feat(kernel): giant-phase boot hooks, proc snapshot, and kernel UX tools

- Add BARE_OS_BOOT_SAFE_MODE, BOOT_TRANSACTION_JOURNAL, BOOT_CHECKPOINT in
  stock kernel; kernel.ext.d requires/after/before ordering; boot-ready
  subsystems.kernel.giantPhase adjunct
- Expose /proc/bare_os/giant_phase_program.json via bare-os-giant-phase;
  wire VFS, baretop snapshot, and ctx batch read
- Add /bin/kernel-doctor and /bin/kernel-explain; verify-giant-phase-doc in
  pretest; giant-phase-benchmark-harness stub
- Bump bareOsCtxApiVersion to 1.23.0; sync seeder kernel/init.js and runtime
  caps; extend booter tests for proc listing and safe mode

Docs: giant-phase-kernel-program.md, feature-roadmap, kernel-extensions,
compatibility-matrix, environment appendix, handbook 06/11, developer
guide, users-manual 07, scripts README; booter CHANGELOG

docs/reference/README.md

@@ -25,6 +25,7 @@ This directory holds the split **file-by-file inventory** that used to live in t
 - **Bits, env, `/proc`, and `ctx` map** — [Kernel capabilities index](kernel-capabilities-index.md)
 - **Version alignment** — [Compatibility matrix](compatibility-matrix.md)
 - **Roadmap status** — [Feature roadmap status](feature-roadmap.md)
+- **Giant phase kernel program (100 items)** — [developer-guide/giant-phase-kernel-program.md](../../developer-guide/giant-phase-kernel-program.md)
 - **Out of scope and tooling** (former §§15–16) — [Out of scope and tooling](out-of-scope-and-tooling.md)
 - **curl and wget (delegation, fetch stack, policy)** — [curl and wget](http-curl-and-wget.md)
 - **Published JSON Schemas** — [Published schemas: boot policy, telemetry, boot trace](../schemas/)

docs/reference/compatibility-matrix.md

@@ -14,7 +14,7 @@ Single place to compare **protocol**, **booter `ctx` API**, **feature-bit docume
 
 ## Version artifacts
 
-**`bareOsCtxApiVersion`** (current stock: **`1.22.0`**) — Defined in [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js). This is the semver string for the documented **`ctx`** contract; bump it when stable guest-visible behavior changes.
+**`bareOsCtxApiVersion`** (current stock: **`1.23.0`**) — Defined in [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js). This is the semver string for the documented **`ctx`** contract; bump it when stable guest-visible behavior changes.
 
 **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** (current stock: **`15`**) — Exported from [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js). It versions the feature-bit documentation and related governance; keep it aligned with [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../../developer-guide/adr/001-kernel-feature-bits-governance.md).
 

docs/reference/environment-and-posix-appendix.md

@@ -24,10 +24,14 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_LOCAL_SEED` — paths — Overrides local seed path helper (`defaultLocalSeedCorestorePath`); booter does not local-boot
 - `BARE_OS_SKIP_REPL` — Booter — If `1`, readline returns null — non-interactive exit
 - `BARE_OS_BOOT_TRACE` — Stock kernel (`init.js`) — If `1` or `true`, log each boot phase duration on stderr as `[boot] phase: Nms`; if `json`, log `{"phase":"…","ms":n}` per phase; **`ndjson`** adds **`sessionId`** / **`ts`** (same shape as `ctx.bareOsEmitBootEvent`)
+- `BARE_OS_BOOT_SAFE_MODE` — Stock kernel — **`1`** / **`true`** skips **`rc.d`**, **`kernel.ext.d`**, **`onboot`** after boot policy merge.
+- `BARE_OS_BOOT_TRANSACTION_JOURNAL` — Stock kernel — **`1`**, **`true`**, or **`ndjson`** appends phase records to **`/run/bare-os/boot-transaction.ndjson`** when **`ctx.vfs`** supports it.
+- `BARE_OS_BOOT_CHECKPOINT` — Stock kernel — **`1`** / **`true`** writes **`/run/bare-os/boot-checkpoint.json`** after each completed boot phase.
+- `BARE_OS_GIANT_PHASE_PROGRAM_JSON` — Booter / **`/proc/bare_os/giant_phase_program.json`** — Optional JSON merged into the giant-phase program snapshot (non-secret).
 - `MANWIDTH` — `/bin/man` — Wrap width for manual text (default `72`; minimum `40`)
 - `NO_COLOR` — `/bin/man` — If set, disable ANSI bold for section headings on a TTY
 
-**Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_SHELL_PARAM_EXPANSION`, `BARE_OS_SHELL_PARAM_EXPANSION_V2`, `BARE_OS_ENV_DASH_S`, `BARE_OS_VFS_WATCH_PSEUDO`, `BARE_OS_VFS_WATCH_SWARM`, `BARE_OS_SHELL_LOCAL_DECLARE`, `BARE_OS_DIAGNOSTICS_SUBSCRIBE`, `BARE_OS_AUTOPASS_INVITE_URL`, `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_TRACE`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_EXEC_LINE_BUDGET_MS`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_IPC_NAMESPACE`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_BOOT_POLICY_STRICT`, `BARE_OS_LAZY_PERSONAL_DRIVE`, `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT`, `BARE_OS_DELEGATE_ALLOW`, `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_MAX_CONCURRENT`, `BARE_OS_DELEGATE_GIT_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, `BARE_OS_DELEGATE_WGET_MAX_PER_MIN`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN`, `BARE_OS_DELEGATE_GIT_MAX_CONCURRENT`, `BARE_OS_DELEGATE_CURL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_WGET_MAX_CONCURRENT`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_AUDIT_ONLY`, `BARE_OS_DNS_ALLOWLIST`, `BARE_OS_KERNEL_HOT_RELOAD`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_TELEMETRY_OTEL_JSONL`, `BARE_OS_PROC_POLL_MS`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_OFFLINE_LKG_BOOT`, `BARE_OS_LKG_SYSTEM_KEY_HEX`, `BARE_OS_HOST_STORAGE_JSON`, `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`, `BARE_OS_SUBPROCESS_BRIDGE_JOBS_JSON`, `BARE_OS_IPC_AUDIT`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, `BARE_OS_PEAR_TRUST_JSON`, `BARE_OS_HOST_BUNDLE_EVALUATE`, **`TERM`**, **`COLORTERM`**.
+**Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_SHELL_PARAM_EXPANSION`, `BARE_OS_SHELL_PARAM_EXPANSION_V2`, `BARE_OS_ENV_DASH_S`, `BARE_OS_VFS_WATCH_PSEUDO`, `BARE_OS_VFS_WATCH_SWARM`, `BARE_OS_SHELL_LOCAL_DECLARE`, `BARE_OS_DIAGNOSTICS_SUBSCRIBE`, `BARE_OS_AUTOPASS_INVITE_URL`, `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_SAFE_MODE`, `BARE_OS_BOOT_TRANSACTION_JOURNAL`, `BARE_OS_BOOT_CHECKPOINT`, `BARE_OS_BOOT_TRACE`, `BARE_OS_GIANT_PHASE_PROGRAM_JSON`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_EXEC_LINE_BUDGET_MS`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_IPC_NAMESPACE`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_BOOT_POLICY_STRICT`, `BARE_OS_LAZY_PERSONAL_DRIVE`, `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT`, `BARE_OS_DELEGATE_ALLOW`, `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_MAX_CONCURRENT`, `BARE_OS_DELEGATE_GIT_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, `BARE_OS_DELEGATE_WGET_MAX_PER_MIN`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN`, `BARE_OS_DELEGATE_GIT_MAX_CONCURRENT`, `BARE_OS_DELEGATE_CURL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_WGET_MAX_CONCURRENT`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_AUDIT_ONLY`, `BARE_OS_DNS_ALLOWLIST`, `BARE_OS_KERNEL_HOT_RELOAD`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_TELEMETRY_OTEL_JSONL`, `BARE_OS_PROC_POLL_MS`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_OFFLINE_LKG_BOOT`, `BARE_OS_LKG_SYSTEM_KEY_HEX`, `BARE_OS_HOST_STORAGE_JSON`, `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`, `BARE_OS_SUBPROCESS_BRIDGE_JOBS_JSON`, `BARE_OS_IPC_AUDIT`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, `BARE_OS_PEAR_TRUST_JSON`, `BARE_OS_HOST_BUNDLE_EVALUATE`, **`TERM`**, **`COLORTERM`**.
 
 - `BARE_OS_VFS_UNION_PREFIXES` — Booter / VFS — Comma-separated logical path prefixes where **`readFile`** may union system + overlay sources.
 - `BARE_OS_VFS_UNION_WRITE_DENY` — Booter / VFS — When **`1`** / **`true`**, block **`writeFile`** / **`unlink`** on paths under union read prefixes (read-only union overlay).

docs/reference/feature-roadmap.md

@@ -695,3 +695,9 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
 | 100 | Mega-integration wave11 + seeder kernel parity | done — pretest + rsync kernel |
 
 See also [kernel-extensions.md](kernel-extensions.md) and [package-bare-os-protocol.md](package-bare-os-protocol.md).
+
+---
+
+## Giant phase kernel super-feature program (100 items)
+
+Single-phase mega-kernel expansion: governance in [developer-guide/giant-phase-kernel-program.md](../../developer-guide/giant-phase-kernel-program.md), stock kernel boot hooks (**`BARE_OS_BOOT_SAFE_MODE`**, **`BARE_OS_BOOT_TRANSACTION_JOURNAL`**, **`BARE_OS_BOOT_CHECKPOINT`**), **`kernel.ext.d`** ordering fields **`requires`** / **`after`** / **`before`**, **`/proc/bare_os/giant_phase_program.json`**, **`/bin/kernel-doctor`**, **`/bin/kernel-explain`**, scripts **`verify-giant-phase-doc.mjs`** + **`giant-phase-benchmark-harness.mjs`**. **`bareOsCtxApiVersion` `1.23.0`**: optional **`subsystems.kernel.giantPhase`** on **`bareOsPublishBootReady`** payloads.

docs/reference/kernel-extensions.md

@@ -20,6 +20,8 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
 
 **Wave 10 Pear/Bare bridge:** **`ctx.bareOsEmitPearDoctorHint`**, **`ctx.bareOsPearInspectProbe`**, **`ctx.bareOsEmitBareBootPhaseHint`**, **`ctx.bareOsBareRpcCapProbe`**, **`ctx.bareOsEmitPearStampPointer`**, **`ctx.bareOsRegisterBareLoggerTap`**, **`ctx.bareOsEmitAutobaseDiscoveryHint`**, **`ctx.bareOsEmitBlindPairingSketch`**, **`ctx.bareOsBareStreamBackpressureHint`**, **`ctx.bareOsPearTerminalCapsProbe`**; host env **`BARE_OS_PROBE_ID_PEAR_INSPECT_LOGGER_TLS`**, **`BARE_OS_BARE_RPC_PROBE_CLASS`**, **`BARE_OS_MTLS_PROXY_MAP_JSON`**, **`BARE_OS_THREAD_POOL_TELEMETRY_JSON`**, **`BARE_OS_HAPPY_EYEBALLS_V4_MODE`**, **`BARE_OS_BARE_BOOT_VERSION`**, **`BARE_OS_BARE_LOGGER_VERSION`**, **`BARE_OS_BARE_TLS_VERSION`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (injected); boot policy **v10** adds **`requireKernelCapabilitiesPearInspectLoggerTls`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`maxPearInspectDepth`**, **`requireBareLoggerMin`**, **`denyAutobaseDiscoveryChannels`**, **`requireBareTlsMin`**, **`extensionSignerPinsV3`**, **`offlineLkgRequirePearStamp`**, **`bootPhasesRequireLifecycleMinSchema`**, …
 
+**Giant phase program (100-item mega kernel):** governance [developer-guide/giant-phase-kernel-program.md](../../developer-guide/giant-phase-kernel-program.md); **`BARE_OS_BOOT_SAFE_MODE`** (skip **`rc.d`**, **`kernel.ext.d`**, **`onboot`**); **`BARE_OS_BOOT_TRANSACTION_JOURNAL`** → **`/run/bare-os/boot-transaction.ndjson`**; **`BARE_OS_BOOT_CHECKPOINT`** → **`/run/bare-os/boot-checkpoint.json`**; **`kernel.ext.d`** may set **`requires`**, **`after`**, **`before`** for load ordering; **`/proc/bare_os/giant_phase_program.json`** (override via **`BARE_OS_GIANT_PHASE_PROGRAM_JSON`**); **`/bin/kernel-doctor`**, **`/bin/kernel-explain`**.
+
 **Word 11** (`bare-os-protocol` **0.8.x**, **`bits11`**): twenty new seed RPC short names (through **`mirror_drive_compaction_v6`**, **`compact_ping_v5`**, **`http_dht_proxy_routes_v3`**, …), boot policy **v11** (**`requireKernelCapabilitiesHypercorePackHrpcLifecycle`**, **`extensionSignerPinsV4`**, pack/addon semver floors, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireHypercorePackHrpcLifecycle`**, merged **`denySeedRpcMethods`**), **`/proc/bare_os/index.json`** schema **7** with 20 word-11 JSON aliases, NDJSON lifecycle **10** / OTel **8** / audit **8**, **`kernel-extensions.registry.schema.json`** branch **8**. Host env **`BARE_OS_PROBE_ID_HYPERCORE_PACK_HRPC_LIFECYCLE`**; optional **`BARE_OS_HIDE_PROC_HYPERCORE_PACK_HRPC_LIFECYCLE=0`** (or **`false`** / **`off`**) hides those word-11 proc nodes from **`readdir`**, path resolution, and the proc index (see **`vfs.js`**).
 
 **JSON Schemas** (policy, telemetry, boot trace): [`docs/schemas/`](../schemas/) (see also [reference README](./README.md)).