diff --git a/CHANGELOG.md b/CHANGELOG.md
index 232dc78..8a729b7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,33 @@ contract is what decides composition: records carrying a contract other than the
 verifier's own are refused (`docs/design/evidence-v3.md` §J). A release that
 changes what admissible means increments it; a patch that does not, keeps it.
 
+## 0.3.1 — contract `evidence-v3.2`
+
+A patch under the same contract: what counts as admissible evidence is
+unchanged, so records written by 0.3.0 still compose with this verifier. Four
+defects at the verifier's input and state boundaries, none of which let bad
+evidence through (#9):
+
+- **A record or CI payload that is valid JSON but not an object** (`[1]`,
+  `"evidence"`, `5`, `null`) is refused as BLOCKED, naming the file and the
+  type. `check`, `compose` and `import-ci` used to crash with a traceback.
+- **`.verification/` is excluded from the state by prefix.** An artifact a gate
+  wrote there was read as drift unless `.gitignore` hid it, because the
+  exclusion listed only the files the directory held before the gates ran.
+- **State hashing never follows a symlink inside a directory entry.** Git
+  reports an untracked nested repository as one entry, and a link inside it
+  pulled bytes from outside the repository into the state ID.
+- **`compose` names the baseline path it checked** when the governing baseline
+  is missing, and says where one does exist.
+
+The second and third change the state ID only for trees with files under an
+un-ignored `.verification/` or symlinks inside an untracked nested directory. A
+record written by 0.3.0 over such a tree goes stale here; it fails safe and is
+re-established by running again.
+
+Installation still pins the 0.3.0 runtime. The installer refuses a pin that is
+not already on `main`, so moving it to this release is a separate change.
+
 ## 0.3.0 — contract `evidence-v3.2`
 
 The same evidence/3 record shape as `evidence-v3.1`, judged under stricter
diff --git a/pyproject.toml b/pyproject.toml
index b61b8be..b685f3e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "verification-ladder"
-version = "0.3.0"
+version = "0.3.1"
 description = "A portable verification procedure and evidence machinery for coding agents"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/skills/verification-ladder/bin/verify.py b/skills/verification-ladder/bin/verify.py
index 3ec9396..7e99145 100644
--- a/skills/verification-ladder/bin/verify.py
+++ b/skills/verification-ladder/bin/verify.py
@@ -67,7 +67,7 @@
 # and fails closed. evidence-v3.1 was the same record shape under weaker rules,
 # so its records must not compose with these. CHANGELOG.md says what moved.
 COMPATIBILITY = "evidence-v3.2"
-VERSION = "0.3.0"  # tracks pyproject's version; tests/test_schema_v3.py holds them equal
+VERSION = "0.3.1"  # tracks pyproject's version; tests/test_schema_v3.py holds them equal
 # A gate declares the target dimensions it depends on. Evidence must carry every
 # dimension its gate declares, and dimensions it does not declare are never
 # compared - so a moved runtime expires a behavioural gate while a lint gate,