diff --git a/goals/G-128-portable-pe-resource-stamping.md b/goals/G-128-portable-pe-resource-stamping.md
index 30a44e75..79176420 100644
--- a/goals/G-128-portable-pe-resource-stamping.md
+++ b/goals/G-128-portable-pe-resource-stamping.md
@@ -337,3 +337,29 @@ the parked RT_VERSION stamping wants, since the project version is known late.
   deploy - stale .punkcheck.lock removed per the recorded recovery procedure,
   completion bake deployed the already-wrapped kits). Full punkexe suite 83
   tests 0 failed. punkshell 0.30.3.
+- Spaced-path characterization (2026-07-29, user test checkout at
+  "C:/repo/jn/program files/punkshell"): the whole flow works with spaces in
+  every path segment. The seam's `catch $cmd` invocation is a PURE-LIST eval
+  (list/lappend-built, evaluated word-per-element - the canonical safe
+  eval-a-list idiom; no {*} needed, no re-substitution occurs), proven live:
+  `make.tcl bake punk9_beta` in the spaced checkout embedded via punkres
+  (stub path "...\program files\...\iconed_punk9_beta.exe"), kit wears
+  PUNKSHELL, sidecar recorded, kit boots loading punk::lib, bakelist reads
+  deployed=current. Also exercised under spaces: punk-runtime.cmd fetch +
+  use (polyglot ok), make.tcl tool build punkres with a PUNK_ZIG override
+  (fresh checkouts carry no toolchain), direct set-icon/extract-ico on
+  "spaced copy.exe" in "space test dir". Suite: punkres.test gained
+  punkres_spaced_paths (8/8, ~3s total - fixture copied into a
+  space-carrying dir + filename, stamped and read back).
+- Runtime-store finding from the same checkout (not a G-128 defect;
+  candidate UX improvements are user-owned): `punk-runtime fetch` downloads
+  only the immutable -rN artifact and points active.toml at it; the
+  suffixless WORKING copy that mapvfs names (tclsh9.0.5-punk.exe) appears
+  only after `punk-runtime use tclsh9.0.5-punk-r2.exe` (the FULL artifact
+  name - `use tclsh9.0.5-punk` resolves suffixless names against EXISTING
+  runtimes for selection, and does NOT materialize from a lone -rN artifact
+  even though it lists it as a candidate). Until then bakelist rows read
+  runtime=missing; the `deployed` column is the KIT build/deploy state
+  (absent in a fresh checkout is correct). Candidates flagged to the user:
+  suffixless `use` materializing from a sole matching -rN artifact, and/or
+  fetch hinting the `use` step for the platform default.
diff --git a/src/tests/shell/testsuites/punkexe/punkres.test b/src/tests/shell/testsuites/punkexe/punkres.test
index 8982d828..96756efd 100644
--- a/src/tests/shell/testsuites/punkexe/punkres.test
+++ b/src/tests/shell/testsuites/punkexe/punkres.test
@@ -166,6 +166,30 @@ namespace eval ::testspace {
         file delete -force $frcopy $frcopy2
     } -result {rc 0 rebuildmode 1 identical 1}
 
+    #added 2026-07-29 (agent, G-128) - windows-common spaced paths: the seam
+    #invokes punkres via a Tcl-list exec (word-per-element; catch of a pure
+    #list), so spaces in the checkout/build paths must ride through argv into
+    #punkres's own file IO. Characterized end-to-end on a copy whose directory
+    #AND filename carry spaces.
+    test punkres_spaced_paths {set-icon + extract-ico through paths containing spaces} -constraints {punkresfixture} -body {
+        variable fixture; variable srcicon; variable workdir
+        set sdir [file join $workdir "punkres space dir"]
+        file delete -force $sdir
+        file mkdir $sdir
+        set scopy [file join $sdir "spaced copy.exe"]
+        set sico [file join $sdir "out ico.ico"]
+        file copy -force $fixture $scopy
+        lassign [run_punkres set-icon -allow-file-relative-shift [file nativename $scopy] [file nativename $srcicon]] rc out
+        set result [list rc $rc]
+        lappend result written [regexp {written: .*spaced copy\.exe} $out]
+        lassign [run_punkres extract-ico [file nativename $scopy] [file nativename $sico]] rc2 out2
+        lappend result rc2 $rc2
+        lappend result identical [string equal [readbin $sico] [readbin $srcicon]]
+        set result
+    } -cleanup {
+        file delete -force $sdir
+    } -result {rc 0 written 1 rc2 0 identical 1}
+
     # -- make.tcl tool discovery (same piped pattern as maketcltool.test) --
 
     variable maketcl_run_timeout_ms 60000