[boburning]

NET-07 slice

This is the update-client follow-up to merged event authority/publication/metadata slices #594, #596, and #598.

Summary

• adds bloom-network-update, a fixed exact-generation consumer for the update event client
• gives associated events the explicit provider_unconfigured disposition because BloomOS has no configured public release provider; offline events receive the explicit offline disposition
• performs no network I/O, download, staging, update activation, or installed-state mutation
• removes the automatic inherited Onion OTA check from normal network reconciliation, including its TLS-bypassing path and ephemeral legacy markers
• runs metadata and update consumers independently after successful station-owned publication; either consumer can fail without restarting or rolling back Wi-Fi
• expands the guarded Warm network bundle to the complete 19-file authority set
• leaves sync event consumption as the remaining NET-07 client integration

Dependency and base

Base: current upstream main at 41c9b6ecfcd432a1479b04d90a9790f4eb5dc2d8.

This slice depends only on already-merged NET-07 work. It is not stacked on another open PR. No issue currently tracks NET-07 and no open PR duplicates this slice.

Validation

Exact candidate: fdda8cd11394d4b4f5169b2b95c7afd34e5ce7fe

• shell syntax: new consumer, Wi-Fi owner, compatibility network script, and guarded deployment helper
• Python compile: deployment-manifest and legacy-manifest tools
• focused Bats: 59/59 passed across update consumer, Wi-Fi backend, transfer policy, guarded deployment, and legacy manifest
• legacy manifest: 334 components
• provenance policy: 7 components
• transfer policy: 6 roots (5 read-write, 1 read-only)
• dependency inventory: 334 components, 2,133 files, 314,701,761 bytes; 230 source-built and 104 unresolved
• git diff --check

Device evidence and limitations

No device mutation was performed before publication. This host-safe slice neither requires nor attempts a Full update. After required CI and exact signed packaging pass, device validation will use signed scripts from unique /tmp paths with synthetic event state only. It will not invoke the inherited OTA script, toggle the radio, mutate profiles/keys/listeners/routes, restart network processes, stage an update, reboot, or touch the live catalog.

BloomOS still has no public update provider or public release process; this PR intentionally records that disposition rather than inventing a downloader or treating the shell-test-inputs-v1 tooling release as firmware. Manual signed update staging/rollback remains unchanged. Remote Mini Plus evidence will not certify physical controls, LCD, audio, gameplay, saves/states, Mini V1-V4, or Flip.

Exact-head CI, signed artifact, and Mini Plus gate

• Required PR shell gate passed in 2m10s for exact head fdda8cd11394d4b4f5169b2b95c7afd34e5ce7fe.
• Protected hardware workflow 33338726619 passed in 7m50s for that exact head.
• Signed archive: 199,839,374 bytes; SHA-256 5f5453233e6a790d3142af7c0b4f3889cf46a1640bc1d2b3984375ddbd639962.
• manifest.json SHA-256 787293fb5a389020478f8b3a67518068f7e83fc0f5a19139b1e57d7f40f1c53d; 64-byte signature SHA-256 87583a7129f32350000f1ee7d811d083e47fb82d1827db58ac20dd698639660b; repository Ed25519 verification passed.
• Payload manifest SHA-256 85964485dcc95b579c3dd5f11469ce6db6dfcc71057921d03b92dacef76d23f3; full archive reconstruction/CRC validation passed.
• Packaged signed scripts were byte-identical to the reviewed tree: bloom-network 15,071 bytes / fde6eb5852c7ce3f8e889b064687589fd43ea29371fc816ea8fe74d29e4f30bc; bloom-network-update 2,972 bytes / 0504515f7f1a6adbdc48ef134b30c1777484f96ced26f774fa66cce3b05ee922; bloom-wifi 10,455 bytes / 819cae74b39d1751264a140312f5a525b2340abb92d31a92c55d4f2ef35f558d.

A strict pinned-key Mini Plus gate ran those candidates only from unique /tmp paths. It published synthetic associated generation 1, proved an injected acknowledgement failure left the update event pending, then received provider_unconfigured and acknowledged the exact generation. Synthetic offline generation 2 received offline and was exactly acknowledged. No OTA process existed before or after.

Pre/post state was identical: Bloom Shell PID 1125, wpa_supplicant PID 994, udhcpc PID 1280, 192.168.1.180/24, default route via 192.168.1.1, transaction idle, session IDLE, listener audit clean, and installed update still known-good 0.1.0-dev-2933f706. Existing zero-byte legacy /tmp/update_checked and .tmp_update/.updateAvailable markers were byte-identical before/after; the gate intentionally did not mutate installed legacy state. All candidate, fixture, and synthetic event files were removed.

No radio toggle, Wi-Fi/profile/key/listener/route mutation, process restart, download, update staging, reboot, or catalog mutation occurred. This remains remote exact-hash evidence, not physical controls, LCD, audio, gameplay, save/state, Mini V1-V4, or Flip certification.