Harden configuration boundaries with fuzz coverage

docs/development.md

@@ -72,3 +72,14 @@ Once code exists, use focused checks while iterating and validation proportionat
 to the change under the testing policy. Documentation-only work does not require
 Go checks unless it changes behavior-bearing examples or commands they validate.
 Release validation is a separate, stricter gate governed by release policy.
+
+## Fuzz validation
+
+Run the bounded fuzz targets independently from the repository root. These exact
+commands keep each campaign short and constrain concurrent workers:
+
+```sh
+go test . -run='^$' -fuzz='^FuzzParsePath$' -fuzztime=30s -parallel=2
+go test ./internal/yaml -run='^$' -fuzz='^FuzzParseDocument$' -fuzztime=30s -parallel=2
+go test . -run='^$' -fuzz='^FuzzCompositionAndOverlay$' -fuzztime=30s -parallel=2
+```

docs/roadmap/implementation.md

@@ -1534,7 +1534,40 @@ Acceptance:
 
 ## Stage 21 — Harden boundaries and verify independent loads
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Added bounded fuzz targets `FuzzParsePath`, `FuzzParseDocument`, and
+  `FuzzCompositionAndOverlay` for canonical pointer round trips, accepted YAML
+  parse/write stability, composition order, overlay behavior, input immutability,
+  and detached results. Each target has a small deterministic seed set and explicit
+  byte, translated-node, and depth bounds; the exact 30-second, two-worker commands
+  are recorded in the [developer guide](../development.md#fuzz-validation).
+- Added concurrent public-load coverage that shares one read-only `Definition` while
+  each defaults factory returns fresh maps and slices. The test exercises custom
+  text scalars, independently mutable results, and the frozen effective snapshot.
+  A second load-level race test confirms copies of one `Reader` source compete for
+  one atomic claim, producing exactly one success and one `source.reader_used`
+  error.
+- Reviewed the existing exact-edge source-byte, aggregate import/profile byte/node,
+  parser depth/node, schema traversal, typed projection, explanation-history, and
+  writer-error tests. Those boundaries already cover consequential reads,
+  traversal, projection, redacted rendering, and historical rendering, so no new
+  public limits or duplicate edge tests were added. YAML anchors, aliases, and merge
+  keys remain rejected; there is no provider extension gate or raw-secret rendering
+  route.
+- Ran the three documented fuzz commands for 30 seconds each with `-parallel=2`.
+  Path and YAML passed directly. The first composition campaign revealed that its
+  initial fuzz-only bounds could leave an expensive case active at campaign
+  shutdown; tightening them to 4 KiB per document, 256 translated nodes, depth 12,
+  and parser depth 24 made the exact rerun pass without changing product behavior or
+  requiring a regression corpus.
+- Verified `go test ./...`, `go test -race ./...`, `go vet ./...`, `go build ./...`,
+  `go mod tidy -diff`, `git diff --check`, and a fresh
+  `GOTOOLCHAIN=local GOPROXY=off go test ./...` with Go 1.26.7 on linux/amd64.
+  Existing skips are explicit platform/filesystem-capability probes; no default test
+  reads credentials, network services, or developer-specific configuration.
 
 Read: testing policy, ownership/projection, import limits, redaction guarantees.