@@ -878,21 +878,24 @@ void apply(mcpp::manifest::Manifest& m, const Directives& d) {
 
     // A named executable's subsystem and entry. `target_directive_error` has
     // refused every value that names no executable, so the conditions below
-    // only keep this function total.
+    // only keep this function total. #622 A3: `is_program()`, not `Binary`
+    // alone — `windows_subsystem`/`windows_entry` accept `app` exactly as
+    // they accept `bin` (PE has no Android row, so this never meets an
+    // `Application` whose form is a shared object in practice).
     for (auto const& entry : d.at(Slot::WindowsSubsystem)) {
         const auto sep = entry.rfind(':');
         if (sep == std::string::npos) continue;
         const auto name = entry.substr(0, sep);
         for (auto& t : m.targets)
-            if (t.name == name && t.kind == mcpp::manifest::Target::Binary)
+            if (t.name == name && t.is_program())
                 t.windowsSubsystem = entry.substr(sep + 1);
     }
     for (auto const& entry : d.at(Slot::WindowsEntry)) {
         const auto sep = entry.rfind(':');
         if (sep == std::string::npos) continue;
         const auto name = entry.substr(0, sep);
         for (auto& t : m.targets)
-            if (t.name == name && t.kind == mcpp::manifest::Target::Binary)
+            if (t.name == name && t.is_program())
                 t.windowsEntry = entry.substr(sep + 1);
     }
 
@@ -967,10 +970,12 @@ static std::string named_target_error(const mcpp::manifest::Manifest& m,
                 wire, entry, m.package.name, name,
                 names.empty() ? std::string("none") : names);
         }
-        if (target->kind != mcpp::manifest::Target::Binary)
+        // #622 A3: `is_program()` — a program, not literally `Binary` — so an
+        // `app` accepts these exactly as a `bin` does.
+        if (!target->is_program())
             return std::format(
                 "build.mcpp emitted `mcpp:{}={}`, and `{}` applies to an executable "
-                "(`kind = \"bin\"`); target `{}` is not one.",
+                "(`kind = \"bin\"` or `\"app\"`); target `{}` is not one.",
                 wire, entry, key, name);
         const std::string& declared =
             subsystem ? target->windowsSubsystem : target->windowsEntry;
 
@@ -1106,14 +1106,28 @@ std::expected<Manifest, ManifestError> parse_string(std::string_view content,
         else if (kind_s == "bin"    || kind_s == "binary")   t.kind = Target::Binary;
         else if (kind_s == "shared" || kind_s == "dylib"
               || kind_s == "so"     || kind_s == "shlib")    t.kind = Target::SharedLibrary;
+        // #622 A3: "the thing a user launches", on every row. Its link form
+        // is a function of the row alone (`toolchain::triple::
+        // application_form`) -- identical to `bin` everywhere except
+        // `*-linux-android`, where it is the shared library the platform
+        // loads. An older engine refuses this name (`toml.cppm:1110` on
+        // 2026.9.12.2 lists three kinds), which is correct: a root that
+        // names a form the engine cannot produce must not build.
+        else if (kind_s == "app"    || kind_s == "application") t.kind = Target::Application;
         else return std::unexpected(error(origin,
-            std::format("targets.{}.kind must be 'bin', 'lib' or 'shared'; got '{}'", tname, kind_s)));
-
-        if (t.kind == Target::Binary) {
+            std::format("targets.{}.kind must be 'bin', 'app', 'lib' or 'shared'; got '{}'", tname, kind_s)));
+
+        // `main` is required for `bin` and for `app`: on every row but
+        // Android it is the executable's entry, exactly as it is for `bin`;
+        // on Android it is a translation unit compiled INTO the shared
+        // library (its actual entry is `ANativeActivity_onCreate` or the
+        // JNI exports, which is the platform's contract and not mcpp's to
+        // rename -- see `is_program()` and `application_form`).
+        if (t.is_program()) {
             auto mit = tt.find("main");
             if (mit == tt.end() || !mit->second.is_string()) {
                 return std::unexpected(error(origin,
-                    std::format("targets.{} (kind=bin) requires 'main' field", tname)));
+                    std::format("targets.{} (kind={}) requires 'main' field", tname, kind_s)));
             }
             t.main = mit->second.as_string();
         }
@@ -1219,12 +1233,16 @@ std::expected<Manifest, ManifestError> parse_string(std::string_view content,
             return std::unexpected(r.error());
         // An executable's property. A library has no subsystem, and a GUI
         // subsystem on anything a test runner executes is the defect #618
-        // describes, so both are refused naming the key.
+        // describes, so both are refused naming the key. `app` is accepted
+        // exactly as `bin` is (#622 A3: PE has no Android row, so this key
+        // never meets `application_form`'s SharedObject form in practice) --
+        // `is_program()` is "is this the program", which is what the PE
+        // subsystem attaches to; `TestBinary` stays refused on purpose.
         if ((!t.windowsSubsystem.empty() || !t.windowsEntry.empty())
-            && t.kind != Target::Binary)
+            && !t.is_program())
             return std::unexpected(error(origin, std::format(
-                "targets.{}.{} applies to an executable (`kind = \"bin\"`), and this "
-                "target is not one", tname,
+                "targets.{}.{} applies to an executable (`kind = \"bin\"` or "
+                "`\"app\"`), and this target is not one", tname,
                 t.windowsSubsystem.empty() ? "windows_entry" : "windows_subsystem")));
         // Guard: -std=... belongs to [package].standard, not per-target flags
         // (same rule as [build].cxxflags). Reject early with a clear message.
@@ -3404,6 +3422,12 @@ void apply_defaults_and_infer(Manifest& m, const std::filesystem::path& root) {
         const bool hasModuleInterface = !moduleInterfaceExt.empty();
 
         if (hasMain) {
+            // #622 A3: inference stays `Binary`, deliberately. `app` is a
+            // platform fact an author states on purpose (an Android build is
+            // never an accident), never a default this engine guesses from a
+            // bare `src/main.cpp` -- guessing wrong here would silently link
+            // a library where the author's `[targets]`-free project expected
+            // an executable.
             Target t;
             t.name = m.package.name;
             t.kind = Target::Binary;
 
@@ -133,8 +133,26 @@ inline std::string windows_choice_problem(bool subsystem, std::string_view value
 
 struct Target {
     std::string                 name;
-    enum Kind { Library, Binary, SharedLibrary, TestBinary } kind;
-    std::string                 main;           // for binary / test
+    // `Application` (#622 A3, `kind = "app"`) is "the thing a user launches",
+    // and its link form is a property of the ROW, not of this enum: on every
+    // row but Android it links exactly as `Binary` does; on `*-linux-android`
+    // it links as `SharedLibrary` does, because that is the only form an
+    // Android application has. See `toolchain::triple::application_form`,
+    // which is the one function that answers this — the manifest carries no
+    // predicate for it.
+    enum Kind { Library, Binary, SharedLibrary, TestBinary, Application } kind;
+    std::string                 main;           // for binary / test / app
+
+    // Whether this target is a PROGRAM -- something `mcpp run` can be asked
+    // for and `mcpp pack` treats as the application pipeline's subject --
+    // as opposed to a library. True for `Binary` and `Application`.
+    //
+    // Every call site that used to ask `kind == Binary` to mean "is this the
+    // program" now asks this instead; a site that means "is this literally an
+    // executable link" (a PE subsystem, a host build tool that must be exec'd
+    // directly) keeps comparing against `Binary` and, where an `app` can
+    // stand in for it, adds `Application` guarded by the row's actual form.
+    bool is_program() const { return kind == Binary || kind == Application; }
     std::string                 soname;         // ABI name for shared libraries, e.g. libfoo.so.1
     // WHICH SYMBOLS THIS ARTIFACT PUBLISHES. Empty = every symbol, which is
     // what both platforms do today (ELF default visibility; PE gets an
 
@@ -1566,6 +1566,10 @@ synthesize_from_xpkg_lua(std::string_view luaContent,
                         else if (k == "bin" || k == "binary")      t.kind = Target::Binary;
                         else if (k == "shared" || k == "dylib"
                               || k == "so" || k == "shlib")        t.kind = Target::SharedLibrary;
+                        // #622 A3: a descriptor's target can be `app` too --
+                        // read exactly like `mcpp.toml` (`toml.cppm`), so a
+                        // Form B package can publish an application.
+                        else if (k == "app" || k == "application") t.kind = Target::Application;
                     } else if (sub == "main") {
                         t.main = cur.read_string();
                     } else if (sub == "soname") {
 
@@ -1158,6 +1158,31 @@ inline ArtifactNaming artifact_naming(const Triple& t, const ArtifactNaming& hos
     return hostNaming;
 }
 
+// ── The link form of `kind = "app"` ──────────────────────────────────────────
+//
+// #622 A3. An application is "the thing a user launches" on every row, but
+// what that MEANS is not the same file shape everywhere: on Android there is
+// no executable form of an application at all -- the platform loads a shared
+// library into a Java process (`System.loadLibrary`, `android:name` in the
+// manifest) -- while on ELF, PE, Mach-O and the Emscripten row it is an
+// ordinary executable, exactly like `kind = "bin"`.
+//
+// This is a property of the ROW ALONE, the same reason `artifact_naming` sits
+// here rather than in the manifest: the manifest says what the author means
+// (`app`), and the engine answers how THIS row spells it. A manifest that
+// tried to say this itself would need a predicate over `[targets.<name>]`,
+// which is exactly the shape §2.3 of the #622 design record rejects.
+enum class ApplicationForm { Executable, SharedObject };
+
+inline ApplicationForm application_form(const Triple& t) {
+    // `env == "android"` is the same test `is_android()` uses (and the same
+    // one `artifact_naming` would use for an Android row, if it had one) --
+    // deliberately not `os == "linux"`, which would also catch a plain
+    // ELF/glibc or musl row that has an ordinary executable `main`.
+    return t.env == "android" ? ApplicationForm::SharedObject
+                              : ApplicationForm::Executable;
+}
+
 } // namespace mcpp::toolchain::triple
 
 namespace mcpp::toolchain::triple {
 
@@ -1715,6 +1715,33 @@ export int build_run_target(const std::optional<std::string>& targetName,
         if (targetName) break;
     }
     if (!chosen) {
+        // #622 A3/A10: an `app` whose form on THIS row is a shared library
+        // never becomes a `LinkUnit::Binary`, so the loop above cannot find
+        // it — that is correct (there is no executable to exec), but "no
+        // binary target 'myapp' found" would blame the user for a name that
+        // does exist. Read the manifest directly and, when that is exactly
+        // why the search came up empty, name the actual reason and the way
+        // out (`--format`, §2.10) instead.
+        for (auto const& t : ctx->manifest.targets) {
+            if (t.kind != mcpp::manifest::Target::Application) continue;
+            if (targetName && t.name != *targetName) continue;
+            auto triple = mcpp::toolchain::triple::parse(ctx->tc.targetTriple);
+            if (mcpp::toolchain::triple::application_form(
+                    triple ? *triple : mcpp::toolchain::triple::Triple{})
+                != mcpp::toolchain::triple::ApplicationForm::SharedObject)
+                continue;
+            std::string formats;
+            for (auto const& f : ctx->plan.providedPackFormats)
+                formats += (formats.empty() ? "" : ", ") + f;
+            std::println(stderr,
+                "error: '{}' is an application, and on {} an application is "
+                "a shared library that a package installs. Run it through a "
+                "distributable: mcpp run --format <name>, where <name> is "
+                "one of: {}",
+                t.name, ctx->tc.targetTriple,
+                formats.empty() ? std::string("none declared") : formats);
+            return 2;
+        }
         std::println(stderr, "error: no binary target {}",
             targetName ? std::format("'{}' found", *targetName) : "in this package");
         return 2;
 
@@ -482,13 +482,22 @@ mcpp::toolchain::triple::ArtifactNaming naming_for(const mcpp::toolchain::Toolch
 // Reading the host constants here made ninja declare an output the compiler
 // never writes (Linux -> PE: declared `bin/foo`, produced `bin/foo.exe`), so
 // the link edge could never be satisfied and reran on every build.
+//
+// `asSharedObject` (#622 A3) is set by the caller for an `Application` target
+// exactly when `toolchain::triple::application_form(triple)` answered
+// `SharedObject` — the file name derives from the link FORM, and this
+// function has no triple of its own to ask, by design (it is called on the
+// dependency-target axis too, where the naming has already been resolved).
+// It is inert for every other kind.
 std::filesystem::path target_output(const mcpp::manifest::Target& t,
-                                    const mcpp::toolchain::triple::ArtifactNaming& n) {
+                                    const mcpp::toolchain::triple::ArtifactNaming& n,
+                                    bool asSharedObject = false) {
     if (t.kind == mcpp::manifest::Target::Library) {
         return std::filesystem::path("bin") /
                std::format("{}{}{}", n.libPrefix, t.name, n.staticLibExt);
     }
-    if (t.kind == mcpp::manifest::Target::SharedLibrary) {
+    if (t.kind == mcpp::manifest::Target::SharedLibrary
+        || (t.kind == mcpp::manifest::Target::Application && asSharedObject)) {
         return std::filesystem::path("bin") /
                std::format("{}{}{}", n.libPrefix, t.name, n.sharedLibExt);
     }
@@ -1370,7 +1379,11 @@ make_plan(const mcpp::manifest::Manifest&         manifest,
     // disambiguate the common single-binary project).
     for (auto& t : manifest.targets) {
         if (t.main.empty()) continue;
-        if (t.kind != mcpp::manifest::Target::Binary
+        // `is_program()` (#622 A3): an `app` also has an entry `main` --
+        // compiled as an ordinary executable entry on every row but Android,
+        // and as a translation unit of the shared library there -- so it
+        // occupies an object address in this census exactly as `bin` does.
+        if (!t.is_program()
             && t.kind != mcpp::manifest::Target::TestBinary) continue;
         auto entry = projectRoot / t.main;
         if (scannedSources.contains(entry)) continue;
@@ -1792,7 +1805,26 @@ make_plan(const mcpp::manifest::Manifest&         manifest,
             lu.kind   = LinkUnit::TestBinary;
             lu.output = target_output(t, naming);
             if (!t.main.empty()) lu.entryMain = projectRoot / t.main;
+        } else if (t.kind == mcpp::manifest::Target::Application
+                   && mcpp::toolchain::triple::application_form(targetTriple)
+                      == mcpp::toolchain::triple::ApplicationForm::SharedObject) {
+            // #622 A3: on `*-linux-android` an `app` links as `shared` does --
+            // this row is the one case the form function answers
+            // `SharedObject` for. `main` still names the file compiled INTO
+            // the library (its actual entry is the platform's JNI/
+            // NativeActivity contract, not mcpp's), so it is synthesized the
+            // same way a `Binary`'s entry is, below.
+            lu.kind   = LinkUnit::SharedLibrary;
+            lu.output = target_output(t, naming, /*asSharedObject=*/true);
+            lu.importLibrary = import_library_for(t, naming);
+            lu.soname = t.soname;
+            lu.exportPatterns = t.exportPatterns;
+            lu.runtimeAliases = runtime_aliases_for_target(t, naming);
+            if (!t.main.empty()) lu.entryMain = projectRoot / t.main;
         } else {
+            // `Binary`, or an `Application` whose row form is `Executable`
+            // (every row this record verifies except Android) -- identical
+            // to `bin` in every respect, which is the point of the kind.
             lu.kind   = LinkUnit::Binary;
             lu.output = target_output(t, naming);
             if (!t.main.empty()) lu.entryMain = projectRoot / t.main;
@@ -1817,7 +1849,13 @@ make_plan(const mcpp::manifest::Manifest&         manifest,
         // false → inline (the pre-archive behavior, always provides the entry).
         bool entryDefinesMain = lu.entryMain && source_defines_main(*lu.entryMain);
 
-        if ((lu.kind == LinkUnit::Binary || lu.kind == LinkUnit::TestBinary) && lu.entryMain) {
+        // #622 A3: a `SharedLibrary` unit only ever carries `entryMain` when
+        // it is an `app` on the Android row (an ordinary `kind = "shared"`
+        // target never sets it) -- so this condition widens to synthesize
+        // that translation unit exactly as `Binary`'s is, without touching
+        // an ordinary shared library's compile set.
+        if ((lu.kind == LinkUnit::Binary || lu.kind == LinkUnit::TestBinary
+             || lu.kind == LinkUnit::SharedLibrary) && lu.entryMain) {
             // Synthesize the entry main's compile unit. Its object path is
             // NOT computed here — it comes from the shared `object_for`
             // disambiguator below, so the link input matches the compile edge