feat(shell): pathname globbing, noglob/set -f, and syscall pathconf

- Add shell-glob.js (fnmatch, brace expansion gate, GLOB_* / DOTGLOB / STRICT_POSIX)
- Tokenizer tracks u/s/d quote segments; expand argv, redirects, and `for … in`
- Builtin `set -f` / `set +f`; richer `case` patterns via bareOsFnmatch
- CI: verify-bundle-throws.mjs + bundle-throw-allowlist.json in pretest
- VFS: symlink cycle detection (ELOOP); stat follow depth 64
- ctx.bareOsPathconf + bareOsSyscall pathconf; syscalls.json schemaVersion 2 + errnoHints
- getconf: pathconf in BARE_OS_SYSCALL_OPS; _PC_*, _POSIX_THREAD_ATTR_STACKSIZE
- Docs: handbook ch.9, environment appendix, user manual ch.4, release-checklist, scripts README
- Tests: tokenize/glob cases in bare-os-booter test.js

Keep posix-conformance-matrix.json bareOsSyscallOps in sync with getconf (add pathconf).

docs/README.md

@@ -27,6 +27,7 @@ This directory is the **`docs/`** tree: reference material, JSON catalog inputs,
 - **[Kernel architecture contract](architecture/KERNEL_CONTRACT.md)** — booter vs guest image boundaries, boot step IDs, typed errors.
 - **[Audit baseline](audit/PLACEHOLDER_BASELINE.md)** — classified incomplete surfaces (incl. vendored bundles).
 - **[OTA and bundles](deployment/OTA_AND_BUNDLES.md)** — Bare/Pear packaging notes for releases.
+- **[Release checklist](release-checklist.md)** — ordered steps before tagging (builds, parity, **`npm test`**).
 
 ---
 

docs/audit/PLACEHOLDER_BASELINE.md

@@ -35,7 +35,7 @@ This document classifies incomplete surfaces as of the kernel hardening pass. It
 
 ## P3 — Vendored `kernel/lib/bare/bundles/*.js`
 
-Upstream-generated IIFEs may contain `TODO` comments, `NOT_IMPLEMENTED` helpers, and abstract stream throws. These are **not** first-party kernel policy; they are rebuilt from `bare-os-bare-libs` and mirrored under `packages/bare-os-seeder/kernel/`. **Inventory:** committed **`docs/audit/bundle-health.json`** (per-bundle bytes, regenerated by **`npm run build -w bare-os-bare-libs`**). **Marker gate:** **`scripts/verify-bundle-markers.mjs`** + **`docs/audit/bundle-marker-allowlist.json`**. Closure strategy: upstream version bumps, allowlist shrink, or bundle post-processing — see **`kernel/lib/bare/README.md`**.
+Upstream-generated IIFEs may contain `TODO` comments, `NOT_IMPLEMENTED` helpers, and abstract stream throws. These are **not** first-party kernel policy; they are rebuilt from `bare-os-bare-libs` and mirrored under `packages/bare-os-seeder/kernel/`. **Inventory:** committed **`docs/audit/bundle-health.json`** (per-bundle bytes, regenerated by **`npm run build -w bare-os-bare-libs`**). **Marker gate:** **`scripts/verify-bundle-markers.mjs`** + **`docs/audit/bundle-marker-allowlist.json`**. **Throw gate:** **`scripts/verify-bundle-throws.mjs`** + **`docs/audit/bundle-throw-allowlist.json`** for `throw new Error("not implemented")` phrasing. Closure strategy: upstream version bumps, allowlist shrink, or bundle post-processing — see **`kernel/lib/bare/README.md`**.
 
 ## Subsystem matrix
 

docs/audit/bundle-health.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-04-04T23:22:39.311Z",
+  "generatedAt": "2026-04-04T23:35:51.774Z",
   "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",
   "buildTool": "packages/bare-os-bare-libs/build.mjs",
   "bundles": [

docs/audit/bundle-throw-allowlist.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "description": "Vendored bundles that still contain throw new Error(\"not implemented\") until upstream removes them.",
+  "entries": [
+    { "bundleFile": "bareAsyncHooks.js", "reason": "Upstream async_hooks compatibility throws" },
+    { "bundleFile": "bareUtils.js", "reason": "Upstream util abstract throws" },
+    { "bundleFile": "bareDev.js", "reason": "Upstream dev/hypercore bundle throws" }
+  ]
+}

docs/reference/environment-and-posix-appendix.md

@@ -101,6 +101,12 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_HOST_BUNDLE_EVALUATE` — `ctx.bareOsHostCapability` — When **`1`**, advertise host **`bundleEvaluate`** for optional cross-worker / **`bare-bundle-evaluate`** paths (host-only).
 - `BARE_OS_SHELL_LOOP_MAX` — Shell — Max iterations for **`while`** / **`for`** (default **10000**).
 - `BARE_OS_SHELL_CASE_MAX_BRANCHES` — Shell — Max **`case`** branches (default **32**).
+- `BARE_OS_STRICT_POSIX` — Shell / utilities — When **`1`**, pathname globs that match nothing fail the command; tighter diagnostics elsewhere as documented.
+- `BARE_OS_SHELL_NOGLOB` — Shell — When **`1`**, pathname expansion is disabled (**`set -f`** sets this; **`set +f`** clears).
+- `BARE_OS_GLOB_MAX_MATCHES` — Shell — Max matches per glob word (default **4096**).
+- `BARE_OS_GLOB_IGNORE` — Shell — Colon-separated fnmatch patterns excluded from glob results.
+- `BARE_OS_DOTGLOB` — Shell — When **`1`**, globbing includes names starting with **`.`** (except **`.bareos_empty`**).
+- `BARE_OS_SHELL_BRACE_EXPANSION` — Shell — When **`1`**, unquoted **`{a,b}`** brace expansion runs before globbing.
 - `BARE_OS_GREP_FILTER_MAX` — **`grep -r`** — Max **`--include` / `--exclude` / `--exclude-dir`** glob patterns (default **32**).
 - `BARE_OS_SED_NULL_MAX_RECORDS` — **`sed -z`** — Max NUL-separated records per run (default **100000**).
 - `BARE_OS_HYPER_MULTISIG_VERIFY` — Seeder — When set, runs **`hyper-multisig verify`** via **[`bare-subprocess`](https://github.com/holepunchto/bare-subprocess)** under Pear/Bare (dependency of **`bare-os-seeder`**), or **`child_process`** on Node. Requires **`hyper-multisig`** on **`PATH`**.

docs/release-checklist.md

@@ -0,0 +1,12 @@
+# Release checklist (Bare operating system)
+
+Run these steps before tagging or publishing a Pear bundle so the kernel, seeder mirror, and docs stay aligned.
+
+1. **`npm ci`** at the repository root (clean install).
+2. **`npm run build -w bare-os-coreutils`** — regenerates `/bin` sources and **`kernel/share/man/man.json`**.
+3. **`npm run build -w bare-os-bare-libs`** — rebuilds vendored **`kernel/lib/bare/bundles/*.js`** and **`docs/audit/bundle-health.json`**.
+4. **`npm run bundle:kernel`** — rebundles **`kernel/init.js`** when the bundler script applies.
+5. **`node scripts/gen-kernel-extensions-index.mjs`** when extension indices are part of your change set.
+6. **`npm test`** at the root (runs **`pretest`** parity, banned terminology, bundle markers/throws, ctx API checks, and workspace tests).
+
+Optional: **`npm run release-checklist`** runs **`scripts/release-checklist.mjs`** for automated JSON checks when configured.