docs(program): record Mini Plus SDL input gate

docs/program/BloomOS_Work_Program_v3.json

@@ -1,9 +1,9 @@
 {
   "schema": 1,
   "program_version": "3.0",
-  "generated_at": "2026-08-25T08:47:49Z",
+  "generated_at": "2026-08-30T19:37:23Z",
   "repository": "boburning/BloomOS",
-  "audited_main": "4d0fd6fb242ffdf1826be3ce0cb95377e7fc4d42",
+  "audited_main": "629e8d590ebef200cafcbd7bae4e013ffec079c3",
   "product_scope": {
     "hardware_family": "miyoo-ssd202d",
     "targets": [
@@ -31,9 +31,9 @@
   },
   "current_phase": "governed_future_work",
   "recovery_live_state": {
-    "audited_at": "2026-08-25T07:20:20Z",
-    "origin_main": "d4901c26abb81eb567c63399e5c045da4b448eab",
-    "clean_worktree": "feature/recovery-v3-f1b-closeout",
+    "audited_at": "2026-08-30T19:37:23Z",
+    "origin_main": "629e8d590ebef200cafcbd7bae4e013ffec079c3",
+    "clean_worktree": "docs/net05-input-gate-ledger",
     "preserved_old_plan_pr7": {
       "branch": "feature/ssd202d-network-foundation",
       "head": "3bf62d5ccb10a0b7ddbba4c87db6c51f3bf2ec92",
@@ -43,17 +43,17 @@
     "device": {
       "profile": "bloom-plus",
       "model": "mini_plus",
-      "installed_version": "v0.1.0-dev-d4901c26",
+      "installed_version": "v0.1.0-dev-2933f706",
       "update_phase": "known_good",
       "health": "healthy",
-      "session": "stopped_terminal_no_active_process",
+      "session": "canonical_idle_shell_pid_3582",
       "unowned_game_process": false,
       "developer_ssh": "running_key_only",
       "listener_audit": "clean_key_only_ssh",
       "deployment_authorization": "local_marker_present",
-      "network_mutation_authorization": "not_reaudited_after_recovery",
+      "network_mutation_authorization": "not_exercised_by_input_gate",
       "network_transaction": "confirmed_idle_recovery_lease_inactive",
-      "component_overlay": "inactive"
+      "component_overlay": "active_signed_net05_sdl_event_7bf5930e_r3"
     }
   },
   "pr_snapshot": [
@@ -935,12 +935,13 @@
         582,
         583,
         584,
-        585
+        585,
+        588
       ],
       "risk_tier": 1,
       "deployment_tier": "hot",
       "device_gate_required": true,
-      "last_audited_main": "94104f65ab78117960093cbbbc4f7f9eaf44475c",
+      "last_audited_main": "629e8d590ebef200cafcbd7bae4e013ffec079c3",
       "evidence": [
         "issue #544 tracks NET-05 on current main after merged NET-04A-D and UI-05; the audit found that Bloom Shell still treats Wi-Fi as an inline toggle whose A and left/right handlers synchronously call bloom-network enable or disable instead of opening the bounded profile and scan UI",
         "the first host-safe slice adds an explicit local credential-free projection of at most 16 validated profile IDs, printable SSIDs, security classes, hidden flags, and one active marker; the private service never returns a PSK and the Shell model rejects unknown or credential-bearing fields",
@@ -1056,6 +1057,7 @@
         "the signed #584 corrective candidate used source commit 7bf5930eaf03478dcf8a865dcbf8bf4606fd7df9, version 0.1.0-dev-7bf5930e, archive SHA-256 fd5db4ed66e5bacf4b561b703b4a2b0f965fdd52da803b2518f3827bd9c3b217, and bloom-shell SHA-256 9c9c6d38ab01743047dc306b83b0ec20e7b57f4f70365c18518e3a83e79c2516; the guarded Hot overlay remained associated on the existing Mini Plus route, reached structured Shell ready state, retained an IDLE session and clean reviewed key-only SSH listener, and changed no Wi-Fi radio, profile, credential, key, listener, route, or update transaction state",
         "GitHub PR #584 keeps the Wi-Fi timer inside SDL 1.2's valid user-event range with a compile-time bound, passed formatting in 15 seconds, the affected Shell gate in 43 seconds, the affected ARM build in 1 minute 14 seconds, AddressSanitizer in 1 minute 24 seconds, native tests in 1 minute 40 seconds, static analysis in 3 minutes 24 seconds, and the signed hardware workflow in 8 minutes 15 seconds, then merged by squash as 4941cd8bb247bb2fcf0294dcaa5ef74133bcf0a9",
         "GitHub PR #585 hardens unattended Hot and Warm recovery by escalating only the exact retained Bloom Shell or keymon PID after a bounded TERM grace; all 741 local Shell tests passed with a 97-second slowest shard, hosted Shell CI passed in 2 minutes 22 seconds, and it merged by squash as 25e1e2030b2cf2e18ac7d04c1be15410ce80a5ea; the active signed #584 Shell overlay was left untouched and read-only follow-up confirmed known-good update state, healthy aggregate status, ready Shell guard, IDLE session, associated Wi-Fi with default route, idle network transaction, no pending Shell signal, and only the reviewed key-only SSH listener",
+        "GitHub PR #588 adds an explicit developer-only SDL console injection mode after read-only Mini Plus inspection proved that Bloom Shell consumes /dev/tty2 while the inherited helper wrote only /dev/input/event0; the exact cd6ddfe00afd38ee7cd8700d74e03cd742d87f4a candidate passed all required hosted gates and a signed 7-minute-47-second hardware build, then a strict key-only /tmp-only device gate verified candidate size and SHA-256, opened and closed Quick Settings with START, retained Wi-Fi On / Connected, IDLE session, Shell PID 3582, idle transaction and clean listener state, removed the temporary candidate, and proved the installed helper unchanged before merging as 629e8d590ebef200cafcbd7bae4e013ffec079c3",
         "NET-05 remains in progress because the profile store is intentionally empty and the final privacy-safe physical Quick Settings and Wi-Fi-detail walkthrough has not yet been observed; remote framebuffer, process, session, resource, association, route, listener, and signed-artifact evidence does not certify physical controls, LCD appearance, Original Mini variants, or Flip hardware"
       ]
     },