feat(booter): complete P2P POSIX roadmap items and doc alignment

- ADRs under docs/adr/; KERNEL_CONTRACT + env appendix + handbook updates
- socketMsgSurface schema 5; replication_snapshot schema 2; syscall/example + tests
- MBR pacing docs/microbench; export mbrReadTimeoutMsForDisk; shell passthrough envs
- verify-ctx-api-feature-bits: syscall schema vs posix-compliance-matrix
- Wasm hostname import, disk.os snapshot hints, kernel-ext resolution docs
- coreutils nice + matrix/dashboard; syscalls.example ctxApiVersion 1.51.1
- Seeder kernel rsync parity; assorted booter/protocol doc fixes

handbook/04-the-booter-runtime.md

@@ -28,6 +28,8 @@ The **authoritative field list** and versioning story are in [developer-guide
 
 Non-TTY mode skips splash noise; automation uses **`BARE_OS_SKIP_REPL=1`**.
 
+**Host vs guest logging:** After the session **`ctx`** exists, user-visible kernel and shell output should flow through **`ctx.console`** (wired in **`createKernelReplSession`** / init). Pre-session and operator-only booter paths use **`packages/bare-os-booter/lib/bare-os-host-booter-log.js`** plus **`BARE_OS_HOST_BOOTER_LOG`** (stderr vs NDJSON file) so automation can separate **host telemetry** from **guest REPL** traffic. The seeder mirrors the same idea via **`packages/bare-os-seeder/lib/host-logger.mjs`** (**`seedLog`**).
+
 ---
 
 ## `executeKernel` in one paragraph

handbook/07-operations-and-development.md

@@ -197,6 +197,8 @@ These are the variables operators touch most often; the full list is in [docs/re
 **Booter behavior**
 
 - **`BARE_OS_BOOT_TIMEOUT_MS`** — Boot deadline (default **60000**).
+- **`BARE_OS_MBR_READ_TIMEOUT_MS`** — Override max wait for replicated **block 0** / MBR before boot fails (**≥ 3000** ms, cap **600000**).
+- **`BARE_OS_MBR_READ_TIMEOUT_ADAPTIVE`** — When **`1`** / **`true`** and **`BARE_OS_MBR_READ_TIMEOUT_MS`** is unset, lengthens or shortens the default MBR wait from live **peer count** (sparse swarms get more time). See environment appendix §14.
 - **`BARE_OS_NO_SPLASH`** — Disable TTY splash.
 - **`BARE_OS_SKIP_REPL`** — Non-interactive kernel.
 - **`BARE_OS_FISH`** — Set **`0`** to disable fish readline.
@@ -246,6 +248,8 @@ Prettier config: **no semicolons**, **single quotes** (`.prettierrc`).
 
 **Booter exits at timeout** — No seeder peer on the **`bare-os-v1`** topic. Start the seeder and confirm network reachability.
 
+**MBR / block 0 stalls on flaky swarms** — Raise **`BARE_OS_MBR_READ_TIMEOUT_MS`** or enable **`BARE_OS_MBR_READ_TIMEOUT_ADAPTIVE`** so cold boot waits longer when few peers are visible; compare **`swarm_health`** / replication metrics in **`/proc/bare_os/metrics_live.json`**. Regression-shaped timings: **`node scripts/kernel-microbench.mjs --suite boot`** (**`mbr_read_timeout_ms_sketch`**).
+
 **`/bin/foo` missing under Pear** — Run **`npm run build -w bare-os-coreutils`** before staging or seeding so the image includes a fresh **`/bin`** build.
 
 **`autopass` or module not found in Pear** — Check hoisting, **`ensure-pear-node-modules`**, and avoid forbidden static imports in HDMS paths.

handbook/09-posix-utilities-shell-and-vfs.md

@@ -12,7 +12,7 @@ If you come from Linux or macOS, Bare OS **feels** like a small Unix: **`ls`**,
 
 **Declared profile (single spec):** [POSIX_DECLARED_PROFILE.md](../docs/architecture/POSIX_DECLARED_PROFILE.md) — contract for XCU/XSH-like behavior, proc stand-ins for “syscalls,” and explicit non-goals.
 
-**Declared profile (constants):** the protocol package publishes **`BARE_OS_POSIX_PROFILE_VERSION`** / **`BARE_OS_POSIX_PROFILE_ID`** (`bare-os-posix-like`), surfaced on **`/proc/bare_os_features`** and in **`/proc/bare_os/syscalls.json`** (schema **10** for that file — adds **`posix_fadvise`** simulated hint and **`clock_gettime`**; **`fdModel`** / **`signalModel`** plus **`opsDetail`** / **`posixXsh`** (schema **2**) / **`socketMsgSurface`** (schema **4**: binary ancillary **`ENOTSUP`**; optional **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS`** JSON **`cmsgs`** → logical **`scmRightsLocalDup`** on **`sendmsg`**; **`recvmsg`** **`controllen: 0`**) / **`errnoHints`**, including cooperative **`fcntl`** advisory locks with optional **`F_SETLKW`** blocking wait (**`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`**) and optional socket-bridge datagram **`bind`/`connect`/`send`/`sendmsg`/`recv`/`recvfrom`/`recvmsg`** (passive UDP **`bind`**, optional **`connect`** on the same fd, **`send`** with explicit **`port`/`host`** when bound without default peer) with bounded queues; **`/proc/bare_os/index.json`** uses schema **8**). **`getconf BARE_OS_POSIX_XSH_OPS`** lists the XSH names; **`getconf BARE_OS_SYSCALL_OPS`** lists ctx op names only. Cold-boot wall time vs **`BARE_OS_BOOT_BUDGET_MS_COLD`** is also written to **`/run/bare-os/boot-perf.json`** when the VFS supports it. **`metrics_live`** includes **`initdReadiness`** (schema **2**), **`bootBudgetTelemetry`** (schema **2**, unified with **`boot-perf.json`**), and paths such as **`utilitiesIndexPath`** → **`/etc/bare-os/posix_utilities.json`** when present. **Dashboard:** [POSIX + P2P consolidated hub](../docs/README.md#posix--p2p-consolidated-dashboard).
+**Declared profile (constants):** the protocol package publishes **`BARE_OS_POSIX_PROFILE_VERSION`** / **`BARE_OS_POSIX_PROFILE_ID`** (`bare-os-posix-like`), surfaced on **`/proc/bare_os_features`** and in **`/proc/bare_os/syscalls.json`** (schema **10** for that file — adds **`posix_fadvise`** simulated hint and **`clock_gettime`**; **`fdModel`** / **`signalModel`** plus **`opsDetail`** / **`posixXsh`** (schema **2**) / **`socketMsgSurface`** (schema **5**: binary ancillary **`ENOTSUP`**; optional **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS`** JSON **`cmsgs`** → logical **`scmRightsLocalDup`** on **`sendmsg`** for **SOCK_STREAM** and **SOCK_DGRAM** bridge fds; **`recvmsg`** **`controllen: 0`**) / **`errnoHints`**, including cooperative **`fcntl`** advisory locks with optional **`F_SETLKW`** blocking wait (**`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`**) and optional socket-bridge datagram **`bind`/`connect`/`send`/`sendmsg`/`recv`/`recvfrom`/`recvmsg`** (passive UDP **`bind`**, optional **`connect`** on the same fd, **`send`** with explicit **`port`/`host`** when bound without default peer) with bounded queues; **`/proc/bare_os/index.json`** uses schema **8**). **`getconf BARE_OS_POSIX_XSH_OPS`** lists the XSH names; **`getconf BARE_OS_SYSCALL_OPS`** lists ctx op names only. Cold-boot wall time vs **`BARE_OS_BOOT_BUDGET_MS_COLD`** is also written to **`/run/bare-os/boot-perf.json`** when the VFS supports it. **`metrics_live`** includes **`initdReadiness`** (schema **2**), **`bootBudgetTelemetry`** (schema **2**, unified with **`boot-perf.json`**), and paths such as **`utilitiesIndexPath`** → **`/etc/bare-os/posix_utilities.json`** when present. **Dashboard:** [POSIX + P2P consolidated hub](../docs/README.md#posix--p2p-consolidated-dashboard).
 
 ---
 
@@ -131,6 +131,8 @@ flowchart LR
 
 **Errexit (subset):** **`BARE_OS_SHELL_ERREXIT=1`**, **`set -e`**, or **`set -o errexit`** stops further top-level **`;`-separated** commands after a non-zero exit (**`set +e`** / **`set +o errexit`** clears). The same flag now applies **inside** **`if`** **`then`** / **`else`** bodies and **`while`** / **`for`** loop bodies between semicolon-separated lists (POSIX-style: a failing command aborts the rest of that compound body). **Condition** expressions in **`if`** / **`while`** still evaluate without errexit stopping between predicate lists. This remains a declared subset, not full Issue **7** **`sh`**.
 
+**Nounset (subset):** **`BARE_OS_SHELL_NOUNSET=1`**, **`set -u`**, or **`set -o nounset`** makes expansion of unset simple parameters an error (**`shell: unbound variable: NAME`**, exit **1**). **`$?`** and positional digits use normal lookup; clearing via **`set +u`** / **`set +o nounset`**.
+
 **Command substitution (bounded):** when **`BARE_OS_SHELL_CMDSUBST=1`**, words may contain **`$(…)`** (one level balanced, nesting depth capped). The inner line runs via **`execLine`**; **`console.log`** output becomes the substituted text, trimmed to **`BARE_OS_SHELL_CMDSUBST_MAX_BYTES`** (default **8192**). This is **not** full POSIX **`sh`** command substitution.
 
 **Captured stdout (`ctx.bareOsStdoutCaptured`):** stages whose **`console.log`** output is captured into the simulated pipe (or into a **`>`** / **`>>`** redirect) run with **`bareOsStdoutCaptured: true`** on the shallow **`ctx`** clone passed to **`runBinCommand`** (see **`bareOsPipelineChildCtx`** in **`shell.js`**). **`ls`** uses this to print **one name per line** in short format, similar to GNU **`ls`** when stdout is not a terminal, so **`grep`**, **`sort`**, and **`wc`** receive one entry per line. Each **`console.log`** call still becomes one output line (trailing newline added by the shell capture).
@@ -152,7 +154,7 @@ Beyond **`alias`**, **`unalias`**, **`cd`**, **`export`**, **`login`**, **`logou
 - **`unset`** — Removes variables from **`vfs.env`**; refuses **readonly** names (POSIX-style error).
 - **`readonly`** — Marks names readonly; **`readonly NAME=value`** sets and locks. Blocks **`export`** and leading assignments on readonly keys.
 - **`umask`** — With an argument, sets **`env.UMASK`** (octal string); without, prints the current mask (default **022** if unset).
-- **`set`** — **`set -f`** / **`set +f`** toggle **`noglob`**; **`set -e`** / **`set +e`** and **`set -o errexit`** / **`set +o errexit`** toggle **`BARE_OS_SHELL_ERREXIT`**; **`set -o pipefail`** / **`set +o pipefail`** toggle **`BARE_OS_SHELL_PIPEFAIL`**. Unsupported **`set`** combinations still error with a clear message.
+- **`set`** — **`set -f`** / **`set +f`** toggle **`noglob`**; **`set -e`** / **`set +e`** and **`set -o errexit`** / **`set +o errexit`** toggle **`BARE_OS_SHELL_ERREXIT`**; **`set -u`** / **`set +u`** and **`set -o nounset`** / **`set +o nounset`** toggle **`BARE_OS_SHELL_NOUNSET`**; **`set -o pipefail`** / **`set +o pipefail`** toggle **`BARE_OS_SHELL_PIPEFAIL`**. Unsupported **`set`** combinations still error with a clear message.
 - **`:`** — No-op (exit status **0**).
 - **`command`** — **`-v`** / **`-V`**: prints **builtin** name or resolved **`PATH`** location via **`resolveBinInPath`**. Otherwise runs **`runBinCommand`** with the remaining words (external commands only for that path).
 - **`type`** — **`type NAME`** reports **builtin** versus resolved **`/bin/...`** path or **not found**.