Add local OLED recovery controls

docs/electrical_tests.md

@@ -140,6 +140,23 @@ For the OLED-aging policy, leave all three buttons untouched and verify:
 
 `debug display status` may verify an individual transition in a separate timing run. Every display diagnostic counts as activity and holds normal UI rendering for 30 seconds, so do not invoke it between the five- and ten-minute observations of one continuous run. Record a missing, stale, clipped, or implausible status value or incorrect dim/off/wake transition before Phase 7C is marked complete.
 
+### 9. Local controls (Phase 7D)
+
+From a status page, use a short Select press to open **Controls**. Previous/next selects an item; Select activates it. The menu includes serial start/stop, Wi-Fi start/stop/reconnect, HTTPS start/stop, SSH start/stop, writer revocation, display off, and reboot. It must never show or change credentials, Wi-Fi profiles, serial framing, TLS/SSH keys, or I²C scan controls.
+
+Stopping a service, Wi-Fi reconnect, writer revocation, and reboot open a confirmation page. Verify that:
+
+1. Previous/back cancels the confirmation without changing the selected service or writer.
+2. A short Select press does not execute the action.
+3. Only one continuous two-second Select hold executes the action once; releasing it does not repeat the action.
+4. Any simultaneous button chord is ignored and cannot confirm an action.
+5. An untouched confirmation expires to the menu after 30 seconds.
+6. A dimmed/off OLED consumes the first button press for wake only; its later release and hold must not navigate or confirm an action.
+
+For Wi-Fi lifecycle calls, confirm the immediate result says `Requested`, then use the status pages to observe the asynchronous state change. HTTPS and SSH starts must fail cleanly when neither station nor AP networking is available. Writer revocation must only release the current writer—never assign a replacement—and the UI must never appear as a broker client. For reboot, observe `Restarting...`, then verify all normal boot services and UART0 recovery return.
+
+Run these checks with UART0 available. Repeat appropriate stop/revoke cases with USB CDC, WebSocket, and SSH clients connected; verify the intended session/service is interrupted, unrelated recovery paths remain responsive, and no action injects serial data.
+
 ## Configuration A: data and handshake pairs
 
 Connect the following pairs:

docs/roadmap.md

@@ -184,7 +184,7 @@ The order below is the current plan. Phase 7 is in progress; later phases remain
 
 Add a standalone local status/control interface without making it a dependency of the serial core. The planning baseline uses a 128×64 dual-color monochrome I²C OLED sold with an SSD1315 controller. Phase 7A confirmed SSD1306-compatible operation, 7-bit I²C address `0x3c`, orientation, column mapping, contrast/inversion behavior, button inputs, and the physical color geometry on the selected hardware.
 
-Phase 7A diagnostics and target-hardware electrical validation are complete. Phases 7B and 7C are complete; Phase 7 overall remains in progress (7D). Phases 7D and 7E are not complete.
+Phase 7A diagnostics and target-hardware electrical validation are complete. Phases 7B and 7C are complete; Phase 7 overall remains in progress (7D). Phase 7D is implemented and awaiting validation; Phase 7E is not complete.
 
 #### Hardware baseline
 
@@ -220,10 +220,12 @@ The persistent yellow strip uses fixed-position serial, Wi-Fi-strength, USB, Web
    - To reduce OLED aging, inactivity dims contrast to `1` after five minutes and switches the panel off after ten minutes. The first debounced button press restores contrast `127` and wakes without navigating.
    - A missing/unresponsive display is nonfatal; the task remains read-only and never acquires serial writer ownership.
    - Target-hardware validation passed for the four pages, fixed active-only status icons, lowercase layout, diagnostics hold, dim/off/wake behavior, all available concurrent client interfaces, UART0 recovery, and serial traffic from 9600 through 230400 baud.
-4. **Phase 7D — Local controls — Planned**
-   - Add a shallow menu for safe serial, Wi-Fi, HTTPS, SSH, writer-release, display, and reboot actions through direct service APIs.
-   - Require a visible confirmation screen and a timed select hold before stopping active services, revoking a writer, rebooting, or performing another disruptive action.
-   - A local display is not a serial broker client and cannot silently acquire the writer lease.
+4. **Phase 7D — Local controls — Implemented; validation pending**
+   - A shallow local `Controls` menu directly invokes public serial-service, Wi-Fi, HTTPS, SSH, broker, display, and restart APIs; it never parses or injects CLI text.
+   - The menu provides serial start/stop, Wi-Fi start/stop/reconnect, HTTPS start/stop, SSH start/stop, emergency current-writer revocation, display off, and reboot. It deliberately excludes serial configuration editing, credentials, Wi-Fi profile/AP changes, host-key/certificate changes, I²C scans, and assignment of the writer to another client.
+   - A visible confirmation screen and one continuous two-second Select hold are required for service stops, Wi-Fi reconnect, writer revocation, and reboot. The confirmation times out after 30 seconds; previous/back cancels. A wake press is consumed and cannot navigate or confirm an action.
+   - Wi-Fi lifecycle results report a queued request rather than falsely claiming an asynchronous transition has completed. HTTPS/SSH start requests require a connected station or active AP. The current writer is only ever force-released to no writer; the UI is not a broker client and cannot acquire or assign a writer lease.
+   - Pending target-hardware validation: menu navigation/timeouts, each enabled action and error result, confirmation cancellation/chord rejection, wake-press suppression, and preservation of UART0 plus transport recovery.
 5. **Phase 7E — Reliability, persistence, and documentation — Planned**
    - Make the implemented contrast dim/blank timeouts configurable and persistent without making the display necessary for recovery.
    - Validate display removal, I²C NACK/timeouts, stuck buttons, queue saturation, and repeated actions.