> For the complete documentation index, see [llms.txt](https://doc-hub.xcavate.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc-hub.xcavate.io/protocol/nft-marketplace/fuzzer/checklist-before-merging-runtime-updates.md).

# Checklist Before Merging Runtime Updates

1. **Fuzzer Execution Stability**
   * [ ] All fuzz test suites run without panics or unexpected aborts.
   * [ ] Runtime weight limits are respected under high-frequency fuzzed actions.
   * [ ] No out-of-memory errors or infinite loops triggered during fuzzing.
2. **Edge-Case Handling**
   * [ ] NFT metadata and payloads of extreme length or unusual characters are processed or rejected gracefully.
   * [ ] Listings with zero, maximum, or overflow-prone price values are handled safely.
   * [ ] Time-bound fields (like listing duration) validate lower/upper edge boundaries correctly.
3. **State Integrity**
   * [ ] Marketplace storage remains consistent across randomized sequences (e.g., no orphaned NFTs or mismatched ownership).
   * [ ] No unauthorized listings or purchases are accepted from unprivileged accounts.
4. **Concurrency & Race Conditions**
   * [ ] Simulated concurrent marketplace operations (e.g., simultaneous buy/delist) do not create inconsistent states.
   * [ ] Ensure no duplicate bids, double purchases, or timing-related transaction issues.
5. **Security & Logic Validation**
   * [ ] Integer overflow/underflow is fully prevented (including price and balance calculations).
   * [ ] Bids and purchases behave consistently across randomized input sequences.
   * [ ] Any token ID reuse is detected and blocked.
6. **Test Coverage Metrics**
   * [ ] All key extrinsics (`mint`, `list`, `buy`, `delist`, `transfer`, `bid`) are fuzzed with randomized inputs.
   * [ ] Hook logic (`on_initialize`, `on_finalize`) has been indirectly exercised during fuzz tests.
7. **Logs & Observability**
   * [ ] Logs (if enabled during fuzzing) do not reveal sensitive data or spam with redundant outputs.
   * [ ] Any detected failures are reproducible using the failing input snapshot or seed.
8. **Documentation & Code Review**
   * [ ] All fuzzer utilities and test functions are documented with purpose and expected outcomes.
   * [ ] Code reviewed by at least one team member not involved in the original fuzz logic implementation.