chore(release): alkssh 0.2.0 — the sibling-adoption release

- version 0.2.0: the dep-req bumps (alkvault 0.2, alktunnels 0.5.0)
  are semver-significant for consumers; no alkssh public API change
  apart from what the bumps ripple through.
- CHANGELOG: the 0.2.0 entry (the three adoptions, the dropped wrap,
  the gate adoption, the harness fidelity fix, the new rows).
- tasks: record the w6-sibling-adoption wave (taskgraph validate:
  43 tasks).

Verification: scripts/matrix.sh green (exit 0 — the full suite per
feature build none/git/session/tunnel/sftp/--all-features + clippy x2
+ fmt + doc), cargo test --manifest-path fuzz/shared/Cargo.toml (11,
corpus replay), cargo publish --dry-run --allow-dirty (76 files,
342.6 KiB compressed).

CHANGELOG.md

@@ -4,6 +4,81 @@ All notable changes to this crate are documented here. The format is
 based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this crate adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.2.0] - 2026-11-04
+
+The sibling-adoption release: the three alkssh-filed upstream reviews
+resolved across the family, and alkssh adopts the results. Two
+dependency requirement bumps (the minor bump, not a patch: dep-req
+changes are semver-significant for consumers) plus the review-003 W2
+adoption wave — no alkssh-side wire-format change, no public API
+change apart from what the dep bumps ripple through.
+
+### Changed
+
+- **alkvault 0.1 → 0.2** (breaking req): `VaultServiceHandle::decrypt`
+  returns `Zeroizing<String>` (alkvault review 001, consumer input
+  from alkssh — resolution paths 1+2). The adapter seam's own
+  `Zeroizing` wrap in `decrypt_and_decode` is **dropped** (it would be
+  a dead double wrap): the pre-wrap unfenced plaintext window ADR-005
+  decision 3 recorded is closed upstream — the vault fences the
+  plaintext from its return onward, on every path including its UTF-8
+  error path, and `rotate` never holds a bare plaintext either.
+  `decode_key_arm`'s signature is unchanged (it kept riding
+  `&Zeroizing<String>` — the posture now proven by the vault's return
+  type instead of the adapter seam).
+- **alktunnels 0.4.1 → 0.5.0** (breaking req, additive API): the
+  review-003 W2 adoption — the forwarded serving surface
+  (`-R` leg's door-side arrival half) now registers
+  **`register_tunnel_forwarded_openable_with_establisher`** with a
+  `ForwardedGate` capturing the door's `ListenRouter`: a stale/missing
+  `listen` token fails the open **typed at the call plane**
+  (`channel:open_failed`, `details.reason == "unknown_resource"`)
+  *before any channel is born*, closing the phantom-channel shape
+  (call-plane success, then handler-side decline) ADR-008 Amendment 2
+  targets; a malformed arrival is likewise typed (`handler_error`)
+  instead of success-then-silent-birth-teardown. The handler-side
+  correlation re-lookup keeps the residual-race + cap-admission
+  teardown-at-birth fallback (the base shape's posture, retained).
+  The wire delta is empty (additive registration only); the ACL
+  (`tunnel:forwarded`) still runs before the establisher (now
+  double-pinned by the unscoped-arrival row, which uses a genuinely
+  minted token).
+- **alktty 0.8.1 → 0.8.2** (patch): the PTY exit-signal-fidelity fix
+  (alktty review 004, consumer input from alkssh) — the requirement
+  resolves to 0.8.2 automatically; the pin text refreshed. **No
+  alkssh contract change**: the negative-code convention (OQ-10's
+  derivation contract) is consumed verbatim, so PTY-row signal
+  deaths now report `exit-signal(name)` through the door exactly as
+  pipe-mode already did — OQ-10's upstream constraint (the
+  portable-pty flattening) is retired.
+
+### Documentation
+
+- ADR-005 decision 3 amended (the gap is closed upstream; the
+  adapter's obligation shrinks to consuming the zeroized value in one
+  pass), the `Negative` consequence amended, OQ-07 and OQ-10 amended +
+  the two upstream watch items closed, `mapping.md`'s `forwarded-tcpip`
+  row (the gate shape) and derivation-contract rule 5 (the PTY
+  constraint retired) updated, `client.md`'s OQ-07 anchor updated.
+
+### Fixed
+
+- The test doubles' fidelity: `tests/tunnel_mapping.rs`'s harness
+  opener now maps the wire refusal's `details.reason` back into the
+  `TunnelEstablishError` taxonomy (the real opener's table) instead of
+  swallowing every call-plane refusal into `HandlerError` — the typed
+  `unknown_resource` survives the client side, which is exactly what
+  the new gate rows pin.
+
+### New rows
+
+- `a_correlation_miss_fails_the_open_typed_before_any_channel` (the
+  gate miss: typed refusal, no phantom channel, no acceptor row),
+  `a_gate_pass_arrival_serves_the_route_unchanged` (the gate-pass
+  posture: the serving flow is the unchanged shape), and the source
+  unit pin `the_pump_residual_miss_teardown_at_births_the_fabric_half`
+  (the handler-side residual miss stays teardown-at-birth).
+
 ## [0.1.0] - 2026-10-30
 
 The founding entry — the crate's first release. `alkssh` is the alk

tasks/implementation/w6-sibling-adoption.md

@@ -0,0 +1,51 @@
+---
+id: w6-sibling-adoption
+name: Wave 6 — the sibling-adoption wave (alkvault 0.2 + alktunnels 0.5.0 gate + alktty 0.8.2 docs)
+status: completed
+depends_on: [w5-publish]
+scope: moderate
+risk: medium
+impact: component
+level: implementation
+---
+
+## Description
+
+The three alkssh-filed upstream reviews all shipped: alkvault 0.2.0
+(review 001, the decrypt plaintext window), alktunnels 0.5.0 (review
+003 W1 absorbed in-repo; W2 is this adoption wave), alktty 0.8.2
+(review 004, the PTY exit-signal fidelity fix; docs-only adoption
+here). Adopt all three and publish as alkssh 0.2.0:
+
+- **alkvault 0.2** — the breaking req bump; the adapter seam's
+  `Zeroizing` wrap dropped (the known-gap ADR-005 decision 3 recorded
+  is closed upstream); ADR-005 §3 + OQ-07 amended per the entry's own
+  predicted one-line doc touch.
+- **alktunnels 0.5.0 + the W2 gate adoption** — the forwarded serving
+  surface registers
+  `register_tunnel_forwarded_openable_with_establisher` with a
+  `ForwardedGate` capturing the `ListenRouter`; stale-token arrivals
+  fail typed at the call plane before any channel is born; the
+  handler-side re-lookup stays as the residual-race +
+  cap-admission teardown-at-birth fallback. mapping.md's
+  `forwarded-tcpip` row updated; gate rows added (miss typed /
+  pass unchanged / residual-miss unit pin).
+- **alktty 0.8.2** — patch-level; pin text refreshed; OQ-10's
+  upstream PTY constraint retired (mapping.md rule 5 amended); the
+  real-tool PTY signal-fidelity e2e row deferred (booked follow-up).
+- Version 0.1.0 → 0.2.0 (dep-req changes are semver-significant for
+  consumers); CHANGELOG entry.
+
+## Notes
+
+- The e2e `real_git_push_creates_the_ref_through_the_door` row
+  flaked once under full-matrix load (prepared-assert raced the
+  accept_task abort; 6+ isolated passes on both parent and adoption
+  tree; no shared path with the gate adoption). Not a regression;
+  the row's abort-vs-record race is a standing e2e flake to watch.
+
+## Summary
+
+All three adoptions landed in one wave; the version is 0.2.0; the
+decline-matrix matrix runner, clippy ×2, fmt, doc, and the fuzz
+corpus gate are green.