feat(booter): default initd parallelism, cmdsubst, bin cache, telemetry NDJSON

docs/reference/environment-and-posix-appendix.md

@@ -79,7 +79,7 @@ The list below is one **bullet per variable** in the form **name — component
 
 **Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value; canonical list in [`packages/bare-os-booter/index.js`](../../packages/bare-os-booter/index.js)): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_PIPELINE_ABS_MAX_BYTES`, `BARE_OS_PIPELINE_ABS_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_STREAMING_MULTIPLIER`, `BARE_OS_SHELL_PIPEFAIL`, `BARE_OS_SHELL_PIPESTATUS`, `BARE_OS_SHELL_READ_BUILTIN`, `BARE_OS_SHELL_READ_MAX_BYTES`, `BARE_OS_SHELL_ERREXIT`, `BARE_OS_SHELL_NOUNSET`, `BARE_OS_SHELL_POSIX_MODE`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_SHELL_PARAM_EXPANSION`, `BARE_OS_SHELL_PARAM_EXPANSION_V2`, `BARE_OS_SHELL_PARAM_EXPANSION_V3`, `BARE_OS_ENV_DASH_S`, `BARE_OS_VFS_WATCH_PSEUDO`, `BARE_OS_VFS_WATCH_SWARM`, `BARE_OS_SHELL_LOCAL_DECLARE`, `BARE_OS_DIAGNOSTICS_SUBSCRIBE`, `BARE_OS_AUTOPASS_INVITE_URL`, `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW`, `BARE_OS_BIN_WORKER_CPU_MS_MAX`, `BARE_OS_BIN_WORKER_WASM_MS_MAX`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_SAFE_MODE`, `BARE_OS_BOOT_TRANSACTION_JOURNAL`, `BARE_OS_BOOT_CHECKPOINT`, `BARE_OS_BOOT_DRY_RUN`, `BARE_OS_BOOT_POLICY_PATH`, `BARE_OS_BOOT_ROLLBACK_APPLY`, `BARE_OS_BOOT_BUNDLE_DIGEST_HEX`, `BARE_OS_REQUIRE_CTX_API_MIN`, `BARE_OS_BOOT_ABI_STRICT`, `BARE_OS_LOADER_AUDIT`, `BARE_OS_DELEGATE_TRACE`, `BARE_OS_DNS_PROFILE`, `BARE_OS_BOOT_TRACE`, `BARE_OS_KERNEL_PROGRAM_PROC_JSON`, `BARE_OS_GIANT_PHASE_PROGRAM_JSON`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_EXEC_LINE_BUDGET_MS`, `BARE_OS_TIMER_BUDGET_MS`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_IPC_MAX_CHANNELS`, `BARE_OS_POSIX_MQ_MAX_MSGS`, `BARE_OS_POSIX_MQ_MSG_BYTES`, `BARE_OS_IPC_NAMESPACE`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_MAX_OPEN`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_HYPERBLOBS_DEDUP`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_VFS_BIN_CACHE_BLAKE2B`, `BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_APPEND`, `BARE_OS_VFS_ENFORCE_ACL`, `BARE_OS_VFS_BIN_INDEX_BUILD`, `BARE_OS_VFS_SYSTEM_IMAGE_WRITE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_BOOT_POLICY_STRICT`, `BARE_OS_LAZY_PERSONAL_DRIVE`, `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT`, `BARE_OS_DELEGATE_ALLOW`, `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_MAX_CONCURRENT`, `BARE_OS_DELEGATE_GIT_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, `BARE_OS_DELEGATE_WGET_MAX_PER_MIN`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN`, `BARE_OS_DELEGATE_GIT_MAX_CONCURRENT`, `BARE_OS_DELEGATE_CURL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_WGET_MAX_CONCURRENT`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_AUDIT_ONLY`, `BARE_OS_DNS_ALLOWLIST`, `BARE_OS_KERNEL_HOT_RELOAD`, `BARE_OS_KERNEL_EXT_D_HOT_RELOAD`, `BARE_OS_KERNEL_EXT_GRAPH`, `BARE_OS_KERNEL_EXT_RESOLUTION_JSON_ALWAYS`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_TELEMETRY_OTEL_JSONL`, `BARE_OS_TELEMETRY_OTEL`, `BARE_OS_PROC_POLL_MS`, `BARE_OS_TIMER_EVERY_MS_MONOTONIC`, `BARE_OS_TRACE_ID`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_OFFLINE_LKG_BOOT`, `BARE_OS_LKG_SYSTEM_KEY_HEX`, `BARE_OS_HOST_STORAGE_JSON`, `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`, `BARE_OS_SUBPROCESS_BRIDGE_JOBS_JSON`, `BARE_OS_IPC_AUDIT`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_XARGS_MAX_PROCS`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_SSH_BIND_ALL`, `BARE_OS_SSH_LISTEN_PORT`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, `BARE_OS_PEER_FIREWALL_E2E_JSON`, `BARE_OS_PEAR_SECURE_ENCLAVE_JSON`, `BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON`, `BARE_OS_PEAR_TRUST_JSON`, `BARE_OS_HOST_BUNDLE_EVALUATE`, `BARE_OS_WASM_KERNEL`, `BARE_OS_WASM_KERNEL_SYSCALL`, `BARE_OS_WASM_KERNEL_MONOTONIC_MS`, `BARE_OS_WASM_KERNEL_HOSTNAME_IMPORT`, **`TERM`**, **`COLORTERM`**. *(Many additional operator JSON pointers and version pins are also copied from the same loop; see source.)*
 
-**Booter default session (host left these empty):** the stock booter then assigns **`BARE_OS_SHELL_STREAMING=1`**, **`BARE_OS_SHELL_STREAMING_MULT=2`**, **`BARE_OS_PIPELINE_MAX_BYTES=536870912`**, and **`BARE_OS_PIPELINE_MAX_LINES=2000000`** so the guest gets the high-throughput pipeline profile without extra host configuration (override by setting those keys on the host before boot).
+**Booter default session (host left these empty):** the stock booter assigns **`BARE_OS_SHELL_STREAMING=1`**, **`BARE_OS_SHELL_STREAMING_MULT=2`**, **`BARE_OS_PIPELINE_MAX_BYTES=536870912`**, **`BARE_OS_PIPELINE_MAX_LINES=2000000`**, **`BARE_OS_INITD_MAX_PARALLEL=4`** (parallel starts per DAG level), **`BARE_OS_SHELL_CMDSUBST=1`**, **`BARE_OS_VFS_BIN_CACHE=1`**, and **`BARE_OS_TELEMETRY_NDJSON=/var/log/bare-os/telemetry.ndjson`**. Exec **audit** sinks (**`BARE_OS_AUDIT`**, **`BARE_OS_AUDIT_JSON`**, …) remain off unless the host sets them. Override any key from the host before boot.
 
 - `BARE_OS_VFS_UNION_PREFIXES` — Booter / VFS — Comma-separated logical path prefixes where **`readFile`** may union system + overlay sources.
 - `BARE_OS_VFS_UNION_WRITE_DENY` — Booter / VFS — When **`1`** / **`true`**, block **`writeFile`** / **`unlink`** on paths under union read prefixes (read-only union overlay).
@@ -90,7 +90,7 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_POSIX_MQ_MAX_MSGS` — Booter / IPC — Default **`maxmsg`** for POSIX **`mq_open`** when the caller omits attrs (subject to internal ceilings); optional host passthrough.
 - `BARE_OS_POSIX_MQ_MSG_BYTES` — Booter / IPC — Default per-message **`maxBytes`** for **`mq_open`** when attrs are omitted.
 - `BARE_OS_VFS_MAX_OPEN` — Booter — When set on the host (positive integer), guest **`/proc/bare_os/rlimits.json`** maps **`RLIMIT_NOFILE`** **`cur`** and **`max`** to that value (advisory mirror for scripts; not a hard kernel **`ulimit`**).
-- `BARE_OS_VFS_BIN_CACHE` — VFS — When **`1`** / **`true`**, LRU read cache for **`/bin`**; invalidated on **`vfs.watch`** when enabled.
+- `BARE_OS_VFS_BIN_CACHE` — VFS — When **`1`** / **`true`**, LRU read cache for **`/bin`**; invalidated on **`vfs.watch`** when enabled. Stock booter seeds **`1`** when unset (set **`0`** / **`false`** on the host to disable).
 - `BARE_OS_VFS_BIN_CACHE_BLAKE2B` — VFS — When **`1`** / **`true`** with **`BARE_OS_VFS_BIN_CACHE`**, **`/bin`** cache entries are keyed by **BLAKE2b** content digests (via **`bare-crypto`**) for deduplication across paths within the LRU budget.
 - `BARE_OS_VFS_ENFORCE_ACL` — VFS — When **`1`** / **`true`**, **`PATH.bare_acl`** sidecars (same text as **`getfacl` / `setfacl`**) can deny reads/writes on the personal drive. Lines **`user::`**, **`user:UID:`**, **`group::`**, **`group:GID:`**, **`other::`**, and **`mask::`** are interpreted with Linux-style **mask** capping named users, named groups, and **`group::`**; **`user::`** and **`other::`** are not masked. Object owner/group default to **`UID` / `GID`**; override with **`BARE_OS_ACL_OBJECT_UID`** / **`BARE_OS_ACL_OBJECT_GID`** when inode metadata differs. See **`bare-os-vfs-acl-enforce.js`**.
 - `BARE_OS_SHELL_LOOP_CONTROL` — Shell — When **`1`** / **`true`**, **`break`** and **`continue`** apply inside **`while`** / **`for`** (bounded by **`BARE_OS_SHELL_LOOP_MAX`**).
@@ -164,10 +164,10 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_IPC_NAMESPACE` — VFS / mkfifo / initd — Prefix simulated FIFO keys as **`<ns>__<name>`** while logical paths stay **`/run/bare-os/ipc/<name>`**.
 - `BARE_OS_SANDBOX_SCRIPT` — `ctx.bareOsSandboxRunScript` — Set **`0`** / **`false`** to disable sandbox script helper.
 - `BARE_OS_SANDBOX_WORKER` — Booter — When **`1`**, defers **`bareOsSandboxRunScript`** on a **fresh microtask** (async boundary); **not** a separate thread or isolate.
-- `BARE_OS_INITD_MAX_PARALLEL` — bare-initd — Max concurrent unit **starts** per DAG level (integer ≥ **1**; default **1**).
+- `BARE_OS_INITD_MAX_PARALLEL` — bare-initd — Max concurrent unit **starts** per DAG level (integer ≥ **1**; stock booter seeds **4** when unset; boot policy **`initdAdmission.maxParallel`** may still clamp).
 - `BARE_OS_INITD_DISABLED` — bare-initd — **Host-only** (read from **`globalThis.process.env`**, not guest **`vfs.env`**). Comma- or whitespace-separated initd unit names merged into the disabled set alongside **`~/.config/bare-os/initd/disabled.txt`**. Used in **`packages/bare-os-booter/test.js`** to skip **`bare-openssh`** under Node ( **`bare-ssh2`** needs Bare **`require.addon`**).
 - `BARE_OS_INITD_JOURNAL_MAX_LINES` — bare-initd / unit journals — Cap lines retained per unit NDJSON journal under **`/run/bare-os/unit-journal/`**.
-- `BARE_OS_TELEMETRY_NDJSON` — Booter — Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`telemetrySchemaVersion` / `lifecycleSchemaVersion`** follow stock **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`**, currently **10** in the tree; **`ts`**, …) mirroring structured boot/kernel events. String fields are passed through a **best-effort redactor** (long hex, `Bearer …`, `sk-…` shapes) before append; do not rely on it for classified payloads.
+- `BARE_OS_TELEMETRY_NDJSON` — Booter — Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`telemetrySchemaVersion` / `lifecycleSchemaVersion`** follow stock **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`**, currently **10** in the tree; **`ts`**, …) mirroring structured boot/kernel events. String fields are passed through a **best-effort redactor** (long hex, `Bearer …`, `sk-…` shapes) before append; do not rely on it for classified payloads. Stock booter seeds **`/var/log/bare-os/telemetry.ndjson`** when unset; set **`0`** / **`false`** on the host to disable the sink (empty path disables **`mirrorBareOsTelemetryNdjson`**).
 - `BARE_OS_TELEMETRY_OTEL_JSONL` — Booter / var-log — Guest VFS path for OTLP-inspired JSON lines (var-log mirrors).
 - `BARE_OS_TELEMETRY_OTEL` — Booter — When **`1`** / **`true`** and **`BARE_OS_TELEMETRY_OTEL_JSONL`** is unset or **`0`**, the booter sets the OTel JSONL path to **`/var/log/bare-os/otel.jsonl`**.
 - `BARE_OS_PROC_POLL_MS` — VFS — Coalescing interval for **`/proc/bare_os/metrics_live.json`** and poll cadence for related pseudo metrics reads (250–60000).