Expand bounded awk/expr/test toward Issue 7; refresh man, profile 1.0.18,

posix matrix/dashboard, and syscalls/process_table schema alignment (v8).

Booter: replication_operator_sketch/corestore hints, HRPC allowlist tests,
Protomux cap channel 65536-byte bound + export, Wasm posix_profile_peek,
swarm-disk and security_posture docs.

Coreutils/kernel: pkg-swarm-index pathCapabilityEnvelopeVerify on get;
pathcap-verify --trusted failure hint; rebuild bins and sync seeder.

Docs: KERNEL_CONTRACT, kernel-extensions, capabilities index, environment
appendix (warm-cache tuning, cap channel, Wasm env), handbook observability,
vault threat model (multisig), developer-guide ctx/HRPC/Wasm, DOCUMENTATION
release-checklist note, release-checklist optional tier1 drift.

Changelog maintenance in bare-os-booter and bare-os-protocol.

kernel/lib/init/fragments/30-init-kernel-extensions.js

@@ -8,7 +8,7 @@
 
 /**
  * @param {{ file: string, extId: string, scripts: string[], dependsOn: string[], signaturePointer?: string }[]} entries
- * @returns {{ ok: true, ordered: typeof entries } | { ok: false, cycleExtIds: string[] }}
+ * @returns {{ ok: true, ordered: typeof entries } | { ok: false, cycleExtIds: string[], cycleEdges: string[] }}
  */
 function topologicalOrderKernelExtEntries(entries) {
   const sorted = [...entries].sort((a, b) => a.file.localeCompare(b.file))
@@ -50,7 +50,21 @@ function topologicalOrderKernelExtEntries(entries) {
   }
   if (out.length !== sorted.length) {
     const stuck = sorted.filter((e) => !out.includes(e.file))
-    return { ok: false, cycleExtIds: stuck.map((e) => e.extId) }
+    const stuckIds = new Set(stuck.map((e) => e.extId))
+    /** @type {string[]} */
+    const cycleEdges = []
+    for (const e of stuck) {
+      for (const dep of e.dependsOn) {
+        if (stuckIds.has(dep))
+          cycleEdges.push(String(e.extId) + ' -> dependsOn:' + String(dep))
+      }
+    }
+    cycleEdges.sort()
+    return {
+      ok: false,
+      cycleExtIds: stuck.map((e) => e.extId),
+      cycleEdges: cycleEdges.slice(0, 48)
+    }
   }
   const byFile = new Map(sorted.map((e) => [e.file, e]))
   return {
@@ -622,17 +636,23 @@ async function runKernelExtDropins(ctx, opts = {}) {
   /** @type {typeof collected} */
   let ordered
   if (!topo.ok) {
+    const edgeHint =
+      topo.cycleEdges && topo.cycleEdges.length
+        ? '; cycle edges (stuck->dep): ' + topo.cycleEdges.join('; ')
+        : ''
     bootStructuredLog(
       ctx,
       'error',
       'kernelExt.cycle',
       '[kernel.ext.d] dependency cycle in extension drop-ins; ext ids: ' +
-        topo.cycleExtIds.join(', ')
+        topo.cycleExtIds.join(', ') +
+        edgeHint
     )
     if (strictPol) {
       await appendKernelExtAuditNdjson(ctx, {
         event: 'dependency_cycle',
-        cycleExtIds: [...topo.cycleExtIds].sort()
+        cycleExtIds: [...topo.cycleExtIds].sort(),
+        cycleEdges: topo.cycleEdges || []
       })
       return false
     }
@@ -673,6 +693,7 @@ async function runKernelExtDropins(ctx, opts = {}) {
             ? {
                 kind: 'dependency_cycle',
                 cycleExtIds: cycleSorted,
+                cycleEdges: topo.cycleEdges || [],
                 provenance: 'kernel.ext.d topological sort (init-main)'
               }
             : null,

kernel/lib/init/init-main.js

@@ -1622,24 +1622,21 @@ async function runKernelSelftest(ctx) {
   return true
 }
 
-/**
- * @param {Record<string, unknown>} ctx
- * @param {number} bootT0
- * @param {string[]} stageLog
- */
 /**
  * @param {Record<string, unknown>} ctx
  * @param {number} bootT0
  * @param {{ kind: string, code: string, wallMs: number, limitMs: number }[]} violations
  * @param {boolean} coldExceeded
  * @param {boolean} stdlibExceeded
+ * @param {string[]} [stageLog]
  */
 async function maybeWriteBootBudgetSummaryJson(
   ctx,
   bootT0,
   violations,
   coldExceeded,
-  stdlibExceeded
+  stdlibExceeded,
+  stageLog
 ) {
   const vfs = ctx.vfs
   const b4 = ctx.b4a
@@ -1647,15 +1644,21 @@ async function maybeWriteBootBudgetSummaryJson(
   const wall = Date.now() - bootT0
   const row =
     JSON.stringify({
-      schema: 1,
+      schema: 2,
       atMs: Date.now(),
       coldWallMs: wall,
       coldExceeded,
       bareStdlibExceeded: stdlibExceeded,
       violationCodes: violations.map((v) => v.code).filter(Boolean),
       violations,
+      bootStageCount:
+        Array.isArray(stageLog) && stageLog.length ? stageLog.length : null,
+      bootStageTail:
+        Array.isArray(stageLog) && stageLog.length
+          ? stageLog.slice(-16)
+          : undefined,
       procHint: '/proc/bare_os/boot_budget_summary.json',
-      note: 'Written every boot; operators mirror into proc via booter VFS provider.'
+      note: 'Written every boot; operators mirror into proc via booter VFS provider. Schema 2 adds bootStageCount/bootStageTail from kernel stage log.'
     }) + '\n'
   try {
     await vfs.writeFile('/run/bare-os/boot-budget-summary.json', b4.from(row))
@@ -2181,7 +2184,8 @@ async function start(ctx) {
       bootT0,
       bootBudgetViolationsForSummary,
       coldExceeded,
-      stdlibExceeded
+      stdlibExceeded,
+      stageLog
     )
     if (budgetStrict && polStrict && (coldExceeded || stdlibExceeded)) {
       bootStructuredLog(