[boburning]

Summary

Advances NET-05 with the first rendered, host-safe Wi-Fi surface and permanently removes direct radio mutation from ordinary Settings and Quick Settings controls.

• changes the Settings Wi-Fi row from an inline toggle to a detail route
• converges Bloom Shell Settings, Bloom Shell Quick Settings, and GameSwitcher Quick Settings on bloom-shell --settings-wifi
• makes left/right inert on every Wi-Fi quick row and deletes the direct bloom-network request enable|disable helper
• loads the credential-free saved-profile projection through the fixed bloomctl network profile list argv, outside the render path, with a 4 KiB/5 second bound and strict schema rejection
• renders connection state and saved SSIDs using the shared panel/list-row/typed-copy boundaries
• preserves the exact Shell return route across GameSwitcher and updates the v3 ledger, security/architecture guidance, tests, manifest, and dependency totals

Dependency and scope

• Base: current main at 3b0a13a30d34733f03831b0d041785c4fc6dc3ae
• Depends on merged PR NET-05A: add credential-free Wi-Fi UI model #545 (NET-05 credential-free UI model) and the already-merged NET-04A-D/UI-05 foundation
• Closes no issue; advances NET-05: replace direct Wi-Fi toggle with bounded profile UI #544
• This is a partial NET-05 slice. Scan rendering, association, credential entry, forget, and any recovery-qualified radio power control remain pending.

Validation

Local host gates:

• make -j8 test: 544/544 passed in 11.5 seconds
• SANITIZE=1 make -j8 test: 544/544 passed in 22.4 seconds with leak detection, halt-on-error, and strict string checks
• canonical shell suite: 737/737 unique tests passed across 8 shards; manifest/provenance/transfer/dependency preflight passed
• focused native + ASan Wi-Fi/settings tests: 31/31 each
• focused shell Wi-Fi/settings/runtime/GameSwitcher tests: 53/53
• deterministic UI gallery: 10/10 frames pixel-identical to reviewed goldens
• strict Bloom Shell syntax compile passed with -Wall -Wextra -Werror
• GameSwitcher syntax compile passed; it retains the unrelated pre-existing gs_romscreen.h nonliteral-format warning
• scoped cppcheck, clang-format 21.1.8, typography policy, bash -n, JSON parse, and git diff --check passed
• legacy manifest: 332 components, 2,131 files, 314,683,965 bytes

The affected ARM build is intentionally delegated to this PR's remote CI: the pinned ARM toolchain is not locally cached and C: is below the program's 60 GiB free-space gate, so downloading another Docker image locally would violate the storage-safety contract.

Device evidence

None claimed for this slice. The Mini Plus remains online on its known-good signed baseline. This branch was not deployed and performed no reboot, update, Wi-Fi/profile/listener/key mutation, or device command. Remote CI is not physical certification.

Safety and limitations

• Ordinary UI input can no longer directly power Wi-Fi off or sever the automation route.
• The surface is intentionally read-only: it shows connection state and saved-network metadata only.
• SSIDs are ephemeral UI data and must not enter logs, screenshots, diagnostics, or durable evidence.
• Original Mini continues to hide the capability; Mini Plus evidence would not certify Mini V1-V4 or Flip.
• Any future association, forget, or radio-control slice must use the guarded transaction/rollback authority and receive its own device gate.

Storage hygiene

Reused the single D:-based implementation worktree and build workspace. No clone, worktree, Docker volume, or persistent container was created. C: remained below the 60 GiB gate, so no new local ARM image was pulled.

Remote CI result

All required checks passed on commit ddd58b2cd6678591432fa89548823883e37f7289:

• format: 14 seconds
• affected ARM build: 1 minute 17 seconds
• native tests and deterministic UI gallery: 1 minute 29 seconds
• AddressSanitizer: 1 minute 56 seconds
• static analysis: 2 minutes 17 seconds
• 737-test shell integration gate: 2 minutes 19 seconds