chore(release): 0.9.0, the fixes from the first real-watch roundv0.9.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4 files changed, 96 insertions, 3 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 892d7a2..540e319 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,57 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-25
+
+Fixes from the first real-watch test on the Forerunner 70 (2026-10-21) and
+the settings spike results (M1).
+
+### Changed
+
+- The PIN is exactly 4 digits and is entered on the 4th digit, like the
+  watch's own lock screen; the keypad has no OK key. A PIN set by 0.8.0 or
+  earlier still unlocks, and the watch then asks for a new 4-digit PIN.
+  New PINs are marked with `wl` in app storage.
+- "Require PIN" sent from the phone while the watch is locked now applies
+  at the next PIN entry, without "Confirm all". Its Result says "Locks when
+  you next enter your PIN on the watch".
+
+### Fixed
+
+- Swiping up and down scrolls the entry list and the text screens (results,
+  About, benchmark); on the Forerunner 70 only the buttons worked.
+- One tap could open an entry twice (a tap also arriving as START), and on
+  the PIN screen START submitted the digits typed so far: the likely cause
+  of "Wrong PIN" followed by the code opening.
+- The first-time encoding progress of 2D codes jumped to 90 % and stayed
+  there; it now follows the work.
+- "Entry IDs" with many entries tripped the watchdog and closed the app; it
+  now reads the entries in steps.
+- Auto-lock now closes a locked barcode, as it does a locked code.
+- A locked barcode shows the padlock in the list; a queued Require PIN no
+  longer shows "Confirm in menu".
+- Clipped text: the Reset PIN question, the last line of text screens on
+  rectangular watches, the glance title on round watches; the warning colour
+  is darker in the light theme.
+
+### Tests
+
+- The UI flow has a second scenario (`uitest-extra.jungle`): legacy PIN and
+  the forced new PIN, Change and Reset PIN, the queued Require PIN, UPC-A,
+  Code 39, the code error screen, the encoding progress, auto-lock on a
+  barcode, the light theme and the glance without a code. The main flow
+  adds the Steam and Library details and the menu's text screens, scrolled
+  by swipes on touch screens. 42 to 44 screens per watch.
+
+### Documentation
+
+- The settings spike results (`docs/SETTINGS_SPIKE.md`): 8000 characters per
+  field and 64,000 in total arrive; `otpauth://` URIs save; a string with
+  `< > \ " { } %`, accented letters and an emoji was refused, with split test
+  strings to find out which.
+- The first Forerunner 70 benchmark (`docs/PERFORMANCE.md`) and what a
+  4-digit PIN means against a copy of the watch's storage (`docs/SECURITY.md`).
+
 ## [0.8.0] - 2026-10-21
 
 Milestone M8: polish, performance and the release candidate. 1.0.0 follows
diff --git a/docs/DEVELOPER_GUIDE.md b/docs/DEVELOPER_GUIDE.md
index fcecffb..a100404 100644
--- a/docs/DEVELOPER_GUIDE.md
+++ b/docs/DEVELOPER_GUIDE.md
@@ -56,6 +56,7 @@ Use other devices with `TEST_DEVICES="fr70 venu3"` on any target that takes a de
 
 - `debug`: what `make build`, `make sim` and `make perf` use. It contains the `(:debug)` diagnostics, the debug menu items (demo entries, performance overlay, on-watch benchmark) and the fixtures.
 - `uitest`: a debug build plus `uitest.jungle`, for `make screenshots`. It keeps the `(:uitest)` half of `source/util/TestMode.mc`, so the app starts with a wiped store, fake entries, the PIN 1234, a frozen clock and a 10 s auto-lock.
+- `uitest-extra`: like `uitest`, but with `uitest-extra.jungle`, which sets `TestMode.SCENARIO` to `SCENARIO_EXTRA`, so `Fixtures.loadExtra` loads a second scenario: a legacy 6-digit PIN without the `wl` marker, a queued Require PIN, UPC-A, Code 39, a broken EAN-13, a large QR and the light theme. `screenshots.sh` runs it after the main flow with `ui_flow.py --scenario extra`.
 - `stress`: a debug build plus `stress.jungle`, for `make watchdog`. It keeps the `(:stress)` half of `source/util/StressTest.mc`: the app starts straight into the watchdog stress test instead of the list.
 - `release`: `monkeyc -r` removes every `(:debug)` declaration; used by `make package`.
 - `test`: adds `test.jungle` and `--unit-test`.
@@ -110,14 +111,14 @@ The simulator is a GTK program. The scripts start it on a virtual display (Xvfb
 
 ### Screenshots and the UI flow
 
-`make screenshots` builds the UI-test variant and runs `tools/ui_flow.py` on every device in `TEST_DEVICES` and `SPOT_DEVICES`.
+`make screenshots` builds both UI-test variants and runs `tools/ui_flow.py` on every device in `TEST_DEVICES` and `SPOT_DEVICES`: the main flow, the glance with its code, the extra scenario, then the glance without a code. All seven watches take about 65 minutes; the Forerunner 70 alone (`make screenshots TEST_DEVICES=fr70 SPOT_DEVICES=`) about 8.
 
 1. **Input.** The flow clicks the buttons where the device's `simulator.json` draws them. It taps and swipes on touch screens, and long-presses for the menu where there's no MENU button.
 2. **Waiting.** After each input it waits for the screen's `DIAG shown <screen>` line. The list and the OTP screen print it only once every visible code is drawn.
 3. **Touch targets.** It reads where to tap from `DIAG list_focus` (the focused row) and `DIAG pin_keys` (the keypad).
 4. **Comparison.** Each screen is cut out of the window capture by `tools/sim_screenshot.py` and compared with `test/golden/<device>/<screen>.png`. That tool finds the device drawing by its bezel, so it doesn't assume a window layout. Differences go to `build/screenshots/<device>/<screen>-diff.png`.
 
-Because the entry IDs, the clock and the codes are fixed in the UI-test build, every run is pixel-identical. Native `Menu2` menus print nothing, so the flow waits a fixed 1.5 s for them. Touch-only watches show menus as a freely scrolling list without focus, so About is reached only on watches with buttons.
+Because the entry IDs, the clock and the codes are fixed in the UI-test build, every run is pixel-identical. Menu items are opened by label from the `DIAG menu items=` line; touch-only watches show menus as a freely scrolling list without focus, so their menu geometry is in `TOUCH_MENU_ROWS` in `tools/ui_flow.py` (a new touch-only test device needs an entry). PIN steps wait for `DIAG pin_state`, the encoding progress is checked from `DIAG code_progress`, and `shot(..., review=True)` saves screens that change from run to run (the benchmark, the progress) without comparing them. A state that needs other fixture data goes into the extra scenario, or a new `SCENARIO_*` with its own jungle and build mode.
 
 ### Performance and memory
 
diff --git a/docs/TESTING.md b/docs/TESTING.md
index c2c3e62..40c6925 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -26,6 +26,31 @@ Test devices (`TEST_DEVICES`): Forerunner 255S (weakest: 218 px round MIP, butto
 
 ## Results
 
+### Real-watch fixes, 2026-10-25 (version 0.9.0)
+
+The first real-watch round on the Forerunner 70 (docs/YOUR_STEPS.md parts 3 and 4, 2026-10-21) reported: no touch scrolling outside the menus, a hard-to-use PIN keypad, "Wrong PIN" once before a correct PIN opened the code, more digits typed than dots shown, the QR progress starting at 90 %, and Manage entry's Require PIN not applying. All are fixed (CHANGELOG 0.9.0). Unit tests: 168 per device.
+
+The UI flow now has two scenarios, 42 to 44 screens per watch:
+
+- **Main** (existing build, extended): Steam and Library details and the menu's text screens (results, entry IDs, clock status; About on touch-only watches), each scrolled with a swipe on touch screens, plus the benchmark (saved for review only).
+- **Extra** (`uitest-extra.jungle`, `Fixtures.loadExtra`, light theme): a Require PIN from the Manage form queued while locked and applied at the next PIN; UPC-A and Code 39 cards that must decode; the code error screen; the QR encoding progress, which must start below 30 % and only rise (Forerunner 70: 0, 11, 14, 22, 24, 42, 54, 63, 73, 85, 95 %); a legacy 6-digit PIN unlocked with OK, then a forced new 4-digit PIN with a mismatch; auto-lock closing a locked code card; Change PIN, Lock now, Reset PIN and creating a PIN; and the glance without a code.
+
+What the new flow found and what was fixed:
+
+- "Entry IDs" with 110 entries tripped the watchdog (all headers read in one event); it now reads 10 per step and shows "Reading…". The debug benchmark times at most 20 headers.
+- Auto-lock didn't close a locked code card (README 7.5); it does now.
+- The list said "Confirm in menu" for a queued Require PIN that applies by itself; locks are no longer counted there.
+- A locked code card showed the barcode icon instead of the padlock.
+- Without the OK key the keypad's bottom row looked like a missing key; it is now empty, 0, delete, as on a phone.
+- The Reset PIN question was cut mid-word; it is now "Erase locked entries?".
+- Venu X1 text screens lost their last line to the rounded corners; the bottom margin is now a tenth of the height.
+- On button-only watches the PIN selector's lower arrow touched the hint.
+- On the Forerunner 70 and 965 the round edge cut the glance title "OTP WALLET"; it falls back to "OTP Wallet".
+- The warning red was too faint on the light theme; it is darker there.
+- Not fixed: on the Instinct 3 AMOLED the system's round sub-screen covers the end of the glance title.
+
+Verification: `make screenshots TEST_DEVICES=fr70 SPOT_DEVICES=` passes (7 min 51 s). The goldens of all seven watches were approved in one run that passed on every device; only the Forerunner 70 was re-verified afterwards, because it is the watch that matters now. `make test`, `make lint`, `make test-tools` and `make watchdog` pass.
+
 ### M8, 2026-10-21 (polish and release candidate, version 0.8.0)
 
 - **Unit tests:** 163 per device on the Forerunner 255S, Venu Sq 2, Forerunner 70 and 965, all passing. New ones:
diff --git a/docs/YOUR_STEPS.md b/docs/YOUR_STEPS.md
index f9fb267..786515d 100644
--- a/docs/YOUR_STEPS.md
+++ b/docs/YOUR_STEPS.md
@@ -4,7 +4,7 @@
 -->
 # Your steps to 1.0.0
 
-Everything that can be checked in Docker is done (0.8.0, `make ci` green). What's left needs your phone, your Forerunner 70 and your Garmin account. This page puts all of it in one order. It replaces reading the [real-watch checklist](TESTING.md#real-watch-checklist) item by item; every checklist item is covered here.
+Everything that can be checked in Docker is done (0.9.0, `make ci` green). Round 1 (parts 3 and 4) is done; round 2 below covers its fixes. What's left needs your phone, your Forerunner 70 and your Garmin account. This page puts all of it in one order. It replaces reading the [real-watch checklist](TESTING.md#real-watch-checklist) item by item; every checklist item is covered here.
 
 **Rules for every step:** use only fake or test accounts and the fake secrets on this page. Never type a real secret into the app, the forms or the test pages.
 
@@ -21,6 +21,22 @@ Total time: about 2.5 to 3 hours, which can be split across days at any part bou
 | 7 | Uninstall check and clean-up | 10 min |
 | 8 | Send me the results | 5 min |
 
+## Round 2: version 0.9.0 (after your results of 2026-10-21)
+
+Your first round (parts 3 and 4, and 5.2) is recorded: the spike in [SETTINGS_SPIKE.md](SETTINGS_SPIKE.md#results), the benchmark in [PERFORMANCE.md](PERFORMANCE.md), and the fixes in the [changelog](../CHANGELOG.md) (0.9.0). Do this round next; then continue with the parts of round 1 you haven't done (5.3 onwards), on 0.9.0 instead of 0.8.0.
+
+1. **Spike test C, split.** Send yourself `spike/settings/test-strings/index.html` again (it has new strings). Paste each of `C1` to `C8` and `aegis-json` into Text 2 of Settings Spike and save. Note which ones the phone refuses. This decides whether Aegis JSON can be imported at all.
+2. **Build:** `make build DEVICE=fr70` and `make package` (gives `build/package/otp-wallet-0.9.0.iq`).
+3. **Update the Store beta.** Upload `otp-wallet-0.9.0.iq` as a new version of OTP Wallet and update it on the watch. Menu, **About** must say 0.9.0. Your entries must still be there.
+4. **Your old 6-digit PIN.** Open `TestLocked`. The keypad shows an OK key this one time: enter your old PIN and OK. The watch then asks for a new 4-digit PIN twice (use `1357`). After that the keypad has no OK key, and the 4th digit enters the PIN.
+5. **PIN keypad.** Leave the app, open `TestLocked` again, enter `1357`: it opens on the 4th digit. Try a wrong PIN: "Wrong PIN" at the 4th digit, no more digits than dots. Note whether the keys are easy to hit now.
+6. **Touch scrolling.** Swipe up and down on the entry list and on a text screen (menu, **About** or **Settings results**): they scroll. Note whether a short swipe scrolls too much or too little.
+7. **Require PIN from the phone:** part 6.6 (rewritten: turn on **Apply**; a Require PIN sent while the PIN isn't entered now applies when you next enter it).
+8. **QR progress.** Add a QR card (part 6.4 "Big QR") and open it the first time: the percentage should start low and rise steadily. Note the time.
+9. **Auto-lock on a barcode.** Lock a barcode card with Require PIN, open it, wait longer than **Lock after**: the card closes.
+
+Send the results of this round in the same form as part 8 ("OK" where it worked).
+
 ## What you need
 
 - The computer, with Docker running: `sudo systemctl start docker` (it is off after a reboot).