diff --git a/README.md b/README.md
index cdd2372..a95fe40 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,7 @@ Any other distribution is refused before anything changes.
 curl -fsSL https://raw.githubusercontent.com/STAIxBWLB/rootfiles/main/scripts/install.sh | sudo bash
 
 # a specific release
-curl -fsSL https://raw.githubusercontent.com/STAIxBWLB/rootfiles/main/scripts/install.sh | sudo bash -s -- --version v0.18.1
+curl -fsSL https://raw.githubusercontent.com/STAIxBWLB/rootfiles/main/scripts/install.sh | sudo bash -s -- --version v0.19.0
 
 # dev channel: build from source (needs Go)
 curl -fsSL https://raw.githubusercontent.com/STAIxBWLB/rootfiles/main/scripts/install.sh | sudo bash -s -- --channel dev
diff --git a/docs/releases/v0.19.0.md b/docs/releases/v0.19.0.md
new file mode 100644
index 0000000..1bbe441
--- /dev/null
+++ b/docs/releases/v0.19.0.md
@@ -0,0 +1,40 @@
+Tenant containers can be pinned to CPUs and NUMA memory nodes without a restart, commands and flags are consistent, and safety checks refuse more risky changes before they touch a host; updating a converged host changes no files and restarts no services.
+
+### New
+- `rootfiles tenant cpuset TENANT --cpus LIST --mems LIST` pins a tenant container to host CPUs and NUMA memory nodes and keeps the pinning across recreates. It updates a running container in place, without a restart; `--clear` removes the pinning. A tenant without `cpuset` in its spec is left as it is, including a pinning set by hand with `docker update`. (#130)
+- `rootfiles schedule status` reports the report timer state, its calendar and the age of the saved reports, without root. (#105)
+- `rootfiles fleet schedule enable --on-calendar EXPR` sets a validated report calendar on the selected hosts. (#105)
+
+### Improved
+- `rootfiles update --check` (and its `upgrade` alias) and `rootfiles tunnel update --check` run without root or the host lock, and exit 0 when current, 2 when an update is available and 1 when the lookup fails. (#100)
+- `rootfiles status --module` filters the module checks and the user, GPU and tunnel details. `rootfiles config init --overwrite` replaces an existing file; `--force` still works but is deprecated. (#102)
+- `ROOTFILES_YES=true` also skips the `rootfiles rollback` confirmation, as it already did for `apply` and the tunnel commands. Fleet rollouts still need an explicit `--yes`. (#102)
+- `rootfiles fleet targets` honors `--host`, `--group` and `--all`, and fleet `--dry-run` previews no longer ask for `--yes`. (#105)
+- Command help shows working examples, the current profile names and the exit codes of each report command. (#105)
+- `rootfiles tunnel setup` keeps the configured token file and VLAN settings. (#105)
+- The `dgx` profile no longer sets a tunnel VLAN address, and its `allowed_ports` lists only 80 and 443 (the SSH port is always allowed). The `gpu-server` profile no longer asks for a VLAN with an empty address. The `full` profile drops a `network` block that never enabled the firewall. (#101)
+- `rootfiles config validate` rejects `modules.cloudflared.private_network.enabled: true` without an address and names the key, where `apply` used to finish without configuring anything. (#101)
+
+### Fixed
+- `apply --tunnel-token`, `tunnel setup TOKEN`, `tunnel install TOKEN` and `user passwd --password` no longer write the token or password into new audit records or into the backup notes that `rootfiles rollback` shows. (#100, #105)
+- Fleet commands refuse native-only flags such as `--module`, `--profile`, `--config`, `--force` and `--tunnel-token`, and reject an invalid `-o` value before opening SSH. (#102)
+- GPU and tunnel commands refuse capabilities Rocky does not support before running anything, dry runs included. (#102)
+- `rootfiles backup` requires root, takes the host lock and writes an audit record; `--dry-run` still runs without root. (#102)
+- When the UFW or firewalld state cannot be read, `rootfiles check` and `rootfiles status` show it as a blocked change instead of stopping the module report, and `apply` refuses SSH port changes, UFW rules, exporter setup and tenant SSH setup instead of guessing. (#103)
+- On Rocky, `rootfiles check` and `rootfiles apply` no longer refuse an unchanged SSH port because the host has source-limited UFW rules or firewalld rich rules. Real port changes still get the firewall checks, including when the current port comes from the main sshd config. (#106)
+- `rootfiles apply --dry-run` no longer rewrites the old single-file user metadata; check reports the old layout and how to move it. User and GPU metadata are replaced atomically and kept for `rootfiles rollback`, and a corrupt GPU ledger is reported before any allocation changes. (#114)
+- `rootfiles check`, `status` and `doctor` leave the SSH runtime directories untouched. Previewed install and locale changes match what `apply` does, a failed time-sync step no longer reports success, and Docker service work is shown only when it is needed. (#114)
+- `rootfiles config init --file FILE --overwrite` always leaves the file at mode 0600 and owned by you. It refuses a symlink, a special file or a file owned by another user, and a failed write keeps the previous file. Its error messages say what to do next. (#127, #128)
+
+### Action needed
+- Update with `sudo rootfiles update` on a host, or `rootfiles fleet update --version v0.19.0` from the fleet controller. Converged hosts need no `apply` afterwards. (#131)
+- Scripts that run `rootfiles update --check` or `rootfiles tunnel update --check` must treat exit 2 as "update available" instead of expecting 0. (#100)
+- Earlier audit logs (`/var/log/rootfiles.log` or `ROOTFILES_LOG_FILE`) and backup notes under `/var/lib/rootfiles/backups` are not rewritten. Rotate any token or password passed on the command line before this release, then review and redact those files. (#100)
+- Remove native-only flags from fleet scripts and put those settings in the inventory or the remote site config. (#102)
+- A DGX host that uses the tunnel's private VLAN must set `modules.cloudflared.private_network` (`enabled`, `interface`, `address`) in a site config that extends `dgx`, then run `sudo rootfiles apply --config <that file>`. A site config with `private_network.enabled: true` and no address now fails validation: add the address, pass `--vlan-address` or set `enabled: false`. (#101)
+- When a change is blocked because the firewall state is unknown, inspect `sudo ufw status` or `sudo firewall-cmd --state`, repair it and rerun. A UFW DENY or REJECT rule blocks an SSH port change until it is reviewed, and source-limited SSH rules are not widened automatically. (#103)
+- If `<home_base>/.rootfiles` is still a file, move it aside, create `<home_base>/.rootfiles` as a root-owned directory, place the file at `<home_base>/.rootfiles/users.json` with mode 0600 and rerun. The old layout is no longer migrated automatically. (#114)
+- Replace `rootfiles backup -o/--output DIR` with `--dir DIR`; the default folder moves from `/raid/backup` to `<state dir>/system-backup`, so pass `--dir /raid/backup` to keep the old one. Replace `rootfiles user backup -o/--output FILE` with `--file FILE` and `rootfiles user add --pubkey` with `--ssh-pubkey`. The old spellings still work with a notice. Stop using `rootfiles user passwd --suffix`: it is removed in the next minor release. (#105)
+- Before downgrading a host to an older release, remove `cpuset` from its tenant specs: older releases refuse a spec with that field. The container keeps its pinning. (#130)
+
+**Full changelog**: https://github.com/STAIxBWLB/rootfiles/compare/v0.18.1...v0.19.0