[boburning]

Summary

• continues NET-05 after merged PR feat(network): derive safe Wi-Fi profile handles (NET-05) #552 with one event-loop-independent owner for the mapped credential form and its nonblocking upsert request
• admits keyboard input only in the editing state and limits shared-keyboard movement to WPA2 forms
• polls submission only at 100-ms monotonic opportunities and preserves the existing five-second child deadline
• clears the entire form on success, failure, cancellation, and teardown; submission still clears the password before returning
• kills and reaps the exact request process group when editing or submission is cancelled
• retains only a bounded non-secret list row so a later rendered slice can restore focus deterministically
• documents the lifecycle in architecture, security, development guidance, the 1.0 test matrix, and the v3 ledger

Dependency and scope

Base: current main at 7c67002caf89e767d318d97f751a0b92e93d827e.

Dependency: PR #552 is merged into the base. This is the next host-only NET-05 slice tracked by #544 and is not stacked on an unmerged branch.

The controller has no rendered or runtime consumer in this PR. It cannot scan, associate, project a profile, restart or disable Wi-Fi, forget a profile, reboot a device, or activate an update.

Validation

• 14/14 focused BloomShellWifiUi* native tests passed; 639 ms test execution
• 14/14 focused BloomShellWifiUi* AddressSanitizer tests passed; 784 ms test execution
• 58/58 affected shell tests passed in one invocation covering platform, core policy, critical surfaces, profile service, and scan service
• legacy manifest, provenance policy with required files, transfer policy, and dependency inventory passed once as part of that shell invocation
• changed C and header files passed clang-format 21.1.8 dry-run with --Werror
• the changed C module passed GNU C18 -Wall -Wextra -Werror host compilation
• focused cppcheck 2.19 completed successfully; emitted only its expected single-translation-unit informational/style findings
• BloomOS_Work_Program_v3.json passed JSON parsing
• git diff --check passed

Current-head GitHub CI passed: formatting in 16 seconds, all affected shell tests in 55 seconds, native tests in 1 minute 8 seconds, AddressSanitizer in 1 minute 19 seconds, the ARM/check build in 1 minute 29 seconds, and scoped static analysis in 2 minutes 16 seconds.

Device evidence

No device candidate was built, installed, or activated for this host-only slice. The connected Mini Plus remained untouched on its known-good signed baseline; no SSH command, Wi-Fi transition, profile mutation, reboot, or update was performed. This PR makes no physical-hardware certification claim.

Limitations and follow-up

• the controller is deliberately unreachable from the SDL render/input loop until the follow-up integration owns input focus, cancellation, and return behavior end to end
• successful upsert does not associate or project the profile; guarded association remains a separate transaction-backed slice
• open networks bypass keyboard movement and secret entry; WPA2 still requires the existing 8-63 printable characters or exact 64-hex PSK validation
• synthetic host fixtures do not certify physical controls, LCD behavior, association recovery, Mini V1-V4, or Flip/my285

Issue: #544
Parent program: #434