When the host leaves these unset, the booter now sets

BARE_OS_SHELL_STREAMING=1, BARE_OS_SHELL_STREAMING_MULT=2,
BARE_OS_PIPELINE_MAX_BYTES (512 MiB), and BARE_OS_PIPELINE_MAX_LINES
(2M) so the high-throughput ~512 MiB burst profile does not require
pre-launch exports.

Align getconf Tier-1 statics with those bases; note legacy rc.profile
exports; refresh handbook, environment appendix, cookbook, and
bare-os-booter CHANGELOG.

developer-guide/11-kernel-pear-cookbook.md

@@ -30,7 +30,7 @@ Set these on the **Pear/Bare host** process before boot (the booter merges them
 
 | Goal | Variables |
 | --- | --- |
-| Large pipeline bursts (`yes \| head …`, big `find`/`ls`) | `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`; optional `BARE_OS_SHELL_STREAMING=1` with `BARE_OS_SHELL_STREAMING_MULT` (same effect as legacy `BARE_OS_STREAMING_MULTIPLIER`). Absolute ceilings default to **512 MiB** captured bytes and **2 M** lines (`BARE_OS_PIPELINE_ABS_MAX_BYTES` / `_LINES` override). |
+| Large pipeline bursts (`yes \| head …`, big `find`/`ls`) | Stock booter defaults **`BARE_OS_SHELL_STREAMING=1`**, **`BARE_OS_SHELL_STREAMING_MULT=2`**, **`BARE_OS_PIPELINE_MAX_BYTES`** (**512 MiB**), **`BARE_OS_PIPELINE_MAX_LINES`** (**2 M**) when unset on the host. Override with **`BARE_OS_PIPELINE_MAX_STAGES`**, **`BARE_OS_STREAMING_MULTIPLIER`** (alias for **`BARE_OS_SHELL_STREAMING_MULT`**). Absolute ceilings default to **512 MiB** / **2 M** lines (`BARE_OS_PIPELINE_ABS_MAX_BYTES` / `_LINES`). |
 | Swarm | `BARE_OS_SWARM_MAX_PEERS`, `BARE_OS_SWARM_MAX_CLIENT_CONNECTIONS`, `BARE_OS_SWARM_MAX_SERVER_CONNECTIONS`, `BARE_OS_SWARM_MAX_PARALLEL` → Hyperswarm ctor. |
 | FIFOs / POSIX MQ | `BARE_OS_IPC_MAX_CHANNELS`; `BARE_OS_POSIX_MQ_MAX_MSGS`, `BARE_OS_POSIX_MQ_MSG_BYTES` (defaults for `mq_open` when attrs omitted). |
 | FD hint for scripts | `BARE_OS_VFS_MAX_OPEN` → mirrored as `RLIMIT_NOFILE` in **`/proc/bare_os/rlimits.json`**. |

docs/reference/environment-and-posix-appendix.md

@@ -79,6 +79,8 @@ The list below is one **bullet per variable** in the form **name — component
 
 **Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value; canonical list in [`packages/bare-os-booter/index.js`](../../packages/bare-os-booter/index.js)): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_PIPELINE_ABS_MAX_BYTES`, `BARE_OS_PIPELINE_ABS_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_STREAMING_MULTIPLIER`, `BARE_OS_SHELL_PIPEFAIL`, `BARE_OS_SHELL_PIPESTATUS`, `BARE_OS_SHELL_READ_BUILTIN`, `BARE_OS_SHELL_READ_MAX_BYTES`, `BARE_OS_SHELL_ERREXIT`, `BARE_OS_SHELL_NOUNSET`, `BARE_OS_SHELL_POSIX_MODE`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_SHELL_PARAM_EXPANSION`, `BARE_OS_SHELL_PARAM_EXPANSION_V2`, `BARE_OS_SHELL_PARAM_EXPANSION_V3`, `BARE_OS_ENV_DASH_S`, `BARE_OS_VFS_WATCH_PSEUDO`, `BARE_OS_VFS_WATCH_SWARM`, `BARE_OS_SHELL_LOCAL_DECLARE`, `BARE_OS_DIAGNOSTICS_SUBSCRIBE`, `BARE_OS_AUTOPASS_INVITE_URL`, `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW`, `BARE_OS_BIN_WORKER_CPU_MS_MAX`, `BARE_OS_BIN_WORKER_WASM_MS_MAX`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_SAFE_MODE`, `BARE_OS_BOOT_TRANSACTION_JOURNAL`, `BARE_OS_BOOT_CHECKPOINT`, `BARE_OS_BOOT_DRY_RUN`, `BARE_OS_BOOT_POLICY_PATH`, `BARE_OS_BOOT_ROLLBACK_APPLY`, `BARE_OS_BOOT_BUNDLE_DIGEST_HEX`, `BARE_OS_REQUIRE_CTX_API_MIN`, `BARE_OS_BOOT_ABI_STRICT`, `BARE_OS_LOADER_AUDIT`, `BARE_OS_DELEGATE_TRACE`, `BARE_OS_DNS_PROFILE`, `BARE_OS_BOOT_TRACE`, `BARE_OS_KERNEL_PROGRAM_PROC_JSON`, `BARE_OS_GIANT_PHASE_PROGRAM_JSON`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_EXEC_LINE_BUDGET_MS`, `BARE_OS_TIMER_BUDGET_MS`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_IPC_MAX_CHANNELS`, `BARE_OS_POSIX_MQ_MAX_MSGS`, `BARE_OS_POSIX_MQ_MSG_BYTES`, `BARE_OS_IPC_NAMESPACE`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_MAX_OPEN`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_HYPERBLOBS_DEDUP`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_VFS_BIN_CACHE_BLAKE2B`, `BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_APPEND`, `BARE_OS_VFS_ENFORCE_ACL`, `BARE_OS_VFS_BIN_INDEX_BUILD`, `BARE_OS_VFS_SYSTEM_IMAGE_WRITE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_BOOT_POLICY_STRICT`, `BARE_OS_LAZY_PERSONAL_DRIVE`, `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT`, `BARE_OS_DELEGATE_ALLOW`, `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_MAX_CONCURRENT`, `BARE_OS_DELEGATE_GIT_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, `BARE_OS_DELEGATE_WGET_MAX_PER_MIN`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN`, `BARE_OS_DELEGATE_GIT_MAX_CONCURRENT`, `BARE_OS_DELEGATE_CURL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_WGET_MAX_CONCURRENT`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_AUDIT_ONLY`, `BARE_OS_DNS_ALLOWLIST`, `BARE_OS_KERNEL_HOT_RELOAD`, `BARE_OS_KERNEL_EXT_D_HOT_RELOAD`, `BARE_OS_KERNEL_EXT_GRAPH`, `BARE_OS_KERNEL_EXT_RESOLUTION_JSON_ALWAYS`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_TELEMETRY_OTEL_JSONL`, `BARE_OS_TELEMETRY_OTEL`, `BARE_OS_PROC_POLL_MS`, `BARE_OS_TIMER_EVERY_MS_MONOTONIC`, `BARE_OS_TRACE_ID`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_OFFLINE_LKG_BOOT`, `BARE_OS_LKG_SYSTEM_KEY_HEX`, `BARE_OS_HOST_STORAGE_JSON`, `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`, `BARE_OS_SUBPROCESS_BRIDGE_JOBS_JSON`, `BARE_OS_IPC_AUDIT`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_XARGS_MAX_PROCS`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_SSH_BIND_ALL`, `BARE_OS_SSH_LISTEN_PORT`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, `BARE_OS_PEER_FIREWALL_E2E_JSON`, `BARE_OS_PEAR_SECURE_ENCLAVE_JSON`, `BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON`, `BARE_OS_PEAR_TRUST_JSON`, `BARE_OS_HOST_BUNDLE_EVALUATE`, `BARE_OS_WASM_KERNEL`, `BARE_OS_WASM_KERNEL_SYSCALL`, `BARE_OS_WASM_KERNEL_MONOTONIC_MS`, `BARE_OS_WASM_KERNEL_HOSTNAME_IMPORT`, **`TERM`**, **`COLORTERM`**. *(Many additional operator JSON pointers and version pins are also copied from the same loop; see source.)*
 
+**Booter default session (host left these empty):** the stock booter then assigns **`BARE_OS_SHELL_STREAMING=1`**, **`BARE_OS_SHELL_STREAMING_MULT=2`**, **`BARE_OS_PIPELINE_MAX_BYTES=536870912`**, and **`BARE_OS_PIPELINE_MAX_LINES=2000000`** so the guest gets the high-throughput pipeline profile without extra host configuration (override by setting those keys on the host before boot).
+
 - `BARE_OS_VFS_UNION_PREFIXES` — Booter / VFS — Comma-separated logical path prefixes where **`readFile`** may union system + overlay sources.
 - `BARE_OS_VFS_UNION_WRITE_DENY` — Booter / VFS — When **`1`** / **`true`**, block **`writeFile`** / **`unlink`** on paths under union read prefixes (read-only union overlay).
 - `BARE_OS_IPC_CHANNEL_MAX_BYTES` — Booter / IPC — Optional JSON map **`{"fifoName": maxBytes}`** (or legacy comma form) capping buffered bytes per FIFO name under **`/run/bare-os/ipc/`**.

handbook/07-operations-and-development.md

@@ -220,8 +220,8 @@ These are the variables operators touch most often; the full list is in [docs/re
 
 **Throughput, IPC, and telemetry (host → guest)**
 
-- **`BARE_OS_PIPELINE_MAX_*`** and **`BARE_OS_PIPELINE_ABS_MAX_BYTES`** / **`BARE_OS_PIPELINE_ABS_MAX_LINES`** — Simulated pipeline capture (absolute caps default **512 MiB** / **2 000 000** lines after the streaming multiplier).
+- **`BARE_OS_PIPELINE_MAX_*`** and **`BARE_OS_PIPELINE_ABS_MAX_BYTES`** / **`BARE_OS_PIPELINE_ABS_MAX_LINES`** — Simulated pipeline capture (absolute caps default **512 MiB** / **2 000 000** lines after the streaming multiplier). The stock booter defaults **`BARE_OS_SHELL_STREAMING=1`**, **`BARE_OS_SHELL_STREAMING_MULT=2`**, **`BARE_OS_PIPELINE_MAX_BYTES`** (**512 MiB**), and **`BARE_OS_PIPELINE_MAX_LINES`** (**2 000 000**) when the host leaves them unset.
-- **`BARE_OS_SHELL_STREAMING`**, **`BARE_OS_SHELL_STREAMING_MULT`** — Multiply capture limits; alias **`BARE_OS_STREAMING_MULTIPLIER`** when **`BARE_OS_SHELL_STREAMING_MULT`** is unset.
+- **`BARE_OS_SHELL_STREAMING`**, **`BARE_OS_SHELL_STREAMING_MULT`** — Multiply capture limits; alias **`BARE_OS_STREAMING_MULTIPLIER`** when **`BARE_OS_SHELL_STREAMING_MULT`** is unset (booter default mult is **2**).
 - **`BARE_OS_IPC_MAX_CHANNELS`**, **`BARE_OS_POSIX_MQ_MAX_MSGS`**, **`BARE_OS_POSIX_MQ_MSG_BYTES`** — FIFO/MQ quotas and POSIX **`mq_open`** defaults.
 - **`BARE_OS_VFS_MAX_OPEN`** — Advisory **`RLIMIT_NOFILE`** in **`/proc/bare_os/rlimits.json`** when set.
 - **`BARE_OS_TELEMETRY_OTEL`** / **`BARE_OS_TELEMETRY_OTEL_JSONL`** — OTel JSON line export (shorthand **`BARE_OS_TELEMETRY_OTEL=1`** defaults the path — see appendix).

handbook/09-posix-utilities-shell-and-vfs.md

@@ -130,7 +130,7 @@ flowchart LR
 
 **Here-string / here-document:** **`<<< word`** feeds the expanded **word** as stdin to the first command in the pipeline. A line that **ends** with **`<<`** **`DELIMITER`** (optional **`'...'`** / **`"..."`** around the delimiter) collects following lines from **`readLine('> ')`** until a line equals **DELIMITER**, then uses that body as stdin (**`$`** expansion is skipped for a single-quoted delimiter name).
 
-**Pipeline limits:** simulated pipe capture is bounded. Defaults: **`BARE_OS_PIPELINE_MAX_BYTES`** (2 MiB), **`BARE_OS_PIPELINE_MAX_LINES`** (50 000), **`BARE_OS_PIPELINE_MAX_STAGES`** (32). Effective capture is also capped by **`BARE_OS_PIPELINE_ABS_MAX_BYTES`** (default **512 MiB**) and **`BARE_OS_PIPELINE_ABS_MAX_LINES`** (default **2 000 000**) after the streaming multiplier. With **`BARE_OS_SHELL_STREAMING=1`**, effective byte and line caps are multiplied by **`BARE_OS_SHELL_STREAMING_MULT`** (default **4**, max **16**; alias **`BARE_OS_STREAMING_MULTIPLIER**`) so large captures remain bounded but less tight. Exceeding a limit fails the pipeline with exit status **1** and an error on stderr. Current caps and FIFO **`stats`** also surface in **`/proc/bare_os_quotas`** and **`ctx.bareOsRuntimeCaps.quotas`**. With **`BARE_OS_SHELL_PIPEFAIL`** (env or **`set -o pipefail`** / clear with **`set +o pipefail`**), a pipeline’s status reflects the first failing stage (bash-like); default is POSIX-like **last stage** only. With **`BARE_OS_SHELL_PIPESTATUS=1`**, after each pipeline completes, **`vfs.env.BARE_OS_PIPESTATUS`** holds space-separated stage exit codes (inspect-only **`PIPESTATUS`** analog).
+**Pipeline limits:** simulated pipe capture is bounded. The stock booter seeds **`BARE_OS_SHELL_STREAMING=1`**, **`BARE_OS_SHELL_STREAMING_MULT=2`** (alias **`BARE_OS_STREAMING_MULTIPLIER`**), **`BARE_OS_PIPELINE_MAX_BYTES`** (**512 MiB**), and **`BARE_OS_PIPELINE_MAX_LINES`** (**2 000 000**) when the host does not set them, so the default session targets a **~512 MiB** effective byte cap (after multiplier and **`BARE_OS_PIPELINE_ABS_MAX_BYTES`**, default **512 MiB**) and **2 M** lines. Tier-1 **`getconf`** statics are aligned to the same base sizes; live Tier-2 values follow **`vfs.env`**. **`BARE_OS_PIPELINE_MAX_STAGES`** defaults to **32**. Effective capture is also capped by **`BARE_OS_PIPELINE_ABS_MAX_BYTES`** and **`BARE_OS_PIPELINE_ABS_MAX_LINES`** after the streaming multiplier. With streaming on, effective byte and line caps are multiplied by **`BARE_OS_SHELL_STREAMING_MULT`** (stock **2** unless overridden; max **16**). Exceeding a limit fails the pipeline with exit status **1** and an error on stderr. Current caps and FIFO **`stats`** also surface in **`/proc/bare_os_quotas`** and **`ctx.bareOsRuntimeCaps.quotas`**. With **`BARE_OS_SHELL_PIPEFAIL`** (env or **`set -o pipefail`** / clear with **`set +o pipefail`**), a pipeline’s status reflects the first failing stage (bash-like); default is POSIX-like **last stage** only. With **`BARE_OS_SHELL_PIPESTATUS=1`**, after each pipeline completes, **`vfs.env.BARE_OS_PIPESTATUS`** holds space-separated stage exit codes (inspect-only **`PIPESTATUS`** analog).
 
 **Errexit (subset):** **`BARE_OS_SHELL_ERREXIT=1`**, **`set -e`**, or **`set -o errexit`** stops further top-level **`;`-separated** commands after a non-zero exit (**`set +e`** / **`set +o errexit`** clears). The same flag now applies **inside** **`if`** **`then`** / **`else`** bodies and **`while`** / **`for`** loop bodies between semicolon-separated lists (POSIX-style: a failing command aborts the rest of that compound body). **Condition** expressions in **`if`** / **`while`** still evaluate without errexit stopping between predicate lists. This remains a declared subset, not full Issue **7** **`sh`**.
 

kernel/bin/getconf

@@ -118,10 +118,10 @@ const CONF = {
   _POSIX_ASYNCHRONOUS_IO: '0',
   /** Bare shell line length (reasonable REPL limit, not a hard kernel cap). */
   BARE_OS_INPUT_LINE_MAX: '8192',
-  /** Defaults for simulated pipelines (override with BARE_OS_PIPELINE_* env); see handbook §3. */
+  /** Defaults for simulated pipelines (stock booter seeds larger session env when host is silent; Tier-2 live caps differ); see handbook §3. */
   BARE_OS_PIPELINE_MAX_STAGES: '32',
-  BARE_OS_PIPELINE_MAX_BYTES: '2097152',
+  BARE_OS_PIPELINE_MAX_BYTES: '536870912',
-  BARE_OS_PIPELINE_MAX_LINES: '50000',
+  BARE_OS_PIPELINE_MAX_LINES: '2000000',
   /** Default cap for find -exec/-ok invocations per run (override with env). */
   BARE_OS_FIND_EXEC_MAX: '64',
   /** Max lines `yes` prints before stopping (override with BARE_OS_YES_MAX_LINES). */
@@ -168,8 +168,8 @@ const CONF = {
   _SC_TTY_NAME_MAX: '32',
   _SC_LOGIN_NAME_MAX: '256',
   /** Defaults; live session: **`ctx.bareOsGetconfSysconf`** (pipeline limits, swarm caps, …). */
-  _SC_BARE_OS_PIPELINE_MAX_BYTES: '2097152',
+  _SC_BARE_OS_PIPELINE_MAX_BYTES: '536870912',
-  _SC_BARE_OS_PIPELINE_MAX_LINES: '50000',
+  _SC_BARE_OS_PIPELINE_MAX_LINES: '2000000',
   _SC_BARE_OS_PIPELINE_MAX_STAGES: '32',
   _SC_BARE_OS_GLOB_MAX_MATCHES: '4096',
   _SC_BARE_OS_SHELL_LOOP_MAX: '10000',

kernel/bin/kernel-doctor

@@ -136,7 +136,16 @@ async function run(ctx, argv) {
       bootDryRun: ctx.env?.BARE_OS_BOOT_DRY_RUN,
       bootPolicyPath: ctx.env?.BARE_OS_BOOT_POLICY_PATH,
       dnsProfile: ctx.env?.BARE_OS_DNS_PROFILE,
-      delegateTrace: ctx.env?.BARE_OS_DELEGATE_TRACE
+      delegateTrace: ctx.env?.BARE_OS_DELEGATE_TRACE,
+      pipelineMaxStages: ctx.env?.BARE_OS_PIPELINE_MAX_STAGES,
+      pipelineMaxBytes: ctx.env?.BARE_OS_PIPELINE_MAX_BYTES,
+      pipelineMaxLines: ctx.env?.BARE_OS_PIPELINE_MAX_LINES,
+      pipelineAbsMaxBytes: ctx.env?.BARE_OS_PIPELINE_ABS_MAX_BYTES,
+      pipelineAbsMaxLines: ctx.env?.BARE_OS_PIPELINE_ABS_MAX_LINES,
+      shellStreaming: ctx.env?.BARE_OS_SHELL_STREAMING,
+      shellStreamingMult:
+        ctx.env?.BARE_OS_SHELL_STREAMING_MULT ??
+        ctx.env?.BARE_OS_STREAMING_MULTIPLIER
     }
   }
   if (json) {

kernel/etc/bare-os/rc.profile.full

@@ -1,4 +1,5 @@
 # Bare OS — optional "full" profile snippet (use with BARE_OS_BOOT_PROFILE=full).
-# Enables relaxed pipeline limits and bounded command substitution (see docs/reference/kernel-extensions.md).
+# Pipeline streaming is already on by default in the stock booter; this line remains for older images.
+# Enables bounded command substitution (see docs/reference/kernel-extensions.md).
 export BARE_OS_SHELL_STREAMING=1
 export BARE_OS_SHELL_CMDSUBST=1

packages/bare-os-booter/CHANGELOG.md

@@ -21,7 +21,7 @@ Authoritative **version alignment** with protocol and telemetry schema numbers l
 - `**baretop**`: optional `**ctx.bareOsReadBareTopSnapshot()**` in `[index.js](index.js)` returns `**{ atMs, files, metricsLiveText }**` (`**metricsLiveText**` = coalesced `**metrics_live**` JSON string) with the same `**files**` keys as `**BARE_TOP_SNAPSHOT_PROC_ENTRIES**` in `**packages/bare-os-coreutils/lib/baretop-snapshot.js**` — keep those lists in sync when adding operator `**/proc/bare_os**` nodes.
 - **hrpc allowlist**: shared parser in `[lib/bare-os-hrpc-allowlist.js](lib/bare-os-hrpc-allowlist.js)`; `**ctx.bareOsHrpcRequest**` and `**ctx.bareOsHrpcAllowlistProbe**` stay aligned. Host passthrough copies `**BARE_OS_HRPC_ALLOWLIST_JSON**`, `**BARE_OS_CORESTORE_SNAPSHOT_WORKFLOW_JSON**`, `**BARE_OS_BLIND_RELAY_TOPOLOGY_JSON**`, `**BARE_OS_MIRROR_DRIVE_COMPOSITION_HINT_JSON**`, `**BARE_OS_REPLICATION_PLAN_JSON**`, and pear-doctor env keys into session env.
 - **Snapshot hints**: `**ctx.bareOsReadSnapshotHintsJson()**` merges `**BARE_OS_CORESTORE_SNAPSHOT_WORKFLOW_JSON**` like `**/proc/bare_os/snapshot_hints.json**`.
-- **Pipeline / IPC / rlimits tuning** — Simulated pipeline capture honors **`BARE_OS_PIPELINE_ABS_MAX_BYTES`** / **`BARE_OS_PIPELINE_ABS_MAX_LINES`** (defaults **512 MiB** / **2 000 000** lines after the streaming multiplier). Host passthrough includes **`BARE_OS_IPC_MAX_CHANNELS`**, POSIX MQ defaults (**`BARE_OS_POSIX_MQ_MAX_MSGS`**, **`BARE_OS_POSIX_MQ_MSG_BYTES`**), **`BARE_OS_VFS_MAX_OPEN`** → **`/proc/bare_os/rlimits.json`** **`RLIMIT_NOFILE`**, and convenience aliases **`BARE_OS_STREAMING_MULTIPLIER`**, **`BARE_OS_TIMER_BUDGET_MS`**, **`BARE_OS_TELEMETRY_OTEL`**. See [environment appendix §14](../../docs/reference/environment-and-posix-appendix.md#14-environment-variables-complete-list) and [developer guide ch.11](../../developer-guide/11-kernel-pear-cookbook.md).
+- **Pipeline / IPC / rlimits tuning** — Simulated pipeline capture honors **`BARE_OS_PIPELINE_ABS_MAX_BYTES`** / **`BARE_OS_PIPELINE_ABS_MAX_LINES`** (defaults **512 MiB** / **2 000 000** lines after the streaming multiplier). When the host leaves pipeline keys unset, the stock booter seeds **`BARE_OS_SHELL_STREAMING=1`**, **`BARE_OS_SHELL_STREAMING_MULT=2`**, **`BARE_OS_PIPELINE_MAX_BYTES`** (**512 MiB**), **`BARE_OS_PIPELINE_MAX_LINES`** (**2 000 000**). Host passthrough includes **`BARE_OS_IPC_MAX_CHANNELS`**, POSIX MQ defaults (**`BARE_OS_POSIX_MQ_MAX_MSGS`**, **`BARE_OS_POSIX_MQ_MSG_BYTES`**), **`BARE_OS_VFS_MAX_OPEN`** → **`/proc/bare_os/rlimits.json`** **`RLIMIT_NOFILE`**, and convenience aliases **`BARE_OS_STREAMING_MULTIPLIER`**, **`BARE_OS_TIMER_BUDGET_MS`**, **`BARE_OS_TELEMETRY_OTEL`**. See [environment appendix §14](../../docs/reference/environment-and-posix-appendix.md#14-environment-variables-complete-list) and [developer guide ch.11](../../developer-guide/11-kernel-pear-cookbook.md).
 
 ## Context API (`bareOsCtxApiVersion`)
 

packages/bare-os-booter/index.js

@@ -831,6 +831,22 @@ async function executeKernel(disk, store, swarm, initSource) {
       shellEnv.COLORTERM = String(hostEnv.COLORTERM)
     }
   }
+  {
+    const trimDefault = (x) => (x == null ? '' : String(x).trim())
+    /** Stock ~512 MiB burst profile when the host leaves pipeline env unset (override any key from host). */
+    if (!trimDefault(shellEnv.BARE_OS_SHELL_STREAMING)) {
+      shellEnv.BARE_OS_SHELL_STREAMING = '1'
+    }
+    if (!trimDefault(shellEnv.BARE_OS_SHELL_STREAMING_MULT)) {
+      shellEnv.BARE_OS_SHELL_STREAMING_MULT = '2'
+    }
+    if (!trimDefault(shellEnv.BARE_OS_PIPELINE_MAX_BYTES)) {
+      shellEnv.BARE_OS_PIPELINE_MAX_BYTES = String(512 * 1024 * 1024)
+    }
+    if (!trimDefault(shellEnv.BARE_OS_PIPELINE_MAX_LINES)) {
+      shellEnv.BARE_OS_PIPELINE_MAX_LINES = String(2_000_000)
+    }
+  }
   if (
     shellEnv.BARE_OS_HOLESAIL_INITD === undefined ||
     shellEnv.BARE_OS_HOLESAIL_INITD === ''

packages/bare-os-booter/lib/bare-os-runtime-caps.js

@@ -239,6 +239,11 @@ export function buildBareOsRuntimeCaps(shellEnv, extra = {}) {
       maxStages: pl.maxStages,
       maxBytes: pl.maxBytes,
       maxLines: pl.maxLines,
+      baseMaxBytes: pl.baseMaxBytes,
+      baseMaxLines: pl.baseMaxLines,
+      absCapBytes: pl.absCapBytes,
+      absCapLines: pl.absCapLines,
+      streamingEnabled: pl.streamingEnabled === true,
       defaults: Object.freeze({
         maxStages: DEFAULT_PIPELINE_MAX_STAGES,
         maxBytes: DEFAULT_PIPELINE_MAX_CAPTURE_BYTES,

packages/bare-os-booter/lib/shell.js

@@ -319,14 +319,24 @@ export function getBareOsPipelineLimits(env) {
     'BARE_OS_PIPELINE_MAX_LINES',
     DEFAULT_PIPELINE_MAX_CAPTURE_LINES
   )
+  const effectiveBytes = Math.floor(baseBytes * mult)
+  const effectiveLines = Math.floor(baseLines * mult)
   return {
     maxStages: parse(
       'BARE_OS_PIPELINE_MAX_STAGES',
       DEFAULT_PIPELINE_MAX_STAGES
     ),
-    maxBytes: Math.min(Math.floor(baseBytes * mult), absMaxBytes),
+    maxBytes: Math.min(effectiveBytes, absMaxBytes),
-    maxLines: Math.min(Math.floor(baseLines * mult), absMaxLines),
+    maxLines: Math.min(effectiveLines, absMaxLines),
-    streamingMultiplier: mult
+    streamingMultiplier: mult,
+    /** True when `BARE_OS_SHELL_STREAMING` relaxes caps via multiplier. */
+    streamingEnabled: streamOn,
+    /** Parsed `BARE_OS_PIPELINE_MAX_*` before multiplier (for operator snapshots). */
+    baseMaxBytes: baseBytes,
+    baseMaxLines: baseLines,
+    /** Hard ceilings after multiplier (`BARE_OS_PIPELINE_ABS_MAX_*`; defaults 512 MiB / 2 M lines). */
+    absCapBytes: absMaxBytes,
+    absCapLines: absMaxLines
   }
 }
 

packages/bare-os-coreutils/man/pages/kernel-doctor.json

@@ -5,7 +5,7 @@
   "synopsis": [
     "kernel-doctor [OPTION]... [OPERAND]..."
   ],
-  "description": "Bare OS implementation of kernel-doctor. Full behavior is defined in packages/bare-os-coreutils/src/kernel-doctor.js.",
+  "description": "Prints a non-secret guest snapshot. With --json, includes /proc JSON (e.g. resources.pipeline: effective maxBytes/maxLines plus absCapBytes/absCapLines ceilings, baseMax*, streamingEnabled) and envHints for select BARE_OS_* keys (including pipeline tunables). See packages/bare-os-coreutils/src/kernel-doctor.js.",
   "options": [],
   "keywords": [
     "kernel-doctor",

packages/bare-os-coreutils/src/getconf.js

@@ -29,10 +29,10 @@ const CONF = {
   _POSIX_ASYNCHRONOUS_IO: '0',
   /** Bare shell line length (reasonable REPL limit, not a hard kernel cap). */
   BARE_OS_INPUT_LINE_MAX: '8192',
-  /** Defaults for simulated pipelines (override with BARE_OS_PIPELINE_* env); see handbook §3. */
+  /** Defaults for simulated pipelines (stock booter seeds larger session env when host is silent; Tier-2 live caps differ); see handbook §3. */
   BARE_OS_PIPELINE_MAX_STAGES: '32',
-  BARE_OS_PIPELINE_MAX_BYTES: '2097152',
+  BARE_OS_PIPELINE_MAX_BYTES: '536870912',
-  BARE_OS_PIPELINE_MAX_LINES: '50000',
+  BARE_OS_PIPELINE_MAX_LINES: '2000000',
   /** Default cap for find -exec/-ok invocations per run (override with env). */
   BARE_OS_FIND_EXEC_MAX: '64',
   /** Max lines `yes` prints before stopping (override with BARE_OS_YES_MAX_LINES). */
@@ -79,8 +79,8 @@ const CONF = {
   _SC_TTY_NAME_MAX: '32',
   _SC_LOGIN_NAME_MAX: '256',
   /** Defaults; live session: **`ctx.bareOsGetconfSysconf`** (pipeline limits, swarm caps, …). */
-  _SC_BARE_OS_PIPELINE_MAX_BYTES: '2097152',
+  _SC_BARE_OS_PIPELINE_MAX_BYTES: '536870912',
-  _SC_BARE_OS_PIPELINE_MAX_LINES: '50000',
+  _SC_BARE_OS_PIPELINE_MAX_LINES: '2000000',
   _SC_BARE_OS_PIPELINE_MAX_STAGES: '32',
   _SC_BARE_OS_GLOB_MAX_MATCHES: '4096',
   _SC_BARE_OS_SHELL_LOOP_MAX: '10000',

packages/bare-os-coreutils/src/kernel-doctor.js

@@ -47,7 +47,16 @@ async function run(ctx, argv) {
       bootDryRun: ctx.env?.BARE_OS_BOOT_DRY_RUN,
       bootPolicyPath: ctx.env?.BARE_OS_BOOT_POLICY_PATH,
       dnsProfile: ctx.env?.BARE_OS_DNS_PROFILE,
-      delegateTrace: ctx.env?.BARE_OS_DELEGATE_TRACE
+      delegateTrace: ctx.env?.BARE_OS_DELEGATE_TRACE,
+      pipelineMaxStages: ctx.env?.BARE_OS_PIPELINE_MAX_STAGES,
+      pipelineMaxBytes: ctx.env?.BARE_OS_PIPELINE_MAX_BYTES,
+      pipelineMaxLines: ctx.env?.BARE_OS_PIPELINE_MAX_LINES,
+      pipelineAbsMaxBytes: ctx.env?.BARE_OS_PIPELINE_ABS_MAX_BYTES,
+      pipelineAbsMaxLines: ctx.env?.BARE_OS_PIPELINE_ABS_MAX_LINES,
+      shellStreaming: ctx.env?.BARE_OS_SHELL_STREAMING,
+      shellStreamingMult:
+        ctx.env?.BARE_OS_SHELL_STREAMING_MULT ??
+        ctx.env?.BARE_OS_STREAMING_MULTIPLIER
     }
   }
   if (json) {

packages/bare-os-seeder/kernel/bin/getconf

@@ -118,10 +118,10 @@ const CONF = {
   _POSIX_ASYNCHRONOUS_IO: '0',
   /** Bare shell line length (reasonable REPL limit, not a hard kernel cap). */
   BARE_OS_INPUT_LINE_MAX: '8192',
-  /** Defaults for simulated pipelines (override with BARE_OS_PIPELINE_* env); see handbook §3. */
+  /** Defaults for simulated pipelines (stock booter seeds larger session env when host is silent; Tier-2 live caps differ); see handbook §3. */
   BARE_OS_PIPELINE_MAX_STAGES: '32',
-  BARE_OS_PIPELINE_MAX_BYTES: '2097152',
+  BARE_OS_PIPELINE_MAX_BYTES: '536870912',
-  BARE_OS_PIPELINE_MAX_LINES: '50000',
+  BARE_OS_PIPELINE_MAX_LINES: '2000000',
   /** Default cap for find -exec/-ok invocations per run (override with env). */
   BARE_OS_FIND_EXEC_MAX: '64',
   /** Max lines `yes` prints before stopping (override with BARE_OS_YES_MAX_LINES). */
@@ -168,8 +168,8 @@ const CONF = {
   _SC_TTY_NAME_MAX: '32',
   _SC_LOGIN_NAME_MAX: '256',
   /** Defaults; live session: **`ctx.bareOsGetconfSysconf`** (pipeline limits, swarm caps, …). */
-  _SC_BARE_OS_PIPELINE_MAX_BYTES: '2097152',
+  _SC_BARE_OS_PIPELINE_MAX_BYTES: '536870912',
-  _SC_BARE_OS_PIPELINE_MAX_LINES: '50000',
+  _SC_BARE_OS_PIPELINE_MAX_LINES: '2000000',
   _SC_BARE_OS_PIPELINE_MAX_STAGES: '32',
   _SC_BARE_OS_GLOB_MAX_MATCHES: '4096',
   _SC_BARE_OS_SHELL_LOOP_MAX: '10000',

packages/bare-os-seeder/kernel/bin/kernel-doctor

@@ -136,7 +136,16 @@ async function run(ctx, argv) {
       bootDryRun: ctx.env?.BARE_OS_BOOT_DRY_RUN,
       bootPolicyPath: ctx.env?.BARE_OS_BOOT_POLICY_PATH,
       dnsProfile: ctx.env?.BARE_OS_DNS_PROFILE,
-      delegateTrace: ctx.env?.BARE_OS_DELEGATE_TRACE
+      delegateTrace: ctx.env?.BARE_OS_DELEGATE_TRACE,
+      pipelineMaxStages: ctx.env?.BARE_OS_PIPELINE_MAX_STAGES,
+      pipelineMaxBytes: ctx.env?.BARE_OS_PIPELINE_MAX_BYTES,
+      pipelineMaxLines: ctx.env?.BARE_OS_PIPELINE_MAX_LINES,
+      pipelineAbsMaxBytes: ctx.env?.BARE_OS_PIPELINE_ABS_MAX_BYTES,
+      pipelineAbsMaxLines: ctx.env?.BARE_OS_PIPELINE_ABS_MAX_LINES,
+      shellStreaming: ctx.env?.BARE_OS_SHELL_STREAMING,
+      shellStreamingMult:
+        ctx.env?.BARE_OS_SHELL_STREAMING_MULT ??
+        ctx.env?.BARE_OS_STREAMING_MULTIPLIER
     }
   }
   if (json) {

packages/bare-os-seeder/kernel/etc/bare-os/rc.profile.full

@@ -1,4 +1,5 @@
 # Bare OS — optional "full" profile snippet (use with BARE_OS_BOOT_PROFILE=full).
-# Enables relaxed pipeline limits and bounded command substitution (see docs/reference/kernel-extensions.md).
+# Pipeline streaming is already on by default in the stock booter; this line remains for older images.
+# Enables bounded command substitution (see docs/reference/kernel-extensions.md).
 export BARE_OS_SHELL_STREAMING=1
 export BARE_OS_SHELL_CMDSUBST=1