diff --git a/CHANGELOG.md b/CHANGELOG.md
index e7ad6c7..9b3ff22 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,39 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-14
+
+The dependency-major release: the alkcall substrate bumped 0.8.1 →
+0.9.0 (the stub-sweep release). No alktunnels API change, no wire
+change; the only code contact with the 0.9.0 breaking surface was
+test-side (`Establishment` no longer derives `Debug` — three
+`expect_err`/`panic!` sites restructured), which is why this is a
+minor bump rather than a patch: the semver-incompatible dependency
+bump plus this crate's public re-exports of alkcall types make it
+semver-visible to downstream consumers (matching the 0.7.1 → 0.8.0
+ride on 0.2.0).
+
+### Changed
+
+- **alkcall 0.8.1 → 0.9.0** (crates.io). The stub-sweep release: the
+  marked-pub open contract (S-01), `channel/control` (S-02),
+  `channel/resources/subscribe` (S-03), and `op/register`
+  forward-through (S-04) replace the four always-failing stubs.
+  None of the four stubs were on this crate's paths (no marked-pub
+  registration, no control-handle subscription, no resource
+  enumerator use, no generic `op/register` announcements), so no
+  behavior change here. Of the 0.9.0 breaking list,
+  `Establishment` dropping its `Debug` derive was the only surface
+  this crate touched — two `bindfirst_establisher` unit tests'
+  `expect_err` calls and one integration test's untyped
+  `panic!("{other:?}")` fall-through restructured (the error type
+  itself remains `Debug`; the `Ok` arm now formats via `panic!("got
+  Ok")`). `ManagerError::InvalidAdopt` (additive),
+  `RelayError::PubTypedOpen` removal, and the
+  `register_imported`/`register_imported_all` return change are
+  untouched by this crate's API use. 136 tests pass; wasm-clean
+  verified.
+
 ## [0.2.1] - 2026-09-28
 
 The hardening release: fuzzing adopted from the alkcall pattern
@@ -268,7 +301,8 @@ complete (Phase 2, review 001 findings remediated).
   matrix). Wasm-clean default crate verified (`wasm32-unknown-unknown`
   check + clippy).
 
-[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.1...HEAD
+[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.3.0...HEAD
+[0.3.0]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.1...v0.3.0
 [0.2.1]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.0...v0.2.1
 [0.2.0]: https://git.alk.dev/alkdev/alktunnels/compare/v0.1.0...v0.2.0
 [0.1.0]: https://git.alk.dev/alkdev/alktunnels/releases/tag/v0.1.0
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index 4b89033..78a4660 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -27,9 +27,9 @@ dependencies = [
 
 [[package]]
 name = "alkcall"
-version = "0.8.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf6af1e4af1460480849adf959c972d65deeafc36f4101064ced1ce6d1adfd5b"
+checksum = "a3562f1f7b348cdeb3d9181eaf57b0a2fb3f988d4280e8e225dadfd7f763cb84"
 dependencies = [
  "async-trait",
  "bytes",
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alktunnels"
-version = "0.2.1"
+version = "0.3.0"
 dependencies = [
  "alkcall",
  "bytes",
diff --git a/Cargo.toml b/Cargo.toml
index 77bb657..6562dfa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "alktunnels"
-version = "0.2.1"
+version = "0.3.0"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"
@@ -23,7 +23,7 @@ default = []
 local = ["tokio/net"]
 
 [dependencies]
-alkcall = "0.8.1"
+alkcall = "0.9.0"
 tokio = { version = "1", default-features = false, features = ["rt", "sync", "io-util", "macros", "time"] }
 bytes = "1"
 futures = "0.3"
diff --git a/README.md b/README.md
index 4dc1973..260d60e 100644
--- a/README.md
+++ b/README.md
@@ -309,6 +309,13 @@ to the reverse-path adopt flow). Two additive diagnostics:
 `TunnelSession::datagram_backlog()` and
 `DatagramReader::retained_bytes()`. No API break, no wire change.
 
+0.3.0 rides the alkcall bump 0.8.1 → 0.9.0 (the stub-sweep release —
+the four registered-but-always-failing stubs became real
+implementations; none were on this crate's paths). No alktunnels API
+change, no wire change; minor rather than patch because the
+semver-incompatible dependency bump + this crate's alkcall type
+re-exports make it semver-visible downstream.
+
 ## Features
 
 | Feature | Contents | wasm |
diff --git a/docs/architecture/overview.md b/docs/architecture/overview.md
index 2dd903d..549f3ac 100644
--- a/docs/architecture/overview.md
+++ b/docs/architecture/overview.md
@@ -109,7 +109,7 @@ establisher + the forwarded op (ADR-008).
 
 ```
 alktunnels (default — wasm-clean)
-├── alkcall 0.8.1   (core types, channels: ChannelCore/ChannelClient/manager,
+├── alkcall 0.9.0   (core types, channels: ChannelCore/ChannelClient/manager,
 │                    pump_bidi, ServingConfig identity seam — CF-005/006,
 │                    establisher reply projection + flavor-form discovery
 │                    derivation + ChannelRelay/HubLegTemplate — review 008/ADR-051)
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
index ca61edc..516a915 100644
--- a/fuzz/Cargo.lock
+++ b/fuzz/Cargo.lock
@@ -27,9 +27,9 @@ dependencies = [
 
 [[package]]
 name = "alkcall"
-version = "0.8.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf6af1e4af1460480849adf959c972d65deeafc36f4101064ced1ce6d1adfd5b"
+checksum = "a3562f1f7b348cdeb3d9181eaf57b0a2fb3f988d4280e8e225dadfd7f763cb84"
 dependencies = [
  "async-trait",
  "bytes",
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alktunnels"
-version = "0.2.1"
+version = "0.3.0"
 dependencies = [
  "alkcall",
  "bytes",
diff --git a/fuzz/shared/Cargo.toml b/fuzz/shared/Cargo.toml
index c39167b..1ea3ef0 100644
--- a/fuzz/shared/Cargo.toml
+++ b/fuzz/shared/Cargo.toml
@@ -6,7 +6,7 @@ edition = "2021"
 
 [dependencies]
 alktunnels = { path = "../.." }
-alkcall = "0.8.1"
+alkcall = "0.9.0"
 serde_json = "1"
 bytes = "1"
 tokio = { version = "1", features = ["rt", "sync", "io-util", "macros", "time"], default-features = false }
diff --git a/src/producer.rs b/src/producer.rs
index c7b159b..cbb4fa8 100644
--- a/src/producer.rs
+++ b/src/producer.rs
@@ -1264,7 +1264,8 @@ mod tests {
         let input = serde_json::json!({"resource": "ghost", "substrate": "tcp"});
         let err = establisher(input, AuthContext::anonymous(b"alk/tunnel"))
             .await
-            .expect_err("registry miss");
+            .err()
+            .expect("registry miss");
         assert!(matches!(err, EstablishmentError::UnknownResource { .. }));
     }
 
@@ -1290,7 +1291,8 @@ mod tests {
             let input = serde_json::json!({"resource": "listener", "substrate": "tcp"});
             let got = establisher(input, AuthContext::anonymous(b"alk/tunnel"))
                 .await
-                .expect_err("bind failure");
+                .err()
+                .expect("bind failure");
             let reason = match &got {
                 EstablishmentError::DialFailed { .. } => "dial_failed",
                 EstablishmentError::ResourceShortage { .. } => "resource_shortage",
diff --git a/tests/producer_direct_op.rs b/tests/producer_direct_op.rs
index ff44d84..4fd20fd 100644
--- a/tests/producer_direct_op.rs
+++ b/tests/producer_direct_op.rs
@@ -351,7 +351,8 @@ async fn establisher_parse_backstop_maps_handler_error() {
         Err(alkcall::channels::operations::EstablishmentError::HandlerError { message }) => {
             assert!(message.contains("invalid direct params"), "{message}");
         }
-        other => panic!("expected HandlerError backstop, got {other:?}"),
+        Err(other) => panic!("expected HandlerError backstop, got {other:?}"),
+        Ok(_) => panic!("expected HandlerError backstop, got Ok"),
     }
 }