Updates

kernel/etc/bare-os/rc

@@ -1,4 +1,4 @@
 # Optional boot-time shell lines (one command per non-comment line).
-# Executed by /boot/init.js after /etc/os-release and /etc/motd, then /etc/bare-os/rc.d/*, before the main banner.
+# Executed by /boot/init.js after /etc/os-release and /etc/motd, then /etc/bare-os/rc.d/* (digit-prefixed names only), before the main banner.
 # Example (uncomment to use):
 # export BARE_OS_SHOW_RC=1

kernel/etc/bare-os/rc.d/.README

@@ -0,0 +1,14 @@
+# Optional boot snippets (trusted)
+
+Only **filenames that start with a digit** are executed (e.g. `10-local`,
+`20-proxy`), after `/etc/bare-os/rc`, in **lexicographic order**. This keeps
+documentation files (this file is named `.README` so even older kernels skip it)
+from being run as shell.
+
+Each snippet is treated like `rc`: one shell command per non-empty, non-comment
+line. Lines starting with `#` and blank lines are ignored.
+
+Dotfiles, names ending in `~`, `README*`, `*.md`, and any name not starting with
+a digit are skipped.
+
+Only ship snippets you trust — they run with full `execLine` power.

kernel/etc/bare-os/rc.d/README

@@ -1,11 +0,0 @@
-# Optional boot snippets (trusted)
-
-Files in this directory are executed after `/etc/bare-os/rc`, in **lexicographic
-order** by filename. Use numeric prefixes (e.g. `10-local`, `20-proxy`) to
-control order. Each file is treated like `rc`: one shell command per non-empty,
-non-comment line.
-
-Lines starting with `#` and blank lines are ignored. Dotfiles and names ending
-in `~` are skipped.
-
-Only ship snippets you trust — they run with full `execLine` power.