Expand bounded awk/expr/test toward Issue 7; refresh man, profile 1.0.18,

posix matrix/dashboard, and syscalls/process_table schema alignment (v8).

Booter: replication_operator_sketch/corestore hints, HRPC allowlist tests,
Protomux cap channel 65536-byte bound + export, Wasm posix_profile_peek,
swarm-disk and security_posture docs.

Coreutils/kernel: pkg-swarm-index pathCapabilityEnvelopeVerify on get;
pathcap-verify --trusted failure hint; rebuild bins and sync seeder.

Docs: KERNEL_CONTRACT, kernel-extensions, capabilities index, environment
appendix (warm-cache tuning, cap channel, Wasm env), handbook observability,
vault threat model (multisig), developer-guide ctx/HRPC/Wasm, DOCUMENTATION
release-checklist note, release-checklist optional tier1 drift.

Changelog maintenance in bare-os-booter and bare-os-protocol.

packages/bare-os-coreutils/src/expr.js

@@ -2,7 +2,7 @@ async function run(ctx, argv) {
   const tokens = argv.slice(1)
   if (!tokens.length || tokens[0] === '--help' || tokens[0] === '-h') {
     ctx.console.log(
-      'usage: expr EXPRESSION\nInteger arithmetic (+ - * / %), comparisons, and string = / !=.'
+      'usage: expr EXPRESSION\nInteger arithmetic (+ - * / %), comparisons, string = / !=, and POSIX : (regex match length; pattern is ECMA ^(?:…))'
     )
     return
   }
@@ -19,11 +19,31 @@ async function run(ctx, argv) {
     if (/^-?\d+$/.test(t)) return { kind: 'n', v: parseInt(t, 10) }
     return { kind: 's', v: t }
   }
-  function parseMul() {
+  /** POSIX-style `:` regex match length (pattern is ECMA RegExp body after ^). */
+  function parseColon() {
     let left = parsePrimary()
+    while (peek() === ':') {
+      take()
+      const right = parsePrimary()
+      const s = left.kind === 'n' ? String(left.v) : String(left.v)
+      const pat = right.kind === 'n' ? String(right.v) : String(right.v)
+      let n = 0
+      try {
+        const re = new RegExp('^(?:' + pat + ')')
+        const m = re.exec(s)
+        if (m) n = m[0].length
+      } catch (_) {
+        n = 0
+      }
+      left = { kind: 'n', v: n }
+    }
+    return left
+  }
+  function parseMul() {
+    let left = parseColon()
     while (peek() === '*' || peek() === '/' || peek() === '%') {
       const op = take()
-      const right = parsePrimary()
+      const right = parseColon()
       if (left.kind !== 'n' || right.kind !== 'n') throw new Error('non-numeric')
       if (op === '*') left = { kind: 'n', v: left.v * right.v }
       else if (op === '/') {

packages/bare-os-coreutils/src/pathcap-verify.js

@@ -83,5 +83,10 @@ async function run(ctx, argv) {
     return
   }
   ctx.console.error('pathcap-verify: FAIL ' + r.reason)
+  if (trusted) {
+    ctx.console.error(
+      'pathcap-verify: hint: extend BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX with the issuer Ed25519 pubkey (64 hex) when the envelope is otherwise well-formed.'
+    )
+  }
   ctx.exitCode = 1
 }

packages/bare-os-coreutils/src/pkg-swarm-index.js

@@ -102,6 +102,27 @@ ${topic ? 'Topic pin prefix: ' + topic.slice(0, 16) + '…' : 'Topic pin unset.'
         return
       }
       const r = await pkgIndexLookup(ctx, keyArg)
+      const ent =
+        r && typeof r === 'object' && r.entry && typeof r.entry === 'object'
+          ? r.entry
+          : null
+      if (
+        ent &&
+        ent.pathCapabilityEnvelope != null &&
+        typeof ctx.bareOsVerifyPathCapabilityEnvelope === 'function'
+      ) {
+        try {
+          r.pathCapabilityEnvelopeVerify =
+            ctx.bareOsVerifyPathCapabilityEnvelope(
+              ent.pathCapabilityEnvelope
+            )
+        } catch (e) {
+          r.pathCapabilityEnvelopeVerify = {
+            ok: false,
+            error: (e && e.message) || String(e)
+          }
+        }
+      }
       ctx.console.log(JSON.stringify(r, null, 2))
       if (!r.ok) ctx.exitCode = 1
       return

packages/bare-os-coreutils/src/test.js

@@ -67,6 +67,25 @@ async function evalTest(ctx, args) {
     }
     if (op === '=') return a === b
     if (op === '!=') return a !== b
+    if (op === '-nt' || op === '-ot' || op === '-ef') {
+      const s1 = await ctx.vfs.stat(a)
+      const s2 = await ctx.vfs.stat(b)
+      if (!s1 || !s2) return false
+      if (op === '-ef') {
+        const i1 = s1.ino != null ? String(s1.ino) : ''
+        const i2 = s2.ino != null ? String(s2.ino) : ''
+        const d1 = s1.dev != null ? String(s1.dev) : ''
+        const d2 = s2.dev != null ? String(s2.dev) : ''
+        if (i1 && i2 && d1 && d2) return i1 === i2 && d1 === d2
+        return a === b
+      }
+      const t1 = Number(s1.mtimeMs)
+      const t2 = Number(s2.mtimeMs)
+      const m1 = Number.isFinite(t1) ? t1 : 0
+      const m2 = Number.isFinite(t2) ? t2 : 0
+      if (op === '-nt') return m1 > m2
+      if (op === '-ot') return m1 < m2
+    }
     return false
   }
   if (args.length === 2) {