Version bump for the 0.4.0 release: all three crates, the internal dependency ranges, the README, and the examples that pin a version.

What 0.4 contains

Tiers 0, 1 and 2 of the maturation roadmap (#41) are complete.

axum 0.8 (#73)

• Route paths use {id} instead of :id — axum 0.8 rejects the old form at startup, so every application must edit its routes. It also removes work from gotcha: {id} is what OpenAPI already used, so the framework no longer translates between the two syntaxes.
• Newly re-exported, so they no longer need gotcha::axum::…: Form, Multipart, Sse/Event/KeepAlive, WebSocketUpgrade/WebSocket, middleware, MatchedPath, OriginalUri. (Form and Multipart were already supported internally — only the re-export was missing.)
• GotchaRouter::fallback_service handles unmatched requests with a Service rather than a handler.

Documentation, made real (#71)

• docs.rs now builds with all features. It previously built with defaults only (http1), so #[api], Schematic, Operable and the entire OpenAPI layer were invisible on docs.rs.
• Feature-gated items carry a "requires feature X" badge.
• #![deny(missing_docs)], and the 64 public items that needed documenting.
• The README is the crate documentation, so its examples are doctests and can't rot again ([docs] Re-enable doctests and fix rotted docs/README #28).

Configuration, redesigned (#60)

• The application's own settings live at the top level of the file; the framework's sit in a reserved [server] section.
• #[config] makes the application's config extractable as State<Config>; State<ServerConfig> covers the bind settings.
• mofa 0.2: environment overrides work for typed fields (APP_SERVER__PORT=8080), and __ is the path separator so snake_case fields are addressable ([config] Environment overrides only work for string fields #61, EnvironmentSource: typed fields can't be overridden, and snake_case keys are unaddressable mofa#2).

Feature flags, trimmed (#70)

• message is gone — the message system is always available.
• cors / static_files were broken, not redundant: tower-http was declared with both sub-features, so wanting CORS also compiled the whole static-file stack. Each now enables only its own half.
• CI stopped testing the powerset: 127 jobs became 7.

Correctness / trust (Tier 0)

• Config loading honours profiles and really fails on missing required files ([config] Config loading is unreliable: panics, ignored profile, fake required-file #27)
• Cron tasks validate up front and survive panics instead of dying silently ([task] Cron tasks panic on bad input and die silently #40)
• Schematic fixes: tuple/newtype variants, DateTime format, Vec requiredness, primitive names, serde_json::Value ([schematic] Derive/schema correctness bugs #37, BUG: openapi of serde_json::Value should not be Record<String, never> #18)
• serde compatibility: skip / default / skip_serializing_if ([schematic] serde compatibility gaps: skip / default / skip_serializing_if #38)
• #[state] makes State<T> extraction actually compile ([state] State<S> handler extraction doesn't compile — no FromRef<GotchaContext> for S #26)
• A usable Messager with application-state access ([cleanup] Remove or implement stub modules: empty state.rs, non-functional Messager #29)
• Handlers returning nothing compile at all, and document an empty body rather than an invalid type: "void" ([openapi] Handlers returning nothing don't compile, and () documents as an invalid type: "void" #62)

Framework identity (Tier 1)

• One router-assembly path shared by the GotchaApp trait and the Gotcha builder ([api] Unify the trait (GotchaApp) and builder (Gotcha) APIs #30)
• GotchaError + GotchaResult with IntoResponse, replacing panics/unwraps ([error] Introduce a coherent framework error type (GotchaError + IntoResponse) #31)

OpenAPI (Tier 2)

• components/$ref instead of inlining — recursive types now produce a finite spec ([openapi] Emit components/$ref instead of inlining every schema #32)
• The error side of Result<T, E> is documented ([openapi] Document error / non-200 responses (Result<T, E>) #33)
• .openapi(|spec| ..) to customize Info / servers / security ([openapi] Make top-level Info/servers/security customizable #34)
• #[schematic(...)] documentation metadata ([schematic] Make the #[schematic(...)] field attribute actually work #35)
• #[api(summary/deprecated/security)] plus header/cookie parameters — TypedHeader<T>, Header<T>/Cookie<T>, HeaderMap, Option<T> ([api] No header / cookie parameter support in ParameterProvider #36)

Validation (Tier 3, landed early)

• Valid<Json<T>> backed by the validator crate; rejects with 422 and readable messages
• #[validate(..)] drives both the runtime check and the schema keywords — written once (builtin validator for json request #9)

Breaking changes since 0.3.0

Two require an edit in every application, and both are covered step by step in MIGRATION.md:

1. Route paths: :id → {id} (axum 0.8 rejects the old form)
2. Config files: application keys move out of [application] to the top level, [basic] → [server]; nested env overrides use __

Also:

• features = ["message"] should be dropped
• Responsible for Result<T, E> requires E: ErrorResponsible (blanket-implemented for E: Schematic and (StatusCode, Json<E>))
• A hand-written FromRequest/FromRequestParts impl drops #[async_trait] (axum-core 0.5)
• Operable gained summary and security fields
• New default dependencies: validator, axum-extra; mofa 0.1 → 0.2

Verification

Locally: every feature combination builds and tests, gotcha_core and gotcha_macro suites, doctests, cargo clippy --all-features --workspace, cargo fmt --check, and a nightly --cfg docsrs doc build with no warnings.

Publishing (gotcha_macro → gotcha_core → gotcha) and the v0.4.0 tag happen after this merges.

🤖 Generated with Claude Code