release: v0.2.1 — the hardening (fuzzing adopted + alkcall 0.8.1)

- CHANGELOG: Unreleased cut to 0.2.1 (the fuzz/ workspace: three
  cargo-fuzz targets + stable-toolchain corpus replay in fuzz/shared;
  the two wave-2 diagnostics datagram_backlog/retained_bytes; the
  alkcall 0.8.0 -> 0.8.1 bump — duplicate adopt no longer destroys the
  live channel; compare links updated)
- README: the 0.2.1 hardening note (fuzzing + alkcall 0.8.1 + the two
  additive diagnostics)
- docs/architecture/overview.md: dep tree alkcall 0.8.1
- Cargo.toml: 0.2.0 -> 0.2.1

Verification: cargo test (136 default / 163 with local), fuzz/shared
corpus replay (5 pass), clippy --all-targets -D warnings (default,
all-features, wasm32-unknown-unknown, fuzz/shared), fmt --check, doc,
wasm32 check, and cargo publish --dry-run --allow-dirty all green
(42 packaged files — fuzz/, docs/research|reviews|plans/, tasks/,
.opencode/, AGENTS.md all excluded)

CHANGELOG.md

@@ -6,6 +6,53 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-09-28
+
+The hardening release: fuzzing adopted from the alkcall pattern
+(`fuzz/` workspace, excluded from the published package) and the
+alkcall substrate bumped 0.8.0 → 0.8.1. No API break, no wire change.
+
+### Added
+
+- **Fuzzing (`fuzz/` workspace, `docs/research/fuzzing.md`)** — three
+  cargo-fuzz targets over this crate's own attacker-reachable surfaces
+  (the envelope/chunk/manager layer is upstream and fuzzed there per
+  alkcall 0.8.1): `datagram_codec` (the ADR-003 codec: no-panic,
+  infallible decode, size bound, F-2 sentinel layering, re-frame
+  round-trip, retained-bytes bound), `params_parse` (the serde
+  params/reply parsers: no-panic on raw bytes and bounded structured
+  values, clean typed failure, round-trips), and `session_pumps` (the
+  wave-2 stateful target: op sequences over a live channels stack per
+  exec, the `TunnelSession` data planes mirrored, no-wedge +
+  shutdown-on-completion + lossless p2c + EOF-sentinel teardown + the
+  `pending` backlog bound asserted). Invariant logic lives in
+  `fuzz/shared/` — a stable-toolchain crate replayed as plain
+  `cargo test`, so the committed corpora (96 + 8 seeds, plus the
+  campaign-promoted `seed-900`) stay executable without nightly.
+  `fuzz/` is excluded from the workspace and from the published
+  package. Campaigns (detached, fork mode): ~25M+228k execs across
+  waves 1–2, zero crashes/hangs/OOMs; all findings were
+  harness-model defects, no crate bugs.
+
+- **`TunnelSession::datagram_backlog()`** — the UDP `pending` count
+  (the datagrams decoded from a chunk beyond the one returned), the
+  wave-2 harness's asserted backlog bound made caller-visible;
+  `None` for stream sessions or after the halves were taken.
+
+- **`DatagramReader::retained_bytes()`** — the decoder-state byte
+  count (leftover buffer + the in-flight partial datagram); post-feed
+  bounded by one frame (≤ `MAX_DATAGRAM_LEN` + 2), pinned by the
+  `datagram_codec` target.
+
+### Changed
+
+- **alkcall 0.8.0 → 0.8.1** (crates.io). The bug-fix release: a
+  duplicate `adopt_channel`/`open_channel` no longer destroys the
+  live channel it collided with (found by alkcall's own
+  `manager_routing` fuzz target) — directly relevant to this crate's
+  reverse-path adopt flow. No alktunnels API or wire change in this
+  bump; the full suite passes unchanged.
+
 ## [0.2.0] - 2026-09-20
 
 The graduation release: the direct op + the bind-first/forwarded
@@ -221,6 +268,7 @@ complete (Phase 2, review 001 findings remediated).
   matrix). Wasm-clean default crate verified (`wasm32-unknown-unknown`
   check + clippy).
 
-[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.0...HEAD
+[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.1...HEAD
+[0.2.1]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.0...v0.2.1
 [0.2.0]: https://git.alk.dev/alkdev/alktunnels/compare/v0.1.0...v0.2.0
 [0.1.0]: https://git.alk.dev/alkdev/alktunnels/releases/tag/v0.1.0

Cargo.lock

@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alktunnels"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "alkcall",
  "bytes",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "alktunnels"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"

README.md

@@ -300,6 +300,15 @@ enabling it on wasm is a compile error.
   flavor-form op ids in discovery (hub relay wraps them as channels);
   bonus: in-tree `ChannelRelay`/`HubLegTemplate` (alkcall ADR-051).
 
+0.2.1 is the hardening release: the `fuzz/` workspace (three
+cargo-fuzz targets over the datagram codec, the params parsers, and a
+stateful session-pump target; corpora replay as plain `cargo test`) —
+`docs/research/fuzzing.md` — and the alkcall bump 0.8.0 → 0.8.1
+(duplicate adopt/open no longer destroys the live channel — relevant
+to the reverse-path adopt flow). Two additive diagnostics:
+`TunnelSession::datagram_backlog()` and
+`DatagramReader::retained_bytes()`. No API break, no wire change.
+
 ## Features
 
 | Feature | Contents | wasm |

docs/architecture/overview.md

@@ -109,7 +109,7 @@ establisher + the forwarded op (ADR-008).
 
 ```
 alktunnels (default — wasm-clean)
-├── alkcall 0.8.0   (core types, channels: ChannelCore/ChannelClient/manager,
+├── alkcall 0.8.1   (core types, channels: ChannelCore/ChannelClient/manager,
 │                    pump_bidi, ServingConfig identity seam — CF-005/006,
 │                    establisher reply projection + flavor-form discovery
 │                    derivation + ChannelRelay/HubLegTemplate — review 008/ADR-051)

fuzz/Cargo.lock

@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alktunnels"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "alkcall",
  "bytes",