W14: C3-C7 epoch-protocol ledger + seeded fuzz-liveness (test-only)

All five protocol quirks are OPEN server-side, so the suite pins CURRENT
behavior (verified live) as a bidirectional ledger in
scripts/test-protocol-gate.sh:
- C3: stray (io-response ...) answered as Unknown command (dead guard)
- C4: malformed (epoch) errors and leaves the epoch stale (envelope
  changed since the finding: the dc7aa709 guard answers rather than kills)
- C5: decreasing epoch accepted silently (no monotonic enforcement)
- C6: two commands on one line -> one error, neither executed
- C7: vm-trace without compiler -> opaque "Not callable: nil"

Plus the fuzz property that matters: 60 deterministically-seeded hostile
lines (unbalanced parens, control chars, unicode, 2KB lines, stray
io-responses, epoch mutations) followed by a well-formed command — the
server must still answer and exit cleanly. protocol-gate: 11/11.

When a server-side fix lands, the matching ledger pin fails loudly and the
ledger is updated to assert the corrected behavior.

Test-only: no semantics edits, no push.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plans/agent-briefings/sx-gate-loop.md

@@ -91,7 +91,9 @@ Pin each confirmed-and-fixed finding with a minimal repro. Add suites to
       sx-build-all.sh left as maintainer call (gate definition D3)
 
 ### E. Epoch-loop protocol fuzz + skip-list
-- [ ] C3/C4/C5/C6/C7 — epoch protocol fuzz suite
+- [x] C3/C4/C5/C6/C7 — protocol-quirk ledger (pins current behavior,
+      bidirectional) + seeded 60-line fuzz-liveness property in
+      `scripts/test-protocol-gate.sh` (11/11)
 - [ ] F10 — hs-upstream skip-list so browser-only FAILs mean something
 - [ ] C9 — empty suite label
 
@@ -100,6 +102,20 @@ Pin each confirmed-and-fixed finding with a minimal repro. Add suites to
 
 ## Progress log (newest first)
 
+- 2026-07-04 — **C3–C7 protocol fuzz suite (item E.1)**. All five findings
+  are still OPEN server-side (sx_server.ml fixes are host-runtime work),
+  so the suite pins CURRENT behavior as a bidirectional ledger — verified
+  each live first: C3 stray io-response → extra Unknown-command reply
+  (dead 13-vs-14-char guard); C4 malformed (epoch) → error reply + stale
+  epoch tag (envelope changed since the finding: dc7aa709's guard now
+  answers rather than ignores); C5 decreasing epoch accepted; C6 two
+  commands one line → one error, neither runs; C7 vm-trace sans compiler →
+  opaque "Not callable: nil". Plus a real fuzz property: 60
+  deterministically-seeded hostile lines (unbalanced parens, control chars,
+  unicode, 2KB lines, stray io-responses, epoch mutations) then a
+  well-formed command — server must still answer and exit cleanly.
+  protocol-gate now 11/11. When a server fix lands, the matching ledger
+  pin fails loudly → update to assert the corrected behavior. Test-only.
 - 2026-07-04 — **F2 WASM corpus runner (section D COMPLETE)**. The review's
   headline conformance gap: no runner ever fed spec/tests through the
   SHIPPED browser artifact (F-1/F-3 divergences existed undetected). Built