release: stage v1.0.3 — the resolver fix, ready to tag

The FT-MR11 fix has been on main since 823533e but is NOT on npm: the version
was never bumped, so Release (which triggers on `push: tags: v*` and verifies
the tag against packages/cli/package.json) never had a tag to fire on. The green
runs since that merge were CI, not a publish. Until this ships, every session
still loads the 1.0.2 binary and still gets the doubled `memory/memory/` paths.

Bumps packages/cli to 1.0.3 — the only package Release publishes — and carves
the two FT-MR11 entries out of [Unreleased] into a dated [1.0.3] section. The
rest of [Unreleased] is left alone: it narrates the monorepo consolidation that
already shipped as 1.0.0, and re-dating someone else's section is not this
change's business. Worth noting the CHANGELOG has never carried a released
version heading despite three releases; [1.0.3] is the first.

To ship (both steps are yours — a registry push is not mine to make):
  git tag -a v1.0.3 -m "loadout-os v1.0.3 - FT-MR11 resolver fix"
  git push origin v1.0.3

Release then builds, bundles the CLI, tests, npm-packs dry-run, publishes with
OIDC provenance, and cuts the GitHub Release.

@mcptoolshop/claude-memories carries the same source fix and is NOT republished
by this workflow, which only publishes -w packages/cli. The CLI bundle is what
the UserPromptSubmit hook loads, so shipping this is what repairs live sessions;
the standalone memories package stays on its old version until someone needs it.

Verify: 383 tests across all four packages, 0 fail, exit 0.
Identity scan: RESULT CLEAN.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mcp-tool-shop

CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.3] - 2026-09-07
+
+### Fixed
+
+- **Index entries recorded the raw pointer instead of the resolved file** (FT-MR11) —
+  `generateIndex` resolved each MEMORY.md reference correctly (trying the store dir,
+  then its parent) and then discarded the result, storing `ref.path` verbatim. The
+  store's own convention writes pointers as `memory/foo.md`, where `memory/` is a
+  namespace label for the store rather than a subdirectory of it, so `refresh`'s
+  `rewritePathsAbsolute` re-applied the prefix and emitted a doubled
+  `…/memory/memory/foo.md`. On the canonical store that left **420 of 492 published
+  entries (85%) pointing at files that do not exist** — and because the
+  UserPromptSubmit hook reads that published index on every prompt, every session was
+  silently handed dead paths and fell back to paraphrasing one-line summaries, which
+  is precisely what the store's own rule forbids. Entries now record the location that
+  actually resolved, relative to the store root with POSIX separators, so both store
+  layouts resolve. Live index went 72/492 → **492/492**. Regression fixture
+  `fixtures/flat-store/` pins the shape the original fixture never exercised: the
+  previous fixture put MEMORY.md *above* its `memory/` directory, so every ref
+  matched on the first base and the parent-base fallback was never under test.
+- **`DEFAULT_STORE` hardcoded one machine's home directory** — the shipped default
+  store path was an absolute literal containing a username, so it resolved on exactly
+  one computer and leaked that username into a public package. It is now derived from
+  `homedir()`, matching `defaultDest()` directly below it.
+
 ## [Unreleased]
 
 The consolidation of the Knowledge OS into a single npm-workspaces monorepo with one
@@ -45,27 +70,6 @@ ship together under `loadout-os`.
 
 ### Fixed
 
-- **Index entries recorded the raw pointer instead of the resolved file** (FT-MR11) —
-  `generateIndex` resolved each MEMORY.md reference correctly (trying the store dir,
-  then its parent) and then discarded the result, storing `ref.path` verbatim. The
-  store's own convention writes pointers as `memory/foo.md`, where `memory/` is a
-  namespace label for the store rather than a subdirectory of it, so `refresh`'s
-  `rewritePathsAbsolute` re-applied the prefix and emitted a doubled
-  `…/memory/memory/foo.md`. On the canonical store that left **420 of 492 published
-  entries (85%) pointing at files that do not exist** — and because the
-  UserPromptSubmit hook reads that published index on every prompt, every session was
-  silently handed dead paths and fell back to paraphrasing one-line summaries, which
-  is precisely what the store's own rule forbids. Entries now record the location that
-  actually resolved, relative to the store root with POSIX separators, so both store
-  layouts resolve. Live index went 72/492 → **492/492**. Regression fixture
-  `fixtures/flat-store/` pins the shape the original fixture never exercised: the
-  previous fixture put MEMORY.md *above* its `memory/` directory, so every ref
-  matched on the first base and the parent-base fallback was never under test.
-- **`DEFAULT_STORE` hardcoded one machine's home directory** — the shipped default
-  store path was an absolute literal containing a username, so it resolved on exactly
-  one computer and leaked that username into a public package. It is now derived from
-  `homedir()`, matching `defaultDest()` directly below it.
-
 - **Matcher recall** (FT-K1) — domain entries were scored by pure coverage
   (`matched / declared keyword count`), which starved keyword-rich entries: a genuine
   2–3 keyword match on the live 30+-keyword entries scored below the 0.1 inclusion floor.

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcptoolshop/loadout-os",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Unified Knowledge OS CLI — wraps ai-loadout (kernel) + claude-memories + claude-rules and absorbs the operational rituals (doctor, report, refresh) into one loadout-os binary.",
   "license": "MIT",
   "author": "mcp-tool-shop",