fix(network): remove retired config remnants on upgrade

build/dependencies.lock

@@ -208,8 +208,8 @@ legacy_channels = ["development"]
 manifest = "build/legacy-manifest.json"
 schema = 1
 component_count = 327
-file_count = 1968
-byte_count = 260664576
+file_count = 1969
+byte_count = 260665275
 source_build_components = 233
 unresolved_components = 94
 inherited_baseline = "07505ea58c7bba698d6b9220ff43946a43cac76b"

build/legacy-manifest.json

@@ -2229,9 +2229,9 @@
       "id": "runtime-tmp-update-script-migration",
       "kind": "runtime",
       "path": "static/build/.tmp_update/script/migration",
-      "file_count": 23,
-      "byte_count": 36335,
-      "tree_sha256": "58f53411acd212e820708166fb97c3221cf16750f89e7e53975a60573b94fd34",
+      "file_count": 24,
+      "byte_count": 37034,
+      "tree_sha256": "179d02612a51266aebcce8bd7e234df94c79236cebd2284db29864a4e2c28418",
       "source": "https://github.com/OnionUI/Onion",
       "source_revision": "07505ea58c7bba698d6b9220ff43946a43cac76b",
       "license": "GPL-3.0-only",

docs/1.0_TEST_MATRIX.md

@@ -53,7 +53,7 @@ shoulder button.
 | Critical lifecycle | Exact 640x480 and 752x560 built-in projections; source/target/path and legacy-file rejection; boot/shutdown/save/low-battery/recovery/Safe Mode ignore theme/config/media; charging reflects bounded actual level; installer uses one deterministic surface; missing optional text/font fallback; signed Full-update boot/charging/shutdown/recovery checkpoint |
 | Settings | One sectioned surface; inline values; capability filtering; one-layer details; hidden Developer section; optional overlapping L1/R1 list paging |
 | Quick Settings | START from core surfaces; immediate brightness/volume/mute; capability-gated Wi-Fi opens the dedicated detail surface; Wi-Fi left/right never mutates the radio; readable battery; B/START close |
-| Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; every authenticated developer shell/exec request enters a fixed non-login gate with inherited profile startup disabled; exact SFTP dispatch; missing-gate fail-closed behavior; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot/VNC flags cannot activate listeners, including after an interactive SSH login; process-aware listener audit including inherited TCP/5900 and vncserver; inherited FTP/Telnet/FileBrowser HTTP, rejected Samba, and unresolved VNC launchers, configurations, libraries, and Tweaks exposure absent from newly assembled stable artifacts; WPS progress assets, WPS controls, inherited hotspot controls, and dormant hotspot mutation functions absent while fail-closed entrypoints and older-card process cleanup remain |
+| Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; every authenticated developer shell/exec request enters a fixed non-login gate with inherited profile startup disabled; exact SFTP dispatch; missing-gate fail-closed behavior; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot/VNC flags cannot activate listeners, including after an interactive SSH login; process-aware listener audit including inherited TCP/5900 and vncserver; inherited FTP/Telnet/FileBrowser HTTP, rejected Samba, and unresolved VNC launchers, configurations, libraries, and Tweaks exposure absent from newly assembled stable artifacts; fixed-path, symlink-safe upgrade cleanup removes preserved FileBrowser and FTP configuration without touching unrelated configuration; WPS progress assets, WPS controls, inherited hotspot controls, and dormant hotspot mutation functions absent while fail-closed entrypoints and older-card process cleanup remain |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; sanitized `network connect status` with internal profile-handle validation and public omission; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
 | Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, explicit secret clearing, nonblocking submit/poll, 4-KiB acknowledgement cap, exact upsert response, timeout process-group cleanup, exact saved-ID reuse, 104-bit no-follow random new handles, collision/security/full-store rejection, one editing/submitting controller with 100-ms poll opportunities, exact cancellation, terminal clearing, bounded focus return, supported scan-result selection, explicit saved-not-connected result, and no implicit association; explicit inactive-profile X/confirm forget flow; active-row refusal in Shell and store; fixed nonblocking delete; exact acknowledgement; terminal projection reload; graceful TERM cleanup before bounded KILL; exact guarded-connect status model with fixed phases/operations/failures, lease consistency, 64-byte transaction-ID and 300-second deadline ceilings, and discarded transaction/overlay identity; fixed no-follow `network connect status` loader with less-than-4-KiB output, five-second read ceiling, and stale-state clearing; separately typed single-flight nonblocking status request with process-group timeout and generic-poller refusal; controller-owned single request, 100-ms opportunities, duplicate-begin refusal, typed terminal state, teardown reaping, explicit guarded-state presentation, one-second freshness, fail-closed mutation gating for stale/unavailable/lease-armed/rollback-failed results, read-only refresh without queued intent, and exit teardown; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
@@ -249,8 +249,14 @@ non-login gate with `ENV=/dev/null`, non-interactive execution remained
 functional, password-only authentication and disabled SFTP were refused, and
 an immediate independent audit found no Telnet process or listener. The exact
 candidate was promoted to known-good with aggregate health green. This does not
-certify another device or enabled SFTP, and inactive retired configuration
-remnants found during the Full checkpoint remain under issue #629.
+certify another device or enabled SFTP. The follow-up signed migration and
+automatic-recovery checkpoint is recorded in
+[`validation/network/plus-retired-network-config-migration-20260901.json`](validation/network/plus-retired-network-config-migration-20260901.json).
+It removed all three inactive FileBrowser/FTP configuration remnants without
+inspecting their contents, preserved Wi-Fi, keys, and the key-only listener
+boundary, and retained the removal through rollback. The candidate reached the
+three-unconfirmed-boot safeguard and was not promoted; the recovered
+`3a828a29` release was confirmed known-good with aggregate health green.
 
 ## Exit criteria
 

docs/DEVICE_SUPPORT.md

@@ -65,6 +65,7 @@ Exact device revisions, firmware versions, build commits, test dates, contributo
 | 2026-08-29 | Miyoo Mini Plus (model ID 354) | signed and confirmed `v0.1.0-dev-e69a36de`; workflow run 33231170143 | UI-12 built-in boot, charging, update, recovery, Safe Mode, saving, and shutdown resource adoption | The exact 199,809,395-byte signed archive matched SHA-256 `874188cf...c6386` locally and on-device, created verified snapshot `20260829T034848Z-pre-update-1466`, installed in one update cycle, and was confirmed known-good after two successful boots. The maintainer physically observed the new boot and charging artwork; the controlled poweroff completed. Exact installed binary and lifecycle-resource hashes matched the payload, remote boot/update/recovery/Safe Mode frames had three equal framebuffer pages, and Bloom Shell returned byte-for-byte after the display probes. Wi-Fi association, the sole key, WPA projection, network-helper hashes, listener policy, idle transaction state, five verified snapshots, and aggregate health remained intact. Machine-readable evidence: [`validation/ui/plus-ui12-lifecycle-surfaces-20260829.json`](validation/ui/plus-ui12-lifecycle-surfaces-20260829.json). | The maintainer was not present for the brief Saving/Shutdown artwork, so its physical appearance remains pending even though the actual poweroff completed. Remote frames do not certify tactile controls, physical LCD quality, audio, gameplay, or save semantics. Mini V1-V4 and Flip/my285 remain pending. |
 | 2026-08-31 | Miyoo Mini Plus (model ID 354) | signed and confirmed `v0.1.0-dev-c1fc6624`; workflow run 33455349733 | UI-12 physical Saving and Shutdown lifecycle correction | The exact 185,669,001-byte signed archive matched SHA-256 `d06dbe0f...01f11`, installed over a verified pre-update snapshot, and retained exact installed `bootScreen` and runtime hashes across two boots. The maintainer physically observed both the Saving and Shutdown screens, the device powered off, and it returned on the same exact version. Post-confirmation aggregate health, five verified save snapshots, the idle network transaction, inactive recovery lease, clean key-only SSH listener policy, and inactive development overlay were all green. Machine-readable evidence: [`validation/ui/plus-ui12-shutdown-c1fc6624-20260831.json`](validation/ui/plus-ui12-shutdown-c1fc6624-20260831.json). | This is a maintainer observation without video capture and covers only Mini Plus. It does not certify Mini V1-V4, Flip/my285, audio, gameplay, save semantics, or long-duration soak behavior. |
 | 2026-08-31 | Miyoo Mini Plus (model ID 354) | signed and confirmed `v0.1.0-dev-3a828a29`; workflow run 33464738492 | Interactive developer SSH profile lockdown and inherited Telnet prevention | The exact 185,667,740-byte signed archive matched SHA-256 `bef1ee7c...92427`, installed over verified snapshot `20260901T032842Z-pre-update-3039`, returned automatically in 362 seconds, and was confirmed known-good after one boot. A fresh no-command interactive key-only SSH request entered non-login `/bin/sh` with `ENV=/dev/null`; non-interactive execution remained functional, password-only authentication and disabled SFTP were refused, no Telnet process or listener appeared, and the independent audit reported only reviewed key-only SSH. The sole authorized key and pinned host key remained unchanged. Exact installed helper hashes matched the reviewed tree; final aggregate health, five verified snapshots, idle network transaction, inactive recovery lease, inactive development overlay, and transfer cleanup were green. Machine-readable evidence: [`validation/network/plus-interactive-ssh-lockdown-20260831.json`](validation/network/plus-interactive-ssh-lockdown-20260831.json). | Enabled SFTP was not changed or retested. Three inactive retired FileBrowser/FTP configuration remnants remain under issue #629, while their executables and stale enablement flags are absent; NET-10 therefore remains open. This is Mini Plus remote evidence, not physical controls/LCD, audio, gameplay, save semantics, or other-device certification. |
+| 2026-09-01 | Miyoo Mini Plus (model ID 354) | signed candidate `v0.1.0-dev-32b96396`; automatically recovered and confirmed known-good `v0.1.0-dev-3a828a29`; workflow run 33468134131 | Upgrade-safe removal of retired FileBrowser/FTP configuration remnants and signed recovery | The exact 185,671,287-byte archive matched SHA-256 `483075fb...b0b35`; metadata, payload inventory, and Ed25519 signature passed. Its migration removed the three inactive retired configuration paths without inspecting their contents. All retired payloads and stale enablement flags remained absent, Wi-Fi and the sole authorized key were preserved, and the independent listener audit reported only reviewed key-only SSH. The migration effect persisted through automatic rollback. After three unconfirmed candidate boots reached the recovery threshold, the device recovered to `3a828a29`; that rollback—not the candidate—was confirmed known-good with healthy aggregate state, six verified snapshots, idle network transaction, inactive recovery lease and development overlay, no install-failure marker, and cleaned transfer staging. Machine-readable evidence: [`validation/network/plus-retired-network-config-migration-20260901.json`](validation/network/plus-retired-network-config-migration-20260901.json). | The candidate itself was never confirmed as known-good, and recovery required maintainer physical power-on after the bounded remote watch. This certifies the migration effect and safe recovery on one Mini Plus, not unattended return, other candidate behavior, physical controls/LCD, audio, gameplay, save semantics, or other devices. |
 | 2026-08-16 | Miyoo Mini Flip (model ID 285) | `v0.1.0-dev-bc086aa6`, `v0.1.0-dev-95de9362`, `v0.1.0-dev-fbf1a03e`, `v0.1.0-dev-3ed5ba7d` | Upgrade install, identity, display/input/battery/lid inventory, Wi-Fi capability, clean-entry boot, instrumented shutdown, Windows FAT check, Play Activity WAL compatibility, key-only SSH | Clean install and boot; native 752×560 panel; two input devices; hall sensor present with open-lid raw value 1; live AXP battery 64%; Wi-Fi capability true. A controlled shutdown cycle entered and returned clean. Play Activity converted a seeded rollback-journal database to WAL, preserved its rows, passed integrity and quick checks, and left no WAL/SHM sidecars after three UI opens. Bloom-built static Dropbear 2025.88 accepted repeated Ed25519 logins, refused password-only authentication, reported model 285 over the live harness, and retained about 74 MB available memory. | Earlier cycles entered or returned dirty, although CHKDSK found no filesystem damage. The first Activity Tracker open/exit briefly glitched the display, then two repeats were normal with no logged crash. Longer soak testing, reboot-path isolation, reboot-time SSH activation, and lid behavior remain required. |
 
 The V2 result is a maintainer validation baseline, not certification of V2 or evidence for V1, V3, or V4. The first Plus shutdown retest was invalid because the card entered Linux dirty after a failed Windows command-line eject. After repairing and using Windows Safely Remove Hardware, the card entered Linux without the not-properly-unmounted warning and returned to Windows clean after BloomOS shutdown.

docs/SECURITY.md

@@ -36,7 +36,10 @@ Tweaks toggle are also excluded; stale-state cleanup and exact BusyBox
 The inherited bftpd executables, anonymous/authenticated configurations, start
 logic, default credentials, and visible Tweaks controls are excluded as well;
 stale FTP state cleanup and exact `bftpd` termination remain for older-card
-compatibility.
+compatibility. Full updates run a fixed-path migration that removes preserved
+`config/filebrowser`, `config/bftpd.conf`, and `config/bftpdauth.conf` remnants.
+The migration unlinks symlinks instead of following them and leaves every
+unrelated configuration path untouched.
 The rejected inherited Samba executable and libraries remain excluded, and its
 configuration, dormant start logic, share editor, default credentials, and
 visible Tweaks controls are no longer shipped or exposed. The signed disable