A new rigor campaign (snapshot-adversarial-fuzz) hunts malformed restore
buffers: every read must succeed into a structurally sound graph or throw
a clean bounded error. It surfaced three real bugs now fixed:
1. BinaryReader threw a caller-contract TypeError on Buffer/Uint8Array
input (fs-style restore) instead of reading it — normalized to a
DataView over the real ArrayBuffer.
2. readBytes built its slice with this.view.buffer + this.offset,
ignoring view.byteOffset — pooled Buffers (byteOffset 768+) read the
wrong memory region entirely, corrupting restored graphs.
3. The edge gate validated array contents but not the header count
fields: a desynced edgeIndex (indices build iterates edgeIndex, not
array length) turned a one-byte flip into a 13-second effective hang.
The gate now cross-validates numNodes/numEdges/edgeIndex/
nextRelationId/valueCount/degreeCount against their sections, and
LazyNodeIdTable bounds-guards garbage offset slices.
Binary mode now carries validity on every return site (direct, logical,
loop, early-termination, structural), gated like the normal path.
John Dvorak
27d04e4058