[boburning]

Summary

• render the bounded Wi-Fi credential form only from a supported, validated scan-result row
• use the shared keyboard for WPA2 while keeping the secret masked; explicit open networks expose no password field
• submit only through the existing nonblocking, fixed-argv, stdin-only profile-upsert controller
• restore the originating bounded row after terminal state and report success honestly as Network saved - not connected
• cancel the form before GameSwitcher and during teardown
• update the typography authority, security/architecture/test documentation, and v3 work-program evidence

Dependency and scope

Base: current main at ad66ede878c07e2c7877361ca08feb22b6890f97 (PR #553 merged).

This is the rendered save-only continuation of NET-05 tracked by #544. It deliberately adds no profile projection, network association, radio mutation, DHCP restart, listener reconciliation, reboot, update, or device action.

Validation

• clang-format --dry-run --Werror src/bloomShell/main.c
• strict host compile of src/bloomShell/main.c with -std=gnu18 -Wall -Wextra -Werror
• exact affected shell scope: 81/81 passed; provenance ran once successfully before a typography call-site inventory drift was corrected, and the final direct selector avoided duplicating provenance
• native exact affected scopes: 189/189 passed (BloomShell*:BloomFrontend* plus BloomUiTypography*)
• AddressSanitizer exact affected scopes: 189/189 passed with leak detection and halt-on-error
• typography authority: Bloom typography validate: 4 candidates, 7 roles, 1 MiB cache
• risk-scoped cppcheck closure: src/bloomUi src/bloomShell completed with exit 0 (known informational/style findings only)
• both changed JSON authorities parse successfully
• git diff --check
• CI scope resolves to risk 2, bloomShell, no visual-gallery gate

Device evidence

No candidate was deployed and no SSH, Wi-Fi, profile, radio, listener, reboot, or update mutation was performed. The Mini Plus remained on the known-good signed baseline, online and associated, throughout this host-only slice.

Limitations

• saving a profile does not connect to it; the UI states that explicitly
• physical button timing, framebuffer presentation, association, rollback, and Mini V1-V4 / Mini Flip behavior were not tested by this slice
• this PR makes no physical certification claim

Closes no issue; continues #544 under parent #434.

Live CI

Current head 7b2e0870 passed all required checks:

• format: 14 seconds
• focused shell integration: 40 seconds
• native tests: 1 minute 21 seconds
• AddressSanitizer: 1 minute 26 seconds
• affected ARM build: 1 minute 36 seconds
• risk-scoped static analysis: 2 minutes 37 seconds