boburning · Aug 28, 2026 · Aug 28, 2026 · Aug 28, 2026 · Aug 28, 2026 · Aug 28, 2026
diff --git a/build/dependencies.lock b/build/dependencies.lock
@@ -184,10 +184,10 @@ legacy_channels = ["development"]
 [legacy_inventory]
 manifest = "build/legacy-manifest.json"
 schema = 1
-component_count = 331
-file_count = 2130
-byte_count = 314651736
-source_build_components = 227
+component_count = 332
+file_count = 2131
+byte_count = 314669717
+source_build_components = 228
 unresolved_components = 104
 inherited_baseline = "07505ea58c7bba698d6b9220ff43946a43cac76b"
 

diff --git a/build/legacy-manifest.json b/build/legacy-manifest.json
@@ -1003,13 +1003,26 @@
       "build_recipe": "Makefile",
       "resolution": "source-build"
     },
+    {
+      "id": "runtime-tmp-update-bin-bloom-wifi-scan",
+      "kind": "runtime",
+      "path": "static/build/.tmp_update/bin/bloom-wifi-scan",
+      "file_count": 1,
+      "byte_count": 17244,
+      "tree_sha256": "7701d79ce3b896f5d4438d0aef5dd4f0c1f4b69ee6945268c47ebd489ac787ef",
+      "source": "https://github.com/boburning/BloomOS",
+      "source_revision": "release-commit",
+      "license": "GPL-3.0-only",
+      "build_recipe": "Makefile",
+      "resolution": "source-build"
+    },
     {
       "id": "runtime-tmp-update-bin-bloomctl",
       "kind": "runtime",
       "path": "static/build/.tmp_update/bin/bloomctl",
       "file_count": 1,
-      "byte_count": 34614,
-      "tree_sha256": "19b5d3dedc13eda3fb584adf271daebf89a38dfeaaf838f3e38e672663980650",
+      "byte_count": 35351,
+      "tree_sha256": "db5fa1c268ed71f098c626f80d29edb2f21896469262a7c2acfaeb49e48dad02",
       "source": "https://github.com/boburning/BloomOS",
       "source_revision": "release-commit",
       "license": "GPL-3.0-only",

diff --git a/build/wifi-scan-result.schema.json b/build/wifi-scan-result.schema.json
@@ -0,0 +1,53 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bloomos.local/schema/wifi-scan-result-v1.json",
+  "title": "BloomOS bounded local Wi-Fi scan result",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "service",
+    "networks"
+  ],
+  "properties": {
+    "schema": {
+      "const": 1
+    },
+    "service": {
+      "const": "bloom-wifi-scan"
+    },
+    "networks": {
+      "type": "array",
+      "maxItems": 32,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "ssid",
+          "security",
+          "signal_dbm"
+        ],
+        "properties": {
+          "ssid": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 32,
+            "pattern": "^[ -~]+$"
+          },
+          "security": {
+            "enum": [
+              "open",
+              "wpa2-psk",
+              "unsupported"
+            ]
+          },
+          "signal_dbm": {
+            "type": "integer",
+            "minimum": -200,
+            "maximum": 0
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/docs/1.0_TEST_MATRIX.md b/docs/1.0_TEST_MATRIX.md
@@ -48,6 +48,7 @@ shoulder button.
 | Quick Settings | START from core surfaces; immediate brightness/volume/mute; capability-gated Wi-Fi; readable battery; B/START close |
 | Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; Samba hidden until a materially different source-build candidate passes feasibility |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and single-profile upsert; requested/document ID binding; inactive-ID deletion with active-profile refusal; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
+| Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
 | GameSwitcher | MENU open/toggle; Left/Right select; L1/R1 page; A resume; X actions; START Quick Settings; B Home; no inherited brightness/view/delete behavior |
 | Apps/Tweaks | Every app disposition recorded; normal configuration requires no Tweaks; supervised launch remains bounded |
 | Persistent state | Versioned atomic publication; exact restoration across Details/game/GameSwitcher/Quick Settings; malformed/oversized/symlink input defaults without Safe Mode |

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -299,6 +299,17 @@ The service never scans, associates, changes the Wi-Fi preference, or restarts
 the radio; those behaviors remain with later NET-04 API work and the existing
 `bloom-network`/`bloom-wifi` owners.
 
+`bloom-wifi-scan` begins the NET-04 station API as a separate ephemeral local
+authority. A start returns immediately with a high-entropy operation ID; only
+one worker may run, starts are rate-limited, runtime is capped at 15 seconds,
+raw backend output is capped at 64 KiB, results are limited to 32 unique
+printable SSIDs, and operation history is capped at eight entries. Status is
+redacted and never contains scan results. Results are available only through
+an explicit local ID-scoped request, live only below a mode-0700 `/tmp` root,
+and classify only explicit open, WPA2-PSK, or unsupported security. A caller
+can cancel active work and explicitly discard any terminal result. The scanner
+does not change a profile, preference, association, DHCP client, or listener.
+
 Listener reconciliation is event-driven at existing fixed boundaries: boot,
 Wi-Fi reconciliation, Wi-Fi preference changes, remote-key publication, and
 each listener preference request. A request publishes its desired boolean and

diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
@@ -297,6 +297,23 @@ redacted health. The remaining NET-04 scan/connect orchestration and active
 profile removal must retain stdin or an equivalent fixed private input
 boundary and the existing rollback rules.
 
+The NET-04 scan slice is asynchronous and keeps result data only under `/tmp`:
+
+```sh
+operation_id=$(bloomctl network scan start | jq -r .operation_id)
+bloomctl network scan status "$operation_id"
+bloomctl network scan results "$operation_id"
+bloomctl network scan cancel "$operation_id"
+bloomctl network scan discard "$operation_id"
+```
+
+Only the explicit results call returns SSIDs, for local UI consumption. Never
+copy that output into logs, screenshots, issues, PR bodies, or validation
+evidence. Host fixtures use synthetic `iw` output and must cover cancellation,
+timeout, backend failure, oversized output, duplicate SSIDs, security
+classification, unsafe paths, stale/live locks, rate limiting, and bounded
+history. This slice performs no connect or forget transition.
+
 An activated update is not considered successful merely because the installer
 or MainUI started. The runtime records each unconfirmed boot in durable
 `.bloom/update` state. After device checks pass, developers can promote the

diff --git a/docs/SECURITY.md b/docs/SECURITY.md
@@ -102,4 +102,12 @@ handle, revalidates the resulting complete store, and publishes atomically.
 the managed supplicant projection. Neither operation scans, associates,
 restarts Wi-Fi, or exposes an SSID or credential.
 
+Wi-Fi scan status and logs never contain SSIDs. An explicit local results call
+may return at most 32 printable SSIDs for the future on-device UI, but that
+ephemeral mode-0600 result is excluded from diagnostics, support exports,
+screenshots, and durable evidence. The worker accepts no interface, command,
+destination, or backend override from its public arguments; it has one fixed
+interface, a 15-second deadline, a 64-KiB raw-output ceiling, a single active
+operation, a five-second start limit, cancellation, and bounded history.
+
 Security-sensitive migrations and repair operations must be bounded, logged, reversible where possible, and validated before activation.
diff --git a/docs/program/BloomOS_Work_Program_v3.json b/docs/program/BloomOS_Work_Program_v3.json
@@ -198,9 +198,7 @@
       "title": "Establish clean recovery workspace and current ledger",
       "status": "merged",
       "dependencies": [],
-      "github_prs": [
-        487
-      ],
+      "github_prs": [],
       "risk_tier": 0,
       "deployment_tier": "host",
       "device_gate_required": false,
@@ -833,15 +831,20 @@
       "dependencies": [
         "NET-03"
       ],
-      "github_prs": [],
+      "github_prs": [
+        487,
+        488
+      ],
       "risk_tier": 2,
       "deployment_tier": "warm",
       "device_gate_required": true,
-      "last_audited_main": "fca10bb0168d8bc38737881745b68cd3bab9da59",
+      "last_audited_main": "105f744d2fc88d0cacf023ecb62e800572dd0933",
       "evidence": [
         "issue #486 tracks NET-04 after NET-03 merged as fca10bb0168d8bc38737881745b68cd3bab9da59; no prior NET-04 issue or implementation PR exists and current main has no bounded scan/connect/forget orchestration",
         "draft PR #487 is the first host-safe NET-04 slice and extends the private NET-03 authority with stdin-only atomic single-profile upsert, requested/document ID binding, inactive-profile deletion, a non-secret projected-profile marker, and fail-closed refusal to replace or forget the active profile; 16/16 focused tests passed in 4.8 seconds with exact 314651736-byte dependency preflight, and the slice does not scan, associate, restart Wi-Fi, change preferences, or complete NET-04",
-        "exact head b6e96eebd08df0eb8b75867b8e341f3e7a76a830 passed risk-scoped shell workflow 33171784731 with 1m29s test execution; its exact 14104-byte helper with SHA-256 5fd88c120a0a4a979a890865a5ac06e7dbeb7e50ffcd99ce08cfa389e637ecc7 was transferred through strict key-only SSH and exercised only under /tmp/bloom-net04a-fixture-b6e96eeb with synthetic profiles, where active deletion failed closed, inactive deletion succeeded, root/store/config modes were 0700/0600/0600, live supplicant SHA-256 d7fbadd510e76c423638513337620e17944d51b4505ff314354971d97114bdef remained unchanged, temporary state was removed, and aggregate device health remained green"
+        "exact head b6e96eebd08df0eb8b75867b8e341f3e7a76a830 passed risk-scoped shell workflow 33171784731 with 1m29s test execution; its exact 14104-byte helper with SHA-256 5fd88c120a0a4a979a890865a5ac06e7dbeb7e50ffcd99ce08cfa389e637ecc7 was transferred through strict key-only SSH and exercised only under /tmp/bloom-net04a-fixture-b6e96eeb with synthetic profiles, where active deletion failed closed, inactive deletion succeeded, root/store/config modes were 0700/0600/0600, live supplicant SHA-256 d7fbadd510e76c423638513337620e17944d51b4505ff314354971d97114bdef remained unchanged, temporary state was removed, and aggregate device health remained green; PR #487 merged as 105f744d2fc88d0cacf023ecb62e800572dd0933",
+        "draft PR #488 adds a fixed-interface asynchronous scan worker with immediate high-entropy operation IDs, redacted status, explicit local-only results, cancellation, terminal discard, one active worker, bounded rate/runtime/raw output/results/history, open/WPA2-PSK/unsupported classification, and bloomctl delegation; 9/9 affected tests passed in 13.8 seconds and 13/13 focused manifest/provenance tests passed in 271 seconds with exact 314669717-byte dependency preflight, and the slice does not connect, forget, change a preference, restart Wi-Fi, modify DHCP, or complete NET-04",
+        "exact head b5de4b1ae7f7d558886a8c55047b3a7ada141621 passed risk-scoped shell workflow 33173965383 with 1m39s test execution; its exact 17244-byte helper with SHA-256 0d3b3e1ac893fb787fcd7c3d28b2c526175475d360bab83836d9072efab695b3 and a 156-byte synthetic platform fixture were transferred through strict key-only SSH and exercised only under /tmp with /bin/echo replacing iw, transitioned RUNNING to SUCCEEDED with zero results, enforced 0700/0700/0600/0600 root-operation-state-result modes, discarded the terminal operation, removed every task file, retained live supplicant SHA-256 d7fbadd510e76c423638513337620e17944d51b4505ff314354971d97114bdef, and left aggregate device health green without a real scan or network mutation"
       ]
     },
     {