What the device refuses

Collected in one place, because the refusals are the design:

• To start, unless a passing verification report describes the MANIFEST.lock it is running with (INV-BUILD-1). It compares that one hash; the file contents are checked by make verify and, on a device, by dm-verity.
• To store a wallet whose mnemonic you have not confirmed you wrote down.
• To register a multisig quorum it holds no key in.
• To sign past a blocking warning without an explicit tick.
• To sign a message that would display differently from what is signed.
• To read a label that could render as text it does not contain.
• To claim it knows which addresses have been used.
• To show a fingerprint it has not verified as though it had.