The target added with the layers themselves reached them, but an audit of what it actually touched turned up four gaps, all of them in code that only this layer's arrival created. The frame body was always the full size the header stated, so a short body was never seen. The decoder itself steps over a truncated final frame rather than decoding it, so this is defence rather than a live path, but `decodeFrame` takes a slice and should survive any length of it; one frame in eight is now cut short. The overrun count was read after the allocations and before the samples, which is the wrong side of where a frame actually runs out of bits. Reading it after walking the granules shows that better than three quarters of these frames exhaust their body -- an arbitrary allocation field asks for far more bits than a frame carries -- which is the single most important thing about this target and was going almost unmeasured. Nothing checked that the output depends only on the input. Every frame is now decoded twice, from fresh state, into two buffers left holding different rubbish, and the results compared byte for byte. Anything read before it is written, or left untouched when it should have been set, shows up as a difference rather than as a plausible-looking sample. `checkFilterbanks` drove only the eighteen time slots of a Layer III granule at a stride of one. Generalizing `synthesize` for Layer I's twelve slots and for writing into one channel of an interleaved pair added two arguments that nothing was varying; both are now chosen per round, and the untouched half of a strided write is checked to have come back exactly as it was left. The coverage floors grew with it, so that a change which stopped reaching these paths fails rather than quietly testing nothing. Over 50,000 rounds: all four scalefactor selectors, all five subband counts -- 32 for Layer I and 8, 12, 27 and 30 for Layer II -- 544,736 grouped-class subbands, 244,627 shared ones, 38,567 exhausted frames and 16,789 frames on the MPEG-2 table. The Smith entry point for this target was also simply missing, so `zig build fuzz --fuzz` could never have driven it. Campaigns run clean: 500,000 rounds in ReleaseSafe and 30,000 in Debug. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VdHRV5ctsqmfwZXhLvKQfb