docs: bring the QA verdict back in line with what has actually been run

The run-state still said "five of eight batches are done and Batch 06 has
begun", from 2026-08-18 at f43e1c2. Four batches have landed since, and the
Command Center quotes that sentence verbatim on the project screen — so a stale
verdict is a published one.

Rewritten to say what is true and, more usefully, what is not: no full round has
run since Round 4, the API 26 image has not been launched since four batches
were written, no real locked screen has been looked at, and TalkBack has never
been run. Those three are the distance between "no known defect" and "fit to
ship". The two days of targeted device checks are recorded as targeted checks,
not as rounds.

Four restore rows added to the security checklist, including the two that would
catch the mistakes this feature could plausibly make: reading an archive before
the unlock, and letting a file switch on a lock setting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/qa/ClaudeQACoverage.md

@@ -84,7 +84,7 @@ emulator as it landed rather than in one pass at the end. Same environment:
 | E — Forecast under hard histories | **Partial** | The §51 cases pass as unit tests against both engines, and the not-yet path was driven through the UI. The variable and outlier histories have still not been entered by hand. |
 | F — Notification privacy | **Not run** | Nothing sends a notification yet — Batch 05. The onboarding *choice* was verified: Discreet is selected before the user touches anything. |
 | G — Accessibility | **Partial** | Every calendar day, the confidence indicator and the hero countdown carry content descriptions, checked by reading the view hierarchy. **The calendar was verified in actual greyscale** and all five marks remain distinguishable. TalkBack itself, and font scaling, still untried. |
-| H — Data ownership | **Partial** | Delete-all covered by an instrumented test. Export, app lock and artifact inspection do not exist yet. |
+| H — Data ownership | **Partial** | Delete-all covered by an instrumented test. Restore driven end to end on `PeriodQA` on 2026-08-21 (add, add-again, and the replace confirmation opened and cancelled). Export through a real save dialog, the app lock's own rows, and artifact inspection are still unrun. |
 
 ### What driving it found that tests did not
 
@@ -121,7 +121,7 @@ profile, debug build.
 | E — Forecast under hard histories | **Not run** | The §51 cases pass as unit tests; none has been driven through the UI, which is what this pass is for. |
 | F — Notification privacy on a lock screen | **Not run** | Nothing sends a notification yet — Batch 05. |
 | G — Accessibility | **Not run** | TalkBack, font scaling and greyscale legibility untried. The working surface is not the designed screen, so this is worth deferring to Batch 03 rather than testing a screen that is about to be replaced. |
-| H — Data ownership and leakage | **Partial** | Delete-all covered by an instrumented test. Export, app lock and the built-artifact inspection do not exist yet. |
+| H — Data ownership and leakage | **Partial** | Delete-all covered by an instrumented test. Restore driven end to end on `PeriodQA` on 2026-08-21 — including that a second restore of the same file adds nothing, and that Insights still shows accuracy unscored afterwards. Export through a real save dialog, the app lock's own rows, and the built-artifact inspection are still unrun. |
 
 ### What pass C found
 

docs/qa/ClaudeReport.md

@@ -3,7 +3,7 @@
 ```
 Status: Current
 Owner: _null
-Last reviewed: 2026-08-18
+Last reviewed: 2026-08-21
 Governs: the QA verdict — build SHAs, round summaries, the overall judgment
 Review trigger: Any QA round run
 ```
@@ -19,22 +19,25 @@ Review trigger: Any QA round run
 
 ## Current run-state
 
-- **Last QA round:** Round 4 — 2026-08-18, partial (A and B pass; C, D, E, F, G and H partial)
-- **Last verified build SHA:** `f43e1c2`
-- **Last tested device / environment:** emulator `PeriodMinSdk26`, API 26, Pixel 6 profile, debug build, at font scales 1.0, 1.3 and 2.0
-- **Overall status:** Five of eight batches are done and Batch 06 has begun:
-  Settings is now the screen §36 describes, and Delete My Data is reachable,
-  confirmed and irreversible. The app has run at its minimum Android version and
-  at the largest accessibility font scale, and both found defects that had been
-  shipping unnoticed — a navigation bar that wrapped its labels mid-word, and a
-  privacy option whose label was not clickable at all, so the control deciding
-  what a lock screen shows could only be changed by hitting the radio button
-  exactly. Both are fixed. The pattern is now four rounds old and unchanged:
-  **every defect of consequence in this project has been found by a person using
-  the app, and none by a test.** The tests are what stop them coming back. The
-  standing gaps are the same shape — nobody has yet looked at an actual locked
-  screen, and TalkBack has still never been run, which is now the single most
-  valuable unspent hour.
+- **Last QA round:** Round 4 — 2026-08-18, partial (A and B pass; C, D, E, F, G and H partial). **No full round has run since**; the checks on the 20th and 21st were targeted at what those batches changed and are recorded below as such.
+- **Last verified build SHA:** `0ae92bd` — targeted device checks. The last SHA a full round covered is `f43e1c2`.
+- **Last tested device / environment:** emulator `PeriodQA`, API 36, debug build, for the targeted checks. The API 26 run (`PeriodMinSdk26`, Pixel 6 profile, font scales 1.0 / 1.3 / 2.0) was Round 4's and **has not been repeated since** — four batches have landed on top of it.
+- **Overall status:** Every batch through 12 has landed and the tracker has no
+  open issue. What was found in the last two days is the reason not to read that
+  as *finished*: two release-blockers were sitting in shipped code that no test
+  and no round had caught — a reminder button that recorded a new period instead
+  of ending one, corrupting the history and every forecast built on it, and a
+  Change PIN flow that never checked the current PIN. Both are fixed and both
+  were driven on a device. The export can now be read back, which was the last
+  thing standing between a user and her own history on a new phone; that flow was
+  driven end to end on `PeriodQA` today.
+  The pattern is now five rounds old and unchanged: **every defect of consequence
+  in this project has been found by driving the app, never by a test.** The tests
+  are what stop them coming back. So the standing gaps are the verdict: nobody
+  has yet looked at an actual locked screen, TalkBack has still never been run,
+  and the app has not been launched at its own `minSdk` since four batches were
+  written. Those three hours are what stands between "no known defect" and "fit
+  to ship", and they are unspent.
 
 ## Open defects
 
@@ -62,6 +65,23 @@ One entry per round, the verdict only. What each pass reached, and what it could
 not, lives in [`ClaudeQACoverage.md`](ClaudeQACoverage.md) and is deliberately
 not repeated here.
 
+- **Targeted checks — 2026-08-21 at `0ae92bd`.** Not a round: only the restore
+  flow was driven, on `PeriodQA` (API 36). An archive pushed to Downloads was
+  restored through Settings → Restore from a file → Add to what is here, giving
+  *"Restored. 4 periods and 2 spotting days added."*; Insights then showed three
+  cycles with accuracy still unscored, which is the property that matters — an
+  import must not manufacture accuracy figures. The same file a second time gave
+  *"Everything in that file was already recorded here, so nothing changed."* The
+  replace confirmation was opened and cancelled. Verdict on this flow only: it
+  does what its screen says. Passes A–H are untouched by this and remain at
+  Round 4's state.
+- **Targeted checks — 2026-08-20 at `f91ba6e`.** Not a round: Batches 11 and 12's
+  own surfaces were driven on `PeriodQA` — the four App-lock options rendering
+  with the biometric rows correctly disabled and explained on a device with no
+  enrolment, and the settings back arrow returning from every sub-page. Screenshots
+  are black once a lock is set (FLAG_SECURE), so the evidence is `uiautomator dump`
+  text. Verdict: the reported navigation trap is gone and the lock offers what it
+  claims to offer.
 - **Round 4 — 2026-08-18 at `f43e1c2`, partial.** Batch 06 began, and driving
   it found two defects in controls that already looked finished: navigation
   labels wrapping mid-word at font scale 2.0, and a privacy option whose row was

docs/security/SECURITY_CHECKLIST.md

@@ -74,6 +74,10 @@ The one group that is not generic. Every item proves part of
 - [ ] The export run once on a device, end to end through the system save dialog — proves the Storage Access Framework path works against a real document provider, which no Robolectric test reaches
 - [ ] The exported file opened and read — proves it is the human-readable archive §35 asks for, and that the dates in it are the dates the user entered
 - [ ] An export attempted while the app lock is on, returning through the lock screen — proves the destination is written only after the unlock, and written once
+- [ ] A file that is **not** this app's archive, chosen for a restore, changes nothing and says so — proves the only untrusted input this app takes is identified by its contents rather than by its name, extension or MIME type
+- [ ] A restore attempted while the app lock is on, returning through the lock screen — proves the archive is read only after the unlock, and read once. Without it, whoever took the phone during the file dialog could overwrite the owner's history without passing the lock
+- [ ] A restore with **Replace what is here** chosen cannot be reached without the confirmation dialog, on a device — proves the one irreversible choice in this feature is two taps and names what it deletes
+- [ ] An archive carrying `"biometricUnlock": true` leaves the app lock exactly as it was — proves a file cannot turn on a fingerprint shortcut for a lock set on this phone
 
 ### The compliance bar, which is not the launch bar