Mode C: machine only

Available, and refused unless you say what you are giving up.

This is the mode every other hardware wallet uses by default, and it is the mode whose failure prompted this project. It is not inherently broken. It is unverifiable, which is different and, for this project, worse.

If you use Mode C you are trusting the Pi's hardware RNG, the kernel CSPRNG, and nullroute's own code to have combined them honestly. You have no way to check any of it. The screen says exactly that, and the daemon refuses to generate anything unless the request carries an explicit acknowledgement, so the mode cannot be reached by tapping through.

The health gates below run first. All of them must pass.

An honest note about how long this was fiction

Everything in the two sections above, the gates and the confirmation, was written here in the present tense long before any of it was built. A reader deciding between rolling dice and letting the device choose was told the second path was gated when it was not. That is the overclaim this project calls a security bug rather than a documentation chore, and it is recorded rather than quietly corrected because the same failure is easy to repeat.

---