Wi-Fi Settings evidence

The protected broker and touch client host checkpoints were tested from source commits through 49e204da on 2026-09-24 UTC:

• python3 -m unittest tests.test_wifi_settings_broker -q — fifteen synthetic host cases passed, including bounded multi-network priority selection, saved credential reselect, real-format scan, rollback and cancellation. Names and passwords in those fixtures are invented; the test neither uses a radio nor reads the board. The * Authentication suites: fixture matches upstream iw v6.9 scan.c, which prints the \t * prefix.
• tools/test-k230-wifi-persistent-service.sh — passed after correcting its stale documentation-string check; the pre-existing LoadCredential unit values remain intact.
• nix build --no-link --print-out-paths --max-jobs 1 --cores 4 .#wifi-settings-broker — passed for broker source b75a76fd before the fresh-interface and saved-reselect corrections; derivation /nix/store/f8yg6i50avmfcw8rb0n1kfds381mg4aw-k230-wifi-settings-broker.drv, package /nix/store/frqh7xcp937xhfra1kz9j0j77gfby65q-k230-wifi-settings-broker. The exact 49e204da broker package build remains open. Earlier package identities are superseded.
• cargo test --offline --manifest-path nix/rust-shell-client/Cargo.toml --quiet — 47 library, 6 navigation, 10 appearance, 5 service, and 8 additional host cases passed. Wi-Fi cases cover typed protocol, a synthetic same-UID native UNIX broker transport, a bounded worker queue, a cancellation watermark, stale replies, touch scaling, direct scroll reversal, open-network password skip, masked input and explicit Forget. The production worker still requires a root-owned broker socket.
• cargo clippy --offline --manifest-path nix/rust-shell-client/Cargo.toml --lib --bin k230-shell-rust -- -D warnings -A clippy::too-many-arguments — passed; the exception is for pre-existing rendering helpers with eight arguments.
• nix build --no-link --print-out-paths --max-jobs 1 --cores 4 .#handheld-shell-rust — passed at source f85a498e: derivation /nix/store/9yml6jyy6hg0kvy1q4x818dncdghby0l-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0.drv, output /nix/store/i61jiww4lks3wncb8smmywmhmbg3l1i3-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0. The source correction 49e204da supersedes this package; its exact target build remains open.
• openspec validate the-handheld-configures-wifi-from-settings --strict — passed.

Paired headless QEMU touch proof, 2026-09-24 UTC

The source and client proof above is supplemented by tests/rust_wifi_settings_qemu.py, run against integrated source revision ea57e47d4472caaf17c4d6f6034a53e46e8815e0. Its exact Rust build passed with derivation /nix/store/w7600117342c3qx9vdwcb6mdq93phx3g-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0.drv and output /nix/store/cspc2gr8ysp5msxz010qx98v2mkahdfp-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0. The independent installed-source Sway executable was /nix/store/lmgq4hj6fxc37vp98hy1x93wnz589iyn-sway-unwrapped-riscv64-unknown-linux-gnu-1.12/bin/sway. These are separate immutable inputs; this is not a full-system image build.

unshare -Ur python3 tests/rust_wifi_settings_qemu.py \
  --sway /nix/store/lmgq4hj6fxc37vp98hy1x93wnz589iyn-sway-unwrapped-riscv64-unknown-linux-gnu-1.12/bin/sway \
  --rust /nix/store/cspc2gr8ysp5msxz010qx98v2mkahdfp-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0/bin/k230-shell-rust \
  --theme-source nix/handheld-theme-default \
  --output /tmp/k230-wifi-qemu-ea57-v7

The command exited zero and reported headless-qemu-injected-touch. It launches real target Sway and Rust processes through qemu-riscv64-static, captures a 568×1232 headless surface through grim, and injects touch through Sway’s test command. A synthetic root-owned broker inside the test user namespace supplies only invented Example network names. Its request checks distinguish saved selection with no password, new WPA2 password submission, synthetic authentication failure, and Forget. It checks the eight-character password only by length, never prints it, and verifies that touch coordinates are absent from the Rust log while the Wi-Fi view is active. The script uses OCR plus image checks to wait for specific visual states, preventing a stale/loading frame from being misreported as a successful capture. A separate synthetic light palette tests readability; neither palette capture is a physical panel result.

Selected captures: dark network list, light network list, saved-network entry, masked password entry, authentication error, Forget confirmation, dark Settings with enabled gesture hint, light Settings with enabled gesture hint, and Settings with the hint disabled. The ea57 captures retain icon-only Backspace labels; later source revision e2fa0366 uses explicit Del/Delete text, and its integrated target package still needs a final build. The screenshots are kept with the exact package identity rather than silently retouched.

The installed board scan confirms the previously installed broker’s real socket/radio path with allowlisted counts only. That result does not prove this corrected source. Real association, protected persistence, recovery timer, reboot reconnect, Forget, and Settings touch/keyboard behavior on physical glass remain UNVERIFIED. The 49e204da broker reselect correction and the e2fa0366 key-label correction were not in the exact packages above.