@@ -1141,6 +1141,11 @@ std::string filter_ninja_output(std::string_view output,
     return filtered;
 }
 
+// The aggregate target for everything staged out of the global cache. Named
+// with a leading underscore so it cannot collide with a module or target name
+// (both of which are identifiers or paths).
+constexpr std::string_view kStagedCacheGoal = "_mcpp_staged_cache";
+
 std::string emit_ninja_string(const BuildPlan& plan) {
     return emit_ninja_string(plan, nullptr);
 }
@@ -2205,7 +2210,7 @@ std::string emit_ninja_string(const BuildPlan& plan, std::string* placements) {
     // Aggregate target for everything staged out of the global cache. Named
     // with a leading underscore so it cannot collide with a module or target
     // name (both of which are identifiers or paths).
-    constexpr std::string_view kStagedCachePhony = "_mcpp_staged_cache";
+    constexpr std::string_view kStagedCachePhony = kStagedCacheGoal;
 
     auto bmi_path = [&traits](std::string_view name) {
         std::string s(traits.bmiDir);
@@ -4051,6 +4056,26 @@ std::expected<BuildResult, BuildError> NinjaBackend::build(const BuildPlan& plan
     for (auto& ev : plan.toolchain.envOverrides)
         nenv.emplace_back(ev.key, ev.value);
 
+    // THE STAGED CACHE IS PLACED BY A PASS OF ITS OWN, before the graph that
+    // reads it. ninja 1.12.1 loads a dyndep file whose producer is up to date
+    // as soon as that producer's order-only inputs are ready, from inside the
+    // completion of the node that readied them; when the dyndep file names that
+    // same node as an input, loading it grows the list the completion is
+    // iterating, a use-after-free (ninja-build/ninja#2662, unfixed upstream).
+    // The scans wait on `_mcpp_staged_cache` and the importers' dyndep files
+    // name the staged BMIs, so re-staging a dependency in a directory whose
+    // scans are current -- a dependency upgraded with its build served from the
+    // cache -- crashed ninja (e2e 196). After this pass the staged nodes are
+    // current, and the second pass loads those dyndep files when it starts.
+    if (manifest.find("\nbuild " + std::string(kStagedCacheGoal) + " : phony") != std::string::npos) {
+        std::vector<std::string> pre{ninjaProgram, "--quiet", "-C", plan.outputDir.string(),
+                                     std::string(kStagedCacheGoal)};
+        (void)mcpp::platform::process::capture_exec_deadline(pre, nenv,
+            std::chrono::milliseconds(static_cast<long long>(opts.buildTimeoutSecs) * 1000),
+            nullptr);
+        stage("ninja-staged-cache");
+    }
+
     bool buildTimedOut = false;
     auto cap = mcpp::platform::process::capture_exec_deadline(
         nargv, nenv,
 
@@ -2701,6 +2701,12 @@ make_plan(const mcpp::manifest::Manifest&         manifest,
         lu.dependencyOwned = true;
         lu.artifactOf      = owner;
         lu.output          = target_output(r.target, naming);
+        // In a workspace plan `bin/` holds products only: the workspace's own
+        // package's, and each member's directory. The program is linked with
+        // its package's intermediate files and placed beside each member
+        // program that ships it (step 6, §15 of the 2026-09-29 design).
+        if (manifest.package.virtualRoot)
+            lu.output = std::filesystem::path("obj") / sanitize(owner) / lu.output.filename();
         lu.windowsSubsystem = r.target.windowsSubsystem;
         lu.windowsEntry     = r.target.windowsEntry;
         lu.loaderTagFlag    = loader_tag_flag(lu.kind);
@@ -3005,10 +3011,46 @@ make_plan(const mcpp::manifest::Manifest&         manifest,
             }
             units.push_back(std::move(lu));
         }
+        // A program the closure ships through `artifacts` (mcpp#711) is linked
+        // once, at `bin/`, and placed beside the member's programs, where a
+        // program that launches it looks for it.
+        for (auto const& r : artifactRequests) {
+            const bool requested = std::ranges::any_of(artifactEdges, [&](auto const& e) {
+                return closureIdx.contains(e.first) && e.second == r.packageIndex;
+            });
+            if (!requested) continue;
+            std::filesystem::path out;
+            for (auto const& u : plan.linkUnits)
+                if (u.artifactOf == qualified_package_name(packages[r.packageIndex].manifest)
+                    && u.targetName == r.target.name) { out = u.output; break; }
+            if (out.empty()) continue;
+            const bool seen = std::ranges::any_of(group.placements,
+                [&](auto const& pl) { return pl.source == out; });
+            if (!seen && out.parent_path() != productDir)
+                group.placements.push_back({out, place(out)});
+        }
         plan.linkGroups.push_back(std::move(group));
         for (auto& u : units) plan.linkUnits.push_back(std::move(u));
     }
 
+    // A product directory is a directory: nothing this plan writes may take
+    // its path as a file (a program of the workspace's own package named as a
+    // member, say).
+    for (auto const& g : plan.linkGroups) {
+        if (g.productDir == std::filesystem::path("bin")) continue;
+        for (auto const& u : plan.linkUnits) {
+            bool clash = u.output == g.productDir;
+            for (auto const& a : u.runtimeAliases) clash = clash || a == g.productDir;
+            if (clash)
+                return std::unexpected(std::format(
+                    "target '{}' would be written to '{}', which is the product "
+                    "directory of workspace member '{}'.\n"
+                    "       Rename the target, or give the member a namespace so "
+                    "that its directory is qualified.",
+                    u.targetName, u.output.generic_string(), g.member));
+        }
+    }
+
     // The single derivation. Deliberately at the END of make_plan, after every
     // producer of a link unit has run: a dependency resolved to the shared
     // form arrives as an ordinary SharedLibrary unit, so this one predicate
 
@@ -500,20 +500,26 @@ export PackOutcome build_and_pack(Options opts, bool modeFromUser,
         // package that the contract says the host serves.
         namespace rp = mcpp::build::runtime_placement;
         const bool msvcAbi = mcpp::toolchain::is_msvc_target(ctx->plan.toolchain);
+        // Relative to the program's directory: `bin`, or a workspace member's
+        // product directory (§15 of the 2026-09-29 workspace design).
+        const auto& productDir = ctx->plan.productDir;
         for (auto const& d : flags.runtimeDeploy) {
-            if (msvcAbi && d.dest.parent_path() == "bin"
+            if (msvcAbi && d.dest.parent_path() == productDir
                 && rp::is_msvc_crt_name(d.dest.filename().string()))
                 continue;
-            opts.runtimeFiles.push_back(d.dest.lexically_relative("bin"));
+            opts.runtimeFiles.push_back(d.dest.lexically_relative(productDir));
         }
         if (msvcAbi && !opts.carryToolchainRuntime && flags.runtimeCrtPolicy != "static")
             for (auto n : rp::kMsvcCrtNames) opts.hostProvidedLibs.emplace_back(n);
         // A dependency's program the manifest ships with this one (mcpp#711,
         // `artifacts = [...]`) is linked into `bin/` beside the executable, so
         // it is staged the way a deployed file is.
+        // In a workspace member's product directory it is the placed copy.
         for (auto const& u : ctx->plan.linkUnits)
             if (!u.artifactOf.empty())
-                opts.runtimeFiles.push_back(u.output.lexically_relative("bin"));
+                opts.runtimeFiles.push_back(productDir == "bin"
+                    ? u.output.lexically_relative("bin")
+                    : std::filesystem::path(u.output.filename()));
         // #634 A3: the Android row reads its closure against the directories
         // its link declared -- a prebuilt library named through `[runtime]
         // link_library_dirs` is a file the link used and the device does not
 
@@ -16,7 +16,9 @@
 #   G6  two members with one package name in two namespaces get qualified
 #       product directories;
 #   G7  no member directory receives a build directory, and `clean --stale`
-#       removes the ones members held before, keeping `target/.build-mcpp/`.
+#       removes the ones members held before, keeping `target/.build-mcpp/`;
+#   G8  a program a member ships through `artifacts` is beside that member's
+#       program, in its product directory.
 set -e
 
 TMP=$(mktemp -d)
@@ -29,10 +31,10 @@ case "$(uname -s)" in MINGW*|MSYS*|CYGWIN*) EXE=".exe" ;; esac
 
 cat > mcpp.toml <<'EOF'
 [workspace]
-members = ["core", "cli", "gui", "ns1/tool", "ns2/tool", "modern"]
+members = ["core", "cli", "gui", "ns1/tool", "ns2/tool", "modern", "helper"]
 EOF
 
-mkdir -p core/src cli/src gui/src ns1/tool/src ns2/tool/src modern/src
+mkdir -p core/src cli/src gui/src ns1/tool/src ns2/tool/src modern/src helper/src
 cat > core/mcpp.toml <<'EOF'
 [package]
 name = "core"
@@ -59,6 +61,22 @@ EOF
 done
 printf '#include <cstdio>\nimport shared_core;\nint main() { std::printf("%%d\\n", core_v() + 1); return 0; }\n' > cli/src/main.cpp
 printf '#include <cstdio>\nimport shared_core;\nint main() { std::printf("%%d\\n", core_v() + 2); return 0; }\n' > gui/src/main.cpp
+cat >> gui/mcpp.toml <<'EOF'
+
+[dependencies.helper]
+path = "../helper"
+artifacts = ["helper"]
+EOF
+cat > helper/mcpp.toml <<'EOF'
+[package]
+name = "helper"
+version = "0.1.0"
+
+[targets.helper]
+kind = "bin"
+main = "src/main.cpp"
+EOF
+printf 'int main() { return 0; }\n' > helper/src/main.cpp
 
 for ns in ns1 ns2; do
     cat > $ns/tool/mcpp.toml <<EOF
@@ -108,6 +126,10 @@ other=$(echo "$dirs" | grep -v "^$main_dir$")
 [ -f "$main_dir/bin/ns1.tool/tool$EXE" ] || fail "G6: bin/ns1.tool/tool missing" ws.log
 [ -f "$main_dir/bin/ns2.tool/tool$EXE" ] || fail "G6: bin/ns2.tool/tool missing" ws.log
 
+# G8: the program gui ships is beside gui's program.
+[ -f "$main_dir/bin/gui/helper$EXE" ] || fail "G8: bin/gui/helper is missing" ws.log
+[ -f "$main_dir/bin/helper/helper$EXE" ] || fail "G8: bin/helper/helper is missing" ws.log
+
 # G1: the core module is compiled once, in the one graph.
 log="$main_dir/.ninja_log"
 n=$(grep -c 'core\.m\.o' "$log" || true)
@@ -136,7 +158,7 @@ fi
 [ -d "$main_dir" ] || fail "G3: the flag edit moved the build directory"
 
 # G7: no member directory holds a build directory; the old ones are stale.
-for m in core cli gui ns1/tool ns2/tool modern; do
+for m in core cli gui ns1/tool ns2/tool modern helper; do
     [ ! -d "$m/target/$(basename "$(dirname "$main_dir")")" ] \
         || fail "G7: $m received a build directory"
 done