diff --git a/docs/releases/0.6.1.md b/docs/releases/0.6.1.md
index d1d54fe..16d4fa7 100644
--- a/docs/releases/0.6.1.md
+++ b/docs/releases/0.6.1.md
@@ -3,7 +3,8 @@
 This desktop hotfix prevents failures in Tenebra's on-connect,
 multi-destination node validation from being reported as an
 all-servers-unreachable result. It also makes failures in the server list's
-separate direct TCP status checks visible.
+separate direct TCP status checks visible and prevents one incompatible
+subscription node from invalidating the shared sing-box configuration.
 
 - The on-connect validation reserves a free contiguous block of loopback ports
   instead of relying on a fixed range that another local process may already
@@ -18,6 +19,11 @@ separate direct TCP status checks visible.
   all-servers-unreachable verdict.
 - Probe stdout and stderr are retained in a bounded tail for diagnosis and are
   scrubbed before being logged or returned through the control interface.
+- Imported VLESS URLs with unsupported stream transports, including `xhttp`,
+  are excluded before the shared probe or tunnel configuration is built.
+  VLESS nodes using QUIC without its required TLS are excluded for the same
+  reason, while compatible VLESS QUIC nodes remain supported. Other usable
+  nodes in the profile stay available.
 - Separately, the server list shows whether its direct TCP status checks are in
   progress, ready or failed and provides a retry action. An earlier successful
   RTT may remain visible while a refresh runs or fails, but it is marked stale
@@ -27,8 +33,10 @@ separate direct TCP status checks visible.
 
 Automated tests cover the on-connect validation's probe ownership, lifecycle
 and port races, authenticated readiness, bounded log capture and the bundled
-sing-box configuration, plus the server list's direct TCP states. The precise
-trigger of the original unavailable-server report on the affected machine has
-not been causally reproduced. Native installation, service, ordinary-user UI
-and tunnel checks of the exact signed candidate remain required before
-publication.
+sing-box configuration, builder-level unsupported-transport isolation and
+compatible VLESS QUIC, plus the server list's direct TCP states. The affected
+profile reproduced the original failure in a retained Windows VM: one `xhttp`
+entry made the bundled sing-box reject the shared configuration with `unknown
+transport type: xhttp`, blocking otherwise usable nodes. Native installation,
+service, ordinary-user UI and tunnel checks of the exact rebuilt signed
+candidate remain required before publication.