diff --git a/docs/IPODTOUCH4.md b/docs/IPODTOUCH4.md
index 00c0bf1ed..5d3345775 100644
--- a/docs/IPODTOUCH4.md
+++ b/docs/IPODTOUCH4.md
@@ -35,7 +35,13 @@ iOS 6.1.6 is untethered). The completed bootstrap provides:
 - OpenSSH on device port 22;
 - a dedicated RSA client key and pinned device host key;
 - `PasswordAuthentication no` after public-key login succeeds;
-- `ldid`, `uicache`, and `uiopen` for application deployment.
+- `ldid`, `uicache`, and `uiopen` for application deployment;
+- **AppSync Unified and its Cydia Substrate dependencies** for local self-signed
+  User applications. Install the `iphoneos-arm` package from the
+  [upstream release](https://github.com/akemin-dayo/AppSync/releases), then
+  reboot once to activate it. `doctor` checks the installed package. The
+  deployment command reports an installation failure if the signing support
+  is inactive; it does not fall back to a System application.
 
 The default local files are:
 
@@ -72,6 +78,7 @@ bun ipodtouch4 deploy
 bun ipodtouch4 launch
 bun ipodtouch4 status [--require-action]
 bun ipodtouch4 capture
+bun ipodtouch4 uninstall         # removes the app and its data
 ```
 
 `build` resolves `apps/clear/pocket.json` against the `ipodtouch4-dev`
@@ -81,12 +88,36 @@ embedded as `__pocket_js` / `__pocket_pak` sections. The build id hashes the
 plan, the guest artifacts, every native object, the sysroot stubs, and the
 baked artwork.
 
-`deploy` copies the bundle over the USB SSH tunnel, verifies every file's
-SHA-256 on the device against the local receipt, and installs under a leased
-transactional lock with rollback — the same protocol as the iPhone 4S, with
-device paths under `pocketjs-ipodtouch4`.
-
-`status` reads `/private/var/tmp/pocketjs-ipodtouch4.status` twice and
+**`build` also produces `dist/ipodtouch4/PocketJSiPodTouch4.ipa`.** `deploy`
+transfers that IPA over the pinned USB SSH tunnel and calls iOS 6
+`MobileInstallationInstall` with `ApplicationType=User`. **iOS creates the
+UUID container under `/var/mobile/Applications`, owns updates, and preserves
+`Documents` and `Library` on update.** Every installed bundle file, including
+the build receipt, must match its local SHA-256. A kernel file lock serializes
+installation and CLI removal; process exit releases the lock.
+
+The first deployment migrates the former `/Applications/PocketJSiPodTouch4.app`
+installation. It checks the bundle identifier, retains the old bundle in a
+root-owned migration journal, and refreshes its System registration before
+installing the User app. The migration restarts `installd` to reload its
+in-memory System map; SpringBoard is not restarted. A failed installation restores the old bundle; the
+next deployment reconciles an interrupted migration. The journal is removed
+after User registration and installed byte verification pass. The app's old
+bundle-specific preferences are copied into its new container when present;
+other files in the shared mobile home are not treated as app-owned data.
+
+**Long-pressing the User app on SpringBoard exposes the native delete badge.**
+Deleting there, or running `bun ipodtouch4 uninstall`, uses iOS's uninstall
+service and removes the application container, including its data. A later
+`deploy` installs a fresh container. The CLI verifies that the registration
+and container are gone. The privileged installer bridge stays under
+`/var/root/Library/PocketJS`; its install/uninstall entitlement is never added
+to the application binary.
+
+`launch`, `status`, and `capture` look up the current container from the iOS
+installation record. The runtime resolves `NSTemporaryDirectory()` and keeps
+its receipts and captures inside that container. **`status` reads
+`<container>/tmp/pocketjs.status` twice** and
 requires the running build id, an advancing frame counter and heartbeat, and
 the GLES1 640×960 density-2 drawable. With `--require-action` it additionally
 requires at least one completed touch sequence and a reported `clear_gesture`
@@ -94,3 +125,5 @@ action — a receipt that a gesture interaction completed on the hardware.
 
 `capture` asks the running app for a raw RGBA frame and converts it to
 `dist/ipodtouch4/device-frame.png`.
+
+User application icons use **opaque 57×57 and 114×114 artwork**. SpringBoard applies the rounded mask and shadow; `UIPrerenderedIcon` suppresses the stock gloss. The System application path uses a precomposed transparent mask instead. Baking that mask into a User icon adds an inset rim under the native mask. Icon filenames include the artwork revision so an update selects a fresh SpringBoard cache entry.
diff --git a/hosts/ios-legacy/svcwire.c b/hosts/ios-legacy/svcwire.c
index 33299ccfc..99deae1df 100644
--- a/hosts/ios-legacy/svcwire.c
+++ b/hosts/ios-legacy/svcwire.c
@@ -152,6 +152,11 @@ static int set_nonblocking(int fd) {
   return flags >= 0 && fcntl(fd, F_SETFL, flags | O_NONBLOCK) == 0;
 }
 
+static int disable_sigpipe(int fd) {
+  int enabled = 1;
+  return setsockopt(fd, SOL_SOCKET, SO_NOSIGPIPE, &enabled, sizeof enabled) == 0;
+}
+
 static void enter_state(SvcState next) {
   state = next;
   state_since_ms = now_ms();
@@ -232,7 +237,7 @@ static int poll_listener(int adopt) {
   if (listen_fd < 0) return 0;
   fd = accept(listen_fd, (struct sockaddr *)&peer, &peer_length);
   if (fd < 0) return 0;
-  if (!adopt || !set_nonblocking(fd)) {
+  if (!adopt || !set_nonblocking(fd) || !disable_sigpipe(fd)) {
     close(fd);
     return 0;
   }
@@ -336,7 +341,7 @@ static void start_connect(void) {
     enter_state(SVC_STATE_BACKOFF);
     return;
   }
-  if (!set_nonblocking(fd)) {
+  if (!set_nonblocking(fd) || !disable_sigpipe(fd)) {
     close(fd);
     enter_state(SVC_STATE_BACKOFF);
     return;
@@ -466,7 +471,8 @@ static void handle_frame(uint8_t type, const uint8_t *payload, uint32_t length)
 }
 
 static void pump_rx(void) {
-  for (;;) {
+  /* A continuously readable peer must still yield to the next UI frame. */
+  for (unsigned reads = 0; reads < 4; ++reads) {
     int progressed;
     /* An oversized (or unwanted-bulk) payload is drained without buffering. */
     if (skip_remaining > 0) {
diff --git a/hosts/iphone4s/Icon.svg b/hosts/iphone4s/Icon.svg
index 87a4b8334..cf9115836 100644
--- a/hosts/iphone4s/Icon.svg
+++ b/hosts/iphone4s/Icon.svg
@@ -4,10 +4,16 @@
     <radialGradient id="light" cx=".38" cy="0" r=".9"><stop stop-color="#fff" stop-opacity="0.12"/><stop offset=".8" stop-color="#fff" stop-opacity="0"/></radialGradient>
     <linearGradient id="edge" x2="0" y2="1"><stop stop-color="#9b91a4"/><stop offset=".45" stop-color="#191424"/><stop offset="1" stop-color="#9b91a4"/></linearGradient>
   </defs>
+  <g id="user-app-face" display="none">
+    <rect width="114" height="114" fill="url(#base)"/>
+    <rect width="114" height="114" fill="url(#light)"/>
+  </g>
+  <g id="system-app-frame">
   <rect x=".75" y=".75" width="112.5" height="112.5" rx="22" fill="url(#edge)"/>
   <rect x="2.25" y="2.25" width="109.5" height="109.5" rx="20.5" fill="url(#base)"/>
   <rect x="2.25" y="2.25" width="109.5" height="109.5" rx="20.5" fill="url(#light)"/>
   <rect x="3.25" y="3.25" width="107.5" height="107.5" rx="19.5" fill="none" stroke="#9b91a4" stroke-opacity=".18"/>
+  </g>
   <g transform="translate(14.68 16) scale(2.645)">  <rect x="2" y="6" width="28" height="20" rx="6" fill="none" stroke="#efce77" stroke-width="2.6" stroke-linejoin="round"/>
   <circle cx="10" cy="16" r="3.1" fill="#dc91ad"/>
   <rect x="16" y="12.6" width="10" height="2.2" rx="1.1" fill="#83c6d0"/>
diff --git a/hosts/ipodtouch4/Info.plist b/hosts/ipodtouch4/Info.plist
index d3741d0d7..a145ac46d 100644
--- a/hosts/ipodtouch4/Info.plist
+++ b/hosts/ipodtouch4/Info.plist
@@ -16,10 +16,10 @@
   <key>CFBundleName</key>
   <string>PocketJS iPod touch 4</string>
   <key>CFBundleIconFile</key>
-  <string>PocketClassic-v6.png</string>
+  <string>PocketClassic-User-v7.png</string>
   <key>CFBundleIconFiles</key>
   <array>
-    <string>PocketClassic-v6</string>
+    <string>PocketClassic-User-v7</string>
   </array>
   <key>CFBundlePackageType</key>
   <string>APPL</string>
diff --git a/hosts/ipodtouch4/README.md b/hosts/ipodtouch4/README.md
index 56aa39472..697497245 100644
--- a/hosts/ipodtouch4/README.md
+++ b/hosts/ipodtouch4/README.md
@@ -16,5 +16,10 @@ for the legacy Apple hosts.
 SpringBoard artwork reuses the classic PocketJS icon pipeline
 (`tools/iphone-classic-icon.ts`).
 
-Use `bun ipodtouch4 doctor`, then the build, deploy, launch, status, and
-capture commands documented in `docs/IPODTOUCH4.md`.
+Deployment produces an IPA and uses iOS 6 MobileInstallation to register a
+**sandboxed User application with native SpringBoard deletion**. AppSync
+Unified is required for these local self-signed builds. Updates retain app
+data; uninstall removes the container and its runtime receipt files.
+
+Use `bun ipodtouch4 doctor`, then the build, deploy, launch, status, capture,
+and uninstall commands documented in `docs/IPODTOUCH4.md`.
diff --git a/hosts/ipodtouch4/installer-entitlements.plist b/hosts/ipodtouch4/installer-entitlements.plist
new file mode 100644
index 000000000..b06cb060a
--- /dev/null
+++ b/hosts/ipodtouch4/installer-entitlements.plist
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.private.mobileinstall.allowedSPI</key>
+  <array>
+    <string>Install</string>
+    <string>Uninstall</string>
+    <string>Lookup</string>
+  </array>
+</dict>
+</plist>
diff --git a/hosts/ipodtouch4/installer.c b/hosts/ipodtouch4/installer.c
new file mode 100644
index 000000000..abd54b579
--- /dev/null
+++ b/hosts/ipodtouch4/installer.c
@@ -0,0 +1,145 @@
+/* iOS 6 MobileInstallation bridge. Runs as root over the pinned USB SSH
+ * transport; application binaries remain ordinary, sandboxed User apps.
+ * Like the legacy host, this uses runtime messaging to avoid modern ObjC
+ * metadata in the historical ARMv7 linker. No installation cache is edited. */
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/file.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+typedef void *id;
+typedef void *SEL;
+extern id objc_getClass(const char *name);
+extern SEL sel_registerName(const char *name);
+extern void *objc_msgSend(void);
+
+static id send0(id object, const char *selector) {
+  return ((id (*)(id, SEL))objc_msgSend)(object, sel_registerName(selector));
+}
+static id send1(id object, const char *selector, id value) {
+  return ((id (*)(id, SEL, id))objc_msgSend)(object, sel_registerName(selector), value);
+}
+static id string(const char *value) {
+  return send1(objc_getClass("NSString"), "stringWithUTF8String:", (id)value);
+}
+static const char *utf8(id value) {
+  return value ? (const char *)send0(value, "UTF8String") : "";
+}
+static id get(id object, const char *key) {
+  return send1(object, "objectForKey:", string(key));
+}
+static int identifier_valid(const char *value) {
+  if (!value[0] || value[0] == '.' || strlen(value) > 200) return 0;
+  for (const char *c = value; *c; ++c)
+    if (!((*c >= 'a' && *c <= 'z') || (*c >= 'A' && *c <= 'Z') ||
+          (*c >= '0' && *c <= '9') || *c == '.' || *c == '-')) return 0;
+  return strchr(value, '.') != NULL && strstr(value, "..") == NULL;
+}
+static id lookup(const char *identifier, const char *type) {
+  id cache = send1(objc_getClass("NSDictionary"), "dictionaryWithContentsOfFile:",
+    string("/var/mobile/Library/Caches/com.apple.mobile.installation.plist"));
+  return get(get(cache, type), identifier);
+}
+static id user_record(const char *identifier) {
+  id record = lookup(identifier, "User");
+  const char *path = utf8(get(record, "Path"));
+  const char *container = utf8(get(record, "Container"));
+  const char *prefix = "/private/var/mobile/Applications/";
+  if (strncmp(container, prefix, strlen(prefix)) != 0) prefix = "/var/mobile/Applications/";
+  if (strcmp(utf8(get(record, "ApplicationType")), "User") ||
+      strcmp(utf8(get(record, "CFBundleIdentifier")), identifier) ||
+      strncmp(container, prefix, strlen(prefix)) ||
+      strlen(container) != strlen(prefix) + 36 || strstr(path, "/../") ||
+      strncmp(path, container, strlen(container)) || path[strlen(container)] != '/' ||
+      !path[strlen(container) + 1] || strchr(path + strlen(container) + 1, '/')) return NULL;
+  const char *uuid = container + strlen(prefix);
+  for (unsigned i = 0; i < 36; ++i) {
+    if (i == 8 || i == 13 || i == 18 || i == 23) { if (uuid[i] != '-') return NULL; }
+    else if (!((uuid[i] >= '0' && uuid[i] <= '9') || (uuid[i] >= 'a' && uuid[i] <= 'f') ||
+               (uuid[i] >= 'A' && uuid[i] <= 'F'))) return NULL;
+  }
+  return record;
+}
+static void progress(id info, void *context) {
+  (void)context;
+  if (get(info, "Error")) fprintf(stderr, "%s\n", utf8(send0(info, "description")));
+}
+/* Migration refreshes the global System map, so all apps share one lock. */
+static int acquire_lock(void) {
+  int fd = open("/var/root/Library/PocketJS/deployment.lock", O_CREAT | O_RDWR | O_NOFOLLOW, 0600);
+  if (fd < 0 || flock(fd, LOCK_EX | LOCK_NB)) {
+    perror("deployment busy (or lock unavailable)"); return -1;
+  }
+  return fd;
+}
+int main(int argc, char **argv) {
+  if (argc < 3 || getuid() != 0) {
+    fprintf(stderr, "usage (root): installer lookup|user-path|install|uninstall|bundle-id <value>; lock <id> <script>\n");
+    return 2;
+  }
+  if (!strcmp(argv[1], "lock")) {
+    if (argc != 4 || !identifier_valid(argv[2])) return 2;
+    if (acquire_lock() < 0) return 73;
+    /* No CLOEXEC: the shell keeps the kernel lock through install/readback.
+     * Process exit releases it, including transport loss; no stale lease. */
+    execl("/bin/sh", "sh", argv[3], (char *)NULL);
+    perror("exec deployment"); return 1;
+  }
+  if (!strcmp(argv[1], "uninstall")) {
+    if (!identifier_valid(argv[2])) return 2;
+    if (acquire_lock() < 0) return 73;
+  }
+  id pool = send0(send0(objc_getClass("NSAutoreleasePool"), "alloc"), "init");
+  int result = 1;
+  if (!strcmp(argv[1], "ready")) {
+    void *library = dlopen("/System/Library/PrivateFrameworks/MobileInstallation.framework/MobileInstallation", RTLD_NOW);
+    id (*lookup_apps)(id) = library ? dlsym(library, "MobileInstallationLookup") : NULL;
+    result = !lookup_apps || !lookup_apps(NULL);
+  } else if (!strcmp(argv[1], "bundle-id")) {
+    char path[4096];
+    if (snprintf(path, sizeof(path), "%s/Info.plist", argv[2]) >= (int)sizeof(path)) return 2;
+    id info = send1(objc_getClass("NSDictionary"), "dictionaryWithContentsOfFile:", string(path));
+    const char *identifier = utf8(get(info, "CFBundleIdentifier"));
+    if (*identifier) { puts(identifier); result = 0; }
+  } else if (!strcmp(argv[1], "lookup") && identifier_valid(argv[2])) {
+    id record = lookup(argv[2], "User");
+    if (!record) record = lookup(argv[2], "System");
+    if (!record) { puts("null"); result = 0; }
+    else {
+      id summary = send0(objc_getClass("NSMutableDictionary"), "dictionary");
+      const char *keys[] = {"CFBundleIdentifier", "ApplicationType", "Path", "Container"};
+      for (unsigned i = 0; i < 4; ++i) {
+        id value = get(record, keys[i]);
+        if (value) ((void (*)(id, SEL, id, id))objc_msgSend)(summary, sel_registerName("setObject:forKey:"), value, string(keys[i]));
+      }
+      id data = ((id (*)(id, SEL, id, unsigned long, id))objc_msgSend)(
+        objc_getClass("NSJSONSerialization"), sel_registerName("dataWithJSONObject:options:error:"), summary, 0, NULL);
+      if (data) {
+        unsigned long length = ((unsigned long (*)(id, SEL))objc_msgSend)(data, sel_registerName("length"));
+        fwrite(send0(data, "bytes"), 1, length, stdout); putchar('\n'); result = 0;
+      }
+    }
+  } else if (!strcmp(argv[1], "user-path") && identifier_valid(argv[2])) {
+    id record = user_record(argv[2]);
+    if (record) { puts(utf8(get(record, "Path"))); result = 0; }
+  } else if (!strcmp(argv[1], "install") || !strcmp(argv[1], "uninstall")) {
+    void *library = dlopen("/System/Library/PrivateFrameworks/MobileInstallation.framework/MobileInstallation", RTLD_NOW);
+    if (library) {
+      id options = ((id (*)(id, SEL, id, id))objc_msgSend)(objc_getClass("NSDictionary"),
+        sel_registerName("dictionaryWithObject:forKey:"), string("User"), string("ApplicationType"));
+      if (!strcmp(argv[1], "install")) {
+        int (*install)(id, id, void (*)(id, void *), id) = dlsym(library, "MobileInstallationInstall");
+        if (install) result = install(string(argv[2]), options, progress, string(argv[2])) != 0;
+      } else if (identifier_valid(argv[2]) && user_record(argv[2])) {
+        int (*uninstall)(id, id, void (*)(id, void *)) = dlsym(library, "MobileInstallationUninstall");
+        if (uninstall) result = uninstall(string(argv[2]), options, progress) != 0;
+      }
+    }
+  }
+  if (result) fprintf(stderr, "MobileInstallation %s failed\n", argv[1]);
+  send0(pool, "drain");
+  return result;
+}
diff --git a/hosts/ipodtouch4/runtime.c b/hosts/ipodtouch4/runtime.c
index 80e2a5c24..1e38e301d 100644
--- a/hosts/ipodtouch4/runtime.c
+++ b/hosts/ipodtouch4/runtime.c
@@ -1,32 +1,26 @@
-/*
- * Device-local receipt paths. Pocket Clear's are the defaults; a second app
- * on the same iPod (tools/ipodtouch4.ts selects it by POCKETJS_IPODTOUCH4_APP)
- * gets its own set through -D flags so two installed apps never share a
- * status file.
- */
-#ifndef POCKET_ACCEPTANCE_PATH
-#define POCKET_ACCEPTANCE_PATH "/private/var/tmp/pocketjs-ipodtouch4.status"
-#endif
-#ifndef POCKET_ACCEPTANCE_TEMP
-#define POCKET_ACCEPTANCE_TEMP "/private/var/tmp/pocketjs-ipodtouch4.status.new"
-#endif
-#ifndef POCKET_CAPTURE_REQUEST_PATH
-#define POCKET_CAPTURE_REQUEST_PATH "/private/var/tmp/pocketjs-ipodtouch4.capture"
-#endif
-#ifndef POCKET_CAPTURE_OUTPUT_PATH
-#define POCKET_CAPTURE_OUTPUT_PATH "/private/var/tmp/pocketjs-ipodtouch4.frame.rgba"
-#endif
-#ifndef POCKET_PREFER_GL_PATH
-#define POCKET_PREFER_GL_PATH "/private/var/tmp/pocketjs-ipodtouch4.gles1"
-#endif
+#include <stdio.h>
+
+/* Every User app owns its tmp directory. Resolve it at runtime because iOS
+ * chooses a container UUID at installation and may change it on update. */
+extern void *NSTemporaryDirectory(void);
+extern void *sel_registerName(const char *name);
+extern void *objc_msgSend(void);
+static const char *pocket_ipod_receipt_path(unsigned index, const char *suffix) {
+  static char paths[5][4096];
+  if (!paths[index][0]) {
+    const char *tmp = ((const char *(*)(void *, void *))objc_msgSend)(
+      NSTemporaryDirectory(), sel_registerName("UTF8String"));
+    snprintf(paths[index], sizeof(paths[index]), "%spocketjs.%s", tmp, suffix);
+  }
+  return paths[index];
+}
+#define POCKET_ACCEPTANCE_PATH pocket_ipod_receipt_path(0, "status")
+#define POCKET_ACCEPTANCE_TEMP pocket_ipod_receipt_path(1, "status.new")
+#define POCKET_CAPTURE_REQUEST_PATH pocket_ipod_receipt_path(2, "capture")
+#define POCKET_CAPTURE_OUTPUT_PATH pocket_ipod_receipt_path(3, "frame.rgba")
+#define POCKET_PREFER_GL_PATH pocket_ipod_receipt_path(4, "gles1")
 #define POCKET_GL_DEFAULT 1
 #define POCKET_REQUIRE_GL 1
 
-/*
- * The iPod touch 4 (iPod4,1, iOS 6.1.6) shares the iPhone 4S display tuple —
- * 320x480 logical at density 2 on a PowerVR SGX535 — and runs the same
- * runtime-registered UIKit host. Keeping one implementation keeps touch slot
- * tracking, hit facts, damage accounting, and hardware receipts identical
- * across legacy Apple devices; this wrapper only scopes device-local paths.
- */
+/* The iPod touch 4 shares the iPhone 4S legacy UIKit implementation. */
 #include "../ios-legacy/runtime.c"
diff --git a/tests/iphone4s-profile.test.ts b/tests/iphone4s-profile.test.ts
index aafefb704..f070b9e2e 100644
--- a/tests/iphone4s-profile.test.ts
+++ b/tests/iphone4s-profile.test.ts
@@ -20,6 +20,8 @@ import {
   bakeClassicIPhoneArtwork,
   IPHONE_CLASSIC_ICON_FILE,
   IPHONE_CLASSIC_RETINA_ICON_FILE,
+  IPHONE_USER_ICON_FILE,
+  IPHONE_USER_RETINA_ICON_FILE,
 } from "../tools/iphone-classic-icon.ts";
 import {
   buildReceiptsMatch,
@@ -228,7 +230,7 @@ describe("private iPhone 4S profile", () => {
         }
       }
       expect(twoPixels).not.toEqual(expected);
-      // UIPrerenderedIcon on the physical iOS 6 host retains opaque corners;
+      // System applications on the physical iOS 6 host retain opaque corners;
       // the source must supply the mask, with an opaque face and soft edges.
       const alpha = (x: number, y: number) => twoPixels[(y * two.width + x) * 4 + 3];
       for (const [x, y] of [[0, 0], [113, 0], [0, 113], [113, 113]]) expect(alpha(x, y)).toBe(0);
@@ -243,4 +245,27 @@ describe("private iPhone 4S profile", () => {
       rmSync(output, { recursive: true, force: true });
     }
   });
+
+  test("gives User applications an opaque face for the native SpringBoard mask", async () => {
+    const output = mkdtempSync(join(tmpdir(), "pocket-user-artwork-"));
+    try {
+      await bakeClassicIPhoneArtwork(output, "User");
+      for (const [file, size] of [[IPHONE_USER_ICON_FILE, 57], [IPHONE_USER_RETINA_ICON_FILE, 114]] as const) {
+        const image = await loadImage(join(output, file));
+        expect([image.width, image.height]).toEqual([size, size]);
+        const ctx = createCanvas(size, size).getContext("2d");
+        ctx.drawImage(image, 0, 0);
+        const pixels = ctx.getImageData(0, 0, size, size).data;
+        expect(pixels.every((value, index) => index % 4 !== 3 || value === 255)).toBe(true);
+        // The top face reaches the edge: no transparent inset or bright rim.
+        const pixel = (x: number, y: number) => Array.from(ctx.getImageData(x, y, 1, 1).data);
+        const edge = pixel(Math.floor(size / 2), 0);
+        const inside = pixel(Math.floor(size / 2), 3);
+        expect(edge[0]).toBeGreaterThan(30);
+        for (let channel = 0; channel < 3; channel++) expect(Math.abs(edge[channel] - inside[channel])).toBeLessThan(10);
+      }
+    } finally {
+      rmSync(output, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/tests/ipodtouch4-installation.test.ts b/tests/ipodtouch4-installation.test.ts
new file mode 100644
index 000000000..1b661c182
--- /dev/null
+++ b/tests/ipodtouch4-installation.test.ts
@@ -0,0 +1,129 @@
+import { describe, expect, test } from "bun:test";
+import { createHash } from "node:crypto";
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ipodAppReceiptPaths, parseInstalledIPodApp, shellQuote, userDeploymentScript, type UserDeployment } from "../tools/ipodtouch4-installation.ts";
+
+const bundleId = "dev.pocket-stack.clear";
+const bundleName = "PocketJSiPodTouch4.app";
+const container = "/private/var/mobile/Applications/236A6F72-07C7-4C2F-B00B-DDC8704E9A06";
+const record = { CFBundleIdentifier: bundleId, ApplicationType: "User", Path: `${container}/${bundleName}`, Container: container };
+const hash = (text: string) => createHash("sha256").update(text).digest("hex");
+
+describe("iPod User application installation", () => {
+  test("resolves container-owned receipts and rejects absent, System, or mismatched apps", () => {
+    const app = parseInstalledIPodApp(JSON.stringify(record), bundleId, bundleName);
+    expect(ipodAppReceiptPaths(app).status).toBe(`${container}/tmp/pocketjs.status`);
+    for (const invalid of [null, { ...record, ApplicationType: "System" }, { ...record, CFBundleIdentifier: "another.app" },
+      { ...record, Container: "/var/mobile" }, { ...record, Path: `${container}/../another.app` },
+      { ...record, Path: `${container}/Other.app` }]) {
+      expect(() => parseInstalledIPodApp(JSON.stringify(invalid), bundleId, bundleName)).toThrow();
+    }
+    expect(() => parseInstalledIPodApp(JSON.stringify(record), "app;id", bundleName)).toThrow();
+  });
+
+  test("quotes shell data without evaluating substitutions", () => {
+    const value = "one ' two $(exit 31) `exit 32`\nthree";
+    const result = Bun.spawnSync(["sh", "-c", `printf '%s' ${shellQuote(value)}`]);
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.toString()).toBe(value);
+  });
+
+  test("rejects unsafe bundle names and receipt file names before generating a transaction", () => {
+    const base = { bundleId, bundleName, archive: "/tmp/app.ipa", archiveHash: hash("ipa"), files: { App: hash("app") } };
+    const invalid: UserDeployment[] = [{ ...base, bundleName: "../Other.app" }, { ...base, files: { "../data": hash("data") } },
+      { ...base, files: { ".": hash("data") } }, { ...base, archiveHash: "bad" }];
+    for (const value of invalid) {
+      expect(() => userDeploymentScript(value)).toThrow();
+    }
+  });
+
+  function fixture(run: (f: { root: string; execute: () => ReturnType<typeof Bun.spawnSync> }) => void) {
+    const root = mkdtempSync(join(tmpdir(), "pocket-user-install-"));
+    try {
+      mkdirSync(join(root, "legacy"));
+      writeFileSync(join(root, "legacy/old-code"), "old");
+      writeFileSync(join(root, "app.ipa"), "ipa");
+      writeFileSync(join(root, "installer"), `#!/bin/sh
+case "$1" in
+  bundle-id) echo '${bundleId}' ;;
+  user-path) test -f '${root}/registered' || exit 1; echo '${root}/container/${bundleName}' ;;
+  install)
+    test ! -f '${root}/fail' || exit 25
+    mkdir -p '${root}/container/${bundleName}'
+    printf '%s' new > '${root}/container/${bundleName}/App'
+    touch '${root}/registered'
+    ;;
+  *) exit 2 ;;
+esac
+`, { mode: 0o755 });
+      const script = userDeploymentScript({ bundleId, bundleName, archive: `${root}/app.ipa`, archiveHash: hash("ipa"), files: { App: hash("new") } })
+        .replace("/var/root/Library/PocketJS/ipodtouch4-installer", `${root}/installer`)
+        .replace(`/Applications/${bundleName}`, `${root}/legacy`)
+        .replace(`/var/root/Library/PocketJS/${bundleId}.migration`, `${root}/journal`)
+        .replace(/refresh\(\) \{[^}]+\}/, `refresh() { echo refresh >> '${root}/refreshes'; }`);
+      writeFileSync(join(root, "deploy.sh"), script);
+      run({ root, execute: () => Bun.spawnSync(["sh", join(root, "deploy.sh")]) });
+    } finally { rmSync(root, { recursive: true, force: true }); }
+  }
+
+  test("commits migration only after installed bytes match and preserves existing data on update", () => {
+    fixture(({ root, execute }) => {
+      mkdirSync(join(root, "container/Documents"), { recursive: true });
+      writeFileSync(join(root, "container/Documents/list"), "user data");
+      expect(execute().exitCode).toBe(0);
+      expect(existsSync(join(root, "legacy"))).toBe(false);
+      expect(existsSync(join(root, "journal"))).toBe(false);
+      expect(execute().exitCode).toBe(0);
+      expect(readFileSync(join(root, "container/Documents/list"), "utf8")).toBe("user data");
+      expect(readFileSync(join(root, "refreshes"), "utf8").trim()).toBe("refresh");
+    });
+  });
+
+  test("restores the System app when the native installer fails", () => {
+    fixture(({ root, execute }) => {
+      writeFileSync(join(root, "fail"), "");
+      expect(execute().exitCode).not.toBe(0);
+      expect(readFileSync(join(root, "legacy/old-code"), "utf8")).toBe("old");
+      expect(existsSync(join(root, "registered"))).toBe(false);
+      rmSync(join(root, "fail"));
+      expect(execute().exitCode).toBe(0);
+    });
+  });
+
+  test("recovers a migration interrupted after the legacy bundle moved", () => {
+    fixture(({ root, execute }) => {
+      mkdirSync(join(root, "journal"));
+      renameSync(join(root, "legacy"), join(root, "journal/legacy.app"));
+      writeFileSync(join(root, "fail"), "");
+      expect(execute().exitCode).not.toBe(0);
+      expect(readFileSync(join(root, "legacy/old-code"), "utf8")).toBe("old");
+      rmSync(join(root, "fail"));
+      expect(execute().exitCode).toBe(0);
+    });
+  });
+
+  test("rejects transfer corruption before moving the existing app", () => {
+    fixture(({ root, execute }) => {
+      writeFileSync(join(root, "app.ipa"), "corrupt");
+      expect(execute().exitCode).not.toBe(0);
+      expect(existsSync(join(root, "legacy/old-code"))).toBe(true);
+      expect(existsSync(join(root, "journal"))).toBe(false);
+    });
+  });
+
+  test("keeps a recovery backup if installed byte verification fails, then completes on retry", () => {
+    fixture(({ root, execute }) => {
+      const installer = join(root, "installer");
+      const code = readFileSync(installer, "utf8");
+      writeFileSync(installer, code.replace("printf '%s' new", "printf '%s' broken"));
+      expect(execute().exitCode).not.toBe(0);
+      expect(existsSync(join(root, "journal/legacy.app/old-code"))).toBe(true);
+      expect(existsSync(join(root, "legacy"))).toBe(false);
+      writeFileSync(installer, code);
+      expect(execute().exitCode).toBe(0);
+      expect(existsSync(join(root, "journal"))).toBe(false);
+    });
+  });
+});
diff --git a/tests/ipodtouch4-profile.test.ts b/tests/ipodtouch4-profile.test.ts
index e6ac0be7a..7761a7443 100644
--- a/tests/ipodtouch4-profile.test.ts
+++ b/tests/ipodtouch4-profile.test.ts
@@ -23,11 +23,7 @@ import {
 import { IPHONE4S_TOOLCHAIN } from "../tools/iphone4s-toolchain.ts";
 import {
   buildReceiptsMatch,
-  deploymentAcquireLockCommand,
-  deploymentInstallCommand,
-  deploymentRenewLockCommand,
   IPODTOUCH4_APPS,
-  ipodtouch4DeploymentPaths,
   selectIPodTouch4App,
 } from "../tools/ipodtouch4.ts";
 
@@ -112,7 +108,7 @@ describe("private iPod touch 4 profile", () => {
     }
     expect(() => selectIPodTouch4App("nope")).toThrow("unknown app");
     const wrapper = readFileSync(join(repository, "hosts/ipodtouch4/runtime.c"), "utf8");
-    expect(wrapper).toContain("#ifndef POCKET_ACCEPTANCE_PATH");
+    expect(wrapper).toContain("NSTemporaryDirectory()");
     const runtime = readFileSync(join(repository, "hosts/ios-legacy/runtime.c"), "utf8");
     expect(runtime).toContain("landscape = POCKET_LOGICAL_WIDTH > POCKET_LOGICAL_HEIGHT");
     expect(runtime).toContain('sel_registerName("setTransform:")');
@@ -139,7 +135,7 @@ describe("private iPod touch 4 profile", () => {
     expect(tool).toContain("passwordauthentication no");
     expect(tool).toContain("byte-exact readback");
     expect(tool).toContain('"build-receipt.json": sha256(receiptPath())');
-    expect(tool).toContain("/bin/su mobile -c 'touch ${CAPTURE_REQUEST_PATH}'");
+    expect(tool).toContain("/bin/su mobile -c 'touch ${paths.capture}'");
     expect(tool).toContain('label: "native/runtime.build-id-input.o"');
     expect(tool).toContain('label: "native/pocket_runtime.o"');
     expect(tool).toContain("...quickJsObjects.map");
@@ -166,31 +162,7 @@ describe("private iPod touch 4 profile", () => {
     expect(guest).toContain("(id << 18) | (y << 9) | x");
     expect(guest).toContain("0x80000000U | (id << 20) | (y << 10) | x");
 
-    const first = ipodtouch4DeploymentPaths("a".repeat(24));
-    const second = ipodtouch4DeploymentPaths("b".repeat(24));
-    expect(first.stage).not.toBe(second.stage);
-    expect(first.backup).not.toBe(second.backup);
-    expect(first.lock).toBe(second.lock);
-    const install = deploymentInstallCommand("a".repeat(24), first);
-    expect(install).toContain("trap rollback EXIT HUP INT TERM");
-    expect(install).toContain("prepared > \"$lock/phase\"");
-    expect(install).toContain("previous > \"$lock/origin\"");
-    expect(install).toContain("committed > \"$lock/phase\"");
-    expect(install.lastIndexOf("uicache")).toBeLessThan(install.lastIndexOf("trap - EXIT HUP INT TERM"));
-    expect(install.lastIndexOf("trap - EXIT HUP INT TERM")).toBeLessThan(install.lastIndexOf('rm -rf "$backup"'));
 
-    const acquire = deploymentAcquireLockCommand("a".repeat(24), first, 1_000, 1_600);
-    expect(acquire).toContain('lease=$(cat "$lock/expires"');
-    expect(acquire).toContain('[ "$lease" -gt "$now" ]');
-    expect(acquire).toContain('reclaim=$lock/reclaim');
-    expect(acquire).toContain('case "$owner" in *[!0-9a-f]*)');
-    expect(acquire).toContain('[ "$phase" = committed ]');
-    expect(acquire).toContain('mv "$backup" "$dest"');
-    expect(acquire).toContain('[ "$origin" = empty ]');
-    expect(() => deploymentAcquireLockCommand("a".repeat(24), first, 1_000, 1_000)).toThrow();
-    const renew = deploymentRenewLockCommand("a".repeat(24), first, 2_000);
-    expect(renew).toContain('test "$(cat "$lock/owner")" = "$tx"');
-    expect(renew).toContain('> "$lock/expires"');
   });
 
   test("compares the complete installed receipt rather than only its build ID", () => {
diff --git a/tests/ipodtouch4-svcwire.test.ts b/tests/ipodtouch4-svcwire.test.ts
new file mode 100644
index 000000000..518d0ecd8
--- /dev/null
+++ b/tests/ipodtouch4-svcwire.test.ts
@@ -0,0 +1,43 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+test.skipIf(process.platform !== "darwin")("legacy Apple wire yields during bulk input and survives a disconnected peer", () => {
+  const root = mkdtempSync(join(tmpdir(), "pocket-svcwire-"));
+  try {
+    const source = join(root, "probe.c");
+    writeFileSync(source, `#define POCKET_SVC_WIRE
+#include ${JSON.stringify(resolve(import.meta.dir, "../hosts/ios-legacy/svcwire.c"))}
+#include <assert.h>
+#include <signal.h>
+int main(void) {
+  int pair[2];
+  char bulk[8192] = {0};
+  assert(socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == 0);
+  tcp_fd = pair[0];
+  assert(set_nonblocking(tcp_fd));
+  state = SVC_STATE_UP;
+  skip_remaining = 65536;
+  assert(send(pair[1], bulk, sizeof bulk, 0) == sizeof bulk);
+  pump_rx();
+  assert(skip_remaining == 65536 - 4096);
+  signal(SIGPIPE, SIG_DFL);
+  assert(disable_sigpipe(tcp_fd));
+  close(pair[1]);
+  tx_buffer[0] = 0;
+  tx_length = 1;
+  tx_offset = 0;
+  pump_tx();
+  assert(state == SVC_STATE_BACKOFF);
+  assert(tcp_fd == -1);
+  return 0;
+}
+`);
+    const binary = join(root, "probe");
+    const build = Bun.spawnSync(["xcrun", "clang", "-Wall", "-Wextra", "-Werror", source, "-o", binary]);
+    expect(build.stderr.toString()).toBe("");
+    expect(build.exitCode).toBe(0);
+    expect(Bun.spawnSync([binary]).exitCode).toBe(0);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
diff --git a/tools/iphone-classic-icon.ts b/tools/iphone-classic-icon.ts
index ee02eddfe..ca14cf3c2 100644
--- a/tools/iphone-classic-icon.ts
+++ b/tools/iphone-classic-icon.ts
@@ -11,9 +11,20 @@ export const IPHONE_CLASSIC_ICON_SOURCE = resolve(REPOSITORY, "hosts/iphone2g/Ic
 export const IPHONE_CLASSIC_RETINA_SOURCE = resolve(REPOSITORY, "hosts/iphone4s/Icon.svg");
 export const IPHONE_CLASSIC_ICON_FILE = "PocketClassic-v6.png";
 export const IPHONE_CLASSIC_RETINA_ICON_FILE = "PocketClassic-v6@2x.png";
+export const IPHONE_USER_ICON_FILE = "PocketClassic-User-v7.png";
+export const IPHONE_USER_RETINA_ICON_FILE = "PocketClassic-User-v7@2x.png";
 
-async function rasterizeRetinaArtwork(width: number, height: number): Promise<Canvas> {
-  return rasterizeIconSvg(readFileSync(IPHONE_CLASSIC_RETINA_SOURCE, "utf8"), width, height, false);
+async function rasterizeRetinaArtwork(width: number, height: number, userApp = false): Promise<Canvas> {
+  let svg = readFileSync(IPHONE_CLASSIC_RETINA_SOURCE, "utf8");
+  if (userApp) {
+    // MobileInstallation User icons receive the native mask and shadow. A
+    // pre-masked inset face would expose a second dark rim underneath it.
+    const face = 'id="user-app-face" display="none"';
+    const frame = 'id="system-app-frame"';
+    if (!svg.includes(face) || !svg.includes(frame)) throw new Error("Missing classic icon installation layers");
+    svg = svg.replace(face, 'id="user-app-face"').replace(frame, `${frame} display="none"`);
+  }
+  return rasterizeIconSvg(svg, width, height, userApp);
 }
 
 function assertOpaque(canvas: Canvas): void {
@@ -25,12 +36,13 @@ function assertOpaque(canvas: Canvas): void {
   }
 }
 
-export async function bakeClassicIPhoneArtwork(outputDirectory: string): Promise<string[]> {
+export async function bakeClassicIPhoneArtwork(outputDirectory: string, applicationType: "System" | "User" = "System"): Promise<string[]> {
   mkdirSync(outputDirectory, { recursive: true });
-  const icon = resolve(outputDirectory, IPHONE_CLASSIC_ICON_FILE);
-  const retinaIcon = resolve(outputDirectory, IPHONE_CLASSIC_RETINA_ICON_FILE);
-  writeFileSync(icon, (await rasterizeRetinaArtwork(57, 57)).toBuffer("image/png"));
-  writeFileSync(retinaIcon, (await rasterizeRetinaArtwork(114, 114)).toBuffer("image/png"));
+  const userApp = applicationType === "User";
+  const icon = resolve(outputDirectory, userApp ? IPHONE_USER_ICON_FILE : IPHONE_CLASSIC_ICON_FILE);
+  const retinaIcon = resolve(outputDirectory, userApp ? IPHONE_USER_RETINA_ICON_FILE : IPHONE_CLASSIC_RETINA_ICON_FILE);
+  writeFileSync(icon, (await rasterizeRetinaArtwork(57, 57, userApp)).toBuffer("image/png"));
+  writeFileSync(retinaIcon, (await rasterizeRetinaArtwork(114, 114, userApp)).toBuffer("image/png"));
 
   const launchIcon = await rasterizeRetinaArtwork(228, 228);
   const written = [icon, retinaIcon];
diff --git a/tools/ipodtouch4-installation.ts b/tools/ipodtouch4-installation.ts
new file mode 100644
index 000000000..f17d725ab
--- /dev/null
+++ b/tools/ipodtouch4-installation.ts
@@ -0,0 +1,124 @@
+/** iOS owns the User container and its install/update/uninstall transaction.
+ * This layer only migrates the former /Applications bundle and checks bytes. */
+export const IPOD_INSTALLER = "/var/root/Library/PocketJS/ipodtouch4-installer";
+export interface InstalledIPodApp {
+  readonly CFBundleIdentifier: string;
+  readonly ApplicationType: "User";
+  readonly Path: string;
+  readonly Container: string;
+}
+export function shellQuote(value: string): string {
+  return "'" + value.replaceAll("'", "'\\''") + "'";
+}
+export function validateIPodIdentity(bundleId: string, bundleName: string): void {
+  if (!/^[A-Za-z0-9][A-Za-z0-9.-]{0,199}$/.test(bundleId) || !bundleId.includes(".") || bundleId.includes("..") ||
+      !/^[A-Za-z0-9][A-Za-z0-9_-]*\.app$/.test(bundleName)) {
+    throw new Error("pocket ipodtouch4: invalid application identity");
+  }
+}
+export function parseInstalledIPodApp(raw: string, bundleId: string, bundleName: string): InstalledIPodApp {
+  validateIPodIdentity(bundleId, bundleName);
+  const value = JSON.parse(raw);
+  if (!value) throw new Error(`pocket ipodtouch4: ${bundleId} is not installed; run deploy`);
+  if (value.ApplicationType !== "User") {
+    throw new Error(`pocket ipodtouch4: ${bundleId} is a legacy System app; run deploy to migrate it`);
+  }
+  if (value.CFBundleIdentifier !== bundleId || typeof value.Container !== "string" ||
+      !/^(?:\/private)?\/var\/mobile\/Applications\/[0-9A-Fa-f]{8}(?:-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}$/.test(value.Container) ||
+      value.Path !== `${value.Container}/${bundleName}`) {
+    throw new Error("pocket ipodtouch4: invalid User application container");
+  }
+  return value;
+}
+export function ipodAppReceiptPaths(app: InstalledIPodApp) {
+  const prefix = `${app.Container}/tmp/pocketjs`;
+  return { status: `${prefix}.status`, frame: `${prefix}.frame.rgba`, capture: `${prefix}.capture` };
+}
+export interface UserDeployment {
+  readonly bundleId: string;
+  readonly bundleName: string;
+  readonly executable?: string;
+  readonly archive: string;
+  readonly archiveHash: string;
+  readonly files: Readonly<Record<string, string>>;
+}
+export function userDeploymentScript(deployment: UserDeployment): string {
+  const { bundleId, bundleName, archive, archiveHash, files } = deployment;
+  validateIPodIdentity(bundleId, bundleName);
+  const executable = deployment.executable ?? bundleName.slice(0, -4);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(executable)) throw new Error("pocket ipodtouch4: invalid executable");
+  if (!/^[0-9a-f]{64}$/.test(archiveHash) || !Object.keys(files).length ||
+      Object.entries(files).some(([name, hash]) => !/^[A-Za-z0-9@._-]+$/.test(name) || name === "." || name === ".." || !/^[0-9a-f]{64}$/.test(hash))) {
+    throw new Error("pocket ipodtouch4: invalid deployment hashes");
+  }
+  return `set -eu
+installer=${shellQuote(IPOD_INSTALLER)}
+id=${shellQuote(bundleId)}
+archive=${shellQuote(archive)}
+legacy=${shellQuote(`/Applications/${bundleName}`)}
+journal=${shellQuote(`/var/root/Library/PocketJS/${bundleId}.migration`)}
+# iOS 6 installd retains the System map in memory after uicache writes it.
+# Restart that service to reload the map before User installation (no respring).
+refresh() {
+  /bin/su mobile -c /usr/bin/uicache
+  killall -KILL installd 2>/dev/null || true
+  # The old IPC endpoint can still exist while SIGKILL is being delivered.
+  sleep 1
+  attempt=0
+  until "$installer" ready service; do
+    attempt=$((attempt + 1))
+    if [ "$attempt" -ge 10 ]; then echo 'installation service did not become ready' >&2; return 1; fi
+    sleep 1
+  done
+}
+# Reconcile an interrupted migration before starting another installation.
+restore_legacy() {
+  if [ -d "$journal/legacy.app" ] && ! "$installer" user-path "$id" >/dev/null 2>&1; then
+    if [ -e "$legacy" ]; then echo 'migration recovery found two legacy bundles' >&2; return 1; fi
+    mv "$journal/legacy.app" "$legacy"
+    refresh
+  fi
+}
+restore_legacy
+rollback() {
+  result=$?
+  trap - EXIT HUP INT TERM
+  set +e
+  restore_legacy
+  exit "$result"
+}
+trap rollback EXIT
+trap 'exit 1' HUP INT TERM
+# Reject corrupt transfers before moving the existing app.
+test "$(/usr/bin/openssl dgst -sha256 "$archive")" = ${shellQuote(`SHA256(${archive})= ${archiveHash}`)}
+if [ -e "$legacy" ]; then
+  test "$("$installer" bundle-id "$legacy")" = "$id"
+  test ! -e "$journal/legacy.app"
+  killall ${shellQuote(executable)} 2>/dev/null || true
+  mkdir -p "$journal"
+  preference=/var/mobile/Library/Preferences/$id.plist
+  if [ -f "$preference" ]; then cp -p "$preference" "$journal/preferences.plist"; fi
+  mv "$legacy" "$journal/legacy.app"
+  refresh
+fi
+# MobileInstallation updates in place, preserving Documents and Library.
+"$installer" install "$archive"
+dest=$("$installer" user-path "$id")
+test "\${dest##*/}" = ${shellQuote(bundleName)}
+cd "$dest"
+${Object.entries(files).map(([name, hash]) => `test "$(/usr/bin/openssl dgst -sha256 ${shellQuote(name)})" = ${shellQuote(`SHA256(${name})= ${hash}`)}`).join("\n")}
+container=\${dest%/*}
+if [ -f "$journal/preferences.plist" ]; then
+  mkdir -p "$container/Library/Preferences"
+  chown mobile:mobile "$container/Library/Preferences"
+  if [ ! -e "$container/Library/Preferences/$id.plist" ]; then
+    cp -p "$journal/preferences.plist" "$container/Library/Preferences/$id.plist"
+    chown mobile:mobile "$container/Library/Preferences/$id.plist"
+  fi
+fi
+# Keep the migration backup until registration and every installed byte pass.
+rm -rf "$journal"
+trap - EXIT HUP INT TERM
+printf 'User application installed: %s\\n' "$dest"
+`;
+}
diff --git a/tools/ipodtouch4.ts b/tools/ipodtouch4.ts
index ad2369282..747ac2950 100644
--- a/tools/ipodtouch4.ts
+++ b/tools/ipodtouch4.ts
@@ -15,8 +15,8 @@ import { fileURLToPath } from "node:url";
 import { extractHostBuildInputs } from "../framework/src/manifest/host-build-inputs.ts";
 import {
   bakeClassicIPhoneArtwork,
-  IPHONE_CLASSIC_ICON_FILE,
-  IPHONE_CLASSIC_RETINA_ICON_FILE,
+  IPHONE_USER_ICON_FILE,
+  IPHONE_USER_RETINA_ICON_FILE,
 } from "./iphone-classic-icon.ts";
 import {
   IPODTOUCH4_DEPLOYMENT,
@@ -35,6 +35,10 @@ import {
   resolveIPodTouch4BuildPlan,
 } from "./ipodtouch4-profile.ts";
 
+import {
+  IPOD_INSTALLER, ipodAppReceiptPaths, parseInstalledIPodApp, shellQuote, userDeploymentScript,
+} from "./ipodtouch4-installation.ts";
+
 const REPOSITORY = fileURLToPath(new URL("..", import.meta.url));
 const DEVICE_TYPE = IPODTOUCH4_DEVICE.productType;
 const DEVICE_HARDWARE = IPODTOUCH4_DEVICE.hardwareModel;
@@ -49,7 +53,6 @@ const KEY_PATH =
 const KNOWN_HOSTS_PATH =
   process.env.POCKETJS_IPODTOUCH4_KNOWN_HOSTS ?? join(ipodtouch4CacheRoot(), "ssh/known_hosts");
 const DEPLOYMENT_TARGET = IPODTOUCH4_TOOLCHAIN.compiler.minimumVersion;
-const DEPLOYMENT_LEASE_SECONDS = 10 * 60;
 /** The app-side acceptance receipt: the Clear guest reports completed gesture
  *  interactions (complete / delete / create / reorder) under this name. */
 const ACTION_NAME = "clear_gesture";
@@ -57,8 +60,7 @@ const ACTION_NAME = "clear_gesture";
 /**
  * One installable app on the iPod. Two apps coexist on the device only if
  * every device-side name differs: the bundle, its executable, the URL scheme
- * SpringBoard launches it by, and the /private/var/tmp receipt files the
- * host writes (hosts/ipodtouch4/runtime.c takes those as -D overrides).
+ * SpringBoard launches it by, and the URL scheme. Runtime receipts live inside the app's own container.
  */
 export interface IPodTouch4App {
   readonly id: string;
@@ -78,7 +80,7 @@ export interface IPodTouch4App {
   readonly title: string;
   /** SpringBoard URL scheme; `<scheme>://launch` opens the app. */
   readonly scheme: string;
-  /** `/private/var/tmp/<slug>.status` and friends on the device. */
+  /** Artifact/receipt label retained for external app descriptors. */
   readonly receiptSlug: string;
   /** The `__reportAppAction` name `status --require-action` waits for. */
   readonly actionName: string;
@@ -186,10 +188,6 @@ const VIA_TUNNEL_PORT = 22224;
 const BUNDLE_NAME = APP.bundleName;
 const BUNDLE_ID = APP.bundleId;
 const EXECUTABLE = APP.executable;
-const INSTALL_PATH = `/Applications/${BUNDLE_NAME}`;
-const STATUS_PATH = `/private/var/tmp/${APP.receiptSlug}.status`;
-const FRAME_PATH = `/private/var/tmp/${APP.receiptSlug}.frame.rgba`;
-const CAPTURE_REQUEST_PATH = `/private/var/tmp/${APP.receiptSlug}.capture`;
 
 interface CommandResult {
   readonly exitCode: number;
@@ -377,20 +375,6 @@ function renderInfoPlist(): string {
     .replaceAll(`<string>${clear.scheme}</string>`, `<string>${APP.scheme}</string>`);
 }
 
-/** Device receipt paths for the wrapper (hosts/ipodtouch4/runtime.c defaults
- *  are Clear's; any other app overrides all five). */
-function receiptPathDefines(): string[] {
-  if (APP.id === "clear") return [];
-  const slug = `/private/var/tmp/${APP.receiptSlug}`;
-  return [
-    `-DPOCKET_ACCEPTANCE_PATH=\"${slug}.status\"`,
-    `-DPOCKET_ACCEPTANCE_TEMP=\"${slug}.status.new\"`,
-    `-DPOCKET_CAPTURE_REQUEST_PATH=\"${slug}.capture\"`,
-    `-DPOCKET_CAPTURE_OUTPUT_PATH=\"${slug}.frame.rgba\"`,
-    `-DPOCKET_PREFER_GL_PATH=\"${slug}.gles1\"`,
-  ];
-}
-
 function bundleDirectory(): string {
   return join(REPOSITORY, `dist/ipodtouch4/${BUNDLE_NAME}`);
 }
@@ -406,10 +390,6 @@ function readReceipt(): BuildReceipt {
   return JSON.parse(readFileSync(receiptPath(), "utf8")) as BuildReceipt;
 }
 
-function shellQuote(word: string): string {
-  return /^[A-Za-z0-9_./:=+-]+$/.test(word) ? word : `'${word.replace(/'/g, "'\\''")}'`;
-}
-
 /** Run a libimobiledevice command where the device is: here, or on VIA. */
 function usbRun(command: string, args: readonly string[]): string {
   if (!VIA) return mustRun(command, args);
@@ -565,7 +545,7 @@ async function withTunnel<T>(
 async function doctor(): Promise<void> {
   let ok = true;
   const usbTools = ["idevice_id", "ideviceinfo", "iproxy"];
-  const required = ["bun", "rustup", "xcrun", "ldid", ...(VIA ? [] : usbTools), "ssh", "scp", "tar", "unzip", "hdiutil"];
+  const required = ["bun", "rustup", "xcrun", "ldid", ...(VIA ? [] : usbTools), "ssh", "scp", "zip", "unzip", "hdiutil"];
   for (const name of required) {
     const path = commandPath(name);
     ok = check(name, path !== undefined, path ?? "not found") && ok;
@@ -599,11 +579,16 @@ async function doctor(): Promise<void> {
     );
     const remoteInfo = mustRemote(
       port,
-      "set -eu; test \"$(uname -m)\" = iPod4,1; test -x /usr/bin/ldid; test -x /usr/bin/uicache; test -x /usr/bin/uiopen; test -w /Applications; " +
+      "set -eu; test \"$(uname -m)\" = iPod4,1; test -x /usr/bin/ldid; test -x /usr/bin/uicache; test -x /usr/bin/uiopen; test -w /var/mobile/Applications; " +
         "/usr/sbin/sshd -T | grep -q '^pubkeyauthentication yes$'; " +
         "/usr/sbin/sshd -T | grep -q '^passwordauthentication no$'; echo jailbreak-key-only-usb-ready",
     );
     console.log(`[ok] jailbreak transport: ${remoteInfo}`);
+    const appSync = remote(port, "dpkg-query -W -f='${Status}' ai.akemi.appsyncunified");
+    ok = check("self-signed User app installation (AppSync Unified)",
+      appSync.exitCode === 0 && appSync.stdout.trim() === "install ok installed",
+      "install AppSync Unified from its upstream release, then reboot once") && ok;
+    if (!ok) process.exitCode = 1;
   });
 }
 
@@ -703,14 +688,13 @@ async function build(): Promise<void> {
   mkdirSync(bundle, { recursive: true });
   writeFileSync(join(bundle, "Info.plist"), renderInfoPlist());
   cpSync(join(REPOSITORY, "hosts/ipodtouch4/PkgInfo"), join(bundle, "PkgInfo"));
-  await bakeClassicIPhoneArtwork(bundle);
+  await bakeClassicIPhoneArtwork(bundle, "User");
 
   const firstParty = [
     ...warnings,
     `-DPOCKET_LOGICAL_WIDTH=${inputs.viewport.logical[0]}`,
     `-DPOCKET_LOGICAL_HEIGHT=${inputs.viewport.logical[1]}`,
     `-DPOCKET_RASTER_DENSITY=${inputs.viewport.rasterDensity}`,
-    ...receiptPathDefines(),
     ...(APP.keepAwake ? ["-DPOCKET_KEEP_AWAKE"] : []),
     // The wrapper reports the transport's state in the acceptance record,
     // so it needs the same switch as the guest runtime.
@@ -775,8 +759,8 @@ async function build(): Promise<void> {
     { label: "native/compat.o", path: compatObject },
     ...quickJsObjects.map((path) => ({ label: `native/${path.slice(nativeBuild.length + 1)}`, path })),
     { label: "native/libpocketjs_symbian_core.a", path: rustLibrary },
-    { label: `bundle/${IPHONE_CLASSIC_ICON_FILE}`, path: join(bundle, IPHONE_CLASSIC_ICON_FILE) },
-    { label: `bundle/${IPHONE_CLASSIC_RETINA_ICON_FILE}`, path: join(bundle, IPHONE_CLASSIC_RETINA_ICON_FILE) },
+    { label: `bundle/${IPHONE_USER_ICON_FILE}`, path: join(bundle, IPHONE_USER_ICON_FILE) },
+    { label: `bundle/${IPHONE_USER_RETINA_ICON_FILE}`, path: join(bundle, IPHONE_USER_RETINA_ICON_FILE) },
     { label: "bundle/Default@2x.png", path: join(bundle, "Default@2x.png") },
     { label: "bundle/Default-568h@2x.png", path: join(bundle, "Default-568h@2x.png") },
   ]);
@@ -819,8 +803,8 @@ async function build(): Promise<void> {
     EXECUTABLE,
     "Info.plist",
     "PkgInfo",
-    IPHONE_CLASSIC_ICON_FILE,
-    IPHONE_CLASSIC_RETINA_ICON_FILE,
+    IPHONE_USER_ICON_FILE,
+    IPHONE_USER_RETINA_ICON_FILE,
     "Default@2x.png",
     "Default-568h@2x.png",
   ];
@@ -841,276 +825,114 @@ async function build(): Promise<void> {
   };
   writeFileSync(receiptPath(), JSON.stringify(receipt, null, 2) + "\n");
 
+  // The USB-side bridge uses the same pinned ARMv7 toolchain, outside the app.
+  const installerObject = join(nativeBuild, "installer.o");
+  compile(join(REPOSITORY, "hosts/ipodtouch4/installer.c"), installerObject,
+    [...warnings, "-Wno-cast-function-type-mismatch"]);
+  const installer = join(REPOSITORY, "dist/ipodtouch4/installer");
+  mustRun(linker, ["-arch", "armv7", "-syslibroot", sysroot, "-L/usr/lib",
+    "-F/System/Library/Frameworks", "-iphoneos_version_min", DEPLOYMENT_TARGET,
+    "-no_pie", "-no_uuid", "-no_function_starts", "-no_data_in_code_info",
+    "-no_source_version", "-no_compact_unwind", "-no_adhoc_codesign", "-no_encryption",
+    "-e", "start", "-o", installer, join(nativeBuild, "csu-start.o"),
+    join(nativeBuild, "csu-dyld-glue.o"), crtGlobalsObject, installerObject,
+    "-framework", "Foundation", "-lobjc", "-lSystem", "-lgcc_s.1"]);
+  chmodSync(installer, 0o755);
+  mustRun("ldid", [`-S${join(REPOSITORY, "hosts/ipodtouch4/installer-entitlements.plist")}`, installer]);
+
+  const packageRoot = join(nativeBuild, "package");
+  const payload = join(packageRoot, "Payload", BUNDLE_NAME);
+  mkdirSync(dirname(payload), { recursive: true });
+  cpSync(bundle, payload, { recursive: true });
+  rmSync(ipaPath(), { force: true });
+  mustRun("zip", ["-q", "-r", ipaPath(), "Payload"], { cwd: packageRoot });
+
   console.log(`built ${bundle}`);
   console.log(fileInfo);
   console.log(`build_id=${buildId}`);
 }
 
-interface DeploymentPaths {
-  readonly archive: string;
-  readonly unpack: string;
-  readonly stage: string;
-  readonly backup: string;
-  readonly lock: string;
-}
-
-export function ipodtouch4DeploymentPaths(transactionId: string): DeploymentPaths {
-  if (!/^[0-9a-f]{24}$/.test(transactionId)) {
-    throw new Error("pocket ipodtouch4: deployment transaction id must be 24 lowercase hex digits");
-  }
-  return {
-    archive: `/private/var/tmp/${APP.receiptSlug}-${transactionId}.app.tar`,
-    unpack: `/Applications/.${BUNDLE_NAME}.pocketjs-unpack-${transactionId}`,
-    stage: `/Applications/.${BUNDLE_NAME}.pocketjs-stage-${transactionId}`,
-    backup: `/Applications/.${BUNDLE_NAME}.pocketjs-backup-${transactionId}`,
-    lock: `/private/var/tmp/${APP.receiptSlug}.deploy.lock`,
-  };
-}
-
-function assertDeploymentLease(nowEpochSeconds: number, expiresEpochSeconds: number): void {
-  if (
-    !Number.isSafeInteger(nowEpochSeconds) ||
-    !Number.isSafeInteger(expiresEpochSeconds) ||
-    nowEpochSeconds < 0 ||
-    expiresEpochSeconds <= nowEpochSeconds
-  ) {
-    throw new Error("pocket ipodtouch4: deployment lease must be a future integer epoch");
-  }
-}
-
-export function deploymentAcquireLockCommand(
-  transactionId: string,
-  paths: DeploymentPaths,
-  nowEpochSeconds: number,
-  expiresEpochSeconds: number,
-): string {
-  if (!/^[0-9a-f]{24}$/.test(transactionId)) {
-    throw new Error("pocket ipodtouch4: deployment transaction id must be 24 lowercase hex digits");
-  }
-  assertDeploymentLease(nowEpochSeconds, expiresEpochSeconds);
-  return (
-    "set -eu; " +
-    `lock=${paths.lock}; tx=${transactionId}; now=${nowEpochSeconds}; expires=${expiresEpochSeconds}; ` +
-    `dest=${INSTALL_PATH}; ` +
-    "if ! mkdir \"$lock\" 2>/dev/null; then " +
-    "owner=$(cat \"$lock/owner\" 2>/dev/null || true); " +
-    "lease=$(cat \"$lock/expires\" 2>/dev/null || true); " +
-    "case \"$lease\" in ''|*[!0-9]*) sleep 1; owner=$(cat \"$lock/owner\" 2>/dev/null || true); " +
-    "lease=$(cat \"$lock/expires\" 2>/dev/null || true) ;; esac; active=0; " +
-    "case \"$lease\" in ''|*[!0-9]*) ;; *) [ \"$lease\" -gt \"$now\" ] && active=1 || true ;; esac; " +
-    "if [ \"$active\" -eq 1 ]; then echo \"deployment busy (owner ${owner:-unknown}, lease $lease)\" >&2; exit 73; fi; " +
-    "reclaim=$lock/reclaim; " +
-    "if ! mkdir \"$reclaim\" 2>/dev/null; then " +
-    "reclaim_lease=$(cat \"$reclaim/expires\" 2>/dev/null || true); " +
-    "case \"$reclaim_lease\" in ''|*[!0-9]*) sleep 1; " +
-    "reclaim_lease=$(cat \"$reclaim/expires\" 2>/dev/null || true) ;; esac; reclaim_active=0; " +
-    "case \"$reclaim_lease\" in ''|*[!0-9]*) ;; *) [ \"$reclaim_lease\" -gt \"$now\" ] && reclaim_active=1 || true ;; esac; " +
-    "if [ \"$reclaim_active\" -eq 1 ]; then echo \"deployment recovery busy\" >&2; exit 73; fi; " +
-    "expired_reclaim=$lock/reclaim-expired-$tx; " +
-    "if ! mv \"$reclaim\" \"$expired_reclaim\" 2>/dev/null; then echo \"deployment recovery busy\" >&2; exit 73; fi; " +
-    "if ! mkdir \"$reclaim\" 2>/dev/null; then rm -rf \"$expired_reclaim\"; echo \"deployment recovery busy\" >&2; exit 73; fi; " +
-    "rm -rf \"$expired_reclaim\"; fi; " +
-    "printf '%s\\n' \"$tx\" > \"$reclaim/owner\"; printf '%s\\n' \"$expires\" > \"$reclaim/expires\"; " +
-    "trap 'status=$?; set +e; test -f \"$reclaim/owner\" && test \"$(cat \"$reclaim/owner\")\" = \"$tx\" && rm -rf \"$reclaim\"; exit \"$status\"' EXIT HUP INT TERM; " +
-    "lease=$(cat \"$lock/expires\" 2>/dev/null || true); active=0; " +
-    "case \"$lease\" in ''|*[!0-9]*) ;; *) [ \"$lease\" -gt \"$now\" ] && active=1 || true ;; esac; " +
-    "if [ \"$active\" -eq 1 ]; then echo \"deployment busy (lease $lease)\" >&2; exit 73; fi; " +
-    "valid_owner=0; case \"$owner\" in " +
-    "????????????????????????) case \"$owner\" in *[!0-9a-f]*) ;; *) valid_owner=1 ;; esac ;; esac; " +
-    "if [ \"$valid_owner\" -eq 1 ]; then " +
-    `backup=/Applications/.${BUNDLE_NAME}.pocketjs-backup-\${owner}; ` +
-    `stage=/Applications/.${BUNDLE_NAME}.pocketjs-stage-\${owner}; ` +
-    `unpack=/Applications/.${BUNDLE_NAME}.pocketjs-unpack-\${owner}; ` +
-    `archive=/private/var/tmp/${APP.receiptSlug}-\${owner}.app.tar; ` +
-    "phase=$(cat \"$lock/phase\" 2>/dev/null || true); origin=$(cat \"$lock/origin\" 2>/dev/null || true); " +
-    "if [ \"$phase\" = committed ]; then rm -rf \"$backup\"; " +
-    "elif [ -e \"$backup\" ]; then rm -rf \"$dest\"; mv \"$backup\" \"$dest\"; " +
-    `chown -R root:wheel "$dest"; chmod 755 "$dest/${EXECUTABLE}"; ` +
-    "elif [ \"$origin\" = empty ]; then rm -rf \"$dest\"; fi; " +
-    "rm -rf \"$stage\" \"$unpack\" \"$archive\"; fi; " +
-    "rm -f \"$lock/phase\" \"$lock/origin\"; " +
-    "printf '%s\\n' \"$tx\" > \"$lock/owner\"; printf '%s\\n' \"$expires\" > \"$lock/expires\"; " +
-    "rm -rf \"$reclaim\"; trap - EXIT HUP INT TERM; " +
-    "else printf '%s\\n' \"$tx\" > \"$lock/owner\"; printf '%s\\n' \"$expires\" > \"$lock/expires\"; fi"
-  );
-}
-
-export function deploymentRenewLockCommand(
-  transactionId: string,
-  paths: DeploymentPaths,
-  expiresEpochSeconds: number,
-): string {
-  if (!/^[0-9a-f]{24}$/.test(transactionId) || !Number.isSafeInteger(expiresEpochSeconds)) {
-    throw new Error("pocket ipodtouch4: invalid deployment lease renewal");
-  }
-  return (
-    "set -eu; " +
-    `lock=${paths.lock}; tx=${transactionId}; expires=${expiresEpochSeconds}; ` +
-    "test -f \"$lock/owner\"; test \"$(cat \"$lock/owner\")\" = \"$tx\"; " +
-    "printf '%s\\n' \"$expires\" > \"$lock/expires\""
-  );
+function ipaPath(): string {
+  return join(REPOSITORY, `dist/ipodtouch4/${BUNDLE_NAME.replace(/\.app$/, ".ipa")}`);
 }
 
-export function deploymentInstallCommand(transactionId: string, paths: DeploymentPaths): string {
-  return (
-    "set -eu; " +
-    `dest=${INSTALL_PATH}; stage=${paths.stage}; backup=${paths.backup}; lock=${paths.lock}; ` +
-    "had_previous=0; installed_new=0; " +
-    "rollback() { status=$?; trap - EXIT HUP INT TERM; set +e; " +
-    "if [ \"$installed_new\" -eq 1 ]; then rm -rf \"$dest\"; fi; " +
-    "if [ \"$had_previous\" -eq 1 ] && [ -e \"$backup\" ]; then " +
-    "mv \"$backup\" \"$dest\"; " +
-    `chown -R root:wheel "$dest"; chmod 755 "$dest/${EXECUTABLE}"; ` +
-    "/bin/su mobile -c /usr/bin/uicache; fi; exit \"$status\"; }; " +
-    "trap rollback EXIT HUP INT TERM; " +
-    "printf '%s\\n' prepared > \"$lock/phase\"; " +
-    "if [ -e \"$dest\" ]; then printf '%s\\n' previous > \"$lock/origin\"; " +
-    "mv \"$dest\" \"$backup\"; had_previous=1; " +
-    "else printf '%s\\n' empty > \"$lock/origin\"; fi; " +
-    "mv \"$stage\" \"$dest\"; installed_new=1; printf '%s\\n' installed > \"$lock/phase\"; " +
-    "chown -R root:wheel \"$dest\"; " +
-    `chmod 755 "$dest/${EXECUTABLE}"; test -x "$dest/${EXECUTABLE}"; ` +
-    `/usr/bin/ldid -e "$dest/${EXECUTABLE}" >/dev/null; ` +
-    "/bin/su mobile -c /usr/bin/uicache; printf '%s\\n' committed > \"$lock/phase\"; " +
-    "trap - EXIT HUP INT TERM; " +
-    "rm -rf \"$backup\"; " +
-    `echo installed-${transactionId}`
-  );
+function copyToDevice(port: number, source: string, destination: string): void {
+  mustRun("scp", [...viaArgs(), "-O", "-i", KEY_PATH, "-P", String(port), "-o", "BatchMode=yes",
+    "-o", `HostKeyAlias=[127.0.0.1]:${LOCAL_PORT}`, "-o", "StrictHostKeyChecking=yes",
+    "-o", `UserKnownHostsFile=${KNOWN_HOSTS_PATH}`, "-o", "HostKeyAlgorithms=+ssh-rsa",
+    "-o", "PubkeyAcceptedAlgorithms=+ssh-rsa", source, `root@127.0.0.1:${destination}`]);
 }
 
 async function deploy(): Promise<void> {
   await build();
   const receipt = readReceipt();
   const transactionId = randomBytes(12).toString("hex");
-  const paths = ipodtouch4DeploymentPaths(transactionId);
-  const archive = join(REPOSITORY, `.pocket-build/ipodtouch4/${BUNDLE_NAME}-${transactionId}.tar`);
-  mkdirSync(dirname(archive), { recursive: true });
-  mustRun(
-    "tar",
-    ["-cf", archive, "-C", dirname(bundleDirectory()), BUNDLE_NAME],
-    { env: { ...process.env, COPYFILE_DISABLE: "1" } },
-  );
-
+  const remoteRoot = `/private/var/tmp/pocketjs-user-${transactionId}`;
+  const archive = `${remoteRoot}/app.ipa`;
+  const script = join(REPOSITORY, `.pocket-build/ipodtouch4/deploy-${transactionId}.sh`);
+  writeFileSync(script, userDeploymentScript({
+    bundleId: BUNDLE_ID, bundleName: BUNDLE_NAME, executable: EXECUTABLE, archive, archiveHash: sha256(ipaPath()),
+    files: { ...receipt.files, "build-receipt.json": sha256(receiptPath()) },
+  }));
   try {
-    await withTunnel(async (port) => {
-      mustRun("scp", [
-        ...viaArgs(),
-        "-O",
-        "-i",
-        KEY_PATH,
-        "-P",
-        String(port),
-        "-o",
-        "BatchMode=yes",
-        "-o",
-        `HostKeyAlias=[127.0.0.1]:${LOCAL_PORT}`,
-        "-o",
-        "StrictHostKeyChecking=yes",
-        "-o",
-        `UserKnownHostsFile=${KNOWN_HOSTS_PATH}`,
-        "-o",
-        "HostKeyAlgorithms=+ssh-rsa",
-        "-o",
-        "PubkeyAcceptedAlgorithms=+ssh-rsa",
-        archive,
-        `root@127.0.0.1:${paths.archive}`,
-      ]);
-
-      let lockHeld = false;
-      let operationError: unknown;
+    await withTunnel((port) => {
+      mustRemote(port, `set -eu; mkdir -p /var/root/Library/PocketJS; chmod 700 /var/root/Library/PocketJS; mkdir -m 755 ${remoteRoot}`);
       try {
-        const acquireTime = Math.floor(Date.now() / 1000);
-        mustRemote(port, deploymentAcquireLockCommand(
-          transactionId,
-          paths,
-          acquireTime,
-          acquireTime + DEPLOYMENT_LEASE_SECONDS,
-        ));
-        lockHeld = true;
-        mustRemote(
-          port,
-          "set -eu; " +
-            `stage=${paths.stage}; unpack=${paths.unpack}; archive=${paths.archive}; ` +
-            "rm -rf \"$stage\" \"$unpack\"; mkdir -p \"$unpack\"; " +
-            "tar -xf \"$archive\" -C \"$unpack\"; " +
-            `test -d "$unpack/${BUNDLE_NAME}"; ` +
-            `mv "$unpack/${BUNDLE_NAME}" "$stage"; rmdir "$unpack"; ` +
-            `test -x "$stage/${EXECUTABLE}"; ` +
-            `/usr/bin/ldid -e "$stage/${EXECUTABLE}" >/dev/null`,
-        );
-        mustRemote(port, deploymentRenewLockCommand(
-          transactionId,
-          paths,
-          Math.floor(Date.now() / 1000) + DEPLOYMENT_LEASE_SECONDS,
-        ));
-        const expectedFiles = { ...receipt.files, "build-receipt.json": sha256(receiptPath()) };
-        const fileNames = Object.keys(expectedFiles);
-        if (fileNames.some((name) => !/^[A-Za-z0-9@._-]+$/.test(name))) {
-          throw new Error("pocket ipodtouch4: receipt contains an unsafe bundle file name");
-        }
-        const hashes = mustRemote(port,
-          `cd ${paths.stage} && for file in ${fileNames.join(" ")}; do /usr/bin/openssl dgst -sha256 \"$file\"; done`);
-        const remoteFiles = new Map(
-          hashes.split("\n").map((line) => {
-            const match = line.match(/^SHA256\((.+)\)= ([0-9a-f]{64})$/);
-            if (!match) throw new Error(`pocket ipodtouch4: malformed device hash line: ${line}`);
-            return [match[1], match[2]];
-          }),
-        );
-        for (const [name, expected] of Object.entries(expectedFiles)) {
-          if (remoteFiles.get(name) !== expected) {
-            throw new Error(`pocket ipodtouch4: device readback mismatch for ${name}`);
-          }
-        }
-        mustRemote(port, deploymentRenewLockCommand(
-          transactionId,
-          paths,
-          Math.floor(Date.now() / 1000) + DEPLOYMENT_LEASE_SECONDS,
-        ));
-        mustRemote(port, deploymentInstallCommand(transactionId, paths));
-      } catch (error) {
-        operationError = error;
-        throw error;
+        copyToDevice(port, join(REPOSITORY, "dist/ipodtouch4/installer"), `${remoteRoot}/installer`);
+        copyToDevice(port, ipaPath(), archive);
+        copyToDevice(port, script, `${remoteRoot}/deploy.sh`);
+        const helperHash = sha256(join(REPOSITORY, "dist/ipodtouch4/installer"));
+        mustRemote(port, `set -eu; test "$(/usr/bin/openssl dgst -sha256 ${remoteRoot}/installer)" = ` +
+          shellQuote(`SHA256(${remoteRoot}/installer)= ${helperHash}`) +
+          `; chmod 700 ${remoteRoot}/installer; mv ${remoteRoot}/installer ${IPOD_INSTALLER}; ` +
+          `${IPOD_INSTALLER} lock ${shellQuote(BUNDLE_ID)} ${remoteRoot}/deploy.sh`);
+        verifyInstalledReceipt(port, receipt);
       } finally {
-        const cleanup = remote(
-          port,
-          "set +e; " +
-            `rm -rf ${paths.stage} ${paths.unpack} ${paths.archive}; ` +
-            (lockHeld
-              ? `lock=${paths.lock}; tx=${transactionId}; ` +
-                "if [ -f \"$lock/owner\" ] && [ \"$(cat \"$lock/owner\")\" = \"$tx\" ]; then rm -rf \"$lock\"; fi"
-              : "true"),
-        );
-        if (cleanup.exitCode !== 0 && operationError === undefined) {
-          throw new Error(
-            `pocket ipodtouch4: deployment cleanup failed (${cleanup.exitCode}):\n${cleanup.stderr.trim()}`,
-          );
-        }
+        // Migration backups are durable and belong to the next locked recovery.
+        remote(port, `rm -rf ${remoteRoot}`);
       }
     });
-  } finally {
-    rmSync(archive, { force: true });
-  }
-  console.log(`deployed ${receipt.buildId} to ${INSTALL_PATH} with byte-exact readback`);
+  } finally { rmSync(script, { force: true }); }
+  console.log(`deployed User app ${receipt.buildId} with byte-exact readback`);
+}
+
+function installedApp(port: number) {
+  const raw = mustRemote(port, `${IPOD_INSTALLER} lookup ${shellQuote(BUNDLE_ID)}`);
+  return parseInstalledIPodApp(raw, BUNDLE_ID, BUNDLE_NAME);
 }
 
-function verifyInstalledReceipt(port: number, receipt: BuildReceipt): void {
-  const installed = mustRemote(port, `cat ${INSTALL_PATH}/build-receipt.json`);
+async function uninstall(): Promise<void> {
+  await withTunnel((port) => {
+    const app = installedApp(port);
+    // Refuse removal of a legacy System app; migration must establish a User container.
+    mustRemote(port, `${IPOD_INSTALLER} uninstall ${shellQuote(BUNDLE_ID)}`);
+    const remaining = mustRemote(port, `${IPOD_INSTALLER} lookup ${shellQuote(BUNDLE_ID)}`);
+    if (JSON.parse(remaining) !== null || remote(port, `test ! -e ${shellQuote(app.Container)}`).exitCode !== 0) {
+      throw new Error("pocket ipodtouch4: uninstall did not remove the application and its container");
+    }
+  });
+  console.log(`uninstalled ${BUNDLE_ID} and its data container`);
+}
+
+function verifyInstalledReceipt(port: number, receipt: BuildReceipt) {
+  const app = installedApp(port);
+  const installed = mustRemote(port, `cat ${shellQuote(app.Path + "/build-receipt.json")}`);
   const installedReceipt = JSON.parse(installed) as BuildReceipt;
   if (!buildReceiptsMatch(installedReceipt, receipt)) {
     throw new Error(
       `pocket ipodtouch4: installed receipt does not match local build ${receipt.buildId}`,
     );
   }
+  return ipodAppReceiptPaths(app);
 }
 
 async function launch(): Promise<void> {
   const receipt = readReceipt();
   await withTunnel(async (port) => {
-    verifyInstalledReceipt(port, receipt);
+    const paths = verifyInstalledReceipt(port, receipt);
     mustRemote(
       port,
-      `killall ${EXECUTABLE} 2>/dev/null || true; rm -f ${STATUS_PATH} ${FRAME_PATH}; ` +
+      `killall ${EXECUTABLE} 2>/dev/null || true; rm -f ${paths.status} ${paths.frame}; ` +
         `/bin/su mobile -c '/usr/bin/uiopen ${APP.scheme}://launch'; echo launch-requested`,
     );
     await Bun.sleep(2500);
@@ -1118,8 +940,8 @@ async function launch(): Promise<void> {
   await status(false);
 }
 
-async function readDeviceStatus(port: number): Promise<DeviceStatus> {
-  const raw = mustRemote(port, `cat ${STATUS_PATH}`);
+async function readDeviceStatus(port: number, paths: ReturnType<typeof ipodAppReceiptPaths>): Promise<DeviceStatus> {
+  const raw = mustRemote(port, `cat ${paths.status}`);
   const values = new Map<string, string>();
   for (const line of raw.split("\n")) {
     const separator = line.indexOf("=");
@@ -1154,10 +976,10 @@ async function readDeviceStatus(port: number): Promise<DeviceStatus> {
 async function status(requireAction: boolean): Promise<void> {
   const receipt = readReceipt();
   await withTunnel(async (port) => {
-    verifyInstalledReceipt(port, receipt);
-    const first = await readDeviceStatus(port);
+    const paths = verifyInstalledReceipt(port, receipt);
+    const first = await readDeviceStatus(port, paths);
     await Bun.sleep(1200);
-    const current = await readDeviceStatus(port);
+    const current = await readDeviceStatus(port, paths);
     if (current.schema !== 2) {
       throw new Error("pocket ipodtouch4: malformed device status identity");
     }
@@ -1209,8 +1031,9 @@ async function capture(): Promise<void> {
   let height = 0;
   const drawable = expectedDrawable(readReceipt());
   await withTunnel(async (port) => {
+    const paths = verifyInstalledReceipt(port, readReceipt());
     try {
-      const status = await readDeviceStatus(port);
+      const status = await readDeviceStatus(port, paths);
       renderer = status.renderer;
       width = status.drawable_width;
       height = status.drawable_height;
@@ -1224,21 +1047,21 @@ async function capture(): Promise<void> {
       }
       mustRemote(
         port,
-        `rm -f ${FRAME_PATH} ${CAPTURE_REQUEST_PATH}; ` +
-          `/bin/su mobile -c 'touch ${CAPTURE_REQUEST_PATH}'`,
+        `rm -f ${paths.frame} ${paths.capture}; ` +
+          `/bin/su mobile -c 'touch ${paths.capture}'`,
       );
       for (let attempt = 0; attempt < 30; attempt += 1) {
         await Bun.sleep(200);
-        if (remote(port, `test -s ${FRAME_PATH}`).exitCode === 0) break;
+        if (remote(port, `test -s ${paths.frame}`).exitCode === 0) break;
       }
-      mustRemote(port, `test -s ${FRAME_PATH}`);
-      const frame = runBinary("ssh", sshArgs(port, `cat ${FRAME_PATH}`));
+      mustRemote(port, `test -s ${paths.frame}`);
+      const frame = runBinary("ssh", sshArgs(port, `cat ${paths.frame}`));
       if (frame.exitCode !== 0) {
         throw new Error(`pocket ipodtouch4: device frame download failed (${frame.exitCode}):\n${frame.stderr.trim()}`);
       }
       writeFileSync(rawDestination, frame.stdout);
     } finally {
-      remote(port, `rm -f ${CAPTURE_REQUEST_PATH} ${FRAME_PATH}`);
+      remote(port, `rm -f ${paths.capture} ${paths.frame}`);
     }
   });
   const raw = readFileSync(rawDestination);
@@ -1283,6 +1106,7 @@ function usage(): void {
   bun ipodtouch4 prepare-sysroot
   bun ipodtouch4 build
   bun ipodtouch4 deploy
+  bun ipodtouch4 uninstall
   bun ipodtouch4 launch
   bun ipodtouch4 status [--require-action]
   bun ipodtouch4 capture
@@ -1307,6 +1131,9 @@ export async function main(args: readonly string[] = Bun.argv.slice(2)): Promise
     case "deploy":
       await deploy();
       break;
+    case "uninstall":
+      await uninstall();
+      break;
     case "launch":
       await launch();
       break;
diff --git a/tools/test.ts b/tools/test.ts
index bd437ca11..e952d2b6d 100644
--- a/tools/test.ts
+++ b/tools/test.ts
@@ -61,6 +61,8 @@ const SUITE: readonly Stage[] = [
       "tests/iphone4s-profile.test.ts",
       "tests/ipodtouch-profile.test.ts",
       "tests/ipodtouch4-profile.test.ts",
+      "tests/ipodtouch4-installation.test.ts",
+      "tests/ipodtouch4-svcwire.test.ts",
       "tests/meizu-m8-profile.test.ts",
       "tests/blackberry-classic.test.ts",
       "tests/pocket-input.test.ts",