diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2caaf57..0430d57 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,13 @@ mark the stability commitment.
 > This repo holds three independently versioned Go modules; entries are tagged
 > by module. Untagged entries belong to the core `secmem` module.
 
+## [0.2.0] - 2026-07-19
+
+A bug-fix release for the core `secmem` module, and the reason to upgrade
+promptly: v0.1.0 could **crash the process** on a documented API sequence.
+`ErrReadOnly` is the only API addition, so the change is backward compatible
+(confirmed by `gorelease`).
+
 ### Fixed
 
 - **Read-only buffers and arenas no longer fault the process on a mutating
@@ -207,7 +214,8 @@ First tagged release of the core `secmem` module.
   cover all three types, both the pointer and (where a value copy is not
   itself a `go vet` copylocks violation) a dereferenced value.
 
-[Unreleased]: https://github.com/deadpoets/secmem/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/deadpoets/secmem/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/deadpoets/secmem/compare/v0.1.0...v0.2.0
 [secmem-lint/v0.1.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-lint%2Fv0.1.0
 [secmem-crypto/v0.1.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-crypto%2Fv0.1.0
 [0.1.0]: https://github.com/deadpoets/secmem/releases/tag/v0.1.0
diff --git a/KERNELS.md b/KERNELS.md
index fa84ff4..8886a4f 100644
--- a/KERNELS.md
+++ b/KERNELS.md
@@ -28,6 +28,26 @@ security proofs beyond unit tests:
 blocked by lockdown) — i.e. the L4 path itself was exercised, not only the
 mmap+mlock (L3) fallback, whose guards and canaries every row verifies.
 
+## v0.2.0 — verified kernels
+
+Validated against `f7fdf4e`, the library tree v0.2.0 tags; the only later
+commits are docs-only (this file and the changelog), so the run reflects
+exactly the shipped code. Every row ran the full gauntlet — core,
+`secmem-crypto`, and `secmem-lint` under `-race`, `GOEXPERIMENT=runtimesecret`,
+the no-heap-escape gates, and `-asan` — plus the three counted proofs.
+
+| Date | Kernel | Arch | Environment | secretmem | Result |
+|---|---|---|---|---|---|
+| 2026-07-19 | 7.0.0-1009-azure | amd64 | Local Hyper-V VM, Ubuntu 26.04, Intel Core Ultra 7 265KF | live | PASS · 3/3 |
+| 2026-07-19 | 6.18.35-rockchip64 | arm64 | Libre Computer Renegade, RK3328 4× Cortex-A53 (in-order), Armbian | live | PASS · 3/3 |
+| 2026-07-19 | 6.17.0-1011-oracle | arm64 | OCI Ampere A1.Flex (Neoverse N1, out-of-order), Ubuntu 24.04 | live | PASS · 3/3 |
+
+The read-only fix this release centers on is exercised where it matters: the
+concurrent protection-transition stress races `ReadOnly`/`Seal` against
+mutators, and it passes under `-race` on the **in-order** Cortex-A53 as well as
+on amd64's stronger TSO ordering — the arm64 weak memory model being where a
+protection-state race would actually surface.
+
 ## v0.1.0 — verified kernels
 
 Tags `v0.1.0` (commit `2faf99c`) and `secmem-crypto/v0.1.0` (commit `06960fb`);