[boburning]

Summary

• let valid Wi-Fi timer wake events reach Bloom Shell's existing render path
• preserve every ordinary input guard for connect, recovery, forget, credential, confirmation, and detail overlays
• lock all six no-action guard exceptions into the affected Shell contract

Root cause

PR #584 corrected the Wi-Fi event type from the invalid SDL 1.2 value 32 to valid user-event value 26. Current Mini Plus evidence confirms that correction works: the timer now polls and reaps the completed bloomctl network connect status child.

The same timer event carries no user action. Each Wi-Fi overlay therefore reached its final “active/open” catch-all and immediately continued before the shared render call. After terminal polling removed the timer, no later event repainted the ready state, leaving the framebuffer permanently on Checking Wi-Fi safety... even though the backend had completed successfully.

This correction identifies only WIFI_EVENT_TYPE as a redraw event and exempts it from those six terminal no-action guards. It does not bypass action-specific validation or permit any additional input or network mutation.

Host validation

• clang-format 21.1.8: pass
• GNU C18 strict syntax with SDL 1.2 headers, -Wall -Wextra -Werror: pass
• focused bloom_shell_settings.bats: 7/7 pass
• CI scope regression: pass
• focused cppcheck 2.19: pass with existing informational/style findings only
• canonical manifest/provenance/transfer/dependency preflight: pass once (332 components, 2,131 files, 314,689,731 bytes)
• git diff --check: pass

Device evidence before correction

• USB-powered Mini Plus, active signed fix(shell): keep Wi-Fi polling inside SDL 1.2 event range #584 Shell overlay, Shell PID 3582
• deterministic SDL console input opened Quick Settings and the Wi-Fi detail surface without selecting any mutating action
• exact installed bloomctl network connect status returned canonical idle/inactive JSON immediately
• the completed child was reaped and no Shell child or zombie remained, proving the fix(shell): keep Wi-Fi polling inside SDL 1.2 event range #584 timer event was delivered and polled
• two framebuffer samples with no intervening input retained Checking Wi-Fi safety..., proving the terminal controller state was not redrawn
• session remained IDLE, Wi-Fi remained associated, transaction remained idle, listener audit remained clean, and the disposable input candidate was removed

Signed device gate

• all required PR checks passed: format 15s, Shell 35s, native 1m16s, ARM 1m24s, AddressSanitizer 1m38s, static analysis 3m21s
• protected hardware workflow: https://github.com/boburning/BloomOS/actions/runs/33332440125 (pass, 8m03s)
• exact source/head: 29e79e5af3b210db193eb994834bb4bfe99e815f
• signed release: BloomOS-v0.1.0-dev-29e79e5a.zip, 199,851,472 bytes, SHA-256 2506f87e2bd26f15ac3ddd7908c568d0da5de3ee0095ca259b0b38ebd07704c4
• manifest SHA-256 ab9452a23bdb537513c8489023c22cd71929b1cff92358cbcd51a5384a5182f7; Ed25519 signature verified against the repository release public key
• payload-manifest SHA-256 0cff0cea29caf9110f009a5336057d4d8da61a5417d947a1789e178c25e620ba; release metadata and payload recomputation passed
• signed Shell: 514,664 bytes, SHA-256 56540689853e387db76041a636934863b55d83397cf335379e9c51dcd7a5c4ba
• guarded Hot deployment net05-redraw-29e79e5a-20260830 seeded five unchanged files and transferred only the signed Shell; prior signed fix(shell): keep Wi-Fi polling inside SDL 1.2 event range #584 overlay remains the rollback slot
• because the installed deploy helper predates fix(device): recover wedged Shell restarts safely #585, restart used the exact signed artifact's 32,634-byte bounded helper from a verified /tmp path, SHA-256 640af072feec7a0fbfd3bc802f0e940f2df75cbaaec6be90ddc1343b1bcc2167, then removed it
• bounded restart succeeded without reboot or rollback; Shell PID changed from 3582 to 1125 and the guard reached ready
• deterministic SDL input selected Wi-Fi: On / Connected, opened detail, and captured both terminal and settled frames showing Saved networks and Scan for networks; the stale Checking Wi-Fi safety... frame is gone
• no Shell child or zombie remained; B returned to Settings and B returned home
• session remained IDLE, update remained known-good, transaction remained idle/inactive, Wi-Fi retained 192.168.1.180/24, and listener audit remained clean with reviewed key-only SSH
• the temporary input candidate was removed and installed sendkeys remained unchanged at SHA-256 c244bff7f442a5e8e44b97b2db4a4b634d404ad116b45dfd80a2329b20098677

Limitations

• no Wi-Fi radio/profile/credential, route, listener, key, update, reboot, ROM, BIOS, save, or installed helper mutation was performed
• the profile store is intentionally empty, so this does not certify guarded association with a saved profile
• remote Mini Plus input/framebuffer evidence does not certify tactile controls, physical LCD appearance, Original Mini revisions, or Flip

Related: #442, #544, #583, #584, #585, #588.