NO MERGE -- all the automatic bugfixes in a single branch Part 3 - #118

Draft

imlvts wants to merge 73 commits into

Adam-Vandervorst:masterfrom

imlvts:fuzz-fixes-v3

Commits on Sep 17, 2026

Fix ACTZipper::val_count counting from the zipper root, not the focus

imlvts
and
claude
committed
350cdd8
Give ACTZipper::to_sibling an answer for an off-trie focus

imlvts
and
claude
committed
9420b9e
Keep a value in subtract when the other side only passes through its byte

imlvts
and
claude
committed
3a98201
Fix graft_child_maps and graft_masked_branches (finding 15)

imlvts
and
claude
committed
3a16a57
Fix join_into replacing or misreporting a destination that holds the source

imlvts
and
claude
committed
3e839e8
Drop dangling paths from meet results

imlvts
and
claude
committed
4062aa8
Make meet/join value bias independent of node layout

imlvts
and
claude
committed
3dae731
Fuzz: separate the ACT ascend_until defect from finding 9

imlvts
and
claude
committed
23d5d12
Fix ACTZipper ascend_until landing on the wrong stop above an off-trie focus

imlvts
and
claude
committed
315b41c
Report Identity from the dense restrict when nothing was dropped

imlvts
and
claude
committed
2d3b6f2
Return Identity from the integer psubtract when nothing was subtracted

imlvts
and
claude
committed
f8a4599
Answer a sibling step from a focus that is not in the trie

imlvts
and
claude
committed
3a2b499
Don't filter branches through a dangling path in remove_unmasked_branches

imlvts
and
claude
committed
ecd7e21
Drop an unvalidated dangling branch from the dense restrict

imlvts
and
claude
committed
e6ced6a
Don't report a change for dropping a shadowed dangling slot

imlvts
and
claude
committed
c882a38
Revive the Rust reference model, and bring it up to the current Lean one

imlvts
and
claude
committed
ff41532
Run the reference model against the crate in one process, and under AFL

imlvts
and
claude
committed
9833f0f
Name the trailer lines in the in-process fuzzer's own summary

imlvts
and
claude
committed
43e023f
Keep a dangling-child residue the classifier cannot see

imlvts
and
claude
committed
acc1bca
Say where AFL actually files a divergence on a stock Linux box

imlvts
and
claude
committed
af3638a
Stop skipping the sibling-byte moves at the zipper root

imlvts
and
claude
committed
46da390
Stop skipping insert_prefix with an empty prefix

imlvts
and
claude
committed
29da7ec
Compare restrict's status instead of masking it

imlvts
and
claude
committed
470eea8
Compare join_k_path_into's bool instead of masking it

imlvts
and
claude
committed
f99f40d
Drop the skip:quarantined vocabulary, which nothing declines by any more

imlvts
and
claude
committed
33bde3a
Correct the input counts the lifted-suppression notes claim

imlvts
and
claude
committed
6c065a4
Emit graft_child_maps in generated repros instead of a quarantine comment

imlvts
and
claude
committed
7842407
Emit insert_prefix with an empty prefix in generated repros

imlvts
and
claude
committed
1daf3ff
Drop a reached dangling slot from the dense subtract against a list or tiny node

imlvts
and
claude
committed
03626d0
Don't claim COUNTER_IDENT for a meet key that runs into an empty onward link

imlvts
and
claude
committed
618f8ce
Keep dangling paths in meet results, as master does

imlvts
and
claude
committed
a7bc950
Specify meet as an intersection of locations, and prune as dropping dangling paths

imlvts
and
claude
committed
75c869a
Compare meet with prune = false only; prune = true may skip shared nodes

imlvts
and
claude
committed
e014741
Test the meet rule for dangling paths (fails until the crate follows it)

imlvts
and
claude
committed
ada5458
Restore the node stack after prune_path without ascending

imlvts
and
claude
committed
6002fb9
Keep a byte both dense nodes have when its contents meet to nothing

imlvts
and
claude
committed
7662195
Never remove the focus in meet_into, and make prune drop dangling paths below it

imlvts
and
claude
committed
96088cf
Meet list nodes slot by slot, keeping the part of each key both sides have

imlvts
and
claude
committed
15a392d
Give each shrink.py process its own temp file

imlvts
and
claude
committed
f3365be
Keep the first k-path's value when drop_head reorders a list node's keys

imlvts
and
claude
committed
98b9ded
Find the onward child in either slot when stepping to a previous list-node sibling

imlvts
and
claude
committed
a6940e8
Make the repro generator skip and call exactly what the harness does

imlvts
and
claude
committed
e28448e
Report Identity when subtract_into drops only an empty link beside a value

imlvts
and
claude
committed
9f382a6
Add a crash-only fuzz mode for the API the differential harness cannot reach

imlvts
and
claude
committed
342426b
Write down the crash-only fuzzer's findings

imlvts
and
claude
committed
10a6332
Fix ZipperHead exclusive path at the head's own root

imlvts
and
claude
committed
00b5174
Fix zipper_head on a write zipper with a borrowed path

imlvts
and
claude
committed
8c937f8
Fix get_trie_ref on a read zipper that owns its root

imlvts
and
claude
committed
3158a51
Fix ProductZipper is_shared at a factor root

imlvts
and
claude
committed
c0f178a
Fix ProductZipper::val_count outside the last factor

imlvts
and
claude
committed
374dba7
Fix graft_child_maps below a long root path

imlvts
and
claude
committed
3cddba7
Fix get_val_with_witness at an owned zipper's root

imlvts
and
claude
committed
b20bcfb
Fix PrefixZipper::descend_first_k_path with k = 0 in the source

imlvts
and
claude
committed
59edba9
Fix UB joining a list node with a cell node

imlvts
and
claude
committed
8905e7c
Fix ZipperHead exclusive paths over an empty node

imlvts
and
claude
committed
6c56544
Fix the default k-path walk looping forever at a leaf

imlvts
and
claude
committed
7f9c59a
Fix ProductZipper factor bookkeeping at the root

imlvts
and
claude
committed
96bfa48
Fix product zipper sibling steps at the root

imlvts
and
claude
committed
169afc9
Fix OverlayZipper focus_byte at the root

imlvts
and
claude
committed
bfd2d0e
Fix OverlayZipper::descend_to_val when the second source stops first

imlvts
and
claude
committed
3c4e277
Fix PrefixZipper over a source rooted at a missing path

imlvts
and
claude
committed
0080b69
Fix TrieRef lookups with a node key longer than its buffer

imlvts
and
claude
committed
3de7914
Fix merkleize with several dangling paths

imlvts
and
claude
committed
6dfde49
Fix exclusive zippers rooted at an emptied link

imlvts
and
claude
committed
503a43c
Fix PrefixZipper fork rooted at the focus

imlvts
and
claude
committed
24f3125
Allow empty child nodes when joining dangling slots

imlvts
and
claude
committed
9954e44
Fix use-after-free between ZipperHead readers and writers

imlvts
and
claude
committed
bd41c79
crash_fuzz: rerun signal crashes alone, trace more

imlvts
and
claude
committed
bda1eac
Fix ProductZipper sibling step failing at a factor root

imlvts
and
claude
committed
9b8d9ad
Fix TrieRef::is_shared on an empty node

imlvts
and
claude
committed
460ff78
Fix list node join of two empty children under one key

imlvts
and
claude
committed
9e15a70
crash_fuzz: trace dangling paths, masks and paths

imlvts
and
claude
committed
6c4e2e5
CRASH_FINDINGS: note the fuzz-fixes-v3 fixes

imlvts
and
claude
committed
ee7546e