Forced fleet rebake (user-directed): all ten win32 kits now carry the embedded
PUNKSHELL group icon via punkres, verified per kit (punkres list, sidecar
icon_group=PUNKSHELL + embedding=punkres, extract-ico byte-identical spot
check) and booting (incl. metakit punksys 8.6.13 / punk86 8.6.17 and
punk902z 9.0.2). punkmagic excluded (runtime absent - keeps its old icon and
_build cache); punkshell902 linux = not applicable.
The first fleet pass surfaced a real shape: mingw-built runtimes (tclsh902z,
tclkit-win64-dyn family) keep COFF symbol/debug tables AFTER their sections,
the extraction head carries them, and punkres correctly refused those stubs
as data-classified overlay. Measured against twapi-era artifacts: Windows'
EndUpdateResource has always silently STRIPPED exactly those bytes at
stub-stamp time (leaving PointerToSymbolTable dangling) and the kits work -
so punkres 0.3.0 (upstream dca8634, re-vendored, 33/33) encodes the
distinction: -drop-opaque-overlay DISCARDS expendable trailing data and
zeroes the orphaned symbol-table header fields, vs -allow-opaque-overlay
which RELOCATES a real self-locating payload; conflicting flags rejected;
drop is inert on zip overlays. The seam's punkres arm passes -drop
(twapi-arm-equivalent stub hygiene; bin/AGENTS.md documents it).
Recovery note: a 10-minute foreground timeout killed the first 3-kit rerun
during deploy - stale src/_build/.punkcheck.lock removed after a dead-pid
check per the recorded procedure; the completion bake deployed the
already-wrapped kits. Full punkexe suite 83 tests 0 failed; goals_lint +
architecture_lint clean.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Julian Noble
c6d50b3b2a