DOG-020: wire the orphaned fuzz/NEIL.c back into the build

Now: OPEN

dog/fuzz/NEIL.c — a six-property harness over NEILCleanup/NEILShift/ NEILCanon (reconstruction, token balance, hygiene, substantive-EQ preservation, splice canon, shift idempotence) — is orphaned: when NEIL moved to dog/ (DOG-002) graf/fuzz dropped its NEILfuzz target, the copied source never entered dog/fuzz/CMakeLists.txt, and it still includes graf/JOIN.h (JOINfile/JOINTokenize/JOINFree) which does not exist in libdog. It silently doesn't build anywhere. Method: Issues.

Input

Context

beagle/graf/fuzz/CMakeLists.txt:17 records the relocation; the beagle tree has the same unbuilt copy under dog/fuzz/NEIL.c.
The harness only needs the JOIN trio for tokenize-to-{toks,hashes}; dog/tok/TOK.h (TOKLexer) + the DIFF u64 hashing cover that locally.

Goals

NEILfuzz builds in dog/fuzz/ (libdog standalone, no graf/) and runs; all six property checks preserved verbatim.
Replace the graf/JOIN.h dependency with a local fuzz-file helper (or a dog-level equivalent if one already exists — check INDEX.md first).
A short local run (≥1M execs or 10 min) under ASan comes back clean, seeded with small C-source old/new pairs.

Constraints

Keep the six properties intact — no weakening a check to make it pass.
No NEIL.c/BRAM.c algorithm edits: a property violation found is its own ticket, linked here (per todo.mkd). DOG-016 tracks a known NEILShift bound issue — cross-link, don't fix here.

WIP

TODOs

T1 local tokenize helper (TOKLexer + u64 token hashes) replacing JOINfile.
T2 CMakeLists target NEILfuzz; confirm it links against dog + abc-core.
T3 run under ASan; record execs/sec + any findings as new tickets.

Blockers and bummers

2026-07-12: T1-T3 implemented in worktree ~/src/DOG-020, UNLANDED. The only NEIL.c change is the JOIN-block swap: local JOINfile + JOINTokenize (TOKLexer + tok32Pack + RAPHash into heap u32b/ u64b) — all six property checks byte-identical to the original (orchestrator diffed against the orphan copy to confirm).
FOUND + FIXED (2026-07-12, follow-up worker): the campaign-only c1 trap was NOT an uninit read (first suspicion wrong) — it is BASS ARENA EXHAUSTION. NEILCleanup is invoked directly (fuzz harness AND WEAVE.c:448), never via call(), so its 5 a_carve scratches leak into the caller's frame; the FUZZ macro never rewinds BASS between iterations, the 1 GB arena fills (187-490K execs), a_carve returns BNOROOM mid-pipeline and the early-return leaves a malformed EDL (zero-len EQ). Fresh-process replay = empty arena = clean, hence the heisenbug. Fix in NEIL.c (+11 lines): NEILCleanup snapshots the BASS data slice at entry and rewinds on both returns — the exact call() idiom from PRO.h. Orchestrator-verified: campaigns clean, RSS flat 440 MB (was climbing past 1.2 GB), all saved artifacts + corpus replay clean, ctest 66/66 in the same build.
BONUS in the same tree: root CMakeLists.txt now defines the WITH_ASAN/WITH_FUZZ flag blocks inside the standalone guard (verbatim beagle root), so plain -DWITH_FUZZ=ON -DWITH_ASAN=ON links all five fuzz targets standalone — the cache-var workaround is obsolete. Beagle-child mode untouched by construction (guard is false there).
Residual (candidate follow-ups): the FUZZ macro itself never rewinds BASS per iteration, so any OTHER directly-called carving fn leaks the same way under fuzzing; a_carve's own failure path bypasses the new restore (benign once the arena stops filling).

Outcome

OPEN — filed 2026-07-12, fuzz-coverage review of dog/fuzz.