Every kit a bake builds now gets a <kitname>.resources.toml sidecar
(build folder + deployed beside bin/<kit>) recording the build-time icon
choice: schema-1 flat TOML in the G-135 tolerant family - kit, target,
kit_type, icon_origin default|override, icon_source (repo-relative),
icon_hash, provenance source+hash lifted from the icon's assetorigin
sidecar (the chain reaches the SVG master), embedding, embedding_status
embedded|not-applicable|unavailable|failed, embedding_reason. Byte-stable
(no timestamps, write-only-if-changed); named "resources" so the parked
RT_VERSION follow-on extends the same file. Format doc: bin/AGENTS.md.
win32-target kits get the icon embedded as RT_ICON/RT_GROUP_ICON via the
twapi resource-update APIs - the tcl-sfe sfe-0.2.tm mechanism (Ashok P.
Nadkarni) generalized: enumerate all existing icon/group entries via
extract_resources, delete ALL, write ids 1..N plus one group under the
first pre-existing group's name+lang (fallback 1/1033) in a single
update transaction - idempotent by construction. Ordering is stub-first:
a PER-KIT copy of the extraction phase's payload-free raw runtime prefix
is stamped BEFORE payload attach, so the resource rewrite can never
corrupt an overlay; all three assemblers (zipfs mkimg, zipcat/concat,
sdx wrap) consume the stamped copy; runtime store originals untouched.
::punkboot::kit_icon_process is the single internal entry point with
mechanism selection inside (a G-128 portable stamper becomes a
substitution). Skip taxonomy: non-PE target / runtimeless .kit =
NOT APPLICABLE; cookfs, missing icon, missing raw prefix, cross-host
(non-windows process family), twapi-unloadable = UNAVAILABLE with
distinct named reasons; embed errors = recapped BUILD-WARNING + status
failed. Sidecar written in every case. Default icon joins the kit's
punkcheck source set (icon changes rebuild kits); sha256 self-contained
(bootsupport has sha1/md5 only), memoized per run.
Verified (evidence in the goal detail file Progress): full bake embeds
all 10 buildable win32 kits (zip x64+ix86, sdx metakit trio) with
resource inspection byte-matching the source ico (punk91, punk86,
punk91ix86 inspected; group name SFE preserved); scratch-copy boots for
zip, metakit and a stamped concat image (androwish exe-path mount);
override round-trip via punk9wintk903.vfs (solid ico embedded +
recorded, then reverted); linux cross-target punkshell902 sidecar with
not-applicable; mingw tclsh86 bake takes the concat path with the
distinct twapi-unloadable notice; vendored twapi 5.0b1 arm proven under
tclsh9.0.5-punk; double-restamp converges. punk9_beta embedded+built
but deploy still blocked by the known bin file lock (stamped product
waits in src/_build).
make.tcl workflow text gains the icon step + sidecar output; punkshell
0.29.0 -> 0.30.0 (minor: kits now wear the punkshell icon; new shipped
sidecar) with CHANGELOG entry. G-057 detail file: ordering + override +
sidecar + seam decisions recorded with tcl-sfe attribution; cross-host
known-shortcoming + G-128 remedy recorded per acceptance.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Julian Noble
5a8a62547b