docs: record M4 results and simulator findings; bump to 0.4.0v0.4.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 6a30397..ee2f94d 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -148,3 +148,8 @@ A locked entry that arrives while the session is locked, or before a PIN exists,
 
   This is best effort, as README 7.8 says.
 - **Invalid UTF-8 is checked before decoding.** `StringUtil.convertEncodedString` stops the app with an uncatchable error on invalid UTF-8, so `Bytes.toUtf8` validates first, and damaged text can't crash the app.
+
+## Test builds and fixtures
+
+- **The UI-test build** (`uitest.jungle`) wipes the store at every start and fills it with fake entries. It sets the PIN 123456 by storing a precomputed wrap of a fixed fake master key (`tools/gen_fixture_wrap.py`), and freezes the clock. All of this is `(:uitest)` or `(:debug)` code; release builds, and therefore the Store package, contain none of it.
+- **The PIN screen hands the derivation a copy of the typed digits** and wipes both the copy and its own buffer once the derivation is done. The native HMAC object may keep its own copy (see above).