diff --git a/goals/G-057-kit-icon-embedding.md b/goals/G-057-kit-icon-embedding.md
index 8302714d..c985cb1f 100644
--- a/goals/G-057-kit-icon-embedding.md
+++ b/goals/G-057-kit-icon-embedding.md
@@ -141,10 +141,13 @@ delete-then-write). Requirements sketch agreed 2026-07-10:
   (src/assets/logo/AGENTS.md "Provenance records"), the checker
   (scriptlib/developer/assetorigin_check.tcl), and a verified derived-copy
   sidecar beside this goal's default icon at src/runtime/punkshell.ico (hash
-  equals source_hash, source ../assets/logo/punk-mark.ico). Its notes also
-  carry the still-open user call this goal will meet at bake time: whether the
-  _vfscommon.vfs / per-kit vfs punkshell.ico copies get sidecars, which would
-  ship inside every baked kit.
+  equals source_hash, source ../assets/logo/punk-mark.ico). The kit-shipping
+  call its notes carried is now made (user-approved 2026-07-28):
+  src/vfs/_vfscommon.vfs/punkshell.ico carries a sidecar that ships inside
+  every kit merging the common payload from that kit's next bake - inside a
+  kit it truthfully reads source-absent (bytes hash-confirmed, source not
+  shipped). The per-kit mkzipfix.vfs / punk8_statictwapi.vfs copies stay
+  unrecorded.
 - The sidecar is the natural reconciliation point for the three provenance surfaces this
   file already flags (G-025's kit stamp, G-117's embedded artifact record, the parked
   RT_VERSION follow-on) - one text record per kit, on every platform.
diff --git a/src/assets/logo/AGENTS.md b/src/assets/logo/AGENTS.md
index 8e08b13b..9e25050e 100644
--- a/src/assets/logo/AGENTS.md
+++ b/src/assets/logo/AGENTS.md
@@ -18,11 +18,13 @@ elsewhere in the tree is a derived copy or a build input, never an original.
   `src/vfs/mkzipfix.vfs/` and `src/vfs/punk8_statictwapi.vfs/`. Those four were
   set from `punk-mark.ico` on 2026-07-28 at the user's direction. Propagating a
   later change to them is build machinery owned by G-057 — not a manual step to
-  repeat from here. The `src/runtime/` copy carries an assetorigin sidecar
-  recording the derivation (hash equals source_hash: a byte-identical copy);
-  the three vfs copies stay deliberately unrecorded pending the user call on
-  shipping sidecars inside baked kits (recorded in
-  goals/archive/G-135-asset-provenance-records.md notes).
+  repeat from here. The `src/runtime/` and `_vfscommon.vfs` copies carry
+  assetorigin sidecars recording the derivation (hash equals source_hash: a
+  byte-identical copy); the `_vfscommon.vfs` sidecar ships inside every baked
+  kit that merges the common payload (user-approved 2026-07-28 - inside a kit
+  it truthfully reads source-absent, the icon bytes still hash-confirmed).
+  The `mkzipfix.vfs` and `punk8_statictwapi.vfs` copies stay unrecorded (no
+  decision requested; unrecorded is silent and fully supported).
 
 ## Local Contracts
 
diff --git a/src/vfs/_vfscommon.vfs/punkshell.ico.assetorigin.toml b/src/vfs/_vfscommon.vfs/punkshell.ico.assetorigin.toml
new file mode 100644
index 00000000..c740ce68
--- /dev/null
+++ b/src/vfs/_vfscommon.vfs/punkshell.ico.assetorigin.toml
@@ -0,0 +1,13 @@
+# assetorigin provenance sidecar (schema 1) for the asset named by this file
+# with the .assetorigin.toml suffix stripped. Optional and advisory.
+# punkshell.ico is a byte-identical derived copy of the generated logo artifact
+# (hash equals source_hash). This sidecar ships inside every baked kit that
+# merges _vfscommon.vfs (user-approved 2026-07-28): inside a kit the recorded
+# source is not present, so a checker truthfully reports source-absent there
+# while still confirming the icon bytes match the record; in the punkshell
+# source tree it verifies.
+schema = 1
+role = "pe-resource"
+hash = "sha256:da875dd08a7665162ead7bbb575e2cb8b82a12d6654579c1e389d97198c19a26"
+source = "../../assets/logo/punk-mark.ico"
+source_hash = "sha256:da875dd08a7665162ead7bbb575e2cb8b82a12d6654579c1e389d97198c19a26"