diff --git a/docs/releases/v1.2.1.md b/docs/releases/v1.2.1.md
new file mode 100644
index 0000000..e5a3d10
--- /dev/null
+++ b/docs/releases/v1.2.1.md
@@ -0,0 +1,57 @@
+# Idryx 1.2.1
+
+A patch release on the 1.2 surface. An ingest that meets an event type or a source
+no detector reads now says so on stderr, in words that no longer call a registered
+type unknown. Nothing is ingested, read or refused differently.
+
+## What changed since 1.2.0
+
+- **The stderr line names unread types and sources, and stops calling them unknown
+  (#103).** A type that the bus registry names (agent-passport SPEC 6.2) but that no
+  detector reads is ingested as it is, and it used to be counted in the "unknown
+  event type(s)" figure. The line now reads "N event type(s) no idryx detector
+  reads, ingested as they are" and names them, and a source none of whose events a
+  detector reads is named the same way. `knownTypes`, `events.consumed` and the
+  ingest path are unchanged. The change has one behavioural test in
+  `cmd/idryx/main_test.go` and one scenario in
+  `features/unread-is-named-not-unknown.feature`. The README test badge moves from
+  374 to 381.
+- **Test gate: the no-scenario case (4403c42).** The teeth case in
+  `scripts/gates-have-teeth.sh` for "no scenario" now removes every feature file
+  rather than one. No runtime change.
+- **CI action pins (dfe360e).** Dependabot moves `actions/upload-artifact` to
+  v7.0.2, `actions/download-artifact` to v8.0.2 and `anchore/sbom-action` to
+  v0.24.3 in `release.yml`, and `github/codeql-action/upload-sarif` to v4.38.3 in
+  `scorecard.yml`. Each is still pinned to a commit.
+
+## Why a patch
+
+Nothing is read, emitted or refused differently, and no frozen name moved:
+`scripts/compat-surface.sh` holds that. The stderr wording is not part of
+`compat/1.0.json`, and this change corrects a diagnostic that said the wrong thing,
+which is a patch. A script that matched the old "unknown event type" wording on
+stderr will see the new one.
+
+## Upgrade note, 1.2.0 to 1.2.1
+
+- Nothing to configure. No variable, subcommand, route, exit code or format changed.
+- Asset names still carry no version, and the image stays
+  `ghcr.io/taipanbox/idryx`, tagged `v1.2.1` on release; the tags stay immutable.
+
+## Evidence and limit
+
+381 test functions (374 at 1.2.0). `features/` carries 17 scenarios, each bound to a
+named test, with 0 broken. Before this release, `gofmt`, `go vet`, `staticcheck` for
+linux, `go test -race ./...`, `gosec`, `govulncheck` and the repository's gate scripts
+were run on this tree and passed.
+
+## Not proven
+
+- The release and image jobs run only on the tag push. The checks above were run
+  locally, not in those jobs.
+- The eBPF sensor's source is unchanged since 1.2.0. `object-matches-its-source.sh`,
+  the BPF teeth cases and the integration job run only in CI's Linux jobs.
+- No operator has yet read the new stderr wording on a live box. The behavioural
+  test checks the line the code writes, not what an operator makes of it.
+
+Full changelog: https://github.com/TAIPANBOX/idryx/compare/v1.2.0...v1.2.1