v0.22.1

slater v0.22.1

Whole-codebase review remediation: 46 findings fixed — 40 from a full
security/correctness/performance review of the codebase, plus 6 follow-ups
discovered while fixing those — each landed with a regression test and a
clean-room verification of the integration branch.

Security & robustness

• Every untrusted-input decode path is now bounded: the Bolt PackStream decoder,
  zstd block decompression, the on-disk column/segment/index decoders, the
  property-value wire format, and query nesting depth. A malformed or hostile
  input can no longer drive an unbounded allocation or a stack-overflow abort.
• The whole pre-authentication connection window is bounded — TLS handshake,
  reads, and writes each on one deadline — and password verification and write
  execution now run off the async reactor behind concurrency caps, so a
  connection or login flood can no longer stall the server for everyone.
• Object-store integrity re-hashes an object body when the store carries no
  server-side checksum, instead of silently falling back to a length-only check.

Correctness

• ORDER BY direction and DISTINCT are read from the parsed keyword rather than a
  substring scan of the clause text.
• Graph export round-trips every node label and backtick-quotes identifiers, so a
  dump rebuilds faithfully and cannot inject into the rebuild.
• The write-ahead log rolls back a partially written batch and recovers from a
  poisoned lock, closing the case where an unacknowledged write could be
  resurrected on replay; segment creation fsyncs its parent directory.
• Integer arithmetic overflow now errors cleanly instead of wrapping silently,
  rand() is uniform over [0,1), and relationship-uniqueness is enforced across
  fixed-length patterns.

Performance

• The block cache and the decoded-block cache are sharded with a lock-free read
  path, so hit throughput scales with cores instead of collapsing under
  contention.
• Anchor scans stream in bounded windows, so LIMIT short-circuits and resident
  memory stays bounded whether or not a write delta is present.

Resident memory remains bounded independent of graph size: a 90M-node /
1.5B-edge graph serves within the documented few-hundred-MB target.

Full Changelog: v0.22.0...v0.22.1