Implement Read-Only OLED Status UI

docs/electrical_tests.md

@@ -4,7 +4,7 @@ These procedures verify the Phase 7A OLED and buttons, MAX3243 breakout, UART1 d
 
 > **Safety:** With power removed, install only the wiring required by the selected test. DE-9 pins 3 (`TX`), 4 (`DTR`), and 7 (`RTS`) are driven outputs. Never connect one of these outputs to another driven output. Keep temporary Dupont wiring short and secure. Power the OLED only from 3.3 V because module-mounted I²C pull-ups may connect SDA and SCL to the OLED `VCC` rail.
 
-## Phase 7A OLED and button bring-up
+## Phase 7 OLED and button bring-up
 
 Use the exact OLED and button connections in [Hardware wiring](wiring.md). Display diagnostics initially operate I²C at 100 kHz and probe the standard 7-bit `0x3c` and `0x3d` addresses. The connected test module acknowledges at `0x3c`, whose 8-bit write/read forms are `0x78` and `0x79`. A missing or unresponsive display is nonfatal: diagnostics should report it without disrupting UART0 or the serial services.
 
@@ -47,7 +47,7 @@ debug display pattern grid
 debug display pattern corners
 ```
 
-Confirm that clear and fill affect the full 128×64 area, checker and grid have regular spacing without shifted or wrapped columns, and all four corner markers are visible in the correct locations. Unexpected mirroring, rotation, clipping, or column offsets must be recorded before Phase 7B fixes the display-driver assumptions.
+Confirm that clear and fill affect the full 128×64 area, checker and grid have regular spacing without shifted or wrapped columns, and all four corner markers are visible in the correct locations. Display diagnostics pause the periodic status UI for 30 seconds so the selected pattern remains observable. Record any unexpected mirroring, rotation, clipping, or column offset for correction.
 
 ### 4. Rendered status/content layout
 
@@ -118,6 +118,19 @@ Use the longer run to check:
 
 `debug buttons test [seconds]` accepts 1 through 30 seconds and defaults to 10 seconds when omitted. Record unexpected event duplication, missed transitions, incorrect GPIO mapping, false long presses, or a test that fails to terminate.
 
+### 8. Read-only status UI (Phase 7C)
+
+After boot, the OLED starts on the **OVERVIEW** page. A short previous/back press on GPIO10 and a short next press on GPIO14 must wrap through these read-only pages:
+
+1. **OVERVIEW** — serial, broker, USB, HTTPS/WebSocket, SSH, and Wi-Fi summary.
+2. **RS232 MODEM** — framing, modem inputs, byte counters, queue depth, drops, and faults.
+3. **BROKER** — connected clients, current writer marker, pending output, and drop/event counters.
+4. **NETWORK SERVICES** — Wi-Fi state/RSSI/IP/AP state and HTTPS, WebSocket, and SSH service state.
+
+Confirm that each page remains entirely within the blue content panel and that the yellow strip continuously shows compact serial/Wi-Fi/client/service state. The UI refreshes at 4 Hz maximum and is read-only: select (GPIO13) must not change a service, acquire/release a writer, inject serial data, or expose passwords, credentials, tickets, or key material.
+
+With UART0, USB CDC, WebSocket, or SSH active, navigate pages and confirm that the display continues to update without disrupting serial traffic or UART0 recovery. Record a missing, stale, clipped, or implausible status value before Phase 7C is marked complete.
+
 ## Configuration A: data and handshake pairs
 
 Connect the following pairs:

docs/roadmap.md

@@ -212,10 +212,12 @@ The persistent yellow strip is reserved for serial-service state, Wi-Fi strength
    - Frame commits refresh only dirty 8-pixel pages. I²C runs at 100 kHz with bounded transactions.
    - The display bus initializes at boot; a known display is automatically initialized and cleared. A missing or unresponsive display is nonfatal and does not make the serial core dependent on it.
    - Target-hardware validation passed for initialization, all display diagnostic patterns, the rendered panel layout and physical divider, row 15/16 boundary, contrast, inversion, display-off/reinitialization, and button diagnostics. Observed contrast control has a useful brightness range of 1–255.
-3. **Phase 7C — Read-only status UI — Planned**
-   - Build display state from existing serial, Wi-Fi, broker, USB, WebSocket, HTTPS, and SSH snapshot APIs rather than parsing CLI output or reaching into transport internals.
-   - Provide overview, RS-232/modem, broker-client/writer, and network/service pages.
-   - Refresh at a bounded low rate, initially about 4 Hz, from a low-priority owner task. Never hold a service lock across an I²C transaction.
+3. **Phase 7C — Read-only status UI — Implemented; validation pending**
+   - The low-priority `local_status_ui` owner task builds display state from copied public serial, Wi-Fi, broker, USB, WebSocket, HTTPS, and SSH snapshots. It does not parse CLI output, reach into transport internals, or become a broker client.
+   - Previous/back and next short presses navigate overview, RS-232/modem, broker-client/writer, and network/service pages. Select has no state-changing action in this read-only phase.
+   - The task polls and debounces the existing active-low button inputs and refreshes at 4 Hz maximum. It collects service snapshots before beginning a display frame, so no service or broker lock is held across an I²C transaction.
+   - A missing/unresponsive display is nonfatal; the task remains read-only and never acquires serial writer ownership.
+   - Pending target-hardware validation: page navigation, each page's live snapshot values, concurrent USB/WebSocket/SSH operation while refreshing, and UART0 responsiveness.
 4. **Phase 7D — Local controls — Planned**
    - Add a shallow menu for safe serial, Wi-Fi, HTTPS, SSH, writer-release, display, and reboot actions through direct service APIs.
    - Require a visible confirmation screen and a timed select hold before stopping active services, revoking a writer, rebooting, or performing another disruptive action.