docs: document the storage format and record M3 results; bump to 0.3.0v0.3.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 24 insertions, 0 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0cee853..c4a7737 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,30 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-19
+
+Milestone M3: storage, keys and PIN logic. Nothing user-visible yet; the
+screens come with M4.
+
+### Added
+
+- Storage (`source/storage/`): the vault (ordered entries, add, update, move,
+  remove, HOTP counter), the deterministic TLV codec, the record format (readable
+  header plus an encrypt-then-MAC box bound to the entry ID), the device key and
+  the PIN-wrapped master key, resumable PIN derivation, the wrong-PIN lockout
+  (trusted clock with an uptime fallback, optional erase after 10 failures), the
+  session with auto-lock and key wiping, the pending queue for locked entries,
+  schema migrations, the 150-entry cap and clean store-full errors.
+- `Bytes.toUtf8` with strict UTF-8 validation.
+- `docs/SECURITY.md`: the stored byte formats and what each protection is
+  tested by.
+- 34 Monkey C tests (65 in total per device) and storage benchmarks.
+
+### Changed
+
+- The PIN wrap and the lockout state are stored under their own keys (`w`,
+  `lk`) instead of inside the metadata (README 6.2 updated).
+
 ## [0.2.0] - 2026-10-18
 
 Milestones M1 (prepared; your phone test pending) and M2: crypto and OTP core.