POSIX / synthetic syscalls

- Bump /proc/bare_os/syscalls.json to schema 7; socketMsgSurface (sendmsg/recvmsg ENOTSUP)
- POSIX profile 1.0.8; align syscalls.example.json, declared profile, compatibility matrix
- Bridged SOCK_DGRAM recv/recvfrom with bounded queue + poll/select readiness env knobs
- process_table.json schema 7; fdModel.processTableSchema and matrix/dashboard sync
- posix-conformance-matrix bareOsSyscallOps includes recvfrom

P2P / protocol / replication
- Optional Protomux bare-os-app-v1 (BARE_OS_PROTOMUX_APP_CHANNEL)
- Replication: guestReplicationPlan (BARE_OS_REPLICATION_PLAN_JSON), sync_window parallelismHint
- Blind-relay swarm protomuxBackpressure (BARE_OS_SWARM_PROTOMUX_BACKPRESSURE_COUNT)
- Remove bareOsProcBlindPeerRelayHintsStub; strict peer allowlist (BARE_OS_PEER_ALLOWLIST_STRICT)
- Kernel multisig gate before kernel.ext.d; Pear updater integrationHints + audit env docs

Tooling / tests / hygiene
- Default holepunch clone drift in pretest; document BARE_OS_HOLEPUNCH_DRIFT_CHECK=0
- Widen bare holepunch catalog overrides; Mermaid architecture in docs hub + README link
- Fix tests: corestore_snapshot proc schema 2, posixXsh schema 2, awk-engine export strip in xcu sweep
- pear-updater-bridge: shared integration hints; identity-session import order
- Handbook ch.3/7/9 + environment appendix updates; scripts README drift script behavior

kernel/lib/init/init-main.js

@@ -2449,6 +2449,66 @@ async function runKernelExtDropins(ctx, opts = {}) {
   const strictPol =
     ctx.env?.BARE_OS_BOOT_POLICY_STRICT === '1' ||
     ctx.env?.BARE_OS_BOOT_POLICY_STRICT === 'true'
+  const multisigExtGate =
+    ctx.env?.BARE_OS_EXTENSION_MULTISIG_VERIFY === '1' ||
+    ctx.env?.BARE_OS_EXTENSION_MULTISIG_VERIFY === 'true' ||
+    ctx.env?.BARE_OS_BOOT_POLICY_REQUIRE_PEAR_MULTISIG === '1' ||
+    ctx.env?.BARE_OS_BOOT_POLICY_REQUIRE_PEAR_MULTISIG === 'true'
+  if (multisigExtGate) {
+    const requireFile =
+      ctx.env?.BARE_OS_BOOT_POLICY_REQUIRE_PEAR_MULTISIG === '1' ||
+      ctx.env?.BARE_OS_BOOT_POLICY_REQUIRE_PEAR_MULTISIG === 'true'
+    try {
+      const mbuf = await drive.get('/etc/bare-os/pear.multisig.json')
+      if (!mbuf || mbuf.byteLength === 0) {
+        if (strictPol && requireFile) {
+          bootStructuredLog(
+            ctx,
+            'error',
+            'kernelExt.multisigMissing',
+            '[kernel.ext.d] strict boot requires /etc/bare-os/pear.multisig.json (BARE_OS_BOOT_POLICY_REQUIRE_PEAR_MULTISIG)'
+          )
+          if (typeof ctx.bareOsRequestBooterExit === 'function')
+            ctx.bareOsRequestBooterExit(1)
+          return false
+        }
+      } else {
+        const mj = JSON.parse(ctx.b4a.toString(mbuf))
+        const signers = mj && mj.signers
+        const quorum = mj && mj.quorum
+        const badShape =
+          !Array.isArray(signers) ||
+          typeof quorum !== 'number' ||
+          quorum < 1 ||
+          quorum > signers.length
+        if (badShape) {
+          bootStructuredLog(
+            ctx,
+            'error',
+            'kernelExt.multisigInvalid',
+            '[kernel.ext.d] pear.multisig.json must be { signers: string[], quorum: number } with 1 ≤ quorum ≤ signers.length'
+          )
+          if (strictPol) {
+            if (typeof ctx.bareOsRequestBooterExit === 'function')
+              ctx.bareOsRequestBooterExit(1)
+            return false
+          }
+        }
+      }
+    } catch (e) {
+      bootStructuredLog(
+        ctx,
+        'warn',
+        'kernelExt.multisigRead',
+        '[kernel.ext.d] pear.multisig.json: ' + ((e && e.message) || String(e))
+      )
+      if (strictPol && requireFile) {
+        if (typeof ctx.bareOsRequestBooterExit === 'function')
+          ctx.bareOsRequestBooterExit(1)
+        return false
+      }
+    }
+  }
   const maxDepthRaw = String(
     ctx.env?.BARE_OS_BOOT_POLICY_MAX_KERNEL_EXT_DEPTH || ''
   ).trim()