docs(research): fuzzing steps 1-3 complete; 10-min campaigns clean on all five targets

\u00a77.8 campaign results: manager_routing 1.06M execs (exact-counter and
parked-bytes invariants held across every adversarial sequence),
envelope_semantic 2.44M execs (coverage saturated, all event kinds
round-trip), spec_parse 10.8M execs (registry compiled every
attacker-shaped schema or rejected cleanly). All exited 0, zero
artifacts.

Also records the two harness-model defects the fuzzer caught in the
interim (per-receiver EOF-sentinel latch; odd/even Adopt range per
ADR-047 \u00a75). Doc-only + harness fixes; no crate changes.

docs/research/fuzzing.md

@@ -1,8 +1,9 @@
 # Fuzzing alkcall: Research and Recommendation
 
-**Status:** step 1 of §7.4 adopted (`fuzz/` workspace, targets 1–2, committed
-seeds, detached runner; campaigns run — §7.7); step 3 targets 3–5 adopted,
-one real finding fixed — see §7.8
+**Status:** steps 1–3 of §7.4 adopted — `fuzz/` workspace, five targets,
+committed seeds, detached runner, two-tier campaigns run; one real
+finding (duplicate adopt/open destroying the live channel) fixed with
+regression tests. CI deferred until a platform exists (§7.8)
 **Date:** 2026-09-27
 **Research inputs:** web survey of the 2025–2026 Rust fuzzing ecosystem, survey
 of fuzzing practice in comparable Rust protocol crates (rustls, quinn, quiche,
@@ -379,10 +380,10 @@ comparisons), and a `-dict` of JSON tokens for the envelope targets.
    found; triage §6.2 candidates with targeted corpus entries.
    **Done for targets 1–2 — see §7.7.**
 3. Add targets 3–5, the smoke CI job, and `.gitignore` entries.
-   **Targets 3–5 done — see §7.8. CI deferred (no CI platform exists in
-   this repo yet; the stable-side corpus replay `cargo test
-   --manifest-path fuzz/shared/Cargo.toml` is the drop-in smoke gate
-   when a platform is chosen).**
+   **Targets 3–5 done, campaigns clean — see §7.8. CI deferred (no CI
+   platform exists in this repo yet; the stable-side corpus replay
+   `cargo test --manifest-path fuzz/shared/Cargo.toml` is the drop-in
+   smoke gate when a platform is chosen).**
 4. Scheduled campaign tier; then OSS-Fuzz application.
 
 ### 7.5 Relationship to existing tests
@@ -697,16 +698,40 @@ not channel-map entries — adopted channels carry no ledger entry, so
 counters survive `clear_all`; and drainer-byte reconciliation needs
 per-id supersession when a fresh stream replaces a drained one.
 
-### Campaign results (smoke tier, 20 s per target)
+### Campaign results (10-min detached runs per target, §7.6 runner)
 
-All three targets ran clean (`-fork=1 -rss_limit_mb=2048
--malloc_limit_mb=2048`): `manager_routing` 79k runs, `envelope_semantic`
-141k runs, `spec_parse` 517k runs — zero crashes beyond the found-and-
-fixed channel bug above. The stable side stayed green throughout:
-684 tests (682 + the two regression tests), clippy `-D warnings`, fmt
-(main + fuzz workspace + shared). Detached 10-min campaigns on the new
-targets follow this commit; §6.2-1 (parked-bytes bound) is now encoded
-as an exact counter model and the §7.4 step-3 stateful coverage exists.
+The smoke-tier runs above surfaced two harness-model defects worth
+recording (the fuzzer as a harness-checker), fixed before the long
+runs: the op-sequence driver's EOF-sentinel latch is **per-receiver,
+not per-channel-id** — a fresh adopt installs a fresh reassembled
+stream with no latched EOF, while a sentinel inside a *drained
+early-arrival queue* latches the new receiver too
+(`drain_early_arrivals` delivers it); and `Adopt` ops must respect
+ADR-047 §5's odd/even split (an Accept-side manager adopts the peer's
+odd ids; its own `Open` allocates even — a cross-range adopt/open
+collision is a protocol violation, not a manager bug).
+
+**Final 10-minute detached campaigns, all three targets (post-fixes,
+post the `insert`-replace fix): every run exited 0 with an empty
+artifacts directory — no crashes, hangs, OOMs, or leaks.**
+
+- `manager_routing` — 1.06M execs (~1.9k exec/s; each exec replays up
+  to 256 manager ops on a live runtime), 33 fork jobs clean,
+  `oom/timeout/crash: 0/0/0` throughout. Final coverage 2499 edges /
+  11332 features / 461 in-memory corpus entries. The exact-counter and
+  parked-bytes invariants held across every adversarial sequence.
+- `envelope_semantic` — 2.44M execs (~4.4k exec/s), 33 fork jobs
+  clean, coverage saturated at 1669 edges (constructor × payload shape
+  space is finite), corpus 765. All six event kinds round-tripped
+  structurally; `CallError` parse-back never failed.
+- `spec_parse` — 10.8M execs (~19k exec/s), 33 fork jobs clean,
+  coverage 978 edges / corpus 1267. The registry compiled every
+  attacker-shaped schema it was handed (or rejected cleanly); the
+  `spec_to_json_pub` → `from_json` round-trip never diverged.
+
+§6.2-1 (parked-bytes bound) is now encoded as an exact counter model
+and held; §6.2-3 confirmed bounded at the parser level (§7.7). The
+stateful coverage §7.4 step 3 called for exists and is clean.
 
 ## 8. Answering the "if / how" directly