docs: RELEASES.md entry for 8.3.3 (rename containment fix + repair)

RELEASES.md

@@ -10,6 +10,34 @@ Full auto-generated changelog: `CHANGELOG.md` · Releases: https://github.com/so
 
 ---
 
+## v8.3.3 — 2026-07-15 (rename moves the containment edge — no ghost in the old directory)
+
+One production-reported fix plus a repair path, completing the delete/move hygiene arc (8.3.1 fixed
+deletes, 8.3.2 fixed counters, this fixes moves).
+
+- **A cross-directory `vfs.rename()` now MOVES the containment edge instead of accumulating one per
+  parent.** The old parent's `Contains` edge was never removed on a move, leaving the entity a child
+  of **both** directories: `readdir(oldDir)` kept listing it after the move, re-creating the old path
+  showed the same name twice, and any tree-walking consumer (sync engines, file browsers) saw the
+  file in two places. The old edge is now removed by edge id, resolved from the graph's own adjacency
+  — a removal never requires reading the thing being removed. Bonus fix in the same seam: a move **to
+  the root** now gets its containment edge (it was previously skipped, orphaning the file out of
+  `readdir('/')`).
+
+- **`repairIndex()` now also reconciles VFS containment** (new `vfs.repairContainment()`): every VFS
+  entity's containment edges are checked against its canonical `metadata.path` — stale old-parent
+  ghosts and duplicate edges are removed, a missing expected edge is restored, and user
+  knowledge-graph edges are never touched (only `vfs-contains` edges are candidates). Loud per
+  repair. Stores that performed cross-directory renames under ≤8.3.2 should run `brain.repairIndex()`
+  once after upgrading — the same single ritual now heals orphan directories, counters, **and**
+  containment edges.
+
+- Also ships a permanent lens-consistency regression suite (combined type+subtype vs subtype-only vs
+  canonical ground truth, id-for-id, warm and after a cold reopen), ported from the field
+  investigation that closed the historical lens-drop report.
+
+No API changes beyond the new optional `vfs.repairContainment()` (also invoked by `repairIndex()`).
+
 ## v8.3.2 — 2026-07-14 (honest counters — the recount + removal-without-re-reading)
 
 Completes 8.3.1's delete-hygiene story at the counter layer, from a production proof chain reported