[boburning]

Summary

• keep Bloom Shell's Wi-Fi polling timer inside SDL 1.2's valid user-event range
• add a compile-time assertion that the Wi-Fi event remains below SDL_NUMEVENTS
• lock the SDL 1.2 event assignment into the affected Shell contract test

This is a focused corrective follow-up to #583 and the v3 NET-05 Wi-Fi UI work. It fixes the device-observed state where the Wi-Fi detail surface remained on Checking Wi-Fi safety... even though the read-only backend request had completed.

Root cause

Bloom Shell is built against SDL 1.2, where SDL_USEREVENT is 24 and SDL_NUMEVENTS is 32. The Wi-Fi timer used SDL_USEREVENT + 8, which evaluates to the out-of-range event type 32. SDL_PushEvent therefore rejected the timer event, so the completed bloomctl network connect status child was never polled or reaped.

The fix uses the previously unused valid slot SDL_USEREVENT + 2 and enforces the range at compile time.

Validation

• gcc -std=gnu18 -fsyntax-only -Wall -Wextra ... src/bloomShell/main.c against Ubuntu SDL 1.2 headers: pass
• SDL header identity: SDL_USEREVENT=24, SDL_NUMEVENTS=32
• focused SDL 1.2 timer/SDL_WaitEvent reproduction: event type 26 is delivered and wakes the wait (valid=26 result=0 numevents=32)
• affected Shell Bats set (bloom_shell_runtime, bloom_shell_safe_mode, bloom_shell_settings, bloom_typography, gameswitcher_controls): 48/48 pass in 20.8 s
• cached ASan native BloomShell*:BloomFrontend*: 212/212 pass in 12.6 s
• clang-format 21.1.8 --dry-run --Werror src/bloomShell/main.c: pass
• git diff --check: pass

The risk-scoped CI build/static-analysis jobs remain authoritative for the ARM consumer and changed-file cppcheck gate. A redundant broad local cppcheck pass was stopped after it began reporting unchanged legacy style findings; no cppcheck suppression or pipeline bypass is included.

Device evidence

Observed on the USB-powered Mini Plus running the signed, unconfirmed v0.1.0-dev-2933f706 candidate:

• Wi-Fi remained associated at the same LAN address and the reviewed key-only SSH listener audit stayed clean
• bloomctl network connect status completed immediately with canonical idle/inactive status
• Bloom Shell continued to render but retained a completed zombie [bloomctl] child whose parent was the live Shell process
• the Wi-Fi detail surface remained on Checking Wi-Fi safety...
• Shell guard remained ready with zero failures; there was no crash or device rollback

No radio toggle, Wi-Fi profile mutation, credential operation, update confirmation, or reboot was used to diagnose this issue.

After CI and the protected signed hardware build pass, the exact signed branch artifact is Hot-deployed with the guarded component deployer. Device acceptance requires the child to be reaped, the status surface to leave Checking Wi-Fi safety..., and Wi-Fi, listener, session, resource, and update invariants to remain stable. The otherwise healthy 2933f706 Full base was confirmed only to exit the state-machine lock without deliberately causing more multi-boot rollback cycles; the signed corrective Shell overlay remains explicit until the next coherent Full checkpoint supersedes that transitional base.

Signed branch candidate

• protected workflow: https://github.com/boburning/BloomOS/actions/runs/33327230264 (pass, 8m15s)
• exact source commit: 7bf5930eaf03478dcf8a865dcbf8bf4606fd7df9
• version: 0.1.0-dev-7bf5930e
• archive size: 199847901 bytes
• archive SHA-256: fd5db4ed66e5bacf4b561b703b4a2b0f965fdd52da803b2518f3827bd9c3b217
• payload-manifest SHA-256: 23c4373c3ec739688aca0cf30723487af50c48570fecc25f7535fde9b6ce6eb5
• release metadata validation: pass
• Ed25519 signature verification against the retained BloomOS release public key: pass
• signed bloom-shell SHA-256: 9c9c6d38ab01743047dc306b83b0ec20e7b57f4f70365c18518e3a83e79c2516

Hot deployment result

• the otherwise healthy 2933f706 Full base was confirmed to exit the update testing lock without another multi-boot rollback cycle
• guarded deployment net05-sdl-event-7bf5930e-r3-20260830 is active
• the old wedged Shell PID 2288 was reaped; replacement PID 3582 is guard-ready with three threads
• the stale [bloomctl] zombie is gone
• session remains IDLE; update state remains known_good; no device reboot occurred
• Wi-Fi remained associated at 192.168.1.180/24; default route and key-only SSH remained available
• listener audit is clean with only reviewed key-only SSH
• no Wi-Fi profile, credential, radio, or network-transaction mutation occurred

The automated framebuffer is coherent on the restarted PICO-8 root surface. The software input injector is not reaching the fresh SDL process, so the final Wi-Fi detail screenshot/status transition remains pending one physical START navigation. This is reported as a limitation rather than inferred as passed.

Dependencies and limitations

• base: current upstream main at the squash merge of NET-05: wire guarded Wi-Fi connect lifecycle #583
• dependency: NET-05: wire guarded Wi-Fi connect lifecycle #583
• tracking: NET-05: replace direct Wi-Fi toggle with bounded profile UI #544
• remote Mini Plus evidence does not certify physical controls, display quality, audio, gameplay, saves, Mini V1-V4, or Mini Flip behavior
• the device currently has no initialized Bloom-managed Wi-Fi profile store, so this fix does not claim a real profile association transaction
• no Full update is required for this single corrective slice; signed Hot/Warm validation is the intended gate before the next coherent integrated update