- Guest-safe legacy personal-root migration with state file and env gates - VFS guest deny for sensitive /.bare paths; warm-cache clear on identity switch - Optional acct/<hash>/ personal layout, guest scrub, vault exclude alignment - Shell session reset + errexit; fish history reload hook; replication metric - Audit NDJSON for migration/scrub; structured booter logging paths - Bump POSIX profile; getconf keys; syscall/socket contract + handbook/docs pass - Booter tests (Bare vs Node split for identity-session); release-checklist audit hook
- Bump BARE_OS_CTX_API_VERSION to 1.41.0; align syscalls.example, compat matrix, POSIX dashboard, and doc-contract verifier - Stock hrpc: BARE_OS_HRPC_AUDIT chain rows; BARE_OS_HRPC_EMIT_UNLISTED for bare-os:hrpc-request; document seed/hrpc boundaries in KERNEL_CONTRACT + protocol CHANGELOG - VFS: bareOsEvictWarmReadPrefixes; BARE_OS_VFS_WARM_CACHE_PREFIX_INVALIDATE + replicationLive schema 2; warm cache stats schema 2; hyperblobs gate metrics + failed-write counter - maybeMergeBareFromDrive: BARE_OS_BARE_STDLIB_RESOLVE_CONCURRENCY (parallel reads, manifest order preserved) - Word-7 proc: pear_runtime_channel.json + vfs maps/tests; host env passthrough - Coreutils: export bareAwkRun for tests; build strips export in shipped awk; nextfile smoke test; getconf _SC_PAGESIZE test; man/hawk handbook tweaks - Security/docs: vault AEAD tamper test in test.identity.js; vault threat model + users-manual; scripts/verify-doc-contracts.mjs in pretest - Fix /proc readdir golden list order for new proc node; sync seeder kernel