diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b2b0278..43682290 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.6.119 — 27 October 2026
+
+- Play audio and video attachments in a dedicated process, containing media-player crashes away from the room screen.
+- Keep authenticated recording bytes in bounded, read-only shared memory and retain explicit play, pause, seek and background-pause controls.
+- This is same-UID crash containment, not a separate security identity. Physical GrapheneOS playback and lifecycle acceptance remains outstanding.
+
 ## 0.6.116 — 26 October 2026
 
 - Restore bundled on-device background segmentation: keep the person visible
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index bb7fbbcb..3a475652 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -98,8 +98,8 @@ android {
         minSdk = 33
         targetSdk = 35
         // Remain newer than the 0.6.3 rendezvous candidate (code 26).
-        versionCode = 141
-        versionName = "0.6.118"
+        versionCode = 142
+        versionName = "0.6.119"
 
         buildConfigField("String", "ACCOUNT_NETWORK_DEFAULT", "\"$accountNetworkDefault\"")
         buildConfigField("String", "INVITATION_PROFILE", "\"$invitationProfile\"")
diff --git a/docs/android-release.md b/docs/android-release.md
index 951653ce..1948feb4 100644
--- a/docs/android-release.md
+++ b/docs/android-release.md
@@ -1,3 +1,21 @@
+## 0.6.119 (142): contain recording playback in a dedicated process
+
+Authenticated audio and video attachments now play through Android `MediaPlayer`
+in a non-exported, dedicated same-UID process. The room process retains only the
+Compose controls and a `SurfaceView`; bounded plaintext crosses through sealed,
+read-only shared memory. This contains media-client failures but is not an
+isolated-UID confidentiality or privilege boundary: platform media services
+perform demuxing and decoding. The security trade-off is recorded in
+`docs/attachment-safety.md`.
+
+PR #344 passed all 17 hosted jobs after an Android 13 emulator install failure
+was rerun. Recording coverage includes preparation without autoplay, explicit
+play and pause, corrupt/truncated input, recipient UI playback and minified-release
+signing-lineage checks on Android 13 and 15. The versioned candidate has separate
+hosted CI, production signing and publication gates. Physical GrapheneOS audible
+output, video, seeking, accessibility, memory pressure, process death, active-call
+behaviour and physical upgrade/readback remain required.
+
 ## 0.6.118 (141): safe model startup and combined relay authentication
 
 When a background model cannot start, retain the complete synthetic backdrop