Routers in WPA2+WPA3 transition mode (PMF required) reject the plain
WPA-PSK/no-PMF config the provisioning flow wrote, and the UI reported
every failure as a wrong password. When the running wpa_supplicant
supports SAE (probed once via wpa_cli get_capability key_mgmt — never
write fields an older supplicant would reject as a parse error), the
network block now offers key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE with
ieee80211w=1. SAE authenticates with the raw passphrase by protocol
design, so sae_password is written alongside the hashed psk (file is
0600 on /data).

The connect worker now distinguishes its failure modes — config
write/service restart, association timeout, DHCP timeout — and the
hint names the failing layer instead of always blaming the password;
on no-SSH release images the screen is the only diagnostic port.

Pairs with instrument-cluster-os enabling
BR2_PACKAGE_WPA_SUPPLICANT_WPA3.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>