test(report): capture the screens this release actually changed

CI captures 345 OLED PNGs and the screenshot phase reports healthy, but every
suite 7.14.2 changed captured zero of them. The rendering evidence for a
release whose entire subject is what reaches the screen did not exist.

Three separate causes, all silent:

1. SECTIONS declared no screenshot expectations for test_msg_ethereum_erc20_0x_signtx,
   test_msg_binance_sign_tx or test_verify_typed_data, so screenshot_filter()
   never selected them. Add a section for the display-binding paths.

2. test_msg_display_disclosure WAS in the filter and still produced nothing.
   It answers ButtonRequests through its own recording callback to read the
   layout, which bypasses the client's capture hook -- so the one suite written
   specifically to police what the screen shows was the one suite whose screens
   nobody could look at. Call _capture_oled() from the recorder.

3. The CI gate is `total PNG count > 0`. A single captured suite satisfies it.
   That cannot distinguish "captured everything" from "captured something", and
   in this round it passed while the release's own screens were absent. Add
   --screenshot-audit: fail if any test that DECLARED screens captured none.
   Skipped tests are excluded -- a version-gated test cannot draw.

Run against the rc30 artifact, the audit reports exactly the eight tests that
declared screens and captured none.

Two entries deliberately carry an EMPTY screenshot list:
  - S9 test_eip1559_requires_chain_id: the refusal happens before the first
    confirm(), so no screen is drawn and none should be expected. The absence
    IS the assertion.
  - S8 test_contract_handler_streamed_calldata_signs_full_data: every test in
    test_msg_ethereum_signing_guards currently SKIPs under requires_firmware.
    Declaring a screen nothing can satisfy would turn the new audit into noise.

Author: BitHighlander

scripts/generate-test-report.py

@@ -275,6 +275,74 @@ def parse_junit(path):
 # context = why this test exists, what it proves, what user sees
 
 SECTIONS = [
+    ('S', 'Display Binding - What the Device Signs Is What It Shows', '7.14.2',
+     'The 7.14.2 security release changed what reaches the OLED on the signing paths. Every '
+     'defect it fixed was a case of the device hashing bytes it never rendered, or rendering '
+     'text it could not vouch for. These tests exist to capture those screens: a passing wire '
+     'assertion proves the device refused or signed, but only the screen proves the user was '
+     'told the truth about what they approved.',
+     [
+         'DISCLOSURE RULE: every byte covered by the signature must be reachable on screen.',
+         '',
+         'The defects this section guards against, all shipped at some point:',
+         '- bytes past an embedded NUL were signed and never drawn ("%s" stops at 0x00)',
+         '- whitespace padding pushed a tail past the cut with no warning',
+         '- 456 bytes past the initial chunk were hashed with a clear-sign screen showing',
+         '  confident token amounts for calldata the device had not seen',
+         '- an unresolved token rendered as the literal "Unknown token value" and signed',
+         '- a truncated memo dropped its last character (Confirm limit 42 vs 420)',
+         '',
+         'A test here with an EMPTY screenshot list is deliberate: refusal paths draw nothing,',
+         'and their evidence is the Failure on the wire plus the absence of a ButtonRequest.',
+     ],
+     [
+         ('S1', 'test_msg_ethereum_erc20_0x_signtx', 'test__sign_transformERC20',
+          '0x transformERC20 raw disclosure',
+          'A 1480-byte transformERC20 payload exceeds one 1024-byte chunk. The device must NOT '
+          'clear-sign it as a token swap, because the bytes past the initial chunk are hashed '
+          'without being decoded. With AdvancedMode on it falls to the raw path, where the byte '
+          'count shown must be the FULL length (1480), not the chunk length (1024) - a short '
+          'count would under-report what is being signed.',
+          ['Raw contract data screen showing the full byte count']),
+         ('S2', 'test_msg_ethereum_erc20_0x_signtx', 'test_sign_0x_swap_ERC20_to_ETH',
+          '0x sellToUniswap names both assets',
+          'Clear-signing is only honest when BOTH token words resolve to known assets. This '
+          'payload resolves (USDC -> ETH) and must name both sides with real amounts. The '
+          'failure this guards is a screen naming a DEX while showing no amount.',
+          ['Swap screen naming both assets and amounts']),
+         ('S3', 'test_msg_ethereum_erc20_0x_signtx', 'test_sign_longdata_swap',
+          'Long 0x calldata stays disclosed',
+          'Calldata spanning multiple chunks must not silently lose its tail from the display '
+          'while remaining inside the signature.',
+          ['Contract data screen']),
+         ('S8', 'test_msg_ethereum_signing_guards',
+          'test_contract_handler_streamed_calldata_signs_full_data',
+          'Streamed calldata is fully covered',
+          'Calldata delivered across several chunks must be hashed in full and disclosed in full. '
+          'This is the positive control for the chunk-completeness gate. NOTE: every test in '
+          'test_msg_ethereum_signing_guards currently SKIPS in CI under requires_firmware, so no '
+          'screen can be captured for it yet - the screenshot list stays empty until the gate '
+          'opens, rather than declaring an expectation nothing can satisfy.',
+          []),
+         ('S9', 'test_msg_ethereum_signing_guards', 'test_eip1559_requires_chain_id',
+          'Omitted chain_id is refused before any screen',
+          'Without a chain_id the device cannot name the network, and a signature would be '
+          'pre-EIP-155 - replayable on every EVM chain. The refusal happens before the first '
+          'confirm(), so NO screen is drawn and no ButtonRequest is emitted. The empty '
+          'screenshot list below is the assertion.',
+          []),
+         ('S10', 'test_verify_typed_data', 'test_structured_eip712_is_refused',
+          'Structured EIP-712 is closed by default',
+          'The legacy JSON parser could not guarantee that every displayed value was the '
+          'canonical value being hashed, and one screen took its title from the attacker-supplied '
+          'domain name. The feature is withdrawn rather than shipped with a screen it could not '
+          'vouch for: zero screens, refusal on the wire.',
+          []),
+         ('S11', 'test_msg_binance_sign_tx', 'test_transfer',
+          'Binance denom renders in full',
+          'A long denom must render completely and must not overflow the formatting buffer.',
+          ['Transfer screen showing the full denom']),
+     ]),
     ('X', 'Device Specifications', '0.0.0',
      'The KeepKey is an open-source hardware wallet built on an ARM Cortex-M3 (STM32F205, 120MHz) '
      'with a 256x64 monochrome OLED, single confirmation button, and micro-USB interface. The '
@@ -1185,6 +1253,46 @@ def screenshot_filter(fw_version):
     return ' or '.join(terms)
 
 
+def screenshot_audit(fw_version, screenshot_root, junit_path=None):
+    """Which SECTIONS tests DECLARED screens but captured none?
+
+    The CI gate was `total PNG count > 0`, which a single captured suite
+    satisfies. That cannot distinguish "captured everything" from "captured
+    something": in the 7.14.2 round, 345 PNGs were produced while every suite
+    the release actually changed captured zero, and the phase reported healthy.
+
+    Returns (ok, missing) where missing is a list of (module, method) that
+    declared a non-empty screenshot list, were not skipped, and produced no
+    PNG directory. Skipped tests are not missing -- a version-gated test
+    cannot draw.
+    """
+    import os as _os
+    skipped = set()
+    if junit_path and _os.path.exists(junit_path):
+        import xml.etree.ElementTree as _ET
+        root = _ET.parse(junit_path).getroot()
+        suites = [root] if root.tag == 'testsuite' else root.findall('testsuite')
+        for su in suites:
+            for tc in su.findall('testcase'):
+                if tc.find('skipped') is not None:
+                    cn = tc.get('classname', '')
+                    mod = next((p for p in cn.split('.') if p.startswith('test_')), '')
+                    skipped.add((mod, tc.get('name')))
+
+    active = [x for x in SECTIONS if ver_ge(fw_version, x[2])]
+    missing = []
+    for letter, title, mf, bg, fl, tests in active:
+        for tid, mod, meth, ttl, ctx, scr in tests:
+            if not scr:
+                continue
+            if (mod, meth) in skipped:
+                continue
+            d = _os.path.join(screenshot_root, mod.replace('test_', '', 1), meth)
+            if not _os.path.isdir(d) or not [f for f in _os.listdir(d) if f.endswith('.png')]:
+                missing.append((mod, meth))
+    return (len(missing) == 0, missing)
+
+
 def validate_junit(fw_version, results):
     """Check SECTIONS tests against JUnit results. Returns (passed, failed_list).
 
@@ -1211,6 +1319,10 @@ def main():
     p.add_argument('--fw-version', default=None)
     p.add_argument('--junit', default=None, help='JUnit XML for pass/fail results')
     p.add_argument('--screenshots', default=None, help='Directory with per-test OLED screenshots')
+    p.add_argument('--screenshot-audit', metavar='SCREENSHOT_DIR',
+                   help='exit 1 if any SECTIONS test that declared screens captured none')
+    p.add_argument('--audit-junit', metavar='XML', default=None,
+                   help='JUnit XML for --screenshot-audit, so skipped tests are not counted missing')
     p.add_argument('--screenshot-filter', action='store_true',
                    help='Print pytest -k expression for tests needing screenshots, then exit')
     p.add_argument('--validate-junit', action='store_true',
@@ -1224,6 +1336,15 @@ def main():
         if fw: print(f'Detected: {fw}', file=sys.stderr)
         else: print('No emulator, defaulting to 7.10.0', file=sys.stderr); fw = '7.10.0'
 
+    if args.screenshot_audit:
+        ok, missing = screenshot_audit(fw, args.screenshot_audit, args.audit_junit)
+        if ok:
+            print('screenshot audit: every declared screen was captured')
+            sys.exit(0)
+        print('screenshot audit FAILED -- declared screens with no capture:')
+        for mod, meth in missing:
+            print('  %s::%s' % (mod, meth))
+        sys.exit(1)
     if args.screenshot_filter:
         print(screenshot_filter(fw))
         sys.exit(0)

tests/test_msg_display_disclosure.py

@@ -90,6 +90,17 @@ def recording_callback(msg):
                 # A capture failure must not mask the behaviour under test;
                 # the assertions below check what was captured.
                 pass
+            try:
+                # Also emit the frame as a PNG through the normal capture path.
+                # This class answers ButtonRequests itself, which bypasses the
+                # client's own capture hook -- so under KEEPKEY_SCREENSHOT=1
+                # these tests were selected by the screenshot filter, passed,
+                # and produced NO images. The screens this suite exists to
+                # police were the ones nobody could look at.
+                if getattr(client, 'screenshot_dir', None):
+                    client._capture_oled()
+            except Exception:
+                pass
             if recorder.answer:
                 client.debug.press_yes()
             else: