diff --git a/CHANGELOG.md b/CHANGELOG.md
index 527a928..d79b330 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,15 +8,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.9.0] - 2026-10-29
+## [0.10.0] - 2026-10-29
 
-The wire 1.0 release, for the fleet's flag day (19 Oct 2026, 18:03 UTC): from
-then on every live station speaks wire 1.0 (macula 15) and nothing older, and
-0.8.2 can no longer connect. libmacula is macula-go v0.29.0, the release that
-carries the A0 contract (v0.27.0 at the flag day); this package's code is
-0.9.0-rc.6's. The entries for rc.1 to rc.6 below are what changed since 0.8.2.
+The A0 release: libmacula is macula-go v0.29.0, the release that carries the A0
+contract where 0.9.0 shipped v0.27.0, and a call a keyed provider refuses
+`sealed_required` is now resealed and answered. No wire change: this package's
+code is 0.9.0-rc.6's plus the entries below.
 
-### Changed since this entry was written
+### Changed
 
 - **A call a keyed provider refuses `sealed_required` is resealed and answered**, instead of the
   caller failing on a stale keyless candidate: the caller seals again to the key in the refusal's
@@ -40,6 +39,14 @@ carries the A0 contract (v0.27.0 at the flag day); this package's code is
   `serveStream` take the policy as a nullable parameter, and omitting it serves any caller
   (macula-php#19 for streams, macula-php#21 for unary).
 
+## [0.9.0] - 2026-10-19
+
+The wire 1.0 release, for the fleet's flag day (19 Oct 2026, 18:03 UTC): from
+then on every live station speaks wire 1.0 (macula 15) and nothing older, and
+0.8.2 can no longer connect. libmacula is macula-go v0.27.0, whose code is
+v0.27.0-rc.8's; this package's code is 0.9.0-rc.6's. The entries for rc.1 to
+rc.6 below are what changed since 0.8.2.
+
 ## [0.9.0-rc.6] - 2026-10-17
 
 ### Added
diff --git a/README.md b/README.md
index c2e533b..c64fd8a 100644
--- a/README.md
+++ b/README.md
@@ -20,10 +20,18 @@
 
 ---
 
+> **A0, 0.10.0 (2026-10-29):** over libmacula from macula-go v0.29.0. A call a
+> keyed provider refuses `sealed_required` is now resealed to the key that
+> refusal carries and answered, instead of failing on a stale keyless candidate.
+> Sealing is still the default only where the provider names a KEM key, and a
+> procedure served with no policy is still open; refusing a clear call unless the
+> caller opts out is not in this release. A default
+> `composer require macula-io/macula-php` resolves 0.10.0.
+>
 > **Wire 1.0, 0.9.0 (2026-10-19):** it speaks wire 1.0 (macula 15) and nothing
 > older, so it reaches only a wire 1.0 station. The fleet moved to wire 1.0 on 19 Oct 2026 at 18:03 UTC, and from then on 0.8.2 and everything before it
 > can no longer connect. A default `composer require macula-io/macula-php`
-> resolves 0.9.0.
+> resolves 0.9.0 until 0.10.0.
 >
 > **Status, 2026-10-14:** over macula-go's **released** libmacula (the tag in
 > `abi/MACULA_GO_REF`, ABI 1), so on wire 1.0 (macula 15): handshake v5 bound to