diff --git a/CHANGELOG.md b/CHANGELOG.md
index a33e9a4a..a66a987e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,8 @@ breaking entries are marked **BREAKING**.
 
 ## [Unreleased]
 
+## [0.17.1] - 2026-09-02
+
 ### Migrating to 0.17.0
 
 - **A zero-padded time or date field in a numeric comparison now fails, and it
@@ -30,9 +32,11 @@ breaking entries are marked **BREAKING**.
   stdin stay leaf-only, refused at `build()` on a node. See
   `docs/wrapped_command.md` for the full grammar.
 - **`Filesystem::canonicalize` and `KernelBackend::canonicalize`** — a
-  defaulted, containment-checked path canonicalizer. `LocalFs` and
-  `VfsRouter` override it with `resolve_beneath`; `readlink -f` and
-  `realpath` are now thin callers instead of walking symlinks themselves.
+  defaulted path canonicalizer; the default inherits whatever containment
+  `lstat`/`read_link` already give. `LocalFs` overrides it with one
+  `resolve_beneath` call, containment-checked; `VfsRouter` delegates to the
+  owning mount. `readlink -f` and `realpath` are now thin callers instead of
+  walking symlinks themselves.
 
 ### Fixed
 - **A mount point's ancestors are navigable again** — with a backend at `/` and
@@ -2625,7 +2629,8 @@ Initial public release of **kaish** (会sh) — a predictable Bourne-like shell
 - **REPL** (`kaish-repl`) with multi-line input, completion, and history; **MCP server** (`kaish-mcp`) exposing `kaish_execute` with help resources and structured + plain-text content blocks.
 - **`KernelClient` trait** + `EmbeddedClient` for in-process embedding; topic-based help system; `kaish-wasi` `wasm32-wasip1` target.
 
-[Unreleased]: https://github.com/tobert/kaish/compare/v0.17.0...HEAD
+[Unreleased]: https://github.com/tobert/kaish/compare/v0.17.1...HEAD
+[0.17.1]: https://github.com/tobert/kaish/compare/v0.17.0...v0.17.1
 [0.17.0]: https://github.com/tobert/kaish/compare/v0.16.0...v0.17.0
 [0.16.0]: https://github.com/tobert/kaish/compare/v0.15.0...v0.16.0
 [0.15.0]: https://github.com/tobert/kaish/compare/v0.14.1...v0.15.0
diff --git a/Cargo.lock b/Cargo.lock
index 939c6d00..a2a97786 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1011,7 +1011,7 @@ dependencies = [
 
 [[package]]
 name = "kaish-client"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1027,7 +1027,7 @@ dependencies = [
 
 [[package]]
 name = "kaish-glob"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "async-trait",
  "ignore",
@@ -1039,14 +1039,14 @@ dependencies = [
 
 [[package]]
 name = "kaish-help"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "kaish-types",
 ]
 
 [[package]]
 name = "kaish-kernel"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "anyhow",
  "ariadne",
@@ -1108,7 +1108,7 @@ dependencies = [
 
 [[package]]
 name = "kaish-repl"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "anyhow",
  "chrono",
@@ -1130,7 +1130,7 @@ dependencies = [
 
 [[package]]
 name = "kaish-tool-api"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "async-trait",
  "clap",
@@ -1139,7 +1139,7 @@ dependencies = [
 
 [[package]]
 name = "kaish-tools-host"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "async-trait",
  "clap",
@@ -1150,7 +1150,7 @@ dependencies = [
 
 [[package]]
 name = "kaish-types"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "base64",
  "schemars",
@@ -1163,7 +1163,7 @@ dependencies = [
 
 [[package]]
 name = "kaish-vfs"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "async-trait",
  "getrandom 0.3.4",
@@ -1175,7 +1175,7 @@ dependencies = [
 
 [[package]]
 name = "kaish-wasi"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "kaish-kernel",
  "kaish-types",
diff --git a/Cargo.toml b/Cargo.toml
index 91ab0c89..2b75fbc8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -14,7 +14,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.17.0"
+version = "0.17.1"
 edition = "2024"
 rust-version = "1.85"
 authors = ["Amy Tobey <tobert@gmail.com>"]
diff --git a/crates/kaish-client/Cargo.toml b/crates/kaish-client/Cargo.toml
index 966a19be..09c1aa74 100644
--- a/crates/kaish-client/Cargo.toml
+++ b/crates/kaish-client/Cargo.toml
@@ -16,8 +16,8 @@ readme = "../../README.md"
 # Feature-neutral on purpose: the embedder decides the kernel's feature set
 # (kaish-web builds no-default for wasm; native hosts add localfs etc.).
 # Unification means enabling defaults here would trample that choice.
-kaish-kernel = { path = "../kaish-kernel", version = "0.17.0", default-features = false }
-kaish-types = { path = "../kaish-types", version = "0.17.0" }
+kaish-kernel = { path = "../kaish-kernel", version = "0.17.1", default-features = false }
+kaish-types = { path = "../kaish-types", version = "0.17.1" }
 
 # Async traits only — no runtime: the library spawns nothing itself, and a
 # tokio dep here would drag net/mio into wasm builds (kaish-extras).
@@ -39,7 +39,7 @@ tracing = { workspace = true }
 # this, `cargo test -p kaish-client` alone sees a no-localfs kernel while a
 # whole-workspace run gets localfs unified in by the REPL, and outcomes
 # depend on which crates happened to build.
-kaish-kernel = { path = "../kaish-kernel", version = "0.17.0", features = ["localfs"] }
+kaish-kernel = { path = "../kaish-kernel", version = "0.17.1", features = ["localfs"] }
 proptest = { workspace = true }
 tempfile = { workspace = true }
 # Tests drive the async client API; the library itself needs no runtime —
diff --git a/crates/kaish-help/Cargo.toml b/crates/kaish-help/Cargo.toml
index a4f91ccf..11a3c775 100644
--- a/crates/kaish-help/Cargo.toml
+++ b/crates/kaish-help/Cargo.toml
@@ -13,7 +13,7 @@ categories.workspace = true
 readme = "../../README.md"
 
 [dependencies]
-kaish-types = { path = "../kaish-types", version = "0.17.0" }
+kaish-types = { path = "../kaish-types", version = "0.17.1" }
 
 [lints]
 workspace = true
diff --git a/crates/kaish-kernel/Cargo.toml b/crates/kaish-kernel/Cargo.toml
index a19a188e..102b2832 100644
--- a/crates/kaish-kernel/Cargo.toml
+++ b/crates/kaish-kernel/Cargo.toml
@@ -14,11 +14,11 @@ readme = "../../README.md"
 exclude = ["tests/snapshots/"]
 
 [dependencies]
-kaish-glob = { path = "../kaish-glob", version = "0.17.0" }
-kaish-types = { path = "../kaish-types", version = "0.17.0", features = [] }
-kaish-help = { path = "../kaish-help", version = "0.17.0" }
-kaish-tool-api = { path = "../kaish-tool-api", version = "0.17.0" }
-kaish-vfs = { path = "../kaish-vfs", version = "0.17.0", features = ["memory", "overlay"] }
+kaish-glob = { path = "../kaish-glob", version = "0.17.1" }
+kaish-types = { path = "../kaish-types", version = "0.17.1", features = [] }
+kaish-help = { path = "../kaish-help", version = "0.17.1" }
+kaish-tool-api = { path = "../kaish-tool-api", version = "0.17.1" }
+kaish-vfs = { path = "../kaish-vfs", version = "0.17.1", features = ["memory", "overlay"] }
 
 # Async runtime — minimal base; `localfs` adds tokio/fs, `subprocess` adds
 # tokio/process + tokio/rt-multi-thread (see [features]).
@@ -90,7 +90,7 @@ jaq-json = { workspace = true }
 # Optional deps, each pulled in by its capability feature:
 #   kaish-tools-host → host, trash/directories → os-integration,
 #   tiktoken-rs → tokens.
-kaish-tools-host = { path = "../kaish-tools-host", version = "0.17.0", optional = true }
+kaish-tools-host = { path = "../kaish-tools-host", version = "0.17.1", optional = true }
 trash = { workspace = true, optional = true }
 directories = { workspace = true, optional = true }
 tiktoken-rs = { workspace = true, optional = true }
diff --git a/crates/kaish-repl/Cargo.toml b/crates/kaish-repl/Cargo.toml
index c2770f9e..19ecefe2 100644
--- a/crates/kaish-repl/Cargo.toml
+++ b/crates/kaish-repl/Cargo.toml
@@ -19,9 +19,9 @@ path = "src/main.rs"
 [dependencies]
 # The REPL is the full interactive human shell: it needs every capability
 # (external commands + job control, git, host introspection, tokens, trash).
-kaish-kernel = { path = "../kaish-kernel", version = "0.17.0", features = ["full"] }
-kaish-client = { path = "../kaish-client", version = "0.17.0" }
-kaish-types = { path = "../kaish-types", version = "0.17.0" }
+kaish-kernel = { path = "../kaish-kernel", version = "0.17.1", features = ["full"] }
+kaish-client = { path = "../kaish-client", version = "0.17.1" }
+kaish-types = { path = "../kaish-types", version = "0.17.1" }
 
 # Line editing
 rustyline = { workspace = true }
diff --git a/crates/kaish-tool-api/Cargo.toml b/crates/kaish-tool-api/Cargo.toml
index 9c7ed49e..4e6b8841 100644
--- a/crates/kaish-tool-api/Cargo.toml
+++ b/crates/kaish-tool-api/Cargo.toml
@@ -13,7 +13,7 @@ categories.workspace = true
 readme = "../../README.md"
 
 [dependencies]
-kaish-types = { path = "../kaish-types", version = "0.17.0", features = [] }
+kaish-types = { path = "../kaish-types", version = "0.17.1", features = [] }
 
 async-trait = { workspace = true }
 clap = { workspace = true }
diff --git a/crates/kaish-tools-host/Cargo.toml b/crates/kaish-tools-host/Cargo.toml
index dba7a3db..4cd9c86e 100644
--- a/crates/kaish-tools-host/Cargo.toml
+++ b/crates/kaish-tools-host/Cargo.toml
@@ -13,8 +13,8 @@ categories.workspace = true
 readme = "../../README.md"
 
 [dependencies]
-kaish-types = { path = "../kaish-types", version = "0.17.0", features = [] }
-kaish-tool-api = { path = "../kaish-tool-api", version = "0.17.0" }
+kaish-types = { path = "../kaish-types", version = "0.17.1", features = [] }
+kaish-tool-api = { path = "../kaish-tool-api", version = "0.17.1" }
 
 async-trait = { workspace = true }
 clap = { workspace = true }
diff --git a/crates/kaish-vfs/Cargo.toml b/crates/kaish-vfs/Cargo.toml
index 73fa4519..bbd068f9 100644
--- a/crates/kaish-vfs/Cargo.toml
+++ b/crates/kaish-vfs/Cargo.toml
@@ -13,7 +13,7 @@ categories.workspace = true
 readme = "../../README.md"
 
 [dependencies]
-kaish-types = { path = "../kaish-types", version = "0.17.0", features = [] }
+kaish-types = { path = "../kaish-types", version = "0.17.1", features = [] }
 async-trait = { workspace = true }
 # DevFs's /dev/urandom pulls from the OS CSPRNG. Pure (no tokio); works on
 # Unix/macOS/WASI.
diff --git a/docs/EMBEDDING.md b/docs/EMBEDDING.md
index 4b3b9bd4..1fc94325 100644
--- a/docs/EMBEDDING.md
+++ b/docs/EMBEDDING.md
@@ -407,9 +407,10 @@ default fails the first case rather than passing silently.
 `readlink -f` and `realpath` both resolve through `Filesystem::canonicalize`
 (and its mirror, `KernelBackend::canonicalize`): follow every symlink hop,
 fold `.` and `..` lexically. The final component may be missing when the
-caller passes `allow_missing_final: true` (GNU `readlink -f` semantics,
-which `realpath` also uses but then requires the answer to exist); a missing
-INTERMEDIATE component is always an error, whichever way that flag is set.
+caller passes `allow_missing_final: true` (GNU `readlink -f` semantics).
+`realpath` passes `false`: the final component, like every intermediate one,
+must exist. A missing INTERMEDIATE component is always an error, whichever
+way that flag is set.
 Symlink hops are capped at 40, matching Linux `MAXSYMLINKS`.
 
 The default walks component by component through `lstat`/`read_link`, so it