diff --git a/AGENTS.md b/AGENTS.md
index 639178d..9dfbba2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,8 +32,8 @@ Node, which is how the tests run.
   IndexedDB and one VM per about:blank iframe. Keep these working.
 - The release form is an npm package of the built files only
   (`java-web.js`, `java-web-worker.js`, `node.js` (the Node entry), `cli.js` (the
-  `java-web` command), `boot.pack`, `jdk/<module>.jar`,
-  `jdk/javac.pack`, `jdk/jdk.localedata.txt`, and OpenJDK's notices in `jdk/legal/`), versioned, with
+  `java-web` command), `boot.pack`, `jdk/image.jar`,
+  `jdk/javac.pack`, and OpenJDK's notices in `jdk/legal/`), versioned, with
   nothing built at install. A GitHub Actions workflow triggered by a release
   publishes it to npm; never publish by hand.
 
@@ -42,7 +42,7 @@ Node, which is how the tests run.
 - `src/classfile.ts` class file parser
 - `src/runtime.ts` classes, methods, fields, objects, arrays
 - `src/interp.ts` bytecode interpreter and per-thread run loop
-- `src/jvm.ts` loading, linking, initialization, resolution, scheduler, boot
+- `src/jvm.ts` loading, linking, initialization, resolution, scheduler, boot; `src/jimage.ts` reads the linked JDK image
 - `src/indy.ts` invokedynamic, method handles
 - `src/snapshot.ts` boot snapshots: saving and restoring the VM as it is after boot
 - `src/library.ts` library mode in the VM: object handles, calls, field access,
@@ -76,12 +76,9 @@ Node, which is how the tests run.
 
 ## Glossary
 
-- **java.home image**: `build/jdk`, the Linux x64 JDK's class library in the
-  exploded layout (`modules/<module>/...` instead of a `lib/modules` jimage),
-  built the same on every host. Mounted at
-  `/jdk` in the VFS. It has no `lib/modules`, which would switch the JDK to
-  image mode; `lib/resources.jimage` holds only the non-class resources, for
-  `jrt:` URLs.
+- **java.home image**: `build/jdk`, a linked image with the Linux x64 JDK's
+  class library in `lib/modules`, built the same on every host and mounted at
+  `/jdk` in the VFS.
 - **VFS**: the virtual file system the Java side sees (`src/fs.ts`).
 - **native**: a JS function implementing a Java `native` method, keyed by
   `class.name(desc)`. A plain native returns its result; a generator native
diff --git a/docs/browser.md b/docs/browser.md
index e477ac6..7e7ed7e 100644
--- a/docs/browser.md
+++ b/docs/browser.md
@@ -5,9 +5,11 @@ The npm package holds the built files: `java-web.js`, `java-web-worker.js`,
 and load `java-web.js` with a classic `<script>` tag. It finds the other files
 next to itself, or where `cheerpjInit({ runtime: "/path/to/dist/" })` says.
 
-- The server should answer range requests for the `jdk/<module>.jar` files,
-  so a page reads only the classes it needs. A host that compresses ranged
-  responses still works, at the cost of one full download per file.
+- The server should answer range requests for `jdk/image.jar`, the whole JDK
+  image, so a page reads only the classes it needs. `boot.pack` holds what a
+  typical start reads, and `jdk/javac.pack` what javac adds. A host that
+  compresses ranged responses still works, at the cost of one full download of
+  `jdk/image.jar` (about 120 MB).
 - The JIT compiles hot Java methods with `new Function`, so a page with a
   Content Security Policy needs `'unsafe-eval'` in `script-src`. Without it,
   Java still runs, only interpreted.
diff --git a/docs/development.md b/docs/development.md
index e58b53c..38f8176 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -6,7 +6,12 @@ same download on Linux x64) into `~/.cache/java-web`, and checks each SHA-256.
 The runtime image comes from the Linux x64 JDK, so every machine, a Mac
 included, builds the same image, with the Linux class library whose natives
 java-web implements. The host JDK is the HotSpot reference the tests run, linked
-at `build/hotspot`.
+at `build/hotspot`. The build links the selected modules into `build/jdk/lib/modules`;
+`lib/packages.txt` indexes packages for the boot class loader. `pnpm build`
+puts it, with the files around it, in `dist/jdk/image.jar`, read by byte range.
+It packs the byte ranges a typical start reads into `boot.pack`, and those javac
+adds into `jdk/javac.pack`. Without `localeData`, the VM leaves `jdk.localedata`
+out with `jdk.module.limitmods`, as `--limit-modules` does.
 
 ```sh
 pnpm install
diff --git a/docs/node.md b/docs/node.md
index eae523f..3246dfd 100644
--- a/docs/node.md
+++ b/docs/node.md
@@ -21,7 +21,7 @@ npx @project516/java-web [options] -jar app.jar [args]
 | `--locale-data` | locales other than English (see [support.md](support.md#locales)) |
 | `-Xmx` | the largest array, and what `Runtime.maxMemory()` reports (default and at most 1g, rounded up to 2 MB steps, below 2m an error); the total heap is not counted |
 | `--max-rss MB` | exit when resident memory passes this (default 2048) |
-| `--jdk DIR` | an exploded JDK image instead of the packaged one |
+| `--jdk DIR` | a java-web JDK image instead of the packaged one |
 | `--debug` | log VM events |
 
 Other `-X` and HotSpot-only options are ignored.
diff --git a/docs/support.md b/docs/support.md
index 1c49461..a885e3f 100644
--- a/docs/support.md
+++ b/docs/support.md
@@ -9,7 +9,6 @@ java-web targets headless Java: console apps, libraries and javac.
 - `java.desktop`'s headless parts work: 2D geometry, image pixels, `Graphics2D`
   drawing on a `BufferedImage`, and JavaBeans. So does `java.xml`, including
   XML Schema validation and DTDs from the JDK's built-in catalog.
-- `jrt:/` URLs read the JDK's resources but not its class files.
 - `Deflater` writes valid DEFLATE streams using stored blocks. Compression
   levels and strategies currently do not reduce output size; compressed bytes
   and compression ratios differ from HotSpot's zlib output.
@@ -19,14 +18,14 @@ java-web targets headless Java: console apps, libraries and javac.
 ## Locales
 
 Locales other than English need `cheerpjInit({ localeData: true })`, or
-  `--locale-data` under Node (`localeData: true` for `runNode`). Turn it on
+  `--locale-data` under Node (`localeData: true` for `runNode`). Adding
+  `jdk.localedata` or `ALL-SYSTEM` with `--add-modules` turns it on too. Turn it on
   when a program formats numbers, dates or currencies, or prints month and day
   names, for a locale other than English: for example
   `String.format(Locale.GERMANY, ...)`, or a German default locale. Without it,
   those locales format as English. It is off by default because, once on, it
   slows the first formatting call of every program, English ones included, by
-  a few hundred milliseconds. With it on, a page also fetches the locale file
-  list (`jdk/jdk.localedata.txt`, 160 KB) at start, then only the locales it
+  up to a second on slow devices. With it on, a page reads only the locales it
   uses.
 
 ## Graphics and text
diff --git a/package.json b/package.json
index 744eacb..2af6f5c 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,6 @@
     "dist/boot.pack",
     "dist/jdk/*.jar",
     "dist/jdk/javac.pack",
-    "dist/jdk/jdk.localedata.txt",
     "dist/jdk/legal/"
   ],
   "publishConfig": {
diff --git a/scripts/ExplodedModuleInfo.java b/scripts/ExplodedModuleInfo.java
index 2daa38e..2572abb 100644
--- a/scripts/ExplodedModuleInfo.java
+++ b/scripts/ExplodedModuleInfo.java
@@ -5,9 +5,7 @@
 import java.nio.file.Files;
 import java.nio.file.Path;
 
-// Drops ModuleHashes from module-info.class files, as a JDK exploded build
-// has none: exploded modules cannot be hashed, and boot fails when java.base
-// records hashes of other modules.
+// Drop hashes of the original JDK modules before linking a different set.
 void main(String[] args) throws Exception {
   ClassFile cf = ClassFile.of();
   for (String a : args) {
diff --git a/scripts/HashedModules.java b/scripts/HashedModules.java
new file mode 100644
index 0000000..5c1c24e
--- /dev/null
+++ b/scripts/HashedModules.java
@@ -0,0 +1,15 @@
+import java.lang.classfile.Attributes;
+import java.lang.classfile.ClassFile;
+import java.nio.file.Path;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+// Prints a jmod --hash-modules pattern for the modules a java.base
+// module-info.class records hashes of, among the given ones.
+// Args: <java.base module-info.class> <modules, space separated>
+void main(String[] args) throws Exception {
+  var hashes = ClassFile.of().parse(Path.of(args[0])).findAttribute(Attributes.moduleHashes()).orElseThrow();
+  Set<String> linked = Set.of(args[1].split(" "));
+  System.out.println(hashes.hashes().stream().map(h -> h.moduleName().name().stringValue())
+      .filter(linked::contains).sorted().collect(Collectors.joining("|", "^(", ")$")));
+}
diff --git a/scripts/LinuxImage.java b/scripts/LinuxImage.java
index 6b6f7c2..f189aa9 100644
--- a/scripts/LinuxImage.java
+++ b/scripts/LinuxImage.java
@@ -1,4 +1,3 @@
-import java.io.DataInputStream;
 import java.io.IOException;
 import java.lang.module.ModuleDescriptor;
 import java.lang.module.ModuleDescriptor.Requires;
@@ -14,9 +13,7 @@
 import java.util.Set;
 import java.util.TreeSet;
 
-// Builds the java.home image from a Linux JDK without jlink: keeps the root
-// modules and the modules they require, as jlink does without --bind-services,
-// and copies the conf/, lib/ and legal/ files of those modules.
+// Copies the conf/, lib/ and legal/ files of the linked modules.
 // Args: <JDK home> <modules extracted from its lib/modules> <root modules, comma separated> <output dir>
 void main(String[] args) throws IOException {
   Path jdk = Path.of(args[0]), src = Path.of(args[1]), out = Path.of(args[3]);
@@ -36,7 +33,6 @@ void main(String[] args) throws IOException {
   // Each module's files are listed in jdk.jlink as type|kind|hash or link target|path
   Path lists = src.resolve("jdk.jlink/jdk/tools/jlink/internal/runtimelink");
   for (String name : keep) {
-    Files.move(src.resolve(name), out.resolve("modules").resolve(name));
     Path list = lists.resolve("fs_" + name + "_files");
     if (Files.notExists(list)) continue;
     for (String line : Files.readAllLines(list)) {
@@ -54,30 +50,8 @@ void main(String[] args) throws IOException {
     }
   }
 
-  restoreSystemModulesMap(src, out);
 
   String version = Files.readAllLines(jdk.resolve("release")).stream()
       .filter(l -> l.startsWith("JAVA_VERSION=")).findFirst().orElseThrow();
   Files.writeString(out.resolve("release"), version + "\nMODULES=\"" + String.join(" ", keep) + "\"\n");
 }
-
-// jlink's system-modules plugin generated SystemModules classes for the whole
-// JDK and pointed SystemModulesMap at them. The image has no lib/modules, so
-// the JDK must find its modules by scanning, which the original map allows.
-// diff_java.base holds the original bytes for undoing the plugin.
-void restoreSystemModulesMap(Path src, Path out) throws IOException {
-  Path diff = src.resolve("jdk.jlink/jdk/tools/jlink/internal/runtimelink/diff_java.base");
-  String dir = "/java.base/jdk/internal/module/";
-  try (var in = new DataInputStream(Files.newInputStream(diff))) {
-    in.readInt();
-    for (int n = in.readInt(); n > 0; n--) {
-      short kind = in.readShort();
-      String name = new String(in.readNBytes(in.readInt()));
-      byte[] original = in.readNBytes(in.readInt());
-      if (!name.startsWith(dir)) continue;
-      Path file = out.resolve("modules").resolve(name.substring(1));
-      if (kind == 1) Files.delete(file);
-      else Files.write(file, original);
-    }
-  }
-}
diff --git a/scripts/ResourceImage.java b/scripts/ResourceImage.java
deleted file mode 100644
index 1629fda..0000000
--- a/scripts/ResourceImage.java
+++ /dev/null
@@ -1,59 +0,0 @@
-import java.io.IOException;
-import java.lang.classfile.Attributes;
-import java.lang.classfile.ClassFile;
-import java.lang.classfile.attribute.ModuleAttribute;
-import java.lang.constant.ModuleDesc;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.spi.ToolProvider;
-import java.util.stream.Stream;
-
-// Builds a jimage that holds only the non-class resources of an exploded
-// modules/ directory, which is all jrt: URLs need. jlink insists that a
-// module's packages match its resources, so each module goes in as a stub
-// module-info plus its resources, with the target platform of the image.
-// Args: <modules dir> <work dir> <output jimage>
-void main(String[] args) throws Exception {
-  Path modules = Path.of(args[0]), work = Path.of(args[1]), image = Path.of(args[2]);
-  Path jmods = work.resolve("jmods");
-  var javaBase = ClassFile.of().parse(modules.resolve("java.base/module-info.class"));
-  String platform = javaBase.findAttribute(Attributes.moduleTarget()).orElseThrow().targetPlatform().stringValue();
-  Files.createDirectories(jmods);
-  List<String> names = new ArrayList<>();
-  try (Stream<Path> dirs = Files.list(modules)) {
-    for (Path dir : dirs.sorted().toList()) {
-      String name = dir.getFileName().toString();
-      Path classes = work.resolve("classes").resolve(name);
-      int copied = 0;
-      try (Stream<Path> files = Files.walk(dir)) {
-        for (Path f : files.filter(Files::isRegularFile).toList()) {
-          if (f.toString().endsWith(".class")) continue;
-          Path to = classes.resolve(dir.relativize(f).toString());
-          Files.createDirectories(to.getParent());
-          Files.copy(f, to);
-          copied++;
-        }
-      }
-      if (copied == 0) continue;
-      ModuleAttribute module = ModuleAttribute.of(ModuleDesc.of(name), b -> {
-        b.moduleVersion(Runtime.version().toString());
-        if (!name.equals("java.base")) b.requires(ModuleDesc.of("java.base"), ClassFile.ACC_MANDATED, null);
-      });
-      Files.write(classes.resolve("module-info.class"), ClassFile.of().buildModule(module));
-      run("jmod", "create", "--target-platform", platform, "--class-path", classes.toString(), jmods.resolve(name + ".jmod").toString());
-      names.add(name);
-    }
-  }
-  Path linked = work.resolve("image");
-  run("jlink", "--module-path", jmods.toString(), "--add-modules", String.join(",", names),
-      "--output", linked.toString(), "--disable-plugin", "system-modules", "--disable-plugin", "generate-jli-classes");
-  Files.createDirectories(image.getParent());
-  Files.move(linked.resolve("lib/modules"), image, java.nio.file.StandardCopyOption.REPLACE_EXISTING);
-}
-
-void run(String tool, String... args) throws IOException {
-  int rc = ToolProvider.findFirst(tool).orElseThrow().run(System.out, System.err, args);
-  if (rc != 0) throw new IOException(tool + " failed with exit code " + rc);
-}
diff --git a/scripts/UndoJlink.java b/scripts/UndoJlink.java
new file mode 100644
index 0000000..8eca5dc
--- /dev/null
+++ b/scripts/UndoJlink.java
@@ -0,0 +1,22 @@
+import java.io.DataInputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+void main(String[] args) throws Exception {
+  Path src = Path.of(args[0]);
+  Path diff = src.resolve("jdk.jlink/jdk/tools/jlink/internal/runtimelink/diff_java.base");
+  try (var in = new DataInputStream(Files.newInputStream(diff))) {
+    in.readInt();
+    for (int n = in.readInt(); n > 0; n--) {
+      short kind = in.readShort();
+      String name = new String(in.readNBytes(in.readInt()));
+      byte[] original = in.readNBytes(in.readInt());
+      Path file = src.resolve(name.substring(1));
+      if (kind == 1) Files.deleteIfExists(file);
+      else {
+        Files.createDirectories(file.getParent());
+        Files.write(file, original);
+      }
+    }
+  }
+}
diff --git a/scripts/build-jdk.sh b/scripts/build-jdk.sh
index 4a82525..2196547 100644
--- a/scripts/build-jdk.sh
+++ b/scripts/build-jdk.sh
@@ -1,7 +1,5 @@
 #!/usr/bin/env bash
-# Builds build/jdk, the java.home the JVM runs on: the Linux x64 JDK 25 class
-# library in the exploded layout (modules/<module>/...) instead of a
-# lib/modules jimage, so classes and resources are plain files.
+# Builds a linked Linux x64 java.home for the VM on every host.
 set -euo pipefail
 
 cd "$(dirname "$0")/.."
@@ -51,12 +49,12 @@ mkdir -p build
 ln -sfn "$JAVA_HOME" build/hotspot
 
 # The image comes from the Linux x64 JDK on every host, since the natives are
-# the Linux ones. Temurin ships no jmods, so jlink cannot link it: the modules
-# are extracted from its lib/modules and selected by scripts/LinuxImage.java.
+# the Linux ones. Extract its modules for jlink and restore their original
+# contents before linking.
 linux=$(jdk_home x64_linux)
 src=build/jdk-src
-rm -rf "$src" "$out"
-mkdir -p "$src" "$out/modules"
+rm -rf "$src" "$out" build/jdk-linked
+mkdir -p "$src" "$out"
 "$JAVA_HOME/bin/jimage" extract --dir "$src" "$linux/lib/modules"
 
 # javaweb.tls is java-web's own TLS pass-through provider (scripts/tls), built
@@ -65,18 +63,35 @@ mkdir -p "$src" "$out/modules"
 "$JAVA_HOME/bin/javac" -d "$src/javaweb.tls" $(find scripts/tls -name '*.java')
 
 "$JAVA_HOME/bin/java" scripts/LinuxImage.java "$linux" "$src" "$modules" "$out"
-rm -rf "$src"
+"$JAVA_HOME/bin/java" scripts/UndoJlink.java "$src"
 
-# Without the generated SystemModules classes the JDK finds its modules by
-# reading module-info.class files from the exploded tree.
-"$JAVA_HOME/bin/java" scripts/ExplodedModuleInfo.java "$out"/modules/*/module-info.class
+# java.base records a hash of each JDK module linked with it, and the JDK leaves
+# those modules' versions out of stack traces. jlink cannot hash module
+# directories, so the modules go into jmods (with fixed timestamps, so the image
+# comes out the same every time) and java.base.jmod records their hashes anew,
+# for the modules Temurin's java.base records.
+linked=$(sed -n 's/^MODULES="\(.*\)"/\1/p' "$out/release")
+hashed=$("$JAVA_HOME/bin/java" scripts/HashedModules.java "$src/java.base/module-info.class" "$linked")
+"$JAVA_HOME/bin/java" scripts/ExplodedModuleInfo.java "$src"/*/module-info.class
+jmods=build/jdk-jmods
+rm -rf "$jmods"
+mkdir -p "$jmods"
+date=2025-01-01T00:00:00Z
+for m in $linked; do
+  [ "$m" = java.base ] || "$JAVA_HOME/bin/jmod" create --date "$date" --class-path "$src/$m" "$jmods/$m.jmod"
+done
+"$JAVA_HOME/bin/jmod" create --date "$date" --class-path "$src/java.base" --module-path "$jmods" --hash-modules "$hashed" "$jmods/java.base.jmod"
+"$JAVA_HOME/bin/jlink" --module-path "$jmods" --add-modules "$modules" --output build/jdk-linked
+rm -rf "$jmods"
+mkdir -p "$out/lib"
+cp build/jdk-linked/lib/modules "$out/lib/modules"
+rm -rf build/jdk-linked
 
-# jrt: URLs read their resources through the jimage reader. Classes stay in
-# modules/, so the image holds only the other resources. It is not named
-# lib/modules, which would switch the JDK to image mode.
-work=$(mktemp -d "$PWD/build/work.XXXXXX")
-"$JAVA_HOME/bin/java" scripts/ResourceImage.java "$out/modules" "$work" "$out/lib/resources.jimage"
-rm -rf "$work"
+# Index the packages in the linked modules.
+(cd "$src" && export LC_ALL=C && for m in $(sed -n 's/^MODULES="\(.*\)"/\1/p' "$OLDPWD/$out/release"); do
+  find "$m" -mindepth 2 -name '*.class' | sed 's|/[^/]*$||' | sort -u | sed "s|^$m/||;s|^|$m |"
+done) > "$out/lib/packages.txt"
+rm -rf "$src"
 
 # The same provider list with JavaWebTLS first, for java.security.properties
 sec=$out/conf/security
@@ -110,11 +125,6 @@ mkdir -p "$out/lib/fonts"
 cp "$font_home/ttf/DejaVuSans.ttf" "$out/lib/fonts/"
 cp "$font_home/LICENSE" "$out/legal/java.desktop/dejavu-fonts.txt"
 
-# module -> packages index, so the boot loader can find a class without probing.
-(cd "$out/modules" && export LC_ALL=C && for m in *; do
-  find "$m" -mindepth 2 -name '*.class' | sed 's|/[^/]*$||' | sort -u | sed "s|^$m/||;s|^|$m |"
-done) > "$out/lib/packages.txt"
-
 # a digest of the whole image, which boot snapshots are made for
 (cd "$out" && node -e '
 const { createHash } = require("node:crypto");
diff --git a/scripts/build-web.ts b/scripts/build-web.ts
index 43cb66b..0efe88f 100644
--- a/scripts/build-web.ts
+++ b/scripts/build-web.ts
@@ -5,7 +5,7 @@
 
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";
 import { build } from "esbuild";
 import { MemoryBackend, VFS } from "../src/fs.ts";
@@ -85,6 +85,18 @@ class Recorder implements Backend {
   constructor(inner: Backend) { this.inner = inner; }
   stat(p: string) { return this.inner.stat(p); }
   list(p: string) { return this.inner.list(p); }
+  // parts of files read in ranges (the JDK image), as [start, end) by path
+  readonly ranges = new Map<string, [number, number][]>();
+  canReadRange(p: string) { return this.inner.canReadRange?.(p) ?? !!this.inner.readRange; }
+  readRange(p: string, off: number, len: number) {
+    const d = this.inner.readRange?.(p, off, len) ?? null;
+    if (d) {
+      let r = this.ranges.get(p);
+      if (!r) this.ranges.set(p, (r = []));
+      r.push([off, off + d.length]);
+    }
+    return d;
+  }
   read(p: string) {
     const d = this.inner.read(p);
     if (d) this.seen.add(p);
@@ -96,7 +108,6 @@ for (const main of ["Hello", "Primes", "Shapes"]) {
   const vfs = new VFS();
   vfs.mount("/", new MemoryBackend());
   vfs.mount("/jdk", recorder);
-  vfs.hide("/jdk/modules/jdk.localedata");
   vfs.mount("/tmp", new MemoryBackend());
   vfs.mount("/app", new NodeBackend(dist));
   const vm = new JVM({
@@ -114,7 +125,6 @@ const javacRecorder = new Recorder(new NodeBackend(jdk));
   const vfs = new VFS();
   vfs.mount("/", new MemoryBackend());
   vfs.mount("/jdk", javacRecorder);
-  vfs.hide("/jdk/modules/jdk.localedata");
   vfs.mount("/tmp", new MemoryBackend());
   vfs.mount("/files", new MemoryBackend());
   vfs.mount("/app", new NodeBackend(dist));
@@ -130,50 +140,64 @@ const javacRecorder = new Recorder(new NodeBackend(jdk));
   vm.halt(0);
 }
 const javacFiles = [...javacRecorder.seen].filter((p) => !recorder.seen.has(p)).sort();
+
+// Sorted [start, end) spans covering the given ones. Spans less than GAP apart
+// join, since a pack entry costs more than a few bytes of filler.
+const GAP = 256;
+function merge(spans: [number, number][]): [number, number][] {
+  const out: [number, number][] = [];
+  for (const [s, e] of [...spans].sort((a, b) => a[0] - b[0])) {
+    const last = out[out.length - 1];
+    if (last && s <= last[1] + GAP) last[1] = Math.max(last[1], e);
+    else out.push([s, e]);
+  }
+  return out;
+}
+// the parts of spans that covered leaves out
+function subtract(spans: [number, number][], covered: [number, number][]): [number, number][] {
+  const out: [number, number][] = [];
+  for (let [s, e] of spans) {
+    for (const [cs, ce] of covered) {
+      if (ce <= s || cs >= e) continue;
+      if (cs > s) out.push([s, cs]);
+      s = Math.max(s, ce);
+      if (s >= e) break;
+    }
+    if (s < e) out.push([s, e]);
+  }
+  return out;
+}
+const bootRanges = new Map([...recorder.ranges].map(([p, r]) => [p, merge(r)]));
+const javacRanges = new Map([...javacRecorder.ranges].map(([p, r]) => [p, subtract(merge(r), bootRanges.get(p) ?? [])]));
+const rangeEntries = (ranges: Map<string, [number, number][]>, src: Recorder) =>
+  [...ranges].flatMap(([p, spans]) => spans.map(([s, e]): [string, Uint8Array] => [`@${s}:${p}`, src.readRange(p, s, e - s)!]));
 const inJavacPack = new Set(javacFiles);
 
-// The image is one file per module, jdk/<module>.jar, read in ranges. Files
-// outside the modules go with java.base, which every start reads. The index
-// says where each file is, so the worker can stat and list offline. Files of a
-// package sit together, so one block read serves several classes.
+// Every java.home file goes in one file, jdk/image.jar, read in ranges:
+// lib/modules (the jimage with every class) and the conf/ and lib/ files
+// around it. The index says where each file is, so the worker can stat and
+// list offline.
 const lines: string[] = [];
-// a module's file lines, which a start parses only once it reads that module
-const moduleLines = new Map<string, string[]>();
-// jdk.localedata's lines go in jdk/jdk.localedata.txt, which a page fetches only with localeData on
-const localeLines: string[] = [];
-const images = new Map<string, { parts: Uint8Array[]; size: number }>();
-const imageOf = (rel: string) => /^\/modules\/([^/]+)\//.exec(rel)?.[1] ?? "java.base";
+const imageFile = join(dist, "jdk", "image.jar");
+writeFileSync(imageFile, "");
+let imageSize = 0;
 const walk = (dir: string) => {
   for (const name of readdirSync(dir).sort()) {
     const p = join(dir, name);
     const rel = "/" + relative(jdk, p);
     if (rel === "/legal") continue;
     const st = statSync(p);
-    const out = rel.startsWith("/modules/jdk.localedata") ? localeLines : lines;
     if (st.isDirectory()) {
-      out.push(`d ${rel}`);
+      lines.push(`d ${rel}`);
       walk(p);
     } else {
-      const name = imageOf(rel);
-      let image = images.get(name);
-      if (!image) images.set(name, (image = { parts: [], size: 0 }));
-      const module = out === lines ? /^\/modules\/([^/]+)\//.exec(rel)?.[1] : undefined;
-      let fileLines = out;
-      if (module) {
-        fileLines = moduleLines.get(module) ?? [];
-        moduleLines.set(module, fileLines);
-      }
-      fileLines.push(`f ${rel} ${st.size} ${name}:${image.size}${inJavacPack.has(rel) ? " javac" : ""}`);
-      image.parts.push(readFileSync(p));
-      image.size += st.size;
+      lines.push(`f ${rel} ${st.size} image:${imageSize}${inJavacPack.has(rel) ? " javac" : ""}`);
+      appendFileSync(imageFile, readFileSync(p));
+      imageSize += st.size;
     }
   }
 };
 walk(jdk);
-writeFileSync(join(dist, "jdk", "jdk.localedata.txt"), localeLines.join("\n"));
-for (const [name, image] of images) writeFileSync(join(dist, "jdk", `${name}.jar`), Buffer.concat(image.parts));
-const imageSize = [...images.values()].reduce((n, i) => n + i.size, 0);
-const largest = [...images].sort((a, b) => b[1].size - a[1].size)[0];
 // OpenJDK's licenses and notices ship next to the image as plain files
 cpSync(join(jdk, "legal"), join(dist, "jdk", "legal"), { recursive: true, dereference: true });
 
@@ -209,10 +233,20 @@ function prefixCode(lines: string[]) {
     return `${n} ${line.slice(n)}`;
   }).join("\n"));
 }
+const lazySpans = (name: string, ranges: Map<string, [number, number][]>): [string, Uint8Array][] => [...ranges].filter(([, r]) => r.length).map(([p, spans]) => {
+  const data = new Uint8Array(spans.length * 8);
+  const dv = new DataView(data.buffer);
+  spans.forEach(([s, e], i) => { dv.setUint32(i * 8, s); dv.setUint32(i * 8 + 4, e); });
+  return [`@lazy:${name}:${p}`, data];
+});
 const boot = writePack(join(dist, "boot.pack"), [
+  ...rangeEntries(bootRanges, recorder),
+  ...lazySpans("javac", javacRanges),
   ["/index.prefix", prefixCode(lines)],
-  ...[...moduleLines].map(([m, l]): [string, Uint8Array] => [`/index/${m}.prefix`, prefixCode(l)]),
   ...[...recorder.seen].sort().map((p): [string, Uint8Array] => [p, recorder.read(p)!]),
 ]);
-const javacPack = writePack(join(dist, "jdk", "javac.pack"), javacFiles.map((p) => [p, javacRecorder.read(p)!]));
-console.log(`dist/ ready: boot.pack ${boot}, jdk/javac.pack ${javacPack}, jdk/<module>.jar ${(imageSize / 2 ** 20).toFixed(0)} MB in ${images.size} files, the largest ${largest[0]} at ${(largest[1].size / 2 ** 20).toFixed(0)} MB`);
+const javacPack = writePack(join(dist, "jdk", "javac.pack"), [
+  ...javacFiles.map((p): [string, Uint8Array] => [p, javacRecorder.read(p)!]),
+  ...rangeEntries(javacRanges, javacRecorder),
+]);
+console.log(`dist/ ready: boot.pack ${boot}, jdk/javac.pack ${javacPack}, jdk/image.jar ${(imageSize / 2 ** 20).toFixed(0)} MB`);
diff --git a/scripts/hotspot.ts b/scripts/hotspot.ts
index 5455029..14a6287 100644
--- a/scripts/hotspot.ts
+++ b/scripts/hotspot.ts
@@ -1,4 +1,4 @@
 import { join } from "node:path";
 
 // A tool from the host's pinned JDK that `pnpm jdk` downloads
-export const hotspot = (tool: "java" | "javac" | "jar") => join(import.meta.dirname, "..", "build", "hotspot", "bin", tool);
+export const hotspot = (tool: "java" | "javac" | "jar" | "jimage") => join(import.meta.dirname, "..", "build", "hotspot", "bin", tool);
diff --git a/src/browser/http.ts b/src/browser/http.ts
index 0ca8baa..a60281b 100644
--- a/src/browser/http.ts
+++ b/src/browser/http.ts
@@ -12,6 +12,12 @@ export interface Pack {
   lazy: Map<string, string>;
   // path -> the image file holding it and its offset there
   offsets: Map<string, { image: string; at: number }>;
+  // path -> parts of a file read in ranges (the JDK image), as [offset, bytes]
+  // sorted by offset
+  ranges: Map<string, [number, Uint8Array][]>;
+  // path -> a lazily fetched pack with more parts of it, and their [start, end)
+  // offsets in pairs
+  lazyRanges: Map<string, { name: string; spans: number[] }>;
 }
 
 const utf8 = new TextDecoder();
@@ -19,8 +25,11 @@ const utf8 = new TextDecoder();
 // Pack layout: repeated [u16 path length][path][u32 size][bytes]. In the boot
 // pack, "/index.prefix" holds prefix-coded "d path" and "f path size
 // [image:offset] [pack]" lines. A file with an offset is read in ranges from
-// <image>.jar, one per module; a named pack is <name>.pack next to it and is
-// fetched whole the first time one of its files is read. Images are .jar
+// <image>.jar; a named pack is <name>.pack next to it and is
+// fetched whole the first time one of its files is read. An entry named
+// "@<offset>:<path>" holds part of a file read in ranges, and one named
+// "@lazy:<pack>:<path>" lists, as u32 start and end pairs, the parts of it
+// that pack holds. Images are .jar
 // files because static hosts such as GitHub Pages compress other types and
 // then apply Range to the compressed bytes; they leave .jar alone.
 export function parsePack(buf: ArrayBuffer): Pack {
@@ -35,45 +44,73 @@ export function parsePack(buf: ArrayBuffer): Pack {
     files.set(path, u8.subarray(p + 4, p + 4 + size));
     p += 4 + size;
   }
-  const pack: Pack = { files, index: null, lazy: new Map(), offsets: new Map() };
+  const pack: Pack = { files, index: null, lazy: new Map(), offsets: new Map(), ranges: new Map(), lazyRanges: new Map() };
+  for (const [p, data] of files) {
+    if (p[0] !== "@") continue;
+    files.delete(p);
+    const colon = p.indexOf(":");
+    if (p.startsWith("@lazy:")) {
+      const at = p.indexOf(":", 6);
+      const dv = new DataView(data.buffer, data.byteOffset, data.byteLength);
+      const spans = Array.from({ length: data.length / 4 }, (_, i) => dv.getUint32(i * 4));
+      pack.lazyRanges.set(p.slice(at + 1), { name: p.slice(6, at), spans });
+    } else {
+      const path = p.slice(colon + 1);
+      let parts = pack.ranges.get(path);
+      if (!parts) pack.ranges.set(path, (parts = []));
+      parts.push([Number(p.slice(1, colon)), data]);
+    }
+  }
+  for (const parts of pack.ranges.values()) parts.sort((a, b) => a[0] - b[0]);
   const raw = files.get("/index.prefix") ?? files.get("/index.txt");
   if (raw) {
-    pack.index = new PackIndex(pack);
+    pack.index = new PackIndex();
     addIndex(pack, utf8.decode(raw), files.has("/index.prefix"));
     files.delete("/index.txt");
     files.delete("/index.prefix");
-    for (const [p, data] of files) {
-      if (!p.startsWith("/index/")) continue;
-      pack.index.modules.set(p.slice(7, -7), data);
-      files.delete(p);
-    }
   }
   return pack;
 }
 
-// A pack's index. A module's file lines ("/index/<module>.prefix") are parsed
-// the first time a path in that module is looked up, since a start reads few
-// of the image's modules.
+// Adds a lazily fetched pack's files and ranges to pack.
+export function addPack(pack: Pack, more: Pack) {
+  for (const [p, d] of more.files) pack.files.set(p, d);
+  for (const [p, parts] of more.ranges) {
+    const all = [...(pack.ranges.get(p) ?? []), ...parts].sort((a, b) => a[0] - b[0]);
+    pack.ranges.set(p, all);
+  }
+}
+
+// Bytes [off, off + len) of path if one packed part holds them all.
+export function packedRange(pack: Pack, path: string, off: number, len: number): Uint8Array | undefined {
+  const parts = pack.ranges.get(path);
+  if (!parts) return undefined;
+  let lo = 0, hi = parts.length - 1;
+  while (lo < hi) {
+    const mid = (lo + hi + 1) >> 1;
+    if (parts[mid][0] <= off) lo = mid;
+    else hi = mid - 1;
+  }
+  const [start, data] = parts[lo];
+  return start <= off && off + len <= start + data.length ? data.subarray(off - start, off - start + len) : undefined;
+}
+
+// The lazy pack holding byte off of path, if it has not been added yet.
+function lazyRangePack(pack: Pack, path: string, off: number): string | undefined {
+  const lazy = pack.lazyRanges.get(path);
+  if (!lazy) return undefined;
+  for (let i = 0; i < lazy.spans.length; i += 2) if (lazy.spans[i] <= off && off < lazy.spans[i + 1]) return lazy.name;
+  return undefined;
+}
+
+// A pack's index, with each directory's names listed once they are asked for.
 export class PackIndex extends Map<string, number> {
-  readonly modules = new Map<string, Uint8Array>();
-  private readonly pack: Pack;
   // directory -> names in it, built for the entries there were at the time
   private dirs: Map<string, string[]> | null = null;
   private dirsSize = 0;
 
-  constructor(pack: Pack) {
+  constructor() {
     super([["/", -1]]);
-    this.pack = pack;
-  }
-
-  override get(path: string) {
-    this.load(path);
-    return super.get(path);
-  }
-
-  override has(path: string) {
-    this.load(path);
-    return super.has(path);
   }
 
   // The names in each directory. Entries are only ever added, so a change in
@@ -94,18 +131,6 @@ export class PackIndex extends Map<string, number> {
     return dirs;
   }
 
-  // Parses the lines of the module path is in. The module directories
-  // themselves are in the main index.
-  load(path: string) {
-    if (this.modules.size === 0 || !path.startsWith("/modules/")) return;
-    const end = path.indexOf("/", 9);
-    if (end < 0) return;
-    const module = path.slice(9, end);
-    const raw = this.modules.get(module);
-    if (!raw) return;
-    this.modules.delete(module);
-    addIndex(this.pack, utf8.decode(raw), true);
-  }
 }
 
 // Adds index lines to a pack that has an index. Runs on every start, so it
@@ -180,7 +205,7 @@ export class HttpBackend implements Backend {
   // 64 KB blocks of files read in parts, by path
   private blocks = new Map<string, Map<number, Uint8Array>>();
 
-  constructor(base: string, pack: Pack = { files: new Map(), index: null, lazy: new Map(), offsets: new Map() }) {
+  constructor(base: string, pack: Pack = { files: new Map(), index: null, lazy: new Map(), offsets: new Map(), ranges: new Map(), lazyRanges: new Map() }) {
     this.base = base.endsWith("/") ? base.slice(0, -1) : base;
     this.pack = pack;
   }
@@ -237,7 +262,7 @@ export class HttpBackend implements Backend {
     if (name !== undefined && !this.fetchedPacks.has(name)) {
       this.fetchedPacks.add(name);
       const xhr = this.request("GET", `/${name}.pack`);
-      if (xhr) for (const [p, d] of parsePack(xhr.response as ArrayBuffer).files) this.pack.files.set(p, d);
+      if (xhr) addPack(this.pack, parsePack(xhr.response as ArrayBuffer));
       return this.read(path);
     }
     if (this.cache.has(path)) return this.cache.get(path)!;
@@ -255,6 +280,15 @@ export class HttpBackend implements Backend {
     const whole = this.pack.files.get(path) ?? this.cache.get(path);
     if (whole) return whole.subarray(off, off + len);
     if (len === 0) return new Uint8Array(0);
+    const part = packedRange(this.pack, path, off, len);
+    if (part) return part;
+    const lazy = lazyRangePack(this.pack, path, off);
+    if (lazy !== undefined && !this.fetchedPacks.has(lazy)) {
+      this.fetchedPacks.add(lazy);
+      const xhr = this.request("GET", `/${lazy}.pack`);
+      if (xhr) addPack(this.pack, parsePack(xhr.response as ArrayBuffer));
+      return this.readRange(path, off, len);
+    }
     // has() parses the path's module first; image files themselves are not indexed
     const at = this.pack.index?.has(path) ? this.pack.offsets.get(path) : undefined;
     if (at !== undefined) return this.readRange(at.image, at.at + off, len);
@@ -317,7 +351,5 @@ export class HttpBackend implements Backend {
 // The names in a directory of a pack index, or null if path is not one.
 export function listIndex(idx: PackIndex, path: string): string[] | null {
   if (idx.get(path) !== -1) return null;
-  const prefix = path === "/" ? "/" : path + "/";
-  idx.load(prefix);
   return [...(idx.children().get(path) ?? [])];
 }
diff --git a/src/browser/worker.ts b/src/browser/worker.ts
index 335cde4..e8876b2 100644
--- a/src/browser/worker.ts
+++ b/src/browser/worker.ts
@@ -4,7 +4,7 @@
 
 import { MemoryBackend, VFS } from "../fs.ts";
 import { JVM, SnapshotError } from "../jvm.ts";
-import { HttpBackend, addIndex, parsePack } from "./http.ts";
+import { HttpBackend, parsePack } from "./http.ts";
 import { dropSnapshot, loadSnapshot, persist, saveSnapshot } from "./idb.ts";
 import type { SnapshotImage } from "../snapshot.ts";
 import type { LibraryError, LibraryReply } from "../library.ts";
@@ -75,12 +75,6 @@ async function init(m: InitMessage) {
   userFiles.putDir("/uploads");
   vfs = new VFS();
   vfs.mount("/", new MemoryBackend());
-  // the boot pack's index leaves jdk.localedata out; its own index adds it
-  if (m.localeData) {
-    const idx = await fetch(new URL("jdk/jdk.localedata.txt", m.runtime));
-    if (!idx.ok) throw new Error(`cannot load ${idx.url}: ${idx.status}`);
-    addIndex(pack, await idx.text());
-  }
   vfs.mount("/jdk", new HttpBackend(new URL("jdk/", m.runtime).href, pack));
   vfs.mount("/app", new HttpBackend(m.app));
   vfs.mount("/files", userFiles);
@@ -167,6 +161,7 @@ function newVm(classpath: string[], vmId: number): JVM {
     // javaProperties can set user.dir, which is then the working directory
     cwd: config!.props["user.dir"] ?? "/files",
     // System.loadLibrary would warn about native access, but its libraries are the page's JS modules
+    localeData: config!.localeData,
     props: { "java.io.tmpdir": "/tmp", "user.home": "/files", "jdk.module.enable.native.access.0": "ALL-UNNAMED", ...config!.props },
     stdout: (data) => post({ type: "out", fd: 1, data }, [data.buffer as ArrayBuffer]),
     stderr: (data) => post({ type: "out", fd: 2, data }, [data.buffer as ArrayBuffer]),
diff --git a/src/fs.ts b/src/fs.ts
index 3b8d26f..9f65408 100644
--- a/src/fs.ts
+++ b/src/fs.ts
@@ -22,6 +22,7 @@ export interface Backend {
   read(path: string): Uint8Array | null;
   // bytes [off, off + len) of a file, for backends that can read part of one
   readRange?(path: string, off: number, len: number): Uint8Array | null;
+  canReadRange?(path: string): boolean;
   list(path: string): string[] | null;
   write?(path: string, data: Uint8Array): boolean;
   // the errno code (such as "ENOSPC") of the last failed write to path
@@ -133,7 +134,7 @@ export class VFS {
   // Whether part of a file can be read without reading all of it.
   canReadRange(path: string): boolean {
     const r = this.resolve(path);
-    return !!r && !!r[0].readRange;
+    return !!r && !!r[0].readRange && (r[0].canReadRange?.(r[1]) ?? true);
   }
 
   readRange(path: string, off: number, len: number): Uint8Array | null {
diff --git a/src/image.ts b/src/image.ts
index 7a1c3b7..9bc3fed 100644
--- a/src/image.ts
+++ b/src/image.ts
@@ -1,27 +1,35 @@
 // The JDK image as `pnpm build` packages it in dist/, read from disk under
-// Node: boot.pack holds the index and the files a typical start reads, and
-// every other file is read at its offset in jdk/<module>.jar.
+// Node: boot.pack holds the index and the files and image ranges a typical
+// start reads, and the rest is read at its offset in jdk/image.jar.
 
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { addIndex, listIndex, parsePack } from "./browser/http.ts";
+import { listIndex, packedRange, parsePack } from "./browser/http.ts";
 import type { Pack } from "./browser/http.ts";
 import type { Backend, Stat } from "./fs.ts";
 
+// The JDK image is read for every boot class, by every VM in the process, so
+// each image file stays open once opened.
+const imageFds = new Map<string, number>();
+export function imageFd(file: string): number {
+  let fd = imageFds.get(file);
+  if (fd === undefined) imageFds.set(file, (fd = fs.openSync(file, "r")));
+  return fd;
+}
+
 export class ImageBackend implements Backend {
   readonly writable = false;
   private readonly dir: string;
   private readonly pack: Pack;
 
-  // dir holds boot.pack and jdk/; localeData adds jdk.localedata's files
-  constructor(dir: string, localeData = false) {
+  // dir holds boot.pack and jdk/
+  constructor(dir: string) {
     this.dir = path.resolve(dir);
-    if (!fs.existsSync(path.join(this.dir, "jdk", "java.base.jar"))) {
+    if (!fs.existsSync(path.join(this.dir, "jdk", "image.jar"))) {
       throw new Error(`no packaged JDK image in ${this.dir}: boot.pack needs jdk/ next to it`);
     }
     const buf = fs.readFileSync(path.join(this.dir, "boot.pack"));
     this.pack = parsePack(buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength));
-    if (localeData) addIndex(this.pack, fs.readFileSync(path.join(this.dir, "jdk", "jdk.localedata.txt"), "utf8"));
   }
 
   stat(p: string): Stat | null {
@@ -40,20 +48,18 @@ export class ImageBackend implements Backend {
     len = Math.max(0, Math.min(len, size - off));
     const packed = this.pack.files.get(p);
     if (packed) return packed.subarray(off, off + len);
+    const part = packedRange(this.pack, p, off, len);
+    if (part) return part;
     const at = this.pack.offsets.get(p);
     if (!at) return null;
     const out = new Uint8Array(len);
     let n = 0;
     try {
-      const fd = fs.openSync(path.join(this.dir, "jdk", at.image), "r");
-      try {
-        while (n < len) {
-          const got = fs.readSync(fd, out, n, len - n, at.at + off + n);
-          if (got === 0) break;
-          n += got;
-        }
-      } finally {
-        fs.closeSync(fd);
+      const fd = imageFd(path.join(this.dir, "jdk", at.image));
+      while (n < len) {
+        const got = fs.readSync(fd, out, n, len - n, at.at + off + n);
+        if (got === 0) break;
+        n += got;
       }
     } catch {
       return null;
diff --git a/src/jimage.ts b/src/jimage.ts
new file mode 100644
index 0000000..81bc55e
--- /dev/null
+++ b/src/jimage.ts
@@ -0,0 +1,80 @@
+import type { VFS } from "./fs.ts";
+
+// Uncompressed jlink image. Only the index is kept in memory.
+export class JImage {
+  private readonly index: Uint8Array;
+  private readonly view: DataView;
+  private readonly count: number;
+  private readonly locations: number;
+  private readonly strings: number;
+
+  private readonly fs: VFS;
+  private readonly path: string;
+
+  constructor(fs: VFS, path: string) {
+    this.fs = fs;
+    this.path = path;
+    const header = fs.readRange(path, 0, 28);
+    if (!header || header.length !== 28) throw new Error(`cannot read image header: ${path}`);
+    const h = new DataView(header.buffer, header.byteOffset, header.byteLength);
+    if (h.getUint32(0, true) !== 0xcafedada || h.getUint32(4, true) !== 0x10000) throw new Error(`invalid image: ${path}`);
+    this.count = h.getUint32(16, true);
+    this.locations = 28 + this.count * 8;
+    this.strings = this.locations + h.getUint32(20, true);
+    const size = this.strings + h.getUint32(24, true);
+    const index = fs.readRange(path, 0, size);
+    if (!index || index.length !== size) throw new Error(`cannot read image index: ${path}`);
+    this.index = index;
+    this.view = new DataView(index.buffer, index.byteOffset, index.byteLength);
+  }
+
+  read(module: string, name: string): Uint8Array | null {
+    const full = `/${module}/${name}`;
+    const utf = modifiedUtf8(full);
+    // ImageStringsReader.hashCode
+    const hash = (seed: number) => {
+      for (const b of utf) seed = Math.imul(seed, 0x01000193) ^ b;
+      return (seed & 0x7fffffff) % this.count;
+    };
+    const redirect = this.view.getInt32(28 + hash(0x01000193) * 4, true);
+    if (!redirect) return null;
+    const slot = redirect < 0 ? -redirect - 1 : hash(redirect);
+    let p = this.locations + this.view.getUint32(28 + this.count * 4 + slot * 4, true);
+    const attrs = Array<number>(8).fill(0);
+    while (this.index[p] > 7) {
+      const b = this.index[p++];
+      let value = 0;
+      for (let n = (b & 7) + 1; n > 0; n--) value = value * 256 + this.index[p++];
+      attrs[b >> 3] = value;
+    }
+    const str = (off: number) => {
+      if (!off) return "";
+      const start = this.strings + off;
+      let value = "";
+      for (let i = start; this.index[i]; i++) {
+        const b = this.index[i];
+        if (b < 0x80) value += String.fromCharCode(b);
+        else if (b < 0xe0) value += String.fromCharCode(((b & 31) << 6) | (this.index[++i] & 63));
+        else value += String.fromCharCode(((b & 15) << 12) | ((this.index[++i] & 63) << 6) | (this.index[++i] & 63));
+      }
+      return value;
+    };
+    const actual = `/${str(attrs[1])}/${attrs[2] ? str(attrs[2]) + "/" : ""}${str(attrs[3])}${attrs[4] ? "." + str(attrs[4]) : ""}`;
+    if (actual !== full) return null;
+    if (attrs[6]) throw new Error("compressed jimage resource");
+    const data = this.fs.readRange(this.path, this.index.length + attrs[5], attrs[7]);
+    if (!data || data.length !== attrs[7]) throw new Error(`cannot read image resource: ${full}`);
+    return data;
+  }
+}
+
+function modifiedUtf8(s: string): number[] {
+  const out: number[] = [];
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c !== 0 && c < 0x80) out.push(c);
+    else if (c < 0x800) out.push(0xc0 | (c >> 6), 0x80 | (c & 63));
+    else out.push(0xe0 | (c >> 12), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));
+  }
+  return out;
+}
diff --git a/src/jvm.ts b/src/jvm.ts
index 6b2f6c3..6a8ad70 100644
--- a/src/jvm.ts
+++ b/src/jvm.ts
@@ -7,6 +7,7 @@ import type { ClassFile } from "./classfile.ts";
 import { deliver, raise, runThread } from "./interp.ts";
 import { NativeMemory } from "./memory.ts";
 import type { VFS } from "./fs.ts";
+import { JImage } from "./jimage.ts";
 import {
   ACC_ABSTRACT, ACC_FINAL, ACC_INTERFACE, ACC_NATIVE, ACC_PRIVATE, ACC_PROTECTED, ACC_PUBLIC,
   ACC_STATIC, ACC_SUPER, ACC_VARARGS, ERRONEOUS, INITIALIZED, INITIALIZING, JArray, JClass, JField,
@@ -42,6 +43,7 @@ export interface JvmOptions {
   // VFS path of java.home (the output of scripts/build-jdk.sh)
   javaHome: string;
   classpath?: string[];
+  localeData?: boolean;
   props?: Record<string, string>;
   stdout: (b: Uint8Array) => void;
   stderr: (b: Uint8Array) => void;
@@ -109,6 +111,7 @@ export class JVM {
   readonly fs: VFS;
   readonly mem = new NativeMemory();
   readonly boot = new Map<string, JClass>();
+  private readonly image: JImage | null;
   // package -> module, for boot classes
   readonly bootPackages = new Map<string, string>();
   // Module objects defined to the boot loader, by name
@@ -165,17 +168,31 @@ export class JVM {
     }
     this.exited = new Promise((r) => (this.exitResolve = r));
     for (const [k, fn] of Object.entries(builtinNatives)) this.natives.set(k, fn);
+    const imagePath = `${opts.javaHome}/lib/modules`;
+    this.image = this.fs.stat(imagePath) ? new JImage(this.fs, imagePath) : null;
     const index = this.fs.read(`${opts.javaHome}/lib/packages.txt`);
     if (!index) throw new Error(`no JDK at ${opts.javaHome}; run pnpm jdk`);
-    // modules the file system hides are left out
+    // Locale data is left out as --limit-modules would leave it, unless asked
+    // for, or named by --add-modules (by name or as ALL-SYSTEM). A limit given
+    // by the caller keeps it only if it names it, since no module requires it.
+    const addmods = [...this.props].filter(([k]) => k.startsWith("jdk.module.addmods.")).flatMap(([, v]) => v.split(","));
+    const limit = this.props.get("jdk.module.limitmods");
+    const noLocales = this.image !== null && (limit !== undefined ? !limit.split(",").includes("jdk.localedata")
+      : !opts.localeData && !addmods.some((m) => m === "ALL-SYSTEM" || m === "jdk.localedata"));
     const present = new Map<string, boolean>();
     for (const line of new TextDecoder().decode(index).split("\n")) {
       const sp = line.indexOf(" ");
       if (sp <= 0) continue;
       const mod = line.slice(0, sp);
       let has = present.get(mod);
-      if (has === undefined) present.set(mod, (has = this.fs.stat(`${opts.javaHome}/modules/${mod}`) !== null));
-      if (has) this.bootPackages.set(line.slice(sp + 1), mod);
+      if (has === undefined) present.set(mod, (has = this.image !== null || this.fs.stat(`${opts.javaHome}/modules/${mod}`) !== null));
+      if (has && !(noLocales && mod === "jdk.localedata")) this.bootPackages.set(line.slice(sp + 1), mod);
+    }
+    if (noLocales && limit === undefined) {
+      const release = this.fs.read(`${opts.javaHome}/release`);
+      const modules = release && /(?:^|\n)MODULES="([^"]+)"/.exec(new TextDecoder().decode(release));
+      if (!modules) throw new Error("JDK release has no module list");
+      this.props.set("jdk.module.limitmods", modules[1].split(" ").filter((m) => m !== "jdk.localedata").join(","));
     }
   }
 
@@ -212,7 +229,7 @@ export class JVM {
     const i = name.lastIndexOf("/");
     const module = this.bootPackages.get(i < 0 ? "" : name.slice(0, i));
     if (!module) return null;
-    const bytes = this.fs.read(`${this.opts.javaHome}/modules/${module}/${name}.class`);
+    const bytes = this.image ? this.image.read(module, `${name}.class`) : this.fs.read(`${this.opts.javaHome}/modules/${module}/${name}.class`);
     if (!bytes) return null;
     const cf = parseClass(bytes);
     const superclass = cf.superName ? this.loadBootOrFail(cf.superName) : null;
@@ -682,13 +699,10 @@ export class JVM {
   }
 
   // ModuleEntry::should_show_version: the JDK's own modules show no version.
-  // They are in the image's modules/ directory here, at jrt:/ on HotSpot.
   shownVersion(mod: JObject): string | null {
     const version = mod.x?.version as string | null | undefined;
     if (!version || !this.getField(mod, "java/lang/Module", "name")) return null;
-    const image = `file://${this.opts.javaHome}/modules/`;
-    const loc = (mod.x.location as string | null) ?? "";
-    const jrt = loc.startsWith(image) ? `jrt:/${loc.slice(image.length)}` : loc;
+    const jrt = (mod.x.location as string | null) ?? "";
     const loader = this.getField(mod, "java/lang/Module", "loader") as JObject | null;
     const platform = loader?.cls.name === "jdk/internal/loader/ClassLoaders$PlatformClassLoader";
     const builtin = !loader || platform || loader.cls.name === "jdk/internal/loader/ClassLoaders$AppClassLoader";
diff --git a/src/memory.ts b/src/memory.ts
index 94f69f3..e175ac8 100644
--- a/src/memory.ts
+++ b/src/memory.ts
@@ -34,16 +34,20 @@ export class NativeMemory {
     this.dv = new DataView(next);
   }
 
-  malloc(n: number): number {
+  malloc(n: number, alignment = ALIGN): number {
     const size = Math.max(ALIGN, Math.ceil(n / ALIGN) * ALIGN);
     const list = this.free.get(size);
-    if (list && list.length > 0) {
-      const addr = list.pop()!;
+    const reuse = list?.findIndex((addr) => addr % alignment === 0) ?? -1;
+    if (list && reuse >= 0) {
+      // the order of a free list does not matter, so the last block fills the gap
+      const addr = list[reuse];
+      list[reuse] = list[list.length - 1];
+      list.pop();
       this.sizes.set(addr, size);
       return addr;
     }
-    const addr = this.top;
-    this.top += size;
+    const addr = Math.ceil(this.top / alignment) * alignment;
+    this.top = addr + size;
     if (this.top > this.buf.byteLength) this.grow(this.top);
     this.sizes.set(addr, size);
     return addr;
diff --git a/src/natives/lang.ts b/src/natives/lang.ts
index 10229f7..c5c51d1 100644
--- a/src/natives/lang.ts
+++ b/src/natives/lang.ts
@@ -356,7 +356,9 @@ export function fillElement(t: JThread, e: JObject, c: JClass, method: string, p
     const name = vm.getField(mod, "java/lang/Module", "name");
     if (name) {
       vm.setField(e, S, "moduleName", name);
-      const version = vm.shownVersion(mod);
+      // every version, as java_lang_StackTraceElement::fill_in sets it;
+      // toString leaves out the JDK's own
+      const version = mod.x?.version as string | null | undefined;
       if (version) vm.setField(e, S, "moduleVersion", vm.intern(version));
     }
   }
diff --git a/src/natives/misc.ts b/src/natives/misc.ts
index 3346579..c03ac20 100644
--- a/src/natives/misc.ts
+++ b/src/natives/misc.ts
@@ -301,6 +301,8 @@ export function vmProperties(vm: JVM): string[] {
     ["java.vm.version", "25"],
     ["java.vm.info", "interpreted mode"],
     ["jdk.debug", "release"],
+    ["jdk.image.map.all", "false"],
+    ["jdk.image.use.jvm.map", "false"],
     ["sun.java.launcher", "SUN_STANDARD"],
     ["sun.nio.MaxDirectMemorySize", "-1"],
     ["sun.nio.PageAlignDirectMemory", "false"],
@@ -355,24 +357,6 @@ function* perfBuffer(t: JThread, size: number): NativeGen {
   return yield t.call(bb.methodMap.get("allocate(I)Ljava/nio/ByteBuffer;")!, size);
 }
 
-// The boot image as the JDK's jimage reader sees it. The image holds only
-// non-class resources and sits at lib/resources.jimage, not lib/modules,
-// because a lib/modules file makes the JDK and javac use image mode instead of
-// the exploded modules/ tree. The path the reader asks for stays unopened.
-function* nativeImageMap(t: JThread, path: string | null): NativeGen {
-  const vm = t.vm;
-  if (path !== `${vm.opts.javaHome}/lib/modules`) return null;
-  const data = vm.fs.read(`${vm.opts.javaHome}/lib/resources.jimage`);
-  if (!data) return null;
-  const addr = vm.mem.malloc(data.length);
-  vm.mem.u8.set(data, addr);
-  const dbb = vm.loadBoot("java/nio/DirectByteBuffer")!;
-  if (dbb.state !== INITIALIZED) yield* vm.initGen(t, dbb);
-  const buf = vm.newObject(dbb);
-  yield t.call(dbb.methodMap.get("<init>(JJ)V")!, buf, BigInt(addr), BigInt(data.length));
-  return buf;
-}
-
 // Nanoseconds since the epoch, finer than Date.now(). The performance clock
 // does not follow changes to the system clock, so it is used only while the
 // two agree.
@@ -406,7 +390,7 @@ export const natives: Natives = {
   "jdk/internal/loader/RawNativeLibraries.unload0(Ljava/lang/String;J)V": () => undefined,
   "jdk/internal/perf/Perf.createLong(Ljava/lang/String;IIJ)Ljava/nio/ByteBuffer;": (t) => perfBuffer(t, 8),
   "jdk/internal/perf/Perf.createByteArray(Ljava/lang/String;II[BI)Ljava/nio/ByteBuffer;": (t, [, , , , , max]) => perfBuffer(t, max),
-  "jdk/internal/jimage/NativeImageBuffer.getNativeMap(Ljava/lang/String;)Ljava/nio/ByteBuffer;": (t, [path]) => nativeImageMap(t, jstr(t, path)),
+  "jdk/internal/jimage/NativeImageBuffer.getNativeMap(Ljava/lang/String;)Ljava/nio/ByteBuffer;": () => null,
   "jdk/internal/perf/Perf.highResCounter()J": () => BigInt(Math.round(performance.now() * 1e6)),
   "jdk/internal/perf/Perf.highResFrequency()J": () => 1_000_000_000n,
   "jdk/internal/misc/VM.initialize()V": () => undefined,
diff --git a/src/natives/nio.ts b/src/natives/nio.ts
index 8276084..929f1a9 100644
--- a/src/natives/nio.ts
+++ b/src/natives/nio.ts
@@ -408,7 +408,7 @@ Object.assign(natives, {
   // writes only then.
   [`${UFD}map0(Ljava/io/FileDescriptor;IJJZ)J`]: (t: JThread, [fd, prot, pos, len]: any[]) => {
     const f = chanFile(t, fd);
-    const addr = t.vm.mem.malloc(Number(len));
+    const addr = t.vm.mem.malloc(Number(len), 4096);
     const save = f.pos;
     f.pos = Number(pos);
     const n = Math.min(f.size - Number(pos), Number(len));
diff --git a/src/node.ts b/src/node.ts
index 7238fda..c523f8e 100644
--- a/src/node.ts
+++ b/src/node.ts
@@ -14,7 +14,7 @@ import { Bridge, nativeTable } from "./bridge.ts";
 import { JVM, LM_CLASS, LM_JAR, SnapshotError } from "./jvm.ts";
 import type { SnapshotImage } from "./snapshot.ts";
 import { hostNatives } from "./hostnatives.ts";
-import { ImageBackend } from "./image.ts";
+import { ImageBackend, imageFd } from "./image.ts";
 import { NodeNet } from "./net-node.ts";
 import { PendingThrow } from "./thread.ts";
 import { setMaxHeap } from "./runtime.ts";
@@ -69,6 +69,27 @@ export class NodeBackend implements Backend {
       return null;
     }
   }
+  // Other open files keep their buffered contents even if the host removes them.
+  canReadRange(p: string) { return !this.writable && p === "/lib/modules"; }
+  readRange(p: string, off: number, len: number): Uint8Array | null {
+    const image = p === "/lib/modules" && !this.writable;
+    try {
+      const fd = image ? imageFd(this.host(p)) : fs.openSync(this.host(p), "r");
+      try {
+        if (!image && !fs.fstatSync(fd).isFile()) return null;
+        const out = new Uint8Array(len);
+        let n = 0;
+        while (n < len) {
+          const got = fs.readSync(fd, out, n, len - n, off + n);
+          if (!got) break;
+          n += got;
+        }
+        return out.subarray(0, n);
+      } finally {
+        if (!image) fs.closeSync(fd);
+      }
+    } catch { return null; }
+  }
   list(p: string) {
     if (!this.writable && this.lists.has(p)) return this.lists.get(p)!;
     let names: string[] | null;
@@ -171,7 +192,7 @@ export interface NodeRunOptions {
   jar?: string;
   args?: string[];
   props?: Record<string, string>;
-  // an exploded JDK image instead of build/jdk (or, for dist/node.js, the packaged one)
+  // a JDK image instead of build/jdk (or, for dist/node.js, the packaged one)
   jdk?: string;
   debug?: boolean;
   stdout?: (b: Uint8Array) => void;
@@ -324,8 +345,7 @@ function nodeVm(o: NodeRunOptions): JVM {
   if (!packaged && !fs.existsSync(path.join(jdk, "lib", "packages.txt"))) {
     throw new Error(`no JDK image at ${jdk}: run \`pnpm jdk\` in a checkout, or keep dist/node.js next to boot.pack and jdk/`);
   }
-  vfs.mount("/jdk", packaged ? new ImageBackend(here, o.localeData) : new NodeBackend(jdk));
-  if (!o.localeData) vfs.hide("/jdk/modules/jdk.localedata");
+  vfs.mount("/jdk", packaged ? new ImageBackend(here) : new NodeBackend(jdk));
   const toVfs = (p: string) => path.resolve(p);
   const classpath = o.jar ? [toVfs(o.jar)] : o.classpath.map(toVfs);
   const natives = o.natives ?? {};
@@ -339,6 +359,7 @@ function nodeVm(o: NodeRunOptions): JVM {
     ...(snapDir && build ? { snapshots: snapshotCache(snapDir, build) } : {}),
     fs: vfs,
     javaHome: "/jdk",
+    localeData: o.localeData,
     classpath,
     props: { "java.io.tmpdir": os.tmpdir(), "user.home": os.homedir(), "user.name": os.userInfo().username, ...o.props },
     cwd: toVfs(process.cwd()),
diff --git a/test/bridge.test.ts b/test/bridge.test.ts
index 8c884cc..b0d7429 100644
--- a/test/bridge.test.ts
+++ b/test/bridge.test.ts
@@ -11,7 +11,8 @@ import { libraryOf, startLibrary } from "../src/node.ts";
 import { hotspot } from "../scripts/hotspot.ts";
 
 const root = join(import.meta.dirname, "..");
-const out = join(root, "build", "test-library");
+// its own directory: library.test.ts compiles the same class at the same time
+const out = join(root, "build", "test-bridge");
 
 let vm: JVM;
 let lib: any;
diff --git a/test/image.test.ts b/test/image.test.ts
index f2f4a35..9a5751c 100644
--- a/test/image.test.ts
+++ b/test/image.test.ts
@@ -9,17 +9,17 @@ import { join } from "node:path";
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { ImageBackend } from "../src/image.ts";
-import { parsePack, listIndex } from "../src/browser/http.ts";
+import { listIndex, packedRange, parsePack } from "../src/browser/http.ts";
 import { hotspot } from "../scripts/hotspot.ts";
 
 const root = join(import.meta.dirname, "..");
 const enc = new TextEncoder();
 
 // the boot.pack layout: [u16 path length][path][u32 size][bytes], repeated
-function pack(entries: [string, string][]): Uint8Array {
+function pack(entries: [string, string | Uint8Array][]): Uint8Array {
   const parts: number[] = [];
   for (const [p, d] of entries) {
-    const name = enc.encode(p), data = enc.encode(d);
+    const name = enc.encode(p), data = typeof d === "string" ? enc.encode(d) : d;
     parts.push(name.length >> 8, name.length & 255, ...name);
     parts.push(data.length >>> 24, (data.length >> 16) & 255, (data.length >> 8) & 255, data.length & 255, ...data);
   }
@@ -30,13 +30,14 @@ test("ImageBackend reads the index, packed files and module images", () => {
   const dir = mkdtempSync(join(tmpdir(), "jw-image-"));
   try {
     mkdirSync(join(dir, "jdk"));
-    // java.base.jar holds "BOOTabcdef", the other image "XYZ"
-    writeFileSync(join(dir, "jdk", "java.base.jar"), "BOOTabcdef");
+    // image.jar holds "BOOTabcdef", the other image "XYZ"
+    writeFileSync(join(dir, "jdk", "image.jar"), "BOOTabcdef");
     writeFileSync(join(dir, "jdk", "jdk.other.jar"), "XYZ");
-    writeFileSync(join(dir, "jdk", "jdk.localedata.txt"), "d /modules/jdk.localedata\nf /modules/jdk.localedata/L 3 jdk.other:0");
     writeFileSync(join(dir, "boot.pack"), pack([
-      ["/index.txt", "d /lib\nf /lib/boot 4 java.base:0\nf /lib/rest 6 java.base:4\nf /lib/cut 6 jdk.other:1\nd /modules\nd /modules/jdk.other\nf /modules/jdk.other/x 3 jdk.other:0"],
+      ["/index.txt", "d /lib\nf /lib/boot 4 image:0\nf /lib/rest 6 image:4\nf /lib/cut 6 jdk.other:1\nd /modules\nd /modules/jdk.other\nf /modules/jdk.other/x 3 jdk.other:0"],
       ["/lib/boot", "BOOT"],
+      // a packed part of /lib/rest, which reads come from before the image
+      ["@1:/lib/rest", "BCD"],
     ]));
     const b = new ImageBackend(dir);
     assert.deepEqual(b.stat("/lib"), { dir: true, size: 0, mtime: 0 });
@@ -48,7 +49,8 @@ test("ImageBackend reads the index, packed files and module images", () => {
     const text = (d: Uint8Array | null) => d && new TextDecoder().decode(d);
     assert.equal(text(b.read("/lib/boot")), "BOOT");
     assert.equal(text(b.read("/lib/rest")), "abcdef");
-    assert.equal(text(b.readRange("/lib/rest", 2, 3)), "cde");
+    assert.equal(text(b.readRange("/lib/rest", 1, 2)), "BC");
+    assert.equal(text(b.readRange("/lib/rest", 3, 2)), "de");
     // a range is cut at the file's end, not read into the next file
     assert.equal(text(b.readRange("/lib/boot", 2, 10)), "OT");
     assert.equal(text(b.readRange("/lib/rest", 4, 10)), "ef");
@@ -56,9 +58,7 @@ test("ImageBackend reads the index, packed files and module images", () => {
     assert.equal(b.read("/lib"), null);
     // past the end of a damaged image
     assert.equal(b.read("/lib/cut"), null);
-    assert.equal(b.stat("/modules/jdk.localedata"), null);
-    assert.equal(text(new ImageBackend(dir, true).read("/modules/jdk.localedata/L")), "XYZ");
-    rmSync(join(dir, "jdk", "java.base.jar"));
+    rmSync(join(dir, "jdk", "image.jar"));
     assert.throws(() => new ImageBackend(dir), /no packaged JDK image/);
   } finally {
     rmSync(dir, { recursive: true, force: true });
@@ -66,30 +66,36 @@ test("ImageBackend reads the index, packed files and module images", () => {
 });
 
 test("compact index keeps paths, sizes, offsets, and directory order", () => {
-  const buf = pack([["/index.prefix", "0 d /lib\n0 f /lib/one 3 java.base:0\n7 two 4 java.base:3 javac\n0 d /modules"]]);
+  const buf = pack([["/index.prefix", "0 d /lib\n0 f /lib/one 3 image:0\n7 two 4 image:3 javac\n0 d /modules"]]);
   const image = parsePack(buf.buffer as ArrayBuffer);
   assert.deepEqual([...image.index!], [["/", -1], ["/lib", -1], ["/lib/one", 3], ["/lib/two", 4], ["/modules", -1]]);
   assert.deepEqual(listIndex(image.index!, "/lib"), ["one", "two"]);
-  assert.deepEqual(image.offsets.get("/lib/two"), { image: "/java.base.jar", at: 3 });
+  assert.deepEqual(image.offsets.get("/lib/two"), { image: "/image.jar", at: 3 });
   assert.equal(image.lazy.get("/lib/two"), "javac");
 });
 
-test("a module's index lines are parsed when a path in it is first looked up", () => {
+test("packed image ranges are found by offset, and a lazy pack lists its own", () => {
+  const spans = new Uint8Array(16);
+  const dv = new DataView(spans.buffer);
+  [100, 110, 200, 205].forEach((v, i) => dv.setUint32(i * 4, v));
   const buf = pack([
-    ["/index.prefix", "0 d /modules\n0 d /modules/a\n0 d /modules/a/p\n0 d /modules/b"],
-    ["/index/a.prefix", "0 f /modules/a/p/X.class 5 a:0\n15 Y.class 6 a:5 javac"],
-    ["/index/b.prefix", "0 f /modules/b/Z.class 7 b:0"],
+    ["@10:/lib/modules", "abcdef"],
+    ["@0:/lib/modules", "0123"],
+    ["@50:/lib/modules", "XY"],
+    ["@lazy:javac:/lib/modules", spans],
   ]);
   const image = parsePack(buf.buffer as ArrayBuffer);
+  const text = (d: Uint8Array | undefined) => d && new TextDecoder().decode(d);
   assert.equal(image.files.size, 0);
-  assert.equal(image.offsets.size, 0);
-  assert.deepEqual(listIndex(image.index!, "/modules/a/p"), ["X.class", "Y.class"]);
-  assert.equal(image.index!.get("/modules/a/p/Y.class"), 6);
-  assert.deepEqual(image.offsets.get("/modules/a/p/Y.class"), { image: "/a.jar", at: 5 });
-  assert.equal(image.lazy.get("/modules/a/p/Y.class"), "javac");
-  assert.equal(image.offsets.has("/modules/b/Z.class"), false);
-  assert.equal(image.index!.has("/modules/b/Z.class"), true);
-  assert.deepEqual(listIndex(image.index!, "/modules"), ["a", "b"]);
+  assert.equal(text(packedRange(image, "/lib/modules", 1, 3)), "123");
+  assert.equal(text(packedRange(image, "/lib/modules", 12, 4)), "cdef");
+  assert.equal(text(packedRange(image, "/lib/modules", 50, 2)), "XY");
+  // across two parts, past a part's end, or between parts: not packed
+  assert.equal(packedRange(image, "/lib/modules", 3, 8), undefined);
+  assert.equal(packedRange(image, "/lib/modules", 14, 3), undefined);
+  assert.equal(packedRange(image, "/lib/modules", 30, 1), undefined);
+  assert.equal(packedRange(image, "/lib/other", 0, 1), undefined);
+  assert.deepEqual(image.lazyRanges.get("/lib/modules"), { name: "javac", spans: [100, 110, 200, 205] });
 });
 
 const node = join(root, "dist", "node.js");
diff --git a/test/java/JrtUrls.java b/test/java/JrtUrls.java
index 6e01b70..ab2585b 100644
--- a/test/java/JrtUrls.java
+++ b/test/java/JrtUrls.java
@@ -60,6 +60,10 @@ public static void main(String[] args) throws Exception {
     var fs = FileSystems.getFileSystem(URI.create("jrt:/"));
     Path catalog = fs.getPath("/modules/java.xml/jdk/xml/internal/jdkcatalog/JDKCatalog.xml");
     System.out.println("jrt fs " + Files.size(catalog) + " bytes");
+    try (var entries = Files.list(fs.getPath("/modules/java.xml"))) {
+      System.out.println("java.xml entries " + entries.map(p -> p.getFileName().toString()).sorted().toList());
+    }
+    System.out.println("module " + DocumentBuilderFactory.class.getModule().getName());
 
     // the DTD comes from the JDK's built-in catalog, not the network
     String xhtml = "<?xml version=\"1.0\"?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" "
diff --git a/test/jimage.test.ts b/test/jimage.test.ts
new file mode 100644
index 0000000..02f8034
--- /dev/null
+++ b/test/jimage.test.ts
@@ -0,0 +1,36 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { test } from "node:test";
+import { hotspot } from "../scripts/hotspot.ts";
+import { JImage } from "../src/jimage.ts";
+import { VFS } from "../src/fs.ts";
+import { NodeBackend } from "../src/node.ts";
+
+test("jimage finds classes and rejects missing names", () => {
+  const fs = new VFS();
+  fs.mount("/jdk", new NodeBackend("build/jdk"));
+  const image = new JImage(fs, "/jdk/lib/modules");
+  for (const [module, name] of [["java.base", "java/lang/Object.class"], ["java.xml", "javax/xml/XMLConstants.class"]]) {
+    assert.deepEqual([...image.read(module, name)!.subarray(0, 4)], [0xca, 0xfe, 0xba, 0xbe]);
+  }
+  assert.equal(image.read("java.base", "java/lang/NoSuchClass.class"), null);
+  assert.equal(image.read("java.xml", "java/lang/Object.class"), null);
+});
+
+// Every resource the JDK's jimage tool lists, many of them behind a second
+// hash seed, comes back at its size.
+test("jimage reads every resource the jimage tool lists", () => {
+  const fs = new VFS();
+  fs.mount("/jdk", new NodeBackend("build/jdk"));
+  const image = new JImage(fs, "/jdk/lib/modules");
+  let module = "", n = 0;
+  for (const line of execFileSync(hotspot("jimage"), ["list", "--verbose", "build/jdk/lib/modules"], { encoding: "utf8", maxBuffer: 64 << 20 }).split("\n")) {
+    const m = /^Module: (\S+)/.exec(line);
+    if (m) module = m[1];
+    const r = /^\s+\d+\s+(\d+)\s+\d+\s+(\S.*)$/.exec(line);
+    if (!r) continue;
+    n++;
+    assert.equal(image.read(module, r[2])?.length, Number(r[1]), `${module}/${r[2]}`);
+  }
+  assert.ok(n > 20000, `only ${n} resources listed`);
+});
diff --git a/test/locales/Locales.java b/test/locales/Locales.java
index 149c5fb..4f1d1b5 100644
--- a/test/locales/Locales.java
+++ b/test/locales/Locales.java
@@ -9,6 +9,12 @@
 // Formats and names from jdk.localedata, for locales other than English.
 public class Locales {
   public static void main(String[] args) {
+    try {
+      Class.forName("sun.util.resources.cldr.ext.CurrencyNames_ru_KZ");
+      System.out.println("locale class present");
+    } catch (ClassNotFoundException e) {
+      System.out.println("locale class absent");
+    }
     LocalDate day = LocalDate.of(2026, 10, 30);
     for (Locale l : new Locale[] {Locale.US, Locale.GERMANY, Locale.FRANCE, Locale.JAPAN, Locale.forLanguageTag("pt-BR")}) {
       System.out.println(l + " " + String.format(l, "%,.2f", 1234567.891) + " | "
diff --git a/test/memory.test.ts b/test/memory.test.ts
new file mode 100644
index 0000000..ea35af7
--- /dev/null
+++ b/test/memory.test.ts
@@ -0,0 +1,12 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { NativeMemory } from "../src/memory.ts";
+
+test("mapped allocations are page aligned and reusable", () => {
+  const mem = new NativeMemory();
+  mem.malloc(32);
+  const page = mem.malloc(128, 4096);
+  assert.equal(page % 4096, 0);
+  mem.freeBlock(page);
+  assert.equal(mem.malloc(128, 4096), page);
+});
diff --git a/test/programs.test.ts b/test/programs.test.ts
index a4866d5..db15cef 100644
--- a/test/programs.test.ts
+++ b/test/programs.test.ts
@@ -184,14 +184,23 @@ test("locale data", async () => {
   const classes = join(root, "build", "test-locales");
   execFileSync(hotspot("javac"), ["-d", classes, join(root, "test", "locales", "Locales.java")]);
   const ref = spawnSync(hotspot("java"), ["-cp", classes, "Locales"], { encoding: "utf8" });
-  const run = async (localeData: boolean) => {
+  assert.equal(ref.status, 0, ref.stderr);
+  const run = async (localeData: boolean, props: Record<string, string> = {}) => {
     const stdout: Uint8Array[] = [];
-    const code = await runNode({ classpath: [classes], mainClass: "Locales", localeData, stdout: (b) => stdout.push(b) });
+    const code = await runNode({ classpath: [classes], mainClass: "Locales", localeData, props, stdout: (b) => stdout.push(b) });
     assert.equal(code, 0);
     return Buffer.concat(stdout).toString("utf8");
   };
   assert.equal(await run(true), ref.stdout);
-  assert.match(await run(false), /^de_DE 1,234,567\.89 /m);
+  // --add-modules=ALL-SYSTEM asks for every module, locale data included
+  assert.equal(await run(false, { "jdk.module.addmods.0": "ALL-SYSTEM" }), ref.stdout);
+  const modules = readFileSync(join(root, "build/jdk/release"), "utf8").match(/MODULES="([^"]+)"/)![1]
+    .split(" ").filter((m) => m !== "jdk.localedata" && m !== "javaweb.tls").join(",");
+  const limited = spawnSync(hotspot("java"), ["--limit-modules", modules, "-cp", classes, "Locales"], { encoding: "utf8" });
+  assert.equal(limited.status, 0, limited.stderr);
+  assert.equal(await run(false), limited.stdout);
+  // a limit the caller gives wins over localeData
+  assert.equal(await run(true, { "jdk.module.limitmods": modules }), limited.stdout);
 });
 
 // The host refuses these writes; root is allowed them, so the test needs a normal user.
diff --git a/test/snapshot.test.ts b/test/snapshot.test.ts
index f75dbf1..60095ba 100644
--- a/test/snapshot.test.ts
+++ b/test/snapshot.test.ts
@@ -80,6 +80,16 @@ test("other properties boot without the snapshot", async () => {
   assert.ok(!loaded(snap, ino));
 });
 
+test("locale data uses a separate snapshot", async () => {
+  const dir = cacheDir();
+  await run(dir);
+  await run(dir);
+  const [snap] = files(dir, ".snap");
+  const ino = age(snap);
+  await runNode({ classpath: [out], mainClass: "Boot", localeData: true, snapshotDir: dir, stdout: () => {} });
+  assert.ok(!loaded(snap, ino));
+});
+
 test("library mode restores its own snapshot", async () => {
   const dir = cacheDir();
   for (let i = 0; i < 2; i++) await run(dir);