- disk.os: path manifest search, metrics schema bump, docs

- HRPC: bare_os.search_local, route table/schema updates; ctx API 1.52.0
- VFS: optional path-capability enforcement; pathcap-verify coreutil
- Replication/boot: warm-cache adaptive metrics, boot budget NDJSON v2
- Identity: savevault pre-snapshot host hint
- POSIX: profile 1.0.16, socket connect timeout env, Wasm ctx API peek import
- Security/ops: peer admission test, personal-drive path policy verifier in pretest
- P2P UX: pkg-swarm-index; multisig rc.proposals/enabled gate + audit rows
- Docs/scripts: README, handbook, env appendix, developer-guide, ctx helper sync
- Examples: syscalls.example ctx version; seeder kernel rsync parity

scripts/README.md

@@ -168,6 +168,18 @@ Ensures **`boot.policy`** documents **`extensionSignerPinsV2`**…**`V5`** and *
 
 Checks that **`packages/bare-os-booter/lib/bare-os-ctx-api.js`** documents a **`BARE_OS_CTX_API_VERSION`** that matches the contract surface (semver discipline) and that stock kernel feature words (**`BARE_OS_KERNEL_FEATURES_STOCK_WORD_*`**) in **`bare-os-protocol`** stay referenced from the booter (including **`kernelCapabilityWords`** / **`ctx`** maps for wire v2). Invoked from the root **`pretest`** hook.
 
+## `verify-ctx-client-helper-sync.mjs`
+
+**Usage:** `node scripts/verify-ctx-client-helper-sync.mjs`
+
+Ensures **[`docs/reference/ctx-client-helper.generated.ts`](../docs/reference/ctx-client-helper.generated.ts)** mentions the current **`BARE_OS_CTX_API_VERSION`** after **`gen-ctx-client-helper.mjs`**. Root **`pretest`**.
+
+## `verify-personal-drive-path-policy.mjs`
+
+**Usage:** `node scripts/verify-personal-drive-path-policy.mjs`
+
+Checks that canonical personal-drive path strings stay documented across the POSIX profile, handbook ch.4–5, and the environment appendix. Root **`pretest`**.
+
 ## `verify-kernel-capabilities-contract.mjs`
 
 **Usage:** `node scripts/verify-kernel-capabilities-contract.mjs`

scripts/release-checklist.mjs

@@ -41,6 +41,13 @@ console.log(
   '[release-checklist] verify-holepunch-clone-drift (BARE_OS_HOLEPUNCH_DRIFT_CHECK=0 to skip; empty repos[] is no-op)'
 )
 run('node', ['scripts/verify-holepunch-clone-drift.mjs'])
+console.log('[release-checklist] verify-personal-drive-path-policy')
+run('node', ['scripts/verify-personal-drive-path-policy.mjs'])
+console.log('[release-checklist] verify-ctx-client-helper-sync')
+run('node', ['scripts/verify-ctx-client-helper-sync.mjs'])
+console.log(
+  '[release-checklist] Optional: BARE_OS_HOLEPUNCH_FRESHNESS_STRICT=1 with fresh `holepunchto_repos` clones — see docs/audit/holepunch-freshness-gate.json'
+)
 console.log(
   '[release-checklist] If you edited kernel/lib/init/init-main.js or kernel/lib/boot/, run: npm run bundle:kernel && rsync -a --delete kernel/ packages/bare-os-seeder/kernel/ then re-run this script.'
 )

scripts/verify-ctx-client-helper-sync.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+/**
+ * CI: generated ctx client helper must list the current ctx API semver (same as bare-os-ctx.d.ts).
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+function main() {
+  const apiPath = path.join(
+    root,
+    'packages/bare-os-booter/lib/bare-os-ctx-api.js'
+  )
+  const helperPath = path.join(
+    root,
+    'docs/reference/ctx-client-helper.generated.ts'
+  )
+  const apiSrc = fs.readFileSync(apiPath, 'utf8')
+  const m = apiSrc.match(/export const BARE_OS_CTX_API_VERSION = '([^']+)'/)
+  if (!m) {
+    console.error('verify-ctx-client-helper-sync: could not parse ctx API version')
+    process.exit(1)
+  }
+  const ver = m[1]
+  const helper = fs.readFileSync(helperPath, 'utf8')
+  if (!helper.includes(ver)) {
+    console.error(
+      'verify-ctx-client-helper-sync: run `node scripts/gen-ctx-client-helper.mjs` — helper missing',
+      ver
+    )
+    process.exit(1)
+  }
+  console.log('verify-ctx-client-helper-sync:', ver, 'OK')
+}
+
+main()

scripts/verify-personal-drive-path-policy.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * CI: canonical personal-drive special paths must stay documented.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+const paths = [
+  '/.bare/account',
+  '/.bare/vault/',
+  '/.bare-os/acct/',
+  '/.bare-os/migration/legacy-root-v1.json',
+  'vault-rotation-audit.ndjson'
+]
+
+const files = [
+  path.join(root, 'docs/architecture/POSIX_DECLARED_PROFILE.md'),
+  path.join(root, 'handbook/04-the-booter-runtime.md'),
+  path.join(root, 'handbook/05-identity-vault-and-hdms.md'),
+  path.join(root, 'docs/reference/environment-and-posix-appendix.md')
+]
+
+function main() {
+  const blob = files.map((f) => fs.readFileSync(f, 'utf8')).join('\n')
+  for (const p of paths) {
+    if (!blob.includes(p)) {
+      console.error(
+        'verify-personal-drive-path-policy: missing documentation for:',
+        p
+      )
+      process.exit(1)
+    }
+  }
+  console.log(
+    'verify-personal-drive-path-policy:',
+    paths.length,
+    'path tokens OK'
+  )
+}
+
+main()