SSSP update menu tree & related adjustments

diff --git a/docs/menu-tree.txt b/docs/menu-tree.txt
index 0bb460d..8a9dea5 100644
--- a/docs/menu-tree.txt
+++ b/docs/menu-tree.txt
@@ -55,7 +55,6 @@
       From VirtDisk [IF VIRTDISK ENABLED]
     File Management
       Verify Backup
-      Teleport Multisig PSBT [IF QR AND SECRET]
       List Files
       Verify Sig File
       NFC File Share [IF NFC ENABLED]
@@ -169,12 +168,12 @@
 [NORMAL OPERATION]
   Ready To Sign
   Passphrase [IF WORD BASED SEED]
-    Restore Saved [MAYBE]
-      A***********
-        [0C52BAD4]
+    Restore Saved
+      c*******
+        [3A14F788]
         Restore
         Delete
-    Edit Phrase [MAYBE]
+    Edit Phrase [IF QWERTY]
     Add Word [IF NOT QWERTY]
       [SEED WORD MENUS]
     Add Numbers [IF NOT QWERTY]
@@ -198,35 +197,44 @@
     Account Number
     Custom Path
     CC-2-of-4
-  Secure Notes & Passwords [IF ENBALED]
-    1: note1
-      "note1"
+  Secure Notes & Passwords [IF ENBALED] [MAYBE]
+    1: note0
+      "note0"
       View Note
       Edit
       Delete
       Export
-      SHORTCUT
-      SHORTCUT
-    2: nostr
-      "nostr"
-      ↳ scg
-      ↳ brb.io
+      Sign Note Text
+    2: secret-PWD
+      "secret-PWD"
+      ↳ satoshi
+      ↳ abc.org
       View Password
       Send Password [MAYBE]
       Export
       Edit Metadata
       Delete
       Change Password
-      SHORTCUT
-      SHORTCUT
+      Sign Note Text
     New Note
     New Password
     Export All
+    Sort By Title
     Import
   Type Passwords [MAYBE]
   Seed Vault [MAYBE]
-    1: [B14E9AE0]
-      [B14E9AE0]
+     1: [7126EB3C]
+      [7126EB3C]
+      Use This Seed
+      Rename
+      Delete
+     2: [CCEE13B9]
+      [CCEE13B9]
+      Use This Seed
+      Rename
+      Delete
+     3: [03EE9989]
+      [03EE9989]
       Use This Seed
       Rename
       Delete
@@ -237,17 +245,18 @@
       Restore Backup
       Clone Coldcard
     Export Wallet
+      Sparrow
+      Cove
       Bitcoin Core
-      Fully Noded
-      Sparrow Wallet
       Nunchuk
+      Bull Bitcoin
       Zeus
       Electrum Wallet
-      Theya
-      Bitcoin Safe
       Wasabi Wallet
+      Fully Noded
       Unchained
-      Lily Wallet
+      Theya
+      Bitcoin Safe
       Samourai Postmix
       Samourai Premix
       Descriptor
@@ -267,17 +276,18 @@
       Verify Backup
       Backup System
       Export Wallet
+        Sparrow
+        Cove
         Bitcoin Core
-        Fully Noded
-        Sparrow Wallet
         Nunchuk
+        Bull Bitcoin
         Zeus
         Electrum Wallet
-        Theya
-        Bitcoin Safe
         Wasabi Wallet
+        Fully Noded
         Unchained
-        Lily Wallet
+        Theya
+        Bitcoin Safe
         Samourai Postmix
         Samourai Premix
         Descriptor
@@ -291,7 +301,7 @@
         Dump Summary
       Sign Text File
       Batch Sign PSBT
-      Teleport Multisig PSBT [IF QR AND SECRET]
+      Teleport Multisig PSBT
       List Files
       Verify Sig File
       NFC File Share [IF NFC ENABLED]
@@ -301,29 +311,28 @@
       Format SD Card
       Format RAM Disk [IF VIRTDISK ENABLED]
     Secure Notes & Passwords [IF QWERTY KEYBOARD]
-      1: note1
-        "note1"
+      1: note0
+        "note0"
         View Note
         Edit
         Delete
         Export
-        SHORTCUT
-        SHORTCUT
-      2: nostr
-        "nostr"
-        ↳ scg
-        ↳ brb.io
+        Sign Note Text
+      2: secret-PWD
+        "secret-PWD"
+        ↳ satoshi
+        ↳ abc.org
         View Password
         Send Password [MAYBE]
         Export
         Edit Metadata
         Delete
         Change Password
-        SHORTCUT
-        SHORTCUT
+        Sign Note Text
       New Note
       New Password
       Export All
+      Sort By Title
       Import
     Derive Seeds (BIP-85)
     View Identity
@@ -343,13 +352,14 @@
       Tapsigner Backup
       Coldcard Backup
     Key Teleport (start)
+    Spending Policy
+      Single-Signer [IF SECRET AND NOT TMP SEED]
+      Co-Sign Multisig (CCC) [IF NOT TMP SEED]
+      HSM Mode [IF HSM AND SECRET]
+        Default Off
+        Enable
+      User Management [MAYBE]
     Paper Wallets
-    Enable HSM [IF HSM AND SECRET]
-      Default Off
-      Enable
-    Coldcard Co-Signing [IF NOT TMP SEED]
-    User Management [IF HSM AND SECRET]
-      (no users yet)
     NFC Tools [IF NFC ENABLED]
       Sign PSBT
       Show Address
@@ -358,7 +368,7 @@
       Verify Address
       File Share
       Import Multisig
-      Push Transaction [IF ENBALED]
+      Push Transaction [IF PUSHTX ENABLED]
     Danger Zone
       Debug Functions
       Seed Functions
@@ -399,22 +409,32 @@
       Settings Space
       MCU Key Slots
       Bless Firmware
-      Reflash GPU [IF QWERTY KEYBOARD]
       Wipe LFS
   Settings
     Login Settings
       Change Main PIN
       Trick PINs [IF SECRET AND NOT TMP SEED]
         Trick PINs:
-        ↳123-254
-          PIN 123-254
+        ↳11-11
+          PIN 11-11
+          ↳Bricks CC
+          Hide Trick
+          Delete Trick
+          Change PIN
+        ↳333-3334
+          PIN 333-3334
           ↳Duress Wallet
           Activate Wallet
           Hide Trick
           Delete Trick
           Change PIN
+        ↳WRONG PIN
+          After 3 wrong:
+          ↳Wipes seed
+          ↳Reboots
+          Hide Trick
+          Delete Trick
         Add New Trick
-        Add If Wrong
         Delete All
       Set Nickname
       Scramble Keys
@@ -459,11 +479,11 @@
         View Details
         Delete
         Coldcard Export
+        Electrum Wallet
         Descriptors
           View Descriptor
           Export
           Bitcoin Core
-        Electrum Wallet
       Import from File
       Import from QR [IF QR SCANNER]
       Import via NFC [IF NFC ENABLED]
@@ -539,7 +559,7 @@
     Verify Address
     File Share
     Import Multisig
-    Push Transaction [IF ENBALED]
+    Push Transaction [IF PUSHTX ENABLED]
 ---
 
 [FACTORY MODE]
@@ -551,3 +571,144 @@
   Perform Selftest
 ---
 
+[SSSP]
+  Ready To Sign
+  Passphrase [IF WORD BASED SEED & SSSP RELATED KEYS ENABLED]
+    Restore Saved
+      c*******
+        [3A14F788]
+        Restore
+        Delete
+    Edit Phrase
+  Scan Any QR Code [IF QR SCANNER]
+  Address Explorer
+    Classic P2PKH
+     ↳ mtHSVByP9EYZ⋯Vm19gvpecb5R
+    P2SH-Segwit
+     ↳ 2NCAJ5wD4Gvm⋯NphNU8UYoEJv
+    Segwit P2WPKH
+     ↳ tb1qupyd58nd⋯vu9jtdyws9n9
+    Applications
+      Samourai
+        Post-mix
+        Pre-mix
+      Wasabi
+    Account Number
+    Custom Path
+    CC-2-of-4
+  Secure Notes & Passwords[IF ENABLED & SSSP ALLOW NOTES]
+    1: note0
+      "note0"
+      View Note
+      Sign Note Text
+    2: secret-PWD
+      "secret-PWD"
+      ↳ satoshi
+      ↳ abc.org
+      View Password
+      Send Password [MAYBE]
+      Sign Note Text
+  Type Passwords [MAYBE]
+  Seed Vault[IF ENABLED & SSSP RELATED KEYS ENABLED]
+     1: [7126EB3C]
+      [7126EB3C]
+      Use This Seed
+     2: [CCEE13B9]
+      [CCEE13B9]
+      Use This Seed
+     3: [03EE9989]
+      [03EE9989]
+      Use This Seed
+  Advanced/Tools
+    File Management
+      Sign Text File
+      Batch Sign PSBT
+      List Files
+      Export Wallet
+        Sparrow
+        Cove
+        Bitcoin Core
+        Nunchuk
+        Bull Bitcoin
+        Zeus
+        Electrum Wallet
+        Wasabi Wallet
+        Fully Noded
+        Unchained
+        Theya
+        Bitcoin Safe
+        Samourai Postmix
+        Samourai Premix
+        Descriptor
+        Generic JSON
+        Export XPUB
+          Segwit (BIP-84)
+          Classic (BIP-44)
+          P2WPKH/P2SH (BIP-49)
+          Master XPUB
+          Current XFP
+        Dump Summary
+      Verify Sig File
+      NFC File Share [IF NFC ENABLED]
+      BBQr File Share [IF QR SCANNER]
+      QR File Share [IF QR SCANNER]
+      Format SD Card
+      Format RAM Disk [IF VIRTDISK ENABLED]
+    Export Wallet
+      Sparrow
+      Cove
+      Bitcoin Core
+      Nunchuk
+      Bull Bitcoin
+      Zeus
+      Electrum Wallet
+      Wasabi Wallet
+      Fully Noded
+      Unchained
+      Theya
+      Bitcoin Safe
+      Samourai Postmix
+      Samourai Premix
+      Descriptor
+      Generic JSON
+      Export XPUB
+        Segwit (BIP-84)
+        Classic (BIP-44)
+        P2WPKH/P2SH (BIP-49)
+        Master XPUB
+        Current XFP
+      Dump Summary
+    Teleport Multisig PSBT [MAYBE]
+    View Identity
+    Temporary Seed [IF SSSP RELATED KEYS ENABLED]
+      Import from QR Scan [IF QR SCANNER]
+      Import Words
+        12 Words
+        18 Words
+        24 Words
+        Import via NFC [IF NFC ENABLED]
+      Import XPRV
+      Tapsigner Backup
+      Coldcard Backup
+    Paper Wallets
+    NFC Tools [IF NFC ENABLED]
+      Sign PSBT
+      Show Address
+      Sign Message
+      Verify Sig File
+      Verify Address
+      File Share
+      Push Transaction [IF PUSHTX ENABLED]
+    Destroy Seed
+  Secure Logout
+  EXIT TEST DRIVE [MAYBE]
+  SHORTCUT [IF NFC ENABLED]
+    Sign PSBT
+    Show Address
+    Sign Message
+    Verify Sig File
+    Verify Address
+    File Share
+    Push Transaction [IF PUSHTX ENABLED]
+---
+
diff --git a/shared/flow.py b/shared/flow.py
index 17b0e17..c59cdc0 100644
--- a/shared/flow.py
+++ b/shared/flow.py
@@ -109,6 +109,22 @@ def is_hobble_testdrive():
     from pincodes import pa
     return (pa.hobbled_mode == 2)
 
+def has_pushtx_url():
+    return bool(settings.get("ptxurl", False))
+
+# SSSP
+def sssp_related_keys():
+    return sssp_spending_policy('okeys')
+
+def sssp_allow_passphrase():
+    return word_based_seed() and sssp_related_keys()
+
+def sssp_allow_notes():
+    return settings.get("secnap", False) and sssp_spending_policy('notes')
+
+def sssp_allow_vault():
+    return settings.master_get('seedvault') and sssp_related_keys()
+
 async def goto_home(*a):
     goto_top_menu()
 
@@ -364,7 +380,7 @@ NFCToolsMenu = [
     MenuItem('Verify Address', f=nfc_address_verify),
     MenuItem('File Share', f=nfc_share_file),
     MenuItem('Import Multisig', f=import_multisig_nfc),
-    MenuItem('Push Transaction', f=nfc_pushtx_file, predicate=lambda: settings.get("ptxurl", False)),
+    MenuItem('Push Transaction', f=nfc_pushtx_file, predicate=has_pushtx_url),
 ]
 
 
@@ -508,8 +524,7 @@ HobbledNFCToolsMenu = [
     MenuItem('Verify Sig File', f=nfc_sign_verify),
     MenuItem('Verify Address', f=nfc_address_verify),
     MenuItem('File Share', f=nfc_share_file),
-    MenuItem('Push Transaction', f=nfc_pushtx_file,
-                                        predicate=lambda: settings.get("ptxurl", False)),
+    MenuItem('Push Transaction', f=nfc_pushtx_file, predicate=has_pushtx_url),
 ]
 
 # Very limited advanced menu when hobbled.
@@ -519,8 +534,7 @@ HobbledAdvancedMenu = [
     MenuItem('Export Wallet', menu=WalletExportMenu, shortcut='x'),  # also inside FileMgmt
     MenuItem('Teleport Multisig PSBT', predicate=qr_and_ms, f=kt_send_file_psbt),
     MenuItem("View Identity", f=view_ident),
-    MenuItem("Temporary Seed", menu=make_ephemeral_seed_menu,
-                                    predicate=lambda: sssp_spending_policy('okeys')),
+    MenuItem("Temporary Seed", menu=make_ephemeral_seed_menu, predicate=sssp_related_keys),
     MenuItem('Paper Wallets', f=make_paper_wallet),
     MenuItem('NFC Tools', predicate=nfc_enabled, menu=HobbledNFCToolsMenu, shortcut=KEY_NFC),
     MenuItem("Destroy Seed", f=clear_seed),
@@ -530,17 +544,16 @@ HobbledAdvancedMenu = [
 HobbledTopMenu = [
     #         xxxxxxxxxxxxxxxx
     MenuItem('Ready To Sign', f=ready2sign, shortcut='r'),
-    MenuItem('Passphrase', menu=start_b39_pw, 
-        predicate=lambda: word_based_seed and sssp_spending_policy('okeys'), shortcut='p'),
-    MenuItem('Scan Any QR Code', predicate=version.has_qr,
-         shortcut=KEY_QR, f=scan_any_qr, arg=(False, True)),
+    MenuItem('Passphrase', menu=start_b39_pw, predicate=sssp_allow_passphrase, shortcut='p'),
+    MenuItem('Scan Any QR Code', predicate=version.has_qr, f=scan_any_qr, arg=(False, True),
+             shortcut=KEY_QR),
     MenuItem("Address Explorer", menu=address_explore, shortcut='x'),
-    MenuItem('Secure Notes & Passwords', menu=make_notes_menu, shortcut='n',
-                 predicate=lambda: settings.get("secnap", False) and sssp_spending_policy('notes')),
+    MenuItem('Secure Notes & Passwords', menu=make_notes_menu, predicate=sssp_allow_notes,
+             shortcut='n'),
     MenuItem('Type Passwords', f=password_entry, shortcut='t',
              predicate=lambda: settings.get("emu", False)),
-    MenuItem('Seed Vault', menu=make_seed_vault_menu, shortcut='v',
-             predicate=lambda: settings.master_get('seedvault') and sssp_spending_policy('okeys')),
+    MenuItem('Seed Vault', menu=make_seed_vault_menu, predicate=sssp_allow_vault,
+             shortcut='v'),
     MenuItem('Advanced/Tools', menu=HobbledAdvancedMenu, shortcut='t'),
     MenuItem('Secure Logout', f=logout_now, predicate=not version.has_battery),
     MenuItem('EXIT TEST DRIVE', f=sssp_feature_menu, predicate=is_hobble_testdrive),
diff --git a/shared/notes.py b/shared/notes.py
index 6a5d2a6..f5ef7f7 100644
--- a/shared/notes.py
+++ b/shared/notes.py
@@ -133,8 +133,7 @@ class NotesMenu(MenuSystem):
 
             rv = []
             for note in NoteContent.get_all():
-                rv.append(MenuItem('%d: %s' % (note.idx+1, note.title),
-                                        menu=lambda *_: note.make_menu()))
+                rv.append(MenuItem('%d: %s' % (note.idx+1, note.title), menu=note.make_menu))
 
             rv.extend(news)
 
@@ -155,7 +154,7 @@ class NotesMenu(MenuSystem):
         rv = []
         for note in NoteContent.get_all():
             rv.append(MenuItem('%d: %s' % (note.idx+1, note.title),
-                                    menu=lambda *_: note.make_menu(readonly=True)))
+                               menu=note.make_menu, arg=True))  # readonly=True
 
         return rv
 
@@ -230,8 +229,8 @@ class NotesMenu(MenuSystem):
     async def drill_to(cls, menu, item):
         # make it so looks like we drilled down into the new note
         menu.goto_idx(item.idx)
-        m = MenuSystem(await item.make_menu())
-        the_ux.push(m)
+        m = await item._make_menu()
+        the_ux.push(MenuSystem(m))
 
 
 class NoteContentBase:
@@ -327,7 +326,8 @@ class NoteContentBase:
 
         if not is_new:
             # change our own menu contents
-            menu.replace_items(await self.make_menu())
+            mi = await self._make_menu()
+            menu.replace_items(mi)
 
             # update parent
             parent = the_ux.parent_of(menu)
@@ -369,18 +369,18 @@ class PasswordContent(NoteContentBase):
     flds = ['title', 'user', 'password', 'site', 'misc' ]
     type_label = 'password'
 
-    async def make_menu(self, readonly=False):
+    async def _make_menu(self, readonly=False):
         rv = [MenuItem('"%s"' % self.title, f=self.view)]
         if self.user:
             rv.append(MenuItem('↳ %s' % self.user, f=self.view))
         if self.site:
             rv.append(MenuItem('↳ %s' % self.site, f=self.view))
-        #if self.misc: rv.append(MenuItem('↳ (notes)', f=self.view))
+        # if self.misc: rv.append(MenuItem('↳ (notes)', f=self.view))
         rv += [
             MenuItem('View Password', f=self.view_pw),
             MenuItem('Send Password', f=self.send_pw, predicate=lambda: settings.get('du', True)),
         ]
-        if not readonly: 
+        if not readonly:
             rv += [
                 MenuItem('Export', f=self.export),
                 MenuItem('Edit Metadata', f=self.edit),
@@ -395,6 +395,10 @@ class PasswordContent(NoteContentBase):
 
         return rv
 
+    async def make_menu(self, a, b, item):
+        items = await self._make_menu(readonly=item.arg)
+        return MenuSystem(items)
+
     async def view(self, *a):
         pl = len(self.password)
         m = ''
@@ -508,7 +512,7 @@ class NoteContent(NoteContentBase):
     flds = ['title', 'misc']
     type_label = 'note'
 
-    async def make_menu(self, readonly=False):
+    async def _make_menu(self, readonly=False):
         # Details and actions for this Note
         rv = [
             MenuItem('"%s"' % self.title, f=self.view),
@@ -527,6 +531,10 @@ class NoteContent(NoteContentBase):
         ]
         return rv
 
+    async def make_menu(self, a, b, item):
+        items = await self._make_menu(readonly=item.arg)
+        return MenuSystem(items)
+
     async def view(self, *a):
         ch = await ux_show_story(self.misc, title=self.title, escape=KEY_QR,
                                  hint_icons=KEY_QR)
diff --git a/shared/seed.py b/shared/seed.py
index 418f4d0..791a8b8 100644
--- a/shared/seed.py
+++ b/shared/seed.py
@@ -40,6 +40,10 @@ _PREFIX_MARKER = const(1<<26)
 # - 'encoded' is hex, and has is trimmed of right side zeros
 VaultEntry = namedtuple('VaultEntry', 'xfp encoded label origin')
 
+def not_hobbled_mode():
+    from pincodes import pa
+    return not pa.hobbled_mode
+
 def seed_vault_iter():
     # iterate over all seeds in the vault; returns VaultEntry instances.
     # raw vault entries are list type when json.loaded from flash
@@ -535,7 +539,7 @@ async def add_seed_to_vault(encoded, origin=None, label=None):
 async def set_ephemeral_seed(encoded, chain=None, summarize_ux=True, bip39pw='',
                              is_restore=False, origin=None, label=None):
     # Capture tmp seed into vault, if so enabled, and regardless apply it as new tmp.
-    if not is_restore and not pa.hobbled_mode:
+    if not is_restore and not_hobbled_mode():
         await add_seed_to_vault(encoded, origin=origin, label=label)
         dis.fullscreen("Wait...")
 
@@ -913,7 +917,7 @@ class SeedVaultMenu(MenuSystem):
         ch = await ux_show_story(title="[" + rec.xfp + "]", msg=msg, escape=esc)
         if ch == "x": return
 
-        assert not pa.hobbled_mode
+        assert not_hobbled_mode()
 
         dis.fullscreen("Saving...")
 
@@ -963,7 +967,7 @@ class SeedVaultMenu(MenuSystem):
         from glob import dis
         from ux import ux_input_text
 
-        assert not pa.hobbled_mode
+        assert not_hobbled_mode()
 
         idx, old = item.arg
         new_label = await ux_input_text(old.label, confirm_exit=False, max_len=40)
@@ -995,7 +999,7 @@ class SeedVaultMenu(MenuSystem):
     async def _add_current_tmp(*a):
         from pincodes import pa
 
-        assert not pa.hobbled_mode
+        assert not_hobbled_mode()
 
         assert pa.tmp_value
         main_xfp = settings.master_get("xfp", 0)
@@ -1039,7 +1043,7 @@ class SeedVaultMenu(MenuSystem):
 
         if not seeds:
             rv.append(MenuItem('(none saved yet)'))
-            if not pa.hobbled_mode:
+            if not_hobbled_mode():
                 if pa.tmp_value:
                     rv.append(add_current_tmp)
                 rv.append(MenuItem("Temporary Seed", menu=make_ephemeral_seed_menu))
@@ -1058,8 +1062,10 @@ class SeedVaultMenu(MenuSystem):
                 submenu = [
                     MenuItem(rec.label, f=cls._detail, arg=(rec, encoded)),
                     MenuItem('Use This Seed', f=cls._set, arg=encoded),
-                    MenuItem('Rename', f=cls._rename, arg=(i, rec), predicate=not pa.hobbled_mode),
-                    MenuItem('Delete', f=cls._remove, arg=(i, rec, encoded), predicate=not pa.hobbled_mode),
+                    MenuItem('Rename', f=cls._rename, arg=(i, rec),
+                             predicate=not_hobbled_mode),
+                    MenuItem('Delete', f=cls._remove, arg=(i, rec, encoded),
+                             predicate=not_hobbled_mode),
                 ]
                 if is_active:
                     submenu[1] = MenuItem("Seed In Use")
@@ -1077,7 +1083,7 @@ class SeedVaultMenu(MenuSystem):
                 rv.append(item)
 
             if pa.tmp_value:
-                if seeds and (not tmp_in_sv) and not pa.hobbled_mode:
+                if seeds and (not tmp_in_sv) and not_hobbled_mode():
                     # give em chance to store current active
                     rv.append(add_current_tmp)
 
@@ -1166,7 +1172,7 @@ class EphemeralSeedMenu(MenuSystem):
         ]
 
         rv = [
-            MenuItem("Generate Words", menu=gen_ephemeral_menu, predicate=not pa.hobbled_mode),
+            MenuItem("Generate Words", menu=gen_ephemeral_menu, predicate=not_hobbled_mode),
             MenuItem('Import from QR Scan', predicate=version.has_qr,
                      shortcut=KEY_QR, f=scan_any_qr, arg=(True, True)),
             MenuItem("Import Words", menu=import_ephemeral_menu),
diff --git a/testing/devtest/menu_dump.py b/testing/devtest/menu_dump.py
index 3b48a81..d10be3c 100644
--- a/testing/devtest/menu_dump.py
+++ b/testing/devtest/menu_dump.py
@@ -10,12 +10,13 @@ async def doit():
     import version
     async def dump_menu(fd, m, label, indent, menu_item=None, menu_idx=0, whs=False):
         from menu import MenuItem, ToggleMenuItem, MenuSystem, NonDefaultMenuItem
-        from seed import WordNestMenu, EphemeralSeedMenu, SeedVaultMenu
+        from seed import WordNestMenu, EphemeralSeedMenu, SeedVaultMenu, not_hobbled_mode
         from trick_pins import TrickPinMenu
         from users import UsersMenu
         from flow import has_secrets, nfc_enabled, vdisk_enabled, word_based_seed
         from flow import hsm_policy_available, is_not_tmp, has_real_secret
-        from flow import has_se_secrets, hsm_available, qr_and_has_secrets
+        from flow import has_se_secrets, hsm_available, qr_and_has_secrets, has_pushtx_url
+        from flow import sssp_related_keys, sssp_allow_passphrase, sssp_allow_notes, sssp_allow_vault
 
         print("%s%s"% (indent, label), file=fd)
 
@@ -32,8 +33,9 @@ async def doit():
             if version.has_qwerty and m.__name__ == "start_seed_import":
                 print('%s[SEED WORD ENTRY]' % indent, file=fd)
                 return
-            if m.__name__ == "make_custom":
+            if m.__name__ in ("make_custom", "bkpw_override"):
                 # address explorer custom path menu
+                # bkpw override = dev thing
                 return
 
             print("Calling: %r (%s)" % (m.__name__, label))
@@ -99,9 +101,24 @@ async def doit():
                     here += ' [IF HSM AND SECRET]'
                 elif pred == qr_and_has_secrets:
                     here += ' [IF QR AND SECRET]'
+                # do nothing, only in NormalOps menu, but SSSP has different menu dump
+                elif pred == not_hobbled_mode: pass
+                #     here += ' [IF SSSP DISABLED]'
+                elif pred == has_pushtx_url:
+                    here += ' [IF PUSHTX ENABLED]'
+                elif pred == sssp_related_keys:
+                    here += ' [IF SSSP RELATED KEYS ENABLED]'
+                elif pred == sssp_allow_passphrase:
+                    here += ' [IF WORD BASED SEED & SSSP RELATED KEYS ENABLED]'
+                elif pred == sssp_allow_notes:
+                    here += '[IF ENABLED & SSSP ALLOW NOTES]'
+                elif pred == sssp_allow_vault:
+                    here += '[IF ENABLED & SSSP RELATED KEYS ENABLED]'
                 elif pred:
                     if here in ("Secure Notes & Passwords", "Push Transaction"):
                         here += ' [IF ENBALED]'
+                    if here == "Secure Logout":
+                        here += ' [IF NOT BATTERIES]'
                     else:
                         here += ' [MAYBE]'
 
@@ -133,16 +150,25 @@ async def doit():
             print('%s%s' % (indent, here), file=fd)
             
 
-    from flow import EmptyWallet, NormalSystem, FactoryMenu, VirginSystem
+    from flow import EmptyWallet, NormalSystem, FactoryMenu, VirginSystem, HobbledTopMenu
     from glob import settings
 
     # need these to supress warnings and info messages
     # that need user interaction nad/or show hidden items
     settings.put("seedvault", 1)
+    settings.put("seeds", [["7126EB3C", "808ae37a2d3d3d0f9db5ca98c8300e3818", "[7126EB3C]", "TRNG Words"],
+                           ["CCEE13B9", "018d669ed0fddccd7f34ef6dac86864e75fc4036d7dd3992c985ba0e625d8da83ac33b64d371a6d0d1a4a5200f00080ef5e2b341251b30a8b665be42c43fb4c5f3", "[CCEE13B9]", "BIP-39 Passphrase on [0F056943]"],
+                           ["03EE9989", "01a00f4ecbfb55b186bae4486e0e292a34e1afb0c1f64ad4a9a3f378bdeefb7296abce50461838f76979a695d6b4f6ac329661c227f1137400520cbbb1294333a7", "[03EE9989]", "BIP85 Derived from [0F056943], index=543"]])
+    settings.put("secnap", 1)
+    settings.put("notes", [{"misc": "some random notes", "title": "note0"},
+                           {"password": "AnnounceHalf+~^99891", "site": "abc.org", "misc": "never disclose!!!!!", "user": "satoshi", "title": "secret-PWD"}])
     settings.put("axskip", 1)
     settings.put("b39skip", 1)
     settings.put("sd2fa", ["a"])
     settings.put("ptxurl", 'https://coldcard.com/pushtx#')
+    settings.put("multisig", [["CC-2-of-4", [2, 4], [[1130956047, "tpubDF2rnouQaaYrXF4noGTv6rQYmx87cQ4GrUdhpvXkhtChwQPbdGTi8GA88NUaSrwZBwNsTkC9bFkkC8vDyGBVVAQTZ2AS6gs68RQXtXcCvkP"], [3503269483, "tpubDFcrvj5n7gyaxWQkoX69k2Zij4vthiAwvN2uhYjDrE6wktKoQaE7gKVZRiTbYdrAYH1UFPGdzdtWJc6WfR2gFMq6XpxA12gCdQmoQNU9mgm"], [2389277556, "tpubDExj5FnaUnPAn7sHGUeBqD3buoNH5dqmjAT6884vbDpH1iDYWigb7kFo2cA97dc8EHb54u13TRcZxC4kgRS9gc3Ey2xc8c5urytEzTcp3ac"], [3190206587, "tpubDFiuHYSJhNbHcbLJoxWdbjtUcbKR6PvLq53qC1Xq6t93CrRx78W3wcng8vJyQnY3giMJZEgNCRVzTojLb8RqPFpW5Ms2dYpjcJYofN1joyu"]], {"pp": "m/48h/1h/0h/2h", "ch": "XTN", "ft": 14}]])
+    settings.put("tp", {"11-11": [0, 16384, 0], "333-3334": [1, 4096, 1001], "!p": [2, 33280, 3]})
+
 
     # saved passphrase on MicroSD
     with open("MicroSD/.tmp.tmp", "wb") as f:
@@ -154,8 +180,13 @@ async def doit():
             ('[IF BLANK WALLET]', EmptyWallet),
             ('[NORMAL OPERATION]', NormalSystem),
             ('[FACTORY MODE]', FactoryMenu),
+            ('[SSSP]', HobbledTopMenu),
         ]:
-            await dump_menu(fd, m, nm, '', whs=(m == NormalSystem))
+            if "SSSP" in nm:
+                from pincodes import pa
+                pa.hobbled_mode = True
+
+            await dump_menu(fd, m, nm, '', whs=(m in (NormalSystem,HobbledTopMenu)))
             print('---\n', file=fd)
 
     print("DONE: check menudump.txt file")