ADR 0001: Kernel subsystem boundaries (booter vs image)

Status: Accepted
Date: 2026-04-04
Context: The booter (packages/bare-os-booter) grew a large index.js while also owning VFS, swarm, IPC, identity, and ctx construction. Contributors need a stable mental model for where new code belongs.
Decision:
1. Treat boot (peer wait, MBR, replication, kernel bytes load, teardown ordering) as distinct from executeKernel (ctx assembly + REPL + initd).
2. Centralize stock kernel capability word construction and seed strict rows in bare-os-capability-registry.js.
3. Centralize network/offline kernel loading (seed RPC wave, MBR iteration) in bare-os-kernel-loader.js.
4. Centralize Pear-safe teardown (HDMS → swarm → drives → store) in bare-os-lifecycle-manager.js.
5. Document the full subsystem map in docs/architecture/kernel-subsystems.md.
Consequences:
- index.js remains the orchestration root but delegates loader/capability/teardown modules.
- Future refactors should move executeKernel into a dedicated module when ready, without changing public ctx contracts.
- ADRs for larger changes should cross-link this boundary map.