test(ui): second UI scenario, and the fixes it found

A second UI-test build (uitest-extra.jungle) covers the legacy PIN and
the forced new PIN, Change and Reset PIN, a queued Require PIN, UPC-A,
Code 39, the code error screen, the encoding progress, auto-lock on a
barcode, the light theme and the glance without a code; the main flow
adds the Steam and Library details and the menu's text screens.

Fixed from what it found: Entry IDs tripped the watchdog with 110
entries; auto-lock didn't close a locked barcode; a queued Require PIN
showed "Confirm in menu"; locked barcodes lacked the padlock; the PIN
keypad's bottom row, the Reset PIN question, text-screen bottoms, the
glance title and the light-theme warning colour.

Goldens approved on all seven watches; only the Forerunner 70 was
re-verified after the version bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 11 insertions, 4 deletions

diff --git a/tools/gen_fixture_wrap.py b/tools/gen_fixture_wrap.py
index 6eb207a..9daca94 100644
--- a/tools/gen_fixture_wrap.py
+++ b/tools/gen_fixture_wrap.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # Author:  cirakg & claude ai
-# Summary: Compute the UI-test fixture's PIN wrap (fake PIN 1234) so the watch needn't run PBKDF2 at start-up.
+# Summary: Compute the UI-test fixtures' PIN wraps (fake PINs 1234 and legacy 123456): no PBKDF2 on the watch at start.
 """Print the fake PIN wrap that source/app/Fixtures.mc stores in the UI-test build.
 
 The wrap follows docs/SECURITY.md ("PIN wrap, version 1") with fixed, fake
@@ -11,8 +11,12 @@ the fixture stores this precomputed value instead. The app's own unlock code
 then checks it like any other wrap, which also cross-checks the format.
 The fixture also stores the 4-digit PIN marker (KeyManager.PIN_LENGTH_KEY =
 PIN_DIGITS), so the PIN isn't treated as a legacy 4-to-10-digit one.
+The extra UI-test scenario stores LEGACY_WRAP instead, the same master key
+under the 6-digit PIN 123456 and without the marker: a PIN from before the
+4-digit rule, which unlocks with OK and is then replaced.
 
-Usage: gen_fixture_wrap.py   (prints FIXTURE_PIN, FIXTURE_WRAP and FIXTURE_MASTER_KEY in hex,
+Usage: gen_fixture_wrap.py   (prints FIXTURE_PIN, FIXTURE_WRAP, FIXTURE_MASTER_KEY,
+                              FIXTURE_LEGACY_PIN and FIXTURE_LEGACY_WRAP in hex,
                               and the marker the fixture stores)
 """
 
@@ -24,6 +28,7 @@ import struct
 import subprocess
 
 PIN = b"1234"
+LEGACY_PIN = b"123456"  # the extra scenario's PIN from before the 4-digit rule
 PIN_DIGITS = 4  # source/storage/KeyManager.mc: every new PIN, and the marker value
 PIN_LENGTH_KEY = "wl"  # source/storage/KeyManager.mc
 ITERATIONS = 2000
@@ -61,8 +66,8 @@ def sealed_box(enc_key: bytes, mac_key: bytes, aad: bytes, plaintext: bytes) ->
     return body + tag
 
 
-def fixture_wrap() -> bytes:
-    pin_key = hashlib.pbkdf2_hmac("sha256", PIN, SALT, ITERATIONS, 32)
+def fixture_wrap(pin: bytes = PIN) -> bytes:
+    pin_key = hashlib.pbkdf2_hmac("sha256", pin, SALT, ITERATIONS, 32)
     enc_key, mac_key = hkdf(pin_key, b"OTPW enc v1"), hkdf(pin_key, b"OTPW mac v1")
     count = struct.pack(">I", ITERATIONS)
     aad = b"OTPW-WRAP-1" + SALT + count
@@ -74,6 +79,8 @@ def main() -> None:
     print("FIXTURE_PIN =", PIN.decode())
     print("FIXTURE_WRAP =", fixture_wrap().hex())
     print("FIXTURE_MASTER_KEY =", MASTER_KEY.hex())
+    print("FIXTURE_LEGACY_PIN =", LEGACY_PIN.decode())
+    print("FIXTURE_LEGACY_WRAP =", fixture_wrap(LEGACY_PIN).hex())
     print(f"marker: {PIN_LENGTH_KEY} = {PIN_DIGITS}")