Updates

docs/README.md

@@ -1,6 +1,7 @@
 # Documentation
 
 - **[Reference hub](reference/README.md)** — file-level inventory (packages, kernel tree, env vars, data-flow diagram). Split from the former root `DOCUMENTATION.md`.
+- **[Kernel extensions](reference/kernel-extensions.md)** — kernel feature bitfield, seed-channel RPC, and related caps.
 - **[Handbook](../handbook/README.md)** — chapters on architecture, booter runtime, protocol, operations.
 - **[Developer guide](../developer-guide/README.md)** — extending the image, `ctx`, coreutils, testing.
 - **[Holepunch catalog](bare-holepunch-catalog.json)** — metadata used to refresh optional `ctx.bare` bundles (see root `package.json` scripts).

docs/reference/README.md

@@ -12,6 +12,7 @@ This directory holds the split **file-by-file inventory** that used to live in t
 | §§12.10–12.12 | [bare-os-coreutils, tests, and seeder build hook](package-bare-os-coreutils-and-ci.md) |
 | §13 | [Architecture: end-to-end data flow](architecture-data-flow.md) |
 | §14, §14a | [Environment variables and POSIX appendix](environment-and-posix-appendix.md) |
+| *(kernel feature bits & handshake)* | [Kernel extensions](kernel-extensions.md) |
 | §§15–16 | [Out of scope and tooling](out-of-scope-and-tooling.md) |
 
 **Narrative docs:** [Handbook](../../handbook/README.md) (why / architecture), [Developer guide](../../developer-guide/README.md) (how to extend `run` / `start`, `ctx`).

docs/reference/environment-and-posix-appendix.md

@@ -18,18 +18,26 @@ Former **DOCUMENTATION.md** §14, §14a. [Reference index →](README.md)
 | `MANWIDTH`                | `/bin/man`               | Wrap width for manual text (default `72`; minimum `40`)                                                                                                                                                                  |
 | `NO_COLOR`                | `/bin/man`               | If set, disable ANSI bold for section headings on a TTY                                                                                                                                                                  |
 
-**Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_TRACE`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, **`TERM`**, **`COLORTERM`**.
+**Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_TRACE`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, **`TERM`**, **`COLORTERM`**.
 
 | Variable | Used by | Meaning |
 | -------- | ------- | ------- |
 | `BARE_OS_VFS_UNION_PREFIXES` | Booter / VFS | Comma-separated logical path prefixes where **`readFile`** may union system + overlay sources. |
+| `BARE_OS_VFS_UNION_WRITE_DENY` | Booter / VFS | When **`1`** / **`true`**, block **`writeFile`** / **`unlink`** on paths under union read prefixes (read-only union overlay). |
+| `BARE_OS_IPC_CHANNEL_MAX_BYTES` | Booter / IPC | Optional JSON map **`{"fifoName": maxBytes}`** (or legacy comma form) capping buffered bytes per FIFO name under **`/run/bare-os/ipc/`**. |
 | `BARE_OS_VFS_BIN_CACHE` | VFS | When **`1`** / **`true`**, LRU read cache for **`/bin`**; invalidated on **`vfs.watch`** when enabled. |
 | `BARE_OS_BOOT_MANIFEST` | Stock kernel | Enable digest check of **`/etc/bare-os/boot.manifest.json`**. |
 | `BARE_OS_BOOT_MANIFEST_SIGN` | Stock kernel + booter | When **`1`**, require valid Ed25519 signature file **`/etc/bare-os/boot.manifest.sig`** (see **`BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`**). |
 | `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX` | Booter / kernel | 64 hex chars — public key for signed boot manifest verification. |
+| `BARE_OS_BOOT_POLICY` | Stock kernel | When **`1`** / **`true`**, merge **`skipPhases`** from **`/etc/bare-os/boot.policy.json`** on the system drive into boot skip logic (see **`kernel/etc/bare-os/boot.policy.example.json`**). |
 | `BARE_OS_SANDBOX_SCRIPT` | `ctx.bareOsSandboxRunScript` | Set **`0`** / **`false`** to disable sandbox script helper. |
-| `BARE_OS_SANDBOX_WORKER` | Booter | When **`1`**, logs intent to use worker-style isolation when a host entrypoint exists (inline fallback today). |
+| `BARE_OS_SANDBOX_WORKER` | Booter | When **`1`**, defers **`bareOsSandboxRunScript`** on a **fresh microtask** (async boundary); **not** a separate thread or isolate. |
 | `BARE_OS_INITD_MAX_PARALLEL` | bare-initd | Max concurrent unit **starts** per DAG level (integer ≥ **1**; default **1**). |
+| `BARE_OS_INITD_JOURNAL_MAX_LINES` | bare-initd / unit journals | Cap lines retained per unit NDJSON journal under **`/run/bare-os/unit-journal/`**. |
+| `BARE_OS_TELEMETRY_NDJSON` | Booter | Absolute or **`~/…`** path in the **guest VFS**: append capped NDJSON telemetry records (**`{ ts, … }`**) mirroring structured boot/kernel events. |
+| `BARE_OS_SEED_RPC_HANDSHAKE` | Booter | Set **`0`** / **`false`** to skip the pre-MBR **`bare_os.capabilities`** RPC against the first peer. |
+| `BARE_OS_SEED_CAP_STRICT` | Booter | When **`1`** / **`true`**, require seeder feature **`bits`** to cover **`BARE_OS_KERNEL_FEATURES_STOCK_V1`** or throw. |
+| `BARE_OS_SEED_CAP_FAIL` | Booter | When **`1`** / **`true`**, rethrow after a failed handshake instead of recording the error and continuing. |
 | `BARE_OS_URANDOM_CRYPTO` | VFS **`/dev/urandom`** | Set **`0`** to use non-crypto PRNG for synthetic urandom (default prefers crypto where available). |
 | `BARE_OS_BLIND_BOOTSTRAP_URL` | `/proc/bare_os_bootstrap` | Non-empty URL string echoed into the proc JSON for host/operator wiring (guest does not fetch it). |
 | `BARE_OS_BLIND_BOOTSTRAP_JSON` | `/proc/bare_os_bootstrap` | Inline JSON string parsed and exposed under **`blindBootstrap`** (invalid JSON yields an error object in the proc file). |
@@ -59,10 +67,10 @@ Former **DOCUMENTATION.md** §14, §14a. [Reference index →](README.md)
 
 | Area          | Status                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **VFS**       | Two-drive unified paths; **`$HOME`** maps to the personal Hyperdrive; writable mounts under **`/mnt`** when HDMS allows. **`mkdir`/`rmdir`**, **`chmod`** (octal + symbolic subset), **`symlink`/`readlink`**, **`stat`/`lstat`**, **`rm`** recursive, **`watch()`** on Hyperdrive paths (optional host **`BARE_OS_VFS_WATCH=0`** to disable). Synthetic **`/proc`**, **`/sys`**, **`/run`**, **`/dev`** for introspection (quotas JSON, boot JSON, initd snapshot, etc.). Empty dirs use **`.bareos_empty`** (same idea as `git-fs-adapter`).                                                                                                                                                                                                                                        |
-| **Shell**     | Pipelines, **`;`**, **`&&`** / **`||`**, redirects, quoting, **`$VAR`**, **`$?`**, builtins including bounded **`if`**, **`while`**, **`for`**, **`case`** (caps **`BARE_OS_SHELL_LOOP_MAX`**, **`BARE_OS_SHELL_CASE_MAX_BRANCHES`**). Branching uses **`ctx.exitCode`**. Bounded pipeline capture (**`BARE_OS_PIPELINE_*`**, **`ctx.bareOsRuntimeCaps`**); optional boot-snippet allowlist (**`BARE_OS_BOOT_ALLOWLIST`** + **`/etc/bare-os/boot.allow`**). No subshells or full POSIX **`sh`**.                                                                                                                                       |
+| **VFS**       | Two-drive unified paths; **`$HOME`** maps to the personal Hyperdrive; writable mounts under **`/mnt`** when HDMS allows. **`mkdir`/`rmdir`**, **`chmod`** (octal + symbolic subset), **`symlink`/`readlink`**, **`stat`/`lstat`**, **`rm`** recursive, **`watch()`** on Hyperdrive paths (optional host **`BARE_OS_VFS_WATCH=0`** to disable). Synthetic **`/proc`**, **`/sys`**, **`/run`**, **`/dev`** for introspection (quotas JSON, boot JSON, initd snapshot, union policy, seed handshake, virtual registry, etc.). Optional union read overlays (**`BARE_OS_VFS_UNION_PREFIXES`**) with optional write deny (**`BARE_OS_VFS_UNION_WRITE_DENY`**). Empty dirs use **`.bareos_empty`** (same idea as `git-fs-adapter`).                                                                                                                                                                                                                                        |
+| **Shell**     | Pipelines, **`;`**, **`&&`** / **`||`**, redirects, quoting, **`$VAR`**, **`$?`**, **`jobs`** / **`fg`** / **`wait`**, optional background **`&`** segments, builtins including bounded **`if`**, **`while`**, **`for`**, **`case`** (caps **`BARE_OS_SHELL_LOOP_MAX`**, **`BARE_OS_SHELL_CASE_MAX_BRANCHES`**). Optional bounded **`$(…)`** when **`BARE_OS_SHELL_CMDSUBST=1`**; optional larger pipeline capture via **`BARE_OS_SHELL_STREAMING`** / **`BARE_OS_SHELL_STREAMING_MULT`**. Branching uses **`ctx.exitCode`**. Bounded pipeline capture (**`BARE_OS_PIPELINE_*`**, **`ctx.bareOsRuntimeCaps`**); optional boot-snippet allowlist (**`BARE_OS_BOOT_ALLOWLIST`** + **`/etc/bare-os/boot.allow`**). No subshells or full POSIX **`sh`**.                                                                                                                                       |
 | **Ownership** | Display and permission checks use **`UID`/`GID`** and mode bits; **`chown`/`chgrp`** update **`metadata.bareOs`** on the **personal** writable tree (not a multi-user host kernel).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| **Utilities** | Tier-1 JS **`/bin`** (**~111** commands; see [§12.10](package-bare-os-coreutils-and-ci.md#1210-package-bare-os-coreutils)): text tools include **`paste`**, **`split`**, **`tac`**, **`rev`**, **`expand`**, **`unexpand`**, **`fold`**, **`fmt`**, **`comm`**, **`join`**, **`pr`**, **`yes`** (line-capped via **`BARE_OS_YES_MAX_LINES`** / **`getconf`**), **`shuf`** (capped via **`BARE_OS_SHUF_MAX_LINES`**), **`tsort`**, **`factor`**, **`expr`** (integer-focused subset), **`numfmt`** (**`--to=iec`** / **`--to=si`**). Checksums: **`md5sum`** (bundled MD5), **`sha1sum`**, **`sha256sum`**, **`sha512sum`** (Web Crypto where available), **`sum`**, **`base32`**, **`basenc`** (**`--base16`**). Files: **`truncate`**, **`unlink`**, **`install`**, **`df`** (synthetic Hyperdrive row; **`-h`** human sizes), **`sync`** (no-op). Session stubs: **`arch`**, **`groups`**, **`hostid`**, **`nproc`**, **`uptime`**, **`users`**, **`who`**. Plus earlier parity: **`man`**, **`sed`** (including **`-z`**, **`BARE_OS_SED_NULL_MAX_RECORDS`**), **`awk`**, **`grep`** (**`-r`** with **`--include`/`--exclude`/`--exclude-dir`**, **`BARE_OS_GREP_FILTER_MAX`**), **`cp`** (**`-u`/`-v`/`-p`**), **`mv`**, **`find`** (**`-regex`**, **`-exec`/`-ok`**, **`BARE_OS_FIND_EXEC_MAX`**), **`mktemp`**, **`git-pear`**, **`cksum`**, **`getconf`** (includes pipeline / cap names + **`-a`**), **`xargs`**, **`dircolors`**, **`theme`**, **`ls`**, **`uniq`**, **`realpath`**, **`base64`**, **`rm`** **`-d`**, **`stat`** **`%F`**. **`dir`** / **`vdir`** call **`ls`**. Large **`sed`/`awk`** are not byte-identical to GNU on all inputs. **`mkfifo`** → **`/run/bare-os/ipc/`**. Online help: **`/share/man/man.json`** and **`man`**. |
+| **Utilities** | Tier-1 JS **`/bin`** (**~112** commands; see [§12.10](package-bare-os-coreutils-and-ci.md#1210-package-bare-os-coreutils)): text tools include **`paste`**, **`split`**, **`tac`**, **`rev`**, **`expand`**, **`unexpand`**, **`fold`**, **`fmt`**, **`comm`**, **`cmp`**, **`join`**, **`pr`**, **`yes`** (line-capped via **`BARE_OS_YES_MAX_LINES`** / **`getconf`**), **`shuf`** (capped via **`BARE_OS_SHUF_MAX_LINES`**), **`tsort`**, **`factor`**, **`expr`** (integer-focused subset), **`numfmt`** (**`--to=iec`** / **`--to=si`**). Checksums: **`md5sum`** (bundled MD5), **`sha1sum`**, **`sha256sum`**, **`sha512sum`** (Web Crypto where available), **`sum`**, **`base32`**, **`basenc`** (**`--base16`**). Files: **`truncate`**, **`unlink`**, **`install`**, **`df`** (synthetic Hyperdrive row; **`-h`** human sizes), **`sync`** (no-op). Session stubs: **`arch`**, **`groups`**, **`hostid`**, **`nproc`**, **`uptime`**, **`users`**, **`who`**. Plus earlier parity: **`man`**, **`sed`** (including **`-z`**, **`BARE_OS_SED_NULL_MAX_RECORDS`**), **`awk`**, **`grep`** (**`-r`** with **`--include`/`--exclude`/`--exclude-dir`**, **`BARE_OS_GREP_FILTER_MAX`**), **`cp`** (**`-u`/`-v`/`-p`**), **`mv`**, **`find`** (**`-regex`**, **`-exec`/`-ok`**, **`BARE_OS_FIND_EXEC_MAX`**), **`mktemp`**, **`git-pear`**, **`cksum`**, **`getconf`** (includes pipeline / cap names + **`-a`**), **`xargs`**, **`dircolors`**, **`theme`**, **`ls`**, **`uniq`**, **`realpath`**, **`base64`**, **`rm`** **`-d`**, **`stat`** **`%F`**. **`dir`** / **`vdir`** call **`ls`**. Large **`sed`/`awk`** are not byte-identical to GNU on all inputs. **`mkfifo`** → **`/run/bare-os/ipc/`**. Online help: **`/share/man/man.json`** and **`man`**. |
 
 **Handbook:** [handbook/09-posix-utilities-shell-and-vfs.md](../../handbook/09-posix-utilities-shell-and-vfs.md) — narrative catalog, engine notes, and Issue 7 alignment. **Manual pages:** [handbook/10-manpages-and-online-help.md](../../handbook/10-manpages-and-online-help.md).
 

docs/reference/kernel-extensions.md

@@ -0,0 +1,41 @@
+# Kernel extensions and feature matrix (Bare OS)
+
+This document complements the [handbook](../../handbook/09-posix-utilities-shell-and-vfs.md) with a single map of optional **booter + stock kernel** features added for richer POSIX-like behavior, protocol alignment, and operations.
+
+## Capability bitmask
+
+Runtime bits are defined in `bare-os-protocol` (`kernel-feature-bits.js`) and surfaced under `/proc/bare_os_features`. The stock booter advertises `BARE_OS_KERNEL_FEATURES_STOCK_V1`.
+
+## Environment quick reference
+
+| Area | Variable | Effect |
+|------|----------|--------|
+| Seed handshake | `BARE_OS_SEED_RPC_HANDSHAKE=0` | Skip `bare_os.capabilities` RPC before MBR read |
+| Seed strict | `BARE_OS_SEED_CAP_STRICT=1` | Fail boot if seeder feature bits do not cover stock booter bits |
+| Seed fail | `BARE_OS_SEED_CAP_FAIL=1` | Fail boot on any handshake error |
+| Pipelines | `BARE_OS_SHELL_STREAMING=1` | Multiply pipeline byte/line caps (`BARE_OS_SHELL_STREAMING_MULT`, default 4×) |
+| Command subst | `BARE_OS_SHELL_CMDSUBST=1` | Enable bounded `$(…)` in words (`BARE_OS_SHELL_CMDSUBST_MAX_BYTES`) |
+| Union writes | `BARE_OS_VFS_UNION_WRITE_DENY` | Comma/colon list of path prefixes blocked for writes under union prefixes |
+| IPC | `BARE_OS_IPC_CHANNEL_MAX_BYTES` | JSON map `{"fifoName": 65536}` per-channel backlog cap |
+| Initd journal | `BARE_OS_INITD_JOURNAL_MAX_LINES` | Cap NDJSON lines per unit (default 400, max 20000) |
+| Telemetry | `BARE_OS_TELEMETRY_NDJSON` | Logical path; append NDJSON mirror of `appendVarLog` events |
+| Boot policy | `BARE_OS_BOOT_POLICY=1` | Merge `skipPhases` from `/etc/bare-os/boot.policy.json` |
+| Sandbox | `BARE_OS_SANDBOX_WORKER=1` | Defer sandbox script on a fresh microtask (soft isolation path) |
+
+## POSIX utility notes
+
+| Utility | Notes |
+|---------|--------|
+| `cmp` | Two-file byte compare; exit 1 on difference |
+| `wait` | Shell builtin: wait for background jobs by id or all |
+
+## Cookbook snippets
+
+1. **Boot phases** — Use `ctx.bareOsRegisterBootPhaseHook` (see stock `kernel/init.js` header).
+2. **Virtual files** — `ctx.bareOsRegisterVirtualFile(name, reader, { etag, mime, ttlMs })`; list via `/proc/bare_os_virtual_registry`.
+3. **IPC** — Named FIFOs under `/run/bare-os/ipc/`; JSON-RPC and fan-out documented in the booter package README.
+4. **Initd drop-ins** — `RestartMaxAttempts=` in `~/.config/bare-os/units/<name>.unit` (1–32).
+
+## Profiles
+
+- `kernel/etc/bare-os/rc.profile.full` — example exports for “full” shell features (use `BARE_OS_BOOT_PROFILE=full` when that snippet is installed as `rc.profile.full` on the image).

docs/reference/package-bare-os-booter.md

@@ -38,7 +38,7 @@ Former **DOCUMENTATION.md** §§12.1–12.9 (runtime, VFS, shell, identity). [Re
 **`executeKernel(disk, store, swarm, initSource)`** (`store`/`swarm` unused but kept for signature symmetry / future use)
 
 - Builds `shellEnv` with **guest** defaults: `USER`/`LOGNAME`=`guest`, `HOME`/`PWD`=`/home/guest`, `UID`/`GID`=`65534`, `BARE_OS_IDENTITY=guest`, `BARE_OS_EXIT_STATUS`=`0`, `BARE_OS_CTX_API_VERSION`, `PATH=/bin`, `SHELL`, `HOSTNAME`, `0`. When the host sets any of the keys listed under “host → session passthrough” in [Environment variables and POSIX appendix](environment-and-posix-appendix.md#14-environment-variables-complete-list), those values are copied into `shellEnv`. Sets **`BARE_OS_BOOT_PROFILE_RESOLVED`** from **`BARE_OS_BOOT_PROFILE`** or the first line of **`/etc/bare-os/profile`**, and **`BARE_OS_SESSION_ID`** (random UUID). Seeds **`/run/bare-os/boot.json`** fields **`imageDigest`**, **`pearChannel`**, **`pearRelease`** from **`BARE_OS_IMAGE_DIGEST`**, **`BARE_OS_PEAR_CHANNEL`** / **`PEAR_CHANNEL`**, **`BARE_OS_PEAR_RELEASE`** when present.
-- **`createBareOsIpc({ maxFifoBytes, ipcRpcToken?, enableFanout?, maxJsonRpcLineBytes? })`** ([`bare-os-ipc.js`](../../packages/bare-os-booter/lib/bare-os-ipc.js)) — FIFOs under **`/run/bare-os/ipc/<name>`**; JSON-RPC with optional token and line cap; fan-out **`fanoutPublish`/`fanoutSubscribe`**; **`stats`** includes fan-out counts when caps expose **`features.ipcFanout`**.
+- **`createBareOsIpc({ maxFifoBytes, perChannelMaxBytes?, ipcRpcToken?, enableFanout?, maxJsonRpcLineBytes? })`** ([`bare-os-ipc.js`](../../packages/bare-os-booter/lib/bare-os-ipc.js)) — FIFOs under **`/run/bare-os/ipc/<name>`**; optional per-name byte caps from **`BARE_OS_IPC_CHANNEL_MAX_BYTES`**; JSON-RPC with optional token and line cap; fan-out **`fanoutPublish`/`fanoutSubscribe`**; **`stats`** includes fan-out counts when caps expose **`features.ipcFanout`**.
 - **`createVfs(drive, personalDrive, shellEnv, vfsMountRef, vfsOptions)`** → `ctx.vfs` (same `env` object as `ctx.env`). **`vfsOptions`** supply **`procSnapshot`**, dynamic **`/proc/*`** and **`/sys/*`** text (quotas JSON, net/disk stubs, session stats), **`bootProfileText`**, **`sessionText`**, **`initdRunText`**, **`bootReadyJsonText`**, mount map for **`/proc/mounts`**, **`bootStartedMs`** for **`/proc/uptime`**, etc. Exposes **`vfs.watch(logicalPath)`** for Hyperdrive-backed paths when **`BARE_OS_VFS_WATCH`** is not **`0`**.
 - **`applyGuestEnv(ctx)`** then **`ensureGuestHome(ctx)`** — normalizes `ctx.identity` and seeds `/.bare/` (and a guest marker) on the personal drive.
 - **`createReadLine()`** always resolves stdio first and returns `stdout` (may be `null`) alongside `readLine` so the kernel can write to the **same** stream as the REPL (including `bare-stdio` under Pear).
@@ -50,15 +50,16 @@ Former **DOCUMENTATION.md** §§12.1–12.9 (runtime, VFS, shell, identity). [Re
   - **`saveVault()`** — encrypt personal-drive files into `/.bare/vault/` (skips `/.bare`, `bin`, `boot`, history paths).
   - **`registerKernelShutdownHook(fn)`** — register async/sync teardown before **`stopBareInitd`** when the REPL session cleans up.
 - After **`createKernelReplSession`**: wires **`readLine`**, **`console`**, **`execLine`**, **`suspendReplForSubprocess`** / **`resumeReplAfterSubprocess`**, then **`await startBareInitd(ctx)`** (services such as kernel log mirroring).
-- Sets `disk.os` with stub `searchLocal` ([]) and `execRpc` (`''`).
+- Sets `disk.os` with stub `searchLocal` ([]) and `execRpc` (`''`) **after initd** (reserved for future local OS hooks; peer **search** / **RPC** use **`SwarmDisk`** message **3–6** and **`disk.rpc()`** — see §12.4).
 - `try { await runKernelFromSource(...) } finally { await session.cleanup() }` — cleanup runs **`runKernelShutdownHooks`**, **`stopBareInitd`**, fish TTY teardown.
 
 **`boot-splash.js`** — TTY splash (disabled when `stdout` is not a TTY or `BARE_OS_NO_SPLASH=1`): full-screen clear, Braille spinner, elapsed boot timer, progress bar vs `BARE_OS_BOOT_TIMEOUT_MS` (default 60s), rotating title color, status lines. `prepareForKernel()` clears again and shows the cursor before the fish shell.
 
-**`bootFromPeers(disk, store, swarm, splash)`**
+**`loadOsFromPeers(disk, store, swarm, splash)`** (network boot path used by **`main()`**)
 
-- `disk.read(0)` → `parseMbr`.
-- For each key: `Hyperdrive(store, driveKey)`, `ready()`, replicate on all `disk.peers`’ mux streams, join drive discovery, `findingPeers` + `swarm.flush`, poll up to 30×200ms for `/boot/init.js`.
+- Optional pre-MBR **`disk.rpc('bare_os', 'capabilities', …)`** when peers exist and **`BARE_OS_SEED_RPC_HANDSHAKE`** is not **`0`**/**`false`**; result stored on **`disk.seedCapabilityInfo`**; **`BARE_OS_SEED_CAP_STRICT`** / **`BARE_OS_SEED_CAP_FAIL`** tighten failure behavior.
+- **`disk.read(0)`** → **`parseMbr`**.
+- For each MBR key: `Hyperdrive(store, driveKey)`, `ready()`, replicate on all `disk.peers`’ mux streams, join drive discovery, `findingPeers` + `swarm.flush`, poll up to 30×200ms for `/boot/init.js`.
 - On success: `initPersonalDrive`, `splash.prepareForKernel()`, `executeKernel`.
 
 **`main()`**
@@ -66,7 +67,7 @@ Former **DOCUMENTATION.md** §§12.1–12.9 (runtime, VFS, shell, identity). [Re
 - `resolveStdio()` → `createBootSplash`, `splash.start()` (initial clear).
 - `Corestore(bootStorePath())`, `Hyperswarm`, `SwarmDisk`, join `topicKey()`.
 - Wait until `disk.peers.size > 0` or **`BARE_OS_BOOT_TIMEOUT_MS`** elapses (default **60000**). There is **no local seed fallback**; without peers, boot fails.
-- `Promise.race` between `bootFromPeers` and the remaining time within the same deadline so the whole network boot finishes within the limit.
+- `Promise.race` between `loadOsFromPeers` and the remaining time within the same deadline so the whole network boot finishes within the limit.
 - **`finally`**: `swarm.destroy()` first, then close drives and `store` (each in try/catch).
 - **`exitHostProcess`**: `Bare.exit` or `process.exit`.
 
@@ -76,7 +77,7 @@ Former **DOCUMENTATION.md** §§12.1–12.9 (runtime, VFS, shell, identity). [Re
 
 **`SwarmDisk` class**
 
-**State:** `localRAM`, `peers` (Set of `{ chan, mux, socket, id }`), `pendingReads`, `pendingSearches`, `pendingRpc`, counters, `drive`, `personalDrive`, `os`.
+**State:** `localRAM`, `peers` (Set of `{ chan, mux, socket, id }`), `pendingReads`, `pendingSearches`, `pendingRpc`, counters, `drive`, `personalDrive`, `os`, **`seedCapabilityInfo`** (last **`bare_os.capabilities`** handshake or error object).
 
 **`initPersonalDrive(store, swarm, Hyperdrive)`**
 
@@ -97,6 +98,10 @@ Former **DOCUMENTATION.md** §§12.1–12.9 (runtime, VFS, shell, identity). [Re
 
 - Fan-out message 3 to all peers with shared id (actually each peer gets same id from counter — **one id per `search()` call**, registered in `pendingSearches`; concurrent searches could collide in id space; documented as current behavior).
 
+**`rpc(module, method, args?, timeoutMs?)`**
+
+- Sends message **5** to the **first** peer in **`peers`**; awaits message **6**; parses **`result`** as JSON when possible. Used for the pre-boot **`bare_os.capabilities`** handshake and operator tooling.
+
 ### 12.5 [packages/bare-os-booter/lib/kernel-runner.js](../../packages/bare-os-booter/lib/kernel-runner.js)
 
 - **`AsyncFunction`** = `Object.getPrototypeOf(async function () {}).constructor`.
@@ -121,7 +126,7 @@ Former **DOCUMENTATION.md** §§12.1–12.9 (runtime, VFS, shell, identity). [Re
 
 **`createVfs(systemDrive, personalDrive, env, mntRef?, vfsOptions?)`**
 
-- **Logical paths** under `$HOME` (booter default `/home/guest`; after `login`, `/home/<pubkey-prefix>`) map to the **personal** Hyperdrive under `/.bare-os/home/<basename>/…`; **`/var/log`** and **`/tmp`** map to **`/.bare-os/var/log/…`** and **`/.bare-os/tmp/…`** with the same basename. Read-only synthetic **`/proc`** and **`/sys`** (optional **`vfsOptions`** for version/cmdline, quotas JSON, net/disk stubs, **`/run/bare-os/*`** text providers, mount map, etc.). All other absolute paths use the **system** drive (read-mostly OS image).
+- **Logical paths** under `$HOME` (booter default `/home/guest`; after `login`, `/home/<pubkey-prefix>`) map to the **personal** Hyperdrive under `/.bare-os/home/<basename>/…`; **`/var/log`** and **`/tmp`** map to **`/.bare-os/var/log/…`** and **`/.bare-os/tmp/…`** with the same basename. Read-only synthetic **`/proc`** and **`/sys`** (optional **`vfsOptions`** for version/cmdline, quotas JSON, net/disk stubs, **`/run/bare-os/*`** text providers, mount map, union policy, seed handshake, virtual registry, etc.). Optional union read overlays via env **`BARE_OS_VFS_UNION_PREFIXES`**; optional **`BARE_OS_VFS_UNION_WRITE_DENY`** blocks writes under those prefixes. All other absolute paths use the **system** drive (read-mostly OS image).
 - **`resolveLogical(p)`** — `unix-path-resolve(cwd, p)` so cwd + relative segments work (the `unix-path-resolve` package only accepts two path arguments).
 - **API**: `getcwd`, `chdir` (rejects regular files), `readFile`, `writeFile` / `unlink` (personal only), `exists`, `readdir`, `stat` / `lstat`, `readlink`, `symlink`, `chmod`, `mkdir` (recursive via `.bareos_empty` marker), `rmdir` (empty dirs; marker-aware), `rm` (recursive tree walk), `route`, `resolveLogical`, `env`, **`watch(logicalPath)`** (Hyperdrive-backed paths only; throws on pseudo **`/proc`**/**`/sys`**/**`/run`**/**`/dev`** and on virtual **`$HOME`**, **`/var`**, **`/mnt`** roots).
 - **Hyperdrive quirk**: `entry` / `get` / `exists` use `std(path, false)` and **throw** on path `'/'` (`Invalid filename: /`). The VFS special-cases drive path `'/'` (logical `/` and personal `$HOME` root) for `chdir`, `stat`, `exists`, `isRegularFile`, and blocks `readFile`/`put`/`del` on that key.
@@ -131,7 +136,7 @@ Former **DOCUMENTATION.md** §§12.1–12.9 (runtime, VFS, shell, identity). [Re
 
 - **`defaultShellAliases`** — includes `ll`, `la`, `l`, `..`, `...` as the baseline merged from **`~/.barerc`**.
 - **`tokenize` / `expandWord` / `parsePipeline`** — POSIX-ish words, `'...'`, `"..."`, `\`, `|`, `||`, `&&`, `;`, `>`, `>>`, `<`; `$VAR` and `${VAR}`; pipelines split on `|`; **`;`** splits lists; **`&&`** / **`||`** short-circuit using **`ctx.exitCode`** (left-associative).
-- **`execShellLine(ctx, line)`** — semicolon-separated lists, then per segment AND-OR chains of pipelines; leading `NAME=value` assignments (blocked for `ctx.shellReadonlyVars`), redirections, builtins `alias`, **`barerc`** (`barerc reload` re-parses `~/.barerc` and reapplies theme), `unalias`, `cd`, `export`, `unset`, `readonly`, `umask`, `:`, `command`, `type`, `login`, `logout`, `exit`, else `runBinCommand`. `command -v`/`-V` and `type` use **`resolveBinInPath`**. `login`/`logout` call the same `ctx.applyRegister` / `ctx.applyUnlock` / `ctx.applyLogout` hooks as `/bin/login` and `/bin/logout`. Captures `console.log` for pipes and file redirection; `>` / `>>` target paths via `ctx.vfs.writeFile` (personal tree). Returns `'exit'` when the `exit` builtin runs. Lone **`&`** (job control) is rejected with a clear error. After each completed line (except empty input), **`syncBareOsExitStatusEnv`** writes **`ctx.exitCode`** to **`vfs.env.BARE_OS_EXIT_STATUS`**; **`expandWord`** maps **`$?`** / **`${?}`** to that value.
+- **`execShellLine(ctx, line)`** — semicolon-separated lists, then per segment AND-OR chains of pipelines; leading `NAME=value` assignments (blocked for `ctx.shellReadonlyVars`), redirections, builtins `alias`, **`barerc`** (`barerc reload` re-parses `~/.barerc` and reapplies theme), `unalias`, `cd`, `export`, `unset`, `readonly`, `umask`, `:`, `command`, `type`, `login`, `logout`, `exit`, **`jobs`**, **`fg`**, **`wait`**, else `runBinCommand`. Optional **`BARE_OS_SHELL_CMDSUBST`** enables bounded **`$(…)`**; optional **`BARE_OS_SHELL_STREAMING`** / **`BARE_OS_SHELL_STREAMING_MULT`** relax pipeline capture caps. Trailing **`&`** at list depth runs prior segments in the **background** (async jobs table). `command -v`/`-V` and `type` use **`resolveBinInPath`**. `login`/`logout` call the same `ctx.applyRegister` / `ctx.applyUnlock` / `ctx.applyLogout` hooks as `/bin/login` and `/bin/logout`. Captures `console.log` for pipes and file redirection; `>` / `>>` target paths via `ctx.vfs.writeFile` (personal tree). Returns `'exit'` when the `exit` builtin runs. After each completed line (except empty input), **`syncBareOsExitStatusEnv`** writes **`ctx.exitCode`** to **`vfs.env.BARE_OS_EXIT_STATUS`**; **`expandWord`** maps **`$?`** / **`${?}`** to that value.
 
 ### 12.8 [packages/bare-os-booter/lib/identity-account.js](../../packages/bare-os-booter/lib/identity-account.js)
 

docs/reference/package-bare-os-coreutils-and-ci.md

@@ -7,7 +7,7 @@ Former **DOCUMENTATION.md** §§12.10–12.12. [Reference index →](README.md)
 - **[packages/bare-os-coreutils/lib/commands.mjs](../../packages/bare-os-coreutils/lib/commands.mjs)** — **`COREUTILS_COMMANDS`**: authoritative sorted `/bin` names for **`build.mjs`** and the manual database builder (keeps the image and **`man`** coverage in sync).
 - **[packages/bare-os-coreutils/build.mjs](../../packages/bare-os-coreutils/build.mjs)** — `export async function build()`: runs **`scripts/build-man-db.mjs`** (validates **`man/pages/*.json`**, writes **`kernel/share/man/man.json`** and the same path under **`packages/bare-os-seeder/kernel/share/man/`**); then for each command concatenates `lib/runtime.js`, optional **`preamble`** libs (**`md5sum`** → **`lib/md5.js`**, **`sed`** → **`lib/sed-engine.js`**, **`awk`** → **`lib/awk-engine.js`**, **`jq`** → **`lib/jq-engine.js`**, **`man`** → **`lib/man-render.js`**, **`ls`** / **`dircolors`** → lscolors helpers, **`edit`** / **`nano`** → **`lib/edit-*.js`** + shared TUI), then **`src/<name>.js`** (**`nano`** reuses **`src/edit.js`**); writes to **`kernel/bin/<name>`** and **`packages/bare-os-seeder/kernel/bin/<name>`**. CLI: **`node build.mjs`** when executed as main.
 - **Manual pages** — Authoring: **`packages/bare-os-coreutils/man/pages/<name>.json`**; schema: **`man/schema.json`**. Optional **`examples`** (cheat.sh-style) and **`descriptionMode`**: **`preserve`** for preformatted text. **`scripts/ingest-handbook-for-man.mjs`** merges every **`handbook/*.md`** as **`man(7)`** at build time (**`man handbook`**, **`man handbook-01-introduction`**, …). Regenerate JSON stubs with **`node packages/bare-os-coreutils/scripts/seed-man-pages.mjs`**. Runtime: **`/bin/man`** reads **`/share/man/man.json`**. **Handbook:** [handbook/10-manpages-and-online-help.md](../../handbook/10-manpages-and-online-help.md).
-- **Commands** (sources under **`src/`**, same order as **`COREUTILS_COMMANDS`** in [`commands.mjs`](../../packages/bare-os-coreutils/lib/commands.mjs)): `arch`, `awk`, `base32`, `base64`, `basename`, `basenc`, `cat`, `chgrp`, `chmod`, `chown`, `cksum`, `clear`, `comm`, `cp`, `crontab`, `cut`, `date`, `df`, `dir`, `dirname`, `dircolors`, `du`, `edit`, `echo`, `env`, `exit`, `expand`, `expr`, `factor`, `false`, `find`, `fmt`, `fold`, `getconf`, `git-pear`, `grep`, `groups`, `head`, `hdms`, `help`, `hostid`, `hostname`, `id`, `install`, `join`, `jq`, `ln`, `login`, `logout`, `logname`, `ls`, `man`, `md5sum`, `mkdir`, `mkfifo`, `mktemp`, `mv`, `nano`, `nl`, `nproc`, `numfmt`, `od`, `paste`, `pathchk`, `pr`, `printenv`, `printf`, `pwd`, `readlink`, `realpath`, `rev`, `rm`, `rmdir`, `savevault`, `sed`, `seq`, `sha1sum`, `sha256sum`, `sha512sum`, `shuf`, `sleep`, `sort`, `split`, `stat`, `sum`, `sync`, `tac`, `tail`, `tee`, `test`, `theme`, `time`, `touch`, `tr`, `truncate`, `true`, `tsort`, `tty`, `uname`, `uniq`, `unlink`, `unexpand`, `uptime`, `users`, `vdir`, `wc`, `which`, `who`, `whoami`, `xargs`, `yes` (**111** built names). The interactive TTY editor is **`edit`**; **`nano`** is the same built script under **`/bin/nano`**, and the default shell maps **`nano` → `edit`** (see **`defaultShellAliases`** in [`shell.js`](../../packages/bare-os-booter/lib/shell.js)). Each built script begins with **`BARE_OS_BIN_API`** in the concatenated prelude; root **`pretest`** runs **[`scripts/verify-kernel-seeder-parity.mjs`](../../scripts/verify-kernel-seeder-parity.mjs)** to keep **`kernel/bin/*`** and **`packages/bare-os-seeder/kernel/bin/*`** in sync and to require that pragma on every staged binary. Scripts are plain **`async function run(ctx, argv)`** using **`ctx.vfs`**, **`ctx.drive`**, **`ctx.b4a`**, **`ctx.console`**, optional **`bareStdin(ctx)`**, optional **`ctx.runBinCommand`** — no ESM **`import`** in **`src/`** (Bare-safe **`AsyncFunction`** load). **`dir`** / **`vdir`** delegate to **`ls -C`** / **`ls -l`**. **Booter-delegated** (stubs under **`kernel/bin/`**, logic in **`packages/bare-os-booter/lib/`**): **`systemctl`**, **`journalctl`** (bare-initd control; **`bare-initctl`** alias; see [handbook/04-the-booter-runtime.md](../../handbook/04-the-booter-runtime.md)). **Narrative reference:** [handbook/09-posix-utilities-shell-and-vfs.md](../../handbook/09-posix-utilities-shell-and-vfs.md).
+- **Commands** (sources under **`src/`**, same order as **`COREUTILS_COMMANDS`** in [`commands.mjs`](../../packages/bare-os-coreutils/lib/commands.mjs)): `arch`, `awk`, `base32`, `base64`, `basename`, `basenc`, `cat`, `chgrp`, `chmod`, `chown`, `cksum`, `clear`, `cmp`, `comm`, `cp`, `crontab`, `cut`, `date`, `df`, `dir`, `dirname`, `dircolors`, `du`, `edit`, `echo`, `env`, `exit`, `expand`, `expr`, `factor`, `false`, `find`, `fmt`, `fold`, `getconf`, `git-pear`, `grep`, `groups`, `head`, `hdms`, `help`, `hostid`, `hostname`, `id`, `install`, `join`, `jq`, `ln`, `login`, `logout`, `logname`, `ls`, `man`, `md5sum`, `mkdir`, `mkfifo`, `mktemp`, `mv`, `nano`, `nl`, `nproc`, `numfmt`, `od`, `paste`, `pathchk`, `pr`, `printenv`, `printf`, `pwd`, `readlink`, `realpath`, `rev`, `rm`, `rmdir`, `savevault`, `sed`, `seq`, `sha1sum`, `sha256sum`, `sha512sum`, `shuf`, `sleep`, `sort`, `split`, `stat`, `sum`, `sync`, `tac`, `tail`, `tee`, `test`, `theme`, `time`, `touch`, `tr`, `truncate`, `true`, `tsort`, `tty`, `uname`, `uniq`, `unlink`, `unexpand`, `uptime`, `users`, `vdir`, `wc`, `which`, `who`, `whoami`, `xargs`, `yes` (**112** built names). The interactive TTY editor is **`edit`**; **`nano`** is the same built script under **`/bin/nano`**, and the default shell maps **`nano` → `edit`** (see **`defaultShellAliases`** in [`shell.js`](../../packages/bare-os-booter/lib/shell.js)). Each built script begins with **`BARE_OS_BIN_API`** in the concatenated prelude; root **`pretest`** runs **[`scripts/verify-kernel-seeder-parity.mjs`](../../scripts/verify-kernel-seeder-parity.mjs)** to keep **`kernel/bin/*`** and **`packages/bare-os-seeder/kernel/bin/*`** in sync and to require that pragma on every staged binary. Scripts are plain **`async function run(ctx, argv)`** using **`ctx.vfs`**, **`ctx.drive`**, **`ctx.b4a`**, **`ctx.console`**, optional **`bareStdin(ctx)`**, optional **`ctx.runBinCommand`** — no ESM **`import`** in **`src/`** (Bare-safe **`AsyncFunction`** load). **`dir`** / **`vdir`** delegate to **`ls -C`** / **`ls -l`**. **Booter-delegated** (stubs under **`kernel/bin/`**, logic in **`packages/bare-os-booter/lib/`**): **`systemctl`**, **`journalctl`** (bare-initd control; **`bare-initctl`** alias; see [handbook/04-the-booter-runtime.md](../../handbook/04-the-booter-runtime.md)). **Narrative reference:** [handbook/09-posix-utilities-shell-and-vfs.md](../../handbook/09-posix-utilities-shell-and-vfs.md).
 
 ### 12.11 [packages/bare-os-booter/test.js](../../packages/bare-os-booter/test.js) and [test.identity.js](../../packages/bare-os-booter/test.identity.js)
 

docs/reference/package-bare-os-protocol.md

@@ -56,10 +56,10 @@ Re-exports from `./lib/channel.js`: `setupSeedChannel`.
 - Creates Protomux channel with `protocol: PROTOCOL_NAME`.
 - **Message 0**: `uint32` read index → if `localRAM.get(index)`, send on message 1.
 - **Message 1**: `msgDataEncoding` (inbound only on client).
-- **Message 2**: `c.buffer` — after `chan.open()`, sends 250-byte bitfield with bit 0 set (gossip stub).
-- **Message 3**: search request → responds on message 4 with empty `matches`.
+- **Message 2**: `c.buffer` — after `chan.open()`, sends 250-byte bitfield with bit 0 set (capability gossip stub; see **`kernel-feature-bits.js`**).
+- **Message 3**: search request (`msgSearchReqEncoding`) → **message 4** returns paths from the staged manifest whose lowercase path contains the query (trimmed); empty query returns a capped prefix of all manifest paths. **`setupSeedChannel(..., { manifestPaths, searchMaxMatches })`** supplies the list (seeder collects paths during **`stageKernelTree`**).
 - **Message 4**: search response encoding.
-- **Message 5**: RPC request → responds on message 6 with failure `"RPC not implemented on seeder"`.
+- **Message 5**: RPC request → **message 6** implements **`bare_os.version`**, **`bare_os.health`**, **`bare_os.kernel_info`**, **`bare_os.capabilities`** (feature bitfield JSON), **`bare_os.gossip`** (manifest count + timestamp); other modules/methods get **`success: false`** and error **`RPC not implemented on seeder`**.
 - **Message 6**: RPC response encoding.
 - Calls `replicateDrive(mux.stream)` (typically `drive.replicate(stream)`).
 

docs/reference/package-bare-os-seeder.md

@@ -45,7 +45,7 @@ Pear-safe path resolution (same idea as Holepunch [pear-rti](https://github.com/
 3. `Corestore(corestorePath())`, `Hyperdrive(store)`, `ready()`.
 4. `stageKernelTree`.
 5. `localRAM = Map`, `buildMbr(drive.key)`, `localRAM.set(0, mbr)`.
-6. `Hyperswarm`, on `connection`: `Protomux(socket)`, `setupSeedChannel(mux, localRAM, stream => drive.replicate(stream))`.
+6. `Hyperswarm`, on `connection`: `Protomux(socket)`, `setupSeedChannel(mux, localRAM, stream => drive.replicate(stream), { manifestPaths, searchMaxMatches })` — **`manifestPaths`** lists every staged drive path so peers can **search** and RPC against the live manifest.
 7. `swarm.join(topicKey())`, `swarm.join(drive.discoveryKey)`, `flush()`.
 8. Logs topic prefix hex, full drive key hex, Corestore path.