Complete the internal “100 task” roadmap: coreutils and shell parity (xargs,

sh, diff/patch, sort, printf, find, test, getfacl/setfacl/xattr), expanded
/proc and metrics (process table, syscalls, replication, net, security
posture, worker budget, swarm/replication hints), initd DAG supervision
metadata and richer restart journal telemetry, synthetic process groups via
IPC (assignProcessGroup/signalProcessGroup) mirrored into process_table,
optional kernel.ext.d incremental hot reload (BARE_OS_KERNEL_EXT_D_HOT_RELOAD)
with reload audit NDJSON, features proc for hyperblobs dedup and systemd
subset documentation, vault threat model doc plus posture fields for AEAD,
Pear enclave pointer, account rotation continuity, and Ed25519 consistency
across boot manifest / extensions / replication. Adds or extends tests and
keeps kernel/ and packages/bare-os-seeder/kernel/ in parity; guest init is
bundled from kernel/lib/init/init-main.js via bundle-kernel-init.

handbook/04-the-booter-runtime.md

@@ -176,7 +176,8 @@ There is no arbitrary command execution, **`source`**, or control flow — it is
 - **`registerBareService({ name, start, stop?, description?, logPath? })`** — optional **`stop`** enables **`systemctl stop`** / **`restart`** for that unit; **`logPath`** is a logical VFS path for **`systemctl status`** / **`logs`**
 - **`startBareInitd(ctx)`** — ensures **`/var/log/bare-os`** (see below), then **DAG-ordered** start with optional parallelism (**`BARE_OS_INITD_MAX_PARALLEL`**, default **1**). Skips units listed in **`~/.config/bare-os/initd/disabled.txt`**. Drop-ins **`~/.config/bare-os/units/<name>.unit`** support **`[Unit]`** keys **`After=`**, **`Before=`**, **`Requires=`**, **`Wants=`**, **`TimeoutStartSec=`**, **`TimeoutStopSec=`**, **`Restart=`**, **`RestartSec=`**, **`OnFailure=`**, **`FailureAction=`**, **`ExecStartPost=`**, **`SocketActivationIpc=`** (defers **`start()`** until the first read on that FIFO), **`IdleSec=`** (with socket activation and a **`stop`** handler: stop after idle seconds between FIFO messages), **`ReadinessPath=`** (VFS path until **`exists`**, or **`exec:<execLine>`** gated by **`ReadinessTimeoutSec=`**), **`ReadinessTimeoutSec=`**, **`ConditionPathExists=`** (skip start when missing), **`AssertPathExists=`** (fail unit when missing). Optional fragments **`~/.config/bare-os/units.d/<name>/*.conf`** (sorted **`.conf`**) merge after the main **`.unit`** and before **`~/.config/bare-init/units/`** overrides. Cycles in **`After`/`Before`** are detected and logged; affected units fail start. Default **`bare-cron`** runs after **`kernel-logger`**. Per-service `try/catch`, `[bare-initd] name: err` on failure; failures append to **`/var/log/bare-os/initd.log`** and the structured unit journal; runtime state **`active`** / **`failed`** / **`inactive`**. **`waitForBareInitdUnits(names, timeoutMs)`** polls until listed units are **`active`** (exposed as **`ctx.bareOsAwaitInitdUnits`**). Mobile **`Bare.suspend`** / **`Bare.wakeup`** walks **stop** handlers in **reverse boot order** and **start** hooks forward, matching the DAG snapshot in **`/proc/bare_os/initd_graph.json`**.
 - **`listBareServices()`**, **`getBareServiceRuntime(name)`**, **`findBareServiceDefinition(name)`**, **`startBareService` / `stopBareService` / `restartBareService`** — introspection and lifecycle (used by the CLI below)
-- **`registerKernelShutdownHook(fn)`** + **`runKernelShutdownHooks()`** — async-friendly teardown before disposers (REPL **`session.cleanup`** awaits hooks, then **`stopBareInitd()`**)
+- **`bareInitdShutdownActiveUnitsReverse(ctx)`** — REPL **`session.cleanup`** awaits this **first**: calls **`stop`** on every **active** unit with a **`stop`** handler, in **reverse boot-DAG** order (same direction as mobile suspend).
+- **`registerKernelShutdownHook(fn)`** + **`runKernelShutdownHooks()`** — async-friendly teardown **after** initd reverse stop, **before** disposers; then **`stopBareInitd()`** clears intervals and runs **`registerBareInitdDisposer`** callbacks.
 - **`registerBareInitdDisposer(fn)`** + **`stopBareInitd()`** — for intervals and synchronous teardown
 - **Kernel logger** — mirrors **`console.log`/`error`** to **`/var/log/bare-os/kernel-console.log`**. The VFS exposes **`/var`** as a virtual directory and maps **`/var/log/…`** onto the **personal** Hyperdrive at **`/.bare-os/var/log/…`** (the system image drive stays read-only). Each log file is **trimmed** when it grows past 512 KiB (last 256 KiB kept plus a notice line).
 
@@ -193,13 +194,19 @@ Built-in **`kernel-logger`** wraps **`ctx.console.log` / `error`** to append UTF
 - Reads **`/etc/bare-os/crontab`** on the **system** image (if present), then **`~/.crontab`** on the personal drive (silent if missing). Invalid lines are skipped and logged to **`/var/log/bare-os/cron.log`**.
 - Loads timer drop-ins from **`~/.config/bare-os/timers/*.timer`** (max **8** files): **`[Timer]`** with **`OnCalendar=`** (five cron fields) + **`ExecLine=`** — merged into the same minute tick as crontab jobs; optional **`JitterSec=`** (spread **`execLine`** within **0…N** seconds); or **`EveryMs=`** (**1000**–**86400000**) + **`ExecLine=`** — fixed-interval **`setInterval`** jobs (optional **`JitterSec=`** delays the first tick); or **`OnInactiveSec=`** + **`ExecLine=`** — fire after the last timer run finishes plus an idle window (**`Persistent=`** keeps scheduling state where supported). Image examples: **`/etc/bare-os/timers/*.timer.example`** on the system drive (copy into **`~/.config/bare-os/timers/`** and rename to **`*.timer`**).
 - Parses five-field cron lines + command remainder, **`@reboot`** + command (once per **`bare-cron`** start), and optional leading **`JitterSec=N`** on the command side for calendar lines.
-- Aligns to **minute boundaries**, **`setInterval(60s)`**, runs **`await ctx.execLine(command)`** with per-line **in-flight** guard; job errors are appended to **`/var/log/bare-os/cron.log`** as well as **`console.error`**.
+- Aligns to **minute boundaries**, **`setInterval(60s)`**, runs **`await ctx.execLine(command)`** with per-line **in-flight** guard; job errors are appended to **`/var/log/bare-os/cron.log`** as well as **`console.error`**. Calendar lines use **wall-clock** minute ticks; **`EveryMs=`** timers use **monotonic-ish** **`setInterval`** spacing (not drift-corrected to NTP — see distributed time sync in **`/proc/bare_os`** when enabled).
 - One **disposer** at module load clears timers on session shutdown; **`stopBareCron`** is also the unit **`stop`** for **`systemctl`**.
 
 Install/list/remove user crontab with **`/bin/crontab`** (see [Chapter 6](06-kernel-and-binaries.md)). See [Developer guide ch.11](../developer-guide/11-kernel-pear-cookbook.md) for timer file layout.
 
 ---
 
+## Shell session, controlling TTY sketch, and job-control gaps
+
+The interactive shell keeps **`ctx.shellSessionState`**: **`sid`** (session id), **`nextPgid`** (for **`&` background jobs**), **`foregroundPgid`** (reset to **`sid`** before each foreground line — session-leader model), and **`controllingTty`** (**`/dev/console`** or **`ipc:<session-fifo>`** when **`BARE_OS_SESSION_FIFO`** / **`BARE_OS_IPC_SESSION_FIFO`** is set). Background jobs record **`sid`** / **`pgid`** in **`ctx.shellBackgroundJobs`** for **`jobs`** output. This is **not** full POSIX job control: there is no **`tcsetpgrp`**, no **`SIGTSTP`/`SIGCONT`** pipeline to the host TTY, and **`fg`/`bg`** are not implemented. Host **SIGINT** may arrive as **`bare-os:host-sigint`** (via optional **`bare-signals`** or **`process.on('SIGINT')`**) for cooperative cancellation; **`ctx.bareOsSendSignal`** also records **PIPE** / **CHLD** / **USR1** / **USR2** on synthetic PIDs without ending the session.
+
+---
+
 ## REPL: fish-style line editor
 
 When stdin/stdout are a capable TTY and **`BARE_OS_FISH≠0`**, **`fish-readline.js`** provides **history**, **hints**, and synchronized **`Console`** output so prompts and **`console.log`** do not fight. History files live on the **personal** drive **keyed by user identity**, so guests and logged-in users do not stomp each other’s command recall. Set **`BARE_OS_FISH=0`** for minimal readline or pipes-first automation; **`BARE_OS_SKIP_REPL=1`** skips the interactive kernel loop entirely.

handbook/07-operations-and-development.md

@@ -78,6 +78,20 @@ If any step fails, scroll the **`npm test`** output for the first non-zero exit;
 
 See [docs/README.md](../docs/README.md) and [developer-guide ch.12](../developer-guide/12-bare-modules-and-pear-ecosystem.md).
 
+### Bundle provenance on the drive (`kernel/lib/bare/manifest.json`)
+
+Each **`npm run build -w bare-os-bare-libs`** run writes **`kernel/lib/bare/manifest.json`** (and mirrors it into **`packages/bare-os-seeder/kernel/lib/bare/manifest.json`**) with:
+
+- **`bundles`** — `/lib/bare/bundles/*.js` paths and **`ctx.bare`** keys.
+- **`bundleStats`** / **`bundleDiagnostics`** — row count and per-bundle byte sizes.
+- **`bundleProvenance`** — **`schemaVersion`**, ISO **`generatedAt`**, repo **`gitCommit`** (from **`git rev-parse HEAD`** when available), host **`nodeVersion`**, **`bundleTier`** (**`all`** unless **`BARE_OS_BUNDLE_TIER`** narrowed the build), **`normativeManifest`**, and **`buildScript`** path.
+
+Use provenance to audit which commit produced an image’s Holepunch IIFEs and to compare bundle tiers across environments.
+
+### Pear bundle and pack pipeline (OS images)
+
+For Pear-shaped releases, align **`pear-bundle`** / **`pear-pack`** with the same **`kernel/`** tree the seeder stages: run **`npm run build -w bare-os-coreutils`** and **`npm run build -w bare-os-bare-libs`**, verify **`scripts/verify-kernel-seeder-parity.mjs`**, then point Pear tooling at **`packages/bare-os-seeder`** or the published Hyperdrive key. Keep **`pear-runtime`** and **`bare-os-protocol`** versions coupled per [compatibility-matrix.md](../docs/reference/compatibility-matrix.md).
+
 ---
 
 ## Release checklist

handbook/09-posix-utilities-shell-and-vfs.md

@@ -10,6 +10,8 @@ If you come from Linux or macOS, Bare OS **feels** like a small Unix: **`ls`**,
 
 **Normative reference:** Open Group **Issue 7** — use the online utilities index for intended semantics; Bare behavior may intentionally diverge where Hyperdrive or the single-process runtime makes full compliance impossible.
 
+**Declared profile:** the protocol package publishes **`BARE_OS_POSIX_PROFILE_VERSION`** / **`BARE_OS_POSIX_PROFILE_ID`** (`bare-os-posix-like`), surfaced on **`/proc/bare_os_features`** and in **`/proc/bare_os/syscalls.json`** (schema **3**). Cold-boot wall time vs **`BARE_OS_BOOT_BUDGET_MS_COLD`** is also written to **`/run/bare-os/boot-perf.json`** when the VFS supports it.
+
 ---
 
 ## On this page