[rowan-claude]

The hostile-read fuzzer used one scalar sentinel, skipped the boolean destination check, and tested terminality only with a one-bit read. A fresh boolean destination clobber and an int64 operation that incorrectly succeeded after refusal each passed the old oracle. This change adds complementary full-width destination patterns, checks boolean and 128-bit destinations, admits empty payloads, and independently probes zero-bit operations after every refusal.

The deterministic gate proves first-refusal coverage for 28 named read cases under both patterns, including later members of grouped wide/unsigned reads and the read after an accepted end. Nine independent post-refusal probes cover degenerate int/int64/int128/fixed/fixed128, alignment, empty bytes, end, and object composition. Each checks result, position, reason, and scalar destination or callback invocation.

Sixteen source controls modify private copies of the actual reader: seven destination writes that preserve the first pattern, plus one broken latch for each of the nine zero-bit APIs. Each must fail the same primary oracle with its expected diagnostic. CI runs replay and all controls with assertions enabled and disabled. Production sources and wire bytes are unchanged.

Validation on Linux Hulk, Temurin 21.0.12.1+1, Java 17 language level:

• Before/after probes: the old oracle accepts the planted boolean clobber and broken int64 latch; the repaired checks detect both.
• make test test-release controls: 576 tests/14,534 checks checked; 562 tests/14,406 checks release; all 18 conformance controls hold.
• make fuzz-sentinel-controls: 7,777 inputs, 28 first-refusal cases under each pattern, and 32 expected control detections across checked/release.
• Oracle counterfactuals: removing the destination assertion lets the planted boolean pass; removing first-refusal recording makes the coverage gate fail with named missing cases.
• Pinned Jazzer 0.30.0 controls: roundtrip asymmetry caught in 4 seconds; hostile range defect in 5 seconds, with expected diagnostics.
• Final ten-second hostile Jazzer budgets: 233,845 checked executions and 174,945 assertions-off executions; no findings. The unchanged roundtrip target also passed 47,029 executions. These bounded runs are not exhaustive security proof.

Logs are retained in /tmp/stella-serialize-java-cold-20261102/review-logs/ on Hulk. Source workspace: /Volumes/nova/ai/stella/working/serialize-java-cold-20261102 on Studio.