Coverage-guided fuzzing (cargo-fuzz) for SaveFile::from_bytes and accessors

[kasbuunk]

The proptest panic sweep from issue #4 (75k+ cases, zero panics) is strong but not coverage-guided; a libFuzzer target explores byte patterns proptest's generators never produce, closing the last gap in the no-panic-from-file-contents guarantee for the wasm build where a panic is a DoS.

Instructions:

1. cargo fuzz init in crates/pksave with a target that runs from_bytes on arbitrary bytes, then walks every view/diagnostic like the existing sweep harness (reuse its accessor-walk function — extract it to a #[doc(hidden)] helper or a shared test-support module).
2. Seed the corpus with the e2e fixtures and new_empty() output; run locally ≥1 CPU-hour; commit the minimized corpus.
3. Optional CI: a scheduled short run (-max_total_time=300) — nightly-only since libFuzzer needs it; keep it off the PR path.

Alternatives considered
The existing proptest sweep already gates this class of bug and runs on stable in CI; this is defense-in-depth, priority low.
AFL++ works without nightly but integrates worse with cargo and CI.

[kasbuunk]

Coverage-guided fuzzing in place; ~1.5 CPU-hours clean. Scaffolding merged in #44, corpus in #48.

• Harness: crates/pksave/fuzz (nightly-only, its own workspace — stable CI untouched) with a save_walk libFuzzer target driving pksave::fuzz_support::exercise: from_bytes on arbitrary bytes, then a walk of every public view/accessor/diagnostic (party/box/daycare mon getters, HoF, items, trainer, pokédex, map, event flags), the untouched byte-identity round-trip asserted, then the file-value-driven mutating paths (fix_checksums→reload, per-box deposit/withdraw, recalculate_stats). The walk lives inside the crate as #[doc(hidden)] pub mod fuzz_support, so it can't drift from the API. (The Review: security — untrusted-input fuzzing, panic reachability, supply chain #4 sweep's walk was never committed, so this reimplements it as a permanent module.)
• Runs: 600,973 executions in a 40-min run + a second 2-worker run (~1.5 CPU-h total, -max_len=33000 to cover the 32 KiB minimum plus RTC-footer tails) — zero panics, zero artifacts. The no-panic-from-file-contents guarantee held under coverage guidance.
• Corpus: seeded with the e2e fixtures and all-0x00/0xFF hostile bases; cargo fuzz cmin → 318 units / 786 coverage edges, committed so future runs start from full coverage. Repro: cargo +nightly fuzz run save_walk -- -max_len=33000.
• Scheduled CI: not added, matching the Extend cargo-mutants beyond checksum/bcd/party to the full pksave crate #33 call — nightly toolchain on the runner + a job that can't be dispatch-tested from sessions (proxy-blocked) isn't worth the rot risk for defense-in-depth already gated by the stable proptest sweep. One documented command reproduces locally.

Alternatives considered: AFL++ (no nightly needed but worse cargo/CI integration, as the issue noted); leaving the corpus untracked (each future run would re-spend the CPU-hours rediscovering coverage).

---

Generated by Claude Code