diff --git a/AGENTS.md b/AGENTS.md
index fe0c7901a..63db04fc1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -184,7 +184,7 @@ Documentation corrections are not runtime fixes or artifact certification.
   `THIRD_PARTY_NOTICES.md`; do not create competing generated notice files.
 - Inspect the actual fork release assets, architecture, signatures, and
   notarization rather than inheriting upstream release claims. The current fork
-  release is **0.8.0, macOS arm64, unsigned and unnotarized**; it is not an
+  release is **0.9.0, macOS arm64, unsigned and unnotarized**; it is not an
   NVIDIA-certified distribution. Public packaging does not grant NVIDIA signing
   credentials, notarization, or privileged-helper approval. Downloading with
   `curl` grants none of these either.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a62b2f1a6..d2ff91fe8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-11-06
+
+Unsigned, unnotarized **macOS arm64 release** for this fork. Windows, Linux
+desktop and Intel Mac packages are not published. The privileged helper and
+helper-based firewall setup remain unavailable in unsigned builds. Desktop
+`0.9.0` ships service product `3.0.0`, a major version because routing to
+unpaired PAIR machines is a breaking change. A source build of this release was
+validated on two macOS arm64 machines; see
+[Next release readiness](docs/release-readiness.mdx) for what was and was not
+exercised, and the [release notes](https://github.com/JaredP94/Personal-AI-Router/releases/tag/v0.9.0)
+for limitations.
+
 **Upgrade notes:** **Breaking:** A PAIR peer counts for routing, identity, models,
 telemetry and workloads only after proving itself over its pinned cluster
 connection. A PAIR machine added by address that is not in your cluster shows
diff --git a/README.md b/README.md
index 9c3c9eaed..9f086de6a 100644
--- a/README.md
+++ b/README.md
@@ -90,6 +90,18 @@ This project exists as a forward-looking extension that introduces practical fea
 12. **Aligned Metrics Layout (0.8.0)**
    - Node cards, job cards and the performance legend show their metrics as aligned key/value groups. Each group names its window once ("Last 60 s", "Since broker start", "This request", "Engine total", "Engine average"), the per-model breakdown is a table, values use tabular figures, and an unreported value reads as a muted dash. Legend rows are buttons, so soloing a series works from the keyboard.
 
+13. **Verified Peers and Saved Machines (0.9.0)**
+   - **Breaking:** a PAIR peer counts for routing, models, telemetry and workloads only after proving itself over its pinned cluster connection. A machine that is not in your cluster shows "Not in your cluster" with a **Pair** action. Upgrade every machine; older peers appear unverified until upgraded.
+   - Add a machine by IP address or hostname (for example over Tailscale) as a **PAIR machine**, which is saved and paired, or as **Engine only**, which uses that engine directly without trusting any PAIR claims. Saved entries keep their kind across restarts.
+
+14. **Engine Settings, Load Options and Download Control (0.9.0)**
+   - Each engine has a Settings panel for its ports, launch arguments and environment variables (for example `OLLAMA_*`), on this device and on verified peers. Changes that would override PAIR's bind address are rejected, and a failed apply restores the previous settings. oMLX shows only its proxy port.
+   - LM Studio models can keep per-model load options (context length, GPU offload, parallelism and other allowlisted tuning options), applied every time PAIR loads them.
+   - Ollama and LM Studio downloads show live progress and can be cancelled; cancelling keeps partial data so the download can resume, and an interrupted download can be retried.
+
+15. **Anthropic Messages API (0.9.0)**
+   - `/v1/messages` routes through every proxy to engines that serve it natively (Ollama 0.14.0+, LM Studio 0.4.1+, oMLX 0.1.0+), so clients such as Claude Code can use PAIR.
+
 ## What is supported
 
 | | |
@@ -122,7 +134,7 @@ with no desktop — but neither is the ordinary way in. Those are covered in
 
 Download PAIR from this fork's
 [GitHub releases page](https://github.com/JaredP94/Personal-AI-Router/releases).
-The latest published build is **`0.8.0` (2026-11-02), an unsigned,
+The latest published build is **`0.9.0` (2026-11-06), an unsigned,
 unnotarized macOS Apple Silicon release**, not an NVIDIA-signed release.
 Earlier releases and candidates remain available on the releases page.
 It includes an arm64 DMG, application ZIP, service-binary ZIP, updater metadata,
@@ -130,7 +142,7 @@ and `SHA256SUMS`; it does not include Windows, Linux, or Intel Mac installers.
 Its privileged helper and automatic helper-based firewall setup are unavailable.
 Automatic updater installation is not certified for this unsigned release;
 use the Terminal installer or a manual replacement. Read its
-[release notes and limitations](https://github.com/JaredP94/Personal-AI-Router/releases/tag/v0.8.0).
+[release notes and limitations](https://github.com/JaredP94/Personal-AI-Router/releases/tag/v0.9.0).
 It is marked as GitHub's Latest release for the Terminal installer and in-app
 update discovery.
 
@@ -139,8 +151,8 @@ Upstream official releases are separate and available at
 Windows `.exe`, Linux `.deb`, and macOS `.dmg` are supported build targets, not a
 promise that this fork publishes all of them for each release.
 
-**Upgrade clients and services together:** Desktop `0.8.0` ships service
-product `2.6.0`. Relay protocol stays v2, introduced in `0.7.0-rc.1`. Do not mix
+**Upgrade clients and services together:** Desktop `0.9.0` ships service
+product `3.0.0`. Relay protocol stays v2, introduced in `0.7.0-rc.1`. Do not mix
 pre-v2 desktop/TUI clients or individual workers from other bundles with this
 bundle. See the changelog for the changes in this release.
 
@@ -153,7 +165,7 @@ trusted or repair privileged-helper signing:
 curl -fsSL https://raw.githubusercontent.com/JaredP94/Personal-AI-Router/main/scripts/install-mac.sh | bash
 ```
 
-To pin the release, pass `--version 0.8.0` using `bash -s --` after the pipe.
+To pin the release, pass `--version 0.9.0` using `bash -s --` after the pipe.
 The installer checks the downloaded DMG against that release's `SHA256SUMS` before
 installation. This detects corruption but is not a signature or independent
 publisher authentication. Local `--dmg` installs require your own verification.
diff --git a/SECURITY.md b/SECURITY.md
index 9a0656778..71723df5e 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -216,7 +216,7 @@ Tracing and payload capture are governed by per-node settings with strict privac
 
 ## macOS Distribution and Privileged Helper
 
-This fork's published `0.8.0` release is unsigned and unnotarized, macOS
+This fork's published `0.9.0` release is unsigned and unnotarized, macOS
 arm64 only. The privileged-helper flow requires NVIDIA's Developer ID policy
 (Team ID `6KR3T733EC`); unsigned/ad-hoc fork builds do not satisfy it. Installing
 through `scripts/install-mac.sh`, checking `SHA256SUMS`, or avoiding browser
diff --git a/desktop/README.md b/desktop/README.md
index 8f386a7eb..cb32209b9 100644
--- a/desktop/README.md
+++ b/desktop/README.md
@@ -147,7 +147,7 @@ npm run build              # renderer, main, preload, and CLI bundles
 This produces the bundles the application runs from, for use on the machine that
 built them; it does not stage the full runtime by itself. Platform `build:*`
 scripts also stage services/tools and produce unsigned packages with
-electron-builder. The current fork release, 0.8.0 for macOS arm64, is
+electron-builder. The current fork release, 0.9.0 for macOS arm64, is
 unsigned and unnotarized, not an NVIDIA-certified release. Inspect actual assets
 and signatures rather than assuming upstream release properties. Mac helper
 packaging additionally needs the macOS SDK and Swift tools; see
diff --git a/desktop/package-lock.json b/desktop/package-lock.json
index 85340f446..2ebc02b68 100644
--- a/desktop/package-lock.json
+++ b/desktop/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "nvpair",
-    "version": "0.8.0",
+    "version": "0.9.0",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "nvpair",
-            "version": "0.8.0",
+            "version": "0.9.0",
             "hasInstallScript": true,
             "license": "Apache-2.0",
             "dependencies": {
diff --git a/desktop/package.json b/desktop/package.json
index af09c3a82..441e02aea 100644
--- a/desktop/package.json
+++ b/desktop/package.json
@@ -1,6 +1,6 @@
 {
     "name": "nvpair",
-    "version": "0.8.0",
+    "version": "0.9.0",
     "description": "Personal AI Router",
     "engines": {
         "node": ">=25.5.0"
diff --git a/docs/architecture.mdx b/docs/architecture.mdx
index bbd2e4030..dd24eb23d 100644
--- a/docs/architecture.mdx
+++ b/docs/architecture.mdx
@@ -1171,7 +1171,7 @@ The Go binaries can be cross-compiled. Desktop also builds operator tools outsid
 `cli-bin/`: `collectlogs` and `inference-dispatcher`; these are not supervised
 service workers. Public electron-builder packaging/installer targets exist but
 produce unsigned, noncertified candidates, not NVIDIA's signed releases. The
-fork's current 0.8.0 release is macOS arm64, unsigned and unnotarized;
+fork's current 0.9.0 release is macOS arm64, unsigned and unnotarized;
 inspect real release assets rather than assuming upstream signing or coverage.
 Mac helper packaging requires the macOS SDK and Swift tools. NVIDIA signing,
 notarization, and helper approval are separate from compilation or downloading
diff --git a/docs/building.mdx b/docs/building.mdx
index c7f0a561a..9ce07f3d4 100644
--- a/docs/building.mdx
+++ b/docs/building.mdx
@@ -107,7 +107,7 @@ The platform `build:mac:*`, `build:linux:*`, and `build:win:*` scripts in
 `desktop/package.json` also stage Go binaries/tools and run electron-builder to
 produce packages. These public packaging targets are unsigned, noncertified
 candidates, not NVIDIA's signed distribution pipeline. The fork's current
-**0.8.0** release is **macOS arm64, unsigned and unnotarized**; inspect the
+**0.9.0** release is **macOS arm64, unsigned and unnotarized**; inspect the
 actual release assets rather than assuming upstream platform or signing status.
 
 Go cross-compilation does not extend to the macOS privileged helper. Its package
diff --git a/docs/getting-started.mdx b/docs/getting-started.mdx
index 71ec8cad8..f8573ebb0 100644
--- a/docs/getting-started.mdx
+++ b/docs/getting-started.mdx
@@ -637,7 +637,7 @@ To manage the container and tracing:
 
 ## Keeping PAIR Up to Date
 
-**Fork release caveat:** `0.8.0` is an unsigned, unnotarized macOS arm64
+**Fork release caveat:** `0.9.0` is an unsigned, unnotarized macOS arm64
 release. Update discovery metadata is published, but automatic installation
 through macOS trust/signature checks is not certified. Use the
 [macOS installation instructions](../README.md#download-a-release) and release
diff --git a/docs/known-issues.mdx b/docs/known-issues.mdx
index e2081a5e1..11faae7b8 100644
--- a/docs/known-issues.mdx
+++ b/docs/known-issues.mdx
@@ -12,11 +12,11 @@ Report vulnerabilities privately as described in [Security](../SECURITY.md).
 
 ## Current Fork Release Is an Unsigned macOS Build
 
-The latest published fork build, `0.8.0`, targets macOS arm64 only. It is
+The latest published fork build, `0.9.0`, targets macOS arm64 only. It is
 unsigned/unnotarized; its privileged helper and helper-based firewall setup are
 unavailable. Downloading via `curl` or verifying its checksum does not change
 those trust restrictions. Windows/Linux desktop and Intel Mac runtime validation
-remain outstanding for that release. See the [release notes](https://github.com/JaredP94/Personal-AI-Router/releases/tag/v0.8.0)
+remain outstanding for that release. See the [release notes](https://github.com/JaredP94/Personal-AI-Router/releases/tag/v0.9.0)
 for the exact tested scope; source-platform support is not artifact certification.
 
 `nvpair-helper-ctl trust` checks the host app and the tool against helper code-signing
diff --git a/scripts/install-mac.sh b/scripts/install-mac.sh
index 26d5d41aa..4199c971c 100755
--- a/scripts/install-mac.sh
+++ b/scripts/install-mac.sh
@@ -18,13 +18,13 @@
 #   curl -fsSL https://raw.githubusercontent.com/JaredP94/Personal-AI-Router/main/scripts/install-mac.sh | bash
 #
 #   # Install a specific version:
-#   ./scripts/install-mac.sh --version 0.8.0
+#   ./scripts/install-mac.sh --version 0.9.0
 #
 #   # Launch after install:
 #   ./scripts/install-mac.sh --launch
 #
 #   # Install from a local DMG file (offline / dev testing):
-#   ./scripts/install-mac.sh --dmg /path/to/NVPAIR-Setup-0.8.0-arm64.dmg
+#   ./scripts/install-mac.sh --dmg /path/to/NVPAIR-Setup-0.9.0-arm64.dmg
 
 set -euo pipefail
 
@@ -42,7 +42,7 @@ Usage:
   $(basename "$0") [options]
 
 Options:
-  -v, --version <version>  Install a specific version (e.g. 0.8.0 or v0.8.0).
+  -v, --version <version>  Install a specific version (e.g. 0.9.0 or v0.9.0).
       --repo <owner/repo>  GitHub repository to download from (default: $PAIR_REPO).
       --dmg <path>         Install a local DMG; verify it independently first.
                           Cannot be combined with --version.
@@ -115,7 +115,7 @@ if ! [[ "$PAIR_REPO" =~ $REPO_PATTERN ]] || [ "${PAIR_REPO#*/}" = "." ] || [ "${
     fail "Invalid repository '$PAIR_REPO'; use GitHub owner/name (no URL or extra path)."
 fi
 if [ -n "$REQUESTED_VERSION" ] && ! valid_version "$REQUESTED_VERSION"; then
-    fail "Invalid version '$REQUESTED_VERSION'; use a filename-safe version such as 0.8.0."
+    fail "Invalid version '$REQUESTED_VERSION'; use a filename-safe version such as 0.9.0."
 fi
 if [ -n "$LOCAL_DMG" ]; then
     [ -z "$REQUESTED_VERSION" ] || fail "--dmg and --version cannot be combined; choose one source."
diff --git a/services/versions.json b/services/versions.json
index 313bd59cf..2f5c0cfe3 100644
--- a/services/versions.json
+++ b/services/versions.json
@@ -1,7 +1,7 @@
 {
   "$comment": "Single source of truth for all version numbers. See VERSIONING.md for bump rules.",
-  "product": "2.6.0",
-  "installer": "2.6.0",
+  "product": "3.0.0",
+  "installer": "3.0.0",
   "components": {
     "ollama-proxy": "1.5.0",
     "lmstudio-proxy": "1.5.0",