Add local OLED recovery controls

docs/roadmap.md

@@ -184,7 +184,7 @@ The order below is the current plan. Phase 7 is in progress; later phases remain
 
 Add a standalone local status/control interface without making it a dependency of the serial core. The planning baseline uses a 128×64 dual-color monochrome I²C OLED sold with an SSD1315 controller. Phase 7A confirmed SSD1306-compatible operation, 7-bit I²C address `0x3c`, orientation, column mapping, contrast/inversion behavior, button inputs, and the physical color geometry on the selected hardware.
 
-Phase 7A diagnostics and target-hardware electrical validation are complete. Phases 7B and 7C are complete; Phase 7 overall remains in progress (7D). Phases 7D and 7E are not complete.
+Phase 7A diagnostics and target-hardware electrical validation are complete. Phases 7B and 7C are complete; Phase 7 overall remains in progress (7D). Phase 7D is implemented and awaiting validation; Phase 7E is not complete.
 
 #### Hardware baseline
 
@@ -220,10 +220,12 @@ The persistent yellow strip uses fixed-position serial, Wi-Fi-strength, USB, Web
    - To reduce OLED aging, inactivity dims contrast to `1` after five minutes and switches the panel off after ten minutes. The first debounced button press restores contrast `127` and wakes without navigating.
    - A missing/unresponsive display is nonfatal; the task remains read-only and never acquires serial writer ownership.
    - Target-hardware validation passed for the four pages, fixed active-only status icons, lowercase layout, diagnostics hold, dim/off/wake behavior, all available concurrent client interfaces, UART0 recovery, and serial traffic from 9600 through 230400 baud.
-4. **Phase 7D — Local controls — Planned**
-   - Add a shallow menu for safe serial, Wi-Fi, HTTPS, SSH, writer-release, display, and reboot actions through direct service APIs.
-   - Require a visible confirmation screen and a timed select hold before stopping active services, revoking a writer, rebooting, or performing another disruptive action.
-   - A local display is not a serial broker client and cannot silently acquire the writer lease.
+4. **Phase 7D — Local controls — Implemented; validation pending**
+   - A shallow local `Controls` menu directly invokes public serial-service, Wi-Fi, HTTPS, SSH, broker, display, and restart APIs; it never parses or injects CLI text.
+   - The menu provides serial start/stop, Wi-Fi start/stop/reconnect, HTTPS start/stop, SSH start/stop, emergency current-writer revocation, display off, and reboot. It deliberately excludes serial configuration editing, credentials, Wi-Fi profile/AP changes, host-key/certificate changes, I²C scans, and assignment of the writer to another client.
+   - A visible confirmation screen and one continuous two-second Select hold are required for service stops, Wi-Fi reconnect, writer revocation, and reboot. The confirmation times out after 30 seconds; previous/back cancels. A wake press is consumed and cannot navigate or confirm an action.
+   - Wi-Fi lifecycle results report a queued request rather than falsely claiming an asynchronous transition has completed. HTTPS/SSH start requests require a connected station or active AP. The current writer is only ever force-released to no writer; the UI is not a broker client and cannot acquire or assign a writer lease.
+   - Pending target-hardware validation: menu navigation/timeouts, each enabled action and error result, confirmation cancellation/chord rejection, wake-press suppression, and preservation of UART0 plus transport recovery.
 5. **Phase 7E — Reliability, persistence, and documentation — Planned**
    - Make the implemented contrast dim/blank timeouts configurable and persistent without making the display necessary for recovery.
    - Validate display removal, I²C NACK/timeouts, stuck buttons, queue saturation, and repeated actions.