Merge "runtimes/google/ipc/...: consistently return io.EOF to avoid spammy log messages."
diff --git a/lib/exec/exec_test.go b/lib/exec/exec_test.go
index a013d55..a1e77db 100644
--- a/lib/exec/exec_test.go
+++ b/lib/exec/exec_test.go
@@ -411,13 +411,12 @@
 }
 
 func TestWaitAndCleanRace(t *testing.T) {
-	name := "TestWaitAndCleanRace"
-	cmd := helperCommand("testReadySlow")
+	name := "testReadyAndHang"
+	cmd := helperCommand(name)
 	tk := timekeeper.NewManualTime()
 	ph := vexec.NewParentHandle(cmd, vexec.TimeKeeperOpt{tk})
-	err := ph.Start()
-	if err != nil {
-		t.Fatalf("%s: start: %v", name, err)
+	if err := waitForReady(t, cmd, name, 1, ph); err != nil {
+		t.Errorf("%s: WaitForReady: %v (%v)", name, err, ph)
 	}
 	go func() {
 		// Wait for the ph.Wait below to block, then advance the time
@@ -426,17 +425,17 @@
 		tk.AdvanceTime(2 * time.Second)
 	}()
 	if got, want := ph.Wait(time.Second), vexec.ErrTimeout; got == nil || got.Error() != want.Error() {
-		t.Fatalf("Wait returned %v, wanted %v instead", got, want)
+		t.Errorf("Wait returned %v, wanted %v instead", got, want)
 	}
 	if got, want := ph.Clean(), "signal: killed"; got == nil || got.Error() != want {
-		t.Fatalf("Wait returned %v, wanted %v instead", got, want)
+		t.Errorf("Wait returned %v, wanted %v instead", got, want)
 	}
 }
 
 func verifyNoExecVariable() {
 	version := os.Getenv(vexec.VersionVariable)
 	if len(version) != 0 {
-		log.Fatal(os.Stderr, "Version variable %q has a value: %s", vexec.VersionVariable, version)
+		log.Fatalf("Version variable %q has a value: %s", vexec.VersionVariable, version)
 	}
 }
 
@@ -452,7 +451,7 @@
 
 	version := os.Getenv(vexec.VersionVariable)
 	if len(version) == 0 {
-		log.Fatal(os.Stderr, "Version variable %q has no value", vexec.VersionVariable)
+		log.Fatalf("Version variable %q has no value", vexec.VersionVariable)
 	}
 
 	// Write errors to stderr or using log. since the parent
@@ -467,7 +466,7 @@
 	}
 
 	if len(args) == 0 {
-		log.Fatal(os.Stderr, "No command\n")
+		log.Fatal("No command")
 	}
 
 	cmd, args := args[0], args[1:]
@@ -476,20 +475,20 @@
 	case "exitEarly":
 		_, err := vexec.GetChildHandle()
 		if err != nil {
-			log.Fatal(os.Stderr, "%s\n", err)
+			log.Fatal(err)
 		}
 		os.Exit(1)
 	case "testNeverReady":
 		_, err := vexec.GetChildHandle()
 		if err != nil {
-			log.Fatal(os.Stderr, "%s\n", err)
+			log.Fatal(err)
 		}
 		verifyNoExecVariable()
 		fmt.Fprintf(os.Stderr, "never ready")
 	case "testTooSlowToReady":
 		ch, err := vexec.GetChildHandle()
 		if err != nil {
-			log.Fatal(os.Stderr, "%s\n", err)
+			log.Fatal(err)
 		}
 		verifyNoExecVariable()
 		// Wait for the parent to tell us when it's ok to proceed.
@@ -498,7 +497,7 @@
 			buf := make([]byte, 100)
 			n, err := controlPipe.Read(buf)
 			if err != nil {
-				log.Fatal(os.Stderr, "%s", err)
+				log.Fatal(err)
 			}
 			if n > 0 {
 				break
@@ -511,11 +510,10 @@
 		} else {
 			fmt.Fprintf(os.Stderr, "didn't get the expected error")
 		}
-		os.Exit(0)
 	case "testFail":
 		ch, err := vexec.GetChildHandle()
 		if err != nil {
-			log.Fatal(os.Stderr, "%s", err)
+			log.Fatal(err)
 		}
 		verifyNoExecVariable()
 		if err := ch.SetFailed(fmt.Errorf("%s", strings.Join(args, " "))); err != nil {
@@ -525,7 +523,7 @@
 	case "testReady":
 		ch, err := vexec.GetChildHandle()
 		if err != nil {
-			log.Fatal(os.Stderr, "%s", err)
+			log.Fatal(err)
 		}
 		verifyNoExecVariable()
 		ch.SetReady()
@@ -533,7 +531,7 @@
 	case "testReadySlow":
 		ch, err := vexec.GetChildHandle()
 		if err != nil {
-			log.Fatal(os.Stderr, "%s", err)
+			log.Fatal(err)
 		}
 		verifyNoExecVariable()
 		// Wait for the parent to tell us when it's ok to proceed.
@@ -542,7 +540,7 @@
 			buf := make([]byte, 100)
 			n, err := controlPipe.Read(buf)
 			if err != nil {
-				log.Fatal(os.Stderr, "%s", err)
+				log.Fatal(err)
 			}
 			if n > 0 {
 				break
@@ -550,10 +548,18 @@
 		}
 		ch.SetReady()
 		fmt.Fprintf(os.Stderr, "..")
+	case "testReadyAndHang":
+		ch, err := vexec.GetChildHandle()
+		if err != nil {
+			log.Fatal(err)
+		}
+		verifyNoExecVariable()
+		ch.SetReady()
+		<-time.After(time.Minute)
 	case "testSuccess", "testError":
 		ch, err := vexec.GetChildHandle()
 		if err != nil {
-			log.Fatal(os.Stderr, "%s\n", err)
+			log.Fatal(err)
 		}
 		verifyNoExecVariable()
 		ch.SetReady()
@@ -592,7 +598,7 @@
 	case "testExtraFiles":
 		ch, err := vexec.GetChildHandle()
 		if err != nil {
-			log.Fatal("error.... %s\n", err)
+			log.Fatalf("error.... %s\n", err)
 		}
 		verifyNoExecVariable()
 		err = ch.SetReady()
@@ -603,6 +609,5 @@
 		} else {
 			fmt.Fprintf(os.Stderr, "child: %s", string(buf[:n]))
 		}
-		os.Exit(0)
 	}
 }
diff --git a/runtimes/google/ipc/client.go b/runtimes/google/ipc/client.go
index 8227e88..064f282 100644
--- a/runtimes/google/ipc/client.go
+++ b/runtimes/google/ipc/client.go
@@ -373,7 +373,11 @@
 	if skipResolve {
 		servers = []string{name}
 	} else {
-		if resolved, err := c.ns.Resolve(ctx, name, naming.RootBlessingPatternOpt(mtPattern)); err != nil {
+		resolveOpts := []naming.ResolveOpt{naming.RootBlessingPatternOpt(mtPattern)}
+		if noDischarges {
+			resolveOpts = append(resolveOpts, vc.NoDischarges{})
+		}
+		if resolved, err := c.ns.Resolve(ctx, name, resolveOpts...); err != nil {
 			if verror.Is(err, naming.ErrNoSuchName.ID) {
 				return nil, verror.RetryRefetch, verror.Make(verror.NoServers, ctx, name)
 			}
diff --git a/runtimes/google/ipc/client_test.go b/runtimes/google/ipc/client_test.go
index a98eca7..f9aa034 100644
--- a/runtimes/google/ipc/client_test.go
+++ b/runtimes/google/ipc/client_test.go
@@ -5,7 +5,6 @@
 	"io"
 	"os"
 	"path/filepath"
-	"reflect"
 	"runtime"
 	"testing"
 	"time"
@@ -14,7 +13,6 @@
 	"veyron.io/veyron/veyron2/ipc"
 	"veyron.io/veyron/veyron2/naming"
 	"veyron.io/veyron/veyron2/rt"
-	old_verror "veyron.io/veyron/veyron2/verror"
 	verror "veyron.io/veyron/veyron2/verror2"
 	"veyron.io/veyron/veyron2/vlog"
 
@@ -189,7 +187,7 @@
 	i := 0
 	for {
 		if err := call.Recv(&i); err != nil {
-			return i, err
+			return i, verror.Convert(verror.Internal, call, err)
 		}
 	}
 }
@@ -448,8 +446,8 @@
 	if verr != nil {
 		t.Fatalf("unexpected error: %s", verr)
 	}
-	if got, want := err, (old_verror.Standard{Msg: "EOF"}); !reflect.DeepEqual(got, want) {
-		t.Fatalf("got %v, want %v", got, want)
+	if !verror.Is(err, "veyron.io/veyron/veyron2/verror.Internal") || err.Error() != `ipc.test:"".Sink: Internal error: EOF` {
+		t.Errorf("wrong error: %#v", err)
 	}
 	if got := result; got != want {
 		t.Errorf("got %d, want %d", got, want)
diff --git a/runtimes/google/ipc/stream/vc/vc.go b/runtimes/google/ipc/stream/vc/vc.go
index 4460e6e..38d8db6 100644
--- a/runtimes/google/ipc/stream/vc/vc.go
+++ b/runtimes/google/ipc/stream/vc/vc.go
@@ -70,6 +70,7 @@
 
 func (NoDischarges) IPCCallOpt()     {}
 func (NoDischarges) IPCStreamVCOpt() {}
+func (NoDischarges) NSResolveOpt()   {}
 
 var _ stream.VC = (*VC)(nil)
 
diff --git a/runtimes/google/naming/namespace/resolve.go b/runtimes/google/naming/namespace/resolve.go
index d010811..e1c4109 100644
--- a/runtimes/google/naming/namespace/resolve.go
+++ b/runtimes/google/naming/namespace/resolve.go
@@ -14,7 +14,7 @@
 	"veyron.io/veyron/veyron2/vlog"
 )
 
-func (ns *namespace) resolveAgainstMountTable(ctx context.T, client ipc.Client, e *naming.MountEntry, pattern string) (*naming.MountEntry, error) {
+func (ns *namespace) resolveAgainstMountTable(ctx context.T, client ipc.Client, e *naming.MountEntry, pattern string, opts ...ipc.CallOpt) (*naming.MountEntry, error) {
 	// Try each server till one answers.
 	finalErr := errors.New("no servers to resolve query")
 	for _, s := range e.Servers {
@@ -32,7 +32,7 @@
 		}
 		// Not in cache, call the real server.
 		callCtx, _ := ctx.WithTimeout(callTimeout)
-		call, err := client.StartCall(callCtx, pattern_and_name, "ResolveStepX", nil, options.NoResolve(true))
+		call, err := client.StartCall(callCtx, pattern_and_name, "ResolveStepX", nil, append(opts, options.NoResolve(true))...)
 		if err != nil {
 			finalErr = err
 			vlog.VI(2).Infof("ResolveStep.StartCall %s failed: %s", name, err)
@@ -82,6 +82,12 @@
 	}
 	pattern := getRootPattern(opts)
 	client := veyron2.RuntimeFromContext(ctx).Client()
+	var callOpts []ipc.CallOpt
+	for _, opt := range opts {
+		if callOpt, ok := opt.(ipc.CallOpt); ok {
+			callOpts = append(callOpts, callOpt)
+		}
+	}
 	// Iterate walking through mount table servers.
 	for remaining := ns.maxResolveDepth; remaining > 0; remaining-- {
 		vlog.VI(2).Infof("ResolveX(%s) loop %v", name, *e)
@@ -91,7 +97,7 @@
 		}
 		var err error
 		curr := e
-		if e, err = ns.resolveAgainstMountTable(ctx, client, curr, pattern); err != nil {
+		if e, err = ns.resolveAgainstMountTable(ctx, client, curr, pattern, callOpts...); err != nil {
 			// Lots of reasons why another error can happen.  We are trying
 			// to single out "this isn't a mount table".
 			if notAnMT(err) {
diff --git a/security/agent/agent_test.go b/security/agent/agent_test.go
index 52badfb..d0acb43 100644
--- a/security/agent/agent_test.go
+++ b/security/agent/agent_test.go
@@ -66,9 +66,7 @@
 	tests := []testInfo{
 		{"BlessSelf", V{"self"}, newBlessing(t, "blessing"), nil},
 		{"Bless", V{newPrincipal(t).PublicKey(), newBlessing(t, "root"), "extension", security.UnconstrainedUse()}, newBlessing(t, "root/extension"), nil},
-		// TODO(toddw): This change is necessary for vom2:
-		//{"Sign", V{make([]byte, 10)}, security.Signature{Purpose: []byte{}, R: []byte{1}, S: []byte{1}}, nil},
-		{"Sign", V{make([]byte, 10)}, security.Signature{R: []byte{1}, S: []byte{1}}, nil},
+		{"Sign", V{make([]byte, 10)}, security.Signature{Purpose: []byte{}, R: []byte{1}, S: []byte{1}}, nil},
 		{"MintDischarge", V{thirdPartyCaveat, security.UnconstrainedUse()}, discharge, nil},
 		{"PublicKey", V{}, mockP.PublicKey(), nil},
 		{"AddToRoots", V{newBlessing(t, "blessing")}, nil, verror2.Make(addToRootsErr, nil)},
diff --git a/security/agent/keymgr/keymgr_test.go b/security/agent/keymgr/keymgr_test.go
index 33c2e74..cf53293 100644
--- a/security/agent/keymgr/keymgr_test.go
+++ b/security/agent/keymgr/keymgr_test.go
@@ -56,8 +56,8 @@
 	}
 }
 
-func createClient(runtime veyron2.Runtime, nmagent *Agent, id []byte) (security.Principal, error) {
-	file, err := nmagent.NewConnection(id)
+func createClient(runtime veyron2.Runtime, deviceAgent *Agent, id []byte) (security.Principal, error) {
+	file, err := deviceAgent.NewConnection(id)
 	if err != nil {
 		return nil, err
 	}
diff --git a/security/agent/server/server.go b/security/agent/server/server.go
index 949877f..6035d22 100644
--- a/security/agent/server/server.go
+++ b/security/agent/server/server.go
@@ -90,12 +90,12 @@
 		return nil, err
 	}
 
-	go mgr.readNMConns(local)
+	go mgr.readDMConns(local)
 
 	return client, nil
 }
 
-func (a keymgr) readNMConns(conn *net.UnixConn) {
+func (a keymgr) readDMConns(conn *net.UnixConn) {
 	defer conn.Close()
 	var buf keyHandle
 	for {
diff --git a/services/identity/identityd/main.go b/services/identity/identityd/main.go
index 58a5a75..c9fbb40 100644
--- a/services/identity/identityd/main.go
+++ b/services/identity/identityd/main.go
@@ -114,6 +114,7 @@
 			ClientSecret:            clientSecret,
 			BlessingLogReader:       blessingLogReader,
 			RevocationManager:       revocationManager,
+			DischargerLocation:      naming.JoinAddressName(published[0], dischargerService),
 			MacaroonBlessingService: naming.JoinAddressName(published[0], macaroonService),
 		})
 		if err != nil {
diff --git a/services/mgmt/device/config/const.go b/services/mgmt/device/config/const.go
index 17a9cc3..49e3df7 100644
--- a/services/mgmt/device/config/const.go
+++ b/services/mgmt/device/config/const.go
@@ -3,22 +3,22 @@
 const (
 	// EnvelopeEnv is the name of the environment variable that holds the
 	// serialized device manager application envelope.
-	EnvelopeEnv = "VEYRON_NM_ENVELOPE"
+	EnvelopeEnv = "VEYRON_DM_ENVELOPE"
 	// PreviousEnv is the name of the environment variable that holds the
 	// path to the previous version of the device manager.
-	PreviousEnv = "VEYRON_NM_PREVIOUS"
+	PreviousEnv = "VEYRON_DM_PREVIOUS"
 	// OriginEnv is the name of the environment variable that holds the
 	// object name of the application repository that can be used to
 	// retrieve the device manager application envelope.
-	OriginEnv = "VEYRON_NM_ORIGIN"
+	OriginEnv = "VEYRON_DM_ORIGIN"
 	// RootEnv is the name of the environment variable that holds the
 	// path to the directory in which device manager workspaces are
 	// created.
-	RootEnv = "VEYRON_NM_ROOT"
+	RootEnv = "VEYRON_DM_ROOT"
 	// CurrentLinkEnv is the name of the environment variable that holds
 	// the path to the soft link that points to the current device manager.
-	CurrentLinkEnv = "VEYRON_NM_CURRENT"
+	CurrentLinkEnv = "VEYRON_DM_CURRENT"
 	// HelperEnv is the name of the environment variable that holds the path
 	// to the suid helper used to start apps as specific system users.
-	HelperEnv = "VEYRON_NM_HELPER"
+	HelperEnv = "VEYRON_DM_HELPER"
 )
diff --git a/services/mgmt/device/impl/app_service.go b/services/mgmt/device/impl/app_service.go
index 99312df..bc37a2a 100644
--- a/services/mgmt/device/impl/app_service.go
+++ b/services/mgmt/device/impl/app_service.go
@@ -495,7 +495,7 @@
 	if err != nil {
 		return err
 	}
-	nmPrincipal := call.LocalPrincipal()
+	dmPrincipal := call.LocalPrincipal()
 	// Take the blessings conferred upon us by the Start-er, extend them
 	// with the app title.
 	grantedBlessings := call.Blessings()
@@ -503,7 +503,7 @@
 		return verror2.Make(ErrInvalidBlessing, nil)
 	}
 	// TODO(caprita): Revisit UnconstrainedUse.
-	appBlessings, err := nmPrincipal.Bless(p.PublicKey(), grantedBlessings, envelope.Title, security.UnconstrainedUse())
+	appBlessings, err := dmPrincipal.Bless(p.PublicKey(), grantedBlessings, envelope.Title, security.UnconstrainedUse())
 	if err != nil {
 		vlog.Errorf("Bless() failed: %v", err)
 		return verror2.Make(ErrOperationFailed, nil)
@@ -535,13 +535,13 @@
 	// TODO(caprita): Figure out if there is any feature value in providing
 	// the app with a device manager-derived blessing (e.g., may the app
 	// need to prove it's running on the device?).
-	nmBlessings, err := nmPrincipal.Bless(p.PublicKey(), nmPrincipal.BlessingStore().Default(), "callback", security.UnconstrainedUse())
+	dmBlessings, err := dmPrincipal.Bless(p.PublicKey(), dmPrincipal.BlessingStore().Default(), "callback", security.UnconstrainedUse())
 	// Put the names of the device manager's default blessings as patterns
 	// for the child, so that the child uses the right blessing when talking
 	// back to the device manager.
-	names := nmPrincipal.BlessingStore().Default().ForContext(call)
+	names := dmPrincipal.BlessingStore().Default().ForContext(call)
 	for _, n := range names {
-		if _, err := p.BlessingStore().Set(nmBlessings, security.BlessingPattern(n)); err != nil {
+		if _, err := p.BlessingStore().Set(dmBlessings, security.BlessingPattern(n)); err != nil {
 			vlog.Errorf("BlessingStore.Set() failed: %v", err)
 			return verror2.Make(ErrOperationFailed, nil)
 		}
@@ -555,12 +555,12 @@
 		vlog.Errorf("generateRandomString() failed: %v", err)
 		return verror2.Make(ErrOperationFailed, nil)
 	}
-	if _, err := p.BlessingStore().Set(nmBlessings, security.BlessingPattern(randomPattern)); err != nil {
+	if _, err := p.BlessingStore().Set(dmBlessings, security.BlessingPattern(randomPattern)); err != nil {
 		vlog.Errorf("BlessingStore.Set() failed: %v", err)
 		return verror2.Make(ErrOperationFailed, nil)
 	}
 	info.DeviceManagerPeerPattern = randomPattern
-	if err := p.AddToRoots(nmBlessings); err != nil {
+	if err := p.AddToRoots(dmBlessings); err != nil {
 		vlog.Errorf("AddToRoots() failed: %v", err)
 		return verror2.Make(ErrOperationFailed, nil)
 	}
diff --git a/services/mgmt/device/impl/association_state_test.go b/services/mgmt/device/impl/association_state_test.go
index 49054ba..e374658 100644
--- a/services/mgmt/device/impl/association_state_test.go
+++ b/services/mgmt/device/impl/association_state_test.go
@@ -14,7 +14,7 @@
 // TestAssociationPersistance verifies correct operation of association
 // persistance code.
 func TestAssociationPersistance(t *testing.T) {
-	td, err := ioutil.TempDir("", "nmtest")
+	td, err := ioutil.TempDir("", "device_test")
 	if err != nil {
 		t.Fatalf("TempDir failed: %v", err)
 	}
diff --git a/services/mgmt/device/impl/callback.go b/services/mgmt/device/impl/callback.go
index d7e7c90..5ff6c5a 100644
--- a/services/mgmt/device/impl/callback.go
+++ b/services/mgmt/device/impl/callback.go
@@ -21,10 +21,10 @@
 			// Device manager was not started by self-update, return silently.
 			return
 		}
-		nmClient := device.ConfigClient(callbackName)
+		client := device.ConfigClient(callbackName)
 		ctx, cancel := ctx.WithTimeout(ipcContextTimeout)
 		defer cancel()
-		if err := nmClient.Set(ctx, mgmt.ChildNameConfigKey, name); err != nil {
+		if err := client.Set(ctx, mgmt.ChildNameConfigKey, name); err != nil {
 			vlog.Fatalf("Set(%v, %v) failed: %v", mgmt.ChildNameConfigKey, name, err)
 		}
 	case exec.ErrNoVersion:
diff --git a/services/mgmt/device/impl/device_installer.go b/services/mgmt/device/impl/device_installer.go
index b296c4b..393d0b6 100644
--- a/services/mgmt/device/impl/device_installer.go
+++ b/services/mgmt/device/impl/device_installer.go
@@ -65,13 +65,13 @@
 	}
 
 	// Create device manager directory tree.
-	nmDir := filepath.Join(configState.Root, "device-manager", "base")
-	if err := os.RemoveAll(nmDir); err != nil {
-		return fmt.Errorf("RemoveAll(%v) failed: %v", nmDir, err)
+	deviceDir := filepath.Join(configState.Root, "device-manager", "base")
+	if err := os.RemoveAll(deviceDir); err != nil {
+		return fmt.Errorf("RemoveAll(%v) failed: %v", deviceDir, err)
 	}
 	perm := os.FileMode(0700)
-	if err := os.MkdirAll(nmDir, perm); err != nil {
-		return fmt.Errorf("MkdirAll(%v, %v) failed: %v", nmDir, perm, err)
+	if err := os.MkdirAll(deviceDir, perm); err != nil {
+		return fmt.Errorf("MkdirAll(%v, %v) failed: %v", deviceDir, perm, err)
 	}
 	envelope := &application.Envelope{
 		Args: args,
@@ -81,16 +81,16 @@
 		// device manager in a different way.
 		Env: VeyronEnvironment(env),
 	}
-	if err := linkSelf(nmDir, "deviced"); err != nil {
+	if err := linkSelf(deviceDir, "deviced"); err != nil {
 		return err
 	}
 	// We don't pass in the config state settings, since they're already
 	// contained in the environment.
-	if err := generateScript(nmDir, nil, envelope); err != nil {
+	if err := generateScript(deviceDir, nil, envelope); err != nil {
 		return err
 	}
 
 	// TODO(caprita): Test the device manager we just installed.
-	return updateLink(filepath.Join(nmDir, "deviced.sh"), configState.CurrentLink)
+	return updateLink(filepath.Join(deviceDir, "deviced.sh"), configState.CurrentLink)
 	// TODO(caprita): Update system management daemon.
 }
diff --git a/services/mgmt/device/impl/device_service.go b/services/mgmt/device/impl/device_service.go
index b31ceae..7f72437 100644
--- a/services/mgmt/device/impl/device_service.go
+++ b/services/mgmt/device/impl/device_service.go
@@ -239,8 +239,8 @@
 		return verror2.Make(ErrOperationFailed, ctx)
 	}
 	// Check that invoking Revert() succeeds.
-	childName = naming.Join(childName, "nm")
-	nmClient := device.DeviceClient(childName)
+	childName = naming.Join(childName, "device")
+	dmClient := device.DeviceClient(childName)
 	linkOld, pathOld, err := i.getCurrentFileInfo()
 	if err != nil {
 		return verror2.Make(ErrOperationFailed, ctx)
@@ -249,7 +249,7 @@
 	// for a second to make sure it can check whether the current symlink is
 	// updated.
 	time.Sleep(time.Second)
-	if err := nmClient.Revert(ctx); err != nil {
+	if err := dmClient.Revert(ctx); err != nil {
 		return verror2.Make(ErrOperationFailed, ctx)
 	}
 	linkNew, pathNew, err := i.getCurrentFileInfo()
diff --git a/services/mgmt/device/impl/dispatcher.go b/services/mgmt/device/impl/dispatcher.go
index 2dc4e30..237a0ca 100644
--- a/services/mgmt/device/impl/dispatcher.go
+++ b/services/mgmt/device/impl/dispatcher.go
@@ -70,7 +70,7 @@
 
 const (
 	appsSuffix   = "apps"
-	deviceSuffix = "nm"
+	deviceSuffix = "device"
 	configSuffix = "cfg"
 
 	pkgPath = "veyron.io/veyron/veyron/services/mgmt/device/impl"
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index d1f8fe0..0bd4d5a 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -342,8 +342,8 @@
 
 	crDir, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
-	nmArgs := []string{"factoryNM", root, "unused_helper", mockApplicationRepoName, currLink}
-	args, env := sh.CommandEnvelope(deviceManagerCmd, crEnv, nmArgs...)
+	dmArgs := []string{"factoryDM", root, "unused_helper", mockApplicationRepoName, currLink}
+	args, env := sh.CommandEnvelope(deviceManagerCmd, crEnv, dmArgs...)
 
 	scriptPathFactory := generateDeviceManagerScript(t, root, args, env)
 
@@ -354,7 +354,7 @@
 	// We instruct the initial device manager that we run to pause before
 	// stopping its service, so that we get a chance to verify that
 	// attempting an update while another one is ongoing will fail.
-	nmPauseBeforeStopEnv := append(crEnv, "PAUSE_BEFORE_STOP=1")
+	dmPauseBeforeStopEnv := append(crEnv, "PAUSE_BEFORE_STOP=1")
 
 	// Start the initial version of the device manager, the so-called
 	// "factory" version. We use the modules-generated command to start it.
@@ -362,27 +362,27 @@
 	// demonstrates that the initial device manager could be started by hand
 	// as long as the right initial configuration is passed into the device
 	// manager implementation.
-	nmh, nms := runShellCommand(t, sh, nmPauseBeforeStopEnv, deviceManagerCmd, nmArgs...)
+	dmh, dms := runShellCommand(t, sh, dmPauseBeforeStopEnv, deviceManagerCmd, dmArgs...)
 	defer func() {
-		syscall.Kill(nmh.Pid(), syscall.SIGINT)
+		syscall.Kill(dmh.Pid(), syscall.SIGINT)
 	}()
 
-	readPID(t, nms)
-	resolve(t, "factoryNM", 1) // Verify the device manager has published itself.
+	readPID(t, dms)
+	resolve(t, "factoryDM", 1) // Verify the device manager has published itself.
 
 	// Simulate an invalid envelope in the application repository.
-	*envelope = envelopeFromShell(sh, nmPauseBeforeStopEnv, deviceManagerCmd, "bogus", nmArgs...)
+	*envelope = envelopeFromShell(sh, dmPauseBeforeStopEnv, deviceManagerCmd, "bogus", dmArgs...)
 
-	updateDeviceExpectError(t, "factoryNM", impl.ErrAppTitleMismatch.ID)
-	revertDeviceExpectError(t, "factoryNM", impl.ErrUpdateNoOp.ID)
+	updateDeviceExpectError(t, "factoryDM", impl.ErrAppTitleMismatch.ID)
+	revertDeviceExpectError(t, "factoryDM", impl.ErrUpdateNoOp.ID)
 
 	// Set up a second version of the device manager. The information in the
 	// envelope will be used by the device manager to stage the next
 	// version.
 	crDir, crEnv = credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
-	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v2NM")
-	updateDevice(t, "factoryNM")
+	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v2DM")
+	updateDevice(t, "factoryDM")
 
 	// Current link should have been updated to point to v2.
 	evalLink := func() string {
@@ -397,26 +397,26 @@
 		t.Fatalf("current link didn't change")
 	}
 
-	updateDeviceExpectError(t, "factoryNM", impl.ErrOperationInProgress.ID)
+	updateDeviceExpectError(t, "factoryDM", impl.ErrOperationInProgress.ID)
 
-	nmh.CloseStdin()
+	dmh.CloseStdin()
 
-	nms.Expect("factoryNM terminating")
-	nmh.Shutdown(os.Stderr, os.Stderr)
+	dms.Expect("factoryDM terminating")
+	dmh.Shutdown(os.Stderr, os.Stderr)
 
 	// A successful update means the device manager has stopped itself.  We
 	// relaunch it from the current link.
-	resolveExpectNotFound(t, "v2NM") // Ensure a clean slate.
+	resolveExpectNotFound(t, "v2DM") // Ensure a clean slate.
 
-	nmh, nms = runShellCommand(t, sh, nil, execScriptCmd, currLink)
+	dmh, dms = runShellCommand(t, sh, nil, execScriptCmd, currLink)
 
-	readPID(t, nms)
-	resolve(t, "v2NM", 1) // Current link should have been launching v2.
+	readPID(t, dms)
+	resolve(t, "v2DM", 1) // Current link should have been launching v2.
 
 	// Try issuing an update without changing the envelope in the
 	// application repository: this should fail, and current link should be
 	// unchanged.
-	updateDeviceExpectError(t, "v2NM", impl.ErrUpdateNoOp.ID)
+	updateDeviceExpectError(t, "v2DM", impl.ErrUpdateNoOp.ID)
 	if evalLink() != scriptPathV2 {
 		t.Fatalf("script changed")
 	}
@@ -424,59 +424,59 @@
 	// Create a third version of the device manager and issue an update.
 	crDir, crEnv = credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
-	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v3NM")
-	updateDevice(t, "v2NM")
+	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v3DM")
+	updateDevice(t, "v2DM")
 
 	scriptPathV3 := evalLink()
 	if scriptPathV3 == scriptPathV2 {
 		t.Fatalf("current link didn't change")
 	}
 
-	nms.Expect("v2NM terminating")
+	dms.Expect("v2DM terminating")
 
-	nmh.Shutdown(os.Stderr, os.Stderr)
+	dmh.Shutdown(os.Stderr, os.Stderr)
 
-	resolveExpectNotFound(t, "v3NM") // Ensure a clean slate.
+	resolveExpectNotFound(t, "v3DM") // Ensure a clean slate.
 
 	// Re-lanuch the device manager from current link.  We instruct the
 	// device manager to pause before stopping its server, so that we can
 	// verify that a second revert fails while a revert is in progress.
-	nmh, nms = runShellCommand(t, sh, nmPauseBeforeStopEnv, execScriptCmd, currLink)
+	dmh, dms = runShellCommand(t, sh, dmPauseBeforeStopEnv, execScriptCmd, currLink)
 
-	readPID(t, nms)
-	resolve(t, "v3NM", 1) // Current link should have been launching v3.
+	readPID(t, dms)
+	resolve(t, "v3DM", 1) // Current link should have been launching v3.
 
 	// Revert the device manager to its previous version (v2).
-	revertDevice(t, "v3NM")
-	revertDeviceExpectError(t, "v3NM", impl.ErrOperationInProgress.ID) // Revert already in progress.
-	nmh.CloseStdin()
-	nms.Expect("v3NM terminating")
+	revertDevice(t, "v3DM")
+	revertDeviceExpectError(t, "v3DM", impl.ErrOperationInProgress.ID) // Revert already in progress.
+	dmh.CloseStdin()
+	dms.Expect("v3DM terminating")
 	if evalLink() != scriptPathV2 {
 		t.Fatalf("current link was not reverted correctly")
 	}
-	nmh.Shutdown(os.Stderr, os.Stderr)
+	dmh.Shutdown(os.Stderr, os.Stderr)
 
-	resolveExpectNotFound(t, "v2NM") // Ensure a clean slate.
+	resolveExpectNotFound(t, "v2DM") // Ensure a clean slate.
 
-	nmh, nms = runShellCommand(t, sh, nil, execScriptCmd, currLink)
-	readPID(t, nms)
-	resolve(t, "v2NM", 1) // Current link should have been launching v2.
+	dmh, dms = runShellCommand(t, sh, nil, execScriptCmd, currLink)
+	readPID(t, dms)
+	resolve(t, "v2DM", 1) // Current link should have been launching v2.
 
 	// Revert the device manager to its previous version (factory).
-	revertDevice(t, "v2NM")
-	nms.Expect("v2NM terminating")
+	revertDevice(t, "v2DM")
+	dms.Expect("v2DM terminating")
 	if evalLink() != scriptPathFactory {
 		t.Fatalf("current link was not reverted correctly")
 	}
-	nmh.Shutdown(os.Stderr, os.Stderr)
+	dmh.Shutdown(os.Stderr, os.Stderr)
 
-	resolveExpectNotFound(t, "factoryNM") // Ensure a clean slate.
-	nmh, nms = runShellCommand(t, sh, nil, execScriptCmd, currLink)
-	pid := readPID(t, nms)
-	resolve(t, "factoryNM", 1) // Current link should have been launching
+	resolveExpectNotFound(t, "factoryDM") // Ensure a clean slate.
+	dmh, dms = runShellCommand(t, sh, nil, execScriptCmd, currLink)
+	pid := readPID(t, dms)
+	resolve(t, "factoryDM", 1) // Current link should have been launching
 	syscall.Kill(pid, syscall.SIGINT)
-	nms.Expect("factoryNM terminating")
-	nms.ExpectEOF()
+	dms.Expect("factoryDM terminating")
+	dms.ExpectEOF()
 }
 
 type pingServer chan<- string
@@ -571,8 +571,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	nmh, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	readPID(t, nms)
+	dmh, dms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	readPID(t, dms)
 
 	// Create the local server that the app uses to let us know it's ready.
 	pingCh, cleanup := setupPingServer(t)
@@ -721,9 +721,9 @@
 	startAppExpectError(t, appID, impl.ErrInvalidOperation.ID)
 
 	// Cleanly shut down the device manager.
-	syscall.Kill(nmh.Pid(), syscall.SIGINT)
-	nms.Expect("nm terminating")
-	nms.ExpectEOF()
+	syscall.Kill(dmh.Pid(), syscall.SIGINT)
+	dms.Expect("dm terminating")
+	dms.ExpectEOF()
 }
 
 func newRuntime(t *testing.T) veyron2.Runtime {
@@ -736,7 +736,7 @@
 }
 
 func tryInstall(ctx context.T) error {
-	appsName := "nm//apps"
+	appsName := "dm//apps"
 	stub := device.ApplicationClient(appsName)
 	if _, err := stub.Install(ctx, mockApplicationRepoName); err != nil {
 		return fmt.Errorf("Install failed: %v", err)
@@ -801,13 +801,13 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	pid := readPID(t, nms)
+	_, dms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	pid := readPID(t, dms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	*envelope = envelopeFromShell(sh, nil, appCmd, "google naps", "trapp")
 
-	deviceStub := device.DeviceClient("nm//nm")
+	deviceStub := device.DeviceClient("dm//device")
 	selfRT := globalRT
 	otherRT := newRuntime(t)
 	defer otherRT.Cleanup()
@@ -888,14 +888,14 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
-	pid := readPID(t, nms)
+	_, dms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
+	pid := readPID(t, dms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// Create an envelope for an app.
 	*envelope = envelopeFromShell(sh, nil, appCmd, "google naps")
 
-	deviceStub := device.DeviceClient("nm//nm")
+	deviceStub := device.DeviceClient("dm//device")
 	acl, etag, err := deviceStub.GetACL(selfRT.NewContext())
 	if err != nil {
 		t.Fatalf("GetACL failed:%v", err)
@@ -973,9 +973,9 @@
 	// (in this case the shell script) which will inherit its environment
 	// when we run it.
 	// TODO(caprita): figure out if this is really necessary, hopefully not.
-	nmargs, _ := sh.CommandEnvelope(deviceManagerCmd, nil)
-	argsForDeviceManager := append([]string{deviceManagerCmd, "--"}, nmargs[1:]...)
-	argsForDeviceManager = append(argsForDeviceManager, "nm")
+	dmargs, _ := sh.CommandEnvelope(deviceManagerCmd, nil)
+	argsForDeviceManager := append([]string{deviceManagerCmd, "--"}, dmargs[1:]...)
+	argsForDeviceManager = append(argsForDeviceManager, "dm")
 
 	// Add vars to instruct the installer how to configure the device
 	// manager.
@@ -986,7 +986,7 @@
 
 	// CurrLink should now be pointing to a device manager script that
 	// can start up a device manager.
-	nmh, nms := runShellCommand(t, sh, nil, execScriptCmd, currLink)
+	dmh, dms := runShellCommand(t, sh, nil, execScriptCmd, currLink)
 
 	// We need the pid of the child process started by the device manager
 	// script above to signal it, not the pid of the script itself.
@@ -996,14 +996,14 @@
 	// able to retain a list of the processes it spawns and be confident
 	// that sending a signal to them will also result in that signal being
 	// sent to their children and so on.
-	pid := readPID(t, nms)
-	resolve(t, "nm", 1)
-	revertDeviceExpectError(t, "nm", impl.ErrUpdateNoOp.ID) // No previous version available.
+	pid := readPID(t, dms)
+	resolve(t, "dm", 1)
+	revertDeviceExpectError(t, "dm", impl.ErrUpdateNoOp.ID) // No previous version available.
 	syscall.Kill(pid, syscall.SIGINT)
 
-	nms.Expect("nm terminating")
-	nms.ExpectEOF()
-	nmh.Shutdown(os.Stderr, os.Stderr)
+	dms.Expect("dm terminating")
+	dms.ExpectEOF()
+	dmh.Shutdown(os.Stderr, os.Stderr)
 }
 
 func TestDeviceManagerGlobAndDebug(t *testing.T) {
@@ -1025,8 +1025,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	pid := readPID(t, nms)
+	_, dms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	pid := readPID(t, dms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -1057,7 +1057,7 @@
 		name, pattern string
 		expected      []string
 	}{
-		{"nm", "...", []string{
+		{"dm", "...", []string{
 			"",
 			"apps",
 			"apps/google naps",
@@ -1075,19 +1075,19 @@
 			"apps/google naps/" + install1ID + "/" + instance1ID + "/stats/system/start-time-rfc1123",
 			"apps/google naps/" + install1ID + "/" + instance1ID + "/stats/system/start-time-unix",
 			"apps/google naps/" + install2ID,
-			"nm",
+			"device",
 		}},
-		{"nm/apps", "*", []string{"google naps"}},
-		{"nm/apps/google naps", "*", []string{install1ID, install2ID}},
-		{"nm/apps/google naps/" + install1ID, "*", []string{instance1ID}},
-		{"nm/apps/google naps/" + install1ID + "/" + instance1ID, "*", []string{"logs", "pprof", "stats"}},
-		{"nm/apps/google naps/" + install1ID + "/" + instance1ID + "/logs", "*", []string{
+		{"dm/apps", "*", []string{"google naps"}},
+		{"dm/apps/google naps", "*", []string{install1ID, install2ID}},
+		{"dm/apps/google naps/" + install1ID, "*", []string{instance1ID}},
+		{"dm/apps/google naps/" + install1ID + "/" + instance1ID, "*", []string{"logs", "pprof", "stats"}},
+		{"dm/apps/google naps/" + install1ID + "/" + instance1ID + "/logs", "*", []string{
 			"STDERR-<timestamp>",
 			"STDOUT-<timestamp>",
 			"bin.INFO",
 			"bin.<*>.INFO.<timestamp>",
 		}},
-		{"nm/apps/google naps/" + install1ID + "/" + instance1ID + "/stats/system", "start-time*", []string{"start-time-rfc1123", "start-time-unix"}},
+		{"dm/apps/google naps/" + install1ID + "/" + instance1ID + "/stats/system", "start-time*", []string{"start-time-rfc1123", "start-time-unix"}},
 	}
 	logFileTimeStampRE := regexp.MustCompile("(STDOUT|STDERR)-[0-9]+$")
 	logFileTrimInfoRE := regexp.MustCompile(`bin\..*\.INFO\.[0-9.-]+$`)
@@ -1122,7 +1122,7 @@
 	}
 
 	// Call Size() on the log file objects.
-	files, err := testutil.GlobName(globalRT.NewContext(), "nm", "apps/google naps/"+install1ID+"/"+instance1ID+"/logs/*")
+	files, err := testutil.GlobName(globalRT.NewContext(), "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/logs/*")
 	if err != nil {
 		t.Errorf("unexpected glob error: %v", err)
 	}
@@ -1130,7 +1130,7 @@
 		t.Errorf("Unexpected number of matches. Got %d, want at least %d", got, want)
 	}
 	for _, file := range files {
-		name := naming.Join("nm", file)
+		name := naming.Join("dm", file)
 		c := logreader.LogFileClient(name)
 		if _, err := c.Size(globalRT.NewContext()); err != nil {
 			t.Errorf("Size(%q) failed: %v", name, err)
@@ -1138,7 +1138,7 @@
 	}
 
 	// Call Value() on some of the stats objects.
-	objects, err := testutil.GlobName(globalRT.NewContext(), "nm", "apps/google naps/"+install1ID+"/"+instance1ID+"/stats/system/start-time*")
+	objects, err := testutil.GlobName(globalRT.NewContext(), "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/stats/system/start-time*")
 	if err != nil {
 		t.Errorf("unexpected glob error: %v", err)
 	}
@@ -1146,7 +1146,7 @@
 		t.Errorf("Unexpected number of matches. Got %d, want %d", got, want)
 	}
 	for _, obj := range objects {
-		name := naming.Join("nm", obj)
+		name := naming.Join("dm", obj)
 		c := stats.StatsClient(name)
 		if _, err := c.Value(globalRT.NewContext()); err != nil {
 			t.Errorf("Value(%q) failed: %v", name, err)
@@ -1155,7 +1155,7 @@
 
 	// Call CmdLine() on the pprof object.
 	{
-		name := "nm/apps/google naps/" + install1ID + "/" + instance1ID + "/pprof"
+		name := "dm/apps/google naps/" + install1ID + "/" + instance1ID + "/pprof"
 		c := pprof.PProfClient(name)
 		v, err := c.CmdLine(globalRT.NewContext())
 		if err != nil {
@@ -1191,8 +1191,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	pid := readPID(t, nms)
+	_, dms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	pid := readPID(t, dms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -1267,11 +1267,11 @@
 	crFile, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crFile)
 
-	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
-	pid := readPID(t, nms)
+	_, dms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
+	pid := readPID(t, dms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
-	deviceStub := device.DeviceClient("nm//nm")
+	deviceStub := device.DeviceClient("dm//device")
 
 	// Attempt to list associations on the device manager without having
 	// claimed it.
@@ -1375,11 +1375,11 @@
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "-mocksetuid", "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	pid := readPID(t, nms)
+	_, dms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "-mocksetuid", "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	pid := readPID(t, dms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
-	deviceStub := device.DeviceClient("nm//nm")
+	deviceStub := device.DeviceClient("dm//device")
 
 	// Create the local server that the app uses to tell us which system
 	// name the device manager wished to run it as.
diff --git a/services/mgmt/device/impl/util_test.go b/services/mgmt/device/impl/util_test.go
index e4d9c7e..197453c 100644
--- a/services/mgmt/device/impl/util_test.go
+++ b/services/mgmt/device/impl/util_test.go
@@ -36,7 +36,7 @@
 	// removing the device manager's workspace for successful test runs (for
 	// failed test runs, this is already the case).  This is useful when
 	// developing test cases.
-	preserveNMWorkspaceEnv = "VEYRON_TEST_PRESERVE_NM_WORKSPACE"
+	preserveDMWorkspaceEnv = "VEYRON_TEST_PRESERVE_DM_WORKSPACE"
 
 	// TODO(caprita): Set the timeout in a more principled manner.
 	expectTimeout = 20 * time.Second
@@ -149,7 +149,7 @@
 		vlog.Fatalf("EvalSymlinks(%v) failed: %v", rootDir, err)
 	}
 	return rootDir, func() {
-		if t.Failed() || os.Getenv(preserveNMWorkspaceEnv) != "" {
+		if t.Failed() || os.Getenv(preserveDMWorkspaceEnv) != "" {
 			t.Logf("You can examine the device manager workspace at %v", rootDir)
 		} else {
 			os.RemoveAll(rootDir)
@@ -204,7 +204,7 @@
 // Revert for device manager.
 
 func deviceStub(name string) device.DeviceClientMethods {
-	deviceName := naming.Join(name, "nm")
+	deviceName := naming.Join(name, "device")
 	return device.DeviceClient(deviceName)
 }
 
@@ -244,7 +244,7 @@
 }
 
 func appStub(nameComponents ...string) device.ApplicationClientMethods {
-	appsName := "nm//apps"
+	appsName := "dm//apps"
 	appName := naming.Join(append([]string{appsName}, nameComponents...)...)
 	return device.ApplicationClient(appName)
 }
diff --git a/services/mgmt/stats/impl/stats_test.go b/services/mgmt/stats/impl/stats_test.go
index 661f6f4..c2c342a 100644
--- a/services/mgmt/stats/impl/stats_test.go
+++ b/services/mgmt/stats/impl/stats_test.go
@@ -106,9 +106,7 @@
 			t.Fatalf("expected more stream values")
 		}
 		got := iterator.Value()
-		// TODO(toddw): This change is necessary for vom2:
-		//expected := types.Change{Name: "testing/foo/bar", Value: int64(10), ResumeMarker: noRM}
-		expected := types.Change{Name: "testing/foo/bar", Value: int64(10)}
+		expected := types.Change{Name: "testing/foo/bar", Value: int64(10), ResumeMarker: noRM}
 		if !reflect.DeepEqual(got, expected) {
 			t.Errorf("unexpected result. Got %#v, want %#v", got, expected)
 		}
@@ -119,9 +117,7 @@
 			t.Fatalf("expected more stream values")
 		}
 		got = iterator.Value()
-		// TODO(toddw): This change is necessary for vom2:
-		//expected := types.Change{Name: "testing/foo/bar", Value: int64(15), ResumeMarker: noRM}
-		expected = types.Change{Name: "testing/foo/bar", Value: int64(15)}
+		expected = types.Change{Name: "testing/foo/bar", Value: int64(15), ResumeMarker: noRM}
 		if !reflect.DeepEqual(got, expected) {
 			t.Errorf("unexpected result. Got %#v, want %#v", got, expected)
 		}
@@ -132,9 +128,7 @@
 			t.Fatalf("expected more stream values")
 		}
 		got = iterator.Value()
-		// TODO(toddw): This change is necessary for vom2:
-		//expected := types.Change{Name: "testing/foo/bar", Value: int64(17), ResumeMarker: noRM}
-		expected = types.Change{Name: "testing/foo/bar", Value: int64(17)}
+		expected = types.Change{Name: "testing/foo/bar", Value: int64(17), ResumeMarker: noRM}
 		if !reflect.DeepEqual(got, expected) {
 			t.Errorf("unexpected result. Got %#v, want %#v", got, expected)
 		}
diff --git a/tools/mgmt/device/acl_test.go b/tools/mgmt/device/acl_test.go
index ea054ff..ce6fdce 100644
--- a/tools/mgmt/device/acl_test.go
+++ b/tools/mgmt/device/acl_test.go
@@ -186,7 +186,7 @@
 				},
 				"Write": access.ACL{
 					In:    []security.BlessingPattern{"friends/...", "friends/alice", "self/..."},
-					NotIn: []string{},
+					NotIn: []string(nil),
 				},
 			},
 			etag: "anEtagForToday",
@@ -201,11 +201,11 @@
 				},
 				"Read": access.ACL{
 					In:    []security.BlessingPattern{"other/...", "self/..."},
-					NotIn: []string{},
+					NotIn: []string(nil),
 				},
 				"Write": access.ACL{
 					In:    []security.BlessingPattern{"friends/...", "friends/alice", "self/..."},
-					NotIn: []string{},
+					NotIn: []string(nil),
 				},
 			},
 			etag: "anEtagForTomorrow",
@@ -277,7 +277,7 @@
 			acl: access.TaggedACLMap{
 				"Read": access.ACL{
 					In:    []security.BlessingPattern{"friend", "other", "self/..."},
-					NotIn: []string{},
+					NotIn: []string(nil),
 				},
 			},
 			etag: "anEtagForToday",
diff --git a/tools/mgmt/nminstall b/tools/mgmt/dminstall
similarity index 93%
rename from tools/mgmt/nminstall
rename to tools/mgmt/dminstall
index bc47887..10ea4fa 100755
--- a/tools/mgmt/nminstall
+++ b/tools/mgmt/dminstall
@@ -16,19 +16,19 @@
 # Usage:
 #
 # # Gets binaries from local repository
-# ./nminstall <install parent dir>
+# ./dminstall <install parent dir>
 #
 # # Gets binaries from local filesystem
-# ./nminstall <install parent dir> /path/to/binaries
+# ./dminstall <install parent dir> /path/to/binaries
 #
 # # Gets binaries from HTTP server
-# ./nminstall <install parent dir> http://host/path
+# ./dminstall <install parent dir> http://host/path
 
 set -e
 
 usage() {
   echo "usage:"
-  echo "./nminstall [--single_user] <install parent dir> [<binary source>] [-- args for device manager...]"
+  echo "./dminstall [--single_user] <install parent dir> [<binary source>] [-- args for device manager...]"
 }
 
 readonly BIN_NAMES=(deviced suidhelper agentd)
@@ -180,8 +180,8 @@
   echo "Suidhelper configured."
 
   # Tell the device manager to install itself.
-  local -r NM_ROOT="${INSTALL_DIR}/nmroot"
-  echo "Installing device manager under ${NM_ROOT} ..."
+  local -r DM_ROOT="${INSTALL_DIR}/dmroot"
+  echo "Installing device manager under ${DM_ROOT} ..."
   local -r PUBLISH=$(hostname)
   if [[ "$1" = "--" ]]; then
     shift
@@ -191,7 +191,7 @@
     exit 1
   fi
 
-  VEYRON_NM_CURRENT="${INSTALL_DIR}/deviced.curr" VEYRON_NM_ROOT="${NM_ROOT}" VEYRON_NM_HELPER="${SETUID_SCRIPT}" "${BIN_INSTALL}/deviced" --install_self -- --name="${PUBLISH}" "$@"
+  VEYRON_DM_CURRENT="${INSTALL_DIR}/deviced.curr" VEYRON_DM_ROOT="${DM_ROOT}" VEYRON_DM_HELPER="${SETUID_SCRIPT}" "${BIN_INSTALL}/deviced" --install_self -- --name="${PUBLISH}" "$@"
   echo "Device manager installed."
 
   local -r SECURITY_DIR="${INSTALL_DIR}/security"
diff --git a/tools/mgmt/test.sh b/tools/mgmt/test.sh
index 97d650c..5699c18 100755
--- a/tools/mgmt/test.sh
+++ b/tools/mgmt/test.sh
@@ -18,7 +18,7 @@
   NAMESPACE_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/tools/namespace')"
   PRINCIPAL_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/tools/principal')"
   DEBUG_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/tools/debug')"
-  NMINSTALL_SCRIPT="$(shell::go_package_dir 'veyron.io/veyron/veyron/tools/mgmt')/nminstall"
+  DMINSTALL_SCRIPT="$(shell::go_package_dir 'veyron.io/veyron/veyron/tools/mgmt')/dminstall"
 }
 
 # TODO(caprita): Move to shell_tesh.sh
@@ -63,14 +63,14 @@
   # test.sh by hand and exercise the code that requires root privileges.
 
   # Install and start device manager.
-  shell_test::start_server "${NMINSTALL_SCRIPT}" --single_user $(shell::tmp_dir) \
+  shell_test::start_server "${DMINSTALL_SCRIPT}" --single_user $(shell::tmp_dir) \
     "${BIN_STAGING_DIR}" -- --veyron.tcp.address=127.0.0.1:0 || shell_test::fail "line ${LINENO} failed to start device manager"
-  # Dump nminstall's log, just to provide visibility into its steps.
+  # Dump dminstall's log, just to provide visibility into its steps.
   cat "${START_SERVER_LOG_FILE}"
 
-  local -r NM_NAME=$(hostname)
+  local -r DM_NAME=$(hostname)
   # Verify that device manager is published under the expected name (hostname).
-  shell_test::assert_ne "$("${NAMESPACE_BIN}" glob "${NM_NAME}")" "" "${LINENO}"
+  shell_test::assert_ne "$("${NAMESPACE_BIN}" glob "${DM_NAME}")" "" "${LINENO}"
 
   # Create the client principal, "alice".
   "${PRINCIPAL_BIN}" create --overwrite=true ./alice alice >/dev/null || \
@@ -80,10 +80,10 @@
   export VEYRON_CREDENTIALS=./alice
 
   # Claim the device as "alice/myworkstation".
-  "${DEVICE_BIN}" claim "${NM_NAME}/nm" myworkstation
+  "${DEVICE_BIN}" claim "${DM_NAME}/device" myworkstation
 
   # Verify the device's default blessing is as expected.
-  shell_test::assert_eq "$("${DEBUG_BIN}" stats read "${NM_NAME}/__debug/stats/security/principal/blessingstore" | head -1 | sed -e 's/^.*Default blessings: '//)" \
+  shell_test::assert_eq "$("${DEBUG_BIN}" stats read "${DM_NAME}/__debug/stats/security/principal/blessingstore" | head -1 | sed -e 's/^.*Default blessings: '//)" \
     "alice/myworkstation" "${LINENO}"
 
   # Start a binary server.
@@ -118,10 +118,10 @@
     "BINARYD" "${LINENO}"
 
   # Install the app on the device.
-  local -r INSTALLATION_NAME=$("${DEVICE_BIN}" install "${NM_NAME}/apps" "${SAMPLE_APP_NAME}" | sed -e 's/Successfully installed: "//' | sed -e 's/"//')
+  local -r INSTALLATION_NAME=$("${DEVICE_BIN}" install "${DM_NAME}/apps" "${SAMPLE_APP_NAME}" | sed -e 's/Successfully installed: "//' | sed -e 's/"//')
 
   # Verify that the installation shows up when globbing the device manager.
-  shell_test::assert_eq "$("${NAMESPACE_BIN}" glob "${NM_NAME}/apps/BINARYD/*")" \
+  shell_test::assert_eq "$("${NAMESPACE_BIN}" glob "${DM_NAME}/apps/BINARYD/*")" \
     "${INSTALLATION_NAME}" "${LINENO}"
 
   # Start an instance of the app, granting it blessing extension myapp.
@@ -129,7 +129,7 @@
   wait_for_mountentry "${NAMESPACE_BIN}" "5" "${APP_PUBLISH_NAME}"
 
   # Verify that the instance shows up when globbing the device manager.
-  shell_test::assert_eq "$("${NAMESPACE_BIN}" glob "${NM_NAME}/apps/BINARYD/*/*")" "${INSTANCE_NAME}" "${LINENO}"
+  shell_test::assert_eq "$("${NAMESPACE_BIN}" glob "${DM_NAME}/apps/BINARYD/*/*")" "${INSTANCE_NAME}" "${LINENO}"
 
   # Verify the app's default blessing.
   shell_test::assert_eq "$("${DEBUG_BIN}" stats read "${INSTANCE_NAME}/stats/security/principal/blessingstore" | head -1 | sed -e 's/^.*Default blessings: '//)" \