COLDCARD firmware

This commit is a minor cleanup. It removes an obsolete unused method from the PIN handling code and fixes a punctuation error in a user-facing message shown when a spending policy blocks an action. There is no security-relevant change.

This commit is a routine update to the on-device menu layout and the developer tool that prints that layout. It reorganizes where options appear for a special 'SSSP' limited mode, renames some menu labels, and fixes a few internal code patterns (like replacing inline checks with named helper functions). There is no direct evidence in the commit of a security vulnerability being fixed.

This commit only adds and updates test files for the COLDCARD firmware. It expands automated tests for temporary seed handling under a restricted 'hobble' mode, including a new test case for BIP-39 passphrases and a more complete XPRV import test. There are no changes to the actual firmware code that runs on the device, so this commit does not introduce or fix any security vulnerability by itself.

This commit adjusts how COLDCARD's 'hobbled mode' handles temporary seeds and the Seed Vault. Hobbled mode is a restricted operating mode (often tied to a special PIN or duress-like setup). The change makes temporary seeds read-only: users can import and use an existing temporary seed for signing, but cannot generate new words or save the temporary seed into the Seed Vault. It also exposes a 'Temporary Seed' menu under Advanced/Tools when a spending-policy flag called 'okeys' is enabled. The commit is titled 'testing' and appears to be a work-in-progress feature patch with added tests, not a published security fix.

This commit fixes a small bug in the COLDCARD wallet's login security check. When the device asks the user to confirm the first and last seed words (to prove they know the backup), the old code could accidentally keep leftover words from a previous attempt. The change makes the word collection more reliable and adds a 'Startup...' message so the screen doesn't look frozen. It is a cleanup/hardening fix rather than a clear-cut exploitable vulnerability.

This commit fixes the 'first and last seed word' login challenge on older COLDCARD Mk4 devices. Previously, the on-screen word picker for this security check was broken (the code even had a 'TODO: fix bugs here on Mk4' comment), which could have allowed someone with physical access to bypass or fail the word-check screen. The patch replaces the buggy callback-based picker with a working one, so the device can now properly verify the user's seed words during login.

This commit fixes a PIN-uniqueness check in the COLDCARD's 'Seed Vault / Secure Spending Policy' setup. Previously, when a user picked an unlock PIN, the code only compared it against the main PIN and visible 'trick' PINs, but missed hidden trick PINs. That could let the same PIN be used for two different security features, which can cause confusion or allow a hidden trick PIN to silently override the intended unlock behavior. The patch now asks the secure element (SE2) whether the PIN is already in use anywhere before accepting it.

This commit adds and reorganizes a 'Spending Policy' feature for the COLDCARD hardware wallet. It lets owners set rules (daily limits, allowed addresses, time delays, web 2FA) that block or allow transaction signing. The change is a feature implementation, not a reported security bug fix. There is no vendor statement that this commit fixes a vulnerability, and no independent researcher is credited.

This commit adds a new 'hobbled mode' feature to the COLDCARD hardware wallet firmware. It lets a user set a 'Spending Policy' that restricts what the device can do even when the main PIN is entered. The policy can limit access to seed words, backups, secure notes, and certain signing operations. A special bypass PIN is required to disable or change the policy. The change is a feature addition, not a fix for a known vulnerability, and the commit message and code comments describe it as a user-controlled self-protection mechanism.

This commit is a minor code cleanup ('nits'). It moves a helper function, adds a comment, and removes an unused local import. There is no change to user-facing behavior or security logic.

This commit fixes a bug where the COLDCARD device's internal flash filesystem was created but not properly entered before trying to create a settings folder. As a result, the folder could be created in the wrong place or the filesystem setup could fail. The fix changes the code to enter the new filesystem first, then create the folder. A related change removes an extra argument when wiping the filesystem during seed operations, and adds a confirmation-key requirement to the filesystem wipe command to reduce accidental use.

This commit only adds a short paragraph to documentation stating that Seed XOR is an open standard and that others may use the name and implement it freely. There is no code change, no security fix, and no vulnerability.