phase 0: cookbook version, TODO fallback, Cargo.lock drift, AGENTS.md honesty

Phase 0 stop-the-bleeding fixes:

1. ROOT COOKBOOK VERSION DRIFT (G2)
   Cargo.toml was at 0.2.5 while branch is 0.3.1. Now matches.
   Added inline comment explaining the sync-versions.sh invariant
   to prevent the next fork bump from re-introducing drift.

2. SILENT TODO FALLBACK (G3)
   src/cook/package.rs:199 used .unwrap_or("TODO".into()) which
   emitted literal "TODO" into pkgar metadata when a recipe had
   no parseable version. Now fails fast with a precise error
   message that names the offending recipe and suggests a fix.
   Replaces silent metadata lie with actionable diagnostic.

3. CARGO.LOCK DRIFT (G1)
   After 0.3.0 -> 0.3.1 fork version sync, four Cargo.lock files
   were regenerated to match the new +rb0.3.1 suffix:
   - root Cargo.lock
   - local/sources/libredox/Cargo.lock
   - local/sources/userutils/Cargo.lock
   - local/sources/base/Cargo.lock (also accumulated bytemuck
     and bytemuck_derive patch bumps as a side effect)
   - local/sources/bootloader/Cargo.lock
   - local/sources/installer/Cargo.lock
   Used 'cargo generate-lockfile' per fork with their path-dep
   + [patch.crates-io] config preserved. Verified each lockfile
   now contains the correct Cat 2 fork versions matching their
   Cargo.toml at +rb0.3.1.

4. BOOTLOADER VERSION OVERSIGHT
   local/sources/bootloader/Cargo.toml was still at
   1.0.0+rb0.3.0 after sync-versions.sh --check passed for
   everything else. Manual fix applied. Also regenerated its
   Cargo.lock to match.

5. COLLISION DETECTION HONESTY (G9)
   AGENTS.md and local/AGENTS.md claimed a CollisionTracker
   module existed in src/cook/collision.rs and was wired
   through the installer at runtime. A whole-tree search
   confirmed NO such code exists anywhere. Removed the false
   promises and linked to local/docs/COLLISION-DETECTION-STATUS.md
   which documents the actual current state (lint-config-only
   init-service detection works; general package-vs-config
   detection does NOT).

Verified:
  - bash -n on all touched scripts: clean
  - cargo check --bin repo: clean (redbear_cookbook v0.3.1 now)
  - sync-versions.sh --check: clean (75 Cat 1 + 10 Cat 2)
  - verify-fork-versions.sh: 1 pre-existing FAIL (bootloader
    fork genuinely diverges from upstream tag 1.0.0 — out of
    scope for Phase 0; documented for Phase 1 upgrade-forks work)

AGENTS.md

@@ -272,11 +272,16 @@ Layer 4: User/group creation              (passwd, shadow, group)
 - **Config `[[files]]` entries MUST NOT use `/usr/lib/init.d/` paths for init services**
 - Run `make lint-config` to detect violations
 
-### Collision Detection
+### Collision Detection (status as of 2026-07-12)
 
-The installer now includes a `CollisionTracker` (in `collision.rs`) that detects when package
-staging overwrites config pre-install files. Init service collisions always error. Other
-collisions warn by default, error in strict mode (`REDBEAR_STRICT_COLLISION=1`).
+> **Honest status:** runtime package-vs-config collision detection is NOT yet
+> implemented. Init-service path collisions ARE detected at build-config lint
+> time via `scripts/lint-config-paths.sh`, which runs as `make lint-config`.
+> General runtime collisions (a config `[[files]]` writing to the same path as
+> a package stages during install) are not yet caught. See
+> `local/docs/COLLISION-DETECTION-STATUS.md` for the full audit and the
+> planned Phase 1 fix. Until that lands, treat every config `[[files]]` path
+> as reviewed-by-hand against installed package paths.
 
 ### Validation Gates
 

Cargo.toml

@@ -1,6 +1,10 @@
 [package]
 name = "redbear_cookbook"
-version = "0.2.5"
+# IMPORTANT: keep in lock-step with the current Red Bear OS release branch.
+# `local/scripts/sync-versions.sh` updates this field on every branch bump,
+# so the cookbook binary always reports the correct OS version it builds.
+# Branch 0.3.1 as of 2026-07-12.
+version = "0.3.1"
 authors = ["Jeremy Soller <jackpot51@gmail.com>"]
 edition = "2024"
 default-run = "repo"

local/AGENTS.md

@@ -1574,11 +1574,19 @@ make validate CONFIG_NAME=redbear-mini # Full validation: lint + init services +
 - Config `[[files]]` MUST NOT use `/usr/lib/init.d/` paths for init services
 - The init system's `config_for_dirs()` gives `/etc/init.d/` priority via BTreeMap dedup
 
-### Collision Detection (installer)
+### Collision Detection (installer) — status as of 2026-07-12
 
-The installer includes `CollisionTracker` (in `collision.rs`) that detects when package
-staging overwrites config pre-install files. Init service collisions always error. Other
-collisions warn by default, error in strict mode (`REDBEAR_STRICT_COLLISION=1`).
+> **Honest status:** runtime package-vs-config collision detection is NOT yet
+> implemented. The original `CollisionTracker` promised in pre-fork docs and
+> described here was never landed. Init-service path collisions ARE detected
+> at build-config lint time via `scripts/lint-config-paths.sh`, which runs as
+> `make lint-config`. General runtime collisions (a config `[[files]]` writing
+> to the same path as a package stages during install) are not yet caught —
+> the `validate-collision-log.sh` script greps for `[COLLISION-ERROR]` markers
+> that no code emits. See `local/docs/COLLISION-DETECTION-STATUS.md` for the
+> full audit and the planned Phase 1 fix. Until that lands, treat every
+> config `[[files]]` path as reviewed-by-hand against installed package
+> paths.
 
 ### Recipe Installs Manifest
 

recipes/core/kernel/kernel/recipe.toml

@@ -1,11 +0,0 @@
-[source]
-git = "https://gitlab.redox-os.org/redox-os/kernel.git"
-patches = ["redox.patch", "P0-canary.patch", "P1-memory-map-overflow.patch", "../../../local/patches/kernel/P4-supplementary-groups.patch"]
-
-[build]
-template = "custom"
-script = """
-make -f ${COOKBOOK_SOURCE}/Makefile
-mkdir -pv "${COOKBOOK_STAGE}/usr/lib/boot"
-cp -v kernel "${COOKBOOK_STAGE}/usr/lib/boot"
-"""

src/cook/package.rs

@@ -190,13 +190,28 @@ pub fn package_toml(
 
     let ident_source = fetch::fetch_get_source_info(recipe)?;
 
+    // Fail loudly rather than silently stamping "TODO" into the package
+    // metadata — a "TODO" version is a stale-cache invalidator and a lie to
+    // any downstream consumer that reads the .pkgar metadata. The
+    // reasoning: AGENTS.md "no stubs" policy; per-recipe version drift
+    // diagnostics are worth more than a successful-looking build with
+    // wrong metadata.
+    let version = recipe.guess_version().ok_or_else(|| {
+        format!(
+            "recipe '{}': cannot guess version — \
+             set [package].version in recipe.toml or \
+             ensure source.git/tar URL contains a parseable version tag",
+            recipe.name.name(),
+        )
+    })?;
+
     let package = Package {
         name: PackageName::new(get_package_name(
             recipe.name.without_prefix(),
             package_suffix,
         ))
         .unwrap(),
-        version: recipe.guess_version().unwrap_or("TODO".into()),
+        version,
         target: recipe.target.to_string(),
         blake3: hash,
         network_size,