Complete the internal “100 task” roadmap: coreutils and shell parity (xargs,

sh, diff/patch, sort, printf, find, test, getfacl/setfacl/xattr), expanded
/proc and metrics (process table, syscalls, replication, net, security
posture, worker budget, swarm/replication hints), initd DAG supervision
metadata and richer restart journal telemetry, synthetic process groups via
IPC (assignProcessGroup/signalProcessGroup) mirrored into process_table,
optional kernel.ext.d incremental hot reload (BARE_OS_KERNEL_EXT_D_HOT_RELOAD)
with reload audit NDJSON, features proc for hyperblobs dedup and systemd
subset documentation, vault threat model doc plus posture fields for AEAD,
Pear enclave pointer, account rotation continuity, and Ed25519 consistency
across boot manifest / extensions / replication. Adds or extends tests and
keeps kernel/ and packages/bare-os-seeder/kernel/ in parity; guest init is
bundled from kernel/lib/init/init-main.js via bundle-kernel-init.

scripts/verify-runtime-no-incomplete-markers.mjs

@@ -9,6 +9,10 @@ import process from 'node:process'
 import { fileURLToPath } from 'node:url'
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const excludeConfigPath = path.join(
+  root,
+  'docs/audit/runtime-marker-excludes.json'
+)
 
 const MARKER_RE = /\b(TODO|FIXME|HACK|XXX)\b/
 const NOT_IMPLEMENTED_RE = /throw\s+new\s+Error\s*\(\s*['"]Not implemented['"]\s*\)/
@@ -31,16 +35,37 @@ function walk(dir) {
   return out
 }
 
-function shouldSkipFile(rel) {
+function loadExcludePrefixes() {
+  try {
+    const raw = fs.readFileSync(excludeConfigPath, 'utf8')
+    const j = JSON.parse(raw)
+    const p = Array.isArray(j.pathPrefixes) ? j.pathPrefixes : []
+    return p
+      .map((s) => String(s || '').replace(/\//g, path.sep))
+      .filter(Boolean)
+  } catch {
+    return []
+  }
+}
+
+/**
+ * @param {string} rel
+ * @param {string[]} excludePrefixes
+ */
+function shouldSkipFile(rel, excludePrefixes) {
   if (rel.startsWith(`packages${path.sep}bare-os-booter${path.sep}test`))
     return true
   if (rel === `packages${path.sep}bare-os-booter${path.sep}test.js`) return true
   if (rel.startsWith(`kernel${path.sep}bin${path.sep}`)) return true
   if (rel.includes(`${path.sep}bundles${path.sep}`)) return true
+  for (const pre of excludePrefixes) {
+    if (rel === pre || rel.startsWith(pre + path.sep)) return true
+  }
   return false
 }
 
 function main() {
+  const excludePrefixes = loadExcludePrefixes()
   const files = [
     path.join(root, 'kernel', 'init.js'),
     path.join(root, 'kernel', 'lib', 'init', 'init-main.js'),
@@ -54,7 +79,7 @@ function main() {
   for (const abs of files) {
     if (!fs.existsSync(abs)) continue
     const rel = path.relative(root, abs)
-    if (shouldSkipFile(rel)) continue
+    if (shouldSkipFile(rel, excludePrefixes)) continue
     const txt = fs.readFileSync(abs, 'utf8')
     for (let i = 0; i < txt.length; i++) {
       const slice = txt.slice(i, i + 200)