diff --git a/AGENTS.md b/AGENTS.md
index d575457..5a1719f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -129,7 +129,43 @@ line-based and ignore comments and unknown fields by construction - new fields
 it. Emission/verification tooling lives in shellspy `src/buildsuites/suite_tcl90`
 (`build905.zig` staging embed, `tools/family_artifacts.tcl` emission - the sidecar
 derives its identity fields from the embedded copy, `tools/family_check.tcl`
-embedded-record probe).
+embedded-record probe). The tooling emits schema v2 as of shellspy G-123 (from
+the next published family revision onward); already-published v1 records remain
+valid pre-v2 records - see the next section.
+
+## Runtime artifacts - schema v2 + retroactive sidecars (shellspy G-123)
+
+Schema v2 for the RUNTIME class is the v1 record plus, in `[provenance]`, the
+build-origin `class` line (`suite-built | third-party | local` - the same v2
+lineage the lib tier landed first, G-138). Family emission (both copies) writes
+`schema = 2` with `[provenance] class = "suite-built"`; everything else in the
+v1 field list is unchanged. The v2-superset guarantee and the ordering caveat
+hold exactly as documented for the lib tier: `[artifact] class` (value
+`runtime`) is the FIRST `class =` line in every record by construction -
+whole-text single-key scanners see that one; a consumer that wants
+`[provenance] class` must parse tables.
+
+RETROACTIVE sidecars (G-123): pre-family artifacts (bare names, no `-r<N>`)
+carry authored schema-v2 sidecars so build origin is machine-readable across
+the whole runtime tier. Contract:
+
+- ADDITIVE ONLY: artifact bytes, bare pre-family names and the `sha1sums.txt`
+  integrity authority are untouched; the sidecar is a new tracked file summed
+  like any other tracked file. No embedded copy exists inside these artifacts
+  (records are sidecar-only), and consumers keep degrading toml-less entries
+  as no-basis rows - a missing sidecar is tolerated, never an error.
+- Field subset: family-identity fields that do not apply are OMITTED rather
+  than invented - `variant`, `working_name`, `revision` (no `-r<N>`),
+  `build_id` (no embedded twin to correlate), `origin` (the artifact was not
+  built FOR an artifact repo). `built`/`license` may carry `"unrecorded"`.
+  `[runtime] tcl_patchlevel` states its basis in a comment (probed under the
+  kit itself vs read from the artifact name).
+- `[provenance]` fields for non-suite classes: `builder` (who COMPILED the
+  binary - `packager` remains who curated it onto the server), `source_url`,
+  `upstream_ref`, `retrieved` - each `"unrecorded"` when unknown, never
+  guessed. Every judgement-based value states its evidence basis in an
+  adjacent `#` comment (binary markers, this repo's git history), so records
+  are auditable and correctable.
 
 ## Library artifacts - lib tier (schema v2)
 
@@ -197,5 +233,5 @@ input tier.
 
 ## Child DOX Index
 
-(None - flat platform folders with artifacts, checksums and README.md; `src/` is a
-single maintenance script.)
+(None - flat platform folders with artifacts, checksums and metadata sidecars;
+docs are this file + the root README.md; `src/` is a single maintenance script.)
diff --git a/README.md b/README.md
index 88a9c24..42faa95 100644
--- a/README.md
+++ b/README.md
@@ -5,16 +5,16 @@ These are self contained Tcl interpreters that have a few necessary extensions,
 punk tcl runtimes can all load Tk as a loadable extension 
 - there is no separate Tk runtime
 
-The recommended current runtime for Windows is tclsh9.0.5-punk-r1.exe
+The recommended current runtime for Windows is tclsh9.0.5-punk-r2.exe
 (see defaults.txt - the punkshell zig-buildsuite family runtime: piperepl-patched
 shell with Thread, tclvfs, tcllib + tcllibc attached; its .toml carries versions,
 provenance and test evidence). tclsh902z.exe remains available.
 
 In general, the startup, interp creation and library loading performance is better on zipfs based runtimes than those built on tclkit.
 
-Platforms:
+Platforms (platforms.txt is the discovery manifest):
 win32-x86_64 (zipfs and tclkit based)
-linux-x86_64 (tclkit based)
+linux-x86_64, linux-arm, macosx, freebsd-x86_64 (tclkit based)
 
 The lib/ folder is a separate LIBRARY artifact tier (not a platform folder):
 suite-built Tcl library packages (tcllib, tcllibc) as versioned zips -
diff --git a/freebsd-x86_64/sha1sums.txt b/freebsd-x86_64/sha1sums.txt
index a4476c5..070558c 100644
--- a/freebsd-x86_64/sha1sums.txt
+++ b/freebsd-x86_64/sha1sums.txt
@@ -1 +1,2 @@
 a08dd02077733a7c0efa733dcfc4990a2e989122 *tclkit-851-freebsd7-x86_64
+a4980ac6e4afe0a3df4a24738d5a6382e7d4b0ed *tclkit-851-freebsd7-x86_64.toml
diff --git a/freebsd-x86_64/tclkit-851-freebsd7-x86_64.toml b/freebsd-x86_64/tclkit-851-freebsd7-x86_64.toml
new file mode 100644
index 0000000..a66ad27
--- /dev/null
+++ b/freebsd-x86_64/tclkit-851-freebsd7-x86_64.toml
@@ -0,0 +1,38 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclkit-851-freebsd7-x86_64"
+class = "runtime"
+target = "freebsd-x86_64"
+sha1 = "a08dd02077733a7c0efa733dcfc4990a2e989122"
+size = 2234902
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#from the artifact name (not host-executable where this record was authored):
+#Tcl 8.5.1, freebsd7-era metakit tclkit (binary carries a Metakit marker and
+#"GCC: (GNU)"). defaults.txt deliberately carries no freebsd-x86_64 line -
+#a legacy kit, not a recommendation.
+tcl_patchlevel = "8.5.1"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "third-party"
+#builder: legacy 8.5-era public tclkit build; upstream identity unrecorded
+#(pre-BAWT era - no Bawt marker in the binary, unlike the 9.0.2 tclkits here).
+builder = "unrecorded (legacy metakit-era tclkit build)"
+source_url = "unrecorded"
+upstream_ref = "unrecorded"
+#retrieved: unrecorded; first recorded in this repo 2026-07-10 (git 31cd264,
+#tier placement corrected same day by 82d212f).
+retrieved = "unrecorded"
diff --git a/linux-arm/sha1sums.txt b/linux-arm/sha1sums.txt
index 449a59f..a9c0619 100644
--- a/linux-arm/sha1sums.txt
+++ b/linux-arm/sha1sums.txt
@@ -1 +1,2 @@
-60fc2e9f4a27fefdc2a457fa1f610ecaed669f96 *tclkit-9.0.2-Linux64-arm-dyn
+60fc2e9f4a27fefdc2a457fa1f610ecaed669f96 *tclkit-9.0.2-Linux64-arm-dyn
+9119cbbe9964b6785a3a844538ceed4fbb9c148b *tclkit-9.0.2-Linux64-arm-dyn.toml
diff --git a/linux-arm/tclkit-9.0.2-Linux64-arm-dyn.toml b/linux-arm/tclkit-9.0.2-Linux64-arm-dyn.toml
new file mode 100644
index 0000000..37c93c8
--- /dev/null
+++ b/linux-arm/tclkit-9.0.2-Linux64-arm-dyn.toml
@@ -0,0 +1,36 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclkit-9.0.2-Linux64-arm-dyn"
+class = "runtime"
+target = "linux-arm"
+sha1 = "60fc2e9f4a27fefdc2a457fa1f610ecaed669f96"
+size = 4671512
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#from the artifact name (not host-executable where this record was authored):
+#Tcl 9.0.2, dynamic-linked metakit-capable tclkit (binary carries Bawt,
+#obermeier and vqtcl markers).
+tcl_patchlevel = "9.0.2"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "third-party"
+#builder basis: BAWT tclkit family naming and binary markers (Bawt/obermeier).
+builder = "BAWT distribution tclkit (Paul Obermeier's Build Automation With Tcl)"
+source_url = "https://www.tcl3d.org/bawt/"
+upstream_ref = "unrecorded"
+#retrieved: unrecorded; first recorded in this repo 2025-08-28 (git d426e9c
+#"Add some non-windows platform tclkits").
+retrieved = "unrecorded"
diff --git a/linux-x86_64/sha1sums.txt b/linux-x86_64/sha1sums.txt
index 35154b8..8b11494 100644
--- a/linux-x86_64/sha1sums.txt
+++ b/linux-x86_64/sha1sums.txt
@@ -1,2 +1,4 @@
-41c81c8cf4020ea67a4e0238c96f9550bdadd8c3 *tclkit-902-Linux64-intel-dyn
-a0c299db0429e799833eb77d7962f410c9a2bfb1 *tclkit-902-Linux64-intel-dyn_basic
+41c81c8cf4020ea67a4e0238c96f9550bdadd8c3 *tclkit-902-Linux64-intel-dyn
+a51a5971606794864ebf3682f05b051f92514d36 *tclkit-902-Linux64-intel-dyn.toml
+a0c299db0429e799833eb77d7962f410c9a2bfb1 *tclkit-902-Linux64-intel-dyn_basic
+0c2a95395e186c5a1e3baaff5c02f9ed912e1e03 *tclkit-902-Linux64-intel-dyn_basic.toml
diff --git a/linux-x86_64/tclkit-902-Linux64-intel-dyn.toml b/linux-x86_64/tclkit-902-Linux64-intel-dyn.toml
new file mode 100644
index 0000000..c0b9068
--- /dev/null
+++ b/linux-x86_64/tclkit-902-Linux64-intel-dyn.toml
@@ -0,0 +1,40 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclkit-902-Linux64-intel-dyn"
+class = "runtime"
+target = "linux-x86_64"
+sha1 = "41c81c8cf4020ea67a4e0238c96f9550bdadd8c3"
+size = 4989232
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#from the artifact name (not host-executable where this record was authored):
+#Tcl 9.0.2, dynamic-linked metakit-capable tclkit (binary carries Bawt,
+#obermeier and vqtcl markers). This is the punkshell punk9linux/punkshell902
+#bake runtime and the defaults.txt recommendation for linux-x86_64.
+tcl_patchlevel = "9.0.2"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "third-party"
+#builder basis: BAWT tclkit family naming and binary markers (Bawt/obermeier).
+#Payload modified in-place after retrieval: git 15a2630 (2025-08-29) added
+#Thread and tcllibc into the kit image; the sibling artifact
+#tclkit-902-Linux64-intel-dyn_basic preserves the unmodified shape.
+builder = "BAWT distribution tclkit (Paul Obermeier's Build Automation With Tcl)"
+source_url = "https://www.tcl3d.org/bawt/"
+upstream_ref = "unrecorded"
+#retrieved: unrecorded; first recorded in this repo 2025-08-28 (git d426e9c
+#"Add some non-windows platform tclkits").
+retrieved = "unrecorded"
diff --git a/linux-x86_64/tclkit-902-Linux64-intel-dyn_basic.toml b/linux-x86_64/tclkit-902-Linux64-intel-dyn_basic.toml
new file mode 100644
index 0000000..af18893
--- /dev/null
+++ b/linux-x86_64/tclkit-902-Linux64-intel-dyn_basic.toml
@@ -0,0 +1,36 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclkit-902-Linux64-intel-dyn_basic"
+class = "runtime"
+target = "linux-x86_64"
+sha1 = "a0c299db0429e799833eb77d7962f410c9a2bfb1"
+size = 4661616
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#from the artifact name (not host-executable where this record was authored):
+#Tcl 9.0.2, dynamic-linked metakit-capable tclkit (binary carries Bawt,
+#obermeier and vqtcl markers). The _basic name marks the UNMODIFIED shape of
+#tclkit-902-Linux64-intel-dyn (whose served copy gained Thread + tcllibc).
+tcl_patchlevel = "9.0.2"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "third-party"
+#builder basis: BAWT tclkit family naming and binary markers (Bawt/obermeier).
+builder = "BAWT distribution tclkit (Paul Obermeier's Build Automation With Tcl)"
+source_url = "https://www.tcl3d.org/bawt/"
+upstream_ref = "unrecorded"
+#retrieved: unrecorded; first recorded in this repo 2026-07-10 (git 31cd264).
+retrieved = "unrecorded"
diff --git a/macosx/sha1sums.txt b/macosx/sha1sums.txt
index 52d1a3d..d6e1528 100644
--- a/macosx/sha1sums.txt
+++ b/macosx/sha1sums.txt
@@ -1 +1,2 @@
-93d342cb2863deb9040416531329b99032eb88e8 *tclkit-902-Darwin64-dyn
+93d342cb2863deb9040416531329b99032eb88e8 *tclkit-902-Darwin64-dyn
+bfbd365e1a3686aa534a9b5cea1d3c50672aa425 *tclkit-902-Darwin64-dyn.toml
diff --git a/macosx/tclkit-902-Darwin64-dyn.toml b/macosx/tclkit-902-Darwin64-dyn.toml
new file mode 100644
index 0000000..7fca2b9
--- /dev/null
+++ b/macosx/tclkit-902-Darwin64-dyn.toml
@@ -0,0 +1,36 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclkit-902-Darwin64-dyn"
+class = "runtime"
+target = "macosx"
+sha1 = "93d342cb2863deb9040416531329b99032eb88e8"
+size = 7014064
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#from the artifact name (not host-executable where this record was authored):
+#Tcl 9.0.2, dynamic-linked Darwin tclkit (binary carries Bawt and obermeier
+#markers). The macosx tier is a single folder (no per-arch split).
+tcl_patchlevel = "9.0.2"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "third-party"
+#builder basis: BAWT tclkit family naming and binary markers (Bawt/obermeier).
+builder = "BAWT distribution tclkit (Paul Obermeier's Build Automation With Tcl)"
+source_url = "https://www.tcl3d.org/bawt/"
+upstream_ref = "unrecorded"
+#retrieved: unrecorded; first recorded in this repo 2025-08-28 (git d426e9c
+#"Add some non-windows platform tclkits").
+retrieved = "unrecorded"
diff --git a/win32-x86_64/sha1sums.txt b/win32-x86_64/sha1sums.txt
index e76a0e3..9383a94 100644
--- a/win32-x86_64/sha1sums.txt
+++ b/win32-x86_64/sha1sums.txt
@@ -1,6 +1,9 @@
 22e11146eab873e3fcfd3453938800461212c497 *tclkit86bi.exe
+77e386535704c4a0a3e778a2233cb2285120629c *tclkit86bi.toml
 83a7fe3d3ff81b4f8432f298a1caeae29a0c430e *tclkit902.exe
+d592057c269d5be61487a20a68e931a4134adf0e *tclkit902.toml
 3a1e2f03e1962dd7c65d00aa40701a40721bc5a6 *tclsfe-x64.exe
+bcb78c47693c5d967baa4083de89f5d23188ecdf *tclsfe-x64.toml
 a6a23f2411f5a99eca7a1f7b7ee0c28c53f34523 *tclsh9.0.5-punk-bi-r1.exe
 f975f1c0812319efaaad9d4e4a0e3eb31f95dc33 *tclsh9.0.5-punk-bi-r1.toml
 6fa25cbe23474710ec853704f11fa223944c08e2 *tclsh9.0.5-punk-bi-r2.exe
@@ -14,6 +17,10 @@ f0d60e14c063c49fb1725a8ca058b315e12c1a22 *tclsh9.0.5-r1.toml
 16f5b2187ef1200cfe686e01f47fa7d302314964 *tclsh9.0.5-r2.exe
 ff5254b8a8ebc6abff9808edd28b7838a4e12aed *tclsh9.0.5-r2.toml
 51d00ccc2e3c59e9b38c4607c928cb9d202d6c75 *tclsh901k.exe
+429aa753c5a5410e44fe0ec7aa6ab7b864824d9d *tclsh901k.toml
 ec9d058279c47e9abe27443793d864ffaf84a672 *tclsh901t.exe
+e3f6bf317e5b1aa3466b373f378a6e26d0eb64ef *tclsh901t.toml
 9e1251d256ca69eefc8b2b8344d07b030bf542dd *tclsh902z.exe
+0d2844d113cf08cd799990e5765d19e8575e759a *tclsh902z.toml
 06c849dd114edee5598866c39cd0e69c09221e5e *tclsh902z_nometakit.exe
+78ed0d1df8b58f7ed2665d5b905437cab6063a13 *tclsh902z_nometakit.toml
diff --git a/win32-x86_64/tclkit86bi.toml b/win32-x86_64/tclkit86bi.toml
new file mode 100644
index 0000000..9647ccb
--- /dev/null
+++ b/win32-x86_64/tclkit86bi.toml
@@ -0,0 +1,45 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclkit86bi.exe"
+class = "runtime"
+target = "win32-x86_64"
+sha1 = "22e11146eab873e3fcfd3453938800461212c497"
+size = 9709080
+#built: when the binary was compiled - unrecorded for this retroactive record.
+built = "unrecorded"
+#packager: declared identity of the curator who placed the artifact on this
+#server, not proof - signing (minisign sidecars) is the verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+#license: unrecorded summary - the kit bundles many components (tcllib, tcltls,
+#tdom, tdbc, sqlite, cffi, critcl, ...) whose license texts ride inside its vfs.
+license = "unrecorded"
+
+[runtime]
+#probed 2026-07-31 (info patchlevel under the kit itself): Tcl 8.6.13, threaded,
+#metakit container (vqtcl4.1); batteries-included lib tree observed: Ffidl,
+#Memchan, Trf, cffi, critcl 3.2 suite, iocp, sqlite 3.40.0, tcllib 1.21,
+#tcllibc, tcltls 1.7.22, tdbc 1.1.5 + drivers, tdom 0.9.3, thread 2.8.8, tk8.6,
+#udp 1.0.11, vfs 1.4.x.
+tcl_patchlevel = "8.6.13"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "third-party"
+#builder: who compiled the binary (packager above is who curated it onto this
+#server). Basis: the binary carries literal "Bawt" and
+#"GCC: (x86_64-posix-seh-rev1, Built by MinGW-W64 project)" markers.
+builder = "unrecorded (BAWT-framework build - Bawt + MinGW-W64 GCC markers in the binary)"
+#source_url: best-evidence attribution from the binary markers and the BAWT
+#tclkit family shape - correct this line if the true source is known.
+source_url = "https://www.tcl3d.org/bawt/"
+upstream_ref = "unrecorded"
+#retrieved: when the artifact was obtained from its source - unrecorded; first
+#recorded in this repo 2023-08-02 (git cbd6754, repo creation import).
+retrieved = "unrecorded"
diff --git a/win32-x86_64/tclkit902.toml b/win32-x86_64/tclkit902.toml
new file mode 100644
index 0000000..fa89b44
--- /dev/null
+++ b/win32-x86_64/tclkit902.toml
@@ -0,0 +1,36 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclkit902.exe"
+class = "runtime"
+target = "win32-x86_64"
+sha1 = "83a7fe3d3ff81b4f8432f298a1caeae29a0c430e"
+size = 6245902
+#built: compile date unrecorded; the kit entered this repo 2025-08-27 in the
+#"built using bawt" batch (git 9f13f97).
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#probed 2026-07-31 (info patchlevel under the kit itself): Tcl 9.0.2, metakit
+#container (vqtcl4.1); lib tree observed: dde1.4, registry1.3, tcllibc 2.0,
+#thread 3.0.2, tk9.0, vfs1.4.1.
+tcl_patchlevel = "9.0.2"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "local"
+#builder basis: repo commit 9f13f97 (2025-08-27) "update win64 binaries tclkit
+#and static zipfs based, built using bawt"; binary carries Bawt and
+#"GCC: (Rev1, Built by MSYS2 project)" markers. Payload later modified in-place:
+#git 3b0fcdc (2025-08-29) added Thread and tcllibc into the kit vfs.
+builder = "Julian Noble (BAWT framework, MSYS2 mingw GCC)"
diff --git a/win32-x86_64/tclsfe-x64.toml b/win32-x86_64/tclsfe-x64.toml
new file mode 100644
index 0000000..6d816eb
--- /dev/null
+++ b/win32-x86_64/tclsfe-x64.toml
@@ -0,0 +1,39 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclsfe-x64.exe"
+class = "runtime"
+target = "win32-x86_64"
+sha1 = "3a1e2f03e1962dd7c65d00aa40701a40721bc5a6"
+size = 6697627
+#built: upstream release build date not recorded at retrieval.
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#probed 2026-07-31 (info patchlevel under the kit itself): Tcl 9.1b0, zipfs
+#container (//zipfs:/app); lib tree observed: sqlite 3.53.0, tdbc 1.1.14 +
+#odbc driver, thread 3.0.5, twapi 5.2.0.
+tcl_patchlevel = "9.1b0"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "third-party"
+#builder: who compiled the binary (packager above is who curated it onto this
+#server). tcl-sfe single-file executables are released by the twapi author.
+builder = "Ashok P. Nadkarni (apnadkarni/tcl-sfe release)"
+source_url = "https://github.com/apnadkarni/tcl-sfe"
+#upstream_ref: release tag not recorded at retrieval.
+upstream_ref = "unrecorded"
+#retrieved: pinned into this repo 2026-07-10 (git b2dbbe6) for the shellspy
+#G-058 static-runtime suite (its unattended constraint fetch consumes it).
+retrieved = "2026-07-10"
diff --git a/win32-x86_64/tclsh901k.toml b/win32-x86_64/tclsh901k.toml
new file mode 100644
index 0000000..dfa52bc
--- /dev/null
+++ b/win32-x86_64/tclsh901k.toml
@@ -0,0 +1,31 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclsh901k.exe"
+class = "runtime"
+target = "win32-x86_64"
+sha1 = "51d00ccc2e3c59e9b38c4607c928cb9d202d6c75"
+size = 4439385
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#probed 2026-07-31 (info patchlevel under the kit itself): Tcl 9.0.1, zipfs
+#container (//zipfs:/app).
+tcl_patchlevel = "9.0.1"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "local"
+#builder basis: repo commit 77290cd (2024-11-04) "interim 901k runtime" -
+#a pre-buildsuite local build; toolchain unrecorded.
+builder = "Julian Noble (interim local build - toolchain unrecorded)"
diff --git a/win32-x86_64/tclsh901t.toml b/win32-x86_64/tclsh901t.toml
new file mode 100644
index 0000000..92b92d7
--- /dev/null
+++ b/win32-x86_64/tclsh901t.toml
@@ -0,0 +1,31 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclsh901t.exe"
+class = "runtime"
+target = "win32-x86_64"
+sha1 = "ec9d058279c47e9abe27443793d864ffaf84a672"
+size = 4414145
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#probed 2026-07-31 (info patchlevel under the kit itself): Tcl 9.0.1, zipfs
+#container (//zipfs:/app).
+tcl_patchlevel = "9.0.1"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "local"
+#builder basis: repo commit 96eb0ca (2025-03-07) "some more test runtimes" -
+#a pre-buildsuite local build; toolchain unrecorded.
+builder = "Julian Noble (test-runtime local build - toolchain unrecorded)"
diff --git a/win32-x86_64/tclsh902z.toml b/win32-x86_64/tclsh902z.toml
new file mode 100644
index 0000000..bb77cc3
--- /dev/null
+++ b/win32-x86_64/tclsh902z.toml
@@ -0,0 +1,35 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclsh902z.exe"
+class = "runtime"
+target = "win32-x86_64"
+sha1 = "9e1251d256ca69eefc8b2b8344d07b030bf542dd"
+size = 6536891
+#built: compile date unrecorded; the kit entered this repo 2025-08-27 in the
+#"built using bawt" batch (git 9f13f97).
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#probed 2026-07-31 (info patchlevel under the kit itself): Tcl 9.0.2, zipfs
+#container (//zipfs:/app).
+tcl_patchlevel = "9.0.2"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "local"
+#builder basis: repo commit 9f13f97 (2025-08-27) "update win64 binaries tclkit
+#and static zipfs based, built using bawt"; binary carries Bawt and
+#"GCC: (Rev1, Built by MSYS2 project)" markers. Payload later modified in-place:
+#git 3b0fcdc (2025-08-29) added Thread and tcllibc into the kit image.
+builder = "Julian Noble (BAWT framework, MSYS2 mingw GCC)"
diff --git a/win32-x86_64/tclsh902z_nometakit.toml b/win32-x86_64/tclsh902z_nometakit.toml
new file mode 100644
index 0000000..e7a718a
--- /dev/null
+++ b/win32-x86_64/tclsh902z_nometakit.toml
@@ -0,0 +1,35 @@
+#punkshell runtime artifact metadata (schema v2, class "runtime") - retroactive
+#sidecar authored per shellspy G-123: ADDITIVE record for a pre-family artifact
+#(artifact bytes, bare name and the sha1sums.txt integrity authority unchanged;
+#no embedded copy exists inside the artifact).
+schema = 2
+
+[artifact]
+name = "tclsh902z_nometakit.exe"
+class = "runtime"
+target = "win32-x86_64"
+sha1 = "06c849dd114edee5598866c39cd0e69c09221e5e"
+size = 6261836
+#built: compile date unrecorded; the kit entered this repo in the 2025-08
+#"built using bawt" batch (present from git 9f13f97/3b0fcdc era).
+built = "unrecorded"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+license = "unrecorded"
+
+[runtime]
+#probed 2026-07-31 (info patchlevel under the kit itself): Tcl 9.0.2, zipfs
+#container (//zipfs:/app); the _nometakit name records the variant built
+#without metakit/vqtcl support.
+tcl_patchlevel = "9.0.2"
+
+[provenance]
+#class: build-origin class (schema v2): suite-built | third-party | local.
+#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
+#line in the record by construction - whole-text single-key scans see that one.
+class = "local"
+#builder basis: the 2025-08 "built using bawt" win64 batch (git 9f13f97,
+#3b0fcdc); binary carries Bawt and "GCC: (Rev1, Built by MSYS2 project)"
+#markers.
+builder = "Julian Noble (BAWT framework, MSYS2 mingw GCC)"