diff --git a/docs/WhatsNew.md b/docs/WhatsNew.md
index bb6ef9a..b2f959f 100644
--- a/docs/WhatsNew.md
+++ b/docs/WhatsNew.md
@@ -64,3 +64,11 @@ AILang now ships with a continuous safety net that verifies the two program form
 - The command-line render/parse flow preserves canonical bytes end-to-end, verified by a hash check.
 
 All three pass first time on the current corpus — the two forms are exactly equipotent today, no expressive-power gap between them. This is the prerequisite for the cross-model authoring test that was deferred earlier; the language can now go into that test on solid ground.
+
+## 2026-05-12 — Roundtrip-invariant milestone closed
+
+The roundtrip-safety-net milestone is done. The two program forms — the structured one and the textual one — are now anchored as a named, prominent invariant in the language reference, with five continuous checks enforcing it on every build: byte-identical round-trip in either direction, every language construct exercised by at least one example, and the CLI render/parse flow verified by hash identity. Float literals (NaN, infinities, subnormals) round-trip exactly through the bits-hex encoding — inside the invariant, not an exception.
+
+No language behaviour changed; the corpus already satisfied the property. The milestone made it explicit and locked in against future drift.
+
+Bench all-green. Roadmap is back to user-direction; the Show+print rewire is gated on the heap-string runtime work.