G-139 achieved 2026-07-30: flip + archive record + reference sweep (0.32.0)

Acceptance met in full (walk in the detail file's Progress): libfetch with
sha1 verification + beside-toml metadata + server-trust consent proven LIVE
against the canonical origin post-publication; PACKAGES_tcl<N> libs-step
materialization with punkcheck provenance; vendorlib_vfs.toml declarations
(source_root=packages + replace) with supersedes removing tcllib1.21 incl.
nested tcllibc 0.4 + md5c from the 8.6-family kits; punk86 kit-hosted
runtests vs the same-day baseline IDENTICAL (zero differences to
disposition); vendored trees removed in their own commit after the proven
bake (70d1838c); the post-removal verification bake shipped kits with
verifiable embedded provenance from the tcllib-vendorless checkout;
derived-project decision recorded (fc2376ca).

Index entry -> GOALS-archive.md record. Reference sweep: G-004's
pending-tense retirement line updated to delivered (+ the remaining
vendored trees named as its outstanding scope with the tcllib pattern as
template); actionable pointers pushed to G-006 (libfetch's trust gate = the
interim consent instance to absorb), G-065 (the artifact-fetch pattern to
absorb/reference), G-027 (derived-project library story via the layout
sync), G-123 (materialization twin + the live interim consent flag to
coordinate with). make.tcl workflow text updated to the landed consumption
shape (fetch -> tier -> PACKAGES phase + vfslibs packages lane); vfslibs
summary/help texts cover both source roots. Project 0.32.0 + CHANGELOG
(user-visible kit payload upgrade). goals_lint clean (82 active, 57
archived). Detail-file move to goals/archive/ follows in the adjacent
pure-rename commit.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

CHANGELOG.md

@@ -5,6 +5,19 @@ The latest `## [X.Y.Z]` header must match the `version` field in `punkproject.to
 Entries are newest-first; one bullet per notable change. See the root `AGENTS.md`
 "Project Versioning" section for the bump policy.
 
+## [0.32.0] - 2026-07-30
+
+- Kit payloads switched to punkbin lib-tier artifacts (G-139): the 8.6-family
+  kits upgrade tcllib 1.21 (+its 2023 tcllibc 0.4 and md5c) to suite-built
+  tcllib 2.0 + current tcllibc; the tcl9 kits' hand-dropped tcllib2.0 copies
+  (which nested md5c/tcllibc) are replaced by the published artifacts with
+  sibling tcllibc. Every installed package tree in deployed lib_tcl<N> and
+  kit payloads now carries an embedded punkbin-artifact.toml provenance
+  record. The vendored src/vendorlib tcllib trees are retired (the first
+  major G-004 payoff). Validated by kit-hosted runtests on punk86 against a
+  same-day baseline (identical results). r1 artifacts published to the
+  punkbin origin; `make.tcl libfetch` verified live against it.
+
 ## [0.31.1] - 2026-07-30
 
 - `make.tcl libs`/`packages`/`bakehouse` gain the PACKAGES_tcl<N> phase

GOALS-archive.md

@@ -242,3 +242,7 @@ Acceptance: each assembled kit image is probed with punk::zip::archive_info and
 ### G-138 [achieved 2026-07-30] Punkbin library artifact tier: suite-built tcllib/tcllibc published as versioned package zips → detail: goals/archive/G-138-punkbin-library-artifact-tier.md
 Scope: src/buildsuites/suite_tcl90/ (library-artifact emission step + tools - beside family_artifacts.tcl, schema emission coordinated with G-123); src/buildsuites/suite_tcl86/ (same emission for the tcl8-generation build); punkbin artifact repo (external, c:/repo/jn/punkbin - new lib/ tier: lib/allplatforms + lib/<target>, layout docs, sha1sums, minisign posture); src/tools/punkzip (as consumed - deterministic zip assembly)
 Acceptance: an emission step produces punkbin-layout library artifacts from verified suite builds - suite_tcl90 demonstrated end-to-end (a platform-neutral tcllib zip under lib/allplatforms and a win32-x86_64 tcllibc zip under lib/win32-x86_64), with suite_tcl86's tcl8-generation emission demonstrated or recorded here as an explicit follow-through; zips are assembled with deterministic member ordering (punkzip) so identical input trees reproduce identical zips, and the zig non-bit-reproducibility caveat is recorded with the publish discipline it forces (revisions bump only on deliberate publish, never per rebuild); each zip contains the package folder in installed shape with an embedded punkbin-artifact.toml (class library; provenance covering the source checkout uuids, critcl ref, zig version, optimize mode and driving-shell patchlevel); beside-artifact toml sidecars and sha1sums.txt entries are emitted in the same step; publication to the real punkbin repo remains a deliberate user step and the punkbin layout docs record the lib tier; the md5c package question is dispositioned (published as its own zip or dropped, with the tcllibc-provides-the-md5-accelerator rationale recorded either way).
+
+### G-139 [achieved 2026-07-30] Consume punkbin library artifacts: fetch/materialize tier replacing vendored tcllib/tcllibc → detail: goals/archive/G-139-punkbin-library-consumption.md
+Scope: src/make.tcl (consent-gated library fetch entrypoint; libs step consuming the packages tier; vfslibs as touched); bin/packages/<target>/ (new untracked materialization tier mirroring bin/runtime/<tier>/); src/runtime/vendorlib_vfs.toml (tcllib/tcllibc kit-vfs declarations with supersedes removal of the legacy versions); src/vendorlib_tcl8/win32-x86_64/tcllib1.21 + src/vendorlib_tcl9/win32-x86_64/tcllib2.0 (retirement targets); src/vfs/*.vfs lib_tcl<N> trees (kit payload switchover incl. the punk86-family tcllib 2.0 upgrade); lib_tcl8/ + lib_tcl9/ (deployed-tree materialization targets); user-config consent (server-trust pattern shared with G-123/G-006)
+Acceptance: a make.tcl entrypoint fetches declared library artifacts from the punkbin lib tier into bin/packages/<target>/ with sha1 verification and beside-toml metadata (consent keyed to server trust per the G-123 posture - fetches from the canonical origin prompt nothing new); the libs step materializes lib_tcl<N>/allplatforms and lib_tcl<N>/<platform> from that tier with punkcheck-tracked provenance; tcllib and tcllibc enter src/runtime/vendorlib_vfs.toml (or its G-115/G-024 successor) declarations so the declared kit vfs trees receive them, with supersedes removing tcllib1.21 (including its nested tcllibc 0.4 and md5c) from the 8.6-family kits; the punk86-family upgrade to tcllib 2.0 + a current tcllibc is validated by kit-hosted runtests against a same-day baseline with every difference dispositioned; the vendored src/vendorlib_tcl8/win32-x86_64/tcllib1.21 and src/vendorlib_tcl9/win32-x86_64/tcllib2.0 trees are removed from the tracked tree once a bake fed from the artifact path reproduces working kits; a bake on a checkout without those trees (fetch consented or bin/packages pre-populated) ships kits whose tcllib/tcllibc provenance is verifiable from the embedded records; the derived-project decision is recorded in this file (fetch via the same entrypoint as the default - the copy-and-tweak in-project suite build per G-104's self-description contract remains the documented alternative).

GOALS.md

@@ -406,7 +406,3 @@ Detail: goals/G-136-generated-project-icon-seeding.md
 ### G-137 [proposed] Kit version resources: RT_VERSION stamping from punkproject.toml via punkres
 Scope: src/tools/punkres/ (VS_VERSIONINFO construction, set-version + field-level read-back - upstream at c:/repo/jn/zig/punkres); src/make.tcl (version stamping at the G-057/G-128 kit-icon seam, punkres arm); bin/*.resources.toml sidecar format + bin/AGENTS.md (version fields and status vocabulary); punkproject.toml (field source - configurable overrides); src/tests/ (characterization)
 Detail: goals/G-137-kit-version-resources.md
-
-### G-139 [active] Consume punkbin library artifacts: fetch/materialize tier replacing vendored tcllib/tcllibc
-Scope: src/make.tcl (consent-gated library fetch entrypoint; libs step consuming the packages tier; vfslibs as touched); bin/packages/<target>/ (new untracked materialization tier mirroring bin/runtime/<tier>/); src/runtime/vendorlib_vfs.toml (tcllib/tcllibc kit-vfs declarations with supersedes removal of the legacy versions); src/vendorlib_tcl8/win32-x86_64/tcllib1.21 + src/vendorlib_tcl9/win32-x86_64/tcllib2.0 (retirement targets); src/vfs/*.vfs lib_tcl<N> trees (kit payload switchover incl. the punk86-family tcllib 2.0 upgrade); lib_tcl8/ + lib_tcl9/ (deployed-tree materialization targets); user-config consent (server-trust pattern shared with G-123/G-006)
-Detail: goals/G-139-punkbin-library-consumption.md

goals/G-004-no-committed-binaries.md

@@ -86,4 +86,5 @@ A standing repo-wide rule in root `AGENTS.md` (User Preferences) already directs
 - The scan in step 4 should distinguish "executable binary" from "zip archive" and from "zip archive containing an executable." A naive extension-based check is insufficient; content inspection (file magic, zip listing) is required.
 - The AGENTS.md user-preference rule is the transition guard: it stops agents from adding new binaries during the G-005/G-006 development period while the developer's existing vendor/vfs binary commits are known and intentional.
 - No persisted prior chat on this topic was found in project sessions; the motivation is the user's stated ultimate aim.
-- G-138 (archived 2026-07-30) landed the punkbin lib tier that lets built library binaries leave the tracked tree: suite-built tcllib/tcllibc as immutable generation-tagged zips with embedded provenance records (see goals/archive/G-138-punkbin-library-artifact-tier.md); the vendored src/vendorlib tcllib-tree retirement itself is G-139's sequenced work.
+- G-138 (archived 2026-07-30) landed the punkbin lib tier that lets built library binaries leave the tracked tree: suite-built tcllib/tcllibc as immutable generation-tagged zips with embedded provenance records (see goals/archive/G-138-punkbin-library-artifact-tier.md).
+- G-139 (archived 2026-07-30) DELIVERED the first major payoff of this goal: src/vendorlib_tcl8/win32-x86_64/tcllib1.21 and src/vendorlib_tcl9/win32-x86_64/tcllib2.0 are REMOVED from the tracked tree, replaced by the consent-gated fetch (make.tcl libfetch -> bin/packages tier -> lib_tcl<N> + kit vfs declarations), with kits validated and shipping verifiable embedded provenance - see goals/archive/G-139-punkbin-library-consumption.md. The remaining vendored binary trees (Img, itcl, sqlite, tdbc, twapi, ...) are this goal's outstanding scope; the tcllib pattern (publish tier + declared fetch + supersedes/replace switchover + runtests bracket) is the template.

goals/G-006-prebuilt-artifact-download.md

@@ -61,3 +61,11 @@ This goal is parallel to and independent of G-005. A user with zig uses G-005; a
   G-123's parallel lane for runtime tiers. The first concrete artifact this
   channel would serve exists: punkres on the punkbin tools tier (G-128,
   achieved - route in src/tools/punkres/PROVENANCE.md "Distribution").
+- G-139 (archived 2026-07-30) landed a WORKING instance of this goal's
+  consent shape for the library tier: 'make.tcl libfetch' with server-trust
+  keying - canonical punkbin origin fetches gate nothing, any other origin
+  (-serverurl / PUNKBIN_URL) refuses without the explicit -trust-server flag,
+  never an interactive prompt; Tcl-http/curl/PowerShell transport tiering;
+  sha1 verification against server sha1sums. This goal's mechanism, when
+  landed, should absorb/replace that interim flag rather than add a second -
+  see goals/archive/G-139-punkbin-library-consumption.md.

goals/G-027-derived-project-pull-updates.md

@@ -148,3 +148,10 @@ What a pull may touch splits by ownership, not by file type:
   maintain it on each pull (origin identity + pulled version). G-087 also
   retired the child-side PROJECT_LAYOUTS_CREATE_FROM_... marker on the
   grounds that post-generation refresh belongs to this goal's pull.
+- G-139 (archived 2026-07-30) recorded the derived-project library story
+  this goal's pull channel carries forward: generated projects receive
+  make.tcl (libfetch + the PACKAGES phase) via the layout make.tcl sync,
+  declare their own artifacts in src/runtime/libpackages.toml, and the
+  project-0.1 layout's src/buildsuites/README.md documents fetch-default vs
+  the G-104 copy-a-suite alternative - see
+  goals/archive/G-139-punkbin-library-consumption.md.

goals/G-065-declarative-vendoring.md

@@ -69,3 +69,11 @@ remains the punkshell format (G-024 direction).
 - The adoption scenario (an existing manual drop-in surfaced as undeclared, then
   brought under a declaration) still needs testing despite the removal - recreate it
   at test time with a scratch drop-in copy.
+- G-139 (archived 2026-07-30) implemented the artifact-fetch shape for the
+  tcllib case this goal anticipated: declared artifacts
+  (src/runtime/libpackages.toml) -> sha1-verified fetch (make.tcl libfetch)
+  -> untracked bin/packages tier -> punkcheck-installed lib_tcl<N> +
+  kit-vfs declarations (vendorlib_vfs.toml source_root="packages" +
+  replace/supersedes). Per its drafting note, this goal should absorb or
+  reference that pattern rather than duplicate it - see
+  goals/archive/G-139-punkbin-library-consumption.md.

goals/G-123-thirdparty-runtime-tiers.md

@@ -106,6 +106,13 @@ see goals/archive/G-058-static-runtime-packages.md).
   kit that passed its declared smoke-requires (plain package require inside the built
   artifact) plus a clean advisory binary-arch scan - see
   goals/archive/G-133-bake-payload-consistency-checks.md.
+- G-139 (archived 2026-07-30) landed the library-tier TWIN of this goal's
+  materialization design (bin/packages/<target> :: bin/runtime/<tier>) and a
+  LIVE instance of the server-trust consent posture: make.tcl libfetch's
+  canonical-origin-trusted / -trust-server-for-others gate (never an
+  interactive prompt) is the interim documented flag this goal's acceptance
+  anticipated - coordinate the punk-runtime-side surface with it rather than
+  introducing a third. See goals/archive/G-139-punkbin-library-consumption.md.
 - G-138 (archived 2026-07-30) landed schema v2 FIRST, for the library class:
   schema = 2 records with [provenance] class = "suite-built" (the
   suite-built|third-party|local field this goal specified), documented in

goals/G-139-punkbin-library-consumption.md

@@ -1,6 +1,6 @@
 # G-139 Consume punkbin library artifacts: fetch/materialize tier replacing vendored tcllib/tcllibc
 
-Status: active
+Status: achieved 2026-07-30
 Scope: src/make.tcl (consent-gated library fetch entrypoint; libs step consuming the packages tier; vfslibs as touched); bin/packages/<target>/ (new untracked materialization tier mirroring bin/runtime/<tier>/); src/runtime/vendorlib_vfs.toml (tcllib/tcllibc kit-vfs declarations with supersedes removal of the legacy versions); src/vendorlib_tcl8/win32-x86_64/tcllib1.21 + src/vendorlib_tcl9/win32-x86_64/tcllib2.0 (retirement targets); src/vfs/*.vfs lib_tcl<N> trees (kit payload switchover incl. the punk86-family tcllib 2.0 upgrade); lib_tcl8/ + lib_tcl9/ (deployed-tree materialization targets); user-config consent (server-trust pattern shared with G-123/G-006)
 Goal: punkshell obtains tcllib and tcllibc from the punkbin library tier (G-138) instead of committed vendored copies - a consent-gated fetch materializes verified library zips into an untracked bin/packages/<target> input tier from which make.tcl installs the deployed lib_tcl<N> trees and the declared kit vfs payloads - retiring the hand-dropped src/vendorlib tcllib trees in the G-004 direction, with every materialized package self-describing via its embedded artifact record, and the derived-project story recorded (fetch as the default path; in-project suite build as the alternative).
 Acceptance: a make.tcl entrypoint fetches declared library artifacts from the punkbin lib tier into bin/packages/<target>/ with sha1 verification and beside-toml metadata (consent keyed to server trust per the G-123 posture - fetches from the canonical origin prompt nothing new); the libs step materializes lib_tcl<N>/allplatforms and lib_tcl<N>/<platform> from that tier with punkcheck-tracked provenance; tcllib and tcllibc enter src/runtime/vendorlib_vfs.toml (or its G-115/G-024 successor) declarations so the declared kit vfs trees receive them, with supersedes removing tcllib1.21 (including its nested tcllibc 0.4 and md5c) from the 8.6-family kits; the punk86-family upgrade to tcllib 2.0 + a current tcllibc is validated by kit-hosted runtests against a same-day baseline with every difference dispositioned; the vendored src/vendorlib_tcl8/win32-x86_64/tcllib1.21 and src/vendorlib_tcl9/win32-x86_64/tcllib2.0 trees are removed from the tracked tree once a bake fed from the artifact path reproduces working kits; a bake on a checkout without those trees (fetch consented or bin/packages pre-populated) ships kits whose tcllib/tcllibc provenance is verifiable from the embedded records; the derived-project decision is recorded in this file (fetch via the same entrypoint as the default - the copy-and-tweak in-project suite build per G-104's self-description contract remains the documented alternative).
@@ -216,9 +216,35 @@ State at drafting worth recording:
   per-test outcome extraction (1119 lines) diffs EMPTY against baseline.
   Differences to disposition: none (the 8 failures pre-exist on the old
   payload and are unrelated to tcllib).
-- Remaining for acceptance: vendored src/vendorlib_tcl8|9 tcllib-tree
-  removal in its own commit (the artifact-path bake has now proven out);
-  the post-removal verification bake re-shipping kits with verifiable
-  embedded provenance; stray sweep (bin/test2/lib_tcl9/tcllib2.0,
+- 2026-07-30 retirement + post-removal verification: vendored
+  src/vendorlib_tcl8/win32-x86_64/tcllib1.21 and
+  src/vendorlib_tcl9/win32-x86_64/tcllib2.0 removed in their own commit
+  (git 70d1838c - removal-only, fallback is a revert) AFTER the artifact
+  path proved out; stray sweep done (bin/test2/lib_tcl9/tcllib2.0,
   scratch/tclkit86bi.vfs/lib/tcllibc, deployed lib_tcl<N> stale vendored
-  mirrors).
+  mirrors - all untracked build-output areas). Post-removal verification
+  bake (punk86 + punk905, tier pre-populated + canonical fetch consented):
+  both kits shipped from the tcllib-vendorless checkout with NO provenance
+  warnings (clean tracked tree) and only the recorded pre-existing zint
+  i386 warning; embedded records re-verified in both container types
+  (in-vfs probe / punkzip central-directory read).
+- ACHIEVED FLIP 2026-07-30. Acceptance walk: libfetch entrypoint with sha1
+  verification + beside-toml metadata + server-trust consent, proven LIVE
+  against the canonical origin post-publication (no prompts/flags);
+  PACKAGES_tcl<N> libs-step materialization into lib_tcl<N>/allplatforms +
+  lib_tcl<N>/win32-x86_64 with punkcheck provenance; tcllib/tcllibc
+  vendorlib_vfs.toml declarations (source_root=packages + replace) with
+  supersedes removing tcllib1.21 incl. nested tcllibc 0.4 + md5c from the
+  8.6-family kits; punk86 kit-hosted runtests validation vs the same-day
+  baseline - IDENTICAL results, zero differences to disposition; vendored
+  trees removed in their own commit after the proven bake; the
+  post-removal bake ships kits with verifiable embedded provenance;
+  derived-project decision recorded (fetch default / G-104 suite
+  alternative; layout samplesuite1 sketch replaced by the routes README).
+  Follow-through notes for the future: punk9linux's linux-built
+  tcllibc/tcllibc2.0 siblings await a linux-x86_64 lib-tier emission
+  (candidate goal - not written); kits other than punk86/punk905 switch
+  payloads at their next natural rebake (punk91/punksys/punk9_beta were
+  live user shells this session); a piped binscripts characterization
+  test for libfetch (httpfixture pattern) is a natural test-coverage
+  follow-up.

punkproject.toml

@@ -1,4 +1,4 @@
 [project]
 name = "punkshell"
-version = "0.31.1"
+version = "0.32.0"
 license = "BSD-2-Clause"

src/make.tcl

@@ -2132,8 +2132,8 @@ proc ::punkboot::punkboot_gethelp {args} {
     append h "    - update the src/vendormodules based on src/vendormodules/include_modules.config" \n \n
     append h "    - update the src/vendorlib based on src/vendorlib/config.toml (todo)" \n \n
     append h "  $scriptname vfslibs"  \n
-    append h "    - propagate declared vendored platform-library packages into kit vfs lib_tcl<N> trees" \n
-    append h "    - declarations (per-package per-kit, with superseded-version removal) live in src/runtime/vendorlib_vfs.toml" \n
+    append h "    - propagate declared platform-library packages (vendored src/ or bin/packages tier) into kit vfs lib_tcl<N> trees" \n
+    append h "    - declarations (per-package per-kit, with superseded-version removal + clean-slate replace) live in src/runtime/vendorlib_vfs.toml" \n
     append h "    - also runs automatically as a phase of '$scriptname bake' (and therefore of '$scriptname bakehouse')" \n \n
     append h "  $scriptname libfetch ?-serverurl <url>? ?-trust-server? ?-force?"  \n
     append h "    - fetch declared punkbin lib-tier library artifacts (src/runtime/libpackages.toml) into bin/packages/<target>" \n
@@ -2327,7 +2327,7 @@ DIAGRAM 2 - KIT ASSEMBLY DETAIL (the 'make.tcl bake' stage; incl. vfslibs phase)
                                            running shell still holds the old exe [K5]
 
 
-LIBRARY-ARTIFACT FETCH (G-139; input tier so far - lib_tcl<N>/kit consumption follows)
+LIBRARY-ARTIFACT FETCH + CONSUMPTION (G-139)
 ----------------------------------------------------------------------------
 
    src/runtime/libpackages.toml       which punkbin LIB-TIER artifacts this checkout
@@ -2345,6 +2345,15 @@ LIBRARY-ARTIFACT FETCH (G-139; input tier so far - lib_tcl<N>/kit consumption fo
    bin/packages/<target>/tcl<N>/<pkgfolder>/
                                       materialized installed-shape trees, self-describing
                                       via their embedded punkbin-artifact.toml records
+                          |
+                          |  consumption (two lanes, both punkcheck-tracked):
+                          |  PACKAGES_tcl<N> phase of modules/libs/packages/bakehouse
+                          |  -> lib_tcl<N>/allplatforms + lib_tcl<N>/<platform>;
+                          |  vfslibs entries with source_root = "packages"
+                          |  -> declared kit vfs lib_tcl<N> trees (see DIAGRAM 2)
+                          v
+   lib_tcl<N>/... + src/vfs/<kit>.vfs/lib_tcl<N>/...   (embedded records ride along
+                                      into deployed trees and baked kit payloads)
 
 
 KEY / NOTES
@@ -2548,7 +2557,7 @@ if {[info exists ::env(PUNKBOOT_PLAIN)] && [string is true -strict $::env(PUNKBO
                 libs            "Build pkgIndex.tcl libraries from src/lib, src/vendorlib etc into <projectdir>/lib etc"
                 bake            "Assemble kit/zipkit executables from promoted payload (src/vfs) and runtimes into <projectdir>/bin"
                 bakelist        "List the kit outputs configured in src/runtime/mapvfs.config: type, runtime/vfs presence, deployed state"
-                vfslibs         "Propagate declared vendored platform-library packages into kit vfs lib_tcl<N> trees"
+                vfslibs         "Propagate declared platform-library packages (vendored or bin/packages tier) into kit vfs lib_tcl<N> trees"
                 bin             "Install executables from src/bin into <projectdir>/bin, then build kits as for bake"
                 vendorupdate    "Update src/vendormodules based on src/vendormodules/include_modules.config"
                 libfetch        "Fetch declared punkbin lib-tier library artifacts into bin/packages/<target> (sha1-verified) and materialize the package trees"
@@ -2648,10 +2657,14 @@ if {[info exists ::env(PUNKBOOT_PLAIN)] && [string is true -strict $::env(PUNKBO
                  only - never builds."
                 vfslibs
                 "
-                 Propagate declared vendored platform-library packages into kit vfs
-                 lib_tcl<N> trees.
-                 Declarations (per-package per-kit, with superseded-version removal)
-                 live in src/runtime/vendorlib_vfs.toml.
+                 Propagate declared platform-library packages into kit vfs
+                 lib_tcl<N> trees - from vendored src/ folders (source_root
+                 'src', the default) or from the bin/packages punkbin lib-tier
+                 input (source_root 'packages', populated by 'make.tcl
+                 libfetch' - G-139).
+                 Declarations (per-package per-kit, with superseded-version
+                 removal and clean-slate same-name 'replace') live in
+                 src/runtime/vendorlib_vfs.toml.
                  Also runs automatically as a phase of 'make.tcl bake' (and therefore
                  of 'make.tcl bakehouse'); this standalone narrowing serves quick
                  iteration on the declarations."