Complete the internal “100 task” roadmap: coreutils and shell parity (xargs,

sh, diff/patch, sort, printf, find, test, getfacl/setfacl/xattr), expanded
/proc and metrics (process table, syscalls, replication, net, security
posture, worker budget, swarm/replication hints), initd DAG supervision
metadata and richer restart journal telemetry, synthetic process groups via
IPC (assignProcessGroup/signalProcessGroup) mirrored into process_table,
optional kernel.ext.d incremental hot reload (BARE_OS_KERNEL_EXT_D_HOT_RELOAD)
with reload audit NDJSON, features proc for hyperblobs dedup and systemd
subset documentation, vault threat model doc plus posture fields for AEAD,
Pear enclave pointer, account rotation continuity, and Ed25519 consistency
across boot manifest / extensions / replication. Adds or extends tests and
keeps kernel/ and packages/bare-os-seeder/kernel/ in parity; guest init is
bundled from kernel/lib/init/init-main.js via bundle-kernel-init.

scripts/gen-ctx-client-helper.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
- * Emit a tiny TypeScript client header aligned with BARE_OS_CTX_API_VERSION.
- * Full schema-driven generation remains a follow-up; this replaces the stdout placeholder.
+ * Emit a TypeScript helper aligned with BARE_OS_CTX_API_VERSION and bare-os-ctx.d.ts.
+ * Writes docs/reference/ctx-client-helper.generated.ts (commit this file when the API bumps).
  */
 import fs from 'node:fs'
 import path from 'node:path'
@@ -13,15 +13,52 @@ const apiPath = path.join(
   root,
   'packages/bare-os-booter/lib/bare-os-ctx-api.js'
 )
-const src = fs.readFileSync(apiPath, 'utf8')
-const m = src.match(/export const BARE_OS_CTX_API_VERSION = '([^']+)'/)
+const dtsPath = path.join(
+  root,
+  'packages/bare-os-booter/lib/bare-os-ctx.d.ts'
+)
+const outPath = path.join(root, 'docs/reference/ctx-client-helper.generated.ts')
+
+const apiSrc = fs.readFileSync(apiPath, 'utf8')
+const m = apiSrc.match(/export const BARE_OS_CTX_API_VERSION = '([^']+)'/)
 const ver = m ? m[1] : 'unknown'
 
-const out = `// Auto-generated by scripts/gen-ctx-client-helper.mjs — do not edit by hand.
-// Types: import type { BareOsKernelContext } from 'bare-os-booter/lib/bare-os-ctx.js'
-// (path varies by consumer package layout)
+let dtsBareOsMemberApprox = 0
+let dtsBytes = 0
+if (fs.existsSync(dtsPath)) {
+  const dts = fs.readFileSync(dtsPath, 'utf8')
+  dtsBytes = dts.length
+  const re = /\bbareOs[a-zA-Z0-9_]*\??\s*[:(]/g
+  let mm
+  while ((mm = re.exec(dts)) !== null) dtsBareOsMemberApprox++
+}
 
+const out = `// Auto-generated by scripts/gen-ctx-client-helper.mjs — do not edit by hand.
+
+/** Canonical \`ctx\` API semver from \`packages/bare-os-booter/lib/bare-os-ctx-api.js\`. */
 export const BARE_OS_CTX_API_CLIENT_VERSION = '${ver}' as const
+
+/** Relative path to the hand-maintained TypeScript contract (schema source of truth). */
+export const BARE_OS_CTX_DTS_SOURCE = 'packages/bare-os-booter/lib/bare-os-ctx.d.ts' as const
+
+/** Approximate count of \`bareOs…\` members in the DTS (diagnostic only; regenerate on contract edits). */
+export const BARE_OS_CTX_DTS_BAREOS_MEMBER_APPROX = ${dtsBareOsMemberApprox} as const
+
+/** Byte length of \`bare-os-ctx.d.ts\` when this file was generated. */
+export const BARE_OS_CTX_DTS_BYTES = ${dtsBytes} as const
+
+/** Pointers for external client generators (OpenAPI / JSON Schema follow-ups). */
+export const BARE_OS_CTX_SCHEMA_HINT = {
+  ctxApiVersion: BARE_OS_CTX_API_CLIENT_VERSION,
+  primaryInterface: 'BareOsKernelContext',
+  documentation: [
+    'docs/reference/package-bare-os-protocol.md',
+    'docs/reference/package-bare-os-booter.md',
+    'developer-guide/02-the-context-object.md',
+  ],
+} as const
 `
 
+fs.mkdirSync(path.dirname(outPath), { recursive: true })
+fs.writeFileSync(outPath, out, 'utf8')
 process.stdout.write(out)