docs(releases): the 10.1.0 consumer entry — bounded recovery, restore founding, the two write-path cures

RELEASES.md

@@ -31,6 +31,45 @@ is sometimes cited as a 7.x removal — those methods never existed on 7.x; the
 
 ---
 
+## v10.1.0 — 2026-08-13 (the bounded-recovery and write-path-cure release)
+
+The theme: **crash recovery is bounded, restores are durably founded, and two
+production-reported write-path defects are cured at their roots.** Ships together
+with the matching native accelerator version; adopt as a pair.
+
+- **Bounded crash recovery (the fold-checkpoint bound).** Recovery after an unclean
+  shutdown now replays only the log segment above a durably-stamped checkpoint
+  instead of the whole log. The checkpoint advances only after a canonical-sync
+  barrier makes every touched record durable (deletes included), so the bound can
+  lag but can never overstate durability. Existing stores converge automatically at
+  their first recovery — zero operator steps; recovery cost stops scaling with
+  store age.
+- **Restores are unclean events, by construction.** `restore()` now runs its swap
+  fully quiesced (no background flush can race the directory replacement — a
+  consumer-reported `ENOTEMPTY` crash class is dead), and a snapshot's durability
+  stamps never survive the restore: the reopen folds the restored log, re-syncs
+  what it re-applied, and stamps fresh. Restored state is durably founded at
+  restore time instead of inheriting assertions about bytes the disk never synced.
+- **Write-path cures from a production report.** (1) Log pad-frame construction is
+  total — a size-class boundary hole could previously kill a sync with "pad frame
+  not constructible". (2) The at-ack sync-failure compensation now splits by phase:
+  the generation counter can never re-mint a number the log may already carry, so
+  the non-monotonic append refusal loop reported by a downstream deployment cannot
+  recur. Both pinned with the reporter's exact shapes.
+- **Operator-truthful sparse queries.** `where` on a field no store row has ever
+  carried now serves the honest answer (`eq`/`in`/range → empty; `ne`/`exists:false`
+  → all rows; `exists:true` → empty) with a throttled did-you-mean warning, instead
+  of refusing. `orderBy` on unknown fields and ambiguous spellings keep their typed
+  refusals.
+- **Cross-package error identity.** `UnresolvableFieldError` thrown across package
+  boundaries is re-normalized so `instanceof` checks in consuming applications
+  match regardless of duplicated dependency trees.
+- Release tooling: publishes now push the tag before the branch (the publish
+  workflow can no longer queue behind a redundant CI run) and verify registry
+  byte-identity with a propagation-tolerant raw-registry probe.
+
+---
+
 ## v10.0.0 — 2026-08-10 (the write-path and lifecycle release)
 
 The theme: **writes ack fast and honestly, startup adopts instead of rebuilding, and