Update Docs

README.md

@@ -7,7 +7,7 @@ This project is **experimental research software**, not a production OS.
 ## What you get
 
 - **Two-drive model** — read-only **system** image + writable **personal** namespace; VFS routes `$HOME` and `/.bare/` to the personal drive.
-- **Tier-1 `/bin`** — ~113 POSIX-oriented utilities, line shell with pipelines and redirects, **`sed`**/**`awk`**, **`man`** backed by a merged JSON handbook + coreutils pages.
+- **Tier-1 `/bin`** — **149** POSIX-oriented utilities (authoritative list: **`COREUTILS_COMMANDS`** in [`packages/bare-os-coreutils/lib/commands.mjs`](packages/bare-os-coreutils/lib/commands.mjs); **`verify-man-coverage`** in **`pretest`** keeps **`man.json`** in sync), line shell with pipelines and redirects, **`sed`**/**`awk`**, **`man`** backed by a merged JSON handbook + coreutils pages.
 - **Identity** — Ed25519 account on the personal drive, guest vs unlocked session, encrypted vault snapshot (`savevault` / `logout --save`).
 - **Boot plumbing** — initd/cron **themes**, synthetic `/proc` / `/run` / `/sys`, optional **`ctx.bare`** bundles from **`/lib/bare`** (Holepunch catalog workflow at repo root).
 - **Protocol** — Swarm topic + Protomux **`bare-os-v1`**, 512-byte **MBR** with Hyperdrive keys (`BIOS` magic). Details: [handbook chapter 3](handbook/03-protocol-and-disk.md) and [protocol reference](docs/reference/package-bare-os-protocol.md).

developer-guide/adr/README.md

@@ -1,6 +1,11 @@
 # Architecture decision records (ADRs)
 
-Use [000-template.md](000-template.md) for new decisions. Number sequentially (`001-…`, `002-…`). See [002-wasm-kernel-compile-hook.md](002-wasm-kernel-compile-hook.md).
+Use [000-template.md](000-template.md) for new decisions. Number sequentially (`001-…`, `002-…`).
+
+| ADR | Topic | Status / primary implementation |
+| --- | --- | --- |
+| [001 — Feature bit governance](001-kernel-feature-bits-governance.md) | Kernel capability bitmask and wire v2 | Accepted — `packages/bare-os-protocol/lib/kernel-feature-bits.js`, [`capability-words.md`](../../docs/reference/capability-words.md) |
+| [002 — WASM compile hook](002-wasm-kernel-compile-hook.md) | `ctx.bareOsWasmKernelCompile` (compile-only) | Accepted — `packages/bare-os-booter/lib/bare-os-wasm-kernel.js`, env **`BARE_OS_WASM_KERNEL`** |
 
 ADRs capture **contract and behavior** choices that are expensive to reverse: protocol fields, capability semantics, boot policy keys, and deprecation windows.
 

docs/CONTRIBUTING-DOCS.md

@@ -1,6 +1,6 @@
 # Contributing to Bare OS documentation
 
-This repository ships documentation as **GitHub-flavored Markdown** (no static site generator in-tree). Changes are validated by **`npm run pretest`** (link checks, terminology rules, compatibility-matrix strings, roadmap row counts, and more). Read [scripts/README.md](../scripts/README.md) for the full verifier list.
+This repository ships documentation as **GitHub-flavored Markdown** (no static site generator in-tree). Changes are validated by **`npm run pretest`** (link checks, terminology rules, compatibility-matrix strings, roadmap row counts, **`verify-doc-tier1-count`** vs **`COREUTILS_COMMANDS`**, and more). Read [scripts/README.md](../scripts/README.md) for the full verifier list.
 
 ---
 
@@ -67,6 +67,16 @@ If you must quote a banned substring for wire-compat or third-party context, add
 
 ---
 
+## Pretest-generated documentation (do not hand-edit)
+
+Root **`npm run pretest`** refreshes or validates these artifacts; if you change contracts they must match after **`pretest`**:
+
+- [`docs/reference/posix-dashboard.md`](reference/posix-dashboard.md) — **`scripts/gen-posix-dashboard.mjs`**
+- [`docs/reference/kernel-extensions-generated-toc.md`](reference/kernel-extensions-generated-toc.md) — **`scripts/gen-kernel-extensions-index.mjs`**
+- [`docs/reference/ctx-client-helper.generated.ts`](reference/ctx-client-helper.generated.ts) — **`scripts/gen-ctx-client-helper.mjs`**
+
+---
+
 ## Single source of truth
 
 - **Version fields, offsets, feature bits, matrix tables:** update the **reference** page or JSON first; narrative chapters should link to it.

docs/README.md

@@ -159,6 +159,7 @@ Narrative spine: *why* and *how* the system fits together.
 | [09 — POSIX, shell, VFS](../handbook/09-posix-utilities-shell-and-vfs.md) | Coverage and divergences |
 | [10 — Man pages and help](../handbook/10-manpages-and-online-help.md) | JSON DB, handbook ingest |
 | [11 — Kernel program and research](../handbook/11-kernel-program-and-research.md) | Roadmap context, capability words |
+| [12 — P2P stack vs POSIX](../handbook/12-p2p-stack-and-posix-boundaries.md) | Hypercore, swarm, Protomux vs declared POSIX profile |
 
 ### Developer guide ([`developer-guide/`](../developer-guide/README.md))
 
@@ -198,6 +199,20 @@ How-to for code inside and around the image.
 | [Machine-readable data](data/README.md) | Roadmap JSON, terminology allowlist |
 | [Holepunch catalog](bare-holepunch-catalog.json) | Optional `ctx.bare` bundle metadata |
 
+### Topic index (canonical reference per subject)
+
+When updating behavior, edit the **canonical** row first; handbook, user manual, and developer guide should **summarize and link** here instead of copying versioned tables or env inventories.
+
+| Topic | Canonical spec / reference | Narrative (handbook) | Operator (users manual) | How-to (developer guide) |
+| --- | --- | --- | --- | --- |
+| Environment variables | [environment-and-posix-appendix.md](reference/environment-and-posix-appendix.md) | [Ch. 7 — Operations](../handbook/07-operations-and-development.md) | [Ch. 7 — Troubleshooting](../users-manual/07-troubleshooting-and-operations.md) | [Ch. 11 — Pear cookbook](../developer-guide/11-kernel-pear-cookbook.md) |
+| `ctx` / booter runtime | [package-bare-os-booter.md](reference/package-bare-os-booter.md), [ctx-api-versioning.md](reference/ctx-api-versioning.md) | [Ch. 4 — Booter runtime](../handbook/04-the-booter-runtime.md) | — | [Ch. 2 — `ctx`](../developer-guide/02-the-context-object.md) |
+| Protocol / MBR / Protomux | [package-bare-os-protocol.md](reference/package-bare-os-protocol.md) | [Ch. 3 — Protocol and disk](../handbook/03-protocol-and-disk.md) | [Ch. 1–3](../users-manual/01-what-this-is.md) | — |
+| Identity / vault / HDMS | [vault-threat-model.md](security/vault-threat-model.md), [package-bare-os-booter.md](reference/package-bare-os-booter.md) (guest `/.bare` policy) | [Ch. 5](../handbook/05-identity-vault-and-hdms.md) | [Ch. 5](../users-manual/05-home-identity-and-vault.md) | [Ch. 9 — Security](../developer-guide/09-security-and-trust.md) |
+| POSIX / syscalls / sockets | [POSIX_DECLARED_PROFILE.md](architecture/POSIX_DECLARED_PROFILE.md), [posix-syscall-facade-map.md](reference/posix-syscall-facade-map.md), [syscall-socket-contract.md](reference/syscall-socket-contract.md) | [Ch. 9](../handbook/09-posix-utilities-shell-and-vfs.md) | — | [Ch. 8 — Testing](../developer-guide/08-testing-and-debugging.md) |
+| Kernel program / capability words | [feature-roadmap.md](reference/feature-roadmap.md), [kernel-capabilities-index.md](reference/kernel-capabilities-index.md), [kernel-program.md](../developer-guide/kernel-program.md) | [Ch. 11–12](../handbook/11-kernel-program-and-research.md) | — | [kernel-program.md](../developer-guide/kernel-program.md) |
+| Tier-1 `/bin` / coreutils | [package-bare-os-coreutils-and-ci.md](reference/package-bare-os-coreutils-and-ci.md), **`packages/bare-os-coreutils/lib/commands.mjs`** | [Ch. 6–9](../handbook/06-kernel-and-binaries.md) | [Ch. 4](../users-manual/04-shell-path-and-scripts.md) | [Ch. 6 — Extending `/bin`](../developer-guide/06-extending-bin-coreutils.md) |
+
 ### Contract bump checklist
 
 When you change **`BARE_OS_CTX_API_VERSION`**, **`/proc`** JSON schemas, **`BARE_OS_PROTOCOL_*`** / package semver, **`BARE_OS_POSIX_PROFILE_VERSION`**, or kernel capability words, update every dependent artifact in one pass:

docs/adr/README.md

@@ -2,10 +2,11 @@
 
 Concise, stable pointers for contributors. Normative behavior remains in [`KERNEL_CONTRACT.md`](../architecture/KERNEL_CONTRACT.md), the handbook, and the developer guide.
 
-| ADR | Topic |
+| ADR | Topic | Status / primary implementation |
-| --- | --- |
+| --- | --- | --- |
-| [0001](0001-two-drive-p2p-model.md) | Two-drive model and swarm-centric replication |
+| [0001 — Two-drive](0001-two-drive-p2p-model.md) | Two-drive model and swarm-centric replication | Accepted — `packages/bare-os-booter/lib/vfs.js`, `swarm-disk.js` |
-| [0002](0002-deny-default-rpc-hrpc.md) | Deny-by-default seed RPC and HRPC bridges |
+| [0001 — Kernel subsystems](0001-kernel-subsystem-boundaries.md) | Booter vs image subsystem split | Accepted — `bare-os-capability-registry.js`, `bare-os-kernel-loader.js`, `bare-os-lifecycle-manager.js`; map in [`kernel-subsystems.md`](../architecture/kernel-subsystems.md) |
-| [0003](0003-posix-facade-no-fork.md) | POSIX-like facade without `fork` or host kernel ABI |
+| [0002](0002-deny-default-rpc-hrpc.md) | Deny-by-default seed RPC and HRPC bridges | Accepted — `bare-os-protocol/lib/seed-rpc-methods.js`, booter `ctx.bareOsHrpcRequest` |
-| [0004](0004-extension-trust-graph.md) | `kernel.ext.d` trust, semver `provides`, and pins |
+| [0003](0003-posix-facade-no-fork.md) | POSIX-like facade without `fork` or host kernel ABI | Accepted — `bare-os-syscalls-proc-json.js`, [`POSIX_DECLARED_PROFILE.md`](../architecture/POSIX_DECLARED_PROFILE.md) |
-| [0005](0005-observability-boundaries.md) | Guest `/proc` vs host logging and metrics |
+| [0004](0004-extension-trust-graph.md) | `kernel.ext.d` trust, semver `provides`, and pins | Accepted — `kernel/lib/init/fragments/30-init-kernel-extensions.js`, booter resolver |
+| [0005](0005-observability-boundaries.md) | Guest `/proc` vs host logging and metrics | Accepted — `bare-os-host-booter-log.js`, `packages/bare-os-seeder/lib/host-logger.mjs` |

docs/audit/PLACEHOLDER_BASELINE.md

@@ -33,7 +33,7 @@ This document classifies incomplete surfaces as of the kernel hardening pass. It
 | Item                         | Location                    | Notes |
 | ---------------------------- | --------------------------- | ----- |
 | ~~`gen-ctx-client-stub.mjs`~~ → **`gen-ctx-client-helper.mjs`** | `scripts/` | Renamed; generates TS client version constant aligned with **`BARE_OS_CTX_API_VERSION`**. |
-| Man / reference “placeholder” prose | `docs/`, `kernel/share/man/` | **Closed for stock tree:** `node scripts/verify-man-coverage.mjs` gates **146** Tier-1 commands; regenerate merged man DB with **`npm run build -w bare-os-coreutils`** when pages change. Narrative alignment: [handbook ch.9 §5](../../handbook/09-posix-utilities-shell-and-vfs.md#5-bin-utilities-catalog). |
+| Man / reference “placeholder” prose | `docs/`, `kernel/share/man/` | **Closed for stock tree:** `node scripts/verify-man-coverage.mjs` gates **149** Tier-1 commands ( **`COREUTILS_COMMANDS`** in **`packages/bare-os-coreutils/lib/commands.mjs`** ); regenerate merged man DB with **`npm run build -w bare-os-coreutils`** when pages change. Narrative alignment: [handbook ch.9 §5](../../handbook/09-posix-utilities-shell-and-vfs.md#5-bin-utilities-catalog). |
 
 ## Extension multisig gate (stock kernel)
 

docs/audit/bundle-health.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-04-06T03:12:51.824Z",
+  "generatedAt": "2026-04-06T03:20:32.248Z",
   "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",
   "buildTool": "packages/bare-os-bare-libs/build.mjs",
   "bundles": [

docs/glossary.md

@@ -56,6 +56,8 @@ Short definitions for terms used across the user manual, handbook, developer gui
 
 **System drive** — Replicated OS image: **`/bin`**, **`/boot`**, **`/etc`**, etc. Treated as shared and replaceable from the swarm’s perspective.
 
+**Tier-1 `/bin`** — Command names shipped as **`/bin/*`** on the system drive; the authoritative list is **`COREUTILS_COMMANDS`** in **`packages/bare-os-coreutils/lib/commands.mjs`**. Root **`pretest`** runs **`scripts/verify-man-coverage.mjs`** so every Tier-1 name has a matching **`man.json`** page.
+
 **SwarmDisk** — Booter-side disk implementation that reads the OS image from replicated storage.
 
 **VFS** — Virtual file system: path classes, mounts, synthetic **`/proc`**, **`/run`**, **`/sys`**. Policy sketch: [vfs-path-classes.md](reference/vfs-path-classes.md).

docs/reference/README.md

@@ -7,7 +7,7 @@ This directory holds the split **file-by-file inventory** that used to live in t
 | Kind | Where to start |
 | --- | --- |
 | Project overview | [README](../../README.md) |
-| Documentation hub | [docs/README.md](../README.md) |
+| Documentation hub | [docs/README.md](../README.md) (includes **topic index**: canonical reference vs handbook / user manual / developer guide) |
 | Glossary / FAQ / troubleshooting | [glossary.md](../glossary.md) · [faq.md](../faq.md) · [troubleshooting.md](../troubleshooting.md) |
 | Operator narrative | [Handbook](../../handbook/README.md) |
 | Contributor / `ctx` / Pear | [Developer guide](../../developer-guide/README.md) |

docs/reference/environment-and-posix-appendix.md

@@ -294,7 +294,7 @@ The list below is one **bullet per variable** in the form **name — component
 - **Errno vocabulary** — **`/proc/bare_os/syscalls.json`** **`errnoHints`** and **`errnoAlignment`** document Linux-style integers (same family as **libuv** / **Holepunch `bare-fs`** binding **`error.code`** strings). Utilities such as **`mkdir`** print **`errno: message`** on stderr when the caught error exposes a string **`code`** (for example **`EEXIST`**, **`EACCES`**), matching the vocabulary in **`errnoHints`**. Simulated logical FDs (**`BARE_OS_POSIX_FD_SIM`**) use **`EBADF`**, **`EAGAIN`**, **`EINVAL`**, **`ENOSYS`**, **`EOPNOTSUPP`** consistently; **`fcntl`** cooperative **`F_SETLK`** returns **`EAGAIN`** when contended; **`F_SETLKW`** does the same unless **`BARE_OS_POSIX_FCNTL_BLOCKING_WAIT`** is set (then **`ETIMEDOUT`** when **`BARE_OS_FCNTL_LOCK_WAIT_MS_MAX`** elapses). Cooperative waits are **not** kernel futexes: callers may see an **`EINTR`-shaped note** when a blocking wait is interrupted by policy rather than a real signal. **`fcntl`** **`O_APPEND`**/**`O_NONBLOCK`** bit masks align with **`bare-fs`** open-flag shapes when the host resolves native FS errors.
 - **Shell** — Pipelines, **`;`**, **`&&`** / \*\*` —  — `**, redirects, quoting, **`$VAR`**, **`$?`**, optional **`${VAR:-word}`** / **`${VAR#prefix}`** when **`BARE*OS_SHELL_PARAM_EXPANSION=1`**, **`jobs`** / **`fg`** / **`wait`**, optional background **`&`** segments, builtins including bounded **`if`**, **`while`**, **`for`**, **`case`** (caps **`BARE_OS_SHELL_LOOP_MAX`**, **`BARE_OS_SHELL_CASE_MAX_BRANCHES`**). Optional bounded **`$(…)`** when **`BARE_OS_SHELL_CMDSUBST=1`**; optional larger pipeline capture via **`BARE_OS_SHELL_STREAMING`** / **`BARE_OS_SHELL_STREAMING_MULT`**. Branching uses **`ctx.exitCode`**. Bounded pipeline capture (**`BARE_OS_PIPELINE*\*`**, **`ctx.bareOsRuntimeCaps`**); optional boot-snippet allowlist (**`BARE_OS_BOOT_ALLOWLIST`** + **`/etc/bare-os/boot.allow`**). No subshells or full POSIX **`sh`\*\*.
 - **Ownership** — Display and permission checks use **`UID`/`GID`** and mode bits; **`chown`/`chgrp`** update **`metadata.bareOs`** on the **personal** writable tree (not a multi-user host kernel).
-- **Utilities** — Tier-1 JS **`/bin`** (**~113** commands; see [§12.10](package-bare-os-coreutils-and-ci.md#1210-package-bare-os-coreutils)): text tools include **`paste`**, **`split`**, **`tac`**, **`rev`**, **`expand`**, **`unexpand`**, **`fold`**, **`fmt`**, **`comm`**, **`cmp`**, **`join`**, **`pr`**, **`yes`** (line-capped via **`BARE_OS_YES_MAX_LINES`** / **`getconf`**), **`shuf`** (capped via **`BARE_OS_SHUF_MAX_LINES`**), **`tsort`**, **`factor`**, **`expr`** (integer-focused subset), **`numfmt`** (**`--to=iec`** / **`--to=si`**). Checksums: **`md5sum`** (bundled MD5), **`sha1sum`**, **`sha256sum`**, **`sha512sum`** (Web Crypto where available), **`sum`**, **`base32`**, **`basenc`** (**`--base16`**). Files: **`truncate`**, **`unlink`**, **`install`**, **`df`** (synthetic Hyperdrive row; **`-h`** human sizes), **`sync`** (no-op), **`timeout`** (wall-clock cap; exit **124** on timeout when **`BARE_OS_FEATURE_ABORT_TIMEOUT`** is advertised). Session stubs: **`arch`**, **`groups`**, **`hostid`**, **`nproc`**, **`uptime`**, **`users`**, **`who`**. Plus earlier parity: **`man`**, **`sed`** (including **`-z`**, **`BARE_OS_SED_NULL_MAX_RECORDS`**), **`awk`**, **`grep`** (**`-r`** with **`--include`/`--exclude`/`--exclude-dir`**, **`BARE_OS_GREP_FILTER_MAX`**), **`cp`** (**`-u`/`-v`/`-p`**), **`mv`**, **`find`** (**`-regex`**, **`-exec`/`-ok`**, **`BARE_OS_FIND_EXEC_MAX`**), **`mktemp`**, **`git-pear`**, **`cksum`**, **`getconf`** (static name table plus live **`vfs.env`** overrides for caps; **`-a`**), **`xargs`** (**`-P`** cap raised via **`BARE_OS_XARGS_MAX_PROCS`**, hard max **32**), **`getfacl`** / **`setfacl`** (POSIX-style ACL **view/edit** against synthetic **`/.bare_acl.json`** sidecars; see handbook ch.9), **`dircolors`**, **`theme`**, **`ls`**, **`uniq`**, **`realpath`**, **`base64`**, **`rm`** **`-d`**, **`stat`** **`%F`**. **`dir`** / **`vdir`** call **`ls`**. Large **`sed`/`awk`** are not byte-identical to GNU on all inputs. **`mkfifo`** → **`/run/bare-os/ipc/`**; optional logical process groups via **`ctx.bareOsIpc.assignProcessGroup`** / **`signalProcessGroup`** (POSIX **`setpgid`** / **`killpg`** analog for IPC routing). Machine-readable per-command POSIX hints: stock **`/etc/bare-os/posix_utilities.json`** (path echoed in **`/proc/bare_os_features`** and **`metrics_live`**). Online help: **`/share/man/man.json`** and **`man`**.
+- **Utilities** — Tier-1 JS **`/bin`** (**149** commands; authoritative list **`COREUTILS_COMMANDS`** in **`packages/bare-os-coreutils/lib/commands.mjs`**; see [§12.10](package-bare-os-coreutils-and-ci.md#1210-package-bare-os-coreutils)): text tools include **`paste`**, **`split`**, **`tac`**, **`rev`**, **`expand`**, **`unexpand`**, **`fold`**, **`fmt`**, **`comm`**, **`cmp`**, **`join`**, **`pr`**, **`yes`** (line-capped via **`BARE_OS_YES_MAX_LINES`** / **`getconf`**), **`shuf`** (capped via **`BARE_OS_SHUF_MAX_LINES`**), **`tsort`**, **`factor`**, **`expr`** (integer-focused subset), **`numfmt`** (**`--to=iec`** / **`--to=si`**). Checksums: **`md5sum`** (bundled MD5), **`sha1sum`**, **`sha256sum`**, **`sha512sum`** (Web Crypto where available), **`sum`**, **`base32`**, **`basenc`** (**`--base16`**). Files: **`truncate`**, **`unlink`**, **`install`**, **`df`** (synthetic Hyperdrive row; **`-h`** human sizes), **`sync`** (no-op), **`timeout`** (wall-clock cap; exit **124** on timeout when **`BARE_OS_FEATURE_ABORT_TIMEOUT`** is advertised). Session stubs: **`arch`**, **`groups`**, **`hostid`**, **`nproc`**, **`uptime`**, **`users`**, **`who`**. Plus earlier parity: **`man`**, **`sed`** (including **`-z`**, **`BARE_OS_SED_NULL_MAX_RECORDS`**), **`awk`**, **`grep`** (**`-r`** with **`--include`/`--exclude`/`--exclude-dir`**, **`BARE_OS_GREP_FILTER_MAX`**), **`cp`** (**`-u`/`-v`/`-p`**), **`mv`**, **`find`** (**`-regex`**, **`-exec`/`-ok`**, **`BARE_OS_FIND_EXEC_MAX`**), **`mktemp`**, **`git-pear`**, **`cksum`**, **`getconf`** (static name table plus live **`vfs.env`** overrides for caps; **`-a`**), **`xargs`** (**`-P`** cap raised via **`BARE_OS_XARGS_MAX_PROCS`**, hard max **32**), **`getfacl`** / **`setfacl`** (POSIX-style ACL **view/edit** against synthetic **`/.bare_acl.json`** sidecars; see handbook ch.9), **`dircolors`**, **`theme`**, **`ls`**, **`uniq`**, **`realpath`**, **`base64`**, **`rm`** **`-d`**, **`stat`** **`%F`**. **`dir`** / **`vdir`** call **`ls`**. Large **`sed`/`awk`** are not byte-identical to GNU on all inputs. **`mkfifo`** → **`/run/bare-os/ipc/`**; optional logical process groups via **`ctx.bareOsIpc.assignProcessGroup`** / **`signalProcessGroup`** (POSIX **`setpgid`** / **`killpg`** analog for IPC routing). Machine-readable per-command POSIX hints: stock **`/etc/bare-os/posix_utilities.json`** (path echoed in **`/proc/bare_os_features`** and **`metrics_live`**). Online help: **`/share/man/man.json`** and **`man`**.
 - **Process tooling note** — **`ps`** and **`kill`** operate on Bare OS synthetic process rows (`pid` 1..3 for kernel/booter/shell); they do not target host OS processes.
 - **Additional utility coverage** — **`dd`** (block-copy subset) and **`logger`** (structured append to **`/var/log/messages`**) are available as Tier-1 commands.
 - **Mount tooling note** — **`mount`** / **`umount`** are Hyperdrive/HDMS-backed commands for `/mnt/<label>` and are not host-kernel mount syscalls.

docs/release-checklist.md

@@ -11,6 +11,8 @@ Run these steps before tagging or publishing a Pear bundle so the kernel, seeder
 5. **`node scripts/gen-kernel-extensions-index.mjs`** when extension indices are part of your change set.
 6. **`npm test`** at the root (runs **`pretest`** parity, banned terminology, bundle markers/throws, ctx API checks, and workspace tests).
 
+When **`COREUTILS_COMMANDS`** in **`packages/bare-os-coreutils/lib/commands.mjs`** changes length, update the **Tier-1 count** prose in root **`README.md`**, **`kernel/README.md`**, **`docs/reference/environment-and-posix-appendix.md`**, **`docs/audit/PLACEHOLDER_BASELINE.md`**, and **`packages/bare-os-coreutils/README.md`** to match — **`scripts/verify-doc-tier1-count.mjs`** (part of **`pretest`**) fails otherwise.
+
 Optional: **`npm run release-checklist`** runs **`scripts/release-checklist.mjs`** for automated JSON checks when configured.
 
 **Quarterly:** compare Holepunch dependency pins in **`packages/bare-os-booter/package.json`** (and optional **`optionalDependencies`**) against your local mirror under **`pearcli/holepunch-repos/holepunchto_repos`** (or upstream tags). Note API or semver changes before bulk upgrades. When **`docs/audit/bundle-health.json`** changes by more than a few percent for any bundle, record a one-line reason in **`packages/bare-os-bare-libs/README.md`** (bundle health log) and shrink **`docs/audit/bundle-marker-allowlist.json`** / **`bundle-throw-allowlist.json`** when upstream clears markers.

handbook/09-posix-utilities-shell-and-vfs.md

@@ -90,7 +90,7 @@ When HDMS or the booter attaches extra Hyperdrives on **`disk.auxiliaryDrives`**
 
 ### 2.5.1 Read-through cache (`/bin`, optional `/lib/bare`)
 
-With **`BARE_OS_VFS_BIN_CACHE=1`**, the booter keeps a bounded LRU of system-drive **`readFile`** results for **`/bin/*`**. Add **`BARE_OS_VFS_LIB_BARE_CACHE=1`** to extend the same warm path to **`/lib/bare/*`** (bundle resolution hot paths). Hit, miss, and per-prefix counters appear under **`warmReadCache`** in **`/proc/bare_os/metrics_live.json`** (and the coalesced **`ctx.bareOsReadProcMetricsLive()`** view) when the cache is enabled. After live replication or policy changes, call **`ctx.bareOsInvalidateWarmReadCaches(reason)`** (or rely on **`ctx.bareOsVfsBatchWrite`** when batch **`put`** paths touch **`bin/`** or **`lib/bare/`**) so operators do not read stale bytes from warm entries. Reasons whose text includes **`replication`** also increment **`vfs.warm_read_cache_invalidate_replication`** for replication-path auditing. **`BARE_OS_VFS_WARM_CACHE_PREFIX_INVALIDATE=1`** evicts **`/bin`**, **`/etc`**, **`/lib`**, **`/usr`**, or personal prefixes when replicated core lengths increase (see **`metrics_live.replicationLive.warmPrefixInvalidate`**). **`BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION=1`** performs a **full** warm-cache clear via **`ctx.bareOsInvalidateWarmReadCaches('replication:core-length')`** on the same growth signal (surfaced under **`warmFullInvalidateOnReplication`**). Hyperswarm connection budgeting uses **`BARE_OS_SWARM_MAX_PEERS`**, **`BARE_OS_SWARM_MAX_CLIENT_CONNECTIONS`**, **`BARE_OS_SWARM_MAX_SERVER_CONNECTIONS`**, and **`BARE_OS_SWARM_MAX_PARALLEL`** (surfaced on **`/proc/bare_os/swarm`** **`connectionBudget`** and **`disk.os` `replication_operator_sketch`** schema **4**). **`ctx.bareOsSyscall('nanosleep', { tv_sec, tv_nsec })`** and bridge **`getsockopt`/`setsockopt`** (**`SO_KEEPALIVE`**, **`TCP_NODELAY`**) are documented in **`/proc/bare_os/syscalls.json`** (POSIX profile **1.0.13**).
+With **`BARE_OS_VFS_BIN_CACHE=1`**, the booter keeps a bounded LRU of system-drive **`readFile`** results for **`/bin/*`**. Add **`BARE_OS_VFS_LIB_BARE_CACHE=1`** to extend the same warm path to **`/lib/bare/*`** (bundle resolution hot paths). Hit, miss, and per-prefix counters appear under **`warmReadCache`** in **`/proc/bare_os/metrics_live.json`** (and the coalesced **`ctx.bareOsReadProcMetricsLive()`** view) when the cache is enabled. After live replication or policy changes, call **`ctx.bareOsInvalidateWarmReadCaches(reason)`** (or rely on **`ctx.bareOsVfsBatchWrite`** when batch **`put`** paths touch **`bin/`** or **`lib/bare/`**) so operators do not read stale bytes from warm entries. Reasons whose text includes **`replication`** also increment **`vfs.warm_read_cache_invalidate_replication`** for replication-path auditing. **`BARE_OS_VFS_WARM_CACHE_PREFIX_INVALIDATE=1`** evicts **`/bin`**, **`/etc`**, **`/lib`**, **`/usr`**, or personal prefixes when replicated core lengths increase (see **`metrics_live.replicationLive.warmPrefixInvalidate`**). **`BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION=1`** performs a **full** warm-cache clear via **`ctx.bareOsInvalidateWarmReadCaches('replication:core-length')`** on the same growth signal (surfaced under **`warmFullInvalidateOnReplication`**). Hyperswarm connection budgeting uses **`BARE_OS_SWARM_MAX_PEERS`**, **`BARE_OS_SWARM_MAX_CLIENT_CONNECTIONS`**, **`BARE_OS_SWARM_MAX_SERVER_CONNECTIONS`**, and **`BARE_OS_SWARM_MAX_PARALLEL`** (surfaced on **`/proc/bare_os/swarm`** **`connectionBudget`** and **`disk.os` `replication_operator_sketch`** schema **4**). **`ctx.bareOsSyscall('nanosleep', { tv_sec, tv_nsec })`** and bridge **`getsockopt`/`setsockopt`** (**`SO_KEEPALIVE`**, **`TCP_NODELAY`**) are documented in **`/proc/bare_os/syscalls.json`** (profile version **`BARE_OS_POSIX_PROFILE_VERSION`** — [POSIX declared profile](../docs/architecture/POSIX_DECLARED_PROFILE.md), [compatibility matrix](../docs/reference/compatibility-matrix.md)).
 
 ### 2.6 Copy and move
 

kernel/README.md

@@ -19,7 +19,7 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 ## Contents
 
 - **`init.js`** — Kernel entry: must define `async function start(ctx)`. Boot order: **`/etc/os-release`** → **`/etc/motd`** → optional **`/etc/bare-os/rc.profile.<profile>`** (profile from **`BARE_OS_BOOT_PROFILE`** or first line of **`/etc/bare-os/profile`**; the booter mirrors the resolved name in **`ctx.env.BARE_OS_BOOT_PROFILE_RESOLVED`** and **`/run/bare-os/boot_profile`**) → **`/etc/bare-os/rc`** → **`/etc/bare-os/rc.d/*`** (sorted; digit-prefixed names only; skip dotfiles, `*~`, `README*`, `*.md`; optional **`BARE_OS_RC_D_SKIP`** comma list and **`prefix*`** patterns) → optional **`/etc/bare-os/rc.local`** → **`/etc/bare-os/kernel.d/*`** (same rules as **`rc.d`**) → banner → when **`BARE_OS_SKIP_REPL`**, optional **onboot** lines from **`BARE_OS_ONBOOT`** or **`/etc/bare-os/onboot`** → **`readLine` / `execLine`** loop. Boot **`execLine`** errors in trusted snippets are logged; with **`BARE_OS_BOOT_STRICT=1`** or **`true`**, the first throw calls **`requestBooterExit(1)`** and stops later boot phases. Custom kernels may call **`ctx.registerKernelShutdownHook(fn)`** before initd disposers; use **`ctx.bareOsRuntimeCaps`** for limits, pseudo paths, and **`features`** ([`developer-guide/02-the-context-object.md`](../developer-guide/02-the-context-object.md)).
-- **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md) (**~115** commands; list in **`packages/bare-os-coreutils/lib/commands.mjs`**). Each file is **`runtime.js`** + optional preamble (**`lib/md5.js`** for **`md5sum`**, **`lib/*-engine.js`** for **`sed`**/**`awk`**, **`jq-engine.js`**, **`lib/man-render.js`**, **`lib/edit-*.js`** for **`edit`**/**`nano`**, lscolors for **`ls`**/**`dircolors`**, …) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**). **`/bin/nano`** duplicates **`/bin/edit`** for familiarity; the shell’s default **`nano` → `edit`** alias uses the **`edit`** command name after expansion. **`dir`**/**`vdir`** invoke **`ls`** via **`ctx.runBinCommand`**.
+- **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md) (**149** commands; authoritative list **`COREUTILS_COMMANDS`** in **`packages/bare-os-coreutils/lib/commands.mjs`**). Each file is **`runtime.js`** + optional preamble (**`lib/md5.js`** for **`md5sum`**, **`lib/*-engine.js`** for **`sed`**/**`awk`**, **`jq-engine.js`**, **`lib/man-render.js`**, **`lib/edit-*.js`** for **`edit`**/**`nano`**, lscolors for **`ls`**/**`dircolors`**, …) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**). **`/bin/nano`** duplicates **`/bin/edit`** for familiarity; the shell’s default **`nano` → `edit`** alias uses the **`edit`** command name after expansion. **`dir`**/**`vdir`** invoke **`ls`** via **`ctx.runBinCommand`**.
 - **`lib/bare/`** — Optional IIFE bundles + **`manifest.json`** for **`ctx.bare`** drive merge, built by [bare-os-bare-libs](../packages/bare-os-bare-libs/README.md). Same trust model as **`bin/`** (trusted seeded image).
 - **`share/man/man.json`** — Merged manual database for **`/bin/man`** (built by **`bare-os-coreutils`**; see [handbook ch.10](../handbook/10-manpages-and-online-help.md)).
 - **`etc/os-release`** — Static OS metadata (`NAME`, `VERSION`, …).

kernel/etc/bare-os/posix_utilities.json

@@ -1,7 +1,7 @@
 {
   "schema": 2,
   "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-06T03:12:50.834Z",
+  "generatedAt": "2026-04-06T03:20:31.090Z",
   "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
   "commandIndex": [
     {

kernel/lib/bare/manifest.json

@@ -1,18 +1,18 @@
 {
   "version": 1,
   "bundles": [
-    {
-      "path": "/lib/bare/bundles/b4a.js",
-      "keys": [
-        "b4a"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/safetyCatch.js",
       "keys": [
         "safetyCatch"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/b4a.js",
+      "keys": [
+        "b4a"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
@@ -25,12 +25,6 @@
         "compactEncoding"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUrl.js",
-      "keys": [
-        "bareUrl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/protomux.js",
       "keys": [
@@ -38,9 +32,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareEncoding.js",
+      "path": "/lib/bare/bundles/bareUrl.js",
       "keys": [
-        "bareEncoding"
+        "bareUrl"
       ]
     },
     {
@@ -49,24 +43,18 @@
         "barePath"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareEncoding.js",
+      "keys": [
+        "bareEncoding"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
         "bareEvents"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAbort.js",
-      "keys": [
-        "bareAbort"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareReadline.js",
-      "keys": [
-        "bareReadline"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAbortController.js",
       "keys": [
@@ -74,9 +62,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "path": "/lib/bare/bundles/bareAbort.js",
       "keys": [
-        "bareAnsiEscapes"
+        "bareAbort"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareReadline.js",
+      "keys": [
+        "bareReadline"
       ]
     },
     {
@@ -92,9 +92,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAppKit.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
       "keys": [
-        "bareAppKit"
+        "bareAnsiEscapes"
       ]
     },
     {
@@ -104,9 +104,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareCrypto.js",
+      "path": "/lib/bare/bundles/bareAssert.js",
       "keys": [
-        "bareCrypto"
+        "bareAssert"
       ]
     },
     {
@@ -116,15 +116,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAssert.js",
+      "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
-        "bareAssert"
+        "bareAppKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareBmp.js",
-      "keys": [
-        "bareBmp"
       ]
     },
     {
@@ -133,18 +127,18 @@
         "bareAtomics"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundle.js",
-      "keys": [
-        "bareBundle"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBuffer.js",
       "keys": [
         "bareBuffer"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBmp.js",
+      "keys": [
+        "bareBmp"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleCompile.js",
       "keys": [
@@ -158,9 +152,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBoot.js",
+      "path": "/lib/bare/bundles/bareBundle.js",
       "keys": [
-        "bareBoot"
+        "bareBundle"
       ]
     },
     {
@@ -169,24 +163,18 @@
         "bareBundleEvaluate"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareConsole.js",
-      "keys": [
-        "bareConsole"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBundleId.js",
       "keys": [
         "bareBundleId"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareConsole.js",
+      "keys": [
+        "bareConsole"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDaemon.js",
       "keys": [
@@ -199,6 +187,18 @@
         "bareChannel"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBoot.js",
+      "keys": [
+        "bareBoot"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDebugLog.js",
+      "keys": [
+        "bareDebugLog"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
@@ -224,9 +224,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareCov.js",
+      "path": "/lib/bare/bundles/bareDgram.js",
       "keys": [
-        "bareCov"
+        "bareDgram"
       ]
     },
     {
@@ -236,9 +236,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDgram.js",
+      "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
-        "bareDgram"
+        "bareCov"
       ]
     },
     {
@@ -254,9 +254,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
+      "path": "/lib/bare/bundles/bareFileLogger.js",
       "keys": [
-        "bareFfmpegEncodings"
+        "bareFileLogger"
       ]
     },
     {
@@ -272,27 +272,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
       "keys": [
-        "bareHeif"
+        "bareFfmpegEncodings"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareGtk.js",
-      "keys": [
-        "bareGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
       ]
     },
     {
@@ -301,6 +283,18 @@
         "bareFs"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareGtk.js",
+      "keys": [
+        "bareGtk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
@@ -308,15 +302,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareIco.js",
+      "path": "/lib/bare/bundles/bareHrtime.js",
       "keys": [
-        "bareIco"
+        "bareHrtime"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareImageResample.js",
-      "keys": [
-        "bareImageResample"
       ]
     },
     {
@@ -326,9 +314,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHttps.js",
+      "path": "/lib/bare/bundles/bareImageResample.js",
       "keys": [
-        "bareHttps"
+        "bareImageResample"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareIco.js",
+      "keys": [
+        "bareIco"
       ]
     },
     {
@@ -337,6 +331,18 @@
         "bareInspect"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareHttps.js",
+      "keys": [
+        "bareHttps"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareJpeg.js",
       "keys": [
@@ -349,48 +355,42 @@
         "bareIpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareIntl.js",
-      "keys": [
-        "bareIntl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLief.js",
       "keys": [
         "bareLief"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLogger.js",
       "keys": [
         "bareLogger"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareMake.js",
-      "keys": [
-        "bareMake"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLink.js",
       "keys": [
         "bareLink"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspector.js",
+      "keys": [
+        "bareInspector"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModuleLexer.js",
       "keys": [
         "bareModuleLexer"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareMake.js",
+      "keys": [
+        "bareMake"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModuleResolve.js",
       "keys": [
@@ -409,6 +409,12 @@
         "bareModuleTraverse"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNative.js",
+      "keys": [
+        "bareNative"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNdk.js",
       "keys": [
@@ -421,18 +427,6 @@
         "bareNodeFetch"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareOpen.js",
-      "keys": [
-        "bareOpen"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNet.js",
-      "keys": [
-        "bareNet"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
@@ -440,9 +434,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNative.js",
+      "path": "/lib/bare/bundles/bareOpen.js",
       "keys": [
-        "bareNative"
+        "bareOpen"
       ]
     },
     {
@@ -452,21 +446,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePack.js",
+      "path": "/lib/bare/bundles/bareNet.js",
       "keys": [
-        "barePack"
+        "bareNet"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePerformance.js",
-      "keys": [
-        "barePerformance"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
-      "keys": [
-        "bareNodeRuntime"
       ]
     },
     {
@@ -476,9 +458,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePng.js",
+      "path": "/lib/bare/bundles/barePerformance.js",
       "keys": [
-        "barePng"
+        "barePerformance"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePack.js",
+      "keys": [
+        "barePack"
       ]
     },
     {
@@ -487,12 +475,24 @@
         "bareDev"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePng.js",
+      "keys": [
+        "barePng"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
         "barePipe"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
@@ -505,6 +505,18 @@
         "barePunycode"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareProcess.js",
+      "keys": [
+        "bareProcess"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareQuerystring.js",
+      "keys": [
+        "bareQuerystring"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRealm.js",
       "keys": [
@@ -517,18 +529,6 @@
         "bareQueueMicrotask"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareQuerystring.js",
-      "keys": [
-        "bareQuerystring"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRuntime.js",
       "keys": [
@@ -536,15 +536,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareProcess.js",
+      "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
-        "bareProcess"
+        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSdl.js",
-      "keys": [
-        "bareSdl"
       ]
     },
     {
@@ -553,36 +547,12 @@
         "bareRpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSemver.js",
-      "keys": [
-        "bareSemver"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSignals.js",
-      "keys": [
-        "bareSignals"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
         "bareRun"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSidecar.js",
-      "keys": [
-        "bareSidecar"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStringDecoder.js",
-      "keys": [
-        "bareStringDecoder"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRepl.js",
       "keys": [
@@ -590,9 +560,33 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStorage.js",
+      "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
-        "bareStorage"
+        "bareSemver"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSdl.js",
+      "keys": [
+        "bareSdl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSidecar.js",
+      "keys": [
+        "bareSidecar"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSignals.js",
+      "keys": [
+        "bareSignals"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareStringDecoder.js",
+      "keys": [
+        "bareStringDecoder"
       ]
     },
     {
@@ -601,6 +595,24 @@
         "bareStream"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStorage.js",
+      "keys": [
+        "bareStorage"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "keys": [
+        "bareSubprocess"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareStructuredClone.js",
+      "keys": [
+        "bareStructuredClone"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStdio.js",
       "keys": [
@@ -614,15 +626,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStructuredClone.js",
+      "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
-        "bareStructuredClone"
+        "bareTiff"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
-      "keys": [
-        "bareSystemLogger"
       ]
     },
     {
@@ -632,27 +638,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
-        "bareSubprocess"
+        "bareSystemLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTiff.js",
-      "keys": [
-        "bareTiff"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareThread.js",
-      "keys": [
-        "bareThread"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTcp.js",
-      "keys": [
-        "bareTcp"
       ]
     },
     {
@@ -662,9 +650,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTpl.js",
+      "path": "/lib/bare/bundles/bareTcp.js",
       "keys": [
-        "bareTpl"
+        "bareTcp"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTls.js",
+      "keys": [
+        "bareTls"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareThread.js",
+      "keys": [
+        "bareThread"
       ]
     },
     {
@@ -674,9 +674,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareTpl.js",
       "keys": [
-        "bareTls"
+        "bareTpl"
       ]
     },
     {
@@ -703,18 +703,18 @@
         "bareV8"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareVm.js",
-      "keys": [
-        "bareVm"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUnionBundle.js",
       "keys": [
         "bareUnionBundle"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareVm.js",
+      "keys": [
+        "bareVm"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
@@ -722,9 +722,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWebKit.js",
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
-        "bareWebKit"
+        "bareV8ToIstanbul"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWebp.js",
+      "keys": [
+        "bareWebp"
       ]
     },
     {
@@ -733,12 +739,6 @@
         "bareWebKitGtk"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
-      "keys": [
-        "bareV8ToIstanbul"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUtils.js",
       "keys": [
@@ -746,9 +746,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWebp.js",
+      "path": "/lib/bare/bundles/bareWebKit.js",
       "keys": [
-        "bareWebp"
+        "bareWebKit"
       ]
     },
     {
@@ -1595,8 +1595,8 @@
   ],
   "bundleProvenance": {
     "schemaVersion": 1,
-    "generatedAt": "2026-04-06T03:12:51.812Z",
+    "generatedAt": "2026-04-06T03:20:32.232Z",
-    "gitCommit": "071edccfb3f074d3ee00c901d5df2a514063815d",
+    "gitCommit": "72e0c9c881ec9702ce6f100d781b8045a6a5093b",
     "nodeVersion": "v22.22.0",
     "bundleTier": "all",
     "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",

kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1775445170834,
+  "atMs": 1775445631090,
   "commands": [
     "arch",
     "awk",

package.json

@@ -22,7 +22,7 @@
     "verify:manifest-data": "node scripts/verify-bare-module-manifest-data.mjs",
     "smoke:bare-manifest": "node scripts/smoke-bare-manifest-imports.mjs",
     "bundle:kernel": "node scripts/bundle-kernel-init.mjs",
-    "pretest": "npm run build -w bare-os-coreutils && npm run verify:manifest-data && npm run build -w bare-os-bare-libs && npm run bundle:kernel && node scripts/gen-kernel-extensions-index.mjs && node scripts/verify-kernel-seeder-parity.mjs && node scripts/verify-banned-terminology.mjs && node scripts/verify-naming-alias-matrix.mjs && node scripts/verify-feature-roadmap-canonical.mjs && node scripts/verify-no-new-giant-phase-identifiers.mjs && node scripts/verify-runtime-no-incomplete-markers.mjs && node scripts/audit-placeholder-baseline.mjs --check && node scripts/verify-bare-imports.mjs && node scripts/verify-booter-boot-steps-alignment.mjs && node scripts/gen-ctx-client-helper.mjs && node scripts/verify-ctx-client-helper-sync.mjs && node scripts/verify-personal-drive-path-policy.mjs && node scripts/verify-extension-manifest-schema.mjs && node scripts/verify-boot-policy-extension-signer-pins.mjs && node scripts/verify-ctx-api-feature-bits.mjs && node scripts/verify-kernel-capabilities-contract.mjs && node scripts/verify-kernel-capabilities-word-6.mjs && node scripts/verify-kernel-capabilities-word-7.mjs && node scripts/verify-kernel-capabilities-word-8.mjs && node scripts/verify-kernel-capabilities-word-9.mjs && node scripts/verify-kernel-capabilities-word-10.mjs && node scripts/verify-kernel-capabilities-word-11.mjs && node scripts/verify-ctx-dts.mjs && node scripts/validate-example-schemas.mjs && node scripts/verify-doc-links.mjs && node scripts/verify-man-coverage.mjs && node scripts/verify-compat-matrix.mjs && node scripts/verify-doc-contracts.mjs && node scripts/verify-bundle-health.mjs && node scripts/verify-bundle-markers.mjs && node scripts/verify-bundle-throws.mjs && node scripts/verify-kernel-program-doc.mjs && node scripts/verify-kernel-program-proc-schema.mjs && node scripts/verify-kernel-program-roadmap-table.mjs && node scripts/verify-pear-no-static-node-import.mjs && node scripts/gen-posix-dashboard.mjs && node scripts/verify-posix-dashboard.mjs && node scripts/verify-posix-profile-triplet.mjs && node scripts/verify-posix-compliance-matrix.mjs && node scripts/verify-holepunch-clone-drift.mjs && node scripts/verify-holepunch-clone-freshness.mjs && npm run smoke:bare-manifest",
+    "pretest": "npm run build -w bare-os-coreutils && npm run verify:manifest-data && npm run build -w bare-os-bare-libs && npm run bundle:kernel && node scripts/gen-kernel-extensions-index.mjs && node scripts/verify-kernel-seeder-parity.mjs && node scripts/verify-banned-terminology.mjs && node scripts/verify-naming-alias-matrix.mjs && node scripts/verify-feature-roadmap-canonical.mjs && node scripts/verify-no-new-giant-phase-identifiers.mjs && node scripts/verify-runtime-no-incomplete-markers.mjs && node scripts/audit-placeholder-baseline.mjs --check && node scripts/verify-bare-imports.mjs && node scripts/verify-booter-boot-steps-alignment.mjs && node scripts/gen-ctx-client-helper.mjs && node scripts/verify-ctx-client-helper-sync.mjs && node scripts/verify-personal-drive-path-policy.mjs && node scripts/verify-extension-manifest-schema.mjs && node scripts/verify-boot-policy-extension-signer-pins.mjs && node scripts/verify-ctx-api-feature-bits.mjs && node scripts/verify-kernel-capabilities-contract.mjs && node scripts/verify-kernel-capabilities-word-6.mjs && node scripts/verify-kernel-capabilities-word-7.mjs && node scripts/verify-kernel-capabilities-word-8.mjs && node scripts/verify-kernel-capabilities-word-9.mjs && node scripts/verify-kernel-capabilities-word-10.mjs && node scripts/verify-kernel-capabilities-word-11.mjs && node scripts/verify-ctx-dts.mjs && node scripts/validate-example-schemas.mjs && node scripts/verify-doc-links.mjs && node scripts/verify-man-coverage.mjs && node scripts/verify-doc-tier1-count.mjs && node scripts/verify-compat-matrix.mjs && node scripts/verify-doc-contracts.mjs && node scripts/verify-bundle-health.mjs && node scripts/verify-bundle-markers.mjs && node scripts/verify-bundle-throws.mjs && node scripts/verify-kernel-program-doc.mjs && node scripts/verify-kernel-program-proc-schema.mjs && node scripts/verify-kernel-program-roadmap-table.mjs && node scripts/verify-pear-no-static-node-import.mjs && node scripts/gen-posix-dashboard.mjs && node scripts/verify-posix-dashboard.mjs && node scripts/verify-posix-profile-triplet.mjs && node scripts/verify-posix-compliance-matrix.mjs && node scripts/verify-holepunch-clone-drift.mjs && node scripts/verify-holepunch-clone-freshness.mjs && npm run smoke:bare-manifest",
     "test": "npm run test --workspaces --if-present",
     "test:bare": "npm run test -w bare-os-protocol && npm run test:bare -w bare-os-booter && npm run test -w bare-os-seeder",
     "verify-kernel-seeder": "node scripts/verify-kernel-seeder-parity.mjs",

packages/bare-os-coreutils/README.md

@@ -33,9 +33,7 @@ Or `node packages/bare-os-coreutils/build.mjs`.
 
 ## Commands (authoritative list)
 
-**Source of truth:** **`lib/commands.mjs`** — **`COREUTILS_COMMANDS`** (imported by **`build.mjs`** and **`scripts/build-man-db.mjs`**). Each name must have **`man/pages/<name>.json`**.
+**Source of truth:** **`lib/commands.mjs`** — **`COREUTILS_COMMANDS`** (imported by **`build.mjs`** and **`scripts/build-man-db.mjs`**). Each name must have **`man/pages/<name>.json`**. **149** Tier-1 commands in the current tree; root **`pretest`** runs **`verify-man-coverage.mjs`** against this list (do not hand-maintain a duplicate comma-separated inventory here—use **`lib/commands.mjs`**, **`ls /bin`** in the guest, or **`man -k`**).
-
-`arch`, `awk`, `base32`, `base64`, `basename`, `basenc`, `baretop`, `btop`, `cat`, `chgrp`, `chmod`, `chown`, `cksum`, `clear`, `comm`, `cp`, `crontab`, `curl`, `cut`, `date`, `df`, `dir`, `dirname`, `dircolors`, `du`, `edit`, `echo`, `env`, `exit`, `expand`, `expr`, `factor`, `false`, `find`, `fmt`, `fold`, `getconf`, `git-pear`, `grep`, `groups`, `head`, `hdms`, `help`, `hostid`, `hostname`, `id`, `install`, `join`, `jq`, `ln`, `login`, `logout`, `logname`, `ls`, `man`, `md5sum`, `mkdir`, `mkfifo`, `mktemp`, `mv`, `nano`, `nl`, `nproc`, `numfmt`, `od`, `paste`, `pathchk`, `pr`, `printenv`, `printf`, `pwd`, `readlink`, `realpath`, `rev`, `rm`, `rmdir`, `savevault`, `sed`, `seq`, `sha1sum`, `sha256sum`, `sha512sum`, `shuf`, `sleep`, `sort`, `split`, `stat`, `sum`, `sync`, `tac`, `tail`, `tee`, `test`, `theme`, `time`, `timeout`, `touch`, `tr`, `truncate`, `true`, `tsort`, `tty`, `uname`, `uniq`, `unlink`, `unexpand`, `uptime`, `users`, `vdir`, `wc`, `wget`, `which`, `who`, `whoami`, `xargs`, `yes`
 
 **`edit`** is a full-screen TTY buffer editor (syntax highlighting, search, save). **`nano`** is built from the same **`src/edit.js`** with the same **`lib/edit-*.js`** preamble; **`/bin/nano`** exists for familiarity, and the stock shell alias **`nano` → `edit`** routes **`nano`** to that utility (see **`packages/bare-os-booter/lib/shell.js`**). Both require a real TTY (**`stdout.isTTY`**).
 

packages/bare-os-protocol/README.md

@@ -12,7 +12,7 @@ Shared **wire format and constants** for the Bare operating system monorepo: Hyp
 - **`buildMbr` / `parseMbr`** — Pack/unpack primary + optional failover Hyperdrive keys
 - **`setupSeedChannel`** — Wire Protomux messages 0–6 for RAM block reads, gossip bitfield, manifest path **search**, **RPC** (incl. `bare_os.capabilities` with **`bits`** … **`bits11`** when non-zero, typed errors for unknown RPC methods, `bare_os.replication_status`, `bare_os.replication_queue`, extended RPC short names in **`seed-rpc-methods.js`**, `bare_os.gossip`), and `drive.replicate`
 
-Subpath exports: `bare-os-protocol/constants.js`, `bare-os-protocol/messages` (compact-encoding schemas), `bare-os-protocol/kernel-feature-bits.js` (documented booter capability words **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_*`**; **`BARE_OS_KERNEL_FEATURE_BITS_DOC=14`**; surfaced in **`/proc/bare_os_features`** and **`/proc/bare_os/`**), `bare-os-protocol/lib/seed-rpc-methods.js` (authoritative **`bare_os.*`** RPC name list for **`kernel_info`**), `bare-os-protocol/protocol-meta.js` (**`BARE_OS_PROTOCOL_PACKAGE_VERSION`** for the seed handshake).
+Subpath exports: `bare-os-protocol/constants.js`, `bare-os-protocol/messages` (compact-encoding schemas), `bare-os-protocol/kernel-feature-bits.js` (documented booter capability words **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_*`**; **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** — see source; surfaced in **`/proc/bare_os_features`** and **`/proc/bare_os/`**), `bare-os-protocol/lib/seed-rpc-methods.js` (authoritative **`bare_os.*`** RPC name list for **`kernel_info`**), `bare-os-protocol/protocol-meta.js` (**`BARE_OS_PROTOCOL_PACKAGE_VERSION`** for the seed handshake).
 
 ## Consumers
 

packages/bare-os-seeder/kernel/README.md

@@ -19,7 +19,7 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 ## Contents
 
 - **`init.js`** — Kernel entry: must define `async function start(ctx)`. Boot order: **`/etc/os-release`** → **`/etc/motd`** → optional **`/etc/bare-os/rc.profile.<profile>`** (profile from **`BARE_OS_BOOT_PROFILE`** or first line of **`/etc/bare-os/profile`**; the booter mirrors the resolved name in **`ctx.env.BARE_OS_BOOT_PROFILE_RESOLVED`** and **`/run/bare-os/boot_profile`**) → **`/etc/bare-os/rc`** → **`/etc/bare-os/rc.d/*`** (sorted; digit-prefixed names only; skip dotfiles, `*~`, `README*`, `*.md`; optional **`BARE_OS_RC_D_SKIP`** comma list and **`prefix*`** patterns) → optional **`/etc/bare-os/rc.local`** → **`/etc/bare-os/kernel.d/*`** (same rules as **`rc.d`**) → banner → when **`BARE_OS_SKIP_REPL`**, optional **onboot** lines from **`BARE_OS_ONBOOT`** or **`/etc/bare-os/onboot`** → **`readLine` / `execLine`** loop. Boot **`execLine`** errors in trusted snippets are logged; with **`BARE_OS_BOOT_STRICT=1`** or **`true`**, the first throw calls **`requestBooterExit(1)`** and stops later boot phases. Custom kernels may call **`ctx.registerKernelShutdownHook(fn)`** before initd disposers; use **`ctx.bareOsRuntimeCaps`** for limits, pseudo paths, and **`features`** ([`developer-guide/02-the-context-object.md`](../developer-guide/02-the-context-object.md)).
-- **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md) (**~115** commands; list in **`packages/bare-os-coreutils/lib/commands.mjs`**). Each file is **`runtime.js`** + optional preamble (**`lib/md5.js`** for **`md5sum`**, **`lib/*-engine.js`** for **`sed`**/**`awk`**, **`jq-engine.js`**, **`lib/man-render.js`**, **`lib/edit-*.js`** for **`edit`**/**`nano`**, lscolors for **`ls`**/**`dircolors`**, …) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**). **`/bin/nano`** duplicates **`/bin/edit`** for familiarity; the shell’s default **`nano` → `edit`** alias uses the **`edit`** command name after expansion. **`dir`**/**`vdir`** invoke **`ls`** via **`ctx.runBinCommand`**.
+- **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md) (**149** commands; authoritative list **`COREUTILS_COMMANDS`** in **`packages/bare-os-coreutils/lib/commands.mjs`**). Each file is **`runtime.js`** + optional preamble (**`lib/md5.js`** for **`md5sum`**, **`lib/*-engine.js`** for **`sed`**/**`awk`**, **`jq-engine.js`**, **`lib/man-render.js`**, **`lib/edit-*.js`** for **`edit`**/**`nano`**, lscolors for **`ls`**/**`dircolors`**, …) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**). **`/bin/nano`** duplicates **`/bin/edit`** for familiarity; the shell’s default **`nano` → `edit`** alias uses the **`edit`** command name after expansion. **`dir`**/**`vdir`** invoke **`ls`** via **`ctx.runBinCommand`**.
 - **`lib/bare/`** — Optional IIFE bundles + **`manifest.json`** for **`ctx.bare`** drive merge, built by [bare-os-bare-libs](../packages/bare-os-bare-libs/README.md). Same trust model as **`bin/`** (trusted seeded image).
 - **`share/man/man.json`** — Merged manual database for **`/bin/man`** (built by **`bare-os-coreutils`**; see [handbook ch.10](../handbook/10-manpages-and-online-help.md)).
 - **`etc/os-release`** — Static OS metadata (`NAME`, `VERSION`, …).

packages/bare-os-seeder/kernel/etc/bare-os/posix_utilities.json

@@ -1,7 +1,7 @@
 {
   "schema": 2,
   "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-06T03:12:50.834Z",
+  "generatedAt": "2026-04-06T03:20:31.090Z",
   "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
   "commandIndex": [
     {

packages/bare-os-seeder/kernel/lib/bare/manifest.json

@@ -1,18 +1,18 @@
 {
   "version": 1,
   "bundles": [
-    {
-      "path": "/lib/bare/bundles/b4a.js",
-      "keys": [
-        "b4a"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/safetyCatch.js",
       "keys": [
         "safetyCatch"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/b4a.js",
+      "keys": [
+        "b4a"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
@@ -25,12 +25,6 @@
         "compactEncoding"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUrl.js",
-      "keys": [
-        "bareUrl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/protomux.js",
       "keys": [
@@ -38,9 +32,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareEncoding.js",
+      "path": "/lib/bare/bundles/bareUrl.js",
       "keys": [
-        "bareEncoding"
+        "bareUrl"
       ]
     },
     {
@@ -49,24 +43,18 @@
         "barePath"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareEncoding.js",
+      "keys": [
+        "bareEncoding"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
         "bareEvents"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAbort.js",
-      "keys": [
-        "bareAbort"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareReadline.js",
-      "keys": [
-        "bareReadline"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAbortController.js",
       "keys": [
@@ -74,9 +62,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "path": "/lib/bare/bundles/bareAbort.js",
       "keys": [
-        "bareAnsiEscapes"
+        "bareAbort"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareReadline.js",
+      "keys": [
+        "bareReadline"
       ]
     },
     {
@@ -92,9 +92,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAppKit.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
       "keys": [
-        "bareAppKit"
+        "bareAnsiEscapes"
       ]
     },
     {
@@ -104,9 +104,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareCrypto.js",
+      "path": "/lib/bare/bundles/bareAssert.js",
       "keys": [
-        "bareCrypto"
+        "bareAssert"
       ]
     },
     {
@@ -116,15 +116,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAssert.js",
+      "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
-        "bareAssert"
+        "bareAppKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareBmp.js",
-      "keys": [
-        "bareBmp"
       ]
     },
     {
@@ -133,18 +127,18 @@
         "bareAtomics"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundle.js",
-      "keys": [
-        "bareBundle"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBuffer.js",
       "keys": [
         "bareBuffer"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBmp.js",
+      "keys": [
+        "bareBmp"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleCompile.js",
       "keys": [
@@ -158,9 +152,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBoot.js",
+      "path": "/lib/bare/bundles/bareBundle.js",
       "keys": [
-        "bareBoot"
+        "bareBundle"
       ]
     },
     {
@@ -169,24 +163,18 @@
         "bareBundleEvaluate"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareConsole.js",
-      "keys": [
-        "bareConsole"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBundleId.js",
       "keys": [
         "bareBundleId"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareConsole.js",
+      "keys": [
+        "bareConsole"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDaemon.js",
       "keys": [
@@ -199,6 +187,18 @@
         "bareChannel"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBoot.js",
+      "keys": [
+        "bareBoot"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareDebugLog.js",
+      "keys": [
+        "bareDebugLog"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
@@ -224,9 +224,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareCov.js",
+      "path": "/lib/bare/bundles/bareDgram.js",
       "keys": [
-        "bareCov"
+        "bareDgram"
       ]
     },
     {
@@ -236,9 +236,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDgram.js",
+      "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
-        "bareDgram"
+        "bareCov"
       ]
     },
     {
@@ -254,9 +254,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
+      "path": "/lib/bare/bundles/bareFileLogger.js",
       "keys": [
-        "bareFfmpegEncodings"
+        "bareFileLogger"
       ]
     },
     {
@@ -272,27 +272,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
       "keys": [
-        "bareHeif"
+        "bareFfmpegEncodings"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareGtk.js",
-      "keys": [
-        "bareGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
       ]
     },
     {
@@ -301,6 +283,18 @@
         "bareFs"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareGtk.js",
+      "keys": [
+        "bareGtk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
@@ -308,15 +302,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareIco.js",
+      "path": "/lib/bare/bundles/bareHrtime.js",
       "keys": [
-        "bareIco"
+        "bareHrtime"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareImageResample.js",
-      "keys": [
-        "bareImageResample"
       ]
     },
     {
@@ -326,9 +314,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHttps.js",
+      "path": "/lib/bare/bundles/bareImageResample.js",
       "keys": [
-        "bareHttps"
+        "bareImageResample"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareIco.js",
+      "keys": [
+        "bareIco"
       ]
     },
     {
@@ -337,6 +331,18 @@
         "bareInspect"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareHttps.js",
+      "keys": [
+        "bareHttps"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareJpeg.js",
       "keys": [
@@ -349,48 +355,42 @@
         "bareIpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareIntl.js",
-      "keys": [
-        "bareIntl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLief.js",
       "keys": [
         "bareLief"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLogger.js",
       "keys": [
         "bareLogger"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareMake.js",
-      "keys": [
-        "bareMake"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLink.js",
       "keys": [
         "bareLink"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspector.js",
+      "keys": [
+        "bareInspector"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModuleLexer.js",
       "keys": [
         "bareModuleLexer"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareMake.js",
+      "keys": [
+        "bareMake"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModuleResolve.js",
       "keys": [
@@ -409,6 +409,12 @@
         "bareModuleTraverse"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNative.js",
+      "keys": [
+        "bareNative"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNdk.js",
       "keys": [
@@ -421,18 +427,6 @@
         "bareNodeFetch"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareOpen.js",
-      "keys": [
-        "bareOpen"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNet.js",
-      "keys": [
-        "bareNet"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
@@ -440,9 +434,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNative.js",
+      "path": "/lib/bare/bundles/bareOpen.js",
       "keys": [
-        "bareNative"
+        "bareOpen"
       ]
     },
     {
@@ -452,21 +446,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePack.js",
+      "path": "/lib/bare/bundles/bareNet.js",
       "keys": [
-        "barePack"
+        "bareNet"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePerformance.js",
-      "keys": [
-        "barePerformance"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
-      "keys": [
-        "bareNodeRuntime"
       ]
     },
     {
@@ -476,9 +458,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePng.js",
+      "path": "/lib/bare/bundles/barePerformance.js",
       "keys": [
-        "barePng"
+        "barePerformance"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePack.js",
+      "keys": [
+        "barePack"
       ]
     },
     {
@@ -487,12 +475,24 @@
         "bareDev"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePng.js",
+      "keys": [
+        "barePng"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
         "barePipe"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
@@ -505,6 +505,18 @@
         "barePunycode"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareProcess.js",
+      "keys": [
+        "bareProcess"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareQuerystring.js",
+      "keys": [
+        "bareQuerystring"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRealm.js",
       "keys": [
@@ -517,18 +529,6 @@
         "bareQueueMicrotask"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareQuerystring.js",
-      "keys": [
-        "bareQuerystring"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRuntime.js",
       "keys": [
@@ -536,15 +536,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareProcess.js",
+      "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
-        "bareProcess"
+        "barePromClient"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSdl.js",
-      "keys": [
-        "bareSdl"
       ]
     },
     {
@@ -553,36 +547,12 @@
         "bareRpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSemver.js",
-      "keys": [
-        "bareSemver"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSignals.js",
-      "keys": [
-        "bareSignals"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
         "bareRun"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSidecar.js",
-      "keys": [
-        "bareSidecar"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStringDecoder.js",
-      "keys": [
-        "bareStringDecoder"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRepl.js",
       "keys": [
@@ -590,9 +560,33 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStorage.js",
+      "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
-        "bareStorage"
+        "bareSemver"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSdl.js",
+      "keys": [
+        "bareSdl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSidecar.js",
+      "keys": [
+        "bareSidecar"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSignals.js",
+      "keys": [
+        "bareSignals"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareStringDecoder.js",
+      "keys": [
+        "bareStringDecoder"
       ]
     },
     {
@@ -601,6 +595,24 @@
         "bareStream"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStorage.js",
+      "keys": [
+        "bareStorage"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "keys": [
+        "bareSubprocess"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareStructuredClone.js",
+      "keys": [
+        "bareStructuredClone"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStdio.js",
       "keys": [
@@ -614,15 +626,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStructuredClone.js",
+      "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
-        "bareStructuredClone"
+        "bareTiff"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
-      "keys": [
-        "bareSystemLogger"
       ]
     },
     {
@@ -632,27 +638,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
-        "bareSubprocess"
+        "bareSystemLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTiff.js",
-      "keys": [
-        "bareTiff"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareThread.js",
-      "keys": [
-        "bareThread"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTcp.js",
-      "keys": [
-        "bareTcp"
       ]
     },
     {
@@ -662,9 +650,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTpl.js",
+      "path": "/lib/bare/bundles/bareTcp.js",
       "keys": [
-        "bareTpl"
+        "bareTcp"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTls.js",
+      "keys": [
+        "bareTls"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareThread.js",
+      "keys": [
+        "bareThread"
       ]
     },
     {
@@ -674,9 +674,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareTpl.js",
       "keys": [
-        "bareTls"
+        "bareTpl"
       ]
     },
     {
@@ -703,18 +703,18 @@
         "bareV8"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareVm.js",
-      "keys": [
-        "bareVm"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUnionBundle.js",
       "keys": [
         "bareUnionBundle"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareVm.js",
+      "keys": [
+        "bareVm"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
@@ -722,9 +722,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWebKit.js",
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
-        "bareWebKit"
+        "bareV8ToIstanbul"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWebp.js",
+      "keys": [
+        "bareWebp"
       ]
     },
     {
@@ -733,12 +739,6 @@
         "bareWebKitGtk"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
-      "keys": [
-        "bareV8ToIstanbul"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUtils.js",
       "keys": [
@@ -746,9 +746,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWebp.js",
+      "path": "/lib/bare/bundles/bareWebKit.js",
       "keys": [
-        "bareWebp"
+        "bareWebKit"
       ]
     },
     {
@@ -1595,8 +1595,8 @@
   ],
   "bundleProvenance": {
     "schemaVersion": 1,
-    "generatedAt": "2026-04-06T03:12:51.812Z",
+    "generatedAt": "2026-04-06T03:20:32.232Z",
-    "gitCommit": "071edccfb3f074d3ee00c901d5df2a514063815d",
+    "gitCommit": "72e0c9c881ec9702ce6f100d781b8045a6a5093b",
     "nodeVersion": "v22.22.0",
     "bundleTier": "all",
     "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",

packages/bare-os-seeder/kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1775445170834,
+  "atMs": 1775445631090,
   "commands": [
     "arch",
     "awk",

scripts/README.md

@@ -264,6 +264,12 @@ Scans **`docs/`**, **`handbook/`**, **`developer-guide/`**, and **`scripts/*.md`
 
 Asserts every Tier-1 name in **`packages/bare-os-coreutils/lib/commands.mjs`** has a matching **`name`** entry in **`kernel/share/man/man.json`**. Root **`pretest`**.
 
+## `verify-doc-tier1-count.mjs`
+
+**Usage:** `node scripts/verify-doc-tier1-count.mjs`
+
+Ensures a fixed set of markdown files (root **`README.md`**, **`kernel/README.md`**, environment appendix, placeholder baseline, **`packages/bare-os-coreutils/README.md`**) document the live **`COREUTILS_COMMANDS.length`** and do not reintroduce obsolete **`~113`** / **`~115`** / **`146`** tier-1 approximations. Root **`pretest`** (after **`verify-man-coverage`**).
+
 ## `verify-compat-matrix.mjs`
 
 **Usage:** `node scripts/verify-compat-matrix.mjs`

scripts/verify-doc-tier1-count.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * CI: Tier-1 /bin count in key markdown must match COREUTILS_COMMANDS.length
+ * (prevents ~113 / ~115 / 146-style drift).
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+function read(rel) {
+  return fs.readFileSync(path.join(root, rel), 'utf8')
+}
+
+function must(cond, msg) {
+  if (!cond) {
+    console.error('verify-doc-tier1-count:', msg)
+    process.exit(1)
+  }
+}
+
+async function main() {
+  const { COREUTILS_COMMANDS } = await import(
+    path.join(root, 'packages/bare-os-coreutils/lib/commands.mjs')
+  )
+  const n = COREUTILS_COMMANDS.length
+  const needle = `**${n}**`
+
+  const checks = [
+    {
+      rel: 'README.md',
+      test: (t) => t.includes('Tier-1 `/bin`') && t.includes(needle)
+    },
+    {
+      rel: 'kernel/README.md',
+      test: (t) => t.includes('Tier-1 utilities') && t.includes(needle)
+    },
+    {
+      rel: 'docs/reference/environment-and-posix-appendix.md',
+      test: (t) => t.includes('Tier-1 JS') && t.includes(needle)
+    },
+    {
+      rel: 'docs/audit/PLACEHOLDER_BASELINE.md',
+      test: (t) =>
+        t.includes('verify-man-coverage.mjs') &&
+        t.includes(needle) &&
+        t.includes('Tier-1')
+    },
+    {
+      rel: 'packages/bare-os-coreutils/README.md',
+      test: (t) =>
+        t.includes('COREUTILS_COMMANDS') && t.includes(needle) && t.includes('Tier-1')
+    }
+  ]
+
+  const obsolete = ['~113', '~115', '146 Tier-1', '**146**']
+
+  for (const { rel, test } of checks) {
+    const text = read(rel)
+    must(test(text), `${rel}: must document Tier-1 count ${n} (${needle}) consistently`)
+    for (const o of obsolete) {
+      must(
+        !text.includes(o),
+        `${rel}: remove obsolete tier-1 count fragment ${JSON.stringify(o)}`
+      )
+    }
+  }
+
+  console.log('verify-doc-tier1-count: OK', n, 'commands')
+}
+
+main().catch((e) => {
+  console.error(e)
+  process.exit(1)
+})

users-manual/03-running-seeder-and-booter.md

@@ -52,6 +52,8 @@ cd packages/bare-os-booter && node index.js
 
 Default store paths are under **`~/.bare-os/corestore/`** for seeder and booter unless you set **`BARE_OS_SEED_STORE`**, **`BARE_OS_BOOT_STORE`**, or the shared base **`BARE_OS_HOST_DATA`**. See each package’s **`lib/paths.js`** for how overrides compose.
 
+On a **fresh clone**, build **`kernel/bin/*`** and **`kernel/lib/bare/`** before staging: from the repo root run **`npm run build -w bare-os-coreutils && npm run build -w bare-os-bare-libs`** (or **`npm run pretest`**, which also verifies kernel/seeder parity). Root **`npm run os:seeder`** runs those builds automatically before **`pear run --dev`**.
+
 ---
 
 ## Run with Pear (recommended for realistic behavior)

users-manual/06-help-man-and-documentation-map.md

@@ -42,7 +42,7 @@ These areas are intentional; each serves a different job:
 | **Developer guide** ([../developer-guide/README.md](../developer-guide/README.md)) | Scripts, **`ctx`**, **`start(ctx)`**, coreutils, testing, Pear, telemetry. |
 | **Reference** ([../docs/reference/README.md](../docs/reference/README.md)) | Packages, env appendix, data flow, compatibility matrix, capabilities, vault [threat model](../docs/reference/vault-threat-model.md). |
 
-If you are lost, start at the **[documentation home](../docs/README.md)**, which lists every tree plus **[glossary](../docs/glossary.md)**, **[FAQ](../docs/faq.md)**, **[troubleshooting router](../docs/troubleshooting.md)**, and **[contributing to docs](../docs/CONTRIBUTING-DOCS.md)**.
+If you are lost, start at the **[documentation home](../docs/README.md)**, which lists every tree plus a **topic index** (which doc is canonical for env vars, `ctx`, protocol, POSIX, and so on), **[glossary](../docs/glossary.md)**, **[FAQ](../docs/faq.md)**, **[troubleshooting router](../docs/troubleshooting.md)**, and **[contributing to docs](../docs/CONTRIBUTING-DOCS.md)**.
 
 ---