Merge branch 'feat/p1-wasm' into feat/p1-proof

# Conflicts:
#	Cargo.toml
#	scripts/ci-test.sh

docs/known-issues.md

@@ -473,6 +473,23 @@ the same agent-store interop test.
 **Fix:** an empty contiguous dataset gets the undefined address (all `0xff`),
 which is what libhdf5 itself writes.
 
+## `clawhdf5-wasm` (browser) limits
+
+**Status:** open (by design for now; added 2026-09-26).
+
+- The whole file is held in memory: `open()` takes its bytes. There are no
+  HTTP range reads, so a multi-GB file does not fit a browser tab.
+- Compound, reference, opaque, bitfield, time and VL-sequence datasets are
+  refused with an error naming the type; attributes of those types come back
+  as `value: null` with their `dtype`.
+- No Zstd or SZIP (both link C): such datasets fail with
+  `unsupported filter: 32015` / `: 4`. pcodec is not enabled either.
+- External links and virtual-dataset sources in other files cannot be
+  followed (no file system).
+- Variable-length string datasets are read by decoding `read_selection`'s
+  bytes with `clawhdf5_format::vl_data` in the wasm crate; `File` itself still
+  cannot (see the audit gaps above).
+
 ## The Node.js package (`packages/clawhdf5-node`) does not work
 
 **Status:** open (found 2026-09-25). Unpublished; not built or tested in CI.