AUD-007: expand adversarial payload sweep — 23 new variants × 38 handlers — 3078 tests pass

@@ -241,6 +241,50 @@241241     }242242   });243243 244+  // ── AUD-007: extended no-crash payload sweep ────────────────────────────245+  //246+  // Each payload variant runs against every handler in PAYLOAD_HANDLERS and247+  // must produce a structured response — never a thrown exception. This248+  // expands fuzz coverage to >3000 tests without changing handler behavior.249+250+  describe("AUD-007 extended payload no-crash sweep", () => {251+    const extraPayloads: Array<{ name: string; payload: unknown }> = [252+      { name: "boolean true", payload: true },253+      { name: "boolean false", payload: false },254+      { name: "negative number", payload: -1 },255+      { name: "NaN", payload: NaN },256+      { name: "Infinity", payload: Infinity },257+      { name: "empty string", payload: "" },258+      { name: "very long string", payload: "A".repeat(10_000) },259+      { name: "unicode string", payload: "私のパスワード🔑" },260+      { name: "RTL string", payload: "مفتاح‮" },261+      { name: "null bytes in string", payload: "a\x00b\x00c" },262+      { name: "html string", payload: "<script>alert(1)</script>" },263+      { name: "sql string", payload: "'; DROP TABLE entries; --" },264+      { name: "path traversal string", payload: "../../etc/passwd" },265+      { name: "object with null prototype-ish", payload: { __proto__: null } },266+      { name: "object with prototype pollution attempt", payload: { __proto__: { polluted: true } } },267+      { name: "object with constructor pollution", payload: { constructor: { prototype: { polluted: true } } } },268+      { name: "deeply nested array", payload: [[[[[[[[[[]]]]]]]]]] },269+      { name: "long array", payload: new Array(1_000).fill(0) },270+      { name: "mixed array", payload: [null, undefined, 1, "x", true, {}, []] },271+      { name: "function-like object", payload: { call: () => 1, apply: () => 1 } },272+      { name: "Date object", payload: new Date(0) },273+      { name: "BigInt-ish payload", payload: { n: "9007199254740993" } },274+      { name: "circular-safe placeholder", payload: { self: "[Circular]" } },275+    ];276+277+    for (const { name, payload } of extraPayloads) {278+      for (const type of PAYLOAD_HANDLERS) {279+        it(`${type} with ${name} payload does not crash`, async () => {280+          const r = await dispatch({ type, payload } as unknown as Message);281+          expect(r).toBeDefined();282+          expect(typeof r.ok).toBe("boolean");283+        });284+      }285+    }286+  });287+244288   // ── Unknown / malformed message types ───────────────────────────────────245289 246290   describe("unknown message types", () => {