing => "CHANGING",
+            Self::Changed => "CHANGED",
+            Self::Retrieve => "RETRIEVE",
+            Self::FormOpen => "FORM_OPEN",
+            Self::FormClose => "FORM_CLOSE",
+        })
+    }
+}
+
+/// EFI_BROWSER_ACTION_REQUEST (UEFI 2.11 §35.5.4): what a Callback() asks the forms browser to
+/// do, a UINTN of which unknown values pass through.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct ActionRequest(pub(crate) usize);
+
+impl ActionRequest {
+    pub(crate) const NONE: Self = Self(0);
+    pub(crate) const RESET: Self = Self(1);
+    pub(crate) const SUBMIT: Self = Self(2);
+    pub(crate) const EXIT: Self = Self(3);
+    pub(crate) const FORM_SUBMIT_EXIT: Self = Self(4);
+    pub(crate) const FORM_DISCARD_EXIT: Self = Self(5);
+    pub(crate) const FORM_APPLY: Self = Self(6);
+    pub(crate) const FORM_DISCARD: Self = Self(7);
+    pub(crate) const RECONNECT: Self = Self(8);
+    pub(crate) const QUESTION_APPLY: Self = Self(9);
+
+    /// What a forms browser does for the request, as the outcome treats it.
+    fn kind(self) -> RequestKind {
+        match self {
+            Self::NONE => RequestKind::None,
+            Self::RESET => RequestKind::Reset,
+            Self::SUBMIT | Self::FORM_SUBMIT_EXIT | Self::FORM_APPLY | Self::QUESTION_APPLY => {
+                RequestKind::Save
+            }
+            Self::EXIT | Self::FORM_DISCARD_EXIT | Self::FORM_DISCARD => RequestKind::Discard,
+            Self::RECONNECT => RequestKind::Reconnect,
+            Self(_) => RequestKind::Undefined,
+        }
+    }
+}
+
+impl fmt::Display for ActionRequest {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let name = match *self {
+            Self::NONE => "NONE",
+            Self::RESET => "RESET",
+            Self::SUBMIT => "SUBMIT",
+            Self::EXIT => "EXIT",
+            Self::FORM_SUBMIT_EXIT => "FORM_SUBMIT_EXIT",
+            Self::FORM_DISCARD_EXIT => "FORM_DISCARD_EXIT",
+            Self::FORM_APPLY => "FORM_APPLY",
+            Self::FORM_DISCARD => "FORM_DISCARD",
+            Self::RECONNECT => "RECONNECT",
+            Self::QUESTION_APPLY => "QUESTION_APPLY",
+            Self(value) => return write!(f, "EFI_BROWSER_ACTION_REQUEST {value}"),
+        };
+        write!(f, "EFI_BROWSER_ACTION_REQUEST_{name}")
+    }
+}
+
+/// What a forms browser does for an ActionRequest (UEFI 2.11 §35.5.4).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum RequestKind {
+    None,
+    /// Exit and reset the platform
+    Reset,
+    /// Save modified question values to storage: SUBMIT, FORM_SUBMIT_EXIT, FORM_APPLY and
+    /// QUESTION_APPLY
+    Save,
+    /// Discard modified question values: EXIT, FORM_DISCARD_EXIT and FORM_DISCARD
+    Discard,
+    /// DisconnectController(), then ConnectController() of the driver's handle
+    Reconnect,
+    /// A value that UEFI 2.11 does not define
+    Undefined,
+}
+
+/// The Type and Value of a Callback(): a number in the bits that `value_type` uses.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct IfrValue {
+    pub(crate) value_type: IfrValueType,
+    pub(crate) value: u64,
+}
+
+impl IfrValue {
+    /// The value as EFI_IFR_TYPE_VALUE holds it: little-endian in its first bytes, the rest
+    /// zero; 24 bytes hold the union's largest member, EFI_HII_REF, with alignment.
+    pub(crate) fn to_union(self) -> [u64; 3] {
+        [(self.value & self.value_type.mask()).to_le(), 0, 0]
+    }
+
+    /// The value of this type that `union` holds, as a Callback() left it.
+    pub(crate) fn from_union(value_type: IfrValueType, union: &[u64; 3]) -> Self {
+        Self {
+            value_type,
+            value: u64::from_le(union[0]) & value_type.mask(),
+        }
+    }
+}
+
+/// What a Callback() returned.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct CallbackReturn {
+    pub(crate) status: EfiStatus,
+    pub(crate) request: ActionRequest,
+}
+
+/// The driver that owns a FormSet: its EFI_HII_CONFIG_ACCESS_PROTOCOL.Callback(), and the
+/// reconnection of its handle that EFI_BROWSER_ACTION_REQUEST_RECONNECT asks for.
+pub(crate) trait DriverCallback {
+    /// Callback(`action`) of the question `question_id` with `value`, which it may change.
+    fn callback(
+        &self,
+        action: BrowserAction,
+        question_id: u16,
+        value: &mut IfrValue,
+    ) -> CallbackReturn;
+
+    /// DisconnectController(), then ConnectController() of the handle that has the protocol.
+    fn reconnect(&self) -> Result<(), EfiStatus>;
+}
+
+/// The question that a sequence calls the driver for.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct DriverQuestion {
+    pub(crate) question_id: u16,
+    /// Its value before the driver's: its IFR standard default, else 0, as a forms browser
+    /// starts a question without storage (edk2-stable202608 SetupBrowserDxe Setup.c:5956)
+    pub(crate) initial: IfrValue,
+    /// Whether the FormSet declares any store, which a save request would write
+    pub(crate) form_set_has_stores: bool,
+    /// Whether a forms browser evaluates a READ (get) or WRITE (set) expression of it beside
+    /// the Callback()s, which uefisettings does not
+    pub(crate) read_expression: bool,
+    pub(crate) write_expression: bool,
+}
+
+/// What the sequence reads and writes besides the driver: the FormSet's stores and the EFI
+/// variables, without the bytes of PASSWORD questions.
+pub(crate) struct FormSetAccess<'a, R, V> {
+    pub(crate) stores: Vec<FormSetStore>,
+    pub(crate) routing: &'a R,
+    pub(crate) variables: &'a WithholdingVariables<V>,
+}
+
+/// One Callback() of a sequence, as logs and outcomes list it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct Call {
+    pub(crate) action: BrowserAction,
+    pub(crate) value: IfrValue,
+    pub(crate) returned: CallbackReturn,
+}
+
+/// The Callback()s of one sequence, which sends FORM_CLOSE once FORM_OPEN was sent, unless
+/// RETRIEVE failed with an error other than EFI_UNSUPPORTED.
+struct Sequence<'a, D> {
+    driver: &'a D,
+    question: DriverQuestion,
+    calls: Vec<Call>,
+}
+
+impl<'a, D: DriverCallback> Sequence<'a, D> {
+    fn new(driver: &'a D, question: DriverQuestion) -> Self {
+        Self {
+            driver,
+            question,
+            calls: Vec::new(),
+        }
+    }
+
+    /// Callback(`action`) with `value`, which it updates as the driver left it.
+    fn call(&mut self, action: BrowserAction, value: &mut IfrValue) -> CallbackReturn {
+        let returned = self
+            .driver
+            .callback(action, self.question.question_id, value);
+        self.calls.push(Call {
+            action,
+            value: *value,
+            returned,
+        });
+        returned
+    }
+
+    /// FORM_OPEN, RETRIEVE, FORM_CLOSE with `value`; the value that RETRIEVE gave, or its
+    /// status.
+    fn retrieve(&mut self, value: IfrValue) -> Result<IfrValue, EfiStatus> {
+        let mut open = value;
+        self.call(BrowserAction::FormOpen, &mut open);
+        let mut retrieved = value;
+        let status = self.call(BrowserAction::Retrieve, &mut retrieved).status;
+        // FORM_CLOSE carries the value the question now has
+        let (mut close, retrieval) = match status {
+            EfiStatus::SUCCESS => (retrieved, Ok(retrieved)),
+            EfiStatus::UNSUPPORTED => (value, Err(EfiStatus::UNSUPPORTED)),
+            // FORM_CLOSE follows a form's submit actions (UEFI 2.11 §35.5.4), which a form that a
+            // failed RETRIEVE ends never reaches: edk2-stable202608 SetupBrowserDxe Presentation.c
+            // goes to Done (:2575-2577, :2716), past FORM_CLOSE, unless the error is
+            // EFI_UNSUPPORTED, which it counts as success (:2281-2285)
+            status => return Err(status),
+        };
+        self.call(BrowserAction::FormClose, &mut close);
+        retrieval
+    }
+
+    /// Why the outcome is refused, from the ActionRequests so far, if any asks what no forms
+    /// browser here does: a save of the FormSet's stores, which only a browser's edit buffer
+    /// holds, or a value that UEFI 2.11 does not define.
+    fn request_refusal(&self) -> Option<String> {
+        self.calls.iter().find_map(|call| {
+            let request = call.returned.request;
+            match request.kind() {
+                RequestKind::Save if self.question.form_set_has_stores => Some(format!(
+                    "Callback({}) asked the forms browser to save the FormSet's modified values \
+                     ({request}), which only a forms browser's edit buffer holds",
+                    call.action
+                )),
+                RequestKind::Undefined => Some(format!(
+                    "Callback({}) returned {request}, which UEFI 2.11 section 35.5.4 does not \
+                     define",
+                    call.action
+                )),
+                RequestKind::None
+                | RequestKind::Save
+                | RequestKind::Reset
+                | RequestKind::Discard
+                | RequestKind::Reconnect => None,
+            }
+        })
+    }
+
+    /// The notes of the ActionRequests that ask for a reset or a discard.
+    fn request_notes(&self) -> Vec<String> {
+        self.calls
+            .iter()
+            .filter_map(|call| {
+                let request = call.returned.request;
+                match request.kind() {
+                    RequestKind::Reset => Some(format!(
+                        "Callback({}) asks for a platform reset ({request})",
+                        call.action
+                    )),
+                    RequestKind::Discard => Some(format!(
+                        "Callback({}) asked the forms browser to discard modified values \
+                         ({request}); outside a forms browser none are pending",
+                        call.action
+                    )),
+                    RequestKind::None
+                    | RequestKind::Save
+                    | RequestKind::Reconnect
+                    | RequestKind::Undefined => None,
+                }
+            })
+            .collect()
+    }
+
+    /// Whether a Callback() asked for EFI_BROWSER_ACTION_REQUEST_RECONNECT.
+    fn reconnect_requested(&self) -> bool {
+        self.calls
+            .iter()
+            .any(|call| call.returned.request.kind() == RequestKind::Reconnect)
+    }
+
+    /// Whether any Callback() ran: the stores' baseline was read before.
+    fn ran(&self) -> bool {
+        !self.calls.is_empty()
+    }
+}
+
+/// get's outcome for a question without a VarStore.
+#[derive(Debug)]
+pub(crate) struct Retrieval {
+    /// The value RETRIEVE gave, or why there is none
+    pub(crate) value: Result<IfrValue, String>,
+    /// Whether driver code changed password bytes, or they could not be compared across it
+    pub(crate) password_refused: bool,
+    /// Notes on ActionRequests, settings left out and changed variables, each a phrase
+    pub(crate) notes: Vec<String>,
+    pub(crate) calls: Vec<Call>,
+}
+
+/// set's outcome for a question without a VarStore.
+#[derive(Debug)]
+pub(crate) struct Change {
+    pub(crate) outcome: ChangeOutcome,
+    /// Whether driver code changed password bytes, or they could not be compared across it
+    pub(crate) password_refused: bool,
+    /// Notes on ActionRequests, the reconnection, settings left out and changed variables,
+    /// each a phrase
+    pub(crate) notes: Vec<String>,
+    pub(crate) calls: Vec<Call>,
+}
+
+/// Whether set applied the value.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum ChangeOutcome {
+    /// CHANGING and CHANGED took the value, and the stores stayed; then the read-back
+    Applied(ReadBack),
+    /// No Callback() ran: why
+    Refused(String),
+    /// The driver ran Callback()s but the change is refused: why, and the last action sent
+    NotApplied {
+        reason: String,
+        last_action: BrowserAction,
+    },
+    /// Applied, with the read-back; then the reconnection that a Callback() asked for did what
+    /// refuses it: why
+    AppliedThenRefused { read_back: ReadBack, reason: String },
+}
+
+/// What the read-back after an applied change gave.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum ReadBack {
+    /// RETRIEVE gave the value set
+    Same,
+    /// RETRIEVE gave another value, as a driver that resets a transient value does
+    Other(IfrValue),
+    /// RETRIEVE returned EFI_UNSUPPORTED
+    NotOffered,
+    /// RETRIEVE returned another error
+    Failed(EfiStatus),
+}
+
+impl ChangeOutcome {
+    /// The outcome in words, each value as `show` writes it.
+    pub(crate) fn text(&self, show: impl Fn(IfrValue) -> String) -> String {
+        match self {
+            Self::Applied(read_back) => read_back.applied(show),
+            Self::AppliedThenRefused { read_back, reason } => {
+                format!("{}; then {reason}", read_back.applied(show))
+            }
+            Self::Refused(reason) => reason.clone(),
+            Self::NotApplied {
+                reason,
+                last_action,
+            } => format!(
+                "not applied: {reason}; the driver's Callback({last_action}) had already run, and \
+                 any effect outside the FormSet's stores stays"
+            ),
+        }
+    }
+}
+
+impl ReadBack {
+    /// An applied change with this read-back in words, each value as `show` writes it.
+    fn applied(&self, show: impl Fn(IfrValue) -> String) -> String {
+        match self {
+            Self::Same => "applied".to_string(),
+            Self::Other(value) => format!("applied; the driver now reports {}", show(*value)),
+            Self::NotOffered => "applied; the driver offers no read-back".to_string(),
+            Self::Failed(status) => {
+                format!("applied; the driver's read-back Callback(RETRIEVE) returned {status}")
+            }
+        }
+    }
+}
+
+impl Retrieval {
+    /// get's answer for `question`, its value as `show` writes it, with the notes; get fails where
+    /// driver code changed password bytes.
+    pub(crate) fn answer(
+        self,
+        question: &str,
+        show: impl Fn(IfrValue) -> String,
+    ) -> Result<String> {
+        let mut answer = match self.value {
+            Ok(value) => show(value),
+            Err(reason) if self.password_refused => {
+                return Err(PasswordBytesRefusal(format!(
+                    "cannot get question {question:?}: {reason}"
+                ))
+                .into())
+            }
+            Err(reason) => format!("<ValueUnavailable: {reason}>"),
+        };
+        for note in self.notes {
+            answer.push_str(&format!(" <{note}>"));
+        }
+        Ok(answer)
+    }
+}
+
+impl Change {
+    /// set's annotation of `question` where the change applied, each value as `show` writes it;
+    /// else set's refusal, a PasswordBytesRefusal where driver code changed password bytes.
+    pub(crate) fn annotation(
+        self,
+        question: &str,
+        show: impl Fn(IfrValue) -> String,
+    ) -> Result<String> {
+        let outcome = self.outcome.text(show);
+        let text = [outcome]
+            .into_iter()
+            .chain(self.notes)
+            .collect::<Vec<_>>()
+            .join("; ");
+        match (self.outcome, self.password_refused) {
+            (_, true) => Err(PasswordBytesRefusal(set_refusal(question, text).to_string()).into()),
+            (ChangeOutcome::Applied(_), false) => Ok(format!(" <{text}>")),
+            (
+                ChangeOutcome::Refused(_)
+                | ChangeOutcome::NotApplied { .. }
+                | ChangeOutcome::AppliedThenRefused { .. },
+                false,
+            ) => Err(set_refusal(question, text)),
+        }
+    }
+}
+
+/// Runs get's sequence for `question`: FORM_OPEN, RETRIEVE, FORM_CLOSE, between the reads of
+/// the FormSet's stores.
+pub(crate) fn retrieve<D, R, V>(
+    driver: &D,
+    question: DriverQuestion,
+    access: FormSetAccess<'_, R, V>,
+) -> Retrieval
+where
+    D: DriverCallback,
+    R: ConfigRouting,
+    V: VariableData + VariableNames,
+{
+    let FormSetAccess {
+        stores,
+        routing,
+        variables,
+    } = access;
+    let (before, baseline) = match snapshots(stores, routing, variables) {
+        Ok(snapshots) => snapshots,
+        Err(refusal) => {
+            return Retrieval {
+                value: Err(refusal.reason),
+                password_refused: refusal.password_refused,
+                notes: Vec::new(),
+                calls: Vec::new(),
+            }
+        }
+    };
+    let mut sequence = Sequence::new(driver, question);
+    let retrieved = sequence.retrieve(question.initial);
+    let check = baseline.check(routing, variables);
+    let changes = before.changes(variables);
+    let password_refused = changes.refusal(DriverCode::CallbackSequence).is_some();
+    let mut notes = sequence.request_notes();
+    notes.extend(dynamic_note(&baseline));
+    notes.extend(variable_note(&changes.listed));
+    let value = match (
+        effect_refusal(&check, &changes),
+        sequence.request_refusal(),
+        retrieved,
+    ) {
+        (Some(reason), _, _) | (None, Some(reason), _) => Err(reason),
+        (None, None, Ok(value)) => Ok(value),
+        // without RETRIEVE's value, a forms browser keeps READ's
+        (None, None, Err(status)) => Err(match question.read_expression {
+            true => ExpressionBesideCallback(QuestionExpression::Read).to_string(),
+            false => StoragelessRefusal::RetrieveFailed {
+                status: status.to_string(),
+            }
+            .to_string(),
+        }),
+    };
+    Retrieval {
+        value,
+        password_refused,
+        notes,
+        calls: sequence.calls,
+    }
+}
+
+/// Runs set's sequence for `question` with `new_value`: FORM_OPEN, RETRIEVE, CHANGING, CHANGED,
+/// FORM_CLOSE, then FORM_OPEN, RETRIEVE, FORM_CLOSE to read the value back, between the reads
+/// of the FormSet's stores; then the reconnection, if a Callback() asked for one, across which
+/// the EFI variables are compared again.
+pub(crate) fn change<D, R, V>(
+    driver: &D,
+    question: DriverQuestion,
+    new_value: IfrValue,
+    access: FormSetAccess<'_, R, V>,
+) -> Change
+where
+    D: DriverCallback,
+    R: ConfigRouting,
+    V: VariableData + VariableNames,
+{
+    // a forms browser evaluates WRITE in SetQuestionValue() once CHANGING has taken the value,
+    // before CHANGED (edk2-stable202608 SetupBrowserDxe Presentation.c
+    // ProcessCallBackFunction, Setup.c SetQuestionValue)
+    if question.write_expression {
+        return refused(NoCallback {
+            reason: ExpressionBesideCallback(QuestionExpression::Write).to_string(),
+            password_refused: false,
+        });
+    }
+    let FormSetAccess {
+        stores,
+        routing,
+        variables,
+    } = access;
+    let (before, baseline) = match snapshots(stores, routing, variables) {
+        Ok(snapshots) => snapshots,
+        Err(refusal) => return refused(refusal),
+    };
+    let mut sequence = Sequence::new(driver, question);
+    let sent = send_change(&mut sequence, new_value);
+    let check = baseline.check(routing, variables);
+    let changes = before.changes(variables);
+    let mut outcome = change_outcome(&sequence, sent, effect_refusal(&check, &changes));
+    let mut password_refused = changes.refusal(DriverCode::CallbackSequence).is_some();
+    let mut listed = changes.listed;
+
+    let mut notes = sequence.request_notes();
+    if let (ChangeOutcome::Applied(read_back), true) = (&outcome, sequence.reconnect_requested()) {
+        notes.push(match driver.reconnect() {
+            Ok(()) => format!(
+                "reconnected the driver's controller ({})",
+                ActionRequest::RECONNECT
+            ),
+            Err(status) => format!(
+                "the reconnection that {} asks for failed: {status}",
+                ActionRequest::RECONNECT
+            ),
+        });
+        // a failed reconnection may have run driver code too; against the same snapshot, the
+        // listing holds the writes of both
+        let reconnected = before.changes(variables);
+        if let Some(reason) = reconnected.refusal(DriverCode::Reconnection) {
+            outcome = ChangeOutcome::AppliedThenRefused {
+                read_back: read_back.clone(),
+                reason,
+            };
+            password_refused = true;
+        }
+        listed = reconnected.listed;
+    }
+    notes.extend(dynamic_note(&baseline));
+    notes.extend(variable_note(&listed));
+    Change {
+        outcome,
+        password_refused,
+        notes,
+        calls: sequence.calls,
+    }
+}
+
+/// Why no Callback() runs.
+struct NoCallback {
+    reason: String,
+    /// Whether driver code changed password bytes, or they could not be compared across it
+    password_refused: bool,
+}
+
+/// The variables and the stores before the first Callback(), which the sequence compares
+/// against; or why no Callback() runs, with the password bytes compared across the stores'
+/// reads that ran, as ExtractConfig() is driver code.
+fn snapshots<R, V>(
+    stores: Vec<FormSetStore>,
+    routing: &R,
+    variables: &WithholdingVariables<V>,
+) -> Result<(VariableSnapshot, Baseline), NoCallback>
+where
+    R: ConfigRouting,
+    V: VariableData + VariableNames,
+{
+    let before =
+        VariableSnapshot::take(variables, DriverCode::CallbackSequence).map_err(|reason| {
+            NoCallback {
+                reason,
+                password_refused: false,
+            }
+        })?;
+    match Baseline::take(stores, routing, variables) {
+        Ok(baseline) => Ok((before, baseline)),
+        Err(refusal) => {
+            let changed = before
+                .changes(variables)
+                .refusal(DriverCode::CallbackSequence);
+            let password_refused = changed.is_some();
+            let reasons: Vec<String> = [refusal.to_string()].into_iter().chain(changed).collect();
+            Err(NoCallback {
+                reason: reasons.join("; "),
+                password_refused,
+            })
+        }
+    }
+}
+
+/// Why the effects of the Callback()s refuse get's value or set's change, if they do: changed
+/// stores, then changed or unreadable password bytes of variables.
+fn effect_refusal(check: &StoresCheck, changes: &VariableChanges) -> Option<String> {
+    let reasons: Vec<String> = check
+        .refusal()
+        .into_iter()
+        .chain(changes.refusal(DriverCode::CallbackSequence))
+        .collect();
+    (!reasons.is_empty()).then(|| reasons.join("; "))
+}
+
+/// set's outcome when no Callback() ran.
+fn refused(refusal: NoCallback) -> Change {
+    Change {
+        outcome: ChangeOutcome::Refused(refusal.reason),
+        password_refused: refusal.password_refused,
+        notes: Vec::new(),
+        calls: Vec::new(),
+    }
+}
+
+/// What send_change saw: how RETRIEVE, CHANGING and CHANGED ended, and the read-back.
+enum Sent {
+    /// RETRIEVE failed with this status, which is not EFI_UNSUPPORTED, so nothing followed
+    RetrieveFailed(EfiStatus),
+    /// CHANGING failed with this status, so CHANGED was not sent
+    ChangingRefused(EfiStatus),
+    /// CHANGED failed with this status
+    ChangedFailed(EfiStatus),
+    /// Both took the value: the read-back
+    Taken(ReadBack),
+}
+
+/// The Callback()s of set: FORM_OPEN, RETRIEVE, then unless RETRIEVE failed with an error other
+/// than EFI_UNSUPPORTED, CHANGING, CHANGED unless CHANGING failed, FORM_CLOSE, then the read-back
+/// if both took the value.
+fn send_change<D: DriverCallback>(sequence: &mut Sequence<'_, D>, new_value: IfrValue) -> Sent {
+    let mut value = sequence.question.initial;
+    sequence.call(BrowserAction::FormOpen, &mut value);
+    let mut retrieved = value;
+    match sequence
+        .call(BrowserAction::Retrieve, &mut retrieved)
+        .status
+    {
+        EfiStatus::SUCCESS => value = retrieved,
+        EfiStatus::UNSUPPORTED => {}
+        // the form ends before it shows, as in Sequence::retrieve
+        status => return Sent::RetrieveFailed(status),
+    }
+
+    // EFI_SUCCESS: the browser uses the value returned; EFI_UNSUPPORTED: the value passed; any
+    // other error: it does not update the value (UEFI 2.11 §35.5.4)
+    let mut changing = new_value;
+    let sent = match sequence.call(BrowserAction::Changing, &mut changing).status {
+        EfiStatus::SUCCESS => Ok(changing),
+        EfiStatus::UNSUPPORTED => Ok(new_value),
+        status => Err(Sent::ChangingRefused(status)),
+    };
+    let sent = sent.and_then(|mut changed| {
+        let status = sequence.call(BrowserAction::Changed, &mut changed).status;
+        value = changed;
+        // a browser ignores CHANGED's errors, but for a question without storage CHANGED is
+        // where the driver applies the value
+        match status {
+            EfiStatus::SUCCESS | EfiStatus::UNSUPPORTED => Ok(changed),
+            status => Err(Sent::ChangedFailed(status)),
+        }
+    });
+    sequence.call(BrowserAction::FormClose, &mut value);
+    match sent {
+        Ok(set) => Sent::Taken(match sequence.retrieve(set) {
+            Ok(read) if read.value == set.value => ReadBack::Same,
+            Ok(read) => ReadBack::Other(read),
+            Err(EfiStatus::UNSUPPORTED) => ReadBack::NotOffered,
+            Err(status) => ReadBack::Failed(status),
+        }),
+        Err(sent) => sent,
+    }
+}
+
+/// set's outcome from what the Callback()s did and why their effects refuse it (effect_refusal).
+fn change_outcome<D: DriverCallback>(
+    sequence: &Sequence<'_, D>,
+    sent: Sent,
+    effect_refusal: Option<String>,
+) -> ChangeOutcome {
+    let last_action = sequence
+        .calls
+        .last()
+        .map_or(BrowserAction::FormClose, |call| call.action);
+    let reason = match (effect_refusal, sequence.request_refusal(), sent) {
+        (Some(reason), _, _) | (None, Some(reason), _) => reason,
+        (None, None, Sent::RetrieveFailed(status)) => format!(
+            "its driver's CallBack(EFI_BROWSER_ACTION_RETRIEVE) returned {status}, which ends a \
+             forms browser's form before it takes a value"
+        ),
+        (None, None, Sent::ChangingRefused(status)) => StoragelessRefusal::ChangingRefused {
+            status: status.to_string(),
+        }
+        .to_string(),
+        (None, None, Sent::ChangedFailed(status)) => {
+            format!("Callback(CHANGED) returned {status}")
+        }
+        (None, None, Sent::Taken(read_back)) => return ChangeOutcome::Applied(read_back),
+    };
+    debug_assert!(
+        sequence.ran(),
+        "a refusal after the baseline follows a Callback()"
+    );
+    ChangeOutcome::NotApplied {
+        reason,
+        last_action,
+    }
+}
+
+/// The note listing the settings of the stores that the check left out, if any.
+fn dynamic_note(baseline: &Baseline) -> Option<String> {
+    let dynamic = baseline.dynamic();
+    (!dynamic.is_empty()).then(|| {
+        format!(
+            "not compared, as they changed between two reads before the first Callback(): {}",
+            dynamic.join(", ")
+        )
+    })
+}
+
+/// The note listing the changed EFI variables `listed` (VariableChanges::listed), if any.
+fn variable_note(listed: &[String]) -> Option<String> {
+    (!listed.is_empty()).then(|| format!("EFI variables changed: {}", listed.join(", ")))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::Cell;
+    use std::cell::RefCell;
+    use std::collections::VecDeque;
+    use std::ops::Range;
+
+    use super::*;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::tests::NV_BS_RT;
+    use crate::efi_variables::VariableContents;
+    use crate::hii::config_routing::ConfigRoutingError;
+    use crate::hii::config_string::ConfigRequest;
+    use crate::hii::config_string::ConfigResp;
+    use crate::hii::config_string::MultiConfigAltResp;
+    use crate::hii::form_set_stores::tests::buffer_declaration;
+    use crate::hii::form_set_stores::tests::efi_declaration;
+    use crate::hii::form_set_stores::tests::header_of;
+    use crate::hii::form_set_stores::tests::store;
+    use crate::hii::form_set_stores::tests::FakeRouting;
+    use crate::hii::form_set_stores::tests::STORE_GUID;
+    use crate::hii::forms::StoreDeclaration;
+    use crate::hii::variables::WithheldBytes;
+    use crate::hii::variables::WithholdingVariables;
+    use crate::hii::VariableAttributes;
+
+    const QUESTION: u16 = 0x0201;
+    const U8: IfrValueType = IfrValueType::NumSize8;
+
+    /// What a scripted Callback() does: return this, after setting the value to `writes` and
+    /// running `effect`.
+    #[derive(Clone, Copy)]
+    struct Step {
+        status: EfiStatus,
+        request: ActionRequest,
+        writes: Option<u64>,
+        effect: Effect,
+    }
+
+    #[derive(Clone, Copy, PartialEq)]
+    enum Effect {
+        None,
+        /// writes byte 0 of the Buffer store
+        Buffer,
+        /// writes the EFI variable store
+        Variable,
+        /// writes bytes 1 and 2 of the EFI variable store, keeping its size
+        Password,
+        /// writes a variable outside the stores
+        Outside,
+    }
+
+    fn step(status: EfiStatus) -> Step {
+        Step {
+            status,
+            request: ActionRequest::NONE,
+            writes: None,
+            effect: Effect::None,
+        }
+    }
+
+    /// A driver whose Callback() follows a script per action, EFI_SUCCESS after it ends, and
+    /// logs each call; it writes the stores of `routing` and `variables` as told.
+    struct ScriptedDriver<'a> {
+        script: RefCell<Vec<(BrowserAction, VecDeque<Step>)>>,
+        log: RefCell<Vec<(BrowserAction, u16, u64)>>,
+        routing: &'a FakeRouting,
+        variables: &'a HeldVariables,
+        reconnects: RefCell<usize>,
+        reconnect_status: Option<EfiStatus>,
+        reconnect_effect: Effect,
+    }
+
+    impl<'a> ScriptedDriver<'a> {
+        fn new(routing: &'a FakeRouting, variables: &'a HeldVariables) -> Self {
+            Self {
+                script: RefCell::new(Vec::new()),
+                log: RefCell::new(Vec::new()),
+                routing,
+                variables,
+                reconnects: RefCell::new(0),
+                reconnect_status: None,
+                reconnect_effect: Effect::None,
+            }
+        }
+
+        fn on(self, action: BrowserAction, step: Step) -> Self {
+            {
+                let mut script = self.script.borrow_mut();
+                match script.iter_mut().find(|(each, _)| *each == action) {
+                    Some((_, steps)) => steps.push_back(step),
+                    None => script.push((action, VecDeque::from([step]))),
+                }
+            }
+            self
+        }
+
+        fn actions(&self) -> Vec<BrowserAction> {
+            self.log
+                .borrow()
+                .iter()
+                .map(|(action, _, _)| *action)
+                .collect()
+        }
+    }
+
+    impl DriverCallback for ScriptedDriver<'_> {
+        fn callback(
+            &self,
+            action: BrowserAction,
+            question_id: u16,
+            value: &mut IfrValue,
+        ) -> CallbackReturn {
+            self.log
+                .borrow_mut()
+                .push((action, question_id, value.value));
+            let step = self
+                .script
+                .borrow_mut()
+                .iter_mut()
+                .find(|(each, _)| *each == action)
+                .and_then(|(_, steps)| steps.pop_front())
+                .unwrap_or(step(EfiStatus::SUCCESS));
+            if let Some(written) = step.writes {
+                value.value = written;
+            }
+            self.run(step.effect);
+            CallbackReturn {
+                status: step.status,
+                request: step.request,
+            }
+        }
+
+        fn reconnect(&self) -> Result<(), EfiStatus> {
+            *self.reconnects.borrow_mut() += 1;
+            self.run(self.reconnect_effect);
+            self.reconnect_status.map_or(Ok(()), Err)
+        }
+    }
+
+    impl ScriptedDriver<'_> {
+        /// Runs `effect` on the stores of `routing` and `variables`.
+        fn run(&self, effect: Effect) {
+            match effect {
+                Effect::None => {}
+                Effect::Buffer => {
+                    let header = self
+                        .routing
+                        .buffers
+                        .borrow()
+                        .keys()
+                        .next()
+                        .cloned()
+                        .expect("a buffer");
+                    self.routing
+                        .buffers
+                        .borrow_mut()
+                        .get_mut(&header)
+                        .expect("buffer")[0] = 0xEE;
+                }
+                Effect::Variable => {
+                    self.variables.variables.borrow_mut().insert(
+                        key("Store", STORE_GUID),
+                        VariableContents::new(NV_BS_RT, vec![1, 2]).expect("data"),
+                    );
+                }
+                Effect::Password => overwrite_store_password(self.variables),
+                Effect::Outside => {
+                    self.variables.variables.borrow_mut().insert(
+                        key("Elsewhere", STORE_GUID),
+                        VariableContents::new(NV_BS_RT, vec![7]).expect("data"),
+                    );
+                }
+            }
+        }
+    }
+
+    /// Writes bytes 1 and 2 of the EFI variable store of `variables`, keeping its size.
+    fn overwrite_store_password(variables: &HeldVariables) {
+        variables.variables.borrow_mut().insert(
+            key("Store", STORE_GUID),
+            VariableContents::new(NV_BS_RT, vec![0x5A, 0xA5, 0xA5, 0x5A]).expect("data"),
+        );
+    }
+
+    struct Fixture {
+        routing: FakeRouting,
+        variables: HeldVariables,
+        stores: Vec<FormSetStore>,
+    }
+
+    /// A FormSet with a 2-byte Buffer store and an EFI variable store.
+    fn fixture() -> Fixture {
+        let stores = vec![
+            store(&buffer_declaration(2, "Buffer", &[(0, 2)])),
+            store(&efi_declaration(1, "Store")),
+        ];
+        let routing = FakeRouting::default().with_buffer(&header_of(&stores[0]), &[0xA5, 0xA5]);
+        let variables = HeldVariables::default().with("Store", STORE_GUID, &[0x5A; 4]);
+        Fixture {
+            routing,
+            variables,
+            stores,
+        }
+    }
+
+    fn question(has_stores: bool) -> DriverQuestion {
+        DriverQuestion {
+            question_id: QUESTION,
+            initial: IfrValue {
+                value_type: U8,
+                value: 0,
+            },
+            form_set_has_stores: has_stores,
+            read_expression: false,
+            write_expression: false,
+        }
+    }
+
+    /// The stores and routing of `fixture`, with `variables`, its variables as withheld.
+    fn access<'a>(
+        fixture: &'a Fixture,
+        variables: &'a WithholdingVariables<&'a HeldVariables>,
+    ) -> FormSetAccess<'a, FakeRouting, &'a HeldVariables> {
+        FormSetAccess {
+            stores: fixture.stores.clone(),
+            routing: &fixture.routing,
+            variables,
+        }
+    }
+
+    /// The variables of `fixture` with no byte withheld.
+    fn nothing_withheld(fixture: &Fixture) -> WithholdingVariables<&HeldVariables> {
+        WithholdingVariables::new(&fixture.variables, WithheldBytes::default())
+    }
+
+    fn value(value: u64) -> IfrValue {
+        IfrValue {
+            value_type: U8,
+            value,
+        }
+    }
+
+    fn get(driver: &ScriptedDriver<'_>, fixture: &Fixture, question: DriverQuestion) -> Retrieval {
+        retrieve(
+            driver,
+            question,
+            access(fixture, &nothing_withheld(fixture)),
+        )
+    }
+
+    fn set_of(
+        driver: &ScriptedDriver<'_>,
+        fixture: &Fixture,
+        question: DriverQuestion,
+        new: u64,
+    ) -> Change {
+        let variables = nothing_withheld(fixture);
+        change(driver, question, value(new), access(fixture, &variables))
+    }
+
+    fn set(driver: &ScriptedDriver<'_>, fixture: &Fixture, new: u64) -> Change {
+        set_of(driver, fixture, question(true), new)
+    }
+
+    /// A value as the tests show it: its number.
+    fn show(value: IfrValue) -> String {
+        value.value.to_string()
+    }
+
+    use BrowserAction::Changed;
+    use BrowserAction::Changing;
+    use BrowserAction::FormClose;
+    use BrowserAction::FormOpen;
+    use BrowserAction::Retrieve;
+
+    #[test]
+    fn get_sends_form_open_retrieve_form_close_and_gives_the_value() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Retrieve,
+            Step {
+                writes: Some(2),
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+
+        let got = get(&driver, &fixture, question(true));
+
+        assert_eq!(got.value, Ok(value(2)), "RETRIEVE's value: {got:?}");
+        assert_eq!(
+            *driver.log.borrow(),
+            [
+                (FormOpen, QUESTION, 0),
+                (Retrieve, QUESTION, 0),
+                (FormClose, QUESTION, 2)
+            ],
+            "the calls, each for the question, FORM_CLOSE with the retrieved value"
+        );
+    }
+
+    #[test]
+    fn get_without_retrieve_has_no_value() {
+        let fixture = fixture();
+        // a forms browser counts EFI_UNSUPPORTED as success and closes the form; any other error
+        // ends the form before its FORM_CLOSE
+        let cases = [
+            (
+                EfiStatus::UNSUPPORTED,
+                "its driver's CallBack(EFI_BROWSER_ACTION_RETRIEVE) returned EFI_UNSUPPORTED; \
+                 without a VarStore the question has no other value (UEFI 2.11 §33.2.5.4.1)",
+                &[FormOpen, Retrieve, FormClose][..],
+            ),
+            (
+                EfiStatus::DEVICE_ERROR,
+                "its driver's CallBack(EFI_BROWSER_ACTION_RETRIEVE) returned EFI_DEVICE_ERROR; \
+                 without a VarStore the question has no other value (UEFI 2.11 §33.2.5.4.1)",
+                &[FormOpen, Retrieve],
+            ),
+        ];
+        for (status, want, want_actions) in cases {
+            let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+                .on(Retrieve, step(status));
+            let got = get(&driver, &fixture, question(true));
+            assert_eq!(
+                got.value,
+                Err(want.to_string()),
+                "RETRIEVE returns {status}"
+            );
+            assert_eq!(
+                driver.actions(),
+                want_actions,
+                "the calls when RETRIEVE returns {status}"
+            );
+        }
+    }
+
+    #[test]
+    fn get_with_a_read_expression_takes_retrieve_or_says_read_is_not_applied() {
+        let fixture = fixture();
+        let with_read = DriverQuestion {
+            read_expression: true,
+            ..question(true)
+        };
+        let retrieved = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Retrieve,
+            Step {
+                writes: Some(2),
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+        let unsupported = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+            .on(Retrieve, step(EfiStatus::UNSUPPORTED));
+
+        let got = get(&retrieved, &fixture, with_read);
+        let missing = get(&unsupported, &fixture, with_read);
+
+        assert_eq!(got.value, Ok(value(2)), "RETRIEVE overrides READ");
+        assert_eq!(
+            missing.value,
+            Err(
+                "question has no VarStore, and uefisettings does not apply its READ expression \
+                 beside its driver's Callback()s"
+                    .to_string()
+            ),
+            "without RETRIEVE's value, READ's would stand"
+        );
+    }
+
+    #[test]
+    fn get_whose_retrieve_writes_a_store_gives_no_value_and_restores() {
+        let cases = [
+            (Effect::Buffer, "VARSTORE 0x0002 Buffer".to_string()),
+            (
+                Effect::Variable,
+                format!("VARSTORE_EFI 0x0001 {}", key("Store", STORE_GUID)),
+            ),
+        ];
+        for (effect, store) in cases {
+            let fixture = fixture();
+            let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+                Retrieve,
+                Step {
+                    writes: Some(1),
+                    effect,
+                    ..step(EfiStatus::SUCCESS)
+                },
+            );
+
+            let got = get(&driver, &fixture, question(true));
+
+            assert_eq!(
+                got.value,
+                Err(format!(
+                    "the Callback sequence changed stores of the FormSet: {store}; restored and \
+                     verified"
+                )),
+                "a RETRIEVE that writes {store}"
+            );
+            assert!(
+                !got.password_refused,
+                "a RETRIEVE that writes {store}: no password refusal"
+            );
+            assert_eq!(
+                fixture.routing.buffer(&header_of(&fixture.stores[0])),
+                [0xA5, 0xA5],
+                "the Buffer store after a write of {store}"
+            );
+            assert_eq!(
+                fixture
+                    .variables
+                    .variables
+                    .borrow()
+                    .get(&key("Store", STORE_GUID))
+                    .map(|contents| contents.data().to_vec()),
+                Some(vec![0x5A; 4]),
+                "the EFI variable store after a write of {store}"
+            );
+        }
+    }
+
+    #[test]
+    fn get_notes_requests_and_changed_variables_and_records_its_calls() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Retrieve,
+            Step {
+                request: ActionRequest::RESET,
+                writes: Some(3),
+                effect: Effect::Outside,
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+
+        let got = get(&driver, &fixture, question(true));
+
+        assert_eq!(got.value, Ok(value(3)), "a reset request keeps the value");
+        assert_eq!(
+            got.notes,
+            [
+                "Callback(RETRIEVE) asks for a platform reset (EFI_BROWSER_ACTION_REQUEST_RESET)"
+                    .to_string(),
+                format!(
+                    "EFI variables changed: {} (created)",
+                    key("Elsewhere", STORE_GUID)
+                ),
+            ],
+            "the notes"
+        );
+        assert_eq!(
+            got.calls
+                .iter()
+                .map(|call| (call.action, call.value.value, call.returned.request))
+                .collect::<Vec<_>>(),
+            [
+                (FormOpen, 0, ActionRequest::NONE),
+                (Retrieve, 3, ActionRequest::RESET),
+                (FormClose, 3, ActionRequest::NONE),
+            ],
+            "the recorded calls"
+        );
+    }
+
+    #[test]
+    fn get_refuses_before_any_callback_when_a_store_is_unreadable() {
+        let fixture = fixture();
+        fixture.routing.extract_fails_from.set(Some(0));
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+
+        let got = get(&driver, &fixture, question(true));
+
+        assert!(
+            got.value
+                .as_ref()
+                .is_err_and(|reason| reason.starts_with("cannot snapshot store VARSTORE 0x0002")),
+            "the refusal: {got:?}"
+        );
+        assert!(driver.actions().is_empty(), "no Callback()");
+        assert!(!got.password_refused, "no password refusal");
+    }
+
+    #[test]
+    fn get_lists_settings_that_change_on_their_own() {
+        let fixture = fixture();
+        // byte 1 of the Buffer store ticks at every ExtractConfig(), as a timestamp would
+        fixture.routing.ticking.borrow_mut().push(1);
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+
+        let got = get(&driver, &fixture, question(true));
+
+        assert_eq!(got.value, Ok(value(0)), "a ticking setting is no change");
+        assert_eq!(
+            got.notes,
+            [
+                "not compared, as they changed between two reads before the first Callback(): \
+                 VARSTORE 0x0002 Buffer: OFFSET=0000&WIDTH=0002"
+            ],
+            "the setting left out"
+        );
+    }
+
+    #[test]
+    fn get_refuses_save_and_undefined_requests_and_notes_a_discard() {
+        let fixture = fixture();
+        let cases = [
+            (
+                ActionRequest::SUBMIT,
+                true,
+                Err(
+                    "Callback(RETRIEVE) asked the forms browser to save the FormSet's modified \
+                     values (EFI_BROWSER_ACTION_REQUEST_SUBMIT), which only a forms browser's \
+                     edit buffer holds"
+                        .to_string(),
+                ),
+                Vec::new(),
+            ),
+            (ActionRequest::SUBMIT, false, Ok(value(1)), Vec::new()),
+            (
+                ActionRequest(10),
+                true,
+                Err(
+                    "Callback(RETRIEVE) returned EFI_BROWSER_ACTION_REQUEST 10, which UEFI 2.11 \
+                     section 35.5.4 does not define"
+                        .to_string(),
+                ),
+                Vec::new(),
+            ),
+            (
+                ActionRequest::FORM_DISCARD,
+                true,
+                Ok(value(1)),
+                vec![
+                    "Callback(RETRIEVE) asked the forms browser to discard modified values \
+                      (EFI_BROWSER_ACTION_REQUEST_FORM_DISCARD); outside a forms browser none are \
+                      pending"
+                        .to_string(),
+                ],
+            ),
+        ];
+        for (request, has_stores, want, want_notes) in cases {
+            let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+                Retrieve,
+                Step {
+                    request,
+                    writes: Some(1),
+                    ..step(EfiStatus::SUCCESS)
+                },
+            );
+
+            let got = get(&driver, &fixture, question(has_stores));
+
+            let case = format!("{request}, the FormSet declaring stores: {has_stores}");
+            assert_eq!(got.value, want, "{case}");
+            assert_eq!(got.notes, want_notes, "{case}: the notes");
+        }
+    }
+
+    #[test]
+    fn set_sends_the_actions_in_order_and_applies() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+            .on(Retrieve, step(EfiStatus::SUCCESS))
+            .on(
+                Retrieve,
+                Step {
+                    writes: Some(1),
+                    ..step(EfiStatus::SUCCESS)
+                },
+            );
+
+        let changed = set(&driver, &fixture, 1);
+
+        assert_eq!(
+            changed.outcome,
+            ChangeOutcome::Applied(ReadBack::Same),
+            "{changed:?}"
+        );
+        assert_eq!(changed.outcome.text(show), "applied", "the outcome's text");
+        assert_eq!(
+            *driver.log.borrow(),
+            [
+                (FormOpen, QUESTION, 0),
+                (Retrieve, QUESTION, 0),
+                (Changing, QUESTION, 1),
+                (Changed, QUESTION, 1),
+                (FormClose, QUESTION, 1),
+                (FormOpen, QUESTION, 1),
+                (Retrieve, QUESTION, 1),
+                (FormClose, QUESTION, 1),
+            ],
+            "set's calls, then the read-back's"
+        );
+        assert_eq!(
+            changed
+                .calls
+                .iter()
+                .map(|call| (call.action, QUESTION, call.value.value))
+                .collect::<Vec<_>>(),
+            [
+                (FormOpen, QUESTION, 0),
+                (Retrieve, QUESTION, 0),
+                (Changing, QUESTION, 1),
+                (Changed, QUESTION, 1),
+                (FormClose, QUESTION, 1),
+                (FormOpen, QUESTION, 1),
+                (Retrieve, QUESTION, 1),
+                (FormClose, QUESTION, 1),
+            ],
+            "the recorded calls, each with the value the driver left"
+        );
+    }
+
+    #[test]
+    fn changing_success_passes_its_value_and_unsupported_the_new_one() {
+        let fixture = fixture();
+        let cases = [
+            (
+                Step {
+                    writes: Some(2),
+                    ..step(EfiStatus::SUCCESS)
+                },
+                2,
+            ),
+            (
+                Step {
+                    writes: Some(2),
+                    ..step(EfiStatus::UNSUPPORTED)
+                },
+                1,
+            ),
+        ];
+        for (changing, want) in cases {
+            let driver =
+                ScriptedDriver::new(&fixture.routing, &fixture.variables).on(Changing, changing);
+            set(&driver, &fixture, 1);
+            let changed_value = driver
+                .log
+                .borrow()
+                .iter()
+                .find(|(action, _, _)| *action == Changed)
+                .map(|(_, _, value)| *value);
+            assert_eq!(
+                changed_value,
+                Some(want),
+                "CHANGED's value after CHANGING returns {}",
+                changing.status
+            );
+        }
+    }
+
+    #[test]
+    fn a_changing_error_skips_changed_but_still_closes() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+            .on(Changing, step(EfiStatus::ACCESS_DENIED));
+
+        let changed = set(&driver, &fixture, 1);
+
+        assert_eq!(
+            driver.actions(),
+            [FormOpen, Retrieve, Changing, FormClose],
+            "no CHANGED, no read-back"
+        );
+        assert_eq!(
+            changed.outcome.text(show),
+            "not applied: its driver's CallBack(EFI_BROWSER_ACTION_CHANGING) refused the value: \
+             EFI_ACCESS_DENIED; the driver's Callback(FORM_CLOSE) had already run, and any \
+             effect outside the FormSet's stores stays",
+            "b1"
+        );
+    }
+
+    #[test]
+    fn a_changed_error_is_not_applied_and_unsupported_is() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+            .on(Changed, step(EfiStatus::DEVICE_ERROR));
+        let failed = set(&driver, &fixture, 1);
+        assert!(
+            failed
+                .outcome
+                .text(show)
+                .starts_with("not applied: Callback(CHANGED) returned EFI_DEVICE_ERROR; "),
+            "b2: {}",
+            failed.outcome.text(show)
+        );
+        assert_eq!(
+            driver.actions(),
+            [FormOpen, Retrieve, Changing, Changed, FormClose],
+            "no read-back after a failed CHANGED"
+        );
+
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+            .on(Changed, step(EfiStatus::UNSUPPORTED));
+        let applied = set(&driver, &fixture, 1);
+        assert!(
+            matches!(applied.outcome, ChangeOutcome::Applied(_)),
+            "CHANGED's EFI_UNSUPPORTED: {:?}",
+            applied.outcome
+        );
+    }
+
+    #[test]
+    fn a_save_request_is_not_applied_with_stores_and_ignored_without() {
+        let fixture = fixture();
+        for request in [
+            ActionRequest::SUBMIT,
+            ActionRequest::FORM_SUBMIT_EXIT,
+            ActionRequest::FORM_APPLY,
+            ActionRequest::QUESTION_APPLY,
+        ] {
+            let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+                Changed,
+                Step {
+                    request,
+                    ..step(EfiStatus::SUCCESS)
+                },
+            );
+            let with_stores = set(&driver, &fixture, 1);
+            assert_eq!(
+                with_stores.outcome.text(show),
+                format!(
+                    "not applied: Callback(CHANGED) asked the forms browser to save the \
+                     FormSet's modified values ({request}), which only a forms browser's edit \
+                     buffer holds; the driver's Callback(FORM_CLOSE) had already run, and any \
+                     effect outside the FormSet's stores stays"
+                ),
+                "b3 for {request}"
+            );
+
+            let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+                Changed,
+                Step {
+                    request,
+                    ..step(EfiStatus::SUCCESS)
+                },
+            );
+            let without = set_of(&driver, &fixture, question(false), 1);
+            assert!(
+                matches!(without.outcome, ChangeOutcome::Applied(_)),
+                "{request} without stores: {:?}",
+                without.outcome
+            );
+        }
+    }
+
+    #[test]
+    fn reset_and_discard_requests_are_noted() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+            .on(
+                Changing,
+                Step {
+                    request: ActionRequest::FORM_DISCARD,
+                    ..step(EfiStatus::SUCCESS)
+                },
+            )
+            .on(
+                Changed,
+                Step {
+                    request: ActionRequest::RESET,
+                    ..step(EfiStatus::SUCCESS)
+                },
+            );
+
+        let changed = set(&driver, &fixture, 1);
+
+        assert!(
+            matches!(changed.outcome, ChangeOutcome::Applied(_)),
+            "{:?}",
+            changed.outcome
+        );
+        assert_eq!(
+            changed.notes,
+            [
+                "Callback(CHANGING) asked the forms browser to discard modified values \
+                 (EFI_BROWSER_ACTION_REQUEST_FORM_DISCARD); outside a forms browser none are \
+                 pending",
+                "Callback(CHANGED) asks for a platform reset (EFI_BROWSER_ACTION_REQUEST_RESET)"
+            ],
+            "the notes"
+        );
+    }
+
+    #[test]
+    fn reconnect_runs_after_an_applied_change_only() {
+        let fixture = fixture();
+        let reconnect = Step {
+            request: ActionRequest::RECONNECT,
+            ..step(EfiStatus::SUCCESS)
+        };
+        let driver =
+            ScriptedDriver::new(&fixture.routing, &fixture.variables).on(Changed, reconnect);
+        let applied = set(&driver, &fixture, 1);
+        assert_eq!(*driver.reconnects.borrow(), 1, "one reconnection");
+        assert_eq!(
+            applied.notes,
+            ["reconnected the driver's controller (EFI_BROWSER_ACTION_REQUEST_RECONNECT)"],
+            "the note"
+        );
+
+        let failing = ScriptedDriver {
+            reconnect_status: Some(EfiStatus::NOT_FOUND),
+            ..ScriptedDriver::new(&fixture.routing, &fixture.variables).on(Changed, reconnect)
+        };
+        let noted = set(&failing, &fixture, 1);
+        assert_eq!(
+            noted.notes,
+            [
+                "the reconnection that EFI_BROWSER_ACTION_REQUEST_RECONNECT asks for failed: \
+              EFI_NOT_FOUND"
+            ],
+            "a failed reconnection"
+        );
+
+        let refused = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+            .on(Changing, Step { ..reconnect })
+            .on(Changed, step(EfiStatus::DEVICE_ERROR));
+        set(&refused, &fixture, 1);
+        assert_eq!(
+            *refused.reconnects.borrow(),
+            0,
+            "no reconnection after a change that is not applied"
+        );
+    }
+
+    #[test]
+    fn an_undefined_request_is_not_applied() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Changing,
+            Step {
+                request: ActionRequest(10),
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+
+        let changed = set(&driver, &fixture, 1);
+
+        assert!(
+            changed.outcome.text(show).starts_with(
+                "not applied: Callback(CHANGING) returned EFI_BROWSER_ACTION_REQUEST 10, which \
+                 UEFI 2.11 section 35.5.4 does not define; "
+            ),
+            "{}",
+            changed.outcome.text(show)
+        );
+    }
+
+    #[test]
+    fn a_changed_store_is_not_applied_and_restored() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Changed,
+            Step {
+                effect: Effect::Variable,
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+
+        let changed = set(&driver, &fixture, 1);
+
+        assert_eq!(
+            changed.outcome.text(show),
+            format!(
+                "not applied: the Callback sequence changed stores of the FormSet: VARSTORE_EFI \
+                 0x0001 {}; restored and verified; the driver's Callback(FORM_CLOSE) had \
+                 already run, and any effect outside the FormSet's stores stays",
+                key("Store", STORE_GUID)
+            ),
+            "the caught change"
+        );
+        assert!(!changed.password_refused, "no password refusal");
+        assert_eq!(
+            fixture
+                .variables
+                .variables
+                .borrow()
+                .get(&key("Store", STORE_GUID))
+                .map(|contents| contents.data().to_vec()),
+            Some(vec![0x5A; 4]),
+            "the store restored"
+        );
+    }
+
+    /// set through the Callback()s of a FormSet whose EFI variable store holds a PASSWORD
+    /// question's bytes, which the withholding variables read as zero: a CHANGED that writes the
+    /// store is caught, and the store is not set back, which would write zeros over the password.
+    #[test]
+    fn set_writes_no_password_byte_back_to_a_store() {
+        let fixture = fixture();
+        let declaration = StoreDeclaration {
+            holds_password: true,
+            ..efi_declaration(1, "Store")
+        };
+        let mut withheld = WithheldBytes::default();
+        withheld.insert(key("Store", STORE_GUID), 1..3);
+        let variables = WithholdingVariables::new(&fixture.variables, withheld);
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Changed,
+            Step {
+                effect: Effect::Variable,
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+        let access = FormSetAccess {
+            stores: vec![store(&declaration)],
+            routing: &fixture.routing,
+            variables: &variables,
+        };
+
+        let changed = change(&driver, question(true), value(1), access);
+
+        // the driver's write cuts the withheld bytes off too
+        assert_eq!(
+            changed.outcome.text(show),
+            format!(
+                "not applied: the Callback sequence changed VarStore 0x0001, which holds a \
+                 PASSWORD question; it was not restored, because SetVariable() writes every byte \
+                 of the variable, the password's too, which uefisettings never writes; {}; the \
+                 driver's Callback(FORM_CLOSE) had already run, and any effect outside the \
+                 FormSet's stores stays",
+                overwritten("Store")
+            ),
+            "the caught change"
+        );
+        assert!(
+            fixture.variables.set.borrow().is_empty()
+                && fixture.variables.deleted.borrow().is_empty(),
+            "no SetVariable() or deletion of the store"
+        );
+        assert_eq!(
+            fixture
+                .variables
+                .variables
+                .borrow()
+                .get(&key("Store", STORE_GUID))
+                .map(|contents| contents.data().to_vec()),
+            Some(vec![1, 2]),
+            "the driver's write stays"
+        );
+    }
+
+    /// The variables of `fixture` with `bytes` of `name` withheld, as a PASSWORD question's.
+    fn withholding<'a>(
+        fixture: &'a Fixture,
+        name: &str,
+        bytes: Range<usize>,
+    ) -> WithholdingVariables<&'a HeldVariables> {
+        let mut withheld = WithheldBytes::default();
+        withheld.insert(key(name, STORE_GUID), bytes);
+        WithholdingVariables::new(&fixture.variables, withheld)
+    }
+
+    /// The refusal of a Callback sequence that changed the withheld bytes of `name`.
+    fn overwritten(name: &str) -> String {
+        format!(
+            "the Callback sequence changed the password bytes of EFI variable {}; they were not \
+             restored, as uefisettings never writes a password byte",
+            key(name, STORE_GUID)
+        )
+    }
+
+    #[test]
+    fn set_refuses_a_callback_that_overwrites_withheld_bytes_only() {
+        let cases = [
+            (
+                "withheld bytes overwritten",
+                Effect::Password,
+                format!(
+                    "not applied: {}; the driver's Callback(FORM_CLOSE) had already run, and any \
+                     effect outside the FormSet's stores stays",
+                    overwritten("Store")
+                ),
+            ),
+            ("withheld bytes kept", Effect::None, "applied".to_string()),
+        ];
+        for (name, effect, want) in cases {
+            let password = matches!(effect, Effect::Password);
+            let fixture = fixture();
+            let variables = withholding(&fixture, "Store", 1..3);
+            let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+                Changed,
+                Step {
+                    effect,
+                    ..step(EfiStatus::SUCCESS)
+                },
+            );
+
+            let changed = change(
+                &driver,
+                question(true),
+                value(1),
+                access(&fixture, &variables),
+            );
+
+            assert_eq!(changed.outcome.text(show), want, "{name}: the outcome");
+            assert_eq!(
+                changed.password_refused, password,
+                "{name}: the password refusal"
+            );
+            assert!(
+                changed.notes.is_empty(),
+                "{name}: no note, as no byte that a read shows changed: {:?}",
+                changed.notes
+            );
+            assert!(
+                fixture.variables.set.borrow().is_empty()
+                    && fixture.variables.deleted.borrow().is_empty(),
+                "{name}: no SetVariable() or deletion"
+            );
+        }
+    }
+
+    #[test]
+    fn get_refuses_a_retrieve_that_overwrites_withheld_bytes() {
+        let fixture = fixture();
+        let variables = withholding(&fixture, "Store", 1..3);
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Retrieve,
+            Step {
+                writes: Some(3),
+                effect: Effect::Password,
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+
+        let got = retrieve(&driver, question(true), access(&fixture, &variables));
+
+        assert_eq!(got.value, Err(overwritten("Store")), "the caught overwrite");
+        assert!(got.password_refused, "a password refusal");
+        assert_eq!(
+            driver.actions(),
+            [FormOpen, Retrieve, FormClose],
+            "the whole sequence ran"
+        );
+    }
+
+    #[test]
+    fn set_refuses_a_callback_that_creates_a_withheld_variable() {
+        let fixture = fixture();
+        let variables = withholding(&fixture, "Elsewhere", 0..usize::MAX);
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Changed,
+            Step {
+                effect: Effect::Outside,
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+
+        let changed = change(
+            &driver,
+            question(true),
+            value(1),
+            access(&fixture, &variables),
+        );
+
+        assert_eq!(
+            changed.outcome.text(show),
+            format!(
+                "not applied: {}; the driver's Callback(FORM_CLOSE) had already run, and any \
+                 effect outside the FormSet's stores stays",
+                overwritten("Elsewhere")
+            ),
+            "the caught creation"
+        );
+        assert_eq!(
+            changed.notes,
+            [format!(
+                "EFI variables changed: {} (created)",
+                key("Elsewhere", STORE_GUID)
+            )],
+            "the listed variable"
+        );
+    }
+
+    #[test]
+    fn a_withheld_variable_that_cannot_be_read_refuses_before_any_callback() {
+        let fixture = fixture();
+        // metadata that metadata_end refuses hides where the value, and its password, starts
+        fixture.variables.variables.borrow_mut().insert(
+            key("Elsewhere", STORE_GUID),
+            VariableContents::new(
+                NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS,
+                vec![0x5A],
+            )
+            .expect("data"),
+        );
+        let variables = withholding(&fixture, "Elsewhere", 0..1);
+        let refusal = format!(
+            "cannot compare the password bytes of EFI variable {} across the Callback sequence: ",
+            key("Elsewhere", STORE_GUID)
+        );
+
+        let setter = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+        let changed = change(
+            &setter,
+            question(true),
+            value(1),
+            access(&fixture, &variables),
+        );
+        let getter = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+        let got = retrieve(&getter, question(true), access(&fixture, &variables));
+
+        assert!(
+            matches!(&changed.outcome, ChangeOutcome::Refused(reason)
+                if reason.starts_with(&refusal)),
+            "set: {}",
+            changed.outcome.text(show)
+        );
+        assert!(
+            matches!(&got.value, Err(reason) if reason.starts_with(&refusal)),
+            "get: {:?}",
+            got.value
+        );
+        assert!(
+            setter.actions().is_empty() && getter.actions().is_empty(),
+            "no Callback()"
+        );
+        assert!(
+            !changed.password_refused && !got.password_refused,
+            "no password refusal, as no driver code ran"
+        );
+    }
+
+    #[test]
+    fn a_reconnection_is_compared_again_and_listed() {
+        let reconnect = Step {
+            request: ActionRequest::RECONNECT,
+            ..step(EfiStatus::SUCCESS)
+        };
+        let reconnected =
+            "reconnected the driver's controller (EFI_BROWSER_ACTION_REQUEST_RECONNECT)"
+                .to_string();
+        let failed = "the reconnection that EFI_BROWSER_ACTION_REQUEST_RECONNECT asks for failed: \
+                      EFI_NOT_FOUND"
+            .to_string();
+        let overwritten_by_reconnection = format!(
+            "applied; then the reconnection that EFI_BROWSER_ACTION_REQUEST_RECONNECT asks for \
+             changed the password bytes of EFI variable {}; they were not restored, as \
+             uefisettings never writes a password byte",
+            key("Store", STORE_GUID)
+        );
+        let created = format!(
+            "EFI variables changed: {} (created)",
+            key("Elsewhere", STORE_GUID)
+        );
+        let cases = [
+            (
+                "withheld bytes overwritten",
+                Effect::Password,
+                None,
+                overwritten_by_reconnection.clone(),
+                vec![reconnected.clone()],
+            ),
+            (
+                "withheld bytes overwritten by a failed reconnection",
+                Effect::Password,
+                Some(EfiStatus::NOT_FOUND),
+                overwritten_by_reconnection,
+                vec![failed],
+            ),
+            (
+                "a variable created",
+                Effect::Outside,
+                None,
+                "applied".to_string(),
+                vec![reconnected.clone(), created],
+            ),
+            (
+                "nothing written",
+                Effect::None,
+                None,
+                "applied".to_string(),
+                vec![reconnected],
+            ),
+        ];
+        for (name, effect, status, want, want_notes) in cases {
+            let password = matches!(effect, Effect::Password);
+            let fixture = fixture();
+            let variables = withholding(&fixture, "Store", 1..3);
+            let driver = ScriptedDriver {
+                reconnect_effect: effect,
+                reconnect_status: status,
+                ..ScriptedDriver::new(&fixture.routing, &fixture.variables).on(Changed, reconnect)
+            };
+
+            let changed = change(
+                &driver,
+                question(true),
+                value(1),
+                access(&fixture, &variables),
+            );
+
+            assert_eq!(
+                *driver.reconnects.borrow(),
+                1,
+                "{name}: the reconnection ran"
+            );
+            assert_eq!(changed.outcome.text(show), want, "{name}: the outcome");
+            assert_eq!(
+                changed.password_refused, password,
+                "{name}: the password refusal"
+            );
+            assert_eq!(changed.notes, want_notes, "{name}: the notes");
+        }
+    }
+
+    /// The routing of a fixture whose ExtractConfig()s but the first `skipped` also write bytes 1
+    /// and 2 of its EFI variable store, as a driver's ExtractConfig() may write its variables.
+    struct VariableWritingRouting<'a> {
+        routing: &'a FakeRouting,
+        variables: &'a HeldVariables,
+        skipped: Cell<usize>,
+    }
+
+    impl ConfigRouting for VariableWritingRouting<'_> {
+        fn extract_config(
+            &self,
+            request: &ConfigRequest,
+        ) -> Result<MultiConfigAltResp, ConfigRoutingError> {
+            match self.skipped.get() {
+                0 => overwrite_store_password(self.variables),
+                skipped => self.skipped.set(skipped - 1),
+            }
+            self.routing.extract_config(request)
+        }
+
+        fn route_config(&self, resp: &ConfigResp) -> Result<(), ConfigRoutingError> {
+            self.routing.route_config(resp)
+        }
+    }
+
+    #[test]
+    fn set_refuses_an_extract_config_that_overwrites_withheld_bytes() {
+        let fixture = fixture();
+        let variables = withholding(&fixture, "Store", 1..3);
+        let routing = VariableWritingRouting {
+            routing: &fixture.routing,
+            variables: &fixture.variables,
+            skipped: Cell::new(0),
+        };
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+        let access = FormSetAccess {
+            stores: fixture.stores.clone(),
+            routing: &routing,
+            variables: &variables,
+        };
+
+        let changed = change(&driver, question(true), value(1), access);
+
+        assert_eq!(
+            changed.outcome.text(show),
+            format!(
+                "not applied: {}; the driver's Callback(FORM_CLOSE) had already run, and any \
+                 effect outside the FormSet's stores stays",
+                overwritten("Store")
+            ),
+            "the overwrite by the stores' first read"
+        );
+    }
+
+    /// Baseline::take reads the Buffer store of fixture() twice, so that its check reads it the
+    /// third time, after the Callback()s.
+    const BASELINE_READS: usize = 2;
+
+    #[test]
+    fn set_refuses_an_overwrite_by_the_stores_check() {
+        let fixture = fixture();
+        let variables = withholding(&fixture, "Store", 1..3);
+        let routing = VariableWritingRouting {
+            routing: &fixture.routing,
+            variables: &fixture.variables,
+            skipped: Cell::new(BASELINE_READS),
+        };
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+        let access = FormSetAccess {
+            stores: fixture.stores.clone(),
+            routing: &routing,
+            variables: &variables,
+        };
+
+        let changed = change(&driver, question(true), value(1), access);
+
+        assert_eq!(
+            changed.outcome.text(show),
+            format!(
+                "not applied: {}; the driver's Callback(FORM_CLOSE) had already run, and any \
+                 effect outside the FormSet's stores stays",
+                overwritten("Store")
+            ),
+            "the overwrite by the check's read, after the Callback()s"
+        );
+    }
+
+    #[test]
+    fn get_refuses_an_overwrite_by_the_stores_check() {
+        let fixture = fixture();
+        let variables = withholding(&fixture, "Store", 1..3);
+        let routing = VariableWritingRouting {
+            routing: &fixture.routing,
+            variables: &fixture.variables,
+            skipped: Cell::new(BASELINE_READS),
+        };
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+        let access = FormSetAccess {
+            stores: fixture.stores.clone(),
+            routing: &routing,
+            variables: &variables,
+        };
+
+        let got = retrieve(&driver, question(true), access);
+
+        assert_eq!(
+            got.value,
+            Err(overwritten("Store")),
+            "the overwrite by the check's read, after the Callback()s"
+        );
+    }
+
+    #[test]
+    fn set_refuses_before_any_callback_when_a_store_is_unreadable() {
+        let fixture = fixture();
+        fixture.routing.extract_fails_from.set(Some(1));
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+
+        let changed = set(&driver, &fixture, 1);
+
+        assert!(
+            matches!(&changed.outcome, ChangeOutcome::Refused(reason)
+                if reason.starts_with("cannot snapshot store VARSTORE 0x0002 Buffer: ")),
+            "{:?}",
+            changed.outcome
+        );
+        assert!(driver.actions().is_empty(), "no Callback()");
+        assert!(!changed.password_refused, "no password refusal");
+    }
+
+    /// The access of `fixture` through `routing`, whose ExtractConfig()s overwrite the withheld
+    /// bytes of Store, and whose second ExtractConfig() fails, so that Baseline::take fails after
+    /// driver code changed a password.
+    fn baseline_failing_access<'a>(
+        fixture: &'a Fixture,
+        routing: &'a VariableWritingRouting<'a>,
+        variables: &'a WithholdingVariables<&'a HeldVariables>,
+    ) -> FormSetAccess<'a, VariableWritingRouting<'a>, &'a HeldVariables> {
+        fixture.routing.extract_fails_from.set(Some(1));
+        FormSetAccess {
+            stores: fixture.stores.clone(),
+            routing,
+            variables,
+        }
+    }
+
+    /// set, whose stores' first read overwrites withheld bytes and whose second read fails,
+    /// refuses, and its refusal names the password change.
+    #[test]
+    fn set_names_a_password_change_when_the_baseline_fails() {
+        let fixture = fixture();
+        let variables = withholding(&fixture, "Store", 1..3);
+        let routing = VariableWritingRouting {
+            routing: &fixture.routing,
+            variables: &fixture.variables,
+            skipped: Cell::new(0),
+        };
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+
+        let changed = change(
+            &driver,
+            question(true),
+            value(1),
+            baseline_failing_access(&fixture, &routing, &variables),
+        );
+
+        let text = changed.outcome.text(show);
+        assert!(
+            matches!(changed.outcome, ChangeOutcome::Refused(_)),
+            "set refuses: {text}"
+        );
+        assert!(driver.actions().is_empty(), "no Callback()");
+        assert!(
+            text.contains(&overwritten("Store")),
+            "the refusal names the password change: {text}"
+        );
+        assert!(changed.password_refused, "a password refusal");
+    }
+
+    /// get, as set_names_a_password_change_when_the_baseline_fails sets up, gives no value, and its
+    /// reason names the password change.
+    #[test]
+    fn get_names_a_password_change_when_the_baseline_fails() {
+        let fixture = fixture();
+        let variables = withholding(&fixture, "Store", 1..3);
+        let routing = VariableWritingRouting {
+            routing: &fixture.routing,
+            variables: &fixture.variables,
+            skipped: Cell::new(0),
+        };
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+
+        let got = retrieve(
+            &driver,
+            question(true),
+            baseline_failing_access(&fixture, &routing, &variables),
+        );
+
+        assert!(got.value.is_err(), "get gives no value: {:?}", got.value);
+        assert!(driver.actions().is_empty(), "no Callback()");
+        assert!(
+            matches!(&got.value, Err(reason) if reason.contains(&overwritten("Store"))),
+            "the reason names the password change: {:?}",
+            got.value
+        );
+        assert!(got.password_refused, "a password refusal");
+    }
+
+    /// get's answer is the value, or ValueUnavailable with why there is none, then the notes; get
+    /// fails, naming the question, where driver code changed password bytes.
+    #[test]
+    fn get_fails_where_driver_code_changed_password_bytes() {
+        let refusal = overwritten("Store");
+        let cases = [
+            ("a value", Ok(value(1)), false, Ok("1 <a note>".to_owned())),
+            (
+                "no value",
+                Err("a store changed".to_owned()),
+                false,
+                Ok("<ValueUnavailable: a store changed> <a note>".to_owned()),
+            ),
+            (
+                "changed password bytes",
+                Err(refusal.clone()),
+                true,
+                Err(format!("cannot get question \"Q\": {refusal}")),
+            ),
+        ];
+        for (case, value, password_refused, want) in cases {
+            let retrieval = Retrieval {
+                value,
+                password_refused,
+                notes: vec!["a note".to_owned()],
+                calls: Vec::new(),
+            };
+
+            let answer = retrieval.answer("Q", show);
+
+            let refused = answer
+                .as_ref()
+                .is_err_and(|error| error.is::<PasswordBytesRefusal>());
+            assert_eq!(
+                answer.map_err(|error| error.to_string()),
+                want,
+                "{case}: the answer"
+            );
+            assert_eq!(refused, password_refused, "{case}: a PasswordBytesRefusal");
+        }
+    }
+
+    /// set's annotation where the change applied; else set's refusal, a PasswordBytesRefusal where
+    /// driver code changed password bytes, also after an applied change.
+    #[test]
+    fn set_refuses_as_password_bytes_changed_where_driver_code_changed_them() {
+        let refusal = overwritten("Store");
+        let cases = [
+            (
+                "applied",
+                ChangeOutcome::Applied(ReadBack::Same),
+                false,
+                Ok(" <applied; a note>".to_owned()),
+            ),
+            (
+                "refused",
+                ChangeOutcome::Refused("a store changed".to_owned()),
+                false,
+                Err("cannot set question \"Q\": a store changed; a note".to_owned()),
+            ),
+            (
+                "changed password bytes",
+                ChangeOutcome::Refused(refusal.clone()),
+                true,
+                Err(format!("cannot set question \"Q\": {refusal}; a note")),
+            ),
+            (
+                "password bytes changed after an applied change",
+                ChangeOutcome::AppliedThenRefused {
+                    read_back: ReadBack::Same,
+                    reason: refusal.clone(),
+                },
+                true,
+                Err(format!(
+                    "cannot set question \"Q\": applied; then {refusal}; a note"
+                )),
+            ),
+        ];
+        for (case, outcome, password_refused, want) in cases {
+            let changed = Change {
+                outcome,
+                password_refused,
+                notes: vec!["a note".to_owned()],
+                calls: Vec::new(),
+            };
+
+            let annotation = changed.annotation("Q", show);
+
+            let refused = annotation
+                .as_ref()
+                .is_err_and(|error| error.is::<PasswordBytesRefusal>());
+            assert_eq!(
+                annotation.map_err(|error| error.to_string()),
+                want,
+                "{case}: the annotation"
+            );
+            assert_eq!(refused, password_refused, "{case}: a PasswordBytesRefusal");
+        }
+    }
+
+    #[test]
+    fn set_with_a_write_expression_refuses_before_any_callback() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+        let with_write = DriverQuestion {
+            write_expression: true,
+            ..question(true)
+        };
+
+        let changed = set_of(&driver, &fixture, with_write, 1);
+
+        assert_eq!(
+            changed.outcome,
+            ChangeOutcome::Refused(
+                "question has no VarStore, and uefisettings does not apply its WRITE expression \
+                 beside its driver's Callback()s"
+                    .to_string()
+            ),
+            "WRITE runs between CHANGING and CHANGED"
+        );
+        assert!(driver.actions().is_empty(), "no Callback()");
+        assert!(changed.calls.is_empty(), "no calls recorded");
+    }
+
+    #[test]
+    fn a_failure_after_the_callbacks_still_restores_and_yields_an_outcome() {
+        let fixture = fixture();
+        // the baseline's two reads take ExtractConfig() calls 0 and 1
+        fixture.routing.extract_fails_from.set(Some(2));
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Changed,
+            Step {
+                effect: Effect::Variable,
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+
+        let changed = set(&driver, &fixture, 1);
+
+        let text = changed.outcome.text(show);
+        assert!(
+            text.starts_with(&format!(
+                "not applied: the Callback sequence changed stores of the FormSet: \
+                 VARSTORE_EFI 0x0001 {}; restored and verified; cannot snapshot store \
+                 VARSTORE 0x0002 Buffer after the Callback sequence: ",
+                key("Store", STORE_GUID)
+            )),
+            "a failure after the Callback()s still restores the changed store: {text}"
+        );
+    }
+
+    #[test]
+    fn the_read_back_reports_another_value_or_none() {
+        let fixture = fixture();
+        let closed = [
+            FormOpen, Retrieve, Changing, Changed, FormClose, FormOpen, Retrieve, FormClose,
+        ];
+        let cases = [
+            (
+                Step {
+                    writes: Some(0),
+                    ..step(EfiStatus::SUCCESS)
+                },
+                "applied; the driver now reports 0",
+                &closed[..],
+            ),
+            (
+                step(EfiStatus::UNSUPPORTED),
+                "applied; the driver offers no read-back",
+                &closed,
+            ),
+            // the read-back's form ends at its failed RETRIEVE, before FORM_CLOSE
+            (
+                step(EfiStatus::DEVICE_ERROR),
+                "applied; the driver's read-back Callback(RETRIEVE) returned EFI_DEVICE_ERROR",
+                &closed[..7],
+            ),
+        ];
+        for (read_back, want, want_actions) in cases {
+            let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+                .on(Retrieve, step(EfiStatus::SUCCESS))
+                .on(Retrieve, read_back);
+            let changed = set(&driver, &fixture, 1);
+            assert_eq!(
+                changed.outcome.text(show),
+                want,
+                "the outcome with the read-back {}",
+                read_back.status
+            );
+            assert_eq!(
+                driver.actions(),
+                want_actions,
+                "the calls with the read-back {}",
+                read_back.status
+            );
+        }
+    }
+
+    #[test]
+    fn a_failed_retrieve_ends_set_before_changing() {
+        let fixture = fixture();
+        let cases = [
+            // a forms browser counts EFI_UNSUPPORTED as success, and the change goes on
+            (
+                EfiStatus::UNSUPPORTED,
+                "applied",
+                &[
+                    FormOpen, Retrieve, Changing, Changed, FormClose, FormOpen, Retrieve, FormClose,
+                ][..],
+            ),
+            // any other error ends the form before it takes a value
+            (
+                EfiStatus::DEVICE_ERROR,
+                "not applied: its driver's CallBack(EFI_BROWSER_ACTION_RETRIEVE) returned \
+                 EFI_DEVICE_ERROR, which ends a forms browser's form before it takes a value; the \
+                 driver's Callback(RETRIEVE) had already run, and any effect outside the FormSet's \
+                 stores stays",
+                &[FormOpen, Retrieve],
+            ),
+        ];
+        for (status, want, want_actions) in cases {
+            let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables)
+                .on(Retrieve, step(status))
+                .on(
+                    Retrieve,
+                    Step {
+                        writes: Some(1),
+                        ..step(EfiStatus::SUCCESS)
+                    },
+                );
+            let changed = set(&driver, &fixture, 1);
+            assert_eq!(
+                changed.outcome.text(show),
+                want,
+                "the outcome when RETRIEVE returns {status}"
+            );
+            assert_eq!(
+                driver.actions(),
+                want_actions,
+                "the calls when RETRIEVE returns {status}"
+            );
+        }
+    }
+
+    #[test]
+    fn variables_changed_outside_the_stores_are_listed_but_do_not_refuse() {
+        let fixture = fixture();
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables).on(
+            Changed,
+            Step {
+                effect: Effect::Outside,
+                ..step(EfiStatus::SUCCESS)
+            },
+        );
+
+        let changed = set(&driver, &fixture, 1);
+
+        assert_eq!(
+            changed.outcome,
+            ChangeOutcome::Applied(ReadBack::Same),
+            "a variable changed outside the stores does not refuse the change"
+        );
+        assert_eq!(
+            changed.notes,
+            [format!(
+                "EFI variables changed: {} (created)",
+                key("Elsewhere", STORE_GUID)
+            )],
+            "the listed variable"
+        );
+    }
+
+    #[test]
+    fn settings_that_change_on_their_own_are_listed_and_not_compared() {
+        let fixture = fixture();
+        // byte 1 of the Buffer store ticks at every ExtractConfig(), as a timestamp would
+        fixture.routing.ticking.borrow_mut().push(1);
+        let driver = ScriptedDriver::new(&fixture.routing, &fixture.variables);
+
+        let changed = set(&driver, &fixture, 1);
+
+        assert_eq!(
+            changed.outcome,
+            ChangeOutcome::Applied(ReadBack::Same),
+            "a ticking setting is no change"
+        );
+        assert_eq!(
+            changed.notes,
+            [
+                "not compared, as they changed between two reads before the first Callback(): \
+                 VARSTORE 0x0002 Buffer: OFFSET=0000&WIDTH=0002"
+            ],
+            "the setting left out"
+        );
+    }
+
+    #[test]
+    fn values_pass_through_the_union_in_their_width() {
+        let cases = [
+            (IfrValueType::NumSize8, 0x1FF, 0xFF),
+            (IfrValueType::NumSize16, 0x1_2345, 0x2345),
+            (IfrValueType::NumSize32, 0x1_2345_6789, 0x2345_6789),
+            (IfrValueType::NumSize64, u64::MAX, u64::MAX),
+            (IfrValueType::Boolean, 0x101, 0x01),
+        ];
+        for (value_type, value, want) in cases {
+            let union = IfrValue { value_type, value }.to_union();
+            assert_eq!(
+                union[1..],
+                [0, 0],
+                "{value_type:?} uses only the first word"
+            );
+            assert_eq!(
+                u64::from_le(union[0]),
+                want,
+                "{value_type:?}'s bytes in memory, least significant first"
+            );
+            assert_eq!(
+                IfrValue::from_union(value_type, &union).value,
+                want,
+                "{value_type:?} keeps its width"
+            );
+        }
+    }
+}
diff --git a/src/lib/hii/scsu.rs b/src/lib/hii/scsu.rs
index cb07851..50a88ce 100644
--- a/src/lib/hii/scsu.rs
+++ b/src/lib/hii/scsu.rs
@@ -13,7 +13,9 @@
 //! SCSU, the Standard Compression Scheme for Unicode (Unicode Technical Standard #6, revision 4),
 //! as UEFI 2.11 §33.3.6.3.1 extends it for the text of the SCSU string blocks (§33.3.6.2): the
 //! windows start from the strings package's LanguageWindow (§33.3.6.1) instead of UTS #6's fixed
-//! values, 0x7F introduces a control code of §33.2.6.2.4, and every character fits UCS-2.
+//! values, and 0x7F introduces a control code of §33.2.6.2.4. A character that UEFI rules out of
+//! strings, such as one beyond UCS-2 or a control code's 0xFxyy form, decodes as any other, and
+//! the strings package's reader reads it as U+FFFD.
 
 use anyhow::anyhow;
 use anyhow::bail;
@@ -26,18 +28,18 @@ const CONTROL_CODE: u8 = 0x7F;
 /// Decodes the SCSU string at the start of `bytes` up to its null terminator, the first decoded
 /// U+0000 (UEFI 2.11 §33.3.6.2 "null-terminated encoded string"), from `language_window`:
 /// static windows 0-7, then dynamic windows 0-7, the order of edk2's mLanguageWindow
-/// (edk2-stable202608 MdeModulePkg/Universal/HiiDatabaseDxe/String.c). Returns the string and
-/// the bytes after its terminator. A control code becomes its 0xFxyy form, as in UCS-2 strings
-/// (§33.2.6.2.4).
+/// (edk2-stable202608 MdeModulePkg/Universal/HiiDatabaseDxe/String.c). Returns the units of the
+/// string and the bytes after its terminator.
 ///
-/// Example: under edk2's LanguageWindow, `41 7F 00 01 42 00 43` is ("A\u{F701}B", `43`): Font
-/// Family 0x01 between "A" and "B", whose 0x00 byte is no terminator.
+/// Example: under edk2's LanguageWindow, `41 7F 00 01 42 00 43` is ([Character(0x41),
+/// ControlCode(0xF701), Character(0x42)], `43`): Font Family 0x01 between "A" and "B", whose
+/// 0x00 byte is no terminator.
 pub(super) fn decode<'a>(
     bytes: &'a [u8],
     language_window: &[u16; 16],
-) -> Result<(String, &'a [u8])> {
+) -> Result<(Vec<ScsuUnit>, &'a [u8])> {
     let mut decoder = Decoder::new(bytes, language_window);
-    let mut string = String::new();
+    let mut units = Vec::new();
     loop {
         let decoded = match decoder.mode {
             Mode::SingleByte => decoder.single_byte()?,
@@ -45,14 +47,24 @@ pub(super) fn decode<'a>(
         };
         match decoded {
             Decoded::State => {}
-            Decoded::ControlCode(code) => string.push(code),
+            Decoded::ControlCode(code) => units.push(ScsuUnit::ControlCode(code)),
             // the null terminator
-            Decoded::Character(0) => return Ok((string, decoder.bytes.as_slice())),
-            Decoded::Character(code_point) => string.push(ucs2_character(code_point)?),
+            Decoded::Character(0) => return Ok((units, decoder.bytes.as_slice())),
+            Decoded::Character(code_point) => units.push(ScsuUnit::Character(code_point)),
         }
     }
 }
 
+/// A unit of a decoded SCSU string.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum ScsuUnit {
+    /// A character's code point, which may lie outside UCS-2
+    Character(u32),
+    /// A UEFI control code that 0x7F introduces, as its 0xFxyy form in UCS-2 strings (UEFI 2.11
+    /// §33.2.6.2.4)
+    ControlCode(u16),
+}
+
 /// UTS #6 §5's two modes.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum Mode {
@@ -68,7 +80,7 @@ enum Decoded {
     /// A tag that changed the mode or the windows.
     State,
     /// A UEFI control code, as its 0xFxyy form.
-    ControlCode(char),
+    ControlCode(u16),
     /// A character's code point, which may lie outside UCS-2.
     Character(u32),
 }
@@ -270,8 +282,6 @@ impl<'a> Decoder<'a> {
             style @ 0x20..=0x2B => 0xF600 | u16::from(style),
             code => bail!("unknown control code 0x7F {code:#04x} (UEFI 2.11 Table 33.3)"),
         };
-        // 0xF6xx-0xF8xx are no surrogates
-        let code = char::from_u32(u32::from(code)).ok_or_else(|| surrogate(code.into()))?;
         Ok(Decoded::ControlCode(code))
     }
 
@@ -284,8 +294,8 @@ impl<'a> Decoder<'a> {
     }
 
     /// SDX or UDX: positions a dynamic window in the supplementary code space by the next two
-    /// bytes (UTS #6 §6.1.3) and makes it the active one. Its characters do not fit UCS-2, so
-    /// the first one is refused.
+    /// bytes (UTS #6 §6.1.3) and makes it the active one. Its characters do not fit UCS-2 (UEFI
+    /// 2.11 §33.2.6.2.2).
     fn define_extended_window(&mut self) -> Result<Decoded> {
         let high = self.next()?;
         let low = self.next()?;
@@ -338,31 +348,10 @@ fn window_offset(index: u8) -> Result<u32> {
     })
 }
 
-/// The character of `code_point`, which must fit UCS-2 (UEFI 2.11 §33.2.6.2.2) and lie outside
-/// 0xF000-0xFCFF (§33.3.6.3.1).
-fn ucs2_character(code_point: u32) -> Result<char> {
-    match code_point {
-        0xF000..=0xFCFF => bail!(
-            "SCSU character U+{code_point:04X} is between 0xF000 and 0xFCFF (UEFI 2.11 \
-             §33.3.6.3.1)"
-        ),
-        0x1_0000.. => {
-            bail!("SCSU character U+{code_point:04X} is outside UCS-2 (UEFI 2.11 §33.2.6.2.2)")
-        }
-        // char::from_u32 refuses exactly the surrogates of the BMP
-        _ => char::from_u32(code_point).ok_or_else(|| surrogate(code_point)),
-    }
-}
-
-/// The refusal of the surrogate `code_point` (UEFI 2.11 §33.2.6.2.2 "UEFI does not support
-/// surrogate characters").
-fn surrogate(code_point: u32) -> anyhow::Error {
-    anyhow!("SCSU character U+{code_point:04X} is a surrogate (UEFI 2.11 §33.2.6.2.2)")
-}
-
 #[cfg(test)]
 pub(crate) mod tests {
     use super::decode;
+    use super::ScsuUnit;
 
     /// edk2's mLanguageWindow (edk2-stable202608 MdeModulePkg/Universal/HiiDatabaseDxe/String.c):
     /// UTS #6's static windows (Table 4), then its dynamic windows (Table 5).
@@ -438,20 +427,36 @@ pub(crate) mod tests {
         0xDF, 0x14, 0x80, 0x15, 0xFF,
     ];
 
-    /// The string of `code_points`.
-    fn text(code_points: &[u32]) -> String {
+    /// decode's result for `bytes` under `language_window`, with the size of the string in bytes
+    /// in place of the bytes after it, and its error as it renders.
+    fn decoded(
+        bytes: &[u8],
+        language_window: &[u16; 16],
+    ) -> Result<(Vec<ScsuUnit>, usize), String> {
+        decode(bytes, language_window)
+            .map(|(units, rest)| (units, bytes.len() - rest.len()))
+            .map_err(|err| format!("{err:#}"))
+    }
+
+    /// The characters of `code_points`.
+    fn characters(code_points: &[u32]) -> Vec<ScsuUnit> {
         code_points
             .iter()
-            .map(|&code_point| char::from_u32(code_point).expect("a code point of UTS #6"))
+            .copied()
+            .map(ScsuUnit::Character)
             .collect()
     }
 
-    /// decode's result for `bytes` under `language_window`, with the size of the string in bytes
-    /// in place of the bytes after it, and its error as it renders.
-    fn decoded(bytes: &[u8], language_window: &[u16; 16]) -> Result<(String, usize), String> {
-        decode(bytes, language_window)
-            .map(|(string, rest)| (string, bytes.len() - rest.len()))
-            .map_err(|err| format!("{err:#}"))
+    /// The units of `string`, whose U+F600-U+F8FF stand for control codes, which only 0x7F
+    /// introduces in decode_reads_every_tag.
+    fn units(string: &str) -> Vec<ScsuUnit> {
+        string
+            .chars()
+            .map(|character| match u16::try_from(u32::from(character)) {
+                Ok(code @ 0xF600..=0xF8FF) => ScsuUnit::ControlCode(code),
+                _ => ScsuUnit::Character(u32::from(character)),
+            })
+            .collect()
     }
 
     /// decode reads UTS #6's examples of German, Russian and Japanese, given a null terminator,
@@ -468,39 +473,93 @@ pub(crate) mod tests {
 
             assert_eq!(
                 decoded(&bytes, &EDK2_LANGUAGE_WINDOW),
-                Ok((text(code_points), bytes.len())),
+                Ok((characters(code_points), bytes.len())),
                 "UTS #6 §{example}"
             );
         }
     }
 
-    /// decode reads UTS #6 §9.4 up to its seventh code point, U+F000, which it refuses (UEFI
-    /// 2.11 §33.3.6.3.1).
+    /// decode reads UTS #6 §9.4, whose U+F000 and U+10FFFF UEFI rules out of strings (UEFI 2.11
+    /// §33.3.6.3.1, §33.2.6.2.2): the strings package's reader reads them as U+FFFD.
     #[test]
-    fn decode_refuses_the_uts_6_example_of_all_features_at_u_f000() {
-        // SD4 0x88: window 4 at 0x88 * 0x80 + 0xAC00 = 0xF000, then its first character
-        let before_f000 = [&ALL_SCSU[..11], &[0x00]].concat();
+    fn decode_reads_the_uts_6_example_of_all_features() {
         let all = [&ALL_SCSU[..], &[0x00]].concat();
 
-        assert_eq!(
-            decoded(&before_f000, &EDK2_LANGUAGE_WINDOW),
-            Ok((text(&ALL_CODE_POINTS[..6]), before_f000.len())),
-            "the code points before U+F000"
-        );
-        assert_eq!(
-            ALL_CODE_POINTS[6], 0xF000,
-            "UTS #6 §9.4's seventh code point"
-        );
         assert_eq!(
             decoded(&all, &EDK2_LANGUAGE_WINDOW),
-            Err(
-                "SCSU character U+F000 is between 0xF000 and 0xFCFF (UEFI 2.11 §33.3.6.3.1)"
-                    .to_string()
-            ),
+            Ok((characters(&ALL_CODE_POINTS), all.len())),
             "UTS #6 §9.4"
         );
     }
 
+    /// decode yields the characters that UEFI rules out of strings as any other: surrogates
+    /// (UEFI 2.11 §33.2.6.2.2), those between 0xF000 and 0xFCFF (§33.3.6.3.1), and those beyond
+    /// UCS-2 (§33.2.6.2.2), which only SDX, UDX or a window past 0xFF80 reach.
+    #[test]
+    fn decode_yields_the_characters_that_uefi_rules_out() {
+        let e = &EDK2_LANGUAGE_WINDOW;
+        let cases: &[(&str, &[u16; 16], &[u8], u32)] = &[
+            ("SQU D800", e, &[0x0E, 0xD8, 0x00, 0x00], 0xD800),
+            (
+                "Unicode mode DFFF",
+                e,
+                &[0x0F, 0xDF, 0xFF, 0x00, 0x00],
+                0xDFFF,
+            ),
+            (
+                "SQ1 00 in static window 1 at 0xD800",
+                &WINDOWS_PAST_UCS2,
+                &[0x02, 0x00, 0x00],
+                0xD800,
+            ),
+            ("SQU F000", e, &[0x0E, 0xF0, 0x00, 0x00], 0xF000),
+            ("SQU FCFF", e, &[0x0E, 0xFC, 0xFF, 0x00], 0xFCFF),
+            (
+                "Unicode mode F620",
+                e,
+                &[0x0F, 0xF6, 0x20, 0x00, 0x00],
+                0xF620,
+            ),
+            (
+                "SDX of window 0 at 0x10000, then 80",
+                e,
+                &[0x0B, 0x00, 0x00, 0x80, 0x00],
+                0x1_0000,
+            ),
+            (
+                "SDX of window 5 at 0x10FF80, then SQ5 FF",
+                e,
+                &[0x0B, 0xBF, 0xFF, 0x06, 0xFF, 0x00],
+                0x10_FFFF,
+            ),
+            (
+                "UDX of window 0 at 0x10000, then 80",
+                e,
+                &[0x0F, 0xF1, 0x00, 0x00, 0x80, 0x00],
+                0x1_0000,
+            ),
+            (
+                "SQ2 7F in static window 2 at 0xFFF0",
+                &WINDOWS_PAST_UCS2,
+                &[0x03, 0x7F, 0x00],
+                0x1_006F,
+            ),
+            (
+                "FF in dynamic window 0 at 0xFFC0",
+                &WINDOWS_PAST_UCS2,
+                &[0xFF, 0x00],
+                0x1_003F,
+            ),
+        ];
+        for &(case, language_window, bytes, code_point) in cases {
+            assert_eq!(
+                decoded(bytes, language_window),
+                Ok((vec![ScsuUnit::Character(code_point)], bytes.len())),
+                "{case}: {bytes:02x?}"
+            );
+        }
+    }
+
     /// decode reads each tag of UTS #6 Tables 6 and 7 and each control code of UEFI 2.11 Table
     /// 33.3, up to the first decoded U+0000, whatever bytes follow.
     #[test]
@@ -730,15 +789,15 @@ pub(crate) mod tests {
         for &(case, language_window, bytes, string, size) in cases {
             assert_eq!(
                 decoded(bytes, language_window),
-                Ok((string.to_string(), size)),
+                Ok((units(string), size)),
                 "{case}: {bytes:02x?}"
             );
         }
     }
 
     /// decode refuses a string whose bytes end first, a byte that static window 0 would read
-    /// otherwise than UTS #6's Basic Latin, an undefined control code, a reserved tag or window
-    /// offset, and a character outside UCS-2, a surrogate or one between 0xF000 and 0xFCFF.
+    /// otherwise than UTS #6's Basic Latin, an undefined control code, and a reserved tag or
+    /// window offset.
     #[test]
     fn decode_refuses_every_bad_string() {
         let e = &EDK2_LANGUAGE_WINDOW;
@@ -888,72 +947,6 @@ pub(crate) mod tests {
                 &[0x0F, 0xE8, 0x00, 0x00],
                 "reserved SCSU window offset 0x00",
             ),
-            (
-                "SQU D800",
-                e,
-                &[0x0E, 0xD8, 0x00, 0x00],
-                "SCSU character U+D800 is a surrogate (UEFI 2.11 §33.2.6.2.2)",
-            ),
-            (
-                "Unicode mode DFFF",
-                e,
-                &[0x0F, 0xDF, 0xFF, 0x00, 0x00],
-                "SCSU character U+DFFF is a surrogate (UEFI 2.11 §33.2.6.2.2)",
-            ),
-            (
-                "SQ1 00 in static window 1 at 0xD800",
-                &WINDOWS_PAST_UCS2,
-                &[0x02, 0x00, 0x00],
-                "SCSU character U+D800 is a surrogate (UEFI 2.11 §33.2.6.2.2)",
-            ),
-            (
-                "SQU F000",
-                e,
-                &[0x0E, 0xF0, 0x00, 0x00],
-                "SCSU character U+F000 is between 0xF000 and 0xFCFF (UEFI 2.11 §33.3.6.3.1)",
-            ),
-            (
-                "SQU FCFF",
-                e,
-                &[0x0E, 0xFC, 0xFF, 0x00],
-                "SCSU character U+FCFF is between 0xF000 and 0xFCFF (UEFI 2.11 §33.3.6.3.1)",
-            ),
-            (
-                "Unicode mode F620",
-                e,
-                &[0x0F, 0xF6, 0x20, 0x00, 0x00],
-                "SCSU character U+F620 is between 0xF000 and 0xFCFF (UEFI 2.11 §33.3.6.3.1)",
-            ),
-            (
-                "SDX of window 0 at 0x10000, then 80",
-                e,
-                &[0x0B, 0x00, 0x00, 0x80, 0x00],
-                "SCSU character U+10000 is outside UCS-2 (UEFI 2.11 §33.2.6.2.2)",
-            ),
-            (
-                "SDX of window 5 at 0x10FF80, then SQ5 FF",
-                e,
-                &[0x0B, 0xBF, 0xFF, 0x06, 0xFF, 0x00],
-                "SCSU character U+10FFFF is outside UCS-2 (UEFI 2.11 §33.2.6.2.2)",
-            ),
-            (
-                "UDX of window 0 at 0x10000, then 80",
-                e,
-                &[0x0F, 0xF1, 0x00, 0x00, 0x80, 0x00],
-                "SCSU character U+10000 is outside UCS-2 (UEFI 2.11 §33.2.6.2.2)",
-            ),
-            (
-                "SQ2 7F in static window 2 at 0xFFF0",
-                &WINDOWS_PAST_UCS2,
-                &[0x03, 0x7F, 0x00],
-                "SCSU character U+1006F is outside UCS-2 (UEFI 2.11 §33.2.6.2.2)",
-            ),
-            (
-                "FF in dynamic window 0 at 0xFFC0",
-                &WINDOWS_PAST_UCS2,
-                &[0xFF, 0x00],
-                "SCSU character U+1003F is outside UCS-2 (UEFI 2.11 §33.2.6.2.2)",
-            ),
         ];
         for &(case, language_window, bytes, refusal) in cases {
             assert_eq!(
diff --git a/src/lib/hii/strings.rs b/src/lib/hii/strings.rs
index 76c7a05..805d9f3 100644
--- a/src/lib/hii/strings.rs
+++ b/src/lib/hii/strings.rs
@@ -10,12 +10,14 @@
 //
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+use std::borrow::Cow;
 use std::collections::BTreeMap;
 use std::collections::BTreeSet;
 use std::ffi::CStr;
 use std::ffi::FromBytesUntilNulError;
 use std::fmt;
 use std::num::TryFromIntError;
+use std::ops::RangeInclusive;
 use std::rc::Rc;
 
 use anyhow::anyhow;
@@ -30,6 +32,7 @@ use log::warn;
 
 use super::package::PACKAGE_HEADER_SIZE;
 use super::scsu;
+use super::scsu::ScsuUnit;
 use crate::parse_error::ReadParsed;
 
 /// LANGUAGE_OFFSET is the offset of Language in a strings package: the package header, HdrSize
@@ -55,6 +58,11 @@ const MAX_CHARACTERS_PER_LENGTH_BYTE: u64 = 16;
 /// The prefix of a private-use language (Language::is_configuration).
 const PRIVATE_USE_PREFIX: &[u8] = b"x-";
 
+/// Unicode's private use area of the BMP, which UEFI 2.11 §33.2.6.2.1 counts as "6500
+/// characters": "UEFI prohibits use of this area in a UEFI environment." The common control codes
+/// lie in it (is_control_code).
+pub(crate) const PRIVATE_USE_AREA: RangeInclusive<u32> = 0xE000..=0xF8FF;
+
 // UEFI 2.10 §33.3.6.1
 #[derive(BinRead, Debug, PartialEq)]
 #[br(little)]
@@ -123,11 +131,18 @@ const EFI_HII_SIBT_FONT: u8 = 0x40;
 /// §33.3.8.2.1). A DUPLICATE's string shares the text of the string it names.
 pub(crate) type StringMap = BTreeMap<u16, Rc<str>>;
 
+/// The strings of a strings package that held a character that UEFI rules out, which reads as
+/// U+FFFD, by id: with the CHAR16s that a UCS-2 string held, which a firmware copies as they are
+/// (edk2-stable202608 SetupBrowserDxe/Setup.c GetQuestionDefault), None for an SCSU string, whose
+/// block holds no CHAR16s.
+pub(crate) type Replaced = BTreeMap<u16, Option<Rc<[u16]>>>;
+
 /// A strings package (UEFI 2.11 §33.3.6): the strings by id, in the language its header names.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct StringPackage {
     pub language: Language,
     pub strings: StringMap,
+    pub replaced: Replaced,
 }
 
 /// StringIdCurrent (UEFI 2.11 §33.3.6.2): the string identifier that the next string block
@@ -258,6 +273,28 @@ pub(crate) struct ListTexts<'a> {
     shown: Vec<&'a StringPackage>,
 }
 
+/// Which texts a QUESTION or VALUE matches: those as stored, then, where they name nothing, those
+/// that display shows. So an input that names a text as stored never selects another whose text
+/// reads alike only once the reader has replaced a character of it, or display has taken out its
+/// common control codes.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum MatchTier {
+    /// The texts as stored (ListTexts::matching)
+    Stored,
+    /// The texts that display shows (ListTexts::matching_displayed)
+    Displayed,
+}
+
+impl MatchTier {
+    /// The tiers, in the order that a match tries them.
+    pub(crate) const ALL: [Self; 2] = [Self::Stored, Self::Displayed];
+}
+
+/// A string of an SCSU block that held a character that UEFI rules out, which reads as U+FFFD:
+/// it holds no CHAR16s that a firmware copies (ListTexts::shown_units).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct ScsuRuledOut;
+
 impl<'a> ListTexts<'a> {
     /// The texts of `packages`, those of one package list, from the package that best_language
     /// picks for the first of `requested` that it picks one for, else from the first package of
@@ -282,44 +319,122 @@ impl<'a> ListTexts<'a> {
     /// configuration language that holds it, else "" (edk2-stable202608 SetupBrowserDxe
     /// GetToken shows "!"), as a firmware may leave a string untranslated or out. Unlike
     /// shown_text, it takes the chosen package also where it is of a configuration language,
-    /// as for --language x-UEFI-ns, whose prompts are the keywords.
-    pub(crate) fn display(&self, id: u16) -> &'a str {
-        let text = self
+    /// as for --language x-UEFI-ns, whose prompts are the keywords. It shows a text without its
+    /// common control codes (displayed), and a keyword as stored.
+    pub(crate) fn display(&self, id: u16) -> Cow<'a, str> {
+        match self.find(id) {
+            Some((language, text)) if language.is_configuration() => Cow::Borrowed(text),
+            Some((_, text)) => displayed(text),
+            None => Cow::Borrowed(""),
+        }
+    }
+
+    /// The text of the string `id` that display shows, as stored, else "": for a name, such as
+    /// that of a name/value storage, which must match the firmware's own.
+    pub(crate) fn stored(&self, id: u16) -> &'a str {
+        self.find(id).map_or("", |(_, text)| text)
+    }
+
+    /// The text of the string `id` that display shows, as stored, and the language of its
+    /// package: the chosen package's, else that of the first package of no configuration language
+    /// that holds it.
+    fn find(&self, id: u16) -> Option<(&'a Language, &'a str)> {
+        let found = self
             .chosen
             .into_iter()
             .chain(self.shown.iter().copied())
-            .find_map(|package| package.strings.get(&id));
-        match text {
-            Some(text) => text,
-            None => {
-                debug!("string id: {id} not found");
-                ""
-            }
+            .find_map(|package| {
+                package
+                    .strings
+                    .get(&id)
+                    .map(|text| (&package.language, text.as_ref()))
+            });
+        if found.is_none() {
+            debug!("string id: {id} not found");
         }
+        found
     }
 
-    /// The text of the string `id` that display shows, None unless a package of no configuration
-    /// language holds it: a text that a Forms Browser can show, never a keyword.
+    /// The stored text of the string `id` that display shows, None unless a package of no
+    /// configuration language holds it: a text that a Forms Browser can show, never a keyword.
     pub(crate) fn shown_text(&self, id: u16) -> Option<&'a str> {
+        self.shown_package(id)
+            .and_then(|package| package.strings.get(&id))
+            .map(AsRef::as_ref)
+    }
+
+    /// The CHAR16s of the string `id` that shown_text gives, as the firmware holds them: those
+    /// that it held where a character of it reads as U+FFFD (StringPackage::replaced), else those
+    /// of its text; Err(ScsuRuledOut) for such an SCSU string, which held none; None as
+    /// shown_text.
+    pub(crate) fn shown_units(&self, id: u16) -> Option<Result<Vec<u16>, ScsuRuledOut>> {
+        let package = self.shown_package(id)?;
+        match package.replaced.get(&id) {
+            Some(Some(units)) => Some(Ok(units.to_vec())),
+            Some(None) => Some(Err(ScsuRuledOut)),
+            None => package
+                .strings
+                .get(&id)
+                .map(|text| Ok(text.encode_utf16().collect())),
+        }
+    }
+
+    /// The package of the string `id` that shown_text gives.
+    fn shown_package(&self, id: u16) -> Option<&'a StringPackage> {
         self.chosen
             .filter(|package| !package.language.is_configuration())
             .into_iter()
             .chain(self.shown.iter().copied())
-            .find_map(|package| package.strings.get(&id))
-            .map(AsRef::as_ref)
+            .find(|package| package.strings.contains_key(&id))
     }
 
-    /// The text of the string `id` in each package of no configuration language that holds it,
-    /// with that package's language: the texts that QUESTION and VALUE match.
+    /// The text of the string `id` in each package of no configuration language that holds it as
+    /// stored, with that package's language: the texts that QUESTION and VALUE match first
+    /// (MatchTier::Stored). A text with a character that reads as U+FFFD
+    /// (StringPackage::replaced) is left out, as the firmware holds another.
     pub(crate) fn matching(&self, id: u16) -> impl Iterator<Item = (&'a Language, &'a str)> + '_ {
+        self.shown
+            .iter()
+            .filter(move |package| !package.replaced.contains_key(&id))
+            .filter_map(move |package| {
+                package
+                    .strings
+                    .get(&id)
+                    .map(|text| (&package.language, text.as_ref()))
+            })
+    }
+
+    /// The text of the string `id` that display shows, in each package of no configuration
+    /// language that holds it, replaced characters included, without its common control codes
+    /// (displayed), with that package's language: the texts that QUESTION and VALUE match where
+    /// none as stored does (MatchTier::Displayed).
+    pub(crate) fn matching_displayed(
+        &self,
+        id: u16,
+    ) -> impl Iterator<Item = (&'a Language, Cow<'a, str>)> + '_ {
         self.shown.iter().filter_map(move |package| {
             package
                 .strings
                 .get(&id)
-                .map(|text| (&package.language, text.as_ref()))
+                .map(|text| (&package.language, displayed(text)))
         })
     }
 
+    /// The texts of the string `id` that QUESTION and VALUE match in `tier`, with their languages.
+    pub(crate) fn matching_in(
+        &self,
+        id: u16,
+        tier: MatchTier,
+    ) -> Vec<(&'a Language, Cow<'a, str>)> {
+        match tier {
+            MatchTier::Stored => self
+                .matching(id)
+                .map(|(language, text)| (language, Cow::Borrowed(text)))
+                .collect(),
+            MatchTier::Displayed => self.matching_displayed(id).collect(),
+        }
+    }
+
     /// The text of the string `id` in each package of a configuration language that holds it,
     /// with that package's language, in list order: a question's keywords, if `id` is its prompt
     /// (UEFI 2.11 §35.2.1.6).
@@ -422,9 +537,14 @@ pub fn handle_string_package(data: &[u8]) -> Result<StringPackage> {
         "String package language is {}, HdrSize {hdr_size}, StringInfoOffset {string_info_offset}",
         language.0.escape_ascii()
     );
-    let strings = StringBlocks::new(string_information, language_window, length).read()?;
+    let (strings, replaced) =
+        StringBlocks::new(string_information, &language, language_window, length).read()?;
 
-    Ok(StringPackage { language, strings })
+    Ok(StringPackage {
+        language,
+        strings,
+        replaced,
+    })
 }
 
 /// UEFI 2.11 §33.3.6.2's string blocks of a strings package: "The blocks must be processed in
@@ -432,9 +552,13 @@ pub fn handle_string_package(data: &[u8]) -> Result<StringPackage> {
 struct StringBlocks<'a> {
     /// The string information from the next block on
     rest: &'a [u8],
+    /// The strings package's Language
+    language: &'a Language,
     language_window: LanguageWindow,
     string_id_current: StringIdCurrent,
     strings: StringMap,
+    /// The strings so far that held a character that UEFI rules out, each DUPLICATE's included
+    replaced: Replaced,
     /// The characters of the strings so far, each DUPLICATE's included
     characters: u64,
     /// The strings package's Length
@@ -444,22 +568,30 @@ struct StringBlocks<'a> {
 }
 
 impl<'a> StringBlocks<'a> {
-    fn new(string_information: &'a [u8], language_window: LanguageWindow, length: u64) -> Self {
+    fn new(
+        string_information: &'a [u8],
+        language: &'a Language,
+        language_window: LanguageWindow,
+        length: u64,
+    ) -> Self {
         Self {
             rest: string_information,
+            language,
             language_window,
             string_id_current: StringIdCurrent::FIRST,
             strings: StringMap::new(),
+            replaced: Replaced::new(),
             characters: 0,
             length,
             font_ids: BTreeSet::new(),
         }
     }
 
-    /// The strings of the blocks up to EFI_HII_SIBT_END. Fails at the first block that is
-    /// unknown, cut short, that breaks a rule of its block type, or that takes the strings past
-    /// MAX_CHARACTERS_PER_LENGTH_BYTE characters per byte of the package's Length.
-    fn read(mut self) -> Result<StringMap> {
+    /// The strings of the blocks up to EFI_HII_SIBT_END, and those of them that held a character
+    /// that UEFI rules out. Fails at the first block that is unknown, cut short, that breaks a
+    /// rule of its block type, or that takes the strings past MAX_CHARACTERS_PER_LENGTH_BYTE
+    /// characters per byte of the package's Length.
+    fn read(mut self) -> Result<(StringMap, Replaced)> {
         loop {
             let (&code, rest) = self
                 .rest
@@ -470,7 +602,7 @@ impl<'a> StringBlocks<'a> {
             debug!("Blocktype is {:?}", block_type);
 
             match block_type {
-                StringBlockType::End => return Ok(self.strings),
+                StringBlockType::End => return Ok((self.strings, self.replaced)),
                 StringBlockType::StringScsu => self.scsu_strings(1)?,
                 StringBlockType::StringScsuFont => {
                     self.font_identifier("EFI_HII_SIBT_STRING_SCSU_FONT")?;
@@ -558,6 +690,28 @@ impl<'a> StringBlocks<'a> {
         Ok(())
     }
 
+    /// Assigns to `id` the text of `string` (string_text), warning of the first character of it
+    /// that UEFI rules out of strings, and keeping such a string in `replaced`.
+    fn insert_text(&mut self, id: u16, string: EncodedString<'_>) -> Result<()> {
+        let (text, ruled_out) = match string {
+            EncodedString::Ucs2(units) => string_text(units.iter().copied()),
+            EncodedString::Scsu(units) => string_text(units.iter().copied()),
+        };
+        if let Some((code_point, rule)) = ruled_out {
+            warn!(
+                "string {id} of the \"{}\" strings package holds U+{code_point:04X}, which is \
+                 {rule}: it reads as U+FFFD",
+                self.language
+            );
+            let units = match string {
+                EncodedString::Ucs2(units) => Some(Rc::from(units)),
+                EncodedString::Scsu(_) => None,
+            };
+            self.replaced.insert(id, units);
+        }
+        self.insert(id, text.into())
+    }
+
     /// The StringCount of the `block` block at the start of the rest.
     fn string_count(&mut self, block: &str) -> Result<u16> {
         Ok(u16::from_le_bytes(take(
@@ -584,7 +738,7 @@ impl<'a> StringBlocks<'a> {
     fn scsu_strings(&mut self, count: u16) -> Result<()> {
         for _ in 0..count {
             let id = self.string_id_current.assign()?;
-            let (string, rest) = scsu::decode(self.rest, &self.language_window.0)
+            let (units, rest) = scsu::decode(self.rest, &self.language_window.0)
                 .with_context(|| format!("failed to decode SCSU string {id}"))?;
             // the string's bytes come before the rest that decode returns
             let size = self.rest.len() - rest.len();
@@ -602,7 +756,7 @@ impl<'a> StringBlocks<'a> {
                      HiiDatabase ends it (AsciiStrSize), so the firmware may show other strings"
                 );
             }
-            self.insert(id, string.into())?;
+            self.insert_text(id, EncodedString::Scsu(&units))?;
             self.rest = rest;
         }
         Ok(())
@@ -613,17 +767,17 @@ impl<'a> StringBlocks<'a> {
     fn ucs2_strings(&mut self, block: &str, count: u16) -> Result<()> {
         for _ in 0..count {
             let id = self.string_id_current.assign()?;
-            let (string, rest) = ucs2_string(self.rest).with_context(|| {
+            let (units, rest) = ucs2_string(self.rest).with_context(|| {
                 format!("the StringText of an {block} block has no null terminator")
             })?;
-            self.insert(id, string.into())?;
+            self.insert_text(id, EncodedString::Ucs2(&units))?;
             self.rest = rest;
         }
         Ok(())
     }
 
     /// EFI_HII_SIBT_DUPLICATE: assigns the string of its StringId, "a previously defined string"
-    /// (UEFI 2.11 §33.3.6.2.1), sharing its text.
+    /// (UEFI 2.11 §33.3.6.2.1), sharing its text and what it held where that was replaced.
     fn duplicate(&mut self) -> Result<()> {
         const BLOCK: &str = "EFI_HII_SIBT_DUPLICATE";
         let string_id = u16::from_le_bytes(take(&mut self.rest, BLOCK, "StringId")?);
@@ -631,6 +785,10 @@ impl<'a> StringBlocks<'a> {
         let string = Rc::clone(self.strings.get(&string_id).with_context(|| {
             format!("{BLOCK} StringId {string_id} names no previously defined string")
         })?);
+        if let Some(units) = self.replaced.get(&string_id) {
+            let units = units.as_ref().map(Rc::clone);
+            self.replaced.insert(id, units);
+        }
         self.insert(id, string)
     }
 
@@ -660,6 +818,8 @@ impl<'a> StringBlocks<'a> {
         let font_style = u32::from_le_bytes(take(&mut fields, BLOCK, "FontStyle")?);
         let (font_name, after) = ucs2_string(fields)
             .with_context(|| format!("the FontName of an {BLOCK} block has no null terminator"))?;
+        // read as the strings are, though only the debug log below shows it
+        let (font_name, _) = string_text(font_name);
         ensure!(
             self.font_ids.insert(font_id),
             "{BLOCK} FontId {font_id} is not unique"
@@ -683,10 +843,10 @@ fn take<const N: usize>(bytes: &mut &[u8], block: &str, field: &str) -> Result<[
     Ok(*field_bytes)
 }
 
-/// The null-terminated CHAR16 string at the start of `bytes` and the bytes after its terminator;
-/// None if `bytes` end first, which binrw's NullWideString reported in words that name no block.
-/// It decodes as UTF-16 with U+FFFD for an unpaired surrogate, as NullWideString's Display does.
-fn ucs2_string(bytes: &[u8]) -> Option<(String, &[u8])> {
+/// The CHAR16s of the null-terminated string at the start of `bytes` and the bytes after its
+/// terminator; None if `bytes` end first, which binrw's NullWideString reported in words that
+/// name no block.
+fn ucs2_string(bytes: &[u8]) -> Option<(Vec<u16>, &[u8])> {
     let (units, _) = bytes.as_chunks::<2>();
     let length = units.iter().position(|&unit| unit == [0, 0])?;
     let units: Vec<u16> = units
@@ -695,7 +855,145 @@ fn ucs2_string(bytes: &[u8]) -> Option<(String, &[u8])> {
         .map(|&unit| u16::from_le_bytes(unit))
         .collect();
     let (_, rest) = bytes.split_at_checked(2 * (length + 1))?;
-    Some((String::from_utf16_lossy(&units), rest))
+    Some((units, rest))
+}
+
+/// A string's characters, as its string block encodes them.
+#[derive(Clone, Copy, Debug)]
+enum EncodedString<'s> {
+    /// The CHAR16s of a UCS-2 string
+    Ucs2(&'s [u16]),
+    /// The units that the SCSU decoder yields
+    Scsu(&'s [ScsuUnit]),
+}
+
+/// A unit of a string's text, as its string block encodes it.
+trait EncodedUnit: Copy {
+    /// The code point that a warning names
+    fn code_point(self) -> u32;
+
+    /// Its character, or why UEFI rules it out of strings
+    fn character(self) -> Result<char, RuledOut>;
+}
+
+/// A CHAR16 of a UCS-2 string. The common control codes lie in the private use area and between
+/// 0xF000 and 0xFCFF, yet UCS-2 strings may hold them (UEFI 2.11 §33.2.6.2.4), so they are taken
+/// first.
+impl EncodedUnit for u16 {
+    fn code_point(self) -> u32 {
+        u32::from(self)
+    }
+
+    fn character(self) -> Result<char, RuledOut> {
+        match is_control_code(self.code_point()) {
+            // char::from_u32 refuses exactly the surrogates of the BMP, which hold no control code
+            true => char::from_u32(self.code_point()).ok_or(RuledOut::Surrogate),
+            false => character(self.code_point()),
+        }
+    }
+}
+
+/// A unit of an SCSU string. SCSU encodes control codes through 0x7F alone (UEFI 2.11
+/// §33.2.6.2.4), so a character between 0xF000 and 0xFCFF, a control code's 0xFxyy form among
+/// them, is ruled out (§33.3.6.3.1).
+impl EncodedUnit for ScsuUnit {
+    fn code_point(self) -> u32 {
+        match self {
+            Self::Character(code_point) => code_point,
+            Self::ControlCode(code) => code.code_point(),
+        }
+    }
+
+    fn character(self) -> Result<char, RuledOut> {
+        match self {
+            Self::Character(code_point) => character(code_point),
+            Self::ControlCode(code) => code.character(),
+        }
+    }
+}
+
+/// Why UEFI rules a character out of strings.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum RuledOut {
+    /// 0xD800-0xDFFF: "UEFI does not support surrogate characters" (UEFI 2.11 §33.2.6.2.2)
+    Surrogate,
+    /// PRIVATE_USE_AREA, 0xE000-0xF8FF
+    PrivateUse,
+    /// 0xF900-0xFCFF, the rest of "Characters between 0xF000 and 0xFCFF should be rejected" (UEFI
+    /// 2.11 §33.3.6.3.1, §33.3.6.3.2) past the private use area
+    F000ToFcff,
+    /// Past 0xFFFF, as an SCSU string may encode: "The UEFI specification uses UCS-2" (UEFI 2.11
+    /// §33.2.6.2.2)
+    OutsideUcs2,
+}
+
+impl fmt::Display for RuledOut {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Self::Surrogate => "a surrogate (UEFI 2.11 §33.2.6.2.2)",
+            Self::PrivateUse => "in the private use area (UEFI 2.11 §33.2.6.2.1)",
+            Self::F000ToFcff => "between 0xF000 and 0xFCFF (UEFI 2.11 §33.3.6.3.1, §33.3.6.3.2)",
+            Self::OutsideUcs2 => "outside UCS-2 (UEFI 2.11 §33.2.6.2.2)",
+        })
+    }
+}
+
+/// Whether `code_point` is a common control code of UEFI 2.11 Table 33.3: 0xF620-0xF62B, 0xF7zz
+/// or 0xF8zz (§33.2.6.2.4).
+pub(crate) fn is_control_code(code_point: u32) -> bool {
+    matches!(code_point, 0xF620..=0xF62B | 0xF700..=0xF8FF)
+}
+
+/// Whether `character` is a common control code (is_control_code).
+pub(crate) fn is_control_character(character: char) -> bool {
+    is_control_code(u32::from(character))
+}
+
+/// `text` without its common control codes, display hints that "different platforms may ignore"
+/// (UEFI 2.11 §33.2.6.2.4): the text that get, set, list-questions and show-ifr show, and that
+/// QUESTION and VALUE match where no text as stored names a question or option (MatchTier).
+/// Texts equal only after this stripping are then equal prompts, which select resolves to the
+/// first selectable match in IFR order.
+fn displayed(text: &str) -> Cow<'_, str> {
+    match text.contains(is_control_character) {
+        true => Cow::Owned(text.replace(is_control_character, "")),
+        false => Cow::Borrowed(text),
+    }
+}
+
+/// The character of the code point `code_point` of a string, or why UEFI rules it out, a common
+/// control code's code point included: only EncodedUnit takes control codes.
+fn character(code_point: u32) -> Result<char, RuledOut> {
+    match code_point {
+        code_point if PRIVATE_USE_AREA.contains(&code_point) => return Err(RuledOut::PrivateUse),
+        0xF900..=0xFCFF => return Err(RuledOut::F000ToFcff),
+        0x1_0000.. => return Err(RuledOut::OutsideUcs2),
+        _ => {}
+    }
+    // char::from_u32 refuses exactly the surrogates of the BMP
+    char::from_u32(code_point).ok_or(RuledOut::Surrogate)
+}
+
+/// The text of the string of `units`, each its own character, and the first of them that UEFI
+/// rules out, with its code point and why (EncodedUnit). One that UEFI rules out reads as
+/// U+FFFD, as String::from_utf16_lossy reads an unpaired surrogate. A QUESTION or VALUE matches
+/// such a text only where no text as stored names a question or option (MatchTier), and texts
+/// equal after this replacement are then equal prompts, which select resolves to the first
+/// selectable match in IFR order.
+fn string_text<U: EncodedUnit>(
+    units: impl IntoIterator<Item = U>,
+) -> (String, Option<(u32, RuledOut)>) {
+    let mut first_ruled_out = None;
+    let text = units
+        .into_iter()
+        .map(|unit| {
+            unit.character().unwrap_or_else(|rule| {
+                first_ruled_out.get_or_insert((unit.code_point(), rule));
+                char::REPLACEMENT_CHARACTER
+            })
+        })
+        .collect();
+    (text, first_ruled_out)
 }
 
 /// The index in a strings package's data, which starts after its package header, of the offset
@@ -797,18 +1095,132 @@ mod tests {
         for (requested, id, shown, displayed) in cases {
             let texts = ListTexts::new(&packages, &[requested]);
             assert_eq!(
-                (texts.shown_text(id), texts.display(id)),
+                (texts.shown_text(id), texts.display(id).as_ref()),
                 (shown, displayed),
                 "string {id}, requested {requested:?}"
             );
         }
     }
 
+    /// display and matching_displayed take the common control codes out of a text, wherever they
+    /// lie, but not out of a keyword, which display shows as stored, as keywords gives it, while a
+    /// text that display falls back on for --language x-UEFI loses them; stored, shown_text and
+    /// matching give the text as stored.
+    #[test]
+    fn texts_show_and_match_without_control_codes_and_keywords_with_them() {
+        let packages = [
+            StringPackage {
+                strings: StringMap::from([(1, Rc::from("\u{F620}Keyword"))]),
+                ..package("x-UEFI-ns")
+            },
+            StringPackage {
+                strings: StringMap::from([
+                    (1, Rc::from("\u{F620}Pr\u{F7AB}ompt\u{F621}")),
+                    (2, Rc::from("Q\u{F7AB}")),
+                ]),
+                ..package("en-US")
+            },
+        ];
+        let stored = "\u{F620}Pr\u{F7AB}ompt\u{F621}";
+
+        let texts = ListTexts::new(&packages, &["en-US"]);
+        assert_eq!(texts.display(1), "Prompt", "display");
+        assert_eq!(texts.display(2), "Q", "display of a trailing control code");
+        assert_eq!(texts.stored(1), stored, "stored");
+        assert_eq!(texts.shown_text(1), Some(stored), "shown_text");
+        let matching: Vec<(String, String)> = MatchTier::ALL
+            .into_iter()
+            .flat_map(|tier| texts.matching_in(1, tier))
+            .map(|(language, text)| (language.to_string(), text.into_owned()))
+            .collect();
+        assert_eq!(
+            matching,
+            [
+                ("en-US".to_string(), stored.to_string()),
+                ("en-US".to_string(), "Prompt".to_string())
+            ],
+            "matching, then matching_displayed"
+        );
+        let keywords: Vec<(String, &str)> = texts
+            .keywords(1)
+            .map(|(language, text)| (language.to_string(), text))
+            .collect();
+        assert_eq!(
+            keywords,
+            [("x-UEFI-ns".to_string(), "\u{F620}Keyword")],
+            "keywords"
+        );
+
+        let texts = ListTexts::new(&packages, &["x-UEFI"]);
+        assert_eq!(
+            texts.display(1),
+            "\u{F620}Keyword",
+            "display of --language x-UEFI"
+        );
+        assert_eq!(
+            texts.display(2),
+            "Q",
+            "display of --language x-UEFI, falling back on en-US"
+        );
+    }
+
+    /// character takes each rule up to its bounds, for a CHAR16 of a UCS-2 string the common
+    /// control codes first, which lie in the private use area. An SCSU character is ruled out
+    /// there, and past UCS-2: only an SCSU control code, which 0x7F introduces, is one.
+    #[test]
+    fn character_rules_out_each_range_up_to_its_bounds() {
+        let private_use = Err(RuledOut::PrivateUse);
+        // the CHAR16 or code point, then its character in a UCS-2 string and in an SCSU one
+        let cases: &[(u16, _, _)] = &[
+            (0xD7FF, Ok('\u{D7FF}'), Ok('\u{D7FF}')),
+            (0xD800, Err(RuledOut::Surrogate), Err(RuledOut::Surrogate)),
+            (0xDFFF, Err(RuledOut::Surrogate), Err(RuledOut::Surrogate)),
+            (0xE000, private_use, private_use),
+            (0xF61F, private_use, private_use),
+            (0xF620, Ok('\u{F620}'), private_use),
+            (0xF62B, Ok('\u{F62B}'), private_use),
+            (0xF62C, private_use, private_use),
+            (0xF6FF, private_use, private_use),
+            (0xF700, Ok('\u{F700}'), private_use),
+            (0xF8FF, Ok('\u{F8FF}'), private_use),
+            (0xF900, Err(RuledOut::F000ToFcff), Err(RuledOut::F000ToFcff)),
+            (0xFCFF, Err(RuledOut::F000ToFcff), Err(RuledOut::F000ToFcff)),
+            (0xFD00, Ok('\u{FD00}'), Ok('\u{FD00}')),
+            (0xFFFF, Ok('\u{FFFF}'), Ok('\u{FFFF}')),
+        ];
+        for &(unit, ucs2, scsu) in cases {
+            assert_eq!(unit.character(), ucs2, "CHAR16 {unit:#06x}");
+            let character = ScsuUnit::Character(u32::from(unit));
+            assert_eq!(character.character(), scsu, "SCSU U+{unit:04X}");
+        }
+
+        for code_point in [0x1_0000, 0x10_FFFF, 0x11_0000] {
+            let character = ScsuUnit::Character(code_point).character();
+            assert_eq!(
+                character,
+                Err(RuledOut::OutsideUcs2),
+                "SCSU U+{code_point:04X}"
+            );
+        }
+
+        let control_codes = [
+            (0xF620, '\u{F620}'),
+            (0xF62B, '\u{F62B}'),
+            (0xF700, '\u{F700}'),
+            (0xF8FF, '\u{F8FF}'),
+        ];
+        for (code, want) in control_codes {
+            let character = ScsuUnit::ControlCode(code).character();
+            assert_eq!(character, Ok(want), "SCSU control code {code:#06x}");
+        }
+    }
+
     /// A strings package of `language` without strings.
     fn package(language: &str) -> StringPackage {
         StringPackage {
             language: Language(language.as_bytes().to_vec()),
             strings: BTreeMap::new(),
+            replaced: Replaced::new(),
         }
     }
 }
diff --git a/src/lib/hii/variable_changes.rs b/src/lib/hii/variable_changes.rs
new file mode 100644
index 0000000..545ccc4
--- /dev/null
+++ b/src/lib/hii/variable_changes.rs
@@ -0,0 +1,921 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The EFI variables that a driver's code (DriverCode) changed: every variable that
+//! GetNextVariableName() lists is read before and after, but those of uefisettings' own vendor
+//! GUID, which are no driver's. The list only informs: a change outside the FormSet's stores may
+//! be the driver's own business, as a question without a VarStore keeps its value somewhere.
+//! A change of withheld bytes, those of a password, which reads give as zero, refuses instead,
+//! as does a password whose bytes cannot be compared: uefisettings never writes them back. The
+//! withheld bytes are compared in every variable that they were recorded for, listed or not,
+//! uefisettings' own too, and in every listed variable that withholds any, each read once.
+
+use std::collections::BTreeMap;
+use std::collections::BTreeSet;
+use std::fmt;
+
+use crate::efi_variables::VariableContents;
+use crate::efi_variables::VariableData;
+use crate::efi_variables::VariableNames;
+use crate::efi_variables::UEFISETTINGS_VENDOR_GUID;
+use crate::hii::question_callbacks::ActionRequest;
+use crate::hii::variables::WithheldWitness;
+use crate::hii::VariableKey;
+use crate::hii::WithholdingVariables;
+
+/// The driver code that a VariableSnapshot is compared across, which its refusals name.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum DriverCode {
+    /// The Callback()s of get's or set's sequence, with the reads and the restore of the
+    /// FormSet's stores around them
+    CallbackSequence,
+    /// The reconnection that EFI_BROWSER_ACTION_REQUEST_RECONNECT asks for
+    Reconnection,
+    /// SetData() of EFI_CONFIG_KEYWORD_HANDLER_PROTOCOL, with the GetData() that reads it back
+    SetData,
+    /// GetData() of EFI_CONFIG_KEYWORD_HANDLER_PROTOCOL
+    GetData,
+}
+
+impl fmt::Display for DriverCode {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::CallbackSequence => write!(f, "the Callback sequence"),
+            Self::Reconnection => write!(
+                f,
+                "the reconnection that {} asks for",
+                ActionRequest::RECONNECT
+            ),
+            Self::SetData => write!(f, "SetData()"),
+            Self::GetData => write!(f, "GetData()"),
+        }
+    }
+}
+
+/// Every EFI variable but uefisettings' own at one time, or why they could not be listed, and
+/// the witnesses of the withheld bytes.
+pub(crate) struct VariableSnapshot {
+    listed: Result<BTreeMap<VariableKey, Read>, String>,
+    /// For each variable whose withheld bytes are compared: their witness, None if it is
+    /// absent, or why it could not be read
+    witnesses: BTreeMap<VariableKey, Result<Option<WithheldWitness>, String>>,
+}
+
+/// What changed since a VariableSnapshot.
+pub(crate) struct VariableChanges {
+    /// Each variable that differs, as `"<name>-<guid> (created)"`, `"(deleted)"` or
+    /// `"(changed)"`, or why they could not be compared
+    pub(crate) listed: Vec<String>,
+    withheld: Vec<WithheldRefusal>,
+}
+
+/// What reading one listed variable gave.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Read {
+    Contents(VariableContents),
+    /// GetVariable() found none, although it was listed
+    Absent,
+    /// GetVariable()'s error, as `{:#}` shows it
+    Failed(String),
+}
+
+/// Why withheld bytes refuse what driver code did.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum WithheldRefusal {
+    /// The withheld bytes of the variable changed, also by its creation or deletion
+    Changed(VariableKey),
+    /// The withheld bytes of the variable could not be read: the error, as `{:#}` shows it
+    Unreadable { key: VariableKey, error: String },
+    /// GetNextVariableName() failed where some variable withholds bytes: its error
+    Unlisted(String),
+}
+
+impl VariableSnapshot {
+    /// Refuses where withheld bytes could not be read or listed, as a change of them across `by`
+    /// would go unseen.
+    pub(crate) fn take<V: VariableData + VariableNames>(
+        variables: &WithholdingVariables<V>,
+        by: DriverCode,
+    ) -> Result<Self, String> {
+        let snapshot = Self::read(variables, []);
+        let unreadable = snapshot.witnesses.iter().filter_map(|(key, witness)| {
+            witness
+                .as_ref()
+                .err()
+                .map(|error| WithheldRefusal::Unreadable {
+                    key: key.clone(),
+                    error: error.clone(),
+                })
+        });
+        let refusals: Vec<WithheldRefusal> = unreadable
+            .chain(unlisted(&snapshot.listed, variables))
+            .collect();
+        match refusal_text(&refusals, by) {
+            Some(refusal) => Err(refusal),
+            None => Ok(snapshot),
+        }
+    }
+
+    /// What differs from this snapshot now. It can be compared again, after more driver code.
+    pub(crate) fn changes<V: VariableData + VariableNames>(
+        &self,
+        variables: &WithholdingVariables<V>,
+    ) -> VariableChanges {
+        let now = Self::read(variables, self.witnesses.keys().cloned());
+        let listed = match (&self.listed, &now.listed) {
+            (Ok(before), Ok(now)) => listed_changes(before, now),
+            (Err(error), _) | (Ok(_), Err(error)) => {
+                vec![format!("not compared: GetNextVariableName(): {error}")]
+            }
+        };
+        let keys: BTreeSet<&VariableKey> =
+            self.witnesses.keys().chain(now.witnesses.keys()).collect();
+        let witnessed = keys.into_iter().filter_map(|key| {
+            match (
+                witness_of(&self.witnesses, key),
+                witness_of(&now.witnesses, key),
+            ) {
+                (Err(error), _) | (_, Err(error)) => Some(WithheldRefusal::Unreadable {
+                    key: key.clone(),
+                    error: error.to_owned(),
+                }),
+                (Ok(earlier), Ok(now)) => {
+                    (earlier != now).then(|| WithheldRefusal::Changed(key.clone()))
+                }
+            }
+        });
+        let unlisted =
+            unlisted(&self.listed, variables).or_else(|| unlisted(&now.listed, variables));
+        VariableChanges {
+            listed,
+            withheld: witnessed.chain(unlisted).collect(),
+        }
+    }
+
+    /// Reads every listed variable, and the withheld bytes of each that `variables` recorded
+    /// them for, of each listed one that withholds any and of `also`, each once.
+    fn read<V: VariableData + VariableNames>(
+        variables: &WithholdingVariables<V>,
+        also: impl IntoIterator<Item = VariableKey>,
+    ) -> Self {
+        let names = variables
+            .variable_names()
+            .map_err(|error| format!("{error:#}"));
+        let listed_keys: BTreeSet<VariableKey> = names
+            .iter()
+            .flatten()
+            .filter(|key| key.guid != UEFISETTINGS_VENDOR_GUID)
+            .cloned()
+            .collect();
+        let witnessed_keys: BTreeSet<VariableKey> = variables
+            .named()
+            .cloned()
+            .chain(also)
+            .chain(
+                names
+                    .iter()
+                    .flatten()
+                    .filter(|key| variables.withholds(key))
+                    .cloned(),
+            )
+            .collect();
+        let mut listed = BTreeMap::new();
+        let mut witnesses = BTreeMap::new();
+        for key in listed_keys.union(&witnessed_keys) {
+            let (read, witness) = match variables.witnessed_data(key) {
+                Ok(Some((contents, witness))) => (Read::Contents(contents), Ok(witness)),
+                Ok(None) => (Read::Absent, Ok(None)),
+                Err(error) => {
+                    let error = format!("{error:#}");
+                    (Read::Failed(error.clone()), Err(error))
+                }
+            };
+            if listed_keys.contains(key) {
+                listed.insert(key.clone(), read);
+            }
+            if witnessed_keys.contains(key) {
+                witnesses.insert(key.clone(), witness);
+            }
+        }
+        Self {
+            listed: names.map(|_| listed),
+            witnesses,
+        }
+    }
+}
+
+impl VariableChanges {
+    /// Why the withheld bytes refuse what `by` did, if they do: each variable whose withheld
+    /// bytes changed or could not be compared.
+    pub(crate) fn refusal(&self, by: DriverCode) -> Option<String> {
+        refusal_text(&self.withheld, by)
+    }
+}
+
+impl WithheldRefusal {
+    /// The refusal in words, of what `by` did.
+    fn text(&self, by: DriverCode) -> String {
+        match self {
+            Self::Changed(key) => format!(
+                "{by} changed the password bytes of EFI variable {key}; they were not restored, \
+                 as uefisettings never writes a password byte"
+            ),
+            Self::Unreadable { key, error } => format!(
+                "cannot compare the password bytes of EFI variable {key} across {by}: {error}"
+            ),
+            Self::Unlisted(error) => format!(
+                "cannot compare the password bytes of EFI variables across {by}: \
+                 GetNextVariableName(): {error}"
+            ),
+        }
+    }
+}
+
+/// The variables that differ from `before` to `now`, sorted.
+fn listed_changes(
+    before: &BTreeMap<VariableKey, Read>,
+    now: &BTreeMap<VariableKey, Read>,
+) -> Vec<String> {
+    let deleted = before
+        .keys()
+        .filter(|key| !now.contains_key(*key))
+        .map(|key| format!("{key} (deleted)"));
+    let created_or_changed = now.iter().filter_map(|(key, read)| match before.get(key) {
+        None => Some(format!("{key} (created)")),
+        Some(earlier) if earlier != read => Some(format!("{key} (changed)")),
+        Some(_) => None,
+    });
+    let mut listed: Vec<String> = deleted.chain(created_or_changed).collect();
+    listed.sort();
+    listed
+}
+
+/// The witness of the withheld bytes of `key` in `witnesses`, None where it has none: a
+/// variable that was neither recorded nor listed did not exist then.
+fn witness_of<'a>(
+    witnesses: &'a BTreeMap<VariableKey, Result<Option<WithheldWitness>, String>>,
+    key: &VariableKey,
+) -> Result<Option<&'a WithheldWitness>, &'a str> {
+    match witnesses.get(key) {
+        Some(witness) => witness.as_ref().map(Option::as_ref).map_err(String::as_str),
+        None => Ok(None),
+    }
+}
+
+/// The refusal of a listing that failed, where some variable of `variables` may withhold bytes,
+/// which a variable that it did not list may hold.
+fn unlisted<V: VariableData>(
+    listed: &Result<BTreeMap<VariableKey, Read>, String>,
+    variables: &WithholdingVariables<V>,
+) -> Option<WithheldRefusal> {
+    match listed {
+        Err(error) if variables.withholds_any() => Some(WithheldRefusal::Unlisted(error.clone())),
+        Ok(_) | Err(_) => None,
+    }
+}
+
+/// `refusals` in words, of what `by` did, if there are any.
+fn refusal_text(refusals: &[WithheldRefusal], by: DriverCode) -> Option<String> {
+    (!refusals.is_empty()).then(|| {
+        refusals
+            .iter()
+            .map(|refusal| refusal.text(by))
+            .collect::<Vec<_>>()
+            .join("; ")
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::Cell;
+    use std::cell::RefCell;
+    use std::ops::Range;
+
+    use anyhow::anyhow;
+    use anyhow::Result;
+
+    use super::*;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::tests::NV_BS_RT;
+    use crate::hii::form_set_stores::tests::STORE_GUID;
+    use crate::hii::package::Guid;
+    use crate::hii::variables::VariableGuids;
+    use crate::hii::variables::WithheldBytes;
+    use crate::hii::VariableAttributes;
+    use crate::hii::VariableInterface;
+
+    /// The driver code that most tests compare across.
+    const BY: DriverCode = DriverCode::CallbackSequence;
+
+    fn contents(data: &[u8]) -> VariableContents {
+        VariableContents::new(NV_BS_RT, data.to_vec()).expect("data")
+    }
+
+    /// `variables` with `bytes` of each named variable withheld.
+    fn withholding<V>(variables: V, bytes: &[(&str, Range<usize>)]) -> WithholdingVariables<V> {
+        let mut withheld = WithheldBytes::default();
+        for (name, bytes) in bytes {
+            withheld.insert(key(name, STORE_GUID), bytes.clone());
+        }
+        WithholdingVariables::new(variables, withheld)
+    }
+
+    #[test]
+    fn lists_created_deleted_and_changed_variables_but_uefisettings_own() {
+        let variables = HeldVariables::default()
+            .with("Kept", STORE_GUID, &[1])
+            .with("Changed", STORE_GUID, &[1])
+            .with("Deleted", STORE_GUID, &[1]);
+        let withheld = withholding(&variables, &[]);
+        let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+        {
+            let mut held = variables.variables.borrow_mut();
+            held.insert(key("Changed", STORE_GUID), contents(&[2]));
+            held.remove(&key("Deleted", STORE_GUID));
+            held.insert(key("Created", STORE_GUID), contents(&[3]));
+            held.insert(key("Record", UEFISETTINGS_VENDOR_GUID), contents(&[4]));
+        }
+
+        let changes = before.changes(&withheld);
+
+        assert_eq!(
+            changes.listed,
+            [
+                format!("{} (changed)", key("Changed", STORE_GUID)),
+                format!("{} (created)", key("Created", STORE_GUID)),
+                format!("{} (deleted)", key("Deleted", STORE_GUID)),
+            ],
+            "the changes, without uefisettings' own variable"
+        );
+        assert_eq!(
+            changes.refusal(BY),
+            None,
+            "nothing withheld, nothing refused"
+        );
+    }
+
+    #[test]
+    fn unchanged_variables_list_nothing() {
+        let variables = HeldVariables::default().with("Kept", STORE_GUID, &[1]);
+        let withheld = withholding(&variables, &[]);
+        let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+
+        let changes = before.changes(&withheld);
+
+        assert!(changes.listed.is_empty(), "no change, no listing");
+        assert_eq!(changes.refusal(BY), None, "no change, no refusal");
+    }
+
+    #[test]
+    fn attributes_alone_count_as_a_change() {
+        let variables = HeldVariables::default().with("Kept", STORE_GUID, &[1]);
+        let withheld = withholding(&variables, &[]);
+        let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+        variables.variables.borrow_mut().insert(
+            key("Kept", STORE_GUID),
+            VariableContents::new(VariableAttributes::NON_VOLATILE, vec![1]).expect("data"),
+        );
+
+        assert_eq!(
+            before.changes(&withheld).listed,
+            [format!("{} (changed)", key("Kept", STORE_GUID))],
+            "the new attributes"
+        );
+    }
+
+    /// The refusal of a change of the withheld bytes of `key` across the Callback sequence.
+    fn overwritten(key: &VariableKey) -> String {
+        format!(
+            "the Callback sequence changed the password bytes of EFI variable {key}; they were \
+             not restored, as uefisettings never writes a password byte"
+        )
+    }
+
+    /// The refusal of a change of the withheld bytes of `name`.
+    fn overwritten_refusal(name: &str) -> Option<String> {
+        Some(overwritten(&key(name, STORE_GUID)))
+    }
+
+    #[test]
+    fn withheld_bytes_refuse_whenever_they_change_and_only_then() {
+        let listed = |name: &str, how: &str| vec![format!("{} {how}", key(name, STORE_GUID))];
+        let one: &[(&str, Range<usize>)] = &[("Store", 1..3)];
+        let two: &[(&str, Range<usize>)] = &[("Store", 0..1), ("Store", 2..3)];
+        let cases = [
+            (
+                "kept",
+                one,
+                &[1, 2, 3, 4][..],
+                Some(&[1, 2, 3, 4][..]),
+                vec![],
+                None,
+            ),
+            (
+                "beside the withheld bytes",
+                one,
+                &[1, 2, 3, 4],
+                Some(&[9, 2, 3, 4]),
+                listed("Store", "(changed)"),
+                None,
+            ),
+            (
+                "withheld bytes",
+                one,
+                &[1, 2, 3, 4],
+                Some(&[1, 9, 3, 4]),
+                vec![],
+                overwritten_refusal("Store"),
+            ),
+            (
+                "cut off",
+                one,
+                &[1, 2, 3, 4],
+                Some(&[1, 2]),
+                listed("Store", "(changed)"),
+                overwritten_refusal("Store"),
+            ),
+            (
+                "grown into",
+                one,
+                &[1, 2],
+                Some(&[1, 2, 3, 4]),
+                listed("Store", "(changed)"),
+                overwritten_refusal("Store"),
+            ),
+            (
+                "deleted",
+                one,
+                &[1, 2, 3, 4],
+                None,
+                listed("Store", "(deleted)"),
+                overwritten_refusal("Store"),
+            ),
+            (
+                "between two withheld ranges",
+                two,
+                &[1, 2, 3, 4],
+                Some(&[1, 9, 3, 4]),
+                listed("Store", "(changed)"),
+                None,
+            ),
+            (
+                "the second of two withheld ranges",
+                two,
+                &[1, 2, 3, 4],
+                Some(&[1, 2, 9, 4]),
+                vec![],
+                overwritten_refusal("Store"),
+            ),
+        ];
+        for (name, ranges, before_data, now_data, want_listed, want_refusal) in cases {
+            let variables = HeldVariables::default().with("Store", STORE_GUID, before_data);
+            let withheld = withholding(&variables, ranges);
+            let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+            {
+                let mut held = variables.variables.borrow_mut();
+                match now_data {
+                    Some(data) => held.insert(key("Store", STORE_GUID), contents(data)),
+                    None => held.remove(&key("Store", STORE_GUID)),
+                };
+            }
+
+            let changes = before.changes(&withheld);
+
+            assert_eq!(changes.listed, want_listed, "{name}: the listing");
+            assert_eq!(changes.refusal(BY), want_refusal, "{name}: the refusal");
+        }
+    }
+
+    #[test]
+    fn withheld_bytes_to_the_end_of_the_value_refuse_when_they_change() {
+        let mut past_end = WithheldBytes::default();
+        past_end.insert(key("Store", STORE_GUID), 1..8);
+        let mut whole = WithheldBytes::default();
+        whole.insert(key("Store", STORE_GUID), 0..usize::MAX);
+        let cases = [
+            ("bytes past the end of the value", past_end),
+            ("a whole variable", whole),
+            ("the variables of a GUID", whole_variables(Some(STORE_GUID))),
+            ("every variable", whole_variables(None)),
+        ];
+        for (name, bytes) in cases {
+            let variables = HeldVariables::default().with("Store", STORE_GUID, &[1, 2, 3, 4]);
+            let withheld = WithholdingVariables::new(&variables, bytes);
+            let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+            variables
+                .variables
+                .borrow_mut()
+                .insert(key("Store", STORE_GUID), contents(&[1, 2, 3, 9]));
+
+            let changes = before.changes(&withheld);
+
+            assert!(
+                changes.listed.is_empty(),
+                "{name}: no byte that a read shows changed: {:?}",
+                changes.listed
+            );
+            assert_eq!(
+                changes.refusal(BY),
+                overwritten_refusal("Store"),
+                "{name}: the refusal"
+            );
+        }
+    }
+
+    #[test]
+    fn a_created_variable_refuses_where_it_withholds_bytes() {
+        let variables = HeldVariables::default();
+        let withheld = withholding(&variables, &[("Whole", 0..usize::MAX)]);
+        let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+        {
+            let mut held = variables.variables.borrow_mut();
+            held.insert(key("Whole", STORE_GUID), contents(&[1]));
+            held.insert(key("Other", STORE_GUID), contents(&[1]));
+        }
+
+        let changes = before.changes(&withheld);
+
+        assert_eq!(
+            changes.listed,
+            [
+                format!("{} (created)", key("Other", STORE_GUID)),
+                format!("{} (created)", key("Whole", STORE_GUID)),
+            ],
+            "both listed"
+        );
+        assert_eq!(
+            changes.refusal(BY),
+            overwritten_refusal("Whole"),
+            "only the variable that withholds bytes refuses"
+        );
+    }
+
+    #[test]
+    fn a_created_variable_of_a_guid_withheld_whole_refuses_as_changed() {
+        let variables = HeldVariables::default();
+        let withheld = WithholdingVariables::new(&variables, whole_variables(Some(STORE_GUID)));
+        let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+        variables
+            .variables
+            .borrow_mut()
+            .insert(key("Created", STORE_GUID), contents(&[1]));
+
+        assert_eq!(
+            before.changes(&withheld).refusal(BY),
+            overwritten_refusal("Created"),
+            "a variable that nothing named, created under a GUID withheld whole"
+        );
+    }
+
+    /// Data whose metadata metadata_end refuses, which hides where the value starts.
+    fn unreadable_value() -> VariableContents {
+        VariableContents::new(
+            NV_BS_RT | VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS,
+            vec![1],
+        )
+        .expect("data")
+    }
+
+    #[test]
+    fn withheld_bytes_that_cannot_be_read_refuse() {
+        let refusal = format!(
+            "cannot compare the password bytes of EFI variable {} across the Callback sequence: ",
+            key("Store", STORE_GUID)
+        );
+        let variables = HeldVariables::default();
+        variables
+            .variables
+            .borrow_mut()
+            .insert(key("Store", STORE_GUID), unreadable_value());
+        let unwithheld = withholding(&variables, &[]);
+        let withheld = withholding(&variables, &[("Store", 1..3)]);
+
+        assert!(
+            VariableSnapshot::take(&unwithheld, BY).is_ok(),
+            "an unreadable variable that withholds nothing does not refuse"
+        );
+        assert!(
+            matches!(VariableSnapshot::take(&withheld, BY), Err(reason) if reason.starts_with(&refusal)),
+            "unreadable before"
+        );
+
+        variables
+            .variables
+            .borrow_mut()
+            .insert(key("Store", STORE_GUID), contents(&[1, 2, 3, 4]));
+        let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+        variables
+            .variables
+            .borrow_mut()
+            .insert(key("Store", STORE_GUID), unreadable_value());
+        let changes = before.changes(&withheld);
+        assert!(
+            matches!(&changes.refusal(BY), Some(reason) if reason.starts_with(&refusal)),
+            "unreadable after: {:?}",
+            changes.refusal(BY)
+        );
+    }
+
+    /// Variables whose listing fails while `fails` holds.
+    struct FlakyNames {
+        variables: HeldVariables,
+        fails: Cell<bool>,
+    }
+
+    impl VariableData for FlakyNames {
+        fn interface(&self) -> VariableInterface {
+            self.variables.interface()
+        }
+
+        fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
+            self.variables.variable_data(key)
+        }
+
+        fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()> {
+            self.variables.set_variable(key, contents)
+        }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            self.variables.delete_variable(key)
+        }
+    }
+
+    impl VariableNames for FlakyNames {
+        fn variable_names(&self) -> Result<Vec<VariableKey>> {
+            match self.fails.get() {
+                true => Err(anyhow!("EFI_DEVICE_ERROR")),
+                false => self.variables.variable_names(),
+            }
+        }
+    }
+
+    /// The bytes of every variable of `guid` withheld, or of every variable for None.
+    fn whole_variables(guid: Option<Guid>) -> WithheldBytes {
+        let mut guids = VariableGuids::default();
+        guids.insert(guid);
+        let mut withheld = WithheldBytes::default();
+        withheld.insert_guids(&guids);
+        withheld
+    }
+
+    #[test]
+    fn an_unlisted_variable_refuses_only_where_bytes_are_withheld() {
+        let refusal = Some(
+            "cannot compare the password bytes of EFI variables across the Callback sequence: \
+             GetNextVariableName(): EFI_DEVICE_ERROR"
+                .to_string(),
+        );
+        let note = vec!["not compared: GetNextVariableName(): EFI_DEVICE_ERROR".to_string()];
+        let mut store_bytes = WithheldBytes::default();
+        store_bytes.insert(key("Store", STORE_GUID), 1..3);
+        let cases = [
+            ("nothing withheld", WithheldBytes::default(), None),
+            ("bytes of a variable", store_bytes, refusal.clone()),
+            (
+                "the variables of a GUID",
+                whole_variables(Some(STORE_GUID)),
+                refusal.clone(),
+            ),
+            ("every variable", whole_variables(None), refusal),
+        ];
+        for (name, bytes, want) in cases {
+            let variables = FlakyNames {
+                variables: HeldVariables::default().with("Store", STORE_GUID, &[1, 2, 3, 4]),
+                fails: Cell::new(true),
+            };
+            let withheld = WithholdingVariables::new(&variables, bytes);
+
+            assert_eq!(
+                VariableSnapshot::take(&withheld, BY).err(),
+                want,
+                "{name}: unlisted before"
+            );
+
+            variables.fails.set(false);
+            let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+            variables.fails.set(true);
+            let changes = before.changes(&withheld);
+            assert_eq!(changes.listed, note, "{name}: unlisted after, the note");
+            assert_eq!(
+                changes.refusal(BY),
+                want,
+                "{name}: unlisted after, the refusal"
+            );
+        }
+    }
+
+    /// Variables that GetNextVariableName() lists without `hidden`, if any, which GetVariable()
+    /// reads, but `unreadable`, if any, which it fails.
+    struct Unlisting {
+        variables: HeldVariables,
+        hidden: RefCell<Option<VariableKey>>,
+        unreadable: Option<VariableKey>,
+    }
+
+    impl VariableData for Unlisting {
+        fn interface(&self) -> VariableInterface {
+            self.variables.interface()
+        }
+
+        fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
+            match self.unreadable.as_ref() == Some(key) {
+                true => Err(anyhow!("EFI_DEVICE_ERROR")),
+                false => self.variables.variable_data(key),
+            }
+        }
+
+        fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()> {
+            self.variables.set_variable(key, contents)
+        }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            self.variables.delete_variable(key)
+        }
+    }
+
+    impl VariableNames for Unlisting {
+        fn variable_names(&self) -> Result<Vec<VariableKey>> {
+            let mut keys = self.variables.variable_names()?;
+            keys.retain(|key| Some(key) != self.hidden.borrow().as_ref());
+            Ok(keys)
+        }
+    }
+
+    #[test]
+    fn a_recorded_variable_is_compared_whether_listed_or_not() {
+        let unlisted = key("Store", STORE_GUID);
+        let own = key("Record", UEFISETTINGS_VENDOR_GUID);
+        let cases = [
+            (
+                "a variable that GetNextVariableName() skips",
+                &unlisted,
+                unlisted.clone(),
+            ),
+            (
+                "uefisettings' own variable, listed",
+                &own,
+                key("Elsewhere", STORE_GUID),
+            ),
+        ];
+        for (name, recorded, hidden) in cases {
+            for (change, data, want) in [
+                ("beside the withheld bytes", [9, 2, 3, 4], None),
+                ("withheld bytes", [1, 9, 3, 4], Some(overwritten(recorded))),
+            ] {
+                let mut held = HeldVariables::default();
+                held.variables
+                    .get_mut()
+                    .insert(recorded.clone(), contents(&[1, 2, 3, 4]));
+                let variables = Unlisting {
+                    variables: held,
+                    hidden: RefCell::new(Some(hidden.clone())),
+                    unreadable: None,
+                };
+                let mut bytes = WithheldBytes::default();
+                bytes.insert(recorded.clone(), 1..3);
+                let withheld = WithholdingVariables::new(&variables, bytes);
+                let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+                variables
+                    .variables
+                    .variables
+                    .borrow_mut()
+                    .insert(recorded.clone(), contents(&data));
+
+                let changes = before.changes(&withheld);
+
+                assert!(
+                    changes.listed.is_empty(),
+                    "{name}, {change}: not listed: {:?}",
+                    changes.listed
+                );
+                assert_eq!(changes.refusal(BY), want, "{name}, {change}: the refusal");
+            }
+        }
+    }
+
+    #[test]
+    fn a_variable_withheld_through_shared_sets_is_compared_unlisted() {
+        let unlisted = key("Store", STORE_GUID);
+        for (change, data, want) in [
+            ("beside the withheld bytes", [9, 2, 3, 4], None),
+            ("withheld bytes", [1, 9, 3, 4], Some(overwritten(&unlisted))),
+        ] {
+            let mut held = HeldVariables::default();
+            held.variables
+                .get_mut()
+                .insert(unlisted.clone(), contents(&[1, 2, 3, 4]));
+            let variables = Unlisting {
+                variables: held,
+                hidden: RefCell::new(Some(unlisted.clone())),
+                unreadable: None,
+            };
+            let mut bytes = WithheldBytes::default();
+            let sets = bytes.share([vec![1..2, 2..3]]);
+            bytes.withhold_shared(&unlisted, sets);
+            let withheld = WithholdingVariables::new(&variables, bytes);
+            let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+            variables
+                .variables
+                .variables
+                .borrow_mut()
+                .insert(unlisted.clone(), contents(&data));
+
+            assert_eq!(
+                before.changes(&withheld).refusal(BY),
+                want,
+                "{change}: the refusal"
+            );
+        }
+    }
+
+    #[test]
+    fn a_withheld_variable_that_the_listing_drops_is_read_again_by_key() {
+        let store = key("Store", STORE_GUID);
+        for (change, data, want) in [
+            ("kept", [1, 2, 3, 4], None),
+            ("withheld bytes", [1, 2, 9, 4], Some(overwritten(&store))),
+        ] {
+            let variables = Unlisting {
+                variables: HeldVariables::default().with("Store", STORE_GUID, &[1, 2, 3, 4]),
+                hidden: RefCell::new(None),
+                unreadable: None,
+            };
+            let withheld = WithholdingVariables::new(&variables, whole_variables(Some(STORE_GUID)));
+            let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+            *variables.hidden.borrow_mut() = Some(store.clone());
+            variables
+                .variables
+                .variables
+                .borrow_mut()
+                .insert(store.clone(), contents(&data));
+
+            let changes = before.changes(&withheld);
+
+            assert_eq!(
+                changes.listed,
+                [format!("{store} (deleted)")],
+                "{change}: no longer listed"
+            );
+            assert_eq!(changes.refusal(BY), want, "{change}: the refusal");
+        }
+    }
+
+    #[test]
+    fn an_unreadable_variable_refuses_only_where_it_withholds_bytes() {
+        let broken = key("Broken", STORE_GUID);
+        let variables = Unlisting {
+            variables: HeldVariables::default()
+                .with("Store", STORE_GUID, &[1, 2, 3, 4])
+                .with("Broken", STORE_GUID, &[1]),
+            hidden: RefCell::new(None),
+            unreadable: Some(broken.clone()),
+        };
+
+        let store_only = withholding(&variables, &[("Store", 1..3)]);
+        let before = VariableSnapshot::take(&store_only, BY).expect("snapshot");
+        let changes = before.changes(&store_only);
+        assert!(
+            changes.listed.is_empty(),
+            "failed twice alike, not listed: {:?}",
+            changes.listed
+        );
+        assert_eq!(changes.refusal(BY), None, "withholding nothing, no refusal");
+
+        let both = withholding(&variables, &[("Store", 1..3), ("Broken", 0..1)]);
+        assert_eq!(
+            VariableSnapshot::take(&both, BY).err(),
+            Some(format!(
+                "cannot compare the password bytes of EFI variable {broken} across the Callback \
+                 sequence: EFI_DEVICE_ERROR"
+            )),
+            "withholding bytes, the refusal"
+        );
+    }
+
+    #[test]
+    fn each_variable_is_read_once_per_snapshot() {
+        let variables = HeldVariables::default()
+            .with("Store", STORE_GUID, &[1, 2, 3, 4])
+            .with("Other", STORE_GUID, &[1]);
+        let withheld = withholding(&variables, &[("Store", 1..3)]);
+        let once = [key("Other", STORE_GUID), key("Store", STORE_GUID)];
+
+        let before = VariableSnapshot::take(&withheld, BY).expect("snapshot");
+        assert_eq!(*variables.read.borrow(), once, "the reads of the snapshot");
+
+        variables.read.borrow_mut().clear();
+        let changes = before.changes(&withheld);
+        assert_eq!(changes.refusal(BY), None, "no change");
+        assert_eq!(*variables.read.borrow(), once, "the reads of the compare");
+    }
+}
diff --git a/src/lib/hii/variable_services.rs b/src/lib/hii/variable_services.rs
index 955b44a..5359ba6 100644
--- a/src/lib/hii/variable_services.rs
+++ b/src/lib/hii/variable_services.rs
@@ -23,6 +23,7 @@ use uefi::runtime;
 use uefi::runtime::VariableVendor;
 use uefi::CString16;
 use uefi::Status;
+use zeroize::Zeroizing;
 
 use crate::efi_variables::globals::platform_lang;
 use crate::efi_variables::walk_variable_names;
@@ -41,9 +42,11 @@ use crate::hii::variables::attributes_and_data;
 use crate::hii::variables::created_variable_bytes;
 use crate::hii::variables::efivar_parts;
 use crate::hii::variables::modify_variable_bytes;
+use crate::hii::variables::read_zeroing;
 use crate::hii::variables::DataPatch;
 use crate::hii::variables::EfivarSource;
 use crate::hii::variables::FirmwareVariables;
+use crate::hii::variables::GetVariableCall;
 use crate::hii::variables::MissingVariable;
 use crate::hii::variables::UnreadVariables;
 use crate::hii::variables::VariableAttributes;
@@ -82,6 +85,7 @@ impl EfivarSource {
 
 /// The variables of the firmware that the UEFI Shell runs on, every one of them, as boot
 /// services still run.
+#[derive(Debug, Clone, Copy)]
 pub(crate) struct VariableServices;
 
 impl VariableServices {
@@ -184,6 +188,8 @@ impl VariableInfoSource for VariableServices {
     /// of its data: as every variable holds one at least (UEFI 2.10 §8.2.3), the firmware
     /// returns EFI_BUFFER_TOO_SMALL with the attributes and the size (§8.2.1), and
     /// uefi::runtime::get_variable drops the attributes then.
+    /// Of a variable with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS, it then reads the data, whose
+    /// metadata only the data holds (UEFI 2.11 §8.2.1), for VariableInfo::from_data.
     fn variable_info(&self, key: &VariableKey) -> Result<VariableInfo> {
         let (variable_name, variable_vendor) = uefi_key(key)?;
         let system_table = uefi::table::system_table_raw().context("no system table")?;
@@ -213,10 +219,18 @@ impl VariableInfoSource for VariableServices {
                      attributes"
                 ))
             }
+            Status::BUFFER_TOO_SMALL | Status::SUCCESS
+                if VariableAttributes::from_bits_retain(attributes.bits())
+                    .contains(VariableAttributes::ENHANCED_AUTHENTICATED_ACCESS) =>
+            {
+                let (data, attributes) = get_variable(key)?;
+                Ok(VariableInfo::from_data(key, attributes.bits(), &data))
+            }
             Status::BUFFER_TOO_SMALL | Status::SUCCESS => Ok(VariableInfo {
                 variable: key.to_string(),
                 attributes: attributes.bits(),
                 size,
+                metadata: None,
             }),
             Status::NOT_FOUND => Err(VariableNotFound(key.clone()).into()),
             status => Err(anyhow!("GetVariable() of EFI variable {key}: {status:?}")),
@@ -230,12 +244,12 @@ impl VariableData for VariableServices {
     }
 
     fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
-        let (data, attributes) = match get_variable(key) {
+        let (mut data, attributes) = match get_variable(key) {
             Err(error) if error.is::<VariableNotFound>() => return Ok(None),
             result => result?,
         };
         let attributes = VariableAttributes::from_bits_retain(attributes.bits());
-        VariableContents::new(attributes, data.into())
+        VariableContents::new(attributes, std::mem::take(&mut *data))
             .map(Some)
             .with_context(|| format!("GetVariable() of EFI variable {key}"))
     }
@@ -254,6 +268,14 @@ impl VariableData for VariableServices {
             },
         )
     }
+
+    fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+        let (variable_name, vendor) = uefi_key(key)?;
+        runtime::delete_variable(&variable_name, &vendor).map_err(|error| match error.status() {
+            Status::NOT_FOUND => VariableNotFound(key.clone()).into(),
+            status => anyhow!("SetVariable() deleting EFI variable {key}: {status:?}"),
+        })
+    }
 }
 
 impl VariableStorageInfo for VariableServices {
@@ -275,12 +297,22 @@ impl VariableStorageInfo for VariableServices {
     }
 }
 
-/// GetVariable() of `key`: its data and attributes, or VariableNotFound.
-fn get_variable(key: &VariableKey) -> Result<(Box<[u8]>, runtime::VariableAttributes)> {
+/// GetVariable() of `key`: its data, in a buffer that zeroes on drop (read_zeroing), and
+/// attributes, or VariableNotFound.
+fn get_variable(key: &VariableKey) -> Result<(Zeroizing<Vec<u8>>, runtime::VariableAttributes)> {
     let (name, vendor) = uefi_key(key)?;
-    runtime::get_variable_boxed(&name, &vendor).map_err(|error| match error.status() {
-        Status::NOT_FOUND => VariableNotFound(key.clone()).into(),
-        status => anyhow!("GetVariable() of EFI variable {key}: {status:?}"),
+    read_zeroing(key, |buffer| {
+        match runtime::get_variable(&name, &vendor, buffer) {
+            Ok((data, attributes)) => Ok(GetVariableCall::Read {
+                size: data.len(),
+                attributes,
+            }),
+            Err(error) => match (error.status(), *error.data()) {
+                (Status::BUFFER_TOO_SMALL, Some(size)) => Ok(GetVariableCall::TooSmall(size)),
+                (Status::NOT_FOUND, _) => Err(VariableNotFound(key.clone()).into()),
+                (status, _) => Err(anyhow!("GetVariable() of EFI variable {key}: {status:?}")),
+            },
+        }
     })
 }
 
diff --git a/src/lib/hii/variables.rs b/src/lib/hii/variables.rs
index f53408b..c3b881f 100644
--- a/src/lib/hii/variables.rs
+++ b/src/lib/hii/variables.rs
@@ -27,10 +27,18 @@ use anyhow::anyhow;
 use anyhow::Context;
 use anyhow::Result;
 use thiserror::Error;
+#[cfg(variable_data)]
+use zeroize::Zeroizing;
 
 use crate::efi_variables::enhanced_authenticated::has_metadata;
 use crate::efi_variables::enhanced_authenticated::metadata_end;
 use crate::efi_variables::enhanced_authenticated::MetadataRefusal;
+#[cfg(variable_data)]
+use crate::efi_variables::VariableContents;
+#[cfg(variable_data)]
+use crate::efi_variables::VariableData;
+#[cfg(variable_names)]
+use crate::efi_variables::VariableNames;
 use crate::hii::config_snapshot::SnapshotLookup;
 #[cfg(all(efivar_dumps, not(system_variables)))]
 use crate::hii::efivarfs_format::EfivarCopy;
@@ -731,7 +739,7 @@ fn read_value_bytes(
 /// A variable that FirmwareVariables does not hold.
 #[derive(Debug, Clone, PartialEq, Eq, Error)]
 #[error("no EFI variable {0}")]
-pub(super) struct VariableNotFound(pub(super) VariableKey);
+pub(crate) struct VariableNotFound(pub(crate) VariableKey);
 
 /// A variable of VariableLayout::OneValue whose value is not as wide as its question's, which get
 /// and set refuse. UEFI 2.11 §33.2.5.4.10 requires that size of a cross-reference question's
@@ -1062,6 +1070,12 @@ impl VariableGuids {
     fn contains(&self, guid: &Guid) -> bool {
         self.every || self.guids.contains(guid)
     }
+
+    /// Whether it holds no GUID.
+    #[cfg(all(variable_data, variable_names, any(target_os = "uefi", test)))]
+    fn is_empty(&self) -> bool {
+        !self.every && self.guids.is_empty()
+    }
 }
 
 /// The bytes of variables in which PASSWORD questions keep their passwords (UEFI 2.11
@@ -1075,6 +1089,16 @@ pub(crate) struct WithheldBytes {
     files: BTreeMap<EfivarFileName, FileBytes>,
     shared: Vec<Vec<Range<usize>>>,
     guids: VariableGuids,
+    /// The variables that `files` were recorded for, which a witness reads whether
+    /// GetNextVariableName() lists them or not
+    #[cfg_attr(
+        not(all(variable_data, variable_names, any(target_os = "uefi", test))),
+        allow(
+            dead_code,
+            reason = "only the UEFI Shell build runs driver code, which a witness compares across"
+        )
+    )]
+    keys: BTreeSet<VariableKey>,
 }
 
 /// The bytes that an efivar file withholds: its own, and the sets of WithheldBytes::shared at
@@ -1094,6 +1118,7 @@ impl WithheldBytes {
                 .or_default()
                 .own
                 .push(bytes);
+            self.keys.insert(key);
         }
     }
 
@@ -1123,6 +1148,7 @@ impl WithheldBytes {
             .or_default()
             .shared
             .push(sets);
+        self.keys.insert(key.clone());
     }
 
     /// The withheld bytes of `key`.
@@ -1209,6 +1235,37 @@ impl WithheldBytes {
             .try_for_each(|patch| self.check_write(key, &patch.range()))
     }
 
+    /// Refuses a write that replaces every byte of `key`, as SetVariable() and deletion do, if it
+    /// has withheld bytes.
+    #[cfg(variable_data)]
+    fn check_replace(&self, key: &VariableKey) -> std::result::Result<(), WithheldPassword> {
+        self.check_write(key, &(0..usize::MAX))
+    }
+
+    /// Whether any variable may have withheld bytes.
+    #[cfg(all(variable_data, variable_names, any(target_os = "uefi", test)))]
+    fn withholds_any(&self) -> bool {
+        !self.files.is_empty() || !self.guids.is_empty()
+    }
+
+    /// The withheld bytes of `key` in `value`, the start of its value, in the order of `of`.
+    #[cfg(all(variable_data, variable_names, any(target_os = "uefi", test)))]
+    fn copy(&self, key: &VariableKey, value: &[u8]) -> Zeroizing<Vec<u8>> {
+        let len = value.len();
+        let parts: Vec<&[u8]> = self
+            .of(key)
+            .filter_map(|withheld| value.get(withheld.start.min(len)..withheld.end.min(len)))
+            .collect();
+        // sized first, as a reallocation would leave the bytes it moved unzeroed
+        let mut copy = Zeroizing::new(Vec::with_capacity(
+            parts.iter().map(|part| part.len()).sum(),
+        ));
+        for part in parts {
+            copy.extend_from_slice(part);
+        }
+        copy
+    }
+
     /// Zeroes the withheld bytes of `key` in `value`, the start of its value.
     fn zero(&self, key: &VariableKey, value: &mut [u8]) {
         let len = value.len();
@@ -1374,13 +1431,197 @@ impl<V: FirmwareVariables> FirmwareVariables for VolatileWritingVariables<V> {
     }
 }
 
+/// As for FirmwareVariables: the Callback() sequences of the UEFI Shell build read and restore
+/// a FormSet's EFI variable stores, and list changed variables, through these. A read gives the
+/// withheld bytes as zero, where the value holds them; SetVariable() and deletion replace every
+/// byte of the variable, so they fail with WithheldPassword for a variable with withheld bytes
+/// before `variables` see it.
+#[cfg(variable_data)]
+impl<V: VariableData> VariableData for WithholdingVariables<V> {
+    fn interface(&self) -> VariableInterface {
+        VariableData::interface(&self.variables)
+    }
+
+    fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
+        if !self.withheld.withholds(key) {
+            return self.variables.variable_data(key);
+        }
+        self.read_withheld(key)?
+            .map(|read| read.zeroed(&self.withheld, key))
+            .transpose()
+    }
+
+    fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()> {
+        self.withheld.check_replace(key)?;
+        self.variables.set_variable(key, contents)
+    }
+
+    fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+        self.withheld.check_replace(key)?;
+        self.variables.delete_variable(key)
+    }
+}
+
+/// One read of a variable that has withheld bytes: its attributes, and its data in a buffer that
+/// zeroes on drop, the value from `value` on (value_of), so that no byte of it outlives the read
+/// in memory that is freed.
+#[cfg(variable_data)]
+struct WithheldRead {
+    attributes: VariableAttributes,
+    data: Zeroizing<Vec<u8>>,
+    value: usize,
+}
+
+#[cfg(variable_data)]
+impl WithheldRead {
+    /// Its data with the bytes that `withheld` withholds of `key` zeroed, in place.
+    fn zeroed(mut self, withheld: &WithheldBytes, key: &VariableKey) -> Result<VariableContents> {
+        if let Some(value) = self.data.get_mut(self.value..) {
+            withheld.zero(key, value);
+        }
+        Ok(VariableContents::new(
+            self.attributes,
+            std::mem::take(&mut *self.data),
+        )?)
+    }
+
+    /// The witness of the bytes that `withheld` withholds of `key`.
+    #[cfg(all(variable_names, any(target_os = "uefi", test)))]
+    fn witness(&self, withheld: &WithheldBytes, key: &VariableKey) -> WithheldWitness {
+        let value = self.data.get(self.value..).unwrap_or_default();
+        WithheldWitness(withheld.copy(key, value))
+    }
+}
+
+/// What one GetVariable() into a buffer gave.
+// the UEFI Shell build reads with GetVariable(); the tests run on every host
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+pub(crate) enum GetVariableCall<A> {
+    /// It wrote `size` bytes of data, and the attributes
+    Read { size: usize, attributes: A },
+    /// EFI_BUFFER_TOO_SMALL: the data needs this many bytes
+    TooSmall(usize),
+}
+
+/// The data and the attributes of variable `key` that `get_variable` reads, GetVariable() into a
+/// buffer that zeroes on drop: empty first, then a new one of each size that a call asks for,
+/// never reallocated, as a reallocation frees the block that held the data unzeroed.
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+pub(crate) fn read_zeroing<A>(
+    key: &VariableKey,
+    mut get_variable: impl FnMut(&mut [u8]) -> Result<GetVariableCall<A>>,
+) -> Result<(Zeroizing<Vec<u8>>, A)> {
+    let mut data = Zeroizing::new(Vec::new());
+    loop {
+        match get_variable(data.as_mut_slice())? {
+            // an EFI variable holds one byte of data at least (UEFI 2.11 §8.2.3)
+            GetVariableCall::Read { size: 0, .. } => {
+                return Err(anyhow!(
+                    "GetVariable() of EFI variable {key} returned EFI_SUCCESS without data"
+                ))
+            }
+            GetVariableCall::Read { size, attributes } if size <= data.len() => {
+                data.truncate(size);
+                return Ok((data, attributes));
+            }
+            GetVariableCall::TooSmall(size) if size > data.len() => {
+                data = Zeroizing::new(vec![0; size]);
+            }
+            GetVariableCall::Read { size, .. } => {
+                return Err(anyhow!(
+                    "GetVariable() of EFI variable {key} wrote {size} bytes into a buffer of {}",
+                    data.len()
+                ))
+            }
+            GetVariableCall::TooSmall(size) => {
+                return Err(anyhow!(
+                    "GetVariable() of EFI variable {key} returned EFI_BUFFER_TOO_SMALL for a \
+                     buffer of {} bytes, asking for {size}",
+                    data.len()
+                ))
+            }
+        }
+    }
+}
+
+#[cfg(variable_data)]
+impl<V: VariableData> WithholdingVariables<V> {
+    /// One read of `key`, which has withheld bytes; None if it is absent.
+    fn read_withheld(&self, key: &VariableKey) -> Result<Option<WithheldRead>> {
+        let Some(contents) = self.variables.variable_data(key)? else {
+            return Ok(None);
+        };
+        let attributes = contents.attributes();
+        let data = Zeroizing::new(contents.into_data());
+        let value = data.len() - value_of(key, attributes.bits(), &data)?.len();
+        Ok(Some(WithheldRead {
+            attributes,
+            data,
+            value,
+        }))
+    }
+}
+
+/// The withheld bytes of one variable, as one read gave them: equal witnesses tell that those
+/// bytes did not change, without showing them, as Debug shows none.
+#[cfg(all(variable_data, variable_names, any(target_os = "uefi", test)))]
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct WithheldWitness(Zeroizing<Vec<u8>>);
+
+/// The driver code that the UEFI Shell build runs tells through these whether it changed a
+/// password, which uefisettings never reads or writes (variable_changes).
+#[cfg(all(variable_data, variable_names, any(target_os = "uefi", test)))]
+impl<V: VariableData> WithholdingVariables<V> {
+    /// Whether any variable may have withheld bytes.
+    pub(crate) fn withholds_any(&self) -> bool {
+        self.withheld.withholds_any()
+    }
+
+    /// Whether `key` has withheld bytes.
+    pub(crate) fn withholds(&self, key: &VariableKey) -> bool {
+        self.withheld.withholds(key)
+    }
+
+    /// The variables that the withheld bytes were recorded for, listed or not.
+    pub(crate) fn named(&self) -> impl Iterator<Item = &VariableKey> {
+        self.withheld.keys.iter()
+    }
+
+    /// One read of `key`: its data as variable_data gives it, and the witness of its withheld
+    /// bytes, None if it has none; None if it is absent.
+    pub(crate) fn witnessed_data(
+        &self,
+        key: &VariableKey,
+    ) -> Result<Option<(VariableContents, Option<WithheldWitness>)>> {
+        if !self.withheld.withholds(key) {
+            return Ok(self
+                .variables
+                .variable_data(key)?
+                .map(|contents| (contents, None)));
+        }
+        let Some(read) = self.read_withheld(key)? else {
+            return Ok(None);
+        };
+        let witness = read.witness(&self.withheld, key);
+        Ok(Some((read.zeroed(&self.withheld, key)?, Some(witness))))
+    }
+}
+
+/// The names of every variable, also of the withheld ones, whose names hold no password.
+#[cfg(variable_names)]
+impl<V: VariableNames> VariableNames for WithholdingVariables<V> {
+    fn variable_names(&self) -> Result<Vec<VariableKey>> {
+        self.variables.variable_names()
+    }
+}
+
 /// A write that WithholdingVariables refuse: it overlaps the bytes of a password.
 #[derive(Debug, Clone, PartialEq, Eq, Error)]
 #[error(
     "EFI variable {key} holds a password {}, which set never writes",
     PasswordBytes(.bytes)
 )]
-pub(super) struct WithheldPassword {
+pub(crate) struct WithheldPassword {
     key: VariableKey,
     bytes: Range<usize>,
 }
@@ -1398,6 +1639,14 @@ impl std::fmt::Display for PasswordBytes<'_> {
     }
 }
 
+/// get's or set's refusal of a question where driver code changed password bytes, or they could
+/// not be compared across it; apply-staged applies no later request (apply_requests).
+// the Callback()s run in the UEFI Shell build; apply-staged's tests run on every host
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+#[derive(Debug, Error)]
+#[error("{0}")]
+pub(crate) struct PasswordBytesRefusal(pub(crate) String);
+
 #[cfg(test)]
 pub(crate) mod tests {
     use std::cell::RefCell;
@@ -1618,6 +1867,48 @@ pub(crate) mod tests {
         }
     }
 
+    /// GetVariable() and SetVariable() of the shared MemoryVariables, as driver code reaches
+    /// them, recording neither reads nor writes.
+    #[cfg(variable_data)]
+    impl VariableData for Rc<MemoryVariables> {
+        fn interface(&self) -> VariableInterface {
+            self.interface
+        }
+
+        fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
+            let variables = self.variables.borrow();
+            let Some(bytes) = variables.get(key) else {
+                return Ok(None);
+            };
+            let attributes = efivar_attributes(bytes).context("attributes word")?;
+            let data = bytes.get(EFIVARFS_HEADER_SIZE..).unwrap_or_default();
+            Ok(Some(VariableContents::new(
+                VariableAttributes::from_bits_retain(attributes),
+                data.to_vec(),
+            )?))
+        }
+
+        fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()> {
+            self.insert(key.clone(), contents.attributes().bits(), contents.data());
+            Ok(())
+        }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            match self.variables.borrow_mut().remove(key) {
+                Some(_) => Ok(()),
+                None => Err(VariableNotFound(key.clone()).into()),
+            }
+        }
+    }
+
+    /// GetNextVariableName() of the shared MemoryVariables.
+    #[cfg(variable_names)]
+    impl VariableNames for Rc<MemoryVariables> {
+        fn variable_names(&self) -> Result<Vec<VariableKey>> {
+            Ok(self.variables.borrow().keys().cloned().collect())
+        }
+    }
+
     /// The write of one patch, under VolatileWrites::Refuse, that most tests make.
     pub(crate) trait WriteAt: FirmwareVariables {
         /// write_patches of `encoded` at data offset `offset` of `key`, whose VarStore has
@@ -2120,6 +2411,86 @@ pub(crate) mod tests {
         }
     }
 
+    /// As FirmwareVariables, WithholdingVariables' VariableData read the withheld bytes of a
+    /// variable as zero, and refuse to set or delete a variable with withheld bytes, which
+    /// SetVariable() and deletion replace whole, before their variables see it; they pass the
+    /// other variables through, and list every name.
+    #[cfg(all(variable_data, variable_names))]
+    #[test]
+    fn withheld_variable_data_reads_as_zero_and_is_neither_set_nor_deleted() {
+        use crate::efi_variables::globals::tests::key;
+        use crate::efi_variables::globals::tests::HeldVariables;
+
+        let variables = HeldVariables::default()
+            .with("Setup", NIL_GUID, &[1])
+            .with("AMITSESetup", NIL_GUID, &[1, 0xAA, 0xAA, 2])
+            .with("Other", NIL_GUID, &[3]);
+        let password = key("AMITSESetup", NIL_GUID);
+        let setup = key("Setup", NIL_GUID);
+        let other = key("Other", NIL_GUID);
+        let mut withheld = WithheldBytes::default();
+        withheld.insert(password.clone(), 1..3);
+        let withholding = WithholdingVariables::new(variables, withheld);
+        let contents =
+            VariableContents::new(VariableAttributes::NON_VOLATILE, vec![0]).expect("contents");
+        let refusal = format!(
+            "EFI variable {password} holds a password at bytes 1..3, which set never writes"
+        );
+
+        assert_eq!(
+            withholding
+                .variable_data(&password)
+                .expect("read AMITSESetup")
+                .map(|read| read.data().to_vec()),
+            Some(vec![1, 0, 0, 2]),
+            "read AMITSESetup"
+        );
+        assert_eq!(
+            withholding
+                .set_variable(&password, &contents)
+                .map_err(|error| error.to_string()),
+            Err(refusal.clone()),
+            "set AMITSESetup"
+        );
+        assert_eq!(
+            withholding
+                .delete_variable(&password)
+                .map_err(|error| error.to_string()),
+            Err(refusal),
+            "delete AMITSESetup"
+        );
+        assert_eq!(
+            withholding
+                .variable_data(&setup)
+                .expect("read Setup")
+                .map(|read| read.data().to_vec()),
+            Some(vec![1]),
+            "read Setup"
+        );
+        withholding
+            .set_variable(&setup, &contents)
+            .expect("set Setup");
+        withholding.delete_variable(&other).expect("delete Other");
+        assert_eq!(
+            *withholding.variables.set.borrow(),
+            std::slice::from_ref(&setup),
+            "set: Setup only"
+        );
+        assert_eq!(
+            *withholding.variables.deleted.borrow(),
+            [other],
+            "deleted: Other only"
+        );
+        assert_eq!(
+            withholding.variables.variables.borrow()[&password].data(),
+            [1, 0xAA, 0xAA, 2],
+            "AMITSESetup keeps its password"
+        );
+        let mut names = withholding.variable_names().expect("names");
+        names.sort();
+        assert_eq!(names, [password, setup], "every name listed");
+    }
+
     /// WithholdingVariables zero the withheld bytes of a variable with
     /// EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS where its value holds them, after its metadata
     /// (UEFI 2.11 §8.2.1), which they keep; read gives no data byte where those end inside the
@@ -2784,4 +3155,269 @@ pub(crate) mod tests {
         );
         assert_eq!(bytes, before, "bytes");
     }
+
+    /// read_zeroing refuses a GetVariable() that wrote no data, or more than its buffer holds, or
+    /// that asks for a buffer no larger than the one it had, which would never end.
+    #[test]
+    #[cfg(variable_data)]
+    fn a_zeroing_read_refuses_a_size_that_contradicts_its_buffer() {
+        let key = VariableKey {
+            name: "Store".to_owned(),
+            guid: NIL_GUID,
+        };
+        let cases = [
+            (
+                "no data",
+                [
+                    GetVariableCall::Read {
+                        size: 0,
+                        attributes: (),
+                    },
+                    GetVariableCall::TooSmall(1),
+                ],
+                format!("GetVariable() of EFI variable {key} returned EFI_SUCCESS without data"),
+            ),
+            (
+                "more data than its buffer",
+                [
+                    GetVariableCall::TooSmall(2),
+                    GetVariableCall::Read {
+                        size: 3,
+                        attributes: (),
+                    },
+                ],
+                format!("GetVariable() of EFI variable {key} wrote 3 bytes into a buffer of 2"),
+            ),
+            (
+                "too small for its own size",
+                [GetVariableCall::TooSmall(2), GetVariableCall::TooSmall(2)],
+                format!(
+                    "GetVariable() of EFI variable {key} returned EFI_BUFFER_TOO_SMALL for a \
+                     buffer of 2 bytes, asking for 2"
+                ),
+            ),
+        ];
+        for (case, calls, want) in cases {
+            let mut calls = calls.into_iter();
+
+            let read = read_zeroing(&key, |_| Ok(calls.next().expect("a call")));
+
+            assert_eq!(
+                read.map(drop).map_err(|error| error.to_string()),
+                Err(want),
+                "{case}"
+            );
+        }
+    }
+
+    /// Whether a read of withheld bytes leaves any of them in memory that it frees: the allocator
+    /// of the library's tests counts the freed blocks that hold a marker.
+    #[cfg(variable_data)]
+    mod freed_bytes {
+        use std::alloc::GlobalAlloc;
+        use std::alloc::Layout;
+        use std::alloc::System;
+        use std::cell::Cell;
+        use std::thread::AccessError;
+
+        use super::*;
+        use crate::efi_variables::globals::tests::key;
+        use crate::efi_variables::globals::tests::HeldVariables;
+
+        /// Stands in for a password in the tests below; no other block of theirs holds it.
+        const MARKER: &[u8] = &[0xC3, 0x5E, 0x9A, 0x17, 0xE4, 0x2B, 0x71, 0xD8];
+
+        /// The system's allocator, zeroing each block that it hands out, so that a byte buffer
+        /// holds no uninitialized byte when it is freed, and counting the freed byte buffers that
+        /// hold the marker of their thread while it counts (freed_holding).
+        struct MarkerCounting;
+
+        thread_local! {
+            /// The marker whose freed blocks this thread counts, with their count
+            static COUNTING: Cell<Option<(&'static [u8], usize)>> = const { Cell::new(None) };
+        }
+
+        // SAFETY: alloc hands its layout on to System, as GlobalAlloc::alloc requires; dealloc
+        // reads a block only while its thread counts, before System frees it with the layout
+        // that it was allocated with.
+        unsafe impl GlobalAlloc for MarkerCounting {
+            unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
+                // SAFETY: the caller passes a layout of non-zero size, as alloc requires
+                unsafe { System.alloc_zeroed(layout) }
+            }
+
+            unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
+                let counted = COUNTING.try_with(|counting| {
+                    let (Some((marker, count)), 1) = (counting.get(), layout.align()) else {
+                        return;
+                    };
+                    // SAFETY: `ptr` is a block of `layout`, still allocated, of alignment 1: a
+                    // byte buffer of the read under count, which alloc handed out zeroed and
+                    // which holds only bytes written as u8 since, so each of its
+                    // `layout.size()` bytes is initialized
+                    let block = unsafe { std::slice::from_raw_parts(ptr, layout.size()) };
+                    if block.windows(marker.len()).any(|window| window == marker) {
+                        counting.set(Some((marker, count + 1)));
+                    }
+                });
+                match counted {
+                    // a thread that ends counts nothing any more
+                    Ok(()) | Err(AccessError { .. }) => {}
+                }
+                // SAFETY: System allocated `ptr` with `layout`, as the caller guarantees of a
+                // block of alloc
+                unsafe { System.dealloc(ptr, layout) }
+            }
+        }
+
+        #[global_allocator]
+        static ALLOCATOR: MarkerCounting = MarkerCounting;
+
+        /// How many blocks this thread freed holding `marker` while `run` ran.
+        fn freed_holding(marker: &'static [u8], run: impl FnOnce()) -> usize {
+            assert!(
+                !marker.is_empty(),
+                "an empty marker, which dealloc would panic on"
+            );
+            COUNTING.with(|counting| counting.set(Some((marker, 0))));
+            run();
+            let (_, freed) = COUNTING.with(Cell::take).expect("counting");
+            freed
+        }
+
+        /// `variables` holding the marker in the value of Store, withheld, and a byte on each
+        /// side of it.
+        fn withholding_marker(variables: &HeldVariables) -> WithholdingVariables<&HeldVariables> {
+            let data = [&[1][..], MARKER, &[2]].concat();
+            variables
+                .variables
+                .borrow_mut()
+                .insert(key("Store", NIL_GUID), contents(&data));
+            let mut withheld = WithheldBytes::default();
+            withheld.insert(key("Store", NIL_GUID), 1..1 + MARKER.len());
+            WithholdingVariables::new(variables, withheld)
+        }
+
+        fn contents(data: &[u8]) -> VariableContents {
+            VariableContents::new(
+                VariableAttributes::from_bits_retain(NV_BS_RT),
+                data.to_vec(),
+            )
+            .expect("contents")
+        }
+
+        #[test]
+        fn the_allocator_counts_a_freed_marker() {
+            assert_eq!(
+                freed_holding(MARKER, || drop(std::hint::black_box(MARKER.to_vec()))),
+                1,
+                "a freed copy"
+            );
+            assert_eq!(
+                freed_holding(MARKER, || drop(vec![0; MARKER.len()])),
+                0,
+                "a freed block without it"
+            );
+        }
+
+        /// read_zeroing of a variable that keeps its size between its GetVariable() calls, shrinks
+        /// or grows: the data that the last call wrote, and no freed block held it.
+        #[test]
+        fn a_zeroing_read_frees_no_byte_of_a_variable_that_changes_size() {
+            let len = MARKER.len();
+            for (case, sizes) in [
+                ("the same size", &[len, len][..]),
+                ("shrinks", &[len + 4, len][..]),
+                ("grows", &[len - 2, len, len][..]),
+            ] {
+                let mut calls = sizes.iter();
+
+                let freed = freed_holding(MARKER, || {
+                    let (data, attributes) = read_zeroing(&key("Store", NIL_GUID), |buffer| {
+                        let size = *calls.next().expect("a call for each size");
+                        match buffer.get_mut(..size) {
+                            Some(data) => {
+                                data.copy_from_slice(MARKER);
+                                Ok(GetVariableCall::Read {
+                                    size,
+                                    attributes: NV_BS_RT,
+                                })
+                            }
+                            None => Ok(GetVariableCall::TooSmall(size)),
+                        }
+                    })
+                    .expect("read");
+                    assert_eq!(&data[..], MARKER, "{case}: the data");
+                    assert_eq!(attributes, NV_BS_RT, "{case}: the attributes");
+                });
+
+                assert_eq!(calls.next(), None, "{case}: a call for each size");
+                assert_eq!(freed, 0, "{case}: freed blocks that held the data");
+            }
+        }
+
+        #[test]
+        fn a_withheld_read_frees_no_withheld_byte() {
+            let variables = HeldVariables::default();
+            let withholding = withholding_marker(&variables);
+
+            let freed = freed_holding(MARKER, || {
+                let read = withholding
+                    .variable_data(&key("Store", NIL_GUID))
+                    .expect("read");
+                assert!(read.is_some(), "the variable read");
+            });
+
+            assert_eq!(freed, 0, "freed blocks that held the withheld bytes");
+        }
+
+        #[test]
+        #[cfg(variable_names)]
+        fn a_witness_of_two_ranges_frees_no_withheld_byte() {
+            let variables = HeldVariables::default();
+            let data = [&[1][..], MARKER, &[2], MARKER, &[3]].concat();
+            variables
+                .variables
+                .borrow_mut()
+                .insert(key("Store", NIL_GUID), contents(&data));
+            let mut withheld = WithheldBytes::default();
+            withheld.insert(key("Store", NIL_GUID), 1..1 + MARKER.len());
+            withheld.insert(
+                key("Store", NIL_GUID),
+                2 + MARKER.len()..2 + 2 * MARKER.len(),
+            );
+            let withholding = WithholdingVariables::new(&variables, withheld);
+
+            let freed = freed_holding(MARKER, || {
+                let read = withholding
+                    .witnessed_data(&key("Store", NIL_GUID))
+                    .expect("read");
+                assert!(
+                    matches!(read, Some((_, Some(_)))),
+                    "the variable read, with a witness"
+                );
+            });
+
+            assert_eq!(freed, 0, "freed blocks that held the withheld bytes");
+        }
+
+        #[test]
+        #[cfg(variable_names)]
+        fn a_witnessed_read_frees_no_withheld_byte() {
+            let variables = HeldVariables::default();
+            let withholding = withholding_marker(&variables);
+
+            let freed = freed_holding(MARKER, || {
+                let read = withholding
+                    .witnessed_data(&key("Store", NIL_GUID))
+                    .expect("read");
+                assert!(
+                    matches!(read, Some((_, Some(_)))),
+                    "the variable read, with a witness"
+                );
+            });
+
+            assert_eq!(freed, 0, "freed blocks that held the withheld bytes");
+        }
+    }
 }
diff --git a/src/lib/hii/win32.rs b/src/lib/hii/win32.rs
index 6bd18b9..9d6c420 100644
--- a/src/lib/hii/win32.rs
+++ b/src/lib/hii/win32.rs
@@ -22,6 +22,7 @@ use windows_sys::Win32::Foundation::ERROR_FILE_NOT_FOUND;
 use windows_sys::Win32::Foundation::ERROR_INSUFFICIENT_BUFFER;
 use windows_sys::Win32::Foundation::ERROR_INVALID_FUNCTION;
 use windows_sys::Win32::Foundation::ERROR_NOT_ALL_ASSIGNED;
+use windows_sys::Win32::Foundation::ERROR_NO_MORE_FILES;
 #[cfg(target_os = "windows")]
 use windows_sys::Win32::Foundation::ERROR_SUCCESS;
 
@@ -42,6 +43,14 @@ impl Win32Error {
     pub(crate) const INSUFFICIENT_BUFFER: Self = Self(ERROR_INSUFFICIENT_BUFFER);
     pub(crate) const ENVVAR_NOT_FOUND: Self = Self(ERROR_ENVVAR_NOT_FOUND);
     pub(crate) const NOT_ALL_ASSIGNED: Self = Self(ERROR_NOT_ALL_ASSIGNED);
+    #[cfg_attr(
+        not(any(target_os = "linux", target_os = "windows")),
+        allow(
+            dead_code,
+            reason = "only the ESP's locator, built on Linux and Windows, reads it"
+        )
+    )]
+    pub(crate) const NO_MORE_FILES: Self = Self(ERROR_NO_MORE_FILES);
 
     /// The calling thread's last Win32 error.
     #[cfg(target_os = "windows")]
diff --git a/src/lib/lib.rs b/src/lib/lib.rs
index 8099553..8a9369c 100644
--- a/src/lib/lib.rs
+++ b/src/lib/lib.rs
@@ -27,7 +27,11 @@ mod capsule_loader;
 mod capsule_services;
 #[cfg(target_os = "linux")]
 mod chattr;
+#[cfg(all(variable_data, any(target_os = "uefi", test)))]
+mod efi_status;
 mod efi_variables;
+#[cfg(any(target_os = "linux", target_os = "windows"))]
+mod esp;
 mod exit_status;
 pub mod exports;
 #[cfg(target_os = "linux")]
@@ -48,6 +52,15 @@ pub mod parse_error;
 #[cfg(target_os = "uefi")]
 mod runtime_time_services;
 pub mod secret_file;
+#[cfg(variable_data)]
+#[cfg_attr(
+    not(any(target_os = "linux", target_os = "windows", test)),
+    allow(
+        dead_code,
+        reason = "only the Linux and Windows builds stage a set for the next boot"
+    )
+)]
+mod staged_set;
 pub mod terminal_text;
 mod translation;
 #[cfg(target_os = "uefi")]
diff --git a/src/lib/secret_file.rs b/src/lib/secret_file.rs
index e8550a7..a57eff3 100644
--- a/src/lib/secret_file.rs
+++ b/src/lib/secret_file.rs
@@ -19,7 +19,6 @@
 use std::fmt;
 use std::io;
 use std::io::Read;
-use std::ops::RangeInclusive;
 use std::str;
 use std::sync::atomic::AtomicBool;
 use std::sync::atomic::Ordering;
@@ -30,6 +29,8 @@ use thiserror::Error;
 use zeroize::Zeroize;
 use zeroize::Zeroizing;
 
+use crate::hii::PRIVATE_USE_AREA;
+
 /// The largest cap that the readers take: 64 KiB, for a PEM key or certificate.
 pub const MAX_SECRET_LEN: usize = 64 * 1024;
 
@@ -49,10 +50,6 @@ const BYTE_ORDER_MARK: u16 = 0xFEFF;
 /// ShellPkg/Application/Shell/FileHandleWrappers.c:2004-2013).
 const SECOND_READ_LEN: usize = 4;
 
-/// The Private Use Area of the Basic Multilingual Plane, which UEFI prohibits (UEFI 2.11
-/// §33.2.6.2.1) and where its strings encode font display codes, 0xF6yy to 0xF8zz (§33.2.6.2.4).
-const PRIVATE_USE_AREA: RangeInclusive<u16> = 0xE000..=0xF8FF;
-
 /// The bytes of a secret, zeroized on drop. Debug and Display show only its length, and it
 /// compares only in constant time.
 pub struct Secret(Zeroizing<Vec<u8>>);
@@ -442,7 +439,12 @@ pub fn encode_ucs2(secret: &Secret, units: usize) -> Result<Secret, SecretError>
     for character in text.chars() {
         let unit = match u16::try_from(u32::from(character)) {
             Ok(0) => return Err(SecretError::Nul),
-            Ok(unit) if PRIVATE_USE_AREA.contains(&unit) => return Err(SecretError::PrivateUse),
+            // The Private Use Area of the Basic Multilingual Plane, which UEFI prohibits (UEFI
+            // 2.11 §33.2.6.2.1) and where its strings encode font display codes, 0xF6yy to 0xF8zz
+            // (§33.2.6.2.4)
+            Ok(unit) if PRIVATE_USE_AREA.contains(&u32::from(unit)) => {
+                return Err(SecretError::PrivateUse)
+            }
             Ok(unit) => unit,
             Err(_) => return Err(SecretError::OutsideBmp),
         };
diff --git a/src/lib/staged_set.rs b/src/lib/staged_set.rs
new file mode 100644
index 0000000..996048e
--- /dev/null
+++ b/src/lib/staged_set.rs
@@ -0,0 +1,2106 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! A set staged for the next boot. Boot services, and with them every driver's Callback(), end at
+//! ExitBootServices(), so set cannot reach a question that only its driver holds from an OS;
+//! it stages the request instead. uefisettings.efi starts once, before the OS, from a Boot####
+//! load option that BootNext names (UEFI 2.11 §3.1.2), and applies the staged requests. Here are
+//! the records of such a set, in uefisettings' own EFI variables, and what the OS side makes of
+//! them.
+
+use std::fmt;
+use std::str::FromStr;
+
+use anyhow::anyhow;
+use anyhow::Context;
+use anyhow::Result;
+use log::warn;
+use serde::de::DeserializeOwned;
+use serde::Deserialize;
+use serde::Serialize;
+use sha2::Digest;
+use sha2::Sha256;
+use thiserror::Error;
+
+use crate::efi_variables::globals::bit_names;
+use crate::efi_variables::globals::boot_next;
+use crate::efi_variables::globals::boot_option_support;
+use crate::efi_variables::globals::boot_order;
+use crate::efi_variables::globals::read_os_indications;
+use crate::efi_variables::globals::BootOptionFlags;
+use crate::efi_variables::globals::LoadOptionKind;
+use crate::efi_variables::globals::LoadOptionName;
+use crate::efi_variables::globals::OsIndications;
+use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+use crate::efi_variables::globals::WRITABLE_ATTRIBUTES;
+use crate::efi_variables::load_option::DevicePathNode;
+use crate::efi_variables::load_option::FilePathList;
+use crate::efi_variables::load_option::HardDrive;
+use crate::efi_variables::load_option::LoadOption;
+use crate::efi_variables::load_option::LoadOptionAttributes;
+use crate::efi_variables::load_option::LoadOptionError;
+use crate::efi_variables::load_option::Ucs2String;
+use crate::efi_variables::VariableContents;
+use crate::efi_variables::VariableData;
+use crate::efi_variables::UEFISETTINGS_VENDOR_GUID;
+use crate::hii::forms::AssumedVarStore;
+use crate::hii::forms::IfrValueType;
+use crate::hii::forms::IncludedStates;
+use crate::hii::package::Guid;
+use crate::hii::VariableAttributes;
+use crate::hii::VariableKey;
+use crate::unsafe_operations::UnsafeOperations;
+
+#[cfg(any(target_os = "uefi", test))]
+pub(crate) mod apply;
+#[cfg(any(target_os = "linux", target_os = "windows"))]
+pub(crate) mod next_boot;
+
+/// The variables of UEFISETTINGS_VENDOR_GUID that hold the staged set, and the outcome of the
+/// last staged set's boot
+const STAGED_SET: &str = "UefisettingsStagedSet";
+const STAGED_OUTCOME: &str = "UefisettingsStagedOutcome";
+/// NV, BS, RT: the records outlive resets, and the OS reads them as uefisettings.efi does
+const RECORD_ATTRIBUTES: VariableAttributes = VariableAttributes::NON_VOLATILE
+    .union(VariableAttributes::BOOTSERVICE_ACCESS)
+    .union(VariableAttributes::RUNTIME_ACCESS);
+/// The command line of a staged set's Boot#### before its nonce: the image, then its command
+const APPLY_STAGED: &str = "uefisettings.efi apply-staged";
+/// uefisettings' directory on the EFI system partition, and the path of a staged set's image in
+/// it, as File Path nodes name them
+#[cfg_attr(
+    not(any(target_os = "linux", target_os = "windows")),
+    allow(dead_code, reason = "only the Linux and Windows builds reach the ESP")
+)]
+pub(crate) const IMAGE_DIRECTORY: &str = "\\EFI\\uefisettings";
+pub(crate) const IMAGE_PATH: &str = "\\EFI\\uefisettings\\uefisettings.efi";
+/// The directory of capsules on disk, which the firmware processes at the next boot when
+/// OsIndications has FILE_CAPSULE_DELIVERY_SUPPORTED, letter case ignored (UEFI 2.11 §8.5.5)
+#[cfg_attr(
+    not(any(target_os = "linux", target_os = "windows")),
+    allow(dead_code, reason = "only the Linux and Windows builds reach the ESP")
+)]
+pub(crate) const CAPSULE_DIRECTORY: &str = "\\EFI\\UpdateCapsule";
+/// The Description of a staged set's Boot####
+const DESCRIPTION: &str = "uefisettings: a set staged for this boot";
+/// The OsIndications that keep the boot manager from starting BootNext's option unattended: it
+/// stops at a firmware user interface, or skips to recovery (UEFI 2.11 §8.5.4). With
+/// FILE_CAPSULE_DELIVERY_SUPPORTED, capsules on disk do too (StageRefusal::CapsulesOnDisk).
+const BEFORE_BOOT_NEXT: OsIndications = OsIndications::BOOT_TO_FW_UI
+    .union(OsIndications::START_OS_RECOVERY)
+    .union(OsIndications::START_PLATFORM_RECOVERY);
+
+/// The 128 random bits that tie a staged set's Boot#### option and outcome to its record.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct Nonce(pub(crate) [u8; 16]);
+
+/// A SHA-256 digest (FIPS 180-4), such as a staged image's.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct Sha256Digest(pub(crate) [u8; 32]);
+
+/// Lowercase hexadecimal digits, two per byte.
+impl fmt::Display for Nonce {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write_hex(f, &self.0)
+    }
+}
+
+/// Lowercase hexadecimal digits, two per byte.
+impl fmt::Display for Sha256Digest {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write_hex(f, &self.0)
+    }
+}
+
+/// The digits that Display writes.
+impl FromStr for Nonce {
+    type Err = RecordError;
+
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        lowercase_hex(text).map(Self)
+    }
+}
+
+/// The digits that Display writes.
+impl FromStr for Sha256Digest {
+    type Err = RecordError;
+
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        lowercase_hex(text).map(Self)
+    }
+}
+
+/// Writes `bytes` in lowercase hexadecimal digits, two per byte.
+fn write_hex(f: &mut fmt::Formatter<'_>, bytes: &[u8]) -> fmt::Result {
+    bytes.iter().try_for_each(|byte| write!(f, "{byte:02x}"))
+}
+
+/// The `N` bytes that `text` writes in lowercase hexadecimal digits, two per byte.
+fn lowercase_hex<const N: usize>(text: &str) -> Result<[u8; N], RecordError> {
+    let bytes: Option<Vec<u8>> = match text.as_bytes().as_chunks::<2>() {
+        (pairs, []) => pairs
+            .iter()
+            .map(|&[high, low]| Some((lowercase_digit(high)? << 4) | lowercase_digit(low)?))
+            .collect(),
+        (_, _) => None,
+    };
+    bytes
+        .and_then(|bytes| bytes.try_into().ok())
+        .ok_or_else(|| RecordError::Hex {
+            text: text.to_owned(),
+            digits: 2 * N,
+        })
+}
+
+/// The value of the lowercase hexadecimal digit `byte`.
+fn lowercase_digit(byte: u8) -> Option<u8> {
+    match byte {
+        b'0'..=b'9' => Some(byte - b'0'),
+        b'a'..=b'f' => Some(byte - b'a' + 10),
+        _ => None,
+    }
+}
+
+/// A request that set staged: to set the question `question_id` of the FormSet `form_set`, which
+/// its driver holds, to `value`, selected with `include` and `assume_var_stores` as set selected
+/// it, with set's grant of `unsafe_operations`. A request that an older uefisettings staged has
+/// "access_level" instead of "assume_var_stores", which deny_unknown_fields refuses by name.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct StagedRequest {
+    /// The question as set named it
+    pub(crate) question: String,
+    #[serde(with = "as_text")]
+    pub(crate) form_set: Guid,
+    pub(crate) question_id: u16,
+    #[serde(with = "as_text")]
+    pub(crate) value_type: IfrValueType,
+    pub(crate) value: u64,
+    /// The states of questions that set selected too, as --include names them
+    #[serde(with = "included_states")]
+    pub(crate) include: IncludedStates,
+    /// The VarStore bytes that set's conditions read in place of those their variables hold, as
+    /// --assume-var-store states them
+    #[serde(with = "assumed_var_stores")]
+    pub(crate) assume_var_stores: Vec<AssumedVarStore>,
+    /// Whether set had --i-am-fine-to-brick-this-system, which apply-staged checks the unsafe
+    /// operations of applying the request against
+    #[serde(with = "unsafe_operations")]
+    pub(crate) unsafe_operations: UnsafeOperations,
+}
+
+/// The image that a staged set's Boot#### starts: its path on the EFI system partition, as its
+/// File Path node names it, and its SHA-256 as staged.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct StagedImage {
+    pub(crate) path: String,
+    #[serde(with = "as_text")]
+    pub(crate) sha256: Sha256Digest,
+}
+
+/// The record of the staged set: its nonce, the number of its Boot####, its image and its
+/// requests, in the order set staged them.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct StagedSet {
+    #[serde(with = "as_text")]
+    pub(crate) nonce: Nonce,
+    pub(crate) boot_option: u16,
+    pub(crate) image: StagedImage,
+    pub(crate) requests: Vec<StagedRequest>,
+}
+
+/// A staged request and what applying it did.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct RequestOutcome {
+    pub(crate) request: StagedRequest,
+    pub(crate) applied: bool,
+    /// What set answers of it
+    pub(crate) result: String,
+    /// The warning of each unsafe operation that applying it lifted, as set prints them
+    pub(crate) warnings: Vec<String>,
+}
+
+/// What became of a staged set's boot, each echoing the set's nonce.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "state", rename_all = "kebab-case", deny_unknown_fields)]
+pub(crate) enum Outcome {
+    /// uefisettings.efi started, and records this before the first Callback()
+    Started {
+        #[serde(with = "as_text")]
+        nonce: Nonce,
+    },
+    /// uefisettings.efi applied the requests
+    Finished {
+        #[serde(with = "as_text")]
+        nonce: Nonce,
+        results: Vec<RequestOutcome>,
+    },
+    /// uefisettings.efi started and recorded no outcome: the requests may be partly applied
+    Interrupted {
+        #[serde(with = "as_text")]
+        nonce: Nonce,
+        requests: Vec<StagedRequest>,
+    },
+    /// The boot is over and uefisettings.efi never started
+    NotStarted {
+        #[serde(with = "as_text")]
+        nonce: Nonce,
+        requests: Vec<StagedRequest>,
+    },
+}
+
+impl Outcome {
+    fn nonce(&self) -> Nonce {
+        match self {
+            Self::Started { nonce }
+            | Self::Finished { nonce, .. }
+            | Self::Interrupted { nonce, .. }
+            | Self::NotStarted { nonce, .. } => *nonce,
+        }
+    }
+}
+
+/// The OptionalData of a staged set's Boot####, which the boot manager passes to the image as
+/// its LoadOptions: the command line `uefisettings.efi apply-staged <nonce>` in CHAR16s.
+pub(crate) fn optional_data(nonce: Nonce) -> Result<Vec<u8>, LoadOptionError> {
+    Ucs2String::try_from(format!("{APPLY_STAGED} {nonce}").as_str())
+        .map(|command| command.to_char16_bytes())
+}
+
+/// What uefisettings' records tell of the staged set.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum StagedState {
+    /// No set is staged; the outcome of the last staged set's boot, if recorded
+    Idle(Option<Outcome>),
+    /// A staged set waits for its boot: BootNext names its Boot####
+    Pending(StagedSet),
+    /// A staged set whose boot is over, and its outcome: the one recorded with its nonce, else,
+    /// if uefisettings.efi recorded that it started, Interrupted, and if not, NotStarted
+    Over(StagedSet, Outcome),
+}
+
+impl StagedState {
+    /// What the records that `variables` hold tell, with BootNext.
+    pub(crate) fn read(variables: &impl VariableData) -> Result<Self> {
+        let recorded: Option<Outcome> = read_record(variables, STAGED_OUTCOME)?;
+        let Some(set) = read_record::<StagedSet>(variables, STAGED_SET)? else {
+            return Ok(Self::Idle(recorded));
+        };
+        let outcome = match recorded.filter(|outcome| outcome.nonce() == set.nonce) {
+            Some(Outcome::Started { nonce }) => Outcome::Interrupted {
+                nonce,
+                requests: set.requests.clone(),
+            },
+            Some(
+                outcome @ (Outcome::Finished { .. }
+                | Outcome::Interrupted { .. }
+                | Outcome::NotStarted { .. }),
+            ) => outcome,
+            None => match boot_next(variables)? {
+                Some(next) if next.number == set.boot_option => return Ok(Self::Pending(set)),
+                Some(_) | None => Outcome::NotStarted {
+                    nonce: set.nonce,
+                    requests: set.requests.clone(),
+                },
+            },
+        };
+        Ok(Self::Over(set, outcome))
+    }
+}
+
+/// A question as staged requests name it: by its FormSet GUID and QuestionId.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct StagedQuestion {
+    pub(crate) form_set: Guid,
+    pub(crate) question_id: u16,
+}
+
+impl StagedQuestion {
+    fn names(self, request: &StagedRequest) -> bool {
+        request.form_set == self.form_set && request.question_id == self.question_id
+    }
+
+    /// The value of the last of `requests` that names this question.
+    fn last_value(self, requests: &[StagedRequest]) -> Option<u64> {
+        requests
+            .iter()
+            .rev()
+            .find(|request| self.names(request))
+            .map(|request| request.value)
+    }
+
+    /// get's note from an OS on this question, with each value as `shown` shows it: its last
+    /// request in the pending set, else its last result in the outcome of the last staged set's
+    /// boot, with the warning of each unsafe operation that applying it lifted, as `state` tells;
+    /// None if neither names it.
+    pub(crate) fn note(self, state: &StagedState, shown: impl Fn(u64) -> String) -> Option<String> {
+        match state {
+            StagedState::Pending(set) => self.last_value(&set.requests).map(|value| {
+                format!(
+                    "{} is staged for the next boot, as Boot{:04X}: restart to apply",
+                    shown(value),
+                    set.boot_option
+                )
+            }),
+            StagedState::Over(_, outcome) | StagedState::Idle(Some(outcome)) => match outcome {
+                Outcome::Finished { results, .. } => results
+                    .iter()
+                    .rev()
+                    .find(|result| self.names(&result.request))
+                    .map(|result| {
+                        let value = shown(result.request.value);
+                        let note = match result.applied {
+                            true => {
+                                format!("the last staged boot applied {value}: {}", result.result)
+                            }
+                            false => format!(
+                                "the last staged boot did not apply {value}: {}",
+                                result.result
+                            ),
+                        };
+                        result
+                            .warnings
+                            .iter()
+                            .fold(note, |note, warning| format!("{note}; warning: {warning}"))
+                    }),
+                Outcome::Interrupted { requests, .. } => self.last_value(requests).map(|value| {
+                    format!(
+                        "the last staged boot stopped while it applied {}, which may be partly \
+                         applied",
+                        shown(value)
+                    )
+                }),
+                Outcome::NotStarted { requests, .. } => self.last_value(requests).map(|value| {
+                    format!(
+                        "the last staged boot did not start uefisettings.efi, so {} is not applied",
+                        shown(value)
+                    )
+                }),
+                // a start whose set is gone: what became of it is unknown
+                Outcome::Started { .. } => None,
+            },
+            StagedState::Idle(None) => None,
+        }
+    }
+}
+
+/// The files of staged images on the EFI system partition, as the OS reaches them.
+pub(crate) trait StagedFiles {
+    /// The paths of the files in uefisettings' directory, \EFI\uefisettings, as File Path nodes
+    /// name them.
+    fn list(&self) -> Result<Vec<String>>;
+
+    /// The SHA-256 of the file at `path`, None if there is none.
+    fn sha256(&self, path: &str) -> Result<Option<Sha256Digest>>;
+
+    /// The paths of the files in \EFI\UpdateCapsule, the directory of capsules on disk (UEFI 2.11
+    /// §8.5.5), as File Path nodes name them.
+    fn capsules(&self) -> Result<Vec<String>>;
+
+    /// Deletes the file at `path`, then uefisettings' directory if it is empty.
+    fn delete(&self, path: &str) -> Result<()>;
+
+    /// Writes `image` to a new file at `path`, creating uefisettings' directory if missing, and
+    /// reads it back: the SHA-256 of what it read. Fails if `path` exists, and leaves no file if
+    /// it fails.
+    fn place(&self, path: &str, image: &[u8]) -> Result<Sha256Digest>;
+}
+
+/// What settle leaves.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum Settled {
+    /// No set is staged; the outcome of the last staged set's boot, if recorded
+    Idle(Option<Outcome>),
+    /// A staged set waits for its boot
+    Pending(StagedSet),
+}
+
+/// Settles a staged set whose boot is over: records its outcome, deletes its Boot#### and BootNext
+/// if it names that, its image, then its record. A Boot#### that holds another command line and
+/// an image whose SHA-256 changed stay, as they are no longer the set's. A set that waits for its
+/// boot stays.
+pub(crate) fn settle(variables: &impl VariableData, files: &impl StagedFiles) -> Result<Settled> {
+    let (set, outcome) = match StagedState::read(variables)? {
+        StagedState::Idle(last) => return Ok(Settled::Idle(last)),
+        StagedState::Pending(set) => return Ok(Settled::Pending(set)),
+        StagedState::Over(set, outcome) => (set, outcome),
+    };
+    write_record(variables, STAGED_OUTCOME, &outcome)?;
+    remove_boot_option(variables, boot_option_name(set.boot_option), set.nonce)?;
+    remove_image(files, &set.image)?;
+    variables.delete_variable(&record_key(STAGED_SET))?;
+    Ok(Settled::Idle(Some(outcome)))
+}
+
+/// The Boot#### of `number`.
+fn boot_option_name(number: u16) -> LoadOptionName {
+    LoadOptionName {
+        kind: LoadOptionKind::Boot,
+        number,
+    }
+}
+
+/// Whether `option` is present and holds the command line of the staged set of `nonce`.
+fn starts_staged_set(
+    variables: &impl VariableData,
+    option: LoadOptionName,
+    nonce: Nonce,
+) -> Result<bool> {
+    let Some(contents) = variables.variable_data(&option.key())? else {
+        return Ok(false);
+    };
+    let command = optional_data(nonce)?;
+    Ok(LoadOption::decode(contents.data())
+        .is_ok_and(|load_option| load_option.optional_data == command))
+}
+
+/// Deletes `option` if it holds the command line of the staged set of `nonce`, after BootNext if
+/// that names it; the variables deleted, in order.
+fn remove_boot_option(
+    variables: &impl VariableData,
+    option: LoadOptionName,
+    nonce: Nonce,
+) -> Result<Vec<VariableKey>> {
+    if !starts_staged_set(variables, option, nonce)? {
+        if variables.variable_data(&option.key())?.is_some() {
+            warn!("kept {option}: it no longer starts the staged set {nonce}");
+        }
+        return Ok(Vec::new());
+    }
+    let mut deleted = Vec::new();
+    if boot_next(variables)? == Some(option) {
+        variables.delete_variable(&boot_next_key())?;
+        deleted.push(boot_next_key());
+    }
+    variables.delete_variable(&option.key())?;
+    deleted.push(option.key());
+    Ok(deleted)
+}
+
+/// Deletes the staged image if it is unchanged.
+fn remove_image(files: &impl StagedFiles, image: &StagedImage) -> Result<()> {
+    match files.sha256(&image.path)? {
+        Some(digest) if digest == image.sha256 => files.delete(&image.path),
+        Some(digest) => {
+            warn!(
+                "kept {}: its SHA-256 is {digest}, not the staged image's {}",
+                image.path, image.sha256
+            );
+            Ok(())
+        }
+        None => Ok(()),
+    }
+}
+
+/// How staging a request goes on.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum StagePlan {
+    /// Append it to the pending set, which keeps its Boot####
+    Append(StagedSet),
+    /// Stage a new set
+    New,
+}
+
+/// Settles the records, then plans staging a request: appended to the pending set, else a new
+/// set. Refused while BootNext names another option, while OsIndications keeps the boot manager
+/// from starting BootNext's option unattended, also through capsules on disk, and while
+/// uefisettings' directory on the EFI system partition holds a file that the pending set does
+/// not name.
+pub(crate) fn plan_stage(
+    variables: &impl VariableData,
+    files: &impl StagedFiles,
+) -> Result<StagePlan> {
+    let pending = match settle(variables, files)? {
+        Settled::Idle(_) => None,
+        Settled::Pending(set) => Some(set),
+    };
+
+    if let Some(next) = boot_next(variables)? {
+        if pending.as_ref().map(|set| set.boot_option) != Some(next.number) {
+            return Err(StageRefusal::ForeignBootNext(next).into());
+        }
+    }
+    let indications = read_os_indications(variables)?.unwrap_or_else(OsIndications::empty);
+    let blocking = indications.intersection(BEFORE_BOOT_NEXT);
+    if !blocking.is_empty() {
+        return Err(StageRefusal::OsIndications(blocking).into());
+    }
+    if indications.contains(OsIndications::FILE_CAPSULE_DELIVERY_SUPPORTED) {
+        let capsules = files.capsules()?;
+        if !capsules.is_empty() {
+            return Err(StageRefusal::CapsulesOnDisk(capsules).into());
+        }
+    }
+    let foreign: Vec<String> = files
+        .list()?
+        .into_iter()
+        .filter(|path| {
+            !pending
+                .as_ref()
+                .is_some_and(|set| set.image.path.eq_ignore_ascii_case(path))
+        })
+        .collect();
+    if !foreign.is_empty() {
+        return Err(StageRefusal::ForeignFiles(foreign).into());
+    }
+
+    Ok(match pending {
+        Some(set) => StagePlan::Append(set),
+        None => StagePlan::New,
+    })
+}
+
+/// Records `set` as the staged set.
+pub(crate) fn record_set(variables: &impl VariableData, set: &StagedSet) -> Result<()> {
+    write_record(variables, STAGED_SET, set)
+}
+
+/// Stages `request` in a new set of `nonce`, for StagePlan::New: writes `image` to IMAGE_PATH
+/// and reads it back, records the set, writes its Boot####, the lowest free one, which starts the
+/// image on the partition of `hard_drive` with the set's command line, then BootNext. A step that
+/// fails undoes the steps before it; an image file that exists already fails it before any write,
+/// and stays, as a set staged at the same time may have placed it.
+pub(crate) fn stage_new(
+    variables: &impl VariableData,
+    files: &impl StagedFiles,
+    hard_drive: HardDrive,
+    request: StagedRequest,
+    image: &[u8],
+    nonce: Nonce,
+) -> Result<StagedSet> {
+    let sha256 = Sha256Digest(Sha256::digest(image).into());
+    let set = StagedSet {
+        nonce,
+        boot_option: free_boot_option(variables)?,
+        image: StagedImage {
+            path: IMAGE_PATH.to_owned(),
+            sha256,
+        },
+        requests: vec![request],
+    };
+    let load_option = LoadOption {
+        attributes: LoadOptionAttributes::ACTIVE
+            | LoadOptionAttributes::HIDDEN
+            | category(variables)?,
+        description: Ucs2String::try_from(DESCRIPTION)?,
+        file_paths: FilePathList::of(&[
+            DevicePathNode::HardDrive(hard_drive),
+            DevicePathNode::FilePath(Ucs2String::try_from(IMAGE_PATH)?),
+        ])?,
+        optional_data: optional_data(nonce)?,
+    };
+
+    let read_back = files.place(&set.image.path, image)?;
+    match write_new_set(variables, files, &set, &load_option, read_back) {
+        Ok(()) => Ok(set),
+        // nothing of a set that failed to stage stays
+        Err(error) => Err(match undo_new_set(variables, files, &set) {
+            Ok(()) => error,
+            Err(undo) => anyhow!("{error:#}; undoing the staging failed too: {undo:#}"),
+        }),
+    }
+}
+
+/// The steps of stage_new after it placed the image, which read back as `read_back`.
+fn write_new_set(
+    variables: &impl VariableData,
+    files: &impl StagedFiles,
+    set: &StagedSet,
+    load_option: &LoadOption,
+    read_back: Sha256Digest,
+) -> Result<()> {
+    if read_back != set.image.sha256 {
+        files.delete(&set.image.path)?;
+        return Err(anyhow!(
+            "{} reads back with SHA-256 {read_back}, not the image's {}",
+            set.image.path,
+            set.image.sha256
+        ));
+    }
+    record_set(variables, set)?;
+    variables.set_variable(
+        &boot_option_name(set.boot_option).key(),
+        &VariableContents::new(WRITABLE_ATTRIBUTES, load_option.encode())?,
+    )?;
+    variables.set_variable(
+        &boot_next_key(),
+        &VariableContents::new(WRITABLE_ATTRIBUTES, set.boot_option.to_le_bytes().to_vec())?,
+    )
+}
+
+/// Undoes the steps of stage_new that wrote, as settle does.
+fn undo_new_set(
+    variables: &impl VariableData,
+    files: &impl StagedFiles,
+    set: &StagedSet,
+) -> Result<()> {
+    remove_boot_option(variables, boot_option_name(set.boot_option), set.nonce)?;
+    if variables.variable_data(&record_key(STAGED_SET))?.is_some() {
+        variables.delete_variable(&record_key(STAGED_SET))?;
+    }
+    remove_image(files, &set.image)
+}
+
+/// The LOAD_OPTION_CATEGORY of a staged set's Boot####: LOAD_OPTION_CATEGORY_APP if
+/// BootOptionSupport has EFI_BOOT_OPTION_SUPPORT_APP, else LOAD_OPTION_CATEGORY_BOOT (UEFI 2.11
+/// §3.1.4).
+fn category(variables: &impl VariableData) -> Result<LoadOptionAttributes> {
+    let supports_apps = boot_option_support(variables)?
+        .is_some_and(|support| support.flags.contains(BootOptionFlags::APP));
+    Ok(match supports_apps {
+        true => LoadOptionAttributes::CATEGORY_APP,
+        false => LoadOptionAttributes::empty(),
+    })
+}
+
+/// The number of the lowest Boot#### that `variables` lack and that neither BootOrder lists, so
+/// that no boot starts it unattended, nor BootNext names, as edk2-stable202608
+/// UefiBootManagerLib BmGetFreeOptionNumber() skips both (BmLoadOption.c).
+fn free_boot_option(variables: &impl VariableData) -> Result<u16> {
+    let taken: Vec<LoadOptionName> = boot_order(variables)?
+        .into_iter()
+        .flatten()
+        .chain(boot_next(variables)?)
+        .collect();
+    for number in 0..=u16::MAX {
+        let option = boot_option_name(number);
+        if !taken.contains(&option) && variables.variable_data(&option.key())?.is_none() {
+            return Ok(number);
+        }
+    }
+    Err(anyhow!(
+        "every Boot#### from Boot0000 to BootFFFF exists or BootOrder or BootNext holds it"
+    ))
+}
+
+fn record_key(name: &str) -> VariableKey {
+    VariableKey {
+        name: name.to_owned(),
+        guid: UEFISETTINGS_VENDOR_GUID,
+    }
+}
+
+fn boot_next_key() -> VariableKey {
+    VariableKey {
+        name: "BootNext".to_owned(),
+        guid: EFI_GLOBAL_VARIABLE,
+    }
+}
+
+/// The record `name` that `variables` hold, None if absent; refused unless it has
+/// RECORD_ATTRIBUTES and its data is the JSON of a T.
+fn read_record<T: DeserializeOwned>(
+    variables: &impl VariableData,
+    name: &str,
+) -> Result<Option<T>> {
+    let key = record_key(name);
+    let Some(contents) = variables.variable_data(&key)? else {
+        return Ok(None);
+    };
+    if contents.attributes() != RECORD_ATTRIBUTES {
+        return Err(RecordError::Attributes {
+            key,
+            attributes: contents.attributes(),
+        }
+        .into());
+    }
+    serde_json::from_slice(contents.data())
+        .map(Some)
+        .with_context(|| format!("EFI variable {key} is malformed"))
+}
+
+/// Sets the record `name` to the JSON of `record`.
+fn write_record(variables: &impl VariableData, name: &str, record: &impl Serialize) -> Result<()> {
+    let key = record_key(name);
+    let data = serde_json::to_vec(record).with_context(|| format!("EFI variable {key}"))?;
+    let contents = VariableContents::new(RECORD_ATTRIBUTES, data)
+        .with_context(|| format!("EFI variable {key}"))?;
+    variables.set_variable(&key, &contents)
+}
+
+/// Serde of a record's field as the text that Display writes and FromStr reads.
+mod as_text {
+    use std::fmt::Display;
+    use std::str::FromStr;
+
+    use serde::de::Error;
+    use serde::Deserialize;
+    use serde::Deserializer;
+    use serde::Serializer;
+
+    pub(super) fn serialize<S: Serializer>(
+        value: &impl Display,
+        serializer: S,
+    ) -> Result<S::Ok, S::Error> {
+        serializer.collect_str(value)
+    }
+
+    pub(super) fn deserialize<'de, T, D>(deserializer: D) -> Result<T, D::Error>
+    where
+        T: FromStr<Err: Display>,
+        D: Deserializer<'de>,
+    {
+        String::deserialize(deserializer)?
+            .parse()
+            .map_err(D::Error::custom)
+    }
+}
+
+/// IncludedStates as the list of the states that --include names.
+mod included_states {
+    use serde::de::Error;
+    use serde::Deserialize;
+    use serde::Deserializer;
+    use serde::Serializer;
+
+    use super::IncludedStates;
+
+    /// The names of the states of `include`, as --include takes them, in the order of
+    /// IncludedStates' flags.
+    fn names(include: IncludedStates) -> Vec<String> {
+        include.iter().map(|state| state.to_string()).collect()
+    }
+
+    pub(super) fn serialize<S: Serializer>(
+        include: &IncludedStates,
+        serializer: S,
+    ) -> Result<S::Ok, S::Error> {
+        serializer.collect_seq(names(*include))
+    }
+
+    /// Refuses names that serialize does not write: unknown, repeated or out of order.
+    pub(super) fn deserialize<'de, D: Deserializer<'de>>(
+        deserializer: D,
+    ) -> Result<IncludedStates, D::Error> {
+        let written = Vec::<String>::deserialize(deserializer)?;
+        let include = IncludedStates::all()
+            .iter()
+            .filter(|state| written.contains(&state.to_string()))
+            .collect();
+        match names(include) == written {
+            true => Ok(include),
+            false => Err(D::Error::custom(format!(
+                "{written:?} are not the states of --include, each once, in the order {:?}",
+                names(IncludedStates::all())
+            ))),
+        }
+    }
+}
+
+/// A grant of unsafe operations: "allow" with --i-am-fine-to-brick-this-system, else "refuse".
+mod unsafe_operations {
+    use serde::de::Error;
+    use serde::Deserialize;
+    use serde::Deserializer;
+    use serde::Serializer;
+
+    use super::UnsafeOperations;
+
+    fn name(grant: UnsafeOperations) -> &'static str {
+        match grant {
+            UnsafeOperations::Refuse => "refuse",
+            UnsafeOperations::Allow => "allow",
+        }
+    }
+
+    pub(super) fn serialize<S: Serializer>(
+        grant: &UnsafeOperations,
+        serializer: S,
+    ) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(name(*grant))
+    }
+
+    pub(super) fn deserialize<'de, D: Deserializer<'de>>(
+        deserializer: D,
+    ) -> Result<UnsafeOperations, D::Error> {
+        let text = String::deserialize(deserializer)?;
+        [UnsafeOperations::Refuse, UnsafeOperations::Allow]
+            .into_iter()
+            .find(|&grant| name(grant) == text)
+            .ok_or_else(|| D::Error::custom(format!("{text:?} is no grant of unsafe operations")))
+    }
+}
+
+/// Stated VarStore bytes as --assume-var-store takes them, NAME-GUID+OFFSET=HEX, in order.
+mod assumed_var_stores {
+    use serde::de::Error;
+    use serde::Deserialize;
+    use serde::Deserializer;
+    use serde::Serializer;
+
+    use super::AssumedVarStore;
+
+    pub(super) fn serialize<S: Serializer>(
+        assumed: &[AssumedVarStore],
+        serializer: S,
+    ) -> Result<S::Ok, S::Error> {
+        serializer.collect_seq(assumed.iter().map(ToString::to_string))
+    }
+
+    pub(super) fn deserialize<'de, D: Deserializer<'de>>(
+        deserializer: D,
+    ) -> Result<Vec<AssumedVarStore>, D::Error> {
+        Vec::<String>::deserialize(deserializer)?
+            .iter()
+            .map(|text| text.parse().map_err(D::Error::custom))
+            .collect()
+    }
+}
+
+/// Why staging refuses, before it writes anything.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub(crate) enum StageRefusal {
+    #[error(
+        "BootNext names {0}, which uefisettings did not stage; staging would replace it, as \
+         BootNext names one option"
+    )]
+    ForeignBootNext(LoadOptionName),
+    #[error(
+        "OsIndications holds {}, so the next boot does not start BootNext's option unattended",
+        bit_names(*.0)
+    )]
+    OsIndications(OsIndications),
+    #[error(
+        "the EFI system partition holds {}, which no staged set names",
+        .0.join(", ")
+    )]
+    ForeignFiles(Vec<String>),
+    #[error(
+        "OsIndications holds FILE_CAPSULE_DELIVERY_SUPPORTED and the EFI system partition holds \
+         {}, so the next boot processes capsules and clears BootNext without starting its option \
+         (UEFI 2.11 §8.5.5)",
+        .0.join(", ")
+    )]
+    CapsulesOnDisk(Vec<String>),
+}
+
+/// A record that uefisettings refuses to read.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub(crate) enum RecordError {
+    #[error("EFI variable {key} has attributes {attributes}, not those of uefisettings' records, {RECORD_ATTRIBUTES}")]
+    Attributes {
+        key: VariableKey,
+        attributes: VariableAttributes,
+    },
+    #[error("{text:?} is not {digits} lowercase hexadecimal digits")]
+    Hex { text: String, digits: usize },
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+    use std::collections::btree_map::Entry;
+    use std::collections::BTreeMap;
+
+    use super::*;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::load_option::DevicePathNode;
+    use crate::efi_variables::load_option::FilePathList;
+    use crate::efi_variables::load_option::LoadOptionAttributes;
+    use crate::hii::VariableInterface;
+
+    pub(super) const NONCE: Nonce = Nonce([
+        0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE,
+        0xFF,
+    ]);
+    pub(super) const OTHER_NONCE: Nonce = Nonce([0xA5; 16]);
+    const IMAGE: &str = "\\EFI\\uefisettings\\uefisettings.efi";
+    const DIGEST: Sha256Digest = Sha256Digest([0x42; 32]);
+    const FORM_SET: &str = "8C78A505-BAA0-4C4A-869F-000000001A09";
+    /// The staged set's Boot####
+    pub(super) const BOOT_OPTION: u16 = 0x0007;
+
+    pub(super) fn request(value: u64) -> StagedRequest {
+        StagedRequest {
+            question: "Generic Question".to_owned(),
+            form_set: FORM_SET.parse().expect("FORM_SET"),
+            question_id: 0x0201,
+            value_type: IfrValueType::NumSize8,
+            value,
+            include: IncludedStates::empty(),
+            assume_var_stores: Vec::new(),
+            unsafe_operations: UnsafeOperations::Refuse,
+        }
+    }
+
+    /// request(2), selected with every state and the bytes 01 ff stated at byte 3 of the VarStore
+    /// Mode, staged with --i-am-fine-to-brick-this-system.
+    pub(super) fn including_request() -> StagedRequest {
+        StagedRequest {
+            include: IncludedStates::all(),
+            assume_var_stores: vec!["Mode-11111111-1111-1111-1111-111111111111+3=01ff"
+                .parse()
+                .expect("a statement")],
+            unsafe_operations: UnsafeOperations::Allow,
+            ..request(2)
+        }
+    }
+
+    pub(super) fn staged_set() -> StagedSet {
+        StagedSet {
+            nonce: NONCE,
+            boot_option: BOOT_OPTION,
+            image: StagedImage {
+                path: IMAGE.to_owned(),
+                sha256: DIGEST,
+            },
+            requests: vec![request(1), including_request()],
+        }
+    }
+
+    pub(super) fn started(nonce: Nonce) -> Outcome {
+        Outcome::Started { nonce }
+    }
+
+    pub(super) fn finished(nonce: Nonce) -> Outcome {
+        Outcome::Finished {
+            nonce,
+            results: vec![RequestOutcome {
+                request: request(1),
+                applied: true,
+                result: "applied".to_owned(),
+                warnings: Vec::new(),
+            }],
+        }
+    }
+
+    fn interrupted() -> Outcome {
+        Outcome::Interrupted {
+            nonce: NONCE,
+            requests: staged_set().requests,
+        }
+    }
+
+    fn not_started() -> Outcome {
+        Outcome::NotStarted {
+            nonce: NONCE,
+            requests: staged_set().requests,
+        }
+    }
+
+    /// The JSON of `record`.
+    fn json(record: &impl Serialize) -> Vec<u8> {
+        serde_json::to_vec(record).expect("JSON of a record")
+    }
+
+    /// A Boot#### whose OptionalData is the command line of `nonce`.
+    pub(super) fn boot_option(nonce: Nonce) -> Vec<u8> {
+        let image = Ucs2String::try_from(IMAGE).expect("IMAGE in UCS-2");
+        LoadOption {
+            attributes: LoadOptionAttributes::ACTIVE
+                | LoadOptionAttributes::HIDDEN
+                | LoadOptionAttributes::CATEGORY_APP,
+            description: Ucs2String::try_from("uefisettings").expect("a description"),
+            file_paths: FilePathList::of(&[DevicePathNode::FilePath(image)])
+                .expect("a FilePathList"),
+            optional_data: optional_data(nonce).expect("the command line"),
+        }
+        .encode()
+    }
+
+    /// Variables that hold the record of staged_set(), its Boot####, BootNext if given and the
+    /// outcome if given.
+    pub(super) fn staged(boot_next: Option<u16>, outcome: Option<&Outcome>) -> HeldVariables {
+        let held = HeldVariables::default()
+            .with(STAGED_SET, UEFISETTINGS_VENDOR_GUID, &json(&staged_set()))
+            .with("Boot0007", EFI_GLOBAL_VARIABLE, &boot_option(NONCE));
+        let held = match boot_next {
+            Some(number) => held.with("BootNext", EFI_GLOBAL_VARIABLE, &number.to_le_bytes()),
+            None => held,
+        };
+        match outcome {
+            Some(outcome) => held.with(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID, &json(outcome)),
+            None => held,
+        }
+    }
+
+    /// The record `name` that `variables` hold, None if absent.
+    pub(super) fn record<T: DeserializeOwned>(variables: &HeldVariables, name: &str) -> Option<T> {
+        read_record(variables, name).expect("a record")
+    }
+
+    pub(super) fn held(variables: &HeldVariables, name: &str, vendor: Guid) -> bool {
+        variables
+            .variables
+            .borrow()
+            .contains_key(&key(name, vendor))
+    }
+
+    /// Files of staged images in memory, by path, each with its SHA-256; records each deletion.
+    /// A placed image reads back as `read_back` if given.
+    #[derive(Default)]
+    struct HeldFiles {
+        files: RefCell<BTreeMap<String, Sha256Digest>>,
+        deleted: RefCell<Vec<String>>,
+        read_back: Option<Sha256Digest>,
+        capsules: Vec<String>,
+    }
+
+    impl HeldFiles {
+        fn with(self, path: &str, sha256: Sha256Digest) -> Self {
+            self.files.borrow_mut().insert(path.to_owned(), sha256);
+            self
+        }
+    }
+
+    impl StagedFiles for HeldFiles {
+        fn list(&self) -> Result<Vec<String>> {
+            Ok(self.files.borrow().keys().cloned().collect())
+        }
+
+        fn sha256(&self, path: &str) -> Result<Option<Sha256Digest>> {
+            Ok(self.files.borrow().get(path).copied())
+        }
+
+        fn capsules(&self) -> Result<Vec<String>> {
+            Ok(self.capsules.clone())
+        }
+
+        fn delete(&self, path: &str) -> Result<()> {
+            self.deleted.borrow_mut().push(path.to_owned());
+            self.files.borrow_mut().remove(path);
+            Ok(())
+        }
+
+        fn place(&self, path: &str, image: &[u8]) -> Result<Sha256Digest> {
+            let digest = self
+                .read_back
+                .unwrap_or_else(|| Sha256Digest(Sha256::digest(image).into()));
+            match self.files.borrow_mut().entry(path.to_owned()) {
+                Entry::Occupied(_) => Err(anyhow!("{path} exists")),
+                Entry::Vacant(entry) => Ok(*entry.insert(digest)),
+            }
+        }
+    }
+
+    /// VariableData that fail to set `failing`, else are `held`.
+    pub(super) struct FailingSet<'a> {
+        pub(super) held: &'a HeldVariables,
+        pub(super) failing: VariableKey,
+    }
+
+    impl VariableData for FailingSet<'_> {
+        fn interface(&self) -> VariableInterface {
+            self.held.interface()
+        }
+
+        fn variable_data(&self, key: &VariableKey) -> Result<Option<VariableContents>> {
+            self.held.variable_data(key)
+        }
+
+        fn set_variable(&self, key: &VariableKey, contents: &VariableContents) -> Result<()> {
+            match *key == self.failing {
+                true => Err(anyhow!("no space for {key}")),
+                false => self.held.set_variable(key, contents),
+            }
+        }
+
+        fn delete_variable(&self, key: &VariableKey) -> Result<()> {
+            self.held.delete_variable(key)
+        }
+    }
+
+    /// The image that stage_new stages here.
+    const IMAGE_BYTES: &[u8] = b"MZ an image";
+
+    /// The Hard Drive node that stage_new names the image's partition by here.
+    fn hard_drive() -> HardDrive {
+        HardDrive {
+            partition_number: 1,
+            start: 2048,
+            size: 2048,
+            signature: crate::efi_variables::load_option::PartitionSignature::Gpt(
+                "8C78A505-BAA0-4C4A-869F-000000001A0E"
+                    .parse()
+                    .expect("a GUID"),
+            ),
+        }
+    }
+
+    /// The data and attributes of the variable `name` of `vendor`, if held.
+    fn data(
+        variables: &HeldVariables,
+        name: &str,
+        vendor: Guid,
+    ) -> Option<(Vec<u8>, VariableAttributes)> {
+        variables
+            .variables
+            .borrow()
+            .get(&key(name, vendor))
+            .map(|contents| (contents.data().to_vec(), contents.attributes()))
+    }
+
+    #[test]
+    fn records_are_json_with_their_ids_and_digests_as_text() {
+        let set = r#"{"nonce":"00112233445566778899aabbccddeeff","boot_option":7,"image":{"path":"\\EFI\\uefisettings\\uefisettings.efi","sha256":"4242424242424242424242424242424242424242424242424242424242424242"},"requests":[{"question":"Generic Question","form_set":"8C78A505-BAA0-4C4A-869F-000000001A09","question_id":513,"value_type":"EFI_IFR_TYPE_NUM_SIZE_8","value":1,"include":[],"assume_var_stores":[],"unsafe_operations":"refuse"},{"question":"Generic Question","form_set":"8C78A505-BAA0-4C4A-869F-000000001A09","question_id":513,"value_type":"EFI_IFR_TYPE_NUM_SIZE_8","value":2,"include":["grayed-out","suppressed","disabled"],"assume_var_stores":["Mode-11111111-1111-1111-1111-111111111111+3=01ff"],"unsafe_operations":"allow"}]}"#;
+        let request_json = r#"{"question":"Generic Question","form_set":"8C78A505-BAA0-4C4A-869F-000000001A09","question_id":513,"value_type":"EFI_IFR_TYPE_NUM_SIZE_8","value":1,"include":[],"assume_var_stores":[],"unsafe_operations":"refuse"}"#;
+        let outcomes = [
+            (
+                started(NONCE),
+                r#"{"state":"started","nonce":"00112233445566778899aabbccddeeff"}"#.to_owned(),
+            ),
+            (
+                finished(NONCE),
+                format!(
+                    r#"{{"state":"finished","nonce":"00112233445566778899aabbccddeeff","results":[{{"request":{request_json},"applied":true,"result":"applied","warnings":[]}}]}}"#
+                ),
+            ),
+            (
+                Outcome::NotStarted {
+                    nonce: NONCE,
+                    requests: vec![request(1)],
+                },
+                format!(
+                    r#"{{"state":"not-started","nonce":"00112233445566778899aabbccddeeff","requests":[{request_json}]}}"#
+                ),
+            ),
+            (
+                Outcome::Interrupted {
+                    nonce: NONCE,
+                    requests: vec![request(1)],
+                },
+                format!(
+                    r#"{{"state":"interrupted","nonce":"00112233445566778899aabbccddeeff","requests":[{request_json}]}}"#
+                ),
+            ),
+        ];
+
+        assert_eq!(
+            serde_json::to_string(&staged_set()).ok(),
+            Some(set.to_owned()),
+            "StagedSet"
+        );
+        assert_eq!(
+            serde_json::from_str::<StagedSet>(set).ok(),
+            Some(staged_set()),
+            "StagedSet read back"
+        );
+        for (outcome, text) in outcomes {
+            assert_eq!(
+                serde_json::to_string(&outcome).ok(),
+                Some(text.clone()),
+                "{text}"
+            );
+            assert_eq!(
+                serde_json::from_str::<Outcome>(&text).ok(),
+                Some(outcome),
+                "{text} read back"
+            );
+        }
+    }
+
+    #[test]
+    fn records_and_fields_that_are_not_what_they_write_are_refused() {
+        let nonce = "00112233445566778899aabbccddeeff";
+        assert_eq!(nonce.parse(), Ok(NONCE), "a nonce");
+        for text in [
+            "00112233445566778899AABBCCDDEEFF",
+            "00112233445566778899aabbccddeef",
+            "00112233445566778899aabbccddeeff0",
+            "00112233445566778899aabbccddeefg",
+            "",
+        ] {
+            assert_eq!(
+                text.parse::<Nonce>(),
+                Err(RecordError::Hex {
+                    text: text.to_owned(),
+                    digits: 32
+                }),
+                "nonce {text:?}"
+            );
+        }
+        assert_eq!(
+            "42".repeat(32).parse::<Sha256Digest>(),
+            Ok(DIGEST),
+            "a SHA-256"
+        );
+        assert!("42".repeat(31).parse::<Sha256Digest>().is_err(), "31 bytes");
+        for value_type in [
+            IfrValueType::NumSize8,
+            IfrValueType::NumSize16,
+            IfrValueType::NumSize32,
+            IfrValueType::NumSize64,
+            IfrValueType::Boolean,
+        ] {
+            assert_eq!(
+                value_type.to_string().parse(),
+                Ok(value_type),
+                "{value_type} read back"
+            );
+        }
+
+        let set = String::from_utf8(json(&staged_set())).expect("JSON");
+        for (case, text) in [
+            ("an unknown field", set.replacen("{", r#"{"extra":1,"#, 1)),
+            (
+                "an unknown value type",
+                set.replace("EFI_IFR_TYPE_NUM_SIZE_8", "EFI_IFR_TYPE_STRING"),
+            ),
+            ("a missing field", set.replace(r#""boot_option":7,"#, "")),
+            (
+                "an unknown state",
+                set.replace(r#""suppressed","#, r#""hidden","#),
+            ),
+            (
+                "a state twice named",
+                set.replace(r#""suppressed","#, r#""disabled","#),
+            ),
+            (
+                "states out of order",
+                set.replace(
+                    r#""grayed-out","suppressed""#,
+                    r#""suppressed","grayed-out""#,
+                ),
+            ),
+            (
+                "a statement that --assume-var-store refuses",
+                set.replace(
+                    "Mode-11111111-1111-1111-1111-111111111111+3=01ff",
+                    "Mode-11111111-1111-1111-1111-111111111111+3=0",
+                ),
+            ),
+            (
+                "the access_level of an older uefisettings, in place of assume_var_stores",
+                set.replace(r#""assume_var_stores":[]"#, r#""access_level":null"#),
+            ),
+            (
+                "an unknown grant of unsafe operations",
+                set.replace(
+                    r#""unsafe_operations":"allow""#,
+                    r#""unsafe_operations":"ask""#,
+                ),
+            ),
+            (
+                "no grant of unsafe operations",
+                set.replace(r#","unsafe_operations":"allow""#, ""),
+            ),
+            (
+                "the state read-only, which no condition gives",
+                set.replace(r#""disabled"]"#, r#""disabled","read-only"]"#),
+            ),
+        ] {
+            assert!(serde_json::from_str::<StagedSet>(&text).is_err(), "{case}");
+        }
+        for text in [
+            r#"{"state":"applied","nonce":"00112233445566778899aabbccddeeff"}"#,
+            r#"{"state":"started","nonce":"00112233445566778899aabbccddeeff","extra":1}"#,
+        ] {
+            assert!(serde_json::from_str::<Outcome>(text).is_err(), "{text}");
+        }
+    }
+
+    /// A request that an older uefisettings staged, with "access_level", is refused by that name,
+    /// null too, never read as one that states no VarStore bytes.
+    #[test]
+    fn a_request_of_an_older_uefisettings_is_refused_by_its_access_level() {
+        for level in ["null", r#""user""#] {
+            let text = format!(
+                r#"{{"question":"Generic Question","form_set":"8C78A505-BAA0-4C4A-869F-000000001A09","question_id":513,"value_type":"EFI_IFR_TYPE_NUM_SIZE_8","value":1,"include":[],"access_level":{level},"unsafe_operations":"refuse"}}"#
+            );
+            let error = serde_json::from_str::<StagedRequest>(&text)
+                .expect_err("a request with access_level");
+            assert!(
+                error
+                    .to_string()
+                    .starts_with("unknown field `access_level`"),
+                "{level}: {error}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_staged_set_s_command_line_is_its_nonce_after_the_image_and_command() {
+        let command: Vec<u8> = "uefisettings.efi apply-staged 00112233445566778899aabbccddeeff"
+            .encode_utf16()
+            .chain([0])
+            .flat_map(u16::to_le_bytes)
+            .collect();
+
+        assert_eq!(
+            optional_data(NONCE),
+            Ok(command),
+            "the OptionalData of NONCE"
+        );
+        assert_ne!(
+            optional_data(OTHER_NONCE),
+            optional_data(NONCE),
+            "another nonce's"
+        );
+    }
+
+    #[test]
+    fn the_state_follows_the_records_their_nonces_and_boot_next() {
+        let pending = StagedState::Pending(staged_set());
+        let over = |outcome| StagedState::Over(staged_set(), outcome);
+        let cases = [
+            (
+                "no record",
+                HeldVariables::default(),
+                StagedState::Idle(None),
+            ),
+            (
+                "an outcome only",
+                HeldVariables::default().with(
+                    STAGED_OUTCOME,
+                    UEFISETTINGS_VENDOR_GUID,
+                    &json(&finished(OTHER_NONCE)),
+                ),
+                StagedState::Idle(Some(finished(OTHER_NONCE))),
+            ),
+            (
+                "BootNext naming the set's Boot####",
+                staged(Some(BOOT_OPTION), None),
+                pending.clone(),
+            ),
+            ("no BootNext", staged(None, None), over(not_started())),
+            (
+                "BootNext naming another option",
+                staged(Some(0x0001), None),
+                over(not_started()),
+            ),
+            (
+                "started, BootNext naming the set's Boot####",
+                staged(Some(BOOT_OPTION), Some(&started(NONCE))),
+                over(interrupted()),
+            ),
+            (
+                "another set started, BootNext naming this one's Boot####",
+                staged(Some(BOOT_OPTION), Some(&started(OTHER_NONCE))),
+                pending,
+            ),
+            (
+                "another set started, no BootNext",
+                staged(None, Some(&started(OTHER_NONCE))),
+                over(not_started()),
+            ),
+            (
+                "another set finished, no BootNext",
+                staged(None, Some(&finished(OTHER_NONCE))),
+                over(not_started()),
+            ),
+            (
+                "finished",
+                staged(Some(BOOT_OPTION), Some(&finished(NONCE))),
+                over(finished(NONCE)),
+            ),
+            (
+                "settled as not started",
+                staged(Some(BOOT_OPTION), Some(&not_started())),
+                over(not_started()),
+            ),
+        ];
+        for (case, variables, want) in cases {
+            let got = StagedState::read(&variables).expect("the state");
+
+            assert_eq!(got, want, "{case}");
+        }
+    }
+
+    #[test]
+    fn records_of_other_attributes_or_data_are_refused() {
+        let variables = HeldVariables::default().with_attributes(
+            STAGED_SET,
+            UEFISETTINGS_VENDOR_GUID,
+            VariableAttributes::NON_VOLATILE | VariableAttributes::BOOTSERVICE_ACCESS,
+            &json(&staged_set()),
+        );
+        assert_eq!(
+            StagedState::read(&variables).map_err(|err| format!("{err:#}")),
+            Err(
+                "EFI variable UefisettingsStagedSet-dd16f539-09ed-41b9-8b64-d85d6cd93a8e has \
+                 attributes NON_VOLATILE | BOOTSERVICE_ACCESS, not those of uefisettings' \
+                 records, NON_VOLATILE | BOOTSERVICE_ACCESS | RUNTIME_ACCESS"
+                    .to_owned()
+            ),
+            "NV, BS"
+        );
+
+        let variables =
+            HeldVariables::default().with(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID, b"started");
+        let got = StagedState::read(&variables).map_err(|err| format!("{err:#}"));
+        assert!(
+            got.as_ref().is_err_and(|err| err.starts_with(
+                "EFI variable UefisettingsStagedOutcome-dd16f539-09ed-41b9-8b64-d85d6cd93a8e is \
+                 malformed: "
+            )),
+            "an outcome of no JSON: {got:?}"
+        );
+    }
+
+    #[test]
+    fn settling_records_the_outcome_and_deletes_what_is_still_the_set_s() {
+        let image = || HeldFiles::default().with(IMAGE, DIGEST);
+        let cases = [
+            (
+                "finished",
+                staged(Some(BOOT_OPTION), Some(&finished(NONCE))),
+                finished(NONCE),
+            ),
+            ("not started", staged(None, None), not_started()),
+            (
+                "interrupted",
+                staged(Some(BOOT_OPTION), Some(&started(NONCE))),
+                interrupted(),
+            ),
+        ];
+        for (case, variables, outcome) in cases {
+            let files = image();
+
+            let got = settle(&variables, &files).expect("settle");
+
+            assert_eq!(got, Settled::Idle(Some(outcome.clone())), "{case}");
+            assert_eq!(
+                record(&variables, STAGED_OUTCOME),
+                Some(outcome),
+                "{case}: the outcome"
+            );
+            assert_eq!(
+                record::<StagedSet>(&variables, STAGED_SET),
+                None,
+                "{case}: the record"
+            );
+            for name in ["Boot0007", "BootNext"] {
+                assert!(
+                    !held(&variables, name, EFI_GLOBAL_VARIABLE),
+                    "{case}: {name}"
+                );
+            }
+            assert_eq!(*files.deleted.borrow(), [IMAGE], "{case}: the image");
+
+            // nothing is left to settle
+            variables.set.borrow_mut().clear();
+            variables.deleted.borrow_mut().clear();
+            let again = settle(&variables, &files).expect("settle again");
+            assert_eq!(again, got, "{case}: again");
+            assert!(
+                variables.set.borrow().is_empty(),
+                "{case}: nothing set again"
+            );
+            assert!(
+                variables.deleted.borrow().is_empty(),
+                "{case}: nothing deleted again"
+            );
+            assert_eq!(
+                files.deleted.borrow().len(),
+                1,
+                "{case}: no file deleted again"
+            );
+        }
+    }
+
+    #[test]
+    fn settling_keeps_a_boot_option_and_image_that_are_no_longer_the_set_s() {
+        // Boot0007 starts another set, and BootNext names it
+        let variables = staged(Some(BOOT_OPTION), Some(&started(NONCE))).with(
+            "Boot0007",
+            EFI_GLOBAL_VARIABLE,
+            &boot_option(OTHER_NONCE),
+        );
+        let files = HeldFiles::default().with(IMAGE, Sha256Digest([0x24; 32]));
+
+        let got = settle(&variables, &files).expect("settle");
+
+        assert_eq!(got, Settled::Idle(Some(interrupted())), "the outcome");
+        assert_eq!(
+            variables
+                .variables
+                .borrow()
+                .get(&key("Boot0007", EFI_GLOBAL_VARIABLE))
+                .map(|contents| contents.data().to_vec()),
+            Some(boot_option(OTHER_NONCE)),
+            "another set's Boot0007"
+        );
+        assert!(
+            held(&variables, "BootNext", EFI_GLOBAL_VARIABLE),
+            "BootNext"
+        );
+        assert!(files.deleted.borrow().is_empty(), "a changed image");
+        assert_eq!(
+            record::<StagedSet>(&variables, STAGED_SET),
+            None,
+            "the record"
+        );
+
+        // no Boot0007 and no image
+        let variables = staged(None, None);
+        variables
+            .variables
+            .borrow_mut()
+            .remove(&key("Boot0007", EFI_GLOBAL_VARIABLE));
+        let files = HeldFiles::default();
+        assert_eq!(
+            settle(&variables, &files).expect("settle"),
+            Settled::Idle(Some(not_started())),
+            "nothing to delete but the record"
+        );
+        assert!(files.deleted.borrow().is_empty(), "no image");
+    }
+
+    #[test]
+    fn settling_leaves_a_pending_set_and_no_set_alone() {
+        let cases = [
+            (
+                "pending",
+                staged(Some(BOOT_OPTION), None),
+                Settled::Pending(staged_set()),
+            ),
+            (
+                "idle",
+                HeldVariables::default().with(
+                    STAGED_OUTCOME,
+                    UEFISETTINGS_VENDOR_GUID,
+                    &json(&finished(OTHER_NONCE)),
+                ),
+                Settled::Idle(Some(finished(OTHER_NONCE))),
+            ),
+        ];
+        for (case, variables, want) in cases {
+            let files = HeldFiles::default().with(IMAGE, DIGEST);
+
+            let got = settle(&variables, &files).expect("settle");
+
+            assert_eq!(got, want, "{case}");
+            assert!(variables.set.borrow().is_empty(), "{case}: nothing set");
+            assert!(
+                variables.deleted.borrow().is_empty(),
+                "{case}: nothing deleted"
+            );
+            assert!(files.deleted.borrow().is_empty(), "{case}: no file deleted");
+        }
+    }
+
+    #[test]
+    fn a_request_appended_to_the_pending_set_keeps_its_boot_option() {
+        let variables = staged(Some(BOOT_OPTION), None);
+        let files = HeldFiles::default().with(IMAGE, DIGEST);
+        let Ok(StagePlan::Append(mut set)) = plan_stage(&variables, &files) else {
+            panic!("no pending set to append to");
+        };
+
+        set.requests.push(request(3));
+        record_set(&variables, &set).expect("record the set");
+
+        let want = StagedSet {
+            requests: vec![request(1), including_request(), request(3)],
+            ..staged_set()
+        };
+        assert_eq!(
+            StagedState::read(&variables).expect("the state"),
+            StagedState::Pending(want),
+            "the pending set"
+        );
+        assert_eq!(
+            variables
+                .variables
+                .borrow()
+                .get(&key("Boot0007", EFI_GLOBAL_VARIABLE))
+                .map(|contents| contents.data().to_vec()),
+            Some(boot_option(NONCE)),
+            "its Boot0007"
+        );
+    }
+
+    /// Staging waits while OsIndications has FILE_CAPSULE_DELIVERY_SUPPORTED and the ESP holds a
+    /// capsule on disk, whose processing clears BootNext without starting its option.
+    #[test]
+    fn staging_waits_while_a_capsule_on_disk_would_clear_boot_next() {
+        let capsule = "\\EFI\\UpdateCapsule\\update.cap";
+        let with_bits = |bits: OsIndications| {
+            HeldVariables::default().with(
+                "OsIndications",
+                EFI_GLOBAL_VARIABLE,
+                &bits.bits().to_le_bytes(),
+            )
+        };
+        let cases = [
+            (
+                "FILE_CAPSULE_DELIVERY_SUPPORTED and a capsule",
+                with_bits(OsIndications::FILE_CAPSULE_DELIVERY_SUPPORTED),
+                vec![capsule.to_owned()],
+                Err(format!(
+                    "OsIndications holds FILE_CAPSULE_DELIVERY_SUPPORTED and the EFI system \
+                     partition holds {capsule}, so the next boot processes capsules and clears \
+                     BootNext without starting its option (UEFI 2.11 §8.5.5)"
+                )),
+            ),
+            (
+                "FILE_CAPSULE_DELIVERY_SUPPORTED without a capsule",
+                with_bits(OsIndications::FILE_CAPSULE_DELIVERY_SUPPORTED),
+                Vec::new(),
+                Ok(StagePlan::New),
+            ),
+            (
+                "a capsule without FILE_CAPSULE_DELIVERY_SUPPORTED",
+                with_bits(OsIndications::TIMESTAMP_REVOCATION),
+                vec![capsule.to_owned()],
+                Ok(StagePlan::New),
+            ),
+        ];
+        for (case, variables, capsules, want) in cases {
+            let files = HeldFiles {
+                capsules,
+                ..HeldFiles::default()
+            };
+            assert_eq!(
+                plan_stage(&variables, &files).map_err(|err| format!("{err:#}")),
+                want,
+                "{case}"
+            );
+            assert!(variables.set.borrow().is_empty(), "{case}: nothing written");
+        }
+    }
+
+    #[test]
+    fn a_new_set_writes_its_image_then_its_record_boot_option_and_boot_next() {
+        let image_digest = Sha256Digest(Sha256::digest(IMAGE_BYTES).into());
+        let support = |flags: u32| {
+            HeldVariables::default()
+                .with("Boot0000", EFI_GLOBAL_VARIABLE, &boot_option(OTHER_NONCE))
+                .with("Boot0001", EFI_GLOBAL_VARIABLE, &boot_option(OTHER_NONCE))
+                .with(
+                    "BootOptionSupport",
+                    EFI_GLOBAL_VARIABLE,
+                    &flags.to_le_bytes(),
+                )
+        };
+        let cases = [
+            (
+                "BootOptionSupport with EFI_BOOT_OPTION_SUPPORT_APP",
+                support(0x0000_0103),
+                LoadOptionAttributes::CATEGORY_APP,
+            ),
+            (
+                "BootOptionSupport without it",
+                support(0x0000_0001),
+                LoadOptionAttributes::empty(),
+            ),
+            (
+                "no BootOptionSupport",
+                HeldVariables::default()
+                    .with("Boot0000", EFI_GLOBAL_VARIABLE, &boot_option(OTHER_NONCE))
+                    .with("Boot0001", EFI_GLOBAL_VARIABLE, &boot_option(OTHER_NONCE)),
+                LoadOptionAttributes::empty(),
+            ),
+        ];
+        for (case, variables, category) in cases {
+            let files = HeldFiles::default();
+
+            let set = stage_new(
+                &variables,
+                &files,
+                hard_drive(),
+                request(1),
+                IMAGE_BYTES,
+                NONCE,
+            )
+            .expect("stage a new set");
+
+            let want = StagedSet {
+                nonce: NONCE,
+                boot_option: 0x0002,
+                image: StagedImage {
+                    path: IMAGE.to_owned(),
+                    sha256: image_digest,
+                },
+                requests: vec![request(1)],
+            };
+            assert_eq!(set, want, "{case}: the set");
+            assert_eq!(
+                files.files.borrow().get(IMAGE),
+                Some(&image_digest),
+                "{case}: the image"
+            );
+            assert_eq!(
+                record(&variables, STAGED_SET),
+                Some(want),
+                "{case}: the record"
+            );
+            let load_option = LoadOption {
+                attributes: LoadOptionAttributes::ACTIVE | LoadOptionAttributes::HIDDEN | category,
+                description: Ucs2String::try_from("uefisettings: a set staged for this boot")
+                    .expect("a description"),
+                file_paths: FilePathList::of(&[
+                    DevicePathNode::HardDrive(hard_drive()),
+                    DevicePathNode::FilePath(Ucs2String::try_from(IMAGE).expect("IMAGE")),
+                ])
+                .expect("a FilePathList"),
+                optional_data: optional_data(NONCE).expect("the command line"),
+            };
+            let nv_bs_rt = VariableAttributes::NON_VOLATILE
+                | VariableAttributes::BOOTSERVICE_ACCESS
+                | VariableAttributes::RUNTIME_ACCESS;
+            assert_eq!(
+                data(&variables, "Boot0002", EFI_GLOBAL_VARIABLE),
+                Some((load_option.encode(), nv_bs_rt)),
+                "{case}: Boot0002"
+            );
+            assert_eq!(
+                data(&variables, "BootNext", EFI_GLOBAL_VARIABLE),
+                Some((vec![0x02, 0x00], nv_bs_rt)),
+                "{case}: BootNext"
+            );
+            assert_eq!(
+                *variables.set.borrow(),
+                [
+                    key(STAGED_SET, UEFISETTINGS_VENDOR_GUID),
+                    key("Boot0002", EFI_GLOBAL_VARIABLE),
+                    key("BootNext", EFI_GLOBAL_VARIABLE),
+                ],
+                "{case}: the writes, in order"
+            );
+            assert_eq!(
+                StagedState::read(&variables).expect("the state"),
+                StagedState::Pending(set),
+                "{case}: the state"
+            );
+        }
+    }
+
+    #[test]
+    fn a_new_set_that_fails_to_stage_leaves_nothing_of_it() {
+        for failing in [
+            key(STAGED_SET, UEFISETTINGS_VENDOR_GUID),
+            key("Boot0000", EFI_GLOBAL_VARIABLE),
+            key("BootNext", EFI_GLOBAL_VARIABLE),
+        ] {
+            let held = HeldVariables::default();
+            let variables = FailingSet {
+                held: &held,
+                failing: failing.clone(),
+            };
+            let files = HeldFiles::default();
+
+            let got = stage_new(
+                &variables,
+                &files,
+                hard_drive(),
+                request(1),
+                IMAGE_BYTES,
+                NONCE,
+            )
+            .map_err(|err| format!("{err:#}"));
+
+            assert_eq!(got, Err(format!("no space for {failing}")), "{failing}");
+            assert!(
+                held.variables.borrow().is_empty(),
+                "{failing}: no variable stays"
+            );
+            assert!(files.files.borrow().is_empty(), "{failing}: no image stays");
+        }
+
+        // the image reads back as other bytes
+        let variables = HeldVariables::default();
+        let files = HeldFiles {
+            read_back: Some(DIGEST),
+            ..HeldFiles::default()
+        };
+        let got = stage_new(
+            &variables,
+            &files,
+            hard_drive(),
+            request(1),
+            IMAGE_BYTES,
+            NONCE,
+        )
+        .map_err(|err| format!("{err:#}"));
+        assert_eq!(
+            got,
+            Err(format!(
+                "\\EFI\\uefisettings\\uefisettings.efi reads back with SHA-256 {DIGEST}, not the \
+                 image's {}",
+                Sha256Digest(Sha256::digest(IMAGE_BYTES).into())
+            )),
+            "a changed read-back"
+        );
+        assert!(
+            variables.variables.borrow().is_empty(),
+            "read back: no variable"
+        );
+        assert_eq!(
+            *files.deleted.borrow(),
+            [IMAGE],
+            "read back: the image deleted"
+        );
+    }
+
+    /// A new set takes the lowest Boot#### that no load option, BootOrder entry or BootNext
+    /// holds, so that no BootOrder entry boots it unattended.
+    #[test]
+    fn a_new_set_takes_a_number_that_neither_boot_order_nor_boot_next_holds() {
+        // Boot0001 is gone, but BootOrder still lists it; BootNext names Boot0002, gone too
+        let variables = HeldVariables::default()
+            .with("Boot0000", EFI_GLOBAL_VARIABLE, &boot_option(OTHER_NONCE))
+            .with("BootOrder", EFI_GLOBAL_VARIABLE, &[0x01, 0x00, 0x00, 0x00])
+            .with("BootNext", EFI_GLOBAL_VARIABLE, &[0x02, 0x00]);
+
+        let set = stage_new(
+            &variables,
+            &HeldFiles::default(),
+            hard_drive(),
+            request(1),
+            IMAGE_BYTES,
+            NONCE,
+        )
+        .expect("stage a new set");
+
+        assert_eq!(set.boot_option, 0x0003, "the set's Boot####");
+        assert!(
+            held(&variables, "Boot0003", EFI_GLOBAL_VARIABLE),
+            "Boot0003 written"
+        );
+        assert!(
+            !held(&variables, "Boot0001", EFI_GLOBAL_VARIABLE),
+            "no Boot0001, which BootOrder lists"
+        );
+    }
+
+    /// A new set whose image file exists, as a set staged at the same time may have placed it,
+    /// fails and keeps that file: its undoing deletes only an image that it placed.
+    #[test]
+    fn a_new_set_over_an_existing_image_fails_and_keeps_it() {
+        let image_digest = Sha256Digest(Sha256::digest(IMAGE_BYTES).into());
+        let variables = HeldVariables::default();
+        let files = HeldFiles::default().with(IMAGE, image_digest);
+
+        let got = stage_new(
+            &variables,
+            &files,
+            hard_drive(),
+            request(1),
+            IMAGE_BYTES,
+            NONCE,
+        )
+        .map_err(|err| format!("{err:#}"));
+
+        assert_eq!(got, Err(format!("{IMAGE} exists")), "the refusal");
+        assert_eq!(
+            files.files.borrow().get(IMAGE),
+            Some(&image_digest),
+            "the image stays"
+        );
+        assert!(files.deleted.borrow().is_empty(), "nothing deleted");
+        assert!(
+            variables.variables.borrow().is_empty(),
+            "no variable written"
+        );
+    }
+
+    #[test]
+    fn staging_appends_to_the_pending_set_or_stages_a_new_one() {
+        let os_indications = |bits: OsIndications| {
+            HeldVariables::default().with(
+                "OsIndications",
+                EFI_GLOBAL_VARIABLE,
+                &bits.bits().to_le_bytes(),
+            )
+        };
+        let other_file = "\\EFI\\uefisettings\\other.efi";
+        let cases = [
+            (
+                "no set",
+                HeldVariables::default(),
+                HeldFiles::default(),
+                Ok(StagePlan::New),
+            ),
+            (
+                "a pending set, its image named in another case",
+                staged(Some(BOOT_OPTION), None),
+                HeldFiles::default().with(&IMAGE.to_ascii_uppercase(), DIGEST),
+                Ok(StagePlan::Append(staged_set())),
+            ),
+            (
+                "a set whose boot is over, and its image",
+                staged(None, Some(&finished(NONCE))),
+                HeldFiles::default().with(IMAGE, DIGEST),
+                Ok(StagePlan::New),
+            ),
+            (
+                "OsIndications of other bits",
+                os_indications(
+                    OsIndications::TIMESTAMP_REVOCATION
+                        | OsIndications::FILE_CAPSULE_DELIVERY_SUPPORTED,
+                ),
+                HeldFiles::default(),
+                Ok(StagePlan::New),
+            ),
+            (
+                "BootNext naming an option of no set",
+                HeldVariables::default().with("BootNext", EFI_GLOBAL_VARIABLE, &[1, 0]),
+                HeldFiles::default(),
+                Err(
+                    "BootNext names Boot0001, which uefisettings did not stage; staging would \
+                     replace it, as BootNext names one option",
+                ),
+            ),
+            (
+                "BootNext naming an option other than the set's",
+                staged(Some(0x0001), None),
+                HeldFiles::default(),
+                Err(
+                    "BootNext names Boot0001, which uefisettings did not stage; staging would \
+                     replace it, as BootNext names one option",
+                ),
+            ),
+            (
+                "OsIndications BOOT_TO_FW_UI",
+                os_indications(OsIndications::BOOT_TO_FW_UI),
+                HeldFiles::default(),
+                Err(
+                    "OsIndications holds BOOT_TO_FW_UI, so the next boot does not start \
+                     BootNext's option unattended",
+                ),
+            ),
+            (
+                "OsIndications START_OS_RECOVERY and others",
+                os_indications(
+                    OsIndications::START_OS_RECOVERY | OsIndications::TIMESTAMP_REVOCATION,
+                ),
+                HeldFiles::default(),
+                Err(
+                    "OsIndications holds START_OS_RECOVERY, so the next boot does not start \
+                     BootNext's option unattended",
+                ),
+            ),
+            (
+                "OsIndications START_PLATFORM_RECOVERY",
+                os_indications(OsIndications::START_PLATFORM_RECOVERY),
+                HeldFiles::default(),
+                Err(
+                    "OsIndications holds START_PLATFORM_RECOVERY, so the next boot does not \
+                     start BootNext's option unattended",
+                ),
+            ),
+            (
+                "a file of no set",
+                HeldVariables::default(),
+                HeldFiles::default().with(other_file, DIGEST),
+                Err(
+                    "the EFI system partition holds \\EFI\\uefisettings\\other.efi, which no \
+                     staged set names",
+                ),
+            ),
+            (
+                "a pending set and a file it does not name",
+                staged(Some(BOOT_OPTION), None),
+                HeldFiles::default()
+                    .with(IMAGE, DIGEST)
+                    .with(other_file, DIGEST),
+                Err(
+                    "the EFI system partition holds \\EFI\\uefisettings\\other.efi, which no \
+                     staged set names",
+                ),
+            ),
+        ];
+        for (case, variables, files, want) in cases {
+            let got = plan_stage(&variables, &files).map_err(|err| format!("{err:#}"));
+
+            assert_eq!(got, want.map_err(str::to_owned), "{case}");
+        }
+    }
+
+    #[test]
+    fn get_notes_a_question_s_last_request_or_result() {
+        let question = StagedQuestion {
+            form_set: FORM_SET.parse().expect("FORM_SET"),
+            question_id: 0x0201,
+        };
+        let other = StagedQuestion {
+            question_id: 0x0202,
+            ..question
+        };
+        let refused = |value| RequestOutcome {
+            request: request(value),
+            applied: false,
+            result: format!("refused {value}"),
+            warnings: Vec::new(),
+        };
+        let applied = |warnings| RequestOutcome {
+            request: request(2),
+            applied: true,
+            result: "applied 2".to_owned(),
+            warnings,
+        };
+        let finished = |warnings| Outcome::Finished {
+            nonce: NONCE,
+            results: vec![refused(1), applied(warnings)],
+        };
+        let cases = [
+            ("no set, no outcome", StagedState::Idle(None), None),
+            (
+                "pending",
+                StagedState::Pending(staged_set()),
+                Some("value 2 is staged for the next boot, as Boot0007: restart to apply"),
+            ),
+            (
+                "finished",
+                StagedState::Over(staged_set(), finished(Vec::new())),
+                Some("the last staged boot applied value 2: applied 2"),
+            ),
+            (
+                "finished after unsafe operations",
+                StagedState::Over(
+                    staged_set(),
+                    finished(vec!["one lifted".to_owned(), "another".to_owned()]),
+                ),
+                Some(
+                    "the last staged boot applied value 2: applied 2; warning: one lifted; \
+                     warning: another",
+                ),
+            ),
+            (
+                "settled, not applied",
+                StagedState::Idle(Some(Outcome::Finished {
+                    nonce: NONCE,
+                    results: vec![refused(1)],
+                })),
+                Some("the last staged boot did not apply value 1: refused 1"),
+            ),
+            (
+                "interrupted",
+                StagedState::Over(staged_set(), interrupted()),
+                Some(
+                    "the last staged boot stopped while it applied value 2, which may be partly \
+                     applied",
+                ),
+            ),
+            (
+                "not started",
+                StagedState::Idle(Some(not_started())),
+                Some(
+                    "the last staged boot did not start uefisettings.efi, so value 2 is not \
+                     applied",
+                ),
+            ),
+            (
+                "a start whose set is gone",
+                StagedState::Idle(Some(started(NONCE))),
+                None,
+            ),
+        ];
+        for (case, state, want) in cases {
+            assert_eq!(
+                question.note(&state, |value| format!("value {value}")),
+                want.map(str::to_owned),
+                "{case}"
+            );
+            assert_eq!(
+                other.note(&state, |value| format!("value {value}")),
+                None,
+                "{case}: another question"
+            );
+        }
+    }
+}
diff --git a/src/lib/staged_set/apply.rs b/src/lib/staged_set/apply.rs
new file mode 100644
index 0000000..a1d9610
--- /dev/null
+++ b/src/lib/staged_set/apply.rs
@@ -0,0 +1,1096 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! apply-staged: what uefisettings.efi does when the staged set's Boot#### starts it, before the
+//! OS.
+
+use anyhow::anyhow;
+use anyhow::Context;
+use anyhow::Result;
+
+use super::boot_next_key;
+use super::boot_option_name;
+use super::read_record;
+use super::remove_boot_option;
+use super::starts_staged_set;
+use super::write_record;
+use super::Nonce;
+use super::Outcome;
+use super::RequestOutcome;
+use super::StagedRequest;
+use super::StagedSet;
+use super::STAGED_OUTCOME;
+use super::STAGED_SET;
+use crate::efi_variables::globals::boot_current;
+use crate::efi_variables::globals::boot_next;
+use crate::efi_variables::VariableData;
+use crate::hii::forms::PasswordQuestions;
+use crate::hii::package::ParsedPackageList;
+use crate::hii::PasswordBytesRefusal;
+use crate::hii::VariableKey;
+use crate::hii::VariableReach;
+use crate::unsafe_operations::LiftedOperations;
+use crate::unsafe_operations::UnsafeOperation;
+
+/// What applies a staged request before the OS starts: the question's driver.
+pub(crate) trait StagedRequestDriver {
+    /// Sets the question of `request` through its driver: the annotation of set's answer and the
+    /// unsafe operations that it lifted, or why it is not applied, with those that it lifted
+    /// before it failed (LiftedOperations).
+    fn apply(&self, request: &StagedRequest) -> Result<(String, Vec<UnsafeOperation>)>;
+}
+
+/// What apply_staged did.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct Application {
+    /// The result of each request, as recorded; None if it applied none
+    pub(crate) results: Option<Vec<RequestOutcome>>,
+    /// The variables that it deleted, in order
+    pub(crate) deleted: Vec<VariableKey>,
+    /// The steps that failed, in order; the steps after each still ran
+    pub(crate) failures: Vec<String>,
+}
+
+impl Application {
+    /// What uefisettings.efi prints of it: each request and its result, after the warning of each
+    /// unsafe operation that applying it lifted, as set prints them; each deletion, then each
+    /// failure.
+    pub(crate) fn lines(&self) -> Vec<String> {
+        let results = self.results.iter().flatten().flat_map(|outcome| {
+            let request = &outcome.request;
+            let applied = match outcome.applied {
+                true => "applied",
+                false => "not applied",
+            };
+            // the name as it is: uefisettings.efi prints the line as TerminalText, which
+            // escapes it once
+            let result = format!(
+                "question \"{}\", QuestionId {:#06x} of FormSet {}, to {}: {applied}: {}",
+                request.question,
+                request.question_id,
+                request.form_set,
+                request.value,
+                outcome.result
+            );
+            let warnings = outcome
+                .warnings
+                .iter()
+                .map(|warning| format!("warning: {warning}"));
+            warnings.chain(std::iter::once(result))
+        });
+        let deleted = self
+            .deleted
+            .iter()
+            .map(|key| format!("deleted {}", key.name));
+        let failures = self
+            .failures
+            .iter()
+            .map(|failure| format!("failed: {failure}"));
+        results.chain(deleted).chain(failures).collect()
+    }
+}
+
+/// apply_staged through `variables` without the bytes of the PASSWORD questions of the package
+/// lists `lists`, which no step writes over. Before the OS, a PASSWORD question whose VarStore is
+/// unknown could keep its password in any variable, so then it fails, and applies, records and
+/// deletes nothing.
+pub(crate) fn apply_staged_withholding(
+    lists: &[ParsedPackageList],
+    variables: impl VariableData,
+    nonce: &str,
+    driver: &impl StagedRequestDriver,
+) -> Result<Application> {
+    let variables = PasswordQuestions::of_lists(lists)
+        .withholding_of(variables, VariableReach::BootServices)?;
+    Ok(apply_staged(&variables, nonce, driver))
+}
+
+/// apply-staged of `nonce`, the text that ends the command line of the staged set's Boot####:
+/// records that uefisettings.efi started, applies each request of the staged set of `nonce`
+/// through `driver`, records each result, then deletes the set's Boot#### and BootNext if it names
+/// BootCurrent, whose Boot#### holds that command line. The set's record and image stay for the OS
+/// to settle. A step that fails is mapped to the outcome or listed in the failures, and the steps
+/// after it still run, but no request is applied unless the start is recorded. A nonce that has an
+/// outcome applies nothing again: a recorded start becomes Interrupted. Without a staged set of
+/// `nonce`, nothing is applied or recorded, and BootCurrent's Boot#### goes only if it holds the
+/// command line of `nonce`. Nor is any request applied after one refused as driver code changed
+/// password bytes (PasswordBytesRefusal), which uefisettings never restores.
+fn apply_staged(
+    variables: &impl VariableData,
+    nonce: &str,
+    driver: &impl StagedRequestDriver,
+) -> Application {
+    let mut deleted = Vec::new();
+    let mut failures = Vec::new();
+    let results = match staged_set_of(variables, nonce) {
+        Ok(set) => {
+            let results = match first_start(variables, &set) {
+                Ok(()) => Some(apply_requests(variables, &set, driver, &mut failures)),
+                Err(error) => {
+                    failures.push(format!("{error:#}"));
+                    None
+                }
+            };
+            match remove_boot_option(variables, boot_option_name(set.boot_option), set.nonce) {
+                Ok(removed) => deleted.extend(removed),
+                Err(error) => {
+                    failures.push(format!("delete Boot{:04X}: {error:#}", set.boot_option));
+                }
+            }
+            results
+        }
+        Err(error) => {
+            failures.push(format!("{error:#}"));
+            match remove_current_option(variables, nonce) {
+                Ok(removed) => deleted.extend(removed),
+                Err(error) => failures.push(format!("delete BootCurrent's Boot####: {error:#}")),
+            }
+            None
+        }
+    };
+    match remove_boot_next_of_current(variables, nonce) {
+        Ok(removed) => deleted.extend(removed),
+        Err(error) => failures.push(format!("delete BootNext: {error:#}")),
+    }
+    Application {
+        results,
+        deleted,
+        failures,
+    }
+}
+
+/// Refuses a second start of `set`, whose nonce already has an outcome, as when its Boot#### starts
+/// again after a crash, a hang or a failed deletion, so that no boot loops on it: a recorded start
+/// becomes Interrupted, as the OS would read it, and any other outcome stays.
+fn first_start(variables: &impl VariableData, set: &StagedSet) -> Result<()> {
+    let outcome = read_record::<Outcome>(variables, STAGED_OUTCOME)?
+        .filter(|outcome| outcome.nonce() == set.nonce);
+    match outcome {
+        None => return Ok(()),
+        Some(Outcome::Started { nonce }) => write_record(
+            variables,
+            STAGED_OUTCOME,
+            &Outcome::Interrupted {
+                nonce,
+                requests: set.requests.clone(),
+            },
+        )?,
+        Some(
+            Outcome::Finished { .. } | Outcome::Interrupted { .. } | Outcome::NotStarted { .. },
+        ) => {}
+    }
+    Err(anyhow!(
+        "the staged set of the nonce {} already started in an earlier boot, so none of its \
+         requests is applied again",
+        set.nonce
+    ))
+}
+
+/// The staged set of `nonce`, refused unless the records hold it.
+fn staged_set_of(variables: &impl VariableData, nonce: &str) -> Result<StagedSet> {
+    let nonce: Nonce = nonce.parse().context("the command line's nonce")?;
+    match read_record::<StagedSet>(variables, STAGED_SET)? {
+        Some(set) if set.nonce == nonce => Ok(set),
+        Some(set) => Err(anyhow!(
+            "the staged set has the nonce {}, not {nonce}",
+            set.nonce
+        )),
+        None => Err(anyhow!("no set is staged, so none of the nonce {nonce}")),
+    }
+}
+
+/// Records that uefisettings.efi started, applies each request of `set` through `driver` if that
+/// is recorded, then records Finished with each result, which it returns; a record that fails goes
+/// to `failures`. A request after one refused as driver code changed password bytes is not applied.
+fn apply_requests(
+    variables: &impl VariableData,
+    set: &StagedSet,
+    driver: &impl StagedRequestDriver,
+    failures: &mut Vec<String>,
+) -> Vec<RequestOutcome> {
+    let started = write_record(
+        variables,
+        STAGED_OUTCOME,
+        &Outcome::Started { nonce: set.nonce },
+    );
+    let mut password_refused = false;
+    let results: Vec<RequestOutcome> = set
+        .requests
+        .iter()
+        .map(|request| {
+            let applied = match (&started, password_refused) {
+                (Ok(()), false) => driver.apply(request),
+                (Ok(()), true) => Err(anyhow!(
+                    "not applied, as driver code changed password bytes while an earlier request \
+                     of this staged set was applied; uefisettings never writes a password byte"
+                )),
+                (Err(error), _) => Err(anyhow!(
+                    "not applied, as recording that uefisettings.efi started failed: {error:#}"
+                )),
+            };
+            if let Err(error) = &applied {
+                password_refused |= error
+                    .chain()
+                    .any(|cause| cause.is::<PasswordBytesRefusal>());
+            }
+            request_outcome(request, applied)
+        })
+        .collect();
+    if let Err(error) = started {
+        failures.push(format!("record that uefisettings.efi started: {error:#}"));
+    }
+    let outcome = Outcome::Finished {
+        nonce: set.nonce,
+        results: results.clone(),
+    };
+    if let Err(error) = write_record(variables, STAGED_OUTCOME, &outcome) {
+        failures.push(format!("record the outcome: {error:#}"));
+    }
+    results
+}
+
+/// The outcome of `request` that `applied` tells, with the warning of each unsafe operation that
+/// applying it lifted, also before it failed (LiftedOperations).
+fn request_outcome(
+    request: &StagedRequest,
+    applied: Result<(String, Vec<UnsafeOperation>)>,
+) -> RequestOutcome {
+    let (applied, result, lifted) = match applied {
+        Ok((annotation, lifted)) => (true, annotation, lifted),
+        Err(error) => {
+            let lifted = match error.downcast_ref::<LiftedOperations>() {
+                Some(LiftedOperations(lifted)) => lifted.clone(),
+                None => Vec::new(),
+            };
+            (false, format!("{error:#}"), lifted)
+        }
+    };
+    RequestOutcome {
+        request: request.clone(),
+        applied,
+        result,
+        warnings: lifted.iter().map(UnsafeOperation::lifted_warning).collect(),
+    }
+}
+
+/// Deletes BootCurrent's Boot#### if it holds the command line of a staged set of `nonce`; the
+/// variables deleted.
+fn remove_current_option(variables: &impl VariableData, nonce: &str) -> Result<Vec<VariableKey>> {
+    match (nonce.parse::<Nonce>(), boot_current(variables)?) {
+        (Ok(nonce), Some(current)) => remove_boot_option(variables, current, nonce),
+        (Err(_), _) | (Ok(_), None) => Ok(Vec::new()),
+    }
+}
+
+/// Deletes BootNext if it names BootCurrent and BootCurrent's Boot#### holds the command line of
+/// `nonce`, so that another tool's BootNext stays; the variables deleted. The boot manager deletes
+/// BootNext before it starts that option (UEFI 2.11 §3.1.2), so one that names it now was written
+/// since, and would start it at the next boot again.
+fn remove_boot_next_of_current(
+    variables: &impl VariableData,
+    nonce: &str,
+) -> Result<Vec<VariableKey>> {
+    let (Ok(nonce), Some(current), Some(next)) = (
+        nonce.parse::<Nonce>(),
+        boot_current(variables)?,
+        boot_next(variables)?,
+    ) else {
+        return Ok(Vec::new());
+    };
+    if current != next || !starts_staged_set(variables, current, nonce)? {
+        return Ok(Vec::new());
+    }
+    variables.delete_variable(&boot_next_key())?;
+    Ok(vec![boot_next_key()])
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+    use std::sync::Arc;
+
+    use super::*;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::tests::HeldVariables;
+    use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+    use crate::efi_variables::UEFISETTINGS_VENDOR_GUID;
+    use crate::hii::forms::ifr_fixtures::form;
+    use crate::hii::forms::ifr_fixtures::parse_form_set;
+    use crate::hii::forms::ifr_fixtures::password_on;
+    use crate::hii::forms::ifr_fixtures::var_store_efi_of;
+    use crate::hii::forms::ifr_fixtures::NIL_GUID;
+    use crate::hii::forms::ifr_fixtures::NV_BS_RT;
+    use crate::hii::forms::IFROperation;
+    use crate::hii::forms::IgnoredIfr;
+    use crate::hii::forms::IgnoredPasswords;
+    use crate::hii::forms::IncludedStates;
+    use crate::staged_set::tests::boot_option;
+    use crate::staged_set::tests::finished;
+    use crate::staged_set::tests::held;
+    use crate::staged_set::tests::including_request;
+    use crate::staged_set::tests::record;
+    use crate::staged_set::tests::request;
+    use crate::staged_set::tests::staged;
+    use crate::staged_set::tests::staged_set;
+    use crate::staged_set::tests::started;
+    use crate::staged_set::tests::FailingSet;
+    use crate::staged_set::tests::BOOT_OPTION;
+    use crate::staged_set::tests::NONCE;
+    use crate::staged_set::tests::OTHER_NONCE;
+    use crate::unsafe_operations::UnsafeOperations;
+
+    /// A driver that applies each request of an even value and refuses each of an odd one, and
+    /// records each request with the outcome recorded when it was asked.
+    struct StagedDriver<'a> {
+        variables: &'a HeldVariables,
+        asked: RefCell<Vec<(u64, Option<Outcome>)>>,
+        refusal: Refusal,
+    }
+
+    /// Why StagedDriver refuses a request.
+    #[derive(Clone, Copy)]
+    enum Refusal {
+        /// The driver refuses the value
+        Driver,
+        /// Driver code changed password bytes (PasswordBytesRefusal)
+        PasswordBytes,
+    }
+
+    impl<'a> StagedDriver<'a> {
+        fn new(variables: &'a HeldVariables) -> Self {
+            Self {
+                variables,
+                asked: RefCell::new(Vec::new()),
+                refusal: Refusal::Driver,
+            }
+        }
+    }
+
+    /// The unsafe operation that StagedDriver lifts for a request staged with
+    /// --i-am-fine-to-brick-this-system.
+    fn read_only_write() -> UnsafeOperation {
+        UnsafeOperation::ReadOnlyQuestion {
+            question: "Generic Question".to_owned(),
+            writable: IncludedStates::empty(),
+        }
+    }
+
+    impl StagedRequestDriver for StagedDriver<'_> {
+        /// Lifts read_only_write for a request staged with --i-am-fine-to-brick-this-system.
+        fn apply(&self, request: &StagedRequest) -> Result<(String, Vec<UnsafeOperation>)> {
+            self.asked
+                .borrow_mut()
+                .push((request.value, record(self.variables, STAGED_OUTCOME)));
+            let lifted = match request.unsafe_operations {
+                UnsafeOperations::Refuse => Vec::new(),
+                UnsafeOperations::Allow => vec![read_only_write()],
+            };
+            match (request.value % 2, self.refusal) {
+                (0, _) => Ok((format!("<applied {}>", request.value), lifted)),
+                (_, Refusal::Driver) => Err(LiftedOperations::attach(
+                    lifted,
+                    anyhow!("the driver refused {}", request.value),
+                )),
+                (_, Refusal::PasswordBytes) => Err(LiftedOperations::attach(
+                    lifted,
+                    PasswordBytesRefusal(format!(
+                        "driver code changed password bytes for {}",
+                        request.value
+                    ))
+                    .into(),
+                )),
+            }
+        }
+    }
+
+    /// The results of staged_set() as StagedDriver applies it: request(1) refused, request(2)
+    /// applied with the warning of read_only_write.
+    fn applied() -> Vec<RequestOutcome> {
+        vec![
+            RequestOutcome {
+                request: request(1),
+                applied: false,
+                result: "the driver refused 1".to_owned(),
+                warnings: Vec::new(),
+            },
+            RequestOutcome {
+                request: including_request(),
+                applied: true,
+                result: "<applied 2>".to_owned(),
+                warnings: vec![read_only_write().lifted_warning()],
+            },
+        ]
+    }
+
+    #[test]
+    fn apply_staged_records_its_start_then_each_result_and_deletes_its_boot_option() {
+        let nonce = NONCE.to_string();
+        let variables = staged(None, Some(&finished(OTHER_NONCE))).with(
+            "BootCurrent",
+            EFI_GLOBAL_VARIABLE,
+            &BOOT_OPTION.to_le_bytes(),
+        );
+        let driver = StagedDriver::new(&variables);
+
+        let application = apply_staged(&variables, &nonce, &driver);
+
+        assert_eq!(
+            application,
+            Application {
+                results: Some(applied()),
+                deleted: vec![key("Boot0007", EFI_GLOBAL_VARIABLE)],
+                failures: Vec::new(),
+            },
+            "the application"
+        );
+        assert_eq!(
+            *driver.asked.borrow(),
+            [(1, Some(started(NONCE))), (2, Some(started(NONCE)))],
+            "each request, once its start is recorded"
+        );
+        assert_eq!(
+            record(&variables, STAGED_OUTCOME),
+            Some(Outcome::Finished {
+                nonce: NONCE,
+                results: applied(),
+            }),
+            "the outcome"
+        );
+        assert_eq!(
+            application.lines(),
+            [
+                "question \"Generic Question\", QuestionId 0x0201 of FormSet \
+                 8C78A505-BAA0-4C4A-869F-000000001A09, to 1: not applied: the driver refused 1",
+                "warning: cannot set question \"Generic Question\": EFI_IFR_FLAG_READ_ONLY makes it \
+                 read-only (UEFI 2.11 §33.3.8.2.2); --i-am-fine-to-brick-this-system lets \
+                 uefisettings write it",
+                "question \"Generic Question\", QuestionId 0x0201 of FormSet \
+                 8C78A505-BAA0-4C4A-869F-000000001A09, to 2: applied: <applied 2>",
+                "deleted Boot0007",
+            ],
+            "the lines"
+        );
+        assert_eq!(
+            *variables.set.borrow(),
+            [
+                key(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID),
+                key(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID),
+            ],
+            "the writes: started, then finished"
+        );
+        assert_eq!(
+            *variables.deleted.borrow(),
+            [key("Boot0007", EFI_GLOBAL_VARIABLE)],
+            "the deletions"
+        );
+        assert_eq!(
+            record(&variables, STAGED_SET),
+            Some(staged_set()),
+            "the record stays for the OS"
+        );
+
+        // BootNext as the boot manager leaves it, or as written since
+        for (case, boot_current, boot_next, current_command, deleted) in [
+            (
+                "BootNext of the set's Boot####",
+                0x0007u16,
+                Some(0x0007u16),
+                None,
+                true,
+            ),
+            (
+                "BootNext of BootCurrent, a copy of the set's Boot####",
+                0x0009,
+                Some(0x0009),
+                Some(NONCE),
+                true,
+            ),
+            // another tool's BootNext
+            (
+                "BootNext of BootCurrent, whose Boot#### holds another command line",
+                0x0009,
+                Some(0x0009),
+                Some(OTHER_NONCE),
+                false,
+            ),
+            (
+                "BootNext of BootCurrent, which is absent",
+                0x0009,
+                Some(0x0009),
+                None,
+                false,
+            ),
+            (
+                "BootNext of another option",
+                0x0007,
+                Some(0x0003),
+                None,
+                false,
+            ),
+        ] {
+            let variables = staged(boot_next, None).with(
+                "BootCurrent",
+                EFI_GLOBAL_VARIABLE,
+                &boot_current.to_le_bytes(),
+            );
+            let variables = match current_command {
+                Some(nonce) => variables.with("Boot0009", EFI_GLOBAL_VARIABLE, &boot_option(nonce)),
+                None => variables,
+            };
+
+            let application = apply_staged(&variables, &nonce, &StagedDriver::new(&variables));
+
+            assert_eq!(application.failures, Vec::<String>::new(), "{case}");
+            assert_eq!(
+                held(&variables, "BootNext", EFI_GLOBAL_VARIABLE),
+                !deleted,
+                "{case}: BootNext"
+            );
+            assert!(
+                !held(&variables, "Boot0007", EFI_GLOBAL_VARIABLE),
+                "{case}: the set's Boot####"
+            );
+        }
+    }
+
+    /// A line names the staged question as it is, in quotes, as the warning of a read-only
+    /// question does: uefisettings.efi prints each line as TerminalText, which escapes it once,
+    /// where a Debug escape would be escaped again.
+    #[test]
+    fn apply_staged_lines_name_the_question_as_it_is() {
+        let question = "C:\\A\u{1b}[2J";
+        let application = Application {
+            results: Some(vec![RequestOutcome {
+                request: StagedRequest {
+                    question: question.to_owned(),
+                    ..request(1)
+                },
+                applied: true,
+                result: "<applied 1>".to_owned(),
+                warnings: Vec::new(),
+            }]),
+            deleted: Vec::new(),
+            failures: Vec::new(),
+        };
+
+        assert_eq!(
+            application.lines(),
+            [format!(
+                "question \"{question}\", QuestionId 0x0201 of FormSet \
+                 8C78A505-BAA0-4C4A-869F-000000001A09, to 1: applied: <applied 1>"
+            )],
+            "the lines"
+        );
+    }
+
+    /// A set whose nonce already has an outcome, as when its Boot#### starts again after a crash
+    /// or a failed deletion, applies no request again: a start becomes Interrupted and any other
+    /// outcome stays, and its Boot#### and BootNext still go.
+    #[test]
+    fn apply_staged_applies_nothing_again_for_a_nonce_with_an_outcome() {
+        let nonce = NONCE.to_string();
+        let interrupted = Outcome::Interrupted {
+            nonce: NONCE,
+            requests: staged_set().requests,
+        };
+        for (outcome, want) in [
+            (started(NONCE), interrupted.clone()),
+            (finished(NONCE), finished(NONCE)),
+            (interrupted.clone(), interrupted.clone()),
+        ] {
+            let variables = staged(Some(BOOT_OPTION), Some(&outcome)).with(
+                "BootCurrent",
+                EFI_GLOBAL_VARIABLE,
+                &BOOT_OPTION.to_le_bytes(),
+            );
+            let driver = StagedDriver::new(&variables);
+
+            let application = apply_staged(&variables, &nonce, &driver);
+
+            assert!(
+                driver.asked.borrow().is_empty(),
+                "{outcome:?}: nothing applied"
+            );
+            assert_eq!(application.results, None, "{outcome:?}: no results");
+            assert_eq!(
+                application.failures,
+                [format!(
+                    "the staged set of the nonce {NONCE} already started in an earlier boot, so \
+                     none of its requests is applied again"
+                )],
+                "{outcome:?}: the failure"
+            );
+            assert_eq!(
+                record(&variables, STAGED_OUTCOME),
+                Some(want),
+                "{outcome:?}: the outcome"
+            );
+            assert_eq!(
+                application.deleted,
+                [
+                    key("BootNext", EFI_GLOBAL_VARIABLE),
+                    key("Boot0007", EFI_GLOBAL_VARIABLE),
+                ],
+                "{outcome:?}: deleted"
+            );
+        }
+    }
+
+    /// A request that fails after its driver lifted an unsafe operation keeps the warning of that
+    /// operation all the same, and its error after them, as set does.
+    #[test]
+    fn a_request_that_fails_keeps_the_warnings_of_what_it_lifted() {
+        let variables = staged(None, None);
+        let set = StagedSet {
+            requests: vec![StagedRequest {
+                value: 3,
+                ..including_request()
+            }],
+            ..staged_set()
+        };
+        let mut failures = Vec::new();
+
+        let results = apply_requests(
+            &variables,
+            &set,
+            &StagedDriver::new(&variables),
+            &mut failures,
+        );
+
+        let want = vec![RequestOutcome {
+            request: set.requests[0].clone(),
+            applied: false,
+            result: "after 1 unsafe operation(s) that --i-am-fine-to-brick-this-system let \
+                     through: the driver refused 3"
+                .to_owned(),
+            warnings: vec![read_only_write().lifted_warning()],
+        }];
+        assert_eq!(results, want, "the results");
+        assert_eq!(failures, Vec::<String>::new(), "the failures");
+        assert_eq!(
+            record(&variables, STAGED_OUTCOME),
+            Some(Outcome::Finished {
+                nonce: NONCE,
+                results: want,
+            }),
+            "the outcome"
+        );
+    }
+
+    /// After a request refused as driver code changed password bytes, also after it lifted an
+    /// unsafe operation, no request reaches the driver: its outcome says why, and the start and the
+    /// outcome are still recorded.
+    #[test]
+    fn apply_requests_applies_nothing_after_driver_code_changed_password_bytes() {
+        let not_applied = "not applied, as driver code changed password bytes while an earlier \
+                           request of this staged set was applied; uefisettings never writes a \
+                           password byte";
+        for (case, first, refusal, warnings) in [
+            (
+                "a refusal",
+                request(1),
+                "driver code changed password bytes for 1",
+                Vec::new(),
+            ),
+            (
+                "a refusal after a lifted operation",
+                StagedRequest {
+                    value: 3,
+                    ..including_request()
+                },
+                "after 1 unsafe operation(s) that --i-am-fine-to-brick-this-system let through: \
+                 driver code changed password bytes for 3",
+                vec![read_only_write().lifted_warning()],
+            ),
+        ] {
+            let variables = staged(None, None);
+            let set = StagedSet {
+                requests: vec![first.clone(), including_request()],
+                ..staged_set()
+            };
+            let driver = StagedDriver {
+                refusal: Refusal::PasswordBytes,
+                ..StagedDriver::new(&variables)
+            };
+            let mut failures = Vec::new();
+
+            let results = apply_requests(&variables, &set, &driver, &mut failures);
+
+            assert_eq!(
+                *driver.asked.borrow(),
+                [(first.value, Some(started(NONCE)))],
+                "{case}: the driver is asked once"
+            );
+            let want = vec![
+                RequestOutcome {
+                    request: first,
+                    applied: false,
+                    result: refusal.to_owned(),
+                    warnings,
+                },
+                RequestOutcome {
+                    request: including_request(),
+                    applied: false,
+                    result: not_applied.to_owned(),
+                    warnings: Vec::new(),
+                },
+            ];
+            assert_eq!(results, want, "{case}: the results");
+            assert_eq!(failures, Vec::<String>::new(), "{case}: the failures");
+            assert_eq!(
+                record(&variables, STAGED_OUTCOME),
+                Some(Outcome::Finished {
+                    nonce: NONCE,
+                    results: want,
+                }),
+                "{case}: the outcome"
+            );
+            assert_eq!(
+                *variables.set.borrow(),
+                [
+                    key(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID),
+                    key(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID),
+                ],
+                "{case}: the writes: started, then finished"
+            );
+        }
+    }
+
+    #[test]
+    fn apply_staged_applies_nothing_unless_its_start_is_recorded() {
+        let held_variables = staged(None, None).with(
+            "BootCurrent",
+            EFI_GLOBAL_VARIABLE,
+            &BOOT_OPTION.to_le_bytes(),
+        );
+        let variables = FailingSet {
+            held: &held_variables,
+            failing: key(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID),
+        };
+        let driver = StagedDriver::new(&held_variables);
+
+        let application = apply_staged(&variables, &NONCE.to_string(), &driver);
+
+        let full = "no space for UefisettingsStagedOutcome-dd16f539-09ed-41b9-8b64-d85d6cd93a8e";
+        let not_applied =
+            format!("not applied, as recording that uefisettings.efi started failed: {full}");
+        let want = vec![
+            RequestOutcome {
+                request: request(1),
+                applied: false,
+                result: not_applied.clone(),
+                warnings: Vec::new(),
+            },
+            RequestOutcome {
+                request: including_request(),
+                applied: false,
+                result: not_applied,
+                warnings: Vec::new(),
+            },
+        ];
+        assert_eq!(
+            application,
+            Application {
+                results: Some(want),
+                deleted: vec![key("Boot0007", EFI_GLOBAL_VARIABLE)],
+                failures: vec![
+                    format!("record that uefisettings.efi started: {full}"),
+                    format!("record the outcome: {full}"),
+                ],
+            },
+            "the application"
+        );
+        assert!(driver.asked.borrow().is_empty(), "no request applied");
+        assert!(
+            !held(&held_variables, "Boot0007", EFI_GLOBAL_VARIABLE),
+            "the Boot#### deleted all the same"
+        );
+    }
+
+    /// The package list of `root`, with no strings.
+    fn package_list(root: &Rc<RefCell<IFROperation>>) -> ParsedPackageList {
+        ParsedPackageList {
+            guid: NIL_GUID,
+            device_path: None,
+            strings: Vec::new(),
+            forms: vec![Rc::clone(root)],
+            ignored_ifr: Vec::new(),
+            outside_ifr: Vec::new(),
+            malformed_outside_stores: Vec::new(),
+            disabled_forms: Vec::new(),
+            first_var_stores: Vec::new(),
+        }
+    }
+
+    /// The package list of a PASSWORD question that keeps its password in the outcome record.
+    fn password_in_outcome_record() -> ParsedPackageList {
+        package_list(&parse_form_set(&[
+            var_store_efi_of(
+                1,
+                UEFISETTINGS_VENDOR_GUID.into(),
+                STAGED_OUTCOME,
+                NV_BS_RT,
+                40,
+            ),
+            form(1, &[password_on(0x10, 1, 1, 0)]),
+        ]))
+    }
+
+    /// apply-staged writes through the variables without the bytes of PASSWORD questions: where
+    /// a PASSWORD question keeps its password in the outcome record, its start is never recorded,
+    /// so it applies no request, and the record is never written; the Boot#### goes all the same.
+    #[test]
+    fn apply_staged_writes_no_password_byte() {
+        let held_variables = staged(None, None).with(
+            "BootCurrent",
+            EFI_GLOBAL_VARIABLE,
+            &BOOT_OPTION.to_le_bytes(),
+        );
+        let driver = StagedDriver::new(&held_variables);
+
+        let application = apply_staged_withholding(
+            &[password_in_outcome_record()],
+            &held_variables,
+            &NONCE.to_string(),
+            &driver,
+        )
+        .expect("the bytes of every password known");
+
+        let refusal = format!(
+            "EFI variable {} holds a password at bytes 0..40, which set never writes",
+            key(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID)
+        );
+        let not_applied =
+            format!("not applied, as recording that uefisettings.efi started failed: {refusal}");
+        assert_eq!(
+            application,
+            Application {
+                results: Some(vec![
+                    RequestOutcome {
+                        request: request(1),
+                        applied: false,
+                        result: not_applied.clone(),
+                        warnings: Vec::new(),
+                    },
+                    RequestOutcome {
+                        request: including_request(),
+                        applied: false,
+                        result: not_applied,
+                        warnings: Vec::new(),
+                    },
+                ]),
+                deleted: vec![key("Boot0007", EFI_GLOBAL_VARIABLE)],
+                failures: vec![
+                    format!("record that uefisettings.efi started: {refusal}"),
+                    format!("record the outcome: {refusal}"),
+                ],
+            },
+            "the application"
+        );
+        assert!(driver.asked.borrow().is_empty(), "no request applied");
+        assert!(
+            !held_variables
+                .set
+                .borrow()
+                .contains(&key(STAGED_OUTCOME, UEFISETTINGS_VENDOR_GUID)),
+            "the outcome record never written"
+        );
+        assert!(
+            !held(&held_variables, "Boot0007", EFI_GLOBAL_VARIABLE),
+            "the Boot#### deleted all the same"
+        );
+    }
+
+    /// Where IFR that uefisettings ignores may hold a PASSWORD question, whose bytes are then
+    /// unknown, apply-staged applies, records and deletes nothing.
+    #[test]
+    fn apply_staged_writes_nothing_without_the_bytes_of_every_password() {
+        let held_variables = staged(None, None).with(
+            "BootCurrent",
+            EFI_GLOBAL_VARIABLE,
+            &BOOT_OPTION.to_le_bytes(),
+        );
+        let mut ignored = password_in_outcome_record();
+        ignored.ignored_ifr = vec![IgnoredIfr {
+            package_list: NIL_GUID,
+            offset: 4,
+            reason: "an op that uefisettings cannot decode".to_owned(),
+            passwords: IgnoredPasswords::Declared(Arc::default()),
+        }];
+        let driver = StagedDriver::new(&held_variables);
+
+        let application =
+            apply_staged_withholding(&[ignored], &held_variables, &NONCE.to_string(), &driver);
+
+        assert_eq!(
+            application.map_err(|error| format!("{error:#}")),
+            Err(format!(
+                "PASSWORD questions of package list {NIL_GUID} may be in the IFR that \
+                 uefisettings ignores at offset 4 of a form package: an op that uefisettings \
+                 cannot decode; as the variable of that password is unknown, the UEFI Shell \
+                 build reads and writes no variable of this HiiDB"
+            )),
+            "the application"
+        );
+        assert!(driver.asked.borrow().is_empty(), "no request applied");
+        assert!(
+            held_variables.set.borrow().is_empty() && held_variables.deleted.borrow().is_empty(),
+            "nothing written or deleted"
+        );
+        assert!(
+            held(&held_variables, "Boot0007", EFI_GLOBAL_VARIABLE),
+            "the Boot#### stays"
+        );
+    }
+
+    /// Beside a PASSWORD that its driver may keep in any variable, one of VarStoreId 0, which
+    /// names no VarStore, or one that edk2 may route to a VARSTORE_NAME_VALUE, apply-staged
+    /// reads, applies, records and deletes nothing, as the password is unresolved, also of
+    /// staged_set()'s request staged with --i-am-fine-to-brick-this-system. Beside a PASSWORD on
+    /// a buffer VarStore it applies the requests.
+    #[test]
+    fn apply_staged_writes_nothing_where_a_driver_may_keep_a_password_in_any_variable() {
+        use crate::hii::forms::ifr_fixtures::var_store;
+        use crate::hii::forms::ifr_fixtures::var_store_name_value;
+
+        for var_store_id in [0, 3, 1] {
+            let held_variables = staged(None, None).with(
+                "BootCurrent",
+                EFI_GLOBAL_VARIABLE,
+                &BOOT_OPTION.to_le_bytes(),
+            );
+            let name_value = package_list(&parse_form_set(&[
+                var_store(1, [0x11; 16], "Store", 48),
+                var_store_name_value(3, [0x33; 16]),
+                form(1, &[password_on(0x10, 1, var_store_id, 4)]),
+            ]));
+            let driver = StagedDriver::new(&held_variables);
+
+            let application = apply_staged_withholding(
+                &[name_value],
+                &held_variables,
+                &NONCE.to_string(),
+                &driver,
+            )
+            .map_err(|error| format!("{error:#}"));
+
+            match var_store_id {
+                1 => assert_eq!(
+                    driver.asked.borrow().len(),
+                    2,
+                    "VarStoreId 1: the requests applied: {application:?}"
+                ),
+                _ => {
+                    assert!(
+                        application.as_ref().is_err_and(|error| {
+                            error.starts_with("PASSWORD question 0x0010 in FormSet ")
+                                && (var_store_id != 0
+                                    || error.contains(": VarStoreId 0 names no VarStore, "))
+                                && error.ends_with(
+                                    "; as the variable of that password is unknown, the UEFI \
+                                     Shell build reads and writes no variable of this HiiDB",
+                                )
+                        }),
+                        "VarStoreId {var_store_id}: the application: {application:?}"
+                    );
+                    assert_eq!(
+                        held_variables.read.borrow().as_slice(),
+                        [],
+                        "VarStoreId {var_store_id}: no variable read"
+                    );
+                    assert!(driver.asked.borrow().is_empty(), "no request applied");
+                    assert!(
+                        held_variables.set.borrow().is_empty()
+                            && held_variables.deleted.borrow().is_empty(),
+                        "nothing written or deleted"
+                    );
+                    assert!(
+                        held(&held_variables, "Boot0007", EFI_GLOBAL_VARIABLE),
+                        "the Boot#### stays"
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn apply_staged_without_a_staged_set_of_its_nonce_applies_and_records_nothing() {
+        let other = OTHER_NONCE.to_string();
+        let started_from = |variables: HeldVariables, nonce: Nonce| {
+            variables
+                .with("Boot0009", EFI_GLOBAL_VARIABLE, &boot_option(nonce))
+                .with("BootCurrent", EFI_GLOBAL_VARIABLE, &0x0009u16.to_le_bytes())
+        };
+        let cases = [
+            (
+                "another nonce's set",
+                started_from(staged(None, None), OTHER_NONCE),
+                other.clone(),
+                format!("the staged set has the nonce {NONCE}, not {other}"),
+                vec![key("Boot0009", EFI_GLOBAL_VARIABLE)],
+            ),
+            (
+                "no set",
+                started_from(HeldVariables::default(), OTHER_NONCE),
+                other.clone(),
+                format!("no set is staged, so none of the nonce {other}"),
+                vec![key("Boot0009", EFI_GLOBAL_VARIABLE)],
+            ),
+            (
+                "BootCurrent of another command line",
+                started_from(HeldVariables::default(), NONCE),
+                other.clone(),
+                format!("no set is staged, so none of the nonce {other}"),
+                Vec::new(),
+            ),
+            (
+                "a malformed nonce",
+                started_from(staged(None, None), OTHER_NONCE),
+                "a5".to_owned(),
+                "the command line's nonce: \"a5\" is not 32 lowercase hexadecimal digits"
+                    .to_owned(),
+                Vec::new(),
+            ),
+        ];
+        for (case, variables, nonce, failure, deleted) in cases {
+            let driver = StagedDriver::new(&variables);
+
+            let application = apply_staged(&variables, &nonce, &driver);
+
+            assert_eq!(
+                application,
+                Application {
+                    results: None,
+                    deleted: deleted.clone(),
+                    failures: vec![failure.clone()],
+                },
+                "{case}"
+            );
+            assert_eq!(
+                application.lines(),
+                deleted
+                    .iter()
+                    .map(|key| format!("deleted {}", key.name))
+                    .chain([format!("failed: {failure}")])
+                    .collect::<Vec<_>>(),
+                "{case}: the lines"
+            );
+            assert!(driver.asked.borrow().is_empty(), "{case}: nothing applied");
+            assert!(
+                variables.set.borrow().is_empty(),
+                "{case}: nothing recorded"
+            );
+            assert_eq!(*variables.deleted.borrow(), deleted, "{case}: deleted");
+        }
+    }
+}
diff --git a/src/lib/staged_set/next_boot.rs b/src/lib/staged_set/next_boot.rs
new file mode 100644
index 0000000..6e04194
--- /dev/null
+++ b/src/lib/staged_set/next_boot.rs
@@ -0,0 +1,1018 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! set on Linux and Windows of a question whose value only its driver holds: staged for the next
+//! boot, on the mounted EFI system partition that BootCurrent names.
+
+use std::fs;
+use std::path::Path;
+use std::path::PathBuf;
+
+use anyhow::Context;
+use anyhow::Result;
+use rand::Rng;
+
+use super::plan_stage;
+use super::record_set;
+use super::stage_new;
+use super::Nonce;
+use super::StagePlan;
+use super::StagedQuestion;
+use super::StagedRequest;
+use super::StagedSet;
+use super::StagedState;
+use crate::efi_variables::globals::secure_boot;
+use crate::efi_variables::VariableData;
+#[cfg(target_os = "linux")]
+use crate::esp::linux::LinuxPaths;
+#[cfg(target_os = "windows")]
+use crate::esp::win32_calls::RealEspCalls;
+use crate::esp::EspLocator;
+use crate::esp::MountedEsp;
+use crate::exports::set_refusal;
+use crate::exports::DriverHeldValues;
+use crate::exports::QuestionList;
+use crate::exports::SetOptions;
+use crate::hii::forms::AssumedVarStore;
+use crate::hii::forms::DriverHeldQuestion;
+use crate::hii::forms::IncludedStates;
+use crate::hii::forms::PasswordQuestions;
+use crate::hii::forms::QuestionDescriptor;
+use crate::hii::package::ParsedPackageList;
+#[cfg(target_os = "linux")]
+use crate::hii::EfivarFiles;
+#[cfg(target_os = "windows")]
+use crate::hii::FirmwareEnvironment;
+use crate::hii::VariableReach;
+use crate::hii::WithholdingVariables;
+use crate::unsafe_operations::UnsafeOperations;
+
+/// What set does on Linux and Windows with a question whose value only its driver holds: stages
+/// it for the next boot, the first set with the uefisettings.efi `image`, through the ESP's mount
+/// point `esp` if given, with the `include` and `assume_var_stores` that set selected it with and
+/// its grant of `unsafe_operations`, writing no byte of the HiiDB's `passwords`.
+pub(crate) struct NextBootStaging {
+    pub(crate) image: Option<PathBuf>,
+    pub(crate) esp: Option<PathBuf>,
+    pub(crate) include: IncludedStates,
+    pub(crate) assume_var_stores: Vec<AssumedVarStore>,
+    pub(crate) unsafe_operations: UnsafeOperations,
+    pub(crate) passwords: PasswordQuestions,
+}
+
+impl NextBootStaging {
+    /// What set stages with `options` in the HiiDB of the package lists `lists`.
+    pub(crate) fn of(options: &SetOptions, lists: &[ParsedPackageList]) -> Self {
+        Self {
+            image: options.staging_image.clone(),
+            esp: options.staging_esp.clone(),
+            include: options.include,
+            assume_var_stores: options.assume_var_stores.clone(),
+            unsafe_operations: options.unsafe_operations,
+            passwords: PasswordQuestions::of_lists(lists),
+        }
+    }
+
+    /// `variables` without the bytes of PASSWORD questions, which staging fails to write over:
+    /// staging writes at Runtime, and refuses up front what apply-staged's BootServices check
+    /// refuses.
+    fn withholding<V: VariableData>(&self, variables: V) -> Result<WithholdingVariables<V>> {
+        Ok(self
+            .passwords
+            .withholding_of(variables, VariableReach::Runtime)?)
+    }
+
+    /// Refuses, before anything is staged, what apply-staged would refuse before the OS, as its
+    /// withholding through BootServices refuses a PASSWORD question whose VarStore is unknown
+    /// (apply_staged_withholding), then what staging `question` through `variables` without the
+    /// bytes of PASSWORD questions, on the ESP that `locator` finds, through --esp if given,
+    /// would refuse: prepare.
+    fn check(
+        &self,
+        variables: impl VariableData,
+        locator: &impl EspLocator,
+        question: &str,
+    ) -> Result<()> {
+        self.passwords
+            .check_withholding(VariableReach::BootServices)?;
+        prepare(
+            &self.withholding(variables)?,
+            locator,
+            self.esp.as_deref(),
+            self.image.as_deref(),
+            question,
+        )
+        .map(drop)
+    }
+
+    /// Stages `request` through `variables` without the bytes of PASSWORD questions, on the ESP
+    /// that `locator` finds, through --esp if given, with --image: stage_request.
+    fn stage(
+        &self,
+        variables: impl VariableData,
+        locator: &impl EspLocator,
+        request: StagedRequest,
+        nonce: Nonce,
+    ) -> Result<String> {
+        stage_request(
+            &self.withholding(variables)?,
+            locator,
+            self.esp.as_deref(),
+            self.image.as_deref(),
+            request,
+            nonce,
+        )
+    }
+
+    /// The request of `value` for the question `question`, whose driver holds it as `held`.
+    fn request(&self, question: &str, held: &DriverHeldQuestion, value: u64) -> StagedRequest {
+        StagedRequest {
+            question: question.to_owned(),
+            form_set: held.form_set,
+            question_id: held.question_id,
+            value_type: held.value_type,
+            value,
+            include: self.include,
+            assume_var_stores: self.assume_var_stores.clone(),
+            unsafe_operations: self.unsafe_operations,
+        }
+    }
+
+    /// get's answer for `question`, whose driver holds it as `held`: its refusal, with what the
+    /// records of staged sets in `records`, if readable, tell of it.
+    pub(crate) fn answer(
+        records: Result<impl VariableData>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+    ) -> String {
+        let staged = StagedQuestion {
+            form_set: held.form_set,
+            question_id: held.question_id,
+        };
+        let note = records
+            .and_then(|records| StagedState::read(&records))
+            .map(|state| {
+                staged.note(&state, |value| {
+                    question
+                        .driver_held_text(value)
+                        .unwrap_or_else(|| value.to_string())
+                })
+            });
+        match note {
+            Ok(Some(note)) => format!("{} <{note}>", question.value),
+            Ok(None) => question.value.clone(),
+            Err(error) => format!(
+                "{} <the records of staged sets are unreadable: {error:#}>",
+                question.value
+            ),
+        }
+    }
+}
+
+impl DriverHeldValues for NextBootStaging {
+    fn store_name(&self) -> &'static str {
+        "staged for the next boot"
+    }
+
+    /// get reaches no driver from the OS: it shows the question's refusal, with what the records of
+    /// staged sets tell of the question.
+    fn get(
+        &self,
+        _list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+    ) -> Result<String> {
+        Ok(Self::answer(system_variables(), question, held))
+    }
+
+    /// apply-staged would apply the set, set finds the ESP, through --esp if given, plan_stage
+    /// allows staging there, and a new set has a readable --image: check.
+    fn check_set(
+        &self,
+        _list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        _held: &DriverHeldQuestion,
+    ) -> Result<()> {
+        self.check(system_variables()?, &system_esp(), &question.question)
+    }
+
+    fn set(
+        &self,
+        _list: &QuestionList<'_>,
+        question: &QuestionDescriptor,
+        held: &DriverHeldQuestion,
+        value: u64,
+    ) -> Result<String> {
+        self.stage(
+            system_variables()?,
+            &system_esp(),
+            self.request(&question.question, held, value),
+            Nonce(rand::thread_rng().gen()),
+        )
+    }
+}
+
+/// This machine's EFI variables: efivarfs on Linux, the firmware environment calls on Windows.
+#[cfg(target_os = "linux")]
+fn system_variables() -> Result<impl VariableData> {
+    Ok(EfivarFiles::system())
+}
+
+/// This machine's EFI variables: efivarfs on Linux, the firmware environment calls on Windows.
+#[cfg(target_os = "windows")]
+fn system_variables() -> Result<impl VariableData> {
+    FirmwareEnvironment::new()
+}
+
+/// What finds this machine's ESP: among its mounted vfat volumes on Linux, its volumes on Windows.
+#[cfg(target_os = "linux")]
+fn system_esp() -> impl EspLocator {
+    LinuxPaths::default()
+}
+
+/// What finds this machine's ESP: among its mounted vfat volumes on Linux, its volumes on Windows.
+#[cfg(target_os = "windows")]
+fn system_esp() -> impl EspLocator {
+    RealEspCalls
+}
+
+/// How stage_request stages a request, once prepare allowed it.
+enum Prepared {
+    /// Appended to the pending set
+    Append(StagedSet),
+    /// In a new set whose Boot#### starts a copy of these image bytes
+    New(Vec<u8>),
+}
+
+/// The ESP that `locator` finds, through its `mount_point` if given, and how a request of
+/// `question` is staged there: appended to the pending set, else in a new set with the bytes of
+/// `image`. Refused as set refuses `question`, before anything is staged.
+fn prepare(
+    variables: &impl VariableData,
+    locator: &impl EspLocator,
+    mount_point: Option<&Path>,
+    image: Option<&Path>,
+    question: &str,
+) -> Result<(MountedEsp, Prepared)> {
+    let esp = locator
+        .locate(variables)
+        .and_then(|esp| match mount_point {
+            Some(mount_point) => locator.mounted_at(esp, mount_point),
+            None => Ok(esp),
+        })
+        .map_err(|error| set_refusal(question, format!("{error:#}")))?;
+    let prepared = match plan_stage(variables, &esp)
+        .map_err(|error| set_refusal(question, format!("{error:#}")))?
+    {
+        StagePlan::Append(set) => Prepared::Append(set),
+        StagePlan::New => {
+            let Some(image) = image else {
+                return Err(set_refusal(question, missing_image(variables)?));
+            };
+            Prepared::New(fs::read(image).with_context(|| format!("read {}", image.display()))?)
+        }
+    };
+    Ok((esp, prepared))
+}
+
+/// Stages `request` on the ESP that `locator` finds, through its `mount_point` if given: appended
+/// to the pending set, else in a new set of `nonce` whose Boot#### starts a copy of `image`.
+/// Returns set's annotation.
+fn stage_request(
+    variables: &impl VariableData,
+    locator: &impl EspLocator,
+    mount_point: Option<&Path>,
+    image: Option<&Path>,
+    request: StagedRequest,
+    nonce: Nonce,
+) -> Result<String> {
+    let (esp, prepared) = prepare(variables, locator, mount_point, image, &request.question)?;
+    let set = match prepared {
+        Prepared::Append(mut set) => {
+            set.requests.push(request);
+            record_set(variables, &set)?;
+            set
+        }
+        Prepared::New(image) => stage_new(variables, &esp, esp.hard_drive, request, &image, nonce)?,
+    };
+    Ok(format!(
+        " <staged for the next boot, as Boot{:04X}: restart to apply>",
+        set.boot_option
+    ))
+}
+
+/// Why a new staged set needs --image: under Secure Boot, signed for db.
+fn missing_image(variables: &impl VariableData) -> Result<String> {
+    let staged = "its driver holds its value, which only uefisettings.efi reaches before the OS \
+                  starts; so set stages it for the next boot, which starts a uefisettings.efi \
+                  that set copies to the EFI system partition";
+    Ok(match secure_boot(variables)? == Some(1) {
+        true => format!(
+            "{staged}. Secure Boot is enabled, so name a uefisettings.efi signed for db with \
+             --image: the firmware does not start an image whose signature db lacks (UEFI 2.11 \
+             §32.4.2)"
+        ),
+        false => format!("{staged}. Name that uefisettings.efi with --image"),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use tempfile::TempDir;
+
+    use super::*;
+    use crate::efi_variables::globals::tests::key;
+    use crate::efi_variables::globals::EFI_GLOBAL_VARIABLE;
+    use crate::efi_variables::load_option::LoadOption;
+    use crate::efi_variables::UEFISETTINGS_VENDOR_GUID;
+    #[cfg(target_os = "linux")]
+    use crate::esp::linux::tests::FakeLinux;
+    use crate::esp::tests::booted_from;
+    use crate::esp::tests::gpt_512_esp;
+    use crate::esp::windows::tests::FakeWindows;
+    use crate::hii::forms::IfrValueType;
+    use crate::hii::VolatileWrites;
+    use crate::staged_set::StagedSet;
+    use crate::staged_set::StagedState;
+    use crate::staged_set::IMAGE_PATH;
+
+    const NONCE: Nonce = Nonce([0x5A; 16]);
+    const QUESTION: &str = "Generic Question";
+
+    fn request(value: u64) -> StagedRequest {
+        StagedRequest {
+            question: QUESTION.to_owned(),
+            form_set: "8C78A505-BAA0-4C4A-869F-000000001A09"
+                .parse()
+                .expect("a GUID"),
+            question_id: 0x0201,
+            value_type: IfrValueType::NumSize8,
+            value,
+            include: IncludedStates::empty(),
+            assume_var_stores: Vec::new(),
+            unsafe_operations: UnsafeOperations::Refuse,
+        }
+    }
+
+    /// The bytes 01 ff stated at byte 3 of the VarStore Mode.
+    const STATED: &str = "Mode-11111111-1111-1111-1111-111111111111+3=01ff";
+
+    /// set stages a request of the question and value with the states, the VarStore bytes stated
+    /// and the grant of unsafe operations that it selected the question with, and the image and
+    /// ESP mount point that it names.
+    #[test]
+    fn set_stages_what_it_selected() {
+        for grant in [UnsafeOperations::Refuse, UnsafeOperations::Allow] {
+            let options = SetOptions {
+                include: IncludedStates::GRAYED_OUT,
+                assume_var_stores: vec![STATED.parse().expect("a statement")],
+                unsafe_operations: grant,
+                // no request takes it: a driver, not a variable, keeps a staged value
+                volatile: VolatileWrites::Allow,
+                // no request takes it: a request holds the value, not the text it was picked by
+                language: Some("fr-FR".to_owned()),
+                staging_image: Some(PathBuf::from("uefisettings.efi")),
+                staging_esp: Some(PathBuf::from("S:")),
+            };
+            let form_set = "8C78A505-BAA0-4C4A-869F-000000001A09"
+                .parse()
+                .expect("a GUID");
+
+            let staging = NextBootStaging::of(&options, &[]);
+            let held = DriverHeldQuestion::checkbox(form_set, 0x0201);
+            let request = staging.request(QUESTION, &held, 1);
+
+            assert_eq!(staging.image, options.staging_image, "the image");
+            assert_eq!(staging.esp, options.staging_esp, "the ESP mount point");
+            assert_eq!(
+                request,
+                StagedRequest {
+                    question: QUESTION.to_owned(),
+                    form_set,
+                    question_id: 0x0201,
+                    value_type: IfrValueType::Boolean,
+                    value: 1,
+                    include: IncludedStates::GRAYED_OUT,
+                    assume_var_stores: vec![STATED.parse().expect("a statement")],
+                    unsafe_operations: grant,
+                },
+                "{grant:?}"
+            );
+        }
+    }
+
+    /// Stages a new set on the ESP that `esp` finds, through `mount` if given, then appends to it;
+    /// the files land under `root`.
+    fn stage_then_append(esp: &impl EspLocator, mount: Option<&Path>, root: &Path) {
+        let variables = booted_from(Some(gpt_512_esp()));
+        let images = TempDir::new().expect("a temporary directory");
+        let image = images.path().join("uefisettings.efi");
+        fs::write(&image, b"MZ uefisettings").expect("the image");
+
+        let staged = stage_request(&variables, esp, mount, Some(&image), request(1), NONCE);
+
+        assert_eq!(
+            staged.map_err(|err| format!("{err:#}")),
+            Ok(" <staged for the next boot, as Boot0000: restart to apply>".to_owned()),
+            "staged"
+        );
+        assert_eq!(
+            fs::read(
+                root.join("EFI")
+                    .join("uefisettings")
+                    .join("uefisettings.efi")
+            )
+            .ok(),
+            Some(b"MZ uefisettings".to_vec()),
+            "the image on the ESP"
+        );
+        let boot0000 = variables
+            .variables
+            .borrow()
+            .get(&key("Boot0000", EFI_GLOBAL_VARIABLE))
+            .map(|contents| LoadOption::decode(contents.data()).expect("Boot0000"))
+            .expect("Boot0000");
+        assert_eq!(
+            boot0000.file_paths.hard_drive(),
+            Ok(Some(gpt_512_esp())),
+            "Boot0000's Hard Drive node"
+        );
+        assert_eq!(
+            boot0000.file_paths.image_path().map(|nodes| nodes.len()),
+            Ok(2),
+            "Boot0000's HD()+File"
+        );
+        let StagedState::Pending(set) = StagedState::read(&variables).expect("the state") else {
+            panic!("no pending set");
+        };
+        assert_eq!(
+            (
+                set.boot_option,
+                set.image.path.as_str(),
+                set.requests.as_slice()
+            ),
+            (0x0000, IMAGE_PATH, [request(1)].as_slice()),
+            "the pending set"
+        );
+
+        // a second set appends, without --image
+        let appended = stage_request(&variables, esp, mount, None, request(2), Nonce([0; 16]));
+
+        assert_eq!(
+            appended.map_err(|err| format!("{err:#}")),
+            Ok(" <staged for the next boot, as Boot0000: restart to apply>".to_owned()),
+            "appended"
+        );
+        assert_eq!(
+            StagedState::read(&variables).expect("the state"),
+            StagedState::Pending(StagedSet {
+                requests: vec![request(1), request(2)],
+                ..set
+            }),
+            "the pending set, appended to"
+        );
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn set_stages_a_new_set_on_the_esp_then_appends_to_it() {
+        let (linux, mount_point) = FakeLinux::with_esp();
+        stage_then_append(&linux.paths, None, &mount_point);
+    }
+
+    /// On Windows, set copies the image through the ESP's volume GUID path, which a directory
+    /// stands for here.
+    #[test]
+    fn set_stages_a_new_set_on_the_esp_volume_then_appends_to_it() {
+        let root = TempDir::new().expect("a temporary directory");
+        let volume = format!("{}\\", root.path().join("volume").display());
+        stage_then_append(
+            &FakeWindows::with_esp_volume(&volume),
+            None,
+            Path::new(&volume),
+        );
+    }
+
+    /// With --esp, set writes the files through the mount point where the user mounted the ESP,
+    /// once the volume there is the ESP, whose GUID may come in either case; a directory stands for
+    /// the mount point here.
+    #[test]
+    fn set_stages_through_the_mount_point_of_the_esp() {
+        let root = TempDir::new().expect("a temporary directory");
+        let volume = r"\\?\Volume{8c78a505-baa0-4c4a-869f-000000001a03}\";
+        let mounted = r"\\?\Volume{8C78A505-BAA0-4C4A-869F-000000001A03}\";
+        let mount = format!("{}\\", root.path().join("S").display());
+        let windows = FakeWindows::with_esp_volume(volume).mount(&mount, mounted);
+
+        stage_then_append(&windows, Some(Path::new(&mount)), Path::new(&mount));
+    }
+
+    /// --esp names a mount point that set refuses unless the ESP is mounted there, and Linux, which
+    /// finds the ESP mounted, refuses any.
+    #[test]
+    fn set_refuses_an_esp_mount_point_that_is_not_the_esp() {
+        let variables = booted_from(Some(gpt_512_esp()));
+        let esp = r"\\?\Volume{8c78a505-baa0-4c4a-869f-000000001a03}\";
+        let data = r"\\?\Volume{8c78a505-baa0-4c4a-869f-000000001a02}\";
+        let windows = FakeWindows::with_esp_volume(esp)
+            .volume(data, 0, (4096, 2048))
+            .mount("D:\\", data);
+        let refused = "cannot set question \"Generic Question\": ";
+
+        for (case, mount_point, want) in [
+            (
+                "another volume",
+                "D:",
+                format!(
+                    "{refused}D:\\ is volume {data}, not the EFI system partition, volume {esp}"
+                ),
+            ),
+            (
+                "no volume",
+                "Q:\\",
+                format!(
+                    "{refused}cannot find the volume at Q:\\: \
+                     GetVolumeNameForVolumeMountPointW failed: Win32 error 2"
+                ),
+            ),
+        ] {
+            let got = stage_request(
+                &variables,
+                &windows,
+                Some(Path::new(mount_point)),
+                None,
+                request(1),
+                NONCE,
+            );
+            assert_eq!(got.map_err(|err| format!("{err:#}")), Err(want), "{case}");
+        }
+    }
+
+    #[test]
+    fn a_new_set_needs_an_image_signed_for_db_under_secure_boot() {
+        let windows = FakeWindows::with_esp();
+        let staged = "cannot set question \"Generic Question\": its driver holds its value, which \
+                      only uefisettings.efi reaches before the OS starts; so set stages it for the \
+                      next boot, which starts a uefisettings.efi that set copies to the EFI \
+                      system partition";
+        for (case, secure_boot, want) in [
+            (
+                "no SecureBoot",
+                None,
+                format!("{staged}. Name that uefisettings.efi with --image"),
+            ),
+            (
+                "SecureBoot 0",
+                Some(0u8),
+                format!("{staged}. Name that uefisettings.efi with --image"),
+            ),
+            (
+                "SecureBoot 1",
+                Some(1u8),
+                format!(
+                    "{staged}. Secure Boot is enabled, so name a uefisettings.efi signed for db \
+                     with --image: the firmware does not start an image whose signature db lacks \
+                     (UEFI 2.11 §32.4.2)"
+                ),
+            ),
+        ] {
+            let variables = booted_from(Some(gpt_512_esp()));
+            let variables = match secure_boot {
+                Some(value) => variables.with("SecureBoot", EFI_GLOBAL_VARIABLE, &[value]),
+                None => variables,
+            };
+
+            let got = stage_request(&variables, &windows, None, None, request(1), NONCE);
+
+            assert_eq!(got.map_err(|err| format!("{err:#}")), Err(want), "{case}");
+            assert!(
+                !variables
+                    .variables
+                    .borrow()
+                    .contains_key(&key("UefisettingsStagedSet", UEFISETTINGS_VENDOR_GUID)),
+                "{case}: no record"
+            );
+        }
+    }
+
+    /// Staging writes through the variables without the bytes of PASSWORD questions: in a HiiDB
+    /// whose PASSWORD question keeps its password in BootNext, as its VarStore or as a VarStore
+    /// outside any FormSet of its VarStoreId, a new set fails to write BootNext and undoes the
+    /// steps before it, so nothing is staged and BootNext is never written.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn staging_writes_no_password_byte() {
+        use crate::hii::forms::ifr_fixtures::form;
+        use crate::hii::forms::ifr_fixtures::form_set;
+        use crate::hii::forms::ifr_fixtures::parse_form_set;
+        use crate::hii::forms::ifr_fixtures::password_on;
+        use crate::hii::forms::ifr_fixtures::var_store_efi;
+        use crate::hii::forms::ifr_fixtures::var_store_efi_of;
+        use crate::hii::forms::ifr_fixtures::NIL_GUID;
+        use crate::hii::forms::ifr_fixtures::NV_BS_RT;
+        use crate::hii::package::hiidb_fixtures::form_package_of;
+        use crate::hii::package::hiidb_fixtures::package_list_with_guid;
+        use crate::hii::package::hiidb_fixtures::END_PACKAGE;
+        use crate::hii::package::read_db;
+
+        let boot_next = var_store_efi_of(1, EFI_GLOBAL_VARIABLE.into(), "BootNext", NV_BS_RT, 40);
+        let in_form_set = ParsedPackageList {
+            guid: NIL_GUID,
+            device_path: None,
+            strings: Vec::new(),
+            forms: vec![parse_form_set(&[
+                boot_next.clone(),
+                form(1, &[password_on(0x10, 1, 1, 0)]),
+            ])],
+            ignored_ifr: Vec::new(),
+            outside_ifr: Vec::new(),
+            malformed_outside_stores: Vec::new(),
+            disabled_forms: Vec::new(),
+            first_var_stores: Vec::new(),
+        };
+        let ifr = [
+            boot_next,
+            form_set(&[
+                var_store_efi(1, "Setup", NV_BS_RT, 40),
+                form(1, &[password_on(0x10, 1, 1, 0)]),
+            ]),
+        ];
+        let outside = read_db(&package_list_with_guid(
+            [0; 16],
+            &[form_package_of(&ifr.concat()), END_PACKAGE.to_vec()].concat(),
+        ))
+        .expect("read_db")
+        .remove(0);
+        for (case, list) in [
+            ("BootNext the PASSWORD's VarStore", in_form_set),
+            ("BootNext a VarStore outside any FormSet of its id", outside),
+        ] {
+            let (linux, esp) = FakeLinux::with_esp();
+            let variables = booted_from(Some(gpt_512_esp()));
+            let images = TempDir::new().expect("a temporary directory");
+            let image = images.path().join("uefisettings.efi");
+            fs::write(&image, b"MZ uefisettings").expect("the image");
+            let options = SetOptions {
+                staging_image: Some(image),
+                ..SetOptions::default()
+            };
+
+            let staged = NextBootStaging::of(&options, &[list]).stage(
+                &variables,
+                &linux.paths,
+                request(1),
+                NONCE,
+            );
+
+            assert_eq!(
+                staged.map_err(|err| format!("{err:#}")),
+                Err(format!(
+                    "EFI variable {} holds a password at bytes 0..40, which set never writes",
+                    key("BootNext", EFI_GLOBAL_VARIABLE)
+                )),
+                "{case}: staged"
+            );
+            assert!(
+                !variables
+                    .set
+                    .borrow()
+                    .contains(&key("BootNext", EFI_GLOBAL_VARIABLE)),
+                "{case}: BootNext never written"
+            );
+            assert_eq!(
+                StagedState::read(&variables).expect("the state"),
+                StagedState::Idle(None),
+                "{case}: nothing staged"
+            );
+            assert!(
+                !variables
+                    .variables
+                    .borrow()
+                    .contains_key(&key("Boot0000", EFI_GLOBAL_VARIABLE)),
+                "{case}: no Boot0000"
+            );
+            assert!(
+                !esp.join("EFI")
+                    .join("uefisettings")
+                    .join("uefisettings.efi")
+                    .exists(),
+                "{case}: no image on the ESP"
+            );
+        }
+    }
+
+    /// Staging writes through no variable of a HiiDB whose IFR past an op where the walk for
+    /// FormSets ends may hold a PASSWORD in any variable (AnyVariablePasswords), as get and set do
+    /// not: it refuses, and stages nothing.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn staging_refuses_a_hiidb_whose_ifr_past_the_walk_may_hold_a_password() {
+        use crate::hii::package::hiidb_fixtures::password_past_the_walk_hiidb;
+        use crate::hii::package::hiidb_fixtures::PAST_THE_WALK_LIST_GUID;
+        use crate::hii::package::read_db;
+        use crate::hii::package::Guid;
+
+        let lists = read_db(&password_past_the_walk_hiidb()).expect("read_db");
+        let (linux, esp) = FakeLinux::with_esp();
+        let variables = booted_from(Some(gpt_512_esp()));
+        let images = TempDir::new().expect("a temporary directory");
+        let image = images.path().join("uefisettings.efi");
+        fs::write(&image, b"MZ uefisettings").expect("the image");
+        let options = SetOptions {
+            staging_image: Some(image),
+            ..SetOptions::default()
+        };
+
+        let staged = NextBootStaging::of(&options, &lists).stage(
+            &variables,
+            &linux.paths,
+            request(1),
+            NONCE,
+        );
+
+        let want = format!(
+            "PASSWORD questions of package list {} may be in the IFR that uefisettings ignores at \
+             offset 0 of a form package, which has no op boundary, so in any variable: ",
+            Guid::from(PAST_THE_WALK_LIST_GUID)
+        );
+        let staged = staged.map_err(|err| format!("{err:#}"));
+        assert!(
+            staged.as_ref().is_err_and(|error| error.starts_with(&want)),
+            "staged: {staged:?}"
+        );
+        assert_eq!(variables.set.borrow().as_slice(), [], "no variable written");
+        assert!(
+            !esp.join("EFI").join("uefisettings").exists(),
+            "no image on the ESP"
+        );
+    }
+
+    /// Staging reads and writes no variable of a HiiDB with a PASSWORD that its driver may keep
+    /// in any variable (AnyVariablePasswords), one of VarStoreId 0, which names no VarStore, or
+    /// one that edk2 may route to a VARSTORE_NAME_VALUE, as get and set do not, also with
+    /// --i-am-fine-to-brick-this-system: it refuses, and stages nothing. Beside a PASSWORD on a
+    /// buffer VarStore it stages.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn staging_refuses_a_hiidb_whose_password_a_driver_may_keep_in_any_variable() {
+        use crate::hii::forms::ifr_fixtures::form;
+        use crate::hii::forms::ifr_fixtures::form_set;
+        use crate::hii::forms::ifr_fixtures::password_on;
+        use crate::hii::forms::ifr_fixtures::var_store;
+        use crate::hii::forms::ifr_fixtures::var_store_name_value;
+        use crate::hii::package::hiidb_fixtures::en_strings_package_of;
+        use crate::hii::package::hiidb_fixtures::form_package_of;
+        use crate::hii::package::hiidb_fixtures::package_list_with_guid;
+        use crate::hii::package::hiidb_fixtures::END_PACKAGE;
+        use crate::hii::package::read_db;
+
+        for var_store_id in [0, 3, 1] {
+            let lists = read_db(&package_list_with_guid(
+                [0x55; 16],
+                &[
+                    form_package_of(&form_set(&[
+                        var_store(1, [0x11; 16], "Store", 48),
+                        var_store_name_value(3, [0x33; 16]),
+                        form(1, &[password_on(3, 1, var_store_id, 4)]),
+                    ])),
+                    en_strings_package_of(&["Password"]),
+                    END_PACKAGE.to_vec(),
+                ]
+                .concat(),
+            ))
+            .expect("read_db");
+            let (linux, esp) = FakeLinux::with_esp();
+            let variables = booted_from(Some(gpt_512_esp()));
+            let images = TempDir::new().expect("a temporary directory");
+            let image = images.path().join("uefisettings.efi");
+            fs::write(&image, b"MZ uefisettings").expect("the image");
+            let options = SetOptions {
+                staging_image: Some(image),
+                unsafe_operations: UnsafeOperations::Allow,
+                ..SetOptions::default()
+            };
+            let request = StagedRequest {
+                unsafe_operations: UnsafeOperations::Allow,
+                ..request(1)
+            };
+
+            let staged = NextBootStaging::of(&options, &lists)
+                .stage(&variables, &linux.paths, request, NONCE)
+                .map_err(|err| format!("{err:#}"));
+
+            match var_store_id {
+                1 => assert!(staged.is_ok(), "VarStoreId 1: staged: {staged:?}"),
+                _ => {
+                    assert!(
+                        staged.as_ref().is_err_and(|error| {
+                            error.starts_with("PASSWORD question 0x0003 in FormSet ")
+                                && (var_store_id != 0
+                                    || error.contains(": VarStoreId 0 names no VarStore, "))
+                                && error.ends_with(
+                                    "; as a PASSWORD there may keep its password in any \
+                                     variable, uefisettings reads and writes no variable of \
+                                     this HiiDB",
+                                )
+                        }),
+                        "VarStoreId {var_store_id}: staged: {staged:?}"
+                    );
+                    assert_eq!(variables.set.borrow().as_slice(), [], "no variable written");
+                    assert_eq!(
+                        variables.read.borrow().as_slice(),
+                        [],
+                        "VarStoreId {var_store_id}: no variable read"
+                    );
+                    assert!(
+                        !esp.join("EFI").join("uefisettings").exists(),
+                        "no image on the ESP"
+                    );
+                }
+            }
+        }
+    }
+
+    /// Staging refuses up front, with apply-staged's refusal, a set that apply-staged would refuse
+    /// before the OS: in a HiiDB where IFR that uefisettings ignores may hold a PASSWORD question,
+    /// or with --i-am-fine-to-brick-this-system beside a PASSWORD outside any FormSet, whose
+    /// VarStore is then unknown, nothing is staged.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn staging_refuses_up_front_what_apply_staged_refuses() {
+        use std::sync::Arc;
+
+        use crate::hii::forms::ifr_fixtures::password_on;
+        use crate::hii::forms::ifr_fixtures::NIL_GUID;
+        use crate::hii::forms::IgnoredIfr;
+        use crate::hii::forms::IgnoredPasswords;
+        use crate::hii::package::hiidb_fixtures::form_package_of;
+        use crate::hii::package::hiidb_fixtures::package_list_with_guid;
+        use crate::hii::package::hiidb_fixtures::END_PACKAGE;
+        use crate::hii::package::read_db;
+
+        let unresolved = "PASSWORD questions of package list 00000000-0000-0000-0000-000000000000 \
+                          may be in the IFR that uefisettings ignores at offset 4 of a form \
+                          package: an op that uefisettings cannot decode; as the variable of that \
+                          password is unknown, the UEFI Shell build reads and writes no variable \
+                          of this HiiDB";
+        let ignored = ParsedPackageList {
+            guid: NIL_GUID,
+            device_path: None,
+            strings: Vec::new(),
+            forms: Vec::new(),
+            ignored_ifr: vec![IgnoredIfr {
+                package_list: NIL_GUID,
+                offset: 4,
+                reason: "an op that uefisettings cannot decode".to_owned(),
+                passwords: IgnoredPasswords::Declared(Arc::default()),
+            }],
+            outside_ifr: Vec::new(),
+            malformed_outside_stores: Vec::new(),
+            disabled_forms: Vec::new(),
+            first_var_stores: Vec::new(),
+        };
+        let outside = read_db(&package_list_with_guid(
+            [0; 16],
+            &[
+                form_package_of(&password_on(0x10, 1, 1, 0)),
+                END_PACKAGE.to_vec(),
+            ]
+            .concat(),
+        ))
+        .expect("read_db")
+        .remove(0);
+        let allowed = SetOptions {
+            unsafe_operations: UnsafeOperations::Allow,
+            ..SetOptions::default()
+        };
+        let cases = [
+            (
+                "IFR that uefisettings ignores",
+                ignored,
+                SetOptions::default(),
+                unresolved,
+            ),
+            (
+                "a PASSWORD outside any FormSet, allowed",
+                outside,
+                allowed,
+                "PASSWORD op of package list 00000000-0000-0000-0000-000000000000 outside a \
+                 FormSet, at offset 0 of a form package, which no Forms Browser shows but edk2's \
+                 Config Keyword Handler finds; as the variable of that password is unknown, the \
+                 UEFI Shell build reads and writes no variable of this HiiDB",
+            ),
+        ];
+        for (case, list, options, refusal) in cases {
+            let (linux, esp) = FakeLinux::with_esp();
+            let variables = booted_from(Some(gpt_512_esp()));
+            let images = TempDir::new().expect("a temporary directory");
+            let image = images.path().join("uefisettings.efi");
+            fs::write(&image, b"MZ uefisettings").expect("the image");
+            let options = SetOptions {
+                staging_image: Some(image),
+                ..options
+            };
+
+            let checked =
+                NextBootStaging::of(&options, &[list]).check(&variables, &linux.paths, QUESTION);
+
+            assert_eq!(
+                checked.map_err(|err| format!("{err:#}")),
+                Err(refusal.to_owned()),
+                "{case}: the check"
+            );
+            assert!(
+                variables.set.borrow().is_empty(),
+                "{case}: no variable written"
+            );
+            assert_eq!(
+                StagedState::read(&variables).expect("the state"),
+                StagedState::Idle(None),
+                "{case}: nothing staged"
+            );
+            assert!(
+                !esp.join("EFI")
+                    .join("uefisettings")
+                    .join("uefisettings.efi")
+                    .exists(),
+                "{case}: no image on the ESP"
+            );
+        }
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn set_on_linux_takes_no_esp_mount_point() {
+        let (linux, mount_point) = FakeLinux::with_esp();
+        let variables = booted_from(Some(gpt_512_esp()));
+
+        let got = stage_request(
+            &variables,
+            &linux.paths,
+            Some(Path::new("/mnt/esp")),
+            None,
+            request(1),
+            NONCE,
+        );
+
+        assert_eq!(
+            got.map_err(|err| format!("{err:#}")),
+            Err(format!(
+                "cannot set question \"Generic Question\": an ESP mount point, /mnt/esp, applies to \
+                 Windows; Linux writes through {}, where it finds the ESP mounted",
+                mount_point.display()
+            )),
+            "a mount point on Linux"
+        );
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn set_refuses_without_the_esp() {
+        let linux = FakeLinux::new();
+        let variables = booted_from(None);
+
+        let got = stage_request(&variables, &linux.paths, None, None, request(1), NONCE);
+
+        assert_eq!(
+            got.map_err(|err| format!("{err:#}")),
+            Err("cannot set question \"Generic Question\": no mounted vfat volume is an EFI system \
+                 partition; mount it. Mounted: none"
+                .to_owned()),
+            "no ESP"
+        );
+    }
+
+    #[test]
+    fn set_refuses_without_an_esp_volume() {
+        let variables = booted_from(Some(gpt_512_esp()));
+
+        let got = stage_request(
+            &variables,
+            &FakeWindows::default(),
+            None,
+            None,
+            request(1),
+            NONCE,
+        );
+
+        assert_eq!(
+            got.map_err(|err| format!("{err:#}")),
+            Err(
+                "cannot set question \"Generic Question\": no volume is the EFI system partition \
+                 that BootCurrent names, GPT partition 8C78A505-BAA0-4C4A-869F-000000001A0E. \
+                 Volumes: none"
+                    .to_owned()
+            ),
+            "no volume"
+        );
+    }
+}
diff --git a/src/lib/unsafe_operations.rs b/src/lib/unsafe_operations.rs
index 9a820e0..0a8f657 100644
--- a/src/lib/unsafe_operations.rs
+++ b/src/lib/unsafe_operations.rs
@@ -63,6 +63,9 @@ pub enum UnsafeOperation {
     /// A write, in the UEFI Shell, in a HiiDB that declares a setup password question, which no
     /// setup browser there asks for
     SetupPassword,
+    /// A set staged for the next boot in a HiiDB that declares a setup password question, which
+    /// uefisettings.efi applies before the OS, where no setup browser asks for it either
+    StagedSetupPassword,
     /// A write of `question`, which EFI_IFR_FLAG_READ_ONLY makes read-only; including the
     /// condition states `writable` selects a writable question of its text instead
     ReadOnlyQuestion {
@@ -100,6 +103,7 @@ impl UnsafeOperation {
     fn unlock(&self) -> &'static str {
         match self {
             Self::SetupPassword => "write without it",
+            Self::StagedSetupPassword => "stage it",
             Self::ReadOnlyQuestion { .. } => "write it",
             #[cfg(variable_data)]
             Self::SetupModePolicyWrite { .. } | Self::SetupModeDeviceDatabaseWrite { .. } => {
@@ -119,7 +123,9 @@ impl UnsafeOperation {
             Self::ReadOnlyQuestion { writable, .. } if !writable.is_empty() => {
                 format!(", or also include {writable} questions to select a writable one")
             }
-            Self::SetupPassword | Self::ReadOnlyQuestion { .. } => String::new(),
+            Self::SetupPassword | Self::StagedSetupPassword | Self::ReadOnlyQuestion { .. } => {
+                String::new()
+            }
             #[cfg(variable_data)]
             Self::SetupModePolicyWrite { .. }
             | Self::SetupModeDeviceDatabaseWrite { .. }
@@ -149,6 +155,10 @@ impl fmt::Display for UnsafeOperation {
                 "this HiiDB declares a setup password question, and the UEFI Shell runs no setup \
                  browser, so no password is asked or checked",
             ),
+            Self::StagedSetupPassword => f.write_str(
+                "this HiiDB declares a setup password question, and a set staged for the next boot \
+                 is applied before the OS, where no setup browser asks for or checks the password",
+            ),
             // the name as it is: a warning escapes it once, as TerminalText
             Self::ReadOnlyQuestion { question, .. } => write!(
                 f,
diff --git a/src/main.rs b/src/main.rs
index 9d9ef7f..78779df 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -29,7 +29,7 @@ use clap::Subcommand;
 use fbthrift::simplejson_protocol;
 use fbthrift::simplejson_protocol::Serializable;
 use log::info;
-use uefisettings::exports::AccessLevel;
+use uefisettings::exports::AssumedVarStore;
 use uefisettings::exports::EfivarSource;
 use uefisettings::exports::GetOptions;
 use uefisettings::exports::HiiBackend;
@@ -63,11 +63,15 @@ use capsule_command::CapsuleCommand;
 use platform::EfivarArgs;
 use platform::HiiDbArgs;
 use platform::HiiPlatformCommands;
+use platform::HiiSourceArgs;
 #[cfg(all(system_hiidb, system_variables))]
 use platform::HiiSourceUnsafeArgs;
 use platform::ListStringsHiiDbArgs;
+use platform::MachineHii;
 use platform::PlatformCommands;
 #[cfg(all(system_hiidb, system_variables))]
+use platform::StagingArgs;
+#[cfg(all(system_hiidb, system_variables))]
 use platform::VolatileArgs;
 #[cfg(system_variables)]
 use variable_command::VariableCommand;
@@ -104,40 +108,6 @@ struct UefiSettingsToolArgs {
     hii_source: HiiSourceArgs,
 }
 
-/// Where the commands read this machine's HiiDB; global, so that the flags may also follow the
-/// command. Only the Linux build reads it in more than one way.
-#[derive(Debug, Default, Args)]
-struct HiiSourceArgs {
-    #[arg(long, global = true, value_enum, default_value_t, help = platform::HII_SOURCE_HELP)]
-    hii_source: HiiSourceArg,
-    #[arg(long, global = true, value_enum, default_value_t, help = platform::EFIVAR_MEMORY_HELP)]
-    efivar_memory: EfivarMemoryArg,
-}
-
-/// The values of --hii-source.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, clap::ValueEnum)]
-enum HiiSourceArg {
-    /// acpi, then efivar, then systab: the next while a method finds its source absent or fails, none after a refusal (kernel lockdown, /dev/mem or /proc/kcore refused, or an unsafe operation without --i-am-fine-to-brick-this-system)
-    #[default]
-    Auto,
-    /// The memory that the OCP HiiDB variable points to, from /dev/mem
-    Efivar,
-    /// The vendor ACPI table QHII or HIID, from /sys/firmware/acpi/tables, without /dev/mem
-    Acpi,
-    /// The HII database export that the EFI System Table lists as a configuration table, from /dev/mem
-    Systab,
-}
-
-/// The values of --efivar-memory.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, clap::ValueEnum)]
-enum EfivarMemoryArg {
-    /// One EFI runtime region of the firmware's memory map that is no memory-mapped I/O
-    #[default]
-    Runtime,
-    /// One firmware-reserved region of the firmware's memory map (x86: Reserved or ACPI Non-volatile Storage in /sys/firmware/memmap; aarch64: reserved, runtime services code or data, ACPI NVS or PAL code), never one that touches runtime memory-mapped I/O
-    FirmwareReserved,
-}
-
 #[derive(Debug, Subcommand)]
 #[cfg_attr(
     target_os = "macos",
@@ -191,6 +161,8 @@ enum Commands {
         unsafe_operations: UnsafeArgs,
         #[command(flatten)]
         volatile: VolatileArgs,
+        #[command(flatten)]
+        staging: StagingArgs,
     },
     /// Show the translation/spellings database for questions and answers
     #[command(next_display_order = None)]
@@ -254,6 +226,8 @@ enum HiiSubcommands {
         unsafe_operations: UnsafeArgs,
         #[command(flatten)]
         volatile: VolatileArgs,
+        #[command(flatten)]
+        staging: StagingArgs,
     },
     /// Show a human readable representation of the Hii Forms
     #[command(next_display_order = None)]
@@ -436,12 +410,15 @@ impl IncludeArgs {
 struct SelectionArgs {
     #[command(flatten)]
     include: IncludeArgs,
-    /// Evaluate the conditions that read the AMI Setup access level (VarStore SystemAccess
-    /// E770BB69-BCB4-4D04-9E97-23FF9456FEAC: 0 Administrator, 1 User) at this level instead of
-    /// the stored value. This states a Setup privilege; it is no password and authenticates
-    /// nothing (UEFI variable writes carry no password).
-    #[arg(long, value_enum, value_name = "LEVEL")]
-    access_level: Option<AccessLevelArg>,
+    /// Evaluate conditions as if the VarStore whose efivar file is NAME-GUID held the bytes HEX,
+    /// two hex digits each, from byte OFFSET of its payload on (decimal, or hexadecimal after 0x;
+    /// default 0), whatever its variable holds; the reason of an unreadable value names
+    /// NAME-GUID+OFFSET. States, the options that conditions hide and the defaults they pick
+    /// follow these bytes; the questions on them still answer with what their variable holds,
+    /// and writes write the variable. This states what a setup browser holds; it is no password
+    /// and authenticates nothing (UEFI variable writes carry no password).
+    #[arg(long, value_name = "NAME-GUID[+OFFSET]=HEX")]
+    assume_var_store: Vec<AssumedVarStore>,
     #[command(flatten)]
     language: LanguageArgs,
 }
@@ -462,17 +439,13 @@ impl SelectionArgs {
     fn states(&self) -> IncludedStates {
         self.include.states()
     }
-
-    fn access_level(&self) -> Option<AccessLevel> {
-        self.access_level.map(AccessLevel::from)
-    }
 }
 
 impl From<&SelectionArgs> for GetOptions {
     fn from(args: &SelectionArgs) -> Self {
         let mut options = Self::default();
         options.include = args.states();
-        options.access_level = args.access_level();
+        options.assume_var_stores.clone_from(&args.assume_var_store);
         options.language.clone_from(&args.language.language);
         options
     }
@@ -483,7 +456,7 @@ impl From<&SelectionArgs> for SetOptions {
     fn from(args: &SelectionArgs) -> Self {
         let mut options = Self::default();
         options.include = args.states();
-        options.access_level = args.access_level();
+        options.assume_var_stores.clone_from(&args.assume_var_store);
         options.language.clone_from(&args.language.language);
         options
     }
@@ -493,7 +466,7 @@ impl From<&SelectionArgs> for ListQuestionsOptions {
     fn from(args: &SelectionArgs) -> Self {
         let mut options = Self::default();
         options.include = args.states();
-        options.access_level = args.access_level();
+        options.assume_var_stores.clone_from(&args.assume_var_store);
         options.language.clone_from(&args.language.language);
         options
     }
@@ -519,6 +492,17 @@ const READ_ONLY_WRITE: &str = "a write of a question that EFI_IFR_FLAG_READ_ONLY
                                picks a writable one first among matches equally certain to be \
                                selected";
 
+/// What set refuses without --i-am-fine-to-brick-this-system on the builds that stage a set for
+/// the next boot.
+#[cfg(all(
+    system_hiidb,
+    system_variables,
+    any(target_os = "linux", target_os = "windows")
+))]
+const STAGED_SETUP_PASSWORD: &str = "a set staged for the next boot in a HiiDB that declares a \
+                                     setup password question, which the next boot applies before \
+                                     the OS, where no setup browser asks for or checks it";
+
 /// --i-am-fine-to-brick-this-system, which only the commands that have an unsafe operation take.
 #[cfg(system_variables)]
 #[derive(Debug, Args)]
@@ -549,16 +533,19 @@ fn unsafe_long_help(arg: clap::Arg, operations: &[&str]) -> clap::Arg {
     ))
 }
 
-/// The SetOptions of `selection`, `unsafe_operations` and `volatile`.
+/// The SetOptions of `selection`, `unsafe_operations`, `volatile` and `staging`.
 #[cfg(all(system_hiidb, system_variables))]
 fn set_options(
     selection: &SelectionArgs,
     unsafe_operations: &UnsafeArgs,
     volatile: &VolatileArgs,
+    staging: &StagingArgs,
 ) -> SetOptions {
     let mut options = SetOptions::from(selection);
     options.unsafe_operations = unsafe_operations.operations();
     options.volatile = volatile.policy();
+    options.staging_image = staging.image();
+    options.staging_esp = staging.esp();
     options
 }
 
@@ -583,8 +570,9 @@ fn hii_set(
     options: &SetOptions,
     json: bool,
     source: &HiiSourceArgs,
+    hii: &impl MachineHii,
 ) -> Result<()> {
-    let (res, lifted) = platform::set_using(question, value, options, source)?;
+    let (res, lifted) = platform::set_using(question, value, options, source, hii)?;
     print_lifted(&lifted)?;
     print_with_style(res, json)?;
     Ok(())
@@ -624,21 +612,6 @@ impl From<IncludeState> for IncludedStates {
     }
 }
 
-#[derive(Debug, Clone, Copy, clap::ValueEnum)]
-enum AccessLevelArg {
-    Administrator,
-    User,
-}
-
-impl From<AccessLevelArg> for AccessLevel {
-    fn from(level: AccessLevelArg) -> Self {
-        match level {
-            AccessLevelArg::Administrator => AccessLevel::Administrator,
-            AccessLevelArg::User => AccessLevel::User,
-        }
-    }
-}
-
 // Every exit returns from main, whose ExitCode::FAILURE the UEFI Shell build's entry point turns
 // into EFI_ABORTED: std::process::exit, also through clap's Error::exit, would exit that image
 // with its code as the status, a warning such as 1 or 2.
@@ -687,6 +660,11 @@ fn parse_error_exit_code(error: &clap::Error) -> ExitCode {
 }
 
 fn handle_cmds(args: UefiSettingsToolArgs) -> Result<()> {
+    handle_cmds_with(args, &platform::Firmware)
+}
+
+/// handle_cmds, with this machine's HII backend reached through `hii`.
+fn handle_cmds_with(args: UefiSettingsToolArgs, hii: &impl MachineHii) -> Result<()> {
     let source = &args.hii_source;
     match &args.command {
         Commands::Hii(hii_command) => match &hii_command.command {
@@ -702,7 +680,7 @@ fn handle_cmds(args: UefiSettingsToolArgs) -> Result<()> {
                 // before the HiiDB is read
                 options.efivars.validate()?;
                 hii_get(
-                    &hiidb.read(&options.efivars, source)?,
+                    &hiidb.read(&options.efivars, source, hii)?,
                     question.selector()?,
                     &options,
                     output.json,
@@ -715,10 +693,11 @@ fn handle_cmds(args: UefiSettingsToolArgs) -> Result<()> {
                 selection,
                 unsafe_operations,
                 volatile,
+                staging,
             } => {
                 let (question, value) = target.target()?;
-                let options = set_options(selection, unsafe_operations, volatile);
-                hii_set(question, &value, &options, output.json, source)?
+                let options = set_options(selection, unsafe_operations, volatile, staging);
+                hii_set(question, &value, &options, output.json, source, hii)?
             }
             HiiSubcommands::ShowIFR {
                 hiidb,
@@ -731,13 +710,14 @@ fn handle_cmds(args: UefiSettingsToolArgs) -> Result<()> {
                 // before the HiiDB is read
                 options.efivars.validate()?;
                 let lines = HiiBackend::show_ifr_lines_using(
-                    &hiidb.read(&options.efivars, source)?,
+                    &hiidb.read(&options.efivars, source, hii)?,
                     &options,
                 )?;
                 print_terminal_lines(&lines)?;
             }
             HiiSubcommands::ListStrings { hiidb, output } => {
-                let res = HiiBackend::list_strings(&hiidb.read(&EfivarSource::Disabled, source)?)?;
+                let res =
+                    HiiBackend::list_strings(&hiidb.read(&EfivarSource::Disabled, source, hii)?)?;
                 print_with_style(res, output.json)?;
             }
             HiiSubcommands::ListQuestions {
@@ -751,7 +731,7 @@ fn handle_cmds(args: UefiSettingsToolArgs) -> Result<()> {
                 // before the HiiDB is read
                 options.efivars.validate()?;
                 let (res, ignored_ifr) = HiiBackend::list_questions_and_ignored_ifr_using(
-                    &hiidb.read(&options.efivars, source)?,
+                    &hiidb.read(&options.efivars, source, hii)?,
                     &options,
                 )?;
                 print_with_style(res, output.json)?;
@@ -760,7 +740,7 @@ fn handle_cmds(args: UefiSettingsToolArgs) -> Result<()> {
                     print_warning(format_args!("questions may be in {ignored}"))?;
                 }
             }
-            HiiSubcommands::Platform(command) => command.run(source)?,
+            HiiSubcommands::Platform(command) => command.run(source, hii)?,
         },
         #[cfg(all(system_hiidb, system_variables))]
         Commands::Get {
@@ -768,7 +748,14 @@ fn handle_cmds(args: UefiSettingsToolArgs) -> Result<()> {
             output,
             selection,
             unsafe_operations,
-        } => platform::auto_get(question, output.json, selection, unsafe_operations, source)?,
+        } => platform::auto_get(
+            question,
+            output.json,
+            selection,
+            unsafe_operations,
+            source,
+            hii,
+        )?,
         #[cfg(all(system_hiidb, system_variables))]
         Commands::Set {
             target,
@@ -776,18 +763,34 @@ fn handle_cmds(args: UefiSettingsToolArgs) -> Result<()> {
             selection,
             unsafe_operations,
             volatile,
+            staging,
         } => {
-            let options = set_options(selection, unsafe_operations, volatile);
-            platform::auto_set(target, output.json, selection, &options, source)?
+            let options = set_options(selection, unsafe_operations, volatile, staging);
+            platform::auto_set(
+                target,
+                output.json,
+                selection,
+                staging,
+                &options,
+                source,
+                hii,
+            )?
         }
         Commands::ShowTranslations { output } => {
+            source.refuse_given("show-translations reads none")?;
             print_with_style(&*translation_db, output.json)?;
         }
         #[cfg(system_variables)]
-        Commands::Variable(command) => command.run()?,
+        Commands::Variable(command) => {
+            source.refuse_given("variable reads none")?;
+            command.run()?
+        }
         #[cfg(system_variables)]
-        Commands::Capsule(command) => command.run()?,
-        Commands::Platform(command) => command.run(source)?,
+        Commands::Capsule(command) => {
+            source.refuse_given("capsule reads none")?;
+            command.run()?
+        }
+        Commands::Platform(command) => command.run(source, hii)?,
     }
     Ok(())
 }
@@ -882,6 +885,24 @@ fn write_warning(
     write_lines(output, console, OutputSyntax::Text, &warning)
 }
 
+/// Prints `line` of what apply-staged did, which may name the HiiDB's strings, such as the prompt
+/// of a staged question, as TerminalText after `apply-staged: `.
+#[cfg(target_os = "uefi")]
+fn print_apply_staged_line(line: &str) -> io::Result<()> {
+    let stdout = io::stdout();
+    write_apply_staged_line(&mut stdout.lock(), &mut platform::stdout_output()?, line)
+}
+
+#[cfg(any(target_os = "uefi", test))]
+fn write_apply_staged_line(
+    output: &mut impl Write,
+    console: &mut impl TextOutput,
+    line: &str,
+) -> io::Result<()> {
+    let line = format!("apply-staged: {}", TerminalText(line));
+    write_lines(output, console, OutputSyntax::Text, &line)
+}
+
 /// Prints `value` as TerminalText, or as its JSON text, as JsonText, if `json`.
 #[cfg(target_os = "uefi")]
 fn print_display_or_json(
@@ -1117,49 +1138,113 @@ mod tests {
         }
     }
 
+    /// --assume-var-store, repeatable, gives get, set and list-questions its statements in order;
+    /// a value that is no NAME-GUID[+OFFSET]=HEX is refused before any command runs.
     #[test]
-    fn access_level_maps_to_its_flag() {
+    fn assume_var_store_maps_to_its_flag() {
+        const MODE: &str = "Mode-11111111-1111-1111-1111-111111111111";
         let cases = [
-            ("no flag", vec![], None),
+            ("no flag", vec![], vec![]),
             (
-                "administrator",
-                vec!["--access-level", "administrator"],
-                Some(AccessLevel::Administrator),
+                "one",
+                vec!["--assume-var-store".to_string(), format!("{MODE}=01")],
+                vec![format!("{MODE}+0=01")],
             ),
             (
-                "user",
-                vec!["--access-level", "user"],
-                Some(AccessLevel::User),
+                "two",
+                vec![
+                    "--assume-var-store".to_string(),
+                    format!("{MODE}+2=0a0b"),
+                    "--assume-var-store".to_string(),
+                    format!("{MODE}+0x10=ff"),
+                ],
+                vec![format!("{MODE}+2=0a0b"), format!("{MODE}+16=ff")],
             ),
         ];
-        for (name, args, level) in cases {
+        for (name, args, want) in cases {
+            let args: Vec<&str> = args.iter().map(String::as_str).collect();
+            let shown = |assumed: &[AssumedVarStore]| -> Vec<String> {
+                assumed.iter().map(ToString::to_string).collect()
+            };
             let selection = selection_of(&args);
             assert_eq!(
-                GetOptions::from(&selection).access_level,
-                level,
+                shown(&GetOptions::from(&selection).assume_var_stores),
+                want,
                 "{name}: get"
             );
             #[cfg(all(system_hiidb, system_variables))]
             assert_eq!(
-                SetOptions::from(&set_selection_of(&args)).access_level,
-                level,
+                shown(&SetOptions::from(&set_selection_of(&args)).assume_var_stores),
+                want,
                 "{name}: set"
             );
             assert_eq!(
-                ListQuestionsOptions::from(&selection).access_level,
-                level,
+                shown(&ListQuestionsOptions::from(&selection).assume_var_stores),
+                want,
                 "{name}: list-questions"
             );
         }
 
-        let error = hii(&[
-            &["list-questions"][..],
-            &OFFLINE_SOURCE,
-            &["--access-level", "0"],
-        ]
-        .concat())
-        .expect_err("parse --access-level 0");
-        assert_eq!(error.kind(), clap::error::ErrorKind::InvalidValue, "0");
+        for value in [MODE, &format!("{MODE}=0"), &format!("{MODE}+x=00")] {
+            let error = hii(&[
+                &["list-questions"][..],
+                &OFFLINE_SOURCE,
+                &["--assume-var-store", value],
+            ]
+            .concat())
+            .expect_err("parse --assume-var-store");
+            assert_eq!(
+                error.kind(),
+                clap::error::ErrorKind::ValueValidation,
+                "{value}"
+            );
+        }
+    }
+
+    /// --assume-var-store comes with --include: on hii get, set and list-questions and on get and
+    /// set, not on show-ifr, which evaluates no conditions, nor on ilo.
+    #[test]
+    fn assume_var_store_is_taken_where_include_is() {
+        let reading: [(&[&str], bool); 3] = [
+            (&["hii", "get", "Q"], true),
+            (&["hii", "list-questions"], true),
+            (&["hii", "show-ifr"], false),
+        ];
+        let reading = reading.map(|(command, takes)| ([command, &OFFLINE_SOURCE].concat(), takes));
+        let commands = reading
+            .iter()
+            .map(|(command, takes)| (&command[..], *takes));
+        #[cfg(all(system_hiidb, system_variables))]
+        let commands = commands.into_iter().chain([
+            (&["hii", "set", "Q", "V"][..], true),
+            (&["get", "Q"], true),
+            (&["set", "Q", "V"], true),
+        ]);
+        // the Linux build's own command
+        #[cfg(target_os = "linux")]
+        let commands = commands
+            .into_iter()
+            .chain([(&["ilo", "get", "Q"][..], false)]);
+        for (command, takes) in commands {
+            let argv = [
+                &["uefisettings"][..],
+                command,
+                &[
+                    "--assume-var-store",
+                    "Mode-11111111-1111-1111-1111-111111111111=01",
+                ],
+            ]
+            .concat();
+            let parsed = UefiSettingsToolArgs::try_parse_from(argv).map_err(|error| error.kind());
+            match takes {
+                true => assert!(parsed.is_ok(), "{command:?}: {parsed:?}"),
+                false => assert_eq!(
+                    parsed.err(),
+                    Some(clap::error::ErrorKind::UnknownArgument),
+                    "{command:?}"
+                ),
+            }
+        }
     }
 
     /// No command's --include takes read-only: get and list-questions show read-only questions
@@ -1280,44 +1365,6 @@ mod tests {
         }
     }
 
-    /// --access-level comes with --include: on hii get, set and list-questions and on get and
-    /// set, not on show-ifr, which evaluates no conditions, nor on ilo.
-    #[test]
-    fn access_level_is_taken_where_include_is() {
-        let reading: [(&[&str], bool); 3] = [
-            (&["hii", "get", "Q"], true),
-            (&["hii", "list-questions"], true),
-            (&["hii", "show-ifr"], false),
-        ];
-        let reading = reading.map(|(command, takes)| ([command, &OFFLINE_SOURCE].concat(), takes));
-        let commands = reading
-            .iter()
-            .map(|(command, takes)| (&command[..], *takes));
-        #[cfg(all(system_hiidb, system_variables))]
-        let commands = commands.into_iter().chain([
-            (&["hii", "set", "Q", "V"][..], true),
-            (&["get", "Q"], true),
-            (&["set", "Q", "V"], true),
-        ]);
-        // the Linux build's own command
-        #[cfg(target_os = "linux")]
-        let commands = commands
-            .into_iter()
-            .chain([(&["ilo", "get", "Q"][..], false)]);
-        for (command, takes) in commands {
-            let argv = [&["uefisettings"][..], command, &["--access-level", "user"]].concat();
-            let parsed = UefiSettingsToolArgs::try_parse_from(argv).map_err(|error| error.kind());
-            match takes {
-                true => assert!(parsed.is_ok(), "{command:?}: {parsed:?}"),
-                false => assert_eq!(
-                    parsed.err(),
-                    Some(clap::error::ErrorKind::UnknownArgument),
-                    "{command:?}"
-                ),
-            }
-        }
-    }
-
     /// --language goes to the options of hii get, set and list-questions, get and set through
     /// their selection flags, and show-ifr; list-strings, which shows every language, and ilo
     /// take none.
@@ -1624,6 +1671,65 @@ mod tests {
         }
     }
 
+    #[test]
+    #[cfg(any(target_os = "linux", target_os = "windows"))]
+    fn set_takes_the_image_that_it_stages() {
+        let image = "/boot/uefisettings.efi";
+        let cases: [(&[&str], Option<std::path::PathBuf>); 2] = [
+            (&["set", "Question", "Value"], None),
+            (
+                &["set", "Question", "Value", "--image", image],
+                Some(image.into()),
+            ),
+        ];
+        for (args, want) in cases {
+            let parsed = hii(args).unwrap_or_else(|error| panic!("parse {args:?}: {error}"));
+            let HiiSubcommands::Set {
+                selection,
+                unsafe_operations,
+                volatile,
+                staging,
+                ..
+            } = parsed
+            else {
+                panic!("{args:?} is no set: {parsed:?}");
+            };
+
+            let options = set_options(&selection, &unsafe_operations, &volatile, &staging);
+
+            assert_eq!(options.staging_image, want, "{args:?}");
+        }
+    }
+
+    #[test]
+    #[cfg(target_os = "windows")]
+    fn set_on_windows_takes_the_mount_point_of_the_esp() {
+        let cases: [(&[&str], Option<std::path::PathBuf>); 2] = [
+            (&["set", "Question", "Value"], None),
+            (
+                &["set", "Question", "Value", "--esp", "S:"],
+                Some("S:".into()),
+            ),
+        ];
+        for (args, want) in cases {
+            let parsed = hii(args).unwrap_or_else(|error| panic!("parse {args:?}: {error}"));
+            let HiiSubcommands::Set {
+                selection,
+                unsafe_operations,
+                volatile,
+                staging,
+                ..
+            } = parsed
+            else {
+                panic!("{args:?} is no set: {parsed:?}");
+            };
+
+            let options = set_options(&selection, &unsafe_operations, &volatile, &staging);
+
+            assert_eq!(options.staging_esp, want, "{args:?}");
+        }
+    }
+
     /// The variable commands parse, which the macOS build lacks, as it has no variables.
     #[cfg(system_variables)]
     #[test]
@@ -2164,58 +2270,33 @@ mod tests {
         assert!(is_broken_pipe(&error.into()));
     }
 
-    /// The flags of the HiiDB source default to auto and runtime, take each of their values, are
-    /// global, so that they also follow the command, and refuse another value, on every build.
+    /// --hii-source and --efivar-memory exist on the Linux build only, the one build that reads
+    /// this machine's HiiDB in more than one way: elsewhere clap refuses them as unexpected
+    /// arguments, before and after the command, so that no build accepts and ignores them.
     #[test]
-    fn hii_source_flags_default_and_follow_the_command() {
-        let parse = |args: &[&str]| {
-            let argv = [&["uefisettings"][..], args].concat();
-            let parsed = UefiSettingsToolArgs::try_parse_from(&argv)
-                .unwrap_or_else(|error| panic!("parse {argv:?}: {error}"));
-            (
-                parsed.hii_source.hii_source,
-                parsed.hii_source.efivar_memory,
-            )
+    fn hii_source_flags_exist_on_linux_only() {
+        let takes = false;
+        #[cfg(target_os = "linux")]
+        let takes = !takes;
+        let want = match takes {
+            true => Ok(()),
+            false => Err(clap::error::ErrorKind::UnknownArgument),
         };
-        assert_eq!(
-            parse(&["show-translations"]),
-            (HiiSourceArg::Auto, EfivarMemoryArg::Runtime),
-            "the defaults"
-        );
-        for (value, want) in [
-            ("auto", HiiSourceArg::Auto),
-            ("efivar", HiiSourceArg::Efivar),
-            ("acpi", HiiSourceArg::Acpi),
-            ("systab", HiiSourceArg::Systab),
+        for (flag, value) in [
+            ("--hii-source", "efivar"),
+            ("--efivar-memory", "firmware-reserved"),
         ] {
             for args in [
-                &["--hii-source", value, "show-translations"][..],
-                &["show-translations", "--hii-source", value],
+                &[flag, value, "show-translations"][..],
+                &["show-translations", flag, value],
             ] {
-                assert_eq!(parse(args).0, want, "{args:?}");
+                let argv = [&["uefisettings"][..], args].concat();
+                let parsed = UefiSettingsToolArgs::try_parse_from(&argv)
+                    .map(drop)
+                    .map_err(|error| error.kind());
+                assert_eq!(parsed, want, "{argv:?}");
             }
         }
-        for (value, want) in [
-            ("runtime", EfivarMemoryArg::Runtime),
-            ("firmware-reserved", EfivarMemoryArg::FirmwareReserved),
-        ] {
-            for args in [
-                &["--efivar-memory", value, "show-translations"][..],
-                &["show-translations", "--efivar-memory", value],
-            ] {
-                assert_eq!(parse(args).1, want, "{args:?}");
-            }
-        }
-        for flag in ["--hii-source", "--efivar-memory"] {
-            let error = UefiSettingsToolArgs::try_parse_from([
-                "uefisettings",
-                flag,
-                "hiidb",
-                "show-translations",
-            ])
-            .expect_err("an unknown value");
-            assert_eq!(error.kind(), clap::error::ErrorKind::InvalidValue, "{flag}");
-        }
     }
 
     /// A text output that renders U+0020-U+007E only, as edk2-stable202608 TerminalDxe's PC-ANSI
@@ -2265,6 +2346,106 @@ mod tests {
         }
     }
 
+    /// get's answer and set's refusal of a question that its driver holds, which name the HiiDB's
+    /// strings, its prompt and what its driver did, such as the EFI variables that it changed,
+    /// print as every answer and error does: text as Debug, its control characters and
+    /// Bidi_Control characters escaped, JSON exact but for what JsonText spells, and through a
+    /// console that renders ASCII only, every other character escaped too.
+    #[test]
+    fn driver_held_answers_and_refusals_escape_firmware_texts() {
+        let prompt = "Q\u{1b}[2J\u{202e}\u{10d}";
+        let answer = uefisettings_backend_thrift::GetResponseList {
+            responses: vec![uefisettings_backend_thrift::GetResponse {
+                question: uefisettings_backend_thrift::Question {
+                    name: prompt.to_owned(),
+                    answer: "On <EFI variables changed: V\u{1b}-8c78a505-baa0-4c4a-869f-\
+                             000000000a01 (created)>"
+                        .to_owned(),
+                    ..Default::default()
+                },
+                ..Default::default()
+            }],
+            ..Default::default()
+        };
+        let refusal = uefisettings_backend_thrift::Error {
+            error_message: format!(
+                "cannot set question {prompt:?}: its driver's \
+                 CallBack(EFI_BROWSER_ACTION_CHANGING) refused the value: EFI_ACCESS_DENIED"
+            ),
+            ..Default::default()
+        };
+        let raw = ['\u{1b}', '\u{202e}', '\u{10d}'];
+        for json in [false, true] {
+            let mut ascii = Vec::new();
+            write_with_style(&mut ascii, &mut AsciiConsole, answer.clone(), json)
+                .expect("the answer through ASCII");
+            write_with_style(&mut ascii, &mut AsciiConsole, refusal.clone(), json)
+                .expect("the refusal through ASCII");
+            let ascii = String::from_utf8(ascii).expect("UTF-8");
+            assert!(
+                !ascii.contains(raw),
+                "json {json}, ASCII console: {ascii:?}"
+            );
+
+            let mut unicode = Vec::new();
+            write_with_style(&mut unicode, &mut UnicodeTerminal, answer.clone(), json)
+                .expect("the answer");
+            write_with_style(&mut unicode, &mut UnicodeTerminal, refusal.clone(), json)
+                .expect("the refusal");
+            let unicode = String::from_utf8(unicode).expect("UTF-8");
+            assert!(
+                !unicode.contains(['\u{1b}', '\u{202e}']),
+                "json {json}, UTF-8 terminal: {unicode:?}"
+            );
+            match json {
+                true => {
+                    let names: Vec<String> = unicode
+                        .lines()
+                        .filter_map(|line| serde_json::from_str::<serde_json::Value>(line).ok())
+                        .filter_map(|value| {
+                            value["responses"][0]["question"]["name"]
+                                .as_str()
+                                .map(str::to_owned)
+                        })
+                        .collect();
+                    assert_eq!(names, [prompt], "the prompt read back from the JSON");
+                }
+                false => assert!(
+                    unicode.contains("Q\\u{1b}[2J\\u{202e}\u{10d}"),
+                    "the prompt as Debug: {unicode:?}"
+                ),
+            }
+        }
+    }
+
+    /// A line of what apply-staged did, which names a staged question's prompt and its driver's
+    /// refusal, prints as TerminalText after `apply-staged: `, its line breaks escaped inside its
+    /// line, and through a console that renders ASCII only, every other character escaped too.
+    #[test]
+    fn apply_staged_lines_escape_firmware_texts() {
+        let line = "question \"Q\u{1b}[2J\u{202e}\u{10d}\": its driver refused\nthe value \\ \
+                    EFI_ACCESS_DENIED";
+        let mut unicode = Vec::new();
+        let mut ascii = Vec::new();
+
+        write_apply_staged_line(&mut unicode, &mut UnicodeTerminal, line).expect("write the line");
+        write_apply_staged_line(&mut ascii, &mut AsciiConsole, line)
+            .expect("write the line through ASCII");
+
+        assert_eq!(
+            String::from_utf8(unicode).expect("UTF-8"),
+            "apply-staged: question \"Q\\u{1b}[2J\\u{202e}\u{10d}\": its driver refused\\nthe \
+             value \\\\ EFI_ACCESS_DENIED\n",
+            "UTF-8 terminal"
+        );
+        assert_eq!(
+            String::from_utf8(ascii).expect("UTF-8"),
+            "apply-staged: question \"Q\\u{1b}[2J\\u{202e}\\u{10d}\": its driver refused\\nthe \
+             value \\\\ EFI_ACCESS_DENIED\n",
+            "ASCII console"
+        );
+    }
+
     /// Text and JSON through a console that renders ASCII only: each other character escaped as
     /// its syntax spells it, and each line break that uefisettings writes kept.
     #[test]
diff --git a/src/platform/linux.rs b/src/platform/linux.rs
index 6612c91..5adb59f 100644
--- a/src/platform/linux.rs
+++ b/src/platform/linux.rs
@@ -67,15 +67,13 @@ use crate::print_line;
 use crate::print_with_style;
 use crate::unsafe_long_help;
 use crate::write_extracted_db;
-use crate::EfivarMemoryArg;
-use crate::HiiSourceArg;
-use crate::HiiSourceArgs;
 use crate::JsonArgs;
 use crate::QuestionArgs;
 use crate::SelectionArgs;
 use crate::SetArgs;
 use crate::UnsafeArgs;
 use crate::READ_ONLY_WRITE;
+use crate::STAGED_SETUP_PASSWORD;
 use crate::UNSAFE_ARG;
 
 /// The about of hii, whose commands read this machine's HiiDB or a file.
@@ -85,28 +83,154 @@ pub(super) const GET_ABOUT: &str = "Auto-identify backend and get the current va
 /// The about of top-level set, which writes this machine's backend.
 pub(super) const SET_ABOUT: &str = "Auto-identify backend and set/change the value of a question";
 
-/// The help of --hii-source.
-pub(super) const HII_SOURCE_HELP: &str =
-    "Where the commands read this machine's HiiDB, where no HiiDB file or efivars dump gives one";
-/// The help of --efivar-memory.
-pub(super) const EFIVAR_MEMORY_HELP: &str =
+/// The help of --hii-source, with the default that hii_source_options takes.
+const HII_SOURCE_HELP: &str = "Where the commands read this machine's HiiDB, where no HiiDB file \
+                               or efivars dump gives one [default: auto]";
+/// The help of --efivar-memory, with the default that hii_source_options takes.
+const EFIVAR_MEMORY_HELP: &str =
     "The memory that the efivar method of --hii-source may read; firmware-reserved is an unsafe \
-     operation, whose refusal names the flag that lifts it";
+     operation, whose refusal names the flag that lifts it [default: runtime]";
+
+/// Where the commands read this machine's HiiDB; global, so that the flags may also follow the
+/// command. Only this build reads it in more than one way, so only it has the flags. Each is
+/// None unless given, so that a command that would ignore it can refuse it.
+#[derive(Debug, Clone, PartialEq, Eq, Args)]
+pub(super) struct HiiSourceArgs {
+    #[arg(long, global = true, value_enum, help = HII_SOURCE_HELP)]
+    hii_source: Option<HiiSourceArg>,
+    #[arg(long, global = true, value_enum, help = EFIVAR_MEMORY_HELP)]
+    efivar_memory: Option<EfivarMemoryArg>,
+}
+
+impl HiiSourceArgs {
+    /// Fails if --hii-source or --efivar-memory is given where `why` names how no HiiDB of this
+    /// machine is read, so that neither is ignored.
+    pub(super) fn refuse_given(&self, why: &str) -> Result<()> {
+        let given: Vec<&str> = [
+            ("--hii-source", self.hii_source.is_some()),
+            ("--efivar-memory", self.efivar_memory.is_some()),
+        ]
+        .into_iter()
+        .filter_map(|(flag, given)| given.then_some(flag))
+        .collect();
+        let flags = match given.as_slice() {
+            [] => return Ok(()),
+            [flag] => format!("{flag} names"),
+            [first @ .., last] => format!("{} and {last} name", first.join(", ")),
+        };
+        Err(anyhow!(
+            "{flags} where this machine's HiiDB is read, and {why}"
+        ))
+    }
+
+    /// Fails if --efivar-memory is given where `why` names how no memory of the efivar method is
+    /// read, so that it is not ignored.
+    fn refuse_efivar_memory(&self, why: &str) -> Result<()> {
+        match self.efivar_memory {
+            None => Ok(()),
+            Some(_) => Err(anyhow!(
+                "--efivar-memory names the memory of the efivar method, and {why}"
+            )),
+        }
+    }
+}
+
+/// The values of --hii-source.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, clap::ValueEnum)]
+enum HiiSourceArg {
+    /// acpi, then efivar, then systab: the next while a method finds its source absent or fails, none after a refusal (kernel lockdown, /dev/mem or /proc/kcore refused, or an unsafe operation without --i-am-fine-to-brick-this-system)
+    Auto,
+    /// The memory that the OCP HiiDB variable points to, from /dev/mem
+    Efivar,
+    /// The vendor ACPI table QHII or HIID, from /sys/firmware/acpi/tables, without /dev/mem
+    Acpi,
+    /// The HII database export that the EFI System Table lists as a configuration table, from /dev/mem
+    Systab,
+}
 
-/// The HiiDB source that `args` name.
-fn hii_source_options(args: &HiiSourceArgs) -> HiiSourceOptions {
+/// The values of --efivar-memory.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, clap::ValueEnum)]
+enum EfivarMemoryArg {
+    /// One EFI runtime region of the firmware's memory map that is no memory-mapped I/O
+    Runtime,
+    /// One firmware-reserved region of the firmware's memory map (x86: Reserved or ACPI Non-volatile Storage in /sys/firmware/memmap; aarch64: reserved, runtime services code or data, ACPI NVS or PAL code), never one that touches runtime memory-mapped I/O
+    FirmwareReserved,
+}
+
+/// The HiiDB source that `args` name, auto and runtime where not given; refuses --efivar-memory
+/// with a method other than efivar, the one method that reads that memory.
+fn hii_source_options(args: &HiiSourceArgs) -> Result<HiiSourceOptions> {
     let mut options = HiiSourceOptions::default();
     options.source = match args.hii_source {
-        HiiSourceArg::Auto => HiiSource::Auto,
-        HiiSourceArg::Efivar => HiiSource::Method(HiiMethod::Efivar),
-        HiiSourceArg::Acpi => HiiSource::Method(HiiMethod::Acpi),
-        HiiSourceArg::Systab => HiiSource::Method(HiiMethod::Systab),
+        None | Some(HiiSourceArg::Auto) => HiiSource::Auto,
+        Some(HiiSourceArg::Efivar) => HiiSource::Method(HiiMethod::Efivar),
+        Some(HiiSourceArg::Acpi) => HiiSource::Method(HiiMethod::Acpi),
+        Some(HiiSourceArg::Systab) => HiiSource::Method(HiiMethod::Systab),
     };
-    options.efivar_memory = match args.efivar_memory {
-        EfivarMemoryArg::Runtime => EfivarMemory::Runtime,
-        EfivarMemoryArg::FirmwareReserved => EfivarMemory::FirmwareReserved,
+    options.efivar_memory = match (args.efivar_memory, options.source) {
+        (None, _) => EfivarMemory::Runtime,
+        (Some(_), HiiSource::Method(method)) if method != HiiMethod::Efivar => {
+            return Err(anyhow!(
+                "--efivar-memory names the memory of the efivar method, which --hii-source \
+                 {method} does not run"
+            ))
+        }
+        (Some(EfivarMemoryArg::Runtime), _) => EfivarMemory::Runtime,
+        (Some(EfivarMemoryArg::FirmwareReserved), _) => EfivarMemory::FirmwareReserved,
     };
-    options
+    Ok(options)
+}
+
+/// This machine's HII backend, which the commands reach with the HiiSourceOptions of the flags;
+/// tests replace it.
+pub(super) trait MachineHii {
+    /// The backends of this machine, as identify_machine_using finds them.
+    fn identify(&self, source: &HiiSourceOptions) -> MachineInfo;
+
+    /// This machine's HiiDB, as HiiBackend::extract_db_from reads it, and the unsafe operations
+    /// that the read lifted.
+    fn extract_db(
+        &self,
+        source: &HiiSourceOptions,
+        unsafe_operations: UnsafeOperations,
+    ) -> Result<(Vec<u8>, Vec<UnsafeOperation>)>;
+
+    /// HiiBackend::set_from.
+    fn set(
+        &self,
+        question: QuestionSelector,
+        value: &SetValue,
+        options: &SetOptions,
+        source: &HiiSourceOptions,
+    ) -> Result<(SetResponseList, Vec<UnsafeOperation>)>;
+}
+
+/// The library's reads and writes of this machine's firmware.
+pub(super) struct Firmware;
+
+impl MachineHii for Firmware {
+    fn identify(&self, source: &HiiSourceOptions) -> MachineInfo {
+        identify_machine_using(source)
+    }
+
+    fn extract_db(
+        &self,
+        source: &HiiSourceOptions,
+        unsafe_operations: UnsafeOperations,
+    ) -> Result<(Vec<u8>, Vec<UnsafeOperation>)> {
+        let (database, lifted) = HiiBackend::extract_db_from(source, unsafe_operations)?;
+        Ok((database.db, lifted))
+    }
+
+    fn set(
+        &self,
+        question: QuestionSelector,
+        value: &SetValue,
+        options: &SetOptions,
+        source: &HiiSourceOptions,
+    ) -> Result<(SetResponseList, Vec<UnsafeOperation>)> {
+        HiiBackend::set_from(question, value, None, options, source)
+    }
 }
 
 /// Logs as RUST_LOG says, each message as TerminalText, as a message may name the HiiDB's
@@ -180,32 +304,40 @@ pub(super) enum PlatformCommands {
 }
 
 impl PlatformCommands {
-    pub(super) fn run(&self, source: &HiiSourceArgs) -> Result<()> {
+    pub(super) fn run(&self, source: &HiiSourceArgs, hii: &impl MachineHii) -> Result<()> {
         match self {
-            Self::Ilo(ilo_command) => match &ilo_command.command {
-                IloSubcommands::Get { question, output } => {
-                    let res = IloBackend::get(question, None)?;
-                    print_with_style(res, output.json)?;
-                }
-                IloSubcommands::Set {
-                    question,
-                    value,
-                    output,
-                } => {
-                    let res = IloBackend::set(question, value, None)?;
-                    print_with_style(res, output.json)?;
+            Self::Ilo(ilo_command) => {
+                source.refuse_given("ilo reads none")?;
+                match &ilo_command.command {
+                    IloSubcommands::Get { question, output } => {
+                        let res = IloBackend::get(question, None)?;
+                        print_with_style(res, output.json)?;
+                    }
+                    IloSubcommands::Set {
+                        question,
+                        value,
+                        output,
+                    } => {
+                        let res = IloBackend::set(question, value, None)?;
+                        print_with_style(res, output.json)?;
+                    }
+                    IloSubcommands::ShowAttributes { output } => {
+                        let res = IloBackend::show_attributes()?;
+                        print_with_style(res, output.json)?;
+                    }
+                    IloSubcommands::ShowPendingAttributes { output } => {
+                        let res = IloBackend::show_pending_attributes()?;
+                        print_with_style(res, output.json)?;
+                    }
                 }
-                IloSubcommands::ShowAttributes { output } => {
-                    let res = IloBackend::show_attributes()?;
-                    print_with_style(res, output.json)?;
-                }
-                IloSubcommands::ShowPendingAttributes { output } => {
-                    let res = IloBackend::show_pending_attributes()?;
-                    print_with_style(res, output.json)?;
-                }
-            },
+            }
             Self::Identify { output } => {
-                let machine = identify_machine_using(&hii_source_options(source));
+                let options = hii_source_options(source)?;
+                source.refuse_efivar_memory(
+                    "identify reads none: its efivar method checks only that the HiiDB variable \
+                     exists",
+                )?;
+                let machine = hii.identify(&options);
                 print_with_style(machine, output.json)?;
             }
         }
@@ -279,19 +411,17 @@ pub(super) enum HiiPlatformCommands {
 }
 
 impl HiiPlatformCommands {
-    pub(super) fn run(&self, source: &HiiSourceArgs) -> Result<()> {
+    pub(super) fn run(&self, source: &HiiSourceArgs, hii: &impl MachineHii) -> Result<()> {
         match self {
             Self::ExtractDB {
                 filename,
                 unsafe_operations,
             } => {
                 write_extracted_db(filename, || {
-                    let (res, lifted) = HiiBackend::extract_db_from(
-                        &hii_source_options(source),
-                        unsafe_operations.operations(),
-                    )?;
+                    let (db, lifted) = hii
+                        .extract_db(&hii_source_options(source)?, unsafe_operations.operations())?;
                     print_lifted(&lifted)?;
-                    Ok(res.db)
+                    Ok(db)
                 })?;
 
                 print_json(&extract_db_report(filename))?;
@@ -307,7 +437,7 @@ impl HiiPlatformCommands {
                     false => EfivarRedaction::DecodedBytes,
                 };
                 let dump = HiiBackend::dump_efivars(
-                    &hiidb.read(&EfivarSource::System, source)?,
+                    &hiidb.read(&EfivarSource::System, source, hii)?,
                     directory,
                     &options,
                 )?;
@@ -335,13 +465,25 @@ pub(super) struct HiiDbArgs {
 }
 
 impl HiiDbArgs {
-    /// The HiiDB: the file, else the one in `efivars` if dump-efivars wrote it, else this
-    /// machine's, read as `source` says, after a warning per unsafe operation that it lifted.
-    pub(super) fn read(&self, efivars: &EfivarSource, source: &HiiSourceArgs) -> Result<Vec<u8>> {
-        let (db, lifted) = HiiBackend::read_hiidb_from(
-            self.filename.as_deref(),
-            efivars,
-            &hii_source_options(source),
+    /// The HiiDB: the file, else the one in `efivars` if dump-efivars wrote it, either of which
+    /// refuses a given `source`, else this machine's, read as `source` says, after a warning per
+    /// unsafe operation that it lifted.
+    pub(super) fn read(
+        &self,
+        efivars: &EfivarSource,
+        source: &HiiSourceArgs,
+        hii: &impl MachineHii,
+    ) -> Result<Vec<u8>> {
+        let given = match self.filename {
+            Some(_) => "--filename gives the HiiDB",
+            None => "the efivars dump of --efivars gives the HiiDB",
+        };
+        if let Some(db) = HiiBackend::read_given_hiidb(self.filename.as_deref(), efivars)? {
+            source.refuse_given(given)?;
+            return Ok(db);
+        }
+        let (db, lifted) = hii.extract_db(
+            &hii_source_options(source)?,
             self.unsafe_operations.operations(),
         )?;
         print_lifted(&lifted)?;
@@ -396,8 +538,44 @@ impl EfivarArgs {
 }
 
 /// The unsafe operations of set, which its long help lists: efivarfs writes from Linux, which
-/// no setup password gates, and the read of the HiiDB.
-pub(super) const SET_UNSAFE_OPERATIONS: &[&str] = &[READ_ONLY_WRITE, FIRMWARE_RESERVED_READ];
+/// no setup password gates, a set staged for the next boot, which one does, and the read of the
+/// HiiDB.
+pub(super) const SET_UNSAFE_OPERATIONS: &[&str] = &[
+    READ_ONLY_WRITE,
+    STAGED_SETUP_PASSWORD,
+    FIRMWARE_RESERVED_READ,
+];
+
+/// What set stages for the next boot.
+#[derive(Debug, Args)]
+// no ArgGroup, which usage would name instead of the flag
+#[group(skip)]
+pub(super) struct StagingArgs {
+    /// The uefisettings.efi that set copies to the EFI system partition when it stages a question whose value only its driver holds, which the next boot applies. Under Secure Boot, it must be signed for db.
+    #[arg(long, value_name = "UEFISETTINGS_EFI")]
+    image: Option<PathBuf>,
+}
+
+impl StagingArgs {
+    pub(super) fn image(&self) -> Option<PathBuf> {
+        self.image.clone()
+    }
+
+    /// None: Linux writes through the mount point where it finds the ESP mounted.
+    pub(super) fn esp(&self) -> Option<PathBuf> {
+        None
+    }
+
+    /// Fails if --image is given: Ilo attributes have no driver that holds their value.
+    pub(super) fn refuse_on_ilo(&self) -> Result<()> {
+        match self.image {
+            None => Ok(()),
+            Some(_) => Err(anyhow!(
+                "--image applies to the HII backend, not to the Ilo backend of this machine"
+            )),
+        }
+    }
+}
 
 /// The QUESTION of `question` for the Ilo backend; fails if a flag of the HII backend is given:
 /// Ilo attributes have no QuestionId, no keywords, no IFR conditions and no HII strings.
@@ -407,7 +585,7 @@ fn refuse_on_ilo<'a>(question: &'a QuestionArgs, selection: &SelectionArgs) -> R
         ("--keyword", question.selector.keyword.is_some()),
         ("--keyword-namespace", question.keyword_namespace.is_some()),
         ("--include", !selection.include.include.is_empty()),
-        ("--access-level", selection.access_level.is_some()),
+        ("--assume-var-store", !selection.assume_var_store.is_empty()),
         ("--language", selection.language.language.is_some()),
     ]
     .into_iter()
@@ -436,22 +614,19 @@ pub(super) fn auto_get(
     selection: &SelectionArgs,
     unsafe_operations: &HiiSourceUnsafeArgs,
     source: &HiiSourceArgs,
+    hii: &impl MachineHii,
 ) -> Result<()> {
-    let options = hii_source_options(source);
-    let machine = identify_machine_using(&options);
+    let options = hii_source_options(source)?;
+    let machine = hii.identify(&options);
     if machine.backend.contains(&Backend::Unknown) {
         return Err(anyhow!("unknown backend"));
     }
     if prioritize_backend(&machine, json)? == Backend::Ilo {
+        source.refuse_given("get takes the Ilo backend of this machine, which reads none")?;
         let res = IloBackend::get(refuse_on_ilo(question, selection)?, None)?;
         print_with_style(res, json)?;
     } else {
-        let (db, lifted) = HiiBackend::read_hiidb_from(
-            None,
-            &EfivarSource::System,
-            &options,
-            unsafe_operations.operations(),
-        )?;
+        let (db, lifted) = hii.extract_db(&options, unsafe_operations.operations())?;
         print_lifted(&lifted)?;
         hii_get(
             &db,
@@ -482,25 +657,30 @@ pub(super) fn auto_set(
     target: &SetArgs,
     json: bool,
     selection: &SelectionArgs,
+    staging: &StagingArgs,
     options: &SetOptions,
     source: &HiiSourceArgs,
+    hii: &impl MachineHii,
 ) -> Result<()> {
-    let machine = identify_machine_using(&hii_source_options(source));
+    let machine = hii.identify(&hii_source_options(source)?);
     if machine.backend.contains(&Backend::Unknown) {
         return Err(anyhow!("unknown backend"));
     }
     let (selector, value) = target.target()?;
     if prioritize_backend(&machine, json)? == Backend::Ilo {
+        source.refuse_given("set takes the Ilo backend of this machine, which reads none")?;
         let SetValue::Text(value) = value else {
             return Err(anyhow!(
                 "--item gives the options of an ORDERED_LIST of the HII backend; the iLO backend \
                  takes VALUE"
             ));
         };
-        let res = IloBackend::set(refuse_on_ilo(&target.question, selection)?, &value, None)?;
+        let question = refuse_on_ilo(&target.question, selection)?;
+        staging.refuse_on_ilo()?;
+        let res = IloBackend::set(question, &value, None)?;
         print_with_style(res, json)?;
     } else {
-        hii_set(selector, &value, options, json, source)?;
+        hii_set(selector, &value, options, json, source, hii)?;
     }
     Ok(())
 }
@@ -511,8 +691,9 @@ pub(super) fn set_using(
     value: &SetValue,
     options: &SetOptions,
     source: &HiiSourceArgs,
+    hii: &impl MachineHii,
 ) -> Result<(SetResponseList, Vec<UnsafeOperation>)> {
-    HiiBackend::set_from(question, value, None, options, &hii_source_options(source))
+    hii.set(question, value, options, &hii_source_options(source)?)
 }
 
 /// The bytes of the file `path`, the payload of capsule deliver or variable write-signed.
@@ -686,19 +867,75 @@ mod tests {
         }
     }
 
+    /// The flags of the HiiDB source are None unless given, take each of their values, are
+    /// global, so that they also follow the command, and refuse another value.
+    #[test]
+    fn hii_source_flags_are_none_unless_given_and_follow_the_command() {
+        let parse = |args: &[&str]| {
+            let argv = [&["uefisettings"][..], args].concat();
+            let parsed = UefiSettingsToolArgs::try_parse_from(&argv)
+                .unwrap_or_else(|error| panic!("parse {argv:?}: {error}"));
+            (
+                parsed.hii_source.hii_source,
+                parsed.hii_source.efivar_memory,
+            )
+        };
+        assert_eq!(parse(&["show-translations"]), (None, None), "no flag");
+        for (value, want) in [
+            ("auto", HiiSourceArg::Auto),
+            ("efivar", HiiSourceArg::Efivar),
+            ("acpi", HiiSourceArg::Acpi),
+            ("systab", HiiSourceArg::Systab),
+        ] {
+            for args in [
+                &["--hii-source", value, "show-translations"][..],
+                &["show-translations", "--hii-source", value],
+            ] {
+                assert_eq!(parse(args).0, Some(want), "{args:?}");
+            }
+        }
+        for (value, want) in [
+            ("runtime", EfivarMemoryArg::Runtime),
+            ("firmware-reserved", EfivarMemoryArg::FirmwareReserved),
+        ] {
+            for args in [
+                &["--efivar-memory", value, "show-translations"][..],
+                &["show-translations", "--efivar-memory", value],
+            ] {
+                assert_eq!(parse(args).1, Some(want), "{args:?}");
+            }
+        }
+        for flag in ["--hii-source", "--efivar-memory"] {
+            let error = UefiSettingsToolArgs::try_parse_from([
+                "uefisettings",
+                flag,
+                "hiidb",
+                "show-translations",
+            ])
+            .expect_err("an unknown value");
+            assert_eq!(error.kind(), clap::error::ErrorKind::InvalidValue, "{flag}");
+        }
+    }
+
     /// The flags name the library's HiiDB source: the automatic order or one method, and the
-    /// memory of the efivar method, also after a hii command.
+    /// memory of the efivar method, also after a hii command; --efivar-memory with acpi or
+    /// systab, which never read that memory, is refused.
     #[test]
     fn hii_source_options_follow_the_flags() {
         use EfivarMemory::FirmwareReserved;
         use EfivarMemory::Runtime;
-        for (args, source, memory) in [
-            (vec![], HiiSource::Auto, Runtime),
-            (vec!["--hii-source", "auto"], HiiSource::Auto, Runtime),
+        let unread = |method: &str| {
+            Err(format!(
+                "--efivar-memory names the memory of the efivar method, which --hii-source \
+                 {method} does not run"
+            ))
+        };
+        for (args, want) in [
+            (vec![], Ok((HiiSource::Auto, Runtime))),
+            (vec!["--hii-source", "auto"], Ok((HiiSource::Auto, Runtime))),
             (
                 vec!["--hii-source", "acpi"],
-                HiiSource::Method(HiiMethod::Acpi),
-                Runtime,
+                Ok((HiiSource::Method(HiiMethod::Acpi), Runtime)),
             ),
             (
                 vec![
@@ -707,15 +944,42 @@ mod tests {
                     "--efivar-memory",
                     "firmware-reserved",
                 ],
-                HiiSource::Method(HiiMethod::Efivar),
-                FirmwareReserved,
+                Ok((HiiSource::Method(HiiMethod::Efivar), FirmwareReserved)),
             ),
             (
                 vec!["--hii-source", "systab"],
-                HiiSource::Method(HiiMethod::Systab),
-                Runtime,
+                Ok((HiiSource::Method(HiiMethod::Systab), Runtime)),
+            ),
+            (
+                vec!["--efivar-memory", "runtime"],
+                Ok((HiiSource::Auto, Runtime)),
+            ),
+            (
+                vec!["--efivar-memory", "firmware-reserved"],
+                Ok((HiiSource::Auto, FirmwareReserved)),
+            ),
+            (
+                vec![
+                    "--hii-source",
+                    "auto",
+                    "--efivar-memory",
+                    "firmware-reserved",
+                ],
+                Ok((HiiSource::Auto, FirmwareReserved)),
+            ),
+            (
+                vec!["--hii-source", "acpi", "--efivar-memory", "runtime"],
+                unread("acpi"),
+            ),
+            (
+                vec![
+                    "--hii-source",
+                    "systab",
+                    "--efivar-memory",
+                    "firmware-reserved",
+                ],
+                unread("systab"),
             ),
-            (vec!["--efivar-memory", "runtime"], HiiSource::Auto, Runtime),
         ] {
             let argv = [&["uefisettings", "hii", "extract-db", "db.bin"][..], &args].concat();
             let parsed = UefiSettingsToolArgs::try_parse_from(&argv)
@@ -724,8 +988,400 @@ mod tests {
             let options = hii_source_options(&parsed.hii_source);
 
             assert_eq!(
-                (options.source, options.efivar_memory),
-                (source, memory),
+                options
+                    .map(|options| (options.source, options.efivar_memory))
+                    .map_err(|error| error.to_string()),
+                want,
+                "{args:?}"
+            );
+        }
+    }
+
+    /// This machine's HII backend in the tests: it records each call with the HiiDB source that
+    /// it is given, finds the HII backend only, and fails each read and set.
+    #[derive(Default)]
+    struct RecordedHii(std::cell::RefCell<Vec<(&'static str, HiiSourceOptions)>>);
+
+    impl RecordedHii {
+        fn record(&self, call: &'static str, source: &HiiSourceOptions) {
+            self.0.borrow_mut().push((call, *source));
+        }
+    }
+
+    impl MachineHii for RecordedHii {
+        fn identify(&self, source: &HiiSourceOptions) -> MachineInfo {
+            self.record("identify", source);
+            MachineInfo {
+                backend: [Backend::Hii].into(),
+                ..Default::default()
+            }
+        }
+
+        fn extract_db(
+            &self,
+            source: &HiiSourceOptions,
+            _: UnsafeOperations,
+        ) -> Result<(Vec<u8>, Vec<UnsafeOperation>)> {
+            self.record("extract_db", source);
+            Err(anyhow!("recorded"))
+        }
+
+        fn set(
+            &self,
+            _: QuestionSelector,
+            _: &SetValue,
+            _: &SetOptions,
+            source: &HiiSourceOptions,
+        ) -> Result<(SetResponseList, Vec<UnsafeOperation>)> {
+            self.record("set", source);
+            Err(anyhow!("recorded"))
+        }
+    }
+
+    /// handle_cmds_with of `uefisettings` and then `args` on a RecordedHii, as its error text, and
+    /// the calls that it recorded.
+    fn run_recorded(args: &[&str]) -> (Result<(), String>, Vec<(&'static str, HiiSourceOptions)>) {
+        let argv = [&["uefisettings"][..], args].concat();
+        let parsed = UefiSettingsToolArgs::try_parse_from(&argv)
+            .unwrap_or_else(|error| panic!("parse {argv:?}: {error}"));
+        let hii = RecordedHii::default();
+
+        let result = crate::handle_cmds_with(parsed, &hii).map_err(|error| error.to_string());
+
+        (result, hii.0.into_inner())
+    }
+
+    /// Each command that reads this machine's HiiDB or backends hands this machine's HII backend
+    /// the source that --hii-source and --efivar-memory name, before the command, after it or,
+    /// for hii, between hii and its command; and the default source without them.
+    #[test]
+    fn machine_commands_read_from_the_flags_source() {
+        let dir = tempfile::tempdir().expect("create a directory");
+        let db = dir.path().join("hiidb.bin");
+        let db_arg = db.to_str().expect("UTF-8 temporary path");
+        let dump = dir.path().join("dump");
+        let dump_arg = dump.to_str().expect("UTF-8 temporary path");
+        let flags = [
+            "--hii-source",
+            "efivar",
+            "--efivar-memory",
+            "firmware-reserved",
+        ];
+        let mut given = HiiSourceOptions::default();
+        given.source = HiiSource::Method(HiiMethod::Efivar);
+        given.efivar_memory = EfivarMemory::FirmwareReserved;
+        let check = |command: &[&str], want: Result<(), String>, calls: &[&str]| {
+            let mut argvs = vec![
+                ([command, &flags].concat(), given),
+                ([&flags, command].concat(), given),
+                (command.to_vec(), HiiSourceOptions::default()),
+            ];
+            if let Some((&"hii", rest)) = command.split_first() {
+                argvs.push(([&["hii"][..], &flags, rest].concat(), given));
+            }
+            for (args, source) in argvs {
+                let (result, recorded) = run_recorded(&args);
+
+                assert_eq!(result, want, "{args:?}");
+                let want_calls: Vec<_> = calls.iter().map(|call| (*call, source)).collect();
+                assert_eq!(recorded, want_calls, "{args:?}: the calls");
+            }
+        };
+        // each fails with RecordedHii's error, after its calls
+        let failing: [(&[&str], &[&str]); 9] = [
+            (&["hii", "get", "Q", "--no-efivars"], &["extract_db"]),
+            (&["hii", "show-ifr", "--no-efivars"], &["extract_db"]),
+            (&["hii", "list-questions", "--no-efivars"], &["extract_db"]),
+            (&["hii", "list-strings"], &["extract_db"]),
+            (&["hii", "set", "Q", "V"], &["set"]),
+            (&["hii", "extract-db", db_arg], &["extract_db"]),
+            (&["hii", "dump-efivars", dump_arg], &["extract_db"]),
+            (&["get", "Q"], &["identify", "extract_db"]),
+            (&["set", "Q", "V"], &["identify", "set"]),
+        ];
+        for (command, calls) in failing {
+            check(command, Err("recorded".to_owned()), calls);
+        }
+        let mut efivar = HiiSourceOptions::default();
+        efivar.source = HiiSource::Method(HiiMethod::Efivar);
+        for (args, source) in [
+            (&["identify", "--hii-source", "efivar"][..], efivar),
+            (&["--hii-source", "efivar", "identify"], efivar),
+            (&["identify"], HiiSourceOptions::default()),
+        ] {
+            assert_eq!(
+                run_recorded(args),
+                (Ok(()), vec![("identify", source)]),
+                "{args:?}"
+            );
+        }
+        assert!(
+            !db.exists(),
+            "extract-db wrote a HiiDB that it failed to read"
+        );
+        assert!(
+            !dump.exists(),
+            "dump-efivars wrote a dump of a HiiDB that it failed to read"
+        );
+    }
+
+    /// The refusal of `flags` given where `why` names how no HiiDB of this machine is read.
+    fn refused(flags: &[&str], why: &str) -> String {
+        let named = match (
+            flags.contains(&"--hii-source"),
+            flags.contains(&"--efivar-memory"),
+        ) {
+            (true, true) => "--hii-source and --efivar-memory name",
+            (true, false) => "--hii-source names",
+            (false, true) => "--efivar-memory names",
+            (false, false) => panic!("no flag in {flags:?}"),
+        };
+        format!("{named} where this machine's HiiDB is read, and {why}")
+    }
+
+    /// --hii-source and --efivar-memory are refused, not ignored, where no HiiDB of this machine
+    /// is read: in show-translations, variable and capsule, and where -f or the efivars dump of
+    /// --efivars gives the HiiDB, once that file or dump is read; before anything of this machine
+    /// is read. Without them, those commands run, and read the HiiDB of the file or the dump,
+    /// which differ in size and hold no package list.
+    /// ilo, whose every command first reaches the BMC, is in the QEMU tests instead.
+    #[test]
+    fn machine_hiidb_flags_are_refused_where_no_machine_hiidb_is_read() {
+        let dir = tempfile::tempdir().expect("create a directory");
+        let db = dir.path().join("hiidb.bin");
+        fs::write(&db, [0; 16]).expect("write the HiiDB");
+        let db_arg = db.to_str().expect("UTF-8 temporary path");
+        let dump = dir.path().join("dump");
+        fs::create_dir(&dump).expect("create the dump");
+        fs::write(dump.join("hiidb.bin"), [0; 32]).expect("write the dump's HiiDB");
+        fs::write(
+            dump.join("uefisettings-dump.json"),
+            r#"{"format": 1, "uefisettings": "0.1.6", "redaction": "unredacted"}"#,
+        )
+        .expect("write the dump's manifest");
+        let dump_arg = dump.to_str().expect("UTF-8 temporary path");
+        let missing = dir.path().join("missing");
+        let missing_arg = missing.to_str().expect("UTF-8 temporary path");
+        let unread = Err(format!("read the payload {}", missing.display()));
+        let file = "--filename gives the HiiDB";
+        let dumped = "the efivars dump of --efivars gives the HiiDB";
+        let file_read = Err("no package lists in 16-byte HiiDB".to_owned());
+        let cases: [(&[&str], &str, Result<(), String>); 7] = [
+            (
+                &["show-translations"],
+                "show-translations reads none",
+                Ok(()),
+            ),
+            (
+                &[
+                    "variable",
+                    "write-signed",
+                    "V",
+                    "8BE4DF61-93CA-11D2-AA0D-00E098032B8C",
+                    "--attributes",
+                    "non-volatile",
+                    "--payload-file",
+                    missing_arg,
+                ],
+                "variable reads none",
+                unread.clone(),
+            ),
+            (
+                &["capsule", "deliver", missing_arg, "--capsule-id", "1"],
+                "capsule reads none",
+                unread,
+            ),
+            (
+                &["hii", "list-strings", "-f", db_arg],
+                file,
+                file_read.clone(),
+            ),
+            (
+                &["hii", "list-questions", "--no-efivars", "-f", db_arg],
+                file,
+                file_read.clone(),
+            ),
+            (
+                &["hii", "show-ifr", "--efivars", dump_arg, "-f", db_arg],
+                file,
+                file_read,
+            ),
+            (
+                &["hii", "list-questions", "--efivars", dump_arg],
+                dumped,
+                Err("no package lists in 32-byte HiiDB".to_owned()),
+            ),
+        ];
+        for (command, why, without) in cases {
+            for flags in [
+                &["--hii-source", "auto"][..],
+                &["--efivar-memory", "runtime"],
+                &[
+                    "--hii-source",
+                    "systab",
+                    "--efivar-memory",
+                    "firmware-reserved",
+                ],
+            ] {
+                for args in [[command, flags].concat(), [flags, command].concat()] {
+                    assert_eq!(
+                        run_recorded(&args),
+                        (Err(refused(flags, why)), Vec::new()),
+                        "{args:?}"
+                    );
+                }
+            }
+            assert_eq!(
+                run_recorded(command),
+                (without, Vec::new()),
+                "{command:?} without flags"
+            );
+        }
+    }
+
+    /// --efivar-memory with --hii-source acpi or systab fails each command that reads this
+    /// machine's HiiDB or backends before it reads anything.
+    #[test]
+    fn efivar_memory_is_refused_with_a_method_that_never_reads_it() {
+        let commands: [&[&str]; 6] = [
+            &["hii", "get", "Q", "--no-efivars"],
+            &["hii", "list-strings"],
+            &["hii", "set", "Q", "V"],
+            &["get", "Q"],
+            &["set", "Q", "V"],
+            &["identify"],
+        ];
+        for command in commands {
+            for (method, memory) in [("acpi", "firmware-reserved"), ("systab", "runtime")] {
+                let args = [
+                    command,
+                    &["--hii-source", method, "--efivar-memory", memory],
+                ]
+                .concat();
+                assert_eq!(
+                    run_recorded(&args),
+                    (
+                        Err(format!(
+                            "--efivar-memory names the memory of the efivar method, which \
+                             --hii-source {method} does not run"
+                        )),
+                        Vec::new()
+                    ),
+                    "{args:?}"
+                );
+            }
+        }
+    }
+
+    /// This machine's HII backend in a test of a machine whose backends include Ilo: it records
+    /// each call, finds the Ilo backend only, and fails each read and set.
+    #[derive(Default)]
+    struct IloMachine(std::cell::RefCell<Vec<&'static str>>);
+
+    impl MachineHii for IloMachine {
+        fn identify(&self, _: &HiiSourceOptions) -> MachineInfo {
+            self.0.borrow_mut().push("identify");
+            MachineInfo {
+                backend: [Backend::Ilo].into(),
+                ..Default::default()
+            }
+        }
+
+        fn extract_db(
+            &self,
+            _: &HiiSourceOptions,
+            _: UnsafeOperations,
+        ) -> Result<(Vec<u8>, Vec<UnsafeOperation>)> {
+            self.0.borrow_mut().push("extract_db");
+            Err(anyhow!("recorded"))
+        }
+
+        fn set(
+            &self,
+            _: QuestionSelector,
+            _: &SetValue,
+            _: &SetOptions,
+            _: &HiiSourceOptions,
+        ) -> Result<(SetResponseList, Vec<UnsafeOperation>)> {
+            self.0.borrow_mut().push("set");
+            Err(anyhow!("recorded"))
+        }
+    }
+
+    /// get and set refuse --hii-source and --efivar-memory where they take the Ilo backend, which
+    /// reads no HiiDB, after identify only; without them, the Ilo branch runs (its refusal of
+    /// --assume-var-store shows it, before the BMC is reached). identify refuses --efivar-memory,
+    /// whose memory its efivar method never reads, before it identifies.
+    #[test]
+    fn the_flags_are_refused_where_only_identify_would_see_them() {
+        let run = |args: &[&str], hii: &IloMachine| {
+            let argv = [&["uefisettings"][..], args].concat();
+            let parsed = UefiSettingsToolArgs::try_parse_from(&argv)
+                .unwrap_or_else(|error| panic!("parse {argv:?}: {error}"));
+            crate::handle_cmds_with(parsed, hii).map_err(|error| error.to_string())
+        };
+        for (command, why) in [
+            (
+                &[
+                    "get",
+                    "Q",
+                    "--assume-var-store",
+                    "Mode-11111111-1111-1111-1111-111111111111=01",
+                ][..],
+                "get takes the Ilo backend of this machine, which reads none",
+            ),
+            (
+                &[
+                    "set",
+                    "Q",
+                    "V",
+                    "--assume-var-store",
+                    "Mode-11111111-1111-1111-1111-111111111111=01",
+                ],
+                "set takes the Ilo backend of this machine, which reads none",
+            ),
+        ] {
+            for flags in [
+                &["--hii-source", "acpi"][..],
+                &["--efivar-memory", "firmware-reserved"],
+                &["--hii-source", "efivar", "--efivar-memory", "runtime"],
+            ] {
+                let args = [command, flags].concat();
+                let hii = IloMachine::default();
+                assert_eq!(run(&args, &hii), Err(refused(flags, why)), "{args:?}");
+                assert_eq!(hii.0.into_inner(), vec!["identify"], "{args:?}: the calls");
+            }
+            let hii = IloMachine::default();
+            assert_eq!(
+                run(command, &hii),
+                Err(
+                    "--assume-var-store applies to the HII backend, not to the Ilo backend of \
+                     this machine"
+                        .to_owned()
+                ),
+                "{command:?} without flags"
+            );
+        }
+        for args in [
+            &["identify", "--efivar-memory", "runtime"][..],
+            &[
+                "identify",
+                "--hii-source",
+                "efivar",
+                "--efivar-memory",
+                "firmware-reserved",
+            ],
+        ] {
+            assert_eq!(
+                run_recorded(args),
+                (
+                    Err(
+                        "--efivar-memory names the memory of the efivar method, and identify \
+                         reads none: its efivar method checks only that the HiiDB variable exists"
+                            .to_owned()
+                    ),
+                    Vec::new()
+                ),
                 "{args:?}"
             );
         }
@@ -847,18 +1503,26 @@ mod tests {
                 Err("--include applies to the HII backend, not to the Ilo backend of this machine"),
             ),
             (
-                "--access-level",
-                vec!["--access-level", "user"],
+                "--assume-var-store",
+                vec![
+                    "--assume-var-store",
+                    "Mode-11111111-1111-1111-1111-111111111111=01",
+                ],
                 Err(
-                    "--access-level applies to the HII backend, not to the Ilo backend of this \
-                     machine",
+                    "--assume-var-store applies to the HII backend, not to the Ilo backend of \
+                     this machine",
                 ),
             ),
             (
-                "--include and --access-level",
-                vec!["--include", "grayed-out", "--access-level", "user"],
+                "--include and --assume-var-store",
+                vec![
+                    "--include",
+                    "grayed-out",
+                    "--assume-var-store",
+                    "Mode-11111111-1111-1111-1111-111111111111=01",
+                ],
                 Err(
-                    "--include and --access-level apply to the HII backend, not to the Ilo \
+                    "--include and --assume-var-store apply to the HII backend, not to the Ilo \
                      backend of this machine",
                 ),
             ),
@@ -870,18 +1534,18 @@ mod tests {
                 ),
             ),
             (
-                "--include, --access-level and --language",
+                "--include, --assume-var-store and --language",
                 vec![
                     "--include",
                     "grayed-out",
-                    "--access-level",
-                    "user",
+                    "--assume-var-store",
+                    "Mode-11111111-1111-1111-1111-111111111111=01",
                     "--language",
                     "fr-FR",
                 ],
                 Err(
-                    "--include, --access-level and --language apply to the HII backend, not to \
-                     the Ilo backend of this machine",
+                    "--include, --assume-var-store and --language apply to the HII backend, not \
+                     to the Ilo backend of this machine",
                 ),
             ),
         ];
@@ -894,6 +1558,29 @@ mod tests {
         }
     }
 
+    /// StagingArgs::refuse_on_ilo refuses --image, which Ilo attributes take no use of, and
+    /// passes its absence.
+    #[test]
+    fn staging_refuse_on_ilo_names_image() {
+        let cases = [
+            ("no --image", None, Ok(())),
+            (
+                "--image",
+                Some(PathBuf::from("uefisettings.efi")),
+                Err("--image applies to the HII backend, not to the Ilo backend of this machine"),
+            ),
+        ];
+        for (case, image, want) in cases {
+            assert_eq!(
+                StagingArgs { image }
+                    .refuse_on_ilo()
+                    .map_err(|error| error.to_string()),
+                want.map_err(str::to_string),
+                "{case}"
+            );
+        }
+    }
+
     /// The efivar flags of a get, show-ifr or list-questions.
     fn efivar_args(command: &HiiSubcommands) -> &EfivarArgs {
         match command {
diff --git a/src/platform/macos.rs b/src/platform/macos.rs
index 769c353..c010b3d 100644
--- a/src/platform/macos.rs
+++ b/src/platform/macos.rs
@@ -25,19 +25,33 @@ use uefisettings::exports::EfivarSource;
 use uefisettings::exports::HiiBackend;
 use uefisettings::terminal_text::UnicodeTerminal;
 
-use crate::HiiSourceArgs;
-
 /// The about of hii, whose commands read a HiiDB file or an efivars dump, and no EFI variables of
 /// this machine.
 pub(super) const HII_ABOUT: &str =
     "Commands which read a UEFI HiiDB file or an efivars dump, and no EFI variables of this machine";
 
-/// The help of --hii-source, which this build ignores.
-pub(super) const HII_SOURCE_HELP: &str =
-    "Accepted as on Linux, and ignored: this build reads only HiiDB files and efivars dumps";
-/// The help of --efivar-memory, which this build ignores.
-pub(super) const EFIVAR_MEMORY_HELP: &str =
-    "Accepted as on Linux, and ignored: this build reads only HiiDB files and efivars dumps";
+/// None: this build reads only HiiDB files and efivars dumps, so it has no --hii-source or
+/// --efivar-memory, which clap refuses as unexpected arguments rather than ignore them.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Args)]
+// no ArgGroup, which usage would name instead of the flag
+#[group(skip)]
+pub(super) struct HiiSourceArgs {}
+
+impl HiiSourceArgs {
+    /// Ok: neither flag exists here.
+    pub(super) fn refuse_given(&self, _why: &str) -> Result<()> {
+        Ok(())
+    }
+}
+
+/// The Linux build's seam to the HII backend, which its tests replace; empty, as this build
+/// reads no firmware.
+pub(super) trait MachineHii {}
+
+/// This machine's firmware, which this build never reads.
+pub(super) struct Firmware;
+
+impl MachineHii for Firmware {}
 
 /// Installs no logger, so that log's macros write nothing.
 pub(super) fn init_logging() {}
@@ -58,7 +72,7 @@ pub(super) fn stderr_output() -> io::Result<UnicodeTerminal> {
 pub(super) enum PlatformCommands {}
 
 impl PlatformCommands {
-    pub(super) fn run(&self, _source: &HiiSourceArgs) -> Result<()> {
+    pub(super) fn run(&self, _source: &HiiSourceArgs, _hii: &impl MachineHii) -> Result<()> {
         match *self {}
     }
 }
@@ -68,7 +82,7 @@ impl PlatformCommands {
 pub(super) enum HiiPlatformCommands {}
 
 impl HiiPlatformCommands {
-    pub(super) fn run(&self, _source: &HiiSourceArgs) -> Result<()> {
+    pub(super) fn run(&self, _source: &HiiSourceArgs, _hii: &impl MachineHii) -> Result<()> {
         match *self {}
     }
 }
@@ -86,7 +100,12 @@ pub(super) struct HiiDbArgs {
 impl HiiDbArgs {
     /// The HiiDB: the file, else the one in `efivars` if dump-efivars wrote it, whatever
     /// `_source` names.
-    pub(super) fn read(&self, efivars: &EfivarSource, _source: &HiiSourceArgs) -> Result<Vec<u8>> {
+    pub(super) fn read(
+        &self,
+        efivars: &EfivarSource,
+        _source: &HiiSourceArgs,
+        _hii: &impl MachineHii,
+    ) -> Result<Vec<u8>> {
         HiiBackend::read_hiidb(self.filename.as_deref(), efivars)
     }
 }
@@ -103,7 +122,12 @@ pub(super) struct ListStringsHiiDbArgs {
 
 impl ListStringsHiiDbArgs {
     /// The HiiDB in the file, whatever `_efivars` and `_source` name.
-    pub(super) fn read(&self, _efivars: &EfivarSource, _source: &HiiSourceArgs) -> Result<Vec<u8>> {
+    pub(super) fn read(
+        &self,
+        _efivars: &EfivarSource,
+        _source: &HiiSourceArgs,
+        _hii: &impl MachineHii,
+    ) -> Result<Vec<u8>> {
         HiiBackend::read_hiidb_file(&self.filename)
     }
 }
@@ -265,7 +289,7 @@ mod tests {
             let source = efivars.source().expect("name the source");
 
             let error = hiidb
-                .read(&source, &HiiSourceArgs::default())
+                .read(&source, &HiiSourceArgs::default(), &Firmware)
                 .expect_err("read the HiiDB of a directory that no dump wrote");
 
             let message = error.to_string();
diff --git a/src/platform/uefi.rs b/src/platform/uefi.rs
index 6ebff7e..85bec9e 100644
--- a/src/platform/uefi.rs
+++ b/src/platform/uefi.rs
@@ -17,6 +17,7 @@
 use std::fmt::Debug;
 use std::io;
 use std::path::Path;
+use std::path::PathBuf;
 use std::ptr;
 use std::ptr::NonNull;
 use std::time::SystemTime;
@@ -25,6 +26,7 @@ use anyhow::Context;
 use anyhow::Result;
 use clap::Args;
 use clap::Subcommand;
+use log::debug;
 use log::warn;
 use uefi::boot;
 use uefi::boot::OpenProtocolAttributes;
@@ -35,6 +37,8 @@ use uefi::proto::console::text::InputEx;
 use uefi::proto::console::text::Key;
 use uefi::proto::console::text::ScanCode;
 use uefi::proto::unsafe_protocol;
+use uefi::runtime;
+use uefi::runtime::ResetType;
 use uefi::CStr16;
 use uefi::CString16;
 use uefi::Handle;
@@ -72,11 +76,11 @@ use uefisettings_backend_thrift::SetResponseList;
 
 use crate::hii_get;
 use crate::hii_set;
+use crate::print_apply_staged_line;
 use crate::print_display_or_json;
 use crate::print_lifted;
 use crate::unsafe_long_help;
 use crate::variable_command::print_info;
-use crate::HiiSourceArgs;
 use crate::IncludeArgs;
 use crate::JsonArgs;
 use crate::QuestionArgs;
@@ -100,12 +104,29 @@ pub(super) const SET_LONG_ABOUT: &str = "Set/change the value of a question.\n\n
      \"causes the system to wake up or power on at the set time\" (UEFI 2.11 §8.3.4), as \
      edk2-stable202608 SetupBrowserDxe/Setup.c:2051 does.";
 
-/// The help of --hii-source, which this build ignores.
-pub(super) const HII_SOURCE_HELP: &str =
-    "Accepted as on Linux, and ignored: this build reads the HiiDB by the HII Database Protocol";
-/// The help of --efivar-memory, which this build ignores.
-pub(super) const EFIVAR_MEMORY_HELP: &str =
-    "Accepted as on Linux, and ignored: this build reads the HiiDB by the HII Database Protocol";
+/// None: this build reads the HiiDB by the HII Database Protocol alone, so it has no
+/// --hii-source or --efivar-memory, which clap refuses as unexpected arguments rather than ignore
+/// them.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Args)]
+// no ArgGroup, which usage would name instead of the flag
+#[group(skip)]
+pub(super) struct HiiSourceArgs {}
+
+impl HiiSourceArgs {
+    /// Ok: neither flag exists here.
+    pub(super) fn refuse_given(&self, _why: &str) -> Result<()> {
+        Ok(())
+    }
+}
+
+/// The Linux build's seam to the HII backend, which its tests replace; empty, as the commands
+/// here reach the HII Database Protocol directly.
+pub(super) trait MachineHii {}
+
+/// This firmware.
+pub(super) struct Firmware;
+
+impl MachineHii for Firmware {}
 
 /// What set and keyword set refuse here without --i-am-fine-to-brick-this-system.
 const SETUP_PASSWORD_WRITE: &str = "a write in a HiiDB that declares a setup password question, \
@@ -117,21 +138,48 @@ pub(super) const SET_UNSAFE_OPERATIONS: &[&str] = &[SETUP_PASSWORD_WRITE, READ_O
 /// Installs no logger, so that log's macros write nothing.
 pub(super) fn init_logging() {}
 
-/// None: ilo and identify need Linux.
+/// apply-staged; ilo and identify need Linux.
 #[derive(Debug, Subcommand)]
-pub(super) enum PlatformCommands {}
+pub(super) enum PlatformCommands {
+    /// Apply the set that set staged from an OS for this boot, then reset the platform. The staged set's Boot####, which BootNext names, starts uefisettings.efi with this command before the OS
+    #[command(next_display_order = None)]
+    ApplyStaged {
+        /// The nonce that ties the staged set to its Boot####, 32 lowercase hexadecimal digits
+        nonce: String,
+    },
+}
 
 impl PlatformCommands {
-    pub(super) fn run(&self, _source: &HiiSourceArgs) -> Result<()> {
-        match *self {}
+    pub(super) fn run(&self, _source: &HiiSourceArgs, _hii: &impl MachineHii) -> Result<()> {
+        match self {
+            Self::ApplyStaged { nonce } => apply_staged(nonce),
+        }
     }
 }
 
+/// apply-staged: prints what applying the staged set of `nonce` did, then resets the platform cold,
+/// as UiApp does after a change that needs a reset (edk2-stable202608
+/// MdeModulePkg/Application/UiApp/FrontPage.c SetupResetReminder), so that the OS starts in a boot
+/// whose boot path holds no uefisettings.efi. ResetSystem() does not return (UEFI 2.11
+/// §8.5.1.1).
+fn apply_staged(nonce: &str) -> ! {
+    for line in HiiBackend::apply_staged(nonce) {
+        // nothing is left to report a failed print to, and the reset comes all the same
+        if let Err(error) = print_apply_staged_line(&line) {
+            debug!("failed to print {line:?}: {error}");
+        }
+    }
+    if let Err(error) = print_apply_staged_line("resetting the platform") {
+        debug!("failed to print the reset: {error}");
+    }
+    runtime::reset(ResetType::COLD, Status::SUCCESS, None)
+}
+
 /// variable-info, which variable info is too, and keyword; extract-db and dump-efivars write
 /// files, which this build does not.
 #[derive(Debug, Subcommand)]
 pub(super) enum HiiPlatformCommands {
-    /// Show the attributes and the size of an EFI variable, never its data
+    /// Show the attributes and the size of an EFI variable, and the EFI_VARIABLE_AUTHENTICATION_3 metadata of one with enhanced-authenticated-access, never its data
     #[command(next_display_order = None)]
     VariableInfo {
         name: String,
@@ -144,7 +192,7 @@ pub(super) enum HiiPlatformCommands {
 }
 
 impl HiiPlatformCommands {
-    pub(super) fn run(&self, _source: &HiiSourceArgs) -> Result<()> {
+    pub(super) fn run(&self, _source: &HiiSourceArgs, _hii: &impl MachineHii) -> Result<()> {
         match self {
             Self::VariableInfo { name, guid } => print_info(name, guid),
             Self::Keyword(command) => command.run(),
@@ -265,7 +313,12 @@ pub(super) struct HiiDbArgs {}
 
 impl HiiDbArgs {
     /// The HiiDB of this firmware, whatever `_efivars` and `_source` name.
-    pub(super) fn read(&self, _efivars: &EfivarSource, _source: &HiiSourceArgs) -> Result<Vec<u8>> {
+    pub(super) fn read(
+        &self,
+        _efivars: &EfivarSource,
+        _source: &HiiSourceArgs,
+        _hii: &impl MachineHii,
+    ) -> Result<Vec<u8>> {
         HiiBackend::export_hiidb()
     }
 }
@@ -313,6 +366,22 @@ impl VolatileArgs {
     }
 }
 
+/// None: set applies a question that its driver holds at once here, and stages nothing.
+#[derive(Debug, Args)]
+// no ArgGroup, which usage would name instead of the flag
+#[group(skip)]
+pub(super) struct StagingArgs {}
+
+impl StagingArgs {
+    pub(super) fn image(&self) -> Option<PathBuf> {
+        None
+    }
+
+    pub(super) fn esp(&self) -> Option<PathBuf> {
+        None
+    }
+}
+
 /// get, in this firmware's HII database.
 pub(super) fn auto_get(
     question: &QuestionArgs,
@@ -320,6 +389,7 @@ pub(super) fn auto_get(
     selection: &SelectionArgs,
     _unsafe_operations: &HiiSourceUnsafeArgs,
     _source: &HiiSourceArgs,
+    _hii: &impl MachineHii,
 ) -> Result<()> {
     hii_get(
         &HiiBackend::export_hiidb()?,
@@ -334,11 +404,13 @@ pub(super) fn auto_set(
     target: &SetArgs,
     json: bool,
     _selection: &SelectionArgs,
+    _staging: &StagingArgs,
     options: &SetOptions,
     source: &HiiSourceArgs,
+    hii: &impl MachineHii,
 ) -> Result<()> {
     let (question, value) = target.target()?;
-    hii_set(question, &value, options, json, source)
+    hii_set(question, &value, options, json, source, hii)
 }
 
 /// HiiBackend::set_using, whatever `_source` names.
@@ -347,6 +419,7 @@ pub(super) fn set_using(
     value: &SetValue,
     options: &SetOptions,
     _source: &HiiSourceArgs,
+    _hii: &impl MachineHii,
 ) -> Result<(SetResponseList, Vec<UnsafeOperation>)> {
     HiiBackend::set_using(question, value, None, options)
 }
diff --git a/src/platform/windows.rs b/src/platform/windows.rs
index 920e7dc..7fe8ebb 100644
--- a/src/platform/windows.rs
+++ b/src/platform/windows.rs
@@ -43,11 +43,11 @@ use crate::hii_get;
 use crate::hii_set;
 use crate::print_json;
 use crate::write_extracted_db;
-use crate::HiiSourceArgs;
 use crate::QuestionArgs;
 use crate::SelectionArgs;
 use crate::SetArgs;
 use crate::READ_ONLY_WRITE;
+use crate::STAGED_SETUP_PASSWORD;
 
 /// The about of hii, whose commands read this machine's HiiDB or a file.
 pub(super) const HII_ABOUT: &str = "Commands which work on machines exposing the UEFI HiiDB";
@@ -56,12 +56,29 @@ pub(super) const GET_ABOUT: &str = "Get the current value of a question";
 /// The about of top-level set, which writes this machine's variables, as hii set does.
 pub(super) const SET_ABOUT: &str = "Set/change the value of a question";
 
-/// The help of --hii-source, which this build ignores.
-pub(super) const HII_SOURCE_HELP: &str =
-    "Accepted as on Linux, and ignored: this build reads the HiiDB through the HiiDB driver";
-/// The help of --efivar-memory, which this build ignores.
-pub(super) const EFIVAR_MEMORY_HELP: &str =
-    "Accepted as on Linux, and ignored: this build reads the HiiDB through the HiiDB driver";
+/// None: this build reads this machine's HiiDB through the HiiDB driver alone, so it has no
+/// --hii-source or --efivar-memory, which clap refuses as unexpected arguments rather than ignore
+/// them.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Args)]
+// no ArgGroup, which usage would name instead of the flag
+#[group(skip)]
+pub(super) struct HiiSourceArgs {}
+
+impl HiiSourceArgs {
+    /// Ok: neither flag exists here.
+    pub(super) fn refuse_given(&self, _why: &str) -> Result<()> {
+        Ok(())
+    }
+}
+
+/// The Linux build's seam to the HII backend, which its tests replace; empty, as the commands
+/// here reach the HiiDB driver directly.
+pub(super) trait MachineHii {}
+
+/// This machine's firmware.
+pub(super) struct Firmware;
+
+impl MachineHii for Firmware {}
 
 /// Installs no logger, so that log's macros write nothing.
 pub(super) fn init_logging() {}
@@ -82,7 +99,7 @@ pub(super) fn stderr_output() -> io::Result<UnicodeTerminal> {
 pub(super) enum PlatformCommands {}
 
 impl PlatformCommands {
-    pub(super) fn run(&self, _source: &HiiSourceArgs) -> Result<()> {
+    pub(super) fn run(&self, _source: &HiiSourceArgs, _hii: &impl MachineHii) -> Result<()> {
         match *self {}
     }
 }
@@ -96,7 +113,7 @@ pub(super) enum HiiPlatformCommands {
 }
 
 impl HiiPlatformCommands {
-    pub(super) fn run(&self, _source: &HiiSourceArgs) -> Result<()> {
+    pub(super) fn run(&self, _source: &HiiSourceArgs, _hii: &impl MachineHii) -> Result<()> {
         match self {
             Self::ExtractDB { filename } => {
                 write_extracted_db(filename, HiiBackend::export_hiidb)?;
@@ -124,7 +141,12 @@ pub(super) struct HiiDbArgs {
 impl HiiDbArgs {
     /// The HiiDB: the file, else this machine's, through the HiiDB driver, whatever `_source`
     /// names.
-    pub(super) fn read(&self, efivars: &EfivarSource, _source: &HiiSourceArgs) -> Result<Vec<u8>> {
+    pub(super) fn read(
+        &self,
+        efivars: &EfivarSource,
+        _source: &HiiSourceArgs,
+        _hii: &impl MachineHii,
+    ) -> Result<Vec<u8>> {
         HiiBackend::read_hiidb(self.filename.as_deref(), efivars)
     }
 }
@@ -156,8 +178,31 @@ impl EfivarArgs {
 
 /// The unsafe operations of set, which its long help lists: Windows writes through the
 /// firmware environment calls, which reach runtime variables like efivarfs, so no setup password
-/// gates them, as on Linux.
-pub(super) const SET_UNSAFE_OPERATIONS: &[&str] = &[READ_ONLY_WRITE];
+/// gates them, as on Linux, and a set staged for the next boot, which one does.
+pub(super) const SET_UNSAFE_OPERATIONS: &[&str] = &[READ_ONLY_WRITE, STAGED_SETUP_PASSWORD];
+
+/// What set stages for the next boot.
+#[derive(Debug, Args)]
+// no ArgGroup, which usage would name instead of the flag
+#[group(skip)]
+pub(super) struct StagingArgs {
+    /// The uefisettings.efi that set copies to the EFI system partition when it stages a question whose value only its driver holds, which the next boot applies. Under Secure Boot, it must be signed for db.
+    #[arg(long, value_name = "UEFISETTINGS_EFI")]
+    image: Option<PathBuf>,
+    /// Where you mounted the EFI system partition, such as S: after `mountvol S: /s`, for set to write the staged files through instead of the partition's volume GUID path. set checks that the volume there is the EFI system partition that it finds.
+    #[arg(long, value_name = "MOUNT_POINT")]
+    esp: Option<PathBuf>,
+}
+
+impl StagingArgs {
+    pub(super) fn image(&self) -> Option<PathBuf> {
+        self.image.clone()
+    }
+
+    pub(super) fn esp(&self) -> Option<PathBuf> {
+        self.esp.clone()
+    }
+}
 
 /// get, in this machine's HiiDB.
 pub(super) fn auto_get(
@@ -166,6 +211,7 @@ pub(super) fn auto_get(
     selection: &SelectionArgs,
     _unsafe_operations: &HiiSourceUnsafeArgs,
     _source: &HiiSourceArgs,
+    _hii: &impl MachineHii,
 ) -> Result<()> {
     hii_get(
         &HiiBackend::export_hiidb()?,
@@ -194,11 +240,13 @@ pub(super) fn auto_set(
     target: &SetArgs,
     json: bool,
     _selection: &SelectionArgs,
+    _staging: &StagingArgs,
     options: &SetOptions,
     source: &HiiSourceArgs,
+    hii: &impl MachineHii,
 ) -> Result<()> {
     let (question, value) = target.target()?;
-    hii_set(question, &value, options, json, source)
+    hii_set(question, &value, options, json, source, hii)
 }
 
 /// HiiBackend::set_using, whatever `_source` names.
@@ -207,6 +255,7 @@ pub(super) fn set_using(
     value: &SetValue,
     options: &SetOptions,
     _source: &HiiSourceArgs,
+    _hii: &impl MachineHii,
 ) -> Result<(SetResponseList, Vec<UnsafeOperation>)> {
     HiiBackend::set_using(question, value, None, options)
 }
diff --git a/src/variable_command.rs b/src/variable_command.rs
index 41b5fa7..bf24178 100644
--- a/src/variable_command.rs
+++ b/src/variable_command.rs
@@ -46,6 +46,8 @@ use crate::UnsafeArgs;
 #[cfg(variable_data)]
 use crate::UNSAFE_ARG;
 
+#[cfg(variable_data)]
+mod boot_manager;
 #[cfg(variable_data)]
 mod write_signed;
 
@@ -66,7 +68,7 @@ enum VariableSubcommands {
         #[arg(long)]
         guid: Option<String>,
     },
-    /// Show the attributes and the size of an EFI variable, never its data
+    /// Show the attributes and the size of an EFI variable, and the EFI_VARIABLE_AUTHENTICATION_3 metadata of one with enhanced-authenticated-access, never its data
     #[cfg(variable_info)]
     #[command(next_display_order = None)]
     Info {
@@ -75,17 +77,18 @@ enum VariableSubcommands {
         guid: String,
     },
     /// Show the attributes and the decoded value of a global variable of UEFI 2.11 section 3.3,
-    /// but its load options, hot keys and device paths, or of a signature database, or that it is
-    /// absent
+    /// its load options, hot keys and device paths as text among them, or of a signature database,
+    /// or that it is absent
     #[cfg(variable_data)]
     #[command(next_display_order = None)]
     Get {
-        /// The variable, such as Timeout, BootOrder, SecureBoot, db or devdb
+        /// The variable, such as Timeout, BootOrder, Boot0001, Key0000, ConOut, SecureBoot, db
+        /// or devdb
         name: String,
         /// The vendor GUID of the variable, which must be its own:
         /// D719B2CB-3D3A-4596-A3BC-DAD00E67656F for db, dbx, dbt and dbr,
-        /// B9C2B4F4-BF5F-462D-8ADF-C5C70AC35DAD for devdb, else
-        /// 8BE4DF61-93CA-11D2-AA0D-00E098032B8C
+        /// B9C2B4F4-BF5F-462D-8ADF-C5C70AC35DAD for devdb, that which OsRecoveryOrder lists for
+        /// OsRecovery####, else 8BE4DF61-93CA-11D2-AA0D-00E098032B8C
         guid: Option<String>,
     },
     /// Set a global variable of UEFI 2.11 section 3.3 that the OS may write: Timeout, BootOrder,
@@ -115,6 +118,9 @@ enum VariableSubcommands {
     #[command(next_display_order = None)]
     // Boxed, as its arguments outgrow every other variant's (clippy::large_enum_variant).
     WriteSigned(Box<write_signed::WriteSignedArgs>),
+    #[cfg(variable_data)]
+    #[command(flatten)]
+    BootManager(boot_manager::BootManagerSubcommands),
 }
 
 /// What variable set refuses without --i-am-fine-to-brick-this-system.
@@ -216,6 +222,8 @@ impl VariableCommand {
             VariableSubcommands::Storage { attributes } => storage(attributes),
             #[cfg(variable_data)]
             VariableSubcommands::WriteSigned(args) => args.run(),
+            #[cfg(variable_data)]
+            VariableSubcommands::BootManager(command) => command.run(),
         }
     }
 }
@@ -248,8 +256,9 @@ fn list_report(keys: &[VariableKey]) -> serde_json::Value {
         .collect()
 }
 
-/// Prints the attributes and the size of the EFI variable `name` of the vendor GUID `guid`: info,
-/// and hii variable-info of the UEFI Shell build.
+/// Prints the attributes and the size of the EFI variable `name` of the vendor GUID `guid`, and
+/// its EFI_VARIABLE_AUTHENTICATION_3 metadata if it has any: info, and hii variable-info of the
+/// UEFI Shell build.
 #[cfg(variable_info)]
 pub(super) fn print_info(name: &str, guid: &str) -> Result<()> {
     let info = VariableBackend::info(name, guid)?;
@@ -266,7 +275,7 @@ fn print_global(name: &str, guid: Option<&str>) -> Result<()> {
     print_global_variable(&VariableBackend::get(name, guid)?)
 }
 
-/// Prints `global` as one line of JSON, for print_global and set.
+/// Prints `global` as one line of JSON, for print_global, set and the boot manager's writes.
 #[cfg(variable_data)]
 fn print_global_variable(global: &GlobalVariable) -> Result<()> {
     print_json(global)?;
@@ -354,7 +363,8 @@ mod tests {
                 #[cfg(variable_data)]
                 parsed @ (VariableSubcommands::Get { .. }
                 | VariableSubcommands::Set(_)
-                | VariableSubcommands::WriteSigned(_)) => {
+                | VariableSubcommands::WriteSigned(_)
+                | VariableSubcommands::BootManager(_)) => {
                     panic!("{args:?} is no list: {parsed:?}")
                 }
                 parsed @ VariableSubcommands::Storage { .. } => {
@@ -376,7 +386,8 @@ mod tests {
             #[cfg(variable_data)]
             parsed @ (VariableSubcommands::Get { .. }
             | VariableSubcommands::Set(_)
-            | VariableSubcommands::WriteSigned(_)) => {
+            | VariableSubcommands::WriteSigned(_)
+            | VariableSubcommands::BootManager(_)) => {
                 panic!("{args:?} is no info: {parsed:?}")
             }
             parsed @ (VariableSubcommands::List { .. } | VariableSubcommands::Storage { .. }) => {
@@ -417,7 +428,8 @@ mod tests {
                 parsed @ (VariableSubcommands::List { .. }
                 | VariableSubcommands::Set(_)
                 | VariableSubcommands::Storage { .. }
-                | VariableSubcommands::WriteSigned(_)) => {
+                | VariableSubcommands::WriteSigned(_)
+                | VariableSubcommands::BootManager(_)) => {
                     panic!("{args:?} is no get: {parsed:?}")
                 }
             };
@@ -450,7 +462,8 @@ mod tests {
                 parsed @ (VariableSubcommands::List { .. }
                 | VariableSubcommands::Get { .. }
                 | VariableSubcommands::Storage { .. }
-                | VariableSubcommands::WriteSigned(_)) => {
+                | VariableSubcommands::WriteSigned(_)
+                | VariableSubcommands::BootManager(_)) => {
                     panic!("{args:?} is no set: {parsed:?}")
                 }
             };
@@ -515,7 +528,8 @@ mod tests {
                 parsed @ (VariableSubcommands::List { .. }
                 | VariableSubcommands::Get { .. }
                 | VariableSubcommands::Storage { .. }
-                | VariableSubcommands::WriteSigned(_)) => {
+                | VariableSubcommands::WriteSigned(_)
+                | VariableSubcommands::BootManager(_)) => {
                     panic!("{args:?} is no set: {parsed:?}")
                 }
             };
@@ -579,7 +593,8 @@ mod tests {
                 #[cfg(variable_data)]
                 parsed @ (VariableSubcommands::Get { .. }
                 | VariableSubcommands::Set(_)
-                | VariableSubcommands::WriteSigned(_)) => {
+                | VariableSubcommands::WriteSigned(_)
+                | VariableSubcommands::BootManager(_)) => {
                     panic!("{args:?} is no storage: {parsed:?}")
                 }
                 parsed @ VariableSubcommands::List { .. } => {
diff --git a/src/variable_command/boot_manager.rs b/src/variable_command/boot_manager.rs
new file mode 100644
index 0000000..e8bf2de
--- /dev/null
+++ b/src/variable_command/boot_manager.rs
@@ -0,0 +1,805 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The variable subcommands that write the boot manager's variables (UEFI 2.11 §3.1).
+
+use std::path::PathBuf;
+
+use anyhow::bail;
+use anyhow::Result;
+use clap::builder::PossibleValue;
+use clap::ArgGroup;
+use clap::Args;
+use clap::Subcommand;
+use clap::ValueEnum;
+use uefisettings::exports::AttributeChange;
+use uefisettings::exports::DevicePathSource;
+use uefisettings::exports::HotKeysFollowing;
+use uefisettings::exports::InputKey;
+use uefisettings::exports::KeyModifier;
+use uefisettings::exports::LoadOptionCategory;
+use uefisettings::exports::LoadOptionFlag;
+use uefisettings::exports::NewHotKey;
+use uefisettings::exports::NewLoadOption;
+use uefisettings::exports::VariableBackend;
+
+use super::print_global_variable;
+use crate::platform;
+
+#[derive(Debug, Subcommand)]
+pub(super) enum BootManagerSubcommands {
+    /// Set and clear the flags and set the category of a Boot####, Driver#### or SysPrep####,
+    /// keeping its other bits and bytes, and the Key#### of a Boot#### following it
+    #[command(next_display_order = None)]
+    SetAttributes(SetAttributesArgs),
+    /// Create a Boot####, Driver#### or SysPrep#### that does not exist, from device paths as
+    /// text or files of their bytes
+    #[command(next_display_order = None)]
+    CreateLoadOption(CreateLoadOptionArgs),
+    /// Set ConIn, ConOut or ErrOut to a device path, as text or a file of its bytes, keeping
+    /// its attributes
+    #[command(next_display_order = None)]
+    SetDevicePath(SetDevicePathArgs),
+    /// Create a Key#### that does not exist: a hot key that starts a Boot####
+    #[command(next_display_order = None)]
+    CreateKey(CreateKeyArgs),
+}
+
+impl BootManagerSubcommands {
+    pub(super) fn run(&self) -> Result<()> {
+        match self {
+            Self::SetAttributes(args) => args.run(),
+            Self::CreateLoadOption(args) => args.run(),
+            Self::SetDevicePath(args) => args.run(),
+            Self::CreateKey(args) => args.run(),
+        }
+    }
+}
+
+/// The load option and the change of its Attributes.
+#[derive(Debug, Args)]
+pub(super) struct SetAttributesArgs {
+    /// The load option, such as Boot0001, of vendor 8BE4DF61-93CA-11D2-AA0D-00E098032B8C
+    name: String,
+    /// The flags to set, comma-separated
+    #[arg(long, value_enum, value_delimiter = ',')]
+    set: Vec<FlagArg>,
+    /// The flags to clear, comma-separated
+    #[arg(long, value_enum, value_delimiter = ',')]
+    clear: Vec<FlagArg>,
+    /// The category to give it, a value of LOAD_OPTION_CATEGORY: boot options boot, app ones the
+    /// boot manager starts only when asked to
+    #[arg(long, value_enum)]
+    category: Option<CategoryArg>,
+}
+
+impl SetAttributesArgs {
+    /// Writes the change and prints the load option as get shows it, and a line on stderr for
+    /// each Key#### updated.
+    fn run(&self) -> Result<()> {
+        let set = VariableBackend::set_attributes(&self.name, &self.change())?;
+        for note in hot_key_notes(&set.hot_keys) {
+            eprintln!("{note}");
+        }
+        print_global_variable(&set.option)
+    }
+
+    fn change(&self) -> AttributeChange {
+        AttributeChange {
+            set: self.set.iter().copied().map(LoadOptionFlag::from).collect(),
+            clear: self
+                .clear
+                .iter()
+                .copied()
+                .map(LoadOptionFlag::from)
+                .collect(),
+            category: self.category.map(LoadOptionCategory::from),
+        }
+    }
+}
+
+/// The load option to create.
+#[derive(Debug, Args)]
+#[command(group(ArgGroup::new("device_paths").required(true).args(["device_path", "device_path_file"])))]
+pub(super) struct CreateLoadOptionArgs {
+    /// The load option, such as Boot0001, of vendor 8BE4DF61-93CA-11D2-AA0D-00E098032B8C
+    name: String,
+    /// Its Description, UCS-2 text, which boot menus show
+    #[arg(long)]
+    description: String,
+    /// A device path as variable get shows it, such as PciRoot(0x0)/Pci(0x1,0x0), once per device path, the first of which locates the image
+    #[arg(long)]
+    device_path: Vec<String>,
+    /// A file of the bytes of a device path, an EFI_DEVICE_PATH_PROTOCOL ended by an End Entire Device Path node, written as they are, once per device path
+    #[arg(long)]
+    device_path_file: Vec<PathBuf>,
+    /// A file of its OptionalData, the bytes that the boot manager passes to the image, written as they are; none if not given
+    #[arg(long)]
+    optional_data_file: Option<PathBuf>,
+    /// Its flags, comma-separated, or none
+    #[arg(long, value_enum, value_delimiter = ',', default_values_t = [NewFlagArg::Flag(FlagArg::Active)])]
+    flags: Vec<NewFlagArg>,
+    /// Its category: boot options boot, app ones the boot manager starts only when asked to
+    #[arg(long, value_enum, default_value_t = CategoryArg::Boot)]
+    category: CategoryArg,
+}
+
+impl CreateLoadOptionArgs {
+    /// Creates the load option and prints it as get shows it, and each warning on stderr.
+    fn run(&self) -> Result<()> {
+        let optional_data = match &self.optional_data_file {
+            Some(path) => platform::read_payload(path)?,
+            None => Vec::new(),
+        };
+        let new = NewLoadOption {
+            flags: self.flags()?,
+            category: self.category.into(),
+            description: self.description.clone(),
+            device_paths: device_path_source(&self.device_path, &self.device_path_file)?,
+            optional_data,
+        };
+        let created = VariableBackend::create_load_option(&self.name, &new)?;
+        for warning in &created.warnings {
+            eprintln!("warning: {warning}");
+        }
+        print_global_variable(&created.option)
+    }
+
+    /// The flags of --flags: none for no flag, alone.
+    fn flags(&self) -> Result<Vec<LoadOptionFlag>> {
+        match self.flags.as_slice() {
+            [NewFlagArg::None] => Ok(Vec::new()),
+            flags => flags
+                .iter()
+                .map(|flag| match flag {
+                    NewFlagArg::None => bail!("--flags takes none alone, for no flag"),
+                    NewFlagArg::Flag(flag) => Ok(LoadOptionFlag::from(*flag)),
+                })
+                .collect(),
+        }
+    }
+}
+
+/// The console variable and its device path.
+#[derive(Debug, Args)]
+#[command(group(ArgGroup::new("path").required(true).args(["device_path", "device_path_file"])))]
+pub(super) struct SetDevicePathArgs {
+    /// ConIn, ConOut or ErrOut
+    name: String,
+    /// The device path as variable get shows it, its instances separated by ","
+    #[arg(long)]
+    device_path: Option<String>,
+    /// A file of its bytes, an EFI_DEVICE_PATH_PROTOCOL ended by an End Entire Device Path node, written as they are
+    #[arg(long)]
+    device_path_file: Option<PathBuf>,
+}
+
+impl SetDevicePathArgs {
+    /// Writes the device path and prints the variable as get shows it, and each warning on
+    /// stderr.
+    fn run(&self) -> Result<()> {
+        let path = device_path_source(
+            self.device_path.as_slice(),
+            self.device_path_file.as_slice(),
+        )?;
+        let set = VariableBackend::set_device_path(&self.name, &path)?;
+        for warning in &set.warnings {
+            eprintln!("warning: {warning}");
+        }
+        print_global_variable(&set.console)
+    }
+}
+
+/// The hot key to create.
+#[derive(Debug, Args)]
+pub(super) struct CreateKeyArgs {
+    /// The hot key, such as Key0001, of vendor 8BE4DF61-93CA-11D2-AA0D-00E098032B8C
+    name: String,
+    /// The Boot#### that it starts, such as Boot0001
+    #[arg(long)]
+    boot: String,
+    /// The shift states that must be pressed with the keys, comma-separated; the others must not be
+    #[arg(long, value_enum, value_delimiter = ',')]
+    modifiers: Vec<ModifierArg>,
+    /// A key, by the name after SCAN_ of its scan code, such as F2, ESC or PAGE_UP, a character, or ScanCode=0x####,UnicodeChar=0x#### as variable get shows other keys, once per key, in order, at most 3
+    #[arg(long)]
+    key: Vec<InputKey>,
+}
+
+impl CreateKeyArgs {
+    /// Creates the hot key and prints it as get shows it, and each warning on stderr.
+    fn run(&self) -> Result<()> {
+        let new = NewHotKey {
+            boot_option: self.boot.clone(),
+            modifiers: self
+                .modifiers
+                .iter()
+                .copied()
+                .map(KeyModifier::from)
+                .collect(),
+            keys: self.key.clone(),
+        };
+        let created = VariableBackend::create_key(&self.name, &new)?;
+        for warning in &created.warnings {
+            eprintln!("warning: {warning}");
+        }
+        print_global_variable(&created.key)
+    }
+}
+
+/// The device paths of `texts`, else of the files `files`, which the argument groups keep
+/// apart.
+fn device_path_source(texts: &[String], files: &[PathBuf]) -> Result<DevicePathSource> {
+    match files.is_empty() {
+        true => Ok(DevicePathSource::Texts(texts.to_vec())),
+        false => Ok(DevicePathSource::Bytes(
+            files
+                .iter()
+                .map(PathBuf::as_path)
+                .map(platform::read_payload)
+                .collect::<Result<_>>()?,
+        )),
+    }
+}
+
+/// What set-attributes prints on stderr of the Key#### that followed the load option.
+fn hot_key_notes(hot_keys: &HotKeysFollowing) -> Vec<String> {
+    match hot_keys {
+        HotKeysFollowing::Updated(numbers) => numbers
+            .iter()
+            .map(|number| {
+                format!(
+                    "updated Key{number:04X}: its BootOptionCrc is the CRC-32 of the Boot#### \
+                     that it starts again (UEFI 2.11 section 3.1.6)"
+                )
+            })
+            .collect(),
+        HotKeysFollowing::Unlisted(boot) => vec![format!(
+            "warning: EFI variables cannot be listed here, so each Key#### that names {boot} \
+             keeps the CRC-32 of its old bytes, and the boot manager now ignores it (UEFI 2.11 \
+             section 3.1.6)"
+        )],
+        _ => Vec::new(),
+    }
+}
+
+/// A flag of a load option's Attributes (UEFI 2.11 §3.1.3), LOAD_OPTION_ and these names.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
+enum FlagArg {
+    Active,
+    ForceReconnect,
+    Hidden,
+}
+
+impl From<FlagArg> for LoadOptionFlag {
+    fn from(flag: FlagArg) -> Self {
+        match flag {
+            FlagArg::Active => Self::Active,
+            FlagArg::ForceReconnect => Self::ForceReconnect,
+            FlagArg::Hidden => Self::Hidden,
+        }
+    }
+}
+
+/// A shift state of EFI_BOOT_KEY_DATA (UEFI 2.11 §3.1.6), these names and Pressed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
+enum ModifierArg {
+    Shift,
+    Control,
+    Alt,
+    Logo,
+    Menu,
+    SysReq,
+}
+
+impl From<ModifierArg> for KeyModifier {
+    fn from(modifier: ModifierArg) -> Self {
+        match modifier {
+            ModifierArg::Shift => Self::Shift,
+            ModifierArg::Control => Self::Control,
+            ModifierArg::Alt => Self::Alt,
+            ModifierArg::Logo => Self::Logo,
+            ModifierArg::Menu => Self::Menu,
+            ModifierArg::SysReq => Self::SysReq,
+        }
+    }
+}
+
+/// A value of LOAD_OPTION_CATEGORY that UEFI 2.11 §3.1.3 defines, LOAD_OPTION_CATEGORY_ and
+/// these names.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
+enum CategoryArg {
+    Boot,
+    App,
+}
+
+impl From<CategoryArg> for LoadOptionCategory {
+    fn from(category: CategoryArg) -> Self {
+        match category {
+            CategoryArg::Boot => Self::Boot,
+            CategoryArg::App => Self::App,
+        }
+    }
+}
+
+/// A flag of create-load-option: a FlagArg, or none, for Attributes of the category alone.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum NewFlagArg {
+    None,
+    Flag(FlagArg),
+}
+
+impl ValueEnum for NewFlagArg {
+    fn value_variants<'a>() -> &'a [Self] {
+        &[
+            Self::None,
+            Self::Flag(FlagArg::Active),
+            Self::Flag(FlagArg::ForceReconnect),
+            Self::Flag(FlagArg::Hidden),
+        ]
+    }
+
+    fn to_possible_value(&self) -> Option<PossibleValue> {
+        match self {
+            Self::None => Some(PossibleValue::new("none")),
+            Self::Flag(flag) => flag.to_possible_value(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use clap::error::ErrorKind;
+    use clap::Parser;
+    use uefisettings::exports::LoadOptionKind;
+    use uefisettings::exports::LoadOptionName;
+
+    use super::*;
+    use crate::variable_command::VariableSubcommands;
+    use crate::Commands;
+    use crate::UefiSettingsToolArgs;
+
+    /// The boot manager subcommand that `args`, after `uefisettings variable`, parse to, or the
+    /// kind of error that their parse fails with.
+    fn boot_manager(args: &[&str]) -> std::result::Result<BootManagerSubcommands, ErrorKind> {
+        let argv = [&["uefisettings", "variable"][..], args].concat();
+        let command = UefiSettingsToolArgs::try_parse_from(&argv)
+            .map_err(|error| error.kind())?
+            .command;
+        match command {
+            Commands::Variable(variable) => match variable.command {
+                VariableSubcommands::BootManager(command) => Ok(command),
+                #[cfg(variable_info)]
+                parsed @ VariableSubcommands::Info { .. } => {
+                    panic!("{argv:?} is no boot manager write: {parsed:?}")
+                }
+                parsed @ (VariableSubcommands::List { .. }
+                | VariableSubcommands::Get { .. }
+                | VariableSubcommands::Set { .. }
+                | VariableSubcommands::Storage { .. }
+                | VariableSubcommands::WriteSigned(_)) => {
+                    panic!("{argv:?} is no boot manager write: {parsed:?}")
+                }
+            },
+            other => panic!("{argv:?} is no variable command: {other:?}"),
+        }
+    }
+
+    /// set-attributes takes the load option, flags to set and to clear, comma-separated or
+    /// repeated, and a category, a value: no flag names LOAD_OPTION_CATEGORY_APP's bit.
+    #[test]
+    fn set_attributes_takes_flags_and_a_category_value() {
+        let cases: [(&[&str], AttributeChange); 3] = [
+            (
+                &[
+                    "Boot0001",
+                    "--set",
+                    "active,hidden",
+                    "--clear",
+                    "force-reconnect",
+                    "--category",
+                    "app",
+                ],
+                AttributeChange {
+                    set: vec![LoadOptionFlag::Active, LoadOptionFlag::Hidden],
+                    clear: vec![LoadOptionFlag::ForceReconnect],
+                    category: Some(LoadOptionCategory::App),
+                },
+            ),
+            (
+                &["Boot0001", "--clear", "active", "--clear", "hidden"],
+                AttributeChange {
+                    clear: vec![LoadOptionFlag::Active, LoadOptionFlag::Hidden],
+                    ..AttributeChange::default()
+                },
+            ),
+            (
+                &["Boot0001", "--category", "boot"],
+                AttributeChange {
+                    category: Some(LoadOptionCategory::Boot),
+                    ..AttributeChange::default()
+                },
+            ),
+        ];
+        for (args, want) in cases {
+            let argv = [&["set-attributes"][..], args].concat();
+            let parsed = match boot_manager(&argv) {
+                Ok(BootManagerSubcommands::SetAttributes(parsed)) => parsed,
+                other => panic!("{argv:?} is no set-attributes: {other:?}"),
+            };
+
+            assert_eq!(
+                (parsed.name.as_str(), parsed.change()),
+                ("Boot0001", want),
+                "{argv:?}"
+            );
+        }
+
+        for args in [
+            &["set-attributes", "Boot0001", "--set", "app"][..],
+            &["set-attributes", "Boot0001", "--clear", "category-app"],
+            &["set-attributes", "Boot0001", "--category", "0x300"],
+        ] {
+            assert_eq!(
+                boot_manager(args).map(|_| ()),
+                Err(ErrorKind::InvalidValue),
+                "{args:?}"
+            );
+        }
+        assert_eq!(
+            boot_manager(&["set-attributes"]).map(|_| ()),
+            Err(ErrorKind::MissingRequiredArgument),
+            "no load option"
+        );
+    }
+
+    /// The flags and categories that set-attributes and create-load-option take are those that
+    /// variable get prints.
+    #[test]
+    fn flag_and_category_names_are_those_that_get_prints() {
+        for flag in FlagArg::value_variants() {
+            let name = flag
+                .to_possible_value()
+                .expect("a possible value")
+                .get_name()
+                .to_owned();
+
+            assert_eq!(name, LoadOptionFlag::from(*flag).name(), "{flag:?}");
+        }
+        assert_eq!(
+            NewFlagArg::value_variants(),
+            [
+                &[NewFlagArg::None][..],
+                &FlagArg::value_variants()
+                    .iter()
+                    .copied()
+                    .map(NewFlagArg::Flag)
+                    .collect::<Vec<_>>(),
+            ]
+            .concat(),
+            "create-load-option's flags: none, then each flag"
+        );
+        for category in CategoryArg::value_variants() {
+            let name = category
+                .to_possible_value()
+                .expect("a possible value")
+                .get_name()
+                .to_owned();
+
+            assert_eq!(
+                name,
+                LoadOptionCategory::from(*category).name(),
+                "{category:?}"
+            );
+        }
+    }
+
+    /// create-load-option takes the load option, a Description, device paths as text or files,
+    /// not both, at least one, OptionalData from a file if any, and flags, or none alone, and a
+    /// category, active and boot if not given.
+    #[test]
+    fn create_load_option_takes_device_paths_as_text_or_files() {
+        let parse =
+            |args: &[&str]| match boot_manager(&[&["create-load-option"][..], args].concat()) {
+                Ok(BootManagerSubcommands::CreateLoadOption(parsed)) => Ok(parsed),
+                Ok(other) => panic!("{args:?} is no create-load-option: {other:?}"),
+                Err(kind) => Err(kind),
+            };
+
+        let texts = parse(&[
+            "Boot0001",
+            "--description",
+            "Shell",
+            "--device-path",
+            "Pci(0x1,0x0)",
+            "--device-path",
+            "Pci(0x2,0x0)",
+        ])
+        .expect("parse texts");
+        let files = parse(&[
+            "Boot0001",
+            "--description",
+            "Shell",
+            "--device-path-file",
+            "a.bin",
+            "--optional-data-file",
+            "o.bin",
+            "--flags",
+            "hidden,force-reconnect",
+            "--category",
+            "app",
+        ])
+        .expect("parse files");
+
+        assert_eq!(
+            (
+                texts.device_path.as_slice(),
+                texts.device_path_file.as_slice(),
+                texts.optional_data_file.as_deref(),
+                texts.flags().expect("the default flags"),
+                texts.category,
+            ),
+            (
+                &["Pci(0x1,0x0)".to_owned(), "Pci(0x2,0x0)".to_owned()][..],
+                &[][..],
+                None,
+                vec![LoadOptionFlag::Active],
+                CategoryArg::Boot,
+            ),
+            "texts, the default flags and category"
+        );
+        assert_eq!(
+            (
+                files.device_path.as_slice(),
+                files.device_path_file.as_slice(),
+                files.optional_data_file.as_deref(),
+                files.flags().expect("hidden,force-reconnect"),
+                files.category,
+            ),
+            (
+                &[][..],
+                &[PathBuf::from("a.bin")][..],
+                Some(std::path::Path::new("o.bin")),
+                vec![LoadOptionFlag::Hidden, LoadOptionFlag::ForceReconnect],
+                CategoryArg::App,
+            ),
+            "files"
+        );
+
+        // no flag: Attributes of the category alone, such as 0x100 of an app
+        let app = |flags: &str| {
+            parse(&[
+                "Boot0001",
+                "--description",
+                "Shell",
+                "--device-path",
+                "Pci(0x1,0x0)",
+                "--flags",
+                flags,
+                "--category",
+                "app",
+            ])
+            .unwrap_or_else(|kind| panic!("parse --flags {flags}: {kind}"))
+        };
+        let none = app("none");
+        assert_eq!(
+            (none.flags().expect("--flags none"), none.category),
+            (vec![], CategoryArg::App),
+            "--flags none"
+        );
+        for flags in ["none,active", "hidden,none", "none,none"] {
+            assert_eq!(
+                app(flags).flags().map_err(|error| error.to_string()),
+                Err("--flags takes none alone, for no flag".to_owned()),
+                "--flags {flags}"
+            );
+        }
+        for (args, want) in [
+            (
+                &["Boot0001", "--description", "Shell"][..],
+                ErrorKind::MissingRequiredArgument,
+            ),
+            (
+                &["Boot0001", "--device-path", "Pci(0x1,0x0)"],
+                ErrorKind::MissingRequiredArgument,
+            ),
+            (
+                &[
+                    "Boot0001",
+                    "--description",
+                    "Shell",
+                    "--device-path",
+                    "Pci(0x1,0x0)",
+                    "--device-path-file",
+                    "a.bin",
+                ],
+                ErrorKind::ArgumentConflict,
+            ),
+            (
+                &[
+                    "Boot0001",
+                    "--description",
+                    "Shell",
+                    "--device-path",
+                    "Pci(0x1,0x0)",
+                    "--flags",
+                    "app",
+                ],
+                ErrorKind::InvalidValue,
+            ),
+        ] {
+            assert_eq!(parse(args).map(|_| ()), Err(want), "{args:?}");
+        }
+    }
+
+    /// set-device-path takes the console variable and one device path, as text or a file.
+    #[test]
+    fn set_device_path_takes_one_device_path() {
+        let parse = |args: &[&str]| match boot_manager(&[&["set-device-path"][..], args].concat()) {
+            Ok(BootManagerSubcommands::SetDevicePath(parsed)) => Ok(parsed),
+            Ok(other) => panic!("{args:?} is no set-device-path: {other:?}"),
+            Err(kind) => Err(kind),
+        };
+
+        let text = parse(&["ConOut", "--device-path", "Pci(0x1,0x0)"]).expect("parse a text");
+        let file = parse(&["ConOut", "--device-path-file", "a.bin"]).expect("parse a file");
+
+        assert_eq!(
+            (
+                text.name.as_str(),
+                text.device_path.as_deref(),
+                text.device_path_file
+            ),
+            ("ConOut", Some("Pci(0x1,0x0)"), None),
+            "text"
+        );
+        assert_eq!(
+            (file.device_path, file.device_path_file),
+            (None, Some(PathBuf::from("a.bin"))),
+            "file"
+        );
+        for (args, want) in [
+            (&["ConOut"][..], ErrorKind::MissingRequiredArgument),
+            (
+                &[
+                    "ConOut",
+                    "--device-path",
+                    "Pci(0x1,0x0)",
+                    "--device-path-file",
+                    "a.bin",
+                ],
+                ErrorKind::ArgumentConflict,
+            ),
+            (
+                &[
+                    "ConOut",
+                    "--device-path",
+                    "Pci(0x1,0x0)",
+                    "--device-path",
+                    "Pci(0x2,0x0)",
+                ],
+                ErrorKind::ArgumentConflict,
+            ),
+        ] {
+            assert_eq!(parse(args).map(|_| ()), Err(want), "{args:?}");
+        }
+    }
+
+    /// create-key takes the hot key, the Boot#### that it starts, shift states, comma-separated,
+    /// and keys, by scan code name, character or codes, in order; other names are refused.
+    #[test]
+    fn create_key_takes_shift_states_and_keys() {
+        let parse = |args: &[&str]| match boot_manager(&[&["create-key"][..], args].concat()) {
+            Ok(BootManagerSubcommands::CreateKey(parsed)) => Ok(parsed),
+            Ok(other) => panic!("{args:?} is no create-key: {other:?}"),
+            Err(kind) => Err(kind),
+        };
+
+        let parsed = parse(&[
+            "Key0001",
+            "--boot",
+            "Boot0001",
+            "--modifiers",
+            "control,sys-req",
+            "--key",
+            "F2",
+            "--key",
+            "q",
+            "--key",
+            "ScanCode=0x0099,UnicodeChar=0x0000",
+        ])
+        .expect("parse create-key");
+
+        assert_eq!(
+            (
+                parsed.name.as_str(),
+                parsed.boot.as_str(),
+                parsed.modifiers.as_slice(),
+                parsed
+                    .key
+                    .iter()
+                    .map(ToString::to_string)
+                    .collect::<Vec<_>>(),
+            ),
+            (
+                "Key0001",
+                "Boot0001",
+                &[ModifierArg::Control, ModifierArg::SysReq][..],
+                vec![
+                    "F2".to_owned(),
+                    "q".to_owned(),
+                    "ScanCode=0x0099,UnicodeChar=0x0000".to_owned(),
+                ],
+            ),
+            "create-key"
+        );
+        for (args, want) in [
+            (
+                &["Key0001", "--key", "F2"][..],
+                ErrorKind::MissingRequiredArgument,
+            ),
+            (
+                &["Key0001", "--boot", "Boot0001", "--key", "f2"],
+                ErrorKind::ValueValidation,
+            ),
+            (
+                &["Key0001", "--boot", "Boot0001", "--modifiers", "ctrl"],
+                ErrorKind::InvalidValue,
+            ),
+        ] {
+            assert_eq!(parse(args).map(|_| ()), Err(want), "{args:?}");
+        }
+    }
+
+    /// The shift states that create-key takes are those that variable get prints.
+    #[test]
+    fn modifier_names_are_those_that_get_prints() {
+        for modifier in ModifierArg::value_variants() {
+            let name = modifier
+                .to_possible_value()
+                .expect("a possible value")
+                .get_name()
+                .to_owned();
+
+            assert_eq!(name, KeyModifier::from(*modifier).name(), "{modifier:?}");
+        }
+    }
+
+    #[test]
+    fn hot_key_notes_name_each_key_updated_or_that_none_could_be() {
+        assert_eq!(
+            hot_key_notes(&HotKeysFollowing::Updated(vec![1, 0xA])),
+            [
+                "updated Key0001: its BootOptionCrc is the CRC-32 of the Boot#### that it starts \
+                 again (UEFI 2.11 section 3.1.6)",
+                "updated Key000A: its BootOptionCrc is the CRC-32 of the Boot#### that it starts \
+                 again (UEFI 2.11 section 3.1.6)",
+            ],
+            "updated"
+        );
+        assert_eq!(
+            hot_key_notes(&HotKeysFollowing::Updated(Vec::new())),
+            Vec::<String>::new(),
+            "none updated"
+        );
+        assert_eq!(
+            hot_key_notes(&HotKeysFollowing::Unlisted(LoadOptionName {
+                kind: LoadOptionKind::Boot,
+                number: 1,
+            })),
+            ["warning: EFI variables cannot be listed here, so each Key#### that names Boot0001 \
+              keeps the CRC-32 of its old bytes, and the boot manager now ignores it (UEFI 2.11 \
+              section 3.1.6)"],
+            "unlisted"
+        );
+    }
+}
diff --git a/src/variable_command/write_signed.rs b/src/variable_command/write_signed.rs
index b0f5b0e..448bf63 100644
--- a/src/variable_command/write_signed.rs
+++ b/src/variable_command/write_signed.rs
@@ -98,7 +98,7 @@ pub(super) struct WriteSignedArgs {
     /// With enhanced-authenticated-access, sign a NONCE_TYPE EFI_VARIABLE_AUTHENTICATION_3 of this nonce, two hex digits per byte, other than the variable's; all zero asks the firmware to make one of that size (UEFI 2.11 section 8.2.5)
     #[arg(long, requires = "data_file", conflicts_with = "timestamp")]
     nonce: Option<Nonce>,
-    /// The nonce that the variable holds, two hex digits per byte, which UEFI 2.11 section 8.2.5 signs after the data: required to update an existing NONCE_TYPE variable (deleting one, which section 8.2.3 defines, write-signed refuses), and omitted only to create one
+    /// The nonce that the variable holds, two hex digits per byte, which UEFI 2.11 section 8.2.5 signs after the data of an update of a NONCE_TYPE variable (deleting one, which section 8.2.3 defines, write-signed refuses): by default the one that the variable's metadata gives (section 8.2.1); given, it must be that one, and a create takes none
     // clap waives `requires` for an argument that conflicts with a given one, as --nonce with
     // --timestamp, hence the conflict.
     #[arg(long, requires = "nonce", conflicts_with = "timestamp")]
@@ -370,7 +370,8 @@ mod tests {
                 parsed @ (VariableSubcommands::List { .. }
                 | VariableSubcommands::Get { .. }
                 | VariableSubcommands::Set { .. }
-                | VariableSubcommands::Storage { .. }) => {
+                | VariableSubcommands::Storage { .. }
+                | VariableSubcommands::BootManager(_)) => {
                     panic!("{argv:?} is no write-signed: {parsed:?}")
                 }
             },
diff --git a/tests/qemu/README.md b/tests/qemu/README.md
index 56f4d49..ab1d17c 100644
--- a/tests/qemu/README.md
+++ b/tests/qemu/README.md
@@ -28,8 +28,8 @@ Device memory as arm64 does. On Ubuntu 26.04 it also needs the packages of
 xargs --arg-file=tests/qemu/ubuntu-packages sudo apt-get install --yes
 ```
 
-The guest's kernel, firmware, UEFI Shell and busybox do not come from the host: they are the
-packages that `guest-packages-<arch>` ([x86_64](guest-packages-x86_64),
+The guest's kernel and its FAT modules, firmware, UEFI Shell and busybox do not come from the
+host: they are the packages that `guest-packages-<arch>` ([x86_64](guest-packages-x86_64),
 [i686](guest-packages-i686) or [aarch64](guest-packages-aarch64)) pins, which
 [`fetch-packages.sh`](fetch-packages.sh) downloads. `run.sh` first runs
 [`fetch-packages-test.sh`](fetch-packages-test.sh), which checks on local fixtures how that
@@ -53,7 +53,7 @@ tests/qemu/run.sh x86_64 boot-smoke   # the named scenarios
 ```
 
 Elsewhere, these tools must be on `PATH`: `qemu-system-x86_64`, `qemu-system-i386`,
-`qemu-system-aarch64`, `virt-fw-vars`, `jq`, `cpio`, `flock` and `openssl` for `run.sh`;
+`qemu-system-aarch64`, `virt-fw-vars`, `jq`, `cpio`, `flock`, `openssl` and `sfdisk` for `run.sh`;
 `curl`, `rpm2cpio`, `cpio`, `ar`, `tar`, `xz` and `zstd` for `fetch-packages.sh`; and,
 unless DriverSample.efi is already built, `gcc`, `g++`, `make`, `git`, `nasm`, `python3`
 and the libuuid headers for [`build-driver-sample.sh`](build-driver-sample.sh), which
@@ -277,6 +277,19 @@ variable that [`vars/disabled-form.json`](vars/disabled-form.json) creates: in t
 `shell-disabled-form`, `uefisettings.efi` reads and writes the questions of its other form, and
 no byte of that PASSWORD.
 
+`publish-hiidb.efi form-set-disable-if-forms` registers those of
+[`publish-hiidb/src/form_set_disable_if_forms.rs`](publish-hiidb/src/form_set_disable_if_forms.rs):
+a form set on the variable that [`vars/form-set-disable-if.json`](vars/form-set-disable-if.json)
+creates, whose forms but the first are in DISABLE_IFs outside forms. A true one holds the form of
+Hidden and of a PASSWORD, which a question of the first form overlaps; one on a question holds the
+form of After; and a false one holds a true SUPPRESS_IF, then the form of Later. In the scenario
+`hii-form-set-disable-if`, whose later `publish-hiidb.efi rt-data` exports the database, and in
+`shell-form-set-disable-if`, Hidden and the PASSWORD are no questions with any `--include`, a
+SUPPRESS_IF on Hidden does not suppress, no byte of the password shows or is written, and After and
+Later may be disabled, so `set` writes them only with disabled questions included. From Linux, the
+x-UEFI-ns keyword of Hidden selects it as a disabled question, and `hii dump-efivars` keeps its byte
+for that keyword, but no byte of the password.
+
 `publish-hiidb.efi short-var-store-forms` registers those of
 [`publish-hiidb/src/short_var_store_forms.rs`](publish-hiidb/src/short_var_store_forms.rs):
 questions on a VARSTORE_EFI of the form before UEFI 2.3.1, each on the EFI variable of its
@@ -316,14 +329,18 @@ question beside it reads, and in the UEFI Shell writes.
 
 `publish-hiidb.efi keyword-kinds-forms` creates the variable `KindStore` unless it exists, with
 its VarStore's Attributes and Size, and registers the forms of
-[`publish-hiidb/src/keyword_kinds_forms.rs`](publish-hiidb/src/keyword_kinds_forms.rs) for a
-new handle of a vendor device path: a DATE that suppresses its year, a TIME that suppresses its
-second, an ORDERED_LIST of at most 3 UINT8 options under EFI_IFR_UNIQUE_SET and a REF5 on
-`KindStore`, each with an x-UEFI-ns keyword. In the scenario `shell-keyword-kinds`,
-`uefisettings.efi hii keyword set` writes the DATE, the TIME and the ORDERED_LIST through edk2's
-Config Keyword Handler, one at a time and two in one SetData(), and refuses before any call a
+[`publish-hiidb/src/keyword_kinds_forms.rs`](publish-hiidb/src/keyword_kinds_forms.rs) for a new
+handle of a vendor device path: a DATE that suppresses its year, a TIME that suppresses its
+second, an ORDERED_LIST of at most 3 UINT8 options under EFI_IFR_UNIQUE_SET, a REF5, and a
+STRING and a multi-line STRING of MaxSize 4 on `KindStore`, each with an x-UEFI-ns keyword. In
+the scenario `shell-keyword-kinds`, `uefisettings.efi hii keyword set` writes the DATE, the
+TIME, the ORDERED_LIST and the STRINGs through edk2's Config Keyword Handler, one at a time and
+two in one SetData(), and `hii keyword get` reads the STRING back. It refuses before any call a
 VALUE that changes a suppressed field, an hour out of range, a container after an empty one, an
-option twice and the REF, which `dmpstore` shows wrote nothing.
+option twice and the REF, and of a STRING a VALUE of 4 characters, of a character after the
+NULL, of a Private Use Area character, of a UTF-16 surrogate, of a line feed in the single-line
+STRING, of fewer bytes than MaxSize CHAR16s or with &READONLY, which `dmpstore` shows wrote
+nothing.
 
 `publish-hiidb.efi name-value-password-forms` registers the package lists of
 [`publish-hiidb/src/name_value_password_forms.rs`](publish-hiidb/src/name_value_password_forms.rs)
@@ -338,8 +355,22 @@ and `publish-hiidb.efi export-config-name-value-password` does it before it inst
 ExportConfig()'s results as `export-config` does, with a `<ConfigResp>` of the
 VARSTORE_NAME_VALUE. In the scenarios `shell-name-value-password`, `hii-name-value-password` and
 `hii-name-value-password-snapshot` `uefisettings` reads and writes no variable of that HiiDB, in
-the UEFI Shell and from Linux, and shows no byte of `NvBacking`, nor of the snapshot, while
-`hii list-questions --no-efivars` lists its questions from Linux.
+the UEFI Shell and from Linux, and shows no byte of `NvBacking`, nor of the snapshot, not even
+through a STRING on the PASSWORD's name, while `hii list-questions --no-efivars` lists its
+questions from Linux.
+
+`publish-hiidb.efi rt-data-name-value-string-forms` registers the forms of
+[`publish-hiidb/src/name_value_string_forms.rs`](publish-hiidb/src/name_value_string_forms.rs)
+for a handle with a device path of its own: STRING questions of MaxSize 4 and a CHECKBOX on the
+names of a VARSTORE_NAME_VALUE, beside no PASSWORD, then publishes the database as `rt-data`
+does. `publish-hiidb.efi export-config-name-value-string` registers them before it installs
+ExportConfig()'s results as `export-config` does, with a `<ConfigResp>` of the
+VARSTORE_NAME_VALUE that gives each STRING the digits of a string, 4 per CHAR16: shorter than
+MaxSize, with a NULL after it, of MaxSize characters, with and without a NULL, longer than
+MaxSize, with a CHAR16 of 2 digits, and empty. In the scenario `hii-name-value-string-snapshot`
+`get`, `hii list-questions` and `hii show-ifr` take each STRING's characters from the snapshot,
+or say why its setting holds none, and the CHECKBOX's number, while with `--no-efivars`, and in
+`hii-name-value-string`, which lists no snapshot, each question says why it has no value.
 
 `publish-hiidb.efi storageless-password-forms` registers the package lists of
 [`publish-hiidb/src/storageless_password_forms.rs`](publish-hiidb/src/storageless_password_forms.rs)
@@ -358,12 +389,30 @@ export-config-storageless-password` does it before it installs ExportConfig()'s
 with `--i-am-fine-to-brick-this-system`, and shows no byte of `SlBacking`, nor of the snapshot,
 while `hii list-questions --no-efivars` lists its questions from Linux.
 
+`publish-hiidb.efi undeclared-password-forms` registers the package lists of
+[`publish-hiidb/src/undeclared_password_forms.rs`](publish-hiidb/src/undeclared_password_forms.rs)
+for one device path: a form set with a NUMERIC, of the x-UEFI-ns keyword `UndeclaredSetting`, over
+the variable `UdBacking`, which [`vars/undeclared-password.json`](vars/undeclared-password.json)
+creates, and a PASSWORD question of VarStoreId 9, which no VarStore of its form package declares,
+then a form set with a NUMERIC over the variable `Other`. Such a VarStoreId names no VarStore (UEFI
+2.11 §33.3.8.2.2 asks for "a previously declared variable store"), so the password may be in any
+variable. `publish-hiidb.efi rt-data-undeclared-password-forms` does the same, then publishes the
+database as `rt-data` does, and `publish-hiidb.efi export-config-undeclared-password` does it
+before it installs ExportConfig()'s results as `export-config` does, with a `<ConfigResp>` of
+`UdBacking`. In the scenarios `shell-undeclared-password`, `hii-undeclared-password` and
+`hii-undeclared-password-snapshot` `uefisettings` reads and writes no variable of that HiiDB, in the
+UEFI Shell and from Linux, even with `--i-am-fine-to-brick-this-system`, and shows no byte of
+`UdBacking`, nor of the snapshot, while `hii list-questions --no-efivars` lists its questions from
+Linux.
+
 `publish-hiidb.efi install-config-tables` sets no `HiiDB`: it installs a copy of the HII
 database, in a zeroed runtime pool a quarter larger, as the EFI configuration table of the HII
 database protocol's GUID, as EDK2 does with `PcdHiiOsRuntimeSupport`, which OVMF and ArmVirt
 set to FALSE. The scenario `hii-systab` and, on aarch64 with `kernel=vamap`, `hii-systab-vamap`
 check that the Linux build reads it with `--hii-source systab` and in the automatic order, where
-the vendor ACPI tables and the `HiiDB` variable report their sources absent.
+the vendor ACPI tables and the `HiiDB` variable report their sources absent; and that it refuses
+`--hii-source` in `show-translations`, `ilo` and `hii list-strings -f`, and `--efivar-memory`
+with `--hii-source systab`.
 
 `publish-hiidb.efi export-config` installs the current configuration that EDK2 exports with
 `PcdHiiOsRuntimeSupport` too (UEFI 2.11 §33.2.11.1): `ExportConfig()`'s results, in a zeroed
@@ -423,6 +472,41 @@ InitCapsuleMaxVariable()), as the variable store that seeds them holds no volati
 `shell-capsule-results` and `shell-capsule-results-i686` check that `uefisettings.efi` prints the
 same results in the UEFI Shell, and the table.
 
+## Staged sets
+
+The scenario `staged-set` stages a set for the next boot from Linux and has the firmware apply
+it, on each architecture. Its option `devices=esp-disk` has `run.sh` attach a writable 64 MiB
+disk image, which its boots share and `sfdisk` partitions as [`esp-disk.sfdisk`](esp-disk.sfdisk):
+the EFI system partition is GPT entry 2 but the first partition on the disk. `run.sh` also puts
+in the initramfs the modules that Linux needs to mount that partition, on x86_64 and aarch64
+only the FAT modules of `kernel-modules-core`, and the UEFI Shell's `uefisettings.efi`. The guest
+test [`staged_set`](guest/tests/staged_set.rs) formats that partition and stages questions of
+`publish-hiidb.efi callback-forms`, whose driver holds their value, with `set --image`.
+
+Its `rebooting-shell:` boots run QEMU without `-no-reboot`, so that a reset restarts the
+firmware. Before the UEFI Shell, the firmware starts the staged set's `Boot####` from
+`BootNext`; its `uefisettings.efi` applies the set, prints each result and the deletion of the
+`Boot####`, and resets the platform. In the other two boots, the firmware finds no image, as the
+test deleted it, or a question's `Callback(CHANGED)` resets the platform before any result.
+[`check-shell-log.sh`](check-shell-log.sh) reads what the firmware printed before the Shell,
+through every reset, as the step `firmware`.
+
+## Boot manager
+
+The scenario `boot-manager` reads and writes the boot manager's variables (UEFI 2.11 §3.1)
+from Linux and from the UEFI Shell. [`vars/boot-manager.json`](vars/boot-manager.json) seeds
+its variable store with `Boot0099`, a load option of a file that no ESP holds, with an
+undefined attribute bit and OptionalData, which `BootOrder` does not list, and `Key0099`, a hot
+key, CTRL-q, to `Boot0099`, whose `BootOptionCrc` is the CRC-32 of that `Boot0099`. The
+firmware's boot manager keeps both, as it keeps every load option that it did not create, and
+ignores a key whose CRC does not match. Its `Driver0000` loads `DriverSample.efi`, as in the HII
+scenarios. Its Linux boot creates `Boot009A`, to the firmware's UEFI Shell, names it in
+`BootNext` and creates `Key009A`, ALT-F11 to `Boot0099`; the firmware starts the Shell through
+`Boot009A`, and the Shell creates `Boot009B`, of the short-form File Path of `uefisettings.efi`,
+names that in `BootNext` and creates `Key009B`, SHIFT-F12 to `Boot009B`. In the next boot,
+`uefisettings.efi` prints its usage and returns, and the firmware starts the Shell of `BootOrder`.
+The Shell checks read the lines in which the firmware's boot manager logged each load.
+
 ## Secure Boot
 
 The scenarios with `firmware=secboot-setup` or `firmware=secboot-user` in their options boot
@@ -475,6 +559,17 @@ refuses them before any write, as its efivarfs lacks the attribute, and the firm
 EFI_INVALID_PARAMETER, as EDK2's variable driver takes no such attribute; the variable stays
 absent.
 
+`shell-auth3-checks`, with `devices=virtio-rng`, seeds the variables of
+[`vars/enhanced-auth-87.json`](vars/enhanced-auth-87.json) on the User Mode firmware, among them
+`EnhancedAuthNonce`, whose metadata holds a nonce, and checks that `uefisettings.efi variable
+write-signed` refuses, before it seeds or writes, what the firmware would refuse against the stored
+metadata (UEFI 2.11 §8.2.3, §8.2.5): a TimeStamp that is not later, other attributes, another Type,
+metadata of Version 2, the variable's own nonce, a `--current-nonce` other than its own, and one for
+a variable that does not exist. A later TimeStamp, and another nonce, which signs the variable's own
+as the current one, reach SetVariable(), which refuses them with EFI_INVALID_PARAMETER as above;
+every variable stays as seeded. `variable info` shows the metadata of `EnhancedAuthNonce` and the
+refusal of that of `EnhancedAuthRefused`.
+
 `shell-devdb-setup` checks, in Setup Mode, that `uefisettings.efi` refuses an append to devdb, the
 device signature database of UEFI 2.11 §32.6.3, signed with PK's key, before any write, and
 appends with `--i-am-fine-to-brick-this-system`, which creates devdb; that the firmware then refuses
diff --git a/tests/qemu/build-secboot-firmware.sh b/tests/qemu/build-secboot-firmware.sh
index ab7a4e4..330d8a3 100755
--- a/tests/qemu/build-secboot-firmware.sh
+++ b/tests/qemu/build-secboot-firmware.sh
@@ -108,6 +108,22 @@ if [[ $head != "$commit" ]]; then
     exit 1
 fi
 git -C "$src" submodule update --quiet --init --depth 1 "${submodules[@]}"
+# The tag's EfiRom.c fails BaseTools' -Werror on ubuntu-26.04 (gcc 15, glibc 2.43): there,
+# strstr of a const string is a const char *, which it assigns to an unused CHAR8 *
+# (discarded-qualifiers). edk2 9af06ef3cbb0 ("BaseTools/EfiRom: fix compiler warning"), after
+# the tag, drops that assignment; pre and post are that commit's blobs of the file, and the
+# WORK of an earlier run may hold either.
+efirom=$src/BaseTools/Source/C/EfiRom/EfiRom.c
+pre=fa7bf0e62e6dd3438b6141d6bd70b7c123188698
+post=6e903b350411b7594c986212debc0c501d703962
+if [[ $(git -C "$src" hash-object --no-filters "$efirom") == "$pre" ]]; then
+    sed -i -e '/^  CHAR8     \*Ptr0;/d' \
+        -e 's/(Ptr0 = \(strstr (.*)\)) != NULL/\1 != NULL/' "$efirom"
+fi
+if [[ $(git -C "$src" hash-object --no-filters "$efirom") != "$post" ]]; then
+    echo "$efirom is not edk2 9af06ef3cbb0's: delete $src" >&2
+    exit 1
+fi
 make -C "$src/BaseTools/Source/C" -j "$jobs"
 rm -rf -- "$work/host"
 "$here/fetch-packages.sh" "$here/host-packages" "$work/packages" "$work/host"
diff --git a/tests/qemu/check-shell-log.sh b/tests/qemu/check-shell-log.sh
index 43df3d3..cb104b3 100755
--- a/tests/qemu/check-shell-log.sh
+++ b/tests/qemu/check-shell-log.sh
@@ -19,14 +19,20 @@
 # The script, tests/qemu/shell/NAME.nsh, runs with echo -off and echoes
 # "uefisettings-shell: start" first, "uefisettings-shell: step STEP %lasterror%" after each
 # step and "uefisettings-shell: done" last: the output of a step is the console lines after
-# the marker before it. EXPECTATIONS, tests/qemu/shell/NAME.tsv, holds the checks, one per
-# line, in tab-separated columns:
+# the marker before it. The console lines before the start are those of the step firmware,
+# which has no status: what the firmware and the boot options that it starts before the Shell
+# print, also in the boots that a reset ended, in a rebooting-shell: boot of run.sh.
+# EXPECTATIONS, tests/qemu/shell/NAME.tsv, holds the checks, one per line, in tab-separated
+# columns:
 #   step       the step that the check reads
 #   check      status: the step's %lasterror% is the argument; "aborted" stands for
 #                EFI_ABORTED, which the shell shows as 0x15, and as 0x80000015 on i686, and
 #                "any" checks none, for a step that runs a command of the shell
 #              json: the step's output is one line, whose JSON the jq filter of the argument
 #                finds true
+#              json-line: one line of the step's output begins with "{", and the jq filter of
+#                the argument finds its JSON true; for a step whose other lines a fixture
+#                driver prints
 #              warned: the step's output is lines that start with "warning: ", at least one,
 #                which line checks read, and then one line of JSON, which the jq filter of the
 #                argument finds true
@@ -35,6 +41,8 @@
 #              line: a line of the step's output matches the extended regular expression of
 #                the argument
 #              none: no line of the step's output matches that expression
+#              count: the argument is "N REGEX"; exactly N lines of the step's output match
+#                the extended regular expression REGEX
 #              same: the step's output is that of the step that the argument names
 #              variable: the argument is "NAME STEP"; the step's output, that of the shell's
 #                set, has the line "NAME = VALUE", and VALUE is the one line of STEP's output
@@ -54,9 +62,12 @@
 #                output of the step OTHER matches the extended regular expression REGEX, or
 #                for unless-line, if none does, such as where the firmware lacks a protocol
 #                that dh lists
+#              firmware: the step's output is one line of JSON, and the jq filter of the
+#                argument finds it true with $firmware bound to the lines of the step
+#                firmware, such as its boot manager's "BdsDxe: loading Boot0002 ..."
 #   argument   what the check takes
-# Every step of the log needs a status check, and every step that a check names must be in
-# the log once.
+# Every step of the log but firmware needs a status check, and every step that a check names
+# must be in the log once.
 
 set -euo pipefail
 shopt -s nullglob
@@ -83,8 +94,15 @@ steps=$(mktemp -d)
 trap 'rm -r "$steps"' EXIT
 # The console has CRLF line ends and control sequences.
 if ! tr -d '\r' <"$console" | LC_ALL=C sed "s|$control_sequence||g" | awk -v steps="$steps" '
-    $0 == "uefisettings-shell: start" { started = 1; output = ""; next }
-    !started { next }
+    BEGIN { seen["firmware"] = 1 }
+    !started && $0 == "uefisettings-shell: start" {
+        started = 1
+        printf "%s", output > (steps "/firmware.out")
+        close(steps "/firmware.out")
+        output = ""
+        next
+    }
+    !started { output = output $0 "\n"; next }
     $0 == "uefisettings-shell: done" { done = 1; exit }
     /^uefisettings-shell: step / {
         if (NF != 4 || $3 !~ /^[a-z0-9-]+$/ || ($3 in seen)) {
@@ -147,6 +165,10 @@ check_step() {
     case $check in
     status)
         status_checked[$step]=1
+        if [[ $step == firmware ]]; then
+            fail "$step" "no status: it is the console before the script's start"
+            continue
+        fi
         want=$argument
         [[ $want != aborted ]] || want=$aborted
         got=$(<"$steps/$step.status")
@@ -158,6 +180,13 @@ check_step() {
             fail "$step" "not one line of JSON for which $argument holds"
         fi
         ;;
+    json-line)
+        json=$(grep -- '^{' "$out" || true)
+        if [[ -z $json || $(wc -l <<<"$json") != 1 ]] ||
+            ! jq --exit-status "$argument" <<<"$json" >/dev/null 2>&1; then
+            fail "$step" "not one line of JSON among its lines for which $argument holds"
+        fi
+        ;;
     warned)
         # the warnings of stderr, then the line of stdout
         if (($(wc -l <"$out") < 2)) || grep --quiet --invert-match '^warning: ' <(head -n -1 "$out") ||
@@ -174,6 +203,11 @@ check_step() {
         ;;
     line) grep --quiet --extended-regexp -- "$argument" "$out" || fail "$step" "no line matches $argument" ;;
     none) ! grep --quiet --extended-regexp -- "$argument" "$out" || fail "$step" "a line matches $argument" ;;
+    count)
+        read -r want regex <<<"$argument"
+        got=$(grep --count --extended-regexp -- "$regex" "$out" || true)
+        [[ $got == "$want" ]] || fail "$step" "$got lines, not $want, match $regex"
+        ;;
     same)
         [[ -f $steps/$argument.out ]] && cmp --quiet "$steps/$argument.out" "$out" ||
             fail "$step" "output differs from that of $argument"
@@ -223,6 +257,13 @@ check_step() {
         echo "check-shell-log: $step: $check $other $regex holds, so $inner $inner_argument"
         check_step "$step" "$inner" "$inner_argument"
         ;;
+    firmware)
+        if (($(wc -l <"$out") != 1)) ||
+            ! jq --exit-status --rawfile firmware "$steps/firmware.out" \
+                "(\$firmware | split(\"\\n\")) as \$firmware | $argument" <"$out" >/dev/null 2>&1; then
+            fail "$step" "not one line of JSON for which $argument holds with the firmware's lines"
+        fi
+        ;;
     *)
         echo "check-shell-log: unknown check $check of $step in $expectations" >&2
         exit 2
@@ -240,7 +281,8 @@ while IFS=$'\t' read -r step check argument || [[ -n $step ]]; do
 done <"$expectations"
 for out in "$steps"/*.out; do
     step=$(basename "$out" .out)
-    [[ -n ${status_checked[$step]:-} ]] || fail "$step" "no status check in $expectations"
+    [[ $step == firmware || -n ${status_checked[$step]:-} ]] ||
+        fail "$step" "no status check in $expectations"
 done
 if ((failures > 0)); then
     echo "check-shell-log: $failures checks FAILED"
diff --git a/tests/qemu/esp-disk.sfdisk b/tests/qemu/esp-disk.sfdisk
new file mode 100644
index 0000000..2f0498d
--- /dev/null
+++ b/tests/qemu/esp-disk.sfdisk
@@ -0,0 +1,11 @@
+# The partitions that run.sh makes with sfdisk on the 64 MiB disk image of devices=esp-disk.
+# The EFI system partition has 40 MiB, as busybox mkdosfs makes only FAT32, with 512-byte
+# clusters, which the firmware refuses with fewer than 65525 clusters (edk2-stable202608
+# FatPkg/EnhancedFatDxe/Init.c FatOpenDevice). It is GPT entry 2 but comes first on the disk, as
+# a Hard Drive node numbers a partition by its entry (UEFI 2.11 §10.3.5.1), not by its place.
+# src/lib/esp/sfdisk_images.rs holds what sfdisk writes of this script as QEMU_ESP_DISK.
+label: gpt
+label-id: 8C78A505-BAA0-4C4A-869F-000000001A0B
+first-lba: 34
+esp-disk.img1 : start=83968, size=32768, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, uuid=8C78A505-BAA0-4C4A-869F-000000001A08, name="data"
+esp-disk.img2 : start=2048, size=81920, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, uuid=8C78A505-BAA0-4C4A-869F-000000001A10, name="esp"
diff --git a/tests/qemu/guest-packages-aarch64 b/tests/qemu/guest-packages-aarch64
index 9612f86..b1e88fe 100644
--- a/tests/qemu/guest-packages-aarch64
+++ b/tests/qemu/guest-packages-aarch64
@@ -1,6 +1,7 @@
-# The kernel, firmware, UEFI Shell and busybox of the aarch64 guests, in the format of
-# fetch-packages.sh.
+# The kernel and its FAT modules, firmware, UEFI Shell and busybox of the aarch64 guests, in
+# the format of fetch-packages.sh.
 9328e61443dcd71e5671806fbef4345eb15a988229b011340fac8b856315c3ee https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/aarch64/os/Packages/k/kernel-core-6.17.1-300.fc43.aarch64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/43/Everything/aarch64/os/Packages/k/kernel-core-6.17.1-300.fc43.aarch64.rpm
+111dfaa667738538ec9b4e2b576110d548f3663f6378728937ae61f17dcea9d7 https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/aarch64/os/Packages/k/kernel-modules-core-6.17.1-300.fc43.aarch64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/43/Everything/aarch64/os/Packages/k/kernel-modules-core-6.17.1-300.fc43.aarch64.rpm
 fad8e80e929cd00dae8c5c8e5dd3ec85f37d9a832eea776957e5e2cf86ef2ab5 https://archive.ubuntu.com/ubuntu/pool/main/e/edk2/qemu-efi-aarch64_2024.02-2ubuntu0.10_all.deb https://launchpad.net/ubuntu/+archive/primary/+files/qemu-efi-aarch64_2024.02-2ubuntu0.10_all.deb
 d96535e0402c011e0ee43449799df2f4504d44b842e4f2b3a6cbc845508eaafc https://ports.ubuntu.com/ubuntu-ports/pool/main/b/busybox/busybox-static_1.36.1-6ubuntu3.1_arm64.deb https://launchpad.net/ubuntu/+archive/primary/+files/busybox-static_1.36.1-6ubuntu3.1_arm64.deb
 2cd676d4763a5fb5f7ced6f28f56d47459ffc46711d3d4f8f06313265f10ba75 https://archive.ubuntu.com/ubuntu/pool/universe/e/edk2/efi-shell-aa64_2024.02-2ubuntu0.10_all.deb https://launchpad.net/ubuntu/+archive/primary/+files/efi-shell-aa64_2024.02-2ubuntu0.10_all.deb
diff --git a/tests/qemu/guest-packages-x86_64 b/tests/qemu/guest-packages-x86_64
index fe5acd5..ab08839 100644
--- a/tests/qemu/guest-packages-x86_64
+++ b/tests/qemu/guest-packages-x86_64
@@ -1,6 +1,7 @@
-# The kernel, firmware, UEFI Shell and busybox of the x86_64 guests, in the format of
-# fetch-packages.sh.
+# The kernel and its FAT modules, firmware, UEFI Shell and busybox of the x86_64 guests, in
+# the format of fetch-packages.sh.
 ab1418c266e2b4b26090ab13e96c249a6bbe7a6fadca09c4e98c9ff477a5d58f https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/Packages/k/kernel-core-6.17.1-300.fc43.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/43/Everything/x86_64/os/Packages/k/kernel-core-6.17.1-300.fc43.x86_64.rpm
+57cfef94968d69a26f6a0a9831b3172687fc44802d1bde81530c030f630541db https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/Packages/k/kernel-modules-core-6.17.1-300.fc43.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/43/Everything/x86_64/os/Packages/k/kernel-modules-core-6.17.1-300.fc43.x86_64.rpm
 78a6a3a4ffa666f1cb25e9069e4ec9270b5ceac7987b6eefc2674bd3f58a1473 https://archive.ubuntu.com/ubuntu/pool/main/e/edk2/ovmf_2024.02-2ubuntu0.10_all.deb https://launchpad.net/ubuntu/+archive/primary/+files/ovmf_2024.02-2ubuntu0.10_all.deb
 944b2728f53ceb3916cec2c962873c9951e612408099601751db2a0a5d81e0ed https://archive.ubuntu.com/ubuntu/pool/main/b/busybox/busybox-static_1.36.1-6ubuntu3.1_amd64.deb https://launchpad.net/ubuntu/+archive/primary/+files/busybox-static_1.36.1-6ubuntu3.1_amd64.deb
 c4e85db2c02fc899754e7bbe9d46779035984b51290b8da14e38e5ee85279549 https://archive.ubuntu.com/ubuntu/pool/universe/e/edk2/efi-shell-x64_2024.02-2ubuntu0.10_all.deb https://launchpad.net/ubuntu/+archive/primary/+files/efi-shell-x64_2024.02-2ubuntu0.10_all.deb
diff --git a/tests/qemu/guest/Cargo.toml b/tests/qemu/guest/Cargo.toml
index c0eaf03..ce73a58 100644
--- a/tests/qemu/guest/Cargo.toml
+++ b/tests/qemu/guest/Cargo.toml
@@ -27,6 +27,10 @@ test-vm = []
 [lib]
 test = false
 
+[[test]]
+name = "boot_manager"
+required-features = ["test-vm"]
+
 [[test]]
 name = "boot_smoke"
 required-features = ["test-vm"]
@@ -107,10 +111,18 @@ required-features = ["test-vm"]
 name = "hii_name_value_password"
 required-features = ["test-vm"]
 
+[[test]]
+name = "hii_name_value_string"
+required-features = ["test-vm"]
+
 [[test]]
 name = "hii_storageless_password"
 required-features = ["test-vm"]
 
+[[test]]
+name = "hii_undeclared_password"
+required-features = ["test-vm"]
+
 [[test]]
 name = "hii_nested_password"
 required-features = ["test-vm"]
@@ -123,6 +135,10 @@ required-features = ["test-vm"]
 name = "hii_formset_skip"
 required-features = ["test-vm"]
 
+[[test]]
+name = "hii_form_set_disable_if"
+required-features = ["test-vm"]
+
 [[test]]
 name = "hii_short_var_store"
 required-features = ["test-vm"]
@@ -131,6 +147,10 @@ required-features = ["test-vm"]
 name = "secboot"
 required-features = ["test-vm"]
 
+[[test]]
+name = "staged_set"
+required-features = ["test-vm"]
+
 [[test]]
 name = "capsule"
 required-features = ["test-vm"]
diff --git a/tests/qemu/guest/tests/boot_manager.rs b/tests/qemu/guest/tests/boot_manager.rs
new file mode 100644
index 0000000..f897f4e
--- /dev/null
+++ b/tests/qemu/guest/tests/boot_manager.rs
@@ -0,0 +1,627 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The variables of the boot manager (src/lib/efi_variables/boot_manager.rs) in the scenario
+//! boot-manager, whose variable store tests/qemu/vars/boot-manager.json seeds with Boot0099, of
+//! a file that no ESP holds, with an undefined attribute bit and OptionalData, and Key0099,
+//! CTRL-q to Boot0099, and whose Driver0000 loads DriverSample.efi. `before_shell` checks that:
+//! - `variable get` shows them as their bytes tell;
+//! - `variable set-attributes` refuses PlatformRecovery####, OsRecovery####, an absent load
+//!   option and a flag both to set and to clear, writing nothing, and clears and sets Boot0099's
+//!   LOAD_OPTION_ACTIVE, changing only its Attributes and the BootOptionCrc of Key0099, which
+//!   follows it, and sets and clears Driver0000's LOAD_OPTION_FORCE_RECONNECT;
+//! - `variable create-load-option` refuses Boot0099, which exists, and creates Boot009A, to the
+//!   UEFI Shell, by text, which BootNext then names, and Boot009C of the same device path's bytes
+//!   and of OptionalData, both from files;
+//! - `variable set-device-path` sets ConOut to its own text, which keeps its bytes, and refuses
+//!   ConOutDev;
+//! - `variable create-key` refuses Key0099, which exists, an absent Boot#### and Key0099's own
+//!   shift states and keys, and creates Key009A, ALT-F11 to Boot0099.
+//!
+//! The UEFI Shell boots after it, shell/boot-manager.nsh through Boot009A and
+//! shell/boot-manager-next.nsh through Boot009B, which the first creates, do the same; their
+//! checks compare what uefisettings.efi prints with the lines "uefisettings-qemu-test: TAG JSON"
+//! of this test log, and with the lines of the firmware's boot manager that loaded them.
+//! `after_shell`, the last boot, reads what the Shell wrote.
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::io;
+use std::io::Write;
+
+use serde_json::json;
+use uefisettings_qemu_guest::changed_bytes;
+use uefisettings_qemu_guest::global_variable;
+use uefisettings_qemu_guest::json_error;
+use uefisettings_qemu_guest::require_test_vm;
+use uefisettings_qemu_guest::Output;
+use uefisettings_qemu_guest::EFIVARS;
+use uefisettings_qemu_guest::EFI_GLOBAL_VARIABLE;
+
+/// The refusals of set-attributes, by its arguments.
+const SET_ATTRIBUTES_REFUSALS: [(&[&str], &str); 4] = [
+    (
+        &["PlatformRecovery0000", "--set", "active"],
+        "set-attributes does not write PlatformRecovery0000: \"These variables are only modified \
+         by firmware and are read-only to the OS.\" (UEFI 2.11 section 3.3)",
+    ),
+    (
+        &["OsRecovery0000", "--set", "active"],
+        "set-attributes does not write OsRecovery0000, a Secure Boot Policy Variable: \"Secure \
+         Boot Policy Variables must be created using the EFI_VARIABLE_AUTHENTICATION_2 \
+         structure.\" (UEFI 2.11 section 3.3); variable write-signed writes a payload signed so",
+    ),
+    (&["Boot1234", "--set", "active"], "Boot1234 is absent"),
+    (
+        &["Boot0099", "--set", "active", "--clear", "active"],
+        "set-attributes cannot both set and clear active",
+    ),
+];
+/// What create-load-option prints for Boot0099, which exists.
+const BOOT0099_EXISTS: &str = "Boot0099 exists: create-load-option creates load options; \
+                               set-attributes changes the Attributes of one, and variable set \
+                               BootOrder its place in BootOrder";
+/// gUefiShellFileGuid, the FILE_GUID of the UEFI Shell (edk2-stable202608
+/// ShellPkg/Application/Shell/Shell.inf), and its bytes.
+const UEFI_SHELL_FILE_GUID: &str = "7C04A583-9E3E-4F1C-AD65-E05268D0B4D1";
+const UEFI_SHELL_FILE_GUID_BYTES: [u8; 16] = [
+    0x83, 0xA5, 0x04, 0x7C, 0x3E, 0x9E, 0x1C, 0x4F, 0xAD, 0x65, 0xE0, 0x52, 0x68, 0xD0, 0xB4, 0xD1,
+];
+/// The Description of Boot009A, which starts the UEFI Shell.
+const SHELL_AGAIN: &str = "uefisettings Shell";
+/// The OptionalData of Boot009C, bytes that no Description or text holds.
+const OPTIONAL_DATA: &[u8] = &[0x00, 0xFF, 0x7F, 0x80, 0x0A];
+/// What set-device-path prints for ConOutDev.
+const CON_OUT_DEV_REFUSAL: &str = "set-device-path does not write ConOutDev: \"These variables \
+                                   are volatile, and are set dynamically on every boot.\" (UEFI \
+                                   2.11 section 3.3)";
+/// The refusals of create-key, by its arguments.
+const CREATE_KEY_REFUSALS: [(&[&str], &str); 3] = [
+    (
+        &["Key0099", "--boot", "Boot0099", "--key", "F2"],
+        "Key0099 exists: create-key creates hot keys",
+    ),
+    (
+        &["Key009A", "--boot", "Boot1234", "--key", "F2"],
+        "Boot1234 is absent",
+    ),
+    (
+        &[
+            "Key009A",
+            "--boot",
+            "Boot0000",
+            "--modifiers",
+            "control",
+            "--key",
+            "q",
+        ],
+        "Key0099 holds these shift states and keys, and the boot manager takes it; it refuses \
+         another of the same",
+    ),
+];
+/// SCAN_F11 and SCAN_F12 (edk2-stable202608 MdePkg/Include/Protocol/SimpleTextIn.h)
+const SCAN_F11: u16 = 0x0015;
+const SCAN_F12: u16 = 0x0016;
+/// What set-attributes prints on stderr when it updates Key0099.
+const KEY0099_UPDATED: &str = "updated Key0099: its BootOptionCrc is the CRC-32 of the Boot#### \
+                               that it starts again (UEFI 2.11 section 3.1.6)";
+
+/// The output of `uefisettings variable` and `args`, whose standard output the test log records
+/// as "uefisettings-qemu-test: TAG JSON", written to stderr itself, which libtest does not
+/// capture, on a line of its own after libtest's "test ... ".
+#[track_caller]
+fn variable(tag: &str, args: &[&str]) -> Output {
+    let output = uefisettings_qemu_guest::uefisettings(&[&["variable"][..], args].concat());
+    writeln!(
+        io::stderr(),
+        "\nuefisettings-qemu-test: {tag} {}",
+        output.stdout.trim_end()
+    )
+    .expect("cannot write to stderr");
+    output
+}
+
+/// What `variable get` prints of `name`, recorded as `tag`.
+#[track_caller]
+fn get(tag: &str, name: &str) -> serde_json::Value {
+    variable(tag, &["get", name]).json(0)
+}
+
+/// What `variable set-attributes` and `args`, which must succeed, print on stdout, recorded as
+/// `tag`, and on stderr.
+#[track_caller]
+fn set_attributes(tag: &str, args: &[&str]) -> (serde_json::Value, String) {
+    let output = variable(tag, &[&["set-attributes"][..], args].concat());
+    (output.json(0), output.stderr)
+}
+
+/// The bytes of each efivar file, by name.
+#[track_caller]
+fn efivars() -> BTreeMap<String, Vec<u8>> {
+    fs::read_dir(EFIVARS)
+        .expect("cannot list the efivars")
+        .map(|entry| {
+            let path = entry.expect("cannot list the efivars").path();
+            let bytes = fs::read(&path)
+                .unwrap_or_else(|error| panic!("cannot read {}: {error}", path.display()));
+            let name = path.file_name().expect("an efivar file").to_string_lossy();
+            (name.into_owned(), bytes)
+        })
+        .collect()
+}
+
+/// What `variable create-load-option` and `args`, which must succeed, print on stdout, recorded
+/// as `tag`, and on stderr.
+#[track_caller]
+fn create_load_option(tag: &str, args: &[&str]) -> (serde_json::Value, String) {
+    let output = variable(tag, &[&["create-load-option"][..], args].concat());
+    (output.json(0), output.stderr)
+}
+
+/// The FilePathList and OptionalData of `option`, an EFI_LOAD_OPTION (UEFI 2.11 §3.1.3).
+#[track_caller]
+fn load_option_parts(option: &[u8]) -> (&[u8], &[u8]) {
+    let length = usize::from(u16::from_le_bytes([option[4], option[5]]));
+    let description = option[6..]
+        .chunks_exact(2)
+        .position(|unit| unit == [0, 0])
+        .expect("a Null-terminated Description");
+    option[6 + 2 * (description + 1)..].split_at(length)
+}
+
+/// The EFI_LOAD_OPTION of `attributes`, `description`, `file_paths` and `optional_data`.
+fn load_option(
+    attributes: u32,
+    description: &str,
+    file_paths: &[u8],
+    optional_data: &[u8],
+) -> Vec<u8> {
+    let description: Vec<u8> = description
+        .encode_utf16()
+        .chain([0])
+        .flat_map(u16::to_le_bytes)
+        .collect();
+    let length = u16::try_from(file_paths.len()).expect("a short FilePathList");
+    [
+        &attributes.to_le_bytes()[..],
+        &length.to_le_bytes(),
+        &description,
+        file_paths,
+        optional_data,
+    ]
+    .concat()
+}
+
+/// The EFI_KEY_OPTION of KeyData `key_data`, whose BootOptionCrc is the CRC-32 of the global
+/// variable `boot` as efivarfs holds it, to its number `boot_option`, of `keys`.
+#[track_caller]
+fn hot_key_bytes(key_data: u32, boot: &str, boot_option: u16, keys: &[(u16, u16)]) -> Vec<u8> {
+    let mut bytes = [
+        &key_data.to_le_bytes()[..],
+        &crc32fast::hash(&data(boot)).to_le_bytes(),
+        &boot_option.to_le_bytes(),
+    ]
+    .concat();
+    for (scan_code, unicode_char) in keys {
+        bytes.extend(scan_code.to_le_bytes());
+        bytes.extend(unicode_char.to_le_bytes());
+    }
+    bytes
+}
+
+/// The instances of `path`, a device path, each without the End node that ends it.
+#[track_caller]
+fn instances(path: &[u8]) -> Vec<Vec<u8>> {
+    let mut instances = vec![Vec::new()];
+    let mut rest = path;
+    while let [node_type, _, low, high, ..] = *rest {
+        let length = usize::from(u16::from_le_bytes([low, high]));
+        let (node, after) = rest.split_at(length);
+        match node_type {
+            0x7F => instances.push(Vec::new()),
+            _ => instances.last_mut().expect("an instance").extend(node),
+        }
+        rest = after;
+    }
+    instances.pop();
+    instances
+}
+
+/// The data of the global variable `name`, which must exist.
+#[track_caller]
+fn data(name: &str) -> Vec<u8> {
+    global_variable(name).unwrap_or_else(|| panic!("{name} is absent"))
+}
+
+/// The global variable `name` of `value`, with NV+BS+RT, as get prints it.
+fn global(name: &str, value: serde_json::Value) -> serde_json::Value {
+    json!({
+        "variable": format!("{name}-{EFI_GLOBAL_VARIABLE}"),
+        "attributes": 7,
+        "value": value,
+    })
+}
+
+/// Boot0099 as tests/qemu/vars/boot-manager.json seeds it, with `attributes`.
+fn seeded_boot0099(attributes: serde_json::Value) -> serde_json::Value {
+    global(
+        "Boot0099",
+        json!({
+            "attributes": attributes,
+            "category": "boot",
+            "description": "file missing-99.efi",
+            "device_paths": ["\\missing-99.efi"],
+            "optional_data": "7565666973657474696e6773",
+        }),
+    )
+}
+
+/// Key0099 as tests/qemu/vars/boot-manager.json seeds it, whose BootOptionCrc matches Boot0099.
+fn seeded_key0099() -> serde_json::Value {
+    global(
+        "Key0099",
+        json!({
+            "revision": 0,
+            "modifiers": ["control"],
+            "keys": ["q"],
+            "boot_option": "Boot0099",
+            "crc_matches": true,
+        }),
+    )
+}
+
+#[test]
+fn before_shell() {
+    require_test_vm();
+
+    assert_eq!(
+        get("seeded-boot0099", "Boot0099"),
+        seeded_boot0099(json!(["active", "0x40000000"])),
+        "Boot0099"
+    );
+    assert_eq!(
+        get("seeded-key0099", "Key0099"),
+        seeded_key0099(),
+        "Key0099"
+    );
+
+    let before = efivars();
+    for (args, refusal) in SET_ATTRIBUTES_REFUSALS {
+        let error = json_error(&[&["variable", "set-attributes"][..], args].concat());
+
+        assert_eq!(error.error_message, refusal, "{args:?}");
+        assert_eq!(efivars(), before, "{args:?}: the efivar files");
+    }
+
+    // Boot0099 inactive: only LOAD_OPTION_ACTIVE changes, and Key0099 follows it
+    let (boot, key) = (data("Boot0099"), data("Key0099"));
+    let (inactive, notes) = set_attributes("inactive-boot0099", &["Boot0099", "--clear", "active"]);
+
+    let (inactive_boot, inactive_key) = (data("Boot0099"), data("Key0099"));
+    assert_eq!(
+        inactive,
+        seeded_boot0099(json!(["0x40000000"])),
+        "inactive Boot0099"
+    );
+    assert_eq!(
+        notes.trim_end(),
+        KEY0099_UPDATED,
+        "inactive Boot0099: stderr"
+    );
+    assert_eq!(
+        changed_bytes(&boot, &inactive_boot),
+        [(0, 0)],
+        "inactive Boot0099: bytes"
+    );
+    assert_eq!(
+        inactive_key[4..8],
+        crc32fast::hash(&inactive_boot).to_le_bytes(),
+        "Key0099: BootOptionCrc"
+    );
+    assert!(
+        changed_bytes(&key, &inactive_key)
+            .iter()
+            .all(|(offset, _)| (4..8).contains(offset)),
+        "Key0099: bytes but BootOptionCrc changed: {key:02x?} {inactive_key:02x?}"
+    );
+    assert_eq!(
+        get("inactive-key0099", "Key0099"),
+        seeded_key0099(),
+        "inactive Key0099"
+    );
+    let mut kept = efivars();
+    for name in ["Boot0099", "Key0099"] {
+        let file = format!("{name}-{EFI_GLOBAL_VARIABLE}");
+        kept.insert(file.clone(), before[&file].clone());
+    }
+    assert_eq!(kept, before, "the other efivar files");
+
+    let (active, notes) = set_attributes("active-boot0099", &["Boot0099", "--set", "active"]);
+
+    assert_eq!(
+        active,
+        seeded_boot0099(json!(["active", "0x40000000"])),
+        "active Boot0099"
+    );
+    assert_eq!(notes.trim_end(), KEY0099_UPDATED, "active Boot0099: stderr");
+    assert_eq!(
+        (data("Boot0099"), data("Key0099")),
+        (boot, key),
+        "Boot0099 and Key0099 again"
+    );
+
+    // Driver0000 with LOAD_OPTION_FORCE_RECONNECT, and without it again
+    let driver = data("Driver0000");
+    let (reconnect, notes) = set_attributes(
+        "driver-force-reconnect",
+        &["Driver0000", "--set", "force-reconnect"],
+    );
+
+    assert_eq!(
+        reconnect["value"]["attributes"],
+        json!(["active", "force-reconnect"]),
+        "Driver0000 with LOAD_OPTION_FORCE_RECONNECT"
+    );
+    assert_eq!(notes, "", "Driver0000: stderr");
+    assert_eq!(
+        changed_bytes(&driver, &data("Driver0000")),
+        [(0, 0x03)],
+        "Driver0000 with LOAD_OPTION_FORCE_RECONNECT: bytes"
+    );
+    let (cleared, _) = set_attributes(
+        "driver-reconnect-cleared",
+        &["Driver0000", "--clear", "force-reconnect"],
+    );
+    assert_eq!(
+        cleared["value"]["attributes"],
+        json!(["active"]),
+        "Driver0000 without LOAD_OPTION_FORCE_RECONNECT"
+    );
+    assert_eq!(data("Driver0000"), driver, "Driver0000 again");
+
+    // create-load-option: refused over Boot0099, then Boot009A to the UEFI Shell, which BootNext
+    // names, and Boot009C of its device path's bytes and OptionalData from files
+    let before = efivars();
+    let error = json_error(&[
+        "variable",
+        "create-load-option",
+        "Boot0099",
+        "--description",
+        "again",
+        "--device-path",
+        "\\missing-99.efi",
+    ]);
+    assert_eq!(error.error_message, BOOT0099_EXISTS, "create Boot0099");
+    assert_eq!(efivars(), before, "create Boot0099: the efivar files");
+
+    // the firmware creates the Shell's Boot#### only on a boot without a kernel, after this one
+    // (edk2-stable202608 OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c:1666-1695), so the
+    // Shell's device path is that of Boot0000, UiApp, of the same firmware volume, with the
+    // Shell's FvFile
+    let ui_app = get("boot0000", "Boot0000");
+    let ui_app_path = ui_app["value"]["device_paths"][0]
+        .as_str()
+        .unwrap_or_else(|| panic!("Boot0000: {ui_app}"));
+    let (volume, _) = ui_app_path
+        .split_once("/FvFile(")
+        .unwrap_or_else(|| panic!("Boot0000 is no FvFile: {ui_app_path}"));
+    let shell_path = format!("{volume}/FvFile({UEFI_SHELL_FILE_GUID})");
+    let (created, warnings) = create_load_option(
+        "created-boot009a",
+        &[
+            "Boot009A",
+            "--description",
+            SHELL_AGAIN,
+            "--device-path",
+            &shell_path,
+        ],
+    );
+    let ui_app_option = data("Boot0000");
+    let (ui_app_file_paths, _) = load_option_parts(&ui_app_option);
+    // Fv(), of the Length that its bytes 2-3 hold, then the Type, Sub-Type and Length of
+    // FvFile(), then its GUID
+    let guid_at = usize::from(u16::from_le_bytes([
+        ui_app_file_paths[2],
+        ui_app_file_paths[3],
+    ])) + 4;
+    let shell_file_paths = [
+        &ui_app_file_paths[..guid_at],
+        &UEFI_SHELL_FILE_GUID_BYTES,
+        &ui_app_file_paths[guid_at + UEFI_SHELL_FILE_GUID_BYTES.len()..],
+    ]
+    .concat();
+    let shell_file_paths = shell_file_paths.as_slice();
+    assert_eq!(
+        data("Boot009A"),
+        load_option(1, SHELL_AGAIN, shell_file_paths, &[]),
+        "Boot009A: bytes"
+    );
+    assert_eq!(
+        created,
+        global(
+            "Boot009A",
+            json!({
+                "attributes": ["active"],
+                "category": "boot",
+                "description": SHELL_AGAIN,
+                "device_paths": [shell_path],
+                "optional_data": "",
+            })
+        ),
+        "Boot009A"
+    );
+    assert_eq!(warnings, "", "Boot009A: stderr");
+
+    let path_file = "/tmp/shell-path.bin";
+    let optional_file = "/tmp/optional-data.bin";
+    fs::write(path_file, shell_file_paths).expect("write the device path file");
+    fs::write(optional_file, OPTIONAL_DATA).expect("write the OptionalData file");
+    let (created, _) = create_load_option(
+        "created-boot009c",
+        &[
+            "Boot009C",
+            "--description",
+            "from files",
+            "--device-path-file",
+            path_file,
+            "--optional-data-file",
+            optional_file,
+            "--flags",
+            "hidden",
+            "--category",
+            "app",
+        ],
+    );
+    assert_eq!(
+        data("Boot009C"),
+        load_option(0x108, "from files", shell_file_paths, OPTIONAL_DATA),
+        "Boot009C: bytes"
+    );
+    assert_eq!(
+        created["value"]["device_paths"],
+        json!([shell_path]),
+        "Boot009C"
+    );
+
+    let written =
+        variable("boot-next", &["set", "BootNext", "Boot009A"]).json::<serde_json::Value>(0);
+    assert_eq!(written, global("BootNext", json!("Boot009A")), "BootNext");
+
+    // set-device-path: ConOut set to its own text keeps its bytes; ConOutDev is refused
+    let con_out = data("ConOut");
+    let text = get("con-out", "ConOut")["value"]
+        .as_str()
+        .unwrap_or_else(|| panic!("ConOut has no text"))
+        .to_owned();
+    let output = variable(
+        "con-out-set",
+        &["set-device-path", "ConOut", "--device-path", &text],
+    );
+    let set: serde_json::Value = output.json(0);
+    assert_eq!(
+        set,
+        global("ConOut", json!(text)),
+        "ConOut set to its own text"
+    );
+    assert_eq!(data("ConOut"), con_out, "ConOut: bytes");
+    let known = instances(&data("ConOutDev"));
+    let lacking = instances(&con_out)
+        .into_iter()
+        .filter(|instance| !known.contains(instance))
+        .count();
+    assert_eq!(
+        output
+            .stderr
+            .lines()
+            .filter(|line| line.starts_with("warning: ConOutDev lacks the instance "))
+            .count(),
+        lacking,
+        "ConOut: warnings: {}",
+        output.stderr
+    );
+    let before = efivars();
+    let error = json_error(&[
+        "variable",
+        "set-device-path",
+        "ConOutDev",
+        "--device-path",
+        &text,
+    ]);
+    assert_eq!(error.error_message, CON_OUT_DEV_REFUSAL, "set ConOutDev");
+    assert_eq!(efivars(), before, "set ConOutDev: the efivar files");
+
+    // create-key: refused over Key0099, for an absent Boot####, and for Key0099's own keys, which
+    // the boot manager takes; then Key009A, ALT-F11 to Boot0099
+    for (args, refusal) in CREATE_KEY_REFUSALS {
+        let error = json_error(&[&["variable", "create-key"][..], args].concat());
+
+        assert_eq!(error.error_message, refusal, "{args:?}");
+        assert_eq!(efivars(), before, "{args:?}: the efivar files");
+    }
+    let created = variable(
+        "created-key009a",
+        &[
+            "create-key",
+            "Key009A",
+            "--boot",
+            "Boot0099",
+            "--modifiers",
+            "alt",
+            "--key",
+            "F11",
+        ],
+    )
+    .json::<serde_json::Value>(0);
+    assert_eq!(
+        data("Key009A"),
+        hot_key_bytes(0x4000_0400, "Boot0099", 0x99, &[(SCAN_F11, 0)]),
+        "Key009A: bytes"
+    );
+    assert_eq!(
+        created,
+        global(
+            "Key009A",
+            json!({
+                "revision": 0,
+                "modifiers": ["alt"],
+                "keys": ["F11"],
+                "boot_option": "Boot0099",
+                "crc_matches": true,
+            })
+        ),
+        "Key009A"
+    );
+    assert_eq!(get("key009a", "Key009A"), created, "get Key009A");
+}
+
+/// After the UEFI Shell boots, the first through Boot009A, which BootNext named, the second
+/// through Boot009B, which the first created and BootNext named: the Shell's writes outlast the
+/// resets, BootNext is gone, and Boot0099 and Key0099 are as seeded again.
+#[test]
+fn after_shell() {
+    require_test_vm();
+
+    let file_path: Vec<u8> = "\\uefisettings.efi"
+        .encode_utf16()
+        .chain([0])
+        .flat_map(u16::to_le_bytes)
+        .collect();
+    let length = u16::try_from(4 + file_path.len()).expect("a short node");
+    let path = [
+        &[0x04, 0x04][..],
+        &length.to_le_bytes(),
+        &file_path,
+        &[0x7F, 0xFF, 0x04, 0x00],
+    ]
+    .concat();
+    assert_eq!(
+        data("Boot009B"),
+        load_option(1, "uefisettings again", &path, &[]),
+        "Boot009B: bytes"
+    );
+    assert_eq!(global_variable("BootNext"), None, "BootNext is gone");
+    assert_eq!(
+        get("after-boot0099", "Boot0099"),
+        seeded_boot0099(json!(["active", "0x40000000"])),
+        "Boot0099"
+    );
+    assert_eq!(get("after-key0099", "Key0099"), seeded_key0099(), "Key0099");
+    assert_eq!(
+        data("Key009B"),
+        hot_key_bytes(0x4000_0100, "Boot009B", 0x9B, &[(SCAN_F12, 0)]),
+        "Key009B: bytes"
+    );
+    for name in ["Key009A", "Key009B"] {
+        let key = get(&format!("after-{name}"), name);
+        assert_eq!(key["value"]["crc_matches"], json!(true), "{name}: {key}");
+    }
+}
diff --git a/tests/qemu/guest/tests/global_variables.rs b/tests/qemu/guest/tests/global_variables.rs
index 7425506..236a156 100644
--- a/tests/qemu/guest/tests/global_variables.rs
+++ b/tests/qemu/guest/tests/global_variables.rs
@@ -12,7 +12,8 @@
 
 //! `variable get` of the global variables (src/lib/efi_variables/globals.rs), which reads them
 //! through efivarfs: `get_default_firmware` in variable-get, on the default firmware, whose
-//! variable store holds no Secure Boot variables, and `get_secboot_setup` and `get_secboot_user`
+//! variable store holds no Secure Boot variables, and its load options, hot keys and ConOut
+//! (src/lib/efi_variables/boot_manager.rs), and `get_secboot_setup` and `get_secboot_user`
 //! in variable-get-secboot-setup and variable-get-secboot-user, on the secboot firmware in Setup
 //! Mode and, with run.sh's PK, KEK and db enrolled, in User Mode, and `get_devdb` in
 //! variable-get-devdb, on the default firmware with the devdb that tests/qemu/vars/devdb.json
@@ -238,13 +239,79 @@ fn get_default_firmware() {
         assert_absent_global(name, EFI_GLOBAL_VARIABLE);
     }
     assert_absent_global("db", EFI_IMAGE_SECURITY_DATABASE);
+    for option in boot_order() {
+        assert_load_option(&option);
+    }
+    for (name, key) in [("Key0000", "F2"), ("Key0001", "ESC")] {
+        assert_global(name, NV_BS_RT, |_| {
+            serde_json::json!({
+                "revision": 0,
+                "modifiers": [],
+                "keys": [key],
+                "boot_option": "Boot0000",
+                "crc_matches": true,
+            })
+        });
+    }
+    let con_out = get("ConOut").value.expect("ConOut is present");
+    assert!(
+        con_out
+            .as_str()
+            .is_some_and(|text| text.contains("/Uart(115200,8,N,1)/")),
+        "ConOut: {con_out}"
+    );
+
+    let error = json_error(&["variable", "get", "Boot001"]);
+
+    assert!(
+        error.error_message.contains("variable info Boot001 GUID"),
+        "Boot001: {error:?}"
+    );
+}
 
-    let error = json_error(&["variable", "get", "Boot0000"]);
+/// get shows the load option `name` as its EFI_LOAD_OPTION in efivarfs tells (UEFI 2.11
+/// §3.1.3): its Description and OptionalData, and each device path of its FilePathList as
+/// text; that of OVMF's UEFI Shell, as the FvFile of the Shell's FILE_GUID.
+#[track_caller]
+fn assert_load_option(name: &str) {
+    let (attributes, data) = efivar(name, EFI_GLOBAL_VARIABLE);
+    let (header, rest) = data.split_at(6);
+    let file_path_list_length = usize::from(uint16(&header[4..]));
+    let units: Vec<u16> = rest
+        .chunks_exact(2)
+        .map(uint16)
+        .take_while(|unit| *unit != 0)
+        .collect();
+    let description = String::from_utf16(&units).expect("a UCS-2 Description");
+    let optional_data: String = rest[(units.len() + 1) * 2 + file_path_list_length..]
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect();
+    let value = get(name)
+        .value
+        .unwrap_or_else(|| panic!("{name} is absent"));
 
+    assert_eq!(attributes, NV_BS_RT, "{name}: attributes in efivarfs");
+    assert_eq!(value["description"], description, "{name}: Description");
+    assert_eq!(
+        value["optional_data"], optional_data,
+        "{name}: OptionalData"
+    );
+    let paths = value["device_paths"]
+        .as_array()
+        .unwrap_or_else(|| panic!("{name}: {value}"));
     assert!(
-        error.error_message.contains("variable info Boot0000 GUID"),
-        "Boot0000: {error:?}"
+        !paths.is_empty() && paths.iter().all(serde_json::Value::is_string),
+        "{name}: device paths of no text: {value}"
     );
+    if description == "EFI Internal Shell" {
+        assert!(
+            paths[0]
+                .as_str()
+                .is_some_and(|text| text.ends_with("/FvFile(7C04A583-9E3E-4F1C-AD65-E05268D0B4D1)")),
+            "{name}: {value}"
+        );
+    }
 }
 
 /// get decodes devdb, the authenticated variable of EFI_DEVICE_SECURITY_DATABASE_GUID, refuses
diff --git a/tests/qemu/guest/tests/hii.rs b/tests/qemu/guest/tests/hii.rs
index ea63c3e..b5dc6ed 100644
--- a/tests/qemu/guest/tests/hii.rs
+++ b/tests/qemu/guest/tests/hii.rs
@@ -375,6 +375,116 @@ fn list_questions_lists_ordered_lists_with_their_items() {
     );
 }
 
+/// The efivar file of DriverSample's MyIfrNVData, as --assume-var-store names it.
+const MY_IFR_NV_DATA: &str = "MyIfrNVData-a04a27f4-df00-4d42-b552-39511302113d";
+/// The byte of SuppressGrayOutSomething in MyIfrNVData (NVDataStruc.h, edk2-stable202608), which
+/// the one-of "My one-of prompt #1" holds, 2 as DriverSample stores it.
+const SUPPRESS_GRAY_OUT_SOMETHING_OFFSET: usize = 93;
+
+/// Stating 00 for SuppressGrayOutSomething, which DriverSample holds as 2, changes the states that
+/// list-questions lists: "Pick 1", which a DISABLE_IF on 2 disables, shows without --include, and
+/// "Boot Order", which a SUPPRESS_IF on 0 hides, does not; the variable and the one-of on that
+/// byte keep 2.
+#[test]
+fn list_questions_reads_stated_var_store_bytes() {
+    let before = variable_data(DRIVER_SAMPLE_VARIABLE).expect("the variable does not exist");
+    assert_eq!(
+        before[SUPPRESS_GRAY_OUT_SOMETHING_OFFSET], 2,
+        "DriverSample stores 2"
+    );
+    let listed = |flags: &[&str]| -> Vec<Question> {
+        json(&[&["hii", "list-questions", "--json"][..], flags].concat())
+    };
+    let names = |questions: &[Question]| -> Vec<String> {
+        questions
+            .iter()
+            .filter(|question| question.items.is_some())
+            .map(|question| question.name.clone())
+            .collect()
+    };
+    // MyOneOf, the first question of that prompt
+    let one_of = |questions: &[Question]| -> Option<String> {
+        questions
+            .iter()
+            .find(|question| question.name == ONE_OF_PROMPT)
+            .map(|question| question.answer.clone())
+    };
+    let statement = format!("{MY_IFR_NV_DATA}+{SUPPRESS_GRAY_OUT_SOMETHING_OFFSET}=00");
+    let stored = listed(&[]);
+    let stated = listed(&["--assume-var-store", &statement]);
+    assert_eq!(
+        names(&stored),
+        [BOOT_ORDER, "Get Call Back default"],
+        "the ordered lists as DriverSample stores 2"
+    );
+    assert_eq!(
+        names(&stated),
+        [PICK_1, "Get Call Back default"],
+        "the ordered lists with 00 stated"
+    );
+    assert_eq!(one_of(&stated), one_of(&stored), "the answer of MyOneOf");
+    assert!(one_of(&stored).is_some(), "MyOneOf listed");
+    assert_eq!(
+        variable_data(DRIVER_SAMPLE_VARIABLE),
+        Some(before),
+        "MyIfrNVData unchanged"
+    );
+}
+
+/// The "BIT numeric" on DriverSample's MyEfiBitVar, which lacks runtime access, is grayed out
+/// while its bit field EfiBitGrayoutTest is 0 (Vfr.vfr, edk2-stable202608): from Linux that is
+/// undetermined, naming the flag that states the byte of the field; stated bytes decide it, and
+/// its answer stays the reason why it has no value.
+#[test]
+fn a_stated_bit_field_decides_a_condition() {
+    let efi_bit_numeric = |flags: &[&str]| -> Vec<String> {
+        let questions: Vec<Question> = json(
+            &[
+                &["hii", "list-questions", "--json"][..],
+                &INCLUDE_GRAYED_OUT,
+                flags,
+            ]
+            .concat(),
+        );
+        questions
+            .into_iter()
+            .filter(|question| {
+                question.name == "BIT numeric" && question.answer.contains("MyEfiBitVar")
+            })
+            .map(|question| question.answer)
+            .collect()
+    };
+    let unread =
+        "<ValueUnavailable: EFI variable MyEfiBitVar-a04a27f4-df00-4d42-b552-39511302113d \
+                  is not present at OS runtime: efivarfs does not list it, and its form declares \
+                  it boot-service-only (no EFI_VARIABLE_RUNTIME_ACCESS)> <IFR default: 4>";
+    let [undetermined] = <[String; 1]>::try_from(efi_bit_numeric(&[]))
+        .unwrap_or_else(|got| panic!("one BIT numeric on MyEfiBitVar: {got:?}"));
+    assert!(
+        undetermined.starts_with(&format!("{unread} <selectable or grayed-out: ")),
+        "{undetermined}"
+    );
+    assert!(
+        undetermined.ends_with(
+            "; --assume-var-store MyEfiBitVar-a04a27f4-df00-4d42-b552-39511302113d+4=<HEX of 1 \
+             byte> states it>>"
+        ),
+        "{undetermined}"
+    );
+    let stated = |byte: &str| {
+        efi_bit_numeric(&[
+            "--assume-var-store",
+            &format!("MyEfiBitVar-a04a27f4-df00-4d42-b552-39511302113d+4={byte}"),
+        ])
+    };
+    assert_eq!(
+        stated("e0"),
+        [format!("{unread} <grayed-out>")],
+        "EfiBitGrayoutTest 0"
+    );
+    assert_eq!(stated("01"), [unread.to_string()], "EfiBitGrayoutTest 1");
+}
+
 /// get shows the EFI_HII_REF that DriverSample's cross-reference question UPDATE_DEST holds at
 /// RefData of its variable: its QuestionId, FormId and FormSetGuid, and its DevicePath, none for
 /// string 0, else the text of that string, quoted. A SUPPRESS_IF hides its form.
diff --git a/tests/qemu/guest/tests/hii_auth87.rs b/tests/qemu/guest/tests/hii_auth87.rs
index a287553..4c9a348 100644
--- a/tests/qemu/guest/tests/hii_auth87.rs
+++ b/tests/qemu/guest/tests/hii_auth87.rs
@@ -17,8 +17,10 @@
 //! EFI_VARIABLE_AUTHENTICATION_3 metadata (UEFI 2.11 §8.2.1). `get` reads the variables whole
 //! from efivarfs, decodes the value behind the metadata of EnhancedAuthData and names the check
 //! that refuses that of EnhancedAuthRefused, as shell/auth87.tsv checks in the UEFI Shell; `set`
-//! refuses both and changes neither variable.
+//! refuses both and changes neither variable. `variable info` shows the metadata of
+//! EnhancedAuthData, and that of EnhancedAuthRefused as the check that refuses it.
 
+use uefisettings_qemu_guest::json;
 use uefisettings_qemu_guest::json_error;
 use uefisettings_qemu_guest::single_response;
 use uefisettings_qemu_guest::variable_bytes;
@@ -104,3 +106,40 @@ fn set_refuses_enhanced_authenticated_variables() {
         }
     }
 }
+
+#[test]
+fn variable_info_shows_the_metadata() {
+    let cert_id: String = (0..32u8).map(|byte| format!("{byte:02x}")).collect();
+    for (variable, metadata) in [
+        (
+            ACCEPTED,
+            serde_json::json!({
+                "version": 1,
+                "type": 1,
+                "metadata_size": 68,
+                "flags": 0,
+                "time_stamp": "2026-11-06T12:00:00Z",
+                "cert_id": {"type": 1, "id": {"hex": cert_id}},
+            }),
+        ),
+        (
+            REFUSED,
+            serde_json::json!({"refused": "EFI_VARIABLE_AUTHENTICATION_3 Version 2, not 1"}),
+        ),
+    ] {
+        seeded(variable);
+
+        let info: serde_json::Value = json(&["variable", "info", variable, VENDOR]);
+
+        assert_eq!(
+            info,
+            serde_json::json!({
+                "variable": format!("{variable}-{VENDOR}"),
+                "attributes": ATTRIBUTES,
+                "size": SIZE,
+                "metadata": metadata,
+            }),
+            "{variable}"
+        );
+    }
+}
diff --git a/tests/qemu/guest/tests/hii_form_set_disable_if.rs b/tests/qemu/guest/tests/hii_form_set_disable_if.rs
new file mode 100644
index 0000000..175f98e
--- /dev/null
+++ b/tests/qemu/guest/tests/hii_form_set_disable_if.rs
@@ -0,0 +1,331 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The boot of the scenario hii-form-set-disable-if: publish-hiidb's `form-set-disable-if-forms`
+//! registers the forms of `publish-hiidb/src/form_set_disable_if_forms.rs`, and `rt-data`
+//! publishes the HII database after it; vars/form-set-disable-if.json creates
+//! UefisettingsFormSetDisableIf. UEFI 2.11 §33.3.8.3.14 has a Forms Processor not process a form
+//! under a true DISABLE_IF outside forms, so Hidden and the PASSWORD there are no questions: no
+//! --include lists, gets or sets them, and Shown, in a SUPPRESS_IF on Hidden, which holds 1, is
+//! not suppressed, while the keyword HiddenKeyword selects Hidden as a disabled question. The
+//! PASSWORD's bytes stay withheld: O, over them, shows none, set writes none, and dump-efivars
+//! keeps none, while it keeps Hidden's byte, which the keyword reads. Whether a Forms Processor
+//! processes After, under a DISABLE_IF on Gate, or Later, after a true SUPPRESS_IF in a DISABLE_IF
+//! outside forms, is not known, so get shows both states and why, and set writes them only with
+//! disabled questions included.
+
+use std::fs;
+
+use serde::Deserialize;
+use uefisettings_qemu_guest::changed_bytes;
+use uefisettings_qemu_guest::uefisettings_with_env;
+use uefisettings_qemu_guest::variable_data;
+use uefisettings_qemu_guest::Output;
+use uefisettings_qemu_guest::EFIVARFS_HEADER_SIZE;
+use uefisettings_qemu_guest::PREFIXES;
+use uefisettings_qemu_guest::UNSAFE_OPERATIONS;
+
+/// The efivarfs file of UefisettingsFormSetDisableIf.
+const STORE: &str =
+    "/sys/firmware/efi/efivars/UefisettingsFormSetDisableIf-8c78a505-baa0-4c4a-869f-000000002401";
+/// The FormSet of the fixture, which list-questions names for each question.
+const FORM_SET: &str = "8C78A505-BAA0-4C4A-869F-000000002400";
+/// The bytes that tests/qemu/vars/form-set-disable-if.json creates UefisettingsFormSetDisableIf
+/// with: Gate, Hidden, Shown, After and Later, 3 bytes that no question holds, then the password.
+const STORE_DATA: [u8; 24] = [
+    0, 1, 2, 3, 4, 0, 0, 0, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB,
+    0xBB, 0xBB, 0xBB, 0xBB,
+];
+/// The byte of UefisettingsFormSetDisableIf that Hidden holds.
+const HIDDEN_OFFSET: usize = 1;
+/// The bytes of UefisettingsFormSetDisableIf that the PASSWORD holds.
+const PASSWORD_BYTES: std::ops::Range<usize> = 8..24;
+/// What shows a byte of the password, 0xBB.
+const PASSWORD_TEXTS: [&str; 5] = ["bb bb", "BB BB", "bbbb", "BBBB", "187, 187"];
+/// The questions that list-questions lists in the FormSet, in order, with every --include.
+const LISTED: [&str; 5] = ["Gate", "Shown", "O", "After", "Later"];
+/// The --include arguments: none, each state, and all of them.
+const INCLUDES: [&[&str]; 5] = [
+    &[],
+    &["--include", "grayed-out"],
+    &["--include", "suppressed"],
+    &["--include", "disabled"],
+    &["--include", "grayed-out,suppressed,disabled"],
+];
+/// The --include argument that selects a disabled question.
+const INCLUDE_DISABLED: [&str; 2] = ["--include", "disabled"];
+/// Why a Forms Processor may not process After: the condition of its DISABLE_IF.
+const NOT_CONSTANT: &str = "it relies on EFI_IFR_EQ_ID_VAL, where a DISABLE_IF outside forms \
+     must only rely on constants (UEFI 2.11 §33.3.8.3.14)";
+/// Why a Forms Processor may not process Later: the true SUPPRESS_IF before its form.
+const AFTER_SUPPRESS_IF: &str = "it is after an EFI_IFR_SUPPRESS_IF in the scope of a DISABLE_IF \
+     of its FormSet, whose condition is TRUE: edk2-stable202608 SetupBrowserDxe/IfrParse.c takes \
+     that condition for the DISABLE_IF's, which may skip the rest of its scope (:1690-1704, \
+     :3045-3059), where UEFI 2.11 §33.3.8.3.75 has it only hide";
+/// The answer of a question whose bytes overlap a password's.
+const PASSWORD_ANSWER: &str = "<ValueUnavailable: its bytes hold a password>";
+/// The end of set's refusal of O.
+const PASSWORD_REFUSAL: &str = "holds a password at bytes 8..24, which set never writes";
+/// The environment of the runs, which logs all that uefisettings logs.
+const TRACE: [(&str, &str); 1] = [("RUST_LOG", "trace")];
+
+/// What `hii dump-efivars` prints.
+#[derive(Debug, Deserialize)]
+struct Dump {
+    directory: String,
+}
+
+#[track_caller]
+fn store_data() -> Vec<u8> {
+    variable_data(STORE).expect("tests/qemu/vars/form-set-disable-if.json creates the variable")
+}
+
+/// Runs `uefisettings` with `args` and TRACE; panics if its standard output or error holds any
+/// of PASSWORD_TEXTS.
+#[track_caller]
+fn showing_no_password(args: &[&str]) -> Output {
+    let output = uefisettings_with_env(args, &TRACE);
+    for text in PASSWORD_TEXTS {
+        assert!(
+            !output.stdout.contains(text) && !output.stderr.contains(text),
+            "{args:?} shows {text:?}: {output:#?}"
+        );
+    }
+    output
+}
+
+/// The answers of get `args`, which must succeed.
+#[track_caller]
+fn answers(args: &[&str]) -> Vec<String> {
+    let output = showing_no_password(args);
+    let got: serde_json::Value = output.json(0);
+    got["responses"]
+        .as_array()
+        .unwrap_or_else(|| panic!("{args:?}: no responses: {output:#?}"))
+        .iter()
+        .map(|response| {
+            response["question"]["answer"]
+                .as_str()
+                .unwrap_or_else(|| panic!("{args:?}: no answer: {output:#?}"))
+                .to_owned()
+        })
+        .collect()
+}
+
+/// The error message of `args`, which must fail.
+#[track_caller]
+fn refusal(args: &[&str]) -> String {
+    let output = showing_no_password(args);
+    let error: serde_json::Value = output.json(1);
+    error["error_message"]
+        .as_str()
+        .unwrap_or_else(|| panic!("{args:?}: no error_message: {output:#?}"))
+        .to_owned()
+}
+
+/// list-questions lists the questions of the FormSet but Hidden and the PASSWORD, with every
+/// --include, and Shown unsuppressed, as Hidden is no question for its SUPPRESS_IF to read.
+#[test]
+fn a_true_form_set_disable_if_holds_no_question_to_list() {
+    for include in INCLUDES {
+        let args = [&["hii", "list-questions", "--json"][..], include].concat();
+        let output = showing_no_password(&args);
+        let questions: Vec<serde_json::Value> = output.json(0);
+        let listed: Vec<(&str, &str)> = questions
+            .iter()
+            .filter(|question| question["form_set_guid"] == FORM_SET)
+            .map(|question| {
+                (
+                    question["name"].as_str().unwrap_or_default(),
+                    question["answer"].as_str().unwrap_or_default(),
+                )
+            })
+            .collect();
+        let names: Vec<&str> = listed.iter().map(|&(name, _)| name).collect();
+        assert_eq!(names, LISTED, "{args:?}: {output:#?}");
+        assert!(
+            listed.contains(&("Shown", "2")),
+            "{args:?}: Shown: {listed:?}"
+        );
+    }
+}
+
+/// get finds no Hidden with any --include, and set refuses it as a question that the HiiDB does
+/// not have, also with --i-am-fine-to-brick-this-system, writing nothing.
+#[test]
+fn a_true_form_set_disable_if_holds_no_question_to_get_or_set() {
+    let before = store_data();
+    for prefix in PREFIXES {
+        for include in INCLUDES {
+            let args = [prefix, &["get", "--json", "Hidden"], include].concat();
+            assert_eq!(answers(&args), Vec::<String>::new(), "{args:?}");
+            for flag in [&[][..], &UNSAFE_OPERATIONS] {
+                let args = [prefix, &["set", "--json"], flag, include, &["Hidden", "5"]].concat();
+                let error = refusal(&args);
+                assert!(
+                    error.starts_with("no question \"Hidden\" in the HiiDB"),
+                    "{args:?}: {error}"
+                );
+            }
+        }
+    }
+    assert_eq!(store_data(), before, "set Hidden writes nothing");
+}
+
+/// get shows After and Later with both states they may be in and why; set refuses them, also
+/// with --i-am-fine-to-brick-this-system, and writes each with disabled questions included, which
+/// get then reads.
+#[test]
+fn questions_that_a_form_set_disable_if_may_skip_are_undetermined() {
+    for (question, offset, reason, value) in [
+        ("After", 3, NOT_CONSTANT, 9u8),
+        ("Later", 4, AFTER_SUPPRESS_IF, 7),
+    ] {
+        let before = store_data();
+        let state = |value: u8| format!("{value} <selectable or disabled: {reason}>");
+        let current = before[offset];
+        for prefix in PREFIXES {
+            let args = [prefix, &["get", "--json", question]].concat();
+            assert_eq!(answers(&args), [state(current)], "{args:?}");
+            for flag in [&[][..], &UNSAFE_OPERATIONS] {
+                let value = value.to_string();
+                let args = [prefix, &["set", "--json"], flag, &[question, &value]].concat();
+                assert_eq!(
+                    refusal(&args),
+                    format!(
+                        "cannot tell whether question \"{question}\" is disabled: {reason}; also \
+                         include disabled questions to select it regardless"
+                    ),
+                    "{args:?}"
+                );
+            }
+        }
+        assert_eq!(store_data(), before, "the refused sets of {question}");
+
+        let value_text = value.to_string();
+        let args = [
+            &["hii", "set", "--json"][..],
+            &INCLUDE_DISABLED,
+            &[question, &value_text],
+        ]
+        .concat();
+        assert_eq!(answers(&args), [state(value)], "{args:?}");
+        assert_eq!(
+            changed_bytes(&before, &store_data()),
+            [(offset, value)],
+            "{args:?} writes the byte of {question} alone"
+        );
+        let args = [&["hii", "get", "--json", question][..], &INCLUDE_DISABLED].concat();
+        assert_eq!(answers(&args), [state(value)], "{args:?}");
+    }
+}
+
+/// O, over the password's bytes, shows none of them, and set refuses it, also with
+/// --i-am-fine-to-brick-this-system and disabled questions included, writing nothing.
+#[test]
+fn the_password_under_a_true_form_set_disable_if_stays_withheld() {
+    let before = store_data();
+    assert_eq!(
+        before.get(PASSWORD_BYTES),
+        STORE_DATA.get(PASSWORD_BYTES),
+        "the password's bytes"
+    );
+    for prefix in PREFIXES {
+        let args = [prefix, &["get", "--json", "O"]].concat();
+        let got = answers(&args);
+        assert!(
+            got.len() == 1 && got[0].starts_with(PASSWORD_ANSWER),
+            "{args:?}: {got:?}"
+        );
+        for flag in [&[][..], &UNSAFE_OPERATIONS] {
+            for include in [&[][..], &INCLUDE_DISABLED] {
+                let args = [prefix, &["set", "--json"], flag, include, &["O", "5"]].concat();
+                let error = refusal(&args);
+                assert!(error.ends_with(PASSWORD_REFUSAL), "{args:?}: {error}");
+            }
+        }
+    }
+    assert_eq!(store_data(), before, "the refused sets of O");
+}
+
+/// --keyword selects Hidden as a disabled question, as edk2's keyword handler evaluates no
+/// condition: get refuses it unless disabled questions are included, and reads its byte then,
+/// while ShownKeyword reads Shown without.
+#[test]
+fn a_keyword_selects_the_question_under_a_true_form_set_disable_if_as_disabled() {
+    let hidden = store_data()[HIDDEN_OFFSET];
+    let error = refusal(&["hii", "get", "--json", "--keyword", "HiddenKeyword"]);
+    assert_eq!(
+        error,
+        "question \"keyword HiddenKeyword of a namespace starting with x-UEFI\" is disabled; also \
+         include disabled questions to select it",
+        "get --keyword HiddenKeyword"
+    );
+    let args = [
+        &["hii", "get", "--json", "--keyword", "HiddenKeyword"][..],
+        &INCLUDE_DISABLED,
+    ]
+    .concat();
+    assert_eq!(answers(&args), [format!("{hidden} <disabled>")], "{args:?}");
+    let args = ["hii", "get", "--json", "--keyword", "ShownKeyword"];
+    assert_eq!(answers(&args), ["2"], "{args:?}");
+}
+
+/// The efivarfs file name of the efivarfs path `path`.
+fn file_name(path: &str) -> &str {
+    path.rsplit('/').next().expect("an efivarfs file name")
+}
+
+/// The redacted dump-efivars keeps Hidden's byte, which --keyword reads, so get --keyword
+/// HiddenKeyword answers from the dump as from the live variables, and no byte of the password.
+#[test]
+fn dump_efivars_keeps_what_a_keyword_reads_and_no_password_byte() {
+    let dir = "/tmp/form-set-disable-if-efivars";
+    let dump: Dump = showing_no_password(&["hii", "dump-efivars", dir]).json(0);
+    assert_eq!(dump.directory, dir, "{dump:#?}");
+
+    let file = file_name(STORE);
+    let dumped = fs::read(format!("{dir}/{file}"))
+        .unwrap_or_else(|error| panic!("cannot read {file} in {dir}: {error}"));
+    let data = dumped
+        .get(EFIVARFS_HEADER_SIZE..)
+        .unwrap_or_else(|| panic!("{file}: no attributes in {dumped:02x?}"));
+    let live = store_data();
+    assert_eq!(
+        data.get(HIDDEN_OFFSET),
+        live.get(HIDDEN_OFFSET),
+        "{file}: Hidden in the dump"
+    );
+    assert_eq!(
+        data.get(PASSWORD_BYTES),
+        Some(&[0; 16][..]),
+        "{file}: the password's bytes in the dump"
+    );
+    assert!(
+        !data.contains(&0xBB),
+        "{file}: a password byte in {data:02x?}"
+    );
+
+    let get = [
+        &["hii", "get", "--json", "--keyword", "HiddenKeyword"][..],
+        &INCLUDE_DISABLED,
+    ]
+    .concat();
+    let live = showing_no_password(&get);
+    let replayed = showing_no_password(&[&get[..], &["--efivars", dir]].concat());
+    assert_eq!(live.code, Some(0), "{get:?}: {live:#?}");
+    assert_eq!(
+        (replayed.code, replayed.stdout),
+        (live.code, live.stdout),
+        "{get:?} --efivars {dir}"
+    );
+}
diff --git a/tests/qemu/guest/tests/hii_name_value_password.rs b/tests/qemu/guest/tests/hii_name_value_password.rs
index 99349df..02d700e 100644
--- a/tests/qemu/guest/tests/hii_name_value_password.rs
+++ b/tests/qemu/guest/tests/hii_name_value_password.rs
@@ -21,7 +21,8 @@
 //! the whole HiiDB, the question of the second list too, naming the PASSWORD, and write nothing,
 //! while list-questions without efivars reads; nothing shows 0x7A5BC3E1. In
 //! hii-name-value-password-snapshot, the ExportConfig snapshot holds 0x7A5BC3E1 for "Pin", and no
-//! question shows a value from it either.
+//! question shows a value from it either, not even the STRING on "Pin", which would read its
+//! digits as the characters U+7A5B and U+C3E1.
 
 use std::path::Path;
 
@@ -38,6 +39,8 @@ const NV_BACKING: &str = "/sys/firmware/efi/efivars/NvBacking-8c78a505-baa0-4c4a
 const BACKING_SETTING: &str = "Backing setting";
 /// The UINT32 NUMERIC on "Pin" of the VARSTORE_NAME_VALUE.
 const PIN_NUMBER: &str = "Name value pin as a number";
+/// The STRING on "Pin" of the VARSTORE_NAME_VALUE, of MaxSize 4.
+const PIN_STRING: &str = "Name value pin as a string";
 /// The UINT16 NUMERIC over Other, of the second package list.
 const OTHER_SETTING: &str = "Other setting";
 /// The PASSWORD that edk2 may route to the VARSTORE_NAME_VALUE, which the refusals name.
@@ -57,6 +60,12 @@ const PIN_TEXTS: [&str; 5] = [
     "e1 c3 5b 7a",
     "225, 195, 91, 122",
 ];
+/// The characters that a STRING would read from the snapshot's digits of 0x7A5BC3E1, 4 per
+/// `<Char>` (UEFI 2.11 §35.2.1.2).
+const PIN_CHARACTERS: [char; 2] = ['\u{7a5b}', '\u{c3e1}'];
+/// Why a question of the VARSTORE_NAME_VALUE has no value without the snapshot.
+const NAME_VALUE: &str =
+    "<ValueUnavailable: HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL>";
 /// What tags a value from the ExportConfig snapshot.
 const SNAPSHOT_TAG: &str = " <snapshot>";
 /// What the debug log says where the configuration table lists no ExportConfig snapshot.
@@ -72,7 +81,7 @@ enum Snapshot {
 }
 
 /// Runs `uefisettings` with `args` and TRACE; panics if its standard output or error holds any
-/// of PIN_TEXTS, in any case, or SNAPSHOT_TAG.
+/// of PIN_TEXTS, in any case, any of PIN_CHARACTERS, also as a JSON escape, or SNAPSHOT_TAG.
 #[track_caller]
 fn showing_no_pin(args: &[&str]) -> Output {
     let output = uefisettings_with_env(args, &TRACE);
@@ -86,6 +95,15 @@ fn showing_no_pin(args: &[&str]) -> Output {
             "{args:?} shows {text:?}: {output:#?}"
         );
     }
+    for character in PIN_CHARACTERS {
+        let escaped = format!("\\u{:04x}", u32::from(character));
+        for text in [character.to_string(), escaped] {
+            assert!(
+                !stdout.contains(&text) && !stderr.contains(&text),
+                "{args:?} shows {text:?}: {output:#?}"
+            );
+        }
+    }
     assert!(
         !output.stdout.contains(SNAPSHOT_TAG) && !output.stderr.contains(SNAPSHOT_TAG),
         "{args:?} shows a value of the snapshot: {output:#?}"
@@ -111,7 +129,7 @@ fn refused(args: &[&str]) -> Output {
 /// get refuses each question, of either package list.
 fn get_refuses_every_question() {
     for prefix in PREFIXES {
-        for question in [BACKING_SETTING, PIN_NUMBER, OTHER_SETTING] {
+        for question in [BACKING_SETTING, PIN_NUMBER, PIN_STRING, OTHER_SETTING] {
             refused(&[prefix, &["get", "--json", question]].concat());
         }
     }
@@ -130,16 +148,26 @@ fn list_questions_refuses_beside_the_snapshot(snapshot: Snapshot) {
 }
 
 /// list-questions without efivars reads no variable, so it lists the questions of both package
-/// lists.
+/// lists, and the STRING on "Pin" says why it has no value.
 fn list_questions_reads_without_efivars() {
     let output = showing_no_pin(&["hii", "list-questions", "--json", "--no-efivars"]);
     let listed: Vec<Question> = output.json(0);
-    for name in [BACKING_SETTING, PIN_NUMBER, OTHER_SETTING] {
+    for name in [BACKING_SETTING, PIN_NUMBER, PIN_STRING, OTHER_SETTING] {
         assert!(
             listed.iter().any(|question| question.name == name),
             "list-questions --no-efivars: {name}: {listed:#?}"
         );
     }
+    let answers: Vec<&str> = listed
+        .iter()
+        .filter(|question| question.name == PIN_STRING)
+        .map(|question| question.answer.as_str())
+        .collect();
+    assert_eq!(
+        answers,
+        [NAME_VALUE],
+        "list-questions --no-efivars: {PIN_STRING}"
+    );
 }
 
 /// set refuses the question over NvBacking and writes nothing.
diff --git a/tests/qemu/guest/tests/hii_name_value_string.rs b/tests/qemu/guest/tests/hii_name_value_string.rs
new file mode 100644
index 0000000..128a480
--- /dev/null
+++ b/tests/qemu/guest/tests/hii_name_value_string.rs
@@ -0,0 +1,211 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The boots of the scenarios hii-name-value-string and hii-name-value-string-snapshot:
+//! publish-hiidb's `rt-data-name-value-string-forms`, or `export-config-name-value-string` and
+//! then `rt-data`, registers the package list of `publish-hiidb/src/name_value_string_forms.rs`
+//! for a device path before it publishes the HII database: STRINGs of MaxSize 4 and a CHECKBOX
+//! on the names of a VARSTORE_NAME_VALUE, whose values its driver exposes, as UEFI 2.11
+//! §33.2.5.6 says, through EFI_HII_CONFIG_ACCESS_PROTOCOL, and no PASSWORD. Linux reads such a
+//! value only from the ExportConfig snapshot: in hii-name-value-string-snapshot, get,
+//! list-questions and show-ifr take each STRING's characters from it, 4 hex digits each, or say
+//! why its setting holds none, and the CHECKBOX's number; without efivars, and in
+//! hii-name-value-string, whose firmware lists no snapshot, each says why it has no value.
+
+use uefisettings_qemu_guest::uefisettings_with_env;
+use uefisettings_qemu_guest::Output;
+use uefisettings_qemu_guest::Question;
+use uefisettings_qemu_guest::Responses;
+use uefisettings_qemu_guest::BACKEND_HII;
+use uefisettings_qemu_guest::PREFIXES;
+
+/// Why a question of the VARSTORE_NAME_VALUE has no value without the snapshot.
+const NAME_VALUE: &str =
+    "<ValueUnavailable: HII name/value varstore requires EFI_HII_CONFIG_ACCESS_PROTOCOL>";
+/// The answers of the questions, each prompted by the name it is on, from the snapshot: its
+/// STRINGs read up to a NULL or 4 characters, and refuse more or a CHAR16 of fewer than 4 digits.
+const SNAPSHOT_ANSWERS: [(&str, &str); 8] = [
+    ("Text", "AB <snapshot>"),
+    ("Nul", "AB <snapshot>"),
+    ("Full", "ABCD <snapshot>"),
+    ("Padded", "ABCD <snapshot>"),
+    (
+        "Long",
+        "<ValueUnavailable: its setting in the ExportConfig snapshot holds more than its MaxSize \
+         of 4 characters>",
+    ),
+    (
+        "Odd",
+        "<ValueUnavailable: its setting in the ExportConfig snapshot is no <String>: 4 hex digits \
+         per CHAR16>",
+    ),
+    ("Empty", " <snapshot>"),
+    ("Flag", "1 <snapshot>"),
+];
+/// What the CHECKBOX shows after NAME_VALUE: its default, which no flag sets.
+const FLAG_DEFAULT: &str = " <IFR default: 0>";
+/// What tags a value from the ExportConfig snapshot.
+const SNAPSHOT_TAG: &str = " <snapshot>";
+/// What the debug log says where the configuration table lists no ExportConfig snapshot.
+const NO_SNAPSHOT: &str = "no ExportConfig snapshot";
+/// The environment of the runs, which logs all that uefisettings logs.
+const TRACE: [(&str, &str); 1] = [("RUST_LOG", "trace")];
+
+/// Whether uefisettings reads the ExportConfig snapshot: the firmware lists it and the run reads
+/// System efivars.
+#[derive(Clone, Copy, Debug)]
+enum Snapshot {
+    Absent,
+    Listed,
+}
+
+/// The answer of the question prompted `name` with or without the snapshot.
+fn answer(name: &str, snapshot: Snapshot) -> String {
+    match snapshot {
+        Snapshot::Listed => SNAPSHOT_ANSWERS
+            .iter()
+            .find(|(prompt, _)| *prompt == name)
+            .map(|(_, answer)| (*answer).to_owned())
+            .unwrap_or_else(|| panic!("no answer of {name}")),
+        Snapshot::Absent if name == "Flag" => format!("{NAME_VALUE}{FLAG_DEFAULT}"),
+        Snapshot::Absent => NAME_VALUE.to_owned(),
+    }
+}
+
+/// Runs `uefisettings` with `args` and TRACE; panics unless it exits with 0 and its debug log
+/// tells whether the firmware lists the snapshot, `listed`.
+#[track_caller]
+fn traced(args: &[&str], listed: Snapshot) -> Output {
+    let output = uefisettings_with_env(args, &TRACE);
+    assert_eq!(output.code, Some(0), "{args:?}: {output:#?}");
+    let logged = output.stderr.contains(NO_SNAPSHOT);
+    match listed {
+        Snapshot::Absent => assert!(logged, "{args:?}: {output:#?}"),
+        Snapshot::Listed => assert!(!logged, "{args:?}: {output:#?}"),
+    }
+    output
+}
+
+/// get gives each question its answer, with and without the hii prefix.
+fn get_answers_each_question(snapshot: Snapshot) {
+    for prefix in PREFIXES {
+        for (name, _) in SNAPSHOT_ANSWERS {
+            let output = traced(&[prefix, &["get", "--json", name]].concat(), snapshot);
+            let Responses { responses } = output.json(0);
+            let [response] = <[_; 1]>::try_from(responses)
+                .unwrap_or_else(|responses| panic!("{name}: one response: {responses:#?}"));
+            assert_eq!(response.backend, BACKEND_HII, "{name}: {response:#?}");
+            assert_eq!(
+                response.question.answer,
+                answer(name, snapshot),
+                "{prefix:?} get {name}"
+            );
+        }
+    }
+}
+
+/// list-questions gives each question its answer.
+fn list_questions_answers_each_question(snapshot: Snapshot) {
+    let listed: Vec<Question> = traced(&["hii", "list-questions", "--json"], snapshot).json(0);
+    for (name, _) in SNAPSHOT_ANSWERS {
+        let question = listed
+            .iter()
+            .find(|question| question.name == name)
+            .unwrap_or_else(|| panic!("list-questions lists no {name}: {listed:#?}"));
+        assert_eq!(
+            question.answer,
+            answer(name, snapshot),
+            "list-questions {name}"
+        );
+    }
+}
+
+/// show-ifr shows the snapshot's characters of the STRINGs and number of the CHECKBOX, or no
+/// value of the snapshot.
+fn show_ifr_shows_the_snapshot_answers(snapshot: Snapshot) {
+    let output = traced(&["hii", "show-ifr"], snapshot);
+    let shown = [
+        "AB <snapshot>",
+        "ABCD <snapshot>",
+        " <snapshot>",
+        "1 <snapshot>",
+    ];
+    for answer in shown {
+        let line = format!("-Answer: {answer}\n");
+        match snapshot {
+            Snapshot::Listed => assert!(output.stdout.contains(&line), "show-ifr: {output:#?}"),
+            Snapshot::Absent => assert!(!output.stdout.contains(&line), "show-ifr: {output:#?}"),
+        }
+    }
+    if let Snapshot::Absent = snapshot {
+        assert!(
+            !output.stdout.contains(SNAPSHOT_TAG),
+            "show-ifr: {output:#?}"
+        );
+    }
+}
+
+/// Without efivars uefisettings reads no snapshot, so each question says why it has no value.
+fn without_efivars_no_question_has_a_value() {
+    let listed: Vec<Question> =
+        uefisettings_with_env(&["hii", "list-questions", "--json", "--no-efivars"], &TRACE).json(0);
+    for (name, _) in SNAPSHOT_ANSWERS {
+        let question = listed
+            .iter()
+            .find(|question| question.name == name)
+            .unwrap_or_else(|| panic!("list-questions --no-efivars lists no {name}: {listed:#?}"));
+        assert_eq!(
+            question.answer,
+            answer(name, Snapshot::Absent),
+            "list-questions --no-efivars {name}"
+        );
+    }
+    let output = uefisettings_with_env(&["hii", "get", "--json", "--no-efivars", "Text"], &TRACE);
+    let Responses { responses } = output.json(0);
+    let answers: Vec<&str> = responses
+        .iter()
+        .map(|response| response.question.answer.as_str())
+        .collect();
+    assert_eq!(answers, [NAME_VALUE], "get --no-efivars Text");
+}
+
+/// The tests of each scenario, in a module named after whether its firmware lists the snapshot.
+macro_rules! name_value_string_tests {
+    ($($module:ident: $snapshot:expr),* $(,)?) => {$(
+        mod $module {
+            #[test]
+            fn get_answers_each_question() {
+                super::get_answers_each_question($snapshot);
+            }
+
+            #[test]
+            fn list_questions_answers_each_question() {
+                super::list_questions_answers_each_question($snapshot);
+            }
+
+            #[test]
+            fn show_ifr_shows_the_snapshot_answers() {
+                super::show_ifr_shows_the_snapshot_answers($snapshot);
+            }
+
+            #[test]
+            fn without_efivars_no_question_has_a_value() {
+                super::without_efivars_no_question_has_a_value();
+            }
+        }
+    )*};
+}
+
+name_value_string_tests!(
+    without_snapshot: super::Snapshot::Absent,
+    with_snapshot: super::Snapshot::Listed,
+);
diff --git a/tests/qemu/guest/tests/hii_no_runtime_access.rs b/tests/qemu/guest/tests/hii_no_runtime_access.rs
index 8e87e7a..ed02b23 100644
--- a/tests/qemu/guest/tests/hii_no_runtime_access.rs
+++ b/tests/qemu/guest/tests/hii_no_runtime_access.rs
@@ -47,9 +47,16 @@ fn check_box_answer() -> String {
     format!("{NO_CONFIG_ACCESS} <IFR default: 1>")
 }
 
-/// Why a condition with `op` on question `id`, on DriverSample's variable, is not evaluated.
-fn unread(op: &str, id: u16) -> String {
-    format!("{op} of question {id:#06x}: {NO_CONFIG_ACCESS}")
+/// Why a condition with `op` on question `id`, on DriverSample's variable, is not evaluated,
+/// and the `--assume-var-store` that states the byte at `offset` that the question reads.
+fn unread(op: &str, id: u16, offset: usize) -> String {
+    let reason = NO_CONFIG_ACCESS
+        .strip_suffix('>')
+        .expect("NO_CONFIG_ACCESS ends with '>'");
+    format!(
+        "{op} of question {id:#06x}: {reason}; --assume-var-store \
+         MyIfrNVData-a04a27f4-df00-4d42-b552-39511302113d+{offset}=<HEX of 1 byte> states it>"
+    )
 }
 
 /// The answers of the listings of [`CHECK_BOX`]: Vfr.vfr grays out or suppresses the first
@@ -59,13 +66,13 @@ fn check_box_answers() -> [String; 2] {
         format!(
             "{} <selectable or grayed-out or suppressed: {}; {}>",
             check_box_answer(),
-            unread("EFI_IFR_QUESTION_REF1", 1),
-            unread("EFI_IFR_EQ_ID_VAL", 1)
+            unread("EFI_IFR_QUESTION_REF1", 1, 93),
+            unread("EFI_IFR_EQ_ID_VAL", 1, 93)
         ),
         format!(
             "{} <selectable or suppressed: {}>",
             check_box_answer(),
-            unread("EFI_IFR_EQ_ID_VAL", 2)
+            unread("EFI_IFR_EQ_ID_VAL", 2, 118)
         ),
     ]
 }
@@ -101,7 +108,7 @@ fn list_questions_reports_numeric_and_one_of_defaults() {
     // The numeric is in a grayoutif on two questions on the variable.
     let numeric_states = format!(
         " <selectable or grayed-out: {}>",
-        unread("EFI_IFR_EQ_ID_VAL", 0x0c)
+        unread("EFI_IFR_EQ_ID_VAL", 0x0c, 82)
     );
     for (name, default, states) in [
         (NUMERIC, "18", numeric_states.as_str()),
diff --git a/tests/qemu/guest/tests/hii_readwrite.rs b/tests/qemu/guest/tests/hii_readwrite.rs
index c85d9db..211a05c 100644
--- a/tests/qemu/guest/tests/hii_readwrite.rs
+++ b/tests/qemu/guest/tests/hii_readwrite.rs
@@ -60,6 +60,10 @@ const DRIVER_HELD: &str = "question has no VarStore; its driver keeps the value,
      EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() reaches (UEFI 2.11 §33.2.5.6), and after \
      ExitBootServices() no EFI device-handle-based protocol may be used (UEFI 2.11 §7.4.6); use \
      uefisettings.efi in the UEFI Shell";
+/// set stages a question that its driver holds for the next boot, on the ESP, which no boot here
+/// mounts
+const NO_MOUNTED_ESP: &str =
+    "no mounted vfat volume is an EFI system partition; mount it. Mounted: none";
 const NO_VALUE_SOURCE: &str = "question has no VarStore, READ or WRITE expression, or \
      EFI_IFR_FLAG_CALLBACK, one of which UEFI 2.11 §33.2.5.6 requires";
 const NO_READ: &str = "question has no VarStore, READ expression or EFI_IFR_FLAG_CALLBACK, so it \
@@ -306,14 +310,20 @@ fn set_of_a_write_into_a_store_without_its_variable_is_refused() {
     assert_eq!(variable_data(ABSENT_BUFFER), None, "AbsentBuffer created");
 }
 
-/// get and set say what each question without a VarStore lacks, or that its driver keeps its
-/// value, which nothing reaches from Linux.
+/// get and set say what each question without a VarStore lacks; get says that its driver keeps
+/// its value, which nothing reaches from Linux, and set, which stages it for the next boot, that no
+/// ESP is mounted.
 #[test]
 fn get_and_set_of_storageless_questions_say_why_they_are_refused() {
     // (question, answer for set, refusal of get, refusal of set): None where the other test
     // checks that it succeeds
     let cases = [
-        ("Driver held", "First", Some(DRIVER_HELD), Some(DRIVER_HELD)),
+        (
+            "Driver held",
+            "First",
+            Some(DRIVER_HELD),
+            Some(NO_MOUNTED_ESP),
+        ),
         (
             "No value source",
             "1",
diff --git a/tests/qemu/guest/tests/hii_systab.rs b/tests/qemu/guest/tests/hii_systab.rs
index d39faca..26b0b71 100644
--- a/tests/qemu/guest/tests/hii_systab.rs
+++ b/tests/qemu/guest/tests/hii_systab.rs
@@ -140,20 +140,92 @@ fn the_automatic_order_logs_the_method_at_debug_level() {
 }
 
 /// Named, the vendor ACPI table method and the `HiiDB` variable method report their sources
-/// absent, as errors apart.
+/// absent, as errors apart. So do the hii commands that read the database, with the vendor ACPI
+/// table method named before or after the command, rather than read the configuration table as
+/// the automatic order would.
 #[test]
 fn the_other_methods_report_their_sources_absent() {
+    let mut runs = Vec::new();
     for method in ["acpi", "efivar"] {
-        let error = json_error(&["--hii-source", method, "hii", "extract-db", "/tmp/none.bin"]);
+        runs.push((
+            method,
+            vec!["--hii-source", method, "hii", "extract-db", "/tmp/none.bin"],
+        ));
+    }
+    let flags = ["--hii-source", "acpi"];
+    let commands: [&[&str]; 4] = [
+        &["hii", "show-ifr", "--no-efivars"],
+        &["hii", "get", NUMERIC, "--no-efivars"],
+        &["hii", "list-questions", "--no-efivars"],
+        &["hii", "list-strings"],
+    ];
+    for command in commands {
+        runs.push(("acpi", [&flags[..], command].concat()));
+        runs.push(("acpi", [command, &flags].concat()));
+    }
+    for (method, args) in runs {
+        let error = json_error(&args);
         assert!(
             error
                 .error_message
                 .starts_with(&format!("no HII database: {method}: absent: ")),
-            "{method}: {error:?}"
+            "{args:?}: {error:?}"
         );
         assert!(
             !error.error_message.contains("systab"),
-            "{method}: tried only the named method: {error:?}"
+            "{args:?}: tried only the named method: {error:?}"
         );
     }
 }
+
+/// --hii-source is refused, not ignored, before or after the command, where no HiiDB of this
+/// machine is read: in show-translations and ilo, and where -f gives the HiiDB, which the same
+/// commands read without it. --efivar-memory is refused with --hii-source systab, which never
+/// reads that memory.
+#[test]
+fn the_flags_are_refused_where_nothing_reads_them() {
+    let path = "/tmp/hiidb-given.bin";
+    let output = uefisettings(&["hii", "extract-db", path]);
+    assert_eq!(output.code, Some(0), "{output:#?}");
+    let given = ["hii", "list-strings", "-f", path];
+    for args in [&["show-translations"][..], &given] {
+        let output = uefisettings(args);
+        assert_eq!(
+            output.code,
+            Some(0),
+            "{args:?} without the flag: {output:#?}"
+        );
+    }
+
+    let flags = ["--hii-source", "systab"];
+    for (command, why) in [
+        (&["show-translations"][..], "show-translations reads none"),
+        (&["ilo", "show-attributes"], "ilo reads none"),
+        (&given, "--filename gives the HiiDB"),
+    ] {
+        for args in [[&flags[..], command].concat(), [command, &flags].concat()] {
+            assert_eq!(
+                json_error(&args).error_message,
+                format!("--hii-source names where this machine's HiiDB is read, and {why}"),
+                "{args:?}"
+            );
+        }
+    }
+
+    let args = [
+        "hii",
+        "get",
+        NUMERIC,
+        "--no-efivars",
+        "--hii-source",
+        "systab",
+        "--efivar-memory",
+        "runtime",
+    ];
+    assert_eq!(
+        json_error(&args).error_message,
+        "--efivar-memory names the memory of the efivar method, which --hii-source systab does \
+         not run",
+        "{args:?}"
+    );
+}
diff --git a/tests/qemu/guest/tests/hii_undeclared_password.rs b/tests/qemu/guest/tests/hii_undeclared_password.rs
new file mode 100644
index 0000000..71998f5
--- /dev/null
+++ b/tests/qemu/guest/tests/hii_undeclared_password.rs
@@ -0,0 +1,214 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The boots of the scenarios hii-undeclared-password and hii-undeclared-password-snapshot:
+//! publish-hiidb's `rt-data-undeclared-password-forms`, or `export-config-undeclared-password`
+//! and then `rt-data`, registers the package lists of
+//! `publish-hiidb/src/undeclared_password_forms.rs` for one device path before it publishes the
+//! HII database, and vars/undeclared-password.json creates UdBacking, whose bytes 0..4 hold
+//! 0x7A4C19E3, and Other. The first list's PASSWORD is of VarStoreId 9, which no VarStore of its
+//! form package declares, so it names no VarStore (UEFI 2.11 §33.3.8.2.2 asks for "a previously
+//! declared variable store"), and its password may be in any variable: through Linux, whose
+//! variables read, get, list-questions, show-ifr, set, also with
+//! --i-am-fine-to-brick-this-system, which lifts none of that and warns of nothing, and
+//! dump-efivars refuse the whole HiiDB, the question of the second list too, naming the
+//! PASSWORD, and write nothing, while list-questions without efivars reads; nothing shows
+//! 0x7A4C19E3. In hii-undeclared-password-snapshot, the ExportConfig snapshot holds 0x7A4C19E3
+//! for UdBacking, and no question shows a value from it either.
+
+use std::path::Path;
+
+use uefisettings_qemu_guest::uefisettings_with_env;
+use uefisettings_qemu_guest::variable_data;
+use uefisettings_qemu_guest::ErrorObject;
+use uefisettings_qemu_guest::Output;
+use uefisettings_qemu_guest::Question;
+use uefisettings_qemu_guest::PREFIXES;
+
+/// The efivarfs file of UdBacking, the buffer VARSTORE of the first package list.
+const UD_BACKING: &str = "/sys/firmware/efi/efivars/UdBacking-8c78a505-baa0-4c4a-869f-000000002301";
+/// The efivarfs file of Other, the buffer VARSTORE of the second package list.
+const OTHER: &str = "/sys/firmware/efi/efivars/Other-8c78a505-baa0-4c4a-869f-000000002303";
+/// The UINT32 NUMERIC over bytes 0..4 of UdBacking.
+const BACKING_SETTING: &str = "Undeclared backing setting";
+/// The UINT16 NUMERIC over Other, of the second package list.
+const OTHER_SETTING: &str = "Undeclared other setting";
+/// The record of the PASSWORD, which the refusals name.
+const PASSWORD_RECORD: &str = "PASSWORD question 0x0002 in FormSet \
+     8C78A505-BAA0-4C4A-869F-000000002300: no supported varstore with matching id 0x0009 found";
+/// The end of the refusal of a HiiDB whose PASSWORD may keep its password in any variable.
+const ANY_VARIABLE: &str = "; as a PASSWORD there may keep its password in any variable, \
+    uefisettings reads and writes no variable of this HiiDB";
+/// What would show 0x7A4C19E3, which UdBacking and the snapshot hold where a password may be:
+/// the UINT32 in decimal, its digits, its little-endian bytes in hex, as a hex dump and as a
+/// Debug list.
+const PIN_TEXTS: [&str; 5] = [
+    "2051807715",
+    "7a4c19e3",
+    "e3194c7a",
+    "e3 19 4c 7a",
+    "227, 25, 76, 122",
+];
+/// What tags a value from the ExportConfig snapshot.
+const SNAPSHOT_TAG: &str = " <snapshot>";
+/// What the debug log says where the configuration table lists no ExportConfig snapshot.
+const NO_SNAPSHOT: &str = "no ExportConfig snapshot";
+/// What starts the line of an operation that --i-am-fine-to-brick-this-system let through.
+const WARNING: &str = "warning: ";
+/// The environment of the runs, which logs all that uefisettings logs.
+const TRACE: [(&str, &str); 1] = [("RUST_LOG", "trace")];
+
+/// Whether the firmware lists the ExportConfig snapshot.
+#[derive(Clone, Copy, Debug)]
+enum Snapshot {
+    Absent,
+    Listed,
+}
+
+/// Runs `uefisettings` with `args` and TRACE; panics if its standard output or error holds any
+/// of PIN_TEXTS, in any case, or SNAPSHOT_TAG.
+#[track_caller]
+fn showing_no_pin(args: &[&str]) -> Output {
+    let output = uefisettings_with_env(args, &TRACE);
+    let (stdout, stderr) = (
+        output.stdout.to_ascii_lowercase(),
+        output.stderr.to_ascii_lowercase(),
+    );
+    for text in PIN_TEXTS {
+        assert!(
+            !stdout.contains(text) && !stderr.contains(text),
+            "{args:?} shows {text:?}: {output:#?}"
+        );
+    }
+    assert!(
+        !output.stdout.contains(SNAPSHOT_TAG) && !output.stderr.contains(SNAPSHOT_TAG),
+        "{args:?} shows a value of the snapshot: {output:#?}"
+    );
+    output
+}
+
+/// Runs `uefisettings` with `args` as showing_no_pin does; panics unless it fails with the
+/// refusal of the HiiDB that names the PASSWORD.
+#[track_caller]
+fn refused(args: &[&str]) -> Output {
+    let output = showing_no_pin(args);
+    let error: ErrorObject = output.json(1);
+    assert!(
+        error.error_message.contains(PASSWORD_RECORD)
+            && error.error_message.ends_with(ANY_VARIABLE),
+        "{args:?}: {}",
+        error.error_message
+    );
+    output
+}
+
+/// get refuses each question, of either package list.
+fn get_refuses_every_question() {
+    for prefix in PREFIXES {
+        for question in [BACKING_SETTING, OTHER_SETTING] {
+            refused(&[prefix, &["get", "--json", question]].concat());
+        }
+    }
+}
+
+/// list-questions and show-ifr refuse the HiiDB, and the debug log tells whether the firmware
+/// lists the snapshot: list-questions reads it before the refusal.
+fn list_questions_refuses_beside_the_snapshot(snapshot: Snapshot) {
+    let listed = refused(&["hii", "list-questions", "--json"]);
+    let logged = listed.stderr.contains(NO_SNAPSHOT);
+    match snapshot {
+        Snapshot::Absent => assert!(logged, "list-questions: {listed:#?}"),
+        Snapshot::Listed => assert!(!logged, "list-questions: {listed:#?}"),
+    }
+    refused(&["hii", "show-ifr"]);
+}
+
+/// list-questions without efivars reads no variable, so it lists the questions of both package
+/// lists.
+fn list_questions_reads_without_efivars() {
+    let output = showing_no_pin(&["hii", "list-questions", "--json", "--no-efivars"]);
+    let listed: Vec<Question> = output.json(0);
+    for name in [BACKING_SETTING, OTHER_SETTING] {
+        assert!(
+            listed.iter().any(|question| question.name == name),
+            "list-questions --no-efivars: {name}: {listed:#?}"
+        );
+    }
+}
+
+/// set, also with --i-am-fine-to-brick-this-system, refuses the question over UdBacking, warns
+/// of no operation that the flag let through, and writes neither UdBacking nor Other.
+fn set_refuses_and_writes_nothing() {
+    let before = [UD_BACKING, OTHER].map(|path| variable_data(path).expect("the variable exists"));
+    for prefix in PREFIXES {
+        for flag in [&[][..], &["--i-am-fine-to-brick-this-system"]] {
+            let args = [prefix, &["set", "--json"], flag, &[BACKING_SETTING, "1"]].concat();
+            let output = refused(&args);
+            assert!(
+                !output.stderr.lines().any(|line| line.starts_with(WARNING)),
+                "{args:?} warns: {output:#?}"
+            );
+        }
+    }
+    for (path, before) in [UD_BACKING, OTHER].iter().zip(before) {
+        assert_eq!(
+            variable_data(path),
+            Some(before),
+            "{path} after the refused sets"
+        );
+    }
+}
+
+/// The redacted dump-efivars refuses the HiiDB before it creates its directory.
+fn dump_efivars_refuses_without_a_directory() {
+    let dir = "/tmp/undeclared-password-efivars";
+    assert!(!Path::new(dir).exists(), "{dir} before dump-efivars");
+    refused(&["hii", "dump-efivars", dir]);
+    assert!(!Path::new(dir).exists(), "{dir} after dump-efivars");
+}
+
+/// The tests of each scenario, in a module named after whether its firmware lists the snapshot.
+macro_rules! undeclared_password_tests {
+    ($($module:ident: $snapshot:expr),* $(,)?) => {$(
+        mod $module {
+            #[test]
+            fn get_refuses_every_question() {
+                super::get_refuses_every_question();
+            }
+
+            #[test]
+            fn list_questions_refuses_beside_the_snapshot() {
+                super::list_questions_refuses_beside_the_snapshot($snapshot);
+            }
+
+            #[test]
+            fn list_questions_reads_without_efivars() {
+                super::list_questions_reads_without_efivars();
+            }
+
+            #[test]
+            fn set_refuses_and_writes_nothing() {
+                super::set_refuses_and_writes_nothing();
+            }
+
+            #[test]
+            fn dump_efivars_refuses_without_a_directory() {
+                super::dump_efivars_refuses_without_a_directory();
+            }
+        }
+    )*};
+}
+
+undeclared_password_tests!(
+    without_snapshot: super::Snapshot::Absent,
+    with_snapshot: super::Snapshot::Listed,
+);
diff --git a/tests/qemu/guest/tests/hii_write.rs b/tests/qemu/guest/tests/hii_write.rs
index f9de7df..49af099 100644
--- a/tests/qemu/guest/tests/hii_write.rs
+++ b/tests/qemu/guest/tests/hii_write.rs
@@ -504,25 +504,26 @@ fn set_read_only_numeric_is_refused_without_the_unsafe_flag() {
     }
 }
 
-/// set, through hii set and set, refuses --access-level on a HiiDB that declares no SystemAccess
-/// VarStore, and writes nothing.
+/// set, through hii set and set, refuses --assume-var-store of a VarStore that no FormSet of the
+/// HiiDB declares, and writes nothing.
 #[test]
-fn set_with_an_access_level_is_refused_without_system_access() {
+fn set_with_bytes_of_an_undeclared_var_store_is_refused() {
     for prefix in PREFIXES {
-        for level in ["administrator", "user"] {
-            assert_eq!(
-                refuse(
-                    prefix,
-                    ONE_OF,
-                    "My one-of text #3",
-                    &["--access-level", level]
-                )
-                .error_message,
-                "--access-level applies to AMI firmware whose HiiDB declares the SystemAccess \
-                 VarStore; this HiiDB declares none",
-                "{prefix:?} {level}"
-            );
-        }
+        assert_eq!(
+            refuse(
+                prefix,
+                ONE_OF,
+                "My one-of text #3",
+                &[
+                    "--assume-var-store",
+                    "Undeclared-00000000-0000-0000-0000-000000000001=00"
+                ]
+            )
+            .error_message,
+            "no FormSet of this HiiDB declares a VarStore \
+             Undeclared-00000000-0000-0000-0000-000000000001",
+            "{prefix:?}"
+        );
     }
 }
 
diff --git a/tests/qemu/guest/tests/staged_set.rs b/tests/qemu/guest/tests/staged_set.rs
new file mode 100644
index 0000000..6c32340
--- /dev/null
+++ b/tests/qemu/guest/tests/staged_set.rs
@@ -0,0 +1,482 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! A set staged for the next boot (src/lib/staged_set.rs), in staged-set: Linux stages
+//! questions of publish-hiidb's callback-forms, whose driver holds their value, on the EFI
+//! system partition of the writable GPT disk of devices=esp-disk (run.sh), /dev/vdb, whose ESP is
+//! GPT entry 2 but the first partition on the disk. Before the UEFI Shell of each
+//! rebooting-shell: boot in between, the firmware starts the staged set's Boot#### from BootNext,
+//! which shell/staged-set-*.tsv check.
+//! - `stage_two_sets` formats that ESP, then two sets stage a question each in one staged set.
+//! - `after_the_applied_boot` reads what that set's boot applied, then stages another set and
+//!   deletes its image from the ESP.
+//! - `after_the_boot_without_its_image` reads that that set's boot never started
+//!   uefisettings.efi, then stages a set whose question's Callback(CHANGED) resets the platform.
+//! - `after_the_interrupted_boot` reads that that set's boot stopped while it applied it, then
+//!   stages another set.
+//!
+//! A set after a staged set's boot first settles that set: records its outcome and deletes its
+//! Boot#### and image.
+
+use std::fs;
+use std::process::Command;
+
+use serde_json::Value;
+use sha2::Digest;
+use sha2::Sha256;
+use uefisettings_qemu_guest::global_variable;
+use uefisettings_qemu_guest::require_test_vm;
+use uefisettings_qemu_guest::single_response;
+use uefisettings_qemu_guest::variable_data;
+use uefisettings_qemu_guest::BACKEND_HII;
+use uefisettings_qemu_guest::EFIVARS;
+use uefisettings_qemu_guest::EFI_GLOBAL_VARIABLE;
+
+/// The disk of devices=esp-disk, its size in 512-byte sectors, and its EFI system partition:
+/// that of tests/qemu/esp-disk.sfdisk.
+const DISK: &str = "/sys/block/vdb";
+const DISK_SECTORS: u64 = 131_072;
+const ESP: &str = "/dev/vdb2";
+const ESP_PARTITION_NUMBER: u32 = 2;
+const ESP_START: u64 = 2048;
+const ESP_SIZE: u64 = 81_920;
+/// The ESP's UniquePartitionGUID, as a GPT entry and a Hard Drive node hold it: the first three
+/// fields little-endian.
+const ESP_SIGNATURE: [u8; 16] = [
+    0x05, 0xA5, 0x78, 0x8C, 0xA0, 0xBA, 0x4A, 0x4C, 0x86, 0x9F, 0x00, 0x00, 0x00, 0x00, 0x1A, 0x10,
+];
+/// Where the tests mount the ESP.
+const MOUNT_POINT: &str = "/esp";
+/// The uefisettings.efi that run.sh puts in the initramfs, which set stages.
+const IMAGE: &str = "/uefisettings.efi";
+/// Where set stages it, under the mount point.
+const STAGED_IMAGE: &str = "/esp/EFI/uefisettings/uefisettings.efi";
+/// Questions of callback-forms without a VarStore: one whose Callback(CHANGED) keeps its value
+/// in a variable of its own, one whose Callback(CHANGING) refuses every value, and one whose
+/// Callback(CHANGED) keeps its value, then resets the platform.
+const BESIDE_STORES: &str = "Callback value beside stores";
+const REFUSED: &str = "Callback value refused in CHANGING";
+const RESETTING: &str = "Callback value resetting the platform";
+/// The variables in which callback-forms keeps those questions' values, of the tests' vendor
+/// GUID.
+const BESIDE_STORES_VALUE: &str = "CallbackValue0201";
+const REFUSED_VALUE: &str = "CallbackValue0204";
+const RESETTING_VALUE: &str = "CallbackValue0102";
+const TESTS_VENDOR: &str = "de145b29-c3cd-455f-91de-a76237b67c52";
+/// uefisettings' vendor GUID, and its records of the staged set and of the last staged set's
+/// outcome.
+const UEFISETTINGS_VENDOR: &str = "dd16f539-09ed-41b9-8b64-d85d6cd93a8e";
+const STAGED_SET: &str = "UefisettingsStagedSet";
+const STAGED_OUTCOME: &str = "UefisettingsStagedOutcome";
+
+/// Runs busybox's `applet` with `args`; panics unless it succeeds.
+#[track_caller]
+fn busybox(applet: &str, args: &[&str]) {
+    require_test_vm();
+    let status = Command::new("/bin/busybox")
+        .arg(applet)
+        .args(args)
+        .status()
+        .unwrap_or_else(|error| panic!("cannot run busybox {applet} {args:?}: {error}"));
+    assert!(status.success(), "busybox {applet} {args:?}: {status}");
+}
+
+/// A number that a sysfs file of the disk holds.
+#[track_caller]
+fn disk_number(file: &str) -> u64 {
+    require_test_vm();
+    let path = format!("{DISK}/{file}");
+    let text = fs::read_to_string(&path).unwrap_or_else(|error| panic!("read {path}: {error}"));
+    text.trim_end()
+        .parse()
+        .unwrap_or_else(|error| panic!("{path}: {text:?}: {error}"))
+}
+
+fn mount_esp() {
+    fs::create_dir_all(MOUNT_POINT).expect("create the mount point");
+    busybox("mount", &["-t", "vfat", ESP, MOUNT_POINT]);
+}
+
+fn unmount_esp() {
+    busybox("umount", &[MOUNT_POINT]);
+}
+
+/// The JSON of uefisettings' record `name`, or None if there is none.
+#[track_caller]
+fn record(name: &str) -> Option<Value> {
+    let data = variable_data(&format!("{EFIVARS}/{name}-{UEFISETTINGS_VENDOR}"))?;
+    Some(
+        serde_json::from_slice(&data).unwrap_or_else(|error| {
+            panic!("{name}: {error}: {:?}", String::from_utf8_lossy(&data))
+        }),
+    )
+}
+
+/// The record of the staged set; panics if there is none.
+#[track_caller]
+fn staged_set() -> Value {
+    record(STAGED_SET).expect("a staged set's record")
+}
+
+/// The data of callback-forms' variable `name`.
+#[track_caller]
+fn question_variable(name: &str) -> Option<Vec<u8>> {
+    variable_data(&format!("{EFIVARS}/{name}-{TESTS_VENDOR}"))
+}
+
+/// The number of the Boot#### that BootNext names; panics if there is no BootNext.
+#[track_caller]
+fn boot_next() -> u16 {
+    let data = global_variable("BootNext").expect("BootNext");
+    let bytes: [u8; 2] = data.try_into().expect("BootNext is a UINT16");
+    u16::from_le_bytes(bytes)
+}
+
+/// The data of Boot`number`, or None if there is none.
+#[track_caller]
+fn boot_option(number: u16) -> Option<Vec<u8>> {
+    global_variable(&format!("Boot{number:04X}"))
+}
+
+/// The Boot#### number of a staged set's record.
+#[track_caller]
+fn boot_option_number(set: &Value) -> u16 {
+    set["boot_option"]
+        .as_u64()
+        .and_then(|number| u16::try_from(number).ok())
+        .unwrap_or_else(|| panic!("no Boot#### number: {set}"))
+}
+
+/// The Hard Drive node (UEFI 2.11 §10.3.5.1) of the ESP: Type, SubType and Length, then the
+/// partition number, start, size, signature, MBR or GPT, and signature type, GUID.
+fn esp_hard_drive_node() -> Vec<u8> {
+    [
+        &[0x04, 0x01, 42, 0][..],
+        &ESP_PARTITION_NUMBER.to_le_bytes(),
+        &ESP_START.to_le_bytes(),
+        &ESP_SIZE.to_le_bytes(),
+        &ESP_SIGNATURE,
+        &[0x02, 0x02],
+    ]
+    .concat()
+}
+
+/// `text` in CHAR16s, as a load option's OptionalData holds a command line.
+fn char16s(text: &str) -> Vec<u8> {
+    text.encode_utf16().flat_map(u16::to_le_bytes).collect()
+}
+
+/// The numbers of the Boot#### whose data holds the command line of a staged set, in order.
+#[track_caller]
+fn staged_boot_options() -> Vec<u16> {
+    require_test_vm();
+    let suffix = format!("-{EFI_GLOBAL_VARIABLE}");
+    let command = char16s("uefisettings.efi apply-staged ");
+    let mut numbers: Vec<u16> = fs::read_dir(EFIVARS)
+        .expect("list efivarfs")
+        .map(|entry| entry.expect("an efivarfs entry").file_name())
+        .filter_map(|name| {
+            let digits = name.to_str()?.strip_suffix(&suffix)?.strip_prefix("Boot")?;
+            match digits.len() {
+                4 => u16::from_str_radix(digits, 16).ok(),
+                _ => None,
+            }
+        })
+        .filter(|&number| {
+            boot_option(number)
+                .is_some_and(|data| data.windows(command.len()).any(|window| window == command))
+        })
+        .collect();
+    numbers.sort_unstable();
+    numbers
+}
+
+/// Panics unless Boot`number` starts the image on the ESP by its Hard Drive node, with the
+/// command line of the staged set of `nonce`, then a Null character.
+#[track_caller]
+fn assert_starts_staged_set(number: u16, nonce: &str) {
+    let option = boot_option(number).unwrap_or_else(|| panic!("no Boot{number:04X}"));
+    let node = esp_hard_drive_node();
+    assert!(
+        option.windows(node.len()).any(|window| window == node),
+        "Boot{number:04X} names no Hard Drive node {node:02x?} of the ESP: {option:02x?}"
+    );
+    let command = char16s(&format!("uefisettings.efi apply-staged {nonce}\0"));
+    assert!(
+        option.ends_with(&command),
+        "Boot{number:04X} has not the command line of {nonce}: {option:02x?}"
+    );
+}
+
+/// The nonce of a record.
+#[track_caller]
+fn nonce(record: &Value) -> String {
+    record["nonce"]
+        .as_str()
+        .unwrap_or_else(|| panic!("no nonce: {record}"))
+        .to_owned()
+}
+
+/// What set answers of a request of an outcome's results.
+#[track_caller]
+fn result(outcome: &Value) -> String {
+    outcome["result"]
+        .as_str()
+        .unwrap_or_else(|| panic!("no result: {outcome}"))
+        .to_owned()
+}
+
+/// The answer that `hii get` gives of `question`.
+#[track_caller]
+fn get(question: &str) -> String {
+    single_response(&["hii", "get", "--json", question], BACKEND_HII)
+        .0
+        .answer
+}
+
+/// Runs `hii set` of `question` to `value` with `more` arguments; panics unless it stages it in
+/// the set whose Boot#### BootNext names, which it returns.
+#[track_caller]
+fn stage(question: &str, value: &str, more: &[&str]) -> u16 {
+    let args = [&["hii", "set", "--json", question, value][..], more].concat();
+    let (answer, _) = single_response(&args, BACKEND_HII);
+    let number = boot_next();
+    let staged = format!(" <staged for the next boot, as Boot{number:04X}: restart to apply>");
+    assert!(
+        answer.answer.ends_with(&staged),
+        "{args:?}: {answer:#?} does not end with {staged:?}"
+    );
+    number
+}
+
+/// Panics unless `get` of `question` shows its refusal with the note `note`.
+#[track_caller]
+fn assert_note(question: &str, note: &str) {
+    let answer = get(question);
+    let suffix = format!(" <{note}>");
+    assert!(
+        answer.starts_with("<ValueUnavailable") && answer.ends_with(&suffix),
+        "get {question:?}: {answer:?} does not end with {suffix:?}"
+    );
+}
+
+/// The SHA-256 of the file at `path`, as a staged set's record writes it.
+#[track_caller]
+fn sha256(path: &str) -> String {
+    let bytes = fs::read(path).unwrap_or_else(|error| panic!("read {path}: {error}"));
+    Sha256::digest(bytes)
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+
+#[test]
+fn stage_two_sets() {
+    require_test_vm();
+    // the disk that run.sh made, partitioned as esp-disk.sfdisk, before formatting anything
+    assert_eq!(disk_number("ro"), 0, "{DISK} is read-only");
+    assert_eq!(
+        disk_number("size"),
+        DISK_SECTORS,
+        "{DISK} is not the ESP disk"
+    );
+    assert_eq!(
+        disk_number("vdb2/start"),
+        ESP_START,
+        "{ESP} does not start the disk"
+    );
+    assert_eq!(disk_number("vdb2/size"), ESP_SIZE, "{ESP} is not the ESP");
+    busybox("mkdosfs", &[ESP]);
+    mount_esp();
+
+    let number = stage(BESIDE_STORES, "On", &["--image", IMAGE]);
+    // the second set appends to the pending set, which keeps its image and Boot####; its flag
+    // lifts nothing here, and its request records it
+    assert_eq!(
+        stage(REFUSED, "On", &["--i-am-fine-to-brick-this-system"]),
+        number,
+        "the second set's Boot####"
+    );
+
+    let set = staged_set();
+    assert_eq!(boot_option_number(&set), number, "{set}");
+    let requests: Vec<(&str, &str)> = set["requests"]
+        .as_array()
+        .unwrap_or_else(|| panic!("no requests: {set}"))
+        .iter()
+        .map(|request| {
+            (
+                request["question"].as_str().expect("a question"),
+                request["unsafe_operations"].as_str().expect("a grant"),
+            )
+        })
+        .collect();
+    assert_eq!(
+        requests,
+        [(BESIDE_STORES, "refuse"), (REFUSED, "allow")],
+        "{set}"
+    );
+    assert_eq!(
+        set["image"]["sha256"].as_str(),
+        Some(sha256(IMAGE).as_str()),
+        "{set}"
+    );
+    assert_eq!(sha256(STAGED_IMAGE), sha256(IMAGE), "the staged image");
+    assert_starts_staged_set(number, &nonce(&set));
+    assert_eq!(
+        staged_boot_options(),
+        [number],
+        "the Boot#### of staged sets"
+    );
+    assert_eq!(
+        record(STAGED_OUTCOME),
+        None,
+        "an outcome before any staged boot"
+    );
+
+    let pending = format!("On is staged for the next boot, as Boot{number:04X}: restart to apply");
+    assert_note(BESIDE_STORES, &pending);
+    assert_note(REFUSED, &pending);
+    unmount_esp();
+}
+
+#[test]
+fn after_the_applied_boot() {
+    require_test_vm();
+    mount_esp();
+    // uefisettings.efi deleted the set's Boot####, after the boot manager deleted BootNext; the
+    // firmware's boot after the reset would have taken its number too, as
+    // after_the_interrupted_boot tells
+    let set = staged_set();
+    assert_eq!(global_variable("BootNext"), None, "BootNext");
+    assert_eq!(
+        staged_boot_options(),
+        Vec::<u16>::new(),
+        "the Boot#### of staged sets"
+    );
+
+    let outcome = record(STAGED_OUTCOME).expect("the outcome of the staged boot");
+    assert_eq!(outcome["state"], "finished", "{outcome}");
+    assert_eq!(nonce(&outcome), nonce(&set), "{outcome}");
+    let results = outcome["results"]
+        .as_array()
+        .unwrap_or_else(|| panic!("no results: {outcome}"));
+    let [applied, refused] = results.as_slice() else {
+        panic!("not two results: {outcome}");
+    };
+    assert_eq!(applied["request"]["question"], BESIDE_STORES, "{outcome}");
+    assert_eq!(applied["applied"], true, "{outcome}");
+    assert_eq!(refused["request"]["question"], REFUSED, "{outcome}");
+    assert_eq!(refused["applied"], false, "{outcome}");
+    assert!(result(refused).contains("EFI_ACCESS_DENIED"), "{outcome}");
+    // neither lifted an unsafe operation
+    for outcome_of in [applied, refused] {
+        assert_eq!(
+            outcome_of["warnings"].as_array().map(Vec::len),
+            Some(0),
+            "{outcome}"
+        );
+    }
+    assert_note(
+        BESIDE_STORES,
+        &format!("the last staged boot applied On: {}", result(applied)),
+    );
+    assert_note(
+        REFUSED,
+        &format!("the last staged boot did not apply On: {}", result(refused)),
+    );
+    // what the driver keeps
+    assert_eq!(question_variable(BESIDE_STORES_VALUE), Some(vec![1]));
+    assert_eq!(question_variable(REFUSED_VALUE), None);
+
+    // settles the applied set, then stages a set whose image the firmware will not find
+    let next = stage(BESIDE_STORES, "Off", &["--image", IMAGE]);
+    let staged = staged_set();
+    assert_ne!(nonce(&staged), nonce(&set), "a new set's nonce");
+    assert_starts_staged_set(next, &nonce(&staged));
+    assert_eq!(staged_boot_options(), [next], "the Boot#### of staged sets");
+    fs::remove_file(STAGED_IMAGE).expect("delete the staged image");
+    unmount_esp();
+}
+
+#[test]
+fn after_the_boot_without_its_image() {
+    require_test_vm();
+    mount_esp();
+    // nothing ran to delete the set's Boot####
+    let set = staged_set();
+    let number = boot_option_number(&set);
+    assert_eq!(global_variable("BootNext"), None, "BootNext");
+    assert_starts_staged_set(number, &nonce(&set));
+    assert_eq!(
+        staged_boot_options(),
+        [number],
+        "the Boot#### of staged sets"
+    );
+    assert_note(
+        BESIDE_STORES,
+        "the last staged boot did not start uefisettings.efi, so Off is not applied",
+    );
+    assert_eq!(question_variable(BESIDE_STORES_VALUE), Some(vec![1]));
+
+    // settles the set, recording that its boot never started it, then stages the question whose
+    // Callback(CHANGED) resets the platform
+    let next = stage(RESETTING, "On", &["--image", IMAGE]);
+    let outcome = record(STAGED_OUTCOME).expect("the settled outcome");
+    assert_eq!(outcome["state"], "not-started", "{outcome}");
+    assert_eq!(nonce(&outcome), nonce(&set), "{outcome}");
+    let staged = staged_set();
+    assert_ne!(nonce(&staged), nonce(&set), "a new set's nonce");
+    // the new set's Boot#### alone, which may have the old one's number
+    assert_starts_staged_set(next, &nonce(&staged));
+    assert_eq!(staged_boot_options(), [next], "the Boot#### of staged sets");
+    unmount_esp();
+}
+
+#[test]
+fn after_the_interrupted_boot() {
+    require_test_vm();
+    mount_esp();
+    // uefisettings.efi recorded its start, then the reset came before any result or cleanup
+    let set = staged_set();
+    let outcome = record(STAGED_OUTCOME).expect("the recorded start");
+    assert_eq!(outcome["state"], "started", "{outcome}");
+    assert_eq!(nonce(&outcome), nonce(&set), "{outcome}");
+    assert_eq!(global_variable("BootNext"), None, "BootNext");
+    assert_note(
+        RESETTING,
+        "the last staged boot stopped while it applied On, which may be partly applied",
+    );
+    // the driver kept the value before it reset the platform
+    assert_eq!(question_variable(RESETTING_VALUE), Some(vec![1]));
+    // Once the boot manager deleted BootNext, nothing referenced the set's Boot####, which the
+    // firmware may then remove (UEFI 2.11 §3.1.1). The boot after the reset wrote the guest
+    // OVMF's Grub option at its number, the lowest that neither BootOrder nor BootNext holds,
+    // then removed that option, as no firmware volume holds its file (edk2-stable202402
+    // MdeModulePkg/Library/UefiBootManagerLib/BmLoadOption.c BmGetFreeOptionNumber,
+    // OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c PlatformBootManagerAfterConsole).
+    // AAVMF keeps the set's Boot####, OVMF removes it.
+    let left = staged_boot_options();
+    assert!(
+        left.is_empty() || left == [boot_option_number(&set)],
+        "the Boot#### of staged sets: {left:?}"
+    );
+
+    // settles the set, recording that its boot was interrupted
+    let next = stage(BESIDE_STORES, "Twice", &["--image", IMAGE]);
+    let outcome = record(STAGED_OUTCOME).expect("the settled outcome");
+    assert_eq!(outcome["state"], "interrupted", "{outcome}");
+    assert_eq!(nonce(&outcome), nonce(&set), "{outcome}");
+    assert_eq!(outcome["requests"][0]["question"], RESETTING, "{outcome}");
+    assert_eq!(staged_boot_options(), [next], "the Boot#### of staged sets");
+    unmount_esp();
+}
diff --git a/tests/qemu/init b/tests/qemu/init
index d2c9d79..a906537 100755
--- a/tests/qemu/init
+++ b/tests/qemu/init
@@ -34,9 +34,13 @@ mount -t sysfs sysfs /sys
 # securityfs holds the lockdown mode, which uefisettings reads before firmware memory.
 mount -t securityfs securityfs /sys/kernel/security
 mount -t devtmpfs devtmpfs /dev
-# The modules that run.sh copies, which the guest's kernel has not built in.
+# The modules that run.sh copies, which the guest's kernel has not built in, in the order of
+# their names, which run.sh numbers so that each follows those that it depends on. Those that do
+# not load fail the setup once the terminal is known.
+unloaded=
 for module in /lib/modules/*.ko; do
-    [ -e "$module" ] && insmod "$module"
+    [ -e "$module" ] || continue
+    insmod "$module" || unloaded="$unloaded ${module##*/}"
 done
 
 test=
@@ -66,6 +70,7 @@ done
 # the start line on.
 printf '\nuefisettings-qemu-test: start %s %s\n' "$test" "$filter" > "$tty"
 setup_status=0
+[ -z "$unloaded" ] || { echo "cannot load:$unloaded" > "$tty"; setup_status=1; }
 efivars=/sys/firmware/efi/efivars
 case $efivarfs in
 default) mount -t efivarfs efivarfs "$efivars" ;;
diff --git a/tests/qemu/publish-hiidb/src/callback_forms.rs b/tests/qemu/publish-hiidb/src/callback_forms.rs
new file mode 100644
index 0000000..ce5e020
--- /dev/null
+++ b/tests/qemu/publish-hiidb/src/callback_forms.rs
@@ -0,0 +1,1083 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The HII package lists that `callback-forms` registers, for the UEFI Shell scenario
+//! `shell-callback-forms` of `tests/qemu/scenarios.tsv`: UINT8 ONE_OF questions without a
+//! VarStore, with EFI_IFR_FLAG_CALLBACK, whose driver holds their value, which only
+//! EFI_HII_CONFIG_ACCESS_PROTOCOL.Callback() reaches (UEFI 2.11 §33.2.5.6). The package list of
+//! each form set but the last is registered by a handle of its own, with a vendor device path,
+//! so that the HII database keeps that path as the list's device path package and
+//! EFI_HII_CONFIG_ROUTING_PROTOCOL routes the form set's stores to the handle's
+//! EFI_HII_CONFIG_ACCESS_PROTOCOL (edk2-stable202608 HiiDatabaseDxe Database.c HiiNewPackageList,
+//! ConfigRouting.c HiiConfigRoutingExtractConfig).
+//! - [`FormSet::Plain`] declares no store; its questions ask for a platform reset in CHANGED, or
+//!   reset the platform there, for the scenario `staged-set`.
+//! - [`FormSet::Stores`] declares an EFI variable store and a 5-byte Buffer store, kept in the
+//!   EFI variable of its name, whose byte 4 ExtractConfig() answers with the count of its
+//!   calls, as a driver answers with data that is no setting; its questions' Callback()s keep
+//!   the value in a variable of their own, overwrite a store, refuse in CHANGING, fail in
+//!   CHANGED, ask for a save or a reconnection, answer RETRIEVE with a reset value or with
+//!   EFI_UNSUPPORTED. A driver binding starts on its handle, for the reconnection.
+//! - [`FormSet::Unreachable`] declares a Buffer store that its ExtractConfig() never answers.
+//! - [`FormSet::Driverless`] is registered by no handle.
+//! - [`FormSet::Password`], which `callback-forms-password` registers, declares a Buffer store
+//!   with a PASSWORD question; its questions' CHANGED overwrites the store's other setting or
+//!   the password.
+//! - [`FormSet::DisabledPassword`], which `callback-forms-password` registers too, declares a
+//!   Buffer store whose PASSWORD question is in a second form, which a CHECKBOX op shorter than
+//!   its minimum disables (UEFI 2.11 §33.2.5.10.1).
+//!
+//! Every Callback(), ExtractConfig(), RouteConfig() and driver binding Start() prints a line,
+//! which `shell/callback-forms.tsv` checks.
+
+use alloc::boxed::Box;
+use alloc::format;
+use alloc::string::String;
+use alloc::string::ToString;
+use alloc::vec::Vec;
+use core::ffi::c_void;
+use core::ptr;
+use core::sync::atomic::AtomicPtr;
+use core::sync::atomic::AtomicU8;
+use core::sync::atomic::Ordering;
+
+use uefi::boot;
+use uefi::boot::OpenProtocolAttributes;
+use uefi::boot::OpenProtocolParams;
+use uefi::cstr16;
+use uefi::guid;
+use uefi::println;
+use uefi::proto::unsafe_protocol;
+use uefi::runtime;
+use uefi::runtime::ResetType;
+use uefi::runtime::VariableAttributes;
+use uefi::runtime::VariableVendor;
+use uefi::CStr16;
+use uefi::CString16;
+use uefi::Guid;
+use uefi::Status;
+use uefi::StatusExt;
+use uefi_raw::protocol::device_path::DevicePathProtocol;
+use uefi_raw::protocol::driver::DriverBindingProtocol;
+use uefi_raw::protocol::hii::config::BrowserAction;
+use uefi_raw::protocol::hii::config::HiiConfigAccessProtocol;
+use uefi_raw::protocol::hii::config::HiiConfigRoutingProtocol;
+use uefi_raw::protocol::hii::form_browser::BrowserActionRequest;
+use uefi_raw::protocol::hii::ifr::IfrTypeValue;
+use uefi_raw::Char16;
+
+use crate::driver_handle;
+use crate::driver_handle::vendor_device_path;
+use crate::hii_package::end;
+use crate::hii_package::op;
+use crate::hii_package::package;
+use crate::hii_package::package_list;
+use crate::hii_package::strings_package;
+use crate::hii_package::EFI_HII_PACKAGE_FORMS;
+use crate::hii_package::EFI_IFR_CHECKBOX_OP;
+use crate::hii_package::EFI_IFR_FORM_OP;
+use crate::hii_package::EFI_IFR_FORM_SET_OP;
+use crate::hii_package::EFI_IFR_NUMERIC_OP;
+use crate::hii_package::EFI_IFR_ONE_OF_OP;
+use crate::hii_package::EFI_IFR_ONE_OF_OPTION_OP;
+use crate::hii_package::EFI_IFR_PASSWORD_OP;
+use crate::hii_package::EFI_IFR_VARSTORE_EFI_OP;
+use crate::hii_package::EFI_IFR_VARSTORE_OP;
+use crate::Failure;
+use crate::RawHiiDatabase;
+
+/// The vendor GUID of the stores and of the questions' variables, which the tests own.
+const VENDOR: Guid = guid!("de145b29-c3cd-455f-91de-a76237b67c52");
+/// The Attributes of every variable here: non-volatile, boot service and runtime access.
+const NV_BS_RT: VariableAttributes = VariableAttributes::NON_VOLATILE
+    .union(VariableAttributes::BOOTSERVICE_ACCESS)
+    .union(VariableAttributes::RUNTIME_ACCESS);
+
+/// The EFI variable store of [`FormSet::Stores`], and its value before any question
+/// overwrites it.
+const EFI_STORE: &CStr16 = cstr16!("CallbackStore");
+const EFI_STORE_INITIAL: [u8; 4] = [0x5A; 4];
+const EFI_STORE_ID: u16 = 1;
+/// The VarStoreIds of the Buffer stores of [`FormSet::Stores`], [`FormSet::Unreachable`],
+/// [`FormSet::Password`] and [`FormSet::DisabledPassword`].
+const BUFFER_STORE_ID: u16 = 2;
+const UNREACHABLE_STORE_ID: u16 = 3;
+const PASSWORD_STORE_ID: u16 = 5;
+const DISABLED_PASSWORD_STORE_ID: u16 = 6;
+
+/// A Buffer store that ExtractConfig() and RouteConfig() here serve, kept in the EFI variable of
+/// its name.
+struct BufferStore {
+    name: &'static CStr16,
+    /// The device path of the handle whose form set declares it
+    path: &'static [u8],
+    initial: &'static [u8],
+    /// The byte that ExtractConfig() answers with the count of its calls, whatever the variable
+    /// holds there
+    counted: Option<usize>,
+}
+
+/// The Buffer store of [`FormSet::Stores`]: a UINT32 setting at byte 0 and the call count at
+/// byte 4.
+static CALLBACK_BUFFER: BufferStore = BufferStore {
+    name: cstr16!("CallbackBuffer"),
+    path: &STORES_PATH,
+    initial: &[0xA5, 0xA5, 0xA5, 0xA5, 0],
+    counted: Some(4),
+};
+/// The Buffer store of [`FormSet::Password`]: a password of 2 CHAR16 at byte 0 and a UINT8
+/// setting at byte 4.
+static PASSWORD_BUFFER: BufferStore = BufferStore {
+    name: cstr16!("CallbackPassword"),
+    path: &PASSWORD_PATH,
+    initial: &[0x11, 0x22, 0x33, 0x44, 0x07],
+    counted: None,
+};
+static BUFFER_STORES: [&BufferStore; 2] = [&CALLBACK_BUFFER, &PASSWORD_BUFFER];
+
+/// The calls of ExtractConfig() of [`CALLBACK_BUFFER`].
+static EXTRACTIONS: AtomicU8 = AtomicU8::new(0);
+/// The handle of [`FormSet::Stores`], the one controller of the driver binding.
+static STORES_HANDLE: AtomicPtr<c_void> = AtomicPtr::new(ptr::null_mut());
+
+/// EFI_IFR_FLAG_CALLBACK and EFI_IFR_FLAG_RESET_REQUIRED (UEFI 2.11 §33.3.8.2.2).
+const EFI_IFR_FLAG_CALLBACK: u8 = 0x04;
+const EFI_IFR_FLAG_RESET_REQUIRED: u8 = 0x10;
+/// EFI_IFR_NUMERIC_SIZE_1 and _4 with EFI_IFR_DISPLAY_UINT_DEC (UEFI 2.11 §33.3.8.3.47).
+const UINT8_DECIMAL: u8 = 0x10;
+const UINT32_DECIMAL: u8 = 0x12;
+/// EFI_IFR_TYPE_NUM_SIZE_8, the Type of a UINT8 EFI_IFR_ONE_OF_OPTION.
+const NUM_SIZE_8: u8 = 0x00;
+
+// The strings, from string ID 2, after the language name, then the prompt of each question.
+const TITLE: u16 = 2;
+const HELP: u16 = 3;
+const OFF: u16 = 4;
+const ON: u16 = 5;
+const TWICE: u16 = 6;
+const COMMON_STRINGS: [&str; 6] = [
+    "English",
+    "uefisettings QEMU callback forms",
+    "Questions whose driver holds their value",
+    "Off",
+    "On",
+    "Twice",
+];
+
+/// The form sets, each in a package list of its own.
+#[derive(Clone, Copy, PartialEq)]
+enum FormSet {
+    Plain,
+    Stores,
+    Unreachable,
+    Driverless,
+    Password,
+    DisabledPassword,
+}
+
+/// The form sets that `callback-forms` registers, and those of `callback-forms-password`, apart
+/// as a PASSWORD question has uefisettings.efi refuse every set without
+/// --i-am-fine-to-brick-this-system.
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum Forms {
+    Callbacks,
+    Password,
+}
+
+impl Forms {
+    fn form_sets(self) -> &'static [FormSet] {
+        match self {
+            Self::Callbacks => &[
+                FormSet::Plain,
+                FormSet::Stores,
+                FormSet::Unreachable,
+                FormSet::Driverless,
+            ],
+            Self::Password => &[FormSet::Password, FormSet::DisabledPassword],
+        }
+    }
+}
+
+impl FormSet {
+    /// The GUID of the form set and of its package list.
+    const fn guid(self) -> Guid {
+        match self {
+            Self::Plain => guid!("8c78a505-baa0-4c4a-869f-000000000210"),
+            Self::Stores => guid!("8c78a505-baa0-4c4a-869f-000000000211"),
+            Self::Unreachable => guid!("8c78a505-baa0-4c4a-869f-000000000202"),
+            Self::Driverless => guid!("8c78a505-baa0-4c4a-869f-000000000203"),
+            Self::Password => guid!("8c78a505-baa0-4c4a-869f-000000000204"),
+            Self::DisabledPassword => guid!("8c78a505-baa0-4c4a-869f-000000001a14"),
+        }
+    }
+
+    /// The device path of the handle that registers it, and its EFI_HII_CONFIG_ACCESS_PROTOCOL;
+    /// None for [`FormSet::Driverless`].
+    fn driver(self) -> Option<(&'static [u8], &'static HiiConfigAccessProtocol)> {
+        match self {
+            Self::Plain => Some((&PLAIN_PATH[..], &PLAIN_ACCESS)),
+            Self::Stores => Some((&STORES_PATH[..], &STORES_ACCESS)),
+            Self::Unreachable => Some((&UNREACHABLE_PATH[..], &UNREACHABLE_ACCESS)),
+            Self::Driverless => None,
+            Self::Password => Some((&PASSWORD_PATH[..], &STORES_ACCESS)),
+            Self::DisabledPassword => Some((&DISABLED_PASSWORD_PATH[..], &PLAIN_ACCESS)),
+        }
+    }
+}
+
+/// What a question's Callback() does.
+#[derive(Clone, Copy, PartialEq)]
+enum Behavior {
+    /// RETRIEVE reads, and CHANGED writes, the question's own variable
+    Own,
+    /// As Own, and CHANGED asks for EFI_BROWSER_ACTION_REQUEST_RESET
+    OwnAskingReset,
+    /// As Own, and CHANGED then resets the platform, so that it never returns
+    OwnResetting,
+    /// As Own, and CHANGED asks for EFI_BROWSER_ACTION_REQUEST_SUBMIT
+    OwnAskingSave,
+    /// As Own, and CHANGED asks for EFI_BROWSER_ACTION_REQUEST_RECONNECT
+    OwnAskingReconnect,
+    /// As Own, but RETRIEVE answers 0, a reset value
+    Transient,
+    /// As Own, but RETRIEVE returns EFI_UNSUPPORTED
+    NoReadBack,
+    /// CHANGED overwrites the EFI variable store
+    OverwritesEfiStore,
+    /// CHANGED overwrites the setting of the Buffer store
+    OverwritesBufferStore,
+    /// CHANGED overwrites the setting beside the password of the password's Buffer store
+    OverwritesPasswordStore,
+    /// CHANGED overwrites the password of the password's Buffer store
+    OverwritesPassword,
+    /// CHANGING returns EFI_ACCESS_DENIED
+    RefusedInChanging,
+    /// CHANGED returns EFI_DEVICE_ERROR
+    FailsInChanged,
+}
+
+/// A question without a VarStore: its QuestionId, form set, prompt and Callback().
+struct Question {
+    id: u16,
+    form_set: FormSet,
+    prompt: &'static str,
+    behavior: Behavior,
+}
+
+const QUESTIONS: [Question; 16] = [
+    Question {
+        id: 0x0101,
+        form_set: FormSet::Plain,
+        prompt: "Callback value asking for a reset",
+        behavior: Behavior::OwnAskingReset,
+    },
+    Question {
+        id: 0x0102,
+        form_set: FormSet::Plain,
+        prompt: "Callback value resetting the platform",
+        behavior: Behavior::OwnResetting,
+    },
+    Question {
+        id: 0x0201,
+        form_set: FormSet::Stores,
+        prompt: "Callback value beside stores",
+        behavior: Behavior::Own,
+    },
+    Question {
+        id: 0x0202,
+        form_set: FormSet::Stores,
+        prompt: "Callback value overwriting its EFI variable store",
+        behavior: Behavior::OverwritesEfiStore,
+    },
+    Question {
+        id: 0x0203,
+        form_set: FormSet::Stores,
+        prompt: "Callback value overwriting its Buffer store",
+        behavior: Behavior::OverwritesBufferStore,
+    },
+    Question {
+        id: 0x0204,
+        form_set: FormSet::Stores,
+        prompt: "Callback value refused in CHANGING",
+        behavior: Behavior::RefusedInChanging,
+    },
+    Question {
+        id: 0x0205,
+        form_set: FormSet::Stores,
+        prompt: "Callback value failing in CHANGED",
+        behavior: Behavior::FailsInChanged,
+    },
+    Question {
+        id: 0x0206,
+        form_set: FormSet::Stores,
+        prompt: "Callback value asking for a save",
+        behavior: Behavior::OwnAskingSave,
+    },
+    Question {
+        id: 0x0207,
+        form_set: FormSet::Stores,
+        prompt: "Callback value asking for a reconnection",
+        behavior: Behavior::OwnAskingReconnect,
+    },
+    Question {
+        id: 0x0208,
+        form_set: FormSet::Stores,
+        prompt: "Transient callback value",
+        behavior: Behavior::Transient,
+    },
+    Question {
+        id: 0x0209,
+        form_set: FormSet::Stores,
+        prompt: "Callback value without read-back",
+        behavior: Behavior::NoReadBack,
+    },
+    Question {
+        id: 0x0301,
+        form_set: FormSet::Unreachable,
+        prompt: "Callback value beside an unreachable store",
+        behavior: Behavior::Own,
+    },
+    Question {
+        id: 0x0401,
+        form_set: FormSet::Driverless,
+        prompt: "Callback value without a driver",
+        behavior: Behavior::Own,
+    },
+    Question {
+        id: 0x0501,
+        form_set: FormSet::Password,
+        prompt: "Callback value beside a password",
+        behavior: Behavior::OverwritesPasswordStore,
+    },
+    Question {
+        id: 0x0502,
+        form_set: FormSet::Password,
+        prompt: "Callback value over a password",
+        behavior: Behavior::OverwritesPassword,
+    },
+    Question {
+        id: 0x0601,
+        form_set: FormSet::DisabledPassword,
+        prompt: "Callback value beside a disabled password",
+        behavior: Behavior::Own,
+    },
+];
+
+static PLAIN_PATH: [u8; 24] = vendor_device_path(FormSet::Plain.guid());
+static STORES_PATH: [u8; 24] = vendor_device_path(FormSet::Stores.guid());
+static UNREACHABLE_PATH: [u8; 24] = vendor_device_path(FormSet::Unreachable.guid());
+static PASSWORD_PATH: [u8; 24] = vendor_device_path(FormSet::Password.guid());
+static DISABLED_PASSWORD_PATH: [u8; 24] = vendor_device_path(FormSet::DisabledPassword.guid());
+
+static PLAIN_ACCESS: HiiConfigAccessProtocol = HiiConfigAccessProtocol {
+    extract_config: extract_nothing,
+    route_config: route_nothing,
+    callback,
+};
+static STORES_ACCESS: HiiConfigAccessProtocol = HiiConfigAccessProtocol {
+    extract_config: extract_buffer_stores,
+    route_config: route_buffer_stores,
+    callback,
+};
+static UNREACHABLE_ACCESS: HiiConfigAccessProtocol = HiiConfigAccessProtocol {
+    extract_config: extract_nothing,
+    route_config: route_nothing,
+    callback,
+};
+
+/// EFI_HII_CONFIG_ROUTING_PROTOCOL, whose BlockToConfig() and ConfigToBlock() the uefi crate
+/// does not wrap.
+#[repr(transparent)]
+#[unsafe_protocol(HiiConfigRoutingProtocol::GUID)]
+struct RawConfigRouting(HiiConfigRoutingProtocol);
+
+/// Gives the stores their initial values if they have none, registers each form set of
+/// `forms`, and installs the driver binding of [`FormSet::Stores`]'s handle.
+pub(crate) fn register(forms: Forms) -> Result<(), Failure> {
+    let vendor = VariableVendor(VENDOR);
+    let buffers = BUFFER_STORES
+        .iter()
+        .map(|store| (store.name, store.initial));
+    for (name, initial) in [(EFI_STORE, &EFI_STORE_INITIAL[..])]
+        .into_iter()
+        .chain(buffers)
+    {
+        match runtime::get_variable(name, &vendor, &mut [0; 8]) {
+            Ok(_) => {}
+            Err(error) if error.status() == Status::NOT_FOUND => {
+                runtime::set_variable(name, &vendor, NV_BS_RT, initial)
+                    .map_err(|error| ("initializing a store", error.status()))?;
+            }
+            Err(error) => return Err(("reading a store", error.status())),
+        }
+    }
+
+    let database = boot::get_handle_for_protocol::<RawHiiDatabase>()
+        .and_then(boot::open_protocol_exclusive::<RawHiiDatabase>)
+        .map_err(|error| ("opening the HII database", error.status()))?;
+    for &form_set in forms.form_sets() {
+        let handle = match form_set.driver() {
+            Some((path, access)) => {
+                let handle = driver_handle::install(path, access)?;
+                if form_set == FormSet::Stores {
+                    STORES_HANDLE.store(handle.as_ptr(), Ordering::Release);
+                }
+                handle.as_ptr()
+            }
+            None => ptr::null_mut(),
+        };
+        let list = package_list(
+            form_set.guid(),
+            &[strings_package(strings(form_set)), form_package(form_set)],
+        );
+        let mut hii_handle = ptr::null_mut();
+        #[expect(
+            unsafe_code,
+            reason = "the uefi crate does not wrap NewPackageList(), a function of the protocol"
+        )]
+        // SAFETY: `database` is the protocol that the firmware installed, which stays open while
+        // the call runs; `list` is a whole package list, which the database copies; the driver
+        // handle is one installed above, or NULL, which NewPackageList() takes (UEFI 2.11
+        // §34.8.2); `hii_handle` is a valid place for the new HII handle.
+        let status = unsafe {
+            (database.0.new_package_list)(
+                &database.0,
+                list.as_ptr().cast(),
+                handle,
+                &mut hii_handle,
+            )
+        };
+        status
+            .to_result()
+            .map_err(|error| ("registering a callback form set", error.status()))?;
+    }
+
+    let image = boot::image_handle().as_ptr();
+    let binding = Box::leak(Box::new(DriverBindingProtocol {
+        supported,
+        start,
+        stop,
+        version: 0x10,
+        image_handle: image,
+        driver_binding_handle: image,
+    }));
+    #[expect(
+        unsafe_code,
+        reason = "installs a protocol whose interface this resident driver leaks"
+    )]
+    // SAFETY: the protocol lives as long as this resident boot service driver, which leaks it
+    unsafe {
+        boot::install_protocol_interface(
+            Some(boot::image_handle()),
+            &DriverBindingProtocol::GUID,
+            ptr::from_mut(binding).cast(),
+        )
+    }
+    .map_err(|error| ("installing EFI_DRIVER_BINDING_PROTOCOL", error.status()))?;
+    Ok(())
+}
+
+/// The strings package of `form_set`: the common strings, then the prompt of each of its
+/// questions and storage settings.
+fn strings(form_set: FormSet) -> Vec<&'static str> {
+    let prompts = QUESTIONS
+        .iter()
+        .filter(|question| question.form_set == form_set)
+        .map(|question| question.prompt);
+    let settings: &[&str] = match form_set {
+        FormSet::Stores => &["Buffer setting", "Buffer call count"],
+        FormSet::Unreachable => &["Unreachable store setting"],
+        FormSet::Password => &["Password", "Password store setting"],
+        FormSet::DisabledPassword => &["Disabled password"],
+        FormSet::Plain | FormSet::Driverless => &[],
+    };
+    COMMON_STRINGS
+        .into_iter()
+        .chain(prompts)
+        .chain(settings.iter().copied())
+        .collect()
+}
+
+/// The form package of `form_set`: the form set, its stores, and one form with its questions,
+/// then its storage settings, whose prompts follow those of the questions in [`strings`]; for
+/// [`FormSet::DisabledPassword`], its PASSWORD question in a second form, which a CHECKBOX op of
+/// 3 bytes, shorter than any CHECKBOX, disables (UEFI 2.11 §33.2.5.10.1).
+fn form_package(form_set: FormSet) -> Vec<u8> {
+    let form_set_op = [
+        &form_set.guid().to_bytes()[..],
+        &TITLE.to_le_bytes(),
+        &HELP.to_le_bytes(),
+        &[1],        // Flags: one ClassGuid
+        &[0x22; 16], // ClassGuid
+    ]
+    .concat();
+    let questions: Vec<&Question> = QUESTIONS
+        .iter()
+        .filter(|question| question.form_set == form_set)
+        .collect();
+    let mut prompt = u16::try_from(COMMON_STRINGS.len()).expect("a few strings") + 1;
+    let mut body = Vec::new();
+    for question in &questions {
+        let flags = match question.behavior {
+            Behavior::OwnAskingReset => EFI_IFR_FLAG_CALLBACK | EFI_IFR_FLAG_RESET_REQUIRED,
+            _ => EFI_IFR_FLAG_CALLBACK,
+        };
+        body.extend(one_of(question.id, prompt, flags));
+        prompt += 1;
+    }
+    let (stores, settings) = match form_set {
+        FormSet::Stores => (
+            [
+                op(
+                    EFI_IFR_VARSTORE_EFI_OP,
+                    false,
+                    &[
+                        &EFI_STORE_ID.to_le_bytes()[..],
+                        &VENDOR.to_bytes(),
+                        &NV_BS_RT.bits().to_le_bytes(),
+                        &4u16.to_le_bytes(), // Size
+                        b"CallbackStore\0",
+                    ]
+                    .concat(),
+                ),
+                buffer_store(BUFFER_STORE_ID, 5, b"CallbackBuffer\0"),
+            ]
+            .concat(),
+            [
+                numeric(0x0210, prompt, BUFFER_STORE_ID, 0, UINT32_DECIMAL),
+                numeric(0x0211, prompt + 1, BUFFER_STORE_ID, 4, UINT8_DECIMAL),
+            ]
+            .concat(),
+        ),
+        FormSet::Unreachable => (
+            buffer_store(UNREACHABLE_STORE_ID, 1, b"CallbackUnreachable\0"),
+            numeric(0x0310, prompt, UNREACHABLE_STORE_ID, 0, UINT8_DECIMAL),
+        ),
+        FormSet::Password => (
+            buffer_store(PASSWORD_STORE_ID, 5, b"CallbackPassword\0"),
+            [
+                password(0x0510, prompt, PASSWORD_STORE_ID, 0),
+                numeric(0x0511, prompt + 1, PASSWORD_STORE_ID, 4, UINT8_DECIMAL),
+            ]
+            .concat(),
+        ),
+        FormSet::DisabledPassword => (
+            buffer_store(DISABLED_PASSWORD_STORE_ID, 4, b"CallbackDisabledPassword\0"),
+            Vec::new(),
+        ),
+        FormSet::Plain | FormSet::Driverless => (Vec::new(), Vec::new()),
+    };
+    let disabled_form = match form_set {
+        FormSet::DisabledPassword => [
+            op(
+                EFI_IFR_FORM_OP,
+                true,
+                &[2u16.to_le_bytes(), TITLE.to_le_bytes()].concat(),
+            ),
+            password(0x0610, prompt, DISABLED_PASSWORD_STORE_ID, 0),
+            op(EFI_IFR_CHECKBOX_OP, false, &[0x00]),
+            end(),
+        ]
+        .concat(),
+        FormSet::Plain
+        | FormSet::Stores
+        | FormSet::Unreachable
+        | FormSet::Driverless
+        | FormSet::Password => Vec::new(),
+    };
+    let form = [1u16.to_le_bytes(), TITLE.to_le_bytes()].concat();
+    let body = [
+        op(EFI_IFR_FORM_SET_OP, true, &form_set_op),
+        stores,
+        op(EFI_IFR_FORM_OP, true, &form),
+        body,
+        settings,
+        end(), // of the form
+        disabled_form,
+        end(), // of the form set
+    ]
+    .concat();
+    package(EFI_HII_PACKAGE_FORMS, &body)
+}
+
+/// The Buffer VARSTORE `id` of `size` bytes and NUL-terminated ASCII `name`.
+fn buffer_store(id: u16, size: u16, name: &[u8]) -> Vec<u8> {
+    op(
+        EFI_IFR_VARSTORE_OP,
+        false,
+        &[
+            &VENDOR.to_bytes()[..],
+            &id.to_le_bytes(),
+            &size.to_le_bytes(),
+            name,
+        ]
+        .concat(),
+    )
+}
+
+/// EFI_IFR_QUESTION_HEADER: Prompt, Help, QuestionId, VarStoreId, VarStoreInfo and Flags.
+fn question_header(id: u16, prompt: u16, var_store: u16, info: u16, flags: u8) -> Vec<u8> {
+    [
+        &prompt.to_le_bytes()[..],
+        &HELP.to_le_bytes(),
+        &id.to_le_bytes(),
+        &var_store.to_le_bytes(),
+        &info.to_le_bytes(),
+        &[flags],
+    ]
+    .concat()
+}
+
+/// A UINT8 ONE_OF without a VarStore (VarStoreId 0 and VarStoreInfo 0xFFFF, as VfrCompile
+/// emits one), of the options Off, On and Twice.
+fn one_of(id: u16, prompt: u16, flags: u8) -> Vec<u8> {
+    [
+        op(
+            EFI_IFR_ONE_OF_OP,
+            true,
+            &[
+                question_header(id, prompt, 0, 0xFFFF, flags),
+                // Flags, MinValue, MaxValue, Step
+                [UINT8_DECIMAL, 0, 2, 0].to_vec(),
+            ]
+            .concat(),
+        ),
+        option(OFF, 0),
+        option(ON, 1),
+        option(TWICE, 2),
+        end(),
+    ]
+    .concat()
+}
+
+/// A NUMERIC at byte `offset` of the Buffer store `var_store`, of the size and display of
+/// `flags`, EFI_IFR_NUMERIC_SIZE_1 or _4.
+fn numeric(id: u16, prompt: u16, var_store: u16, offset: u16, flags: u8) -> Vec<u8> {
+    let range = match flags {
+        UINT32_DECIMAL => [
+            0u32.to_le_bytes(),
+            u32::MAX.to_le_bytes(),
+            1u32.to_le_bytes(),
+        ]
+        .concat(),
+        _ => [0, u8::MAX, 1].to_vec(),
+    };
+    [
+        op(
+            EFI_IFR_NUMERIC_OP,
+            true,
+            &[
+                question_header(id, prompt, var_store, offset, 0),
+                [flags].to_vec(),
+                range,
+            ]
+            .concat(),
+        ),
+        end(),
+    ]
+    .concat()
+}
+
+/// A PASSWORD of 2 CHAR16 at byte `offset` of the Buffer store `var_store`, without
+/// EFI_IFR_FLAG_CALLBACK, which a forms browser writes to the store (UEFI 2.11 §33.3.8.3.54).
+fn password(id: u16, prompt: u16, var_store: u16, offset: u16) -> Vec<u8> {
+    let data = [
+        question_header(id, prompt, var_store, offset, 0),
+        [1u16.to_le_bytes(), 2u16.to_le_bytes()].concat(), // MinSize, MaxSize
+    ]
+    .concat();
+    op(EFI_IFR_PASSWORD_OP, false, &data)
+}
+
+/// A UINT8 EFI_IFR_ONE_OF_OPTION of `text` and `value`.
+fn option(text: u16, value: u8) -> Vec<u8> {
+    let data = [&text.to_le_bytes()[..], &[0, NUM_SIZE_8, value]].concat();
+    op(EFI_IFR_ONE_OF_OPTION_OP, false, &data)
+}
+
+/// The NUL-terminated UCS-2 string at `text`, which a caller passed.
+#[expect(unsafe_code, reason = "reads a string that firmware passed")]
+fn caller_string(text: *const Char16) -> String {
+    // SAFETY: the callers pass a NUL-terminated UCS-2 string that outlives the call
+    unsafe { CStr16::from_ptr(text.cast()) }.to_string()
+}
+
+impl BufferStore {
+    /// Its `<ConfigHdr>` (UEFI 2.11 §35.2.1), in lower case: GUID and NAME as its bytes and
+    /// characters in hex, PATH as the bytes of its handle's device path.
+    fn header(&self) -> String {
+        let guid: String = VENDOR
+            .to_bytes()
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect();
+        let name: String = self
+            .name
+            .iter()
+            .map(|unit| format!("{:04x}", u16::from(*unit)))
+            .collect();
+        let path: String = self.path.iter().map(|byte| format!("{byte:02x}")).collect();
+        format!("guid={guid}&name={name}&path={path}")
+    }
+
+    /// The store that `config`, a `<ConfigRequest>` or `<ConfigResp>`, names.
+    fn named_by(config: &str) -> Option<&'static Self> {
+        BUFFER_STORES.iter().copied().find(|store| {
+            let header = store.header();
+            config
+                .get(..header.len())
+                .is_some_and(|start| start.eq_ignore_ascii_case(&header))
+                && config
+                    .as_bytes()
+                    .get(header.len())
+                    .is_none_or(|&c| c == b'&')
+        })
+    }
+
+    /// Its bytes, from its variable.
+    fn read(&self) -> Result<Vec<u8>, Status> {
+        let mut data = [0; 8];
+        match runtime::get_variable(self.name, &VariableVendor(VENDOR), &mut data) {
+            Ok((read, _)) if read.len() == self.initial.len() => Ok(read.to_vec()),
+            Ok(_) => Err(Status::BAD_BUFFER_SIZE),
+            Err(error) => Err(error.status()),
+        }
+    }
+}
+
+/// The firmware's EFI_HII_CONFIG_ROUTING_PROTOCOL, opened GetProtocol while `run` runs.
+fn with_routing(run: impl FnOnce(&HiiConfigRoutingProtocol) -> Status) -> Status {
+    let Ok(handle) = boot::get_handle_for_protocol::<RawConfigRouting>() else {
+        return Status::NOT_FOUND;
+    };
+    let params = OpenProtocolParams {
+        handle,
+        agent: boot::image_handle(),
+        controller: None,
+    };
+    #[expect(unsafe_code, reason = "opens a protocol non-exclusively")]
+    // SAFETY: the HII database driver installs the protocol and uninstalls it nowhere
+    // (edk2-stable202608 HiiDatabaseDxe HiiDatabaseEntry.c)
+    let routing = unsafe {
+        boot::open_protocol::<RawConfigRouting>(params, OpenProtocolAttributes::GetProtocol)
+    };
+    match routing.as_ref().ok().and_then(|routing| routing.get()) {
+        Some(routing) => run(&routing.0),
+        None => Status::NOT_FOUND,
+    }
+}
+
+/// ExtractConfig() of a form set whose stores it does not answer.
+#[expect(unsafe_code, reason = "a protocol function that firmware calls")]
+unsafe extern "efiapi" fn extract_nothing(
+    _this: *const HiiConfigAccessProtocol,
+    request: *const Char16,
+    progress: *mut *const Char16,
+    _results: *mut *mut Char16,
+) -> Status {
+    if progress.is_null() {
+        return Status::INVALID_PARAMETER;
+    }
+    // SAFETY: the caller's valid out pointer
+    unsafe { *progress = request };
+    if !request.is_null() {
+        println!(
+            "callback-forms: ExtractConfig unanswered {}",
+            caller_string(request)
+        );
+    }
+    Status::NOT_FOUND
+}
+
+#[expect(unsafe_code, reason = "a protocol function that firmware calls")]
+unsafe extern "efiapi" fn route_nothing(
+    _this: *const HiiConfigAccessProtocol,
+    configuration: *const Char16,
+    progress: *mut *const Char16,
+) -> Status {
+    if configuration.is_null() || progress.is_null() {
+        return Status::INVALID_PARAMETER;
+    }
+    // SAFETY: the caller's valid out pointer
+    unsafe { *progress = configuration };
+    Status::NOT_FOUND
+}
+
+/// ExtractConfig() of a Buffer store of [`BUFFER_STORES`]: the requested settings of its
+/// variable, with the call count as its counted byte, through BlockToConfig(). A NULL request,
+/// which asks for every store, finds none: the HII database then requests the IFR's settings
+/// (edk2-stable202608 ConfigRouting.c HiiConfigRoutingExportConfig).
+#[expect(unsafe_code, reason = "a protocol function that firmware calls")]
+unsafe extern "efiapi" fn extract_buffer_stores(
+    _this: *const HiiConfigAccessProtocol,
+    request: *const Char16,
+    progress: *mut *const Char16,
+    results: *mut *mut Char16,
+) -> Status {
+    if progress.is_null() || results.is_null() {
+        return Status::INVALID_PARAMETER;
+    }
+    // SAFETY: the caller's valid out pointer
+    unsafe { *progress = request };
+    if request.is_null() {
+        return Status::NOT_FOUND;
+    }
+    let text = caller_string(request);
+    let Some(store) = BufferStore::named_by(&text) else {
+        return Status::NOT_FOUND;
+    };
+    let mut bytes = match store.read() {
+        Ok(bytes) => bytes,
+        Err(status) => return status,
+    };
+    if let Some(counted) = store.counted {
+        bytes[counted] = EXTRACTIONS.fetch_add(1, Ordering::Relaxed).wrapping_add(1);
+    }
+    let mut block_progress = ptr::null();
+    let status = with_routing(|routing| {
+        // SAFETY: the caller's NUL-terminated <ConfigRequest>, the store's bytes, and valid out
+        // pointers
+        unsafe {
+            (routing.block_to_config)(
+                routing,
+                request,
+                bytes.as_ptr(),
+                bytes.len(),
+                results,
+                &mut block_progress,
+            )
+        }
+    });
+    if status.is_success() {
+        // SAFETY: as above; the end of the caller's string, which BlockToConfig() reached
+        unsafe { *progress = request.add(text.encode_utf16().count()) };
+    }
+    println!("callback-forms: ExtractConfig {text}: {status:?}");
+    status
+}
+
+/// RouteConfig() of a Buffer store of [`BUFFER_STORES`]: ConfigToBlock() into its variable.
+#[expect(unsafe_code, reason = "a protocol function that firmware calls")]
+unsafe extern "efiapi" fn route_buffer_stores(
+    _this: *const HiiConfigAccessProtocol,
+    configuration: *const Char16,
+    progress: *mut *const Char16,
+) -> Status {
+    if configuration.is_null() || progress.is_null() {
+        return Status::INVALID_PARAMETER;
+    }
+    // SAFETY: the caller's valid out pointer
+    unsafe { *progress = configuration };
+    let text = caller_string(configuration);
+    let Some(store) = BufferStore::named_by(&text) else {
+        return Status::NOT_FOUND;
+    };
+    let mut bytes = match store.read() {
+        Ok(bytes) => bytes,
+        Err(status) => return status,
+    };
+    let mut size = bytes.len();
+    let status = with_routing(|routing| {
+        // SAFETY: the caller's NUL-terminated <ConfigResp>, the store's bytes and their size,
+        // and the caller's valid out pointer
+        unsafe {
+            (routing.config_to_block)(
+                routing,
+                configuration,
+                bytes.as_mut_ptr(),
+                &mut size,
+                progress,
+            )
+        }
+    });
+    let status = match status.is_success() {
+        true => write_variable(store.name, &bytes),
+        false => status,
+    };
+    println!("callback-forms: RouteConfig {text}: {status:?}");
+    status
+}
+
+/// Writes `bytes` over those at `offset` of `store`.
+fn overwrite(store: &BufferStore, offset: usize, bytes: &[u8]) -> Status {
+    match store.read() {
+        Ok(mut data) => {
+            data[offset..offset + bytes.len()].copy_from_slice(bytes);
+            write_variable(store.name, &data)
+        }
+        Err(status) => status,
+    }
+}
+
+/// The variable of question `id`, which holds its value.
+fn own_variable(id: u16) -> CString16 {
+    CString16::try_from(format!("CallbackValue{id:04X}").as_str()).expect("an ASCII name")
+}
+
+/// Writes `data` to the variable `name`.
+fn write_variable(name: &CStr16, data: &[u8]) -> Status {
+    match runtime::set_variable(name, &VariableVendor(VENDOR), NV_BS_RT, data) {
+        Ok(()) => Status::SUCCESS,
+        Err(error) => error.status(),
+    }
+}
+
+/// What Callback(`action`) of `question` with `value` returns: its status, ActionRequest and
+/// value.
+fn respond(
+    question: &Question,
+    action: BrowserAction,
+    value: u8,
+) -> (Status, BrowserActionRequest, u8) {
+    let vendor = VariableVendor(VENDOR);
+    let own = own_variable(question.id);
+    let none = BrowserActionRequest::NONE;
+    match (action, question.behavior) {
+        (BrowserAction::RETRIEVE, Behavior::Transient) => (Status::SUCCESS, none, 0),
+        (BrowserAction::RETRIEVE, Behavior::NoReadBack) => (Status::UNSUPPORTED, none, value),
+        (BrowserAction::RETRIEVE, _) => {
+            let mut data = [0; 1];
+            match runtime::get_variable(&own, &vendor, &mut data) {
+                Ok(_) => (Status::SUCCESS, none, data[0]),
+                Err(error) if error.status() == Status::NOT_FOUND => (Status::SUCCESS, none, 0),
+                Err(error) => (error.status(), none, value),
+            }
+        }
+        (BrowserAction::CHANGING, Behavior::RefusedInChanging) => {
+            (Status::ACCESS_DENIED, none, value)
+        }
+        (BrowserAction::CHANGING, _) => (Status::SUCCESS, none, value),
+        (BrowserAction::CHANGED, behavior) => {
+            let (status, request) = match behavior {
+                Behavior::Own | Behavior::Transient | Behavior::NoReadBack => {
+                    (write_variable(&own, &[value]), none)
+                }
+                Behavior::OwnAskingReset => {
+                    (write_variable(&own, &[value]), BrowserActionRequest::RESET)
+                }
+                Behavior::OwnResetting => {
+                    let status = write_variable(&own, &[value]);
+                    println!(
+                        "callback-forms: Callback(CHANGED) question {:#06x} value {value:#x}: \
+                         {status:?}, resetting the platform",
+                        question.id
+                    );
+                    runtime::reset(ResetType::COLD, Status::SUCCESS, None)
+                }
+                Behavior::OwnAskingSave => {
+                    (write_variable(&own, &[value]), BrowserActionRequest::SUBMIT)
+                }
+                Behavior::OwnAskingReconnect => (
+                    write_variable(&own, &[value]),
+                    BrowserActionRequest::RECONNECT,
+                ),
+                Behavior::OverwritesEfiStore => {
+                    (write_variable(EFI_STORE, &[value, 0xC1, 0xC2, 0xC3]), none)
+                }
+                Behavior::OverwritesBufferStore => (
+                    overwrite(&CALLBACK_BUFFER, 0, &[value, 0xB1, 0xB2, 0xB3]),
+                    none,
+                ),
+                Behavior::OverwritesPasswordStore => {
+                    (overwrite(&PASSWORD_BUFFER, 4, &[value]), none)
+                }
+                Behavior::OverwritesPassword => (
+                    overwrite(&PASSWORD_BUFFER, 0, &[value, 0xD1, 0xD2, 0xD3]),
+                    none,
+                ),
+                Behavior::RefusedInChanging => (Status::SUCCESS, none),
+                Behavior::FailsInChanged => (Status::DEVICE_ERROR, none),
+            };
+            (status, request, value)
+        }
+        _ => (Status::UNSUPPORTED, none, value),
+    }
+}
+
+/// The name of `action`, as the checks match it.
+fn action_name(action: BrowserAction) -> String {
+    match action {
+        BrowserAction::CHANGING => "CHANGING".to_string(),
+        BrowserAction::CHANGED => "CHANGED".to_string(),
+        BrowserAction::RETRIEVE => "RETRIEVE".to_string(),
+        BrowserAction::FORM_OPEN => "FORM_OPEN".to_string(),
+        BrowserAction::FORM_CLOSE => "FORM_CLOSE".to_string(),
+        other => format!("{:#x}", other.0),
+    }
+}
+
+#[expect(unsafe_code, reason = "a protocol function that firmware calls")]
+unsafe extern "efiapi" fn callback(
+    _this: *const HiiConfigAccessProtocol,
+    action: BrowserAction,
+    question_id: u16,
+    _value_type: u8,
+    value: *mut IfrTypeValue,
+    action_request: *mut BrowserActionRequest,
+) -> Status {
+    let Some(question) = QUESTIONS.iter().find(|question| question.id == question_id) else {
+        return Status::UNSUPPORTED;
+    };
+    if value.is_null() || action_request.is_null() {
+        return Status::INVALID_PARAMETER;
+    }
+    // SAFETY: the caller's EFI_IFR_TYPE_VALUE, of a UINT8 question
+    let given = unsafe { (*value).u8 };
+    let (status, request, returned) = respond(question, action, given);
+    // SAFETY: as above, and the caller's ActionRequest
+    unsafe {
+        (*value).u8 = returned;
+        *action_request = request;
+    }
+    println!(
+        "callback-forms: Callback({}) question {question_id:#06x} value {given:#x}: {status:?}, \
+         returned {returned:#x}, request {}",
+        action_name(action),
+        request.0
+    );
+    status
+}
+
+/// Supported() of the driver binding: only the handle of [`FormSet::Stores`].
+#[expect(unsafe_code, reason = "a protocol function that firmware calls")]
+unsafe extern "efiapi" fn supported(
+    _this: *const DriverBindingProtocol,
+    controller: uefi_raw::Handle,
+    _remaining: *const DevicePathProtocol,
+) -> Status {
+    match controller == STORES_HANDLE.load(Ordering::Acquire) {
+        true => Status::SUCCESS,
+        false => Status::UNSUPPORTED,
+    }
+}
+
+/// Start() of the driver binding, which opens nothing, so that DisconnectController() finds
+/// nothing to stop.
+#[expect(unsafe_code, reason = "a protocol function that firmware calls")]
+unsafe extern "efiapi" fn start(
+    _this: *const DriverBindingProtocol,
+    _controller: uefi_raw::Handle,
+    _remaining: *const DevicePathProtocol,
+) -> Status {
+    println!("callback-forms: driver binding Start()");
+    Status::SUCCESS
+}
+
+#[expect(unsafe_code, reason = "a protocol function that firmware calls")]
+unsafe extern "efiapi" fn stop(
+    _this: *const DriverBindingProtocol,
+    _controller: uefi_raw::Handle,
+    _children: usize,
+    _child_handles: *const uefi_raw::Handle,
+) -> Status {
+    Status::SUCCESS
+}
diff --git a/tests/qemu/publish-hiidb/src/driver_handle.rs b/tests/qemu/publish-hiidb/src/driver_handle.rs
new file mode 100644
index 0000000..7c35fc3
--- /dev/null
+++ b/tests/qemu/publish-hiidb/src/driver_handle.rs
@@ -0,0 +1,80 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The handles that register the package lists of publish-hiidb's forms with a driver: each has
+//! a vendor device path, which the HII database keeps as the list's device path package and
+//! EFI_HII_CONFIG_ROUTING_PROTOCOL routes a `<ConfigHdr>` by (edk2-stable202608 HiiDatabaseDxe
+//! Database.c HiiNewPackageList, ConfigRouting.c HiiConfigRoutingExtractConfig), and an
+//! EFI_HII_CONFIG_ACCESS_PROTOCOL.
+
+use core::ptr;
+
+use uefi::boot;
+use uefi::Guid;
+use uefi::Handle;
+use uefi_raw::protocol::device_path::DevicePathProtocol;
+use uefi_raw::protocol::hii::config::HiiConfigAccessProtocol;
+
+use crate::Failure;
+
+/// A device path of one vendor-defined hardware node of `guid` (UEFI 2.11 §10.3.2.4), then the
+/// End node.
+pub(crate) const fn vendor_device_path(guid: Guid) -> [u8; 24] {
+    let mut path = [0; 24];
+    // Type, SubType and Length of the vendor node
+    path[0] = 0x01;
+    path[1] = 0x04;
+    path[2] = 20;
+    let bytes = guid.to_bytes();
+    let mut i = 0;
+    while i < 16 {
+        path[4 + i] = bytes[i];
+        i += 1;
+    }
+    // End of Hardware Device Path, End Entire Device Path
+    path[20] = 0x7F;
+    path[21] = 0xFF;
+    path[22] = 4;
+    path
+}
+
+/// A new handle with the device path `path` and the EFI_HII_CONFIG_ACCESS_PROTOCOL `access`,
+/// both statics of this resident driver.
+pub(crate) fn install(
+    path: &'static [u8],
+    access: &'static HiiConfigAccessProtocol,
+) -> Result<Handle, Failure> {
+    #[expect(
+        unsafe_code,
+        reason = "installs a protocol whose interface is a static of this driver"
+    )]
+    // SAFETY: the device path is a static of this resident boot service driver, which nothing
+    // writes
+    let handle = unsafe {
+        boot::install_protocol_interface(None, &DevicePathProtocol::GUID, path.as_ptr().cast())
+    }
+    .map_err(|error| ("installing a device path", error.status()))?;
+    #[expect(
+        unsafe_code,
+        reason = "installs a protocol whose interface is a static of this driver"
+    )]
+    // SAFETY: the protocol is a static of this resident boot service driver
+    unsafe {
+        boot::install_protocol_interface(
+            Some(handle),
+            &HiiConfigAccessProtocol::GUID,
+            ptr::from_ref(access).cast(),
+        )
+    }
+    .map_err(|error| ("installing EFI_HII_CONFIG_ACCESS_PROTOCOL", error.status()))?;
+    Ok(handle)
+}
diff --git a/tests/qemu/publish-hiidb/src/exported_config.rs b/tests/qemu/publish-hiidb/src/exported_config.rs
index de38c23..1c38207 100644
--- a/tests/qemu/publish-hiidb/src/exported_config.rs
+++ b/tests/qemu/publish-hiidb/src/exported_config.rs
@@ -23,7 +23,13 @@
 //! [`name_value_password_forms`] and the `<ConfigResp>` of their VARSTORE_NAME_VALUE, which holds
 //! the value of the name that their PASSWORD is on. `export-config-storageless-password` does it
 //! with those of [`storageless_password_forms`] and the `<ConfigResp>` of their VARSTORE
-//! SlBacking, whose bytes stand for a password that their PASSWORDs of VarStoreId 0 keep there.
+//! SlBacking, whose bytes stand for a password that their PASSWORDs of VarStoreId 0 keep there,
+//! and `export-config-undeclared-password` with those of [`undeclared_password_forms`] and the
+//! `<ConfigResp>` of their VARSTORE UdBacking, whose bytes stand for a password that the driver of
+//! their PASSWORD of an undeclared VarStoreId keeps there.
+//! `export-config-name-value-string` does the same with the package list of
+//! [`name_value_string_forms`] and the `<ConfigResp>` of its VARSTORE_NAME_VALUE, which holds the
+//! settings of its STRINGs and its CHECKBOX.
 
 use alloc::format;
 use alloc::string::String;
@@ -44,11 +50,15 @@ use uefi_raw::protocol::hii::config::HiiConfigRoutingProtocol;
 
 use crate::install_device_path;
 use crate::name_value_password_forms;
+use crate::name_value_string_forms;
 use crate::password_forms;
 use crate::register_name_value_password_forms;
+use crate::register_name_value_string_forms;
 use crate::register_package_list_for;
 use crate::register_storageless_password_forms;
+use crate::register_undeclared_password_forms;
 use crate::storageless_password_forms;
+use crate::undeclared_password_forms;
 use crate::vendor_device_path;
 use crate::Failure;
 
@@ -99,6 +109,25 @@ pub(crate) fn export_storageless_config() -> Result<(), Failure> {
     export_config_with(&storageless_password_forms::backing_resp(), "SlBacking")
 }
 
+/// Registers the package lists of [`undeclared_password_forms`] for a handle of their device
+/// path, then installs ExportConfig()'s results with the `<ConfigResp>` of their VARSTORE
+/// UdBacking after them, and logs where.
+pub(crate) fn export_undeclared_config() -> Result<(), Failure> {
+    register_undeclared_password_forms()?;
+    export_config_with(&undeclared_password_forms::backing_resp(), "UdBacking")
+}
+
+/// Registers the package list of [`name_value_string_forms`] for a handle of its device path,
+/// then installs ExportConfig()'s results with the `<ConfigResp>` of its VARSTORE_NAME_VALUE
+/// after them, and logs where.
+pub(crate) fn export_name_value_string_config() -> Result<(), Failure> {
+    register_name_value_string_forms()?;
+    export_config_with(
+        &name_value_string_forms::settings_resp(),
+        "the VARSTORE_NAME_VALUE of the STRINGs",
+    )
+}
+
 /// Installs ExportConfig()'s results with `resp`, the `<ConfigResp>` of `storage`, after them,
 /// and logs where.
 fn export_config_with(resp: &str, storage: &str) -> Result<(), Failure> {
diff --git a/tests/qemu/publish-hiidb/src/form_set_disable_if_forms.rs b/tests/qemu/publish-hiidb/src/form_set_disable_if_forms.rs
new file mode 100644
index 0000000..f77aa3f
--- /dev/null
+++ b/tests/qemu/publish-hiidb/src/form_set_disable_if_forms.rs
@@ -0,0 +1,233 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The HII package list that `form-set-disable-if-forms` registers in the HII database, for the
+//! scenarios `hii-form-set-disable-if` and `shell-form-set-disable-if` of
+//! `tests/qemu/scenarios.tsv`: a form set on the VARSTORE_EFI UefisettingsFormSetDisableIf, which
+//! `tests/qemu/vars/form-set-disable-if.json` creates, whose forms but the first are in DISABLE_IFs
+//! outside forms, which UEFI 2.11 §33.3.8.3.14 has rely on constants only. The first form holds
+//! Gate, Shown, in a SUPPRESS_IF on Hidden holding 1, and O, over the bytes of the PASSWORD; a
+//! true DISABLE_IF holds the form of Hidden and of that PASSWORD; a DISABLE_IF on Gate holds the
+//! form of After; and a false DISABLE_IF holds a true SUPPRESS_IF, then the form of Later. Each
+//! question but the PASSWORD is a UINT8 NUMERIC. The x-UEFI-ns keywords HiddenKeyword and
+//! ShownKeyword name Hidden and Shown.
+
+use alloc::vec::Vec;
+
+use uefi::guid;
+use uefi::Guid;
+
+use crate::hii_package::end;
+use crate::hii_package::form_set_op;
+use crate::hii_package::language_strings_package;
+use crate::hii_package::op;
+use crate::hii_package::package;
+use crate::hii_package::package_list;
+use crate::hii_package::question_header;
+use crate::hii_package::strings_package;
+use crate::hii_package::EFI_HII_PACKAGE_FORMS;
+use crate::hii_package::EFI_IFR_DISABLE_IF_OP;
+use crate::hii_package::EFI_IFR_EQ_ID_VAL_OP;
+use crate::hii_package::EFI_IFR_FALSE_OP;
+use crate::hii_package::EFI_IFR_FORM_OP;
+use crate::hii_package::EFI_IFR_NUMERIC_OP;
+use crate::hii_package::EFI_IFR_PASSWORD_OP;
+use crate::hii_package::EFI_IFR_SUPPRESS_IF_OP;
+use crate::hii_package::EFI_IFR_TRUE_OP;
+use crate::hii_package::EFI_IFR_VARSTORE_EFI_OP;
+use crate::hii_package::UINT8_DECIMAL;
+
+/// The GUID of the package list and of its form set.
+const FORM_SET: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002400");
+/// The vendor GUID of UefisettingsFormSetDisableIf.
+const STORE_VENDOR: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002401");
+/// The Name of UefisettingsFormSetDisableIf, NUL-terminated.
+const STORE_NAME: &[u8] = b"UefisettingsFormSetDisableIf\0";
+/// The size of UefisettingsFormSetDisableIf: Gate, Hidden, Shown, After and Later, 3 bytes that
+/// no question holds, then the password.
+const STORE_SIZE: u16 = 24;
+/// The VarStoreId of UefisettingsFormSetDisableIf.
+const VAR_STORE: u16 = 1;
+/// The Attributes of the VARSTORE_EFI: non-volatile, boot service and runtime access.
+const NV_BS_RT: u32 = 0x07;
+
+// The strings, from string ID 2, after the language name: the prompts of Hidden and Shown first,
+// so that the x-UEFI-ns strings name them. Each question's QuestionId is its prompt's.
+const HIDDEN: u16 = 2;
+const SHOWN: u16 = 3;
+const GATE: u16 = 4;
+const AFTER: u16 = 5;
+const LATER: u16 = 6;
+const O: u16 = 7;
+const PASSWORD: u16 = 8;
+const TITLE: u16 = 9;
+const HELP: u16 = 10;
+const STRINGS: [&str; 10] = [
+    "English",
+    "Hidden",
+    "Shown",
+    "Gate",
+    "After",
+    "Later",
+    "O",
+    "Password",
+    "uefisettings QEMU form set DISABLE_IF forms",
+    "Forms in DISABLE_IFs outside forms",
+];
+/// The language and the strings, from string ID 1, of the x-UEFI-ns strings package: the
+/// keywords of Hidden and Shown (UEFI 2.11 §35.2.1.6).
+const KEYWORD_LANGUAGE: &[u8] = b"x-UEFI-ns\0";
+const KEYWORDS: [&str; 3] = ["UefiNameSpace", "HiddenKeyword", "ShownKeyword"];
+
+/// The byte of each UINT8 NUMERIC, and the first of the PASSWORD's, which O's overlaps.
+const GATE_OFFSET: u16 = 0;
+const HIDDEN_OFFSET: u16 = 1;
+const SHOWN_OFFSET: u16 = 2;
+const AFTER_OFFSET: u16 = 3;
+const LATER_OFFSET: u16 = 4;
+const PASSWORD_OFFSET: u16 = 8;
+/// The MinSize and MaxSize of the PASSWORD, in characters: its UCS-2 string takes bytes 8 to 23.
+const PASSWORD_MIN_SIZE: u16 = 1;
+const PASSWORD_MAX_SIZE: u16 = 8;
+/// What Gate and Hidden hold where the DISABLE_IF on Gate disables, and where the SUPPRESS_IF on
+/// Hidden suppresses.
+const TRUE_VALUE: u16 = 1;
+
+/// The package list, as NewPackageList() takes it.
+pub(crate) fn package_list_bytes() -> Vec<u8> {
+    package_list(
+        FORM_SET,
+        &[
+            strings_package(STRINGS),
+            language_strings_package(KEYWORD_LANGUAGE, KEYWORDS),
+            form_package(),
+        ],
+    )
+}
+
+/// The form package: the form set, which declares UefisettingsFormSetDisableIf first, then holds
+/// the forms in the order of the module's documentation.
+fn form_package() -> Vec<u8> {
+    let var_store = op(
+        EFI_IFR_VARSTORE_EFI_OP,
+        false,
+        &[
+            &VAR_STORE.to_le_bytes()[..],
+            &STORE_VENDOR.to_bytes(),
+            &NV_BS_RT.to_le_bytes(),
+            &STORE_SIZE.to_le_bytes(),
+            STORE_NAME,
+        ]
+        .concat(),
+    );
+    let first = form(
+        1,
+        &[
+            uint8_numeric(GATE, GATE_OFFSET),
+            conditional(
+                EFI_IFR_SUPPRESS_IF_OP,
+                &eq_id_val(HIDDEN),
+                &uint8_numeric(SHOWN, SHOWN_OFFSET),
+            ),
+            uint8_numeric(O, PASSWORD_OFFSET),
+        ]
+        .concat(),
+    );
+    let hidden = form(
+        2,
+        &[uint8_numeric(HIDDEN, HIDDEN_OFFSET), password()].concat(),
+    );
+    let after = form(3, &uint8_numeric(AFTER, AFTER_OFFSET));
+    let later = [
+        conditional(EFI_IFR_SUPPRESS_IF_OP, &constant(EFI_IFR_TRUE_OP), &[]),
+        form(4, &uint8_numeric(LATER, LATER_OFFSET)),
+    ]
+    .concat();
+    let body = [
+        form_set_op(FORM_SET, TITLE, HELP),
+        var_store,
+        first,
+        conditional(EFI_IFR_DISABLE_IF_OP, &constant(EFI_IFR_TRUE_OP), &hidden),
+        conditional(EFI_IFR_DISABLE_IF_OP, &eq_id_val(GATE), &after),
+        conditional(EFI_IFR_DISABLE_IF_OP, &constant(EFI_IFR_FALSE_OP), &later),
+        end(), // of the form set
+    ]
+    .concat();
+    package(EFI_HII_PACKAGE_FORMS, &body)
+}
+
+/// The conditional op `op_code`, whose scope holds the expression `condition`, then `ops`.
+fn conditional(op_code: u8, condition: &[u8], ops: &[u8]) -> Vec<u8> {
+    [
+        op(op_code, true, &[]),
+        condition.to_vec(),
+        ops.to_vec(),
+        end(),
+    ]
+    .concat()
+}
+
+/// The expression of the constant op `op_code`, EFI_IFR_TRUE or EFI_IFR_FALSE.
+fn constant(op_code: u8) -> Vec<u8> {
+    op(op_code, false, &[])
+}
+
+/// An EFI_IFR_EQ_ID_VAL: whether the question of QuestionId `question_id` holds TRUE_VALUE.
+fn eq_id_val(question_id: u16) -> Vec<u8> {
+    op(
+        EFI_IFR_EQ_ID_VAL_OP,
+        false,
+        &[question_id.to_le_bytes(), TRUE_VALUE.to_le_bytes()].concat(),
+    )
+}
+
+/// A form of FormId `id` that holds `questions`.
+fn form(id: u16, questions: &[u8]) -> Vec<u8> {
+    let form = [id.to_le_bytes(), TITLE.to_le_bytes()].concat();
+    [op(EFI_IFR_FORM_OP, true, &form), questions.to_vec(), end()].concat()
+}
+
+/// A UINT8 NUMERIC prompted, and of QuestionId, `prompt` at byte `offset` of the variable.
+fn uint8_numeric(prompt: u16, offset: u16) -> Vec<u8> {
+    [
+        op(
+            EFI_IFR_NUMERIC_OP,
+            true,
+            &[
+                question_header(prompt, HELP, prompt, VAR_STORE, offset),
+                // Flags, MinValue, MaxValue, Step
+                [UINT8_DECIMAL, 0, 255, 1].to_vec(),
+            ]
+            .concat(),
+        ),
+        end(),
+    ]
+    .concat()
+}
+
+/// The PASSWORD at bytes PASSWORD_OFFSET to PASSWORD_OFFSET + 2 * PASSWORD_MAX_SIZE - 1 of the
+/// variable.
+fn password() -> Vec<u8> {
+    op(
+        EFI_IFR_PASSWORD_OP,
+        false,
+        &[
+            question_header(PASSWORD, HELP, PASSWORD, VAR_STORE, PASSWORD_OFFSET),
+            [
+                PASSWORD_MIN_SIZE.to_le_bytes(),
+                PASSWORD_MAX_SIZE.to_le_bytes(),
+            ]
+            .concat(),
+        ]
+        .concat(),
+    )
+}
diff --git a/tests/qemu/publish-hiidb/src/hii_package.rs b/tests/qemu/publish-hiidb/src/hii_package.rs
index f539693..af788cb 100644
--- a/tests/qemu/publish-hiidb/src/hii_package.rs
+++ b/tests/qemu/publish-hiidb/src/hii_package.rs
@@ -49,9 +49,11 @@ pub(crate) const EFI_IFR_ONE_OF_OPTION_OP: u8 = 0x09;
 pub(crate) const EFI_IFR_SUPPRESS_IF_OP: u8 = 0x0A;
 pub(crate) const EFI_IFR_FORM_SET_OP: u8 = 0x0E;
 pub(crate) const EFI_IFR_REF_OP: u8 = 0x0F;
+pub(crate) const EFI_IFR_EQ_ID_VAL_OP: u8 = 0x12;
 pub(crate) const EFI_IFR_AND_OP: u8 = 0x15;
 pub(crate) const EFI_IFR_DATE_OP: u8 = 0x1A;
 pub(crate) const EFI_IFR_TIME_OP: u8 = 0x1B;
+pub(crate) const EFI_IFR_STRING_OP: u8 = 0x1C;
 pub(crate) const EFI_IFR_DISABLE_IF_OP: u8 = 0x1E;
 pub(crate) const EFI_IFR_MAP_OP: u8 = 0x22;
 pub(crate) const EFI_IFR_ORDERED_LIST_OP: u8 = 0x23;
@@ -265,6 +267,25 @@ pub(crate) fn uint16_numeric(header: Vec<u8>) -> Vec<u8> {
     )
 }
 
+/// The VARSTORE_NAME_VALUE of `id` whose values are named in the space `guid`.
+pub(crate) fn var_store_name_value_op(id: u16, guid: Guid) -> Vec<u8> {
+    op(
+        EFI_IFR_VARSTORE_NAME_VALUE_OP,
+        false,
+        &[&id.to_le_bytes()[..], &guid.to_bytes()].concat(),
+    )
+}
+
+/// The STRING op (UEFI 2.11 §33.3.8.3.70) whose question header is `header`, of MinSize
+/// `min_size` and MaxSize `max_size` characters and no Flags.
+pub(crate) fn string_op(header: Vec<u8>, min_size: u8, max_size: u8) -> Vec<u8> {
+    op(
+        EFI_IFR_STRING_OP,
+        false,
+        &[&header[..], &[min_size, max_size, 0]].concat(),
+    )
+}
+
 /// EFI_IFR_END, which closes a scope.
 pub(crate) fn end() -> Vec<u8> {
     op(EFI_IFR_END_OP, false, &[])
diff --git a/tests/qemu/publish-hiidb/src/keyword_kinds_forms.rs b/tests/qemu/publish-hiidb/src/keyword_kinds_forms.rs
index 55cac2d..259be1b 100644
--- a/tests/qemu/publish-hiidb/src/keyword_kinds_forms.rs
+++ b/tests/qemu/publish-hiidb/src/keyword_kinds_forms.rs
@@ -13,8 +13,9 @@
 //! The package list that `publish-hiidb.efi keyword-kinds-forms` registers for a handle of
 //! [`DRIVER_PATH`], for the UEFI Shell scenario `shell-keyword-kinds` of
 //! `tests/qemu/scenarios.tsv`: a form set with a DATE that suppresses its year, a TIME that
-//! suppresses its second, an ORDERED_LIST of at most 3 UINT8 options under EFI_IFR_UNIQUE_SET and
-//! a REF5, each with an x-UEFI-ns keyword, on the VARSTORE_EFI KindStore, which the driver creates
+//! suppresses its second, an ORDERED_LIST of at most 3 UINT8 options under EFI_IFR_UNIQUE_SET, a
+//! REF5, a STRING and a multi-line STRING, each with an x-UEFI-ns keyword, on the VARSTORE_EFI
+//! KindStore, which the driver creates
 //! with the VarStore's Attributes and Size when it is missing. The Keyword Handler finds the
 //! questions by the device path package that the HII database adds for that handle, and writes
 //! KindStore through SetVariable() with the VarStore's Attributes (edk2-stable202608
@@ -42,6 +43,7 @@ use crate::hii_package::EFI_IFR_FORM_SET_OP;
 use crate::hii_package::EFI_IFR_ONE_OF_OPTION_OP;
 use crate::hii_package::EFI_IFR_ORDERED_LIST_OP;
 use crate::hii_package::EFI_IFR_REF_OP;
+use crate::hii_package::EFI_IFR_STRING_OP;
 use crate::hii_package::EFI_IFR_TIME_OP;
 use crate::hii_package::EFI_IFR_VARSTORE_EFI_OP;
 use crate::vendor_device_path;
@@ -68,31 +70,37 @@ const KIND_DATE: u16 = 2;
 const KIND_TIME: u16 = 3;
 const KIND_LIST: u16 = 4;
 const KIND_REF: u16 = 5;
-const TITLE: u16 = 6;
-const HELP: u16 = 7;
-const FIRST: u16 = 8;
-const SECOND: u16 = 9;
-const THIRD: u16 = 10;
-const STRINGS: [&str; 10] = [
+const KIND_STRING: u16 = 6;
+const KIND_TEXT: u16 = 7;
+const TITLE: u16 = 8;
+const HELP: u16 = 9;
+const FIRST: u16 = 10;
+const SECOND: u16 = 11;
+const THIRD: u16 = 12;
+const STRINGS: [&str; 12] = [
     "English",
     "Kind date",
     "Kind time",
     "Kind list",
     "Kind ref",
+    "Kind string",
+    "Kind text",
     "uefisettings QEMU keyword kinds forms",
-    "A DATE, a TIME, an ORDERED_LIST and a REF5 with x-UEFI-ns keywords",
+    "A DATE, a TIME, an ORDERED_LIST, a REF5 and two STRINGs with x-UEFI-ns keywords",
     "First",
     "Second",
     "Third",
 ];
 /// The x-UEFI-ns strings: the language name, as edk2's DriverSample names it, then the keywords
 /// of the prompts.
-const KEYWORDS: [&str; 5] = [
+const KEYWORDS: [&str; 7] = [
     "UefiNameSpace",
     "KindDate",
     "KindTime",
     "KindList",
     "KindRef",
+    "KindString",
+    "KindText",
 ];
 
 // The VarStore and the questions' VarOffsets
@@ -101,6 +109,8 @@ const DATE_OFFSET: u16 = 0;
 const TIME_OFFSET: u16 = 4;
 const LIST_OFFSET: u16 = 8;
 const REF_OFFSET: u16 = 12;
+const STRING_OFFSET: u16 = 34;
+const TEXT_OFFSET: u16 = 42;
 
 /// EFI_QF_DATE_YEAR_SUPPRESS (UEFI 2.11 §33.3.8.3.11).
 const YEAR_SUPPRESS: u8 = 0x01;
@@ -110,6 +120,10 @@ const SECOND_SUPPRESS: u8 = 0x04;
 const UNIQUE_SET: u8 = 0x01;
 /// The MaxContainers of the ORDERED_LIST.
 const MAX_CONTAINERS: u8 = 3;
+/// The MaxSize of each STRING, in CHAR16s: 3 characters and the NULL.
+const STRING_MAX_SIZE: u8 = 4;
+/// EFI_IFR_STRING_MULTI_LINE (UEFI 2.11 §33.3.8.3.70).
+const MULTI_LINE: u8 = 0x01;
 /// EFI_IFR_TYPE_NUM_SIZE_8 (UEFI 2.11 §33.3.8.3.51).
 const UINT8_TYPE: u8 = 0x00;
 
@@ -130,7 +144,8 @@ pub(crate) fn package_list_bytes() -> Vec<u8> {
 /// items 1, 2 and 3 at [`LIST_OFFSET`], and at [`REF_OFFSET`] the EFI_HII_REF of the REF5 itself
 /// (QuestionId 4, FormId 1, FormSetGuid [`FORM_SET`], DevicePath 0), its last 22 bytes, as edk2's
 /// HiiConfigToBlock refuses a block past the variable's end (ConfigRouting.c :6383-6386); 0 in
-/// bytes 7 and 11, which are in no question.
+/// bytes 7 and 11, which are in no question, and the empty strings, all NULL CHAR16s, at
+/// [`STRING_OFFSET`] and [`TEXT_OFFSET`].
 pub(crate) fn store_data() -> Vec<u8> {
     [
         &[0xE8, 0x07, 3, 31][..],
@@ -142,6 +157,8 @@ pub(crate) fn store_data() -> Vec<u8> {
         &1u16.to_le_bytes(),
         &FORM_SET.to_bytes(),
         &0u16.to_le_bytes(),
+        &[0; 2 * STRING_MAX_SIZE as usize],
+        &[0; 2 * STRING_MAX_SIZE as usize],
     ]
     .concat()
 }
@@ -197,6 +214,8 @@ fn form_package() -> Vec<u8> {
             false,
             &question_header(KIND_REF, HELP, 4, STORE, REF_OFFSET),
         ),
+        string(5, KIND_STRING, STRING_OFFSET, 0),
+        string(6, KIND_TEXT, TEXT_OFFSET, MULTI_LINE),
     ];
     let form = [1u16.to_le_bytes(), TITLE.to_le_bytes()].concat();
     let body = [
@@ -221,3 +240,14 @@ fn date_time(op_code: u8, id: u16, prompt: u16, offset: u16, flags: u8) -> Vec<u
     .concat();
     [op(op_code, true, &data), end()].concat()
 }
+
+/// A STRING of question `id` at VarOffset `offset` of [`STORE`], of MinSize 0, MaxSize
+/// [`STRING_MAX_SIZE`] and `flags` (UEFI 2.11 §33.3.8.3.70).
+fn string(id: u16, prompt: u16, offset: u16, flags: u8) -> Vec<u8> {
+    let data = [
+        &question_header(prompt, HELP, id, STORE, offset)[..],
+        &[0, STRING_MAX_SIZE, flags],
+    ]
+    .concat();
+    op(EFI_IFR_STRING_OP, false, &data)
+}
diff --git a/tests/qemu/publish-hiidb/src/main.rs b/tests/qemu/publish-hiidb/src/main.rs
index 1593b4f..7076fd7 100644
--- a/tests/qemu/publish-hiidb/src/main.rs
+++ b/tests/qemu/publish-hiidb/src/main.rs
@@ -12,7 +12,7 @@
 
 //! UEFI driver for the QEMU tests of the `uefisettings` HII backend, which a
 //! `Driver####` load option runs as
-//! `publish-hiidb.efi [rt-data|reserved|acpi-nvs|loader-data|rt-data-global-variable-forms|rt-data-readwrite-forms|wakeup-time-forms|password-forms|rt-data-password-forms|nested-password-forms|rt-data-nested-password-forms|enhanced-auth-forms|dropped-password-forms|control-text-forms|formset-skip-forms|disabled-form-forms|short-var-store-forms|rt-data-short-var-store-forms|outside-form-set-password-forms|rt-data-outside-form-set-password-forms|first-store-password-forms|rt-data-first-store-password-forms|keyword-kinds-forms|name-value-password-forms|rt-data-name-value-password-forms|storageless-password-forms|rt-data-storageless-password-forms|padded-strings|string-blocks|acpi-table|acpi-table-hiid|acpi-table-junk-qhii|install-config-tables|export-config|export-config-name-value-password|export-config-storageless-password|rt-properties-no-set-variable|rt-properties-all|rt-properties-version-2|rt-properties-version-2-all|json-config-data|json-config-data-past-region|json-config-data-boot-services|json-config-data-mmio|json-capsule-result|set-auth-variables=PATH[,PATH]...]`:
+//! `publish-hiidb.efi [rt-data|reserved|acpi-nvs|loader-data|rt-data-global-variable-forms|rt-data-readwrite-forms|wakeup-time-forms|password-forms|rt-data-password-forms|nested-password-forms|rt-data-nested-password-forms|enhanced-auth-forms|dropped-password-forms|control-text-forms|formset-skip-forms|disabled-form-forms|form-set-disable-if-forms|short-var-store-forms|rt-data-short-var-store-forms|outside-form-set-password-forms|rt-data-outside-form-set-password-forms|first-store-password-forms|rt-data-first-store-password-forms|keyword-kinds-forms|name-value-password-forms|rt-data-name-value-password-forms|rt-data-name-value-string-forms|storageless-password-forms|rt-data-storageless-password-forms|undeclared-password-forms|rt-data-undeclared-password-forms|padded-strings|string-blocks|callback-forms|callback-forms-password|acpi-table|acpi-table-hiid|acpi-table-junk-qhii|install-config-tables|export-config|export-config-name-value-password|export-config-storageless-password|export-config-undeclared-password|export-config-name-value-string|rt-properties-no-set-variable|rt-properties-all|rt-properties-version-2|rt-properties-version-2-all|json-config-data|json-config-data-past-region|json-config-data-boot-services|json-config-data-mmio|json-capsule-result|set-auth-variables=PATH[,PATH]...]`:
 //! it copies the HII database into pages of that memory type, one byte in, and points
 //! the volatile `HiiDB` variable at the copy as `{ u32 length; u64 address }`, the way
 //! OCP firmware does for `src/lib/hii/extract.rs`. The x86 EFI stub reports
@@ -61,6 +61,8 @@
 //! after it does the same, so that Linux finds it too.
 //! `disabled-form-forms` registers, alone, the package list of [`formset_skip_forms`] with a form
 //! that `uefisettings` disables.
+//! `form-set-disable-if-forms` registers the package list of [`form_set_disable_if_forms`], which
+//! a later `publish-hiidb.efi rt-data` exports with the database for Linux.
 //! `first-store-password-forms` creates the variables of [`first_store_password_forms`] if they
 //! are missing and registers its package list, whose PASSWORD's VarStoreId an earlier form set
 //! declares first, for `uefisettings.efi` in the UEFI Shell;
@@ -77,9 +79,20 @@
 //! whose PASSWORDs are of VarStoreId 0, for a handle with a device path, for `uefisettings.efi` in
 //! the UEFI Shell; `rt-data-storageless-password-forms` is `rt-data`, after it does the same, so
 //! that Linux finds them too.
+//! `undeclared-password-forms` registers the package lists of [`undeclared_password_forms`],
+//! whose PASSWORD is of a VarStoreId that no VarStore declares, for a handle with a device path,
+//! for `uefisettings.efi` in the UEFI Shell; `rt-data-undeclared-password-forms` is `rt-data`,
+//! after it does the same, so that Linux finds them too.
+//! `rt-data-name-value-string-forms` is `rt-data`, after it registers the package list of
+//! [`name_value_string_forms`], whose STRINGs are on a VARSTORE_NAME_VALUE, for a handle with a
+//! device path.
 //! `padded-strings` publishes nothing either: it registers the package list of
 //! [`padded_strings`], which a later `publish-hiidb.efi` exports with the database.
 //! `string-blocks` does the same with the package list of [`string_blocks`].
+//! `callback-forms` publishes nothing either: it registers the package lists of
+//! [`callback_forms`], each by a handle with its EFI_HII_CONFIG_ACCESS_PROTOCOL but the last, and
+//! `callback-forms-password` those of its form sets with a PASSWORD question, one in a disabled
+//! form.
 //! `acpi-table` sets no `HiiDB`: it installs the database as the body of a `QHII` ACPI table,
 //! where `src/lib/hii/extract.rs` also looks, and puts its CRC-32 in `HiiDBCrc32`.
 //! `acpi-table-hiid` does the same with an `HIID` table, the other vendor ACPI table that
@@ -95,9 +108,12 @@
 //! handle with a device path and appends a `<ConfigResp>` of marker bytes for its password
 //! VarStore: [`exported_config`]. A later `publish-hiidb.efi rt-data` publishes that list too.
 //! `export-config-name-value-password` does the same with the package lists of
-//! [`name_value_password_forms`] and a `<ConfigResp>` of their VARSTORE_NAME_VALUE, and
+//! [`name_value_password_forms`] and a `<ConfigResp>` of their VARSTORE_NAME_VALUE,
 //! `export-config-storageless-password` with those of [`storageless_password_forms`] and a
-//! `<ConfigResp>` of their VARSTORE SlBacking.
+//! `<ConfigResp>` of their VARSTORE SlBacking, `export-config-undeclared-password` with those
+//! of [`undeclared_password_forms`] and a `<ConfigResp>` of their VARSTORE UdBacking, and
+//! `export-config-name-value-string` with the package list of [`name_value_string_forms`] and a
+//! `<ConfigResp>` of its VARSTORE_NAME_VALUE.
 //! `rt-properties-no-set-variable` publishes nothing: it installs an EFI_RT_PROPERTIES_TABLE
 //! (UEFI 2.11 §4.6.2) whose RuntimeServicesSupported lists every runtime service but
 //! SetVariable(), as firmware that cannot write variables at runtime publishes, and
@@ -126,16 +142,20 @@
 extern crate alloc;
 
 mod auth_variables;
+mod callback_forms;
 mod control_text_forms;
+mod driver_handle;
 mod dropped_password_forms;
 mod enhanced_auth_forms;
 mod exported_config;
 mod first_store_password_forms;
+mod form_set_disable_if_forms;
 mod formset_skip_forms;
 mod global_variable_forms;
 mod hii_package;
 mod keyword_kinds_forms;
 mod name_value_password_forms;
+mod name_value_string_forms;
 mod nested_password_forms;
 mod outside_form_set_password_forms;
 mod padded_strings;
@@ -145,6 +165,7 @@ mod readwrite_forms;
 mod short_var_store_forms;
 mod storageless_password_forms;
 mod string_blocks;
+mod undeclared_password_forms;
 mod wakeup_time_forms;
 
 use alloc::vec::Vec;
@@ -320,6 +341,11 @@ fn efi_main() -> Status {
             "registering the disabled form forms",
         )
         .map(|()| println!("publish-hiidb: registered the disabled form forms")),
+        Some(Task::RegisterFormSetDisableIfForms) => register_package_list(
+            &form_set_disable_if_forms::package_list_bytes(),
+            "registering the form set DISABLE_IF forms",
+        )
+        .map(|()| println!("publish-hiidb: registered the form set DISABLE_IF forms")),
         Some(Task::RegisterShortVarStoreForms) => register_short_var_store_forms()
             .map(|()| println!("publish-hiidb: registered the short VARSTORE_EFI forms")),
         Some(Task::PublishShortVarStoreForms) => register_short_var_store_forms()
@@ -376,6 +402,24 @@ fn efi_main() -> Status {
                      {address:#x}"
                 );
             }),
+        Some(Task::RegisterUndeclaredPasswordForms) => register_undeclared_password_forms()
+            .map(|()| println!("publish-hiidb: registered the undeclared password forms")),
+        Some(Task::PublishUndeclaredPasswordForms) => register_undeclared_password_forms()
+            .and_then(|()| publish(MemoryType::RUNTIME_SERVICES_DATA, Database::Exported))
+            .map(|(address, length)| {
+                println!(
+                    "publish-hiidb: undeclared password forms registered; {length} bytes at \
+                     {address:#x}"
+                );
+            }),
+        Some(Task::PublishNameValueStringForms) => register_name_value_string_forms()
+            .and_then(|()| publish(MemoryType::RUNTIME_SERVICES_DATA, Database::Exported))
+            .map(|(address, length)| {
+                println!(
+                    "publish-hiidb: name/value string forms registered; {length} bytes at \
+                     {address:#x}"
+                );
+            }),
         Some(Task::RegisterPaddedStrings) => register_package_list(
             &padded_strings::package_list_bytes(),
             "registering the padded strings",
@@ -397,6 +441,8 @@ fn efi_main() -> Status {
                 );
             })
         }
+        Some(Task::RegisterCallbackForms(forms)) => callback_forms::register(forms)
+            .map(|()| println!("publish-hiidb: registered the callback forms {forms:?}")),
         Some(Task::PublishAcpiTable(signature)) => publish_acpi_table(signature).map(|length| {
             let signature = signature.escape_ascii();
             println!("publish-hiidb: {length} bytes in the {signature} ACPI table");
@@ -411,6 +457,10 @@ fn efi_main() -> Status {
         Some(Task::ExportConfig) => exported_config::export_config(),
         Some(Task::ExportNameValueConfig) => exported_config::export_name_value_config(),
         Some(Task::ExportStoragelessConfig) => exported_config::export_storageless_config(),
+        Some(Task::ExportUndeclaredConfig) => exported_config::export_undeclared_config(),
+        Some(Task::ExportNameValueStringConfig) => {
+            exported_config::export_name_value_string_config()
+        }
         Some(Task::InstallRtProperties(version, supported)) => {
             install_rt_properties(version, supported)
         }
@@ -426,14 +476,19 @@ fn efi_main() -> Status {
                  |rt-data-password-forms|nested-password-forms|rt-data-nested-password-forms\
                  |enhanced-auth-forms|dropped-password-forms|control-text-forms\
                  |formset-skip-forms\
-                 |disabled-form-forms|short-var-store-forms|rt-data-short-var-store-forms\
+                 |disabled-form-forms|form-set-disable-if-forms|short-var-store-forms\
+                 |rt-data-short-var-store-forms\
                  |outside-form-set-password-forms|rt-data-outside-form-set-password-forms\
                  |first-store-password-forms|rt-data-first-store-password-forms|keyword-kinds-forms\
                  |name-value-password-forms|rt-data-name-value-password-forms\
                  |storageless-password-forms|rt-data-storageless-password-forms\
-                 |padded-strings|string-blocks|acpi-table|acpi-table-hiid|acpi-table-junk-qhii\
+                 |undeclared-password-forms|rt-data-undeclared-password-forms\
+                 |rt-data-name-value-string-forms\
+                 |padded-strings|string-blocks|callback-forms|callback-forms-password\
+                 |acpi-table|acpi-table-hiid|acpi-table-junk-qhii\
                  |install-config-tables|export-config|export-config-name-value-password\
-                 |export-config-storageless-password\
+                 |export-config-storageless-password|export-config-undeclared-password\
+                 |export-config-name-value-string\
                  |rt-properties-no-set-variable\
                  |rt-properties-all\
                  |rt-properties-version-2|rt-properties-version-2-all|json-config-data\
@@ -479,6 +534,8 @@ enum Task {
     /// Register the package list of a disabled form of [`formset_skip_forms`] in the HII
     /// database.
     RegisterDisabledFormForms,
+    /// Register the package list of [`form_set_disable_if_forms`] in the HII database.
+    RegisterFormSetDisableIfForms,
     /// Register the package list of [`short_var_store_forms`] in the HII database.
     RegisterShortVarStoreForms,
     /// Do what RegisterShortVarStoreForms does, then publish the database in runtime-data pages.
@@ -510,6 +567,15 @@ enum Task {
     /// Do what RegisterStoragelessPasswordForms does, then publish the database in runtime-data
     /// pages.
     PublishStoragelessPasswordForms,
+    /// Register the package lists of [`undeclared_password_forms`] in the HII database for a
+    /// handle with their device path.
+    RegisterUndeclaredPasswordForms,
+    /// Do what RegisterUndeclaredPasswordForms does, then publish the database in runtime-data
+    /// pages.
+    PublishUndeclaredPasswordForms,
+    /// Register the package list of [`name_value_string_forms`] in the HII database for a handle
+    /// with its device path, then publish the database in runtime-data pages.
+    PublishNameValueStringForms,
     /// Register the package list of [`padded_strings`] in the HII database.
     RegisterPaddedStrings,
     /// Create the variable of [`readwrite_forms`] if missing, register its package list in the
@@ -521,6 +587,8 @@ enum Task {
     /// [`wakeup_time_forms`] if missing, register its package list in the HII database, then
     /// publish the database in runtime-data pages.
     PublishWakeupTimeForms,
+    /// Register these package lists of [`callback_forms`] by their handles.
+    RegisterCallbackForms(callback_forms::Forms),
     /// Publish the database in an ACPI table of the signature.
     PublishAcpiTable([u8; 4]),
     /// Install an ACPI table of the signature whose body is JUNK_TABLE_BODY.
@@ -538,6 +606,14 @@ enum Task {
     /// a block of their VARSTORE SlBacking, as the HII Configuration Routing Protocol's
     /// configuration table.
     ExportStoragelessConfig,
+    /// Do what RegisterUndeclaredPasswordForms does, then install ExportConfig()'s results, with
+    /// a block of their VARSTORE UdBacking, as the HII Configuration Routing Protocol's
+    /// configuration table.
+    ExportUndeclaredConfig,
+    /// Register the package list of [`name_value_string_forms`] in the HII database for a handle
+    /// with its device path, then install ExportConfig()'s results, with the settings of its
+    /// VARSTORE_NAME_VALUE, as the HII Configuration Routing Protocol's configuration table.
+    ExportNameValueStringConfig,
     /// Install an EFI_RT_PROPERTIES_TABLE of this Version and RuntimeServicesSupported.
     InstallRtProperties(u16, u32),
     /// Install this JSON configuration table.
@@ -600,6 +676,9 @@ fn load_option() -> Option<Task> {
         Ok(option) if option == cstr16!("disabled-form-forms") => {
             Some(Task::RegisterDisabledFormForms)
         }
+        Ok(option) if option == cstr16!("form-set-disable-if-forms") => {
+            Some(Task::RegisterFormSetDisableIfForms)
+        }
         Ok(option) if option == cstr16!("short-var-store-forms") => {
             Some(Task::RegisterShortVarStoreForms)
         }
@@ -627,14 +706,29 @@ fn load_option() -> Option<Task> {
         Ok(option) if option == cstr16!("rt-data-name-value-password-forms") => {
             Some(Task::PublishNameValuePasswordForms)
         }
+        Ok(option) if option == cstr16!("rt-data-name-value-string-forms") => {
+            Some(Task::PublishNameValueStringForms)
+        }
         Ok(option) if option == cstr16!("storageless-password-forms") => {
             Some(Task::RegisterStoragelessPasswordForms)
         }
         Ok(option) if option == cstr16!("rt-data-storageless-password-forms") => {
             Some(Task::PublishStoragelessPasswordForms)
         }
+        Ok(option) if option == cstr16!("undeclared-password-forms") => {
+            Some(Task::RegisterUndeclaredPasswordForms)
+        }
+        Ok(option) if option == cstr16!("rt-data-undeclared-password-forms") => {
+            Some(Task::PublishUndeclaredPasswordForms)
+        }
         Ok(option) if option == cstr16!("padded-strings") => Some(Task::RegisterPaddedStrings),
         Ok(option) if option == cstr16!("string-blocks") => Some(Task::RegisterStringBlocks),
+        Ok(option) if option == cstr16!("callback-forms") => Some(Task::RegisterCallbackForms(
+            callback_forms::Forms::Callbacks,
+        )),
+        Ok(option) if option == cstr16!("callback-forms-password") => {
+            Some(Task::RegisterCallbackForms(callback_forms::Forms::Password))
+        }
         Ok(option) if option == cstr16!("acpi-table") => {
             Some(Task::PublishAcpiTable(QHII_SIGNATURE))
         }
@@ -652,6 +746,12 @@ fn load_option() -> Option<Task> {
         Ok(option) if option == cstr16!("export-config-storageless-password") => {
             Some(Task::ExportStoragelessConfig)
         }
+        Ok(option) if option == cstr16!("export-config-undeclared-password") => {
+            Some(Task::ExportUndeclaredConfig)
+        }
+        Ok(option) if option == cstr16!("export-config-name-value-string") => {
+            Some(Task::ExportNameValueStringConfig)
+        }
         Ok(option) if option == cstr16!("rt-properties-no-set-variable") => {
             Some(Task::InstallRtProperties(
                 RT_PROPERTIES_TABLE_VERSION,
@@ -921,6 +1021,32 @@ fn register_storageless_password_forms() -> Result<(), Failure> {
         })
 }
 
+/// Registers the package lists of [`undeclared_password_forms`] for a new handle with their
+/// device path, as one driver registers several.
+fn register_undeclared_password_forms() -> Result<(), Failure> {
+    let driver = install_device_path(&undeclared_password_forms::DRIVER_PATH)?;
+    undeclared_password_forms::package_lists()
+        .iter()
+        .try_for_each(|list| {
+            register_package_list_for(
+                list,
+                Some(driver),
+                "registering the undeclared password forms",
+            )
+        })
+}
+
+/// Registers the package list of [`name_value_string_forms`] for a new handle with its device
+/// path.
+fn register_name_value_string_forms() -> Result<(), Failure> {
+    let driver = install_device_path(&name_value_string_forms::DRIVER_PATH)?;
+    register_package_list_for(
+        &name_value_string_forms::package_list_bytes(),
+        Some(driver),
+        "registering the name/value string forms",
+    )
+}
+
 /// Creates the variables of [`nested_password_forms`] unless they exist, then registers its
 /// package list.
 fn register_nested_password_forms() -> Result<(), Failure> {
diff --git a/tests/qemu/publish-hiidb/src/name_value_password_forms.rs b/tests/qemu/publish-hiidb/src/name_value_password_forms.rs
index 0226096..cce02fd 100644
--- a/tests/qemu/publish-hiidb/src/name_value_password_forms.rs
+++ b/tests/qemu/publish-hiidb/src/name_value_password_forms.rs
@@ -16,7 +16,7 @@
 //! Linux scenarios `hii-name-value-password` and `hii-name-value-password-snapshot` of
 //! `tests/qemu/scenarios.tsv`. The first list's form set declares the buffer VARSTORE NvBacking,
 //! VarStoreId 1, with a UINT32 NUMERIC over its bytes 0..4, and the VARSTORE_NAME_VALUE of
-//! VarStoreId 3, with a UINT32 NUMERIC and a PASSWORD on its name "Pin"; the second list's form
+//! VarStoreId 3, with a UINT32 NUMERIC, a PASSWORD and a STRING on "Pin"; the second list's form
 //! set has a UINT16 NUMERIC over the buffer VARSTORE Other. A VARSTORE_NAME_VALUE is one whose
 //! values its driver exposes, as UEFI 2.11 §33.2.5.6 says, through EFI_HII_CONFIG_ACCESS_PROTOCOL,
 //! in storage of its own choosing, and one driver may serve several package lists
@@ -39,14 +39,15 @@ use crate::hii_package::op;
 use crate::hii_package::package;
 use crate::hii_package::package_list;
 use crate::hii_package::question_header;
+use crate::hii_package::string_op;
 use crate::hii_package::strings_package;
 use crate::hii_package::uint16_numeric;
 use crate::hii_package::uint32_numeric;
 use crate::hii_package::var_store;
+use crate::hii_package::var_store_name_value_op;
 use crate::hii_package::EFI_HII_PACKAGE_FORMS;
 use crate::hii_package::EFI_IFR_FORM_OP;
 use crate::hii_package::EFI_IFR_PASSWORD_OP;
-use crate::hii_package::EFI_IFR_VARSTORE_NAME_VALUE_OP;
 use crate::vendor_device_path;
 
 /// The GUID of the first package list and of its form set.
@@ -74,9 +75,11 @@ const HELP: u16 = 4;
 const PIN_NAME: u16 = 5;
 const PASSWORD: u16 = 6;
 const PIN_NUMBER: u16 = 7;
-/// The name of the VARSTORE_NAME_VALUE's value that the NUMERIC and the PASSWORD are on.
+const PIN_STRING: u16 = 8;
+/// The name of the VARSTORE_NAME_VALUE's value that the NUMERIC, the PASSWORD and the STRING are
+/// on.
 const PIN_LABEL: &str = "Pin";
-const STRINGS: [&str; 7] = [
+const STRINGS: [&str; 8] = [
     "English",
     "Backing setting",
     "uefisettings QEMU name value password forms",
@@ -84,6 +87,7 @@ const STRINGS: [&str; 7] = [
     PIN_LABEL,
     "Name value password",
     "Name value pin as a number",
+    "Name value pin as a string",
 ];
 /// The language and the strings, from string ID 1, of the first package list's x-UEFI-ns
 /// strings package: the keyword of "Backing setting" (UEFI 2.11 §35.2.1.6).
@@ -111,6 +115,8 @@ const OTHER_SIZE: u16 = 2;
 /// The MinSize and MaxSize of the PASSWORD, in characters.
 const PASSWORD_MIN_SIZE: u16 = 4;
 const PASSWORD_MAX_SIZE: u16 = 8;
+/// The MaxSize of the STRING, in characters: room for the 2 CHAR16s of [`PIN`]'s 8 digits.
+const PIN_STRING_MAX_SIZE: u8 = 4;
 
 /// The package lists, as NewPackageList() takes them.
 pub(crate) fn package_lists() -> [Vec<u8>; 2] {
@@ -140,7 +146,8 @@ pub(crate) fn pin_resp() -> String {
 }
 
 /// The first list's form package: its form set, NvBacking, the VARSTORE_NAME_VALUE and one form
-/// that holds the NUMERIC over NvBacking, the NUMERIC on "Pin" and the PASSWORD on "Pin".
+/// that holds the NUMERIC over NvBacking, the NUMERIC on "Pin", the PASSWORD on "Pin" and the
+/// STRING on "Pin".
 fn name_value_forms() -> Vec<u8> {
     let password = op(
         EFI_IFR_PASSWORD_OP,
@@ -164,15 +171,7 @@ fn name_value_forms() -> Vec<u8> {
             NV_BACKING_SIZE,
             b"NvBacking\0",
         ),
-        op(
-            EFI_IFR_VARSTORE_NAME_VALUE_OP,
-            false,
-            &[
-                &NAME_VALUE_ID.to_le_bytes()[..],
-                &NAME_VALUE_GUID.to_bytes(),
-            ]
-            .concat(),
-        ),
+        var_store_name_value_op(NAME_VALUE_ID, NAME_VALUE_GUID),
         op(EFI_IFR_FORM_OP, true, &form),
         uint32_numeric(question_header(BACKING_SETTING, HELP, 1, NV_BACKING_ID, 0)),
         uint32_numeric(question_header(
@@ -183,6 +182,11 @@ fn name_value_forms() -> Vec<u8> {
             PIN_NAME,
         )),
         password,
+        string_op(
+            question_header(PIN_STRING, HELP, 4, NAME_VALUE_ID, PIN_NAME),
+            0,
+            PIN_STRING_MAX_SIZE,
+        ),
         end(), // of the form
         end(), // of the form set
     ]
diff --git a/tests/qemu/publish-hiidb/src/name_value_string_forms.rs b/tests/qemu/publish-hiidb/src/name_value_string_forms.rs
new file mode 100644
index 0000000..a7506be
--- /dev/null
+++ b/tests/qemu/publish-hiidb/src/name_value_string_forms.rs
@@ -0,0 +1,155 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The HII package list that `rt-data-name-value-string-forms` and
+//! `export-config-name-value-string` register in the HII database for a handle with the device
+//! path [`DRIVER_PATH`], for the Linux scenarios `hii-name-value-string` and
+//! `hii-name-value-string-snapshot` of `tests/qemu/scenarios.tsv`. Its form set declares a
+//! VARSTORE_NAME_VALUE, whose values its driver exposes, as UEFI 2.11 §33.2.5.6 says, through
+//! EFI_HII_CONFIG_ACCESS_PROTOCOL, and no PASSWORD; on each name of [`STRING_SETTINGS`] a STRING
+//! of MaxSize [`STRING_MAX_SIZE`], and on [`FLAG_SETTING`]'s a CHECKBOX, each prompted by its
+//! name. [`settings_resp`] is the `<ConfigResp>` that `export-config-name-value-string` appends
+//! to ExportConfig()'s results: as a STRING reads them, 4 hex digits per `<Char>` (UEFI 2.11
+//! §35.2.1.2), Text holds "AB", Nul "AB" and a NULL, Full "ABCD", Padded "ABCD" and a NULL,
+//! Long 5 characters, Odd one and 2 digits, and Empty none.
+
+use alloc::format;
+use alloc::string::String;
+use alloc::vec;
+use alloc::vec::Vec;
+
+use uefi::guid;
+use uefi::Guid;
+
+use crate::hii_package::end;
+use crate::hii_package::form_set_op;
+use crate::hii_package::op;
+use crate::hii_package::package;
+use crate::hii_package::package_list;
+use crate::hii_package::question_header;
+use crate::hii_package::string_op;
+use crate::hii_package::strings_package;
+use crate::hii_package::var_store_name_value_op;
+use crate::hii_package::EFI_HII_PACKAGE_FORMS;
+use crate::hii_package::EFI_IFR_CHECKBOX_OP;
+use crate::hii_package::EFI_IFR_FORM_OP;
+use crate::vendor_device_path;
+
+/// The GUID of the package list and of its form set.
+const FORM_SET: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002200");
+/// The GUID of the VARSTORE_NAME_VALUE.
+const NAME_VALUE_GUID: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002201");
+/// The Vendor_GUID of the Vendor Device Path node of [`DRIVER_PATH`].
+const DRIVER_VENDOR: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002202");
+/// The device path of the handle that registers the package list.
+pub(crate) static DRIVER_PATH: [u8; 24] = vendor_device_path(DRIVER_VENDOR);
+
+/// The names of the VARSTORE_NAME_VALUE's values that the STRINGs are on, with the digits that
+/// [`settings_resp`] gives each.
+const STRING_SETTINGS: [(&str, &str); 7] = [
+    ("Text", "00410042"),
+    ("Nul", "004100420000"),
+    ("Full", "0041004200430044"),
+    ("Padded", "00410042004300440000"),
+    ("Long", "00410042004300440045"),
+    ("Odd", "004100"),
+    ("Empty", ""),
+];
+/// The name of the VARSTORE_NAME_VALUE's value that the CHECKBOX is on, with its digits: 1.
+const FLAG_SETTING: (&str, &str) = ("Flag", "01");
+
+// The strings, from string ID 2, after the language name: TITLE, HELP, then the names of
+// STRING_SETTINGS and FLAG_SETTING's, from FIRST_NAME on.
+const TITLE: u16 = 2;
+const HELP: u16 = 3;
+const FIRST_NAME: u16 = 4;
+const LANGUAGE_AND_TEXTS: [&str; 3] = [
+    "English",
+    "uefisettings QEMU name value string forms",
+    "A question of a VARSTORE_NAME_VALUE",
+];
+
+/// The VarStoreId of the VARSTORE_NAME_VALUE.
+const NAME_VALUE_ID: u16 = 1;
+/// The MaxSize of each STRING, in characters.
+const STRING_MAX_SIZE: u8 = 4;
+
+/// The package list, as NewPackageList() takes it.
+pub(crate) fn package_list_bytes() -> Vec<u8> {
+    let names = STRING_SETTINGS
+        .into_iter()
+        .chain([FLAG_SETTING])
+        .map(|(name, _)| name);
+    package_list(
+        FORM_SET,
+        &[
+            strings_package(LANGUAGE_AND_TEXTS.into_iter().chain(names)),
+            forms(),
+        ],
+    )
+}
+
+/// The `<ConfigResp>` that the driver at [`DRIVER_PATH`] would export for the
+/// VARSTORE_NAME_VALUE, whose `<ConfigHdr>` (UEFI 2.11 §35.2.1.3) has an empty NAME, as the
+/// VarStore names no variable: an `<NvConfig>` (§35.2.1.4) of each name of [`STRING_SETTINGS`]
+/// and of [`FLAG_SETTING`]'s, in that order.
+pub(crate) fn settings_resp() -> String {
+    let hex = |bytes: &[u8]| -> String { bytes.iter().map(|byte| format!("{byte:02x}")).collect() };
+    let settings: String = STRING_SETTINGS
+        .into_iter()
+        .chain([FLAG_SETTING])
+        .map(|(name, digits)| format!("&{name}={digits}"))
+        .collect();
+    format!(
+        "GUID={}&NAME=&PATH={}{settings}",
+        hex(&NAME_VALUE_GUID.to_bytes()),
+        hex(&DRIVER_PATH),
+    )
+}
+
+/// The form package: the form set, the VARSTORE_NAME_VALUE and one form that holds a STRING on
+/// each name of [`STRING_SETTINGS`], then the CHECKBOX on [`FLAG_SETTING`]'s, each of the
+/// QuestionId after the one before it, from 1, and prompted by its name.
+fn forms() -> Vec<u8> {
+    let question =
+        |name: u16| question_header(name, HELP, name - FIRST_NAME + 1, NAME_VALUE_ID, name);
+    let mut names = FIRST_NAME..;
+    let strings: Vec<Vec<u8>> = STRING_SETTINGS
+        .iter()
+        .zip(names.by_ref())
+        .map(|(_, name)| string_op(question(name), 0, STRING_MAX_SIZE))
+        .collect();
+    let flag = names
+        .next()
+        .expect("a string ID after the names of the STRINGs");
+    let form = [1u16.to_le_bytes(), TITLE.to_le_bytes()].concat();
+    let body = [
+        vec![
+            form_set_op(FORM_SET, TITLE, HELP),
+            var_store_name_value_op(NAME_VALUE_ID, NAME_VALUE_GUID),
+            op(EFI_IFR_FORM_OP, true, &form),
+        ],
+        strings,
+        vec![
+            op(
+                EFI_IFR_CHECKBOX_OP,
+                false,
+                &[&question(flag)[..], &[0]].concat(),
+            ),
+            end(), // of the form
+            end(), // of the form set
+        ],
+    ]
+    .concat()
+    .concat();
+    package(EFI_HII_PACKAGE_FORMS, &body)
+}
diff --git a/tests/qemu/publish-hiidb/src/undeclared_password_forms.rs b/tests/qemu/publish-hiidb/src/undeclared_password_forms.rs
new file mode 100644
index 0000000..b74df3e
--- /dev/null
+++ b/tests/qemu/publish-hiidb/src/undeclared_password_forms.rs
@@ -0,0 +1,186 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The HII package lists that `undeclared-password-forms`, `rt-data-undeclared-password-forms`
+//! and `export-config-undeclared-password` register in the HII database for a handle with the
+//! device path [`DRIVER_PATH`], for the UEFI Shell scenario `shell-undeclared-password` and the
+//! Linux scenarios `hii-undeclared-password` and `hii-undeclared-password-snapshot` of
+//! `tests/qemu/scenarios.tsv`. The first list's form set declares the buffer VARSTORE UdBacking,
+//! VarStoreId 1, with a UINT32 NUMERIC over its bytes 0..4, of the x-UEFI-ns keyword
+//! UndeclaredSetting, and a PASSWORD of VarStoreId 9, which no VarStore of its form package
+//! declares, so it names no VarStore: UEFI 2.11 §33.3.8.2.2 asks for "a previously declared
+//! variable store"; the second list's form set has a UINT16 NUMERIC over the buffer VARSTORE
+//! Other. Its driver, which may serve several package lists, keeps that password where it
+//! chooses, so in any variable: `tests/qemu/vars/undeclared-password.json` creates UdBacking
+//! holding [`PIN`] where the NUMERIC reads, and Other. The PASSWORD's prompt has no x-UEFI-ns
+//! keyword, so no keyword request selects it, and UdBacking is a buffer VARSTORE, not a
+//! VARSTORE_EFI, so edk2 resolves the PASSWORD's storage neither when it registers the forms nor
+//! when it exports their configuration.
+
+use alloc::format;
+use alloc::string::String;
+use alloc::vec::Vec;
+
+use uefi::guid;
+use uefi::Guid;
+
+use crate::hii_package::end;
+use crate::hii_package::form_set_op;
+use crate::hii_package::language_strings_package;
+use crate::hii_package::op;
+use crate::hii_package::package;
+use crate::hii_package::package_list;
+use crate::hii_package::question_header;
+use crate::hii_package::strings_package;
+use crate::hii_package::uint16_numeric;
+use crate::hii_package::uint32_numeric;
+use crate::hii_package::var_store;
+use crate::hii_package::EFI_HII_PACKAGE_FORMS;
+use crate::hii_package::EFI_IFR_FORM_OP;
+use crate::hii_package::EFI_IFR_PASSWORD_OP;
+use crate::vendor_device_path;
+
+/// The GUID of the first package list and of its form set.
+const UNDECLARED_FORM_SET: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002300");
+/// The vendor GUID of UdBacking.
+const UD_BACKING_VENDOR: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002301");
+/// The GUID of the second package list and of its form set.
+const OTHER_FORM_SET: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002302");
+/// The vendor GUID of Other.
+const OTHER_VENDOR: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002303");
+/// The Vendor_GUID of the Vendor Device Path node of [`DRIVER_PATH`].
+const DRIVER_VENDOR: Guid = guid!("8c78a505-baa0-4c4a-869f-000000002304");
+/// The device path of the handle that registers both package lists.
+pub(crate) static DRIVER_PATH: [u8; 24] = vendor_device_path(DRIVER_VENDOR);
+/// The value that `tests/qemu/vars/undeclared-password.json` puts in UdBacking's bytes 0..4,
+/// little-endian, standing for a password that the PASSWORD's driver keeps there, and that the
+/// `<ConfigResp>` of [`backing_resp`] holds.
+const PIN: u32 = 0x7A4C_19E3;
+
+// The strings of the first package list, from string ID 2, after the language name.
+const BACKING_SETTING: u16 = 2;
+const TITLE: u16 = 3;
+const HELP: u16 = 4;
+const PASSWORD_PROMPT: u16 = 5;
+const STRINGS: [&str; 5] = [
+    "English",
+    "Undeclared backing setting",
+    "uefisettings QEMU undeclared password forms",
+    "A password question of a VarStoreId that no VarStore declares",
+    "Undeclared password",
+];
+/// The language and the strings, from string ID 1, of the first package list's x-UEFI-ns
+/// strings package: the keyword of "Undeclared backing setting" (UEFI 2.11 §35.2.1.6).
+const KEYWORD_LANGUAGE: &[u8] = b"x-UEFI-ns\0";
+const KEYWORD_STRINGS: [&str; 2] = ["UefiNameSpace", "UndeclaredSetting"];
+
+// The strings of the second package list, likewise.
+const OTHER_SETTING: u16 = 2;
+const OTHER_TITLE: u16 = 3;
+const OTHER_HELP: u16 = 4;
+const OTHER_STRINGS: [&str; 4] = [
+    "English",
+    "Undeclared other setting",
+    "uefisettings QEMU undeclared password other forms",
+    "A question of another package list of the driver of the undeclared password",
+];
+
+/// The VarStoreIds of UdBacking and of Other, and the one of the PASSWORD, which no VarStore of
+/// its form package declares.
+const UD_BACKING_ID: u16 = 1;
+const OTHER_ID: u16 = 2;
+const UNDECLARED_ID: u16 = 9;
+/// The name and the size of UdBacking, and the size of Other.
+const UD_BACKING_NAME: &str = "UdBacking";
+const UD_BACKING_SIZE: u16 = 4;
+const OTHER_SIZE: u16 = 2;
+/// The MinSize and MaxSize of the PASSWORD, in characters.
+const PASSWORD_MIN_SIZE: u16 = 4;
+const PASSWORD_MAX_SIZE: u16 = 8;
+
+/// The package lists, as NewPackageList() takes them.
+pub(crate) fn package_lists() -> [Vec<u8>; 2] {
+    let keywords = language_strings_package(KEYWORD_LANGUAGE, KEYWORD_STRINGS);
+    [
+        package_list(
+            UNDECLARED_FORM_SET,
+            &[strings_package(STRINGS), keywords, undeclared_forms()],
+        ),
+        package_list(
+            OTHER_FORM_SET,
+            &[strings_package(OTHER_STRINGS), other_forms()],
+        ),
+    ]
+}
+
+/// The `<ConfigResp>` of UdBacking that the driver at [`DRIVER_PATH`] would export, as edk2's
+/// HiiConstructConfigHdr and BlockToConfig write one: its NAME in hex CHAR16s and its bytes
+/// holding [`PIN`], VALUE's digits most significant first (UEFI 2.11 §35.4.6).
+pub(crate) fn backing_resp() -> String {
+    let hex = |bytes: &[u8]| -> String { bytes.iter().map(|byte| format!("{byte:02x}")).collect() };
+    let name: String = UD_BACKING_NAME
+        .encode_utf16()
+        .map(|unit| format!("{unit:04x}"))
+        .collect();
+    format!(
+        "GUID={}&NAME={name}&PATH={}&OFFSET=0&WIDTH={UD_BACKING_SIZE:x}&VALUE={PIN:08x}",
+        hex(&UD_BACKING_VENDOR.to_bytes()),
+        hex(&DRIVER_PATH),
+    )
+}
+
+/// The first list's form package: its form set, UdBacking and one form that holds the UINT32
+/// NUMERIC over UdBacking and the PASSWORD of VarStoreId 9.
+fn undeclared_forms() -> Vec<u8> {
+    let form = [1u16.to_le_bytes(), TITLE.to_le_bytes()].concat();
+    let password = [
+        question_header(PASSWORD_PROMPT, HELP, 2, UNDECLARED_ID, 0),
+        [
+            PASSWORD_MIN_SIZE.to_le_bytes(),
+            PASSWORD_MAX_SIZE.to_le_bytes(),
+        ]
+        .concat(),
+    ]
+    .concat();
+    let body = [
+        form_set_op(UNDECLARED_FORM_SET, TITLE, HELP),
+        var_store(
+            UD_BACKING_ID,
+            UD_BACKING_VENDOR,
+            UD_BACKING_SIZE,
+            &[UD_BACKING_NAME.as_bytes(), &[0]].concat(),
+        ),
+        op(EFI_IFR_FORM_OP, true, &form),
+        uint32_numeric(question_header(BACKING_SETTING, HELP, 1, UD_BACKING_ID, 0)),
+        op(EFI_IFR_PASSWORD_OP, false, &password),
+        end(), // of the form
+        end(), // of the form set
+    ]
+    .concat();
+    package(EFI_HII_PACKAGE_FORMS, &body)
+}
+
+/// The second list's form package: its form set, Other and one form that holds the UINT16
+/// NUMERIC over Other.
+fn other_forms() -> Vec<u8> {
+    let form = [1u16.to_le_bytes(), OTHER_TITLE.to_le_bytes()].concat();
+    let body = [
+        form_set_op(OTHER_FORM_SET, OTHER_TITLE, OTHER_HELP),
+        var_store(OTHER_ID, OTHER_VENDOR, OTHER_SIZE, b"Other\0"),
+        op(EFI_IFR_FORM_OP, true, &form),
+        uint16_numeric(question_header(OTHER_SETTING, OTHER_HELP, 1, OTHER_ID, 0)),
+        end(), // of the form
+        end(), // of the form set
+    ]
+    .concat();
+    package(EFI_HII_PACKAGE_FORMS, &body)
+}
diff --git a/tests/qemu/run.sh b/tests/qemu/run.sh
index c3d8c3e..80e263a 100755
--- a/tests/qemu/run.sh
+++ b/tests/qemu/run.sh
@@ -43,7 +43,10 @@ shift
 # PL011 UART, so the aarch64 guests write to a virtio console. Debian's i686 kernel has
 # efivarfs as a module. aarch64 runs under TCG, so it boots on x86_64 hosts like the others.
 # Fedora's kernel has that virtio console as a module. modules lists the modules of every guest
-# of the architecture, and guest_modules the one more module of a guest, if any.
+# of the architecture, guest_modules the one more module of a guest, if any, and
+# esp_disk_modules those of devices=esp-disk, each after those that it depends on: on i686,
+# virtio's PCI transport and block driver, FAT and NLS; on x86_64 and aarch64 only FAT, which
+# Fedora's kernel-modules-core ships, as kernel-core builds in the rest.
 # vamap_args, the QEMU arguments of the vamap scenarios, make the kernel call
 # SetVirtualAddressMap(), which x86 Linux does at every boot (Linux v6.11
 # arch/x86/platform/efi/efi.c efi_enter_virtual_mode()).
@@ -55,6 +58,7 @@ x86_64)
     firmware_vars=usr/share/OVMF/OVMF_VARS_4M.fd
     vmlinuz_pattern='lib/modules/*/vmlinuz'
     modules=()
+    esp_disk_modules=('lib/modules/*/kernel/fs/fat/fat.ko.xz' 'lib/modules/*/kernel/fs/fat/vfat.ko.xz')
     console=ttyS0
     tty=ttyS1
     tty_device=(-serial chardev:tty)
@@ -80,6 +84,18 @@ i686)
     firmware_vars=usr/share/OVMF/OVMF32_VARS_4M.fd
     vmlinuz_pattern='boot/vmlinuz-*'
     modules=('lib/modules/*/kernel/fs/efivarfs/efivarfs.ko')
+    esp_disk_modules=(
+        'lib/modules/*/kernel/drivers/virtio/virtio.ko'
+        'lib/modules/*/kernel/drivers/virtio/virtio_ring.ko'
+        'lib/modules/*/kernel/drivers/virtio/virtio_pci_legacy_dev.ko'
+        'lib/modules/*/kernel/drivers/virtio/virtio_pci_modern_dev.ko'
+        'lib/modules/*/kernel/drivers/virtio/virtio_pci.ko'
+        'lib/modules/*/kernel/drivers/block/virtio_blk.ko'
+        'lib/modules/*/kernel/fs/fat/fat.ko'
+        'lib/modules/*/kernel/fs/fat/vfat.ko'
+        'lib/modules/*/kernel/fs/nls/nls_cp437.ko'
+        'lib/modules/*/kernel/fs/nls/nls_ascii.ko'
+    )
     console=ttyS0
     tty=ttyS1
     tty_device=(-serial chardev:tty)
@@ -111,6 +127,7 @@ aarch64)
     vmlinuz_pattern='lib/modules/*/vmlinuz'
     modules=()
     guest_modules=([unfixed]='lib/modules/*/kernel/drivers/char/virtio_console.ko.xz')
+    esp_disk_modules=('lib/modules/*/kernel/fs/fat/fat.ko.xz' 'lib/modules/*/kernel/fs/fat/vfat.ko.xz')
     console=ttyAMA0
     tty=hvc0
     tty_device=(-device virtio-serial-pci -device "virtconsole,chardev=tty")
@@ -183,7 +200,7 @@ done
 # The test binaries that the Linux boots of the scenarios name, the fourth column.
 mapfile -t named < <(awk -F '\t' '$1 !~ /^(#|$)/ {
     n = split($4, boots, ",")
-    for (i = 1; i <= n; i++) if (boots[i] !~ /^shell:/) { sub("/.*", "", boots[i]); print boots[i] }
+    for (i = 1; i <= n; i++) if (boots[i] !~ /^(rebooting-)?shell:/) { sub("/.*", "", boots[i]); print boots[i] }
 }' "$here/scenarios.tsv")
 
 # One run of an architecture at a time, such as make -j's of its Linux and UEFI Shell
@@ -421,12 +438,22 @@ while IFS=$'\t' read -r -u 3 name drivers variables boots options || [[ -n $name
     if [[ -n $option_guest && -n ${guest_modules[$option_guest]-} ]]; then
         patterns+=("${guest_modules[$option_guest]}")
     fi
-    # busybox insmod takes no compressed module.
+    # devices=esp-disk: Linux mounts that disk's ESP with these modules and stages on it the
+    # uefisettings.efi of the UEFI Shell boots, /uefisettings.efi in the initramfs.
+    if [[ " ${option_devices[*]} " == *" esp-disk "* ]]; then
+        patterns+=("${esp_disk_modules[@]}")
+        cp "$run/shell-esp/uefisettings.efi" "$dir/initramfs/"
+    fi
+    # busybox insmod takes no compressed module. init loads the modules in the order of their
+    # names, which number them in the order of patterns.
+    number=0
     for module in "${patterns[@]}"; do
+        number=$((number + 1))
         module=$(guest_file "$packages" "$module")
+        copy=$dir/initramfs/lib/modules/$(printf %02d "$number")-$(basename "$module" .xz)
         case $module in
-        *.ko.xz) xz --decompress --stdout "$module" >"$dir/initramfs/lib/modules/$(basename "$module" .xz)" ;;
-        *) cp "$module" "$dir/initramfs/lib/modules/" ;;
+        *.ko.xz) xz --decompress --stdout "$module" >"$copy" ;;
+        *) cp "$module" "$copy" ;;
         esac
     done
     cp "$packages/usr/bin/busybox" "$dir/initramfs/bin/busybox"
@@ -483,6 +510,13 @@ while IFS=$'\t' read -r -u 3 name drivers variables boots options || [[ -n $name
         case $device in
         # Its driver, VirtioRngDxe, gives the firmware EFI_RNG_PROTOCOL.
         virtio-rng) device_args+=(-device virtio-rng-pci) ;;
+        # A writable disk that the boots of the scenario share, after the read-only ESP of
+        # guest_args: /dev/vdb in Linux, which formats its EFI system partition.
+        esp-disk)
+            truncate --size=64M "$dir/esp-disk.img"
+            sfdisk --quiet "$dir/esp-disk.img" <"$here/esp-disk.sfdisk"
+            device_args+=(-drive "if=virtio,format=raw,file=$dir/esp-disk.img")
+            ;;
         esac
     done
     boot=0
@@ -491,15 +525,19 @@ while IFS=$'\t' read -r -u 3 name drivers variables boots options || [[ -n $name
         boot=$((boot + 1))
         log=$dir/boot$boot
         echo "run.sh: $name boot $boot: $spec"
+        # A reset ends QEMU, but in a rebooting-shell: boot, which a reset before its UEFI Shell
+        # restarts, such as the one that ends the boot of a staged set's Boot####.
+        reboot_args=(-no-reboot)
         case $spec in
-        shell:*)
+        shell:* | rebooting-shell:*)
             # Without a kernel, the firmware boots its UEFI Shell, which runs startup.nsh:
             # the boot's script, on a copy of the ESP that also holds uefisettings.efi, the
             # capsule payloads of shell/capsule in \capsule, and the kernel and initrd, which
             # the line @LINUX@ of the script starts from the shell, into the guest test
             # boot_smoke. The Secure Boot scenarios also get the pinned Shell, as the removable
             # media boot loader, their payloads in \auth and what uefisettings signs with in \sign.
-            script=$here/shell/${spec#shell:}
+            [[ $spec != rebooting-shell:* ]] || reboot_args=()
+            script=$here/shell/${spec#*shell:}
             esp=$log.esp
             cp -r "$run/esp" "$esp"
             if [[ $option_firmware != default ]]; then
@@ -543,7 +581,7 @@ while IFS=$'\t' read -r -u 3 name drivers variables boots options || [[ -n $name
         # (KVM_EXIT_SHUTDOWN) after its triple fault and 2 (I/O) after a reset through a port.
         # The console is the first serial port, before any of guest_args.
         : >"$log.qemu.log"
-        timeout --foreground -k 10 120 "${boot_qemu[@]}" -nodefaults -no-user-config -no-reboot \
+        timeout --foreground -k 10 120 "${boot_qemu[@]}" -nodefaults -no-user-config "${reboot_args[@]}" \
             -display none -sandbox on -m 1024 -smp 2 \
             -drive "if=pflash,format=raw,unit=0,readonly=on,file=$code" \
             -drive "if=pflash,format=raw,unit=1,file=$dir/vars.fd" \
@@ -560,7 +598,7 @@ while IFS=$'\t' read -r -u 3 name drivers variables boots options || [[ -n $name
         mv "$log.qemu.log.new" "$log.qemu.log"
         passed=yes
         case $spec in
-        shell:*)
+        shell:* | rebooting-shell:*)
             # shell/NAME.ARCH.tsv, if any, holds the checks of shell/NAME.nsh on ARCH instead
             expectations=$script.tsv
             [[ ! -f $script.$arch.tsv ]] || expectations=$script.$arch.tsv
diff --git a/tests/qemu/scenario-options-test.sh b/tests/qemu/scenario-options-test.sh
index 5a47aa0..150ed21 100755
--- a/tests/qemu/scenario-options-test.sh
+++ b/tests/qemu/scenario-options-test.sh
@@ -84,6 +84,9 @@ accepts firmware=secboot-user 'kernel= firmware=secboot-user arch=x86_64,i686,aa
 accepts arch=i686 'kernel= firmware=default arch=i686 devices= guest= params='
 accepts arch=aarch64,x86_64 'kernel= firmware=default arch=aarch64,x86_64 devices= guest= params='
 accepts devices=virtio-rng "kernel= $all devices=virtio-rng guest= params="
+accepts 'devices=esp-disk arch=i686' 'kernel= firmware=default arch=i686 devices=esp-disk guest= params='
+accepts 'arch=i686 devices=virtio-rng,esp-disk' \
+    'kernel= firmware=default arch=i686 devices=virtio-rng,esp-disk guest= params='
 accepts 'devices=virtio-rng firmware=secboot-user kernel=lockdown arch=x86_64,i686' \
     'kernel=lockdown firmware=secboot-user arch=x86_64,i686 devices=virtio-rng guest= params='
 accepts guest=unfixed "kernel= $all devices= guest=unfixed params="
@@ -130,9 +133,10 @@ refuses arch=riscv64 \
 refuses arch=x86 \
     'scenarios.tsv: test: unknown element x86 in arch=x86; the elements are x86_64 i686 aarch64'
 refuses devices=fat-disk \
-    'scenarios.tsv: test: unknown element fat-disk in devices=fat-disk; the elements are virtio-rng'
+    'scenarios.tsv: test: unknown element fat-disk in devices=fat-disk; the elements are virtio-rng esp-disk'
 refuses devices=virtio \
-    'scenarios.tsv: test: unknown element virtio in devices=virtio; the elements are virtio-rng'
+    'scenarios.tsv: test: unknown element virtio in devices=virtio; the elements are virtio-rng esp-disk'
+accepts devices=esp-disk "kernel= $all devices=esp-disk guest= params="
 refuses devices=virtio-rng,virtio-rng \
     'scenarios.tsv: test: repeated element virtio-rng in devices=virtio-rng,virtio-rng'
 refuses guest= 'scenarios.tsv: test: unknown value guest=; the values are unfixed unfixed-v5.8'
diff --git a/tests/qemu/scenario-options.sh b/tests/qemu/scenario-options.sh
index a8cb2c2..f223ffb 100644
--- a/tests/qemu/scenario-options.sh
+++ b/tests/qemu/scenario-options.sh
@@ -20,7 +20,8 @@
 #                                        default: default
 #   arch=ARCH[,ARCH]...                  the architectures, of x86_64, i686 and aarch64, that boot
 #                                        the scenario; default: all three
-#   devices=DEVICE[,DEVICE]...           QEMU devices to add, of virtio-rng; default: none
+#   devices=DEVICE[,DEVICE]...           QEMU devices to add, of virtio-rng and esp-disk (run.sh);
+#                                        default: none
 #   guest=unfixed|unfixed-v5.8           the guest of guest-packages-<arch>-unfixed, or of
 #                                        guest-packages-x86_64-unfixed-v5.8, which needs
 #                                        arch=x86_64: Linux without upstream 0e8d2444168d (run.sh);
@@ -82,7 +83,7 @@ scenario_options() {
             option_firmware=$value
             ;;
         arch) scenario_option_list "$name" "$key" "$value" option_arches x86_64 i686 aarch64 || return 1 ;;
-        devices) scenario_option_list "$name" "$key" "$value" option_devices virtio-rng || return 1 ;;
+        devices) scenario_option_list "$name" "$key" "$value" option_devices virtio-rng esp-disk || return 1 ;;
         guest)
             scenario_option_value "$name" "$key" "$value" unfixed unfixed-v5.8 || return 1
             option_guest=$value
diff --git a/tests/qemu/scenarios.tsv b/tests/qemu/scenarios.tsv
index d17d4b6..61ed0f5 100644
--- a/tests/qemu/scenarios.tsv
+++ b/tests/qemu/scenarios.tsv
@@ -7,7 +7,8 @@
 #   boots        the boots, separated by ",", which share one UEFI variable store: each is a
 #                test binary of tests/qemu/guest/tests, then "/" and a libtest filter if any,
 #                or "shell:" and a script of tests/qemu/shell, which the firmware's UEFI Shell
-#                runs instead of Linux (check-shell-log.sh)
+#                runs instead of Linux (check-shell-log.sh), or "rebooting-shell:" and such a
+#                script, in a boot that a reset before the Shell restarts instead of ending
 #   options      key=value tokens separated by single spaces, each key at most once, which
 #                scenario-options.sh parses: kernel= how the scenario's Linux runs, "vamap" to
 #                have it call SetVirtualAddressMap(), which run.sh sets up per architecture, or
@@ -17,7 +18,8 @@
 #                that run.sh generates for the scenario, in User Mode, or "default"; arch= a
 #                comma list of the architectures that boot the scenario, of x86_64, i686 and
 #                aarch64, which the others skip; devices= a comma list of QEMU devices to add,
-#                of virtio-rng; guest= "unfixed" to boot the kernel of
+#                of virtio-rng and esp-disk, a writable disk that the boots share, partitioned
+#                as esp-disk.sfdisk; guest= "unfixed" to boot the kernel of
 #                guest-packages-<arch>-unfixed, or "unfixed-v5.8", with arch=x86_64, that of
 #                guest-packages-x86_64-unfixed-v5.8, both without upstream Linux 0e8d2444168d;
 #                params= a comma list of more kernel parameters of the Linux boots, such as
@@ -44,8 +46,12 @@ hii-outside-form-set-password	/publish-hiidb.efi rt-data-outside-form-set-passwo
 hii-first-store-password	/publish-hiidb.efi rt-data-first-store-password-forms	-	hii_first_store_password	arch=x86_64
 hii-name-value-password	/publish-hiidb.efi rt-data-name-value-password-forms	name-value-password.json	hii_name_value_password/without_snapshot::	-
 hii-name-value-password-snapshot	/publish-hiidb.efi export-config-name-value-password;/publish-hiidb.efi rt-data	name-value-password.json	hii_name_value_password/with_snapshot::	-
+hii-name-value-string	/publish-hiidb.efi rt-data-name-value-string-forms	-	hii_name_value_string/without_snapshot::	-
+hii-name-value-string-snapshot	/publish-hiidb.efi export-config-name-value-string;/publish-hiidb.efi rt-data	-	hii_name_value_string/with_snapshot::	-
 hii-storageless-password	/publish-hiidb.efi rt-data-storageless-password-forms	storageless-password.json	hii_storageless_password/without_snapshot::	-
 hii-storageless-password-snapshot	/publish-hiidb.efi export-config-storageless-password;/publish-hiidb.efi rt-data	storageless-password.json	hii_storageless_password/with_snapshot::	-
+hii-undeclared-password	/publish-hiidb.efi rt-data-undeclared-password-forms	undeclared-password.json	hii_undeclared_password/without_snapshot::	-
+hii-undeclared-password-snapshot	/publish-hiidb.efi export-config-undeclared-password;/publish-hiidb.efi rt-data	undeclared-password.json	hii_undeclared_password/with_snapshot::	-
 hii-time-storage	/DriverSample.efi;/publish-hiidb.efi wakeup-time-forms	my-ifr-nv-data.json	hii_time_storage	-
 hii-acpi	/DriverSample.efi;/publish-hiidb.efi acpi-table	my-ifr-nv-data.json	hii_acpi/qhii::	-
 hii-acpi-hiid	/DriverSample.efi;/publish-hiidb.efi acpi-table-hiid	my-ifr-nv-data.json	hii_acpi/hiid::	-
@@ -63,11 +69,16 @@ shell-formset-skip	/publish-hiidb.efi formset-skip-forms	formset-skip.json	shell
 shell-short-var-store	/publish-hiidb.efi short-var-store-forms	short-var-store.json	shell:short-var-store	-
 shell-outside-form-set-password	/publish-hiidb.efi outside-form-set-password-forms	-	shell:outside-form-set-password	-
 shell-disabled-form	/publish-hiidb.efi disabled-form-forms	disabled-form.json	shell:disabled-form	-
+hii-form-set-disable-if	/publish-hiidb.efi form-set-disable-if-forms;/publish-hiidb.efi rt-data	form-set-disable-if.json	hii_form_set_disable_if	-
+shell-form-set-disable-if	/publish-hiidb.efi form-set-disable-if-forms	form-set-disable-if.json	shell:form-set-disable-if	-
 shell-first-store-password	/publish-hiidb.efi first-store-password-forms	-	shell:first-store-password	-
 shell-keyword-kinds	/publish-hiidb.efi keyword-kinds-forms	-	shell:keyword-kinds	-
 shell-name-value-password	/publish-hiidb.efi name-value-password-forms	name-value-password.json	shell:name-value-password	-
 shell-storageless-password	/publish-hiidb.efi storageless-password-forms	storageless-password.json	shell:storageless-password	-
+shell-undeclared-password	/publish-hiidb.efi undeclared-password-forms	undeclared-password.json	shell:undeclared-password	-
 shell-time-storage	/DriverSample.efi;/publish-hiidb.efi wakeup-time-forms	my-ifr-nv-data.json	shell:time-storage	-
+shell-callback-forms	/publish-hiidb.efi callback-forms	-	shell:callback-forms	-
+shell-callback-forms-password	/publish-hiidb.efi callback-forms-password	-	shell:callback-forms-password	-
 shell-auth27	/DriverSample.efi	my-ifr-nv-data-auth27.json	shell:auth27	-
 hii-auth87	/publish-hiidb.efi enhanced-auth-forms;/publish-hiidb.efi rt-data	enhanced-auth-87.json	hii_auth87	-
 shell-auth87	/publish-hiidb.efi enhanced-auth-forms	enhanced-auth-87.json	shell:auth87	-
@@ -102,6 +113,7 @@ shell-variable-get-secboot-user	-	-	shell:variable-get-secboot-user	firmware=sec
 variable-get-devdb	-	devdb.json	global_variables/get_devdb	-
 shell-variable-get-devdb	-	devdb.json	shell:variable-get-devdb	-
 global-variables	-	boot-options.json	global_variables/set_before_reboot,global_variables/after_reboot	-
+boot-manager	/DriverSample.efi	boot-manager.json	boot_manager/before_shell,shell:boot-manager,shell:boot-manager-next,boot_manager/after_shell	-
 shell-global-variables	-	-	shell:global-variables,shell:global-variables-reboot	-
 secboot-setup	-	-	secboot/setup_mode	firmware=secboot-setup
 secboot-user	-	-	secboot/user_mode	firmware=secboot-user
@@ -145,4 +157,6 @@ shell-sign-user	-	-	shell:sign-user	firmware=secboot-user devices=virtio-rng
 shell-sign-no-rng	-	-	shell:sign-no-rng	firmware=secboot-user
 sign-setup	-	-	write_signed/signing_in_setup	firmware=secboot-setup
 shell-sign-setup	-	-	shell:sign-setup	firmware=secboot-setup devices=virtio-rng
+shell-auth3-checks	-	enhanced-auth-87.json	shell:auth3-checks	firmware=secboot-user devices=virtio-rng
 shell-devdb-setup	-	-	shell:devdb-setup,write_signed/devdb_appended_by_the_shell	firmware=secboot-setup devices=virtio-rng
+staged-set	/publish-hiidb.efi callback-forms;/publish-hiidb.efi rt-data	-	staged_set/stage_two_sets,rebooting-shell:staged-set-applied,staged_set/after_the_applied_boot,rebooting-shell:staged-set-not-started,staged_set/after_the_boot_without_its_image,rebooting-shell:staged-set-interrupted,staged_set/after_the_interrupted_boot	devices=esp-disk
diff --git a/tests/qemu/shell/auth3-checks.nsh b/tests/qemu/shell/auth3-checks.nsh
new file mode 100644
index 0000000..db31260
--- /dev/null
+++ b/tests/qemu/shell/auth3-checks.nsh
@@ -0,0 +1,52 @@
+echo -off
+# The Shell boot of the scenario shell-auth3-checks, on the secboot firmware in User Mode with
+# run.sh's keys in \sign and a virtio-rng device, whose EFI_RNG_PROTOCOL seeds RSA blinding.
+# vars/enhanced-auth-87.json seeds EnhancedAuthData, of TimeStamp 2026-11-06T12:00:00Z,
+# EnhancedAuthRefused, whose metadata has Version 2, and EnhancedAuthNonce, whose current nonce is
+# 8 bytes of 0xA5, each with the attributes 0x87. uefisettings.efi variable write-signed checks
+# each write against the variable before it seeds or writes, and refuses what the firmware would
+# refuse (UEFI 2.11 sections 8.2.3 and 8.2.5); the writes that it takes reach SetVariable(),
+# which this firmware refuses for EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS. variable info
+# shows the metadata of each. shell/auth3-checks.tsv holds the checks of its steps.
+fs0:
+echo uefisettings-shell: start
+dmpstore EnhancedAuthData -guid 8C78A505-BAA0-4C4A-869F-000000000301
+echo uefisettings-shell: step dmpstore-before-data %lasterror%
+dmpstore EnhancedAuthRefused -guid 8C78A505-BAA0-4C4A-869F-000000000301
+echo uefisettings-shell: step dmpstore-before-refused %lasterror%
+dmpstore EnhancedAuthNonce -guid 8C78A505-BAA0-4C4A-869F-000000000301
+echo uefisettings-shell: step dmpstore-before-nonce %lasterror%
+uefisettings.efi variable info EnhancedAuthNonce 8C78A505-BAA0-4C4A-869F-000000000301
+echo uefisettings-shell: step info-nonce %lasterror%
+uefisettings.efi variable info EnhancedAuthRefused 8C78A505-BAA0-4C4A-869F-000000000301
+echo uefisettings-shell: step info-refused %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthData 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --timestamp 2026-11-06T12:00:00Z
+echo uefisettings-shell: step ts-equal %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthData 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --timestamp 2026-11-06T11:59:59Z
+echo uefisettings-shell: step ts-earlier %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthData 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --timestamp 2026-11-07T00:00:00Z
+echo uefisettings-shell: step ts-later %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthData 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --timestamp 2026-11-07T00:00:00Z
+echo uefisettings-shell: step other-attributes %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthData 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --nonce 0909090909
+echo uefisettings-shell: step nonce-on-timestamp %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthRefused 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --timestamp 2026-11-07T00:00:00Z
+echo uefisettings-shell: step refused-metadata %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthNonce 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --nonce a5a5a5a5a5a5a5a5
+echo uefisettings-shell: step nonce-held %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthNonce 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --nonce 0909090909 --current-nonce 0101010101010101
+echo uefisettings-shell: step nonce-other-current %lasterror%
+uefisettings.efi variable write-signed EnhancedAuthNonce 8C78A505-BAA0-4C4A-869F-000000000301 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --nonce 0909090909
+echo uefisettings-shell: step nonce-default %lasterror%
+uefisettings.efi variable write-signed EnhancedProbe DE145B29-C3CD-455F-91DE-A76237B67C52 --attributes non-volatile,bootservice-access,runtime-access,enhanced-authenticated-access --data-file \sign\probe.data --signing-key-file \sign\KEK.key --signing-certificate-file \sign\KEK.crt --nonce 0909090909 --current-nonce 0101010101010101
+echo uefisettings-shell: step current-nonce-create %lasterror%
+dmpstore EnhancedAuthData -guid 8C78A505-BAA0-4C4A-869F-000000000301
+echo uefisettings-shell: step dmpstore-after-data %lasterror%
+dmpstore EnhancedAuthRefused -guid 8C78A505-BAA0-4C4A-869F-000000000301
+echo uefisettings-shell: step dmpstore-after-refused %lasterror%
+dmpstore EnhancedAuthNonce -guid 8C78A505-BAA0-4C4A-869F-000000000301
+echo uefisettings-shell: step dmpstore-after-nonce %lasterror%
+dmpstore EnhancedProbe -guid DE145B29-C3CD-455F-91DE-A76237B67C52
+echo uefisettings-shell: step dmpstore-probe %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/auth3-checks.tsv b/tests/qemu/shell/auth3-checks.tsv
new file mode 100644
index 0000000..ed2c972
--- /dev/null
+++ b/tests/qemu/shell/auth3-checks.tsv
@@ -0,0 +1,51 @@
+# The checks of shell/auth3-checks.nsh, the Shell boot of shell-auth3-checks: EnhancedAuthData,
+# EnhancedAuthRefused and EnhancedAuthNonce have the attributes 0x87. See check-shell-log.sh.
+# DmpStore shows each as seeded: 68 bytes of metadata and 4 of data, or 64 and 4 for the nonce
+dmpstore-before-data	status	any
+dmpstore-before-data	line	^Variable NV\+RT\+BS '8C78A505-BAA0-4C4A-869F-000000000301:EnhancedAuthData' DataSize = 0x48$
+dmpstore-before-refused	status	any
+dmpstore-before-refused	line	^Variable NV\+RT\+BS '8C78A505-BAA0-4C4A-869F-000000000301:EnhancedAuthRefused' DataSize = 0x48$
+dmpstore-before-nonce	status	any
+dmpstore-before-nonce	line	^Variable NV\+RT\+BS '8C78A505-BAA0-4C4A-869F-000000000301:EnhancedAuthNonce' DataSize = 0x44$
+# variable info shows the metadata of the nonce-type variable, and why it refuses that of
+# Version 2, from the data that GetVariable() returns (UEFI 2.11 section 8.2.1)
+info-nonce	status	0x0
+info-nonce	json	. == {"variable": "EnhancedAuthNonce-8c78a505-baa0-4c4a-869f-000000000301", "attributes": 135, "size": 68, "metadata": {"version": 1, "type": 2, "metadata_size": 64, "flags": 0, "nonce": {"hex": "a5a5a5a5a5a5a5a5"}, "cert_id": {"type": 1, "id": {"hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f"}}}}
+info-refused	status	0x0
+info-refused	json	. == {"variable": "EnhancedAuthRefused-8c78a505-baa0-4c4a-869f-000000000301", "attributes": 135, "size": 72, "metadata": {"refused": "EFI_VARIABLE_AUTHENTICATION_3 Version 2, not 1"}}
+# a TimeStamp that is not later than the variable's is refused before any write
+ts-equal	status	aborted
+ts-equal	json	. == {"error_message": "the TimeStamp 2026-11-06T12:00:00Z is not later than 2026-11-06T12:00:00Z, that of EFI variable EnhancedAuthData-8c78a505-baa0-4c4a-869f-000000000301, as the firmware requires (UEFI 2.11 section 8.2.5)"}
+ts-earlier	status	aborted
+ts-earlier	json	. == {"error_message": "the TimeStamp 2026-11-06T11:59:59Z is not later than 2026-11-06T12:00:00Z, that of EFI variable EnhancedAuthData-8c78a505-baa0-4c4a-869f-000000000301, as the firmware requires (UEFI 2.11 section 8.2.5)"}
+# a later one reaches SetVariable(), which this firmware refuses for the attribute
+ts-later	status	aborted
+ts-later	json	. == {"error_message": "SetVariable() of EFI variable EnhancedAuthData-8c78a505-baa0-4c4a-869f-000000000301: INVALID_PARAMETER"}
+# other attributes, another Type and metadata that uefisettings does not take are refused
+other-attributes	status	aborted
+other-attributes	json	. == {"error_message": "EFI variable EnhancedAuthData-8c78a505-baa0-4c4a-869f-000000000301 has the attributes NON_VOLATILE | BOOTSERVICE_ACCESS | RUNTIME_ACCESS | ENHANCED_AUTHENTICATED_ACCESS, not NON_VOLATILE | BOOTSERVICE_ACCESS | ENHANCED_AUTHENTICATED_ACCESS: SetVariable() refuses a rewrite with attributes other than these but APPEND_WRITE with EFI_INVALID_PARAMETER (UEFI 2.11 section 8.2.3)"}
+nonce-on-timestamp	status	aborted
+nonce-on-timestamp	json	. == {"error_message": "EFI variable EnhancedAuthData-8c78a505-baa0-4c4a-869f-000000000301 holds an EFI_VARIABLE_AUTHENTICATION_3 of Type TIMESTAMP (1), not NONCE (2), and the firmware verifies that the Types match (UEFI 2.11 section 8.2.5)"}
+refused-metadata	status	aborted
+refused-metadata	json	. == {"error_message": "EFI variable EnhancedAuthRefused-8c78a505-baa0-4c4a-869f-000000000301 holds EFI_VARIABLE_AUTHENTICATION_3 metadata that uefisettings does not take, so it cannot check the write against it: EFI_VARIABLE_AUTHENTICATION_3 Version 2, not 1"}
+# the variable's own nonce and a current nonce other than its own are refused
+nonce-held	status	aborted
+nonce-held	json	. == {"error_message": "the nonce is the one that EFI variable EnhancedAuthNonce-8c78a505-baa0-4c4a-869f-000000000301 holds, for which SetVariable() returns EFI_INVALID_PARAMETER (UEFI 2.11 sections 8.2.3 and 8.2.5)"}
+nonce-other-current	status	aborted
+nonce-other-current	json	. == {"error_message": "the current nonce given is not the one that EFI variable EnhancedAuthNonce-8c78a505-baa0-4c4a-869f-000000000301 holds, so the firmware would not verify the signature over it (UEFI 2.11 section 8.2.5)"}
+# another nonce without --current-nonce signs the variable's and reaches SetVariable()
+nonce-default	status	aborted
+nonce-default	json	. == {"error_message": "SetVariable() of EFI variable EnhancedAuthNonce-8c78a505-baa0-4c4a-869f-000000000301: INVALID_PARAMETER"}
+# a current nonce for a variable that does not exist is refused
+current-nonce-create	status	aborted
+current-nonce-create	json	. == {"error_message": "EFI variable EnhancedProbe-de145b29-c3cd-455f-91de-a76237b67c52 does not exist, so its create signs no current nonce (UEFI 2.11 section 8.2.5), and the firmware would not verify the signature over the one given"}
+# and every variable stays as it was, and EnhancedProbe absent
+dmpstore-after-data	status	any
+dmpstore-after-data	same	dmpstore-before-data
+dmpstore-after-refused	status	any
+dmpstore-after-refused	same	dmpstore-before-refused
+dmpstore-after-nonce	status	any
+dmpstore-after-nonce	same	dmpstore-before-nonce
+dmpstore-probe	status	any
+dmpstore-probe	line	No matching variables found
+dmpstore-probe	none	^Variable
diff --git a/tests/qemu/shell/auth87.tsv b/tests/qemu/shell/auth87.tsv
index dc64b0f..baeb2b5 100644
--- a/tests/qemu/shell/auth87.tsv
+++ b/tests/qemu/shell/auth87.tsv
@@ -19,9 +19,10 @@ set-bypass	json	. == {"error_message": "EFI variable EnhancedAuthData-8c78a505-b
 # and the variable stays as it was
 dmpstore-after	status	any
 dmpstore-after	same	dmpstore-before
-# the firmware holds the attributes and size that the scenario seeds
+# the firmware holds the attributes and size that the scenario seeds, and info shows the
+# metadata before the data (UEFI 2.11 §8.2.1)
 variable-info	status	0x0
-variable-info	json	. == {"variable": "EnhancedAuthData-8c78a505-baa0-4c4a-869f-000000000301", "attributes": 135, "size": 72}
+variable-info	json	. == {"variable": "EnhancedAuthData-8c78a505-baa0-4c4a-869f-000000000301", "attributes": 135, "size": 72, "metadata": {"version": 1, "type": 1, "metadata_size": 68, "flags": 0, "time_stamp": "2026-11-06T12:00:00Z", "cert_id": {"type": 1, "id": {"hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f"}}}}
 # get names the check that refuses the metadata of Version 2
 get-refused	status	0x0
 get-refused	json	.responses | length == 1 and .[0].question.answer == "<ValueUnavailable: EFI variable EnhancedAuthRefused-8c78a505-baa0-4c4a-869f-000000000301 has enhanced authenticated access (attributes 0x87), whose metadata uefisettings refuses: EFI_VARIABLE_AUTHENTICATION_3 Version 2, not 1>"
diff --git a/tests/qemu/shell/boot-manager-next.nsh b/tests/qemu/shell/boot-manager-next.nsh
new file mode 100644
index 0000000..5827e81
--- /dev/null
+++ b/tests/qemu/shell/boot-manager-next.nsh
@@ -0,0 +1,12 @@
+echo -off
+# The second UEFI Shell boot of the scenario boot-manager, through Boot009B, which the first
+# created, whose uefisettings.efi printed its usage and returned, so that the boot manager went on
+# to the Shell of BootOrder; shell/boot-manager-next.tsv holds the checks of its steps.
+fs0:
+echo uefisettings-shell: start
+uefisettings.efi variable get Boot009B
+echo uefisettings-shell: step boot009b %lasterror%
+uefisettings.efi variable get BootNext
+echo uefisettings-shell: step boot-next-gone %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/boot-manager-next.tsv b/tests/qemu/shell/boot-manager-next.tsv
new file mode 100644
index 0000000..a9e50c1
--- /dev/null
+++ b/tests/qemu/shell/boot-manager-next.tsv
@@ -0,0 +1,7 @@
+# The checks of shell/boot-manager-next.nsh, the second UEFI Shell boot of boot-manager: the
+# firmware's boot manager loaded Boot009B, which BootNext named, and BootNext is gone. See
+# check-shell-log.sh.
+boot009b	status	0x0
+boot009b	firmware	.value as $v | .variable == "Boot009B-8be4df61-93ca-11d2-aa0d-00e098032b8c" and ($firmware | any(startswith("BdsDxe: loading Boot009B \"\($v.description)\" from ")))
+boot-next-gone	status	0x0
+boot-next-gone	json	. == {"variable": "BootNext-8be4df61-93ca-11d2-aa0d-00e098032b8c", "absent": true}
diff --git a/tests/qemu/shell/boot-manager.nsh b/tests/qemu/shell/boot-manager.nsh
new file mode 100644
index 0000000..14eb9de
--- /dev/null
+++ b/tests/qemu/shell/boot-manager.nsh
@@ -0,0 +1,55 @@
+echo -off
+# The first UEFI Shell boot of the scenario boot-manager, after the guest test boot_manager's
+# before_shell, through Boot009A, which BootNext names; shell/boot-manager.tsv holds the checks
+# of its steps. dmpstore without arguments dumps the variables of EFI_GLOBAL_VARIABLE, which no
+# refusal may change.
+fs0:
+echo uefisettings-shell: start
+uefisettings.efi variable get Boot009A
+echo uefisettings-shell: step boot009a %lasterror%
+uefisettings.efi variable get BootNext
+echo uefisettings-shell: step boot-next-gone %lasterror%
+uefisettings.efi variable get Boot0099
+echo uefisettings-shell: step seeded-boot0099 %lasterror%
+uefisettings.efi variable get Key0099
+echo uefisettings-shell: step seeded-key0099 %lasterror%
+dmpstore
+echo uefisettings-shell: step before-refusals %lasterror%
+uefisettings.efi variable set-attributes PlatformRecovery0000 --set active
+echo uefisettings-shell: step platform-recovery %lasterror%
+uefisettings.efi variable set-attributes OsRecovery0000 --set active
+echo uefisettings-shell: step os-recovery %lasterror%
+uefisettings.efi variable set-attributes Boot1234 --set active
+echo uefisettings-shell: step absent %lasterror%
+uefisettings.efi variable set-attributes Boot0099 --set active --clear active
+echo uefisettings-shell: step set-and-clear %lasterror%
+uefisettings.efi variable create-load-option Boot0099 --description again --device-path \missing-99.efi
+echo uefisettings-shell: step create-existing %lasterror%
+uefisettings.efi variable set-device-path ConOutDev --device-path Pci(0x1,0x0)
+echo uefisettings-shell: step con-out-dev %lasterror%
+dmpstore
+echo uefisettings-shell: step after-refusals %lasterror%
+uefisettings.efi variable set-attributes Boot0099 --clear active
+echo uefisettings-shell: step inactive-boot0099 %lasterror%
+uefisettings.efi variable get Key0099
+echo uefisettings-shell: step inactive-key0099 %lasterror%
+uefisettings.efi variable set-attributes Boot0099 --set active
+echo uefisettings-shell: step active-boot0099 %lasterror%
+uefisettings.efi variable get Key0099
+echo uefisettings-shell: step active-key0099 %lasterror%
+uefisettings.efi variable set-attributes Driver0000 --set force-reconnect
+echo uefisettings-shell: step driver-force-reconnect %lasterror%
+uefisettings.efi variable set-attributes Driver0000 --clear force-reconnect
+echo uefisettings-shell: step driver-reconnect-cleared %lasterror%
+uefisettings.efi variable create-load-option Boot009B --description "uefisettings again" --device-path \uefisettings.efi
+echo uefisettings-shell: step created-boot009b %lasterror%
+uefisettings.efi variable set BootNext Boot009B
+echo uefisettings-shell: step boot-next %lasterror%
+uefisettings.efi variable create-key Key0099 --boot Boot0099 --key F2
+echo uefisettings-shell: step key-existing %lasterror%
+uefisettings.efi variable create-key Key009C --boot Boot009B --modifiers alt --key F11
+echo uefisettings-shell: step key-taken %lasterror%
+uefisettings.efi variable create-key Key009B --boot Boot009B --modifiers shift --key F12
+echo uefisettings-shell: step created-key009b %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/boot-manager.tsv b/tests/qemu/shell/boot-manager.tsv
new file mode 100644
index 0000000..ecc984e
--- /dev/null
+++ b/tests/qemu/shell/boot-manager.tsv
@@ -0,0 +1,67 @@
+# The checks of shell/boot-manager.nsh, the first UEFI Shell boot of boot-manager: the firmware's
+# boot manager loaded it through Boot009A, which BootNext named and Linux created in boot 1, from
+# the device path that get shows, and BootNext is gone; get shows Boot0099 and Key0099 as
+# tests/qemu/vars/boot-manager.json seeds them, as Linux showed them; set-attributes refuses
+# PlatformRecovery####, OsRecovery####, an absent load option and a flag both to set and to clear,
+# create-load-option refuses Boot0099, which exists, and set-device-path ConOutDev, leaving the
+# global variables as they were; set-attributes clears and sets Boot0099's LOAD_OPTION_ACTIVE,
+# keeping its undefined bit, and Key0099 and Key009A follow it, and sets and clears
+# Driver0000's LOAD_OPTION_FORCE_RECONNECT, as Linux did; create-load-option creates Boot009B, of
+# the short-form File Path of uefisettings.efi, which BootNext then names; create-key refuses
+# Key0099, which exists, and ALT-F11, the keys of Key009A that Linux created, and creates
+# Key009B, SHIFT-F12 to Boot009B. See check-shell-log.sh.
+boot009a	status	0x0
+boot009a	firmware	.value as $v | . == {"variable": "Boot009A-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"attributes": ["active"], "category": "boot", "description": "uefisettings Shell", "device_paths": $v.device_paths, "optional_data": ""}} and ($firmware | any(. == "BdsDxe: loading Boot009A \"\($v.description)\" from \($v.device_paths[0])"))
+boot009a	linux	boot1.test.log created-boot009a . == $linux
+boot-next-gone	status	0x0
+boot-next-gone	json	. == {"variable": "BootNext-8be4df61-93ca-11d2-aa0d-00e098032b8c", "absent": true}
+seeded-boot0099	status	0x0
+seeded-boot0099	json	. == {"variable": "Boot0099-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"attributes": ["active", "0x40000000"], "category": "boot", "description": "file missing-99.efi", "device_paths": ["\\missing-99.efi"], "optional_data": "7565666973657474696e6773"}}
+seeded-boot0099	linux	boot1.test.log seeded-boot0099 . == $linux
+seeded-key0099	status	0x0
+seeded-key0099	json	. == {"variable": "Key0099-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"revision": 0, "modifiers": ["control"], "keys": ["q"], "boot_option": "Boot0099", "crc_matches": true}}
+seeded-key0099	linux	boot1.test.log seeded-key0099 . == $linux
+before-refusals	status	any
+platform-recovery	status	aborted
+platform-recovery	line	set-attributes does not write PlatformRecovery0000: .*read-only to the OS
+os-recovery	status	aborted
+os-recovery	line	set-attributes does not write OsRecovery0000, a Secure Boot Policy Variable
+absent	status	aborted
+absent	line	Boot1234 is absent
+set-and-clear	status	aborted
+set-and-clear	line	set-attributes cannot both set and clear active
+create-existing	status	aborted
+create-existing	line	Boot0099 exists: create-load-option creates load options
+con-out-dev	status	aborted
+con-out-dev	line	set-device-path does not write ConOutDev: .*These variables are volatile
+after-refusals	status	any
+after-refusals	same	before-refusals
+inactive-boot0099	status	0x0
+inactive-boot0099	json-line	. == {"variable": "Boot0099-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"attributes": ["0x40000000"], "category": "boot", "description": "file missing-99.efi", "device_paths": ["\\missing-99.efi"], "optional_data": "7565666973657474696e6773"}}
+inactive-boot0099	line	^updated Key0099: its BootOptionCrc is the CRC-32 of the Boot#### that it starts again
+inactive-boot0099	line	^updated Key009A: its BootOptionCrc is the CRC-32 of the Boot#### that it starts again
+inactive-key0099	status	0x0
+inactive-key0099	json	. == {"variable": "Key0099-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"revision": 0, "modifiers": ["control"], "keys": ["q"], "boot_option": "Boot0099", "crc_matches": true}}
+inactive-key0099	linux	boot1.test.log inactive-key0099 . == $linux
+active-boot0099	status	0x0
+active-boot0099	json-line	. == {"variable": "Boot0099-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"attributes": ["active", "0x40000000"], "category": "boot", "description": "file missing-99.efi", "device_paths": ["\\missing-99.efi"], "optional_data": "7565666973657474696e6773"}}
+active-boot0099	line	^updated Key0099: its BootOptionCrc is the CRC-32 of the Boot#### that it starts again
+active-boot0099	line	^updated Key009A: its BootOptionCrc is the CRC-32 of the Boot#### that it starts again
+active-key0099	status	0x0
+active-key0099	same	seeded-key0099
+driver-force-reconnect	status	0x0
+driver-force-reconnect	json	.variable == "Driver0000-8be4df61-93ca-11d2-aa0d-00e098032b8c" and .value.attributes == ["active", "force-reconnect"]
+driver-force-reconnect	linux	boot1.test.log driver-force-reconnect . == $linux
+driver-reconnect-cleared	status	0x0
+driver-reconnect-cleared	json	.variable == "Driver0000-8be4df61-93ca-11d2-aa0d-00e098032b8c" and .value.attributes == ["active"]
+driver-reconnect-cleared	linux	boot1.test.log driver-reconnect-cleared . == $linux
+created-boot009b	status	0x0
+created-boot009b	json	. == {"variable": "Boot009B-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"attributes": ["active"], "category": "boot", "description": "uefisettings again", "device_paths": ["\\uefisettings.efi"], "optional_data": ""}}
+boot-next	status	0x0
+boot-next	json	. == {"variable": "BootNext-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": "Boot009B"}
+key-existing	status	aborted
+key-existing	line	Key0099 exists: create-key creates hot keys
+key-taken	status	aborted
+key-taken	line	Key009A holds these shift states and keys, and the boot manager takes it
+created-key009b	status	0x0
+created-key009b	json	. == {"variable": "Key009B-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"revision": 0, "modifiers": ["shift"], "keys": ["F12"], "boot_option": "Boot009B", "crc_matches": true}}
diff --git a/tests/qemu/shell/callback-forms-password.nsh b/tests/qemu/shell/callback-forms-password.nsh
new file mode 100644
index 0000000..d7e36c5
--- /dev/null
+++ b/tests/qemu/shell/callback-forms-password.nsh
@@ -0,0 +1,26 @@
+echo -off
+# The boot of the scenario shell-callback-forms-password: publish-hiidb.efi
+# callback-forms-password registers a form set whose Buffer store holds a PASSWORD question
+# beside a setting, and questions without a VarStore whose driver's CHANGED overwrites that
+# setting or the password, and a form set whose PASSWORD question is in a disabled form;
+# shell/callback-forms-password.tsv holds the checks of the steps.
+fs0:
+echo uefisettings-shell: start
+dmpstore CallbackPassword -guid DE145B29-C3CD-455F-91DE-A76237B67C52
+echo uefisettings-shell: step store-before %lasterror%
+uefisettings.efi hii get --json "Callback value beside a password"
+echo uefisettings-shell: step get %lasterror%
+uefisettings.efi hii get --json "Callback value beside a disabled password"
+echo uefisettings-shell: step get-disabled %lasterror%
+uefisettings.efi hii set --json "Callback value beside a password" On
+echo uefisettings-shell: step set-refused %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system "Callback value beside a password" On
+echo uefisettings-shell: step set %lasterror%
+dmpstore CallbackPassword -guid DE145B29-C3CD-455F-91DE-A76237B67C52
+echo uefisettings-shell: step store-after %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system "Callback value over a password" On
+echo uefisettings-shell: step set-over %lasterror%
+dmpstore CallbackPassword -guid DE145B29-C3CD-455F-91DE-A76237B67C52
+echo uefisettings-shell: step store-over %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/callback-forms-password.tsv b/tests/qemu/shell/callback-forms-password.tsv
new file mode 100644
index 0000000..c52c569
--- /dev/null
+++ b/tests/qemu/shell/callback-forms-password.tsv
@@ -0,0 +1,39 @@
+# The checks of shell/callback-forms-password.nsh. See check-shell-log.sh.
+store-before	status	any
+store-before	line	^  00000000: 11 22 33 44 07
+# the reads of the store request the setting, never the password's bytes
+get	status	0x0
+get	json-line	.responses | length == 1 and .[0].question.answer == "Off"
+get	line	^callback-forms: ExtractConfig .*&OFFSET=0*4&WIDTH=0*1: SUCCESS$
+get	none	^callback-forms: ExtractConfig .*&OFFSET=0+&WIDTH
+# a question whose FormSet has a disabled form with a PASSWORD question calls no Callback()
+get-disabled	status	0x0
+get-disabled	json-line	.responses | length == 1 and (.[0].question.answer | test("^<ValueUnavailable: the form 2 of the FormSet 8C78A505-BAA0-4C4A-869F-000000001A14, whose EFI_IFR_CHECKBOX op is malformed; UEFI 2\\.11 .*33\\.2\\.5\\.10\\.1 disables the form of a malformed op: .*; that form holds an EFI_IFR_PASSWORD, so uefisettings cannot tell which stores a restore through RouteConfig\\(\\) would change>$"))
+get-disabled	none	^callback-forms: Callback\(
+# without --i-am-fine-to-brick-this-system, set refuses in this HiiDB before any Callback()
+set-refused	status	aborted
+set-refused	json-line	. == {"error_message": "this HiiDB declares a setup password question, and the UEFI Shell runs no setup browser, so no password is asked or checked; pass --i-am-fine-to-brick-this-system to write without it"}
+set-refused	none	^callback-forms: Callback\(
+set-refused	none	^warning:
+# with it, set warns of the setup password and calls the driver; a changed store that holds a
+# password is not restored, and its variable is listed: the setting beside the password changed,
+# and the password's bytes read as zero
+set	status	aborted
+set	line	^warning: this HiiDB declares a setup password question, and the UEFI Shell runs no setup browser, so no password is asked or checked; --i-am-fine-to-brick-this-system lets uefisettings write without it$
+set	json-line	.error_message | startswith("after 1 unsafe operation(s) that --i-am-fine-to-brick-this-system let through: ") and contains("not applied: the Callback sequence changed VarStore 0x0005, which holds a PASSWORD question; it was not restored, because a RouteConfig() without the password bytes may clear it; the driver's Callback(FORM_CLOSE) had already run, and any effect outside the FormSet's stores stays; EFI variables changed: CallbackPassword-de145b29-c3cd-455f-91de-a76237b67c52 (changed)")
+set	line	^callback-forms: Callback\(CHANGED\) question 0x0501 value 0x1: SUCCESS
+set	none	^callback-forms: RouteConfig
+set	none	^callback-forms: ExtractConfig .*&OFFSET=0+&WIDTH
+store-after	status	any
+store-after	line	^  00000000: 11 22 33 44 01
+# a Callback() that changes only the password's bytes, which the reads give as zero, is caught
+# all the same: the value is not applied, the password stays as the driver wrote it, and the
+# password's variable is not listed
+set-over	status	aborted
+set-over	line	^warning: this HiiDB declares a setup password question, and the UEFI Shell runs no setup browser, so no password is asked or checked; --i-am-fine-to-brick-this-system lets uefisettings write without it$
+set-over	json-line	.error_message | startswith("after 1 unsafe operation(s) that --i-am-fine-to-brick-this-system let through: ") and contains("not applied: the Callback sequence changed the password bytes of EFI variable CallbackPassword-de145b29-c3cd-455f-91de-a76237b67c52; they were not restored, as uefisettings never writes a password byte; the driver's Callback(FORM_CLOSE) had already run, and any effect outside the FormSet's stores stays") and (contains("EFI variables changed") | not)
+set-over	line	^callback-forms: Callback\(CHANGED\) question 0x0502 value 0x1: SUCCESS
+set-over	none	^callback-forms: RouteConfig
+set-over	none	^callback-forms: ExtractConfig .*&OFFSET=0+&WIDTH
+store-over	status	any
+store-over	line	^  00000000: 01 D1 D2 D3 01
diff --git a/tests/qemu/shell/callback-forms.nsh b/tests/qemu/shell/callback-forms.nsh
new file mode 100644
index 0000000..5ce5c2f
--- /dev/null
+++ b/tests/qemu/shell/callback-forms.nsh
@@ -0,0 +1,57 @@
+echo -off
+# The boot of the scenario shell-callback-forms: publish-hiidb.efi callback-forms registers
+# questions without a VarStore whose driver holds their value, which get and set reach through
+# the driver's Callback(), between reads of the form set's stores; shell/callback-forms.tsv
+# holds the checks of the steps.
+fs0:
+echo uefisettings-shell: start
+uefisettings.efi hii list-questions --json
+echo uefisettings-shell: step list-questions %lasterror%
+uefisettings.efi hii show-ifr
+echo uefisettings-shell: step show-ifr %lasterror%
+uefisettings.efi hii get --json --no-efivars "Callback value beside stores"
+echo uefisettings-shell: step get-no-efivars %lasterror%
+uefisettings.efi hii get --json "Callback value beside stores"
+echo uefisettings-shell: step get-beside %lasterror%
+uefisettings.efi hii set --json "Callback value beside stores" On
+echo uefisettings-shell: step set-beside %lasterror%
+uefisettings.efi hii get --json "Callback value beside stores"
+echo uefisettings-shell: step get-beside-after %lasterror%
+dmpstore CallbackStore -guid DE145B29-C3CD-455F-91DE-A76237B67C52
+echo uefisettings-shell: step efi-store-before %lasterror%
+uefisettings.efi hii set --json "Callback value overwriting its EFI variable store" On
+echo uefisettings-shell: step set-efi-store %lasterror%
+dmpstore CallbackStore -guid DE145B29-C3CD-455F-91DE-A76237B67C52
+echo uefisettings-shell: step efi-store-after %lasterror%
+uefisettings.efi hii get --json "Buffer setting"
+echo uefisettings-shell: step buffer-before %lasterror%
+uefisettings.efi hii set --json "Callback value overwriting its Buffer store" On
+echo uefisettings-shell: step set-buffer-store %lasterror%
+uefisettings.efi hii get --json "Buffer setting"
+echo uefisettings-shell: step buffer-after %lasterror%
+uefisettings.efi hii set --json "Callback value refused in CHANGING" On
+echo uefisettings-shell: step set-refused-in-changing %lasterror%
+uefisettings.efi hii set --json "Callback value failing in CHANGED" On
+echo uefisettings-shell: step set-failing-in-changed %lasterror%
+uefisettings.efi hii set --json "Callback value asking for a save" On
+echo uefisettings-shell: step set-save %lasterror%
+uefisettings.efi hii set --json "Callback value asking for a reconnection" On
+echo uefisettings-shell: step set-reconnect %lasterror%
+uefisettings.efi hii set --json "Transient callback value" On
+echo uefisettings-shell: step set-transient %lasterror%
+uefisettings.efi hii set --json "Callback value without read-back" On
+echo uefisettings-shell: step set-no-read-back %lasterror%
+uefisettings.efi hii get --json "Callback value without read-back"
+echo uefisettings-shell: step get-no-read-back %lasterror%
+uefisettings.efi hii set --json "Callback value asking for a reset" On
+echo uefisettings-shell: step set-reset %lasterror%
+uefisettings.efi hii get --json "Callback value beside an unreachable store"
+echo uefisettings-shell: step get-unreachable %lasterror%
+uefisettings.efi hii set --json "Callback value beside an unreachable store" On
+echo uefisettings-shell: step set-unreachable %lasterror%
+uefisettings.efi hii get --json "Callback value without a driver"
+echo uefisettings-shell: step get-driverless %lasterror%
+uefisettings.efi hii set --json "Callback value without a driver" On
+echo uefisettings-shell: step set-driverless %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/callback-forms.tsv b/tests/qemu/shell/callback-forms.tsv
new file mode 100644
index 0000000..7929516
--- /dev/null
+++ b/tests/qemu/shell/callback-forms.tsv
@@ -0,0 +1,85 @@
+# The checks of shell/callback-forms.nsh. See check-shell-log.sh.
+# list-questions, show-ifr and get --no-efivars call no Callback()
+list-questions	status	0x0
+list-questions	none	^callback-forms: Callback
+show-ifr	status	0x0
+show-ifr	none	^callback-forms: Callback
+get-no-efivars	status	0x0
+get-no-efivars	none	^callback-forms: Callback
+# get runs FORM_OPEN, RETRIEVE, FORM_CLOSE between two reads of the stores, which leave out
+# byte 4 of the Buffer store, whose ExtractConfig() answer changes at every call
+get-beside	status	0x0
+get-beside	json-line	.responses | length == 1 and .[0].question.answer == "Off <not compared, as they changed between two reads before the first Callback(): VARSTORE 0x0002 CallbackBuffer: OFFSET=0004&WIDTH=0001>"
+get-beside	line	^callback-forms: Callback\(FORM_OPEN\) question 0x0201 value 0x0: UNSUPPORTED
+get-beside	line	^callback-forms: Callback\(RETRIEVE\) question 0x0201 value 0x0: SUCCESS, returned 0x0, request 0$
+get-beside	line	^callback-forms: Callback\(FORM_CLOSE\) question 0x0201 value 0x0: UNSUPPORTED
+get-beside	none	^callback-forms: Callback\(CHANG
+get-beside	none	^callback-forms: RouteConfig
+# set runs CHANGING and CHANGED, then reads the value back; the stores stay, and the question's
+# own variable is listed
+set-beside	status	0x0
+set-beside	json-line	.responses | length == 1 and .[0].question.answer == "On <applied; not compared, as they changed between two reads before the first Callback(): VARSTORE 0x0002 CallbackBuffer: OFFSET=0004&WIDTH=0001; EFI variables changed: CallbackValue0201-de145b29-c3cd-455f-91de-a76237b67c52 (created)>"
+set-beside	line	^callback-forms: Callback\(CHANGING\) question 0x0201 value 0x1: SUCCESS
+set-beside	line	^callback-forms: Callback\(CHANGED\) question 0x0201 value 0x1: SUCCESS
+set-beside	line	^callback-forms: Callback\(RETRIEVE\) question 0x0201 value 0x1: SUCCESS, returned 0x1, request 0$
+set-beside	none	^callback-forms: RouteConfig
+get-beside-after	status	0x0
+get-beside-after	json-line	.responses | length == 1 and (.[0].question.answer | startswith("On <not compared"))
+# a CHANGED that overwrites the EFI variable store is not applied, and the store is restored
+efi-store-before	status	any
+efi-store-before	line	^  00000000: 5A 5A 5A 5A
+set-efi-store	status	aborted
+set-efi-store	json-line	.error_message | contains("not applied: the Callback sequence changed stores of the FormSet: VARSTORE_EFI 0x0001 CallbackStore-de145b29-c3cd-455f-91de-a76237b67c52; restored and verified; the driver's Callback(FORM_CLOSE) had already run, and any effect outside the FormSet's stores stays")
+set-efi-store	line	^callback-forms: Callback\(CHANGED\) question 0x0202 value 0x1: SUCCESS
+efi-store-after	status	any
+efi-store-after	same	efi-store-before
+# one that overwrites the Buffer store's setting has the whole store routed back in one
+# RouteConfig(): that setting as before the Callback()s, the changing byte 4 as after them
+buffer-before	status	0x0
+set-buffer-store	status	aborted
+set-buffer-store	json-line	.error_message | contains("not applied: the Callback sequence changed stores of the FormSet: VARSTORE 0x0002 CallbackBuffer; restored and verified; ")
+set-buffer-store	line	^callback-forms: Callback\(CHANGED\) question 0x0203 value 0x1: SUCCESS
+set-buffer-store	line	^callback-forms: RouteConfig GUID=[0-9a-f]+&NAME=[0-9a-f]+&PATH=[0-9a-f]+&OFFSET=0000&WIDTH=0004&VALUE=a5a5a5a5&OFFSET=0004&WIDTH=0001&VALUE=[0-9a-f]{2}: SUCCESS$
+set-buffer-store	none	^callback-forms: RouteConfig .*&VALUE=[0-9a-fA-F]{8}: SUCCESS$
+buffer-after	status	0x0
+buffer-after	same	buffer-before
+# CHANGING's error refuses the value, and CHANGED is not sent
+set-refused-in-changing	status	aborted
+set-refused-in-changing	json-line	.error_message | contains("not applied: its driver's CallBack(EFI_BROWSER_ACTION_CHANGING) refused the value: EFI_ACCESS_DENIED; the driver's Callback(FORM_CLOSE) had already run")
+set-refused-in-changing	none	^callback-forms: Callback\(CHANGED\)
+set-refused-in-changing	line	^callback-forms: Callback\(FORM_CLOSE\) question 0x0204
+# CHANGED's error is not applied
+set-failing-in-changed	status	aborted
+set-failing-in-changed	json-line	.error_message | contains("not applied: Callback(CHANGED) returned EFI_DEVICE_ERROR; the driver's Callback(FORM_CLOSE) had already run")
+set-failing-in-changed	line	^callback-forms: Callback\(FORM_CLOSE\) question 0x0205
+# a save request in a form set with stores is not applied, and what the driver wrote is listed
+set-save	status	aborted
+set-save	json-line	.error_message | contains("not applied: Callback(CHANGED) asked the forms browser to save the FormSet's modified values (EFI_BROWSER_ACTION_REQUEST_SUBMIT), which only a forms browser's edit buffer holds; ") and contains("EFI variables changed: CallbackValue0206-de145b29-c3cd-455f-91de-a76237b67c52 (created)")
+# a reconnection request disconnects and connects the driver's handle
+set-reconnect	status	0x0
+set-reconnect	json-line	.responses | length == 1 and (.[0].question.answer | startswith("On <applied; reconnected the driver's controller (EFI_BROWSER_ACTION_REQUEST_RECONNECT); "))
+set-reconnect	line	^callback-forms: driver binding Start\(\)$
+# the read-back tells a transient value and one that no RETRIEVE gives
+set-transient	status	0x0
+set-transient	json-line	.responses | length == 1 and (.[0].question.answer | startswith("On <applied; the driver now reports Off; "))
+set-no-read-back	status	0x0
+set-no-read-back	json-line	.responses | length == 1 and (.[0].question.answer | startswith("On <applied; the driver offers no read-back; "))
+# get of a question whose RETRIEVE returns EFI_UNSUPPORTED has no value
+get-no-read-back	status	0x0
+get-no-read-back	json-line	.responses | length == 1 and (.[0].question.answer | startswith("<ValueUnavailable: its driver's CallBack(EFI_BROWSER_ACTION_RETRIEVE) returned EFI_UNSUPPORTED; without a VarStore the question has no other value (UEFI 2.11 "))
+# a reset request is noted, in a form set without stores
+set-reset	status	0x0
+set-reset	json-line	.responses | length == 1 and .[0].question.answer == "On <applied; Callback(CHANGED) asks for a platform reset (EFI_BROWSER_ACTION_REQUEST_RESET); EFI variables changed: CallbackValue0101-de145b29-c3cd-455f-91de-a76237b67c52 (created)>"
+# a store that ExtractConfig() does not answer refuses before any Callback()
+get-unreachable	status	0x0
+get-unreachable	json-line	.responses | length == 1 and (.[0].question.answer | startswith("<ValueUnavailable: cannot snapshot store VARSTORE 0x0003 CallbackUnreachable: ExtractConfig() returned EFI_NOT_FOUND"))
+get-unreachable	line	^callback-forms: ExtractConfig unanswered
+get-unreachable	none	^callback-forms: Callback
+set-unreachable	status	aborted
+set-unreachable	json-line	.error_message | contains("cannot snapshot store VARSTORE 0x0003 CallbackUnreachable: ExtractConfig() returned EFI_NOT_FOUND")
+set-unreachable	none	^callback-forms: Callback
+# a package list that no driver handle registered has no Callback() to call
+get-driverless	status	0x0
+get-driverless	json-line	.responses | length == 1 and (.[0].question.answer | startswith("<ValueUnavailable: question has no VarStore, and no driver handle of its package list has EFI_HII_CONFIG_ACCESS_PROTOCOL") and endswith(": GetPackageListHandle() names no driver handle>"))
+set-driverless	status	aborted
+set-driverless	json-line	.error_message | contains("no driver handle of its package list has EFI_HII_CONFIG_ACCESS_PROTOCOL") and contains(": GetPackageListHandle() names no driver handle")
diff --git a/tests/qemu/shell/driver-sample.nsh b/tests/qemu/shell/driver-sample.nsh
index 992658f..e8321b7 100644
--- a/tests/qemu/shell/driver-sample.nsh
+++ b/tests/qemu/shell/driver-sample.nsh
@@ -89,6 +89,10 @@ uefisettings.efi hii get --help
 echo uefisettings-shell: step hii-get-help %lasterror%
 uefisettings.efi hii set --help
 echo uefisettings-shell: step hii-set-help %lasterror%
+uefisettings.efi --hii-source efivar hii list-strings
+echo uefisettings-shell: step hii-source-refused %lasterror%
+uefisettings.efi hii list-strings --efivar-memory runtime
+echo uefisettings-shell: step efivar-memory-refused %lasterror%
 uefisettings.efi hii keyword get --namespace x-UEFI-ns "PATH=01041400f4274aa000df424db55239511302113d7fff0400&KEYWORD=iSCSIBootEnable"
 echo uefisettings-shell: step keyword-get %lasterror%
 uefisettings.efi hii keyword get --namespace x-UEFI-ns KEYWORD=iSCSIBootEnable
diff --git a/tests/qemu/shell/driver-sample.tsv b/tests/qemu/shell/driver-sample.tsv
index 7577424..48e1656 100644
--- a/tests/qemu/shell/driver-sample.tsv
+++ b/tests/qemu/shell/driver-sample.tsv
@@ -105,7 +105,8 @@ variable-storage-rt	status	aborted
 variable-storage-rt	json	. == {"error_message": "RUNTIME_ACCESS: runtime access implies boot service access (UEFI 2.10 section 8.2.3)"}
 # the help names no command or flag of the Linux build only
 help	status	0x0
-help	line	^Usage: uefisettings.efi \[OPTIONS\] <COMMAND>$
+help	line	^Usage: uefisettings.efi <COMMAND>$
+help	none	--hii-source|--efivar-memory
 help	none	^  (identify|ilo) 
 # get and set use the HII database here, with no backend to identify
 help	line	^  get +Get the current value of a question$
@@ -122,6 +123,12 @@ hii-set-help	line	--i-am-fine-to-brick-this-system
 # its long help lists set's unsafe operations, each check up to a space, where clap may wrap
 hii-set-help	line	(^| )browser,( |$)
 hii-set-help	line	(^| )EFI_IFR_FLAG_READ_ONLY( |$)
+# the flags of the Linux build's HiiDB source are unexpected arguments here, before or after
+# the command, as any unknown flag, not accepted and ignored
+hii-source-refused	status	aborted
+hii-source-refused	line	^error: unexpected argument '--hii-source' found$
+efivar-memory-refused	status	aborted
+efivar-memory-refused	line	^error: unexpected argument '--efivar-memory' found$
 # get and set by keyword through EFI_CONFIG_KEYWORD_HANDLER_PROTOCOL (UEFI 2.11 §35.3.1):
 # DriverSample's "My Keyword Namespace Test" has the x-UEFI-ns keyword iSCSIBootEnable, the byte at
 # 0x5B, with the options 0, 1 and 3; PATH is the vendor device path of DriverSample's main form set
diff --git a/tests/qemu/shell/form-set-disable-if.nsh b/tests/qemu/shell/form-set-disable-if.nsh
new file mode 100644
index 0000000..4d182d4
--- /dev/null
+++ b/tests/qemu/shell/form-set-disable-if.nsh
@@ -0,0 +1,51 @@
+echo -off
+# The boot of the scenario shell-form-set-disable-if: publish-hiidb.efi form-set-disable-if-forms
+# registers a form set on the variable UefisettingsFormSetDisableIf, which
+# tests/qemu/vars/form-set-disable-if.json creates with Gate 0, Hidden 1, Shown 2, After 3 and
+# Later 4, 3 bytes of 0, then 16 bytes of 0xBB, standing for a password. Its first form keeps Gate,
+# Shown, in a SUPPRESS_IF on Hidden holding 1, and O, over the password; a true DISABLE_IF outside
+# forms holds the form of Hidden and of the PASSWORD at bytes 8 to 23; a DISABLE_IF on Gate holds
+# the form of After; and a false DISABLE_IF holds a true SUPPRESS_IF, then the form of Later.
+# shell/form-set-disable-if.tsv holds the checks of the steps.
+fs0:
+echo uefisettings-shell: start
+uefisettings.efi hii list-questions --json
+echo uefisettings-shell: step list-questions %lasterror%
+uefisettings.efi hii list-questions --json --include grayed-out,suppressed,disabled
+echo uefisettings-shell: step list-questions-all %lasterror%
+uefisettings.efi hii get --json Hidden
+echo uefisettings-shell: step get-hidden %lasterror%
+uefisettings.efi hii get --json --include grayed-out,suppressed,disabled Hidden
+echo uefisettings-shell: step get-hidden-all %lasterror%
+uefisettings.efi hii get --json Shown
+echo uefisettings-shell: step get-shown %lasterror%
+uefisettings.efi hii get --json After
+echo uefisettings-shell: step get-after %lasterror%
+uefisettings.efi hii get --json Later
+echo uefisettings-shell: step get-later %lasterror%
+uefisettings.efi hii get --json O
+echo uefisettings-shell: step get-o %lasterror%
+dmpstore UefisettingsFormSetDisableIf -guid 8C78A505-BAA0-4C4A-869F-000000002401
+echo uefisettings-shell: step dmpstore-before %lasterror%
+uefisettings.efi hii set --json --include disabled After 9
+echo uefisettings-shell: step set-flagless %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system --include grayed-out,suppressed,disabled Hidden 5
+echo uefisettings-shell: step set-hidden %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system After 9
+echo uefisettings-shell: step set-after-refused %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system Later 7
+echo uefisettings-shell: step set-later-refused %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system --include disabled O 5
+echo uefisettings-shell: step set-o %lasterror%
+dmpstore UefisettingsFormSetDisableIf -guid 8C78A505-BAA0-4C4A-869F-000000002401
+echo uefisettings-shell: step dmpstore-refused %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system --include disabled After 9
+echo uefisettings-shell: step set-after %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system --include disabled Later 7
+echo uefisettings-shell: step set-later %lasterror%
+dmpstore UefisettingsFormSetDisableIf -guid 8C78A505-BAA0-4C4A-869F-000000002401
+echo uefisettings-shell: step dmpstore-after %lasterror%
+uefisettings.efi hii get --json --include disabled After
+echo uefisettings-shell: step get-after-written %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/form-set-disable-if.tsv b/tests/qemu/shell/form-set-disable-if.tsv
new file mode 100644
index 0000000..7bb3dba
--- /dev/null
+++ b/tests/qemu/shell/form-set-disable-if.tsv
@@ -0,0 +1,57 @@
+# The checks of shell/form-set-disable-if.nsh. See check-shell-log.sh.
+# Hidden and the PASSWORD, in a form under a true DISABLE_IF outside forms, are no questions, with
+# every --include, and Shown, in a SUPPRESS_IF on Hidden, is not suppressed; O shows no byte of the
+# password; After and Later may be disabled, as the checks of the reasons, which stop before their
+# section sign, which the aarch64 console prints as ?, tell
+list-questions	status	0x0
+list-questions	json	(map(select(.form_set_guid == "8C78A505-BAA0-4C4A-869F-000000002400") | .name) == ["Gate", "Shown", "O", "After", "Later"]) and (map(select(.form_set_guid == "8C78A505-BAA0-4C4A-869F-000000002400" and .name == "Shown") | .answer) == ["2"])
+list-questions	none	bb bb|BB BB|bbbb|BBBB
+list-questions-all	status	0x0
+list-questions-all	json	(map(select(.form_set_guid == "8C78A505-BAA0-4C4A-869F-000000002400") | .name) == ["Gate", "Shown", "O", "After", "Later"]) and (map(select(.form_set_guid == "8C78A505-BAA0-4C4A-869F-000000002400" and .name == "Shown") | .answer) == ["2"])
+list-questions-all	none	bb bb|BB BB|bbbb|BBBB
+get-hidden	status	0x0
+get-hidden	json	.responses | length == 0
+get-hidden-all	status	0x0
+get-hidden-all	json	.responses | length == 0
+get-shown	status	0x0
+get-shown	json	.responses | length == 1 and .[0].question.answer == "2"
+get-after	status	0x0
+get-after	json	.responses | length == 1 and (.[0].question.answer | startswith("3 <selectable or disabled: it relies on EFI_IFR_EQ_ID_VAL, where a DISABLE_IF outside forms must only rely on constants (UEFI 2.11 "))
+get-later	status	0x0
+get-later	json	.responses | length == 1 and (.[0].question.answer | startswith("4 <selectable or disabled: it is after an EFI_IFR_SUPPRESS_IF in the scope of a DISABLE_IF of its FormSet, whose condition is TRUE: edk2-stable202608 SetupBrowserDxe/IfrParse.c takes that condition for the DISABLE_IF's, which may skip the rest of its scope (:1690-1704, :3045-3059), where UEFI 2.11 "))
+get-o	status	0x0
+get-o	json	.responses | length == 1 and (.[0].question.answer | startswith("<ValueUnavailable: its bytes hold a password>"))
+get-o	none	bb bb|BB BB|bbbb|BBBB
+dmpstore-before	status	any
+dmpstore-before	line	^Variable NV\+RT\+BS '8C78A505-BAA0-4C4A-869F-000000002401:UefisettingsFormSetDisableIf' DataSize = 0x18$
+dmpstore-before	line	^  00000000: 00 01 02 03 04 00 00 00-BB BB BB BB BB BB BB BB  \*\.{16}\*$
+dmpstore-before	line	^  00000010: BB BB BB BB BB BB BB BB- +\*\.{8}\*$
+# The PASSWORD is a setup password question, which no setup browser asks for in the UEFI Shell
+set-flagless	status	aborted
+set-flagless	json	. == {"error_message": "this HiiDB declares a setup password question, and the UEFI Shell runs no setup browser, so no password is asked or checked; pass --i-am-fine-to-brick-this-system to write without it"}
+# and --i-am-fine-to-brick-this-system selects no Hidden, nor After or Later without disabled
+# questions included, and writes no byte of the password
+set-hidden	status	aborted
+set-hidden	json	.error_message | startswith("no question \"Hidden\" in the HiiDB")
+set-after-refused	status	aborted
+set-after-refused	json	.error_message | startswith("cannot tell whether question \"After\" is disabled: it relies on EFI_IFR_EQ_ID_VAL, where a DISABLE_IF outside forms must only rely on constants (UEFI 2.11 ") and endswith("; also include disabled questions to select it regardless")
+set-later-refused	status	aborted
+set-later-refused	json	.error_message | startswith("cannot tell whether question \"Later\" is disabled: it is after an EFI_IFR_SUPPRESS_IF in the scope of a DISABLE_IF of its FormSet, whose condition is TRUE: edk2-stable202608 SetupBrowserDxe/IfrParse.c takes that condition for the DISABLE_IF's, which may skip the rest of its scope (:1690-1704, :3045-3059), where UEFI 2.11 ") and endswith("; also include disabled questions to select it regardless")
+set-o	status	aborted
+set-o	json	.error_message | endswith("holds a password at bytes 8..24, which set never writes")
+set-o	none	bb bb|BB BB|bbbb|BBBB
+dmpstore-refused	status	any
+dmpstore-refused	same	dmpstore-before
+# With disabled questions included, it writes the bytes of After and Later alone
+set-after	status	0x0
+set-after	warned	.responses | length == 1 and (.[0].question.answer | startswith("9 <selectable or disabled: it relies on EFI_IFR_EQ_ID_VAL, where a DISABLE_IF outside forms must only rely on constants (UEFI 2.11 ")) and .[0].modified == true
+set-after	line	^warning: this HiiDB declares a setup password question, and the UEFI Shell runs no setup browser, so no password is asked or checked; --i-am-fine-to-brick-this-system lets uefisettings write without it$
+set-later	status	0x0
+set-later	warned	.responses | length == 1 and (.[0].question.answer | startswith("7 <selectable or disabled: it is after an EFI_IFR_SUPPRESS_IF in the scope of a DISABLE_IF of its FormSet, whose condition is TRUE: edk2-stable202608 SetupBrowserDxe/IfrParse.c takes that condition for the DISABLE_IF's, which may skip the rest of its scope (:1690-1704, :3045-3059), where UEFI 2.11 ")) and .[0].modified == true
+set-later	line	^warning: this HiiDB declares a setup password question, and the UEFI Shell runs no setup browser, so no password is asked or checked; --i-am-fine-to-brick-this-system lets uefisettings write without it$
+dmpstore-after	status	any
+dmpstore-after	line	^Variable NV\+RT\+BS '8C78A505-BAA0-4C4A-869F-000000002401:UefisettingsFormSetDisableIf' DataSize = 0x18$
+dmpstore-after	line	^  00000000: 00 01 02 09 07 00 00 00-BB BB BB BB BB BB BB BB  \*\.{16}\*$
+dmpstore-after	line	^  00000010: BB BB BB BB BB BB BB BB- +\*\.{8}\*$
+get-after-written	status	0x0
+get-after-written	json	.responses | length == 1 and (.[0].question.answer | startswith("9 <selectable or disabled: it relies on EFI_IFR_EQ_ID_VAL, where a DISABLE_IF outside forms must only rely on constants (UEFI 2.11 "))
diff --git a/tests/qemu/shell/keyword-kinds.nsh b/tests/qemu/shell/keyword-kinds.nsh
index a1d9009..1321de8 100644
--- a/tests/qemu/shell/keyword-kinds.nsh
+++ b/tests/qemu/shell/keyword-kinds.nsh
@@ -2,8 +2,8 @@ echo -off
 # The boot of the scenario shell-keyword-kinds: publish-hiidb.efi keyword-kinds-forms creates
 # KindStore and registers the forms of publish-hiidb/src/keyword_kinds_forms.rs for a handle of
 # the device path 0104140005a5788ca0ba4a4c869f000000001e027fff0400, whose x-UEFI-ns keywords
-# KindDate, KindTime, KindList and KindRef uefisettings.efi sets through the Keyword Handler;
-# shell/keyword-kinds.tsv holds the checks of the steps.
+# KindDate, KindTime, KindList, KindRef, KindString and KindText uefisettings.efi sets through
+# the Keyword Handler; shell/keyword-kinds.tsv holds the checks of the steps.
 fs0:
 echo uefisettings-shell: start
 dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
@@ -44,5 +44,43 @@ uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4
 echo uefisettings-shell: step set-date-and-list %lasterror%
 dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
 echo uefisettings-shell: step dmpstore-date-and-list %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=0000000000420041"
+echo uefisettings-shell: step set-string %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-string %lasterror%
+uefisettings.efi hii keyword get --namespace x-UEFI-ns "PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString"
+echo uefisettings-shell: step get-string %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindText&VALUE=00000042000a0041"
+echo uefisettings-shell: step set-text %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-text %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=0044004300420041"
+echo uefisettings-shell: step set-string-too-long %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-string-too-long %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=0000004200000041"
+echo uefisettings-shell: step set-string-unwritten %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-string-unwritten %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=000000000000e000"
+echo uefisettings-shell: step set-string-private-use %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-string-private-use %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=000000000000d800"
+echo uefisettings-shell: step set-string-surrogate %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-string-surrogate %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=00000042000a0041"
+echo uefisettings-shell: step set-string-line-break %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-string-line-break %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=00420041"
+echo uefisettings-shell: step set-string-width %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-string-width %lasterror%
+uefisettings.efi hii keyword set "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=0000000000420041&READONLY"
+echo uefisettings-shell: step set-string-read-only-resp %lasterror%
+dmpstore KindStore -guid 8C78A505-BAA0-4C4A-869F-000000001E01
+echo uefisettings-shell: step dmpstore-string-read-only-resp %lasterror%
 echo uefisettings-shell: done
 reset -s
diff --git a/tests/qemu/shell/keyword-kinds.tsv b/tests/qemu/shell/keyword-kinds.tsv
index 422ea10..e4ac12b 100644
--- a/tests/qemu/shell/keyword-kinds.tsv
+++ b/tests/qemu/shell/keyword-kinds.tsv
@@ -1,13 +1,16 @@
-# The checks of shell/keyword-kinds.nsh: hii keyword set of a DATE, a TIME and an ORDERED_LIST
-# through the Keyword Handler, which writes each VALUE as given (UEFI 2.11 §35.3.2), and refusals
-# before any call, which dmpstore shows wrote nothing. See check-shell-log.sh.
+# The checks of shell/keyword-kinds.nsh: hii keyword set of a DATE, a TIME, an ORDERED_LIST and
+# STRINGs through the Keyword Handler, which writes each VALUE as given (UEFI 2.11 §35.3.2), and
+# refusals before any call, which dmpstore shows wrote nothing. See check-shell-log.sh.
 # TerminalDxe prints a character outside ASCII as "?" unless the serial terminal is VT-UTF8, so
 # the checks of texts that cite "§" compare them with "?" in its place.
 # KindStore as publish-hiidb creates it: 2024-03-31 at byte 0, 12:34:56 at byte 4, the items 1, 2
-# and 3 at byte 8, and the EFI_HII_REF of QuestionId 4 and FormId 1 at byte 12
+# and 3 at byte 8, the EFI_HII_REF of QuestionId 4 and FormId 1 at byte 12, and the empty STRINGs
+# KindString at byte 34 and KindText at byte 42
 dmpstore-before	status	any
-dmpstore-before	line	^Variable NV\+BS '8C78A505-BAA0-4C4A-869F-000000001E01:KindStore' DataSize = 0x22$
+dmpstore-before	line	^Variable NV\+BS '8C78A505-BAA0-4C4A-869F-000000001E01:KindStore' DataSize = 0x32$
 dmpstore-before	line	^  00000000: E8 07 03 1F 0C 22 38 00-01 02 03 00 04 00 01 00
+dmpstore-before	line	^  00000020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 
+dmpstore-before	line	^  00000030: 00 00 +\*\.\.\*$
 # the DATE suppresses its year: a VALUE that keeps 2024 sets 2024-04-01
 set-date	status	0x0
 set-date	line	^NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindDate&VALUE=010407e8$
@@ -50,3 +53,51 @@ set-date-and-list	status	0x0
 set-date-and-list	line	^NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindDate&VALUE=1f0c07e8&NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindList&VALUE=000103$
 dmpstore-date-and-list	status	any
 dmpstore-date-and-list	line	^  00000000: E8 07 0C 1F 0D 00 38 00-03 01 00 00 04 00 01 00
+# a STRING's VALUE holds its MaxSize CHAR16s last byte first, NULL-padded: "AB"
+set-string	status	0x0
+set-string	line	^NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=0000000000420041$
+dmpstore-string	status	any
+dmpstore-string	line	^  00000020: 00 00 41 00 42 00 00 00-00 00 00 00 00 00 00 00 
+get-string	status	0x0
+get-string	line	^NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindString&VALUE=0000000000420041$
+# the multi-line STRING takes a line feed: "A", LF, "B"
+set-text	status	0x0
+set-text	line	^NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f000000001e027fff0400&KEYWORD=KindText&VALUE=00000042000a0041$
+dmpstore-text	status	any
+dmpstore-text	line	^  00000020: 00 00 41 00 42 00 00 00-00 00 41 00 0A 00 42 00 
+dmpstore-text	line	^  00000030: 00 00 +\*
+# 4 characters, where the last CHAR16 holds the NULL
+set-string-too-long	status	aborted
+set-string-too-long	json	(.error_message | gsub("§"; "?")) == "keyword KindString: VALUE=0044004300420041 of question \"Kind string\": cannot set question \"Kind string\": the STRING takes at most 3 characters, its last CHAR16 of MaxSize 4 holding the NULL (UEFI 2.11 ?33.2.5.4.9), not 4"
+dmpstore-string-too-long	status	any
+dmpstore-string-too-long	same	dmpstore-text
+# a character after the NULL, which set does not write
+set-string-unwritten	status	aborted
+set-string-unwritten	json	.error_message == "keyword KindString: SetData() writes VALUE=0000004200000041 as given, where set writes 0000000000000041 at VarOffset 34 for question \"Kind string\""
+dmpstore-string-unwritten	status	any
+dmpstore-string-unwritten	same	dmpstore-text
+# U+E000, of the Private Use Area
+set-string-private-use	status	aborted
+set-string-private-use	json	(.error_message | gsub("§"; "?")) == "keyword KindString: VALUE=000000000000e000 of question \"Kind string\": cannot set question \"Kind string\": '\\u{e000}' (U+E000) lies in the Private Use Area, U+E000..U+F8FF, which UEFI 2.11 ?33.2.6.2.1 prohibits"
+dmpstore-string-private-use	status	any
+dmpstore-string-private-use	same	dmpstore-text
+# a UTF-16 surrogate
+set-string-surrogate	status	aborted
+set-string-surrogate	json	(.error_message | gsub("§"; "?")) == "keyword KindString: VALUE=000000000000d800 of question \"Kind string\": its character 0 is CHAR16 0xd800, a UTF-16 surrogate, which UCS-2 has no character for (UEFI 2.11 ?33.2.6.2.2)"
+dmpstore-string-surrogate	status	any
+dmpstore-string-surrogate	same	dmpstore-text
+# a line feed in the single-line STRING
+set-string-line-break	status	aborted
+set-string-line-break	json	(.error_message | gsub("§"; "?")) == "keyword KindString: VALUE=00000042000a0041 of question \"Kind string\": cannot set question \"Kind string\": the STRING is single-line (no EFI_IFR_STRING_MULTI_LINE, UEFI 2.11 ?33.3.8.3.70), so it takes no line break"
+dmpstore-string-line-break	status	any
+dmpstore-string-line-break	same	dmpstore-text
+# 2 CHAR16s, where SetData() writes MaxSize 4
+set-string-width	status	aborted
+set-string-width	json	.error_message == "keyword KindString: VALUE=00420041 is not as wide as question \"Kind string\""
+dmpstore-string-width	status	any
+dmpstore-string-width	same	dmpstore-text
+# &READONLY
+set-string-read-only-resp	status	aborted
+set-string-read-only-resp	json	.error_message == "keyword KindString: its <KeywordResp> has &READONLY, and SetData() writes no read-only keyword"
+dmpstore-string-read-only-resp	status	any
+dmpstore-string-read-only-resp	same	dmpstore-text
diff --git a/tests/qemu/shell/readwrite.tsv b/tests/qemu/shell/readwrite.tsv
index beeb438..df10cd2 100644
--- a/tests/qemu/shell/readwrite.tsv
+++ b/tests/qemu/shell/readwrite.tsv
@@ -66,12 +66,12 @@ set-absent-target	json	. == {"error_message": "cannot set question \"Absent targ
 # its EFI_IFR_VALUE makes "Computed value" read-only: set refuses it before any write
 set-computed	status	aborted
 set-computed	json	(.error_message | gsub("§"; "?")) == "cannot set question \"Computed value\": its EFI_IFR_VALUE expression makes it read-only (UEFI 2.11 ?33.3.8.3.88)"
-# what each question without a VarStore lacks, or that its driver keeps its value, which this
-# build does not call yet
+# what each question without a VarStore lacks, or that its driver keeps its value: get and set find
+# no driver handle with EFI_HII_CONFIG_ACCESS_PROTOCOL for it
 get-driver-held	status	0x0
-get-driver-held	json	.responses | length == 1 and (.[0].question.answer | gsub("§"; "?")) == "<ValueUnavailable: question has no VarStore; its driver keeps the value, which only EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() reaches (UEFI 2.11 ?33.2.5.6), which uefisettings.efi does not call yet>"
+get-driver-held	json	.responses | length == 1 and (.[0].question.answer | gsub("§"; "?")) == "<ValueUnavailable: question has no VarStore, and no driver handle of its package list has EFI_HII_CONFIG_ACCESS_PROTOCOL, whose CallBack() alone reaches its value (UEFI 2.11 ?33.2.5.6): GetPackageListHandle() names no driver handle>"
 set-driver-held	status	aborted
-set-driver-held	json	(.error_message | gsub("§"; "?")) == "cannot set question \"Driver held\": question has no VarStore; its driver keeps the value, which only EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() reaches (UEFI 2.11 ?33.2.5.6), which uefisettings.efi does not call yet"
+set-driver-held	json	(.error_message | gsub("§"; "?")) == "cannot set question \"Driver held\": question has no VarStore, and no driver handle of its package list has EFI_HII_CONFIG_ACCESS_PROTOCOL, whose CallBack() alone reaches its value (UEFI 2.11 ?33.2.5.6): GetPackageListHandle() names no driver handle"
 get-no-value-source	status	0x0
 get-no-value-source	json	.responses | length == 1 and (.[0].question.answer | gsub("§"; "?")) == "<ValueUnavailable: question has no VarStore, READ or WRITE expression, or EFI_IFR_FLAG_CALLBACK, one of which UEFI 2.11 ?33.2.5.6 requires>"
 set-no-value-source	status	aborted
@@ -82,10 +82,10 @@ set-read-only	status	aborted
 set-read-only	json	(.error_message | gsub("§"; "?")) == "cannot set question \"Read only\": question has no VarStore, WRITE expression or EFI_IFR_FLAG_CALLBACK, so nothing keeps a changed value (UEFI 2.11 ?33.2.5.4.1)"
 get-unevaluated-read	status	0x0
 get-unevaluated-read	json	.responses | length == 1 and .[0].question.answer == "<ValueUnavailable: its READ expression uses EFI_IFR_TO_UINT, which uefisettings does not evaluate>"
-# list-questions never calls a driver: it lists the question that its driver holds with get's
-# refusal
+# list-questions never calls a driver: it lists the question that its driver holds with the refusal
+# of get --no-efivars
 list-questions	status	0x0
-list-questions	json	any(.[]; .name == "Driver held" and (.answer | gsub("§"; "?")) == "<ValueUnavailable: question has no VarStore; its driver keeps the value, which only EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() reaches (UEFI 2.11 ?33.2.5.6), which uefisettings.efi does not call yet>") and any(.[]; .name == "Read only" and .answer == "5") and any(.[]; .name == "Read transformed" and .answer == "101") and any(.[]; .name == "Computed value" and .answer == "21")
+list-questions	json	any(.[]; .name == "Driver held" and (.answer | gsub("§"; "?")) == "<ValueUnavailable: question has no VarStore; its driver keeps the value, which only EFI_HII_CONFIG_ACCESS_PROTOCOL.CallBack() reaches (UEFI 2.11 ?33.2.5.6), which only get (without --no-efivars) and set call>") and any(.[]; .name == "Read only" and .answer == "5") and any(.[]; .name == "Read transformed" and .answer == "101") and any(.[]; .name == "Computed value" and .answer == "21")
 # no refused set wrote, nor created AbsentBuffer
 dmpstore-refused	status	any
 dmpstore-refused	same	dmpstore-after
diff --git a/tests/qemu/shell/staged-set-applied.nsh b/tests/qemu/shell/staged-set-applied.nsh
new file mode 100644
index 0000000..b584bc3
--- /dev/null
+++ b/tests/qemu/shell/staged-set-applied.nsh
@@ -0,0 +1,13 @@
+echo -off
+# The second boot of the scenario staged-set: before the UEFI Shell, the firmware starts the
+# Boot#### of the set that Linux staged, whose uefisettings.efi applies it and resets the
+# platform; then the Shell reads the questions that it set. shell/staged-set-applied.tsv holds
+# the checks.
+fs0:
+echo uefisettings-shell: start
+uefisettings.efi hii get --json "Callback value beside stores"
+echo uefisettings-shell: step get-applied %lasterror%
+uefisettings.efi hii get --json "Callback value refused in CHANGING"
+echo uefisettings-shell: step get-refused %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/staged-set-applied.tsv b/tests/qemu/shell/staged-set-applied.tsv
new file mode 100644
index 0000000..0068c31
--- /dev/null
+++ b/tests/qemu/shell/staged-set-applied.tsv
@@ -0,0 +1,18 @@
+# The checks of shell/staged-set-applied.nsh. See check-shell-log.sh.
+# the firmware starts the staged set's Boot#### by the Hard Drive node of the ESP, GPT entry 2,
+# the first partition on the disk; its uefisettings.efi applies the first request, its driver
+# refuses the second, it deletes the set's Boot####, and it resets the platform, after which the
+# firmware loads the drivers again
+firmware	line	^BdsDxe: starting Boot[0-9A-Fa-f]{4} "uefisettings: a set staged for this boot" from HD\(2,GPT,8C78A505-BAA0-4C4A-869F-000000001A10,0x800,0x14000\)/\\EFI\\uefisettings\\uefisettings\.efi$
+firmware	line	^callback-forms: Callback\(CHANGED\) question 0x0201 value 0x1: SUCCESS
+firmware	line	^apply-staged: question "Callback value beside stores", QuestionId 0x0201 of FormSet [0-9A-Fa-f-]+, to 1: applied: <applied
+firmware	line	^apply-staged: question "Callback value refused in CHANGING", QuestionId 0x0204 of FormSet [0-9A-Fa-f-]+, to 1: not applied: .*EFI_ACCESS_DENIED
+firmware	line	^apply-staged: deleted Boot[0-9A-Fa-f]{4}$
+firmware	none	^apply-staged: failed
+firmware	line	^apply-staged: resetting the platform$
+firmware	count	2 ^publish-hiidb: registered the callback forms Callbacks$
+# the driver keeps what the staged boot set
+get-applied	status	0x0
+get-applied	json-line	.responses | length == 1 and (.[0].question.answer | startswith("On <"))
+get-refused	status	0x0
+get-refused	json-line	.responses | length == 1 and (.[0].question.answer | startswith("Off <"))
diff --git a/tests/qemu/shell/staged-set-interrupted.nsh b/tests/qemu/shell/staged-set-interrupted.nsh
new file mode 100644
index 0000000..3a7faa4
--- /dev/null
+++ b/tests/qemu/shell/staged-set-interrupted.nsh
@@ -0,0 +1,11 @@
+echo -off
+# The fourth boot of the scenario staged-set: the firmware starts the Boot#### of the set that
+# Linux staged, whose question's Callback(CHANGED) resets the platform before uefisettings.efi
+# records any result; then the UEFI Shell reads that question. shell/staged-set-interrupted.tsv
+# holds the checks.
+fs0:
+echo uefisettings-shell: start
+uefisettings.efi hii get --json "Callback value resetting the platform"
+echo uefisettings-shell: step get-partly-applied %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/staged-set-interrupted.tsv b/tests/qemu/shell/staged-set-interrupted.tsv
new file mode 100644
index 0000000..d79f5db
--- /dev/null
+++ b/tests/qemu/shell/staged-set-interrupted.tsv
@@ -0,0 +1,10 @@
+# The checks of shell/staged-set-interrupted.nsh. See check-shell-log.sh.
+# the staged set's uefisettings.efi starts and its driver resets the platform in CHANGED, before
+# uefisettings.efi prints anything, after which the firmware loads the drivers again
+firmware	line	^BdsDxe: starting Boot[0-9A-Fa-f]{4} "uefisettings: a set staged for this boot" from HD\(2,GPT,8C78A505-BAA0-4C4A-869F-000000001A10,0x800,0x14000\)/\\EFI\\uefisettings\\uefisettings\.efi$
+firmware	line	^callback-forms: Callback\(CHANGED\) question 0x0102 value 0x1: SUCCESS, resetting the platform$
+firmware	none	^apply-staged:
+firmware	count	2 ^publish-hiidb: registered the callback forms Callbacks$
+# the driver wrote the value before the reset
+get-partly-applied	status	0x0
+get-partly-applied	json-line	.responses | length == 1 and (.[0].question.answer | startswith("On"))
diff --git a/tests/qemu/shell/staged-set-not-started.nsh b/tests/qemu/shell/staged-set-not-started.nsh
new file mode 100644
index 0000000..951f540
--- /dev/null
+++ b/tests/qemu/shell/staged-set-not-started.nsh
@@ -0,0 +1,10 @@
+echo -off
+# The third boot of the scenario staged-set: the firmware finds no image for the Boot#### of
+# the set that Linux staged, as Linux deleted it, and starts the UEFI Shell, which reads the
+# question of that set. shell/staged-set-not-started.tsv holds the checks.
+fs0:
+echo uefisettings-shell: start
+uefisettings.efi hii get --json "Callback value beside stores"
+echo uefisettings-shell: step get-unapplied %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/staged-set-not-started.tsv b/tests/qemu/shell/staged-set-not-started.tsv
new file mode 100644
index 0000000..e6f4d5d
--- /dev/null
+++ b/tests/qemu/shell/staged-set-not-started.tsv
@@ -0,0 +1,8 @@
+# The checks of shell/staged-set-not-started.nsh. See check-shell-log.sh.
+# the firmware fails to load the staged set's image and boots on, once
+firmware	line	^BdsDxe: failed to load Boot[0-9A-Fa-f]{4} "uefisettings: a set staged for this boot" from HD\(2,GPT,8C78A505-BAA0-4C4A-869F-000000001A10,0x800,0x14000\)/\\EFI\\uefisettings\\uefisettings\.efi: Not Found$
+firmware	none	^apply-staged:
+firmware	count	1 ^publish-hiidb: registered the callback forms Callbacks$
+# the value that the staged set held is not applied
+get-unapplied	status	0x0
+get-unapplied	json-line	.responses | length == 1 and (.[0].question.answer | startswith("On <"))
diff --git a/tests/qemu/shell/undeclared-password.nsh b/tests/qemu/shell/undeclared-password.nsh
new file mode 100644
index 0000000..990fad8
--- /dev/null
+++ b/tests/qemu/shell/undeclared-password.nsh
@@ -0,0 +1,28 @@
+echo -off
+# The boot of the scenario shell-undeclared-password: publish-hiidb.efi undeclared-password-forms
+# registers, for one device path, a package list with a PASSWORD of VarStoreId 9, which no VarStore
+# of its form package declares, beside the NUMERIC "Undeclared backing setting", of the x-UEFI-ns
+# keyword UndeclaredSetting, over bytes 0..4 of UdBacking, and a package list with the NUMERIC
+# "Undeclared other setting" over Other; vars/undeclared-password.json creates UdBacking, whose
+# bytes 0..4 hold 0x7A4C19E3, and Other. shell/undeclared-password.tsv holds the checks of the
+# steps.
+fs0:
+echo uefisettings-shell: start
+dmpstore UdBacking -guid 8C78A505-BAA0-4C4A-869F-000000002301
+echo uefisettings-shell: step dmpstore-before %lasterror%
+uefisettings.efi hii get --json "Undeclared backing setting"
+echo uefisettings-shell: step get %lasterror%
+uefisettings.efi hii get --json "Undeclared other setting"
+echo uefisettings-shell: step get-other %lasterror%
+uefisettings.efi hii keyword get --namespace x-UEFI-ns "PATH=0104140005a5788ca0ba4a4c869f0000000023047fff0400&KEYWORD=UndeclaredSetting"
+echo uefisettings-shell: step keyword-get %lasterror%
+uefisettings.efi hii keyword set --i-am-fine-to-brick-this-system "NAMESPACE=x-UEFI-ns&PATH=0104140005a5788ca0ba4a4c869f0000000023047fff0400&KEYWORD=UndeclaredSetting&VALUE=00000001"
+echo uefisettings-shell: step keyword-set %lasterror%
+uefisettings.efi hii list-questions --json
+echo uefisettings-shell: step list-questions %lasterror%
+uefisettings.efi hii set --json --i-am-fine-to-brick-this-system "Undeclared backing setting" 1
+echo uefisettings-shell: step set-bypassed %lasterror%
+dmpstore UdBacking -guid 8C78A505-BAA0-4C4A-869F-000000002301
+echo uefisettings-shell: step dmpstore-after %lasterror%
+echo uefisettings-shell: done
+reset -s
diff --git a/tests/qemu/shell/undeclared-password.tsv b/tests/qemu/shell/undeclared-password.tsv
new file mode 100644
index 0000000..6c835f0
--- /dev/null
+++ b/tests/qemu/shell/undeclared-password.tsv
@@ -0,0 +1,25 @@
+# The checks of shell/undeclared-password.nsh. See check-shell-log.sh.
+# A PASSWORD of VarStoreId 9, which no VarStore of its form package declares, names no VarStore,
+# so its password may be in any variable: get, keyword get, keyword set, list-questions and set
+# read and write none, of either package list, even with --i-am-fine-to-brick-this-system, which
+# lifts none of that, so set and keyword set warn of nothing, and nothing shows 0x7A4C19E3, which
+# UdBacking holds where the password may be
+dmpstore-before	status	any
+dmpstore-before	line	^Variable NV\+RT\+BS '8C78A505-BAA0-4C4A-869F-000000002301:UdBacking' DataSize = 0x04$
+get	status	aborted
+get	json	. == {"error_message": "PASSWORD question 0x0002 in FormSet 8C78A505-BAA0-4C4A-869F-000000002300: no supported varstore with matching id 0x0009 found; as the variable of that password is unknown, the UEFI Shell build reads and writes no variable of this HiiDB"}
+get	none	2051807715|7[aA]4[cC]19[eE]3|[eE]3194[cC]7[aA]|[eE]3 19 4[cC] 7[aA]|227, 25, 76, 122
+get-other	status	aborted
+get-other	same	get
+keyword-get	status	aborted
+keyword-get	same	get
+keyword-get	none	2051807715|7[aA]4[cC]19[eE]3|[eE]3194[cC]7[aA]|[eE]3 19 4[cC] 7[aA]|227, 25, 76, 122
+keyword-set	status	aborted
+keyword-set	same	get
+keyword-set	none	2051807715|7[aA]4[cC]19[eE]3|[eE]3194[cC]7[aA]|[eE]3 19 4[cC] 7[aA]|227, 25, 76, 122
+list-questions	status	aborted
+list-questions	same	get
+set-bypassed	status	aborted
+set-bypassed	same	get
+dmpstore-after	status	any
+dmpstore-after	same	dmpstore-before
diff --git a/tests/qemu/shell/variable-get.nsh b/tests/qemu/shell/variable-get.nsh
index 004b3f0..6f7c0e2 100644
--- a/tests/qemu/shell/variable-get.nsh
+++ b/tests/qemu/shell/variable-get.nsh
@@ -11,7 +11,15 @@ uefisettings.efi variable get SecureBoot
 echo uefisettings-shell: step secure-boot %lasterror%
 uefisettings.efi variable get SetupMode
 echo uefisettings-shell: step setup-mode %lasterror%
-uefisettings.efi variable get Boot0000
+uefisettings.efi variable get Boot0001
+echo uefisettings-shell: step boot0001 %lasterror%
+uefisettings.efi variable get Boot0002
+echo uefisettings-shell: step boot0002 %lasterror%
+uefisettings.efi variable get Key0000
+echo uefisettings-shell: step key0000 %lasterror%
+uefisettings.efi variable get ConOut
+echo uefisettings-shell: step con-out %lasterror%
+uefisettings.efi variable get Boot001
 echo uefisettings-shell: step unknown %lasterror%
 echo uefisettings-shell: done
 reset -s
diff --git a/tests/qemu/shell/variable-get.tsv b/tests/qemu/shell/variable-get.tsv
index 55d10ce..f3363b3 100644
--- a/tests/qemu/shell/variable-get.tsv
+++ b/tests/qemu/shell/variable-get.tsv
@@ -1,5 +1,8 @@
 # The checks of shell/variable-get.nsh, the boot of shell-variable-get: get decodes Timeout and
-# BootOrder, and the default firmware has no SecureBoot or SetupMode. See check-shell-log.sh.
+# BootOrder, and the default firmware has no SecureBoot or SetupMode. It shows Boot0001 and
+# Boot0002 as the firmware's boot manager logged them when it tried them before the shell, the
+# first, "UEFI Misc Device", in vain; Key0000, F2 to Boot0000, whose CRC matches; and ConOut as
+# text. See check-shell-log.sh.
 timeout	status	0x0
 timeout	json	.variable == "Timeout-8be4df61-93ca-11d2-aa0d-00e098032b8c" and .attributes == 7 and (.value | type) == "number"
 boot-order	status	0x0
@@ -8,5 +11,13 @@ secure-boot	status	0x0
 secure-boot	json	. == {"variable": "SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c", "absent": true}
 setup-mode	status	0x0
 setup-mode	json	. == {"variable": "SetupMode-8be4df61-93ca-11d2-aa0d-00e098032b8c", "absent": true}
+boot0001	status	0x0
+boot0001	firmware	.value as $v | .variable == "Boot0001-8be4df61-93ca-11d2-aa0d-00e098032b8c" and ($v.device_paths | length) == 1 and ($firmware | any(startswith("BdsDxe: failed to load Boot0001 \"\($v.description)\" from \($v.device_paths[0]): ")))
+boot0002	status	0x0
+boot0002	firmware	.value as $v | .variable == "Boot0002-8be4df61-93ca-11d2-aa0d-00e098032b8c" and ($v.device_paths | length) == 1 and ($firmware | any(. == "BdsDxe: loading Boot0002 \"\($v.description)\" from \($v.device_paths[0])"))
+key0000	status	0x0
+key0000	json	. == {"variable": "Key0000-8be4df61-93ca-11d2-aa0d-00e098032b8c", "attributes": 7, "value": {"revision": 0, "modifiers": [], "keys": ["F2"], "boot_option": "Boot0000", "crc_matches": true}}
+con-out	status	0x0
+con-out	json	.variable == "ConOut-8be4df61-93ca-11d2-aa0d-00e098032b8c" and .attributes == 7 and (.value | type) == "string" and (.value | contains("/Uart(115200,8,N,1)/"))
 unknown	status	aborted
-unknown	line	`uefisettings variable info Boot0000 GUID`
+unknown	line	`uefisettings variable info Boot001 GUID`
diff --git a/tests/qemu/ubuntu-packages b/tests/qemu/ubuntu-packages
index 67a6682..636b14e 100644
--- a/tests/qemu/ubuntu-packages
+++ b/tests/qemu/ubuntu-packages
@@ -2,6 +2,7 @@ binutils-aarch64-linux-gnu
 build-essential
 cpio
 curl
+fdisk
 gcc-aarch64-linux-gnu
 git
 jq
diff --git a/tests/qemu/vars/boot-manager.json b/tests/qemu/vars/boot-manager.json
new file mode 100644
index 0000000..c6b9cb6
--- /dev/null
+++ b/tests/qemu/vars/boot-manager.json
@@ -0,0 +1,17 @@
+{
+  "version": 2,
+  "variables": [
+    {
+      "name": "Boot0099",
+      "guid": "8be4df61-93ca-11d2-aa0d-00e098032b8c",
+      "attr": 7,
+      "data": "010000402800660069006c00650020006d0069007300730069006e0067002d00390039002e006500660069000000040424005c006d0069007300730069006e0067002d00390039002e0065006600690000007fff04007565666973657474696e6773"
+    },
+    {
+      "name": "Key0099",
+      "guid": "8be4df61-93ca-11d2-aa0d-00e098032b8c",
+      "attr": 7,
+      "data": "00020040579314c5990000007100"
+    }
+  ]
+}
diff --git a/tests/qemu/vars/enhanced-auth-87.json b/tests/qemu/vars/enhanced-auth-87.json
index 231245e..eb22285 100644
--- a/tests/qemu/vars/enhanced-auth-87.json
+++ b/tests/qemu/vars/enhanced-auth-87.json
@@ -12,6 +12,12 @@
       "guid": "8c78a505-baa0-4c4a-869f-000000000301",
       "attr": 135,
       "data": "020100004400000000000000EA070B060C00000000000000000000000100000020000000000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F00120000"
+    },
+    {
+      "name": "EnhancedAuthNonce",
+      "guid": "8c78a505-baa0-4c4a-869f-000000000301",
+      "attr": 135,
+      "data": "01020000400000000000000008000000A5A5A5A5A5A5A5A50100000020000000000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F00120000"
     }
   ]
 }
diff --git a/tests/qemu/vars/form-set-disable-if.json b/tests/qemu/vars/form-set-disable-if.json
new file mode 100644
index 0000000..39d8e63
--- /dev/null
+++ b/tests/qemu/vars/form-set-disable-if.json
@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "variables": [
+    {
+      "name": "UefisettingsFormSetDisableIf",
+      "guid": "8c78a505-baa0-4c4a-869f-000000002401",
+      "attr": 7,
+      "data": "0001020304000000BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+    }
+  ]
+}
diff --git a/tests/qemu/vars/undeclared-password.json b/tests/qemu/vars/undeclared-password.json
new file mode 100644
index 0000000..d2a5b37
--- /dev/null
+++ b/tests/qemu/vars/undeclared-password.json
@@ -0,0 +1,17 @@
+{
+  "version": 2,
+  "variables": [
+    {
+      "name": "UdBacking",
+      "guid": "8c78a505-baa0-4c4a-869f-000000002301",
+      "attr": 7,
+      "data": "E3194C7A"
+    },
+    {
+      "name": "Other",
+      "guid": "8c78a505-baa0-4c4a-869f-000000002303",
+      "attr": 7,
+      "data": "2211"
+    }
+  ]
+}
diff --git a/tests/ruled_out_character_warning.rs b/tests/ruled_out_character_warning.rs
new file mode 100644
index 0000000..9e817bc
--- /dev/null
+++ b/tests/ruled_out_character_warning.rs
@@ -0,0 +1,146 @@
+// Copyright 2023 Meta Platforms, Inc. and affiliates.
+//
+// Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//! The warning that uefisettings logs for a string that holds a character that UEFI 2.11 rules
+//! out of strings, which reads as U+FFFD: one per string, naming the first such character, while
+//! list-strings still writes valid JSON. A string that holds only common control codes
+//! (§33.2.6.2.4) gets none.
+
+// the builds that read HiiDB files and log as RUST_LOG says
+#![cfg(all(hiidb_files, target_os = "linux"))]
+
+use std::fs;
+use std::process::Command;
+
+/// The HiiDB file of one package list of a strings package and the End package (UEFI 2.11
+/// §33.3.1, §33.3.6): its header holds Language "en", and its string blocks are an
+/// EFI_HII_SIBT_STRING_UCS2 of the CHAR16s of each of `strings`, then EFI_HII_SIBT_END.
+fn hiidb(strings: &[&[u16]]) -> Vec<u8> {
+    let header = [
+        &[0u8; 32][..],      // LanguageWindow
+        &1u16.to_le_bytes(), // LanguageName
+        b"en\0",             // Language
+    ]
+    .concat();
+    let mut blocks = Vec::new();
+    for units in strings {
+        blocks.push(0x14);
+        blocks.extend(units.iter().chain(&[0]).flat_map(|unit| unit.to_le_bytes()));
+    }
+    blocks.push(0x00);
+    let hdr_size = u32::try_from(4 + 4 + 4 + header.len()).expect("HdrSize fits a u32");
+    let length = hdr_size + u32::try_from(blocks.len()).expect("the blocks fit a u32");
+    let strings = [
+        &length.to_le_bytes()[..3],
+        &[0x04], // EFI_HII_PACKAGE_STRINGS
+        &hdr_size.to_le_bytes(),
+        &hdr_size.to_le_bytes(), // StringInfoOffset
+        &header,
+        &blocks,
+    ]
+    .concat();
+    let end = [0x04, 0x00, 0x00, 0xDF];
+    let list_length = u32::try_from(16 + 4 + strings.len() + end.len()).expect("the list fits");
+    [&[0x11; 16][..], &list_length.to_le_bytes(), &strings, &end].concat()
+}
+
+/// What `uefisettings hii list-strings --json -f <file>` prints on stdout, parsed as JSON, and on
+/// stderr, with RUST_LOG=warn, for the HiiDB file `hiidb`.
+fn list_strings(hiidb: &[u8]) -> (serde_json::Value, String) {
+    let dir = tempfile::tempdir().expect("create a directory");
+    let path = dir.path().join("hiidb.bin");
+    fs::write(&path, hiidb).expect("write the HiiDB");
+    let output = Command::new(env!("CARGO_BIN_EXE_uefisettings"))
+        .args(["hii", "list-strings", "--json", "-f"])
+        .arg(&path)
+        .env("RUST_LOG", "warn")
+        .output()
+        .expect("run uefisettings");
+    let stdout = String::from_utf8(output.stdout).expect("stdout is UTF-8");
+    let stderr = String::from_utf8_lossy(&output.stderr).into_owned();
+    assert!(
+        output.status.success(),
+        "{:?}: stdout {stdout}, stderr {stderr}",
+        output.status
+    );
+    let json = serde_json::from_str(&stdout)
+        .unwrap_or_else(|err| panic!("parse stdout {stdout} as JSON: {err}"));
+    (json, stderr)
+}
+
+/// Whether `json` holds the string `text`.
+fn lists(json: &serde_json::Value, text: &str) -> bool {
+    json.to_string()
+        .contains(&serde_json::Value::from(text).to_string())
+}
+
+/// What every warning of a ruled-out character ends with.
+const READS_AS_U_FFFD: &str = "it reads as U+FFFD";
+
+#[test]
+fn list_strings_warns_once_per_string_of_its_first_ruled_out_character() {
+    let cases: [(&str, &[u16], &str, &str); 3] = [
+        (
+            "private use",
+            &[0x41, 0xE000, 0xE001, 0x42],
+            "A\u{FFFD}\u{FFFD}B",
+            "string 1 of the \"en\" strings package holds U+E000, which is in the private use \
+             area (UEFI 2.11 §33.2.6.2.1): it reads as U+FFFD",
+        ),
+        (
+            "a surrogate pair",
+            &[0xD83D, 0xDE00],
+            "\u{FFFD}\u{FFFD}",
+            "string 1 of the \"en\" strings package holds U+D83D, which is a surrogate (UEFI \
+             2.11 §33.2.6.2.2): it reads as U+FFFD",
+        ),
+        (
+            "U+FC00",
+            &[0xFC00],
+            "\u{FFFD}",
+            "string 1 of the \"en\" strings package holds U+FC00, which is between 0xF000 and \
+             0xFCFF (UEFI 2.11 §33.3.6.3.1, §33.3.6.3.2): it reads as U+FFFD",
+        ),
+    ];
+    // string 2 holds a ruled-out character too, so that its warning is its own
+    let string_2 = "string 2 of the \"en\" strings package holds U+F000, which is in the private \
+                    use area (UEFI 2.11 §33.2.6.2.1): it reads as U+FFFD";
+    for (case, units, string, warning) in cases {
+        let (json, stderr) = list_strings(&hiidb(&[units, &[0xF000, 0x5A]]));
+
+        assert!(lists(&json, string), "{case}: {string:?} is listed: {json}");
+        assert!(
+            lists(&json, "\u{FFFD}Z"),
+            "{case}: string 2 is listed: {json}"
+        );
+        assert_eq!(
+            (
+                stderr.matches(warning).count(),
+                stderr.matches(string_2).count(),
+                stderr.matches(READS_AS_U_FFFD).count()
+            ),
+            (1, 1, 2),
+            "{case}: one warning per string: {stderr}"
+        );
+    }
+}
+
+#[test]
+fn list_strings_keeps_control_codes_without_a_warning() {
+    let (json, stderr) = list_strings(&hiidb(&[&[0xF620, 0x51, 0xF621, 0xF7AB, 0xF8FF]]));
+
+    assert!(
+        lists(&json, "\u{F620}Q\u{F621}\u{F7AB}\u{F8FF}"),
+        "the control codes are listed: {json}"
+    );
+    assert!(!stderr.contains(READS_AS_U_FFFD), "stderr: {stderr}");
+}