diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff940e3..7b750e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ actually cutting it, and this file starts there.
 
 ## Unreleased
 
+## 0.2.0 — 2026-07-21
+
 ### Added
 
 - CI refuses a release PR with no drill record at `drills/<version>.md`
diff --git a/drills/0.2.0.md b/drills/0.2.0.md
new file mode 100644
index 0000000..9c70f7f
--- /dev/null
+++ b/drills/0.2.0.md
@@ -0,0 +1,62 @@
+# cast 0.2.0 — release drill
+
+**WAIVED. No drill was run for this release.**
+
+Waived by the maintainer (@danmt) on 2026-07-21. This file exists because the
+gate requires a *record*, not a passing result — so a skip is a line in a diff
+somebody reviewed, rather than a silence nobody notices.
+
+## Why
+
+The drill harness is not in a state to produce a trustworthy run, and cast is
+the least automated of the three: **cast has no drill harness of its own**, and
+its legs are the heaviest to stand up. The A→B promotion path needs two live
+Coolify instances, working credentials, an age store and a registered GitHub
+App. In the 2026-07-19 drill, instance B had to be built from a hand-written
+compose file.
+
+A run improvised under those conditions produces numbers nobody should rely on,
+and `drills/` is worth nothing if it fills with records like that.
+
+Deferred deliberately, and tracked: #142.
+
+## What this release therefore does NOT prove
+
+Stated plainly so it is not rediscovered as a surprise:
+
+- **The A→B promotion path** against two genuinely live instances: `team`,
+  `apply`, an idempotent re-diff, `smoke` (the bulk-upsert contract),
+  `inventory`, `emit-draft`, `fleet --all`, `destroy` behind its typed gate with
+  the orphan preserved, and the read-only guard refusing.
+- **The two headline features of this release under real use.** Declarative
+  HTTP basic auth (#76) writes to a live Coolify and is only partly readable
+  back — the password is deliberately never compared, so a drill is the only
+  place the write is observed end to end. And `cast github-app create` (#7) runs
+  GitHub's App Manifest flow, whose `redirect_url` on `127.0.0.1` is documented
+  in that PR as **unvalidated and load-bearing** — no automated test covers it,
+  and this release does not either.
+- **The `### Removed` breaking change in practice** — `scripts/register-github-app.sh`
+  is gone; the replacement path is exercised only by unit tests.
+
+## What CI did prove on this tree
+
+Not nothing, and worth recording so the gap is precise rather than total:
+
+| Job | Result |
+|---|---|
+| `install` — real `install.sh` against throwaway roots | pass |
+| `scope` | pass |
+| `reconcile` | pass |
+| `npm test` | 784 passed, 0 failed (39 files) |
+| `npm run check` (biome, `--error-on-warnings`) | clean |
+| `npm run build` (tsc) | clean |
+| `shellcheck-all.sh` | clean |
+
+The command surface, the schema and the installer are covered. Nothing that
+requires a live Coolify is.
+
+## The commitment
+
+The next release carries a real drill record at `drills/<version>.md` — what
+ran, on what host, the pinned refs and SHAs, the numbers, and what failed. A
+failed drill is a valid record; another waiver is not. Tracked in #142.
diff --git a/package-lock.json b/package-lock.json
index bd7a86e..32c66e0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "cast",
-  "version": "0.1.2-dev",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cast",
-      "version": "0.1.2-dev",
+      "version": "0.2.0",
       "dependencies": {
         "yaml": "^2.5.0",
         "zod": "^3.25.76"
diff --git a/package.json b/package.json
index 64da5ea..cf61874 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cast",
-  "version": "0.1.2-dev",
+  "version": "0.2.0",
   "type": "module",
   "private": true,
   "engines": {