[boburning]

Program slice

This is DISP-03 — Settings and trusted config-composer integration from the v3 work program. It is based directly on current main at 5967607dad0067cefb9ba73feb209a2c702b77d6; it is not stacked on another open implementation PR.

Related predecessor delivery: #606 (DISP-02 semantic model), with ledger reconciliation in #607.

Summary

• Adds backward-compatible canonical display selections to bloom-settings: Scaling, internal Sampling, Screen Effect, and Bezel. Older schema-1 settings read as Auto; the first mutation creates the complete typed object atomically.
• Keeps display selections out of Onion compatibility materialization and rejects unknown values.
• Adds the guarded bloom-display-session-prepare decorator, driven by canonical settings and observed bloom-platform framebuffer dimensions.
• Extends the existing typed RetroArch composer with display-owned keys and safe empty-value support. Display and RetroAchievements contributions now merge into exactly one private 0600 session config.
• Activates the session transaction's previously reserved display-decorator seam. Helper failure or timeout preserves the immutable base launch; an RA degradation preserves an already validated display config.
• Adds the new helper to host/device Warm-bundle allowlists, provenance inventory, dependency totals, focused tests, and the 1.0 test matrix.

Safety and behavior

• Auto does not rewrite an axis from the DISP-01 baseline.
• fill, nearest/linear sampling, effect none, and bezel none have complete typed implementations.
• Source-dependent Integer Pixels and Correct Aspect degrade that axis to Auto until trusted core AV geometry exists.
• LCD/CRT/custom effect and custom bezel degrade that axis to Auto until DISP-04/DISP-05 provide reviewed identities.
• Custom selections never become raw filesystem paths.
• No global RetroArch config, inherited override, network setting, Wi-Fi profile, credential, ROM, Save, or user-data path is mutated.

Validation

• Native host suite: 593/593 passed in 16.1 seconds.
• Focused settings/launch/composer native suite: 64/64 passed.
• Final focused display/session/RA/deployment/provenance/device suite: 115/115 passed.
• Canonical shell gate: 792/792 passed across 8 shards after manifest, provenance, transfer-policy, and dependency-inventory preflights.
• Targeted cppcheck for src/bloomLaunch and src/bloomSettings: exited successfully with no new blocking diagnostic.
• sh -n and host C syntax checks passed for the affected helpers and translation units.
• Required GitHub gates passed at implementation commit 6050dde80e9b821fd527ef2498ab1a63f1e4d67e: Check build, format, shell-test, Static analysis, Test build, and AddressSanitizer.

Device evidence

• Signed hardware build: run 33345813017, version 0.1.0-dev-6050dde8; archive size 199862348, SHA-256 66904930f2c076ab122b4af26b8010403c178002519106afdeaa147089d7da40. SHA256SUMS, release metadata, and the Ed25519 manifest signature verified. The artifact was used only as the byte source for a Warm overlay; no Full update was installed.
• Mini Plus model ID 354 passed guarded key-only preflight. All 11 sealed launch-session files matched their manifest before and after activation of disp03-launch-6050dde8.
• The installed older settings service omitted the new display object; the candidate correctly produced the four-axis Auto fallback and a private 0600 config containing only video_fullscreen = "true".
• Direct ARM composition of Fill + nearest + effect none + bezel none against the observed 640×480 framebuffer produced the bounded allowlisted viewport/sampling/effect/artwork keys in a private 0600 config.
• The canonical session remained IDLE and no RetroArch process, ROM, Save, credential, or user-data path was used. Wi-Fi remained enabled and associated before, during, and after every guarded restart; no network component or setting was deployed or mutated.
• Global retroarch.cfg remained 336ee748ca06bba32582087efc867f811f465558df158056b9a25689bf36672e; canonical settings remained 31fe5ad0969bc8a9e831d10b77752da4712b30d0b96082c8243a6fa495316c9d.
• The candidate rolled back, its helper and task configs were absent, the exact temporary deployer was removed, and the current merged Shell bundle was restored as disp03-shell-restore-6050dde8 with readiness green.
• Structured evidence and the privacy-safe post-restore framebuffer capture are committed in docs/validation/display/plus-disp03-settings-composer-20260831.json and docs/validation/display/disp03-20260831/shell-restored.png.

Limitations

• No LCD/CRT built-in profile ships here; that belongs to DISP-04.
• No custom effect/bezel pack ships here; that belongs to DISP-05.
• Trusted source raster/aspect wiring is not yet available, so Integer Pixels and Correct Aspect report bounded degradation rather than guessing.
• This PR does not add a new visual settings UI surface.
• Mini Plus evidence is remote config/process/framebuffer evidence only. It does not certify physical controls, LCD quality, audio, gameplay, Mini V1-V4, or Mini Flip/my285.
• The device gate intentionally did not launch a ROM; full gameplay/display-profile review belongs to DISP-04 after reviewed built-in profiles exist.