docs: user guide, known limitations and M8 results; bump to 0.8.0v0.8.0

0.8.0 is the release candidate: 1.0.0 is tagged after the on-watch
checklist (docs/TESTING.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 16 insertions, 13 deletions

diff --git a/README.md b/README.md
index 87c3a46..1045ec6 100644
--- a/README.md
+++ b/README.md
@@ -6,14 +6,15 @@
 
 A Garmin Connect IQ watch app that shows one-time passwords (TOTP, HOTP, and optional Steam Guard codes) and stores barcodes and QR codes (loyalty cards, tickets) to show at a scanner. Everything lives encrypted on the watch. There is no cloud, no backend and no analytics, and the app requests no permissions, so it cannot use the network.
 
-> **Status: M7 (phone settings forms) done; next is M8, polish and release; M1 (settings spike) and the M7 phone check wait for you.** The plan below was approved on 2026-10-18. M0 built the Docker toolchain and pipeline, M2 the crypto and OTP core, M3 the encrypted vault ([docs/SECURITY.md](docs/SECURITY.md)), M4 the screens, M5 import (`otpauth://` and Aegis JSON via the phone settings) and M6 all 12 barcode symbologies, encoded on the watch. M7 added the rest of the phone settings:
+> **Status: M8 (polish, performance, release candidate) done in Docker as version 0.8.0; 1.0.0 is tagged after your on-watch checklist.** The plan below was approved on 2026-10-18. M0 built the Docker toolchain and pipeline, M2 the crypto and OTP core, M3 the encrypted vault ([docs/SECURITY.md](docs/SECURITY.md)), M4 the screens, M5 import (`otpauth://` and Aegis JSON via the phone settings), M6 all 12 barcode symbologies and M7 the phone settings forms. M8 added:
 >
-> - **Add OTP and Add code forms**, validated on the watch (codes by the real encoders), with a short result written back to each form.
-> - **Manage entry** by ID: edit, move, require or drop the PIN, replace the secret or contents, set a HOTP counter, delete. Changes to locked entries wait until you confirm them with the PIN on the watch.
-> - **Options** applied as soon as you save, and a read-only **About** group with the entry IDs.
-> - **Checks:** the resource XML validates against the SDK schema; the UI flow sends the forms the way the phone does and checks the new entries on screenshots.
+> - **The favourite code in the glance** (opt-in), and favourite marks in Manage entry.
+> - **Brightness** for barcodes: full brightness on AMOLED watches, the backlight on MIP watches, for about a minute.
+> - **Memory and speed:** a 100-entry import peaks at 45 % of the Forerunner 255S's memory instead of 56 %; QR mask scoring on packed rows; two job steps per tick on the 768 KB watches.
+> - **Watchdog safety:** every 2D encoder now handles the largest inputs the app accepts without being stopped by the watchdog, proven by `make watchdog` at twice the normal work per event.
+> - **Docs:** the [user guide](docs/USER_GUIDE.md) with the [known limitations](docs/USER_GUIDE.md#known-limitations).
 >
-> The settings spike (`make spike`, [docs/SETTINGS_SPIKE.md](docs/SETTINGS_SPIKE.md)) and the M7 check with the Store beta wait for your phone. The Phase 0 research, with sources, is in [docs/FEASIBILITY.md](docs/FEASIBILITY.md); the daily workflow is in [docs/DEVELOPER_GUIDE.md](docs/DEVELOPER_GUIDE.md).
+> Waiting for you: the settings spike (`make spike`, [docs/SETTINGS_SPIKE.md](docs/SETTINGS_SPIKE.md)) and the [real-watch checklist](docs/TESTING.md#real-watch-checklist) with the 0.8.0 beta. The Phase 0 research, with sources, is in [docs/FEASIBILITY.md](docs/FEASIBILITY.md); the daily workflow is in [docs/DEVELOPER_GUIDE.md](docs/DEVELOPER_GUIDE.md).
 
 "OTP Wallet" is a working title.
 
@@ -388,7 +389,7 @@ Garmin's "array settings" (growable lists) are broken today. A failed save reset
 | Property | Type | Field | Notes |
 | --- | --- | --- | --- |
 | `mgId` | string | alphaNumeric | The entry ID shown on the watch, for example `K7F2` (case-insensitive) |
-| `mgAction` | number | list | Edit details, Move to position, Require PIN, Don't require PIN, Replace secret or contents, Set HOTP counter, Delete |
+| `mgAction` | number | list | Edit details, Move to position, Require PIN, Don't require PIN, Replace secret or contents, Set HOTP counter, Delete, Mark as favourite (glance), Remove favourite (M8) |
 | `mgName`, `mgAccount`, `mgGroup` | string | alphaNumeric | Blank means unchanged. `-` clears the group |
 | `mgPosition` | number | numeric (≥ 1) | |
 | `mgSecret` | string | password | New secret (Base32) or new code contents |
@@ -620,7 +621,7 @@ A symbology counts as implemented only when checks 1 to 3 pass. Otherwise it's l
 - **PIN**: a keypad on touch screens; a digit selector on button-only watches. Digits show as dots. A wrong PIN vibrates (where available) and shows any waiting time.
 - **Create or change PIN**: enter it twice. Warns below 6 digits.
 - **Menu**: Lock now, Change PIN, Reset PIN (erases locked entries), Settings results, Entry IDs, Clock status, About (version, storage use, self-test result).
-- **Glance**: "OTP Wallet · 12 entries". If you turn it on, it shows the favourite unlocked TOTP code with a progress bar instead.
+- **Glance**: "OTP Wallet · 12 entries". If you turn it on, it shows the code of the first favourite TOTP or Steam entry without the PIN, with a progress bar, instead ([docs/SECURITY.md](docs/SECURITY.md#glance-code)).
 
 ### 13.2 Flow
 
@@ -741,11 +742,12 @@ The Garmin SDK and device files are never baked into an image (Garmin's licence)
 | `make screenshots-approve` | Save the current screens as the approved images, after you've reviewed them | no |
 | `make icons` | Regenerate the per-size launcher icons after the product list changes | no |
 | `make perf` | Performance measurements against the budgets | no |
-| `make memtest` | Peak memory on Forerunner 255S, app and glance | no |
+| `make memtest` | Memory after the first frame and in the glance, on `TEST_DEVICES` | no |
+| `make watchdog` | The largest code of every 2D symbology encoded, packed and drawn at twice the steps per event, on `WATCHDOG_DEVICES` (Forerunner 255S and 70); fails on a watchdog trip or if the last code doesn't decode | no |
 | `make lint` | Strict type check (`-l 3`) with warnings as errors, project lint rules, settings XML schema check, Python lint for the tools | no |
 | `make package` | Signed `.iq` for the Store beta, plus per-device `.prg` files | no |
 | `make docs` | Markdown lint, link check, Mermaid render check | no (yes when building the docs image) |
-| `make ci` | lint, test, screenshots, perf, memtest, package, docs | no |
+| `make ci` | lint, test, screenshots, perf, memtest, watchdog, package, docs | no |
 | `make products` | Check the manifest's product list against the downloaded device files | no |
 | `make lock` | Regenerate the Python and npm lock files (only releases older than the cutoff date) | yes |
 | `make vectors` | Regenerate the cross-checked crypto and OTP test vectors | no |
@@ -890,6 +892,7 @@ Done when: each symbology is either marked implemented with every check green, o
   - Final `docs/` and the manual test checklist.
   - `make ci` green; signed `.iq` and per-device `.prg` files; `CHANGELOG` 1.0.0; the final list of known limitations.
 - **Done when**: `make ci` is green from a clean checkout, you've completed the on-watch checklist, and 1.0.0 is tagged.
+- **Status (2026-10-21)**: done in Docker as 0.8.0, the release candidate: `make ci` is green, also from a clean checkout; the signed `.iq` and the release `.prg` files are built by `make package`; the known limitations are in [docs/USER_GUIDE.md](docs/USER_GUIDE.md#known-limitations). Your on-watch checklist ([docs/TESTING.md](docs/TESTING.md#real-watch-checklist)) comes before the 1.0.0 tag.
 
 ## 17. Test plan
 
@@ -948,7 +951,7 @@ Tests are written alongside the code, never after.
 
 ### 17.6 Performance and memory
 
-See [section 18](#18-performance-budgets). `make perf` and `make memtest` fail the build when a budget is exceeded.
+See [section 18](#18-performance-budgets). `make perf` and `make memtest` fail the build when a budget is exceeded. `make watchdog` (M8) runs the largest input of every 2D encoder with twice the normal steps per event, so each step is proven to use at most half the watchdog budget, and draws the largest codes each screen fits.
 
 ### 17.7 Static checks
 
@@ -963,7 +966,7 @@ See [section 18](#18-performance-budgets). `make perf` and `make memtest` fail t
 
 ### 17.8 `make ci`
 
-Runs lint, test, screenshots, perf, memtest, package and docs in that order, and stops at the first failure.
+Runs lint, test, screenshots, perf, memtest, watchdog, package and docs in that order, and stops at the first failure.
 
 ### 17.9 Manual checklist on the real watch
 
@@ -1038,7 +1041,7 @@ The simulator runs on your PC's CPU, so its timings don't represent a watch. In
 ├── CHANGELOG.md
 ├── Makefile                   host entry point; every target runs in Docker
 ├── manifest.xml
-├── monkey.jungle              debug, release and test configurations
+├── monkey.jungle              debug, release and test configurations (+ test, uitest, stress .jungle)
 ├── docker/
 │   ├── Dockerfile             garmin-otp/dev
 │   ├── docs.Dockerfile        garmin-otp/docs