- Add CowHashMap: O(1) snapshot cloning for lock-free iteration
- Replace DashMap<i64, TxnState> with Mutex<CowHashMap<TxnState>>
- Add auto-shrink to I64Map/I64Set after bulk deletes
- Fix historical version arena_idx (must be None, slot reused by HEAD)
- Pass WHERE clause to storage layer for UPDATE index optimization
- Remove unused ConcurrentI64Map type

CowHashMap uses same algorithm as I64Map (FxHash with pre-mixing,
backward-shift deletion) but adds COW semantics via reference counting.
Thread-local caching in is_directly_visible() minimizes lock contention.

- Add `add_batch_slice` and `remove_batch_slice` to Index trait for
  single-lock batch operations (O(1) locks instead of O(N))
- Remove `add_arc`/`remove_arc` methods - batch slices use borrowed
  values, eliminating intermediate Arc allocations
- Move index updates from MVCCTable::commit() to TransactionVersionStore
  with two-phase commit (validate-then-modify) and rollback support
- Fix hash collision bug in HashIndex::add() - same hash was incorrectly
  treated as same values, causing silent UPDATE failures
- Improve conflict detection to properly catch UPDATE conflicts using
  get_latest_version_id() (old code only detected INSERT conflicts)
- Add I64Map/I64Set::reserve() for batch pre-allocation
- Add rightmost split optimization in CowBTree for sequential inserts
- Add tests for unique constraint swap and performance regression

Peak memory usage reduced by ~10% (verified with DHAT).

…ization

- Remove create_time from ArenaRowMeta (saves 8 bytes per row)
- TransactionRegistry: committed transactions removed from map (implicit state)
- Pack TxnState into 16 bytes with bit manipulation for status + commit_seq
- Add separate snapshot_seqs map for snapshot isolation commit sequences
- Track aborted transactions with sentinel value instead of removal
- Fix next_txn_id recovery to not skip transaction IDs

- Fix race condition in commit paths where transaction was briefly
  absent from both transactions and snapshot_seqs maps, causing
  incorrect visibility in snapshot isolation
- Fix abort_transaction to not resurrect already-committed transactions
- Add active_txn_count atomic for O(1) active transaction counting
- Add XOR mixing to committed cache index to prevent 0% hit rate
  when transaction IDs are strided by cache size
- Optimize GC with retain() to reduce lock contention
- Add I64Map::retain() method for efficient bulk removal

…nsaction safety improvements

Major changes:
- Add PkIndex: hybrid bitset+I64Set primary key index with O(1) lookups
- Add TRUNCATE TABLE with WAL persistence and transaction safety checks
- Replace row_arena_index HashMap with speculative arena probe (saves ~40 bytes/row)
- Add CowBTree reverse iterators for O(limit) descending ORDER BY
- Add snapshot isolation guards on arena fast paths (needs_snapshot_isolation)
- Use i128 accumulator for SUM/AVG to prevent integer overflow
- Fix partial commit handling: commit_all_tables returns (bool, Option<Error>)
- Fix record_commit error propagation (was silently swallowed)
- Add savepoint DDL rollback support (CREATE/DROP TABLE)
- Fix expressions_equivalent for In, Like, FunctionCall, Window, Between.not
- Fix FloatLiteral token in build_in_filter_expression
- Add streaming fallback data in StreamingResult for snapshot isolation
- Strict DDL WAL error propagation (record_ddl now returns Result)
- TOCTOU fixes in create_table/drop_table/rename_table DDL operations

…ess fixes

WAL & Snapshot Safety:
- Safe WAL truncation: only truncate to 2nd-to-last CRC-verified snapshot
- Snapshot fallback loading: try older snapshots when latest is corrupted
- Remove stale checkpoint.meta when all snapshots fail to load
- Use min(header_lsn) across tables instead of max for crash-safe replay
- Capture commit_seq AFTER checkpoint to prevent data loss window
- Clean up orphaned snapshot directories from dropped tables
- CRC-aware snapshot cleanup: corrupt files don't count toward keep_count
- Clean up old rotated WAL files covered by snapshots
- WAL rotation after DDL/DML commits to prevent unbounded growth
- Sort WAL files by embedded LSN instead of lexicographic order
- Cap checkpoint metadata allocation to prevent OOM from corrupt data

Transaction Safety:
- Write WAL COMMIT marker before making changes visible in registry
- Abort transaction on Phase 3 WAL write failure to prevent registry leak
- Restore transaction on API commit failure so rollback remains possible
- Fix file lock race: acquire lock before truncating PID file
- Fix registry override_count underflow from mismatched fetch_sub

Correctness Fixes:
- Sort row IDs before intersect_sorted_ids (BTree returns value order)
- Fix version chain cleanup: don't assume monotonic visibility
- Multi-column index: skip redundant post-filter for full-key bounds
- Rollback in-memory index on CREATE INDEX WAL write failure
- Record DROP INDEX to WAL before in-memory removal

Features:
- Named parameter support (:name) in PK fast path and DML fast path
- HashIndex get_all_values() for statistics
- EXPLAIN plan colorization in CLI with ANSI colors
- EXPLAIN output improvements: DISTINCT, better labels, column threshold
- Durability test suite

- Merge duplicate error variants (TableNotFound/TableNotFoundByName → TableNotFound(String),
  ColumnNotFound/ColumnNotFoundByName/ColumnNotFoundNamed → ColumnNotFound(String),
  IndexNotFound/IndexNotFoundByName → IndexNotFound(String), etc.) for consistent
  context-rich error messages across all 27 files
- Remove unused MvccError enum and its From<MvccError> impl
- CAST(NULL AS type) now returns typed NULL per SQL standard instead of default values
  (e.g., Integer(0), Text(""))
- Add overflow guards: checked_neg/checked_abs for i64::MIN, checked_add in SUM with
  float promotion on overflow
- Fix CAST text→float→integer path to reject inf/NaN/out-of-range (was silently
  saturating to i64::MAX)
- Fix ILIKE pattern matching to use byte slices instead of str slicing, preventing
  panics on multi-byte UTF-8 characters
- Fix AM/PM format_timestamp sequential replacement interference using placeholders
- Unify VM JumpIfTrue/JumpIfFalse/PopJumpIfTrue/PopJumpIfFalse to use to_bool() helper
- Add JumpIfNotNull to program validation/optimization passes
- Validate LOCATE start position argument

…idation, and durability tests

Add column existence checks in pushdown rules to prevent invalid storage-level
predicates for columns not in the schema (e.g., from JOINs), falling back to
memory-layer evaluation. Implement rename_column and modify_column on MVCCTable
with dual schema updates (version store + cached schema), replacing the previous
stubs. Add comprehensive durability tests for TRUNCATE TABLE and ALTER TABLE
operations covering close/reopen scenarios. Update benchmark numbers.

Add 4 new tests closing verified durability gaps:
- test_alter_table_modify_column_durability: WAL op_type=4 roundtrip
- test_alter_table_modify_column_with_snapshot: MODIFY replayed over snapshot
- test_bitmap_index_durability: USING BITMAP WAL serialization (index_type=2)
- test_bitmap_index_with_snapshot_recovery: bitmap index created after snapshot

…rop dispatch

Replace the stored dropper function pointer in CompactArc's Header with
a CompactArcDrop trait that resolves drop+dealloc logic at compile time
via monomorphization. This eliminates 8 bytes per allocation (the
redundant fn pointer) and replaces an indirect call with a direct call
in the drop path.

- Add CompactArcDrop trait with three non-overlapping impls (Sized, str, [T])
- Remove dropper field from Header (24 -> 16 bytes)
- Remove standalone drop_sized, drop_str, drop_slice functions
- Remove unused set_meta method
- Add test_header_size assertion

…saction-local visibility fix

## Foreign Key Support

- Parse column-level `REFERENCES` and table-level `FOREIGN KEY` syntax with `ON DELETE`/`ON UPDATE` actions
- DDL validation: parent table exists, referenced column is PK/UNIQUE, `SET NULL` on `NOT NULL` rejected
- Referential integrity enforcement on INSERT, UPDATE, DELETE, TRUNCATE, and DROP TABLE
- Recursive CASCADE with depth limit (16), cached reverse FK mapping, auto-created FK indexes
- WAL + snapshot persistence for FK metadata (both serialization paths)
- Epoch-tagged `NotOptimizable` for fast-path recompilation when FK tables are added/dropped
- DROP TABLE strips orphaned FK constraints from child schemas (in-memory, WAL replay, and snapshot)

## Transaction-Local Visibility Fix

- Replace `txn_versions.get()` with `get_local_version()` in 11 PK-lookup and index-lookup paths
- Fixes pre-existing bug where locally-deleted rows reappeared via committed store fallback
- `get()` returns `None` for deleted rows, causing incorrect fallback to committed store
- `get_local_version()` distinguishes "no local version" from "locally deleted"

## Documentation

- Add `docs/_docs/sql-features/foreign-keys.md` covering syntax, actions, cascading, transactions, and DDL
- Update `schema-management.md` with FK constraint examples

## Version Bump
- Update `Cargo.toml`, `Cargo.lock`, `fuzz/Cargo.lock` to v0.3.0
- Update `BENCHMARKS.md` header to v0.3.0

## New Documentation Pages
- ALTER TABLE (rename/modify column)
- RETURNING clause
- Set operations (UNION, INTERSECT, EXCEPT)
- Views (CREATE/DROP VIEW)
- Transactions (BEGIN, COMMIT, ROLLBACK, isolation levels)
- Auto-increment (AUTOINCREMENT)
- Collation (COLLATE NOCASE)
- DESCRIBE command
- SHOW commands (SHOW TABLES, SHOW INDEXES, etc.)

## Expanded Existing Docs
- JSON operators (`->`, `->>`)
- NATURAL JOIN and USING clause
- Window frames (ROWS/RANGE BETWEEN) and WINDOW clause
- VALUES as inline table source
- INSERT INTO ... SELECT
- IS DISTINCT FROM / IS NOT DISTINCT FROM
- XOR logical operator
- MEDIAN, STDDEV_POP, STDDEV_SAMP, VAR_POP, VAR_SAMP aggregates
- Foreign keys formatting improvements