Port the post-v0.228.0 development train

[kapoorankush]

Ports the litclock-dev train merged 2026-09-19/20 (litclock-dev#872-#878), boundary afa2d6b4..fde50fc6.

Gate

Bench QA pass of 2026-09-20 on a fresh flash of dev-20260920-512c291 (Pi Zero 2 W): 13 checks, no blocking findings, every member of this train exercised on real hardware — the setup-key rotation arms, the shell-history wipe on the PWA factory reset, the registry corpus resolution, and the Stage A self-test.

What owners get

One line in the CHANGELOG, because it is the only thing visible from outside:

• Gift mode and the app's Factory reset now wipe and lock the two default shell history files, as clone prep already did (litclock-dev#868). history -c reaches only the script's own shell; the console or SSH shell the operator ran it from writes its history back on exit, during the power-off. The lock is a root-owned empty directory at the path, which fails that write with EISDIR; first-boot.sh removes both on the not-yet-set-up path, so the recipient's first login gets an ordinary history file.

Shipping silently, by design

• Per-language corpus resolution (litclock-dev#870). The quote CSV is resolved from the languages.json registry for the active language; LITCLOCK_CORPUS_CSV still overrides, and the PNG lookup reads image_corpus_path() on purpose — the corpus the images were baked from. Latent while English is the sole active language: the pre-rendered images stay English, so a second language needs on-device text rendering before it can be activated.
• The runtime-render self-test, shipped INERT (litclock-dev#871 Stage A). On a marker-bearing device an applied release now asks whether the device can actually paint a quote from text, and records the verdict in /var/lib/litclock/runtime-render-selftest.json. It changes no setting, it renders into a throwaway directory so the live frame is untouched, weather is forced off, and a failed self-test is not an update failure. First field measurement: 3.8s on a Pi Zero 2 W during an update, 3.4-3.7s idle — whole-process wall time (interpreter start + PIL import + render), not render time, and not comparable to frame settle.

Plus: the LKG recorder stops claiming bootcheck/revert is unshipped (litclock-dev#877), the WiFi retry tests stub an IP-geo resolver that was making a live network call (litclock-dev#876), and CLAUDE.md gains the 2026-09-20 bench results and the rewritten litclock-dev#867 raw-journal check (the old one passed vacuously).

Port mechanics

• Boundary established by content, not by the previous port commit's stated range.
• 48 bare #NNN and 14 dev#NNN requalified to litclock-dev#NNN, on ported lines only, validated by this repo's own tests/test_issue_ref_namespace.py.
• Hand-merged where this repo has diverged: README (its own structure), docs/script-reference.md (the #resetting anchor), scripts/lib/state.sh (the already-qualified writer-lock header), and two comment conflicts.
• CONTRIBUTING.md edited in place to preserve CRLF.
• Scrubbed: one maintainer-local harness path.

Review findings, fixed on dev and ported in

/review on this branch found two defects the train carried over from dev. Both were fixed on dev first (litclock-dev#879, #880, #882) and ported here, which is why this branch has three commits.

• The IP-geo stub litclock-dev#876 added covered one test class of three. Measured on this checkout with a getaddrinfo probe: 24 DNS lookups of ip-api.com across 8 tests. The resolver's success path calls set_system_timezone(), which shells out to sudo, and it is not sandboxed by anything these tests patch — so on a machine where the installer has run, pytest tests/ could change the system timezone. The fixture is module-scoped now. Probe after the fix: 0.
• ${EPOCHREALTIME/./} recorded a silently wrong duration_s under a non-dot LC_NUMERIC. Now ${EPOCHREALTIME//[^0-9]/} — every non-digit, because the separator is not limited to a dot and a comma (glibc gives fa_IR and ps_AF U+066B). Production always got C from systemd; the exposure is a maintainer running update.sh by hand from a non-English desktop, which the README tells owners they may do.

Four review rounds each broke the previous round's test with a shape it did not model, so the test that holds this now executes the shipped function with stubs and a known-duration painter and asserts on the value the record writer receives, rather than asserting anything about source text.

Two findings belong to this repo alone and are fixed here: a doubled litclock-dev litclock-dev#876 the requalifier created, and PUBLIC_NUMBER_CEILING raised 67 → 70 (two ports behind), with the 68–70 audit recorded.

Hardware QA

The train was gated by the full bench pass of 2026-09-20 (fresh flash of dev-20260920-512c291, 13 checks, no blocking findings). The only device-facing code added after that pass is the two timing expansions above, so they got their own targeted check on the bench today — the Pi's bash is 5.2.15 against 5.2.21 on the dev box, which is why it needed hardware:

• real function, real painter, real clock: recorded 3.4s, against an independently measured 3497ms — agreeing to the tenth, across two runs that moved together. Consistent with the 2026-09-20 baseline (3.8s under update load, 3.4–3.7s idle), so the widening did not move the figure.
• all three separators handled on 5.2.15; the old pattern handles only the dot.
• control: with the strip replaced by a no-op, the duration comes back empty against a real 3558ms — so the check can fail.
• live frame untouched, LITCLOCK_RUNTIME_RENDER still false, record file untouched.

No OTA run: the self-test is inert this release, update.sh has no set -e, and a failed self-test is explicitly not an update failure, so a broken expansion can mis-record a number but cannot stop an update.

Verification

ruff check . clean, shellcheck (exact CI invocation) clean, pytest 4648 passed / 66 skipped, vitest 209 passed.