[boburning]

Summary

Advances NET-05 with a reusable nonblocking command boundary for the future Wi-Fi scan surface.

• permits only fixed bloomctl network scan {start|status|results|cancel|discard} argv shapes
• validates every operation ID before fork and requires exact versioned start/status/results/cancel/discard responses
• keeps one request in flight, captures stdout through a nonblocking pipe, and caps it at 16 KiB
• redirects stdin/stderr, closes inherited descriptors, enforces a five-second monotonic command deadline, and kills/reaps the child process group on failure or teardown
• rejects a missing, relative, non-executable, or symlinked bloomctl
• adds deterministic success, malformed-ack, timeout, oversized-output, unsafe-ID, symlink, argv, and cleanup tests
• records merged PR feat(network): route Wi-Fi controls to safe details (NET-05) #546 and this host-only safety layer in the v3 ledger and normative docs

Dependency and scope

• Base: current main at 7dee3fc27b5b0cd5b743af99f8e66b631c514c12
• Depends on merged PR feat(network): route Wi-Fi controls to safe details (NET-05) #546 (NET-05 read-only surface) and merged PR NET-05A: add credential-free Wi-Fi UI model #545 (credential-free model)
• Advances NET-05: replace direct Wi-Fi toggle with bounded profile UI #544
• This is a partial NET-05 slice with deliberately no runtime consumer. The follow-on SDL state machine will own timers, polling, result presentation, cancellation, and discard.

Validation

• focused native: 6/6 BloomShellWifiUi* tests passed
• focused AddressSanitizer: 6/6 passed with leak detection, halt-on-error, and strict string checks
• focused shell integration: 58/58 selected platform, policy, critical-surface, profile, and scan tests passed
• canonical shell preflight passed legacy manifest, provenance closure, transfer policy, and dependency inventory on the first run
• risk-scoped cppcheck passed src/bloomShell; exhaustive warning/performance/portability/style analysis of the changed source passed
• strict C syntax compile passed with -Wall -Wextra -Werror
• clang-format 21.1.8, JSON parse, and git diff --check passed
• CI scope resolves to risk 2, BloomShellWifiUi*, Bloom Shell ARM, src/bloomShell static analysis, five focused shell files, and no visual job

The affected ARM build is delegated to this PR's remote CI. The pinned ARM image remains uncached locally and C: is below the program's 60 GiB free-space gate.

Device evidence

None claimed or required for this host-only boundary. It has no runtime consumer and therefore cannot initiate a scan. The online Mini Plus remained untouched on its known-good signed baseline: no SSH command, scan, connection/profile transition, Wi-Fi toggle, listener/key mutation, deployment, update, or reboot occurred. Remote CI is not physical certification.

Safety and limitations

• No SSID or credential logging/evidence path is added.
• The request object is single-flight and nonblocking, but the SDL timer/state-machine consumer is intentionally pending.
• Scan results remain ephemeral; association, credential entry, profile forget, and radio power remain pending guarded slices.
• A later consumer must destroy the request object on every Shell exit and must not invoke commands from draw().
• Original Mini remains hidden; no Mini Plus evidence can certify Mini V1-V4 or Flip.

Storage hygiene

Reused the single D:-based implementation worktree and build workspace. Created no clone, worktree, container, image, or volume. Temporary test containers used the pinned shell image with --rm. No ARM image was pulled locally while C: remained below the free-space gate.

Remote CI result

All required checks passed on commit 998b481e83dcfaed958743029c6e85bb1c446c14:

• format: 23 seconds
• focused 58-test shell integration gate: 43 seconds
• native tests: 1 minute 8 seconds
• AddressSanitizer: 1 minute 12 seconds
• affected Bloom Shell ARM build: 1 minute 21 seconds
• scoped static analysis: 2 minutes 8 seconds