Release 0.4.0: fuzzing wave findings, MaxLengthReserved encoding, reservation read/write API

- VariableEncoding gains MaxLengthReserved (public enum, semver-major
  for 0.x; breaks exhaustive matches) — W3-3 root fix
- read_field/write_field correctly treat aligned maxLength reservations
  as raw zero-padded/NUL-trimmed windows (W3-3, a0dd3d2)
- plan_read_array bounds check for truncated fixed-stride arrays (W2-1)
- data_access::read_reservation{,_string}/write_reservation public API
- 0.4.0 changelog entry; fuzz Cargo.lock version sync

Verification: cargo test --release 573 passed/0 failed; clippy
--all-targets -D warnings clean; wasm32-unknown-unknown release build
clean; fuzz corpus replay 30/30; cargo doc --no-deps clean;
cargo publish --dry-run --allow-dirty (67 files, 1.3MiB) verified

CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to this crate are documented here. The format is
 based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this crate adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.4.0] - 2026-09-30
+
+The fuzzing release. The fuzz/ workspace (docs/plans/fuzzing.md) put
+five libFuzzer targets on the engine — bast_compile, data_access,
+read_opseq, layout_build, validate_pair — with release-budget campaigns
+across all five. Two genuine engine bugs found and fixed same-day,
+plus one upstream pin (docs/plans/fuzzing.md §6, §5 campaign numbers).
+
+### Breaking changes
+
+- **`VariableEncoding` gains `MaxLengthReserved`** (finding W3-3):
+  the aligned-mode `maxLength` reservation (ADR-003 strategy 2, the
+  `VARCHAR(N)` pattern) is now recorded as its own encoding variant
+  instead of masquerading as `LengthPrefixed`. Code matching on
+  `VariableEncoding` exhaustively must add an arm; in the document
+  form the strategy is still expressed via `maxLength`, never as an
+  `encoding` value.
+- **`read_field`/`write_field` fix for aligned `maxLength`
+  reservations** (finding W3-3, commit `a0dd3d2`): an aligned
+  String/Bytes leaf with a declared `maxLength` is now read as a raw
+  zero-padded, NUL-trimmed window and written zero-padded — previously
+  the first four raw bytes of the reservation window were misparsed as
+  a u32 length prefix, breaking the validate_bytes ⇒ read_field
+  agreement for every aligned schema declaring `maxLength`.
+- **`plan_read_array` bounds check** (finding W2-1, wave 2): a
+  fixed-stride array whose declared window (count × stride) extends
+  past the buffer now returns an `Access` error naming the array
+  field instead of reporting success and deferring the failure to the
+  next field read (or masking it entirely when the array was last).
+
+### Additions
+
+- **`data_access::read_reservation` / `read_reservation_string` /
+  `write_reservation`** — the single source of truth for the
+  `maxLength` reservation leaf semantics, shared with the aligned
+  materializer.
+- **`fuzz/` subtree** — five libFuzzer targets, 257 committed seeds,
+  the corpus-replay gate (`cargo test --manifest-path
+  fuzz/shared/Cargo.toml`, AGENTS.md verification checklist), the
+  detached campaign runner; nightly confined to `fuzz/`, `fuzz/`
+  excluded from the package. All targets, seeds, and the replay gate
+  are stable-toolchain safe.
+
 ## [0.3.0] - 2026-09-07
 
 The compiled-forms release. The packed read path — the hot path for

Cargo.lock

@@ -27,7 +27,7 @@ dependencies = [
 
 [[package]]
 name = "alktype"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "criterion",
  "jsonschema",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "alktype"
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 rust-version = "1.85"
 license = "MIT OR Apache-2.0"

fuzz/Cargo.lock

@@ -27,7 +27,7 @@ dependencies = [
 
 [[package]]
 name = "alktype"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "jsonschema",
  "serde_json",