test: fuzzing, Miri, benchmarks, CI, and a strategy note; the journal refuses floats

Max-testing pass, ranks 4-6 and step 9 for ledger-core.

Fuzzing (rank 4): fuzz_op_sequence now drives balanced pairs, foreign
lines, periods, closes, and amounts from raw decimal bits, and asserts
the books stay valid (TB balances, posted entries validate, no draft in
a closed period); new fuzz_core_serde (every persisted core type
round-trips) and fuzz_store_open (a corrupt journal is an error, never a
panic); hangs count (-timeout=10). 54M executions; one crash:
- fuzz_journal_line: a number too big for an integer parsed as a float,
  and its canonical form (which the hash chain covers) re-canonicalized
  differently. The journal never holds floats (R-2), so the reader now
  refuses them (JournalLine::parse, used by every journal reader);
  regression a_journal_line_with_a_float_is_refused. Checked first: the
  real books' journal has none. Rerun: 13.2M executions, clean.
Seeds in fuzz/seeds/ (synthetic, minimal); the grown corpora stay out of
git. `just fuzz <target> <seconds>`.

Miri (rank 4): the core's unit, bridge, and invariant tests under Miri
(our code has no unsafe; rust_decimal and chrono do): no undefined
behavior. `just miri`. A pinned nightly (nightly-2026-10-01, with miri)
is now in mise.toml.

Benchmarks (rank 6): criterion (new dev-dependency: the playbook's Rust
benchmark tool; none existed) in benches/books.rs; baselines in
docs/testing.md. The store's per-command rehearsal clone costs ~1 ms at
10k entries. No budget yet, so nothing gates on them. `just bench`.

CI: .github/workflows/check.yml runs `just check` on every push;
scheduled.yml runs proofs, the GnuCash oracle, fuzzing, and mutation
weekly. Tools come from mise.toml.

docs/testing.md: every layer, its oracle rank, command, runtime, and
gate; benchmark baselines; the ASSUMED invariants for the owner to reject;
the gap list with triggers. docs/oracle.md's fuzzing paragraph had
claimed persistent corpora that didn't exist; corrected.

Also: ledger-import now inherits the workspace lints (nightly cargo
warned).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

justfile

@@ -40,12 +40,34 @@ prove:
     fi
     echo "Lean: $(wc -l <<<"$audit") headline theorems, standard axioms only"
 
-# Cross-check against GnuCash (an oracle, never the spec): random books through
-# wanderbooks and through GnuCash 5.10 in a pinned container. Needs Docker.
+# Random books through wanderbooks and GnuCash 5.10, compared exactly (Docker)
 oracle:
     docker build -q -t wanderbooks-gnucash-oracle oracle/gnucash
     cargo test -p ledger-core --test oracle_gnucash -- --ignored --nocapture
 
+# Fuzz one target for some seconds (nightly; corpus in fuzz/corpus/<target>)
+fuzz target="fuzz_op_sequence" seconds="300":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    # Call the binary directly: mise's shim would pin stable rustc.
+    fuzz=$(mise which cargo-fuzz)
+    cd fuzz && mkdir -p corpus/{{target}} seeds/{{target}}
+    # corpus/ grows (git-ignored); seeds/ holds the checked-in minimal inputs.
+    RUSTUP_TOOLCHAIN=nightly-2026-10-01 "$fuzz" fuzz run {{target}} corpus/{{target}} seeds/{{target}} -- \
+        -max_total_time={{seconds}} -timeout=10 -rss_limit_mb=2048
+
+# Undefined-behavior check of the core's tests under Miri (nightly)
+miri:
+    PROPTEST_CASES=4 MIRIFLAGS="-Zmiri-disable-isolation" cargo +nightly-2026-10-01 miri test -p ledger-core --lib --test kernel_bridge --test invariants
+
+# Mutation testing of the core: do the tests catch planted bugs?
+mutants:
+    cargo mutants -p ledger-core --exclude crates/ledger-core/src/proofs.rs -j 4 --timeout 120
+
+# Benchmarks of the core's hot paths (no budget gates them yet)
+bench:
+    cargo bench -p ledger-core --bench books
+
 # Build the release binaries (CLI, MCP server, GUI)
 build:
     cargo build --release -p ledger-cli -p ledger-mcp -p ledger-gui