[0xPxt]

Value

A user who has turned blind signing on, and who signs the same call repeatedly,
had no way to reach the approval except by tapping or clicking through every
screen. A wide DeFi withdrawal is 27 display items; the device has already told
them it cannot fully explain one of the arguments, so most of that paging buys
nothing.

The skip menu was meant to be that way out. It did not work.

• It was offered after every item. On a 27-item review that is 25 copies of a
  screen whose whole purpose is to shorten the review.
• Taking it did nothing when blind signing — the one case where a shortcut is
  wanted most. Pressing both buttons left the screen exactly where it was.
• It was offered on ordinary reviews, which is the dangerous one: a shortcut
  there is a way to approve without reading, reached without the blind-signing
  warning and without the setting the user had to turn on.

Technical

h_review_is_skippable() is the single predicate all three UIs share: blind
signed, and past REVIEW_SKIP_MIN_ITEMS. Counting the transaction's own display
items rather than the screens wrapped around them keeps the answer the same on
every device.

On bagl the skip becomes an ordinary UX_STEP_CB at a fixed slot before the first
item, so it is a position in the ring rather than something injected and withdrawn
mid-review. The custom button callback the interstitial needed is gone — left and
right are the flow engine's job again, which is most of the diff in view_x.c.

The blind-signing failure was a disagreement: run_ux_review_flow put
ux_review_flow_3_step_blindsign in the flow while the skip handler always asked
ux_flow_init to start at ux_review_flow_3_step, which that flow does not
contain. Both now call approval_step(), so the mismatch cannot come back.

Skipping leaves the paging one index past the last item, as reading to the end
does, so stepping back from the approval shows the end of the transaction.

MAX_REVIEW_UX_SCREENS goes 10 → 12: the added step makes the worst-case flow
eleven entries in a global array.

On NBGL the same reviews now set SKIPPABLE_OPERATION. That is the platform's own
control, and deliberately not a copy of the Nano screen — reproducing that would
mean rebuilding the review from nbgl_useCaseGenericReview and hand-writing the
blind-signing intro and the "Accept risk and sign" page, which are the SDK's to
own.

Verification

Exercised through Zondax/ledger-stacks#246, which turns the progressive review on:

• Full zemu suite green, 255 tests across Nano X, Nano S+, Stax, Flex and Apex.
• A new test drives the shortcut on all five and asserts it reaches "Accept risk
  and sign", never the plain approval.
• Verified by hand on a physical Nano S+ and a physical Flex: offered once, reading
  past it uninterrupted, back-navigation lands on the last item, and a long
  transaction that is not blind signed offers nothing.

Notes for review

• Rebased onto main, and zxversion.h now goes to 52.3.0 so apps have a
  version to move to. Minor rather than major: nothing in include/ changed
  shape, since h_review_is_skippable() and REVIEW_SKIP_MIN_ITEMS both live in
  view_internal.h, so a consumer picks this up without touching its own code.
• view_s.c (Nano S) gets the same gate but is not compile-checked — the app I
  verified against cannot build that target at all.
• REVIEW_SKIP_MIN_ITEMS = 12 is a judgement call; apps can override it.
• Apps without APP_BLINDSIGN_MODE_ENABLED now get no shortcut at all, since there
  is no opted-in state to key it on. Deliberate, but it is a behaviour change for
  any such app using the progressive review.

https://claude.ai/code/session_01PzJ2P5pR4becLUiDTm17HN