Fix QR-code generation

PLANS.md

@@ -122,6 +122,7 @@ Each row is a delivery milestone, not a completion claim. Expand its record befo
 | 10  | Visible styled keyboard quick reference in bottom panel | 8; existing M7 TUI                        | accepted    |
 | 11  | Valid subnet routes shown as a capability limitation    | 10                                        | accepted    |
 | 12  | Aligned, responsive client table                        | 11                                        | accepted    |
+| 13  | Compact terminal QR disclosure                           | 12                                        | accepted    |
 
 ### Milestone 1 — Rust foundation, settings, and domain states
 
@@ -3544,8 +3545,57 @@ source in [M12 evidence](docs/evidence/milestone-12.md). Synthetic UI/PTY
 evidence does not establish physical terminal, Alpine or systemd behavior.
 Stop after this milestone; do not resume VM work, commit or deploy.
 
+### Milestone 13 — Compact terminal QR disclosure
+
+Status: accepted (2026-10-27T21:13:30+02:00). M12 is accepted; M9 remains retired and
+unaccepted. This is the user's scoped terminal disclosure repair.
+
+#### Outcome and scope
+
+Render authorized QR modules with two vertical modules per terminal cell,
+explicit dark/light colors, and the complete four-module quiet zone. Fit must
+account for the actual bordered disclosure layout and wrapped delivery notice;
+retain file-backed fallback and Esc cleanup when it cannot fit. Existing file
+delivery, password authorization, and draft/saved/applied behavior remain intact.
+
+#### Tasks and acceptance
+
+| Task | Owner | State | Evidence required |
+| --- | --- | --- | --- |
+| M13.1 | implementer | complete for implementation scope | Compact rendering/layout and focused deterministic tests in `src/tui/render.rs` and test-only QR fixture in `src/delivery/qr.rs` |
+| M13.2 | independent reviewer; repairer | complete | R1–R5 repaired and independently re-reviewed; no actionable scoped finding remains |
+| M13.3 | coordinator | complete | Integrated files checked; pinned Rust gates passed; source and artifact recorded in [M13 evidence](docs/evidence/milestone-13.md) |
+
+- [x] M13-A1: all four two-module cell combinations, odd-height light padding,
+  explicit colors and full quiet zone render correctly.
+- [x] M13-A2: a deterministic nonsecret 73-module matrix uses 73 columns and 37
+  QR rows, with exact fit/fallback dimensions from bordered layout and wrapped notice.
+- [x] M13-A3: fallback points to saved file; resizing redraws the same authorized
+  QR; Esc clears it; no matrix or configuration enters logs, Debug or snapshots.
+- [x] M13-A4: independent review closes findings and focused plus required Rust
+  completion gates pass. Automated render evidence is distinct from manual scanning.
+
+Planned checks: `cargo test --locked tui::render::tests::`, focused QR tests,
+`cargo fmt --all -- --check`, `cargo clippy --locked --all-targets -- -D warnings`,
+`cargo test --locked`, `cargo build --locked --release`, and `git diff --check`.
+Synthetic tests require no Docker or VM; real systemd is outside this scope.
+Evidence will be recorded in `docs/evidence/milestone-13.md`.
+
+#### Outcome and handoff
+
+M13-R1–R5 (P2, closed): fallback visibility at 34×12/20×8, Draft/Saved/Applied
+status, all quiet-zone edges, exact available-area reporting and uncertain
+delivery wording were repaired and independently re-reviewed. [M13 evidence](docs/evidence/milestone-13.md)
+records focused and integrated results. No production or host service was used.
+
+Accepted for the automated TUI rendering scope. A 73-module matrix needs 73×37
+QR cells; the tested bordered layout with a one-row notice fits at 75×44.
+Longer notices increase the required terminal height. Physical terminal and
+phone/decoder scanning remain unverified; M9 systemd acceptance remains retired.
+
 ## Current progress and resume point
 
+- Milestone 13 is accepted (2026-10-27): compact, explicitly colored QR disclosure, complete quiet zone and dimensioned fallback passed synthetic rendering tests, independent R5 closure and pinned Rust gates. [M13 evidence](docs/evidence/milestone-13.md) records the reviewed source and release artifact. No manual scan, Alpine rerun, VM or production validation is claimed.
 - Bounded TUI maintenance TUI-TS-001 (2026-10-27): new-client form creation timestamps now have whole-second UTC precision before strict metadata rendering. A fixed fractional-second instant and a synthetic blank-IP form-to-draft workflow passed; saved bytes stayed unchanged. Independent review found no actionable issue, and pinned-toolchain Rust completion gates passed. [Timestamp repair evidence](docs/evidence/tui-creation-timestamp.md) identifies the source and release artifact. This repairs M7 behavior without claiming new Alpine or VM validation; earlier artifact identities remain historical after this Rust change.
 - Bounded TUI maintenance (2026-10-26): repaired list arrows opening client details. Up/Down now only move the highlight; Enter opens details and Esc returns. Initial navigation follows the renderer's first-row highlight. Independent review closed NAV-001 with no remaining scoped findings; validation is recorded in [navigation repair evidence](docs/evidence/tui-navigation.md). This does not advance M9 or supply VM/Alpine acceptance evidence; prior artifact identities remain historical after this Rust change.
 - Milestones 1–8 are accepted; milestone 9 is retired by user direction and unaccepted. Its real systemd/D-Bus checks remain unverified and are not a prerequisite to M10.
@@ -3564,7 +3614,7 @@ Stop after this milestone; do not resume VM work, commit or deploy.
 
 - Milestone 8 delivered reviewed opt-in Alpine Testcontainers coverage for real IPv4 WireGuard peers, application lifecycle, saved/runtime separation, restoration, import/reissue, backup failures and the real Rustix reader. Host gates and three fresh real-container runs passed on one stable source fingerprint; M8-A1–A10 accepted. Real IPv6 behavior is unverified by user-authorized scope.
 - Milestone 9 is retired and unaccepted: the reviewed disposable VM preparation and guarded first start did not establish Debian/systemd acceptance. The exact VM was powered off after the user stopped work. M9.2–M9.3 were not started; M9-A1–A9 are unchecked.
-- Next action: scoped timestamp repair is complete; await user direction. Do not restart the VM, access production, commit, or deploy.
+- Next action: await user direction after M13. Do not restart the VM, access production, commit, or deploy.
 
 ## Plan maintenance