make-ico.tcl (any tclsh 8.6+, rsvg-convert on PATH) replaces make-ico.ps1
in place: pure-Tcl PNG decode (core zlib inflate + row unfilter) and
DIB/ICONDIR assembly take over from System.Drawing, with an embedded
sha256 (NIST-vector validated, cross-checked against Get-FileHash).
Byte-identity proven before the ps1 removal: 'all -check' regenerates all
seven recorded artifacts (punk-mark.ico, punk-mark-solid.ico,
project-default/icon.ico on the DIB+PNG256 profile; favicon.ico all-PNG;
apple-touch/192/512 rasters) byte-identical to the committed files under
both mingw tclsh 8.6.11 and native Tcl 9.0.3.
Every artifact now carries its <name>.assetorigin.toml sidecar (schema 1:
artifact sha256, source + source hash, role, generator + invocation
options), (re)written by every generator subcommand so regeneration
cannot leave a stale record. The 'all' manifest embeds the invocation
profiles; 'all -check' is the no-write drift probe (exit 1 on any
difference). src/runtime/punkshell.ico gains a derived-copy sidecar (hash
equals source_hash, source ../assets/logo/punk-mark.ico); the three vfs
copies stay unrecorded pending the user call on shipping sidecars inside
baked kits.
src/assets/logo/AGENTS.md: assetorigin schema 1 format documentation
(canonical), Tcl-generator work guidance, drift-probe verification line.
favicon source recorded as web/icon.svg (renders byte-identical to
punk-mark.svg at 16/32/48; the same-directory primary web icon chosen).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Julian Noble