chore(release): 0.4.0

[Kilerd]

Version bump for the 0.4.0 release: all three crates, the internal dependency ranges, the README, and the examples that pin a version.

What 0.4 contains

Tiers 0, 1 and 2 of the maturation roadmap (#41) are complete.

Documentation, made real (#71)

• docs.rs now builds with all features. It previously built with defaults only (http1), so #[api], Schematic, Operable and the entire OpenAPI layer were invisible on docs.rs — the framework's headline capability didn't appear in its published docs at all.
• Feature-gated items carry a "requires feature X" badge.
• #![deny(missing_docs)], and the 64 public items that needed documenting.
• The README is the crate documentation, so its examples are doctests and can't rot again ([docs] Re-enable doctests and fix rotted docs/README #28).

Configuration, redesigned (#60)

• The application's own settings live at the top level of the file; the framework's sit in a reserved [server] section. config.application.name → config.name, config.basic.port → config.server.port.
• #[config] makes the application's config extractable as State<Config>; State<ServerConfig> covers the bind settings.
• mofa 0.2: environment overrides finally work for typed fields (APP_SERVER__PORT=8080), and __ is the path separator so snake_case fields like database_url are addressable ([config] Environment overrides only work for string fields #61, EnvironmentSource: typed fields can't be overridden, and snake_case keys are unaddressable mofa#2).

Feature flags, trimmed (#70)

• message is gone — the message system is always available.
• cors / static_files were broken, not redundant: tower-http was declared with both sub-features, so wanting CORS also compiled the whole static-file stack. Each now enables only its own half.
• CI stopped testing the powerset: 127 jobs became 7.

Correctness / trust (Tier 0)

• Config loading honours profiles and really fails on missing required files ([config] Config loading is unreliable: panics, ignored profile, fake required-file #27)
• Cron tasks validate up front and survive panics instead of dying silently ([task] Cron tasks panic on bad input and die silently #40)
• Schematic fixes: tuple/newtype variants, DateTime format, Vec requiredness, primitive names, serde_json::Value ([schematic] Derive/schema correctness bugs #37, BUG: openapi of serde_json::Value should not be Record<String, never> #18)
• serde compatibility: skip / default / skip_serializing_if ([schematic] serde compatibility gaps: skip / default / skip_serializing_if #38)
• Path params template correctly for camelCase/uppercase/digits ([openapi] PATH_VARIABLE_PATTERN only matches lowercase and diverges from parameter.rs #39)
• #[state] makes State<T> extraction actually compile ([state] State<S> handler extraction doesn't compile — no FromRef<GotchaContext> for S #26)
• A usable Messager with application-state access ([cleanup] Remove or implement stub modules: empty state.rs, non-functional Messager #29)
• Handlers returning nothing now compile at all, and document an empty body rather than an invalid type: "void" ([openapi] Handlers returning nothing don't compile, and () documents as an invalid type: "void" #62)

Framework identity (Tier 1)

• One router-assembly path shared by the GotchaApp trait and the Gotcha builder ([api] Unify the trait (GotchaApp) and builder (Gotcha) APIs #30)
• GotchaError + GotchaResult with IntoResponse, replacing panics/unwraps ([error] Introduce a coherent framework error type (GotchaError + IntoResponse) #31)

OpenAPI (Tier 2)

• components/$ref instead of inlining — recursive types now produce a finite spec ([openapi] Emit components/$ref instead of inlining every schema #32)
• The error side of Result<T, E> is documented ([openapi] Document error / non-200 responses (Result<T, E>) #33)
• .openapi(|spec| ..) to customize Info / servers / security ([openapi] Make top-level Info/servers/security customizable #34)
• #[schematic(...)] documentation metadata ([schematic] Make the #[schematic(...)] field attribute actually work #35)
• #[api(summary/deprecated/security)] plus header/cookie parameters — TypedHeader<T>, Header<T>/Cookie<T>, HeaderMap, Option<T> ([api] No header / cookie parameter support in ParameterProvider #36)

Validation (Tier 3, landed early)

• Valid<Json<T>> backed by the validator crate; rejects with 422 and readable messages
• #[validate(..)] drives both the runtime check and the schema keywords — written once (builtin validator for json request #9)

Breaking changes since 0.3.0

• Config files must be migrated: application keys move out of [application] to the top level, and [basic] becomes [server]. Nested env overrides use __ (APP_SERVER__PORT).
• features = ["message"] should be dropped; the message system is always available.
• Responsible for Result<T, E> now requires E: ErrorResponsible (blanket-implemented for E: Schematic and for (StatusCode, Json<E>))
• Operable gained summary and security fields
• GotchaRouter stores &'static Operable and builds Operations at assembly time
• New default dependencies: validator, axum-extra (typed-header only); mofa 0.1 → 0.2

Verification

Locally: every feature combination builds and tests, gotcha_core and gotcha_macro suites, doctests (34), cargo clippy --all-features --workspace, cargo fmt --check, and a nightly --cfg docsrs doc build with no warnings.

Publishing (gotcha_macro → gotcha_core → gotcha) and the v0.4.0 tag happen after this merges.

🤖 Generated with Claude Code