What to try — microdots

# WHAT TO TRY — Item A3-1: Dead Drops & Microdots

**Time needed: about 5 minutes. You need: a terminal in this folder and
one PNG photo of your own you don't mind copying (a phone photo saved
or exported as PNG works — a JPEG won't, and step 2 shows you why).**

Folder: `~/workspace/horizon-works/q-branch-2026-10-31/wave-a3/a3-1-microdots/`
The page that explains it all (just open the file, nothing is online):
`index.html` — theme “Microdot Sepia”. It also carries the short
history of real microdots and the hollow-book / false-bottom-drawer
craft note.

**⚠ PROTOTYPE — SAMPLE DATA ONLY. Try it with made-up notes first.**

## The 5-minute walk

1. **Hide a made-up note in a copy of your photo**
   ```
   python3 steg.py hide my-photo.png my-photo-hidden.png --passphrase "purple tiger 42" --text "The spare key lives where we agreed."
   ```
   Expect a `hidden: …` line with the sealed size and the photo's
   capacity — and the sentence *“Steganography hides existence;
   encryption protects content.”* Open both pictures side by side:
   they should look the same. That sameness is the whole trick.

2. **Get the note back**
   ```
   python3 steg.py extract my-photo-hidden.png --passphrase "purple tiger 42"
   ```
   Expect your exact note, word for word.

3. **Try the wrong passphrase on purpose**
   ```
   python3 steg.py extract my-photo-hidden.png --passphrase "wrong guess"
   ```
   Expect a plain refusal: `FAIL: verification failed …` — and no
   note, not even a garbled one. That refusal is the integrity tag
   doing its job; a tool that prints *something* here would be lying.

4. **Feel the two hard edges**
   - Save the hidden picture as a JPEG (any editor), then extract from
     the JPEG. The tool refuses: LSB hiding does not survive JPEG, and
     it says so instead of failing mysteriously later.
   - Hide a long note in a very small PNG. The tool refuses and prints
     both numbers — how many bytes the sealed note needs vs how many
     the picture holds.

5. **The strong pairing (optional, 2 more minutes)** — seal a note in
   the Dead Drop (`02-deaddrop/index.html`), download the sealed
   `.txt`, then hide *that file* here with `--file` in place of
   `--text`, and extract it back out with `--out`. Modern crypto
   protects the content; this tool hides that it exists.

## The fence, in plain words

- Hiding is not locking. This keeps a note out of casual sight; the
  built-in seal is a teaching-grade construction, plainly labelled —
  for a real secret, seal with the Dead Drop first (step 5).
- A forgotten passphrase is gone for good. There is no recovery and
  no back door, by design.
- Everything runs on this machine. No photo or note is uploaded
  anywhere.

## If something breaks

- `error: input must be a PNG` → export a PNG copy of the photo first.
- `error: note does not fit` → bigger photo or shorter note; the
  message prints both byte counts so you can see how close you are.
- `FAIL: verification failed` on a note you just hid → check the
  passphrase spelling, and that you're extracting the *hidden* output
  file, not the original.