diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c3a3407..884be2df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,10 @@ under [1.0.0](#100---2026-09-20) before upgrading.
 
 ## [Unreleased]
 
+## [2.0.1] - 2026-10-16
+
+Patch release for the 2.0 line. The public API and native ABI are unchanged from 2.0.0.
+
 ### Security
 
 - Pin repository builds to .NET SDK 10.0.402, which selects the patched .NET 10.0.13 runtime and Native AOT packs.
@@ -29,6 +33,25 @@ under [1.0.0](#100---2026-09-20) before upgrading.
   verification preserves that top. Refusal releases the operation admission without resetting or retrying the state.
   These guards contain invalid provider state; they do not establish the cause or resolution of a live host failure.
 
+### Qualification waivers
+
+This release carries managed and native-fixture evidence (C1/C2), with no new exact-host or multi-plugin
+qualification (C3/C4). The following release-gate scenarios remain limited to the evidence described in the repository:
+
+- Q02: bootstrap initialization has managed and host-emulator checks; the exact Cheat Engine loader is not requalified.
+- Q03: exports-table validation has managed checks; the exact host's version/table-size handshake is not requalified.
+- Q04: the second bootstrap integer is recorded as a raw observation; no new exact-host meaning is asserted.
+- Q05: plugin identity and lifecycle epochs have managed checks; exact-host behavior, including non-ASCII names,
+  is not requalified.
+- Q06: startup-failure cleanup has managed checks; exact-host failure recovery is not requalified.
+- Q07: lifecycle reentrancy has managed checks; an exact-host disable during active work is not requalified.
+- Q08: disable-failure cleanup has managed checks; exact-host cleanup under injected faults is not requalified.
+- Q09: native hostfxr emulator results are C2 evidence; shared-state isolation under Cheat Engine is not established.
+- Q10: exact-host multi-plugin coexistence and teardown remain unqualified.
+- Q40: clean package-consumer checks are C1/C2 evidence; the exact-host deployment path is not requalified.
+- Q41: Native AOT publish/export probes are C0/C2 evidence; a Native AOT library remains unsupported as a classic
+  Cheat Engine plugin.
+
 ## [2.0.0] - 2026-09-24
 
 Every pack is validated against the published 1.0.0 package, and each intentional break is declared in
@@ -182,5 +205,6 @@ Every pack is validated against the published 1.0.0 package, and each intentiona
 - The earlier project-specific exception hierarchy.
 - The NLog dependency.
 
+[2.0.1]: https://github.com/CheatEngineNet/CheatEngine.SDK/releases/tag/v2.0.1
 [2.0.0]: https://github.com/CheatEngineNet/CheatEngine.SDK/releases/tag/v2.0.0
 [1.0.0]: https://github.com/CheatEngineNet/CheatEngine.SDK/releases/tag/v1.0.0
diff --git a/RELEASING.md b/RELEASING.md
index bba2d271..f336a205 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -3,11 +3,11 @@
 NuGet releases are produced by `.github/workflows/release.yml` from version tags. This document describes the chain,
 how to prepare and publish a release, and how anyone can verify one afterwards.
 
-> **Current state.** The last published version is 1.0.0, released before this chain existed: its GitHub release carries
-> the nupkg only (no SBOM or checksums) and is not immutable. The 2.0 line has not been released. There is no automated
-> qualification gate: before tagging a stable release, the maintainer confirms against the audit's Q02-Q10, Q40 and Q41
-> register (analyses/20 of the audit dossier) that the release is not claiming host qualification it has not earned, and
-> records any open row as a known limitation in the release notes.
+> **Release evidence.** The 2.0 line uses this release chain. The older 1.0.0 release predates it: its GitHub release
+> carries the nupkg only (no SBOM or checksums) and is not immutable. There is no automated qualification gate: before
+> tagging a stable release, the maintainer confirms against the audit's Q02-Q10, Q40 and Q41 register (analyses/20 of
+> the audit dossier) that the release is not claiming host qualification it has not earned, and records any open row
+> as a known limitation in the release notes.
 
 ## Overview
 
diff --git a/tests/CheatEngine.SDK.Lua.Tests/Callbacks/LuaHostSubscriptionTests.cs b/tests/CheatEngine.SDK.Lua.Tests/Callbacks/LuaHostSubscriptionTests.cs
index 1ea1b1f9..b493dbd3 100644
--- a/tests/CheatEngine.SDK.Lua.Tests/Callbacks/LuaHostSubscriptionTests.cs
+++ b/tests/CheatEngine.SDK.Lua.Tests/Callbacks/LuaHostSubscriptionTests.cs
@@ -219,7 +219,8 @@ public async Task Disable_admission_waits_for_an_entered_callback_and_rejects_a_
 			return releaseState => unregisters++;
 		}, out LuaHostSubscription? subscription));
 		Assert.NotNull(subscription);
-		LuaHostSubscriptionRegistry.CallbackAdmissionClosedForTesting = admissionClosed.Set;
+		// The registry seam closes registrations before it closes this subscription's callback admission.
+		LuaHostSubscription.CallbackDrainStartedForTesting = admissionClosed.Set;
 
 		try
 		{
@@ -240,6 +241,7 @@ public async Task Disable_admission_waits_for_an_entered_callback_and_rejects_a_
 			allowReturn.Set();
 			await enteredCall.WaitAsync(TimeSpan.FromSeconds(5), cancellationToken);
 			await close.WaitAsync(TimeSpan.FromSeconds(5), cancellationToken);
+			Assert.Null(subscription.LastCallbackException);
 
 			LuaRuntime.Detach();
 			Assert.Equal(1, unregisters);
@@ -247,7 +249,7 @@ public async Task Disable_admission_waits_for_an_entered_callback_and_rejects_a_
 		}
 		finally
 		{
-			LuaHostSubscriptionRegistry.CallbackAdmissionClosedForTesting = null;
+			LuaHostSubscription.CallbackDrainStartedForTesting = null;
 			allowReturn.Set();
 		}
 	}