feat: merge display-fix — touch driver, keyboard, WiFi setup UI

Squash-merge of feature/display-fix (27 commits):
- AXS15231B touch driver with coordinate parsing (touch.c/h)
- On-screen keyboard with layout/hit detection (keyboard.c/h)
- WiFi setup state machine + config_add_wifi (wifi_setup.c/h)
- Web-based WiFi setup via captive portal
- Display rotation fix (stride=480), color fixes, DMA byte-swap
- WiFi QR code on BOOT and ERROR screens
- ERROR state transition after WiFi retries exhausted
- Unit tests: test_touch, test_keyboard, test_wifi_setup
- Integration test: wifi_setup.mjs
- E2E test: wifi-setup.spec.mjs
- Per-board hardware locks for flash targets

Conflicts resolved: took master for config/cvm/api/main (more current),
took display-fix for display/axs15231b (newer fixes).

9 files changed, 514 insertions, 0 deletions

diff --git a/tests/unit/stubs/driver/gpio.h b/tests/unit/stubs/driver/gpio.h
new file mode 100644
index 0000000..d8dda0a
--- /dev/null
+++ b/tests/unit/stubs/driver/gpio.h
@@ -0,0 +1,44 @@
+#ifndef STUBS_DRIVER_GPIO_H
+#define STUBS_DRIVER_GPIO_H
+
+#include <stdint.h>
+
+typedef enum {
+    GPIO_MODE_DISABLE = 0,
+    GPIO_MODE_INPUT,
+    GPIO_MODE_OUTPUT,
+    GPIO_MODE_OUTPUT_OD,
+    GPIO_MODE_INPUT_OUTPUT_OD,
+    GPIO_MODE_INPUT_OUTPUT,
+} gpio_mode_t;
+
+typedef enum {
+    GPIO_INTR_DISABLE = 0,
+} gpio_int_type_t;
+
+typedef enum {
+    GPIO_PULLUP_DISABLE = 0,
+    GPIO_PULLUP_ENABLE,
+} gpio_pullup_t;
+
+typedef enum {
+    GPIO_PULLDOWN_DISABLE = 0,
+    GPIO_PULLDOWN_ENABLE,
+} gpio_pulldown_t;
+
+typedef struct {
+    uint64_t pin_bit_mask;
+    gpio_mode_t mode;
+    gpio_pullup_t pull_up_en;
+    gpio_pulldown_t pull_down_en;
+    gpio_int_type_t intr_type;
+} gpio_config_t;
+
+static inline int gpio_config(const gpio_config_t *cfg) { (void)cfg; return 0; }
+static inline int gpio_set_level(uint32_t gpio_num, uint32_t level) { (void)gpio_num; (void)level; return 0; }
+
+#define GPIO_INTR_DISABLE 0
+#define GPIO_PULLUP_DISABLE 0
+#define GPIO_PULLDOWN_DISABLE 0
+
+#endif
diff --git a/tests/unit/stubs/driver/i2c_master.h b/tests/unit/stubs/driver/i2c_master.h
new file mode 100644
index 0000000..f49eaad
--- /dev/null
+++ b/tests/unit/stubs/driver/i2c_master.h
@@ -0,0 +1,39 @@
+#ifndef STUBS_DRIVER_I2C_MASTER_H
+#define STUBS_DRIVER_I2C_MASTER_H
+
+#include "driver/i2c_types.h"
+#include "esp_err.h"
+#include <stdint.h>
+#include <stddef.h>
+
+static inline esp_err_t i2c_new_master_bus(const i2c_master_bus_config_t *cfg, i2c_master_bus_handle_t *ret) {
+    (void)cfg; (void)ret;
+    return ESP_OK;
+}
+
+static inline esp_err_t i2c_master_bus_add_device(i2c_master_bus_handle_t bus, const i2c_device_config_t *cfg, i2c_master_dev_handle_t *ret) {
+    (void)bus; (void)cfg; (void)ret;
+    return ESP_OK;
+}
+
+static inline esp_err_t i2c_master_transmit(i2c_master_dev_handle_t dev, const uint8_t *buf, size_t len, int timeout_ms) {
+    (void)dev; (void)buf; (void)len; (void)timeout_ms;
+    return ESP_OK;
+}
+
+static inline esp_err_t i2c_master_receive(i2c_master_dev_handle_t dev, uint8_t *buf, size_t len, int timeout_ms) {
+    (void)dev; (void)buf; (void)len; (void)timeout_ms;
+    return ESP_OK;
+}
+
+static inline esp_err_t i2c_master_bus_rm_device(i2c_master_dev_handle_t dev) {
+    (void)dev;
+    return ESP_OK;
+}
+
+static inline esp_err_t i2c_del_master_bus(i2c_master_bus_handle_t bus) {
+    (void)bus;
+    return ESP_OK;
+}
+
+#endif
diff --git a/tests/unit/stubs/driver/i2c_types.h b/tests/unit/stubs/driver/i2c_types.h
new file mode 100644
index 0000000..3590a8b
--- /dev/null
+++ b/tests/unit/stubs/driver/i2c_types.h
@@ -0,0 +1,45 @@
+#ifndef STUBS_DRIVER_I2C_TYPES_H
+#define STUBS_DRIVER_I2C_TYPES_H
+
+#include <stdint.h>
+#include <stddef.h>
+
+typedef int i2c_port_num_t;
+#define I2C_NUM_0 0
+
+typedef enum {
+    I2C_ADDR_BIT_LEN_7 = 0,
+} i2c_addr_bit_len_t;
+
+typedef enum {
+    I2C_CLK_SRC_DEFAULT = 0,
+} i2c_clock_source_t;
+
+typedef struct i2c_master_bus_t *i2c_master_bus_handle_t;
+typedef struct i2c_master_dev_t *i2c_master_dev_handle_t;
+
+typedef struct {
+    i2c_port_num_t i2c_port;
+    int sda_io_num;
+    int scl_io_num;
+    i2c_clock_source_t clk_source;
+    uint8_t glitch_ignore_cnt;
+    int intr_priority;
+    size_t trans_queue_depth;
+    struct {
+        uint32_t enable_internal_pullup : 1;
+        uint32_t allow_pd : 1;
+    } flags;
+} i2c_master_bus_config_t;
+
+typedef struct {
+    i2c_addr_bit_len_t dev_addr_length;
+    uint16_t device_address;
+    uint32_t scl_speed_hz;
+    uint32_t scl_wait_us;
+    struct {
+        uint32_t disable_ack_check : 1;
+    } flags;
+} i2c_device_config_t;
+
+#endif
diff --git a/tests/unit/test_keyboard b/tests/unit/test_keyboard
new file mode 100755
index 0000000..61cc9f5
--- /dev/null
+++ b/tests/unit/test_keyboard
diff --git a/tests/unit/test_keyboard.c b/tests/unit/test_keyboard.c
new file mode 100644
index 0000000..81ca328
--- /dev/null
+++ b/tests/unit/test_keyboard.c
@@ -0,0 +1,172 @@
+#include "test_framework.h"
+#include "../../main/keyboard.h"
+#include <string.h>
+
+int main(void)
+{
+    printf("=== test_keyboard ===\n");
+
+    const char *keys;
+    int count;
+
+    count = kb_get_row_keys(0, KB_ALPHA_LOWER, &keys);
+    ASSERT_EQ_INT(10, count, "Row 0 alpha lower has 10 keys");
+    ASSERT_EQ_INT('q', keys[0], "Row 0 starts with 'q'");
+    ASSERT_EQ_INT('p', keys[9], "Row 0 ends with 'p'");
+
+    count = kb_get_row_keys(1, KB_ALPHA_LOWER, &keys);
+    ASSERT_EQ_INT(9, count, "Row 1 alpha lower has 9 keys");
+    ASSERT_EQ_INT('a', keys[0], "Row 1 starts with 'a'");
+
+    count = kb_get_row_keys(2, KB_ALPHA_LOWER, &keys);
+    ASSERT(count > 0, "Row 2 alpha lower has keys");
+    ASSERT_EQ_INT('\001', keys[0], "Row 2 starts with SHIFT control char");
+
+    count = kb_get_row_keys(0, KB_ALPHA_UPPER, &keys);
+    ASSERT_EQ_INT(10, count, "Row 0 alpha upper has 10 keys");
+    ASSERT_EQ_INT('Q', keys[0], "Row 0 upper starts with 'Q'");
+
+    count = kb_get_row_keys(0, KB_NUMSYM, &keys);
+    ASSERT_EQ_INT(10, count, "Row 0 numsym has 10 keys");
+    ASSERT_EQ_INT('1', keys[0], "Row 0 numsym starts with '1'");
+    ASSERT_EQ_INT('0', keys[9], "Row 0 numsym ends with '0'");
+
+    count = kb_get_row_keys(-1, KB_ALPHA_LOWER, &keys);
+    ASSERT_EQ_INT(0, count, "Invalid row -1 returns 0");
+
+    count = kb_get_row_keys(99, KB_ALPHA_LOWER, &keys);
+    ASSERT_EQ_INT(0, count, "Invalid row 99 returns 0");
+
+    {
+        kb_result_t r = kb_hit_test(160, 10, KB_ALPHA_LOWER);
+        ASSERT(r.action == KB_ACTION_NONE, "Touch above keyboard = NONE");
+
+        r = kb_hit_test(160, 70 + 4 * (36 + 2) + 10, KB_ALPHA_LOWER);
+        ASSERT(r.action == KB_ACTION_NONE, "Touch below keyboard = NONE");
+    }
+
+    {
+        int margin_r0 = (320 - (10 * 28 + 9 * 2)) / 2;
+        int mid_x = margin_r0 + 28 / 2;
+        int mid_y = 70 + 36 / 2;
+        kb_result_t r = kb_hit_test(mid_x, mid_y, KB_ALPHA_LOWER);
+        ASSERT(r.action == KB_ACTION_CHAR, "Row 0 first key is a char");
+        ASSERT_EQ_INT('q', r.ch, "Row 0 first key = 'q'");
+    }
+
+    {
+        int margin_r0 = (320 - (10 * 28 + 9 * 2)) / 2;
+        int x = margin_r0 + 28 + 2 + 28 / 2;
+        int y = 70 + 36 / 2;
+        kb_result_t r = kb_hit_test(x, y, KB_ALPHA_LOWER);
+        ASSERT(r.action == KB_ACTION_CHAR, "Row 0 second key is a char");
+        ASSERT_EQ_INT('w', r.ch, "Row 0 second key = 'w'");
+    }
+
+    {
+        int margin_r1 = (320 - (9 * 28 + 8 * 2)) / 2;
+        int y_row1 = 70 + (36 + 2) + 36 / 2;
+        int x_row1 = margin_r1 + 28 / 2 + 28 / 2;
+        kb_result_t r = kb_hit_test(x_row1, y_row1, KB_ALPHA_LOWER);
+        ASSERT(r.action == KB_ACTION_CHAR, "Row 1 first key is a char");
+        ASSERT_EQ_INT('a', r.ch, "Row 1 first key = 'a'");
+    }
+
+    {
+        int margin_r2 = (320 - (9 * 28 + 8 * 2)) / 2 + 28;
+        int y_row2 = 70 + 2 * (36 + 2) + 36 / 2;
+        int x_row2 = margin_r2 + 28 / 2;
+        kb_result_t r = kb_hit_test(x_row2, y_row2, KB_ALPHA_LOWER);
+        ASSERT(r.action == KB_ACTION_SHIFT, "Row 2 first key = SHIFT");
+    }
+
+    {
+        kb_state_t st;
+        kb_state_init(&st);
+        ASSERT_EQ_INT(0, st.cursor, "Initial cursor = 0");
+        ASSERT_EQ_INT(KB_ALPHA_LOWER, st.layer, "Initial layer = lower");
+        ASSERT_EQ_STR("", st.input, "Initial input is empty");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_CHAR, 'h'});
+        ASSERT_EQ_STR("h", st.input, "After typing 'h': input='h'");
+        ASSERT_EQ_INT(1, st.cursor, "After typing 'h': cursor=1");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_CHAR, 'i'});
+        ASSERT_EQ_STR("hi", st.input, "After typing 'i': input='hi'");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_BACKSPACE, 0});
+        ASSERT_EQ_STR("h", st.input, "After backspace: input='h'");
+        ASSERT_EQ_INT(1, st.cursor, "After backspace: cursor=1");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_BACKSPACE, 0});
+        ASSERT_EQ_STR("", st.input, "After second backspace: empty");
+        ASSERT_EQ_INT(0, st.cursor, "After second backspace: cursor=0");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_BACKSPACE, 0});
+        ASSERT_EQ_INT(0, st.cursor, "Backspace on empty stays at 0");
+    }
+
+    {
+        kb_state_t st;
+        kb_state_init(&st);
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_SHIFT, 0});
+        ASSERT_EQ_INT(KB_ALPHA_UPPER, st.layer, "Shift: lower->upper");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_SHIFT, 0});
+        ASSERT_EQ_INT(KB_ALPHA_LOWER, st.layer, "Shift: upper->lower");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_LAYER, 0});
+        ASSERT_EQ_INT(KB_NUMSYM, st.layer, "Layer: lower->numsym");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_LAYER, 0});
+        ASSERT_EQ_INT(KB_ALPHA_LOWER, st.layer, "Layer: numsym->lower");
+    }
+
+    {
+        kb_state_t st;
+        kb_state_init(&st);
+
+        for (int i = 0; i < KB_INPUT_MAX; i++) {
+            kb_apply(&st, (kb_result_t){KB_ACTION_CHAR, 'a' + (i % 26)});
+        }
+        ASSERT_EQ_INT(KB_INPUT_MAX, st.cursor, "Filled to max");
+        ASSERT_EQ_INT(KB_INPUT_MAX, (int)strlen(st.input), "String length = max");
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_CHAR, 'Z'});
+        ASSERT_EQ_INT(KB_INPUT_MAX, st.cursor, "Overflow blocked");
+        ASSERT_EQ_INT(KB_INPUT_MAX, (int)strlen(st.input), "Length unchanged after overflow");
+    }
+
+    {
+        kb_state_t st;
+        kb_state_init(&st);
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_SPACE, ' '});
+        ASSERT_EQ_STR(" ", st.input, "Space adds space char");
+        ASSERT_EQ_INT(1, st.cursor, "Space increments cursor");
+    }
+
+    {
+        kb_state_t st;
+        kb_state_init(&st);
+        kb_result_t none = {KB_ACTION_NONE, 0};
+        kb_apply(&st, none);
+        ASSERT_EQ_STR("", st.input, "NONE action does nothing");
+
+        kb_apply(NULL, (kb_result_t){KB_ACTION_CHAR, 'x'});
+    }
+
+    {
+        kb_state_t st;
+        kb_state_init(&st);
+
+        kb_apply(&st, (kb_result_t){KB_ACTION_CHAR, 'P'});
+        kb_apply(&st, (kb_result_t){KB_ACTION_CHAR, '@'});
+        kb_apply(&st, (kb_result_t){KB_ACTION_CHAR, 's'});
+        kb_apply(&st, (kb_result_t){KB_ACTION_CHAR, 's'});
+        ASSERT_EQ_STR("P@ss", st.input, "Password build: P@ss");
+    }
+
+    TEST_SUMMARY();
+}
diff --git a/tests/unit/test_touch b/tests/unit/test_touch
new file mode 100755
index 0000000..43c8790
--- /dev/null
+++ b/tests/unit/test_touch
diff --git a/tests/unit/test_touch.c b/tests/unit/test_touch.c
new file mode 100644
index 0000000..13f04b5
--- /dev/null
+++ b/tests/unit/test_touch.c
@@ -0,0 +1,93 @@
+#include "test_framework.h"
+#include "../../main/touch.h"
+#include <string.h>
+
+int main(void)
+{
+    touch_point_t pt;
+    uint8_t data[8];
+
+    printf("=== test_touch ===\n");
+
+    memset(data, 0, sizeof(data));
+    touch_parse_raw(data, &pt);
+    ASSERT(!pt.touched, "All-zero data = no touch");
+
+    data[0] = 1;
+    data[1] = 1;
+    data[2] = 0;
+    data[3] = 0;
+    touch_parse_raw(data, &pt);
+    ASSERT(!pt.touched, "data[0]=1 = no touch (gesture byte nonzero)");
+
+    data[0] = 0;
+    data[1] = 0;
+    touch_parse_raw(data, &pt);
+    ASSERT(!pt.touched, "data[1]=0 = no touch (touch count zero)");
+
+    data[0] = 0;
+    data[1] = 1;
+    data[2] = 0x00;
+    data[3] = 0x64;
+    data[4] = 0x00;
+    data[5] = 0xC8;
+    data[6] = 0;
+    data[7] = 0;
+    touch_parse_raw(data, &pt);
+    ASSERT(pt.touched, "Valid touch: touched=true");
+    ASSERT_EQ_INT(100, (int)pt.x, "Valid touch: x=100");
+    ASSERT_EQ_INT(200, (int)pt.y, "Valid touch: y=200");
+
+    data[0] = 0;
+    data[1] = 1;
+    data[2] = 0x0F;
+    data[3] = 0xFF;
+    data[4] = 0x0F;
+    data[5] = 0xFF;
+    touch_parse_raw(data, &pt);
+    ASSERT(pt.touched, "Max raw coords: touched=true");
+    ASSERT_EQ_INT(TOUCH_MAX_X, (int)pt.x, "Max raw coords clamped to 319");
+    ASSERT_EQ_INT(TOUCH_MAX_Y, (int)pt.y, "Max raw coords clamped to 479");
+
+    data[0] = 0;
+    data[1] = 1;
+    data[2] = 0x05;
+    data[3] = 0x00;
+    data[4] = 0x08;
+    data[5] = 0x00;
+    touch_parse_raw(data, &pt);
+    ASSERT(pt.touched, "12-bit coords: touched=true");
+    ASSERT_EQ_INT(TOUCH_MAX_X, (int)pt.x, "12-bit x: (0x05 << 8) | 0x00 = 1280, clamped to 319");
+
+    data[0] = 0;
+    data[1] = 2;
+    touch_parse_raw(data, &pt);
+    ASSERT(!pt.touched, "data[1]=2 = too many touches, reject");
+
+    touch_parse_raw(NULL, &pt);
+    ASSERT(!pt.touched, "NULL data = no touch");
+
+    data[0] = 0;
+    data[1] = 1;
+    data[2] = 0x00;
+    data[3] = 0x00;
+    data[4] = 0x00;
+    data[5] = 0x00;
+    touch_parse_raw(data, &pt);
+    ASSERT(pt.touched, "Origin (0,0): touched=true");
+    ASSERT_EQ_INT(0, (int)pt.x, "Origin: x=0");
+    ASSERT_EQ_INT(0, (int)pt.y, "Origin: y=0");
+
+    data[0] = 0;
+    data[1] = 1;
+    data[2] = 0x01;
+    data[3] = 0x3F;
+    data[4] = 0x01;
+    data[5] = 0xDF;
+    touch_parse_raw(data, &pt);
+    ASSERT(pt.touched, "Mid-screen: touched=true");
+    ASSERT_EQ_INT(319, (int)pt.x, "Mid-screen: x=0x13F=319");
+    ASSERT_EQ_INT(479, (int)pt.y, "Mid-screen: y=0x1DF=479");
+
+    TEST_SUMMARY();
+}
diff --git a/tests/unit/test_wifi_setup b/tests/unit/test_wifi_setup
new file mode 100755
index 0000000..aa0e0b4
--- /dev/null
+++ b/tests/unit/test_wifi_setup
diff --git a/tests/unit/test_wifi_setup.c b/tests/unit/test_wifi_setup.c
new file mode 100644
index 0000000..5f1b8f0
--- /dev/null
+++ b/tests/unit/test_wifi_setup.c
@@ -0,0 +1,121 @@
+#include "test_framework.h"
+#include "../../main/wifi_setup.h"
+#include <string.h>
+
+int main(void)
+{
+    printf("=== test_wifi_setup ===\n");
+
+    wifi_setup_t setup;
+    wifi_setup_init(&setup);
+
+    ASSERT_EQ_INT(SETUP_SCAN, (int)setup.state, "Init state = SCAN");
+    ASSERT_EQ_INT(0, setup.ap_count, "Init ap_count = 0");
+    ASSERT_EQ_INT(-1, setup.selected_ap, "Init selected_ap = -1");
+
+    wifi_ap_info_t test_aps[3] = {
+        {"FastNet",     -30, true},
+        {"SlowNet",     -70, true},
+        {"OpenNet",     -50, false},
+    };
+    wifi_setup_set_aps(&setup, test_aps, 3);
+
+    ASSERT_EQ_INT(SETUP_LIST, (int)setup.state, "After set_aps: state = LIST");
+    ASSERT_EQ_INT(3, setup.ap_count, "After set_aps: ap_count = 3");
+    ASSERT_EQ_INT(3, wifi_setup_visible_count(&setup), "Visible count = 3");
+
+    {
+        const wifi_ap_info_t *ap = wifi_setup_get_visible(&setup, 0);
+        ASSERT(ap != NULL, "Visible AP 0 is not NULL");
+        ASSERT_EQ_STR("FastNet", ap->ssid, "AP 0 = FastNet");
+        ASSERT_EQ_INT(-30, ap->rssi, "AP 0 RSSI = -30");
+        ASSERT(ap->secured, "AP 0 is secured");
+    }
+
+    {
+        const wifi_ap_info_t *ap = wifi_setup_get_visible(&setup, 2);
+        ASSERT(ap != NULL, "Visible AP 2 is not NULL");
+        ASSERT_EQ_STR("OpenNet", ap->ssid, "AP 2 = OpenNet");
+        ASSERT(!ap->secured, "AP 2 is open");
+    }
+
+    {
+        const wifi_ap_info_t *ap = wifi_setup_get_visible(&setup, 3);
+        ASSERT(ap == NULL, "Out of range returns NULL");
+    }
+
+    setup_state_t s = wifi_setup_handle_select(&setup, 0);
+    ASSERT_EQ_INT(SETUP_PASSWORD, (int)s, "Select AP 0: state = PASSWORD");
+    ASSERT_EQ_INT(0, setup.selected_ap, "Selected AP index = 0");
+    ASSERT_EQ_STR("FastNet", setup.selected_ssid, "Selected SSID = FastNet");
+
+    wifi_setup_handle_connect(&setup);
+    ASSERT_EQ_INT(SETUP_CONNECTING, (int)setup.state, "Connect: state = CONNECTING");
+
+    s = wifi_setup_handle_connect_result(&setup, true, "192.168.1.42");
+    ASSERT_EQ_INT(SETUP_SUCCESS, (int)s, "Connect success: state = SUCCESS");
+    ASSERT_EQ_STR("192.168.1.42", setup.connect_ip, "Connect IP stored");
+
+    wifi_setup_init(&setup);
+    wifi_setup_set_aps(&setup, test_aps, 3);
+    wifi_setup_handle_select(&setup, 1);
+    wifi_setup_handle_connect(&setup);
+
+    s = wifi_setup_handle_connect_result(&setup, false, NULL);
+    ASSERT_EQ_INT(SETUP_FAILED, (int)s, "Connect fail: state = FAILED");
+    ASSERT(setup.connect_failed_auth, "Failed auth flag set");
+
+    s = wifi_setup_handle_retry(&setup);
+    ASSERT_EQ_INT(SETUP_PASSWORD, (int)s, "Retry: state = PASSWORD");
+    ASSERT(!setup.connect_failed_auth, "Retry clears auth flag");
+
+    wifi_setup_init(&setup);
+    wifi_setup_set_aps(&setup, test_aps, 3);
+    wifi_setup_handle_select(&setup, 0);
+    wifi_setup_handle_connect(&setup);
+    wifi_setup_handle_connect_result(&setup, false, NULL);
+
+    s = wifi_setup_handle_change_network(&setup);
+    ASSERT_EQ_INT(SETUP_LIST, (int)s, "Change network: state = LIST");
+
+    wifi_setup_init(&setup);
+    s = wifi_setup_handle_cancel(&setup);
+    ASSERT_EQ_INT(SETUP_CANCELLED, (int)s, "Cancel: state = CANCELLED");
+
+    wifi_setup_init(&setup);
+    wifi_ap_info_t many_aps[12];
+    for (int i = 0; i < 12; i++) {
+        snprintf(many_aps[i].ssid, sizeof(many_aps[i].ssid), "Net%d", i);
+        many_aps[i].rssi = -30 - i * 5;
+        many_aps[i].secured = true;
+    }
+    wifi_setup_set_aps(&setup, many_aps, 12);
+    ASSERT_EQ_INT(12, setup.ap_count, "12 APs stored");
+    ASSERT_EQ_INT(8, wifi_setup_visible_count(&setup), "Only 8 visible");
+
+    {
+        const wifi_ap_info_t *ap = wifi_setup_get_visible(&setup, 7);
+        ASSERT(ap != NULL, "8th visible AP exists");
+        ASSERT_EQ_STR("Net7", ap->ssid, "8th visible = Net7");
+    }
+
+    wifi_setup_init(&setup);
+    s = wifi_setup_handle_select(&setup, 0);
+    ASSERT_EQ_INT(SETUP_SCAN, (int)s, "Select in SCAN state = no change");
+
+    s = wifi_setup_handle_select(&setup, -1);
+    ASSERT_EQ_INT(SETUP_SCAN, (int)s, "Select invalid idx = no change");
+
+    wifi_setup_init(&setup);
+    wifi_setup_set_aps(&setup, test_aps, 3);
+    s = wifi_setup_handle_retry(&setup);
+    ASSERT_EQ_INT(SETUP_LIST, (int)s, "Retry in LIST state = no change");
+
+    s = wifi_setup_handle_change_network(&setup);
+    ASSERT_EQ_INT(SETUP_LIST, (int)s, "Change network in LIST state = no change");
+
+    ASSERT_EQ_INT(0, wifi_setup_visible_count(NULL), "NULL setup returns 0");
+    ASSERT(NULL == wifi_setup_get_visible(NULL, 0), "NULL setup returns NULL AP");
+
+    TEST_SUMMARY();
+}