Characterized (windows tcl 9.0.5) how a binary inside a zip-based .tm (modpod)
loads, per user request. All three loading locations - dll direct in a kit's
zipfs, a standalone .tm on disk, and a .tm nested inside a kit's zipfs
(zip-in-zip, mounts in place, no .tm pre-extraction) - converge on the same
copy-to-temp path: the binary extracts to %TEMP%\TCL<hex>\ with the same
TIP-741 non-cleanup/accumulation flaw (verified with a #modpod-mybintest
wrapping a real tcl9thread307.dll built via modpod::lib::make_zip_modpod).
- G-066 (substantive): the characterization + the multi-package-name design -
manifest-at-well-known-location read by libunknown (not yet implemented);
multi-name .tm are punkshell/libunknown-only, not plain-tclsh loadable, which
is acceptable if clearly documented; TIP 590 lowercase single-name is the
plain-tclsh-loadable happy path; complex mechanisms OK with extensive tests.
- G-103: TIP-741 thread extended - windows flaw now confirmed for BOTH
direct-kit and modpod-.tm binary loads.
- G-105: linux leg BLOCKED - local WSL is tcl 8.6.14 (no zipfs); needs a linux
tcl9 runtime. Windows done; linux expectation (no accumulation) unverified.
- G-067: binary modpod .tm as a publish payload; cross-refs.
Temp reclaim also done this session: 15,596 orphaned %TEMP%\TCL* dirs removed.
Notes only; no contract changes. goals_lint clean.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
New goals (user-approved drafts, all proposed) covering the declarative
vendoring direction:
- G-065 declarative vendoring: toml-declared external packages with
version/commit pinning, retrieval provenance, binary-scan gating with
punkproject.toml override; manual drop-ins stay supported (surfaced as
undeclared); agent-free by design
- G-066 pkgIndex.tcl-to-.tm repackaging: lib.copyasmodule expansion with
embedded LICENSE/metadata datafile and distribution-unit tracking for
multi-package upstreams (tcllib-style)
- G-067 module artifact channel: publish/retrieve prepared .tm modules
against configurable artifact servers, sharing the G-006 consent-gating
and source-override pattern
- G-068 agent-assisted moduledoc generation workflow for vendored
third-party libraries (G-055 pattern generalized), decoupled from basic
vendoring
G-063 contract extended (user-approved): vendored-package license
indications additionally carry verification provenance (method, verifier,
date), reported by the audit surface.
Proving case recorded in G-065 notes: the hand-trimmed tcl_oauth2_library
copy was load-tested then removed before ever being committed, so the
first vendoring of it runs end-to-end through the declaration; the
TEMP_REFERENCE clone remains the upstream stand-in.
goals_lint: clean.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Julian Noble