[boburning]

Summary Publishes the read-only scan slice of v3 NET-04 after merged NET-04A (#487). - adds one fixed-interface asynchronous scan authority with immediate high-entropy operation IDs - keeps status redacted and returns SSIDs only through an explicit local ID-scoped results call - permits one active worker, cancellation, terminal discard, and at most eight retained operations - enforces a five-second start limit, 15-second runtime, 64-KiB raw-output ceiling, 32 unique printable SSIDs, and mode-0700/0600 ephemeral state - classifies only explicit open, WPA2-PSK, or unsupported security; WEP/enterprise are never presented as connectable WPA2-PSK - reconciles dead workers to bounded terminal failure and refuses unsafe roots, links, locks, state, and publication slots - exposes only fixed bloomctl network scan start/status/results/cancel/discard operations - adds a versioned result schema and exact payload/provenance ownership - corrects the NET-04A ledger mapping so #487 belongs to NET-04 rather than REC-01 This PR intentionally does not connect, forget an active profile, change Wi-Fi preference, restart the radio, modify DHCP/listeners, or complete NET-04. Rollback-bounded association follows separately. ## Dependency and issue links Base: main at 105f744d2fc88d0cacf023ecb62e800572dd0933 (merged NET-04A, #487). This PR is not stacked on an unmerged branch. Refs #486. Parent program: #434. ## Validation - affected scan/CLI/schema gate: 9/9 passed in 13.8s

• risk-scoped shell workflow 33173965383: passed with 1m39s test execution on b5de4b1ae7f7d558886a8c55047b3a7ada141621 - focused legacy manifest/provenance file: 13/13 passed in 271s - canonical legacy manifest: 332 components / 2,131 files / 314,669,717 bytes - source-built components: 228; unresolved inherited components: 104 - full file-backed provenance, transfer policy, FAT payload, POSIX syntax, JSON parsing, dependency totals, and diff checks: passed - adversarial coverage includes cancellation, timeout, backend failure, output size, rate/history limits, duplicate SSIDs, non-PSK privacy classification, malformed signal filtering, stale/live workers and locks, path/link refusal, unsupported hardware, invalid public bounds, and explicit discard - bloom-wifi-scan: 17,244 bytes, SHA-256 0d3b3e1ac893fb787fcd7c3d28b2c526175475d360bab83836d9072efab695b3 - result schema: 1,137 bytes, SHA-256 d4587b206eb077d3e9f33967e058e1f76f4a42cb10fca8b2f3426560c7ea39b2 ## Mini Plus evidence and limitations Strict key-only read-only preflight confirmed the exact fixed dependencies exist on the current Mini Plus at /bin/date, /usr/bin/od, /bin/sleep, /usr/bin/nohup, /usr/bin/awk, /usr/bin/wc, /usr/bin/tr, plus the shipped iw and jq. That check caught and corrected bare-PATH executable validation before publication. The exact 17,244-byte helper (SHA-256 0d3b3e1ac893fb787fcd7c3d28b2c526175475d360bab83836d9072efab695b3) and a 156-byte synthetic platform fixture were transferred through strict key-only SSH and exercised only below /tmp, with /bin/echo replacing iw. The operation transitioned RUNNING to SUCCEEDED with zero results, enforced 0700/0700/0600/0600 root/operation/state/result modes, discarded cleanly, and removed every task file. The live supplicant hash remained d7fbadd510e76c423638513337620e17944d51b4505ff314354971d97114bdef; aggregate health remained green. No real scan, SSID, address, credential, live profile, supplicant contents, association, Wi-Fi toggle, reboot, update, activation, listener change, or network transaction entered evidence. This is not physical certification and not Mini V1-V4 or Mini Flip/my285 evidence. ## Storage hygiene Reused the single D:-based implementation worktree and cached pinned shell-test image. All focused containers used --rm; no clone, extra worktree, WSL build directory, named Docker volume, or build cache was created. C: remained above the 60-GiB gate. No unrelated worktree, image, volume, branch, stash, recovery state, or signed evidence was removed.