# PIN Storage Security Remediation

- [x] Investigation evidence collected.
- [x] Official Android Keystore behavior verified.
- [x] Implement hardware-backed PIN envelope and limited-use attempt gates.
- [x] Add focused tests and version bump.
- [x] Run full unit tests, lint, and release builds.
- [ ] Complete real-device validation and publish device-tier guarantees.

## Checkpoint

- [ ] No ordinary-storage PIN-derived value can decrypt or validate the vault without Keystore hardware.
- [ ] StrongBox/TEE/unsupported behavior is evidenced on real devices.