# Desktop QR (BC-UR) — Smoke Test

Manual end-to-end test for the desktop online wallet's QR support
(Plan 9). Run on a real desktop + real iOS device. Both flows
require the desktop to be in **online** mode.

## Setup

1. Build the online desktop app (production):
   ```
   bash scripts/build-online.sh
   open "tauri/src-tauri/target/release/bundle/macos/Armory Online.app"
   ```
   Use the production build — the dev build (`cargo tauri dev`) does
   NOT pick up the Info.plist `NSCameraUsageDescription`, so the
   camera prompt won't fire. Allow camera permission when first
   prompted.
2. Build + run the iOS Armory Cold app on a real device (any recent
   build with Plan 7+ for the camera fix).
3. Have a watch-only wallet already imported on the desktop so the
   Create PSBT and Broadcast panels are reachable. OR plan to import
   one via QR during Flow B.

## Flow A: PSBT round-trip

1. **Desktop creates an unsigned PSBT** — fill the existing Create
   PSBT form (recipient + amount), click Create PSBT. PSBT result
   panel appears.
2. **Desktop shows QR** — click "Show QR" (the third button after
   Copy PSBT and Download .psbt). Modal opens with an animated QR
   cycling at ~5 fps. "Frame N / M" label updates.
3. **Mobile scans** — open the iOS Armory Cold app, tap into the
   wallet (unlock with password), then Sign → Scan QR. Hold the
   phone over the desktop screen until "Scanned 100%" completes
   and PSBTReviewScreen opens.
4. **Mobile signs** — review the recipients + fee, tap Sign in the
   toolbar. SignResultScreen appears with "Show animated QR".
5. **Mobile shows signed QR** — tap Show animated QR. Animated QR
   cycles on the phone screen.
6. **Desktop scans** — desktop Broadcast panel → click "Scan QR".
   Aim the desktop camera at the phone. When complete the textarea
   fills with the signed base64 PSBT and the modal closes.
7. **Desktop broadcasts** — tap the existing Broadcast button.
   Verify the transaction lands on the network (e.g., paste txid
   into a block explorer).

Pass criteria:
- Desktop's animated QR cycles smoothly (~5 fps, no stutter).
- Mobile scan completes inside ~10 seconds at arm's length.
- Desktop scan completes inside ~10 seconds at arm's length.
- Signed PSBT broadcasts successfully.
- No file transfer used; no base64 text manually pasted.

## Flow B: Watch-only wallet QR import

1. **Mobile has a wallet** — use an existing wallet on the iOS app,
   or restore from the abandon-abandon test seed.
2. **Mobile exports watch-only QR** — tap into the wallet, Export
   watch-only → Show QR. Animated QR appears.
3. **Desktop scans** — either on a fresh desktop install (mode
   selector → Online → Import) or via "Re-import wallet" if a
   wallet already exists. Click "Scan QR instead" (the button below
   the file picker). Aim the desktop camera at the phone. When the
   scanner completes, the password dialog appears.
4. **Set password** — enter a wallet encryption password (or skip
   if testing the skippable path). Wallet imports.
5. **Verify** — desktop now shows the wallet. Compare the
   fingerprint shown in the desktop UI against the fingerprint on
   the mobile app's WalletsList row — they should match.

Pass criteria:
- QR scan completes within ~10 seconds.
- Imported wallet matches the source on the phone (same fingerprint).
- Both the file-based import (.json picker) and the QR-based import
  remain functional independently.

## Wrong-type guards

Quick sanity check that mismatched QR types are rejected:

1. Open desktop's Broadcast panel → Scan QR.
2. Aim at a watch-only animated QR on the phone (NOT a signed PSBT).
3. Expected: modal shows error
   "Wrong QR type: expected crypto-psbt, got armory-watch-only.",
   does NOT auto-close, does NOT pollute the broadcast textarea.

Mirror: open desktop's Import → Scan QR instead, aim at a signed
PSBT QR. Expected: error about wrong UR type, no auto-close.

## Network safety check (always)

Throughout both flows, watch the desktop OS's network monitor
(macOS: `Activity Monitor → Network` tab, filter by the Armory
Online process). Confirm zero outbound network traffic to anything
other than the configured Electrum/Bitcoin RPC node when
broadcasting. QR transport must not leak to any external URL.

On the mobile side, Xcode's Debug Navigator should also show zero
outbound traffic — the cold wallet is air-gapped.
