v0.17.2 — Fable 5.1 Audit: 6 Critical Bugs + $N Renumbering

Breaking Changes (pre-v1.0)

• WithSensitiveFields removed — use MaskArgs() in custom hooks
• WithLogger no longer logs parameters by default

Added

• MaskArgs(query, args) — safe parameter masking for custom hooks
• Expression values in UpdateQuery.Set() (enables SET n = n + ?)

Changed

• Logger removed from query hot-path — WithLogger() = QueryHook wrapper (30µs → 0)
• WithQueryHook composes (chains) instead of replacing

Fixed

• One() no longer masks errors as ErrNotFound — context cancellation propagates
• Statement cache race condition — GetOrSet() atomic cache-or-insert
• SQL placeholder lexer — ? inside strings, JSONB ?|, ?&, ??, comments handled
• PostgreSQL $N collision in subqueries — renderSQL + single-pass architecture
• GroupByExpr/OrderByExpr params now renumbered on PostgreSQL
• Arg count validation — count(?) != len(args) caught at Build() time
• Documentation: 17 subquery examples fixed, security guides updated

Validated by Fable 5.1 across 6 review rounds.