[angeloINTJ]

Two defects of the panel's PIN, found while #255 was checked on the rig.

1. Raising the PIN minimum locked shorter PINs out of the panel. A stricter policy marks every account holding a PIN to choose a new one, so that an account whose PIN is now too short identifies with it and goes to the change. But the keypad refused that entry as too short, against the new minimum, before Core 0 saw it.
2. "PIN too short (min 4)" said 4 under any policy. The number was written into the line, in the firmware and in both packs.

One commit per defect, then the flash record.

What changes

	main 8388f32	this branch
Proving a PIN shorter than the policy's minimum	refused, "PIN muito curto (mín. 4)"; the account is out of the panel	Core 0 checks it; if right, the account goes straight to Novo PIN
A PIN the web set below the minimum (the web does not check it, finding 7)	refused the same way, the one thing that held it to the policy	identifies and goes to Novo PIN: a tap is a character, so the entry's length is the PIN's
The too-short line	"(mín. 4)" whatever the minimum	the screen's real minimum, through a {n} marker
A pack line that drops the marker	not checked	check_lang_packs.py (before every build) fails

PinKb::entryMinLen( ) is the shortest entry a screen takes: 4 to prove a PIN, the policy's minimum to choose one. PinKb::changeAfterProof( ) decides the forced change: the mark, or a PIN shorter than the policy. display/CountInText.h fills the marker. It never hands the pack line to printf: packs are uploaded, so a %s in a line prints as %s.

What gets worse: an entry of 4 characters or more is now a real attempt, so a wrong one counts on the account's ladder. One shorter than the policy used to cost nothing.

What stays: narrowing the alphabet or lowering the length ceiling still strands an old PIN with a letter that left the cards, or longer than the ceiling. The cards cannot offer the first, and Core 0 cannot resolve the second in time. Manual chapters 8 and 30 now say so, with the way out (a new PIN from the panel's Users, the web or the console).

Tests first

• Native suite (287 of 287, plainly and under ASan and UBSan; the other eight suites pass too). Each new case first failed against main's behaviour:
  • test_identification_takes_a_pin_shorter_than_the_policy: "Expected 4 Was 5. identifying";
  • test_a_pin_below_the_policy_is_changed_once_it_proves: "shorter than the policy, unmarked";
  • test_count_in_text_puts_the_number_where_the_line_says: "Expected 'PIN too short (min 5)' Was 'PIN too short (min {n})'". It also covers a pack older than the marker, a %s%n in a line, and a short buffer.
• The language gate: with {n} in the firmware's English, it failed on both packs until their lines carried it.
• The gates job's scripts and build_manual.py --check pass.
• Every commit builds pico_w_test.

On the rig

pico_w_test of each tree, from the S1 bench dump, restored and read back byte for byte before each image. The policy went from 4/3/0 to 5/3/0 over pshort (PIN 1357) and plong (24680). The web then gave pweb 2468, unmarked.

	main	this branch
pshort, 1357	"PIN muito curto (mín. 4)", no SEC_PIN_OK	identified, Novo PIN
pweb, 2468	the same	identified, Novo PIN
plong, 24680	identified, Novo PIN	identified, Novo PIN
three digits on Novo PIN	"PIN muito curto (mín. 4)"	"PIN muito curto (mín. 5)", with the new pt-BR pack uploaded

On this branch, pshort chose 13579 and got the menu, and from then on its new PIN opened the menu directly. On the first try after the restart that loaded the pack, pshort's taps landed on the dashboard. That was the instrument, not the device; the second try is the one above. The rig is back in its arrival state (R30).

Flash

image	main	this branch	budget
release	1,020,940	1,021,092 (+152)	1,021,012 → 1,021,164
test	1,025,516	1,025,668 (+152)	1,025,660 → 1,025,812
test_https	1,030,492	1,030,652 (+160)	1,030,492 → 1,030,652
asserts	1,023,236	1,023,388 (+152)	1,023,268 → 1,023,420
alpha, Air	unchanged	unchanged	hold
Pico 2 W	997,000	997,160 (+160)	997,128 → 997,288

The signed release .bin has 7,019 B left under the OTA ceiling.

Docs

• Manual chapter 8 (the web PIN, wrong PINs, the PIN messages, the policy) and chapter 30 (two troubleshooting rows) are updated; MANUAL.pt-BR.html is regenerated.
• The READMEs count 639 cases, and quote the release at 97.8 % of its slot. The last commit fixes that number: CI caught it, because I had run check_readme_numbers.py before the flash record moved.
• tools/flash_budget.json and §3.1 of PLANO_STABLE.md carry the record.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BniVDEDSHGQgcoqmCRn5um