diff --git a/CHANGELOG.md b/CHANGELOG.md
index 139b847..d5abf5c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,14 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Changed
-- **A new app icon.** An off-white arch bridge on black, with three
-  turquoise dots above it. It replaces the bar chart over an arc.
-  `assets/icon.svg` is the source, and `scripts/generate-icon.py` writes the
-  PNG, ICNS and ICO from it.
-- **The menu bar and notification-area icon matches.** It is now a solid arch
-  bridge with three dots instead of a cloud, redrawn to stay legible at this
-  size. While an alert is open, an exclamation mark replaces the dots.
+## [0.9.0] - 2026-11-04
+
+Close the month with evidence: freeze a bill, check it against the provider's
+invoice and export a review to share. Insights also flags security groups open
+to the internet, and the app is translated into 简体中文 with a new icon.
+
 ### Added
 - **Reconciliation.** A new page holds each invoice's final total against the
   ledger's authoritative billed cost, or a frozen snapshot, in the invoice's own
@@ -48,6 +46,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   picks up a new language at the next launch.
 
 ### Changed
+- **A new app icon.** An off-white arch bridge on black, with three
+  turquoise dots above it. It replaces the bar chart over an arc.
+  `assets/icon.svg` is the source, and `scripts/generate-icon.py` writes the
+  PNG, ICNS and ICO from it.
+- **The menu bar and notification-area icon matches.** It is now a solid arch
+  bridge with three dots instead of a cloud, redrawn to stay legible at this
+  size. While an alert is open, an exclamation mark replaces the dots.
 - **Buttons are one size.** Buttons with a border or fill are now one
   height across every page, and refreshing, adding an account and alert
   actions no longer use the black emphasis.
@@ -104,9 +109,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   edge, the Overview card links sit under their captions, and the actions on
   the Accounts table hold their columns from row to row.
 - **Installing the scanner failed on a dropped connection.** The Insights
-  scanner is a 46 MB download, and a connection cut partway through
+  scanner is a download of about 45 MB, and a connection cut partway through
   stopped the install with "io: unexpected end of file". A dropped or
-  timed-out download, or a server error, is now tried up to three times.
+  timed-out download, or a server error, is now tried up to three times. The
+  install dialog also gave its size as about 30 MB, and now says about 45 MB.
 
 ## [0.8.0] - 2026-10-31
 
diff --git a/Cargo.lock b/Cargo.lock
index cd942b4..13112d7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1210,7 +1210,7 @@ dependencies = [
 
 [[package]]
 name = "cloudbridge"
-version = "0.8.0"
+version = "0.9.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/Cargo.toml b/Cargo.toml
index c0362d2..76b8afe 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cloudbridge"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2021"
 description = "A cross-platform desktop application for multi-cloud cost management"
 authors = ["JetSquirrel"]
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 6028509..5956403 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -91,6 +91,13 @@ Gateways join the built-in findings, read from the bill alone. Scans move
 to corkscrew `cloudbridge-r4`, whose partial scans are imported and whose
 gaps are listed after the scan.
 
+0.9.0 closes the month with evidence. A month-end snapshot freezes an account's
+bill, Reconciliation holds a provider's invoice against the ledger or a snapshot
+in the invoice's own currency, and Overview exports a month as one HTML review.
+Insights gains a read-only check for AWS security groups open to the internet,
+which says what it could not evaluate. Every page is translated into 简体中文,
+and the arch bridge replaces the old app and tray icons.
+
 A source is a `SourceDescriptor` registry entry rather than an enum
 variant. API-backed sources implement `BillingSource`; file-only sources
 provide a bill parser without an API client. The ingest pipeline persists
diff --git a/locales/ui.yml b/locales/ui.yml
index f7527ab..1391d35 100644
--- a/locales/ui.yml
+++ b/locales/ui.yml
@@ -2181,8 +2181,8 @@ insights:
     en: "Scan settings"
     zh-CN: "扫描设置"
   install_point_1:
-    en: "CloudBridge downloads corkscrew, a free open-source scanner (MIT licence, about 30 MB), and keeps it in its own data folder."
-    zh-CN: "CloudBridge 会下载免费开源扫描器 corkscrew（MIT 许可，约 30 MB），并保存在自己的数据文件夹中。"
+    en: "CloudBridge downloads corkscrew, a free open-source scanner (MIT licence, about 45 MB), and keeps it in its own data folder."
+    zh-CN: "CloudBridge 会下载免费开源扫描器 corkscrew（MIT 许可，约 45 MB），并保存在自己的数据文件夹中。"
   install_point_2:
     en: "Each AWS or Cloudflare account is scanned with the credential saved for it. The scan only reads: it lists resources and changes nothing."
     zh-CN: "每个 AWS 或 Cloudflare 账户都使用为其保存的凭据进行扫描。扫描只读：仅列出资源，不做任何更改。"