- Extend bundle throw governance and guest boot trace; seeder parity hints

- fcntl F_GETFL/F_SETFL + posixPoll; bump POSIX profile to 1.0.3, syscalls example
- bareOsSendSignal: negative target = logical pgid; process_table docs
- IPC: max channel quota, telemetry; metrics_live.ipcTelemetry; BARE_OS_IPC_MAX_CHANNELS
- VFS: bareOsClearWarmReadCaches; invalidate on batch bin/lib/bare puts; ctx helpers
- Swarm: enforce BARE_OS_PEER_ALLOWLIST_HEX in shouldAttemptPeer
- Replication JSON reader, boot-ready bareStdlib resolutionWallMs, vault audit mirror docs
- sync-holepunch-clones.mjs report; kernel-extension resolver/test alignment; protomux tests
- pathconf union/mirror; getconf tests; golden tests for test/expr/printf
- docs: contract bump checklist, handbook/env appendix, package refs, protocol CHANGELOG

packages/bare-os-booter/lib/bare-os-swarm-peer-policy.js

@@ -4,8 +4,12 @@
  *
  * Tunable via optional env (read by caller): BARE_OS_SWARM_BAN_FAIL_THRESHOLD,
  * BARE_OS_SWARM_BAN_MS_INITIAL, BARE_OS_SWARM_BAN_MS_MAX, BARE_OS_SWARM_EWMA_ALPHA.
+ * Optional **`BARE_OS_PEER_ALLOWLIST_HEX`** is enforced here so swarm scheduling aligns with
+ * **`ctx.bareOsEvaluatePeerAdmission`** (deny before reconnect budget is spent).
  */
 
+import { evaluateBareOsPeerAdmission } from './bare-os-peer-admission.js'
+
 const DEFAULT_FAILS_BEFORE_BAN = 4
 const DEFAULT_BAN_MS_INITIAL = 5000
 const DEFAULT_BAN_MS_MAX = 300000
@@ -69,6 +73,7 @@ export class BareOsSwarmPeerPolicyEngine {
    */
   constructor(swarm, opts = {}) {
     this.swarm = swarm
+    this._env = opts.env && typeof opts.env === 'object' ? opts.env : null
     this._cfg = readSwarmPolicyEnv(opts.env)
     /** @type {Map<string, PeerState>} */
     this._peers = new Map()
@@ -149,6 +154,10 @@ export class BareOsSwarmPeerPolicyEngine {
    */
   shouldAttemptPeer(peerKey) {
     const k = this._key(peerKey)
+    if (this._env) {
+      const adm = evaluateBareOsPeerAdmission(this._env, k)
+      if (adm.verdict === 'deny') return false
+    }
     const st = this._peers.get(k)
     const now = Date.now()
     if (!st) return true