From b03cf1783b6a50f03968d6ef0b53f80ccfb95581 Mon Sep 17 00:00:00 2001
From: botandbang <337765928+botandbang@users.noreply.github.com>
Date: Fri, 30 Oct 2026 11:02:10 -0400
Subject: [PATCH 1/2] test(locallibrary): format and eject disk images in the
 weekly run

---
 .github/workflows/locallibrary-scheduled.yml  |  51 +++-
 apps/locallibrary/CHANGELOG.md                |   4 +
 apps/locallibrary/CONTRIBUTING.md             |   5 +
 apps/locallibrary/TODO.md                     |   5 -
 crates/locallibrary/src/format/disk_image.rs  | 260 ++++++++++++++++++
 .../src/format/disk_image/tests.rs            | 155 +++++++++++
 crates/locallibrary/src/format/linux.rs       |   8 +-
 crates/locallibrary/src/format/linux/tests.rs |  23 ++
 crates/locallibrary/src/format/macos.rs       |   5 +-
 crates/locallibrary/src/format/mod.rs         |  31 ++-
 crates/locallibrary/src/format/tests.rs       |  27 +-
 crates/locallibrary/src/format/windows.rs     |   2 +-
 12 files changed, 552 insertions(+), 24 deletions(-)
 create mode 100644 crates/locallibrary/src/format/disk_image.rs
 create mode 100644 crates/locallibrary/src/format/disk_image/tests.rs

diff --git a/.github/workflows/locallibrary-scheduled.yml b/.github/workflows/locallibrary-scheduled.yml
index dd36fcb06..f72690f92 100644
--- a/.github/workflows/locallibrary-scheduled.yml
+++ b/.github/workflows/locallibrary-scheduled.yml
@@ -2,8 +2,9 @@ name: locallibrary scheduled
 
 # The slow suites, weekly and on demand (Actions > locallibrary scheduled > Run workflow, on any
 # branch), so pull requests only wait for locallibrary-ci.yml's quick checks: every feature
-# combination, Bombadil, mutation testing, fuzzing, the Hegel property tests on fresh inputs, the
-# CLI's timings against a week earlier and a release build of every target. Also a weekly RustSec check, which catches advisories published against
+# combination, formatting and ejecting disk images, Bombadil, mutation testing, fuzzing, the Hegel
+# property tests on fresh inputs, the CLI's timings against a week earlier and a release build of
+# every target. Also a weekly RustSec check, which catches advisories published against
 # Cargo.lock between pushes.
 on:
   schedule:
@@ -58,6 +59,38 @@ jobs:
       - run: sudo apt-get update && sudo apt-get install -y libasound2-dev
       - run: cargo hack clippy --workspace --feature-powerset --all-targets --locked -- -D warnings
 
+  # format::apply and eject on a real disk, on each system: each test creates a small disk image,
+  # attaches it (hdiutil, a loop device, a VHD), formats or ejects it, and detaches it
+  # (crates/locallibrary/src/format/disk_image.rs). Without LOCALLIBRARY_DISK_IMAGE_TESTS they
+  # return at once, so no other run touches a device. losetup, sfdisk and mkfs need root on Linux,
+  # so the test binary runs under sudo as nextest's target runner; Windows runners are
+  # administrators already.
+  disk-images:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    env:
+      LOCALLIBRARY_DISK_IMAGE_TESTS: "1"
+      # nextest's `ci` profile, as the features job has it.
+      NEXTEST_PROFILE: ci
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - run: rustup toolchain install
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        with:
+          tool: cargo-nextest
+      - if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update && sudo apt-get install -y dosfstools exfatprogs
+          echo "CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER=sudo --preserve-env" >> "$GITHUB_ENV"
+      - run: cargo nextest run -p locallibrary --lib --locked --no-fail-fast -E 'test(/^format::disk_image::/)'
+
   # Bombadil explores the TUI and the mix report (property-based UI testing; see
   # apps/locallibrary/bombadil/).
   # macOS and Linux only: Bombadil has no Windows build.
@@ -443,7 +476,19 @@ jobs:
   # that passes closes it (scheduled-issue.yml).
   report:
     needs:
-      [advisories, features, bombadil, mutants, fuzz, hegel, cli-timings, release-plan, release-build, release-global]
+      [
+        advisories,
+        features,
+        disk-images,
+        bombadil,
+        mutants,
+        fuzz,
+        hegel,
+        cli-timings,
+        release-plan,
+        release-build,
+        release-global,
+      ]
     if: ${{ !cancelled() && github.event_name == 'schedule' }}
     permissions:
       actions: read
diff --git a/apps/locallibrary/CHANGELOG.md b/apps/locallibrary/CHANGELOG.md
index 7b4efc9ed..803a2ae75 100644
--- a/apps/locallibrary/CHANGELOG.md
+++ b/apps/locallibrary/CHANGELOG.md
@@ -679,6 +679,10 @@ their old names.
   folders, `drive disks` and `format` refuse while it's set, it lists each volume once without
   the boot volume, and every command warns when it's set. `LOCALLIBRARY_AUDIO=silent`, another,
   has the player play to no output at all, in real time, so a harness can play tracks unheard.
+- `format` always refuses disk images, loop devices and virtual disks:
+  `LOCALLIBRARY_FORMAT_VIRTUAL`, which let it format any of them, is gone. The weekly scheduled
+  run tests `format` and `eject` on a disk image it attaches (hdiutil, a loop device, a VHD), and
+  only a test build lets that one image through.
 - The sidecar refuses relative paths to write to (`art.embed.*` files included), `mix.export`
   refuses to replace a file without `replace: true`, `drive.reidentify` is a `.plan`/`.apply` pair
   (the old name still works), a second SIGINT or SIGTERM waits for a database swap under way,
diff --git a/apps/locallibrary/CONTRIBUTING.md b/apps/locallibrary/CONTRIBUTING.md
index 57b3e93d1..c5738577e 100644
--- a/apps/locallibrary/CONTRIBUTING.md
+++ b/apps/locallibrary/CONTRIBUTING.md
@@ -94,6 +94,11 @@ branch from the Actions tab (locallibrary scheduled, Run workflow):
 - the builds without the default features (on Linux, without the ALSA headers): the tests of the
   library and the CLI with none and of the CLI with only `account`, and clippy over every
   combination of features with [cargo-hack](https://github.com/taiki-e/cargo-hack);
+- `format` and `eject` on a disk image each test creates and attaches (hdiutil on macOS, a loop
+  device on Linux, a VHD on Windows; `crates/locallibrary/src/format/disk_image.rs`). They skip
+  themselves without `LOCALLIBRARY_DISK_IMAGE_TESTS=1`. On a Mac,
+  `LOCALLIBRARY_DISK_IMAGE_TESTS=1 cargo nextest run -p locallibrary --lib -E 'test(/^format::disk_image::/)'`
+  runs them;
 - the Bombadil explorations below;
 - mutation testing of the past week's changes to the `loclib-*` crates, the plugins and
   `rekordbox-pdb` with [cargo-mutants](https://mutants.rs) (settings in `.cargo/mutants.toml`), in
diff --git a/apps/locallibrary/TODO.md b/apps/locallibrary/TODO.md
index cfb4dd0df..84666a7ae 100644
--- a/apps/locallibrary/TODO.md
+++ b/apps/locallibrary/TODO.md
@@ -166,11 +166,6 @@ Open work left by the 2026-10-11 and 2026-10-12 sessions was added on 2026-10-12
 
 ## Tests to add
 
-- [ ] A CI-only `format::apply` test on a disk image per OS (hdiutil, a diskpart vdisk, losetup).
-      Linux first needs loop devices treated as removable under `LOCALLIBRARY_FORMAT_VIRTUAL`
-      (`format/linux.rs`).
-- [ ] `eject` on a two-partition image on the macOS leg of that job: refusing when the store is on
-      another volume, and naming the volumes it unmounts.
 - [ ] `check --audio` on tiny committed MP3, FLAC and M4A fixtures, truncated in
       `tests/it/check.rs` (only WAV truncation is tested). The same fixtures cover MP3 gapless.
 - [ ] The underline on the current hot cue, with a ratatui `TestBackend`.
diff --git a/crates/locallibrary/src/format/disk_image.rs b/crates/locallibrary/src/format/disk_image.rs
new file mode 100644
index 000000000..f1c150489
--- /dev/null
+++ b/crates/locallibrary/src/format/disk_image.rs
@@ -0,0 +1,260 @@
+//! Disk images for the tests that format and eject a real disk. [`TestImage`] creates an empty
+//! image, attaches it, and detaches it when it goes, also when the test fails.
+//!
+//! Only the scheduled workflow runs these tests, with `LOCALLIBRARY_DISK_IMAGE_TESTS=1` on each
+//! system's runner: without it they return at once, so an ordinary `cargo test` never touches a
+//! device. Linux and Windows need administrator rights (`losetup`, `Mount-DiskImage`).
+//!
+//! The format code refuses every disk image. [`TestImage::admit`] lets through the one a test
+//! attached, by its exact identifier, on that test's thread only ([`super::TEST_IMAGE`]).
+
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU32, Ordering};
+
+use super::{Cmd, Disk};
+
+/// Whether this run may attach and format disk images.
+fn enabled() -> bool {
+    std::env::var_os("LOCALLIBRARY_DISK_IMAGE_TESTS").is_some_and(|v| v == "1")
+}
+
+/// True, and says so, when this run may not attach disk images: the test then returns.
+pub(super) fn skipped() -> bool {
+    if enabled() {
+        return false;
+    }
+    eprintln!("skipped: set LOCALLIBRARY_DISK_IMAGE_TESTS=1 to attach and format disk images");
+    true
+}
+
+/// A volume label no other test running on this machine uses (the OS mounts volumes by label,
+/// `/Volumes/<label>` on macOS): `LT`, `tag`, this process and a count, at most 11 characters
+/// (FAT32's limit).
+pub(super) fn unique_label(tag: char) -> String {
+    static N: AtomicU32 = AtomicU32::new(0);
+    let n = N.fetch_add(1, Ordering::Relaxed) & 0xFF;
+    format!("LT{tag}{:05X}{n:X}", std::process::id() & 0xF_FFFF)
+}
+
+/// An empty disk image this test created and attached. Dropping it detaches it, looked up by its
+/// file, so it never detaches anything else.
+pub(super) struct TestImage {
+    /// The image file. The folder holding it goes after the image is detached.
+    file: PathBuf,
+    _dir: tempfile::TempDir,
+    /// The whole disk as the format code names it: `disk4`, `/dev/loop7`, `PhysicalDrive3`.
+    pub id: String,
+    /// Its device path, as attaching it printed it.
+    pub device: String,
+}
+
+impl TestImage {
+    /// Create an empty image of `mib` MiB and attach it, mounting nothing.
+    pub fn attach(mib: u64) -> TestImage {
+        let dir = tempfile::tempdir().unwrap();
+        let file = dir.path().join(format!("locallibrary-{}.{}", std::process::id(), os::EXTENSION));
+        // Made before attaching: if attaching panics part way, dropping it detaches the image.
+        let mut image = TestImage { file, _dir: dir, id: String::new(), device: String::new() };
+        os::create(&image.file, mib);
+        image.device = os::attach(&image.file);
+        image.id = os::id(&image.device);
+        assert_eq!(image.attached().as_deref(), Some(image.device.as_str()), "{}", image.file.display());
+        eprintln!("attached {} at {}", image.file.display(), image.device);
+        image
+    }
+
+    /// The device the system has this image attached at now, if it has.
+    pub fn attached(&self) -> Option<String> {
+        os::attached(&self.file)
+    }
+
+    /// Let the format code format this image, on this thread.
+    pub fn admit(&self) {
+        super::TEST_IMAGE.set(Some(self.id.clone()));
+    }
+
+    /// Panic unless `disk` is this image, still attached where attaching it said. Called before
+    /// anything that writes to a disk.
+    pub fn assert_mine(&self, disk: &Disk) {
+        assert_eq!((disk.id.as_str(), disk.device.as_str()), (self.id.as_str(), self.device.as_str()));
+        assert!(disk.virtual_disk, "{disk:?}");
+        assert_eq!(self.attached().as_deref(), Some(self.device.as_str()), "{} isn't attached", self.file.display());
+    }
+}
+
+impl Drop for TestImage {
+    fn drop(&mut self) {
+        super::TEST_IMAGE.with_borrow_mut(|t| {
+            if t.as_deref() == Some(self.id.as_str()) {
+                *t = None;
+            }
+        });
+        if let Some(device) = self.attached()
+            && let Err(e) = os::detach(&self.file, &device)
+        {
+            eprintln!("detaching {device} ({}): {e}", self.file.display());
+        }
+        let left = self.attached();
+        if !std::thread::panicking() {
+            assert_eq!(left, None, "{} is still attached", self.file.display());
+        } else if let Some(device) = left {
+            eprintln!("{} is still attached at {device}", self.file.display());
+        }
+    }
+}
+
+/// Whether `a` and `b` name the same file, symbolic links resolved: the system's tools may report
+/// the image's path either way (`/var` is `/private/var` on macOS).
+#[cfg(unix)]
+fn same_file(a: &Path, b: &Path) -> bool {
+    let canonical = |p: &Path| p.canonicalize().unwrap_or_else(|_| p.to_path_buf());
+    canonical(a) == canonical(b)
+}
+
+/// `hdiutil`.
+#[cfg(target_os = "macos")]
+mod os {
+    use super::*;
+    use crate::format::json;
+    use serde_json::Value;
+
+    pub const EXTENSION: &str = "dmg";
+
+    /// `hdiutil <args>` (with `-plist`), as JSON.
+    fn hdiutil(args: &[&str]) -> Value {
+        let xml = Cmd::new("hdiutil", args).run().unwrap();
+        let text = Cmd::new("plutil", &["-convert", "json", "-o", "-", "--", "-"]).input(xml).run().unwrap();
+        serde_json::from_str(&text).unwrap()
+    }
+
+    /// The whole disk among an image's `system-entities` (its partitions are `/dev/disk4s1`...).
+    fn whole_disk(image: &Value) -> Option<String> {
+        json::array(image.get("system-entities"))
+            .into_iter()
+            .filter_map(|e| json::str(e, "dev-entry"))
+            .find(|d| d.strip_prefix("/dev/disk").is_some_and(|n| n.chars().all(|c| c.is_ascii_digit())))
+    }
+
+    pub fn create(file: &Path, mib: u64) {
+        let size = format!("{mib}m");
+        let file = file.to_string_lossy();
+        Cmd::new("hdiutil", &["create", "-quiet", "-size", &size, "-layout", "NONE", "-type", "UDIF", &file])
+            .run()
+            .unwrap();
+    }
+
+    pub fn attach(file: &Path) -> String {
+        let file = file.to_string_lossy();
+        let out = hdiutil(&["attach", "-plist", "-nomount", "-noverify", "-noautofsck", "-noautoopen", &file]);
+        whole_disk(&out).unwrap_or_else(|| panic!("no disk in hdiutil's answer: {out}"))
+    }
+
+    pub fn attached(file: &Path) -> Option<String> {
+        let info = hdiutil(&["info", "-plist"]);
+        json::array(info.get("images"))
+            .into_iter()
+            .find(|i| json::str(i, "image-path").is_some_and(|p| same_file(Path::new(&p), file)))
+            .and_then(whole_disk)
+    }
+
+    pub fn detach(_: &Path, device: &str) -> crate::Result<()> {
+        Cmd::new("hdiutil", &["detach", device])
+            .run()
+            .or_else(|_| Cmd::new("hdiutil", &["detach", "-force", device]).run())?;
+        Ok(())
+    }
+
+    pub fn id(device: &str) -> String {
+        device.trim_start_matches("/dev/").to_string()
+    }
+}
+
+/// `losetup`, with partition scanning, so the format's partition shows up as `/dev/loop7p1`.
+#[cfg(all(unix, not(target_os = "macos")))]
+mod os {
+    use super::*;
+    use crate::format::json;
+    use serde_json::Value;
+
+    pub const EXTENSION: &str = "img";
+
+    pub fn create(file: &Path, mib: u64) {
+        std::fs::File::create(file).unwrap().set_len(mib << 20).unwrap();
+    }
+
+    pub fn attach(file: &Path) -> String {
+        Cmd::new("losetup", &["--find", "--show", "--partscan", &file.to_string_lossy()])
+            .run()
+            .unwrap()
+            .trim()
+            .to_string()
+    }
+
+    pub fn attached(file: &Path) -> Option<String> {
+        // Nothing at all when no loop device is set up.
+        let text = Cmd::new("losetup", &["--list", "--json", "--output", "NAME,BACK-FILE"]).run().unwrap();
+        let list: Value = if text.trim().is_empty() { Value::Null } else { serde_json::from_str(&text).unwrap() };
+        json::array(list.get("loopdevices"))
+            .into_iter()
+            .find(|d| json::str(d, "back-file").is_some_and(|p| same_file(Path::new(&p), file)))
+            .and_then(|d| json::str(d, "name"))
+    }
+
+    pub fn detach(_: &Path, device: &str) -> crate::Result<()> {
+        Cmd::new("losetup", &["--detach", device]).run()?;
+        Ok(())
+    }
+
+    pub fn id(device: &str) -> String {
+        device.to_string()
+    }
+}
+
+/// A VHD: `diskpart` creates it (`New-VHD` needs Hyper-V), the Storage cmdlets attach it.
+#[cfg(windows)]
+mod os {
+    use super::*;
+    use crate::format::windows::{powershell, quote};
+
+    pub const EXTENSION: &str = "vhd";
+
+    pub fn create(file: &Path, mib: u64) {
+        let script = file.with_extension("diskpart");
+        std::fs::write(&script, format!("create vdisk file=\"{}\" maximum={mib} type=expandable\r\n", file.display()))
+            .unwrap();
+        Cmd::new("diskpart", &["/s", &script.to_string_lossy()]).run().unwrap();
+    }
+
+    pub fn attach(file: &Path) -> String {
+        let path = quote(&file.to_string_lossy());
+        let n = powershell(&format!(
+            "$ErrorActionPreference = 'Stop'\n$null = Mount-DiskImage -ImagePath {path} -StorageType VHD\n(Get-DiskImage -ImagePath {path}).Number"
+        ))
+        .run()
+        .unwrap();
+        format!(r"\\.\PhysicalDrive{}", n.trim())
+    }
+
+    pub fn attached(file: &Path) -> Option<String> {
+        let path = quote(&file.to_string_lossy());
+        let n = powershell(&format!(
+            "$i = Get-DiskImage -ImagePath {path} -ErrorAction SilentlyContinue\nif ($i.Attached) {{ $i.Number }}"
+        ))
+        .run()
+        .unwrap();
+        let n = n.trim();
+        (!n.is_empty()).then(|| format!(r"\\.\PhysicalDrive{n}"))
+    }
+
+    pub fn detach(file: &Path, _: &str) -> crate::Result<()> {
+        let path = quote(&file.to_string_lossy());
+        powershell(&format!("$ErrorActionPreference = 'Stop'\n$null = Dismount-DiskImage -ImagePath {path}")).run()?;
+        Ok(())
+    }
+
+    pub fn id(device: &str) -> String {
+        device.trim_start_matches(r"\\.\").to_string()
+    }
+}
+
+mod tests;
diff --git a/crates/locallibrary/src/format/disk_image/tests.rs b/crates/locallibrary/src/format/disk_image/tests.rs
new file mode 100644
index 000000000..ad3b11535
--- /dev/null
+++ b/crates/locallibrary/src/format/disk_image/tests.rs
@@ -0,0 +1,155 @@
+use super::*;
+use crate::Error;
+use crate::device::Device;
+use crate::format::{Filesystem, FormatOptions, FsKind, Scheme, apply, disk_by_id, plan};
+use crate::progress::Ctx;
+use crate::store::Store;
+
+/// The disk `image` is now, checked to be it.
+fn mine(image: &TestImage) -> Disk {
+    // lsblk reads what udev has found on the disk: wait for it to catch up with the format.
+    #[cfg(all(unix, not(target_os = "macos")))]
+    let _ = Cmd::new("udevadm", &["settle"]).run();
+    let disk = disk_by_id(&image.id).unwrap().unwrap_or_else(|| panic!("{} is gone", image.id));
+    image.assert_mine(&disk);
+    disk
+}
+
+fn volumes(disk: &Disk) -> Vec<(Option<FsKind>, Option<&str>)> {
+    disk.volumes.iter().map(|v| (v.filesystem, v.label.as_deref())).collect()
+}
+
+/// An image is detached when its guard goes, also when the test holding it panics, and the
+/// format code stops taking it for the test's image.
+#[test]
+fn an_image_is_detached_when_its_test_ends() {
+    if skipped() {
+        return;
+    }
+    let image = TestImage::attach(8);
+    image.admit();
+    assert!(super::super::is_test_image(&image.id));
+    let file = image.file.clone();
+    drop(image);
+    assert_eq!(os::attached(&file), None);
+    super::super::TEST_IMAGE.with_borrow(|t| assert_eq!(t, &None));
+
+    let attached = std::cell::RefCell::new(None);
+    let failed = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        let image = TestImage::attach(8);
+        *attached.borrow_mut() = Some(image.file.clone());
+        panic!("the test failed");
+    }));
+    assert!(failed.is_err());
+    assert_eq!(os::attached(&attached.into_inner().unwrap()), None);
+}
+
+/// A disk image is refused like any other, until the test lets its own through. Then
+/// `format::apply` makes one FAT32 partition on MBR as planned, refuses the plan once the disk has
+/// changed, and formats it again as exFAT. Where the system mounts the new volume, a drive adopted
+/// on it keeps its name and identity.
+#[test]
+fn formats_the_image_it_attached_as_planned() {
+    if skipped() {
+        return;
+    }
+    // FAT32 with the default 4 KB clusters needs about 256 MiB.
+    let image = TestImage::attach(300);
+    let ctx = Ctx::silent();
+    let store_dir = tempfile::tempdir().unwrap();
+    let store = Store::open_or_init(store_dir.path().join("store")).unwrap();
+    let protected = vec![store.root().to_path_buf()];
+
+    // Linux doesn't take a loop device for a disk at all.
+    let unadmitted = disk_by_id(&image.id).unwrap();
+    assert_eq!(unadmitted.is_none(), cfg!(all(unix, not(target_os = "macos"))));
+    if let Some(disk) = unadmitted {
+        image.assert_mine(&disk);
+        let refused = plan(disk, &FormatOptions::default(), Some(&store), &protected, &ctx).unwrap_err();
+        assert!(
+            matches!(&refused, Error::Invalid(m) if m.ends_with("it's a disk image or virtual disk")),
+            "{refused:?}"
+        );
+    }
+
+    image.admit();
+    let label = unique_label('F');
+    let fat32 = FormatOptions { label: Some(label.clone()), ..FormatOptions::default() };
+    let planned = plan(mine(&image), &fat32, Some(&store), &protected, &ctx).unwrap();
+    assert_eq!((planned.filesystem, planned.label.as_str()), (Filesystem::Fat32, label.as_str()));
+    image.assert_mine(&planned.disk);
+    let report = apply(planned.disk.clone(), &planned.identity, &fat32, Some(&store), &protected, &ctx).unwrap();
+    assert_eq!((report.disk.as_str(), report.filesystem), (image.id.as_str(), Filesystem::Fat32));
+    let formatted = mine(&image);
+    assert_eq!(formatted.scheme, Some(Scheme::Mbr));
+    assert_eq!(volumes(&formatted), [(Some(FsKind::Fat32), Some(label.as_str()))]);
+    assert_eq!(report.mount, formatted.volumes[0].mount);
+
+    let stale = apply(formatted.clone(), &planned.identity, &fat32, Some(&store), &protected, &ctx).unwrap_err();
+    assert!(matches!(stale, Error::StalePlan(_)), "{stale:?}");
+
+    let kept = report.mount.as_ref().map(|m| {
+        let mut d = Device::open(m).unwrap();
+        let name = unique_label('K');
+        d.adopt(Some(&name)).unwrap();
+        crate::sync::register_drive(&store, &d, None).unwrap();
+        (name, d.id().unwrap())
+    });
+    let exfat = FormatOptions { filesystem: Some(Filesystem::Exfat), ..FormatOptions::default() };
+    let planned = plan(mine(&image), &exfat, Some(&store), &protected, &ctx).unwrap();
+    assert_eq!(planned.keeps_name, kept.as_ref().map(|(name, _)| name.clone()));
+    image.assert_mine(&planned.disk);
+    let report = apply(planned.disk.clone(), &planned.identity, &exfat, Some(&store), &protected, &ctx).unwrap();
+    assert_eq!(report.drive_name, planned.keeps_name);
+    assert_eq!(volumes(&mine(&image)), [(Some(FsKind::Exfat), Some(planned.label.as_str()))]);
+    if let (Some(m), Some((_, id))) = (&report.mount, &kept) {
+        assert_eq!(Device::open(m).unwrap().id(), Some(*id));
+    }
+}
+
+/// Ejecting a drive on one partition of a two-partition image is refused while the store is on
+/// the other, which ejecting would unmount, and nothing runs. Otherwise the plan names the other
+/// volume, and applying it unmounts both and detaches the image.
+#[cfg(target_os = "macos")]
+#[test]
+fn ejecting_a_drive_unmounts_the_other_volume_of_its_disk() {
+    use crate::api::{EjectDrives, drive_eject_plan};
+    if skipped() {
+        return;
+    }
+    let image = TestImage::attach(64);
+    image.assert_mine(&mine(&image));
+    let (a, b) = (unique_label('A'), unique_label('B'));
+    Cmd::new("diskutil", &["partitionDisk", &image.id, "2", "MBR", "ExFAT", &a, "32M", "ExFAT", &b, "R"])
+        .run()
+        .unwrap();
+    let disk = mine(&image);
+    let mount = |label: &str| {
+        disk.volumes.iter().find(|v| v.label.as_deref() == Some(label)).and_then(|v| v.mount.clone()).unwrap()
+    };
+    let (on_a, on_b) = (mount(&a), mount(&b));
+    let mut d = Device::open(&on_a).unwrap();
+    let name = unique_label('D');
+    d.adopt(Some(&name)).unwrap();
+    let req = EjectDrives { drives: vec![on_a.display().to_string()] };
+
+    let refused = drive_eject_plan(Some(&on_b.join("store")), &req).unwrap_err();
+    let unmounts = format!("would unmount {}, which holds", on_b.display());
+    assert!(matches!(&refused, Error::Invalid(m) if m.contains(&unmounts)), "{refused:?}");
+    assert!(on_a.is_dir() && on_b.is_dir());
+
+    let store_dir = tempfile::tempdir().unwrap();
+    let store = Store::open_or_init(store_dir.path().join("store")).unwrap();
+    crate::sync::register_drive(&store, &d, None).unwrap();
+    let planned = drive_eject_plan(Some(store.root()), &req).unwrap();
+    assert_eq!(planned.plan.drives[0].also_unmounts, std::slice::from_ref(&on_b));
+    let summary = format!("eject {name}: unmount it (and {}, on the same disk) and power it off", on_b.display());
+    assert_eq!(planned.summary, [summary]);
+    image.assert_mine(&crate::format::disk_at(&on_a).unwrap());
+    let reports = planned.apply(Some(&store), &Ctx::silent()).unwrap();
+    assert_eq!(reports[0].commands, planned.plan.drives[0].commands);
+    assert!(reports[0].powered_off);
+    assert!(!on_a.exists() && !on_b.exists());
+    assert_eq!(image.attached(), None);
+    assert_eq!(store.drives().unwrap().shift_remove(&d.id().unwrap()).unwrap().log.clean_ejects, 1);
+}
diff --git a/crates/locallibrary/src/format/linux.rs b/crates/locallibrary/src/format/linux.rs
index 9b198b08f..e59f0f24a 100644
--- a/crates/locallibrary/src/format/linux.rs
+++ b/crates/locallibrary/src/format/linux.rs
@@ -69,11 +69,13 @@ fn mounts(node: &Value, out: &mut Vec<(String, String)>) {
 const SYSTEM_MOUNTS: [&str; 7] = ["/", "/boot", "/boot/efi", "/efi", "/usr", "/var", "[SWAP]"];
 
 pub(super) fn parse_disk(d: &Value) -> Option<Disk> {
-    if json::str(d, "type").as_deref() != Some("disk") {
-        return None;
-    }
     let name = json::str(d, "name").unwrap_or_default();
     let path = json::str(d, "path").unwrap_or_else(|| format!("/dev/{name}"));
+    // A loop device only when it's the disk image a test attached.
+    let test_image = || json::str(d, "type").as_deref() == Some("loop") && super::is_test_image(&path);
+    if json::str(d, "type").as_deref() != Some("disk") && !test_image() {
+        return None;
+    }
     let mut all = Vec::new();
     mounts(d, &mut all);
     let system = all.iter().any(|(_, m)| SYSTEM_MOUNTS.contains(&m.as_str()));
diff --git a/crates/locallibrary/src/format/linux/tests.rs b/crates/locallibrary/src/format/linux/tests.rs
index fe7a31085..3926a6a8b 100644
--- a/crates/locallibrary/src/format/linux/tests.rs
+++ b/crates/locallibrary/src/format/linux/tests.rs
@@ -28,6 +28,29 @@ fn parses_lsblk_old_and_new() {
     }
 }
 
+/// A loop device isn't a disk, unless it's the disk image this test attached.
+#[test]
+fn only_the_tests_own_loop_device_is_a_disk() {
+    let lsblk = |path: &str| {
+        json!({
+            "name": path.trim_start_matches("/dev/"), "path": path, "type": "loop", "size": 314572800u64,
+            "rm": false, "hotplug": false, "ro": false, "tran": null, "log-sec": 512, "pttype": "dos",
+            "children": [{
+                "name": "loop7p1", "path": format!("{path}p1"), "type": "part", "size": 313524224u64,
+                "fstype": "vfat", "fsver": "FAT32", "label": "LTF", "mountpoint": null
+            }]
+        })
+    };
+    assert!(parse_disk(&lsblk("/dev/loop7")).is_none());
+    super::super::TEST_IMAGE.set(Some("/dev/loop7".into()));
+    let d = parse_disk(&lsblk("/dev/loop7")).unwrap();
+    assert!(d.virtual_disk && !d.removable && d.internal);
+    assert_eq!(d.problem(&[]), None);
+    assert_eq!(d.volumes[0].filesystem, Some(FsKind::Fat32));
+    assert!(parse_disk(&lsblk("/dev/loop8")).is_none());
+    super::super::TEST_IMAGE.set(None);
+}
+
 #[test]
 fn system_disks_are_flagged() {
     let mut v = usb_drive(false);
diff --git a/crates/locallibrary/src/format/macos.rs b/crates/locallibrary/src/format/macos.rs
index 970e8dd3b..b71e2ef31 100644
--- a/crates/locallibrary/src/format/macos.rs
+++ b/crates/locallibrary/src/format/macos.rs
@@ -22,10 +22,7 @@ fn diskutil(args: &[&str]) -> Result<Value> {
 }
 
 pub fn list() -> Result<Vec<Disk>> {
-    let filter: &[&str] = if super::virtual_disks_allowed() { &["external"] } else { &["external", "physical"] };
-    let mut args = vec!["list"];
-    args.extend_from_slice(filter);
-    let listing = diskutil(&args)?;
+    let listing = diskutil(&["list", "external", "physical"])?;
     let boot = boot_disks();
     let usb = usb_devices();
     json::array(listing.get("WholeDisks"))
diff --git a/crates/locallibrary/src/format/mod.rs b/crates/locallibrary/src/format/mod.rs
index 1e1da2e17..4587ce6ca 100644
--- a/crates/locallibrary/src/format/mod.rs
+++ b/crates/locallibrary/src/format/mod.rs
@@ -240,10 +240,13 @@ impl Disk {
         if self.system {
             return Some("it holds the running operating system".into());
         }
-        if self.internal || !self.removable {
+        // The disk image a test attached is let through, and nothing else: it's virtual, and on
+        // Linux (a loop device) not removable either.
+        let test_image = self.virtual_disk && is_test_image(&self.id);
+        if (self.internal || !self.removable) && !test_image {
             return Some("it's an internal disk (only external and removable drives can be formatted)".into());
         }
-        if self.virtual_disk && !virtual_disks_allowed() {
+        if self.virtual_disk && !test_image {
             return Some("it's a disk image or virtual disk".into());
         }
         if self.read_only {
@@ -274,9 +277,22 @@ impl Disk {
     }
 }
 
-/// Tests format disk images; set `LOCALLIBRARY_FORMAT_VIRTUAL=1` to allow them.
-fn virtual_disks_allowed() -> bool {
-    std::env::var_os("LOCALLIBRARY_FORMAT_VIRTUAL").is_some_and(|v| v == "1")
+#[cfg(test)]
+thread_local! {
+    /// The whole-disk identifier of the disk image this test thread attached ([`disk_image`]),
+    /// the one virtual disk it may format.
+    pub(crate) static TEST_IMAGE: std::cell::RefCell<Option<String>> = const { std::cell::RefCell::new(None) };
+}
+
+/// Whether `id` names the disk image this test thread attached. Never, outside tests.
+#[cfg(test)]
+fn is_test_image(id: &str) -> bool {
+    TEST_IMAGE.with_borrow(|t| t.as_deref() == Some(id))
+}
+
+#[cfg(not(test))]
+fn is_test_image(_: &str) -> bool {
+    false
 }
 
 /// A disk, how players would get on with it as it is, and whether it can be formatted.
@@ -298,7 +314,7 @@ pub fn list(protected: &[PathBuf]) -> Result<Vec<DiskView>> {
 fn views(disks: Vec<Disk>, protected: &[PathBuf]) -> Vec<DiskView> {
     disks
         .into_iter()
-        .filter(|d| d.removable && !d.internal && (!d.virtual_disk || virtual_disks_allowed()))
+        .filter(|d| d.removable && !d.internal && !d.virtual_disk)
         .map(|disk| DiskView {
             identity: disk.identity(),
             compatibility: players::assess_disk(&disk),
@@ -823,3 +839,6 @@ pub(crate) mod json {
 
 #[cfg(test)]
 pub(crate) mod tests;
+
+#[cfg(test)]
+mod disk_image;
diff --git a/crates/locallibrary/src/format/tests.rs b/crates/locallibrary/src/format/tests.rs
index fe95e6cc6..036505995 100644
--- a/crates/locallibrary/src/format/tests.rs
+++ b/crates/locallibrary/src/format/tests.rs
@@ -198,8 +198,7 @@ fn file_systems_are_named_and_small_volumes_get_small_clusters() {
     assert_eq!(Filesystem::Hfsplus.label(""), "REKORDBOX");
 }
 
-/// A disk image is refused unless tests allow them, and so is a disk holding `/` whatever it
-/// says about itself.
+/// A disk image is refused, and so is a disk holding `/` whatever it says about itself.
 #[test]
 fn refuses_disk_images_and_the_root_volume() {
     let image = Disk { virtual_disk: true, ..sample_disk() };
@@ -209,6 +208,30 @@ fn refuses_disk_images_and_the_root_volume() {
     assert_eq!(root.problem(&[]).as_deref(), Some("it holds the running operating system"));
 }
 
+/// The disk image a test attached is let through, and only that one: a disk image under another
+/// identifier is refused, and so is a disk that isn't an image under the image's identifier.
+#[test]
+fn only_the_tests_own_image_is_let_through() {
+    let image = Disk { virtual_disk: true, internal: true, removable: false, ..sample_disk() };
+    TEST_IMAGE.set(Some(image.id.clone()));
+    assert_eq!(image.problem(&[]), None);
+    let other = Disk { id: "disk9".into(), ..image.clone() };
+    assert_eq!(
+        other.problem(&[]).as_deref(),
+        Some("it's an internal disk (only external and removable drives can be formatted)")
+    );
+    let real = Disk { virtual_disk: false, ..image.clone() };
+    assert!(real.problem(&[]).unwrap().contains("internal"));
+    // Read-only, holding the system or a protected path: refused all the same.
+    assert_eq!(Disk { read_only: true, ..image.clone() }.problem(&[]).as_deref(), Some("it's write-protected"));
+    assert!(Disk { system: true, ..image.clone() }.problem(&[]).unwrap().contains("operating system"));
+    assert!(image.problem(&[PathBuf::from("/Volumes/DNA/store")]).unwrap().contains("holds"));
+    // Nor is it listed: tests name it by its identifier.
+    assert!(views(vec![image.clone()], &[]).is_empty());
+    TEST_IMAGE.set(None);
+    assert!(image.problem(&[]).unwrap().contains("internal"));
+}
+
 /// Only external and removable physical disks are listed, each with why it can't be
 /// formatted when it can't.
 #[test]
diff --git a/crates/locallibrary/src/format/windows.rs b/crates/locallibrary/src/format/windows.rs
index 512e33ad3..02f08a7bf 100644
--- a/crates/locallibrary/src/format/windows.rs
+++ b/crates/locallibrary/src/format/windows.rs
@@ -39,7 +39,7 @@ ConvertTo-Json -InputObject $disks -Depth 5 -Compress
 
 /// Run a script with Windows PowerShell. `-EncodedCommand` (UTF-16LE, base64) avoids both
 /// quoting and `-Command -`'s line-by-line reading of standard input.
-fn powershell(script: &str) -> Cmd {
+pub(crate) fn powershell(script: &str) -> Cmd {
     let script = format!("$ProgressPreference = 'SilentlyContinue'\n{script}");
     let utf16: Vec<u8> = script.encode_utf16().flat_map(u16::to_le_bytes).collect();
     let encoded = BASE64_STANDARD.encode(&utf16);

From 8c8ed2d7540449a69bf03e36c5b34354ceea45e8 Mon Sep 17 00:00:00 2001
From: botandbang <337765928+botandbang@users.noreply.github.com>
Date: Sat, 31 Oct 2026 10:53:42 -0400
Subject: [PATCH 2/2] test(locallibrary): keep the disk-image test module where
 CodeQL leaves tests out

---
 .github/workflows/locallibrary-scheduled.yml                   | 2 +-
 apps/locallibrary/CONTRIBUTING.md                              | 2 +-
 crates/locallibrary/src/format/mod.rs                          | 1 +
 crates/locallibrary/src/format/{ => tests}/disk_image.rs       | 1 +
 crates/locallibrary/src/format/{ => tests}/disk_image/tests.rs | 0
 5 files changed, 4 insertions(+), 2 deletions(-)
 rename crates/locallibrary/src/format/{ => tests}/disk_image.rs (99%)
 rename crates/locallibrary/src/format/{ => tests}/disk_image/tests.rs (100%)

diff --git a/.github/workflows/locallibrary-scheduled.yml b/.github/workflows/locallibrary-scheduled.yml
index 0d3de01fc..4e2988c33 100644
--- a/.github/workflows/locallibrary-scheduled.yml
+++ b/.github/workflows/locallibrary-scheduled.yml
@@ -61,7 +61,7 @@ jobs:
 
   # format::apply and eject on a real disk, on each system: each test creates a small disk image,
   # attaches it (hdiutil, a loop device, a VHD), formats or ejects it, and detaches it
-  # (crates/locallibrary/src/format/disk_image.rs). Without LOCALLIBRARY_DISK_IMAGE_TESTS they
+  # (crates/locallibrary/src/format/tests/disk_image.rs). Without LOCALLIBRARY_DISK_IMAGE_TESTS they
   # return at once, so no other run touches a device. losetup, sfdisk and mkfs need root on Linux,
   # so the test binary runs under sudo as nextest's target runner; Windows runners are
   # administrators already.
diff --git a/apps/locallibrary/CONTRIBUTING.md b/apps/locallibrary/CONTRIBUTING.md
index 6f60bde29..df2326944 100644
--- a/apps/locallibrary/CONTRIBUTING.md
+++ b/apps/locallibrary/CONTRIBUTING.md
@@ -98,7 +98,7 @@ branch from the Actions tab (locallibrary scheduled, Run workflow):
   library and the CLI with none and of the CLI with only `account`, and clippy over every
   combination of features with [cargo-hack](https://github.com/taiki-e/cargo-hack);
 - `format` and `eject` on a disk image each test creates and attaches (hdiutil on macOS, a loop
-  device on Linux, a VHD on Windows; `crates/locallibrary/src/format/disk_image.rs`). They skip
+  device on Linux, a VHD on Windows; `crates/locallibrary/src/format/tests/disk_image.rs`). They skip
   themselves without `LOCALLIBRARY_DISK_IMAGE_TESTS=1`. On a Mac,
   `LOCALLIBRARY_DISK_IMAGE_TESTS=1 cargo nextest run -p locallibrary --lib -E 'test(/^format::disk_image::/)'`
   runs them;
diff --git a/crates/locallibrary/src/format/mod.rs b/crates/locallibrary/src/format/mod.rs
index 4587ce6ca..336cf983f 100644
--- a/crates/locallibrary/src/format/mod.rs
+++ b/crates/locallibrary/src/format/mod.rs
@@ -841,4 +841,5 @@ pub(crate) mod json {
 pub(crate) mod tests;
 
 #[cfg(test)]
+#[path = "tests/disk_image.rs"]
 mod disk_image;
diff --git a/crates/locallibrary/src/format/disk_image.rs b/crates/locallibrary/src/format/tests/disk_image.rs
similarity index 99%
rename from crates/locallibrary/src/format/disk_image.rs
rename to crates/locallibrary/src/format/tests/disk_image.rs
index f1c150489..3df81d498 100644
--- a/crates/locallibrary/src/format/disk_image.rs
+++ b/crates/locallibrary/src/format/tests/disk_image.rs
@@ -257,4 +257,5 @@ mod os {
     }
 }
 
+#[path = "disk_image/tests.rs"]
 mod tests;
diff --git a/crates/locallibrary/src/format/disk_image/tests.rs b/crates/locallibrary/src/format/tests/disk_image/tests.rs
similarity index 100%
rename from crates/locallibrary/src/format/disk_image/tests.rs
rename to crates/locallibrary/src/format/tests/disk_image/tests.rs