Implement the 20-task Bare OS POSIX + P2P roadmap: holepunch lockfile drift

reporting and audit:holepunch-clones docs; placeholder baseline automation;
maintainer kernel-image sync script; protomux schema coupling in protocol
tests; disk.os RPC hints (replication_operator_sketch, hyperblobs/blind v3);
union/mirror VFS + warm-cache selective eviction tests; extension resolver
coverage; curl/wget fall through PATH when BARE_OS_DELEGATE_ALLOW excludes
delegates (kernel-runner) with handbook/ctx docs; socket contract / Wasm /
boot budget strict path / hrpc allowlist tests; subprocess bridge meta;
shell until gate + tar stat metadata; POSIX profile triplet pretest verifier;
regenerate kernel bundle, seeder parity, and audit artifacts as needed.

Covers KERNEL_CONTRACT, POSIX_DECLARED_PROFILE, handbook, developer-guide,
scripts/README, and related reference docs.

docs/reference/environment-and-posix-appendix.md

@@ -65,11 +65,14 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_VFS_BIN_CACHE_BLAKE2B` — VFS — When **`1`** / **`true`** with **`BARE_OS_VFS_BIN_CACHE`**, **`/bin`** cache entries are keyed by **BLAKE2b** content digests (via **`bare-crypto`**) for deduplication across paths within the LRU budget.
 - `BARE_OS_VFS_ENFORCE_ACL` — VFS — When **`1`** / **`true`**, **`PATH.bare_acl`** sidecars (same text as **`getfacl` / `setfacl`**) can deny reads/writes on the personal drive. Lines **`user::`**, **`user:UID:`**, **`group::`**, **`group:GID:`**, **`other::`**, and **`mask::`** are interpreted with Linux-style **mask** capping named users, named groups, and **`group::`**; **`user::`** and **`other::`** are not masked. Object owner/group default to **`UID` / `GID`**; override with **`BARE_OS_ACL_OBJECT_UID`** / **`BARE_OS_ACL_OBJECT_GID`** when inode metadata differs. See **`bare-os-vfs-acl-enforce.js`**.
 - `BARE_OS_SHELL_LOOP_CONTROL` — Shell — When **`1`** / **`true`**, **`break`** and **`continue`** apply inside **`while`** / **`for`** (bounded by **`BARE_OS_SHELL_LOOP_MAX`**).
+- `BARE_OS_SHELL_UNTIL` — Shell — When **`1`** / **`true`**, enables **`until …; do …; done`** (condition inverted vs **`while`**; same **`BARE_OS_SHELL_LOOP_MAX`** cap).
 - `BARE_OS_VFS_SYSTEM_RO_ALIAS` — VFS — Absolute path prefix that maps read-only to the system Hyperdrive (listed in **`/proc/mounts`**).
 - `BARE_OS_VFS_LIB_BARE_CACHE` — VFS — When **`1`** / **`true`**, extend warm read-through cache to hot **`/lib/bare`** paths (same LRU style as **`/bin`** when bin cache is on). When a batch write updates only **`lib/bare/bare-module-manifest.json`**, the booter evicts **`/lib/bare/bundles/<ctxKey>.js`** entries for **`bundle:true`** manifest rows instead of flushing the whole warm cache; **`ctx.bareOsInvalidateWarmReadCachesFromBareManifestJson`** applies the same parse rules.
+- `BARE_OS_VFS_WARM_BATCH_SELECTIVE` — Booter — When **`1`** / **`true`**, **`ctx.bareOsVfsBatchWrite`** evicts individual **`/bin/*`** and **`/lib/bare/*`** warm-cache paths touched in the batch via **`vfs.bareOsEvictWarmReadLogicalPath`** instead of **`bareOsClearWarmReadCaches`**, except **`boot/init.js`** / **`lib/init/*`** puts still force a full clear for safety.
 - `BARE_OS_BOOT_PERF_DETAIL` — Stock kernel + booter — Per-stage **`boot-perf.json`** (**schema 2**) with optional **`bare-hrtime`** monotonic samples; when **`1`** on the host, the booter also logs **`bare_stdlib_merge_ns`** (wall **`hrtime`** delta for **`maybeMergeBareFromDrive`**) via structured host booter logging.
 - `BARE_OS_BOOT_BARE_STDLIB_RESOLUTION_MS` — Booter — Milliseconds for drive **`ctx.bare`** merge + optional host resolve before the guest kernel starts; copied into session env by the stock booter.
 - `BARE_OS_BOOT_BUDGET_MS_BARE_STDLIB` — Operator — Optional budget (ms) for the value above; when set and exceeded, the stock kernel logs **`bootBudgetBareStdlibExceeded`**, sets **`BARE_OS_BOOT_BUDGET_STDLIB_*`**, and records **`bareStdlibBudgetWarning`** in **`/run/bare-os/boot-perf.json`** (**schema 3** when stdlib telemetry fields are present).
+- `BARE_OS_BOOT_BUDGET_STRICT` — Stock kernel — With **`BARE_OS_BOOT_POLICY_STRICT`**, calls **`bareOsRequestBooterExit(1)`** after a cold or bare-stdlib budget violation (after appending **`bootBudgetViolation`** metadata to **`boot-transaction.ndjson`** when journaling is enabled).
 - `BARE_OS_KERNEL_EXT_GRAPH` — Stock kernel — Write **`/run/bare-os/kernel-ext-graph.json`** after **`kernel.ext.d`** ordering.
 - `BARE_OS_BIN_HYPERBEE_INDEX` — Booter — When **`1`** / **`true`**, writes **`/.bare-os/index/bin-hyperbee-hint.json`** (**schema 2**, **`namesDigest`**) and **`/.bare-os/indexes/hyperbee_status.json`**; optional **`hyperbee`** import probe; refreshed when **`bareOsVfsBatchWrite`** touches **`bin/*`** (same as manifest).
 - `BARE_OS_PEAR_INSPECT` — Booter — When **`1`** / **`true`**, emit **`bare-os:pear-inspect-snapshot`** on the host process after **`ctx`** is wired (non-secret snapshot only).
@@ -92,6 +95,9 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_KERNEL_HOT_RELOAD` — Booter — Dev: allow **`ctx.bareOsRequestKernelReload()`** to re-read **`/boot/init.js`**.
 - `BARE_OS_KERNEL_EXT_D_HOT_RELOAD` — Stock kernel — When **`1`** / **`true`**, after boot the kernel exposes **`ctx.bareOsReloadKernelExtDropinsSafe()`**, which re-scans **`/etc/bare-os/kernel.ext.d`** and runs only extension scripts not yet recorded (**append-only**; does not unload). When **`ctx.vfs.writeFile`** exists, each reload appends **`kernelExtReloadSchemaVersion`** lines to **`/run/bare-os/kernel-ext-reload.ndjson`**.
 - `BARE_OS_VFS_HYPERBLOBS_DEDUP` — Booter / features proc — When **`1`** / **`true`**, surfaces an operator hint under **`/proc/bare_os/features`** that host mirror / hyperblob pipelines may use content-defined chunking; the guest VFS does not enable hyperblobs by itself.
+- `BARE_OS_HYPERBLOBS_STATS_JSON` — Booter / **`disk.os`** — Optional non-secret JSON parsed into **`replication_operator_sketch.hyperblobsDedupSketch`** (**schema 3**).
+- `BARE_OS_BLIND_PEER_TOPOLOGY_V3_JSON` — Booter / **`disk.os`** — Optional non-secret JSON parsed into **`replication_operator_sketch.blindTopologySketchV3`** (**schema 3**).
+- `BARE_OS_SUBPROCESS_BRIDGE_META_JSON` — Booter / **`process_table.json`** — Optional JSON (**host-injected**); the stock snapshot exposes a non-secret summary under **`subprocessBridgeMeta`** (**schema 7** **`process_table`**) for **`bare-process`** / **`bare-subprocess`** bridge alignment.
 - `BARE_OS_XARGS_MAX_PROCS` — **`/bin/xargs`** — Raises the cap for **`-P`** parallelism (still bounded by a hard maximum of **32** and by delegate concurrency when **`runBinCommand`** uses workers); default effective cap **8** when unset.
 - `BARE_OS_PEER_FIREWALL_E2E_JSON` — Booter / replication proc — Optional operator JSON merged into **`/proc/bare_os/replication`** for peer-firewall end-to-end checks (**invalid JSON yields an error object** in proc).
 - `BARE_OS_REPLICATION_PLAN_JSON` — Booter — Optional JSON string merged into **`/proc/bare_os/replication`** as **`guestReplicationPlan`** (operator warm-replication / mirror-drive style hints; guest does not execute the plan).
@@ -152,7 +158,7 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_APPEND` — Booter — When **`1`** / **`true`**, register **`append`** listeners on the system Hyperdrive metadata and blob Hypercores (when present) to clear **`/bin`** / **`lib/bare`** warm read caches on replication (**offline-first** safety; may increase churn on busy drives).
 - `BARE_OS_SHELL_POSIX_MODE` — Shell — When **`1`** / **`true`**, **`( compound-list )`** runs as a grouped list in the same session (**no forked subshell**); must be the full top-level statement.
 - `BARE_OS_WASM_KERNEL` — Booter — When **`1`** / **`true`**, enables **`ctx.bareOsWasmKernelCompile`** (bounded **`WebAssembly.compile`** probe) and **`ctx.bareOsWasmKernelInstantiate`** (bounded **`WebAssembly.instantiate`** with isolated **`Memory`** and **`env.bare_os_nop`**).
-- `BARE_OS_WASM_KERNEL_SYSCALL` — Booter — When **`1`** / **`true`** with **`BARE_OS_WASM_KERNEL`**, **`instantiate`** also supplies sync Wasm imports **`env.bare_os_pathconf(pathPtr, pathLen, namePtr, nameLen, outPtr, outCap)`** (delegates to **`ctx.bareOsPathconf`**, NUL-terminated result) and **`env.bare_os_umask_get()`** (from session **`UMASK`**). Async **`ctx.bareOsSyscall`** ops are not exposed to Wasm.
+- `BARE_OS_WASM_KERNEL_SYSCALL` — Booter — When **`1`** / **`true`** with **`BARE_OS_WASM_KERNEL`**, **`instantiate`** also supplies sync Wasm imports **`env.bare_os_pathconf(pathPtr, pathLen, namePtr, nameLen, outPtr, outCap)`** (delegates to **`ctx.bareOsPathconf`**, NUL-terminated result) and **`env.bare_os_umask_get()`** (from session **`UMASK`**), plus **`env.bare_os_wall_time_ms32()`** (low 32 bits of **`Date.now()`**, signed wrap). Async **`ctx.bareOsSyscall`** ops are not exposed to Wasm.
 - `BARE_OS_POSIX_FD_SIM` — Booter — When **`1`** / **`true`**, enables in-memory POSIX-like pipe simulation: **`ctx.bareOsPosixFdSimPipe`**, **`bareOsPosixFdSimDup`**, **`bareOsPosixFdSimRead`**, **`bareOsPosixFdSimWrite`** (logical FD targets under **`posix-pipe:`**; see handbook ch.9).
 - `BARE_OS_POSIX_FD_SIM_MAX_BYTES` — Booter — Max buffered bytes per simulated pipe pair (default **`1048576`**, hard cap **16 MiB**).
 - `BARE_OS_POSIX_FCNTL_BLOCKING_WAIT` — Booter — When **`1`** / **`true`** / **`yes`**, **`F_SETLKW`** on cooperative advisory locks **waits** (FIFO queue) until the lock is free or **`BARE_OS_FCNTL_LOCK_WAIT_MS_MAX`** elapses (**`ETIMEDOUT`**).

docs/reference/package-bare-os-booter.md

@@ -63,7 +63,7 @@ See also [Kernel subsystem map](../architecture/kernel-subsystems.md) and [ADR 0
   - **`saveVault()`** — encrypt personal-drive files into `/.bare/vault/` (skips `/.bare`, `bin`, `boot`, history paths).
   - **`registerKernelShutdownHook(fn)`** — register async/sync teardown before **`stopBareInitd`** when the REPL session cleans up.
 - After **`createKernelReplSession`**: wires **`readLine`**, **`console`**, **`execLine`**, **`suspendReplForSubprocess`** / **`resumeReplAfterSubprocess`**, then **`await startBareInitd(ctx)`** (services such as kernel log mirroring).
-- Sets **`disk.os`** **after initd** with **`createBareOsDiskOsBridge`** (**`searchLocal`**, whitelisted **`execRpc`** / **`bare_os.*`**, optional **`replication_operator_sketch`** schema **2**, cap-gated **`replication_operator_intent`** when **`BARE_OS_DISK_OS_OPERATOR_INTENT_RPC=1`**) — peers use **`SwarmDisk`** messages **3–6**; see [`bare-os-disk-os-bridge.js`](../../packages/bare-os-booter/lib/bare-os-disk-os-bridge.js) and §12.4.
+- Sets **`disk.os`** **after initd** with **`createBareOsDiskOsBridge`** (**`searchLocal`**, whitelisted **`execRpc`** / **`bare_os.*`**, **`disk_os_hints`** schema **2**, **`replication_operator_sketch`** schema **3**, cap-gated **`replication_operator_intent`** when **`BARE_OS_DISK_OS_OPERATOR_INTENT_RPC=1`**) — peers use **`SwarmDisk`** messages **3–6**; see [`bare-os-disk-os-bridge.js`](../../packages/bare-os-booter/lib/bare-os-disk-os-bridge.js) and §12.4.
 - `try { await runKernelFromSource(...) } finally { await session.cleanup() }` — cleanup runs **`bareInitdShutdownActiveUnitsReverse`**, **`runKernelShutdownHooks`**, **`stopBareInitd`**, fish TTY teardown.
 
 **`boot-splash.js`** — TTY splash (disabled when `stdout` is not a TTY or `BARE_OS_NO_SPLASH=1`): initial full-screen clear and hidden cursor, then centered redraws from the top-left without erasing the whole screen each tick (reduces flicker); one full clear again if the terminal is resized. Vertically and horizontally centered “card” (Unicode box frame when wide enough; compact rules on very narrow widths). On very wide terminals the framed card (and progress bar) width is capped so the bar does not span the entire display. Layout scales with `stdout.columns` / `stdout.rows` (sensible fallbacks): more log lines on tall terminals (capped), word-wrapped phase text, ANSI-safe centering. **`createBootSplash(stdout, { bootLimitMs?, tagline?, footerLines? })`** — optional **`tagline`** and dim **`footerLines`**; **`main()`** passes booter and protocol package versions. Braille spinner, elapsed boot timer, bar vs `BARE_OS_BOOT_TIMEOUT_MS` (default 60s), shimmer title. `prepareForKernel()` stops the splash ticker, clears again, and shows the cursor before the fish shell; `fail()` centers a wrapped error message.

docs/reference/syscall-socket-contract.md

@@ -26,7 +26,7 @@ Enable with **`BARE_OS_POSIX_SOCKET_FD_BRIDGE=1`**. Requires **`ctx.bare`** to e
 
 - **Ancillary control** on **`sendmsg`**: non-empty binary **`control`** / **`controllen`**, or malformed **`cmsgs`**, → **`ENOTSUP`** + **`ancillaryReject`**.
 - **`recvmsg`**: **`controllen` 0**; **`msgHdr.name`** filled from UDP **`rinfo`** when present.
-- **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS=1`**: **`cmsgs`** and **`msgHdr.cmsgs`** may contain only objects **`{ fds: number[] }`** (logical SCM_RIGHTS). Each fd is duplicated; the syscall result includes **`scmRightsLocalDup: [{ from, to }]`**. Cap via **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS_MAX_FDS`** (default **4**). Idle / listen / bound bridge sockets reject dup. **`shutdown`** refcount-per-alias destroys the underlying slot when the last fd closes.
+- **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS=1`**: **`cmsgs`** and **`msgHdr.cmsgs`** may contain only objects **`{ fds: number[] }`** (logical SCM_RIGHTS). Each fd is duplicated; the syscall result includes **`scmRightsLocalDup: [{ from, to }]`**. Cap via **`BARE_OS_POSIX_SOCKET_SCM_RIGHTS_MAX_FDS`** (default **4**). Idle / listen / bound bridge sockets reject dup. **`shutdown`** refcount-per-alias destroys the underlying slot when the last fd closes. With this env set, the stock bridge implements **logical** fd duplication end-to-end (not host **`SCM_RIGHTS`**); without it, any non-empty ancillary payload remains **`ENOTSUP`** as documented in **`ancillaryControl`**.
 
 ## TCP **`shutdown`** / half-close