diff --git a/docs/release-notes/v0.2.10.md b/docs/release-notes/v0.2.10.md
new file mode 100644
index 0000000..8b9b014
--- /dev/null
+++ b/docs/release-notes/v0.2.10.md
@@ -0,0 +1,76 @@
+# TiDB Cloud CLI v0.2.10
+
+This release adds the Azure Central US TiDB Cloud Filesystem placement, makes Filesystem-only placements fail closed for TiDB Cloud Starter commands, and fixes two Filesystem data-plane bugs. It is validated against the published Drive9 companion build `d39a6d1`.
+
+## What's new
+
+- TiDB Cloud Filesystem now includes the built-in `azure-centralus` placement (`https://azure-centralus.drive9.ai`). `ti configure`, `--region`, the installers, and telemetry accept the code. [ti #76](https://github.com/tidbcloud/ti-cli/pull/76)
+- `azure-centralus` is a Filesystem-only placement. `ti fs` commands route to the Azure endpoint, while `ti db` commands reject the placement during local validation with `placement "azure-centralus" serves TiDB Cloud Filesystem only, not TiDB Cloud Starter` instead of sending an unsupported region to the TiDB Cloud Starter API.
+- `gcp-us-east1` now follows the same Filesystem-only rule. `ti db` commands fail locally for `gcp-us-east1` instead of sending `regions/gcp-us-east1` to the Starter API. Filesystem usage of `gcp-us-east1` is unchanged, and it remains a valid value for `ti configure`, `--region`, and stored Filesystem credentials.
+
+Both placements stay available for Filesystem commands and local configuration; only TiDB Cloud Starter placement validation rejects them.
+
+## Bug fixes
+
+- `ti fs copy-file` no longer replaces an existing remote destination unless `--overwrite` is explicit. Uploads from a local path or stdin probe the destination first and fail with `fs.target_exists`, matching the direct copy path. `--overwrite`, `--append`, and `--resume` keep their documented behavior. [ti #74](https://github.com/tidbcloud/ti-cli/pull/74)
+- `ti fs list-files`, `ti fs find-files`, and `ti fs search-file-content` keep spaces in names and paths. Companion output was parsed by splitting on whitespace, so a file named `alpha beta.txt` was reported as `alpha` and paths with spaces were truncated. [ti #75](https://github.com/tidbcloud/ti-cli/pull/75)
+
+## Upgrade from v0.2.9
+
+Drain FUSE mounts and unmount all active Filesystem and Vault mounts before replacing the binaries. On macOS or Linux with a ti-owned installation, run:
+
+```bash
+ti update --check
+ti update --target-version v0.2.10
+ti --version
+"$(dirname "$(command -v ti)")/ti-drive9" version
+```
+
+New installations and reinstalls can use the version-specific installer:
+
+```bash
+curl -fsSL https://github.com/tidbcloud/ti-cli/releases/download/v0.2.10/install.sh | sh -s -- --version v0.2.10 --yes
+export PATH="$HOME/.ti/bin:$PATH"
+ti --version
+"$HOME/.ti/bin/ti-drive9" version
+```
+
+For a custom installation directory, pass `--install-dir` with that directory. On Windows, rerun the PowerShell installer because in-place self-update is unsupported:
+
+```powershell
+$script = "$env:TEMP\install-ti.ps1"
+iwr https://github.com/tidbcloud/ti-cli/releases/download/v0.2.10/install.ps1 -OutFile $script
+powershell -ExecutionPolicy Bypass -File $script -Version v0.2.10 -Yes
+$env:Path = "$HOME\.ti\bin;$env:Path"
+ti --version
+& "$HOME\.ti\bin\ti-drive9.exe" version
+```
+
+The companion is downloaded separately from mutable Drive9 endpoints and is not pinned to the ti version. Record both installed versions when reporting an issue. Pinning or rolling back ti does not pin or roll back Drive9.
+
+## Use the Azure Central US Filesystem region
+
+```bash
+ti configure --non-interactive --region-code azure-centralus \
+  --tidb-cloud-public-key "$TIDB_CLOUD_PUBLIC_KEY" \
+  --tidb-cloud-private-key "$TIDB_CLOUD_PRIVATE_KEY"
+
+ti --region azure-centralus fs list-file-systems
+```
+
+## Drive9 companion
+
+The companion is downloaded separately from mutable Drive9 endpoints and is not pinned to the ti version. This release was prepared against the published build `d39a6d1` (`git_hash d39a6d1b3ba1d3e23fc75b8d530259c861855702`, built 2026-10-08). Recheck the endpoints before publishing, because these artifacts can change:
+
+| Artifact | SHA-256 |
+| --- | --- |
+| `drive9-darwin-amd64` | `5f33ba5937eb4771fb9109529706413f4bb3c501f4f673e0be9a8b5a0874f811` |
+| `drive9-darwin-arm64` | `84c53cf948eb7a1b5cd8aeb2484bbcf4d81018b0fcbe5b7ffa4d55a39e2eb1c1` |
+| `drive9-linux-amd64` | `e8b8c7245c46e855fd37eaf6e05386d6fc492b51ecc4b40686ffd81de304378d` |
+| `drive9-linux-arm64` | `275c83194cd28ed75b2b4d1a9071df8ca86583a03248322f4567579710235e28` |
+| `drive9-windows-amd64.exe` | `e2df1caec1b806f26096bf9763d4f87209708772eb23a262e5041823a603a7f9` |
+
+`https://releases.drive9.ai/latest/SHA256SUMS` and `https://drive9.ai/releases/checksums.txt` agree on these five ti targets, and both `version` files report `d39a6d1`. The checksum-verified `drive9-linux-amd64` download exposes the required surface: `drive9 fs layer` includes `fork`, `chain`, and `delete`, and `drive9 mount` accepts `-layer` and `-checkpoint`.
+
+Upgrading to v0.2.10 refreshes the companion through the installer or `ti update`, which validates the companion and its required capabilities before replacing anything. Users already on v0.2.9 cannot refresh the companion alone, because `ti update` stops when the ti version is unchanged; this patch release provides the normal update path. `d39a6d1` identifies the upstream build used for release preparation, not a dependency pin. Pinning or rolling back ti does not pin or roll back Drive9.
+