[JacobStephens2]

Summary

0.16.6 makes Security runs close addressed findings by default after a fix merges and the proof-of-concept passes on the merged Base branch (#1433).

• Closure names the merged PR. Fixing remains opt-in; no-security-close or close = false under [security] keeps findings open, while security-close overrides the setting (Close verified Security findings by default #1433).
• The Console and thirdshift status count a ready Pass and its ready dispatched run once when both reference the same pull request. Ready dispatches still appear separately when the Pass is live or not ready, or the dispatch references a different pull request (Count a ready Pass and its ready dispatch on one pull request once (#1428) #1430).
• scripts/release.sh skips release Experiments by default. --with-experiment replaces --no-experiment and opts in per invocation, including resumes (Make release Experiments opt-in #1424).

Also: site and docs updates (#1424, #1433), and more time for historical Rust pin and live usage-limit stop tests on CI (#1429, #1441).

Version diff

diff --git a/Cargo.lock b/Cargo.lock
index d289b38d..ac459e23 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2184,3 +2184,3 @@ dependencies = [
 name = "thirdshift"
-version = "0.16.5"
+version = "0.16.6"
 dependencies = [
diff --git a/Cargo.toml b/Cargo.toml
index 61782c04..6dfda33b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,3 +2,3 @@
 name = "thirdshift"
-version = "0.16.5"
+version = "0.16.6"
 edition = "2024"

[JacobStephens2]

This was generated by AI during triage.

Closing: #1437 merged to main while this PR waited for CI, so release.sh refused to merge a tree that omits it. Rerunning scripts/release.sh 0.16.6 from current main.