docs: RELEASES.md entry for 8.3.0 (heal-cost + ADR-004 Pass 2/3)

Consumer summary of the 8.3.0 minor: 16-way parallel canonical enumeration +
id-only getNounIdsWithPagination (index-heal speedup, standalone); the ADR-004
cross-layer integrity contract (validateInvariants delegation + repairIndex
native rebuild); and the registered-blob family contract (declared index blobs
undeletable). The two contract pieces are inert until a native provider
implements the matching hooks.

RELEASES.md

@@ -10,6 +10,39 @@ Full auto-generated changelog: `CHANGELOG.md` · Releases: https://github.com/so
 
 ---
 
+## v8.3.0 — 2026-07-13 (faster index heals + the cross-layer integrity contract)
+
+Three additive changes. The first is an immediate, standalone performance win; the other two are the
+brainy side of the write/index-spine integrity contract (ADR-004), inert until a native accelerator
+that implements the matching hooks is present — so this release changes nothing for a JS-only brain
+beyond the speedup.
+
+- **Canonical enumeration is up to ~16× faster — the dominant term in an index heal.** The paginated
+  entity walk (`getNounsWithPagination`) hydrated each entity's vector + metadata one-at-a-time; since
+  every index rebuild enumerates canonical storage, that serial per-item latency dominated multi-minute
+  heals. Hydration is now 16-way bounded-concurrency, with the pagination contract (order, cursor
+  resume, filters, totalCount) byte-identical to before. New **`getNounIdsWithPagination()`** returns
+  ids without hydrating anything (zero per-entity reads when unfiltered) for callers that own their own
+  IO schedule.
+
+- **Cross-layer integrity — `validateIndexConsistency()` is no longer blind to native providers.** It
+  only ran the JS metadata index's own check, so a native provider whose manifest/segments/counts had
+  diverged still read as "healthy". It now feature-detects and aggregates each provider's optional
+  `validateInvariants()` self-report, names every failing invariant with its numbers, and exposes the
+  per-provider reports. `repairIndex()` now reconciles native derived state from canonical too
+  (rebuilding any provider whose failing invariant asks for it). New exported types
+  `ProviderInvariantReport` / `InvariantResult` / `InvariantHeal`.
+
+- **Registered-blob families — declared index files are undeletable through the storage layer.** A
+  provider can declare a derived-index blob *family* (a set of members that are load-bearing together);
+  once declared, `deleteBinaryBlob` / `removeRawPrefix` refuse to remove a member (new exported
+  `ProtectedArtifactError`), so a stray in-process sweeper cannot delete a load-bearing index file. The
+  declaration persists across reopen; `checkDerivedFamiliesPresent()` names any member missing on open.
+  New optional `StorageAdapter` surface (`registerDerivedFamily` / `unregisterDerivedFamily` /
+  `listDerivedFamilies` + `DerivedFamilyDeclaration`) and exported `DerivedArtifactMissingError`.
+
+No breaking API change (all additions are optional/new). Each change ships with regression tests.
+
 ## v8.2.8 — 2026-07-13 (honest index readiness — no more silently-empty queries on a cold index)
 
 Closes the last of the three spine anti-patterns: the "dishonest readiness proxy," where `size() > 0`