[boburning]

Summary

Completes the remaining NET-07 client fan-out by adding a fixed bloom-network-sync event consumer and wiring it after canonical Wi-Fi connectivity publication.

• validates the exact sync event schema and generation before acknowledgement
• records engine_unavailable while SYNC-01/02 have no save-bundle contract or transport-neutral engine
• records offline for offline observations
• performs no Save access, filesystem sync, network transport, download, or update action
• keeps sync-consumer failure secondary to healthy Wi-Fi ownership
• includes the consumer in the transaction-authorized 20-file network-helper Warm bundle
• updates exact legacy provenance and dependency inventory

Base and dependencies

Base: main at b90f5ecb9d8633771838fe2b139b415b2e9eeb99.

This depends only on merged NET-07 work: #592 (time opportunity), #594 (event authority), #596 (Wi-Fi publisher), #598 (metadata consumer), and #600 (update consumer). It is not stacked on an unmerged PR.

Refs #434.

Validation

Exact head: 5645289c7419f0e5d6514ef4b63248043597fb0b.

• shell syntax validation for bloom-network-sync and bloom-wifi
• Python bytecode validation for both manifest tools
• 60/60 focused sync, Wi-Fi, transfer-policy, deployment, and legacy-manifest tests
• 780/780 canonical read-only shell tests across 8 shards; slowest shard 92 seconds
• hosted exhaustive shell workflow 33340250150 passed on the first run in 2m15s; no native, ASan, Cppcheck, or ARM PR workflow was path-triggered
• signed hardware workflow 33340272502 passed in 7m59s for the exact head
• legacy manifest: 335 components
• provenance policy: 7 components
• transfer policy: 6 roots (5 read-write, 1 read-only)
• dependency inventory: 335 components, 2,134 files, 314,704,844 bytes; 231 source-built and 104 unresolved
• git diff --check

Device evidence

Signed workflow 33340272502 produced BloomOS-v0.1.0-dev-5645289c.zip (199,852,386 bytes, SHA-256 2301645832a4e24869ab8194e14f6e6af1b04b6709dd356c11a1ea8ed31ab1ed). Its Ed25519 manifest signature verified, release metadata reconstructed the complete payload, and packaged bloom-network (15,071 bytes, fde6eb5852c7ce3f8e889b064687589fd43ea29371fc816ea8fe74d29e4f30bc), bloom-network-sync (2,845 bytes, 73abd13a7cc092581b8392413762b027129695e14e2bf058240ea9ce18bf974a), and bloom-wifi (10,607 bytes, 347933508bb3e68a85c61b98e211a0d5892c68bae27d6eac7bcf7e54670732ff) were byte-identical to the reviewed tree.

A strict pinned-key Mini Plus /tmp-only gate published synthetic associated generation 1, proved an injected acknowledgement failure retained it pending, acknowledged it with engine_unavailable, then published and acknowledged synthetic offline generation 2 with offline. Shell PID 1125, wpa_supplicant PID 994, udhcpc PID 1280, association, IP, route, IDLE session, known-good 0.1.0-dev-2933f706 update state, idle network transaction, aggregate health, and clean key-only listener audit were identical before and after. The candidate did not execute bloom-wifi, access Saves, start a transport, modify profiles/keys/listeners/routes, stage an update, or reboot. All temporary device files were removed.

Limitations

• This does not implement SYNC-01 through SYNC-04, a Save Sync engine, conflict handling, or any transport adapter.
• It does not claim physical controls, LCD, audio, gameplay, save semantics, Mini V1-V4, or Flip certification.
• No consumer-facing update is required for this isolated event-disposition gate.