[boburning]

Summary

• add numbered Full-update migration 00024_remove_retired_network_configs.sh
• remove exactly the preserved config/filebrowser, config/bftpd.conf, and config/bftpdauth.conf retirement remnants
• unlink legacy symlinks without following them and preserve every unrelated configuration path
• keep the operation idempotent and avoid reading database, theme, or credential contents
• route the change through risk tier 3, exhaustive Shell, full ARM/package, provenance, and FAT-payload validation
• regenerate the inherited inventory to 327 components, 1,969 files, and 260,665,275 bytes

Closes #629.

Base

Based on merged PR #646 (aeaa3ec3b686083673363d33825a265123035aaf), whose exact signed Mini Plus candidate is confirmed known-good.

Validation

• dedicated migration behavior: 2/2 passed
• original affected CI/listener/manifest/provenance/FAT selection: 47/47 passed
• final focused SSH/migration/listener evidence selection: 30/30 passed
• CI scope and ARM orchestration contract: passed
• exact pinned PixelReader, zlib, libxml2, and libzip provenance submodules initialized
• legacy manifest and dependency inventory: canonical
• initial implementation head 32b9639631f85dc650d62c8476044e84ba0dedd5 passed all six required hosted checks
• signed workflow 33468134131 produced 0.1.0-dev-32b96396; the 185,671,287-byte archive matched SHA-256 483075fbc0bf19c9d62960a3d03e8bf5de38e71411e07877f24aeee6b8bb0b35, with valid metadata, payload inventory, and Ed25519 signature
• packaged migration SHA-256: 14f963188d4df492fcf0f0b7962dcd8d7f7763f01d192161856f96e8a1f9b947
• durable evidence: docs/validation/network/plus-retired-network-config-migration-20260901.json

Device result and boundary

The signed Mini Plus installation ran the migration and removed all three inactive remnants without inspecting their contents. The retired payload audit and stale enablement-flag audit remained empty; Wi-Fi, the sole authorized key, pinned host key, and clean key-only SSH listener boundary were preserved. The migration effect persisted through rollback.

The candidate was not confirmed as known-good. Three unconfirmed boots reached the automatic recovery threshold, and maintainer physical power-on was required after the bounded remote watch. The recovered 0.1.0-dev-3a828a29 rollback—not the candidate—was confirmed known-good with healthy aggregate state, six verified snapshots, idle network transaction, inactive recovery lease and development overlay, no install-failure marker, and cleaned transfer staging.

This certifies the migration effect and safe recovery on one Mini Plus. It does not claim unattended return, candidate-wide certification, physical controls/LCD, audio, gameplay, save semantics, or Mini V1-V4 / Mini Flip behavior.

[boburning]

Signed Mini Plus checkpoint for exact head 32b9639631f85dc650d62c8476044e84ba0dedd5:

• all six required hosted checks passed and the PR is clean to merge
• hardware workflow 33468134131 succeeded
• the 185,671,287-byte archive matched SHA-256 483075fbc0bf19c9d62960a3d03e8bf5de38e71411e07877f24aeee6b8bb0b35
• build metadata matched exact commit/version, release metadata and payload inventory validated, the Ed25519 signature verified, and the migration inside onion.pak matched reviewed source SHA-256 14f963188d4df492fcf0f0b7962dcd8d7f7763f01d192161856f96e8a1f9b947
• baseline was confirmed 0.1.0-dev-3a828a29, aggregate health green, five snapshots verified, network transaction idle, developer overlay inactive, listener audit clean with only key-only SSH, and all three retired config remnants present without reading their contents
• strict transfer completed with exact byte count and device-side SHA-256; stage and prepare passed
• activation created pre-update snapshot 20260901T041533Z-pre-update-1411 and entered activation_pending
• after one controlled reboot, the device went offline at 5 seconds but did not return on the pinned address within the full 20-minute window; ping, TCP/22, and ARP remained absent at 23 minutes
• no second reboot, rollback request, merge, or completion claim was made

A source comparison from the confirmed candidate to this head found no Wi-Fi/network runtime changes; the only added runtime path is 00024_remove_retired_network_configs.sh. Physical power/visible-state access is now required before installed version, rollback outcome, config removal, health, and listeners can be checked. PR #652 remains open and unmerged.

[boburning]

Final signed-device evidence is now committed at head 4185001. The migration passed and its removal persisted through rollback. The candidate itself remains explicitly unconfirmed: the three-boot safeguard recovered 3a828a2, and that rollback was confirmed known-good with green health, six verified snapshots, preserved Wi-Fi/key-only SSH, no install-failure marker, and cleaned transfer staging. Focused evidence validation passed 30/30 plus CI-scope and ARM-orchestration contracts. Waiting only for the rerun hosted checks before merge.

[boburning]

Post-merge verification: PR #652 merged as ca92e79 and issue #629 closed. The device remains on confirmed known-good v0.1.0-dev-3a828a29 with recovered_from 0.1.0-dev-32b96396; aggregate health is healthy, all six snapshots are verified and unreferenced, SSH is running key-only, SFTP and Samba remain disabled, the network transaction is idle with no recovery lease, all three retired configuration paths remain absent, and an independent listener audit is clean with only reviewed key-only SSH. The earlier combined-shell listener alert was measurement contamination from the audit seeing the later filebrowser token in its own SSH command line; the isolated audit had no prohibited listener or process.