Hardens the `mz-avro` decoder against adversarial input (Avro
bytes/schemas arrive from Kafka and an external registry, so a panic/OOM
is an availability bug): bound per-block array/map lengths and object
counts by remaining input, cap object-container block byte length, bound
schema-parse/value-decode recursion, and fix two schema-resolution
panics on unmatched named types.

Found by the cargo-fuzz suite ([separate infra
PR](#36982)). Each fix
has a regression test.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Print→reparse round-trip bugs in the SQL parser and pretty-printer,
surfaced by the grammar-aware fuzz target. Each fix has a regression
test; the sqllogictest/testdrive plan goldens are refreshed to match.

Themes: quoting bare keyword identifiers (any/all/some/list,
context-sensitive keywords), parenthesizing low-precedence operands
(prefix ops, casts, COLLATE, quantified comparisons), special-form
display correctness (EXTRACT/POSITION/SUBSCRIBE), and bounding parser
recursion/backtracking to reject pathological inputs.

Found by the cargo-fuzz suite ([separate infra
PR](#36982)).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…37177)

`RowPacker::push_array_with_unchecked` and `push_array_with_row_major`
compute an array's expected cardinality as the product of its dimension
lengths and compare it against the actual number of elements pushed. The
product was an unchecked `usize` multiply (`dims.iter()...product()` /
`cardinality *= dim.length`), so dimension lengths whose product exceeds
`usize::MAX` overflowed.

Under overflow checks (debug, and the cargo-fuzz build) this panics; in
release it silently wraps, and a wrapped value can even spuriously match
the actual element count — accepting a corrupt array (e.g. dims claiming
`[2^32, 2^32]` wrap to a cardinality of 0, matching an empty element
list). This is reachable from `Row::decode` over an attacker- or
corruption-supplied `ProtoRow`, since the proto array dimensions are not
otherwise bounded.

Saturate the product to `usize::MAX` instead. An overflowing cardinality
is impossibly large — no array can hold that many elements — so it never
equals the real element count and the existing check rejects it as
`WrongCardinality`, turning the panic/silent-wrap into a clean error on
both build profiles.

Found by the `repr::row_codec_roundtrip` cargo-fuzz target in
#36982

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

All found via #36982

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Hardens `mz-repr` proto/Row decoding against malformed/untrusted bytes —
these paths are reachable from persisted state and the wire, so a panic
is an availability bug. Replaces panics/asserts with proper decode
errors and validates ranges (Date, CheckedTimestamp, ProtoNumeric,
ProtoRange, ProtoRelationDesc, ProtoRow dict ordering, uuid parsing,
leap-second truncation, Avro decimal).

Found by the cargo-fuzz suite ([separate infra
PR](#36982)). Each fix
has a regression test.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Moritz Hoffmann <antiguru@gmail.com>

…nput (#36985)

Hardens decode paths in `persist`, `persist-client`, `persist-types`,
`pgrepr`, and `postgres-util` against malformed/untrusted input: reject
rollup-less/empty-frontier/hollow-only/invalid StateDiff state instead
of panicking or debug-asserting, guard UUID parsing, fix i16 overflow in
pgrepr numeric-scale binary decode, and propagate u16-conversion errors
in the postgres table-desc protos.

Found by the cargo-fuzz suite ([separate infra
PR](#36982)). Each fix
has a regression test.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>