punk-runtime list -remote: surface server default + active selection

Both payloads in parity (rewrapped; roundtrip pin PASS; twins + layout
copy refreshed): the remote comparison now answers "is my active runtime
the recommended one?" at a glance - summary lines show the platform's
server default (defaults.txt, best-effort fetch with cache; absent
server = markers gracefully omitted) and the locally active runtime
(annotated '(= server default)' on match); rows gain the local listing's
'*' active marker and a '(server default)' annotation on the default's
row, whether it is locally present or remote-only.

Also fixes the latent bash bug the verification exposed: CRLF server
sha1sums made locally-present runtimes ALSO appear as remote-only rows
(bash read keeps the \r that msys grep strips, so the \r-suffixed name
failed the local-existence test) - the remote-only loop now strips \r,
and punkbin's build_sha1sums.tcl writes LF sha1sums going forward
(punkbin 4b403a3). Project 0.18.6.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

CHANGELOG.md

@@ -5,6 +5,10 @@ The latest `## [X.Y.Z]` header must match the `version` field in `punkproject.to
 Entries are newest-first; one bullet per notable change. See the root `AGENTS.md`
 "Project Versioning" section for the bump policy.
 
+## [0.18.6] - 2026-07-22
+
+- `bin/punk-runtime.cmd` `list -remote`: surfaces the selection state - summary lines show the platform's server default (per `defaults.txt`, best-effort fetch) and the locally active runtime (annotated `(= server default)` on match); the active runtime's row carries the local listing's `*` marker and the default's row (local or remote-only) is annotated `(server default)`. Also fixed a latent bash-payload bug the work exposed: CRLF server sha1sums made locally-present runtimes additionally appear as remote-only rows (`\r`-suffixed name failed the existence test; msys grep strips `\r`, bash `read` does not) - punkbin's maintenance script now writes LF sha1sums too.
+
 ## [0.18.5] - 2026-07-22
 
 - `bin/punk-runtime.cmd`: the default runtime a no-name `fetch` retrieves now comes from the artifact server's curated root-level `defaults.txt` (`<platform> <runtimename>` per line - a punkbin release decision, updated there in the same change-set that publishes the artifact it points at; validated by punkbin's maintenance script) instead of values baked into the payloads. Works for any `-platform` (the recommendation is per-platform server data); platforms without a recorded default, and servers without the file, get an actionable message; cached-copy fallback on network failure. The baked per-platform defaults were removed from both payloads - one of them (linux-arm) had already drifted from the server's actual artifact name, which is precisely the failure mode the server-side file eliminates.

bin/AGENTS.md

@@ -76,8 +76,12 @@ The first argument to a built punk shell may be a dash-delimited package mode co
 verification against its `sha1sums.txt` - both the powershell payload on windows and the
 bash payload on unix verify; a fetch whose checksum fails leaves only a `.tmp`).
 `list -remote` compares local runtimes against the server's sha1sums (Same version /
-UPDATE AVAILABLE / not-listed, plus remote-only entries; the bash payload falls back to
-a cached sha1sums.txt with a warning when the server is unreachable). The artifact
+UPDATE AVAILABLE / not-listed, plus remote-only entries; cached sha1sums.txt fallback
+with a warning when the server is unreachable). It also surfaces the selection state:
+summary lines show the platform's server default (from `defaults.txt`, best-effort)
+and the locally active runtime (annotated `(= server default)` when they match), the
+active runtime's row carries the same `*` marker the local listing uses, and the
+default's row - local or remote-only - is annotated `(server default)`. The artifact
 server base url is overridable via `PUNKBIN_URL` (mirrors/testing) in both payloads.
 Which runtime `run` launches is the per-machine "active" selection in
 `bin/runtime/<platform>/active.toml` (constrained single-key toml `active = "<name>"`,

bin/punk-runtime.cmd

@@ -1532,7 +1532,11 @@ show_help() {
     echo "      (variant, tcl patchlevel, revision, piperepl policy, source"
     echo "      artifact of a materialized copy; a !TARGET-MISMATCH flag marks"
     echo "      a runtime filed under the wrong platform folder). -remote"
-    echo "      compares local runtimes against the server's sha1sums."
+    echo "      compares local runtimes against the server's sha1sums, marks"
+    echo "      the locally ACTIVE runtime (*) and annotates the platform's"
+    echo "      recommended runtime ((server default), per the server's"
+    echo "      defaults.txt when available) - so active-vs-default is"
+    echo "      visible at a glance."
     echo "  use <name> ?-platform <p>?"
     echo "      Select the runtime that 'run' launches (records active.toml in"
     echo "      the platform folder). An immutable -r<N> ARTIFACT name is"
@@ -1721,12 +1725,32 @@ case "$action" in
                 echo "No sha1 tool found (tried sha1sum, shasum, sha1, openssl) - cannot compare local runtimes."
                 exit 1
             fi
+            #server-default + local-active surfacing (G-103): the server's curated
+            #defaults.txt names the recommended runtime per platform - best-effort
+            #fetch (cached/absent both fine for a listing), then mark the matching
+            #row and the locally active one so "is my active the recommended
+            #default?" is answerable at a glance.
+            activename=$(get_active)
+            platform_default=""
+            defaultslocal="${scriptdir}/runtime/defaults.txt"
+            curl -fsL --silent --output "$defaultslocal" "${url_kitbase}/defaults.txt" 2>/dev/null || :
+            if [[ -f "$defaultslocal" ]]; then
+                platform_default=$(awk -v p="$archtail" '$1==p {print $2; exit}' "$defaultslocal")
+            fi
             echo "-----------------------------------------------------------------------"
             echo "Runtimes for $archtail"
             echo "Local  $archdir"
             echo "Remote ${url_kitbase}/${archtail}"
+            if [[ -n "$platform_default" ]]; then
+                echo "server default for $archtail: $platform_default"
+            fi
+            if [[ -n "$activename" ]]; then
+                matchnote=""
+                [[ -n "$platform_default" && "$activename" == "$platform_default" ]] && matchnote="  (= server default)"
+                echo "active (local): $activename$matchnote"
+            fi
             echo "-----------------------------------------------------------------------"
-            echo "Local                               Remote"
+            echo "  Local                               Remote"
             echo "-----------------------------------------------------------------------"
             for f in $(list_candidates); do
                 local_sha1=$(lcase "$(sha1_of "$archdir/$f")")
@@ -1738,16 +1762,27 @@ case "$action" in
                 else
                     rhs="UPDATE AVAILABLE"
                 fi
-                printf '%-35s %s\n' "$f" "$rhs"
+                mark="  "
+                [[ "$f" == "$activename" ]] && mark="* "
+                annot=""
+                [[ -n "$platform_default" && "$f" == "$platform_default" ]] && annot="  (server default)"
+                printf '%s%-35s %s%s\n' "$mark" "$f" "$rhs" "$annot"
             done
             #remote-only entries
             while IFS= read -r line; do
+                #server sha1sums may be CRLF: msys grep strips \r in text mode but
+                #bash read does not - without this a locally-present runtime also
+                #shows as a remote-only row (its \r-suffixed name fails the -f test)
+                line="${line%$'\r'}"
                 rname=$(printf '%s' "$line" | sed -n 's/^[0-9a-fA-F]\{40\} \*\(.*\)$/\1/p')
                 if [[ -n "$rname" && ! -f "$archdir/$rname" ]]; then
-                    printf '%-35s %s\n' "-" "$rname"
+                    annot=""
+                    [[ -n "$platform_default" && "$rname" == "$platform_default" ]] && annot="  (server default)"
+                    printf '  %-35s %s%s\n' "-" "$rname" "$annot"
                 fi
             done < "$sha1local"
             echo "-----------------------------------------------------------------------"
+            echo "* = active (local selection)"
         else
             if [[ -d "$archdir" ]]; then
                 candidates=$(list_candidates)
@@ -2363,7 +2398,11 @@ function Show-PunkRuntimeHelp {
     write-host "      (variant, tcl patchlevel, revision, piperepl policy, source"
     write-host "      artifact of a materialized copy; a !TARGET-MISMATCH flag marks"
     write-host "      a runtime filed under the wrong platform folder). -remote"
-    write-host "      compares local runtimes against the server's sha1sums."
+    write-host "      compares local runtimes against the server's sha1sums, marks"
+    write-host "      the locally ACTIVE runtime (*) and annotates the platform's"
+    write-host "      recommended runtime ((server default), per the server's"
+    write-host "      defaults.txt when available) - so active-vs-default is"
+    write-host "      visible at a glance."
     write-host "  use <name> ?-platform <p>?"
     write-host "      Select the runtime that 'run' launches (records active.toml in"
     write-host "      the platform folder). An immutable -r<N> ARTIFACT name is"
@@ -2980,12 +3019,44 @@ function psmain {
                         }
                     }
 
+                    #server-default + local-active surfacing (G-103): the server's
+                    #curated defaults.txt names the recommended runtime per platform -
+                    #best-effort fetch (cached/absent both fine for a listing), then
+                    #mark the matching row and the locally active one so "is my
+                    #active the recommended default?" is answerable at a glance.
+                    $activename = Get-PunkActiveRuntime $archfolder
+                    $platform_default = ""
+                    $defaultslocal = Join-Path -Path $rtfolder -ChildPath "defaults.txt"
+                    try {
+                        Invoke-WebRequest -Uri "$artifacturl/defaults.txt" -OutFile $defaultslocal -ErrorAction Stop
+                    } catch { }
+                    if (Test-Path -Path $defaultslocal -PathType Leaf) {
+                        foreach ($line in (Get-Content -Path $defaultslocal)) {
+                            $line = $line.Trim()
+                            if ($line -eq "" -or $line.StartsWith("#")) { continue }
+                            $parts = -split $line
+                            if ($parts.Count -ge 2 -and $parts[0] -eq $arch) {
+                                $platform_default = $parts[1]
+                                break
+                            }
+                        }
+                    }
                     Write-host     "-----------------------------------------------------------------------"
                     Write-host     "Runtimes for $arch"
                     Write-host     "Local  $archfolder"
                     Write-host     "Remote $archurl"
+                    if ($platform_default -ne "") {
+                        Write-host "server default for ${arch}: $platform_default"
+                    }
+                    if ($activename -ne "") {
+                        $matchnote = ""
+                        if ($platform_default -ne "" -and $activename -eq $platform_default) {
+                            $matchnote = "  (= server default)"
+                        }
+                        Write-host "active (local): $activename$matchnote"
+                    }
                     Write-host     "-----------------------------------------------------------------------"
-                    Write-host     "Local                               Remote"
+                    Write-host     "  Local                               Remote"
                     Write-host     "-----------------------------------------------------------------------"
                     #               12345678910234567892023456789302345
                     $G = "`e[32m" #Green
@@ -3009,18 +3080,25 @@ function psmain {
                         #ansi problems from cmd.exe not in windows terminal - review
                         $C = ""
                         $RST = ""
+                        $mark = "  "
+                        if ($key -eq $activename) { $mark = "* " }
+                        $annot = ""
+                        if ($platform_default -ne "" -and $key -eq $platform_default) { $annot = "  (server default)" }
                         $lhs = "$key".PadRight(35, ' ')
-                        write-host -nonewline "${C}${lhs}${RST}"
-                        write-host $rhs
+                        write-host -nonewline "${mark}${C}${lhs}${RST}"
+                        write-host "$rhs$annot"
                     }
                     $lhs_missing = "-".PadRight(35, ' ')
                     foreach ($key in $remotedict.Keys) {
                         if (-not ($localdict.ContainsKey($key))) {
-                            write-host -nonewline $lhs_missing
-                            write-host $key
+                            $annot = ""
+                            if ($platform_default -ne "" -and $key -eq $platform_default) { $annot = "  (server default)" }
+                            write-host -nonewline "  $lhs_missing"
+                            write-host "$key$annot"
                         }
                     }
                     Write-host     "-----------------------------------------------------------------------"
+                    Write-host     "* = active (local selection)"
 
                 } else {
                     if (test-path -Path $archfolder -Type Container) {

punkproject.toml

@@ -1,4 +1,4 @@
 [project]
 name = "punkshell"
-version = "0.18.5"
+version = "0.18.6"
 license = "BSD-2-Clause"

src/project_layouts/vendor/punk/project-0.1/bin/punk-runtime.cmd

@@ -1532,7 +1532,11 @@ show_help() {
     echo "      (variant, tcl patchlevel, revision, piperepl policy, source"
     echo "      artifact of a materialized copy; a !TARGET-MISMATCH flag marks"
     echo "      a runtime filed under the wrong platform folder). -remote"
-    echo "      compares local runtimes against the server's sha1sums."
+    echo "      compares local runtimes against the server's sha1sums, marks"
+    echo "      the locally ACTIVE runtime (*) and annotates the platform's"
+    echo "      recommended runtime ((server default), per the server's"
+    echo "      defaults.txt when available) - so active-vs-default is"
+    echo "      visible at a glance."
     echo "  use <name> ?-platform <p>?"
     echo "      Select the runtime that 'run' launches (records active.toml in"
     echo "      the platform folder). An immutable -r<N> ARTIFACT name is"
@@ -1721,12 +1725,32 @@ case "$action" in
                 echo "No sha1 tool found (tried sha1sum, shasum, sha1, openssl) - cannot compare local runtimes."
                 exit 1
             fi
+            #server-default + local-active surfacing (G-103): the server's curated
+            #defaults.txt names the recommended runtime per platform - best-effort
+            #fetch (cached/absent both fine for a listing), then mark the matching
+            #row and the locally active one so "is my active the recommended
+            #default?" is answerable at a glance.
+            activename=$(get_active)
+            platform_default=""
+            defaultslocal="${scriptdir}/runtime/defaults.txt"
+            curl -fsL --silent --output "$defaultslocal" "${url_kitbase}/defaults.txt" 2>/dev/null || :
+            if [[ -f "$defaultslocal" ]]; then
+                platform_default=$(awk -v p="$archtail" '$1==p {print $2; exit}' "$defaultslocal")
+            fi
             echo "-----------------------------------------------------------------------"
             echo "Runtimes for $archtail"
             echo "Local  $archdir"
             echo "Remote ${url_kitbase}/${archtail}"
+            if [[ -n "$platform_default" ]]; then
+                echo "server default for $archtail: $platform_default"
+            fi
+            if [[ -n "$activename" ]]; then
+                matchnote=""
+                [[ -n "$platform_default" && "$activename" == "$platform_default" ]] && matchnote="  (= server default)"
+                echo "active (local): $activename$matchnote"
+            fi
             echo "-----------------------------------------------------------------------"
-            echo "Local                               Remote"
+            echo "  Local                               Remote"
             echo "-----------------------------------------------------------------------"
             for f in $(list_candidates); do
                 local_sha1=$(lcase "$(sha1_of "$archdir/$f")")
@@ -1738,16 +1762,27 @@ case "$action" in
                 else
                     rhs="UPDATE AVAILABLE"
                 fi
-                printf '%-35s %s\n' "$f" "$rhs"
+                mark="  "
+                [[ "$f" == "$activename" ]] && mark="* "
+                annot=""
+                [[ -n "$platform_default" && "$f" == "$platform_default" ]] && annot="  (server default)"
+                printf '%s%-35s %s%s\n' "$mark" "$f" "$rhs" "$annot"
             done
             #remote-only entries
             while IFS= read -r line; do
+                #server sha1sums may be CRLF: msys grep strips \r in text mode but
+                #bash read does not - without this a locally-present runtime also
+                #shows as a remote-only row (its \r-suffixed name fails the -f test)
+                line="${line%$'\r'}"
                 rname=$(printf '%s' "$line" | sed -n 's/^[0-9a-fA-F]\{40\} \*\(.*\)$/\1/p')
                 if [[ -n "$rname" && ! -f "$archdir/$rname" ]]; then
-                    printf '%-35s %s\n' "-" "$rname"
+                    annot=""
+                    [[ -n "$platform_default" && "$rname" == "$platform_default" ]] && annot="  (server default)"
+                    printf '  %-35s %s%s\n' "-" "$rname" "$annot"
                 fi
             done < "$sha1local"
             echo "-----------------------------------------------------------------------"
+            echo "* = active (local selection)"
         else
             if [[ -d "$archdir" ]]; then
                 candidates=$(list_candidates)
@@ -2363,7 +2398,11 @@ function Show-PunkRuntimeHelp {
     write-host "      (variant, tcl patchlevel, revision, piperepl policy, source"
     write-host "      artifact of a materialized copy; a !TARGET-MISMATCH flag marks"
     write-host "      a runtime filed under the wrong platform folder). -remote"
-    write-host "      compares local runtimes against the server's sha1sums."
+    write-host "      compares local runtimes against the server's sha1sums, marks"
+    write-host "      the locally ACTIVE runtime (*) and annotates the platform's"
+    write-host "      recommended runtime ((server default), per the server's"
+    write-host "      defaults.txt when available) - so active-vs-default is"
+    write-host "      visible at a glance."
     write-host "  use <name> ?-platform <p>?"
     write-host "      Select the runtime that 'run' launches (records active.toml in"
     write-host "      the platform folder). An immutable -r<N> ARTIFACT name is"
@@ -2980,12 +3019,44 @@ function psmain {
                         }
                     }
 
+                    #server-default + local-active surfacing (G-103): the server's
+                    #curated defaults.txt names the recommended runtime per platform -
+                    #best-effort fetch (cached/absent both fine for a listing), then
+                    #mark the matching row and the locally active one so "is my
+                    #active the recommended default?" is answerable at a glance.
+                    $activename = Get-PunkActiveRuntime $archfolder
+                    $platform_default = ""
+                    $defaultslocal = Join-Path -Path $rtfolder -ChildPath "defaults.txt"
+                    try {
+                        Invoke-WebRequest -Uri "$artifacturl/defaults.txt" -OutFile $defaultslocal -ErrorAction Stop
+                    } catch { }
+                    if (Test-Path -Path $defaultslocal -PathType Leaf) {
+                        foreach ($line in (Get-Content -Path $defaultslocal)) {
+                            $line = $line.Trim()
+                            if ($line -eq "" -or $line.StartsWith("#")) { continue }
+                            $parts = -split $line
+                            if ($parts.Count -ge 2 -and $parts[0] -eq $arch) {
+                                $platform_default = $parts[1]
+                                break
+                            }
+                        }
+                    }
                     Write-host     "-----------------------------------------------------------------------"
                     Write-host     "Runtimes for $arch"
                     Write-host     "Local  $archfolder"
                     Write-host     "Remote $archurl"
+                    if ($platform_default -ne "") {
+                        Write-host "server default for ${arch}: $platform_default"
+                    }
+                    if ($activename -ne "") {
+                        $matchnote = ""
+                        if ($platform_default -ne "" -and $activename -eq $platform_default) {
+                            $matchnote = "  (= server default)"
+                        }
+                        Write-host "active (local): $activename$matchnote"
+                    }
                     Write-host     "-----------------------------------------------------------------------"
-                    Write-host     "Local                               Remote"
+                    Write-host     "  Local                               Remote"
                     Write-host     "-----------------------------------------------------------------------"
                     #               12345678910234567892023456789302345
                     $G = "`e[32m" #Green
@@ -3009,18 +3080,25 @@ function psmain {
                         #ansi problems from cmd.exe not in windows terminal - review
                         $C = ""
                         $RST = ""
+                        $mark = "  "
+                        if ($key -eq $activename) { $mark = "* " }
+                        $annot = ""
+                        if ($platform_default -ne "" -and $key -eq $platform_default) { $annot = "  (server default)" }
                         $lhs = "$key".PadRight(35, ' ')
-                        write-host -nonewline "${C}${lhs}${RST}"
-                        write-host $rhs
+                        write-host -nonewline "${mark}${C}${lhs}${RST}"
+                        write-host "$rhs$annot"
                     }
                     $lhs_missing = "-".PadRight(35, ' ')
                     foreach ($key in $remotedict.Keys) {
                         if (-not ($localdict.ContainsKey($key))) {
-                            write-host -nonewline $lhs_missing
-                            write-host $key
+                            $annot = ""
+                            if ($platform_default -ne "" -and $key -eq $platform_default) { $annot = "  (server default)" }
+                            write-host -nonewline "  $lhs_missing"
+                            write-host "$key$annot"
                         }
                     }
                     Write-host     "-----------------------------------------------------------------------"
+                    Write-host     "* = active (local selection)"
 
                 } else {
                     if (test-path -Path $archfolder -Type Container) {

src/scriptapps/bin/punk-runtime.bash

@@ -252,7 +252,11 @@ show_help() {
     echo "      (variant, tcl patchlevel, revision, piperepl policy, source"
     echo "      artifact of a materialized copy; a !TARGET-MISMATCH flag marks"
     echo "      a runtime filed under the wrong platform folder). -remote"
-    echo "      compares local runtimes against the server's sha1sums."
+    echo "      compares local runtimes against the server's sha1sums, marks"
+    echo "      the locally ACTIVE runtime (*) and annotates the platform's"
+    echo "      recommended runtime ((server default), per the server's"
+    echo "      defaults.txt when available) - so active-vs-default is"
+    echo "      visible at a glance."
     echo "  use <name> ?-platform <p>?"
     echo "      Select the runtime that 'run' launches (records active.toml in"
     echo "      the platform folder). An immutable -r<N> ARTIFACT name is"
@@ -441,12 +445,32 @@ case "$action" in
                 echo "No sha1 tool found (tried sha1sum, shasum, sha1, openssl) - cannot compare local runtimes."
                 exit 1
             fi
+            #server-default + local-active surfacing (G-103): the server's curated
+            #defaults.txt names the recommended runtime per platform - best-effort
+            #fetch (cached/absent both fine for a listing), then mark the matching
+            #row and the locally active one so "is my active the recommended
+            #default?" is answerable at a glance.
+            activename=$(get_active)
+            platform_default=""
+            defaultslocal="${scriptdir}/runtime/defaults.txt"
+            curl -fsL --silent --output "$defaultslocal" "${url_kitbase}/defaults.txt" 2>/dev/null || :
+            if [[ -f "$defaultslocal" ]]; then
+                platform_default=$(awk -v p="$archtail" '$1==p {print $2; exit}' "$defaultslocal")
+            fi
             echo "-----------------------------------------------------------------------"
             echo "Runtimes for $archtail"
             echo "Local  $archdir"
             echo "Remote ${url_kitbase}/${archtail}"
+            if [[ -n "$platform_default" ]]; then
+                echo "server default for $archtail: $platform_default"
+            fi
+            if [[ -n "$activename" ]]; then
+                matchnote=""
+                [[ -n "$platform_default" && "$activename" == "$platform_default" ]] && matchnote="  (= server default)"
+                echo "active (local): $activename$matchnote"
+            fi
             echo "-----------------------------------------------------------------------"
-            echo "Local                               Remote"
+            echo "  Local                               Remote"
             echo "-----------------------------------------------------------------------"
             for f in $(list_candidates); do
                 local_sha1=$(lcase "$(sha1_of "$archdir/$f")")
@@ -458,16 +482,27 @@ case "$action" in
                 else
                     rhs="UPDATE AVAILABLE"
                 fi
-                printf '%-35s %s\n' "$f" "$rhs"
+                mark="  "
+                [[ "$f" == "$activename" ]] && mark="* "
+                annot=""
+                [[ -n "$platform_default" && "$f" == "$platform_default" ]] && annot="  (server default)"
+                printf '%s%-35s %s%s\n' "$mark" "$f" "$rhs" "$annot"
             done
             #remote-only entries
             while IFS= read -r line; do
+                #server sha1sums may be CRLF: msys grep strips \r in text mode but
+                #bash read does not - without this a locally-present runtime also
+                #shows as a remote-only row (its \r-suffixed name fails the -f test)
+                line="${line%$'\r'}"
                 rname=$(printf '%s' "$line" | sed -n 's/^[0-9a-fA-F]\{40\} \*\(.*\)$/\1/p')
                 if [[ -n "$rname" && ! -f "$archdir/$rname" ]]; then
-                    printf '%-35s %s\n' "-" "$rname"
+                    annot=""
+                    [[ -n "$platform_default" && "$rname" == "$platform_default" ]] && annot="  (server default)"
+                    printf '  %-35s %s%s\n' "-" "$rname" "$annot"
                 fi
             done < "$sha1local"
             echo "-----------------------------------------------------------------------"
+            echo "* = active (local selection)"
         else
             if [[ -d "$archdir" ]]; then
                 candidates=$(list_candidates)

src/scriptapps/bin/punk-runtime.ps1

@@ -101,7 +101,11 @@ function Show-PunkRuntimeHelp {
     write-host "      (variant, tcl patchlevel, revision, piperepl policy, source"
     write-host "      artifact of a materialized copy; a !TARGET-MISMATCH flag marks"
     write-host "      a runtime filed under the wrong platform folder). -remote"
-    write-host "      compares local runtimes against the server's sha1sums."
+    write-host "      compares local runtimes against the server's sha1sums, marks"
+    write-host "      the locally ACTIVE runtime (*) and annotates the platform's"
+    write-host "      recommended runtime ((server default), per the server's"
+    write-host "      defaults.txt when available) - so active-vs-default is"
+    write-host "      visible at a glance."
     write-host "  use <name> ?-platform <p>?"
     write-host "      Select the runtime that 'run' launches (records active.toml in"
     write-host "      the platform folder). An immutable -r<N> ARTIFACT name is"
@@ -718,12 +722,44 @@ function psmain {
                         }
                     }
 
+                    #server-default + local-active surfacing (G-103): the server's
+                    #curated defaults.txt names the recommended runtime per platform -
+                    #best-effort fetch (cached/absent both fine for a listing), then
+                    #mark the matching row and the locally active one so "is my
+                    #active the recommended default?" is answerable at a glance.
+                    $activename = Get-PunkActiveRuntime $archfolder
+                    $platform_default = ""
+                    $defaultslocal = Join-Path -Path $rtfolder -ChildPath "defaults.txt"
+                    try {
+                        Invoke-WebRequest -Uri "$artifacturl/defaults.txt" -OutFile $defaultslocal -ErrorAction Stop
+                    } catch { }
+                    if (Test-Path -Path $defaultslocal -PathType Leaf) {
+                        foreach ($line in (Get-Content -Path $defaultslocal)) {
+                            $line = $line.Trim()
+                            if ($line -eq "" -or $line.StartsWith("#")) { continue }
+                            $parts = -split $line
+                            if ($parts.Count -ge 2 -and $parts[0] -eq $arch) {
+                                $platform_default = $parts[1]
+                                break
+                            }
+                        }
+                    }
                     Write-host     "-----------------------------------------------------------------------"
                     Write-host     "Runtimes for $arch"
                     Write-host     "Local  $archfolder"
                     Write-host     "Remote $archurl"
+                    if ($platform_default -ne "") {
+                        Write-host "server default for ${arch}: $platform_default"
+                    }
+                    if ($activename -ne "") {
+                        $matchnote = ""
+                        if ($platform_default -ne "" -and $activename -eq $platform_default) {
+                            $matchnote = "  (= server default)"
+                        }
+                        Write-host "active (local): $activename$matchnote"
+                    }
                     Write-host     "-----------------------------------------------------------------------"
-                    Write-host     "Local                               Remote"
+                    Write-host     "  Local                               Remote"
                     Write-host     "-----------------------------------------------------------------------"
                     #               12345678910234567892023456789302345
                     $G = "`e[32m" #Green
@@ -747,18 +783,25 @@ function psmain {
                         #ansi problems from cmd.exe not in windows terminal - review
                         $C = ""
                         $RST = ""
+                        $mark = "  "
+                        if ($key -eq $activename) { $mark = "* " }
+                        $annot = ""
+                        if ($platform_default -ne "" -and $key -eq $platform_default) { $annot = "  (server default)" }
                         $lhs = "$key".PadRight(35, ' ')
-                        write-host -nonewline "${C}${lhs}${RST}"
-                        write-host $rhs
+                        write-host -nonewline "${mark}${C}${lhs}${RST}"
+                        write-host "$rhs$annot"
                     }
                     $lhs_missing = "-".PadRight(35, ' ')
                     foreach ($key in $remotedict.Keys) {
                         if (-not ($localdict.ContainsKey($key))) {
-                            write-host -nonewline $lhs_missing
-                            write-host $key
+                            $annot = ""
+                            if ($platform_default -ne "" -and $key -eq $platform_default) { $annot = "  (server default)" }
+                            write-host -nonewline "  $lhs_missing"
+                            write-host "$key$annot"
                         }
                     }
                     Write-host     "-----------------------------------------------------------------------"
+                    Write-host     "* = active (local selection)"
 
                 } else {
                     if (test-path -Path $archfolder -Type Container) {