# Fuzzing alktunnels: Proposal and Plan

**Status:** adopted; wave-1 complete (`datagram_codec` +
`params_parse` implemented, seeds committed, two 10-min campaigns
clean, two harness-model findings fixed; see §7); wave-2
(`session_pumps`) implemented and campaigning (see §3.3/§7).
Campaigns run via the detached runner (§6), **never as a foreground
child of an agent session** (§5).
**Date:** 2026-09-28
**Upstream precedent:** `/workspace/@alkdev/alkcall/docs/research/fuzzing.md`
(0.8.0 to 0.8.1 campaign; one real finding: duplicate adopt/open destroying
the live channel, fixed in 0.8.1). Tooling, corpus policy, runner, and the
no-hosted-CI posture are inherited from that doc wholesale: this doc does
not re-litigate them; it scopes them to this crate.

---

## 1. Should this crate be fuzzed?

**Yes, but scoped smaller than alkcall's.** The decision follows from
three lines, all pointing the same way:

1. **alkcall's fuzz doc already assigned this to us.** Its §5
   "non-surfaces (deliberately)" note ends: *the channels layer carries
   opaque `Bytes` and the handler owns sub-stream framing (ADR-035);
   those downstream parsers are downstream crates' fuzz targets.* Our
   `wire.rs` datagram codec IS that named downstream target. Fuzzing it
   completes alkcall's fuzz scope rather than duplicating it.

2. **We own one hand-rolled parse surface of exactly the covered class.**
   `DatagramReader::feed` (`src/wire.rs:100`) is an incremental
   length-prefix state machine reassembling `[len: u16 BE][payload]`
   frames across arbitrary chunk boundaries: length arithmetic and
   boundary handling, the dominant rust-fuzz trophy-case classes. It is
   sync, pure, allocation-light, and infallible **by contract** (the
   decode direction cannot fail; oversize is rejected at frame time),
   and a fuzz target is how that contract is *demonstrated* rather than
   believed.

3. **The stateful DoS class applies to us directly.** One pre-fuzz
   code-review candidate, the analog of alkcall §6.2-1 (the
   early-arrival key-space): `DatagramHalves.pending`
   (`src/consumer.rs:78`) queues every datagram decoded from a chunk
   beyond the one returned to the caller. A single 16 MiB chunk of
   `[00 00]` pairs = ~8.4 M empty datagrams → ~8.4 M `VecDeque`
   entries (≈ 400+ MiB) from ONE peer chunk, a ~25–50× memory
   amplification riding a bounded channel buffer. Example-based tests
   structurally cannot find this; a byte-sequence target with a
   pending-bytes assertion will.

**The honest caveat** (mirroring alkcall §1): the highest-value alkcall
targets (envelope framing, chunk header, demux, manager) are upstream
and now fuzzed (0.8.1). Our params parsing is serde + registry-side
jsonschema (upstream's `spec_parse` target covers attacker-shaped
schemas compiling at registration). Expected yield here: datagram-codec
pathologies, the pending-queue bound (§1.3), serde/untagged-enum edge
cases in params, and lifecycle invariants in the two-pump shape. That
is worthwhile, not five-targets-worth of new machinery on day one,
hence the two-wave scope in §4. If the first campaigns find nothing,
that is the successful-negative-result posture alkcall's §1 codified:
"we think the codec is robust" becomes a demonstrated property, and the
targets become regression protection for a wire-stable format
(ADR-003).

## 2. Toolchain (inherited, not re-decided)

Identical to alkcall §4: **cargo-fuzz 0.13.2 + `arbitrary` 1.4.x**,
nightly confined to the `fuzz/` subtree via `fuzz/rust-toolchain.toml`,
the crate itself stays stable at MSRV 1.88. AFL optional/deferred;
bolero deferred (same async-friction argument); libafl/honggfuzz/OSS-Fuzz
not adopted. Sanitizer: `--sanitizer=address` with debug assertions
(cargo-fuzz defaults); no MSAN (no `unsafe` in this crate).

**Layout (the alkcall pattern, load-bearing):**

```
fuzz/
├── Cargo.toml            alktunnels-fuzz (nightly-only bins; own [workspace])
├── rust-toolchain.toml   pins nightly for this subtree only
├── fuzz_targets/         thin fuzz_target! wrappers (3-line each)
│   ├── datagram_codec.rs
│   ├── params_parse.rs
│   └── session_pumps.rs
├── shared/               alktunnels-fuzz-shared, the STABLE-toolchain library
│   └── src/…             invariant logic + corpus replay (§3)
├── corpus/<target>/      committed hand-made seeds (§3)
├── gen_fuzz_seeds.py     deterministic seed generator (quiche pattern)
├── run-detached.sh       §6 detached runner (CWD-independent)
└── README.md
```

- **Invariant logic lives in `fuzz/shared/`**, not inline in the target
  binaries: the stable-toolchain corpus replay
  (`cargo test --manifest-path fuzz/shared/Cargo.toml`) runs the SAME
  invariant functions the fuzzer runs, on stable, in the release
  verification checklist. This is CI tier-3's deliverable (alkcall
  §7.2) minus automation; per alkcall §7.9 this repo has no hosted CI
  and will not get one (same gitea posture); corpus replay as plain
  `cargo test` is the fuzz gate.
- **Root `Cargo.toml` needs the explicit `[workspace]` table**
  (`members = ["."]`, `exclude = ["fuzz"]`) and `"fuzz/"` on the
  publish exclude list; without it cargo auto-discovers `fuzz/shared/`
  into the main workspace and the MSRV toolchain tries to build the
  nightly-consumed dev-deps (the exact failure alkcall hit).
- **Corpus policy:** commit hand-made seeds, gitignore grown corpora
  (quinn/h2 model). Seeds per target: valid frames, truncation at every
  short prefix length, `len = 0` / `len = MAX` / `len = MAX+1`, empty
  datagrams, batching (two frames per chunk), splitting (one frame per
  many chunks), and for params: every substrate value, unknown
  substrate, unknown/missing fields, `listen: 0`, malformed reply
  shapes, untagged cross-shape targets, deep/invalid JSON.

## 3. Invariants by target

### 3.1 `datagram_codec` (wave 1)

Input: raw `&[u8]` (and in the shared logic, chunk-slice parameter
arbitrary). Drives `DatagramReader::feed` + `frame_datagram`
(`src/wire.rs`). Invariants:

- **no-panic on any byte sequence** (the baseline; the one
  `unreachable!` in `feed` is a structural invariant of the state
  machine; the target is how it stays true).
- **infallibility**: `feed` never errors (contract: oversize is
  rejected at frame time; the decode direction is infallible by
  design, `src/wire.rs` docs).
- **datagram-size bound**: every yielded datagram is
  `<= MAX_DATAGRAM_LEN` (u16 frame field makes this structural; the
  target pins it against future refactors).
- **no partial yields**: a datagram completes only when exactly
  `declared` payload bytes are buffered (`is_mid_datagram` observable
  consistency); `feed(&[])` never yields anything and never clears
  mid-datagram state.
- **round-trip**: `feed(frame_datagram(x)) == [x]` for any x; the
  reverse direction `write(feed-parse(x))` re-frames to the same
  frame for any well-framed input.
- **F-2 sentinel layering**: `len == 0` is a legal empty datagram,
  never EOF; the codec never emits zero-length datagrams for non-empty
  frames and never treats an empty datagram as stream end.
- **consumption accounting**: re-framing all consumed bytes and
  feeding the byte-level remainder yields the same datagram stream
  (splitting a feed at any boundary is transparent).
- **oversize frame rejection**: `frame_datagram` errors iff payload >
  `MAX_DATAGRAM_LEN`, echoing the sizes.
- **pending-queue bound (the §1.3 finding-class assertion)**: total
  bytes retained across `buf` + `current` + `pending` after a feed is
  bounded by the fed chunk size plus the one in-flight frame, so
  an adversarial peer chunk cannot force unbounded queue growth in
  the decoder state. (NOTE: this is the *decoder-state* bound; the
  consumer-side `DatagramHalves.pending` backlog between chunk-read
  and `recv_datagram` pulls is a session-shape question tracked in
  §4/§8 (the wave-2 stateful target, or a code fix if the bound is
  judged unacceptable. The fuzzer documents the amplification factor;
  the remediation decision is ours. **Wave-2 resolution (§3.3):** the
  session-shape backlog is now an asserted invariant: the harness's
  per-op drain holds the pending queue to the routed-batch remainder
  (≤ one chunk's worth of batched datagrams, drained by
  `recv_datagram` pulls), so the amplification question is bounded
  by construction + assertion rather than remediated; the
  `datagram_backlog()` diagnostic exposes the live count.)

### 3.2 `params_parse` (wave 1)

Input: raw bytes → `serde_json` (with alkcall's bounded
`arbitrary_value` approach, depth/width-capped `Value` generation) →
`TunnelParams` / `TunnelDirectParams` / `TunnelForwardedParams` /
`SubstrateAddr` deserialization + `parse_listen_reply` /
`listen_reply_fields` (`src/params.rs`). Invariants:

- **no-panic on any JSON-shaped input** (untagged-enum serde dispatch,
  `deny_unknown_fields`, the `positive_u32` pin).
- **clean failure only**: parse failures are `Err`, never panics;
  `parse_listen_reply` returns `TunnelError::MalformedReply` on
  malformed shapes.
- **round-trip for valid params**: `from_json(to_json(p)) == p` for
  constructed params of every substrate.
- **deny-unknown posture**: unknown top-level fields reject;
  untagged-variant leniency (extra fields inside a `SubstrateAddr`
  variant) is the documented asymmetry (asserted, not "fixed").
- **the `listen: 0` pin**: zero rejects at serde level.
- **projection agreement**: `listen_reply_fields` yields both-`Some`
  iff `parse_listen_reply` is `Ok`; it never panics and never refuses
  construction (the lenient view projects malformed to both-`None`).
- **establishment-reason surface**: `establishment_reason` never
  panics on arbitrary `ChannelOpenError` shapes.

### 3.3 `session_pumps` (wave 2)

Input: op sequences (`#[derive(Arbitrary)]` `SessionSequence`, the
`manager_routing` pattern) over one live channels stack per exec:
MuxRunner → raw chunk stream → the real `run_demux_loop_for_client`
demux → `ChannelManager` per side (producer Connect / consumer
Accept over one duplex transport, the reverse POC's topology). Ops:
`Route` (producer→consumer framed datagrams / raw stream bytes via
`route_payload`), `AdoptDatagram` / `AdoptStream` (the
`TunnelSession` data-plane mirrors: codec reader + `pending`, and
`pump_bidi` against in-process peer halves), `Pump` (peer→channel;
`len == 0` drops the p2c source, the EOF path), `Teardown`,
`ClearAll`. Invariants:

- **no-panic / no-wedge on any op sequence** (the baseline; the
  harness's 5 s reconcile bound turns a wedged pump into a finding,
  and §5's `-timeout=25` fork containment is the outer net).
- **two-pump shutdown-on-completion (convention 8)**: after the p2c
  source drops, the pump's channel-side shutdown must propagate and
  the pump must complete once the teardown EOFs the c2p source,
  pinned by the `reconcile` join with the 5 s bound.
- **lossless p2c copy**: the pump's `p2c` count equals exactly what
  the harness pushed into the peer half (copy never truncates).
- **EOF-sentinel teardown semantics**: after a sentinel (teardown /
  `clear_all`), the reassembled stream drains its queue before
  reporting EOF, with every routed datagram consumable and nothing
  lost;
  the consumer map empties; the codec's `len == 0` sentinel layering
  holds at the session layer (a routed empty datagram is data; the
  channels EOF is a separate mechanism).
- **FIFO reconciliation**: every complete frame routed through the
  real demux path arrives as exactly one datagram of the declared
  length, in order (the model walks the framing as the codec does,
  the wave-1 F-2 walk reused at the session layer).
- **pending-queue bound (the §1.3 finding-class assertion)**: the
  session-shape `DatagramHalves.pending` backlog never exceeds the
  unrouted remainder (i.e. the backlog holds only datagrams decoded
  from routed chunks beyond the ones consumed; with the harness's
  per-op drain the queue returns to zero after every op, so an
  amplification factor > 1× chunk size would trip the assert. (The
  wave-1 decoder-state bound re-asserted per op alongside.)
- **monotonicity**: the manager's early-arrival / dropped counters
  survive `clear_all` (the alkcall §7.7 pattern), and the consumer
  map empties on the transport-EOF path.

Bounds: 128 ops, ≤ 512-byte payloads (generator-clamped; the codec's
`MAX_DATAGRAM_LEN` stays the wire bound). Even-id masking (ADR-047
§5: the consumer is the Accept side; the producer allocates even).

## 4. Scope: two waves

**Wave 1 (complete):** the two targets above. Both drive already-
`pub` APIs, with no `#[cfg(fuzzing)]` exposure needed (matching alkcall's
experience where none of five targets needed it).

**Wave 2 (this session):** `session_pumps`, the stateful op-sequence
target over the two-pump tunnel shape in the alkcall `manager_routing`
style (`#[derive(Arbitrary)]` op enum; live mux + demux runners; the
alkcall harness lessons applied: even-id masking, drained-state
asserts). Drives: the `TunnelSession` data-plane shapes (the datagram
codec plane + the `pump_bidi` stream plane) over a REAL channels
stack: the two-pump shutdown-on-completion contract (AGENTS.md
convention 8), the EOF-sentinel teardown semantics, and the §1.3
backlog bound as byte-accounting invariants (§3.3). The
`forwarded_routing` correlation target stays deferred until the
assembly-side correlation registry (ADR-008 §3, assembly
bookkeeping) grows into this crate.

Sequencing mirrors alkcall §7.4: init + wave-1 targets → 10–30 min
campaigns per target via the detached runner → fix anything found →
wave 2 (`session_pumps`) → further targets when justified.

## 5. Operational isolation: campaigns never share fate with the agent session

**This is an environment constraint, not a nice-to-have** (upstream
doc §7.6, adopted verbatim as policy here). Agent sessions (opencode)
run fuzzer builds/campaigns through a bash tool that spawns the fuzzer
as a **child of the session's own process tree and cgroup**. A fuzz
run is precisely the workload shape that kills its own host:

- **OOM-killer shared fate**: the target's worst case IS unbounded
  allocation. If libFuzzer's soft RSS guard loses the race with the
  kernel, the OOM killer fires, and it picks the largest-RSS process
  in the cgroup, which can be the opencode server hosting the session.
  That is *recoverable* (sessions are recorded in a DB) but hugely
  derailing, since
  the session's live environment access dies mid-task.
  An OOM in a fuzz target must cost the fuzzer, never the session.
- **Fork bombs / CPU saturation**: `-fork=N` workers; a runaway
  campaign starves the session host.
- **Wedged targets**: a deadlock in an async harness would hang a
  foreground bash call forever.

Three layers of defense, cheapest first, **all mandatory**:

1. **libFuzzer soft limits (always on)**: `-rss_limit_mb=2048`
   `-malloc_limit_mb=2048` make libFuzzer exit cleanly (artifact
   recorded) before the kernel gets involved. Note the RSS limit is
   *soft* (polls `/proc/self/statm`); a fast huge allocation can beat
   it, and that is
   what layers 2–3 are for. Never `ulimit -v` with ASAN
   (it reserves terabytes of virtual address space); the ASAN-safe
   hard-limit recipe is `-fork=1`.
2. **Fork mode as blast-radius containment (default)**: `-fork=1`
   (or a small number) runs each input in a short-lived child, so a
   crash/timeout/OOM/leak kills only that child; the harness survives,
   records the artifact, keeps fuzzing. Also the deadlock answer: the
   per-input timeout kills the child, not the session's bash call.
3. **Process detachment from the session tree (MANDATORY for agent-run
   campaigns)**: never run fuzzing as a foreground child of the
   session. The runner script wraps `cargo fuzz run` in `setsid` +
   `nohup` + full redirection to a log file, which (a) removes the
   fuzzer
   from the session's controlling terminal and signal relation, (b)
   survives the session ending, (c) gives the agent a pollable log +
   artifact directory instead of a blocking call. Combined with fork
   mode, an OOM-class finding costs one child process.

**The runner** (`fuzz/run-detached.sh`, CWD-independent, since it
resolves its
own repo root):

```bash
#!/usr/bin/env bash
# Detached fuzzing runner for agent sessions: the campaign never runs
# as a foreground child of the session (an OOM in a target must cost
# the fuzzer, never the agent host), and survives the session ending.
set -euo pipefail
target="${1:?usage: run-detached.sh <target> [extra libfuzzer args...]}"
shift
runtime="${FUZZ_RUNTIME_SECS:-600}"
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
log_dir="$root/fuzz/artifacts"
mkdir -p "$log_dir"
log="$log_dir/${target}-$(date -u +%Y%m%d-%H%M%S).log"
cd "$root"
setsid nohup cargo fuzz run "$target" -- \
  -fork=1 -rss_limit_mb=2048 -malloc_limit_mb=2048 -timeout=25 \
  -max_total_time="$runtime" "$@" \
  >"$log" 2>&1 < /dev/null &
echo "pid=$! log=$log"
```

**Agent polling protocol** (never `wait` on the detached process from a
tool call; poll instead):

- `tail -n 50 fuzz/artifacts/<target>-*.log`: campaign progress.
- `ls fuzz/artifacts/`: `crash-*` / `oom-*` / `timeout-*` / `leak-*`
  artifacts are the findings.
- `pgrep -f "cargo fuzz run <target>"`: still running?
- One detached campaign per target at a time; log filenames carry the
  UTC timestamp.

**Flags worth pinning beyond the runner defaults**: `-max_len=65536`
on the codec target; `-use_value_profile=1`; a JSON token `-dict` for
the params target (alkcall's `json.dict` transfers as-is).

## 6. No hosted CI

Per alkcall §7.9, the standing policy applies to this repo identically:
no hosted CI will exist; do not add Actions/Gitea-Actions workflow
files. **Corpus replay is the fuzz gate as plain `cargo test`**:
`cargo test --manifest-path fuzz/shared/Cargo.toml` replays every
committed seed through the invariant functions; add it to the release
verification checklist (AGENTS.md). Campaigns run manually via the
detached runner (§6), e.g. before a release, or after touching
`src/wire.rs`, the consumer data planes, or `src/params.rs`.

## 7. Implementation log

- **2026-09-28, proposal adopted** (this doc). Wave-1 targets
  `datagram_codec` + `params_parse`; wave-2 deferred (§4).
- **2026-09-28, `alkcall` bumped 0.8.0 → 0.8.1.** Bug-fix release, no
  API/wire change; the fix (duplicate adopt/open no longer destroying
  the live channel) is directly relevant to this crate's
  `TunnelSession::adopt` path: the changelog's "open-op response
  replayed / id re-announced" scenario is our reverse path. Verification:
  full suite (135 passed), clippy, fmt, wasm check (§8 commands).
- **2026-09-28, wave-1 implemented.** `fuzz/` workspace laid out per
  §2 (nightly-pinned subtree, stable `fuzz/shared` library, runner,
  dict, generator); `datagram_codec` + `params_parse` targets over
  already-`pub` APIs, with no `#[cfg(fuzzing)]` exposure needed. One new
  public diagnostic: `DatagramReader::retained_bytes()` (the
  decoder-state byte count the §3.1 bound asserts against, in the
  `is_mid_datagram` diagnostic style). Seeds committed: 27 +
  69 generated (fuzz/gen_fuzz_seeds.py) + 1 campaign-found crash
  input promoted to `datagram_codec/seed-900` (see the finding below).
  Stable side: corpus replay green, shared crate clippy/fmt clean;
  main suite untouched and green; `cargo fuzz build` clean.
- **2026-09-28, first campaign finding: a HARNESS-model bug, not a
  crate bug.** The `datagram_codec` campaign crashed in its first
  minute on input `00 2b 01 00 00 05` (`fuzz/artifacts/datagram_codec/
  crash-e9ba284e…`, exit 77, fork-mode containment worked as
  designed: the harness parent survived and persisted the artifact).
  Analysis: the codec is CORRECT, since `00 2b` declares a 43-byte
  datagram; `01 00 00 05` is its in-flight payload; nothing is
  yielded. The invariant that tripped ("an empty datagram must come
  only from a [00 00] length header") was mis-modeled: it counted
  `00 00` byte pairs anywhere in the RAW stream, but a `00 00` pair
  sitting INSIDE a frame's payload region is payload, not a length
  header, which is exactly the same class as alkcall §7.7's probe (the
  harness claimed `4 + len` when the prefix counts only the body).
  Fix: the count now walks the framing as the decoder does (complete
  frames from the start; the walk stops where the decoder would be
  stuck mid-frame). The crash input is committed as seed-900 and
  replays clean; the campaign relaunched clean.
- **2026-09-28, second harness finding (caught by corpus replay,
  pre-campaign): `establishment_reason` is a pass-through extractor,
  not a validated table.** The params.rs doc names the pinned reason
  strings, but the upstream implementation (alkcall
  `channels/client.rs` `establishment_reason`) extracts
  `details.reason` AS-IS whenever the code is `channel:open_failed`,
  so
  a made-up reason is surfaced as-is by design, and validation is the
  consumer's job. The harness first asserted a closed set of reason
  strings and corpus replay tripped it on `made_up_reason` before any
  campaign ran. Invariant corrected to assert the extraction shape
  (Some iff code == `channel:open_failed` and reason is a string).
- **2026-09-28, second harness finding (same replay pass):
  `is_mid_datagram` means a partial DATAGRAM, not buffered header
  bytes.** A dangling 1-byte length prefix at input end is buffered
  header state (no frame in flight, `is_mid_datagram == false`);
  the harness first asserted `true` for that case. Corrected:
  mid-datagram iff the framing walk leaves a remainder ≥ 2 bytes
  (a parsed-but-unfinished payload), not `!= 0`.
- **2026-09-28, wave-1 campaigns run (10-min detached runs, §6 runner;
  `-fork=1 -rss_limit_mb=2048 -malloc_limit_mb=2048 -timeout=25`;
  codec with `-max_len=65536`, params with `-dict=json.dict
  -use_value_profile=1`). Both exited 0.**
  - `params_parse`: 3.14M execs (~5.3k exec/s), 33 fork jobs,
    `oom/timeout/crash: 0/0/0` throughout. Coverage 2049 edges /
    15.6k features; in-memory corpus 69 committed seeds → 3018
    entries; the serde/untagged-enum shape space was still expanding
    at budget end, so longer campaigns keep paying here.
  - `datagram_codec` (post-harness-fix): 827k execs, 33 fork jobs,
    `oom/timeout/crash: 0/0/0` throughout. Coverage saturated at 221
    edges (ft 1198); the 2-byte-header state machine is fully
    enumerated, matching alkcall §7.7's `chunk_header` saturation
    profile. Exec/s reads low (~400) because each exec replays the
    input through a ~35-feed 3-byte-sliced sequence alongside the
    whole-input feed; the state space is small and exhausted early.
  - The pre-fix `datagram_codec` run (the §7 finding above) crashed at
    job 4 and exited 77; fork-mode containment behaved as designed,
    with the harness surviving, persisting the artifact, and the run
    wrapping up. That artifact is the promoted seed-900.
  - Grown corpora (3018 params entries) were **not** merged into the
    committed seeds, since
    per the §2 policy, grown corpora stay
    gitignored.
  - Operational note for future sessions: `cargo fuzz run` returns
    before its last fork-mode children fully exit; a `pkill -f
    "cargo fuzz run <target>"` followed immediately by another
    `pgrep` of the same pattern can wedge a bash tool call on its own
    process match. Prefer `pgrep -af` to LIST, kill by explicit pid
    from the runner's echoed `pid=`, and never pattern-kill-and-recheck
    in one call.
- **NO crate bugs found by wave 1.** The two findings this session
  were both harness-model defects (§7 above), each invisible to
  example-based review and caught by fuzzing/replay: the alkcall §7.7
  "fuzzer as a harness-checker" pattern, confirmed. The §1.3
  decoder-state bound held everywhere: `retained_bytes()` never
  exceeded fed + one frame on any adversarial input. The session-shape
  `DatagramHalves.pending` amplification remains a documented
  §1.3/§4 note (wave-2's motivation), not a campaign finding, since
  the
  wave-1 targets assert the decoder, not the session pump.
- **2026-09-28, wave-2 implemented: `session_pumps` (the stateful
  two-pump/EOF-sentinel target, §3.3).** The harness mirrors
  `TunnelSession`'s data-plane shapes over one REAL channels stack
  per exec (MuxRunner → raw chunk stream → the real
  `run_demux_loop_for_client` demux → `ChannelManager` per side over
  one duplex transport; producer Connect / consumer Accept, the
  reverse POC's topology). Ops: Route/AdoptDatagram/AdoptStream/
  Pump/Teardown/ClearAll; invariants per §3.3. One diagnostic
  addition to the crate: `TunnelSession::datagram_backlog()` (the
  `DatagramHalves.pending` count the §3.3 bound asserts against, in
  the `retained_bytes()` diagnostic style) + a suite test pinning
  its rest states. Seeds: 8 committed (deterministic decode-scan
  hex patterns, the `manager_routing` precedent, since
  arbitrary ships
  no encoder) + 2 in-source semantic fixtures (the §1.3 batched-
  backlog probe; the W4 half-close shape). Two harness-model
  findings caught by corpus replay pre-campaign:
  - **the p2c-EOF pump-join wedge is the DESIGNED half-close
    shape, not a wedge.** The first `reconcile` draft awaited the
    pump after dropping only the p2c source, but the c2p pump's
    source (the channel read half) EOFs only via teardown, so the
    join legitimately blocked (the 5 s bound tripped). `pump_bidi`
    completes when BOTH pumps finish; the half-close contract is
    that the p2c completion shuts the channel side down (the
    observable), and the pump completes once the c2p source EOFs
    too. The harness now models exactly that: drop p2c source →
    teardown the entry → join with the 5 s bound. (The alkcall §7.7
    harness-checker pattern again: the fuzzer harness's first
    campaign-found crash in wave 1 and this replay catch are both
    harness-model defects, not crate bugs.)
  - **the stream-plane c2p accounting is asynchronous**: the pump
    writes channel→peer into the peer duplex while a far-end reader
    task counts; the reconcile join (after the pump completes) is
    when the count is final. First draft read it early. Fixed by
    reading after the reader task's join.
- **2026-09-28, third harness finding (campaign-found, fork-mode
  containment as designed): duplicate adopt is a LEGAL manager
  outcome, not a finding.** The first campaign crashed at ~49 s on
  `AdoptDatagram { channel_id: 0 }` after the id had already been
  adopted. `ChannelExists` is the manager's documented
  id-collision error, and my adopt arms treated every error as a
  finding. Fix: both adopt arms model the documented error table
  (`ChannelExists` / `TooManyChannels` are no-ops, exactly the
  alkcall `manager_routing` harness's treatment). The crash input
  is committed as seed-900 and replays clean; the campaign
  relaunched clean.
- **2026-09-28, fourth harness finding (second campaign): the
  harness modeled the producer→consumer path through the WRONG
  primitive.** The second campaign crashed at ~5 s on `Route`:
  raw-id addressing (`even_id` masked arbitrary ids; collisions +
  an `UnknownChannel`-class state the model didn't track), `len ==
  0` raw routes doubling as EOF sentinels mid-model, and
  (the structural one) `route_payload` was used as the producer's
  forward write. `route_payload` routes into the LOCAL manager's
  channel entry (the demux direction); the producer pump handler
  writes the channel's SEND half (the mux pump frames onto the
  transport). Bytes never reached the consumer. Rewrite (the real
  protocol shape, matching `manager_routing`'s op-vocabulary
  lesson): producer `Open` (`open_channel` allocates the id, the
  harness holds the send half, the pump handler's write side), 
  session-INDEX addressing (no masking, no collisions), `Adopt`
  consumes the producer-allocated id (the early-arrival drain is
  the real adopt-race path), `Route` writes the producer send half
  (the real wire path: mux pump → transport → consumer demux →
  reassembly), `Pull` (the `recv_datagram` pull pops the backlog +
  the model), and a STATEFUL framing model (partial frames persist
  across ops, with the wave-1 walk carried across ops). EOF sentinels
  now arise only from teardown/sender-drop (the real mechanisms),
  never from `len == 0` routes (F-2: a routed empty datagram is
  DATA). All committed session_pumps seeds regenerated by the
  rewrite (the old hex patterns decode against the new op enum);
  the semantic fixtures re-pinned. Verification of the fix: the
  campaign's 0-exec crash went away; batched frames now reconcile
  FIFO through the real two-manager stack.
- **2026-09-28, fifth + sixth harness findings (third campaign's
  first minutes): the two ClearAll modeling defects.** (5) A
  double-adopt of a live session panicked the harness's own guard,
  but a re-adopt of a LIVE id is the manager's documented
  `ChannelExists` outcome (a legal no-op; alkcall 0.8.1's
  insert-replace fix leaves the live entry intact). Modeled as a
  no-op. (6) A `ClearAll` followed by `Route` on the same session
  tripped the backlog reconciliation. The harness retired only the
  sessions whose ids appeared in `clear_all`'s RETURN value, but
  that value is the OPENER-LEDGER records (ADR-047 §7): adopted
  channels carry no ledger entry, so the set is empty while the map
  itself empties. The alkcall §7.7 lesson ("`drained.len() ==
  open_count()` is not an invariant"), learned again at this
  crate's layer: the map-empties assert is the ground truth; the
  harness now retires EVERY session on `ClearAll`.
- **2026-09-28, wave-2 campaign run (10-min detached run, §6
  runner; `-fork=1 -rss_limit_mb=2048 -malloc_limit_mb=2048
  -timeout=25 -max_len=4096 -use_value_profile=1`): exited 0.**
  228,676 execs (~380 exec/s; each exec replays up to 128 ops on a
  live two-manager stack with real mux/demux tasks), 32 fork jobs,
  `oom/timeout/crash: 0/0/0` throughout. Coverage 3427 edges /
  17,529 features / 1184 in-memory corpus entries and STILL
  EXPANDING at budget end (the op-interleaving space is much larger
  than the parser targets'), so longer campaigns keep paying. The
  two-pump contract held across every adversarial sequence: no
  wedged pump (the 5 s reconcile join), no lost datagram (the
  FIFO/backlog reconciliation), no premature EOF (the sentinel
  layering). The §1.3 backlog bound held everywhere: the
  `DatagramHalves.pending` queue never exceeded the
  routed-but-unpulled remainder.
- **NO crate bugs found by wave 2.** All six findings across waves
  1–2 were harness-model defects (four this session), each
  invisible to example-based review and caught by fuzzing/replay:
  the alkcall §7.7 "fuzzer as a harness-checker" pattern,
  re-confirmed. The stateful thesis is validated from the harness
  side: the harness defects themselves (double-adopt semantics, the
  clear_all ledger/map distinction, the route_payload direction)
  are exactly the interleaving-shape mistakes the alkcall §7.8
  campaigns caught in their own drivers.
- (progress appended as implementation proceeds; see git log)

## 8. Verification commands

```bash
cargo test                                    # main suite (stable)
cargo test --manifest-path fuzz/shared/Cargo.toml   # corpus replay (fuzz gate)
cargo fuzz build                              # in fuzz/ (nightly, ASAN)
fuzz/run-detached.sh <target>                 # campaigns (never foreground)
cargo clippy --all-targets -- -D warnings
cargo fmt --check
cargo clippy --manifest-path fuzz/shared/Cargo.toml --all-targets -- -D warnings
cargo fmt --manifest-path fuzz/shared/Cargo.toml --check
cargo check --target wasm32-unknown-unknown   # default crate stays wasm-clean
```

Campaign flags per target: `datagram_codec -max_len=65536`;
`params_parse -dict=json.dict -use_value_profile=1`;
`session_pumps -max_len=4096 -use_value_profile=1`.

## 9. References

- Upstream campaign + operational model (authoritative for tooling,
  runner, corpus policy, no-CI posture):
  `/workspace/@alkdev/alkcall/docs/research/fuzzing.md`
- alkcall 0.8.1 changelog: the finding our adopt path is exposed to
- This crate: ADR-003 (codec framing), ADR-002 (ALPN), ADR-007/008
  (direct/forwarded ops), `docs/architecture/wire.md`
- External: RUSTSEC-2026-0037 (quinn-proto, the maintainers'
  fuzzing-coverage statement), rust-fuzz trophy case, cargo-fuzz Rust
  Fuzz Book (all linked from the upstream doc's §9)