diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69e1637..6acc178 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # changelog
 
+## 0.3.16
+
+- **feat**: optional `shouldStop` handler hook on `FirehoseClient.subscribe` — checked before every frame and around every reconnect; returning true makes subscribe return cleanly instead of reconnecting forever (bounded consumers: bootstrap capture, tests, graceful shutdown). comptime-gated like `onError`/`onRawFrame`; existing handlers unchanged.
+- **fix**: CAR block verification now covers the full CID (atmos parity): CIDv0 must be exactly the 34-byte sha2-256 multihash, CIDv1 must declare version 1 with the digest ending the CID exactly, and identity-hash digests are compared against content (previously accepted unchecked). valid CARs are unaffected; only forged or malformed CIDs are newly rejected.
+
 ## 0.3.15
 
 - **feat**: optional `onRawFrame` handler hook on `FirehoseClient` — delivers raw frames for callers that decode on their own threads; reconnect cursor tracked via new `firehose.peekSeq` (cheap, no CAR hydration).
diff --git a/build.zig.zon b/build.zig.zon
index 7ee244f..d9ad3f8 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,6 +1,6 @@
 .{
     .name = .zat,
-    .version = "0.3.15",
+    .version = "0.3.16",
     .fingerprint = 0x8da9db57ee82fbe4,
     .minimum_zig_version = "0.16.0-dev.3070+b22eb176b",
     .dependencies = .{