[boburning]

Summary

• advances v3 work item NET-04 with a rollback-bounded wifi-profile-connect ID transaction
• preserves the exact prior supplicant bytes in a mode-0600 snapshot below a mode-0700 private JFFS2 root; public SD-card transaction metadata contains only its SHA-256
• routes station replacement through the canonical bloom-network and bloom-wifi owners, bounded by the existing monotonic watchdog and recovery lease
• restores the exact prior configuration after apply failure, explicit rollback, deadline expiry, or interrupted boot, then rechecks association, services, and listeners
• extends the guarded host workflow so success still requires an independent host-key-verified SSH connection

This is the third implementation slice for NET-04 and depends only on current main, which already contains NET-04A (#487) and NET-04B (#488). It does not complete NET-04; active-profile forget and the signed physical connect/rollback checkpoint remain tracked by #486.

Closes no issue. Progresses #486.

Validation

• focused affected gate: 117/117 passed in about 34 seconds
• exhaustive focused manifest/provenance gate: 140/140 passed once, including exact inventory preflight
• inventory: 332 components, 2,131 files, 314,676,226 bytes, 228 source-build, 104 unresolved
• git diff --check
• live read-only Mini Plus preflight confirmed /usr/bin/sha256sum, /bin/sync, regular supplicant config, associated networking, known-good update state, and healthy aggregate diagnostics

Device evidence

Exact candidate ff5b0775:

• bloom-network-transaction: 33,007 bytes
• SHA-256: d3bed4f13e6e3b84344ba9c370f6a258b09d5e23a96378068a64eff30b2ab68e
• transferred over strict key-only, pinned-host SSH with host and device byte/hash equality
• exercised only in /tmp/bloom-net04c-fixture-ff5b0775 with synthetic station data and mocked network/profile/service dependencies
• exact prior configuration hash was restored after project/apply/rollback
• private root/snapshot modes were 0700/0600
• no credential-bearing copy appeared under public SD-card transaction state
• fixture, candidate, and result files were removed
• post-fixture live bloom-network status remained associated and aggregate health remained green

Limitations

• no real scan, association change, Wi-Fi toggle, DHCP replacement, listener mutation, reboot, or signed update was performed on the sole-route Mini Plus
• isolated remote evidence does not certify physical controls, display behavior, Mini V1-V4, or Mini Flip/my285
• a real profile transition must not be confirmed without a fresh independent SSH connection and all recovery surfaces green
• active-profile forget and the signed physical connect/failure/timeout/boot-recovery matrix remain for a later NET-04 slice