diff --git a/.fossil-settings/ignore-glob b/.fossil-settings/ignore-glob
index cd0c2940..a89e91cf 100644
--- a/.fossil-settings/ignore-glob
+++ b/.fossil-settings/ignore-glob
@@ -48,6 +48,9 @@ src/scriptapps/test_*
 #G-115 demonstration kit payload - materialized from src/vfs/punkdeclare.vfs.toml, never committed
 src/vfs/punkdeclare.vfs/lib_tcl9
 
+#G-127 per-platform payload staging - materialized from %platform% entries in src/vfs/<name>.vfs.toml, never committed
+src/vfs/*.vfs/_targets
+
 #review
 src/docgen
 
diff --git a/.gitignore b/.gitignore
index 2e39ee5a..79773aaa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,6 +49,11 @@ scratch*
 #declaration is the point, so it is never committed
 /src/vfs/punkdeclare.vfs/lib_tcl9/
 
+#G-127 per-platform payload staging - materialized from %platform% entries in
+#src/vfs/<name>.vfs.toml (one subtree per consuming kit target) and selected into
+#each kit's merged image at bake time; regenerable staging, never committed
+/src/vfs/*.vfs/_targets/
+
 #review
 /src/docgen
 
diff --git a/goals/G-127-crosstarget-vfs-bake.md b/goals/G-127-crosstarget-vfs-bake.md
index 8dfc50c5..97fbfe4a 100644
--- a/goals/G-127-crosstarget-vfs-bake.md
+++ b/goals/G-127-crosstarget-vfs-bake.md
@@ -224,11 +224,34 @@ exists locally (empty but for sha1sums.txt) and punkbin upstream carries
   bake; their old flat bin copies become the same class of orphan. (G-129
   achieved - see goals/archive/G-129-kitboot-mountpoint-derivation.md; the kits
   stay active per their mapvfs group description.)
-- Remaining for acceptance: per-target payload declaration axis on the G-115
-  .vfs.toml surface + punk9linux.vfs migrated-or-recorded; two-target one-vfs
-  characterization via the PUNK_MAPVFS_CONFIG seam (one-run distinct artifacts,
-  cross-run no-overwrite, two-non-native coexistence, mismatch-report regression
-  pin per the G-133 redundancy note); byte-comparability spot-check for a
-  zip-type native kit; existing punkexe suites pass as a set; bin/AGENTS.md +
-  src/AGENTS.md output-location docs; G-023 reconciliation statement recorded
-  here; punkshell902 + win32-ix86 relocation records finalized.
+- 2026-07-31 increment 2 (per-target payload axis, VFSPAYLOAD + kit loop):
+  a payload 'source' containing %platform% is a PER-PLATFORM entry - the platform
+  set is DERIVED from the kit mapping (every mapvfs kit output pairing the vfs,
+  bake_default included; PUNK_MAPVFS_CONFIG honoured via mapvfs_locate), never
+  declared twice. Each platform's copy materializes punkcheck-tracked under
+  _targets/<platform>/<target>/ in the .vfs folder (VCS-ignored staging - rules
+  added to .gitignore + .fossil-settings/ignore-glob); at bake time the kit's
+  merged image gets ONLY its own target's subtree (selection overlay upstream of
+  the arch scan and G-125 gate, staging dropped from the image; missing
+  _targets/<kit target> in a staged vfs earns a recapped BUILD-WARNING).
+  supersedes/replace apply within each platform subtree; %platform% in 'target'
+  is rejected (staging prefix is implicit); a %platform% entry on an unconsumed
+  vfs warns and skips. Spec extended in src/vfs/README.md. MIGRATION: the
+  punk9linux.vfs tcllibc entry now reads source = "%platform%/tcl9/tcllibc"
+  (was hardcoded linux-x86_64) and the flat COMMITTED lib_tcl9/tcllibc tree was
+  removed from both VCS (declaration + packages tier govern it; committed-binary
+  reduction in the G-004 direction). Verified live: bake punkshell902 stages
+  _targets/linux-x86_64, selects it into the image (lib_tcl9/tcllibc present,
+  no _targets residue, arch scan 6 scanned/6 match - same composition as the
+  pre-axis bake), deploys to bin/kits/linux-x86_64/; bake punkdeclare
+  (platform-neutral entries) unchanged, smoke probe resolves udp 1.0.13 +
+  tcllibc 2.0 from the freshly built native artifact.
+- Remaining for acceptance: two-target one-vfs characterization via the
+  PUNK_MAPVFS_CONFIG seam (one-run distinct artifacts, cross-run no-overwrite,
+  two-non-native coexistence, per-target payload selection, mismatch-report
+  regression pin per the G-133 redundancy note); byte-comparability spot-check
+  for a zip-type native kit; existing punkexe suites pass as a set;
+  bin/AGENTS.md + src/AGENTS.md output-location docs; G-023 reconciliation
+  statement recorded here; punkshell902 + win32-ix86 relocation records
+  finalized; punk9linux.vfs remaining drop-ins (tcltls/tdom/thread .so)
+  recorded as deliberately hand-curated or migrated.
diff --git a/src/make.tcl b/src/make.tcl
index b0259b48..eb38c51c 100644
--- a/src/make.tcl
+++ b/src/make.tcl
@@ -6194,6 +6194,9 @@ if {$::punkboot::command in {bakehouse bake vfslibs}} {
     #'make.tcl libfetch'), target (folder path INSIDE the .vfs, e.g "lib_tcl9";
     #default the .vfs root), supersedes (explicit legacy sibling folder removals),
     #replace (boolean clean-slate of the SAME-NAMED target folder before install).
+    #A source containing %platform% is a PER-PLATFORM entry (G-127): one copy per
+    #consuming kit target (derived from the kit mapping below), staged under
+    #_targets/<platform>/ and selected into each kit's merged image at bake time.
     #Materialization is punkcheck-tracked (records in src/vfs/.punkcheck, outside kit
     #payloads) with -overwrite synced-targets: a target file punkcheck did not install,
     #or that changed since it was installed (a drop-in or hand edit), is PRESERVED and
@@ -6211,6 +6214,29 @@ if {$::punkboot::command in {bakehouse bake vfslibs}} {
     if {![llength $payload_files]} {
         puts stdout "VFSPAYLOAD: no per-.vfs payload declarations (src/vfs/<name>.vfs.toml) - nothing to materialize"
     }
+    #G-127 per-platform payload derivation: a payload source containing %platform%
+    #declares ONE payload materialized per CONSUMING KIT TARGET - the platform set
+    #is derived from the kit mapping (every mapvfs kit output pairing this vfs,
+    #whatever its bake_default), never declared a second time in the payload file.
+    #Each platform's copy lands under _targets/<platform>/<target>/ inside the .vfs
+    #folder (VCS-ignored staging); the bake selects the consuming kit's subtree
+    #into its merged image and drops the staging tree, so an assembled kit carries
+    #only its own target's payload.
+    set vfspayload_kit_targets [dict create]
+    if {[llength $payload_files]} {
+        set _pmapmodel [punkboot::lib::mapvfs_parse [punkboot::lib::mapvfs_locate $sourcefolder/runtime] $binfolder/runtime $sourcefolder $::punkboot::target_platform]
+        if {[llength [dict get $_pmapmodel configerrors]]} {
+            puts stderr "WARNING: VFSPAYLOAD: kit-mapping config errors - per-platform (%platform%) payload derivation unavailable this run (the mapping's own gates report the errors)"
+        } else {
+            foreach _prec [punkboot::lib::mapvfs_kit_outputs $_pmapmodel $binfolder/runtime $sourcefolder] {
+                if {![dict exists $vfspayload_kit_targets [dict get $_prec vfs]]
+                    || [dict get $_prec target] ni [dict get $vfspayload_kit_targets [dict get $_prec vfs]]} {
+                    dict lappend vfspayload_kit_targets [dict get $_prec vfs] [dict get $_prec target]
+                }
+            }
+        }
+        unset -nocomplain _pmapmodel _prec
+    }
     foreach ptail $payload_files {
         set pfile $sourcefolder/vfs/$ptail
         set vfstail [file rootname $ptail] ;#punkdeclare.vfs.toml -> punkdeclare.vfs
@@ -6274,74 +6300,106 @@ if {$::punkboot::command in {bakehouse bake vfslibs}} {
                 puts stderr "$A(BAD)VFSPAYLOAD: entry $entrylabel is missing required key 'source'$A(RST)"
                 exit 3
             }
-            switch -- $isource_root {
-                src {
-                    set source_pkg_folder $sourcefolder/$isource
-                    set source_missing_hint ""
-                }
-                packages {
-                    set source_pkg_folder $projectroot/bin/packages/$isource
-                    set source_missing_hint " - populate the bin/packages tier first: 'tclsh src/make.tcl libfetch' (declarations in src/runtime/libpackages.toml)"
-                }
-                default {
-                    puts stderr "$A(BAD)VFSPAYLOAD: entry $entrylabel has unknown source_root '$isource_root' (expected src|packages)$A(RST)"
-                    exit 3
-                }
-            }
-            if {![file isdirectory $source_pkg_folder]} {
-                puts stderr "$A(BAD)VFSPAYLOAD: entry $entrylabel source '$isource' not found at $source_pkg_folder$source_missing_hint$A(RST)"
-                exit 3
-            }
             if {$itarget ne "" && ([file pathtype $itarget] ne "relative" || ".." in [file split $itarget])} {
                 puts stderr "$A(BAD)VFSPAYLOAD: entry $entrylabel target '$itarget' must be a relative path inside the .vfs folder (no '..')$A(RST)"
                 exit 3
             }
-            set pkgtail [file tail $source_pkg_folder]
-            if {$itarget eq ""} {
-                set target_lib_folder $sourcefolder/vfs/$vfstail
-                set target_display vfs/$vfstail
+            #G-127 per-platform axis: %platform% in 'source' selects the payload per
+            #consuming kit target (set derived above); 'target' stays literal - its
+            #per-platform staging prefix (_targets/<platform>/) is implicit.
+            if {[string match *%platform%* $itarget]} {
+                puts stderr "$A(BAD)VFSPAYLOAD: entry $entrylabel: 'target' must not contain %platform% - the per-platform staging prefix (_targets/<platform>/) is implicit for a %platform% source$A(RST)"
+                exit 3
+            }
+            if {[string match *%platform%* $isource]} {
+                if {![dict exists $vfspayload_kit_targets $vfstail]
+                    || ![llength [dict get $vfspayload_kit_targets $vfstail]]} {
+                    puts stderr "WARNING: VFSPAYLOAD entry $entrylabel declares a per-platform source (%platform%) but no kit in the mapping consumes $vfstail - no platform set to derive, entry skipped"
+                    continue
+                }
+                set entry_platforms [dict get $vfspayload_kit_targets $vfstail]
             } else {
-                set target_lib_folder $sourcefolder/vfs/$vfstail/$itarget
-                set target_display vfs/$vfstail/$itarget
+                set entry_platforms [list ""] ;#platform-neutral entry - materialize once, directly in the folder
             }
-            file mkdir $target_lib_folder
-            #supersession first - no silent mixed-version provision (G-035 concerns)
-            foreach sup $isupersedes {
-                if {$sup eq $pkgtail} {
-                    continue ;#never remove what we are about to install - use replace for that
+            foreach eplatform $entry_platforms {
+                if {$eplatform eq ""} {
+                    set esource $isource
+                    set elabel  $entrylabel
+                    set evfsprefix ""
+                } else {
+                    set esource [string map [list %platform% $eplatform] $isource]
+                    set elabel  "$entrylabel \[$eplatform\]"
+                    set evfsprefix _targets/$eplatform
+                }
+                switch -- $isource_root {
+                    src {
+                        set source_pkg_folder $sourcefolder/$esource
+                        set source_missing_hint ""
+                    }
+                    packages {
+                        set source_pkg_folder $projectroot/bin/packages/$esource
+                        set source_missing_hint " - populate the bin/packages tier first: 'tclsh src/make.tcl libfetch' (declarations in src/runtime/libpackages.toml)"
+                    }
+                    default {
+                        puts stderr "$A(BAD)VFSPAYLOAD: entry $elabel has unknown source_root '$isource_root' (expected src|packages)$A(RST)"
+                        exit 3
+                    }
                 }
-                set suppath $target_lib_folder/$sup
-                if {[file exists $suppath]} {
-                    puts stdout "VFSPAYLOAD $entrylabel: removing superseded '$sup' from $target_display"
-                    file delete -force $suppath
+                if {![file isdirectory $source_pkg_folder]} {
+                    puts stderr "$A(BAD)VFSPAYLOAD: entry $elabel source '$esource' not found at $source_pkg_folder$source_missing_hint$A(RST)"
+                    exit 3
                 }
-            }
-            if {$ireplace && [file isdirectory $target_lib_folder/$pkgtail]} {
-                puts stdout "VFSPAYLOAD $entrylabel: replace=true - removing existing '$pkgtail' from $target_display (clean-slate install)"
-                file delete -force $target_lib_folder/$pkgtail
-            }
-            puts stdout "VFSPAYLOAD $entrylabel: $isource_root:$isource -> $target_display/$pkgtail (if source changed; drop-ins/hand-edits preserved)"
-            set resultdict [punkcheck::install $source_pkg_folder $target_lib_folder/$pkgtail\
-                -installer make.tcl\
-                -createdir 1\
-                -overwrite synced-targets\
-                -punkcheck-folder $sourcefolder/vfs\
-                -progresschannel stdout\
-            ]
-            puts stdout [punkcheck::summarize_install_resultdict $resultdict]
-            #preserved-collision report: a file skipped although its SOURCE changed was
-            #withheld by synced-targets (a drop-in, or hand-modified since install) -
-            #distinct from the routine source-unchanged skips.
-            set _preserved [list]
-            foreach _sk [dict get $resultdict files_skipped] {
-                if {$_sk ni [dict get $resultdict sources_unchanged]} {
-                    lappend _preserved $_sk
+                set pkgtail [file tail $source_pkg_folder]
+                set etarget_subpath $itarget
+                if {$evfsprefix ne ""} {
+                    set etarget_subpath [expr {$itarget eq "" ? $evfsprefix : "$evfsprefix/$itarget"}]
                 }
+                if {$etarget_subpath eq ""} {
+                    set target_lib_folder $sourcefolder/vfs/$vfstail
+                    set target_display vfs/$vfstail
+                } else {
+                    set target_lib_folder $sourcefolder/vfs/$vfstail/$etarget_subpath
+                    set target_display vfs/$vfstail/$etarget_subpath
+                }
+                file mkdir $target_lib_folder
+                #supersession first - no silent mixed-version provision (G-035 concerns)
+                foreach sup $isupersedes {
+                    if {$sup eq $pkgtail} {
+                        continue ;#never remove what we are about to install - use replace for that
+                    }
+                    set suppath $target_lib_folder/$sup
+                    if {[file exists $suppath]} {
+                        puts stdout "VFSPAYLOAD $elabel: removing superseded '$sup' from $target_display"
+                        file delete -force $suppath
+                    }
+                }
+                if {$ireplace && [file isdirectory $target_lib_folder/$pkgtail]} {
+                    puts stdout "VFSPAYLOAD $elabel: replace=true - removing existing '$pkgtail' from $target_display (clean-slate install)"
+                    file delete -force $target_lib_folder/$pkgtail
+                }
+                puts stdout "VFSPAYLOAD $elabel: $isource_root:$esource -> $target_display/$pkgtail (if source changed; drop-ins/hand-edits preserved)"
+                set resultdict [punkcheck::install $source_pkg_folder $target_lib_folder/$pkgtail\
+                    -installer make.tcl\
+                    -createdir 1\
+                    -overwrite synced-targets\
+                    -punkcheck-folder $sourcefolder/vfs\
+                    -progresschannel stdout\
+                ]
+                puts stdout [punkcheck::summarize_install_resultdict $resultdict]
+                #preserved-collision report: a file skipped although its SOURCE changed was
+                #withheld by synced-targets (a drop-in, or hand-modified since install) -
+                #distinct from the routine source-unchanged skips.
+                set _preserved [list]
+                foreach _sk [dict get $resultdict files_skipped] {
+                    if {$_sk ni [dict get $resultdict sources_unchanged]} {
+                        lappend _preserved $_sk
+                    }
+                }
+                if {[llength $_preserved]} {
+                    puts stdout "VFSPAYLOAD $elabel: NOTE - [llength $_preserved] changed file(s) NOT overwritten (existing target content was not installed by this mechanism, or was modified since) - the G-115 drop-in-wins precedence. Declare 'replace = true' (whole package folder) or remove the target files to hand control to the declaration."
+                }
+                unset -nocomplain _preserved _sk
             }
-            if {[llength $_preserved]} {
-                puts stdout "VFSPAYLOAD $entrylabel: NOTE - [llength $_preserved] changed file(s) NOT overwritten (existing target content was not installed by this mechanism, or was modified since) - the G-115 drop-in-wins precedence. Declare 'replace = true' (whole package folder) or remove the target files to hand control to the declaration."
-            }
-            unset -nocomplain _preserved _sk
         }
     }
 }
@@ -8396,6 +8454,26 @@ foreach vfstail $vfs_tails {
                 set sourcevfs [file join $sourcefolder vfs $vfstail]
                 merge_over $sourcevfs $targetvfs
 
+                #G-127 per-platform payload selection: the VFSPAYLOAD phase stages
+                #%platform% payload entries under _targets/<platform>/ in the .vfs
+                #folder (one subtree per consuming kit target), and the merge above
+                #carried that staging tree into the image. Select THIS kit's target
+                #subtree into the image root and drop the staging tree, so the
+                #assembled kit carries only its own target's payload - upstream of
+                #the arch scan and the G-125 gate, which must judge the final tree.
+                if {[file isdirectory $targetvfs/_targets]} {
+                    set _pstaging ${targetvfs}._targets_staging
+                    file delete -force $_pstaging
+                    file rename $targetvfs/_targets $_pstaging
+                    if {[file isdirectory $_pstaging/$rt_target]} {
+                        puts stdout "    per-platform payload (G-127): selecting _targets/$rt_target into the merged image for kit $targetkit"
+                        merge_over $_pstaging/$rt_target $targetvfs
+                    } else {
+                        ::punkboot::print_build_warnings [list "per-platform payload (G-127): kit $targetkit (target $rt_target) - the merged vfs has a _targets/ staging tree but no _targets/$rt_target subtree, so this kit gets NO per-platform payload (check the %platform% declarations in src/vfs/$vfstail.toml against the kit's mapvfs target)"]
+                    }
+                    file delete -force $_pstaging
+                }
+
                 #G-133 advisory payload/target binary-arch scan, at the same post-merge
                 #seam as the G-125 gate below. Structural (header bytes only, nothing
                 #executed), so it runs for every kit including cross-target ones. A
diff --git a/src/vfs/README.md b/src/vfs/README.md
index d590715a..d122e820 100644
--- a/src/vfs/README.md
+++ b/src/vfs/README.md
@@ -37,6 +37,33 @@ replace     = true         # optional: clean-slate the SAME-NAMED target folder
 - `target` must be a relative path inside the `.vfs` folder (no `..`).
 - Unknown keys, missing sources, or an unparseable file fail the build naming the entry.
 
+### Per-platform entries (G-127)
+
+A `source` containing `%platform%` declares ONE payload selected per consuming kit
+TARGET - the platform set is derived from the kit mapping (`src/runtime/mapvfs.toml`:
+every kit output pairing this vfs, whatever its `bake_default`), never declared a second
+time in the payload file:
+
+```toml
+[payload.tcllibc]
+source_root = "packages"
+source      = "%platform%/tcl9/tcllibc"   # resolved once per consuming kit target
+target      = "lib_tcl9"
+```
+
+- Each platform's copy materializes under `_targets/<platform>/<target>/` inside the
+  `.vfs` folder - VCS-ignored staging (both VCS), regenerable from the declaration.
+- At bake time the kit's merged image gets ONLY its own target's subtree: the staging
+  tree is selected (`_targets/<kit target>/` overlaid onto the image root) and dropped,
+  upstream of the payload arch scan and the G-125 boot gate.
+- `supersedes`/`replace` apply within each platform's staging subtree; `target` must not
+  itself contain `%platform%` (the staging prefix is implicit).
+- A `%platform%` entry on a vfs no kit mapping consumes has no platform set to derive -
+  it warns and is skipped. A missing per-platform source fails the build naming the
+  entry and platform, exactly like any missing source.
+- Stale staging for a target no longer in the mapping is left in place (drop-in-wins
+  posture) - it never reaches an image; delete `_targets/<platform>/` by hand to tidy.
+
 ### Precedence (drop-in wins)
 
 Materialization is punkcheck-tracked (records in `src/vfs/.punkcheck`, outside kit
diff --git a/src/vfs/punk9linux.vfs.toml b/src/vfs/punk9linux.vfs.toml
index 4cfac05c..5ef55d9e 100644
--- a/src/vfs/punk9linux.vfs.toml
+++ b/src/vfs/punk9linux.vfs.toml
@@ -3,8 +3,8 @@
 # precedence rules: src/vfs/README.md. punkcheck-tracked (records in src/vfs/.punkcheck).
 # Migrated 2026-07-31 from the per-package src/runtime/vendorlib_vfs.toml surface (G-037/G-139).
 
-# G-139/G-140: platform-neutral tcllib plus this linux-target kit's OWN tcllibc from the
-# linux-x86_64 tier (the suite_tcl90 tcllibc-linux cross build). replace retires the
+# G-139/G-140: platform-neutral tcllib plus each consuming kit target's OWN tcllibc from
+# that platform's packages tier (the suite lib-tier builds). replace retires the
 # provenance-less hand-dropped tcllibc; supersedes removes the stray-named tcllibc2.0.
 [payload.tcllib]
 source_root = "packages"
@@ -12,9 +12,14 @@ source = "allplatforms/tcl9/tcllib2.0"
 target = "lib_tcl9"
 replace = true
 
+# G-127 per-platform entry: %platform% resolves per consuming kit target (today
+# linux-x86_64 via [kit.punkshell902]; a freebsd kit of this vfs would add its own
+# platform automatically once its packages tier is fetched). Staged under
+# _targets/<platform>/lib_tcl9/ and selected into the kit image at bake time - the
+# flat committed lib_tcl9/tcllibc copy was removed with this migration.
 [payload.tcllibc]
 source_root = "packages"
-source = "linux-x86_64/tcl9/tcllibc"
+source = "%platform%/tcl9/tcllibc"
 target = "lib_tcl9"
 replace = true
 supersedes = ["tcllibc2.0"]
diff --git a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/critcl-rt.tcl b/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/critcl-rt.tcl
deleted file mode 100644
index 84c74113..00000000
--- a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/critcl-rt.tcl
+++ /dev/null
@@ -1,386 +0,0 @@
-#
-#   Critcl - build C extensions on-the-fly
-#
-#   Copyright (c) 2001-2007 Jean-Claude Wippler
-#   Copyright (c) 2002-2007 Steve Landers
-#
-#   See http://wiki.tcl.tk/critcl
-#
-#   This is the Critcl runtime that loads the appropriate
-#   shared library when a package is requested
-#
-
-namespace eval ::critcl::runtime {}
-
-proc ::critcl::runtime::loadlib {dir package version libname initfun tsrc mapping args} {
-    # XXX At least parts of this can be done by the package generator,
-    # XXX like listing the Tcl files to source. The glob here allows
-    # XXX code-injection after-the-fact, by simply adding a .tcl in
-    # XXX the proper place.
-    set path [file join $dir [MapPlatform $mapping]]
-    set ext [info sharedlibextension]
-    set lib [file join $path $libname$ext]
-    set provide [list]
-
-    # Now the runtime equivalent of a series of 'preFetch' commands.
-    if {[llength $args]} {
-	set preload [file join $path preload$ext]
-	foreach p $args {
-	    set prelib [file join $path $p$ext]
-	    if {[file readable $preload] && [file readable $prelib]} {
-		lappend provide [list load $preload];# XXX Move this out of the loop, do only once.
-		lappend provide [list ::critcl::runtime::preload $prelib]
-	    }
-	}
-    }
-
-    lappend provide [list load $lib $initfun]
-    foreach t $tsrc {
-	lappend loadcmd "::critcl::runtime::Fetch \$dir [list $t]"
-    }
-    lappend provide "package provide $package $version"
-    package ifneeded $package $version [join $provide "\n"]
-    return
-}
-
-proc ::critcl::runtime::preFetch {path ext dll} {
-    set preload [file join $path preload$ext]
-    if {![file readable $preload]} return
-
-    set prelib [file join $path $dll$ext]
-    if {![file readable $prelib]} return
-
-    load $preload ; # Defines next command.
-    ::critcl::runtime::preload $prelib
-    return
-}
-
-proc ::critcl::runtime::Fetch {dir t} {
-    # The 'Ignore' disables compile & run functionality.
-
-    # Background: If the regular critcl package is already loaded, and
-    # this prebuilt package uses its defining .tcl file also as a
-    # 'tsources' then critcl might try to collect data and build it
-    # because of the calls to its API, despite the necessary binaries
-    # already being present, just not in the critcl cache. That is
-    # redundant in the best case, and fails in the worst case (no
-    # compiler), preventing the use o a perfectly fine package. The
-    # 'ignore' call now tells critcl that it should ignore any calls
-    # made to it by the sourced files, and thus avoids that trouble.
-
-    # The other case, the regular critcl package getting loaded after
-    # this prebuilt package is irrelevant. At that point the tsources
-    # were already run, and used the dummy procedures defined in the
-    # critcl-rt.tcl, which ignore the calls by definition.
-
-    set t [file join $dir tcl $t]
-    ::critcl::Ignore $t
-    uplevel #0 [list source $t]
-    return
-}
-
-proc ::critcl::runtime::precopy {dll} {
-    # This command is only used on Windows when preloading out of a
-    # VFS that doesn't support direct loading (usually, a Starkit)
-    #   - we preserve the dll name so that dependencies are satisfied
-    #	- The critcl::runtime::preload command is defined in the supporting
-    #     "preload" package, implemented in "critcl/lib/critcl/critcl_c/preload.c"
-
-    global env
-    if {[info exists env(TEMP)]} {
-	set dir $env(TEMP)
-    } elseif {[info exists env(TMP)]} {
-	set dir $env(TMP)
-    } elseif {[file exists $env(HOME)]} {
-	set dir $env(HOME)
-    } else {
-	set dir .
-    }
-    set dir [file join $dir TCL[pid]]
-    set i 0
-    while {[file exists $dir]} {
-	append dir [incr i]
-    }
-    set new [file join $dir [file tail $dll]]
-    file mkdir $dir
-    file copy $dll $new
-    return $new
-}
-
-proc ::critcl::runtime::MapPlatform {{mapping {}}} {
-    # A sibling of critcl::platform that applies the platform mapping
-
-    set platform [::platform::generic]
-    set version $::tcl_platform(osVersion)
-    if {[string match "macosx-*" $platform]} {
-	# "normalize" the osVersion to match OSX release numbers
-	set v [split $version .]
-	set v1 [lindex $v 0]
-	set v2 [lindex $v 1]
-	incr v1 -4
-	set version 10.$v1.$v2
-    } else {
-	# Strip trailing non-version info
-	regsub -- {-.*$} $version {} version
-    }
-    foreach {config map} $mapping {
-	if {![string match $config $platform]} continue
-	set minver [lindex $map 1]
-	if {[package vcompare $version $minver] < 0} continue
-	set platform [lindex $map 0]
-	break
-    }
-    return $platform
-}
-
-# Dummy implementation of the critcl package, if not present
-if {![llength [info commands ::critcl::Ignore]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::Ignore {args} {
-		namespace eval ::critcl::v {}
-		set ::critcl::v::ignore([file normalize [lindex $args 0]]) .
-	    }
-}
-if {![llength [info commands ::critcl::api]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::api {args} {}
-}
-if {![llength [info commands ::critcl::at]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::at {args} {}
-}
-if {![llength [info commands ::critcl::cache]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::cache {args} {}
-}
-if {![llength [info commands ::critcl::ccode]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::ccode {args} {}
-}
-if {![llength [info commands ::critcl::ccommand]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::ccommand {args} {}
-}
-if {![llength [info commands ::critcl::cdata]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::cdata {args} {}
-}
-if {![llength [info commands ::critcl::cdefines]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::cdefines {args} {}
-}
-if {![llength [info commands ::critcl::cflags]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::cflags {args} {}
-}
-if {![llength [info commands ::critcl::cheaders]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::cheaders {args} {}
-}
-if {![llength [info commands ::critcl::check]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::check {args} {return 0}
-}
-if {![llength [info commands ::critcl::cinit]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::cinit {args} {}
-}
-if {![llength [info commands ::critcl::clibraries]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::clibraries {args} {}
-}
-if {![llength [info commands ::critcl::compiled]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::compiled {args} {return 1}
-}
-if {![llength [info commands ::critcl::compiling]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::compiling {args} {return 0}
-}
-if {![llength [info commands ::critcl::config]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::config {args} {}
-}
-if {![llength [info commands ::critcl::cproc]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::cproc {args} {}
-}
-if {![llength [info commands ::critcl::csources]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::csources {args} {}
-}
-if {![llength [info commands ::critcl::debug]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::debug {args} {}
-}
-if {![llength [info commands ::critcl::done]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::done {args} {return 1}
-}
-if {![llength [info commands ::critcl::failed]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::failed {args} {return 0}
-}
-if {![llength [info commands ::critcl::framework]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::framework {args} {}
-}
-if {![llength [info commands ::critcl::include]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::include {args} {}
-}
-if {![llength [info commands ::critcl::ldflags]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::ldflags {args} {}
-}
-if {![llength [info commands ::critcl::license]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::license {args} {}
-}
-if {![llength [info commands ::critcl::load]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::load {args} {return 1}
-}
-if {![llength [info commands ::critcl::make]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::make {args} {}
-}
-if {![llength [info commands ::critcl::meta]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::meta {args} {}
-}
-if {![llength [info commands ::critcl::platform]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::platform {args} {}
-}
-if {![llength [info commands ::critcl::preload]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::preload {args} {}
-}
-if {![llength [info commands ::critcl::source]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::source {args} {}
-}
-if {![llength [info commands ::critcl::tcl]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::tcl {args} {}
-}
-if {![llength [info commands ::critcl::tk]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::tk {args} {}
-}
-if {![llength [info commands ::critcl::tsources]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::tsources {args} {}
-}
-if {![llength [info commands ::critcl::userconfig]]} {
-    namespace eval ::critcl {}
-    proc ::critcl::userconfig {args} {}
-}
-
-# Define a clone of platform::generic, if needed
-if {![llength [info commands ::platform::generic]]} {
-    namespace eval ::platform {}
-    proc ::platform::generic {} {
-        global tcl_platform
-    
-        set plat [string tolower [lindex $tcl_platform(os) 0]]
-        set cpu  $tcl_platform(machine)
-    
-        switch -glob -- $cpu {
-    	sun4* {
-    	    set cpu sparc
-    	}
-    	intel -
-    	ia32* -
-    	i*86* {
-    	    set cpu ix86
-    	}
-    	x86_64 {
-    	    if {$tcl_platform(wordSize) == 4} {
-    		# See Example <1> at the top of this file.
-    		set cpu ix86
-    	    }
-    	}
-    	ppc -
-    	"Power*" {
-    	    set cpu powerpc
-    	}
-    	"arm*" {
-    	    set cpu arm
-    	}
-    	ia64 {
-    	    if {$tcl_platform(wordSize) == 4} {
-    		append cpu _32
-    	    }
-    	}
-        }
-    
-        switch -glob -- $plat {
-    	windows {
-    	    if {$tcl_platform(platform) eq "unix"} {
-    		set plat cygwin
-    	    } else {
-    		set plat win32
-    	    }
-    	    if {$cpu eq "amd64"} {
-    		# Do not check wordSize, win32-x64 is an IL32P64 platform.
-    		set cpu x86_64
-    	    }
-    	}
-    	sunos {
-    	    set plat solaris
-    	    if {[string match "ix86" $cpu]} {
-    		if {$tcl_platform(wordSize) == 8} {
-    		    set cpu x86_64
-    		}
-    	    } elseif {![string match "ia64*" $cpu]} {
-    		# sparc
-    		if {$tcl_platform(wordSize) == 8} {
-    		    append cpu 64
-    		}
-    	    }
-    	}
-    	darwin {
-    	    set major [lindex [split $tcl_platform(osVersion) .] 0]
-    	    if {$major > 19} {
-    		set plat macos
-    	    } else {
-    		set plat macosx
-    	    }
-    	    # Correctly identify the cpu when running as a 64bit
-    	    # process on a machine with a 32bit kernel
-    	    if {$cpu eq "ix86"} {
-    		if {$tcl_platform(wordSize) == 8} {
-    		    set cpu x86_64
-    		}
-    	    }
-    	}
-    	aix {
-    	    set cpu powerpc
-    	    if {$tcl_platform(wordSize) == 8} {
-    		append cpu 64
-    	    }
-    	}
-    	hp-ux {
-    	    set plat hpux
-    	    if {![string match "ia64*" $cpu]} {
-    		set cpu parisc
-    		if {$tcl_platform(wordSize) == 8} {
-    		    append cpu 64
-    		}
-    	    }
-    	}
-    	osf1 {
-    	    set plat tru64
-    	}
-    	default {
-    	    set plat [lindex [split $plat _-] 0]
-    	}
-        }
-    
-        return "${plat}-${cpu}"
-    }
-}
-
-
diff --git a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/license.terms b/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/license.terms
deleted file mode 100644
index 6975e4c9..00000000
--- a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/license.terms
+++ /dev/null
@@ -1 +0,0 @@
-<<Undefined>>
diff --git a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/linux-x86_64/tcllibc.so b/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/linux-x86_64/tcllibc.so
deleted file mode 100644
index b84c100f..00000000
Binary files a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/linux-x86_64/tcllibc.so and /dev/null differ
diff --git a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/pkgIndex.tcl b/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/pkgIndex.tcl
deleted file mode 100644
index 7b6fb366..00000000
--- a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/pkgIndex.tcl
+++ /dev/null
@@ -1,2 +0,0 @@
-if {![package vsatisfies [package provide Tcl] 9.0]} {return}
-package ifneeded tcllibc 2.0 "[list proc __critcl_load__ {dir} { ;     source [file join $dir critcl-rt.tcl] ;     set path [file join $dir [::critcl::runtime::MapPlatform]] ;     set ext [info sharedlibextension] ;     set lib [file join $path "tcllibc$ext"] ;     load $lib Tcllibc ;     package provide tcllibc 2.0 ;     catch {rename __critcl_load__ {}}}] ; [list __critcl_load__ $dir]"
diff --git a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/punkbin-artifact.toml b/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/punkbin-artifact.toml
deleted file mode 100644
index ff01732b..00000000
--- a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/punkbin-artifact.toml
+++ /dev/null
@@ -1,53 +0,0 @@
-#punkshell library artifact metadata - EMBEDDED copy (schema v2, class "library"),
-#written at library-artifacts emission into the staged package copy BEFORE the
-#zip is assembled and hashed (embed-then-hash). Finished-zip facts (sha1, size,
-#built) live only in the sidecar toml + sha1sums.txt, which remain the
-#integrity authority; this copy makes a materialized package tree self-describing.
-schema = 2
-
-[artifact]
-name = "tcllibc-tcl9-r1.zip"
-class = "library"
-package = "tcllibc"
-package_version = "2.0"
-#folder: the installed-shape package folder the zip carries at its root
-folder = "tcllibc"
-revision = 1
-target = "linux-x86_64"
-#tcl_generation: the Tcl major-generation the package was built/installed under
-#(and, for binary packages, compiled against) - part of the artifact name.
-tcl_generation = "tcl9"
-#build_id: offline correlation key re-joining a renamed copy to its record;
-#identical in the embedded and sidecar copies (a deterministic identity digest,
-#not an integrity key - the sidecar sha1 is the integrity fact).
-build_id = "e7030a7a-0486-9c94-00cb-7536716ea5d9"
-#origin: canonical artifact repo this artifact was BUILT FOR - not necessarily
-#where it is hosted; mirrors preserve it.
-origin = "https://www.gitea1.intx.com.au/jn/punkbin"
-#packager: declared identity, not proof - signing (minisign sidecars) is the
-#verification layer.
-packager = "Julian Noble <julian@precisium.com.au>"
-project = "punkshell"
-project_url = "unrecorded"
-#license: summary for the distributed package; the package's own license text
-#rides inside the zip (license.terms etc).
-license = "BSD"
-build_host_platform = "win32-x86_64"
-
-[library]
-#driving_tcl_patchlevel: patchlevel of the suite-built shell that ran the
-#installer/critcl - the generation witness, not a runtime version requirement.
-driving_tcl_patchlevel = "9.0.5"
-
-[provenance]
-#class: build-origin class (schema v2): suite-built | third-party | local.
-#NOTE for line-based consumers: '[artifact] class' above is the first 'class ='
-#line in the record by construction - whole-text single-key scans see that one.
-class = "suite-built"
-suite = "suite_tcl90"
-toolchain = "zig 0.16.0"
-optimize = "ReleaseFast"
-#critcl: version declared by the package's own critcl-generated teapot.txt
-critcl = "3.3.1"
-tcllib_checkout = "c784f6fda4516f676453a2785b3c56f1ca5999f450e80ccba6c317ba78ce4e21"
-critcl_checkout = "254bdffe2afc78148f79f92df8d6823a24f971bf"
diff --git a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/teapot.txt b/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/teapot.txt
deleted file mode 100644
index cf2d7786..00000000
--- a/src/vfs/punk9linux.vfs/lib_tcl9/tcllibc/teapot.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-Package tcllibc 2.0
-Meta platform linux-x86_64
-Meta build::date 2026-07-30
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::by {critcl 3.3.1} jnoble {critcl 3.3.1} jnoble
-Meta generated::date critcl
-Meta require {Tcl 8.5 9} {Tcl 8.5 9} {Tcl 8.5 9} {Tcl 8.5 9} {Tcl 8.5 9}
-Meta require {Tcl 8.5 9} {Tcl 8.5 9} {Tcl 8.5 9} {Tcl 8.5 9} {Tcl 8.5 9}
-Meta require {Tcl 8.5 9} {Tcl 8.5 9}
-Meta license BSD licensed.
-Meta author {Andreas Kupries}
-Meta entrytclcommand {eval "[list proc __critcl_load__ {dir} { ;     source [file join $dir critcl-rt.tcl] ;     set path [file join $dir [::critcl::runtime::MapPlatform]] ;     set ext [info sharedlibextension] ;     set lib [file join $path "tcllibc$ext"] ;     load $lib Tcllibc ;     package provide tcllibc 2.0 ;     catch {rename __critcl_load__ {}}}] ; [list __critcl_load__ $dir]"}
-Meta included critcl-rt.tcl linux-x86_64/tcllibc.so