Put an address beside its own QR code, on one screen

Opening an address showed its text, and the code was a step further in.
Scanning is what a reader almost always came for, so it is the screen
they land on now - with the derivation path and the address itself in
the margin the right-aligned code leaves, in the same groups of four the
paged view uses.

Two facts about one address were on two screens; they are on one.

The grid is fixed at two groups to a line rather than as many as the
margin holds, so the shape is the same every time and only the last line
varies. Each column is as wide as the widest group in the value: the
face is proportional, so groups of equal length are not of equal width,
and centring each line would start every one at its own x. A last line
that does not fill its columns is centred on the block instead of left
in the first one.

Not every address fits. A taproot address is 62 characters against the
48 two columns hold there, so seedtool_render_qr_address measures before
it draws anything and refuses what will not fit - those fall back to the
code alone and then the paged text, which has the width for them. An
address cut off at the margin's end looks exactly like one that ended
there, which is the whole reason this returns a bool rather than drawing
as far as it reaches.

That refusal is checked rather than argued: the new self-test alters an
address's last group and requires the margin to change with it, so a
tail that was never drawn fails, and it requires the taproot address to
be refused outright. Both halves were confirmed against a deliberately
broken build - removing the height guard fails it - because the existing
grouped-paging check walks only the paged path at the body face and says
nothing about groups drawn by any other route.

page_grouped loses its only caller and goes; the paged grouped view it
named is reached through page_text_impl now, for the values that need it.

Verified with the host self-test, the 52 Python tests, the QR smoke test
and the self-test under ASan and UBSan. Every address shape the firmware
derives was rendered off the framebuffer and read.

Author: oroderico

host/origo_sdl.c

@@ -169,6 +169,15 @@ bool seedtool_display_qr(const char* title, const char* text)
     return ok;
 }
 
+bool seedtool_display_qr_address(const char* title, const char* text)
+{
+    const bool ok = seedtool_render_qr_address(title, text);
+    if (ok) {
+        present();
+    }
+    return ok;
+}
+
 bool seedtool_display_qr_bytes(const char* title, const uint8_t* data, const size_t len)
 {
     const bool ok = seedtool_render_qr_bytes(title, data, len);

host/origo_simulator.c

@@ -1714,6 +1714,92 @@ static bool grouped_paging_preserves_the_value(void)
     return true;
 }
 
+/* The QR screen draws the address beside the code, and the margin it has is
+ * not always enough: a taproot address is 62 characters against the 48 two
+ * columns of four hold there. seedtool_render_qr_address must refuse those
+ * outright rather than draw as far as it reaches, because an address cut off
+ * mid-value looks exactly like one that ended there and nothing on screen
+ * says otherwise. This is the check grouped_paging_preserves_the_value does
+ * not make: that one walks seedtool_render_fit_grouped, the paged path at the
+ * body face, and says nothing about groups drawn by any other route. The first
+ * version of this screen truncated a taproot address to 48 of its characters
+ * with every other check still passing.
+ *
+ * Proving the tail is drawn without restating the renderer's own geometry:
+ * change only the value's last group and the margin must change with it. The
+ * margin is everything left of the code, found by looking for the first column
+ * carrying a run of white tall enough to be the code itself rather than a line
+ * of text. */
+static int qr_code_left_edge(void)
+{
+    const uint16_t* const pixels = seedtool_render_pixels();
+    for (int x = 0; x < SEEDTOOL_DISPLAY_WIDTH; ++x) {
+        int run = 0;
+        for (int y = 0; y < SEEDTOOL_DISPLAY_HEIGHT; ++y) {
+            run = pixels[y * SEEDTOOL_DISPLAY_WIDTH + x] == 0xffff ? run + 1 : 0;
+            if (run > 40) {
+                return x;
+            }
+        }
+    }
+    return -1;
+}
+
+static bool qr_address_draws_every_group(void)
+{
+    static const char* const fits[] = {
+        "bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4",
+        "1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2",
+        "3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy",
+    };
+    static uint16_t before[SEEDTOOL_DISPLAY_WIDTH * SEEDTOOL_DISPLAY_HEIGHT];
+
+    for (size_t v = 0; v < sizeof(fits) / sizeof(fits[0]); ++v) {
+        const char* const value = fits[v];
+        if (!seedtool_render_qr_address("m/84'/0'/0'/0/0", value)) {
+            return false; /* these do fit; refusing them is its own failure */
+        }
+        const int edge = qr_code_left_edge();
+        if (edge <= 0) {
+            return false;
+        }
+        memcpy(before, seedtool_render_pixels(), sizeof(before));
+
+        /* The same value with its last group altered, same length so the code
+         * keeps its version and the margin keeps its width. */
+        char altered[80] = { 0 };
+        const size_t total = strlen(value);
+        if (total + 1 > sizeof(altered) || total < SEEDTOOL_GROUP_LEN) {
+            return false;
+        }
+        memcpy(altered, value, total);
+        for (size_t i = total - SEEDTOOL_GROUP_LEN; i < total; ++i) {
+            altered[i] = altered[i] == 'q' ? 'p' : 'q';
+        }
+        if (!seedtool_render_qr_address("m/84'/0'/0'/0/0", altered)) {
+            return false;
+        }
+        const uint16_t* const after = seedtool_render_pixels();
+
+        bool margin_changed = false;
+        for (int y = 0; y < SEEDTOOL_DISPLAY_HEIGHT && !margin_changed; ++y) {
+            for (int x = 0; x < edge; ++x) {
+                if (before[y * SEEDTOOL_DISPLAY_WIDTH + x] != after[y * SEEDTOOL_DISPLAY_WIDTH + x]) {
+                    margin_changed = true;
+                    break;
+                }
+            }
+        }
+        if (!margin_changed) {
+            return false; /* the tail was never drawn */
+        }
+    }
+
+    /* And the one the margin cannot hold, which must say so rather than clip. */
+    return !seedtool_render_qr_address(
+        "m/86'/0'/0'/0/0", "bc1p5cyxnuxmeuwuvkwfem96lqzszd02n6xdcjrs20cac6yqjjwudpxqkedrcr");
+}
+
 /* The grouped line is centred with its gaps counted in, so it can run off an
  * edge in a way the plain centred line cannot. Measured, not assumed. */
 static bool grouped_lines_clear_the_edges(void)
@@ -2347,6 +2433,10 @@ static int self_test(void)
         fputs("Origo grouped address geometry self-test failed\n", stderr);
         return 1;
     }
+    if (!qr_address_draws_every_group()) {
+        fputs("Origo address-beside-QR self-test failed\n", stderr);
+        return 1;
+    }
     if (!nav_chrome_bands_do_not_collide()) {
         fputs("Origo nav chrome geometry self-test failed\n", stderr);
         return 1;

main/seedtool_app.c

@@ -833,13 +833,6 @@ static bool page_text(const char* title, const char* text)
     return page_text_impl(title, text, true, false);
 }
 
-/* page_text for a value with no word shapes to read by - an address. Drawn in
- * groups of four so the reader transcribing it has somewhere to keep their
- * place; the string itself is untouched. */
-static bool page_grouped(const char* title, const char* text)
-{
-    return page_text_impl(title, text, true, true);
-}
 
 /* Paged text there is nothing to take. Returns nothing because there is
  * nothing to return: the reader pages down and leaves by the arrow, and a
@@ -1945,19 +1938,35 @@ static void show_descriptor(const char* mnemonic, const char* passphrase, const
     seedtool_zero(value, sizeof(value));
 }
 
-/* A single address's own QR, opened from the address list: no account key in
- * this view to warn about or to carousel over to, since a photo of one
- * address on its own reveals nothing the address itself did not already. */
+/* A single address's own QR, and the first thing opening an address shows: no
+ * account key in this view to warn about or to carousel over to, since a photo
+ * of one address on its own reveals nothing the address itself did not
+ * already. Scanning is what a reader almost always came for, so the code, its
+ * path and the address itself share one screen rather than two.
+ *
+ * Not every address fits beside its code: a taproot address is 62 characters
+ * against the 48 the margin holds. seedtool_display_qr_address refuses those
+ * rather than drawing as far as it reaches - an address cut off mid-value
+ * looks exactly like one that ended there - and they fall back to the code
+ * alone, then the paged text, which has the width for them. */
 static void show_address_qr(const char* title, const char* address)
 {
     for (;;) {
+        if (seedtool_display_qr_address(title, address)) {
+            if (wait_key() == KEY_REDRAW) {
+                continue;
+            }
+            return;
+        }
         if (!seedtool_display_qr(title, address)) {
             notice("Too long for a QR", title, "Read it as text instead");
             return;
         }
-        if (wait_key() != KEY_REDRAW) {
-            return;
+        if (wait_key() == KEY_REDRAW) {
+            continue;
         }
+        (void)page_text_impl(title, address, false, true);
+        return;
     }
 }
 
@@ -2238,9 +2247,11 @@ static void show_addresses(
          * make. */
         char path[sizeof(prefix) + 12];
         (void)snprintf(path, sizeof(path), "%s/%u", prefix, (unsigned)index);
-        if (page_grouped(path, address)) {
-            show_address_qr(path, address);
-        }
+        /* One screen: the code, its path, and the address itself beside it.
+         * Opening an address used to land on the text and reach the QR through
+         * it, which cost a step to the reader who came to scan - and left the
+         * two halves of the same fact on separate screens. */
+        show_address_qr(path, address);
         seedtool_zero(address, sizeof(address));
     }
     seedtool_zero(addresses, sizeof(addresses));

main/seedtool_display.c

@@ -265,6 +265,15 @@ bool seedtool_display_qr(const char* title, const char* text)
     return ok;
 }
 
+bool seedtool_display_qr_address(const char* title, const char* text)
+{
+    const bool ok = seedtool_render_qr_address(title, text);
+    if (ok) {
+        flush();
+    }
+    return ok;
+}
+
 bool seedtool_display_qr_bytes(const char* title, const uint8_t* data, const size_t len)
 {
     const bool ok = seedtool_render_qr_bytes(title, data, len);

main/seedtool_display.h

@@ -47,6 +47,7 @@ void seedtool_display_value_box(
 void seedtool_display_keyboard(const char* title, const char* text, const char* layout, const bool* enabled,
     size_t selected, size_t position, size_t total);
 bool seedtool_display_qr(const char* title, const char* text);
+bool seedtool_display_qr_address(const char* title, const char* text);
 bool seedtool_display_qr_bytes(const char* title, const uint8_t* data, size_t len);
 bool seedtool_display_qr_bytes_region(const char* title, const uint8_t* data, size_t len, size_t region_index);
 bool seedtool_display_qr_bytes_map(const char* title, const uint8_t* data, size_t len);