New libFuzzer/AFL++ harnesses, each trapping on an oracle violation:
p2p_json (nesting bound, round trip), p2p_connstr (endpoint round trip,
pin idempotence, no silent re-pin), p2p_handshake (validators and the
full acceptor bind the TLS peer), p2p_delta_stream (batch, session and
bootstrap receive paths stay inside count and byte budgets), p2p_inbound
(the manager inbound session through registry update) and
topology_codec (decoded snapshots re-encode losslessly). p2p_delta now
draws its exchange limits from the input.
p2p_seeds.py writes framed-session seeds for FuzzedDataProvider layouts,
dicts/p2p.dict carries the frame vocabulary, generate_corpus.sh accepts a
local seedgen, and fuzz.sh no longer fails on macOS bash 3.2 when a
target has no dictionary. The generated corpus stays untracked.
The fuzzing subdirectory skipped itself unless the compiler was AFL++,
so fuzzers could only be built inside the Docker image and no quick
local or CI run was possible. With -Dbuild-fuzzers=true a clang that
links the libFuzzer runtime now selects libFuzzer: project objects get
-fsanitize=fuzzer-no-link plus ASan and UBSan unless b_sanitize is set.
AFL++ builds keep their previous flags.
fuzz.sh gains a 'local' command that runs a libFuzzer target over its
seed corpus and passes a dictionary when tools/fuzzing/dicts has one.
Add libFuzzer/AFL++ harnesses for the direct-P2P handshake/state/history and
delta/bootstrap control parsers. Fuzzers invoke the same production parser
seams as the live wire path, so coverage cannot drift from real validation. A
protocol-v3 seed exercises exact-version rejection after the v4 upgrade. Bound
noninteractive AFL++ campaigns with AFL_FUZZ_SECONDS and register focused
fuzz-smoke tests without duplicating broad protocol/delta registrations.
Clarify that peer/cycle status is local health telemetry rather than global
convergence, and document the remaining decision-grade live-performance gate.
Signed-off-by: trvon <git@trevon.dev>
