diff --git a/services/device/internal/impl/debug_perms_test.go b/services/device/internal/impl/debug_perms_test.go
index 7bba065..306cebe 100644
--- a/services/device/internal/impl/debug_perms_test.go
+++ b/services/device/internal/impl/debug_perms_test.go
@@ -44,9 +44,9 @@
 	defer cleanup()
 
 	// Set up the device manager.
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	servicetest.ReadPID(t, dmh)
-	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 
 	// Create the local server that the app uses to let us know it's ready.
 	pingCh, cleanup := utiltest.SetupPingServer(t, ctx)
@@ -62,7 +62,7 @@
 	// TODO(rjkroege): Set AccessLists here that conflict with the one provided by the device
 	// manager and show that the one set here is overridden.
 	// Create the envelope for the first version of the app.
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, appCmd, "google naps", "appV1")
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.AppCmd, "google naps", "appV1")
 
 	// Install the app.
 	appID := utiltest.InstallApp(t, ctx)
@@ -72,7 +72,7 @@
 
 	// Bob starts an instance of the app.
 	bobApp := utiltest.LaunchApp(t, bobCtx, appID)
-	pingCh.VerifyPingArgs(t, userName(t), "default", "")
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "default", "")
 
 	// Bob permits Alice to read from his app.
 	updateAccessList(t, bobCtx, "root/alice/$", string(access.Read), "dm/apps", appID, bobApp)
@@ -200,7 +200,7 @@
 	}
 
 	// Set up the device manager.
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "--log_dir="+extraLogDir, "dm", root, helperPath, "unused", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "--log_dir="+extraLogDir, "dm", root, helperPath, "unused", "unused_curr_link")
 	servicetest.ReadPID(t, dmh)
 
 	// Make some users.
@@ -210,7 +210,7 @@
 	hjCtx := utiltest.CtxWithNewPrincipal(t, selfCtx, idp, "hackerjoe")
 
 	// Bob claims the device manager.
-	utiltest.ClaimDevice(t, bobCtx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, bobCtx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 
 	// Create some globbing test vectors.
 	dmGlobtests := []utiltest.GlobTestVector{
diff --git a/services/device/internal/impl/impl_test.go b/services/device/internal/impl/impl_test.go
index 201a844..babe024 100644
--- a/services/device/internal/impl/impl_test.go
+++ b/services/device/internal/impl/impl_test.go
@@ -13,12 +13,9 @@
 	"crypto/md5"
 	"encoding/base64"
 	"encoding/hex"
-	"flag"
 	"fmt"
-	"io"
 	"io/ioutil"
 	"os"
-	"os/user"
 	"path"
 	"path/filepath"
 	"reflect"
@@ -44,93 +41,21 @@
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/device/internal/impl"
 	"v.io/x/ref/services/device/internal/impl/utiltest"
-	"v.io/x/ref/services/device/internal/suid"
 	"v.io/x/ref/services/internal/binarylib"
 	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/expect"
-	"v.io/x/ref/test/modules"
 	"v.io/x/ref/test/testutil"
 )
 
-//go:generate v23 test generate .
-
-const (
-	// Modules command names.
-	execScriptCmd       = "execScript"
-	deviceManagerCmd    = "deviceManager"
-	deviceManagerV10Cmd = "deviceManagerV10" // deviceManager with a different major version number
-	appCmd              = "app"
-	hangingAppCmd       = "hangingApp"
-	installerCmd        = "installer"
-	uninstallerCmd      = "uninstaller"
-
-	testFlagName = "random_test_flag"
-	// V23 prefix is necessary to pass the env filtering.
-	testEnvVarName = "V23_RANDOM_ENV_VALUE"
-
-	noPairingToken = ""
-)
-
-var flagValue = flag.String(testFlagName, "default", "")
-
-func init() {
-	// The installer sets this flag on the installed device manager, so we
-	// need to ensure it's defined.
-	flag.String("name", "", "")
-}
-
 func TestMain(m *testing.M) {
-	test.Init()
-	isSuidHelper := len(os.Getenv("V23_SUIDHELPER_TEST")) > 0
-	if modules.IsModulesChildProcess() && !isSuidHelper {
-		if err := modules.Dispatch(); err != nil {
-			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
-			os.Exit(1)
-		}
-		return
-	}
-	os.Exit(m.Run())
+	utiltest.TestMainImpl(m)
 }
 
 // TestSuidHelper is testing boilerplate for suidhelper that does not
 // create a runtime because the suidhelper is not a Vanadium application.
 func TestSuidHelper(t *testing.T) {
-	if os.Getenv("V23_SUIDHELPER_TEST") != "1" {
-		return
-	}
-	vlog.VI(1).Infof("TestSuidHelper starting")
-	if err := suid.Run(os.Environ()); err != nil {
-		vlog.Fatalf("Failed to Run() setuidhelper: %v", err)
-	}
-}
-
-// execScript launches the script passed as argument.
-func execScript(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	return utiltest.ExecScript(stdin, stdout, stderr, env, args...)
-}
-
-// deviceManager sets up a device manager server.  It accepts the name to
-// publish the server under as an argument.  Additional arguments can optionally
-// specify device manager config settings.
-func deviceManager(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	return utiltest.DeviceManager(stdin, stdout, stderr, env, args...)
-}
-
-// This is the same as deviceManager above, except that it has a different major version number
-func deviceManagerV10(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	return utiltest.DeviceManagerV10(stdin, stdout, stderr, env, args...)
-}
-
-func app(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	return utiltest.App(stdin, stdout, stderr, env, flagValue, args...)
-}
-
-// Same as app, except that it does not exit properly after being stopped
-func hangingApp(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	err := app(stdin, stdout, stderr, env, args...)
-	time.Sleep(24 * time.Hour)
-	return err
+	utiltest.TestSuidHelperImpl(t)
 }
 
 // TODO(rjkroege): generateDeviceManagerScript and generateSuidHelperScript have
@@ -209,7 +134,7 @@
 	defer os.RemoveAll(dmCreds)
 	dmEnv := []string{fmt.Sprintf("%v=%v", envvar.Credentials, dmCreds)}
 	dmArgs := []string{"factoryDM", root, "unused_helper", utiltest.MockApplicationRepoName, currLink}
-	args, env := sh.CommandEnvelope(deviceManagerCmd, dmEnv, dmArgs...)
+	args, env := sh.CommandEnvelope(utiltest.DeviceManagerCmd, dmEnv, dmArgs...)
 	scriptPathFactory := generateDeviceManagerScript(t, root, args, env)
 
 	if err := os.Symlink(scriptPathFactory, currLink); err != nil {
@@ -227,7 +152,7 @@
 	// demonstrates that the initial device manager could be running by hand
 	// as long as the right initial configuration is passed into the device
 	// manager implementation.
-	dmh := servicetest.RunCommand(t, sh, dmPauseBeforeStopEnv, deviceManagerCmd, dmArgs...)
+	dmh := servicetest.RunCommand(t, sh, dmPauseBeforeStopEnv, utiltest.DeviceManagerCmd, dmArgs...)
 	defer func() {
 		syscall.Kill(dmh.Pid(), syscall.SIGINT)
 		utiltest.VerifyNoRunningProcesses(t)
@@ -236,9 +161,9 @@
 	servicetest.ReadPID(t, dmh)
 	utiltest.Resolve(t, ctx, "claimable", 1)
 	// Brand new device manager must be claimed first.
-	utiltest.ClaimDevice(t, ctx, "claimable", "factoryDM", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, ctx, "claimable", "factoryDM", "mydevice", utiltest.NoPairingToken)
 	// Simulate an invalid envelope in the application repository.
-	*envelope = utiltest.EnvelopeFromShell(sh, dmPauseBeforeStopEnv, deviceManagerCmd, "bogus", dmArgs...)
+	*envelope = utiltest.EnvelopeFromShell(sh, dmPauseBeforeStopEnv, utiltest.DeviceManagerCmd, "bogus", dmArgs...)
 
 	utiltest.UpdateDeviceExpectError(t, ctx, "factoryDM", impl.ErrAppTitleMismatch.ID)
 	utiltest.RevertDeviceExpectError(t, ctx, "factoryDM", impl.ErrUpdateNoOp.ID)
@@ -246,7 +171,7 @@
 	// Set up a second version of the device manager. The information in the
 	// envelope will be used by the device manager to stage the next
 	// version.
-	*envelope = utiltest.EnvelopeFromShell(sh, dmEnv, deviceManagerCmd, application.DeviceManagerTitle, "v2DM")
+	*envelope = utiltest.EnvelopeFromShell(sh, dmEnv, utiltest.DeviceManagerCmd, application.DeviceManagerTitle, "v2DM")
 	utiltest.UpdateDevice(t, ctx, "factoryDM")
 
 	// Current link should have been updated to point to v2.
@@ -274,7 +199,7 @@
 	// relaunch it from the current link.
 	utiltest.ResolveExpectNotFound(t, ctx, "v2DM") // Ensure a clean slate.
 
-	dmh = servicetest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, utiltest.ExecScriptCmd, currLink)
 
 	servicetest.ReadPID(t, dmh)
 	utiltest.Resolve(t, ctx, "v2DM", 1) // Current link should have been launching v2.
@@ -290,7 +215,7 @@
 	// Try issuing an update with a binary that has a different major version
 	// number. It should fail.
 	utiltest.ResolveExpectNotFound(t, ctx, "v2.5DM") // Ensure a clean slate.
-	*envelope = utiltest.EnvelopeFromShell(sh, dmEnv, deviceManagerV10Cmd, application.DeviceManagerTitle, "v2.5DM")
+	*envelope = utiltest.EnvelopeFromShell(sh, dmEnv, utiltest.DeviceManagerV10Cmd, application.DeviceManagerTitle, "v2.5DM")
 	utiltest.UpdateDeviceExpectError(t, ctx, "v2DM", impl.ErrOperationFailed.ID)
 
 	if evalLink() != scriptPathV2 {
@@ -298,7 +223,7 @@
 	}
 
 	// Create a third version of the device manager and issue an update.
-	*envelope = utiltest.EnvelopeFromShell(sh, dmEnv, deviceManagerCmd, application.DeviceManagerTitle, "v3DM")
+	*envelope = utiltest.EnvelopeFromShell(sh, dmEnv, utiltest.DeviceManagerCmd, application.DeviceManagerTitle, "v3DM")
 	utiltest.UpdateDevice(t, ctx, "v2DM")
 
 	scriptPathV3 := evalLink()
@@ -316,7 +241,7 @@
 	// Re-lanuch the device manager from current link.  We instruct the
 	// device manager to pause before stopping its server, so that we can
 	// verify that a second revert fails while a revert is in progress.
-	dmh = servicetest.RunCommand(t, sh, dmPauseBeforeStopEnv, execScriptCmd, currLink)
+	dmh = servicetest.RunCommand(t, sh, dmPauseBeforeStopEnv, utiltest.ExecScriptCmd, currLink)
 
 	servicetest.ReadPID(t, dmh)
 	utiltest.Resolve(t, ctx, "v3DM", 1) // Current link should have been launching v3.
@@ -334,7 +259,7 @@
 
 	utiltest.ResolveExpectNotFound(t, ctx, "v2DM") // Ensure a clean slate.
 
-	dmh = servicetest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, utiltest.ExecScriptCmd, currLink)
 	servicetest.ReadPID(t, dmh)
 	utiltest.Resolve(t, ctx, "v2DM", 1) // Current link should have been launching v2.
 
@@ -349,7 +274,7 @@
 
 	utiltest.ResolveExpectNotFound(t, ctx, "factoryDM") // Ensure a clean slate.
 
-	dmh = servicetest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, utiltest.ExecScriptCmd, currLink)
 	servicetest.ReadPID(t, dmh)
 	utiltest.Resolve(t, ctx, "factoryDM", 1) // Current link should have been launching factory version.
 	utiltest.ShutdownDevice(t, ctx, "factoryDM")
@@ -358,7 +283,7 @@
 
 	// Re-launch the device manager, to exercise the behavior of Stop.
 	utiltest.ResolveExpectNotFound(t, ctx, "factoryDM") // Ensure a clean slate.
-	dmh = servicetest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, utiltest.ExecScriptCmd, currLink)
 	servicetest.ReadPID(t, dmh)
 	utiltest.Resolve(t, ctx, "factoryDM", 1)
 	utiltest.KillDevice(t, ctx, "factoryDM")
@@ -420,9 +345,9 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	servicetest.ReadPID(t, dmh)
-	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 
 	// Create the local server that the app uses to let us know it's ready.
 	pingCh, cleanup := utiltest.SetupPingServer(t, ctx)
@@ -431,7 +356,7 @@
 	utiltest.Resolve(t, ctx, "pingserver", 1)
 
 	// Create an envelope for a first version of the app.
-	*envelope = utiltest.EnvelopeFromShell(sh, []string{utiltest.TestEnvVarName + "=env-val-envelope"}, appCmd, "google naps", fmt.Sprintf("--%s=flag-val-envelope", testFlagName), "appV1")
+	*envelope = utiltest.EnvelopeFromShell(sh, []string{utiltest.TestEnvVarName + "=env-val-envelope"}, utiltest.AppCmd, "google naps", fmt.Sprintf("--%s=flag-val-envelope", utiltest.TestFlagName), "appV1")
 
 	// Install the app.  The config-specified flag value for testFlagName
 	// should override the value specified in the envelope above, and the
@@ -444,7 +369,7 @@
 	// This rooted name should be equivalent to the relative name "ar", but
 	// we want to test that the config override for origin works.
 	rootedAppRepoName := naming.Join(mtName, "ar")
-	appID := utiltest.InstallApp(t, ctx, device.Config{testFlagName: "flag-val-install", mgmt.AppOriginConfigKey: rootedAppRepoName})
+	appID := utiltest.InstallApp(t, ctx, device.Config{utiltest.TestFlagName: "flag-val-install", mgmt.AppOriginConfigKey: rootedAppRepoName})
 	v1 := utiltest.VerifyState(t, ctx, device.InstallationStateActive, appID)
 	installationDebug := utiltest.Debug(t, ctx, appID)
 	// We spot-check a couple pieces of information we expect in the debug
@@ -479,7 +404,7 @@
 	}
 
 	// Wait until the app pings us that it's ready.
-	pingCh.VerifyPingArgs(t, userName(t), "flag-val-install", "env-val-envelope")
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "flag-val-install", "env-val-envelope")
 
 	v1EP1 := utiltest.Resolve(t, ctx, "appV1", 1)[0]
 
@@ -490,7 +415,7 @@
 
 	utiltest.RunApp(t, ctx, appID, instance1ID)
 	utiltest.VerifyState(t, ctx, device.InstanceStateRunning, appID, instance1ID)
-	pingCh.VerifyPingArgs(t, userName(t), "flag-val-install", "env-val-envelope") // Wait until the app pings us that it's ready.
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "flag-val-install", "env-val-envelope") // Wait until the app pings us that it's ready.
 	oldV1EP1 := v1EP1
 	if v1EP1 = utiltest.Resolve(t, ctx, "appV1", 1)[0]; v1EP1 == oldV1EP1 {
 		t.Fatalf("Expected a new endpoint for the app after kill/run")
@@ -498,7 +423,7 @@
 
 	// Start a second instance.
 	instance2ID := utiltest.LaunchApp(t, ctx, appID)
-	pingCh.VerifyPingArgs(t, userName(t), "flag-val-install", "env-val-envelope") // Wait until the app pings us that it's ready.
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "flag-val-install", "env-val-envelope") // Wait until the app pings us that it's ready.
 
 	// There should be two endpoints mounted as "appV1", one for each
 	// instance of the app.
@@ -527,12 +452,12 @@
 	utiltest.UpdateAppExpectError(t, ctx, appID, impl.ErrUpdateNoOp.ID)
 
 	// Updating the installation should not work with a mismatched title.
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, appCmd, "bogus")
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.AppCmd, "bogus")
 
 	utiltest.UpdateAppExpectError(t, ctx, appID, impl.ErrAppTitleMismatch.ID)
 
 	// Create a second version of the app and update the app to it.
-	*envelope = utiltest.EnvelopeFromShell(sh, []string{utiltest.TestEnvVarName + "=env-val-envelope"}, appCmd, "google naps", "appV2")
+	*envelope = utiltest.EnvelopeFromShell(sh, []string{utiltest.TestEnvVarName + "=env-val-envelope"}, utiltest.AppCmd, "google naps", "appV2")
 
 	utiltest.UpdateApp(t, ctx, appID)
 
@@ -554,7 +479,7 @@
 	if v := utiltest.VerifyState(t, ctx, device.InstanceStateRunning, appID, instance1ID); v != v1 {
 		t.Fatalf("Instance version expected to be %v, got %v instead", v1, v)
 	}
-	pingCh.VerifyPingArgs(t, userName(t), "flag-val-install", "env-val-envelope") // Wait until the app pings us that it's ready.
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "flag-val-install", "env-val-envelope") // Wait until the app pings us that it's ready.
 	// Both instances should still be running the first version of the app.
 	// Check that the mounttable contains two endpoints, one of which is
 	// v1EP2.
@@ -582,7 +507,7 @@
 	}
 	// Resume the first instance and verify it's running v2 now.
 	utiltest.RunApp(t, ctx, appID, instance1ID)
-	pingCh.VerifyPingArgs(t, userName(t), "flag-val-install", "env-val-envelope")
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "flag-val-install", "env-val-envelope")
 	utiltest.Resolve(t, ctx, "appV1", 1)
 	utiltest.Resolve(t, ctx, "appV2", 1)
 
@@ -597,7 +522,7 @@
 		t.Fatalf("Instance version expected to be %v, got %v instead", v2, v)
 	}
 	// Wait until the app pings us that it's ready.
-	pingCh.VerifyPingArgs(t, userName(t), "flag-val-install", "env-val-envelope")
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "flag-val-install", "env-val-envelope")
 
 	utiltest.Resolve(t, ctx, "appV2", 1)
 
@@ -620,7 +545,7 @@
 	if v := utiltest.VerifyState(t, ctx, device.InstanceStateRunning, appID, instance4ID); v != v1 {
 		t.Fatalf("Instance version expected to be %v, got %v instead", v1, v)
 	}
-	pingCh.VerifyPingArgs(t, userName(t), "flag-val-install", "env-val-envelope") // Wait until the app pings us that it's ready.
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "flag-val-install", "env-val-envelope") // Wait until the app pings us that it's ready.
 	utiltest.Resolve(t, ctx, "appV1", 1)
 	utiltest.TerminateApp(t, ctx, appID, instance4ID)
 	utiltest.ResolveExpectNotFound(t, ctx, "appV1")
@@ -645,7 +570,7 @@
 	// cleanly Do this by installing, instantiating, running, and killing
 	// hangingApp, which sleeps (rather than exits) after being asked to
 	// Stop()
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, hangingAppCmd, "hanging ap", "hAppV1")
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.HangingAppCmd, "hanging ap", "hAppV1")
 	hAppID := utiltest.InstallApp(t, ctx)
 	hInstanceID := utiltest.LaunchApp(t, ctx, hAppID)
 	hangingPid := pingCh.WaitForPingArgs(t).Pid
@@ -731,11 +656,11 @@
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
 	pairingToken := "abcxyz"
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link", pairingToken)
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link", pairingToken)
 	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, appCmd, "google naps", "trapp")
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.AppCmd, "google naps", "trapp")
 
 	claimantCtx := utiltest.CtxWithNewPrincipal(t, ctx, idp, "claimant")
 	octx, err := v23.WithPrincipal(ctx, testutil.NewPrincipal("other"))
@@ -812,13 +737,13 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
 	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 	defer utiltest.VerifyNoRunningProcesses(t)
 
 	// Create an envelope for an app.
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, appCmd, "google naps")
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.AppCmd, "google naps")
 
 	// On an unclaimed device manager, there will be no AccessLists.
 	if _, _, err := device.DeviceClient("claimable").GetPermissions(selfCtx); err == nil {
@@ -826,7 +751,7 @@
 	}
 
 	// Claim the devicemanager as "root/self/mydevice"
-	utiltest.ClaimDevice(t, selfCtx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, selfCtx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 	expectedAccessList := make(access.Permissions)
 	for _, tag := range access.AllTypicalTags() {
 		expectedAccessList[string(tag)] = access.AccessList{In: []security.BlessingPattern{"root/$", "root/self/$", "root/self/mydevice/$"}}
@@ -900,7 +825,7 @@
 	// Create an 'envelope' for the device manager that we can pass to the
 	// installer, to ensure that the device manager that the installer
 	// configures can run.
-	dmargs, dmenv := sh.CommandEnvelope(deviceManagerCmd, nil, "dm")
+	dmargs, dmenv := sh.CommandEnvelope(utiltest.DeviceManagerCmd, nil, "dm")
 	dmDir := filepath.Join(testDir, "dm")
 	// TODO(caprita): Add test logic when initMode = true.
 	singleUser, sessionMode, initMode := true, true, false
@@ -918,7 +843,7 @@
 	}
 	dms := expect.NewSession(t, stdout, servicetest.ExpectTimeout)
 	servicetest.ReadPID(t, dms)
-	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 	utiltest.RevertDeviceExpectError(t, ctx, "dm", impl.ErrUpdateNoOp.ID) // No previous version available.
 
 	// Stop the device manager.
@@ -963,7 +888,7 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
@@ -972,10 +897,10 @@
 	defer cleanup()
 
 	// Create the envelope for the first version of the app.
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, appCmd, "google naps", "appV1")
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.AppCmd, "google naps", "appV1")
 
 	// Device must be claimed before applications can be installed.
-	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 	// Install the app.
 	appID := utiltest.InstallApp(t, ctx)
 	install1ID := path.Base(appID)
@@ -1091,7 +1016,7 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 	defer utiltest.VerifyNoRunningProcesses(t)
@@ -1101,7 +1026,7 @@
 	defer cleanup()
 
 	// Create the envelope for the first version of the app.
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, appCmd, "google naps", "appV1")
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.AppCmd, "google naps", "appV1")
 	envelope.Packages = map[string]application.SignedFile{
 		"test": application.SignedFile{
 			File: "realbin/testpkg",
@@ -1126,7 +1051,7 @@
 		},
 	}
 	// Device must be claimed before apps can be installed.
-	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 	// Install the app.
 	appID := utiltest.InstallApp(t, ctx, packages)
 
@@ -1206,7 +1131,7 @@
 		v23.GetPrincipal(c).AddToRoots(v23.GetPrincipal(ctx).BlessingStore().Default())
 	}
 
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
 	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 	defer utiltest.VerifyNoRunningProcesses(t)
@@ -1218,7 +1143,7 @@
 	}
 
 	// self claims the device manager.
-	utiltest.ClaimDevice(t, selfCtx, "claimable", "dm", "alice", noPairingToken)
+	utiltest.ClaimDevice(t, selfCtx, "claimable", "dm", "alice", utiltest.NoPairingToken)
 
 	vlog.VI(2).Info("Verify that associations start out empty.")
 	deviceStub := device.DeviceClient("dm/device")
@@ -1266,16 +1191,6 @@
 	})
 }
 
-// userName is a helper function to determine the system name that the test is
-// running under.
-func userName(t *testing.T) string {
-	u, err := user.Current()
-	if err != nil {
-		t.Fatalf("user.Current() failed: %v", err)
-	}
-	return u.Username
-}
-
 func TestAppWithSuidHelper(t *testing.T) {
 	ctx, shutdown := initForTest()
 	defer shutdown()
@@ -1306,12 +1221,12 @@
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := utiltest.GenerateSuidHelperScript(t, root)
 
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "-mocksetuid", "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "-mocksetuid", "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 	defer utiltest.VerifyNoRunningProcesses(t)
 	// Claim the devicemanager with selfCtx as root/self/alice
-	utiltest.ClaimDevice(t, selfCtx, "claimable", "dm", "alice", noPairingToken)
+	utiltest.ClaimDevice(t, selfCtx, "claimable", "dm", "alice", utiltest.NoPairingToken)
 
 	deviceStub := device.DeviceClient("dm/device")
 
@@ -1321,7 +1236,7 @@
 	defer cleanup()
 
 	// Create an envelope for a first version of the app.
-	*envelope = utiltest.EnvelopeFromShell(sh, []string{utiltest.TestEnvVarName + "=env-var"}, appCmd, "google naps", fmt.Sprintf("--%s=flag-val-envelope", testFlagName), "appV1")
+	*envelope = utiltest.EnvelopeFromShell(sh, []string{utiltest.TestEnvVarName + "=env-var"}, utiltest.AppCmd, "google naps", fmt.Sprintf("--%s=flag-val-envelope", utiltest.TestFlagName), "appV1")
 
 	// Install and start the app as root/self.
 	appID := utiltest.InstallApp(t, selfCtx)
@@ -1489,10 +1404,10 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
-	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 
 	publisher, err := v23.GetPrincipal(ctx).BlessSelf("publisher")
 	if err != nil {
diff --git a/services/device/internal/impl/instance_reaping_test.go b/services/device/internal/impl/instance_reaping_test.go
index a563484..39e74e8 100644
--- a/services/device/internal/impl/instance_reaping_test.go
+++ b/services/device/internal/impl/instance_reaping_test.go
@@ -5,20 +5,14 @@
 package impl_test
 
 import (
-	"fmt"
-	"io/ioutil"
-	"os"
 	"syscall"
 	"testing"
-	"time"
 
-	"v.io/v23/context"
 	"v.io/v23/naming"
 	"v.io/v23/services/device"
 	"v.io/v23/services/stats"
 	"v.io/v23/vdl"
 
-	"v.io/x/ref/envvar"
 	"v.io/x/ref/services/device/internal/impl/utiltest"
 	"v.io/x/ref/services/internal/servicetest"
 )
@@ -29,9 +23,9 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	dmh := servicetest.RunCommand(t, sh, nil, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	servicetest.ReadPID(t, dmh)
-	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", noPairingToken)
+	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
 
 	// Create the local server that the app uses to let us know it's ready.
 	pingCh, cleanup := utiltest.SetupPingServer(t, ctx)
@@ -40,7 +34,7 @@
 	utiltest.Resolve(t, ctx, "pingserver", 1)
 
 	// Create an envelope for a first version of the app.
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, appCmd, "google naps", "appV1")
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.AppCmd, "google naps", "appV1")
 
 	// Install the app.  The config-specified flag value for testFlagName
 	// should override the value specified in the envelope above.
@@ -50,7 +44,7 @@
 	instance1ID := utiltest.LaunchApp(t, ctx, appID)
 
 	// Wait until the app pings us that it's ready.
-	pingCh.VerifyPingArgs(t, userName(t), "default", "")
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "default", "")
 
 	// Get application pid.
 	name := naming.Join("dm", "apps/"+appID+"/"+instance1ID+"/stats/system/pid")
@@ -69,7 +63,7 @@
 
 	// Start a second instance of the app which will force polling to happen.
 	instance2ID := utiltest.LaunchApp(t, ctx, appID)
-	pingCh.VerifyPingArgs(t, userName(t), "default", "")
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "default", "")
 
 	utiltest.VerifyState(t, ctx, device.InstanceStateRunning, appID, instance2ID)
 
@@ -84,124 +78,3 @@
 	dmh.Expect("dm terminated")
 	dmh.ExpectEOF()
 }
-
-func getPid(t *testing.T, ctx *context.T, appID, instanceID string) int {
-	name := naming.Join("dm", "apps/"+appID+"/"+instanceID+"/stats/system/pid")
-	c := stats.StatsClient(name)
-	v, err := c.Value(ctx)
-	if err != nil {
-		t.Fatalf("Value() failed: %v\n", err)
-	}
-	return int(v.Int())
-}
-
-func TestReapReconciliation(t *testing.T) {
-	cleanup, ctx, sh, envelope, root, helperPath, _ := utiltest.StartupHelper(t)
-	defer cleanup()
-
-	// Start a device manager.
-	// (Since it will be restarted, use the VeyronCredentials environment
-	// to maintain the same set of credentials across runs)
-	dmCreds, err := ioutil.TempDir("", "TestDeviceManagerUpdateAndRevert")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(dmCreds)
-	dmEnv := []string{fmt.Sprintf("%v=%v", envvar.Credentials, dmCreds)}
-
-	dmh := servicetest.RunCommand(t, sh, dmEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	servicetest.ReadPID(t, dmh)
-	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", noPairingToken)
-
-	// Create the local server that the app uses to let us know it's ready.
-	pingCh, cleanup := utiltest.SetupPingServer(t, ctx)
-	defer cleanup()
-	utiltest.Resolve(t, ctx, "pingserver", 1)
-
-	// Create an envelope for the app.
-	*envelope = utiltest.EnvelopeFromShell(sh, nil, appCmd, "google naps", "appV1")
-
-	// Install the app.
-	appID := utiltest.InstallApp(t, ctx)
-
-	// Start three app instances.
-	instances := make([]string, 3)
-	for i, _ := range instances {
-		instances[i] = utiltest.LaunchApp(t, ctx, appID)
-		pingCh.VerifyPingArgs(t, userName(t), "default", "")
-	}
-
-	// Get pid of instance[0]
-	pid := getPid(t, ctx, appID, instances[0])
-
-	// Shutdown the first device manager.
-	syscall.Kill(dmh.Pid(), syscall.SIGINT)
-	dmh.Expect("dm terminated")
-	dmh.ExpectEOF()
-	dmh.Shutdown(os.Stderr, os.Stderr)
-	utiltest.ResolveExpectNotFound(t, ctx, "dm") // Ensure a clean slate.
-
-	// Kill instance[0] and wait until it exits before proceeding.
-	syscall.Kill(pid, 9)
-	timeOut := time.After(5 * time.Second)
-	for syscall.Kill(pid, 0) == nil {
-		select {
-		case <-timeOut:
-			t.Fatalf("Timed out waiting for PID %v to terminate", pid)
-		case <-time.After(time.Millisecond):
-			// Try again.
-		}
-	}
-
-	// Run another device manager to replace the dead one.
-	dmh = servicetest.RunCommand(t, sh, dmEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	servicetest.ReadPID(t, dmh)
-	utiltest.Resolve(t, ctx, "dm", 1) // Verify the device manager has published itself.
-
-	// By now, we've reconciled the state of the tree with which processes
-	// are actually alive. instance-0 is not alive.
-	expected := []device.InstanceState{device.InstanceStateNotRunning, device.InstanceStateRunning, device.InstanceStateRunning}
-	for i, _ := range instances {
-		utiltest.VerifyState(t, ctx, expected[i], appID, instances[i])
-	}
-
-	// Start instance[0] over-again to show that an app marked not running
-	// by reconciliation can be restarted.
-	utiltest.RunApp(t, ctx, appID, instances[0])
-	pingCh.VerifyPingArgs(t, userName(t), "default", "")
-
-	// Kill instance[1]
-	pid = getPid(t, ctx, appID, instances[1])
-	syscall.Kill(pid, 9)
-
-	// Make a fourth instance. This forces a polling of processes so that
-	// the state is updated.
-	instances = append(instances, utiltest.LaunchApp(t, ctx, appID))
-	pingCh.VerifyPingArgs(t, userName(t), "default", "")
-
-	// Stop the fourth instance to make sure that there's no way we could
-	// still be running the polling loop before doing the below.
-	utiltest.TerminateApp(t, ctx, appID, instances[3])
-
-	// Verify that reaper picked up the previous instances and was watching
-	// instance[1]
-	expected = []device.InstanceState{device.InstanceStateRunning, device.InstanceStateNotRunning, device.InstanceStateRunning, device.InstanceStateDeleted}
-	for i, _ := range instances {
-		utiltest.VerifyState(t, ctx, expected[i], appID, instances[i])
-	}
-
-	utiltest.TerminateApp(t, ctx, appID, instances[2])
-
-	expected = []device.InstanceState{device.InstanceStateRunning, device.InstanceStateNotRunning, device.InstanceStateDeleted, device.InstanceStateDeleted}
-	for i, _ := range instances {
-		utiltest.VerifyState(t, ctx, expected[i], appID, instances[i])
-	}
-	utiltest.TerminateApp(t, ctx, appID, instances[0])
-
-	// TODO(rjkroege): Should be in a defer to ensure that the device
-	// manager is cleaned up even if the test fails in an exceptional way.
-	utiltest.VerifyNoRunningProcesses(t)
-	syscall.Kill(dmh.Pid(), syscall.SIGINT)
-	dmh.Expect("dm terminated")
-	dmh.ExpectEOF()
-}
diff --git a/services/device/internal/impl/only_for_test.go b/services/device/internal/impl/only_for_test.go
index 23bcc37..0cec861 100644
--- a/services/device/internal/impl/only_for_test.go
+++ b/services/device/internal/impl/only_for_test.go
@@ -11,7 +11,6 @@
 	"path/filepath"
 
 	"v.io/v23/rpc"
-	"v.io/v23/services/device"
 	"v.io/x/lib/vlog"
 )
 
@@ -54,10 +53,6 @@
 		}
 	}
 	isSetuid = possiblyMockIsSetuid
-
-	Describe = func() (descr device.Description, err error) {
-		return device.Description{Profiles: map[string]struct{}{"test-profile": struct{}{}}}, nil
-	}
 }
 
 func possiblyMockIsSetuid(fileStat os.FileInfo) bool {
diff --git a/services/device/internal/impl/reaping/doc.go b/services/device/internal/impl/reaping/doc.go
new file mode 100644
index 0000000..b791c77
--- /dev/null
+++ b/services/device/internal/impl/reaping/doc.go
@@ -0,0 +1,8 @@
+// Copyright 2015 The Vanadium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package reaping
+
+// Test code for the device manager's facility to watch if applications
+// have stopped operation.
diff --git a/services/device/internal/impl/reaping/impl_test.go b/services/device/internal/impl/reaping/impl_test.go
new file mode 100644
index 0000000..abc7f7a
--- /dev/null
+++ b/services/device/internal/impl/reaping/impl_test.go
@@ -0,0 +1,21 @@
+// Copyright 2015 The Vanadium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package reaping_test
+
+import (
+	"testing"
+
+	"v.io/x/ref/services/device/internal/impl/utiltest"
+)
+
+func TestMain(m *testing.M) {
+	utiltest.TestMainImpl(m)
+}
+
+// TestSuidHelper is testing boilerplate for suidhelper that does not
+// create a runtime because the suidhelper is not a Vanadium application.
+func TestSuidHelper(t *testing.T) {
+	utiltest.TestSuidHelperImpl(t)
+}
diff --git a/services/device/internal/impl/reaping/instance_reaping_test.go b/services/device/internal/impl/reaping/instance_reaping_test.go
new file mode 100644
index 0000000..195799d
--- /dev/null
+++ b/services/device/internal/impl/reaping/instance_reaping_test.go
@@ -0,0 +1,144 @@
+// Copyright 2015 The Vanadium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package reaping_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"syscall"
+	"testing"
+	"time"
+
+	"v.io/v23/context"
+	"v.io/v23/naming"
+	"v.io/v23/services/device"
+	"v.io/v23/services/stats"
+
+	"v.io/x/ref/envvar"
+	"v.io/x/ref/services/device/internal/impl/utiltest"
+	"v.io/x/ref/services/internal/servicetest"
+)
+
+func getPid(t *testing.T, ctx *context.T, appID, instanceID string) int {
+	name := naming.Join("dm", "apps/"+appID+"/"+instanceID+"/stats/system/pid")
+	c := stats.StatsClient(name)
+	v, err := c.Value(ctx)
+	if err != nil {
+		t.Fatalf("Value() failed: %v\n", err)
+	}
+	return int(v.Int())
+}
+
+func TestReapReconciliation(t *testing.T) {
+	cleanup, ctx, sh, envelope, root, helperPath, _ := utiltest.StartupHelper(t)
+	defer cleanup()
+
+	// Start a device manager.
+	// (Since it will be restarted, use the VeyronCredentials environment
+	// to maintain the same set of credentials across runs)
+	dmCreds, err := ioutil.TempDir("", "TestDeviceManagerUpdateAndRevert")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dmCreds)
+	dmEnv := []string{fmt.Sprintf("%v=%v", envvar.Credentials, dmCreds)}
+
+	dmh := servicetest.RunCommand(t, sh, dmEnv, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	servicetest.ReadPID(t, dmh)
+	utiltest.ClaimDevice(t, ctx, "claimable", "dm", "mydevice", utiltest.NoPairingToken)
+
+	// Create the local server that the app uses to let us know it's ready.
+	pingCh, cleanup := utiltest.SetupPingServer(t, ctx)
+	defer cleanup()
+	utiltest.Resolve(t, ctx, "pingserver", 1)
+
+	// Create an envelope for the app.
+	*envelope = utiltest.EnvelopeFromShell(sh, nil, utiltest.AppCmd, "google naps", "appV1")
+
+	// Install the app.
+	appID := utiltest.InstallApp(t, ctx)
+
+	// Start three app instances.
+	instances := make([]string, 3)
+	for i, _ := range instances {
+		instances[i] = utiltest.LaunchApp(t, ctx, appID)
+		pingCh.VerifyPingArgs(t, utiltest.UserName(t), "default", "")
+	}
+
+	// Get pid of instance[0]
+	pid := getPid(t, ctx, appID, instances[0])
+
+	// Shutdown the first device manager.
+	syscall.Kill(dmh.Pid(), syscall.SIGINT)
+	dmh.Expect("dm terminated")
+	dmh.ExpectEOF()
+	dmh.Shutdown(os.Stderr, os.Stderr)
+	utiltest.ResolveExpectNotFound(t, ctx, "dm") // Ensure a clean slate.
+
+	// Kill instance[0] and wait until it exits before proceeding.
+	syscall.Kill(pid, 9)
+	timeOut := time.After(5 * time.Second)
+	for syscall.Kill(pid, 0) == nil {
+		select {
+		case <-timeOut:
+			t.Fatalf("Timed out waiting for PID %v to terminate", pid)
+		case <-time.After(time.Millisecond):
+			// Try again.
+		}
+	}
+
+	// Run another device manager to replace the dead one.
+	dmh = servicetest.RunCommand(t, sh, dmEnv, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	servicetest.ReadPID(t, dmh)
+	utiltest.Resolve(t, ctx, "dm", 1) // Verify the device manager has published itself.
+
+	// By now, we've reconciled the state of the tree with which processes
+	// are actually alive. instance-0 is not alive.
+	expected := []device.InstanceState{device.InstanceStateNotRunning, device.InstanceStateRunning, device.InstanceStateRunning}
+	for i, _ := range instances {
+		utiltest.VerifyState(t, ctx, expected[i], appID, instances[i])
+	}
+
+	// Start instance[0] over-again to show that an app marked not running
+	// by reconciliation can be restarted.
+	utiltest.RunApp(t, ctx, appID, instances[0])
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "default", "")
+
+	// Kill instance[1]
+	pid = getPid(t, ctx, appID, instances[1])
+	syscall.Kill(pid, 9)
+
+	// Make a fourth instance. This forces a polling of processes so that
+	// the state is updated.
+	instances = append(instances, utiltest.LaunchApp(t, ctx, appID))
+	pingCh.VerifyPingArgs(t, utiltest.UserName(t), "default", "")
+
+	// Stop the fourth instance to make sure that there's no way we could
+	// still be running the polling loop before doing the below.
+	utiltest.TerminateApp(t, ctx, appID, instances[3])
+
+	// Verify that reaper picked up the previous instances and was watching
+	// instance[1]
+	expected = []device.InstanceState{device.InstanceStateRunning, device.InstanceStateNotRunning, device.InstanceStateRunning, device.InstanceStateDeleted}
+	for i, _ := range instances {
+		utiltest.VerifyState(t, ctx, expected[i], appID, instances[i])
+	}
+
+	utiltest.TerminateApp(t, ctx, appID, instances[2])
+
+	expected = []device.InstanceState{device.InstanceStateRunning, device.InstanceStateNotRunning, device.InstanceStateDeleted, device.InstanceStateDeleted}
+	for i, _ := range instances {
+		utiltest.VerifyState(t, ctx, expected[i], appID, instances[i])
+	}
+	utiltest.TerminateApp(t, ctx, appID, instances[0])
+
+	// TODO(rjkroege): Should be in a defer to ensure that the device
+	// manager is cleaned up even if the test fails in an exceptional way.
+	utiltest.VerifyNoRunningProcesses(t)
+	syscall.Kill(dmh.Pid(), syscall.SIGINT)
+	dmh.Expect("dm terminated")
+	dmh.ExpectEOF()
+}
diff --git a/services/device/internal/impl/utiltest/app.go b/services/device/internal/impl/utiltest/app.go
index 2b7ec13..47d88a4 100644
--- a/services/device/internal/impl/utiltest/app.go
+++ b/services/device/internal/impl/utiltest/app.go
@@ -6,6 +6,7 @@
 
 import (
 	"encoding/json"
+	"flag"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -31,6 +32,18 @@
 	"v.io/x/ref/test/testutil"
 )
 
+const (
+	TestFlagName = "random_test_flag"
+)
+
+var flagValue = flag.String(TestFlagName, "default", "")
+
+func init() {
+	// The installer sets this flag on the installed device manager, so we
+	// need to ensure it's defined.
+	flag.String("name", "", "")
+}
+
 // appService defines a test service that the test app should be running.
 // TODO(caprita): Use this to make calls to the app and verify how Kill
 // interacts with an active service.
@@ -100,8 +113,8 @@
 	return content, nil
 }
 
-// App is a test application. It pings the invoking device manager with state information.
-func App(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, flagValue *string, args ...string) error {
+// app is a test application. It pings the invoking device manager with state information.
+func app(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
@@ -179,3 +192,10 @@
 		t.Fatalf(testutil.FormatLogLine(2, "got ping args %q, expected %q", args, wantArgs))
 	}
 }
+
+// Same as app, except that it does not exit properly after being stopped
+func hangingApp(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
+	err := app(stdin, stdout, stderr, env, args...)
+	time.Sleep(24 * time.Hour)
+	return err
+}
diff --git a/services/device/internal/impl/utiltest/helpers.go b/services/device/internal/impl/utiltest/helpers.go
index e118a60..5b753c0 100644
--- a/services/device/internal/impl/utiltest/helpers.go
+++ b/services/device/internal/impl/utiltest/helpers.go
@@ -9,6 +9,7 @@
 	"fmt"
 	"io/ioutil"
 	"os"
+	"os/user"
 	"path/filepath"
 	"reflect"
 	"regexp"
@@ -45,6 +46,12 @@
 	killTimeout = 20 * time.Second
 )
 
+func init() {
+	impl.Describe = func() (descr device.Description, err error) {
+		return device.Description{Profiles: map[string]struct{}{"test-profile": struct{}{}}}, nil
+	}
+}
+
 func EnvelopeFromShell(sh *modules.Shell, env []string, cmd, title string, args ...string) application.Envelope {
 	args, nenv := sh.CommandEnvelope(cmd, env, args...)
 	return application.Envelope{
@@ -650,3 +657,11 @@
 	ctx, _, err := v23.WithNewNamespace(ctx, roots...)
 	return ctx, err
 }
+
+func UserName(t *testing.T) string {
+	u, err := user.Current()
+	if err != nil {
+		t.Fatalf("user.Current() failed: %v", err)
+	}
+	return u.Username
+}
diff --git a/services/device/internal/impl/utiltest/modules.go b/services/device/internal/impl/utiltest/modules.go
index 65852ed..96d6f6b 100644
--- a/services/device/internal/impl/utiltest/modules.go
+++ b/services/device/internal/impl/utiltest/modules.go
@@ -10,6 +10,7 @@
 	"os"
 	goexec "os/exec"
 	"strings"
+	"testing"
 
 	"v.io/v23"
 	"v.io/v23/naming"
@@ -21,6 +22,7 @@
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/device/internal/impl"
 	"v.io/x/ref/services/device/internal/starter"
+	"v.io/x/ref/services/device/internal/suid"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/modules"
 )
@@ -28,10 +30,18 @@
 const (
 	RedirectEnv    = "DEVICE_MANAGER_DONT_REDIRECT_STDOUT_STDERR"
 	TestEnvVarName = "V23_RANDOM_ENV_VALUE"
+	NoPairingToken = ""
+
+	// Modules names.
+	ExecScriptCmd       = "execScript"
+	DeviceManagerCmd    = "deviceManager"
+	DeviceManagerV10Cmd = "deviceManagerV10" // deviceManager with a different major version number
+	AppCmd              = "app"
+	HangingAppCmd       = "hangingApp"
 )
 
-// ExecScript launches the script passed as argument.
-func ExecScript(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
+// execScript launches the script passed as argument.
+func execScript(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	if want, got := 1, len(args); want != got {
 		vlog.Fatalf("execScript expected %d arguments, got %d instead", want, got)
 	}
@@ -52,10 +62,10 @@
 	return cmd.Run()
 }
 
-// DeviceManager sets up a device manager server.  It accepts the name to
+// deviceManager sets up a device manager server.  It accepts the name to
 // publish the server under as an argument.  Additional arguments can optionally
 // specify device manager config settings.
-func DeviceManager(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
+func deviceManager(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	ctx, shutdown := test.InitForTest()
 	if len(args) == 0 {
 		vlog.Fatalf("deviceManager expected at least an argument")
@@ -138,7 +148,42 @@
 }
 
 // This is the same as DeviceManager above, except that it has a different major version number
-func DeviceManagerV10(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
+func deviceManagerV10(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	impl.CurrentVersion = impl.Version{10, 0} // Set the version number to 10.0
-	return DeviceManager(stdin, stdout, stderr, env, args...)
+	return deviceManager(stdin, stdout, stderr, env, args...)
+}
+
+func TestMainImpl(m *testing.M) {
+	test.Init()
+	isSuidHelper := len(os.Getenv("V23_SUIDHELPER_TEST")) > 0
+	if modules.IsModulesChildProcess() && !isSuidHelper {
+		if err := modules.Dispatch(); err != nil {
+			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
+			os.Exit(1)
+		}
+		return
+	}
+	os.Exit(m.Run())
+}
+
+// TestSuidHelper is testing boilerplate for suidhelper that does not
+// create a runtime because the suidhelper is not a Vanadium application.
+func TestSuidHelperImpl(t *testing.T) {
+	if os.Getenv("V23_SUIDHELPER_TEST") != "1" {
+		return
+	}
+	vlog.VI(1).Infof("TestSuidHelper starting")
+	if err := suid.Run(os.Environ()); err != nil {
+		vlog.Fatalf("Failed to Run() setuidhelper: %v", err)
+	}
+}
+
+func init() {
+	modules.RegisterChild("execScript", `execScript launches the script passed as argument.`, execScript)
+	modules.RegisterChild("deviceManager", `deviceManager sets up a device manager server.  It accepts the name to
+publish the server under as an argument.  Additional arguments can optionally
+ specify device manager config settings.`, deviceManager)
+	modules.RegisterChild("deviceManagerV10", `This is the same as deviceManager above, except that it has a different major version number`, deviceManagerV10)
+	modules.RegisterChild("app", ``, app)
+	modules.RegisterChild("hangingApp", `Same as app, except that it does not exit properly after being stopped`, hangingApp)
 }
diff --git a/services/device/internal/impl/v23_test.go b/services/device/internal/impl/v23_test.go
deleted file mode 100644
index 1ccf6c1..0000000
--- a/services/device/internal/impl/v23_test.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright 2015 The Vanadium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// This file was auto-generated via go generate.
-// DO NOT UPDATE MANUALLY
-package impl_test
-
-import "v.io/x/ref/test/modules"
-
-func init() {
-	modules.RegisterChild("execScript", `execScript launches the script passed as argument.`, execScript)
-	modules.RegisterChild("deviceManager", `deviceManager sets up a device manager server.  It accepts the name to
-publish the server under as an argument.  Additional arguments can optionally
-specify device manager config settings.`, deviceManager)
-	modules.RegisterChild("deviceManagerV10", `This is the same as deviceManager above, except that it has a different major version number`, deviceManagerV10)
-	modules.RegisterChild("app", ``, app)
-	modules.RegisterChild("hangingApp", `Same as app, except that it does not exit properly after being stopped`, hangingApp)
-}