[boburning]

Summary Publishes the first host-safe NET-04 slice on merged NET-03 (#485). - adds stdin-only atomic upsert ID for one private Wi-Fi profile - binds the stdin document ID to the requested non-secret handle - preserves the 16-profile / 16-KiB complete-store validation boundary - adds atomic delete ID for inactive profiles only - marks projections with a non-secret managed profile ID - refuses replacement or deletion of the active projected profile - retains mode-0700 root, mode-0600 store/config, same-directory candidates, sync, locking, link refusal, and redacted output - does not scan, associate, restart Wi-Fi, change the Wi-Fi preference, touch listeners, or expose an SSID/credential This PR intentionally does not complete NET-04. The following slice will add bounded asynchronous scan/connect orchestration and rollback-safe active-profile transitions. The v3 ledger remains in_progress. ## Dependency and issue links Base: main at fca10bb0168d8bc38737881745b68cd3bab9da59 (merged NET-03, #485). This PR is not stacked on an unmerged branch. Refs #486. Parent program: #434. ## Validation - focused profile-store gate: 16/16 passed in 4.8s

• risk-scoped shell workflow 33171784731: passed with 1m29s test execution on b6e96eebd08df0eb8b75867b8e341f3e7a76a830 - canonical legacy manifest: 331 components - full file-backed provenance: passed - transfer policy: passed - FAT payload validation: passed - dependency aggregate: 331 components, 2,130 files, 314,651,736 bytes, 227 source-build and 104 unresolved inherited components - POSIX syntax, JSON parsing, and diff checks: passed - adversarial coverage includes requested/document ID mismatch, active replace/delete refusal, unsafe config links, occupied slots, stale/live locks, malformed input, count/byte limits, duplicate IDs/SSIDs, credential and directive injection, and prior-store preservation - bloom-wifi-profiles: 14,104 bytes, SHA-256 5fd88c120a0a4a979a890865a5ac06e7dbeb7e50ffcd99ce08cfa389e637ecc7 ## Device evidence and limitations The exact 14,104-byte helper (SHA-256 5fd88c120a0a4a979a890865a5ac06e7dbeb7e50ffcd99ce08cfa389e637ecc7) was transferred through strict key-only SSH and exercised only under /tmp/bloom-net04a-fixture-b6e96eeb with synthetic profiles. Two upserts succeeded, deletion of the projected profile failed closed, deletion of the inactive profile succeeded, and root/store/config modes were 0700/0600/0600. The live /appconfigs/wpa_supplicant.conf hash remained d7fbadd510e76c423638513337620e17944d51b4505ff314354971d97114bdef; temporary state was removed and aggregate health remained green. No live profile, association, Wi-Fi toggle, reboot, update, activation, listener change, or network transaction was attempted. This is not physical certification and not Mini V1-V4 or Mini Flip/my285 evidence. ## Storage hygiene Reused the single D:-based implementation worktree and cached pinned shell-test image. Focused containers used --rm; no clone, extra worktree, WSL build directory, named Docker volume, or build cache was created. C: remained above the 60-GiB gate. No unrelated worktree, image, volume, branch, stash, recovery state, or signed evidence was removed.