win32-x86_64: family r2 artifacts (schema v1 embedded records) + defaults flip to tclsh9.0.5-punk-r2

Second assembly revision of the 9.0.5 family (first content change: tclvfs
forTcl9/1.5.0), first revision carrying the G-117 schema v1 metadata: records
embedded in each artifact's attached image (punkbin-artifact.toml; build_id
identical to sidecar, packager recorded, embed-then-hash - see AGENTS.md
"Artifact metadata records"). Built by shellspy suite_tcl90 (zig 0.16.0,
ReleaseFast; provenance checkout uuids + test-gate results in the tomls;
family_check self-containment + embed verification PASS all members).
defaults.txt win32-x86_64 recommendation: tclsh9.0.5-punk-r1.exe ->
tclsh9.0.5-punk-r2.exe (same change-set per the release rule). r1 remains
immutable alongside.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

AGENTS.md

@@ -59,13 +59,80 @@ This artifact repository is specific to the punkshell project.
   Runtimes with statically-linked packages (e.g. tclsfe-x64.exe: Thread, twapi,
   sqlite3, tdbc) are supported by punkshell boot as of shellspy G-058.
 
+## Artifact metadata records (schema v1)
+
+Family runtime artifacts (shellspy G-103/G-117) are metadata-carrying in TWO copies:
+
+- SIDECAR: `<artifact rootname>.toml` beside the artifact, listed in `sha1sums.txt`.
+  The sidecar + sha1sums are the INTEGRITY AUTHORITY.
+- EMBEDDED: the same record minus the finished-binary facts, at
+  `punkbin-artifact.toml` inside the artifact's attached (exe-appended) zip image -
+  written at kit-family staging BEFORE wrapping and hashing (embed-then-hash: the
+  embedded copy can never contain its own sha1). It makes a runtime separated from
+  its sidecar (out-of-band copy, rename) self-describing:
+  `punk-runtime info <name-or-path>` reads it WITHOUT executing the target (zip
+  central-directory read of the exe-appended archive - .NET in the ps1 payload,
+  unzip in the bash payload; a cooperative probe piping a reader script into the
+  EXECUTED target is the documented fallback for hosts with no zip reader, with
+  the obvious caveat about running untrusted binaries) and flags
+  embedded-vs-sidecar disagreements. The record survives punkshell's make.tcl kit
+  wrapping (the kit vfs overlays the image without clearing it), so wrapped kits
+  inherit their runtime's record (shellspy G-025 treats it as the
+  runtime-provenance layer of kit self-reporting).
+
+Field semantics (v1; `schema = 1` at the top of both copies):
+
+- `schema` - record format version. Absent = pre-v1 (r1-era records; consumers
+  parse them tolerantly).
+- `[artifact]` `name`/`class`/`variant`/`working_name`/`revision`/`target` - the
+  G-103 identity: immutable `-r<N>` artifact name, `runtime` class, family variant
+  (plain/punk/punk-bi), the working name `use` materializes to, assembly revision,
+  punkbin platform target.
+- `sha1`/`size`/`built` - SIDECAR-ONLY finished-binary facts.
+- `build_id` - offline correlation key re-joining a renamed stray copy to its
+  record; IDENTICAL in embedded and sidecar copies. A deterministic uuid-shaped
+  digest of stable identity inputs (artifact name, toolchain/optimize, patchlevel,
+  per-member source checkout uuids) - a correlation key, NOT an integrity key
+  (sha1sums is).
+- `origin` - the canonical artifact repo this artifact was BUILT FOR (suite option
+  `-Doriginurl`, default this repo's url) - NOT necessarily where it is hosted;
+  mirrors preserve it, so an artifact found on a third-party repo still declares
+  its home. Where an artifact actually lives is the hosting repo's own business.
+- `packager` - DECLARED builder identity (`-Dpackager` > env `PUNKBIN_PACKAGER` >
+  the building checkout's git identity > `"unrecorded"`). Declarative, not proof:
+  the verification layer is signing - per-artifact `.minisig` sidecars (this
+  repo's existing minisign practice for zig tool archives) are the natural
+  complement, deliberately outside the metadata file (a signature cannot live
+  inside what it signs).
+- `project`/`project_url` - what a stray artifact belongs to beyond its origin
+  repo (`-Dprojecturl`; `unrecorded` until a canonical url is chosen).
+- `license` - summary for the distributed artifact (`TCL` for family runtimes);
+  component license texts ride inside the attached image.
+- `build_host_platform` - platform the artifact was built ON (meaningful once
+  cross-builds exist; equals `target` today).
+- `[runtime]` `tcl_patchlevel`, `piperepl`/`piperepl_default`/`piperepl_opt_out`,
+  `attached_batteries` - probed-verifiable runtime facts (the suite's
+  family_check asserts them against the actual binary).
+- `[provenance]` `suite`/`toolchain`/`optimize`/`*_checkout` - build provenance
+  (fossil checkout uuids per component).
+- `[tests]` - per-suite test-gate result lines (sidecar only; from the G-107
+  evidence summaries).
+
+Records carry `#` comment lines documenting the non-obvious fields; consumers are
+line-based and ignore comments and unknown fields by construction - new fields
+(e.g. the planned tls battery fields, shellspy G-116) extend v1 rather than fork
+it. Emission/verification tooling lives in shellspy `src/buildsuites/suite_tcl90`
+(`build905.zig` staging embed, `tools/family_artifacts.tcl` emission - the sidecar
+derives its identity fields from the embedded copy, `tools/family_check.tcl`
+embedded-record probe).
+
 ## Work Guidance
 
 - Adding a runtime: copy it into the platform folder, `git add` it, run
   `tclsh src/build_sha1sums.tcl`, verify the NEW line's checksum, commit with a
   message recording provenance (upstream URL/version/build source).
 - Consumers: the punkshell project retrieves runtimes into its
-  `bin/runtime/<platform>/` via `bin/runtime.cmd` or manual copy; punkshell's
+  `bin/runtime/<platform>/` via `bin/punk-runtime.cmd` or manual copy; punkshell's
   `src/runtime/mapvfs.config` maps runtimes to vfs payloads.
 - Do not push on an agent's initiative - the remote is the project's upstream
   artifact store; the maintainer controls what is published.

defaults.txt

@@ -8,7 +8,7 @@
 #(platforms with no line here have no recommended default - punk-runtime tells
 #the user to name a runtime explicitly, e.g. freebsd-x86_64's only artifact is
 #a legacy 8.5-era kit not suitable as a recommendation.)
-win32-x86_64 tclsh9.0.5-punk-r1.exe
+win32-x86_64 tclsh9.0.5-punk-r2.exe
 linux-x86_64 tclkit-902-Linux64-intel-dyn
 linux-arm tclkit-9.0.2-Linux64-arm-dyn
 macosx tclkit-902-Darwin64-dyn

win32-x86_64/sha1sums.txt

@@ -3,10 +3,16 @@
 3a1e2f03e1962dd7c65d00aa40701a40721bc5a6 *tclsfe-x64.exe
 a6a23f2411f5a99eca7a1f7b7ee0c28c53f34523 *tclsh9.0.5-punk-bi-r1.exe
 f975f1c0812319efaaad9d4e4a0e3eb31f95dc33 *tclsh9.0.5-punk-bi-r1.toml
+6fa25cbe23474710ec853704f11fa223944c08e2 *tclsh9.0.5-punk-bi-r2.exe
+429c938a8d0dd7fd018314db19b30880bb4a55ee *tclsh9.0.5-punk-bi-r2.toml
 63bc8f57eab65c0ee2f8994916e82133e595ed21 *tclsh9.0.5-punk-r1.exe
 3e4f12ed67d5be02e271fa3f8e5b1e997569855d *tclsh9.0.5-punk-r1.toml
+5337179b8e0aef277f95a64a66317f1957235684 *tclsh9.0.5-punk-r2.exe
+964a6edd1c299edaf243a9ee7f7b2fe88ebedf73 *tclsh9.0.5-punk-r2.toml
 969ac1e1645db138304e93f72ab1b5e56727e48f *tclsh9.0.5-r1.exe
 f0d60e14c063c49fb1725a8ca058b315e12c1a22 *tclsh9.0.5-r1.toml
+16f5b2187ef1200cfe686e01f47fa7d302314964 *tclsh9.0.5-r2.exe
+ff5254b8a8ebc6abff9808edd28b7838a4e12aed *tclsh9.0.5-r2.toml
 51d00ccc2e3c59e9b38c4607c928cb9d202d6c75 *tclsh901k.exe
 ec9d058279c47e9abe27443793d864ffaf84a672 *tclsh901t.exe
 9e1251d256ca69eefc8b2b8344d07b030bf542dd *tclsh902z.exe

win32-x86_64/tclsh9.0.5-punk-bi-r2.toml

@@ -0,0 +1,58 @@
+#punkshell runtime artifact metadata (G-117 schema v1) - generated by family_artifacts.tcl
+#sidecar copy: the embedded record carried inside the artifact's attached image
+#(punkbin-artifact.toml) plus the finished-binary facts (sha1, size, built).
+#The sidecar + sha1sums.txt remain the integrity authority.
+schema = 1
+
+[artifact]
+name = "tclsh9.0.5-punk-bi-r2.exe"
+class = "runtime"
+variant = "punk-bi"
+working_name = "tclsh9.0.5-punk-bi.exe"
+revision = 2
+target = "win32-x86_64"
+sha1 = "6fa25cbe23474710ec853704f11fa223944c08e2"
+size = 9386774
+built = "2026-07-24T03:20:12Z"
+#build_id: offline correlation key re-joining a renamed copy to its record;
+#identical in the embedded and sidecar copies (a deterministic identity digest,
+#not an integrity key - sha1 above is the integrity fact).
+build_id = "20044928-80ca-2f8b-1600-c4477bf2565e"
+#origin: canonical artifact repo this artifact was BUILT FOR - not necessarily
+#where it is hosted; mirrors preserve it.
+origin = "https://www.gitea1.intx.com.au/jn/punkbin"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+project = "punkshell"
+project_url = "unrecorded"
+#license: summary for the distributed artifact; component license texts ride
+#inside the attached image (tcl_library/license.terms etc).
+license = "TCL"
+build_host_platform = "win32-x86_64"
+
+[runtime]
+tcl_patchlevel = "9.0.5"
+piperepl = true
+piperepl_default = "on"
+piperepl_opt_out = "TCLSH_PIPEREPL=0"
+attached_batteries = ["Thread 3.0.7", "vfs 1.5.0", "tcllib 2.0", "tcllibc 2.0", "Tk 9.0.2", "tklib 0.9"]
+
+[provenance]
+suite = "suite_tcl90"
+toolchain = "zig 0.16.0"
+optimize = "ReleaseFast"
+tcl_checkout = "1a9c3b9d965d66f69f037cab6718d64bd802ef2cc8520d6c20f13b6803cd162f"
+thread_checkout = "caa1d3aa302798de2200de7297f9d4ca40102a5df108ed21f14a90cea9691cad"
+tclvfs_checkout = "75a26729914e2fbc68bf955315d34dc0302e3dbd7e239109785f9f5e30bd5fdd"
+tk_checkout = "effef6c657952d3304048267fa40a795a318997af2910611f5247586f9e3e181"
+tcllib_checkout = "c784f6fda4516f676453a2785b3c56f1ca5999f450e80ccba6c317ba78ce4e21"
+tklib_checkout = "2d53beafc0e8621dacc75b3c809898cc9f1f92f980bf5aac6134060c19497526"
+
+[tests]
+tclcore = "result=pass mode=gate total=69552 passed=56039 skipped=13504 failed=9"
+tcllib = "result=pass mode=record total=62328 passed=59240 skipped=3034 failed=54"
+tclvfs = "result=pass mode=gate total=51 passed=42 skipped=9 failed=0"
+thread = "result=pass mode=gate total=143 passed=117 skipped=26 failed=0"
+tk = "result=pass mode=record total=9865 passed=8127 skipped=1711 failed=27"
+tklib = "result=pass mode=record total=796 passed=688 skipped=90 failed=18"

win32-x86_64/tclsh9.0.5-punk-r2.toml

@@ -0,0 +1,58 @@
+#punkshell runtime artifact metadata (G-117 schema v1) - generated by family_artifacts.tcl
+#sidecar copy: the embedded record carried inside the artifact's attached image
+#(punkbin-artifact.toml) plus the finished-binary facts (sha1, size, built).
+#The sidecar + sha1sums.txt remain the integrity authority.
+schema = 1
+
+[artifact]
+name = "tclsh9.0.5-punk-r2.exe"
+class = "runtime"
+variant = "punk"
+working_name = "tclsh9.0.5-punk.exe"
+revision = 2
+target = "win32-x86_64"
+sha1 = "5337179b8e0aef277f95a64a66317f1957235684"
+size = 6614636
+built = "2026-07-24T03:20:12Z"
+#build_id: offline correlation key re-joining a renamed copy to its record;
+#identical in the embedded and sidecar copies (a deterministic identity digest,
+#not an integrity key - sha1 above is the integrity fact).
+build_id = "635e7951-2b0a-80fc-c062-ae601a3d62ab"
+#origin: canonical artifact repo this artifact was BUILT FOR - not necessarily
+#where it is hosted; mirrors preserve it.
+origin = "https://www.gitea1.intx.com.au/jn/punkbin"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+project = "punkshell"
+project_url = "unrecorded"
+#license: summary for the distributed artifact; component license texts ride
+#inside the attached image (tcl_library/license.terms etc).
+license = "TCL"
+build_host_platform = "win32-x86_64"
+
+[runtime]
+tcl_patchlevel = "9.0.5"
+piperepl = true
+piperepl_default = "on"
+piperepl_opt_out = "TCLSH_PIPEREPL=0"
+attached_batteries = ["Thread 3.0.7", "vfs 1.5.0", "tcllib 2.0", "tcllibc 2.0"]
+
+[provenance]
+suite = "suite_tcl90"
+toolchain = "zig 0.16.0"
+optimize = "ReleaseFast"
+tcl_checkout = "1a9c3b9d965d66f69f037cab6718d64bd802ef2cc8520d6c20f13b6803cd162f"
+thread_checkout = "caa1d3aa302798de2200de7297f9d4ca40102a5df108ed21f14a90cea9691cad"
+tclvfs_checkout = "75a26729914e2fbc68bf955315d34dc0302e3dbd7e239109785f9f5e30bd5fdd"
+tk_checkout = "effef6c657952d3304048267fa40a795a318997af2910611f5247586f9e3e181"
+tcllib_checkout = "c784f6fda4516f676453a2785b3c56f1ca5999f450e80ccba6c317ba78ce4e21"
+tklib_checkout = "2d53beafc0e8621dacc75b3c809898cc9f1f92f980bf5aac6134060c19497526"
+
+[tests]
+tclcore = "result=pass mode=gate total=69552 passed=56039 skipped=13504 failed=9"
+tcllib = "result=pass mode=record total=62328 passed=59240 skipped=3034 failed=54"
+tclvfs = "result=pass mode=gate total=51 passed=42 skipped=9 failed=0"
+thread = "result=pass mode=gate total=143 passed=117 skipped=26 failed=0"
+tk = "result=pass mode=record total=9865 passed=8127 skipped=1711 failed=27"
+tklib = "result=pass mode=record total=796 passed=688 skipped=90 failed=18"

win32-x86_64/tclsh9.0.5-r2.toml

@@ -0,0 +1,56 @@
+#punkshell runtime artifact metadata (G-117 schema v1) - generated by family_artifacts.tcl
+#sidecar copy: the embedded record carried inside the artifact's attached image
+#(punkbin-artifact.toml) plus the finished-binary facts (sha1, size, built).
+#The sidecar + sha1sums.txt remain the integrity authority.
+schema = 1
+
+[artifact]
+name = "tclsh9.0.5-r2.exe"
+class = "runtime"
+variant = "plain"
+working_name = "tclsh9.0.5.exe"
+revision = 2
+target = "win32-x86_64"
+sha1 = "16f5b2187ef1200cfe686e01f47fa7d302314964"
+size = 6611524
+built = "2026-07-24T03:20:12Z"
+#build_id: offline correlation key re-joining a renamed copy to its record;
+#identical in the embedded and sidecar copies (a deterministic identity digest,
+#not an integrity key - sha1 above is the integrity fact).
+build_id = "0988568a-de0e-c9d2-2e5c-8670cfe0404d"
+#origin: canonical artifact repo this artifact was BUILT FOR - not necessarily
+#where it is hosted; mirrors preserve it.
+origin = "https://www.gitea1.intx.com.au/jn/punkbin"
+#packager: declared identity, not proof - signing (minisign sidecars) is the
+#verification layer.
+packager = "Julian Noble <julian@precisium.com.au>"
+project = "punkshell"
+project_url = "unrecorded"
+#license: summary for the distributed artifact; component license texts ride
+#inside the attached image (tcl_library/license.terms etc).
+license = "TCL"
+build_host_platform = "win32-x86_64"
+
+[runtime]
+tcl_patchlevel = "9.0.5"
+piperepl = false
+attached_batteries = ["Thread 3.0.7", "vfs 1.5.0", "tcllib 2.0", "tcllibc 2.0"]
+
+[provenance]
+suite = "suite_tcl90"
+toolchain = "zig 0.16.0"
+optimize = "ReleaseFast"
+tcl_checkout = "1a9c3b9d965d66f69f037cab6718d64bd802ef2cc8520d6c20f13b6803cd162f"
+thread_checkout = "caa1d3aa302798de2200de7297f9d4ca40102a5df108ed21f14a90cea9691cad"
+tclvfs_checkout = "75a26729914e2fbc68bf955315d34dc0302e3dbd7e239109785f9f5e30bd5fdd"
+tk_checkout = "effef6c657952d3304048267fa40a795a318997af2910611f5247586f9e3e181"
+tcllib_checkout = "c784f6fda4516f676453a2785b3c56f1ca5999f450e80ccba6c317ba78ce4e21"
+tklib_checkout = "2d53beafc0e8621dacc75b3c809898cc9f1f92f980bf5aac6134060c19497526"
+
+[tests]
+tclcore = "result=pass mode=gate total=69552 passed=56039 skipped=13504 failed=9"
+tcllib = "result=pass mode=record total=62328 passed=59240 skipped=3034 failed=54"
+tclvfs = "result=pass mode=gate total=51 passed=42 skipped=9 failed=0"
+thread = "result=pass mode=gate total=143 passed=117 skipped=26 failed=0"
+tk = "result=pass mode=record total=9865 passed=8127 skipped=1711 failed=27"
+tklib = "result=pass mode=record total=796 passed=688 skipped=90 failed=18"