chore(release): 0.9.0 — the stub sweep

- version 0.8.1 -> 0.9.0 (minor bump: 5 breaking lints vs 0.8.1 —
  ManagerError::InvalidAdopt variant, RelayError::PubTypedOpen
  removal, register_imported* Result return, Establishment Debug
  derive dropped; all pre-1.0 permitted)
- CHANGELOG 0.9.0: S-01..S-04 from reviews 010/011 (the marked-pub
  open contract, channel/control, channel/resources/subscribe,
  op/register forward-through), the stub guard, and the
  verification summary
- open_pub_channel: a non-object input tears down the freshly
  allocated id before the early return (the slot is not parked
  against the ADR-040 bound; regression test added)
- register_imported_all: atomic — a refusal leaves the overlay
  untouched; atomicity documented

Verified: cargo test (697 + stub guard), clippy --all-targets
--all-features -- -D warnings, fmt --check, cargo doc,
wasm32-unknown-unknown check, fuzz corpus replay 5/5,
cargo publish --dry-run --allow-dirty clean.

CHANGELOG.md

@@ -4,6 +4,103 @@ All notable changes to this crate are documented here. The format is
 based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this crate adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.9.0] - 2026-10-14
+
+The stub sweep: four registered-but-always-failing stubs shipped across
+nine published versions (reviews 010/011) are now real implementations
+— the marked-pub open contract (S-01), `channel/control` (S-02),
+`channel/resources/subscribe` (S-03), and `op/register`
+forward-through (S-04). Every handler that registers on a discoverable
+surface can now succeed; the four stubs are replaced and the class is
+release-blocking in both directions (a loud-failure stub is still a
+stub — the stub guard plus registration-time invariants hold the gate).
+
+**Breaking (semver-relevant, hence the minor bump).** New variant
+`ManagerError::InvalidAdopt`; `RelayError::PubTypedOpen` removed (the
+relay put-translation now allocates and opens on the producer leg);
+`register_imported`/`register_imported_all` return `Result<(), String>`
+(beyond the boolean); `Establishment` no longer derives `Debug` (the
+establisher-contributed `ChannelControl` inner is not `Debug`).
+
+### Added
+
+- **The marked-pub open contract — S-01 (ADR-047 amendment 4, review
+  011 §3).** The put path end-to-end:
+  - `ChannelCore::register_pub_openable` + `PubOpenHandler` — the
+    put's handler returns its result for the merged single response;
+    the wrapper awaits it inline, teardown is EOF-driven, no
+    `handler_task` is ever spawned. `register_openable*` refuses
+    `Pub`-typed specs; the wrapper entry points refuse unmarked /
+    non-`Pub` shapes.
+  - The reserved input key `channel_id` (the initiator-allocated id)
+    is stripped pre-validation by `resolve_sink_handler` (P-08, the
+    single source of truth), handed to the wrapper via
+    `OperationContext.metadata`; a missing key rejects
+    `INVALID_INPUT`; adopt parity is enforced
+    (`ManagerError::InvalidAdopt`) and adopt failures answer
+    `channel:open_failed` / reason `adopt_failed`.
+  - Zero `call.published` on marked ops: the first publish chunk on a
+    marked op is rejected loudly (`channel:publish_chunks_rejected`)
+    in both dispatch loops; the handler is never fed.
+  - The relay's put-translation (ADR-042): the hub allocates odd on
+    the producer leg, opens the spoke op in the background
+    (put-acks-in-result), pumps one direction only, and mirrors the
+    response with the producer's reserved key stripped.
+  - `ChannelClient::open_pub_channel` + `PubOpenReply` — the
+    initiator-allocated put open capability (odd ids on the connect
+    side, ADR-047 §5). A failed open tears the local adopt entry down,
+    including the pre-flight INVALID_INPUT path (the allocated id is
+    released, not parked against the ADR-040 bound).
+- **`channel/control` implemented — S-02 (ADR-052).** The
+  establisher-contributed control handle (`Establishment::with_control`)
+  is registered manager-side at establishment, removed on teardown, and
+  reachable through the `channel/control` op; an establisher without a
+  control handle answers `channel:no_control_handle`.
+- **`channel/resources/subscribe` implemented — S-03 (ADR-053).** The
+  per-peer-connection `ResourceEnumerators` registry with
+  snapshot-then-changes enumerators, scan-once aggregation over the
+  channel operations, and the empty seed; the always-failing one-shot
+  error stream is gone.
+- **`op/register` forward-through — S-04 (ADR-022 amendment).**
+  Announced unmarked `Sub`/`Pub` operations register the real
+  streaming/sink forwarding shapes; marked announcements are refused
+  with `MARKED_SPEC_UNSUPPORTED`; marked specs refuse both the generic
+  registration path (`OperationRegistry::register`, `op/register`) and
+  the connection-overlay path (`CallConnection::register_imported`
+  — now returning `Result`; `register_imported_all` is atomic: a
+  refusal leaves the overlay untouched).
+
+### Changed
+
+- `HandlerRegistration` gained the private `channel_wrapper` field
+  (the channel wrapper family's plumbing); externally constructed
+  registrations stay impossible (`HandlerRegistration::new` unchanged).
+
+### Fixed
+
+- **`open_pub_channel` no longer parks a channel slot on the
+  pre-flight rejection.** The early-return on a non-object input now
+  tears down the freshly allocated id (regression:
+  `open_pub_channel_invalid_input_releases_the_allocated_id`).
+- `Capabilities::zeroize`: an unused map-key iteration tripped
+  `clippy::for_kv_map` under `-D warnings`. No behavior change.
+
+### Guard
+
+- `tests/stub_guard.rs` — `cargo test` fails if `not_implemented`
+  appears anywhere under `src/`: the four former pinned-stub tests are
+  deleted and the marked-spec registration refusals are pinned by
+  tests instead.
+
+### Verified
+
+- 698 tests pass (including the stub guard); `clippy --all-targets
+  --all-features -- -D warnings`, `fmt --check`, `cargo doc`,
+  `wasm32-unknown-unknown` check, fuzz corpus replay
+  (`cargo test --manifest-path fuzz/shared/Cargo.toml`, 5/5), and
+  `cargo semver-checks` (5 breaking lints vs 0.8.1 — the minor-bump
+  classification above).
+
 ## [0.8.1] - 2026-09-28
 
 Bug-fix release: a duplicate `adopt_channel`/`open_channel` no longer
@@ -737,6 +834,7 @@ Vendored core types (`Connection`, `ProtocolHandler`, `BiStream`,
 (ADR-046), the channels protocol with openable-ALPNs-as-operations
 (ADR-047), and the `ChannelClient` transport-agnostic client.
 
+[0.9.0]: https://git.alk.dev/alkdev/alkcall/releases/tag/v0.9.0
 [0.8.1]: https://git.alk.dev/alkdev/alkcall/releases/tag/v0.8.1
 [0.8.0]: https://git.alk.dev/alkdev/alkcall/releases/tag/v0.8.0
 [0.7.1]: https://git.alk.dev/alkdev/alkcall/releases/tag/v0.7.1