feat(booter): complete P2P POSIX roadmap items and doc alignment

- ADRs under docs/adr/; KERNEL_CONTRACT + env appendix + handbook updates
- socketMsgSurface schema 5; replication_snapshot schema 2; syscall/example + tests
- MBR pacing docs/microbench; export mbrReadTimeoutMsForDisk; shell passthrough envs
- verify-ctx-api-feature-bits: syscall schema vs posix-compliance-matrix
- Wasm hostname import, disk.os snapshot hints, kernel-ext resolution docs
- coreutils nice + matrix/dashboard; syscalls.example ctxApiVersion 1.51.1
- Seeder kernel rsync parity; assorted booter/protocol doc fixes

docs/architecture/KERNEL_CONTRACT.md

@@ -63,7 +63,7 @@ sequenceDiagram
 
 ## WebAssembly guest probes
 
-When **`BARE_OS_WASM_KERNEL=1`**, **`ctx.bareOsWasmKernelInstantiate`** compiles with bounded **`Memory`**. With **`BARE_OS_WASM_KERNEL_SYSCALL=1`**, the import object includes **`env.bare_os_pathconf`** (UTF-8 path/name pointers into linear memory, NUL-terminated textual result) backed by **`ctx.bareOsPathconf`**, **`env.bare_os_umask_get`** from session **`UMASK`**, and **`env.bare_os_wall_time_ms32`** (low 32 bits of wall clock, signed wrap). With **`BARE_OS_WASM_KERNEL_MONOTONIC_MS=1`** (also requires syscall imports), **`env.bare_os_monotonic_ms`** returns **`Number`** monotonic milliseconds from the booter clock helper (bounded, sync — no async syscall bridge). General async **`ctx.bareOsSyscall`** (including **`clock_gettime`**, **`nanosleep`**, socket bridge ops) is intentionally **not** imported into Wasm — use JS **`ctx.bareOsSyscall`** from the host-injected context when you need parity with **`posixXsh.namesCsv`**; see [`posix-syscall-facade-map.md`](../reference/posix-syscall-facade-map.md).
+When **`BARE_OS_WASM_KERNEL=1`**, **`ctx.bareOsWasmKernelInstantiate`** compiles with bounded **`Memory`**. With **`BARE_OS_WASM_KERNEL_SYSCALL=1`**, the import object includes **`env.bare_os_pathconf`** (UTF-8 path/name pointers into linear memory, NUL-terminated textual result) backed by **`ctx.bareOsPathconf`**, **`env.bare_os_umask_get`** from session **`UMASK`**, and **`env.bare_os_wall_time_ms32`** (low 32 bits of wall clock, signed wrap). With **`BARE_OS_WASM_KERNEL_MONOTONIC_MS=1`** (also requires syscall imports), **`env.bare_os_monotonic_ms`** returns **`Number`** monotonic milliseconds from the booter clock helper (bounded, sync — no async syscall bridge). With **`BARE_OS_WASM_KERNEL_HOSTNAME_IMPORT=1`**, **`env.bare_os_hostname_peek`** writes session **`HOSTNAME`** (or **`bare-os`**) NUL-terminated into guest memory (bounded). General async **`ctx.bareOsSyscall`** (including **`clock_gettime`**, **`nanosleep`**, socket bridge ops) is intentionally **not** imported into Wasm — use JS **`ctx.bareOsSyscall`** from the host-injected context when you need parity with **`posixXsh.namesCsv`**; see [`posix-syscall-facade-map.md`](../reference/posix-syscall-facade-map.md) and [`developer-guide/kernel-program.md`](../../developer-guide/kernel-program.md).
 
 ## Typed errors (for callers)
 
@@ -76,6 +76,7 @@ Shared error classes (stable `code` field): [`packages/bare-os-booter/lib/bare-o
 
 ## Related docs
 
+- [ADR index — P2P-first invariants](../adr/README.md) (two-drive model, RPC posture, POSIX facade, extensions, observability)
 - [Declared POSIX-like profile](POSIX_DECLARED_PROFILE.md)
 - [Architecture: end-to-end data flow](../reference/architecture-data-flow.md)
 - [Documentation home](../README.md)

docs/architecture/POSIX_DECLARED_PROFILE.md

@@ -18,7 +18,7 @@ This document is the **normative contract** for how closely the stock Bare OS ke
 
 Bare OS does **not** expose a C ABI. The following **observability contracts** stand in for “system calls”:
 
-- **`/proc/bare_os/syscalls.json`** — Declares **fd model**, **signal model**, **errno hints**, **operation detail**, **`posixXsh`**, **`socketMsgSurface`**, and related adjuncts (schema **10** in stock builds; see [`docs/reference/posix-compliance-matrix.json`](../reference/posix-compliance-matrix.json)). **`ops`** lists invocable **`ctx.bareOsSyscall`** names (**`posix_fadvise`** as a simulated no-op hint; **`clock_gettime`** for REALTIME / MONOTONIC sketches alongside **`nanosleep`**); **`opsDetail`** also carries **POSIX.1 XSH** logical names (**`open`**, **`close`**, **`read`**, **`write`**, **`readv`**, **`writev`**, **`getsockopt`**, **`setsockopt`**, **`lseek`**, **`pipe`**, **`dup`**, **`dup2`**, **`fcntl`**, **`poll`**, **`select`**, **`umask`**, **`fsync`**, **`fdatasync`**, **`posix_fadvise`**, and **socket family** probes) with **`posixAlignment`** (**`simulated`**, **`partial`**, **`ENOTSUP`**) and **`mapsTo`** for traceability. The **`posixXsh`** object summarizes those XSH names (via **`bareOsPosixXshOpsCsv()`**). **`socketMsgSurface`** (schema **4**) documents **`sendmsg`** / **`recvmsg`** on the bridge: bounded **iovec** flattening for datagram and stream paths; binary ancillary control on **`sendmsg`** remains **`ENOTSUP`** with structured rejection metadata unless **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS=1`**, in which case JSON-shaped **`cmsgs`** may request logical **`scmRightsLocalDup`** (guest logical FD duplication — not host **`SCM_RIGHTS`**); **`recvmsg`** reports **`controllen: 0`** on the receive path. **`fcntl`** supports **`F_GETFL`** / **`F_SETFL`** (Linux-shaped **`O_APPEND`** **`0x400`**, **`O_NONBLOCK`** **`0x800`**) and **cooperative advisory locks** via **`F_GETLK`** / **`F_SETLK`** / **`F_SETLKW`** using **`args.path`** (absolute) or **`args.fd`** whose logical target is an absolute path; contended **`F_SETLK`** returns **`EAGAIN`**. **`F_SETLKW`** also returns **`EAGAIN`** by default; with **`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`**, waiters are queued **FIFO per lock path** until the lock is free or **`BARE_OS_FCNTL_LOCK_WAIT_MS_MAX`** elapses (**`ETIMEDOUT`**; default **30000** ms, max **300000**). There is **no** cross-path global fairness and **no** host deadlock detection. Unknown FDs yield **`EBADF`**. **`readv`** / **`writev`** perform bounded scatter/gather on **`BARE_OS_POSIX_FD_SIM`** pipe read/write ends. **`poll`** / **`select`** share the same logical FD readiness probe when **`BARE_OS_POSIX_FD_SIM`** is enabled; with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**, bridged **datagram** fds participate (**`SOCK_DGRAM`** via **`bareDgram`** when merged) with bounded **`recv`** / **`recvfrom`** queues (**`BARE_OS_POSIX_DGRAM_RECVQ_MAX`**, **`BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX`**); passive **`SOCK_STREAM`** uses **`bind`/`listen`/`accept`** when **`bareTcp.Server`** is available. **Socket-shaped** syscalls default to **`ENOSYS`** / **`ENOTSUP`**; with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**, **`socket`** + **`connect`** may use **`ctx.bare.bareTcp.Socket`** (**`SOCK_STREAM`**) or **`bareDgram`** (**`SOCK_DGRAM`**) when merged. The stock booter **caches** this JSON until warm read-cache invalidation.
+- **`/proc/bare_os/syscalls.json`** — Declares **fd model**, **signal model**, **errno hints**, **operation detail**, **`posixXsh`**, **`socketMsgSurface`**, and related adjuncts (schema **10** in stock builds; see [`docs/reference/posix-compliance-matrix.json`](../reference/posix-compliance-matrix.json)). **`ops`** lists invocable **`ctx.bareOsSyscall`** names (**`posix_fadvise`** as a simulated no-op hint; **`clock_gettime`** for REALTIME / MONOTONIC sketches alongside **`nanosleep`**); **`opsDetail`** also carries **POSIX.1 XSH** logical names (**`open`**, **`close`**, **`read`**, **`write`**, **`readv`**, **`writev`**, **`getsockopt`**, **`setsockopt`**, **`lseek`**, **`pipe`**, **`dup`**, **`dup2`**, **`fcntl`**, **`poll`**, **`select`**, **`umask`**, **`fsync`**, **`fdatasync`**, **`posix_fadvise`**, and **socket family** probes) with **`posixAlignment`** (**`simulated`**, **`partial`**, **`ENOTSUP`**) and **`mapsTo`** for traceability. The **`posixXsh`** object summarizes those XSH names (via **`bareOsPosixXshOpsCsv()`**). **`socketMsgSurface`** (schema **5**) documents **`sendmsg`** / **`recvmsg`** on the bridge: bounded **iovec** flattening for datagram and stream paths; binary ancillary control on **`sendmsg`** remains **`ENOTSUP`** with structured rejection metadata unless **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS=1`**, in which case JSON-shaped **`cmsgs`** may request logical **`scmRightsLocalDup`** on **SOCK_STREAM** and **SOCK_DGRAM** bridge fds (guest logical FD duplication — not host **`SCM_RIGHTS`**); **`recvmsg`** reports **`controllen: 0`** on the receive path. **`fcntl`** supports **`F_GETFL`** / **`F_SETFL`** (Linux-shaped **`O_APPEND`** **`0x400`**, **`O_NONBLOCK`** **`0x800`**) and **cooperative advisory locks** via **`F_GETLK`** / **`F_SETLK`** / **`F_SETLKW`** using **`args.path`** (absolute) or **`args.fd`** whose logical target is an absolute path; contended **`F_SETLK`** returns **`EAGAIN`**. **`F_SETLKW`** also returns **`EAGAIN`** by default; with **`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`**, waiters are queued **FIFO per lock path** until the lock is free or **`BARE_OS_FCNTL_LOCK_WAIT_MS_MAX`** elapses (**`ETIMEDOUT`**; default **30000** ms, max **300000**). There is **no** cross-path global fairness and **no** host deadlock detection. Unknown FDs yield **`EBADF`**. **`readv`** / **`writev`** perform bounded scatter/gather on **`BARE_OS_POSIX_FD_SIM`** pipe read/write ends. **`poll`** / **`select`** share the same logical FD readiness probe when **`BARE_OS_POSIX_FD_SIM`** is enabled; with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**, bridged **datagram** fds participate (**`SOCK_DGRAM`** via **`bareDgram`** when merged) with bounded **`recv`** / **`recvfrom`** queues (**`BARE_OS_POSIX_DGRAM_RECVQ_MAX`**, **`BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX`**); passive **`SOCK_STREAM`** uses **`bind`/`listen`/`accept`** when **`bareTcp.Server`** is available. **Socket-shaped** syscalls default to **`ENOSYS`** / **`ENOTSUP`**; with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**, **`socket`** + **`connect`** may use **`ctx.bare.bareTcp.Socket`** (**`SOCK_STREAM`**) or **`bareDgram`** (**`SOCK_DGRAM`**) when merged. The stock booter **caches** this JSON until warm read-cache invalidation.
 - **`/proc/bare_os/process_table.json`** — **PGID** / **SID**-style fields, **`parentName`** (from **`ppid`**), **signal routing**, and initd binding for the **logical** process table (not host PIDs).
 
 **Explicit non-goals**