Qualify hostile sentinel and terminality checks with source controls

.github/workflows/ci.yml

@@ -21,6 +21,7 @@ jobs:
       # reader with one refusal rule deleted fails exactly the vectors
       # conformance-controls/<rule>.expected names
       - run: make controls JDK_HOME="$JAVA_HOME"
+      - run: make fuzz-sentinel-controls JDK_HOME="$JAVA_HOME"
 
   # The coverage guided fuzz smoke, the reference's libFuzzer job in Java:
   # Jazzer (pinned, sha256 checked by the Makefile) drives the two targets in

Makefile

@@ -210,3 +210,28 @@ fuzz-read-control: $(JAZZER_JAR) $(FUZZ_CLASSES)/.stamp $(READ_SABOTAGE_CLASSES)
 
 clean:
 	rm -rf build
+
+# Deterministic hostile qualification is independent of Jazzer discovery. Both
+# destination patterns must reach every first refusal, including grouped reads.
+.PHONY: fuzz-replay fuzz-sentinel-controls
+fuzz-replay: $(FUZZ_CLASSES)/.stamp
+	$(JAVA) -ea -cp $(CLASSES):$(FUZZ_CLASSES) serialize.fuzz.HostileReadReplay
+	$(JAVA) -da -cp $(CLASSES):$(FUZZ_CLASSES) serialize.fuzz.HostileReadReplay
+
+# Planted destination writes preserve the first sentinel (the bits controls also
+# preserve the low half). Separate latch controls test each zero-bit API.
+fuzz-sentinel-controls: fuzz-replay
+	@set -eu; for ctl in bool bits bits64 float double int128 uint128 terminal-int terminal-int64 terminal-int128 terminal-fixed terminal-fixed128 terminal-align terminal-bytes terminal-end terminal-object; do \
+	  dir=build/fuzz-sentinel-controls/$$ctl; mkdir -p $$dir/src $$dir/classes; \
+	  $(JAVA) -cp $(FUZZ_CLASSES) serialize.fuzz.SentinelSabotage src/serialize/ReadStream.java $$dir/src/ReadStream.java $$ctl; \
+	  $(JAVAC) --release 17 -Xlint:all -Werror -cp $(CLASSES) -d $$dir/classes $$dir/src/ReadStream.java; \
+	  expected="a refused read wrote its scalar destination"; \
+	  case $$ctl in terminal-*) expected="$${ctl#terminal-}: accepted after refusal" ;; esac; \
+	  for mode in -ea -da; do \
+	    if $(JAVA) $$mode -cp $$dir/classes:$(CLASSES):$(FUZZ_CLASSES) serialize.fuzz.HostileReadReplay > $$dir/$$mode.log 2>&1; then \
+	      echo "sentinel control $$ctl $$mode survived"; exit 1; \
+	    fi; \
+	    grep -q "$$expected" $$dir/$$mode.log || { cat $$dir/$$mode.log; exit 1; }; \
+	    echo "sentinel control $$ctl $$mode caught the planted defect"; \
+	  done; \
+	done

README.md

@@ -164,10 +164,23 @@ make test-release  # the same suite with assertions off, the release shape
 make controls      # the negative controls: sabotaged readers must fail exactly their rule's vectors
 make fuzz          # the coverage guided fuzz targets, FUZZ_TIME seconds each (default 60)
 make fuzz-control  # the fuzzer's negative control: a planted asymmetry must be caught
+make fuzz-sentinel-controls # deterministic first-refusal replay and source controls
 ```
 
 ## Testing
 
+`make fuzz-sentinel-controls` replays 7,777 hostile inputs with assertions on
+and off. Both complementary destination patterns must reach the first refusal
+of all 28 named read cases, including later members of grouped reads.
+Seven copied-reader controls plant destination writes that preserve the first
+pattern; the same oracle must catch each under the second pattern. The integer
+controls include partial destination writes in the high and low halves.
+Nine further source controls prove independent post-refusal checks for
+degenerate integer/fixed ranges, align, zero bytes, end, and object composition.
+Each probe checks the result, position, reason, and scalar destination (or
+that the object callback was never invoked).
+
+
 `make test` runs the suite with assertions enabled (`-ea`): writer
 contracts are `assert` statements, so this is the checked shape.
 `make test-release` runs the same suite with assertions disabled — the