docs(releases): the 10.3.0 consumer entry — the trust-and-provenance release

RELEASES.md

@@ -31,6 +31,41 @@ is sometimes cited as a 7.x removal — those methods never existed on 7.x; the
 
 ---
 
+## v10.3.0 — 2026-08-18 (the trust-and-provenance release)
+
+Four consumer-driven cures. Pairs with the same native accelerator line
+(>=4.1.0); adopt alongside the accelerator's 4.2.0 for its paired fixes.
+
+- **Writer-lock fencing.** A live writer is never auto-evicted (staleness now
+  requires the holding process to be dead — a >60s stall is a slow writer, not
+  a dead one); the lock claim is atomic (no empty-file window a racer can
+  misread as torn); and every flush commit and transact barrier verifies lock
+  ownership first, so a forced-out or lock-deleted writer fails typed
+  (`BRAINY_WRITER_FENCED`) instead of writing on unaware — the split-brain
+  class a shared dev store hit is dead at all three roots. The documented
+  same-process re-open ("warn and take over") stays benign: ownership is
+  per-process. Consumers that raised stop-timeouts as mitigation can retire
+  them.
+- **Transaction-log provenance.** `TxLogEntry` gains an optional `origin`
+  field — absent means a user write (existing consumers unchanged);
+  engine-originated commits stamp themselves (`system:embed-landing`,
+  `system:adoption-backfill`, `system:reconcile`), and the same stamp rides
+  the commit fact's meta. Activity feeds filter on fact instead of guessing;
+  a reported "double tick" (the deferred vector landing indistinguishable from
+  a user save) is cured without collapsing genuine rapid saves.
+- **The attested reconcile door.** `reconcileLogDivergence(id, {attest})`
+  resolves the one adoption-refusing divergence class
+  (`log-live-canonical-absent`) with a human's word: `'deleted'` mints the
+  tombstone the log always lacked; `'restore'` folds the log's only copy back
+  into canonical; wrong-class calls refuse typed with nothing written. Loud,
+  narrated, single-row.
+- **Iron-honest test budgets.** The wall-clock micro-budgets are recalibrated
+  as order-of-magnitude guards (3x the worst measurement across three machine
+  classes) so honest hardware differences can never again read as failures;
+  real performance enforcement lives in the dedicated perf lanes.
+
+---
+
 ## v10.2.0 — 2026-08-17 (adoption completes in one call)
 
 One fix, headline-sized for large stores. Pairs with the same native accelerator