[boburning]

Summary

Advances NET-05 with an event-loop-independent lifecycle controller for the nonblocking scan client merged in #547.

• sequences one fixed start, 250-ms status opportunities, result fetch, and terminal discard
• retains successful networks or terminal error state in bounded memory while clearing the service-side operation ID
• automatically discards succeeded, failed, and cancelled operations so scan history cannot accumulate
• defers a cancel pressed while start is still in flight until the validated operation ID arrives
• cancels an in-flight status/results CLI before issuing the exact service cancel, then confirms terminal status and discards it
• keeps the controller single-flight and exposes no arbitrary command, path, operation, or identifier
• adds deterministic success and cancel-during-start lifecycle fixtures
• records merged feat(network): add nonblocking Wi-Fi scan client (NET-05) #547 and the controller contract in the v3 ledger and normative docs

Dependency and scope

• Base: current main at 765f2038b7d63e61d6db8bab1a70ce750a07d088
• Depends on merged feat(network): add nonblocking Wi-Fi scan client (NET-05) #547 (nonblocking scan client), feat(network): route Wi-Fi controls to safe details (NET-05) #546 (read-only Wi-Fi surface), and NET-05A: add credential-free Wi-Fi UI model #545 (credential-free model)
• Advances NET-05: replace direct Wi-Fi toggle with bounded profile UI #544
• This remains a host-only partial NET-05 slice. It intentionally has no SDL or rendered-surface consumer; that follow-on will supply timer events, focus, scan/cancel actions, and result presentation.

Validation

• focused native: 8/8 BloomShellWifiUi* tests passed
• focused AddressSanitizer: 8/8 passed with leak detection, halt-on-error, and strict string checks
• focused shell integration: 58/58 selected platform, policy, critical-surface, profile, and scan tests passed
• canonical shell preflight passed legacy manifest, provenance closure, transfer policy, and dependency inventory on the first run
• exhaustive changed-source cppcheck passed warning/performance/portability/style
• strict C syntax compile passed with -Wall -Wextra -Werror
• clang-format 21.1.8, JSON parse, and git diff --check passed

The affected Bloom Shell ARM build is delegated to remote CI because the pinned image is not locally cached and C: remains below the 60 GiB free-space gate.

Device evidence

None claimed. This branch has no runtime consumer and cannot initiate a device scan. The online Mini Plus remained untouched on its known-good signed baseline: no SSH command, scan, profile/connection transition, Wi-Fi toggle, listener/key mutation, deployment, update, or reboot occurred. Remote CI is not physical certification.

Safety and limitations

• Successful network results remain ephemeral in memory and are not logged or persisted.
• A future SDL owner must poll with monotonic milliseconds, keep the controller alive through cancel/discard, and destroy it on Shell exit.
• Rendered scan controls, association, credentials, forget, and radio power remain pending guarded slices.
• Original Mini remains hidden; no Plus evidence certifies other SSD202D families.

Storage hygiene

Reused the single D:-based implementation worktree/build workspace. Created no clone, worktree, image, volume, or persistent container. Temporary shell containers used the pinned image with --rm; no local ARM image was pulled while C: was below the gate.

Remote CI result

All required checks passed on commit 3865ae329c92769dbe48753f6ec1bd8b00b88e11:

• format: 18 seconds
• focused 58-test shell integration gate: 50 seconds
• affected Bloom Shell ARM build: 1 minute 11 seconds
• native tests: 1 minute 20 seconds
• AddressSanitizer: 1 minute 26 seconds
• scoped static analysis: 2 minutes 8 seconds