When BARE_OS_WAVE11_PROC is 0, false, or off, omit the 20 Wave 11

flat /proc/bare_os_*.json names, matching /proc/bare_os/* aliases, and
their bare_os_proc_index rows; resolution behaves as missing reads.
Pass the variable through the booter host→shell env allowlist. Add a
VFS test driven by BARE_OS_WAVE11_PROC_FILE_TO_ID.
Document the toggle and Wave 11 summary in kernel-extensions and the
capabilities index; extend release-checklist and node-to-bare-modules.

developer-guide/13-privacy-telemetry-pii.md

@@ -13,6 +13,7 @@ When building custom NDJSON / OTel mirrors or Pear-side aggregators, treat these
 - **Wave 8 fields:** `sessionForkGeneration`, `vaultRotateCount`, multisig / trust-graph ids surfaced as pointers, OIDC publishing URLs, subprocess **`uidGidMapHint`**, RocksDB / sidecar manifest pointers — treat as operator metadata; scrub before cross-tenant export.
 - **Wave 9 fields:** `wave9ProbeId`, `bareModuleProbeClass`, Pear stage / appling / updater / radio / wakeups sketches from **`BARE_OS_*_JSON`** env mirrors, SOCKS / HTTP proxy map keys (host-only interpretation) — treat as deployment fingerprinting; scrub or bucket before multi-tenant export.
 - **Wave 10 fields:** `wave10ProbeId`, `bareRpcProbeClass`, Pear doctor / workshop / RTI / user-dirs sketches, Bare logger tap payloads, mTLS proxy map keys, thread-pool telemetry JSON — treat as operator metadata; scrub before cross-tenant export.
+- **Wave 11 fields:** `wave11ProbeId`, hypercore replicate budget / drive graph / protomux backpressure / Pear matrix / bundle preload / HRPC allowlist / sidecar cap / git LFS / net QoS / storage tier / indexer catchup / multisig quorum / relay geo sketches — operator hints only; no secret material in stock paths.
 
 Stock emitters avoid logging env wholesale; `/proc/self/environ` omits secret-like keys. Prefer **hashed** or **bucketed** counters (e.g. pairing backoff counts) over raw payloads.
 
@@ -22,7 +23,7 @@ Operators running Bare OS as part of a service should maintain a **subprocessor
 
 ## Schema versions
 
-- NDJSON lifecycle / telemetry: see **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (**9** in stock tree) and rows in [`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md).
+- NDJSON lifecycle / telemetry: see **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (**10** in stock tree) and rows in [`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md).
 - OTel-inspired lines: **`otlSchemaVersion: 7`**, example [`kernel/etc/bare-os/otel-jsonl.example.json`](../kernel/etc/bare-os/otel-jsonl.example.json), schema [`docs/schemas/otel-bare-os-jsonl.schema.json`](../docs/schemas/otel-bare-os-jsonl.schema.json).
 - Audit JSON: **`auditSchemaVersion: 7`** (delegate depth / Wave 9–10 RPC classes); optional **`requestSmugglingClass`** remains default **`none`** in stock emitters where applicable.
 

developer-guide/adr/001-kernel-feature-bits-governance.md

@@ -1,4 +1,4 @@
-# ADR 001: Kernel feature bit governance (v8)
+# ADR 001: Kernel feature bit governance (v9)
 
 ## Status
 
@@ -39,9 +39,11 @@ Bare OS advertises optional booter and seed-channel capabilities as a versioned
 
 13. **Tenth capability word (`bits10`, wave 10)** — **`BARE_OS_KERNEL_FEATURES_STOCK_V10`** and **`BARE_OS_FEATURE10_*`** add the tenth 32-bit word. **Word 9 high bits** remain reserved for future wave-9–scoped features; wave 10 uses **`bits10`** for Pear/Bare–inspired seed RPC wave 10, replication JSON adjuncts (bundle tier, autobase-discovery hint, token bucket v4, staging schema 7, peer firewall v5, compact ping v4, ready guard v4, mirror compaction v5, blind relay v3), Wave 10 **`/proc`** JSON (**`bare-os-wave10-proc.js`**), **`bare_os_proc_index`** schema **6**, boot policy v10 (**`requireFeatureBits10`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`extensionSignerPinsV3`**, **`bootPhasesRequireLifecycleMinSchema`**, …), extension registry schema **7**, Pear/Bare bridge **`ctx`** wave 10, worker **`sysproc:*`**, telemetry NDJSON schema **9** / OTel **7** / audit **7**, and CI **`verify-kernel-roadmap-wave10.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`bits10`**. **`BARE_OS_SEED_CAP_STRICT`** requires **`bits10`** to cover the stock tenth word when it is non-zero (same pattern as **`bits9`**).
 
+14. **Eleventh capability word (`bits11`, wave 11)** — **`BARE_OS_KERNEL_FEATURES_STOCK_V11`** and **`BARE_OS_FEATURE11_*`** add the eleventh 32-bit word. **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** is **13** for this wave. Wave 11 groups protocol **`0.7.0`**, twenty new seed RPC methods (replicate budget, drive graph, protomux backpressure, Pear matrix, bundle preload, … through mirror compaction v6), **`bare-os-wave11-proc.js`** with twenty **`/proc/bare_os/*.json`** surfaces, **`bare_os_proc_index`** schema **7**, boot policy v11 (**`requireFeatureBits11`**, **`extensionSignerPinsV4`**, **`requireBarePackMin`**, **`requireBareAddonPolicyMin`**, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireBits11`**, merged **`denySeedRpcMethods`**), extension registry **`/proc`** payload schema **8**, **`ctx`** API **1.20.0** wave-11 probes, worker patterns **`cryptoproc:*`** / **`indexerproc:*`**, telemetry NDJSON **10** / OTel **`otlSchemaVersion` 8** / audit **8**, and CI **`verify-kernel-roadmap-wave11.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`bits11`**. **`BARE_OS_SEED_CAP_STRICT`** requires **`bits11`** to cover the stock eleventh word when it is non-zero.
+
 **Deprecation (unused bits):** once a bit is published in this ADR and **`kernel-capabilities-index.md`**, its numeric position is **stable**; if a feature is removed from the stock booter, the bit stays reserved (document as “unused / reserved”) until a major governance revision. **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** bumps when semantics or this policy changes.
 
 ## Consequences
 
-- Seeder RPC `bare_os.capabilities` must return `protocolPackageVersion`, optional **`booterPackageVersion`**, and `featureBitsDoc` alongside `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, and **`bits10`** (omit zero words if desired; the stock seeder sends all ten today).
-- CI should keep seeder and booter copies of the stock masks aligned (`BARE_OS_KERNEL_FEATURES_STOCK_V1`, **`STOCK_V2`**, **`STOCK_V3`**, **`STOCK_V4`**, **`STOCK_V5`**, **`STOCK_V6`**, **`STOCK_V7`**, **`STOCK_V8`**, **`STOCK_V9`**, **`STOCK_V10`**).
+- Seeder RPC `bare_os.capabilities` must return `protocolPackageVersion`, optional **`booterPackageVersion`**, and `featureBitsDoc` alongside `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`**, and **`bits11`** (omit zero words if desired; the stock seeder sends all eleven today).
+- CI should keep seeder and booter copies of the stock masks aligned (`BARE_OS_KERNEL_FEATURES_STOCK_V1`, **`STOCK_V2`**, **`STOCK_V3`**, **`STOCK_V4`**, **`STOCK_V5`**, **`STOCK_V6`**, **`STOCK_V7`**, **`STOCK_V8`**, **`STOCK_V9`**, **`STOCK_V10`**, **`STOCK_V11`**).

developer-guide/node-to-bare-modules.md

@@ -20,3 +20,5 @@ Bare OS **guest** code (kernel `/boot/init.js`, `/bin` utilities running in the
 Stock **`/bin/openssl`** is a **stub** that points integrators at **`bare-crypto`** (see [`packages/bare-os-coreutils/src/openssl.js`](../../packages/bare-os-coreutils/src/openssl.js)).
 
 See also [kernel-extensions.md](../docs/reference/kernel-extensions.md), [handbook ch.11](../handbook/11-kernel-roadmap-and-research.md), and CI **`verify-pear-no-static-node-import.mjs`**.
+
+**Wave 11:** stock boot policy may pin **`bare-pack`** / **`bare-addon-policy`** (and related) versions via host env keys surfaced in **`boot.policy.json` v11**; Hypercore/replication-heavy guests should prefer Holepunch **`bare-*`** modules over Node **`node:*`** for the same capability areas as in the table above (see **`bits11`** / **`STOCK_V11`** in [compatibility-matrix.md](../docs/reference/compatibility-matrix.md)).