G-127 achieved 2026-07-31: cross-target bake of a custom .vfs - per-target payload + per-target output location

- Acceptance verified clause-by-clause (detail file Progress increments 1-5):
  one-run two-target same-vfs real bake to distinct artifacts (flat native +
  bin/kits/<platform>/), cross-run no-overwrite by construction + live two-run
  same-name check, two-non-native namesake coexistence, per-target payload
  selection via %platform% on vendorlib + packages roots, byte-comparability by
  the recorded prefix+content method (punk86 identical; punkdeclare 2805
  members identical), mismatch reporting live + G-133 regression pin, bakelist
  locations, punk9linux migrated-plus-hand-curated record, punkshell902 +
  verify-ix86 relocations executed and recorded, G-023 reconciliation stated,
  native outputs unchanged with punkexe suites 101/0-fail, kit-loop TODO retired
- punkdeclare.vfs.toml: both payload entries now %platform% (vendor tree +
  packages tier), flat folder payload removed - whole payload stages per target
- index entry -> GOALS-archive.md record; reference sweep: achieved markers +
  actionable pointers in G-141 (derivation input live), G-137 (seam already
  per-kit), G-131, G-114, G-105, G-023, G-101, G-116, G-060
- relocation orphans removed (flat punkshell902 + punkluck86 copies)
- detail-file move to goals/archive/ follows as a pure rename

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

GOALS-archive.md

@@ -235,6 +235,10 @@ Acceptance: the vendored source builds under the repo's pinned zig 0.16 toolchai
 Scope: src/assets/logo/ (per-asset *.assetorigin.toml sidecars, masters and generated icons); src/assets/logo/make-ico.ps1 (replaced in place by a Tcl generator, then removed); scriptlib/developer/ (provenance checker, sibling to goals_lint and architecture_lint); checker home revisited if it becomes a bake step (a punk:: module rather than scriptlib, which make.tcl must not depend on); src/runtime/punkshell.ico and src/vfs/_vfscommon.vfs/punkshell.ico (recorded as derived copies, not relocated)
 Acceptance: the `<asset-filename>.assetorigin.toml` sidecar format is documented with a `schema` key, the recorded asset bound by the sidecar's own filename (suffix stripped, same directory) and the source reference relative to that directory, files ending in the suffix being records, never assets; a reader tolerates a missing sidecar, unknown keys and an unrecognised schema version without erroring; a checker written in plain Tcl - no rasterizer, no external binary, runnable under any punkshell runtime - classifies each asset it examines as exactly one of `unrecorded` (no sidecar), `verified`, `artifact-absent` (a sidecar whose paired asset is gone), `source-absent`, `replaced` or `stale` per the state table in this file, where `verified` requires every hash the sidecar records to match, so a sidecar carrying only the artifact hash is verified on that alone, demonstrably distinguishing `stale` (source changed since the artifact was generated) from `replaced` (artifact changed since recording) and from `artifact-absent` on constructed fixtures, and is advisory only, never failing a build, in the manner of the G-133 payload checks; the icon generator is reimplemented with no Windows-only component (`System.Drawing` in particular), regenerating every generated `.ico` under `src/assets/logo/` byte-identically to the current `make-ico.ps1` under the invocation profile that produced it before that script is removed, and (re)writing the sidecar of each artifact it produces - artifact and source hashes plus the invocation options - so regeneration cannot leave a stale record; and sidecars exist and verify for every generated artifact under `src/assets/logo/`, `alternative/`, `web/` and `project-default/`.
 
+### G-127 [achieved 2026-07-31] Cross-target bake of a custom .vfs: per-target payload and per-target output location → detail: goals/archive/G-127-crosstarget-vfs-bake.md
+Scope: src/make.tcl (target-keyed output location and deploy folder, kit-name disambiguation by target, payload/target mismatch reporting, retirement of the kit-loop cross-platform TODO); src/vfs/*.vfs.toml (per-target payload declaration - the achieved G-115 surface this goal adds the platform axis to); src/runtime/mapvfs.toml (one vfs definition paired with several targets); src/vfs/ (per-target payload convention with punk9linux.vfs as the migration case); bin/kits/<platform>/ (non-native kit output tier, beside the existing bin/runtime/<platform>/ input tier); src/tests/shell/testsuites/punkexe/ (characterization - two-target bake, no-collision, mismatch report); bin/AGENTS.md + src/AGENTS.md (where cross-target kits land)
+Acceptance: two mapvfs entries pairing the SAME vfs definition with two different targets bake in one run to distinct artifacts - a native-target kit stays at bin/<name> exactly where it lands today, a non-native one at bin/kits/<platform>/<name> with src/_build separated the same way - and neither is overwritten when the two are baked as separate selective single-kit runs (the current defect: exe_names_seen resets per run, so the second write lands on the first); two NON-NATIVE targets sharing a kit name coexist as distinct artifacts, where today they collide or are disambiguated by runtime name rather than by platform; the binary payload installed into each target's kit is selected for that target from src/vendorlib_tcl<N>/<platform> through one declaration rather than by duplicating a .vfs folder per target, and a kit declared for a single target builds byte-comparably to today; a payload binary that would be LOADED on the kit's target but was built for another platform is reported naming the file and both platforms, while per-platform subdirectory layouts that the loader resolves correctly (e.g tcllib's <pkg>/<platform>/<lib>) are explicitly not flagged; bakelist shows each row's output location; the existing punk9linux.vfs is either migrated to the declaration or recorded here as deliberately staying hand-curated, and the linux punkshell902 kit's move from bin/ to bin/kits/linux-x86_64/ is recorded as an intended relocation; the G-023 reconciliation is stated (version-named outputs compose with the platform directory rather than competing with it); native win32 kit outputs are unchanged in name and location and the existing punkexe suites pass unchanged; the kit-loop TODO at src/make.tcl "allow building of kits for other platforms" is retired pointing here.
+
 ### G-128 [achieved 2026-07-29] Portable PE resource stamping: a vendored zig tool that icons a finished kit from any host → detail: goals/archive/G-128-portable-pe-resource-stamping.md
 Scope: src/tools/punkres/ (vendored zig source - tool name settled in the work - with provenance and licence records); src/make.tcl (mechanism selection at the G-057 seam, sharing G-126's tool build step); bin/tools/zig* (pinned toolchain as consumed); bin/punkres.exe (untracked build output); src/tests/ (characterization - icon replaced, payload intact, idempotent, overlay-unsafe refusal); TEMP_REFERENCE/tcl-sfe (read-only reference for the resource structures)
 Acceptance: the vendored tool, built by the same make.tcl tool step G-126 establishes, replaces RT_ICON/RT_GROUP_ICON in a pre-built PE that already carries an appended zip overlay, for the kit shapes we build (kit, zip, zipcat per mapvfs.config): the new icon is confirmed by reading the resources back with the tool ITSELF (so verification does not require a windows host or twapi) and cross-checked once on windows with twapi::extract_resources; the stamped kit still boots to a working punk shell reading its payload; re-stamping converges with no resource accumulation; it works where .rsrc is NOT the last section - the shape our own runtimes have (tclsfe-x64/punk91: .text .rdata .data .pdata .rsrc .reloc; suite-built tclsh9.0.5-punk: .text .rdata .buildid .data .pdata .tls .rsrc .reloc) - by appending a section and repointing the resource data directory rather than growing .rsrc in place; the appended payload survives the file-offset shift this causes, which is safe for an ARCHIVE-relative zip and not for a file-relative one; a file-relative payload is REFUSED BY DEFAULT with an error naming the reason and the rewrap remedy, but an explicit consent flag (tool CLI and the G-057 seam, never an interactive prompt in non-interactive runs) stamps it by shifting the overlay AND rewriting every central-directory local-header offset plus the EOCD directory offset by the shift delta - deliberately PRESERVING the file-relative convention, with a notification that the format is non-standard - verified by re-reading the stamped artifact (offsetstyle still file, members crc-verified); zip64 and multi-disk archives are refused even with consent; one end-to-end run from a NON-WINDOWS host produces a stamped win32 kit whose icon a windows machine confirms (recorded here: which host); G-057's seam selects the tool when present and falls back to its twapi path otherwise, with a parity check showing both mechanisms yield equivalent resource content from the same input, and zig stays optional - with no tool built, G-057 behaves exactly as it does without this goal; the tool's distribution is settled and recorded - buildable from the vendored source with the pinned toolchain AND publishable as a punkbin artifact through the G-123/G-006 channels, so a no-toolchain user has a route that does not depend on the committed twapi; the tool's structure handling is written so the parked RT_VERSION stamping needs no second tool; licensing and upstream provenance of the vendored tree are recorded per G-063 and G-026.

GOALS.md

@@ -370,10 +370,6 @@ Scope: src/buildsuites/suite_tcl90/ (build_tcltls module + crypto-backend build,
 Detail: goals/G-116-suite-built-tcltls.md
 
 
-### G-127 [active] Cross-target bake of a custom .vfs: per-target payload and per-target output location
-Scope: src/make.tcl (target-keyed output location and deploy folder, kit-name disambiguation by target, payload/target mismatch reporting, retirement of the kit-loop cross-platform TODO); src/vfs/*.vfs.toml (per-target payload declaration - the achieved G-115 surface this goal adds the platform axis to); src/runtime/mapvfs.toml (one vfs definition paired with several targets); src/vfs/ (per-target payload convention with punk9linux.vfs as the migration case); bin/kits/<platform>/ (non-native kit output tier, beside the existing bin/runtime/<platform>/ input tier); src/tests/shell/testsuites/punkexe/ (characterization - two-target bake, no-collision, mismatch report); bin/AGENTS.md + src/AGENTS.md (where cross-target kits land)
-Detail: goals/G-127-crosstarget-vfs-bake.md
-
 ### G-130 [proposed] 32-bit windows runtimes from the buildsuites, both Tcl generations
 Scope: src/buildsuites/suite_tcl90/ and src/buildsuites/suite_tcl86/ (the win32-ix86 target invocation and any recipe or flag divergence 32-bit forces); src/buildsuites/ (target dimension as settled by G-105 - no per-target tree copies); bin/runtime/win32-ix86/ (output tier - already holds the third-party comparison runtimes); punkbin per-target artifact layout with G-103 metadata carrying the target
 Detail: goals/G-130-32bit-windows-buildsuites.md

goals/G-023-version-named-binaries.md

@@ -109,3 +109,10 @@ binary-artifacts repository). Revisit when the accumulation actually bites.
   each get their own <name>.resources.toml sidecar via the same per-targetkit
   emission.
 - G-121 (archived) recorded that scheme-expanded output names should enter the parsed mapping model as expansions (::punkboot::lib::mapvfs_kit_outputs) so generated names join the bakelist / bake-by-name surface automatically when this goal lands - see goals/archive/G-121-bakelist-selective-bake.md
+- G-127 (achieved 2026-07-31, archived) recorded the reconciliation its Acceptance owed
+  this goal: version-named outputs COMPOSE with the platform output tier rather than
+  competing - scheme records carry a target like any mapping entry and flow through the
+  same per-kit location logic (a scheme declaring target <p> yields
+  bin/kits/<p>/punk<gen>-<version> etc), and the release gate now checks the per-kit
+  deploy dir rather than flat bin/ - this goal's explicit release step must address the
+  same per-kit location - see goals/archive/G-127-crosstarget-vfs-bake.md.

goals/G-060-qemu-test-matrix.md

@@ -86,3 +86,8 @@ direction rather than a new ad-hoc location.
   windows-framed): per guest, verify extracted temp copies do not accumulate, or
   characterize the flaw. Detail + requirement: G-103 Notes (achieved
   2026-07-22 - see goals/archive/G-103-runtime-kit-family.md).
+- G-127 (achieved 2026-07-31, archived) - cross-target kits now bake to
+  bin/kits/<platform>/<kit> with acceptance deliberately host-verifiable end to end
+  (non-executing gates, stated-reason smoke skips); ON-TARGET execution of those
+  artifacts is exactly this matrix's job, and its FreeBSD kit case is the first
+  customer - see goals/archive/G-127-crosstarget-vfs-bake.md.

goals/G-101-tcl86-kit-container-strategy.md

@@ -408,3 +408,7 @@ it over cookfs/zipvfs, since Tcl 9 already has zipfs and needs no help.
   the existing punkbin 8.6-era third-party kits (tclkit86bi etc) already
   carry its retroactive provenance sidecars. See
   goals/archive/G-123-thirdparty-runtime-tiers.md.
+- G-127 (achieved 2026-07-31, archived) made the mapping/output surfaces 8.6 containers
+  ride fully target-keyed: non-default-target kits bake to bin/kits/<platform>/ and
+  per-.vfs %platform% payload declarations select per consuming kit target - container
+  kits inherit both unchanged - see goals/archive/G-127-crosstarget-vfs-bake.md.

goals/G-105-buildsuite-cross-target.md

@@ -160,3 +160,8 @@ goals/archive/G-100-suite-tcl86-tk-tcllib.md), G-102 (achieved 2026-07-21 - driv
   consent gate - publish a suite-built cross-target runtime into its
   punkbin tier and the whole client path already works. See
   goals/archive/G-123-thirdparty-runtime-tiers.md.
+- G-127 (achieved 2026-07-31, archived) gave this goal's cross-target artifacts their
+  OUTPUT home: a mapvfs entry targeting a suite-built runtime's platform bakes to
+  bin/kits/<platform>/<kit> (src/_build tiered the same way), with per-target payload
+  selection via %platform% declarations - the consumption end of this goal's produce
+  end - see goals/archive/G-127-crosstarget-vfs-bake.md.

goals/G-114-per-platform-tm-roots.md

@@ -62,3 +62,9 @@ work land deliberately when G-109-era binary tms arrive, not ad hoc.
   time for whatever layout a payload has, while this goal would PREVENT wrong-platform
   binary .tm registration at runtime - see
   goals/archive/G-133-bake-payload-consistency-checks.md.
+- G-127 (achieved 2026-07-31, archived) built the payload/platform connection its notes
+  said had never been made, one layer up from this goal: %platform% payload declarations
+  stage per consuming kit target and each kit image carries only its own target's
+  subtree - so a cross-target kit's tm-root registration (this goal's layer) can assume
+  the image payload is already target-appropriate - see
+  goals/archive/G-127-crosstarget-vfs-bake.md.

goals/G-116-suite-built-tcltls.md

@@ -65,3 +65,9 @@ extends).
 - G-108 relationship: when the debug tier lands, this goal's static crypto + tls
   extension joins the TCL_MEM_DEBUG all-or-nothing set - G-108's debug-define
   rebuild feasibility must cover it.
+- G-127 (achieved 2026-07-31, archived) provides the landing surface for this goal's
+  artifacts inside kit payloads: per-platform payload declarations (%platform% source
+  -> _targets/<platform>/ staging, selected per consuming kit target). punk9linux.vfs's
+  hand-dropped tcltls tree is explicitly recorded there as hand-curated PENDING this
+  goal - once suite-built tcltls artifacts publish to a lib tier, a single %platform%
+  entry replaces the drop-in - see goals/archive/G-127-crosstarget-vfs-bake.md.

goals/G-127-crosstarget-vfs-bake.md

@@ -1,6 +1,6 @@
 # G-127 Cross-target bake of a custom .vfs
 
-Status: active
+Status: achieved 2026-07-31
 Scope: src/make.tcl (target-keyed output location and deploy folder, kit-name disambiguation by target, payload/target mismatch reporting, retirement of the kit-loop cross-platform TODO); src/vfs/*.vfs.toml (per-target payload declaration - the achieved G-115 surface this goal adds the platform axis to); src/runtime/mapvfs.toml (one vfs definition paired with several targets); src/vfs/ (per-target payload convention with punk9linux.vfs as the migration case); bin/kits/<platform>/ (non-native kit output tier, beside the existing bin/runtime/<platform>/ input tier); src/tests/shell/testsuites/punkexe/ (characterization - two-target bake, no-collision, mismatch report); bin/AGENTS.md + src/AGENTS.md (where cross-target kits land)
 Goal: one kit definition bakes for several declared target platforms from a single source of truth - each target getting ITS binary payload and an output location that cannot be overwritten by another target's kit of the same name - so building a custom .vfs for this machine and for FreeBSD is a declaration, not a duplicated .vfs folder and a naming convention held in the developer's head. G-122 made the build read the right runtime for a target; this makes it write the right kit for one.
 Acceptance: two mapvfs entries pairing the SAME vfs definition with two different targets bake in one run to distinct artifacts - a native-target kit stays at bin/<name> exactly where it lands today, a non-native one at bin/kits/<platform>/<name> with src/_build separated the same way - and neither is overwritten when the two are baked as separate selective single-kit runs (the current defect: exe_names_seen resets per run, so the second write lands on the first); two NON-NATIVE targets sharing a kit name coexist as distinct artifacts, where today they collide or are disambiguated by runtime name rather than by platform; the binary payload installed into each target's kit is selected for that target from src/vendorlib_tcl<N>/<platform> through one declaration rather than by duplicating a .vfs folder per target, and a kit declared for a single target builds byte-comparably to today; a payload binary that would be LOADED on the kit's target but was built for another platform is reported naming the file and both platforms, while per-platform subdirectory layouts that the loader resolves correctly (e.g tcllib's <pkg>/<platform>/<lib>) are explicitly not flagged; bakelist shows each row's output location; the existing punk9linux.vfs is either migrated to the declaration or recorded here as deliberately staying hand-curated, and the linux punkshell902 kit's move from bin/ to bin/kits/linux-x86_64/ is recorded as an intended relocation; the G-023 reconciliation is stated (version-named outputs compose with the platform directory rather than competing with it); native win32 kit outputs are unchanged in name and location and the existing punkexe suites pass unchanged; the kit-loop TODO at src/make.tcl "allow building of kits for other platforms" is retired pointing here.
@@ -296,6 +296,52 @@ exists locally (empty but for sha1sums.txt) and punkbin upstream carries
   vendored-tree migration is G-004's recorded template). Mixed posture is the
   honest record: declared where a governed source tier exists, hand-curated
   drop-ins where none does yet.
-- Remaining for acceptance: byte-comparability spot-check for a zip-type native
+- 2026-07-31 increment 5 (verification + closeout):
-  kit (prefix + extracted-content comparison); full-suite/punkexe re-run at
+  BYTE-COMPARABILITY: punk86 (sdx type) rebuilt through the split machinery
-  closeout.
+  deploy-skipped as content-identical to its pre-G-127 deployed copy; punkdeclare
+  (zip type) forced-rebuild compared by the recorded method for
+  non-byte-reproducible kit zips - runtime prefix (2433536 bytes) identical, 2805
+  members, zero name/size/crc32 differences. Zip-kit rebuilds differ from their
+  7-29/30 bin copies only by intervening G-115-era payload-source evolution
+  (punkcheck-attributed), not by the location machinery.
+  DRIVING-TCLSH TRAP (found by the G-134 pin doing its job): this host's PATH
+  tclsh is c:/tcl87 (dev 8.7, old zipfs API) whose mkimg emits FILE-relative
+  offsets - zip kits baked with it earn the G-134 BUILD-WARNING and drift bytes.
+  punk905 + punkdeclare were re-baked clean with the native Tcl903 tclsh90;
+  drive bakes with Tcl903 (or a punk kit), never the tcl87 PATH tclsh.
+  ONE-RUN TWO-TARGET SAME-VFS real bake (fixture mapping, full real bakes):
+  'bake fixnat fixlin' (punk9wintk903.vfs as win32-x86_64 zip + linux-x86_64
+  kit) produced bin/fixnat.exe AND bin/kits/linux-x86_64/fixlin in one run,
+  each arch-scanned against ITS OWN target (fixnat 72/72 match; fixlin 72
+  recapped mismatches naming file, found arch and target - the mismatch clause
+  demonstrated live, with the platform-subdir exemption visible on both).
+  SAME-NAME TWO-NON-NATIVE real bakes: legacy fixture fixsame (linux-x86_64 kit
+  + win32-ix86 zip on punk8min.vfs) - one 'bake fixsame' run built BOTH
+  artifacts (distinct sha1s AE93E2AE... / ADDE393E...), a second run left both
+  byte-identical: the cross-run overwrite is structurally impossible. Fixture
+  artifacts removed after verification (ledger rows remain, harmless).
+  VERIFY-IX86 RELOCATION LIVE: punkluck86 baked to
+  bin/kits/win32-ix86/punkluck86.exe - arch scan 26/26 match for win32-ix86 and
+  the smoke probe EXECUTED the tiered artifact (host-runnable non-default
+  target): Thread 2.8.5.
+  %platform% ON BOTH SOURCE ROOTS incl. the vendorlib path the Acceptance names:
+  punkdeclare.vfs.toml migrated (tcludp from vendorlib_tcl9/%platform%/,
+  tcllibc from the packages tier), flat folder payload removed - the whole
+  payload stages under _targets/win32-x86_64/ and the smoke probe resolves
+  udp 1.0.13 + tcllibc 2.0 inside the built kit.
+  RELOCATION ORPHANS removed after verifying the tiered replacements:
+  bin/punkshell902 + src/_build/punkshell902(.vfs), bin/punkluck86.exe + build
+  copies; punk91ix86's flat copy stays until its next bake relocates it.
+  Full punkexe subtree re-run after all increments: 15 files, 101 tests,
+  97 pass / 4 constraint-skips / 0 fail (Tcl903 runner).
+- Acceptance assessment 2026-07-31: every clause verified - one-run two-target
+  distinct artifacts with native placement unchanged; cross-run no-overwrite by
+  construction plus the live two-run check; two-non-native same-name
+  coexistence; per-target payload selection from vendorlib_tcl<N>/%platform%
+  and the packages tier through one declaration; single-target
+  byte-comparability by the recorded prefix+content method; mismatch reporting
+  live and pinned as the G-133 regression pin; bakelist row locations; the
+  punk9linux migrated-plus-hand-curated record; the punkshell902 relocation
+  recorded and executed; the G-023 reconciliation stated; native win32 outputs
+  unchanged with the punkexe suites passing; the kit-loop TODO retired.
+  Remaining-work list: resolved. Flipped achieved 2026-07-31.

goals/G-131-boot-payload-autodetection.md

@@ -113,3 +113,8 @@ independently-written branches.
   in kit <kit> (target <t>) ...", recapped BUILD-WARNINGs), and its smoke-require probe
   runs the built artifact via the tclsh subcommand - another consumer of the runtime_caps
   /probe surface being reworked here - see goals/archive/G-133-bake-payload-consistency-checks.md.
+- G-127 (achieved 2026-07-31, archived) landed the sibling output half of the kit loop
+  this goal's rework edits: per-kit target-keyed locations (kit_builddir/kit_deploydir,
+  kits/<platform>/ tiers), a per-(target,name) duplicate guard, and the _targets
+  per-platform payload-selection overlay between the vfs merges and the arch scan/G-125
+  gate - see goals/archive/G-127-crosstarget-vfs-bake.md.

goals/G-137-kit-version-resources.md

@@ -77,11 +77,14 @@ sidecar.
 - Related: G-024 (achieved 2026-07-31 - see goals/archive/G-024-mapvfs-toml.md;
   mapvfs.toml is live) - if per-kit version overrides are ever wanted, they land
   in its mapvfs toml grammar.
-- Related: G-127 - its bin/kits/<platform>/ output relocation moves the artifacts
+- Related: G-127 (achieved 2026-07-31 - see
-  this stamping seam emits; stamp + sidecar emission must follow the artifact's
+  goals/archive/G-127-crosstarget-vfs-bake.md) - its bin/kits/<platform>/ output
-  location (the same per-target wrap-seam composition question G-127's G-057 icon
+  relocation is LIVE and the icon/resources wrap seam already receives the
-  note records). Bridge recorded directly 2026-07-31 when G-024 - previously the
+  per-kit build dir (kit_builddir), so stamp + <kit>.resources.toml sidecar
-  pair's only shared live reference - was archived.
+  emission follow the artifact's location today; this goal's RT_VERSION stamping
+  inherits the same pathing with nothing extra to do. Bridge recorded directly
+  2026-07-31 when G-024 - previously the pair's only shared live reference - was
+  archived.
 - Related: G-028 - a locked kit exe blocks a resource update exactly as it
   blocks deploy; its locker-report direction applies to version stamping
   failures too.

goals/G-141-libfetch-target-selection.md

@@ -54,11 +54,14 @@ has no equivalent of "materialize what this checkout needs".
 - Report the derivation (target -> pulling declaration) in libfetch output;
   make the VFSLIBS missing-source hint name the invocation that fetches what
   the failing bake needs.
-- Coordinate surfaces, not formats: G-127 owns per-target kit payload
+- Coordinate surfaces, not formats: G-127 (achieved 2026-07-31 - see
-  declaration and G-115 the declaration format - the derivation consumes
+  goals/archive/G-127-crosstarget-vfs-bake.md) owned per-target kit payload
-  whichever declaration surface is current (the per-.vfs
+  declaration and G-115 the declaration format - both are now live, so the
-  src/vfs/<name>.vfs.toml files since G-115's 2026-07-31 supersession of
+  derivation consumes the current surface: per-.vfs src/vfs/<name>.vfs.toml
-  vendorlib_vfs.toml - see the Notes update).
+  files, whose source_root="packages" entries carry either literal
+  <target>-prefixed source paths OR the G-127 %platform% form (platform set =
+  the consuming kits' mapvfs targets, already computed by the VFSPAYLOAD
+  phase's derivation map).
 
 ## Alternatives considered
 
@@ -91,9 +94,12 @@ has no equivalent of "materialize what this checkout needs".
   (-trust-server / PUNKBIN_TRUST_SERVER=1, fetch-only gate) alongside
   libfetch's -trust-server - this goal's selection options join that
   vocabulary, and G-006 absorbs all of it when it lands.
-- Related: G-127 - owns per-target kit payload declaration and bake output
+- Related: G-127 (achieved 2026-07-31 - see
-  targeting; whichever lands second adopts the other (its per-target
+  goals/archive/G-127-crosstarget-vfs-bake.md) - landed first: per-target
-  declarations become this derivation's input).
+  payload declarations (%platform% sources, platform set derived from the
+  consuming kits) and bin/kits/<platform>/ output targeting are live, so this
+  goal adopts that surface as its derivation input - a %platform% packages
+  entry's needed targets are exactly the consuming kits' mapvfs targets.
 - Related: G-115 (achieved 2026-07-31 - see
   goals/archive/G-115-declarative-vfs-composition.md) - it DID supersede
   vendorlib_vfs.toml: the kit-consumption input for this goal's derivation is

src/vfs/punkdeclare.vfs.toml

@@ -10,11 +10,14 @@
 # smokerequire (udp + tcllibc in mapvfs.toml) proves both binary packages resolve inside the
 # built artifact. Undeclared files dropped into the folder are preserved across
 # re-materialization (drop-in-wins precedence - src/vfs/README.md).
+# G-127: both entries are PER-PLATFORM (%platform% resolves per consuming kit target -
+# today win32-x86_64 via [kit.punkdeclare]) - one from the vendor tree, one from the
+# packages tier, so the demo covers the axis on both source roots.
 [payload.tcludp]
-source = "vendorlib_tcl9/win32-x86_64/tcludp1.0.13"
+source = "vendorlib_tcl9/%platform%/tcludp1.0.13"
 target = "lib_tcl9"
 
 [payload.tcllibc]
 source_root = "packages"
-source = "win32-x86_64/tcl9/tcllibc"
+source = "%platform%/tcl9/tcllibc"
 target = "lib_tcl9"