[boburning]

Summary

• advances v3 NET-04 by exposing the existing private profile and guarded connect authorities through bounded bloomctl network commands
• keeps profile creation on stdin, status redacted, and forget limited to one validated non-secret ID
• provides explicit connect begin/apply/confirm/cancel aliases over the rollback-bounded transaction merged in NET-04C: add rollback-bounded Wi-Fi profile connect #489
• defines active forget as: connect and independently confirm a stored fallback, then delete the now-inactive old profile
• retains the profile authority's fail-closed refusal to delete the currently projected profile; there is no delete-first or implicit-fallback path

This slice targets current main and depends on merged NET-04C #489. It progresses #486. It does not authorize a real sole-route profile transition or complete the signed physical NET-04 checkpoint.

Validation

• 76/76 direct profile, CLI, and network-transaction tests passed
• 99/99 exhaustive focused tests passed in one run, including manifest/provenance closure
• exact inventory preflight: 332 components, 2,131 files, 314,678,142 bytes, 228 source-build, 104 unresolved
• git diff --check

Device evidence

Exact candidate b06f4a82:

• bloomctl: 37,288 bytes
• SHA-256: f9e765dd668aeff9137772ecd06bf3bd02b7fe30597e46243dcb2b1caa29046e
• transferred with strict key-only pinned-host SSH and exact byte/hash verification
• exercised only under /tmp against mocked network, transaction, and profile helpers with synthetic profile input
• verified stdin forwarding, redacted status delegation, bounded connect begin/apply/confirm/cancel mapping, explicit inactive-ID deletion, and local rejection of traversal IDs
• fixture, candidate, and result were removed; live networking remained associated

Limitations

• no real scan, association change, active-profile deletion, Wi-Fi toggle, DHCP mutation, listener mutation, reboot, update, or signed payload was performed
• active forget requires a distinct stored fallback and independent confirmation before deleting the old ID
• remote fixture evidence does not certify physical controls, display behavior, original Mini, or Mini Flip/my285
• the signed physical success/failure/timeout/boot-recovery matrix remains tracked by NET-04: add bounded Wi-Fi scan/connect/forget API #486