G-133 achieved 2026-07-27: activation + flip + archive record + reference sweep

Activation (user-directed this session) through achieved flip in one lifecycle
change-set: index entry moved to GOALS-archive.md (Scope relocated verbatim;
title preserved with the [achieved] status transform; Detail: line becomes the
archive detail pointer - the standard flip transformations), detail file gains
the activation survey Related: notes (G-114 prevention-side sibling, G-128
sibling PE surface), the advisory-as-drafted open-decision resolution, and the
full Progress/verification records (live bake evidence on
punkluck86/punk91ix86/punk86/punkshell902, the zint real finding, 92.6ms avg
scan cost, suite results). Reference sweep pushes the archived file's
actionable notes to G-024 (toml schema home), G-131 (one-vocabulary +
runtime_caps), G-127 (target-addressing adoption), G-130 (subdir exemption for
32-bit growth), G-123 (publication citation), G-114 (detection-side sibling).
Detail file moves to goals/archive/ in the following pure-rename commit.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

GOALS-archive.md

@@ -210,3 +210,7 @@ Acceptance: when extraction from the source runtime yields nothing and the kit's
 ### G-129 [achieved 2026-07-27] Kit boot finds its payload wherever the archive mounted, not only at //zipfs:/app → detail: goals/archive/G-129-kitboot-mountpoint-derivation.md
 Scope: src/vfs/_config/punk_main.tcl and src/vfs/_config/project_main.tcl (vfs capability detection plus mount-point derivation for the kit's internal module/lib path assembly - both carry the same code today); src/runtime/mapvfs.config (an active kit entry per verification runtime); bin/runtime/win32-ix86/ (the two third-party 32-bit runtimes that verify it - read-only input); src/tests/shell/testsuites/punkexe/ (characterization of the derivation); src/AGENTS.md + bin/AGENTS.md (what a runtime must provide to be kit-wrappable)
 Acceptance: a kit baked from a runtime that mounts its attached archive at the executable's own path boots and resolves its own payload with no external package paths in play - the kit's internal modules/ and lib/ trees appear in tcl::tm::list and auto_path and a package that exists only inside the kit resolves - with bin/runtime/win32-ix86/tclsh8.6.10-luck-zip.exe recorded here as that verification runtime; a kit baked from bin/runtime/win32-ix86/tclsh9.1b0-tclsfe.exe (32-bit, modern //zipfs:/app convention) boots the same way, proving the 32-bit target itself needs nothing special and that the derivation did not regress the ordinary case; punkshell's existing 64-bit kits are unaffected, verified by comparing each kit's internal tcl::tm::list and auto_path entries before and after the change across at least one zipfs kit and one starkit-family kit (identical); a runtime that has an attached archive the boot cannot locate says so on stderr rather than continuing silently with no internal paths, which is today's failure shape; and the runtime requirements for kit-wrapping - which zipfs commands and mount conventions are supported - are documented in bin/AGENTS.md.
+
+### G-133 [achieved 2026-07-27] Bakes verify payload/target consistency: smoke-requires probe + advisory binary-arch scan → detail: goals/archive/G-133-bake-payload-consistency-checks.md
+Scope: src/make.tcl (post-merge advisory arch scan at the G-125 gate seam; post-bake smoke-require step for host-runnable kits; recapped reporting); src/modules/punkboot/utils-999999.0a1.0.tm (binary-arch classifier + payload scan predicate beside vfs_boot_library_report); src/runtime/mapvfs.config (per-kit smoke-require declaration - interim line format, schema home moves with G-024); src/tests/modules/punkboot/utils/ (classifier fixtures); src/tests/shell/testsuites/punkexe/ (reporting characterization); src/AGENTS.md + bin/AGENTS.md (what is and is not guaranteed)
+Acceptance: a merged payload carrying a wrong-arch binary outside any platform-discriminated subdir produces a recapped BUILD-WARNING naming file, found architecture and kit target, with the 2026-07-27 punkluck86 case (x64 thread dll under plain lib_tcl8/ in a win32-ix86 kit) reproduced as a fixture; multi-arch platform-subdir packages (iocp-2.0.2's win32-ix86 + win32-x86_64 pair) and recognised vendor spellings (blend2d-style win-x64) produce no warning; the scan is structural, non-executing, runs for cross-target kits and its measured per-kit cost is recorded as negligible; a kit entry may declare smoke-require packages, and for host-runnable kits the freshly built artifact is executed via its tclsh subcommand with each declared package plain-required - failures are recapped naming kit, package and the actual error, the Thread version-shadowing case is caught by construction, cross-target kits skip with a stated reason, and undeclared kits run nothing new; the classifier is unit-tested over PE i386/x64/arm64 fixtures and platform-subdir layouts with non-PE formats classified or honestly unknown; and src/AGENTS.md + bin/AGENTS.md state what the checks do not guarantee (statics, pure-tcl packages with binary deps, and version-preference outcomes are visible only to the smoke probe).

GOALS.md

@@ -414,7 +414,3 @@ Detail: goals/G-131-boot-payload-autodetection.md
 ### G-132 [proposed] Draft the Tcl-on-windows errno catch-all report for manual submission
 Scope: TEMP_REFERENCE/tcl-windows-errno-catchall-TICKET-DRAFT.md (submission-ready ticket text - STAGING ONLY, unversioned, and the agent does not submit it); this detail file (the tracked record: finding, verbatim reproducer, the submitted URL once the user files it, and the upstream disposition); src/bootsupport/AGENTS.md and src/make.tcl (the existing workaround and its warning - dated, not removed, if upstream fixes it)
 Detail: goals/G-132-tcl-windows-errno-catchall-report.md
-
-### G-133 [proposed] Bakes verify payload/target consistency: smoke-requires probe + advisory binary-arch scan
-Scope: src/make.tcl (post-merge advisory arch scan at the G-125 gate seam; post-bake smoke-require step for host-runnable kits; recapped reporting); src/modules/punkboot/utils-999999.0a1.0.tm (binary-arch classifier + payload scan predicate beside vfs_boot_library_report); src/runtime/mapvfs.config (per-kit smoke-require declaration - interim line format, schema home moves with G-024); src/tests/modules/punkboot/utils/ (classifier fixtures); src/tests/shell/testsuites/punkexe/ (reporting characterization); src/AGENTS.md + bin/AGENTS.md (what is and is not guaranteed)
-Detail: goals/G-133-bake-payload-consistency-checks.md

goals/G-024-mapvfs-toml.md

@@ -86,3 +86,7 @@ with the G-014 direction of toml + tomlish for declared configuration.
   grammars in one toml family (shared conventions, not two dialects); G-115's
   vendorlib_vfs.toml fold/supersede decision should cite this goal's scheme format.
 - G-121 (archived) delivered the shared parsed-mapping reader (::punkboot::lib::mapvfs_parse + mapvfs_kit_outputs): the bake kit machinery, bakelist and the bake/bakelist argdoc kit-name choices all consume the model, never the file format - this goal's toml conversion swaps the reader implementation underneath that surface, and bakelist is where its per-entry validation errors surface (runtime/vfs missing rows) - see goals/archive/G-121-bakelist-selective-bake.md
+- G-133 (archived) landed the interim per-kit smoke-require declaration as a 5th
+  mapvfs.config entry element (list of packages the built kit must plain-require);
+  the toml conversion is its designated schema home, alongside the verification-set
+  grouping already recorded here - see goals/archive/G-133-bake-payload-consistency-checks.md.

goals/G-114-per-platform-tm-roots.md

@@ -57,3 +57,8 @@ work land deliberately when G-109-era binary tms arrive, not ad hoc.
   (zig-triple <-> canon mapping, per-target artifact layout) and this goal's
   per-platform tm roots share the punk::platform canon settled in the same
   2026-07-21/22 survey - root naming follows the canon, never zig triples.
+- G-133 (archived) is this goal's detection-side sibling, now landed: the bake's advisory
+  binary-arch scan + smoke-require probe DETECT wrong-platform binaries/resolution at bake
+  time for whatever layout a payload has, while this goal would PREVENT wrong-platform
+  binary .tm registration at runtime - see
+  goals/archive/G-133-bake-payload-consistency-checks.md.

goals/G-123-thirdparty-runtime-tiers.md

@@ -102,3 +102,7 @@ see goals/archive/G-058-static-runtime-packages.md).
   win32-ix86 third-party specimens wrapped as active verification kits
   (punkluck86 / punk91ix86); see
   goals/archive/G-129-kitboot-mountpoint-derivation.md.
+- G-133 (archived) landed the bake-side guarantee this tier would cite at publication: a
+  kit that passed its declared smoke-requires (plain package require inside the built
+  artifact) plus a clean advisory binary-arch scan - see
+  goals/archive/G-133-bake-payload-consistency-checks.md.

goals/G-127-crosstarget-vfs-bake.md

@@ -127,3 +127,9 @@ exists locally (empty but for sha1sums.txt) and punkbin upstream carries
   goals/archive/G-037-vendorlib-vfs-propagation.md.
 - Tension to hold in view: G-004 (no committed binaries) - per-target payloads multiply
   the binary count in the tree unless they arrive by build or fetch.
+- G-133 (archived) landed second-guessing-free target addressing for its checks (arch
+  scan keyed by the entry's rt_target; smoke probe gated on host process-family
+  runnability with a stated-reason skip) - per its cross-reference this goal, landing
+  second, adopts that target-addressing; its output-location move must also keep the
+  smoke probe pointed at wherever the freshly built artifact lands - see
+  goals/archive/G-133-bake-payload-consistency-checks.md.

goals/G-130-32bit-windows-buildsuites.md

@@ -79,3 +79,9 @@ the other's generation.
   `host=win32-ix86 target=win32-ix86 store=bin/runtime/win32-ix86` when driven by one. No
   platform-canon work is required; the tier name the store already uses is the canonical
   one.
+- G-133 (archived) is what lets this goal's first-party 32-bit runtimes/packages grow the
+  win32-ix86 verification kits' payloads without advisory noise: binaries under
+  platform-discriminated subdirs (win32-ix86/ etc) are exempt from the bake's arch scan,
+  and the kits' smoke-require declarations (punkluck86 Thread; punk91ix86 Thread iocp)
+  probe resolution inside the built 32-bit artifacts - see
+  goals/archive/G-133-bake-payload-consistency-checks.md.

goals/G-131-boot-payload-autodetection.md

@@ -105,3 +105,8 @@ independently-written branches.
   conventions) are in its Progress records; and make.tcl's capability probe now keys
   has_zipfs on `tcl::zipfs::mount` (the LUCK backport probes has_zipfs 1 + has_starkit 1 -
   already a both-capability row this goal's mismatch-check work must accommodate).
+- G-133 (archived) recorded the payload/target failure-report vocabulary this goal's
+  kit_type_mismatch rework should read as one voice with ("payload/target arch mismatch
+  in kit <kit> (target <t>) ...", recapped BUILD-WARNINGs), and its smoke-require probe
+  runs the built artifact via the tclsh subcommand - another consumer of the runtime_caps
+  /probe surface being reworked here - see goals/archive/G-133-bake-payload-consistency-checks.md.

goals/G-133-bake-payload-consistency-checks.md

@@ -1,6 +1,6 @@
 # G-133 Bakes verify payload/target consistency
 
-Status: proposed
+Status: achieved 2026-07-27
 Scope: src/make.tcl (post-merge advisory arch scan at the G-125 gate seam; post-bake smoke-require step for host-runnable kits; recapped reporting); src/modules/punkboot/utils-999999.0a1.0.tm (binary-arch classifier + payload scan predicate beside vfs_boot_library_report); src/runtime/mapvfs.config (per-kit smoke-require declaration - interim line format, schema home moves with G-024); src/tests/modules/punkboot/utils/ (classifier fixtures); src/tests/shell/testsuites/punkexe/ (reporting characterization); src/AGENTS.md + bin/AGENTS.md (what is and is not guaranteed)
 Goal: a bake tells the developer, before anyone runs the kit, when a kit's payload cannot deliver what it visibly carries: every kit including cross-target gets a structural check that binary libraries match the kit's declared target unless they sit under a platform-discriminated subdir, and host-runnable kits prove a declared package set actually resolves and loads inside the built artifact via plain package require - so resolution-order defects (a higher-versioned wrong-arch copy shadowing a working one) are caught, not just missing files.
 Acceptance: a merged payload carrying a wrong-arch binary outside any platform-discriminated subdir produces a recapped BUILD-WARNING naming file, found architecture and kit target, with the 2026-07-27 punkluck86 case (x64 thread dll under plain lib_tcl8/ in a win32-ix86 kit) reproduced as a fixture; multi-arch platform-subdir packages (iocp-2.0.2's win32-ix86 + win32-x86_64 pair) and recognised vendor spellings (blend2d-style win-x64) produce no warning; the scan is structural, non-executing, runs for cross-target kits and its measured per-kit cost is recorded as negligible; a kit entry may declare smoke-require packages, and for host-runnable kits the freshly built artifact is executed via its tclsh subcommand with each declared package plain-required - failures are recapped naming kit, package and the actual error, the Thread version-shadowing case is caught by construction, cross-target kits skip with a stated reason, and undeclared kits run nothing new; the classifier is unit-tested over PE i386/x64/arm64 fixtures and platform-subdir layouts with non-PE formats classified or honestly unknown; and src/AGENTS.md + bin/AGENTS.md state what the checks do not guarantee (statics, pure-tcl packages with binary deps, and version-preference outcomes are visible only to the smoke probe).
@@ -72,5 +72,91 @@ future payload/target pairing can regress the same way, silently.
   goals/archive/G-125-unbootable-kit-deploy-gate.md) gates bootability at the same seam;
   G-129 (achieved - see goals/archive/G-129-kitboot-mountpoint-derivation.md) produced
   the two win32-ix86 verification kits whose payload/arch failures motivated this goal.
-- Open decision at activation: smoke-require failures advisory (as drafted) vs
-  kit-failing gate.
+- Related (activation-freshness survey 2026-07-27): G-114 - prevention-side sibling:
+  per-platform tm roots would stop wrong-platform binary modules from ever being
+  registered at runtime; this goal detects the same class at bake time for whatever
+  layout a payload actually carries. G-128 - sibling PE-format surface (resource
+  stamping of finished kit executables); both read PE structures but share no code
+  path today. G-126 also surfaced (shared bake/zip vocabulary) - incidental machinery
+  overlap only, no relationship recorded.
+- Open decision resolved at activation (2026-07-27): smoke-require failures are
+  ADVISORY as drafted (recapped BUILD-WARNINGs; the kit still builds and deploys) -
+  the user activated without electing the kit-failing-gate alternative, and the
+  drafted Acceptance is written for the advisory behaviour. Revisit as a gate if
+  field use shows recapped warnings being missed.
+
+## Progress
+
+2026-07-27 - implemented and achieved same day; every Acceptance clause verified. Detail:
+
+- `punkboot::utils` 0.4.0 -> 0.5.0 gains `binary_arch_classify` (PE Machine field at
+  e_lfanew+4; ELF e_machine honouring EI_DATA endianness; Mach-O thin + fat/universal;
+  unmapped machine values report as definite `unknown-0x<hex>`, unrecognisable content
+  as honest `unknown`), `platform_expected_binary`, `platform_discriminated_segment`
+  (canonical `<os>-<cpu>` token lists + vendor-spelling list, all plain namespace
+  variables for visible extension) and `vfs_binary_arch_report` (iterative walk,
+  exemption decided per directory so exempt subtrees are counted without being read).
+- make.tcl: `::punkboot::get_vfs_binary_arch_report` guarded require (G-125 pattern,
+  degrades to a NOTE); scan wired immediately after the `_vfscommon.vfs` + `<kit>.vfs`
+  merges, before the G-125 gate, so even a gate-refused kit reports its arch findings;
+  per-file BUILD-WARNINGs capped at 8 with an honest total line. Smoke step after the
+  artifact rename: `::punkboot::kit_smoke_require_probe` writes a generated probe
+  script beside the artifact and runs `<artifact> tclsh <script>` with drained stdin
+  via `punk::lib::invoke`; per-package OK lines to stdout, failures + missing results +
+  nonzero exit as recapped BUILD-WARNINGs. mapvfs.config entries accept a 5th element
+  (`mapvfs_parse`/`mapvfs_kit_outputs` carry `smokerequire`; bakelist rows unchanged).
+  `check` reports scan ACTIVE/UNAVAILABLE + the declared smoke matrix; workflow text
+  gains key note K11.
+- Declarations: punkluck86 {Thread} (the incident construction), punk91ix86
+  {Thread iocp} (static builtin + platform-subdir dll selection), punkshell902
+  {Thread} (cross-target skip demonstrator; a linux-hosted bake would probe it).
+
+### Verification records (2026-07-27)
+
+- Live bake (`bake -confirm 0 punkluck86 punk91ix86 punk86 punkshell902`, all 4
+  INSTALLED): punkluck86 scan OK (26 scanned, 8 exempt) and smoke `Thread -> 2.8.5`
+  (the runtime's working 32-bit copy - plain require inside the artifact IS the
+  shadowing construction); punk91ix86 smoke `Thread -> 3.0.5` (static) and
+  `iocp -> 2.0.2` (win32-ix86 subdir dll selected in the 32-bit process); punkshell902
+  (cross-target linux-x86_64) scanned structurally (6 ELF libraries matched) and
+  smoke skipped with the stated not-executable-here reason; punk86 produced the
+  recapped BUILD-WARNING naming file, found architecture and kit target.
+- REAL FINDING on the scan's first sweep: `zint.dll` 2.13.0 in
+  `src/vfs/punk8win.vfs/lib_tcl8/` is PE i386 (independently confirmed with file(1)),
+  carried by all three x64 tcl8 kits (punk86/punkbi/punksys) where its unconditional
+  pkgIndex load can never succeed. Left in place - payload curation is the user's;
+  those bakes warn until it is fixed. The same 32-bit dll also sits in
+  `src/vfs/punk8_statictwapi.vfs/lib/` (not currently baked). Zero false positives:
+  across all 12 assembled trees (494 binaries scanned) the only mismatches are the
+  three zint instances.
+- Negative smoke fixture: zint temporarily declared on punk86 and the kit force-rebuilt -
+  recap produced `smoke-require FAILED for kit punk86.exe: package require zint ->
+  couldn't load library ... Bad exe format. Possibly a 32/64-bit mismatch.` (kit,
+  package, actual error - both mechanisms attributing the same real defect at bake
+  time). mapvfs.config restored byte-identical from backup afterwards.
+- Cost: warm-cache scan of all 12 assembled trees 29-139ms per kit, avg 92.6ms,
+  1.11s total - negligible beside a bake that takes minutes, which is what lets it
+  run unconditionally including for cross-target kits.
+- `modules/punkboot/utils/testsuites/utils/binaryarch.test` 23/23 (PE i386/x64/arm64 +
+  unmapped-machine + MZ-no-PE fixtures, ELF LE/BE, Mach-O thin/universal, java-class
+  cafebabe decoy, text/short honest unknowns, the punkluck86 case as a fixture, iocp
+  pair + win-x64 exemptions, subtree exemption, format mismatch, unmapped target,
+  no-write check, real-trees sweep with the zint findings pinned as known-real and
+  filtered so fixing the payload keeps it green). All fixtures generated with
+  `binary format` - no committed binaries.
+- `shell/testsuites/punkexe/maketclpayloadcheck.test` 3/3 (check status/contract/
+  declared-matrix, ESC-free per G-113); sibling make-family punkexe suites
+  (bootgate/bakelist/colour/platform) 14/14 unchanged.
+- Both guarded-require branches observed live: check reported UNAVAILABLE before the
+  bootsupport propagation, ACTIVE after (`make.tcl modules` + `bootsupport` +
+  `vfscommonupdate -confirm 0`; utils-0.5.0 promoted, 0.4.0 pruned).
+- Full source-tree suite: 1197 tests, 1176 passed, 20 skipped, 1 failed - the
+  documented pre-existing `core/tcl exec-14.3` baseline only.
+- `make.tcl workflow` renders the checks as key note K11 in both default and
+  PUNKBOOT_PLAIN=1 modes, max line width within the 100 budget.
+- Remaining manual item (user decision): resolve the zint payload defect (obtain an
+  x64 zint build, move it under a platform-discriminated subdir with index logic, or
+  drop it from punk8win.vfs); punk905/punk91/punk902z/punk9_beta/punk9bi_beta/punkbi/
+  punksys/punkmagic were deliberately not rebaked this session (avoids the pre-deploy
+  sweep closing running user shells) - the next `make.tcl bake`/`bakehouse` picks up
+  the refreshed `_vfscommon.vfs` (utils 0.5.0) for them.