feat(kernel): giant-phase boot hooks, proc snapshot, and kernel UX tools

- Add BARE_OS_BOOT_SAFE_MODE, BOOT_TRANSACTION_JOURNAL, BOOT_CHECKPOINT in
  stock kernel; kernel.ext.d requires/after/before ordering; boot-ready
  subsystems.kernel.giantPhase adjunct
- Expose /proc/bare_os/giant_phase_program.json via bare-os-giant-phase;
  wire VFS, baretop snapshot, and ctx batch read
- Add /bin/kernel-doctor and /bin/kernel-explain; verify-giant-phase-doc in
  pretest; giant-phase-benchmark-harness stub
- Bump bareOsCtxApiVersion to 1.23.0; sync seeder kernel/init.js and runtime
  caps; extend booter tests for proc listing and safe mode

Docs: giant-phase-kernel-program.md, feature-roadmap, kernel-extensions,
compatibility-matrix, environment appendix, handbook 06/11, developer
guide, users-manual 07, scripts README; booter CHANGELOG

developer-guide/03-kernel-boot-init.md

@@ -28,7 +28,9 @@ The repository’s default kernel ([`kernel/init.js`](../kernel/init.js)) is int
    - `status = await ctx.execLine(line)` inside try/catch (`console.error` on failure).
    - If `status === 'exit'`, break.
 
-Set **`BARE_OS_BOOT_TRACE=1`** (or **`true`**) in the environment to log boot phase timings on stderr as **`[boot] phase: Nms`**. Use **`BARE_OS_BOOT_TRACE=json`** for one JSON object per phase (**`{"phase":"…","ms":n}`**) on stderr. The same phases are also delivered to **`ctx.bareOsSubscribeBootEvent`** subscribers as NDJSON-shaped objects. The booter emits additional **`booter:*`** phases (**`vfs`**, **`ctx`**, **`repl`**, **`initd`**, **`kernel_invoke`**) and records them under **`booterPhases`** in **`/run/bare-os/boot.json`**. **`BARE_OS_BOOT_ALLOWLIST=1`** with **`/etc/bare-os/boot.allow`** restricts the first token of lines in trusted rc/onboot snippets. Inspect **`ctx.bareOsRuntimeCaps`** for pipeline limits, quotas, pseudo paths, and **`features`** (including **`httpDelegate`**, **`gitDelegate`**, **`systemctlDelegate`**, **`vfsWatch`**, **`ipcFanout`**).
+Set **`BARE_OS_BOOT_TRACE=1`** (or **`true`**) in the environment to log boot phase timings on stderr as **`[boot] phase: Nms`**. Use **`BARE_OS_BOOT_TRACE=json`** for one JSON object per phase (**`{"phase":"…","ms":n}`**) on stderr. The same phases are also delivered to **`ctx.bareOsSubscribeBootEvent`** subscribers as NDJSON-shaped objects.
+
+**Giant-phase boot hooks** (see [giant-phase-kernel-program.md](./giant-phase-kernel-program.md)): **`BARE_OS_BOOT_SAFE_MODE`** skips **`rc.d`**, **`kernel.ext.d`**, and **`onboot`**; **`BARE_OS_BOOT_TRANSACTION_JOURNAL`** appends phase NDJSON to **`/run/bare-os/boot-transaction.ndjson`**; **`BARE_OS_BOOT_CHECKPOINT`** refreshes **`/run/bare-os/boot-checkpoint.json`** after each phase. Extension drop-ins may use **`requires`**, **`after`**, and **`before`** for ordering alongside **`dependsOn`**. The booter emits additional **`booter:*`** phases (**`vfs`**, **`ctx`**, **`repl`**, **`initd`**, **`kernel_invoke`**) and records them under **`booterPhases`** in **`/run/bare-os/boot.json`**. **`BARE_OS_BOOT_ALLOWLIST=1`** with **`/etc/bare-os/boot.allow`** restricts the first token of lines in trusted rc/onboot snippets. Inspect **`ctx.bareOsRuntimeCaps`** for pipeline limits, quotas, pseudo paths, and **`features`** (including **`httpDelegate`**, **`gitDelegate`**, **`systemctlDelegate`**, **`vfsWatch`**, **`ipcFanout`**).
 
 **Boot policy v5** (optional **`/etc/bare-os/boot.policy.json`** fields when **`BARE_OS_BOOT_POLICY=1`**): **`requireKernelCapabilitiesHostTransportDelegates`** and **`requireInitJsSha256`** (64-char lowercase hex of raw **`/boot/init.js`** via **`ctx.bareOsBootFileSha256Hex`**). **`BARE_OS_KERNEL_PROFILE_WARM=1`** enables **`ctx.bareOsRequestKernelProfileReload()`** for a warm **`start(ctx)`** re-run without dropping the swarm session (same machinery as hot reload).
 

developer-guide/README.md

@@ -50,6 +50,7 @@ This project is **experimental research software**. APIs described here follow t
 - **[13 — Privacy, telemetry, and PII](13-privacy-telemetry-pii.md)** — Scrub lists for NDJSON / OTel mirrors; non-secret posture.
 - **[Node → Bare module map](node-to-bare-modules.md)** — Guest-safe replacements for **`node:*`** built-ins (**`bare-crypto`**, **`bare-module`**, …).
 - **[bare-boot vs kernel phases](bare-boot-kernel-phase-alignment.md)** — Conceptual map: Holepunch **`bare-boot`** stages vs stock **`kernel/init.js`**.
+- **[Giant phase kernel program (100 items)](giant-phase-kernel-program.md)** — Mega-kernel governance, boot hooks, proc snapshot, Bare stack pointers.
 
 ---
 

developer-guide/giant-phase-kernel-program.md

@@ -0,0 +1,48 @@
+# Giant Phase Kernel Super-Feature Program
+
+This document is the **governance board** for the single-phase mega-kernel expansion: acceptance criteria, traceability to Holepunch Bare stacks (no Node `node:*` built-ins in guest paths), and operator-facing env/proc hooks.
+
+## Acceptance criteria (global)
+
+1. **Bare-only runtime**: Guest code uses `bare-*` / `pear-*` modules per [bare-node](https://github.com/holepunchto/bare-node) mapping (local mirror: `holepunch-repos/holepunchto_repos/bare-node/README.md`).
+2. **Contracts**: Any wire, `ctx` API, boot policy, or `/proc` shape change bumps the artifacts in [compatibility-matrix.md](../docs/reference/compatibility-matrix.md).
+3. **Docs**: Each workstream updates [feature-roadmap.md](../docs/reference/feature-roadmap.md), [kernel-extensions.md](../docs/reference/kernel-extensions.md), and the relevant handbook / users-manual / schema files.
+4. **Tests**: Stock kernel and booter tests cover new boot env flags and proc JSON where applicable.
+
+## Program version
+
+| Artifact | Value |
+|----------|--------|
+| Giant phase schema | **1** (see `/proc/bare_os/giant_phase_program.json`) |
+| Primary proc path | `/proc/bare_os/giant_phase_program.json` |
+| Legacy underscore alias | `/proc/bare_os_giant_phase_program.json` |
+
+## Environment hooks (stock kernel + booter)
+
+| Variable | Purpose |
+|----------|---------|
+| `BARE_OS_BOOT_SAFE_MODE` | `1` / `true` — skip `rc.d`, `kernel.ext.d`, and `onboot` after policy merge (recovery-oriented). |
+| `BARE_OS_BOOT_TRANSACTION_JOURNAL` | `1` / `true` / `ndjson` — append boot phase records to `/run/bare-os/boot-transaction.ndjson` when `ctx.vfs` supports it. |
+| `BARE_OS_BOOT_CHECKPOINT` | `1` / `true` — write `/run/bare-os/boot-checkpoint.json` after each boot phase (last-wins resume hint). |
+| `BARE_OS_GIANT_PHASE_PROGRAM_JSON` | Optional override JSON merged into the giant-phase proc snapshot (bounded; non-secret). |
+
+## kernel.ext.d drop-in extensions
+
+In addition to `scripts`, `id`, `dependsOn`, and `signaturePointer`, drop-ins may set:
+
+- **`requires`** — string array, merged into `dependsOn` (same semantics).
+- **`after`** — extension ids that must load before this drop-in (appended to `dependsOn`).
+- **`before`** — extension ids that must load **after** this drop-in (those ids gain a dependency on this drop-in’s `id`).
+
+## 100-item traceability matrix
+
+Items **1–100** map to the approved plan (boot graph, journal, safe mode, extension ordering, module policy, process/IPC, VFS, networking, security, telemetry, upgrades, dev UX, benchmarks). Implementation status:
+
+- **Shipped in tree**: boot safe mode, transaction journal, checkpoints, `before`/`after`/`requires` for `kernel.ext.d`, `/proc/bare_os/giant_phase_program.json`, `/bin/kernel-doctor`, `/bin/kernel-explain`, governance doc, doc cross-links.
+- **Framework / operator hooks**: remaining items are tracked via env-driven proc sketches (wave 9–11 pattern), boot policy versions, and [feature-roadmap.md](../docs/reference/feature-roadmap.md) mega-kernel waves — extend those rows as each capability hardens.
+
+## See also
+
+- [03-kernel-boot-init.md](./03-kernel-boot-init.md)
+- [02-the-context-object.md](./02-the-context-object.md)
+- [Handbook ch.11 — Roadmap](../handbook/11-kernel-roadmap-and-research.md)

docs/reference/README.md

@@ -25,6 +25,7 @@ This directory holds the split **file-by-file inventory** that used to live in t
 - **Bits, env, `/proc`, and `ctx` map** — [Kernel capabilities index](kernel-capabilities-index.md)
 - **Version alignment** — [Compatibility matrix](compatibility-matrix.md)
 - **Roadmap status** — [Feature roadmap status](feature-roadmap.md)
+- **Giant phase kernel program (100 items)** — [developer-guide/giant-phase-kernel-program.md](../../developer-guide/giant-phase-kernel-program.md)
 - **Out of scope and tooling** (former §§15–16) — [Out of scope and tooling](out-of-scope-and-tooling.md)
 - **curl and wget (delegation, fetch stack, policy)** — [curl and wget](http-curl-and-wget.md)
 - **Published JSON Schemas** — [Published schemas: boot policy, telemetry, boot trace](../schemas/)

docs/reference/compatibility-matrix.md

@@ -14,7 +14,7 @@ Single place to compare **protocol**, **booter `ctx` API**, **feature-bit docume
 
 ## Version artifacts
 
-**`bareOsCtxApiVersion`** (current stock: **`1.22.0`**) — Defined in [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js). This is the semver string for the documented **`ctx`** contract; bump it when stable guest-visible behavior changes.
+**`bareOsCtxApiVersion`** (current stock: **`1.23.0`**) — Defined in [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js). This is the semver string for the documented **`ctx`** contract; bump it when stable guest-visible behavior changes.
 
 **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** (current stock: **`15`**) — Exported from [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js). It versions the feature-bit documentation and related governance; keep it aligned with [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../../developer-guide/adr/001-kernel-feature-bits-governance.md).
 

docs/reference/environment-and-posix-appendix.md

@@ -24,10 +24,14 @@ The list below is one **bullet per variable** in the form **name — component
 - `BARE_OS_LOCAL_SEED` — paths — Overrides local seed path helper (`defaultLocalSeedCorestorePath`); booter does not local-boot
 - `BARE_OS_SKIP_REPL` — Booter — If `1`, readline returns null — non-interactive exit
 - `BARE_OS_BOOT_TRACE` — Stock kernel (`init.js`) — If `1` or `true`, log each boot phase duration on stderr as `[boot] phase: Nms`; if `json`, log `{"phase":"…","ms":n}` per phase; **`ndjson`** adds **`sessionId`** / **`ts`** (same shape as `ctx.bareOsEmitBootEvent`)
+- `BARE_OS_BOOT_SAFE_MODE` — Stock kernel — **`1`** / **`true`** skips **`rc.d`**, **`kernel.ext.d`**, **`onboot`** after boot policy merge.
+- `BARE_OS_BOOT_TRANSACTION_JOURNAL` — Stock kernel — **`1`**, **`true`**, or **`ndjson`** appends phase records to **`/run/bare-os/boot-transaction.ndjson`** when **`ctx.vfs`** supports it.
+- `BARE_OS_BOOT_CHECKPOINT` — Stock kernel — **`1`** / **`true`** writes **`/run/bare-os/boot-checkpoint.json`** after each completed boot phase.
+- `BARE_OS_GIANT_PHASE_PROGRAM_JSON` — Booter / **`/proc/bare_os/giant_phase_program.json`** — Optional JSON merged into the giant-phase program snapshot (non-secret).
 - `MANWIDTH` — `/bin/man` — Wrap width for manual text (default `72`; minimum `40`)
 - `NO_COLOR` — `/bin/man` — If set, disable ANSI bold for section headings on a TTY
 
-**Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_SHELL_PARAM_EXPANSION`, `BARE_OS_SHELL_PARAM_EXPANSION_V2`, `BARE_OS_ENV_DASH_S`, `BARE_OS_VFS_WATCH_PSEUDO`, `BARE_OS_VFS_WATCH_SWARM`, `BARE_OS_SHELL_LOCAL_DECLARE`, `BARE_OS_DIAGNOSTICS_SUBSCRIBE`, `BARE_OS_AUTOPASS_INVITE_URL`, `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_TRACE`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_EXEC_LINE_BUDGET_MS`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_IPC_NAMESPACE`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_BOOT_POLICY_STRICT`, `BARE_OS_LAZY_PERSONAL_DRIVE`, `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT`, `BARE_OS_DELEGATE_ALLOW`, `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_MAX_CONCURRENT`, `BARE_OS_DELEGATE_GIT_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, `BARE_OS_DELEGATE_WGET_MAX_PER_MIN`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN`, `BARE_OS_DELEGATE_GIT_MAX_CONCURRENT`, `BARE_OS_DELEGATE_CURL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_WGET_MAX_CONCURRENT`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_AUDIT_ONLY`, `BARE_OS_DNS_ALLOWLIST`, `BARE_OS_KERNEL_HOT_RELOAD`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_TELEMETRY_OTEL_JSONL`, `BARE_OS_PROC_POLL_MS`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_OFFLINE_LKG_BOOT`, `BARE_OS_LKG_SYSTEM_KEY_HEX`, `BARE_OS_HOST_STORAGE_JSON`, `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`, `BARE_OS_SUBPROCESS_BRIDGE_JOBS_JSON`, `BARE_OS_IPC_AUDIT`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, `BARE_OS_PEAR_TRUST_JSON`, `BARE_OS_HOST_BUNDLE_EVALUATE`, **`TERM`**, **`COLORTERM`**.
+**Host → session passthrough** (booter copies into **`shellEnv`** when the host sets a non-empty value): `BARE_OS_PIPELINE_MAX_STAGES`, `BARE_OS_PIPELINE_MAX_BYTES`, `BARE_OS_PIPELINE_MAX_LINES`, `BARE_OS_SHELL_STREAMING`, `BARE_OS_SHELL_STREAMING_MULT`, `BARE_OS_SHELL_CMDSUBST`, `BARE_OS_SHELL_CMDSUBST_MAX_BYTES`, `BARE_OS_SHELL_PARAM_EXPANSION`, `BARE_OS_SHELL_PARAM_EXPANSION_V2`, `BARE_OS_ENV_DASH_S`, `BARE_OS_VFS_WATCH_PSEUDO`, `BARE_OS_VFS_WATCH_SWARM`, `BARE_OS_SHELL_LOCAL_DECLARE`, `BARE_OS_DIAGNOSTICS_SUBSCRIBE`, `BARE_OS_AUTOPASS_INVITE_URL`, `BARE_OS_BIN_WORKER_OFFLOAD`, `BARE_OS_BIN_WORKER_ALLOW`, `BARE_OS_BOOT_PROFILE`, `BARE_OS_ONBOOT`, `BARE_OS_BOOT_STRICT`, `BARE_OS_RC_D_SKIP`, `BARE_OS_BOOT_MINIMAL`, `BARE_OS_BOOT_SKIP`, `BARE_OS_BOOT_SAFE_MODE`, `BARE_OS_BOOT_TRANSACTION_JOURNAL`, `BARE_OS_BOOT_CHECKPOINT`, `BARE_OS_BOOT_TRACE`, `BARE_OS_GIANT_PHASE_PROGRAM_JSON`, `BARE_OS_KERNEL_SELFTEST`, `BARE_OS_SELFTEST_FORMAT`, `BARE_OS_AUDIT`, `BARE_OS_AUDIT_JSON`, `BARE_OS_AUDIT_REDACT`, `BARE_OS_IMAGE_DIGEST`, `BARE_OS_EXEC_MAX_DEPTH`, `BARE_OS_EXEC_LINE_BUDGET_MS`, `BARE_OS_IPC_MAX_BYTES`, `BARE_OS_IPC_CHANNEL_MAX_BYTES`, `BARE_OS_IPC_RPC_TOKEN`, `BARE_OS_IPC_FANOUT`, `BARE_OS_IPC_JSON_MAX_BYTES`, `BARE_OS_IPC_NAMESPACE`, `BARE_OS_VFS_WATCH`, `BARE_OS_VFS_UNION_PREFIXES`, `BARE_OS_VFS_UNION_WRITE_DENY`, `BARE_OS_VFS_BIN_CACHE`, `BARE_OS_BOOT_ALLOWLIST`, `BARE_OS_BOOT_MANIFEST`, `BARE_OS_BOOT_MANIFEST_SIGN`, `BARE_OS_BOOT_MANIFEST_PUBKEY_HEX`, `BARE_OS_BOOT_POLICY`, `BARE_OS_BOOT_POLICY_STRICT`, `BARE_OS_LAZY_PERSONAL_DRIVE`, `BARE_OS_SYSTEM_REVISION_ID`, `BARE_OS_SYSTEM_REVISION_PENDING`, `BARE_OS_SYSTEM_SLOT`, `BARE_OS_DELEGATE_ALLOW`, `BARE_OS_DELEGATE_MAX_PER_MIN`, `BARE_OS_DELEGATE_MAX_CONCURRENT`, `BARE_OS_DELEGATE_GIT_MAX_PER_MIN`, `BARE_OS_DELEGATE_CURL_MAX_PER_MIN`, `BARE_OS_DELEGATE_WGET_MAX_PER_MIN`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN`, `BARE_OS_DELEGATE_GIT_MAX_CONCURRENT`, `BARE_OS_DELEGATE_CURL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_WGET_MAX_CONCURRENT`, `BARE_OS_DELEGATE_SYSTEMCTL_MAX_CONCURRENT`, `BARE_OS_DELEGATE_AUDIT_ONLY`, `BARE_OS_DNS_ALLOWLIST`, `BARE_OS_KERNEL_HOT_RELOAD`, `BARE_OS_SANDBOX_SCRIPT`, `BARE_OS_SANDBOX_WORKER`, `BARE_OS_INITD_MAX_PARALLEL`, `BARE_OS_INITD_JOURNAL_MAX_LINES`, `BARE_OS_URANDOM_CRYPTO`, `BARE_OS_TELEMETRY_NDJSON`, `BARE_OS_TELEMETRY_OTEL_JSONL`, `BARE_OS_PROC_POLL_MS`, `BARE_OS_SEED_RPC_HANDSHAKE`, `BARE_OS_SEED_CAP_STRICT`, `BARE_OS_SEED_CAP_FAIL`, `BARE_OS_OFFLINE_LKG_BOOT`, `BARE_OS_LKG_SYSTEM_KEY_HEX`, `BARE_OS_HOST_STORAGE_JSON`, `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`, `BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS`, `BARE_OS_SUBPROCESS_BRIDGE_JOBS_JSON`, `BARE_OS_IPC_AUDIT`, `BARE_OS_HTTP_ALLOWLIST`, `BARE_OS_HTTP_DENYLIST`, `BARE_OS_TLS_PIN_SHA256`, `BARE_OS_BARE_MODULES`, `BARE_OS_BARE_DRIVE_BUNDLES`, `BARE_OS_PEAR_CHANNEL`, `BARE_OS_PEAR_RELEASE`, `PEAR_CHANNEL`, `BARE_OS_FIND_EXEC_MAX`, `BARE_OS_YES_MAX_LINES`, `BARE_OS_SHUF_MAX_LINES`, `BARE_OS_SPLIT_MAX_FILES`, `BARE_OS_NPROC`, `BARE_OS_BLIND_BOOTSTRAP_URL`, `BARE_OS_BLIND_BOOTSTRAP_JSON`, `BARE_OS_MIRROR_READ_KEY`, `BARE_OS_PEAR_TRUST_JSON`, `BARE_OS_HOST_BUNDLE_EVALUATE`, **`TERM`**, **`COLORTERM`**.
 
 - `BARE_OS_VFS_UNION_PREFIXES` — Booter / VFS — Comma-separated logical path prefixes where **`readFile`** may union system + overlay sources.
 - `BARE_OS_VFS_UNION_WRITE_DENY` — Booter / VFS — When **`1`** / **`true`**, block **`writeFile`** / **`unlink`** on paths under union read prefixes (read-only union overlay).

docs/reference/feature-roadmap.md

@@ -695,3 +695,9 @@ Waves **6** through **11** are **hundred-item** checklists that track the mega-k
 | 100 | Mega-integration wave11 + seeder kernel parity | done — pretest + rsync kernel |
 
 See also [kernel-extensions.md](kernel-extensions.md) and [package-bare-os-protocol.md](package-bare-os-protocol.md).
+
+---
+
+## Giant phase kernel super-feature program (100 items)
+
+Single-phase mega-kernel expansion: governance in [developer-guide/giant-phase-kernel-program.md](../../developer-guide/giant-phase-kernel-program.md), stock kernel boot hooks (**`BARE_OS_BOOT_SAFE_MODE`**, **`BARE_OS_BOOT_TRANSACTION_JOURNAL`**, **`BARE_OS_BOOT_CHECKPOINT`**), **`kernel.ext.d`** ordering fields **`requires`** / **`after`** / **`before`**, **`/proc/bare_os/giant_phase_program.json`**, **`/bin/kernel-doctor`**, **`/bin/kernel-explain`**, scripts **`verify-giant-phase-doc.mjs`** + **`giant-phase-benchmark-harness.mjs`**. **`bareOsCtxApiVersion` `1.23.0`**: optional **`subsystems.kernel.giantPhase`** on **`bareOsPublishBootReady`** payloads.

docs/reference/kernel-extensions.md

@@ -20,6 +20,8 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
 
 **Wave 10 Pear/Bare bridge:** **`ctx.bareOsEmitPearDoctorHint`**, **`ctx.bareOsPearInspectProbe`**, **`ctx.bareOsEmitBareBootPhaseHint`**, **`ctx.bareOsBareRpcCapProbe`**, **`ctx.bareOsEmitPearStampPointer`**, **`ctx.bareOsRegisterBareLoggerTap`**, **`ctx.bareOsEmitAutobaseDiscoveryHint`**, **`ctx.bareOsEmitBlindPairingSketch`**, **`ctx.bareOsBareStreamBackpressureHint`**, **`ctx.bareOsPearTerminalCapsProbe`**; host env **`BARE_OS_PROBE_ID_PEAR_INSPECT_LOGGER_TLS`**, **`BARE_OS_BARE_RPC_PROBE_CLASS`**, **`BARE_OS_MTLS_PROXY_MAP_JSON`**, **`BARE_OS_THREAD_POOL_TELEMETRY_JSON`**, **`BARE_OS_HAPPY_EYEBALLS_V4_MODE`**, **`BARE_OS_BARE_BOOT_VERSION`**, **`BARE_OS_BARE_LOGGER_VERSION`**, **`BARE_OS_BARE_TLS_VERSION`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (injected); boot policy **v10** adds **`requireKernelCapabilitiesPearInspectLoggerTls`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`maxPearInspectDepth`**, **`requireBareLoggerMin`**, **`denyAutobaseDiscoveryChannels`**, **`requireBareTlsMin`**, **`extensionSignerPinsV3`**, **`offlineLkgRequirePearStamp`**, **`bootPhasesRequireLifecycleMinSchema`**, …
 
+**Giant phase program (100-item mega kernel):** governance [developer-guide/giant-phase-kernel-program.md](../../developer-guide/giant-phase-kernel-program.md); **`BARE_OS_BOOT_SAFE_MODE`** (skip **`rc.d`**, **`kernel.ext.d`**, **`onboot`**); **`BARE_OS_BOOT_TRANSACTION_JOURNAL`** → **`/run/bare-os/boot-transaction.ndjson`**; **`BARE_OS_BOOT_CHECKPOINT`** → **`/run/bare-os/boot-checkpoint.json`**; **`kernel.ext.d`** may set **`requires`**, **`after`**, **`before`** for load ordering; **`/proc/bare_os/giant_phase_program.json`** (override via **`BARE_OS_GIANT_PHASE_PROGRAM_JSON`**); **`/bin/kernel-doctor`**, **`/bin/kernel-explain`**.
+
 **Word 11** (`bare-os-protocol` **0.8.x**, **`bits11`**): twenty new seed RPC short names (through **`mirror_drive_compaction_v6`**, **`compact_ping_v5`**, **`http_dht_proxy_routes_v3`**, …), boot policy **v11** (**`requireKernelCapabilitiesHypercorePackHrpcLifecycle`**, **`extensionSignerPinsV4`**, pack/addon semver floors, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireHypercorePackHrpcLifecycle`**, merged **`denySeedRpcMethods`**), **`/proc/bare_os/index.json`** schema **7** with 20 word-11 JSON aliases, NDJSON lifecycle **10** / OTel **8** / audit **8**, **`kernel-extensions.registry.schema.json`** branch **8**. Host env **`BARE_OS_PROBE_ID_HYPERCORE_PACK_HRPC_LIFECYCLE`**; optional **`BARE_OS_HIDE_PROC_HYPERCORE_PACK_HRPC_LIFECYCLE=0`** (or **`false`** / **`off`**) hides those word-11 proc nodes from **`readdir`**, path resolution, and the proc index (see **`vfs.js`**).
 
 **JSON Schemas** (policy, telemetry, boot trace): [`docs/schemas/`](../schemas/) (see also [reference README](./README.md)).

handbook/06-kernel-and-binaries.md

@@ -34,7 +34,7 @@ Staged from **`kernel/init.js`**. Responsibilities (typical):
 5. Run digit-prefixed snippets under **`/etc/bare-os/rc.d/`** (same rules as before)
 6. Run optional **`/etc/bare-os/rc.local`** (non-comment lines via **`execLine`**, after **`rc.d`**)
 7. Run digit-prefixed snippets under **`/etc/bare-os/kernel.d/`** (same skip rules as **`rc.d`**) after **`rc.local`**
-8. Run optional **`/etc/bare-os/kernel.ext.d/*.json`** drop-ins listing trusted scripts under **`/lib/bare-os/extensions/`** (via **`ctx.bareOsRunImageScript`**); each load is recorded for **`/proc/bare_os/extensions.json`** when **`ctx.bareOsRegisterKernelExtensionRecord`** is available
+8. Run optional **`/etc/bare-os/kernel.ext.d/*.json`** drop-ins listing trusted scripts under **`/lib/bare-os/extensions/`** (via **`ctx.bareOsRunImageScript`**); JSON may include **`dependsOn`**, **`requires`**, **`after`**, and **`before`** for extension-id ordering (topological sort; cycles fall back unless strict policy fails). Each load is recorded for **`/proc/bare_os/extensions.json`** when **`ctx.bareOsRegisterKernelExtensionRecord`** is available
 9. Print a **one-line** hint (commands, login, paths), or **`/etc/bare-os/banner`** / **`/etc/issue`** when present
 10. When **`BARE_OS_SKIP_REPL`**: optional **onboot** — every non-comment line from host **`BARE_OS_ONBOOT`** (newline-separated), or if unset, every such line from **`/etc/bare-os/onboot`** in order, via **`execLine`**
 11. Loop forever:
@@ -63,6 +63,8 @@ The **prompt** (`[user@host:path] > `) is applied by the booter’s readline lay
 - **`BARE_OS_BOOT_PROFILE`** / **`/etc/bare-os/profile`** — First line names **`/etc/bare-os/rc.profile.<name>`** (before **`rc`**). Suggested names: **`dev`** (extra PATH, aliases), **`ci`** (**`BARE_OS_SKIP_REPL`** + **`BARE_OS_ONBOOT`** smoke lines), **`kiosk`** (minimal **`rc.d`**, fixed **`onboot`**).
 - **`BARE_OS_BOOT_MINIMAL`** — Skip **`rc`**, **`rc.d`**, **`rc.local`**, **`kernel.d`**, **`onboot`**, and profile **`rc.profile.*`** — recovery shell with **`os-release`** / **`motd`** only.
 - **`BARE_OS_BOOT_SKIP`** — Comma list of phases to skip: **`profile`**, **`rc`**, **`rc.d`**, **`rc.local`**, **`kernel.d`**, **`kernel.ext.d`**, **`onboot`**.
+- **`BARE_OS_BOOT_SAFE_MODE`** — Skips **`rc.d`**, **`kernel.ext.d`**, and **`onboot`** after boot policy merge (recovery).
+- **`BARE_OS_BOOT_TRANSACTION_JOURNAL`** / **`BARE_OS_BOOT_CHECKPOINT`** — Append boot NDJSON / last-phase checkpoint under **`/run/bare-os/`** when **`ctx.vfs`** allows (see [Giant phase program](../developer-guide/giant-phase-kernel-program.md)).
 - **`BARE_OS_BOOT_TRACE=ndjson`** — One JSON object per boot phase on stderr (**`type`**, **`phase`**, **`ms`**, **`sessionId`**, **`ts`**).
 - **`BARE_OS_KERNEL_SELFTEST`** — After boot snippets, run a short trusted **`execLine`** checklist.
 - **`BARE_OS_SELFTEST_FORMAT=tap`** — Same self-test emits **TAP** lines on stderr (CI-friendly).

handbook/11-kernel-roadmap-and-research.md

@@ -24,7 +24,7 @@ Nothing in that tree *is* the Bare OS kernel: our **kernel** remains **`/boot/in
 
 ## Feature waves (protocol)
 
-Capability words **`bits`** … **`bits10`** (see [`packages/bare-os-protocol`](../packages/bare-os-protocol/README.md)) advertise what the stock booter and seeder implement. **`BARE_OS_SEED_CAP_STRICT`** requires the seeder to cover every non-zero stock word. Wave 6–10 status: [`docs/reference/feature-roadmap.md`](../docs/reference/feature-roadmap.md). Governance: [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../developer-guide/adr/001-kernel-feature-bits-governance.md). **Wave 10** extends Pear/Bare–aligned seed RPCs, Wave 10 **`/proc`** JSON, boot policy v10, extension registry schema **7**, telemetry schema **9** / OTel **7** / audit **7**, and the Node→Bare module map in [`developer-guide/node-to-bare-modules.md`](../developer-guide/node-to-bare-modules.md).
+Capability words **`bits`** … **`bits11`** (see [`packages/bare-os-protocol`](../packages/bare-os-protocol/README.md)) advertise what the stock booter and seeder implement. **`BARE_OS_SEED_CAP_STRICT`** requires the seeder to cover every non-zero stock word. Wave 6–11 status: [`docs/reference/feature-roadmap.md`](../docs/reference/feature-roadmap.md). **Giant phase (100-item program):** [`developer-guide/giant-phase-kernel-program.md`](../developer-guide/giant-phase-kernel-program.md). Governance: [`developer-guide/adr/001-kernel-feature-bits-governance.md`](../developer-guide/adr/001-kernel-feature-bits-governance.md). **Wave 10** extends Pear/Bare–aligned seed RPCs, Wave 10 **`/proc`** JSON, boot policy v10, extension registry schema **7**, telemetry schema **9** / OTel **7** / audit **7**, and the Node→Bare module map in [`developer-guide/node-to-bare-modules.md`](../developer-guide/node-to-bare-modules.md).
 
 ---
 

kernel/bin/baretop

@@ -343,6 +343,7 @@ var BARE_TOP_SNAPSHOT_PROC_ENTRIES = [
   ['ipcBackpressure', '/proc/bare_os/ipc_backpressure.json'],
   ['delegateRed', '/proc/bare_os/delegate_red.json'],
   ['gitDelegateStats', '/proc/bare_os/git_delegate_stats.json'],
+  ['giantPhaseProgram', '/proc/bare_os/giant_phase_program.json'],
   ['gitLfsPointerStats', '/proc/bare_os/git_lfs_pointer_stats.json'],
   ['workerBudget', '/proc/bare_os/worker_budget.json'],
   ['sandboxProfile', '/proc/bare_os/sandbox_profile.json'],

kernel/bin/btop

@@ -343,6 +343,7 @@ var BARE_TOP_SNAPSHOT_PROC_ENTRIES = [
   ['ipcBackpressure', '/proc/bare_os/ipc_backpressure.json'],
   ['delegateRed', '/proc/bare_os/delegate_red.json'],
   ['gitDelegateStats', '/proc/bare_os/git_delegate_stats.json'],
+  ['giantPhaseProgram', '/proc/bare_os/giant_phase_program.json'],
   ['gitLfsPointerStats', '/proc/bare_os/git_lfs_pointer_stats.json'],
   ['workerBudget', '/proc/bare_os/worker_budget.json'],
   ['sandboxProfile', '/proc/bare_os/sandbox_profile.json'],

kernel/bin/help

@@ -87,7 +87,7 @@ function bareOsEmitRaw(ctx, chunk) {
   return false
 }
 
-var BARE_OS_HELP_BIN_SPACED = "arch awk baretop base32 base64 basename basenc btop cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split ssh-keygen stat sum sync systemctl tac tail tar tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
+var BARE_OS_HELP_BIN_SPACED = "arch awk baretop base32 base64 basename basenc btop cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq kernel-doctor kernel-explain ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split ssh-keygen stat sum sync systemctl tac tail tar tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
 async function run(ctx, argv) {
   ctx.console.log(
     'Bare OS — default user: guest | shell builtins: alias, barerc, cd, command, export, exit, login, logout, readonly, type, umask, unalias, unset, : | /bin: ' +

kernel/bin/kernel-doctor

@@ -0,0 +1,130 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+async function readProcJson(ctx, p) {
+  const vfs = ctx.vfs
+  if (!vfs || typeof vfs.readFile !== 'function') return null
+  try {
+    const buf = await vfs.readFile(p)
+    const t = ctx.b4a ? ctx.b4a.toString(buf) : String(buf)
+    const j = JSON.parse(t.trim())
+    return j && typeof j === 'object' ? j : null
+  } catch {
+    return null
+  }
+}
+
+async function run(ctx, argv) {
+  let json = false
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '--json') json = true
+  }
+  const out = {
+    note: 'kernel-doctor — guest snapshot (non-secret). See developer-guide/giant-phase-kernel-program.md',
+    ctxApiVersion: String(ctx.bareOsCtxApiVersion || ''),
+    giantPhase: await readProcJson(ctx, '/proc/bare_os/giant_phase_program.json'),
+    resources: await readProcJson(ctx, '/proc/bare_os/resources'),
+    bootReady: await readProcJson(ctx, '/run/bare-os/boot.json'),
+    envHints: {
+      bootSafeMode: ctx.env?.BARE_OS_BOOT_SAFE_MODE,
+      bootTransactionJournal: ctx.env?.BARE_OS_BOOT_TRANSACTION_JOURNAL,
+      bootCheckpoint: ctx.env?.BARE_OS_BOOT_CHECKPOINT
+    }
+  }
+  if (json) {
+    ctx.console.log(JSON.stringify(out, null, 2))
+  } else {
+    ctx.console.log('ctx API: ' + out.ctxApiVersion)
+    ctx.console.log(
+      'giant phase program: ' +
+        (out.giantPhase ? 'see /proc/bare_os/giant_phase_program.json' : '(unavailable)')
+    )
+    ctx.console.log('run: kernel-doctor --json | jq .')
+  }
+}

kernel/bin/kernel-explain

@@ -0,0 +1,135 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+/** Map common failure tokens to documentation anchors (offline-friendly). */
+var KERNEL_EXPLAIN_MAP = {
+  boot_policy: 'docs/reference/kernel-extensions.md — BARE_OS_BOOT_POLICY',
+  safe_mode: 'BARE_OS_BOOT_SAFE_MODE — skips rc.d, kernel.ext.d, onboot (developer-guide/giant-phase-kernel-program.md)',
+  boot_journal:
+    'BARE_OS_BOOT_TRANSACTION_JOURNAL — /run/bare-os/boot-transaction.ndjson',
+  boot_checkpoint: 'BARE_OS_BOOT_CHECKPOINT — /run/bare-os/boot-checkpoint.json',
+  kernel_ext:
+    'kernel.ext.d — dependsOn, requires, after, before (stock kernel/init.js header)',
+  giant_phase:
+    '/proc/bare_os/giant_phase_program.json — giant-phase program snapshot',
+  bare_module:
+    'Use bare-module / bare-node mapping (Holepunch); never node:module in guest',
+  bare_crypto:
+    'Use bare-crypto / bare-node crypto shim; never node:crypto in guest',
+  compat: 'docs/reference/compatibility-matrix.md',
+  roadmap: 'docs/reference/feature-roadmap.md'
+}
+
+async function run(ctx, argv) {
+  const key = String(argv[1] || '')
+    .trim()
+    .toLowerCase()
+    .replace(/^bare_os_/, '')
+    .replace(/-/g, '_')
+  if (!key || argv[1] === '--help' || argv[1] === '-h') {
+    ctx.console.log(
+      'Usage: kernel-explain <topic>\nTopics: ' +
+        Object.keys(KERNEL_EXPLAIN_MAP).sort().join(', ')
+    )
+    return
+  }
+  const hit = KERNEL_EXPLAIN_MAP[key]
+  if (hit) {
+    ctx.console.log(hit)
+    return
+  }
+  for (const [k, v] of Object.entries(KERNEL_EXPLAIN_MAP)) {
+    if (k.includes(key) || key.includes(k)) {
+      ctx.console.log(k + ': ' + v)
+      return
+    }
+  }
+  ctx.console.error('kernel-explain: unknown topic: ' + argv[1])
+  ctx.exitCode = 1
+}

kernel/init.js

@@ -18,6 +18,10 @@
  * BARE_OS_BOOT_TRACE=ndjson logs {"type":"boot","phase","ms","sessionId","ts"} per line.
  *
  * BARE_OS_BOOT_MINIMAL=1 or true: skip profile rc, rc, rc.d, rc.local, kernel.d (recovery shell).
+ * BARE_OS_BOOT_SAFE_MODE=1 or true: after boot policy merge, skip rc.d, kernel.ext.d, onboot (lighter recovery).
+ * BARE_OS_BOOT_TRANSACTION_JOURNAL=1, true, or ndjson: append boot phase NDJSON lines to
+ *   /run/bare-os/boot-transaction.ndjson when ctx.vfs supports readFile/writeFile.
+ * BARE_OS_BOOT_CHECKPOINT=1 or true: write /run/bare-os/boot-checkpoint.json after each completed boot phase.
  * BARE_OS_BOOT_SKIP: comma-separated phases to skip among:
  *   profile, rc, rc.d, rc.local, kernel.d, kernel.ext.d, onboot (os-release and motd always run).
  *
@@ -35,6 +39,8 @@
  * `BARE_OS_BOOT_POLICY_STRICT=1`: exit boot on policy violation (via requestBooterExit(1)).
  *
  * kernel.ext.d: JSON drop-ins under /etc/bare-os/kernel.ext.d/*.json with `{ "scripts": ["/lib/bare-os/extensions/…"] }` (trusted).
+ * Optional ordering: `dependsOn`, `requires` (merged into dependsOn), `after` (ids loaded before this drop-in),
+ *   `before` (ids that must load after this drop-in). Cycles fail strict boot or fall back to filename order.
  *
  * BARE_OS_BOOT_STRICT=1 or true: first execLine throw in trusted boot snippets calls
  * requestBooterExit(1) and stops further boot phases.
@@ -75,6 +81,78 @@ function bootMinimal(ctx) {
   return v === '1' || v === 'true'
 }
 
+/**
+ * Recovery-oriented boot: skip rc.d snippets, kernel extensions, and onboot after policy merge.
+ * @param {Record<string, unknown>} ctx
+ */
+function applyBootSafeMode(ctx) {
+  const v = ctx.env && ctx.env.BARE_OS_BOOT_SAFE_MODE
+  if (v !== '1' && v !== 'true') return
+  const pol = ctx.bareOsBootPolicySkipPhases
+  if (!(pol instanceof Set)) return
+  pol.add('rc.d')
+  pol.add('kernel.ext.d')
+  pol.add('onboot')
+}
+
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {Record<string, unknown>} row
+ */
+async function maybeAppendBootTransactionJournal(ctx, row) {
+  const en = ctx.env && ctx.env.BARE_OS_BOOT_TRANSACTION_JOURNAL
+  if (en !== '1' && en !== 'true' && en !== 'ndjson') return
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.readFile !== 'function' || typeof vfs.writeFile !== 'function' || !b4) return
+  const path = '/run/bare-os/boot-transaction.ndjson'
+  const line =
+    JSON.stringify({
+      type: 'boot_transaction',
+      ts: Date.now(),
+      sessionId: String((ctx.env && ctx.env.BARE_OS_SESSION_ID) || ''),
+      ...row
+    }) + '\n'
+  try {
+    let prev = ''
+    try {
+      const buf = await vfs.readFile(path)
+      prev = b4.toString(buf)
+    } catch {
+      /* new */
+    }
+    await vfs.writeFile(path, b4.from(prev + line))
+  } catch {
+    /* ignore */
+  }
+}
+
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {string} phase
+ * @param {number} ms
+ */
+async function maybeWriteBootCheckpoint(ctx, phase, ms) {
+  const v = ctx.env && ctx.env.BARE_OS_BOOT_CHECKPOINT
+  if (v !== '1' && v !== 'true') return
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.writeFile !== 'function' || !b4) return
+  try {
+    const body =
+      JSON.stringify({
+        schema: 1,
+        phase: String(phase),
+        phaseMs: typeof ms === 'number' ? ms : 0,
+        atMs: Date.now(),
+        sessionId: String((ctx.env && ctx.env.BARE_OS_SESSION_ID) || '')
+      }) + '\n'
+    await vfs.writeFile('/run/bare-os/boot-checkpoint.json', b4.from(body))
+  } catch {
+    /* ignore */
+  }
+}
+
 /**
  * @param {Record<string, unknown>} ctx
  * @returns {Set<string>}
@@ -1130,6 +1208,8 @@ async function bootTimed(ctx, label, fn, phaseLog) {
   await fn()
   const ms = Date.now() - t0
   phaseLog.push(label)
+  await maybeAppendBootTransactionJournal(ctx, { phase: label, ms, ok: true })
+  await maybeWriteBootCheckpoint(ctx, label, ms)
   if (wantBootTrace(ctx)) {
     if (isBootTraceNdjson(ctx)) {
       const sid = (ctx.env && ctx.env.BARE_OS_SESSION_ID) || ''
@@ -1608,7 +1688,7 @@ async function runKernelExtDropins(ctx) {
     return true
   }
   names.sort()
-  /** @type {{ file: string, extId: string, scripts: string[], dependsOn: string[], signaturePointer?: string }[]} */
+  /** @type {{ file: string, extId: string, scripts: string[], dependsOn: string[], beforeIds: string[], signaturePointer?: string }[]} */
   const collected = []
   for (const name of names) {
     if (!name.endsWith('.json')) continue
@@ -1629,9 +1709,22 @@ async function runKernelExtDropins(ctx) {
       const scripts = pol.scripts
       if (!Array.isArray(scripts)) continue
       /** @type {string[]} */
-      const dependsOn = Array.isArray(pol.dependsOn)
+      let dependsOn = Array.isArray(pol.dependsOn)
         ? pol.dependsOn.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
         : []
+      if (Array.isArray(pol.requires)) {
+        dependsOn = dependsOn.concat(
+          pol.requires.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
+        )
+      }
+      if (Array.isArray(pol.after)) {
+        dependsOn = dependsOn.concat(
+          pol.after.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
+        )
+      }
+      const beforeIds = Array.isArray(pol.before)
+        ? pol.before.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
+        : []
       const sig =
         typeof pol.signaturePointer === 'string'
           ? pol.signaturePointer.trim().slice(0, 512)
@@ -1641,12 +1734,27 @@ async function runKernelExtDropins(ctx) {
         extId,
         scripts: scripts.map((s) => String(s).trim()).filter(Boolean),
         dependsOn,
+        beforeIds,
         signaturePointer: sig || undefined
       })
     } catch (e) {
       console.error(`kernel.ext.d/${name}: ` + ((e && e.message) || String(e)))
     }
   }
+  const idToCollected = new Map(collected.map((e) => [e.extId, e]))
+  for (const e of collected) {
+    for (const bid of e.beforeIds) {
+      const target = idToCollected.get(bid)
+      if (target && target.extId !== e.extId) {
+        const next = new Set(target.dependsOn)
+        next.add(e.extId)
+        target.dependsOn = [...next].slice(0, 24)
+      }
+    }
+  }
+  for (const e of collected) {
+    e.dependsOn = [...new Set(e.dependsOn)]
+  }
   if (maxDepthCap > 0) {
     const d = kernelExtDependencyDepth(collected)
     if (d > maxDepthCap) {
@@ -1886,6 +1994,10 @@ async function runKernelSelftest(ctx) {
 function publishBootReady(ctx, phaseLog) {
   if (typeof ctx.bareOsPublishBootReady !== 'function') return
   const sid = (ctx.env && ctx.env.BARE_OS_SESSION_ID) || ''
+  const gpen = ctx.env && ctx.env.BARE_OS_BOOT_TRANSACTION_JOURNAL
+  const safe =
+    ctx.env?.BARE_OS_BOOT_SAFE_MODE === '1' ||
+    ctx.env?.BARE_OS_BOOT_SAFE_MODE === 'true'
   ctx.bareOsPublishBootReady({
     ready: true,
     phases: [...phaseLog],
@@ -1893,7 +2005,18 @@ function publishBootReady(ctx, phaseLog) {
     completedAtMs: Date.now(),
     minimal: bootMinimal(ctx),
     subsystems: {
-      kernel: { ready: true, phaseCount: phaseLog.length },
+      kernel: {
+        ready: true,
+        phaseCount: phaseLog.length,
+        giantPhase: {
+          schema: 1,
+          safeMode: safe,
+          transactionJournal: gpen === '1' || gpen === 'true' || gpen === 'ndjson',
+          checkpoint:
+            ctx.env?.BARE_OS_BOOT_CHECKPOINT === '1' ||
+            ctx.env?.BARE_OS_BOOT_CHECKPOINT === 'true'
+        }
+      },
       initd: { awaited: true }
     }
   })
@@ -1905,6 +2028,7 @@ async function start(ctx) {
   const phaseLog = []
   ctx.bareOsBootPolicySkipPhases = new Set()
   if (!(await applyBootPolicyFile(ctx))) return
+  applyBootSafeMode(ctx)
   await bootTimed(ctx, 'os-release', () => printOsRelease(ctx), phaseLog)
   await bootTimed(ctx, 'motd', () => printMotd(ctx), phaseLog)
   const profileName = await resolveBootProfileName(ctx)

kernel/lib/bare/manifest.json

@@ -1,12 +1,6 @@
 {
   "version": 1,
   "bundles": [
-    {
-      "path": "/lib/bare/bundles/safetyCatch.js",
-      "keys": [
-        "safetyCatch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/b4a.js",
       "keys": [
@@ -14,15 +8,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
+      "path": "/lib/bare/bundles/safetyCatch.js",
       "keys": [
-        "hypercoreIdEncoding"
+        "safetyCatch"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareUrl.js",
+      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
-        "bareUrl"
+        "hypercoreIdEncoding"
       ]
     },
     {
@@ -37,24 +31,30 @@
         "protomux"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUrl.js",
+      "keys": [
+        "bareUrl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEncoding.js",
       "keys": [
         "bareEncoding"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePath.js",
-      "keys": [
-        "barePath"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
         "bareEvents"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePath.js",
+      "keys": [
+        "barePath"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAbort.js",
       "keys": [
@@ -68,9 +68,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareReadline.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
       "keys": [
-        "bareReadline"
+        "bareAnsiEscapes"
       ]
     },
     {
@@ -80,9 +80,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "path": "/lib/bare/bundles/bareReadline.js",
       "keys": [
-        "bareAnsiEscapes"
+        "bareReadline"
       ]
     },
     {
@@ -92,9 +92,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/fetch.js",
+      "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
-        "fetch"
+        "bareAppKit"
       ]
     },
     {
@@ -103,48 +103,48 @@
         "bareAsyncHooks"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAppKit.js",
-      "keys": [
-        "bareAppKit"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAtomics.js",
       "keys": [
         "bareAtomics"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareApk.js",
-      "keys": [
-        "bareApk"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAssert.js",
       "keys": [
         "bareAssert"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareApk.js",
+      "keys": [
+        "bareApk"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBmp.js",
       "keys": [
         "bareBmp"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBuffer.js",
+      "keys": [
+        "bareBuffer"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleCompile.js",
       "keys": [
         "bareBundleCompile"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBluetoothApple.js",
-      "keys": [
-        "bareBluetoothApple"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBundle.js",
       "keys": [
@@ -152,9 +152,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBuffer.js",
+      "path": "/lib/bare/bundles/bareBluetoothApple.js",
       "keys": [
-        "bareBuffer"
+        "bareBluetoothApple"
       ]
     },
     {
@@ -182,9 +182,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDelta.js",
+      "path": "/lib/bare/bundles/bareChannel.js",
       "keys": [
-        "bareDelta"
+        "bareChannel"
       ]
     },
     {
@@ -194,9 +194,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareChannel.js",
+      "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
-        "bareChannel"
+        "bareDelta"
       ]
     },
     {
@@ -205,12 +205,6 @@
         "bareDaemon"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareCov.js",
-      "keys": [
-        "bareCov"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
       "keys": [
@@ -235,12 +229,6 @@
         "bareExif"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
-      "keys": [
-        "bareFfmpegEncodings"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDgram.js",
       "keys": [
@@ -254,9 +242,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareGif.js",
+      "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
-        "bareGif"
+        "bareCov"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
+      "keys": [
+        "bareFfmpegEncodings"
       ]
     },
     {
@@ -272,27 +266,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareGif.js",
       "keys": [
-        "bareHeif"
+        "bareGif"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareGtk.js",
-      "keys": [
-        "bareGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
       ]
     },
     {
@@ -301,24 +277,48 @@
         "bareFs"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFileLogger.js",
+      "keys": [
+        "bareFileLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareGtk.js",
+      "keys": [
+        "bareGtk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHrtime.js",
+      "keys": [
+        "bareHrtime"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
         "bareHttpParser"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareImageResample.js",
-      "keys": [
-        "bareImageResample"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareIco.js",
       "keys": [
         "bareIco"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareImageResample.js",
+      "keys": [
+        "bareImageResample"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareInspect.js",
       "keys": [
@@ -331,12 +331,24 @@
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareJpeg.js",
+      "keys": [
+        "bareJpeg"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
         "bareHttps"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareIpc.js",
       "keys": [
@@ -344,15 +356,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareJpeg.js",
+      "path": "/lib/bare/bundles/bareLogger.js",
       "keys": [
-        "bareJpeg"
+        "bareLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareIntl.js",
-      "keys": [
-        "bareIntl"
       ]
     },
     {
@@ -368,9 +374,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareLogger.js",
+      "path": "/lib/bare/bundles/bareLink.js",
       "keys": [
-        "bareLogger"
+        "bareLink"
       ]
     },
     {
@@ -380,15 +386,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareLink.js",
+      "path": "/lib/bare/bundles/bareModuleLexer.js",
       "keys": [
-        "bareLink"
+        "bareModuleLexer"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
       ]
     },
     {
@@ -397,12 +397,6 @@
         "bareModuleResolve"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModuleLexer.js",
-      "keys": [
-        "bareModuleLexer"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareModule.js",
       "keys": [
@@ -415,18 +409,18 @@
         "bareModuleTraverse"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNative.js",
-      "keys": [
-        "bareNative"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareNdk.js",
       "keys": [
         "bareNdk"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNative.js",
+      "keys": [
+        "bareNative"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNodeFetch.js",
       "keys": [
@@ -434,9 +428,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareOpen.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
-        "bareOpen"
+        "bareMedia"
       ]
     },
     {
@@ -445,24 +439,18 @@
         "bareOs"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareOpen.js",
+      "keys": [
+        "bareOpen"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNet.js",
       "keys": [
         "bareNet"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareMedia.js",
-      "keys": [
-        "bareMedia"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePng.js",
-      "keys": [
-        "barePng"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePerformance.js",
       "keys": [
@@ -481,18 +469,18 @@
         "barePackDrive"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePunycode.js",
-      "keys": [
-        "barePunycode"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
         "barePipe"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePng.js",
+      "keys": [
+        "barePng"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
@@ -500,9 +488,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "path": "/lib/bare/bundles/barePunycode.js",
       "keys": [
-        "bareNodeRuntime"
+        "barePunycode"
       ]
     },
     {
@@ -512,15 +500,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
       "keys": [
-        "bareQueueMicrotask"
+        "bareNodeRuntime"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareRealm.js",
+      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
       "keys": [
-        "bareRealm"
+        "bareQueueMicrotask"
       ]
     },
     {
@@ -529,12 +517,24 @@
         "bareProcess"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareRealm.js",
+      "keys": [
+        "bareRealm"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
         "barePromClient"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRuntime.js",
       "keys": [
@@ -547,36 +547,12 @@
         "bareSdl"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSemver.js",
-      "keys": [
-        "bareSemver"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRpc.js",
       "keys": [
         "bareRpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSidecar.js",
-      "keys": [
-        "bareSidecar"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSignals.js",
-      "keys": [
-        "bareSignals"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRun.js",
-      "keys": [
-        "bareRun"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRepl.js",
       "keys": [
@@ -584,15 +560,27 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStdio.js",
+      "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
-        "bareStdio"
+        "bareSemver"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStorage.js",
+      "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
-        "bareStorage"
+        "bareRun"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSignals.js",
+      "keys": [
+        "bareSignals"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSidecar.js",
+      "keys": [
+        "bareSidecar"
       ]
     },
     {
@@ -602,9 +590,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareStorage.js",
       "keys": [
-        "bareSvg"
+        "bareStorage"
       ]
     },
     {
@@ -614,9 +602,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareStdio.js",
       "keys": [
-        "bareSystemLogger"
+        "bareStdio"
       ]
     },
     {
@@ -626,15 +614,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTiff.js",
+      "path": "/lib/bare/bundles/bareSvg.js",
       "keys": [
-        "bareTiff"
+        "bareSvg"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
-        "bareSubprocess"
+        "bareTiff"
       ]
     },
     {
@@ -644,21 +632,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTimers.js",
+      "path": "/lib/bare/bundles/bareSubprocess.js",
       "keys": [
-        "bareTimers"
+        "bareSubprocess"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTpl.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
-        "bareTpl"
+        "bareSystemLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTcp.js",
-      "keys": [
-        "bareTcp"
       ]
     },
     {
@@ -667,18 +649,42 @@
         "bareThread"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTcp.js",
+      "keys": [
+        "bareTcp"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTimers.js",
+      "keys": [
+        "bareTimers"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareType.js",
       "keys": [
         "bareType"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTpl.js",
+      "keys": [
+        "bareTpl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
         "bareTty"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareV8.js",
+      "keys": [
+        "bareV8"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareUiKit.js",
       "keys": [
@@ -697,72 +703,66 @@
         "bareTls"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareV8.js",
-      "keys": [
-        "bareV8"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareVm.js",
       "keys": [
         "bareVm"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebKit.js",
-      "keys": [
-        "bareWebKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareUnionBundle.js",
-      "keys": [
-        "bareUnionBundle"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
         "bareWalkHandles"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUnionBundle.js",
+      "keys": [
+        "bareUnionBundle"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWebKit.js",
+      "keys": [
+        "bareWebKit"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWebp.js",
       "keys": [
         "bareWebp"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebKitGtk.js",
-      "keys": [
-        "bareWebKitGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareWhich.js",
-      "keys": [
-        "bareWhich"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareWinUi.js",
-      "keys": [
-        "bareWinUi"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUtils.js",
       "keys": [
         "bareUtils"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWhich.js",
+      "keys": [
+        "bareWhich"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWebKitGtk.js",
+      "keys": [
+        "bareWebKitGtk"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
         "bareV8ToIstanbul"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWinUi.js",
+      "keys": [
+        "bareWinUi"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareXdiff.js",
       "keys": [
@@ -775,12 +775,6 @@
         "bareZlib"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWs.js",
-      "keys": [
-        "bareWs"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareZmq.js",
       "keys": [
@@ -792,6 +786,12 @@
       "keys": [
         "bareWorker"
       ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWs.js",
+      "keys": [
+        "bareWs"
+      ]
     }
   ],
   "bundleStats": {

package.json

@@ -14,7 +14,7 @@
     "gen:bare-catalog:check": "node scripts/gen-bare-holepunch-catalog.mjs --check",
     "sync:bare-manifest": "node scripts/sync-bare-module-manifest-from-catalog.mjs",
     "smoke:bare-manifest": "node scripts/smoke-bare-manifest-imports.mjs",
-    "pretest": "npm run build -w bare-os-coreutils && npm run build -w bare-os-bare-libs && node scripts/verify-kernel-seeder-parity.mjs && node scripts/verify-ctx-api-feature-bits.mjs && node scripts/verify-kernel-capabilities-contract.mjs && node scripts/verify-kernel-capabilities-word-6.mjs && node scripts/verify-kernel-capabilities-word-7.mjs && node scripts/verify-kernel-capabilities-word-8.mjs && node scripts/verify-kernel-capabilities-word-9.mjs && node scripts/verify-kernel-capabilities-word-10.mjs && node scripts/verify-kernel-capabilities-word-11.mjs && node scripts/verify-ctx-dts.mjs && node scripts/validate-example-schemas.mjs && node scripts/verify-doc-links.mjs && node scripts/verify-man-coverage.mjs && node scripts/verify-compat-matrix.mjs && node scripts/verify-pear-no-static-node-import.mjs && npm run smoke:bare-manifest",
+    "pretest": "npm run build -w bare-os-coreutils && npm run build -w bare-os-bare-libs && node scripts/verify-kernel-seeder-parity.mjs && node scripts/verify-ctx-api-feature-bits.mjs && node scripts/verify-kernel-capabilities-contract.mjs && node scripts/verify-kernel-capabilities-word-6.mjs && node scripts/verify-kernel-capabilities-word-7.mjs && node scripts/verify-kernel-capabilities-word-8.mjs && node scripts/verify-kernel-capabilities-word-9.mjs && node scripts/verify-kernel-capabilities-word-10.mjs && node scripts/verify-kernel-capabilities-word-11.mjs && node scripts/verify-ctx-dts.mjs && node scripts/validate-example-schemas.mjs && node scripts/verify-doc-links.mjs && node scripts/verify-man-coverage.mjs && node scripts/verify-compat-matrix.mjs && node scripts/verify-giant-phase-doc.mjs && node scripts/verify-pear-no-static-node-import.mjs && npm run smoke:bare-manifest",
     "test": "npm run test --workspaces --if-present",
     "verify-kernel-seeder": "node scripts/verify-kernel-seeder-parity.mjs",
     "release-checklist": "node scripts/release-checklist.mjs",

packages/bare-os-booter/CHANGELOG.md

@@ -11,6 +11,7 @@ Authoritative **version alignment** with protocol and telemetry schema numbers l
 
 | Version | Booter (workspace) | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | ------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 1.23.0  | 0.1.0              | Giant-phase program: **`/proc/bare_os/giant_phase_program.json`** (+ flat alias), **`bareOsReadBareTopSnapshot`** + **`baretop`** proc entry; stock kernel **`BARE_OS_BOOT_SAFE_MODE`**, boot transaction journal + checkpoint under **`/run/bare-os/`**; **`kernel.ext.d`** **`requires`** / **`after`** / **`before`** ordering; optional **`subsystems.kernel.giantPhase`** on **`bareOsPublishBootReady`**. See **`developer-guide/giant-phase-kernel-program.md`**. |
 | 1.22.0  | 0.1.0              | **Breaking:** **`bareOsAdvertisedKernelCapabilityWords`** / **`bareOsSeedKernelCapabilityWords`** frozen maps (wire v2 semantic keys); removed per-word **`bareOsAdvertisedKernelCapabilities*`** / **`bareOsSeedCapability*`** fields. Seed strict check + **`/proc/bare_os_features`**, debug proc, offline LKG handshake use **`kernelCapabilityWords`**. Shipped with **`bare-os-protocol` `0.9.0`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC=15`**. Kernels: read words via map keys (see **`kernel/init.js`**). |
 | 1.21.0  | 0.1.0              | Semantic **`ctx`** capability field names (per-word **`bareOsAdvertisedKernelCapabilities*`** / **`bareOsSeedCapability*`**); operator env renames (**`BARE_OS_PROBE_ID_*`**, **`BARE_OS_HIDE_PROC_HYPERCORE_PACK_HRPC_LIFECYCLE`**); **`bare-os-protocol` `0.8.0`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC=14`** (identifier/doc bump; wire **`bits`**…**`bits11`** unchanged). CI: **`verify-kernel-capabilities-contract.mjs`**, **`verify-kernel-capabilities-word-*.mjs`**. |
 | 1.20.0  | 0.1.0              | Eleventh word **`bits11`** + **`BARE_OS_KERNEL_FEATURES_STOCK_WORD_HYPERCORE_PACK_HRPC_LIFECYCLE`**; seed **`bits11`** + strict check; word-11 **`/proc`** JSON (**`bare-os-proc-hypercore-pack-hrpc-lifecycle.js`**), **`bare_os_proc_index`** schema **7**, **`extensions.json`** schema **8**; boot policy v11 keys (**`requireKernelCapabilitiesHypercorePackHrpcLifecycle`**, **`extensionSignerPinsV4`**, **`requireBarePackMin`**, **`requireBareAddonPolicyMin`**, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireHypercorePackHrpcLifecycle`**, merged **`denySeedRpcMethods`**); NDJSON lifecycle **10**, OTel **`otlSchemaVersion: 8`**, audit **`auditSchemaVersion: 8`**; **`cryptoproc:*`** / **`indexerproc:*`** worker patterns; word-11 **`ctx`** stubs; **`hypercorePackHrpcLifecycleProbeId`**, **`BARE_OS_BARE_PACK_VERSION`**, **`BARE_OS_BARE_ADDON_POLICY_VERSION`**. Shipped with protocol **`0.7.0`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC=13`**. CI: **`verify-kernel-capabilities-word-11.mjs`**. |

packages/bare-os-booter/index.js

@@ -1878,6 +1878,7 @@ async function executeKernel(disk, store, swarm, initSource) {
         ['ipcBackpressure', '/proc/bare_os/ipc_backpressure.json'],
         ['delegateRed', '/proc/bare_os/delegate_red.json'],
         ['gitDelegateStats', '/proc/bare_os/git_delegate_stats.json'],
+        ['giantPhaseProgram', '/proc/bare_os/giant_phase_program.json'],
         ['gitLfsPointerStats', '/proc/bare_os/git_lfs_pointer_stats.json'],
         ['workerBudget', '/proc/bare_os/worker_budget.json'],
         ['sandboxProfile', '/proc/bare_os/sandbox_profile.json'],

packages/bare-os-booter/lib/bare-os-ctx-api.js

@@ -2,4 +2,4 @@
  * Semantic version of the booter `ctx` contract for custom kernels.
  * Bump when adding/removing/renaming documented `ctx` fields or changing behavior.
  */
-export const BARE_OS_CTX_API_VERSION = '1.22.0'
+export const BARE_OS_CTX_API_VERSION = '1.23.0'

packages/bare-os-booter/lib/bare-os-giant-phase.js

@@ -0,0 +1,74 @@
+/**
+ * Giant Phase Kernel Super-Feature Program — operator-facing proc snapshot.
+ * Uses env flags only (no Node `node:*` in guest-facing surfaces).
+ * @param {Record<string, string | undefined>} env
+ */
+export function buildGiantPhaseProgramProcJson(env) {
+  const now = Date.now()
+  const esc = (k) => String(env[k] ?? '').trim()
+  const on = (k) => {
+    const v = esc(k)
+    return v === '1' || v === 'true'
+  }
+
+  function parseOverride() {
+    const raw = esc('BARE_OS_GIANT_PHASE_PROGRAM_JSON')
+    if (!raw) return null
+    try {
+      const o = JSON.parse(raw)
+      return o && typeof o === 'object' ? o : null
+    } catch {
+      return { error: 'invalid_json', key: 'BARE_OS_GIANT_PHASE_PROGRAM_JSON', atMs: now }
+    }
+  }
+
+  const base = {
+    schema: 1,
+    program: 'giant-phase-kernel-superfeature',
+    programVersion: 1,
+    atMs: now,
+    hooks: {
+      bootSafeMode: on('BARE_OS_BOOT_SAFE_MODE'),
+      bootTransactionJournal: (() => {
+        const v = esc('BARE_OS_BOOT_TRANSACTION_JOURNAL')
+        return v === '1' || v === 'true' || v === 'ndjson' ? v : ''
+      })(),
+      bootCheckpoint: on('BARE_OS_BOOT_CHECKPOINT'),
+      bootPolicy: on('BARE_OS_BOOT_POLICY'),
+      bootPolicyStrict: on('BARE_OS_BOOT_POLICY_STRICT'),
+      bootMinimal: on('BARE_OS_BOOT_MINIMAL'),
+      kernelDebug: on('BARE_OS_KERNEL_DEBUG'),
+      lazyPersonalDrive: on('BARE_OS_LAZY_PERSONAL_DRIVE'),
+      kernelHotReload: on('BARE_OS_KERNEL_HOT_RELOAD')
+    },
+    bareStacks: {
+      note:
+        'Prefer bare-module, bare-crypto, bare-fs, bare-net, bare-dns, bare-process, bare-subprocess, bare-ipc, bare-worker, bare-tls, bare-fetch, bare-http1, bare-ws per holepunch bare-node map.',
+      bareCryptoVersion: esc('BARE_OS_BARE_CRYPTO_VERSION').slice(0, 64),
+      pearIpcVersion: esc('BARE_OS_PEAR_IPC_PACKAGE_VERSION').slice(0, 64),
+      bareTlsVersion: esc('BARE_OS_BARE_TLS_VERSION').slice(0, 64)
+    },
+    workstreams: {
+      bootRuntime: { status: 'active', items: '1-10' },
+      moduleLoading: { status: 'active', items: '11-20' },
+      processIpc: { status: 'framework', items: '21-30' },
+      vfsStorage: { status: 'framework', items: '31-40' },
+      networking: { status: 'framework', items: '41-50' },
+      security: { status: 'framework', items: '51-60' },
+      reliability: { status: 'framework', items: '61-70' },
+      lifecycle: { status: 'framework', items: '71-80' },
+      devexUx: { status: 'active', items: '81-90' },
+      perfCompat: { status: 'framework', items: '91-100' }
+    },
+    docAnchor: 'developer-guide/giant-phase-kernel-program.md'
+  }
+
+  const override = parseOverride()
+  if (override && !override.error) {
+    return { ...base, ...override, schema: 1, atMs: now }
+  }
+  if (override && override.error) {
+    return { ...base, overrideError: override }
+  }
+  return base
+}

packages/bare-os-booter/lib/bare-os-proc-hypercore-pack-hrpc-lifecycle.js

@@ -1,3 +1,5 @@
+import { buildGiantPhaseProgramProcJson } from './bare-os-giant-phase.js'
+
 /**
  * Wave 11 optional `/proc/bare_os/*.json` payloads (env-injected; bounded, non-secret).
  * Aligns with seed RPC wave 11 + bits11 — no Node `node:*` built-ins in guest paths.
@@ -160,6 +162,8 @@ export function buildBareOsHypercorePackHrpcLifecycleProcJson(id, env) {
         note: 'wave11 SLO hint adjunct.',
         atMs: now
       }
+    case 'giant_phase_program':
+      return buildGiantPhaseProgramProcJson(env)
     default:
       return {
         schema: 1,

packages/bare-os-booter/lib/bare-os-runtime-caps.js

@@ -67,6 +67,7 @@ export const BARE_OS_PSEUDO_FS_PATHS = Object.freeze([
   '/proc/bare_os/worker_budget.json',
   '/proc/bare_os/sandbox_profile.json',
   '/proc/bare_os/dns_map_active.json',
+  '/proc/bare_os/giant_phase_program.json',
   '/proc/bare_os/git_delegate_stats.json',
   '/proc/bare_os/snapshot_hints.json',
   '/proc/bare_os/activity_queue_depth.json',

packages/bare-os-booter/lib/vfs.js

@@ -149,7 +149,8 @@ export const BARE_OS_PROC_FILE_TO_ID_HYPERCORE_PACK_HRPC_LIFECYCLE = Object.free
   bare_os_sidecar_resource_cap: 'sidecar_resource_cap',
   bare_os_storage_tier_hint: 'storage_tier_hint',
   bare_os_wave11_operator_slo_v2: 'wave11_operator_slo_v2',
-  bare_os_wave11_peer_qos_sketch: 'wave11_peer_qos_sketch'
+  bare_os_wave11_peer_qos_sketch: 'wave11_peer_qos_sketch',
+  bare_os_giant_phase_program: 'giant_phase_program'
 })
 
 /**
@@ -1426,6 +1427,10 @@ export function createVfs(
               name: 'git_lfs_budget.json',
               path: '/proc/bare_os/git_lfs_budget.json'
             },
+            {
+              name: 'giant_phase_program.json',
+              path: '/proc/bare_os/giant_phase_program.json'
+            },
             {
               name: 'net_qos_class.json',
               path: '/proc/bare_os/net_qos_class.json'
@@ -1909,6 +1914,8 @@ export function createVfs(
           'wave11_peer_qos_sketch.json': 'bare_os_wave11_peer_qos_sketch',
           wave11_operator_slo_v2: 'bare_os_wave11_operator_slo_v2',
           'wave11_operator_slo_v2.json': 'bare_os_wave11_operator_slo_v2',
+          giant_phase_program: 'bare_os_giant_phase_program',
+          'giant_phase_program.json': 'bare_os_giant_phase_program',
           'initd_graph.json': 'bare_os_initd_graph'
         }[rest]
         if (alias) {
@@ -3075,12 +3082,13 @@ export function createVfs(
           'bare_os_drive_version_graph.json',
           'bare_os_extensions.json',
           'bare_os_features',
-          'bare_os_form_data_delegate_limits_v2.json',
           'bare_os_form_data_delegate_limits.json',
+          'bare_os_form_data_delegate_limits_v2.json',
+          'bare_os_giant_phase_program.json',
           'bare_os_gip_transport_sketch.json',
           'bare_os_git_delegate_stats.json',
-          'bare_os_git_lfs_pointer_stats.json',
           'bare_os_git_lfs_budget.json',
+          'bare_os_git_lfs_pointer_stats.json',
           'bare_os_hdms_health.json',
           'bare_os_hdms_hints.json',
           'bare_os_host_os.json',
@@ -3234,6 +3242,7 @@ export function createVfs(
           'git_delegate_stats.json',
           'git_lfs_pointer_stats.json',
           'git_lfs_budget.json',
+          'giant_phase_program.json',
           'hdms_health.json',
           'hdms_hints.json',
           'host_os.json',

packages/bare-os-booter/test.js

@@ -15,6 +15,7 @@ import {
   createVfs,
   BARE_OS_PROC_FILE_TO_ID_HYPERCORE_PACK_HRPC_LIFECYCLE
 } from './lib/vfs.js'
+import { buildBareOsHypercorePackHrpcLifecycleProcJson } from './lib/bare-os-proc-hypercore-pack-hrpc-lifecycle.js'
 import { createBareOsIpc } from './lib/bare-os-ipc.js'
 import { bareOsHttpUrlAllowed } from './lib/bare-os-http-policy.js'
 import { raceWithAbortAndTimeout } from './lib/bare-os-abort.js'
@@ -136,6 +137,56 @@ function personalHomeBacking(homePath, rel = '') {
   return r ? `/.bare-os/home/${seg}/${r}` : `/.bare-os/home/${seg}`
 }
 
+test('giant_phase_program proc JSON includes program metadata', async (t) => {
+  const o = buildBareOsHypercorePackHrpcLifecycleProcJson(
+    'giant_phase_program',
+    { BARE_OS_BOOT_SAFE_MODE: '1' }
+  )
+  t.is(o.schema, 1)
+  t.is(o.program, 'giant-phase-kernel-superfeature')
+  t.ok(o.hooks && o.hooks.bootSafeMode === true)
+})
+
+test('stock kernel BARE_OS_BOOT_SAFE_MODE skips kernel.ext.d scripts', async (t) => {
+  const src = await readFile(
+    path.join(__dirname, '../../kernel/init.js'),
+    'utf8'
+  )
+  let extRan = false
+  const drive = {
+    async get(p) {
+      if (p === '/etc/bare-os/kernel.ext.d/01-a.json') {
+        return b4a.from(
+          JSON.stringify({
+            id: 'a',
+            scripts: ['/lib/bare-os/extensions/x.js']
+          })
+        )
+      }
+      return null
+    },
+    async *readdir(d) {
+      if (d === '/etc/bare-os/kernel.ext.d') yield '01-a.json'
+    }
+  }
+  const ctx = {
+    bareOsSkipRepl: true,
+    env: { BARE_OS_BOOT_SAFE_MODE: '1' },
+    drive,
+    b4a,
+    console: { log() {}, error() {} },
+    readLine: async () => null,
+    async execLine() {
+      return 'ok'
+    },
+    async bareOsRunImageScript() {
+      extRan = true
+    }
+  }
+  await runKernelFromSource(src, ctx)
+  t.is(extRan, false)
+})
+
 test('runKernelFromSource invokes start(ctx)', async (t) => {
   const calls = []
   const source = `
@@ -911,6 +962,7 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
     'bare_os_features',
     'bare_os_form_data_delegate_limits.json',
     'bare_os_form_data_delegate_limits_v2.json',
+    'bare_os_giant_phase_program.json',
     'bare_os_gip_transport_sketch.json',
     'bare_os_git_delegate_stats.json',
     'bare_os_git_lfs_budget.json',

packages/bare-os-coreutils/lib/baretop-snapshot.js

@@ -33,6 +33,7 @@ var BARE_TOP_SNAPSHOT_PROC_ENTRIES = [
   ['ipcBackpressure', '/proc/bare_os/ipc_backpressure.json'],
   ['delegateRed', '/proc/bare_os/delegate_red.json'],
   ['gitDelegateStats', '/proc/bare_os/git_delegate_stats.json'],
+  ['giantPhaseProgram', '/proc/bare_os/giant_phase_program.json'],
   ['gitLfsPointerStats', '/proc/bare_os/git_lfs_pointer_stats.json'],
   ['workerBudget', '/proc/bare_os/worker_budget.json'],
   ['sandboxProfile', '/proc/bare_os/sandbox_profile.json'],

packages/bare-os-coreutils/lib/commands.mjs

@@ -52,6 +52,8 @@ export const COREUTILS_COMMANDS = [
   'id',
   'install',
   'join',
+  'kernel-doctor',
+  'kernel-explain',
   'jq',
   'ln',
   'login',

packages/bare-os-coreutils/man/pages/baretop.json

@@ -3,43 +3,13 @@
   "section": 1,
   "title": "baretop",
   "synopsis": [
-    "baretop [OPTION]..."
+    "baretop [OPTION]... [OPERAND]..."
   ],
-  "description": "Full-screen terminal dashboard for Bare OS session and kernel-adjacent state. Visually similar to htop, but Bare OS does not expose a Linux-style per-PID process table: the UI focuses on metrics_live session counters, Hyperswarm peers, delegate inflight and rate buckets, pipeline limits, optional ctx snapshots (fairness, subprocess bridge, host stats), and a broad set of /proc/bare_os JSON mirrors (replication, Pear IPC, HDMS, quotas, extensions, etc.). Data is read via ctx.vfs.readFile with optional fast paths ctx.bareOsReadProcMetricsLive, ctx.bareOsGetResourceStatus, and ctx.bareOsReadBareTopSnapshot (booter batch read). Implementation: packages/bare-os-coreutils/src/baretop.js with preamble lib/baretop-snapshot.js and lib/baretop-tui.js (plus edit-ansi.js, edit-key-parse.js).",
+  "description": "Bare OS implementation of baretop. Full behavior is defined in packages/bare-os-coreutils/src/baretop.js.",
   "options": [],
-  "environment": [
-    "BARE_TOP_INTERVAL_MS — refresh period in ms (default 1000; clamped 250–10000)",
-    "BARE_TOP_UI_MIN_MS — minimum ms between full redraws (0 disables throttling)",
-    "BARE_TOP_FETCH_CONCURRENCY — parallel batch size for extra /proc/bare_os reads (default 6)",
-    "BARE_TOP_NO_ALTSCREEN — any non-empty value disables xterm alternate screen; uses full clear on exit",
-    "BARE_TOP_ASCII_GRAPH — set to 1 for ASCII sparklines instead of Unicode block glyphs",
-    "BARE_TOP_ASCII_UI — set to 1 to bias ASCII fallbacks when LANG suggests plain terminals",
-    "BARE_TOP_BRAILLE_SPARK — set to 1 for braille sparkline glyphs (Unicode)",
-    "BARE_TOP_LOG_SPARK — set to 1 for log-scaled sparkline normalization",
-    "BARE_TOP_EMA_ALPHA — 0–1 exponential smoothing on per-tick deltas (0 = off)",
-    "BARE_TOP_THEME — dark | light | none (SGR palette)",
-    "BARE_TOP_HIGH_CONTRAST — set to 1 for stronger emphasis (bold/underline)",
-    "BARE_TOP_COLOR256 — set to 1 to use 256-color hints for histogram bars when supported",
-    "BARE_TOP_VI_KEYS — set to 1 to enable hjkl navigation in scrollable views",
-    "BARE_TOP_LAYOUT — stacked | even (wide-terminal overview hint)",
-    "BARE_TOP_EXPORT_PATH — path for JSON snapshot export (key e; default /tmp/baretop-snapshot.json)",
-    "BARE_TOP_ICONS — set to 1 for a bullet prefix in the title bar",
-    "NO_COLOR — disable colors",
-    "COLORTERM — consulted with BARE_TOP_COLOR256 for 256-color bar mode"
-  ],
-  "diagnostics": [
-    "If the UI leaves garbage on exit, set BARE_TOP_NO_ALTSCREEN=1.",
-    "If Unicode graphs garble, set BARE_TOP_ASCII_GRAPH=1 or BARE_TOP_ASCII_UI=1.",
-    "On very narrow terminals (<80 cols), secondary columns are omitted automatically.",
-    "Diagnostics tab may include /proc/bare_os/debug.json; treat as operator-sensitive and avoid logging in untrusted contexts."
-  ],
   "keywords": [
     "baretop",
-    "monitor",
-    "metrics",
     "bare-os",
-    "coreutils",
+    "coreutils"
-    "proc"
+  ]
-  ],
-  "bareOsNotes": "Uses ctx.vfs.readFile on /proc paths; uses ctx.bareOsReadProcMetricsLive, ctx.bareOsGetResourceStatus, ctx.bareOsReadBareTopSnapshot, ctx.bareOsReadDelegateFairnessSnapshot, ctx.bareOsReadSubprocessBridgeSnapshot, and ctx.bareOsHostStats when present. Requires a TTY; integrates with fish suspend/resume and bareOsRegisterSuspendHook/ResumeHook like edit(1). No node: imports in the /bin bundle — use JSON.parse and ctx.b4a only."
 }

packages/bare-os-coreutils/man/pages/btop.json

@@ -3,22 +3,13 @@
   "section": 1,
   "title": "btop",
   "synopsis": [
-    "btop [OPTION]..."
+    "btop [OPTION]... [OPERAND]..."
   ],
-  "description": "Short name for baretop(1): the same full-screen session / operator dashboard and /proc/bare_os panels. The /bin bundle is built from packages/bare-os-coreutils/src/baretop.js with the same preamble as baretop. Default shell alias: btop expands to baretop.",
+  "description": "Bare OS implementation of btop. Full behavior is defined in packages/bare-os-coreutils/src/btop.js.",
   "options": [],
-  "seeAlso": [
-    {
-      "name": "baretop",
-      "section": 1
-    }
-  ],
   "keywords": [
     "btop",
-    "baretop",
-    "monitor",
     "bare-os",
     "coreutils"
-  ],
+  ]
-  "bareOsNotes": "Same ctx and TTY requirements as baretop(1)."
 }

packages/bare-os-coreutils/man/pages/kernel-doctor.json

@@ -0,0 +1,15 @@
+{
+  "name": "kernel-doctor",
+  "section": 1,
+  "title": "kernel-doctor",
+  "synopsis": [
+    "kernel-doctor [OPTION]... [OPERAND]..."
+  ],
+  "description": "Bare OS implementation of kernel-doctor. Full behavior is defined in packages/bare-os-coreutils/src/kernel-doctor.js.",
+  "options": [],
+  "keywords": [
+    "kernel-doctor",
+    "bare-os",
+    "coreutils"
+  ]
+}

packages/bare-os-coreutils/man/pages/kernel-explain.json

@@ -0,0 +1,15 @@
+{
+  "name": "kernel-explain",
+  "section": 1,
+  "title": "kernel-explain",
+  "synopsis": [
+    "kernel-explain [OPTION]... [OPERAND]..."
+  ],
+  "description": "Bare OS implementation of kernel-explain. Full behavior is defined in packages/bare-os-coreutils/src/kernel-explain.js.",
+  "options": [],
+  "keywords": [
+    "kernel-explain",
+    "bare-os",
+    "coreutils"
+  ]
+}

packages/bare-os-coreutils/src/kernel-doctor.js

@@ -0,0 +1,41 @@
+async function readProcJson(ctx, p) {
+  const vfs = ctx.vfs
+  if (!vfs || typeof vfs.readFile !== 'function') return null
+  try {
+    const buf = await vfs.readFile(p)
+    const t = ctx.b4a ? ctx.b4a.toString(buf) : String(buf)
+    const j = JSON.parse(t.trim())
+    return j && typeof j === 'object' ? j : null
+  } catch {
+    return null
+  }
+}
+
+async function run(ctx, argv) {
+  let json = false
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '--json') json = true
+  }
+  const out = {
+    note: 'kernel-doctor — guest snapshot (non-secret). See developer-guide/giant-phase-kernel-program.md',
+    ctxApiVersion: String(ctx.bareOsCtxApiVersion || ''),
+    giantPhase: await readProcJson(ctx, '/proc/bare_os/giant_phase_program.json'),
+    resources: await readProcJson(ctx, '/proc/bare_os/resources'),
+    bootReady: await readProcJson(ctx, '/run/bare-os/boot.json'),
+    envHints: {
+      bootSafeMode: ctx.env?.BARE_OS_BOOT_SAFE_MODE,
+      bootTransactionJournal: ctx.env?.BARE_OS_BOOT_TRANSACTION_JOURNAL,
+      bootCheckpoint: ctx.env?.BARE_OS_BOOT_CHECKPOINT
+    }
+  }
+  if (json) {
+    ctx.console.log(JSON.stringify(out, null, 2))
+  } else {
+    ctx.console.log('ctx API: ' + out.ctxApiVersion)
+    ctx.console.log(
+      'giant phase program: ' +
+        (out.giantPhase ? 'see /proc/bare_os/giant_phase_program.json' : '(unavailable)')
+    )
+    ctx.console.log('run: kernel-doctor --json | jq .')
+  }
+}

packages/bare-os-coreutils/src/kernel-explain.js

@@ -0,0 +1,46 @@
+/** Map common failure tokens to documentation anchors (offline-friendly). */
+var KERNEL_EXPLAIN_MAP = {
+  boot_policy: 'docs/reference/kernel-extensions.md — BARE_OS_BOOT_POLICY',
+  safe_mode: 'BARE_OS_BOOT_SAFE_MODE — skips rc.d, kernel.ext.d, onboot (developer-guide/giant-phase-kernel-program.md)',
+  boot_journal:
+    'BARE_OS_BOOT_TRANSACTION_JOURNAL — /run/bare-os/boot-transaction.ndjson',
+  boot_checkpoint: 'BARE_OS_BOOT_CHECKPOINT — /run/bare-os/boot-checkpoint.json',
+  kernel_ext:
+    'kernel.ext.d — dependsOn, requires, after, before (stock kernel/init.js header)',
+  giant_phase:
+    '/proc/bare_os/giant_phase_program.json — giant-phase program snapshot',
+  bare_module:
+    'Use bare-module / bare-node mapping (Holepunch); never node:module in guest',
+  bare_crypto:
+    'Use bare-crypto / bare-node crypto shim; never node:crypto in guest',
+  compat: 'docs/reference/compatibility-matrix.md',
+  roadmap: 'docs/reference/feature-roadmap.md'
+}
+
+async function run(ctx, argv) {
+  const key = String(argv[1] || '')
+    .trim()
+    .toLowerCase()
+    .replace(/^bare_os_/, '')
+    .replace(/-/g, '_')
+  if (!key || argv[1] === '--help' || argv[1] === '-h') {
+    ctx.console.log(
+      'Usage: kernel-explain <topic>\nTopics: ' +
+        Object.keys(KERNEL_EXPLAIN_MAP).sort().join(', ')
+    )
+    return
+  }
+  const hit = KERNEL_EXPLAIN_MAP[key]
+  if (hit) {
+    ctx.console.log(hit)
+    return
+  }
+  for (const [k, v] of Object.entries(KERNEL_EXPLAIN_MAP)) {
+    if (k.includes(key) || key.includes(k)) {
+      ctx.console.log(k + ': ' + v)
+      return
+    }
+  }
+  ctx.console.error('kernel-explain: unknown topic: ' + argv[1])
+  ctx.exitCode = 1
+}

packages/bare-os-seeder/kernel/bin/baretop

@@ -343,6 +343,7 @@ var BARE_TOP_SNAPSHOT_PROC_ENTRIES = [
   ['ipcBackpressure', '/proc/bare_os/ipc_backpressure.json'],
   ['delegateRed', '/proc/bare_os/delegate_red.json'],
   ['gitDelegateStats', '/proc/bare_os/git_delegate_stats.json'],
+  ['giantPhaseProgram', '/proc/bare_os/giant_phase_program.json'],
   ['gitLfsPointerStats', '/proc/bare_os/git_lfs_pointer_stats.json'],
   ['workerBudget', '/proc/bare_os/worker_budget.json'],
   ['sandboxProfile', '/proc/bare_os/sandbox_profile.json'],

packages/bare-os-seeder/kernel/bin/btop

@@ -343,6 +343,7 @@ var BARE_TOP_SNAPSHOT_PROC_ENTRIES = [
   ['ipcBackpressure', '/proc/bare_os/ipc_backpressure.json'],
   ['delegateRed', '/proc/bare_os/delegate_red.json'],
   ['gitDelegateStats', '/proc/bare_os/git_delegate_stats.json'],
+  ['giantPhaseProgram', '/proc/bare_os/giant_phase_program.json'],
   ['gitLfsPointerStats', '/proc/bare_os/git_lfs_pointer_stats.json'],
   ['workerBudget', '/proc/bare_os/worker_budget.json'],
   ['sandboxProfile', '/proc/bare_os/sandbox_profile.json'],

packages/bare-os-seeder/kernel/bin/help

@@ -87,7 +87,7 @@ function bareOsEmitRaw(ctx, chunk) {
   return false
 }
 
-var BARE_OS_HELP_BIN_SPACED = "arch awk baretop base32 base64 basename basenc btop cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split ssh-keygen stat sum sync systemctl tac tail tar tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
+var BARE_OS_HELP_BIN_SPACED = "arch awk baretop base32 base64 basename basenc btop cat chgrp chmod chown cksum clear cmp comm cp crontab curl cut date df dir dircolors dirname du echo edit env exit expand expr factor false find fmt fold getconf git git-pear grep groups hdms head help hostid hostname id install join journalctl jq kernel-doctor kernel-explain ln login logname logout ls man md5sum mkdir mkfifo mktemp mv nano nl nohup nproc numfmt od oidc-publish openssl paste pathchk pr printenv printf pwd readlink realpath rev rm rmdir savevault sed seq sha1sum sha256sum sha512sum shuf sleep sort split ssh-keygen stat sum sync systemctl tac tail tar tee test theme time timeout touch tr true truncate tsort tty uname unexpand uniq unlink uptime users vdir wc wget which who whoami xargs yes"
 async function run(ctx, argv) {
   ctx.console.log(
     'Bare OS — default user: guest | shell builtins: alias, barerc, cd, command, export, exit, login, logout, readonly, type, umask, unalias, unset, : | /bin: ' +

packages/bare-os-seeder/kernel/bin/kernel-doctor

@@ -0,0 +1,130 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+async function readProcJson(ctx, p) {
+  const vfs = ctx.vfs
+  if (!vfs || typeof vfs.readFile !== 'function') return null
+  try {
+    const buf = await vfs.readFile(p)
+    const t = ctx.b4a ? ctx.b4a.toString(buf) : String(buf)
+    const j = JSON.parse(t.trim())
+    return j && typeof j === 'object' ? j : null
+  } catch {
+    return null
+  }
+}
+
+async function run(ctx, argv) {
+  let json = false
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '--json') json = true
+  }
+  const out = {
+    note: 'kernel-doctor — guest snapshot (non-secret). See developer-guide/giant-phase-kernel-program.md',
+    ctxApiVersion: String(ctx.bareOsCtxApiVersion || ''),
+    giantPhase: await readProcJson(ctx, '/proc/bare_os/giant_phase_program.json'),
+    resources: await readProcJson(ctx, '/proc/bare_os/resources'),
+    bootReady: await readProcJson(ctx, '/run/bare-os/boot.json'),
+    envHints: {
+      bootSafeMode: ctx.env?.BARE_OS_BOOT_SAFE_MODE,
+      bootTransactionJournal: ctx.env?.BARE_OS_BOOT_TRANSACTION_JOURNAL,
+      bootCheckpoint: ctx.env?.BARE_OS_BOOT_CHECKPOINT
+    }
+  }
+  if (json) {
+    ctx.console.log(JSON.stringify(out, null, 2))
+  } else {
+    ctx.console.log('ctx API: ' + out.ctxApiVersion)
+    ctx.console.log(
+      'giant phase program: ' +
+        (out.giantPhase ? 'see /proc/bare_os/giant_phase_program.json' : '(unavailable)')
+    )
+    ctx.console.log('run: kernel-doctor --json | jq .')
+  }
+}

packages/bare-os-seeder/kernel/bin/kernel-explain

@@ -0,0 +1,135 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+/** Map common failure tokens to documentation anchors (offline-friendly). */
+var KERNEL_EXPLAIN_MAP = {
+  boot_policy: 'docs/reference/kernel-extensions.md — BARE_OS_BOOT_POLICY',
+  safe_mode: 'BARE_OS_BOOT_SAFE_MODE — skips rc.d, kernel.ext.d, onboot (developer-guide/giant-phase-kernel-program.md)',
+  boot_journal:
+    'BARE_OS_BOOT_TRANSACTION_JOURNAL — /run/bare-os/boot-transaction.ndjson',
+  boot_checkpoint: 'BARE_OS_BOOT_CHECKPOINT — /run/bare-os/boot-checkpoint.json',
+  kernel_ext:
+    'kernel.ext.d — dependsOn, requires, after, before (stock kernel/init.js header)',
+  giant_phase:
+    '/proc/bare_os/giant_phase_program.json — giant-phase program snapshot',
+  bare_module:
+    'Use bare-module / bare-node mapping (Holepunch); never node:module in guest',
+  bare_crypto:
+    'Use bare-crypto / bare-node crypto shim; never node:crypto in guest',
+  compat: 'docs/reference/compatibility-matrix.md',
+  roadmap: 'docs/reference/feature-roadmap.md'
+}
+
+async function run(ctx, argv) {
+  const key = String(argv[1] || '')
+    .trim()
+    .toLowerCase()
+    .replace(/^bare_os_/, '')
+    .replace(/-/g, '_')
+  if (!key || argv[1] === '--help' || argv[1] === '-h') {
+    ctx.console.log(
+      'Usage: kernel-explain <topic>\nTopics: ' +
+        Object.keys(KERNEL_EXPLAIN_MAP).sort().join(', ')
+    )
+    return
+  }
+  const hit = KERNEL_EXPLAIN_MAP[key]
+  if (hit) {
+    ctx.console.log(hit)
+    return
+  }
+  for (const [k, v] of Object.entries(KERNEL_EXPLAIN_MAP)) {
+    if (k.includes(key) || key.includes(k)) {
+      ctx.console.log(k + ': ' + v)
+      return
+    }
+  }
+  ctx.console.error('kernel-explain: unknown topic: ' + argv[1])
+  ctx.exitCode = 1
+}

packages/bare-os-seeder/kernel/init.js

@@ -18,6 +18,10 @@
  * BARE_OS_BOOT_TRACE=ndjson logs {"type":"boot","phase","ms","sessionId","ts"} per line.
  *
  * BARE_OS_BOOT_MINIMAL=1 or true: skip profile rc, rc, rc.d, rc.local, kernel.d (recovery shell).
+ * BARE_OS_BOOT_SAFE_MODE=1 or true: after boot policy merge, skip rc.d, kernel.ext.d, onboot (lighter recovery).
+ * BARE_OS_BOOT_TRANSACTION_JOURNAL=1, true, or ndjson: append boot phase NDJSON lines to
+ *   /run/bare-os/boot-transaction.ndjson when ctx.vfs supports readFile/writeFile.
+ * BARE_OS_BOOT_CHECKPOINT=1 or true: write /run/bare-os/boot-checkpoint.json after each completed boot phase.
  * BARE_OS_BOOT_SKIP: comma-separated phases to skip among:
  *   profile, rc, rc.d, rc.local, kernel.d, kernel.ext.d, onboot (os-release and motd always run).
  *
@@ -35,6 +39,8 @@
  * `BARE_OS_BOOT_POLICY_STRICT=1`: exit boot on policy violation (via requestBooterExit(1)).
  *
  * kernel.ext.d: JSON drop-ins under /etc/bare-os/kernel.ext.d/*.json with `{ "scripts": ["/lib/bare-os/extensions/…"] }` (trusted).
+ * Optional ordering: `dependsOn`, `requires` (merged into dependsOn), `after` (ids loaded before this drop-in),
+ *   `before` (ids that must load after this drop-in). Cycles fail strict boot or fall back to filename order.
  *
  * BARE_OS_BOOT_STRICT=1 or true: first execLine throw in trusted boot snippets calls
  * requestBooterExit(1) and stops further boot phases.
@@ -75,6 +81,78 @@ function bootMinimal(ctx) {
   return v === '1' || v === 'true'
 }
 
+/**
+ * Recovery-oriented boot: skip rc.d snippets, kernel extensions, and onboot after policy merge.
+ * @param {Record<string, unknown>} ctx
+ */
+function applyBootSafeMode(ctx) {
+  const v = ctx.env && ctx.env.BARE_OS_BOOT_SAFE_MODE
+  if (v !== '1' && v !== 'true') return
+  const pol = ctx.bareOsBootPolicySkipPhases
+  if (!(pol instanceof Set)) return
+  pol.add('rc.d')
+  pol.add('kernel.ext.d')
+  pol.add('onboot')
+}
+
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {Record<string, unknown>} row
+ */
+async function maybeAppendBootTransactionJournal(ctx, row) {
+  const en = ctx.env && ctx.env.BARE_OS_BOOT_TRANSACTION_JOURNAL
+  if (en !== '1' && en !== 'true' && en !== 'ndjson') return
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.readFile !== 'function' || typeof vfs.writeFile !== 'function' || !b4) return
+  const path = '/run/bare-os/boot-transaction.ndjson'
+  const line =
+    JSON.stringify({
+      type: 'boot_transaction',
+      ts: Date.now(),
+      sessionId: String((ctx.env && ctx.env.BARE_OS_SESSION_ID) || ''),
+      ...row
+    }) + '\n'
+  try {
+    let prev = ''
+    try {
+      const buf = await vfs.readFile(path)
+      prev = b4.toString(buf)
+    } catch {
+      /* new */
+    }
+    await vfs.writeFile(path, b4.from(prev + line))
+  } catch {
+    /* ignore */
+  }
+}
+
+/**
+ * @param {Record<string, unknown>} ctx
+ * @param {string} phase
+ * @param {number} ms
+ */
+async function maybeWriteBootCheckpoint(ctx, phase, ms) {
+  const v = ctx.env && ctx.env.BARE_OS_BOOT_CHECKPOINT
+  if (v !== '1' && v !== 'true') return
+  const vfs = ctx.vfs
+  const b4 = ctx.b4a
+  if (!vfs || typeof vfs.writeFile !== 'function' || !b4) return
+  try {
+    const body =
+      JSON.stringify({
+        schema: 1,
+        phase: String(phase),
+        phaseMs: typeof ms === 'number' ? ms : 0,
+        atMs: Date.now(),
+        sessionId: String((ctx.env && ctx.env.BARE_OS_SESSION_ID) || '')
+      }) + '\n'
+    await vfs.writeFile('/run/bare-os/boot-checkpoint.json', b4.from(body))
+  } catch {
+    /* ignore */
+  }
+}
+
 /**
  * @param {Record<string, unknown>} ctx
  * @returns {Set<string>}
@@ -1130,6 +1208,8 @@ async function bootTimed(ctx, label, fn, phaseLog) {
   await fn()
   const ms = Date.now() - t0
   phaseLog.push(label)
+  await maybeAppendBootTransactionJournal(ctx, { phase: label, ms, ok: true })
+  await maybeWriteBootCheckpoint(ctx, label, ms)
   if (wantBootTrace(ctx)) {
     if (isBootTraceNdjson(ctx)) {
       const sid = (ctx.env && ctx.env.BARE_OS_SESSION_ID) || ''
@@ -1608,7 +1688,7 @@ async function runKernelExtDropins(ctx) {
     return true
   }
   names.sort()
-  /** @type {{ file: string, extId: string, scripts: string[], dependsOn: string[], signaturePointer?: string }[]} */
+  /** @type {{ file: string, extId: string, scripts: string[], dependsOn: string[], beforeIds: string[], signaturePointer?: string }[]} */
   const collected = []
   for (const name of names) {
     if (!name.endsWith('.json')) continue
@@ -1629,9 +1709,22 @@ async function runKernelExtDropins(ctx) {
       const scripts = pol.scripts
       if (!Array.isArray(scripts)) continue
       /** @type {string[]} */
-      const dependsOn = Array.isArray(pol.dependsOn)
+      let dependsOn = Array.isArray(pol.dependsOn)
         ? pol.dependsOn.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
         : []
+      if (Array.isArray(pol.requires)) {
+        dependsOn = dependsOn.concat(
+          pol.requires.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
+        )
+      }
+      if (Array.isArray(pol.after)) {
+        dependsOn = dependsOn.concat(
+          pol.after.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
+        )
+      }
+      const beforeIds = Array.isArray(pol.before)
+        ? pol.before.map((d) => String(d).trim()).filter(Boolean).slice(0, 16)
+        : []
       const sig =
         typeof pol.signaturePointer === 'string'
           ? pol.signaturePointer.trim().slice(0, 512)
@@ -1641,12 +1734,27 @@ async function runKernelExtDropins(ctx) {
         extId,
         scripts: scripts.map((s) => String(s).trim()).filter(Boolean),
         dependsOn,
+        beforeIds,
         signaturePointer: sig || undefined
       })
     } catch (e) {
       console.error(`kernel.ext.d/${name}: ` + ((e && e.message) || String(e)))
     }
   }
+  const idToCollected = new Map(collected.map((e) => [e.extId, e]))
+  for (const e of collected) {
+    for (const bid of e.beforeIds) {
+      const target = idToCollected.get(bid)
+      if (target && target.extId !== e.extId) {
+        const next = new Set(target.dependsOn)
+        next.add(e.extId)
+        target.dependsOn = [...next].slice(0, 24)
+      }
+    }
+  }
+  for (const e of collected) {
+    e.dependsOn = [...new Set(e.dependsOn)]
+  }
   if (maxDepthCap > 0) {
     const d = kernelExtDependencyDepth(collected)
     if (d > maxDepthCap) {
@@ -1886,6 +1994,10 @@ async function runKernelSelftest(ctx) {
 function publishBootReady(ctx, phaseLog) {
   if (typeof ctx.bareOsPublishBootReady !== 'function') return
   const sid = (ctx.env && ctx.env.BARE_OS_SESSION_ID) || ''
+  const gpen = ctx.env && ctx.env.BARE_OS_BOOT_TRANSACTION_JOURNAL
+  const safe =
+    ctx.env?.BARE_OS_BOOT_SAFE_MODE === '1' ||
+    ctx.env?.BARE_OS_BOOT_SAFE_MODE === 'true'
   ctx.bareOsPublishBootReady({
     ready: true,
     phases: [...phaseLog],
@@ -1893,7 +2005,18 @@ function publishBootReady(ctx, phaseLog) {
     completedAtMs: Date.now(),
     minimal: bootMinimal(ctx),
     subsystems: {
-      kernel: { ready: true, phaseCount: phaseLog.length },
+      kernel: {
+        ready: true,
+        phaseCount: phaseLog.length,
+        giantPhase: {
+          schema: 1,
+          safeMode: safe,
+          transactionJournal: gpen === '1' || gpen === 'true' || gpen === 'ndjson',
+          checkpoint:
+            ctx.env?.BARE_OS_BOOT_CHECKPOINT === '1' ||
+            ctx.env?.BARE_OS_BOOT_CHECKPOINT === 'true'
+        }
+      },
       initd: { awaited: true }
     }
   })
@@ -1905,6 +2028,7 @@ async function start(ctx) {
   const phaseLog = []
   ctx.bareOsBootPolicySkipPhases = new Set()
   if (!(await applyBootPolicyFile(ctx))) return
+  applyBootSafeMode(ctx)
   await bootTimed(ctx, 'os-release', () => printOsRelease(ctx), phaseLog)
   await bootTimed(ctx, 'motd', () => printMotd(ctx), phaseLog)
   const profileName = await resolveBootProfileName(ctx)

packages/bare-os-seeder/kernel/lib/bare/manifest.json

@@ -1,12 +1,6 @@
 {
   "version": 1,
   "bundles": [
-    {
-      "path": "/lib/bare/bundles/safetyCatch.js",
-      "keys": [
-        "safetyCatch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/b4a.js",
       "keys": [
@@ -14,15 +8,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
+      "path": "/lib/bare/bundles/safetyCatch.js",
       "keys": [
-        "hypercoreIdEncoding"
+        "safetyCatch"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareUrl.js",
+      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
-        "bareUrl"
+        "hypercoreIdEncoding"
       ]
     },
     {
@@ -37,24 +31,30 @@
         "protomux"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUrl.js",
+      "keys": [
+        "bareUrl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEncoding.js",
       "keys": [
         "bareEncoding"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePath.js",
-      "keys": [
-        "barePath"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
         "bareEvents"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePath.js",
+      "keys": [
+        "barePath"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAbort.js",
       "keys": [
@@ -68,9 +68,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareReadline.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
       "keys": [
-        "bareReadline"
+        "bareAnsiEscapes"
       ]
     },
     {
@@ -80,9 +80,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "path": "/lib/bare/bundles/bareReadline.js",
       "keys": [
-        "bareAnsiEscapes"
+        "bareReadline"
       ]
     },
     {
@@ -92,9 +92,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/fetch.js",
+      "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
-        "fetch"
+        "bareAppKit"
       ]
     },
     {
@@ -103,48 +103,48 @@
         "bareAsyncHooks"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAppKit.js",
-      "keys": [
-        "bareAppKit"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAtomics.js",
       "keys": [
         "bareAtomics"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareApk.js",
-      "keys": [
-        "bareApk"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAssert.js",
       "keys": [
         "bareAssert"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareApk.js",
+      "keys": [
+        "bareApk"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBmp.js",
       "keys": [
         "bareBmp"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareBuffer.js",
+      "keys": [
+        "bareBuffer"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBundleCompile.js",
       "keys": [
         "bareBundleCompile"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBluetoothApple.js",
-      "keys": [
-        "bareBluetoothApple"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBundle.js",
       "keys": [
@@ -152,9 +152,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBuffer.js",
+      "path": "/lib/bare/bundles/bareBluetoothApple.js",
       "keys": [
-        "bareBuffer"
+        "bareBluetoothApple"
       ]
     },
     {
@@ -182,9 +182,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDelta.js",
+      "path": "/lib/bare/bundles/bareChannel.js",
       "keys": [
-        "bareDelta"
+        "bareChannel"
       ]
     },
     {
@@ -194,9 +194,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareChannel.js",
+      "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
-        "bareChannel"
+        "bareDelta"
       ]
     },
     {
@@ -205,12 +205,6 @@
         "bareDaemon"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareCov.js",
-      "keys": [
-        "bareCov"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
       "keys": [
@@ -235,12 +229,6 @@
         "bareExif"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
-      "keys": [
-        "bareFfmpegEncodings"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDgram.js",
       "keys": [
@@ -254,9 +242,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareGif.js",
+      "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
-        "bareGif"
+        "bareCov"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
+      "keys": [
+        "bareFfmpegEncodings"
       ]
     },
     {
@@ -272,27 +266,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareGif.js",
       "keys": [
-        "bareHeif"
+        "bareGif"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareGtk.js",
-      "keys": [
-        "bareGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
       ]
     },
     {
@@ -301,24 +277,48 @@
         "bareFs"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFileLogger.js",
+      "keys": [
+        "bareFileLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareGtk.js",
+      "keys": [
+        "bareGtk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHrtime.js",
+      "keys": [
+        "bareHrtime"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
         "bareHttpParser"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareImageResample.js",
-      "keys": [
-        "bareImageResample"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareIco.js",
       "keys": [
         "bareIco"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareImageResample.js",
+      "keys": [
+        "bareImageResample"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareInspect.js",
       "keys": [
@@ -331,12 +331,24 @@
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareJpeg.js",
+      "keys": [
+        "bareJpeg"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
         "bareHttps"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareIpc.js",
       "keys": [
@@ -344,15 +356,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareJpeg.js",
+      "path": "/lib/bare/bundles/bareLogger.js",
       "keys": [
-        "bareJpeg"
+        "bareLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareIntl.js",
-      "keys": [
-        "bareIntl"
       ]
     },
     {
@@ -368,9 +374,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareLogger.js",
+      "path": "/lib/bare/bundles/bareLink.js",
       "keys": [
-        "bareLogger"
+        "bareLink"
       ]
     },
     {
@@ -380,15 +386,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareLink.js",
+      "path": "/lib/bare/bundles/bareModuleLexer.js",
       "keys": [
-        "bareLink"
+        "bareModuleLexer"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
       ]
     },
     {
@@ -397,12 +397,6 @@
         "bareModuleResolve"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModuleLexer.js",
-      "keys": [
-        "bareModuleLexer"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareModule.js",
       "keys": [
@@ -415,18 +409,18 @@
         "bareModuleTraverse"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNative.js",
-      "keys": [
-        "bareNative"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareNdk.js",
       "keys": [
         "bareNdk"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNative.js",
+      "keys": [
+        "bareNative"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNodeFetch.js",
       "keys": [
@@ -434,9 +428,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareOpen.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
-        "bareOpen"
+        "bareMedia"
       ]
     },
     {
@@ -445,24 +439,18 @@
         "bareOs"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareOpen.js",
+      "keys": [
+        "bareOpen"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNet.js",
       "keys": [
         "bareNet"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareMedia.js",
-      "keys": [
-        "bareMedia"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePng.js",
-      "keys": [
-        "barePng"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePerformance.js",
       "keys": [
@@ -481,18 +469,18 @@
         "barePackDrive"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePunycode.js",
-      "keys": [
-        "barePunycode"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
         "barePipe"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePng.js",
+      "keys": [
+        "barePng"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
@@ -500,9 +488,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "path": "/lib/bare/bundles/barePunycode.js",
       "keys": [
-        "bareNodeRuntime"
+        "barePunycode"
       ]
     },
     {
@@ -512,15 +500,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
       "keys": [
-        "bareQueueMicrotask"
+        "bareNodeRuntime"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareRealm.js",
+      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
       "keys": [
-        "bareRealm"
+        "bareQueueMicrotask"
       ]
     },
     {
@@ -529,12 +517,24 @@
         "bareProcess"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareRealm.js",
+      "keys": [
+        "bareRealm"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
         "barePromClient"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRuntime.js",
       "keys": [
@@ -547,36 +547,12 @@
         "bareSdl"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSemver.js",
-      "keys": [
-        "bareSemver"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRpc.js",
       "keys": [
         "bareRpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSidecar.js",
-      "keys": [
-        "bareSidecar"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSignals.js",
-      "keys": [
-        "bareSignals"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRun.js",
-      "keys": [
-        "bareRun"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRepl.js",
       "keys": [
@@ -584,15 +560,27 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStdio.js",
+      "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
-        "bareStdio"
+        "bareSemver"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStorage.js",
+      "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
-        "bareStorage"
+        "bareRun"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSignals.js",
+      "keys": [
+        "bareSignals"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSidecar.js",
+      "keys": [
+        "bareSidecar"
       ]
     },
     {
@@ -602,9 +590,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareStorage.js",
       "keys": [
-        "bareSvg"
+        "bareStorage"
       ]
     },
     {
@@ -614,9 +602,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareStdio.js",
       "keys": [
-        "bareSystemLogger"
+        "bareStdio"
       ]
     },
     {
@@ -626,15 +614,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTiff.js",
+      "path": "/lib/bare/bundles/bareSvg.js",
       "keys": [
-        "bareTiff"
+        "bareSvg"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
-        "bareSubprocess"
+        "bareTiff"
       ]
     },
     {
@@ -644,21 +632,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTimers.js",
+      "path": "/lib/bare/bundles/bareSubprocess.js",
       "keys": [
-        "bareTimers"
+        "bareSubprocess"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTpl.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
-        "bareTpl"
+        "bareSystemLogger"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTcp.js",
-      "keys": [
-        "bareTcp"
       ]
     },
     {
@@ -667,18 +649,42 @@
         "bareThread"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTcp.js",
+      "keys": [
+        "bareTcp"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTimers.js",
+      "keys": [
+        "bareTimers"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareType.js",
       "keys": [
         "bareType"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTpl.js",
+      "keys": [
+        "bareTpl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
         "bareTty"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareV8.js",
+      "keys": [
+        "bareV8"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareUiKit.js",
       "keys": [
@@ -697,72 +703,66 @@
         "bareTls"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareV8.js",
-      "keys": [
-        "bareV8"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareVm.js",
       "keys": [
         "bareVm"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebKit.js",
-      "keys": [
-        "bareWebKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareUnionBundle.js",
-      "keys": [
-        "bareUnionBundle"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
         "bareWalkHandles"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUnionBundle.js",
+      "keys": [
+        "bareUnionBundle"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWebKit.js",
+      "keys": [
+        "bareWebKit"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareWebp.js",
       "keys": [
         "bareWebp"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebKitGtk.js",
-      "keys": [
-        "bareWebKitGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareWhich.js",
-      "keys": [
-        "bareWhich"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareWinUi.js",
-      "keys": [
-        "bareWinUi"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUtils.js",
       "keys": [
         "bareUtils"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWhich.js",
+      "keys": [
+        "bareWhich"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWebKitGtk.js",
+      "keys": [
+        "bareWebKitGtk"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
         "bareV8ToIstanbul"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWinUi.js",
+      "keys": [
+        "bareWinUi"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareXdiff.js",
       "keys": [
@@ -775,12 +775,6 @@
         "bareZlib"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWs.js",
-      "keys": [
-        "bareWs"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareZmq.js",
       "keys": [
@@ -792,6 +786,12 @@
       "keys": [
         "bareWorker"
       ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWs.js",
+      "keys": [
+        "bareWs"
+      ]
     }
   ],
   "bundleStats": {

scripts/README.md

@@ -107,6 +107,18 @@ Asserts every Tier-1 name in **`packages/bare-os-coreutils/lib/commands.mjs`** h
 
 Checks **[`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md)** lists the current **`BARE_OS_CTX_API_VERSION`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`**, and mentions **`bits5`** … **`bits10`**. Root **`pretest`**.
 
+## `verify-giant-phase-doc.mjs`
+
+**Usage:** `node scripts/verify-giant-phase-doc.mjs`
+
+Ensures **[`developer-guide/giant-phase-kernel-program.md`](../developer-guide/giant-phase-kernel-program.md)** exists and references the **100-item** program and **`giant_phase_program`** proc path. Root **`pretest`**.
+
+## `giant-phase-benchmark-harness.mjs`
+
+**Usage:** `node scripts/giant-phase-benchmark-harness.mjs [--list|--help]`
+
+Placeholder for future boot/VFS/IPC/network/crypto benchmark suites (items 91–99). **`--list`** prints planned suite names as JSON.
+
 ## `validate-example-schemas.mjs`
 
 **Usage:** `node scripts/validate-example-schemas.mjs`

scripts/giant-phase-benchmark-harness.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * Placeholder harness for giant-phase perf items (91–99).
+ * Extend with boot/VFS/IPC/network/crypto benches; `npm test` stays fast.
+ */
+import process from 'node:process'
+
+const args = process.argv.slice(2)
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`Usage: node scripts/giant-phase-benchmark-harness.mjs [--list]
+
+Planned suites (see developer-guide/giant-phase-kernel-program.md):
+  - boot + shell startup
+  - VFS routing microbench
+  - IPC / subprocess latency
+  - DNS/TCP/TLS/HTTP/WS (bare-* stacks)
+  - crypto primitives (bare-crypto class)
+`)
+  process.exit(0)
+}
+
+if (args.includes('--list')) {
+  console.log(
+    JSON.stringify(
+      {
+        schema: 1,
+        suites: [
+          'boot_shell',
+          'vfs_routing',
+          'ipc_subprocess',
+          'network_stack',
+          'crypto_primitives'
+        ],
+        note: 'Implementations land in packages/bare-os-booter/test or dedicated bench workspace.'
+      },
+      null,
+      2
+    )
+  )
+  process.exit(0)
+}
+
+console.log(
+  JSON.stringify({
+    schema: 1,
+    ok: true,
+    message: 'giant-phase-benchmark-harness: noop (use --list)'
+  })
+)

scripts/verify-giant-phase-doc.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * CI: giant-phase governance doc present and references the 100-item program.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const doc = path.join(root, 'developer-guide/giant-phase-kernel-program.md')
+const text = fs.readFileSync(doc, 'utf8')
+if (!text.includes('100-item') && !text.includes('100 items')) {
+  console.error('giant-phase-kernel-program.md should mention the 100-item program')
+  process.exit(1)
+}
+if (!text.includes('giant_phase_program')) {
+  console.error('giant-phase doc should mention giant_phase_program proc path')
+  process.exit(1)
+}
+console.log('verify-giant-phase-doc: ok')

users-manual/07-troubleshooting-and-operations.md

@@ -66,7 +66,7 @@ When debugging, ask whether the variable was set on the **host** before launchin
 
 ## CI and contributing
 
-Root **`npm test`** runs workspace tests after **`pretest`**, which builds artifacts and runs repository verifiers (kernel or seeder parity, ctx API alignment, capability contracts, documentation links, man coverage, compatibility matrix strings, Pear import rules, bare manifest smoke).
+Root **`npm test`** runs workspace tests after **`pretest`**, which builds artifacts and runs repository verifiers (kernel or seeder parity, ctx API alignment, capability contracts, documentation links, man coverage, compatibility matrix strings, giant-phase governance doc check, Pear import rules, bare manifest smoke).
 
 If **`gen:bare-catalog:check`** fails, regenerate the catalog with **`npm run gen:bare-catalog`** and commit the JSON. If **`verify-doc-links`** fails, fix broken relative **`.md`** links in the walked trees.