diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9761538..b57b9cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,24 @@ All notable changes to **volumen** are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [development]
+
+### Added
+
+- `<pubDate>` in RSS feed items, derived from the post date.
+- `<lastmod>` in sitemap entries for SEO.
+- In-memory rate limiting on the login endpoint: 10 attempts per 60 seconds per IP.
+
+### Changed
+
+- Split `lib/volumen/server.rb` into `api_routes.rb` and `admin_routes.rb` modules,
+  keeping the server class focused on configuration and shared helpers.
+
+### Fixed
+
+- `admin.session_ttl` was defined but never read; it now controls
+  `Rack::Session::Cookie` expiration via `expire_after`.
+
 ## [0.1.0] — 2026-06-20
 
 First public release: a small, file-based Markdown blog engine in CRuby. Posts
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 225381f..cff11f5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -116,15 +116,18 @@ chore: pin gem versions to latest
 
 1. Create a feature branch from `development`.
 2. Make your changes with Conventional-Commits messages.
-3. Ensure `bundle exec rubocop` reports zero offenses and `just test` passes.
-4. Add or update tests for your change.
-5. Update documentation if the public API, configuration, or behaviour changes:
+3. Record your changes under the `## [development]` section at the top of
+   `CHANGELOG.md`, using the Keep a Changelog categories (`Added`, `Changed`,
+   `Fixed`, etc.).
+4. Ensure `bundle exec rubocop` reports zero offenses and `just test` passes.
+5. Add or update tests for your change.
+6. Update documentation if the public API, configuration, or behaviour changes:
    - `README.md` — high-level overview.
    - `docs/configuration.md` — config keys.
    - `docs/api-reference.md` — JSON API behaviour.
    - `docs/architecture.md` — structural changes.
    - `docs/security.md` — anything touching auth, uploads, or rendering.
-6. Open a pull request against `development`. Releases are cut by merging
+7. Open a pull request against `development`. Releases are cut by merging
    `development` into `main` and pushing a `vX.Y.Z` tag — see
    [Cutting a release](#cutting-a-release).
 
@@ -232,7 +235,8 @@ Requires a `FORGEJO_TOKEN` secret with permission to create releases.
 ### Cutting a release
 
 1. Bump `VERSION` in `lib/volumen/version.rb`.
-2. Add a `## [X.Y.Z] — YYYY-MM-DD` section at the top of `CHANGELOG.md`.
+2. Rename `## [development]` to `## [X.Y.Z] — YYYY-MM-DD` at the top of
+   `CHANGELOG.md`, and add a fresh empty `## [development]` section above it.
 3. Ensure CI is green on `development`.
 4. Merge `development` into `main` (the only time `main` changes outside a tag).
 5. Tag and push: