CI/docs: placeholder-baseline --check, seeder↔kernel sync script and docs,

holepunch lockfile drift Markdown dashboard + doc links
- disk.os / ctx: replication_operator_sketch schema 5 + corestore stats;
  protomux extensions proc versioning; HRPC allowlist_sketch schema 3 +
  versioned stock route table; swarm_health proc + runtime caps paths
- Session: BARE_OS_HOSTNAME_SET + ctx.bareOsSetSessionHostname, hostname man,
  security_posture; export -p in shell
- kernel.ext.d: optional provides[] version conflict detection (strict boot);
  resolver parity + tests; BARE_OS_INIT_DEFER_KERNEL_EXT_GRAPH documented
- VFS/policy: mirror/aux read tests, GUEST_BARE_READ_ALL edge negative test;
  adaptive warm-cache window env documented; microbench note
- POSIX: syscalls.json schema 10, posix_fadvise no-op, getconf + conformance
  matrix sync; posix-issue7-traceability index; handbook/profile/matrix updates
- Seeder: pear.multisig hint tests; SCM_RIGHTS unit coverage extended
- Regenerated kernel bundle, seeder kernel mirror, posix dashboard, coreutils
  build/man; booter CHANGELOG maintenance row updated
Full npm test / pretest green.

kernel/bin/getconf

@@ -183,10 +183,10 @@ const CONF = {
   _PC_2_SYMLINKS: '1',
   /** Comma-separated `ctx.bareOsSyscall` op names implemented in stock booter. */
   BARE_OS_SYSCALL_OPS:
-    'accept,access,bind,chdir,chmod,clock_gettime,connect,exists,fcntl,fdatasync,fsync,ftruncate,getcwd,getsockopt,kill,link,listen,lstat,mkdir,mount,mq_open,mq_receive,mq_send,nanosleep,pathconf,posixPoll,readFile,readdir,readlink,readv,recv,recvfrom,recvmsg,rename,rmdir,select,send,sendmsg,setsockopt,shutdown,socket,stat,symlink,truncate,umask,umount,unlink,utimes,writeFile,writev',
+    'accept,access,bind,chdir,chmod,clock_gettime,connect,exists,fcntl,fdatasync,fsync,ftruncate,getcwd,getsockopt,kill,link,listen,lstat,mkdir,mount,mq_open,mq_receive,mq_send,nanosleep,pathconf,posix_fadvise,posixPoll,readFile,readdir,readlink,readv,recv,recvfrom,recvmsg,rename,rmdir,select,send,sendmsg,setsockopt,shutdown,socket,stat,symlink,truncate,umask,umount,unlink,utimes,writeFile,writev',
   /** POSIX.1 XSH-style names documented in `/proc/bare_os/syscalls.json` opsDetail (socket family are syscall probes returning ENOSYS-shaped results). */
   BARE_OS_POSIX_XSH_OPS:
-    'open,close,read,write,lseek,nanosleep,clock_gettime,pipe,dup,dup2,fcntl,poll,select,umask,socket,bind,listen,accept,connect,send,recv,recvfrom,sendmsg,recvmsg,shutdown',
+    'open,close,read,write,readv,writev,getsockopt,setsockopt,lseek,nanosleep,clock_gettime,posix_fadvise,pipe,dup,dup2,fcntl,poll,select,umask,fsync,fdatasync,socket,bind,listen,accept,connect,send,recv,recvfrom,sendmsg,recvmsg,shutdown',
   /** Encodings accepted by `/bin/iconv` (subset; case-insensitive names). */
   BARE_OS_ICONV_ENCODINGS: 'UTF-8,ISO-8859-1,UTF-16LE,UTF-16BE',
   /** Synthetic process table JSON path (logical VFS). */

kernel/bin/hostname

@@ -95,11 +95,28 @@ async function run(ctx, argv) {
     'bare-os'
   h = String(h)
   let shortOnly = false
+  let setName = null
   for (let i = 1; i < argv.length; i++) {
     const a = String(argv[i] || '')
     if (a === '-s' || a === '--short') shortOnly = true
     else if (a === '-f' || a === '--fqdn') shortOnly = false
-    else if (a === '--') break
+    else if (a === '-S' || a === '--set') {
+      setName = String(argv[++i] || '').trim()
+      break
+    } else if (a === '--') break
+  }
+  if (setName != null) {
+    if (
+      typeof ctx.bareOsSetSessionHostname === 'function' &&
+      (ctx.env?.BARE_OS_HOSTNAME_SET === '1' ||
+        ctx.env?.BARE_OS_HOSTNAME_SET === 'true')
+    ) {
+      ctx.bareOsSetSessionHostname(setName)
+      return
+    }
+    throw new Error(
+      'hostname: setting disabled (require BARE_OS_HOSTNAME_SET=1 and ctx.bareOsSetSessionHostname)'
+    )
   }
   if (shortOnly) {
     const dot = h.indexOf('.')

kernel/etc/bare-os/posix_utilities.json

@@ -1,7 +1,7 @@
 {
   "schema": 2,
   "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-05T18:15:46.515Z",
+  "generatedAt": "2026-04-05T18:43:53.989Z",
   "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
   "commandIndex": [
     {

kernel/etc/bare-os/syscalls.example.json

@@ -1,6 +1,6 @@
 {
-  "schemaVersion": 9,
-  "ctxApiVersion": "1.50.0",
+  "schemaVersion": 10,
+  "ctxApiVersion": "1.51.0",
   "posixProfile": {
     "id": "bare-os-posix-like",
     "version": "1.0.15"

kernel/init.js

@@ -1690,8 +1690,10 @@ async function runKernelExtDropins(ctx, opts = {}) {
     return true
   }
   names.sort()
-  /** @type {{ file: string, extId: string, scripts: string[], dependsOn: string[], beforeIds: string[], conflictsWith: string[], signaturePointer?: string }[]} */
+  /** @type {{ file: string, extId: string, scripts: string[], dependsOn: string[], beforeIds: string[], conflictsWith: string[], signaturePointer?: string, provides: { name: string, version: string }[] }[]} */
   const collected = []
+  /** @type {Map<string, string[]>} */
+  const extIdFiles = new Map()
   for (const name of names) {
     if (!name.endsWith('.json')) continue
     const p = `/etc/bare-os/kernel.ext.d/${name}`
@@ -1764,6 +1766,19 @@ async function runKernelExtDropins(ctx, opts = {}) {
       const conflictsWith = Array.isArray(pol.conflictsWith)
         ? pol.conflictsWith.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
         : []
+      /** @type {{ name: string, version: string }[]} */
+      const provides = Array.isArray(pol.provides)
+        ? pol.provides
+            .map((x) => {
+              if (!x || typeof x !== 'object') return null
+              const nm = String(x.name || '').trim()
+              const ver = String(x.version ?? x.semver ?? '').trim()
+              if (!nm || !ver) return null
+              return { name: nm, version: ver }
+            })
+            .filter(Boolean)
+            .slice(0, 16)
+        : []
       collected.push({
         file: name,
         extId,
@@ -1771,8 +1786,11 @@ async function runKernelExtDropins(ctx, opts = {}) {
         dependsOn,
         beforeIds,
         conflictsWith,
+        provides,
         signaturePointer: sig || undefined
       })
+      if (!extIdFiles.has(extId)) extIdFiles.set(extId, [])
+      extIdFiles.get(extId).push(name)
     } catch (e) {
       bootStructuredLog(
         ctx,
@@ -1782,6 +1800,59 @@ async function runKernelExtDropins(ctx, opts = {}) {
       )
     }
   }
+  /** @type {string[]} */
+  const duplicateExtIds = []
+  for (const [eid, files] of extIdFiles) {
+    if (files.length > 1) duplicateExtIds.push(eid)
+  }
+  duplicateExtIds.sort()
+  if (duplicateExtIds.length) {
+    bootStructuredLog(
+      ctx,
+      'error',
+      'kernelExt.duplicateId',
+      `[kernel.ext.d] duplicate extension id(s): ${duplicateExtIds.join(', ')} — each id must appear in at most one drop-in`
+    )
+    if (strictPol) {
+      await appendKernelExtAuditNdjson(ctx, {
+        event: 'duplicate_ext_id',
+        duplicateExtIds
+      })
+      return false
+    }
+  }
+  /** @type {Map<string, { extId: string, version: string }>} */
+  const provideNameToOwner = new Map()
+  /** @type {string[]} */
+  const providesVersionConflicts = []
+  for (const e of collected) {
+    for (const pr of e.provides || []) {
+      const prev = provideNameToOwner.get(pr.name)
+      if (prev && prev.version !== pr.version) {
+        providesVersionConflicts.push(
+          `${pr.name}: ${prev.extId}@${prev.version} vs ${e.extId}@${pr.version}`
+        )
+      } else if (!prev) {
+        provideNameToOwner.set(pr.name, { extId: e.extId, version: pr.version })
+      }
+    }
+  }
+  providesVersionConflicts.sort()
+  if (providesVersionConflicts.length) {
+    bootStructuredLog(
+      ctx,
+      'error',
+      'kernelExt.providesConflict',
+      `[kernel.ext.d] conflicting provides version(s): ${providesVersionConflicts.join('; ')}`
+    )
+    if (strictPol) {
+      await appendKernelExtAuditNdjson(ctx, {
+        event: 'provides_version_conflict',
+        conflicts: providesVersionConflicts
+      })
+      return false
+    }
+  }
   const idToCollected = new Map(collected.map((e) => [e.extId, e]))
   for (const e of collected) {
     for (const bid of e.beforeIds) {
@@ -1898,7 +1969,16 @@ async function runKernelExtDropins(ctx, opts = {}) {
   const extGraphOn =
     ctx.env?.BARE_OS_KERNEL_EXT_GRAPH === '1' ||
     ctx.env?.BARE_OS_KERNEL_EXT_GRAPH === 'true'
-  if (extGraphOn && ctx.vfs && typeof ctx.vfs.writeFile === 'function' && ctx.b4a) {
+  const extGraphDefer =
+    ctx.env?.BARE_OS_INIT_DEFER_KERNEL_EXT_GRAPH === '1' ||
+    ctx.env?.BARE_OS_INIT_DEFER_KERNEL_EXT_GRAPH === 'true'
+  if (
+    extGraphOn &&
+    !extGraphDefer &&
+    ctx.vfs &&
+    typeof ctx.vfs.writeFile === 'function' &&
+    ctx.b4a
+  ) {
     let bareModuleTraverse = 'unresolved'
     try {
       await import('bare-module-traverse')

kernel/lib/bare/manifest.json

@@ -1,18 +1,18 @@
 {
   "version": 1,
   "bundles": [
-    {
-      "path": "/lib/bare/bundles/safetyCatch.js",
-      "keys": [
-        "safetyCatch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/b4a.js",
       "keys": [
         "b4a"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/safetyCatch.js",
+      "keys": [
+        "safetyCatch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
@@ -31,18 +31,18 @@
         "protomux"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUrl.js",
-      "keys": [
-        "bareUrl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareEncoding.js",
       "keys": [
         "bareEncoding"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUrl.js",
+      "keys": [
+        "bareUrl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePath.js",
       "keys": [
@@ -55,12 +55,6 @@
         "bareEvents"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAbortController.js",
-      "keys": [
-        "bareAbortController"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAbort.js",
       "keys": [
@@ -68,21 +62,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareReadline.js",
+      "path": "/lib/bare/bundles/bareAbortController.js",
       "keys": [
-        "bareReadline"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareAddonResolve.js",
-      "keys": [
-        "bareAddonResolve"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareCrypto.js",
-      "keys": [
-        "bareCrypto"
+        "bareAbortController"
       ]
     },
     {
@@ -92,9 +74,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAsyncHooks.js",
+      "path": "/lib/bare/bundles/bareAddonResolve.js",
       "keys": [
-        "bareAsyncHooks"
+        "bareAddonResolve"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareReadline.js",
+      "keys": [
+        "bareReadline"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
       ]
     },
     {
@@ -104,9 +98,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAtomics.js",
+      "path": "/lib/bare/bundles/bareAsyncHooks.js",
       "keys": [
-        "bareAtomics"
+        "bareAsyncHooks"
       ]
     },
     {
@@ -116,9 +110,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareApk.js",
+      "path": "/lib/bare/bundles/bareAtomics.js",
       "keys": [
-        "bareApk"
+        "bareAtomics"
       ]
     },
     {
@@ -128,15 +122,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBmp.js",
+      "path": "/lib/bare/bundles/bareApk.js",
       "keys": [
-        "bareBmp"
+        "bareApk"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBuffer.js",
+      "path": "/lib/bare/bundles/bareBmp.js",
       "keys": [
-        "bareBuffer"
+        "bareBmp"
       ]
     },
     {
@@ -151,6 +145,12 @@
         "bareBundle"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBuffer.js",
+      "keys": [
+        "bareBuffer"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBluetoothApple.js",
       "keys": [
@@ -163,18 +163,18 @@
         "bareBundleEvaluate"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundleId.js",
-      "keys": [
-        "bareBundleId"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBoot.js",
       "keys": [
         "bareBoot"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBundleId.js",
+      "keys": [
+        "bareBundleId"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareConsole.js",
       "keys": [
@@ -187,30 +187,24 @@
         "bareDebugLog"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDaemon.js",
-      "keys": [
-        "bareDaemon"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareChannel.js",
       "keys": [
         "bareChannel"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDaemon.js",
+      "keys": [
+        "bareDaemon"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
         "bareDelta"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
-      "keys": [
-        "bareDiagnosticsChannel"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDns.js",
       "keys": [
@@ -218,9 +212,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareCov.js",
+      "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
       "keys": [
-        "bareCov"
+        "bareDiagnosticsChannel"
       ]
     },
     {
@@ -241,6 +235,12 @@
         "bareDgram"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareCov.js",
+      "keys": [
+        "bareCov"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFfmpeg.js",
       "keys": [
@@ -253,12 +253,6 @@
         "bareFfmpegEncodings"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFormat.js",
-      "keys": [
-        "bareFormat"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareFormData.js",
       "keys": [
@@ -266,9 +260,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
+      "path": "/lib/bare/bundles/bareFormat.js",
       "keys": [
-        "bareFileLogger"
+        "bareFormat"
       ]
     },
     {
@@ -278,15 +272,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareGtk.js",
+      "path": "/lib/bare/bundles/bareFileLogger.js",
       "keys": [
-        "bareGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
+        "bareFileLogger"
       ]
     },
     {
@@ -296,9 +284,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHttpParser.js",
+      "path": "/lib/bare/bundles/bareHrtime.js",
       "keys": [
-        "bareHttpParser"
+        "bareHrtime"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareGtk.js",
+      "keys": [
+        "bareGtk"
       ]
     },
     {
@@ -308,9 +302,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareImageResample.js",
+      "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
-        "bareImageResample"
+        "bareHttpParser"
       ]
     },
     {
@@ -320,9 +314,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareInspect.js",
+      "path": "/lib/bare/bundles/bareImageResample.js",
       "keys": [
-        "bareInspect"
+        "bareImageResample"
       ]
     },
     {
@@ -331,6 +325,12 @@
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspect.js",
+      "keys": [
+        "bareInspect"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
@@ -338,9 +338,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareJpeg.js",
+      "path": "/lib/bare/bundles/bareIpc.js",
       "keys": [
-        "bareJpeg"
+        "bareIpc"
       ]
     },
     {
@@ -350,9 +350,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareIpc.js",
+      "path": "/lib/bare/bundles/bareJpeg.js",
       "keys": [
-        "bareIpc"
+        "bareJpeg"
       ]
     },
     {
@@ -379,18 +379,6 @@
         "bareLink"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModuleLexer.js",
-      "keys": [
-        "bareModuleLexer"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareModuleResolve.js",
-      "keys": [
-        "bareModuleResolve"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareMake.js",
       "keys": [
@@ -403,6 +391,24 @@
         "bareModule"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareModuleResolve.js",
+      "keys": [
+        "bareModuleResolve"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareModuleLexer.js",
+      "keys": [
+        "bareModuleLexer"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareModuleTraverse.js",
+      "keys": [
+        "bareModuleTraverse"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNdk.js",
       "keys": [
@@ -416,15 +422,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNodeFetch.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
-        "bareNodeFetch"
+        "bareMedia"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareModuleTraverse.js",
+      "path": "/lib/bare/bundles/bareNodeFetch.js",
       "keys": [
-        "bareModuleTraverse"
+        "bareNodeFetch"
       ]
     },
     {
@@ -434,9 +440,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareMedia.js",
+      "path": "/lib/bare/bundles/bareOpen.js",
       "keys": [
-        "bareMedia"
+        "bareOpen"
       ]
     },
     {
@@ -446,9 +452,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareOpen.js",
+      "path": "/lib/bare/bundles/barePack.js",
       "keys": [
-        "bareOpen"
+        "barePack"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
       ]
     },
     {
@@ -457,24 +469,12 @@
         "barePerformance"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePipe.js",
-      "keys": [
-        "barePipe"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePng.js",
       "keys": [
         "barePng"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePack.js",
-      "keys": [
-        "barePack"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePackDrive.js",
       "keys": [
@@ -482,9 +482,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePrebuild.js",
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
       "keys": [
-        "barePrebuild"
+        "bareNodeRuntime"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePipe.js",
+      "keys": [
+        "barePipe"
       ]
     },
     {
@@ -500,9 +506,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareProcess.js",
+      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
       "keys": [
-        "bareProcess"
+        "bareQueueMicrotask"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePrebuild.js",
+      "keys": [
+        "barePrebuild"
       ]
     },
     {
@@ -512,45 +524,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "path": "/lib/bare/bundles/bareProcess.js",
       "keys": [
-        "bareQueueMicrotask"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
-      "keys": [
-        "bareNodeRuntime"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRpc.js",
-      "keys": [
-        "bareRpc"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRuntime.js",
-      "keys": [
-        "bareRuntime"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRun.js",
-      "keys": [
-        "bareRun"
+        "bareProcess"
       ]
     },
     {
@@ -560,15 +536,27 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSdl.js",
+      "path": "/lib/bare/bundles/bareRuntime.js",
       "keys": [
-        "bareSdl"
+        "bareRuntime"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSemver.js",
+      "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
-        "bareSemver"
+        "barePromClient"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareRpc.js",
+      "keys": [
+        "bareRpc"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSdl.js",
+      "keys": [
+        "bareSdl"
       ]
     },
     {
@@ -577,6 +565,18 @@
         "bareSignals"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSemver.js",
+      "keys": [
+        "bareSemver"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareRun.js",
+      "keys": [
+        "bareRun"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSidecar.js",
       "keys": [
@@ -584,9 +584,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStringDecoder.js",
+      "path": "/lib/bare/bundles/bareStdio.js",
       "keys": [
-        "bareStringDecoder"
+        "bareStdio"
       ]
     },
     {
@@ -602,21 +602,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareStringDecoder.js",
       "keys": [
-        "bareSvg"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStdio.js",
-      "keys": [
-        "bareStdio"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
-      "keys": [
-        "bareSystemLogger"
+        "bareStringDecoder"
       ]
     },
     {
@@ -626,15 +614,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTcp.js",
+      "path": "/lib/bare/bundles/bareSvg.js",
       "keys": [
-        "bareTcp"
+        "bareSvg"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
-        "bareSubprocess"
+        "bareSystemLogger"
       ]
     },
     {
@@ -643,12 +631,24 @@
         "bareTap"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTcp.js",
+      "keys": [
+        "bareTcp"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
         "bareTiff"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "keys": [
+        "bareSubprocess"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareThread.js",
       "keys": [
@@ -673,6 +673,12 @@
         "bareType"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUnpack.js",
+      "keys": [
+        "bareUnpack"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTls.js",
       "keys": [
@@ -685,12 +691,6 @@
         "bareUiKit"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUnpack.js",
-      "keys": [
-        "bareUnpack"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
@@ -703,42 +703,24 @@
         "bareV8"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareVm.js",
-      "keys": [
-        "bareVm"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareWebKit.js",
-      "keys": [
-        "bareWebKit"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
         "bareWalkHandles"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareVm.js",
+      "keys": [
+        "bareVm"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareUnionBundle.js",
       "keys": [
         "bareUnionBundle"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUtils.js",
-      "keys": [
-        "bareUtils"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareWebKitGtk.js",
-      "keys": [
-        "bareWebKitGtk"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWebp.js",
       "keys": [
@@ -752,9 +734,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWinUi.js",
+      "path": "/lib/bare/bundles/bareWebKit.js",
       "keys": [
-        "bareWinUi"
+        "bareWebKit"
       ]
     },
     {
@@ -764,15 +746,27 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareXdiff.js",
+      "path": "/lib/bare/bundles/bareWebKitGtk.js",
       "keys": [
-        "bareXdiff"
+        "bareWebKitGtk"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWs.js",
+      "path": "/lib/bare/bundles/bareUtils.js",
       "keys": [
-        "bareWs"
+        "bareUtils"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWinUi.js",
+      "keys": [
+        "bareWinUi"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareXdiff.js",
+      "keys": [
+        "bareXdiff"
       ]
     },
     {
@@ -781,6 +775,12 @@
         "bareZmq"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareZlib.js",
+      "keys": [
+        "bareZlib"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWorker.js",
       "keys": [
@@ -788,9 +788,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareZlib.js",
+      "path": "/lib/bare/bundles/bareWs.js",
       "keys": [
-        "bareZlib"
+        "bareWs"
       ]
     }
   ],
@@ -1595,8 +1595,8 @@
   ],
   "bundleProvenance": {
     "schemaVersion": 1,
-    "generatedAt": "2026-04-05T18:15:47.509Z",
-    "gitCommit": "c15e8fa5be4e6d014a383cff12024e5525e11bbd",
+    "generatedAt": "2026-04-05T18:43:55.029Z",
+    "gitCommit": "8bde7451914ae7534418f5c06def978ca5cec733",
     "nodeVersion": "v22.22.0",
     "bundleTier": "all",
     "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",

kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1775412946515,
+  "atMs": 1775414633988,
   "commands": [
     "arch",
     "awk",

kernel/lib/init/fragments/30-init-kernel-extensions.js

@@ -376,8 +376,10 @@ async function runKernelExtDropins(ctx, opts = {}) {
     return true
   }
   names.sort()
-  /** @type {{ file: string, extId: string, scripts: string[], dependsOn: string[], beforeIds: string[], conflictsWith: string[], signaturePointer?: string }[]} */
+  /** @type {{ file: string, extId: string, scripts: string[], dependsOn: string[], beforeIds: string[], conflictsWith: string[], signaturePointer?: string, provides: { name: string, version: string }[] }[]} */
   const collected = []
+  /** @type {Map<string, string[]>} */
+  const extIdFiles = new Map()
   for (const name of names) {
     if (!name.endsWith('.json')) continue
     const p = `/etc/bare-os/kernel.ext.d/${name}`
@@ -450,6 +452,19 @@ async function runKernelExtDropins(ctx, opts = {}) {
       const conflictsWith = Array.isArray(pol.conflictsWith)
         ? pol.conflictsWith.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
         : []
+      /** @type {{ name: string, version: string }[]} */
+      const provides = Array.isArray(pol.provides)
+        ? pol.provides
+            .map((x) => {
+              if (!x || typeof x !== 'object') return null
+              const nm = String(x.name || '').trim()
+              const ver = String(x.version ?? x.semver ?? '').trim()
+              if (!nm || !ver) return null
+              return { name: nm, version: ver }
+            })
+            .filter(Boolean)
+            .slice(0, 16)
+        : []
       collected.push({
         file: name,
         extId,
@@ -457,8 +472,11 @@ async function runKernelExtDropins(ctx, opts = {}) {
         dependsOn,
         beforeIds,
         conflictsWith,
+        provides,
         signaturePointer: sig || undefined
       })
+      if (!extIdFiles.has(extId)) extIdFiles.set(extId, [])
+      extIdFiles.get(extId).push(name)
     } catch (e) {
       bootStructuredLog(
         ctx,
@@ -468,6 +486,59 @@ async function runKernelExtDropins(ctx, opts = {}) {
       )
     }
   }
+  /** @type {string[]} */
+  const duplicateExtIds = []
+  for (const [eid, files] of extIdFiles) {
+    if (files.length > 1) duplicateExtIds.push(eid)
+  }
+  duplicateExtIds.sort()
+  if (duplicateExtIds.length) {
+    bootStructuredLog(
+      ctx,
+      'error',
+      'kernelExt.duplicateId',
+      `[kernel.ext.d] duplicate extension id(s): ${duplicateExtIds.join(', ')} — each id must appear in at most one drop-in`
+    )
+    if (strictPol) {
+      await appendKernelExtAuditNdjson(ctx, {
+        event: 'duplicate_ext_id',
+        duplicateExtIds
+      })
+      return false
+    }
+  }
+  /** @type {Map<string, { extId: string, version: string }>} */
+  const provideNameToOwner = new Map()
+  /** @type {string[]} */
+  const providesVersionConflicts = []
+  for (const e of collected) {
+    for (const pr of e.provides || []) {
+      const prev = provideNameToOwner.get(pr.name)
+      if (prev && prev.version !== pr.version) {
+        providesVersionConflicts.push(
+          `${pr.name}: ${prev.extId}@${prev.version} vs ${e.extId}@${pr.version}`
+        )
+      } else if (!prev) {
+        provideNameToOwner.set(pr.name, { extId: e.extId, version: pr.version })
+      }
+    }
+  }
+  providesVersionConflicts.sort()
+  if (providesVersionConflicts.length) {
+    bootStructuredLog(
+      ctx,
+      'error',
+      'kernelExt.providesConflict',
+      `[kernel.ext.d] conflicting provides version(s): ${providesVersionConflicts.join('; ')}`
+    )
+    if (strictPol) {
+      await appendKernelExtAuditNdjson(ctx, {
+        event: 'provides_version_conflict',
+        conflicts: providesVersionConflicts
+      })
+      return false
+    }
+  }
   const idToCollected = new Map(collected.map((e) => [e.extId, e]))
   for (const e of collected) {
     for (const bid of e.beforeIds) {
@@ -584,7 +655,16 @@ async function runKernelExtDropins(ctx, opts = {}) {
   const extGraphOn =
     ctx.env?.BARE_OS_KERNEL_EXT_GRAPH === '1' ||
     ctx.env?.BARE_OS_KERNEL_EXT_GRAPH === 'true'
-  if (extGraphOn && ctx.vfs && typeof ctx.vfs.writeFile === 'function' && ctx.b4a) {
+  const extGraphDefer =
+    ctx.env?.BARE_OS_INIT_DEFER_KERNEL_EXT_GRAPH === '1' ||
+    ctx.env?.BARE_OS_INIT_DEFER_KERNEL_EXT_GRAPH === 'true'
+  if (
+    extGraphOn &&
+    !extGraphDefer &&
+    ctx.vfs &&
+    typeof ctx.vfs.writeFile === 'function' &&
+    ctx.b4a
+  ) {
     let bareModuleTraverse = 'unresolved'
     try {
       await import('bare-module-traverse')