Move editable kernel bulk from kernel/init-main.js to kernel/lib/init/

(staged as /lib/init/init-main.js); point bundle-kernel-init and verify
scripts at the new path.

Wire curl, wget, openssl, ssh-keygen, and tar through coreutils and
booter host delegates with booter-side CLI helpers; refresh related
bins, bare manifest, shell completion, and man DB (kernel + seeder).

Add booter support modules for ACL evaluation, audit chain, secret
handles, peer admission, replication priority, process table, swarm
lifecycle, boot-graph proc, metrics, monotonic time, protomux alias
registry, and swarm peer policy; extend extension resolver, VFS,
swarm connection managers, IPC, identity-account, and initd.

Harden bare-os-bare-libs build on esbuild failure; add verify scripts
for extension manifest schema and runtime incomplete markers; extend
ctx API typings, gen-ctx-client-stub, and verify-ctx-dts.

Update boot hook fragment, bundled init.js, handbook and reference
docs (incl. kernel security and VFS path classes).

kernel/lib/bare/manifest.json

@@ -1,6 +1,12 @@
 {
   "version": 1,
   "bundles": [
+    {
+      "path": "/lib/bare/bundles/safetyCatch.js",
+      "keys": [
+        "safetyCatch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/b4a.js",
       "keys": [
@@ -13,30 +19,24 @@
         "hypercoreIdEncoding"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/safetyCatch.js",
-      "keys": [
-        "safetyCatch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/compactEncoding.js",
       "keys": [
         "compactEncoding"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/protomux.js",
-      "keys": [
-        "protomux"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUrl.js",
       "keys": [
         "bareUrl"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/protomux.js",
+      "keys": [
+        "protomux"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEncoding.js",
       "keys": [
@@ -79,6 +79,12 @@
         "bareReadline"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareAddonResolve.js",
+      "keys": [
+        "bareAddonResolve"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareCrypto.js",
       "keys": [
@@ -86,9 +92,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAddonResolve.js",
+      "path": "/lib/bare/bundles/bareApk.js",
       "keys": [
-        "bareAddonResolve"
+        "bareApk"
       ]
     },
     {
@@ -109,42 +115,24 @@
         "bareAtomics"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAppKit.js",
-      "keys": [
-        "bareAppKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareApk.js",
-      "keys": [
-        "bareApk"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAssert.js",
       "keys": [
         "bareAssert"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareAppKit.js",
+      "keys": [
+        "bareAppKit"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBmp.js",
       "keys": [
         "bareBmp"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundleCompile.js",
-      "keys": [
-        "bareBundleCompile"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareBundle.js",
-      "keys": [
-        "bareBundle"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBuffer.js",
       "keys": [
@@ -157,6 +145,18 @@
         "bareBluetoothApple"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "keys": [
+        "bareBundleCompile"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareBundle.js",
+      "keys": [
+        "bareBundle"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleEvaluate.js",
       "keys": [
@@ -175,6 +175,12 @@
         "bareDebugLog"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareConsole.js",
+      "keys": [
+        "bareConsole"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleId.js",
       "keys": [
@@ -188,9 +194,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareConsole.js",
+      "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
-        "bareConsole"
+        "bareDelta"
       ]
     },
     {
@@ -199,18 +205,18 @@
         "bareDaemon"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDelta.js",
-      "keys": [
-        "bareDelta"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
       "keys": [
         "bareDiagnosticsChannel"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDns.js",
+      "keys": [
+        "bareDns"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEnv.js",
       "keys": [
@@ -218,9 +224,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDns.js",
+      "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
-        "bareDns"
+        "bareCov"
       ]
     },
     {
@@ -236,9 +242,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareCov.js",
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
       "keys": [
-        "bareCov"
+        "bareFfmpegEncodings"
       ]
     },
     {
@@ -248,9 +254,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
+      "path": "/lib/bare/bundles/bareGif.js",
       "keys": [
-        "bareFfmpegEncodings"
+        "bareGif"
       ]
     },
     {
@@ -260,15 +266,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareGif.js",
+      "path": "/lib/bare/bundles/bareFormData.js",
       "keys": [
-        "bareGif"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareGtk.js",
-      "keys": [
-        "bareGtk"
+        "bareFormData"
       ]
     },
     {
@@ -278,9 +278,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareFormData.js",
+      "path": "/lib/bare/bundles/bareGtk.js",
       "keys": [
-        "bareFormData"
+        "bareGtk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFs.js",
+      "keys": [
+        "bareFs"
       ]
     },
     {
@@ -289,12 +295,6 @@
         "bareHeif"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareHttpParser.js",
-      "keys": [
-        "bareHttpParser"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareHrtime.js",
       "keys": [
@@ -302,9 +302,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareFs.js",
+      "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
-        "bareFs"
+        "bareHttpParser"
       ]
     },
     {
@@ -319,18 +319,24 @@
         "bareImageResample"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareHttp1.js",
-      "keys": [
-        "bareHttp1"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareInspect.js",
       "keys": [
         "bareInspect"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHttp1.js",
+      "keys": [
+        "bareHttp1"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareJpeg.js",
       "keys": [
@@ -344,9 +350,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareIntl.js",
+      "path": "/lib/bare/bundles/bareInspector.js",
       "keys": [
-        "bareIntl"
+        "bareInspector"
       ]
     },
     {
@@ -355,6 +361,12 @@
         "bareIpc"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareLogger.js",
+      "keys": [
+        "bareLogger"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareLief.js",
       "keys": [
@@ -368,15 +380,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareLogger.js",
+      "path": "/lib/bare/bundles/bareMake.js",
       "keys": [
-        "bareLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
+        "bareMake"
       ]
     },
     {
@@ -386,9 +392,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareMake.js",
+      "path": "/lib/bare/bundles/bareModuleResolve.js",
       "keys": [
-        "bareMake"
+        "bareModuleResolve"
       ]
     },
     {
@@ -397,48 +403,30 @@
         "bareModule"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModuleResolve.js",
-      "keys": [
-        "bareModuleResolve"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareNdk.js",
       "keys": [
         "bareNdk"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNative.js",
-      "keys": [
-        "bareNative"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareModuleTraverse.js",
       "keys": [
         "bareModuleTraverse"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNative.js",
+      "keys": [
+        "bareNative"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNodeFetch.js",
       "keys": [
         "bareNodeFetch"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNet.js",
-      "keys": [
-        "bareNet"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareMedia.js",
-      "keys": [
-        "bareMedia"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareOpen.js",
       "keys": [
@@ -452,15 +440,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePack.js",
+      "path": "/lib/bare/bundles/bareNet.js",
       "keys": [
-        "barePack"
+        "bareNet"
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePackDrive.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
-        "barePackDrive"
+        "bareMedia"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePack.js",
+      "keys": [
+        "barePack"
       ]
     },
     {
@@ -470,15 +464,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDev.js",
+      "path": "/lib/bare/bundles/barePackDrive.js",
       "keys": [
-        "bareDev"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePng.js",
-      "keys": [
-        "barePng"
+        "barePackDrive"
       ]
     },
     {
@@ -488,9 +476,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePunycode.js",
+      "path": "/lib/bare/bundles/barePng.js",
       "keys": [
-        "barePunycode"
+        "barePng"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
       ]
     },
     {
@@ -499,6 +493,18 @@
         "barePrebuild"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePunycode.js",
+      "keys": [
+        "barePunycode"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareQuerystring.js",
       "keys": [
@@ -506,9 +512,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "path": "/lib/bare/bundles/bareRealm.js",
       "keys": [
-        "bareNodeRuntime"
+        "bareRealm"
       ]
     },
     {
@@ -524,9 +530,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareRealm.js",
+      "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
-        "bareRealm"
+        "barePromClient"
       ]
     },
     {
@@ -535,12 +541,6 @@
         "bareRuntime"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSdl.js",
       "keys": [
@@ -559,6 +559,12 @@
         "bareRpc"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareRepl.js",
+      "keys": [
+        "bareRepl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
@@ -571,12 +577,6 @@
         "bareSignals"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareRepl.js",
-      "keys": [
-        "bareRepl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSidecar.js",
       "keys": [
@@ -601,6 +601,12 @@
         "bareStream"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStdio.js",
+      "keys": [
+        "bareStdio"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSvg.js",
       "keys": [
@@ -614,9 +620,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStdio.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
-        "bareStdio"
+        "bareSystemLogger"
       ]
     },
     {
@@ -626,15 +632,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareTcp.js",
       "keys": [
-        "bareSystemLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTiff.js",
-      "keys": [
-        "bareTiff"
+        "bareTcp"
       ]
     },
     {
@@ -644,15 +644,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTimers.js",
+      "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
-        "bareTimers"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTpl.js",
-      "keys": [
-        "bareTpl"
+        "bareTiff"
       ]
     },
     {
@@ -662,9 +656,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTcp.js",
+      "path": "/lib/bare/bundles/bareTimers.js",
       "keys": [
-        "bareTcp"
+        "bareTimers"
       ]
     },
     {
@@ -674,9 +668,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareTpl.js",
       "keys": [
-        "bareTls"
+        "bareTpl"
       ]
     },
     {
@@ -686,9 +680,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareUnpack.js",
+      "path": "/lib/bare/bundles/bareTls.js",
       "keys": [
-        "bareUnpack"
+        "bareTls"
       ]
     },
     {
@@ -697,6 +691,18 @@
         "bareTty"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUnpack.js",
+      "keys": [
+        "bareUnpack"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareVm.js",
+      "keys": [
+        "bareVm"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareV8.js",
       "keys": [
@@ -709,36 +715,24 @@
         "bareWalkHandles"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareVm.js",
-      "keys": [
-        "bareVm"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUnionBundle.js",
       "keys": [
         "bareUnionBundle"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebKit.js",
-      "keys": [
-        "bareWebKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareUtils.js",
-      "keys": [
-        "bareUtils"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWebp.js",
       "keys": [
         "bareWebp"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWebKit.js",
+      "keys": [
+        "bareWebKit"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWebKitGtk.js",
       "keys": [
@@ -746,9 +740,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWhich.js",
+      "path": "/lib/bare/bundles/bareUtils.js",
       "keys": [
-        "bareWhich"
+        "bareUtils"
       ]
     },
     {
@@ -758,9 +752,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWinUi.js",
+      "path": "/lib/bare/bundles/bareWhich.js",
       "keys": [
-        "bareWinUi"
+        "bareWhich"
       ]
     },
     {
@@ -770,9 +764,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWs.js",
+      "path": "/lib/bare/bundles/bareWinUi.js",
       "keys": [
-        "bareWs"
+        "bareWinUi"
       ]
     },
     {
@@ -781,6 +775,12 @@
         "bareZlib"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWs.js",
+      "keys": [
+        "bareWs"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWorker.js",
       "keys": [

kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1775337850995,
+  "atMs": 1775339424020,
   "commands": [
     "arch",
     "awk",
@@ -136,7 +136,10 @@
   "helpDelegated": [
     "git",
     "journalctl",
-    "systemctl"
+    "openssl",
+    "ssh-keygen",
+    "systemctl",
+    "tar"
   ],
   "note": "Shell-completion metadata; generate via npm run build -w bare-os-coreutils"
 }

kernel/lib/boot/01-invoke-ctx-hooks.js

@@ -1,6 +1,9 @@
-/** Boot transaction journal row state (resume / audit). */
+/** Boot transaction journal row state (resume / audit / rollback FSM). */
 const BARE_OS_BOOT_TXN_STATE = Object.freeze({
-  STAGE_COMMITTED: 'stage_committed'
+  STAGE_STARTED: 'stage_started',
+  STAGE_COMMITTED: 'stage_committed',
+  STAGE_ROLLBACK: 'stage_rollback',
+  STAGE_SKIPPED: 'stage_skipped'
 })
 
 /**

kernel/lib/init/STRUCTURE.md

@@ -1,6 +1,6 @@
 # Stock kernel internal layout (`/boot/init.js`)
 
-The shipped kernel is a **single** Hyperdrive file evaluated with `AsyncFunction` (see `packages/bare-os-booter/lib/kernel-runner.js`). Logical modules map to regions of `kernel/init.js` for maintenance:
+The shipped kernel is a **single** Hyperdrive file evaluated with `AsyncFunction` (see `packages/bare-os-booter/lib/kernel-runner.js`). The editable bulk of that script lives in **`init-main.js`** in this directory (staged on the image as **`/lib/init/init-main.js`**); `scripts/bundle-kernel-init.mjs` concatenates `kernel/lib/boot/*.js` + **`init-main.js`** → repo-root **`kernel/init.js`** (staged as **`/boot/init.js`**). Logical modules map to regions of `kernel/init.js` for maintenance:
 
 | Concern | Responsibility |
 | --- | --- |