feat(network): render bounded Wi-Fi scans (NET-05)

build/bloom-typography.json

@@ -96,7 +96,7 @@
     "unclassified_data": "unchanged",
     "fragment_kinds": ["copy", "data"],
     "maximum_fragments": 8,
-    "classified_copy_call_sites": 81,
-    "classified_mixed_call_sites": 13
+    "classified_copy_call_sites": 82,
+    "classified_mixed_call_sites": 14
   }
 }

docs/1.0_TEST_MATRIX.md

@@ -50,7 +50,7 @@ shoulder button.
 | Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; Samba hidden until a materially different source-build candidate passes feasibility |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
-| Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
+| Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
 | GameSwitcher | MENU open/toggle; Left/Right select; L1/R1 page; A resume; X actions; START Quick Settings; B Home; no inherited brightness/view/delete behavior |
 | Apps/Tweaks | Every app disposition recorded; normal configuration requires no Tweaks; supervised launch remains bounded |
 | Persistent state | Versioned atomic publication; exact restoration across Details/game/GameSwitcher/Quick Settings; malformed/oversized/symlink input defaults without Safe Mode |

docs/ARCHITECTURE.md

@@ -566,6 +566,14 @@ remembered and issued immediately afterward. Successful networks and terminal
 errors remain in bounded memory for presentation while the service-side
 operation ID is cleared, preventing scan-history accumulation.
 
+Bloom Shell drives the controller from a 100-ms SDL wake only while work is
+active. The Wi-Fi panel exposes one Scan/Cancel row and renders either saved
+profiles or successful read-only scan results through shared list components.
+B closes the panel only after initiating bounded cancellation; MENU defers the
+GameSwitcher handoff until cancel, terminal status, and discard clear the exact
+operation. No scan command is invoked from `draw()` and no result can initiate
+association in this slice.
+
 Profile association reuses the one guarded network-transaction authority rather
 than adding a second recovery mechanism. `begin` copies the exact current
 supplicant file into a mode-0700 JFFS2-private transaction root, records only

docs/DEVELOPMENT.md

@@ -388,6 +388,12 @@ the next wake. Keep the controller alive until cancel/status/discard completes,
 including when cancel is requested while start is still returning its operation
 ID.
 
+The SDL owner uses `WIFI_EVENT_TYPE` only while the controller is active.
+Changing surfaces may hide the panel, but must not destroy an in-flight
+controller: B requests cancellation in the background, and GameSwitcher waits
+until the exact operation reaches discard. Scan result rows are deliberately
+read-only until the separate guarded association and credential slices land.
+
 The NET-04 scan slice is asynchronous and keeps result data only under `/tmp`:
 
 ```sh

docs/SECURITY.md

@@ -149,4 +149,10 @@ operation ID: cancellation requested during start remains pending until the
 validated start response supplies the ID. This bounds scan history and prevents
 a UI close or rapid cancel from racing an unrelated service operation.
 
+The rendered surface does not turn a discovered SSID into an action. Scan rows
+are classified runtime data and remain read-only; only the Bloom-owned Scan row
+accepts A. A GameSwitcher request during a scan is held until the controller has
+confirmed and discarded cancellation, so a child UI cannot strand the Shell's
+operation or inherit its command pipe.
+
 Security-sensitive migrations and repair operations must be bounded, logged, reversible where possible, and validated before activation.

docs/program/BloomOS_Work_Program_v3.json

@@ -883,12 +883,14 @@
       "github_prs": [
         545,
         546,
-        547
+        547,
+        548,
+        549
       ],
       "risk_tier": 1,
       "deployment_tier": "hot",
       "device_gate_required": true,
-      "last_audited_main": "765f2038b7d63e61d6db8bab1a70ce750a07d088",
+      "last_audited_main": "9b3a847d99daf8baf44d953670d0ff4a18562a60",
       "evidence": [
         "issue #544 tracks NET-05 on current main after merged NET-04A-D and UI-05; the audit found that Bloom Shell still treats Wi-Fi as an inline toggle whose A and left/right handlers synchronously call bloom-network enable or disable instead of opening the bounded profile and scan UI",
         "the first host-safe slice adds an explicit local credential-free projection of at most 16 validated profile IDs, printable SSIDs, security classes, hidden flags, and one active marker; the private service never returns a PSK and the Shell model rejects unknown or credential-bearing fields",
@@ -898,7 +900,9 @@
         "GitHub PR #546 passed format in 14 seconds, the affected ARM build in 1 minute 17 seconds, native tests and the deterministic UI gallery in 1 minute 29 seconds, AddressSanitizer in 1 minute 56 seconds, static analysis in 2 minutes 17 seconds, and the 737-test shell gate in 2 minutes 19 seconds; it merged by squash as 7dee3fc27b5b0cd5b743af99f8e66b631c514c12",
         "the next host-only slice adds no runtime consumer or device action; it provides a nonblocking fixed-argv client for scan start, status, results, cancel, and discard with strict operation IDs, a 16-KiB output ceiling, a five-second command deadline, process-group kill and reap, no-follow executable checks, exact response parsing, and deterministic teardown so the later event-loop UI cannot improvise subprocess behavior",
         "GitHub PR #547 used risk-scoped CI: format passed in 23 seconds, 58 focused shell tests in 43 seconds, native tests in 1 minute 8 seconds, AddressSanitizer in 1 minute 12 seconds, the affected Bloom Shell ARM build in 1 minute 21 seconds, and scoped static analysis in 2 minutes 8 seconds; it merged by squash as 765f2038b7d63e61d6db8bab1a70ce750a07d088",
-        "the following host-only lifecycle controller sequences start, bounded status polling, results, and terminal discard through the single-flight request client; it preserves terminal results in memory while clearing the service operation, and a cancel received during start is deferred until the exact operation ID arrives before status confirmation and discard"
+        "the following host-only lifecycle controller sequences start, bounded status polling, results, and terminal discard through the single-flight request client; it preserves terminal results in memory while clearing the service operation, and a cancel received during start is deferred until the exact operation ID arrives before status confirmation and discard",
+        "GitHub PR #548 passed format in 18 seconds, 58 focused shell tests in 50 seconds, the affected Bloom Shell ARM build in 1 minute 11 seconds, native tests in 1 minute 20 seconds, AddressSanitizer in 1 minute 26 seconds, and scoped static analysis in 2 minutes 8 seconds; it merged by squash as 9b3a847d99daf8baf44d953670d0ff4a18562a60",
+        "GitHub PR #549 renders the bounded scan controller through a 100-ms SDL wake without invoking commands from draw or blocking input, adds a selectable Scan action and read-only bounded results, cancels in the background when leaving the panel, and defers GameSwitcher until the exact scan operation is cancelled, confirmed terminal, and discarded; association, credential entry, forget, and radio power remain absent"
       ]
     },
     {

src/bloomShell/bloom_shell_wifi_ui.c

@@ -752,8 +752,14 @@ int bloom_shell_wifi_controller_cancel(BloomShellWifiController *controller,
     }
     if (controller->state == BLOOM_SHELL_WIFI_CONTROLLER_CANCELLING)
         return 0;
+    if (controller->state == BLOOM_SHELL_WIFI_CONTROLLER_DISCARDING)
+        return 0;
     if (wifi->scan_id[0] == '\0')
         return -1;
+    if (controller->state == BLOOM_SHELL_WIFI_CONTROLLER_FETCHING) {
+        bloom_shell_wifi_request_destroy(&controller->request);
+        return controller_discard(controller, bloomctl_path, wifi, now_ms);
+    }
     if (bloom_shell_wifi_request_active(&controller->request))
         bloom_shell_wifi_request_destroy(&controller->request);
     controller->cancel_pending = 0;