docs: log Batch 04, and a git mistake worth keeping

Records the fertility work, the third instance of "the app declines rather than
stretches", and the pre-commit hook that made `git rm` impossible.

Also records my own error rather than tidying it away: `git reset --hard` after
the post-commit hook has pushed does not undo the push, and it discarded an
uncommitted fix mid-proof. Reconciled forward instead of rewriting published
history.

docs/history/DEVELOPMENT_LOG.md

@@ -32,6 +32,69 @@ written and stay true. It is exempt from review for the same reason a receipt is
 
 ## Entries
 
+### 2026-08-18 — Batch 04 shipped: fertility that declines, and a hook that refused every deletion
+
+Three issues closed and the milestone with them. Four of the eight batches are
+now done.
+
+**Fertility, and the decision that made it worth shipping.** Ovulation is
+estimated a luteal phase before the *predicted* next period — §17 asks for that
+direction because the luteal phase is the stable half of the cycle — and the
+window opens five days before it and closes one after. The uncertainty is
+inherited from the forecast rather than invented.
+
+The first version was arithmetically correct and useless. A user one cycle into
+the app was shown a fertile window of **8 Aug – 24 Aug**: seventeen days, over
+half a cycle, dressed up as a feature. So the estimate now returns null past a
+usable uncertainty and the screen says *"Not enough history to estimate"* with a
+reason to keep logging. Three stable cycles later the same user gets 12 Aug – 20
+Aug, which is worth reading. Both states were checked on a device.
+
+That is the third instance of one pattern, so it is now written into
+`docs/architecture/README.md` as a rule rather than a coincidence: **the app
+declines rather than stretches.** Accuracy figures wait for three scored
+forecasts; averages wait for two intervals; fertility waits for a forecast tight
+enough to hang off.
+
+**§18's prohibition is a type.** `FertilityLikelihood` has LOWER, HIGHER and
+UNKNOWN and no fourth value, and a test asserts no label contains a permission
+word — so adding "safe" is a deliberate act with a failing test rather than a
+slip in a string.
+
+**Another greyscale collision.** The ovulation star was centred and sat directly
+behind the numeral; in greyscale the "18" and the mark merged. Ovulation is now
+the fertile ring plus a small star low in the cell, which is also the more honest
+picture — that day *is* inside the window.
+
+**The hook refused every deletion-only commit.** `secrets.sh` exits 2 for
+"nothing was scanned", which is the correct answer for a commit that only
+deletes files. The hook treated any non-zero as a refusal and printed *"possible
+credential in the staged changes"* over a plain `git rm`. Found while removing a
+`bin/` directory Buildship had been writing — a directory full of `.kt` files,
+which is the one kind of build output that does not look like build output in a
+`git status`. It only got committed at all because a `.gitignore` edit was
+staged alongside, which gave the scanner something to read.
+
+**And a mistake worth recording rather than tidying away.** While proving the
+fix, I committed a throwaway, then ran `git reset --hard HEAD~1` — which did not
+undo the push the post-commit hook had already made, and silently discarded the
+uncommitted hook fix I was in the middle of proving. The second proof then
+failed for a reason that had nothing to do with the guard. Reconciled forward
+rather than force-pushed. **Commit the work before proving the guard, not after.**
+
+- **Closed:** #21, #22, #23 — and the `Batch 04 — Fertility` milestone.
+- **Next action:** Batch 05 — Notifications. File its issues first; the milestone
+  is empty. The work is WorkManager-scheduled reminders (§29, §30) with the three
+  privacy modes from §28 — and the mode that matters is Discreet, already the
+  stored default and already chosen in onboarding, so this batch is about the
+  lock screen actually honouring it. **Pass F cannot be run until this lands**,
+  and it is the pass that checks the most likely real privacy breach in this
+  product.
+- **Blockers:** Unchanged, both needing a person: the three branding marks (#8)
+  and the Command Center webhook (#9). The three standing QA gaps are also still
+  open and are getting more expensive the more UI exists — TalkBack has never
+  been run, text has never been scaled, and nothing has run at `minSdk` 26.
+
 ### 2026-08-18 — Batch 03 shipped: every screen the app has, and three defects only looking could find
 
 All six Batch 03 issues closed and the milestone with them. Period stopped being