feat(shell): render guarded Wi-Fi profile save form

build/bloom-typography.json

@@ -96,7 +96,7 @@
     "unclassified_data": "unchanged",
     "fragment_kinds": ["copy", "data"],
     "maximum_fragments": 8,
-    "classified_copy_call_sites": 82,
-    "classified_mixed_call_sites": 14
+    "classified_copy_call_sites": 86,
+    "classified_mixed_call_sites": 15
   }
 }

docs/1.0_TEST_MATRIX.md

@@ -50,7 +50,7 @@ shoulder button.
 | Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; Samba hidden until a materially different source-build candidate passes feasibility |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
-| Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; host-only open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, explicit secret clearing, nonblocking submit/poll, 4-KiB acknowledgement cap, exact upsert response, timeout process-group cleanup, exact saved-ID reuse, 104-bit no-follow random new handles, collision/security/full-store rejection, and one editing/submitting controller with 100-ms poll opportunities, exact cancellation, terminal clearing, and bounded focus return; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
+| Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, explicit secret clearing, nonblocking submit/poll, 4-KiB acknowledgement cap, exact upsert response, timeout process-group cleanup, exact saved-ID reuse, 104-bit no-follow random new handles, collision/security/full-store rejection, one editing/submitting controller with 100-ms poll opportunities, exact cancellation, terminal clearing, bounded focus return, supported scan-result selection, explicit saved-not-connected result, and no implicit association; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
 | GameSwitcher | MENU open/toggle; Left/Right select; L1/R1 page; A resume; X actions; START Quick Settings; B Home; no inherited brightness/view/delete behavior |
 | Apps/Tweaks | Every app disposition recorded; normal configuration requires no Tweaks; supervised launch remains bounded |
 | Persistent state | Versioned atomic publication; exact restoration across Details/game/GameSwitcher/Quick Settings; malformed/oversized/symlink input defaults without Safe Mode |

docs/ARCHITECTURE.md

@@ -603,7 +603,16 @@ single-flight upsert request. It admits input only while editing, polls only at
 every terminal result, and kills and reaps the exact request process group on
 cancel or destroy. The controller retains only the bounded non-secret list row
 needed to return focus after completion, failure, or cancellation. It remains
-unreachable from the rendered Shell in this host-only slice.
+unreachable from the rendered Shell in its host-only foundation slice.
+
+The rendered integration activates that controller only for a supported row in
+the already-bounded scan result list. WPA2 uses the shared masked keyboard;
+explicit open networks expose no secret field. START stores the profile through
+the controller's fixed stdin-only upsert request, B deletes one password byte or
+cancels at the empty form, and MENU cancels before GameSwitcher. Terminal state
+returns to the exact bounded row and reports `Network saved - not connected` on
+success. No result from this surface projects, associates, restarts, enables, or
+disables the station.
 
 Profile association reuses the one guarded network-transaction authority rather
 than adding a second recovery mechanism. `begin` copies the exact current

docs/DEVELOPMENT.md

@@ -413,6 +413,10 @@ request process group on cancellation or teardown. Its `return_item` is a
 bounded non-secret row index for deterministic focus restoration; it is not a
 profile, SSID, or association authority. The controller remains host-only until
 the rendered integration slice adds explicit input and cancellation ownership.
+That integration may open the form only from a supported bounded scan row. It
+must label a successful upsert as saved but not connected, return focus to the
+originating row, cancel before GameSwitcher or Shell teardown, and never invoke
+profile projection, association, radio power, DHCP, or listener reconciliation.
 
 The NET-04 scan slice is asynchronous and keeps result data only under `/tmp`:
 

docs/SECURITY.md

@@ -183,6 +183,9 @@ submission clears the password before returning; every terminal, cancellation,
 and teardown path clears the complete form; and cancellation kills and reaps the
 exact child process group. Only a bounded non-secret focus row survives a
 terminal transition. This controller has no rendered or association consumer in
-its initial slice.
+its initial slice. The rendered follow-up invokes it only from a supported
+bounded scan row, renders password state solely through the masked label, and
+returns a non-secret `saved - not connected` result. It adds no projection,
+association, network transaction, radio, DHCP, listener, reboot, or update path.
 
 Security-sensitive migrations and repair operations must be bounded, logged, reversible where possible, and validated before activation.

docs/program/BloomOS_Work_Program_v3.json

@@ -889,12 +889,13 @@
         550,
         551,
         552,
-        553
+        553,
+        554
       ],
       "risk_tier": 1,
       "deployment_tier": "hot",
       "device_gate_required": true,
-      "last_audited_main": "7c67002caf89e767d318d97f751a0b92e93d827e",
+      "last_audited_main": "ad66ede878c07e2c7877361ca08feb22b6890f97",
       "evidence": [
         "issue #544 tracks NET-05 on current main after merged NET-04A-D and UI-05; the audit found that Bloom Shell still treats Wi-Fi as an inline toggle whose A and left/right handlers synchronously call bloom-network enable or disable instead of opening the bounded profile and scan UI",
         "the first host-safe slice adds an explicit local credential-free projection of at most 16 validated profile IDs, printable SSIDs, security classes, hidden flags, and one active marker; the private service never returns a PSK and the Shell model rejects unknown or credential-bearing fields",
@@ -914,7 +915,9 @@
         "GitHub PR #551 passed format in 14 seconds, the complete 58-test affected shell selector in 50 seconds, AddressSanitizer in 1 minute 15 seconds, native tests in 1 minute 20 seconds, the affected Bloom Shell ARM build in 1 minute 23 seconds, and scoped static analysis in 2 minutes 18 seconds; it merged by squash as 49f0a8096bff9a9157e4ce176201d2f532bb74dd",
         "GitHub PR #552 adds a host-only selection boundary that requires a current validated profile snapshot, reuses an exact saved SSID only when its security matches, creates a 104-bit high-entropy no-follow random handle for a new network, and rejects malformed state, unsupported security, full stores, security mismatch, unavailable state, and bounded collision exhaustion before any form or request can be created",
         "GitHub PR #552 passed formatting in 13 seconds, the complete 58-test affected shell selector in 45 seconds, the affected Bloom Shell ARM build in 1 minute 12 seconds, native tests in 1 minute 15 seconds, AddressSanitizer in 1 minute 22 seconds, and scoped static analysis in 1 minute 45 seconds; it merged by squash as 7c67002caf89e767d318d97f751a0b92e93d827e",
-        "GitHub PR #553 gives the credential form one host-only lifecycle owner with editing and submitting states, 100-ms monotonic poll opportunities, input rejection outside editing, exact request cancellation and teardown, terminal form clearing, and a bounded non-secret return row for deterministic focus restoration; it still has no rendered, association, radio, or device consumer"
+        "GitHub PR #553 gives the credential form one host-only lifecycle owner with editing and submitting states, 100-ms monotonic poll opportunities, input rejection outside editing, exact request cancellation and teardown, terminal form clearing, and a bounded non-secret return row for deterministic focus restoration; it still has no rendered, association, radio, or device consumer",
+        "GitHub PR #553 passed formatting in 16 seconds, the complete 58-test affected shell selector in 55 seconds, native tests in 1 minute 8 seconds, AddressSanitizer in 1 minute 19 seconds, the affected Bloom Shell ARM build in 1 minute 29 seconds, and scoped static analysis in 2 minutes 16 seconds; it merged by squash as ad66ede878c07e2c7877361ca08feb22b6890f97",
+        "GitHub PR #554 opens the controller only from a supported bounded scan row, uses the shared masked keyboard for WPA2, stores through the fixed nonblocking upsert request, cancels before GameSwitcher or focus return, reports success explicitly as saved but not connected, and adds no projection, association, radio, DHCP, listener, reboot, update, or device action"
       ]
     },
     {