- Add createBareOsDiskOsBridge for Hyperdrive searchLocal + whitelisted bare_os.* execRpc; wire disk.os after initd - Expose ctx.bareOsRunSystemctlCli; route /bin/systemctl and journalctl through it (sync seeder kernel/bin) - Implement ssh-keygen passphrase envelope (bareOsKeySchema 2, PBKDF2 + ChaCha20-Poly1305); add warc and archive delegates - Extend basenc (--base32/--base64); improve hostid/users session UX - Introduce bare-os-boot-phases, bare-os-errors; CI boot-step alignment - Bump BARE_OS_CTX_API_VERSION to 1.28.0; update ctx d.ts and verifiers - Add KERNEL_CONTRACT, OTA_AND_BUNDLES, PLACEHOLDER_BASELINE; handbook disk.os + security hooks; reference docs and CHANGELOG