docs: RELEASES.md — the unreleased write-path and lifecycle entry (consumer-facing draft; version set at cut)

RELEASES.md

@@ -31,6 +31,60 @@ is sometimes cited as a 7.x removal — those methods never existed on 7.x; the
 
 ---
 
+## UNRELEASED — the write-path and lifecycle release (version set at cut)
+
+The theme: **writes ack fast and honestly, startup adopts instead of rebuilding, and
+every query path serves, announces, or refuses — never silently degrades.** Everything
+below is on `main`, gated, and ships as one release together with the matching native
+accelerator version.
+
+### New capabilities
+
+- **`deferEmbedding: true`** on `add()`/`update()`: the write acks at durability; the
+  embedding runs on a crash-safe background worker and the vector swaps in atomically.
+  The row is id/metadata-findable immediately; semantic recall converges when the embed
+  lands. Barriers and gauges: `awaitPendingEmbeds()`, `waitForIndexed('semantic')`,
+  `getIndexStatus().pendingEmbeds`. VFS file writes adopt this end to end — file-write
+  ack no longer waits on a neural net (measured ~50× faster serial writes on a
+  production-shaped corpus).
+- **`waitForIndexed(path?, { generation?, timeoutMs? })`** — the one honest read
+  barrier for write-then-recall flows. Typed timeout error naming what was still
+  pending; never a silent partial wait.
+- **Engine-owned persistence cadence** (`persistence.policy: 'auto'`, now the default):
+  the engine flushes on write-count/interval/idle triggers in the background,
+  single-flight. **Delete `flush()` calls from hot paths** — `flush()` remains as an
+  awaitable durability barrier. A hung flush can never block a write ack.
+- **Time-travel recall contract**: `asOf(G).find()` serves vectors exactly as they
+  stood at G — a later update never leaks into an earlier pin; deleted rows mask;
+  beyond-head pins refuse typed.
+- **Log-authority storage (opt-in, per brain)**: `verifyLogAuthority()` audits the
+  generation log against stored truth record-by-record and names every divergence;
+  `adoptLogAuthority()` flips a brain to log-authoritative storage only on a green
+  audit (self-healing curable divergences first), enabling durable-at-ack writes:
+  concurrent writers share one fsync and an acked write survives power loss, by
+  construction (crash-recovery replay is pinned by fault-injection tests).
+
+### Behaviour changes
+
+- **`find({ where: {} })` now serves match-all** (previously returned an empty result
+  silently — warm and cold). Same fix applies to count, streaming, and graph-scoped
+  seeding paths.
+- **`removeMany({ where: {} })` now refuses with a typed error** — a match-all bulk
+  delete must be explicit, never inherited from an empty filter object.
+- **Aggregations always answer**: state persists at every `flush()` (not only close),
+  an unclean exit reconciles incrementally instead of rescanning the store, and
+  deletes without a before-image flag a loud rescan instead of silently skipping.
+- **Vector updates are atomic in place** — a row is never transiently absent from
+  search during an update (the "flicker" class is gone); type-only re-index of an
+  unchanged vector is a no-op.
+
+### Format note
+
+- The generation log gains **format v2** (typed, versioned records with integrity
+  seals). v1 segments remain readable forever; new segments write v2. Older brainy
+  builds refuse v2 segments with a clear version-naming error rather than misreading
+  them. Records reserve encryption fields for a future release — zero behaviour today.
+
 ## v8.11.0 — 2026-07-27 (canonical enumeration mode for export — storage-walked, canon-complete)
 
 From a fleet data-migration program's requirement for whole-brain exports that are