docs(fuzz): wave-2 spec_import campaign clean — 2.34M execs, zero findings

docs/plans/fuzzing.md

@@ -41,7 +41,10 @@ Progress log:
 - **2026-09-29 — target 3 (`spec_import`) implemented (wave 2).**
   Harness + 42 seeds + the three `fuzzing` hubs; no crate findings in
   the initial corpus replay (11 shared tests green, main crate 457
-  default / 590 all-features). Smoke campaign results in §5.
+  default / 590 all-features). Smoke campaign clean: 2.34M execs /
+  10 min, zero crash/OOM/timeout, coverage still growing at budget
+  end (see §5). One harness-assert fix on the way (the quoted-`""`
+  YAML key noted above).
 
 ---
 
@@ -355,8 +358,23 @@ exited 0, artifact dirs empty — no crash/hang/OOM/leak):
 - Toolchain notes live in `fuzz/README.md`; nightly stays confined to
   `fuzz/`.
 
-Wave-2 (`spec_import`) campaign results: filled in below after the
-smoke run completes.
+Wave-2 (`spec_import`) smoke campaign (2026-09-29, 10 min, exited 0,
+artifact dirs empty):
+
+- `spec_import` — 2.34M execs at ~4k/s (each exec replays the three
+  spec constructors + the YAML boundary + compile/harden/validate +
+  the MCP tool lane + `$ref` resolution, so per-exec work is heavy),
+  coverage still growing at budget end: 14.1k edges / 36.9k features
+  / 3046 in-memory corpus entries. One early abort in the *first*
+  launch, a harness assert too strong for the documented boundary
+  (an explicitly-quoted `""` YAML mapping key is legal — JSON
+  has the same key; the nullish-key rejection covers the implicit
+  null key, not a quoted empty string), fixed before the counted run;
+  no crate finding.
+- **Seeds regenerate deterministically:** `python3
+  fuzz/gen_fuzz_seeds.py`.
+- Toolchain notes live in `fuzz/README.md`; nightly stays confined to
+  `fuzz/`.
 
 ## 6. Sequencing
 
@@ -364,10 +382,11 @@ smoke run completes.
    exclude, toolchain pin, runner, seed generator, README) + targets
    1–2 + corpora + corpus replay + AGENTS.md gate + smoke campaigns
    (clean, see §5). Includes the FWD-20 SSE dribble quadratic fix.
-2. ✅ **Done (2026-09-29)** — target 3 (`spec_import`): harness +
-   invariants (`fuzz/shared/src/spec_import.rs`), 42 seeds, `json.dict`
-   extended with the OpenAPI-token set, fuzzing hubs in the three
-   driven modules. Smoke campaign: see §5.
+2. ✅ **Done (2026-09-29, commit e6491e3)** — target 3
+   (`spec_import`): harness + invariants
+   (`fuzz/shared/src/spec_import.rs`), 42 seeds, `json.dict` extended
+   with the OpenAPI-token set, fuzzing hubs in the three driven
+   modules. Smoke campaign clean (see §5).
 3. **Next** — target 4 stateful wave + longer campaigns; revisit
    corpus merges if any campaign yields inputs worth curating.