docs: correct rc-era time-travel staleness + record the embedding-model ordering constraint

- data-storage-architecture.md described transact() as 'the unit of history'
  (rc.2 era). Single-op retention has been the model since 8.0 — every write
  gets its own generation; transact() only groups several into one. Corrected.
- RELEASE-GUIDE.md now records the hard ordering constraint: no embedding-model
  change ships before vector model-version stamping + hard-error-on-mismatch
  lands.

docs/RELEASE-GUIDE.md

@@ -120,3 +120,12 @@ gh release create vY.Y.Y --generate-notes
 - **Major versions should be RARE**
 - **When in doubt, it's probably MINOR**
 - **NEVER use "BREAKING CHANGE" for internal changes**
+## Hard Ordering Constraints (check before EVERY release)
+
+- **Embedding model changes are SEQUENCED, not free.** No release may change the
+  embedding model (or its quantization/dimensions) before **vector model-version
+  stamping + hard-error-on-mismatch** ships. Stored vectors carry no model version
+  today; mixing vectors from two models silently corrupts every similarity
+  comparison. If a model bump is ever proposed, the stamping work moves ahead of
+  it in the schedule — coordinate with the native provider so both engines stamp
+  and enforce identically. (Registered with the native-provider team 2026-07-07.)

docs/architecture/data-storage-architecture.md

@@ -369,7 +369,10 @@ await brain.restore('/backups/today', { confirm: true })   // replace store stat
   through the metadata index, not the filesystem.
 - **`_system/`** holds singletons plus 256 hash buckets of index state.
 - **`_generations/` + `manifest.json` + `tx-log.jsonl`** implement
-  generational MVCC; `transact()` is the unit of history.
+  generational MVCC. History is per-write: every `add()`/`update()`/`remove()`/
+  `relate()` gets its own generation, and `transact()` groups several ops into
+  one atomic generation. (Single-op retention has been the model since 8.0;
+  you never need to route a write through `transact()` just to keep its history.)
 - **`_column_index/` + `_blobs/`** hold the columnar metadata runs and binary
   blobs (VFS content included).
 - **`locks/`** coordinates the single writer and reader flush requests, and