ship one record per function: merge the release set, gen reads it, descriptions as doc comments, gates for what was only claimed; v3.0

fuzz/fuzz_targets/fuzz_rtti.rs

@@ -12,7 +12,7 @@ fuzz_target!(|data: &[u8]| {
     };
     let vts = rtti::enumerate_vtables(&img, 128);
     for cv in vts.iter().take(32) {
-        let _ = (&cv.name, &cv.mangled, cv.offset_to_top, cv.slots.len());
+        let _ = (&cv.name, cv.offset_to_top, cv.slots.len());
     }
     // The by-name lookup path (mangling + candidate walk) on a name pulled from the input itself.
     if let Some(name) = vts.first().map(|c| c.name.clone()) {

fuzz/fuzz_targets/fuzz_schema.rs

@@ -15,13 +15,16 @@ fuzz_target!(|data: &[u8]| {
     // width/count word, and an enumerator array whose length that word supplies. A crafted count is the
     // sharp edge — it drives the per-enumerator read loop — so the reader must bound it rather than
     // trust it.
-    for e in schema::enumerate_enums(&img) {
+    let classes = schema::enumerate_schema(&img);
+    // The enum walk takes the classes because a class FIELD descriptor is byte-compatible with an enum
+    // binding — so a crafted image can aim the field-array spans it derives from them anywhere too.
+    for e in schema::enumerate_enums(&img, &classes) {
         let _ = (e.name.len(), e.size, e.align);
         for (n, v) in &e.values {
             let _ = (n.len(), *v);
         }
     }
-    for c in schema::enumerate_schema(&img) {
+    for c in &classes {
         let _ = c.primary_base();
         for f in &c.fields {
             let _ = (f.offset, f.name.len());