chore(release): v1.6.0 prep — reconcile versions + CHANGELOG

[kbennett2000]

What landed

Stop 1 of a two-stop release. Files only — version reconciliation + a new CHANGELOG + a dev-notes entry. No tag, no GitHub Release (those are Stop 2, after this merges, on explicit authorization).

Version reconciliation → 1.6.0

The last tag was v1.1.0, but the package versions never moved off the 0.1.0 scaffold default while everything through the v1.6 fan-out shipped untagged. backend/songbird/__init__.py's __version__ is the single source for the served version (FastAPI version=__version__ → OpenAPI info.version; /healthz), so four files declared the literal and all four are bumped:

File	Role
backend/pyproject.toml	backend package version
backend/songbird/__init__.py	__version__ — drives FastAPI/OpenAPI + /healthz
frontend/package.json	frontend package version
frontend/src/test/msw/handlers.ts	the /healthz test mock (no test asserts the literal)

Left alone, by design: scripts/screenshots/package.json (separate internal dev tool); the export-bundle data-format version in schemas.ts/api/schemas.py; the MapLibre style-spec version: 8; and concord_contract_test.py's info["version"] == "1.2.0" (that's Concord's pinned version). The Dockerfile has no version label and the UI shows no version string.

CHANGELOG.md (new)

Keep-a-Changelog style, newest-first, plain language for the same audience as the User's Guide. Per-version backfill 1.0.0 → 1.6.0, sourced from docs/dev-notes.md + the docs/vX specs (not invented). A preamble explains the tag drift and that earlier versions are documented but not retroactively tagged. Dates are git-sourced.

No published artifact

CI runs gates only; the nightly workflow runs the contract test; there's no release/publish workflow and no GHCR push of a songbird image. docker-compose.yml builds songbird locally; users install by clone/ZIP + docker compose up. So a release here is git tag + GitHub Release only — no image-publish step.

How it was verified

• grep -rnE '0\.1\.0' (deps/locks excluded) → no matches; the four sites read 1.6.0.
• make check → 241 passed / 4 deselected.
• make check-frontend → 221 passed, build clean (build banner now reads songbird-frontend@1.6.0).

Next (Stop 2 — after you merge this)

I'll present the exact git tag -a v1.6.0 + push + gh release create commands and wait for your authorization, run from a freshly-pulled main. The tag is never pushed in the same breath as this PR.

🤖 Generated with Claude Code