G-094 achieved: punkcheck single record lifecycle (verification recorded); project 0.17.2

Acceptance verified in full (evidence in the detail file's Progress
section): characterization suites pass with one recorded pin flip,
lifecycle.test pins batch/OO field equivalence (-targets_cksums incl)
and o_record_list coherence across sequential events, the retired-trio
grep is clean, and a full make.tcl build completes with skip/copy
decisions unchanged against pre-refactor .punkcheck state.

Index entry moved to GOALS-archive.md; reference sweep: G-095 notes gain
the chokepoint-achieved pointer, the transient concurrent-save evidence
observed during verification, and the inherited MAX_PATH rider pointer
(G-087/G-094, unaddressed); G-027's punkcheck note updated to achieved
tense. Detail file moves to goals/archive/ in the adjacent commit (pure
rename per the doc-restructure rules).

punkproject.toml 0.17.2 + CHANGELOG entry (punkcheck ships in kits; the
in-shell punkcheck API surface changed with the retirement).

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

CHANGELOG.md

@@ -5,6 +5,10 @@ The latest `## [X.Y.Z]` header must match the `version` field in `punkproject.to
 Entries are newest-first; one bullet per notable change. See the root `AGENTS.md`
 "Project Versioning" section for the bump policy.
 
+## [0.17.2] - 2026-07-21
+
+- punkcheck 0.5.0 (G-094, goal achieved): the installtrack/installevent object layer is the sole implementation of the .punkcheck record lifecycle, with a per-event persistence policy (`start_event ?-persistence eager|deferred?`; deferred updates flush via `$installer flush`, QUERY is never persisted) and a single save chokepoint (installtrack `save_working_recordset` - the G-095 attachment point). `punkcheck::install` is now a tree-walking OO consumer in deferred mode and its records carry the full field set including `-targets_cksums`. The zero-caller legacy proc pipeline (`start_installer_event`, `installfile_begin/started_install/finished_install/skipped_install`) is retired to error shims pointing at `punkcheck::installfile_help` (rewritten for the OO lifecycle). Sequential events on one installtrack no longer clobber prior targetset writes (ending an event now clears the active slot), and several latent bugs are fixed (installer-record `-name` trailing space on flush, event-history timestamp rewrites on reconstruction, `get_recordlist`, `targetset_dict`). Build skip/copy decisions are unchanged against pre-refactor `.punkcheck` state.
+
 ## [0.17.1] - 2026-07-20
 
 - punk::path 0.4.0 (G-093, goal achieved): pathglob syntax gains `***` - as a whole segment it matches ZERO or more path segments, so `X/***` addresses X and everything below it (`***/f.txt` matches at any depth including the root). The directory-pattern lattice (`X` in-dir, `X/*` one below, `X/**` strictly below, `X/***` base-inclusive) is now separable in both directions: an exact or single-segment-glob include match no longer drags the whole subtree in, and non-spanning exclude matches drop only the matched directory's files instead of pruning (only `**`/`***` tails prune - the documented `**/_aside` vs `**/_aside/**` distinction is now real). The legacy bare-`*` match-everything include alias is removed, and the default-nocase drive-letter exception survives glued-group patterns like `c:/***`.

GOALS-archive.md

@@ -124,3 +124,7 @@ Acceptance: from the pinned zig and fetched sources the suite produces a Tk the
 ### G-096 [achieved 2026-07-20] Tracked zig tcl buildsuite (suite_tcl90) with recovered TCLSH_PIPEREPL kit-repl capability → detail: goals/archive/G-096-zig-buildsuite-piperepl.md
 Scope: src/buildsuites/ (suite_tcl90 new; samplesuite1 sketch reconciliation; VCS ignore flip), src/buildsuites/_build/ (untracked build/source area via existing _build globs), .gitignore + .fossil-settings/ignore-glob, src/scriptapps/bin/ (getzig scriptset rename), bin/ (regenerated punk-getzig wrapper twins, old names retired, AGENTS.md naming policy), bin/tools/ (untracked zig toolchains, existing), TEMP_REFERENCE/2024zig (read-only recovery origin)
 Acceptance: from a clean checkout plus a punk-getzig-fetched pinned zig, the suite builds tclsh90s/tclsh90szip from a fresh core-9-0-branch checkout under src/buildsuites/_build with recipe-generated tclUuid.h and tclsh.exe.manifest (no hand-placed files) and the result reports the expected patchlevel; the recovered patch set (piperepl plus the companion tclZipfs/tclCmdIL patches and a notes doc) is tracked in the suite; the rebased piperepl build gates per the G-103 punk-kit policy: with TCLSH_PIPEREPL=0 it behaves identically to the unpatched build on a tty/piped/script-arg matrix, with the gate open (unset or any other value - the default) scripts that never touch ::tclsh(dorepl) still behave stock on the same matrix (script-arg runs default dorepl to 0; unconsumed piped input is buffered in ::tclsh(inputbuffer), not eval'd), and a script setting ::tclsh(dorepl) 1 lands in a live interactive console repl after piped-input eof with the unconsumed input available in ::tclsh(inputbuffer); src/buildsuites is tracked in both VCSes with only _build content ignored and the samplesuite1 vendorbuild-prefix residue reconciled (vendorbuild concept retired); bin/AGENTS.md documents the utility naming policy (punk- prefix for punkshell-own utilities; exceptions: external-tool wrappers such as dtplite/sdx/kettle, and getpunk as the intended future cross-platform entry point) and the getzig scriptset and its bin wrapper twins (getzig.cmd/getzig.ps1) are renamed to punk-getzig with the old names removed and references updated.
+
+### G-094 [achieved 2026-07-21] punkcheck single record lifecycle: OO installtrack as sole implementation with a persistence policy → detail: goals/archive/G-094-punkcheck-single-lifecycle.md
+Scope: src/modules/punkcheck-999999.0a1.0.tm (installtrack/installevent lifecycle unification, installfile_* retirement, punkcheck::install as OO consumer), src/modules/punk/mix/cli-999999.0a1.0.tm + src/make.tcl (consumers verified unchanged), src/tests/modules/punkcheck/testsuites/punkcheck/ (characterization + new equivalence/staleness coverage)
+Acceptance: characterization suites install.test and installtrack.test pass (pins flipped only where this goal's contract deliberately changes behaviour, each flip recorded); a new test pins field equivalence between batch-installed and OO-installed records (including -targets_cksums, which the legacy proc pipeline never stored); a new regression test covers o_record_list coherence - two sequential events on one installtrack instance, with targetset writes in the first event, lose nothing at the second start_event; grep of src/modules, src/make.tcl and src/project_layouts finds no live caller of the retired trio outside shims and tests; a full make.tcl build completes with skip/copy decisions unchanged against pre-refactor .punkcheck state (no spurious recopies of unchanged sources).

GOALS.md

@@ -334,10 +334,6 @@ Detail: goals/G-089-scriptlib-kits-and-modes.md
 Scope: src/modules/shellfilter-999999.0a1.0.tm (stack placement, insert_transform, junctions), src/modules/shellthread-999999.0a1.0.tm (worker park/adoption/termination), src/tests/modules/ (new characterization suites), README.md ('very unripe parts' note)
 Detail: goals/G-090-shellfilter-shellthread-audit.md
 
-### G-094 [active] punkcheck single record lifecycle: OO installtrack as sole implementation with a persistence policy
-Scope: src/modules/punkcheck-999999.0a1.0.tm (installtrack/installevent lifecycle unification, installfile_* retirement, punkcheck::install as OO consumer), src/modules/punk/mix/cli-999999.0a1.0.tm + src/make.tcl (consumers verified unchanged), src/tests/modules/punkcheck/testsuites/punkcheck/ (characterization + new equivalence/staleness coverage)
-Detail: goals/G-094-punkcheck-single-lifecycle.md
-
 ### G-095 [proposed] punkcheck concurrent-writer safety: atomic saves and advisory event-scoped locking
 Scope: src/modules/punkcheck-999999.0a1.0.tm (save/load chokepoint: atomic rename, lockfile protocol, merge-on-flush, non-interactive recovery), src/make.tcl + src/modules/punk/mix/cli-999999.0a1.0.tm (event-scoped lock consumers as verified), src/tests/modules/punkcheck/testsuites/punkcheck/ (new concurrency suite)
 Detail: goals/G-095-punkcheck-concurrent-writer-safety.md

goals/G-027-derived-project-pull-updates.md

@@ -128,12 +128,14 @@ What a pull may touch splits by ownership, not by file type:
 - G-062 (archived) recorded a follow-on relevant here: seeding LICENSE.txt into generated
   project layouts and pulling it into derived projects (deliberately excluded from G-062's
   acceptance) - see goals/archive/G-062-project-license-file.md.
-- punkcheck internals this goal leans on are now goal-tracked (2026-07-19): G-094
-  unifies the record lifecycle on the OO installtrack layer - the pull entrypoint
-  should drive that surface (or the batch punkcheck::install consumer), not the
-  legacy installfile_* pipeline G-094 retires; G-095 adds concurrent-writer
-  safety - a pull writing a derived project's .punkcheck while builds run there
-  is a future instance of exactly its scenario.
+- punkcheck internals this goal leans on: G-094 (achieved 2026-07-21 - see
+  goals/archive/G-094-punkcheck-single-lifecycle.md) unified the record
+  lifecycle on the OO installtrack layer with a per-event persistence policy -
+  the pull entrypoint should drive that surface (or the batch
+  punkcheck::install consumer); the legacy installfile_* pipeline is retired
+  to error shims. G-095 (proposed) adds concurrent-writer safety - a pull
+  writing a derived project's .punkcheck while builds run there is a future
+  instance of exactly its scenario.
 - G-087 (archived - goals/archive/G-087-thin-project-layouts.md) seeded the
   interim provenance carrier this goal's baseline record needs: generated
   projects now carry a root punkorigin.toml (format = 1; [generation] utc,

goals/G-094-punkcheck-single-lifecycle.md

@@ -1,6 +1,6 @@
 # G-094 punkcheck single record lifecycle: OO installtrack as sole implementation with a persistence policy
 
-Status: active
+Status: achieved 2026-07-21
 Scope: src/modules/punkcheck-999999.0a1.0.tm (installtrack/installevent lifecycle unification, installfile_* retirement, punkcheck::install as OO consumer), src/modules/punk/mix/cli-999999.0a1.0.tm + src/make.tcl (consumers verified unchanged), src/tests/modules/punkcheck/testsuites/punkcheck/ (characterization + new equivalence/staleness coverage)
 Goal: The installtrack/installevent OO layer is the only implementation of the .punkcheck record lifecycle (targetset init / add-source / started / end), with an explicit per-event persistence policy - eager per-operation read-modify-write (current OO behaviour) and deferred event-scoped flush (current batch behaviour, QUERY's no-save being the in-object precedent) - punkcheck::install rebuilt as a tree-walking consumer of that layer in deferred mode, the zero-caller legacy pipeline (installfile_begin / installfile_finished_install / installfile_skipped_install) retired to error-with-pointer shims, and every .punkcheck save flowing through a single chokepoint.
 Acceptance: characterization suites install.test and installtrack.test pass (pins flipped only where this goal's contract deliberately changes behaviour, each flip recorded); a new test pins field equivalence between batch-installed and OO-installed records (including -targets_cksums, which the legacy proc pipeline never stored); a new regression test covers o_record_list coherence - two sequential events on one installtrack instance, with targetset writes in the first event, lose nothing at the second start_event; grep of src/modules, src/make.tcl and src/project_layouts finds no live caller of the retired trio outside shims and tests; a full make.tcl build completes with skip/copy decisions unchanged against pre-refactor .punkcheck state (no spurious recopies of unchanged sources).
@@ -89,3 +89,57 @@ lifecycle, not an ad-hoc bypass with its own record code.
 - The characterization suites were written expressly to lock behaviour "before
   any refactoring" - this is that refactoring.
 - punkcheck::cli (status/paths) is a read-only consumer and stays untouched.
+
+## Progress
+
+- 2026-07-21 landed in full (punkcheck 0.5.0; punk::mix::cli 0.5.1 comment-only cleanup;
+  bootsupport re-vendored same day): installtrack/installevent as the sole lifecycle
+  implementation; per-event persistence policy (start_event ?-persistence eager|deferred?;
+  deferred = in-memory working recordset, persisted by an explicit $installer flush; QUERY
+  never persisted in either mode); punkcheck::install rebuilt as a tree-walking OO consumer
+  in deferred mode; legacy proc pipeline (installfile_begin/started_install/finished_install/
+  skipped_install AND start_installer_event) retired to error-with-pointer shims with
+  installfile_help rewritten for the OO lifecycle; single save chokepoint = installtrack
+  method save_working_recordset (the G-095 attachment point); dead targetset class removed.
+- Acceptance verification (2026-07-21, native Tcl 9.0.3 tclsh, Windows 11):
+  - install.test 35/35, installtrack.test 29/29. One pin flipped, recorded in-file: the
+    full-lifecycle test's `$event end` + `$installer end_event` double-end now correctly
+    errors, because ending clears the installtrack's active-event slot (the mechanism that
+    makes sequential events on one instance possible). No real consumer double-ends
+    (cli/make.tcl/commandsets all call `$event end` once - verified by grep).
+  - lifecycle.test (new, 14 tests): batch/OO field equivalence for INSTALL-RECORD and SOURCE
+    records incl equal -targets_cksums; o_record_list coherence (event-1 targetset writes
+    survive the second start_event; event ts_begin preserved through flush); deferred
+    no-write-until-flush and unflushed-discard semantics; QUERY leaves no on-disk FILEINFO;
+    all five retirement shims error with pointer; get_recordlist and targetset_dict fixes.
+  - Retired-trio grep over src/modules, src/make.tcl, src/project_layouts: only the module's
+    own shims match.
+  - Full build: `make.tcl modules` x2 plus a full `make.tcl project` under the re-vendored
+    bootsupport punkcheck 0.5.0 complete exit 0 with skip/copy decisions unchanged against
+    pre-refactor .punkcheck state - copied: 0 on every batch phase (modules, modules_tcl8/9,
+    libs, vfs syncs, layout syncs), kit installs skip 'no change detected'; the sole punk905
+    kit rebuild traces to the newly promoted tclsh905 runtime (a genuinely changed source
+    from the parallel G-102 session, not a spurious recopy).
+- Additional latent fixes surfaced by the unification (beyond the two named in Context):
+  installtrack as_record wrote -name with a trailing space via a stray escaped-space
+  backslash, breaking by-name installer lookup after any flush/save_installer_record; event
+  reconstruction in the installtrack constructor passed raw record fields so -tsbegin/-tsend
+  fell to defaults (a flush would have rewritten prior event history timestamps with 'now'
+  and empty ends). Both fixed and pinned by lifecycle.test.
+- Deliberate contract deltas beyond the headline unification (all recorded in the punkcheck
+  0.5.0 buildversion changelog): QUERY targetset_started now sets -metadata_us like other
+  operations; all-targets batch installs now store -targets_cksums (previously only
+  non-all-targets copies did - enables later synced-targets use); batch install records gain
+  -metadata_us/-ts_start_transfer/-transfer_us/-cksum_us (field parity with OO records);
+  recordlist::extract_or_create_fileset_record no longer prints to stdout (isnew returned;
+  targetset_init reports via debugchannel, and punkcheck::install preserves its
+  progresschannel-gated announcement); an explicitly empty -punkcheck-folder now errors
+  early instead of failing later in path relativization; -punkcheck-records is
+  accepted-but-ignored (pre-G-094 behaviour already replaced it at depth 0); the
+  installedsourcechanged copy print no longer emits a duplicate '(cksum time)' using the
+  copy timing.
+- Observed during verification (G-095 evidence): one transient save failure
+  (targetset_init -> save_working_recordset traceback) on the first post-re-vendor build
+  run, with a second session concurrently active in the same checkout; not reproducible -
+  two subsequent full runs clean, exit 0. Exactly the concurrent-writer exposure G-095's
+  locking/atomic-rename measures target, now funnelled through the single chokepoint.

goals/G-095-punkcheck-concurrent-writer-safety.md

@@ -35,8 +35,11 @@ user + agent).
 
 ## Approach
 
-- Depends on G-094's single save chokepoint - lock, atomic rename and
-  merge-on-flush are implemented once there, inherited by every path.
+- Builds on G-094's single save chokepoint (achieved 2026-07-21 - see
+  goals/archive/G-094-punkcheck-single-lifecycle.md): every record-lifecycle
+  write now funnels through installtrack method save_working_recordset - lock,
+  atomic rename and merge-on-flush are implemented once there, inherited by
+  every path (eager per-op saves, start_event registration, deferred flush).
 - Lock scope: the whole installer event (start_event through final
   flush/end; batch install = the whole depth-0 call), sibling lockfile
   `.punkcheck.lock` in the punkcheck folder.
@@ -83,7 +86,19 @@ user + agent).
   recovery; locking does not make the file precious.
 - The installtrack constructor's deletion prompt ("It is safe to delete
   .punkcheck files...") oversells for synced-targets consumers - add the
-  wedge caveat to that message when it is touched under G-094/G-095.
+  wedge caveat to that message when it is touched under this goal (G-094
+  landed without touching it).
+- G-094 (archived) recorded direct evidence for this goal during its
+  verification: one transient targetset_init -> save_working_recordset save
+  failure on the first post-re-vendor build with a second session active in
+  the same checkout (not reproducible; subsequent runs clean) - see the
+  Progress section of goals/archive/G-094-punkcheck-single-lifecycle.md.
+- G-094 (archived) carried the punkcheck MAX_PATH candidate as a load/save
+  consolidation rider (deep relative source chains exceed Windows path
+  limits, unnormalized - first recorded by G-087) and did NOT address it;
+  this goal's chokepoint work is the next natural carrier - see
+  goals/archive/G-094-punkcheck-single-lifecycle.md and
+  goals/archive/G-087-thin-project-layouts.md.
 - Advisory protocol is only effective once all writers carry it - re-vendor
   bootsupport immediately after landing; the signature tripwire covers the
   transition window.

punkproject.toml

@@ -1,4 +1,4 @@
 [project]
 name = "punkshell"
-version = "0.17.1"
+version = "0.17.2"
 license = "BSD-2-Clause"