docs: record v0.4 release validation

docs/VALIDATION.md

@@ -1,5 +1,52 @@
 # Validation
 
+## Version 0.4.0 release and security validation, 2026-09-13
+
+Implementation commit: `e26efc19fa7f73e63cd98cb32b446d1fe10eed40`, signed by
+Nic Weyand. Version 0.4 completes plan phases 0 through 2: typed source coverage,
+granular name/edge/equivalence trust, authenticated quorum votes, structured
+observation batches, a bounded candidate observer, deterministic review queues,
+drift classification, sticky revocation, and publisher-signed emergency feeds.
+Writer stores migrate to schema version 5 and `argand.site-rules/v4`.
+
+Linux x86_64 with Rust/Cargo 1.98.1 and Python 3.14.7 passed:
+
+- Formatting, locked all-target compilation, Clippy with warnings denied, strict
+  API documentation, all 61 Rust tests and all eight Python source-release tests.
+- Native CLI, reusable Rust and Python consumer parity across the five-source
+  synthetic fixture, including trust failures.
+- The strict two-reviewer acceptance flow from source assertions through separate
+  name, edge and equivalence votes, observation replay, evidence invalidation,
+  drift, revocation, signed release, emergency-feed application, explicit
+  reinstatement, and policy-epoch revocation retention.
+- Adversarial coverage for source-coverage forks and gaps, signature tampering,
+  future and expired decisions, duplicated physical reviewer keys, publisher key
+  reuse, stale and cross-generation revocation feeds, late observation inserts,
+  SSRF address classes, redirect loops, compressed bodies, extraction limits and
+  a deterministic 512-case parser mutation corpus.
+- `cargo audit --deny warnings` scanned 1,243 RustSec advisories across 272 locked
+  dependencies without a finding. `systemd-analyze verify` accepted the observer
+  units; its sole output was an unrelated warning from the host's installed
+  `arch-audit.service`.
+
+Two source packages from the clean signed implementation commit were byte
+identical. Receipt pin:
+`a1614fcd44c91c5d842d2c391b2d31f530ab2fceed295aab834612cd885f8a19`.
+Archive SHA-256:
+`d260bfce000cc1d2e6fb81db4f9fda4a4b0727a729af1cab761fc46bda53bb17`.
+The receipt verifier accepted both copies. The archive was extracted outside the
+repository without Git metadata and passed the complete acceptance gate again.
+
+The final inventory was reviewed for credentials, private paths, datasets,
+generated artifacts, unsafe Rust and unrelated changes. The 0.4 security review
+found and fixed seven issues before release; no known critical, high or medium
+finding remains in its reviewed scope. See
+[SECURITY-REVIEW-0.4.md](SECURITY-REVIEW-0.4.md).
+
+No provider dataset was acquired or published, no production review or signing
+key was used, and no Argand source tree, build cache, service or public route was
+changed during implementation or validation.
+
 ## Version 0.3.0 security validation, 2026-09-13
 
 Implementation commit: `9705b01fe4bca201220c22aed7aab10c17abbf1d`, signed by