INT-06 — Add WAL replay fuzz target (crates/clawhdf5-agent/fuzz/).
Writes arbitrary bytes to a temp file and runs them through
WalFile::read_entries, exercising the magic-byte check, version
dispatch, CRC32 guard, length-prefix bounds, and EOF handling.
No byte sequence should cause a panic or OOM.
INT-08 — Wrap Android JNI HDF5Memory handles in Mutex.
Handle type changed from *mut HDF5Memory to *mut Mutex<HDF5Memory>.
Every JNI entry point acquires the lock before calling into
HDF5Memory, making concurrent calls from multiple Java/Kotlin threads
safe without requiring the caller to synchronize externally.
Added concurrent_count_active_is_safe test to exercise the path.
INT-10 — Add media reference sandboxing to MediaRef::validate().
Path references are canonicalized and checked to stay within an
optional sandbox directory (preventing ../ traversal).
URL references must use a scheme from ALLOWED_URL_SCHEMES (https,
http); file://, data:, and schemeless strings are rejected.
Inline references are always accepted.
Added 9 unit tests covering the acceptance and rejection paths.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
