Add tenth capability word (STOCK_V10), protocol 0.6.0, ctx API 1.19.0, and

strict seed coverage for bits10. Extend seed RPC, replication adjuncts,
Wave 10 /proc JSON + proc index schema 6, boot.policy v10 enforcement in
kernel/init.js, sysproc:* workers, NDJSON/OTel/audit schema bumps, CI
(verify-kernel-roadmap-wave10.mjs) and doc updates across handbook,
developer-guide, compatibility matrix, and seeder kernel parity.

developer-guide/13-privacy-telemetry-pii.md

@@ -1,4 +1,4 @@
-# Privacy, telemetry, and PII (Wave 9)
+# Privacy, telemetry, and PII (Wave 10)
 
 Bare OS telemetry is **operator-controlled** and **bounded**. Guests must treat every field as potentially visible to hosts, log sinks, and replicated drives.
 
@@ -12,6 +12,7 @@ When building custom NDJSON / OTel mirrors or Pear-side aggregators, treat these
 - **Paths:** home directory absolute paths on the host when they include real usernames (prefer basenames already used in `$HOME` mapping).
 - **Wave 8 fields:** `sessionForkGeneration`, `vaultRotateCount`, multisig / trust-graph ids surfaced as pointers, OIDC publishing URLs, subprocess **`uidGidMapHint`**, RocksDB / sidecar manifest pointers — treat as operator metadata; scrub before cross-tenant export.
 - **Wave 9 fields:** `wave9ProbeId`, `bareModuleProbeClass`, Pear stage / appling / updater / radio / wakeups sketches from **`BARE_OS_*_JSON`** env mirrors, SOCKS / HTTP proxy map keys (host-only interpretation) — treat as deployment fingerprinting; scrub or bucket before multi-tenant export.
+- **Wave 10 fields:** `wave10ProbeId`, `bareRpcProbeClass`, Pear doctor / workshop / RTI / user-dirs sketches, Bare logger tap payloads, mTLS proxy map keys, thread-pool telemetry JSON — treat as operator metadata; scrub before cross-tenant export.
 
 Stock emitters avoid logging env wholesale; `/proc/self/environ` omits secret-like keys. Prefer **hashed** or **bucketed** counters (e.g. pairing backoff counts) over raw payloads.
 
@@ -21,9 +22,9 @@ Operators running Bare OS as part of a service should maintain a **subprocessor
 
 ## Schema versions
 
-- NDJSON lifecycle / telemetry: see **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (**8** in stock tree) and rows in [`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md).
+- NDJSON lifecycle / telemetry: see **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (**9** in stock tree) and rows in [`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md).
-- OTel-inspired lines: **`otlSchemaVersion: 4–6`**, example [`kernel/etc/bare-os/otel-jsonl.example.json`](../kernel/etc/bare-os/otel-jsonl.example.json), schema [`docs/schemas/otel-bare-os-jsonl.schema.json`](../docs/schemas/otel-bare-os-jsonl.schema.json).
+- OTel-inspired lines: **`otlSchemaVersion: 7`**, example [`kernel/etc/bare-os/otel-jsonl.example.json`](../kernel/etc/bare-os/otel-jsonl.example.json), schema [`docs/schemas/otel-bare-os-jsonl.schema.json`](../docs/schemas/otel-bare-os-jsonl.schema.json).
-- Audit JSON: **`auditSchemaVersion: 6`** (delegate depth / Wave 9 RPC classes); optional **`requestSmugglingClass`** remains default **`none`** in stock emitters where applicable.
+- Audit JSON: **`auditSchemaVersion: 7`** (delegate depth / Wave 9–10 RPC classes); optional **`requestSmugglingClass`** remains default **`none`** in stock emitters where applicable.
 
 ## Related
 

developer-guide/adr/001-kernel-feature-bits-governance.md

@@ -37,9 +37,11 @@ Bare OS advertises optional booter and seed-channel capabilities as a versioned
 
 12. **Ninth capability word (`bits9`, wave 9)** — **`BARE_OS_KERNEL_FEATURES_STOCK_V9`** and **`BARE_OS_FEATURE9_*`** add the ninth 32-bit word. **Word 8 high bits** remain reserved for future wave-8–scoped features; wave 9 uses **`bits9`** for Holepunch-aligned seed RPC wave 9, Wave 9 **`/proc`** (bare-module, bare-crypto, pear-stage, …), boot policy v9 (**`requireFeatureBits9`**, **`requirePearRuntimeRange`**, **`requireBareCryptoMin`**, **`denyBareModuleSpecifierPatterns`**, …), extension registry schema 6 surface, Pear/Bare bridge **`ctx`** wave 9, worker **`mediaproc:*`**, telemetry NDJSON schema 8 / OTel schema 6 / audit schema 6, and CI **`verify-kernel-roadmap-wave9.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`bits9`**. **`BARE_OS_SEED_CAP_STRICT`** requires **`bits9`** to cover the stock ninth word when it is non-zero.
 
+13. **Tenth capability word (`bits10`, wave 10)** — **`BARE_OS_KERNEL_FEATURES_STOCK_V10`** and **`BARE_OS_FEATURE10_*`** add the tenth 32-bit word. **Word 9 high bits** remain reserved for future wave-9–scoped features; wave 10 uses **`bits10`** for Pear/Bare–inspired seed RPC wave 10, replication JSON adjuncts (bundle tier, autobase-discovery hint, token bucket v4, staging schema 7, peer firewall v5, compact ping v4, ready guard v4, mirror compaction v5, blind relay v3), Wave 10 **`/proc`** JSON (**`bare-os-wave10-proc.js`**), **`bare_os_proc_index`** schema **6**, boot policy v10 (**`requireFeatureBits10`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`extensionSignerPinsV3`**, **`bootPhasesRequireLifecycleMinSchema`**, …), extension registry schema **7**, Pear/Bare bridge **`ctx`** wave 10, worker **`sysproc:*`**, telemetry NDJSON schema **9** / OTel **7** / audit **7**, and CI **`verify-kernel-roadmap-wave10.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`bits10`**. **`BARE_OS_SEED_CAP_STRICT`** requires **`bits10`** to cover the stock tenth word when it is non-zero (same pattern as **`bits9`**).
+
 **Deprecation (unused bits):** once a bit is published in this ADR and **`kernel-capabilities-index.md`**, its numeric position is **stable**; if a feature is removed from the stock booter, the bit stays reserved (document as “unused / reserved”) until a major governance revision. **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** bumps when semantics or this policy changes.
 
 ## Consequences
 
-- Seeder RPC `bare_os.capabilities` must return `protocolPackageVersion`, optional **`booterPackageVersion`**, and `featureBitsDoc` alongside `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, and **`bits9`** (omit zero words if desired; the stock seeder sends all nine today).
+- Seeder RPC `bare_os.capabilities` must return `protocolPackageVersion`, optional **`booterPackageVersion`**, and `featureBitsDoc` alongside `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, and **`bits10`** (omit zero words if desired; the stock seeder sends all ten today).
-- CI should keep seeder and booter copies of the stock masks aligned (`BARE_OS_KERNEL_FEATURES_STOCK_V1`, **`STOCK_V2`**, **`STOCK_V3`**, **`STOCK_V4`**, **`STOCK_V5`**, **`STOCK_V6`**, **`STOCK_V7`**, **`STOCK_V8`**, **`STOCK_V9`**).
+- CI should keep seeder and booter copies of the stock masks aligned (`BARE_OS_KERNEL_FEATURES_STOCK_V1`, **`STOCK_V2`**, **`STOCK_V3`**, **`STOCK_V4`**, **`STOCK_V5`**, **`STOCK_V6`**, **`STOCK_V7`**, **`STOCK_V8`**, **`STOCK_V9`**, **`STOCK_V10`**).

developer-guide/node-to-bare-modules.md

@@ -13,6 +13,9 @@ Bare OS **guest** code (kernel `/boot/init.js`, `/bin` utilities running in the
 | `node:http` / `node:https` | [`bare-http1`](https://github.com/holepunchto/bare-http1), [`bare-https`](https://github.com/holepunchto/bare-https); **`ctx`** may expose wrapped **`fetch`**. |
 | `node:worker_threads` | [`bare-worker`](https://github.com/holepunchto/bare-worker), [`bare-thread`](https://github.com/holepunchto/bare-thread) |
 | `node:diagnostics_channel` | [`bare-diagnostics-channel`](https://github.com/holepunchto/bare-diagnostics-channel) |
+| WebSockets / WS upgrade paths | [`bare-ws`](https://github.com/holepunchto/bare-ws) — pair with **`bare-http1`** / **`bare-tls`** for gateways; see handbook ch.11 / transport table in [kernel-extensions.md](../docs/reference/kernel-extensions.md). |
+| Inspector-style probes (non-secret) | [`bare-inspect`](https://github.com/holepunchto/bare-inspect) — boot policy **`maxPearInspectDepth`** caps nested inspect hints merged from **`boot.policy.json`**. |
+| RPC-style delegates | [`bare-rpc`](https://github.com/holepunchto/bare-rpc) — boot policy **`denyBareRpcMethodPatterns`** can deny method-class patterns before they reach guest-visible **`ctx`** probes. |
 
 Stock **`/bin/openssl`** is a **stub** that points integrators at **`bare-crypto`** (see [`packages/bare-os-coreutils/src/openssl.js`](../../packages/bare-os-coreutils/src/openssl.js)).
 

docs/reference/compatibility-matrix.md

@@ -4,15 +4,15 @@ Single place to compare **protocol**, **booter `ctx` API**, **feature-bit docume
 
 | Artifact | Location | Current (stock) |
 | --- | --- | --- |
-| **`bareOsCtxApiVersion`** | [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js) | `1.18.0` |
+| **`bareOsCtxApiVersion`** | [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js) | `1.19.0` |
-| **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** | [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js) | `11` |
+| **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** | [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js) | `12` |
-| **Capability words** | `bare_os.capabilities` RPC + `/proc/bare_os_features` | `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`** |
+| **Capability words** | `bare_os.capabilities` RPC + `/proc/bare_os_features` | `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`** |
-| **Lifecycle / telemetry NDJSON** | `BARE_OS_LIFECYCLE_SCHEMA_VERSION` in [`bare-os-lifecycle-schema.js`](../../packages/bare-os-booter/lib/bare-os-lifecycle-schema.js) | `8` |
+| **Lifecycle / telemetry NDJSON** | `BARE_OS_LIFECYCLE_SCHEMA_VERSION` in [`bare-os-lifecycle-schema.js`](../../packages/bare-os-booter/lib/bare-os-lifecycle-schema.js) | `9` |
 | **Protocol package** | [`bare-os-protocol` `package.json`](../../packages/bare-os-protocol/package.json) | see workspace version |
 
 ## Peer assumptions
 
-- **Seeder** must answer **`bare_os.capabilities`** with **`bits4`** / **`bits5`** / **`bits6`** / **`bits7`** / **`bits8`** / **`bits9`** when using a current **`bare-os-protocol`** build; older seeders omit newer words (zeros) — use **`BARE_OS_SEED_CAP_STRICT`** only when peers are upgraded.
+- **Seeder** must answer **`bare_os.capabilities`** with **`bits4`** / **`bits5`** / **`bits6`** / **`bits7`** / **`bits8`** / **`bits9`** / **`bits10`** when using a current **`bare-os-protocol`** build; older seeders omit newer words (zeros) — use **`BARE_OS_SEED_CAP_STRICT`** only when peers are upgraded.
 - **Offline LKG** booters skip the swarm peer wait when **`BARE_OS_OFFLINE_LKG_BOOT=1`** and **`BARE_OS_LKG_SYSTEM_KEY_HEX`** is set; the system drive must already contain **`/boot/init.js`** in Corestore.
 
 ## See also

docs/reference/feature-roadmap.md

@@ -470,4 +470,109 @@ This file tracks the twenty-item “kernel super-features” plan. Items are **d
 | 99 | BARE_OS_SOCKS_PROXY_MAP_JSON helper | done — http-fetch-url.js |
 | 100 | Mega-integration wave9 + parity | done — pretest + seeder kernel sync |
 
+## Wave 10 (100-item mega kernel)
+
+| # | Item | Status |
+|---|------|--------|
+| 1 | bits10 + STOCK_V10 + FEATURE10_* + BARE_OS_KERNEL_FEATURE_BITS_DOC=12 | done — kernel-feature-bits.js, protocol index |
+| 2 | ADR 001 §13 tenth capability word | done — developer-guide/adr/001 |
+| 3 | bits10 on seed capabilities + /proc + BARE_OS_SEED_CAP_STRICT | done — channel.js, booter index.js |
+| 4 | BARE_OS_CTX_API_VERSION 1.19.0 + bare-os-ctx.d.ts wave10 | done — bare-os-ctx-api.js |
+| 5 | verify-ctx-api-feature-bits + verify-ctx-dts bits10 | done — scripts |
+| 6 | verify-kernel-roadmap-wave10.mjs 100 rows + pretest | done — scripts |
+| 7 | verify-kernel-roadmap-wave3 STOCK_V10 + RPC + boot policy v10 | done — wave3.mjs |
+| 8 | package-bare-os-protocol.md semver 0.6.0 | done — docs |
+| 9 | Protocol package 0.6.0 + protocol-meta.js | done — bare-os-protocol |
+| 10 | STOCK_V10 !== 0 protocol test | done — test.js |
+| 11 | Seed RPC pear_doctor_hint | done — seed-rpc-methods, channel |
+| 12 | Seed RPC pear_info_sketch | done — channel |
+| 13 | Seed RPC pear_inspect_caps | done — channel |
+| 14 | Seed RPC pear_dump_budget | done — channel |
+| 15 | Seed RPC pear_reset_guard | done — channel |
+| 16 | Seed RPC pear_restart_window | done — channel |
+| 17 | Seed RPC pear_run_flags | done — channel |
+| 18 | Seed RPC pear_bundle_manifest_slice | done — channel |
+| 19 | Seed RPC pear_pack_layout_hint | done — channel |
+| 20 | Seed RPC pear_seed_topology | done — channel |
+| 21 | Seed RPC pear_state_snapshot | done — channel |
+| 22 | Seed RPC pear_stamp_pointer | done — channel |
+| 23 | Seed RPC pear_shake_latency | done — channel |
+| 24 | Seed RPC pear_crasher_class | done — channel |
+| 25 | Seed RPC pear_errors_rate_hint | done — channel |
+| 26 | Seed RPC pear_bridge_health | done — channel |
+| 27 | Seed RPC pear_link_matrix | done — channel |
+| 28 | Seed RPC pear_pipe_backpressure | done — channel |
+| 29 | Seed RPC pear_opwait_budget | done — channel |
+| 30 | Seed RPC pear_terminal_caps | done — channel |
+| 31 | replication_status.pearBundleTier | done — channel + seeder env |
+| 32 | replication_status.autobaseDiscoveryHint | done — channel + seeder env |
+| 33 | staging_slot schema 7 + wave10 blob | done — channel.js |
+| 34 | kernel_info.pearRuntimeBareFingerprint | done — channel + seeder env |
+| 35 | peer_firewall_stats v5 + wave10 | done — channel.js |
+| 36 | compact_ping v4 optional fields | done — channel + compact_ping_v4 RPC |
+| 37 | handshakeTokenBucketV4Json / seeder token bucket v4 | done — replication_status |
+| 38 | ready_guard_v4 RPC | done — seed-rpc-methods, channel |
+| 39 | mirror_drive_compaction_v5 RPC | done — seed-rpc-methods, channel + seeder |
+| 40 | blind_relay_circuit_v3 RPC | done — seed-rpc-methods, channel + seeder |
+| 41 | /proc pear_doctor_state.json | done — bare-os-wave10-proc.js |
+| 42 | /proc pear_workshop_flags.json | done — wave10 proc |
+| 43 | /proc pear_user_dirs_map.json | done — wave10 proc |
+| 44 | /proc pear_api_allowlist_sketch.json | done — wave10 proc |
+| 45 | /proc pear_rti_pointer.json | done — wave10 proc |
+| 46 | /proc bare_boot_phase_map.json | done — wave10 proc |
+| 47 | /proc bare_rpc_registry_sketch.json | done — wave10 proc |
+| 48 | /proc bare_logger_policy.json | done — wave10 proc |
+| 49 | /proc bare_performance_counters.json | done — wave10 proc |
+| 50 | /proc bare_inspect_policy.json | done — wave10 proc |
+| 51 | /proc bare_signals_mask.json | done — wave10 proc |
+| 52 | /proc bare_timers_budget.json | done — wave10 proc |
+| 53 | /proc bare_stream_backpressure.json | done — wave10 proc |
+| 54 | /proc bare_ws_gateway_sketch.json | done — wave10 proc |
+| 55 | /proc bare_tls_session_hint.json | done — wave10 proc |
+| 56 | /proc autobase_writer_hint.json | done — wave10 proc |
+| 57 | /proc blind_pairing_sketch.json | done — wave10 proc |
+| 58 | /proc broadcast_encryption_hint.json | done — wave10 proc |
+| 59 | /proc activity_queue_depth.json | done — wave10 proc |
+| 60 | bare_os_proc_index schema 6 | done — vfs.js + aliases + readdir |
+| 61 | ctx.bareOsEmitPearDoctorHint | done — booter index.js |
+| 62 | ctx.bareOsPearInspectProbe | done — booter stub |
+| 63 | ctx.bareOsEmitBareBootPhaseHint | done — booter |
+| 64 | ctx.bareOsBareRpcCapProbe | done — booter |
+| 65 | ctx.bareOsEmitPearStampPointer | done — booter |
+| 66 | ctx.bareOsRegisterBareLoggerTap | done — booter (capped) |
+| 67 | ctx.bareOsEmitAutobaseDiscoveryHint | done — booter |
+| 68 | ctx.bareOsEmitBlindPairingSketch | done — booter |
+| 69 | ctx.bareOsBareStreamBackpressureHint | done — booter |
+| 70 | ctx.bareOsPearTerminalCapsProbe | done — booter |
+| 71 | boot.policy v10 requireFeatureBits10 | done — schema + kernel/init.js |
+| 72 | requireBareBootMin | done — kernel/init.js + BARE_OS_BARE_BOOT_VERSION |
+| 73 | denyBareRpcMethodPatterns | done — kernel/init.js env JSON |
+| 74 | maxPearInspectDepth | done — kernel/init.js env |
+| 75 | requireBareLoggerMin | done — kernel/init.js |
+| 76 | denyAutobaseDiscoveryChannels | done — kernel/init.js env JSON |
+| 77 | requireBareTlsMin | done — kernel/init.js |
+| 78 | extensionSignerPinsV3 | done — boot.policy.schema + kernel env |
+| 79 | offlineLkgRequirePearStamp | done — kernel/init.js env |
+| 80 | bootPhasesRequireLifecycleMinSchema | done — kernel/init.js vs lifecycle schema |
+| 81 | bare-fs errno mapping v4 (handbook) | done — handbook ch.9 |
+| 82 | Union statfs v2 docs | done — handbook ch.9 |
+| 83 | /dev/shm quota v3 class hints | done — handbook ch.9 |
+| 84 | Shell export -f v2 edge cases | done — handbook ch.9 |
+| 85 | tar xattr subset stub | done — coreutils + handbook |
+| 86 | ssh-keygen stub (bare-crypto) | done — coreutils + handbook |
+| 87 | xargs -P parallelism cap | done — coreutils + tests |
+| 88 | Git worktree policy v4 | done — developer-guide / handbook |
+| 89 | BARE_OS_BIN_WORKER_ALLOW sysproc:* | done — kernel-runner.js |
+| 90 | BARE_OS_THREAD_POOL_TELEMETRY_JSON | done — env passthrough + docs |
+| 91 | bare-realm boundary v2 doc | done — developer-guide |
+| 92 | bare-dns DoT path doc | done — developer-guide / handbook |
+| 93 | Transport table v2 (tcp/tls/ws) | done — reference docs |
+| 94 | wget bare-fetch mirror path | done — node-to-bare-modules.md |
+| 95 | BARE_OS_MTLS_PROXY_MAP_JSON | done — booter env passthrough + kernel-extensions |
+| 96 | BARE_OS_HAPPY_EYEBALLS_V4_MODE | done — env + compatibility-matrix note |
+| 97 | NDJSON lifecycle v9 wave10ProbeId | done — bare-os-var-log.js |
+| 98 | OTel JSONL otlSchemaVersion 7 | done — bare-os-var-log.js |
+| 99 | Audit JSON schema 7 | done — index.js + kernel-runner.js |
+| 100 | Mega-integration wave10 + parity | done — pretest + seeder kernel sync |
+
 See also [kernel-extensions.md](kernel-extensions.md) and [package-bare-os-protocol.md](package-bare-os-protocol.md).

docs/reference/kernel-capabilities-index.md

@@ -203,7 +203,25 @@ Single map from optional **feature bits** ([`packages/bare-os-protocol/lib/kerne
 | 11 `FEATURE9_DOC_CI_WAVE9` | — | — | **`verify-kernel-roadmap-wave9.mjs`** |
 | 12 `FEATURE9_HTTP_DHT_PROXY_ROUTES_V2` | — | `http_dht_proxy_routes_v2` RPC | revision v2 |
 
-**Related `ctx` (1.18.0+):** **`bareOsAdvertisedKernelBits9`**, **`bareOsSeedCapabilityBits9`**; Wave 9 hooks above.
+### Word 10 — `bits10` / `BARE_OS_KERNEL_FEATURES_STOCK_V10` (wave 10)
+
+| Bit | Symbol | Primary surfaces | Notes |
+| --- | --- | --- | --- |
+| 0 `FEATURE10_CAP_WORD` | — | seed **`bits10`** + `/proc/bare_os_features` | tenth word marker |
+| 1 `FEATURE10_SEED_RPC_WAVE10` | `BARE_OS_SEED_*` JSON | `pear_doctor_hint` … `pear_terminal_caps`, `ready_guard_v4`, `compact_ping_v4`, … | [`seed-rpc-methods.js`](../../packages/bare-os-protocol/lib/seed-rpc-methods.js) |
+| 2 `FEATURE10_REPLICATION_JSON_WAVE10` | seeder opts | `pearBundleTier`, `autobaseDiscoveryHint`, `handshakeTokenBucketV4`, `staging_slot` **schema 7**, `peer_firewall_stats` **v5** | advisory |
+| 3 `FEATURE10_PROC_METRICS_WAVE10` | Wave 10 `BARE_OS_*_JSON` envs | 19× `bare_os_*.json` + `bare_os_proc_index` schema **6** | [`bare-os-wave10-proc.js`](../../packages/bare-os-booter/lib/bare-os-wave10-proc.js) |
+| 4 `FEATURE10_BOOT_POLICY_V10` | `boot.policy.json` v10 | — | **`requireFeatureBits10`**, **`requireBareBootMin`**, **`bootPhasesRequireLifecycleMinSchema`**, … |
+| 5 `FEATURE10_KERNEL_EXT_REGISTRY_V7` | extension records | `/proc/bare_os/extensions.json` schema **7** | **`extensionSignerPinsV3`** env |
+| 6 `FEATURE10_PEAR_BARE_BRIDGE_WAVE10` | — | — | **`bareOsEmitPearDoctorHint`**, terminal probe, logger tap, … |
+| 7 `FEATURE10_VFS_POSIX_WAVE10` | coreutils / handbook ch.9 | `ssh-keygen` stub, `xargs -P` cap, `tar` xattr sketch | no guest **`node:crypto`** |
+| 8 `FEATURE10_INITD_SUBPROC_WAVE10` | — | — | shared with prior waves |
+| 9 `FEATURE10_WORKER_NET_WAVE10` | **`sysproc:*`**, **`BARE_OS_MTLS_PROXY_MAP_JSON`**, **`BARE_OS_HAPPY_EYEBALLS_V4_MODE`** | thread telemetry env | transport docs |
+| 10 `FEATURE10_TELEMETRY_AUDIT_WAVE10` | telemetry sinks | NDJSON **9** / OTel **7** / audit **7** | **`wave10ProbeId`**, **`bareRpcProbeClass`** |
+| 11 `FEATURE10_DOC_CI_WAVE10` | — | — | **`verify-kernel-roadmap-wave10.mjs`** |
+| 12 `FEATURE10_COMPACT_READY_RPC_V4` | — | `compact_ping_v4`, `ready_guard_v4` RPC | dedicated v4 payloads |
+
+**Related `ctx` (1.19.0+):** **`bareOsAdvertisedKernelBits10`**, **`bareOsSeedCapabilityBits10`**, prior-word **`bareOsAdvertisedKernelBits9`** / **`bareOsSeedCapabilityBits9`**, and Wave 10 **`ctx`** hooks above.
 
 **Handbook:** [handbook/09-posix-utilities-shell-and-vfs.md](../../handbook/09-posix-utilities-shell-and-vfs.md), [handbook/04-the-booter-runtime.md](../../handbook/04-the-booter-runtime.md).
 

docs/reference/kernel-extensions.md

@@ -2,7 +2,7 @@
 
 This document complements the [handbook](../../handbook/09-posix-utilities-shell-and-vfs.md) with a single map of optional **booter + stock kernel** features added for richer POSIX-like behavior, protocol alignment, and operations.
 
-## Governance (feature bits doc v11)
+## Governance (feature bits doc v12)
 
 New capability bits are governed by [ADR 001 — Kernel feature bit governance](../../developer-guide/adr/001-kernel-feature-bits-governance.md). **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** must bump when semantics change. Bits **28–30** on word 1 are assigned (see ADR). **Word 2 (`bits2`)** carries wave-2 features; always mask with **`>>> 0`**. Avoid `1 << 31` on word 1 in JS without `>>> 0` discipline.
 
@@ -10,14 +10,16 @@ New capability bits are governed by [ADR 001 — Kernel feature bit governance](
 
 ## Capability bitmask
 
-Runtime bits are defined in `bare-os-protocol` (`kernel-feature-bits.js`) and surfaced under `/proc/bare_os_features` and the **`/proc/bare_os/`** tree. The stock booter advertises **`BARE_OS_KERNEL_FEATURES_STOCK_V1`** … **`STOCK_V9`** (nine words on the wire when non-zero).
+Runtime bits are defined in `bare-os-protocol` (`kernel-feature-bits.js`) and surfaced under `/proc/bare_os_features` and the **`/proc/bare_os/`** tree. The stock booter advertises **`BARE_OS_KERNEL_FEATURES_STOCK_V1`** … **`STOCK_V10`** (ten words on the wire when non-zero).
 
-Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optional **`booterPackageVersion`**, **`featureBitsDoc`**, **`doc`**, **`bits`**, **`bits2`**, **`bits3`**, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`role`**, **`protocol`**. RPC method names are listed from a single registry ([`seed-rpc-methods.js`](../../packages/bare-os-protocol/lib/seed-rpc-methods.js)); unknown methods return **`bare_os.rpc_unknown_method`**. **`bare_os.replication_status`** returns seeder-side replication hints (manifest path count, local RAM block count). **`bare_os.replication_queue`** includes bounded **`queueDepthEstimate`** and snapshot workflow notes; **`bare_os.capability_attestation`**, and **`bare_os.mbr_layout`** remain optional wave-2 RPCs. Wave 6 adds **`replication_plan`**, **`dht_bootstrap_hint`**, **`snapshot_chain`**, **`mirror_compaction_hint`**, **`updater_state`**, **`blind_peer_topology_v2`**, **`compact_ping`**. Wave 7 adds **`corestore_stats`**, **`snapshot_manifest_slice`**, **`mirror_drive_hint_v2`**, **`hrpc_registry_summary`**, **`protomux_capability_ad`**, **`dht_address_book`**, **`replication_throttle_hint`**, **`bundlebee_stage`**, **`http_dht_proxy_hint`**. Wave 8 adds **`protomux_rpc_pool_hint`**, **`hyperblob_store_hint`**, **`signing_request_queue_hint`**, **`core_storage_layout_hint`**, **`mirror_drive_compaction_v3`**, **`bundlebee_cli_stage`**, **`ready_guard_v2`**, **`blind_relay_circuit_hint`**, **`http_dht_proxy_routes`**. **Wave 9** adds Holepunch-aligned short names such as **`pear_stage_hint`**, **`updater_channel_matrix`**, **`appling_bundle_pointer`**, **`drive_resolve_policy`**, **`bundle_id_fingerprint`**, **`hyperdb_migration_hint`**, **`sidecar_bundle_index_v2`**, **`pear_message_queue_sketch`**, **`runtime_bootstrap_etag`**, **`force_update_guard`**, **`gracedown_window`**, **`tryboot_slot`**, **`hotmods_allowlist`**, **`prefetcher_budget`**, **`opstream_backpressure`**, **`multisig_link_pointer`**, **`md_render_caps`**, **`bundlebee_cli_stage_v2`**, **`seed_manifest_diff_v2`**, **`peer_handshake_latency_budget`**, plus replication adjuncts (**`ready_guard_v3`**, **`mirror_drive_compaction_v4`**, **`blind_relay_circuit_v2`**, **`http_dht_proxy_routes_v2`**, token-bucket metadata, **`compact_ping` v3**, **`peer_firewall_stats` v4**, **`staging_slot` schema 6**, **`kernel_info.pearApplingId`**). **`bare_os.manifest_hints`** returns a sample of manifest paths; **`bare_os.peer_health`** returns seeder health counters; **`bare_os.staging_slot`** returns optional A/B slot hints (seeder env `BARE_OS_SEED_STAGING_SLOT`, `BARE_OS_SEED_STAGING_PENDING`). Booter mirrors hints under **`/proc/bare_os/manifest_hints`**, **`peer_health`**, **`staging_slot`**, **`net_summary.json`**, **`extensions.json`** (schema **6** in wave 9), **`hdms_hints.json`** (schema **3**: optional **`vaultRotateCount`**) and embeds them in **`/proc/bare_os_replication`** JSON. **`/proc/bare_os/index.json`** lists stable aliases (**`bare_os_proc_index` schema 5**).
+Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optional **`booterPackageVersion`**, **`featureBitsDoc`**, **`doc`**, **`bits`**, **`bits2`**, **`bits3`**, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`**, **`role`**, **`protocol`**. RPC method names are listed from a single registry ([`seed-rpc-methods.js`](../../packages/bare-os-protocol/lib/seed-rpc-methods.js)); unknown methods return **`bare_os.rpc_unknown_method`**. **`bare_os.replication_status`** returns seeder-side replication hints (manifest path count, local RAM block count). **`bare_os.replication_queue`** includes bounded **`queueDepthEstimate`** and snapshot workflow notes; **`bare_os.capability_attestation`**, and **`bare_os.mbr_layout`** remain optional wave-2 RPCs. Wave 6 adds **`replication_plan`**, **`dht_bootstrap_hint`**, **`snapshot_chain`**, **`mirror_compaction_hint`**, **`updater_state`**, **`blind_peer_topology_v2`**, **`compact_ping`**. Wave 7 adds **`corestore_stats`**, **`snapshot_manifest_slice`**, **`mirror_drive_hint_v2`**, **`hrpc_registry_summary`**, **`protomux_capability_ad`**, **`dht_address_book`**, **`replication_throttle_hint`**, **`bundlebee_stage`**, **`http_dht_proxy_hint`**. Wave 8 adds **`protomux_rpc_pool_hint`**, **`hyperblob_store_hint`**, **`signing_request_queue_hint`**, **`core_storage_layout_hint`**, **`mirror_drive_compaction_v3`**, **`bundlebee_cli_stage`**, **`ready_guard_v2`**, **`blind_relay_circuit_hint`**, **`http_dht_proxy_routes`**. **Wave 9** adds Holepunch-aligned short names such as **`pear_stage_hint`**, **`updater_channel_matrix`**, **`appling_bundle_pointer`**, **`drive_resolve_policy`**, **`bundle_id_fingerprint`**, **`hyperdb_migration_hint`**, **`sidecar_bundle_index_v2`**, **`pear_message_queue_sketch`**, **`runtime_bootstrap_etag`**, **`force_update_guard`**, **`gracedown_window`**, **`tryboot_slot`**, **`hotmods_allowlist`**, **`prefetcher_budget`**, **`opstream_backpressure`**, **`multisig_link_pointer`**, **`md_render_caps`**, **`bundlebee_cli_stage_v2`**, **`seed_manifest_diff_v2`**, **`peer_handshake_latency_budget`**, plus replication adjuncts (**`ready_guard_v3`**, **`mirror_drive_compaction_v4`**, **`blind_relay_circuit_v2`**, **`http_dht_proxy_routes_v2`**, token-bucket metadata, **`compact_ping` v3**, **`peer_firewall_stats` v4**, **`staging_slot` schema 6**, **`kernel_info.pearApplingId`**). **`bare_os.manifest_hints`** returns a sample of manifest paths; **`bare_os.peer_health`** returns seeder health counters; **`bare_os.staging_slot`** returns optional A/B slot hints (seeder env `BARE_OS_SEED_STAGING_SLOT`, `BARE_OS_SEED_STAGING_PENDING`). Booter mirrors hints under **`/proc/bare_os/manifest_hints`**, **`peer_health`**, **`staging_slot`**, **`net_summary.json`**, **`extensions.json`** (schema **7** in wave 10), **`hdms_hints.json`** (schema **3**: optional **`vaultRotateCount`**) and embeds them in **`/proc/bare_os_replication`** JSON. **`/proc/bare_os/index.json`** lists stable aliases (**`bare_os_proc_index` schema 6**). **Wave 10** adds Pear/Bare sketch RPCs (**`pear_doctor_hint`** … **`pear_terminal_caps`**, **`ready_guard_v4`**, **`compact_ping_v4`**, compaction/blind-relay v5/v3), replication adjuncts (**`pearBundleTier`**, **`autobaseDiscoveryHint`**, **`handshakeTokenBucketV4`**, **`staging_slot` schema 7**, **`peer_firewall_stats` v5**), and 19× Wave 10 **`/proc/bare_os/*.json`** files via **`bare-os-wave10-proc.js`**.
 
 **Wave 8 Pear/Bare bridge (doc-first):** **`ctx.bareOsEmitStructuredCloneCap`** / **`ctx.bareOsProtomuxChannelAlias`**; **`BARE_OS_CURL_RESOLVE_MAP_JSON`** (curl/wget); **`BARE_OS_HTTP_PROXY_MAP_JSON`** (operator proxy map, host-interpreted); **`BARE_OS_BARE_HTTP1_KEEPALIVE_POOL`**, **`BARE_OS_HAPPY_EYEBALLS_IPV6_FIRST`**, **`BARE_OS_RESUME_STAGGER_LEVEL_MS_JSON`**, **`BARE_OS_INITD_COLLECT_MODE_HINT`**, **`BARE_OS_INITD_START_LIMIT_INTERVAL_MS`**, **`BARE_OS_INITD_START_LIMIT_BURST`**, **`BARE_OS_WORKER_RSS_HIGH_WATER_JSON`**, **`BARE_OS_SANDBOX_FS_CLASS`**, **`BARE_OS_SUBPROCESS_SCHED_POLICY_HINT`**, **`BARE_OS_DIAGNOSTICS_SUBSCRIBE_ALLOWLIST_JSON`**; **`BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS`** (comma-separated short names, also merged from **`denySeedRpcMethods`** in **`boot.policy.json`** v8).
 
 **Wave 9 Pear/Bare bridge:** **`ctx.bareOsEmitPearStageHint`**, **`ctx.bareOsBareModuleResolveProbe`**, **`ctx.bareOsBareCryptoCapProbe`**, **`ctx.bareOsPearUpdaterChannel`**, **`ctx.bareOsEmitDriveResolveHint`**, **`ctx.bareOsRegisterBareDiagnosticsTapV2`**, **`ctx.bareOsEmitPearMessageSketch`**, **`ctx.bareOsEmitTrybootSlot`**, **`ctx.bareOsEmitMultisigPointer`**, **`ctx.bareOsBareStorageHint`**; host env **`BARE_OS_SOCKS_PROXY_MAP_JSON`** (delegated fetch); **`BARE_OS_BARE_CRYPTO_VERSION`**, **`BARE_OS_PEAR_IPC_PACKAGE_VERSION`**, **`BARE_OS_PEAR_UPDATER_CHANNEL`**, **`BARE_OS_HAPPY_EYEBALLS_V3_MODE`**, **`BARE_OS_BIN_WORKER_WASM_MS_MAX`**, **`BARE_OS_WAVE9_PROBE_ID`**, **`BARE_OS_BARE_MODULE_PROBE_CLASS`**; optional **`BARE_OS_*_JSON`** blobs for Wave 9 **`/proc/bare_os/*.json`** files (see **`bare-os-wave9-proc.js`**); boot policy **v9** adds **`requireFeatureBits9`**, **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`**, **`maxKernelExtensionDepth` v2 semantics**, … — see [`boot.policy.schema.json`](../schemas/boot.policy.schema.json).
 
+**Wave 10 Pear/Bare bridge:** **`ctx.bareOsEmitPearDoctorHint`**, **`ctx.bareOsPearInspectProbe`**, **`ctx.bareOsEmitBareBootPhaseHint`**, **`ctx.bareOsBareRpcCapProbe`**, **`ctx.bareOsEmitPearStampPointer`**, **`ctx.bareOsRegisterBareLoggerTap`**, **`ctx.bareOsEmitAutobaseDiscoveryHint`**, **`ctx.bareOsEmitBlindPairingSketch`**, **`ctx.bareOsBareStreamBackpressureHint`**, **`ctx.bareOsPearTerminalCapsProbe`**; host env **`BARE_OS_WAVE10_PROBE_ID`**, **`BARE_OS_BARE_RPC_PROBE_CLASS`**, **`BARE_OS_MTLS_PROXY_MAP_JSON`**, **`BARE_OS_THREAD_POOL_TELEMETRY_JSON`**, **`BARE_OS_HAPPY_EYEBALLS_V4_MODE`**, **`BARE_OS_BARE_BOOT_VERSION`**, **`BARE_OS_BARE_LOGGER_VERSION`**, **`BARE_OS_BARE_TLS_VERSION`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (injected); boot policy **v10** adds **`requireFeatureBits10`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`maxPearInspectDepth`**, **`requireBareLoggerMin`**, **`denyAutobaseDiscoveryChannels`**, **`requireBareTlsMin`**, **`extensionSignerPinsV3`**, **`offlineLkgRequirePearStamp`**, **`bootPhasesRequireLifecycleMinSchema`**, …
+
 **JSON Schemas** (policy, telemetry, boot trace): [`docs/schemas/`](../schemas/) (see also [reference README](./README.md)).
 
 ## Environment quick reference
@@ -32,8 +34,8 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
 | Union writes          | `BARE_OS_VFS_UNION_WRITE_DENY`                                                         | Comma/colon list of path prefixes blocked for writes under union prefixes                                                                                                                                                                                                                                                                                                             |
 | IPC                   | `BARE_OS_IPC_CHANNEL_MAX_BYTES`                                                        | JSON map `{"fifoName": 65536}` per-channel backlog cap                                                                                                                                                                                                                                                                                                                                |
 | Initd journal         | `BARE_OS_INITD_JOURNAL_MAX_LINES`                                                      | Cap NDJSON lines per unit (default 400, max 20000)                                                                                                                                                                                                                                                                                                                                    |
-| Telemetry             | `BARE_OS_TELEMETRY_NDJSON`                                                             | Logical path; append NDJSON mirror (`telemetrySchemaVersion` / `lifecycleSchemaVersion` **8**); optional **`sessionForkGeneration`**, **`wave9ProbeId`**, **`bareModuleProbeClass`**; optional correlation via **`BARE_OS_BOOT_ATTEMPT_ID`** → **`bootAttemptId`**                                                                                                                                                                     |
+| Telemetry             | `BARE_OS_TELEMETRY_NDJSON`                                                             | Logical path; append NDJSON mirror (`telemetrySchemaVersion` / `lifecycleSchemaVersion` **9**); optional **`sessionForkGeneration`**, **`wave9ProbeId`**, **`wave10ProbeId`**, **`bareModuleProbeClass`**, **`bareRpcProbeClass`**; optional correlation via **`BARE_OS_BOOT_ATTEMPT_ID`** → **`bootAttemptId`**                                                                                                                                                                     |
-| Telemetry OTel        | `BARE_OS_TELEMETRY_OTEL_JSONL`                                                         | Logical path; append OTLP-inspired JSON lines (`otlSchemaVersion` **4–6**, optional **`scopeMetrics`** sketch; see [`otel-bare-os-jsonl.schema.json`](../schemas/otel-bare-os-jsonl.schema.json))                                                                                                                                                                                      |
+| Telemetry OTel        | `BARE_OS_TELEMETRY_OTEL_JSONL`                                                         | Logical path; append OTLP-inspired JSON lines (`otlSchemaVersion` **7**, optional **`scopeMetrics`** sketch; see [`otel-bare-os-jsonl.schema.json`](../schemas/otel-bare-os-jsonl.schema.json))                                                                                                                                                                                      |
 | Proc poll             | `BARE_OS_PROC_POLL_MS`                                                                 | Min interval 250ms, max 60s, for coalesced **`/proc/bare_os/metrics_live.json`**                                                                                                                                                                                                                                                                                                      |
 | Shell `${…}`          | `BARE_OS_SHELL_PARAM_EXPANSION=1`                                                      | Enable `${VAR:-default}` and `${VAR#prefix}` (bounded prefix length)                                                                                                                                                                                                                                                                                                                  |
 | Shell `${…}` v2       | `BARE_OS_SHELL_PARAM_EXPANSION_V2=1`                                                   | With param expansion on: `${VAR:=x}`, `${VAR##*/}` / `${VAR#*/}`, `${VAR%%pat}` / `${VAR%pat}` (bounded; see handbook ch.9)                                                                                                                                                                                                                                                           |
@@ -41,7 +43,7 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
 | VFS pseudo watch      | `BARE_OS_VFS_WATCH_PSEUDO=1`                                                           | `vfs.watch` on coalesced **`/proc/bare_os/metrics_live.json`**                                                                                                                                                                                                                                                                                                                        |
 | Diagnostics           | `BARE_OS_DIAGNOSTICS_SUBSCRIBE=1`                                                      | `ctx.bareOsDiagnosticsSubscribe` for structured dev events                                                                                                                                                                                                                                                                                                                            |
 | HDMS / autopass hint  | `BARE_OS_AUTOPASS_INVITE_URL`                                                          | Surfaced in **`/proc/bare_os/hdms_hints.json`** (guest does not open URLs)                                                                                                                                                                                                                                                                                                            |
-| Bin worker            | `BARE_OS_BIN_WORKER_OFFLOAD=1`, `BARE_OS_BIN_WORKER_ALLOW`                             | Offload eligible `/bin` on Bare via `bare-worker`; allow list defaults to awk/sed/jq, or patterns like `textproc:*` (cut, tr, sort, uniq, …); **`mathproc:*`** (`bc`, `dc`); **`mediaproc:*`** (`ffmpeg`, `ffprobe`); optional per-invocation wall cap **`BARE_OS_BIN_WORKER_WALL_MS`**; optional WASM time budget **`BARE_OS_BIN_WORKER_WASM_MS_MAX`**                                                                                                                                                                                                      |
+| Bin worker            | `BARE_OS_BIN_WORKER_OFFLOAD=1`, `BARE_OS_BIN_WORKER_ALLOW`                             | Offload eligible `/bin` on Bare via `bare-worker`; allow list defaults to awk/sed/jq, or patterns like `textproc:*` (cut, tr, sort, uniq, …); **`mathproc:*`** (`bc`, `dc`); **`mediaproc:*`** (`ffmpeg`, `ffprobe`); **`sysproc:*`** (bounded process-adjacent builtins: `echo`, `pwd`, `printenv`, …); optional per-invocation wall cap **`BARE_OS_BIN_WORKER_WALL_MS`**; optional WASM time budget **`BARE_OS_BIN_WORKER_WASM_MS_MAX`**                                                                                                                                                                                                      |
 | Wave 6 proc inject    | `BARE_OS_PROC_*` (see [kernel-capabilities-index](./kernel-capabilities-index.md) Word 6) | Bounded JSON for **`/proc/bare_os/*.json`** operator metrics (udx, DHT, backpressure, locale, …)                                                                                                                                                                                                                                                                               |
 | DNS map               | `BARE_OS_DNS_MAP_JSON`                                                                 | Split-horizon static map; summary in **`/proc/bare_os/dns_map_active.json`**                                                                                                                                                                                                                                                                                                        |
 | Resume stagger        | `BARE_OS_RESUME_STAGGER_MS`                                                            | Delay between initd unit starts on resume (advisory)                                                                                                                                                                                                                                                                                                                                  |
@@ -52,7 +54,7 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
 | Exec budget           | `BARE_OS_EXEC_LINE_BUDGET_MS`                                                          | Reject top-level `execLine` when session wall time exceeds budget                                                                                                                                                                                                                                                                                                                     |
 | Delegates             | `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, …                 | Per-minute caps on host delegates (sliding minute window)                                                                                                                                                                                                                                                                                                                             |
 | Delegates             | `BARE_OS_DELEGATE_AUDIT_ONLY=1`                                                        | With `BARE_OS_AUDIT=1`, log delegate invocations and skip host run (exit 0)                                                                                                                                                                                                                                                                                                           |
-| Boot policy           | `BARE_OS_BOOT_POLICY=1`                                                                | Merge `skipPhases` / `denyBootPhases` from `/etc/bare-os/boot.policy.json`; optional `minKernelFeatureMask` / `requireSeedCaps`; v2 `maxExecLineDepth`, `denyEnvKeys`, `requireProcNodes`; **v3** `requireFeatureBits2`, `requireFeatureBits3`, `allowedPearIpcChannels` → session env, `denyVfsPrefixes` (VFS deny), `maxInitdRestartsPerUnit` → `BARE_OS_INITD_RESTART_MAX_DEFAULT`; **v4** `requireFeatureBits4`, `denyExecLineBuiltins` → `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `allowedCtxMethods` → `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`; **v5** `requireFeatureBits5`, `requireInitJsSha256`; **v6** `requireFeatureBits6`, `requireBooterSemver`, `requireCtxApiMin`, `denyKernelExtensionIds`, `kernelExtensionHashPins`, `offlineLkgIntegrityStrict`; **v7–v8** (see schema); **v9** `requireFeatureBits9`, `requirePearRuntimeRange`, `denyBareModuleSpecifierPatterns`, `requireBareCryptoMin`, `denyKernelSyscalls`, `requirePearIpcMin`, `extensionSignerPinsV2`, `offlineLkgManifestMaxAgeSec`, `bootPhasesRequireProcIndexMinSchema`, stricter extension depth / cycle diagnostics |
+| Boot policy           | `BARE_OS_BOOT_POLICY=1`                                                                | Merge `skipPhases` / `denyBootPhases` from `/etc/bare-os/boot.policy.json`; optional `minKernelFeatureMask` / `requireSeedCaps`; v2 `maxExecLineDepth`, `denyEnvKeys`, `requireProcNodes`; **v3** `requireFeatureBits2`, `requireFeatureBits3`, `allowedPearIpcChannels` → session env, `denyVfsPrefixes` (VFS deny), `maxInitdRestartsPerUnit` → `BARE_OS_INITD_RESTART_MAX_DEFAULT`; **v4** `requireFeatureBits4`, `denyExecLineBuiltins` → `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `allowedCtxMethods` → `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`; **v5** `requireFeatureBits5`, `requireInitJsSha256`; **v6** `requireFeatureBits6`, `requireBooterSemver`, `requireCtxApiMin`, `denyKernelExtensionIds`, `kernelExtensionHashPins`, `offlineLkgIntegrityStrict`; **v7–v8** (see schema); **v9** `requireFeatureBits9`, `requirePearRuntimeRange`, `denyBareModuleSpecifierPatterns`, `requireBareCryptoMin`, `denyKernelSyscalls`, `requirePearIpcMin`, `extensionSignerPinsV2`, `offlineLkgManifestMaxAgeSec`, `bootPhasesRequireProcIndexMinSchema`, stricter extension depth / cycle diagnostics; **v10** `requireFeatureBits10`, `requireBareBootMin`, `denyBareRpcMethodPatterns`, `maxPearInspectDepth`, `requireBareLoggerMin`, `denyAutobaseDiscoveryChannels`, `requireBareTlsMin`, `extensionSignerPinsV3`, `offlineLkgRequirePearStamp`, `bootPhasesRequireLifecycleMinSchema` |
 | Boot policy strict    | `BARE_OS_BOOT_POLICY_STRICT=1`                                                         | Abort boot when policy checks fail                                                                                                                                                                                                                                                                                                                                                    |
 | Lazy personal drive   | `BARE_OS_LAZY_PERSONAL_DRIVE=1`                                                        | Mount personal Hyperdrive at session setup instead of immediately after kernel fetch                                                                                                                                                                                                                                                                                                  |
 | System revision       | `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT` | Exposed as `ctx.bareOsSystemRevision` (Pear OTA–style hints)                                                                                                                                                                                                                                                                                                                          |
@@ -79,6 +81,10 @@ Shipped as **`bits6`** + **`STOCK_V6`**. Full bit map: [kernel-capabilities-inde
 
 Shipped as **`bits9`** + **`STOCK_V9`**. Word 9 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Wave 9 table). Node→Bare map: [node-to-bare-modules.md](../../developer-guide/node-to-bare-modules.md). CI: **`verify-kernel-roadmap-wave9.mjs`**, **`verify-kernel-roadmap-wave3.mjs`**, **`verify-ctx-api-feature-bits.mjs`**, **`verify-ctx-dts.mjs`**, **`verify-compat-matrix.mjs`**.
 
+## Wave 10 summary
+
+Shipped as **`bits10`** + **`STOCK_V10`**. Word 10 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Wave 10 table). CI: **`verify-kernel-roadmap-wave10.mjs`** plus the wave 3 / ctx / compat scripts above.
+
 ## POSIX utility notes
 
 | Utility | Notes                                                |

docs/reference/package-bare-os-protocol.md

@@ -9,7 +9,7 @@ Former **DOCUMENTATION.md** §10. [Reference index →](README.md)
 | Item                        | Detail                                                                     |
 | --------------------------- | -------------------------------------------------------------------------- |
 | `name`                      | `bare-os-protocol`                                                         |
-| `version`                   | `0.5.0` (wave 9: **`bits9`**, Holepunch-aligned seed RPC wave + `http_dht_proxy_routes_v2`; couple boot policy **`requireProtocolPackageMin`** to this semver) |
+| `version`                   | `0.6.0` (wave 10: **`bits10`**, Pear/Bare seed RPC wave 10 + replication v5/v4 adjuncts + `compact_ping_v4`; couple boot policy **`requireProtocolPackageMin`** to this semver) |
 | `main` / `exports["."]`     | `./index.js`                                                               |
 | `exports["./constants.js"]` | `./constants.js` (for `bare-os-protocol/constants.js` imports)             |
 | `exports["./messages"]`     | `./lib/messages.js`                                                        |

docs/schemas/boot.policy.schema.json

@@ -17,6 +17,46 @@
     "requireFeatureBits7": { "type": "integer", "minimum": 0 },
     "requireFeatureBits8": { "type": "integer", "minimum": 0 },
     "requireFeatureBits9": { "type": "integer", "minimum": 0 },
+    "requireFeatureBits10": { "type": "integer", "minimum": 0 },
+    "requireBareBootMin": {
+      "type": "string",
+      "description": "Minimum bare-boot semver vs BARE_OS_BARE_BOOT_VERSION"
+    },
+    "denyBareRpcMethodPatterns": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Regex/pattern strings merged to BARE_OS_BOOT_POLICY_DENY_BARE_RPC_PATTERNS_JSON"
+    },
+    "maxPearInspectDepth": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 64
+    },
+    "requireBareLoggerMin": {
+      "type": "string",
+      "description": "Minimum bare-logger API class vs BARE_OS_BARE_LOGGER_VERSION"
+    },
+    "denyAutobaseDiscoveryChannels": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "requireBareTlsMin": {
+      "type": "string",
+      "description": "Minimum bare-tls semver vs BARE_OS_BARE_TLS_VERSION"
+    },
+    "extensionSignerPinsV3": {
+      "type": "object",
+      "additionalProperties": { "type": "string" }
+    },
+    "offlineLkgRequirePearStamp": {
+      "type": "boolean",
+      "description": "When true, sets BARE_OS_OFFLINE_LKG_REQUIRE_PEAR_STAMP=1 for host/offline stamp class hints"
+    },
+    "bootPhasesRequireLifecycleMinSchema": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "When > 0, fail strict boot when BARE_OS_LIFECYCLE_SCHEMA_VERSION < this value; **0** disables the check"
+    },
     "requirePearRuntimeRange": {
       "type": "object",
       "additionalProperties": false,

docs/schemas/otel-bare-os-jsonl.schema.json

@@ -6,7 +6,7 @@
   "required": ["otlSchemaVersion", "resourceLogs"],
   "additionalProperties": true,
   "properties": {
-    "otlSchemaVersion": { "type": "integer", "enum": [4, 5] },
+    "otlSchemaVersion": { "type": "integer", "enum": [4, 5, 6, 7] },
     "scopeMetrics": {
       "type": "array",
       "description": "Optional OTel-style scope metrics sketch (schema v5+)",

handbook/04-the-booter-runtime.md

@@ -34,7 +34,7 @@ Non-TTY mode skips splash noise; automation uses **`BARE_OS_SKIP_REPL=1`**.
 
 After the **system** and **personal** drives exist:
 
-1. Build **`shellEnv`** (guest defaults: `HOME`, `PATH`, `USER`, …, **`BARE_OS_CTX_API_VERSION`**), copying host keys when set — including **`BARE_OS_PIPELINE_*`**, **`BARE_OS_SHELL_STREAMING`**, **`BARE_OS_SHELL_STREAMING_MULT`**, **`BARE_OS_SHELL_CMDSUBST`**, **`BARE_OS_SHELL_CMDSUBST_MAX_BYTES`**, boot and audit toggles (**`BARE_OS_BOOT_PROFILE`**, **`BARE_OS_ONBOOT`**, **`BARE_OS_BOOT_STRICT`**, **`BARE_OS_RC_D_SKIP`**, **`BARE_OS_BOOT_MINIMAL`**, **`BARE_OS_BOOT_SKIP`**, **`BARE_OS_BOOT_TRACE`**, **`BARE_OS_KERNEL_SELFTEST`**, **`BARE_OS_SELFTEST_FORMAT`**, **`BARE_OS_AUDIT`**, **`BARE_OS_AUDIT_JSON`**, **`BARE_OS_AUDIT_REDACT`**, **`BARE_OS_BOOT_ALLOWLIST`**, **`BARE_OS_EXEC_MAX_DEPTH`**, **`BARE_OS_IPC_*`**, **`BARE_OS_IPC_CHANNEL_MAX_BYTES`**, **`BARE_OS_HTTP_ALLOWLIST`**, **`BARE_OS_HTTP_DENYLIST`**, **`BARE_OS_TLS_PIN_SHA256`**, **`BARE_OS_VFS_WATCH`**, **`BARE_OS_VFS_UNION_PREFIXES`**, **`BARE_OS_VFS_UNION_WRITE_DENY`**, **`BARE_OS_VFS_BIN_CACHE`**, **`BARE_OS_IMAGE_DIGEST`**, **`BARE_OS_PEAR_CHANNEL`**, **`BARE_OS_PEAR_RELEASE`**, **`BARE_OS_BARE_MODULES`**, **`BARE_OS_BARE_DRIVE_BUNDLES`**, **`BARE_OS_BOOT_MANIFEST`**, **`BARE_OS_BOOT_MANIFEST_SIGN`**, **`BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`**, **`BARE_OS_BOOT_POLICY`**, **`BARE_OS_SANDBOX_SCRIPT`**, **`BARE_OS_SANDBOX_WORKER`**, **`BARE_OS_INITD_MAX_PARALLEL`**, **`BARE_OS_INITD_JOURNAL_MAX_LINES`**, **`BARE_OS_URANDOM_CRYPTO`**, **`BARE_OS_TELEMETRY_NDJSON`**, **`BARE_OS_SEED_RPC_HANDSHAKE`**, **`BARE_OS_SEED_CAP_STRICT`**, **`BARE_OS_SEED_CAP_FAIL`**, **`BARE_OS_BLIND_BOOTSTRAP_URL`**, **`BARE_OS_BLIND_BOOTSTRAP_JSON`**, **`BARE_OS_MIRROR_READ_KEY`**, **`PEAR_CHANNEL`**, Wave 9 keys (**`BARE_OS_SOCKS_PROXY_MAP_JSON`**, **`BARE_OS_BARE_CRYPTO_VERSION`**, **`BARE_OS_PEAR_IPC_PACKAGE_VERSION`**, **`BARE_OS_PEAR_UPDATER_CHANNEL`**, **`BARE_OS_HAPPY_EYEBALLS_V3_MODE`**, **`BARE_OS_BIN_WORKER_WASM_MS_MAX`**, **`BARE_OS_WAVE9_PROBE_ID`**, optional **`BARE_OS_*_JSON`** for **`/proc/bare_os/`** Wave 9 files) — see [Chapter 7](07-operations-and-development.md), the [environment appendix](../docs/reference/environment-and-posix-appendix.md#14-environment-variables-complete-list), [Kernel extensions](../docs/reference/kernel-extensions.md), and the [context object developer guide](../developer-guide/02-the-context-object.md). Set **`BARE_OS_BOOT_PROFILE_RESOLVED`** from the host override or the first line of **`/etc/bare-os/profile`** on the system drive; assign **`BARE_OS_SESSION_ID`** for **`/run/bare-os/session`**. Seed **`/run/bare-os/boot.json`** fields **`imageDigest`**, **`pearChannel`**, **`pearRelease`**, and accumulate **`booterPhases`** (**`vfs`**, **`ctx`**, **`repl`**, **`initd`**, **`kernel_invoke`**) for observability alongside kernel **`phases`**.
+1. Build **`shellEnv`** (guest defaults: `HOME`, `PATH`, `USER`, …, **`BARE_OS_CTX_API_VERSION`**), copying host keys when set — including **`BARE_OS_PIPELINE_*`**, **`BARE_OS_SHELL_STREAMING`**, **`BARE_OS_SHELL_STREAMING_MULT`**, **`BARE_OS_SHELL_CMDSUBST`**, **`BARE_OS_SHELL_CMDSUBST_MAX_BYTES`**, boot and audit toggles (**`BARE_OS_BOOT_PROFILE`**, **`BARE_OS_ONBOOT`**, **`BARE_OS_BOOT_STRICT`**, **`BARE_OS_RC_D_SKIP`**, **`BARE_OS_BOOT_MINIMAL`**, **`BARE_OS_BOOT_SKIP`**, **`BARE_OS_BOOT_TRACE`**, **`BARE_OS_KERNEL_SELFTEST`**, **`BARE_OS_SELFTEST_FORMAT`**, **`BARE_OS_AUDIT`**, **`BARE_OS_AUDIT_JSON`**, **`BARE_OS_AUDIT_REDACT`**, **`BARE_OS_BOOT_ALLOWLIST`**, **`BARE_OS_EXEC_MAX_DEPTH`**, **`BARE_OS_IPC_*`**, **`BARE_OS_IPC_CHANNEL_MAX_BYTES`**, **`BARE_OS_HTTP_ALLOWLIST`**, **`BARE_OS_HTTP_DENYLIST`**, **`BARE_OS_TLS_PIN_SHA256`**, **`BARE_OS_VFS_WATCH`**, **`BARE_OS_VFS_UNION_PREFIXES`**, **`BARE_OS_VFS_UNION_WRITE_DENY`**, **`BARE_OS_VFS_BIN_CACHE`**, **`BARE_OS_IMAGE_DIGEST`**, **`BARE_OS_PEAR_CHANNEL`**, **`BARE_OS_PEAR_RELEASE`**, **`BARE_OS_BARE_MODULES`**, **`BARE_OS_BARE_DRIVE_BUNDLES`**, **`BARE_OS_BOOT_MANIFEST`**, **`BARE_OS_BOOT_MANIFEST_SIGN`**, **`BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`**, **`BARE_OS_BOOT_POLICY`**, **`BARE_OS_SANDBOX_SCRIPT`**, **`BARE_OS_SANDBOX_WORKER`**, **`BARE_OS_INITD_MAX_PARALLEL`**, **`BARE_OS_INITD_JOURNAL_MAX_LINES`**, **`BARE_OS_URANDOM_CRYPTO`**, **`BARE_OS_TELEMETRY_NDJSON`**, **`BARE_OS_SEED_RPC_HANDSHAKE`**, **`BARE_OS_SEED_CAP_STRICT`**, **`BARE_OS_SEED_CAP_FAIL`**, **`BARE_OS_BLIND_BOOTSTRAP_URL`**, **`BARE_OS_BLIND_BOOTSTRAP_JSON`**, **`BARE_OS_MIRROR_READ_KEY`**, **`PEAR_CHANNEL`**, Wave 9 keys (**`BARE_OS_SOCKS_PROXY_MAP_JSON`**, **`BARE_OS_BARE_CRYPTO_VERSION`**, **`BARE_OS_PEAR_IPC_PACKAGE_VERSION`**, **`BARE_OS_PEAR_UPDATER_CHANNEL`**, **`BARE_OS_HAPPY_EYEBALLS_V3_MODE`**, **`BARE_OS_BIN_WORKER_WASM_MS_MAX`**, **`BARE_OS_WAVE9_PROBE_ID`**, optional **`BARE_OS_*_JSON`** for **`/proc/bare_os/`** Wave 9 files), and Wave 10 keys (**`BARE_OS_WAVE10_PROBE_ID`**, **`BARE_OS_BARE_RPC_PROBE_CLASS`**, **`BARE_OS_MTLS_PROXY_MAP_JSON`**, **`BARE_OS_THREAD_POOL_TELEMETRY_JSON`**, **`BARE_OS_HAPPY_EYEBALLS_V4_MODE`**, **`BARE_OS_BARE_BOOT_VERSION`**, **`BARE_OS_BARE_LOGGER_VERSION`**, **`BARE_OS_BARE_TLS_VERSION`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`**, optional **`BARE_OS_*_JSON`** for Wave 10 **`/proc/bare_os/`** files — see [Chapter 7](07-operations-and-development.md), the [environment appendix](../docs/reference/environment-and-posix-appendix.md#14-environment-variables-complete-list), [Kernel extensions](../docs/reference/kernel-extensions.md), and the [context object developer guide](../developer-guide/02-the-context-object.md). Set **`BARE_OS_BOOT_PROFILE_RESOLVED`** from the host override or the first line of **`/etc/bare-os/profile`** on the system drive; assign **`BARE_OS_SESSION_ID`** for **`/run/bare-os/session`**. Seed **`/run/bare-os/boot.json`** fields **`imageDigest`**, **`pearChannel`**, **`pearRelease`**, and accumulate **`booterPhases`** (**`vfs`**, **`ctx`**, **`repl`**, **`initd`**, **`kernel_invoke`**) for observability alongside kernel **`phases`**.
 2. **`createBareOsIpc({ maxFifoBytes, perChannelMaxBytes?, ipcRpcToken?, enableFanout?, maxJsonRpcLineBytes? })`** — in-memory FIFOs under **`/run/bare-os/ipc/<name>`**; optional per-name byte caps via **`BARE_OS_IPC_CHANNEL_MAX_BYTES`** (JSON map); **`pushJson`/`takeJson`** with optional shared-secret field **`bareOsIpcToken`** when **`BARE_OS_IPC_RPC_TOKEN`** is set; **fan-out** topics **`fanoutPublish`/`fanoutSubscribe`** (disable with **`BARE_OS_IPC_FANOUT=0`**); **`createDuplexBridge(baseName)`** pairs two **`push`/`take`** sides for bidirectional byte streams; **`duplexJsonRoundTrip(side, request)`** sends one JSON object and awaits one JSON reply (bounded); **`stats`** includes fan-out subscriber counts.
 3. **`createVfs(drive, personalDrive, shellEnv, mntRef, vfsOptions?)`** — the two-drive router; optional **`vfsOptions`** supply **`procSnapshot`** (**`/proc/version`**, **`cmdline`**), dynamic text for **`/proc/net/dev`**, **`/proc/diskstats`**, **`/proc/bare_os_quotas`**, **`/proc/bare_os_resources`**, **`/proc/bare_os_features`**, **`/sys/class/net/lo`**, **`bootProfileText`**, **`sessionText`**, **`initdRunText`**, **`bootReadyJsonText`**, **`getVirtualReaders`** for **`/run/bare-os/virtual/<name>`**, etc.
 4. After VFS: **`buildBareCtxObjectFromHost`** + **`maybeMergeBareFromDrive`** fill a **`bareLibrary`** map (host imports first; drive bundles only add **missing** keys). **`/lib/bare/manifest.json`** and **`/lib/bare/bundles/*.js`** are **trusted** like **`/bin`**. See [developer guide ch.12](../developer-guide/12-bare-modules-and-pear-ecosystem.md).
@@ -76,7 +76,7 @@ Catalog detail: [Chapter 9](09-posix-utilities-shell-and-vfs.md).
 
 These paths are **synthetic** (not stored on either Hyperdrive). They exist for inspection and scripting ergonomics, **not** Linux ABI compatibility. In **blog terms**: **`/proc`** is “what is this session doing?”; **`/sys`** is “tiny sysfs-shaped stubs”; **`/run`** is “volatile session state the booter owns”; **`/dev`** is “just enough device names that scripts stop crashing”; session **`/tmp`** is “scratch space that never lands on the read-only system drive.”
 
-- **`/proc`**: **`version`**, **`bare_os_version`**, **`uptime`**, **`meminfo`**, **`cpuinfo`**, **`loadavg`**, **`mounts`**, **`diskstats`** (stub text), **`bare_os_quotas`** (JSON: pipeline limits, exec-depth cap, IPC cap, session stats, FIFO **`stats`**), **`bare_os_resources`**, **`bare_os_features`** (includes **`bits2`** / **`bits3`** / **`bits4`** / **`bits5`**, optional **`seedHandshake`** summary after **`bare_os.capabilities`** RPC when enabled), **`bare_os_swarm`** (bounded P2P / session snapshot when the host provides it), **`bare_os_replication`** (JSON hints: version, peers, last error; may embed **`manifestHints`**, **`peerHealth`**, **`stagingSlot`**, **`seedSnapshotHints`**, **`seedPeerFirewallStats`**, **`seedReplication`**, **`mbrKeysHex`** from seed RPCs), **`bare_os_manifest_hints`**, **`bare_os_peer_health`**, **`bare_os_staging_slot`**, **`bare_os_snapshot_hints`**, **`bare_os_provenance`** (digest / signing / Pear channel summary), **`bare_os_pear_ipc_registry`** (well-known Pear IPC channel names), **`bare_os_pear_trust`** (operator JSON from **`BARE_OS_PEAR_TRUST_JSON`**), **`bare_os_initd_dag`** / **`bare_os_initd_graph`** (initd dependency graph JSON; graph may include a **`dot`** string), **`bare_os_rlimits`** (getrlimit-shaped mirror of runtime caps), **`bare_os_hdms_health`** (non-secret mount/registry summary), **`bare_os_metrics_live`** (coalesced quotas/resources snapshot; interval **`BARE_OS_PROC_POLL_MS`**; schema **2** adds delegate inflight / rate-bucket samples), **`bare_os_net_summary`** (operator rollup of swarm topic, peer count, seed RPC hints; optional **`transport`** from **`BARE_OS_NET_TRANSPORT_STATS_JSON`**), **`bare_os_host_os.json`** (Holepunch **`bare-os`** or injected JSON), **`bare_os_sync_window.json`** (**`BARE_OS_REPLICATION_SYNC_WINDOWS`** UTC windows), **`bare_os_debug.json`** when **`BARE_OS_KERNEL_DEBUG=1`** (non-secret masks), **`bare_os_extensions.json`** / **`bare_os_hdms_hints.json`** (kernel extension registry + HDMS/autopass hints), **`bare_os_capabilities`** (human-readable dump of **`ctx.bareOsRuntimeCaps`**; **`bare_os_capabilities.json`** or **`Accept: application/json`** for machine output), **`bare_os_bootstrap`**, **`bare_os_union`** (JSON: union read prefixes + **`BARE_OS_VFS_UNION_WRITE_DENY`**), **`bare_os_seed_handshake`** (raw handshake / error object), **`bare_os_virtual_registry`** (registered virtual file metadata), **`/proc/bare_os/`** (stable names + **`index.json`** mirroring the flat **`bare_os_*`** aliases), **`net/dev`** (P2P-oriented stub), **`net/tcp`**, **`net/udp`** (header-only stubs), **`self/`** with **`environ`**, **`cmdline`**, **`cgroups`**, **`exe`**, **`fd/0`–`2`** (stub targets), plus **`bare_os_session_stats`**. **`environ`** omits keys whose names look secret-bearing (e.g. **`PASSWORD`**, **`TOKEN`**, **`VAULT`**) and only includes a small public set plus **`BARE_OS_*`** (including **`BARE_OS_SESSION_ID`**).
+- **`/proc`**: **`version`**, **`bare_os_version`**, **`uptime`**, **`meminfo`**, **`cpuinfo`**, **`loadavg`**, **`mounts`**, **`diskstats`** (stub text), **`bare_os_quotas`** (JSON: pipeline limits, exec-depth cap, IPC cap, session stats, FIFO **`stats`**), **`bare_os_resources`**, **`bare_os_features`** (includes advertised stock words **`bits2`** … **`bits10`** when non-zero, optional **`seedHandshake`** summary after **`bare_os.capabilities`** RPC when enabled), **`bare_os_swarm`** (bounded P2P / session snapshot when the host provides it), **`bare_os_replication`** (JSON hints: version, peers, last error; may embed **`manifestHints`**, **`peerHealth`**, **`stagingSlot`**, **`seedSnapshotHints`**, **`seedPeerFirewallStats`**, **`seedReplication`**, **`mbrKeysHex`** from seed RPCs), **`bare_os_manifest_hints`**, **`bare_os_peer_health`**, **`bare_os_staging_slot`**, **`bare_os_snapshot_hints`**, **`bare_os_provenance`** (digest / signing / Pear channel summary), **`bare_os_pear_ipc_registry`** (well-known Pear IPC channel names), **`bare_os_pear_trust`** (operator JSON from **`BARE_OS_PEAR_TRUST_JSON`**), **`bare_os_initd_dag`** / **`bare_os_initd_graph`** (initd dependency graph JSON; graph may include a **`dot`** string), **`bare_os_rlimits`** (getrlimit-shaped mirror of runtime caps), **`bare_os_hdms_health`** (non-secret mount/registry summary), **`bare_os_metrics_live`** (coalesced quotas/resources snapshot; interval **`BARE_OS_PROC_POLL_MS`**; schema **2** adds delegate inflight / rate-bucket samples), **`bare_os_net_summary`** (operator rollup of swarm topic, peer count, seed RPC hints; optional **`transport`** from **`BARE_OS_NET_TRANSPORT_STATS_JSON`**), **`bare_os_host_os.json`** (Holepunch **`bare-os`** or injected JSON), **`bare_os_sync_window.json`** (**`BARE_OS_REPLICATION_SYNC_WINDOWS`** UTC windows), **`bare_os_debug.json`** when **`BARE_OS_KERNEL_DEBUG=1`** (non-secret masks), **`bare_os_extensions.json`** / **`bare_os_hdms_hints.json`** (kernel extension registry + HDMS/autopass hints), **`bare_os_capabilities`** (human-readable dump of **`ctx.bareOsRuntimeCaps`**; **`bare_os_capabilities.json`** or **`Accept: application/json`** for machine output), **`bare_os_bootstrap`**, **`bare_os_union`** (JSON: union read prefixes + **`BARE_OS_VFS_UNION_WRITE_DENY`**), **`bare_os_seed_handshake`** (raw handshake / error object), **`bare_os_virtual_registry`** (registered virtual file metadata), **`/proc/bare_os/`** (stable names + **`index.json`** mirroring the flat **`bare_os_*`** aliases), **`net/dev`** (P2P-oriented stub), **`net/tcp`**, **`net/udp`** (header-only stubs), **`self/`** with **`environ`**, **`cmdline`**, **`cgroups`**, **`exe`**, **`fd/0`–`2`** (stub targets), plus **`bare_os_session_stats`**. **`environ`** omits keys whose names look secret-bearing (e.g. **`PASSWORD`**, **`TOKEN`**, **`VAULT`**) and only includes a small public set plus **`BARE_OS_*`** (including **`BARE_OS_SESSION_ID`**).
 - **`/sys`**: **`fs/bare_os/version`**, **`fs/bare_os/build_id`**, **`class/net/lo`** (stub **`operstate`** / **`carrier`**), **`devices/virtual/`** (placeholder tree for script portability).
 - **`/sys/fs/bare_os/version`**: same text as **`/proc/version`**.
 - **`/run/bare-os/units`**: tab-separated snapshot of **bare-initd** registered units (phase, start time, description).

handbook/06-kernel-and-binaries.md

@@ -63,7 +63,7 @@ The **prompt** (`[user@host:path] > `) is applied by the booter’s readline lay
 | **`BARE_OS_BOOT_MANIFEST`**                                              | When **`1`** / **`true`**, the stock kernel verifies **`/etc/bare-os/boot.manifest.json`** against an expected SHA-256 (see kernel **`init.js`** and **`ctx.bareOsBootFileSha256Hex`**). Example layout: [`kernel/etc/bare-os/boot.manifest.example.json`](../kernel/etc/bare-os/boot.manifest.example.json).                                                                                                                                                                                                                                                                                                       |
 | **`BARE_OS_BOOT_MANIFEST_SIGN`**, **`BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`** | Optional **Ed25519** over the **raw manifest bytes**: expects **`/etc/bare-os/boot.manifest.sig`** and **`ctx.bareOsVerifyBootManifestSignature`** (host/booter). Mismatch fails boot with a clear stderr line.                                                                                                                                                                                                                                                                                                                                                                                                     |
 | **`ctx.bareOsRegisterBootPhaseHook` / `bareOsInvokeBootPhaseHooks`**     | Kernel extensions can observe **`before:` / `after:`** stock phases (e.g. **`rc`**, **`repl`**) without replacing **`init.js`**. See [developer guide §2](../developer-guide/02-the-context-object.md).                                                                                                                                                                                                                                                                                                                                                                                                             |
-| **`BARE_OS_BOOT_POLICY`**, **`/etc/bare-os/boot.policy.json`**           | When enabled, merges **`skipPhases`**, **`denyBootPhases`**, optional **`minKernelFeatureMask`** / **`requireSeedCaps`**, v2 **`maxExecLineDepth`** / **`denyEnvKeys`** / **`requireProcNodes`**, v3 **`requireFeatureBits2`** / **`requireFeatureBits3`**, **`allowedPearIpcChannels`**, **`denyVfsPrefixes`**, **`maxInitdRestartsPerUnit`**, v4 **`requireFeatureBits4`**, **`denyExecLineBuiltins`**, **`allowedCtxMethods`**, later **`requireFeatureBits5`** … **`requireFeatureBits9`**, and v9 **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`** (see **[`kernel/etc/bare-os/boot.policy.example.json`](../kernel/etc/bare-os/boot.policy.example.json)** and **[`docs/schemas/boot.policy.schema.json`](../docs/schemas/boot.policy.schema.json)**). **`BARE_OS_BOOT_POLICY_STRICT`** aborts when a check fails. |
+| **`BARE_OS_BOOT_POLICY`**, **`/etc/bare-os/boot.policy.json`**           | When enabled, merges **`skipPhases`**, **`denyBootPhases`**, optional **`minKernelFeatureMask`** / **`requireSeedCaps`**, v2 **`maxExecLineDepth`** / **`denyEnvKeys`** / **`requireProcNodes`**, v3 **`requireFeatureBits2`** / **`requireFeatureBits3`**, **`allowedPearIpcChannels`**, **`denyVfsPrefixes`**, **`maxInitdRestartsPerUnit`**, v4 **`requireFeatureBits4`**, **`denyExecLineBuiltins`**, **`allowedCtxMethods`**, later **`requireFeatureBits5`** … **`requireFeatureBits10`**, and v9 **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`**, plus v10 **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`maxPearInspectDepth`**, **`requireBareLoggerMin`**, **`denyAutobaseDiscoveryChannels`**, **`requireBareTlsMin`**, **`extensionSignerPinsV3`**, **`offlineLkgRequirePearStamp`**, **`bootPhasesRequireLifecycleMinSchema`** (see **[`kernel/etc/bare-os/boot.policy.example.json`](../kernel/etc/bare-os/boot.policy.example.json)** and **[`docs/schemas/boot.policy.schema.json`](../docs/schemas/boot.policy.schema.json)**). **`BARE_OS_BOOT_POLICY_STRICT`** aborts when a check fails. |
 | **`/etc/bare-os/selftest.d/`**                                           | Optional digit-prefixed **`*.sh`** snippets run after the main boot path when **`BARE_OS_KERNEL_SELFTEST`** is enabled (same **`execLine`** rules as other boot snippets). Pair with **`BARE_OS_SELFTEST_FORMAT=tap`** for CI-friendly stderr.                                                                                                                                                                                                                                                                                                                                                                      |
 
 ### Custom `init.js` contract

handbook/09-posix-utilities-shell-and-vfs.md

@@ -24,7 +24,7 @@ We borrow **names and muscle memory** from POSIX because that makes scripts port
 | **Processes, `fork`, pipes as OS primitives**  | Pipelines are simulated by capturing **`console.log`** (and merged **`console.error`** when **`2>&1`** is used) into the next command.                                                                                                                                                                                                                                                                                                                               |
 | **`chown` / `chgrp` / real UIDs across users** | Single-session identity; metadata carries **uid/gid** for display and checks.                                                                                                                                                                                                                                                                                                                                                                                        |
 | **FIFOs, `mknod`, real devices**               | No kernel FIFOs or **`mknod`**; **`mkfifo`** creates **in-memory** channels under **`/run/bare-os/ipc/<name>`** (see **`bare-os-ipc.js`**).                                                                                                                                                                                                                                                                                                                          |
-| **`xargs`** full POSIX/GNU surface             | Bounded implementation: **`ctx.runBinCommand`** only; **`-0`**, **`-n`** (and **`-nN`**); stdin/token/invocation caps (see **`src/xargs.js`**).                                                                                                                                                                                                                                                                                                                      |
+| **`xargs`** full POSIX/GNU surface             | Bounded implementation: **`ctx.runBinCommand`** only; **`-0`**, **`-n`** (and **`-nN`**), optional **`-P`** parallelism **capped** at **4** (sequential when **`0`**); stdin/token/invocation caps (see **`src/xargs.js`**).                                                                                                                                                                                                                                                                                                                      |
 | **`getconf` / live `sysconf`**                 | Fixed name table + **`-a`**; values are Bare constants, not host kernel queries (see **`src/getconf.js`**).                                                                                                                                                                                                                                                                                                                                                          |
 | **Byte-identical `sed` / `awk` / `grep`**      | JavaScript engines; regex and edge cases differ from GNU or strict POSIX.                                                                                                                                                                                                                                                                                                                                                                                            |
 
@@ -51,7 +51,7 @@ Hyperdrive does not always behave like a POSIX directory tree. Empty directories
 
 ### 2.3 Pseudo **`/proc`**, **`/sys`**, **`/run`**, **`/dev`**, and session **`/tmp`**
 
-- **`/proc`**, **`/sys`**, **`/run`**, **`/dev`** — read-only synthetic trees except **`/dev/null`** and **`/dev/zero`** accept writes that are discarded (see [Chapter 4](04-the-booter-runtime.md)). Other pseudo **`writeFile`** / **`unlink`** / **`chmod`** paths fail as documented there. Extra Linux-shaped stubs include **`/proc/cpuinfo`**, **`/proc/meminfo`**, **`/proc/loadavg`**, **`/proc/net/dev`**, **`/proc/net/tcp`**, **`/proc/net/udp`**, **`/proc/diskstats`**, **`/proc/bare_os/`** (stable aliases + **`index.json`** schema **5** in Wave 9, listing Pear/Bare operator JSON such as **`pear_stage_pointer.json`**, **`bare_module_resolution.json`**, …), **`/proc/bare_os_quotas`**, **`/proc/bare_os_resources`**, **`/proc/bare_os_features`**, **`/proc/bare_os_session_stats`**, **`/proc/bare_os_swarm`**, **`/proc/bare_os_replication`**, **`/proc/bare_os_manifest_hints`**, **`/proc/bare_os_peer_health`**, **`/proc/bare_os_staging_slot`**, **`/proc/bare_os_snapshot_hints`**, **`/proc/bare_os_provenance`**, **`/proc/bare_os_pear_ipc_registry`**, **`/proc/bare_os_initd_dag`**, **`/proc/bare_os_initd_graph`**, **`/proc/bare_os_pear_trust`**, **`/proc/bare_os_rlimits`**, **`/proc/bare_os_hdms_health`**, **`/proc/bare_os_metrics_live`** (and **`/proc/bare_os/metrics_live.json`**), **`/proc/bare_os_extensions.json`**, **`/proc/bare_os_hdms_hints.json`**, **`/proc/bare_os_capabilities`** (and **`/proc/bare_os_capabilities.json`**), **`/proc/bare_os_bootstrap`**, **`/proc/bare_os_union`**, **`/proc/bare_os_seed_handshake`**, **`/proc/bare_os_virtual_registry`**, **`/proc/self/cgroups`**, **`/proc/self/exe`**, **`/proc/self/fd/0`–`2`**, **`/sys/class/net/lo`**, **`/sys/devices/virtual`**, **`/sys/fs/bare_os/build_id`**, **`/run/bare-os/virtual/*`**, **`/run/bare-os/unit-journal/*.ndjson`**, and **`/dev/urandom`** (each **`readFile`** of urandom returns a **bounded** buffer; **not** suitable for cryptography unless **`BARE_OS_URANDOM_CRYPTO`** is left at default). Optional union write denials use **`BARE_OS_VFS_UNION_WRITE_DENY`** (see [kernel extensions](../docs/reference/kernel-extensions.md)). With **`BARE_OS_VFS_WATCH_PSEUDO=1`**, **`vfs.watch`** may poll coalesced **`metrics_live`**. With **`BARE_OS_VFS_WATCH_SWARM=1`**, **`vfs.watch`** may poll coalesced **`swarm`** / **`replication`** pseudo files. Use **`ctx.bareOsReadProcMetricsLive()`** for the same JSON as **`metrics_live`** without a VFS read. **`/bin/env`** supports **`-S`** / **`--env-file`** when **`BARE_OS_ENV_DASH_S=1`**. Shell **`${…}`** v2 (**`##`**, **`%%`**, **`:=`**, basename **`*/`**) requires **`BARE_OS_SHELL_PARAM_EXPANSION_V2=1`** with param expansion enabled. Gated **`local`** / read-only **`declare -r`** use **`BARE_OS_SHELL_LOCAL_DECLARE=1`**.
+- **`/proc`**, **`/sys`**, **`/run`**, **`/dev`** — read-only synthetic trees except **`/dev/null`** and **`/dev/zero`** accept writes that are discarded (see [Chapter 4](04-the-booter-runtime.md)). Other pseudo **`writeFile`** / **`unlink`** / **`chmod`** paths fail as documented there. Extra Linux-shaped stubs include **`/proc/cpuinfo`**, **`/proc/meminfo`**, **`/proc/loadavg`**, **`/proc/net/dev`**, **`/proc/net/tcp`**, **`/proc/net/udp`**, **`/proc/diskstats`**, **`/proc/bare_os/`** (stable aliases + **`index.json`** schema **6** in Wave 10, listing Pear/Bare operator JSON from Waves 6–10 such as **`pear_stage_pointer.json`**, **`bare_module_resolution.json`**, **`pear_doctor_state.json`**, **`bare_boot_phase_map.json`**, …), **`/proc/bare_os_quotas`**, **`/proc/bare_os_resources`**, **`/proc/bare_os_features`**, **`/proc/bare_os_session_stats`**, **`/proc/bare_os_swarm`**, **`/proc/bare_os_replication`**, **`/proc/bare_os_manifest_hints`**, **`/proc/bare_os_peer_health`**, **`/proc/bare_os_staging_slot`**, **`/proc/bare_os_snapshot_hints`**, **`/proc/bare_os_provenance`**, **`/proc/bare_os_pear_ipc_registry`**, **`/proc/bare_os_initd_dag`**, **`/proc/bare_os_initd_graph`**, **`/proc/bare_os_pear_trust`**, **`/proc/bare_os_rlimits`**, **`/proc/bare_os_hdms_health`**, **`/proc/bare_os_metrics_live`** (and **`/proc/bare_os/metrics_live.json`**), **`/proc/bare_os_extensions.json`**, **`/proc/bare_os_hdms_hints.json`**, **`/proc/bare_os_capabilities`** (and **`/proc/bare_os_capabilities.json`**), **`/proc/bare_os_bootstrap`**, **`/proc/bare_os_union`**, **`/proc/bare_os_seed_handshake`**, **`/proc/bare_os_virtual_registry`**, **`/proc/self/cgroups`**, **`/proc/self/exe`**, **`/proc/self/fd/0`–`2`**, **`/sys/class/net/lo`**, **`/sys/devices/virtual`**, **`/sys/fs/bare_os/build_id`**, **`/run/bare-os/virtual/*`**, **`/run/bare-os/unit-journal/*.ndjson`**, and **`/dev/urandom`** (each **`readFile`** of urandom returns a **bounded** buffer; **not** suitable for cryptography unless **`BARE_OS_URANDOM_CRYPTO`** is left at default). Optional union write denials use **`BARE_OS_VFS_UNION_WRITE_DENY`** (see [kernel extensions](../docs/reference/kernel-extensions.md)). With **`BARE_OS_VFS_WATCH_PSEUDO=1`**, **`vfs.watch`** may poll coalesced **`metrics_live`**. With **`BARE_OS_VFS_WATCH_SWARM=1`**, **`vfs.watch`** may poll coalesced **`swarm`** / **`replication`** pseudo files. Use **`ctx.bareOsReadProcMetricsLive()`** for the same JSON as **`metrics_live`** without a VFS read. **`/bin/env`** supports **`-S`** / **`--env-file`** when **`BARE_OS_ENV_DASH_S=1`**. Shell **`${…}`** v2 (**`##`**, **`%%`**, **`:=`**, basename **`*/`**) requires **`BARE_OS_SHELL_PARAM_EXPANSION_V2=1`** with param expansion enabled. Gated **`local`** / read-only **`declare -r`** use **`BARE_OS_SHELL_LOCAL_DECLARE=1`**.
 - **`/tmp`** — writable on the **personal** drive under **`/.bare-os/tmp/<HOME-basename>/…`**, isolated like **`$HOME`** and **`/var/log`**.
 
 ### 2.4 `chmod` (octal and symbolic)

handbook/11-kernel-roadmap-and-research.md

@@ -26,7 +26,7 @@ Nothing in that tree *is* the Bare OS kernel: our **kernel** remains **`/boot/in
 
 ## Feature waves (protocol)
 
-Capability words **`bits`** … **`bits9`** (see [`packages/bare-os-protocol`](../packages/bare-os-protocol/README.md)) advertise what the stock booter and seeder implement. **`BARE_OS_SEED_CAP_STRICT`** requires the seeder to cover every non-zero stock word. Wave 6–9 status: [`docs/reference/feature-roadmap.md`](../docs/reference/feature-roadmap.md). Governance: [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../developer-guide/adr/001-kernel-feature-bits-governance.md). **Wave 9** adds Holepunch **`bare-*` / `pear-*`**-aligned seed RPCs, `/proc` JSON, boot policy v9, and the Node→Bare module map in [`developer-guide/node-to-bare-modules.md`](../developer-guide/node-to-bare-modules.md).
+Capability words **`bits`** … **`bits10`** (see [`packages/bare-os-protocol`](../packages/bare-os-protocol/README.md)) advertise what the stock booter and seeder implement. **`BARE_OS_SEED_CAP_STRICT`** requires the seeder to cover every non-zero stock word. Wave 6–10 status: [`docs/reference/feature-roadmap.md`](../docs/reference/feature-roadmap.md). Governance: [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../developer-guide/adr/001-kernel-feature-bits-governance.md). **Wave 10** extends Pear/Bare–aligned seed RPCs, Wave 10 **`/proc`** JSON, boot policy v10, extension registry schema **7**, telemetry schema **9** / OTel **7** / audit **7**, and the Node→Bare module map in [`developer-guide/node-to-bare-modules.md`](../developer-guide/node-to-bare-modules.md).
 
 ---
 

kernel/README.md

@@ -19,7 +19,7 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 ## Contents
 
 - **`init.js`** — Kernel entry: must define `async function start(ctx)`. Boot order: **`/etc/os-release`** → **`/etc/motd`** → optional **`/etc/bare-os/rc.profile.<profile>`** (profile from **`BARE_OS_BOOT_PROFILE`** or first line of **`/etc/bare-os/profile`**; the booter mirrors the resolved name in **`ctx.env.BARE_OS_BOOT_PROFILE_RESOLVED`** and **`/run/bare-os/boot_profile`**) → **`/etc/bare-os/rc`** → **`/etc/bare-os/rc.d/*`** (sorted; digit-prefixed names only; skip dotfiles, `*~`, `README*`, `*.md`; optional **`BARE_OS_RC_D_SKIP`** comma list and **`prefix*`** patterns) → optional **`/etc/bare-os/rc.local`** → **`/etc/bare-os/kernel.d/*`** (same rules as **`rc.d`**) → banner → when **`BARE_OS_SKIP_REPL`**, optional **onboot** lines from **`BARE_OS_ONBOOT`** or **`/etc/bare-os/onboot`** → **`readLine` / `execLine`** loop. Boot **`execLine`** errors in trusted snippets are logged; with **`BARE_OS_BOOT_STRICT=1`** or **`true`**, the first throw calls **`requestBooterExit(1)`** and stops later boot phases. Custom kernels may call **`ctx.registerKernelShutdownHook(fn)`** before initd disposers; use **`ctx.bareOsRuntimeCaps`** for limits, pseudo paths, and **`features`** ([`developer-guide/02-the-context-object.md`](../developer-guide/02-the-context-object.md)).
-- **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md) (**~113** commands; list in **`packages/bare-os-coreutils/lib/commands.mjs`**). Each file is **`runtime.js`** + optional preamble (**`lib/md5.js`** for **`md5sum`**, **`lib/*-engine.js`** for **`sed`**/**`awk`**, **`jq-engine.js`**, **`lib/man-render.js`**, **`lib/edit-*.js`** for **`edit`**/**`nano`**, lscolors for **`ls`**/**`dircolors`**, …) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**). **`/bin/nano`** duplicates **`/bin/edit`** for familiarity; the shell’s default **`nano` → `edit`** alias uses the **`edit`** command name after expansion. **`dir`**/**`vdir`** invoke **`ls`** via **`ctx.runBinCommand`**.
+- **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md) (**~115** commands; list in **`packages/bare-os-coreutils/lib/commands.mjs`**). Each file is **`runtime.js`** + optional preamble (**`lib/md5.js`** for **`md5sum`**, **`lib/*-engine.js`** for **`sed`**/**`awk`**, **`jq-engine.js`**, **`lib/man-render.js`**, **`lib/edit-*.js`** for **`edit`**/**`nano`**, lscolors for **`ls`**/**`dircolors`**, …) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**). **`/bin/nano`** duplicates **`/bin/edit`** for familiarity; the shell’s default **`nano` → `edit`** alias uses the **`edit`** command name after expansion. **`dir`**/**`vdir`** invoke **`ls`** via **`ctx.runBinCommand`**.
 - **`lib/bare/`** — Optional IIFE bundles + **`manifest.json`** for **`ctx.bare`** drive merge, built by [bare-os-bare-libs](../packages/bare-os-bare-libs/README.md). Same trust model as **`bin/`** (trusted seeded image).
 - **`share/man/man.json`** — Merged manual database for **`/bin/man`** (built by **`bare-os-coreutils`**; see [handbook ch.10](../handbook/10-manpages-and-online-help.md)).
 - **`etc/os-release`** — Static OS metadata (`NAME`, `VERSION`, …).
@@ -37,7 +37,7 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 
 Pear bundles use the **vendored** tree under `packages/bare-os-seeder/kernel/`; keep it in sync by running the same builds before `pear stage`. **`npm test`** runs **`scripts/verify-kernel-seeder-parity.mjs`**, **`scripts/verify-ctx-api-feature-bits.mjs`**, and **`scripts/validate-example-schemas.mjs`** (after **`bare-os-coreutils`** and **`bare-os-bare-libs`** builds) so the two trees match byte-for-byte, ctx semver / feature words stay wired, example JSON matches **[`docs/schemas/`](../docs/schemas/)**, and every **`kernel/bin/*`** file contains the **`BARE_OS_BIN_API`** pragma (coreutils **`runtime.js`** and hand-written stubs such as **`systemctl`** / **`journalctl`**).
 
-Optional **system** image examples: **`etc/bare-os/boot.allow.example`** (copy to **`boot.allow`** when using host **`BARE_OS_BOOT_ALLOWLIST=1`**), **`etc/bare-os/boot.policy.example.json`** (install as **`boot.policy.json`** when using **`BARE_OS_BOOT_POLICY=1`**; v2 fields **`maxExecLineDepth`**, **`denyEnvKeys`**, **`requireProcNodes`**; v3 **`requireFeatureBits2`**, **`requireFeatureBits3`**, **`allowedPearIpcChannels`**, **`denyVfsPrefixes`**, **`maxInitdRestartsPerUnit`**; v4 **`requireFeatureBits4`**, **`denyExecLineBuiltins`**, **`allowedCtxMethods`**; v9 **`requireFeatureBits9`**, **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`**; JSON Schema: [`docs/schemas/boot.policy.schema.json`](../docs/schemas/boot.policy.schema.json)), **`etc/bare-os/kernel.extensions.registry.example.json`** (shape for **`/proc/bare_os/extensions.json`** schema 6), **`etc/bare-os/boot-trace-line.example.json`** and **`etc/bare-os/telemetry-ndjson.example.json`** (shape checks for CI), **`etc/bare-os/rc.profile.full`** (sample full profile referenced from **`profile`**), **`etc/bare-os/crontab.example`** (system-wide cron lines merged ahead of user **`~/.crontab`**), **`etc/bare-os/timers/*.timer.example`** (copy to **`~/.config/bare-os/timers/*.timer`** for **`OnCalendar=`**, **`EveryMs=`**, or **`OnInactiveSec=`** jobs). **`kernel.ext.d`** scripts register into **`/proc/bare_os/extensions.json`** when the booter provides **`ctx.bareOsRegisterKernelExtensionRecord`**.
+Optional **system** image examples: **`etc/bare-os/boot.allow.example`** (copy to **`boot.allow`** when using host **`BARE_OS_BOOT_ALLOWLIST=1`**), **`etc/bare-os/boot.policy.example.json`** (install as **`boot.policy.json`** when using **`BARE_OS_BOOT_POLICY=1`**; v2 fields **`maxExecLineDepth`**, **`denyEnvKeys`**, **`requireProcNodes`**; v3 **`requireFeatureBits2`**, **`requireFeatureBits3`**, **`allowedPearIpcChannels`**, **`denyVfsPrefixes`**, **`maxInitdRestartsPerUnit`**; v4 **`requireFeatureBits4`**, **`denyExecLineBuiltins`**, **`allowedCtxMethods`**; v9 **`requireFeatureBits9`**, **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`**; v10 **`requireFeatureBits10`**, **`requireBareBootMin`**, **`bootPhasesRequireLifecycleMinSchema`**, **`extensionSignerPinsV3`**, …; JSON Schema: [`docs/schemas/boot.policy.schema.json`](../docs/schemas/boot.policy.schema.json)), **`etc/bare-os/kernel.extensions.registry.example.json`** (shape for **`/proc/bare_os/extensions.json`** schema 7), **`etc/bare-os/boot-trace-line.example.json`** and **`etc/bare-os/telemetry-ndjson.example.json`** (shape checks for CI), **`etc/bare-os/rc.profile.full`** (sample full profile referenced from **`profile`**), **`etc/bare-os/crontab.example`** (system-wide cron lines merged ahead of user **`~/.crontab`**), **`etc/bare-os/timers/*.timer.example`** (copy to **`~/.config/bare-os/timers/*.timer`** for **`OnCalendar=`**, **`EveryMs=`**, or **`OnInactiveSec=`** jobs). **`kernel.ext.d`** scripts register into **`/proc/bare_os/extensions.json`** when the booter provides **`ctx.bareOsRegisterKernelExtensionRecord`**.
 
 ## See also
 

kernel/bin/help

@@ -87,7 +87,7 @@ function bareOsEmitRaw(ctx, chunk) {
   return false
 }
 
-var BARE_OS_HELP_BIN_SPACED = "arch awk base32 base64 basename basenc cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split stat sum sync systemctl tac tail tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
+var BARE_OS_HELP_BIN_SPACED = "arch awk base32 base64 basename basenc cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split ssh-keygen stat sum sync systemctl tac tail tar tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
 async function run(ctx, argv) {
   ctx.console.log(
     'Bare OS — default user: guest | shell builtins: alias, barerc, cd, command, export, exit, login, logout, readonly, type, umask, unalias, unset, : | /bin: ' +

kernel/bin/ssh-keygen

@@ -0,0 +1,110 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+/**
+ * Non-crypto stub: Pear/Bare guests must not use Node `node:crypto` for keys.
+ * Operators use host **`bare-crypto`** / Pear tooling; see developer-guide Node→Bare map.
+ */
+async function run(ctx, argv) {
+  const args = argv.slice(1)
+  if (args.includes('-h') || args.includes('--help') || args.includes('-?')) {
+    ctx.console.log(
+      'Usage: ssh-keygen (stub)\n' +
+        'Bare OS does not generate SSH keys in-guest. Use bare-crypto / Pear host workflows.\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  ctx.console.error(
+    'ssh-keygen: Bare OS stub only — use bare-crypto and host key tooling (no node:crypto in guest).'
+  )
+  ctx.exitCode = 1
+}
+
+export { run }

kernel/bin/tar

@@ -0,0 +1,125 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+/**
+ * Wave 10: bounded extended-attribute metadata sketch only (no archive I/O).
+ * Full archive workflows use Pear pack / bare-pack tooling outside the stub.
+ */
+async function run(ctx, argv) {
+  const args = argv.slice(1)
+  if (
+    args.includes('--bare-os-wave10-xattr-sketch') ||
+    args.includes('--bare-os-xattr-sketch')
+  ) {
+    ctx.console.log(
+      JSON.stringify({
+        schema: 1,
+        note: 'tar xattr subset stub; no archive bytes read in stock coreutils',
+        entries: [],
+        atMs: Date.now()
+      }) + '\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  if (args.includes('-h') || args.includes('--help')) {
+    ctx.console.log(
+      'Usage: tar [--bare-os-wave10-xattr-sketch]\n' +
+        'Bare OS tar is a documentation stub; use Pear/bare-pack for bundles.\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  ctx.console.error(
+    'tar: Bare OS stub — pass --bare-os-wave10-xattr-sketch for JSON sketch or use host pack tools.'
+  )
+  ctx.exitCode = 1
+}
+
+export { run }

kernel/bin/xargs

@@ -92,12 +92,14 @@ function bareOsEmitRaw(ctx, chunk) {
  * Limits: stdin 256KiB, 4096 whitespace/null tokens, 128 args per invocation,
  * 64 invocations per run. Exceeding limits is a fatal error (exit 125).
  * Supports -0/--null, -n, -I repl (replace repl in utility argv; implies -n 1 unless -n given).
+ * -P N is accepted; stock booter runs sequentially; N is capped at MAX_P_FLAG (4).
  */
 
 const MAX_STDIN = 256 * 1024
 const MAX_TOKENS = 4096
 const MAX_PER_INVOCATION = 128
 const MAX_INVOCATIONS = 64
+const MAX_P_FLAG = 4
 
 async function run(ctx, argv) {
   if (typeof ctx.runBinCommand !== 'function') {
@@ -113,6 +115,7 @@ async function run(ctx, argv) {
   /** @type {string | null} */
   let repl = null
   let nExplicit = false
+  let pCap = 1
   let i = 0
 
   while (i < args.length && args[i].startsWith('-')) {
@@ -126,6 +129,40 @@ async function run(ctx, argv) {
       i++
       continue
     }
+    if (a === '-P' || a === '--max-procs') {
+      const n = args[i + 1]
+      if (n == null || !/^\d+$/.test(n)) {
+        ctx.console.error('xargs: -P requires a non-negative integer')
+        ctx.exitCode = 1
+        return
+      }
+      const raw = Number(n)
+      pCap = Math.min(MAX_P_FLAG, Math.max(1, raw))
+      if (raw > MAX_P_FLAG) {
+        ctx.console.error(
+          'xargs: -P ' +
+            raw +
+            ' exceeds Bare OS cap ' +
+            MAX_P_FLAG +
+            ' (parallelism hint only; sequential execution)'
+        )
+      }
+      i += 2
+      continue
+    }
+    if (a.startsWith('-P') && a.length > 2 && /^\d+$/.test(a.slice(2))) {
+      const raw = Number(a.slice(2))
+      pCap = Math.min(MAX_P_FLAG, Math.max(1, raw))
+      if (raw > MAX_P_FLAG) {
+        ctx.console.error(
+          'xargs: -P exceeds Bare OS cap ' +
+            MAX_P_FLAG +
+            ' (parallelism hint only; sequential execution)'
+        )
+      }
+      i++
+      continue
+    }
     if (a === '-n' || a === '--max-args') {
       const n = args[i + 1]
       if (n == null || !/^\d+$/.test(n) || Number(n) < 1) {
@@ -165,7 +202,9 @@ async function run(ctx, argv) {
     ctx.console.error(
       'xargs: Bare OS supports: -0/--null, -n N (max ' +
         MAX_PER_INVOCATION +
-        ' per run), -I repl'
+        ' per run), -I repl, -P N (max ' +
+        MAX_P_FLAG +
+        ', sequential)'
     )
     ctx.exitCode = 1
     return
@@ -174,6 +213,7 @@ async function run(ctx, argv) {
   /** @type {string[]} */
   let cmd = args.slice(i)
   if (cmd.length === 0) cmd = ['echo']
+  void pCap
 
   let text = bareStdin(ctx) || ''
   if (text.length > MAX_STDIN) {

kernel/etc/bare-os/boot.policy.example.json

@@ -10,6 +10,17 @@
   "requireFeatureBits6": 0,
   "requireFeatureBits7": 0,
   "requireFeatureBits8": 0,
+  "requireFeatureBits9": 0,
+  "requireFeatureBits10": 0,
+  "requireBareBootMin": "0.0.0",
+  "denyBareRpcMethodPatterns": [],
+  "maxPearInspectDepth": 0,
+  "requireBareLoggerMin": "0.0.0",
+  "denyAutobaseDiscoveryChannels": [],
+  "requireBareTlsMin": "0.0.0",
+  "extensionSignerPinsV3": {},
+  "offlineLkgRequirePearStamp": false,
+  "bootPhasesRequireLifecycleMinSchema": 0,
   "requireBareRuntimeMin": "0.0.0",
   "denySeedRpcMethods": [],
   "maxProtomuxChannelNameLength": 256,

kernel/etc/bare-os/otel-jsonl.example.json

@@ -1,5 +1,5 @@
 {
-  "otlSchemaVersion": 5,
+  "otlSchemaVersion": 7,
   "scopeMetrics": [
     {
       "scope": { "name": "bare-os-example" },

kernel/init.js

@@ -127,6 +127,9 @@ function shouldSkipBootPhase(ctx, phase) {
  * Boot policy v9 (optional): `requireFeatureBits9`, `requirePearRuntimeRange` (`{ min?, max? }` semver),
  *   `denyBareModuleSpecifierPatterns`, `requireBareCryptoMin`, `denyKernelSyscalls`, `requirePearIpcMin`,
  *   `extensionSignerPinsV2`, `offlineLkgManifestMaxAgeSec`, `bootPhasesRequireProcIndexMinSchema`.
+ * Boot policy v10 (optional): `requireFeatureBits10`, `requireBareBootMin`, `denyBareRpcMethodPatterns`,
+ *   `maxPearInspectDepth`, `requireBareLoggerMin`, `denyAutobaseDiscoveryChannels`, `requireBareTlsMin`,
+ *   `extensionSignerPinsV3`, `offlineLkgRequirePearStamp`, `bootPhasesRequireLifecycleMinSchema`.
  * @param {Record<string, unknown>} ctx
  * @returns {Promise<boolean>} false when strict policy fails (caller should abort boot)
  */
@@ -361,6 +364,24 @@ async function applyBootPolicyFile(ctx) {
         }
       }
     }
+    if (
+      typeof pol.requireFeatureBits10 === 'number' &&
+      pol.requireFeatureBits10 > 0
+    ) {
+      const adv10 = ctx.bareOsAdvertisedKernelBits10
+      const need10 = pol.requireFeatureBits10 >>> 0
+      const ok =
+        typeof adv10 === 'number' && ((adv10 >>> 0) & need10) === need10
+      if (!ok) {
+        console.error('[boot-policy] requireFeatureBits10 not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
     if (
       pol.requirePearRuntimeRange &&
       typeof pol.requirePearRuntimeRange === 'object'
@@ -654,6 +675,106 @@ async function applyBootPolicyFile(ctx) {
         /* ignore */
       }
     }
+    if (
+      pol.extensionSignerPinsV3 &&
+      typeof pol.extensionSignerPinsV3 === 'object' &&
+      ctx.env
+    ) {
+      try {
+        ctx.env.BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V3_JSON =
+          JSON.stringify(pol.extensionSignerPinsV3)
+      } catch {
+        /* ignore */
+      }
+    }
+    if (
+      typeof pol.requireBareBootMin === 'string' &&
+      String(pol.requireBareBootMin).trim()
+    ) {
+      const needS = String(pol.requireBareBootMin).trim()
+      const haveS =
+        ctx.env && String(ctx.env.BARE_OS_BARE_BOOT_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBareBootMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
+    if (
+      Array.isArray(pol.denyBareRpcMethodPatterns) &&
+      ctx.env
+    ) {
+      try {
+        ctx.env.BARE_OS_BOOT_POLICY_DENY_BARE_RPC_PATTERNS_JSON =
+          JSON.stringify(pol.denyBareRpcMethodPatterns)
+      } catch {
+        /* ignore */
+      }
+    }
+    if (
+      typeof pol.maxPearInspectDepth === 'number' &&
+      pol.maxPearInspectDepth >= 0 &&
+      ctx.env
+    ) {
+      ctx.env.BARE_OS_BOOT_POLICY_MAX_PEAR_INSPECT_DEPTH = String(
+        Math.min(64, Math.floor(pol.maxPearInspectDepth))
+      )
+    }
+    if (
+      typeof pol.requireBareLoggerMin === 'string' &&
+      String(pol.requireBareLoggerMin).trim()
+    ) {
+      const needS = String(pol.requireBareLoggerMin).trim()
+      const haveS =
+        ctx.env && String(ctx.env.BARE_OS_BARE_LOGGER_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBareLoggerMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
+    if (
+      Array.isArray(pol.denyAutobaseDiscoveryChannels) &&
+      ctx.env
+    ) {
+      try {
+        ctx.env.BARE_OS_BOOT_POLICY_DENY_AUTOBASE_DISCOVERY_CHANNELS_JSON =
+          JSON.stringify(pol.denyAutobaseDiscoveryChannels)
+      } catch {
+        /* ignore */
+      }
+    }
+    if (
+      typeof pol.requireBareTlsMin === 'string' &&
+      String(pol.requireBareTlsMin).trim()
+    ) {
+      const needS = String(pol.requireBareTlsMin).trim()
+      const haveS =
+        ctx.env && String(ctx.env.BARE_OS_BARE_TLS_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBareTlsMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
+    if (pol.offlineLkgRequirePearStamp === true && ctx.env) {
+      ctx.env.BARE_OS_OFFLINE_LKG_REQUIRE_PEAR_STAMP = '1'
+    }
     if (
       typeof pol.offlineLkgManifestMaxAgeSec === 'number' &&
       pol.offlineLkgManifestMaxAgeSec > 0 &&
@@ -712,6 +833,26 @@ async function applyBootPolicyFile(ctx) {
         }
       }
     }
+    if (
+      typeof pol.bootPhasesRequireLifecycleMinSchema === 'number' &&
+      pol.bootPhasesRequireLifecycleMinSchema > 0
+    ) {
+      const needSch = Math.floor(pol.bootPhasesRequireLifecycleMinSchema)
+      const raw = ctx.env && String(ctx.env.BARE_OS_LIFECYCLE_SCHEMA_VERSION || '').trim()
+      const haveSch = Number.parseInt(raw, 10)
+      const ok = Number.isFinite(haveSch) && haveSch >= needSch
+      if (!ok) {
+        console.error(
+          '[boot-policy] bootPhasesRequireLifecycleMinSchema not satisfied'
+        )
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
     if (
       typeof pol.bootPhasesRequireProcIndexMinSchema === 'number' &&
       pol.bootPhasesRequireProcIndexMinSchema > 0

kernel/lib/bare/manifest.json

@@ -37,18 +37,18 @@
         "protomux"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareEncoding.js",
-      "keys": [
-        "bareEncoding"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
         "bareEvents"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareEncoding.js",
+      "keys": [
+        "bareEncoding"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePath.js",
       "keys": [
@@ -67,30 +67,42 @@
         "bareAbortController"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAddonResolve.js",
       "keys": [
         "bareAddonResolve"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "keys": [
+        "bareAnsiEscapes"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareReadline.js",
       "keys": [
         "bareReadline"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareApk.js",
       "keys": [
         "bareApk"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
@@ -103,18 +115,6 @@
         "bareAssert"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareCrypto.js",
-      "keys": [
-        "bareCrypto"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/fetch.js",
-      "keys": [
-        "fetch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAsyncHooks.js",
       "keys": [
@@ -139,12 +139,6 @@
         "bareBundle"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundleCompile.js",
-      "keys": [
-        "bareBundleCompile"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBuffer.js",
       "keys": [
@@ -157,6 +151,12 @@
         "bareBluetoothApple"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "keys": [
+        "bareBundleCompile"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleEvaluate.js",
       "keys": [
@@ -176,9 +176,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareChannel.js",
+      "path": "/lib/bare/bundles/bareBundleId.js",
       "keys": [
-        "bareChannel"
+        "bareBundleId"
       ]
     },
     {
@@ -187,24 +187,30 @@
         "bareDebugLog"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareChannel.js",
+      "keys": [
+        "bareChannel"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDaemon.js",
       "keys": [
         "bareDaemon"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundleId.js",
-      "keys": [
-        "bareBundleId"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
         "bareDelta"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareEnv.js",
+      "keys": [
+        "bareEnv"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDns.js",
       "keys": [
@@ -217,18 +223,6 @@
         "bareDiagnosticsChannel"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareEnv.js",
-      "keys": [
-        "bareEnv"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareExif.js",
-      "keys": [
-        "bareExif"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
@@ -241,6 +235,12 @@
         "bareDgram"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareExif.js",
+      "keys": [
+        "bareExif"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFfmpeg.js",
       "keys": [
@@ -253,18 +253,18 @@
         "bareFfmpegEncodings"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFormData.js",
-      "keys": [
-        "bareFormData"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareFormat.js",
       "keys": [
         "bareFormat"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFormData.js",
+      "keys": [
+        "bareFormData"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFileLogger.js",
       "keys": [
@@ -278,15 +278,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareFs.js",
+      "path": "/lib/bare/bundles/bareHeif.js",
       "keys": [
-        "bareFs"
+        "bareHeif"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
       ]
     },
     {
@@ -296,9 +290,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareHrtime.js",
       "keys": [
-        "bareHeif"
+        "bareHrtime"
       ]
     },
     {
@@ -307,12 +301,6 @@
         "bareHttpParser"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareImageResample.js",
-      "keys": [
-        "bareImageResample"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareIco.js",
       "keys": [
@@ -320,9 +308,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareInspect.js",
+      "path": "/lib/bare/bundles/bareFs.js",
       "keys": [
-        "bareInspect"
+        "bareFs"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareImageResample.js",
+      "keys": [
+        "bareImageResample"
       ]
     },
     {
@@ -331,6 +325,12 @@
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspect.js",
+      "keys": [
+        "bareInspect"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
@@ -367,66 +367,66 @@
         "bareLogger"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareLink.js",
-      "keys": [
-        "bareLink"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareInspector.js",
       "keys": [
         "bareInspector"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareLink.js",
+      "keys": [
+        "bareLink"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareMake.js",
       "keys": [
         "bareMake"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModuleResolve.js",
-      "keys": [
-        "bareModuleResolve"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareModuleLexer.js",
       "keys": [
         "bareModuleLexer"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareModuleResolve.js",
+      "keys": [
+        "bareModuleResolve"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModule.js",
       "keys": [
         "bareModule"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNdk.js",
-      "keys": [
-        "bareNdk"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareModuleTraverse.js",
       "keys": [
         "bareModuleTraverse"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNodeFetch.js",
-      "keys": [
-        "bareNodeFetch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareNative.js",
       "keys": [
         "bareNative"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNdk.js",
+      "keys": [
+        "bareNdk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareNodeFetch.js",
+      "keys": [
+        "bareNodeFetch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
@@ -451,30 +451,24 @@
         "bareNet"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePack.js",
-      "keys": [
-        "barePack"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePerformance.js",
       "keys": [
         "barePerformance"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePng.js",
-      "keys": [
-        "barePng"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
         "barePipe"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePack.js",
+      "keys": [
+        "barePack"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePackDrive.js",
       "keys": [
@@ -482,9 +476,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "path": "/lib/bare/bundles/barePng.js",
       "keys": [
-        "bareNodeRuntime"
+        "barePng"
       ]
     },
     {
@@ -493,18 +487,24 @@
         "barePunycode"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareQuerystring.js",
-      "keys": [
-        "bareQuerystring"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
         "barePrebuild"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareQuerystring.js",
+      "keys": [
+        "bareQuerystring"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareQueueMicrotask.js",
       "keys": [
@@ -523,6 +523,12 @@
         "bareRealm"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePromClient.js",
+      "keys": [
+        "barePromClient"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDev.js",
       "keys": [
@@ -535,30 +541,12 @@
         "bareRuntime"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRpc.js",
-      "keys": [
-        "bareRpc"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSdl.js",
       "keys": [
         "bareSdl"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareRun.js",
-      "keys": [
-        "bareRun"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
@@ -566,15 +554,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSignals.js",
+      "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
-        "bareSignals"
+        "bareRun"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRepl.js",
-      "keys": [
-        "bareRepl"
       ]
     },
     {
@@ -583,60 +565,78 @@
         "bareSidecar"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareRpc.js",
+      "keys": [
+        "bareRpc"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareRepl.js",
+      "keys": [
+        "bareRepl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSignals.js",
+      "keys": [
+        "bareSignals"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStringDecoder.js",
       "keys": [
         "bareStringDecoder"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareStream.js",
-      "keys": [
-        "bareStream"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStdio.js",
-      "keys": [
-        "bareStdio"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSvg.js",
-      "keys": [
-        "bareSvg"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareStorage.js",
       "keys": [
         "bareStorage"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStream.js",
+      "keys": [
+        "bareStream"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSvg.js",
+      "keys": [
+        "bareSvg"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStructuredClone.js",
       "keys": [
         "bareStructuredClone"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStdio.js",
+      "keys": [
+        "bareStdio"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
         "bareSystemLogger"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTap.js",
-      "keys": [
-        "bareTap"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSubprocess.js",
       "keys": [
         "bareSubprocess"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTap.js",
+      "keys": [
+        "bareTap"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
@@ -649,24 +649,30 @@
         "bareTimers"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTpl.js",
-      "keys": [
-        "bareTpl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareThread.js",
       "keys": [
         "bareThread"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTpl.js",
+      "keys": [
+        "bareTpl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTcp.js",
       "keys": [
         "bareTcp"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTls.js",
+      "keys": [
+        "bareTls"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareType.js",
       "keys": [
@@ -674,9 +680,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
-        "bareTls"
+        "bareTty"
       ]
     },
     {
@@ -691,30 +697,24 @@
         "bareUnpack"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTty.js",
-      "keys": [
-        "bareTty"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareV8.js",
       "keys": [
         "bareV8"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUnionBundle.js",
-      "keys": [
-        "bareUnionBundle"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareVm.js",
       "keys": [
         "bareVm"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUnionBundle.js",
+      "keys": [
+        "bareUnionBundle"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
@@ -727,18 +727,18 @@
         "bareWebKit"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebp.js",
-      "keys": [
-        "bareWebp"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWebKitGtk.js",
       "keys": [
         "bareWebKitGtk"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWebp.js",
+      "keys": [
+        "bareWebp"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWhich.js",
       "keys": [
@@ -746,9 +746,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWinUi.js",
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
-        "bareWinUi"
+        "bareV8ToIstanbul"
       ]
     },
     {
@@ -758,9 +758,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
+      "path": "/lib/bare/bundles/bareWinUi.js",
       "keys": [
-        "bareV8ToIstanbul"
+        "bareWinUi"
       ]
     },
     {
@@ -781,17 +781,17 @@
         "bareZmq"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWorker.js",
-      "keys": [
-        "bareWorker"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWs.js",
       "keys": [
         "bareWs"
       ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWorker.js",
+      "keys": [
+        "bareWorker"
+      ]
     }
   ],
   "bundleStats": {

package.json

@@ -14,7 +14,7 @@
     "gen:bare-catalog:check": "node scripts/gen-bare-holepunch-catalog.mjs --check",
     "sync:bare-manifest": "node scripts/sync-bare-module-manifest-from-catalog.mjs",
     "smoke:bare-manifest": "node scripts/smoke-bare-manifest-imports.mjs",
-    "pretest": "npm run build -w bare-os-coreutils && npm run build -w bare-os-bare-libs && node scripts/verify-kernel-seeder-parity.mjs && node scripts/verify-ctx-api-feature-bits.mjs && node scripts/verify-kernel-roadmap-wave3.mjs && node scripts/verify-kernel-roadmap-wave6.mjs && node scripts/verify-kernel-roadmap-wave7.mjs && node scripts/verify-kernel-roadmap-wave8.mjs && node scripts/verify-kernel-roadmap-wave9.mjs && node scripts/verify-ctx-dts.mjs && node scripts/validate-example-schemas.mjs && node scripts/verify-doc-links.mjs && node scripts/verify-man-coverage.mjs && node scripts/verify-compat-matrix.mjs && node scripts/verify-pear-no-static-node-import.mjs && npm run smoke:bare-manifest",
+    "pretest": "npm run build -w bare-os-coreutils && npm run build -w bare-os-bare-libs && node scripts/verify-kernel-seeder-parity.mjs && node scripts/verify-ctx-api-feature-bits.mjs && node scripts/verify-kernel-roadmap-wave3.mjs && node scripts/verify-kernel-roadmap-wave6.mjs && node scripts/verify-kernel-roadmap-wave7.mjs && node scripts/verify-kernel-roadmap-wave8.mjs && node scripts/verify-kernel-roadmap-wave9.mjs && node scripts/verify-kernel-roadmap-wave10.mjs && node scripts/verify-ctx-dts.mjs && node scripts/validate-example-schemas.mjs && node scripts/verify-doc-links.mjs && node scripts/verify-man-coverage.mjs && node scripts/verify-compat-matrix.mjs && node scripts/verify-pear-no-static-node-import.mjs && npm run smoke:bare-manifest",
     "test": "npm run test --workspaces --if-present",
     "verify-kernel-seeder": "node scripts/verify-kernel-seeder-parity.mjs",
     "release-checklist": "node scripts/release-checklist.mjs",

packages/bare-os-booter/CHANGELOG.md

@@ -8,6 +8,7 @@
 
 | Version | Booter (workspace) | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | ------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 1.19.0  | 0.1.0              | Tenth word **`bits10`** + **`STOCK_V10`**; seed **`bits10`** + strict check; Wave 10 **`/proc`** JSON (**`bare-os-wave10-proc.js`**), **`bare_os_proc_index`** schema **6**, **`extensions.json`** schema **7**; boot policy v10 keys; NDJSON lifecycle **9**, OTel **`otlSchemaVersion: 7`**, audit **`auditSchemaVersion: 7`**; **`sysproc:*`** worker group; **`ctx`** wave 10 Pear/Bare stubs; telemetry **`wave10ProbeId`**, **`bareRpcProbeClass`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** in guest env. Protocol **`0.6.0`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC=12`**. CI: **`verify-kernel-roadmap-wave10.mjs`**. |
 | 1.18.0  | 0.1.0              | Ninth word **`bits9`** + **`STOCK_V9`**; seed **`bits9`** + strict check; Wave 9 **`/proc`** JSON (**`bare-os-wave9-proc.js`**), **`bare_os_proc_index`** schema **5**, **`extensions.json`** schema **6**; boot policy v9 keys in **`boot.policy.json`**; NDJSON lifecycle **8**, OTel **`otlSchemaVersion: 6`**, audit **`auditSchemaVersion: 6`**; **`mediaproc:*`** worker group; **`ctx`** wave 9 Pear/Bare stubs (**`bareOsEmitPearStageHint`**, probes, …); **`BARE_OS_SOCKS_PROXY_MAP_JSON`** lookup helper; telemetry **`wave9ProbeId`**. Protocol **`0.5.0`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC=11`**, extended **`seed-rpc-methods.js`**. CI: **`verify-kernel-roadmap-wave9.mjs`**. |
 | 1.15.0  | 0.1.0              | Sixth word **`bits6`** + **`STOCK_V6`**; seed **`bits6`** + strict check; Wave 6 **`/proc/bare_os/*.json`** operator metrics; **`bareOsAdvertisedKernelBits6`**, **`bareOsSeedCapabilityBits6`**, **`bareOsBooterPackageVersion`**; Pear hooks **`bareOsPearUpdaterDelegate`**, **`bareOsEmitHyperdhtBootstrapRefresh`**; subprocess snapshot schema **3**; boot policy v6 env (**`requireFeatureBits6`**, **`requireBooterSemver`**, **`requireCtxApiMin`**, extension deny/hash pins, offline LKG strict); NDJSON lifecycle **5**, OTel **`otlSchemaVersion: 3`**, audit **`auditSchemaVersion: 3`**; **`mathproc:*`**, **`BARE_OS_BIN_WORKER_WALL_MS`**; delegate **`hrpc`** stub; **`verify-kernel-roadmap-wave6.mjs`**, **`verify-pear-no-static-node-import.mjs`**. Protocol: **`BARE_OS_KERNEL_FEATURE_BITS_DOC=8`**, extended **`seed-rpc-methods.js`**. |
 | 1.14.0  | 0.1.0              | Fifth feature word **`bits5`** + **`STOCK_V5`**; seed **`bits5`** + strict check; **`/proc/bare_os/host_os.json`**, **`sync_window.json`**, **`debug.json`**; **`bareOsReadSubprocessBridgeSnapshot`**, **`bareOsRequestKernelProfileReload`**; boot policy v5 (**`requireFeatureBits5`**, **`requireInitJsSha256`**); OTel JSONL **`otlSchemaVersion: 2`**; **`BARE_OS_BIN_WORKER_ALLOW`** pattern groups (**`textproc:*`**); union **`readlink`** shadow; HDMS hints schema **2** + correlation id; net summary **`transport`**; replication sync windows; seeder staging rollback + queue hints env. Protocol: **`BARE_OS_KERNEL_FEATURE_BITS_DOC=7`**, **`seed-rpc-methods.js`**, typed seed RPC errors. CI: **`verify-doc-links`**, **`verify-man-coverage`**, **`verify-compat-matrix`**. |

packages/bare-os-booter/index.js

@@ -19,6 +19,7 @@ import {
   BARE_OS_KERNEL_FEATURES_STOCK_V7,
   BARE_OS_KERNEL_FEATURES_STOCK_V8,
   BARE_OS_KERNEL_FEATURES_STOCK_V9,
+  BARE_OS_KERNEL_FEATURES_STOCK_V10,
   BARE_OS_KERNEL_FEATURE_BITS_DOC,
   BARE_OS_FEATURE_CRYPTO_URANDOM,
   BARE_OS_PROTOCOL_PACKAGE_VERSION
@@ -35,6 +36,7 @@ import { createBareOsSandboxContext } from './lib/bare-os-sandbox.js'
 import { createVfs } from './lib/vfs.js'
 import { buildBareOsWave8ProcJson } from './lib/bare-os-wave8-proc.js'
 import { buildBareOsWave9ProcJson } from './lib/bare-os-wave9-proc.js'
+import { buildBareOsWave10ProcJson } from './lib/bare-os-wave10-proc.js'
 import { createBareOsIpc } from './lib/bare-os-ipc.js'
 import {
   execShellLine,
@@ -471,11 +473,19 @@ async function executeKernel(disk, store, swarm, initSource) {
     'BARE_OS_HTTP_PROXY_MAP_JSON',
     'BARE_OS_SOCKS_PROXY_MAP_JSON',
     'BARE_OS_BARE_CRYPTO_VERSION',
+    'BARE_OS_BARE_BOOT_VERSION',
+    'BARE_OS_BARE_LOGGER_VERSION',
+    'BARE_OS_BARE_TLS_VERSION',
     'BARE_OS_PEAR_IPC_PACKAGE_VERSION',
     'BARE_OS_PEAR_UPDATER_CHANNEL',
     'BARE_OS_HAPPY_EYEBALLS_V3_MODE',
     'BARE_OS_BIN_WORKER_WASM_MS_MAX',
     'BARE_OS_WAVE9_PROBE_ID',
+    'BARE_OS_WAVE10_PROBE_ID',
+    'BARE_OS_BARE_RPC_PROBE_CLASS',
+    'BARE_OS_MTLS_PROXY_MAP_JSON',
+    'BARE_OS_THREAD_POOL_TELEMETRY_JSON',
+    'BARE_OS_HAPPY_EYEBALLS_V4_MODE',
     'BARE_OS_PROC_RLIMITS_JSON',
     'BARE_OS_SUBPROCESS_BRIDGE_UID_GID_MAP_JSON',
     'BARE_OS_HDMS_VAULT_ROTATE_COUNT',
@@ -524,6 +534,9 @@ async function executeKernel(disk, store, swarm, initSource) {
   shellEnv.BARE_OS_BOOT_PROFILE_RESOLVED = bootProfileResolved
   const bareOsSessionId = randomUUID()
   shellEnv.BARE_OS_SESSION_ID = bareOsSessionId
+  shellEnv.BARE_OS_LIFECYCLE_SCHEMA_VERSION = String(
+    BARE_OS_LIFECYCLE_SCHEMA_VERSION
+  )
   /** @type {((ev: Record<string, unknown>) => void | Promise<void>)[]} */
   const hdmsLifecycleSubs = []
   /** @type {Set<(ev: Record<string, unknown>) => void | Promise<void>>} */
@@ -676,6 +689,7 @@ async function executeKernel(disk, store, swarm, initSource) {
         bits7: BARE_OS_KERNEL_FEATURES_STOCK_V7 >>> 0,
         bits8: BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0,
         bits9: BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0,
+        bits10: BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0,
         bootTracePointer: 'stderr:BARE_OS_BOOT_TRACE',
         atMs: Date.now()
       })}\n`
@@ -709,6 +723,10 @@ async function executeKernel(disk, store, swarm, initSource) {
       const o = buildBareOsWave9ProcJson(String(wave9Id || ''), shellEnv)
       return `${JSON.stringify(o)}\n`
     },
+    procBareOsWave10JsonText(wave10Id) {
+      const o = buildBareOsWave10ProcJson(String(wave10Id || ''), shellEnv)
+      return `${JSON.stringify(o)}\n`
+    },
     hostProcStatsRef,
     procSnapshot: {
       version: BARE_OS_CTX_API_VERSION,
@@ -820,6 +838,7 @@ async function executeKernel(disk, store, swarm, initSource) {
             bits7: seed.bits7,
             bits8: seed.bits8,
             bits9: seed.bits9,
+            bits10: seed.bits10,
             role: seed.role,
             protocol: seed.protocol
           }
@@ -841,6 +860,7 @@ async function executeKernel(disk, store, swarm, initSource) {
         bits7: BARE_OS_KERNEL_FEATURES_STOCK_V7 >>> 0,
         bits8: BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0,
         bits9: BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0,
+        bits10: BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0,
         urandomCrypto: urandomCryptoOn,
         seedHandshake,
         protocolPackageVersion: protocolPackageVersion || undefined,
@@ -849,7 +869,7 @@ async function executeKernel(disk, store, swarm, initSource) {
     },
     procBareOsExtensionsText() {
       return `${JSON.stringify({
-        schema: 6,
+        schema: 7,
         featureBitsDoc: BARE_OS_KERNEL_FEATURE_BITS_DOC,
         entries: kernelExtensionRecords,
         atMs: Date.now()
@@ -1428,6 +1448,8 @@ async function executeKernel(disk, store, swarm, initSource) {
     BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0
   const bareOsAdvertisedKernelBits9Resolved =
     BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0
+  const bareOsAdvertisedKernelBits10Resolved =
+    BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0
 
   /** @type {(() => void | Promise<void>)[]} */
   const bareOsSuspendHooks = []
@@ -1472,6 +1494,7 @@ async function executeKernel(disk, store, swarm, initSource) {
     bareOsAdvertisedKernelBits7: bareOsAdvertisedKernelBits7Resolved,
     bareOsAdvertisedKernelBits8: bareOsAdvertisedKernelBits8Resolved,
     bareOsAdvertisedKernelBits9: bareOsAdvertisedKernelBits9Resolved,
+    bareOsAdvertisedKernelBits10: bareOsAdvertisedKernelBits10Resolved,
     bareOsBooterPackageVersion: _BOOTER_PKG_VERSION,
     bareOsProtocolPackageVersion: BARE_OS_PROTOCOL_PACKAGE_VERSION,
     bareOsPearRuntimeVersion: String(
@@ -1534,6 +1557,12 @@ async function executeKernel(disk, store, swarm, initSource) {
       typeof disk.seedCapabilityInfo.bits9 === 'number'
         ? disk.seedCapabilityInfo.bits9 >>> 0
         : null,
+    bareOsSeedCapabilityBits10:
+      disk.seedCapabilityInfo &&
+      typeof disk.seedCapabilityInfo === 'object' &&
+      typeof disk.seedCapabilityInfo.bits10 === 'number'
+        ? disk.seedCapabilityInfo.bits10 >>> 0
+        : null,
     bareOsSystemRevision: Object.freeze({
       currentId: String(shellEnv.BARE_OS_SYSTEM_REVISION_ID || '').trim(),
       pendingId: String(shellEnv.BARE_OS_SYSTEM_REVISION_PENDING || '').trim(),
@@ -2367,6 +2396,121 @@ async function executeKernel(disk, store, swarm, initSource) {
         return false
       }
     },
+    bareOsEmitPearDoctorHint(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:pear-doctor-hint', {
+          healthClass: String(payload.healthClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsPearInspectProbe(payload = {}) {
+      const depth = Math.min(32, Math.max(0, Number(payload.depth) || 0))
+      return {
+        ok: false,
+        depth,
+        note: 'Host-only inspect probe; stock booter returns stub.'
+      }
+    },
+    bareOsEmitBareBootPhaseHint(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:bare-boot-phase-hint', {
+          phase: String(payload.phase || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsBareRpcCapProbe() {
+      return {
+        ok: false,
+        note: 'bare-rpc capability class; host may wire delegate.'
+      }
+    },
+    bareOsEmitPearStampPointer(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:pear-stamp-pointer', {
+          stampClass: String(payload.stampClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    /** @param {(ev: Record<string, unknown>) => void} fn */
+    bareOsRegisterBareLoggerTap(fn) {
+      if (typeof fn !== 'function') return () => {}
+      let n = 0
+      const cap = 256
+      const wrapped = (ev) => {
+        if (n >= cap) return
+        n++
+        try {
+          fn(ev && typeof ev === 'object' ? ev : {})
+        } catch {
+          /* ignore */
+        }
+      }
+      if (typeof globalThis.process?.on === 'function') {
+        globalThis.process.on('bare-os:bare-logger-tap', wrapped)
+      }
+      return () => {
+        if (typeof globalThis.process?.off === 'function') {
+          globalThis.process.off('bare-os:bare-logger-tap', wrapped)
+        }
+      }
+    },
+    bareOsEmitAutobaseDiscoveryHint(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:autobase-discovery-hint', {
+          channelClass: String(payload.channelClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsEmitBlindPairingSketch(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:blind-pairing-sketch', {
+          sketchClass: String(payload.sketchClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsBareStreamBackpressureHint(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:bare-stream-backpressure-hint', {
+          backlogClass: String(payload.backlogClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsPearTerminalCapsProbe() {
+      return {
+        ok: false,
+        note: 'Terminal capability flags; host interprets pear-terminal class.'
+      }
+    },
     /**
      * Optional hrpc round-trip; stock booter never leaves guest without host bridge.
      * @returns {Promise<unknown>}
@@ -2635,7 +2779,7 @@ async function executeKernel(disk, store, swarm, initSource) {
     const auditFn = auditOn
       ? (info) => {
           const line = JSON.stringify({
-            auditSchemaVersion: 6,
+            auditSchemaVersion: 7,
             type: 'httpFetch',
             ts: Date.now(),
             requestSmugglingClass: 'none',
@@ -2758,7 +2902,7 @@ async function executeKernel(disk, store, swarm, initSource) {
           AUDIT_LOG,
           'json',
           JSON.stringify({
-            auditSchemaVersion: 6,
+            auditSchemaVersion: 7,
             type: 'execLine',
             ts: Date.now(),
             requestSmugglingClass: 'none',
@@ -2927,6 +3071,7 @@ async function loadOsFromOfflineLkg(store, swarm, Hyperdrive, disk, splash, keyH
     bits7: BARE_OS_KERNEL_FEATURES_STOCK_V7 >>> 0,
     bits8: BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0,
     bits9: BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0,
+    bits10: BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0,
     protocol: 'bare-os-v1',
     note: 'offline boot; bare_os.capabilities RPC not used'
   }
@@ -3038,6 +3183,13 @@ async function loadOsFromPeers(disk, store, swarm, splash) {
             'BARE_OS_SEED_CAP_STRICT: seeder feature bits9 do not cover stock booter requirements'
           )
         }
+        const need10 = BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0
+        const got10 = typeof cap.bits10 === 'number' ? cap.bits10 >>> 0 : 0
+        if (need10 !== 0 && (got10 & need10) !== need10) {
+          throw new Error(
+            'BARE_OS_SEED_CAP_STRICT: seeder feature bits10 do not cover stock booter requirements'
+          )
+        }
       }
       try {
         disk.seedReplicationStatus = await disk.rpc(

packages/bare-os-booter/lib/bare-os-ctx-api.js

@@ -2,4 +2,4 @@
  * Semantic version of the booter `ctx` contract for custom kernels.
  * Bump when adding/removing/renaming documented `ctx` fields or changing behavior.
  */
-export const BARE_OS_CTX_API_VERSION = '1.18.0'
+export const BARE_OS_CTX_API_VERSION = '1.19.0'

packages/bare-os-booter/lib/bare-os-ctx.d.ts

@@ -95,6 +95,8 @@ export interface BareOsKernelContext {
   bareOsSeedCapabilityBits8?: number | null
   bareOsAdvertisedKernelBits9?: number
   bareOsSeedCapabilityBits9?: number | null
+  bareOsAdvertisedKernelBits10?: number
+  bareOsSeedCapabilityBits10?: number | null
   bareOsBooterPackageVersion?: string
   bareOsProtocolPackageVersion?: string
   bareOsPearRuntimeVersion?: string
@@ -214,6 +216,20 @@ export interface BareOsKernelContext {
   bareOsEmitTrybootSlot?(payload?: Record<string, unknown>): boolean
   bareOsEmitMultisigPointer?(payload?: Record<string, unknown>): boolean
   bareOsBareStorageHint?(payload?: Record<string, unknown>): boolean
+  bareOsEmitPearDoctorHint?(payload?: Record<string, unknown>): boolean
+  bareOsPearInspectProbe?(payload?: {
+    depth?: number
+  }): { ok: boolean; depth?: number; note?: string }
+  bareOsEmitBareBootPhaseHint?(payload?: Record<string, unknown>): boolean
+  bareOsBareRpcCapProbe?(): { ok: boolean; note?: string }
+  bareOsEmitPearStampPointer?(payload?: Record<string, unknown>): boolean
+  bareOsRegisterBareLoggerTap?(
+    fn: (ev: Record<string, unknown>) => void
+  ): () => void
+  bareOsEmitAutobaseDiscoveryHint?(payload?: Record<string, unknown>): boolean
+  bareOsEmitBlindPairingSketch?(payload?: Record<string, unknown>): boolean
+  bareOsBareStreamBackpressureHint?(payload?: Record<string, unknown>): boolean
+  bareOsPearTerminalCapsProbe?(): { ok: boolean; note?: string }
   bareOsHrpcRequest?(
     service: string,
     method: string,

packages/bare-os-booter/lib/bare-os-lifecycle-schema.js

@@ -2,7 +2,7 @@
  * Unified version for booter NDJSON telemetry, boot phase events, and var-log mirrors.
  * Bump when adding required fields or changing semantics (see docs/reference/kernel-extensions.md).
  */
-export const BARE_OS_LIFECYCLE_SCHEMA_VERSION = 8
+export const BARE_OS_LIFECYCLE_SCHEMA_VERSION = 9
 
 /** Legacy field still emitted for older parsers; prefer {@link BARE_OS_LIFECYCLE_SCHEMA_VERSION}. */
-export const BARE_OS_TELEMETRY_SCHEMA_VERSION = 8
+export const BARE_OS_TELEMETRY_SCHEMA_VERSION = 9

packages/bare-os-booter/lib/bare-os-runtime-caps.js

@@ -69,6 +69,44 @@ export const BARE_OS_PSEUDO_FS_PATHS = Object.freeze([
   '/proc/bare_os/dns_map_active.json',
   '/proc/bare_os/git_delegate_stats.json',
   '/proc/bare_os/snapshot_hints.json',
+  '/proc/bare_os/activity_queue_depth.json',
+  '/proc/bare_os/autobase_writer_hint.json',
+  '/proc/bare_os/bare_boot_phase_map.json',
+  '/proc/bare_os/bare_inspect_policy.json',
+  '/proc/bare_os/bare_logger_policy.json',
+  '/proc/bare_os/bare_performance_counters.json',
+  '/proc/bare_os/bare_rpc_registry_sketch.json',
+  '/proc/bare_os/bare_signals_mask.json',
+  '/proc/bare_os/bare_stream_backpressure.json',
+  '/proc/bare_os/bare_timers_budget.json',
+  '/proc/bare_os/bare_tls_session_hint.json',
+  '/proc/bare_os/bare_ws_gateway_sketch.json',
+  '/proc/bare_os/blind_pairing_sketch.json',
+  '/proc/bare_os/broadcast_encryption_hint.json',
+  '/proc/bare_os/pear_api_allowlist_sketch.json',
+  '/proc/bare_os/pear_doctor_state.json',
+  '/proc/bare_os/pear_rti_pointer.json',
+  '/proc/bare_os/pear_user_dirs_map.json',
+  '/proc/bare_os/pear_workshop_flags.json',
+  '/proc/bare_os_activity_queue_depth.json',
+  '/proc/bare_os_autobase_writer_hint.json',
+  '/proc/bare_os_bare_boot_phase_map.json',
+  '/proc/bare_os_bare_inspect_policy.json',
+  '/proc/bare_os_bare_logger_policy.json',
+  '/proc/bare_os_bare_performance_counters.json',
+  '/proc/bare_os_bare_rpc_registry_sketch.json',
+  '/proc/bare_os_bare_signals_mask.json',
+  '/proc/bare_os_bare_stream_backpressure.json',
+  '/proc/bare_os_bare_timers_budget.json',
+  '/proc/bare_os_bare_tls_session_hint.json',
+  '/proc/bare_os_bare_ws_gateway_sketch.json',
+  '/proc/bare_os_blind_pairing_sketch.json',
+  '/proc/bare_os_broadcast_encryption_hint.json',
+  '/proc/bare_os_pear_api_allowlist_sketch.json',
+  '/proc/bare_os_pear_doctor_state.json',
+  '/proc/bare_os_pear_rti_pointer.json',
+  '/proc/bare_os_pear_user_dirs_map.json',
+  '/proc/bare_os_pear_workshop_flags.json',
   '/proc/bare_os_snapshot_hints.json',
   '/proc/bare_os_extensions.json',
   '/proc/bare_os_hdms_hints.json',

packages/bare-os-booter/lib/bare-os-var-log.js

@@ -112,6 +112,7 @@ async function mirrorBareOsTelemetryNdjson(ctx, rec) {
     const lineage = String(env.BARE_OS_TELEMETRY_SESSION_LINEAGE_ID || '').trim()
     const bootAttemptId = String(env.BARE_OS_BOOT_ATTEMPT_ID || '').trim()
     const wave9ProbeId = String(env.BARE_OS_WAVE9_PROBE_ID || '').trim()
+    const wave10ProbeId = String(env.BARE_OS_WAVE10_PROBE_ID || '').trim()
     const line =
       JSON.stringify({
         telemetrySchemaVersion: BARE_OS_TELEMETRY_SCHEMA_VERSION,
@@ -119,6 +120,12 @@ async function mirrorBareOsTelemetryNdjson(ctx, rec) {
         ts: Date.now(),
         bootAttemptId: bootAttemptId ? bootAttemptId.slice(0, 128) : undefined,
         wave9ProbeId: wave9ProbeId ? wave9ProbeId.slice(0, 128) : undefined,
+        wave10ProbeId: wave10ProbeId ? wave10ProbeId.slice(0, 128) : undefined,
+        bareRpcProbeClass: String(
+          env.BARE_OS_BARE_RPC_PROBE_CLASS || ''
+        )
+          .trim()
+          .slice(0, 64) || undefined,
         bareModuleProbeClass: String(
           env.BARE_OS_BARE_MODULE_PROBE_CLASS || ''
         ).trim().slice(0, 64) || undefined,
@@ -164,7 +171,7 @@ async function mirrorBareOsOtelJsonl(ctx, eventName, attrs) {
     if (!vfs || typeof vfs.readFile !== 'function') return
     const line =
       JSON.stringify({
-        otlSchemaVersion: 6,
+        otlSchemaVersion: 7,
         resourceLogs: [
           {
             resource: {

packages/bare-os-booter/lib/bare-os-wave10-proc.js

@@ -0,0 +1,164 @@
+/**
+ * Wave 10 optional `/proc/bare_os/*.json` payloads (env-injected; bounded, non-secret).
+ * Maps Holepunch `bare-*` / `pear-*` stacks — no Node `node:*` built-ins in guest paths.
+ * @param {string} id
+ * @param {Record<string, string>} env
+ */
+export function buildBareOsWave10ProcJson(id, env) {
+  const now = Date.now()
+  const esc = (k) => String(env[k] ?? '').trim()
+
+  function parseJsonEnv(key) {
+    const raw = esc(key)
+    if (!raw) return null
+    try {
+      const o = JSON.parse(raw)
+      return o && typeof o === 'object' ? o : null
+    } catch {
+      return { schema: 1, error: 'invalid_json', key, atMs: now }
+    }
+  }
+
+  switch (id) {
+    case 'pear_doctor_state':
+      return {
+        schema: 1,
+        state: parseJsonEnv('BARE_OS_PEAR_DOCTOR_STATE_JSON'),
+        note: 'pear-doctor operator health sketch.',
+        atMs: now
+      }
+    case 'pear_workshop_flags':
+      return {
+        schema: 1,
+        flags: parseJsonEnv('BARE_OS_PEAR_WORKSHOP_FLAGS_JSON'),
+        note: 'pear-workshop dev flags.',
+        atMs: now
+      }
+    case 'pear_user_dirs_map':
+      return {
+        schema: 1,
+        map: parseJsonEnv('BARE_OS_PEAR_USER_DIRS_MAP_JSON'),
+        note: 'pear-user-dirs map (non-secret).',
+        atMs: now
+      }
+    case 'pear_api_allowlist_sketch':
+      return {
+        schema: 1,
+        allowlist: parseJsonEnv('BARE_OS_PEAR_API_ALLOWLIST_SKETCH_JSON'),
+        note: 'pear-api surface allow sketch.',
+        atMs: now
+      }
+    case 'pear_rti_pointer':
+      return {
+        schema: 1,
+        pointer: parseJsonEnv('BARE_OS_PEAR_RTI_POINTER_JSON'),
+        note: 'pear-rti pointer doc.',
+        atMs: now
+      }
+    case 'bare_boot_phase_map':
+      return {
+        schema: 1,
+        phases: parseJsonEnv('BARE_OS_BARE_BOOT_PHASE_MAP_JSON'),
+        note: 'bare-boot phase alignment map.',
+        atMs: now
+      }
+    case 'bare_rpc_registry_sketch':
+      return {
+        schema: 1,
+        registry: parseJsonEnv('BARE_OS_BARE_RPC_REGISTRY_SKETCH_JSON'),
+        note: 'bare-rpc registry summary (names only).',
+        atMs: now
+      }
+    case 'bare_logger_policy':
+      return {
+        schema: 1,
+        policy: parseJsonEnv('BARE_OS_BARE_LOGGER_POLICY_JSON'),
+        note: 'bare-logger / bare-file-logger sink class.',
+        atMs: now
+      }
+    case 'bare_performance_counters':
+      return {
+        schema: 1,
+        counters: parseJsonEnv('BARE_OS_BARE_PERFORMANCE_COUNTERS_JSON'),
+        note: 'bare-performance / bare-hrtime counters sketch.',
+        atMs: now
+      }
+    case 'bare_inspect_policy':
+      return {
+        schema: 1,
+        policy: parseJsonEnv('BARE_OS_BARE_INSPECT_POLICY_JSON'),
+        note: 'bare-inspect policy.',
+        atMs: now
+      }
+    case 'bare_signals_mask':
+      return {
+        schema: 1,
+        mask: parseJsonEnv('BARE_OS_BARE_SIGNALS_MASK_JSON'),
+        note: 'bare-signals mask summary.',
+        atMs: now
+      }
+    case 'bare_timers_budget':
+      return {
+        schema: 1,
+        budget: parseJsonEnv('BARE_OS_BARE_TIMERS_BUDGET_JSON'),
+        note: 'bare-timers budget.',
+        atMs: now
+      }
+    case 'bare_stream_backpressure':
+      return {
+        schema: 1,
+        backpressure: parseJsonEnv('BARE_OS_BARE_STREAM_BACKPRESSURE_JSON'),
+        note: 'bare-stream / bare-pipe class.',
+        atMs: now
+      }
+    case 'bare_ws_gateway_sketch':
+      return {
+        schema: 1,
+        gateway: parseJsonEnv('BARE_OS_BARE_WS_GATEWAY_SKETCH_JSON'),
+        note: 'bare-ws gateway policy.',
+        atMs: now
+      }
+    case 'bare_tls_session_hint':
+      return {
+        schema: 1,
+        tls: parseJsonEnv('BARE_OS_BARE_TLS_SESSION_HINT_JSON'),
+        note: 'bare-tls session cache / pin class.',
+        atMs: now
+      }
+    case 'autobase_writer_hint':
+      return {
+        schema: 1,
+        writer: parseJsonEnv('BARE_OS_AUTOBASE_WRITER_HINT_JSON'),
+        note: 'autobase writer hint (non-secret).',
+        atMs: now
+      }
+    case 'blind_pairing_sketch':
+      return {
+        schema: 1,
+        sketch: parseJsonEnv('BARE_OS_BLIND_PAIRING_SKETCH_JSON'),
+        note: 'blind-pairing operator sketch.',
+        atMs: now
+      }
+    case 'broadcast_encryption_hint':
+      return {
+        schema: 1,
+        hint: parseJsonEnv('BARE_OS_BROADCAST_ENCRYPTION_HINT_JSON'),
+        note: 'broadcast-encryption capability hint.',
+        atMs: now
+      }
+    case 'activity_queue_depth':
+      return {
+        schema: 1,
+        depth: parseJsonEnv('BARE_OS_ACTIVITY_QUEUE_DEPTH_JSON'),
+        note: 'activity-queue depth sketch.',
+        atMs: now
+      }
+    default:
+      return {
+        schema: 1,
+        error: 'unknown_wave10_proc_id',
+        id,
+        atMs: now
+      }
+  }
+}

packages/bare-os-booter/lib/kernel-runner.js

@@ -49,6 +49,18 @@ const _BIN_WORKER_IOPROC = new Set(['cat', 'head', 'tail'])
 
 const _BIN_WORKER_MEDIAPROC = new Set(['ffmpeg', 'ffprobe'])
 
+/** Process/shell-adjacent builtins allowed under `sysproc:*` (documentary group; bare-process-class). */
+const _BIN_WORKER_SYSPROC = new Set([
+  'pwd',
+  'echo',
+  'printenv',
+  'uname',
+  'id',
+  'env',
+  'true',
+  'false'
+])
+
 /**
  * @param {string} cmd
  * @param {Record<string, string | undefined> | null | undefined} env
@@ -84,12 +96,17 @@ function binWorkerOffloadEnabled(cmd, env) {
       if (_BIN_WORKER_MEDIAPROC.has(cmd)) return true
       continue
     }
+    if (p === 'sysproc:*') {
+      if (_BIN_WORKER_SYSPROC.has(cmd)) return true
+      continue
+    }
     if (p.endsWith(':*')) {
       const pre = p.slice(0, -2)
       if (pre === 'textproc' && _BIN_WORKER_TEXTPROC.has(cmd)) return true
       if (pre === 'mathproc' && _BIN_WORKER_MATHPROC.has(cmd)) return true
       if (pre === 'ioproc' && _BIN_WORKER_IOPROC.has(cmd)) return true
       if (pre === 'mediaproc' && _BIN_WORKER_MEDIAPROC.has(cmd)) return true
+      if (pre === 'sysproc' && _BIN_WORKER_SYSPROC.has(cmd)) return true
       continue
     }
     if (p === cmd) return true
@@ -160,7 +177,7 @@ async function auditDelegateJson(ctx, kind, argv) {
     AUDIT_LOG,
     'json',
     JSON.stringify({
-      auditSchemaVersion: 6,
+      auditSchemaVersion: 7,
       requestSmugglingClass: 'none',
       type: 'delegate',
       kind,

packages/bare-os-booter/lib/vfs.js

@@ -105,6 +105,29 @@ export const BARE_OS_WAVE9_PROC_FILE_TO_ID = Object.freeze({
   bare_os_form_data_delegate_limits_v2: 'form_data_delegate_limits_v2'
 })
 
+/** Wave 10 `/proc` pseudo files → {@link ./bare-os-wave10-proc.js} ids. */
+export const BARE_OS_WAVE10_PROC_FILE_TO_ID = Object.freeze({
+  bare_os_activity_queue_depth: 'activity_queue_depth',
+  bare_os_autobase_writer_hint: 'autobase_writer_hint',
+  bare_os_bare_boot_phase_map: 'bare_boot_phase_map',
+  bare_os_bare_inspect_policy: 'bare_inspect_policy',
+  bare_os_bare_logger_policy: 'bare_logger_policy',
+  bare_os_bare_performance_counters: 'bare_performance_counters',
+  bare_os_bare_rpc_registry_sketch: 'bare_rpc_registry_sketch',
+  bare_os_bare_signals_mask: 'bare_signals_mask',
+  bare_os_bare_stream_backpressure: 'bare_stream_backpressure',
+  bare_os_bare_timers_budget: 'bare_timers_budget',
+  bare_os_bare_tls_session_hint: 'bare_tls_session_hint',
+  bare_os_bare_ws_gateway_sketch: 'bare_ws_gateway_sketch',
+  bare_os_blind_pairing_sketch: 'blind_pairing_sketch',
+  bare_os_broadcast_encryption_hint: 'broadcast_encryption_hint',
+  bare_os_pear_api_allowlist_sketch: 'pear_api_allowlist_sketch',
+  bare_os_pear_doctor_state: 'pear_doctor_state',
+  bare_os_pear_rti_pointer: 'pear_rti_pointer',
+  bare_os_pear_user_dirs_map: 'pear_user_dirs_map',
+  bare_os_pear_workshop_flags: 'pear_workshop_flags'
+})
+
 /**
  * Unified path view: system Hyperdrive for OS paths, personal Hyperdrive under $HOME,
  * optional HDMS mounts under /mnt/<label>/…, virtual /var with writable /var/log/…
@@ -161,6 +184,7 @@ export const BARE_OS_WAVE9_PROC_FILE_TO_ID = Object.freeze({
  *   procBareOsWave7JsonText?: (wave7Id: string) => string,
  *   procBareOsWave8JsonText?: (wave8Id: string) => string,
  *   procBareOsWave9JsonText?: (wave9Id: string) => string,
+ *   procBareOsWave10JsonText?: (wave10Id: string) => string,
  *   getUnitJournalNdjson?: (unit: string) => string,
  *   getVirtualReaders?: () => Map<string, unknown>,
  *   unionReadPrefixes?: readonly string[],
@@ -351,6 +375,10 @@ export function createVfs(
     typeof vfsOptions.procBareOsWave9JsonText === 'function'
       ? vfsOptions.procBareOsWave9JsonText
       : null
+  const procBareOsWave10JsonText =
+    typeof vfsOptions.procBareOsWave10JsonText === 'function'
+      ? vfsOptions.procBareOsWave10JsonText
+      : null
   const getUnitJournalNdjson =
     typeof vfsOptions.getUnitJournalNdjson === 'function'
       ? vfsOptions.getUnitJournalNdjson
@@ -853,9 +881,21 @@ export function createVfs(
           return utf8Encode(t)
         }
       }
+      {
+        const wid10 = BARE_OS_WAVE10_PROC_FILE_TO_ID[f]
+        if (wid10) {
+          const t = procBareOsWave10JsonText
+            ? procBareOsWave10JsonText(wid10)
+            : `${JSON.stringify({
+                schema: 1,
+                note: 'wave10 proc provider missing'
+              })}\n`
+          return utf8Encode(t)
+        }
+      }
       if (f === 'bare_os_proc_index') {
         const idx = {
-          schema: 5,
+          schema: 6,
           description:
             'Stable aliases under /proc/bare_os/ (same payloads as flat /proc/bare_os_* files).',
           entries: [
@@ -1205,6 +1245,82 @@ export function createVfs(
             {
               name: 'form_data_delegate_limits_v2.json',
               path: '/proc/bare_os/form_data_delegate_limits_v2.json'
+            },
+            {
+              name: 'activity_queue_depth.json',
+              path: '/proc/bare_os/activity_queue_depth.json'
+            },
+            {
+              name: 'autobase_writer_hint.json',
+              path: '/proc/bare_os/autobase_writer_hint.json'
+            },
+            {
+              name: 'bare_boot_phase_map.json',
+              path: '/proc/bare_os/bare_boot_phase_map.json'
+            },
+            {
+              name: 'bare_inspect_policy.json',
+              path: '/proc/bare_os/bare_inspect_policy.json'
+            },
+            {
+              name: 'bare_logger_policy.json',
+              path: '/proc/bare_os/bare_logger_policy.json'
+            },
+            {
+              name: 'bare_performance_counters.json',
+              path: '/proc/bare_os/bare_performance_counters.json'
+            },
+            {
+              name: 'bare_rpc_registry_sketch.json',
+              path: '/proc/bare_os/bare_rpc_registry_sketch.json'
+            },
+            {
+              name: 'bare_signals_mask.json',
+              path: '/proc/bare_os/bare_signals_mask.json'
+            },
+            {
+              name: 'bare_stream_backpressure.json',
+              path: '/proc/bare_os/bare_stream_backpressure.json'
+            },
+            {
+              name: 'bare_timers_budget.json',
+              path: '/proc/bare_os/bare_timers_budget.json'
+            },
+            {
+              name: 'bare_tls_session_hint.json',
+              path: '/proc/bare_os/bare_tls_session_hint.json'
+            },
+            {
+              name: 'bare_ws_gateway_sketch.json',
+              path: '/proc/bare_os/bare_ws_gateway_sketch.json'
+            },
+            {
+              name: 'blind_pairing_sketch.json',
+              path: '/proc/bare_os/blind_pairing_sketch.json'
+            },
+            {
+              name: 'broadcast_encryption_hint.json',
+              path: '/proc/bare_os/broadcast_encryption_hint.json'
+            },
+            {
+              name: 'pear_api_allowlist_sketch.json',
+              path: '/proc/bare_os/pear_api_allowlist_sketch.json'
+            },
+            {
+              name: 'pear_doctor_state.json',
+              path: '/proc/bare_os/pear_doctor_state.json'
+            },
+            {
+              name: 'pear_rti_pointer.json',
+              path: '/proc/bare_os/pear_rti_pointer.json'
+            },
+            {
+              name: 'pear_user_dirs_map.json',
+              path: '/proc/bare_os/pear_user_dirs_map.json'
+            },
+            {
+              name: 'pear_workshop_flags.json',
+              path: '/proc/bare_os/pear_workshop_flags.json'
             }
           ]
         }
@@ -1555,6 +1671,44 @@ export function createVfs(
           'rlimits.json': 'bare_os_rlimits',
           hdms_health: 'bare_os_hdms_health',
           'hdms_health.json': 'bare_os_hdms_health',
+          activity_queue_depth: 'bare_os_activity_queue_depth',
+          'activity_queue_depth.json': 'bare_os_activity_queue_depth',
+          autobase_writer_hint: 'bare_os_autobase_writer_hint',
+          'autobase_writer_hint.json': 'bare_os_autobase_writer_hint',
+          bare_boot_phase_map: 'bare_os_bare_boot_phase_map',
+          'bare_boot_phase_map.json': 'bare_os_bare_boot_phase_map',
+          bare_inspect_policy: 'bare_os_bare_inspect_policy',
+          'bare_inspect_policy.json': 'bare_os_bare_inspect_policy',
+          bare_logger_policy: 'bare_os_bare_logger_policy',
+          'bare_logger_policy.json': 'bare_os_bare_logger_policy',
+          bare_performance_counters: 'bare_os_bare_performance_counters',
+          'bare_performance_counters.json': 'bare_os_bare_performance_counters',
+          bare_rpc_registry_sketch: 'bare_os_bare_rpc_registry_sketch',
+          'bare_rpc_registry_sketch.json': 'bare_os_bare_rpc_registry_sketch',
+          bare_signals_mask: 'bare_os_bare_signals_mask',
+          'bare_signals_mask.json': 'bare_os_bare_signals_mask',
+          bare_stream_backpressure: 'bare_os_bare_stream_backpressure',
+          'bare_stream_backpressure.json': 'bare_os_bare_stream_backpressure',
+          bare_timers_budget: 'bare_os_bare_timers_budget',
+          'bare_timers_budget.json': 'bare_os_bare_timers_budget',
+          bare_tls_session_hint: 'bare_os_bare_tls_session_hint',
+          'bare_tls_session_hint.json': 'bare_os_bare_tls_session_hint',
+          bare_ws_gateway_sketch: 'bare_os_bare_ws_gateway_sketch',
+          'bare_ws_gateway_sketch.json': 'bare_os_bare_ws_gateway_sketch',
+          blind_pairing_sketch: 'bare_os_blind_pairing_sketch',
+          'blind_pairing_sketch.json': 'bare_os_blind_pairing_sketch',
+          broadcast_encryption_hint: 'bare_os_broadcast_encryption_hint',
+          'broadcast_encryption_hint.json': 'bare_os_broadcast_encryption_hint',
+          pear_api_allowlist_sketch: 'bare_os_pear_api_allowlist_sketch',
+          'pear_api_allowlist_sketch.json': 'bare_os_pear_api_allowlist_sketch',
+          pear_doctor_state: 'bare_os_pear_doctor_state',
+          'pear_doctor_state.json': 'bare_os_pear_doctor_state',
+          pear_rti_pointer: 'bare_os_pear_rti_pointer',
+          'pear_rti_pointer.json': 'bare_os_pear_rti_pointer',
+          pear_user_dirs_map: 'bare_os_pear_user_dirs_map',
+          'pear_user_dirs_map.json': 'bare_os_pear_user_dirs_map',
+          pear_workshop_flags: 'bare_os_pear_workshop_flags',
+          'pear_workshop_flags.json': 'bare_os_pear_workshop_flags',
           'initd_graph.json': 'bare_os_initd_graph'
         }[rest]
         if (alias) {
@@ -1903,6 +2057,14 @@ export function createVfs(
             file: stripped
           }
         }
+        if (BARE_OS_WAVE10_PROC_FILE_TO_ID[stripped]) {
+          return {
+            virtualPseudo: true,
+            kind: 'proc',
+            node: 'file',
+            file: stripped
+          }
+        }
       }
       return { virtualPseudo: true, kind: 'proc', node: 'enoent' }
     }
@@ -2644,22 +2806,36 @@ export function createVfs(
       if (pr.kind === 'proc' && pr.node === 'root') {
         return [
           'bare_os',
+          'bare_os_activity_queue_depth.json',
           'bare_os_async_hooks_lag.json',
+          'bare_os_autobase_writer_hint.json',
           'bare_os_autopass_session_sketch.json',
+          'bare_os_bare_boot_phase_map.json',
           'bare_os_bare_crypto_policy.json',
           'bare_os_bare_daemon_hooks.json',
           'bare_os_bare_diagnostics_channel.json',
+          'bare_os_bare_inspect_policy.json',
           'bare_os_bare_ipc_bridge.json',
           'bare_os_bare_kit_bridge.json',
+          'bare_os_bare_logger_policy.json',
           'bare_os_bare_module_resolution.json',
           'bare_os_bare_net_interfaces.json',
+          'bare_os_bare_performance_counters.json',
+          'bare_os_bare_rpc_registry_sketch.json',
+          'bare_os_bare_signals_mask.json',
           'bare_os_bare_storage_quota.json',
+          'bare_os_bare_stream_backpressure.json',
           'bare_os_bare_thread_pool.json',
+          'bare_os_bare_timers_budget.json',
+          'bare_os_bare_tls_session_hint.json',
           'bare_os_bare_vm_sandbox_sketch.json',
           'bare_os_bare_worker_pool.json',
+          'bare_os_bare_ws_gateway_sketch.json',
+          'bare_os_blind_pairing_sketch.json',
           'bare_os_blind_relay_router.json',
           'bare_os_bootstrap',
           'bare_os_brittle_snapshot_ci.json',
+          'bare_os_broadcast_encryption_hint.json',
           'bare_os_build_attestation_pointer.json',
           'bare_os_capabilities',
           'bare_os_capabilities.json',
@@ -2668,13 +2844,13 @@ export function createVfs(
           'bare_os_corestore_gc_hint.json',
           'bare_os_debug.json',
           'bare_os_delegate_red.json',
-          'bare_os_drive_resolve_cache.json',
           'bare_os_dht_status.json',
           'bare_os_dns_map_active.json',
+          'bare_os_drive_resolve_cache.json',
           'bare_os_extensions.json',
           'bare_os_features',
-          'bare_os_form_data_delegate_limits.json',
           'bare_os_form_data_delegate_limits_v2.json',
+          'bare_os_form_data_delegate_limits.json',
           'bare_os_gip_transport_sketch.json',
           'bare_os_git_delegate_stats.json',
           'bare_os_git_lfs_pointer_stats.json',
@@ -2699,16 +2875,21 @@ export function createVfs(
           'bare_os_metrics_live.json',
           'bare_os_net_summary.json',
           'bare_os_oidc_publishing_pointer.json',
+          'bare_os_pear_api_allowlist_sketch.json',
           'bare_os_pear_appling_manifest.json',
           'bare_os_pear_build_fingerprint.json',
+          'bare_os_pear_doctor_state.json',
           'bare_os_pear_drop_events.json',
           'bare_os_pear_ipc_health.json',
           'bare_os_pear_radio_state.json',
+          'bare_os_pear_rti_pointer.json',
           'bare_os_pear_sidecar_bundle_index.json',
           'bare_os_pear_stage_pointer.json',
           'bare_os_pear_trust.json',
           'bare_os_pear_updater_state.json',
+          'bare_os_pear_user_dirs_map.json',
           'bare_os_pear_wakeups_schedule.json',
+          'bare_os_pear_workshop_flags.json',
           'bare_os_peer_health',
           'bare_os_protomux_channel_alias_v2.json',
           'bare_os_protomux_channels.json',
@@ -2758,22 +2939,36 @@ export function createVfs(
         pr.dir === 'bare_os_proc'
       ) {
         return [
+          'activity_queue_depth.json',
           'async_hooks_lag.json',
+          'autobase_writer_hint.json',
           'autopass_session_sketch.json',
+          'bare_boot_phase_map.json',
           'bare_crypto_policy.json',
           'bare_daemon_hooks.json',
           'bare_diagnostics_channel.json',
+          'bare_inspect_policy.json',
           'bare_ipc_bridge.json',
           'bare_kit_bridge.json',
+          'bare_logger_policy.json',
           'bare_module_resolution.json',
           'bare_net_interfaces.json',
+          'bare_performance_counters.json',
+          'bare_rpc_registry_sketch.json',
+          'bare_signals_mask.json',
           'bare_storage_quota.json',
+          'bare_stream_backpressure.json',
           'bare_thread_pool.json',
+          'bare_timers_budget.json',
+          'bare_tls_session_hint.json',
           'bare_vm_sandbox_sketch.json',
           'bare_worker_pool.json',
+          'bare_ws_gateway_sketch.json',
+          'blind_pairing_sketch.json',
           'blind_relay_router.json',
           'bootstrap',
           'brittle_snapshot_ci.json',
+          'broadcast_encryption_hint.json',
           'build_attestation_pointer.json',
           'capabilities',
           'capabilities.json',
@@ -2782,9 +2977,9 @@ export function createVfs(
           'corestore_gc_hint.json',
           'debug.json',
           'delegate_red.json',
-          'drive_resolve_cache.json',
           'dht_status.json',
           'dns_map_active.json',
+          'drive_resolve_cache.json',
           'extensions.json',
           'features',
           'form_data_delegate_limits.json',
@@ -2814,17 +3009,22 @@ export function createVfs(
           'metrics_live.json',
           'net_summary.json',
           'oidc_publishing_pointer.json',
+          'pear_api_allowlist_sketch.json',
           'pear_appling_manifest.json',
           'pear_build_fingerprint.json',
+          'pear_doctor_state.json',
           'pear_drop_events.json',
           'pear_ipc.json',
           'pear_ipc_health.json',
           'pear_radio_state.json',
+          'pear_rti_pointer.json',
           'pear_sidecar_bundle_index.json',
           'pear_stage_pointer.json',
           'pear_trust.json',
           'pear_updater_state.json',
+          'pear_user_dirs_map.json',
           'pear_wakeups_schedule.json',
+          'pear_workshop_flags.json',
           'peer_health',
           'protomux_channel_alias_v2.json',
           'protomux_channels.json',
@@ -2844,6 +3044,7 @@ export function createVfs(
           'seed_handshake',
           'session_stats',
           'slo_hints.json',
+          'snapshot_hints',
           'snapshot_hints.json',
           'staging_slot',
           'structured_clone_budget_v2.json',
@@ -2856,6 +3057,7 @@ export function createVfs(
           'version',
           'virtual_registry',
           'worker_budget.json'
+
         ]
       }
       if (pr.kind === 'proc' && pr.node === 'dir' && pr.dir === 'net') {

packages/bare-os-booter/test.js

@@ -856,22 +856,36 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
   t.ok(root.includes('dev'))
   t.alike(await vfs.readdir('/proc').then((a) => [...a].sort()), [
     'bare_os',
+    'bare_os_activity_queue_depth.json',
     'bare_os_async_hooks_lag.json',
+    'bare_os_autobase_writer_hint.json',
     'bare_os_autopass_session_sketch.json',
+    'bare_os_bare_boot_phase_map.json',
     'bare_os_bare_crypto_policy.json',
     'bare_os_bare_daemon_hooks.json',
     'bare_os_bare_diagnostics_channel.json',
+    'bare_os_bare_inspect_policy.json',
     'bare_os_bare_ipc_bridge.json',
     'bare_os_bare_kit_bridge.json',
+    'bare_os_bare_logger_policy.json',
     'bare_os_bare_module_resolution.json',
     'bare_os_bare_net_interfaces.json',
+    'bare_os_bare_performance_counters.json',
+    'bare_os_bare_rpc_registry_sketch.json',
+    'bare_os_bare_signals_mask.json',
     'bare_os_bare_storage_quota.json',
+    'bare_os_bare_stream_backpressure.json',
     'bare_os_bare_thread_pool.json',
+    'bare_os_bare_timers_budget.json',
+    'bare_os_bare_tls_session_hint.json',
     'bare_os_bare_vm_sandbox_sketch.json',
     'bare_os_bare_worker_pool.json',
+    'bare_os_bare_ws_gateway_sketch.json',
+    'bare_os_blind_pairing_sketch.json',
     'bare_os_blind_relay_router.json',
     'bare_os_bootstrap',
     'bare_os_brittle_snapshot_ci.json',
+    'bare_os_broadcast_encryption_hint.json',
     'bare_os_build_attestation_pointer.json',
     'bare_os_capabilities',
     'bare_os_capabilities.json',
@@ -911,16 +925,21 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
     'bare_os_metrics_live.json',
     'bare_os_net_summary.json',
     'bare_os_oidc_publishing_pointer.json',
+    'bare_os_pear_api_allowlist_sketch.json',
     'bare_os_pear_appling_manifest.json',
     'bare_os_pear_build_fingerprint.json',
+    'bare_os_pear_doctor_state.json',
     'bare_os_pear_drop_events.json',
     'bare_os_pear_ipc_health.json',
     'bare_os_pear_radio_state.json',
+    'bare_os_pear_rti_pointer.json',
     'bare_os_pear_sidecar_bundle_index.json',
     'bare_os_pear_stage_pointer.json',
     'bare_os_pear_trust.json',
     'bare_os_pear_updater_state.json',
+    'bare_os_pear_user_dirs_map.json',
     'bare_os_pear_wakeups_schedule.json',
+    'bare_os_pear_workshop_flags.json',
     'bare_os_peer_health',
     'bare_os_protomux_channel_alias_v2.json',
     'bare_os_protomux_channels.json',

packages/bare-os-coreutils/lib/commands.mjs

@@ -91,9 +91,11 @@ export const COREUTILS_COMMANDS = [
   'sleep',
   'sort',
   'split',
+  'ssh-keygen',
   'stat',
   'sum',
   'sync',
+  'tar',
   'tac',
   'tail',
   'tee',

packages/bare-os-coreutils/man/pages/ssh-keygen.json

@@ -0,0 +1,10 @@
+{
+  "name": "ssh-keygen",
+  "section": 1,
+  "title": "ssh-keygen",
+  "synopsis": ["ssh-keygen [OPTION]..."],
+  "description": "Bare OS stub only. Key generation uses bare-crypto / Pear host tooling; guests must not rely on node:crypto.",
+  "options": [],
+  "keywords": ["ssh-keygen", "bare-crypto", "bare-os", "coreutils"],
+  "bareOsNotes": "See developer-guide/node-to-bare-modules.md and handbook ch.9."
+}

packages/bare-os-coreutils/man/pages/tar.json

@@ -0,0 +1,10 @@
+{
+  "name": "tar",
+  "section": 1,
+  "title": "tar",
+  "synopsis": ["tar [--bare-os-wave10-xattr-sketch]"],
+  "description": "Bare OS stub. Emits a bounded JSON xattr sketch when --bare-os-wave10-xattr-sketch is passed; otherwise directs operators to Pear/bare-pack tooling.",
+  "options": [],
+  "keywords": ["tar", "xattr", "bare-os", "coreutils"],
+  "bareOsNotes": "Handbook ch.9 — archive operations are not implemented in stock coreutils."
+}

packages/bare-os-coreutils/src/ssh-keygen.js

@@ -0,0 +1,21 @@
+/**
+ * Non-crypto stub: Pear/Bare guests must not use Node `node:crypto` for keys.
+ * Operators use host **`bare-crypto`** / Pear tooling; see developer-guide Node→Bare map.
+ */
+async function run(ctx, argv) {
+  const args = argv.slice(1)
+  if (args.includes('-h') || args.includes('--help') || args.includes('-?')) {
+    ctx.console.log(
+      'Usage: ssh-keygen (stub)\n' +
+        'Bare OS does not generate SSH keys in-guest. Use bare-crypto / Pear host workflows.\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  ctx.console.error(
+    'ssh-keygen: Bare OS stub only — use bare-crypto and host key tooling (no node:crypto in guest).'
+  )
+  ctx.exitCode = 1
+}
+
+export { run }

packages/bare-os-coreutils/src/tar.js

@@ -0,0 +1,36 @@
+/**
+ * Wave 10: bounded extended-attribute metadata sketch only (no archive I/O).
+ * Full archive workflows use Pear pack / bare-pack tooling outside the stub.
+ */
+async function run(ctx, argv) {
+  const args = argv.slice(1)
+  if (
+    args.includes('--bare-os-wave10-xattr-sketch') ||
+    args.includes('--bare-os-xattr-sketch')
+  ) {
+    ctx.console.log(
+      JSON.stringify({
+        schema: 1,
+        note: 'tar xattr subset stub; no archive bytes read in stock coreutils',
+        entries: [],
+        atMs: Date.now()
+      }) + '\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  if (args.includes('-h') || args.includes('--help')) {
+    ctx.console.log(
+      'Usage: tar [--bare-os-wave10-xattr-sketch]\n' +
+        'Bare OS tar is a documentation stub; use Pear/bare-pack for bundles.\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  ctx.console.error(
+    'tar: Bare OS stub — pass --bare-os-wave10-xattr-sketch for JSON sketch or use host pack tools.'
+  )
+  ctx.exitCode = 1
+}
+
+export { run }

packages/bare-os-coreutils/src/xargs.js

@@ -3,12 +3,14 @@
  * Limits: stdin 256KiB, 4096 whitespace/null tokens, 128 args per invocation,
  * 64 invocations per run. Exceeding limits is a fatal error (exit 125).
  * Supports -0/--null, -n, -I repl (replace repl in utility argv; implies -n 1 unless -n given).
+ * -P N is accepted; stock booter runs sequentially; N is capped at MAX_P_FLAG (4).
  */
 
 const MAX_STDIN = 256 * 1024
 const MAX_TOKENS = 4096
 const MAX_PER_INVOCATION = 128
 const MAX_INVOCATIONS = 64
+const MAX_P_FLAG = 4
 
 async function run(ctx, argv) {
   if (typeof ctx.runBinCommand !== 'function') {
@@ -24,6 +26,7 @@ async function run(ctx, argv) {
   /** @type {string | null} */
   let repl = null
   let nExplicit = false
+  let pCap = 1
   let i = 0
 
   while (i < args.length && args[i].startsWith('-')) {
@@ -37,6 +40,40 @@ async function run(ctx, argv) {
       i++
       continue
     }
+    if (a === '-P' || a === '--max-procs') {
+      const n = args[i + 1]
+      if (n == null || !/^\d+$/.test(n)) {
+        ctx.console.error('xargs: -P requires a non-negative integer')
+        ctx.exitCode = 1
+        return
+      }
+      const raw = Number(n)
+      pCap = Math.min(MAX_P_FLAG, Math.max(1, raw))
+      if (raw > MAX_P_FLAG) {
+        ctx.console.error(
+          'xargs: -P ' +
+            raw +
+            ' exceeds Bare OS cap ' +
+            MAX_P_FLAG +
+            ' (parallelism hint only; sequential execution)'
+        )
+      }
+      i += 2
+      continue
+    }
+    if (a.startsWith('-P') && a.length > 2 && /^\d+$/.test(a.slice(2))) {
+      const raw = Number(a.slice(2))
+      pCap = Math.min(MAX_P_FLAG, Math.max(1, raw))
+      if (raw > MAX_P_FLAG) {
+        ctx.console.error(
+          'xargs: -P exceeds Bare OS cap ' +
+            MAX_P_FLAG +
+            ' (parallelism hint only; sequential execution)'
+        )
+      }
+      i++
+      continue
+    }
     if (a === '-n' || a === '--max-args') {
       const n = args[i + 1]
       if (n == null || !/^\d+$/.test(n) || Number(n) < 1) {
@@ -76,7 +113,9 @@ async function run(ctx, argv) {
     ctx.console.error(
       'xargs: Bare OS supports: -0/--null, -n N (max ' +
         MAX_PER_INVOCATION +
-        ' per run), -I repl'
+        ' per run), -I repl, -P N (max ' +
+        MAX_P_FLAG +
+        ', sequential)'
     )
     ctx.exitCode = 1
     return
@@ -85,6 +124,7 @@ async function run(ctx, argv) {
   /** @type {string[]} */
   let cmd = args.slice(i)
   if (cmd.length === 0) cmd = ['echo']
+  void pCap
 
   let text = bareStdin(ctx) || ''
   if (text.length > MAX_STDIN) {

packages/bare-os-protocol/README.md

@@ -10,9 +10,9 @@ Shared **wire format and constants** for the Bare operating system monorepo: Hyp
 | `topicKey()`                    | 32-byte topic for `swarm.join()`                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `BLOCK_SIZE`, `MBR_MAGIC`       | 512-byte MBR, magic `BIOS` at offset 0                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `buildMbr` / `parseMbr`         | Pack/unpack primary + optional failover Hyperdrive keys                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `setupSeedChannel`              | Wire Protomux messages 0–6 for RAM block reads, gossip bitfield, manifest path **search**, **RPC** (incl. `bare_os.capabilities` with **`bits`** … **`bits9`** when non-zero, typed errors for unknown RPC methods, `bare_os.replication_status`, `bare_os.replication_queue`, wave 6–9 RPC short names in **`seed-rpc-methods.js`**, `bare_os.gossip`), and `drive.replicate` |
+| `setupSeedChannel`              | Wire Protomux messages 0–6 for RAM block reads, gossip bitfield, manifest path **search**, **RPC** (incl. `bare_os.capabilities` with **`bits`** … **`bits10`** when non-zero, typed errors for unknown RPC methods, `bare_os.replication_status`, `bare_os.replication_queue`, wave 6–10 RPC short names in **`seed-rpc-methods.js`**, `bare_os.gossip`), and `drive.replicate` |
 
-Subpath exports: `bare-os-protocol/constants.js`, `bare-os-protocol/messages` (compact-encoding schemas), `bare-os-protocol/kernel-feature-bits.js` (documented booter capability words **`STOCK_V1`** … **`STOCK_V9`**; **`BARE_OS_KERNEL_FEATURE_BITS_DOC=11`**; surfaced in **`/proc/bare_os_features`** and **`/proc/bare_os/`**), `bare-os-protocol/lib/seed-rpc-methods.js` (authoritative **`bare_os.*`** RPC name list for **`kernel_info`**), `bare-os-protocol/protocol-meta.js` (**`BARE_OS_PROTOCOL_PACKAGE_VERSION`** for the seed handshake).
+Subpath exports: `bare-os-protocol/constants.js`, `bare-os-protocol/messages` (compact-encoding schemas), `bare-os-protocol/kernel-feature-bits.js` (documented booter capability words **`STOCK_V1`** … **`STOCK_V10`**; **`BARE_OS_KERNEL_FEATURE_BITS_DOC=12`**; surfaced in **`/proc/bare_os_features`** and **`/proc/bare_os/`**), `bare-os-protocol/lib/seed-rpc-methods.js` (authoritative **`bare_os.*`** RPC name list for **`kernel_info`**), `bare-os-protocol/protocol-meta.js` (**`BARE_OS_PROTOCOL_PACKAGE_VERSION`** for the seed handshake).
 
 ## Consumers
 

packages/bare-os-protocol/index.js

@@ -174,5 +174,19 @@ export {
   BARE_OS_FEATURE9_WORKER_NET_WAVE9,
   BARE_OS_FEATURE9_TELEMETRY_AUDIT_WAVE9,
   BARE_OS_FEATURE9_DOC_CI_WAVE9,
-  BARE_OS_FEATURE9_HTTP_DHT_PROXY_ROUTES_V2
+  BARE_OS_FEATURE9_HTTP_DHT_PROXY_ROUTES_V2,
+  BARE_OS_KERNEL_FEATURES_STOCK_V10,
+  BARE_OS_FEATURE10_CAP_WORD,
+  BARE_OS_FEATURE10_SEED_RPC_WAVE10,
+  BARE_OS_FEATURE10_REPLICATION_JSON_WAVE10,
+  BARE_OS_FEATURE10_PROC_METRICS_WAVE10,
+  BARE_OS_FEATURE10_BOOT_POLICY_V10,
+  BARE_OS_FEATURE10_KERNEL_EXT_REGISTRY_V7,
+  BARE_OS_FEATURE10_PEAR_BARE_BRIDGE_WAVE10,
+  BARE_OS_FEATURE10_VFS_POSIX_WAVE10,
+  BARE_OS_FEATURE10_INITD_SUBPROC_WAVE10,
+  BARE_OS_FEATURE10_WORKER_NET_WAVE10,
+  BARE_OS_FEATURE10_TELEMETRY_AUDIT_WAVE10,
+  BARE_OS_FEATURE10_DOC_CI_WAVE10,
+  BARE_OS_FEATURE10_COMPACT_READY_RPC_V4
 } from './lib/kernel-feature-bits.js'

packages/bare-os-protocol/lib/channel.js

@@ -11,7 +11,8 @@ import {
   BARE_OS_KERNEL_FEATURES_STOCK_V6,
   BARE_OS_KERNEL_FEATURES_STOCK_V7,
   BARE_OS_KERNEL_FEATURES_STOCK_V8,
-  BARE_OS_KERNEL_FEATURES_STOCK_V9
+  BARE_OS_KERNEL_FEATURES_STOCK_V9,
+  BARE_OS_KERNEL_FEATURES_STOCK_V10
 } from './kernel-feature-bits.js'
 import {
   BARE_OS_SEED_RPC_METHODS,
@@ -121,7 +122,37 @@ import {
  *   mirrorDriveCompactionV4Json?: string,
  *   readyGuardV3Json?: string,
  *   blindRelayCircuitV2Json?: string,
- *   httpDhtProxyRoutesV2Json?: string
+ *   httpDhtProxyRoutesV2Json?: string,
+ *   pearBundleTier?: string,
+ *   autobaseDiscoveryHintJson?: string,
+ *   handshakeTokenBucketV4Json?: string,
+ *   peerFirewallStatsV5Json?: string,
+ *   stagingSlotWave10Json?: string,
+ *   compactPingV4Json?: string,
+ *   seederPearRuntimeBareFingerprint?: string,
+ *   pearDoctorHintJson?: string,
+ *   pearInfoSketchJson?: string,
+ *   pearInspectCapsJson?: string,
+ *   pearDumpBudgetJson?: string,
+ *   pearResetGuardJson?: string,
+ *   pearRestartWindowJson?: string,
+ *   pearRunFlagsJson?: string,
+ *   pearBundleManifestSliceJson?: string,
+ *   pearPackLayoutHintJson?: string,
+ *   pearSeedTopologyJson?: string,
+ *   pearStateSnapshotJson?: string,
+ *   pearStampPointerJson?: string,
+ *   pearShakeLatencyJson?: string,
+ *   pearCrasherClassJson?: string,
+ *   pearErrorsRateHintJson?: string,
+ *   pearBridgeHealthJson?: string,
+ *   pearLinkMatrixJson?: string,
+ *   pearPipeBackpressureJson?: string,
+ *   pearOpwaitBudgetJson?: string,
+ *   pearTerminalCapsJson?: string,
+ *   readyGuardV4Json?: string,
+ *   mirrorDriveCompactionV5Json?: string,
+ *   blindRelayCircuitV3Json?: string
  * }} [opts]
  */
 export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
@@ -222,6 +253,14 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
   const seederPearApplingId = String(opts.seederPearApplingId ?? '')
     .trim()
     .slice(0, 256)
+  const seederPearRuntimeBareFingerprint = String(
+    opts.seederPearRuntimeBareFingerprint ?? ''
+  )
+    .trim()
+    .slice(0, 256)
+  const pearBundleTier = String(opts.pearBundleTier ?? '')
+    .trim()
+    .slice(0, 64)
   const compactPingEncodingHint = String(opts.compactPingEncodingHint ?? '')
     .trim()
     .slice(0, 64)
@@ -345,7 +384,9 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
             pearRuntimeFingerprint:
               seederPearRuntimeFingerprint || undefined,
             booterPackageVersion: booterPackageVersionHint || undefined,
-            pearApplingId: seederPearApplingId || undefined
+            pearApplingId: seederPearApplingId || undefined,
+            pearRuntimeBareFingerprint:
+              seederPearRuntimeBareFingerprint || undefined
           }),
           error: ''
         })
@@ -367,6 +408,7 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
             bits7: BARE_OS_KERNEL_FEATURES_STOCK_V7 >>> 0,
             bits8: BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0,
             bits9: BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0,
+            bits10: BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0,
             protocolPackageVersion: BARE_OS_PROTOCOL_PACKAGE_VERSION,
             booterPackageVersion: booterPackageVersionHint || undefined,
             role: 'seeder',
@@ -407,6 +449,11 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
           rs.pearUpdaterDelegate = pearUpdaterDelegateClass
         const tb3 = parseOptJson(opts.handshakeTokenBucketV3Json)
         if (tb3) rs.handshakeTokenBucketV3 = tb3
+        if (pearBundleTier) rs.pearBundleTier = pearBundleTier
+        const abdisc = parseOptJson(opts.autobaseDiscoveryHintJson)
+        if (abdisc) rs.autobaseDiscoveryHint = abdisc
+        const tb4 = parseOptJson(opts.handshakeTokenBucketV4Json)
+        if (tb4) rs.handshakeTokenBucketV4 = tb4
         chan.messages[6].send({
           id: m.id,
           success: true,
@@ -470,7 +517,7 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
           result: JSON.stringify({
             role: 'seeder',
             protocol: PROTOCOL_NAME,
-            schema: 6,
+            schema: 7,
             activeSlot: stagingActiveSlot,
             pendingSlot: stagingPendingSlot || null,
             previousSlot: stagingPreviousSlot || null,
@@ -478,12 +525,15 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
             drainDeadlineMs: stagingDrainDeadlineMs,
             quarantine: parseOptJson(opts.stagingQuarantineJson),
             wave9: parseOptJson(opts.stagingSlotWave9Json),
+            wave10: parseOptJson(opts.stagingSlotWave10Json),
             rollbackHint:
               'pending slot is rollback candidate when switching A/B; verify image before activate',
             tripleSlotNote:
               'canarySlot is optional third slot metadata for staged rollouts (operator-defined).',
             schema6Note:
               'schema 6 adds optional wave9 operator blob; schema 5 fields remain stable.',
+            schema7Note:
+              'schema 7 adds optional wave10 operator blob; prior fields remain stable.',
             atMs: Date.now()
           }),
           error: ''
@@ -636,6 +686,8 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
         if (sat) stats.saturationClass = sat
         const fw4 = parseOptJson(opts.peerFirewallStatsV4Json)
         if (fw4) stats.wave9 = fw4
+        const fw5 = parseOptJson(opts.peerFirewallStatsV5Json)
+        if (fw5) stats.wave10 = fw5
         chan.messages[6].send({
           id: m.id,
           success: true,
@@ -643,7 +695,7 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
             role: 'seeder',
             protocol: PROTOCOL_NAME,
             firewall: stats,
-            firewallSchema: 4,
+            firewallSchema: 5,
             atMs: Date.now()
           }),
           error: ''
@@ -754,6 +806,7 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
           perf && typeof perf.now === 'function'
             ? Math.floor(perf.now() * 1000)
             : Date.now() * 1000
+        const v4 = parseOptJson(opts.compactPingV4Json)
         chan.messages[6].send({
           id: m.id,
           success: true,
@@ -762,8 +815,9 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
             pong: true,
             tUs,
             protocol: PROTOCOL_NAME,
-            schema: 3,
+            schema: 4,
-            encodingHint: compactPingEncodingHint || undefined
+            encodingHint: compactPingEncodingHint || undefined,
+            wave10: v4 || undefined
           }),
           error: ''
         })
@@ -1282,6 +1336,194 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
         })
         return
       }
+      if (m.module === 'bare_os' && m.method === 'pear_doctor_hint') {
+        const h = parseOptJson(opts.pearDoctorHintJson)
+        sendWave9Rpc({
+          doctor: h || { note: 'pear-doctor health class (non-secret)' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_info_sketch') {
+        const h = parseOptJson(opts.pearInfoSketchJson)
+        sendWave9Rpc({
+          info: h || { note: 'pear-info build/runtime pointer' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_inspect_caps') {
+        const h = parseOptJson(opts.pearInspectCapsJson)
+        sendWave9Rpc({
+          inspect: h || { note: 'pear-inspect capability flags' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_dump_budget') {
+        const h = parseOptJson(opts.pearDumpBudgetJson)
+        sendWave9Rpc({
+          dumpBudget: h || { note: 'pear-dump export budget class' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_reset_guard') {
+        const h = parseOptJson(opts.pearResetGuardJson)
+        sendWave9Rpc({
+          resetGuard: h || { note: 'pear-reset policy hint' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_restart_window') {
+        const h = parseOptJson(opts.pearRestartWindowJson)
+        sendWave9Rpc({
+          restartWindow: h || { note: 'pear-restart backoff window' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_run_flags') {
+        const h = parseOptJson(opts.pearRunFlagsJson)
+        sendWave9Rpc({
+          runFlags: h || { note: 'pear-run mode flags' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_bundle_manifest_slice') {
+        const h = parseOptJson(opts.pearBundleManifestSliceJson)
+        sendWave9Rpc({
+          bundleSlice: h || { note: 'pear-bundle manifest sample' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_pack_layout_hint') {
+        const h = parseOptJson(opts.pearPackLayoutHintJson)
+        sendWave9Rpc({
+          packLayout: h || { note: 'pear-pack layout operator hint' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_seed_topology') {
+        const h = parseOptJson(opts.pearSeedTopologyJson)
+        sendWave9Rpc({
+          seedTopology: h || { note: 'pear-seed graph sketch' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_state_snapshot') {
+        const h = parseOptJson(opts.pearStateSnapshotJson)
+        sendWave9Rpc({
+          stateSnapshot: h || { note: 'pear-state volatile class' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_stamp_pointer') {
+        const h = parseOptJson(opts.pearStampPointerJson)
+        sendWave9Rpc({
+          stamp: h || { note: 'pear-stamp provenance pointer' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_shake_latency') {
+        const h = parseOptJson(opts.pearShakeLatencyJson)
+        sendWave9Rpc({
+          shakeLatency: h || { note: 'pear-shake handshake latency sketch' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_crasher_class') {
+        const h = parseOptJson(opts.pearCrasherClassJson)
+        sendWave9Rpc({
+          crasherClass: h || { note: 'pear-crasher reporting class (non-secret)' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_errors_rate_hint') {
+        const h = parseOptJson(opts.pearErrorsRateHintJson)
+        sendWave9Rpc({
+          errorsRate: h || { note: 'pear-errors taxonomy rate bucket' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_bridge_health') {
+        const h = parseOptJson(opts.pearBridgeHealthJson)
+        sendWave9Rpc({
+          bridgeHealth: h || { note: 'pear-bridge health sketch' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_link_matrix') {
+        const h = parseOptJson(opts.pearLinkMatrixJson)
+        sendWave9Rpc({
+          linkMatrix: h || { note: 'pear-link alias matrix' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_pipe_backpressure') {
+        const h = parseOptJson(opts.pearPipeBackpressureJson)
+        sendWave9Rpc({
+          pipeBackpressure: h || { note: 'pear-pipe backlog class' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_opwait_budget') {
+        const h = parseOptJson(opts.pearOpwaitBudgetJson)
+        sendWave9Rpc({
+          opwaitBudget: h || { note: 'pear-opwait budget' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_terminal_caps') {
+        const h = parseOptJson(opts.pearTerminalCapsJson)
+        sendWave9Rpc({
+          terminalCaps: h || { note: 'pear-terminal capability flags' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'ready_guard_v4') {
+        const h = parseOptJson(opts.readyGuardV4Json)
+        sendWave9Rpc({
+          readyGuardV4:
+            h || { matrix: [], note: 'ready-guard v4 enum expansion' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'mirror_drive_compaction_v5') {
+        const h = parseOptJson(opts.mirrorDriveCompactionV5Json)
+        sendWave9Rpc({
+          compactionV5:
+            h || { phases: [], note: 'mirror-drive compaction enum v5' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'blind_relay_circuit_v3') {
+        const h = parseOptJson(opts.blindRelayCircuitV3Json)
+        sendWave9Rpc({
+          circuitsV3:
+            h || { note: 'blind-relay circuit v3 reason codes' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'compact_ping_v4') {
+        const perf = globalThis.performance
+        const tUs =
+          perf && typeof perf.now === 'function'
+            ? Math.floor(perf.now() * 1000)
+            : Date.now() * 1000
+        const v4 = parseOptJson(opts.compactPingV4Json)
+        chan.messages[6].send({
+          id: m.id,
+          success: true,
+          result: JSON.stringify({
+            role: 'seeder',
+            pong: true,
+            tUs,
+            protocol: PROTOCOL_NAME,
+            schema: 4,
+            variant: 'compact_ping_v4',
+            wave10: v4 || { note: 'compact ping v4 dedicated RPC' },
+            atMs: Date.now()
+          }),
+          error: ''
+        })
+        return
+      }
       chan.messages[6].send({
         id: m.id,
         success: false,

packages/bare-os-protocol/lib/kernel-feature-bits.js

@@ -4,7 +4,7 @@
  */
 
 /** Protocol document version for this bitmask file (bump when bit semantics or governance changes). */
-export const BARE_OS_KERNEL_FEATURE_BITS_DOC = 11
+export const BARE_OS_KERNEL_FEATURE_BITS_DOC = 12
 
 /**
  * Second capability word (bits 0–31, always use `>>> 0` when masking).
@@ -474,6 +474,52 @@ export const BARE_OS_KERNEL_FEATURES_STOCK_V9 =
   BARE_OS_FEATURE9_DOC_CI_WAVE9 |
   BARE_OS_FEATURE9_HTTP_DHT_PROXY_ROUTES_V2
 
+/**
+ * Tenth capability word (bits 0–31, use `>>> 0`). Wave 10 mega-phase — ADR 001 §13.
+ */
+/** Word10 bit 0: `bits10` on seed `capabilities` + `/proc/bare_os_features`. */
+export const BARE_OS_FEATURE10_CAP_WORD = 1 << 0
+/** Word10 bit 1: Extended seed RPCs (pear_doctor_hint, pear_inspect_caps, …). */
+export const BARE_OS_FEATURE10_SEED_RPC_WAVE10 = 1 << 1
+/** Word10 bit 2: Replication JSON / staging schema 7 / kernel_info wave 10 adjuncts. */
+export const BARE_OS_FEATURE10_REPLICATION_JSON_WAVE10 = 1 << 2
+/** Word10 bit 3: Wave 10 `/proc/bare_os/*.json` (bare-boot, bare-rpc, pear-doctor, …). */
+export const BARE_OS_FEATURE10_PROC_METRICS_WAVE10 = 1 << 3
+/** Word10 bit 4: Boot policy v10 (`requireFeatureBits10`, `requireBareBootMin`, …). */
+export const BARE_OS_FEATURE10_BOOT_POLICY_V10 = 1 << 4
+/** Word10 bit 5: Kernel extension registry schema 7 + extensionSignerPins v3 hints. */
+export const BARE_OS_FEATURE10_KERNEL_EXT_REGISTRY_V7 = 1 << 5
+/** Word10 bit 6: Pear/Bare bridge wave 10 (doctor hint, bare logger tap, …). */
+export const BARE_OS_FEATURE10_PEAR_BARE_BRIDGE_WAVE10 = 1 << 6
+/** Word10 bit 7: VFS/POSIX/shell wave 10 (ssh-keygen stub, xargs -P, tar xattr). */
+export const BARE_OS_FEATURE10_VFS_POSIX_WAVE10 = 1 << 7
+/** Word10 bit 8: Initd / subprocess / git worktree policy wave 10. */
+export const BARE_OS_FEATURE10_INITD_SUBPROC_WAVE10 = 1 << 8
+/** Word10 bit 9: Workers / sandbox / net wave 10 (`sysproc:*`, mTLS map, happy eyeballs v4). */
+export const BARE_OS_FEATURE10_WORKER_NET_WAVE10 = 1 << 9
+/** Word10 bit 10: Telemetry NDJSON v9 / OTel v7 / audit v7. */
+export const BARE_OS_FEATURE10_TELEMETRY_AUDIT_WAVE10 = 1 << 10
+/** Word10 bit 11: CI (`verify-kernel-roadmap-wave10`). */
+export const BARE_OS_FEATURE10_DOC_CI_WAVE10 = 1 << 11
+/** Word10 bit 12: Seed RPC `compact_ping_v4` + `ready_guard_v4` surface. */
+export const BARE_OS_FEATURE10_COMPACT_READY_RPC_V4 = 1 << 12
+
+/** Stock booter tenth word (wave 10). */
+export const BARE_OS_KERNEL_FEATURES_STOCK_V10 =
+  BARE_OS_FEATURE10_CAP_WORD |
+  BARE_OS_FEATURE10_SEED_RPC_WAVE10 |
+  BARE_OS_FEATURE10_REPLICATION_JSON_WAVE10 |
+  BARE_OS_FEATURE10_PROC_METRICS_WAVE10 |
+  BARE_OS_FEATURE10_BOOT_POLICY_V10 |
+  BARE_OS_FEATURE10_KERNEL_EXT_REGISTRY_V7 |
+  BARE_OS_FEATURE10_PEAR_BARE_BRIDGE_WAVE10 |
+  BARE_OS_FEATURE10_VFS_POSIX_WAVE10 |
+  BARE_OS_FEATURE10_INITD_SUBPROC_WAVE10 |
+  BARE_OS_FEATURE10_WORKER_NET_WAVE10 |
+  BARE_OS_FEATURE10_TELEMETRY_AUDIT_WAVE10 |
+  BARE_OS_FEATURE10_DOC_CI_WAVE10 |
+  BARE_OS_FEATURE10_COMPACT_READY_RPC_V4
+
 /** Bit 0: IPC fan-out / pub-sub style channels (booter `bareOsIpc`). */
 export const BARE_OS_FEATURE_IPC_FANOUT = 1 << 0
 

packages/bare-os-protocol/lib/protocol-meta.js

@@ -2,4 +2,4 @@
  * Published package version string for seed-channel handshake (keep in sync with package.json).
  * @type {string}
  */
-export const BARE_OS_PROTOCOL_PACKAGE_VERSION = '0.5.0'
+export const BARE_OS_PROTOCOL_PACKAGE_VERSION = '0.6.0'

packages/bare-os-protocol/lib/seed-rpc-methods.js

@@ -65,7 +65,31 @@ export const BARE_OS_SEED_RPC_METHOD_SHORT_NAMES = [
   'mirror_drive_compaction_v4',
   'ready_guard_v3',
   'blind_relay_circuit_v2',
-  'http_dht_proxy_routes_v2'
+  'http_dht_proxy_routes_v2',
+  'pear_doctor_hint',
+  'pear_info_sketch',
+  'pear_inspect_caps',
+  'pear_dump_budget',
+  'pear_reset_guard',
+  'pear_restart_window',
+  'pear_run_flags',
+  'pear_bundle_manifest_slice',
+  'pear_pack_layout_hint',
+  'pear_seed_topology',
+  'pear_state_snapshot',
+  'pear_stamp_pointer',
+  'pear_shake_latency',
+  'pear_crasher_class',
+  'pear_errors_rate_hint',
+  'pear_bridge_health',
+  'pear_link_matrix',
+  'pear_pipe_backpressure',
+  'pear_opwait_budget',
+  'pear_terminal_caps',
+  'ready_guard_v4',
+  'mirror_drive_compaction_v5',
+  'blind_relay_circuit_v3',
+  'compact_ping_v4'
 ]
 
 /** @type {Set<string>} */

packages/bare-os-protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-os-protocol",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "MBR layout, swarm topic, and Protomux encodings for bare-operating-system",
   "type": "module",
   "main": "./index.js",

packages/bare-os-protocol/test.js

@@ -17,7 +17,8 @@ import {
   BARE_OS_KERNEL_FEATURES_STOCK_V6,
   BARE_OS_KERNEL_FEATURES_STOCK_V7,
   BARE_OS_KERNEL_FEATURES_STOCK_V8,
-  BARE_OS_KERNEL_FEATURES_STOCK_V9
+  BARE_OS_KERNEL_FEATURES_STOCK_V9,
+  BARE_OS_KERNEL_FEATURES_STOCK_V10
 } from './lib/kernel-feature-bits.js'
 import { msgDataEncoding, msgSearchReqEncoding } from './lib/messages.js'
 test('topicKey is deterministic 32-byte hash', (t) => {
@@ -98,3 +99,7 @@ test('STOCK_V8 is non-zero wave-8 advertisement', (t) => {
 test('STOCK_V9 is non-zero wave-9 advertisement', (t) => {
   t.ok((BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0) > 0)
 })
+
+test('STOCK_V10 is non-zero wave-10 advertisement', (t) => {
+  t.ok((BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0) > 0)
+})

packages/bare-os-seeder/index.js

@@ -385,6 +385,32 @@ async function main() {
     ),
     httpDhtProxyRoutesV2Json: String(
       hostEnv?.BARE_OS_SEED_HTTP_DHT_PROXY_ROUTES_V2_JSON ?? ''
+    ),
+    pearBundleTier: String(hostEnv?.BARE_OS_SEED_PEAR_BUNDLE_TIER ?? ''),
+    autobaseDiscoveryHintJson: String(
+      hostEnv?.BARE_OS_SEED_AUTOBASE_DISCOVERY_HINT_JSON ?? ''
+    ),
+    handshakeTokenBucketV4Json: String(
+      hostEnv?.BARE_OS_SEED_HANDSHAKE_TOKEN_BUCKET_V4_JSON ?? ''
+    ),
+    peerFirewallStatsV5Json: String(
+      hostEnv?.BARE_OS_SEED_PEER_FIREWALL_STATS_V5_JSON ?? ''
+    ),
+    stagingSlotWave10Json: String(
+      hostEnv?.BARE_OS_SEED_STAGING_SLOT_WAVE10_JSON ?? ''
+    ),
+    compactPingV4Json: String(
+      hostEnv?.BARE_OS_SEED_COMPACT_PING_V4_JSON ?? ''
+    ),
+    readyGuardV4Json: String(hostEnv?.BARE_OS_SEED_READY_GUARD_V4_JSON ?? ''),
+    mirrorDriveCompactionV5Json: String(
+      hostEnv?.BARE_OS_SEED_MIRROR_DRIVE_COMPACTION_V5_JSON ?? ''
+    ),
+    blindRelayCircuitV3Json: String(
+      hostEnv?.BARE_OS_SEED_BLIND_RELAY_CIRCUIT_V3_JSON ?? ''
+    ),
+    seederPearRuntimeBareFingerprint: String(
+      hostEnv?.BARE_OS_SEED_PEAR_RUNTIME_BARE_FINGERPRINT ?? ''
     )
   }
 

packages/bare-os-seeder/kernel/README.md

@@ -19,7 +19,7 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 ## Contents
 
 - **`init.js`** — Kernel entry: must define `async function start(ctx)`. Boot order: **`/etc/os-release`** → **`/etc/motd`** → optional **`/etc/bare-os/rc.profile.<profile>`** (profile from **`BARE_OS_BOOT_PROFILE`** or first line of **`/etc/bare-os/profile`**; the booter mirrors the resolved name in **`ctx.env.BARE_OS_BOOT_PROFILE_RESOLVED`** and **`/run/bare-os/boot_profile`**) → **`/etc/bare-os/rc`** → **`/etc/bare-os/rc.d/*`** (sorted; digit-prefixed names only; skip dotfiles, `*~`, `README*`, `*.md`; optional **`BARE_OS_RC_D_SKIP`** comma list and **`prefix*`** patterns) → optional **`/etc/bare-os/rc.local`** → **`/etc/bare-os/kernel.d/*`** (same rules as **`rc.d`**) → banner → when **`BARE_OS_SKIP_REPL`**, optional **onboot** lines from **`BARE_OS_ONBOOT`** or **`/etc/bare-os/onboot`** → **`readLine` / `execLine`** loop. Boot **`execLine`** errors in trusted snippets are logged; with **`BARE_OS_BOOT_STRICT=1`** or **`true`**, the first throw calls **`requestBooterExit(1)`** and stops later boot phases. Custom kernels may call **`ctx.registerKernelShutdownHook(fn)`** before initd disposers; use **`ctx.bareOsRuntimeCaps`** for limits, pseudo paths, and **`features`** ([`developer-guide/02-the-context-object.md`](../developer-guide/02-the-context-object.md)).
-- **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md) (**~113** commands; list in **`packages/bare-os-coreutils/lib/commands.mjs`**). Each file is **`runtime.js`** + optional preamble (**`lib/md5.js`** for **`md5sum`**, **`lib/*-engine.js`** for **`sed`**/**`awk`**, **`jq-engine.js`**, **`lib/man-render.js`**, **`lib/edit-*.js`** for **`edit`**/**`nano`**, lscolors for **`ls`**/**`dircolors`**, …) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**). **`/bin/nano`** duplicates **`/bin/edit`** for familiarity; the shell’s default **`nano` → `edit`** alias uses the **`edit`** command name after expansion. **`dir`**/**`vdir`** invoke **`ls`** via **`ctx.runBinCommand`**.
+- **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md) (**~115** commands; list in **`packages/bare-os-coreutils/lib/commands.mjs`**). Each file is **`runtime.js`** + optional preamble (**`lib/md5.js`** for **`md5sum`**, **`lib/*-engine.js`** for **`sed`**/**`awk`**, **`jq-engine.js`**, **`lib/man-render.js`**, **`lib/edit-*.js`** for **`edit`**/**`nano`**, lscolors for **`ls`**/**`dircolors`**, …) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**). **`/bin/nano`** duplicates **`/bin/edit`** for familiarity; the shell’s default **`nano` → `edit`** alias uses the **`edit`** command name after expansion. **`dir`**/**`vdir`** invoke **`ls`** via **`ctx.runBinCommand`**.
 - **`lib/bare/`** — Optional IIFE bundles + **`manifest.json`** for **`ctx.bare`** drive merge, built by [bare-os-bare-libs](../packages/bare-os-bare-libs/README.md). Same trust model as **`bin/`** (trusted seeded image).
 - **`share/man/man.json`** — Merged manual database for **`/bin/man`** (built by **`bare-os-coreutils`**; see [handbook ch.10](../handbook/10-manpages-and-online-help.md)).
 - **`etc/os-release`** — Static OS metadata (`NAME`, `VERSION`, …).
@@ -37,7 +37,7 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 
 Pear bundles use the **vendored** tree under `packages/bare-os-seeder/kernel/`; keep it in sync by running the same builds before `pear stage`. **`npm test`** runs **`scripts/verify-kernel-seeder-parity.mjs`**, **`scripts/verify-ctx-api-feature-bits.mjs`**, and **`scripts/validate-example-schemas.mjs`** (after **`bare-os-coreutils`** and **`bare-os-bare-libs`** builds) so the two trees match byte-for-byte, ctx semver / feature words stay wired, example JSON matches **[`docs/schemas/`](../docs/schemas/)**, and every **`kernel/bin/*`** file contains the **`BARE_OS_BIN_API`** pragma (coreutils **`runtime.js`** and hand-written stubs such as **`systemctl`** / **`journalctl`**).
 
-Optional **system** image examples: **`etc/bare-os/boot.allow.example`** (copy to **`boot.allow`** when using host **`BARE_OS_BOOT_ALLOWLIST=1`**), **`etc/bare-os/boot.policy.example.json`** (install as **`boot.policy.json`** when using **`BARE_OS_BOOT_POLICY=1`**; v2 fields **`maxExecLineDepth`**, **`denyEnvKeys`**, **`requireProcNodes`**; v3 **`requireFeatureBits2`**, **`requireFeatureBits3`**, **`allowedPearIpcChannels`**, **`denyVfsPrefixes`**, **`maxInitdRestartsPerUnit`**; v4 **`requireFeatureBits4`**, **`denyExecLineBuiltins`**, **`allowedCtxMethods`**; v9 **`requireFeatureBits9`**, **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`**; JSON Schema: [`docs/schemas/boot.policy.schema.json`](../docs/schemas/boot.policy.schema.json)), **`etc/bare-os/kernel.extensions.registry.example.json`** (shape for **`/proc/bare_os/extensions.json`** schema 6), **`etc/bare-os/boot-trace-line.example.json`** and **`etc/bare-os/telemetry-ndjson.example.json`** (shape checks for CI), **`etc/bare-os/rc.profile.full`** (sample full profile referenced from **`profile`**), **`etc/bare-os/crontab.example`** (system-wide cron lines merged ahead of user **`~/.crontab`**), **`etc/bare-os/timers/*.timer.example`** (copy to **`~/.config/bare-os/timers/*.timer`** for **`OnCalendar=`**, **`EveryMs=`**, or **`OnInactiveSec=`** jobs). **`kernel.ext.d`** scripts register into **`/proc/bare_os/extensions.json`** when the booter provides **`ctx.bareOsRegisterKernelExtensionRecord`**.
+Optional **system** image examples: **`etc/bare-os/boot.allow.example`** (copy to **`boot.allow`** when using host **`BARE_OS_BOOT_ALLOWLIST=1`**), **`etc/bare-os/boot.policy.example.json`** (install as **`boot.policy.json`** when using **`BARE_OS_BOOT_POLICY=1`**; v2 fields **`maxExecLineDepth`**, **`denyEnvKeys`**, **`requireProcNodes`**; v3 **`requireFeatureBits2`**, **`requireFeatureBits3`**, **`allowedPearIpcChannels`**, **`denyVfsPrefixes`**, **`maxInitdRestartsPerUnit`**; v4 **`requireFeatureBits4`**, **`denyExecLineBuiltins`**, **`allowedCtxMethods`**; v9 **`requireFeatureBits9`**, **`requirePearRuntimeRange`**, **`denyBareModuleSpecifierPatterns`**, **`requireBareCryptoMin`**, **`denyKernelSyscalls`**, **`requirePearIpcMin`**, **`extensionSignerPinsV2`**, **`offlineLkgManifestMaxAgeSec`**, **`bootPhasesRequireProcIndexMinSchema`**; v10 **`requireFeatureBits10`**, **`requireBareBootMin`**, **`bootPhasesRequireLifecycleMinSchema`**, **`extensionSignerPinsV3`**, …; JSON Schema: [`docs/schemas/boot.policy.schema.json`](../docs/schemas/boot.policy.schema.json)), **`etc/bare-os/kernel.extensions.registry.example.json`** (shape for **`/proc/bare_os/extensions.json`** schema 7), **`etc/bare-os/boot-trace-line.example.json`** and **`etc/bare-os/telemetry-ndjson.example.json`** (shape checks for CI), **`etc/bare-os/rc.profile.full`** (sample full profile referenced from **`profile`**), **`etc/bare-os/crontab.example`** (system-wide cron lines merged ahead of user **`~/.crontab`**), **`etc/bare-os/timers/*.timer.example`** (copy to **`~/.config/bare-os/timers/*.timer`** for **`OnCalendar=`**, **`EveryMs=`**, or **`OnInactiveSec=`** jobs). **`kernel.ext.d`** scripts register into **`/proc/bare_os/extensions.json`** when the booter provides **`ctx.bareOsRegisterKernelExtensionRecord`**.
 
 ## See also
 

packages/bare-os-seeder/kernel/bin/help

@@ -87,7 +87,7 @@ function bareOsEmitRaw(ctx, chunk) {
   return false
 }
 
-var BARE_OS_HELP_BIN_SPACED = "arch awk base32 base64 basename basenc cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split stat sum sync systemctl tac tail tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
+var BARE_OS_HELP_BIN_SPACED = "arch awk base32 base64 basename basenc cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split ssh-keygen stat sum sync systemctl tac tail tar tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
 async function run(ctx, argv) {
   ctx.console.log(
     'Bare OS — default user: guest | shell builtins: alias, barerc, cd, command, export, exit, login, logout, readonly, type, umask, unalias, unset, : | /bin: ' +

packages/bare-os-seeder/kernel/bin/ssh-keygen

@@ -0,0 +1,110 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+/**
+ * Non-crypto stub: Pear/Bare guests must not use Node `node:crypto` for keys.
+ * Operators use host **`bare-crypto`** / Pear tooling; see developer-guide Node→Bare map.
+ */
+async function run(ctx, argv) {
+  const args = argv.slice(1)
+  if (args.includes('-h') || args.includes('--help') || args.includes('-?')) {
+    ctx.console.log(
+      'Usage: ssh-keygen (stub)\n' +
+        'Bare OS does not generate SSH keys in-guest. Use bare-crypto / Pear host workflows.\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  ctx.console.error(
+    'ssh-keygen: Bare OS stub only — use bare-crypto and host key tooling (no node:crypto in guest).'
+  )
+  ctx.exitCode = 1
+}
+
+export { run }

packages/bare-os-seeder/kernel/bin/tar

@@ -0,0 +1,125 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+/**
+ * Wave 10: bounded extended-attribute metadata sketch only (no archive I/O).
+ * Full archive workflows use Pear pack / bare-pack tooling outside the stub.
+ */
+async function run(ctx, argv) {
+  const args = argv.slice(1)
+  if (
+    args.includes('--bare-os-wave10-xattr-sketch') ||
+    args.includes('--bare-os-xattr-sketch')
+  ) {
+    ctx.console.log(
+      JSON.stringify({
+        schema: 1,
+        note: 'tar xattr subset stub; no archive bytes read in stock coreutils',
+        entries: [],
+        atMs: Date.now()
+      }) + '\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  if (args.includes('-h') || args.includes('--help')) {
+    ctx.console.log(
+      'Usage: tar [--bare-os-wave10-xattr-sketch]\n' +
+        'Bare OS tar is a documentation stub; use Pear/bare-pack for bundles.\n'
+    )
+    ctx.exitCode = 0
+    return
+  }
+  ctx.console.error(
+    'tar: Bare OS stub — pass --bare-os-wave10-xattr-sketch for JSON sketch or use host pack tools.'
+  )
+  ctx.exitCode = 1
+}
+
+export { run }

packages/bare-os-seeder/kernel/bin/xargs

@@ -92,12 +92,14 @@ function bareOsEmitRaw(ctx, chunk) {
  * Limits: stdin 256KiB, 4096 whitespace/null tokens, 128 args per invocation,
  * 64 invocations per run. Exceeding limits is a fatal error (exit 125).
  * Supports -0/--null, -n, -I repl (replace repl in utility argv; implies -n 1 unless -n given).
+ * -P N is accepted; stock booter runs sequentially; N is capped at MAX_P_FLAG (4).
  */
 
 const MAX_STDIN = 256 * 1024
 const MAX_TOKENS = 4096
 const MAX_PER_INVOCATION = 128
 const MAX_INVOCATIONS = 64
+const MAX_P_FLAG = 4
 
 async function run(ctx, argv) {
   if (typeof ctx.runBinCommand !== 'function') {
@@ -113,6 +115,7 @@ async function run(ctx, argv) {
   /** @type {string | null} */
   let repl = null
   let nExplicit = false
+  let pCap = 1
   let i = 0
 
   while (i < args.length && args[i].startsWith('-')) {
@@ -126,6 +129,40 @@ async function run(ctx, argv) {
       i++
       continue
     }
+    if (a === '-P' || a === '--max-procs') {
+      const n = args[i + 1]
+      if (n == null || !/^\d+$/.test(n)) {
+        ctx.console.error('xargs: -P requires a non-negative integer')
+        ctx.exitCode = 1
+        return
+      }
+      const raw = Number(n)
+      pCap = Math.min(MAX_P_FLAG, Math.max(1, raw))
+      if (raw > MAX_P_FLAG) {
+        ctx.console.error(
+          'xargs: -P ' +
+            raw +
+            ' exceeds Bare OS cap ' +
+            MAX_P_FLAG +
+            ' (parallelism hint only; sequential execution)'
+        )
+      }
+      i += 2
+      continue
+    }
+    if (a.startsWith('-P') && a.length > 2 && /^\d+$/.test(a.slice(2))) {
+      const raw = Number(a.slice(2))
+      pCap = Math.min(MAX_P_FLAG, Math.max(1, raw))
+      if (raw > MAX_P_FLAG) {
+        ctx.console.error(
+          'xargs: -P exceeds Bare OS cap ' +
+            MAX_P_FLAG +
+            ' (parallelism hint only; sequential execution)'
+        )
+      }
+      i++
+      continue
+    }
     if (a === '-n' || a === '--max-args') {
       const n = args[i + 1]
       if (n == null || !/^\d+$/.test(n) || Number(n) < 1) {
@@ -165,7 +202,9 @@ async function run(ctx, argv) {
     ctx.console.error(
       'xargs: Bare OS supports: -0/--null, -n N (max ' +
         MAX_PER_INVOCATION +
-        ' per run), -I repl'
+        ' per run), -I repl, -P N (max ' +
+        MAX_P_FLAG +
+        ', sequential)'
     )
     ctx.exitCode = 1
     return
@@ -174,6 +213,7 @@ async function run(ctx, argv) {
   /** @type {string[]} */
   let cmd = args.slice(i)
   if (cmd.length === 0) cmd = ['echo']
+  void pCap
 
   let text = bareStdin(ctx) || ''
   if (text.length > MAX_STDIN) {

packages/bare-os-seeder/kernel/etc/bare-os/boot.policy.example.json

@@ -10,6 +10,17 @@
   "requireFeatureBits6": 0,
   "requireFeatureBits7": 0,
   "requireFeatureBits8": 0,
+  "requireFeatureBits9": 0,
+  "requireFeatureBits10": 0,
+  "requireBareBootMin": "0.0.0",
+  "denyBareRpcMethodPatterns": [],
+  "maxPearInspectDepth": 0,
+  "requireBareLoggerMin": "0.0.0",
+  "denyAutobaseDiscoveryChannels": [],
+  "requireBareTlsMin": "0.0.0",
+  "extensionSignerPinsV3": {},
+  "offlineLkgRequirePearStamp": false,
+  "bootPhasesRequireLifecycleMinSchema": 0,
   "requireBareRuntimeMin": "0.0.0",
   "denySeedRpcMethods": [],
   "maxProtomuxChannelNameLength": 256,

packages/bare-os-seeder/kernel/etc/bare-os/otel-jsonl.example.json

@@ -1,5 +1,5 @@
 {
-  "otlSchemaVersion": 5,
+  "otlSchemaVersion": 7,
   "scopeMetrics": [
     {
       "scope": { "name": "bare-os-example" },

packages/bare-os-seeder/kernel/init.js

@@ -127,6 +127,9 @@ function shouldSkipBootPhase(ctx, phase) {
  * Boot policy v9 (optional): `requireFeatureBits9`, `requirePearRuntimeRange` (`{ min?, max? }` semver),
  *   `denyBareModuleSpecifierPatterns`, `requireBareCryptoMin`, `denyKernelSyscalls`, `requirePearIpcMin`,
  *   `extensionSignerPinsV2`, `offlineLkgManifestMaxAgeSec`, `bootPhasesRequireProcIndexMinSchema`.
+ * Boot policy v10 (optional): `requireFeatureBits10`, `requireBareBootMin`, `denyBareRpcMethodPatterns`,
+ *   `maxPearInspectDepth`, `requireBareLoggerMin`, `denyAutobaseDiscoveryChannels`, `requireBareTlsMin`,
+ *   `extensionSignerPinsV3`, `offlineLkgRequirePearStamp`, `bootPhasesRequireLifecycleMinSchema`.
  * @param {Record<string, unknown>} ctx
  * @returns {Promise<boolean>} false when strict policy fails (caller should abort boot)
  */
@@ -361,6 +364,24 @@ async function applyBootPolicyFile(ctx) {
         }
       }
     }
+    if (
+      typeof pol.requireFeatureBits10 === 'number' &&
+      pol.requireFeatureBits10 > 0
+    ) {
+      const adv10 = ctx.bareOsAdvertisedKernelBits10
+      const need10 = pol.requireFeatureBits10 >>> 0
+      const ok =
+        typeof adv10 === 'number' && ((adv10 >>> 0) & need10) === need10
+      if (!ok) {
+        console.error('[boot-policy] requireFeatureBits10 not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
     if (
       pol.requirePearRuntimeRange &&
       typeof pol.requirePearRuntimeRange === 'object'
@@ -654,6 +675,106 @@ async function applyBootPolicyFile(ctx) {
         /* ignore */
       }
     }
+    if (
+      pol.extensionSignerPinsV3 &&
+      typeof pol.extensionSignerPinsV3 === 'object' &&
+      ctx.env
+    ) {
+      try {
+        ctx.env.BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V3_JSON =
+          JSON.stringify(pol.extensionSignerPinsV3)
+      } catch {
+        /* ignore */
+      }
+    }
+    if (
+      typeof pol.requireBareBootMin === 'string' &&
+      String(pol.requireBareBootMin).trim()
+    ) {
+      const needS = String(pol.requireBareBootMin).trim()
+      const haveS =
+        ctx.env && String(ctx.env.BARE_OS_BARE_BOOT_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBareBootMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
+    if (
+      Array.isArray(pol.denyBareRpcMethodPatterns) &&
+      ctx.env
+    ) {
+      try {
+        ctx.env.BARE_OS_BOOT_POLICY_DENY_BARE_RPC_PATTERNS_JSON =
+          JSON.stringify(pol.denyBareRpcMethodPatterns)
+      } catch {
+        /* ignore */
+      }
+    }
+    if (
+      typeof pol.maxPearInspectDepth === 'number' &&
+      pol.maxPearInspectDepth >= 0 &&
+      ctx.env
+    ) {
+      ctx.env.BARE_OS_BOOT_POLICY_MAX_PEAR_INSPECT_DEPTH = String(
+        Math.min(64, Math.floor(pol.maxPearInspectDepth))
+      )
+    }
+    if (
+      typeof pol.requireBareLoggerMin === 'string' &&
+      String(pol.requireBareLoggerMin).trim()
+    ) {
+      const needS = String(pol.requireBareLoggerMin).trim()
+      const haveS =
+        ctx.env && String(ctx.env.BARE_OS_BARE_LOGGER_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBareLoggerMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
+    if (
+      Array.isArray(pol.denyAutobaseDiscoveryChannels) &&
+      ctx.env
+    ) {
+      try {
+        ctx.env.BARE_OS_BOOT_POLICY_DENY_AUTOBASE_DISCOVERY_CHANNELS_JSON =
+          JSON.stringify(pol.denyAutobaseDiscoveryChannels)
+      } catch {
+        /* ignore */
+      }
+    }
+    if (
+      typeof pol.requireBareTlsMin === 'string' &&
+      String(pol.requireBareTlsMin).trim()
+    ) {
+      const needS = String(pol.requireBareTlsMin).trim()
+      const haveS =
+        ctx.env && String(ctx.env.BARE_OS_BARE_TLS_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBareTlsMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
+    if (pol.offlineLkgRequirePearStamp === true && ctx.env) {
+      ctx.env.BARE_OS_OFFLINE_LKG_REQUIRE_PEAR_STAMP = '1'
+    }
     if (
       typeof pol.offlineLkgManifestMaxAgeSec === 'number' &&
       pol.offlineLkgManifestMaxAgeSec > 0 &&
@@ -712,6 +833,26 @@ async function applyBootPolicyFile(ctx) {
         }
       }
     }
+    if (
+      typeof pol.bootPhasesRequireLifecycleMinSchema === 'number' &&
+      pol.bootPhasesRequireLifecycleMinSchema > 0
+    ) {
+      const needSch = Math.floor(pol.bootPhasesRequireLifecycleMinSchema)
+      const raw = ctx.env && String(ctx.env.BARE_OS_LIFECYCLE_SCHEMA_VERSION || '').trim()
+      const haveSch = Number.parseInt(raw, 10)
+      const ok = Number.isFinite(haveSch) && haveSch >= needSch
+      if (!ok) {
+        console.error(
+          '[boot-policy] bootPhasesRequireLifecycleMinSchema not satisfied'
+        )
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
     if (
       typeof pol.bootPhasesRequireProcIndexMinSchema === 'number' &&
       pol.bootPhasesRequireProcIndexMinSchema > 0

packages/bare-os-seeder/kernel/lib/bare/manifest.json

@@ -37,18 +37,18 @@
         "protomux"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareEncoding.js",
-      "keys": [
-        "bareEncoding"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
         "bareEvents"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareEncoding.js",
+      "keys": [
+        "bareEncoding"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePath.js",
       "keys": [
@@ -67,30 +67,42 @@
         "bareAbortController"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAddonResolve.js",
       "keys": [
         "bareAddonResolve"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "keys": [
+        "bareAnsiEscapes"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareReadline.js",
       "keys": [
         "bareReadline"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareApk.js",
       "keys": [
         "bareApk"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
@@ -103,18 +115,6 @@
         "bareAssert"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareCrypto.js",
-      "keys": [
-        "bareCrypto"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/fetch.js",
-      "keys": [
-        "fetch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAsyncHooks.js",
       "keys": [
@@ -139,12 +139,6 @@
         "bareBundle"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundleCompile.js",
-      "keys": [
-        "bareBundleCompile"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBuffer.js",
       "keys": [
@@ -157,6 +151,12 @@
         "bareBluetoothApple"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "keys": [
+        "bareBundleCompile"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleEvaluate.js",
       "keys": [
@@ -176,9 +176,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareChannel.js",
+      "path": "/lib/bare/bundles/bareBundleId.js",
       "keys": [
-        "bareChannel"
+        "bareBundleId"
       ]
     },
     {
@@ -187,24 +187,30 @@
         "bareDebugLog"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareChannel.js",
+      "keys": [
+        "bareChannel"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDaemon.js",
       "keys": [
         "bareDaemon"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundleId.js",
-      "keys": [
-        "bareBundleId"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
         "bareDelta"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareEnv.js",
+      "keys": [
+        "bareEnv"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDns.js",
       "keys": [
@@ -217,18 +223,6 @@
         "bareDiagnosticsChannel"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareEnv.js",
-      "keys": [
-        "bareEnv"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareExif.js",
-      "keys": [
-        "bareExif"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
@@ -241,6 +235,12 @@
         "bareDgram"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareExif.js",
+      "keys": [
+        "bareExif"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFfmpeg.js",
       "keys": [
@@ -253,18 +253,18 @@
         "bareFfmpegEncodings"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFormData.js",
-      "keys": [
-        "bareFormData"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareFormat.js",
       "keys": [
         "bareFormat"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFormData.js",
+      "keys": [
+        "bareFormData"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFileLogger.js",
       "keys": [
@@ -278,15 +278,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareFs.js",
+      "path": "/lib/bare/bundles/bareHeif.js",
       "keys": [
-        "bareFs"
+        "bareHeif"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
       ]
     },
     {
@@ -296,9 +290,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareHrtime.js",
       "keys": [
-        "bareHeif"
+        "bareHrtime"
       ]
     },
     {
@@ -307,12 +301,6 @@
         "bareHttpParser"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareImageResample.js",
-      "keys": [
-        "bareImageResample"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareIco.js",
       "keys": [
@@ -320,9 +308,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareInspect.js",
+      "path": "/lib/bare/bundles/bareFs.js",
       "keys": [
-        "bareInspect"
+        "bareFs"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareImageResample.js",
+      "keys": [
+        "bareImageResample"
       ]
     },
     {
@@ -331,6 +325,12 @@
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspect.js",
+      "keys": [
+        "bareInspect"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
@@ -367,66 +367,66 @@
         "bareLogger"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareLink.js",
-      "keys": [
-        "bareLink"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareInspector.js",
       "keys": [
         "bareInspector"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareLink.js",
+      "keys": [
+        "bareLink"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareMake.js",
       "keys": [
         "bareMake"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModuleResolve.js",
-      "keys": [
-        "bareModuleResolve"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareModuleLexer.js",
       "keys": [
         "bareModuleLexer"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareModuleResolve.js",
+      "keys": [
+        "bareModuleResolve"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModule.js",
       "keys": [
         "bareModule"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNdk.js",
-      "keys": [
-        "bareNdk"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareModuleTraverse.js",
       "keys": [
         "bareModuleTraverse"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNodeFetch.js",
-      "keys": [
-        "bareNodeFetch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareNative.js",
       "keys": [
         "bareNative"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNdk.js",
+      "keys": [
+        "bareNdk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareNodeFetch.js",
+      "keys": [
+        "bareNodeFetch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
@@ -451,30 +451,24 @@
         "bareNet"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePack.js",
-      "keys": [
-        "barePack"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePerformance.js",
       "keys": [
         "barePerformance"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePng.js",
-      "keys": [
-        "barePng"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
         "barePipe"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePack.js",
+      "keys": [
+        "barePack"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePackDrive.js",
       "keys": [
@@ -482,9 +476,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "path": "/lib/bare/bundles/barePng.js",
       "keys": [
-        "bareNodeRuntime"
+        "barePng"
       ]
     },
     {
@@ -493,18 +487,24 @@
         "barePunycode"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareQuerystring.js",
-      "keys": [
-        "bareQuerystring"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
         "barePrebuild"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareQuerystring.js",
+      "keys": [
+        "bareQuerystring"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareQueueMicrotask.js",
       "keys": [
@@ -523,6 +523,12 @@
         "bareRealm"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePromClient.js",
+      "keys": [
+        "barePromClient"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDev.js",
       "keys": [
@@ -535,30 +541,12 @@
         "bareRuntime"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRpc.js",
-      "keys": [
-        "bareRpc"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSdl.js",
       "keys": [
         "bareSdl"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareRun.js",
-      "keys": [
-        "bareRun"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
@@ -566,15 +554,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSignals.js",
+      "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
-        "bareSignals"
+        "bareRun"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRepl.js",
-      "keys": [
-        "bareRepl"
       ]
     },
     {
@@ -583,60 +565,78 @@
         "bareSidecar"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareRpc.js",
+      "keys": [
+        "bareRpc"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareRepl.js",
+      "keys": [
+        "bareRepl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSignals.js",
+      "keys": [
+        "bareSignals"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStringDecoder.js",
       "keys": [
         "bareStringDecoder"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareStream.js",
-      "keys": [
-        "bareStream"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStdio.js",
-      "keys": [
-        "bareStdio"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSvg.js",
-      "keys": [
-        "bareSvg"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareStorage.js",
       "keys": [
         "bareStorage"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStream.js",
+      "keys": [
+        "bareStream"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSvg.js",
+      "keys": [
+        "bareSvg"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStructuredClone.js",
       "keys": [
         "bareStructuredClone"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStdio.js",
+      "keys": [
+        "bareStdio"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
         "bareSystemLogger"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTap.js",
-      "keys": [
-        "bareTap"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSubprocess.js",
       "keys": [
         "bareSubprocess"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTap.js",
+      "keys": [
+        "bareTap"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
@@ -649,24 +649,30 @@
         "bareTimers"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTpl.js",
-      "keys": [
-        "bareTpl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareThread.js",
       "keys": [
         "bareThread"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTpl.js",
+      "keys": [
+        "bareTpl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTcp.js",
       "keys": [
         "bareTcp"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTls.js",
+      "keys": [
+        "bareTls"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareType.js",
       "keys": [
@@ -674,9 +680,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
-        "bareTls"
+        "bareTty"
       ]
     },
     {
@@ -691,30 +697,24 @@
         "bareUnpack"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTty.js",
-      "keys": [
-        "bareTty"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareV8.js",
       "keys": [
         "bareV8"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUnionBundle.js",
-      "keys": [
-        "bareUnionBundle"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareVm.js",
       "keys": [
         "bareVm"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUnionBundle.js",
+      "keys": [
+        "bareUnionBundle"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
@@ -727,18 +727,18 @@
         "bareWebKit"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebp.js",
-      "keys": [
-        "bareWebp"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWebKitGtk.js",
       "keys": [
         "bareWebKitGtk"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWebp.js",
+      "keys": [
+        "bareWebp"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWhich.js",
       "keys": [
@@ -746,9 +746,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWinUi.js",
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
-        "bareWinUi"
+        "bareV8ToIstanbul"
       ]
     },
     {
@@ -758,9 +758,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
+      "path": "/lib/bare/bundles/bareWinUi.js",
       "keys": [
-        "bareV8ToIstanbul"
+        "bareWinUi"
       ]
     },
     {
@@ -781,17 +781,17 @@
         "bareZmq"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWorker.js",
-      "keys": [
-        "bareWorker"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWs.js",
       "keys": [
         "bareWs"
       ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWorker.js",
+      "keys": [
+        "bareWorker"
+      ]
     }
   ],
   "bundleStats": {

scripts/README.md

@@ -55,6 +55,12 @@ Asserts **`feature-roadmap.md`** contains a **`## Wave 8`** section with at leas
 
 Asserts **`feature-roadmap.md`** contains a **`## Wave 9`** section with at least **100** numbered table rows. Root **`pretest`**.
 
+## `verify-kernel-roadmap-wave10.mjs`
+
+**Usage:** `node scripts/verify-kernel-roadmap-wave10.mjs`
+
+Asserts **`feature-roadmap.md`** contains a **`## Wave 10`** section with at least **100** numbered table rows. Root **`pretest`**.
+
 ## `verify-pear-no-static-node-import.mjs`
 
 **Usage:** `node scripts/verify-pear-no-static-node-import.mjs`
@@ -65,7 +71,7 @@ Fails on **`from 'node:…'`** static imports under **`packages/bare-os-booter/i
 
 **Usage:** `node scripts/verify-ctx-dts.mjs`
 
-Ensures **`bare-os-ctx.d.ts`** lists new **`ctx`** fields (**`bareOsAdvertisedKernelBits4`**–**`bits9`**, Bare runtime semver, protocol/Pear runtime semver, subprocess snapshot, profile reload, delegate fairness, IPC audit, Pear / bundlebee / diagnostics / hrpc / structured-clone / wave9 stubs, …) that exist in **`packages/bare-os-booter/index.js`**. Root **`pretest`**.
+Ensures **`bare-os-ctx.d.ts`** lists new **`ctx`** fields (**`bareOsAdvertisedKernelBits4`**–**`bits10`**, Bare runtime semver, protocol/Pear runtime semver, subprocess snapshot, profile reload, delegate fairness, IPC audit, Pear / bundlebee / diagnostics / hrpc / structured-clone / wave9–10 stubs, …) that exist in **`packages/bare-os-booter/index.js`**. Root **`pretest`**.
 
 ## `verify-doc-links.mjs`
 
@@ -83,7 +89,7 @@ Asserts every Tier-1 name in **`packages/bare-os-coreutils/lib/commands.mjs`** h
 
 **Usage:** `node scripts/verify-compat-matrix.mjs`
 
-Checks **[`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md)** lists the current **`BARE_OS_CTX_API_VERSION`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`**, and mentions **`bits5`** … **`bits9`**. Root **`pretest`**.
+Checks **[`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md)** lists the current **`BARE_OS_CTX_API_VERSION`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`**, and mentions **`bits5`** … **`bits10`**. Root **`pretest`**.
 
 ## `validate-example-schemas.mjs`
 

scripts/verify-compat-matrix.mjs

@@ -73,6 +73,10 @@ function main() {
     console.error('compatibility-matrix.md should mention bits9 capability word')
     process.exit(1)
   }
+  if (!md.includes('**`bits10`**') && !md.includes('bits10')) {
+    console.error('compatibility-matrix.md should mention bits10 capability word')
+    process.exit(1)
+  }
   if (!md.includes('`' + lifeMatch[1] + '`')) {
     console.error(
       'compatibility-matrix.md must list BARE_OS_LIFECYCLE_SCHEMA_VERSION',

scripts/verify-ctx-api-feature-bits.mjs

@@ -80,6 +80,10 @@ function main() {
     console.error('index.js should wire seed/features bits9')
     process.exit(1)
   }
+  if (!idx.includes('bits10')) {
+    console.error('index.js should wire seed/features bits10')
+    process.exit(1)
+  }
   if (!idx.includes('BARE_OS_KERNEL_FEATURES_STOCK_V6')) {
     console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V6')
     process.exit(1)
@@ -96,6 +100,10 @@ function main() {
     console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V9')
     process.exit(1)
   }
+  if (!idx.includes('BARE_OS_KERNEL_FEATURES_STOCK_V10')) {
+    console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V10')
+    process.exit(1)
+  }
 
   const bitsSrc = read(bitsPath)
   if (!bitsSrc.includes('export const BARE_OS_KERNEL_FEATURES_STOCK_V1')) {
@@ -152,6 +160,12 @@ function main() {
     )
     process.exit(1)
   }
+  if (!bitsSrc.includes('export const BARE_OS_KERNEL_FEATURES_STOCK_V10')) {
+    console.error(
+      'kernel-feature-bits.js missing BARE_OS_KERNEL_FEATURES_STOCK_V10'
+    )
+    process.exit(1)
+  }
   const docMatch = bitsSrc.match(
     /export const BARE_OS_KERNEL_FEATURE_BITS_DOC = (\d+)/
   )
@@ -159,8 +173,8 @@ function main() {
     console.error('Could not parse BARE_OS_KERNEL_FEATURE_BITS_DOC')
     process.exit(1)
   }
-  if (docMatch[1] !== '11') {
+  if (docMatch[1] !== '12') {
-    console.error('Expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 11 for wave 9')
+    console.error('Expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 12 for wave 10')
     process.exit(1)
   }
 

scripts/verify-ctx-dts.mjs

@@ -39,9 +39,21 @@ const needles = [
   'bareOsProtomuxChannelAlias',
   'bareOsAdvertisedKernelBits9',
   'bareOsSeedCapabilityBits9',
+  'bareOsAdvertisedKernelBits10',
+  'bareOsSeedCapabilityBits10',
   'bareOsEmitPearStageHint',
   'bareOsBareModuleResolveProbe',
-  'bareOsBareCryptoCapProbe'
+  'bareOsBareCryptoCapProbe',
+  'bareOsEmitPearDoctorHint',
+  'bareOsPearInspectProbe',
+  'bareOsEmitBareBootPhaseHint',
+  'bareOsBareRpcCapProbe',
+  'bareOsEmitPearStampPointer',
+  'bareOsRegisterBareLoggerTap',
+  'bareOsEmitAutobaseDiscoveryHint',
+  'bareOsEmitBlindPairingSketch',
+  'bareOsBareStreamBackpressureHint',
+  'bareOsPearTerminalCapsProbe'
 ]
 
 function main() {

scripts/verify-kernel-roadmap-wave10.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+/**
+ * CI: Wave 10 mega-phase — feature-roadmap.md must contain 100 numbered rows under "## Wave 10".
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+function read(rel) {
+  return fs.readFileSync(path.join(root, rel), 'utf8')
+}
+
+function main() {
+  const md = read('docs/reference/feature-roadmap.md')
+  const idx = md.indexOf('## Wave 10')
+  if (idx < 0) {
+    console.error('feature-roadmap.md missing ## Wave 10 section')
+    process.exit(1)
+  }
+  const rest = md.slice(idx + '## Wave 10'.length)
+  const nextH2 = rest.search(/\n## /)
+  const block = nextH2 < 0 ? rest : rest.slice(0, nextH2)
+  let count = 0
+  for (const line of block.split('\n')) {
+    if (/^\| *[0-9]+ *\|/.test(line)) count++
+  }
+  if (count < 100) {
+    console.error(
+      'verify-kernel-roadmap-wave10: expected >=100 table rows in Wave 10, got',
+      count
+    )
+    process.exit(1)
+  }
+  console.log('verify-kernel-roadmap-wave10: OK', count, 'rows')
+}
+
+main()

scripts/verify-kernel-roadmap-wave3.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * CI: roadmap wave-3 … wave-9 contract checks (bits9, seed RPC registry, boot policy keys).
+ * CI: roadmap wave-3 … wave-10 contract checks (bits10, seed RPC registry, boot policy keys).
  */
 import fs from 'node:fs'
 import path from 'node:path'
@@ -39,9 +39,13 @@ function main() {
     console.error('kernel-feature-bits.js missing STOCK_V9')
     process.exit(1)
   }
-  if (!bits.includes('BARE_OS_KERNEL_FEATURE_BITS_DOC = 11')) {
+  if (!bits.includes('BARE_OS_KERNEL_FEATURES_STOCK_V10')) {
+    console.error('kernel-feature-bits.js missing STOCK_V10')
+    process.exit(1)
+  }
+  if (!bits.includes('BARE_OS_KERNEL_FEATURE_BITS_DOC = 12')) {
     console.error(
-      'kernel-feature-bits.js: expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 11'
+      'kernel-feature-bits.js: expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 12'
     )
     process.exit(1)
   }
@@ -74,6 +78,10 @@ function main() {
     console.error('channel.js capabilities must include bits9')
     process.exit(1)
   }
+  if (!chan.includes('bits10:')) {
+    console.error('channel.js capabilities must include bits10')
+    process.exit(1)
+  }
   const seedRpc = read('packages/bare-os-protocol/lib/seed-rpc-methods.js')
   if (!seedRpc.includes('BARE_OS_SEED_RPC_METHOD_SHORT_NAMES')) {
     console.error('seed-rpc-methods.js missing method list')
@@ -137,7 +145,31 @@ function main() {
     'mirror_drive_compaction_v4',
     'ready_guard_v3',
     'blind_relay_circuit_v2',
-    'http_dht_proxy_routes_v2'
+    'http_dht_proxy_routes_v2',
+    'pear_doctor_hint',
+    'pear_info_sketch',
+    'pear_inspect_caps',
+    'pear_dump_budget',
+    'pear_reset_guard',
+    'pear_restart_window',
+    'pear_run_flags',
+    'pear_bundle_manifest_slice',
+    'pear_pack_layout_hint',
+    'pear_seed_topology',
+    'pear_state_snapshot',
+    'pear_stamp_pointer',
+    'pear_shake_latency',
+    'pear_crasher_class',
+    'pear_errors_rate_hint',
+    'pear_bridge_health',
+    'pear_link_matrix',
+    'pear_pipe_backpressure',
+    'pear_opwait_budget',
+    'pear_terminal_caps',
+    'ready_guard_v4',
+    'mirror_drive_compaction_v5',
+    'blind_relay_circuit_v3',
+    'compact_ping_v4'
   ]) {
     if (!seedRpc.includes("'" + rpc + "'")) {
       console.error('seed-rpc-methods.js missing short name', rpc)
@@ -169,6 +201,10 @@ function main() {
     console.error('booter index.js must import STOCK_V9')
     process.exit(1)
   }
+  if (!bootIdx.includes('BARE_OS_KERNEL_FEATURES_STOCK_V10')) {
+    console.error('booter index.js must import STOCK_V10')
+    process.exit(1)
+  }
   if (!bootIdx.includes('bits6 do not cover stock')) {
     console.error('booter must strict-check bits6')
     process.exit(1)
@@ -185,6 +221,10 @@ function main() {
     console.error('booter must strict-check bits9')
     process.exit(1)
   }
+  if (!bootIdx.includes('bits10 do not cover stock')) {
+    console.error('booter must strict-check bits10')
+    process.exit(1)
+  }
   if (!bootIdx.includes('loadOsFromOfflineLkg')) {
     console.error('booter index.js must define loadOsFromOfflineLkg')
     process.exit(1)
@@ -219,6 +259,16 @@ function main() {
     'requireFeatureBits7',
     'requireFeatureBits8',
     'requireFeatureBits9',
+    'requireFeatureBits10',
+    'requireBareBootMin',
+    'denyBareRpcMethodPatterns',
+    'maxPearInspectDepth',
+    'requireBareLoggerMin',
+    'denyAutobaseDiscoveryChannels',
+    'requireBareTlsMin',
+    'extensionSignerPinsV3',
+    'offlineLkgRequirePearStamp',
+    'bootPhasesRequireLifecycleMinSchema',
     'requirePearRuntimeRange',
     'denyBareModuleSpecifierPatterns',
     'requireBareCryptoMin',
@@ -275,6 +325,10 @@ function main() {
     console.error('kernel/init.js must enforce requireFeatureBits9')
     process.exit(1)
   }
+  if (!kInit.includes('requireFeatureBits10')) {
+    console.error('kernel/init.js must enforce requireFeatureBits10')
+    process.exit(1)
+  }
   if (!kInit.includes('requireBareRuntimeMin')) {
     console.error('kernel/init.js must enforce requireBareRuntimeMin')
     process.exit(1)