docs: record the settings spike and the Forerunner 70 benchmark

Spike (2026-10-21, Android): 8000 characters per field and 64,000 in
total arrive; URIs with & save; the mixed special-character string is
refused, so the test strings now split it into one group each plus a
fake Aegis export. Benchmark: SHA-1 TOTP 18 ms, SHA-512 732 ms, PBKDF2
2,000 iterations per second.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 17 insertions, 0 deletions

diff --git a/docs/PERFORMANCE.md b/docs/PERFORMANCE.md
index 4c35be6..0433457 100644
--- a/docs/PERFORMANCE.md
+++ b/docs/PERFORMANCE.md
@@ -27,6 +27,23 @@ The targets are in [README section 18](../README.md#18-performance-budgets). Thi
 
 ## Results
 
+### Forerunner 70, 2026-10-21 (real watch, debug build 0.8.0)
+
+The first numbers from the real watch, read from "Debug: benchmark" on the sideloaded debug build (docs/YOUR_STEPS.md part 4.2):
+
+| Value | Forerunner 70 | Simulator (M4/M8) | Note |
+| --- | --- | --- | --- |
+| TOTP, SHA-1 | 18 ms | under 1 ms | One code per timer event is far inside the watchdog |
+| TOTP, SHA-512 | 732 ms | 17.5 ms | About 40 times SHA-1, as the simulator ratio predicted. A list with several SHA-512 entries fills in about one per second; the detail screen shows the code within a second |
+| PBKDF2 | 2,000 iterations per second | about 12,000 | Exactly the lower bound in README 18, so setting a PIN calibrates to the 2,000-iteration floor and unlocking takes about 1 s |
+| Header reading | 0 entries in 1 ms | | The benchmark ran before the demo entries were added, so this says nothing yet |
+| Self-test | 292 ms | | The crypto known-answer tests at start-up of the debug build |
+| Memory at the benchmark | 179 of 763 KB (23 %) | 21 % at the first frame | Well under the 70 % budget |
+
+Other timings reported from the same session: settings saved on the phone reach the watch in about 1 second (settings spike, test G). The Member QR demo card took noticeably long on its first opening and about 1 second the second time; its progress display jumped to 90 % almost at once, which is fixed in the next version (the percentage now follows the work, not the phase count).
+
+What this means: unlocking stays at about 1 s because 2,000 iterations is also the minimum the app accepts. An attacker who copies the watch's storage still has to run those 2,000 iterations per guess, but on a PC that is microseconds, so the PIN protects mainly against someone holding the watch (lockout and the optional erase after 10 wrong PINs), not against an offline attack on a copied file system (docs/SECURITY.md).
+
 ### M8, 2026-10-21 (polish and release candidate, version 0.8.0)
 
 - **Memory, Forerunner 255S (512 KB):**