diff --git a/AGENTS.md b/AGENTS.md
index d7679e8..12c6450 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -165,9 +165,9 @@ just spawned implementation agents.
     `Identity`, `IdentityProvider`, `AccessControl`,
     `OwnershipProvider`, `HandlerError`, `StreamError` come from
     `alkcall::core`. Do not vendor copies into this crate. alkcall is
-    v0.9.x — breaking changes are expected at this major-zero stage;
+    v0.10.x — breaking changes are expected at this major-zero stage;
     this is an early consumer, so we find and fix issues upstream
-    rather than working around them. Pin `alkcall = "0.9.0"` and bump
+    rather than working around them. Pin `alkcall = "0.10.0"` and bump
     deliberately. The 0.6.0 establishment surface (ADR-049 + amendment
     2) is load-bearing for this crate: tunnel opens use
     `register_openable_with_establisher` so a refused target dial is
@@ -264,7 +264,7 @@ non-backend module changes.
     (§POC Target 3: tunnel handler). Validates the demux→Connection→
     handler→mux path and the two-pump tunnel shape over a stand-in
     transport. POC code at `/workspace/alknet-channels-poc/`.
-  - **alkcall** — `/workspace/@alkdev/alkcall` (v0.9.x, crates.io).
+  - **alkcall** — `/workspace/@alkdev/alkcall` (v0.10.x, crates.io).
     The substrate: call protocol + channels multiplexing. The tunnel
     crate consumes `alkcall::core` types and the channels
     `ChannelCore`/`ChannelClient`/`register_openable` surface.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b3ff22..9f0626b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,37 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-19
+
+The dependency-major release: the alkcall substrate bumped 0.9.0 →
+0.10.0 (the gateway ownership-seam release). No alktunnels API
+change, no wire change; zero source changes — the only file-level
+contacts with the bump are `Cargo.toml`/`Cargo.lock`. Minor rather
+than patch for the 0.3.0 reason: the semver-incompatible dependency
+bump plus this crate's public re-exports of alkcall types
+(`ChannelOpenError`; `Establishment`/`EstablishmentError` shapes in
+the producer API) make it semver-visible to downstream consumers.
+
+### Changed
+
+- **alkcall 0.9.0 → 0.10.0** (crates.io). The gateway
+  ownership-seam release (review 012): `GatewayDispatch` gains
+  `with_ownership_provider` / `with_static_ownership_fallback`, and
+  the previously-silent static fallback becomes loud — an unwired
+  spine refuses (an error envelope, `FORBIDDEN`, pre-dispatch) an op
+  whose spec carries `access_control.resource_type`. None of it is on
+  this crate's paths: alktunnels does not use the `gateway` feature
+  or `GatewayDispatch` — tunnel opens serve via
+  `ChannelCore::register_openable`/`register_openable_with_establisher`
+  registry dispatch on the native wire, which 0.10.0 leaves
+  untouched. All of this crate's alkcall contact points
+  (`register_openable`/`register_openable_with_establisher`,
+  `Establishment::new`, `OpenHandler`,
+  `ChannelClient::open_channel_with_reply`,
+  `ManagerError::ChannelExists`, `ChannelOpenError`) are unchanged
+  between 0.9.0 and 0.10.0. 136 tests pass; wasm-clean verified
+  (check + clippy on `wasm32-unknown-unknown`).
+
 ## [0.3.0] - 2026-10-14
 
 The dependency-major release: the alkcall substrate bumped 0.8.1 →
@@ -301,7 +332,8 @@ complete (Phase 2, review 001 findings remediated).
   matrix). Wasm-clean default crate verified (`wasm32-unknown-unknown`
   check + clippy).
 
-[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.3.0...HEAD
+[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.4.0...HEAD
+[0.4.0]: https://git.alk.dev/alkdev/alktunnels/compare/v0.3.0...v0.4.0
 [0.3.0]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.1...v0.3.0
 [0.2.1]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.0...v0.2.1
 [0.2.0]: https://git.alk.dev/alkdev/alktunnels/compare/v0.1.0...v0.2.0
diff --git a/Cargo.lock b/Cargo.lock
index 78a4660..9087860 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -27,9 +27,9 @@ dependencies = [
 
 [[package]]
 name = "alkcall"
-version = "0.9.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3562f1f7b348cdeb3d9181eaf57b0a2fb3f988d4280e8e225dadfd7f763cb84"
+checksum = "6b8ef0591beff0e3fe64b7277a67d8e7caeccf71c27538b4b7aced028d22ca44"
 dependencies = [
  "async-trait",
  "bytes",
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alktunnels"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "alkcall",
  "bytes",
diff --git a/Cargo.toml b/Cargo.toml
index 6562dfa..a8358b3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "alktunnels"
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"
@@ -23,7 +23,7 @@ default = []
 local = ["tokio/net"]
 
 [dependencies]
-alkcall = "0.9.0"
+alkcall = "0.10.0"
 tokio = { version = "1", default-features = false, features = ["rt", "sync", "io-util", "macros", "time"] }
 bytes = "1"
 futures = "0.3"
diff --git a/README.md b/README.md
index 260d60e..c45f4dd 100644
--- a/README.md
+++ b/README.md
@@ -316,6 +316,13 @@ change, no wire change; minor rather than patch because the
 semver-incompatible dependency bump + this crate's alkcall type
 re-exports make it semver-visible downstream.
 
+0.4.0 rides the alkcall bump 0.9.0 → 0.10.0 (the gateway
+ownership-seam release — the loud ownership-wiring default on the
+`GatewayDispatch` spine, behind the opt-in `gateway` feature; none of
+it is on this crate's paths, which serve via
+`ChannelCore::register_openable*` dispatch). No alktunnels API
+change, no wire change; same minor-not-patch reasoning as 0.3.0.
+
 ## Features
 
 | Feature | Contents | wasm |
diff --git a/docs/architecture/overview.md b/docs/architecture/overview.md
index 549f3ac..6ea3738 100644
--- a/docs/architecture/overview.md
+++ b/docs/architecture/overview.md
@@ -109,7 +109,7 @@ establisher + the forwarded op (ADR-008).
 
 ```
 alktunnels (default — wasm-clean)
-├── alkcall 0.9.0   (core types, channels: ChannelCore/ChannelClient/manager,
+├── alkcall 0.10.0  (core types, channels: ChannelCore/ChannelClient/manager,
 │                    pump_bidi, ServingConfig identity seam — CF-005/006,
 │                    establisher reply projection + flavor-form discovery
 │                    derivation + ChannelRelay/HubLegTemplate — review 008/ADR-051)
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
index 516a915..e11cbc4 100644
--- a/fuzz/Cargo.lock
+++ b/fuzz/Cargo.lock
@@ -27,9 +27,9 @@ dependencies = [
 
 [[package]]
 name = "alkcall"
-version = "0.9.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3562f1f7b348cdeb3d9181eaf57b0a2fb3f988d4280e8e225dadfd7f763cb84"
+checksum = "6b8ef0591beff0e3fe64b7277a67d8e7caeccf71c27538b4b7aced028d22ca44"
 dependencies = [
  "async-trait",
  "bytes",
@@ -48,7 +48,7 @@ dependencies = [
 
 [[package]]
 name = "alktunnels"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "alkcall",
  "bytes",
diff --git a/fuzz/shared/Cargo.toml b/fuzz/shared/Cargo.toml
index 1ea3ef0..91794b6 100644
--- a/fuzz/shared/Cargo.toml
+++ b/fuzz/shared/Cargo.toml
@@ -6,7 +6,7 @@ edition = "2021"
 
 [dependencies]
 alktunnels = { path = "../.." }
-alkcall = "0.9.0"
+alkcall = "0.10.0"
 serde_json = "1"
 bytes = "1"
 tokio = { version = "1", features = ["rt", "sync", "io-util", "macros", "time"], default-features = false }