- disk.os: replication_operator_sketch schema 7 + corestoreSnapshotUxHint; wire corestore into bridge

- HRPC: bare_os.pkg_index_get, route table schema 3; pkg-swarm-index list/get; pathcap-verify --trusted - POSIX: profile 1.0.17, ctx API 1.53.0, syscalls.json schema 11 + susv4Refs; JSON schemas + matrix/dashboard - Feature bits: BARE_OS_KERNEL_FEATURE_BITS_DOC 16; contract + verify scripts; ctx.d.ts + gen helper sync - Ops: BARE_OS_HOLEPUNCH_DRIFT_TIER1 + tier1Repos; mktemp avoids false XXX marker; /proc boot_budget_summary test list - Docs: contract spine, env appendix, handbook, compatibility matrix, boot budget schema, vault threat model notes Covers bare-os P2P roadmap items 1–20 where implemented in-tree; kernel/lib/bare/README left minimal per maintainer edit.
2026-04-05 15:52:59 -04:00
parent 41526508df
commit 64a1270d18
79 changed files with 1707 additions and 568 deletions
@@ -46,7 +46,7 @@ The [developer guide](developer-guide/README.md) is the **how-to** for `start(ct

 ### POSIX surface

-Intentional coverage and gaps for utilities, shell, and VFS: [handbook — Chapter 9](handbook/09-posix-utilities-shell-and-vfs.md). Declared profile **`1.0.16`** (**`BARE_OS_POSIX_PROFILE_VERSION`**) with **`ctx`** API **`1.52.0`** — see [POSIX declared profile](docs/architecture/POSIX_DECLARED_PROFILE.md) and [compatibility matrix](docs/reference/compatibility-matrix.md). Machine-readable summary: [docs/reference/posix-compliance-matrix.json](docs/reference/posix-compliance-matrix.json) (verified in **`pretest`**).
+Intentional coverage and gaps for utilities, shell, and VFS: [handbook — Chapter 9](handbook/09-posix-utilities-shell-and-vfs.md). Declared profile **`1.0.17`** (**`BARE_OS_POSIX_PROFILE_VERSION`**) with **`ctx`** API **`1.53.0`** — see [POSIX declared profile](docs/architecture/POSIX_DECLARED_PROFILE.md) and [compatibility matrix](docs/reference/compatibility-matrix.md). Machine-readable summary: [docs/reference/posix-compliance-matrix.json](docs/reference/posix-compliance-matrix.json) (verified in **`pretest`**).

 ## Quick start

@@ -50,6 +50,8 @@ This chapter ties together **Holepunch `bare-*` packages**, the **Pear** host ru

 - **Local Holepunch clone inventory** — After editing the manifest or before a release, run **`npm run audit:holepunch-clones`** to refresh **[`docs/audit/holepunch-clone-sync-report.json`](../docs/audit/holepunch-clone-sync-report.json)** against **`BARE_OS_HOLEPUNCH_CLONES_ROOT`**. To fail CI when selected clones lag **`origin/main`**, list their directory names in **[`docs/audit/holepunch-drift-repos.json`](../docs/audit/holepunch-drift-repos.json)** and set **`BARE_OS_HOLEPUNCH_DRIFT_CHECK=1`** (see [scripts/README.md](../scripts/README.md)).

+- **`mirror-drive` (Holepunch) audit** — The stock VFS union and **`/mirror/*`** overlays remain the supported read-mostly composition path. The upstream **`mirror-drive`** package is a candidate for a future **env-gated** fast path (read-only layering); treat any integration as **parity-tested** against union semantics and document **fallback** when the package is absent. See **`BARE_OS_VFS_UNION_PREFIXES`** in the environment appendix and **`ctx.bareOsEmitMirrorDriveHint`** above.
+
 ---

 ## Runtime caps
@@ -18,7 +18,7 @@ This project is **experimental research software**. APIs described here follow t

 **Kernel source set:** [`docs/reference/kernel-extensions.md`](../docs/reference/kernel-extensions.md) — first-party paths (`kernel/init.js`, `kernel/lib/boot`, built `/bin`) vs vendored **`kernel/lib/bare/bundles`** (Holepunch IIFEs), CI allowlists, and seeder parity. Hand-authored code must stay free of incomplete markers; bundles are gated by **`verify-bundle-markers.mjs`**, **`verify-bundle-throws.mjs`** ( **`new Error` messages** with *not implemented* / abstract-base-class semantics — see [`docs/audit/bundle-throw-allowlist.json`](../docs/audit/bundle-throw-allowlist.json)), and **`sanitize-bare-bundles.mjs`**. Prefer shrinking the throw allowlist via upstream bundle refreshes over silent drift.

-**Local Holepunch mirror:** run **`npm run audit:holepunch-clones`** to refresh **`docs/audit/holepunch-clone-sync-report.json`** (schema **2**), **`holepunch-lockfile-drift.json`**, and NDJSON summaries. The sync report lists every **`bare-module-manifest.json`** entry against **`BARE_OS_HOLEPUNCH_CLONES_ROOT`** (default **`~/dev/pearcli/holepunch-repos/holepunchto_repos`**): **`gitHead`**, **`originMainHead`**, **`commitsBehindOriginMain`**, **`commitsAheadOfOriginMain`** (meaningful after **`git fetch origin main`** in each clone). **`goldenPathRows`** mirrors **`goldenPathRepos`** in **`docs/audit/holepunch-drift-repos.json`** (Bare runtime + Pear + core wire stack) for quick maintainer diff review — it is **not** a CI gate. Root **`pretest`** runs **`verify-holepunch-clone-drift.mjs`** only against **`repos[]`** in the same JSON (empty = no-op). Regenerate the maximal npm catalog with **`node scripts/gen-bare-holepunch-catalog.mjs`** (or **`npm run gen:bare-catalog`**), then **`npm run sync:bare-manifest`** — see [scripts/README.md](../scripts/README.md).
+**Local Holepunch mirror:** run **`npm run audit:holepunch-clones`** to refresh **`docs/audit/holepunch-clone-sync-report.json`** (schema **2**), **`holepunch-lockfile-drift.json`**, and NDJSON summaries. The sync report lists every **`bare-module-manifest.json`** entry against **`BARE_OS_HOLEPUNCH_CLONES_ROOT`** (default **`~/dev/pearcli/holepunch-repos/holepunchto_repos`**): **`gitHead`**, **`originMainHead`**, **`commitsBehindOriginMain`**, **`commitsAheadOfOriginMain`** (meaningful after **`git fetch origin main`** in each clone). **`goldenPathRows`** mirrors **`goldenPathRepos`** in **`docs/audit/holepunch-drift-repos.json`** (Bare runtime + Pear + core wire stack) for quick maintainer diff review — it is **not** a CI gate. Root **`pretest`** runs **`verify-holepunch-clone-drift.mjs`** only against **`repos[]`** in the same JSON (empty = no-op). Maintainers may set **`BARE_OS_HOLEPUNCH_DRIFT_TIER1=1`** to check **`tier1Repos[]`** instead (hypercore / hyperdrive / hyperswarm / protomux / pear / pear-runtime / bare-fs / bare-process). Regenerate the maximal npm catalog with **`node scripts/gen-bare-holepunch-catalog.mjs`** (or **`npm run gen:bare-catalog`**), then **`npm run sync:bare-manifest`** — see [scripts/README.md](../scripts/README.md).

 ---

@@ -41,7 +41,7 @@ Bare OS advertises optional booter and seed-channel capabilities as a versioned

 13. **Tenth capability word (`bits10`)** — **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_PEAR_INSPECT_LOGGER_TLS`** and **`BARE_OS_FEATURE10_*`** add the tenth 32-bit word. **Word 9 high bits** remain reserved for future ninth-word–scoped features; **`bits10`** carries additional seed RPCs, replication JSON adjuncts (bundle tier, autobase-discovery hint, token bucket v4, staging schema 7, peer firewall v5, compact ping v4, ready guard v4, mirror compaction v5, blind relay v3), **`/proc`** JSON (**`bare-os-proc-pear-inspect-logger-tls.js`**), **`bare_os_proc_index`** schema **6**, boot policy v10 (**`requireKernelCapabilitiesPearInspectLoggerTls`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`extensionSignerPinsV3`**, **`bootPhasesRequireLifecycleMinSchema`**, …), extension registry schema **7**, Pear/Bare bridge **`ctx`**, worker **`sysproc:*`**, telemetry NDJSON schema **9** / OTel **7** / audit **7**, and CI **`verify-kernel-capabilities-word-10.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`bits10`**. **`BARE_OS_SEED_CAP_STRICT`** requires **`bits10`** to cover the stock tenth word when it is non-zero (same pattern as **`bits9`**).

-14. **Eleventh capability word (`hypercorePackHrpcLifecycle`)** — **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE`** and **`BARE_OS_FEATURE11_*`** add the eleventh 32-bit word. **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** is **15** after the wire-v2 documentation bump (JSON shape only; no bit-position changes). This word groups protocol **`0.9.0`** (wire v2 **`kernelCapabilityWords`**), twenty seed RPC methods (replicate budget, drive graph, protomux backpressure, Pear matrix, bundle preload, … through mirror compaction v6), **`bare-os-proc-hypercore-pack-hrpc-lifecycle.js`** with twenty **`/proc/bare_os/*.json`** surfaces, **`bare_os_proc_index`** schema **7**, boot policy v11 (**`requireKernelCapabilitiesHypercorePackHrpcLifecycle`**, **`extensionSignerPinsV4`**, **`requireBarePackMin`**, **`requireBareAddonPolicyMin`**, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireHypercorePackHrpcLifecycle`**, merged **`denySeedRpcMethods`**), extension registry **`/proc`** payload schema **8**, **`ctx`** API **1.22.0** (**`bareOsAdvertisedKernelCapabilityWords`** / **`bareOsSeedKernelCapabilityWords`**), worker patterns **`cryptoproc:*`** / **`indexerproc:*`**, telemetry NDJSON **10** / OTel **`otlSchemaVersion` 8** / audit **8**, and CI **`verify-kernel-capabilities-word-11.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`kernelCapabilityWords.hypercorePackHrpcLifecycle`**. **`BARE_OS_SEED_CAP_STRICT`** requires that key to cover the stock eleventh word when it is non-zero.
+14. **Eleventh capability word (`hypercorePackHrpcLifecycle`)** — **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE`** and **`BARE_OS_FEATURE11_*`** add the eleventh 32-bit word. **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** is **16** after the optional Protomux cap-channel bit (**`BARE_OS_FEATURE8_PROTOMUX_CAP_CHANNEL`**) and related proc/HRPC documentation bump (no legacy bit renumbering). This word groups protocol **`0.9.0`** (wire v2 **`kernelCapabilityWords`**), twenty seed RPC methods (replicate budget, drive graph, protomux backpressure, Pear matrix, bundle preload, … through mirror compaction v6), **`bare-os-proc-hypercore-pack-hrpc-lifecycle.js`** with twenty **`/proc/bare_os/*.json`** surfaces, **`bare_os_proc_index`** schema **7**, boot policy v11 (**`requireKernelCapabilitiesHypercorePackHrpcLifecycle`**, **`extensionSignerPinsV4`**, **`requireBarePackMin`**, **`requireBareAddonPolicyMin`**, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireHypercorePackHrpcLifecycle`**, merged **`denySeedRpcMethods`**), extension registry **`/proc`** payload schema **8**, **`ctx`** API **1.22.0** (**`bareOsAdvertisedKernelCapabilityWords`** / **`bareOsSeedKernelCapabilityWords`**), worker patterns **`cryptoproc:*`** / **`indexerproc:*`**, telemetry NDJSON **10** / OTel **`otlSchemaVersion` 8** / audit **8**, and CI **`verify-kernel-capabilities-word-11.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`kernelCapabilityWords.hypercorePackHrpcLifecycle`**. **`BARE_OS_SEED_CAP_STRICT`** requires that key to cover the stock eleventh word when it is non-zero.

 **Deprecation (unused bits):** once a bit is published in this ADR and **`kernel-capabilities-index.md`**, its numeric position is **stable**; if a feature is removed from the stock booter, the bit stays reserved (document as “unused / reserved”) until a major governance revision. **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** bumps when semantics or this policy changes.

@@ -36,6 +36,31 @@ flowchart TB

 ---

+## Contract spine (quick cross-links)
+
+Normative and machine-readable contracts that should move together when behavior changes:
+
+| Surface | Role |
+| --- | --- |
+| [POSIX declared profile](architecture/POSIX_DECLARED_PROFILE.md) | Narrative stance, non-goals, env gates (`BARE_OS_POSIX_PROFILE_VERSION`). |
+| [`ctx` API version](reference/compatibility-matrix.md) | Guest-visible `ctx` semver in `bare-os-ctx-api.js`. |
+| [Protocol / feature bits](reference/compatibility-matrix.md) | `bare-os-protocol` package version, kernel feature words, Protomux channel names. |
+| [Telemetry / audit](schemas/) | NDJSON and JSON Schema shards under `docs/schemas/`; handbook ops ch.7. |
+| [`/proc` and HRPC](reference/package-bare-os-booter.md) | Proc JSON schema bumps, `disk.os` allowlist, `replication_operator_sketch` versions. |
+
+```mermaid
+flowchart LR
+  P[POSIX profile + syscalls.json] --> M[posix-compliance-matrix.json]
+  C[ctx API semver] --> CM[compatibility-matrix.md]
+  PR[bare-os-protocol] --> FB[kernel feature bits]
+  B[booter /proc builders] --> HRPC[ctx.bareOsHrpcRequest table]
+  K[/boot/init.js boot policy] --> T[telemetry NDJSON]
+```
+
+Run **`npm run pretest`** after contract edits so generated dashboards and parity scripts stay aligned.
+
+---
+
 ## POSIX + P2P consolidated dashboard

 Single entry point for **declared POSIX-like behavior**, machine-readable matrices, and **P2P / capability** alignment:
@@ -12,7 +12,7 @@ This document is the **single overview** of how the Bare OS “kernel” is spli
 | **Init / services** | Booter | `bare-initd`, `systemctl` delegate, unit files |
 | **Guest shell + `/bin`** | Image + booter | Hyperdrive-resident scripts; host delegates for selected CLIs |
 | **Extensions** | Image | `kernel.ext.d`, manifests; resolver in booter |
-| **Peer search / OS RPC** | Booter | `disk.os` after initd (`bare-os-disk-os-bridge.js`); optional **`BARE_OS_VFS_HYPERBLOBS_DEDUP`** surfaces **non-secret** dedup hints via **`BARE_OS_HYPERBLOBS_STATS_JSON`** merged into **`replication_operator_sketch`**; optional **`BARE_OS_CORESTORE_STATS_JSON`** merges **`corestoreOperatorSketch`** (**schema 5** response). Guest does not run **`hyperblobs`** / Corestore internals. |
+| **Peer search / OS RPC** | Booter | `disk.os` after initd (`bare-os-disk-os-bridge.js`); optional **`BARE_OS_VFS_HYPERBLOBS_DEDUP`** surfaces **non-secret** dedup hints via **`BARE_OS_HYPERBLOBS_STATS_JSON`** merged into **`replication_operator_sketch`**; optional **`BARE_OS_CORESTORE_STATS_JSON`** merges **`corestoreOperatorSketch`**; **`corestoreSnapshotUxHint`** compares snapshot vs stats env JSON (**schema 7** response). Guest does not run **`hyperblobs`** / Corestore internals. |

 ## Boot steps (booter)

@@ -6,7 +6,7 @@ This document is the **normative contract** for how closely the stock Bare OS ke

 | Constant | Value |
 | -------- | ----- |
-| `BARE_OS_POSIX_PROFILE_VERSION` | `1.0.16` |
+| `BARE_OS_POSIX_PROFILE_VERSION` | `1.0.17` |
 | `BARE_OS_POSIX_PROFILE_ID` | `bare-os-posix-like` |
 | `BARE_OS_POSIX_PROFILE_REFERENCE` | Open Group Issue 7 index URL |

@@ -18,7 +18,7 @@ This document is the **normative contract** for how closely the stock Bare OS ke

 Bare OS does **not** expose a C ABI. The following **observability contracts** stand in for “system calls”:

- **`/proc/bare_os/syscalls.json`** — Declares **fd model**, **signal model**, **errno hints**, **operation detail**, **`posixXsh`**, **`socketMsgSurface`**, and related adjuncts (schema **10** in stock builds; see [`docs/reference/posix-compliance-matrix.json`](../reference/posix-compliance-matrix.json)). **`ops`** lists invocable **`ctx.bareOsSyscall`** names (**`posix_fadvise`** as a simulated no-op hint; **`clock_gettime`** for REALTIME / MONOTONIC sketches alongside **`nanosleep`**); **`opsDetail`** also carries **POSIX.1 XSH** logical names (**`open`**, **`close`**, **`read`**, **`write`**, **`readv`**, **`writev`**, **`getsockopt`**, **`setsockopt`**, **`lseek`**, **`pipe`**, **`dup`**, **`dup2`**, **`fcntl`**, **`poll`**, **`select`**, **`umask`**, **`fsync`**, **`fdatasync`**, **`posix_fadvise`**, and **socket family** probes) with **`posixAlignment`** (**`simulated`**, **`partial`**, **`ENOTSUP`**) and **`mapsTo`** for traceability. The **`posixXsh`** object summarizes those XSH names (via **`bareOsPosixXshOpsCsv()`**). **`socketMsgSurface`** (schema **5**) documents **`sendmsg`** / **`recvmsg`** on the bridge: bounded **iovec** flattening for datagram and stream paths; binary ancillary control on **`sendmsg`** remains **`ENOTSUP`** with structured rejection metadata unless **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS=1`**, in which case JSON-shaped **`cmsgs`** may request logical **`scmRightsLocalDup`** on **SOCK_STREAM** and **SOCK_DGRAM** bridge fds (guest logical FD duplication — not host **`SCM_RIGHTS`**); **`recvmsg`** reports **`controllen: 0`** on the receive path. **`fcntl`** supports **`F_GETFL`** / **`F_SETFL`** (Linux-shaped **`O_APPEND`** **`0x400`**, **`O_NONBLOCK`** **`0x800`**) and **cooperative advisory locks** via **`F_GETLK`** / **`F_SETLK`** / **`F_SETLKW`** using **`args.path`** (absolute) or **`args.fd`** whose logical target is an absolute path; contended **`F_SETLK`** returns **`EAGAIN`**. **`F_SETLKW`** also returns **`EAGAIN`** by default; with **`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`**, waiters are queued **FIFO per lock path** until the lock is free or **`BARE_OS_FCNTL_LOCK_WAIT_MS_MAX`** elapses (**`ETIMEDOUT`**; default **30000** ms, max **300000**). There is **no** cross-path global fairness and **no** host deadlock detection. Unknown FDs yield **`EBADF`**. **`readv`** / **`writev`** perform bounded scatter/gather on **`BARE_OS_POSIX_FD_SIM`** pipe read/write ends. **`poll`** / **`select`** share the same logical FD readiness probe when **`BARE_OS_POSIX_FD_SIM`** is enabled; with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**, bridged **datagram** fds participate (**`SOCK_DGRAM`** via **`bareDgram`** when merged) with bounded **`recv`** / **`recvfrom`** queues (**`BARE_OS_POSIX_DGRAM_RECVQ_MAX`**, **`BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX`**); passive **`SOCK_STREAM`** uses **`bind`/`listen`/`accept`** when **`bareTcp.Server`** is available. **Socket-shaped** syscalls default to **`ENOSYS`** / **`ENOTSUP`**; with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**, **`socket`** + **`connect`** may use **`ctx.bare.bareTcp.Socket`** (**`SOCK_STREAM`**) or **`bareDgram`** (**`SOCK_DGRAM`**) when merged. The stock booter **caches** this JSON until warm read-cache invalidation.
+- **`/proc/bare_os/syscalls.json`** — Declares **fd model**, **signal model**, **errno hints**, **operation detail**, **`posixXsh`**, **`socketMsgSurface`**, and related adjuncts (schema **11** in stock builds; see [`docs/reference/posix-compliance-matrix.json`](../reference/posix-compliance-matrix.json)). **`ops`** lists invocable **`ctx.bareOsSyscall`** names (**`posix_fadvise`** as a simulated no-op hint; **`clock_gettime`** for REALTIME / MONOTONIC sketches alongside **`nanosleep`**); **`opsDetail`** also carries **POSIX.1 XSH** logical names (**`open`**, **`close`**, **`read`**, **`write`**, **`readv`**, **`writev`**, **`getsockopt`**, **`setsockopt`**, **`lseek`**, **`pipe`**, **`dup`**, **`dup2`**, **`fcntl`**, **`poll`**, **`select`**, **`umask`**, **`fsync`**, **`fdatasync`**, **`posix_fadvise`**, and **socket family** probes) with **`posixAlignment`** (**`simulated`**, **`partial`**, **`ENOTSUP`**) and **`mapsTo`** for traceability; stable **`susv4Refs`** string tokens (for example **`XSH/open`**) support audit cross-walks. The **`posixXsh`** object summarizes those XSH names (via **`bareOsPosixXshOpsCsv()`**); schema **3** pairs with syscall proc **11**. **`socketMsgSurface`** (schema **5**) documents **`sendmsg`** / **`recvmsg`** on the bridge: bounded **iovec** flattening for datagram and stream paths; binary ancillary control on **`sendmsg`** remains **`ENOTSUP`** with structured rejection metadata unless **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS=1`**, in which case JSON-shaped **`cmsgs`** may request logical **`scmRightsLocalDup`** on **SOCK_STREAM** and **SOCK_DGRAM** bridge fds (guest logical FD duplication — not host **`SCM_RIGHTS`**); **`recvmsg`** reports **`controllen: 0`** on the receive path. **`fcntl`** supports **`F_GETFL`** / **`F_SETFL`** (Linux-shaped **`O_APPEND`** **`0x400`**, **`O_NONBLOCK`** **`0x800`**) and **cooperative advisory locks** via **`F_GETLK`** / **`F_SETLK`** / **`F_SETLKW`** using **`args.path`** (absolute) or **`args.fd`** whose logical target is an absolute path; contended **`F_SETLK`** returns **`EAGAIN`**. **`F_SETLKW`** also returns **`EAGAIN`** by default; with **`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`**, waiters are queued **FIFO per lock path** until the lock is free or **`BARE_OS_FCNTL_LOCK_WAIT_MS_MAX`** elapses (**`ETIMEDOUT`**; default **30000** ms, max **300000**). There is **no** cross-path global fairness and **no** host deadlock detection. Unknown FDs yield **`EBADF`**. **`readv`** / **`writev`** perform bounded scatter/gather on **`BARE_OS_POSIX_FD_SIM`** pipe read/write ends. **`poll`** / **`select`** share the same logical FD readiness probe when **`BARE_OS_POSIX_FD_SIM`** is enabled; with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**, bridged **datagram** fds participate (**`SOCK_DGRAM`** via **`bareDgram`** when merged) with bounded **`recv`** / **`recvfrom`** queues (**`BARE_OS_POSIX_DGRAM_RECVQ_MAX`**, **`BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX`**); passive **`SOCK_STREAM`** uses **`bind`/`listen`/`accept`** when **`bareTcp.Server`** is available. **Socket-shaped** syscalls default to **`ENOSYS`** / **`ENOTSUP`**; with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**, **`socket`** + **`connect`** may use **`ctx.bare.bareTcp.Socket`** (**`SOCK_STREAM`**) or **`bareDgram`** (**`SOCK_DGRAM`**) when merged. The stock booter **caches** this JSON until warm read-cache invalidation.
 - **`/proc/bare_os/process_table.json`** — **PGID** / **SID**-style fields, **`parentName`** (from **`ppid`**), **signal routing**, and initd binding for the **logical** process table (not host PIDs).

 **Explicit non-goals**
@@ -73,4 +73,6 @@ Signal names accepted by **`kill`** and shell builtins follow POSIX **names** wh

 Bump **`BARE_OS_POSIX_PROFILE_VERSION`** in `bare-os-protocol` when **intentional** utility, shell, VFS, or proc-contract behavior changes. Update this file, handbook ch.9, and §14a in the same change set.

+**1.0.17** — Syscalls proc **schema 11** (**`susv4Refs`** on **`opsDetail`**, **`posixXsh` schema 3**); **`ctx`** API **1.53.0**; **`disk.os`** **`replication_operator_sketch` schema 7** (**`corestoreSnapshotUxHint`**, **`pkgIndexSurface`**, **`bare_os.pkg_index_get`** + **`BARE_OS_PKG_INDEX_PATH`**); optional **Protomux cap channel** (**`BARE_OS_PROTOMUX_CAP_CHANNEL`**, feature bit); **`metrics_live.replicationLive`** collaboration hints + optional **`BARE_OS_COLLAB_SESSION_NDJSON`**; **`security_posture`** blind-relay posture sketch; **`ctx.bareOsVerifyPathCapabilityEnvelopeTrusted`** + **`BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX`**; **`/proc/bare_os/boot_budget_summary.json`**; warm-cache adaptive **jitter** (**`BARE_OS_VFS_WARM_REPL_ADAPTIVE_JITTER_PCT`**); shell unset-only default expansion (**`BARE_OS_SHELL_POSIX_UNSET_ONLY_DEFAULT`**); **`pathcap-verify --trusted`**; **`pkg-swarm-index`** **`list` / `get`** against drive manifest or HRPC.
+
 **1.0.16** — Stock **`pathcap-verify`**, **`pkg-swarm-index`**, optional **path-capability** VFS gate (**`BARE_OS_PATH_CAPABILITY_*`**), **`ctx.bareOsVerifyPathCapabilityEnvelope`**, **`disk.os` path manifest + `bare_os.search_local` hrpc**, **`metrics_live.replicationLive` schema 4** (**`warmReplAdaptive`**), boot budget transaction **`bootBudgetSchemaVersion` 2** (**`bootBudgetViolations`**), Wasm **`env.bare_os_ctx_api_version_peek`**, optional **`BARE_OS_POSIX_SOCKET_CONNECT_TIMEOUT_MS`** on bridge TCP **`connect`**, **`BARE_OS_SAVEVAULT_PRESNAPSHOT_HINT`** host event, optional **`BARE_OS_RC_PROPOSAL_MULTISIG_STRICT`** + **`rc.proposals/enabled`** audit rows (**`rc.proposal.multisig_*`**).
@@ -43,7 +43,7 @@ This document classifies incomplete surfaces as of the kernel hardening pass. It

 ## P3 — Vendored `kernel/lib/bare/bundles/*.js`

-Upstream-generated IIFEs may contain `TODO` comments, `NOT_IMPLEMENTED` helpers, and abstract stream throws. These are **not** first-party kernel policy; they are rebuilt from `bare-os-bare-libs` and mirrored under `packages/bare-os-seeder/kernel/`. **Inventory:** committed **`docs/audit/bundle-health.json`** (per-bundle bytes, regenerated by **`npm run build -w bare-os-bare-libs`**). **Marker gate:** **`scripts/verify-bundle-markers.mjs`** + **`docs/audit/bundle-marker-allowlist.json`**. **Throw gate:** **`scripts/verify-bundle-throws.mjs`** + **`docs/audit/bundle-throw-allowlist.json`** for `throw new Error("not implemented")` phrasing. Closure strategy: upstream version bumps, allowlist shrink, or bundle post-processing — see **`kernel/lib/bare/README.md`**.
+Upstream-generated IIFEs may contain `TODO` comments, `NOT_IMPLEMENTED` helpers, and abstract stream throws. These are **not** first-party kernel policy; they are rebuilt from `bare-os-bare-libs` and mirrored under `packages/bare-os-seeder/kernel/`. **Inventory:** committed **`docs/audit/bundle-health.json`** (per-bundle bytes, regenerated by **`npm run build -w bare-os-bare-libs`**). **Marker gate:** **`scripts/verify-bundle-markers.mjs`** + **`docs/audit/bundle-marker-allowlist.json`**. **Throw gate:** **`scripts/verify-bundle-throws.mjs`** + **`docs/audit/bundle-throw-allowlist.json`** for `throw new Error("not implemented")` phrasing. **Maintainer hygiene:** optional **`BARE_OS_HOLEPUNCH_DRIFT_TIER1=1`** exercises **`tier1Repos[]`** in **`docs/audit/holepunch-drift-repos.json`** against local clones (see **`scripts/verify-holepunch-clone-drift.mjs`**). Closure strategy: upstream version bumps, allowlist shrink, or bundle post-processing — see **`kernel/lib/bare/README.md`**.

 ## Subsystem matrix

@@ -1,6 +1,6 @@
 {
  "schemaVersion": 1,
-  "generatedAt": "2026-04-05T19:26:43.567Z",
+  "generatedAt": "2026-04-05T19:51:46.184Z",
  "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",
  "buildTool": "packages/bare-os-bare-libs/build.mjs",
  "bundles": [
@@ -1,7 +1,17 @@
 {
-  "schema": 1,
-  "note": "pretest runs verify-holepunch-clone-drift only against repos[] (empty = no-op). For release gates, copy names from suggestedCriticalRepos into repos[] after git fetch origin main in each clone, or set BARE_OS_HOLEPUNCH_DRIFT_CHECK=0 to skip. Missing clones are skipped with a warning; listed clones must not lag origin/main. lockfilePackages drives scripts/report-holepunch-lockfile-drift.mjs (npm run audit:holepunch-clones). goldenPathRepos is emitted by scripts/sync-holepunch-clones.mjs as goldenPathRows (local HEAD vs origin/main ahead/behind) for maintainer review only — it does not gate CI.",
+  "schema": 2,
+  "note": "pretest runs verify-holepunch-clone-drift only against repos[] (empty = no-op). Optional: BARE_OS_HOLEPUNCH_DRIFT_TIER1=1 checks tier1Repos[] instead (maintainer spine). For release gates, copy names from suggestedCriticalRepos into repos[] after git fetch origin main in each clone, or set BARE_OS_HOLEPUNCH_DRIFT_CHECK=0 to skip. Missing clones are skipped with a warning; listed clones must not lag origin/main. lockfilePackages drives scripts/report-holepunch-lockfile-drift.mjs (npm run audit:holepunch-clones). goldenPathRepos is emitted by scripts/sync-holepunch-clones.mjs as goldenPathRows (local HEAD vs origin/main ahead/behind) for maintainer review only — it does not gate CI.",
  "repos": [],
+  "tier1Repos": [
+    "hypercore",
+    "hyperdrive",
+    "hyperswarm",
+    "protomux",
+    "pear",
+    "pear-runtime",
+    "bare-fs",
+    "bare-process"
+  ],
  "goldenPathRepos": [
    "bare-os",
    "bare-fs",
@@ -26,7 +26,7 @@ After replication, the booter records **`vfs`** → **`ctx`** → **`repl`** →

 ### Swarm `disk.os` bridge (post-`initd`)

-[`createBareOsDiskOsBridge`](../../packages/bare-os-booter/lib/bare-os-disk-os-bridge.js) is assigned to **`disk.os`**. Peer **`searchLocal`** aggregates path substring matches from the **system** Hyperdrive and every **`SwarmDisk.auxiliaryDrives`** entry (read-only mirrors under **`/mirror/aux*`**), dedupes, and caps results. The system drive may ship **`/etc/bare-os/path-manifest.json`** (or **`BARE_OS_DISK_OS_PATH_MANIFEST`**) so common paths match **without** a full recursive **`list()`** on the primary drive; **`BARE_OS_DISK_OS_SEARCH_MANIFEST_ONLY`** skips primary listing when a complete manifest is maintained. Optional host env **`BARE_OS_DISK_OS_SEARCH_THROTTLE_MS`** (0–500) yields between **auxiliary** drive scans. Whitelisted RPC **`bare_os.disk_os_hints`** (**schema 3**) exposes advisory **`mirrorDriveHintV2`**, **`httpDhtProxyHint`**, and **`pathSearchLocal`** metrics — operators only; guests do not auto-apply mirror hints. Stock **`ctx.bareOsHrpcRequest`** includes **`bare_os.search_local`** (**`payload.query`**) returning **`paths`** from **`disk.os.searchLocal`**. **`bare_os.replication_operator_sketch`** returns **schema 5** JSON (seed replication status, **`swarmPeerCount`**, Hyperswarm **`connectionBudget`**, protomux operator sketch, pause/backpressure env mirrors, optional **`hyperblobsDedupSketch`** / **`corestoreOperatorSketch`** / **`peerPrioritySketch`**). **`bare_os.replication_operator_intent`** appends an audit row when **`BARE_OS_DISK_OS_OPERATOR_INTENT_RPC=1`** and the booter wires **`auditBatch`**.
+[`createBareOsDiskOsBridge`](../../packages/bare-os-booter/lib/bare-os-disk-os-bridge.js) is assigned to **`disk.os`**. Peer **`searchLocal`** aggregates path substring matches from the **system** Hyperdrive and every **`SwarmDisk.auxiliaryDrives`** entry (read-only mirrors under **`/mirror/aux*`**), dedupes, and caps results. The system drive may ship **`/etc/bare-os/path-manifest.json`** (or **`BARE_OS_DISK_OS_PATH_MANIFEST`**) so common paths match **without** a full recursive **`list()`** on the primary drive; **`BARE_OS_DISK_OS_SEARCH_MANIFEST_ONLY`** skips primary listing when a complete manifest is maintained. Optional host env **`BARE_OS_DISK_OS_SEARCH_THROTTLE_MS`** (0–500) yields between **auxiliary** drive scans. Whitelisted RPC **`bare_os.disk_os_hints`** (**schema 3**) exposes advisory **`mirrorDriveHintV2`**, **`httpDhtProxyHint`**, and **`pathSearchLocal`** metrics — operators only; guests do not auto-apply mirror hints. Stock **`ctx.bareOsHrpcRequest`** includes **`bare_os.search_local`** (**`payload.query`**) returning **`paths`** from **`disk.os.searchLocal`**. **`bare_os.replication_operator_sketch`** returns **schema 7** JSON (seed replication status, **`swarmPeerCount`**, Hyperswarm **`connectionBudget`**, protomux operator sketch, **`pkgIndexSurface`**, **`corestoreSnapshotUxHint`**, pause/backpressure env mirrors, optional **`hyperblobsDedupSketch`** / **`corestoreOperatorSketch`** / **`peerPrioritySketch`**). **`bare_os.pkg_index_get`** reads the static drive manifest (**`BARE_OS_PKG_INDEX_PATH`**). **`bare_os.replication_operator_intent`** appends an audit row when **`BARE_OS_DISK_OS_OPERATOR_INTENT_RPC=1`** and the booter wires **`auditBatch`**.

 ```mermaid
 flowchart TB
@@ -14,9 +14,9 @@ Single place to compare **protocol**, **booter `ctx` API**, **feature-bit docume

 ## Version artifacts

-**`bareOsCtxApiVersion`** (current stock: **`1.52.0`**) — Defined in [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js). This is the semver string for the documented **`ctx`** contract; bump it when stable guest-visible behavior changes.
+**`bareOsCtxApiVersion`** (current stock: **`1.53.0`**) — Defined in [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js). This is the semver string for the documented **`ctx`** contract; bump it when stable guest-visible behavior changes.

-**`BARE_OS_KERNEL_FEATURE_BITS_DOC`** (current stock: **`15`**) — Exported from [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js). It versions the feature-bit documentation and related governance; keep it aligned with [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../../developer-guide/adr/001-kernel-feature-bits-governance.md).
+**`BARE_OS_KERNEL_FEATURE_BITS_DOC`** (current stock: **`16`**) — Exported from [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js). It versions the feature-bit documentation and related governance; keep it aligned with [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../../developer-guide/adr/001-kernel-feature-bits-governance.md).

 **Capability words (wire v2)** — Surfaces on **`bare_os.capabilities`** RPC and under **`/proc/bare_os_features`**. The stock tree uses a top-level **`kernelCapabilityWords`** object with eleven **`uint32`** masks named **`primary`**, **`extendedSeedingPlatform`**, **`rlimitsDelegatesShell`**, **`offlineNetExtensions`**, **`hostTransportDelegates`**, **`replicationOperatorSurface`**, **`pearCorestoreHrpc`**, **`bareRuntimeProtoMux`**, **`bareModuleCryptoStaging`**, **`pearInspectLoggerTls`**, and **`hypercorePackHrpcLifecycle`**. Bit positions match the legacy top-level **`bits`** … **`bits11`** fields for migration.

@@ -24,9 +24,9 @@ Single place to compare **protocol**, **booter `ctx` API**, **feature-bit docume

 **Protocol package** — Workspace version in [`bare-os-protocol` `package.json`](../../packages/bare-os-protocol/package.json). Pair it with seeder and booter releases when you change wire behavior.

-**POSIX-like profile** — **`BARE_OS_POSIX_PROFILE_VERSION`** (**`1.0.16`**) and **`BARE_OS_POSIX_PROFILE_ID`** (**`bare-os-posix-like`**) in [`bare-os-protocol/lib/bare-os-posix-profile.js`](../../packages/bare-os-protocol/lib/bare-os-posix-profile.js). Surfaced under **`/proc/bare_os_features`** as **`capabilitySurface.posixProfile`** and in **`/proc/bare_os/syscalls.json`**.
+**POSIX-like profile** — **`BARE_OS_POSIX_PROFILE_VERSION`** (**`1.0.17`**) and **`BARE_OS_POSIX_PROFILE_ID`** (**`bare-os-posix-like`**) in [`bare-os-protocol/lib/bare-os-posix-profile.js`](../../packages/bare-os-protocol/lib/bare-os-posix-profile.js). Surfaced under **`/proc/bare_os_features`** as **`capabilitySurface.posixProfile`** and in **`/proc/bare_os/syscalls.json`**.

-**`/proc/bare_os/syscalls.json`** — Schema **10** (see also [handbook ch.9 §2.3](../../handbook/09-posix-utilities-shell-and-vfs.md#23-pseudo-proc-sys-run-dev-and-session-tmp)) adds **`posix_fadvise`** as a simulated **`ctx.bareOsSyscall`** no-op and retains **`clock_gettime`** (REALTIME / MONOTONIC sketch); earlier schema fields remain: cooperative **`fcntl`** advisory locks (optional **`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`** for **`F_SETLKW`**-shaped waits), optional **`BARE_OS_POSIX_SOCKET_FD_BRIDGE`** **`socket`/`connect`** (**`SOCK_STREAM`** via **`bareTcp`**, **`SOCK_DGRAM`** via **`bareDgram`** when merged) with bounded **`send`/`sendmsg`/`recv`/`recvfrom`/`recvmsg`** on bridged datagram fds (**`BARE_OS_POSIX_DGRAM_RECVQ_MAX`**, **`BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX`**), **`socketMsgSurface`** schema **5** (**`sendmsg`/`recvmsg`** partial on bridge; binary ancillary **`ENOTSUP`**; optional **`logicalScmRightsOnSend`** when **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS`**; **`recvmsg`** **`controllen` 0**), and retains socket-family **probes** plus **`posixXsh`**. Earlier schemas added **`fdModel`**, **`signalModel`**, **`opsDetail`**, **`errnoHints`**, and **`posixProfile`**. The stock booter **caches** the JSON text until **`vfs.bareOsClearWarmReadCaches()`** / **`ctx.bareOsInvalidateWarmReadCaches()`** (same invalidation path as **`/bin`** warm cache; **`boot/init.js`** and **`lib/init/**` batch puts also invalidate). Example payload: [`kernel/etc/bare-os/syscalls.example.json`](../../kernel/etc/bare-os/syscalls.example.json); JSON Schema: [`docs/schemas/bare-os-syscalls.schema.json`](../schemas/bare-os-syscalls.schema.json).
+**`/proc/bare_os/syscalls.json`** — Schema **11** (see also [handbook ch.9 §2.3](../../handbook/09-posix-utilities-shell-and-vfs.md#23-pseudo-proc-sys-run-dev-and-session-tmp)) adds **`susv4Refs`** tokens on **`opsDetail`** and bumps **`posixXsh` schema** to **3**; schema **10** added **`posix_fadvise`** as a simulated **`ctx.bareOsSyscall`** no-op and retains **`clock_gettime`** (REALTIME / MONOTONIC sketch); earlier schema fields remain: cooperative **`fcntl`** advisory locks (optional **`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`** for **`F_SETLKW`**-shaped waits), optional **`BARE_OS_POSIX_SOCKET_FD_BRIDGE`** **`socket`/`connect`** (**`SOCK_STREAM`** via **`bareTcp`**, **`SOCK_DGRAM`** via **`bareDgram`** when merged) with bounded **`send`/`sendmsg`/`recv`/`recvfrom`/`recvmsg`** on bridged datagram fds (**`BARE_OS_POSIX_DGRAM_RECVQ_MAX`**, **`BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX`**), **`socketMsgSurface`** schema **5** (**`sendmsg`/`recvmsg`** partial on bridge; binary ancillary **`ENOTSUP`**; optional **`logicalScmRightsOnSend`** when **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS`**; **`recvmsg`** **`controllen` 0**), and retains socket-family **probes** plus **`posixXsh`**. Earlier schemas added **`fdModel`**, **`signalModel`**, **`opsDetail`**, **`errnoHints`**, and **`posixProfile`**. The stock booter **caches** the JSON text until **`vfs.bareOsClearWarmReadCaches()`** / **`ctx.bareOsInvalidateWarmReadCaches()`** (same invalidation path as **`/bin`** warm cache; **`boot/init.js`** and **`lib/init/**` batch puts also invalidate). Example payload: [`kernel/etc/bare-os/syscalls.example.json`](../../kernel/etc/bare-os/syscalls.example.json); JSON Schema: [`docs/schemas/bare-os-syscalls.schema.json`](../schemas/bare-os-syscalls.schema.json).

 **`/proc/bare_os/process_table.json`** — Schema **7** (see **`fdModel.processTableSchema`** inside **`syscalls.json`** and [handbook ch.9 §2.3](../../handbook/09-posix-utilities-shell-and-vfs.md#23-pseudo-proc-sys-run-dev-and-session-tmp)); documents logical jobs, PGID/SID-style fields, initd binding, and signal routing.

@@ -1,16 +1,16 @@
 // Auto-generated by scripts/gen-ctx-client-helper.mjs — do not edit by hand.

 /** Canonical `ctx` API semver from `packages/bare-os-booter/lib/bare-os-ctx-api.js`. */
-export const BARE_OS_CTX_API_CLIENT_VERSION = '1.52.0' as const
+export const BARE_OS_CTX_API_CLIENT_VERSION = '1.53.0' as const

 /** Relative path to the hand-maintained TypeScript contract (schema source of truth). */
 export const BARE_OS_CTX_DTS_SOURCE = 'packages/bare-os-booter/lib/bare-os-ctx.d.ts' as const

 /** Approximate count of `bareOs…` members in the DTS (diagnostic only; regenerate on contract edits). */
-export const BARE_OS_CTX_DTS_BAREOS_MEMBER_APPROX = 155 as const
+export const BARE_OS_CTX_DTS_BAREOS_MEMBER_APPROX = 156 as const

 /** Byte length of `bare-os-ctx.d.ts` when this file was generated. */
-export const BARE_OS_CTX_DTS_BYTES = 20046 as const
+export const BARE_OS_CTX_DTS_BYTES = 20232 as const

 /** Pointers for external client generators (OpenAPI / JSON Schema follow-ups). */
 export const BARE_OS_CTX_SCHEMA_HINT = {
@@ -45,10 +45,12 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_DISK_OS_MANIFEST_CACHE_MS` — Booter — Cache parsed manifest paths per system drive (**default** **30000**, max **3600000**). Reduces **`drive.get`** churn when peers issue many searches.
 - `BARE_OS_PATH_CAPABILITY_ENFORCE_READ` — Booter / VFS — When **`1`** / **`true`**, reads on the **personal** drive under **`BARE_OS_PATH_CAPABILITY_PREFIX`** require a valid **`user.bareos.cap_v1`** entry in **`PATH.bare_xattr.json`** (see **`path-capability.envelope.example.json`** and **`ctx.bareOsVerifyPathCapabilityEnvelope`**). Sidecar and ACL files are exempt from the check.
 - `BARE_OS_PATH_CAPABILITY_PREFIX` — Booter — Logical path prefix for the capability gate (**default** **`/home/`**). Only applies with **`BARE_OS_PATH_CAPABILITY_ENFORCE_READ`**.
+- `BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX` — Booter — Comma- or whitespace-separated **ed25519** public keys (**hex**) allowed as **`ctx.bareOsVerifyPathCapabilityEnvelopeTrusted`** issuers for signed envelopes (see **`/bin/pathcap-verify --trusted`**).
 - `BARE_OS_SAVEVAULT_PRESNAPSHOT_HINT` — Booter — When **`1`** / **`true`**, **`saveVaultToDrive`** emits **`process.emit('bare-os:vault-pre-save-snapshot-hint', …)`** so the host may snapshot the personal Corestore namespace before sealing vault blobs.
 - `BARE_OS_POSIX_SOCKET_CONNECT_TIMEOUT_MS` — Booter — Optional **SOCK_STREAM** bridge **`connect`** wall timeout in milliseconds (**default** **0** = unlimited). On expiry the socket is destroyed and **`connect`** returns **`ETIMEDOUT`**.
 - `BARE_OS_WASM_KERNEL_CTX_API_PEEK` — Booter / guest env — With **`BARE_OS_WASM_KERNEL_SYSCALL`**, adds Wasm import **`env.bare_os_ctx_api_version_peek`** writing **`ctx.bareOsCtxApiVersion`** NUL-terminated (**bounded**).
 - `BARE_OS_PKG_SWARM_TOPIC_HEX` — Guest — Optional **64-hex** topic class hint for **`pkg-swarm-index`** operator documentation (not wired to Hyperswarm by the stock utility).
+- `BARE_OS_PKG_INDEX_PATH` — Booter / **`disk.os`** — Absolute path on the **system** Hyperdrive for **`bare_os.pkg_index_get`** (default **`/etc/bare-os/pkg-index.json`**); see **`kernel/etc/bare-os/pkg-index.example.json`**.
 - `BARE_OS_RC_PROPOSAL_MULTISIG_STRICT` — Stock kernel — When **`1`** / **`true`**, before **`rc.d`** validate **`/etc/bare-os/rc.proposals/enabled/*.json`** against **`/etc/bare-os/pear.multisig.json`** (**`signaturesFrom`** ⊆ **`signers`**, distinct count ≥ **`quorum`**). Emits audit rows **`rc.proposal.multisig_*`** via **`ctx.bareOsAuditLogAppend`** when present.
 - `BARE_OS_NO_SPLASH` — Booter — If `1`, skip TTY splash (plain logs / non-TTY behavior unchanged)
 - `BARE_OS_LOCAL_SEED` — paths — Overrides local seed path helper (`defaultLocalSeedCorestorePath`); booter does not local-boot
@@ -115,8 +117,8 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_KERNEL_HOT_RELOAD` — Booter — Dev: allow **`ctx.bareOsRequestKernelReload()`** to re-read **`/boot/init.js`**.
 - `BARE_OS_KERNEL_EXT_D_HOT_RELOAD` — Stock kernel — When **`1`** / **`true`**, after boot the kernel exposes **`ctx.bareOsReloadKernelExtDropinsSafe()`**, which re-scans **`/etc/bare-os/kernel.ext.d`** and runs only extension scripts not yet recorded (**append-only**; does not unload). When **`ctx.vfs.writeFile`** exists, each reload appends **`kernelExtReloadSchemaVersion`** lines to **`/run/bare-os/kernel-ext-reload.ndjson`**.
 - `BARE_OS_VFS_HYPERBLOBS_DEDUP` — Booter / features proc — When **`1`** / **`true`**, surfaces an operator hint under **`/proc/bare_os/features`** that host mirror / hyperblob pipelines may use content-defined chunking; the guest VFS does not enable hyperblobs by itself.
- `BARE_OS_HYPERBLOBS_STATS_JSON` — Booter / **`disk.os`** — Optional non-secret JSON parsed into **`replication_operator_sketch.hyperblobsDedupSketch`** (merged into **`disk.os`** response **schema 5**).
- `BARE_OS_CORESTORE_STATS_JSON` — Booter / **`disk.os`** — Optional non-secret JSON parsed into **`replication_operator_sketch.corestoreOperatorSketch`** (**`bare_os.replication_operator_sketch`** response **schema 5**). Use for namespace counts, open-core tallies, or other **non-secret** Corestore operator metrics (no keys or paths to private material).
+- `BARE_OS_HYPERBLOBS_STATS_JSON` — Booter / **`disk.os`** — Optional non-secret JSON parsed into **`replication_operator_sketch.hyperblobsDedupSketch`** (merged into **`disk.os`** response **schema 7**).
+- `BARE_OS_CORESTORE_STATS_JSON` — Booter / **`disk.os`** — Optional non-secret JSON parsed into **`replication_operator_sketch.corestoreOperatorSketch`** (**`bare_os.replication_operator_sketch`** response **schema 7**). Use for namespace counts, open-core tallies, or other **non-secret** Corestore operator metrics (no keys or paths to private material). Together with **`BARE_OS_CORESTORE_SNAPSHOT_JSON`**, **`corestoreSnapshotUxHint`** (schema **3**) surfaces non-secret merge counts for rollback UX.
 - `BARE_OS_BLIND_PEER_TOPOLOGY_V3_JSON` — Booter / **`disk.os`** — Optional non-secret JSON parsed into **`replication_operator_sketch.blindTopologySketchV3`** (**schema 3** sketch object).
 - `BARE_OS_SUBPROCESS_BRIDGE_META_JSON` — Booter / **`process_table.json`** — Optional JSON (**host-injected**); the stock snapshot exposes a non-secret summary under **`subprocessBridgeMeta`** (**schema 7** **`process_table`**) for **`bare-process`** / **`bare-subprocess`** bridge alignment.
 - `BARE_OS_XARGS_MAX_PROCS` — **`/bin/xargs`** — Raises the cap for **`-P`** parallelism (still bounded by a hard maximum of **32** and by delegate concurrency when **`runBinCommand`** uses workers); default effective cap **8** when unset.
@@ -137,7 +139,7 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_SWARM_MAX_PEERS` — Booter — Integer passed to Hyperswarm **`maxPeers`** when set (non-empty positive integer string).
 - `BARE_OS_SWARM_MAX_CLIENT_CONNECTIONS` — Booter — Cap inbound client connections (**Hyperswarm** **`maxClientConnections`**).
 - `BARE_OS_SWARM_MAX_SERVER_CONNECTIONS` — Booter — Cap outbound server connections (**Hyperswarm** **`maxServerConnections`**).
- `BARE_OS_SWARM_MAX_PARALLEL` — Booter — Integer passed to Hyperswarm **`maxParallel`** when set. Effective values echo under **`/proc/bare_os/swarm`** **`connectionBudget`** and **`disk.os` `replication_operator_sketch`** (**schema 5**).
+- `BARE_OS_SWARM_MAX_PARALLEL` — Booter — Integer passed to Hyperswarm **`maxParallel`** when set. Effective values echo under **`/proc/bare_os/swarm`** **`connectionBudget`** and **`disk.os` `replication_operator_sketch`** (**schema 7**).
 - `BARE_OS_PEAR_SECURE_ENCLAVE_JSON` — Booter / security posture — Non-secret JSON pointer for optional Pear secure-enclave key storage hints; treat as opaque unless host policy attests hardware backing (see [vault threat model](../security/vault-threat-model.md)).
 - `BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON` — Booter / security posture — Non-secret JSON for signing continuity across overlapping trust windows during account key rotation (not private keys).
 - `BARE_OS_VAULT_MULTISIG_CONTINUITY_JSON` — Booter / **`/proc/bare_os/hyper_multisig_trust_pointer.json`** — Optional operator JSON merged as **`vaultMultisigContinuity`** when the proc builder uses **schema 2** (pointer-only multisig continuity sketch; no secret keys).
@@ -156,6 +158,7 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_SHELL_PARAM_EXPANSION` — Shell — When **`1`**, enable **`${VAR:-word}`** and **`${VAR#prefix}`** in **`expandWord`**.
 - `BARE_OS_SHELL_PARAM_EXPANSION_V2` — Shell — With param expansion on, enable **`${VAR:=word}`**, **`${VAR##*/}`** / **`${VAR#*/}`**, **`${VAR%%suffix}`** / **`${VAR%suffix}`** (bounded patterns).
 - `BARE_OS_SHELL_PARAM_EXPANSION_V3` — Shell — With param expansion on, enable **`${VAR:?word}`** and **`${VAR:+word}`** (POSIX-style error/alternate-value forms within documented bounds). Covered by **`expandWord param expansion v3`** in **`packages/bare-os-booter/test.js`**.
+- `BARE_OS_SHELL_POSIX_UNSET_ONLY_DEFAULT` — Shell — When **`1`** / **`true`** with param expansion on, enables **`${name-default}`** (default only when **unset**, distinct from **`${name:-default}`** when **unset or empty**).
 - `BARE_OS_ENV_DASH_S` — `/bin/env` — When **`1`**, enable **`-S` / `--split-string`** and **`--env-file`** (bounded).
 - `BARE_OS_VFS_WATCH_PSEUDO` — VFS — When **`1`**, allow **`vfs.watch`** on coalesced **`/proc/bare_os/metrics_live.json`** and polled **`/proc/bare_os/metrics.prom`** (and flat **`/proc/bare_os_metrics_*`** aliases).
 - `BARE_OS_VFS_WATCH_SWARM` — VFS — When **`1`**, allow bounded **`vfs.watch`** on **`/proc/bare_os/swarm`**, flat **`/proc/bare_os_swarm`**, **`/proc/bare_os/replication`**, **`/proc/bare_os_replication`** (poll interval **`BARE_OS_PROC_POLL_MS`**).
@@ -197,6 +200,7 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_VFS_WARM_CACHE_PREFIX_INVALIDATE` — Booter — When **`1`** / **`true`**, evict warm-cache entries for **`/bin`**, **`/etc`**, **`/lib`**, **`/usr`**, and configured personal prefixes when replicated core lengths increase (see **`metrics_live.replicationLive.warmPrefixInvalidate`**).
 - `BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION` — Booter — When **`1`** / **`true`**, call **`ctx.bareOsInvalidateWarmReadCaches('replication:core-length')`** on the same growth signal (full flush; **`metrics_live.warmFullInvalidateOnReplication`**).
 - `BARE_OS_VFS_WARM_REPL_ADAPTIVE_WINDOW_MS` — Booter — When set to a positive integer and full replication-driven invalidation is active, skip issuing another **full** warm-cache flush if the previous one was within this window (milliseconds), reducing churn on busy swarms while **`replication_operator_sketch`** / core-length signals remain visible in **`metrics_live`**. **`0`** or unset disables the grace window.
+- `BARE_OS_VFS_WARM_REPL_ADAPTIVE_JITTER_PCT` — Booter — Optional **0–50** integer percent jitter applied to adaptive warm-cache decisions (reduces synchronized invalidation bursts).
 - `BARE_OS_HOSTNAME_SET` — Booter / session — When **`1`** / **`true`**, allows **`ctx.bareOsSetSessionHostname`** and **`hostname --set`** to mutate session **`HOSTNAME`** / **`COMPUTERNAME`** (surfaced in **`/proc/bare_os/security_posture.json`** **`hostnameMutation`**).
 - `BARE_OS_SHELL_POSIX_MODE` — Shell — When **`1`** / **`true`**, **`( compound-list )`** runs as a grouped list in the same session (**no forked subshell**); must be the full top-level statement.
 - `BARE_OS_WASM_KERNEL` — Booter — When **`1`** / **`true`**, enables **`ctx.bareOsWasmKernelCompile`** (bounded **`WebAssembly.compile`** probe) and **`ctx.bareOsWasmKernelInstantiate`** (bounded **`WebAssembly.instantiate`** with isolated **`Memory`** and **`env.bare_os_nop`**).
@@ -219,6 +223,8 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX` — Booter — Optional blocking **`recv`** / **`accept`** wait cap (ms) for bridged UDP fds and for **`accept`** on listening TCP bridge fds before **`EAGAIN`**-shaped timeout notes.
 - `BARE_OS_POSIX_ACCEPT_QUEUE_MAX` — Booter — Max pending **`bareTcp.Server`** connections held before **`accept`** (default **64**, cap **1024**).
 - `BARE_OS_PROTOMUX_APP_CHANNEL` — Booter / seeder — When **`1`** / **`true`**, opens a second Protomux channel **`bare-os-app-v1`** alongside **`bare-os-v1`** for namespaced app RPC (see **`bare-os-protocol`** **`PROTOCOL_APP_CHANNEL_NAME`**).
+- `BARE_OS_PROTOMUX_CAP_CHANNEL` — Booter — When **`1`** / **`true`**, opens optional Protomux channel **`bare-os-cap-v1`** for capability-scoped guest IPC experiments (gated by kernel feature bit **`BARE_OS_FEATURE8_PROTOMUX_CAP_CHANNEL`**).
+- `BARE_OS_COLLAB_SESSION_NDJSON` — Booter — When **`1`** / **`true`**, host boot trace may append collaboration session lines (non-secret peer counts) via swarm-disk logging.
 - `BARE_OS_PHYS_PAGES_HINT` — Booter — Optional integer string for **`getconf _SC_PHYS_PAGES`** via **`ctx.bareOsGetconfSysconf`** (default **`524288`** when unset).
 - `BARE_OS_SHELL_HEREDOC_MAX_BYTES` — Booter — When **`BARE_OS_SHELL_POSIX_MODE`** is on, caps here-document body size (default **`262144`**, max **2 MiB**).
 - `BARE_OS_SHELL_LOOP_MAX` — Shell — Max iterations for **`while`** / **`for`** (default **10000**).
@@ -65,8 +65,8 @@ See also [Kernel subsystem map](../architecture/kernel-subsystems.md) and [ADR 0
  - **`saveVault()`** — encrypt personal-drive files into `/.bare/vault/` (skips `/.bare`, `bin`, `boot`, history paths).
  - **`registerKernelShutdownHook(fn)`** — register async/sync teardown before **`stopBareInitd`** when the REPL session cleans up.
 - After **`createKernelReplSession`**: wires **`readLine`**, **`console`**, **`execLine`**, **`suspendReplForSubprocess`** / **`resumeReplAfterSubprocess`**, then **`await startBareInitd(ctx)`** (services such as kernel log mirroring).
- Sets **`disk.os`** **after initd** with **`createBareOsDiskOsBridge`** (**`searchLocal`** with optional path manifest, whitelisted **`execRpc`** / **`bare_os.*`**, **`disk_os_hints`** schema **3**, **`replication_operator_sketch`** schema **5**, cap-gated **`replication_operator_intent`** when **`BARE_OS_DISK_OS_OPERATOR_INTENT_RPC=1`**) — peers use **`SwarmDisk`** messages **3–6**; see [`bare-os-disk-os-bridge.js`](../../packages/bare-os-booter/lib/bare-os-disk-os-bridge.js) and §12.4.
- **`ctx.bareOsHrpcRequest`** (stock) — validates **`service`**, **`method`**, object **`payload`**; optional **`BARE_OS_HRPC_ALLOWLIST_JSON`**; built-in routes **`kernel.ping`**, **`kernel.capabilities`**, **`vfs.readText`**, **`bare_os.echo`**, **`bare_os.disk_os_hints`**, **`bare_os.search_local`**, **`bare_os.replication_operator_sketch`**, **`bare_os.replication_snapshot`** (**`BARE_OS_HRPC_ROUTE_TABLE_SCHEMA_VERSION` 2**). **`BARE_OS_HRPC_EMIT_UNLISTED`** forwards unknown routes to **`process.emit('bare-os:hrpc-request', …)`** on Node when enabled.
+- Sets **`disk.os`** **after initd** with **`createBareOsDiskOsBridge`** (**`searchLocal`** with optional path manifest, whitelisted **`execRpc`** / **`bare_os.*`**, **`disk_os_hints`** schema **3**, **`replication_operator_sketch`** schema **7**, cap-gated **`replication_operator_intent`** when **`BARE_OS_DISK_OS_OPERATOR_INTENT_RPC=1`**) — peers use **`SwarmDisk`** messages **3–6**; see [`bare-os-disk-os-bridge.js`](../../packages/bare-os-booter/lib/bare-os-disk-os-bridge.js) and §12.4.
+- **`ctx.bareOsHrpcRequest`** (stock) — validates **`service`**, **`method`**, object **`payload`**; optional **`BARE_OS_HRPC_ALLOWLIST_JSON`**; built-in routes **`kernel.ping`**, **`kernel.capabilities`**, **`vfs.readText`**, **`bare_os.echo`**, **`bare_os.disk_os_hints`**, **`bare_os.search_local`**, **`bare_os.replication_operator_sketch`**, **`bare_os.replication_snapshot`**, **`bare_os.pkg_index_get`** (**`BARE_OS_HRPC_ROUTE_TABLE_SCHEMA_VERSION` 3**). **`BARE_OS_HRPC_EMIT_UNLISTED`** forwards unknown routes to **`process.emit('bare-os:hrpc-request', …)`** on Node when enabled.
 - `try { await runKernelFromSource(...) } finally { await session.cleanup() }` — cleanup runs **`bareInitdShutdownActiveUnitsReverse`**, **`runKernelShutdownHooks`**, **`stopBareInitd`**, fish TTY teardown.

 **`boot-splash.js`** — TTY splash (disabled when `stdout` is not a TTY or `BARE_OS_NO_SPLASH=1`): initial full-screen clear and hidden cursor, then centered redraws from the top-left without erasing the whole screen each tick (reduces flicker); one full clear again if the terminal is resized. Vertically and horizontally centered “card” (Unicode box frame when wide enough; compact rules on very narrow widths). On very wide terminals the framed card (and progress bar) width is capped so the bar does not span the entire display. Layout scales with `stdout.columns` / `stdout.rows` (sensible fallbacks): more log lines on tall terminals (capped), word-wrapped phase text, ANSI-safe centering. **`createBootSplash(stdout, { bootLimitMs?, tagline?, footerLines? })`** — optional **`tagline`** and dim **`footerLines`**; **`main()`** passes booter and protocol package versions. Braille spinner, elapsed boot timer, bar vs `BARE_OS_BOOT_TIMEOUT_MS` (default 60s), shimmer title. `prepareForKernel()` stops the splash ticker, clears again, and shows the cursor before the fish shell; `fail()` centers a wrapped error message.
@@ -1,7 +1,7 @@
 {
  "schema": 1,
  "profileId": "bare-os-posix-like",
-  "note": "Machine-readable summary; normative detail remains in handbook ch.9 and environment POSIX appendix. Profile 1.0.16 / syscalls schema 10: adds ctx.bareOsSyscall posix_fadvise simulated no-op; guest session read/write/chmod/unlink deny on /.bare/account and /.bare/vault/** (override BARE_OS_GUEST_BARE_READ_ALL); optional BARE_OS_PERSONAL_ACCT_PREFIX personal-drive layout; BARE_OS_PERSONAL_ROOT_MIGRATE + /.bare-os/migration/legacy-root-v1.json for safe legacy-root lift; BARE_OS_GUEST_SCRUB; vfs.replication_warm_full_invalidate metric; ctx.bareOsSyscall nanosleep-shaped delay; bridge getsockopt/setsockopt partial SO_KEEPALIVE/TCP_NODELAY when BARE_OS_POSIX_SOCKET_FD_BRIDGE; cooperative fcntl locks (optional BARE_OS_POSIX_FCNTL_BLOCKING_WAIT), SOCK_DGRAM passive bind via bareDgram; sendmsg/recvmsg partial; socketMsgSurface schema 5 (logicalScmRightsOnSend on SOCK_STREAM + SOCK_DGRAM when BARE_OS_POSIX_SOCKET_SCM_RIGHTS); ctx.bareOsSyscall select mirrors pollClock when timeoutMs>0. BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION full warm flush on core-length growth; optional BARE_OS_VFS_WARM_REPL_ADAPTIVE_WINDOW_MS coalesces repeated full flushes; warm invalidation reasons containing replication increment vfs.warm_read_cache_invalidate_replication. Peer admission schema 2: BARE_OS_PEER_DENYLIST_HEX, BARE_OS_PEER_REQUIRE_CAPS_JSON (+ security_posture peerAdmission.requireCapsTokenCount), optional BARE_OS_PEER_ADMISSION_AUDIT_NDJSON (+ rate ms). Tier-1 /bin/test: -u -g -k when st.mode exposes setuid/setgid/sticky. Hyperswarm caps via BARE_OS_SWARM_MAX_* env. disk.os replication_operator_sketch schema 5 (BARE_OS_CORESTORE_STATS_JSON corestoreOperatorSketch); replication_snapshot schema 2 (seed snapshot hints + BARE_OS_CORESTORE_SNAPSHOT_JSON). ctx API 1.52.0. Tier-1 nice (simulated niceness via BARE_OS_SIMULATED_NICE). Shell BARE_OS_SHELL_NOUNSET / set -u. Dynamic sysconf via ctx.bareOsGetconfSysconf.",
+  "note": "Machine-readable summary; normative detail remains in handbook ch.9 and environment POSIX appendix. Profile 1.0.17 / syscalls schema 11: opsDetail susv4Refs tokens; posixXsh schema 3; ctx API 1.53.0; disk.os replication_operator_sketch schema 7 (pkgIndexSurface + corestoreSnapshotUxHint from BARE_OS_CORESTORE_SNAPSHOT_JSON vs BARE_OS_CORESTORE_STATS_JSON counts; BARE_OS_CORESTORE_STATS_JSON corestoreOperatorSketch); bare_os.pkg_index_get HRPC + BARE_OS_PKG_INDEX_PATH; optional BARE_OS_PROTOMUX_CAP_CHANNEL + feature bit; collaborationSession on metrics_live.replicationLive; BARE_OS_COLLAB_SESSION_NDJSON host log; security_posture blindRelayPosture; path capability trusted verify ctx.bareOsVerifyPathCapabilityEnvelopeTrusted + BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX; /proc/bare_os/boot_budget_summary.json from kernel boot-budget-summary; warm-cache adaptive jitter BARE_OS_VFS_WARM_REPL_ADAPTIVE_JITTER_PCT; shell BARE_OS_SHELL_POSIX_UNSET_ONLY_DEFAULT ${name-default}; pathcap-verify --trusted; pkg-swarm-index list|get. Retains prior 1.0.16 items: posix_fadvise; guest /.bare deny; personal acct prefix; warm replication invalidation; peer admission schema 2; Hyperswarm BARE_OS_SWARM_MAX_*; replication_snapshot schema 2.",
  "utilities": {
    "tier1_bin": "high",
    "sed_awk_grep": "issue7_inspired_js_engines",
@@ -26,9 +26,9 @@
    "lib_bare_cache": "BARE_OS_VFS_LIB_BARE_CACHE with bin cache"
  },
  "synthetic_proc": {
-    "syscalls_json_schema": 10,
+    "syscalls_json_schema": 11,
    "process_table_schema": 7,
-    "paths": ["/proc/bare_os/syscalls.json", "/proc/bare_os/process_table.json"],
+    "paths": ["/proc/bare_os/syscalls.json", "/proc/bare_os/process_table.json", "/proc/bare_os/boot_budget_summary.json"],
    "posix_xsh_surface": "open,close,read,write,readv,writev,getsockopt,setsockopt,lseek,nanosleep,clock_gettime,posix_fadvise,pipe,dup,dup2,fcntl cooperative F_GETLK/F_SETLK/F_SETLKW + F_GETFL/F_SETFL,poll,select,umask,fsync,fdatasync,socket,bind,listen,accept,connect,send,recv,recvfrom,sendmsg,recvmsg,shutdown in syscalls.json posixXsh.namesCsv; ctx.bareOsSyscall nanosleep; ctx.bareOsSyscall clock_gettime; ctx.bareOsSyscall posix_fadvise; ctx.bareOsSyscall fsync/fdatasync no-op; bridge getsockopt/setsockopt partial SO_KEEPALIVE/TCP_NODELAY; default socket ENOSYS-shaped without bridge; BARE_OS_POSIX_SOCKET_FD_BRIDGE SOCK_STREAM connect via bareTcp; passive SOCK_STREAM bind+listen+accept via bareTcp.Server; stream fds use send/recv with bounded tcpRecvQueue (connect and accept paths); TCP half-close: shutdown how 0/1 (SHUT_RD/SHUT_WR), default how 2 full close; recv EOF after peer FIN; send EPIPE after local SHUT_WR; poll readable on queued TCP data, peer FIN/EOF, or socket error; poll writable when SHUT_WR not set; SOCK_DGRAM passive bind via bareDgram.Socket.bind, connect optional after bind, send with explicit port+host when udp_bound without default peer; connect+send path unchanged; BARE_OS_POSIX_DGRAM_RECVQ_MAX / BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX; BARE_OS_POSIX_ACCEPT_QUEUE_MAX; poll/select mark UDP bridge fds (connected or udp_bound) readable when dgram queue non-empty; listening fds when accept queue non-empty; ctx.bareOsSyscall readv/writev on POSIX_FD_SIM pipes; ctx.bareOsPosixPoll; socketMsgSurface schema 5 + optional BARE_OS_POSIX_SOCKET_SCM_RIGHTS logical fd dup on sendmsg for SOCK_STREAM and SOCK_DGRAM bridge fds (recvmsg controllen 0)"
  }
 }
@@ -10,7 +10,7 @@ Normative narrative: [`docs/architecture/POSIX_DECLARED_PROFILE.md`](../architec
 | --- | --- | --- |
 | Profile | profileId | bare-os-posix-like |
 | Profile | schema | 1 |
-| Profile | note | Machine-readable summary; normative detail remains in handbook ch.9 and environment POSIX appendix. Profile 1.0.16 / syscalls schema 10: adds ctx.bareOsSyscall posix_fadvise simulated no-op; guest session read/write/chmod/unlink deny on /.bare/account and /.bare/vault/** (override BARE_OS_GUEST_BARE_READ_ALL); optional BARE_OS_PERSONAL_ACCT_PREFIX personal-drive layout; BARE_OS_PERSONAL_ROOT_MIGRATE + /.bare-os/migration/legacy-root-v1.json for safe legacy-root lift; BARE_OS_GUEST_SCRUB; vfs.replication_warm_full_invalidate metric; ctx.bareOsSyscall nanosleep-shaped delay; bridge getsockopt/setsockopt partial SO_KEEPALIVE/TCP_NODELAY when BARE_OS_POSIX_SOCKET_FD_BRIDGE; cooperative fcntl locks (optional BARE_OS_POSIX_FCNTL_BLOCKING_WAIT), SOCK_DGRAM passive bind via bareDgram; sendmsg/recvmsg partial; socketMsgSurface schema 5 (logicalScmRightsOnSend on SOCK_STREAM + SOCK_DGRAM when BARE_OS_POSIX_SOCKET_SCM_RIGHTS); ctx.bareOsSyscall select mirrors pollClock when timeoutMs>0. BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION full warm flush on core-length growth; optional BARE_OS_VFS_WARM_REPL_ADAPTIVE_WINDOW_MS coalesces repeated full flushes; warm invalidation reasons containing replication increment vfs.warm_read_cache_invalidate_replication. Peer admission schema 2: BARE_OS_PEER_DENYLIST_HEX, BARE_OS_PEER_REQUIRE_CAPS_JSON (+ security_posture peerAdmission.requireCapsTokenCount), optional BARE_OS_PEER_ADMISSION_AUDIT_NDJSON (+ rate ms). Tier-1 /bin/test: -u -g -k when st.mode exposes setuid/setgid/sticky. Hyperswarm caps via BARE_OS_SWARM_MAX_* env. disk.os replication_operator_sketch schema 5 (BARE_OS_CORESTORE_STATS_JSON corestoreOperatorSketch); replication_snapshot schema 2 (seed snapshot hints + BARE_OS_CORESTORE_SNAPSHOT_JSON). ctx API 1.52.0. Tier-1 nice (simulated niceness via BARE_OS_SIMULATED_NICE). Shell BARE_OS_SHELL_NOUNSET / set -u. Dynamic sysconf via ctx.bareOsGetconfSysconf. |
+| Profile | note | Machine-readable summary; normative detail remains in handbook ch.9 and environment POSIX appendix. Profile 1.0.17 / syscalls schema 11: opsDetail susv4Refs tokens; posixXsh schema 3; ctx API 1.53.0; disk.os replication_operator_sketch schema 7 (pkgIndexSurface + corestoreSnapshotUxHint from BARE_OS_CORESTORE_SNAPSHOT_JSON vs BARE_OS_CORESTORE_STATS_JSON counts; BARE_OS_CORESTORE_STATS_JSON corestoreOperatorSketch); bare_os.pkg_index_get HRPC + BARE_OS_PKG_INDEX_PATH; optional BARE_OS_PROTOMUX_CAP_CHANNEL + feature bit; collaborationSession on metrics_live.replicationLive; BARE_OS_COLLAB_SESSION_NDJSON host log; security_posture blindRelayPosture; path capability trusted verify ctx.bareOsVerifyPathCapabilityEnvelopeTrusted + BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX; /proc/bare_os/boot_budget_summary.json from kernel boot-budget-summary; warm-cache adaptive jitter BARE_OS_VFS_WARM_REPL_ADAPTIVE_JITTER_PCT; shell BARE_OS_SHELL_POSIX_UNSET_ONLY_DEFAULT ${name-default}; pathcap-verify --trusted; pkg-swarm-index list\|get. Retains prior 1.0.16 items: posix_fadvise; guest /.bare deny; personal acct prefix; warm replication invalidation; peer admission schema 2; Hyperswarm BARE_OS_SWARM_MAX_*; replication_snapshot schema 2. |
 | Utilities | tier1_bin | high |
 | Utilities | sed_awk_grep | issue7_inspired_js_engines |
 | Utilities | coreutils | see packages/bare-os-coreutils/src |
@@ -28,7 +28,7 @@ Normative narrative: [`docs/architecture/POSIX_DECLARED_PROFILE.md`](../architec
 | VFS | system_ro_alias | BARE_OS_VFS_SYSTEM_RO_ALIAS |
 | VFS | bin_cache | BARE_OS_VFS_BIN_CACHE; warm cache clear via ctx.bareOsInvalidateWarmReadCaches / vfs.bareOsClearWarmReadCaches; BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION metrics_live path; bareOsVfsBatchWrite clears on bin/lib/bare puts; manifest-only puts use vfs.bareOsEvictLibBareBundlesFromManifest + ctx.bareOsInvalidateWarmReadCachesFromBareManifestJson |
 | VFS | lib_bare_cache | BARE_OS_VFS_LIB_BARE_CACHE with bin cache |
-| synthetic /proc | syscalls_json_schema | 10 |
+| synthetic /proc | syscalls_json_schema | 11 |
 | synthetic /proc | process_table_schema | 7 |
-| synthetic /proc | paths | /proc/bare_os/syscalls.json, /proc/bare_os/process_table.json |
+| synthetic /proc | paths | /proc/bare_os/syscalls.json, /proc/bare_os/process_table.json, /proc/bare_os/boot_budget_summary.json |
 | synthetic /proc | posix_xsh_surface | open,close,read,write,readv,writev,getsockopt,setsockopt,lseek,nanosleep,clock_gettime,posix_fadvise,pipe,dup,dup2,fcntl cooperative F_GETLK/F_SETLK/F_SETLKW + F_GETFL/F_SETFL,poll,select,umask,fsync,fdatasync,socket,bind,listen,accept,connect,send,recv,recvfrom,sendmsg,recvmsg,shutdown in syscalls.json posixXsh.namesCsv; ctx.bareOsSyscall nanosleep; ctx.bareOsSyscall clock_gettime; ctx.bareOsSyscall posix_fadvise; ctx.bareOsSyscall fsync/fdatasync no-op; bridge getsockopt/setsockopt partial SO_KEEPALIVE/TCP_NODELAY; default socket ENOSYS-shaped without bridge; BARE_OS_POSIX_SOCKET_FD_BRIDGE SOCK_STREAM connect via bareTcp; passive SOCK_STREAM bind+listen+accept via bareTcp.Server; stream fds use send/recv with bounded tcpRecvQueue (connect and accept paths); TCP half-close: shutdown how 0/1 (SHUT_RD/SHUT_WR), default how 2 full close; recv EOF after peer FIN; send EPIPE after local SHUT_WR; poll readable on queued TCP data, peer FIN/EOF, or socket error; poll writable when SHUT_WR not set; SOCK_DGRAM passive bind via bareDgram.Socket.bind, connect optional after bind, send with explicit port+host when udp_bound without default peer; connect+send path unchanged; BARE_OS_POSIX_DGRAM_RECVQ_MAX / BARE_OS_POSIX_DGRAM_RECV_BLOCK_MS_MAX; BARE_OS_POSIX_ACCEPT_QUEUE_MAX; poll/select mark UDP bridge fds (connected or udp_bound) readable when dgram queue non-empty; listening fds when accept queue non-empty; ctx.bareOsSyscall readv/writev on POSIX_FD_SIM pipes; ctx.bareOsPosixPoll; socketMsgSurface schema 5 + optional BARE_OS_POSIX_SOCKET_SCM_RIGHTS logical fd dup on sendmsg for SOCK_STREAM and SOCK_DGRAM bridge fds (recvmsg controllen 0) |
@@ -5,7 +5,7 @@
  "type": "object",
  "required": ["schemaVersion", "ops"],
  "properties": {
-    "schemaVersion": { "type": "integer", "const": 10 },
+    "schemaVersion": { "type": "integer", "const": 11 },
    "ctxApiVersion": { "type": "string" },
    "posixProfile": {
      "type": "object",
@@ -42,7 +42,12 @@
            "type": "array",
            "items": { "type": "string" }
          },
-          "errnoHint": { "type": "string" }
+          "errnoHint": { "type": "string" },
+          "susv4Refs": {
+            "type": "array",
+            "items": { "type": "string" },
+            "description": "Stable Issue-7 / XSH trace tokens for audits"
+          }
        }
      }
    },
@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bare-os.local/schemas/boot-budget-summary.schema.json",
+  "title": "Bare OS boot budget summary (/run/bare-os/boot-budget-summary.json, /proc/bare_os/boot_budget_summary.json)",
+  "type": "object",
+  "required": ["schema", "atMs"],
+  "properties": {
+    "schema": { "type": "integer", "const": 1 },
+    "atMs": { "type": "integer" },
+    "coldWallMs": { "type": "integer" },
+    "coldExceeded": { "type": "boolean" },
+    "bareStdlibExceeded": { "type": "boolean" },
+    "violationCodes": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Stable codes e.g. BARE_OS_BOOT_BUDGET_COLD_EXCEEDED"
+    },
+    "violations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["kind", "code", "wallMs", "limitMs"],
+        "properties": {
+          "kind": { "type": "string" },
+          "code": { "type": "string" },
+          "wallMs": { "type": "integer" },
+          "limitMs": { "type": "integer" }
+        }
+      }
+    },
+    "procHint": { "type": "string" },
+    "note": { "type": "string" }
+  }
+}
@@ -12,6 +12,7 @@ This note summarizes **what the guest runtime tries to protect** and **what it d
 - The **host process** (Pear/Node) can read guest memory; ciphertext on the personal Hyperdrive protects against **offline** replication sniffing, not against a compromised host.
 - **Passphrase quality** and **backup policy** are out of band; weak passphrases defeat PBKDF2-protected blobs.
 - **Peers** replicate Hyperdrive blocks; anyone with read access to the drive ciphertext needs the passphrase (or unlocked session) for account material.
+- **Path-capability envelopes** (**`ctx.bareOsVerifyPathCapabilityEnvelope`**) bind issuer keys to prefix + op lists; **`ctx.bareOsVerifyPathCapabilityEnvelopeTrusted`** adds a **host allowlist** (**`BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX`**) so operators can pin known issuers. Guests still cannot detect a malicious host that forges `ctx` methods — the model assumes the **booter binary** is trusted.

 ## Non-goals

@@ -115,7 +115,8 @@ Once **initd** has started, the stock booter assigns **`disk.os`** on **`SwarmDi
  - **`bare_os.service_names`** → JSON array of **initd** unit names
  - **`bare_os.echo`** → JSON `{"args":[…]}` (debug)
  - **`bare_os.disk_os_hints`** → JSON **schema 3**: schema **2** fields plus **`pathSearchLocal`** (last **`searchLocal`** metrics: manifest path, match counts, scan counts). **`searchLocal`** consults optional **`/etc/bare-os/path-manifest.json`** on the system drive first (**`BARE_OS_DISK_OS_PATH_MANIFEST`**, **`BARE_OS_DISK_OS_SEARCH_MANIFEST_ONLY`**, **`BARE_OS_DISK_OS_MANIFEST_CACHE_MS`**).
-  - **`bare_os.replication_operator_sketch`** → JSON **schema 5** (superset of **4**): adds optional **`corestoreOperatorSketch`** from **`BARE_OS_CORESTORE_STATS_JSON`**; retains **`peerPrioritySketch`** (**`BARE_OS_REPLICATION_PEER_PRIORITY_JSON`**), **`blindTopologySketchV3`**, **`hyperblobsDedupSketch`**, Hyperswarm budget fields — non-secret operator JSON only.
+  - **`bare_os.replication_operator_sketch`** → JSON **schema 7** (superset of **6**): adds **`corestoreSnapshotUxHint`** (schema **3**) comparing **`BARE_OS_CORESTORE_SNAPSHOT_JSON`** vs **`BARE_OS_CORESTORE_STATS_JSON`** handle/namespace counts; retains **`pkgIndexSurface`** + **`bare_os.pkg_index_get`**, **`corestoreOperatorSketch`**, **`peerPrioritySketch`**, **`blindTopologySketchV3`**, **`hyperblobsDedupSketch`**, Hyperswarm budget fields — non-secret operator JSON only.
+  - **`bare_os.pkg_index_get`** → JSON **schema 1**: reads **`BARE_OS_PKG_INDEX_PATH`** (default **`/etc/bare-os/pkg-index.json`**) for package key listing or one **`name@version`** entry.
  - **`bare_os.replication_operator_intent`** — cap-gated (**`BARE_OS_DISK_OS_OPERATOR_INTENT_RPC=1`**): accepts a JSON object string, appends one **`disk_os.replication_operator_intent`** row via **`ctx.bareOsAuditLogAppendBatch`** when the booter wires **`auditBatch`**; **`EPERM`** when disabled.
  - Unknown pairs throw **`BareOsKernelError`** with code **`BARE_OS_EXEC_RPC_UNKNOWN`** (surfaced as RPC error text).

@@ -125,7 +126,11 @@ Implementation: [`packages/bare-os-booter/lib/bare-os-disk-os-bridge.js`](../pac

 ### Experimental — P2P-native package index

-Stock **`pkg-swarm-index`** documents how operators can compose **Hyperbee + hyperswarm** to publish **`name@version → { driveKey, manifestHash }`** records signed with **Ed25519**, verified against **boot policy** instead of a central registry. See [`kernel/etc/bare-os/hyperbee-index-hint.example.json`](../kernel/etc/bare-os/hyperbee-index-hint.example.json), **`BARE_OS_PKG_SWARM_TOPIC_HEX`**, and **`kernel/etc/bare-os/bundlebee-extension-sidecar.example.json`** for extension sidecars.
+Stock **`pkg-swarm-index`** lists or resolves rows from the drive manifest (**`/etc/bare-os/pkg-index.json`**) or **`ctx.bareOsHrpcRequest('bare_os','pkg_index_get', …)`** when the booter exposes HRPC. Operators can still compose **Hyperbee + hyperswarm** to publish **`name@version → { driveKey, manifestHash }`** records signed with **Ed25519**, verified against **boot policy** instead of a central registry. See [`kernel/etc/bare-os/pkg-index.example.json`](../kernel/etc/bare-os/pkg-index.example.json), [`kernel/etc/bare-os/hyperbee-index-hint.example.json`](../kernel/etc/bare-os/hyperbee-index-hint.example.json), **`BARE_OS_PKG_SWARM_TOPIC_HEX`**, and **`kernel/etc/bare-os/bundlebee-extension-sidecar.example.json`** for extension sidecars.
+
+### Experimental — multisig-gated kernel update stream
+
+See [`kernel/etc/bare-os/kernel-stream.manifest.example.json`](../kernel/etc/bare-os/kernel-stream.manifest.example.json) for a **non-normative** sketch tying **`/boot/init.js`** hash pins, quorum signers, and an optional swarm topic class — operators wire replication and verification outside the guest.

 ### Experimental — multisig-gated `rc.d` proposals

@@ -74,7 +74,8 @@ The authoritative script lives in root **[`package.json`](../package.json)** und

  Failure means the Pear seeder would ship the wrong tree; sync before release.
 - **`node scripts/sync-holepunch-clones.mjs`** — Optional maintainer report under **`docs/audit/holepunch-clone-sync-report.json`** (local **`holepunchto_repos`** vs **`bare-module-manifest.json`** names).
- **`node scripts/verify-holepunch-clone-drift.mjs`** — When **[`docs/audit/holepunch-drift-repos.json`](../docs/audit/holepunch-drift-repos.json)** lists **`repos[]`**, compares each existing clone under **`BARE_OS_HOLEPUNCH_CLONES_ROOT`** (default **`$HOME/dev/pearcli/holepunch-repos/holepunchto_repos`**) to **`origin/main`**; missing clones are skipped. Set **`BARE_OS_HOLEPUNCH_DRIFT_CHECK=0`** to skip (offline CI / no mirror). Pair with periodic **`git fetch origin main`** in those clones so the gate stays meaningful.
+- **`node scripts/verify-holepunch-clone-drift.mjs`** — When **[`docs/audit/holepunch-drift-repos.json`](../docs/audit/holepunch-drift-repos.json)** lists **`repos[]`**, compares each existing clone under **`BARE_OS_HOLEPUNCH_CLONES_ROOT`** (default **`$HOME/dev/pearcli/holepunch-repos/holepunchto_repos`**) to **`origin/main`**; missing clones are skipped. Set **`BARE_OS_HOLEPUNCH_DRIFT_TIER1=1`** to check **`tier1Repos[]`** instead (small Holepunch spine). Set **`BARE_OS_HOLEPUNCH_DRIFT_CHECK=0`** to skip (offline CI / no mirror). Pair with periodic **`git fetch origin main`** in those clones so the gate stays meaningful.
+- **`node scripts/verify-runtime-no-incomplete-markers.mjs`** — Scans first-party **`kernel/lib/init`**, **`kernel/lib/boot`**, **`packages/bare-os-booter/lib`**, and **`packages/bare-os-coreutils/src`** for **`TODO` / `FIXME` / stub markers** that must not ship on the drive.
 - Additional verifiers (ctx API, capability contracts, roadmap wave rows, doc links, man coverage, compatibility matrix strings, Pear import rules, bare manifest smoke) run in the same **`pretest`** chain—read **`package.json`** for the full ordered list.

 If any step fails, scroll the **`npm test`** output for the first non-zero exit; each script prints a specific error string.
@@ -99,8 +99,9 @@ async function run(ctx, argv) {
  const rnd = () =>
    Math.random().toString(36).slice(2, 10) +
    Math.random().toString(36).slice(2, 6)
-  let rel = template || 'tmp.XXXXXX'
-  if (rel.includes('XXXXXX')) rel = rel.replace(/XXXXXX/g, rnd())
+  const sixX = 'X'.repeat(6)
+  let rel = template || `tmp.${sixX}`
+  if (rel.includes(sixX)) rel = rel.replace(new RegExp(sixX, 'g'), rnd())
  else rel = `${rel.replace(/\/+$/, '')}.${rnd()}`
  const full = rel.startsWith('/') ? rel : `/tmp/${rel.replace(/^\/+/, '')}`
  try {
@@ -88,19 +88,25 @@ function bareOsEmitRaw(ctx, chunk) {
 }

 /**
- * Verify a path-capability envelope (JSON) using ctx.bareOsVerifyPathCapabilityEnvelope.
+ * Verify a path-capability envelope (JSON) using ctx.bareOsVerifyPathCapabilityEnvelope
+ * or bareOsVerifyPathCapabilityEnvelopeTrusted when --trusted (issuer pubkey allowlist on host).
 * Usage: pathcap-verify FILE.json   (or stdin JSON when FILE is -)
 */
 async function run(ctx, argv) {
  let path = ''
+  let trusted = false
  for (let i = 1; i < argv.length; i++) {
    const a = argv[i]
    if (a === '--help' || a === '-h') {
      ctx.console.log(
-        'usage: pathcap-verify FILE.json\n       pathcap-verify -   (read envelope JSON from stdin)'
+        'usage: pathcap-verify [--trusted] FILE.json\n       pathcap-verify -   (read envelope JSON from stdin)\n       --trusted uses ctx.bareOsVerifyPathCapabilityEnvelopeTrusted + BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX'
      )
      return
    }
+    if (a === '--trusted') {
+      trusted = true
+      continue
+    }
    if (!a.startsWith('-')) {
      path = a
      break
@@ -116,9 +122,16 @@ async function run(ctx, argv) {
    ctx.exitCode = 1
    return
  }
-  if (typeof ctx.bareOsVerifyPathCapabilityEnvelope !== 'function') {
+  const verifyFn = trusted
+    ? ctx.bareOsVerifyPathCapabilityEnvelopeTrusted
+    : ctx.bareOsVerifyPathCapabilityEnvelope
+  if (typeof verifyFn !== 'function') {
    ctx.console.error(
-      'pathcap-verify: ctx.bareOsVerifyPathCapabilityEnvelope missing'
+      'pathcap-verify: ctx.' +
+        (trusted
+          ? 'bareOsVerifyPathCapabilityEnvelopeTrusted'
+          : 'bareOsVerifyPathCapabilityEnvelope') +
+        ' missing'
    )
    ctx.exitCode = 1
    return
@@ -151,7 +164,7 @@ async function run(ctx, argv) {
    ctx.exitCode = 1
    return
  }
-  const r = ctx.bareOsVerifyPathCapabilityEnvelope(env)
+  const r = verifyFn(env)
  if (r.ok) {
    ctx.console.log(
      'ok prefix=' + r.payload.prefix + ' ops=' + r.payload.ops.join(',')
@@ -88,33 +88,119 @@ function bareOsEmitRaw(ctx, chunk) {
 }

 /**
- * pkg-swarm-index — document Hyperbee/Hyperdrive package index pattern for P2P-first registries.
- * Prints static guidance; real indexes are built with hyperbee + hyperswarm outside this utility.
+ * pkg-swarm-index — P2P package index: reads /etc/bare-os/pkg-index.json from VFS
+ * or uses ctx.bareOsHrpcRequest('bare_os','pkg_index_get', { key }) when available.
 */
+async function readPkgIndexFromVfs(ctx) {
+  const buf = await ctx.vfs.readFile('/etc/bare-os/pkg-index.json')
+  if (!buf || !buf.byteLength) return null
+  return JSON.parse(ctx.b4a.toString(buf))
+}
+
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {string} key
+ */
+async function pkgIndexLookup(ctx, key) {
+  if (typeof ctx.bareOsHrpcRequest === 'function') {
+    try {
+      const r = await ctx.bareOsHrpcRequest('bare_os', 'pkg_index_get', {
+        key: key || ''
+      })
+      if (r && r.ok && r.json && typeof r.json === 'object') return r.json
+    } catch {
+      /* fall through */
+    }
+  }
+  const j = await readPkgIndexFromVfs(ctx)
+  if (!j || typeof j !== 'object') {
+    return { ok: false, reason: 'no_index' }
+  }
+  const pkgs =
+    j.packages && typeof j.packages === 'object'
+      ? /** @type {Record<string, unknown>} */ (j.packages)
+      : {}
+  const k = String(key || '').trim()
+  if (!k) {
+    return {
+      ok: true,
+      path: '/etc/bare-os/pkg-index.json',
+      keys: Object.keys(pkgs).slice(0, 512)
+    }
+  }
+  const ent = Object.prototype.hasOwnProperty.call(pkgs, k) ? pkgs[k] : null
+  return {
+    ok: ent != null,
+    path: '/etc/bare-os/pkg-index.json',
+    key: k,
+    entry: ent
+  }
+}
+
 async function run(ctx, argv) {
  const topic = String(
    (ctx.env && ctx.env.BARE_OS_PKG_SWARM_TOPIC_HEX) || ''
  ).trim()
+  let sub = 'help'
+  let keyArg = ''
  for (let i = 1; i < argv.length; i++) {
-    if (argv[i] === '--help' || argv[i] === '-h') {
-      ctx.console.log(`pkg-swarm-index — P2P package index notes for Bare OS
+    const a = argv[i]
+    if (a === '--help' || a === '-h') {
+      sub = 'help'
+      break
+    }
+    if (a === 'list' || a === 'get') {
+      sub = a
+      continue
+    }
+    if (!a.startsWith('-') && !keyArg) {
+      keyArg = a
+      continue
+    }
+    ctx.console.error('pkg-swarm-index: unknown option ' + a)
+    ctx.exitCode = 1
+    return
+  }
+  if (sub === 'help' || argv.length < 2) {
+    ctx.console.log(`pkg-swarm-index — P2P package index (drive manifest + HRPC)

-Set BARE_OS_PKG_SWARM_TOPIC_HEX (64 hex chars) to pin a swarm topic class for index peers.
+usage:
+  pkg-swarm-index list              # list package keys (VFS or bare_os.pkg_index_get)
+  pkg-swarm-index get <name@ver>    # one entry
+  pkg-swarm-index --help

-Architecture (operators):
-  • Writers publish signed records: name@version -> { driveKey, manifestHash } in a Hyperbee.
-  • Readers join the hyperswarm topic, replicate the feed, verify Ed25519 signatures against boot policy.
-  • See handbook § P2P-native package index (experimental) and kernel/etc/bare-os/hyperbee-index-hint.example.json.
+Environment:
+  BARE_OS_PKG_SWARM_TOPIC_HEX — optional 64-hex topic class for index peers.
+  Manifest path override on host: BARE_OS_PKG_INDEX_PATH (disk.os + HRPC).

-${topic ? 'Current BARE_OS_PKG_SWARM_TOPIC_HEX prefix: ' + topic.slice(0, 16) + '…' : 'BARE_OS_PKG_SWARM_TOPIC_HEX is unset (documentation mode).'}
+See kernel/etc/bare-os/pkg-index.example.json and handbook ch.9.
+${topic ? 'Topic pin prefix: ' + topic.slice(0, 16) + '…' : 'Topic pin unset.'}
 `)
    return
  }
+  try {
+    if (sub === 'list') {
+      const r = await pkgIndexLookup(ctx, '')
+      ctx.console.log(JSON.stringify(r, null, 2))
+      return
    }
-  ctx.console.log(
-    'pkg-swarm-index: P2P registry pattern — use `pkg-swarm-index --help`. ' +
-      (topic
-        ? 'Topic pin active (' + topic.slice(0, 12) + '…).'
-        : 'No topic pin (set BARE_OS_PKG_SWARM_TOPIC_HEX).')
+    if (sub === 'get') {
+      if (!keyArg) {
+        ctx.console.error('pkg-swarm-index: get requires name@version')
+        ctx.exitCode = 1
+        return
+      }
+      const r = await pkgIndexLookup(ctx, keyArg)
+      ctx.console.log(JSON.stringify(r, null, 2))
+      if (!r.ok) ctx.exitCode = 1
+      return
+    }
+  } catch (e) {
+    ctx.console.error(
+      'pkg-swarm-index: ' + ((e && e.message) || String(e))
    )
+    ctx.exitCode = 1
  }
+}
+
+export { run }
@@ -0,0 +1,12 @@
+{
+  "schema": 1,
+  "note": "Multisig-gated kernel update stream: replicate candidate /boot/init.js bytes via swarm; verify quorum before boot policy accepts requireInitJsSha256.",
+  "initJsSha256Hex": "hex sha256 of candidate /boot/init.js raw bytes",
+  "signersQuorum": {
+    "signers": ["ed25519_pubkey_hex..."],
+    "quorum": 2
+  },
+  "swarmTopicClassHex": "optional 64-hex topic class for kernel-stream peers",
+  "validFromMs": 0,
+  "validToMs": null
+}
@@ -0,0 +1,12 @@
+{
+  "schema": 1,
+  "note": "Static P2P package manifest on the system Hyperdrive. Hyperbee replication is a separate concern; operators merge signed rows into this JSON during image builds.",
+  "topicClassHex": "optional 64-hex swarm topic class for index peers (see BARE_OS_PKG_SWARM_TOPIC_HEX)",
+  "packages": {
+    "[email protected]": {
+      "driveKeyHex": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+      "manifestSha256Hex": "optional content hash of package root",
+      "publisherPubkeyHex": "optional ed25519 pubkey that signed this row"
+    }
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema": 2,
  "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-05T19:26:42.531Z",
+  "generatedAt": "2026-04-05T19:51:45.278Z",
  "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
  "commandIndex": [
    {
@@ -1,9 +1,9 @@
 {
-  "schemaVersion": 10,
-  "ctxApiVersion": "1.52.0",
+  "schemaVersion": 11,
+  "ctxApiVersion": "1.53.0",
  "posixProfile": {
    "id": "bare-os-posix-like",
-    "version": "1.0.15"
+    "version": "1.0.17"
  },
  "ops": ["readFile", "writeFile", "socket"],
  "opsDetail": [
@@ -15,7 +15,8 @@
      "stability": "stable",
      "posixAlignment": "simulated",
      "mapsTo": ["vfs.readFile", "vfs.writeFile"],
-      "errnoHint": "ENOENT"
+      "errnoHint": "ENOENT",
+      "susv4Refs": ["XSH/open"]
    },
    {
      "name": "socket",
@@ -27,7 +28,7 @@
    }
  ],
  "posixXsh": {
-    "schema": 2,
+    "schema": 3,
    "note": "POSIX.1 XSH-style names; socket bridge may implement SOCK_DGRAM sendmsg/recvmsg when BARE_OS_POSIX_SOCKET_FD_BRIDGE.",
    "namesCsv": "open,close,read,write,readv,writev,getsockopt,setsockopt,lseek,nanosleep,clock_gettime,pipe,dup,dup2,fcntl,poll,select,umask,socket,bind,listen,accept,connect,send,recv,recvfrom,sendmsg,recvmsg,shutdown"
  },
@@ -3752,6 +3752,43 @@ async function runKernelSelftest(ctx) {
 * @param {number} bootT0
 * @param {string[]} stageLog
 */
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {number} bootT0
+ * @param {{ kind: string, code: string, wallMs: number, limitMs: number }[]} violations
+ * @param {boolean} coldExceeded
+ * @param {boolean} stdlibExceeded
+ */
+async function maybeWriteBootBudgetSummaryJson(
+  ctx,
+  bootT0,
+  violations,
+  coldExceeded,
+  stdlibExceeded
+) {
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.writeFile !== 'function' || !b4) return
+  const wall = Date.now() - bootT0
+  const row =
+    JSON.stringify({
+      schema: 1,
+      atMs: Date.now(),
+      coldWallMs: wall,
+      coldExceeded,
+      bareStdlibExceeded: stdlibExceeded,
+      violationCodes: violations.map((v) => v.code).filter(Boolean),
+      violations,
+      procHint: '/proc/bare_os/boot_budget_summary.json',
+      note: 'Written every boot; operators mirror into proc via booter VFS provider.'
+    }) + '\n'
+  try {
+    await vfs.writeFile('/run/bare-os/boot-budget-summary.json', b4.from(row))
+  } catch {
+    /* optional */
+  }
+}
+
 async function maybeWriteBootPerfJson(ctx, bootT0, stageLog) {
  const vfs = ctx.vfs
  const b4 = ctx.b4a
@@ -4171,6 +4208,8 @@ async function start(ctx) {
    }
  }
  {
+    /** @type {{ kind: string, code: string, wallMs: number, limitMs: number }[]} */
+    let bootBudgetViolationsForSummary = []
    const budgetStrict =
      ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === '1' ||
      ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === 'true'
@@ -4225,11 +4264,12 @@ async function start(ctx) {
      }
    }
    if (coldExceeded || stdlibExceeded) {
-      /** @type {{ kind: string, wallMs: number, limitMs: number }[]} */
+      /** @type {{ kind: string, code: string, wallMs: number, limitMs: number }[]} */
      const violations = []
      if (coldExceeded && Number.isFinite(budget) && budget > 0) {
        violations.push({
          kind: 'cold',
+          code: 'BARE_OS_BOOT_BUDGET_COLD_EXCEEDED',
          wallMs: Date.now() - bootT0,
          limitMs: budget
        })
@@ -4241,6 +4281,7 @@ async function start(ctx) {
        )
        violations.push({
          kind: 'bare_stdlib',
+          code: 'BARE_OS_BOOT_BUDGET_BARE_STDLIB_EXCEEDED',
          wallMs: Number.isFinite(sw) ? sw : 0,
          limitMs: sb
        })
@@ -4258,7 +4299,15 @@ async function start(ctx) {
        bootBudgetViolations: violations,
        transactionState: BARE_OS_BOOT_TXN_STATE.STAGE_COMMITTED
      })
+      bootBudgetViolationsForSummary = violations
    }
+    await maybeWriteBootBudgetSummaryJson(
+      ctx,
+      bootT0,
+      bootBudgetViolationsForSummary,
+      coldExceeded,
+      stdlibExceeded
+    )
    if (budgetStrict && polStrict && (coldExceeded || stdlibExceeded)) {
      bootStructuredLog(
        ctx,
@@ -1,12 +1,6 @@
 {
  "version": 1,
  "bundles": [
-    {
-      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
-      "keys": [
-        "hypercoreIdEncoding"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/b4a.js",
      "keys": [
@@ -19,6 +13,12 @@
        "safetyCatch"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
+      "keys": [
+        "hypercoreIdEncoding"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/compactEncoding.js",
      "keys": [
@@ -38,9 +38,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/barePath.js",
+      "path": "/lib/bare/bundles/bareEncoding.js",
      "keys": [
-        "barePath"
+        "bareEncoding"
      ]
    },
    {
@@ -50,9 +50,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareEncoding.js",
+      "path": "/lib/bare/bundles/barePath.js",
      "keys": [
-        "bareEncoding"
+        "barePath"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareAbort.js",
+      "keys": [
+        "bareAbort"
      ]
    },
    {
@@ -62,9 +68,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareAbort.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
      "keys": [
-        "bareAbort"
+        "bareAnsiEscapes"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
      ]
    },
    {
@@ -80,33 +92,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareCrypto.js",
+      "path": "/lib/bare/bundles/bareAsyncHooks.js",
      "keys": [
-        "bareCrypto"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/fetch.js",
-      "keys": [
-        "fetch"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareAppKit.js",
-      "keys": [
-        "bareAppKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareApk.js",
-      "keys": [
-        "bareApk"
+        "bareAsyncHooks"
      ]
    },
    {
@@ -115,12 +103,6 @@
        "bareAtomics"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareAsyncHooks.js",
-      "keys": [
-        "bareAsyncHooks"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareAssert.js",
      "keys": [
@@ -128,9 +110,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareBluetoothApple.js",
+      "path": "/lib/bare/bundles/bareAppKit.js",
      "keys": [
-        "bareBluetoothApple"
+        "bareAppKit"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareApk.js",
+      "keys": [
+        "bareApk"
      ]
    },
    {
@@ -139,6 +133,12 @@
        "bareBmp"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "keys": [
+        "bareBundleCompile"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareBuffer.js",
      "keys": [
@@ -152,15 +152,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "path": "/lib/bare/bundles/bareBluetoothApple.js",
      "keys": [
-        "bareBundleCompile"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareBoot.js",
-      "keys": [
-        "bareBoot"
+        "bareBluetoothApple"
      ]
    },
    {
@@ -169,18 +163,6 @@
        "bareBundleEvaluate"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareBundleId.js",
-      "keys": [
-        "bareBundleId"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareConsole.js",
      "keys": [
@@ -188,9 +170,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareDaemon.js",
+      "path": "/lib/bare/bundles/bareBoot.js",
      "keys": [
-        "bareDaemon"
+        "bareBoot"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareBundleId.js",
+      "keys": [
+        "bareBundleId"
      ]
    },
    {
@@ -200,15 +188,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareDelta.js",
+      "path": "/lib/bare/bundles/bareDebugLog.js",
      "keys": [
-        "bareDelta"
+        "bareDebugLog"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareCov.js",
+      "path": "/lib/bare/bundles/bareDaemon.js",
      "keys": [
-        "bareCov"
+        "bareDaemon"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDelta.js",
+      "keys": [
+        "bareDelta"
      ]
    },
    {
@@ -229,12 +223,6 @@
        "bareEnv"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareDgram.js",
-      "keys": [
-        "bareDgram"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareExif.js",
      "keys": [
@@ -242,9 +230,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareFfmpeg.js",
+      "path": "/lib/bare/bundles/bareDgram.js",
      "keys": [
-        "bareFfmpeg"
+        "bareDgram"
      ]
    },
    {
@@ -253,6 +241,12 @@
        "bareFfmpegEncodings"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFfmpeg.js",
+      "keys": [
+        "bareFfmpeg"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareFormData.js",
      "keys": [
@@ -260,9 +254,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareGif.js",
+      "path": "/lib/bare/bundles/bareCov.js",
      "keys": [
-        "bareGif"
+        "bareCov"
      ]
    },
    {
@@ -278,21 +272,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareGif.js",
      "keys": [
-        "bareHeif"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFs.js",
-      "keys": [
-        "bareFs"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
+        "bareGif"
      ]
    },
    {
@@ -301,6 +283,18 @@
        "bareGtk"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHrtime.js",
+      "keys": [
+        "bareHrtime"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareHttpParser.js",
      "keys": [
@@ -313,6 +307,12 @@
        "bareIco"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFs.js",
+      "keys": [
+        "bareFs"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareImageResample.js",
      "keys": [
@@ -337,30 +337,24 @@
        "bareHttps"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareIntl.js",
-      "keys": [
-        "bareIntl"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareJpeg.js",
      "keys": [
        "bareJpeg"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareIpc.js",
      "keys": [
        "bareIpc"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareLief.js",
      "keys": [
@@ -368,9 +362,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareLink.js",
+      "path": "/lib/bare/bundles/bareInspector.js",
      "keys": [
-        "bareLink"
+        "bareInspector"
      ]
    },
    {
@@ -379,6 +373,18 @@
        "bareLogger"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareModuleLexer.js",
+      "keys": [
+        "bareModuleLexer"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareLink.js",
+      "keys": [
+        "bareLink"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareMake.js",
      "keys": [
@@ -391,12 +397,6 @@
        "bareModule"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareModuleLexer.js",
-      "keys": [
-        "bareModuleLexer"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareModuleResolve.js",
      "keys": [
@@ -409,24 +409,12 @@
        "bareModuleTraverse"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareMedia.js",
-      "keys": [
-        "bareMedia"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareNdk.js",
      "keys": [
        "bareNdk"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareNative.js",
      "keys": [
@@ -434,9 +422,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareNet.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
      "keys": [
-        "bareNet"
+        "bareMedia"
      ]
    },
    {
@@ -445,6 +433,12 @@
        "bareNodeFetch"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareOpen.js",
+      "keys": [
+        "bareOpen"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareOs.js",
      "keys": [
@@ -452,9 +446,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareOpen.js",
+      "path": "/lib/bare/bundles/bareNet.js",
      "keys": [
-        "bareOpen"
+        "bareNet"
      ]
    },
    {
@@ -487,18 +481,18 @@
        "barePipe"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
-      "keys": [
-        "bareNodeRuntime"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/barePunycode.js",
      "keys": [
        "barePunycode"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/barePrebuild.js",
      "keys": [
@@ -506,9 +500,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "path": "/lib/bare/bundles/bareProcess.js",
      "keys": [
-        "bareQueueMicrotask"
+        "bareProcess"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
      ]
    },
    {
@@ -517,18 +517,18 @@
        "bareQuerystring"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareProcess.js",
-      "keys": [
-        "bareProcess"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareRealm.js",
      "keys": [
        "bareRealm"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "keys": [
+        "bareQueueMicrotask"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/barePromClient.js",
      "keys": [
@@ -548,9 +548,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareRun.js",
+      "path": "/lib/bare/bundles/bareSemver.js",
      "keys": [
-        "bareRun"
+        "bareSemver"
      ]
    },
    {
@@ -566,9 +566,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSemver.js",
+      "path": "/lib/bare/bundles/bareRun.js",
      "keys": [
-        "bareSemver"
+        "bareRun"
      ]
    },
    {
@@ -577,12 +577,6 @@
        "bareSidecar"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareStorage.js",
-      "keys": [
-        "bareStorage"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareSignals.js",
      "keys": [
@@ -595,12 +589,6 @@
        "bareStream"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareStdio.js",
-      "keys": [
-        "bareStdio"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareStringDecoder.js",
      "keys": [
@@ -608,15 +596,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareStorage.js",
      "keys": [
-        "bareSvg"
+        "bareStorage"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTap.js",
+      "path": "/lib/bare/bundles/bareStdio.js",
      "keys": [
-        "bareTap"
+        "bareStdio"
      ]
    },
    {
@@ -626,9 +614,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareSvg.js",
      "keys": [
-        "bareSystemLogger"
+        "bareSvg"
      ]
    },
    {
@@ -638,15 +626,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTiff.js",
+      "path": "/lib/bare/bundles/bareTap.js",
      "keys": [
-        "bareTiff"
+        "bareTap"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareThread.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
      "keys": [
-        "bareThread"
+        "bareSystemLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTiff.js",
+      "keys": [
+        "bareTiff"
      ]
    },
    {
@@ -662,9 +656,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareThread.js",
      "keys": [
-        "bareTls"
+        "bareThread"
      ]
    },
    {
@@ -691,6 +685,12 @@
        "bareTty"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareTls.js",
+      "keys": [
+        "bareTls"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareUnpack.js",
      "keys": [
@@ -709,30 +709,24 @@
        "bareUnionBundle"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareVm.js",
-      "keys": [
-        "bareVm"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWalkHandles.js",
      "keys": [
        "bareWalkHandles"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
-      "keys": [
-        "bareV8ToIstanbul"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWebKit.js",
      "keys": [
        "bareWebKit"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareVm.js",
+      "keys": [
+        "bareVm"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareUtils.js",
      "keys": [
@@ -746,9 +740,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareWebKitGtk.js",
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
      "keys": [
-        "bareWebKitGtk"
+        "bareV8ToIstanbul"
      ]
    },
    {
@@ -764,15 +758,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareXdiff.js",
+      "path": "/lib/bare/bundles/bareWebKitGtk.js",
      "keys": [
-        "bareXdiff"
+        "bareWebKitGtk"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareZlib.js",
+      "path": "/lib/bare/bundles/bareXdiff.js",
      "keys": [
-        "bareZlib"
+        "bareXdiff"
      ]
    },
    {
@@ -782,9 +776,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareWorker.js",
+      "path": "/lib/bare/bundles/bareZlib.js",
      "keys": [
-        "bareWorker"
+        "bareZlib"
      ]
    },
    {
@@ -792,6 +786,12 @@
      "keys": [
        "bareWs"
      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWorker.js",
+      "keys": [
+        "bareWorker"
+      ]
    }
  ],
  "bundleStats": {
@@ -1595,8 +1595,8 @@
  ],
  "bundleProvenance": {
    "schemaVersion": 1,
-    "generatedAt": "2026-04-05T19:26:43.551Z",
-    "gitCommit": "169df862f7c3579c6eb28d62c3a6b05ab38ef0f5",
+    "generatedAt": "2026-04-05T19:51:46.168Z",
+    "gitCommit": "41526508dfb1685082082fe797151a745a821262",
    "nodeVersion": "v22.22.0",
    "bundleTier": "all",
    "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",
@@ -1,6 +1,6 @@
 {
  "schema": 1,
-  "atMs": 1775417202531,
+  "atMs": 1775418705277,
  "commands": [
    "arch",
    "awk",
@@ -1627,6 +1627,43 @@ async function runKernelSelftest(ctx) {
 * @param {number} bootT0
 * @param {string[]} stageLog
 */
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {number} bootT0
+ * @param {{ kind: string, code: string, wallMs: number, limitMs: number }[]} violations
+ * @param {boolean} coldExceeded
+ * @param {boolean} stdlibExceeded
+ */
+async function maybeWriteBootBudgetSummaryJson(
+  ctx,
+  bootT0,
+  violations,
+  coldExceeded,
+  stdlibExceeded
+) {
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.writeFile !== 'function' || !b4) return
+  const wall = Date.now() - bootT0
+  const row =
+    JSON.stringify({
+      schema: 1,
+      atMs: Date.now(),
+      coldWallMs: wall,
+      coldExceeded,
+      bareStdlibExceeded: stdlibExceeded,
+      violationCodes: violations.map((v) => v.code).filter(Boolean),
+      violations,
+      procHint: '/proc/bare_os/boot_budget_summary.json',
+      note: 'Written every boot; operators mirror into proc via booter VFS provider.'
+    }) + '\n'
+  try {
+    await vfs.writeFile('/run/bare-os/boot-budget-summary.json', b4.from(row))
+  } catch {
+    /* optional */
+  }
+}
+
 async function maybeWriteBootPerfJson(ctx, bootT0, stageLog) {
  const vfs = ctx.vfs
  const b4 = ctx.b4a
@@ -2046,6 +2083,8 @@ async function start(ctx) {
    }
  }
  {
+    /** @type {{ kind: string, code: string, wallMs: number, limitMs: number }[]} */
+    let bootBudgetViolationsForSummary = []
    const budgetStrict =
      ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === '1' ||
      ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === 'true'
@@ -2100,11 +2139,12 @@ async function start(ctx) {
      }
    }
    if (coldExceeded || stdlibExceeded) {
-      /** @type {{ kind: string, wallMs: number, limitMs: number }[]} */
+      /** @type {{ kind: string, code: string, wallMs: number, limitMs: number }[]} */
      const violations = []
      if (coldExceeded && Number.isFinite(budget) && budget > 0) {
        violations.push({
          kind: 'cold',
+          code: 'BARE_OS_BOOT_BUDGET_COLD_EXCEEDED',
          wallMs: Date.now() - bootT0,
          limitMs: budget
        })
@@ -2116,6 +2156,7 @@ async function start(ctx) {
        )
        violations.push({
          kind: 'bare_stdlib',
+          code: 'BARE_OS_BOOT_BUDGET_BARE_STDLIB_EXCEEDED',
          wallMs: Number.isFinite(sw) ? sw : 0,
          limitMs: sb
        })
@@ -2133,7 +2174,15 @@ async function start(ctx) {
        bootBudgetViolations: violations,
        transactionState: BARE_OS_BOOT_TXN_STATE.STAGE_COMMITTED
      })
+      bootBudgetViolationsForSummary = violations
    }
+    await maybeWriteBootBudgetSummaryJson(
+      ctx,
+      bootT0,
+      bootBudgetViolationsForSummary,
+      coldExceeded,
+      stdlibExceeded
+    )
    if (budgetStrict && polStrict && (coldExceeded || stdlibExceeded)) {
      bootStructuredLog(
        ctx,
@@ -5,7 +5,7 @@ Authoritative **version alignment** with protocol and telemetry schema numbers l
 ## Maintenance

 - **Host filesystem**: first-party booter and seeder sources use **`import … from '#host-fs'`** / **`#host-path`** (and seeder **`#host-fs-promises`**) so Bare resolves **`bare-fs`** / **`bare-path`** and Node resolves the built-in **`fs`** / **`path`** modules via the default **`imports`** condition. **`bare-fs`** is a direct **`dependencies`** entry of **`bare-os-booter`**. CI: **`scripts/verify-pear-no-static-node-import.mjs`** rejects bare **`fs`** / **`path`** specifiers.
- **POSIX / proc**: **`/proc/bare_os/syscalls.json`** schema **10** with **`socketMsgSurface` schema 5** (`logicalScmRightsOnSend`); includes **`posixXsh`** (**`posix_fadvise`** simulated), **`fdModel`**, **`errnoHints`**; JSON text **cached** until **`vfs.bareOsClearWarmReadCaches`**. **`/proc/bare_os/process_table.json`** schema **7**; **`/proc/bare_os/protomux.json`** wire text schema **2**; **`/dev/shm`** in-memory named segments. **`/proc/bare_os/security_posture.json`** schema **5** — adds **`blindPeeringOperatorSketch`** env gate pointers; **`vaultCryptoPrimitives`**, **`bareCryptoReportedVersion`**, **`peerAdmission`**. **`/proc/bare_os_features`**: **`protomuxAppChannel`** advertisement + **`pearIpcConservativeAdvertisement`**. Protocol export **`BARE_OS_POSIX_PROFILE_*`**.
+- **POSIX / proc**: **`/proc/bare_os/syscalls.json`** schema **11** with **`susv4Refs`** on **`opsDetail`**, **`posixXsh` schema 3**, **`socketMsgSurface` schema 5** (`logicalScmRightsOnSend`); includes **`posix_fadvise`** simulated, **`fdModel`**, **`errnoHints`**; JSON text **cached** until **`vfs.bareOsClearWarmReadCaches`**. **`/proc/bare_os/process_table.json`** schema **7**; **`/proc/bare_os/protomux.json`** wire text schema **2**; **`/dev/shm`** in-memory named segments. **`/proc/bare_os/security_posture.json`** — **`blindRelayPosture`**, **`blindPeeringOperatorSketch`** env gate pointers; **`vaultCryptoPrimitives`**, **`bareCryptoReportedVersion`**, **`peerAdmission`**. **`/proc/bare_os/boot_budget_summary.json`** mirrors kernel **`/run/bare-os/boot-budget-summary.json`**. **`/proc/bare_os_features`**: **`protomuxAppChannel`**, optional **`protomuxCapChannel`**, **`pearIpcConservativeAdvertisement`**. Protocol export **`BARE_OS_POSIX_PROFILE_*`**.
 - **Blind-relay / pairing / geo proc** (default): **`bareOsProcBlindPeerRelayHintsMinimal`** returns **schema 1** with **`operatorRedacted: true`**. The legacy export **`bareOsProcBlindPeerRelayHintsStub`** was removed; use **`bareOsProcBlindPeerRelayHintsMinimal`** only.
 - **Vendored bundles**: post-esbuild **`scripts/sanitize-bare-bundles.mjs`** (from **`bare-os-bare-libs/build.mjs`**) strips CI-forbidden markers and replaces **`node:`** requires in **`bareDev.js`** with **`bare-*`** modules.
 - **Boot hooks (naming)**: canonical **`bareOsRegisterBootStepHook`**, **`bareOsInvokeBootStepHooks`**, **`bareOsEmitBareBootStepHint`**; legacy **`*BootPhase*`** methods remain thin wrappers (**no `bareOsCtxApiVersion` bump**). See [docs/reference/naming-alias-matrix.md](../../docs/reference/naming-alias-matrix.md).
@@ -18,6 +18,7 @@ Authoritative **version alignment** with protocol and telemetry schema numbers l

 | Version | Booter (workspace) | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | ------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 1.53.0  | 0.1.0              | **`disk.os` `bare_os.replication_operator_sketch`** JSON **schema 7** — **`corestoreSnapshotUxHint`** (env merge counts), **`pkgIndexSurface`**, prior operator fields. **`ctx.bareOsHrpcRequest`** routes **`bare_os.pkg_index_get`**; **`BARE_OS_HRPC_ROUTE_TABLE_SCHEMA_VERSION` `3`**. **`/proc/bare_os/syscalls.json`** schema **11** (**`susv4Refs`**); **`posixXsh` schema 3**. Optional **Protomux cap channel** (**`BARE_OS_PROTOMUX_CAP_CHANNEL`**, **`bare-os-cap-v1`**). **`ctx.bareOsVerifyPathCapabilityEnvelopeTrusted`** + **`BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX`**. **`/proc/bare_os/boot_budget_summary.json`**. Warm-cache adaptive **jitter** (**`BARE_OS_VFS_WARM_REPL_ADAPTIVE_JITTER_PCT`**). Shell **`BARE_OS_SHELL_POSIX_UNSET_ONLY_DEFAULT`**. Wasm **`env.bare_os_posix_bridge_peek`**. **`protomux_extensions.json` `schemaVersion` 4** (**`guestContractVersion`**, **`channelLifecycle`**). |
 | 1.52.0  | 0.1.0              | **`disk.os` `searchLocal`** — optional **`/etc/bare-os/path-manifest.json`** acceleration (**`BARE_OS_DISK_OS_PATH_MANIFEST`**, **`BARE_OS_DISK_OS_SEARCH_MANIFEST_ONLY`**, **`BARE_OS_DISK_OS_MANIFEST_CACHE_MS`**) + **`bare_os.disk_os_hints`** JSON **schema 3** (**`pathSearchLocal`** metrics). Stock **`ctx.bareOsHrpcRequest`** route **`bare_os.search_local`** (**`payload.query`**, max 512 chars). **`BARE_OS_HRPC_ROUTE_TABLE_SCHEMA_VERSION` `2`**. Optional **path capabilities**: **`ctx.bareOsVerifyPathCapabilityEnvelope`**, VFS gate **`BARE_OS_PATH_CAPABILITY_ENFORCE_READ`** + **`BARE_OS_PATH_CAPABILITY_PREFIX`**, **`/bin/pathcap-verify`**, example **`kernel/etc/bare-os/path-capability.envelope.example.json`**. |
 | 1.51.1  | 0.1.0              | **`disk.os` `bare_os.replication_snapshot`** JSON **schema 2** — merges seed snapshot hints / manifest slice / chain + **`BARE_OS_CORESTORE_SNAPSHOT_JSON`**. Shell **`BARE_OS_SHELL_NOUNSET`** / **`set -u`** / **`set -o nounset`**. Wasm **`BARE_OS_WASM_KERNEL_HOSTNAME_IMPORT`** → **`env.bare_os_hostname_peek`**. **`ctx.bareOsTrySpawnHostSubprocess`** merges default **`timeoutMs`** from **`BARE_OS_BARE_SUBPROCESS_TIMEOUT_MS`**. **`/proc/bare_os_features`**: **`protomuxAppChannel`**. **`/proc/bare_os/security_posture.json`** schema **5** (**`blindPeeringOperatorSketch`**). Swarm disk: **`BARE_OS_MBR_READ_TIMEOUT_MS`**, **`BARE_OS_MBR_READ_TIMEOUT_ADAPTIVE`**. Kernel **`kernel-ext-resolution.json`** schema **3** + **`BARE_OS_KERNEL_EXT_RESOLUTION_JSON_ALWAYS`**. Seeder multisig logs via **`seedLog`**. |
 | 1.51.0  | 0.1.0              | **`disk.os` `bare_os.replication_operator_sketch`** JSON **schema 5** — optional **`corestoreOperatorSketch`** from host **`BARE_OS_CORESTORE_STATS_JSON`**. **`/proc/bare_os/syscalls.json`** schema **10** — **`ctx.bareOsSyscall('posix_fadvise')`** simulated no-op; **`getconf`** / **`posix-compliance-matrix`** syscall op list includes **`posix_fadvise`**. **`hrpc_allowlist_sketch`** proc **schema 3** + **`routeTableSchemaVersion`** ( **`bare-os-hrpc-route-table.js`** ). **`export -p`** shell builtin. Optional **`kernel.ext.d` `provides`** version conflict detection (strict boot). Runtime caps: **`swarm_health`** proc paths. |
@@ -67,7 +67,10 @@ import { createBareOsDiskOsBridge } from './lib/bare-os-disk-os-bridge.js'
 import { buildBareOsHyperbeeGuestHint } from './lib/bare-os-hyperbee-guest-hint.js'
 import { invokeBareOsPearUpdaterDelegate } from './lib/bare-os-pear-updater-bridge.js'
 import { verifyBootManifestEd25519 } from '#bare-os-boot-manifest-sig'
-import { verifyPathCapabilityEnvelope } from './lib/bare-os-path-capability.js'
+import {
+  verifyPathCapabilityEnvelope,
+  verifyPathCapabilityEnvelopeTrusted
+} from './lib/bare-os-path-capability.js'
 import { getBareInitdJournalNdjson } from './lib/bare-initd-journal.js'
 import { createBareOsSandboxContext } from './lib/bare-os-sandbox.js'
 import {
@@ -1007,6 +1010,9 @@ async function executeKernel(disk, store, swarm, initSource) {
  const replicationWarmAdaptiveSkipRef = { current: 0 }
  /** Cached `/proc/bare_os/syscalls.json` text; cleared with warm read cache invalidation. */
  let bareOsSyscallsProcJsonCache = null
+  const bootBudgetSummaryProcRef = {
+    text: '{"schema":1,"note":"boot_budget_summary_pending"}\n'
+  }
  function bareOsBlindRelayRuntimeHintsForProc() {
    if (!bareOsProcBlindPeerRelayHintsExposed(shellEnv)) return undefined
    const peers = disk.peers ? [...disk.peers] : []
@@ -1246,6 +1252,9 @@ async function executeKernel(disk, store, swarm, initSource) {
        })
      )}\n`
    },
+    procBareOsBootBudgetSummaryText() {
+      return bootBudgetSummaryProcRef.text
+    },
    hostProcStatsRef,
    procSnapshot: {
      version: BARE_OS_CTX_API_VERSION,
@@ -1495,13 +1504,25 @@ async function executeKernel(disk, store, swarm, initSource) {
          note:
            'Optional second Protomux channel paired alongside bare-os-v1 for app-tier traffic; control plane stays on PROTOCOL_NAME.'
        },
-        pearIpcConservativeAdvertisement: {
-          schema: 2,
+        protomuxCapChannel: {
+          schema: 1,
+          protocolName: 'bare-os-cap-v1',
+          envGate: 'BARE_OS_PROTOMUX_CAP_CHANNEL',
+          hostEnabled:
+            shellEnv.BARE_OS_PROTOMUX_CAP_CHANNEL === '1' ||
+            shellEnv.BARE_OS_PROTOMUX_CAP_CHANNEL === 'true',
+          operatorMetric: 'disk.os replication_operator_sketch.protomuxOperatorSketch.protomuxCapChannelRxTotal',
          note:
-            'Well-known Pear IPC channel *names* only (pear-runtime conservative surface); does not assert host wiring or handler behavior.',
+            'Optional opaque buffer channel for capability tokens / app datagrams; must be authenticated at application layer.'
+        },
+        pearIpcConservativeAdvertisement: {
+          schema: 3,
+          note:
+            'Well-known Pear IPC channel *names* only (pear-runtime conservative surface); does not assert host wiring or handler behavior. Schema 3 documents static pear-ipc export hints for drift checks.',
          channels: pearIpcReg.channels.map((c) => c.name),
          channelCount: pearIpcReg.channels.length,
-          updaterDelegateEnv: 'BARE_OS_PEAR_UPDATER_DELEGATE'
+          updaterDelegateEnv: 'BARE_OS_PEAR_UPDATER_DELEGATE',
+          pearIpcExportHints: ['register', 'unregister', 'channels', 'messages']
        },
        posixShellExtendedProfile: {
          schema: 1,
@@ -1576,9 +1597,23 @@ async function executeKernel(disk, store, swarm, initSource) {
        String(shellEnv.BARE_OS_KEY_HANDLE_TTL_MS || ''),
        10
      )
+      const blindRelayStatsRaw = String(
+        shellEnv.BARE_OS_BLIND_RELAY_STATS_JSON || ''
+      ).trim()
+      let blindRelayKeySample = []
+      if (blindRelayStatsRaw) {
+        try {
+          const br = JSON.parse(blindRelayStatsRaw)
+          if (br && typeof br === 'object' && !Array.isArray(br)) {
+            blindRelayKeySample = Object.keys(br).slice(0, 16)
+          }
+        } catch {
+          blindRelayKeySample = ['parse_error']
+        }
+      }
      return `${JSON.stringify({
-        schema: 5,
-        note: 'Non-secret security posture snapshot; no vault or key material. Schema 5 adds blindPeeringOperatorSketch env gates.',
+        schema: 6,
+        note: 'Non-secret security posture snapshot; no vault or key material. Schema 6 adds blindRelayPosture key sample.',
        bootPolicyMerged: bootPol,
        bootPolicyStrict: strict,
        sandboxScript:
@@ -1696,6 +1731,14 @@ async function executeKernel(disk, store, swarm, initSource) {
          note:
            'When armed, operators may route blind-relay admission sketches to host NDJSON sinks; proc JSON never carries peer keys (see blind-relay-p2p-hardening.md).'
        },
+        blindRelayPosture: {
+          schema: 1,
+          statsJsonEnv: 'BARE_OS_BLIND_RELAY_STATS_JSON',
+          statsJsonPresent: !!blindRelayStatsRaw,
+          statsTopLevelKeysSample: blindRelayKeySample,
+          note:
+            'Summarizes blind-relay-service–style host stats JSON when present; values are never echoed — keys only for operator dashboards.'
+        },
        pearMultisigSeeder: {
          schema: 1,
          verifyResult: String(
@@ -2640,12 +2683,28 @@ async function executeKernel(disk, store, swarm, initSource) {
        String(shellEnv.BARE_OS_VFS_WARM_REPL_ADAPTIVE_WINDOW_MS || '').trim(),
        10
      )
+      const jitterPctRaw = Number.parseInt(
+        String(shellEnv.BARE_OS_VFS_WARM_REPL_ADAPTIVE_JITTER_PCT || '').trim(),
+        10
+      )
+      const jitterPct =
+        Number.isFinite(jitterPctRaw) && jitterPctRaw > 0
+          ? Math.min(50, jitterPctRaw)
+          : 0
      const adaptiveReplWarm =
        Number.isFinite(adaptWin) && adaptWin > 0 && warmFullInvOnRep
      let doFullInv = warmFullInvOnRep && (repGrewSys || repGrewPer)
      if (adaptiveReplWarm && doFullInv) {
        const nowMs = Date.now()
-        if (nowMs - replicationWarmLastFullInvMsRef.current < adaptWin) {
+        let effWin = adaptWin
+        if (jitterPct > 0) {
+          const r = Math.random() * (2 * jitterPct) - jitterPct
+          effWin = Math.max(
+            1,
+            Math.floor(adaptWin * (1 + r / 100))
+          )
+        }
+        if (nowMs - replicationWarmLastFullInvMsRef.current < effWin) {
          doFullInv = false
          replicationWarmAdaptiveSkipRef.current++
        } else {
@@ -2677,7 +2736,7 @@ async function executeKernel(disk, store, swarm, initSource) {
          session: { ...sessionStatsRef },
          peers: peerRep,
          replicationLive: {
-            schema: 4,
+            schema: 5,
            peerCount: peerRep,
            liveHyperdriveSketchSchema: repLive.schema,
            systemCoreLength: repLive.systemCoreLength,
@@ -2685,6 +2744,21 @@ async function executeKernel(disk, store, swarm, initSource) {
            auxiliaryDriveCount: repLive.auxiliaryDriveCount,
            stallHint: repLive.stallHint,
            corestoreSnapshotSurface: repLive.corestoreSnapshotSurface,
+            collaborationSession: {
+              schema: 1,
+              swarmPeerCount: peerRep,
+              protomuxAppChannelRxTotal:
+                typeof disk.protomuxAppChannelRxTotal === 'number'
+                  ? disk.protomuxAppChannelRxTotal
+                  : 0,
+              protomuxCapChannelRxTotal:
+                typeof disk.protomuxCapChannelRxTotal === 'number'
+                  ? disk.protomuxCapChannelRxTotal
+                  : 0,
+              collabNdjsonEnv: 'BARE_OS_COLLAB_SESSION_NDJSON',
+              note:
+                'Live collaboration hint: correlates swarm peers with optional Protomux side channels; enable BARE_OS_COLLAB_SESSION_NDJSON for personal-drive audit rows (privacy-sensitive).'
+            },
            warmPrefixInvalidate: {
              schema: 1,
              enabled: warmPrefixInvEnabled,
@@ -2698,11 +2772,13 @@ async function executeKernel(disk, store, swarm, initSource) {
              note: 'When enabled, increasing replicated core lengths call ctx.bareOsInvalidateWarmReadCaches(replication:core-length) for full /bin + /lib/bare warm flush.'
            },
            warmReplAdaptive: {
-              schema: 1,
+              schema: 2,
              windowMs: adaptiveReplWarm ? adaptWin : null,
+              jitterPercentMax: jitterPct > 0 ? jitterPct : null,
+              jitterEnvGate: 'BARE_OS_VFS_WARM_REPL_ADAPTIVE_JITTER_PCT',
              skippedFullFlushCount: replicationWarmAdaptiveSkipRef.current,
              envGate: 'BARE_OS_VFS_WARM_REPL_ADAPTIVE_WINDOW_MS',
-              note: 'Coalesces full warm-cache invalidation bursts when replication core lengths grow faster than the adaptive window.'
+              note: 'Schema 2: optional BARE_OS_VFS_WARM_REPL_ADAPTIVE_JITTER_PCT (1–50) randomizes effective window to reduce thundering herd. Coalesces full warm-cache invalidation bursts when replication core lengths grow faster than the adaptive window.'
            }
          },
          pipeline: pl,
@@ -2890,7 +2966,7 @@ async function executeKernel(disk, store, swarm, initSource) {
          note: 'Stable Protomux channel ordering for bare-os-v1 seed/booter wire.'
        },
        operatorMetrics: {
-          schema: 4,
+          schema: 5,
          aliasPairCount:
            rt.aliases && typeof rt.aliases === 'object'
              ? Object.keys(rt.aliases).length
@@ -2909,6 +2985,10 @@ async function executeKernel(disk, store, swarm, initSource) {
            typeof disk.protomuxAppChannelRxTotal === 'number'
              ? disk.protomuxAppChannelRxTotal
              : 0,
+          protomuxCapChannelRxTotal:
+            typeof disk.protomuxCapChannelRxTotal === 'number'
+              ? disk.protomuxCapChannelRxTotal
+              : 0,
          rpcClientPoolHintPresent: !!(
            disk.seedProtomuxRpcPoolHint &&
            typeof disk.seedProtomuxRpcPoolHint === 'object'
@@ -2917,7 +2997,7 @@ async function executeKernel(disk, store, swarm, initSource) {
            shellEnv.BARE_OS_PROTOMUX_RPC_CLIENT_POOL_COMPOSITION === '1' ||
            shellEnv.BARE_OS_PROTOMUX_RPC_CLIENT_POOL_COMPOSITION === 'true',
          rpcClientPoolCompositionEnv: 'BARE_OS_PROTOMUX_RPC_CLIENT_POOL_COMPOSITION',
-          note: 'Schema 4 adds rpcClientPoolCompositionGate (operator enables when wiring holepunchto/protomux-rpc-client-pool–style multiplexing). Schema 3: protomuxAppChannelRxTotal, rpcClientPoolHintPresent.',
+          note: 'Schema 5: protomuxCapChannelRxTotal (bare-os-cap-v1). Schema 4: rpcClientPoolCompositionGate. Schema 3: protomuxAppChannelRxTotal.',
          backpressureEvent: 'bare-os:protomux-backpressure',
          backpressureEmit: 'ctx.bareOsEmitProtomuxBackpressure'
        },
@@ -3335,6 +3415,22 @@ async function executeKernel(disk, store, swarm, initSource) {
      hrpcAuditAppend({ ok: true, route: 'bare_os.replication_snapshot' })
      return { ok: true, text: txt, json: parsed }
    }
+    if (svc === 'bare_os' && m === 'pkg_index_get') {
+      if (!disk?.os || typeof disk.os.execRpc !== 'function') {
+        hrpcAuditAppend({ ok: false, reason: 'disk_os_unavailable' })
+        throw new Error('bareOsHrpcRequest: disk.os bridge unavailable')
+      }
+      const key = String(payload.key ?? payload.name ?? '').trim()
+      const txt = await disk.os.execRpc('bare_os', 'pkg_index_get', [key])
+      let parsed = null
+      try {
+        parsed = JSON.parse(txt)
+      } catch {
+        parsed = { error: 'invalid_json' }
+      }
+      hrpcAuditAppend({ ok: true, route: 'bare_os.pkg_index_get' })
+      return { ok: true, text: txt, json: parsed }
+    }

    const emitUnlisted =
      shellEnv.BARE_OS_HRPC_EMIT_UNLISTED === '1' ||
@@ -7638,6 +7734,10 @@ async function executeKernel(disk, store, swarm, initSource) {
        ['extensions', '/proc/bare_os/extensions.json'],
        ['initdDag', '/proc/bare_os/initd_dag.json'],
        ['bootGraph', '/proc/bare_os/boot_graph.json'],
+        [
+          'bootBudgetSummary',
+          '/proc/bare_os/boot_budget_summary.json'
+        ],
        ['processTable', '/proc/bare_os/process_table.json'],
        ['syscalls', '/proc/bare_os/syscalls.json'],
        ['metricsProm', '/proc/bare_os/metrics.prom'],
@@ -7920,6 +8020,13 @@ async function executeKernel(disk, store, swarm, initSource) {
    bareOsVerifyPathCapabilityEnvelope(envelope) {
      return verifyPathCapabilityEnvelope(envelope)
    },
+    /**
+     * Verify envelope and optional **`BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX`** issuer allowlist.
+     * @param {unknown} envelope
+     */
+    bareOsVerifyPathCapabilityEnvelopeTrusted(envelope) {
+      return verifyPathCapabilityEnvelopeTrusted(envelope, shellEnv)
+    },
    /**
     * Ask host to attach a mirror read key (Pear / Holepunch); emits process event when available.
     * @param {{ key?: string, label?: string }} [opts]
@@ -9226,6 +9333,7 @@ async function executeKernel(disk, store, swarm, initSource) {

  disk.os = createBareOsDiskOsBridge({
    drive: disk.drive,
+    corestore: store,
    auxiliaryDrives: Array.isArray(disk.auxiliaryDrives)
      ? disk.auxiliaryDrives
      : [],
@@ -9271,16 +9379,22 @@ async function executeKernel(disk, store, swarm, initSource) {
        ? disk.swarmConnectionBudget
        : null,
    protomuxOperatorSketch: {
-      schema: 2,
+      schema: 3,
      protomuxAppChannelRxTotal:
        typeof disk.protomuxAppChannelRxTotal === 'number'
          ? disk.protomuxAppChannelRxTotal
          : 0,
+      protomuxCapChannelRxTotal:
+        typeof disk.protomuxCapChannelRxTotal === 'number'
+          ? disk.protomuxCapChannelRxTotal
+          : 0,
      envGateAppChannel: 'BARE_OS_PROTOMUX_APP_CHANNEL',
+      envGateCapChannel: 'BARE_OS_PROTOMUX_CAP_CHANNEL',
      tuningFromEnv: bareOsProtomuxTuningFromEnv(shellEnv),
      tuningEnvKey: 'BARE_OS_PROTOMUX_TUNING_JSON',
      hyperswarmConstructorOptsEcho: bareOsHyperswarmOptsFromEnv(shellEnv),
-      note: 'Schema 2: optional BARE_OS_PROTOMUX_TUNING_JSON merge + Hyperswarm opt echo (advisory).'
+      note:
+        'Schema 3: adds protomuxCapChannelRxTotal + BARE_OS_PROTOMUX_CAP_CHANNEL. Schema 2: BARE_OS_PROTOMUX_TUNING_JSON + Hyperswarm opt echo (advisory).'
    },
    auditBatch: (entries) => {
      try {
@@ -9305,6 +9419,13 @@ async function executeKernel(disk, store, swarm, initSource) {
    while (true) {
      try {
        await runKernelFromSource(b4a.toString(currentInit), ctx)
+        try {
+          const bb = await vfs.readFile('/run/bare-os/boot-budget-summary.json')
+          if (bb && bb.byteLength)
+            bootBudgetSummaryProcRef.text = b4a.toString(bb)
+        } catch {
+          /* optional */
+        }
        break
      } catch (e) {
        const code = e && /** @type {any} */ (e).code
@@ -2,4 +2,4 @@
 * Semantic version of the booter `ctx` contract for custom kernels.
 * Bump when adding/removing/renaming documented `ctx` fields or changing behavior.
 */
-export const BARE_OS_CTX_API_VERSION = '1.52.0'
+export const BARE_OS_CTX_API_VERSION = '1.53.0'
@@ -1,6 +1,6 @@
 /**
 * Stable shapes for custom kernels and `/bin` utilities (best-effort; full `ctx` is assembled in `index.js`).
- * Match `BARE_OS_CTX_API_VERSION` in `bare-os-ctx-api.js` (stock **1.52.0**).
+ * Match `BARE_OS_CTX_API_VERSION` in `bare-os-ctx-api.js` (stock **1.53.0**).
 */

 export interface BareOsAbortOpts {
@@ -188,6 +188,9 @@ export interface BareOsKernelContext {
  bareOsVerifyPathCapabilityEnvelope(envelope: unknown):
    | { ok: true; payload: { prefix: string; ops: string[]; expMs: number | null } }
    | { ok: false; reason: string }
+  bareOsVerifyPathCapabilityEnvelopeTrusted?(envelope: unknown):
+    | { ok: true; payload: { prefix: string; ops: string[]; expMs: number | null } }
+    | { ok: false; reason: string }
  bareOsRequestMirror(opts?: {
    key?: string
    label?: string
@@ -10,6 +10,7 @@ import {
 } from 'bare-os-protocol'
 import { listBareServices } from './bare-initd.js'
 import { BareOsKernelError } from './bare-os-errors.js'
+import { bareOsCorestoreSnapshotOperatorHint } from './corestore-host-lifecycle.js'

 const MAX_SEARCH_RESULTS = 256

@@ -132,6 +133,7 @@ function sleepMs(ms) {
 *   protomuxOperatorSketch?: Record<string, unknown> | null
 *   auditBatch?: (entries: unknown[]) => unknown
 *   booterPackageVersion?: string | null
+ *   corestore?: unknown
 * }} opts
 */
 export function createBareOsDiskOsBridge(opts) {
@@ -421,7 +423,7 @@ export function createBareOsDiskOsBridge(opts) {
          'BARE_OS_REPLICATION_PEER_PRIORITY_JSON'
        )
        return JSON.stringify({
-          schema: 5,
+          schema: 7,
          ok: true,
          seedReplicationStatus:
            sr && typeof sr === 'object' ? sr : null,
@@ -436,6 +438,18 @@ export function createBareOsDiskOsBridge(opts) {
            typeof opts.protomuxOperatorSketch === 'object'
              ? opts.protomuxOperatorSketch
              : null,
+          pkgIndexSurface: {
+            schema: 1,
+            diskOsRpc: 'bare_os.pkg_index_get',
+            hrpcRoute: 'bare_os.pkg_index_get',
+            defaultManifestPath: '/etc/bare-os/pkg-index.json',
+            envManifestPath: 'BARE_OS_PKG_INDEX_PATH',
+            note:
+              'Hyperbee-backed indexes replicate separately; this JSON is a static drive manifest for operators.'
+          },
+          corestoreSnapshotUxHint: bareOsCorestoreSnapshotOperatorHint(
+            opts.corestore ?? null
+          ),
          corestoreSnapshotPaused:
            String(env?.BARE_OS_CORESTORE_SNAPSHOT_PAUSED || '') === '1' ||
            String(env?.BARE_OS_CORESTORE_SNAPSHOT_PAUSED || '') === 'true',
@@ -451,7 +465,7 @@ export function createBareOsDiskOsBridge(opts) {
          corestoreOperatorSketch: corestoreSketch,
          peerPrioritySketch,
          note:
-            'Schema 5: adds corestoreOperatorSketch from BARE_OS_CORESTORE_STATS_JSON (non-secret host JSON for namespace/core counts, etc.). Superset of schema 4 (swarmConnectionBudget, protomuxOperatorSketch, peerPrioritySketch, blindTopologySketchV3, hyperblobsDedupSketch).'
+            'Schema 7: adds corestoreSnapshotUxHint (BARE_OS_CORESTORE_SNAPSHOT_JSON vs BARE_OS_CORESTORE_STATS_JSON merge counts; advisory). Schema 6: pkgIndexSurface. Schema 5: corestoreOperatorSketch from BARE_OS_CORESTORE_STATS_JSON.'
        })
      }

@@ -644,6 +658,72 @@ export function createBareOsDiskOsBridge(opts) {
        }
      }

+      if (mod === 'bare_os' && meth === 'pkg_index_get') {
+        const drive = opts.drive
+        const env = globalThis.process?.env
+        const relRaw = String(
+          env?.BARE_OS_PKG_INDEX_PATH != null
+            ? env.BARE_OS_PKG_INDEX_PATH
+            : '/etc/bare-os/pkg-index.json'
+        ).trim()
+        const rel =
+          relRaw === ''
+            ? '/etc/bare-os/pkg-index.json'
+            : relRaw.startsWith('/')
+              ? relRaw
+              : `/${relRaw}`
+        const want = String(a[0] || '').trim()
+        if (!drive || typeof drive.get !== 'function') {
+          return JSON.stringify({
+            schema: 1,
+            ok: false,
+            reason: 'no_system_drive'
+          })
+        }
+        try {
+          const node = await drive.get(rel)
+          if (!node || !node.byteLength) {
+            return JSON.stringify({
+              schema: 1,
+              ok: false,
+              path: rel,
+              reason: 'missing_or_empty'
+            })
+          }
+          const j = JSON.parse(b4a.toString(node))
+          const pkgs =
+            j &&
+            typeof j === 'object' &&
+            j.packages &&
+            typeof j.packages === 'object'
+              ? /** @type {Record<string, unknown>} */ (j.packages)
+              : {}
+          if (!want) {
+            return JSON.stringify({
+              schema: 1,
+              ok: true,
+              path: rel,
+              keys: Object.keys(pkgs).slice(0, 512)
+            })
+          }
+          const ent =
+            Object.prototype.hasOwnProperty.call(pkgs, want) ? pkgs[want] : null
+          return JSON.stringify({
+            schema: 1,
+            ok: ent != null,
+            path: rel,
+            key: want,
+            entry: ent
+          })
+        } catch (e) {
+          return JSON.stringify({
+            schema: 1,
+            ok: false,
+            error: (e && /** @type {Error} */ (e).message) || String(e)
+          })
+        }
+      }
+
      throw new BareOsKernelError(
        'BARE_OS_EXEC_RPC_UNKNOWN',
        `execRpc: unknown module/method: ${mod}.${meth}`
@@ -1,7 +1,7 @@
 /**
 * Stock ctx.bareOsHrpcRequest built-in routes (versioned for guest tooling).
 */
-export const BARE_OS_HRPC_ROUTE_TABLE_SCHEMA_VERSION = 2
+export const BARE_OS_HRPC_ROUTE_TABLE_SCHEMA_VERSION = 3

 export const BARE_OS_HRPC_STOCK_ROUTES = Object.freeze([
  'kernel.ping',
@@ -11,5 +11,6 @@ export const BARE_OS_HRPC_STOCK_ROUTES = Object.freeze([
  'bare_os.disk_os_hints',
  'bare_os.search_local',
  'bare_os.replication_operator_sketch',
-  'bare_os.replication_snapshot'
+  'bare_os.replication_snapshot',
+  'bare_os.pkg_index_get'
 ])
@@ -133,3 +133,50 @@ export async function bareOsVfsPathCapabilityDeniesDriveRead(
  if (!la.startsWith(vr.payload.prefix)) return true
  return false
 }
+
+/**
+ * @param {Record<string, string | undefined> | null | undefined} env
+ * @returns {string[] | null}
+ */
+export function parsePathCapabilityTrustedPubkeysHex(env) {
+  const raw = String(env?.BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX || '').trim()
+  if (!raw) return null
+  /** @type {string[]} */
+  const out = []
+  for (const p of raw.split(/[,;\s]+/)) {
+    const x = p.trim().toLowerCase().replace(/^0x/, '')
+    if (/^[0-9a-f]{64}$/i.test(x)) out.push(x.toLowerCase())
+  }
+  return out.length ? out : null
+}
+
+/**
+ * Same as {@link verifyPathCapabilityEnvelope} plus optional issuer allowlist from
+ * **`BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX`** (comma-separated 64-hex Ed25519 pubkeys).
+ * @param {unknown} envelope
+ * @param {Record<string, string | undefined> | null | undefined} env
+ * @returns {{ ok: true, payload: { prefix: string, ops: string[], expMs: number | null }, trustedIssuer: true | 'signature_only' } | { ok: false, reason: string }}
+ */
+export function verifyPathCapabilityEnvelopeTrusted(envelope, env) {
+  const base = verifyPathCapabilityEnvelope(envelope)
+  if (!base.ok) return base
+  const allow = parsePathCapabilityTrustedPubkeysHex(env)
+  if (!allow) {
+    return {
+      ok: true,
+      payload: base.payload,
+      trustedIssuer: 'signature_only'
+    }
+  }
+  const e =
+    envelope && typeof envelope === 'object' && !Array.isArray(envelope)
+      ? /** @type {Record<string, unknown>} */ (envelope)
+      : {}
+  const pub = String(e.pubkeyHex || '')
+    .trim()
+    .toLowerCase()
+    .replace(/^0x/, '')
+  if (!allow.includes(pub))
+    return { ok: false, reason: 'issuer_not_trusted' }
+  return { ok: true, payload: base.payload, trustedIssuer: true }
+}
@@ -37,12 +37,20 @@ export function buildBareOsProtomuxExtensionsProcJson(opts = {}) {
      ? opts.registrySnapshot
      : {}
  return {
-    schemaVersion: 3,
+    schemaVersion: 4,
+    guestContractVersion: 1,
    exposed: true,
    ctxApiVersion: String(opts.ctxApiVersion || ''),
    registry: snap,
    muxWirePackage: 'protomux',
    muxWireMajor: 3,
+    channelLifecycle: {
+      schema: 1,
+      states: ['paired', 'opening', 'open', 'closing', 'closed'],
+      backpressureEvent: 'bare-os:protomux-backpressure',
+      note:
+        'Guest-facing contract: logical channels follow Protomux createChannel/open/close; framed streams must preserve message boundaries (length-prefixed / secret-stream).'
+    },
    holepunchCompanionPackages: {
      rpcPool: 'protomux-rpc-client-pool',
      note:
@@ -56,6 +64,12 @@ export function buildBareOsProtomuxExtensionsProcJson(opts = {}) {
      {
        name: 'bare-os-extension-telemetry',
        note: 'Optional NDJSON-shaped diagnostic channel; host must open explicitly.'
+      },
+      {
+        name: 'bare-os-cap-v1',
+        protocol: 'bare-os-cap-v1',
+        envGate: 'BARE_OS_PROTOMUX_CAP_CHANNEL',
+        note: 'Opaque buffer side channel; application-layer auth required.'
      }
    ],
    wireReference: '/proc/bare_os/protomux.json',
@@ -540,6 +540,49 @@ export const BARE_OS_SYSCALL_OPS_DETAIL_FULL = Object.freeze([
  ...BARE_OS_POSIX_XSH_OPS_DETAIL
 ])

+/**
+ * Stable Open Group Issue 7 index tokens for audit dashboards (not a conformance claim).
+ * @type {Readonly<Record<string, readonly string[]>>}
+ */
+export const BARE_OS_SYSCALL_OPS_SUSV4_REFS = Object.freeze({
+  open: Object.freeze(['XSH/open']),
+  close: Object.freeze(['XSH/close']),
+  read: Object.freeze(['XSH/read']),
+  write: Object.freeze(['XSH/write']),
+  readv: Object.freeze(['XSH/readv']),
+  writev: Object.freeze(['XSH/writev']),
+  pipe: Object.freeze(['XSH/pipe']),
+  dup: Object.freeze(['XSH/dup']),
+  dup2: Object.freeze(['XSH/dup2']),
+  fcntl: Object.freeze(['XSH/fcntl']),
+  poll: Object.freeze(['XSH/poll']),
+  select: Object.freeze(['XSH/select']),
+  umask: Object.freeze(['XSH/umask']),
+  lseek: Object.freeze(['XSH/lseek']),
+  nanosleep: Object.freeze(['XSH/nanosleep']),
+  clock_gettime: Object.freeze(['XSH/clock_gettime']),
+  posix_fadvise: Object.freeze(['XSH/posix_fadvise']),
+  fsync: Object.freeze(['XSH/fsync']),
+  fdatasync: Object.freeze(['XSH/fdatasync']),
+  pathconf: Object.freeze(['XSH/pathconf']),
+  mq_open: Object.freeze(['XSH/mq_open']),
+  mq_send: Object.freeze(['XSH/mq_send']),
+  mq_receive: Object.freeze(['XSH/mq_receive']),
+  socket: Object.freeze(['XSH/socket']),
+  bind: Object.freeze(['XSH/bind']),
+  listen: Object.freeze(['XSH/listen']),
+  accept: Object.freeze(['XSH/accept']),
+  connect: Object.freeze(['XSH/connect']),
+  send: Object.freeze(['XSH/send']),
+  recv: Object.freeze(['XSH/recv']),
+  recvfrom: Object.freeze(['XSH/recvfrom']),
+  sendmsg: Object.freeze(['XSH/sendmsg']),
+  recvmsg: Object.freeze(['XSH/recvmsg']),
+  shutdown: Object.freeze(['XSH/shutdown']),
+  getsockopt: Object.freeze(['XSH/getsockopt']),
+  setsockopt: Object.freeze(['XSH/setsockopt'])
+})
+
 export const BARE_OS_STOCK_SYSCALL_OPS = Object.freeze(
  BARE_OS_SYSCALL_OPS_DETAIL.map((o) => o.name)
 )
@@ -7,6 +7,7 @@ import {
 } from 'bare-os-protocol/bare-os-posix-profile.js'
 import {
  BARE_OS_SYSCALL_OPS_DETAIL_FULL,
+  BARE_OS_SYSCALL_OPS_SUSV4_REFS,
  BARE_OS_STOCK_SYSCALL_OPS,
  bareOsPosixXshOpsCsv
 } from './bare-os-syscall-ops.js'
@@ -17,8 +18,12 @@ import { bareOsErrnoTableForProc } from './bare-os-posix-errno.js'
 * @param {{ ctxApiVersion: string }} p
 */
 export function buildBareOsSyscallsProcJson(p) {
+  const opsDetail = BARE_OS_SYSCALL_OPS_DETAIL_FULL.map((o) => {
+    const refs = BARE_OS_SYSCALL_OPS_SUSV4_REFS[o.name]
+    return refs ? { ...o, susv4Refs: [...refs] } : { ...o }
+  })
  return {
-    schemaVersion: 10,
+    schemaVersion: 11,
    ctxApiVersion: p.ctxApiVersion,
    posixProfile: {
      id: BARE_OS_POSIX_PROFILE_ID,
@@ -26,10 +31,10 @@ export function buildBareOsSyscallsProcJson(p) {
      utilitiesIndexPath: '/etc/bare-os/posix_utilities.json'
    },
    ops: [...BARE_OS_STOCK_SYSCALL_OPS],
-    opsDetail: [...BARE_OS_SYSCALL_OPS_DETAIL_FULL],
+    opsDetail,
    posixXsh: {
-      schema: 2,
-        note: 'POSIX.1 XSH-style names: logical names in opsDetail; schema 10 adds posix_fadvise as a simulated ctx.bareOsSyscall no-op (Issue 7-style advice hint). Socket family are ctx.bareOsSyscall ops returning ENOSYS-shaped results (not kernel socket FDs) unless BARE_OS_POSIX_SOCKET_FD_BRIDGE. readv/writev are partial posix-pipe facades. getsockopt/setsockopt: ENOSYS without bridge fd; with bridge, partial SO_KEEPALIVE/TCP_NODELAY and optional SO_RCVBUF/SO_SNDBUF on logical fds when the Bare socket implementation exposes buffer sizes. nanosleep-shaped delay via ctx.bareOsSyscall("nanosleep"); clock_gettime via ctx.bareOsSyscall("clock_gettime") (REALTIME wall; MONOTONIC via bare-hrtime or performance.now sketch). SOCK_DGRAM bridge supports passive bind(2), optional connect(2) after bind, send/sendmsg/recv/recvfrom/recvmsg with bounded queue (BARE_OS_POSIX_DGRAM_RECVQ_MAX); bound-without-connect send requires port+host syscall args. sendmsg/recvmsg: non-empty ancillary control is ENOTSUP (socketMsgSurface schema 5) unless BARE_OS_POSIX_SOCKET_SCM_RIGHTS=1, then only SCM_RIGHTS-shaped `{ fds: number[] }` logical fd dup is accepted on SOCK_STREAM and SOCK_DGRAM bridge fds (same prepareBridgeSendmsg path; see bare-os-socket-scm-rights.js and syscall-socket-contract.md).',
+      schema: 3,
+        note: 'POSIX.1 XSH-style names: logical names in opsDetail; schema 11 adds susv4Refs tokens (Issue 7 index) on mapped operations. Schema 10: posix_fadvise simulated no-op. Socket family: ENOSYS without BARE_OS_POSIX_SOCKET_FD_BRIDGE. readv/writev: partial posix-pipe facades. nanosleep / clock_gettime via ctx.bareOsSyscall. sendmsg/recvmsg: socketMsgSurface schema 5; optional SCM_RIGHTS logical dup.',
      namesCsv: bareOsPosixXshOpsCsv()
    },
    socketMsgSurface: {
@@ -150,6 +150,10 @@ export async function bareOsWasmKernelInstantiate(source, ctx, opts = {}) {
      wantSyscall &&
      (shellEnv.BARE_OS_WASM_KERNEL_CTX_API_PEEK === '1' ||
        shellEnv.BARE_OS_WASM_KERNEL_CTX_API_PEEK === 'true')
+    const wantPosixBridgePeek =
+      wantSyscall &&
+      (shellEnv.BARE_OS_WASM_KERNEL_POSIX_BRIDGE_PEEK === '1' ||
+        shellEnv.BARE_OS_WASM_KERNEL_POSIX_BRIDGE_PEEK === 'true')
    const pathconfFn = ctx && typeof ctx.bareOsPathconf === 'function'
      ? ctx.bareOsPathconf.bind(ctx)
      : null
@@ -227,6 +231,20 @@ export async function bareOsWasmKernelInstantiate(source, ctx, opts = {}) {
          return writeCStrToMemory(memory, Number(outPtr), Number(outCap), v)
        }
      }
+      if (wantPosixBridgePeek) {
+        envImports.bare_os_posix_bridge_peek = () => {
+          const sock =
+            shellEnv.BARE_OS_POSIX_SOCKET_FD_BRIDGE === '1' ||
+            shellEnv.BARE_OS_POSIX_SOCKET_FD_BRIDGE === 'true'
+          const fcntlWait =
+            shellEnv.BARE_OS_POSIX_FCNTL_BLOCKING_WAIT === '1' ||
+            shellEnv.BARE_OS_POSIX_FCNTL_BLOCKING_WAIT === 'true'
+          let flags = 0
+          if (sock) flags |= 1
+          if (fcntlWait) flags |= 2
+          return flags | 0
+        }
+      }
    }
    const importObject = {
      env: envImports
@@ -255,7 +273,8 @@ export async function bareOsWasmKernelInstantiate(source, ctx, opts = {}) {
      wasmWallClockMs32Import: !!wantSyscall,
      wasmMonotonicMsImport: !!wantMonotonicMs,
      wasmHostnamePeekImport: !!(wantSyscall && wantHostname),
-      wasmCtxApiVersionPeekImport: !!(wantSyscall && wantCtxApiPeek)
+      wasmCtxApiVersionPeekImport: !!(wantSyscall && wantCtxApiPeek),
+      wasmPosixBridgePeekImport: !!(wantSyscall && wantPosixBridgePeek)
    }
  } catch (e) {
    return { ok: false, reason: String(e && e.message ? e.message : e) }
@@ -50,14 +50,43 @@ export function bareOsInstallCorestoreSuspendResumeHooks(ctx) {
 * @param {unknown} store
 */
 export function bareOsCorestoreSnapshotOperatorHint(store) {
+  const env = globalThis.process?.env
+  const snapRaw = String(env?.BARE_OS_CORESTORE_SNAPSHOT_JSON || '').trim()
+  const statsRaw = String(env?.BARE_OS_CORESTORE_STATS_JSON || '').trim()
+  let snapshotKeyCount = null
+  let statsNamespaceCount = null
+  if (snapRaw) {
+    try {
+      const s = JSON.parse(snapRaw)
+      if (s && typeof s === 'object') {
+        if (Array.isArray(s.handles)) snapshotKeyCount = s.handles.length
+        else if (Array.isArray(s.keys)) snapshotKeyCount = s.keys.length
+      }
+    } catch {
+      snapshotKeyCount = -1
+    }
+  }
+  if (statsRaw) {
+    try {
+      const st = JSON.parse(statsRaw)
+      if (st && typeof st === 'object' && Array.isArray(st.namespaces))
+        statsNamespaceCount = st.namespaces.length
+    } catch {
+      statsNamespaceCount = -1
+    }
+  }
  return {
-    schema: 2,
-    note: 'Wire the holepunch corestore-snapshot package on the host; guests receive this descriptor only. Suspend/resume on live Corestore/Hyperswarm is host-only: see bareOsRegisterCorestoreSuspendResumeHooks.',
+    schema: 3,
+    note: 'Wire the holepunch corestore-snapshot package on the host; guests receive this descriptor only. Schema 3 adds non-secret merge hints when BARE_OS_CORESTORE_SNAPSHOT_JSON and BARE_OS_CORESTORE_STATS_JSON parse.',
    corestoreSnapshotPackage: 'corestore-snapshot',
    hasLiveStore: !!(store && typeof store === 'object'),
    guestSuspendResume: 'ENOTSUP',
    guestSuspendResumeNote:
      'Kernel guests do not call store.suspend() directly; booter wires hooks when the runtime exposes suspend/resume.',
+    corestoreSnapshotEnvPresent: !!snapRaw,
+    corestoreStatsEnvPresent: !!statsRaw,
+    snapshotManifestKeyCount: snapshotKeyCount,
+    statsNamespacesCount: statsNamespaceCount,
    atMs: Date.now()
  }
 }
@@ -733,6 +733,30 @@ function expandParamBracedInner(inner, env) {
    }
  }

+  const posixUnsetOnly =
+    env &&
+    (env.BARE_OS_SHELL_POSIX_UNSET_ONLY_DEFAULT === '1' ||
+      env.BARE_OS_SHELL_POSIX_UNSET_ONLY_DEFAULT === 'true')
+  if (posixUnsetOnly) {
+    const hy = inner.indexOf('-')
+    if (
+      hy > 0 &&
+      inner.slice(hy - 1, hy + 1) !== ':-' &&
+      !inner.includes(':')
+    ) {
+      const m = /^([A-Za-z_][A-Za-z0-9_]*)-(.+)$/.exec(inner)
+      if (m && m[1] && m[2] != null) {
+        const name = m[1]
+        const alt = m[2]
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+          if (!Object.prototype.hasOwnProperty.call(env, name))
+            return expandWord(alt, env)
+          return String(env[name] ?? '')
+        }
+      }
+    }
+  }
+
  const idx = inner.indexOf(':-')
  if (idx > 0) {
    const name = inner.slice(0, idx).trim()
@@ -2,7 +2,8 @@ import b4a from 'b4a'
 import c from 'compact-encoding'
 import {
  PROTOCOL_NAME,
-  PROTOCOL_APP_CHANNEL_NAME
+  PROTOCOL_APP_CHANNEL_NAME,
+  PROTOCOL_CAP_CHANNEL_NAME
 } from 'bare-os-protocol/constants.js'
 import {
  bareOsHostBooterInfo,
@@ -131,6 +132,8 @@ export class SwarmDisk {
    this.seedProtomuxCapabilityAd = null
    /** Cumulative count of buffers received on optional Protomux app-channel pairs (operator observability). */
    this.protomuxAppChannelRxTotal = 0
+    /** Cumulative count of buffers received on optional Protomux cap-channel pairs (`bare-os-cap-v1`). */
+    this.protomuxCapChannelRxTotal = 0
    /** @type {Record<string, unknown> | null} Host-requested Hyperswarm caps (from env); surfaced on disk.os RPC. */
    this.swarmConnectionBudget = null
    /** @type {Record<string, unknown> | null} */
@@ -432,9 +435,45 @@ export class SwarmDisk {
      })
    }

+    const capChOn =
+      globalThis.process &&
+      globalThis.process.env &&
+      (globalThis.process.env.BARE_OS_PROTOMUX_CAP_CHANNEL === '1' ||
+        globalThis.process.env.BARE_OS_PROTOMUX_CAP_CHANNEL === 'true')
+    if (capChOn) {
+      mux.pair({ protocol: PROTOCOL_CAP_CHANNEL_NAME }, (cchan) => {
+        cchan.addMessage({
+          encoding: c.buffer,
+          onmessage: () => {
+            try {
+              this.protomuxCapChannelRxTotal++
+            } catch {
+              /* ignore */
+            }
+          }
+        })
+        cchan.open()
+      })
+    }
+
    const peer = { chan, mux, socket, id: null }
    this.peers.add(peer)

+    const collabNd =
+      globalThis.process &&
+      globalThis.process.env &&
+      (globalThis.process.env.BARE_OS_COLLAB_SESSION_NDJSON === '1' ||
+        globalThis.process.env.BARE_OS_COLLAB_SESSION_NDJSON === 'true')
+    if (collabNd) {
+      emitSwarmDiskHostLog('info', 'collab_session_peer', {
+        peerCount: this.peers.size,
+        capChannelEnabled: capChOn,
+        appChannelEnabled: appChOn,
+        note:
+          'Host NDJSON preview; mirror to personal-drive tooling off-guest if policy allows.'
+      })
+    }
+
    const setPeerId = () => {
      if (socket.remotePublicKey && !peer.id) {
        peer.id = b4a.toString(socket.remotePublicKey, 'hex')
@@ -360,6 +360,7 @@ export const BARE_OS_PROC_FILE_TO_ID_HYPERCORE_PACK_HRPC_LIFECYCLE = Object.free
 *   procBareOsPearIpcRegistryText?: () => string,
 *   procBareOsInitdDagText?: () => string,
 *   procBareOsBootGraphJsonText?: () => string,
+ *   procBareOsBootBudgetSummaryText?: () => string,
 *   procBareOsMetricsLiveText?: () => string,
 *   procBareOsProcessTableText?: () => string,
 *   procBareOsSyscallsText?: () => string,
@@ -555,6 +556,10 @@ export function createVfs(
    typeof vfsOptions.procBareOsBootGraphJsonText === 'function'
      ? vfsOptions.procBareOsBootGraphJsonText
      : null
+  const procBareOsBootBudgetSummaryText =
+    typeof vfsOptions.procBareOsBootBudgetSummaryText === 'function'
+      ? vfsOptions.procBareOsBootBudgetSummaryText
+      : null
  const procBareOsMetricsLiveText =
    typeof vfsOptions.procBareOsMetricsLiveText === 'function'
      ? vfsOptions.procBareOsMetricsLiveText
@@ -1493,6 +1498,12 @@ export function createVfs(
            })}\n`
        return utf8Encode(t)
      }
+      if (f === 'bare_os_boot_budget_summary') {
+        const t = procBareOsBootBudgetSummaryText
+          ? procBareOsBootBudgetSummaryText()
+          : '{"schema":1,"note":"boot_budget_summary_provider_missing"}\n'
+        return utf8Encode(t)
+      }
      if (f === 'bare_os_metrics_live') {
        const t = procBareOsMetricsLiveText
          ? procBareOsMetricsLiveText()
@@ -1720,6 +1731,10 @@ export function createVfs(
              name: 'boot_graph.json',
              path: '/proc/bare_os/boot_graph.json'
            },
+            {
+              name: 'boot_budget_summary.json',
+              path: '/proc/bare_os/boot_budget_summary.json'
+            },
            {
              name: 'metrics_live.json',
              path: '/proc/bare_os/metrics_live.json'
@@ -2439,6 +2454,7 @@ export function createVfs(
          'pear_ipc.json': 'bare_os_pear_ipc_registry',
          'initd_dag.json': 'bare_os_initd_dag',
          'boot_graph.json': 'bare_os_boot_graph',
+          'boot_budget_summary.json': 'bare_os_boot_budget_summary',
          metrics_live: 'bare_os_metrics_live',
          'metrics_live.json': 'bare_os_metrics_live',
          process_table: 'bare_os_process_table',
@@ -2889,6 +2905,14 @@ export function createVfs(
          file: 'bare_os_boot_graph'
        }
      }
+      if (sub === 'bare_os_boot_budget_summary.json') {
+        return {
+          virtualPseudo: true,
+          kind: 'proc',
+          node: 'file',
+          file: 'bare_os_boot_budget_summary'
+        }
+      }
      if (
        sub === 'bare_os_metrics_live' ||
        sub === 'bare_os_metrics_live.json'
@@ -4157,6 +4181,7 @@ export function createVfs(
          'bare_os_multisig_quorum_pointer.json',
          'bare_os_initd_dag.json',
          'bare_os_boot_graph.json',
+          'bare_os_boot_budget_summary.json',
          'bare_os_initd_graph.json',
          'bare_os_ipc_backpressure.json',
          'bare_os_kernel_program.json',
@@ -4323,6 +4348,7 @@ export function createVfs(
          'index.json',
          'initd_dag.json',
          'boot_graph.json',
+          'boot_budget_summary.json',
          'initd_graph.json',
          'indexer_catchup.json',
          'ipc_backpressure.json',
@@ -1255,7 +1255,7 @@ test('protomux_extensions proc JSON gated by BARE_OS_PROC_PROTOMUX_EXTENSIONS_RE
    ctxApiVersion: BARE_OS_CTX_API_VERSION
  })
  t.is(on.exposed, true)
-  t.is(on.schemaVersion, 3)
+  t.is(on.schemaVersion, 4)
  t.is(on.muxWireMajor, 3)
  t.ok(Array.isArray(on.extensionLogicalChannels))
 })
@@ -1365,7 +1365,10 @@ test('pathnameExpandShellWord caps matches with BARE_OS_GLOB_MAX_MATCHES', async

 test('buildBareOsSyscallsProcJson exposes posixLike fd mapping', async (t) => {
  const j = buildBareOsSyscallsProcJson({ ctxApiVersion: BARE_OS_CTX_API_VERSION })
-  t.is(j.schemaVersion, 10)
+  t.is(j.schemaVersion, 11)
+  const openRow = j.opsDetail.find((r) => r.name === 'open')
+  t.ok(openRow && Array.isArray(openRow.susv4Refs))
+  t.ok(openRow.susv4Refs.includes('XSH/open'))
  t.ok(j.ops.includes('clock_gettime'))
  t.ok(j.posixXsh.namesCsv.includes('clock_gettime'))
  t.ok(j.fdModel && j.fdModel.posixLike && j.fdModel.posixLike.pipe)
@@ -1373,7 +1376,7 @@ test('buildBareOsSyscallsProcJson exposes posixLike fd mapping', async (t) => {
  t.ok(j.fdModel.posixLike.fcntl)
  t.ok(j.fdModel.posixLike.poll)
  t.ok(j.fdModel.posixLike.socketFamily)
-  t.ok(j.posixXsh && j.posixXsh.schema === 2 && j.posixXsh.namesCsv.includes('open'))
+  t.ok(j.posixXsh && j.posixXsh.schema === 3 && j.posixXsh.namesCsv.includes('open'))
  t.ok(j.posixXsh.namesCsv.includes('poll'))
  t.ok(j.posixXsh.namesCsv.includes('select'))
  t.ok(j.posixXsh.namesCsv.includes('umask'))
@@ -1495,10 +1498,11 @@ test('hrpc_allowlist_sketch proc lists stock bareOsHrpcRequest routes', async (t
    {}
  )
  t.is(j.schema, 3)
-  t.is(j.routeTableSchemaVersion, 2)
+  t.is(j.routeTableSchemaVersion, 3)
  t.ok(Array.isArray(j.stockRoutes))
  t.ok(j.stockRoutes.includes('bare_os.replication_snapshot'))
  t.ok(j.stockRoutes.includes('bare_os.search_local'))
+  t.ok(j.stockRoutes.includes('bare_os.pkg_index_get'))
 })

 test('pear_doctor_state proc JSON schema 2 parity fields', async (t) => {
@@ -1569,8 +1573,9 @@ test('disk.os replication_snapshot and replication_operator_sketch RPCs', async
  t.ok(typeof sj.writable === 'boolean')
  const op = await bridge.execRpc('bare_os', 'replication_operator_sketch', [])
  const oj = JSON.parse(op)
-  t.is(oj.schema, 5)
+  t.is(oj.schema, 7)
  t.is(oj.protomuxOperatorSketch?.schema, 2)
+  t.is(oj.corestoreSnapshotUxHint?.schema, 3)
  t.is(oj.seedReplicationStatus?.depth, 1)
  t.is(oj.swarmPeerCount, null)
  const badIntent = await bridge.execRpc(
@@ -2071,6 +2076,7 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_bare_ws_gateway_sketch.json',
    'bare_os_blind_pairing_sketch.json',
    'bare_os_blind_relay_router.json',
+    'bare_os_boot_budget_summary.json',
    'bare_os_boot_graph.json',
    'bare_os_bootstrap',
    'bare_os_brittle_snapshot_ci.json',
@@ -7117,7 +7123,7 @@ test('disk.os replication_operator_sketch mirrors blind v3 and hyperblobs env JS
    })
    const op = await bridge.execRpc('bare_os', 'replication_operator_sketch', [])
    const oj = JSON.parse(op)
-    t.is(oj.schema, 5)
+    t.is(oj.schema, 7)
    t.is(oj.blindTopologySketchV3?.schema, 3)
    t.is(oj.hyperblobsDedupSketch?.chunkCount, 4)
    t.is(oj.corestoreOperatorSketch?.namespaceCount, 2)
@@ -10,8 +10,9 @@ async function run(ctx, argv) {
  const rnd = () =>
    Math.random().toString(36).slice(2, 10) +
    Math.random().toString(36).slice(2, 6)
-  let rel = template || 'tmp.XXXXXX'
-  if (rel.includes('XXXXXX')) rel = rel.replace(/XXXXXX/g, rnd())
+  const sixX = 'X'.repeat(6)
+  let rel = template || `tmp.${sixX}`
+  if (rel.includes(sixX)) rel = rel.replace(new RegExp(sixX, 'g'), rnd())
  else rel = `${rel.replace(/\/+$/, '')}.${rnd()}`
  const full = rel.startsWith('/') ? rel : `/tmp/${rel.replace(/^\/+/, '')}`
  try {
@@ -1,17 +1,23 @@
 /**
- * Verify a path-capability envelope (JSON) using ctx.bareOsVerifyPathCapabilityEnvelope.
+ * Verify a path-capability envelope (JSON) using ctx.bareOsVerifyPathCapabilityEnvelope
+ * or bareOsVerifyPathCapabilityEnvelopeTrusted when --trusted (issuer pubkey allowlist on host).
 * Usage: pathcap-verify FILE.json   (or stdin JSON when FILE is -)
 */
 async function run(ctx, argv) {
  let path = ''
+  let trusted = false
  for (let i = 1; i < argv.length; i++) {
    const a = argv[i]
    if (a === '--help' || a === '-h') {
      ctx.console.log(
-        'usage: pathcap-verify FILE.json\n       pathcap-verify -   (read envelope JSON from stdin)'
+        'usage: pathcap-verify [--trusted] FILE.json\n       pathcap-verify -   (read envelope JSON from stdin)\n       --trusted uses ctx.bareOsVerifyPathCapabilityEnvelopeTrusted + BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX'
      )
      return
    }
+    if (a === '--trusted') {
+      trusted = true
+      continue
+    }
    if (!a.startsWith('-')) {
      path = a
      break
@@ -27,9 +33,16 @@ async function run(ctx, argv) {
    ctx.exitCode = 1
    return
  }
-  if (typeof ctx.bareOsVerifyPathCapabilityEnvelope !== 'function') {
+  const verifyFn = trusted
+    ? ctx.bareOsVerifyPathCapabilityEnvelopeTrusted
+    : ctx.bareOsVerifyPathCapabilityEnvelope
+  if (typeof verifyFn !== 'function') {
    ctx.console.error(
-      'pathcap-verify: ctx.bareOsVerifyPathCapabilityEnvelope missing'
+      'pathcap-verify: ctx.' +
+        (trusted
+          ? 'bareOsVerifyPathCapabilityEnvelopeTrusted'
+          : 'bareOsVerifyPathCapabilityEnvelope') +
+        ' missing'
    )
    ctx.exitCode = 1
    return
@@ -62,7 +75,7 @@ async function run(ctx, argv) {
    ctx.exitCode = 1
    return
  }
-  const r = ctx.bareOsVerifyPathCapabilityEnvelope(env)
+  const r = verifyFn(env)
  if (r.ok) {
    ctx.console.log(
      'ok prefix=' + r.payload.prefix + ' ops=' + r.payload.ops.join(',')
@@ -1,31 +1,117 @@
 /**
- * pkg-swarm-index — document Hyperbee/Hyperdrive package index pattern for P2P-first registries.
- * Prints static guidance; real indexes are built with hyperbee + hyperswarm outside this utility.
+ * pkg-swarm-index — P2P package index: reads /etc/bare-os/pkg-index.json from VFS
+ * or uses ctx.bareOsHrpcRequest('bare_os','pkg_index_get', { key }) when available.
 */
+async function readPkgIndexFromVfs(ctx) {
+  const buf = await ctx.vfs.readFile('/etc/bare-os/pkg-index.json')
+  if (!buf || !buf.byteLength) return null
+  return JSON.parse(ctx.b4a.toString(buf))
+}
+
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {string} key
+ */
+async function pkgIndexLookup(ctx, key) {
+  if (typeof ctx.bareOsHrpcRequest === 'function') {
+    try {
+      const r = await ctx.bareOsHrpcRequest('bare_os', 'pkg_index_get', {
+        key: key || ''
+      })
+      if (r && r.ok && r.json && typeof r.json === 'object') return r.json
+    } catch {
+      /* fall through */
+    }
+  }
+  const j = await readPkgIndexFromVfs(ctx)
+  if (!j || typeof j !== 'object') {
+    return { ok: false, reason: 'no_index' }
+  }
+  const pkgs =
+    j.packages && typeof j.packages === 'object'
+      ? /** @type {Record<string, unknown>} */ (j.packages)
+      : {}
+  const k = String(key || '').trim()
+  if (!k) {
+    return {
+      ok: true,
+      path: '/etc/bare-os/pkg-index.json',
+      keys: Object.keys(pkgs).slice(0, 512)
+    }
+  }
+  const ent = Object.prototype.hasOwnProperty.call(pkgs, k) ? pkgs[k] : null
+  return {
+    ok: ent != null,
+    path: '/etc/bare-os/pkg-index.json',
+    key: k,
+    entry: ent
+  }
+}
+
 async function run(ctx, argv) {
  const topic = String(
    (ctx.env && ctx.env.BARE_OS_PKG_SWARM_TOPIC_HEX) || ''
  ).trim()
+  let sub = 'help'
+  let keyArg = ''
  for (let i = 1; i < argv.length; i++) {
-    if (argv[i] === '--help' || argv[i] === '-h') {
-      ctx.console.log(`pkg-swarm-index — P2P package index notes for Bare OS
+    const a = argv[i]
+    if (a === '--help' || a === '-h') {
+      sub = 'help'
+      break
+    }
+    if (a === 'list' || a === 'get') {
+      sub = a
+      continue
+    }
+    if (!a.startsWith('-') && !keyArg) {
+      keyArg = a
+      continue
+    }
+    ctx.console.error('pkg-swarm-index: unknown option ' + a)
+    ctx.exitCode = 1
+    return
+  }
+  if (sub === 'help' || argv.length < 2) {
+    ctx.console.log(`pkg-swarm-index — P2P package index (drive manifest + HRPC)

-Set BARE_OS_PKG_SWARM_TOPIC_HEX (64 hex chars) to pin a swarm topic class for index peers.
+usage:
+  pkg-swarm-index list              # list package keys (VFS or bare_os.pkg_index_get)
+  pkg-swarm-index get <name@ver>    # one entry
+  pkg-swarm-index --help

-Architecture (operators):
-  • Writers publish signed records: name@version -> { driveKey, manifestHash } in a Hyperbee.
-  • Readers join the hyperswarm topic, replicate the feed, verify Ed25519 signatures against boot policy.
-  • See handbook § P2P-native package index (experimental) and kernel/etc/bare-os/hyperbee-index-hint.example.json.
+Environment:
+  BARE_OS_PKG_SWARM_TOPIC_HEX — optional 64-hex topic class for index peers.
+  Manifest path override on host: BARE_OS_PKG_INDEX_PATH (disk.os + HRPC).

-${topic ? 'Current BARE_OS_PKG_SWARM_TOPIC_HEX prefix: ' + topic.slice(0, 16) + '…' : 'BARE_OS_PKG_SWARM_TOPIC_HEX is unset (documentation mode).'}
+See kernel/etc/bare-os/pkg-index.example.json and handbook ch.9.
+${topic ? 'Topic pin prefix: ' + topic.slice(0, 16) + '…' : 'Topic pin unset.'}
 `)
    return
  }
+  try {
+    if (sub === 'list') {
+      const r = await pkgIndexLookup(ctx, '')
+      ctx.console.log(JSON.stringify(r, null, 2))
+      return
    }
-  ctx.console.log(
-    'pkg-swarm-index: P2P registry pattern — use `pkg-swarm-index --help`. ' +
-      (topic
-        ? 'Topic pin active (' + topic.slice(0, 12) + '…).'
-        : 'No topic pin (set BARE_OS_PKG_SWARM_TOPIC_HEX).')
+    if (sub === 'get') {
+      if (!keyArg) {
+        ctx.console.error('pkg-swarm-index: get requires name@version')
+        ctx.exitCode = 1
+        return
+      }
+      const r = await pkgIndexLookup(ctx, keyArg)
+      ctx.console.log(JSON.stringify(r, null, 2))
+      if (!r.ok) ctx.exitCode = 1
+      return
+    }
+  } catch (e) {
+    ctx.console.error(
+      'pkg-swarm-index: ' + ((e && e.message) || String(e))
    )
+    ctx.exitCode = 1
  }
+}
+
+export { run }
@@ -4,6 +4,7 @@ Cross-package **version alignment** (ctx API, feature-bits doc, lifecycle schema

 ## Documentation (rolling)

+- **`0.9.1` / `BARE_OS_KERNEL_FEATURE_BITS_DOC` `16`** — Protomux cap-channel constant (**`PROTOCOL_CAP_CHANNEL_NAME`**) + **`BARE_OS_FEATURE8_PROTOMUX_CAP_CHANNEL`** documentation bump (stock **`bare-os-booter`** surfaces); **`stock-booter-capability-contract.json`** **`expectedFeatureBitsDoc`** aligned.
 - **Wire stack pins** — Re-verified **2026-04-05**: root **`package-lock.json`** hoisted **`protomux`** / **`hyperswarm`** versions still match [`packages/bare-os-booter/fixtures/protomux-hyperswarm-lock.json`](../packages/bare-os-booter/fixtures/protomux-hyperswarm-lock.json) (**`BARE_OS_PROTOMUX_CHANNEL_SCHEMA_VERSION`** unchanged).
 - **`BARE_OS_POSIX_PROFILE_VERSION` `1.0.15`** — Multi-account personal layout (**`BARE_OS_PERSONAL_ACCT_PREFIX`**), scoped **`/.bare/**`** routing, **`clock_gettime`**-shaped **`ctx.bareOsSyscall`** / proc **`syscalls.json` schema 9**, stock **`hrpc`** routes **`bare_os.replication_operator_sketch`** + **`bare_os.replication_snapshot`**, **`hyper_multisig_trust_pointer` proc schema 2** (**`BARE_OS_VAULT_MULTISIG_CONTINUITY_JSON`**), and related matrix / handbook alignment (see [`bare-os-posix-profile.js`](lib/bare-os-posix-profile.js), [`docs/reference/posix-compliance-matrix.json`](../../docs/reference/posix-compliance-matrix.json), [`docs/architecture/POSIX_DECLARED_PROFILE.md`](../../docs/architecture/POSIX_DECLARED_PROFILE.md)).
 - **`BARE_OS_POSIX_PROFILE_VERSION` `1.0.14`** — Declared profile + `posixXsh` proc note aligned with **`socketMsgSurface` schema 4** (logical **`scmRightsLocalDup`** path); optional bridge **`SO_RCVBUF`/`SO_SNDBUF`** when Bare sockets expose sizes; optional **`BARE_OS_SHELL_READ_BUILTIN`**; expanded dynamic **`sysconf`**; Wasm **`bare_os_monotonic_ms`**; replication snapshot hint schema; blind-relay / hyperbee proc alignment; **`mq_*`** priority POSIX ordering; fcntl FIFO contention tests; peer admission audit tests; boot budget / warm-cache telemetry (see [`bare-os-posix-profile.js`](lib/bare-os-posix-profile.js), [`docs/reference/posix-compliance-matrix.json`](../../docs/reference/posix-compliance-matrix.json), [`docs/architecture/POSIX_DECLARED_PROFILE.md`](../../docs/architecture/POSIX_DECLARED_PROFILE.md)).
@@ -5,6 +5,8 @@ export const PROTOCOL_NAME = 'bare-os-v1'
 export const TOPIC_STRING = 'bare-os-v1'
 /** Optional second Protomux channel for app-level RPC (paired when `BARE_OS_PROTOMUX_APP_CHANNEL` is set). */
 export const PROTOCOL_APP_CHANNEL_NAME = 'bare-os-app-v1'
+/** Optional capability/datagram side channel (paired when `BARE_OS_PROTOMUX_CAP_CHANNEL` is set). */
+export const PROTOCOL_CAP_CHANNEL_NAME = 'bare-os-cap-v1'
 export const BLOCK_SIZE = 512
 export const MBR_MAGIC = b4a.from('BIOS')

@@ -1,6 +1,7 @@
 export {
  PROTOCOL_NAME,
  PROTOCOL_APP_CHANNEL_NAME,
+  PROTOCOL_CAP_CHANNEL_NAME,
  TOPIC_STRING,
  BLOCK_SIZE,
  MBR_MAGIC,
@@ -164,6 +165,7 @@ export {
  BARE_OS_FEATURE8_TELEMETRY_AUDIT,
  BARE_OS_FEATURE8_DOC_CI_CONTRACTS,
  BARE_OS_FEATURE8_HTTP_DHT_PROXY_ROUTES,
+  BARE_OS_FEATURE8_PROTOMUX_CAP_CHANNEL,
  BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_MODULE_CRYPTO_STAGING,
  BARE_OS_FEATURE9_CAP_WORD,
  BARE_OS_FEATURE9_SEED_RPC_EXTENDED,
@@ -4,7 +4,7 @@
 */

 /** Semver for the documented POSIX-like surface (handbook ch.9 + environment appendix). */
-export const BARE_OS_POSIX_PROFILE_VERSION = '1.0.16'
+export const BARE_OS_POSIX_PROFILE_VERSION = '1.0.17'

 /** Short identifier for telemetry and `/proc` mirrors. */
 export const BARE_OS_POSIX_PROFILE_ID = 'bare-os-posix-like'
@@ -4,7 +4,7 @@
 */

 /** Protocol document version for this bitmask file (bump when bit semantics, wire shape, or governance changes). */
-export const BARE_OS_KERNEL_FEATURE_BITS_DOC = 15
+export const BARE_OS_KERNEL_FEATURE_BITS_DOC = 16

 /**
 * Second capability word (bits 0–31, always use `>>> 0` when masking).
@@ -411,6 +411,8 @@ export const BARE_OS_FEATURE8_TELEMETRY_AUDIT = 1 << 10
 export const BARE_OS_FEATURE8_DOC_CI_CONTRACTS = 1 << 11
 /** Word8 bit 12: Seed RPC `http_dht_proxy_routes` revision surface. */
 export const BARE_OS_FEATURE8_HTTP_DHT_PROXY_ROUTES = 1 << 12
+/** Word8 bit 13: Protomux `bare-os-cap-v1` side channel (`BARE_OS_PROTOMUX_CAP_CHANNEL`). */
+export const BARE_OS_FEATURE8_PROTOMUX_CAP_CHANNEL = 1 << 13

 /** Stock booter eighth word (word 8). */
 export const BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_RUNTIME_PROTO_MUX =
@@ -426,7 +428,8 @@ export const BARE_OS_KERNEL_FEATURES_STOCK_WORD_BARE_RUNTIME_PROTO_MUX =
  BARE_OS_FEATURE8_WORKER_NET |
  BARE_OS_FEATURE8_TELEMETRY_AUDIT |
  BARE_OS_FEATURE8_DOC_CI_CONTRACTS |
-  BARE_OS_FEATURE8_HTTP_DHT_PROXY_ROUTES
+  BARE_OS_FEATURE8_HTTP_DHT_PROXY_ROUTES |
+  BARE_OS_FEATURE8_PROTOMUX_CAP_CHANNEL

 /**
 * Ninth capability word (bits 0–31, use `>>> 0`). Capability word 9 capability-word program — ADR 001 §12.
@@ -2,4 +2,4 @@
 * Published package version string for seed-channel handshake (keep in sync with package.json).
 * @type {string}
 */
-export const BARE_OS_PROTOCOL_PACKAGE_VERSION = '0.9.0'
+export const BARE_OS_PROTOCOL_PACKAGE_VERSION = '0.9.1'
@@ -1,7 +1,7 @@
 {
  "schema": 1,
  "note": "Single list of stock kernel capability symbols CI must find in booter index.js and kernel-feature-bits.js. Edit verify-ctx-api-feature-bits.mjs when extending.",
-  "expectedFeatureBitsDoc": 15,
+  "expectedFeatureBitsDoc": 16,
  "requiredBitsExports": [
    "BARE_OS_KERNEL_FEATURES_STOCK_WORD_PRIMARY",
    "BARE_OS_KERNEL_FEATURES_STOCK_WORD_EXTENDED_SEEDING_PLATFORM",
@@ -1,6 +1,6 @@
 {
  "name": "bare-os-protocol",
-  "version": "0.9.0",
+  "version": "0.9.1",
  "description": "MBR layout, swarm topic, and Protomux encodings for bare-operating-system",
  "type": "module",
  "main": "./index.js",
@@ -7,7 +7,8 @@ import {
  parseMbr,
  BLOCK_SIZE,
  TOPIC_STRING,
-  PROTOCOL_APP_CHANNEL_NAME
+  PROTOCOL_APP_CHANNEL_NAME,
+  PROTOCOL_CAP_CHANNEL_NAME
 } from './constants.js'
 import {
  BARE_OS_SEED_RPC_METHOD_SHORT_NAMES,
@@ -81,6 +82,10 @@ test('PROTOCOL_APP_CHANNEL_NAME is bare-os-app-v1', (t) => {
  t.is(PROTOCOL_APP_CHANNEL_NAME, 'bare-os-app-v1')
 })

+test('PROTOCOL_CAP_CHANNEL_NAME is bare-os-cap-v1', (t) => {
+  t.is(PROTOCOL_CAP_CHANNEL_NAME, 'bare-os-cap-v1')
+})
+
 test('TOPIC_STRING is bare-os-v1', (t) => {
  t.is(TOPIC_STRING, 'bare-os-v1')
 })
@@ -99,8 +99,9 @@ async function run(ctx, argv) {
  const rnd = () =>
    Math.random().toString(36).slice(2, 10) +
    Math.random().toString(36).slice(2, 6)
-  let rel = template || 'tmp.XXXXXX'
-  if (rel.includes('XXXXXX')) rel = rel.replace(/XXXXXX/g, rnd())
+  const sixX = 'X'.repeat(6)
+  let rel = template || `tmp.${sixX}`
+  if (rel.includes(sixX)) rel = rel.replace(new RegExp(sixX, 'g'), rnd())
  else rel = `${rel.replace(/\/+$/, '')}.${rnd()}`
  const full = rel.startsWith('/') ? rel : `/tmp/${rel.replace(/^\/+/, '')}`
  try {
@@ -88,19 +88,25 @@ function bareOsEmitRaw(ctx, chunk) {
 }

 /**
- * Verify a path-capability envelope (JSON) using ctx.bareOsVerifyPathCapabilityEnvelope.
+ * Verify a path-capability envelope (JSON) using ctx.bareOsVerifyPathCapabilityEnvelope
+ * or bareOsVerifyPathCapabilityEnvelopeTrusted when --trusted (issuer pubkey allowlist on host).
 * Usage: pathcap-verify FILE.json   (or stdin JSON when FILE is -)
 */
 async function run(ctx, argv) {
  let path = ''
+  let trusted = false
  for (let i = 1; i < argv.length; i++) {
    const a = argv[i]
    if (a === '--help' || a === '-h') {
      ctx.console.log(
-        'usage: pathcap-verify FILE.json\n       pathcap-verify -   (read envelope JSON from stdin)'
+        'usage: pathcap-verify [--trusted] FILE.json\n       pathcap-verify -   (read envelope JSON from stdin)\n       --trusted uses ctx.bareOsVerifyPathCapabilityEnvelopeTrusted + BARE_OS_PATH_CAPABILITY_TRUSTED_PUBKEYS_HEX'
      )
      return
    }
+    if (a === '--trusted') {
+      trusted = true
+      continue
+    }
    if (!a.startsWith('-')) {
      path = a
      break
@@ -116,9 +122,16 @@ async function run(ctx, argv) {
    ctx.exitCode = 1
    return
  }
-  if (typeof ctx.bareOsVerifyPathCapabilityEnvelope !== 'function') {
+  const verifyFn = trusted
+    ? ctx.bareOsVerifyPathCapabilityEnvelopeTrusted
+    : ctx.bareOsVerifyPathCapabilityEnvelope
+  if (typeof verifyFn !== 'function') {
    ctx.console.error(
-      'pathcap-verify: ctx.bareOsVerifyPathCapabilityEnvelope missing'
+      'pathcap-verify: ctx.' +
+        (trusted
+          ? 'bareOsVerifyPathCapabilityEnvelopeTrusted'
+          : 'bareOsVerifyPathCapabilityEnvelope') +
+        ' missing'
    )
    ctx.exitCode = 1
    return
@@ -151,7 +164,7 @@ async function run(ctx, argv) {
    ctx.exitCode = 1
    return
  }
-  const r = ctx.bareOsVerifyPathCapabilityEnvelope(env)
+  const r = verifyFn(env)
  if (r.ok) {
    ctx.console.log(
      'ok prefix=' + r.payload.prefix + ' ops=' + r.payload.ops.join(',')
@@ -88,33 +88,119 @@ function bareOsEmitRaw(ctx, chunk) {
 }

 /**
- * pkg-swarm-index — document Hyperbee/Hyperdrive package index pattern for P2P-first registries.
- * Prints static guidance; real indexes are built with hyperbee + hyperswarm outside this utility.
+ * pkg-swarm-index — P2P package index: reads /etc/bare-os/pkg-index.json from VFS
+ * or uses ctx.bareOsHrpcRequest('bare_os','pkg_index_get', { key }) when available.
 */
+async function readPkgIndexFromVfs(ctx) {
+  const buf = await ctx.vfs.readFile('/etc/bare-os/pkg-index.json')
+  if (!buf || !buf.byteLength) return null
+  return JSON.parse(ctx.b4a.toString(buf))
+}
+
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {string} key
+ */
+async function pkgIndexLookup(ctx, key) {
+  if (typeof ctx.bareOsHrpcRequest === 'function') {
+    try {
+      const r = await ctx.bareOsHrpcRequest('bare_os', 'pkg_index_get', {
+        key: key || ''
+      })
+      if (r && r.ok && r.json && typeof r.json === 'object') return r.json
+    } catch {
+      /* fall through */
+    }
+  }
+  const j = await readPkgIndexFromVfs(ctx)
+  if (!j || typeof j !== 'object') {
+    return { ok: false, reason: 'no_index' }
+  }
+  const pkgs =
+    j.packages && typeof j.packages === 'object'
+      ? /** @type {Record<string, unknown>} */ (j.packages)
+      : {}
+  const k = String(key || '').trim()
+  if (!k) {
+    return {
+      ok: true,
+      path: '/etc/bare-os/pkg-index.json',
+      keys: Object.keys(pkgs).slice(0, 512)
+    }
+  }
+  const ent = Object.prototype.hasOwnProperty.call(pkgs, k) ? pkgs[k] : null
+  return {
+    ok: ent != null,
+    path: '/etc/bare-os/pkg-index.json',
+    key: k,
+    entry: ent
+  }
+}
+
 async function run(ctx, argv) {
  const topic = String(
    (ctx.env && ctx.env.BARE_OS_PKG_SWARM_TOPIC_HEX) || ''
  ).trim()
+  let sub = 'help'
+  let keyArg = ''
  for (let i = 1; i < argv.length; i++) {
-    if (argv[i] === '--help' || argv[i] === '-h') {
-      ctx.console.log(`pkg-swarm-index — P2P package index notes for Bare OS
+    const a = argv[i]
+    if (a === '--help' || a === '-h') {
+      sub = 'help'
+      break
+    }
+    if (a === 'list' || a === 'get') {
+      sub = a
+      continue
+    }
+    if (!a.startsWith('-') && !keyArg) {
+      keyArg = a
+      continue
+    }
+    ctx.console.error('pkg-swarm-index: unknown option ' + a)
+    ctx.exitCode = 1
+    return
+  }
+  if (sub === 'help' || argv.length < 2) {
+    ctx.console.log(`pkg-swarm-index — P2P package index (drive manifest + HRPC)

-Set BARE_OS_PKG_SWARM_TOPIC_HEX (64 hex chars) to pin a swarm topic class for index peers.
+usage:
+  pkg-swarm-index list              # list package keys (VFS or bare_os.pkg_index_get)
+  pkg-swarm-index get <name@ver>    # one entry
+  pkg-swarm-index --help

-Architecture (operators):
-  • Writers publish signed records: name@version -> { driveKey, manifestHash } in a Hyperbee.
-  • Readers join the hyperswarm topic, replicate the feed, verify Ed25519 signatures against boot policy.
-  • See handbook § P2P-native package index (experimental) and kernel/etc/bare-os/hyperbee-index-hint.example.json.
+Environment:
+  BARE_OS_PKG_SWARM_TOPIC_HEX — optional 64-hex topic class for index peers.
+  Manifest path override on host: BARE_OS_PKG_INDEX_PATH (disk.os + HRPC).

-${topic ? 'Current BARE_OS_PKG_SWARM_TOPIC_HEX prefix: ' + topic.slice(0, 16) + '…' : 'BARE_OS_PKG_SWARM_TOPIC_HEX is unset (documentation mode).'}
+See kernel/etc/bare-os/pkg-index.example.json and handbook ch.9.
+${topic ? 'Topic pin prefix: ' + topic.slice(0, 16) + '…' : 'Topic pin unset.'}
 `)
    return
  }
+  try {
+    if (sub === 'list') {
+      const r = await pkgIndexLookup(ctx, '')
+      ctx.console.log(JSON.stringify(r, null, 2))
+      return
    }
-  ctx.console.log(
-    'pkg-swarm-index: P2P registry pattern — use `pkg-swarm-index --help`. ' +
-      (topic
-        ? 'Topic pin active (' + topic.slice(0, 12) + '…).'
-        : 'No topic pin (set BARE_OS_PKG_SWARM_TOPIC_HEX).')
+    if (sub === 'get') {
+      if (!keyArg) {
+        ctx.console.error('pkg-swarm-index: get requires name@version')
+        ctx.exitCode = 1
+        return
+      }
+      const r = await pkgIndexLookup(ctx, keyArg)
+      ctx.console.log(JSON.stringify(r, null, 2))
+      if (!r.ok) ctx.exitCode = 1
+      return
+    }
+  } catch (e) {
+    ctx.console.error(
+      'pkg-swarm-index: ' + ((e && e.message) || String(e))
    )
+    ctx.exitCode = 1
  }
+}
+
+export { run }
@@ -0,0 +1,12 @@
+{
+  "schema": 1,
+  "note": "Multisig-gated kernel update stream: replicate candidate /boot/init.js bytes via swarm; verify quorum before boot policy accepts requireInitJsSha256.",
+  "initJsSha256Hex": "hex sha256 of candidate /boot/init.js raw bytes",
+  "signersQuorum": {
+    "signers": ["ed25519_pubkey_hex..."],
+    "quorum": 2
+  },
+  "swarmTopicClassHex": "optional 64-hex topic class for kernel-stream peers",
+  "validFromMs": 0,
+  "validToMs": null
+}
@@ -0,0 +1,12 @@
+{
+  "schema": 1,
+  "note": "Static P2P package manifest on the system Hyperdrive. Hyperbee replication is a separate concern; operators merge signed rows into this JSON during image builds.",
+  "topicClassHex": "optional 64-hex swarm topic class for index peers (see BARE_OS_PKG_SWARM_TOPIC_HEX)",
+  "packages": {
+    "[email protected]": {
+      "driveKeyHex": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+      "manifestSha256Hex": "optional content hash of package root",
+      "publisherPubkeyHex": "optional ed25519 pubkey that signed this row"
+    }
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema": 2,
  "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-05T19:26:42.531Z",
+  "generatedAt": "2026-04-05T19:51:45.278Z",
  "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
  "commandIndex": [
    {
@@ -1,9 +1,9 @@
 {
-  "schemaVersion": 10,
-  "ctxApiVersion": "1.52.0",
+  "schemaVersion": 11,
+  "ctxApiVersion": "1.53.0",
  "posixProfile": {
    "id": "bare-os-posix-like",
-    "version": "1.0.15"
+    "version": "1.0.17"
  },
  "ops": ["readFile", "writeFile", "socket"],
  "opsDetail": [
@@ -15,7 +15,8 @@
      "stability": "stable",
      "posixAlignment": "simulated",
      "mapsTo": ["vfs.readFile", "vfs.writeFile"],
-      "errnoHint": "ENOENT"
+      "errnoHint": "ENOENT",
+      "susv4Refs": ["XSH/open"]
    },
    {
      "name": "socket",
@@ -27,7 +28,7 @@
    }
  ],
  "posixXsh": {
-    "schema": 2,
+    "schema": 3,
    "note": "POSIX.1 XSH-style names; socket bridge may implement SOCK_DGRAM sendmsg/recvmsg when BARE_OS_POSIX_SOCKET_FD_BRIDGE.",
    "namesCsv": "open,close,read,write,readv,writev,getsockopt,setsockopt,lseek,nanosleep,clock_gettime,pipe,dup,dup2,fcntl,poll,select,umask,socket,bind,listen,accept,connect,send,recv,recvfrom,sendmsg,recvmsg,shutdown"
  },
@@ -3752,6 +3752,43 @@ async function runKernelSelftest(ctx) {
 * @param {number} bootT0
 * @param {string[]} stageLog
 */
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {number} bootT0
+ * @param {{ kind: string, code: string, wallMs: number, limitMs: number }[]} violations
+ * @param {boolean} coldExceeded
+ * @param {boolean} stdlibExceeded
+ */
+async function maybeWriteBootBudgetSummaryJson(
+  ctx,
+  bootT0,
+  violations,
+  coldExceeded,
+  stdlibExceeded
+) {
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.writeFile !== 'function' || !b4) return
+  const wall = Date.now() - bootT0
+  const row =
+    JSON.stringify({
+      schema: 1,
+      atMs: Date.now(),
+      coldWallMs: wall,
+      coldExceeded,
+      bareStdlibExceeded: stdlibExceeded,
+      violationCodes: violations.map((v) => v.code).filter(Boolean),
+      violations,
+      procHint: '/proc/bare_os/boot_budget_summary.json',
+      note: 'Written every boot; operators mirror into proc via booter VFS provider.'
+    }) + '\n'
+  try {
+    await vfs.writeFile('/run/bare-os/boot-budget-summary.json', b4.from(row))
+  } catch {
+    /* optional */
+  }
+}
+
 async function maybeWriteBootPerfJson(ctx, bootT0, stageLog) {
  const vfs = ctx.vfs
  const b4 = ctx.b4a
@@ -4171,6 +4208,8 @@ async function start(ctx) {
    }
  }
  {
+    /** @type {{ kind: string, code: string, wallMs: number, limitMs: number }[]} */
+    let bootBudgetViolationsForSummary = []
    const budgetStrict =
      ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === '1' ||
      ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === 'true'
@@ -4225,11 +4264,12 @@ async function start(ctx) {
      }
    }
    if (coldExceeded || stdlibExceeded) {
-      /** @type {{ kind: string, wallMs: number, limitMs: number }[]} */
+      /** @type {{ kind: string, code: string, wallMs: number, limitMs: number }[]} */
      const violations = []
      if (coldExceeded && Number.isFinite(budget) && budget > 0) {
        violations.push({
          kind: 'cold',
+          code: 'BARE_OS_BOOT_BUDGET_COLD_EXCEEDED',
          wallMs: Date.now() - bootT0,
          limitMs: budget
        })
@@ -4241,6 +4281,7 @@ async function start(ctx) {
        )
        violations.push({
          kind: 'bare_stdlib',
+          code: 'BARE_OS_BOOT_BUDGET_BARE_STDLIB_EXCEEDED',
          wallMs: Number.isFinite(sw) ? sw : 0,
          limitMs: sb
        })
@@ -4258,7 +4299,15 @@ async function start(ctx) {
        bootBudgetViolations: violations,
        transactionState: BARE_OS_BOOT_TXN_STATE.STAGE_COMMITTED
      })
+      bootBudgetViolationsForSummary = violations
    }
+    await maybeWriteBootBudgetSummaryJson(
+      ctx,
+      bootT0,
+      bootBudgetViolationsForSummary,
+      coldExceeded,
+      stdlibExceeded
+    )
    if (budgetStrict && polStrict && (coldExceeded || stdlibExceeded)) {
      bootStructuredLog(
        ctx,
@@ -1,12 +1,6 @@
 {
  "version": 1,
  "bundles": [
-    {
-      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
-      "keys": [
-        "hypercoreIdEncoding"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/b4a.js",
      "keys": [
@@ -19,6 +13,12 @@
        "safetyCatch"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
+      "keys": [
+        "hypercoreIdEncoding"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/compactEncoding.js",
      "keys": [
@@ -38,9 +38,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/barePath.js",
+      "path": "/lib/bare/bundles/bareEncoding.js",
      "keys": [
-        "barePath"
+        "bareEncoding"
      ]
    },
    {
@@ -50,9 +50,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareEncoding.js",
+      "path": "/lib/bare/bundles/barePath.js",
      "keys": [
-        "bareEncoding"
+        "barePath"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareAbort.js",
+      "keys": [
+        "bareAbort"
      ]
    },
    {
@@ -62,9 +68,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareAbort.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
      "keys": [
-        "bareAbort"
+        "bareAnsiEscapes"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
      ]
    },
    {
@@ -80,33 +92,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareCrypto.js",
+      "path": "/lib/bare/bundles/bareAsyncHooks.js",
      "keys": [
-        "bareCrypto"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/fetch.js",
-      "keys": [
-        "fetch"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareAppKit.js",
-      "keys": [
-        "bareAppKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareApk.js",
-      "keys": [
-        "bareApk"
+        "bareAsyncHooks"
      ]
    },
    {
@@ -115,12 +103,6 @@
        "bareAtomics"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareAsyncHooks.js",
-      "keys": [
-        "bareAsyncHooks"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareAssert.js",
      "keys": [
@@ -128,9 +110,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareBluetoothApple.js",
+      "path": "/lib/bare/bundles/bareAppKit.js",
      "keys": [
-        "bareBluetoothApple"
+        "bareAppKit"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareApk.js",
+      "keys": [
+        "bareApk"
      ]
    },
    {
@@ -139,6 +133,12 @@
        "bareBmp"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "keys": [
+        "bareBundleCompile"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareBuffer.js",
      "keys": [
@@ -152,15 +152,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "path": "/lib/bare/bundles/bareBluetoothApple.js",
      "keys": [
-        "bareBundleCompile"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareBoot.js",
-      "keys": [
-        "bareBoot"
+        "bareBluetoothApple"
      ]
    },
    {
@@ -169,18 +163,6 @@
        "bareBundleEvaluate"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareBundleId.js",
-      "keys": [
-        "bareBundleId"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareConsole.js",
      "keys": [
@@ -188,9 +170,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareDaemon.js",
+      "path": "/lib/bare/bundles/bareBoot.js",
      "keys": [
-        "bareDaemon"
+        "bareBoot"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareBundleId.js",
+      "keys": [
+        "bareBundleId"
      ]
    },
    {
@@ -200,15 +188,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareDelta.js",
+      "path": "/lib/bare/bundles/bareDebugLog.js",
      "keys": [
-        "bareDelta"
+        "bareDebugLog"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareCov.js",
+      "path": "/lib/bare/bundles/bareDaemon.js",
      "keys": [
-        "bareCov"
+        "bareDaemon"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDelta.js",
+      "keys": [
+        "bareDelta"
      ]
    },
    {
@@ -229,12 +223,6 @@
        "bareEnv"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareDgram.js",
-      "keys": [
-        "bareDgram"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareExif.js",
      "keys": [
@@ -242,9 +230,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareFfmpeg.js",
+      "path": "/lib/bare/bundles/bareDgram.js",
      "keys": [
-        "bareFfmpeg"
+        "bareDgram"
      ]
    },
    {
@@ -253,6 +241,12 @@
        "bareFfmpegEncodings"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFfmpeg.js",
+      "keys": [
+        "bareFfmpeg"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareFormData.js",
      "keys": [
@@ -260,9 +254,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareGif.js",
+      "path": "/lib/bare/bundles/bareCov.js",
      "keys": [
-        "bareGif"
+        "bareCov"
      ]
    },
    {
@@ -278,21 +272,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareGif.js",
      "keys": [
-        "bareHeif"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFs.js",
-      "keys": [
-        "bareFs"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
+        "bareGif"
      ]
    },
    {
@@ -301,6 +283,18 @@
        "bareGtk"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHrtime.js",
+      "keys": [
+        "bareHrtime"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareHttpParser.js",
      "keys": [
@@ -313,6 +307,12 @@
        "bareIco"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFs.js",
+      "keys": [
+        "bareFs"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareImageResample.js",
      "keys": [
@@ -337,30 +337,24 @@
        "bareHttps"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareIntl.js",
-      "keys": [
-        "bareIntl"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareJpeg.js",
      "keys": [
        "bareJpeg"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareIpc.js",
      "keys": [
        "bareIpc"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareLief.js",
      "keys": [
@@ -368,9 +362,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareLink.js",
+      "path": "/lib/bare/bundles/bareInspector.js",
      "keys": [
-        "bareLink"
+        "bareInspector"
      ]
    },
    {
@@ -379,6 +373,18 @@
        "bareLogger"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareModuleLexer.js",
+      "keys": [
+        "bareModuleLexer"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareLink.js",
+      "keys": [
+        "bareLink"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareMake.js",
      "keys": [
@@ -391,12 +397,6 @@
        "bareModule"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareModuleLexer.js",
-      "keys": [
-        "bareModuleLexer"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareModuleResolve.js",
      "keys": [
@@ -409,24 +409,12 @@
        "bareModuleTraverse"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareMedia.js",
-      "keys": [
-        "bareMedia"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareNdk.js",
      "keys": [
        "bareNdk"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareNative.js",
      "keys": [
@@ -434,9 +422,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareNet.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
      "keys": [
-        "bareNet"
+        "bareMedia"
      ]
    },
    {
@@ -445,6 +433,12 @@
        "bareNodeFetch"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareOpen.js",
+      "keys": [
+        "bareOpen"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareOs.js",
      "keys": [
@@ -452,9 +446,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareOpen.js",
+      "path": "/lib/bare/bundles/bareNet.js",
      "keys": [
-        "bareOpen"
+        "bareNet"
      ]
    },
    {
@@ -487,18 +481,18 @@
        "barePipe"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
-      "keys": [
-        "bareNodeRuntime"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/barePunycode.js",
      "keys": [
        "barePunycode"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/barePrebuild.js",
      "keys": [
@@ -506,9 +500,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "path": "/lib/bare/bundles/bareProcess.js",
      "keys": [
-        "bareQueueMicrotask"
+        "bareProcess"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
      ]
    },
    {
@@ -517,18 +517,18 @@
        "bareQuerystring"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareProcess.js",
-      "keys": [
-        "bareProcess"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareRealm.js",
      "keys": [
        "bareRealm"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "keys": [
+        "bareQueueMicrotask"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/barePromClient.js",
      "keys": [
@@ -548,9 +548,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareRun.js",
+      "path": "/lib/bare/bundles/bareSemver.js",
      "keys": [
-        "bareRun"
+        "bareSemver"
      ]
    },
    {
@@ -566,9 +566,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSemver.js",
+      "path": "/lib/bare/bundles/bareRun.js",
      "keys": [
-        "bareSemver"
+        "bareRun"
      ]
    },
    {
@@ -577,12 +577,6 @@
        "bareSidecar"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareStorage.js",
-      "keys": [
-        "bareStorage"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareSignals.js",
      "keys": [
@@ -595,12 +589,6 @@
        "bareStream"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareStdio.js",
-      "keys": [
-        "bareStdio"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareStringDecoder.js",
      "keys": [
@@ -608,15 +596,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareStorage.js",
      "keys": [
-        "bareSvg"
+        "bareStorage"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTap.js",
+      "path": "/lib/bare/bundles/bareStdio.js",
      "keys": [
-        "bareTap"
+        "bareStdio"
      ]
    },
    {
@@ -626,9 +614,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareSvg.js",
      "keys": [
-        "bareSystemLogger"
+        "bareSvg"
      ]
    },
    {
@@ -638,15 +626,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTiff.js",
+      "path": "/lib/bare/bundles/bareTap.js",
      "keys": [
-        "bareTiff"
+        "bareTap"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareThread.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
      "keys": [
-        "bareThread"
+        "bareSystemLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTiff.js",
+      "keys": [
+        "bareTiff"
      ]
    },
    {
@@ -662,9 +656,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareThread.js",
      "keys": [
-        "bareTls"
+        "bareThread"
      ]
    },
    {
@@ -691,6 +685,12 @@
        "bareTty"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareTls.js",
+      "keys": [
+        "bareTls"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareUnpack.js",
      "keys": [
@@ -709,30 +709,24 @@
        "bareUnionBundle"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareVm.js",
-      "keys": [
-        "bareVm"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWalkHandles.js",
      "keys": [
        "bareWalkHandles"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
-      "keys": [
-        "bareV8ToIstanbul"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWebKit.js",
      "keys": [
        "bareWebKit"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareVm.js",
+      "keys": [
+        "bareVm"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareUtils.js",
      "keys": [
@@ -746,9 +740,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareWebKitGtk.js",
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
      "keys": [
-        "bareWebKitGtk"
+        "bareV8ToIstanbul"
      ]
    },
    {
@@ -764,15 +758,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareXdiff.js",
+      "path": "/lib/bare/bundles/bareWebKitGtk.js",
      "keys": [
-        "bareXdiff"
+        "bareWebKitGtk"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareZlib.js",
+      "path": "/lib/bare/bundles/bareXdiff.js",
      "keys": [
-        "bareZlib"
+        "bareXdiff"
      ]
    },
    {
@@ -782,9 +776,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareWorker.js",
+      "path": "/lib/bare/bundles/bareZlib.js",
      "keys": [
-        "bareWorker"
+        "bareZlib"
      ]
    },
    {
@@ -792,6 +786,12 @@
      "keys": [
        "bareWs"
      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWorker.js",
+      "keys": [
+        "bareWorker"
+      ]
    }
  ],
  "bundleStats": {
@@ -1595,8 +1595,8 @@
  ],
  "bundleProvenance": {
    "schemaVersion": 1,
-    "generatedAt": "2026-04-05T19:26:43.551Z",
-    "gitCommit": "169df862f7c3579c6eb28d62c3a6b05ab38ef0f5",
+    "generatedAt": "2026-04-05T19:51:46.168Z",
+    "gitCommit": "41526508dfb1685082082fe797151a745a821262",
    "nodeVersion": "v22.22.0",
    "bundleTier": "all",
    "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",
@@ -1,6 +1,6 @@
 {
  "schema": 1,
-  "atMs": 1775417202531,
+  "atMs": 1775418705277,
  "commands": [
    "arch",
    "awk",
@@ -1627,6 +1627,43 @@ async function runKernelSelftest(ctx) {
 * @param {number} bootT0
 * @param {string[]} stageLog
 */
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {number} bootT0
+ * @param {{ kind: string, code: string, wallMs: number, limitMs: number }[]} violations
+ * @param {boolean} coldExceeded
+ * @param {boolean} stdlibExceeded
+ */
+async function maybeWriteBootBudgetSummaryJson(
+  ctx,
+  bootT0,
+  violations,
+  coldExceeded,
+  stdlibExceeded
+) {
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.writeFile !== 'function' || !b4) return
+  const wall = Date.now() - bootT0
+  const row =
+    JSON.stringify({
+      schema: 1,
+      atMs: Date.now(),
+      coldWallMs: wall,
+      coldExceeded,
+      bareStdlibExceeded: stdlibExceeded,
+      violationCodes: violations.map((v) => v.code).filter(Boolean),
+      violations,
+      procHint: '/proc/bare_os/boot_budget_summary.json',
+      note: 'Written every boot; operators mirror into proc via booter VFS provider.'
+    }) + '\n'
+  try {
+    await vfs.writeFile('/run/bare-os/boot-budget-summary.json', b4.from(row))
+  } catch {
+    /* optional */
+  }
+}
+
 async function maybeWriteBootPerfJson(ctx, bootT0, stageLog) {
  const vfs = ctx.vfs
  const b4 = ctx.b4a
@@ -2046,6 +2083,8 @@ async function start(ctx) {
    }
  }
  {
+    /** @type {{ kind: string, code: string, wallMs: number, limitMs: number }[]} */
+    let bootBudgetViolationsForSummary = []
    const budgetStrict =
      ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === '1' ||
      ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === 'true'
@@ -2100,11 +2139,12 @@ async function start(ctx) {
      }
    }
    if (coldExceeded || stdlibExceeded) {
-      /** @type {{ kind: string, wallMs: number, limitMs: number }[]} */
+      /** @type {{ kind: string, code: string, wallMs: number, limitMs: number }[]} */
      const violations = []
      if (coldExceeded && Number.isFinite(budget) && budget > 0) {
        violations.push({
          kind: 'cold',
+          code: 'BARE_OS_BOOT_BUDGET_COLD_EXCEEDED',
          wallMs: Date.now() - bootT0,
          limitMs: budget
        })
@@ -2116,6 +2156,7 @@ async function start(ctx) {
        )
        violations.push({
          kind: 'bare_stdlib',
+          code: 'BARE_OS_BOOT_BUDGET_BARE_STDLIB_EXCEEDED',
          wallMs: Number.isFinite(sw) ? sw : 0,
          limitMs: sb
        })
@@ -2133,7 +2174,15 @@ async function start(ctx) {
        bootBudgetViolations: violations,
        transactionState: BARE_OS_BOOT_TXN_STATE.STAGE_COMMITTED
      })
+      bootBudgetViolationsForSummary = violations
    }
+    await maybeWriteBootBudgetSummaryJson(
+      ctx,
+      bootT0,
+      bootBudgetViolationsForSummary,
+      coldExceeded,
+      stdlibExceeded
+    )
    if (budgetStrict && polStrict && (coldExceeded || stdlibExceeded)) {
      bootStructuredLog(
        ctx,
@@ -316,7 +316,7 @@ Fails when **`BARE_OS_POSIX_PROFILE_VERSION`** / **`BARE_OS_POSIX_PROFILE_ID`**

 **Usage:** `node scripts/verify-holepunch-clone-drift.mjs` (root **`pretest`**)

-Runs on every **`pretest`**. For each repo basename listed in **`repos`** inside **[`docs/audit/holepunch-drift-repos.json`](../docs/audit/holepunch-drift-repos.json)**, checks that **`origin/main`** is an ancestor of **`HEAD`** (clone not behind remote). With an empty **`repos`** array, the script is a no-op. The same file carries **`suggestedCriticalRepos`** and optional **`goldenPathRepos`** (wire stack + runtime hints); copy **`suggestedCriticalRepos`** into **`repos`** when you maintain local clones and want CI to enforce freshness. **`goldenPathRepos`** is informational only (surfaced in **`holepunch-clone-sync-report.json`**). Set **`BARE_OS_HOLEPUNCH_DRIFT_CHECK=0`** to skip the script entirely (e.g. offline sandboxes). **`sync-holepunch-clones.mjs`** echoes **`suggestedCriticalRepos`** into **`holepunch-clone-sync-report.json`** for review.
+Runs on every **`pretest`**. For each repo basename listed in **`repos`** inside **[`docs/audit/holepunch-drift-repos.json`](../docs/audit/holepunch-drift-repos.json)**, checks that **`origin/main`** is an ancestor of **`HEAD`** (clone not behind remote). With an empty **`repos`** array, the script is a no-op unless **`BARE_OS_HOLEPUNCH_DRIFT_TIER1=1`**, in which case it checks **`tier1Repos[]`** (hypercore, hyperdrive, hyperswarm, protomux, pear, pear-runtime, bare-fs, bare-process) instead. The same file carries **`suggestedCriticalRepos`** and optional **`goldenPathRepos`** (wire stack + runtime hints); copy **`suggestedCriticalRepos`** into **`repos`** when you maintain local clones and want CI to enforce freshness. **`goldenPathRepos`** is informational only (surfaced in **`holepunch-clone-sync-report.json`**). Set **`BARE_OS_HOLEPUNCH_DRIFT_CHECK=0`** to skip the script entirely (e.g. offline sandboxes). **`sync-holepunch-clones.mjs`** echoes **`suggestedCriticalRepos`** into **`holepunch-clone-sync-report.json`** for review.

 ## `verify-holepunch-clone-freshness.mjs`

@@ -4,6 +4,9 @@
 * local clones under `BARE_OS_HOLEPUNCH_CLONES_ROOT` are not behind `origin/main`.
 * Disable with `BARE_OS_HOLEPUNCH_DRIFT_CHECK=0` (offline / no clones).
 *
+ * Optional maintainer gate: `BARE_OS_HOLEPUNCH_DRIFT_TIER1=1` checks **`tier1Repos[]`**
+ * from the same JSON (ignores **`repos[]`**), for a small Holepunch spine set.
+ *
 * Prereq: `git fetch origin main` in each clone so origin/main is meaningful.
 * Config: docs/audit/holepunch-drift-repos.json → { repos: ["name", ...] }
 * Clones root: BARE_OS_HOLEPUNCH_CLONES_ROOT (same default as sync-holepunch-clones.mjs)
@@ -74,8 +77,28 @@ function main() {
    console.error('verify-holepunch-clone-drift: parse config failed', e)
    process.exit(1)
  }
-  const repos = Array.isArray(cfg.repos) ? cfg.repos.map((r) => String(r).trim()).filter(Boolean) : []
+  const tier1 =
+    process.env.BARE_OS_HOLEPUNCH_DRIFT_TIER1 === '1' ||
+    process.env.BARE_OS_HOLEPUNCH_DRIFT_TIER1 === 'true'
+  let repos = Array.isArray(cfg.repos)
+    ? cfg.repos.map((r) => String(r).trim()).filter(Boolean)
+    : []
+  if (tier1) {
+    repos = Array.isArray(cfg.tier1Repos)
+      ? cfg.tier1Repos.map((r) => String(r).trim()).filter(Boolean)
+      : []
    if (!repos.length) {
+      console.log(
+        'verify-holepunch-clone-drift: tier1 mode but tier1Repos[] empty — nothing to check'
+      )
+      return
+    }
+    console.log(
+      'verify-holepunch-clone-drift: tier1 mode — checking',
+      repos.length,
+      'repo(s)'
+    )
+  } else if (!repos.length) {
    console.log('verify-holepunch-clone-drift: repos[] empty — nothing to check')
    return
  }
@@ -63,9 +63,9 @@ function main() {
    )
    process.exit(1)
  }
-  if (!bits.includes('BARE_OS_KERNEL_FEATURE_BITS_DOC = 15')) {
+  if (!bits.includes('BARE_OS_KERNEL_FEATURE_BITS_DOC = 16')) {
    console.error(
-      'kernel-feature-bits.js: expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 15'
+      'kernel-feature-bits.js: expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 16'
    )
    process.exit(1)
  }
@@ -3,6 +3,7 @@
 * CI: forbid incomplete-implementation markers in first-party kernel + booter runtime sources only.
 *
 * Scanned: kernel/init.js, kernel/lib/init/init-main.js, all kernel/lib/boot/*.js, kernel/bin/*.js (walk skips bundles),
+ * packages/bare-os-coreutils/src (`.js` + `.mjs` Tier-1 sources that ship into `/bin`),
 * packages/bare-os-booter/index.js, packages/bare-os-booter/lib (recursive .js),
 * packages/bare-os-protocol/lib (recursive .js; protocol constants only).
 * Not scanned: kernel/lib/bare/bundles (vendored IIFEs — verify-bundle-markers.mjs,
@@ -23,7 +24,8 @@ const MARKER_RE = /\b(TODO|FIXME|HACK|XXX)\b/
 const NOT_IMPLEMENTED_RE = /throw\s+new\s+Error\s*\(\s*['"]Not implemented['"]\s*\)/

 /** @param {string} dir */
-function walk(dir) {
+/** @param {string[]} [exts] */
+function walk(dir, exts = ['.js']) {
  /** @type {string[]} */
  const out = []
  if (!fs.existsSync(dir)) return out
@@ -32,9 +34,10 @@ function walk(dir) {
    if (ent.isDirectory()) {
      if (ent.name === 'bundles') continue
      if (ent.name === 'node_modules') continue
-      out.push(...walk(p))
-    } else if (ent.isFile() && ent.name.endsWith('.js')) {
-      out.push(p)
+      out.push(...walk(p, exts))
+    } else if (ent.isFile()) {
+      const ext = path.extname(ent.name)
+      if (exts.includes(ext)) out.push(p)
    }
  }
  return out
@@ -76,6 +79,10 @@ function main() {
    ...walk(path.join(root, 'kernel', 'lib', 'init', 'fragments')),
    ...walk(path.join(root, 'kernel', 'lib', 'boot')),
    ...walk(path.join(root, 'kernel', 'bin')),
+    ...walk(path.join(root, 'packages', 'bare-os-coreutils', 'src'), [
+      '.js',
+      '.mjs'
+    ]),
    ...walk(path.join(root, 'packages', 'bare-os-booter', 'lib')),
    ...walk(path.join(root, 'packages', 'bare-os-protocol', 'lib')),
    path.join(root, 'packages', 'bare-os-booter', 'index.js')
@@ -62,6 +62,7 @@ If you are **changing** `/bin`, the booter, or the kernel image, use the [develo
 **Pear OTA snapshot:** host Pear channels pair with **`BARE_OS_PEAR_CHANNEL` / `BARE_OS_PEAR_RELEASE`** and optional **`ctx.bareOsPearUpdaterDelegate()`** (async) when **`BARE_OS_PEAR_UPDATER_SNAPSHOT_JSON`** or **`BARE_OS_PEAR_UPDATER_MODULE`** is set; **`ctx.bareOsSystemRevision`** and boot policy markers govern rollback. See [developer-guide ch.11 — Pear workflows](../developer-guide/11-kernel-pear-cookbook.md).
 - **[docs/README.md](../docs/README.md)** is the **documentation home**: maps every tree, glossary, FAQ, troubleshooting router, ADRs, and release checklist.
 - **[docs/reference](../docs/reference/README.md)** is the **file-level reference**: packages, environment variables, data flow, compatibility. Capability **bit masks** are defined in **[`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../packages/bare-os-protocol/lib/kernel-feature-bits.js)** and summarized in **[kernel capabilities index](../docs/reference/kernel-capabilities-index.md)**.
+- **Boot budget dashboard:** the guest writes **`/run/bare-os/boot-budget-summary.json`** each boot; the stock booter mirrors it to **`/proc/bare_os/boot_budget_summary.json`**. Stable violation codes (**`BARE_OS_BOOT_BUDGET_*`**) are listed in that JSON. JSON Schema: [`docs/schemas/boot-budget-summary.schema.json`](../docs/schemas/boot-budget-summary.schema.json).
 - **[PEAR-RUN.md](../docs/PEAR-RUN.md)** lists **Pear channels**, versioned `pear://` links, and host environment notes for embedded Pear apps.

 When this manual and another doc disagree on a detail, treat the **handbook** or **reference** as authoritative and open an issue if something is stale.