[boburning]

Summary

• give Bloom Shell and keymon a bounded TERM grace during guarded Hot/Warm restart and rollback
• if, and only if, the exact old PID is still the sole named process after that grace, escalate that PID once with KILL
• retain the existing 20-second overall readiness deadline and automatic byte rollback
• make the signal and sleep adapters injectable so the safety boundary is covered without killing host processes
• refresh the exact inherited-component identity and dependency byte total

This is a recovery hardening follow-up to #584 and supports the unattended NET-05 workflow tracked by #544.

Why

During the signed Mini Plus corrective deployment for #584, the old Bloom Shell PID retained a pending TERM signal while wedged in its SDL wait. The deployer correctly restored bytes but could not complete the supervised restart until that exact retained PID was killed manually. That left an unattended Hot deployment unable to recover even though the runtime supervisor, network association, key-only SSH listener, and signed rollback state were healthy.

The new path preserves graceful termination as the default. Escalation occurs only after 20 bounded 250 ms observations, only when pidof still resolves exactly one process, and only when that PID is the same PID originally sent TERM. A replacement process is never signaled by this path.

Validation

• POSIX syntax check: pass
• focused new wedged-PID test: 1/1 pass
• test/shell/dev_deploy.bats: 17/17 pass in 14 seconds
• exhaustive pinned shell gate: 741/741 pass across 8 shards; slowest shard 97 seconds
• legacy manifest: 332 components, pass
• provenance policy: 7 components, pass
• transfer policy: 6 roots, pass
• dependency inventory: 332 components, 2,131 files, 314,689,731 bytes, pass
• CI scope regression tests: pass
• git diff --check: pass

Device evidence

The motivating failure was observed on the USB-powered Miyoo Mini Plus while running the signed #584 candidate. The exact old Bloom Shell PID remained after TERM; killing only that retained PID allowed the existing runtime supervisor to reap it and launch the corrected Shell. The replacement Shell reached structured ready state, the prior PID disappeared, Wi-Fi remained associated with its existing IPv4/default route, the reviewed key-only SSH listener remained clean, and the active session remained IDLE.

No device filesystem or network mutation is needed to validate this host-side policy change. The currently running Mini Plus overlay remains the signed #584 Shell candidate and is deliberately not replaced by this PR.

Dependencies and limitations

• base: current main after merged fix(shell): keep Wi-Fi polling inside SDL 1.2 event range #584
• no Wi-Fi radio, profile, credential, listener, key, route, update-state, or reboot mutation
• no direct Mini Plus deployment of this helper in this PR; it will enter the next coherent signed Full payload, because replacing the deployment authority itself is not worth another live network-helper mutation
• remote evidence does not certify physical buttons, LCD appearance, audio, gameplay, save semantics, Original Mini variants, or Flip hardware

Closes no issue; follow-up to #544 and #584.