chore: release alkhttp 0.5.0

- version bump 0.4.1 -> 0.5.0 (minor per the dep-wave convention:
  0.3.0 rode alkcall 0.6.0, 0.4.0 rode alkcall 0.7.0)
- README usage snippet 0.4.1 -> 0.5.0
- changelog: cut [0.5.0] with the alkcall 0.8.0 consumption under
  Changed — the additive-only audit (reply fields, relay/hub-leg,
  flavor-form discovery) and the one ride-through discovery change
  (explicit channel_open_alpn for non-standard open-op names)

Verification: cargo test/clippy/fmt/doc green in the preceding deps
commit; no source change in this commit

CHANGELOG.md

@@ -6,6 +6,54 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-09-18
+
+### Changed
+
+- **`alkcall` dependency bumped to 0.8.0** (review 008's remediation
+  wave: the graduation upstream asks + the in-tree channel relay). No
+  code change in this crate — alkcall 0.8.0 is additive on the
+  call-plane JSON and the registry seams, and none of its new surfaces
+  are constructed here: this crate builds no `Establishment` reply
+  fields (the WS ferry passes `Option<OpenEstablisher>` through
+  unchanged; reply-field projection is an establisher-supplier
+  feature), imports no marked specs through `from_call` (the
+  `from_wss` operation filter excludes the protocol-session ops; any
+  domain op the remote serves imports as a forwarding bundle exactly
+  as before), and consumes neither `ChannelRelay` nor
+  `HubLegImports`/`HubLegTemplate` (hub-leg assembly remains the
+  consumer's concern at the assembly layer). One ride-through visible
+  on this crate's discovery surface: for a deployment's
+  `with_ws_openable_alpns` open-op specs whose names are not standard
+  `channels/<seg>/(sub|pub)` shapes, the served `services/list` /
+  `services/schema` output now carries an explicit
+  `channel_open_alpn` string alongside the boolean marker (alkcall
+  0.8.0's U-1, ADR-047 amendment 3) — so hubs relaying through a
+  `from_call` import of those ops reconstruct the marker instead of
+  seeing plain forwarding stubs. Standard-shape open-op names stay
+  byte-stable. Minor bump per the dep-wave convention (0.3.0 rode
+  alkcall 0.6.0; 0.4.0 rode 0.7.0).
+
+## [0.4.1] — 2026-09-10
+
+### Changed
+
+- **`rust-version` floor raised 1.85 → 1.88** (patch bump, no API change).
+  The 1.85 claim was already false at the dependency level: the resolved
+  lockfile pulls `icu_*` 2.x (MSRV 1.86 via `jsonschema` → `idna`) and —
+  since alkcall 0.7.1 — alkcall itself declares 1.88, so 1.85 toolchains
+  cannot build the tree regardless of what Cargo.toml declared. Raising
+  the floor to 1.88 aligns with the ecosystem MSRV decision (noq QUIC
+  path; recorded for alktls in OQ-TLS-08) and breaks no downstream that
+  could build the crate before. Verified: 1.88 toolchain `cargo test
+  --locked` + clippy `--all-targets -D warnings` clean; one 1.88 clippy
+  lint fixed (`uninlined_format_args` in a `forward.rs` test).
+
+- **`alkcall` dependency consumed at 0.7.1** (lockfile bump; the
+  `version = "0.7"` requirement already covered it). No code change
+  forced — alkcall 0.7.1's changes are its own MSRV-floor raise plus the
+  cf-006/cf-007 feature work already consumed in the 0.7.0 wave.
+
 ## [0.4.0] — 2026-09-07
 
 ### Changed

Cargo.lock

@@ -27,9 +27,9 @@ dependencies = [
 
 [[package]]
 name = "alkcall"
-version = "0.7.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5162a10144df65b03b887e30f77eb30d956ca1ca460a3f81b409128cbcae3199"
+checksum = "8695d47cee5b5a5fe68471f04a505bc257a7e7ed9e64d827de33ff83adf4db12"
 dependencies = [
  "async-trait",
  "bytes",
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alkhttp"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "alkcall",
  "arc-swap",

Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "alkhttp"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.88"
 license = "MIT OR Apache-2.0"
 description = "HTTP interface for the alk stack: serves HTTP/1.1 + HTTP/2 on standard ALPNs (with WebSocket upgrade carrying the channels protocol) and hosts the HTTP-backed call-protocol adapters"
 readme = "README.md"
@@ -42,7 +42,7 @@ h2 = ["server", "dep:hyper", "hyper-util/http2", "hyper/http2"]
 http1 = ["server", "dep:hyper", "hyper-util/http1", "hyper/http1"]
 
 [dependencies]
-alkcall = { version = "0.7", features = ["gateway"] }
+alkcall = { version = "0.8", features = ["gateway"] }
 arc-swap = { version = "1", optional = true }
 axum = { version = "0.8", optional = true, features = ["ws"] }
 bytes = "1"

README.md

@@ -161,7 +161,7 @@ A lean single-side build takes `default-features = false` plus the side
 it needs:
 
 ```toml
-alkhttp = { version = "0.4", default-features = false, features = ["server"] }
+alkhttp = { version = "0.5.0", default-features = false, features = ["server"] }
 ```
 
 ## Security posture

src/adapters/forward.rs

@@ -2125,8 +2125,7 @@ mod tests {
                     );
                     assert!(
                         !segments.iter().any(|s| s == "." || s == ".."),
-                        "value `{value:?}` must not leave lone dot segments: {:?}",
-                        segments
+                        "value `{value:?}` must not leave lone dot segments: {segments:?}"
                     );
                 }
                 Err(err) => {