release: v0.1.0 — the initial release

- CHANGELOG: the 0.1.0 entry finalized for publish — the alkcall
  0.8.1 / alktunnels 0.2.1 bumps and the fuzzing adoption folded in
  (the crate is unpublished, so no separate hardening cut — the
  alktunnels 0.2.1 precedent only applies post-publish); the fuzz/
  workspace bullet added (three targets, 129 seeds, corpus-replay
  gate, campaigns clean)
- README: the Version 0.1 note aligned (alkcall 0.8.1 — the
  duplicate-adopt fix is directly relevant to the consumer open/adopt
  paths; alktunnels 0.2.1; the fuzz posture noted)
- docs/architecture/overview.md: dep tree 0.8.1 / 0.2.1

Verification: cargo test (376 default / 638 all-features), fuzz/shared
corpus replay (3 pass), clippy --all-targets -D warnings (default,
all-features, wasm32-unknown-unknown), fmt --check, doc, wasm32 check,
and cargo publish --dry-run --allow-dirty all green (64 packaged
files — fuzz/, docs/research|reviews|plans/, tasks/, .opencode/,
AGENTS.md all excluded)

CHANGELOG.md

@@ -10,11 +10,14 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 The initial release: SOCKS5 (RFC 1928) as a produced resource on
 alkcall channels — the `-D` flavor as a first-class protocol crate,
-over alkcall 0.8.0. The defining posture: the protocol never binds a
+over alkcall 0.8.1. The defining posture: the protocol never binds a
 port; kernel binds exist only as explicit, feature-gated assembly
-shapes. Composed against by the alktunnels 0.2.0 graduation (the
+shapes. Composed against by the alktunnels 0.2.1 graduation (the
 direct op + the bind-first/forwarded flow power the composed
-providers).
+providers). Fuzzing adopted (the `fuzz/` workspace — excluded from
+the published package) over the crate's two attacker-reachable
+parsers: the ASSOCIATE datagram codec and the RFC 1928 handshake;
+campaigns clean, no crate bugs.
 
 ### Added
 
@@ -77,7 +80,7 @@ providers).
   listener (`ProducerDoor` — vanilla clients dial it, each accepted
   connection is served via `serve_socks5_over`; the ADR-014
   idle-first-byte window + max-sessions cap knobs).
-- **The `composed` feature (ADR-008/009)** — the alktunnels 0.2.0
+- **The `composed` feature (ADR-008/009)** — the alktunnels 0.2.1
   composed providers: `direct_egress` (the direct-op egress — a lazy
   destination→tunnel table, `DEFAULT_MAX_TUNNELS` bounded), and
   `bindfirst_accept` + `register_forwarded_serving` (the BIND accept
@@ -91,6 +94,18 @@ providers).
   reference checkout (`tests/rfc1928-differential.rs`), the
   protocol-core integration suite (`tests/core-integration.rs`), and
   the assembly-layer integration suite (`tests/assembly-integration.rs`).
+- **Fuzzing (`fuzz/` workspace, `docs/research/fuzzing.md`)** — the
+  alkcall §5 pattern adopted for this crate's two attacker-reachable
+  parser classes: `datagram_codec` (the `wire` codec — no-panic,
+  infallible decode, size bound, re-frame round-trip, the
+  `retained_bytes` bound) and `rfc1928_codec` (the RFC 1928 handshake
+  state machine, fed attacker bytes from both protocol directions),
+  plus `params_parse`. Invariant logic lives in `fuzz/shared/` — a
+  stable-toolchain crate replayed as plain `cargo test` (the corpus
+  replay is the fuzz gate). 129 committed seeds; detached campaigns
+  clean (`oom/timeout/crash: 0/0/0`, coverage saturated). The one
+  diagnostic added: `DatagramReader::retained_bytes()`. `fuzz/` is
+  excluded from the workspace and from the published package.
 
 [`Socks5ChannelSession`]: https://docs.rs/alksocks/latest/alksocks/consumer/struct.Socks5ChannelSession.html
 [`AssociateSession`]: https://docs.rs/alksocks/latest/alksocks/consumer/struct.AssociateSession.html