[boburning]

Summary

• add the first real NET-07 event consumer at the existing metadata job-scheduler boundary
• apply only exact associated or offline observations to due network-required jobs without claiming or executing work
• acknowledge only the same metadata generation after a valid scheduler result
• retry safely by leaving the event pending after malformed input, database/observation failure, or acknowledgement failure
• keep metadata delivery strictly secondary so it cannot restart or roll back healthy Wi-Fi

Dependencies and base

• Base: current main at a00516df975f139d309663bbadb5c7f5bb59d284.
• Depends on the NET-07 event authority and Mini Plus publication merged through NET-07: add bounded connectivity event authority #594 and NET-07: publish Mini Plus connectivity events #596.
• NET-01 is merged through NET-01: add network service v2 and settings authority #481.
• Update and sync consumption remain separate follow-up NET-07 work; this PR does not invent services that do not yet exist.
• Program tracker: Long-term SSD202D autonomous implementation program #434.

Validation

Exact candidate 4c264c153bfe8c58f1b22ff726c41cc65c2ea614:

• all 16 BloomLibraryJobTest tests passed; test execution took 85 ms after the incremental build
• 40/40 affected metadata-consumer, Mini Plus Wi-Fi, and guarded deployment shell tests passed
• POSIX syntax passed for bloom-network-metadata, bloom-wifi, and bloom-dev-deploy
• C CLI syntax passed with GCC warnings enabled
• affected reduced cppcheck gate passed in 9 seconds
• canonical legacy manifest: 333 components, 2,132 files, 314,698,725 bytes
• provenance policy: 7 reviewed components
• transfer policy: 6 bounded roots
• dependency inventory exactly matches the canonical manifest: 229 source-built and 104 unresolved components
• deterministic network-helper manifests now require bloom-network-metadata; incomplete mixed-version bundles are rejected
• git diff --check: passed
• the local pinned ARM toolchain image was absent and was not pulled because C: has only 43.69 GiB free, below the task's 60-GiB no-new-storage gate; exact hosted ARM and exhaustive gates are required before merge

Device evidence

No device mutation has been performed or claimed for this slice. The Mini Plus remains associated on its stable known-good signed runtime and Shell overlay. After the signed exact-candidate build passes, a guarded /tmp-only gate may exercise the consumer only if it can preserve the live station and avoid unsafe library/user-data mutation.

Limitations

• This consumes only the fixed metadata event. The update and sync generations remain pending for their own real owning services.
• The consumer changes only durable metadata-job scheduling state; it does not perform provider networking, download media, claim jobs, run workers, alter ROMs/Saves, or touch credentials.
• No radio toggle, Wi-Fi restart, profile/credential mutation, listener/route mutation, reboot, signed update, or Full deployment is part of this PR.
• Host validation does not certify physical controls, LCD behavior, gameplay, save semantics, Original Mini revisions, or Mini Flip.

Corrective validation

• 4c264c153bfe8c58f1b22ff726c41cc65c2ea614 refreshes the exact manifest/provenance and complete 18-file Warm-bundle fixtures after the first hosted shell run exposed stale expectations.
• Focused rerun: 18/18 affected Bats tests passed; manifest, provenance, transfer-policy, and dependency-inventory preflights passed before Bats.
• The failed prior-head shell run was not manually rerun; pushing this corrective commit created one fresh CI cycle for the exact head.

Exact-head CI and signed Mini Plus gate

Exact head: 4c264c153bfe8c58f1b22ff726c41cc65c2ea614

• Required checks: format 17s; Test build 1m16s; AddressSanitizer 1m50s; shell integration 2m22s; Check build 3m54s; Static analysis 3m56s. All six passed.
• The corrected shell run passed provenance once and completed under the five-minute target; the failed prior-head run was not manually rerun.
• Protected hardware workflow 33337476823 passed in 7m45s for the exact head.
• Signed archive: 199,849,446 bytes; SHA-256 4625898fbfbc72ae71fe73af6daedc2f6b461487194a351f3c49d1562c15d8fe.
• manifest.json SHA-256 4571d03a15d37629138e44ba703eeb2d9ed9ee4602f7b80a45bd570d7b1728cf; 64-byte signature SHA-256 c5aa6c0274cbeb4fae14a9c8223623e113d91b6d9dc7b7592e41f627cf37ce5f; repository Ed25519 verification passed.
• Payload manifest SHA-256 942bc3bcf914adf1fa288fdcea3bffe2b1584f195ade199e88fdacf3b7435ef9; full archive reconstruction/CRC validation passed.
• Packaged candidates: bloom-network 15,071 bytes / fde6eb5852c7ce3f8e889b064687589fd43ea29371fc816ea8fe74d29e4f30bc; bloom-network-metadata 3,711 bytes / dbffcf81db1e5d2ca483bdcfb4e25dec5c22f2db25410420b433dbc7d55871cb; bloom-wifi 10,293 bytes / 1ea6bb698cbd9d97b73e8b9970d7cd3920c3e08466d884154b84062698dbf895; each script is byte-identical to the reviewed tree.
• Packaged bloom-library: 608,980-byte ARM EABI5 hard-float ELF; SHA-256 bcd59d81096664a15c9d14dd800fe8f30f089ace6e33cc2b508b5f6a0a485851; the binary exposes the reviewed network-observe associated|offline command.

A key-only SSH gate ran the signed network and metadata scripts only from unique /tmp paths on the USB-powered Mini Plus. A bounded mock library fixture kept the live catalog database untouched. Synthetic associated generation 1 was observed and exactly acknowledged; synthetic offline generation 2 remained pending after an injected observation failure, then was observed and exactly acknowledged on retry. Candidate byte counts and SHA-256 values matched locally and remotely.

Pre/post state was identical: Bloom Shell PID 1125, wpa_supplicant PID 994, udhcpc PID 1280, 192.168.1.180/24, default route via 192.168.1.1, transaction idle, session IDLE, listener audit clean, and installed update still known-good 0.1.0-dev-2933f706. All candidate, fixture, log, and event files were removed. No radio toggle, Wi-Fi/profile/key/listener/route mutation, process restart, catalog mutation, reboot, or update occurred.

Limitations: this is remote exact-hash process/script evidence, not physical controls, LCD, audio, gameplay, save/state, Mini V1-V4, or Flip certification. The signed ARM library was identity/ABI inspected but deliberately not run against the live catalog; scheduler mutation semantics are covered by the native unit suite and hosted ARM builds.