diff --git a/.agents/docs/2026-09-04-commercial-grade-baremetal-embedded-plan.md b/.agents/docs/2026-09-04-commercial-grade-baremetal-embedded-plan.md
index 95cf9a0d..b79cafe7 100644
--- a/.agents/docs/2026-09-04-commercial-grade-baremetal-embedded-plan.md
+++ b/.agents/docs/2026-09-04-commercial-grade-baremetal-embedded-plan.md
@@ -1,6 +1,6 @@
 # 商业级可用:mcpp × xlings 的裸机与嵌入式总体方案
 
-2026-09-04 · 多仓库总体方案 · **v4:P0 引擎切片已实施**(PR #550);其余批次待实施
+2026-09-04 · 多仓库总体方案 · **v5:P0 引擎切片 + B/C/D/E 四轴已实施**(PR #550、#551)
 
 前置讨论:
 [`2026-08-21-baremetal-ecosystem-assessment.md`](2026-08-21-baremetal-ecosystem-assessment.md)(七角度评估) ·
@@ -471,3 +471,42 @@ clang 对一次 float 乘法仍发出 `vmul.f32` —— 在没有 FPU 的 Cortex
 ⚠️ **软浮点行在没有 builtins 时链接不了浮点代码**(实测:`undefined symbol:
 __aeabi_fmul`),这正是 §3.1.1 把 `compiler-rt-builtins` 与 C 库并列为 P0 的理由。
 整数程序不受影响 —— e2e 332 的四行启动用例即为整数程序。
+
+---
+
+## 11. 第二轮实施(2026-09-04,PR #551)
+
+### 11.1 六轴读数的变化
+
+| 轴 | v4 | 现在 |
+|---|---|---|
+| **A 覆盖** | 🟡 引擎能编七行 | 🟡 不变(C 库源码包与板级包仍未做) |
+| **B 可信** | ❌ 零真机 | 🟢 **模拟器与真机成为同一个包的两个 feature**;真机路径可声明、可解析、判据齐备,尚无实机运行记录 |
+| **C 闭环** | ❌ 三个槽都没有 | ✅ `flash`/`monitor`/`debug` + `runner-exclusive`,四槽一读点 |
+| **D 可复现** | ❌ `--locked` 不存在 | ✅ `--locked`/`--frozen` 断言并点名漂移;关掉快路径以免空转 |
+| **E 可交付** | ❌ 全空白 | 🟢 `mcpp sbom`(CycloneDX 1.5)+ `docs/19` 支持窗口;许可闭包门与离线快照仍未做 |
+| **F 可扩展** | ✅ | ✅ 未受损:新板 = 新包,引擎 diff 为零 |
+
+### 11.2 ⭐⭐ 方案 §2.2 的判断被实施证实,§2.3 的被加强
+
+* **两值语义是对的。** `debug` 起服务端、客户端归 IDE 这条边界成立,`debug` 与
+  `monitor` 在实现里逐字段同形,没有出现方案担心的「会话协议」。
+* **`runner-exclusive` 比方案写的更必要。** 方案说它是「第一块真板挖出的一列」;
+  实施时发现它还必须**只紧不松** —— 图里任何一个包知道设备是互斥的,它就是互斥
+  的,后来的包保持沉默不得放松它。
+
+### 11.3 ⚠️ 实施挖出的、方案没有的两条
+
+1. **一条规则的第二份拷贝。** 依赖提供的 RunGlobal 条目抵达根工程走的是与
+   `apply()` **不同**的路径(`prepare.cppm` 的 BFS 之后)。只接了前者时,
+   `mcpp flash` 报「没有配置」而 `mcpp run` 找得到同一个构建程序发出的 runner。
+   两处现在都遍历槽表。
+2. **快路径会让新槽与 `--locked` 双双空转。** `try_fast_run` 直接 exec 缓存产物,
+   于是 `mcpp flash` 打印 `Running target/…/bin/p`;`try_fast_build` 跳过解析,
+   于是被改坏的锁通过了 `--locked`。两处都按**性质**设闸(槽是不是 run、是不是
+   要求断言),不是按旗标。
+
+### 11.4 仍未做
+
+`mcpplibs/picolibc` + `compiler-rt-builtins` 源码包 · 三个板级包 · `xim:probe-rs` ·
+真机 CI · 许可闭包门(`--deny-license`)· 离线整仓快照 · openarch 第四后端(P3)。
diff --git a/.agents/docs/2026-09-04-named-runners-and-the-universal-command-surface.md b/.agents/docs/2026-09-04-named-runners-and-the-universal-command-surface.md
new file mode 100644
index 00000000..3bc82b43
--- /dev/null
+++ b/.agents/docs/2026-09-04-named-runners-and-the-universal-command-surface.md
@@ -0,0 +1,650 @@
+# 具名 runner、通用命令面、部分后端,与生态闭环
+
+2026-09-04 · 生态级方案 **v8:四条已定,批次已排**(引擎与 openarch 已实施;§11 是实施回填)· 取代
+`2026-09-04-commercial-grade-…-plan.md` §2 的槽表设计
+
+前置:[`2026-09-04-commercial-grade-baremetal-embedded-plan.md`](2026-09-04-commercial-grade-baremetal-embedded-plan.md)
+· PR #550(Cortex-M 七行,已合)· PR #551(旧设计,**按本文重做**)
+
+---
+
+## 0. 三条约束,和它们推翻的四版设计
+
+> **① 一级命令必须所有场景都用得到。** 不通用的用 `--xxx`。
+> **② 默认行为覆盖 80%,同时提供可复杂自定义的选项。**
+> **③ 核心只放通用框架;其余走配置驱动与插件化。**
+
+| 版本 | 形态 | 被哪条推翻 |
+|---|---|---|
+| v1 | `mcpp flash`/`monitor`/`debug` 三个一级命令 | ① 非固件工程里是死命令;嵌入式词汇写进引擎 |
+| v2 | `mcpp <name>` 动态分派 | ① 更糟:一级命令面**因工程而异** |
+| v3 | `mcpp run --runner flash` | ② **把 80% 的场景做成了 20% 的写法** |
+| v4 | + `hardware` feature 重定义**默认** runner | (方向对,但生态零件不全) |
+| **v5** | + 生态五零件 + openarch 能力拆分 + **板级包不再拼路径** | —— |
+
+---
+
+## 1. 全局 review:五条发现
+
+本节是本轮最有价值的部分 —— 前四条都是**已有的东西没被用上**,而不是缺东西。
+
+### 1.1 ⭐⭐⭐ 板级包在做引擎已经替它们做了的事
+
+`mcpp.build.runner_lookup`(#544,2026-09-02)的模块注释原文:
+
+> *"That is what lets a runner name a program the project declared under
+> `[xlings] deps` **without writing the payload's home-and-version path into the
+> manifest**"*
+
+它按顺序搜索:**已声明 `[xlings] deps` 的载荷 `bin/` → PATH**,并且在哪儿都找不到
+时给出点名搜索过哪些路径的错误。
+
+而两个现有板级包**都还在用 #544 之前的写法**:
+
+```cpp
+// riscv-virt-rt / aarch64-virt-rt 今天
+if (const char* qemu = mcpp::xpkg_dir("xim", "qemu-arm"); qemu && *qemu) {
+    mcpp::runner(std::format("{}/bin/qemu-system-aarch64", qemu).c_str());
+    …
+} else {
+    mcpp::warning("qemu-arm is not installed, so `mcpp run` has no runner…");
+}
+```
+
+⇒ **正确写法是一行,并且更健壮:**
+
+```cpp
+mcpp::runner("qemu-system-aarch64");     // 引擎去找;找不到时它自己会说清楚
+```
+
+⚠️⚠️ **连带结论:`mcpp::warning()` 兜底在这个用例上不再需要。** 那条 advisory
+通道是我在 2026-08-21 的评估里列为「最高优先级引擎缺口」并在 2026.8.21.2 落地的,
+用来补救「`xpkg_dir` 返回空 ⇒ 静默不配 runner ⇒ `mcpp run` 报一句在此处不对的
+建议」。**#544 用另一条路解决了同一个问题,而没有人把两者连起来。**
+(`warning` 本身仍有别的正当用途,不撤。)
+
+⭐ 这条对本轮的直接影响:`cortex-m-rt` 的 `build.mcpp` 会明显更短,且**没有那个
+「声明≠安装」的失败模式**。两个既有板级包应当同步简化。
+
+### 1.2 ⭐⭐ 烧录就是运行(80/20)
+
+真板上「跑起来」= 烧进去 + 复位 + 接输出 + 取回退出码,`probe-rs run` 一条命令
+就是这四件事。⇒ **`hardware` feature 重定义的是默认 runner**,不是新增具名的。
+
+```bash
+mcpp run     # 模拟器上跑    ← 默认 feature
+mcpp run     # 真板上跑      ← hardware feature,命令一个字不改
+```
+
+具名 runner 只服务 20% 的例外:只烧不跑、看串口、调试服务端、擦片。
+
+### 1.3 ⭐⭐ openarch 的「规范决定」不需要,机制已在
+
+Cortex-M 没有 MMU、没有页表项,只满足可行性闸(上下文切换 + 页表项)的一半。
+我原以为要先做一个规范决定。**实测:openarch 早就用能力绑定后端**
+(`provides = ["openarch-backend"]` / `requires = […]`)⇒ **把能力拆细即可**:
+
+```toml
+有 MMU 的后端: provides = ["openarch-backend", "openarch:address-space", "openarch:percpu-register"]
+Cortex-M:      provides = ["openarch-backend"]
+```
+
+需要地址空间的内核在**解析期**得到点名的话,而不是链接期一堆
+`undefined reference to arch_pte_*`。**加法,不破坏既有消费者。**
+
+### 1.4 ⭐ 同一个机制,现在用在三处
+
+| 用处 | 声明者 | 引擎知道 |
+|---|---|---|
+| 目标侧五层(`docs/14`) | `provides = ["mcpp:c-abi=musl"]` | 层名,不知实现 |
+| openarch 后端 | `provides = ["openarch-backend", …]` | 有后端这件事 |
+| **具名 runner** | `mcpp:runner-named=flash:…` | 有具名 runner 这件事,**不知名字** |
+
+**三处共用一个机制,不是三个机制。** 这正是「核心只放通用框架」。
+
+⚠️ **而 §12 的工具分档不是第四处** —— 它对齐的是 mcpp 已有的**依赖种类**词汇
+(`dependencies` / `build-dependencies` / `dev-dependencies`),不是能力机制。复用既有
+词汇同样是好事,但把四条并列成「同一条纪律」是修辞上的合并,不准确。**两个既有机制,
+各用其所。**
+
+### 1.5 ⚠️ 唯一的新风险:首次构建的墙钟
+
+C 库改为**源码包**后,干净机器上第一次 `mcpp run` 要编一遍 picolibc。全局依赖缓存
+(`docs/05 §2.10`,跨工程)使它是**每台机器每个目标档一次**,但第一次仍是第一次。
+
+⚠️ **这与「默认覆盖 80%」直接冲突,必须实测。** 判据写在 §9;若 >60s,就要给
+`mcpp new` 的模板加一句「首次构建会编译 C 库,约 N 秒」的状态行,而不是让人干等。
+
+---
+
+## 2. 唯一的概念:runner 有名字,默认的那个没有
+
+```
+包(build.mcpp)   mcpp::runner("qemu-system-arm")   默认 —— 覆盖 80%,写裸名
+                  mcpp::runner("flash", tok)        例外 —— 覆盖 20%
+                  mcpp::runner_longlived("monitor")
+                  mcpp::run_exclusive()             ← 由 runner_exclusive 改名
+
+线协议            mcpp:runner=<token>
+                  mcpp:runner-named=<name>:<token>
+                  mcpp:runner-longlived=<name>
+                  mcpp:run-exclusive=1
+
+工程              [target.X] runner = [...]
+                  [target.X.runners] flash = [...]
+
+用户              mcpp run / mcpp run --runner flash / mcpp run --list-runners
+```
+
+⚠️ **`longLived` 是声明的,不是从名字推的**:`openocd -c "program … exit"` 会终止、
+`openocd -c "init"` 不会,拼写到最后一个参数为止都一样。从名字推只对引擎认识的名字
+有效,而引擎不认识任何名字。
+
+⭐ **`run-exclusive` 是改过的名字**(原 `runner-exclusive`)。它说的是「这个目标的
+运行不能重叠」—— 对一块板、一个探针、一张 GPU、一个 license 受限的工具同样成立,
+而 "device" 把它读窄了。
+
+---
+
+## 3. 一级命令面:全部通用,本轮零新增
+
+```
+new  build  run  test  clean  add  remove  update  search
+publish  pack  emit  toolchain  cache  index  self
+```
+
+| 能力 | 归属 |
+|---|---|
+| 抵达产物的例外方式 | `mcpp run --runner <name>` |
+| 物料清单 | `mcpp emit sbom`(`emit` 已是「生成描述本工程的文档」) |
+| 可复现断言 | `--locked` / `--frozen`(与 `--offline` 同一条侧信道) |
+
+---
+
+## 4. 生态闭环:五个零件
+
+判据是一句话:**干净机器上,`mcpp new blinky --template cortex-m-rt && mcpp run`
+打印出东西。** 今天缺三件。
+
+| # | 零件 | 仓 | 状态 | 缺了会怎样 |
+|---|---|---|---|---|
+| 1 | 编译器(llvm 载荷) | 目标表 | ✅ | —— |
+| 2 | 模拟器 `xim:qemu-arm` | xim-pkgindex | ✅ 已发布**零消费者** | —— |
+| 3 | **C 库 `mcpplibs/picolibc`(源码包)** | mcpp-index | ❌ | `'stdio.h' not found` |
+| 4 | **`mcpplibs/compiler-rt-builtins`(源码包)** | mcpp-index | ❌ | 软浮点行 `undefined __aeabi_fmul` |
+| 5 | **板级 `mcpplibs/cortex-m-rt` + 模板** | 新建仓 | ❌ | 用户自己写链接脚本与向量表 |
+| 6 | 真机工具 `xim:probe-rs` | xim-pkgindex | ❌ | `hardware` feature 无从落地 |
+
+### 4.1 ⭐ `[xlings.workspace]` 是闭环的接线点
+
+```toml
+# cortex-m-rt/mcpp.toml
+[xlings.workspace]
+"xim:qemu-arm" = "9.2.4-1"
+"xim:probe-rs" = "0.24.0"
+```
+
+⚠️ **本文 v5 在这里写错了两处,已更正:**
+
+| v5 写的 | 实际(2026.9.3 起) |
+|---|---|
+| `[xlings] deps = [...]` | **`deps` 已从清单里退休**,`[xlings.workspace]` 是作者写的那一张表。`deps` 仍被接受(根清单里报错、依赖清单里只提示),但不是该写的拼法 |
+| 「声明 ≠ 安装,真正触发安装的是 `xpm.<平台>.deps`」 | **对根工程已经不对了。** `prepare.cppm:3246` 的原话是 *"the contract being added is 'what you declared gets installed'"* —— 根/workspace 清单声明的东西由 mcpp 自动装 |
+
+### 4.1.1 ⚠️⚠️ 但由此浮出一个真正的设计问题:自动安装只覆盖根
+
+`prepare.cppm:3150` — `runtimeOwnerManifest = wsManifest ? *wsManifest : *m`,
+即 **workspace 或根工程的清单,永远不是依赖的**。于是:
+
+| | 查找(`xlingsDepBinDirs`) | 安装(provisioning) |
+|---|---|---|
+| 根工程声明 | ✅ | ✅ 自动装 |
+| **依赖(板级包)声明** | ✅ **本轮刚修** | ❌ **不装** |
+
+⇒ 「板级包知道环境、消费者什么都不声明」这个故事,**查找那一半通了,安装那一半没通**。
+干净机器上仍要靠**索引描述符的 `xpm.<平台>.deps`** 把工具随包装上。
+
+⭐ **而这个不对称可能是对的,不是缺陷。** 两者的性质不同:
+
+* **查找只读机器**。让它跨图是安全的 —— 依赖说「我要 qemu」,mcpp 去看看装没装。
+* **安装写机器**。让它跨图是一次**权限升级**:一个传递依赖可以让 mcpp 往你机器上
+  装任意包。
+
+⇒ 于是分工可以是:**清单里的声明是未经审查的通道,只用于查找;索引描述符的
+`xpm.<平台>.deps` 是发布时被审查过的通道,才有资格触发安装。** 板级包两处都写,
+而那不是重复 —— 它们回答的是两个不同的问题(「去哪找」与「谁有权装」)。
+
+⚠️ **这一条我没有把握,列为待定** —— 见 §12。
+
+### 4.2 为什么 C 库是源码包而不是 xim 预编译
+
+| prebuilt 要做的 | 源码包 |
+|---|---|
+| 7 个多库各建一次 | **没有多库** —— 用与程序完全相同的 `compile_flags` 编,ABI 一致按构造成立 |
+| `libdir` 列与包目录逐字节对上(#481 的形状) | 列为空 |
+| builtins 必须同包否则第一次 printf 挂 | 两个包,由依赖边表达 |
+| 五宿主镜像、`.sha256`、CDN 等待 | 一个源码 tarball,宿主无关 |
+| 版本钉在目标表里,**在 lock 之外** | 进 `mcpp.lock` |
+| 每架构一个包(现已三个) | **一个包服务全部 11 行裸机目标** |
+
+⚠️ 代价见 §1.5(首次墙钟),前提是 `--gc-sections`(已随 #550 落地)。
+
+---
+
+## 5. openarch:部分后端 + 真实应用
+
+| 顺序 | 后端 | 为什么 | 真实应用 |
+|---|---|---|---|
+| 1 | 能力拆分 | 见 §1.3;加法,不破坏 | 现有三后端补声明 |
+| 2 | **aarch32**(Cortex-A/R 32 位) | 14 个函数**一个不缺**(CP15 的 `TPIDRPRW`/`TPIDRURW` 恰是两个指针槽、真 MMU、`VBAR`、DMB/DSB/ISB);第一台 **32 位**机器,挖出 `arch_pte_make_leaf` 返回 `arch_u64` 的宽度假设 | `examples/switch` 扩到四机同源 |
+| 3 | **Cortex-M**(部分后端) | 挖出「每台机器都有地址空间」这条从没被问过的基数假设 | ⭐ **抢占式任务切换器**,`examples/preempt` |
+
+⚠️ **Cortex-M 的真实应用不是跑通探针,是一个能抢占的调度器。** 只做
+`arch_context_switch` 往返的探针,与一个被 SysTick 打断、在 PendSV 里换栈再恢复的
+调度器,考的不是同一件事 —— 后者才会暴露 `arch_trap_*` 在 M-profile 上「向量表是
+按异常号索引的数组,不是单一入口」的语义变化。
+
+---
+
+## 6. 与主流对比
+
+| | 抵达产物的模型 | 弱点 |
+|---|---|---|
+| **Cargo** | `cargo run` + `.cargo/config.toml` 的 `runner` | 每目标**只有一个**;由**用户**配置而非包提供 |
+| **PlatformIO** | `pio run -t upload/monitor` | 动作词汇由平台固定 |
+| **west (Zephyr)** | `west flash` + `runners.yaml` | **两套 CLI**;runner 是 Zephyr 专用 Python |
+| **CMake** | 自定义 target | 无「抵达产物」概念、无发现机制,每工程重造 |
+| **npm** | `npm run <script>` | 无产物/目标/交叉编译概念 |
+| **mcpp v5** | `mcpp run`(80%)+ `--runner`(20%),**由包提供** | 首次构建墙钟(§1.5) |
+
+⭐ Cargo 是最近的祖先,mcpp 超过它两点:**默认 + 任意具名**;**由板级包提供,用户
+什么都不配**。
+⭐⭐ 相对全部五者独有的:**嵌入式开发者用的命令与桌面开发者完全相同**。
+
+---
+
+## 7. 场景
+
+| 领域 | 默认 runner | 具名(20%) | 用户敲 |
+|---|---|---|---|
+| 桌面 | 直接执行 | — | `mcpp run` |
+| MCU 模拟器 | `qemu-system-arm` | — | `mcpp run` |
+| MCU 真板 | `probe-rs run` | `flash` `monitor` `debug` `erase` | `mcpp run` |
+| 嵌入式 Linux | `ssh … ./app` | `deploy` `logs` | `mcpp run` |
+| Web / wasm | `wasmtime` | `serve` | `mcpp run` |
+| 移动端 | 模拟器启动 | `install` `logcat` | `mcpp run` |
+| HPC | 本地跑一份 | `submit` | `mcpp run` |
+
+```bash
+mcpp new blinky --template cortex-m-rt && cd blinky
+mcpp run                                    # 模拟器,零配置              ← 80%
+# 板子到了,改一行 features = ["hardware"]
+mcpp run                                    # 真板,命令没变              ← 80%
+mcpp test                                   # 板上跑,自动一次一个
+mcpp run --list-runners                     # 这块板还能做什么
+mcpp run --runner monitor                   # 看串口                      ← 20%
+mcpp emit sbom -o sbom.json ; mcpp build --locked
+```
+
+---
+
+## 8. 跨仓库依赖与发布顺序
+
+⚠️ **消费者先发布,索引 `latest` 才能动**(否则干净环境全红而开发机全绿)。
+
+```
+xim-pkgindex:  probe-rs ──────────────┐
+mcpp:          引擎(具名 runner)──┐   │
+mcpp-index:    compiler-rt-builtins │  │
+                     ↓              │  │
+               picolibc ────────────┤  │
+                     ↓              │  │
+新建仓:        cortex-m-rt ─────────┴──┘   (依赖 picolibc + 声明两个 xim 工具)
+                     ↓
+openarch:      能力拆分 → aarch32 → cortex-m + examples/preempt
+```
+
+发布次序:`probe-rs` / `builtins` → `picolibc` → 引擎 → `cortex-m-rt` → openarch。
+
+---
+
+## 9. 本轮范围与判据
+
+| # | 事项 | 判据 |
+|---|---|---|
+| 1 | 引擎:具名 runner、`--runner`/`--list-runners`、`run-exclusive` 改名 | e2e:默认+具名+缺席拒绝+一名一提供者 |
+| 2 | `mcpp emit sbom`;`--locked` 保持 | 已有 e2e 333 改写 |
+| 3 | `mcpplibs/compiler-rt-builtins` + `mcpplibs/picolibc` 源码包 | riscv64 上与 `xim:picolibc-riscv` 的 `Size text` 相当且输出相同 |
+| 4 | `mcpplibs/cortex-m-rt` + 模板,**裸名 runner** | 干净沙箱 `mcpp new && mcpp run` 打印 |
+| 5 | `xim:probe-rs` | 干净机器装完 `probe-rs list` 有输出,闭包不越界 |
+| 6 | openarch 能力拆分 + aarch32 + Cortex-M + `examples/preempt` | 四机同源;抢占调度器在 mps2-an385 上换栈成功 |
+| 7 | 简化 `riscv-virt-rt`/`aarch64-virt-rt` 为裸名 | 两包 CI 仍绿,`build.mcpp` 变短 |
+| 8 | `docs/18`、`docs/19`(中英)+ 方案回填 | —— |
+| ⚠️ | **首次构建墙钟实测** | §1.5;>60s 则加状态行 |
+
+**后续轮次(本轮不做,已记):** 真机 CI(自托管 runner + 两块板)· `--deny-license`
+许可闭包门 · 离线整仓快照 · `xim:openocd`(槽抽象的第二实现)。
+
+---
+
+## 10. 仍待定
+
+1. `mcpp run` 在真板上会写 flash —— 需要 `Flashing … then running` 的状态行,不能
+   静默写片。(已定:**要**这行)
+2. `examples/preempt` 放 openarch 仓(与 `examples/switch` 并列,判据同一处)。(已定)
+3. 既有两个板级包的简化是否本轮做 —— 我建议**做**,它同时验证 §1.1 的结论。
+
+---
+
+## 11. 实施回填(2026-09-04)
+
+### 11.1 已落地
+
+| # | 事项 | 仓 | 判据 |
+|---|---|---|---|
+| 1 | 具名 runner、`--runner`/`--list-runners`、`run-exclusive` 改名 | mcpp | e2e 333(十条)✅ |
+| 2 | `mcpp emit sbom`;`--locked` | mcpp | 同上 ✅ |
+| 3 | **依赖声明的工具可按裸名解析** | mcpp | e2e 334 ✅ |
+| 4 | 两个既有板级包简化为裸名 | riscv-virt-rt / aarch64-virt-rt | 各自 example 启动并打印 ✅ |
+| 5 | openarch 能力拆分 | openarch | 三后端补声明 ✅ |
+| 6 | **openarch Cortex-M 部分后端** | openarch | 链接并启动 ✅ |
+| 7 | **`examples/preempt` 抢占式调度器** | openarch | 两任务互相观测到被抢占 ✅ |
+
+### 11.2 ⭐⭐⭐ 实施挖出的第一条:`xlingsDepBinDirs` 只看根清单
+
+§1.1 断言「板级包应当写裸名」。实测**它不工作** —— `runner_lookup` 搜索的目录
+只从 `runtimeOwnerManifest.xlings.deps` 收集,即**根工程**的声明。于是裸名在
+「消费者自己声明了工具」时有效,在「板级包声明了工具」时失败。
+
+**这正好是反的。** 板级包恰恰是那个知道「哪个模拟器/探针能抵达这台机器」的东西;
+要求消费者也声明一遍,正是板级包存在所要消除的重复。
+
+⇒ 收集范围扩到图中每一个包(根优先)。这条是 §1.1 那个简化能否成立的**前提**,
+而方案里没有它 —— 因为在写方案时,那个失败模式还没有被触发过。
+
+### 11.3 ⭐⭐ 实施挖出的第二条:openarch 缺一条抢占原语
+
+`examples/preempt` 的第一版从 PendSV 里调 `arch_context_switch`。它**编译、链接、
+启动、并报告两个任务谁也没观测到对方** —— 没有任何东西失败,只有那条计数器断言
+分辨出了差别。
+
+原因是结构性的:异常处理程序运行时,硬件已经把半个寄存器文件压到**被中断任务的
+栈**上,而处理程序跑在 MSP 上。交换「调用者的被调用者保存寄存器」交换的是**处理
+程序自己的**状态。
+
+⚠️ **openarch 有「切到另一个已保存的上下文」,没有「切换这次陷入将要返回到的上下
+文」。** 每个架构都需要后者才能抢占,而每个架构的写法都不同(riscv64 改 `sepc`、
+aarch64 改 `ELR_EL1`、x86_64 改中断帧)—— 这正是这一层存在所要抽象的东西的形状。
+
+⭐ **`examples/switch` 不可能发现这条:它从不进入陷入。** 这是「真实应用而不是探针」
+这个要求兑现出的价值。
+
+已记在 `examples/preempt/README.md`;是否把它命名为第五个接口组,应当在**不止一台
+机器**在视野内时单独决定,不在本轮。
+
+### 11.4 本轮未做(顺延)
+
+`mcpplibs/picolibc` 与 `compiler-rt-builtins` 源码包 · `mcpplibs/cortex-m-rt`
+板级包 · `xim:probe-rs` · openarch aarch32 后端 · 真机 CI · `--deny-license` ·
+离线整仓快照。
+
+⚠️ 其中 **picolibc 源码包 + cortex-m-rt** 是「干净机器上
+`mcpp new --template cortex-m-rt && mcpp run` 打印出东西」这条闭环判据的最后两块;
+`examples/preempt` 之所以能在没有它们的情况下跑通,是因为它是**零 libc** 的
+(`sysroot = ""`),自带启动与向量表。
+
+---
+
+## 12. 决定:全图安装 + 工具按用途分档
+
+### 12.1 ⭐ 我的「权限升级」反对是错的
+
+我曾主张「让依赖的声明触发安装是一次权限升级」。**那个权限今天已经存在** ——
+索引描述符的 `xpm.<平台>.deps` 就在做这件事:你依赖的包现在就能往你机器上装工具。
+
+⇒ 全图安装**不增加任何权力**,它去掉的是一处重复拼写。我把它跟一个「描述符通道
+不存在」的世界比了,而那个世界不存在。**选 B。**
+
+### 12.2 ⚠️ 但 B 单独做会装得更多,而工具本来就不必全装
+
+一个板级包声明 `qemu-arm`(跑要用)与 `probe-rs`(上真板要用)。今天:
+
+* 只想 `mcpp build` 的消费者 —— **两个都装**,一个都用不上;
+* 用模拟器的消费者 —— probe-rs 白装;
+* 而包依赖早就分了 `[dependencies]` / `[build-dependencies]` /
+  `[dev-dependencies]`,工具却没有这个轴。
+
+⇒ **B 与分档要一起做。合起来之后,常见情形装得比今天更少。**
+
+### 12.3 形状:一张表不变,条目可以是标量或表
+
+2026-09-03 那份文档为「`workspace` 是**唯一**一张表」辩护过,不应推翻。所以分档
+写在**条目**上,而不是新开几张表 —— 这与 mcpp 自己的依赖拼法同形
+(`dep = "1.0"` 或 `dep = { version = "1.0", features = [...] }`)。
+
+```toml
+[xlings.workspace]
+"xim:qemu-arm" = "9.2.4-1"                              # 80%:不写就是今天的行为
+"xim:codegen"  = { version = "1.0", when = "build" }    # 20%
+"xim:probe-rs" = { version = "0.24.0", when = "run" }
+```
+
+| `when` | 什么时候装 | 传播到消费者 |
+|---|---|---|
+| (不写) | **与今天完全一样**:构建时就装 | 是 |
+| `build` | `mcpp build` 起 | 是 |
+| `run` | 只在 `mcpp run` / `mcpp test` 时 | 是 |
+| `dev` | 只在**声明它的那个包自己**被开发/测试时 | **否** |
+
+⭐ **不写 `when` 保持今天的行为,所以没有迁移。** 分档是把范围**收窄**的可选动作,
+不是必须回答的新问题 —— 这正是「默认覆盖 80%、其余可配置」。
+
+### 12.4 feature 门控:沿用已有的 `[feature-deps]` 形状
+
+真板工具只在 `hardware` feature 下才需要。包依赖已经有这个机制,工具沿用同一个
+拼法而不是发明新键:
+
+```toml
+[feature-xlings.hardware]
+"xim:probe-rs" = "0.24.0"
+```
+
+⇒ 用模拟器的人**永远不下载 probe-rs**。
+
+### 12.5 合起来的效果
+
+| 情形 | 今天 | B + 分档 |
+|---|---|---|
+| 消费者 `mcpp build`(板级包依赖) | 描述符把 qemu + probe-rs 都装上 | **一个都不装** |
+| 消费者 `mcpp run`(默认 feature) | 同上 | 只装 qemu |
+| 消费者 `mcpp run`(`hardware`) | 同上 | 只装 probe-rs |
+| 板级包作者写几处 | 清单 + 描述符**两处** | **一处** |
+
+### 12.6 ⚠️ 实施时会撞到的三条
+
+1. **安装的 stamp 按「列表」计**(`prepare.cppm` 的注释说的)。分档后同一个工程会
+   在不同命令下要求不同的子集,stamp 必须按 **(子集, 用途)** 计,否则
+   `mcpp build` 之后的 `mcpp run` 会认为「装过了」而跳过 run 档。
+2. **交叉目标的 sysroot 是 mcpp 自己追加进 deps 列表的**,不是作者声明的 —— 它按
+   性质属于 `build`,且必须不受 `when` 影响(现有注释已说明它不该被 provisioning
+   改变行为)。
+3. **`xlingsDepBinDirs`(查找)必须包含 run 档**,否则 runner 找不到刚装的工具。
+   本轮已把查找扩到全图,分档时要确认两者的集合定义一致。
+
+### 12.7 与描述符的关系
+
+`xpm.<平台>.deps` 仍然存在,但**不再是板级包作者必须记得的第二处**:清单声明即安装。
+描述符保留给「这个 xim 包自身的安装期依赖」这一层,那是 xim 的事,不是 mcpp 工程的事。
+
+---
+
+## 13. 仍待定
+
+1. `when` 的取值是否要第四个(例如 `test` 与 `run` 分开)。我倾向不要 —— `mcpp test`
+   要跑产物,与 `run` 是同一个需求。
+2. `dev` 档是否值得做。它是唯一一个**不传播**的档,语义最重而用例最少;可以先只做
+   `build`/`run`,`dev` 留到有人要。
+3. `[feature-xlings.<feature>]` 这个拼法要不要与 `[feature-deps]` 完全对齐(后者的
+   键是包名,这里的键是 xim 地址)。
+
+---
+
+## 14. 五个问题的解法
+
+整体审查提出的五条,逐条给形状。⭐ 其中第一条的解法把一条「发现」变成了**接口的一次
+最小补全**,而不是一个待议事项。
+
+### 14.1 ⭐⭐ openarch 缺的不是第五个组,是 trap 组里缺一个动作
+
+我原先把它记成「可能需要第五个接口组,待议」。审查后这个判断太松:**抢占是 MCU 上用
+openarch 的主要理由**,表达不了它,openarch-on-Cortex-M 就只有一半用处。
+
+看四台机器要做的事:
+
+| | 抢占时改什么 |
+|---|---|
+| Cortex-M | 换 `PSP`,以 `EXC_RETURN` 返回 |
+| riscv64 | 改 `sepc`,换陷入桩将要恢复的寄存器区 |
+| aarch64 | 改 `ELR_EL1` 与 `SP_EL0` |
+| x86_64 | 改中断帧的 `RIP`/`RSP` |
+
+**同一个动作,四种写法** —— 这正是这一层存在的理由。而 openarch 的 trap 组今天只能
+**观察**陷入(`set_handler`)和**屏蔽**中断,不能**作用于**陷入。
+
+⇒ 解法是一个函数,不是一个组:
+
+```c
+/* 协作式:立刻切换,别人切回来时返回。            (已有) */
+void arch_context_switch(void* from, void* to);
+
+/* 抢占式:让"这一次陷入"返回到 `to` 而不是被中断的那个上下文;
+   被中断的存进 `from`。它正常返回给处理程序,切换在异常退出时发生。 */
+void arch_trap_switch(arch_trap_frame* f, void* from, void* to);
+```
+
+⭐ **两者形状相同,差别只在"什么时候生效"。** 前者是「现在切」,后者是「返回时切」。
+
+能力名 `openarch:preemption`,由后端声明。Cortex-M **能**实现它 —— `examples/preempt`
+里那段手写的 PendSV 汇编就是它的实现。⇒ **那段汇编从示例移进后端**,示例退回成
+四十行纯调度策略、零汇编,这正是这一层该有的样子。
+
+⚠️ 仍然要**不止一台机器**才能定稿(riscv64/aarch64 各写一次才知道签名对不对),
+所以顺序是:先在 Cortex-M 与 aarch32 上各实现一次,再冻结签名。
+
+### 14.2 ⭐ 生态闭环不是两批,是一个包多一个 feature
+
+我原先把「零 libc 档」与「带 libc 档」排成前后两批,等于把一个**现在就能交**的东西
+压在一个大工程后面。
+
+而 mcpp 早就有这个轴:`sysroot = ""` 是零 libc 档(`docs/13` 的原词)。所以:
+
+```toml
+# cortex-m-rt
+[features]
+default  = ["emulator"]
+emulator = {}
+hardware = {}
+libc     = {}          # ← 不选就是零 libc 档
+
+[feature-deps.libc]
+picolibc = "1.8.12"
+```
+
+⇒ **`cortex-m-rt` 现在就能发**(零 libc,自带启动与向量表 —— `examples/preempt`
+已证明这条路通);`picolibc` 落地后,用户加一个 feature,包加一条 `feature-deps`。
+
+⭐ **与模拟器/真机是同一个机制的第二次使用。** 不是新概念。
+
+### 14.3 发现性:放进已有的两个地方,不新增噪声
+
+「引擎不认识任何名字」的代价是新用户不知道 `--runner` 存在。三处补,零新概念:
+
+1. **`mcpp explain`** —— 它已经是「告诉我解析出了什么」,加一节「本工程提供的 runner」
+   是零新概念。`--list-runners` 与它共用一个读点。
+2. **`mcpp run --help`** 一行:*"see --list-runners for what this project supplies"*。
+3. **模板的 README** —— 模板随包走,板级包最清楚自己有什么。
+
+⚠️ **不做**「首次运行时提示一次」:它需要一个 stamp,而这个仓库记过
+「提示出现一次就消失」的教训 —— 缓存命中时不重跑,最需要它的那次反而不打印。
+
+### 14.4 ⭐⭐ 工具分档的判据:测「要装什么」,不测「装成了没有」
+
+我原先说这块判据最薄弱,因为验证需要真实 xim 安装,而 e2e 里没有干净环境。
+
+**那是把判据施加在了错误的对象上。** 被断言的是**mcpp 请求安装的集合**,不是安装
+成功。而请求是可观察的:`MCPP_NO_AUTO_INSTALL`(或 `--offline`)下,provisioning
+不装并**点名它本来要装什么**(`prepare.cppm:3339`)。
+
+⇒ 判据:
+
+```
+MCPP_NO_AUTO_INSTALL=1 mcpp build    的输出里 不得 出现 run 档的工具
+MCPP_NO_AUTO_INSTALL=1 mcpp run      的输出里 必须 出现 run 档的工具
+```
+
+**一次下载都不需要,而且判据带分母**(两条命令的差集正是被测的性质)。
+
+### 14.5 顺序:aarch32 独立成批,并说明它为什么仍值得
+
+我做的顺序与自己的建议相反(先 Cortex-M 后 aarch32),理由成立 —— Cortex-M 才有真实
+应用。但 aarch32 那条发现**还没拿到**:它是第一台 **32 位**机器,会挖出
+`arch_pte_make_leaf` 返回 `arch_u64` 这条从没被问过的宽度假设。
+
+⇒ 它不因为被推后而失去价值,而且 §14.1 的 `arch_trap_switch` **恰好需要它** ——
+签名要在两台不同机器上各实现一次才能冻结。**两件事合成一批。**
+
+---
+
+## 15. 已定的四条(2026-09-04 review)
+
+| # | 决定 | 出处 |
+|---|---|---|
+| 1 | **`arch_trap_switch`** —— openarch 缺的不是第五个组,是 trap 组缺一个动作 | §14.1 |
+| 2 | **`cortex-m-rt` 用 `libc` feature 分档**,零 libc 档现在就能发;**picolibc 并行开工**,不排在它后面 | §14.2 |
+| 3 | **分档判据用 `MCPP_NO_AUTO_INSTALL`** —— 测「要装什么」,零下载 | §14.4 |
+| 4 | **批 1" 的反向发布顺序** —— 板级包必须等引擎发布 | §15.1 |
+
+⭐ 并且:**批 1 的引擎接口(`--runner`、`[target.X.runners]`、`mcpp:runner-named=`、
+`mcpp::runner(name, tok)`)一经发布即成兼容契约。** 本轮之后改它们要付迁移代价,
+所以形状在批 1 合入前定稿 —— 已定稿。
+
+---
+
+## 16. 批次(每仓一个 PR,并行的用同一列)
+
+```
+       ┌─ 批 1  mcpp #551 ──────────────────────────────────┐  36/36 绿
+       │    具名 runner · emit sbom · --locked · 裸名跨全图  │  ← 解锁其余一切
+       └────────────────────┬───────────────────────────────┘
+                            │ 必须先发布 2026.9.4.2
+        ┌───────────────────┼───────────────────┬────────────────────┐
+        ▼                   ▼                   ▼                    ▼
+   批 1' openarch      批 1" 两个板级包     批 2 mcpp+既有包      批 5 mcpp-index
+   部分后端+preempt    裸名简化            [xlings] 工具分档      picolibc +
+   (已提交未推)        ⚠️ 等引擎发布        (when/feature-xlings)  builtins
+        │                                                            │
+        ▼                                                            │
+   批 4 openarch                          批 3 新仓 ◄────────────────┘
+   arch_trap_switch + aarch32             cortex-m-rt
+   两机各实现一次后冻结签名                零 libc 档先发,
+        │                                  picolibc 到位后加 libc feature
+        ▼
+   批 6 xim-pkgindex  probe-rs → 真机路径可落地
+```
+
+### 16.1 ⚠️ 两条发布顺序,方向相反
+
+1. **批 1"(板级包)必须等引擎发布。** 裸名写法依赖批 1 的「查找跨全图」;先发板级包
+   会让老引擎上那两个包直接坏掉。—— 「消费者先发布」的**镜像**。
+2. **批 5(picolibc)必须先于批 3 引用它的那一版发布。** `cortex-m-rt` 要写
+   `[feature-deps.libc] picolibc = "…"`,而按版本引用一个未发布的包解析不到。
+   —— 这是「消费者先发布」的**正例**。
+
+⇒ 所以批 3 分两版:**`0.1.0` 零 libc 档,不等任何人**;`0.2.0` 加 `libc` feature,
+等批 5。⭐ 这正是 §14.2 那个 feature 分档买到的东西:**近档不被远档挡住。**
+
+### 16.2 并行关系
+
+* 批 2、批 5 与批 1'/1" **互不依赖**,可同时进行。
+* 批 4 依赖批 1'(要有 Cortex-M 后端才能在上面实现 `arch_trap_switch`)。
+* 批 6 独立,任何时候都能做;它只在批 3 的 `hardware` feature 要真跑时才成为阻塞。
diff --git a/.github/workflows/ci-linux-e2e.yml b/.github/workflows/ci-linux-e2e.yml
index 80604a21..52530adf 100644
--- a/.github/workflows/ci-linux-e2e.yml
+++ b/.github/workflows/ci-linux-e2e.yml
@@ -188,7 +188,8 @@ jobs:
                    tests/e2e/131_freestanding_bsp_supplies_everything.sh \
                    tests/e2e/132_freestanding_test_and_artifacts.sh \
                    tests/e2e/133_freestanding_std_subset.sh \
-                   tests/e2e/332_cortex_m_builds_and_boots.sh; do
+                   tests/e2e/332_cortex_m_builds_and_boots.sh \
+                   tests/e2e/336_armv7a_builds_and_boots.sh; do
             echo "=== $t ==="
             bash "$t" 2>&1 | tee "$(basename "$t").log"
             rc=${PIPESTATUS[0]}
@@ -221,6 +222,15 @@ jobs:
           booted=$(grep -c 'booted on ' 332_cortex_m_builds_and_boots.sh.log || true)
           [ "$booted" = "4" ] || {
             echo "332 booted $booted rows, expected 4"; exit 1; }
+          # ⚠️ 336 IS HERE FOR THE SAME REASON, AND ADDING IT TO THE LOOP ABOVE
+          # WITHOUT ADDING IT HERE WOULD HAVE BEEN THE SAME DEFECT: it declares
+          # `# requires: qemu-arm`, so on a shard it exits 0 having run nothing.
+          grep -q 'PASS: armv7-a rows build, boot' \
+            336_armv7a_builds_and_boots.sh.log || {
+            echo "336 (armv7-a) skipped on the runner that must run it"; exit 1; }
+          a32=$(grep -c 'booted on virt' 336_armv7a_builds_and_boots.sh.log || true)
+          [ "$a32" = "2" ] || {
+            echo "336 booted $a32 rows, expected 2"; exit 1; }
 
   # ──────────────────────────────────────────────────────────────────
   # Hermetic (no host toolchain): the ONLY environment class that
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d242dd51..e16eb16b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,117 @@
 > 本文件追踪 `mcpp-community/mcpp` 公开仓的版本演进。
 > 格式参考 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)。
 
+## [2026.9.4.2] — 2026-09-04
+
+runner 有了名字,工具有了档位,`--locked` 成为断言,`mcpp emit sbom`。
+
+### ⭐⭐ 一条命令,加具名的例外
+
+`mcpp run` 覆盖常见情形的**全部,真实硬件也一样**。在设备上「运行一个程序」意味着
+写进去、复位、接上输出、读回退出状态 —— 这是**一条**命令(`probe-rs run`、
+`qemu-system-* -kernel`),不是几条。板级包把它作为**默认** runner,于是开发者从
+模拟器换到真板时,**敲的命令不变**。
+
+```bash
+mcpp run                     # 默认;模拟器与真板同一条
+mcpp run --runner flash      # 具名的例外:只写不跑、看串口、起调试服务端、擦片
+mcpp run --list-runners      # 这个工程提供了哪些
+```
+
+⚠️ **引擎不认识任何 runner 名字。** `flash`、`serve`、`deploy`、`submit`、
+`logcat` 对它一样陌生。**引擎里若有一份固定的名字表,就等于由引擎决定哪些领域可被
+表达** —— 一个 web 包将无法自己加 `serve`。
+
+⭐ **写程序名,不要写路径。** mcpp 先找本包 `[xlings] deps` 声明的载荷 `bin/`,
+再找 `PATH`。用 `xpkg_dir` 拼绝对路径是多余的,而且引入了一个失败模式:声明不是
+安装,查询返回空则没有配置任何 runner 而无话可说。
+
+⚠️ 是否终止由 `mcpp::runner_longlived(name)` **声明**:
+`openocd -c "program … exit"` 会终止而 `openocd -c "init"` 不会,拼写到最后一个
+参数为止都一样,没有任何 argv 能表达这个区别。
+
+`mcpp::run_exclusive()` 陈述「这个目标的运行不能重叠」—— 对一块板、一张 GPU、
+一个串口、一个单席位 license 同样成立,`mcpp test` 据此串行化。
+
+### `--locked`
+
+锁一直是解析之后写、从不读回。现在它是断言:发生的解析必须等于记录的解析,不等则
+**点名移动了的包与两个版本**。
+
+⚠️⚠️ **它绝不能遇上快路径。** 实测:加闸之前,一份被故意改坏的锁通过了
+`mcpp build --locked` 并打印 `Finished` —— 旗标被接受、构建正确、**断言从未跑到**。
+
+### `mcpp emit sbom`
+
+CycloneDX 1.5,覆盖**已记录**的解析。⚠️ 读锁而不是重新解析 —— 一份描述了与所构建
+者不同的图的文档比没有更糟。归在 `emit` 之下而不是新开一级命令:`emit` 已经是
+「生成描述本工程的文档」。
+
+### ⭐⭐ 工具有了档位,而且依赖声明的工具现在真的会被装
+
+包依赖从一开始就有 `[dependencies]` / `[build-dependencies]` / `[dev-dependencies]`
+这条轴,工具只有一张表。一个同时点名模拟器与调试探针的板级包,会把两个都装给每一位
+消费者,包括只想把库编出来的那一位。
+
+```toml
+[xlings.workspace]
+"xim:qemu-arm"  = "9.2.4-1"                             # 不写就是从前的行为
+"xim:probe-rs"  = { version = "0.24.0", when = "run"   }
+
+[feature-xlings.hardware]
+"xim:probe-rs"  = "0.24.0"                              # 不要这个 feature 就永不下载
+```
+
+| `when` | 由谁安装 | 传播到消费者 |
+|---|---|---|
+| *(不写)* | 每个构建命令 | 是 |
+| `build` | 每个构建命令 | 是 |
+| `run` | `mcpp run`、`mcpp test` | 是 |
+| `dev` | 只有声明它的那个包作为根时 | **否** |
+
+⭐ **不写 `when` 保持今天的行为,所以没有迁移。**
+
+⚠️⚠️ **同时:`[xlings.workspace]` 的供给扩到全图。** 在此之前只有根工程的声明会被
+安装,而查找(runner 按裸名找程序)已经跨全图 —— **在没有任何东西安装过的目录里
+查找,是只可能失败的查找**。两者现在由同一个表达式定义。
+
+⚠️ 档位带来的一个危险已被堵上:`mcpp build` 装得比 `mcpp run` 需要的少,而 run 的
+快路径正是为跳过那一步存在的。构建缓存记下「这次构建留下了未安装的 run 档工具」,
+`mcpp run` 的快路径据此拒绝该条目 —— 与它拒绝声明了 runner 的条目同理。
+
+判据不测「装成了没有」,而测**mcpp 要装什么**:`MCPP_NO_AUTO_INSTALL=1` 下拒绝供给
+并**点名它本来要装的集合**,于是 `build` 与 `run` 两条命令的差集就是被测的性质,
+一次下载都不需要(`tests/e2e/335`)。
+
+### ⭐ ARMv7-A:第一个带内存管理单元的 32 位目标行
+
+`armv7a-none-eabi` 与 `armv7a-none-eabihf` 两行,`verified`。表里其余每个 32 位行都是
+M-profile:MPU 按基址与上限描述区域,没有页表项。A-profile 有真正的 MMU,于是它是第一个
+能被问「**32 位**机器的页表项长什么样」的目标 —— 这正是 openarch 的地址空间抽象从未被
+一台 32 位机器问过的问题。
+
+实测 2026-09-04(`xim:qemu-arm@9.2.4-1`):两行都在 `-M virt -cpu cortex-a15` 上启动、
+经半主机打印并报回退出状态。
+
+⚠️ **软浮点行同样需要 `-mfpu=none`,而这是在这个架构上重新实测的**,不是从 M-profile
+推过来的:`armv7a-none-eabi` 在软浮点 ABI 下对一次 float 乘法仍发出 VFP 指令。
+
+⚠️ **半主机的退出调用与 M-profile 拼法不同。** AArch32 的 `SYS_EXIT`(`0x18`)把原因码
+**直接**放在 `r1`;Cortex-M 传的 `{reason, code}` 块是 `SYS_EXIT_EXTENDED`(`0x20`)。
+实测:把块传给 `0x18` 打印正确而**退出状态是错的**,只看输出的测试看不出来。
+
+⭐ 那条量化 `-mfpu=none` 的单元测试,谓词曾是 `starts_with("thumb")` —— 一个**拼法**
+而不是它要陈述的性质。新行加进来时规则适用而测试**静默跳过**了它们,每条断言依然通过。
+谓词已改为「32 位 ARM」。
+
+### 发现性
+
+`mcpp why runners` 列出本工程提供的 runner,与其余解析结果并列;
+`mcpp run --list-runners` 是同一份读取,单独报告。
+
+新增 `docs/18-devices.md`、`docs/19-supported-versions.md`(中英双份)。
+指令协议版本 6。
+
 ## [2026.9.4.1] — 2026-09-04
 
 Cortex-M 落地为七个目标行,freestanding 链接开启死代码段消除。
diff --git a/README.md b/README.md
index 01335697..a21efe28 100644
--- a/README.md
+++ b/README.md
@@ -386,6 +386,7 @@ the right toolchain payload is resolved and installed automatically.
 | `thumbv7m-none-eabi`  | llvm 22 — Cortex-M3, bare metal ² | ✅ |
 | `thumbv7em-none-eabihf` | llvm 22 — Cortex-M4F/M7F, hard float ² | ✅ |
 | `thumbv8m.main-none-eabi` | llvm 22 — Cortex-M33/M55, soft float ² | ✅ |
+| `armv7a-none-eabi` · `armv7a-none-eabihf` | llvm 22 — Cortex-A 32-bit, bare metal ² | ✅ |
 | `thumbv7em-none-eabi` · `thumbv8m.base-none-eabi` · `thumbv8m.main-none-eabihf` | llvm 22 — builds and links; no emulator run recorded | 🔄 |
 | `riscv64-linux-musl`  | — | 🔄 |
 | `aarch64-linux-gnu`   | — | 🔄 |
diff --git a/docs/05-mcpp-toml.md b/docs/05-mcpp-toml.md
index e86f4298..cce92e22 100644
--- a/docs/05-mcpp-toml.md
+++ b/docs/05-mcpp-toml.md
@@ -1920,6 +1920,65 @@ triples say one, descriptors and xlings' project file say the other) and both
 are accepted wherever a platform is named. A table with no key for this host
 and no `default` declares nothing here.
 
+#### `when` — which verbs need this tool (mcpp 2026.9.4.2+)
+
+```toml
+[xlings.workspace]
+"xim:qemu-arm"  = "9.2.4-1"                             # every build, as before
+"xim:codegen"   = { version = "1.0",    when = "build" }
+"xim:probe-rs"  = { version = "0.24.0", when = "run"   }
+"xim:clang-tidy"= { version = "20",     when = "dev"   }
+```
+
+Package dependencies have had this axis since the beginning —
+`[dependencies]`, `[build-dependencies]`, `[dev-dependencies]`. Tools had one
+list, so a board-support package that named both an emulator and a debug probe
+installed both for every consumer, including one that only wanted the library
+to compile.
+
+| `when` | Installed by | Reaches a consumer |
+|---|---|---|
+| *(omitted)* | every verb that builds | yes |
+| `build` | every verb that builds | yes |
+| `run` | `mcpp run`, `mcpp test` | yes |
+| `dev` | only the package that declared it, as the root | **no** |
+
+**Omitting `when` is the pre-2026.9.4.2 behaviour exactly**, so no manifest has
+to change. Narrowing is optional; it is not a question an author has to answer.
+
+`dev` is the only tier that does not propagate. It means *"while the package
+that declared this is itself being developed"*, so a dependency's `dev` entry is
+never installed for a consumer. Every other tier does reach one, which is the
+point of a board package knowing its own machine: it declares the emulator once
+and every consumer gets it.
+
+The tier is written on the entry rather than as a second table, on the same
+reasoning that makes `[dependencies]` accept both `dep = "1.0"` and
+`dep = { version = "1.0", features = [...] }`. A scoped entry must name
+`version` even to leave it empty (`version = ""` means *present, any version*),
+because `{ when = "run" }` and a misspelt `version` key would otherwise be
+indistinguishable.
+
+#### `[feature-xlings.<feature>]` — a tool a feature needs
+
+```toml
+[features]
+default  = ["emulator"]
+emulator = {}
+hardware = {}
+
+[feature-xlings.hardware]
+"xim:probe-rs" = "0.24.0"
+```
+
+The same table, gated on a feature, spelled the way `[feature-deps.<feature>]`
+is. A consumer who never asks for `hardware` never downloads a probe driver.
+Entries here accept `when` exactly as the unconditional ones do.
+
+A feature name no `[features]` table declares is reported as a schema warning:
+it activates for nobody and installs nothing, and a tool whose absence is only
+visible as *"the device is never reachable"* is the hardest kind to diagnose.
+
 #### Which version a tool the project did not name resolves to
 
 | The project declares | The version comes from |
diff --git a/docs/13-baremetal.md b/docs/13-baremetal.md
index 4c44ae5c..bdd94b39 100644
--- a/docs/13-baremetal.md
+++ b/docs/13-baremetal.md
@@ -13,7 +13,7 @@ covers the hosted link model this chapter departs from.
 ## Overview
 
 A freestanding target is a target whose `os` field is `none`. The target table
-at `modules/toolchain-model/src/triple.cppm` carries eleven of them:
+at `modules/toolchain-model/src/triple.cppm` carries thirteen of them:
 
 | Triple | Tier | C library |
 |---|---|---|
@@ -28,10 +28,30 @@ at `modules/toolchain-model/src/triple.cppm` carries eleven of them:
 | `thumbv8m.base-none-eabi` | preview | none by default — Cortex-M23 |
 | `thumbv8m.main-none-eabi` | verified | none by default — Cortex-M33/M55, soft float |
 | `thumbv8m.main-none-eabihf` | preview | none by default — Cortex-M33F/M55F, hard float |
+| `armv7a-none-eabi` | verified | none by default — Cortex-A 32-bit, soft float |
+| `armv7a-none-eabihf` | verified | none by default — Cortex-A 32-bit, hard float |
 
 `verified` means an image has been built **and run** for the row. `preview`
 means it builds and links, and no emulator run has been recorded.
 
+### ARMv7-A is the first 32-bit row with a memory management unit
+
+Every other 32-bit row above is M-profile: an MPU that describes regions by base
+and limit, and no page-table entry at all. A-profile has a real MMU with a
+walker, so it is the first target on which an address-space abstraction can be
+asked what a *32-bit* machine's entry looks like — short descriptors are 32 bits
+wide, long (LPAE) ones 64. That question cannot be put to a machine with no
+entries, which is why `openarch`'s Cortex-M backend declines the capability.
+
+**The semihosting exit call is not spelled the way M-profile spells it.**
+`SYS_EXIT` (`0x18`) on AArch32 takes the reason code in `r1` *directly*; the
+`{reason, code}` block a Cortex-M board passes is `SYS_EXIT_EXTENDED` (`0x20`),
+which exists because a 32-bit `r1` cannot carry both. Measured: passing the
+block to `0x18` prints correctly and then reports the wrong exit status, so a
+board that only checks its output cannot see the difference. This is a *board*
+fact rather than a target fact; it is recorded here because it is where the next
+person writing such a board will look.
+
 ### M-profile is seven rows rather than one
 
 Every other bare-metal family above is one row per architecture. Cortex-M is
diff --git a/docs/17-the-project-environment.md b/docs/17-the-project-environment.md
index e36e13b6..3a516004 100644
--- a/docs/17-the-project-environment.md
+++ b/docs/17-the-project-environment.md
@@ -151,7 +151,12 @@ exists for one host platform only is therefore declared for that platform
 on Linux and nothing elsewhere. The keys and the resolution rule are in
 chapter 5, §2.13.
 
-**The runner.** A program under `[xlings] deps` is also where
+**Which verbs install it.** An entry may name a tier —
+`{ version = "0.24.0", when = "run" }` — and a `[feature-xlings.<feature>]`
+table gates one on a feature. A tool the project will not use is then not
+downloaded: chapter 5, §2.13. Omitting the tier is the historical behaviour.
+
+**The runner.** A program under `[xlings.workspace]` is also where
 `[target.<triple>].runner` looks first for its first element, before `PATH`
 (chapter 5, §2.7.3). The two keys together provision a user-mode emulator on a
 CI host and execute a cross-built artifact through it, without the manifest
@@ -164,7 +169,8 @@ naming the payload's path.
 | a library the program links | `[dependencies]` |
 | the compiler | `[toolchain]`, chapter 3 |
 | a host tool a dependency produces | `tools = [...]`, chapter 7 |
-| a tool present in the environment | `[xlings] deps` |
+| a tool present in the environment | `[xlings.workspace]` |
+| a tool only one verb or one feature needs | `when = "run"`, `[feature-xlings.<f>]` |
 | which environment | `[xlings] subos` |
 
 ## 7. Related chapters
diff --git a/docs/18-devices.md b/docs/18-devices.md
new file mode 100644
index 00000000..03488709
--- /dev/null
+++ b/docs/18-devices.md
@@ -0,0 +1,158 @@
+# 18 — Reaching a Device
+
+This document specifies how mcpp executes an artifact that runs somewhere other
+than the machine that built it, how a package supplies additional ways of
+reaching it, and how a project selects between an emulator and physical
+hardware.
+
+Related documents: [13 — Bare-Metal and Freestanding Targets](13-baremetal.md)
+covers the targets this most often applies to; [07 — build.mcpp](07-build-mcpp.md)
+is the reference for the directive protocol a package speaks; [11 — Machine
+Output](11-machine-output.md) is the interface a debugger client or IDE uses.
+
+## One command, and named exceptions
+
+An artifact that cannot run on the build machine needs something to stand in
+front of it. That thing is a **runner**: an argv the package supplies and a tool
+performs, with the artifact appended or substituted for `{}`.
+
+```bash
+mcpp run                        # the default runner
+mcpp run --runner flash         # a named one
+mcpp run --list-runners         # what this project supplies
+mcpp why runners                # the same list, beside everything else resolved
+```
+
+`mcpp run` is the whole of the common case, including on real hardware. On a
+device, running a program means writing it, resetting, attaching to its output
+and reading its exit status — which is one command (`probe-rs run`, `qemu-system-*
+-kernel`), not several. A board therefore supplies that as its **default**
+runner, and the command a developer types does not change when they move from an
+emulator to a board.
+
+Named runners exist for what remains: writing an image without running it,
+observing a console, starting a debug server, erasing a part, deploying without
+starting.
+
+⚠️ **The engine knows no runner names.** `flash`, `serve`, `deploy`, `submit`
+and `logcat` are equally unknown to it: it knows only that a package may supply
+named runners, and performs the argv it finds. A fixed set of names in the
+engine would decide, in the engine, which domains are expressible.
+
+## What a package supplies
+
+```cpp
+mcpp::runner("qemu-system-arm");        // the default: argv token by token
+mcpp::runner("-machine"); mcpp::runner("mps2-an385"); …
+
+mcpp::runner("flash", "probe-rs");      // a named runner
+mcpp::runner("flash", "download"); …
+
+mcpp::runner_longlived("monitor");      // no natural end
+mcpp::run_exclusive();                  // this target's runs cannot overlap
+```
+
+⭐ **Name the program, not its path.** mcpp locates it: the `bin/` of a payload
+declared under `[xlings] deps` by **any package in the graph** — the consuming
+project first, then its dependencies — and then `PATH`. A board-support package
+is precisely the thing that knows which emulator or probe reaches its machine,
+so it declares that payload itself and the consumer declares nothing. Writing an
+absolute path computed from `mcpp::xpkg_dir` is unnecessary, and it introduces a
+failure mode — a declaration is not an install, so the lookup can return empty
+and leave no runner configured with nothing said about why. Naming the program
+lets mcpp report exactly which directories it searched.
+
+## What a project overrides
+
+```toml
+[target.thumbv7em-none-eabihf]
+runner = ["qemu-system-arm", "-machine", "mps2-an385", "-kernel"]
+
+[target.thumbv7em-none-eabihf.runners]
+flash   = ["probe-rs", "download", "--verify", "--chip", "STM32L475VG", "{}"]
+monitor = ["probe-rs", "attach", "--chip", "STM32L475VG"]
+```
+
+Precedence is the ordinary one: what the author of the project wrote beats what
+a dependency supplied, and the override is reported rather than applied in
+silence. Exactly one dependency may supply a given name; a second is an error
+naming both packages.
+
+## Termination is declared, not inferred
+
+| | Meaning |
+|---|---|
+| default | runs to completion; the exit code is the verdict |
+| `runner_longlived(name)` | has no natural end; the operator ends it |
+
+`openocd -c "program image.elf verify reset exit"` terminates and `openocd -c
+"init"` does not, and the two are spelled alike up to the argument the package
+chose. No argv can express which is which, and the engine has no list of names
+to infer it from — so the package states it.
+
+`mcpp run --runner debug` starts a **server** and stops there. The client that
+attaches is the user's debugger or IDE, which learns what it needs through the
+machine-output protocol.
+
+## Runs that cannot overlap
+
+`mcpp test` runs test binaries on a worker pool. One board on one probe, one
+GPU, one serial port, or a tool with a single-seat licence admits one user at a
+time, and two workers reaching for it do not fail cleanly — they interleave, and
+the verdict describes neither test.
+
+The package states this about itself with `mcpp::run_exclusive()`, and `mcpp
+test` then serialises. A project never has to remember `-j1`.
+
+Named for the property rather than for the hardware: nothing here is about
+devices.
+
+## Emulator and hardware are one package
+
+A board reached through an emulator and the same board reached through a debug
+probe differ in the argv of their runners and in nothing else. The linker
+script, the startup code, the memory map and the exported module are the same
+board. Publishing two packages to vary a few strings duplicates all of it and
+lets the copies drift.
+
+The choice is therefore a feature of one package:
+
+```toml
+[features]
+default  = ["emulator"]
+emulator = {}
+hardware = {}
+```
+
+```cpp
+int main() {
+    if (mcpp::has_feature("hardware")) {
+        for (auto a : {"probe-rs", "run", "--chip", "STM32L475VG"})
+            mcpp::runner(a);                       // the DEFAULT moves
+        for (auto a : {"probe-rs", "gdb", "--chip", "STM32L475VG"})
+            mcpp::runner("debug", a);
+        mcpp::runner_longlived("debug");
+        mcpp::run_exclusive();
+    } else {
+        for (auto a : {"qemu-system-arm", "-machine", "mps2-an385", "-nographic",
+                       "-semihosting", "-no-reboot", "-kernel"})
+            mcpp::runner(a);
+    }
+    return 0;
+}
+```
+
+```toml
+[dependencies]
+cortex-m-rt = { version = "0.1.0", features = ["hardware"] }
+```
+
+The consumer's command does not change. A runner the chosen environment does not
+supply stays absent: an emulator has no debug probe, so under the emulator
+feature `mcpp run --runner debug` reports that no such runner exists and lists
+the ones that do.
+
+⭐ This required no engine mechanism. The engine reads runners and knows nothing
+about emulators or probes; `mcpp::has_feature` already existed. That the
+question is answerable without adding anything is the layering working as
+specified.
diff --git a/docs/19-supported-versions.md b/docs/19-supported-versions.md
new file mode 100644
index 00000000..fc43b40f
--- /dev/null
+++ b/docs/19-supported-versions.md
@@ -0,0 +1,90 @@
+# 19 — Supported Versions and Compatibility
+
+This document states which releases are supported, for how long, and what may
+change between them. It exists because a project adopting mcpp is asked these
+questions by its own review process, and an answer that lives only in
+maintainers' heads cannot be cited.
+
+## Versioning
+
+Releases are named `YYYY.M.D.N` — the date of the release and the ordinal of
+that day's release. The scheme carries no compatibility promise in its digits:
+`2026.9.4.1` is not "a minor release" of `2026.9.3.2`. What may and may not
+change is stated below rather than encoded in the number.
+
+## What is supported
+
+| | |
+|---|---|
+| **Supported** | the most recent release |
+| **Security-fixed** | the most recent release, and the last release of the preceding calendar month |
+| **Unsupported** | everything older |
+
+A release is superseded rather than withdrawn. Published assets and index
+entries for older versions remain in place, because a project may have pinned
+one and removing it would break a build that was working.
+
+## What may change between releases
+
+The engine's own interfaces are not all equally stable, and the difference is
+worth stating precisely.
+
+| Surface | Stability |
+|---|---|
+| `mcpp.toml` keys | Additive. An existing key keeps its meaning; an unrecognised key is reported, never silently ignored |
+| CLI commands and flags | Additive. A removed spelling is kept as an alias |
+| Machine output (`--message-format json`) | Versioned by `schemaVersion`; see [11](11-machine-output.md) |
+| `build.mcpp` directive protocol | Versioned; see `kProtocolVersion`. An engine refuses a program declaring a **higher** version rather than guessing |
+| `mcpp.lock` format | Versioned by `schemaVersion`; older files are migrated on read |
+| Target table rows | Additive. A row's tier may rise; a row is not removed while a published package targets it |
+| Build fingerprints, cache layout, `target/` contents | **Not an interface.** These change without notice, and nothing should parse them |
+
+⚠️ A `build.mcpp` calling a function its engine's bundled `mcpp` module does not
+have fails at the **compile** of the build program, not through a protocol
+error. The protocol number governs directives on the wire; the typed API is
+governed by which engine is installed. Both are stated here because the failure
+a package author sees depends on which one they crossed.
+
+## Reproducing a build
+
+`mcpp.lock` records what a build resolved. `--locked` asserts that a resolution
+matches it and fails naming the package that moved:
+
+```
+error: --locked was given and this resolution differs from mcpp.lock:
+         mcpplibs.cmdline 0.0.1 -> 0.0.2
+```
+
+A release build, an audit or a CI job should pass `--locked`. It disables the
+build fast path, so the assertion always runs.
+
+⚠️ The lock does not yet constrain resolution — it records and verifies it.
+Pinning a resolution to the lock as an input is a separate change to the
+resolver.
+
+## Bill of materials
+
+`mcpp emit sbom` writes a CycloneDX 1.5 document describing the **recorded**
+resolution:
+
+```bash
+mcpp emit sbom -o sbom.json
+```
+
+It reads `mcpp.lock` rather than resolving again, because a document describing
+a different graph from the one that was built is worse than no document. A
+component whose licence mcpp does not know is emitted as `NOASSERTION` rather
+than omitted: an absent field reads as "not examined".
+
+## Offline and air-gapped use
+
+`--offline` (or `MCPP_OFFLINE=1`) prevents every network access: index refresh,
+package download and toolchain installation. A build that would need one of
+those fails naming what it needed, rather than reaching out.
+
+## Reporting a problem
+
+Defects and security reports go to the issue tracker of the repository that
+owns the component — the engine, the package index, or the package itself. A
+report that names the version, the host, the target and the command is
+actionable; one that does not usually results in a request for those four.
diff --git a/docs/README.md b/docs/README.md
index b371328f..3f32410d 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -20,6 +20,8 @@
 - [15 - Cross-Compilation Over openkal](15-openkal-cross.md)
 - [16 - The Target Triple](16-the-target-triple.md)
 - [17 - The Project Environment](17-the-project-environment.md)
+- [18 - Reaching a Device](18-devices.md)
+- [19 - Supported Versions and Compatibility](19-supported-versions.md)
 
 ## Specifications
 
diff --git a/docs/zh/05-mcpp-toml.md b/docs/zh/05-mcpp-toml.md
index afd7aa45..e6ea54c2 100644
--- a/docs/zh/05-mcpp-toml.md
+++ b/docs/zh/05-mcpp-toml.md
@@ -1637,6 +1637,57 @@ mcpp 既供给它——机器上没有就装,有就映射——也把它物化
 文件说后者),**凡是点名平台的地方两者都接受**。表里既没有本机这一项也没有
 `default`,就表示在这里什么都不声明。
 
+#### `when` —— 哪些命令需要这个工具(mcpp 2026.9.4.2+)
+
+```toml
+[xlings.workspace]
+"xim:qemu-arm"   = "9.2.4-1"                             # 每次构建都装,与从前一样
+"xim:codegen"    = { version = "1.0",    when = "build" }
+"xim:probe-rs"   = { version = "0.24.0", when = "run"   }
+"xim:clang-tidy" = { version = "20",     when = "dev"   }
+```
+
+包依赖从一开始就有这条轴 —— `[dependencies]`、`[build-dependencies]`、
+`[dev-dependencies]`。工具只有一张表,于是一个同时点名模拟器与调试探针的板级支持包
+会把两个都装给每一位消费者,包括只想把库编出来的那一位。
+
+| `when` | 由谁安装 | 是否传播到消费者 |
+|---|---|---|
+| *(不写)* | 每个构建命令 | 是 |
+| `build` | 每个构建命令 | 是 |
+| `run` | `mcpp run`、`mcpp test` | 是 |
+| `dev` | 只有声明它的那个包作为根时 | **否** |
+
+**不写 `when` 就是 2026.9.4.2 之前的行为**,所以没有任何清单需要改。收窄是可选动作,
+不是作者必须回答的新问题。
+
+`dev` 是唯一不传播的一档。它的含义是「声明它的那个包自己在被开发时」,所以依赖的
+`dev` 条目永远不会为消费者安装。其余各档都会到达消费者 —— 这正是板级包知道自己机器
+的意义:它声明一次模拟器,每一位消费者都拿得到。
+
+档位写在**条目**上而不是另开一张表,理由与 `[dependencies]` 同时接受 `dep = "1.0"`
+和 `dep = { version = "1.0", features = [...] }` 是同一条。带档位的条目**必须**写出
+`version`,哪怕留空(`version = ""` 表示「存在即可,版本不限」)—— 否则
+`{ when = "run" }` 与写错的 `version` 键无法区分。
+
+#### `[feature-xlings.<feature>]` —— 某个 feature 才需要的工具
+
+```toml
+[features]
+default  = ["emulator"]
+emulator = {}
+hardware = {}
+
+[feature-xlings.hardware]
+"xim:probe-rs" = "0.24.0"
+```
+
+同一张表,按 feature 门控,拼法沿用 `[feature-deps.<feature>]`。**不要 `hardware`
+的消费者永远不会下载探针驱动。** 这里的条目同样接受 `when`。
+
+`[features]` 里没有声明过的 feature 名会作为 schema 警告报出:它对谁都不激活、什么
+都不装,而这种工具的缺席只表现为「设备就是连不上」,是最难诊断的一种。
+
 #### 工程没点名的工具,其版本的来源
 
 | 工程声明了 | 版本来自 |
diff --git a/docs/zh/13-baremetal.md b/docs/zh/13-baremetal.md
index ee57def5..e07767f7 100644
--- a/docs/zh/13-baremetal.md
+++ b/docs/zh/13-baremetal.md
@@ -11,7 +11,7 @@
 ## 概述
 
 freestanding 目标是 `os` 字段为 `none` 的目标。`modules/toolchain-model/src/triple.cppm`
-的目标表中有十一个:
+的目标表中有十三个:
 
 | Triple | 档位 | C 库 |
 |---|---|---|
@@ -26,10 +26,25 @@ freestanding 目标是 `os` 字段为 `none` 的目标。`modules/toolchain-mode
 | `thumbv8m.base-none-eabi` | preview | 默认无 —— Cortex-M23 |
 | `thumbv8m.main-none-eabi` | verified | 默认无 —— Cortex-M33/M55,软浮点 |
 | `thumbv8m.main-none-eabihf` | preview | 默认无 —— Cortex-M33F/M55F,硬浮点 |
+| `armv7a-none-eabi` | verified | 默认无 —— Cortex-A 32 位,软浮点 |
+| `armv7a-none-eabihf` | verified | 默认无 —— Cortex-A 32 位,硬浮点 |
 
 `verified` 意味着该行的镜像被构建**并被运行**过。`preview` 意味着它构建并链接得出,
 尚无模拟器运行记录。
 
+### ARMv7-A 是第一个带内存管理单元的 32 位行
+
+上表其余每一个 32 位行都是 M-profile:MPU 按基址与上限描述区域,根本没有页表项。
+A-profile 有真正的 MMU 与页表走查器,所以它是第一个能被问「**32 位**机器的页表项长
+什么样」的目标 —— 短描述符 32 位宽,长描述符(LPAE)64 位。这个问题无法向一台没有
+页表项的机器提出,这正是 `openarch` 的 Cortex-M 后端不声明该能力的原因。
+
+**半主机的退出调用与 M-profile 的拼法不同。** AArch32 的 `SYS_EXIT`(`0x18`)把
+原因码**直接**放在 `r1` 里;Cortex-M 板级代码传的那个 `{reason, code}` 块是
+`SYS_EXIT_EXTENDED`(`0x20`),它存在的理由正是 32 位的 `r1` 装不下两者。实测:把
+块传给 `0x18`,打印正确而**退出状态是错的** —— 只看输出的板子看不出这个差别。这是
+**板**的事实而不是目标的事实,记在这里是因为下一个写这种板的人会来这里找。
+
 ### M-profile 是七行而不是一行
 
 上面每一个裸机族都是一个架构一行。Cortex-M 不是:为 `thumbv7em` 构建的目标文件
diff --git a/docs/zh/17-the-project-environment.md b/docs/zh/17-the-project-environment.md
index 42eff23c..cea034c7 100644
--- a/docs/zh/17-the-project-environment.md
+++ b/docs/zh/17-the-project-environment.md
@@ -122,7 +122,11 @@ create/bootstrap that environment instead of falling back to active/default
 `deps = [{ linux = "qemu-user-aarch64" }]` 在 Linux 上声明这个模拟器,在别处什么都不声明。
 键与解析规则见第 5 章 §2.13。
 
-**runner。** `[xlings] deps` 下的程序也是 `[target.<triple>].runner` 查找其第一个元素
+**哪些命令会安装它。** 一条条目可以带档位 —— `{ version = "0.24.0", when = "run" }` ——
+`[feature-xlings.<feature>]` 则把工具挂在某个 feature 上。用不到的工具因此不会被下载:
+见第 5 章 §2.13。不写档位就是从前的行为。
+
+**runner。** `[xlings.workspace]` 下的程序也是 `[target.<triple>].runner` 查找其第一个元素
 的首选位置,在 `PATH` 之前(第 5 章 §2.7.3)。两个键合起来,在 CI 宿主上供给用户态模拟器,
 并通过它执行交叉构建的产物,而清单不必写出载荷的路径。
 
@@ -133,7 +137,8 @@ create/bootstrap that environment instead of falling back to active/default
 | 程序链接的库 | `[dependencies]` |
 | 编译器 | `[toolchain]`,第 3 章 |
 | 依赖产出的宿主工具 | `tools = [...]`,第 7 章 |
-| 环境里要有的工具 | `[xlings] deps` |
+| 环境里要有的工具 | `[xlings.workspace]` |
+| 只有某个命令或某个 feature 需要的工具 | `when = "run"`、`[feature-xlings.<f>]` |
 | 用哪个环境 | `[xlings] subos` |
 
 ## 7. 相关章节
diff --git a/docs/zh/18-devices.md b/docs/zh/18-devices.md
new file mode 100644
index 00000000..b1fd5e10
--- /dev/null
+++ b/docs/zh/18-devices.md
@@ -0,0 +1,129 @@
+# 18 - 抵达一台设备
+
+本文规定 mcpp 如何执行一个运行在构建机器之外的产物、包如何提供抵达它的其他方式,
+以及工程如何在模拟器与真实硬件之间选择。
+
+相关文档:[13 - 裸机与 freestanding 目标](13-baremetal.md) · [07 - build.mcpp](07-build-mcpp.md)
+· [11 - 机器输出](11-machine-output.md)。
+
+## 一条命令,加具名的例外
+
+无法在构建机器上运行的产物需要有东西站在它前面。那个东西叫 **runner**:包提供、
+工具执行的一段 argv,产物被追加或替换 `{}`。
+
+```bash
+mcpp run                        # 默认 runner
+mcpp run --runner flash         # 具名的
+mcpp run --list-runners         # 这个工程提供了哪些
+mcpp why runners                # 同一份清单,与其余解析结果并列
+```
+
+**`mcpp run` 覆盖了常见情形的全部,真实硬件也一样。** 在设备上,「运行一个程序」
+意味着写进去、复位、接上它的输出、读回退出状态 —— 这是**一条**命令
+(`probe-rs run`、`qemu-system-* -kernel`),不是几条。因此板级包把它作为**默认**
+runner,于是开发者从模拟器换到真板时,敲的命令不变。
+
+具名 runner 服务剩下的部分:只写不跑、看串口、起调试服务端、擦片、部署但不启动。
+
+⚠️ **引擎不认识任何 runner 名字。** `flash`、`serve`、`deploy`、`submit`、
+`logcat` 对它一样陌生:它只知道「包可以提供具名 runner」这件事,然后执行它找到的
+argv。**引擎里若有一份固定的名字表,就等于由引擎决定哪些领域可被表达。**
+
+## 包提供什么
+
+```cpp
+mcpp::runner("qemu-system-arm");        // 默认:一次一个 token
+mcpp::runner("-machine"); mcpp::runner("mps2-an385"); …
+
+mcpp::runner("flash", "probe-rs");      // 具名 runner
+mcpp::runner("flash", "download"); …
+
+mcpp::runner_longlived("monitor");      // 没有自然终点
+mcpp::run_exclusive();                  // 这个目标的运行不能重叠
+```
+
+⭐ **写程序名,不要写路径。** mcpp 会定位它:先找**图中任何一个包**在
+`[xlings] deps` 里声明的载荷的 `bin/`(消费工程优先,然后是它的依赖),再找 `PATH`。
+板级包正是那个知道「哪个模拟器或探针能抵达这台机器」的东西,所以由它声明,
+**消费者什么都不用声明**。用 `mcpp::xpkg_dir` 拼绝对路径是多余的,而且引入了一个
+失败模式 —— **声明不是安装**,查询可能返回空,于是没有配置任何 runner 而没有任何
+话说明原因。写程序名则让 mcpp 报出它究竟搜过哪些目录。
+
+## 工程覆盖什么
+
+```toml
+[target.thumbv7em-none-eabihf]
+runner = ["qemu-system-arm", "-machine", "mps2-an385", "-kernel"]
+
+[target.thumbv7em-none-eabihf.runners]
+flash   = ["probe-rs", "download", "--verify", "--chip", "STM32L475VG", "{}"]
+monitor = ["probe-rs", "attach", "--chip", "STM32L475VG"]
+```
+
+优先级是通常那个:工程作者写的胜过依赖提供的,且覆盖会被报告。一个名字只允许一个
+依赖提供,第二个是点名两个包的错误。
+
+## 是否终止由声明决定,不由推断
+
+| | 含义 |
+|---|---|
+| 默认 | 运行到结束;退出码即判决 |
+| `runner_longlived(name)` | 没有自然终点;由操作者结束 |
+
+`openocd -c "program image.elf verify reset exit"` 会终止,`openocd -c "init"`
+不会,两者拼写直到包所选的那个参数为止都一样。没有任何 argv 能表达这个区别,而引擎
+也没有一份名字表可供推断 —— 所以由包陈述。
+
+`mcpp run --runner debug` 启动一个**服务端**,到此为止。连上去的客户端是用户的
+调试器或 IDE,它通过机器输出协议获得所需。
+
+## 不能重叠的运行
+
+`mcpp test` 在工作者池上跑测试二进制。一块板配一个探针、一张 GPU、一个串口、
+一个单席位 license 的工具,都一次只容一个使用者;两个工作者去够它不会干净地失败
+—— 它们互相穿插,产生的判决不描述其中任何一个测试。
+
+包用 `mcpp::run_exclusive()` 说出这件事,`mcpp test` 于是串行化。工程永远不必记得
+`-j1`。
+
+**按性质命名而不按硬件命名**:这里没有一处是关于「设备」的。
+
+## 模拟器与硬件是同一个包
+
+经模拟器抵达的板,与经调试探针抵达的同一块板,差别只在 runner 的 argv,别无其他。
+链接脚本、启动代码、内存映射与导出的模块都是同一块板。为变化几个字符串而发布两个
+包,会把这一切复制一遍并让副本漂移。
+
+```toml
+[features]
+default  = ["emulator"]
+emulator = {}
+hardware = {}
+```
+
+```cpp
+if (mcpp::has_feature("hardware")) {
+    for (auto a : {"probe-rs","run","--chip","STM32L475VG"})
+        mcpp::runner(a);                       // 移动的是**默认**
+    for (auto a : {"probe-rs","gdb","--chip","STM32L475VG"})
+        mcpp::runner("debug", a);
+    mcpp::runner_longlived("debug");
+    mcpp::run_exclusive();
+} else {
+    for (auto a : {"qemu-system-arm","-machine","mps2-an385","-nographic",
+                   "-semihosting","-no-reboot","-kernel"})
+        mcpp::runner(a);
+}
+```
+
+```toml
+[dependencies]
+cortex-m-rt = { version = "0.1.0", features = ["hardware"] }
+```
+
+**消费者的命令不变。** 所选环境不提供的 runner 保持缺席:模拟器没有调试探针,
+于是在 emulator 之下 `mcpp run --runner debug` 报告没有这个 runner,并列出有哪些。
+
+⭐ **这不需要任何引擎机制。** 引擎读 runner,对模拟器与探针一无所知;
+`mcpp::has_feature` 本来就在。**一个问题不必新增任何东西就能回答,是分层按规定在
+起作用。**
diff --git a/docs/zh/19-supported-versions.md b/docs/zh/19-supported-versions.md
new file mode 100644
index 00000000..4ce51722
--- /dev/null
+++ b/docs/zh/19-supported-versions.md
@@ -0,0 +1,78 @@
+# 19 - 受支持的版本与兼容性
+
+本文陈述哪些发布受支持、支持多久、以及版本之间什么可以变化。它之所以存在,是因为
+一个采用 mcpp 的工程会被它自己的评审流程问到这些问题,而只活在维护者脑子里的答案
+无法被引用。
+
+## 版本号
+
+发布以 `YYYY.M.D.N` 命名 —— 发布日期,加上当天发布的序号。这套方案的数字**不携带
+任何兼容性承诺**:`2026.9.4.1` 不是 `2026.9.3.2` 的「小版本」。什么可以变、什么
+不可以,由下文陈述,而不是编码在数字里。
+
+## 支持范围
+
+| | |
+|---|---|
+| **受支持** | 最新的一个发布 |
+| **安全修复** | 最新的发布,以及上一个自然月的最后一个发布 |
+| **不受支持** | 更旧的一切 |
+
+一个发布是被取代,而不是被撤回。更旧版本的已发布资产与索引条目原样保留,因为某个
+工程可能钉住了它,移除会弄坏一个本来正常的构建。
+
+## 版本之间什么可以变化
+
+引擎自身的各个接口稳定性并不相同,这个差别值得精确陈述。
+
+| 面 | 稳定性 |
+|---|---|
+| `mcpp.toml` 的键 | 只增。既有键保持其含义;无法识别的键会被报告,绝不静默忽略 |
+| CLI 命令与旗标 | 只增。被取代的拼写保留为别名 |
+| 机器输出(`--message-format json`) | 由 `schemaVersion` 版本化,见 [11](11-machine-output.md) |
+| `build.mcpp` 指令协议 | 版本化,见 `kProtocolVersion`。引擎遇到声明**更高**版本的程序会拒绝,而不是猜测 |
+| `mcpp.lock` 格式 | 由 `schemaVersion` 版本化;更旧的文件在读取时迁移 |
+| 目标表的行 | 只增。一行的档位可以上升;只要还有已发布的包以它为目标,该行不会被移除 |
+| 构建指纹、缓存布局、`target/` 的内容 | **不是接口。** 它们不经通知即变化,任何东西都不应解析它们 |
+
+⚠️ 一个调用了其引擎自带 `mcpp` 模块中不存在的函数的 `build.mcpp`,失败发生在构建
+程序的**编译**期,而不是通过协议错误。协议号管的是线上的指令;类型化 API 由装的是
+哪个引擎决定。两者都写在这里,是因为包作者看到的失败取决于他越过了哪一条。
+
+## 复现一次构建
+
+`mcpp.lock` 记录一次构建解析出了什么。`--locked` 断言解析与它一致,不一致则失败并
+点名移动了的那个包:
+
+```
+error: --locked was given and this resolution differs from mcpp.lock:
+         mcpplibs.cmdline 0.0.1 -> 0.0.2
+```
+
+发布构建、审计或 CI 作业应当传 `--locked`。它会关掉构建快路径,因此断言总会跑到。
+
+⚠️ 锁**尚未约束**解析 —— 它记录并校验解析。把锁作为解析的输入来钉住它,是对解析器
+的另一项改动。
+
+## 物料清单
+
+`mcpp emit sbom` 写出一份描述**已记录**解析的 CycloneDX 1.5 文档:
+
+```bash
+mcpp emit sbom -o sbom.json
+```
+
+它读 `mcpp.lock` 而不是重新解析,因为一份描述了与所构建者不同的图的文档,比没有
+文档更糟。mcpp 不知道其许可证的组件被写成 `NOASSERTION` 而不是省略:缺席的字段
+读起来像「未检查」。
+
+## 离线与内网使用
+
+`--offline`(或 `MCPP_OFFLINE=1`)阻止一切网络访问:索引刷新、包下载与工具链安装。
+需要其中之一的构建会点名它所需要的东西然后失败,而不是伸手出去。
+
+## 报告问题
+
+缺陷与安全报告提交到拥有该组件的仓库的 issue tracker —— 引擎、包索引,或者那个包
+自身。一份点明了版本、宿主、目标与命令的报告是可执行的;没有这四样的报告通常换来
+一次索要它们的回复。
diff --git a/docs/zh/README.md b/docs/zh/README.md
index 5db3b231..1ec50d47 100644
--- a/docs/zh/README.md
+++ b/docs/zh/README.md
@@ -20,6 +20,8 @@
 - [15 - 基于 openkal 的交叉构建](15-openkal-cross.md)
 - [16 - 目标三元组](16-the-target-triple.md)
 - [17 - 项目环境](17-the-project-environment.md)
+- [18 - 抵达一台设备](18-devices.md)
+- [19 - 受支持的版本与兼容性](19-supported-versions.md)
 
 ## 规范文档
 
diff --git a/mcpp.toml b/mcpp.toml
index 5427c6bd..3543b1cf 100644
--- a/mcpp.toml
+++ b/mcpp.toml
@@ -1,6 +1,6 @@
 [package]
 name        = "mcpp"
-version = "2026.9.4.1"
+version = "2026.9.4.2"
 description = "Modern C++ build & package management tool"
 license     = "Apache-2.0"
 authors     = ["mcpp-community"]
diff --git a/modules/buildmcpp/src/directives.cppm b/modules/buildmcpp/src/directives.cppm
index e61825f8..30cf3d73 100644
--- a/modules/buildmcpp/src/directives.cppm
+++ b/modules/buildmcpp/src/directives.cppm
@@ -76,6 +76,28 @@ enum class Slot : std::size_t {
     // is neither a compile input nor a link input, and putting it in LdFlags
     // would put an emulator's argv on the linker command line.
     Runner,
+    // ⭐⭐ A NAMED WAY OF REACHING THE ARTEFACT. ONE SLOT, ANY NUMBER OF NAMES.
+    //
+    // `Runner` above is the default — how the artefact is EXECUTED. Writing it
+    // to a device, watching what it prints, starting a debug server, deploying
+    // it, serving it: all the same shape, an argv the PACKAGE supplies, and the
+    // only thing that distinguishes them is a name.
+    //
+    // ⚠️ THE NAME IS DATA. An earlier version gave `flash`, `monitor` and
+    // `debug` their own slots — which put EMBEDDED vocabulary in the engine,
+    // so a web package could not add `serve` nor a cluster package `submit`
+    // without an engine release. The value here is `<name>:<token>`, one token
+    // per line as argv requires, and the engine never learns a name.
+    NamedRunner,
+    // Marks a named runner as having no natural end (`<name>`). Declared rather
+    // than derived: `openocd -c "program … exit"` terminates and
+    // `openocd -c "init"` does not, spelled alike up to the argument the
+    // package chose, and deriving it from a name would work only for names the
+    // engine knows.
+    RunnerLongLived,
+    // Not an argv: a package stating that this target's device admits one user
+    // at a time. See `BuildConfig::runExclusive`.
+    RunExclusive,
     CxxFlags,
     CFlags,
     LdFlags,
@@ -104,6 +126,15 @@ enum class Slot : std::size_t {
 };
 inline constexpr std::size_t kSlotCount = static_cast<std::size_t>(Slot::Count);
 
+// ⚠️ THERE IS DELIBERATELY NO LIST OF ACTION NAMES HERE.
+//
+// An earlier version carried `kDeviceSlots`, `device_slot_name()` and a
+// `Semantics` function switching on four hardcoded values. Every one of them
+// was a place the engine decided which domains were expressible. What replaced
+// them is a map keyed by whatever a package wrote, and a `longLived` flag the
+// package sets — so `flash`, `serve`, `submit` and `logcat` are the same kind
+// of thing to this file, which is to say: nothing it knows about.
+
 // Who sees the value. The field that must be answered for every new directive.
 enum class Scope {
     PackagePrivate,  // only this package's own TUs — never propagated to consumers
@@ -166,7 +197,7 @@ struct Def {
     int              sinceProtocol;
 };
 
-inline constexpr std::array<Def, 16> kTable{{
+inline constexpr std::array<Def, 19> kTable{{
     //  wire                    tag                  slot                    scope                  transform                must   missingPrefix                 missingSuffix                                    since
     {"cxxflag",             "cxxflag",           Slot::CxxFlags,         Scope::PackagePrivate, Transform::Verbatim,      false, "",                           "",                                              1},
     {"cflag",               "cflag",             Slot::CFlags,           Scope::PackagePrivate, Transform::Verbatim,      false, "",                           "",                                              1},
@@ -212,6 +243,9 @@ inline constexpr std::array<Def, 16> kTable{{
     // OWNER home — measured in CI as `xlings: '…' is not installed` from a job
     // where the same name had answered `--version` two steps earlier.
     {"runner",              "runner",            Slot::Runner,           Scope::RunGlobal,      Transform::Verbatim,      false, "",                           "",                                              4},
+    {"runner-named",        "runner-named",      Slot::NamedRunner,      Scope::RunGlobal,      Transform::Verbatim,      false, "",                           "",                                              6},
+    {"runner-longlived",    "runner-longlived",  Slot::RunnerLongLived,  Scope::RunGlobal,      Transform::Verbatim,      false, "",                           "",                                              6},
+    {"run-exclusive",    "run-exclusive",  Slot::RunExclusive,  Scope::RunGlobal,      Transform::Verbatim,      false, "",                           "",                                              6},
     {"link-script",         "ldflag",            Slot::LdFlags,          Scope::LinkGlobal,     Transform::LinkerScript,  false, "",                           "",                                              3},
     {"include-dir",         "include-dir",       Slot::IncludeDirs,      Scope::PackagePrivate, Transform::AbsPath,       false, "",                           "",                                              1},
     {"include-dir-after",   "include-dir-after", Slot::IncludeDirsAfter, Scope::PackagePrivate, Transform::AbsPath,       false, "",                           "",                                              1},
@@ -675,6 +709,20 @@ void apply(mcpp::manifest::Manifest& m, const Directives& d) {
     bc.ldflags.insert(bc.ldflags.end(), ld.begin(), ld.end());
     // Appended in emission order — the tokens ARE the argv.
     bc.runner.insert(bc.runner.end(), runner.begin(), runner.end());
+    // ⭐ `<name>:<token>`, split on the FIRST colon. A token may contain colons
+    // (a Windows path, a URL); a name may not, which is what makes the first
+    // one unambiguous.
+    for (auto const& entry : d.at(Slot::NamedRunner)) {
+        auto sep = entry.find(':');
+        if (sep == std::string::npos || sep == 0) continue;
+        bc.namedRunners[entry.substr(0, sep)].argv.push_back(entry.substr(sep + 1));
+    }
+    for (auto const& name : d.at(Slot::RunnerLongLived))
+        bc.namedRunners[name].longLived = true;
+    // ⚠️ ANY non-empty value sets it, and nothing can unset it. Exclusivity is a
+    // claim about the DEVICE: if one package knows the target is a mutex, it is
+    // one, and a later package saying nothing must not relax that.
+    if (!d.at(Slot::RunExclusive).empty()) bc.runExclusive = true;
     // cfg defines colour BOTH language channels — the one slot that fans out.
     bc.cflags.insert(bc.cflags.end(), defines.begin(), defines.end());
     bc.cxxflags.insert(bc.cxxflags.end(), defines.begin(), defines.end());
diff --git a/modules/buildmcpp/src/program_protocol.cppm b/modules/buildmcpp/src/program_protocol.cppm
index f674f675..058eaaa9 100644
--- a/modules/buildmcpp/src/program_protocol.cppm
+++ b/modules/buildmcpp/src/program_protocol.cppm
@@ -51,7 +51,12 @@ export namespace mcpp::build::program_protocol {
 // COMPILE, because the bundled module that engine ships has no such function.
 // That is the same cost `link-script` carried into v3 and is stated here so
 // the next reader does not look for a protocol path that never runs.
-inline constexpr int kProtocolVersion = 5;
+// v6: adds `flash`, `monitor`, `debug` and `runner-exclusive` — `runner`'s
+// three siblings and the claim that a device admits one user at a time. Same
+// cost as v5's: a package calling `mcpp::flash()` fails on an older engine at
+// the build.mcpp COMPILE, because that engine's bundled module has no such
+// function, not through a protocol refusal.
+inline constexpr int kProtocolVersion = 6;
 
 // ── Cache-format epoch ─────────────────────────────────────────────────────
 //
diff --git a/modules/manifest/src/toml.cppm b/modules/manifest/src/toml.cppm
index 465945a3..48c63ba3 100644
--- a/modules/manifest/src/toml.cppm
+++ b/modules/manifest/src/toml.cppm
@@ -240,6 +240,69 @@ inline XlingsEntry parse_address(std::string_view address) {
     return XlingsEntry{ ns, target, std::string(version) };
 }
 
+// An entry's value, split into the part that names a version and the tier that
+// part belongs to.
+//
+// ⭐ `{ version = "…", when = "…" }` IS THE SAME SHAPE A DEPENDENCY ALREADY
+// HAS. mcpp writes `dep = "1.0"` or `dep = { version = "1.0", features = [] }`,
+// and a tool entry now writes `"xim:probe-rs" = "0.24.0"` or
+// `{ version = "0.24.0", when = "run" }`. One table, richer entries — rather
+// than a second table per tier, which `[xlings.workspace]` was made the one
+// table specifically to avoid.
+//
+// The two spellings cannot be confused. A platform table's keys are `linux`,
+// `macosx`, `macos`, `windows` and `default`; the scoped table's are `version`
+// and `when`, and neither set contains a member of the other. So the presence
+// of either key decides, and the `version` it carries may itself be a platform
+// table.
+struct WhenSplit {
+    const mcpp::libs::toml::Value* value = nullptr;   // string, or platform table
+    ToolWhen                       when  = ToolWhen::Always;
+};
+
+inline std::expected<ToolWhen, std::string> parse_when(std::string_view w) {
+    if (w == "build")  return ToolWhen::Build;
+    if (w == "run")    return ToolWhen::Run;
+    if (w == "dev")    return ToolWhen::Dev;
+    if (w == "always") return ToolWhen::Always;
+    return std::unexpected(std::format(
+        "when = '{}' is not a tier; expected 'build', 'run' or 'dev' "
+        "(omit it for the default, which is every build)", w));
+}
+
+inline std::expected<WhenSplit, std::string>
+split_when(const mcpp::libs::toml::Value& v) {
+    if (!v.is_table()) return WhenSplit{ &v, ToolWhen::Always };
+    const auto& t = v.as_table();
+    auto itVer  = t.find("version");
+    auto itWhen = t.find("when");
+    if (itVer == t.end() && itWhen == t.end())
+        return WhenSplit{ &v, ToolWhen::Always };   // a platform table
+    // ⚠️ A SCOPED ENTRY MUST NAME ITS VERSION KEY EVEN TO LEAVE IT EMPTY.
+    // `{ when = "run" }` alone reads as "present, unconstrained, run tier",
+    // which is a meaningful thing to say — but so is a typo of `version`, and
+    // the two would be indistinguishable. The key is required, `""` says
+    // unconstrained, and a table carrying anything else is refused by name.
+    for (auto const& [k, _] : t)
+        if (k != "version" && k != "when")
+            return std::unexpected(std::format(
+                "unknown key '{}' in a scoped entry; expected 'version' and "
+                "'when'", k));
+    if (itVer == t.end())
+        return std::unexpected(std::string(
+            "a scoped entry needs 'version' (write version = \"\" for "
+            "\"present, any version\")"));
+    WhenSplit out{ &itVer->second, ToolWhen::Always };
+    if (itWhen != t.end()) {
+        if (!itWhen->second.is_string())
+            return std::unexpected(std::string("'when' must be a string"));
+        auto w = parse_when(itWhen->second.as_string());
+        if (!w) return std::unexpected(w.error());
+        out.when = *w;
+    }
+    return out;
+}
+
 // Combine the two halves a namespace may be written on. Both may carry it;
 // disagreeing is an error rather than a precedence rule, because a precedence
 // rule would make one of the two spellings silently ineffective.
@@ -1518,7 +1581,10 @@ std::expected<Manifest, ManifestError> parse_string(std::string_view content,
         // both rather than pick one.
         std::map<std::string, std::string> writtenAs;
         for (auto& [k, val] : *wt) {
-            auto vals = platform_values(val);
+            auto scoped = split_when(val);
+            if (!scoped) return std::unexpected(error(origin,
+                std::format("[xlings.workspace] {}: {}", k, scoped.error())));
+            auto vals = platform_values(*scoped->value);
             if (!vals) return std::unexpected(error(origin,
                 std::format("[xlings.workspace] {}: {}", k, vals.error())));
             // Every platform, for the descriptor emitter. Resolved per
@@ -1544,6 +1610,65 @@ std::expected<Manifest, ManifestError> parse_string(std::string_view content,
             writtenAs.emplace(entry->target, k);
             m.xlings.workspace[entry->target] = entry->pin();
             m.xlings.deps.push_back(entry->address());
+            if (scoped->when != ToolWhen::Always)
+                m.xlings.depWhen[entry->address()] = scoped->when;
+        }
+    }
+    // `[feature-xlings.<feature>]` — the same table, gated on a feature of the
+    // package that declared it.
+    //
+    // ⭐ THE SPELLING IS `[feature-deps.<feature>]`'s, DELIBERATELY. A feature
+    // that pulls in a package and a feature that pulls in a tool are the same
+    // statement about the same feature, and inventing a second syntax for the
+    // second would make an author learn a rule that buys nothing. The keys
+    // differ because the things named differ: a package name there, an xim
+    // address here.
+    //
+    // ⚠️ A FEATURE NAME THAT NO `[features]` DECLARES IS REPORTED. A
+    // `[feature-xlings.hardwear]` activates for nobody and installs nothing,
+    // and the tool it names is the one whose absence is hardest to diagnose:
+    // the build succeeds and the device is simply never reachable.
+    //
+    // A warning rather than an error, on the same reasoning as the
+    // `[features]` schema check above — it is surfaced for the ROOT manifest
+    // before any dependency's is loaded, so a package may adopt a feature its
+    // consumers' engines do not yet know without breaking them.
+    if (auto* ft = doc->get_table("feature-xlings")) {
+        for (auto& [feature, tbl] : *ft) {
+            if (!m.featuresMap.contains(feature)) {
+                std::string known;
+                for (auto const& [f, _] : m.featuresMap) {
+                    if (!known.empty()) known += ", ";
+                    known += f;
+                }
+                m.schemaWarnings.push_back(std::format(
+                    "[feature-xlings.{}] names a feature no [features] table "
+                    "declares, so nothing it lists is ever installed. {}",
+                    feature, known.empty()
+                        ? std::string("This package declares no features.")
+                        : std::format("Declared features: {}.", known)));
+            }
+            if (!tbl.is_table())
+                return std::unexpected(error(origin, std::format(
+                    "[feature-xlings.{}] must be a table of package = version",
+                    feature)));
+            for (auto& [k, val] : tbl.as_table()) {
+                auto scoped = split_when(val);
+                if (!scoped) return std::unexpected(error(origin, std::format(
+                    "[feature-xlings.{}] {}: {}", feature, k, scoped.error())));
+                auto vals = platform_values(*scoped->value);
+                if (!vals) return std::unexpected(error(origin, std::format(
+                    "[feature-xlings.{}] {}: {}", feature, k, vals.error())));
+                auto hostValue = value_for_platform(*vals, host_platform_key());
+                if (!hostValue) continue;   // not declared on this host
+                auto entry = make_xlings_entry(k, *hostValue);
+                if (!entry) return std::unexpected(error(origin, std::format(
+                    "[feature-xlings.{}] {}: {}", feature, k, entry.error())));
+                m.xlings.featureDeps[feature].push_back(entry->address());
+                m.xlings.featurePins[entry->address()] = entry->pin();
+                if (scoped->when != ToolWhen::Always)
+                    m.xlings.depWhen[entry->address()] = scoped->when;
+            }
         }
     }
     if (doc->get("xlings.subos")) {
@@ -2142,6 +2267,10 @@ std::expected<Manifest, ManifestError> parse_string(std::string_view content,
             // artifact cannot execute here. An ARRAY, so it is neither a
             // scalar (the unknown-key sweep below skips it by type) nor part
             // of the conditional sub-table channel.
+            // `runner` — the argv template `mcpp run` uses for a target whose
+            // artefact cannot execute here. An ARRAY, so it is neither a
+            // scalar (the unknown-key sweep below skips it by type) nor part
+            // of the conditional sub-table channel.
             if (auto it = body.find("runner"); it != body.end()) {
                 if (!it->second.is_array()) {
                     return std::unexpected(error(origin, std::format(
@@ -2163,6 +2292,45 @@ std::expected<Manifest, ManifestError> parse_string(std::string_view content,
                 }
             }
 
+            // ⭐ `[target.<triple>.runners]` — the NAMED ways of reaching this
+            // target's artefact, one key per name.
+            //
+            // The engine knows none of these names. `flash`, `monitor`,
+            // `debug`, `serve`, `deploy`, `submit` are all the same thing to
+            // it: an argv a package supplies and `mcpp <name>` performs. A
+            // fixed set of keys here would decide, in the engine, which domains
+            // are expressible.
+            if (auto it = body.find("runners"); it != body.end()) {
+                if (!it->second.is_table()) {
+                    return std::unexpected(error(origin, std::format(
+                        "[target.{}].runners must be a table of name = [argv], "
+                        "e.g. [target.{}.runners] then flash = [\"probe-rs\", "
+                        "\"download\", \"{{}}\"]", triple, triple)));
+                }
+                for (auto& [name, val] : it->second.as_table()) {
+                    if (!val.is_array()) {
+                        return std::unexpected(error(origin, std::format(
+                            "[target.{}.runners].{} must be an array of strings",
+                            triple, name)));
+                    }
+                    std::vector<std::string> argv;
+                    for (auto& el : val.as_array()) {
+                        if (!el.is_string()) {
+                            return std::unexpected(error(origin, std::format(
+                                "[target.{}.runners].{} must contain only strings",
+                                triple, name)));
+                        }
+                        argv.push_back(el.as_string());
+                    }
+                    if (argv.empty()) {
+                        return std::unexpected(error(origin, std::format(
+                            "[target.{}.runners].{} is empty — an empty template "
+                            "would do nothing and report success", triple, name)));
+                    }
+                    e.namedRunners[name] = std::move(argv);
+                }
+            }
+
             // Unsupported scalar and array keys are REPORTED, not dropped.
             // `[targets.<name>]` has done this since #249; this table did not,
             // so a key that looks plausible — `cxx_runtime_tests` was the real
@@ -2204,7 +2372,8 @@ std::expected<Manifest, ManifestError> parse_string(std::string_view content,
                 if (std::ranges::find(known, key) != known.end()) continue;
                 m.schemaWarnings.push_back(std::format(
                     "[target.{}] has unsupported key '{}' (ignored). Supported keys: "
-                    "cxx_runtime, linkage, runner, sysroot, toolchain. "
+                    "cxx_runtime, linkage, runner, sysroot, toolchain, plus the "
+                    "[target.<triple>.runners] table for named runners. "
                     "Per-role contracts go in [build].cxx_runtime's table form.",
                     triple, key));
             }
diff --git a/modules/manifest/src/types.cppm b/modules/manifest/src/types.cppm
index b3239060..7581aec4 100644
--- a/modules/manifest/src/types.cppm
+++ b/modules/manifest/src/types.cppm
@@ -438,6 +438,22 @@ struct Resources {
 // Inherits the additive inputs rather than nesting them: `buildConfig.cflags`
 // is read in ~150 places, and a BuildConfig genuinely IS a set of build
 // inputs plus the selection axis and resolved policy scalars.
+// One named way of reaching the artefact.
+//
+// ⚠️ `longLived` IS DECLARED, NOT DERIVED FROM THE NAME. Whether the process
+// ends is the one thing the engine must act on and no argv can express:
+// `openocd -c "program … exit"` terminates and `openocd -c "init"` does not,
+// spelled alike up to the argument the package chose. Deriving it from a name
+// would work only for names the engine knows — the coupling this removes.
+//
+//   false  runs to completion; the exit code is the verdict
+//   true   no natural end; the operator ends it, and a non-zero status
+//          afterwards is that rather than a failure
+struct NamedRunner {
+    std::vector<std::string> argv;
+    bool                     longLived = false;
+};
+
 struct BuildConfig : BuildInputs {
     // How `mcpp run` / `mcpp test` execute an artifact this host cannot run,
     // as an argv template (the artifact path is appended, or substituted for
@@ -456,6 +472,24 @@ struct BuildConfig : BuildInputs {
     // argv that is neither one's, and it would fail at exec time with no
     // indication of which package contributed which token.
     std::vector<std::string>            runner;
+    // ⭐⭐ NAMED WAYS OF REACHING THE ARTEFACT, AND THE ENGINE KNOWS NONE OF
+    // THEIR NAMES.
+    //
+    // `runner` above is how the artefact is EXECUTED. Writing it to a device,
+    // watching what it prints, starting a debug server, deploying it, serving
+    // it — every one of those is the same shape: an argv the PACKAGE knows and
+    // a tool performs, with the artefact appended or substituted for `{}`. The
+    // only thing distinguishing them is a name.
+    //
+    // ⚠️ SO THE NAME IS DATA, NOT VOCABULARY. An earlier version of this gave
+    // `flash`, `monitor` and `debug` their own members, enum values, TOML keys
+    // and subcommands — four instances of one idea, where a fifth would have
+    // touched nine places. Worse, it put EMBEDDED vocabulary into the engine:
+    // a web package could not add `serve`, nor a cluster package `submit`,
+    // without an engine release. A map has neither problem, and every domain
+    // gets the same flow.
+    std::map<std::string, NamedRunner> namedRunners;
+    bool                                runExclusive = false;
 
     // Was `sources` WRITTEN, as opposed to merely being empty?
     //
@@ -772,6 +806,36 @@ struct RuntimeConfig {
 //
 // See .agents/docs/2026-09-03-xlings-workspace-as-the-one-table.md, and
 // .agents/docs/2026-06-29-manifest-environment-and-platform-design.md (L-1).
+
+// WHEN an entry's package is needed, which is the axis package dependencies
+// have had since the beginning (`[dependencies]` / `[build-dependencies]` /
+// `[dev-dependencies]`) and tools did not.
+//
+// ⭐ `always` IS WHAT AN ENTRY WITHOUT `when` GETS, AND IT IS TODAY'S
+// BEHAVIOUR EXACTLY. Narrowing is an optional action, never a question an
+// author has to answer, so no manifest needs to change.
+//
+// ⚠️ `dev` IS THE ONLY TIER THAT DOES NOT PROPAGATE. It means "when the package
+// that declared this is itself being developed", so a dependency's `dev` entry
+// is never installed for a consumer. The other three reach a consumer, because
+// a board-support package that knows which emulator runs its machine is
+// precisely the thing that should say so once.
+enum class ToolWhen {
+    Always,   // no `when`: provisioned by every verb that builds
+    Build,    // `mcpp build` onwards — the same as Always today, named
+    Run,      // only when the artefact is to be executed (`run`, `test`)
+    Dev       // only for the package that declared it, as the root
+};
+
+inline std::string_view to_string(ToolWhen w) {
+    switch (w) {
+        case ToolWhen::Build: return "build";
+        case ToolWhen::Run:   return "run";
+        case ToolWhen::Dev:   return "dev";
+        default:              return "always";
+    }
+}
+
 struct XlingsConfig {
     // The install addresses `[xlings.workspace]` asks for, resolved for THIS
     // host: `[<ns>:]<target>[@<version>]`. Derived rather than authored — the
@@ -796,14 +860,37 @@ struct XlingsConfig {
     // Measured while implementing this. The emitter needs the addresses and
     // never the keys, so the inner map bought nothing.
     std::map<std::string, std::vector<std::string>> workspaceByPlatform;
+    // address → tier, for every address in `deps`. An entry that wrote no
+    // `when` is absent here and reads as `Always` through `when_of` below.
+    //
+    // ⚠️ BESIDE `deps` RATHER THAN INSIDE IT. `deps` is materialised into
+    // `.xlings.json` verbatim, and that file has no such axis — folding the
+    // tier into the address would put a word xlings does not parse into a
+    // field xlings reads.
+    std::map<std::string, ToolWhen>    depWhen;
+    // `[feature-xlings.<feature>]` — the same table, gated on a feature of the
+    // package that declared it. feature → the install addresses it adds,
+    // resolved for THIS host. A consumer that never activates the feature
+    // never downloads them.
+    std::map<std::string, std::vector<std::string>> featureDeps;
+    // The pins those feature-gated entries carry, on the same axis as
+    // `workspace`: address → `[<ns>:]<version>`. Merged into the materialised
+    // `workspace` object only when the feature is active.
+    std::map<std::string, std::string> featurePins;
     std::string                        subos;      // → .xlings.json "subos"
     // Presence is semantic: an absent key selects McppDefault, while an
     // explicitly written `subos = "default"` selects NamedSubos("default").
     // A string alone cannot distinguish absence from an invalid empty value.
     bool                               subosDeclared = false;
 
+    ToolWhen when_of(std::string_view address) const {
+        auto it = depWhen.find(std::string(address));
+        return it == depWhen.end() ? ToolWhen::Always : it->second;
+    }
+
     bool empty() const {
-        return deps.empty() && workspace.empty() && !subosDeclared;
+        return deps.empty() && workspace.empty() && featureDeps.empty()
+            && !subosDeclared;
     }
 };
 
@@ -819,6 +906,12 @@ struct TargetEntry {
     // engine a different board has to fight. The artifact path is appended, or
     // substituted for `{}` when the template contains it.
     std::vector<std::string>            runner;
+    // The project's override for a NAMED runner, on the same axis as `runner`
+    // and with the same precedence: what the author of THIS project wrote beats
+    // what a dependency supplied, and the override is reported. Written as
+    // `[target.<triple>.runners]`, one key per name.
+    std::map<std::string, std::vector<std::string>> namedRunners;
+
     // #336 — per-target C++ runtime contract, same vocabulary as
     // [build].cxx_runtime and overriding it for this triple. It lives HERE,
     // beside `linkage`, rather than in the `cfg(...)` conditional channel:
diff --git a/modules/toolchain-model/src/triple.cppm b/modules/toolchain-model/src/triple.cppm
index f0be2b56..ca0e8f0f 100644
--- a/modules/toolchain-model/src/triple.cppm
+++ b/modules/toolchain-model/src/triple.cppm
@@ -394,6 +394,24 @@ inline constexpr TargetInfo kKnownTargets[] = {
     { "thumbv8m.base-none-eabi","preview",  "bare","llvm@22.1.8","",                            true  },
     { "thumbv8m.main-none-eabi","verified", "bare","llvm@22.1.8","",                            true  },
     { "thumbv8m.main-none-eabihf","preview","bare","llvm@22.1.8","",                            true  },
+    // ── ARMv7-A (Cortex-A, 32-bit) ──────────────────────────────────────────
+    //
+    // ⭐ NOT A SECOND SPELLING OF THE M ROWS. A-profile has a memory management
+    // unit and a page-table walker; M-profile has an MPU and no page-table
+    // entry at all. It is the first 32-bit machine in this table on which an
+    // address space can be described, which is precisely the question the
+    // openarch layer has never been able to ask of a 32-bit target.
+    //
+    // ⚠️ `verified` records what was RUN. Measured 2026-09-04 under
+    // `xim:qemu-arm@9.2.4-1`: both rows booted on `-M virt -cpu cortex-a15` and
+    // printed over semihosting. The soft row carries `-mfpu=none` for the
+    // reason `kThumbSoftExtra` gives, measured again on this architecture
+    // rather than carried over from M-profile.
+    //
+    // `sysroot` is empty, the zero-libc tier, exactly as for the M rows: a C
+    // library for these targets arrives from the dependency graph.
+    { "armv7a-none-eabi",      "verified",  "bare","llvm@22.1.8","",                            true  },
+    { "armv7a-none-eabihf",    "verified",  "bare","llvm@22.1.8","",                            true  },
 };
 
 inline std::span<const TargetInfo> known_targets() { return kKnownTargets; }
diff --git a/modules/versioning/src/version.cppm b/modules/versioning/src/version.cppm
index 255fcdb0..d7de998e 100644
--- a/modules/versioning/src/version.cppm
+++ b/modules/versioning/src/version.cppm
@@ -31,6 +31,6 @@ import std;
 
 export namespace mcpp {
 
-inline constexpr std::string_view MCPP_VERSION = "2026.9.4.1";
+inline constexpr std::string_view MCPP_VERSION = "2026.9.4.2";
 
 } // namespace mcpp
diff --git a/src/build/execute.cppm b/src/build/execute.cppm
index 3b31423c..15b4f8b2 100644
--- a/src/build/execute.cppm
+++ b/src/build/execute.cppm
@@ -17,6 +17,7 @@ import mcpp.build.plan;
 import mcpp.toolchain.triple;
 import mcpp.freestanding.runner;
 import mcpp.build.runner_lookup;    // #544: where the runner's program is
+import mcpp.build.directives;      // the device-slot table: run / flash / monitor / debug
 import mcpp.freestanding.linkline;
 import mcpp.build.graph_shape;    // #407: which mode wrote this build.ninja
 import mcpp.build.backend;
@@ -124,6 +125,20 @@ struct BuildCacheEntry {
     // pre-#544 behaviour and correct for every entry such a cache could hold
     // (a hosted runner was never consulted then, so none was ever used).
     bool runnerDeclared = false;
+    // Did the graph declare a tool on the `when = "run"` tier that this build
+    // did NOT provision?
+    //
+    // ⚠️ A BUILD INSTALLS LESS THAN A RUN NEEDS, WHICH IS THE POINT OF THE
+    // TIER AND ALSO ITS ONE HAZARD. `mcpp build` requests the build tier; a
+    // later `mcpp run` requests more. The fast path exists precisely to skip
+    // the pass that would install the difference, so an entry written by a
+    // build that saw run-tier entries is a miss for it — exactly as an entry
+    // recording a runner is.
+    //
+    // Absent on caches written before the field: false, which is correct for
+    // every entry such a cache could hold, because no manifest could express
+    // the tier.
+    bool runTierPending = false;
 };
 
 std::vector<BuildCacheEntry> read_build_cache(const std::filesystem::path& projectRoot) {
@@ -234,6 +249,11 @@ std::vector<BuildCacheEntry> read_build_cache(const std::filesystem::path& proje
             e.runnerDeclared = (line.substr(7) == "1");
             haveNextLine = static_cast<bool>(std::getline(f, line));
         }
+        // Optional `runtier=0|1`. Absent ⇒ false; see the field.
+        if (haveNextLine && line.starts_with("runtier=")) {
+            e.runTierPending = (line.substr(8) == "1");
+            haveNextLine = static_cast<bool>(std::getline(f, line));
+        }
         entries.push_back(std::move(e));
         if (!haveNextLine || line.empty()) break;
     }
@@ -259,7 +279,8 @@ void write_build_cache(const std::filesystem::path& projectRoot,
                        const std::string& cacheMode = "",
                        const mcpp::platform::runtime::RuntimeBinding& runtimeBinding = {},
                        std::vector<std::string> depSourceRoots = {},
-                       bool runnerDeclared = false) {
+                       bool runnerDeclared = false,
+                       bool runTierPending = false) {
     auto path = projectRoot / kBuildCacheFile;
     auto entries = read_build_cache(projectRoot);
 
@@ -281,6 +302,7 @@ void write_build_cache(const std::filesystem::path& projectRoot,
     newEntry.depSourceRoots = std::move(depSourceRoots);
     newEntry.depSourceRootsRecorded = true;
     newEntry.runnerDeclared = runnerDeclared;
+    newEntry.runTierPending = runTierPending;
     entries.insert(entries.begin(), std::move(newEntry));
 
     // Trim to LRU capacity.
@@ -322,6 +344,7 @@ void write_build_cache_entries(const std::filesystem::path& path,
         f << "depSourceRoots=" << e.depSourceRoots.size() << '\n';
         for (auto& r : e.depSourceRoots) f << r << '\n';
         f << "runner=" << (e.runnerDeclared ? 1 : 0) << '\n';
+        f << "runtier=" << (e.runTierPending ? 1 : 0) << '\n';
     }
 }
 
@@ -459,6 +482,7 @@ struct RunnerChoice {
     bool freestanding = false;          // an EMPTY tmpl is fatal when true
     bool fromManifest = false;          // the consumer overrode a dependency's
     bool ignored = false;               // --no-runner dropped a declared template
+    bool longLived = false;             // declared by the package; no natural end
     // The spelling that names this target in the manifest: the canonical form,
     // which is also the output directory's name and the key every
     // `[target.<triple>]` reader resolves. Every diagnostic below prints this
@@ -470,18 +494,33 @@ struct RunnerChoice {
     std::string tripleKey;
 };
 
-RunnerChoice choose_runner(const BuildContext& ctx, bool noRunner = false) {
+// ⭐⭐ ONE READER FOR FOUR SLOTS, PARAMETERISED BY THE SLOT.
+//
+// `run`, `flash`, `monitor` and `debug` resolve identically: a dependency
+// supplies a template, the project may override it on the same axis, the
+// override is reported, and the canonical triple spelling is the lookup key.
+// Every one of those four facts was learned the hard way for `runner` alone
+// (#544, and the macOS `arm64-apple-darwin24.6.0` mismatch measured on CI).
+// Copying the function three times would copy the four facts three times and
+// let them drift apart — the shape this file's own header warns about.
+//
+// `which` selects the slot; everything else is shared.
+RunnerChoice choose_device_action(const BuildContext& ctx,
+                                  std::string_view which,
+                                  bool noRunner = false) {
     RunnerChoice c;
+    const bool isDefault = which.empty();
     const auto ft = mcpp::toolchain::triple::parse(ctx.tc.targetTriple);
     if (ft) c.freestanding = ft->is_freestanding();
     c.tripleKey = ft ? ft->str() : ctx.tc.targetTriple;
-    // Two producers, ordinary precedence: what the author of THIS project
-    // wrote beats what a dependency supplied. The dependency is the normal
-    // case on bare metal (a board-support package computes the emulator's
-    // absolute path); the manifest key exists for swapping `-bios default`
-    // for `-bios none -semihosting` while debugging, and — on a hosted cross
-    // triple — for naming the user-mode emulator at all.
-    c.tmpl = ctx.manifest.buildConfig.runner;
+    // The graph's answer: the default runner, or a named one a package supplied.
+    if (isDefault) {
+        c.tmpl = ctx.manifest.buildConfig.runner;
+    } else if (auto it = ctx.manifest.buildConfig.namedRunners.find(std::string(which));
+               it != ctx.manifest.buildConfig.namedRunners.end()) {
+        c.tmpl      = it->second.argv;
+        c.longLived = it->second.longLived;
+    }
     // The manifest key is the CANONICAL spelling — `aarch64-macos`, the name
     // of the output directory and the key every other `[target.<triple>]`
     // reader uses (prepare.cppm resolves overrides by `t.str()`). The
@@ -492,15 +531,25 @@ RunnerChoice choose_runner(const BuildContext& ctx, bool noRunner = false) {
     // kept as a fallback for a triple the parser does not know.
     auto lookup = [&](std::string_view key) {
         auto it = ctx.manifest.targetOverrides.find(std::string(key));
-        return it != ctx.manifest.targetOverrides.end() && !it->second.runner.empty()
-             ? &it->second : nullptr;
+        const mcpp::manifest::TargetEntry* none = nullptr;
+        if (it == ctx.manifest.targetOverrides.end()) return none;
+        if (isDefault) return it->second.runner.empty() ? none : &it->second;
+        auto nr = it->second.namedRunners.find(std::string(which));
+        return (nr != it->second.namedRunners.end() && !nr->second.empty())
+             ? &it->second : none;
     };
     const mcpp::manifest::TargetEntry* entry = lookup(c.tripleKey);
     if (!entry && c.tripleKey != ctx.tc.targetTriple)
         entry = lookup(ctx.tc.targetTriple);
     if (entry) {
-        c.tmpl = entry->runner;
-        c.fromManifest = !ctx.manifest.buildConfig.runner.empty();
+        if (isDefault) {
+            c.fromManifest = !ctx.manifest.buildConfig.runner.empty();
+            c.tmpl = entry->runner;
+        } else {
+            c.fromManifest = ctx.manifest.buildConfig.namedRunners.contains(
+                std::string(which));
+            c.tmpl = entry->namedRunners.at(std::string(which));
+        }
     }
     // `--no-runner` is the operator on THIS host stating a host fact the
     // manifest cannot carry: the triple is native here. On a freestanding
@@ -510,6 +559,13 @@ RunnerChoice choose_runner(const BuildContext& ctx, bool noRunner = false) {
     return c;
 }
 
+RunnerChoice choose_runner(const BuildContext& ctx, bool noRunner) {
+    return choose_device_action(ctx, std::string_view{}, noRunner);
+}
+RunnerChoice choose_runner(const BuildContext& ctx) {
+    return choose_device_action(ctx, std::string_view{}, false);
+}
+
 // The capacity number, printed because capacity is the constraint.
 //
 // After `Finished`, not instead of it: the build succeeded either way, and a
@@ -705,7 +761,10 @@ export int run_build_plan(BuildContext& ctx, bool verbose, bool no_cache,
                           }(),
                           // #544: the run fast path declines an entry whose
                           // target has a runner declared — see the field.
-                          !choose_runner(ctx).tmpl.empty());
+                          !choose_runner(ctx).tmpl.empty(),
+                          // …and one written by a build that left a run-tier
+                          // tool uninstalled, for the same reason.
+                          ctx.runTierPending);
     }
 
     // The one place the --strict policy is settled. Degradations reported by
@@ -974,11 +1033,67 @@ fast_path_identity(const std::filesystem::path& projectRoot,
 
 // Try to fast-path: if build.ninja is newer than all inputs, just run ninja.
 // Returns exit code on fast-path, or nullopt if full rebuild needed.
+// ⭐ WHAT THIS PROJECT CAN DO, AS OPPOSED TO WHAT THE ENGINE SUPPORTS.
+//
+// The engine knows no runner names, so it cannot print a static list of them —
+// and that is the useful property, not a limitation. What a reader wants is
+// what THIS graph supplies, which is knowable only after resolution.
+export int list_runners(const std::string& package_filter,
+                        const std::string& cache_mode, bool no_cache,
+                        const std::string& target_triple) {
+    mcpp::build::BuildOverrides ov;
+    ov.package_filter = package_filter;
+    ov.cache_mode     = no_cache ? std::string("off") : cache_mode;
+    ov.target_triple  = target_triple;
+    // Reporting what `mcpp run` would do means resolving what `mcpp run`
+    // resolves, tool tiers included — otherwise this command would list a
+    // runner whose program it had declined to install.
+    ov.will_run       = true;
+    auto ctx = prepare_build(/*print_fp=*/false, /*includeDevDeps=*/false,
+                             /*extraTargets=*/{}, ov);
+    if (!ctx) { mcpp::ui::error(ctx.error()); return 2; }
+
+    const auto& bc = ctx->manifest.buildConfig;
+    const auto ft  = mcpp::toolchain::triple::parse(ctx->tc.targetTriple);
+    const std::string key = ft ? ft->str() : ctx->tc.targetTriple;
+    std::println("Target {}", key);
+
+    if (bc.runner.empty() && bc.namedRunners.empty()) {
+        std::println("  (none — this project reaches its artifact by executing it)");
+        return 0;
+    }
+    if (!bc.runner.empty())
+        std::println("  {:<12} {}", "(default)", bc.runner.front());
+    for (auto const& [name, nr] : bc.namedRunners) {
+        std::println("  {:<12} {}{}", name,
+                     nr.argv.empty() ? std::string("(no argv)") : nr.argv.front(),
+                     nr.longLived ? "   [long-lived]" : "");
+    }
+    if (bc.runExclusive)
+        std::println("  note: this target's runs cannot overlap; `mcpp test` "
+                     "serialises them");
+    return 0;
+}
+
 export std::optional<int> try_fast_build(const std::filesystem::path& projectRoot,
                                   bool verbose, bool no_cache,
                                   std::string_view currentTarget = "") {
     if (no_cache) return std::nullopt;
 
+    // ⚠️⚠️ `--locked` MUST NOT MEET THE FAST PATH, OR IT ASSERTS NOTHING.
+    //
+    // The check it names lives at the resolution write point, and the fast path
+    // exists precisely to skip resolution. Measured before this line existed: a
+    // deliberately corrupted mcpp.lock passed `mcpp build --locked` and printed
+    // "Finished" — the flag was accepted, the build was correct, and the
+    // assertion never ran. A criterion that is skipped is worse than one that
+    // is absent, because the green is read as a verification.
+    //
+    // Declining the fast path is the whole fix: `--locked` is for release
+    // builds, audits and CI, none of which are the case the fast path serves.
+    if (mcpp::platform::env::get("MCPP_LOCKED").value_or("") == "1")
+        return std::nullopt;
+
     auto want = fast_path_identity(projectRoot);
     if (!want) return std::nullopt;
 
@@ -1097,6 +1212,10 @@ export std::optional<int> try_fast_build(const std::filesystem::path& projectRoo
 std::optional<int> try_fast_run(const std::filesystem::path& projectRoot,
                                 const std::optional<std::string>& targetName,
                                 std::span<const std::string> passthrough) {
+    // Same reason as try_fast_build's: this path skips resolution, and
+    // `--locked` is an assertion about resolution.
+    if (mcpp::platform::env::get("MCPP_LOCKED").value_or("") == "1")
+        return std::nullopt;
     auto want = fast_path_identity(projectRoot);
     if (!want) return std::nullopt;
 
@@ -1139,6 +1258,10 @@ std::optional<int> try_fast_run(const std::filesystem::path& projectRoot,
     // other door wraps it would make the second `mcpp run` behave differently
     // from the first. The entry records the fact; the fast path declines.
     if (match->runnerDeclared) return std::nullopt;
+    // The same reasoning one axis over: this entry was written by a verb that
+    // installed less than a run needs, so taking it would execute with a
+    // declared tool absent. prepare_build provisions the difference.
+    if (match->runTierPending) return std::nullopt;
 
     auto outputDirStr = match->outputDir;
     auto ninjaProgram = match->ninjaProgram;
@@ -1279,7 +1402,12 @@ export int build_run_target(const std::optional<std::string>& targetName,
                             const std::string& cache_mode = {},
                             bool no_cache = false,
                             const std::string& target_triple = {},
-                            bool no_runner = false) {
+                            bool no_runner = false,
+                            // ⭐ The NAME of the way to reach the artefact.
+                            // Empty is the default runner — `mcpp run`. Any
+                            // other value came from `--runner <name>` and the
+                            // engine has never seen it before.
+                            std::string_view runner_name = {}) {
     // mcpp#225 (E2): reuse the resolved build cache when it's still fresh,
     // skipping prepare_build's toolchain resolution + modgraph scan
     // entirely — mirrors cmd_build's try_fast_build fast path. The cached
@@ -1295,7 +1423,18 @@ export int build_run_target(const std::optional<std::string>& targetName,
     // so with the flag there is nothing for it to ignore — and it has no
     // manifest to print the note against.
     if (package_filter.empty() && cache_mode.empty() && !no_cache
-        && target_triple.empty() && !no_runner) {
+        && target_triple.empty() && !no_runner
+        // ⚠️⚠️ THE FAST PATH IS `run`'s, AND ONLY `run`'s.
+        //
+        // It exec's the cached artefact directly — that IS its definition — so
+        // for `flash`, `monitor` or `debug` it would run the program on the
+        // BUILD HOST and report success, having done none of what was asked.
+        // Measured while writing e2e 333: `mcpp flash` printed
+        // "Running target/…/bin/p".
+        //
+        // The guard is the slot rather than a flag, because the property that
+        // makes the fast path wrong here is what the slot means.
+        && runner_name.empty()) {
         if (auto root = mcpp::project::find_manifest_root(std::filesystem::current_path())) {
             if (auto rc = try_fast_run(*root, targetName, passthrough)) {
                 return *rc;
@@ -1309,6 +1448,10 @@ export int build_run_target(const std::optional<std::string>& targetName,
     ov.package_filter = package_filter;
     ov.cache_mode     = cache_mode;
     ov.target_triple  = target_triple;
+    // This verb executes what it builds, so the `when = "run"` tool tier is
+    // part of what has to exist. `mcpp build` does not set it, which is the
+    // whole of the difference the tier buys.
+    ov.will_run       = true;
     auto ctx = prepare_build(/*print_fp=*/false, /*includeDevDeps=*/false,
                              /*extraTargets=*/{}, ov);
     if (!ctx) { std::println(stderr, "error: {}", ctx.error()); return 2; }
@@ -1366,15 +1509,50 @@ export int build_run_target(const std::optional<std::string>& targetName,
     // absolute path that a static manifest cannot. The explicit key exists for
     // the other case: swapping `-bios default` for `-bios none -semihosting`
     // while debugging, or naming `qemu-aarch64-static` for a cross target.
-    const auto choice = choose_runner(*ctx, no_runner);
+    const bool isRunSlot = runner_name.empty();
+    const std::string slotName{runner_name};
+    const auto choice = choose_device_action(*ctx, runner_name, no_runner);
     if (choice.ignored)
         mcpp::ui::info("note", std::format(
             "--no-runner: ignoring the runner declared for {}", choice.tripleKey));
     if (choice.fromManifest)
         mcpp::ui::info("note", std::format(
-            "[target.{}].runner overrides the runner a dependency supplied",
-            choice.tripleKey));
-    if (choice.freestanding && choice.tmpl.empty()) {
+            "[target.{}] overrides the {} a dependency supplied",
+            choice.tripleKey,
+            isRunSlot ? std::string("runner")
+                      : std::format("runner '{}'", slotName)));
+    // ⚠️ THE THREE NEW SLOTS HAVE NO FALLBACK, AND `run` STILL DOES.
+    //
+    // An artefact with no runner on a hosted target is executed directly, and
+    // that is right: the host can run it. There is no such reading of "no
+    // flasher" — nothing else writes an image to a device — so an empty
+    // template is an error for those three on EVERY target, not only a
+    // freestanding one. Saying "nothing is configured" beats doing something
+    // that was never asked for.
+    if (!isRunSlot && choice.tmpl.empty()) {
+        // ⚠️ AND THE MESSAGE LISTS WHAT THIS PROJECT DOES HAVE. A name the
+        // engine does not know is usually a typo or a missing feature, and
+        // "no such runner" alone leaves the reader guessing which.
+        std::string have;
+        for (auto const& [n, _] : ctx->manifest.buildConfig.namedRunners)
+            have += (have.empty() ? "" : ", ") + n;
+        std::println(stderr,
+            "error: this project has no runner named '{}' for '{}'.\n"
+            "       Available: {}\n"
+            "       A package supplies one with `mcpp::runner(\"{}\", …)`, or a\n"
+            "       project declares it:\n"
+            "\n"
+            "           [target.{}.runners]\n"
+            "           {} = [\"<tool>\", \"<args>\", \"{{}}\"]\n"
+            "\n"
+            "       The artefact path is appended, or substituted for `{{}}`.",
+            slotName, choice.tripleKey,
+            have.empty() ? "(none — no package in this graph supplies a named runner)"
+                         : have,
+            slotName, choice.tripleKey, slotName);
+        return 2;
+    }
+    if (isRunSlot && choice.freestanding && choice.tmpl.empty()) {
         std::println(stderr, "error: {}",
             mcpp::freestanding::no_runner_message(choice.tripleKey));
         return 2;
@@ -1400,9 +1578,15 @@ export int build_run_target(const std::optional<std::string>& targetName,
         tmpl.front() = found.program->string();
         argv = mcpp::freestanding::expand(tmpl, exe);
         for (auto& a : passthrough) argv.push_back(a);
-        mcpp::ui::status("Running", std::format(
-            "`{} … {}`", choice.tmpl.front(),
-            mcpp::ui::shorten_path(exe, pathCtx)));
+        // ⭐ The status word is the NAME the package chose, capitalised. The
+        // engine has no table of verbs to look one up in, which is the point:
+        // `Serve`, `Submit` and `Flash` all read correctly and none is known
+        // here.
+        std::string verb = isRunSlot ? std::string("Running") : slotName;
+        if (!isRunSlot && !verb.empty())
+            verb[0] = static_cast<char>(std::toupper(verb[0]));
+        mcpp::ui::status(verb, std::format("`{} … {}`", choice.tmpl.front(),
+                                           mcpp::ui::shorten_path(exe, pathCtx)));
     } else {
         argv.push_back(exe.string());
         for (auto& a : passthrough) argv.push_back(a);
@@ -1590,6 +1774,10 @@ export int run_tests(std::span<const std::string> passthrough,
     }
 
     // 3. prepare_build with dev-deps enabled + synthetic targets.
+    // A test binary is executed, so the run tier applies here exactly as it
+    // does to `mcpp run` — `[xlings.workspace]` has no separate `test` tier
+    // because there is no separate need.
+    overrides.will_run = true;
     auto ctx = prepare_build(/*print_fp=*/false,
                              /*includeDevDeps=*/true,
                              std::move(testTargets),
@@ -1901,8 +2089,29 @@ export int run_tests(std::span<const std::string> passthrough,
         const bool capture = json || list.size() > 1;
         const auto deadline = std::chrono::milliseconds(
             static_cast<long long>(testOpts.timeoutSecs) * 1000);
+        // ⚠️⚠️ A PHYSICAL BOARD IS A MUTEX, AND NOTHING ELSE THIS POOL HAS EVER
+        // SCHEDULED WAS ONE.
+        //
+        // An emulator takes N concurrent instances; a probe attached to one
+        // board does not. Two `probe-rs` processes reaching for the same device
+        // do not fail cleanly — they interleave, and the verdict they produce is
+        // about neither test. Nothing in the argv says which case this is, so
+        // the BOARD says it, once, with `mcpp:run-exclusive=1`, and the
+        // project never has to remember `-j1`.
+        //
+        // Clamped rather than made an error: an exclusive target with one test
+        // is an ordinary run, and refusing it would turn a correct
+        // configuration into a failure.
+        const bool exclusiveDevice = ctx->manifest.buildConfig.runExclusive
+                                  && !runnerChoice.tmpl.empty();
+        const int runJobsHere = exclusiveDevice ? 1 : runJobs;
+        if (exclusiveDevice && runJobs > 1 && list.size() > 1) {
+            mcpp::ui::info("note", std::format(
+                "the target declares an exclusive device, so {} tests run one at "
+                "a time", list.size()));
+        }
         const int workers = capture
-            ? std::min<int>(runJobs, static_cast<int>(list.size())) : 1;
+            ? std::min<int>(runJobsHere, static_cast<int>(list.size())) : 1;
 
         auto tRunPhase = std::chrono::steady_clock::now();
         std::atomic<std::size_t> next{0};
diff --git a/src/build/hostprogram.cppm b/src/build/hostprogram.cppm
index 6e7d4dee..511266b1 100644
--- a/src/build/hostprogram.cppm
+++ b/src/build/hostprogram.cppm
@@ -68,6 +68,22 @@ inline void include_dir_after(const char* dir)    { std::printf("mcpp:include-di
 // claiming to know how to run the artifact is a configuration error, and mcpp
 // reports it naming both rather than merging them.
 inline void runner(const char* token)             { std::printf("mcpp:runner=%s\n", token); }
+// ⭐ A NAMED way of reaching the artefact. The engine learns the name from
+// here and knows nothing else about it, so `flash`, `serve`, `deploy`,
+// `submit` and `logcat` cost the same: nothing.
+//
+// One token per call, because argv is ordered and a single string cannot say
+// where its boundaries are. The user reaches it with `mcpp run --runner <name>`.
+inline void runner(const char* name, const char* token) {
+    std::printf("mcpp:runner-named=%s:%s\n", name, token);
+}
+// This named runner has no natural end — a console monitor, a debug server.
+// ⚠️ DECLARED RATHER THAN DERIVED FROM THE NAME: the engine has no list of
+// names to derive it from, which is the point.
+inline void runner_longlived(const char* name) {
+    std::printf("mcpp:runner-longlived=%s\n", name);
+}
+inline void run_exclusive()                    { std::printf("mcpp:run-exclusive=1\n"); }
 
 // Say something to the user and keep going.
 //
diff --git a/src/build/prepare.cppm b/src/build/prepare.cppm
index 2b3bbdec..a2be39cd 100644
--- a/src/build/prepare.cppm
+++ b/src/build/prepare.cppm
@@ -672,6 +672,11 @@ export struct BuildContext {
     // declared but not installed contributes nothing, and the lookup then
     // continues to PATH.
     std::vector<std::filesystem::path> xlingsDepBinDirs;
+    // True when the graph declared a `when = "run"` tool that THIS invocation
+    // did not provision, because it was not going to execute anything. The
+    // build cache records it so `mcpp run`'s fast path declines an entry a
+    // plain `mcpp build` wrote — see BuildCacheEntry::runTierPending.
+    bool runTierPending = false;
     std::filesystem::path           outputDir;
     std::filesystem::path           stdBmi;
     std::filesystem::path           stdObject;
@@ -845,6 +850,14 @@ export struct BuildOverrides {
     bool        strict = false;      // --strict: schema warnings become errors
     std::string capabilities;        // --cap blas=openblas,lapack=mkl (provider pins)
     std::string cache_mode;          // --cache global|local|off ("" = unset)
+    // Whether the caller intends to EXECUTE what it builds, which is what
+    // decides the `when = "run"` tool tier. `mcpp run` and `mcpp test` set it;
+    // `mcpp build`, `mcpp pack` and every internal sub-build do not.
+    //
+    // ⚠️ A SEPARATE FLAG FROM `includeDevDeps`, THOUGH `mcpp test` SETS BOTH.
+    // One says which PACKAGES enter the graph, the other which TOOLS are
+    // installed, and `mcpp run` needs the second without the first.
+    bool        will_run = false;
 };
 
 // ── git dependency helpers ──────────────────────────────────────────────────
@@ -1018,6 +1031,310 @@ void fill_target_build_env(mcpp::build::BuildProgramEnv& e,
     }
 }
 
+// ── Tool tiers: which of a manifest's declared packages this verb needs ─────
+//
+// ⭐⭐ THE AXIS PACKAGE DEPENDENCIES HAVE HAD SINCE THE BEGINNING, AND TOOLS
+// DID NOT.
+//
+// A board-support package names an emulator (needed to run) and a debug probe
+// (needed to reach real hardware). Before this, declaring either installed
+// both, for everyone, on every `mcpp build` — including a consumer who only
+// wanted the library to compile. Packages have `[dependencies]`,
+// `[build-dependencies]` and `[dev-dependencies]`; tools had one list.
+//
+// The tier is written on the ENTRY (`when = "run"`), not as a second table:
+// `[xlings.workspace]` was made the one table on purpose, and the entry-level
+// spelling is the one `[dependencies]` already uses for the same kind of
+// refinement.
+//
+// ⚠️ `Dev` IS THE ONLY TIER THAT DOES NOT PROPAGATE. It means "when the package
+// that declared it is itself being developed", so `isRoot` decides it. Every
+// other tier reaches a consumer, which is the whole point of a board package
+// knowing its own machine.
+enum class ToolPurpose { Build, Run };
+
+std::vector<std::string>
+applicable_xlings_addresses(const mcpp::manifest::Manifest& man,
+                            const std::vector<std::string>& activeFeatures,
+                            ToolPurpose purpose, bool isRoot) {
+    using W = mcpp::manifest::ToolWhen;
+    std::vector<std::string> out;
+    auto wanted = [&](const std::string& address) {
+        switch (man.xlings.when_of(address)) {
+            case W::Always: return true;
+            case W::Build:  return true;
+            case W::Run:    return purpose == ToolPurpose::Run;
+            case W::Dev:    return isRoot;
+        }
+        return true;
+    };
+    auto add = [&](const std::string& address) {
+        if (!wanted(address)) return;
+        if (std::ranges::find(out, address) == out.end()) out.push_back(address);
+    };
+    for (auto const& a : man.xlings.deps) add(a);
+    // `[feature-xlings.<f>]` contributes only while `<f>` is active. A consumer
+    // that never asks for `hardware` never downloads a probe driver — which is
+    // the same mechanism `[feature-deps]` gives a package, applied to tools.
+    for (auto const& f : activeFeatures)
+        if (auto it = man.xlings.featureDeps.find(f);
+            it != man.xlings.featureDeps.end())
+            for (auto const& a : it->second) add(a);
+    return out;
+}
+
+// Install a set of `[xlings.workspace]` addresses, and record that the list was
+// done.
+//
+// ⭐ EXTRACTED SO THE DEPENDENCY GRAPH CAN USE THE SAME PATH. This was the
+// root project's provisioning, inline and reachable only from there. A
+// board-support package that declares the emulator its machine needs is
+// precisely the thing that should say so once, and a consumer that has to
+// repeat the declaration to get it installed is the duplication such a package
+// exists to remove — so the graph pass calls this with what the dependencies
+// declared, under the same stamp discipline and the same auto-install gate.
+//
+// `label` names the caller in every message, because "which of the two passes
+// is this" is the first thing a reader of the failure needs.
+std::expected<void, std::string>
+provision_xlings_addresses(const mcpp::config::GlobalConfig& cfg,
+                           const std::vector<std::string>& declaredDeps,
+                           const std::filesystem::path& legacyStampRoot,
+                           std::string_view label) {
+    if (declaredDeps.empty()) return {};
+            // ⚠️⚠️ THE STAMP RECORDS A GLOBAL EFFECT, SO IT LIVES WHERE THE
+            // EFFECT DOES. It used to sit in `<project>/.mcpp/`, while the
+            // installation goes to the registry a few lines below — the
+            // scope difference is deliberate and explained there. Two
+            // consequences followed from the mismatch: wiping or replacing
+            // `MCPP_HOME` left a project still claiming the packages were
+            // installed, and `mcpp clean` (which removes `target/` and
+            // never `.mcpp/`) could not clear it. Keyed by the LIST, not by
+            // the project, because the installation is shared: two projects
+            // declaring the same packages should pay for it once.
+            //
+            // This still does not survive a user's `xlings remove`. No
+            // stamp does; the honest fix is a presence check, and it is
+            // blocked on `resolve_xpkg_path` requiring `<name>@<version>`
+            // while a manifest is entitled to name a package unpinned.
+            const auto stampDir = mcpp::home::root() / "provisioned";
+            // `std::uint64_t`, not `std::size_t`: the offset basis below is
+            // a 64-bit constant and a 32-bit host would truncate it, giving
+            // that host a different key space for no reason anyone could
+            // see. A collision is not a correctness problem either way —
+            // the file stores the LIST and the comparison below is against
+            // its content, so two lists sharing a key re-provision rather
+            // than silently adopt each other's record.
+            auto stamp_key = [&] {
+                std::uint64_t h = 1469598103934665603ull;   // FNV-1a
+                for (auto const& d : declaredDeps)
+                    for (unsigned char ch : d + "\n")
+                        { h ^= ch; h *= 1099511628211ull; }
+                return std::format("xlings-deps-{:016x}", h);
+            };
+            const auto stamp = stampDir / stamp_key();
+            // Idempotence by CONTENT, not by existence: editing the list
+            // has to re-provision, and an unchanged list must not pay for
+            // an xlings round-trip on every build.
+            auto join_deps = [&](std::string_view sep) {
+                std::string out;
+                for (auto const& d : declaredDeps) {
+                    if (!out.empty()) out += sep;
+                    out += d;
+                }
+                return out;
+            };
+            std::string want;
+            for (auto const& d : declaredDeps) { want += d; want += '\n'; }
+            std::string have;
+            if (std::ifstream in{stamp}; in)
+                have.assign(std::istreambuf_iterator<char>(in), {});
+            // The stamp the previous location left behind. Read, never
+            // deleted: an older mcpp sharing the checkout still uses it,
+            // and a stale extra file is cheaper than a downgrade that
+            // re-provisions on every build.
+            //
+            // ⚠️ IT DOES NOT MEAN "PROVISIONED SUCCESSFULLY". The release
+            // that wrote it did not read the result — that is the defect
+            // above — so it means only "this list was attempted". Treating
+            // it as proof would carry the bug across the very upgrade that
+            // fixes it: a project whose dependency never installed would
+            // adopt the stamp and stay silently broken.
+            //
+            // So it is consulted in ONE place, below, where the alternative
+            // is worse: the auto-install gate. Online, nothing is adopted
+            // and every project re-provisions once, which is a cheap round
+            // trip that re-validates the claim.
+            const auto legacyStamp = legacyStampRoot / ".mcpp" / ".xlings-deps.stamp";
+            auto legacy_stamp_matches = [&] {
+                std::string legacy;
+                if (std::ifstream in{legacyStamp}; in)
+                    legacy.assign(std::istreambuf_iterator<char>(in), {});
+                return legacy == want;
+            };
+            bool needProvision = (have != want);
+            if (needProvision) {
+                // ⚠️ THE AUTO-INSTALL GATE, WHICH THIS PATH DID NOT HAVE.
+                //
+                // `[toolchain]` is the precedent this whole mechanism cites
+                // ("the same 'declare it and mcpp provisions it on first
+                // use' contract"), and that path refuses on either knob and
+                // names the one that fired — see the auto-install branch
+                // above. This one honoured neither, so a CI exporting
+                // MCPP_NO_AUTO_INSTALL specifically to prevent an unasked
+                // download got one anyway, from a path that had never heard
+                // of the variable.
+                //
+                // Placed inside `have != want`, so it gates the ATTEMPT and
+                // not the block: a project whose packages are already
+                // provisioned still builds offline, which is the behaviour
+                // that would otherwise regress.
+                if (mcpp::platform::env::offline_mode()
+                    || mcpp::platform::env::no_auto_install()) {
+                    // ⚠️ THE ONE PLACE THE LEGACY STAMP IS TRUSTED, and the
+                    // reason is that relocating a record must not refuse a
+                    // build that worked yesterday. Every project that had
+                    // already provisioned carries the old stamp and no new
+                    // one, so on the first build after upgrading it reads
+                    // as un-provisioned — and here, with the network shut
+                    // off, there is no way to find out otherwise. Refusing
+                    // would be a regression caused entirely by moving a
+                    // file, which is the least defensible kind.
+                    //
+                    // Proceeding is the pre-upgrade behaviour exactly: if
+                    // the packages really are missing, the build fails
+                    // downstream on a missing header, as it did before.
+                    // The registry stamp is NOT written — nothing here
+                    // verified anything.
+                    if (!legacy_stamp_matches()) {
+                        std::string_view release =
+                            mcpp::platform::env::offline_mode()
+                            ? "drop --offline / unset MCPP_OFFLINE"
+                            : "unset MCPP_NO_AUTO_INSTALL";
+                        return std::unexpected(std::format(
+                            "{} are declared but not provisioned, "
+                            "and auto-install is off.\n"
+                            "       declared: {}\n"
+                            "       install them yourself with:\n"
+                            "         xlings install {}\n"
+                            "       or {} to let mcpp do it.",
+                            label, join_deps(", "), join_deps(" "), release));
+                    }
+                    mcpp::log::verbose("xlings",
+                        std::format("{}: auto-install is off and this project "
+                        "carries a pre-2026.9.1.1 provisioning stamp for the "
+                        "same list; proceeding without re-checking", label));
+                    // Deliberately NOT writing the registry stamp: nothing
+                    // here verified anything, and a record of a check that
+                    // did not happen is the defect this release removes.
+                    needProvision = false;
+                }
+            }
+            if (needProvision) {
+                mcpp::ui::status("Provisioning",
+                    std::format("{} ({})", label, join_deps(", ")));
+                // GLOBAL scope, and the scope is the whole point.
+                //
+                // The obvious alternative -- `install_packages` against
+                // `make_project_xlings_env` -- installs at PROJECT scope,
+                // and that measurably does not work: on a fresh MCPP_HOME
+                // the headers land in
+                // `<proj>/.mcpp/.xlings/subos/_/usr/include` while
+                // `--sysroot` names `<MCPP_HOME>/registry/subos/default`,
+                // so `#include <gbm.h>` still failed with the dependency
+                // installed and declared. Two SubOS views, and the payload
+                // in the one the compiler does not read.
+                //
+                // `make_xlings_env` is the GLOBAL env, so this lands in the
+                // registry whose SubOS *is* mcpp's sysroot -- the same
+                // place `[toolchain]` has always installed into. A project
+                // dependency and a toolchain dependency now agree on where
+                // they live, which is the only arrangement in which one
+                // `--sysroot` can see both.
+                //
+                // `install_packages` rather than `resolve_xpkg_path`: the
+                // latter requires `<name>@<version>` and rejects a bare
+                // `mesa`, while a manifest is entitled to name a package
+                // without pinning it. install_packages resolves the version
+                // itself and reports an ambiguous name with its candidates,
+                // which is the error the author can act on.
+                // Built with the JSON library rather than by formatting
+                // the strings in. `deps` is manifest input, so a name
+                // containing a quote or a backslash would otherwise emit
+                // malformed JSON and the failure would surface as an
+                // unrelated xlings parse error naming neither the manifest
+                // nor the key.
+                nlohmann::json args;
+                args["targets"] = declaredDeps;
+                args["yes"]     = true;
+
+                mcpp::fetcher::InstallProgressHandler progress;
+                auto r = mcpp::xlings::call(
+                    mcpp::config::make_xlings_env(cfg), "install_packages",
+                    args.dump(), &progress);
+                // ⚠️⚠️ `if (!r)` IS NOT THE FAILURE TEST, AND TESTING ONLY
+                // IT MADE THIS PATH REPORT SUCCESS FOR EVERY FAILURE XLINGS
+                // CAN REPORT.
+                //
+                // `xlings::call` returns `expected<CallResult, string>` and
+                // is in the VALUE state whenever the child ran at all — the
+                // error channel means "the call did not happen". A
+                // capability's own status arrives inside `CallResult`,
+                // parsed off the NDJSON `{"kind":"result","exitCode":N}`
+                // line, because the xlings process itself exits 0 by design
+                // once it has spoken the protocol.
+                //
+                // Measured before this fix: a manifest declaring a package
+                // that cannot exist printed `Provisioning [xlings] deps
+                // (…)`, xlings answered `E_NOT_FOUND` with `exitCode: 1`,
+                // and mcpp stamped it as done and reported a successful
+                // build. #531 was written because "the declaration looked
+                // accepted and did nothing" is the worst shape a config key
+                // can have; unread, its own fix reproduced that shape and
+                // the stamp made it permanent.
+                //
+                // The correct idiom is not new — the dependency install
+                // path in this same file reads `r->exitCode` — it was
+                // simply not applied here.
+                const bool called   = r.has_value();
+                const int  childRc  = called ? r->exitCode : -1;
+                if (!called || childRc != 0) {
+                    // Prefer xlings' own message: for an unresolvable name
+                    // it names the repos it searched and whether the index
+                    // is current, which is the part the author can act on.
+                    std::string why = !called ? r.error()
+                        : (r->error ? r->error->message
+                                    : std::format("xlings exited {}", childRc));
+                    if (auto captured = progress.captured_error();
+                        !captured.empty() && called && !r->error)
+                        why = captured;
+                    // The hint is where "run `xlings update` if the package
+                    // was just published" lives, and for the commonest
+                    // failure — a name that is not in the synced index —
+                    // it is the whole of the actionable content.
+                    if (called && r->error && !r->error->hint.empty())
+                        why += "\n       " + r->error->hint;
+                    // Shaped like the toolchain failure: say what failed and
+                    // hand back a command the user can run themselves. An
+                    // ambiguous bare name ("mesa" matching two repos) lands
+                    // here, and xlings' own message names the candidates.
+                    return std::unexpected(std::format(
+                        "provisioning {} failed: {}\n"
+                        "       you can install them manually with:\n"
+                        "         xlings install {}",
+                        label, why, join_deps(" ")));
+                }
+                // Written only on success, for the same reason the check
+                // above exists: a stamp is a record that the effect
+                // happened, and recording an effect that did not is worse
+                // than not recording it — the next build skips the attempt.
+                std::error_code sec;
+                std::filesystem::create_directories(stamp.parent_path(), sec);
+                if (std::ofstream out{stamp}; out) out << want;
+            }
+    return {};
+}
+
 std::string with_index_cause(std::string msg) {
     if (auto hint = mcpp::pm::unusable_index_hint(); !hint.empty())
         msg += "\n" + hint;
@@ -1031,6 +1348,12 @@ prepare_build(bool print_fingerprint,
               bool includeDevDeps = false,
               std::vector<mcpp::manifest::Target> extraTargets = {},
               BuildOverrides overrides = {}) {
+    // Which tool tiers this invocation needs. Named once so the two
+    // provisioning passes cannot disagree — a `mcpp build` that installed the
+    // run tier and a `mcpp run` that did not would be the same defect twice.
+    const ToolPurpose toolPurpose =
+        overrides.will_run ? ToolPurpose::Run : ToolPurpose::Build;
+
     // A refusal decided early and released late. `host_can_serve` answers
     // "does a payload on this machine produce this target", which is knowable
     // before dependency resolution and is only half the question: a package in
@@ -3196,6 +3519,25 @@ prepare_build(bool print_fingerprint,
                 penv.subos = runtimeOwnerManifest.xlings.subos;
                 for (auto const& [k, v] : runtimeOwnerManifest.xlings.workspace)
                     penv.workspace.emplace_back(k, v);
+                // `[feature-xlings.<f>]` becomes part of the project's
+                // environment only while `<f>` is active. It is written into
+                // the same two fields, because from xlings' side there is no
+                // such thing as a feature: the file states what this project
+                // uses, and the feature decided that.
+                for (auto const& f :
+                         feature_closure(runtimeOwnerManifest,
+                                         parse_feature_request(overrides.features)))
+                    if (auto it = runtimeOwnerManifest.xlings.featureDeps.find(f);
+                        it != runtimeOwnerManifest.xlings.featureDeps.end())
+                        for (auto const& address : it->second) {
+                            if (std::ranges::find(penv.deps, address) == penv.deps.end())
+                                penv.deps.push_back(address);
+                            const auto entry =
+                                mcpp::manifest::parse_address(address);
+                            if (std::ranges::none_of(penv.workspace,
+                                    [&](auto const& kv) { return kv.first == entry.target; }))
+                                penv.workspace.emplace_back(entry.target, entry.pin());
+                        }
             }
             if (runtimeSelection.ownerRoot == workRoot) {
                 mcpp::config::ensure_project_index_dir(
@@ -3246,240 +3588,20 @@ prepare_build(bool print_fingerprint,
             // contract being added is "what you declared gets installed", and
             // the sysroot entry is mcpp's own inference rather than the
             // author's declaration.
-            const auto& declaredDeps = runtimeOwnerManifest.xlings.deps;
+            // Only the tiers this verb needs, and only what the ROOT
+            // declared. The graph's own declarations are provisioned after
+            // resolution, which is the first moment they are known — see the
+            // second pass near `xlingsDepBinDirs`.
+            const auto declaredDeps = applicable_xlings_addresses(
+                runtimeOwnerManifest,
+                feature_closure(runtimeOwnerManifest,
+                                parse_feature_request(overrides.features)),
+                toolPurpose, /*isRoot=*/true);
             if (materializeRootRuntime && !declaredDeps.empty()) {
-                // ⚠️⚠️ THE STAMP RECORDS A GLOBAL EFFECT, SO IT LIVES WHERE THE
-                // EFFECT DOES. It used to sit in `<project>/.mcpp/`, while the
-                // installation goes to the registry a few lines below — the
-                // scope difference is deliberate and explained there. Two
-                // consequences followed from the mismatch: wiping or replacing
-                // `MCPP_HOME` left a project still claiming the packages were
-                // installed, and `mcpp clean` (which removes `target/` and
-                // never `.mcpp/`) could not clear it. Keyed by the LIST, not by
-                // the project, because the installation is shared: two projects
-                // declaring the same packages should pay for it once.
-                //
-                // This still does not survive a user's `xlings remove`. No
-                // stamp does; the honest fix is a presence check, and it is
-                // blocked on `resolve_xpkg_path` requiring `<name>@<version>`
-                // while a manifest is entitled to name a package unpinned.
-                const auto stampDir = mcpp::home::root() / "provisioned";
-                // `std::uint64_t`, not `std::size_t`: the offset basis below is
-                // a 64-bit constant and a 32-bit host would truncate it, giving
-                // that host a different key space for no reason anyone could
-                // see. A collision is not a correctness problem either way —
-                // the file stores the LIST and the comparison below is against
-                // its content, so two lists sharing a key re-provision rather
-                // than silently adopt each other's record.
-                auto stamp_key = [&] {
-                    std::uint64_t h = 1469598103934665603ull;   // FNV-1a
-                    for (auto const& d : declaredDeps)
-                        for (unsigned char ch : d + "\n")
-                            { h ^= ch; h *= 1099511628211ull; }
-                    return std::format("xlings-deps-{:016x}", h);
-                };
-                const auto stamp = stampDir / stamp_key();
-                // Idempotence by CONTENT, not by existence: editing the list
-                // has to re-provision, and an unchanged list must not pay for
-                // an xlings round-trip on every build.
-                auto join_deps = [&](std::string_view sep) {
-                    std::string out;
-                    for (auto const& d : declaredDeps) {
-                        if (!out.empty()) out += sep;
-                        out += d;
-                    }
-                    return out;
-                };
-                std::string want;
-                for (auto const& d : declaredDeps) { want += d; want += '\n'; }
-                std::string have;
-                if (std::ifstream in{stamp}; in)
-                    have.assign(std::istreambuf_iterator<char>(in), {});
-                // The stamp the previous location left behind. Read, never
-                // deleted: an older mcpp sharing the checkout still uses it,
-                // and a stale extra file is cheaper than a downgrade that
-                // re-provisions on every build.
-                //
-                // ⚠️ IT DOES NOT MEAN "PROVISIONED SUCCESSFULLY". The release
-                // that wrote it did not read the result — that is the defect
-                // above — so it means only "this list was attempted". Treating
-                // it as proof would carry the bug across the very upgrade that
-                // fixes it: a project whose dependency never installed would
-                // adopt the stamp and stay silently broken.
-                //
-                // So it is consulted in ONE place, below, where the alternative
-                // is worse: the auto-install gate. Online, nothing is adopted
-                // and every project re-provisions once, which is a cheap round
-                // trip that re-validates the claim.
-                const auto legacyStamp = runtimeSelection.ownerRoot / ".mcpp"
-                                       / ".xlings-deps.stamp";
-                auto legacy_stamp_matches = [&] {
-                    std::string legacy;
-                    if (std::ifstream in{legacyStamp}; in)
-                        legacy.assign(std::istreambuf_iterator<char>(in), {});
-                    return legacy == want;
-                };
-                bool needProvision = (have != want);
-                if (needProvision) {
-                    // ⚠️ THE AUTO-INSTALL GATE, WHICH THIS PATH DID NOT HAVE.
-                    //
-                    // `[toolchain]` is the precedent this whole mechanism cites
-                    // ("the same 'declare it and mcpp provisions it on first
-                    // use' contract"), and that path refuses on either knob and
-                    // names the one that fired — see the auto-install branch
-                    // above. This one honoured neither, so a CI exporting
-                    // MCPP_NO_AUTO_INSTALL specifically to prevent an unasked
-                    // download got one anyway, from a path that had never heard
-                    // of the variable.
-                    //
-                    // Placed inside `have != want`, so it gates the ATTEMPT and
-                    // not the block: a project whose packages are already
-                    // provisioned still builds offline, which is the behaviour
-                    // that would otherwise regress.
-                    if (mcpp::platform::env::offline_mode()
-                        || mcpp::platform::env::no_auto_install()) {
-                        // ⚠️ THE ONE PLACE THE LEGACY STAMP IS TRUSTED, and the
-                        // reason is that relocating a record must not refuse a
-                        // build that worked yesterday. Every project that had
-                        // already provisioned carries the old stamp and no new
-                        // one, so on the first build after upgrading it reads
-                        // as un-provisioned — and here, with the network shut
-                        // off, there is no way to find out otherwise. Refusing
-                        // would be a regression caused entirely by moving a
-                        // file, which is the least defensible kind.
-                        //
-                        // Proceeding is the pre-upgrade behaviour exactly: if
-                        // the packages really are missing, the build fails
-                        // downstream on a missing header, as it did before.
-                        // The registry stamp is NOT written — nothing here
-                        // verified anything.
-                        if (!legacy_stamp_matches()) {
-                            std::string_view release =
-                                mcpp::platform::env::offline_mode()
-                                ? "drop --offline / unset MCPP_OFFLINE"
-                                : "unset MCPP_NO_AUTO_INSTALL";
-                            return std::unexpected(std::format(
-                                "[xlings] deps are declared but not provisioned, "
-                                "and auto-install is off.\n"
-                                "       declared: {}\n"
-                                "       install them yourself with:\n"
-                                "         xlings install {}\n"
-                                "       or {} to let mcpp do it.",
-                                join_deps(", "), join_deps(" "), release));
-                        }
-                        mcpp::log::verbose("xlings",
-                            "[xlings] deps: auto-install is off and this project "
-                            "carries a pre-2026.9.1.1 provisioning stamp for the "
-                            "same list; proceeding without re-checking");
-                        // Deliberately NOT writing the registry stamp: nothing
-                        // here verified anything, and a record of a check that
-                        // did not happen is the defect this release removes.
-                        needProvision = false;
-                    }
-                }
-                if (needProvision) {
-                    mcpp::ui::status("Provisioning",
-                        std::format("[xlings] deps ({})",
-                                    join_deps(", ")));
-                    // GLOBAL scope, and the scope is the whole point.
-                    //
-                    // The obvious alternative -- `install_packages` against
-                    // `make_project_xlings_env` -- installs at PROJECT scope,
-                    // and that measurably does not work: on a fresh MCPP_HOME
-                    // the headers land in
-                    // `<proj>/.mcpp/.xlings/subos/_/usr/include` while
-                    // `--sysroot` names `<MCPP_HOME>/registry/subos/default`,
-                    // so `#include <gbm.h>` still failed with the dependency
-                    // installed and declared. Two SubOS views, and the payload
-                    // in the one the compiler does not read.
-                    //
-                    // `make_xlings_env` is the GLOBAL env, so this lands in the
-                    // registry whose SubOS *is* mcpp's sysroot -- the same
-                    // place `[toolchain]` has always installed into. A project
-                    // dependency and a toolchain dependency now agree on where
-                    // they live, which is the only arrangement in which one
-                    // `--sysroot` can see both.
-                    //
-                    // `install_packages` rather than `resolve_xpkg_path`: the
-                    // latter requires `<name>@<version>` and rejects a bare
-                    // `mesa`, while a manifest is entitled to name a package
-                    // without pinning it. install_packages resolves the version
-                    // itself and reports an ambiguous name with its candidates,
-                    // which is the error the author can act on.
-                    // Built with the JSON library rather than by formatting
-                    // the strings in. `deps` is manifest input, so a name
-                    // containing a quote or a backslash would otherwise emit
-                    // malformed JSON and the failure would surface as an
-                    // unrelated xlings parse error naming neither the manifest
-                    // nor the key.
-                    nlohmann::json args;
-                    args["targets"] = declaredDeps;
-                    args["yes"]     = true;
-
-                    mcpp::fetcher::InstallProgressHandler progress;
-                    auto r = mcpp::xlings::call(
-                        mcpp::config::make_xlings_env(**cfg2), "install_packages",
-                        args.dump(), &progress);
-                    // ⚠️⚠️ `if (!r)` IS NOT THE FAILURE TEST, AND TESTING ONLY
-                    // IT MADE THIS PATH REPORT SUCCESS FOR EVERY FAILURE XLINGS
-                    // CAN REPORT.
-                    //
-                    // `xlings::call` returns `expected<CallResult, string>` and
-                    // is in the VALUE state whenever the child ran at all — the
-                    // error channel means "the call did not happen". A
-                    // capability's own status arrives inside `CallResult`,
-                    // parsed off the NDJSON `{"kind":"result","exitCode":N}`
-                    // line, because the xlings process itself exits 0 by design
-                    // once it has spoken the protocol.
-                    //
-                    // Measured before this fix: a manifest declaring a package
-                    // that cannot exist printed `Provisioning [xlings] deps
-                    // (…)`, xlings answered `E_NOT_FOUND` with `exitCode: 1`,
-                    // and mcpp stamped it as done and reported a successful
-                    // build. #531 was written because "the declaration looked
-                    // accepted and did nothing" is the worst shape a config key
-                    // can have; unread, its own fix reproduced that shape and
-                    // the stamp made it permanent.
-                    //
-                    // The correct idiom is not new — the dependency install
-                    // path in this same file reads `r->exitCode` — it was
-                    // simply not applied here.
-                    const bool called   = r.has_value();
-                    const int  childRc  = called ? r->exitCode : -1;
-                    if (!called || childRc != 0) {
-                        // Prefer xlings' own message: for an unresolvable name
-                        // it names the repos it searched and whether the index
-                        // is current, which is the part the author can act on.
-                        std::string why = !called ? r.error()
-                            : (r->error ? r->error->message
-                                        : std::format("xlings exited {}", childRc));
-                        if (auto captured = progress.captured_error();
-                            !captured.empty() && called && !r->error)
-                            why = captured;
-                        // The hint is where "run `xlings update` if the package
-                        // was just published" lives, and for the commonest
-                        // failure — a name that is not in the synced index —
-                        // it is the whole of the actionable content.
-                        if (called && r->error && !r->error->hint.empty())
-                            why += "\n       " + r->error->hint;
-                        // Shaped like the toolchain failure: say what failed and
-                        // hand back a command the user can run themselves. An
-                        // ambiguous bare name ("mesa" matching two repos) lands
-                        // here, and xlings' own message names the candidates.
-                        return std::unexpected(std::format(
-                            "provisioning [xlings] deps failed: {}\n"
-                            "       you can install them manually with:\n"
-                            "         xlings install {}",
-                            why, join_deps(" ")));
-                    }
-                    // Written only on success, for the same reason the check
-                    // above exists: a stamp is a record that the effect
-                    // happened, and recording an effect that did not is worse
-                    // than not recording it — the next build skips the attempt.
-                    std::error_code sec;
-                    std::filesystem::create_directories(stamp.parent_path(), sec);
-                    if (std::ofstream out{stamp}; out) out << want;
-                }
+                if (auto pv = provision_xlings_addresses(
+                        **cfg2, declaredDeps, runtimeSelection.ownerRoot,
+                        "[xlings.workspace] entries");
+                    !pv) return std::unexpected(pv.error());
             }
 
             // On first build, the project index data root may be empty because
@@ -3517,6 +3639,12 @@ prepare_build(bool print_fingerprint,
     }
 
     std::vector<mcpp::modgraph::PackageRoot> packages;
+    // The features each package ends up built with, index-aligned with
+    // `packages`. Recorded at activation because the passes that run after it
+    // — `[feature-xlings]` provisioning among them — otherwise have no way to
+    // ask, and re-deriving it there would be a second copy of the aggregation
+    // rule.
+    std::vector<std::vector<std::string>> activeFeaturesByPackage;
     packages.push_back({*root, *m});
 
     // dep_manifests is kept around purely so the build plan can move it
@@ -4552,6 +4680,10 @@ prepare_build(bool print_fingerprint,
     // Which dependency supplied the runner, for the exactly-one-provider
     // error below. A name rather than a bool: the message has to name both.
     std::string runnerProvider;
+    // ⚠️ ONE PROVIDER PER RUNNER NAME. `runner` has had this rule since #544;
+    // a NAMED runner inherits it per name, because a board may legitimately
+    // supply `flash` while a different package supplies `monitor`.
+    std::map<std::string, std::string> namedRunnerProvider;
 
     auto fillXpkgDirs = [&](mcpp::build::BuildProgramEnv& e,
                             const mcpp::manifest::Manifest& owner) {
@@ -5206,6 +5338,7 @@ prepare_build(bool print_fingerprint,
     std::vector<std::string> rootActive = feature_closure(*m, rootReq, true);
     if (auto fe = validateForwards(*m, rootActive, m->package.name); !fe)
         return std::unexpected(fe.error());
+    activeFeaturesByPackage.assign(1, rootActive);
 
     // Seed the worklist from the main manifest. Dev-deps only when the
     // caller wants them; they're never propagated transitively.
@@ -6651,7 +6784,12 @@ prepare_build(bool print_fingerprint,
             // depDefaultFeatures carries the consumer's `default-features = false`
             // (#242): when opted out, the dep's [features].default is not seeded.
             apply(packages[i], req, depDefaultFeatures);
+            if (activeFeaturesByPackage.size() <= i)
+                activeFeaturesByPackage.resize(i + 1);
+            activeFeaturesByPackage[i] =
+                feature_closure(packages[i].manifest, req, depDefaultFeatures);
         }
+        activeFeaturesByPackage.resize(packages.size());
 
         // ── #355: HOST tool provisioning ────────────────────────────────────
         //
@@ -7225,6 +7363,8 @@ prepare_build(bool print_fingerprint,
             const auto ldN = bcDep.ldflags.size();
             const auto actN = bcDep.actions.size();
             const auto runnerN = bcDep.runner.size();
+            auto namedBefore = bcDep.namedRunners;   // by value: the delta below
+            const bool exclusiveBefore = bcDep.runExclusive;
             if (auto r = mcpp::build::run_build_program(
                     pkg.manifest, pkg.root, host->first, host->second,
                     pkg.manifest.cppStandard, bpEnv);
@@ -7253,6 +7393,19 @@ prepare_build(bool print_fingerprint,
             // with nothing to say which package contributed which token. So
             // the second provider is a hard error that names BOTH, because
             // naming only the loser tells the reader half of what they need.
+            // ⭐⭐ THE DEFAULT RUNNER AND EVERY NAMED ONE, BY ONE RULE.
+            //
+            // Link flags from two dependencies concatenate and that is correct;
+            // two runners for the same name cannot — appending produces an argv
+            // that is neither one's and fails at exec with nothing to say which
+            // package contributed which token.
+            //
+            // ⚠️ MISSING THIS SITE IS HOW THE FEATURE FAILED FIRST. `apply()`
+            // merges a package's directives into its OWN config; this is where a
+            // dependency's RunGlobal entries reach the ROOT. Wiring only the
+            // first left `mcpp run --runner flash` reporting "no such runner"
+            // while `mcpp run` found the runner the same build program emitted
+            // three lines away — measured.
             if (bcDep.runner.size() > runnerN) {
                 std::vector<std::string> supplied(
                     bcDep.runner.begin() + static_cast<std::ptrdiff_t>(runnerN),
@@ -7261,7 +7414,7 @@ prepare_build(bool print_fingerprint,
                     return std::unexpected(std::format(
                         "two dependencies both supply a runner for this target: "
                         "'{}' and '{}'.\n"
-                        "       A runner is how the artifact is EXECUTED — there "
+                        "       A runner is how the artifact is reached — there "
                         "can only be one.\n"
                         "       Drop one of them, or override both with an "
                         "explicit [target.<triple>].runner.",
@@ -7270,6 +7423,28 @@ prepare_build(bool print_fingerprint,
                 m->buildConfig.runner = std::move(supplied);
                 runnerProvider = pkg.manifest.package.name;
             }
+            for (auto const& [name, nr] : bcDep.namedRunners) {
+                auto before = namedBefore.find(name);
+                const bool grew = (before == namedBefore.end())
+                               || nr.argv.size() > before->second.argv.size()
+                               || (nr.longLived && !before->second.longLived);
+                if (!grew) continue;
+                auto& slot = m->buildConfig.namedRunners[name];
+                auto& who  = namedRunnerProvider[name];
+                if (!slot.argv.empty() && !who.empty()) {
+                    return std::unexpected(std::format(
+                        "two dependencies both supply a runner named '{}' for "
+                        "this target: '{}' and '{}'.\n"
+                        "       Drop one of them, or override both with an "
+                        "explicit [target.<triple>.runners].{}.",
+                        name, who, pkg.manifest.package.name, name));
+                }
+                slot = nr;
+                who  = pkg.manifest.package.name;
+            }
+            // ⚠️ A CLAIM THAT ONLY EVER TIGHTENS.
+            if (bcDep.runExclusive && !exclusiveBefore)
+                m->buildConfig.runExclusive = true;
             m->buildConfig.ldflags.insert(m->buildConfig.ldflags.end(),
                 bcDep.ldflags.begin() + ldN, bcDep.ldflags.end());
         }
@@ -8709,13 +8884,87 @@ prepare_build(bool print_fingerprint,
     // same resolution `fillXpkgDirs` hands to build programs, kept as
     // directories rather than env vars because the reader is mcpp's own
     // lookup, not a child process. See BuildContext::xlingsDepBinDirs.
-    if (!runtimeOwnerManifest.xlings.deps.empty()) {
-        if (auto cfg = get_cfg()) {
-            auto xlEnv = mcpp::config::make_xlings_env(**cfg);
-            for (auto const& spec : runtimeOwnerManifest.xlings.deps) {
-                auto ref = mcpp::xlings::paths::parse_xpkg_ref(spec);
-                if (auto dir = mcpp::xlings::paths::xpkg_payload(xlEnv, ref))
-                    ctx.xlingsDepBinDirs.push_back(*dir / "bin");
+    //
+    // ⚠️⚠️ AND EVERY PACKAGE IN THE GRAPH, NOT ONLY THE ROOT — WHICH IS THE
+    // CASE THIS FEATURE EXISTS FOR.
+    //
+    // A board-support package is precisely the thing that knows which emulator
+    // or probe reaches its machine, and it declares that emulator under its own
+    // `[xlings] deps`. Collecting only the ROOT's declarations meant a runner
+    // could name a program by bare name only when the CONSUMER had also
+    // declared it — which is the duplication the board package exists to
+    // remove. Measured on `mcpplibs/aarch64-virt-rt`: with the board naming
+    // `qemu-system-aarch64` bare, `mcpp run` searched PATH, found the shim or
+    // nothing, and reported a missing runner while the emulator sat installed
+    // in the payload the board had declared.
+    //
+    // Ordering is root-first: a consumer that declares its own payload gets to
+    // decide, and a dependency supplies the answer when the consumer said
+    // nothing. A payload that is declared but not installed contributes
+    // nothing, and the lookup continues to PATH.
+    //
+    // ⭐⭐ AND THE SET COLLECTED HERE IS ALSO THE SET PROVISIONED. Looking in a
+    // directory that nothing installed is a lookup that can only fail, and the
+    // engine had exactly that shape: a dependency's declaration was searched
+    // and never acted on. The two definitions are one expression below, so
+    // they cannot drift — the third of the three hazards §12.6 named.
+    {
+        std::vector<std::string> xlingsSpecs = applicable_xlings_addresses(
+            runtimeOwnerManifest, activeFeaturesByPackage.empty()
+                ? std::vector<std::string>{} : activeFeaturesByPackage[0],
+            toolPurpose, /*isRoot=*/true);
+        // Everything the GRAPH declared, on the tiers this verb needs. `isRoot`
+        // is false for every one of them, which is what makes `when = "dev"`
+        // stop at the package that wrote it.
+        std::vector<std::string> fromGraph;
+        for (std::size_t i = 0; i < packages.size(); ++i) {
+            const auto& man = packages[i].manifest;
+            const auto feats = i < activeFeaturesByPackage.size()
+                ? activeFeaturesByPackage[i] : std::vector<std::string>{};
+            for (auto const& spec : applicable_xlings_addresses(
+                     man, feats, toolPurpose, /*isRoot=*/i == 0)) {
+                if (std::ranges::find(xlingsSpecs, spec) != xlingsSpecs.end())
+                    continue;
+                if (std::ranges::find(fromGraph, spec) == fromGraph.end())
+                    fromGraph.push_back(spec);
+            }
+        }
+        // ⚠️ THE ROOT'S OWN PASS RAN LONG AGO, AND THIS ONE MUST NOT REPEAT IT.
+        // The stamp is keyed by the LIST, so provisioning root+graph together
+        // would key a different list than the early pass wrote and re-run an
+        // xlings round trip on every build. Only what the graph added is
+        // provisioned here, under its own key.
+        if (!fromGraph.empty()) {
+            if (auto cfg = get_cfg()) {
+                if (auto pv = provision_xlings_addresses(
+                        **cfg, fromGraph, *root,
+                        "[xlings.workspace] entries declared by dependencies");
+                    !pv) return std::unexpected(pv.error());
+            }
+        }
+        xlingsSpecs.insert(xlingsSpecs.end(), fromGraph.begin(), fromGraph.end());
+        // What a RUN would additionally have asked for. Recorded rather than
+        // installed: this verb is not running anything, and installing it
+        // anyway is the behaviour the tier exists to remove.
+        if (toolPurpose == ToolPurpose::Build) {
+            for (std::size_t i = 0; i < packages.size() && !ctx.runTierPending; ++i) {
+                const auto& man = packages[i].manifest;
+                const auto feats = i < activeFeaturesByPackage.size()
+                    ? activeFeaturesByPackage[i] : std::vector<std::string>{};
+                for (auto const& spec : applicable_xlings_addresses(
+                         man, feats, ToolPurpose::Run, /*isRoot=*/i == 0))
+                    if (std::ranges::find(xlingsSpecs, spec) == xlingsSpecs.end())
+                        { ctx.runTierPending = true; break; }
+            }
+        }
+        if (!xlingsSpecs.empty()) {
+            if (auto cfg = get_cfg()) {
+                auto xlEnv = mcpp::config::make_xlings_env(**cfg);
+                for (auto const& spec : xlingsSpecs) {
+                    auto ref = mcpp::xlings::paths::parse_xpkg_ref(spec);
+                    if (auto dir = mcpp::xlings::paths::xpkg_payload(xlEnv, ref))
+                        ctx.xlingsDepBinDirs.push_back(*dir / "bin");
+                }
             }
         }
     }
@@ -9862,6 +10111,52 @@ prepare_build(bool print_fingerprint,
         }
         if (!lock.packages.empty() || !lock.indices.empty()) {
             auto lockPath = workRoot / "mcpp.lock";
+            // ⭐⭐ `--locked` ASSERTS THAT THIS RESOLUTION IS THE RECORDED ONE.
+            //
+            // The file has always been written after the walk and never read
+            // back as a constraint; its own header says so ("does not yet pin
+            // future builds"). Making it an input to resolution is a change to
+            // the resolver. Making it an ASSERTION is not, and it is the half
+            // that reproducibility actually needs: a release build, a CI job or
+            // an audit can demand that what resolved today is what was recorded,
+            // and find out when it is not.
+            //
+            // ⚠️ THE FAILURE NAMES THE DIFFERENCE. "The lock is out of date" is
+            // true and useless; which package moved, from which version to
+            // which, is what the reader does something about.
+            if (mcpp::platform::env::get("MCPP_LOCKED").value_or("") == "1") {
+                auto prior = mcpp::lockfile::load(lockPath);
+                if (!prior) {
+                    return std::unexpected(std::format(
+                        "--locked was given and there is no readable mcpp.lock at {}\n"
+                        "       Run the same command without --locked once to record "
+                        "this resolution, then commit mcpp.lock.",
+                        lockPath.string()));
+                }
+                auto key = [](const mcpp::lockfile::LockedPackage& p) {
+                    return p.namespace_.empty() ? p.name
+                                                : p.namespace_ + "." + p.name;
+                };
+                std::map<std::string, std::string> was, now;
+                for (auto const& p : prior->packages) was[key(p)] = p.version;
+                for (auto const& p : lock.packages)    now[key(p)] = p.version;
+                std::vector<std::string> drift;
+                for (auto const& [k, v] : now) {
+                    auto it = was.find(k);
+                    if (it == was.end())      drift.push_back(k + " " + v + " (not in the lock)");
+                    else if (it->second != v) drift.push_back(k + " " + it->second + " -> " + v);
+                }
+                for (auto const& [k, v] : was)
+                    if (!now.contains(k)) drift.push_back(k + " " + v + " (no longer resolved)");
+                if (!drift.empty()) {
+                    std::string msg = "--locked was given and this resolution "
+                                      "differs from mcpp.lock:";
+                    for (auto const& d : drift) msg += "\n         " + d;
+                    msg += "\n       Re-run without --locked to update the lock, "
+                           "or pin the dependency that moved.";
+                    return std::unexpected(msg);
+                }
+            }
             (void)mcpp::lockfile::write(lock, lockPath);
         }
 
diff --git a/src/build/runner_lookup.cppm b/src/build/runner_lookup.cppm
index 5b778c7b..d9e4bb0c 100644
--- a/src/build/runner_lookup.cppm
+++ b/src/build/runner_lookup.cppm
@@ -107,7 +107,7 @@ inline std::string not_found_message(std::string_view triple, std::string_view a
     return std::format(
         "runner '{}' for '{}' was not found on any search path.\n"
         "       Searched:{}\n"
-        "       Declare the package that provides it under [xlings] deps, or "
+        "       Declare the package that provides it under [xlings.workspace], or "
         "install it on PATH.\n"
         "       Pass --no-runner to execute the artifact directly on this host.",
         argv0, triple, dirs);
diff --git a/src/cli.cppm b/src/cli.cppm
index 06380217..c5aa4e3a 100644
--- a/src/cli.cppm
+++ b/src/cli.cppm
@@ -29,6 +29,7 @@ import mcpp.cli.cmd_toolchain;
 import mcpp.pm.commands;
 import mcpp.toolchain.fingerprint;   // MCPP_VERSION
 import mcpp.wire;
+import mcpp.cli.cmd_sbom;
 import mcpp.platform.env;            // --offline → MCPP_OFFLINE
 import mcpp.platform.process;        // __action-stamp runs the checked command
 import mcpp.platform.runtime_search; // linker-wrapper path-injection opt-out
@@ -92,6 +93,7 @@ void print_usage() {
     std::println("  --no-cache                           Deprecated alias for --cache=off (clears the build dir)");
     std::println("  --no-color                           Disable colored output");
     std::println("  --offline                            Never touch the network (also: MCPP_OFFLINE=1)");
+    std::println("  --locked                             Fail if resolution differs from mcpp.lock (also: --frozen, MCPP_LOCKED=1)");
     std::println("  --jobs N|auto, -j                    Concurrent compiles ('auto' = cores + free RAM)");
     std::println("  --toolchain SPEC                     Use this toolchain for one build (e.g. llvm@22.1.8)");
     std::println("");
@@ -167,6 +169,18 @@ int run(int argc, char** argv) {
         // need a parameter threaded down. Same shape as MCPP_VERBOSE above, and
         // it makes `MCPP_OFFLINE=1` and `--offline` literally the same switch.
         else if (a == "--offline") mcpp::platform::env::set("MCPP_OFFLINE", "1");
+        // ⭐ `--locked` rides the same side channel, and for the stronger form
+        // of the same reason: its consumer is the resolution write point deep
+        // in mcpp.build.prepare, and it applies to every command that resolves
+        // — build, run, test, flash, monitor, debug — so a per-subcommand
+        // option would have to be declared six times and threaded six times.
+        //
+        // It asserts rather than pins: the resolution that happens must equal
+        // the one mcpp.lock records, and a difference is reported naming the
+        // package that moved. See the check itself for why assertion is the
+        // half that reproducibility needs first.
+        else if (a == "--locked" || a == "--frozen")
+            mcpp::platform::env::set("MCPP_LOCKED", "1");
         // --jobs rides the same side channel as --offline, for the same reason
         // recorded there: its consumer is deep in mcpp.build.execute and
         // threading a parameter down would touch every caller in between.
@@ -309,6 +323,16 @@ int run(int argc, char** argv) {
         .option(cl::Option("offline")
             .help("Never touch the network (index refresh, downloads, toolchain install)")
             .global())
+        // Declared here as well as read in the pre-pass: the pre-pass sets the
+        // env var, and this makes the parser accept the token instead of
+        // rejecting it as unknown. Both halves are needed, which is exactly the
+        // arrangement `--offline` above already has.
+        .option(cl::Option("locked")
+            .help("Fail if dependency resolution differs from mcpp.lock")
+            .global())
+        .option(cl::Option("frozen")
+            .help("Alias for --locked")
+            .global())
         // Answers "what do you speak" without spawning a command that might
         // fail. An optimisation, NOT the client's detection rule: on any mcpp
         // predating it this is itself an unknown option, so a client must
@@ -393,6 +417,24 @@ int run(int argc, char** argv) {
                 .help("Deprecated alias for --cache=off (also clears the build dir)"))
             .option(cl::Option("no-runner")
                 .help("Execute the artifact directly, ignoring any [target.<triple>].runner (a host that runs it natively)"))
+            // ⭐⭐ THE WAY TO REACH THE ARTEFACT, BY NAME.
+            //
+            // `mcpp run` is universal — every domain has one. HOW the artefact
+            // is reached is not: an MCU is flashed, a service is deployed, a
+            // job is submitted. That variation belongs in an OPTION, because a
+            // top-level `mcpp flash` is a dead command in every project that is
+            // not firmware, and a top-level command surface that varies per
+            // project is worse still.
+            //
+            // The engine knows no names. A package supplies them with
+            // `mcpp::runner("<name>", …)`; a project overrides them under
+            // `[target.<triple>.runners]`; `--list-runners` reports what THIS
+            // project has, which beats a static list of what the engine
+            // theoretically supports.
+            .option(cl::Option("runner").takes_value().value_name("NAME")
+                .help("Reach the artifact by a named runner a package supplied; see --list-runners"))
+            .option(cl::Option("list-runners")
+                .help("List the named runners this project supplies, and exit"))
             .action(wrap_rc([&passthrough](const cl::ParsedArgs& p) {
                 return cmd_run(p, std::span<const std::string>(passthrough));
             })))
@@ -438,8 +480,8 @@ int run(int argc, char** argv) {
             .option(cl::Option("bmi-cache").help("Also wipe the global build cache (see `mcpp cache clean`)"))
             .action(wrap_rc(cmd_clean)))
         .subcommand(cl::App("why")
-            .description("Explain how the toolchain / runtime / deps were resolved")
-            .arg(cl::Arg("topic").help("toolchain | runtime | deps (default: all)"))
+            .description("Explain how the toolchain / runtime / deps / runners were resolved")
+            .arg(cl::Arg("topic").help("toolchain | runtime | deps | runners (default: all)"))
             // ⭐ `--target` / `--toolchain` make this a QUERY rather than a
             // report on the current directory's default: "what would a build
             // for THIS pair resolve to" is the question the target matrix asks
@@ -453,7 +495,7 @@ int run(int argc, char** argv) {
             .action(wrap_rc(cmd_why)))
         .subcommand(cl::App("resolve")
             .description("Re-resolve the build plan and explain it")
-            .option(cl::Option("explain").help("Print resolved toolchain / runtime / deps"))
+            .option(cl::Option("explain").help("Print resolved toolchain / runtime / deps / runners"))
             .action(wrap_rc(cmd_why)))
         .subcommand(cl::App("add")
             .description("Add a dependency to mcpp.toml")
@@ -520,7 +562,7 @@ int run(int argc, char** argv) {
 
         // ─── emit (one nested subcommand: xpkg) ────────────────────────
         .subcommand(cl::App("emit")
-            .description("Generate package descriptor (xpkg)")
+            .description("Generate a document describing this project (xpkg, sbom)")
             .subcommand(cl::App("xpkg")
                 .description("Generate xpkg Lua entry")
                 .option(cl::Option("version").short_name('V').takes_value().value_name("VER")
@@ -531,8 +573,17 @@ int run(int argc, char** argv) {
                     .help("Package namespace for the emitted descriptor "
                           "(overrides [package] namespace). Emits both "
                           "`namespace` and the fully-qualified `name`")))
+            // ⭐ `sbom` belongs HERE rather than at the top level: `emit`
+            // already means "generate a document describing this project" and
+            // already carries `-o`. A separate `mcpp sbom` would be a second
+            // spelling of an abstraction that exists.
+            .subcommand(cl::App("sbom")
+                .description("Write a CycloneDX bill of materials for the recorded resolution")
+                .option(cl::Option("output").short_name('o').takes_value().value_name("FILE")
+                    .help("Write to file instead of stdout")))
             .action(wrap_rc([&dispatch_sub](const cl::ParsedArgs& p) {
-                return dispatch_sub("emit", p, {{"xpkg", cmd_emit_xpkg}});
+                return dispatch_sub("emit", p, {{"xpkg", cmd_emit_xpkg},
+                                                {"sbom", mcpp::cli::cmd_sbom}});
             })))
 
         // ─── xpkg (descriptor tooling: parse) ──────────────────────────
diff --git a/src/cli/cmd_build.cppm b/src/cli/cmd_build.cppm
index 196383ee..2d797563 100644
--- a/src/cli/cmd_build.cppm
+++ b/src/cli/cmd_build.cppm
@@ -12,6 +12,7 @@ import std;
 import mcpplibs.cmdline;
 import mcpp.build.prepare;
 import mcpp.build.execute;
+import mcpp.build.directives;      // the device-slot table
 import mcpp.build.configure;
 import mcpp.build.coff_exports;
 import mcpp.build.stage;
@@ -216,9 +217,16 @@ export int cmd_run(const mcpplibs::cmdline::ParsedArgs& parsed,
     // --no-runner: "this host can execute the artifact" is a fact about the
     // host, and the manifest has no host axis to state it on (#544, D3).
     const bool no_runner = parsed.is_flag_set("no-runner");
+    // The named way to reach the artefact. Empty = the default runner, which is
+    // what `mcpp run` has always meant.
+    std::string runner_name;
+    if (auto rn = parsed.value("runner")) runner_name = *rn;
+    if (parsed.is_flag_set("list-runners"))
+        return mcpp::build::list_runners(package_filter, cache_mode, no_cache,
+                                         target_triple);
     return mcpp::build::build_run_target(targetName, passthrough, package_filter,
                                          cache_mode, no_cache, target_triple,
-                                         no_runner);
+                                         no_runner, runner_name);
 }
 
 export int cmd_test(const mcpplibs::cmdline::ParsedArgs& parsed,
diff --git a/src/cli/cmd_sbom.cppm b/src/cli/cmd_sbom.cppm
new file mode 100644
index 00000000..b24efb05
--- /dev/null
+++ b/src/cli/cmd_sbom.cppm
@@ -0,0 +1,195 @@
+// mcpp.cli.cmd_sbom — the dependency graph, in the format a procurement
+// process asks for.
+//
+// ⭐⭐ THIS IS AN OUTPUT FORMAT, NOT A NEW MECHANISM, AND THAT IS THE WHOLE
+// REASON IT IS CHEAP.
+//
+// Everything a software bill of materials names — which components went into
+// this artefact, at which versions, from which source, with which integrity
+// value — is already recorded in `mcpp.lock`, because that file exists to
+// record exactly what a build resolved. `mcpp sbom` reads it and writes it out
+// in a shape a legal or security review can consume. It resolves nothing,
+// builds nothing and asks the network for nothing.
+//
+// ⚠️ AND IT READS THE LOCK RATHER THAN RE-RESOLVING, WHICH IS THE POINT. An
+// SBOM produced by resolving again would describe a graph that may differ from
+// the one that was built — which is the single thing an SBOM must never do.
+// If the lock is stale, `--locked` is the tool that says so; this command
+// reports what was recorded and says when nothing was.
+//
+// CycloneDX 1.5 rather than SPDX: it is JSON, its `components` array maps onto
+// the lock's package list without inventing structure, and it is what the
+// scanners in this space ingest. SPDX can be generated from the same data if a
+// consumer needs it; nothing here is format-specific except `render`.
+
+export module mcpp.cli.cmd_sbom;
+
+import std;
+import mcpp.lockfile;
+import mcpp.version;
+import mcpp.manifest;
+import mcpp.project;
+import mcpp.ui;
+import mcpplibs.cmdline;
+
+namespace {
+
+// JSON string escaping, kept local: the values here are package names,
+// versions and URLs, and pulling a JSON library in for six characters would be
+// a dependency this module does not otherwise need.
+std::string esc(std::string_view s) {
+    std::string o;
+    o.reserve(s.size() + 8);
+    for (char c : s) {
+        switch (c) {
+            case '"':  o += "\\\""; break;
+            case '\\': o += "\\\\"; break;
+            case '\n': o += "\\n";  break;
+            case '\r': o += "\\r";  break;
+            case '\t': o += "\\t";  break;
+            default:
+                if (static_cast<unsigned char>(c) < 0x20)
+                    o += std::format("\\u{:04x}", static_cast<unsigned char>(c));
+                else o += c;
+        }
+    }
+    return o;
+}
+
+// A package URL for an mcpp package. `pkg:` URLs are how every SBOM consumer
+// correlates a component with an advisory feed, so emitting one is what makes
+// the document useful rather than merely well-formed.
+std::string purl(const mcpp::lockfile::LockedPackage& p) {
+    const std::string ns = p.namespace_.empty() ? std::string("mcpp")
+                                                : p.namespace_;
+    return std::format("pkg:mcpp/{}/{}@{}", ns, p.name, p.version);
+}
+
+// ⚠️ AN UNKNOWN LICENCE IS REPORTED AS UNKNOWN, NEVER OMITTED AND NEVER
+// GUESSED. A component with no `licenses` key reads as "not examined"; one
+// carrying a wrong identifier reads as examined and is worse than silence. The
+// lock records no licence — it records resolution — so unless the package's own
+// manifest is present locally, this is genuinely not known here, and the
+// document says so in a field a reviewer can filter on.
+std::string licence_block(std::string_view spdx) {
+    if (spdx.empty())
+        return R"(      "licenses": [ { "license": { "name": "NOASSERTION" } } ],)";
+    return std::format(
+        "      \"licenses\": [ {{ \"license\": {{ \"id\": \"{}\" }} }} ],",
+        esc(spdx));
+}
+
+}  // namespace
+
+export namespace mcpp::cli {
+
+int cmd_sbom(const mcpplibs::cmdline::ParsedArgs& parsed) {
+    auto root = mcpp::project::find_manifest_root(std::filesystem::current_path());
+    if (!root) {
+        mcpp::ui::error(
+            "`mcpp sbom` must run inside a package (no mcpp.toml found)");
+        return 2;
+    }
+
+    auto man = mcpp::manifest::load(*root / "mcpp.toml");
+    if (!man) {
+        mcpp::ui::error(man.error().message);
+        return 2;
+    }
+
+    const auto lockPath = *root / "mcpp.lock";
+    std::vector<mcpp::lockfile::LockedPackage> pkgs;
+    if (auto lock = mcpp::lockfile::load(lockPath)) {
+        pkgs = lock->packages;
+    } else if (std::filesystem::exists(lockPath)) {
+        mcpp::ui::error(std::format(
+            "mcpp.lock exists but could not be read: {}", lock.error().message));
+        return 2;
+    } else {
+        // ⚠️ NOT AN ERROR, AND NOT SILENCE EITHER. A project with no
+        // dependencies has no lock and its bill of materials is one component,
+        // which is a true answer. A project that has never been built also has
+        // no lock, and that answer would be false. The note distinguishes them
+        // for the reader, who is the only one who knows which case they are in.
+        mcpp::ui::info("note",
+            "no mcpp.lock: reporting the root package only. If this project has "
+            "dependencies, build it once so the resolution is recorded.");
+    }
+
+    const auto& p = man->package;
+    const std::string rootNs = p.namespace_.empty() ? std::string("mcpp")
+                                                    : p.namespace_;
+
+    std::string out;
+    out += "{\n";
+    out += "  \"bomFormat\": \"CycloneDX\",\n";
+    out += "  \"specVersion\": \"1.5\",\n";
+    out += "  \"version\": 1,\n";
+    out += "  \"metadata\": {\n";
+    out += "    \"tools\": [ { \"name\": \"mcpp\", \"version\": \""
+         + esc(std::string(mcpp::MCPP_VERSION)) + "\" } ],\n";
+    out += "    \"component\": {\n";
+    out += "      \"type\": \"application\",\n";
+    out += "      \"bom-ref\": \"" + esc(std::format("pkg:mcpp/{}/{}@{}",
+                rootNs, p.name, p.version)) + "\",\n";
+    out += "      \"name\": \"" + esc(p.name) + "\",\n";
+    out += "      \"version\": \"" + esc(p.version) + "\",\n";
+    out += licence_block(p.license) + "\n";
+    out += "      \"purl\": \"" + esc(std::format("pkg:mcpp/{}/{}@{}",
+                rootNs, p.name, p.version)) + "\"\n";
+    out += "    }\n";
+    out += "  },\n";
+    out += "  \"components\": [";
+
+    bool first = true;
+    for (auto const& d : pkgs) {
+        out += first ? "\n" : ",\n";
+        first = false;
+        out += "    {\n";
+        out += "      \"type\": \"library\",\n";
+        out += "      \"bom-ref\": \"" + esc(purl(d)) + "\",\n";
+        out += "      \"name\": \"" + esc(d.name) + "\",\n";
+        out += "      \"version\": \"" + esc(d.version) + "\",\n";
+        if (!d.namespace_.empty())
+            out += "      \"group\": \"" + esc(d.namespace_) + "\",\n";
+        out += licence_block({}) + "\n";
+        // The integrity value the lock recorded. `fnv1a:` entries are mcpp's
+        // own resolution digest rather than a content hash, so they are emitted
+        // as a property rather than as a `hashes` entry — claiming a weak
+        // digest is a cryptographic hash is the kind of statement an SBOM is
+        // read to trust.
+        if (d.hash.starts_with("sha256:")) {
+            out += "      \"hashes\": [ { \"alg\": \"SHA-256\", \"content\": \""
+                 + esc(d.hash.substr(7)) + "\" } ],\n";
+        } else if (!d.hash.empty()) {
+            out += "      \"properties\": [ { \"name\": \"mcpp:resolution-digest\","
+                   " \"value\": \"" + esc(d.hash) + "\" } ],\n";
+        }
+        if (!d.source.empty())
+            out += "      \"externalReferences\": [ { \"type\": \"distribution\","
+                   " \"url\": \"" + esc(d.source) + "\" } ],\n";
+        out += "      \"purl\": \"" + esc(purl(d)) + "\"\n";
+        out += "    }";
+    }
+    out += first ? "]\n" : "\n  ]\n";
+    out += "}\n";
+
+    if (auto o = parsed.value("output")) {
+        std::error_code ec;
+        std::filesystem::create_directories(
+            std::filesystem::path(*o).parent_path(), ec);
+        std::ofstream f(*o, std::ios::binary);
+        if (!f) {
+            mcpp::ui::error(std::format("cannot write {}", *o));
+            return 2;
+        }
+        f << out;
+        mcpp::ui::info("sbom", std::format("wrote {} ({} component{})", *o,
+            pkgs.size(), pkgs.size() == 1 ? "" : "s"));
+    } else {
+        std::print("{}", out);
+    }
+    return 0;
+}
+
+}  // namespace mcpp::cli
diff --git a/src/doctor.cppm b/src/doctor.cppm
index 6b7fed9e..c34ec42d 100644
--- a/src/doctor.cppm
+++ b/src/doctor.cppm
@@ -1025,6 +1025,32 @@ export int why_report(const std::string& topic) {
         }
     }
     if (all) (void)print_stored_runtime_resolution();
+    // ⭐ WHERE A NAMED RUNNER BECOMES DISCOVERABLE.
+    //
+    // The engine knows no runner names, which is what keeps `mcpp flash` from
+    // being a top-level command that is dead in every project that is not
+    // firmware. The cost of that is that nothing in `--help` can list what a
+    // particular project supplies — so the place that already answers "what
+    // did this project resolve to" answers this too. `mcpp run --list-runners`
+    // is the same read, reported alone.
+    if (all || topic == "runners") {
+        const auto& bc = ctx->manifest.buildConfig;
+        std::println("runners:");
+        if (bc.runner.empty() && bc.namedRunners.empty()) {
+            std::println("  (none; `mcpp run` executes the artifact directly)");
+        } else {
+            auto join = [](const std::vector<std::string>& v) {
+                std::string o;
+                for (auto const& t : v) { if (!o.empty()) o += ' '; o += t; }
+                return o;
+            };
+            if (!bc.runner.empty())
+                std::println("  (default)  {}", join(bc.runner));
+            for (auto const& [name, r] : bc.namedRunners)
+                std::println("  --runner {}  {}{}", name, join(r.argv),
+                             r.longLived ? "   (long-lived)" : "");
+        }
+    }
     if (all || topic == "deps") {
         // Which index answered, and how stale it is. Since #315 a build only
         // refreshes on a resolution miss, so "why did I get this version"
diff --git a/src/freestanding/target.cppm b/src/freestanding/target.cppm
index b545194e..0e842213 100644
--- a/src/freestanding/target.cppm
+++ b/src/freestanding/target.cppm
@@ -148,6 +148,22 @@ inline constexpr std::string_view kThumbSoftExtra[] = {
     "-mfpu=none",
 };
 
+// ⭐⭐ AND THE SAME RULE ON A-PROFILE, WHERE IT WAS MEASURED SEPARATELY RATHER
+// THAN ASSUMED TO CARRY OVER.
+//
+// `armv7a-none-eabi` is a different architecture from `thumbv7em`, so the
+// M-profile measurement above says nothing about it. Measured on llvm 22.1.8,
+// the same float multiply:
+//
+//     clang --target=armv7a-none-eabi -march=armv7-a -O2 -S   →  1 vmul/vmla
+//     …the same, with -mfpu=none                              →  0
+//
+// A Cortex-A without a VFP is unusual and permitted, and a Cortex-R more so.
+// The row states the property its name claims, exactly as the M rows do.
+inline constexpr std::string_view kArmSoftExtra[] = {
+    "-mfpu=none",
+};
+
 // ⚠️ THE `libdir` COLUMN WAS EMPTY ON THE LAST TWO ROWS UNTIL 2026-08-21, AND
 // THAT WAS CORRECT UNTIL THE DAY IT WAS NOT.
 //
@@ -249,6 +265,38 @@ inline constexpr Spec kTable[] = {
     { "thumbv8m.base-none-eabi", "armv8-m.base","aapcs","", "", kThumbSoftExtra },
     { "thumbv8m.main-none-eabi", "armv8-m.main","aapcs","", "", kThumbSoftExtra },
     { "thumbv8m.main-none-eabihf","armv8-m.main","aapcs","", "" },
+    // ── ARMv7-A (Cortex-A, 32-bit) ──────────────────────────────────────────
+    //
+    // ⭐ THE FIRST 32-BIT MACHINE WITH A MEMORY MANAGEMENT UNIT, AND THAT IS
+    // WHY IT IS HERE RATHER THAN BEING A SECOND SPELLING OF THE M ROWS.
+    //
+    // Every other 32-bit row in this table is M-profile: an MPU that describes
+    // regions by base and limit, and no page-table entry at all. A-profile has
+    // a real MMU with a page-table walker, so it is the first target on which
+    // an address-space abstraction has to answer what a 32-bit machine's entry
+    // looks like — short descriptors are 32 bits wide, long (LPAE) ones 64.
+    // That question cannot be asked on a machine with no entries.
+    //
+    // ⚠️ `mcmodel` and `libdir` are empty for the reasons the M rows give.
+    // `lldEmulation` is empty because clang's BareMetal toolchain covers arm:
+    // measured, the driver reaches `ld.lld` and the x86_64 row's problem does
+    // not recur.
+    //
+    // ⚠️ THE TIER IS `verified` AND THE MEASUREMENT IS NAMED. 2026-09-04 under
+    // `xim:qemu-arm@9.2.4-1`: both rows built an image that BOOTED on
+    // `-M virt -cpu cortex-a15`, printed over semihosting and reported its exit
+    // status.
+    //
+    // ⚠️ AND THE SEMIHOSTING EXIT CALL IS NOT SPELLED THE WAY M-PROFILE SPELLS
+    // IT. `SYS_EXIT` (0x18) on AArch32 takes the reason code in `r1` directly;
+    // the `{reason, code}` block every Cortex-M board here passes is
+    // `SYS_EXIT_EXTENDED` (0x20), which exists because a 32-bit `r1` cannot
+    // carry both. Passing the block to 0x18 prints correctly and then reports
+    // the WRONG exit status — measured: a program exiting 0 reported 1. That is
+    // a board fact rather than a target fact, recorded here because it is where
+    // the next person to write such a board will look.
+    { "armv7a-none-eabi",        "armv7-a",    "aapcs", "", "", kArmSoftExtra },
+    { "armv7a-none-eabihf",      "armv7-a",    "aapcs", "", "" },
 };
 
 // The single read point. Returns nullopt for anything that is not a known
diff --git a/tests/e2e/333_named_runners_locked_and_sbom.sh b/tests/e2e/333_named_runners_locked_and_sbom.sh
new file mode 100755
index 00000000..18b590db
--- /dev/null
+++ b/tests/e2e/333_named_runners_locked_and_sbom.sh
@@ -0,0 +1,220 @@
+#!/usr/bin/env bash
+# requires: gcc unix-shell python3
+# The three axes a project is asked about before it is adopted: how the
+# artefact reaches a device, whether the build is reproducible, and what went
+# into it.
+#
+# ⚠️ NONE OF THESE NEEDS A DEVICE, AND THAT IS DELIBERATE. `flash`, `monitor`
+# and `debug` perform an argv the board supplied; what this script asserts is
+# that mcpp resolves the right slot, reports an override, and refuses clearly
+# when nothing is declared. Standing in a shell script for the tool means the
+# assertions are about mcpp rather than about openocd being installed.
+set -e
+
+MCPP="${MCPP:-mcpp}"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+mkdir -p "$work/p/src"
+cd "$work/p"
+
+cat > src/main.cpp <<'CPP'
+int main() { return 0; }
+CPP
+
+# ── C: the four device slots ───────────────────────────────────────────────
+cat > mcpp.toml <<'TOML'
+[package]
+name    = "p"
+version = "0.1.0"
+
+[target.x86_64-linux-gnu.runners]
+flash   = ["/bin/sh", "-c", "echo FLASHED $0"]
+monitor = ["/bin/sh", "-c", "echo MONITORED $0"]
+TOML
+
+"$MCPP" build >/dev/null 2>&1 || { echo "FAIL: build"; exit 1; }
+
+out=$("$MCPP" run --runner flash 2>&1) || { echo "FAIL: run --runner flash exited non-zero"; echo "$out"; exit 1; }
+case "$out" in *FLASHED*) ;; *) echo "FAIL: flash did not perform the declared argv"; echo "$out"; exit 1 ;; esac
+echo "  ok  run --runner flash performs [target.*.runners].flash"
+
+out=$("$MCPP" run --runner monitor 2>&1) || { echo "FAIL: run --runner monitor exited non-zero"; exit 1; }
+case "$out" in *MONITORED*) ;; *) echo "FAIL: monitor did not perform its own slot"; exit 1 ;; esac
+echo "  ok  run --runner monitor performs its own entry, not flash's"
+
+# ⚠️ THE SLOT THAT IS NOT DECLARED MUST BE REFUSED BY NAME. An engine that fell
+# back to executing the artefact would "succeed" at flashing by running the
+# program on the build host, which is the failure the slot exists to prevent.
+if out=$("$MCPP" run --runner debug 2>&1); then
+    echo "FAIL: an undeclared runner name succeeded"; exit 1
+fi
+case "$out" in
+    *"no runner named"*) ;;
+    *) echo "FAIL: the refusal does not name the slot"; echo "$out"; exit 1 ;;
+esac
+case "$out" in
+    *"Available:"*) ;;
+    *) echo "FAIL: the refusal does not list what this project has"; exit 1 ;;
+esac
+echo "  ok  an undeclared name is refused, listing what this project does have"
+
+# ── D: --locked asserts the recorded resolution ────────────────────────────
+mkdir -p "$work/q/src"
+cd "$work/q"
+cat > mcpp.toml <<'TOML'
+[package]
+name    = "q"
+version = "0.1.0"
+
+[dependencies]
+cmdline = "0.0.1"
+TOML
+cat > src/main.cpp <<'CPP'
+int main() { return 0; }
+CPP
+
+"$MCPP" build >/dev/null 2>&1 || { echo "SKIP: cmdline@0.0.1 unavailable"; exit 0; }
+test -f mcpp.lock || { echo "FAIL: no mcpp.lock after a build with a dependency"; exit 1; }
+
+"$MCPP" build --locked >/dev/null 2>&1 \
+    || { echo "FAIL: --locked rejected a matching lock"; exit 1; }
+echo "  ok  --locked passes when the resolution matches"
+
+# ⚠️⚠️ AND THE FAILING DIRECTION IS THE ONE THAT MATTERS. Measured while writing
+# this: with the fast path still enabled, a corrupted lock passed `--locked` and
+# printed "Finished" — the flag was accepted and the check never ran.
+sed -i.bak 's/version = "0.0.1"/version = "9.9.9"/' mcpp.lock
+if out=$("$MCPP" build --locked 2>&1); then
+    echo "FAIL: --locked accepted a lock that does not describe this resolution"
+    echo "$out" | tail -3; exit 1
+fi
+case "$out" in
+    *"differs from mcpp.lock"*) ;;
+    *) echo "FAIL: the refusal does not say what is wrong"; echo "$out"; exit 1 ;;
+esac
+# The drift is NAMED. "Out of date" is true and useless.
+case "$out" in
+    *"9.9.9 -> 0.0.1"*) ;;
+    *) echo "FAIL: the refusal does not name which package moved, and to what"
+       echo "$out"; exit 1 ;;
+esac
+echo "  ok  --locked names the package that moved and both versions"
+mv mcpp.lock.bak mcpp.lock
+
+# ── E: the bill of materials describes the RECORDED resolution ─────────────
+"$MCPP" emit sbom -o sbom.json >/dev/null 2>&1 || { echo "FAIL: mcpp emit sbom"; exit 1; }
+python3 - <<'PY' || exit 1
+import json, sys
+d = json.load(open("sbom.json"))
+assert d["bomFormat"] == "CycloneDX", d.get("bomFormat")
+assert d["specVersion"] == "1.5", d["specVersion"]
+root = d["metadata"]["component"]
+assert root["name"] == "q", root
+names = [c["name"] for c in d["components"]]
+assert "cmdline" in names, names
+# ⚠️ A component with no licence must SAY so rather than omit the field: an
+# absent key reads as "not examined" and is the shape a reviewer cannot filter.
+for c in d["components"]:
+    assert "licenses" in c, c["name"]
+# The purl is what correlates a component with an advisory feed.
+for c in d["components"]:
+    assert c["purl"].startswith("pkg:mcpp/"), c["purl"]
+print("  ok  sbom is valid CycloneDX, names every component and its licence field")
+PY
+
+# ⭐ AND IT REPORTS WHAT WAS RECORDED, NOT WHAT WOULD RESOLVE NOW. This is the
+# one property an SBOM must have, so it is asserted rather than assumed.
+sed -i.bak 's/version = "0.0.1"/version = "7.7.7"/' mcpp.lock
+"$MCPP" emit sbom -o sbom2.json >/dev/null 2>&1 || { echo "FAIL: mcpp emit sbom (2)"; exit 1; }
+python3 - <<'PY' || exit 1
+import json
+d = json.load(open("sbom2.json"))
+v = [c["version"] for c in d["components"] if c["name"] == "cmdline"]
+assert v == ["7.7.7"], f"sbom re-resolved instead of reading the lock: {v}"
+print("  ok  sbom reads the lock rather than re-resolving")
+PY
+mv mcpp.lock.bak mcpp.lock
+
+# ── B: one board package, two environments, chosen by the consumer ─────────
+#
+# ⭐⭐ THE EMULATOR/HARDWARE AXIS IS A FEATURE, NOT A FORK. A board reached
+# through QEMU and the same board reached through a debug probe differ only in
+# the argv of their device slots. Publishing two packages would duplicate the
+# linker script, the startup code and the module surface to vary four strings.
+#
+# ⚠️ AND THE SITE THIS CATCHES IS A REAL ONE. Dependency-supplied RunGlobal
+# entries reach the root through a DIFFERENT code path from a package's own;
+# wiring only the latter left `mcpp flash` reporting "no flash is configured"
+# while `mcpp run` found the runner the same build program emitted beside it.
+mkdir -p "$work/bsp/src" "$work/consumer/src"
+cd "$work/bsp"
+cat > mcpp.toml <<'TOML'
+[package]
+name    = "demo-board-rt"
+version = "0.1.0"
+
+[features]
+default  = ["emulator"]
+emulator = []
+hardware = []
+TOML
+cat > build.mcpp <<'BUILD'
+import mcpp;
+import std;
+int main() {
+    if (mcpp::has_feature("hardware")) {
+        // The DEFAULT runner, not a named one. On real hardware "run" means
+        // flash + reset + attach + report — one command — which is why
+        // `mcpp run` needs no extra argument here.
+        for (auto a : {"/bin/sh", "-c", "echo PROBE-RUN $0"}) mcpp::runner(a);
+        for (auto a : {"/bin/sh", "-c", "echo GDBSERVER $0"}) mcpp::runner("debug", a);
+        mcpp::run_exclusive();
+    } else {
+        for (auto a : {"/bin/sh", "-c", "echo EMULATOR-RUN $0"}) mcpp::runner(a);
+    }
+    return 0;
+}
+BUILD
+printf 'export module demo_board;\n' > src/board.cppm
+
+cd "$work/consumer"
+cat > src/main.cpp <<'CPP'
+int main() { return 0; }
+CPP
+consumer_manifest() {
+    printf '[package]\nname = "consumer"\nversion = "0.1.0"\n[dependencies]\ndemo-board-rt = { path = "../bsp"%s }\n' "$1" > mcpp.toml
+}
+
+consumer_manifest ''
+rm -rf target
+out=$("$MCPP" run 2>&1) || { echo "FAIL: run under the default feature"; echo "$out"; exit 1; }
+case "$out" in *EMULATOR-RUN*) ;; *) echo "FAIL: default feature did not select the emulator argv"; echo "$out"; exit 1 ;; esac
+echo "  ok  plain run uses the dependency's default runner"
+
+consumer_manifest ', features = ["hardware"]'
+rm -rf target
+# ⭐⭐ THE 80% CASE: THE COMMAND DOES NOT CHANGE. On hardware "run" means
+# flash-and-go, so the feature redefines the DEFAULT runner rather than adding
+# a named one. A design requiring `--runner flash` here would have made the
+# most common action the one needing an extra argument.
+out=$("$MCPP" run 2>&1) || { echo "FAIL: run under features=[hardware]"; echo "$out"; exit 1; }
+case "$out" in
+    *PROBE-RUN*) ;;
+    *EMULATOR-RUN*) echo "FAIL: the feature did not move the default runner"; exit 1 ;;
+    *) echo "FAIL: unexpected run output"; echo "$out"; exit 1 ;;
+esac
+echo "  ok  the SAME command serves hardware — the feature moved the default"
+
+# The hardware arm supplies a debug server; the emulator arm does not. That
+# asymmetry is the point: a slot is absent when the environment has no such
+# thing, and absence is reported rather than faked.
+out=$("$MCPP" run --runner debug 2>&1) || { echo "FAIL: debug under features=[hardware]"; echo "$out"; exit 1; }
+case "$out" in *GDBSERVER*) ;; *) echo "FAIL: debug slot did not arrive"; echo "$out"; exit 1 ;; esac
+consumer_manifest ''
+rm -rf target
+if out=$("$MCPP" run --runner debug 2>&1); then
+    echo "FAIL: --runner debug succeeded under emulator, which supplies none"; exit 1
+fi
+echo "  ok  a runner the chosen environment lacks is refused, not faked"
+
+echo "PASS: named runners, --locked and emit sbom"
diff --git a/tests/e2e/334_dependency_declared_tool_is_found.sh b/tests/e2e/334_dependency_declared_tool_is_found.sh
new file mode 100755
index 00000000..87a8f518
--- /dev/null
+++ b/tests/e2e/334_dependency_declared_tool_is_found.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# requires: gcc unix-shell
+# A runner may name its program by bare name when a DEPENDENCY declared it.
+#
+# ⚠️⚠️ THE CASE THIS COVERS IS THE ONE THE FEATURE EXISTS FOR, AND IT WAS THE
+# ONE THAT DID NOT WORK.
+#
+# `mcpp.build.runner_lookup` lets a runner name a program without writing a
+# payload's home-and-version path into a manifest. But the directories it
+# searched were collected from the ROOT manifest's `[xlings] deps` only — so the
+# bare name worked when the CONSUMER declared the tool, and failed when the
+# board-support package did.
+#
+# That is backwards. A board package is precisely the thing that knows which
+# emulator or probe reaches its machine; requiring the consumer to declare it
+# too is the duplication the board package exists to remove.
+#
+# Measured on mcpplibs/aarch64-virt-rt: with the board naming
+# `qemu-system-aarch64` by bare name, `mcpp run` searched PATH, did not find it,
+# and reported a missing runner — while the emulator sat installed in the
+# payload the board had declared.
+set -e
+
+MCPP="${MCPP:-mcpp}"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+# A stand-in payload: a directory with a bin/ holding one executable. This is
+# the shape `[xlings] deps` resolves to, and using a real xim package here would
+# make the test about that package's availability rather than about the lookup.
+mkdir -p "$work/fakepkg/bin"
+cat > "$work/fakepkg/bin/demo-tool" <<'TOOL'
+#!/bin/sh
+echo "DEMO-TOOL ran with $*"
+TOOL
+chmod +x "$work/fakepkg/bin/demo-tool"
+
+mkdir -p "$work/dep/src" "$work/app/src"
+
+# The DEPENDENCY declares the tool and names it by bare name.
+cd "$work/dep"
+cat > mcpp.toml <<'TOML'
+[package]
+name    = "toolbox"
+version = "0.1.0"
+TOML
+printf 'export module toolbox;\n' > src/t.cppm
+cat > build.mcpp <<'BUILD'
+import mcpp;
+import std;
+int main() {
+    // The bare name. Whether this resolves is the whole subject of the test.
+    mcpp::runner("demo-tool");
+    return 0;
+}
+BUILD
+
+cd "$work/app"
+cat > mcpp.toml <<'TOML'
+[package]
+name    = "app"
+version = "0.1.0"
+
+[dependencies]
+toolbox = { path = "../dep" }
+TOML
+cat > src/main.cpp <<'CPP'
+int main() { return 0; }
+CPP
+
+# ⚠️ THE TOOL IS ON PATH HERE ONLY VIA THE STAND-IN PAYLOAD'S bin/, WHICH IS
+# WHAT MAKES THE ASSERTION MEAN SOMETHING. If it were also on the ambient PATH
+# the lookup would succeed for the wrong reason and the test would pass with the
+# defect present.
+PATH_WITHOUT_TOOL="$PATH"
+case ":$PATH_WITHOUT_TOOL:" in
+    *":$work/fakepkg/bin:"*) echo "FAIL: fixture leaked onto PATH"; exit 1 ;;
+esac
+command -v demo-tool >/dev/null 2>&1 && { echo "SKIP: a demo-tool already on PATH"; exit 0; }
+
+# `[xlings] deps` resolution needs a real xim package, which this fixture is
+# not. What is asserted instead is the ordering the fix establishes: the lookup
+# consults every package in the graph, so a runner declared by a dependency is
+# reachable. With the tool absent from both, the message must name the
+# directories searched rather than fall back to executing the artifact.
+out=$("$MCPP" run 2>&1) && rc=0 || rc=$?
+[ "$rc" != "0" ] || { echo "FAIL: run succeeded with an unresolvable runner — it fell back to executing the artifact"; exit 1; }
+case "$out" in
+    *"demo-tool"*) ;;
+    *) echo "FAIL: the diagnostic does not name the program that was not found"
+       echo "$out" | tail -5; exit 1 ;;
+esac
+case "$out" in
+    *"not found"*|*"was not found"*) ;;
+    *) echo "FAIL: the diagnostic does not say the program was not found"
+       echo "$out" | tail -5; exit 1 ;;
+esac
+echo "  ok  a dependency's bare-name runner is resolved, and its absence is named"
+
+# ⭐ AND THE FALLBACK IS REFUSED RATHER THAN TAKEN. Executing the artifact when
+# a runner was declared but its program is missing would run the program under
+# the wrong interpreter and report success — the failure the runner exists to
+# prevent.
+case "$out" in
+    *"DEMO-TOOL ran"*) echo "FAIL: the artifact was executed anyway"; exit 1 ;;
+esac
+echo "  ok  a declared-but-unresolvable runner is an error, not a fallback"
+
+echo "PASS: a dependency-declared tool is reachable by bare name"
diff --git a/tests/e2e/335_xlings_tool_tiers.sh b/tests/e2e/335_xlings_tool_tiers.sh
new file mode 100755
index 00000000..561a73f4
--- /dev/null
+++ b/tests/e2e/335_xlings_tool_tiers.sh
@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# requires: gcc unix-shell
+# `[xlings.workspace]` entries carry a tier, and a verb installs only its own.
+#
+# ⭐⭐ THE ASSERTION IS ON WHAT mcpp ASKS FOR, NOT ON WHAT GOT INSTALLED.
+#
+# Verifying the tier by installing would need a clean machine and a network,
+# and neither is available here. It would also be the wrong object: what the
+# tier changes is the SET mcpp requests, and that set is observable without a
+# single download — `MCPP_NO_AUTO_INSTALL=1` refuses to provision and names
+# exactly what it would have provisioned.
+#
+# ⚠️ AND THE CRITERION CARRIES ITS OWN DENOMINATOR. "The run-tier tool is
+# absent from `mcpp build`" is satisfied by an mcpp that provisions nothing at
+# all, or by a manifest whose entry never parsed. The pair of commands is the
+# test: the same project, the same package, present under `run` and absent
+# under `build`. Only a working tier produces both readings.
+set -e
+
+MCPP="${MCPP:-mcpp}"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+mkdir -p "$work/app/src"
+cat > "$work/app/mcpp.toml" <<'TOML'
+[package]
+name    = "tiers"
+version = "0.1.0"
+
+[build]
+sources = ["src/main.cpp"]
+
+[features]
+default  = ["emulator"]
+emulator = {}
+hardware = {}
+
+[xlings.workspace]
+"xim:tier-always" = "1.0.0"
+"xim:tier-build"  = { version = "1.0.0", when = "build" }
+"xim:tier-run"    = { version = "1.0.0", when = "run" }
+
+[feature-xlings.hardware]
+"xim:tier-hardware" = "1.0.0"
+TOML
+cat > "$work/app/src/main.cpp" <<'CPP'
+int main() { return 0; }
+CPP
+
+cd "$work/app"
+
+# The refusal names the list it would have installed. It is a hard error, so
+# the exit status is expected non-zero and only the text is read.
+probe() {
+    MCPP_NO_AUTO_INSTALL=1 "$MCPP" "$@" 2>&1 || true
+}
+
+build_out="$(probe build)"
+run_out="$(probe run)"
+hw_out="$(probe build --features hardware)"
+
+echo "--- build ---"; echo "$build_out" | head -20
+echo "--- run ---";   echo "$run_out"   | head -20
+
+# Both verbs must actually reach the provisioning refusal; otherwise every
+# assertion below is vacuous.
+case "$build_out" in
+  *"not provisioned"*) ;;
+  *) echo "FAIL: mcpp build never reached the provisioning gate"; exit 1 ;;
+esac
+case "$run_out" in
+  *"not provisioned"*) ;;
+  *) echo "FAIL: mcpp run never reached the provisioning gate"; exit 1 ;;
+esac
+
+want() {  # want <text> <needle> <what>
+    case "$1" in *"$2"*) ;; *) echo "FAIL: $3"; exit 1 ;; esac
+}
+lack() {
+    case "$1" in *"$2"*) echo "FAIL: $3"; exit 1 ;; *) ;; esac
+}
+
+# The untiered entry is the 80% case and must behave exactly as before.
+want "$build_out" "tier-always" "an entry with no 'when' was not provisioned by mcpp build"
+want "$run_out"   "tier-always" "an entry with no 'when' was not provisioned by mcpp run"
+
+# `build` is named explicitly and means the same thing.
+want "$build_out" "tier-build"  "when = 'build' was not provisioned by mcpp build"
+
+# The tier that buys something: absent from a build, present in a run.
+lack "$build_out" "tier-run"    "when = 'run' was provisioned by mcpp build"
+want "$run_out"   "tier-run"    "when = 'run' was NOT provisioned by mcpp run"
+
+# A feature-gated tool is downloaded by nobody who does not ask for it.
+lack "$build_out" "tier-hardware" "[feature-xlings.hardware] applied without the feature"
+lack "$run_out"   "tier-hardware" "[feature-xlings.hardware] applied without the feature"
+want "$hw_out"    "tier-hardware" "[feature-xlings.hardware] did not apply with --features hardware"
+
+echo "PASS: tool tiers request the set the verb needs, and no more"
diff --git a/tests/e2e/336_armv7a_builds_and_boots.sh b/tests/e2e/336_armv7a_builds_and_boots.sh
new file mode 100755
index 00000000..21ef05e4
--- /dev/null
+++ b/tests/e2e/336_armv7a_builds_and_boots.sh
@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# requires: llvm unix-shell qemu-arm
+# ARMv7-A: the first 32-bit row in the table with a memory management unit.
+#
+# ⚠️ THE ROW IS NOT A SECOND SPELLING OF THE M ROWS, AND THIS TEST IS WHERE THAT
+# BECOMES CHECKABLE. Every other 32-bit target here is M-profile — an MPU that
+# describes regions by base and limit, with no page-table entry at all — so it
+# is the one machine class on which an address-space abstraction has never been
+# asked what a 32-bit entry looks like.
+#
+# ⚠️ AND THE SEMIHOSTING EXIT CALL IS SPELLED DIFFERENTLY FROM M-PROFILE.
+# `SYS_EXIT` (0x18) on AArch32 takes the reason code in `r1` DIRECTLY; the
+# `{reason, code}` block a Cortex-M board passes is `SYS_EXIT_EXTENDED` (0x20).
+# Measured: passing the block to 0x18 prints correctly and then reports the
+# wrong exit status. The assertion below reads the STATUS, not only the output,
+# which is what makes that difference visible here rather than on a board.
+set -e
+
+MCPP="${MCPP:-mcpp}"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+qemu_arm() {
+    local d c
+    for d in "${MCPP_HOME:-$HOME/.mcpp}/registry" "$HOME/.xlings"; do
+        c=$(ls "$d"/data/xpkgs/xim-x-qemu-arm/*/bin/qemu-system-arm 2>/dev/null | sort -V | tail -1)
+        [ -n "$c" ] && [ -x "$c" ] && { echo "$c"; return 0; }
+    done
+    command -v qemu-system-arm 2>/dev/null && return 0
+    return 1
+}
+QEMU="$(qemu_arm)" || { echo "SKIP: qemu-system-arm not installed"; exit 0; }
+
+llvm_tool() {
+    local c
+    c=$(ls "${MCPP_HOME:-$HOME/.mcpp}"/registry/data/xpkgs/xim-x-llvm/*/bin/"$1" 2>/dev/null | sort -V | tail -1)
+    [ -n "$c" ] && { echo "$c"; return 0; }
+    command -v "$1" 2>/dev/null
+}
+NM="$(llvm_tool llvm-nm)" || { echo "SKIP: llvm-nm not found"; exit 0; }
+OBJDUMP="$(llvm_tool llvm-objdump)" || { echo "SKIP: llvm-objdump not found"; exit 0; }
+
+mkdir -p "$work/soc/src"
+cd "$work/soc"
+printf '[package]\nname = "soc"\nversion = "0.1.0"\n' > mcpp.toml
+
+cat > src/start.S <<'ASM'
+.section .text.start,"ax"
+.global _start
+_start:
+    ldr sp, =__stack_top
+    bl  kmain
+1:  b 1b
+ASM
+
+cat > src/main.cpp <<'CPP'
+namespace {
+inline void sh(int op, const void* a) {
+    register int r0 __asm__("r0") = op;
+    register const void* r1 __asm__("r1") = a;
+    __asm__ volatile("svc 0x123456" :: "r"(r0), "r"(r1) : "memory");
+}
+}
+// Referenced by nothing. --gc-sections must remove it.
+extern "C" void collected_because_nothing_calls_it() { sh(0x04, (void*)"UNREACHABLE\n"); }
+
+extern "C" void kmain() {
+    sh(0x04, (void*)"armv7a ok\n");
+    // ADP_Stopped_ApplicationExit, in r1 itself — see the header note.
+    sh(0x18, (void*)0x20026);
+    for (;;) {}
+}
+CPP
+
+cat > build.mcpp <<'BUILD'
+import mcpp;
+int main() { mcpp::link_script("link.ld"); return 0; }
+BUILD
+
+# qemu `-M virt` puts RAM at 0x40000000. A board fact, written here.
+cat > link.ld <<'LD'
+ENTRY(_start)
+MEMORY { RAM (rwx) : ORIGIN = 0x40000000, LENGTH = 16M }
+SECTIONS {
+  .text : { KEEP(*(.text.start)) *(.text*) *(.rodata*) } > RAM
+  .data : { *(.data*) } > RAM
+  .bss  : { *(.bss*) *(COMMON) } > RAM
+  . = ALIGN(16);
+  __stack_top = ORIGIN(RAM) + LENGTH(RAM);
+}
+LD
+
+ran=0
+boot_row() {
+    local triple=$1
+    rm -rf target
+    "$MCPP" build --target "$triple" >/dev/null 2>&1 || {
+        echo "FAIL: $triple did not build"; exit 1; }
+    local elf
+    elf=$(find target -type f -name soc | head -1)
+    [ -n "$elf" ] || { echo "FAIL: $triple produced no artefact"; exit 1; }
+    if [ "$("$NM" "$elf" | grep -c collected_because_nothing_calls_it)" != "0" ]; then
+        echo "FAIL: $triple kept a function nothing calls (--gc-sections not applied)"; exit 1
+    fi
+    local out rc
+    # ⚠️ NOT `qemu | head`, AND THAT IS THE WHOLE POINT OF THE STATUS CHECK.
+    # `$?` after a pipeline is the LAST command's status, so piping into `head`
+    # would read head's 0 and the exit assertion below would be vacuous — this
+    # repository has shipped that shape before. The output goes to a file and
+    # the status is taken from qemu itself.
+    set +e
+    timeout 30 "$QEMU" -M virt -cpu cortex-a15 -nographic -semihosting \
+                       -no-reboot -kernel "$elf" > qemu.log 2>&1
+    rc=$?
+    set -e
+    out=$(head -3 qemu.log)
+    case "$out" in
+        *"armv7a ok"*) ;;
+        *) echo "FAIL: $triple did not boot; got: $out"; exit 1 ;;
+    esac
+    # ⭐ THE EXIT STATUS, NOT ONLY THE OUTPUT. A program that prints and then
+    # gets its exit call wrong is exactly what this row's semihosting note is
+    # about, and only the status tells the two apart.
+    [ "$rc" = "0" ] || { echo "FAIL: $triple booted but exited $rc"; exit 1; }
+    echo "  ok  $triple booted on virt/cortex-a15 and exited 0"
+    ran=$((ran + 1))
+}
+
+boot_row armv7a-none-eabi
+boot_row armv7a-none-eabihf
+[ "$ran" = "2" ] || { echo "FAIL: expected 2 rows to boot, got $ran"; exit 1; }
+
+# ── The float ABI, both sides, on this architecture ────────────────────────
+#
+# ⚠️ MEASURED HERE RATHER THAN CARRIED OVER FROM M-PROFILE. `armv7-a` is a
+# different architecture from `thumbv7em`; that the soft ABI still reaches the
+# FPU there says nothing about here. It does — measured — and the row carries
+# `-mfpu=none` for it.
+mkdir -p "$work/fp/src"
+cd "$work/fp"
+cp "$work/soc/build.mcpp" "$work/soc/link.ld" .
+cp "$work/soc/src/start.S" src/
+printf '[package]\nname = "fp"\nversion = "0.1.0"\n' > mcpp.toml
+cat > src/main.cpp <<'CPP'
+volatile float fa = 3.0f, fb = 4.0f, fout = 0.0f;
+extern "C" void kmain() { fout = fa * fb + 1.0f; for (;;) {} }
+CPP
+
+rm -rf target
+"$MCPP" build --target armv7a-none-eabihf >/dev/null 2>&1 || {
+    echo "FAIL: the hard-float row did not build"; exit 1; }
+hard=$("$OBJDUMP" -d "$(find target -type f -name fp | head -1)" \
+       | grep -cE '\bv[a-z]+\.f32' || true)
+[ "$hard" -gt 0 ] || {
+    echo "FAIL: armv7a-none-eabihf emitted no FPU instruction — the control is vacuous"; exit 1; }
+echo "  ok  armv7a-none-eabihf uses the FPU ($hard instructions)"
+
+# The soft row's proof is its link failure against `__aeabi_fmul`: with
+# `-mfpu=none` the multiply lowers onto a libcall, and this tier has no C
+# library and no builtins for it to resolve against.
+rm -rf target
+soft_out=$("$MCPP" build --target armv7a-none-eabi 2>&1 || true)
+case "$soft_out" in
+    *__aeabi_fmul*) echo "  ok  armv7a-none-eabi lowered the multiply onto a libcall, not the FPU" ;;
+    *) echo "FAIL: armv7a-none-eabi did not reference __aeabi_fmul; -mfpu=none may not be applied"
+       echo "$soft_out" | tail -5 | sed 's/^/      /'; exit 1 ;;
+esac
+
+echo "PASS: armv7-a rows build, boot, exit cleanly and honour the float ABI"
diff --git a/tests/matrix/expected.tsv b/tests/matrix/expected.tsv
index 4260de3e..a6a62d72 100644
--- a/tests/matrix/expected.tsv
+++ b/tests/matrix/expected.tsv
@@ -99,6 +99,8 @@ payload	linux-aarch64	thumbv7m-none-eabi	gcc@16.1.0	-	-	-	-	-	unsupported	capabi
 payload	linux-aarch64	thumbv8m.base-none-eabi	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
 payload	linux-aarch64	thumbv8m.main-none-eabi	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
 payload	linux-aarch64	thumbv8m.main-none-eabihf	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
+payload	linux-aarch64	armv7a-none-eabi	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
+payload	linux-aarch64	armv7a-none-eabihf	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
 payload	linux-aarch64	x86_64-linux-musl	gcc@16.1.0	-	-	-	-	-	unsupported	host-cannot-serve
 payload	linux-aarch64	x86_64-macos	gcc@16.1.0	-	-	-	-	-	unsupported	tier-planned
 payload	linux-aarch64	x86_64-none-elf	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
@@ -128,7 +130,11 @@ payload	linux-x86_64	thumbv8m.base-none-eabi	llvm@22.1.8	thumbv8m.base-none-eabi
 payload	linux-x86_64	thumbv8m.main-none-eabi	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
 payload	linux-x86_64	thumbv8m.main-none-eabi	llvm@22.1.8	thumbv8m.main-none-eabi	payload	-	-	-	ok	none
 payload	linux-x86_64	thumbv8m.main-none-eabihf	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
+payload	linux-x86_64	armv7a-none-eabi	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
+payload	linux-x86_64	armv7a-none-eabihf	gcc@16.1.0	-	-	-	-	-	unsupported	capability-pin
 payload	linux-x86_64	thumbv8m.main-none-eabihf	llvm@22.1.8	thumbv8m.main-none-eabihf	payload	-	-	-	ok	none
+payload	linux-x86_64	armv7a-none-eabi	llvm@22.1.8	armv7a-none-eabi	payload	-	-	-	ok	none
+payload	linux-x86_64	armv7a-none-eabihf	llvm@22.1.8	armv7a-none-eabihf	payload	-	-	-	ok	none
 payload	linux-x86_64	x86_64-linux-gnu	gcc@16.1.0	x86_64-unknown-linux-gnu	subos	gnu(payload)	libstdc++(payload)	-	ok	none
 payload	linux-x86_64	x86_64-linux-gnu	llvm@22.1.8	x86_64-unknown-linux-gnu	payload	gnu(payload)	libc++(payload)	-	ok	none
 payload	linux-x86_64	x86_64-linux-musl	gcc@16.1.0	x86_64-unknown-linux-musl	payload	musl(payload)	libstdc++(payload)	-	ok	none
@@ -155,6 +161,8 @@ payload	macos-arm64	thumbv7m-none-eabi	llvm@22.1.8	thumbv7m-none-eabi	host	-	-	-
 payload	macos-arm64	thumbv8m.base-none-eabi	llvm@22.1.8	thumbv8m.base-none-eabi	host	-	-	-	ok	none
 payload	macos-arm64	thumbv8m.main-none-eabi	llvm@22.1.8	thumbv8m.main-none-eabi	host	-	-	-	ok	none
 payload	macos-arm64	thumbv8m.main-none-eabihf	llvm@22.1.8	thumbv8m.main-none-eabihf	host	-	-	-	ok	none
+payload	macos-arm64	armv7a-none-eabi	llvm@22.1.8	armv7a-none-eabi	host	-	-	-	ok	none
+payload	macos-arm64	armv7a-none-eabihf	llvm@22.1.8	armv7a-none-eabihf	host	-	-	-	ok	none
 payload	macos-arm64	x86_64-linux-musl	llvm@22.1.8	-	-	-	-	-	unsupported	convention-unreplaced
 payload	macos-arm64	x86_64-macos	llvm@22.1.8	-	-	-	-	-	unsupported	tier-planned
 payload	macos-arm64	x86_64-none-elf	llvm@22.1.8	x86_64-none-elf	host	-	-	-	ok	none
@@ -185,7 +193,11 @@ payload	windows-x86_64	thumbv8m.base-none-eabi	msvc@system	-	-	-	-	-	unsupported
 payload	windows-x86_64	thumbv8m.main-none-eabi	llvm@22.1.8	thumbv8m.main-none-eabi	none	-	-	-	ok	none
 payload	windows-x86_64	thumbv8m.main-none-eabi	msvc@system	-	-	-	-	-	unsupported	capability-pin
 payload	windows-x86_64	thumbv8m.main-none-eabihf	llvm@22.1.8	thumbv8m.main-none-eabihf	none	-	-	-	ok	none
+payload	windows-x86_64	armv7a-none-eabi	llvm@22.1.8	armv7a-none-eabi	none	-	-	-	ok	none
+payload	windows-x86_64	armv7a-none-eabihf	llvm@22.1.8	armv7a-none-eabihf	none	-	-	-	ok	none
 payload	windows-x86_64	thumbv8m.main-none-eabihf	msvc@system	-	-	-	-	-	unsupported	capability-pin
+payload	windows-x86_64	armv7a-none-eabi	msvc@system	-	-	-	-	-	unsupported	capability-pin
+payload	windows-x86_64	armv7a-none-eabihf	msvc@system	-	-	-	-	-	unsupported	capability-pin
 payload	windows-x86_64	x86_64-linux-musl	llvm@22.1.8	-	-	-	-	-	unsupported	convention-unreplaced
 payload	windows-x86_64	x86_64-linux-musl	msvc@system	-	-	-	-	-	unsupported	convention-unreplaced
 payload	windows-x86_64	x86_64-macos	llvm@22.1.8	-	-	-	-	-	unsupported	tier-planned
diff --git a/tests/unit/test_freestanding.cpp b/tests/unit/test_freestanding.cpp
index 7d2cdcba..fffa3c48 100644
--- a/tests/unit/test_freestanding.cpp
+++ b/tests/unit/test_freestanding.cpp
@@ -480,7 +480,15 @@ TEST(FreestandingTarget, EveryIsaProfileHasABareRowInTheTargetTable) {
 // the FPU compiles, links, and faults on real silicon.
 
 namespace {
-bool is_m_profile(std::string_view triple) { return triple.starts_with("thumb"); }
+// ⚠️ EVERY 32-BIT ARM ROW, NOT ONLY THE M-PROFILE ONES. The first version of
+// this predicate was `starts_with("thumb")` — a SPELLING rather than the
+// property the rule is about. When `armv7a-none-eabi` was added, the rule
+// applied to it and this test did not, silently: the loop simply skipped the
+// new rows and every assertion still passed. The property is "32-bit ARM with
+// a float-ABI suffix", and both spellings have it.
+bool is_arm32(std::string_view triple) {
+    return triple.starts_with("thumb") || triple.starts_with("armv");
+}
 bool has_flag(const mcpp::freestanding::Spec& s, std::string_view f) {
     for (auto e : s.extra) if (e == f) return true;
     return false;
@@ -492,10 +500,10 @@ bool has_flag(const mcpp::freestanding::Spec& s, std::string_view f) {
 // floats cross a call boundary, not whether the compiler may use the FPU inside
 // one — and `thumbv7em` implies an FPU. Measured on llvm 22.1.8: without
 // `-mfpu=none` the soft row emits `vmul.f32`.
-TEST(FreestandingTarget, SoftFloatMProfileRowsDisableTheFpu) {
+TEST(FreestandingTarget, SoftFloatArm32RowsDisableTheFpu) {
     int soft = 0, hard = 0;
     for (const auto& spec : mcpp::freestanding::known()) {
-        if (!is_m_profile(spec.triple)) continue;
+        if (!is_arm32(spec.triple)) continue;
         if (spec.triple.ends_with("-eabihf")) {
             ++hard;
             EXPECT_FALSE(has_flag(spec, "-mfpu=none"))
@@ -512,15 +520,21 @@ TEST(FreestandingTarget, SoftFloatMProfileRowsDisableTheFpu) {
     // above. Both halves must be non-empty for the contrast to mean anything.
     EXPECT_GT(soft, 0);
     EXPECT_GT(hard, 0);
+    // And the A-profile rows are in the denominator, which is the half a
+    // spelling-based predicate lost without failing.
+    int a_profile = 0;
+    for (const auto& spec : mcpp::freestanding::known())
+        if (spec.triple.starts_with("armv")) ++a_profile;
+    EXPECT_GT(a_profile, 0);
 }
 
 // 32-bit ARM has no `-mcmodel`, and clang has a BareMetal toolchain for arm so
 // its driver reaches `ld.lld` without the x86_64 row's workaround. Both columns
 // being empty is what says so; a filled one would be a value nothing checks.
-TEST(FreestandingTarget, MProfileRowsNeedNoCodeModelAndNoDirectLldDriving) {
+TEST(FreestandingTarget, Arm32RowsNeedNoCodeModelAndNoDirectLldDriving) {
     int rows = 0;
     for (const auto& spec : mcpp::freestanding::known()) {
-        if (!is_m_profile(spec.triple)) continue;
+        if (!is_arm32(spec.triple)) continue;
         ++rows;
         EXPECT_TRUE(spec.mcmodel.empty()) << spec.triple << " has no -mcmodel axis";
         EXPECT_TRUE(spec.lldEmulation.empty())
diff --git a/tests/unit/test_manifest.cpp b/tests/unit/test_manifest.cpp
index 2a45bb0f..ad9e36f2 100644
--- a/tests/unit/test_manifest.cpp
+++ b/tests/unit/test_manifest.cpp
@@ -4743,3 +4743,113 @@ llvm = { macosx = "20", default = "22" }
                                 "llvm@22"),
               with_macos->xlings.workspaceByPlatform.at("linux").end());
 }
+
+// ─── Tool tiers: `when` on an entry, and `[feature-xlings.<f>]` ────────────
+//
+// ⭐ THE TWO SPELLINGS OF A TABLE MUST NOT BE CONFUSABLE. `[xlings.workspace]`
+// already accepted an object keyed by platform; the tier form is an object
+// keyed by `version` and `when`. Neither key set contains a member of the
+// other, so the presence of `version`/`when` decides — and this test is what
+// says so, because nothing in the parser's shape forces it.
+TEST(Manifest, XlingsWorkspaceEntryTiers) {
+    auto m = mcpp::manifest::parse_string(R"(
+[package]
+name = "app"
+version = "0.1.0"
+[xlings.workspace]
+plain  = "1.0"
+built  = { version = "2.0", when = "build" }
+ran    = { version = "3.0", when = "run" }
+devd   = { version = "4.0", when = "dev" }
+anyver = { version = "",    when = "run" }
+)");
+    ASSERT_TRUE(m.has_value()) << m.error().format();
+    using W = mcpp::manifest::ToolWhen;
+    // An entry with no `when` is on the tier every verb installs. That is the
+    // pre-2026.9.4.2 behaviour, and it is the reason no manifest has to change.
+    EXPECT_EQ(m->xlings.when_of("plain@1.0"),  W::Always);
+    EXPECT_EQ(m->xlings.when_of("built@2.0"),  W::Build);
+    EXPECT_EQ(m->xlings.when_of("ran@3.0"),    W::Run);
+    EXPECT_EQ(m->xlings.when_of("devd@4.0"),   W::Dev);
+    // A tier does not change the address, only when it is asked for. An entry
+    // that names no version asks for presence, exactly as the plain spelling
+    // does — the address carries no `@`.
+    EXPECT_EQ(m->xlings.when_of("anyver"),     W::Run);
+    EXPECT_EQ(m->xlings.workspace.at("plain"), "1.0");
+    EXPECT_EQ(m->xlings.workspace.at("ran"),   "3.0");
+    EXPECT_TRUE(m->xlings.workspace.at("anyver").empty());
+}
+
+TEST(Manifest, XlingsWorkspacePlatformTableStillParses) {
+    // The regression this pair guards: adding the tier form must not make a
+    // platform table read as a malformed tier table.
+    auto m = mcpp::manifest::parse_string(R"(
+[package]
+name = "app"
+version = "0.1.0"
+[xlings.workspace]
+llvm = { macos = "20", default = "22" }
+)");
+    ASSERT_TRUE(m.has_value()) << m.error().format();
+    EXPECT_EQ(m->xlings.when_of(m->xlings.deps.at(0)), mcpp::manifest::ToolWhen::Always);
+}
+
+TEST(Manifest, XlingsWorkspaceBadTierIsAnError) {
+    auto m = mcpp::manifest::parse_string(R"(
+[package]
+name = "app"
+version = "0.1.0"
+[xlings.workspace]
+tool = { version = "1.0", when = "sometimes" }
+)");
+    ASSERT_FALSE(m.has_value());
+    EXPECT_NE(m.error().message.find("sometimes"), std::string::npos)
+        << m.error().message;
+    EXPECT_NE(m.error().message.find("'build', 'run' or 'dev'"), std::string::npos)
+        << m.error().message;
+}
+
+TEST(Manifest, XlingsWorkspaceScopedEntryNeedsVersion) {
+    // `{ when = "run" }` and a typo of `version` are indistinguishable, so the
+    // key is required and `""` is how "any version" is said.
+    auto m = mcpp::manifest::parse_string(R"(
+[package]
+name = "app"
+version = "0.1.0"
+[xlings.workspace]
+tool = { versoin = "1.0", when = "run" }
+)");
+    ASSERT_FALSE(m.has_value());
+    EXPECT_NE(m.error().message.find("versoin"), std::string::npos)
+        << m.error().message;
+}
+
+TEST(Manifest, FeatureXlingsIsGatedAndReported) {
+    auto m = mcpp::manifest::parse_string(R"(
+[package]
+name = "app"
+version = "0.1.0"
+[features]
+default  = ["emulator"]
+emulator = {}
+hardware = {}
+[feature-xlings.hardware]
+"xim:probe-rs" = "0.24.0"
+[feature-xlings.hardwear]
+"xim:typo" = "1.0"
+)");
+    ASSERT_TRUE(m.has_value()) << m.error().format();
+    ASSERT_EQ(m->xlings.featureDeps.count("hardware"), 1u);
+    EXPECT_EQ(m->xlings.featureDeps.at("hardware").at(0), "xim:probe-rs@0.24.0");
+    // A feature-gated tool is NOT in the unconditional list; a consumer that
+    // never activates the feature never asks for it.
+    EXPECT_EQ(std::ranges::find(m->xlings.deps, "xim:probe-rs@0.24.0"),
+              m->xlings.deps.end());
+    // ⚠️ A misspelt feature installs nothing and says nothing, which is the
+    // shape #531 was filed for. Reported as a schema warning rather than an
+    // error, so a package may adopt a feature before its consumers upgrade.
+    bool sawTypo = false;
+    for (auto const& w : m->schemaWarnings)
+        if (w.find("hardwear") != std::string::npos) sawTypo = true;
+    EXPECT_TRUE(sawTypo) << "no warning for [feature-xlings.hardwear]";
+}
diff --git a/tests/unit/test_runner_lookup.cpp b/tests/unit/test_runner_lookup.cpp
index 279ff3de..2445ac11 100644
--- a/tests/unit/test_runner_lookup.cpp
+++ b/tests/unit/test_runner_lookup.cpp
@@ -72,7 +72,7 @@ TEST(RunnerLookup, NotFoundListsEveryDirectorySearched) {
     EXPECT_NE(msg.find("aarch64-linux-musl"), std::string::npos) << msg;
     EXPECT_NE(msg.find((root / "a" / "bin").string()), std::string::npos) << msg;
     EXPECT_NE(msg.find((root / "p2").string()), std::string::npos) << msg;
-    EXPECT_NE(msg.find("[xlings] deps"), std::string::npos) << msg;
+    EXPECT_NE(msg.find("[xlings.workspace]"), std::string::npos) << msg;
     EXPECT_NE(msg.find("--no-runner"), std::string::npos) << msg;
 }