diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff7e3b0..e7ad6c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,53 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-09-28
+
+The hardening release: fuzzing adopted from the alkcall pattern
+(`fuzz/` workspace, excluded from the published package) and the
+alkcall substrate bumped 0.8.0 → 0.8.1. No API break, no wire change.
+
+### Added
+
+- **Fuzzing (`fuzz/` workspace, `docs/research/fuzzing.md`)** — three
+  cargo-fuzz targets over this crate's own attacker-reachable surfaces
+  (the envelope/chunk/manager layer is upstream and fuzzed there per
+  alkcall 0.8.1): `datagram_codec` (the ADR-003 codec: no-panic,
+  infallible decode, size bound, F-2 sentinel layering, re-frame
+  round-trip, retained-bytes bound), `params_parse` (the serde
+  params/reply parsers: no-panic on raw bytes and bounded structured
+  values, clean typed failure, round-trips), and `session_pumps` (the
+  wave-2 stateful target: op sequences over a live channels stack per
+  exec, the `TunnelSession` data planes mirrored, no-wedge +
+  shutdown-on-completion + lossless p2c + EOF-sentinel teardown + the
+  `pending` backlog bound asserted). Invariant logic lives in
+  `fuzz/shared/` — a stable-toolchain crate replayed as plain
+  `cargo test`, so the committed corpora (96 + 8 seeds, plus the
+  campaign-promoted `seed-900`) stay executable without nightly.
+  `fuzz/` is excluded from the workspace and from the published
+  package. Campaigns (detached, fork mode): ~25M+228k execs across
+  waves 1–2, zero crashes/hangs/OOMs; all findings were
+  harness-model defects, no crate bugs.
+
+- **`TunnelSession::datagram_backlog()`** — the UDP `pending` count
+  (the datagrams decoded from a chunk beyond the one returned), the
+  wave-2 harness's asserted backlog bound made caller-visible;
+  `None` for stream sessions or after the halves were taken.
+
+- **`DatagramReader::retained_bytes()`** — the decoder-state byte
+  count (leftover buffer + the in-flight partial datagram); post-feed
+  bounded by one frame (≤ `MAX_DATAGRAM_LEN` + 2), pinned by the
+  `datagram_codec` target.
+
+### Changed
+
+- **alkcall 0.8.0 → 0.8.1** (crates.io). The bug-fix release: a
+  duplicate `adopt_channel`/`open_channel` no longer destroys the
+  live channel it collided with (found by alkcall's own
+  `manager_routing` fuzz target) — directly relevant to this crate's
+  reverse-path adopt flow. No alktunnels API or wire change in this
+  bump; the full suite passes unchanged.
+
 ## [0.2.0] - 2026-09-20
 
 The graduation release: the direct op + the bind-first/forwarded
@@ -221,6 +268,7 @@ complete (Phase 2, review 001 findings remediated).
   matrix). Wasm-clean default crate verified (`wasm32-unknown-unknown`
   check + clippy).
 
-[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.0...HEAD
+[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.1...HEAD
+[0.2.1]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.0...v0.2.1
 [0.2.0]: https://git.alk.dev/alkdev/alktunnels/compare/v0.1.0...v0.2.0
 [0.1.0]: https://git.alk.dev/alkdev/alktunnels/releases/tag/v0.1.0
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index ebf764c..4b89033 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alktunnels"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "alkcall",
  "bytes",
diff --git a/Cargo.toml b/Cargo.toml
index 011d678..77bb657 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "alktunnels"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"
diff --git a/README.md b/README.md
index 2dfc1d2..4dc1973 100644
--- a/README.md
+++ b/README.md
@@ -300,6 +300,15 @@ enabling it on wasm is a compile error.
   flavor-form op ids in discovery (hub relay wraps them as channels);
   bonus: in-tree `ChannelRelay`/`HubLegTemplate` (alkcall ADR-051).
 
+0.2.1 is the hardening release: the `fuzz/` workspace (three
+cargo-fuzz targets over the datagram codec, the params parsers, and a
+stateful session-pump target; corpora replay as plain `cargo test`) —
+`docs/research/fuzzing.md` — and the alkcall bump 0.8.0 → 0.8.1
+(duplicate adopt/open no longer destroys the live channel — relevant
+to the reverse-path adopt flow). Two additive diagnostics:
+`TunnelSession::datagram_backlog()` and
+`DatagramReader::retained_bytes()`. No API break, no wire change.
+
 ## Features
 
 | Feature | Contents | wasm |
diff --git a/docs/architecture/overview.md b/docs/architecture/overview.md
index 3e6c179..2dd903d 100644
--- a/docs/architecture/overview.md
+++ b/docs/architecture/overview.md
@@ -109,7 +109,7 @@ establisher + the forwarded op (ADR-008).
 
 ```
 alktunnels (default — wasm-clean)
-├── alkcall 0.8.0   (core types, channels: ChannelCore/ChannelClient/manager,
+├── alkcall 0.8.1   (core types, channels: ChannelCore/ChannelClient/manager,
 │                    pump_bidi, ServingConfig identity seam — CF-005/006,
 │                    establisher reply projection + flavor-form discovery
 │                    derivation + ChannelRelay/HubLegTemplate — review 008/ADR-051)
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
index 1082135..ca61edc 100644
--- a/fuzz/Cargo.lock
+++ b/fuzz/Cargo.lock
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alktunnels"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "alkcall",
  "bytes",