diff --git a/BUILD.md b/BUILD.md
index 1421e80..12f4d92 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -75,7 +75,19 @@ signature or trust service.
 
 Use fresh output paths; producers refuse overwriting. The official Alpine OCI digest is pinned in `system/Containerfile`; APK repositories retain signature checking. The base records package versions in `/etc/alpine-packages.lock`. Its archive hash and all selected hardware hashes are recorded separately from the install contract. The APK mirror is not an immutable snapshot: future base rebuilds may select newer signed package revisions and must get new receipts.
 
-The producer composes Alpine-owned policy into one public gzip root for every platform (no kernel or modules: orchard's platform layer brings those at install, and orchard writes the boot entry), seals a recovery per platform to the root's receipt, adds orchard's layer per platform, and emits `release.toml` plus the index that pins it. Public build receipts omit local machine paths. No private firmware, SSH keys, ADT or machine IDs are embedded.
+The producer composes Alpine-owned policy into one public root archive, converts it with `orchard.image.root_image`, and takes platform layers, loaders and install tools from `orchard.image.platforms_index`. It emits `release.toml` plus the index that pins it. Public build receipts omit local machine paths. No private firmware, SSH keys, ADT or machine IDs are embedded.
+
+Builds using `--orchard-inputs` validate every selected platform against the
+ARM64 release root before root assembly. The standalone signed ARMv7 recovery
+base remains available through `armv7/build-base.py`.
+
+LwVM records require a static mapper for the selected ISA and a coherent rescue
+tool pair. This build passes the validated input document to
+`orchard.image.platforms_index --inputs`; Orchard's installed-root companion
+consumes the selected mapper and rescue paths when creating the layer. A local
+integration fixture checks the selected ARM64 board, loader and tool bytes
+through the real index and validates the resulting manifest. Physical P105
+qualification remains part of the ARMv7 device work.
 
 ## Native isolated checks
 
diff --git a/armv7/Containerfile b/armv7/Containerfile
index 41c94b1..4efb80c 100644
--- a/armv7/Containerfile
+++ b/armv7/Containerfile
@@ -5,7 +5,21 @@ COPY --from=armkeys /etc/apk/keys /armroot/etc/apk/keys
 COPY --from=armkeys /etc/apk/keys /etc/apk/keys
 RUN apk --root /armroot --arch armv7 --initdb --no-scripts \
     --keys-dir /etc/apk/keys --repositories-file /etc/apk/repositories \
-    add busybox musl python3 dropbear nfs-utils \
+    add busybox musl python3 dropbear nfs-utils util-linux e2fsprogs \
     && mkdir -p /armroot/bin \
     && cp /etc/apk/repositories /armroot/etc/apk/repositories \
-    && cp -a /etc/apk/keys /armroot/etc/apk/keys
+    && cp -a /etc/apk/keys /armroot/etc/apk/keys \
+    && for directory in bin sbin lib; do \
+        mkdir -p "/armroot/usr/$directory"; \
+        cp -a "/armroot/$directory/." "/armroot/usr/$directory/"; \
+        rm -rf "/armroot/$directory"; \
+        ln -s "usr/$directory" "/armroot/$directory"; \
+       done \
+    && test -f /armroot/usr/bin/python3 \
+    && test -f /armroot/usr/sbin/blkid \
+    && test -f /armroot/usr/sbin/sfdisk \
+    && test -f /armroot/usr/sbin/mke2fs \
+    && test -f /armroot/etc/mke2fs.conf \
+    && test "$(readlink /armroot/lib)" = usr/lib \
+    && test "$(readlink /armroot/bin)" = usr/bin \
+    && test "$(readlink /armroot/sbin)" = usr/sbin
diff --git a/armv7/README.md b/armv7/README.md
index fe7ad95..d4a9cc2 100644
--- a/armv7/README.md
+++ b/armv7/README.md
@@ -5,7 +5,7 @@ Wi-Fi) use an ARMv7 recovery environment. Build its Alpine package base in an
 ARM64 Podman environment:
 
 ```sh
-python3 armv7/build-base.py --output /absolute/new/alpine-base.tar
+python3 armv7/build-base.py --output /absolute/new/alpine-base.tar.gz
 ```
 
 Pass `--no-cache` to refresh the package layer. Each build uses its returned
@@ -13,7 +13,11 @@ image ID, leaving existing Podman image tags untouched.
 
 The recipe uses pinned container images and the official ARMv7 Alpine signing
 keys. It extracts signed ARMv7 packages without running their scripts. A JSON
-receipt beside the archive records the target architecture, image identity,
-recipe hash and archive hash. The base does not contain owner firmware or
+receipt at `alpine-base.tar.gz.json` records Orchard's target architecture
+(`arm`), image identity, recipe hash and archive hash. The gzip tar uses the
+merged `/usr` layout expected by Orchard's recovery producer and includes
+native `blkid`, `sfdisk`, `mke2fs` and its configuration. Python's musl loader
+and libraries live under `/usr/lib` so the producer can stage their closure.
+The base does not contain owner firmware or
 calibration. A separate private recovery composer and the companion hardware
 and CLI contributions are required for a tethered boot.
diff --git a/armv7/build-base.py b/armv7/build-base.py
index 08bed6f..76f4fc7 100644
--- a/armv7/build-base.py
+++ b/armv7/build-base.py
@@ -1,10 +1,12 @@
 #!/usr/bin/env python3
 """Export signed Alpine ARMv7 packages for the 32-bit (apple-armv7) RAM recovery."""
 import argparse
+import gzip
 import hashlib
 import json
 from pathlib import Path
 import re
+import shutil
 import subprocess
 import tempfile
 
@@ -15,7 +17,7 @@ def main():
     parser.add_argument('--no-cache', action='store_true', help='refresh the package build without cached layers')
     args = parser.parse_args()
     output = args.output.absolute()
-    receipt = output.with_suffix('.json')
+    receipt = output.with_suffix(output.suffix + '.json')
     if output.exists() or output.is_symlink() or receipt.exists() or receipt.is_symlink():
         parser.error('Choose a fresh base output')
     output.parent.mkdir(parents=True, exist_ok=True)
@@ -32,11 +34,17 @@ def main():
         observed = subprocess.check_output(['podman', 'image', 'inspect', image, '--format', '{{.Id}}'], text=True).strip()
         if observed.removeprefix('sha256:') != image.removeprefix('sha256:'):
             parser.error('Podman image inspection differs from the build output')
-        with output.open('xb') as stream:
+        archive = Path(temporary)/'base.tar'
+        with archive.open('xb') as stream:
             subprocess.run(['podman', 'run', '--rm', '--network', 'none', image,
                             'tar', '-C', '/armroot', '-cf', '-', '.'], stdout=stream, check=True)
+        with archive.open('rb') as source, output.open('xb') as stream:
+            with gzip.GzipFile(fileobj=stream, filename='', mode='wb', mtime=0,
+                               compresslevel=1) as compressed:
+                shutil.copyfileobj(source, compressed)
         with receipt.open('x') as stream:
-            stream.write(json.dumps({'schema': 1, 'architecture': 'armv7',
+            stream.write(json.dumps({'schema': 1, 'architecture': 'arm',
+                'archive': 'tar+gzip', 'layout': 'merged-usr',
                 'signed_apk': True, 'image': image, 'bytes': output.stat().st_size,
                 'sha256': hashlib.sha256(output.read_bytes()).hexdigest(),
                 'recipe_sha256': hashlib.sha256(recipe.read_bytes()).hexdigest()}, indent=2)+'\n')
diff --git a/build.py b/build.py
index a17226a..11176b7 100644
--- a/build.py
+++ b/build.py
@@ -177,7 +177,9 @@ def manifests(output, version, root, offered, orchard):
     document += table('install_tools', offered['install_tools'])
     for name, layer in sorted(offered['platforms'].items()):
         document += f'\n[platforms.{name}]\nboards = {json.dumps(layer["boards"])}\n'
-        document += table(f'platforms.{name}.layer', {key: value for key, value in layer.items() if key != 'boards'})
+        document += table(f'platforms.{name}.layer', {key: layer[key] for key in
+            ('file', 'url', 'bytes', 'sha256', 'compression', 'expanded_bytes', 'members', 'kernel_release')
+            if key in layer})
     path = output / 'release.toml'
     path.write_text(document)
     (output / 'index.toml').write_text('schema = 2\nkind = "orchard.index"\ndistro = "minimal-linux"\n'
@@ -201,6 +203,12 @@ def main():
     components, inputs = verify_inputs(args.inputs)
     resolved = json.loads(args.orchard_inputs.read_text()) if args.orchard_inputs else None
     revision = resolved['orchard'] if resolved else None
+    if resolved is not None:
+        try:
+            from producer_inputs import components as producer_components
+            producer_components(resolved)
+        except ValueError as error:
+            parser.error(str(error))
     args.output.parent.mkdir(parents=True, exist_ok=True)
     with tempfile.TemporaryDirectory(prefix='.minimal-build-', dir=args.output.parent) as temp:
         output = Path(temp) / 'release'
diff --git a/producer_inputs.py b/producer_inputs.py
new file mode 100644
index 0000000..b4facad
--- /dev/null
+++ b/producer_inputs.py
@@ -0,0 +1,100 @@
+"""Validate Orchard producer records against the shared Alpine release root."""
+from pathlib import Path
+import struct
+
+TOOLS = ('busybox', 'dropbear', 'dropbearkey', 'wpa_supplicant', 'wpa_cli', 'iw')
+
+
+def lwvm_helper(row):
+    """Validate an optional mapper before starting the shared ARM64 root build."""
+    root_format = row.get('root_format', 'gpt')
+    if root_format not in ('gpt', 'lwvm'):
+        raise ValueError('Unsupported platform root format')
+    value = row.get('tools', {}).get('lwvm')
+    if root_format == 'gpt':
+        if value is not None:
+            raise ValueError('A GPT platform cannot supply an LwVM mapper')
+        return None
+    if not isinstance(value, str) or not value or not Path(value).is_absolute():
+        raise ValueError('An LwVM platform needs an absolute mapper path')
+    path = Path(value)
+    if path.is_symlink() or not path.is_file():
+        raise ValueError('The LwVM mapper must be a regular file')
+    data = path.read_bytes()
+    if len(data) < 64 or data[:7] != b'\x7fELF\x02\x01\x01' or struct.unpack_from('<H', data, 18)[0] != 183:
+        raise ValueError('The LwVM mapper must match the ARM64 release root')
+    if struct.unpack_from('<H', data, 16)[0] not in (2, 3):
+        raise ValueError('The LwVM mapper must be an ELF executable')
+    offset = struct.unpack_from('<Q', data, 32)[0]
+    size, count = struct.unpack_from('<HH', data, 54)
+    if not count or size < 56 or offset < 64 or offset + size * count > len(data):
+        raise ValueError('The LwVM mapper has invalid ELF program headers')
+    entry = struct.unpack_from('<Q', data, 24)[0]
+    loadable = False
+    executable_entry = False
+    for index in range(count):
+        kind, flags, start, virtual, _, length, memory, _ = struct.unpack_from('<II6Q', data, offset + index * size)
+        if start + length > len(data):
+            raise ValueError('The LwVM mapper has a truncated ELF segment')
+        if kind == 1:
+            if memory < length:
+                raise ValueError('The LwVM mapper has an invalid loadable ELF segment')
+            loadable |= length > 0
+            executable_entry |= bool(flags & 1 and virtual <= entry < virtual + length)
+        if kind == 3:
+            raise ValueError('The LwVM mapper must be static')
+        if kind == 2:
+            if length % 16:
+                raise ValueError('The LwVM mapper has an invalid dynamic table')
+            for position in range(start, start + length, 16):
+                tag, _ = struct.unpack_from('<QQ', data, position)
+                if tag == 0:
+                    break
+                if tag == 1:
+                    raise ValueError('The LwVM mapper must be static')
+            else:
+                raise ValueError('The LwVM mapper has an unterminated dynamic table')
+    if not loadable:
+        raise ValueError('The LwVM mapper has no loadable ELF segment')
+    if not executable_entry:
+        raise ValueError('The LwVM mapper entry is outside executable file bytes')
+    return str(path)
+
+
+def validate_backend(row):
+    """Check a backend's mapper and rescue pair before handing inputs to Orchard."""
+    helper = lwvm_helper(row)
+    if helper is None:
+        return
+    tools = row['tools']
+    parents = {Path(tools[name]).parent for name in ('dropbear', 'dropbearkey')}
+    if len(parents) != 1:
+        raise ValueError('The LwVM rescue tools must share a directory')
+
+
+def components(document):
+    """Return one coherent m1n1/tool set for the existing ARM64 release."""
+    if document.get('architecture', 'arm64') != 'arm64':
+        raise ValueError('The release needs an ARM64 base; build ARMv7 recovery bases with armv7/build-base.py')
+    platforms = document.get('platforms', {})
+    if not platforms:
+        raise ValueError('Orchard inputs name no platforms')
+    shared = document.get('shared', {})
+    records = []
+    for name, row in platforms.items():
+        if row.get('architecture', 'arm64') != 'arm64' or row.get('image', 'Image.gz') != 'Image.gz':
+            raise ValueError('Platform ' + name + ' does not match the ARM64 release root')
+        loader = row.get('loader', {'kind': 'm1n1', 'file': shared.get('m1n1')})
+        if loader.get('kind') != 'm1n1' or not loader.get('file'):
+            raise ValueError('Platform ' + name + ' needs an m1n1 loader')
+        tools = row.get('tools', shared.get('tools', {}))
+        if any(not isinstance(tools.get(key), str) or not tools[key] for key in TOOLS):
+            raise ValueError('Platform ' + name + ' has incomplete static tools')
+        validate_backend(row)
+        records.append((str(Path(loader['file'])), {key: str(Path(tools[key])) for key in TOOLS}))
+    if any(record != records[0] for record in records[1:]):
+        raise ValueError('Platforms in one release need the same loader and static tools')
+    if not isinstance(shared.get('pongo'), str) or not shared['pongo']:
+        raise ValueError('The ARM64 release needs its Pongo input')
+    loader, tools = records[0]
+    return {'m1n1': loader, 'pongo': shared['pongo'], 'tools': tools}
diff --git a/tests/test_armv7_base.py b/tests/test_armv7_base.py
index f380765..8aac348 100644
--- a/tests/test_armv7_base.py
+++ b/tests/test_armv7_base.py
@@ -1,5 +1,6 @@
 """Host-only checks for the signed ARMv7 recovery base exporter."""
 import hashlib
+import gzip
 import importlib.util
 import json
 from pathlib import Path
@@ -17,7 +18,7 @@
 class Armv7Base(unittest.TestCase):
     def test_export_receipt_binds_image_recipe_and_stream(self):
         with tempfile.TemporaryDirectory() as temporary:
-            output = Path(temporary) / 'base.tar'
+            output = Path(temporary) / 'base.tar.gz'
             image = 'sha256:' + 'a' * 64
             commands = []
             def run(command, **kwargs):
@@ -30,9 +31,13 @@ def run(command, **kwargs):
                  patch.object(base.subprocess, 'run', side_effect=run), \
                  patch.object(base.subprocess, 'check_output', return_value=image + '\n'):
                 base.main()
-            receipt = json.loads(output.with_suffix('.json').read_text())
+            receipt = json.loads(output.with_suffix('.gz.json').read_text())
             self.assertEqual(receipt['image'], image)
-            self.assertEqual(receipt['architecture'], 'armv7')
+            self.assertEqual(receipt['architecture'], 'arm')
+            self.assertEqual(receipt['archive'], 'tar+gzip')
+            self.assertEqual(receipt['layout'], 'merged-usr')
+            self.assertEqual(gzip.decompress(output.read_bytes()), b'fixture base')
+            self.assertEqual(output.read_bytes()[4:8], b'\0\0\0\0')
             self.assertTrue(receipt['signed_apk'])
             self.assertEqual(receipt['sha256'], hashlib.sha256(output.read_bytes()).hexdigest())
             self.assertEqual(receipt['recipe_sha256'], hashlib.sha256((PROJECT / 'armv7/Containerfile').read_bytes()).hexdigest())
@@ -63,7 +68,7 @@ def run(command, **kwargs):
             self.assertNotIn('-t', commands[0])
             self.assertNotIn('--tag', commands[0])
             self.assertEqual(inspect.call_args.args[0][3], image)
-            self.assertEqual(json.loads(output.with_suffix('.json').read_text())['image'], image)
+            self.assertEqual(json.loads(output.with_suffix('.tar.json').read_text())['image'], image)
 
     def test_mismatched_inspection_is_rejected_before_export(self):
         with tempfile.TemporaryDirectory() as temporary:
@@ -78,12 +83,12 @@ def build(command, **_kwargs):
                     base.main()
             self.assertEqual(run.call_count, 1)
             self.assertFalse(output.exists())
-            self.assertFalse(output.with_suffix('.json').exists())
+            self.assertFalse(output.with_suffix('.tar.json').exists())
 
     def test_existing_output_or_receipt_stops_before_build(self):
         with tempfile.TemporaryDirectory() as temporary:
             output = Path(temporary) / 'base.tar'
-            for present in (output, output.with_suffix('.json')):
+            for present in (output, output.with_suffix('.tar.json')):
                 with self.subTest(present=present):
                     present.write_bytes(b'existing')
                     with patch('sys.argv', ['build-base', '--output', str(output)]), \
@@ -93,7 +98,7 @@ def test_existing_output_or_receipt_stops_before_build(self):
                     run.assert_not_called()
                     self.assertEqual(present.read_bytes(), b'existing')
                     present.unlink()
-            receipt = output.with_suffix('.json')
+            receipt = output.with_suffix('.tar.json')
             receipt.symlink_to(Path(temporary) / 'missing')
             with patch('sys.argv', ['build-base', '--output', str(output)]), \
                  patch.object(base.subprocess, 'run') as run:
@@ -110,6 +115,11 @@ def test_recipe_pins_images_and_uses_verified_armv7_packages(self):
         self.assertIn('--arch armv7', recipe)
         self.assertIn('--no-scripts', recipe)
         self.assertIn('/etc/apk/keys', recipe)
+        self.assertIn('util-linux e2fsprogs', recipe)
+        self.assertIn('for directory in bin sbin lib', recipe)
+        for name in ('blkid', 'sfdisk', 'mke2fs'):
+            self.assertIn('test -f /armroot/usr/sbin/' + name, recipe)
+        self.assertIn('test -f /armroot/etc/mke2fs.conf', recipe)
 
 
 if __name__ == '__main__':
diff --git a/tests/test_producer_inputs.py b/tests/test_producer_inputs.py
new file mode 100644
index 0000000..f590b1f
--- /dev/null
+++ b/tests/test_producer_inputs.py
@@ -0,0 +1,158 @@
+"""The release consumes architecture-aware producer records as one root."""
+import unittest
+from pathlib import Path
+import struct
+import tempfile
+import producer_inputs
+
+
+def document():
+    tools = {name: '/cache/tools/' + name for name in producer_inputs.TOOLS}
+    return {'architecture': 'arm64', 'shared': {'pongo': '/cache/pongo'},
+            'platforms': {name: {'architecture': 'arm64', 'image': 'Image.gz',
+                'loader': {'kind': 'm1n1', 'file': '/cache/m1n1'}, 'tools': dict(tools)}
+                for name in ('apple-4k', 'apple-16k')}}
+
+
+class ProducerInputsTests(unittest.TestCase):
+    def test_current_records_resolve_shared_components(self):
+        result = producer_inputs.components(document())
+        self.assertEqual(result['m1n1'], '/cache/m1n1')
+        self.assertEqual(result['pongo'], '/cache/pongo')
+        self.assertEqual(result['tools']['busybox'], '/cache/tools/busybox')
+
+    def test_mixed_architectures_fail_before_root_assembly(self):
+        data = document()
+        data['platforms']['apple-4k']['architecture'] = 'arm'
+        with self.assertRaisesRegex(ValueError, 'ARM64 release root'):
+            producer_inputs.components(data)
+
+    def test_armv7_release_requires_its_own_root_path(self):
+        data = document()
+        data['architecture'] = 'arm'
+        with self.assertRaisesRegex(ValueError, 'armv7/build-base.py'):
+            producer_inputs.components(data)
+
+    def test_different_tools_fail_before_component_pinning(self):
+        data = document()
+        data['platforms']['apple-4k']['tools']['busybox'] = '/other/busybox'
+        with self.assertRaisesRegex(ValueError, 'same loader and static tools'):
+            producer_inputs.components(data)
+
+    def test_wrong_loader_and_incomplete_tools_are_rejected(self):
+        for field, value in [('loader', {'kind': 'cascadia', 'file': '/cache/cascadia'}), ('tools', {})]:
+            data = document()
+            data['platforms']['apple-4k'][field] = value
+            with self.assertRaises(ValueError):
+                producer_inputs.components(data)
+
+    def test_older_snapshot_components_still_resolve(self):
+        data = document()
+        row = data['platforms']['apple-4k']
+        data['shared'].update(m1n1=row['loader']['file'], tools=row['tools'])
+        data.pop('architecture')
+        for row in data['platforms'].values():
+            for key in ('architecture', 'image', 'loader', 'tools'):
+                row.pop(key)
+        self.assertEqual(producer_inputs.components(data)['m1n1'], '/cache/m1n1')
+
+    def helper(self, temporary, *, kind=1, machine=183):
+        path = Path(temporary) / 'orchard-lwvm'
+        data = bytearray(136)
+        data[:7] = b'\x7fELF\x02\x01\x01'
+        struct.pack_into('<HHI', data, 16, 2, machine, 1)
+        struct.pack_into('<Q', data, 32, 64)
+        struct.pack_into('<HHH', data, 52, 64, 56, 1)
+        struct.pack_into('<II6Q', data, 64, kind, 5, 120, 0, 0, 16, 16, 8)
+        path.write_bytes(data)
+        return path
+
+    def test_lwvm_platform_validates_its_mapper_and_rescue_pair(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            path = self.helper(temporary)
+            data = document()
+            row = data['platforms']['apple-4k']
+            row['root_format'] = 'lwvm'
+            row['tools']['lwvm'] = str(path)
+            producer_inputs.components(data)
+            self.assertEqual(producer_inputs.lwvm_helper(row), str(path))
+            self.assertIsNone(producer_inputs.validate_backend(row))
+            self.assertIsNone(producer_inputs.validate_backend(data['platforms']['apple-16k']))
+
+    def test_lwvm_missing_mapper_fails_before_build(self):
+        row = document()['platforms']['apple-4k']
+        row['root_format'] = 'lwvm'
+        with self.assertRaisesRegex(ValueError, 'absolute mapper'):
+            producer_inputs.validate_backend(row)
+
+    def test_lwvm_rejects_foreign_or_dynamic_helpers(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            row = document()['platforms']['apple-4k']
+            row['root_format'] = 'lwvm'
+            for kind, machine in ((1, 40), (3, 183), (2, 183)):
+                path = self.helper(temporary, kind=kind, machine=machine)
+                if kind == 2:
+                    data = bytearray(path.read_bytes())
+                    struct.pack_into('<QQ', data, 120, 1, 0)
+                    path.write_bytes(data)
+                row['tools']['lwvm'] = str(path)
+                with self.subTest(kind=kind, machine=machine), self.assertRaises(ValueError):
+                    producer_inputs.validate_backend(row)
+
+    def test_lwvm_rejects_a_header_without_loadable_code(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            row = document()['platforms']['apple-4k']
+            row['root_format'] = 'lwvm'
+            row['tools']['lwvm'] = str(self.helper(temporary, kind=0))
+            with self.assertRaisesRegex(ValueError, 'no loadable ELF segment'):
+                producer_inputs.validate_backend(row)
+
+    def test_lwvm_entry_must_reach_executable_file_bytes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            row = document()['platforms']['apple-4k']
+            row['root_format'] = 'lwvm'
+            for flags, length, memory, entry in ((4, 16, 16, 0), (5, 0, 16, 0),
+                                                  (5, 16, 16, 16), (5, 16, 8, 0)):
+                path = self.helper(temporary)
+                raw = bytearray(path.read_bytes())
+                struct.pack_into('<Q', raw, 24, entry)
+                struct.pack_into('<II6Q', raw, 64, 1, flags, 120, 0, 0, length, memory, 8)
+                path.write_bytes(raw)
+                row['tools']['lwvm'] = str(path)
+                with self.subTest(flags=flags, length=length, memory=memory, entry=entry), \
+                        self.assertRaises(ValueError):
+                    producer_inputs.validate_backend(row)
+
+    def test_lwvm_dynamic_table_must_end_with_null(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            path = Path(temporary) / 'orchard-lwvm'
+            row = document()['platforms']['apple-4k']
+            row['root_format'] = 'lwvm'
+            row['tools']['lwvm'] = str(path)
+            raw = bytearray(208)
+            raw[:7] = b'\x7fELF\x02\x01\x01'
+            struct.pack_into('<HHI', raw, 16, 2, 183, 1)
+            struct.pack_into('<Q', raw, 32, 64)
+            struct.pack_into('<HHH', raw, 52, 64, 56, 2)
+            struct.pack_into('<II6Q', raw, 64, 1, 5, 176, 0, 0, 16, 16, 8)
+            struct.pack_into('<II6Q', raw, 120, 2, 4, 192, 16, 0, 16, 16, 8)
+            struct.pack_into('<QQ', raw, 192, 7, 0)
+            path.write_bytes(raw)
+            with self.assertRaisesRegex(ValueError, 'unterminated dynamic table'):
+                producer_inputs.validate_backend(row)
+            struct.pack_into('<QQ', raw, 192, 0, 0)
+            path.write_bytes(raw)
+            self.assertIsNone(producer_inputs.validate_backend(row))
+
+    def test_lwvm_rejects_truncation_and_split_rescue_tools(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            row = document()['platforms']['apple-4k']
+            row['root_format'] = 'lwvm'
+            path = self.helper(temporary)
+            row['tools']['lwvm'] = str(path)
+            row['tools']['dropbearkey'] = '/other/dropbearkey'
+            with self.assertRaisesRegex(ValueError, 'share a directory'):
+                producer_inputs.validate_backend(row)
+            path.write_bytes(path.read_bytes()[:100])
+            with self.assertRaisesRegex(ValueError, 'program headers'):
+                producer_inputs.validate_backend(row)
diff --git a/tests/test_publication.py b/tests/test_publication.py
index f3b9d1d..1b955b2 100644
--- a/tests/test_publication.py
+++ b/tests/test_publication.py
@@ -21,7 +21,7 @@ def release(source):
                  'platform-apple-16k.tar.gz', 'platform-apple-4k.tar.gz'):
         (source / name).write_bytes(name.encode())
     platforms = {name: {**build.receipt(source / f'platform-{name}.tar.gz'), 'compression': 'gzip', 'expanded_bytes': 10,
-                        'members': 2, 'kernel_release': '7.3-' + name, 'boards': boards}
+                        'members': 2, 'kernel_release': '7.3-' + name, 'boards': boards, 'architecture': 'arm64'}
                  for name, boards in (('apple-16k', ['j71b']), ('apple-4k', ['n61']))}
     root = {**build.receipt(source / 'root.blocks.zst'), 'compression': 'zstd', 'format': 'blocks', 'expanded_bytes': 100,
             'members': 3, 'map': build.receipt(source / 'root.map.json')}
@@ -40,6 +40,8 @@ def test_one_manifest_for_every_platform_with_the_account(self):
                 'default_root': '/minimal', 'ready': '/run/orchard-ready',
                 'account': {'user': 'tablet', 'password': True, 'pin': False, 'passwordless_sudo': False}})
             self.assertEqual(sorted(manifest['platforms']), ['apple-16k', 'apple-4k'])
+            for row in manifest['platforms'].values():
+                self.assertNotIn('architecture', row['layer'])
 
     def test_minimal_manifest_is_rewritten_and_rehashed(self):
         with tempfile.TemporaryDirectory() as directory:
diff --git a/tests/test_release_inputs.py b/tests/test_release_inputs.py
new file mode 100644
index 0000000..fb2eb5e
--- /dev/null
+++ b/tests/test_release_inputs.py
@@ -0,0 +1,118 @@
+"""Validate selected inputs before root assembly, then hand them to Orchard's index producer."""
+import importlib.util
+import json
+from pathlib import Path
+import struct
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import producer_inputs
+
+PROJECT = Path(__file__).resolve().parents[1]
+spec = importlib.util.spec_from_file_location('minimal_release_inputs', PROJECT / 'build.py')
+build = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(build)
+
+
+def document():
+    tools = {name: '/cache/tools/' + name for name in producer_inputs.TOOLS}
+    return {
+        'architecture': 'arm64',
+        'orchard': {'commit': 'c' * 40, 'modified': False},
+        'shared': {'pongo': '/cache/pongo', 'm1n1': '/cache/m1n1', 'tools': dict(tools)},
+        'platforms': {
+            'apple-4k': {
+                'architecture': 'arm64',
+                'image': 'Image.gz',
+                'loader': {'kind': 'm1n1', 'file': '/cache/m1n1'},
+                'tools': dict(tools),
+            },
+        },
+    }
+
+
+class ReleaseInputs(unittest.TestCase):
+    def invoke(self, root, selected, command):
+        inputs = root / 'orchard-inputs.json'
+        inputs.write_text(json.dumps(selected))
+        logo = root / 'logo.bin'
+        logo.write_bytes(b'logo')
+        base_receipt = root / 'base.json'
+        base_receipt.write_text('{}')
+        argv = ['build.py', '--base', str(root / 'base.tar.gz'),
+                '--base-receipt', str(base_receipt), '--inputs', str(root / 'public.json'),
+                '--orchard-inputs', str(inputs), '--version', 'test', '--output', str(root / 'release')]
+        with patch.object(sys, 'argv', argv), \
+                patch.object(build, 'orchard_root', return_value=Path('/snapshot')), \
+                patch.object(build, 'verify_inputs', return_value=({'logo': logo}, {'files': {}})), \
+                patch.object(build, 'root_archive') as assemble_root, \
+                patch.object(build, 'orchard_command', side_effect=command), \
+                patch.object(build, 'manifests'):
+            try:
+                build.main()
+            finally:
+                self.assemble_root = assemble_root
+        return inputs
+
+    def test_mixed_architecture_stops_before_root_or_producer(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            selected = document()
+            selected['platforms']['apple-4k']['architecture'] = 'arm'
+            with patch.object(build, 'orchard_command') as unused:
+                with self.assertRaises(SystemExit) as error:
+                    self.invoke(root, selected, unused)
+            self.assertEqual(error.exception.code, 2)
+            self.assemble_root.assert_not_called()
+            unused.assert_not_called()
+            self.assertFalse((root / 'release').exists())
+
+    def test_foreign_lwvm_mapper_stops_before_root_or_producer(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            mapper = root / 'orchard-lwvm'
+            raw = bytearray(136)
+            raw[:7] = b'\x7fELF\x02\x01\x01'
+            struct.pack_into('<HHI', raw, 16, 2, 40, 1)
+            mapper.write_bytes(raw)
+            selected = document()
+            selected['platforms']['apple-4k'].update(root_format='lwvm')
+            selected['platforms']['apple-4k']['tools']['lwvm'] = str(mapper)
+            with patch.object(build, 'orchard_command') as unused:
+                with self.assertRaises(SystemExit) as error:
+                    self.invoke(root, selected, unused)
+            self.assertEqual(error.exception.code, 2)
+            self.assemble_root.assert_not_called()
+            unused.assert_not_called()
+            self.assertFalse((root / 'release').exists())
+
+    def test_selected_inputs_reach_index_and_root_image_producers(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            calls = []
+            selected = document()
+
+            def produce(snapshot, module, *argv, **kwargs):
+                calls.append((snapshot, module, argv))
+                if module == 'image.platforms_index':
+                    self.assertEqual(snapshot, Path('/snapshot'))
+                    self.assertEqual(argv[1:], ('--inputs', root / 'orchard-inputs.json'))
+                    self.assertEqual(json.loads(argv[2].read_text()), selected)
+                    (argv[0] / 'platforms.toml').write_text('commit = "' + 'c' * 40 + '"\n[platforms]\n')
+                elif module == 'image.root_image':
+                    self.assertEqual(argv[0].name, 'rootfs.tar.gz')
+                    self.assertEqual(argv[1], '--output')
+                    (argv[2] / 'root-image.json').write_text('{}')
+                else:
+                    self.fail('Unexpected producer: ' + module)
+
+            self.invoke(root, selected, produce)
+            self.assemble_root.assert_called_once()
+            self.assertEqual([row[1] for row in calls], ['image.platforms_index', 'image.root_image'])
+            self.assertTrue((root / 'release/build-receipt.json').is_file())
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tools/build.py b/tools/build.py
index da0ff3d..e8c9a3c 100755
--- a/tools/build.py
+++ b/tools/build.py
@@ -18,6 +18,7 @@
 
 PROJECT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(PROJECT))
+import producer_inputs  # noqa: E402
 import snapshot  # noqa: E402  orchard's snapshot and commands; none of its Python
 # What each component is made from, relative to this checkout.
 INPUTS = {
@@ -45,11 +46,6 @@ def main():
     # The release builder builds every platform when it is given none.
     selected = [part for name in args.platform if name != 'all' for part in ('--platform', name)]
 
-    base = snapshot.component('base', INPUTS['base'],
-                              lambda path, work: python('build_base.py', '--output', path), artifact='base.tar.gz')
-    artwork = snapshot.component('artwork', INPUTS['artwork'],
-                                 lambda path, work: python('boot/build-artwork.py', '--output', path),
-                                 artifact='artwork')
     (PROJECT / 'out').mkdir(exist_ok=True)
     # What orchard supplies finished: kernels, boards, m1n1, Pongo, tools (orchard.inputs). Kept beside the
     # release, not in it (its paths are this host's): under "produced" it says how orchard got each one.
@@ -57,7 +53,13 @@ def main():
     resolved.parent.mkdir(parents=True, exist_ok=True)
     with tempfile.TemporaryDirectory(prefix='.inputs-', dir=PROJECT / 'out') as temporary:
         snapshot.command(orchard, 'inputs', '--output', resolved, *selected)
-        shared = json.loads(resolved.read_text())['shared']
+        shared = producer_inputs.components(json.loads(resolved.read_text()))
+        base = snapshot.component('base', INPUTS['base'],
+                                  lambda path, work: python('build_base.py', '--output', path), artifact='base.tar.gz')
+        artwork = snapshot.component('artwork', INPUTS['artwork'],
+                                     lambda path, work: python('boot/build-artwork.py', '--output', path),
+                                     artifact='artwork')
+
         tools = {name: Path(path) for name, path in shared['tools'].items()}
         inputs = Path(temporary) / 'public'
         python('pin_components.py', '--loader', shared['m1n1'], '--splash', artwork / 'splash',