feat: POSIX/P2P roadmap — multisig shape, socket bridge, bin index, docs

- Unify pear.multisig.json validation via bare-os-protocol + kernel boot fragment
- Socket bridge: SCM_RIGHTS path, ancillary handling, TCP half-close/shutdown how,
  connect tcpRecvQueue + poll/recv EOF and EPIPE-shaped errors
- Bin manifest / Hyperbee hints schema 2 + namesDigest; batch-write invalidation
- Host booter structured logging; BOOT_PERF_DETAIL bare_stdlib_merge_ns timing
- Wasm kernel optional syscall imports; security_posture rotation hints schema 2
- Shell errexit inside compound bodies; expand getconf/_SC_* and bareOsGetconfSysconf
- Subprocess bridge snapshot timeoutPolicy; blind-relay protomux backpressure tests
- Pear updater minimal delegate example + verify-pear scan; holepunch drift repos
- Refresh handbook, kernel-image, syscall-socket-contract, posix matrix, PEAR-RUN

Rebuild coreutils/bundles; bundle kernel; keep seeder/kernel parity.

kernel/lib/bare/manifest.json

@@ -2,9 +2,9 @@
   "version": 1,
   "bundles": [
     {
-      "path": "/lib/bare/bundles/compactEncoding.js",
+      "path": "/lib/bare/bundles/safetyCatch.js",
       "keys": [
-        "compactEncoding"
+        "safetyCatch"
       ]
     },
     {
@@ -20,15 +20,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/safetyCatch.js",
+      "path": "/lib/bare/bundles/compactEncoding.js",
       "keys": [
-        "safetyCatch"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareUrl.js",
-      "keys": [
-        "bareUrl"
+        "compactEncoding"
       ]
     },
     {
@@ -38,9 +32,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePath.js",
+      "path": "/lib/bare/bundles/bareUrl.js",
       "keys": [
-        "barePath"
+        "bareUrl"
       ]
     },
     {
@@ -49,6 +43,12 @@
         "bareEncoding"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePath.js",
+      "keys": [
+        "barePath"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
@@ -67,36 +67,54 @@
         "bareAbortController"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareReadline.js",
       "keys": [
         "bareReadline"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareCrypto.js",
-      "keys": [
-        "bareCrypto"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAddonResolve.js",
       "keys": [
         "bareAddonResolve"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "keys": [
+        "bareAnsiEscapes"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAsyncHooks.js",
       "keys": [
         "bareAsyncHooks"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareAppKit.js",
+      "keys": [
+        "bareAppKit"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareApk.js",
+      "keys": [
+        "bareApk"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAssert.js",
       "keys": [
@@ -109,24 +127,6 @@
         "bareAtomics"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAppKit.js",
-      "keys": [
-        "bareAppKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareApk.js",
-      "keys": [
-        "bareApk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/fetch.js",
-      "keys": [
-        "fetch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBmp.js",
       "keys": [
@@ -163,36 +163,36 @@
         "bareBundleEvaluate"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBoot.js",
-      "keys": [
-        "bareBoot"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareConsole.js",
       "keys": [
         "bareConsole"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBoot.js",
+      "keys": [
+        "bareBoot"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleId.js",
       "keys": [
         "bareBundleId"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareChannel.js",
       "keys": [
         "bareChannel"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDebugLog.js",
+      "keys": [
+        "bareDebugLog"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
@@ -205,18 +205,18 @@
         "bareDaemon"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDns.js",
-      "keys": [
-        "bareDns"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
       "keys": [
         "bareDiagnosticsChannel"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDns.js",
+      "keys": [
+        "bareDns"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEnv.js",
       "keys": [
@@ -229,12 +229,6 @@
         "bareExif"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
-      "keys": [
-        "bareFfmpegEncodings"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDgram.js",
       "keys": [
@@ -247,6 +241,12 @@
         "bareFfmpeg"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
+      "keys": [
+        "bareFfmpegEncodings"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
@@ -271,12 +271,6 @@
         "bareFormData"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareHeif.js",
       "keys": [
@@ -289,12 +283,6 @@
         "bareHrtime"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareGtk.js",
-      "keys": [
-        "bareGtk"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareFs.js",
       "keys": [
@@ -302,9 +290,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareIco.js",
+      "path": "/lib/bare/bundles/bareGtk.js",
       "keys": [
-        "bareIco"
+        "bareGtk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFileLogger.js",
+      "keys": [
+        "bareFileLogger"
       ]
     },
     {
@@ -313,24 +307,30 @@
         "bareHttpParser"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareIco.js",
+      "keys": [
+        "bareIco"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareImageResample.js",
       "keys": [
         "bareImageResample"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareInspect.js",
-      "keys": [
-        "bareInspect"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareHttp1.js",
       "keys": [
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspect.js",
+      "keys": [
+        "bareInspect"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
@@ -349,30 +349,12 @@
         "bareIntl"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareLief.js",
-      "keys": [
-        "bareLief"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareIpc.js",
       "keys": [
         "bareIpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareLink.js",
-      "keys": [
-        "bareLink"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLogger.js",
       "keys": [
@@ -380,15 +362,27 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareMake.js",
+      "path": "/lib/bare/bundles/bareLink.js",
       "keys": [
-        "bareMake"
+        "bareLink"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareModule.js",
+      "path": "/lib/bare/bundles/bareInspector.js",
       "keys": [
-        "bareModule"
+        "bareInspector"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareLief.js",
+      "keys": [
+        "bareLief"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareMake.js",
+      "keys": [
+        "bareMake"
       ]
     },
     {
@@ -410,15 +404,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNdk.js",
+      "path": "/lib/bare/bundles/bareModule.js",
       "keys": [
-        "bareNdk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNative.js",
-      "keys": [
-        "bareNative"
+        "bareModule"
       ]
     },
     {
@@ -427,6 +415,24 @@
         "bareNodeFetch"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNative.js",
+      "keys": [
+        "bareNative"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareNdk.js",
+      "keys": [
+        "bareNdk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareOpen.js",
       "keys": [
@@ -434,9 +440,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareMedia.js",
+      "path": "/lib/bare/bundles/bareOs.js",
       "keys": [
-        "bareMedia"
+        "bareOs"
       ]
     },
     {
@@ -446,9 +452,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareOs.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
-        "bareOs"
+        "bareMedia"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePng.js",
+      "keys": [
+        "barePng"
       ]
     },
     {
@@ -469,30 +481,24 @@
         "barePackDrive"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePng.js",
-      "keys": [
-        "barePng"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
         "barePipe"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePunycode.js",
-      "keys": [
-        "barePunycode"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareNodeRuntime.js",
       "keys": [
         "bareNodeRuntime"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePunycode.js",
+      "keys": [
+        "barePunycode"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareQuerystring.js",
       "keys": [
@@ -505,18 +511,18 @@
         "bareQueueMicrotask"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePrebuild.js",
-      "keys": [
-        "barePrebuild"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRealm.js",
       "keys": [
         "bareRealm"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePrebuild.js",
+      "keys": [
+        "barePrebuild"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareProcess.js",
       "keys": [
@@ -529,42 +535,36 @@
         "bareRuntime"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRpc.js",
       "keys": [
         "bareRpc"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePromClient.js",
+      "keys": [
+        "barePromClient"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
         "bareSemver"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSdl.js",
-      "keys": [
-        "bareSdl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRepl.js",
       "keys": [
         "bareRepl"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSdl.js",
+      "keys": [
+        "bareSdl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
@@ -577,12 +577,6 @@
         "bareSignals"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSidecar.js",
-      "keys": [
-        "bareSidecar"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareStringDecoder.js",
       "keys": [
@@ -595,12 +589,36 @@
         "bareStream"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSidecar.js",
+      "keys": [
+        "bareSidecar"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStorage.js",
       "keys": [
         "bareStorage"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSvg.js",
+      "keys": [
+        "bareSvg"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "keys": [
+        "bareSystemLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareStructuredClone.js",
+      "keys": [
+        "bareStructuredClone"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStdio.js",
       "keys": [
@@ -608,9 +626,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
-        "bareSvg"
+        "bareTiff"
       ]
     },
     {
@@ -626,9 +644,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareTcp.js",
       "keys": [
-        "bareSystemLogger"
+        "bareTcp"
       ]
     },
     {
@@ -637,24 +655,6 @@
         "bareThread"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareStructuredClone.js",
-      "keys": [
-        "bareStructuredClone"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTiff.js",
-      "keys": [
-        "bareTiff"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTcp.js",
-      "keys": [
-        "bareTcp"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareTimers.js",
       "keys": [
@@ -691,6 +691,12 @@
         "bareTty"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUnionBundle.js",
+      "keys": [
+        "bareUnionBundle"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareV8.js",
       "keys": [
@@ -703,12 +709,6 @@
         "bareUnpack"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUnionBundle.js",
-      "keys": [
-        "bareUnionBundle"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
@@ -722,9 +722,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWebKit.js",
+      "path": "/lib/bare/bundles/bareWebp.js",
       "keys": [
-        "bareWebKit"
+        "bareWebp"
       ]
     },
     {
@@ -733,24 +733,18 @@
         "bareWhich"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWebKit.js",
+      "keys": [
+        "bareWebKit"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWebKitGtk.js",
       "keys": [
         "bareWebKitGtk"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebp.js",
-      "keys": [
-        "bareWebp"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareXdiff.js",
-      "keys": [
-        "bareXdiff"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUtils.js",
       "keys": [
@@ -763,12 +757,6 @@
         "bareV8ToIstanbul"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWorker.js",
-      "keys": [
-        "bareWorker"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWinUi.js",
       "keys": [
@@ -776,9 +764,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWs.js",
+      "path": "/lib/bare/bundles/bareXdiff.js",
       "keys": [
-        "bareWs"
+        "bareXdiff"
       ]
     },
     {
@@ -792,6 +780,18 @@
       "keys": [
         "bareZmq"
       ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWs.js",
+      "keys": [
+        "bareWs"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWorker.js",
+      "keys": [
+        "bareWorker"
+      ]
     }
   ],
   "bundleStats": {
@@ -1595,8 +1595,8 @@
   ],
   "bundleProvenance": {
     "schemaVersion": 1,
-    "generatedAt": "2026-04-05T05:45:19.496Z",
-    "gitCommit": "15209b4837c1c23e2b6102c180d8adf609f4c381",
+    "generatedAt": "2026-04-05T06:07:30.836Z",
+    "gitCommit": "ebee9576c8e7ad247c71fbe2a0478dcf644edfa8",
     "nodeVersion": "v22.22.0",
     "bundleTier": "all",
     "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",

kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1775367918774,
+  "atMs": 1775369250127,
   "commands": [
     "arch",
     "awk",

kernel/lib/boot/00-pear-multisig-shape.js

@@ -0,0 +1,14 @@
+/**
+ * Keep algorithm in sync with `packages/bare-os-protocol/lib/bare-os-pear-multisig-shape.js`
+ * (`pearMultisigShapeOk`). Kernel bundle cannot import npm packages.
+ * @param {unknown} parsed
+ * @returns {boolean}
+ */
+function bareOsPearMultisigShapeOk(parsed) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return false
+  const signers = /** @type {{ signers?: unknown }} */ (parsed).signers
+  const quorum = /** @type {{ quorum?: unknown }} */ (parsed).quorum
+  if (!Array.isArray(signers) || typeof quorum !== 'number') return false
+  if (quorum < 1 || quorum > signers.length) return false
+  return true
+}

kernel/lib/init/init-main.js

@@ -2486,14 +2486,7 @@ async function runKernelExtDropins(ctx, opts = {}) {
         }
       } else {
         const mj = JSON.parse(ctx.b4a.toString(mbuf))
-        const signers = mj && mj.signers
-        const quorum = mj && mj.quorum
-        const badShape =
-          !Array.isArray(signers) ||
-          typeof quorum !== 'number' ||
-          quorum < 1 ||
-          quorum > signers.length
-        if (badShape) {
+        if (!bareOsPearMultisigShapeOk(mj)) {
           bootStructuredLog(
             ctx,
             'error',