Summary
A clean-volume full report run at the companion remediation tree captured 1,235 PNGs, then correctly failed because three catalog entries claimed screens their tests did not retain:
test_storage_version_gate::test_v16_blob_upgrades_without_wiping: declared 4, captured 3test_storage_version_gate::test_bitcoin_only_band_refuses_without_wiping: declared 4, captured 3test_msg_eip712_streaming::test_spec_example_matches_the_published_hashes: declared 7, captured 1
Root cause
The EIP-712 walker is another manual call_raw() protocol loop. It directly presses and acknowledges every ButtonRequest, bypassing callback_ButtonRequest() and therefore retaining none of the typed-data field confirmations. Its sole PNG is the unrelated AdvancedMode policy prompt from setUp().
Focused reproduction also corrected the original catalog: the canonical Mail document produces nine, not seven, field screens (four domain leaves, two leaves for from, two for to, and contents). The report prose already stated “9 screens” but its entry collapsed each Person’s name and wallet into one claimed screen.
The two storage tests retain their wipe/import setup confirmations and the explicitly sampled post-boot home screen, but do not retain the claimed restored-address confirmation. Further isolation found that both storage behavioral tests also fail earlier because their flash mutator predates framed journal records; that deeper failure is tracked separately.
This extends #600: that issue listed three manual reset/recovery paths, but the looping auditor did not search for other direct call_raw() confirmation loops and did not execute a clean full report audit after diagnosing those examples.
Required remediation
- Reset EIP-712 screenshots after enabling AdvancedMode, then explicitly capture every typed-data
ButtonRequest before acknowledging it.
- Expand the canonical Mail catalog from seven combined labels to the actual nine field screens.
- Drive the storage address display through a deterministic manual confirmation helper that captures the address before approval and verifies the returned address.
- Keep or strengthen screen counts; do not exclude these tests.
- Re-run the clean-volume full and bitcoin-only report audits.
The stopped clean-run container and copied evidence were preserved before teardown.
Summary
A clean-volume full report run at the companion remediation tree captured 1,235 PNGs, then correctly failed because three catalog entries claimed screens their tests did not retain:
test_storage_version_gate::test_v16_blob_upgrades_without_wiping: declared 4, captured 3test_storage_version_gate::test_bitcoin_only_band_refuses_without_wiping: declared 4, captured 3test_msg_eip712_streaming::test_spec_example_matches_the_published_hashes: declared 7, captured 1Root cause
The EIP-712 walker is another manual
call_raw()protocol loop. It directly presses and acknowledges everyButtonRequest, bypassingcallback_ButtonRequest()and therefore retaining none of the typed-data field confirmations. Its sole PNG is the unrelated AdvancedMode policy prompt fromsetUp().Focused reproduction also corrected the original catalog: the canonical Mail document produces nine, not seven, field screens (four domain leaves, two leaves for
from, two forto, and contents). The report prose already stated “9 screens” but its entry collapsed each Person’s name and wallet into one claimed screen.The two storage tests retain their wipe/import setup confirmations and the explicitly sampled post-boot home screen, but do not retain the claimed restored-address confirmation. Further isolation found that both storage behavioral tests also fail earlier because their flash mutator predates framed journal records; that deeper failure is tracked separately.
This extends #600: that issue listed three manual reset/recovery paths, but the looping auditor did not search for other direct
call_raw()confirmation loops and did not execute a clean full report audit after diagnosing those examples.Required remediation
ButtonRequestbefore acknowledging it.The stopped clean-run container and copied evidence were preserved before teardown.