[boburning]

Summary

Implements NET-02 from the authoritative v3 program on top of merged NET-01 (#481).

• adds one schema-validated transfer policy for Roms, BIOS, Artwork, Screenshots, Themes, and read-only Saves
• denies private roots, traversal, symlink boundaries, unsafe components, and writes outside the five canonical write roots
• confines SFTP to policy-derived mounts, provisions only missing public write roots, and requires explicit SFTP fsync before same-filesystem atomic publication
• preserves the prior final on ordinary CLOSE/cancel and abrupt transport loss, hides internal chroot/staging entries, and enforces the canonical 4 GiB bound
• treats Wi-Fi carrier without a global IPv4 address as acquiring_address, not usable association
• repairs carrier-only state by restarting only the fixed inherited DHCP client and reconciling services from one detached, bounded, stale-lock-recovering watcher
• makes a self-restored network overlay close rollback after exact prior-state verification instead of replaying optional services
• reconciles a terminal failed rollback only after the live network, service, and listener baseline matches its saved prior state twice; the failed record is preserved before the lease is closed
• runs complete shell integration tests in eight isolated read-only shards after fail-fast manifest, provenance, transfer-policy, and dependency-inventory gates
• parallelizes native, ASan, and cppcheck work on the hosted runner; pull-request and integration cppcheck retain affected/full source coverage and whole-program analysis with one bounded preprocessor configuration; native, ASan, and ARM compile the real configurations
• integrates policy, server, helpers, deployment, inventory, dependency totals, provenance, payload, documentation, tests, and the v3 ledger

Dependency and issue links

Base: main at 9f339e90a773a288014bd5612fcb8bcc23790641 (merged NET-01, #481). This PR is not stacked on an unmerged branch.

Closes #482. Parent program: #434.

Validation

• complete pinned shell gate: 643/643 passed from immutable read-only repository mounts in 244.50 seconds on the Windows/WSL development path; the preceding 641-test measurement passed in 240.96 seconds
• exact current-head local shell gate: 643/643 passed in 243.86 seconds, including fail-fast manifest, file-backed provenance, transfer policy, and exact dependency inventory before the eight disposable shards
• exact current-head local native gate: 441/441 passed in 59.56 seconds with parallel compilation; exact ASan gate: 441/441 passed in 64.11 seconds
• exact current-head Makefile-routed exhaustive cppcheck: 130.16 seconds with 172/975 active checkers and whole-program unusedFunction findings preserved; focused two-component mode completed in 9.93 seconds
• exact current-head hosted PR Test build 33072463105 passed in 5m23s total, down from 25m16s (78.7%); full-source bounded cppcheck passed in 96 seconds instead of about 20m52s (92.3% reduction), native in 85 seconds, and ASan in 100 seconds
• hosted native plus ASan unit-test gates completed in 185 seconds (3m05s) while retaining all 441 tests in each configuration; the under-five-minute unit-test target is met with 1m55s margin
• exact current-head hosted shell job 33072463127 passed in 2m11s and docs job 33072463131 passed in 1m59s
• exact current-head ARM check build 33072463122 passed in 7m36s total
• exact-head exhaustive dispatch 33072577489 passed in 21m33s total: full-source default configuration cppcheck 17m06s, native 87 seconds, and ASan 91 seconds
• protected signed Hardware test build 33072126375 was cancelled before artifact publication when its head became superseded; replacement build 33074138754 passed in 8m47s for exact current head 0b5c70687744d2c96882c74cf8857b138336012a
• exact-head signed archive BloomOS-v0.1.0-dev-0b5c7068.zip: 203,244,149 bytes, SHA-256 f5846fccadd55aaa505de39e976033df86e94475a6e9410a0da31bd6f99b4c52; manifest SHA-256 04c152b23cbe249cd09af707957acc5e5521795ffd3d82eb910ce973aa1731c1; signature SHA-256 74fc5193cf1898919f4f5b31f50d58616017f0b0f316379ecfb7c3afb3c9fb42; payload-manifest SHA-256 7b79dd0c1e3961bab72bc685bea58c3988da998258fe75f9d8a3e040a092a0b5; build-info SHA-256 c8278881e78f043eacbbdfdc35d4e5830ec8da9803ece0199095a4c68af4073e; ZIP CRC, release metadata, exact commit, and repository Ed25519 signature verification passed
• exact-head GitHub shell job 33067929402 passed in 1m39s total; its preflight plus 643-test step completed in about 69 seconds
• exact parallel inventory enforcement rejects duplicate/suffix-overlapping names and requires 643 observed passes; temporary containers are bounded to eight, uniquely named, and --rm
• provenance/inventory/transfer preflight runs before Bats; full file-backed provenance is required when the source closure is present, while an intentionally partial CI checkout may defer only paths beneath declared uninitialized submodules
• focused network transaction gate: 15/15 passed, including exact restored-baseline reconciliation and refusal when the baseline differs; focused Wi-Fi gate: 10/10 passed
• the GitHub-only watcher-cleanup assertion race was corrected with a bounded wait and the focused Wi-Fi suite passed 10/10 consecutive reruns
• dependency lock, legacy manifest, provenance, and FAT payload gate: 31/31 passed
• legacy manifest at the prior head: 330 components; exact dependency aggregate: 314,628,396 bytes; superseded by the 6f3ce2b9 corrective totals below
• POSIX syntax, JSON parsing, evidence byte/hash identity, diff check, risk scope (risk 3, full), and changed-diff private-secret scan: passed
• prior-head bloom-network-transaction: 25,255 bytes, SHA-256 3ab5a21a9d02856ccc0e9820153a8b0fe8bd1147e934bcfc5333b1b4203d927e; superseded by the 6f3ce2b9 identity below
• both OpenSSH patches apply to the pinned source; the corrective SFTP artifact remains stripped static ARM EABI5, 562,156 bytes, SHA-256 ade73040dfe42ba72650d67841e9a9e8d8398f6cec4e3ea558d43ba9e62676ae
• native SFTP protocol probe passed explicit-fsync publication, cancel preservation, Saves/private denial, hidden scaffolding, and zero-residue gates
• previous protected Hardware test build 33039305266 signed prior head 6904df1a35e513307e7c0d709841eda7f13c0630; it is superseded for current-head release purposes by 0b5c70687744d2c96882c74cf8857b138336012a and will not be deployed; the 203,245,224-byte archive has SHA-256 bcf050f908c351958d0737bc9e6c1acd2b341e99c9bb1cf9a4e8670bbddc15a3, manifest SHA-256 eee41dcf13cc8b9b75e9a3b869ace72a84150c2379c23e52edfde813fba8793d, and signature SHA-256 8071d437384476c3004cf98aca5f322503aa4f09549c7717ee4714a1bc6b81bc; repository-key verification and release metadata validation passed

Signed attempts and recovery

Four signed Full candidates were rejected and never confirmed:

• aff110ba73eca83dfd52d18afd26b316caa9e7fd, workflow 32969798436
• ef9dbec54f0faffc0efd2eaf6cac1009957bb307, workflow 33025501252; archive 203,232,278 bytes, SHA-256 6d4e5628a0ebf76772c7bb81fd92ee035f809ab8404505794d72fd88f94fe417
• 0b5c70687744d2c96882c74cf8857b138336012a, workflow 33074138754; archive 203,244,149 bytes, SHA-256 f5846fccadd55aaa505de39e976033df86e94475a6e9410a0da31bd6f99b4c52
• 6f3ce2b9aab0c9a40ee455e0b77249d42dad71c2, workflow 33095435808; archive 203,245,885 bytes, SHA-256 334029833ba040647b95531e971df533bb95ebeedcb0c491a87d5db4dfa502ec

The second candidate reached Bloom Shell twice and reported Wi-Fi carrier, but wlan0 had no global IPv4 address or usable LAN route, key-only SSH did not return, and the UI request path appeared unresponsive. Bloom automatically rolled back to retained known-good b073b423 (recovered_from=0.1.0-dev-ef9dbec5).

This disproved the earlier carrier-only correction. The reviewed source and retained state show two faults: carrier was accepted as network readiness, and a bounded carrier wait ran synchronously without repairing DHCP. Commit 354cb7fb requires carrier plus global IPv4, restarts the fixed udhcpc -i wlan0 -s /etc/init.d/udhcpc.script path when needed, and moves post-address service reconciliation to one detached 60-second watcher.

A guarded one-file Warm attempt was also not accepted as a deployment: the legacy activator self-restored the exact installed bloom-wifi bytes, but the installed legacy transaction helper replayed saved optional-service preferences and ended rollback_failed before delayed DHCP recovery completed. The overlay is absent. Fresh inspection found the public transaction state marked its lease inactive while the separately validated lease file remained armed. The source now verifies an already-restored overlay before replay and can reconcile this terminal mismatch only after the exact saved baseline is observed twice; it preserves the failed state as last.json before closing the lease.

Machine-readable evidence: docs/validation/network/plus-net02-signed-recovery-20260826.json.

Current Mini Plus evidence

Rejected signed candidate v0.1.0-dev-6f3ce2b9 was never confirmed and has now automatically rolled back. The recovered installed image is retained known-good v0.1.0-dev-b073b423; bloomctl update confirm promoted only that recovered image and records phase=known_good with recovered_from=0.1.0-dev-6f3ce2b9. The session manager is IDLE, Wi-Fi is associated with 192.168.1.180/24 and a default route, key-only SSH is available, and the listener audit is clean.

Commit 12146089 and its signed archive are quarantined: they were host/CI/signature verified but were never installed and will not be installed. The repeated failure is now treated as a two-part safety defect: the shell displayed saved desired state instead of live association, and disable could reconcile remote services before proving the backend mutation.## Corrective validation at 6f3ce2b9

• complete shell integration gate: 646/646 passed in 4m15.544s; manifest, provenance, transfer-policy, and exact dependency-inventory checks ran once before eight disposable --rm shards
• native gate: 441/441 passed in 56.67s; ASan gate with leak/error halting: 441/441 passed in 59.21s; combined native plus ASan wall time was 1m55.88s
• focused shell safety gates passed: 16/16 transaction, 12/12 network, and 12/12 Wi-Fi tests; the combined focused run was 40/40
• exact dependency aggregate: 330 components, 2,129 files, 314,630,246 bytes
• bloom-network: 6,282 bytes, SHA-256 d7256dd1a96a10169787bb5958eb7c6a9ecc12a3b3cfca0bc3f7e08b7b2496fe
• bloom-network-transaction: 25,714 bytes, SHA-256 9b1beba21b704cd583544a87dbcfc5cde46b808678886e8685460377b08d6b78
• bloom-wifi: 8,951 bytes, SHA-256 774897e1d6d081c40236e9a292b0e76813bead3c7d4581b75516fa354be56541
• disable ordering is now settings → services → backend, avoiding loss of the transport before inherited service reconciliation; enable remains settings → backend → compatibility → services
• same-value canonical settings mutations now retry failed Onion materialization instead of falsely reporting success; tests verify unchanged generation and repaired derived state
• DHCP recovery uses three total fixed-client launches at bounded attempts and safely stops only an owned live watcher before radio teardown
• network-overlay rollback waits for bounded post-overlay DHCP convergence before replaying prior state, then verifies a single restore for up to 60 seconds

Mini Plus corrective evidence

Signed candidate v0.1.0-dev-0b5c7068 was rejected and automatically rolled back to retained known-good v0.1.0-dev-b073b423; it was never confirmed. Update state now reports known_good, recovered_from=0.1.0-dev-0b5c7068.

A guarded compatible Warm overlay then exercised the corrected network stack without replacing the signed installed version. Physical input turned Wi-Fi from On to Off, and the maintainer pressed A to restore it to On. This confirms the physical toggle path and recovery, but promptness was not observed continuously and is not claimed as a latency pass. The overlay watchdog removed the candidate, the exact prior network state was reconciled to rolled_back, and all temporary bootstrap helpers were restored byte-for-byte to their signed b073b423 hashes.

Fresh strict key-only inspection after cleanup confirmed known-good b073b423, Wi-Fi associated, SSH running key-only, SFTP and Samba off, listener audit clean, no active session, no active overlay, canonical generation 129, transaction tx-2500-3216 terminal rolled_back, and recovery lease inactive. This is Mini Plus remote evidence plus the stated physical control observation; it does not certify Mini V1-V4 or Mini Flip/my285.

Exact corrective validation at 12146089

• commit e6399217 bounds Bloom Shell network requests to five seconds, terminates the owned request process group, reloads the canonical preference after partial apply, and safely escalates only a re-verified owned Wi-Fi watcher from TERM to KILL
• focused pinned Wi-Fi backend gate: 13/13 passed, including a TERM-ignoring watcher; native: 442/442 passed; ASan: 442/442 passed; manifest, dependency inventory, POSIX syntax, and diff checks passed
• exact dependency aggregate: 330 components, 2,129 files, 314,630,696 bytes
• PR Test build 33101167841 passed: native plus ASan job 4m16s, and separately parallelized affected/full-source cppcheck 1m42s; shell 33101167905 passed in 2m01s, docs 33101167852 in 2m15s, formatting 33101167860 in 4m02s, and ARM 33101167881 in 7m50s
• exhaustive dispatch 33101698289 passed in 13m55s with full native 442/442, full ASan 442/442, and full-configuration whole-program cppcheck; this is down from the prior 21m33s exhaustive run without weakening the exhaustive gate
• protected Hardware test build 33101895295 passed in 9m29s for exact commit 121460894290402eb0154631c3c4915cc6eda180
• signed archive BloomOS-v0.1.0-dev-12146089.zip: 203,250,500 bytes, SHA-256 7a9627b2a4cc4ee2fc9bfc9e48ca7616678d3455b58d3fdee69611e0d26fbacf; manifest SHA-256 523c065ee30ddb385439c73d5d2fa1e1caf78015f70c13033d70247bbfaacd7d; signature SHA-256 ffddc09253c8c1b00313a85d0217e3b1f59eaec6a9acde7f910afa69792d14b2; payload-manifest SHA-256 b80a1d3c9e3847e4f77c8dc95c634f1c3dc13954cc0ff438cccee3e304c452ee; build-info SHA-256 f27385779b8f6585c82a09ec796cbcd911d72af65b9dc081e0b5ed38cb568000
• repository Ed25519 signature, release metadata, exact commit/channel/device list, archive CRC, and reconstructed payload manifest passed; nested bloom-network SHA-256 d7256dd1a96a10169787bb5958eb7c6a9ecc12a3b3cfca0bc3f7e08b7b2496fe and bloom-wifi SHA-256 b2cdcf8118d7986392dc5778f2fb2f91f7272070edbc1d294acf83c781f90bfc match reviewed source byte-for-byte; signed bloom-shell is 350,772 bytes with SHA-256 bfa1dccfa75b36f9d5c9719b4ce4af9ac3eb8230b973fac8b5185aa9712c42a5
• this artifact is verified but not yet installed; recovery of the rejected candidate and a real signed Off/On promptness gate remain required

Exact rollback-safety correction at 00c1f1e0

• Wi-Fi preference mutation now verifies the backend before changing settings, snapshots the prior preference, applies settings -> backend -> compatibility -> services, and restores the prior preference/backend/services on any failed stage.
• backend failure can no longer stop SSH-facing services first; explicit terminal states distinguish a successful rollback from rollback failure.
• Bloom Shell joins runtime bloom-network status and displays On / Connected, On / No connection, or Off; malformed/unavailable status clears stale connectivity instead of retaining a prior Connected claim.
• focused network and Wi-Fi suites passed 28/28 in 11.7 seconds; dependency lock passed 10/10, provenance policy 5/5, legacy manifest 13/13, FAT payload validation, CI-scope policy, POSIX syntax, formatting, and diff checks passed.
• exact dependency aggregate is 330 components, 2,129 files, 314,631,721 bytes.
• current-head hosted native, ASan, static analysis, shell, format, docs, and ARM checks are in progress. No current-head signed archive has been installed or activated.

Atomic Warm bundle correction at ac9c0cdf

A sealed two-file Warm slot for bloom-network and bloom-wifi was intentionally not confirmed: independent confirmation reported the station unhealthy. The live radio and IPv4 route were actually healthy; the candidate bloom-network had been paired with the older b073b423 platform/settings/service contracts and therefore reported platform_unavailable. The guard rolled the slot back and restored both installed helper hashes exactly. The older known-good service helper then failed while reconciling SFTP=false and left a stale derived SSH state; a fresh strict connection and listener audit proved key-only port 22 remained active, the captured prior booleans were restored, and the exact current 25,714-byte transaction helper (9b1beba21b704cd583544a87dbcfc5cde46b808678886e8685460377b08d6b78) was used once from /tmp to reconcile the terminal record before being removed.

• host and device manifest validation now require the complete 16-file settings/platform/Wi-Fi/service/transaction/remote-key/SFTP/transfer-policy authority as one atomic network-helpers bundle
• partial bundles are rejected before device transfer or activation; mixed contract generations can no longer be sealed
• focused device deployment 16/16, transfer policy 5/5, and host device harness 26/26 passed in parallel; dependency lock 10/10, provenance 5/5, legacy manifest 13/13, FAT payload, CI-scope, syntax, and diff gates passed
• exact dependency aggregate is 330 components, 2,129 files, 314,632,109 bytes
• prior-head hardware workflow 33107651037 passed for d74fea5e, but that artifact lacks this guard, is superseded, and will not be installed
• post-recovery state is exact known-good b073b423, IDLE session, associated IPv4/default route, key-only SSH running, SFTP/Samba off, clean listener audit, no active overlay, and transaction/lease terminal inactive

Limitations and merge state

• This PR remains draft. Exact-head 72ec7069 hosted CI, exhaustive dispatch, and protected signing are green; the guarded complete-bundle Mini Plus Off/On automatic-restore gate remains pending. No partial or Full candidate will be installed before recovery evidence is captured.
• main currently has no branch protection or merge queue, so merge_group cannot be treated as an enforceable gate. The same Test build workflow exposes workflow_dispatch; an exact-head exhaustive dispatch is required before this PR leaves draft or merges.
• Retained known-good b073b423 is installed and confirmed. Rejected 6f3ce2b9 and quarantined 12146089 will not be reactivated.
• The maintainer physically observed that shutdown during the update/recovery loop required holding the power button until power-off. Idle Bloom Shell has not reproduced that behavior; update-loop power ownership still needs a focused physical retest.
• Current hardware evidence is remote Mini Plus evidence plus the isolated ash fixture. It does not certify physical LCD, audio, gameplay/save semantics, Mini V1-V4, or Mini Flip/my285.
• No ROM, BIOS, save content, credentials, private keys, unrestricted logs, or framebuffer data are included in the repository.

Storage hygiene

Reused one D:-based implementation worktree and one bounded D:-based task workspace. Temporary containers used --rm; no C:-based clone, persistent WSL clone, named Docker volume, or broad prune was created. C: remained above the 60 GiB gate. Signed artifacts and privacy-bounded validation evidence remain retained outside the repository.

Coherent signed overlay and timed-disable result at 7758e362

• exact-head ac9c0cdf exhaustive workflow 33109591129 passed; native plus ASan completed in 3m22s, while the full-source cppcheck configuration expansion took about 16m46s
• exact-head protected hardware workflow 33109591160 passed; the 203,256,219-byte signed archive has SHA-256 6b6b6ee8b9ad13badfc783dc20123169e66fb7fcc51503699dc4dfc27241e4d4, and its manifest signature and release metadata validated
• the complete signed 16-file ac9c0cdf network bundle was sealed, size/hash-verified file by file, activated through a rollback-timed transaction, and confirmed through a fresh independent key-only SSH connection
• post-activation evidence showed associated Wi-Fi, key-only SSH, SFTP/Samba off, a clean listener audit, healthy aggregate status, and all 16 live hashes matching the signed bundle
• an isolated device-local backend-failure fixture returned backend_failed_rolled_back and proved the live network, service, and listener snapshots remained unchanged
• the real timed wifi-disable gate dropped the network path as expected, but the single restore attempt did not re-associate within 234 seconds; this is a failed device gate, not a pass. No reboot, update, or further remote mutation was attempted.
• aec6bd35 replaces the single restore with four fresh 45-second recovery windows and keeps the recovery lease honestly armed on exhaustion. Focused transaction tests pass 19/19 and the combined network/deployer regression set passes 76/76.
• 7758e362 bounds full-source workflow-dispatch and merge-group cppcheck to one preprocessor configuration while retaining the complete source closure and whole-program checks. Native, ASan, and ARM remain the real-configuration compiler gates.
• exact-head exhaustive workflow 33112793021 passed: full-source cppcheck completed in 1m45s total (73s analysis), and native plus ASan completed in 3m26s total.
• exact-head protected hardware workflow 33112794960 passed; the 203,241,168-byte signed archive has SHA-256 da5fc0fbf9f821d8f84ccbb0564e7f3b4f09b0523572d1f4172d5f88311873f0, its signature/metadata validate, and the corrected 25,974-byte transaction helper has SHA-256 1be01393fae5c2a8b68d785d20ea968d424dae10c793cb003f81d2be9ef4f5a9.
• the physical device still needs one local Wi-Fi enable action before failed-state evidence can be collected and the retry correction can be deployed. Hardware evidence above is for parent ac9c0cdf; the retry correction is not yet hardware-validated.

PR #483 remains draft and must not merge until the corrected rollback path passes the same real disable/automatic-restore gate.

Boot-interruption recovery correction at 72ec7069

The failed real Wi-Fi-disable gate exposed a second safety gap beyond the single restore attempt: an interrupted or failed detached watchdog could leave the persisted Wi-Fi-off preference as the next boot baseline. Reboot then followed that preference, so ordinary boot networking could not recover the sole SSH path and repeated signed-update recovery boots could follow.

• bloom-network-transaction boot-recover now accepts only a validated matching transaction/recovery-lease pair, removes only its own empty non-symlink stale lock, and invokes the same bounded prior-state rollback for armed armed, applying, applied, rolling_back, or rollback_failed phases
• runtime invokes boot recovery after canonical settings load and before ordinary networking; incomplete, mismatched, unsafe, or non-empty state fails closed
• the guarded network-helpers authority is now an exact 17-file bundle that includes the cooperating boot runtime, preventing mixed transaction/runtime generations
• focused transaction/network/Wi-Fi/deployer/updater/settings validation passed 90/90
• the complete shell gate passed 657/657 across eight disposable read-only shards; legacy manifest, file-backed provenance, transfer policy, and exact dependency inventory ran once before sharding
• exact dependency aggregate is 330 components, 2,129 files, 314,634,522 bytes; POSIX syntax, FAT payload, CI scope, and diff checks passed
• the previous 7758e362 signed artifact is superseded for deployment by this correction. No 72ec7069 artifact has been staged or activated. The existing Mini Plus recovery remains in progress and strict key-only SSH has not yet returned.

The retry and boot-interruption corrections are not yet hardware-validated. PR #483 remains draft and must not merge until the corrected rollback path passes the real automatic-restore gate without another recovery loop.

Exact-head CI and signed artifact

• all ordinary PR checks are green at 72ec706926a1276e1650ecacf1eee633ade96b0b; the hosted Test build rerun passed in 3m24s, including static analysis in 1m58s, shell in 1m58s, docs in 1m57s, formatting in 44s, and ARM in 8m26s
• exhaustive workflow 33118211692 passed at the exact head: native 64s, ASan 75s, and full-source whole-program cppcheck 96s; every unit/static-analysis target remains below five minutes
• protected Hardware test build 33118213384 passed for the exact head
• signed archive BloomOS-v0.1.0-dev-72ec7069.zip: 203,248,718 bytes, SHA-256 02a29bf9909315d415a8ddf8054f8c8ec759a381d701381d72f1db432beeb5f2; manifest SHA-256 00dfe2b264b1562d4567f543be7c9a130d3cdf3a0f9e3df2183036a9697131ce; signature SHA-256 fadcf5b836d28635f974a6cdf0cec40c0d2299e7d6518b2cdaf6b59b98496e19; payload manifest SHA-256 6f4b1f6028408cc36c72bc31cfe9de502585e0ec512e4e520c6726f4e097ee56; build-info SHA-256 1aabf9fbd45357d4ec204021c12131523361eb16a1c3618c4c33c3d11cac56c3
• release metadata reconstruction, ZIP CRC, exact commit/channel/device list, SHA256SUMS, and repository Ed25519 signature verification passed
• nested signed helpers match reviewed source byte-for-byte: bloom-network-transaction SHA-256 cc3136b199064b3fcad581d6185caa5009a91f7928341e34392aa0ae1f0768b3; bloom-dev-deploy SHA-256 9fa077ae0083420b81cb7527bc994142e3c70509309a44f48400c12e7b2002ed; runtime.sh SHA-256 968fb7d1b4b6294aa127dfd2534f1b4f3a177ba52e53e778441732e72127e878
• this artifact is retained on D: and has not been staged, activated, or installed; the Mini Plus still times out at the network layer, so no blind mutation was attempted

Offline recovery evidence on 2026-08-27

The failed real Wi-Fi-disable state was preserved from the powered-off Mini Plus before any repair. It proves the same stale desired/live split observed physically:

• Bloom Shell displayed Wi-Fi On, while the device had no ARP, ICMP, or SSH path
• canonical settings generation 134 stored device.wifi_enabled=false, but the Onion compatibility snapshot stored wifi=1
• the saved transaction prior state required wifi_enabled=true
• transaction tx-5415-933 was rollback_failed with restore_failed; its state record said the recovery lease was inactive while the separate matching lease file remained armed
• confirmed 16-file overlay net02-network-full-ac9c0cdf remained active; update state remained known-good v0.1.0-dev-b073b423, recovered from rejected 6f3ce2b9
• the card entered Windows dirty after the physical shutdown, but two complete FAT32 checks found no filesystem errors; chkdsk /F cleared the dirty flag and the final volume state was Healthy/OK
• 53 transaction/settings/update/overlay/live-helper files totaling 1,774,272 bytes were copied to D: and verified byte-for-byte before repair; credentials, ROMs, BIOS, saves, and unrestricted logs were excluded
• offline recovery changed only canonical settings generation 134 -> 135 and device.wifi_enabled false -> true; every other semantic setting, transaction file, overlay pointer, and update record remained unchanged
• recovered settings are 2,851 bytes with SHA-256 579e04766ea6f5b3710c3fb71b6b1cd5445dffae89e3aa944985ca7a9e6ea73c; the FAT32 volume passed again and was safely ejected

No 72ec7069 candidate was staged or activated during offline recovery. One clean boot, strict evidence capture, and live-state reconciliation are required before any further deployment or Wi-Fi mutation.

Comprehensive offline rollback on 2026-08-27

The first offline settings-only repair was insufficient. On the next boot, runtime copied the current device-specific Onion profile 5E649300ABEA.json with wifi=0 into the boot settings path and canonical settings returned to generation 136 with Wi-Fi disabled. Bloom Shell then displayed Off and a physical A press produced no network recovery within one minute. No further toggles or reboot loop were requested.

A second powered-off, evidence-first recovery completely removed the active NET-02 development overlay and restored the verified signed baseline:

• preserved 58 pre-recovery files totaling 1,782,720 bytes, plus the signed known-good verification records, before mutation
• verified the retained known-good v0.1.0-dev-b073b423 archive at 203,221,654 bytes with SHA-256 6ab66f264f86f1b312440b7768a772e0905bf53a27e048f8e33e3b3738786494; repository Ed25519 verification passed
• verified all 14 signed overlay backups byte-for-byte against that archive; the fifteenth backup, config/transfer-policy.json, matched the reviewed repository file at SHA-256 68563c3202ce397ddaa90dffa36668e6a23adf162c694374fe3f2e74eb7e2c26
• verified untouched live runtime.sh and bloom-dev-deploy against the signed known-good archive
• restored all 15 backed-up files with zero hash mismatches, removed only the overlay-created bloom-transfer-policy binary and active pointer, and retained the complete sealed deployment slot, payload, backups, missing marker, manifest, and seal
• changed canonical generation 136 -> 137, canonical and derived Wi-Fi state to enabled, and only the verified current Mini Plus profile 5E649300ABEA.json from wifi=0 to wifi=1; three unrelated device profiles remained byte-for-byte unchanged
• retained failed transaction tx-5415-933 and its armed lease for later read-only diagnosis rather than falsifying terminal evidence
• captured 19 post-recovery files totaling 766,473 bytes; chkdsk I: /F found no problems, and final FAT32 state was Healthy/OK and NOT Dirty
• final settings SHA-256 is 58e3e115631e12f2577b073276d587a5614db3f602090b7d90d3c969c4b75b30; final current-device profile SHA-256 is 7dd5fba35f575ed70a9ed21158eb16e7dc32841e3b9146a724edb66687f825f9

The card was safely ejected. No 72ec7069 artifact was staged or activated. The next boot is observation-only; no further NET-02 deployment or disruptive Wi-Fi test will occur until the known-good baseline is captured and the current code proves unattended watchdog rollback, boot recovery, and independent confirmation without requiring physical recovery.

Per-device boot recovery persistence at 5017d2ef

Offline evidence proved that restoring canonical/root Wi-Fi state alone is not durable on this runtime: a later boot copies .tmp_update/config/system/<device-serial>.json into system.json. If that profile still contains wifi=0, it can re-disable networking after the recovery lease has already closed.

Commit 5017d2ef9e863df9f3593e2aebf39fc04f6efda5 captures boot-recover output and, only when it reports an actual restored transaction, immediately saves the restored root settings to the current per-device profile before ordinary networking starts. No-op recovery does not rewrite the profile. Recovery failure and profile-persistence failure remain explicit logged failures.

Validation:

• focused transaction/runtime gate: 23/23 passed
• complete optimized shell gate: 658/658 passed across eight disposable read-only shards; manifest, provenance, transfer policy, and exact dependency inventory ran once before sharding
• v3 ledger consumers: 26/26 passed in one network-disabled named --rm container
• exact dependency aggregate: 330 components, 2,129 files, 314,635,220 bytes
• POSIX syntax, JSON parsing, legacy manifest, full development provenance, diff, and storage gates passed

The branch was pushed to the existing draft PR #483. No device candidate was staged or activated. The real automatic-restore device gate remains required, and it will not be repeated until the known-good post-recovery baseline is captured and the unattended recovery path can be exercised without another physical recovery loop.

Durable ordinary Wi-Fi preference projection at 6f83b9b1

The same offline evidence exposed a second recurrence path: compatibility reconciliation intentionally imports the current per-device Onion profile even after Bloom authority cutover. Therefore a successful ordinary Bloom Shell Wi-Fi enable could still be reverted by a later unclean power loss if only canonical system.json changed and the serial-specific profile retained wifi=0.

Commit 6f83b9b1 closes that path in the existing network authority:

• after a successful preference/backend/compatibility/service transaction, copy canonical system.json to a same-directory temporary file and atomically replace only .tmp_update/config/system/<validated-12-hex-serial>.json
• perform the same projection after a successful rollback to the prior preference
• reject missing or symlinked source/profile roots, non-executable identity readers, malformed serials, symlinked targets, and pre-existing temporary paths
• on projection failure, roll the canonical preference, backend, compatibility layer, and services back; report rollback failure honestly if safe profile persistence cannot be proven
• never touch another device profile

Validation:

• focused network gate: 16/16 passed, including enable/disable projection and a symlink target that remains untouched while state rolls back
• focused transaction/runtime gate: 23/23 passed
• complete optimized shell gate: 659/659 passed across eight disposable read-only shards after one manifest/provenance/transfer/dependency preflight
• exact dependency aggregate: 330 components, 2,129 files, 314,636,496 bytes
• POSIX syntax, JSON, manifest, full development provenance, diff, and storage gates passed

No device candidate was staged or activated. PR #483 remains draft and the physical automatic-restore gate remains pending.

Exact-head persistence corrections and signed artifact at 6f83b9b1

The second offline recovery showed that both boot recovery and an ordinary successful Wi-Fi preference change must persist to the validated current-device profile; otherwise a later boot or unclean power loss can re-import stale wifi=0 state. Commits 5017d2ef and 6f83b9b1 close those two recurrence paths while failing closed on unsafe paths, symlinks, malformed device identity, or an unprovable rollback.

• focused transaction/runtime gate: 23/23 passed; focused network gate: 16/16 passed, including isolated current-profile projection and symlink-target refusal
• complete optimized shell gate: 659/659 passed across eight disposable read-only shards after one manifest/provenance/transfer/dependency preflight
• v3 ledger consumers: 26/26 passed; POSIX syntax, JSON, legacy manifest, full development provenance, FAT payload, and diff gates passed
• exact dependency aggregate: 330 components, 2,129 files, 314,636,496 bytes
• all ordinary exact-head checks are green: shell 2m02s, static analysis 2m07s, native plus ASan job 3m42s, ARM 7m40s, docs 1m27s, and formatting 42s
• exact-head exhaustive workflow 33130453001 passed in 3m52s; whole-source cppcheck completed in 1m59s, with full native and ASan gates green
• protected Hardware test build 33130454476 passed in 9m07s for exact commit 6f83b9b1788e9f8685b62704de4bfa70c33d54d5
• signed archive BloomOS-v0.1.0-dev-6f83b9b1.zip: 203,246,348 bytes, SHA-256 0a002612f1f9fd9b0060172d86449f8aea8769420039f1510ddb23c95e0e00c8; manifest 74e9871c01a772f1cc8ed2b661faaee9a5064c939875040a1bb34a37fa188d74; signature 4a9bac66233977539c17ab6956cb671150fb5e2776afb91dff1532d9a7ad175b; payload manifest 090f1490ab502376631371aab3403639abb3eaadbc30746e9dd7d805fe52bfd8; build info a6449c90f54ee24d9bc9abc6c3374f8e789154e9e30b1151a02df553555de003
• repository metadata reconstruction, SHA256SUMS, every-member ZIP CRC, exact commit/channel/device scope, dependency-lock digest, and Ed25519 signature verification passed
• affected signed files match the reviewed Git tree: bloom-network d08b2782b35b3623be3429a02ed52baf2d08fa3e1e4740ea09b3629996746f50; transaction helper cc3136b199064b3fcad581d6185caa5009a91f7928341e34392aa0ae1f0768b3; service helper 922c3a7118cba2b525df842fb15891e718af1ad2e216161a026123079a68fdfe; deployer 9fa077ae0083420b81cb7527bc994142e3c70509309a44f48400c12e7b2002ed; runtime 791ce1106f299ebe0896d41f11bec1d4fe9dc7fbb3c0e250b4144dbeac5568f1; transfer policy 68563c3202ce397ddaa90dffa36668e6a23adf162c694374fe3f2e74eb7e2c26

This exact-head artifact is retained on D: but has not been staged, activated, or installed. PR #483 remains draft. The next Mini Plus boot is observation-only: capture the known-good baseline first, then re-plan the unattended rollback gate. No further Wi-Fi mutation, device reboot, or candidate deployment will occur before that evidence is reviewed.

BusyBox Telnet lockdown correction at fced0821

A signed exact-head 17-file Warm overlay from 6f83b9b1 was activated and independently confirmed on the Mini Plus without changing the installed signed version. A deliberately no-mutation detached-watchdog dry-run then exposed the remaining blocker before any real Wi-Fi disable: this firmware starts Telnet as busybox telnetd, so pgrep telnetd and killall telnetd did not see it. Compatibility reconciliation therefore left port 23 active and correctly failed the listener gate. No real Wi-Fi disable was attempted.

The dry-run transaction and recovery lease were reconciled, the overlay was rolled back through the current reviewed deployer, and exact signed b073b423 helper hashes were restored. Fresh evidence showed associated Wi-Fi, key-only SSH, SFTP/Samba disabled, no active overlay, and a terminal inactive transaction. The 6f83b9b1 artifact is superseded and will not be redeployed.

Commit fced08216e680fedda39b2787045820c213ff6fb now:

• matches only exact NUL-delimited BusyBox Telnet applet argv under a bounded, non-symlink proc root
• kills only the verified numeric PID and ignores caller-like command lines and symlinked proc entries
• recognizes a BusyBox-owned port 23 as prohibited Telnet in the listener audit
• adds focused fixture coverage for the exact firmware process form and false-positive boundaries

Validation: focused listener gate 6/6, combined listener/network/transaction/deployer gate 61/61, complete optimized shell gate 660/660 immediately before the final proc-symlink hardening, and post-hardening FAT payload, canonical legacy manifest, file-backed provenance, transfer policy, JSON ledger, POSIX syntax, focused listener, and diff gates all passed. Exact-head hosted CI is now the complete-suite gate for fced0821.

Limitations: this correction is not yet signed or activated on hardware. PR #483 remains draft. A new exact-head signed Warm bundle must first pass an isolated fixture and a no-mutation watchdog dry-run with a clean listener audit; only then may the real unattended Wi-Fi disable/automatic-restore checkpoint be attempted. Current evidence is Mini Plus remote evidence and does not certify Mini V1-V4 or Mini Flip/my285.

Untouched-watchdog replay correction at e04539d7

Exact head fced08216e680fedda39b2787045820c213ff6fb passed all ordinary checks, exhaustive workflow 33134063692, and protected hardware workflow 33134064776. The signed archive is 203,244,666 bytes with SHA-256 9bd6aa9b1a524e290c15e90d02770f9785d155bb7234661cd283819141b84932; manifest SHA-256 145626b57ad5b3f5efab88b30da8ae1f8a6b0f1b816cd6f4c8e6e7a1e06e0ab1; signature SHA-256 ef2760c9049d0232dedd3d68de1044506134b579271c63e6f6d0acc2229d0f17; payload-manifest SHA-256 cbe9390381c3ea551587687882867e522d5554b95f1f5839efe06265b3df5839; build-info SHA-256 840da9e20e3a3164abf85c9b71df5c8b27f5ed952587b738dec94272bc6aaecb. Release metadata, SHA256SUMS, exact commit/device scope, dependency lock, ZIP CRC, complete payload reconstruction, and repository Ed25519 signature all passed.

The signed 17-file bundle was independently verified, sealed, activated, and confirmed through a fresh key-only connection. Wi-Fi remained associated, SSH key-only, SFTP/Samba off, listener audit clean, aggregate health true, profile Wi-Fi enabled, and installed version remained signed known-good b073b423. The exact BusyBox fixture proved only PID 3605 was selected, caller-like and symlinked proc entries were ignored, and a BusyBox-owned port 23 was prohibited, with no live mutation.

The subsequent no-mutation watchdog dry-run applied no disable operation. It kept the listener clean, proving the Telnet correction, but unnecessarily replayed an already-matching prior network state. SSH briefly restarted and returned automatically; the transaction ended rollback_failed after live state had recovered. The exact saved baseline was verified twice, the failed record was archived, its matching lease was closed, and the overlay was rolled back to signed b073b423. No real Wi-Fi disable was attempted and no user action or reboot was required.

Commit e04539d706c3df64d9492baf47cb14fa062f216a closes an untouched timed transaction directly when operation is none and the saved network/service/listener baseline already matches. Any drift still enters the existing bounded restoration path. Focused transaction validation passed 25/25, including both zero-replay and drifted-baseline cases; the earlier combined transaction/listener gate passed 30/30. Canonical manifest, 314,637,653-byte dependency inventory, file-backed provenance, FAT payload, transfer policy, JSON, POSIX syntax, and diff gates passed. Exact-head hosted CI is pending.

PR #483 remains draft. A new signed exact-head transaction helper must pass the same no-mutation watchdog gate before any real Wi-Fi disable/automatic-restore attempt.

Exact-head no-mutation pass and real restore failure at e04539d7

All ordinary checks are green at e04539d7533c09f16a3b4d9cfe5f1aa21c467274: shell 2m07s, static analysis 1m29s, native plus ASan 3m28s, ARM 7m44s, docs 2m14s, and formatting 39s. Exact-head exhaustive workflow 33136083339 passed. Protected hardware workflow 33136084481 passed in 9m10s.

The signed archive is 203,248,860 bytes with SHA-256 358c5366144e7f49624f7ceb8e7cca3b4da7b0b6695a55d8186af001478b5c97; manifest SHA-256 fcde7039517574685ba365f4482f43209f6cef38955f212c225406c33c296bf7; signature SHA-256 4f0de5ce353ad703362de73d4288db7922fea4fd56fb6a0f949590eeefac09a0; payload-manifest SHA-256 4970ee9586037e5693dba611be9f137f2f1bc62df244b1a30607c21c2f663163; build-info SHA-256 baadc19ae8e8576e5ba5b77ad4b8e6689c4a929227df74a81476ac967f822e80. Exact commit/device scope, dependency lock, SHA256SUMS, payload reconstruction, every ZIP CRC, metadata, and repository Ed25519 signature passed. Signed bloom-network-transaction is 27,679 bytes with SHA-256 af65431b93bc03af15dd7553dfb5819ec2fc650218d7d4085a7d372d7bc575b1, matching the reviewed tree byte-for-byte.

The exact 17-file bundle was sealed, independently verified, activated, and confirmed through a fresh strict key-only connection. The corrected 30-second no-mutation watchdog then passed: every poll remained reachable, transaction tx-6489-2892 closed rolled_back with its lease inactive, Wi-Fi stayed associated, settings/profile remained enabled, services stayed correct, and the listener audit stayed clean.

The subsequent real timed wifi-disable gate is a failure. Preflight proved an IDLE session, associated Wi-Fi, clean listener audit, inactive prior lease, and exact e04539d7 overlay. Transaction tx-6625-4060 began with a 45-second deadline; the disable connection closed as expected, but strict key-only SSH did not return during 731 seconds of bounded polling or a further three-minute late-recovery poll. No blind follow-up mutation, reboot, manual toggle, or card change was attempted. The current remote transaction and recovery-lease state cannot be read until physical boot recovery restores a network path.

PR #483 remains draft and must not merge. The real unattended automatic-restore checkpoint is not satisfied. One physical reboot is now unavoidable because no remote path exists; boot recovery must be observed and its exact transaction, lease, profile, listener, overlay, and signed-version state captured before another correction is designed. No further real Wi-Fi-disable test is authorized until that evidence is reviewed.

Offline overlay recovery and fail-closed Wi-Fi-disable guard at 6565d348

A physical reboot did not restore the automation path after failed transaction tx-6625-4060. Bloom Shell reported Wi-Fi connected, but the known LAN endpoint did not answer ICMP or strict key-only SSH and the device MAC was absent from the live neighbor table. Card inspection established the repeat-loop cause: signed update state had already recovered to known-good 0.1.0-dev-b073b423, but the complete temporary net02-network-full-e04539d7 network/boot overlay remained active. Early boot therefore reran the same overlay-owned recovery and returned to rollback_failed instead of the signed runtime.

Powered-off offline recovery was bounded to Bloom-owned state:

• preserved exact transaction, lease, prior, settings, profile, update, and overlay-pointer evidence outside the repository before mutation
• verified all 17 live overlay files matched the sealed e04539d7 payload and the sealed manifest SHA-256 was 1f2662443bc4fd4d6c02e32ac7e9fedb618e698bcf5c4d8c3fa31e2e8e00f732
• restored 16 exact sealed signed-baseline backups and removed the one file recorded as originally absent, with all 17 post-restore dispositions verified
• removed only the active overlay pointer, retained every sealed deployment slot and backup, quarantined the four-file failed transaction directory, and renamed the local network-mutation enable marker to a disabled recovery marker
• retained canonical and per-device Wi-Fi preference enabled and left ROMs, BIOS, saves, credentials, keys, and user data untouched
• confirmed signed update state remains known_good at 0.1.0-dev-b073b423
• ran read-only FAT32 chkdsk; Windows found no filesystem problems, then safely ejected the card

Commit 6565d348 makes the prohibition durable. bloom-device rejects a new remote wifi-disable locally, and bloom-network-transaction rejects it before preflight, lock, authorization, state publication, or radio mutation. Recovery of historical persisted Wi-Fi-disable transactions remains covered for backward compatibility. This aligns implementation with the v3 instruction: Do not test a sole-route persistent Wi-Fi-off operation.

Validation at 6565d348:

• focused transaction suite: 26/26 passed in 13 seconds
• focused host device suite: 26/26 passed; the new local-rejection case passed
• legacy manifest: 330 components; dependency inventory: 2,129 files, 314,637,632 bytes
• file-backed provenance, transfer policy, FAT payload, POSIX/Bash syntax, v3 JSON, dependency totals, and diff checks passed together in 5.6 seconds
• temporary test containers used --rm; C: remained unchanged at 61.49 GiB free during metadata validation

PR #483 remains draft. The only pending device action is an observation-only clean boot and strict read-only evidence capture on the restored signed baseline. No further live Wi-Fi-disable test will be performed.

Signed-baseline post-recovery observation at 6565d348

After the offline recovery and a clean user boot, strict BatchMode/IdentitiesOnly/public-key SSH returned on the first probe. Read-only inspection at 2026-08-28T11:14Z confirmed installed signed known-good 0.1.0-dev-b073b423, aggregate health true, Wi-Fi enabled and associated with a default route, wpa_supplicant and the fixed DHCP client running, key-only SSH running, SFTP/Samba stopped, and a clean listener audit with no prohibited listener or process.

The transaction authority reports idle with an inactive lease. The canonical transaction directory and developer active pointer are absent, no development overlay is active, the network-mutation enable marker is absent, and the offline disabled marker remains present. The failed four-file transaction record remains quarantined with exact hashes preserved outside the repository. Canonical generation 139 and the current device profile both retain Wi-Fi enabled. The session is IDLE, Bloom Shell is running, RetroArch is not running, and no temporary probe remains.

The restored live hashes include signed-baseline bloom-network 2b58d67935a46bb7697a205ad428cc74c9489f4a8c43e480eb8e58548fb495f6, bloom-wifi 5ec86c0d09d25dd7dcb8196725c9e20935478f1cab582a3bb5952e5a04af4c35, and runtime.sh cb49ff20db0cb37a7bda3cdd2e38101685db7c44df57a33114aeaf3f24f6fada. The privacy-safe external evidence record is 3,360 bytes with SHA-256 e40dc034bc9ac8331cf761e47c48416dcaf86f374511f25de80cb1b43140d4f1.

This is remote Mini Plus recovery evidence, not physical certification of controls, LCD, audio, gameplay, or save semantics. The corrective candidate remains host/CI validated but was not activated during recovery. No sole-route Wi-Fi-disable operation, reboot, overlay activation, or network mutation was attempted.

Exact-head recovery correction gates at 6565d348

All ordinary checks are green at exact head: shell 1m40s, static analysis 2m01s, native plus ASan 3m38s, ARM 7m40s, docs 2m09s, and formatting 45s. Exact-head exhaustive workflow 33166683195 passed in 3m51s; whole-source cppcheck completed in 1m58s and the full native plus ASan job remained under four minutes.

Protected Hardware test build 33166684506 passed in 9m25s for exact commit 6565d34874600d42e7b60cdb75f08a9e4c9b3791. The signed archive BloomOS-v0.1.0-dev-6565d348.zip is 203,248,605 bytes with SHA-256 dee6cc27cf02ad0604c76acae331d30121765b4a749fe3150ec51375a927f535; manifest 1d40a37820a3a6a089b4196b0a1d62efd1d7667999b72233fb3847271548a2f5; signature 5c49176b043ed1bdf2151f496a8cc6b10d63220e423d96eb80438f6ea678737a; payload manifest c597375ea194548c480f710b9bd0d822a8896a87b8c94a7a6e0a9902076559a6; build info 8ffb6bcce1d97d4a9433975a6eff8938a268de412c7a124877b4091d4caf29a3.

Repository Ed25519 signature, SHA256SUMS, ZIP CRC, exact commit/channel/device scope, dependency-lock digest, complete payload reconstruction, and release metadata passed. Embedded reviewed-source hashes match exactly: bloom-network d08b2782b35b3623be3429a02ed52baf2d08fa3e1e4740ea09b3629996746f50; transaction helper 37f08d8e5502ca1d56ac79448156a88c321b456a61f06cfe2b5a2daad01e9497; bloom-wifi b2cdcf8118d7986392dc5778f2fb2f91f7272070edbc1d294acf83c781f90bfc; runtime 791ce1106f299ebe0896d41f11bec1d4fe9dc7fbb3c0e250b4144dbeac5568f1. The privacy-safe external verification record is 2,345 bytes with SHA-256 cebe9bba2021909a0c7f1769df01c19e350bbc88f53842ee3073fa46e9751abb.

The artifact is verified and retained on D: but has not been staged, activated, installed, or confirmed. Signing is not device certification. No sole-route Wi-Fi-disable operation will be performed.

[boburning]

Signed Full gate update:

• protected workflow 32969798436 succeeded for exact head aff110ba73eca83dfd52d18afd26b316caa9e7fd
• signed ZIP: 203243467 bytes, SHA-256 21c656282568150d3279226085726e812ec33ae0eeb2e85367b3c38346aa8ed4
• manifest/signature/archive were transferred over strict key-only SSH and independently matched by remote byte count and SHA-256
• signature/archive staging and isolated preparation succeeded for 0.1.0-dev-aff110ba
• update armed from retained known-good 0.1.0-dev-b073b423
• activation created pre-update snapshot 20260826T125928Z-pre-update-2064
• Bloom clean reboot closed SSH as expected
• the USB-powered Plus remained fully offline (no ICMP, TCP 22, or ARP presence) for a conservative 40-minute bound

This is now at the known unavoidable USB-powered physical boundary: one power-button press is needed to leave the charging/update screen and resume the already armed signed boot. The PR remains draft and the update remains unconfirmed. No power cycle, SD-card mutation, restage, bypass, or manual live-file replacement was attempted.

[boburning]

Final CI reconciliation at exact head \6904df1a35e513307e7c0d709841eda7f13c0630: all required checks passed (Check build, Shell integration tests, Test Docs deployment, and Test build including AddressSanitizer). Protected Hardware test build 33039305266 also completed successfully for the same head. The PR intentionally remains draft; the signed artifact is retained but was not deployed, and the corrected durable Mini Plus gate remains pending a separately reviewed physical checkpoint.