# Wi-Fi Settings evidence

The protected broker and touch client host checkpoints were tested from source commits through `49e204da` on 2026-09-24 UTC:

- `python3 -m unittest tests.test_wifi_settings_broker -q` — fifteen synthetic host cases passed, including bounded multi-network priority selection, saved credential reselect, real-format scan, rollback and cancellation. Names and passwords in those fixtures are invented; the test neither uses a radio nor reads the board. The `* Authentication suites:` fixture matches [upstream `iw` v6.9 `scan.c`](https://kernel.googlesource.com/pub/scm/linux/kernel/git/jberg/iw/+/refs/tags/v6.9/scan.c), which prints the `\t * ` prefix.
- `tools/test-k230-wifi-persistent-service.sh` — passed after correcting its stale documentation-string check; the pre-existing `LoadCredential` unit values remain intact.
- `nix build --no-link --print-out-paths --max-jobs 1 --cores 4 .#wifi-settings-broker` — passed for broker source `b75a76fd` before the fresh-interface and saved-reselect corrections; derivation `/nix/store/f8yg6i50avmfcw8rb0n1kfds381mg4aw-k230-wifi-settings-broker.drv`, package `/nix/store/frqh7xcp937xhfra1kz9j0j77gfby65q-k230-wifi-settings-broker`. The exact `49e204da` broker package build remains open. Earlier package identities are superseded.
- `cargo test --offline --manifest-path nix/rust-shell-client/Cargo.toml --quiet` — 47 library, 6 navigation, 10 appearance, 5 service, and 8 additional host cases passed. Wi-Fi cases cover typed protocol, a synthetic same-UID native UNIX broker transport, a bounded worker queue, a cancellation watermark, stale replies, touch scaling, direct scroll reversal, open-network password skip, masked input and explicit Forget. The production worker still requires a root-owned broker socket.
- `cargo clippy --offline --manifest-path nix/rust-shell-client/Cargo.toml --lib --bin k230-shell-rust -- -D warnings -A clippy::too-many-arguments` — passed; the exception is for pre-existing rendering helpers with eight arguments.
- `nix build --no-link --print-out-paths --max-jobs 1 --cores 4 .#handheld-shell-rust` — passed at source `f85a498e`: derivation `/nix/store/9yml6jyy6hg0kvy1q4x818dncdghby0l-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0.drv`, output `/nix/store/i61jiww4lks3wncb8smmywmhmbg3l1i3-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0`. The source correction `49e204da` supersedes this package; its exact target build remains open.
- `openspec validate the-handheld-configures-wifi-from-settings --strict` — passed.

## Paired headless QEMU touch proof, 2026-09-24 UTC

The source and client proof above is supplemented by `tests/rust_wifi_settings_qemu.py`, run against integrated source revision `ea57e47d4472caaf17c4d6f6034a53e46e8815e0`. Its exact Rust build passed with derivation `/nix/store/w7600117342c3qx9vdwcb6mdq93phx3g-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0.drv` and output `/nix/store/cspc2gr8ysp5msxz010qx98v2mkahdfp-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0`. The independent installed-source Sway executable was `/nix/store/lmgq4hj6fxc37vp98hy1x93wnz589iyn-sway-unwrapped-riscv64-unknown-linux-gnu-1.12/bin/sway`. These are separate immutable inputs; this is not a full-system image build.

```sh
unshare -Ur python3 tests/rust_wifi_settings_qemu.py \
  --sway /nix/store/lmgq4hj6fxc37vp98hy1x93wnz589iyn-sway-unwrapped-riscv64-unknown-linux-gnu-1.12/bin/sway \
  --rust /nix/store/cspc2gr8ysp5msxz010qx98v2mkahdfp-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0/bin/k230-shell-rust \
  --theme-source nix/handheld-theme-default \
  --output /tmp/k230-wifi-qemu-ea57-v7
```

The command exited zero and reported `headless-qemu-injected-touch`. It launches real target Sway and Rust processes through `qemu-riscv64-static`, captures a 568×1232 headless surface through `grim`, and injects touch through Sway's test command. A synthetic root-owned broker inside the test user namespace supplies only invented `Example` network names. Its request checks distinguish saved selection with no password, new WPA2 password submission, synthetic authentication failure, and Forget. It checks the eight-character password only by length, never prints it, and verifies that touch coordinates are absent from the Rust log while the Wi-Fi view is active. The script uses OCR plus image checks to wait for specific visual states, preventing a stale/loading frame from being misreported as a successful capture. A separate synthetic light palette tests readability; neither palette capture is a physical panel result.

Selected captures: [dark network list](paired-qemu/wifi-list-dark.png), [light network list](paired-qemu/wifi-list-light.png), [saved-network entry](paired-qemu/wifi-saved-entry.png), [masked password entry](paired-qemu/wifi-masked-dark.png), [authentication error](paired-qemu/wifi-auth-error-dark.png), [Forget confirmation](paired-qemu/wifi-forget-confirm-dark.png), [dark Settings with enabled gesture hint](paired-qemu/wifi-settings-dark.png), [light Settings with enabled gesture hint](paired-qemu/wifi-settings-light.png), and [Settings with the hint disabled](paired-qemu/wifi-keyboard-gesture-disabled-dark.png). The ea57 captures retain icon-only Backspace labels; later source revision `e2fa0366` uses explicit `Del`/`Delete` text, and its integrated target package still needs a final build. The screenshots are kept with the exact package identity rather than silently retouched.

The [installed board scan](board-scan.md) confirms the previously installed broker’s real socket/radio path with allowlisted counts only. That result does not prove this corrected source. Real association, protected persistence, recovery timer, reboot reconnect, Forget, and Settings touch/keyboard behavior on physical glass remain **UNVERIFIED**. The `49e204da` broker reselect correction and the `e2fa0366` key-label correction were not in the exact packages above.