Keystone 3 firmware

fix(zcash): preflight the batch in the QR display path

The QR batch scan opens the Zcash batch view directly
(gui_scan_widgets.c), bypassing the model check step, so the preflight
that populates g_checkedBatch never ran before the view parsed for
display. Parsing then failed with "no checked Zcash batch available"
because the checked container was NULL.

Run the batch preflight from GuiParseZcashBatchData when g_checkedBatch
is missing (the USB path pre-checks via service_resolve_ur, so guard on
NULL to avoid a redundant second preflight), and surface a preflight
failure through the existing batch parse-error window.

feat(zcash): resolve compact PCZT fields once in preflight

chore(zcash): repin pczt stack to the upstream 2557 teststack

refactor(zcash): rename checked PCZT check helpers

docs(zcash): rename preflight FUTURE marker to omitted-field-recompute

The previous tag "qr-v2-omitted-fields" collided with this project's
established use of "QR" for quantum-recoverable notes and referenced an
unpinned "v2". Rename to describe the step plainly.

style(zcash): rustfmt the checked-PCZT additions

refactor(zcash): drop ufvk from sign FFI and retire byte-level postflights

feat(zcash): drive batch display/sign from the checked batch container

refactor(zcash): route batch FFI through per-message checked preflight

feat(zcash): add batch-policy preflight for checked batch messages

feat(zcash): store checked_PCZT in C and drive display/sign from it

refactor(zcash): route single-tx FFI through checked-PCZT preflight/sign

feat(zcash): sign checked PCZTs with a single parse and in-memory postflight

feat(zcash): add single-parse preflight that normalizes checked PCZTs

feat(zcash): add ZcashCheckedPczt FFI container with digest binding

enhance the data content checking on the boot update logic

enhance the fp data checking logic

show the se gen version on the about the welcome UI page

feat(se): Move 2 W1 — SE generation detection, gen-isolated backend, gen-1 page-8 gate

- SeGen_t + GetSeGen(): classify the SE generation from the IMMUTABLE locked config manifest only (countMatch/chipOptions/slotConfig[8,13]/keyConfig[4,7,8,11,13]); fail-closed on UNPROVISIONED/INVALID. match_count is NOT used for classification (mutable; a transient slot-8 read must not flip a healthy device to INVALID).

- SeAccountBackend vtable + SeBackend() dispatcher: gen-1 wrappers map to the existing legacy derivation (derive_608/provision_608/on_unlock_success no-op); gen-2 stubs (filled in W2-W9); SeBackend() returns NULL for UNPROVISIONED/INVALID (fail closed).

- Gate the legacy page-8 wipe to SE_GEN_1 at the caller (AccountManagerInit) so it can never erase a gen-2 R_wrapped.

Scaffolding only: vtables in se_manager.c for now (physical split to src/managers/se/ during the gen-1 extraction); no callers wired -> zero runtime change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

add the function seCounter, matchCounter, rearm etc for se gen2

tmp

refactor the gen2 functions and add some functions in the driver

add the function for the gen2 R and K608 related usage

Gen2Provision608

change Gen2Provision608 and clear the secret K608

refactor the 608b logic and set add gen1 and gen2 backend logic

fix the building issues

fix the paras issues

update the solt/key config

show the se gen version in the device info

get the exsiting pwd to get R when adding the 2/3 wallet

check the device bricked in init on gen2

destroy the account and wipe device setting

add the se account status checking logic and change pwd logic

unset the pwd after change pwd and for gen2 use new way to get the existing account number

disable lock on add wallet and change password/pin

adjust current wallet limit and clear the r passs value as required

add the feature for forget password

fix the wrong pin limit issue and remove the logs

feat: add the weak pin modal

fix simulator and disable boot checking for dev build

fix: the weak-passcode modal free issue

clear the pw for R when lock the device

add data checking function when provision608 before R generation

init the view with g_proveOwnershipDone to false

roll kdf_i in the data check failed

set the state after all passed zero

fix the possible save account issues

prevent the pin dup try when reached back to lock view

add log for desstory account

fix the initail value issue on KeyboardWidget

fix: remove bump on the counter to enlarge the lifetime

refactor the code to move gen decision into the se backend

default to gen2 config in the blank chip

check the operation result to avoid mutation issue

fix the simulator

reorder the wipe function steps

add 10 limit on the password check try

drop the current working flow(add-wallet, change-pin etc) to home view if the password try reached limit and fix the memory leak issue

fix the R Recovery issue for nav back and forth on adding wallet view

fix the issue of drop forget pw flow

protect test R_wrapped value to prevent zero value caculation

remove the ForceLockScreen and fix create-wallet missing R issue

R protect: when forget pass, retype the same wallet pw and seed return not pass

clean the comment and salt value

chore(zcash): bump orchard to 0.15.0-pre.1, repoint librustzcash

Move orchard from the git-pinned b2af0a11 (BundleProtocol API) to the
published crates.io 0.15.0-pre.1 (BundleVersion API), drop the
[patch.crates-io] orchard git pin, and repoint the librustzcash patches
from dc95dcef to ironwood-integration (644b1ecf), which already builds
against orchard 0.15.0-pre.1. zcash_vendor's orchard constraint moves from
0.14 to 0.15.0-pre.1; the graph resolves to a single orchard 0.15.0-pre.1.

0.15.0-pre.1 splits note encryption by version, which required two changes:

- decode_output_enc_ciphertext (the PCZT trial-decrypt path) hardcoded
OrchardDomain (V2) and could not decrypt Ironwood (V3) actions. It now
selects IronwoodDomain for V3 notes and OrchardDomain for V2, keyed on the
action's note version.

- The sample-PCZT test fixtures had the same V2/V3 domain issue for the
Ironwood note, and minted their V2 Orchard source notes via an orchard_v3
coinbase, which 0.15.0-pre.1 now prohibits (the cross-address-restricted
Orchard pool forbids coinbase bundles). They now use IronwoodDomain for the
Ironwood note and mint the Orchard notes via orchard_v2, producing the same
V2 note.

Verified: cargo test -p app_zcash (cypherpunk) 90 passed incl. the
lean-sighash oracle and Ironwood verify/sign/parse tests; multi_coins 38
passed; clippy clean.

fix build

add 2.5.0 changelog

chore: bump beta version

fix(zcash): sign shielded PCZTs without RoleSigner to fit the device stack

The cypherpunk shielded PCZT signing path used the upstream pczt RoleSigner,
which reconstructs a full TransactionData for every bundle just to compute the
32-byte ZIP-244 sighash. That setup alone needs ~61 KB of stack, well over the
26 KB UiDisplayTask budget, so signing an Orchard->Ironwood migration batch
overflowed the task stack and the device reset into firmware verification.

Replace RoleSigner with the lean signer used before Ironwood: low_level_signer
driven in place, with the sighash computed by the in-repo byte-level
pczt_ext::shielded_sig_commitment instead of a TransactionData rebuild. Extend
that hasher to the v6 (NU6.3) Orchard and Ironwood commitment domains so it
stays correct for migration transactions. This restores the pre-Ironwood
signing footprint (~45 KB on host, the same as the path that already signs
shielded Orchard on shipping Keystones) while supporting Ironwood.

pczt_ext (zcash_vendor):
- digest_orchard_v6 / digest_ironwood_v6 and a v6 branch in
shielded_sig_commitment: v6 bundle personalizations, anchor omitted from the
effects digest, the 5-node to_hash_v6 layout.
- sign_ironwood driver mirroring sign_orchard; a shared sign_orchard_action
that defers the sign/skip decision to the signer (wallet-controlled
zero-value spends are still signed; tx_modifiable is cleared only when a new
signature is added).

app_zcash:
- A lean SeedSigner (PcztSigner) deriving keys and signing actions in place,
preserving the strict per-action validation from the removed collect path
(ZIP 32 derivation shape, dummy_sk rules, already-signed skip, per-account
key cache, PcztNoMyInputs).
- validate_supported_pczt rejects v6 PCZTs carrying a Sapling spend: the lean
hasher implements the Orchard/Ironwood v6 domains but not the v6 Sapling-spend
domain (distinct noncompact personalization, anchor omitted). Keystone never
signs Sapling spends; Sapling outputs are version-independent and remain
supported.

Oracle tests assert the lean sighash is bit-exact against
RoleSigner::shielded_sighash for Orchard-only, dual-pool migration, and
Ironwood-spend shapes, so any upstream sighash change fails CI rather than
producing wrong on-device signatures.

fix: cypherpunk build