# Coverage-guided fuzzing
The fuzz executables are byte-oriented boundaries for an external coverage-guided engine. They are excluded from ordinary builds and add no dependency to any library component.
```bash
cabal build -ffuzz-targets \
exe:moonlight-triangulation-fuzz-decode \
exe:moonlight-triangulation-fuzz-constraints \
exe:moonlight-triangulation-fuzz-refinement
```
Each executable accepts one corpus path in `@@` form or reads the input from standard input. On Linux, AFL++ can guide an uninstrumented GHC executable through QEMU mode:
```bash
afl-fuzz -Q -i fuzz/corpus/decode -o fuzz/artifacts/decode -- \
"$(cabal list-bin -ffuzz-targets exe:moonlight-triangulation-fuzz-decode)" @@
afl-fuzz -Q -i fuzz/corpus/constraints -o fuzz/artifacts/constraints -- \
"$(cabal list-bin -ffuzz-targets exe:moonlight-triangulation-fuzz-constraints)" @@
afl-fuzz -Q -i fuzz/corpus/refinement -o fuzz/artifacts/refinement -- \
"$(cabal list-bin -ffuzz-targets exe:moonlight-triangulation-fuzz-refinement)" @@
```
Decoder refusals, unrealizable constraint batches, invalid refinement parameters, and rejected domains are expected typed outcomes. A target fails only when an admitted result violates the DCEL laws or serialization round-trip.