docs: the 0.3.2 pre-release bookkeeping (changelog + readme ride notes)

- CHANGELOG: the 0.3.2 entry (alktunnels 0.4.1 -> 0.5.0, the
  correlation-gate release; patch, additive-only, no path change).
- README: the 0.3.2 version-history paragraph, same pattern.

Release machinery (tag + publish) deliberately deferred until the
doc-cleanup session lands.

CHANGELOG.md

@@ -6,6 +6,35 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.3.2] - 2026-11-03
+
+The dependency-patch release: the alktunnels sibling bumped 0.4.1 →
+0.5.0 (the correlation-gate release). No alkcall bump (0.10.1 rides
+on), no alksocks API change, no wire change, and no change on this
+crate's paths: the composed accept stays on the base
+`register_tunnel_forwarded_openable` (kept byte-for-byte upstream), so
+the new serving-side establishment phase is an adoption question, not
+a bump requirement. Patch rather than minor: the dependency bump is
+semver-compatible (additive API only), matching the 0.3.1 precedent.
+
+### Changed
+
+- **alktunnels 0.4.1 → 0.5.0** (crates.io). The correlation-gate
+  release (routed from alkssh's downstream experience): the forwarded
+  op's serving half gains an establishment phase —
+  `register_tunnel_forwarded_openable_with_establisher` + `ForwardedGate`
+  + `ForwardedPlan`, so a stale/missing `listen` token fails the open
+  as a typed `channel:open_failed` with
+  `details.reason == "unknown_resource"` BEFORE any channel is born
+  (extending alkcall ADR-049's posture to the forwarded op's serving
+  side). Additive public API only; the wire delta is empty and the
+  base `register_tunnel_forwarded_openable` stays byte-for-byte.
+  Adoption in this crate: available to the composed accept's
+  `register_forwarded_serving` (the correlation registry is assembly
+  side, so a `ForwardedGate` over the token map is the adoption
+  shape), but not taken in this bump — the base registration remains
+  the compiled path and the residual-race fallback posture.
+
 ## [0.3.1] - 2026-10-22
 
 The dependency-patch release: the alkcall substrate bumped 0.10.0 →

README.md

@@ -255,6 +255,18 @@ to the bind-first adopt flow) and the alktunnels bump 0.4.0 → 0.4.1
 there is no change on this crate's paths; patch rather than minor
 because both dependency bumps are semver-compatible.
 
+0.3.2 rides the alktunnels bump 0.4.1 → 0.5.0 (the correlation-gate
+release — the forwarded op's serving half gains an establishment
+phase, `register_tunnel_forwarded_openable_with_establisher` +
+`ForwardedGate`: a stale/missing `listen` token fails the open as a
+typed `channel:open_failed` instead of success-then-silent-birth-
+teardown). Additive API only, no wire change, no alkcall bump
+(0.10.1 rides on); the composed accept stays on the base
+`register_tunnel_forwarded_openable` (kept byte-for-byte upstream),
+so there is no change on this crate's paths. Patch rather than minor:
+semver-compatible additive dependency bump, matching the 0.3.1
+precedent.
+
 ## Verification
 
 ```bash