docs(release): release model usage + recorded M3 drills (#13)

- README: Release model section (package/activate/rollback/status,
  pointer + append-only log, gate-then-flip guarantee)
- BUILD-LOG Phase 7: drills recorded (update, refusal, rollback),
  two harness/product corrections documented

Drill evidence: 0.0.3 -> 0.0.4 update with unchanged config checksum and
green verify; fault-injected refusal left pointer untouched; health-gated
rollback restored 0.0.3; full append-only event history.

Closes #13

README.md

@@ -83,6 +83,24 @@ scripts/test-task.sh                                   # selftests (schema negat
 
 A run exits 0 only when its expectation is met (`expectExact` match); mismatches, nonzero agent exits, and timeouts record `status: failed` in `result.json` and exit 1. Each run gets a unique directory — rerunning never rewrites history.
 
+## Release model (M3)
+
+`RELEASE` single-sources the release version (0.0.X until declared stable); the image tag derives from it plus the pinned Pi version. Activation is health-gated and every event is recorded:
+
+```bash
+scripts/release.sh package                    # build + tag the release image
+scripts/release.sh activate                   # health check (exact marker) -> atomic pointer swap
+scripts/release.sh activate --fault-injection # prove the refusal path (drills only)
+scripts/release.sh rollback                   # health-gated return to the previous release
+scripts/release.sh status                     # release, tag, active pointer, recent log
+scripts/test-release.sh                       # release selftests
+```
+
+- `<dataRoot>/state/active.json` — the activation pointer (atomic tmp+rename replace)
+- `<dataRoot>/state/activation-log.jsonl` — append-only history: package / activate / refused / rollback
+
+A failed health check never activates; the previously active release remains deployed. Updating the software therefore cannot corrupt the running installation: package beside, gate, then flip. Verified by the update/refusal/rollback drills in BUILD-LOG Phase 7.
+
 See `docs/plans/2026-09-02_atomic-mosaic-foundation.md` for the full plan.
 
 Inside the container:
@@ -95,7 +113,8 @@ Inside the container:
 
 ## How it works
 
-1. `scripts/build.sh` builds `mosaic-poc-agent:0.84.4` with Docker Compose.
+1. `scripts/build.sh` builds the release image (`mosaic-poc-agent:<pi>-r<release>`,
+   tag derived from `RELEASE` + the pinned Pi version) with Docker Compose.
 2. On each run, `/opt/mosaic/src/load-contracts.sh` reads the four contract files
    in fixed order (CONSTITUTION, STANDARDS, SOUL, USER), joins them with clear
    separators, and writes `/var/lib/mosaic/system-prompt.md`.
@@ -116,8 +135,10 @@ scripts/build.sh       # build the image
 scripts/hello.sh       # one-shot request; prints the model response
 scripts/verify.sh      # full gated test; exit 0 only on exact MOSAIC_HELLO_OK
 scripts/run-task.sh    # run a mission/task file (see Missions & tasks)
+scripts/release.sh     # package / activate / rollback / status (see Release model)
 scripts/test-config.sh # fast config-layer selftests (no Docker)
 scripts/test-task.sh   # mission/task selftests (schema + live runs)
+scripts/test-release.sh # release selftests
 scripts/reset.sh       # delete the configured data root (safety-checked)
 ```