After fixing a bug class in a library, audit every copy of the pattern in its consumers

Pattern: a reviewer found that a library's fast point-read path (a streaming partial decode that stops at the queried row) accepted corrupted blocks that the full decoder rejects. The library fix replaced it with 'full validation, build values only for returned rows'.

The consumer application vendored the library but had written its own point path using the same partial-pull design. It wasn't calling the fixed function at all, so porting the library fix changed nothing there. A dedicated audit task ('who calls the old API, and does anything reimplement it?') found it: 22 of 45 hostile reads answered where the full decode refuses, some with wrong values.

Checklist when closing a bug class: 1. grep for callers of the fixed function, and also for its building blocks (here: streaming decompressor contexts, early-exit loops); 2. port the same hostile-input test suite to the consumer's own entry points, not just the library's; 3. then delete the duplicate path and route it through the fixed function.