feat(shell): forget inactive Wi-Fi profiles safely

build/bloom-typography.json

@@ -96,7 +96,7 @@
     "unclassified_data": "unchanged",
     "fragment_kinds": ["copy", "data"],
     "maximum_fragments": 8,
-    "classified_copy_call_sites": 86,
+    "classified_copy_call_sites": 91,
     "classified_mixed_call_sites": 15
   }
 }

docs/1.0_TEST_MATRIX.md

@@ -50,7 +50,7 @@ shoulder button.
 | Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; Samba hidden until a materially different source-build candidate passes feasibility |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
-| Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, explicit secret clearing, nonblocking submit/poll, 4-KiB acknowledgement cap, exact upsert response, timeout process-group cleanup, exact saved-ID reuse, 104-bit no-follow random new handles, collision/security/full-store rejection, one editing/submitting controller with 100-ms poll opportunities, exact cancellation, terminal clearing, bounded focus return, supported scan-result selection, explicit saved-not-connected result, and no implicit association; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
+| Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, explicit secret clearing, nonblocking submit/poll, 4-KiB acknowledgement cap, exact upsert response, timeout process-group cleanup, exact saved-ID reuse, 104-bit no-follow random new handles, collision/security/full-store rejection, one editing/submitting controller with 100-ms poll opportunities, exact cancellation, terminal clearing, bounded focus return, supported scan-result selection, explicit saved-not-connected result, and no implicit association; explicit inactive-profile X/confirm forget flow; active-row refusal in Shell and store; fixed nonblocking delete; exact acknowledgement; terminal projection reload; graceful TERM cleanup before bounded KILL; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
 | GameSwitcher | MENU open/toggle; Left/Right select; L1/R1 page; A resume; X actions; START Quick Settings; B Home; no inherited brightness/view/delete behavior |
 | Apps/Tweaks | Every app disposition recorded; normal configuration requires no Tweaks; supervised launch remains bounded |
 | Persistent state | Versioned atomic publication; exact restoration across Details/game/GameSwitcher/Quick Settings; malformed/oversized/symlink input defaults without Safe Mode |

docs/ARCHITECTURE.md

@@ -614,6 +614,16 @@ returns to the exact bounded row and reports `Network saved - not connected` on
 success. No result from this surface projects, associates, restarts, enables, or
 disables the station.
 
+Saved-profile management uses a separate fixed nonblocking delete request and
+controller. X is offered only on the saved-profile view, a confirmation dialog
+precedes submission, and both the Shell snapshot and private profile service
+refuse the projected active profile. Terminal and cancellation paths reload the
+credential-free projection because publication may have completed before an
+acknowledgement was read. Process teardown sends TERM first so the profile
+service can remove its exact lock and incoming file, then uses a bounded KILL
+fallback. Reopening Wi-Fi resets terminal scan presentation before loading the
+saved list. Forget never projects, associates, restarts, or disables Wi-Fi.
+
 Profile association reuses the one guarded network-transaction authority rather
 than adding a second recovery mechanism. `begin` copies the exact current
 supplicant file into a mode-0700 JFFS2-private transaction root, records only

docs/DEVELOPMENT.md

@@ -417,6 +417,12 @@ That integration may open the form only from a supported bounded scan row. It
 must label a successful upsert as saved but not connected, return focus to the
 originating row, cancel before GameSwitcher or Shell teardown, and never invoke
 profile projection, association, radio power, DHCP, or listener reconciliation.
+An inactive saved profile may be forgotten only after the explicit X/confirm
+flow. The request must remain fixed-argv and nonblocking, reject the active row
+before spawn, accept only the exact delete acknowledgement, and reload the
+credential-free list on every terminal or cancellation path. Request teardown
+must allow the profile service's TERM trap to clean its private lock and
+incoming candidate before a bounded KILL fallback.
 
 The NET-04 scan slice is asynchronous and keeps result data only under `/tmp`:
 

docs/SECURITY.md

@@ -187,5 +187,11 @@ its initial slice. The rendered follow-up invokes it only from a supported
 bounded scan row, renders password state solely through the masked label, and
 returns a non-secret `saved - not connected` result. It adds no projection,
 association, network transaction, radio, DHCP, listener, reboot, or update path.
+The saved-profile forget surface retains only a bounded non-secret profile ID,
+requires explicit confirmation, and never submits an active row. The private
+store independently refuses its projected profile and publishes deletion
+atomically. A cancelled request reloads the redacted list and first gives the
+service a bounded TERM cleanup opportunity, preventing abandoned private lock
+or incoming-store artifacts before any forced process-group kill.
 
 Security-sensitive migrations and repair operations must be bounded, logged, reversible where possible, and validated before activation.

docs/program/BloomOS_Work_Program_v3.json

@@ -890,12 +890,13 @@
         551,
         552,
         553,
-        554
+        554,
+        555
       ],
       "risk_tier": 1,
       "deployment_tier": "hot",
       "device_gate_required": true,
-      "last_audited_main": "ad66ede878c07e2c7877361ca08feb22b6890f97",
+      "last_audited_main": "736b25dcda4502ee6342f267309a8ec7d16a001b",
       "evidence": [
         "issue #544 tracks NET-05 on current main after merged NET-04A-D and UI-05; the audit found that Bloom Shell still treats Wi-Fi as an inline toggle whose A and left/right handlers synchronously call bloom-network enable or disable instead of opening the bounded profile and scan UI",
         "the first host-safe slice adds an explicit local credential-free projection of at most 16 validated profile IDs, printable SSIDs, security classes, hidden flags, and one active marker; the private service never returns a PSK and the Shell model rejects unknown or credential-bearing fields",
@@ -917,7 +918,9 @@
         "GitHub PR #552 passed formatting in 13 seconds, the complete 58-test affected shell selector in 45 seconds, the affected Bloom Shell ARM build in 1 minute 12 seconds, native tests in 1 minute 15 seconds, AddressSanitizer in 1 minute 22 seconds, and scoped static analysis in 1 minute 45 seconds; it merged by squash as 7c67002caf89e767d318d97f751a0b92e93d827e",
         "GitHub PR #553 gives the credential form one host-only lifecycle owner with editing and submitting states, 100-ms monotonic poll opportunities, input rejection outside editing, exact request cancellation and teardown, terminal form clearing, and a bounded non-secret return row for deterministic focus restoration; it still has no rendered, association, radio, or device consumer",
         "GitHub PR #553 passed formatting in 16 seconds, the complete 58-test affected shell selector in 55 seconds, native tests in 1 minute 8 seconds, AddressSanitizer in 1 minute 19 seconds, the affected Bloom Shell ARM build in 1 minute 29 seconds, and scoped static analysis in 2 minutes 16 seconds; it merged by squash as ad66ede878c07e2c7877361ca08feb22b6890f97",
-        "GitHub PR #554 opens the controller only from a supported bounded scan row, uses the shared masked keyboard for WPA2, stores through the fixed nonblocking upsert request, cancels before GameSwitcher or focus return, reports success explicitly as saved but not connected, and adds no projection, association, radio, DHCP, listener, reboot, update, or device action"
+        "GitHub PR #554 opens the controller only from a supported bounded scan row, uses the shared masked keyboard for WPA2, stores through the fixed nonblocking upsert request, cancels before GameSwitcher or focus return, reports success explicitly as saved but not connected, and adds no projection, association, radio, DHCP, listener, reboot, update, or device action",
+        "GitHub PR #554 passed formatting in 14 seconds, the focused shell workflow in 40 seconds, native tests in 1 minute 21 seconds, AddressSanitizer in 1 minute 26 seconds, the affected Bloom Shell ARM build in 1 minute 36 seconds, and scoped static analysis in 2 minutes 37 seconds; it merged by squash as 736b25dcda4502ee6342f267309a8ec7d16a001b",
+        "GitHub PR #555 adds an explicit X/confirm surface for inactive-profile management, refuses the active profile before spawn and again in the store, uses one fixed nonblocking delete request with exact acknowledgement parsing, reloads the redacted projection after terminal or cancellation state, and gives the service a bounded TERM cleanup window before forced process-group teardown; it adds no projection, association, radio, DHCP, listener, reboot, update, or device action"
       ]
     },
     {