# Plan: alkhttp fuzzing

Adopted from alkcall's `docs/research/fuzzing.md` (the pattern is
operational in four sibling crates: alkcall, alktty, alktunnels,
alksocks — each with the same `fuzz/` layout, the detached runner, and
the corpus-replay-as-plain-test gate). This document is the working
plan for alkhttp; the sibling docs are the reference for rationale
(alkcall's doc is the deep version: tool landscape, comparable-crate
survey, CI tiers) — this plan stays focused on what alkhttp fuzzes and
in what order.

**Status:** targets 1–3 implemented and verified (1–2 on 2026-09-29,
wave 1; 3 on 2026-09-29, wave 2); target 4 implemented (2026-09-29,
wave 3: `ws_session_opseq` + `retry_throttle`; campaign results in
§5); the only crash found so far (FWD-21, the `WriteChunkWalk`
failure-carry drop) was a crate contract fix, not a harness
misassert.

Progress log:

- **2026-09-29 — targets 1–2 + infra landed (commit 5971c0a).** The
  `fuzz/` workspace, 80 committed seeds (52 + 28), the detached
  runner, the corpus-replay gate (AGENTS.md verification checklist
  gains the line), nightly pinned subtree, explicit root `[workspace]`
  exclusion. One crate finding on the way (below). `cargo fuzz build`
  clean; corpus replay 80/80 green; campaigns pending at commit time.
- **2026-09-29 — FWD-20, the SSE dribble-drain quadratic (fixed in
  the same commit).** Found by driving the new `sse_parser` harness's
  split-feed invariants: `SseParser::feed` re-walked the whole
  reassembly buffer per feed — a subscription dribble-fed one giant
  unterminated line (the attacker can hold `data: <n MiB>` open
  forever without sending `\n`) paid O(n²) in the dribbled bytes:
  64 KiB dribble ≈ 12.5 s CPU, 1 MiB would run to minutes per
  connection, with no per-stream total-CPU bound (the alkcall
  research §6.2-3 shape, in this crate). The fix: line assembly walks
  only the arriving chunk — the reassembly buffer holds just the
  current line, so the scan never revisits drained bytes; measured
  1 MiB dribble now 21 ms (linear, 4× data = ~4× time). Regression
  test `sse_parser_dribble_feeds_do_not_rescan_the_buffer`. Also
  fixed by corpus replay pre-campaign: the harness's own re-frame
  round-trip was wrong for data ending in `\r` (un-re-encodable under
  WHATWG CR-stripping — the serde_json key-order class; the harness
  skips that documented-lossy shape).
- **2026-09-29 — target 3 (`spec_import`) implemented (wave 2).**
  Harness + 42 seeds + the three `fuzzing` hubs; no crate findings in
  the initial corpus replay (11 shared tests green, main crate 457
  default / 590 all-features). Smoke campaign clean: 2.34M execs /
  10 min, zero crash/OOM/timeout, coverage still growing at budget
  end (see §5). One harness-assert fix on the way (the quoted-`""`
  YAML key noted above).
- **2026-09-29 — target 4 (`ws_session_opseq` + `retry_throttle`)
  implemented (wave 3).** Two stateful harnesses + 16 seeds + the
  `byte_adapter::fuzzing` drive hub (generic pump bodies over a mock
  socket flavor) + the `client::fuzzing` throttle hub. One crate
  finding on the way: FWD-21 (above) — fixed same commit.
- **2026-09-29 — FWD-21, the `WriteChunkWalk` failure-carry drop.**
  Found minutes into the first `ws_session_opseq` campaign: one feed
  that drains a complete chunk and then hits an oversize header (or
  the pending cap) in the same call returned
  `Walk::Oversize`/`PendingOverCap` and **discarded the already
  drained pieces** — the walk's own consumption-accounting contract
  ("every parsed byte is either emitted or retained", wave-1
  invariant 6) was violated by the crate, not the harness. Production
  could not reach the shape (the mux's per-write invariant caps
  `pending` at one chunk + header), so impact was nil, but
  `WriteChunkWalk` is public API and the wave-1 `split_walk` equality
  check was silently skipped on exactly this path. Fix (user-approved
  semver-relevant API change): `Walk::Oversize(Vec<Vec<u8>>)` /
  `Walk::PendingOverCap(Vec<Vec<u8>>)` carry the pre-failure pieces;
  the write pump emits them before `fail_write_pump`, so a 1011
  close never swallows a legal chunk the mux already counted as
  written. Regression seeds cover the drain-then-fail shape in both
  chunk harnesses.
- **2026-09-29 — FWD-22, the round-trip guard-CR (harness-assert
  fix; wave 4).** Found ~32 min into the first long `sse_parser`
  campaign: the re-frame round-trip probe's `frame_event` emitted
  `data: <line>` unguarded, so a JSON payload carrying an *interior*
  CR (multi-line data `"\r\n…"` — the payload line is `"\r"`) had
  its payload CR consumed by `strip_cr` at re-parse time and the
  round-trip lost it (wave-1 had skipped only the *terminal*-CR
  case). The parser was never wrong — the shape is representable on
  input (`data: x\r\r\n` → value `x\r`) and both drives agreed — the
  re-encode was weak: one CR in the wire form is ambiguous between
  "payload CR" and "line-terminator CR". Fix: `frame_event` emits
  `data: <line>\r` for every data line (the guard CR is the
  terminator, `strip_cr` removes exactly it, the payload CR
  survives), and the terminal-CR skip is dropped — the round trip is
  now total over anything JSON-encodable (JSON never encodes a raw
  CR, so the residual asymmetry stays the serde_json non-preserved
  key-order class). No crate API change. Regression seeds + unit
  cases cover the interior-CR JSON shape (`{"k": "a\\rb"}`, two-line
  `{…}\r\r\n{…}`).

---

## 1. Why alkhttp fuzzes (the if)

Same three converging arguments as every sibling crate, with one
stronger premise:

1. **This is the outermost shell.** alkcall's peers are authenticated
   by construction; alkhttp's HTTP surface faces anonymous callers —
   gateway routes accept bytes on the wire before any identity is
   resolved, `/healthz` and the stealth decoy are fully public, and the
   `from_*` adapters parse responses from remote HTTP servers nobody
   in this repo controls. The quinn-CVE class (RUSTSEC-2026-0037: a
   panic on attacker wire bytes is a remote DoS) applies here at its
   most direct. A remote crash in this crate does not need a peer
   trust step to reach.
2. **Real hand-rolled byte parsing on untrusted streams.** The HTTP
   framing itself is hyper/axum/reqwest (upstream-fuzzed, not our job),
   but the crate owns an incremental SSE frame parser, the
   WS↔byte-stream chunk parser on both directions, a YAML→JSON
   conversion pass with its own number/key/pointer semantics, and
   bounded-schema compilation over arbitrary input values. These are
   the exact shapes (incremental, splitting-sensitive,
   cap-check-ordered) where example tests miss off-by-one bugs. No
   `unsafe` exists (grep-verified), so the expected yield is the
   alkcall profile: panics, arithmetic, allocation, and state-growth
   bugs — not memory corruption.
3. **The integration seam is untested from this side.** alkhttp sits
   downstream of the alkcall 0.8.1 fix (duplicate adopt/open
   destroying the live channel — found by alkcall's `manager_routing`
   campaign minutes into its first run). alkhttp's WS path hands raw
   bytes to alkcall's demux; `fuzz/shared` depending on alkcall means
   corpus replay exercises the alkcall surface from the integration
   crate, a direction alkcall's own harness does not cover.

Also the standing empirical argument: the 0.8.1 bug was a stateful
interleaving invisible to example-based tests, and it cost a patch
release across every sibling. The infrastructure is already proven and
cheap to replicate; the marginal cost here is only the target logic.

## 2. Infrastructure (identical to the siblings)

Layout (copy of alksocks/alktty/alktunnels/alkcall):

```
fuzz/
├── Cargo.toml            alkhttp-fuzz (nightly-only bins; own [workspace])
├── rust-toolchain.toml   pins nightly + llvm-tools for this subtree only
├── fuzz_targets/         thin fuzz_target! wrappers (3 lines each)
├── shared/               alkhttp-fuzz-shared — STABLE-toolchain library:
│                         invariant logic + corpus-replay tests
├── corpus/<target>/      committed seeds (generated by gen_fuzz_seeds.py)
├── artifacts/            gitignored crash/oom/timeout artifacts + logs
├── gen_fuzz_seeds.py     deterministic seed generator (quiche pattern)
├── json.dict             JSON token dictionary (spec_import)
├── run-detached.sh       detached campaign runner (copied from the siblings)
└── README.md             operational cheat-sheet
```

Load-bearing details (all four siblings hit these):

- **Invariant logic lives in `fuzz/shared/`**, not the target binaries.
  The stable-toolchain shared crate replays every committed seed
  through the identical invariant functions as plain `cargo test` —
  the standing fuzz gate (alkcall research §7.9 tier-3 deliverable,
  this repo has no hosted CI by policy) — and the `fuzz_target!`
  binaries are thin wrappers.
- **Root `Cargo.toml` needs an explicit `[workspace]` table**
  (`members = ["."]`, `exclude = ["fuzz"]`); without it auto-discovery
  pulls `fuzz/shared/` into the main workspace and the stable
  toolchain builds nightly-consumed dev-deps. alkcall hit this trap.
- **`fuzz/rust-toolchain.toml` pins nightly** so `cargo fuzz build`
  works from any CWD; nightly stays confined to `fuzz/`, MSRV 1.88
  untouched. `fuzz/` joins the publish `exclude` list.
- **`.gitignore` additions**: `fuzz/artifacts/`, grown-corpus dirs
  (committed seeds stay).
- **Detached runner (non-negotiable operating rule).** Campaigns never
  run as a foreground child of an agent session (an OOM in a target
  can take down the session host's process tree). Runner pins
  `-fork=1 -rss_limit_mb=2048 -malloc_limit_mb=2048 -timeout=25` and
  detaches via `setsid` + `nohup` + log redirect; the agent polls the
  log and artifact directory, never waits. Copied from alksocks
  (§`fuzz/run-detached.sh`).

**Verification-gate change:** `cargo test --manifest-path
fuzz/shared/Cargo.toml` (corpus replay) joins AGENTS.md's verification
checklist, as the siblings did.

## 3. Target inventory (all 4)

| # | Target | Drives | Input style | Status |
|---|---|---|---|---|
| 1 | `sse_parser` | `SseParser::feed` + `sse_event_envelope` mapping (`src/adapters/forward.rs`) | chunk-split sequence × eof flag | implemented 2026-09-29 |
| 2 | `ws_chunk_framing` | the WS↔byte-adapter chunk parsers (`WriteChunkWalk`, the write pump's extracted chunk walk) (`src/websocket/byte_adapter.rs`) | byte sequences + message-split boundaries | implemented 2026-09-29 |
| 3 | `spec_import` | `OpenAPISpec::from_str`/`from_yaml`/`from_json`, `CompiledInputSchema`/`harden_closed_by_default`/`validate`, `FromMCP::build_spec` (`src/adapters/openapi_spec.rs`, `from_jsonschema.rs`, `from_mcp/mod.rs`) | attacker-shaped OpenAPI/JSON/YAML docs + schemas | implemented 2026-09-29 |
| 4 | `ws_session_opseq` / `retry_throttle` | stateful op sequences over the WS byte-adapter pumps (write/read pump interleavings, close timing, oversize frames); `RetryAfterMiddleware` throttle-map growth | `#[derive(Arbitrary)]` op enums | implemented 2026-09-29 |

### Target 1 — `sse_parser` (the chunk_header-class target)

The crate's most direct untrusted-byte parser: any subscription over
`from_openapi`/`from_jsonschema` pipes remote HTTP bytes through
`SseParser::feed`.

- **Drives:** incremental `feed` with the fuzzer choosing the chunk
  split boundaries; also the full-input single feed, and the
  `sse_event_envelope` mapping (FWD-17: JSON payload surfaces as
  itself, non-JSON as the `{"data","event"}` wrapper, empty →
  `Null`).
- **Invariants:**
  - no-panic on any byte sequence, any split, any eof timing;
  - splitting transparency: whole-feed and every-slice-split feed
    produce identical event streams (the alksocks `datagram_codec`
    pattern);
  - the buffer-cap check runs *before* the buffer grows
    (FWD-14): the reassembly buffer can never exceed
    `SSE_EVENT_BUFFER_CAP`; overflow surfaces as `BufferOverflow`,
    never a panic or unbounded growth;
  - dispatch discipline: an event is dispatched only on a blank line
    (or EOF for a pending event with data); `data:` lines join with
    `\n`; last `event:` before the blank line wins; `id:`/`retry:`/
    comment lines (`:` prefix) never dispatch or alter state;
  - shape partition: `BufferOverflow` only when a fed chunk would push
    the reassembly buffer over the cap; a cap-sized-and-under input
    can never trigger it — never allocate beyond the cap;
  - UTF-8 discipline: a multi-byte character split at a chunk boundary
    is not corrupted (decode happens once a complete line/EOF bounds
    the window); invalid raw UTF-8 lines are skipped silently (WHATWG
    tolerance), never panic;
  - envelope mapping (FWD-17): every `feed`-produced event maps to a
    success `ResponseEnvelope`; the JSON-ness branch agrees with
    `serde_json::from_str` on the joined data; the JSON branch never
    carries the `event` binding.
  - round-trip-ish probe: re-serializing a parsed event as
    `data:`/`event:` lines re-parses to an equal event for
    JSON-encodable payloads (catches field-name and joining drift;
    structural equality only).
- **Exposure:** `SseParser`/`SseEvent`/`sse_event_envelope` are
  `pub(crate)`. Shared/invariant access via quinn/rustls-style
  exposure if the pure functions can't be reached — alkcall's
  campaign never needed `#[cfg(fuzzing)]` after making parse helpers
  `pub(crate)` + re-export; the first choice here is the same: a
  minimal `#[cfg(fuzzing)] pub mod fuzzing` re-export in
  `src/adapters/forward.rs` (nightly-fuzz-only builds see it; stable
  builds don't).

### Target 2 — `ws_chunk_framing`

The WS↔byte adapter parses 8-byte chunk headers on the write
(outbound byte→WS-message) side and validates against
`MAX_CHUNK_LEN`; the inbound side reassembles WS messages into the
byte stream that alkcall's demux parses. The hand-rolled pieces are
the chunk-walk loop and the pending accumulator.

- **Drives:** the write-pump parse loop driven directly with the
  same logic `run_write_pump` executes on each `WriteMsg::Bytes`
  (header scan → `MAX_CHUNK_LEN` gate → drain → 1 MiB message-piece
  split → pending cap), and the read-pump inbound path's
  message→header reassembly, driven as a byte-sequence target with
  the fuzzer controlling both the byte stream and the message split
  boundaries.
- **Invariants:**
  - no-panic on any byte sequence at any message-split boundary;
  - a header claiming `> MAX_CHUNK_LEN` fails the stream loudly
    (WS-04/HY-09) at exactly the point the pump reaches the header —
    never a silent wait and never an allocate-before-reject;
  - the pending accumulator never exceeds `PENDING_BUFFER_CAP` =
    `MAX_CHUNK_LEN + 8` (WS-14): bound asserted after every op; a
    single write above the cap is rejected in `poll_write` before
    queueing, so the cap is invariantly satisfied;
  - message-splitting transparency: a chunk split across N
    WS-message feeds parses exactly like the whole-buffer feed
    (receiver's boundary is the header, not the message —
    WS-06); pieces split at any offset ≤ `WS_MESSAGE_CAP`
    reassemble losslessly;
  - consumption accounting: every parsed byte is either emitted as a
    chunk piece or retained in the pending buffer — nothing lost or
    duplicated across the walk;
  - the over-cap write rejection (`poll_write` > `PENDING_BUFFER_CAP`
    → `InvalidData` before queueing) is exact: no partial state, no
    silent truncation.
- **Exposure:** the pure parse helpers are extracted/testable; the
  pump functions are `pub(crate)` async — drives via a
  `#[cfg(fuzzing)]` re-export and a current-thread runtime with a
  mock sink (the alkcall `envelope_frame` Cursor pattern).

### Target 3 — `spec_import` (implemented 2026-09-29)

- **Drives:** raw bytes (and `json.dict`) → `serde_json`/`yaml_serde`
  → `OpenAPISpec::from_str` (JSON-first, YAML-fallback, ADR-051) and
  the typed helpers: `yaml_to_json_value` boundary, number/key
  conversion; plus `CompiledInputSchema::compile` +
  `harden_closed_by_default` + `validate` over attacker-shaped
  schemas and input values; plus `FromMCP::build_spec` over arbitrary
  `Tool`-shaped JSON.
- **Invariants:** no-panic; parse failures are always clean
  `AdapterError::SchemaParse` naming a pointer (never a panic/silent
  null); the YAML normalization rejects loudly what
  `serde_json::Number` cannot represent (non-finite floats,
  non-string keys); `$ref` resolution errors on cycles instead of
  unbounded recursion; the compiled validator rejects/accepts
  consistently w.r.t. the schema; closed-by-default hardening pins
  `additionalProperties: false`; registry-compile shape parity with
  alkcall's `spec_parse` invariants (bounded compile, always
  `Result`).
- **Implemented shape:** the harness drives one attacker string
  through all four lanes — the three spec constructors (str/json,
  yaml under `openapi`), the direct YAML→JSON normalization boundary
  (merge keys applied; a value the boundary accepted can't contain
  non-finite numbers — serde_json-invariant, asserted recursively),
  the compile/harden/validate lane against the whole doc (hardening
  partition: injected iff absent and the input is an object;
  validate determinism probe with an unknown-key input; deterministic
  two-call agreement), the MCP tool-shape lane (the doc and a
  `{name, inputSchema}` wrapper through `serde_json`→`Tool`→
  `build_spec`; success pins the namespace prefix), and the `$ref`
  lane (`resolve_refs_recursive` over the raw doc + declared
  component schemas when the doc parses). Exposure via
  `fuzzing` hubs alongside the wave-1 one:
  `openapi_spec::fuzzing`, `input_validation::fuzzing`
  (an opaque `FuzzCompiledValidator` newtype so the `pub(crate)`
  validator never leaks), `from_mcp::fuzzing` (`mcp` feature).
  The shared crate gates `openapi`/`mcp` (both on by default, riding
  the main crate's default build); corpus replay passes both with and
  without.
- **Note:** yaml_serde (ADR-051: YAML 1.2 + merge keys) is the
  deepest third-party parse we own — the campaign should also encode
  the already-documented boundaries (`apply_merge` error path,
  duplicate-key rejection with line/column) as corpus expectations.
  42 committed seeds cover the menu below.

### Target 4 — stateful wave (implemented 2026-09-29)

- **`ws_session_opseq`:** `#[derive(Arbitrary)]` op sequences over
  the WS byte adapter driven end-to-end (like alktty's
  `session_opseq` / alkcall's `manager_routing`): write-side ops
  (well-formed chunks, oversize headers, the pending shape),
  read-side ops (binary deliveries, dribble, text, inbound read
  error, peer close), a lane-healthy requested close, shutdown vs
  close ordering, backpressure scaled 1..=8 read slots. Asserts:
  lossless inbound forwarding (forwarded == delivered exactly after
  the teardown joins, prefix mid-sequence), the WS-01 walk's
  completed-chunk count vs the declared frame count, the loud-gate
  close mapping (1002/1011/verbatim-requested + a per-cause reason,
  WS-15), lossless write framing (outbound concat == the declared
  chunk stream incl. the FWD-21 failure-carry), lane-failure
  isolation (the alkcall 0.8.1 class), and pump termination within
  the harness bound. Exposure: `byte_adapter::fuzzing`
  (`FuzzMockSocket` flavor, `FuzzChannels`/`FuzzWriteSide` channel
  bundle, pump spawn funnels, `FuzzInboundChunkProgress`).
- **`retry_throttle`:** bounded-map growth of the inlined
  `RetryAfterMiddleware`: capacity bound (exact, distinct-URL
  observable partition), expired-first + Farthest-future eviction
  policy, ceiling clamp (deadline never grows past the ceiling of
  the record moment), refresh contraction (a higher `Retry-After`
  never extends the first-seen deadline; the missing-header refresh
  is a documented no-op), `Retry-After` parse partition
  (non-negative seconds ∪ future HTTP dates, post-clamp), and the
  jitter bounds (≤ 25% of a short wait, capped at 2 s). Op sequences
  of records/refreshes/queries/rebuilds with seconds, huge-seconds,
  HTTP-date, past-date, garbage, and no-header shapes. Exposure:
  `client::fuzzing` (constructor, synthetic throttled response,
  record/deadline/parse/jitter funnels — the middleware map never
  leaks).
- Sequenced after 1–3 stabilize, per the sibling pattern.

## 4. Corpus policy

Committed hand-made seeds per target, generated by
`fuzz/gen_fuzz_seeds.py` (deterministic, in-tree, quiche pattern);
grown corpora and artifacts gitignored. Seed menus:

- `sse_parser`: a minimal valid event; every framing edge (`data:`
  multi-line joins, `event:` override, comment, `id:`, `retry:`,
  BOM, CRLF/LF, field with no colon, `data` with no space);
  truncation at every structural prefix; split at a UTF-8 multibyte
  boundary; cap-boundary event (`SSE_EVENT_BUFFER_CAP - 1`,
  exactly at cap, one over); an over-cap trailing line; EOF with
  pending data / pending no-data; empty stream; pure whitespace.
- `ws_chunk_framing`: a minimal valid chunk (`[id:u32 BE][len:u32
  BE][payload]`); `len = 0`, `len = MAX_CHUNK_LEN`,
  `len = MAX_CHUNK_LEN + 1`, `len = u32::MAX`; truncation at every
  prefix length (1–8 bytes); chunk split across a message boundary
  at every offset; channel-id 0 (the control channel); a header
  claiming big length whose payload never arrives (the pump-wait
  shape); the >cap single write (`poll_write` rejection).
- `spec_import` (when built): a minimal valid OpenAPI doc (JSON);
  the same doc as YAML; missing `info`/`paths`; a deep-nesting
  probe; duplicate-key YAML; `<<: *anchor` merge; `.inf`/`.nan`
  scalars; non-string map keys; a `$ref` cycle; an unreachable
  `$ref`; `additionalProperties` absent (hardening probe) and
  present both ways.
- Stateful seeds (target 4): the semantic fixtures the campaign must
  always replay — a write/echo flow, the oversize loud-gate after a
  clean chunk, the text-rejection + surviving write lane, an inbound
  read error, a peer close mid-flight + shutdown drain, a requested
  close, the throttle-map fill/evict cycle at capacity, the
  missing-header refresh no-op, hostile-seconds clamping, refresh
  contraction, and a mid-sequence rebuild (16 total; the
  `ws_session_opseq`/`retry_throttle` blocks in
  `fuzz/gen_fuzz_seeds.py`, hand-encoded against the `arbitrary`
  1.4.x derive layout with ceiling-division tags and per-element
  keep-going bytes, pinned by seed-decode tests).

## 5. Campaign + gate policy

Identical to the siblings (alkcall §7.9 posture; no hosted CI in this
repo):

- **Corpus replay is the standing fuzz gate:** `cargo test
  --manifest-path fuzz/shared/Cargo.toml` — in AGENTS.md's
  verification checklist.
- **Campaigns run detached** via `fuzz/run-detached.sh` (never a
  foreground child of an agent session); budget 10 min per target for
  a smoke campaign, 30+ min before a release or after touching the
  SSE parser, the WS adapter, or the import adapters.
- **Grown corpora stay gitignored**: the hash-named files a campaign
  drops into `fuzz/corpus/<target>/` after run-detached runs are
  ignored via a hash-pattern (the committed `seed-*` files stay);
  merge worthy entries into seeds only deliberately.

Wave-1 smoke campaign results (2026-09-29, 10 min per target, both
exited 0, artifact dirs empty — no crash/hang/OOM/leak):

- `sse_parser` — 18.9k execs at ~30/s (each exec replays the
  whole-feed + 3-byte-split + cap-probe + envelope-mapping +
  round-trip chain, so per-exec work is heavy), coverage 1100 edges /
  9510 features / 807 in-memory corpus entries, still discovering when
  the budget ended — longer campaigns keep paying.
- `ws_chunk_framing` — 4.8M execs at ~9k/s, coverage saturated at 245
  edges / 1071 features / 136 corpus entries.
- **Seeds regenerate deterministically:** `python3
  fuzz/gen_fuzz_seeds.py`.
- Toolchain notes live in `fuzz/README.md`; nightly stays confined to
  `fuzz/`.

Wave-2 (`spec_import`) smoke campaign (2026-09-29, 10 min, exited 0,
artifact dirs empty):

- `spec_import` — 2.34M execs at ~4k/s (each exec replays the three
  spec constructors + the YAML boundary + compile/harden/validate +
  the MCP tool lane + `$ref` resolution, so per-exec work is heavy),
  coverage still growing at budget end: 14.1k edges / 36.9k features
  / 3046 in-memory corpus entries. One early abort in the *first*
  launch, a harness assert too strong for the documented boundary
  (an explicitly-quoted `""` YAML mapping key is legal — JSON
  has the same key; the nullish-key rejection covers the implicit
  null key, not a quoted empty string), fixed before the counted run;
  no crate finding.
- **Seeds regenerate deterministically:** `python3
  fuzz/gen_fuzz_seeds.py`.
- Toolchain notes live in `fuzz/README.md`; nightly stays confined to
  `fuzz/`.

Wave-3 stateful smoke campaigns (2026-09-29, 10 min per target, both
exited 0, artifact dirs empty — no crash/hang/OOM/leak; the first
`ws_session_opseq` launch aborted at 17 s on FWD-21, fixed before
the counted run):

- `ws_session_opseq` — 206k execs at ~340/s (each exec interleaves up
  to 64 two-lane ops with yield quiesce points per exec, so per-exec
  work is heavy), coverage 2251 edges / 5831 features / 232 in-memory
  corpus entries — coverage still growing at budget end.
- `retry_throttle` — 897k execs at ~1.4k/s, coverage saturated at
  1154 edges / 6925 features / 324 corpus entries.
- **Seeds regenerate deterministically:** `python3
  fuzz/gen_fuzz_seeds.py`.
- Toolchain notes live in `fuzz/README.md`; nightly stays confined to
  `fuzz/`.

Wave-4 release-budget campaigns (2026-09-29, 45 min per target,
launched concurrently, five of five):

- `ws_chunk_framing` — exited 0: 13.7M execs at ~5k/s, coverage
  saturated (297 edges / 1216 features / 139 corpus).
- `spec_import` — exited 0: 6.85M execs at ~3.2k/s, coverage growing
  to budget end (14.9k edges / 43.4k features / 3946 corpus).
- `ws_session_opseq` — exited 0: 715k execs at ~253/s, coverage
  growing to budget end (2251 edges / 6337 features / 260 corpus).
- `retry_throttle` — exited 0: 3.3M execs at ~1.3k/s, coverage
  saturated (1154 edges / 7071 features / 352 corpus).
- `sse_parser` — aborted at 1913 s on FWD-22 (above; the
  interior-CR round-trip loss, a harness fix); before the abort it
  had 57k execs at ~35/s (1269 edges / 5584 features / 509 corpus),
  still growing. 45-min rerun post-fix exited 0: 96k execs at ~33/s,
  coverage still growing at budget end (1378 edges / 6655 features /
  734 corpus) — zero findings.
- A stale crash artifact from the wave-2 morning session (quoted-`""`
  YAML key, predating that fix) was still present in
  `fuzz/artifacts/spec_import/` at campaign start — not produced by
  wave 4 (the wave-4 `spec_import` log has zero findings).
- **Seeds regenerate deterministically:** `python3
  fuzz/gen_fuzz_seeds.py`.
- Toolchain notes live in `fuzz/README.md`; nightly stays confined to
  `fuzz/`.

1. ✅ **Done (2026-09-29, commit 5971c0a)** — infra (workspace
   exclude, toolchain pin, runner, seed generator, README) + targets
   1–2 + corpora + corpus replay + AGENTS.md gate + smoke campaigns
   (clean, see §5). Includes the FWD-20 SSE dribble quadratic fix.
2. ✅ **Done (2026-09-29, commit e6491e3)** — target 3
   (`spec_import`): harness + invariants
   (`fuzz/shared/src/spec_import.rs`), 42 seeds, `json.dict` extended
   with the OpenAPI-token set, fuzzing hubs in the three driven
   modules. Smoke campaign clean (see §5).
3. ✅ **Done (2026-09-29, wave 4)** — long (45 min) release-budget
   campaigns, all five targets, all exited 0 (see §5; the one
   finding, FWD-22, was a harness-assert fix, fixed + re-run clean in
   the same wave). Corpus merges remain deliberately deferred (grown
   corpora stay gitignored; nothing campaign-dropped has been curated
   into seeds).
4. ✅ **Done (2026-09-29, wave 3)** — target 4 stateful
   (`ws_session_opseq` + `retry_throttle`): two harnesses + 16 seeds
   + the `byte_adapter::fuzzing` / `client::fuzzing` hubs + FWD-21
   (the `WriteChunkWalk` failure-carry drop — a crate contract fix;
   user-approved semver-relevant API change). Smoke campaigns clean
   (see §5).

Status updates land in §3's table and §6's list as work completes.