diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b471b0..605871c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [0.2.1] — 2026-09-13 — reach the CLI without PATH (#14)
+
+**Docs and a second entrypoint only.** No wire, schema, or API change; `0.2.0`
+clients and the `control-plane` console script behave exactly as before.
+
+Added
+- `python -m control_plane` — the CLI as a module, for when the interpreter's
+  scripts directory is not on `PATH`. `pip` installs the console script there and
+  cannot add it to `PATH` (wheels have no install-time hooks), which is the default
+  outcome on Windows under the Python Install Manager: only the `python.exe` shim is
+  on `PATH`, so `control-plane` installs successfully and is then not found.
+- `tests/test_cli_entrypoints.py` — the module form is a supported entrypoint, not a
+  convenience, so it is covered.
+
+Changed
+- `argparse` `prog` is derived from `argv[0]`, so usage and hints name the form you
+  invoked. `control-plane ui` previously printed `Run: control-plane serve --port
+  8800` — naming the very command a PATH-less user could not run.
+- README `Install` gains *If `control-plane` isn't found* (`pipx` / `uv tool`, the
+  module form, and a `sysconfig` one-liner that prints the directory to add) and
+  *After upgrading Python* (installs belong to one interpreter, so both forms stop
+  working after an upgrade; a hand-added scripts directory is version-scoped).
+
 ## [0.2.0] — 2026-09-13 — TokenOps remote-only + background CLI (#10)
 
 **Additive on the wire and schema.** 0.1-era clients keep working against 0.2.x; the
diff --git a/RELEASING.md b/RELEASING.md
index 8878c5f..beecbde 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -33,7 +33,10 @@ In the `theagentplane/control-plane` repo:
 1. **Settings → Environments → New environment**
 2. Name it exactly `pypi` (must match `environment: pypi` in `release.yml` and
    the PyPI publisher form).
-3. Optional: add required reviewers so a human must approve before upload.
+3. Required reviewers are configured on this environment, so the PyPI upload
+   pauses until a human approves it in **Actions → the run → Review deployments**.
+   PyPI versions are immutable, so this is the last point at which a bad build
+   can be stopped.
 
 No secrets needed — OIDC uses `permissions: id-token: write` in `release.yml`.
 
@@ -52,7 +55,7 @@ No secrets needed — OIDC uses `permissions: id-token: write` in `release.yml`.
    2. Build sdist/wheel and `twine check`
    3. Create and push the git tag
    4. Create the GitHub Release (attaches dist artifacts)
-   5. Upload to PyPI (may wait on `pypi` environment approval)
+   5. Upload to PyPI — **waits on `pypi` environment approval** (see above)
 5. Verify:
    ```bash
    pip install agentplane-control-plane==X.Y.Z
diff --git a/control_plane/__init__.py b/control_plane/__init__.py
index d5bb355..856812b 100644
--- a/control_plane/__init__.py
+++ b/control_plane/__init__.py
@@ -1,3 +1,3 @@
 """AgentPlane shared control plane — governance (TokenOps) + Chronicle envelopes."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
diff --git a/pyproject.toml b/pyproject.toml
index ab7b288..484c5bd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentplane-control-plane"
-version = "0.2.0"
+version = "0.2.1"
 description = "Shared AgentPlane control plane: Chronicle envelopes + TokenOps governance over HTTP."
 readme = "README.md"
 requires-python = ">=3.10"