Document how the block list is kept and how the sources are verified

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.en.md

@@ -27,9 +27,9 @@ Personal project, only tried on Fedora 44, KDE Plasma 6.7 on Wayland, NVIDIA
 GPU, Fcitx5 5.1.23 with the Pinyin engine. Animations, the right click menu,
 forgetting candidates and starting at login have been used on that setup.
 
-**`scripts/build.sh` has not been run from scratch in a clean environment**, and
-no other distribution or desktop has been tried. Please open an issue if
-something breaks.
+`scripts/build.sh` has been run from scratch in a clean directory once (Fedora 44),
+no other distribution or desktop has been tried. Please open an issue if something
+breaks.
 
 The addon is a fork of `classicui` and is built inside the Fcitx5 source tree,
 because Fcitx5's Wayland protocol wrappers are not installed by `fcitx5-devel`.
@@ -60,7 +60,11 @@ scripts/install.sh    # installs into ~/.local, nothing outside $HOME
 ```
 
 `build.sh` picks the Fcitx5 version from `pkg-config`, override it with
-`FCITX_VERSION`.
+`FCITX_VERSION`. The sources are fetched **by commit hash** and the hash is checked
+afterwards (a tag can be moved, a commit hash cannot be faked). A version without a
+pinned commit is refused unless you pass `FCITX_COMMIT=<sha>`. The plugin runs
+inside the input method and sees everything you type, so what it is built from
+matters.
 
 ## Use
 
@@ -114,7 +118,16 @@ When you pick *Forget candidate*, m3ui therefore also records the word in
 those words from the candidate list before every refresh.
 
 - Matching is exact on the full text of the candidate.
-- To bring a word back, delete its line and restart Fcitx5.
+- **It survives restarts**: the file is replaced atomically (temporary file,
+  `fsync`, rename, so a kill in the middle never leaves a half written list) and is
+  mode `600`. If a save fails the word stays hidden for that run and the save is
+  retried.
+- Changes made to the file by other programs or by hand are picked up without a
+  restart.
+- Only words forgotten **through the right click menu** are recorded. A word
+  forgotten with the Pinyin engine's own shortcut (`Ctrl+7`) is not, and if it comes
+  from a system dictionary it will show up again.
+- To bring a word back, delete its line.
 - This is a layer on top of the engine. With the stock classicui the words
   show up again.