docs: record M7 (settings forms) results; bump to 0.7.0v0.7.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 53 insertions, 0 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e3882e..7ac63f2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,59 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-10-20
+
+Milestone M7: the phone settings forms. Entries can now be added and changed
+from Garmin Connect on the phone, one form at a time.
+
+### Added
+
+- The full settings form (`resources/settings/`): Add OTP, Add code, Manage
+  entry, Import, Options and a read-only About group, with every property of
+  README 10.2 and its strings.
+- Processing (`source/settings/SettingsJob.mc`) in README 10.3 order: Import,
+  Add OTP, Add code, Manage, then the About fields. Each form is applied only
+  when its switch is on. On success the form is cleared (secret first) and
+  its keyed hash remembered, so the same form sent again does nothing. After a
+  problem only the secret is cleared, so the rest can be corrected. Every form
+  writes a short result into its Result field and the results screen.
+- Add OTP (`OtpForm.mc`): TOTP, HOTP and Steam, validated as README 10.4 says
+  (Base32 errors name the character and position, a warning below 80 bits).
+- Add code (`CodeForm.mc`): all 12 symbologies, validated by the real encoder
+  (`CodeCheck`, a job for 2D codes), with a warning when the code doesn't fit
+  this screen. 2D codes are cached encoded on the way in, so the first
+  opening is instant.
+- Manage entry (`ManageForm.mc`): edit details, move, require or drop the
+  PIN, replace the secret or contents, set a HOTP counter, delete. Entry IDs
+  are case-insensitive.
+- Changes to locked entries wait for the PIN (README 7.9,
+  `ChangeQueue.mc`): they are sealed with the device key under `q`, listed
+  under "Phone changes" in the menu and applied only after the PIN is
+  entered on the watch, or rejected.
+- About fields (`AboutScan.mc`): the entry catalog (IDs and names, at most
+  800 characters; IDs and types only with "Encrypt names"), the version and
+  the storage use, rewritten only when something changed.
+- "Encrypt names" now works: new entries follow it, and existing ones are
+  re-sealed (locked ones after the next PIN entry).
+- Options are applied as soon as the phone saves them.
+- `tools/check_resources.py` (in `make lint`): every resource file validates
+  against the SDK's `resources.xsd`, and settings, properties and strings
+  agree. The dev image gains `xmlschema` for it.
+- Tests: 34 new Monkey C tests (154 per device), including every symbology
+  valid and invalid, every Manage action, the queue, idempotency and a
+  check that the form defaults match `properties.xml`. The UI flow sends the
+  forms the way the phone does and checks the results: a TOTP with its known
+  code, a Code 128 card that must decode, and a queued change confirmed with
+  the PIN.
+
+### Changed
+
+- Form hashes are keyed (HMAC-SHA256 with a key derived from the device
+  key) instead of plain SHA-256 of the content, because the content includes
+  secrets. Fields are fed to the native HMAC one by one: copying a large
+  import form into one buffer and zeroing it tripped the watchdog on the
+  Forerunner 255S during M7.
+
 ## [0.6.0] - 2026-10-20
 
 Milestone M6: barcodes. Code entries now show their barcode: all 12