docs: record M4 results and simulator findings; bump to 0.4.0v0.4.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 36 insertions, 0 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c4a7737..75f3850 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,42 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-19
+
+Milestone M4: the screens. The app is usable in the simulator with demo
+entries; adding real entries comes with M5 (import) and M7 (settings).
+
+### Added
+
+- List of entries with live codes, countdowns, lock and barcode icons, and
+  groups. Rows adapt to narrow screens, and headers are read only for the
+  visible rows.
+- OTP detail: large grouped code, countdown ring (bar on rectangular screens),
+  next code in the last 5 seconds, HOTP "next" with the counter, entry ID.
+- PIN screen: touch keypad or button digit selector. It covers create (twice,
+  with a warning below 6 digits), unlock and change. Wrong PINs vibrate, and
+  the lockout wait is shown. Pending locked entries are promoted after
+  unlocking.
+- Menu: lock now, set/change/reset PIN, settings results, entry IDs, clock
+  status, about. Debug builds add demo entries, a performance overlay and an
+  on-watch benchmark.
+- Glance with the number of entries; the crypto self-test on first start and
+  daily; auto-lock while a locked entry is open.
+- Option properties with defaults (`resources/settings/properties.xml`).
+- UI-test build with fake entries, PIN and a frozen clock. A scripted UI flow
+  (`tools/ui_flow.py`) checks 10 screens on each of seven simulated watches.
+  Also new: `tools/gen_fixture_wrap.py`, and 7 Monkey C and 6 Python tests.
+
+### Changed
+
+- PBKDF2 XORs 32-bit words: 2.3× faster, and 100 iterations per job step,
+  because 200 tripped the watchdog on the Forerunner 255S.
+- Codes are computed in their own timer events, at most one SHA-512 code per
+  event.
+- `make screenshots` runs the scripted flow; goldens are now
+  `test/golden/<device>/<screen>.png`. Start-up budgets are set from the M4
+  measurements.
+
 ## [0.3.0] - 2026-10-19
 
 Milestone M3: storage, keys and PIN logic. Nothing user-visible yet; the