@@ -12,22 +12,27 @@
   Step 6). `build.zig.zon` `.zwasm` = tag pin
   `v2.4.0` (2026-08-03; zwasm's external-consumer release — nothing in
   it reaches cljw, pin hygiene only). Latest release:
-  **v1.5.1** (2026-07-17; zwasm-pin patch release on top of v1.5.0 =
-  the ADR-0174 host-class campaign + Thread lifecycle; tap carries
-  cljw 1.5.1 + zwasm). CHANGELOG is the release-history SSOT.
-- **First task on resume MUST be**: continue the 2026-08-04 audit-remediation
-  arc (`private/analysis/2026-08-04-tri-project/09_improvement_backlog.md` is
-  the ordered list). Landed so far: doc-truth + `size_claims` widened
-  (`77f690a3`), Issues/PR surface opened (`e897cbfc`), **ADR-0177**
-  capability-claim gate + ROADMAP §1.1/§1.2/§1.3/§8.1/§8.3/§10.3 amendment.
-  Next in order: **P1-2** (`data/placement.yaml` — kill or gate; it cites 3
-  scripts of which 2 do not exist, is not wired into `run_all.sh`, covers
-  49/683 vars, unchanged since 2026-05-25), **P1-5** (`category: security`
-  active rows, one sweep), **P1-4** (`clojure.core` public surface: ~60 `-`
-  internals + ~30 interface names are `ns-publics` — must land before 2.0),
-  **P1-1** (NaN-box tag space is 64/64 — ADR + F-004 question for the user),
-  then **release v1.6.0** and the distribution follow (tap + the three demo
-  repos, all still pinned to cljw v1.0.0).
+  **v1.6.0** (2026-08-04; four hang/abort fixes — ADR-0175 spawn-to-register
+  safepoint, ADR-0176 live-worker teardown, D-347 unmetered `wasm/run`, D-339
+  `run-server` head deadline — plus the opened Issues/PR surface).
+  CHANGELOG is the release-history SSOT.
+- **First task on resume MUST be**: the NaN-box tag-space surgery
+  (`private/notes/2026-08-04-nanbox-tag-space-investigation.md` has the
+  measured classification + the ADR outline). The audit's "64/64 full, needs a
+  user F-004 decision" was WRONG: 53 tags are actually NaN-boxed, 3 are
+  heap-only (`tail_node` / `hamt_map_node` / `tval` — GC-traced, never a
+  Value), and **7 are pure unused reservations** (`reader_conditional` /
+  `class` / `array_chunk` / `matcher` / `tuple` / `box` / `wasm_fn` — zero
+  references outside the enum; `Class` is a `.type_descriptor` and `Matcher`
+  is a `host_instance`). So ~10 slots are recoverable WITHOUT touching F-004.
+  Treating the reservations as binding was the Reservation-as-bias smell
+  CLAUDE.md names explicitly. Then **P1-6** (WIT↔Clojure type-mapping shared
+  spec with ClojureWit).
+  The 2026-08-04 audit-remediation arc otherwise closed: doc-truth +
+  `size_claims` widened (`77f690a3`), Issues/PR opened (`e897cbfc`),
+  ADR-0177 capability-claim gate (`92d7926d`), D-339 (`c601aa75`), ADR-0178
+  generated placement index (`4c52ebcc`), AD-057 + core-surface gate
+  (`18e9ea5f`), D-347 (`b4b5ef83`), D-343 + security triage (`6bdeeeb2`).
 - **Unreleased on main**: envelope v9 (op_var_meta — def-meta rides
   the AOT wire), computed def-meta (D-316) — incl. `:tag` uniform-eval
   (`^String`→Class, `^Foo`→name error; the bare-symbol workaround
@@ -56,9 +61,10 @@
 - **v1.5.1** is the released line; v1.5.0 was the ADR-0174 host-class campaign
   + Thread lifecycle. The v1.4.0 binary-size campaign (ADR-0172/0173) and the
   v1.3.x arc are in CHANGELOG.
-- Debug tooling: `scripts/nrepl_send.py`, `scripts/clj_diff_sweep.sh` +
-  corpora, `scripts/binary_size_report.sh` (now gates every public size claim,
-  ADR-0177), `scripts/check_capability_claims.sh` (ADR-0177).
+- Debug tooling: `nrepl_send.py`, `clj_diff_sweep.sh` + corpora,
+  `binary_size_report.sh` / `check_capability_claims.sh` (ADR-0177),
+  `gen_placement.sh` / `check_placement_status.sh` (ADR-0178),
+  `check_core_surface.sh` (AD-057).
 - nREPL is single-connection (serial accept, D-117(a)): a second client waits
   while an editor is attached — probe via a fresh server, not the editor's port.
 - **Issues and PRs are OPEN** as of 2026-08-04 (`e897cbfc`); three issue
@@ -68,29 +74,27 @@
 ## Standing units (tracked in .dev/debt.yaml)
 
 - **D-565** — external-contributor reproducibility / doc-staleness sweep
-  (fresh-clone onboarding audit, Discussion #11). Build/test/CI reproduce
-  cleanly; gaps are doc rot (`zwasm_from_scratch`→`zwasm`, dead `OSS/zig`
-  ref, missing `cleanup_orphans.sh`, README 1.0.0-vs-1.5.1, autonomous-vs-
-  maintenance mismatch) + no CONTRIBUTING opt-out notes. Companion: zwasm D-526.
+  (Discussion #11). PARTLY drained 2026-08-04: README version + CONTRIBUTING
+  opt-out notes landed with the Issues/PR opening (`e897cbfc`). Residual is
+  path rot (`zwasm_from_scratch`→`zwasm`, dead `OSS/zig` ref,
+  `cleanup_orphans.sh`). Companion: zwasm D-526.
 
 - **Perf campaign (§9.2.S) — PAUSED** (D-520 / D-386 / D-005/006).
 - **D-513** — clojure.core.reducers / clojure.repl / var :doc.
 - **D-548** — (a) DISCHARGED (ADR-0176); residual = (b) pmap
   wall-clock on the 3-vCPU runner (timing envelope, still gated).
-- CIDER upstream banner patch draft:
-  `private/notes/cider-clojurewasm-banner-patch.md` (user-side PR).
+- CIDER upstream banner patch draft (user-side PR):
+  `private/notes/cider-clojurewasm-banner-patch.md`.
 
 ## North star (ACTIVE, distal)
 
-cljw's differentiator = **Wasm/edge-native (gap II) × VM-perf
-fusion→JIT (gap III)**. zwasm JIT (ADR-0200) is the cljw default;
-remaining = components-through-the-JIT (zwasm-side, D-500). Distal —
-needs a user nod; the §9.2.T public-ization sweep (easiest-first debt
-drain) is the active near-term mode.
+cljw's differentiator = **Wasm interop (gap II) × VM-perf fusion→JIT (gap
+III)**. zwasm JIT (ADR-0200) is the cljw default; remaining =
+components-through-the-JIT (zwasm-side, D-500). Distal — needs a user nod.
+NOTE ADR-0177: "edge execution" is an AIM owned by D-552, not a capability.
 
 ## Reading order (resume)
 
-handover → `yq` the live `active:` list → ADR-0166 (public-ization
-sweep mode) → ROADMAP §9.0. Memories:
+handover → `yq` the live `active:` list → ADR-0166 → ROADMAP §9.0. Memories:
 `verify_against_releasesafe_binary` / `smoke_first_batch_full_gate` /
 `external-publish-payload-guard`.
@@ -7,6 +7,52 @@ first stable `1.0.0` tag; pre-1.0 `alpha` / `rc` tags may still change surfaces.
 
 ## [Unreleased]
 
+## [1.6.0] - 2026-08-04
+
+**Upgrade if you use threads, futures, promises, or `wasm/run`.** This
+release carries four fixes for ways cljw could hang or abort, two of them
+outstanding since 1.5.1 (2026-07-17).
+
+### Fixed
+
+- **A live worker at process exit could abort (glibc `abort`).** A
+  `future` / `promise` whose worker was still running while the runtime tore
+  down could crash the process instead of exiting. `exitBarrier` plus
+  deinit-chokepoint guards make a live worker force a daemon-style hard exit
+  rather than a teardown under its own feet. Measured: 6 failures in 32 runs
+  before, 0 in 96 after. (ADR-0176, AD-056)
+- **Thread registration was not a GC safepoint (SIGABRT on x86_64 Linux).**
+  The window between spawning a worker and registering it with the collector
+  was not a safepoint, so a collection landing in that window could abort.
+  Registration is now a safepoint, and the `TooManyThreads`
+  run-unregistered fallthrough is closed. (ADR-0175)
+- **`(wasm/run …)` ran guests unmetered — an infinite loop in a guest hung
+  the host forever.** `wasm/load` has always defaulted to a finite fuel and
+  memory budget; `wasm/run` passed no budget at all, so the two sibling
+  surfaces had opposite postures. `wasm/run` now takes the same finite
+  default. Measured: a spinning guest ran past 15s before, traps
+  `out_of_fuel` in about 1s after.
+- **`cljw.http.server` could be wedged by one unfinished request.** The
+  accept loop had no read deadline, so a client that opened a connection and
+  never completed the request head held the whole server — which binds
+  0.0.0.0 — indefinitely. A request-head deadline now bounds it. Measured: a
+  half-open connection blocked the next client for 12s before, 1s after.
+  (Note: a serial server still handles one connection at a time; this bounds
+  the wedge, it does not add concurrency.)
+- **Namespace names with an empty segment resolved.** `(require (symbol
+  "..a.b"))` could load `a.b` because the munge collapsed the doubled
+  separator. JVM Clojure refuses such names; so does cljw now. These names
+  cannot be written through the reader, so only computed namespace names are
+  affected.
+
+### Added
+
+- **`run-server` accepts `:header-timeout-ms`** — how long a connection may
+  take to deliver its request head. Default 10000; `0` disables the deadline.
+- **`wasm/run` accepts `:fuel` and `:max-memory-pages`** — the same budget
+  keys `wasm/load` already took. `0` or negative means unmetered, which is
+  how you opt a trusted command out of the new default.
+
 ### Changed
 
 - **zwasm pinned to v2.4.0** (its external-consumer release:
@@ -16,6 +62,21 @@ first stable `1.0.0` tag; pre-1.0 `alpha` / `rc` tags may still change surfaces.
   compiler-rt, and it builds at zwasm's default Wasm 3.0 level where the
   DCE guard is inert. Pin hygiene, not a behaviour follow; `-Dwasm`
   build + the phase16 wasm e2e suite verified green on the new pin.
+- **Issues and Pull Requests are open.** Reports of Clojure code that
+  behaves differently here than on the JVM are the most useful thing you can
+  file; there is an issue template for exactly that. Outside contributors are
+  explicitly not asked to follow the internal commit / ledger conventions —
+  see CONTRIBUTING.
+
+### Note for upgraders
+
+Two behaviour changes can surface in working code:
+
+1. `(wasm/run …)` is now fuel-bounded by default. A legitimately long-running
+   guest that exceeds roughly 1e9 instructions will trap; pass `{:fuel 0}` to
+   restore the previous unbounded behaviour.
+2. `(require (symbol s))` with a computed `s` containing a leading, trailing,
+   or doubled dot no longer resolves. Well-formed names are unaffected.
 
 ## [1.5.1] - 2026-07-17
 
 
@@ -1,6 +1,6 @@
 .{
     .name = .cljw,
-    .version = "1.5.1",
+    .version = "1.6.0",
     .fingerprint = 0x1869d207073beffa,
     .minimum_zig_version = "0.16.0",
     .dependencies = .{