Merge release/v2.7.0

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

.gitea/workflows/ci.yml

@@ -22,5 +22,25 @@ jobs:
         run: rustup component add rustfmt clippy
       - name: Install thumbv7em-none-eabihf target
         run: rustup target add thumbv7em-none-eabihf
+      - name: Install Python interop dependencies
+        # The interop suites used to skip silently when python3/h5py were
+        # missing, so they never ran in CI. Install them and make a missing
+        # dependency a failure (CLAWHDF5_REQUIRE_INTEROP below).
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends python3 python3-venv
+          python3 -m venv /opt/interop
+          /opt/interop/bin/pip install --no-cache-dir h5py numpy netCDF4 xarray
+          echo "/opt/interop/bin" >> "$GITHUB_PATH"
+      - name: Show interop library versions
+        run: /opt/interop/bin/python -c "import h5py, netCDF4; print('h5py', h5py.__version__, 'HDF5', h5py.version.hdf5_version, 'netCDF4', netCDF4.__version__)"
       - name: Run CI script
+        env:
+          # Name the interpreter outright rather than relying on $GITHUB_PATH
+          # reaching the test processes: if `python3` resolved to the system
+          # one instead of the venv, every interop suite would skip.
+          # CLAWHDF5_REQUIRE_INTEROP turns that skip into a failure, so the
+          # two together mean the suites either run or the build goes red.
+          CLAWHDF5_PYTHON: /opt/interop/bin/python
+          CLAWHDF5_REQUIRE_INTEROP: "1"
         run: bash scripts/ci-test.sh

.gitignore

@@ -1,3 +1,7 @@
 /target
 Cargo.lock
 benchmarks/longmemeval/*.json
+
+# Local model weights (MiniLM etc.) — large, not committed
+weights/
+.venv

BENCHMARKS.md

@@ -6,8 +6,469 @@
 **Rust:** 1.96.0-nightly (2026-03-14) · `--release` profile  
 **Date:** 2026-07-01
 
+> **Traceability note:** the "h5bench-Equivalent I/O Benchmarks" and both
+> "Independent Validation: tank" sections below meet a dated,
+> hardware-cited, reproducible standard (explicit date, machine spec, and a
+> runnable command per result) — this now covers "LongMemEval Results",
+> "SIMD & Parallelism", "Vector Search Latency", and "Comparison to MemX" via
+> their tank re-runs. The remaining undated sections above (Hybrid Search,
+> Knowledge Graph, Memory Consolidation, Temporal Index, Write Path, Decision
+> Gate, Memory Strategy, Multi-Session Benchmark, Memory Footprint,
+> Consolidation Efficiency, Ephemeral Tier) do not yet meet that bar — this is
+> a known, tracked documentation gap, not a claim that those numbers are wrong.
+>
+> **Correctness note (2026-08-06).** Being dated and reproducible is necessary but
+> not sufficient — a number can be perfectly reproducible and still measure the
+> wrong thing. A methodology audit found two such cases and both have been
+> retracted in place: the session-level LongMemEval figures (degenerate on the
+> oracle variant) and the MemX retrieval comparison (mismatched granularity and
+> corpus). Every cross-system comparison in this file now carries an explicit
+> scoping caveat. Where a section states a scoring target, that declaration is the
+> contract — read it before citing the number.
+
 ---
 
+## Memory footprint
+
+`cargo run --release -p clawhdf5-bench --bin search_harness -- --footprint --full`,
+384-dim `f32`. The figure that matters is **reopened**: a store loaded from
+disk, which is what a long-lived process holds.
+
+Measured with a counting global allocator, not RSS. RSS cannot see this from
+inside one process — freeing a large structure returns its pages to the
+allocator's pool rather than to the OS, so allocating the next one shows no
+change at all. Measured that way a store holding the corpus twice and one
+holding it once came out *identical* (1.00x both), which is how the first
+attempt at this measurement went.
+
+| N | vectors (raw) | reopened, before | reopened, after |
+|---:|---:|---:|---:|
+| 1 000 | 1 MiB | 5 MiB (3.41x) | 4 MiB (2.39x) |
+| 10 000 | 15 MiB | 50 MiB (3.43x) | 35 MiB (2.42x) |
+| 100 000 | 146 MiB | 505 MiB (3.44x) | **357 MiB (2.43x)** |
+
+The cache stored every embedding twice — once as a `Vec<Vec<f32>>` and once
+flattened for the batched kernels, kept in lock-step on every push, update and
+compaction. Storing only the flat buffer and indexing into it gives back
+almost exactly one copy of the corpus (148 MiB at 100k) and one heap
+allocation per entry. Recall and query latency are unchanged.
+
+What remains at 2.43x: the flat vectors (1.0x), the HNSW index's own copy of
+them (1.0x), and text, ids and graph (~0.4x). The index copy is the next
+target — it is what a quantised or borrowed representation would address.
+
+### Quantising the index copy (`quantized_index`)
+
+`MemoryConfig::quantized_index` stores the index's copy as `i8` instead of
+`f32`. Same harness, same binary, `--footprint --full` with and without
+`--int8`:
+
+| N | vectors (raw) | indexes, f32 | indexes, int8 | reopened, f32 | reopened, int8 |
+|---:|---:|---:|---:|---:|---:|
+| 1 000 | 1 MiB | 2 MiB | 1 MiB | 4 MiB (2.40x) | 2 MiB (1.64x) |
+| 10 000 | 15 MiB | 32 MiB | 14 MiB | 44 MiB (3.03x) | 27 MiB (1.81x) |
+| 100 000 | 146 MiB | 266 MiB | **123 MiB** | 399 MiB (2.72x) | **256 MiB (1.74x)** |
+
+The scale is **per row**, not global. A unit-length row in `d` dimensions has
+components around `1/sqrt(d)`, so a fixed `[-1, 1]` scale spends fewer than 12
+of the 255 levels on a 128-dimensional vector: measured against an exact
+ranking that gives 0.35 top-10 overlap — unusable. Scaling each row by its own
+largest component brings the same measurement to 0.99.
+
+Quantised distances still cost recall on their own, and **`ef` does not buy it
+back**, because the loss is in the distances rather than in the graph
+(`--ann-only --full`, N = 100 000):
+
+| ef | recall@10, f32 | recall@10, int8 | recall@10, int8 + re-score |
+|---:|---:|---:|---:|
+| 32 | 0.9775 | 0.9415 | 0.9785 |
+| 64 | 0.9945 | 0.9625 | 0.9940 |
+| 128 | 0.9995 | 0.9670 | 0.9990 |
+| 256 | 0.9995 | 0.9670 (ceiling) | 0.9990 |
+
+Re-scoring closes the gap: the store already holds the exact embeddings, so
+the query path re-scores the candidate pool against them before fusion. That
+is done automatically whenever the index is quantised.
+
+**On AVX2 this costs nothing — it pays.** The first measurement of this put
+the cost at ~13% of QPS and ~16% of build time, but that compared a scalar
+int8 loop against `clawhdf5-accel`'s hand-written AVX2 kernels for `f32`:
+the gap was a missing kernel, not a property of int8. With
+`clawhdf5_accel::dot_i8` (AVX2: sign-extend to `i16`, then `madd_epi16`),
+medians of three alternating runs at N = 100 000, same binary:
+
+| | f32 | int8 | int8 + re-score |
+|---|---:|---:|---:|
+| build | 3197 ms | **1778 ms** | 1826 ms |
+| QPS at ef = 64 | 13 399 | 29 195 | **21 848** |
+| recall@10 at ef = 64 | 0.9945 | 0.9625 | **0.9940** |
+
+So at equal recall the quantised index answers **1.63x as many queries per
+second**, builds **1.8x faster**, and holds a quarter of the vectors. (Compare
+only at equal `ef`: with re-scoring the harness raises `ef` to at least the
+candidate pool, so the `ef = 16` and `ef = 32` rows are not like-for-like.)
+
+It is still **off by default**, for portability rather than performance: the
+int8 kernel is AVX2-only, and on aarch64 — including `clawhdf5-android` — it
+falls back to the scalar loop, where the original trade still applies. A NEON
+kernel would remove that caveat. On an x86-64 deployment, turning it on is a
+win on every axis measured.
+
+A measurement trap worth recording: the synthetic `clustered` generator in the
+`clawhdf5-ann` tests draws clusters far tighter than any real embedding, so
+neighbours there sit closer together than the quantisation error and top-10
+*identity* is noise. Scored on that fixture int8 looks catastrophic (0.57
+overlap) — a fact about the fixture, not the storage. The tests use random
+vectors, and recall is measured against brute-force ground truth rather than
+against the f32 index, whose own approximation errors a re-scored search is
+entitled to get right.
+
+### Opening a store (`read_from_disk`)
+
+`HDF5Memory::open` memory-mapped the file, copied the whole mapping into a
+`Vec`, and handed that to `File::from_bytes` — while `File::open` memory-maps
+the file itself. Dropping the copy takes **store open from 455 ms to 327 ms**
+at 100 000 x 384 (`--e2e-only --full`; two runs after the change, 326.8 and
+328.1 ms).
+
+It does **not** lower the process's peak memory, which is worth stating
+precisely because it is the obvious thing to assume. The harness now reports a
+high-water mark alongside the retained figure:
+
+| N | reopened MiB | peak during open MiB |
+|---:|---:|---:|
+| 1 000 | 4 | 5 |
+| 10 000 | 44 | 61 |
+| 100 000 | 399 | 562 |
+
+The peak is set *after* the parse, by the index build, so a buffer allocated
+and freed during the parse never reaches the high-water mark. Holding a
+deliberate extra copy of the file across the whole parse leaves the peak
+unmoved, which is how this was confirmed rather than assumed. What the change
+saves is the copy itself: a full-file memcpy on every open, and the transient
+that goes with it.
+
+## Read harness
+
+Produced by `cargo run --release -p clawhdf5-bench --bin read_harness`: a 4096 x
+2048 `f64` dataset (64 MB) written three ways, read in full and through four
+hyperslab selections, each from a fresh file handle. The last column is the
+point: does a selection cost what the *selection* costs?
+
+### Baseline (v2.4.0): every selection decodes the whole dataset
+
+4096 x 2048 f64 (64 MB per dataset), chunks 256 x 256, file 129 MB
+
+| layout | read | selected | time ms | MB/s of selection | vs full read |
+|---|---|---:|---:|---:|---:|
+| chunked + deflate | full (first) | 64 MB | 181.8 | 352 | |
+| chunked + deflate | full (repeat) | 64 MB | 162.1 | 395 | 1.00x |
+| chunked + deflate | 64 x 64 window (1 chunk) | 0.03 MB | 104.89 | 0 | 0.577x |
+| chunked + deflate | 512 x 512 window (4-9 chunks) | 2.00 MB | 110.26 | 18 | 0.606x |
+| chunked + deflate | one row | 0.02 MB | 105.81 | 0 | 0.582x |
+| chunked + deflate | one column | 0.03 MB | 108.37 | 0 | 0.596x |
+| chunked | full (first) | 64 MB | 97.4 | 657 | |
+| chunked | full (repeat) | 64 MB | 86.7 | 738 | 1.00x |
+| chunked | 64 x 64 window (1 chunk) | 0.03 MB | 40.97 | 1 | 0.420x |
+| chunked | 512 x 512 window (4-9 chunks) | 2.00 MB | 44.66 | 45 | 0.458x |
+| chunked | one row | 0.02 MB | 30.88 | 1 | 0.317x |
+| chunked | one column | 0.03 MB | 30.27 | 1 | 0.311x |
+| contiguous | full (first) | 64 MB | 57.6 | 1112 | |
+| contiguous | full (repeat) | 64 MB | 53.5 | 1195 | 1.00x |
+| contiguous | 64 x 64 window (1 chunk) | 0.03 MB | 30.97 | 1 | 0.538x |
+| contiguous | 512 x 512 window (4-9 chunks) | 2.00 MB | 31.64 | 63 | 0.550x |
+| contiguous | one row | 0.02 MB | 31.90 | 0 | 0.554x |
+| contiguous | one column | 0.03 MB | 29.36 | 1 | 0.510x |
+
+### After: partial reads
+
+Only the rows of a contiguous dataset, or the chunks, that overlap the
+selection's bounding box are read/decoded. A 64 x 64 window of the compressed
+dataset: **105 -> 0.39 ms**; one row: **106 -> 2.7 ms**; one column:
+**108 -> 5.2 ms**. (Absolute full-read times differ between the two runs
+because the machine's speed drifted; compare the *vs full read* column.)
+
+4096 x 2048 f64 (64 MB per dataset), chunks 256 x 256, file 129 MB
+
+| layout | read | selected | time ms | MB/s of selection | vs full read |
+|---|---|---:|---:|---:|---:|
+| chunked + deflate | full (first) | 64 MB | 112.5 | 569 | |
+| chunked + deflate | full (repeat) | 64 MB | 104.5 | 612 | 1.00x |
+| chunked + deflate | 64 x 64 window (1 chunk) | 0.03 MB | 0.39 | 81 | 0.003x |
+| chunked + deflate | 512 x 512 window (4-9 chunks) | 2.00 MB | 4.85 | 412 | 0.043x |
+| chunked + deflate | one row | 0.02 MB | 2.69 | 6 | 0.024x |
+| chunked + deflate | one column | 0.03 MB | 5.23 | 6 | 0.046x |
+| chunked | full (first) | 64 MB | 70.0 | 915 | |
+| chunked | full (repeat) | 64 MB | 61.7 | 1037 | 1.00x |
+| chunked | 64 x 64 window (1 chunk) | 0.03 MB | 0.06 | 541 | 0.001x |
+| chunked | 512 x 512 window (4-9 chunks) | 2.00 MB | 1.99 | 1005 | 0.028x |
+| chunked | one row | 0.02 MB | 0.05 | 285 | 0.001x |
+| chunked | one column | 0.03 MB | 0.45 | 69 | 0.006x |
+| contiguous | full (first) | 64 MB | 60.3 | 1062 | |
+| contiguous | full (repeat) | 64 MB | 56.4 | 1134 | 1.00x |
+| contiguous | 64 x 64 window (1 chunk) | 0.03 MB | 0.08 | 396 | 0.001x |
+| contiguous | 512 x 512 window (4-9 chunks) | 2.00 MB | 2.12 | 944 | 0.035x |
+| contiguous | one row | 0.02 MB | 0.03 | 576 | 0.000x |
+| contiguous | one column | 0.03 MB | 2.55 | 12 | 0.042x |
+
+### After: parallel cached decode, fewer copies (full reads)
+
+Full-read times, old and new binaries run alternately at the same moment (this
+machine's absolute speed drifts over a long session, so only same-moment
+comparisons mean anything):
+
+| layout (64 MB `f64`) | before | after |
+|---|---:|---:|
+| chunked + deflate | 110 ms | 69 ms |
+| chunked | 72 ms | 60 ms |
+| contiguous | 56 ms | 30 ms |
+
+What changed: the facade's cached read path decompressed chunks one at a time
+(only the uncached reader was parallel) and pushed every chunk through a 16 MiB
+cache that a 64 MB read simply churns; it now decodes cache misses in parallel
+batches and caches only datasets that fit. Unfiltered chunks are copied
+straight from the file bytes instead of via two intermediate buffers. A
+contiguous dataset is converted straight from the file bytes (one copy instead
+of two), and the native-endian conversions no longer zero a buffer they are
+about to overwrite.
+
+## Search harness baseline (v2.3.0)
+
+Produced by `cargo run --release -p clawhdf5-bench --bin search_harness -- --full`
+on deterministic **clustered** synthetic data (384-dim, unit-normalised; points =
+cluster centre + noise — uniform random vectors are nearly equidistant in high
+dimension and say nothing about embeddings). Recall is measured against an exact
+brute-force scan, 200 queries. This is the *before* picture for the search
+hot-path work; every change to that path should be justified by a re-run.
+
+Two things stand out:
+
+* **HNSW recall does not respond to `ef`** and degrades sharply with size
+  (0.87 → 0.67 → 0.31 recall@10 at 1K / 10K / 100K). Latency plateaus at the same
+  point, i.e. the search exhausts the nodes it can reach: on clustered data the
+  graph is poorly connected. The index selects neighbours by plain top-M
+  distance rather than the HNSW paper's diversity heuristic.
+* **End-to-end `hybrid_search` is ~1000x slower than its vector stage** (49 ms
+  vs ~0.03 ms at 10K; 884 ms at 100K). Each query rebuilds the BM25 index from
+  scratch and rewrites the whole `.h5` file. The first query after `open()`
+  additionally rebuilds the HNSW index (10.5 s at 100K).
+
+### HNSW, N = 1000, dim = 384, M = 16, ef_construction = 64
+
+build: 72.4 ms (13818 vectors/s) · exact scan: 3854 QPS, p50 258 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.8710 | 59484 | 16 | 31 |
+| 32 | 0.8730 | 46302 | 21 | 25 |
+| 64 | 0.8730 | 31683 | 31 | 44 |
+| 128 | 0.8730 | 24715 | 40 | 49 |
+| 256 | 0.8730 | 24788 | 40 | 50 |
+
+### HNSW, N = 10000, dim = 384, M = 16, ef_construction = 64
+
+build: 802.5 ms (12461 vectors/s) · exact scan: 418 QPS, p50 2363 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.6695 | 44031 | 19 | 51 |
+| 32 | 0.6705 | 45066 | 22 | 30 |
+| 64 | 0.6705 | 32746 | 30 | 41 |
+| 128 | 0.6705 | 27542 | 36 | 51 |
+| 256 | 0.6705 | 27754 | 36 | 49 |
+
+### HNSW, N = 100000, dim = 384, M = 16, ef_construction = 64
+
+build: 9752.6 ms (10254 vectors/s) · exact scan: 40 QPS, p50 24648 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.3085 | 18046 | 57 | 84 |
+| 32 | 0.3110 | 21621 | 43 | 75 |
+| 64 | 0.3130 | 20015 | 49 | 70 |
+| 128 | 0.3135 | 15822 | 63 | 99 |
+| 256 | 0.3135 | 15308 | 66 | 124 |
+
+### End to end: `HDF5Memory::hybrid_search` (k = 10, weights 0.7 / 0.3)
+
+| N | ingest ms | checkpoint ms | open ms | first query ms | p50 ms | p99 ms | QPS |
+|---:|---:|---:|---:|---:|---:|---:|---:|
+| 1000 | 11 | 3.9 | 0.9 | 68.1 | 5.48 | 5.57 | 182.5 |
+| 10000 | 114 | 32.2 | 10.9 | 845.0 | 48.56 | 78.65 | 19.8 |
+| 100000 | 1486 | 713.0 | 354.5 | 10486.5 | 883.51 | 975.23 | 1.1 |
+wrote /tmp/claude-1000/-home-osobh-projects-clawhdf5/422f755e-dd25-4c35-8613-5439087e3aaa/scratchpad/baseline_full.json
+
+### After: HNSW neighbour-selection heuristic
+
+Same harness, same data, after replacing closest-M neighbour selection with the
+HNSW paper's diversity heuristic (Algorithm 4, keeping pruned connections) for
+both new links and back-link pruning. Recall@10 at `ef = 64`: **0.87 → 1.00**
+(1K), **0.67 → 1.00** (10K), **0.31 → 0.98** (100K), and it now rises with
+`ef` as it should. The cost is a slower build (extra distance evaluations per
+insert: ~3.5x at 10K); the distance-kernel work that follows targets that.
+
+### HNSW, N = 1000, dim = 384, M = 16, ef_construction = 64
+
+build: 221.3 ms (4519 vectors/s) · exact scan: 3851 QPS, p50 258 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.9990 | 54760 | 18 | 29 |
+| 32 | 1.0000 | 40422 | 24 | 44 |
+| 64 | 1.0000 | 27744 | 36 | 51 |
+| 128 | 1.0000 | 13164 | 74 | 106 |
+| 256 | 1.0000 | 6879 | 144 | 175 |
+
+### HNSW, N = 10000, dim = 384, M = 16, ef_construction = 64
+
+build: 2733.5 ms (3658 vectors/s) · exact scan: 423 QPS, p50 2362 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.9975 | 31321 | 27 | 61 |
+| 32 | 1.0000 | 32427 | 29 | 48 |
+| 64 | 1.0000 | 22738 | 42 | 62 |
+| 128 | 1.0000 | 10055 | 99 | 129 |
+| 256 | 1.0000 | 4649 | 214 | 266 |
+
+### HNSW, N = 100000, dim = 384, M = 16, ef_construction = 64
+
+build: 36472.8 ms (2742 vectors/s) · exact scan: 40 QPS, p50 24644 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.9235 | 11394 | 82 | 194 |
+| 32 | 0.9675 | 12788 | 73 | 161 |
+| 64 | 0.9840 | 10406 | 91 | 186 |
+| 128 | 0.9990 | 7633 | 126 | 248 |
+| 256 | 0.9990 | 2823 | 352 | 510 |
+
+### After: persistent keyword index, no store rewrite per query
+
+`hybrid_search` used to rebuild the BM25 index from scratch (re-tokenising every
+record) and rewrite the whole `.h5` file on **every query**. The index is now
+kept for the life of the store and updated incrementally, and activation boosts
+are persisted by the next checkpoint instead of inside the query. Steady-state
+p50: **5.5 → 0.24 ms** (1K), **49 → 2.1 ms** (10K), **884 → 23 ms** (100K).
+
+The first query after `open()` is slower than before (it pays for the better —
+slower — HNSW build plus the one-off keyword index build); persisting the HNSW
+index removes that.
+
+### End to end: `HDF5Memory::hybrid_search` (k = 10, weights 0.7 / 0.3)
+
+| N | ingest ms | checkpoint ms | open ms | first query ms | p50 ms | p99 ms | QPS |
+|---:|---:|---:|---:|---:|---:|---:|---:|
+| 1000 | 11 | 3.8 | 0.9 | 195.9 | 0.24 | 0.27 | 4130.4 |
+| 10000 | 104 | 31.1 | 10.9 | 2627.1 | 2.09 | 2.11 | 479.5 |
+| 100000 | 1436 | 684.7 | 278.0 | 36308.1 | 22.90 | 25.46 | 43.5 |
+
+### After: vector index persisted with the checkpoint
+
+The HNSW graph (not the vectors, which the store already holds) is saved to
+`<store>.h5.ann` at each checkpoint and reloaded by `open()`, tied to that
+checkpoint by a generation id. The index is now built once per store (the *cold
+index build* column — the first query ever), not once per session. First query
+after `open()`: **196 → 1.7 ms** (1K), **2627 → 15 ms** (10K),
+**36308 → 159 ms** (100K); what remains is the one-off keyword index build.
+Batch saves no longer force a full rebuild either: appended records join the
+index incrementally.
+
+| N | ingest ms | cold index build ms | checkpoint ms | open ms | first query after open ms | p50 ms | p99 ms | QPS |
+|---:|---:|---:|---:|---:|---:|---:|---:|---:|
+| 1000 | 14 | 220 | 6.1 | 1.2 | 1.7 | 0.24 | 0.27 | 4049.9 |
+| 10000 | 120 | 2916 | 33.1 | 14.0 | 15.4 | 2.15 | 3.30 | 421.2 |
+| 100000 | 1591 | 40515 | 747.3 | 324.7 | 158.9 | 23.07 | 30.42 | 41.3 |
+
+### After: unit-vector dot product, reusable visited set
+
+Cosine distance recomputed both vector norms on every evaluation; the index now
+stores unit vectors and uses a plain dot product. The per-call `HashSet` of
+visited nodes became a reusable epoch-stamped array. Recall is unchanged.
+Build: **2.75 -> 1.89 s** (10K), **~38 -> 21 s** (100K). QPS at `ef = 64`:
+**22.7K -> 39K** (10K), **10.4K -> 14K** (100K).
+
+### HNSW, N = 1000, dim = 384, M = 16, ef_construction = 64
+
+build: 113.4 ms (8821 vectors/s) · exact scan: 4375 QPS, p50 225 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.9990 | 144379 | 7 | 15 |
+| 32 | 1.0000 | 110654 | 9 | 17 |
+| 64 | 1.0000 | 80446 | 12 | 25 |
+| 128 | 1.0000 | 38220 | 26 | 36 |
+| 256 | 1.0000 | 20041 | 50 | 62 |
+
+### HNSW, N = 10000, dim = 384, M = 16, ef_construction = 64
+
+build: 1519.4 ms (6581 vectors/s) · exact scan: 422 QPS, p50 2368 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.9975 | 54608 | 15 | 45 |
+| 32 | 1.0000 | 66009 | 14 | 24 |
+| 64 | 1.0000 | 49854 | 19 | 31 |
+| 128 | 1.0000 | 22403 | 45 | 57 |
+| 256 | 1.0000 | 10096 | 100 | 120 |
+
+### HNSW, N = 100000, dim = 384, M = 16, ef_construction = 64
+
+build: 21084.6 ms (4743 vectors/s) · exact scan: 39 QPS, p50 24739 µs
+
+| ef | recall@10 | QPS | p50 µs | p99 µs |
+|---:|---:|---:|---:|---:|
+| 16 | 0.9235 | 15139 | 61 | 154 |
+| 32 | 0.9675 | 18181 | 53 | 121 |
+| 64 | 0.9840 | 13980 | 70 | 139 |
+| 128 | 0.9990 | 10959 | 86 | 174 |
+| 256 | 0.9990 | 3731 | 254 | 697 |
+
+
+### After: unranked keyword scores, top-k merge (rankings unchanged)
+
+A fusion study (`search_harness --fusion-study`) showed that capping the
+keyword candidate pool is **not** a safe optimisation: against the current
+full-corpus normalisation the final top-10 overlap is only 0.83-0.92 and the
+first result changes for 10-35% of queries, for only a 2x saving. So the fusion
+semantics were left alone and the same answer made cheaper: fusion needs every
+keyword score but not their ranking, so BM25 now returns them unsorted from a
+dense accumulator (it hashed every posting and then sorted every match), and
+the merge selects its top k instead of sorting every candidate. Steady-state
+p50: **0.24 -> 0.07 ms** (1K), **2.1 -> 0.49 ms** (10K), **23 -> 4.65 ms**
+(100K) — **79x / 100x / 190x** faster than the v2.3.0 baseline, with identical
+results.
+
+### End to end: `HDF5Memory::hybrid_search` (k = 10, weights 0.7 / 0.3)
+
+| N | ingest ms | cold index build ms | checkpoint ms | open ms | first query after open ms | p50 ms | p99 ms | QPS |
+|---:|---:|---:|---:|---:|---:|---:|---:|---:|
+| 1000 | 11 | 112 | 4.0 | 1.1 | 1.4 | 0.07 | 0.08 | 14077.9 |
+| 10000 | 104 | 1487 | 33.8 | 13.7 | 13.9 | 0.49 | 0.51 | 2020.9 |
+| 100000 | 1376 | 20285 | 728.9 | 353.1 | 142.2 | 4.65 | 4.78 | 214.7 |
+
+### After: batched bulk build (optionally parallel); deletions handled in search
+
+Profiling showed **90% of a build's distance evaluations are in back-link
+pruning**. The bulk build now inserts in batches: plan each node's neighbours
+against the graph as it stood at the start of the batch, link, then prune every
+overflowing list once. That is less work even single-threaded (a node gaining
+several back-links in a batch is pruned once), and with the `parallel` feature
+planning and pruning run on a thread pool. The graph is deterministic and the
+same with or without the feature. Parallelising *within* one insert was tried
+first and gave only 1.45x on 16 cores (tasks too small).
+
+| build | 1K | 10K | 100K |
+|---|---:|---:|---:|
+| v2.4.0 | 116 ms | 1676 ms | ~21 s |
+| batched | 83 ms | 1074 ms | 19.2 s |
+| batched + `parallel` (16 cores) | 34 ms | 388 ms | 5.9 s |
+
+Recall on clustered data is unchanged or slightly better (100K, `ef = 64`:
+0.984 -> 0.9945). On uniform random data it dips slightly (10K, `ef = 64`:
+0.474 -> 0.444), the cost of batch members not seeing each other while
+planning; batches are capped at 1/16 of the graph and 512 nodes.
+
 ## Vector Search Latency
 
 Brute-force cosine similarity over 384-dimensional embeddings (OpenAI text-embedding-3-small size).
@@ -24,10 +485,19 @@ Brute-force cosine similarity over 384-dimensional embeddings (OpenAI text-embed
 
 MemX claims end-to-end search under 90ms at 100K records (Rust + libSQL + FTS5).
 
-| Metric | MemX (claimed) | ClawhDF5 | Speedup |
+> **Caveat — not like-for-like.** MemX's `<90 ms` is *end-to-end* search across their
-|--------|----------------|----------|---------|
+> full pipeline (dense embeddings + FTS5 + four-factor re-ranking). The clawhdf5
-| 100K flat search | <90 ms | 11.4 ms | **~8x** |
+> figures below are a *single component* — raw vector search latency, excluding
-| 100K IVF-PQ search | — | 1.19 ms | **~76x** |
+> embedding, keyword, fusion, and re-ranking stages. A component measured against a
+> full pipeline will always look favourable; the "speedup" column overstates the real
+> advantage by an unquantified margin and should be read as an order-of-magnitude
+> indication only, not a benchmark result. Matching MemX's measurement boundary is
+> tracked as follow-up work.
+
+| Metric | MemX (claimed, end-to-end) | ClawhDF5 (component only) | Ratio |
+|--------|----------------------------|---------------------------|-------|
+| 100K flat search | <90 ms | 11.4 ms | ~8x |
+| 100K IVF-PQ search | — | 1.19 ms | ~76x |
 | Keyword search 10K | 1,100x improvement over unindexed | 583 µs (BM25) | Comparable |
 
 ---
@@ -174,46 +644,290 @@ _Latency benchmarks generated with Criterion.rs (50-100 samples per benchmark).
 
 ## LongMemEval Results
 
-**Dataset:** LongMemEval oracle (500 questions, 6 question types, variable-length chat histories)
+> **Scoring target declaration.** Per [arXiv 2605.24060](https://arxiv.org/abs/2605.24060),
+> which found that changing scoring target alone alters nDCG on 83–94% of queries and
+> can reverse system rankings, this section states its measurement contract explicitly:
+>
+> - **Dataset variant:** both are now reported below — the full `longmemeval_s`
+>   haystack (**the headline number**) and `longmemeval_oracle` (evidence sessions
+>   only, a substantially easier corpus, kept for continuity). The harness does not
+>   trust the filename: it measures evidence-session density from the data and
+>   labels the run from that, so a mislabelled input cannot yield a mislabelled
+>   result. Measured density is 4.0% on `longmemeval_s` and 100.0% on the oracle.
+> - **Metric:** *retrieval recall.* A "hit" means the gold-labelled memory appeared in
+>   the top-k. **No answer is generated and none is scored** — the dataset's `answer`
+>   field is deserialized and never read. This is **not** the official LongMemEval
+>   leaderboard metric, which is end-to-end QA accuracy (retrieve → generate → LLM
+>   judge). Retrieval recall reported as QA accuracy typically overstates by 20–30 points.
+> - **Granularity:** turn-level = the returned memory's source turn had `has_answer == true`.
+> - **k = 10**, n = 500.
+> - **Retrieval mode:** all three are reported below. Historically the bench passed
+>   zero-vector embeddings with `vector_weight=0.0`, so the HNSW/vector stage was
+>   inert and every published number was BM25 alone. Real `all-MiniLM-L6-v2`
+>   embeddings are now available via `--features embeddings --embeddings <dir>`,
+>   and BM25-only / vector-only / hybrid are each measured separately.
+
 **Mode:** BM25-only retrieval — zero embeddings, `vector_weight=0.0`, `keyword_weight=1.0`
-**Reference:** MemX (arxiv:2603.16171) with full embedding system: Hit@5=51.6%, MRR=0.380
 
-> **Run:** `cargo run --release --bin longmemeval_bench`
+> **Run:** `cargo run --release --bin longmemeval_bench -- benchmarks/longmemeval/longmemeval_s_cleaned.json`
+> (~70 s for all 500 questions on the tank reference machine). Omit the path for the
+> oracle variant; add `--limit N` for an evenly-strided subsample.
 
-### Session-Level Recall (n=500)
+### Full haystack — `longmemeval_s`, n=500 (the number to cite)
 
-| Metric | ClawhDF5 (BM25-only) |
+47.7 sessions and 493.5 turns per question; 4.0% of haystack sessions are evidence
-|--------|---------------------|
+sessions, so retrieval has to actually discriminate.
-| Hit@1 | **100.0%** |
-| Hit@5 | **100.0%** |
-| Hit@10 | **100.0%** |
-| MRR | **1.0000** |
 
-Perfect session-level recall across all 500 questions and all 6 question types.
+| Metric | Turn-level | Session-level |
+|--------|-----------|---------------|
+| Hit@1 | 53.8% | 86.2% |
+| Hit@5 | **75.0%** | **93.6%** |
+| Hit@10 | 81.6% | 96.6% |
+| MRR | 0.6320 | 0.8948 |
 
-### Turn-Level Recall (n=500)
+Session-level is reported here because on this corpus it is meaningful — unlike on
+the oracle variant, where it was degenerate and was retracted (below). At 4.0%
+evidence density a session-level hit reflects discrimination rather than corpus
+shape.
 
-| Metric | ClawhDF5 (BM25-only) | MemX (full system)¹ |
+Per-type, session-level: `single-session-assistant` 100.0% Hit@1 (n=56),
-|--------|---------------------|---------------------|
+`knowledge-update` 96.2% (n=78), `single-session-user` 94.3% (n=70),
-| Hit@1 | **52.6%** | — |
+`multi-session` 84.2% (n=133), `temporal-reasoning` 84.2% (n=133), and
-| Hit@5 | **84.4%** | 51.6% |
+`single-session-preference` 33.3% (n=30) — the one category where BM25 clearly
-| Hit@10 | **90.4%** | — |
+struggles, since a preference question's evidence rarely shares vocabulary with
-| MRR | **0.6597** | 0.380 |
+the question.
 
-**clawhdf5 outperforms MemX at turn-level retrieval** — Hit@5 84.4% vs 51.6%, MRR 0.66 vs 0.38 — with BM25 alone, no embeddings needed.
+### Retrieval mode ablation — full haystack, n=500
 
-> ¹ MemX uses dense embeddings + FTS5 + four-factor re-ranking. Our BM25-only result exceeds their full pipeline.
+Real 384-d `all-MiniLM-L6-v2` embeddings, 190,015 unique texts encoded once on an
+RTX 5060 Ti (~13 min; the same work on the 8-core CPU was still unfinished after
+30 minutes, so the GPU path is not a convenience here). Turn-level:
 
-### Per-Type Breakdown (session-level)
+| Mode | Hit@1 | Hit@5 | Hit@10 | MRR |
+|------|-------|-------|--------|-----|
+| BM25 only (`0.0`/`1.0`) | **53.8%** | 75.0% | 81.6% | **0.6320** |
+| Vector only (`1.0`/`0.0`) | 36.0% | 71.8% | 81.6% | 0.5027 |
+| Hybrid (`0.7`/`0.3`) | 44.4% | **79.2%** | **86.0%** | 0.5868 |
 
-| Question Type | N | Hit@1 | Hit@5 | Hit@10 | MRR |
+Session-level:
-|---------------|---|-------|-------|--------|-----|
+
-| single-session-user | 70 | 100.0% | 100.0% | 100.0% | 1.0000 |
+| Mode | Hit@1 | Hit@5 | Hit@10 | MRR |
-| single-session-assistant | 56 | 100.0% | 100.0% | 100.0% | 1.0000 |
+|------|-------|-------|--------|-----|
-| single-session-preference | 30 | 100.0% | 100.0% | 100.0% | 1.0000 |
+| BM25 only | 86.2% | 93.6% | 96.6% | 0.8948 |
-| temporal-reasoning | 133 | 100.0% | 100.0% | 100.0% | 1.0000 |
+| Vector only | 85.4% | 94.2% | 96.6% | 0.8901 |
-| multi-session | 133 | 100.0% | 100.0% | 100.0% | 1.0000 |
+| Hybrid | **88.2%** | **95.8%** | **97.8%** | **0.9158** |
-| knowledge-update | 78 | 100.0% | 100.0% | 100.0% | 1.0000 |
+
+### Fusion method — weighted vs. RRF, full haystack, n=500
+
+Reciprocal rank fusion has been in the codebase since early on but was only
+reachable as a free function over a linear scan, so it had never been compared
+with the weighted sum on equal terms. `HDF5Memory::hybrid_search_with` now
+takes a `Fusion`, and both run over the same HNSW + BM25 candidates:
+
+| Mode | turn Hit@1 | Hit@5 | Hit@10 | MRR | session Hit@1 | session MRR |
+|---|---|---|---|---|---|---|
+| BM25 only | **53.8%** | 75.0% | 81.6% | 0.6320 | 86.2% | 0.8948 |
+| Vector only | 36.0% | 71.8% | 81.6% | 0.5031 | 85.4% | 0.8901 |
+| **Weighted 0.4 / 0.6** | 51.6% | **81.4%** | **87.8%** | **0.6430** | **91.0%** | **0.9347** |
+| RRF (k=60) | 45.0% | 78.8% | 87.6% | 0.5967 | 89.6% | 0.9253 |
+
+**RRF loses to the tuned weighted sum** — 6.6pp of turn Hit@1 and 0.046 of MRR
+— and lands almost exactly where the old `0.7/0.3` weighting did (44.2% / 
+0.5856). That is not a coincidence: RRF combines the two stages by rank with
+*equal* influence, and on this corpus the stages are not equally good. BM25
+alone beats the vector stage by 17.8pp at Hit@1, so any scheme that treats them
+as peers gives up rank-1 accuracy, and RRF discards the score magnitudes that
+would say which stage to believe.
+
+This is a property of the corpus, not a defect in RRF: its selling point is
+robustness when the two stages' scores are not comparable and there is no
+labelled data to tune against. Here there is, so the weighted sum is kept as
+the default. `Fusion::Rrf` remains available for callers whose stages are more
+evenly matched.
+
+### Keyword tokenizer — stemming, full haystack, n=500
+
+The keyword stage lowercases and splits on non-alphanumerics, with no stemming,
+so "training" and "trains" are unrelated terms. `TokenFilter::Stemmed` strips
+common English inflections (plurals, `-ing`/`-ed`, with consonant un-doubling)
+from documents and queries alike. Turn-level:
+
+| Mode | Hit@1 | Hit@5 | Hit@10 | MRR | session Hit@1 |
+|---|---|---|---|---|---|
+| BM25 only | **53.8%** | 75.0% | 81.6% | 0.6320 | 86.2% |
+| BM25 only, stemmed | 52.0% | 77.8% | 84.0% | 0.6320 | 88.0% |
+| Hybrid 0.4/0.6 | 51.6% | **81.4%** | 87.8% | **0.6430** | 91.0% |
+| Hybrid 0.4/0.6, stemmed | 50.2% | **81.4%** | **88.2%** | 0.6394 | **91.4%** |
+
+**Stemming is a trade, not a win, and the default stays off.** It reliably buys
+depth and costs the top rank: on BM25 alone, +2.8pp Hit@5 and +2.4pp Hit@10 for
+−1.8pp Hit@1, with MRR unchanged to four decimal places — the gains deeper down
+exactly offset the loss at rank 1. That is what conflation does: merging
+"train"/"training"/"trains" surfaces documents an exact-match query would never
+reach, and also lets a near-miss outrank the exact hit.
+
+On the configuration that actually ships (hybrid 0.4/0.6) the trade is
+narrower still — Hit@5 identical, Hit@10 +0.4pp, Hit@1 −1.4pp, MRR −0.004 —
+because the vector stage already supplies much of the recall stemming would
+add. There is no case here for changing the default; `TokenFilter::Stemmed`
+is available via `HDF5Memory::set_token_filter` for callers who want Hit@5/@10
+over rank-1 precision.
+
+### Re-ranking and recency — full haystack, n=500
+
+`reranker::rerank` combines temporal decay, source authority and Hebbian
+activation. Until now its combined score contained **no relevance term at
+all** — `RerankInput` did not carry the retrieval score — so a caller that
+re-ranked its candidates threw the retriever's ordering away and returned them
+ordered by age. The OpenClaw backend did exactly that on every search.
+
+Measuring that is unambiguous. "Recency" below is the share of
+`knowledge-update` questions where the newest gold session outranked the stale
+one (see `newest_gold_first`); ~45% is chance.
+
+| Mode | Hit@1 | Hit@5 | Hit@10 | MRR | recency |
+|---|---|---|---|---|---|
+| Hybrid 0.4/0.6, no re-rank | 51.6% | **81.4%** | 87.8% | 0.6430 | 45.0% |
+| + re-rank, **metadata only** (pre-fix) | 11.0% | 24.8% | 43.8% | 0.1829 | **87.5%** |
+| + re-rank, relevance-led, half-life 1 day | **52.0%** | 79.8% | 87.8% | 0.6403 | 51.7% |
+| + re-rank, relevance-led, half-life 7 days | 51.8% | 80.8% | 87.6% | **0.6437** | **52.2%** |
+| + re-rank, relevance-led, half-life 30 days | 51.8% | 81.0% | 87.8% | 0.6427 | 51.4% |
+| + re-rank, relevance-led, half-life 90 days | **52.0%** | 80.4% | 87.8% | 0.6425 | 50.8% |
+
+**The pre-fix row is the finding.** Ordering candidates by recency alone costs
+40.6pp of Hit@1 and two thirds of MRR: the results are the newest memories in
+the pool rather than the ones that answer the question. It does ace the recency
+metric, which is exactly what makes that metric worth having — a number that
+only goes up when a change is good would not have caught this.
+
+With relevance leading, retrieval is preserved (Hit@1 +0.4pp, MRR −0.003
+against no re-ranking) and recency discrimination gains 6–7pp. That is a real
+improvement but not a solved problem: recency only breaks near-ties, so it
+cannot reach the 87.5% the degenerate ordering gets. Those two rows are the
+ends of a trade-off, and the default sits deliberately near the relevance end.
+
+**Half-life is not a sensitive knob.** Across 1, 7, 30 and 90 days recency
+moves 1.4pp and MRR 0.003 — inside the noise of a 500-question run — because
+the temporal term is capped by its weight (0.3) while relevance differences
+between candidates are larger. The 24-hour default is kept; there is no
+measured reason to change it, and a corpus-matched value is not the lever it
+looks like.
+
+### Weight sweep — full haystack, n=500
+
+`0.7/0.3` was a documented default, never a searched one. Sweeping
+`vector_weight` from 0.0 to 1.0 (`--sweep`, reusing the one-time embedding
+table) shows it is not merely suboptimal but **strictly dominated**:
+
+| vector / keyword | Hit@1 | Hit@5 | Hit@10 | MRR | session Hit@5 |
+|---|---|---|---|---|---|
+| 0.0 / 1.0 (BM25) | **53.8%** | 75.0% | 81.6% | 0.6320 | 93.6% |
+| 0.1 / 0.9 | 53.2% | 77.4% | 83.8% | 0.6374 | 95.0% |
+| 0.2 / 0.8 | 53.6% | 78.2% | 85.6% | 0.6440 | 95.4% |
+| 0.3 / 0.7 | 53.2% | 78.8% | 87.2% | **0.6463** | 96.0% |
+| **0.4 / 0.6** | 51.6% | **81.4%** | 87.8% | 0.6429 | 96.8% |
+| 0.5 / 0.5 | 48.2% | **81.4%** | **88.2%** | 0.6234 | **97.4%** |
+| 0.6 / 0.4 | 46.6% | 79.8% | 87.4% | 0.6069 | 96.6% |
+| 0.7 / 0.3 *(old default)* | 44.4% | 79.2% | 86.0% | 0.5868 | 95.8% |
+| 0.8 / 0.2 | 40.6% | 76.2% | 85.4% | 0.5571 | 95.2% |
+| 0.9 / 0.1 | 37.8% | 73.4% | 84.6% | 0.5289 | 94.2% |
+| 1.0 / 0.0 (vector) | 36.0% | 71.8% | 81.6% | 0.5027 | 94.2% |
+
+**`0.4/0.6` beats `0.7/0.3` on every metric at both granularities** — Hit@1
++7.2pp, Hit@5 +2.2, Hit@10 +1.8, MRR +0.056. There is no trade being made; the
+old default was simply on the wrong side of the peak. **`0.4/0.6` is the
+recommended setting**, with `0.3/0.7` preferable if rank-1 precision matters
+most (it takes the best MRR in the sweep and gives up only 0.6pp of Hit@1
+against pure BM25).
+
+**Correction.** An earlier revision of this section, measuring only `0.7/0.3`,
+concluded that fusion "buys deeper recall and pays for it at rank 1" and advised
+callers taking a single top hit to prefer BM25. That was an artifact of the
+badly-chosen weight, not a property of fusion. At `0.3/0.7` hybrid *beats* BM25
+on MRR (0.6463 vs 0.6320) and on Hit@5 (78.8% vs 75.0%) while costing 0.6pp of
+Hit@1. The advice below is corrected accordingly.
+
+**Hybrid wins, once the weights are right.** At the old `0.7/0.3` the picture
+looked like a trade: best at Hit@5 and Hit@10, worse than BM25 at Hit@1 and MRR.
+The sweep above shows that was the weight, not fusion. At `0.4/0.6` hybrid leads
+Hit@5 and Hit@10 outright; at `0.3/0.7` it also leads MRR and is within 0.6pp of
+BM25 at Hit@1. Both dominate `0.7/0.3`.
+
+The rows below are kept at the three original settings because they are what the
+mode ablation measured — read them as "the shape of each stage in isolation",
+and take the operating point from the sweep. `0.4/0.6` is now the shipped
+default (`hybrid::DEFAULT_FUSION`).
+
+The same pattern shows up independently in omni-cortex's four-signal RRF ablation,
+where adding BM25 to a dense retriever raised nDCG@5 while lowering Hit@1 and MRR.
+Two different codebases, two different fusion schemes, same direction.
+
+Vector-only being *worse* than BM25 at every turn-level cutoff except Hit@10 is
+worth stating plainly rather than hiding: LongMemEval questions share substantial
+vocabulary with their evidence turns, which is close to the best case for lexical
+matching, and MiniLM at 384 dimensions is a small embedding model.
+
+> **Run:** `cargo run --release --bin longmemeval_bench --features embeddings -- \
+>   benchmarks/longmemeval/longmemeval_s_cleaned.json --embeddings weights/all-minilm-l6-v2`
+> For the GPU path use `--features embeddings-cuda`. That requires `nvcc` on
+> `PATH` at *build* time — cudarc's build script shells out to it. The toolkit
+> installs to `/usr/local/cuda/bin`, which many distributions do not export;
+> check with `nvcc --version` and, if it is missing, add it somewhere every
+> shell reads (for zsh that is `~/.zshenv`, not `~/.zshrc`, since build tooling
+> runs non-interactively). The device is selected at runtime with a CPU
+> fallback, so a machine without CUDA still produces correct numbers — just far
+> more slowly, and the bench says so on startup.
+>
+> Weights: `huggingface.co/sentence-transformers/all-MiniLM-L6-v2` — place
+> `model.safetensors` and `tokenizer.json` in the `--embeddings` directory.
+
+### Oracle variant — `longmemeval_oracle`, n=500 (easier corpus, kept for continuity)
+
+| Metric | ClawhDF5 (BM25-only, oracle variant) |
+|--------|--------------------------------------|
+| Hit@1 | 52.6% |
+| Hit@5 | **84.4%** |
+| Hit@10 | 90.4% |
+| MRR | 0.6597 |
+
+Turn-level. The 9.4-point gap between this and the full haystack's 75.0% is the
+price of the harder corpus, and is the reason oracle-only numbers should not be
+presented as LongMemEval results. Session-level figures on this variant are
+degenerate — see below.
+
+With real embeddings the same oracle corpus gives BM25-only 84.2% / vector-only
+80.4% / hybrid **85.2%** Hit@5 turn-level — hybrid ahead at Hit@5 and Hit@10 and
+behind at Hit@1, matching the full-haystack pattern above. (BM25-only reads 84.2%
+here against 84.4% with zero embedding vectors: one question of 500 changes rank,
+with MRR identical at 0.6597. On the full haystack the two agree exactly.)
+
+### Retracted: session-level recall and the MemX comparison
+
+Earlier revisions of this file reported session-level Hit@1/5/10 of **100.0%** with
+MRR **1.0000**, uniform across all six question types, and claimed clawhdf5
+"outperforms MemX at turn-level retrieval (84.4% vs 51.6%)". **Both are withdrawn.**
+
+**The session-level numbers are a degenerate artifact.** On the `longmemeval_oracle`
+variant, the ingested haystack for a question consists essentially only of that
+question's evidence sessions. Every returned document therefore belongs to an answer
+session, so session-level hit rate is ≈1.0 at rank 0 *by construction* — which is
+exactly why the result was a uniform 100.0% across every question type. It measured
+the shape of the corpus, not the retriever.
+
+**The MemX comparison was not like-for-like on two independent axes.** MemX
+([arxiv:2603.16171](https://arxiv.org/abs/2603.16171)) reports Hit@5 = 51.6% /
+MRR = 0.380 at **fact-level granularity over 220,349 fact-level records drawn from
+19,195 sessions**, and explicitly notes that fact-level "doubl[es] session-level
+performance." Our 84.4% is **turn-level, on the oracle subset**. Different retrieval
+granularity, and a corpus smaller by orders of magnitude. A higher number on an
+easier corpus at a different granularity is not an outperformance claim, and it
+should not have been presented as one.
+
+The full-haystack half of that gap is now closed: the section above reports
+`longmemeval_s` over all 500 questions. The **granularity** mismatch remains — MemX
+measures fact-level, we measure turn-level and session-level — so no cross-system
+claim is made here even now. Matching granularity would require fact-level
+extraction over the haystack, which this harness does not do.
 
 ### Search Latency (LongMemEval, n=500 queries)
 
@@ -368,6 +1082,54 @@ No network hop, no serialization — direct HashMap operations.
 
 ---
 
+## World-Model Sample Loading (vs h5py / stable-worldmodel shape)
+
+Reproduces the access pattern of `stable-worldmodel`'s HDF5 dataloader
+([arXiv 2605.21800](https://arxiv.org/abs/2605.21800), LeCun/Balestriero
+group), which supports HDF5 as one of three native formats and measures
+generic HDF5 at **1,416-1,474 samples/s** (vs Lance 4,815) for per-frame
+sample loading. This benchmark measures **clawhdf5 vs h5py on the same
+machine and the same file**, so the comparison is hardware-controlled.
+
+**Absolute numbers are not comparable to the paper's** - different hardware
+(AMD Ryzen 7 7800X3D, local NVMe, warm page cache), smaller frames, and no
+torch-tensor / transform step. Only the clawhdf5-vs-h5py ratio *here* is a
+controlled result. The workload is the dataloader shape: a `(N, H, W, C)`
+uint8 observation dataset (20,000 x 64x64x3 = 246 MB), each frame read once
+per pass in a fixed shuffled (random-access) order, 10 passes.
+
+Both read a **file written by h5py** - clawhdf5 parsing an
+externally-produced HDF5 file is itself the interop result. h5py opens SWMR
+with a 256 MB chunk cache, exactly `stable-worldmodel`'s `HDF5Dataset`; it
+materialises each frame as a numpy array (`d[i]`) and sums it. clawhdf5
+mmaps once, takes a zero-copy `&[u8]` over the contiguous dataset, and
+indexes frame `i` as a subslice.
+
+| Reader | samples/sec (median of 3) | vs h5py |
+|--------|---------------------------|---------|
+| **clawhdf5** (zero-copy view) | **593,000** | **8.1x** |
+| **clawhdf5** (materialised copy per frame) | **518,000** | **7.1x** |
+| h5py (swmr, 256 MB cache) | 73,000 | 1.0x |
+
+The **materialised-copy row is the fair, equal-work comparison** - it
+`to_vec()`s every frame so clawhdf5 pays the same per-frame allocation h5py
+does, and it is still **7.1x faster**. That the copy costs almost nothing
+(518k vs 593k) shows the h5py gap is **per-frame call overhead** (Python +
+library dispatch), not data movement. This is an in-page-cache measurement:
+it isolates the read-path overhead both libraries add on top of the OS,
+which is the thing that differs - not disk bandwidth, which is shared.
+
+Reproduce (`benchmarks/`):
+
+```bash
+python benchmarks/gen_worldmodel_frames.py /tmp/wm_frames.h5 20000
+cargo run --release -p clawhdf5-bench --example worldmodel_sampling -- /tmp/wm_frames.h5 10
+cargo run --release -p clawhdf5-bench --example worldmodel_sampling -- /tmp/wm_frames.h5 10 --copy
+python benchmarks/bench_worldmodel_h5py.py /tmp/wm_frames.h5 10
+```
+
+Measured 2026-08-07 on tank (Ryzen 7 7800X3D, 246 MB dataset in page cache).
+
 ## Cross-Platform Notes
 
 > **Run:** `./benchmarks/cross_platform.sh [--full] [--output results.json]`
@@ -649,3 +1411,117 @@ cargo bench -p clawhdf5-bench --features libhdf5-compare --bench h5bench_meta --
 cargo bench -p clawhdf5-bench --features libhdf5-compare --bench h5bench_meta -- metadata_parse_in_memory
 cargo bench -p clawhdf5-bench --features libhdf5-compare --bench h5bench_read -- read_zerocopy_mmap
 ```
+
+## Independent Validation: tank — LongMemEval & Vector Search (Ryzen 7 7800X3D), 2026-08-05
+
+Re-running the "LongMemEval Results" and "SIMD & Parallelism" sections above on
+tank (AMD Ryzen 7 7800X3D, 8C/16T, Ubuntu 26.04, same machine as the
+vs-libhdf5 validation above) to give both sections the dated, hardware-cited,
+reproducible citation the top-of-file traceability note flags them as
+missing.
+
+### LongMemEval Results (reproduction)
+
+```bash
+cd benchmarks/longmemeval
+wget https://huggingface.co/datasets/xiaowu0162/longmemeval-cleaned/resolve/main/longmemeval_oracle.json
+cargo run --release --bin longmemeval_bench
+```
+
+Recall numbers are deterministic (pure BM25 retrieval over a fixed dataset) and
+reproduce exactly. Scoring target as declared in the LongMemEval section above:
+retrieval recall, turn-level, k=10, `longmemeval_oracle` variant, BM25-only.
+
+| Metric | Turn-Level |
+|--------|------------|
+| Hit@1 | 52.6% |
+| Hit@5 | **84.4%** |
+| Hit@10 | 90.4% |
+| MRR | 0.6597 |
+
+Session-level figures are omitted here — they are degenerate on the oracle variant
+and have been retracted; see "Retracted: session-level recall and the MemX
+comparison" above.
+
+Search latency (hardware-dependent, tank numbers):
+
+| Metric | avg | p50 | p95 | p99 |
+|--------|-----|-----|-----|-----|
+| Latency | 2,431 µs | 2,105 µs | 7,250 µs | 12,018 µs |
+
+Higher than the i7-12650H figures at the top of this file (avg 1,004 µs) despite
+tank's faster single-core performance elsewhere in this document — BM25 search
+latency here scales with per-question haystack size and this run's variance is
+wider (p99 is ~5x the mean), suggesting this metric is more sensitive to
+momentary scheduling/cache effects than the flat-array vector-search benchmarks.
+Recorded as-is rather than smoothed.
+
+### SIMD & Parallelism (reproduction, with a correction)
+
+```bash
+cargo bench -p clawhdf5-agent --bench bench -- "^(strategy_scalar_10k|strategy_simd_10k|strategy_rayon_10k|adaptive_search_10k|simd_cosine_100k|rayon_cosine_100k)$"
+```
+
+The original 10K table above compares named benchmarks (`vector_search`,
+`rayon`, `strategy`) that, on inspection, don't all exercise the same
+scalar-vs-SIMD-vs-parallel axis the table implies — several of the
+`simd_cosine_10k`/`sequential_cosine_10k`-style benchmarks actually call the
+same underlying function under different names. The `adaptive_benches` group's
+`strategy_scalar_10k` / `strategy_simd_10k` / `strategy_rayon_10k` benchmarks
+are the ones that genuinely hold the dataset fixed and vary only the
+`SearchStrategy` enum, so they're the correct apples-to-apples comparison —
+used here instead.
+
+| Strategy | Latency (tank) | vs Sequential |
+|----------|-----------------|----------------|
+| Sequential (scalar) | 502 µs | 1.0x |
+| SIMD (auto-vectorized) | 327 µs | **1.53x** |
+| Rayon (parallel) | 323 µs | **1.55x** |
+| Adaptive (auto-select) | 339 µs | **1.48x** |
+
+Honest finding: the speedup from SIMD/parallelism over scalar is real but
+smaller here (~1.5x) than the i7-12650H figures above (~2.0x). The Ryzen 7
+7800X3D's large L3 cache (96MB 3D V-Cache) measurably narrows the gap versus a
+naive scalar loop compared to the i7 — this is a genuine hardware-dependent
+result, not a regression or measurement error, and is recorded rather than
+reconciled away.
+
+At 100K, no `strategy_*` benchmark exists in the current suite (`adaptive_benches`
+only covers n=10,000), so this row uses the same `simd_cosine_100k`/
+`rayon_cosine_100k` benchmarks as the original table — not a true scalar
+baseline, so no "vs Sequential" multiple is reported for it:
+
+| Strategy | Latency (tank) |
+|----------|-----------------|
+| SIMD | 6.60 ms |
+| Rayon parallel | 4.73 ms |
+
+### Vector Search Latency & Comparison to MemX (reproduction)
+
+```bash
+cargo bench -p clawhdf5-agent --bench bench -- "^(vector_search_1k|simd_cosine_10k|simd_cosine_100k|prenorm_search_10k|ivf_search_10k_nprobe10|ivf_search_100k_nprobe10|ivf_pq_search_100k|rairs_search_10k_nprobe10|bm25_search_10k)$"
+```
+
+| Scale | Flat Search | Pre-norm | IVF (nprobe=10) | IVF-PQ | RAIRS |
+|-------|-------------|----------|-----------------|--------|-------|
+| **1K** | 47.8 µs | — | — | — | — |
+| **10K** | 501 µs | 322 µs | 24.8 µs | — | 109 µs |
+| **100K** | 6.60 ms | — | 608 µs | 865 µs | — |
+
+(The 1K Pre-norm cell from the original table has no corresponding benchmark
+in the current suite — not re-verified, left blank rather than guessed.)
+
+Same not-like-for-like caveat as the "Comparison to MemX" section at the top of this
+file applies — MemX's figure is end-to-end, these are a single component. Ratios are
+an order-of-magnitude indication, not a benchmark result.
+
+| Metric | MemX (claimed, end-to-end) | ClawhDF5 (tank, component only) | Ratio |
+|--------|----------------------------|----------------------------------|-------|
+| 100K flat search | <90 ms | 6.60 ms | ~14x |
+| 100K IVF-PQ search | — | 865 µs | ~104x |
+| Keyword search 10K | 1,100x improvement over unindexed | 520 µs (BM25) | Comparable |
+
+Every figure in this subsection is faster than the corresponding i7-12650H
+number at the top of this file, consistent with the Ryzen 7 7800X3D's higher
+single-core throughput and larger cache observed in the vs-libhdf5 validation
+above.

CHANGELOG.md

@@ -1,6 +1,629 @@
 # Changelog
 
-## Unreleased
+## v2.7.0 (2026-09-20)
+
+### Upgrade Notes
+- **Two read-path bugs fixed, one of them silent.** Datasets indexed by an
+  Extensible Array (any dataset with one unlimited dimension) returned data
+  from the wrong chunks past their first few dozen. If you have readings taken
+  from such a dataset with an earlier release, they may be wrong; re-read them.
+- **A corrupt chunk index is now an error.** Fixed and Extensible Array
+  structures carry checksums that were previously ignored, so damage surfaced
+  as plausible data from the wrong offset. Code that read a damaged file and
+  got numbers will now get `ChecksumMismatch` instead. That is the point.
+- **Breaking:** `MemoryConfig` gained `hnsw_m`, `hnsw_ef_construction` and
+  `hnsw_ef_search`, so literal constructions need updating;
+  `..Default::default()` does not. All three default to the previous
+  behaviour.
+
+### Correctness
+- `clawhdf5-format`: **datasets indexed by an Extensible Array returned wrong
+  data beyond their first few dozen chunks.** One unlimited dimension gives a
+  dataset an Extensible Array chunk index, whose first elements (4 by default)
+  sit inline in the index block and whose rest live in data blocks sized by a
+  formula the reader got wrong. In the default layout everything through the
+  36th chunk happened to line up and the 37th onwards did not: a 400-chunk
+  dataset silently returned wrong values from chunk 37, and datasets past
+  about a thousand chunks failed outright with "invalid Extensible Array data
+  block signature". **Reads were wrong, not
+  merely refused** — the caller got plausible numbers from the wrong chunks.
+  Four separate layout errors, each checked against files written by HDF5 2.0
+  and against the library source:
+  - the number of data blocks in super block `u` is `2^(u/2)`, not `2^u`;
+  - each holds `2^((u+1)/2) * data_blk_min_elmts` elements, which doubles
+    every *other* level rather than every level;
+  - a super block carries a block-offset field before its data block
+    addresses, which was not skipped;
+  - the page-init bitmap belongs to the super block, one bit per page packed
+    across all its data blocks (MSB first), and was being read from inside the
+    data block instead; a paged data block also ends its prefix with a
+    checksum before the first page.
+  Covered now by interop tests at 4, 37, 400, 5 000 and 200 000 chunks (the
+  last large enough for paged data blocks), plus sparse, gzip-filtered and
+  2-D cases. Writing is unaffected; this is a read-path bug.
+- `clawhdf5-format`: the sibling Fixed Array index (fixed dimensions written
+  with `libver='latest'`) was checked against the same range and is correct,
+  including paged data blocks and sparse datasets — it really does keep its
+  page-init bitmap in the data block, where the Extensible Array does not.
+  It had no real-file coverage above the inline sizes either, so it now has
+  the same tests.
+
+### Security
+- `clawhdf5-format`: **a crafted file could crash any reader through B-tree v2
+  traversal.** Recursion was bounded only by the depth the file claimed (a
+  `u16`), and child addresses were never checked for sharing. A node listing
+  itself as its own child under a header claiming 65 535 levels — under 100
+  bytes — overflowed the stack and **aborted the process** (SIGABRT, not a
+  catchable error). Levels whose children all point at one shared node below
+  reached it fan-out^depth times: 29.5 million records from ~5 KB, and one
+  more level would exhaust memory. Both are now errors, returned in under a
+  millisecond: depth is capped at 64 (as the fractal heap already was), and
+  traversal stops once it has produced more records than the file has bytes
+  to hold. Every B-tree v2 user goes through this path — dense attributes,
+  v2 groups, shared messages and chunk indexes. Valid files are unaffected,
+  including a depth-2 HDF5 2.0 chunk index with 40 000 records, now covered by
+  an interop test.
+
+### Integrity
+- `clawhdf5-format`: **Fixed and Extensible Array chunk indexes now verify
+  their checksums** (the `checksum` feature, on by default). Every structure
+  in both — header, index block, super block, data block and each data block
+  page — carries a Jenkins lookup3 checksum that was parsed past and ignored.
+  The consequence of skipping it is not a missing warning but wrong data: a
+  single flipped bit in a chunk address still parses, still points inside the
+  file, and the reader hands back whatever bytes now sit there as the chunk's
+  contents. Verified in both directions — the checksums accept files written
+  by HDF5 2.0 at 100 to 200 000 chunks, dense, sparse, filtered and paged,
+  and an interop test corrupts an address to confirm the read now fails
+  instead of returning data (it does return data when the check is removed).
+
+### Performance
+- `clawhdf5-agent`: **opening a store is ~28% faster** (455 ms -> 327 ms at
+  100k x 384). `read_from_disk` memory-mapped the file and then copied the
+  entire mapping into a `Vec` for `File::from_bytes`, when `File::open`
+  memory-maps it directly — so every open paid a full-file memcpy for nothing.
+  Process peak memory is unchanged: the peak falls after the parse, during the
+  index build, so the transient never reached the high-water mark. The
+  footprint harness now reports that peak next to the retained figure, which
+  is how this was checked rather than assumed.
+- `clawhdf5-accel`: **`dot_i8`, a runtime-dispatched int8 dot product** (AVX2:
+  sign-extend each half to `i16`, then `madd_epi16`; scalar fallback
+  elsewhere). The quantised HNSW index used a scalar loop while the `f32` path
+  it was measured against ran AVX2, so the ~13% throughput cost recorded for
+  `MemoryConfig::quantized_index` was a missing kernel rather than a property
+  of int8. With the kernel, at N = 100 000 x 384 and equal recall, the
+  quantised index answers **1.63x as many queries per second** (21 848 vs
+  13 399 at ef=64, recall 0.9940 vs 0.9945) and builds **1.8x faster** (1778
+  vs 3197 ms) — on top of holding a quarter of the vectors. Medians of three
+  alternating runs. It remains off by default only because the kernel is
+  AVX2-only and aarch64 falls back to the scalar loop. Integer arithmetic, so
+  the SIMD path is tested to agree with scalar bit for bit.
+
+### Tuning
+- `clawhdf5-agent`: **the HNSW parameters are configurable** —
+  `MemoryConfig::hnsw_m`, `hnsw_ef_construction` and `hnsw_ef_search`
+  (defaults 16, 64, and 0 meaning "scale with `k`", i.e. today's behaviour).
+  They were constants, so a deployment could not trade recall against memory
+  or query speed at all. All three are persisted with the store. Values are
+  clamped where the index requires it: `clawhdf5-ann` asserts a graph degree
+  of at least 2, so a configured 0 — from a file, or from a caller who took 0
+  to mean "default" — used to abort the process inside the builder. Lowering
+  `ef_search` also no longer narrows the candidate pool that fusion sees.
+  **Breaking:** `MemoryConfig` gained fields, so literal constructions need
+  updating; `..Default::default()` does not.
+
+### Documentation
+- `clawhdf5-agent`: `BM25Index::search` claimed to use Block-Max WAND for early
+  termination. It never did; it scores every match exhaustively. It now says
+  so, and why no pruning would help the store: `hybrid_search` uses `scores()`,
+  since fusion normalises over every match.
+
+## v2.6.0 (2026-09-20)
+
+### Upgrade Notes
+- **Re-ranked results change, substantially for the better.** `RerankInput`
+  and `ReRankConfig` gained fields (`relevance`, `relevance_weight`), so
+  literal constructions need updating; `..Default::default()` does not. Any
+  caller that re-ranked was previously getting results ordered by age with the
+  retrieval score discarded — see below.
+- **Breaking:** `MemoryCache::embeddings` is a `cache::Embeddings` rather than
+  a `Vec<Vec<f32>>` (indexing still yields a `&[f32]` row); `embeddings_flat`
+  is gone, replaced by `flat_embeddings()`; `rebuild_flat()` is a deprecated
+  no-op.
+- `MemoryConfig` gained `quantized_index` (default `false`, so behaviour is
+  unchanged unless you opt in); literal constructions need the field.
+
+### Retrieval quality
+- `clawhdf5-agent`: **re-ranking discarded the retrieval score.**
+  `reranker::rerank` built its combined score from temporal decay, source
+  authority and Hebbian activation only — `RerankInput` had no relevance field
+  — so re-ranking a candidate pool reordered it by age and threw the
+  retriever's ordering away. The OpenClaw backend re-ranked every search, so
+  this was its shipping behaviour: measured over the full LongMemEval haystack
+  it cost **40.6pp of Hit@1** (11.0% vs 51.6%) and two thirds of MRR (0.183 vs
+  0.643). `RerankInput::relevance` and `ReRankConfig::relevance_weight` (1.0 by
+  default) fix it: relevance leads and the metadata signals break near-ties,
+  which restores retrieval (Hit@1 +0.4pp vs no re-ranking) and improves
+  recency discrimination by 6–7pp. **Breaking:** `RerankInput` and
+  `ReRankConfig` gained fields, so literal constructions need updating;
+  `..Default::default()` does not.
+- `clawhdf5-bench`: the LongMemEval harness feeds the dataset's real session
+  dates to the store instead of a synthetic counter (decay needs true
+  intervals, not just the right order), and reports `newest_gold_first` — on a
+  `knowledge-update` question, did the newest gold session outrank the stale
+  one it supersedes? Plain recall cannot see this, because both are labelled
+  gold. New `--rerank-sweep`.
+
+### Memory
+- `clawhdf5-agent`: **`MemoryConfig::quantized_index`** stores the vector
+  index's own copy of the embeddings as `i8` rather than `f32`, which at 100k
+  384-dim entries takes the index from 266 to 123 MiB and the whole reopened
+  store from 399 to 256 MiB (2.72x -> **1.74x** the raw vectors). Quantised
+  distances are approximate and `ef` cannot compensate — recall@10 tops out at
+  0.967 against f32's 0.9995 — so the query path re-scores the candidate pool
+  against the exact embeddings the store already holds, which restores recall
+  (0.9940 vs 0.9945 at ef=64) for about 13% of QPS. **Off by default**: it
+  trades query speed for memory, and which side is worth more depends on the
+  deployment. The setting is persisted, so a reopened store does not silently
+  revert to four times the index memory.
+- `clawhdf5-ann`: `Storage::Int8` and the `build_with` / `new_with` /
+  `from_graph_bytes_with` constructors that select it. The scale is per row,
+  not global — a fixed `[-1, 1]` scale spends fewer than 12 of the 255 levels
+  on a unit-length 128-dim vector and is unusable (0.35 top-10 overlap against
+  an exact ranking, versus 0.99 per row). `compact()` keeps the storage it was
+  given; serialized indexes still carry f32 vectors, so a quantised index is
+  rebuilt rather than loaded.
+- `clawhdf5-agent`: **a loaded store holds ~30% less memory** (100k 384-dim
+  entries: 505 -> 357 MiB, 3.44x -> 2.43x the raw vectors). The cache kept
+  every embedding twice — a `Vec<Vec<f32>>` and a flattened copy for the
+  batched kernels, maintained in lock-step — so it now stores only the flat
+  buffer and indexes into it. Recall and query latency are unchanged.
+  **Breaking:** `MemoryCache::embeddings` is a `cache::Embeddings` rather than
+  a `Vec<Vec<f32>>` (indexing still yields a `&[f32]` row); `embeddings_flat`
+  is gone, replaced by `flat_embeddings()`; `rebuild_flat()` is a deprecated
+  no-op. Rows are now always exactly `dim` long — shorter ones are
+  zero-padded — which makes the ragged-row case that used to silently
+  misalign the flattened copy unrepresentable.
+- `clawhdf5-bench`: `search_harness --footprint` reports live heap use per
+  stage, measured with a counting allocator (RSS cannot see a structure freed
+  into the allocator's own pool).
+
+### Testing
+- The Python interop suites honour **`CLAWHDF5_PYTHON`**, and `ci-test.sh`
+  picks up a `.venv/bin/python` automatically. On a PEP 668 "externally
+  managed" system h5py cannot be installed into the system interpreter at all,
+  so every interop suite — the h5py writer round-trips, the facade, netCDF4
+  and the reference files — was skipping silently. A silent skip here is
+  exactly how the v5 compound-datatype bug reached a release.
+  `CLAWHDF5_REQUIRE_INTEROP=1` still turns a skip into a failure.
+
+## v2.5.0 (2026-09-19)
+
+### Upgrade Notes
+- **Retrieval rankings change, for the better.** The default fusion weights
+  move from `0.7/0.3` to `0.4/0.6` (`hybrid::DEFAULT_FUSION`), measured over the
+  full LongMemEval haystack: turn-level Hit@1 51.6% vs 44.2%, MRR 0.643 vs
+  0.586. `unified_search` and the OpenClaw backend pick this up automatically;
+  callers passing weights to `hybrid_search` explicitly are unaffected.
+- **Out-of-range selections are now errors.** `read_*_selection` used to return
+  data for a selection that ran past a dataset edge — a hyperslab came back
+  zero-padded, and a point with an out-of-range coordinate wrapped into the
+  next row. Both are now `FormatError::SelectionOutOfBounds`. Code relying on
+  the old (wrong) values will start seeing errors.
+- **Large compressed datasets written without explicit chunk dimensions get a
+  different layout.** They used to be stored as one chunk; they are now split
+  to ~1 MiB chunks. The files stay standard and h5py-readable, and explicit
+  `with_chunks` is unaffected.
+- `rayon` is now a default dependency of `clawhdf5-agent` (the parallel index
+  build). Opt out with `--no-default-features --features float16,hnsw`.
+- `clawhdf5-ann` search results no longer shrink when records near the query
+  have been deleted, so a search that previously returned fewer than `k`
+  results now returns `k`.
+
+### Retrieval quality
+- `clawhdf5-agent`: optional keyword stemming — `bm25::TokenFilter::Stemmed`
+  and `HDF5Memory::set_token_filter`, so "training" and "trains" match. **Off
+  by default**, on measurement rather than principle: over the full LongMemEval
+  haystack it buys depth and costs the top rank (BM25 alone: Hit@5 +2.8pp,
+  Hit@10 +2.4pp, Hit@1 −1.8pp, MRR unchanged), and on the shipping hybrid
+  configuration the trade is narrower still. See `BENCHMARKS.md`.
+- `clawhdf5-agent`: **`QueryExpander::expand` panicked on ordinary non-ASCII
+  input** — `"İ AI"` was enough. It searched a lowercased copy of the query and
+  then sliced the *original* with those offsets, which only works while
+  lowercasing preserves byte length (Turkish `İ` is 2 bytes and lowercases to
+  3). Depending on where the offsets drifted it either corrupted the output
+  ("İstanbul AI trip" lost a character) or panicked. Matching now walks the
+  original string.
+- `clawhdf5-agent`: query expansion no longer rewrites text inside words.
+  `replace_word_case_insensitive` did a plain substring replace despite its
+  name, so "training" became "trArtificial Intelligencening" and "programming"
+  became "Pull Requestogramming" — every acronym expansion of ordinary prose
+  was corrupt. Matches now require word boundaries; genuine acronyms
+  (`API`, `database`) still expand.
+- `clawhdf5-agent`: **the default fusion weights are now the measured ones.**
+  A sweep of every 0.1 step over the full LongMemEval haystack (500 questions,
+  real MiniLM embeddings) shows the long-standing `0.7/0.3` default is
+  *strictly dominated* by `0.4/0.6` — turn-level Hit@1 51.6% vs 44.2%, Hit@5
+  81.4% vs 79.2%, Hit@10 87.8% vs 85.8%, MRR 0.643 vs 0.586, and better at
+  session level too. The finding was recorded in `BENCHMARKS.md` but had never
+  been applied: `unified_search` and the OpenClaw backend both hardcoded
+  `0.7/0.3`. They now use `hybrid::DEFAULT_FUSION`. **Callers passing weights
+  to `hybrid_search` explicitly are unaffected** — pass `0.4`/`0.6` (or use
+  `hybrid_search_with`) to get the tuned behaviour.
+- `clawhdf5-agent`: fusion is now selectable. New `hybrid::Fusion`
+  (`Weighted { vector, keyword }` or `Rrf { k }`), `hybrid::fuse`,
+  `hybrid::hybrid_search_fused` and `HDF5Memory::hybrid_search_with`.
+  Reciprocal rank fusion existed but was unreachable from the store, so it had
+  never been measured against the weighted sum; the LongMemEval bench now has
+  an `RRF` mode.
+
+### HDF5 Read Path
+- **Selection reads cost what the selection costs.** `read_*_selection` decoded
+  the *entire* dataset and then picked elements out, so a 64 x 64 window of a
+  64 MB compressed dataset took 105 ms - about as long as reading all of it.
+  Now only the rows (contiguous) or chunks that overlap the selection's
+  bounding box are read and decompressed: that window takes 0.39 ms, one row
+  2.7 ms, one column 5.2 ms. Results are identical to the full-read path
+  (equivalence-tested over random hyperslabs and point lists, ranks 1-3,
+  contiguous / chunked / deflate). New `read_harness` bench binary.
+- **Faster full reads** (same-moment A/B, 64 MB `f64`): chunked + deflate
+  110 -> 69 ms, chunked 72 -> 60 ms, contiguous 56 -> 30 ms. The facade's
+  cached read path now decompresses cache misses in parallel batches (it was
+  sequential; only the uncached reader was parallel) and caches only datasets
+  that fit the chunk cache; unfiltered chunks are copied straight from the file
+  bytes; a contiguous dataset is converted straight from the file bytes; and
+  the native-endian conversions no longer zero a buffer before overwriting it.
+- **Datasets indexed by a version-2 B-tree now read** (layout v4, chunk index
+  type 5 — what `libver='latest'` uses for two or more unlimited dimensions;
+  previously "unsupported chunked layout"). The four copies of the chunk-index
+  dispatch are now one shared function, so every read path gets it.
+- **`H5T_STD_REF` references** (HDF5 1.12+, datatype message version 4) parse:
+  `ReferenceType` gains `Object2`, `DatasetRegion2` and `Attribute`, and
+  `read_object_references` decodes the new object references. Previously any
+  dataset of this type failed with `InvalidReferenceType(2)`. Tested against a
+  file written by HDF5 2.0 itself (fixture + generator script committed).
+- **Automatic chunk sizes.** Asking for compression (or any filter) without
+  `with_chunks` used to store the whole dataset as one chunk, so any read had
+  to decompress everything and nothing could be decoded in parallel. Datasets up
+  to 1 MiB stay a single chunk, as before; larger ones are split by halving the
+  dimensions in turn until a chunk is at most 1 MiB (the approach h5py takes).
+  **Behaviour change:** large compressed datasets written without explicit
+  chunk dimensions get a different (standard, h5py-readable) layout. Explicit
+  `with_chunks` is unaffected.
+- **Out-of-range selections are errors.** They used to return data: a hyperslab
+  past an edge came back padded with zeros, and a point whose column was out of
+  range wrapped into the next row and returned that element. Now
+  `FormatError::SelectionOutOfBounds` (also for a rank mismatch or overlapping
+  blocks).
+
+### Search
+- `clawhdf5-ann`: **faster index builds.** Back-link pruning is 90% of a
+  build's distance evaluations; the bulk build now inserts in batches and
+  prunes each overflowing neighbour list once per batch (10K: 1676 -> 1074 ms).
+  With the `parallel` feature, planning and pruning run on a thread pool (10K:
+  388 ms, 100K: ~21 s -> 5.9 s on 16 cores). The graph is deterministic and
+  identical with or without the feature. `clawhdf5-agent`'s `parallel` feature
+  enables it for the agent's index and is now **on by default** (adds `rayon`
+  to the default dependency set; build with `--no-default-features --features
+  float16,hnsw` to opt out).
+- `clawhdf5-ann`: `HnswIndex::search` returned fewer than `k` results — often
+  none — when the records nearest the query had been deleted: it collected `ef`
+  candidates, *then* dropped the deleted ones, *then* took `k`. Deleted nodes
+  are now traversed as waypoints but never occupy a result slot, so a search
+  returns the `k` nearest live records. Matters for any store that deletes or
+  supersedes memories without compacting straight away.
+
+## v2.4.0 (2026-09-19)
+
+### Upgrade Notes
+- **Search results improve on upgrade.** The HNSW index now reaches true
+  neighbours it previously could not (recall@10 0.31 -> 0.98 at 100K records on
+  clustered data), so `hybrid_search` rankings change for the better. The agent
+  rebuilds its index from the store automatically; a standalone `HnswIndex`
+  persisted with `to_hdf5_bytes` keeps its old graph until rebuilt.
+- **`hybrid_search` no longer writes the store.** Hebbian activation boosts are
+  persisted by the next checkpoint (any flushing write, `flush_wal`, or when
+  the `HDF5Memory` is dropped) instead of inside every query; a crash before
+  then forgets only the boosts since the last checkpoint. Activation weights
+  are now capped at 16.
+- A new sidecar file, `<store>.h5.ann`, holds the vector index graph. It is
+  derived data: safe to delete (the index is rebuilt), copied by `snapshot()`,
+  and worth including when copying a store by hand to avoid a rebuild.
+- `BM25Index` no longer caches IDF and gained `add_document`,
+  `remove_document`, `pad_to`, `scores`, `len` and `is_empty`; results are now
+  deterministic (ties break by record id).
+
+### Search
+- `clawhdf5-ann`: **HNSW recall fix.** Neighbours were chosen as the plain
+  closest-M, which on clustered data (what embeddings look like) turns each
+  cluster into an island: recall@10 was 0.87 / 0.67 / 0.31 at 1K / 10K / 100K
+  vectors and did not improve with `ef`. The index now uses the HNSW paper's
+  diversity heuristic (Algorithm 4 with kept pruned connections) when linking a
+  new node and when pruning back-links: recall@10 at `ef = 64` is 1.00 / 1.00 /
+  0.98 and responds to `ef`. Builds are slower (~3.5x at 10K). Existing
+  persisted indexes keep their old graph until rebuilt; the agent rebuilds its
+  index from the cache, so stores pick this up automatically.
+- `clawhdf5-agent`: **`hybrid_search` is 23-39x faster in steady state** (p50
+  5.5 -> 0.24 ms at 1K records, 49 -> 2.1 ms at 10K, 884 -> 23 ms at 100K).
+  Every query used to rebuild the BM25 index from scratch and rewrite the whole
+  `.h5` file. The keyword index now lives for the life of the store and is
+  updated incrementally (add / remove / in-place update, exactly equivalent to
+  a fresh build - property-tested), and a query no longer writes the store.
+  **Behaviour change:** Hebbian activation boosts are persisted by the next
+  checkpoint (any flushing write, `flush_wal`, or drop) rather than
+  immediately; a crash in between forgets only the boosts since the last
+  checkpoint. Activation weights are now capped (16.0) - they grew without
+  bound.
+- `clawhdf5-agent`: **the vector index is persisted**, so `open()` no longer
+  rebuilds it on the first search (first query after open: 2627 -> 15 ms at 10K
+  records, 36 s -> 159 ms at 100K). The HNSW graph — not the vectors, which the
+  store already holds — is written to `<store>.h5.ann` at each checkpoint and
+  tied to it by a generation id in `/meta`; a missing, stale, damaged or
+  structurally invalid sidecar is ignored and the index rebuilt. Records
+  replayed from the WAL join the loaded index incrementally; a replayed update
+  or delete invalidates it. `snapshot()` copies it. Batch saves no longer force
+  a full index rebuild.
+- `clawhdf5-ann`: faster HNSW build and search with identical recall. The
+  cosine metric stores unit vectors and compares them with a plain dot product
+  (it re-derived both norms on every distance evaluation), and the per-call
+  `HashSet` of visited nodes is a reusable epoch-stamped array. Build 2.75 ->
+  1.89 s at 10K and ~38 -> 21 s at 100K; QPS at `ef = 64` 22.7K -> 39K at 10K.
+  Distances returned by `search` are unchanged (1 - cosine). Indexes loaded
+  from older HDF5 files are normalised on load.
+- `clawhdf5-accel`: the SIMD backend is detected once per process instead of
+  on every kernel call.
+- `clawhdf5-ann`: `HnswIndex::graph_to_bytes` / `from_graph_bytes` — graph-only
+  serialization (checksummed, every neighbour id and level validated on load).
+- `clawhdf5-agent`: a further 4-5x on `hybrid_search` with **identical
+  rankings** (p50 now 0.07 / 0.49 / 4.65 ms at 1K / 10K / 100K — 79x / 100x /
+  190x faster than v2.3.0). Fusion needs every keyword score but not their
+  ranking: new `BM25Index::scores` returns them unsorted from a dense
+  accumulator (it hashed every posting, then sorted every match), and
+  `merge_vector_keyword` selects its top k instead of sorting every candidate.
+  Capping the keyword candidate pool was measured and rejected: it changes the
+  top-10 for most queries (`search_harness --fusion-study`).
+- `clawhdf5-agent`: BM25 results are deterministic (ties break by record id),
+  top-k uses a bounded heap, and the "WAND early termination" that computed a
+  bound and then ignored it is gone. IDF is computed per query.
+- `clawhdf5-bench`: new `search_harness` binary — HNSW recall@10 / QPS / latency
+  per `ef` against an exact scan, and end-to-end `hybrid_search` timings, on
+  deterministic clustered (or `--uniform`) data. Baseline in `BENCHMARKS.md`.
+
+## v2.3.0 (2026-09-19)
+
+### Upgrade Notes
+- **A memory store now has a single writer.** `HDF5Memory::create`/`open` take
+  an exclusive lock (`<store>.h5.lock`); a second open of the same store — in
+  the same or another process — returns `MemoryError::Locked`. Code that opened
+  a second handle just to read should use `HDF5Memory::open_read_only`.
+- **Unsigned array attributes arrive as `AttrValue::U64Array`**, not
+  `I64Array`, and `attrs()` may now return `AttrValue::Raw`. Exhaustive matches
+  on `AttrValue` need the two new arms.
+- **WAL header version 3 → 4.** v3 files are read and upgraded in place, but a
+  store written by 2.3.0 with a pending WAL cannot be opened by 2.2.0 or
+  earlier (it is refused, not corrupted). Checkpoint first
+  (`flush_wal`) if you need to downgrade.
+- `MemoryConfig::compression` now uses deflate unless the agent's new `zstd`
+  feature is enabled; it previously failed outright in a default build.
+- `MemoryError` gained `Locked`; `FormatError` gained `UnresolvedSharedMessage`,
+  `ExternalDataFilesUnsupported` and `ExternalLinkUnsupported`; `MessageType`
+  gained `ExternalDataFiles`.
+
+### Bug Fixes
+- `clawhdf5-format`: compound datatypes written with **default libver bounds**
+  (datatype message version 1 — what plain `h5py.File(path, 'w')` produces)
+  were mis-parsed. The v1 member layout carries 28 bytes of legacy array
+  fields after the byte offset (the parser skipped 24), and v2 pads member
+  names to 8 bytes and has no array fields at all (the parser did neither), so
+  every member after the first byte offset was read from the wrong position —
+  typically surfacing as `Overflow("compound member ...")` on read. Found by
+  adding a default-libver axis to the h5py interop tests; byte-level regression
+  tests for v1 and v2 added.
+- `clawhdf5-gpu`: `gpu_tests` could hang forever under the default parallel
+  test runner — every test created its own wgpu instance and device at once.
+  Tests now serialise GPU access, and GPU→CPU readback waits are bounded
+  (30 s) so a wedged driver returns `GpuError::BufferMap` instead of blocking.
+- `clawhdf5-agent`: `benches/bench.rs` and `benches/memory_bench.rs` no longer
+  compiled against the current `strategy`/`consolidation` APIs.
+
+### HDF5 Compatibility
+- `clawhdf5-format`/`clawhdf5`: datasets and attributes that use a **committed
+  (named) datatype** now read correctly. They store a shared-message reference;
+  the facade parsed the reference bytes as the datatype (`Time { size: 0 }`,
+  unreadable data) and silently dropped such attributes. The shared-reference
+  parser itself was wrong for real files: version 2 has no reserved bytes, and
+  the version 3 types were inverted (1 = SOHM heap, 2 = committed).
+- **Fill values are applied on read.** There was no Fill Value message parser:
+  the holes of a sparse chunked dataset read as zeros even when the fill value
+  was not zero (silently wrong data), and a dataset that was created but never
+  written failed with `NoDataAllocated` where h5py returns a filled array.
+  Messages v1–v3 and the old 0x0004 form are parsed; the fill value is written
+  into exactly the chunk-grid cells missing from the chunk index.
+- **Soft links are followed** during path resolution, in old- and new-style
+  groups (absolute/relative targets, links to groups, links through links),
+  with a depth limit so a link cycle is an error rather than a hang. A dangling
+  link reports the target it could not find.
+- Things the reader does not follow are now explicit errors instead of wrong
+  answers: an external link is `ExternalLinkUnsupported { filename,
+  object_path }` (was `PathNotFound`), and a dataset whose raw data lives in
+  external files (message 0x0007, now a known `MessageType`) is
+  `ExternalDataFilesUnsupported` (it would otherwise read as fill values).
+- **`attrs()` no longer drops attributes.** Any attribute whose datatype had
+  no `AttrValue` variant was omitted with no error — including every Python
+  `bool` (h5py stores `attrs["flag"] = True` as an enum), complex numbers,
+  compound values and object references. Now:
+  - numpy/h5py-style booleans (an enum of exactly `FALSE`=0 / `TRUE`=1) decode
+    as `I64` / `I64Array` of 0/1;
+  - new `AttrValue::U64Array` keeps unsigned arrays unsigned (they were cast to
+    `I64Array`, so values above `i64::MAX` came back negative). **Behaviour
+    change:** code matching `I64Array` for an unsigned attribute must also
+    match `U64Array` (the netCDF-4 CF helpers and Python bindings do);
+  - new `AttrValue::Raw { datatype, shape, data }` carries everything else
+    verbatim, decodable with `clawhdf5_format::data_read` against `datatype`.
+  Both new variants are writable, so an attribute can be copied between files
+  unchanged. Python receives `Raw` as `{"dtype", "shape", "data"}`.
+- All of the above are covered by h5py interop tests under both default and
+  `libver='latest'` bounds, compared against h5py's own readback.
+
+### Security
+- `clawhdf5`: virtual-dataset source file names are untrusted input but were
+  joined straight onto the opened file's directory, so a crafted file could
+  make the reader open any path the process can reach (absolute path, or `..`
+  components). Only plain relative paths inside that directory are accepted.
+
+### Durability & Integrity
+- `clawhdf5-agent`: a crash between writing a checkpoint and truncating the WAL
+  no longer **duplicates every pending entry** on the next open. Each
+  checkpoint records a `WalMark` (byte length + chained CRC of the WAL prefix it
+  folded in) in `/meta`; `open()` skips exactly that prefix when it is still
+  present. No WAL format change for this; older files behave as before.
+- `clawhdf5-agent`: checkpoints and snapshots are durable as a unit — the temp
+  file is synced before the rename and the directory after it. Individual WAL
+  appends remain unsynced by design (documented in `CLAUDE.md`).
+- `clawhdf5-agent`: `save_or_update` hits are logged as a new `Update` WAL
+  record, so replay updates in place instead of appending a duplicate. WAL
+  header version 3 → 4 (so older builds refuse the file rather than truncating
+  a record they can't parse); v3 files are read and upgraded in place.
+- `clawhdf5-agent`: loading validates every per-record dataset length (a
+  truncated store is now `MemoryError::Schema`, not a later panic), fixes the
+  `n.len() == n.len()` tautology that trusted a norms dataset of any length,
+  and rejects `embedding_dim == 0` with records present.
+- `clawhdf5-agent`: eight behavioural `MemoryConfig` fields are now persisted in
+  `/meta`. Previously they reset to defaults on every open — a compressed store
+  was rewritten uncompressed, `wal_enabled = false` flipped back to `true`.
+- `clawhdf5-agent`: `compression = true` never worked in a default build (it
+  requested Zstd without enabling the feature, so every checkpoint failed with
+  `unsupported filter: 32015`). Default builds now use deflate; Zstd is the new
+  opt-in `zstd` feature.
+- `clawhdf5-agent`: **single-writer lock** (`<store>.h5.lock`,
+  `MemoryError::Locked`) — two handles on one store used to silently destroy
+  each other's data. New `HDF5Memory::open_read_only` gives a lock-free,
+  never-writing view; the CLI's read-only subcommands use it.
+- `clawhdf5-agent`: an unreadable WAL (torn header / bad magic) is quarantined
+  (`HDF5Memory::quarantined_wal()`) instead of blocking `open()` of a healthy
+  store. A WAL from an unknown newer version still fails and is left intact.
+- `clawhdf5-agent`: provenance records are renumbered on compaction (they
+  weren't, so every later `save_or_update` raised a false High integrity
+  alert); pending anomaly alerts and tracked sessions are bounded;
+  `snapshot()` includes entries still in the WAL.
+- `clawhdf5-agent`: hybrid ranking is deterministic (index tie-breaks instead
+  of `HashMap` order); a set of identical positive scores — including a single
+  candidate — normalises to 1.0 rather than 0.0; the Hebbian boost no longer
+  reinforces zero-score filler results.
+- `clawhdf5-format`: chunked/VDS/hyperslab reads size their buffers with
+  overflow-checked arithmetic and fallible allocation, so crafted dimensions
+  are `FormatError::Overflow` instead of a wrapped size or a process abort;
+  `parallel_read` bounds checks use `checked_add`.
+- `clawhdf5`: a malformed filter-pipeline message is an error instead of being
+  treated as "no filters" (which returned compressed bytes as data);
+  `FileBuilder::write` is atomic and synced instead of truncating the
+  destination first.
+
+### CI / Testing
+- CI now lints every target (`cargo clippy --all-targets`) plus
+  `clawhdf5-format`'s optional features, compiles all benches, and tests the
+  format feature matrix. Previously test/bench code and feature-gated modules
+  were never linted; the accumulated clippy backlog is fixed.
+- CI installs python3 + h5py/numpy/netCDF4/xarray and sets
+  `CLAWHDF5_REQUIRE_INTEROP=1`, which turns a missing interop dependency into a
+  test **failure**. Until now every h5py/netCDF4 interop test silently skipped
+  in CI, which is how the HDF5 2.0 compound bug fixed in v2.2.0 reached a user.
+  The `#[ignore]`d `writer_h5py_tests` suite is run explicitly.
+- h5py-generated-file tests now cover default libver bounds as well as
+  `libver='latest'` (HDF5 2.0 raised the default low bound to 1.8).
+- `clawhdf5-agent`: WAL property tests (round trip; after any corruption the
+  entries read back are an exact prefix of what was written — 1500 seeded
+  cases), a crash-recovery matrix (an on-disk image after every operation, the
+  checkpoint window, and the WAL torn at every byte length, each reopened and
+  checked against a model), and a WAL fuzz target.
+- Optional fuzz smoke run (`CLAWHDF5_FUZZ_SECONDS=N scripts/ci-test.sh`); new
+  datatype corpus seeds for v1 compound and native complex messages.
+
+## v2.2.0 (2026-09-18)
+
+### Security
+- `clawhdf5-format`: bounded decompression output (`MAX_DECOMPRESS_SIZE`) for
+  deflate/lz4/zstd/pcodec so a crafted compressed chunk can't drive an
+  unbounded allocation (memory-exhaustion DoS).
+- `clawhdf5-format`: `chunked_read.rs`/`data_read.rs`/`local_heap.rs` bounds
+  audit — added `ensure_len` overflow guards at every plain-arithmetic
+  offset+size check, a recursion-depth guard against a crafted
+  self-referencing/cyclic B-tree chunk index, a fix for an unguarded
+  compound-datatype `byte_offset` overrun in `read_compound_fields`, and an
+  `ndims - 1` underflow guard for degenerate zero-dimension chunked layouts.
+  Added a new `fuzz_dataset_read` cargo-fuzz target (walks every dataset in a
+  parsed file and exercises the contiguous/chunked/compact raw-data read
+  paths) which found and fixed 3 real crash bugs — an integer-multiply
+  overflow in `copy_chunk_to_output`'s N-D assembly path, the `ndims - 1`
+  underflow above, and an overflow in `local_heap.rs` — within the first few
+  fuzzing runs.
+- `clawhdf5-format`: `btree_v1.rs` overflow-safe bounds checks via a local
+  `ensure_len` helper, closing a `usize`-overflow panic reachable from a
+  crafted near-`usize::MAX` B-tree offset.
+- `clawhdf5-agent`: WAL length-prefix caps (`MAX_WAL_FIELD_LEN`, 64 MiB) reject
+  a corrupted/truncated length claim before allocating. Followed by a full
+  per-entry CRC32 trailer (`WAL_VERSION` bumped to 2) — a bit-flip inside an
+  entry now stops replay cleanly instead of silently accepting corrupted
+  data. Old-format WAL files are still read correctly and migrated to the new
+  format on next open.
+- `clawhdf5-android`: validate `embedding_len`/`query_embedding_len` against
+  the handle's configured `embedding_dim` (and reject null pointers) before
+  constructing a slice from a raw pointer in `edgehdf5_save` /
+  `edgehdf5_hybrid_search`.
+- `clawhdf5-py`: bump pyo3/numpy `0.28` → `0.29`, clearing two RUSTSEC
+  advisories (OOB read in `PyList`/`PyTuple` iterator; missing `Sync` bound on
+  `PyCFunction::new_closure`).
+- Clarified that the integrity hashes in `clawhdf5-agent::provenance`
+  (FNV-1a) and `clawhdf5-format::provenance` (SHA-256) are unkeyed and detect
+  only accidental corruption, not tampering — doc-only change, no behavior
+  change.
+
+### Performance
+- `clawhdf5-format`: chunk cache lookup is now O(1) (`slot_index: HashMap`)
+  instead of a linear scan, and cache hits return a shared `Arc` instead of
+  cloning the decompressed buffer — the hottest path in chunked reads.
+- `clawhdf5-ann`: optional `parallel` feature (rayon) parallelizes HNSW's
+  `prune_connections` neighbor-distance computation. The outer build/insert
+  loop is deliberately left sequential — it has genuine cross-iteration data
+  dependencies and needs its own correctness-focused design pass.
+- `clawhdf5-format/chunked_read.rs`: removed 12 unnecessary
+  `chunk_dimensions[..rank].to_vec()` allocations where callees already
+  accept `&[u32]`.
+
+### Architecture
+- Added `.gitea/workflows/ci.yml`, actually wiring the long-existing
+  `scripts/ci-test.sh` (fmt, clippy, tests, no_std check) into CI on every
+  push/PR to `main`. Fixed stale package names in `ci-test.sh`/
+  `check-nostd.sh` that had been silently no-op'ing the `clawhdf5-py`
+  exclusion and the no_std check.
+- Fixed a genuine no_std build break in `clawhdf5-format` (uncovered once the
+  no_std CI check actually started running): `core::sync::atomic::AtomicU64`
+  doesn't exist on `thumbv7em-none-eabihf` (switched to `portable-atomic`),
+  missing `alloc` imports for `Box`/`Vec`/`format!` on a few no_std paths, and
+  `f64::powi` (std/libm-only) replaced with a local exponentiation-by-squaring
+  helper in the scale-offset filter.
+- Added `[workspace.dependencies]` for `tempfile`/`criterion`/`half`/`serde`,
+  fixing a real version skew on `half` (`2` vs `2.7` across crates).
+- Fixed version skew: `clawhdf5-py` (`pyproject.toml`) and
+  `packages/clawhdf5-node` (`package.json`) were both behind the actual crate
+  version (2.1.0).
+- Documented that the `mpi-io` feature's read/write paths are root-read
+  +broadcast / gather-to-rank-0, not true collective I/O.
+
+### Documentation
+- BENCHMARKS.md: re-ran the previously-undated "LongMemEval Results", "SIMD &
+  Parallelism", and "Vector Search Latency"/"Comparison to MemX" sections on
+  a second machine (tank, Ryzen 7 7800X3D) with explicit dates and reproduce
+  commands. Found and corrected a methodology issue in the SIMD/Parallelism
+  benchmark selection (several originally-compared benchmarks didn't actually
+  isolate the scalar/SIMD/parallel axis).
+- README.md / ROADMAP.md / CLAUDE.md: corrected several stale facts —
+  the `clawhdf5-types` crate (removed earlier) was still listed in the
+  README crate map; the LongMemEval numbers in the README badge and table
+  didn't match the actual (much better) benchmark results in BENCHMARKS.md;
+  total line-of-code and test-count figures were stale; `clawhdf5-gpu`'s
+  CubeCL→wgpu correction; documented the new `clawhdf5-ann` `parallel`
+  feature flag, which had no entry in the Feature Flags table.
 
 ### New Features
 - `clawhdf5-migrate`: substantial engine improvements:
@@ -161,6 +784,16 @@
   reading compound types and — critically — every chunked/compressed dataset
   written by HDF5 2.0. Found by running the h5py interop tests against
   h5py 3.16 / HDF5 2.0.
+  Independently reported (with a patch) against the v2.1.0 tag by
+  M. Scot Breitenfeld (The HDF Group) — v2.1.0 predates this fix.
+- `clawhdf5-format`: parse HDF5 2.0 native complex datatypes (class 11,
+  datatype version 5, e.g. `H5T_COMPLEX_IEEE_F64LE`). The properties are a
+  single base floating-point datatype, not a compound-style member list; the
+  old parser read the base type's bytes as member names, producing a garbage
+  datatype, and failed with `UnexpectedEof` when a complex type was nested in
+  a compound. It is now surfaced as the equivalent `{r, i}` compound (the
+  shape h5py writes for numpy complex dtypes), with a size check against the
+  base type. Validated end-to-end against an HDF5 2.0-written file.
 
 ### Performance
 - `clawhdf5-format`: chunked writes now compress all chunks up front via

CLAUDE.md

@@ -17,7 +17,7 @@ Cargo workspace with 16 crates under `crates/` (plus `libaec-sys`, an internal F
 | `clawhdf5-netcdf4` | NetCDF-4 compatibility layer |
 | `clawhdf5-ann` | HNSW approximate nearest-neighbor vector index |
 | `clawhdf5-agent` | Agent memory, session history, knowledge graph storage |
-| `clawhdf5-gpu` | GPU-accelerated I/O via CubeCL |
+| `clawhdf5-gpu` | GPU-accelerated I/O via wgpu (hand-written WGSL compute shaders) |
 | `clawhdf5-accel` | CPU SIMD acceleration path |
 | `clawhdf5-migrate` | Schema migration engine |
 | `clawhdf5-android` | Android JNI bindings |
@@ -33,7 +33,68 @@ Cargo workspace with 16 crates under `crates/` (plus `libaec-sys`, an internal F
   the approximate `clawhdf5-ann` index for the vector stage (the index mirrors
   the cache and self-heals on drift). Build the agent with
   `--no-default-features --features float16` to force the exact linear cosine scan.
-- WAL (write-ahead log) for crash-safe persistence
+  The agent's `parallel` feature (also default) builds the index on a thread
+  pool; the graph is identical with or without it.
+  The index uses the HNSW paper's diversity heuristic for neighbour selection
+  (plain closest-M capped recall on clustered data: 0.31 recall@10 at 100K). Its
+  graph is saved to `<store>.h5.ann` at each checkpoint and reloaded by `open()`
+  (tied to the checkpoint by a generation id; stale/damaged sidecars are
+  ignored and the index rebuilt). `MemoryConfig::quantized_index` (off by
+  default, persisted) stores the index's own copy of the embeddings as `i8`,
+  which roughly halves a loaded store's memory (2.72x -> 1.74x the raw vectors
+  at 100K); because quantised distances are approximate and `ef` cannot
+  compensate, the query path then re-scores the candidate pool against the
+  exact embeddings, which holds recall at the f32 index's level. On AVX2 it is
+  also 1.63x the QPS and 1.8x the build speed (`clawhdf5_accel::dot_i8`); it
+  stays off by default only because that kernel is AVX2-only and aarch64 falls
+  back to scalar. `hybrid_search` keeps one incremental BM25
+  index for the life of the store and never writes the store: Hebbian
+  activation boosts are persisted by the next checkpoint (or on drop), not per
+  query. Measure any search-path change with
+  `cargo run --release -p clawhdf5-bench --bin search_harness` (baselines in
+  `BENCHMARKS.md`).
+- WAL (write-ahead log) for crash-safe persistence, with a chained CRC32
+  trailer per entry (each entry's CRC folds in the previous entry's CRC) so a
+  corrupted, reordered, duplicated, or spliced entry stops replay cleanly
+  instead of loading bad or tampered data. The pre-chaining per-entry-CRC
+  format (v2) is still fully readable; the oldest no-CRC format (v1) is only
+  reachable through the one-time migration path in `HDF5Memory::open`, not
+  through the public `WalFile::read_entries`.
+  **What the WAL guarantees:** integrity, ordering, and recovery from a
+  *process* crash at any point — including between a checkpoint and the WAL
+  truncate (each checkpoint records a `WalMark` in `/meta`, and `open()` skips
+  the WAL prefix the `.h5` already contains, so entries are never applied
+  twice). Checkpoints and snapshots are made durable as a unit (temp file
+  synced, renamed, directory synced). **What it does not guarantee:**
+  individual WAL appends are *not* fsynced (a deliberate latency trade-off), so
+  saves made since the last checkpoint can be lost on power failure or kernel
+  panic. Current header version is 4 (adds the `Update` record used by
+  `save_or_update`); v3 files are read and upgraded in place.
+- A store has a **single writer**: `HDF5Memory::create`/`open` hold an exclusive
+  advisory lock on `<store>.h5.lock` and a second opener gets
+  `MemoryError::Locked`. Use `HDF5Memory::open_read_only` for a lock-free,
+  never-writing point-in-time view (the CLI's `recall`/`stats`/`agents-md`/
+  `export` do). An unreadable WAL (torn header, bad magic) is quarantined to
+  `<store>.h5.wal.corrupt-<ts>` rather than blocking `open()`; a WAL with an
+  unknown *newer* version still fails and is left untouched.
+- `MemoryConfig::compression` uses deflate by default; enable the agent's
+  `zstd` feature to compress embeddings with Zstd instead (links libzstd).
+- `Dataset::verify_provenance()` (clawhdf5 facade, `provenance` feature, on by
+  default) recomputes a dataset's SHA-256 and compares it against the
+  `_provenance_sha256` attribute written automatically on save when
+  `DatasetBuilder::with_provenance` is used. It's opt-in per call, not run
+  automatically on open — it decodes and hashes the whole dataset. The hash
+  is unkeyed (tamper-*evident*, not tamper-*proof*): it detects accidental
+  corruption, not a deliberate actor able to modify both the data and the
+  stored hash.
+- `clawhdf5-agent`'s `HDF5Memory::save`/`save_batch`/`save_or_update` run every
+  write through an in-memory (session-scoped, not persisted to disk)
+  provenance ledger and write-anomaly detector: a content hash per record
+  (`provenance.rs`) for detecting accidental mid-session corruption, plus
+  rate-limit/injection-pattern/source-distribution checks (`anomaly.rs`).
+  Alerts never block a save — drain them with `HDF5Memory::take_anomaly_alerts`.
+  `MemorySource` for this bookkeeping is inferred from the caller-supplied
+  `source_channel` string (a heuristic, not an authenticated trust boundary).
 - GPU-accelerated batch I/O for large dataset processing
 - Python and Node.js bindings for cross-language use
 - NetCDF-4 compatibility for scientific data interop

Cargo.toml

@@ -21,7 +21,13 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 license = "MIT"
-repository = "https://github.com/redclawsystems/clawhdf5"
+repository = "https://git.redclaw.dev/quantumclaw/clawhdf5"
+
+[workspace.dependencies]
+tempfile = "3"
+criterion = { version = "0.5", features = ["html_reports"] }
+half = "2.7"
+serde = { version = "1", features = ["derive"] }

README.md

@@ -4,8 +4,8 @@
 
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Rust](https://img.shields.io/badge/rust-1.75%2B-orange.svg)](https://www.rust-lang.org)
-[![Tests](https://img.shields.io/badge/tests-1500%2B%20passing-brightgreen.svg)](#benchmarks)
+[![Tests](https://img.shields.io/badge/tests-1650%2B%20passing-brightgreen.svg)](#performance)
-[![LongMemEval](https://img.shields.io/badge/LongMemEval-Hit@5%2046%25%20BM25--only-blue.svg)](BENCHMARKS.md#longmemeval-results)
+[![LongMemEval](https://img.shields.io/badge/LongMemEval%20oracle-Turn--Level%20Hit@5%2084%25%20BM25--only-blue.svg)](BENCHMARKS.md#longmemeval-results)
 [![Footprint](https://img.shields.io/badge/footprint-6.5%20KB%2Frecord-lightgrey.svg)](BENCHMARKS.md#memory-footprint)
 
 ClawHDF5 is a pure-Rust HDF5 implementation combined with a research-grade agent memory engine. It gives AI agents persistent, searchable, cryptographically verifiable memory — all stored in a single portable file.
@@ -64,7 +64,12 @@ Figures below are from an independent reproduction run on a second machine (AMD
 |-------|------|-----------------|--------|----------|
 | 1K | **54 µs** | — | — | — |
 | 10K | 753 µs | **27 µs** | — | — |
-| 100K | 11.4 ms | 1.32 ms | **1.19 ms** | **8–76× faster** |
+| 100K | 11.4 ms | 1.32 ms | **1.19 ms** | ~8–76× (see caveat) |
+
+> Reproduced on the same second machine (Ryzen 7 7800X3D) with a corrected,
+> apples-to-apples SIMD/scalar/parallel comparison methodology — see
+> [BENCHMARKS.md § Independent Validation: tank — LongMemEval & Vector
+> Search](BENCHMARKS.md#independent-validation-tank--longmemeval--vector-search-ryzen-7-7800x3d-2026-08-05).
 
 ### Agent Memory Operations
 
@@ -92,20 +97,52 @@ by default (AoS→SoA byte transpose, +157–204% throughput for float data):
 
 Use `.with_zstd(3)` or `.with_deflate(6)` for write-heavy workloads — both now perform at ~720–750 MiB/s on large matrices. Use `.with_pcodec()` for write-once/read-many workloads where compression ratio matters more than encode speed. Disable auto-shuffle with `.without_shuffle()` for byte arrays that don't benefit from AoS→SoA transposition.
 
-> ¹ MemX ([arxiv:2603.16171](https://arxiv.org/abs/2603.16171), March 2026): Rust + libSQL, claims <90ms at 100K records.
+> ¹ MemX ([arxiv:2603.16171](https://arxiv.org/abs/2603.16171), March 2026): Rust + libSQL, claims <90ms at 100K records. **Not like-for-like:** MemX's figure is *end-to-end* (embeddings + FTS5 + four-factor re-ranking); ours is a *single component* (raw vector search). The ratio overstates the real advantage by an unquantified margin — order-of-magnitude indication only. See [BENCHMARKS.md](BENCHMARKS.md#comparison-to-memx-arxiv260316171).
 
 ### LongMemEval Retrieval Recall
 
-Evaluated against the LongMemEval dataset (500 questions, multi-session haystack).
+Evaluated against the full **`longmemeval_s`** haystack — all 500 questions, 47.7
-BM25-only baseline (no embedding model required at bench time):
+sessions and 493.5 turns each, with only 4.0% of haystack sessions being evidence
+sessions. See [BENCHMARKS.md § LongMemEval
+Results](BENCHMARKS.md#longmemeval-results) for the full scoring-target
+declaration:
 
-| Metric | BM25-only | Full hybrid¹ |
+| Mode | Turn-Level Hit@5 | Session-Level Hit@5 |
-|--------|-----------|--------------|
+|------|------------------|---------------------|
-| Hit@5 (session) | ~46% | Higher |
+| BM25 only | 75.0% | 93.6% |
-| MRR (session) | ~0.34 | Higher |
+| Vector only (MiniLM) | 71.8% | 94.2% |
-| Abstention accuracy | ~72% | — |
+| Hybrid (0.4/0.6, tuned) | **81.4%** | **96.8%** |
 
-> ¹ Enable embeddings via `hybrid_search(query_emb, text, 0.7, 0.3, k)` for substantially higher recall. The vector stage is served by the HNSW index by default (the `hnsw` feature is on by default); build with `--no-default-features --features float16` to fall back to an exact linear cosine scan.
+Hybrid is the strongest configuration, which is what running two retrieval stages
+is for. The weights matter more than the stages: a sweep of `vector_weight` from
+0.0 to 1.0 found the long-standing `0.7/0.3` default is **strictly dominated** by
+`0.4/0.6` — better on Hit@1, Hit@5, Hit@10 and MRR at both granularities. Use
+`0.4/0.6`, or `0.3/0.7` if rank-1 precision matters most. See
+[BENCHMARKS.md § Weight sweep](BENCHMARKS.md#longmemeval-results).
+
+Vector embeddings require `--features embeddings`; without it the vector stage is
+inert and only the BM25 row is produced, which is what every previously published
+number here measured.
+
+On the easier `longmemeval_oracle` variant (evidence sessions only) the same
+harness scores 84.4% turn-level Hit@5 / MRR 0.6597, reproduced identically on a
+second machine. The 9.4-point gap is the cost of the real haystack, and is why the
+full-haystack number is the one quoted here.
+
+This is **retrieval recall** (did the gold memory appear in the top-k), not the
+official LongMemEval QA-accuracy metric — the two are not comparable, and
+retrieval recall reported as QA accuracy typically overstates by 20–30 points.
+
+> **Previously reported here and now retracted:** session-level Hit@5 of 100.0% /
+> MRR 1.0000, and a claim of beating MemX's 51.6%. Those session-level figures were
+> degenerate on the oracle variant (any returned document is a hit by
+> construction); the 93.6% above is a different, real measurement on a corpus where
+> evidence sessions are 4.0% of the haystack. The MemX comparison stays withdrawn —
+> MemX measures fact-level granularity over 220,349 records, which running the full
+> haystack does not fix. Details in
+> [BENCHMARKS.md](BENCHMARKS.md#retracted-session-level-recall-and-the-memx-comparison).
+
+> Enable embeddings via `hybrid_search(query_emb, text, 0.4, 0.6, k)` for substantially higher recall. The vector stage is served by the HNSW index by default (the `hnsw` feature is on by default); build with `--no-default-features --features float16` to fall back to an exact linear cosine scan.
 
 ### Memory Footprint
 
@@ -194,7 +231,7 @@ ClawhDF5's agent memory engine implements research from 15+ recent papers on age
 | **`ivf` / `pq`** | IVF-PQ approximate nearest neighbor for billion-scale search |
 | **`bm25`** | BM25 keyword index with TF-IDF scoring |
 | **`entity_extract`** | Rule-based entity extraction from text chunks into the knowledge graph |
-| **`wal`** | Write-ahead log for crash-safe persistence |
+| **`wal`** | Write-ahead log for crash-safe persistence; each entry is CRC32-checked on replay, so a corrupted entry stops replay there instead of loading bad data |
 | **`memory_strategy`** | Pluggable strategies: save-every, semantic-shift, user-correction detection |
 | **`decision_gate`** | Sub-microsecond trivial/substantive classification |
 | **`async_memory`** | Tokio-based async wrapper over the memory store (`async` feature) |
@@ -338,22 +375,22 @@ let exported = backend.export_markdown("MEMORY.md")?;
 ## Crate Map
 
 ```
-clawhdf5 workspace (17 crates, 84K lines of Rust)
+clawhdf5 workspace (16 crates, ~92K lines of Rust; plus libaec-sys, an
+                     internal FFI bindings crate for the optional szip feature)
 │
 ├── Core HDF5
-│   ├── clawhdf5-types      — Type system definitions
+│   ├── clawhdf5-format      — Binary parser/writer (no_std), shared type definitions
-│   ├── clawhdf5-format      — Binary parser/writer (no_std)
 │   ├── clawhdf5-io          — I/O abstraction (buffered, mmap, async)
-│   ├── clawhdf5-filters     — Compression (deflate, lz4, zstd, blosc)
+│   ├── clawhdf5-filters     — Fast deflate path (zlib-ng); lz4/zstd/pcodec/szip filters live in clawhdf5-format
 │   ├── clawhdf5-derive      — Proc macros
 │   ├── clawhdf5             — High-level API
 │   ├── clawhdf5-netcdf4     — NetCDF-4 support
 │   ├── clawhdf5-accel       — SIMD (NEON, AVX2, AVX-512)
-│   └── clawhdf5-gpu         — GPU compute (wgpu)
+│   └── clawhdf5-gpu         — GPU compute (wgpu, hand-written WGSL compute shaders)
 │
 ├── Agent Memory
-│   ├── clawhdf5-agent       — Memory engine (20.7K lines, 32 modules)
+│   ├── clawhdf5-agent       — Memory engine (20.9K lines, 32 modules; WAL is CRC32-checked per entry)
-│   ├── clawhdf5-ann         — HNSW approximate nearest neighbor (default backend)
+│   ├── clawhdf5-ann         — HNSW approximate nearest neighbor (default backend; optional `parallel` feature)
 │   ├── clawhdf5-migrate     — SQLite → HDF5 migration
 │   ├── clawhdf5-android     — Android JNI bridge
 │   └── clawhdf5-cli         — CLI tool
@@ -395,6 +432,20 @@ ClawhDF5's agent memory design draws from 15+ recent papers:
 | `agent` | no | Full agent memory layer |
 | `float16` | **yes** | Half-precision embedding storage (2× compression) |
 | `hnsw` | **yes** | HNSW approximate vector index for `hybrid_search` (via `clawhdf5-ann`); disable for an exact linear scan |
+
+`MemoryConfig::hnsw_m`, `hnsw_ef_construction` and `hnsw_ef_search` tune the
+vector index (16 / 64 / scale-with-`k` by default) and are stored with the
+file.
+
+`MemoryConfig::quantized_index` (off by default) stores the HNSW index's own
+copy of the embeddings as `i8`, roughly halving a loaded store's memory
+(2.72x -> 1.74x the raw vectors at 100k x 384). Quantised distances are
+approximate, so the query path re-scores the candidate pool against the exact
+embeddings the store already holds, which keeps recall at the `f32` index's
+level. On AVX2 it is also **faster** — 1.63x the queries per second and 1.8x
+the build speed at equal recall — because the int8 kernel is SIMD too. It
+stays off by default only because that kernel is AVX2-only and aarch64 falls
+back to a scalar loop. See `BENCHMARKS.md`, "Quantising the index copy".
 | `parallel` | no | Rayon parallel search |
 | `fast-math` | no | BLAS matrix-vector multiply |
 | `accelerate` | no | Apple Accelerate / AMX (macOS) |
@@ -420,6 +471,24 @@ ClawhDF5's agent memory design draws from 15+ recent papers:
 | `system-zlib` / `zlib-rs` | no | Alternative zlib backends for deflate |
 | `blake3_hash` | no | BLAKE3 content hashing for provenance |
 
+### `clawhdf5-ann`
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `parallel` | no | Rayon-parallel neighbor-distance computation during HNSW graph pruning |
+
+### `clawhdf5-io`
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `mpi-io` | no | MPI-backed I/O via the `mpi` crate |
+
+> **Parallel I/O (MPI) limitation:** `mpi-io`'s read path is a root-rank read
+> followed by a broadcast, and its write path gathers all ranks' shards to
+> rank 0 before writing — not true collective I/O
+> (`MPI_File_read_at_all`/`write_at_all`). It does not provide I/O bandwidth
+> that scales with rank count; true collective I/O is tracked as future work.
+
 ---
 
 ## Building
@@ -435,8 +504,16 @@ cargo build -p clawhdf5-agent --features "agent,float16,parallel,fast-math"
 cargo build -p clawhdf5-agent --features "agent,float16,accelerate,parallel,gpu"
 
 # Tests
-cargo test --workspace            # all 417+ tests
+cargo test --workspace            # all 1,650+ tests
 cargo test -p clawhdf5-agent      # agent memory tests
+scripts/ci-test.sh                # what CI runs: fmt, clippy matrix, tests,
+                                  # h5py/netCDF4 interop, no_std
+
+# The interop suites need a Python with h5py; on a PEP 668 system that has to
+# be a virtualenv. `ci-test.sh` finds `.venv` on its own, or set
+# CLAWHDF5_PYTHON. Without one they skip — set CLAWHDF5_REQUIRE_INTEROP=1 to
+# make that a failure instead.
+python3 -m venv .venv && .venv/bin/pip install h5py numpy netCDF4 xarray
 
 # Benchmarks
 cargo bench -p clawhdf5-agent               # agent memory suite
@@ -505,7 +582,7 @@ See [ROADMAP.md](ROADMAP.md) for the full implementation tracker.
 - ✅ OpenClaw integration layer
 - ✅ Comprehensive Criterion benchmarks
 
-**Phase 2** — OpenClaw TypeScript bridge, academic benchmarks (MemoryArena, LongMemEval), cross-platform validation.
+**Phase 2** — MemoryArena and LongMemEval academic benchmarks are done (see [BENCHMARKS.md](BENCHMARKS.md), reproduced on a second machine); remaining: publish the OpenClaw TypeScript bridge to npm, crates.io/PyPI publishing.
 
 ---
 
@@ -523,5 +600,5 @@ MIT
 
 <p align="center">
   <em>Built by <a href="https://github.com/redclawsystems">RedClaw Systems</a></em><br>
-  <em>72,087 lines of Rust. Zero C dependencies. One file to remember everything.</em>
+  <em>~92,000 lines of Rust. Zero C dependencies. One file to remember everything.</em>
 </p>

ROADMAP.md

@@ -145,19 +145,36 @@
 **Phase 3:** ~~Track 6 (multi-modal) + Track 7 (OpenClaw integration)~~ 🟢 Complete
 **Phase 4:** ~~Track 8 (benchmarking + validation)~~ 🟢 Complete
 
-All 8 tracks delivered. 1,546 tests passing, zero clippy warnings.
+All 8 tracks delivered. 1,650+ tests passing, zero clippy warnings.
 
 ---
 
 ## What's Next
 
-Verified against current repo state on 2026-08-03 (see also `docs/superpowers/plans/` for the filter-codec/format-write/MPI-IO work, now shipped):
+Verified against current repo state on 2026-08-05 (see also `docs/superpowers/plans/` for the filter-codec/format-write/MPI-IO work, now shipped):
 
-- [ ] CI/CD pipeline — still no GitHub/Gitea Actions workflow in the repo; automated testing is manual only
+- [ ] TypeScript bridge not wired into CI — `packages/clawhdf5-node/` already has a complete, working napi-rs package (package.json, tsconfig, hand-written TS wrapper matching all 21 `#[napi]` items, Jest test suite, README); it isn't published to npm and has no committed lockfile
-- [ ] Academic benchmark cross-validation — reproduce MemX/LongMemEval under identical conditions
-- [ ] TypeScript bridge — `clawhdf5-napi` has no `package.json`; it's still Rust-only scaffolding, not a publishable npm package
 - [ ] Publish crates to crates.io — no `publish` config anywhere in the workspace yet
 - [ ] Python wheel distribution via maturin — `crates/clawhdf5-py/pyproject.toml` exists (maturin-buildable locally) but wheels aren't published anywhere
+- [ ] `chunked_read.rs`/`data_read.rs` full bounds-check audit + scheduled fuzz campaigns (the new `fuzz_dataset_read` target covers the two files' main entry points; a full manual audit of every indexing site is still open) — see Tier 4 below
+- [ ] WAL per-entry checksum landed as CRC32 (see below); a stronger per-entry format (explicit length prefix, avoiding the read-then-verify restructuring) could still be revisited if profiling shows it matters
+- [ ] HNSW build parallelism is still narrow (only `prune_connections`); the correctness-sensitive outer insert loop needs its own dedicated design pass before parallelizing
+
+### Recently closed out (2026-08-05, Tier 3–4 hardening pass)
+
+- [x] Academic benchmark cross-validation — LongMemEval reproduced against MemX on tank (Ryzen 7 7800X3D): turn-level Hit@5 84.4% vs MemX's 51.6%; recall numbers are deterministic and reproduce exactly across machines. SIMD/Parallelism and Vector Search sections also re-run and dated. See [BENCHMARKS.md § Independent Validation: tank — LongMemEval & Vector Search](BENCHMARKS.md#independent-validation-tank--longmemeval--vector-search-ryzen-7-7800x3d-2026-08-05)
+- [x] Android JNI (`clawhdf5-android`): validate `embedding_len`/`query_embedding_len` against the handle's configured `embedding_dim` before constructing a slice from a raw pointer
+- [x] `clawhdf5-py`: bumped pyo3/numpy 0.28 → 0.29, clearing two RUSTSEC advisories
+- [x] WAL (`clawhdf5-agent`): length-prefix caps (`MAX_WAL_FIELD_LEN`) to reject a corrupted length claim before allocating, then a full per-entry CRC32 trailer (`WAL_VERSION` 2) so a bit-flip stops replay cleanly instead of loading corrupted data; old-format WAL files still read correctly and are migrated on next open
+- [x] `chunked_read.rs`/`data_read.rs`/`local_heap.rs` bounds-check audit: added `ensure_len` overflow guards, a recursion-depth guard against cyclic B-trees, and a fix for an unguarded compound-datatype byte-offset overrun. Added a new `fuzz_dataset_read` cargo-fuzz target exercising the contiguous/chunked/compact read paths — it found and we fixed 3 real crash bugs (integer-overflow panics) within the first few runs
+- [x] `clawhdf5-ann`: optional `parallel` feature (rayon) for HNSW's `prune_connections` neighbor-distance computation
+- [x] `[workspace.dependencies]` added for `tempfile`/`criterion`/`half`/`serde`, fixing a real version skew on `half` (2 vs 2.7)
+
+### Recently closed out (2026-08-05 hardening pass)
+
+- [x] CI/CD pipeline — `.gitea/workflows/ci.yml` now runs `scripts/ci-test.sh` (fmt, clippy, tests, no_std check) on push/PR to `main`
+- [x] Fixed no_std build breakage in `clawhdf5-format` (missing alloc imports, `AtomicU64` unsupported on thumbv7em, `f64::powi` requiring std/libm)
+- [x] Fixed version skew: `clawhdf5-py` (pyproject.toml) and `packages/clawhdf5-node` (package.json) were both behind the actual crate version
 
 ### Recently closed out (2026-08-03 cleanup pass)
 
@@ -167,4 +184,4 @@ Verified against current repo state on 2026-08-03 (see also `docs/superpowers/pl
 
 ---
 
-_Last updated: 2026-08-03_
+_Last updated: 2026-08-05_

benchmarks/bench_worldmodel_h5py.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""h5py counterpart to worldmodel_sampling.rs — same file, same shuffled
+per-frame access, same minimal touch (sum the frame bytes). Reports
+samples/sec so the two sit side by side on one machine."""
+import sys, time, numpy as np, h5py
+
+path = sys.argv[1]
+passes = int(sys.argv[2]) if len(sys.argv) > 2 else 5
+
+def shuffled(n):
+    v = list(range(n))
+    state = 0x9E3779B97F4A7C15
+    for i in range(n - 1, 0, -1):
+        state = (state * 6364136223846793005 + 1442695040888963407) & 0xFFFFFFFFFFFFFFFF
+        j = (state >> 33) % (i + 1)
+        v[i], v[j] = v[j], v[i]
+    return v
+
+# swmr + a 256 MB chunk cache: exactly stable-worldmodel's HDF5Dataset._open_h5.
+f = h5py.File(path, "r", swmr=True, rdcc_nbytes=256 * 1024 * 1024)
+d = f["observation"]
+n = d.shape[0]
+order = shuffled(n)
+
+# warm
+sink = 0
+for i in order:
+    sink += int(d[i].sum())
+
+t0 = time.perf_counter()
+sink = 0
+for _ in range(passes):
+    for i in order:
+        sink += int(d[i].sum())
+elapsed = time.perf_counter() - t0
+total = n * passes
+print(f"h5py: {n} frames x {passes} passes = {total} reads in {elapsed:.3f}s")
+print(f"h5py: {total/elapsed:.0f} samples/sec")

benchmarks/gen_worldmodel_frames.py

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+"""Generate a world-model-shaped dataset: N frames of HxWxC uint8 observations,
+contiguous (N,H,W,C), matching stable-worldmodel's per-frame sample-loading
+access pattern. Also emits ep_len/ep_offset like their format."""
+import sys, time, numpy as np, h5py
+
+path = sys.argv[1]
+N = int(sys.argv[2]) if len(sys.argv) > 2 else 20000
+H = W = 64
+C = 3
+rng = np.random.default_rng(0)
+t0 = time.perf_counter()
+with h5py.File(path, "w", libver="latest") as f:
+    # Contiguous (N,H,W,C) uint8 — the fair, both-APIs-support-it layout.
+    obs = f.create_dataset("observation", shape=(N, H, W, C), dtype=np.uint8)
+    # Write in blocks to bound memory.
+    B = 2000
+    for i in range(0, N, B):
+        n = min(B, N - i)
+        obs[i:i+n] = rng.integers(0, 256, size=(n, H, W, C), dtype=np.uint8)
+    # Episode metadata like their format: 100-step episodes.
+    ep = 100
+    n_ep = N // ep
+    f.create_dataset("ep_len", data=np.full(n_ep, ep, dtype=np.int32))
+    f.create_dataset("ep_offset", data=(np.arange(n_ep) * ep).astype(np.int64))
+print(f"wrote {N} frames {H}x{W}x{C} to {path} in {time.perf_counter()-t0:.1f}s "
+      f"({N*H*W*C/1e6:.0f} MB)")

crates/clawhdf5-accel/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "clawhdf5-accel"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 description = "SIMD-accelerated operations for rustyhdf5"
 license = "MIT"
-repository = "https://github.com/redclawsystems/clawhdf5"
+repository = "https://git.redclaw.dev/quantumclaw/clawhdf5"
 readme = "README.md"
 keywords = ["hdf5", "simd", "acceleration", "performance"]
 categories = ["science", "algorithms"]
@@ -15,7 +15,7 @@ float16 = ["dep:half"]
 avx512 = []
 
 [dependencies]
-half = { version = "2", optional = true }
+half = { workspace = true, optional = true }
 
 [package.metadata.docs.rs]
 features = []

crates/clawhdf5-accel/src/avx2.rs

@@ -25,6 +25,55 @@ unsafe fn hsum_256(v: __m256) -> f32 {
     _mm_cvtss_f32(result)
 }
 
+/// AVX2 dot product of two `i8` slices, widened to `i32`.
+///
+/// Each 16-byte half is sign-extended to sixteen `i16` lanes and multiplied
+/// pairwise with `madd_epi16`, which sums adjacent products straight into
+/// eight `i32` lanes — the widening that an autovectorised scalar loop does
+/// in several shuffles is one instruction here. A pair sum is at most
+/// `2 * 127 * 127`, far inside `i32`.
+///
+/// # Safety
+/// Caller must verify is_x86_feature_detected!("avx2").
+// SAFETY: Caller must have verified AVX2 via is_x86_feature_detected!.
+#[target_feature(enable = "avx2")]
+pub unsafe fn dot_i8(a: &[i8], b: &[i8]) -> i32 {
+    // SAFETY: Caller guarantees AVX2 is available per the # Safety contract;
+    // every load reads 32 bytes at an index checked against `len` first.
+    unsafe {
+        assert_eq!(a.len(), b.len());
+        let len = a.len();
+        let mut i = 0;
+        let mut acc0 = _mm256_setzero_si256();
+        let mut acc1 = _mm256_setzero_si256();
+
+        while i + 32 <= len {
+            let va = _mm256_loadu_si256(a.as_ptr().add(i).cast());
+            let vb = _mm256_loadu_si256(b.as_ptr().add(i).cast());
+            let a_lo = _mm256_cvtepi8_epi16(_mm256_castsi256_si128(va));
+            let b_lo = _mm256_cvtepi8_epi16(_mm256_castsi256_si128(vb));
+            let a_hi = _mm256_cvtepi8_epi16(_mm256_extracti128_si256(va, 1));
+            let b_hi = _mm256_cvtepi8_epi16(_mm256_extracti128_si256(vb, 1));
+            acc0 = _mm256_add_epi32(acc0, _mm256_madd_epi16(a_lo, b_lo));
+            acc1 = _mm256_add_epi32(acc1, _mm256_madd_epi16(a_hi, b_hi));
+            i += 32;
+        }
+
+        // Horizontal sum of the eight i32 lanes.
+        let v = _mm256_add_epi32(acc0, acc1);
+        let s128 = _mm_add_epi32(_mm256_castsi256_si128(v), _mm256_extracti128_si256(v, 1));
+        let s64 = _mm_add_epi32(s128, _mm_unpackhi_epi64(s128, s128));
+        let s32 = _mm_add_epi32(s64, _mm_shuffle_epi32(s64, 0b01));
+        let mut sum = _mm_cvtsi128_si32(s32);
+
+        while i < len {
+            sum += i32::from(a[i]) * i32::from(b[i]);
+            i += 1;
+        }
+        sum
+    }
+}
+
 /// AVX2 dot product for f32 slices.
 ///
 /// # Safety
@@ -111,7 +160,11 @@ pub unsafe fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 {
         }
 
         let denom = (norm_a * norm_b).sqrt();
-        if denom == 0.0 { 0.0 } else { dot / denom }
+        if denom < f32::EPSILON {
+            0.0
+        } else {
+            dot / denom
+        }
     }
 }
 

crates/clawhdf5-accel/src/avx512.rs

@@ -89,7 +89,11 @@ pub unsafe fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 {
         }
 
         let denom = (norm_a * norm_b).sqrt();
-        if denom == 0.0 { 0.0 } else { dot / denom }
+        if denom < f32::EPSILON {
+            0.0
+        } else {
+            dot / denom
+        }
     }
 }
 

crates/clawhdf5-accel/src/lib.rs

@@ -61,8 +61,14 @@ pub enum Backend {
     Scalar,
 }
 
-/// Detect the best available SIMD backend at runtime.
+/// The best available SIMD backend, detected once per process. Every kernel
+/// dispatches through this, so it sits in the innermost loop of every search.
 pub fn detect_backend() -> Backend {
+    static BACKEND: std::sync::OnceLock<Backend> = std::sync::OnceLock::new();
+    *BACKEND.get_or_init(detect_backend_uncached)
+}
+
+fn detect_backend_uncached() -> Backend {
     #[cfg(target_arch = "aarch64")]
     {
         return Backend::Neon; // Always available on aarch64
@@ -116,6 +122,23 @@ pub fn dot_product(a: &[f32], b: &[f32]) -> f32 {
     }
 }
 
+/// Dot product of two `i8` slices, widened to `i32`.
+///
+/// The kernel behind int8-quantised vector search. Uses the AVX2 path
+/// whenever AVX2 is present — including on AVX-512 machines, where it is
+/// what the f32 kernels use too on a default build.
+pub fn dot_i8(a: &[i8], b: &[i8]) -> i32 {
+    match detect_backend() {
+        #[cfg(target_arch = "x86_64")]
+        // SAFETY: both variants imply AVX2 was detected at runtime (the
+        // AVX-512 backend is only selected on CPUs that also have AVX2).
+        Backend::Avx2 | Backend::Avx512 if is_x86_feature_detected!("avx2") => unsafe {
+            avx2::dot_i8(a, b)
+        },
+        _ => scalar::dot_i8(a, b),
+    }
+}
+
 /// Compute the L2 norm (magnitude) of a vector.
 pub fn vector_norm(v: &[f32]) -> f32 {
     dot_product(v, v).sqrt()
@@ -361,6 +384,18 @@ mod tests {
         assert!(approx_eq(cosine_similarity(&a, &b), 0.0, EPSILON));
     }
 
+    #[test]
+    fn test_cosine_near_zero_norm_clamped() {
+        // denom = 1e-4 * 1e-4 = 1e-8, comfortably below f32::EPSILON
+        // (~1.19e-7) but not exactly 0.0 — must still clamp to 0.0 so
+        // callers computing `1.0 - cosine_similarity(...)` treat these
+        // as maximally dissimilar, matching the pre-SIMD scalar guard.
+        let a = [1e-4f32];
+        let b = [1e-4f32];
+        assert_eq!(cosine_similarity(&a, &b), 0.0);
+        assert_eq!(scalar::cosine_similarity(&a, &b), 0.0);
+    }
+
     #[test]
     fn test_cosine_scalar_vs_dispatch() {
         let a: Vec<f32> = (0..384).map(|i| (i as f32).sin()).collect();
@@ -695,3 +730,42 @@ mod tests {
         }
     }
 }
+
+#[cfg(test)]
+mod dot_i8_tests {
+    use super::*;
+
+    fn codes(n: usize, seed: u64) -> Vec<i8> {
+        let mut state = seed;
+        (0..n)
+            .map(|_| {
+                state = state
+                    .wrapping_mul(6_364_136_223_846_793_005)
+                    .wrapping_add(1_442_695_040_888_963_407);
+                // Full range, including the extremes.
+                ((state >> 56) as u8) as i8
+            })
+            .collect()
+    }
+
+    #[test]
+    fn dispatched_kernel_matches_scalar_exactly() {
+        // Integer arithmetic: the SIMD path must agree bit for bit, at every
+        // length — including ones that are not multiples of the 32-byte block,
+        // which exercise the tail.
+        for len in [0, 1, 7, 31, 32, 33, 63, 64, 100, 384, 385, 1536] {
+            let a = codes(len, 1 + len as u64);
+            let b = codes(len, 1000 + len as u64);
+            assert_eq!(dot_i8(&a, &b), scalar::dot_i8(&a, &b), "len {len}");
+        }
+    }
+
+    #[test]
+    fn extremes_do_not_overflow() {
+        // -128 * -128 is the largest product; a long run of it must still fit.
+        let a = vec![-128i8; 4096];
+        assert_eq!(dot_i8(&a, &a), 4096 * 128 * 128);
+        let b = vec![127i8; 4096];
+        assert_eq!(dot_i8(&a, &b), -4096 * 128 * 127);
+    }
+}

crates/clawhdf5-accel/src/neon.rs

@@ -94,7 +94,11 @@ pub unsafe fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 {
     }
 
     let denom = (norm_a * norm_b).sqrt();
-    if denom == 0.0 { 0.0 } else { dot / denom }
+    if denom < f32::EPSILON {
+        0.0
+    } else {
+        dot / denom
+    }
 }
 
 /// NEON L2 distance.

crates/clawhdf5-accel/src/scalar.rs

@@ -21,7 +21,11 @@ pub fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 {
         norm_b += y * y;
     }
     let denom = (norm_a * norm_b).sqrt();
-    if denom == 0.0 { 0.0 } else { dot / denom }
+    if denom < f32::EPSILON {
+        0.0
+    } else {
+        dot / denom
+    }
 }
 
 pub fn batch_cosine(query: &[f32], vectors: &[&[f32]], results: &mut [(usize, f32)]) {
@@ -136,3 +140,33 @@ fn f16_to_f32_soft(h: u16) -> f32 {
 
     f32::from_bits(f32_bits)
 }
+
+/// Dot product of two `i8` slices, widened to `i32`.
+///
+/// `dim` terms of at most `127 * 127` fit an `i32` for any realistic
+/// dimension (over 130 000 terms before overflow is possible).
+pub fn dot_i8(a: &[i8], b: &[i8]) -> i32 {
+    assert_eq!(a.len(), b.len());
+    // Four independent accumulators over 32-lane blocks: the widening product
+    // has to sit in a fixed-length chunk for the vectoriser to see it, and the
+    // separate accumulators keep it off one dependency chain.
+    const LANE: usize = 8;
+    let (a_blocks, a_tail) = a.as_chunks::<{ LANE * 4 }>();
+    let (b_blocks, b_tail) = b.as_chunks::<{ LANE * 4 }>();
+    let mut acc = [0i32; 4];
+    for (x, y) in a_blocks.iter().zip(b_blocks) {
+        for (lane, slot) in acc.iter_mut().enumerate() {
+            let mut sum = 0i32;
+            for k in 0..LANE {
+                sum += i32::from(x[lane * LANE + k]) * i32::from(y[lane * LANE + k]);
+            }
+            *slot += sum;
+        }
+    }
+    let tail: i32 = a_tail
+        .iter()
+        .zip(b_tail)
+        .map(|(&x, &y)| i32::from(x) * i32::from(y))
+        .sum();
+    acc[0] + acc[1] + acc[2] + acc[3] + tail
+}

crates/clawhdf5-agent/Cargo.toml

@@ -1,24 +1,24 @@
 [package]
 name = "clawhdf5-agent"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 description = "HDF5-backed persistent memory store for on-device AI agents"
 license = "MIT"
-repository = "https://github.com/redclawsystems/clawhdf5"
+repository = "https://git.redclaw.dev/quantumclaw/clawhdf5"
 readme = "README.md"
 keywords = ["agent", "memory", "hdf5", "vector-search", "embedding"]
 categories = ["database", "science", "algorithms"]
 
 [dependencies]
-clawhdf5-format = { path = "../clawhdf5-format", version = "2.1.0", features = ["parallel", "fast-checksum"] }
+clawhdf5-format = { path = "../clawhdf5-format", version = "2.7.0", features = ["parallel", "fast-checksum"] }
-clawhdf5 = { path = "../clawhdf5", version = "2.1.0" }
+clawhdf5 = { path = "../clawhdf5", version = "2.7.0" }
-clawhdf5-io = { path = "../clawhdf5-io", version = "2.1.0", features = ["mmap"] }
+clawhdf5-io = { path = "../clawhdf5-io", version = "2.7.0", features = ["mmap"] }
-clawhdf5-accel = { path = "../clawhdf5-accel", version = "2.1.0" }
+clawhdf5-accel = { path = "../clawhdf5-accel", version = "2.7.0" }
-clawhdf5-ann = { path = "../clawhdf5-ann", version = "2.1.0", optional = true }
+clawhdf5-ann = { path = "../clawhdf5-ann", version = "2.7.0", optional = true }
-clawhdf5-gpu = { path = "../clawhdf5-gpu", version = "2.1.0", optional = true, default-features = false }
+clawhdf5-gpu = { path = "../clawhdf5-gpu", version = "2.7.0", optional = true, default-features = false }
-serde = { version = "1", features = ["derive"] }
+serde = { workspace = true }
 byteorder = "1"
-half = { version = "2", optional = true }
+half = { workspace = true, optional = true }
 rayon = { version = "1", optional = true }
 matrixmultiply = { version = "0.3", optional = true }
 cblas-sys = { version = "0.1", optional = true }
@@ -31,8 +31,8 @@ accelerate-src = { version = "0.3", optional = true }
 openblas-src = { version = "0.10", optional = true, features = ["cblas"] }
 
 [dev-dependencies]
-tempfile = "3"
+tempfile = { workspace = true }
-criterion = "0.5"
+criterion = { workspace = true }
 rayon = "1"
 tokio = { version = "1", features = ["rt-multi-thread", "sync", "macros"] }
 
@@ -45,9 +45,14 @@ name = "memory_bench"
 harness = false
 
 [features]
-default = ["float16", "hnsw"]
+default = ["float16", "hnsw", "parallel"]
 float16 = ["half"]
-parallel = ["rayon"]
+# Rayon-parallel brute-force search strategies, and a parallel bulk build of
+# the HNSW index (same graph, several times faster on a multi-core machine).
+parallel = ["rayon", "clawhdf5-ann?/parallel"]
+# Compress embeddings with Zstd instead of deflate when
+# `MemoryConfig::compression` is on. Off by default: it links libzstd (C).
+zstd = ["clawhdf5/zstd"]
 # HNSW approximate-nearest-neighbour acceleration for the vector stage of
 # hybrid_search. On by default; the index is rebuilt from the cache on demand
 # and stays self-consistent with the persisted memory store. Disable with

crates/clawhdf5-agent/benches/bench.rs

@@ -483,7 +483,7 @@ fn rayon_benches(c: &mut Criterion) {
                 use rayon::prelude::*;
                 let query_norm = vector_search::compute_norm(&query);
                 let num_cores = rayon::current_num_threads().max(1);
-                let chunk_size = (n + num_cores - 1) / num_cores;
+                let chunk_size = n.div_ceil(num_cores);
                 let mut results: Vec<(usize, f32)> = vectors
                     .par_chunks(chunk_size)
                     .enumerate()
@@ -537,7 +537,7 @@ fn rayon_benches(c: &mut Criterion) {
                 use rayon::prelude::*;
                 let query_norm = vector_search::compute_norm(&query);
                 let num_cores = rayon::current_num_threads().max(1);
-                let chunk_size = (n + num_cores - 1) / num_cores;
+                let chunk_size = n.div_ceil(num_cores);
                 let mut results: Vec<(usize, f32)> = vectors
                     .par_chunks(chunk_size)
                     .enumerate()
@@ -766,12 +766,22 @@ fn adaptive_benches(c: &mut Criterion) {
         .map(|v| vector_search::compute_norm(v))
         .collect();
     let tombstones = vec![0u8; n];
+    let flat: Vec<f32> = vectors.iter().flatten().copied().collect();
 
     c.bench_function("adaptive_search_10k", |b| {
         let hw = HardwareCapabilities::detect();
         let strat = strategy::auto_select_strategy(n, &hw);
         b.iter(|| {
-            strategy::search_with_metrics(&query, &vectors, &norms, &tombstones, 10, strat, None)
+            strategy::search_with_metrics(
+                &query,
+                &vectors,
+                &flat,
+                &norms,
+                &tombstones,
+                10,
+                strat,
+                None,
+            )
         });
     });
 
@@ -781,6 +791,7 @@ fn adaptive_benches(c: &mut Criterion) {
             strategy::search_with_metrics(
                 &query,
                 &vectors,
+                &flat,
                 &norms,
                 &tombstones,
                 10,
@@ -795,6 +806,7 @@ fn adaptive_benches(c: &mut Criterion) {
             strategy::search_with_metrics(
                 &query,
                 &vectors,
+                &flat,
                 &norms,
                 &tombstones,
                 10,
@@ -809,6 +821,7 @@ fn adaptive_benches(c: &mut Criterion) {
             strategy::search_with_metrics(
                 &query,
                 &vectors,
+                &flat,
                 &norms,
                 &tombstones,
                 10,

crates/clawhdf5-agent/benches/memory_bench.rs

@@ -1,6 +1,7 @@
 use clawhdf5_agent::bm25::BM25Index;
 use clawhdf5_agent::consolidation::{
     ConsolidationConfig, ConsolidationEngine, ImportanceScorer, ImportanceWeights, MemorySource,
+    UntrustedSource,
 };
 use clawhdf5_agent::hybrid::{hybrid_search, rrf_hybrid_search};
 use clawhdf5_agent::knowledge::KnowledgeCache;
@@ -285,7 +286,12 @@ fn consolidation_benches(c: &mut Criterion) {
                         for i in 0..n {
                             let embedding = make_vec(&mut rng, DIM);
                             let chunk = format!("memory record {i} with some content");
-                            engine.add_memory(chunk, embedding, MemorySource::User, now + i as f64);
+                            engine.add_memory(
+                                chunk,
+                                embedding,
+                                UntrustedSource::User,
+                                now + i as f64,
+                            );
                         }
                         engine
                     },
@@ -307,9 +313,10 @@ fn consolidation_benches(c: &mut Criterion) {
         for i in 0..50usize {
             let embedding = make_vec(&mut rng, DIM);
             let chunk = format!("existing record {i}");
-            engine.add_memory(chunk, embedding, MemorySource::User, now + i as f64);
+            engine.add_memory(chunk, embedding, UntrustedSource::User, now + i as f64);
         }
         let records = engine.records().to_vec();
+        let record_refs: Vec<&_> = records.iter().collect();
         let weights = ImportanceWeights::default();
         let query_embedding = make_vec(&mut rng, DIM);
         let sample_text =
@@ -317,7 +324,7 @@ fn consolidation_benches(c: &mut Criterion) {
 
         group.bench_function("bench_importance_scoring", |b| {
             b.iter(|| {
-                let surprise = ImportanceScorer::score_surprise(&query_embedding, &records);
+                let surprise = ImportanceScorer::score_surprise(&query_embedding, &record_refs);
                 let correction = ImportanceScorer::score_correction(&MemorySource::Correction);
                 let length = ImportanceScorer::score_length(sample_text);
                 ImportanceScorer::score_combined(surprise, correction, length, &weights)
@@ -354,7 +361,7 @@ fn temporal_benches(c: &mut Criterion) {
     // Insert benchmark: measure time to insert 10k timestamps one by one
     group.bench_function("bench_temporal_insert_10k", |b| {
         b.iter_batched(
-            || TemporalIndex::new(),
+            TemporalIndex::new,
             |mut idx| {
                 for i in 0..N {
                     // Shuffle insertion order slightly using a simple offset pattern
@@ -442,7 +449,8 @@ fn large_consolidation_benches(c: &mut Criterion) {
     let mut group = c.benchmark_group("consolidation_large");
     group.sample_size(10);
 
-    for (label, n) in [("10k", 10_000usize)] {
+    {
+        let (label, n) = ("10k", 10_000usize);
         group.bench_with_input(
             BenchmarkId::new("bench_consolidation_cycle", label),
             &n,
@@ -459,7 +467,12 @@ fn large_consolidation_benches(c: &mut Criterion) {
                         for i in 0..n {
                             let embedding = make_vec(&mut rng, DIM);
                             let chunk = format!("memory record {i} with content");
-                            engine.add_memory(chunk, embedding, MemorySource::User, now + i as f64);
+                            engine.add_memory(
+                                chunk,
+                                embedding,
+                                UntrustedSource::User,
+                                now + i as f64,
+                            );
                         }
                         engine
                     },

crates/clawhdf5-agent/fuzz/.gitignore

@@ -0,0 +1,3 @@
+target/
+artifacts/
+coverage/

crates/clawhdf5-agent/fuzz/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "clawhdf5-agent-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2024"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+tempfile = "3"
+
+[dependencies.clawhdf5-agent]
+path = ".."
+
+[workspace]
+members = ["."]
+
+[[bin]]
+name = "fuzz_wal_replay"
+path = "fuzz_targets/fuzz_wal_replay.rs"
+doc = false

crates/clawhdf5-agent/fuzz/fuzz_targets/fuzz_wal_replay.rs

@@ -0,0 +1,36 @@
+#![no_main]
+//! Arbitrary bytes as a WAL file. Reading, and opening for append (which scans
+//! the chain and truncates an unverifiable tail), must never panic, hang, or
+//! allocate without bound — and after `open` repairs the file, everything
+//! `read_entries` returned before must still be returned.
+//!
+//! The deterministic counterpart that runs in ordinary CI is
+//! `tests/wal_properties.rs`; this target explores inputs it cannot reach.
+
+use std::io::Write as _;
+
+use clawhdf5_agent::wal::WalFile;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(mut tmp) = tempfile::NamedTempFile::new() else {
+        return;
+    };
+    if tmp.write_all(data).and_then(|()| tmp.flush()).is_err() {
+        return;
+    }
+    let before = WalFile::read_entries(tmp.path()).map(|e| e.len());
+    // Only the chained formats (header versions 3 and 4) are repaired in
+    // place. `open` deliberately recreates a legacy-format file from scratch:
+    // `HDF5Memory::open` has already replayed its entries by then.
+    let chained = matches!(data.get(4), Some(3 | 4));
+    let opened = WalFile::open(tmp.path());
+    if !chained {
+        return;
+    }
+    if let (Ok(before), Ok(wal)) = (before, opened) {
+        drop(wal);
+        let after = WalFile::read_entries(tmp.path()).map(|e| e.len());
+        assert_eq!(after.ok(), Some(before), "open() changed what is replayable");
+    }
+});

crates/clawhdf5-agent/src/agents_md.rs

@@ -118,6 +118,10 @@ mod tests {
             created_at: "2025-01-01T00:00:00Z".to_string(),
             wal_enabled: false,
             wal_max_entries: 500,
+            quantized_index: false,
+            hnsw_m: 16,
+            hnsw_ef_construction: 64,
+            hnsw_ef_search: 0,
         }
     }
 

crates/clawhdf5-agent/src/anomaly.rs

@@ -82,6 +82,68 @@ impl Default for AnomalyConfig {
     }
 }
 
+// ---------------------------------------------------------------------------
+// Pattern-match normalization
+// ---------------------------------------------------------------------------
+
+/// `true` for characters used to invisibly break up text without being
+/// rendered (zero-width joiners/spacers, bidi control marks, the BOM/ZWNBSP,
+/// soft hyphen, and the invisible math operators) — a common trick for
+/// splitting a flagged word so a literal-substring check misses it while the
+/// text still displays normally.
+fn is_invisible_format_char(ch: char) -> bool {
+    matches!(
+        ch,
+        '\u{00AD}' // soft hyphen
+            | '\u{200B}' // zero width space
+            | '\u{200C}' // zero width non-joiner
+            | '\u{200D}' // zero width joiner
+            | '\u{200E}' // left-to-right mark
+            | '\u{200F}' // right-to-left mark
+            | '\u{2060}' // word joiner
+            | '\u{2061}'..='\u{2064}' // invisible times/plus/separator/function application
+            | '\u{202A}'..='\u{202E}' // bidi embedding/override controls
+            | '\u{FEFF}' // BOM / zero width no-break space
+    )
+}
+
+/// Normalize text before suspicious-pattern matching so the cheapest evasion
+/// tricks — extra whitespace, zero-width characters, or punctuation spliced
+/// between letters (e.g. `"s.y.s.t.e.m"`) — don't defeat a literal-substring
+/// check. Lowercases, drops invisible-format and control characters, drops
+/// punctuation entirely (not just collapses it, so split words rejoin), and
+/// collapses whitespace runs to a single space.
+///
+/// Does not perform Unicode NFKC normalization or confusable/homoglyph
+/// folding (see [`WriteAnomalyDetector::check_pattern_anomaly`]).
+fn normalize_for_pattern_match(text: &str) -> String {
+    let mut out = String::with_capacity(text.len());
+    let mut last_was_space = true; // trims leading whitespace for free
+    for ch in text.chars() {
+        if ch.is_control() || is_invisible_format_char(ch) {
+            continue;
+        }
+        if ch.is_whitespace() {
+            if !last_was_space {
+                out.push(' ');
+                last_was_space = true;
+            }
+            continue;
+        }
+        if ch.is_ascii_punctuation() {
+            continue;
+        }
+        for lower in ch.to_lowercase() {
+            out.push(lower);
+        }
+        last_was_space = false;
+    }
+    while out.ends_with(' ') {
+        out.pop();
+    }
+    out
+}
+
 // ---------------------------------------------------------------------------
 // WriteEvent
 // ---------------------------------------------------------------------------
@@ -99,6 +161,9 @@ pub struct WriteEvent {
 // WriteAnomalyDetector
 // ---------------------------------------------------------------------------
 
+/// Upper bound on distinct session ids the detector tracks at once.
+const MAX_TRACKED_SESSIONS: usize = 4096;
+
 /// Tracks write events and raises alerts for suspicious behaviour.
 #[derive(Debug)]
 pub struct WriteAnomalyDetector {
@@ -127,6 +192,23 @@ impl WriteAnomalyDetector {
         if event.timestamp > self.last_timestamp {
             self.last_timestamp = event.timestamp;
         }
+        // Bound the per-session map: a long-lived process sees an unbounded
+        // number of distinct session ids. When it overflows, forget the
+        // sessions with the fewest writes (they are furthest from the limit
+        // this map exists to enforce); the current one is re-added below.
+        if self.session_counts.len() >= MAX_TRACKED_SESSIONS
+            && !self.session_counts.contains_key(&event.session_id)
+        {
+            let mut counts: Vec<u32> = self.session_counts.values().copied().collect();
+            let keep_from = counts.len() / 2;
+            counts.select_nth_unstable(keep_from);
+            let threshold = counts[keep_from];
+            self.session_counts.retain(|_, c| *c >= threshold);
+            if self.session_counts.len() >= MAX_TRACKED_SESSIONS {
+                // Every session had the same count: drop them all.
+                self.session_counts.clear();
+            }
+        }
         *self
             .session_counts
             .entry(event.session_id.clone())
@@ -146,6 +228,13 @@ impl WriteAnomalyDetector {
     /// Returns an alert if the number of writes in the last 60 seconds exceeds
     /// `config.max_writes_per_minute`, or if any session has exceeded
     /// `config.max_writes_per_session`.
+    ///
+    /// The 60-second window is a single shared window across all
+    /// sessions/sources, so when it trips the alert additionally names the
+    /// top-contributing session and source within that window — a session
+    /// can never account for more of the window than the aggregate count, so
+    /// this attributes the same trip to its actual offender rather than
+    /// reporting only the anonymous aggregate total.
     pub fn check_rate_anomaly(&self) -> Option<AnomalyAlert> {
         let recent = self.window.len() as u32;
         if recent > self.config.max_writes_per_minute {
@@ -156,11 +245,31 @@ impl WriteAnomalyDetector {
             } else {
                 Severity::Medium
             };
+
+            let mut per_session: std::collections::HashMap<&str, u32> =
+                std::collections::HashMap::new();
+            // MemorySource isn't Eq/Hash, so key by its Display string instead.
+            let mut per_source: std::collections::HashMap<String, u32> =
+                std::collections::HashMap::new();
+            for e in &self.window {
+                *per_session.entry(e.session_id.as_str()).or_insert(0) += 1;
+                *per_source.entry(e.source.to_string()).or_insert(0) += 1;
+            }
+            let top_session = per_session.iter().max_by_key(|&(_, &c)| c);
+            let top_source = per_source.iter().max_by_key(|&(_, &c)| c);
+
+            let attribution = match (top_session, top_source) {
+                (Some((session, s_count)), Some((source, r_count))) => format!(
+                    "; top contributor: session '{session}' with {s_count} writes, \
+                     source {source} with {r_count} writes"
+                ),
+                _ => String::new(),
+            };
             return Some(AnomalyAlert {
                 severity,
                 message: format!(
-                    "Rate limit exceeded: {} writes in last 60s (max {})",
+                    "Rate limit exceeded: {} writes in last 60s (max {}){}",
-                    recent, self.config.max_writes_per_minute
+                    recent, self.config.max_writes_per_minute, attribution
                 ),
                 timestamp: self.last_timestamp,
             });
@@ -188,11 +297,24 @@ impl WriteAnomalyDetector {
     // -----------------------------------------------------------------------
 
     /// Returns an alert if `chunk` contains any of the configured suspicious
-    /// patterns (case-insensitive).
+    /// patterns, after normalizing both sides to defeat the cheapest evasion
+    /// tricks (case, extra whitespace, punctuation between letters,
+    /// zero-width/invisible-formatting characters).
+    ///
+    /// This does not perform Unicode NFKC normalization or confusable/
+    /// homoglyph folding (e.g. Cyrillic 'а' standing in for Latin 'a') —
+    /// that needs a per-codepoint confusable table (Unicode's
+    /// `confusables.txt`) beyond what's practical to hand-roll correctly,
+    /// and no such crate is a dependency of this crate today. A determined
+    /// attacker using homoglyphs can still evade these patterns.
     pub fn check_pattern_anomaly(&self, chunk: &str) -> Option<AnomalyAlert> {
-        let lower = chunk.to_lowercase();
+        let normalized = normalize_for_pattern_match(chunk);
         for pattern in &self.config.suspicious_patterns {
-            if lower.contains(pattern.as_str()) {
+            let normalized_pattern = normalize_for_pattern_match(pattern);
+            if normalized_pattern.is_empty() {
+                continue;
+            }
+            if normalized.contains(&normalized_pattern) {
                 let severity = if pattern.contains("ignore") || pattern.contains("override") {
                     Severity::Critical
                 } else if pattern.contains("system") || pattern.contains("jailbreak") {
@@ -327,6 +449,57 @@ mod tests {
         assert!(alert.unwrap().severity >= Severity::Medium);
     }
 
+    /// A single session dominating the shared 60s window must be named in
+    /// the alert, not just the anonymous aggregate count — this is the case
+    /// the separate cumulative max_writes_per_session check doesn't cover
+    /// (the window can trip before the session's lifetime total does).
+    #[test]
+    fn rate_anomaly_names_offending_session() {
+        let mut det = WriteAnomalyDetector::new(cfg());
+        for i in 0..11 {
+            det.record_write(event(
+                1.0 + i as f64 * 0.1,
+                "flood-session",
+                MemorySource::User,
+            ));
+        }
+        let alert = det.check_rate_anomaly().unwrap();
+        assert!(
+            alert.message.contains("flood-session"),
+            "expected the offending session to be named, got: {}",
+            alert.message
+        );
+    }
+
+    /// When many distinct sessions jointly trip the shared window, the top
+    /// contributor named must actually be the one with the most writes.
+    #[test]
+    fn rate_anomaly_attributes_top_contributor_among_many_sessions() {
+        let mut det = WriteAnomalyDetector::new(cfg());
+        // 5 sessions with 1 write each (below any per-session limit)...
+        for i in 0..5 {
+            det.record_write(event(
+                1.0 + i as f64 * 0.1,
+                "minor-session",
+                MemorySource::User,
+            ));
+        }
+        // ...plus one session responsible for the majority of the flood.
+        for i in 0..8 {
+            det.record_write(event(
+                2.0 + i as f64 * 0.1,
+                "major-session",
+                MemorySource::User,
+            ));
+        }
+        let alert = det.check_rate_anomaly().unwrap();
+        assert!(
+            alert.message.contains("major-session"),
+            "expected the top contributor to be named, got: {}",
+            alert.message
+        );
+    }
+
     #[test]
     fn rate_anomaly_critical_3x() {
         let mut det = WriteAnomalyDetector::new(cfg());
@@ -395,6 +568,71 @@ mod tests {
         assert!(alert.is_some());
     }
 
+    // --- Pattern-match evasion hardening ---
+
+    #[test]
+    fn pattern_defeats_extra_whitespace() {
+        let det = WriteAnomalyDetector::new(cfg());
+        let alert = det.check_pattern_anomaly("please   ignore    previous   instructions");
+        assert!(alert.is_some(), "extra whitespace must not defeat matching");
+    }
+
+    #[test]
+    fn pattern_defeats_punctuation_splicing() {
+        let det = WriteAnomalyDetector::new(cfg());
+        let alert = det.check_pattern_anomaly("i.g.n.o.r.e p-r-e-v-i-o-u-s instructions");
+        assert!(
+            alert.is_some(),
+            "punctuation spliced between letters must not defeat matching"
+        );
+    }
+
+    #[test]
+    fn pattern_defeats_zero_width_space() {
+        let det = WriteAnomalyDetector::new(cfg());
+        // Zero-width space (U+200B) inserted mid-word.
+        let chunk = "ign\u{200B}ore previ\u{200B}ous instructions";
+        let alert = det.check_pattern_anomaly(chunk);
+        assert!(
+            alert.is_some(),
+            "zero-width space injection must not defeat matching"
+        );
+    }
+
+    #[test]
+    fn pattern_defeats_zero_width_joiner_and_bom() {
+        let det = WriteAnomalyDetector::new(cfg());
+        let chunk = "jail\u{200D}break\u{FEFF} attempt";
+        let alert = det.check_pattern_anomaly(chunk);
+        assert!(
+            alert.is_some(),
+            "ZWJ/BOM injection must not defeat matching"
+        );
+    }
+
+    #[test]
+    fn pattern_still_clean_after_normalization() {
+        let det = WriteAnomalyDetector::new(cfg());
+        // Normalization must not introduce false positives on ordinary text
+        // that merely contains punctuation and extra whitespace.
+        let alert =
+            det.check_pattern_anomaly("Well,  I think... the weather is nice today, right?");
+        assert!(alert.is_none());
+    }
+
+    #[test]
+    fn normalize_for_pattern_match_examples() {
+        assert_eq!(
+            normalize_for_pattern_match("i.g.n.o.r.e p-r-e-v-i-o-u-s"),
+            "ignore previous"
+        );
+        assert_eq!(
+            normalize_for_pattern_match("ign\u{200B}ore   previous"),
+            "ignore previous"
+        );
+        assert_eq!(normalize_for_pattern_match("SYSTEM:"), "system");
+    }
+
     #[test]
     fn pattern_jailbreak() {
         let det = WriteAnomalyDetector::new(cfg());

crates/clawhdf5-agent/src/async_memory.rs

@@ -37,7 +37,7 @@
 //! let mem = AsyncHDF5Memory::open_with(path, config).await?;
 //! mem.save(entry).await?;           // buffered → background writer
 //! mem.save_batch(entries).await?;    // also buffered
-//! let results = mem.hybrid_search(emb, "query".into(), 0.7, 0.3, 5).await;
+//! let results = mem.hybrid_search(emb, "query".into(), 0.4, 0.6, 5).await;
 //! mem.shutdown().await?;             // final flush + stop
 //! ```
 
@@ -408,6 +408,10 @@ impl AsyncHDF5Memory {
         let (tx, rx) = oneshot::channel();
         let _ = self.write_tx.send(WriteCmd::Shutdown(tx)).await;
         let _ = rx.await;
+        // The writer task has stopped, so nothing can write through this
+        // handle any more: release the single-writer lock now rather than at
+        // drop, so the store can be reopened while `self` is still in scope.
+        self.inner.lock().await.release_store_lock();
         Ok(())
     }
 }

crates/clawhdf5-agent/src/bm25.rs

@@ -3,12 +3,38 @@
 //! Provides a standard BM25 (Okapi BM25) implementation with an in-memory
 //! inverted index. Tombstoned documents are excluded from indexing and search.
 //!
-//! Optimizations:
+//! The index is **incremental**: [`BM25Index::add_document`] and
-//! - Cached IDF scores (don't recompute per query)
+//! [`BM25Index::remove_document`] keep it exactly equivalent to one built from
-//! - Sorted posting lists by doc_id for cache-friendly access
+//! scratch over the same live documents, so a store can maintain one index for
-//! - Block-Max WAND early termination
+//! its lifetime instead of re-tokenising the whole corpus per query. To make
+//! that possible IDF is computed at query time (it depends on the live
+//! document count) rather than cached at build time.
+//!
+//! - Posting lists sorted by doc id
+//! - Bounded-heap top-k; results ordered by score, then doc id (deterministic)
 
-use std::collections::HashMap;
+use std::cmp::Reverse;
+use std::collections::{BinaryHeap, HashMap};
+
+/// `f32` wrapper providing a total order (via `total_cmp`) so BM25 scores can
+/// be kept in a `BinaryHeap`. Scores are always finite in practice (no NaN
+/// inputs reach this path), so `total_cmp`'s NaN ordering is never exercised.
+#[derive(Debug, Clone, Copy, PartialEq)]
+struct HeapScore(f32);
+
+impl Eq for HeapScore {}
+
+impl PartialOrd for HeapScore {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for HeapScore {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.0.total_cmp(&other.0)
+    }
+}
 
 /// Default BM25 term-frequency saturation parameter.
 const DEFAULT_K1: f32 = 1.2;
@@ -20,10 +46,11 @@ const DEFAULT_B: f32 = 0.75;
 pub struct BM25Index {
     /// Inverted index: token -> sorted list of (doc_id, term_frequency).
     inverted: HashMap<String, Vec<(usize, u32)>>,
-    /// Cached IDF scores per token.
-    idf_cache: HashMap<String, f32>,
     /// Number of tokens in each document (0 for tombstoned docs).
     doc_lengths: Vec<u32>,
+    /// Sum of `doc_lengths` over live documents (keeps `avg_dl` exact under
+    /// incremental updates).
+    total_length: u64,
     /// Average document length across non-tombstoned docs.
     avg_dl: f32,
     /// Number of non-tombstoned documents.
@@ -32,19 +59,27 @@ pub struct BM25Index {
     k1: f32,
     /// BM25 b parameter.
     b: f32,
+    /// Applied to every document and query token, so the two always agree.
+    filter: TokenFilter,
 }
 
 impl BM25Index {
     /// Build a BM25 index from a set of documents, excluding tombstoned entries.
     pub fn build(documents: &[String], tombstones: &[u8]) -> Self {
+        Self::build_with(documents, tombstones, TokenFilter::default())
+    }
+
+    /// [`BM25Index::build`] with the token filter chosen explicitly.
+    pub fn build_with(documents: &[String], tombstones: &[u8], filter: TokenFilter) -> Self {
         let mut index = Self {
             inverted: HashMap::new(),
-            idf_cache: HashMap::new(),
             doc_lengths: vec![0; documents.len()],
+            total_length: 0,
             avg_dl: 0.0,
             num_docs: 0,
             k1: DEFAULT_K1,
             b: DEFAULT_B,
+            filter,
         };
         index.index_documents(documents, tombstones);
         index
@@ -53,115 +88,171 @@ impl BM25Index {
     /// Search the index for a query, returning the top `k` results
     /// as `(doc_id, score)` pairs sorted by score descending.
     ///
-    /// Uses Block-Max WAND for early termination when remaining documents
+    /// Scores every matching document exhaustively, then keeps the top `k`.
-    /// cannot beat the current top-k threshold.
+    /// There is no early termination (WAND, MaxScore): the store's hot path
+    /// is [`scores`](Self::scores), because score fusion normalises over the
+    /// whole matching set and so needs every score, which no pruning scheme
+    /// can skip. This method is for BM25-only callers.
     pub fn search(&self, query: &str, k: usize) -> Vec<(usize, f32)> {
-        if self.num_docs == 0 || k == 0 {
+        if k == 0 {
             return Vec::new();
         }
-
+        // Top-k with a bounded min-heap: O(matches * log k) instead of sorting
-        let tokens = tokenize(query);
+        // every match. Ties break towards the lower doc id so results are
-        if tokens.is_empty() {
+        // deterministic.
-            return Vec::new();
+        let mut heap: BinaryHeap<Reverse<(HeapScore, Reverse<usize>)>> =
-        }
+            BinaryHeap::with_capacity(k.min(1024) + 1);
-
+        for (doc_id, score) in self.scores(query) {
-        // Collect posting lists and cached IDF scores for query tokens
+            heap.push(Reverse((HeapScore(score), Reverse(doc_id))));
-        type QueryTerm<'a> = (&'a str, f32, &'a [(usize, u32)]);
+            if heap.len() > k {
-        let mut query_terms: Vec<QueryTerm<'_>> = Vec::new();
+                heap.pop();
-        for token in &tokens {
-            if let (Some(postings), Some(&idf)) = (
-                self.inverted.get(token.as_str()),
-                self.idf_cache.get(token.as_str()),
-            ) {
-                query_terms.push((token, idf, postings));
             }
         }
+        let mut results: Vec<(usize, f32)> = heap
+            .into_iter()
+            .map(|Reverse((HeapScore(score), Reverse(doc_id)))| (doc_id, score))
+            .collect();
+        results.sort_by(|a, b| b.1.total_cmp(&a.1).then(a.0.cmp(&b.0)));
+        results
+    }
 
-        if query_terms.is_empty() {
+    /// The BM25 score of **every** matching document, in doc-id order, unsorted
+    /// by score. Score fusion normalises over the whole matching set, so it
+    /// needs all of these but not their ranking; producing a ranked list of
+    /// every match (`search(query, corpus_len)`) spent most of its time sorting.
+    pub fn scores(&self, query: &str) -> Vec<(usize, f32)> {
+        if self.num_docs == 0 {
             return Vec::new();
         }
-
+        // Term-at-a-time accumulation into a dense array: a common term has a
-        // Accumulate BM25 scores per document using WAND-style scoring
+        // posting per document, and hashing each one dominated query time.
-        let mut scores: HashMap<usize, f32> = HashMap::new();
+        // IDF is computed here rather than cached at build time: it depends on
-
+        // the live document count, which changes with every incremental
-        // Compute maximum possible contribution per term for WAND
+        // add/remove, and costs one `ln` per query term.
-        let max_tf_score: Vec<f32> = query_terms
+        let mut acc = vec![0.0f32; self.doc_lengths.len()];
-            .iter()
+        let mut matched = false;
-            .map(|(_, idf, _)| {
+        for token in tokenize_with(query, self.filter) {
-                // Upper bound: max TF contribution when tf is high and dl is short
+            let Some(postings) = self.inverted.get(token.as_str()) else {
-                let max_tf_num = 10.0 * (self.k1 + 1.0);
+                continue;
-                let max_tf_den = 10.0 + self.k1 * (1.0 - self.b);
+            };
-                idf * max_tf_num / max_tf_den
+            matched = true;
-            })
+            let df = postings.len() as f32;
-            .collect();
+            let idf = ((self.num_docs as f32 - df + 0.5) / (df + 0.5) + 1.0).ln();
-
+            for &(doc_id, freq) in postings {
-        let total_max_contribution: f32 = max_tf_score.iter().sum();
-
-        // Threshold for WAND early termination
-        let mut threshold = 0.0f32;
-        let mut top_k_scores: Vec<f32> = Vec::with_capacity(k);
-
-        for (term_idx, (_, idf, postings)) in query_terms.iter().enumerate() {
-            for &(doc_id, freq) in *postings {
                 let dl = self.doc_lengths[doc_id] as f32;
                 let freq_f = freq as f32;
                 let tf = (freq_f * (self.k1 + 1.0))
                     / (freq_f + self.k1 * (1.0 - self.b + self.b * dl / self.avg_dl));
-                let contribution = idf * tf;
+                acc[doc_id] += idf * tf;
-
-                let entry = scores.entry(doc_id).or_insert(0.0);
-                *entry += contribution;
-
-                // WAND check: if this doc's current partial score + remaining
-                // max terms can't beat threshold, we can skip (but we still
-                // accumulate since we process term-at-a-time)
-                if term_idx == query_terms.len() - 1 {
-                    // Last term: check if this doc beats threshold
-                    let final_score = *entry;
-                    if final_score > threshold && top_k_scores.len() >= k {
-                        // Update threshold
-                        top_k_scores
-                            .sort_by(|a, b| b.partial_cmp(a).unwrap_or(std::cmp::Ordering::Equal));
-                        if final_score > top_k_scores[k - 1] {
-                            top_k_scores[k - 1] = final_score;
-                            top_k_scores.sort_by(|a, b| {
-                                b.partial_cmp(a).unwrap_or(std::cmp::Ordering::Equal)
-                            });
-                            threshold = top_k_scores[k - 1];
-                        }
-                    } else if top_k_scores.len() < k {
-                        top_k_scores.push(final_score);
-                        if top_k_scores.len() == k {
-                            top_k_scores.sort_by(|a, b| {
-                                b.partial_cmp(a).unwrap_or(std::cmp::Ordering::Equal)
-                            });
-                            threshold = top_k_scores[k - 1];
-                        }
-                    }
-                }
-            }
-            // After processing each term, check if remaining terms can
-            // possibly produce results above threshold
-            let remaining_max: f32 = max_tf_score[term_idx + 1..].iter().sum();
-            if remaining_max < threshold && total_max_contribution > 0.0 {
-                // Early termination: remaining terms can't produce new top-k
-                // entries on their own. But existing partial scores may still
-                // be updated, so we continue (WAND is approximate here).
-                let _ = remaining_max; // hint to compiler
             }
         }
+        if !matched {
+            return Vec::new();
+        }
+        // Every contribution is strictly positive (idf = ln(1 + x), x > 0), so
+        // a zero entry is a document no query term touched.
+        acc.into_iter()
+            .enumerate()
+            .filter(|&(_, score)| score > 0.0)
+            .collect()
+    }
 
-        let mut results: Vec<(usize, f32)> = scores.into_iter().collect();
+    /// The token filter this index was built with.
-        results.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+    pub fn token_filter(&self) -> TokenFilter {
-        results.truncate(k);
+        self.filter
-        results
+    }
+
+    /// Number of document slots (live or not) the index covers. Ids are
+    /// positions in the document list it mirrors.
+    pub fn len(&self) -> usize {
+        self.doc_lengths.len()
+    }
+
+    /// `true` when the index covers no document slots.
+    pub fn is_empty(&self) -> bool {
+        self.doc_lengths.is_empty()
+    }
+
+    /// Index `text` as document `doc_id`, which must be the next free id
+    /// (`self.len()`) or an existing slot that is currently empty (removed or
+    /// tombstoned). After any sequence of `add_document` / `remove_document`
+    /// calls the index scores exactly as one freshly built from the same live
+    /// documents.
+    pub fn add_document(&mut self, doc_id: usize, text: &str) {
+        if doc_id >= self.doc_lengths.len() {
+            self.doc_lengths.resize(doc_id + 1, 0);
+        }
+        debug_assert_eq!(self.doc_lengths[doc_id], 0, "slot {doc_id} is occupied");
+
+        let tokens = tokenize_with(text, self.filter);
+        let mut term_freqs: HashMap<&str, u32> = HashMap::new();
+        for token in &tokens {
+            *term_freqs.entry(token).or_insert(0) += 1;
+        }
+        for (token, freq) in term_freqs {
+            let postings = self.inverted.entry(token.to_string()).or_default();
+            // Posting lists stay sorted by doc id; appends are the common case.
+            match postings.last() {
+                Some(&(last, _)) if last >= doc_id => {
+                    let at = postings.partition_point(|&(id, _)| id < doc_id);
+                    postings.insert(at, (doc_id, freq));
+                }
+                _ => postings.push((doc_id, freq)),
+            }
+        }
+        self.doc_lengths[doc_id] = tokens.len() as u32;
+        self.total_length += tokens.len() as u64;
+        self.num_docs += 1;
+        self.refresh_avg_dl();
+    }
+
+    /// Extend the index to cover `len` document slots, leaving new ones empty.
+    /// Used for slots that hold no live document (tombstoned records).
+    pub fn pad_to(&mut self, len: usize) {
+        if len > self.doc_lengths.len() {
+            self.doc_lengths.resize(len, 0);
+        }
+    }
+
+    /// Remove document `doc_id`, whose indexed text was `text`. The text is
+    /// needed to find its postings; pass exactly what was added.
+    pub fn remove_document(&mut self, doc_id: usize, text: &str) {
+        let tokens = tokenize_with(text, self.filter);
+        let mut seen: std::collections::HashSet<&str> = std::collections::HashSet::new();
+        for token in &tokens {
+            if !seen.insert(token) {
+                continue;
+            }
+            if let Some(postings) = self.inverted.get_mut(token.as_str()) {
+                if let Ok(at) = postings.binary_search_by_key(&doc_id, |&(id, _)| id) {
+                    postings.remove(at);
+                }
+                if postings.is_empty() {
+                    self.inverted.remove(token.as_str());
+                }
+            }
+        }
+        if let Some(len) = self.doc_lengths.get_mut(doc_id) {
+            self.total_length = self.total_length.saturating_sub(u64::from(*len));
+            *len = 0;
+        }
+        self.num_docs = self.num_docs.saturating_sub(1);
+        self.refresh_avg_dl();
+    }
+
+    fn refresh_avg_dl(&mut self) {
+        self.avg_dl = if self.num_docs > 0 {
+            self.total_length as f32 / self.num_docs as f32
+        } else {
+            0.0
+        };
     }
 
     /// Rebuild the index from scratch (e.g., after compaction).
     pub fn rebuild(&mut self, documents: &[String], tombstones: &[u8]) {
         self.inverted.clear();
-        self.idf_cache.clear();
         self.doc_lengths = vec![0; documents.len()];
+        self.total_length = 0;
         self.avg_dl = 0.0;
         self.num_docs = 0;
         self.index_documents(documents, tombstones);
@@ -177,7 +268,7 @@ impl BM25Index {
                 continue;
             }
 
-            let tokens = tokenize(doc);
+            let tokens = tokenize_with(doc, self.filter);
             let doc_len = tokens.len() as u32;
             self.doc_lengths[i] = doc_len;
             total_length += doc_len as u64;
@@ -198,33 +289,98 @@ impl BM25Index {
         }
 
         self.num_docs = count;
-        self.avg_dl = if count > 0 {
+        self.total_length = total_length;
-            total_length as f32 / count as f32
+        self.refresh_avg_dl();
-        } else {
-            0.0
-        };
 
         // Sort posting lists by doc_id for cache-friendly access
         for postings in self.inverted.values_mut() {
             postings.sort_by_key(|&(doc_id, _)| doc_id);
         }
-
-        // Pre-compute and cache IDF scores
-        for (token, postings) in &self.inverted {
-            let df = postings.len() as f32;
-            let idf = ((self.num_docs as f32 - df + 0.5) / (df + 0.5) + 1.0).ln();
-            self.idf_cache.insert(token.clone(), idf);
-        }
     }
 }
 
 /// Tokenize a string: lowercase, split on non-alphanumeric characters,
 /// filter empty tokens.
+/// What [`tokenize_with`] does to each token after splitting.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum TokenFilter {
+    /// Lowercase and split only — the original behaviour.
+    #[default]
+    Plain,
+    /// Also strip common English inflections, so "running" and "runs" match
+    /// "run". Conservative on purpose: only plural and past/continuous verb
+    /// endings, and only on tokens long enough that stripping leaves a real
+    /// stem. A stemmer earns its keep by conflating *related* words; an
+    /// aggressive one also conflates unrelated ones ("universe"/"university"),
+    /// which costs precision.
+    Stemmed,
+}
+
+/// Strip common English inflections from an already-lowercased token.
+///
+/// Applied identically to documents and queries, so the pair only has to agree
+/// with itself — the stem need not be a real word.
+fn stem(token: &str) -> &str {
+    // Below this, stripping does more harm than good ("bed" -> "b").
+    const MIN_STEM: usize = 4;
+    let strip = |suffix: &str, min_len: usize| -> Option<&str> {
+        let stem = token.strip_suffix(suffix)?;
+        (stem.len() >= min_len).then_some(stem)
+    };
+
+    // Plurals first: "studies" -> "studi", "classes" -> "class", "cats" -> "cat".
+    // "ies" keeps its "i" so the result meets "-ied" ("studied" -> "studi").
+    if let Some(stem) = strip("ies", 2) {
+        return &token[..stem.len() + 1];
+    }
+    for suffix in ["sses", "shes", "ches", "xes", "zes"] {
+        if let Some(stem) = strip(suffix, MIN_STEM - 1) {
+            // Keep the sibilant: "classes" -> "class", not "clas".
+            return &token[..stem.len() + 2];
+        }
+    }
+    // Verb endings before the bare plural, so "raced" doesn't become "raced".
+    if let Some(stem) = strip("ing", MIN_STEM - 1).or_else(|| strip("ed", MIN_STEM - 1)) {
+        return undouble(stem);
+    }
+    if !token.ends_with("ss")
+        && !token.ends_with("us")
+        && !token.ends_with("is")
+        && let Some(stem) = strip("s", MIN_STEM - 1)
+    {
+        return stem;
+    }
+    token
+}
+
+/// "runn" -> "run": undo the consonant doubling that "-ing"/"-ed" introduce.
+fn undouble(stem: &str) -> &str {
+    let mut chars = stem.chars().rev();
+    let (Some(last), Some(prev)) = (chars.next(), chars.next()) else {
+        return stem;
+    };
+    let doubled = last == prev && !"aeiou".contains(last) && last.is_ascii_alphabetic();
+    if doubled && stem.len() > 3 {
+        &stem[..stem.len() - 1]
+    } else {
+        stem
+    }
+}
+
+#[cfg(test)]
 fn tokenize(text: &str) -> Vec<String> {
+    tokenize_with(text, TokenFilter::Plain)
+}
+
+/// Split `text` into scoring tokens under `filter`.
+pub fn tokenize_with(text: &str, filter: TokenFilter) -> Vec<String> {
     text.to_lowercase()
         .split(|c: char| !c.is_alphanumeric())
         .filter(|s| !s.is_empty())
-        .map(|s| s.to_string())
+        .map(|token| match filter {
+            TokenFilter::Plain => token.to_string(),
+            TokenFilter::Stemmed => stem(token).to_string(),
+        })
         .collect()
 }
 
@@ -370,24 +526,21 @@ mod tests {
     }
 
     #[test]
-    fn cached_idf_consistent_with_computed() {
+    fn score_matches_the_bm25_formula() {
         let docs = vec![
             "rust programming".to_string(),
             "rust systems".to_string(),
             "python scripting".to_string(),
         ];
-        let tombstones = vec![0, 0, 0];
+        let index = BM25Index::build(&docs, &[0, 0, 0]);
-        let index = BM25Index::build(&docs, &tombstones);
 
-        // IDF for "rust" (appears in 2 of 3 docs)
+        // "python": df = 1 of N = 3. Every doc has the average length (2) and
-        let idf_rust = index.idf_cache.get("rust").unwrap();
+        // tf = 1, so the tf factor is exactly 1 and the score is the IDF.
-        let expected_idf = ((3.0f32 - 2.0 + 0.5) / (2.0 + 0.5) + 1.0).ln();
+        let results = index.search("python", 3);
-        assert!(
+        let expected_idf = ((3.0f32 - 1.0 + 0.5) / (1.0 + 0.5) + 1.0).ln();
-            (idf_rust - expected_idf).abs() < 1e-6,
+        assert_eq!(results.len(), 1);
-            "cached IDF mismatch: {} vs {}",
+        assert_eq!(results[0].0, 2);
-            idf_rust,
+        assert!((results[0].1 - expected_idf).abs() < 1e-6, "{results:?}");
-            expected_idf
-        );
     }
 
     #[test]
@@ -411,8 +564,9 @@ mod tests {
     }
 
     #[test]
-    fn wand_returns_same_results_as_exhaustive() {
+    fn top_k_search_matches_ranking_every_score() {
-        // WAND-style search should produce same scores as exhaustive
+        // `search` must agree with ranking the full `scores` set — the
+        // bounded heap is an optimisation over sorting, not an approximation.
         let docs: Vec<String> = (0..100)
             .map(|i| {
                 if i % 3 == 0 {
@@ -451,4 +605,144 @@ mod tests {
             );
         }
     }
+    /// Documents drawn from a small vocabulary so terms collide heavily.
+    fn random_doc(state: &mut u64) -> String {
+        const VOCAB: &[&str] = &[
+            "alpha", "beta", "gamma", "delta", "eps", "zeta", "eta", "x1",
+        ];
+        let mut next = || {
+            *state = state
+                .wrapping_mul(6364136223846793005)
+                .wrapping_add(1442695040888963407);
+            (*state >> 33) as usize
+        };
+        let len = 1 + next() % 9;
+        (0..len)
+            .map(|_| VOCAB[next() % VOCAB.len()])
+            .collect::<Vec<_>>()
+            .join(" ")
+    }
+
+    #[test]
+    fn incremental_updates_match_a_fresh_build_exactly() {
+        for seed in 0..60u64 {
+            let mut state = seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1;
+            let mut docs: Vec<String> = Vec::new();
+            let mut tombstones: Vec<u8> = Vec::new();
+            let mut index = BM25Index::build(&docs, &tombstones);
+
+            for step in 0..80 {
+                state = state.wrapping_mul(6364136223846793005).wrapping_add(1);
+                let live: Vec<usize> = (0..docs.len()).filter(|&i| tombstones[i] == 0).collect();
+                match (state >> 40) % 4 {
+                    0 if !live.is_empty() => {
+                        // delete
+                        let id = live[(state >> 20) as usize % live.len()];
+                        index.remove_document(id, &docs[id]);
+                        tombstones[id] = 1;
+                    }
+                    1 if !live.is_empty() => {
+                        // update in place
+                        let id = live[(state >> 20) as usize % live.len()];
+                        let new_text = random_doc(&mut state);
+                        index.remove_document(id, &docs[id]);
+                        index.add_document(id, &new_text);
+                        docs[id] = new_text;
+                    }
+                    _ => {
+                        let text = random_doc(&mut state);
+                        index.add_document(docs.len(), &text);
+                        docs.push(text);
+                        tombstones.push(0);
+                    }
+                }
+
+                let fresh = BM25Index::build(&docs, &tombstones);
+                for query in ["alpha", "beta gamma", "x1 zeta alpha delta", "missing"] {
+                    let got = index.search(query, 5);
+                    let want = fresh.search(query, 5);
+                    assert_eq!(got.len(), want.len(), "seed {seed} step {step} {query:?}");
+                    for (g, w) in got.iter().zip(&want) {
+                        assert_eq!(
+                            g.0, w.0,
+                            "seed {seed} step {step} {query:?}: {got:?} vs {want:?}"
+                        );
+                        assert!(
+                            (g.1 - w.1).abs() < 1e-5,
+                            "seed {seed} step {step} {query:?}"
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn scores_is_the_unranked_form_of_a_full_search() {
+        let mut state = 99u64;
+        let docs: Vec<String> = (0..200).map(|_| random_doc(&mut state)).collect();
+        let tombstones: Vec<u8> = (0..200).map(|i| u8::from(i % 7 == 0)).collect();
+        let index = BM25Index::build(&docs, &tombstones);
+        for query in ["alpha", "beta gamma x1", "missing", ""] {
+            let mut all = index.scores(query);
+            all.sort_by(|a, b| b.1.total_cmp(&a.1).then(a.0.cmp(&b.0)));
+            assert_eq!(all, index.search(query, docs.len()), "{query:?}");
+            assert!(all.iter().all(|(id, _)| tombstones[*id] == 0));
+        }
+    }
+
+    #[test]
+    fn stemming_conflates_inflections_of_the_same_word() {
+        let stem_of = |w: &str| tokenize_with(w, TokenFilter::Stemmed).pop().unwrap();
+        // Pairs that should meet.
+        for (a, b) in [
+            ("running", "runs"),
+            ("trained", "training"),
+            ("miles", "mile"),
+            ("studies", "studied"),
+            ("mentioned", "mentioning"),
+            ("classes", "class"),
+            ("planned", "planning"),
+        ] {
+            assert_eq!(stem_of(a), stem_of(b), "{a} / {b} should share a stem");
+        }
+        // Pairs that must stay apart. Note which pairs are deliberately absent:
+        // "bed"/"bedding" and "gas"/"gassed" both collapse to one stem, which
+        // is what Porter does too and is right — they are related words.
+        for (a, b) in [
+            ("universe", "university"),
+            ("business", "busy"),
+            ("this", "thing"),
+        ] {
+            assert_ne!(stem_of(a), stem_of(b), "{a} / {b} must not be conflated");
+        }
+        // Short words and non-inflections are left alone.
+        for word in ["run", "bus", "is", "his", "data", "gas"] {
+            assert_eq!(stem_of(word), word, "{word} should be untouched");
+        }
+    }
+
+    #[test]
+    fn stemming_is_off_by_default_and_applied_consistently() {
+        assert_eq!(tokenize("Running miles"), ["running", "miles"]);
+        assert_eq!(
+            tokenize_with("Running miles", TokenFilter::Stemmed),
+            ["run", "mile"]
+        );
+
+        // A query inflected differently from the document still matches.
+        let docs = vec!["I ran while training for the marathon".to_string()];
+        let plain = BM25Index::build_with(&docs, &[0], TokenFilter::Plain);
+        let stemmed = BM25Index::build_with(&docs, &[0], TokenFilter::Stemmed);
+        assert!(plain.search("trains", 1).is_empty());
+        assert_eq!(stemmed.search("trains", 1).len(), 1);
+    }
+
+    #[test]
+    fn ties_break_towards_the_lower_doc_id() {
+        let docs: Vec<String> = (0..6).map(|_| "same text".to_string()).collect();
+        let index = BM25Index::build(&docs, &[0; 6]);
+        let ids: Vec<usize> = index.search("same", 3).into_iter().map(|r| r.0).collect();
+        assert_eq!(ids, [0, 1, 2]);
+    }
 }

crates/clawhdf5-agent/src/cache.rs

@@ -2,11 +2,143 @@
 
 use crate::vector_search;
 
+/// Every entry's embedding, in one contiguous `[N x dim]` buffer.
+///
+/// Rows are always exactly `dim` long: a shorter one is zero-padded, a longer
+/// one truncated. The previous `Vec<Vec<f32>>` allowed ragged rows, which
+/// silently misaligned the flattened copy that the batched kernels read — a
+/// single wrong-length embedding shifted every row after it. Padding makes
+/// that unrepresentable. A record stored without an embedding therefore holds
+/// a zero row, and is told apart by its norm being zero rather than by length.
+///
+/// This used to be two fields — a `Vec<Vec<f32>>` and a flattened copy kept in
+/// lock-step — which stored the whole corpus twice and cost one heap
+/// allocation per entry on top. At 100k 384-dim entries that duplicate was
+/// ~150 MiB. Indexing yields a `&[f32]` row, so `embeddings[i]` still reads
+/// the same way.
+#[derive(Debug, Clone, Default)]
+pub struct Embeddings {
+    flat: Vec<f32>,
+    dim: usize,
+}
+
+impl Embeddings {
+    pub fn new(dim: usize) -> Self {
+        Self {
+            flat: Vec::new(),
+            dim,
+        }
+    }
+
+    /// Number of embeddings.
+    pub fn len(&self) -> usize {
+        self.flat.len().checked_div(self.dim).unwrap_or(0)
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// The whole buffer, `[N x dim]` row-major — what batched kernels read.
+    pub fn as_flat(&self) -> &[f32] {
+        &self.flat
+    }
+
+    pub fn dim(&self) -> usize {
+        self.dim
+    }
+
+    /// Row `i`, or `None` if out of range.
+    pub fn get(&self, i: usize) -> Option<&[f32]> {
+        let start = i.checked_mul(self.dim)?;
+        self.flat.get(start..start.checked_add(self.dim)?)
+    }
+
+    pub fn iter(&self) -> impl ExactSizeIterator<Item = &[f32]> {
+        self.flat.chunks_exact(self.dim.max(1))
+    }
+
+    /// Append one embedding. A row whose length doesn't match `dim` is padded
+    /// or truncated, so the buffer stays rectangular whatever a caller passes.
+    pub fn push(&mut self, embedding: &[f32]) {
+        if self.dim == 0 {
+            return;
+        }
+        let take = embedding.len().min(self.dim);
+        self.flat.extend_from_slice(&embedding[..take]);
+        self.flat.resize(self.flat.len() + (self.dim - take), 0.0);
+    }
+
+    /// Replace row `i`. Out-of-range indices are ignored.
+    pub fn set(&mut self, i: usize, embedding: &[f32]) {
+        let Some(start) = i.checked_mul(self.dim) else {
+            return;
+        };
+        if start + self.dim > self.flat.len() {
+            return;
+        }
+        let take = embedding.len().min(self.dim);
+        self.flat[start..start + take].copy_from_slice(&embedding[..take]);
+        self.flat[start + take..start + self.dim].fill(0.0);
+    }
+
+    /// Keep only the rows `keep` returns true for, preserving order.
+    pub fn retain(&mut self, mut keep: impl FnMut(usize) -> bool) {
+        if self.dim == 0 {
+            return;
+        }
+        let mut write = 0usize;
+        for read in 0..self.len() {
+            if keep(read) {
+                if write != read {
+                    let (dst, src) = (write * self.dim, read * self.dim);
+                    self.flat.copy_within(src..src + self.dim, dst);
+                }
+                write += 1;
+            }
+        }
+        self.flat.truncate(write * self.dim);
+    }
+
+    /// Replace the contents with `rows`.
+    pub fn reset_from(&mut self, dim: usize, rows: impl IntoIterator<Item = Vec<f32>>) {
+        self.dim = dim;
+        self.flat.clear();
+        for row in rows {
+            self.push(&row);
+        }
+    }
+
+    /// Adopt an already-flat buffer, trimming any partial trailing row.
+    pub fn set_flat(&mut self, dim: usize, mut flat: Vec<f32>) {
+        self.dim = dim;
+        match flat.len().checked_div(dim) {
+            Some(rows) => flat.truncate(rows * dim),
+            None => flat.clear(),
+        }
+        self.flat = flat;
+    }
+}
+
+impl PartialEq for Embeddings {
+    fn eq(&self, other: &Self) -> bool {
+        self.dim == other.dim && self.flat == other.flat
+    }
+}
+
+impl std::ops::Index<usize> for Embeddings {
+    type Output = [f32];
+
+    fn index(&self, i: usize) -> &[f32] {
+        self.get(i).expect("embedding index out of range")
+    }
+}
+
 /// In-memory cache for the /memory group data.
 #[derive(Debug, Clone)]
 pub struct MemoryCache {
     pub chunks: Vec<String>,
-    pub embeddings: Vec<Vec<f32>>,
+    pub embeddings: Embeddings,
     pub source_channels: Vec<String>,
     pub timestamps: Vec<f64>,
     pub session_ids: Vec<String>,
@@ -23,7 +155,7 @@ impl MemoryCache {
     pub fn new(embedding_dim: usize) -> Self {
         Self {
             chunks: Vec::new(),
-            embeddings: Vec::new(),
+            embeddings: Embeddings::new(embedding_dim),
             source_channels: Vec::new(),
             timestamps: Vec::new(),
             session_ids: Vec::new(),
@@ -35,6 +167,16 @@ impl MemoryCache {
         }
     }
 
+    /// Kept for callers that used to have to re-flatten after a bulk load.
+    /// The buffer is always flat now, so there is nothing to rebuild.
+    #[deprecated(note = "embeddings are stored flat; this is a no-op")]
+    pub fn rebuild_flat(&mut self) {}
+
+    /// The embeddings as one contiguous `[N x dim]` buffer.
+    pub fn flat_embeddings(&self) -> &[f32] {
+        self.embeddings.as_flat()
+    }
+
     /// Total number of entries (including tombstoned).
     pub fn len(&self) -> usize {
         self.chunks.len()
@@ -62,7 +204,7 @@ impl MemoryCache {
         let idx = self.chunks.len();
         let norm = vector_search::compute_norm(&embedding);
         self.chunks.push(chunk);
-        self.embeddings.push(embedding);
+        self.embeddings.push(&embedding);
         self.source_channels.push(source_channel);
         self.timestamps.push(timestamp);
         self.session_ids.push(session_id);
@@ -100,7 +242,7 @@ impl MemoryCache {
         if idx < self.chunks.len() {
             let norm = vector_search::compute_norm(&embedding);
             self.chunks[idx] = chunk;
-            self.embeddings[idx] = embedding;
+            self.embeddings.set(idx, &embedding);
             self.source_channels[idx] = source_channel;
             self.timestamps[idx] = timestamp;
             self.session_ids[idx] = session_id;
@@ -152,7 +294,7 @@ impl MemoryCache {
                 new_idx += 1;
                 let norm = vector_search::compute_norm(&self.embeddings[i]);
                 new_chunks.push(self.chunks[i].clone());
-                new_embeddings.push(self.embeddings[i].clone());
+                new_embeddings.push(self.embeddings[i].to_vec());
                 new_source_channels.push(self.source_channels[i].clone());
                 new_timestamps.push(self.timestamps[i]);
                 new_session_ids.push(self.session_ids[i].clone());
@@ -165,7 +307,8 @@ impl MemoryCache {
 
         let removed = old_len - new_chunks.len();
         self.chunks = new_chunks;
-        self.embeddings = new_embeddings;
+        self.embeddings
+            .reset_from(self.embedding_dim, new_embeddings);
         self.source_channels = new_source_channels;
         self.timestamps = new_timestamps;
         self.session_ids = new_session_ids;
@@ -177,12 +320,123 @@ impl MemoryCache {
         (removed, index_map)
     }
 
-    /// Flatten all embeddings into a single Vec<f32> for HDF5 storage.
+    /// All embeddings as one owned `[N x dim]` buffer, for HDF5 storage.
-    pub fn flat_embeddings(&self) -> Vec<f32> {
+    /// Prefer [`MemoryCache::flat_embeddings`] where a borrow will do.
-        let mut flat = Vec::with_capacity(self.embeddings.len() * self.embedding_dim);
+    pub fn flat_embeddings_owned(&self) -> Vec<f32> {
-        for emb in &self.embeddings {
+        self.embeddings.as_flat().to_vec()
-            flat.extend_from_slice(emb);
+    }
-        }
+}
-        flat
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// `embeddings_flat` must always equal a from-scratch flatten of `embeddings`.
+    fn assert_flat_in_sync(cache: &MemoryCache) {
+        let expected: Vec<f32> = cache.embeddings.iter().flatten().copied().collect();
+        assert_eq!(cache.embeddings.as_flat(), expected);
+    }
+
+    #[test]
+    fn push_keeps_flat_buffer_in_sync() {
+        let mut cache = MemoryCache::new(3);
+        cache.push(
+            "a".into(),
+            vec![1.0, 2.0, 3.0],
+            "chan".into(),
+            0.0,
+            "s1".into(),
+            String::new(),
+        );
+        cache.push(
+            "b".into(),
+            vec![4.0, 5.0, 6.0],
+            "chan".into(),
+            1.0,
+            "s1".into(),
+            String::new(),
+        );
+        assert_flat_in_sync(&cache);
+        assert_eq!(
+            cache.embeddings.as_flat(),
+            vec![1.0, 2.0, 3.0, 4.0, 5.0, 6.0]
+        );
+    }
+
+    #[test]
+    fn update_keeps_flat_buffer_in_sync() {
+        let mut cache = MemoryCache::new(3);
+        cache.push(
+            "a".into(),
+            vec![1.0, 2.0, 3.0],
+            "chan".into(),
+            0.0,
+            "s1".into(),
+            String::new(),
+        );
+        cache.push(
+            "b".into(),
+            vec![4.0, 5.0, 6.0],
+            "chan".into(),
+            1.0,
+            "s1".into(),
+            String::new(),
+        );
+        cache.update(
+            0,
+            "a2".into(),
+            vec![7.0, 8.0, 9.0],
+            "chan".into(),
+            2.0,
+            "s1".into(),
+        );
+        assert_flat_in_sync(&cache);
+        assert_eq!(
+            cache.embeddings.as_flat(),
+            vec![7.0, 8.0, 9.0, 4.0, 5.0, 6.0],
+            "update must overwrite the correct flat slice, not just append"
+        );
+    }
+
+    #[test]
+    fn compact_keeps_flat_buffer_in_sync() {
+        let mut cache = MemoryCache::new(2);
+        cache.push(
+            "a".into(),
+            vec![1.0, 1.0],
+            "chan".into(),
+            0.0,
+            "s1".into(),
+            String::new(),
+        );
+        cache.push(
+            "b".into(),
+            vec![2.0, 2.0],
+            "chan".into(),
+            1.0,
+            "s1".into(),
+            String::new(),
+        );
+        cache.push(
+            "c".into(),
+            vec![3.0, 3.0],
+            "chan".into(),
+            2.0,
+            "s1".into(),
+            String::new(),
+        );
+        cache.mark_deleted(1);
+        cache.compact();
+        assert_flat_in_sync(&cache);
+        assert_eq!(cache.embeddings.as_flat(), vec![1.0, 1.0, 3.0, 3.0]);
+    }
+
+    #[test]
+    fn rebuild_flat_matches_manual_flatten() {
+        let mut cache = MemoryCache::new(2);
+        cache
+            .embeddings
+            .reset_from(2, vec![vec![1.0, 2.0], vec![3.0, 4.0]]);
+        assert_eq!(cache.embeddings.as_flat(), vec![1.0, 2.0, 3.0, 4.0]);
     }
 }

crates/clawhdf5-agent/src/consolidation.rs

@@ -16,6 +16,55 @@ pub enum MemorySource {
     Correction,
 }
 
+/// Source classification for content whose true origin is *not*
+/// independently verified by the caller of [`ConsolidationEngine::add_memory`]
+/// — arbitrary text forwarded from a user, a tool's output, or a retrieval
+/// pipeline. This is the only source set `add_memory` accepts; it cannot
+/// claim the `System`/`Correction` importance boost (see [`TrustedSource`]
+/// and [`ConsolidationEngine::add_trusted_memory`]) — a caller passing
+/// through untrusted content has no way to self-report an elevated trust
+/// level through this entry point.
+#[derive(Clone, Debug, PartialEq)]
+pub enum UntrustedSource {
+    User,
+    Tool,
+    Retrieval,
+}
+
+impl From<UntrustedSource> for MemorySource {
+    fn from(s: UntrustedSource) -> Self {
+        match s {
+            UntrustedSource::User => MemorySource::User,
+            UntrustedSource::Tool => MemorySource::Tool,
+            UntrustedSource::Retrieval => MemorySource::Retrieval,
+        }
+    }
+}
+
+/// Source classification for content whose elevated trust level has been
+/// independently verified by the caller — e.g. the library's own
+/// system-generated text, or a caller that ran its own correction-cue
+/// detection (as `memory_strategy::SaveOnUserCorrection` does) rather than
+/// forwarding a caller-supplied label verbatim. `MemorySource::System`/
+/// `Correction` get elevated importance weighting in
+/// [`ImportanceScorer::score_correction`]; only reachable through
+/// [`ConsolidationEngine::add_trusted_memory`], a distinct entry point from
+/// the one untrusted content is passed through.
+#[derive(Clone, Debug, PartialEq)]
+pub enum TrustedSource {
+    System,
+    Correction,
+}
+
+impl From<TrustedSource> for MemorySource {
+    fn from(s: TrustedSource) -> Self {
+        match s {
+            TrustedSource::System => MemorySource::System,
+            TrustedSource::Correction => MemorySource::Correction,
+        }
+    }
+}
+
 #[derive(Clone, Debug, PartialEq)]
 pub enum MemoryTier {
     Working,
@@ -118,7 +167,7 @@ impl ImportanceScorer {
 
     /// Novelty score: 1.0 − max cosine similarity against all existing records.
     /// Returns 1.0 when there are no existing memories.
-    pub fn score_surprise(embedding: &[f32], existing_memories: &[MemoryRecord]) -> f32 {
+    pub fn score_surprise(embedding: &[f32], existing_memories: &[&MemoryRecord]) -> f32 {
         if existing_memories.is_empty() {
             return 1.0;
         }
@@ -199,21 +248,51 @@ impl ConsolidationEngine {
         }
     }
 
-    /// Add a new memory to the Working tier.
+    /// Add a new memory to the Working tier from an untrusted/ordinary origin
+    /// (User, Tool, or Retrieval). This is the entry point for arbitrary
+    /// caller-supplied content — it cannot claim the elevated System/
+    /// Correction importance boost. Use [`Self::add_trusted_memory`] for
+    /// content whose elevated trust level the caller has independently
+    /// verified.
     ///
     /// Importance is scored against existing Working-tier records only.
     pub fn add_memory(
+        &mut self,
+        chunk: String,
+        embedding: Vec<f32>,
+        source: UntrustedSource,
+        now: f64,
+    ) -> u64 {
+        self.add_memory_with_source(chunk, embedding, source.into(), now)
+    }
+
+    /// Add a new memory tagged System or Correction, which get elevated
+    /// importance weighting in [`ImportanceScorer::score_correction`]. Only
+    /// call this from code that has independently verified the origin (the
+    /// library's own system-generated text, or a caller that ran its own
+    /// correction-cue detection) — never from a path that forwards a
+    /// caller-supplied trust label verbatim.
+    pub fn add_trusted_memory(
+        &mut self,
+        chunk: String,
+        embedding: Vec<f32>,
+        source: TrustedSource,
+        now: f64,
+    ) -> u64 {
+        self.add_memory_with_source(chunk, embedding, source.into(), now)
+    }
+
+    fn add_memory_with_source(
         &mut self,
         chunk: String,
         embedding: Vec<f32>,
         source: MemorySource,
         now: f64,
     ) -> u64 {
-        let working: Vec<MemoryRecord> = self
+        let working: Vec<&MemoryRecord> = self
             .records
             .iter()
             .filter(|r| r.tier == MemoryTier::Working)
-            .cloned()
             .collect();
 
         let surprise = ImportanceScorer::score_surprise(&embedding, &working);
@@ -281,7 +360,7 @@ impl ConsolidationEngine {
         if working_count > capacity {
             let evict_n = working_count - capacity;
             // Collect the ids of the records to evict (lowest decay = first in sorted list).
-            let evict_ids: Vec<u64> = working_indices[..evict_n]
+            let evict_ids: std::collections::HashSet<u64> = working_indices[..evict_n]
                 .iter()
                 .map(|&i| self.records[i].id)
                 .collect();
@@ -342,7 +421,7 @@ impl ConsolidationEngine {
             });
 
             let evict_n = episodic_count - episodic_capacity;
-            let evict_ids: Vec<u64> = episodic_indices[..evict_n]
+            let evict_ids: std::collections::HashSet<u64> = episodic_indices[..evict_n]
                 .iter()
                 .map(|&i| self.records[i].id)
                 .collect();
@@ -419,13 +498,44 @@ mod tests {
     // ---------------------------------------------------------------------------
     // 2. Add memory — basic
     // ---------------------------------------------------------------------------
+    /// add_trusted_memory(TrustedSource::Correction) must actually produce a
+    /// MemorySource::Correction record — the only way to reach that elevated
+    /// classification, since add_memory's UntrustedSource has no such variant.
+    #[test]
+    fn test_add_trusted_memory_sets_correction_source() {
+        let mut engine = ConsolidationEngine::new(ConsolidationConfig::default());
+        let id = engine.add_trusted_memory(
+            "verified correction".to_string(),
+            unit_vec(4, 0),
+            TrustedSource::Correction,
+            0.0,
+        );
+        let rec = engine.get_by_id(id).unwrap();
+        assert_eq!(rec.source, MemorySource::Correction);
+    }
+
+    /// add_trusted_memory(TrustedSource::System) must produce a
+    /// MemorySource::System record.
+    #[test]
+    fn test_add_trusted_memory_sets_system_source() {
+        let mut engine = ConsolidationEngine::new(ConsolidationConfig::default());
+        let id = engine.add_trusted_memory(
+            "bootstrap text".to_string(),
+            unit_vec(4, 0),
+            TrustedSource::System,
+            0.0,
+        );
+        let rec = engine.get_by_id(id).unwrap();
+        assert_eq!(rec.source, MemorySource::System);
+    }
+
     #[test]
     fn test_add_memory_basic() {
         let mut engine = ConsolidationEngine::new(ConsolidationConfig::default());
         let id = engine.add_memory(
             "Hello world".to_string(),
             unit_vec(4, 0),
-            MemorySource::User,
+            UntrustedSource::User,
             1_000_000.0,
         );
         assert_eq!(id, 0);
@@ -453,7 +563,7 @@ mod tests {
     #[test]
     fn test_importance_scorer_surprise_identical() {
         let emb = unit_vec(4, 0);
-        let existing = vec![MemoryRecord {
+        let existing = [MemoryRecord {
             id: 0,
             chunk: "existing".to_string(),
             embedding: emb.clone(),
@@ -464,7 +574,8 @@ mod tests {
             created_at: 0.0,
             source: MemorySource::User,
         }];
-        let score = ImportanceScorer::score_surprise(&emb, &existing);
+        let existing_refs: Vec<&MemoryRecord> = existing.iter().collect();
+        let score = ImportanceScorer::score_surprise(&emb, &existing_refs);
         assert!(score < 0.01, "expected ~0.0, got {score}");
     }
 
@@ -492,23 +603,20 @@ mod tests {
     fn test_importance_scorer_length() {
         assert!((ImportanceScorer::score_length("")).abs() < f32::EPSILON);
         // 50 words → 0.5
-        let fifty_words = std::iter::repeat("word")
+        let fifty_words = std::iter::repeat_n("word", 50)
-            .take(50)
             .collect::<Vec<_>>()
             .join(" ");
         let s50 = ImportanceScorer::score_length(&fifty_words);
         assert!((s50 - 0.5).abs() < 1e-5, "expected 0.5, got {s50}");
 
         // 100 words → 1.0
-        let hundred_words = std::iter::repeat("word")
+        let hundred_words = std::iter::repeat_n("word", 100)
-            .take(100)
             .collect::<Vec<_>>()
             .join(" ");
         assert_eq!(ImportanceScorer::score_length(&hundred_words), 1.0);
 
         // 200 words → still 1.0 (clamped)
-        let two_hundred = std::iter::repeat("word")
+        let two_hundred = std::iter::repeat_n("word", 200)
-            .take(200)
             .collect::<Vec<_>>()
             .join(" ");
         assert_eq!(ImportanceScorer::score_length(&two_hundred), 1.0);
@@ -582,9 +690,11 @@ mod tests {
     // ---------------------------------------------------------------------------
     #[test]
     fn test_consolidate_eviction_working() {
-        let mut cfg = ConsolidationConfig::default();
+        let cfg = ConsolidationConfig {
-        cfg.working_capacity = 3;
+            working_capacity: 3,
-        cfg.working_to_episodic_threshold = 2.0; // never promote in this test
+            working_to_episodic_threshold: 2.0, // never promote in this test
+            ..Default::default()
+        };
         let mut engine = ConsolidationEngine::new(cfg);
 
         // Add 5 records; all have very low importance so none get promoted.
@@ -592,7 +702,7 @@ mod tests {
             let id = engine.add_memory(
                 "x".to_string(),
                 unit_vec(4, i as usize),
-                MemorySource::User,
+                UntrustedSource::User,
                 i as f64,
             );
             // Force low importance so promotion threshold is not crossed.
@@ -625,10 +735,10 @@ mod tests {
         let cfg = ConsolidationConfig::default();
         let mut engine = ConsolidationEngine::new(cfg);
 
-        let id = engine.add_memory(
+        let id = engine.add_trusted_memory(
             "important memory".to_string(),
             unit_vec(4, 0),
-            MemorySource::Correction,
+            TrustedSource::Correction,
             0.0,
         );
         // Force importance above threshold.
@@ -661,7 +771,7 @@ mod tests {
         let id = engine.add_memory(
             "frequently accessed".to_string(),
             unit_vec(4, 0),
-            MemorySource::User,
+            UntrustedSource::User,
             0.0,
         );
 
@@ -689,7 +799,12 @@ mod tests {
     #[test]
     fn test_access_memory_reactivation() {
         let mut engine = ConsolidationEngine::new(ConsolidationConfig::default());
-        let id = engine.add_memory("chunk".to_string(), unit_vec(4, 0), MemorySource::User, 0.0);
+        let id = engine.add_memory(
+            "chunk".to_string(),
+            unit_vec(4, 0),
+            UntrustedSource::User,
+            0.0,
+        );
 
         engine.access_memory(id, 5000.0);
         let rec = engine.get_by_id(id).unwrap();
@@ -710,11 +825,11 @@ mod tests {
         let mut engine = ConsolidationEngine::new(ConsolidationConfig::default());
 
         // 2 Working
-        engine.add_memory("w1".to_string(), unit_vec(4, 0), MemorySource::User, 0.0);
+        engine.add_memory("w1".to_string(), unit_vec(4, 0), UntrustedSource::User, 0.0);
-        engine.add_memory("w2".to_string(), unit_vec(4, 1), MemorySource::User, 0.0);
+        engine.add_memory("w2".to_string(), unit_vec(4, 1), UntrustedSource::User, 0.0);
 
         // 1 Episodic (manually set)
-        let id_e = engine.add_memory("e1".to_string(), unit_vec(4, 2), MemorySource::User, 0.0);
+        let id_e = engine.add_memory("e1".to_string(), unit_vec(4, 2), UntrustedSource::User, 0.0);
         engine
             .records
             .iter_mut()
@@ -723,7 +838,7 @@ mod tests {
             .tier = MemoryTier::Episodic;
 
         // 1 Semantic (manually set)
-        let id_s = engine.add_memory("s1".to_string(), unit_vec(4, 3), MemorySource::User, 0.0);
+        let id_s = engine.add_memory("s1".to_string(), unit_vec(4, 3), UntrustedSource::User, 0.0);
         engine
             .records
             .iter_mut()
@@ -742,9 +857,11 @@ mod tests {
     // ---------------------------------------------------------------------------
     #[test]
     fn test_consolidate_episodic_eviction() {
-        let mut cfg = ConsolidationConfig::default();
+        let cfg = ConsolidationConfig {
-        cfg.episodic_capacity = 3;
+            episodic_capacity: 3,
-        cfg.working_to_episodic_threshold = 2.0; // never auto-promote from Working
+            working_to_episodic_threshold: 2.0, // never auto-promote from Working
+            ..Default::default()
+        };
         let mut engine = ConsolidationEngine::new(cfg);
 
         // Seed 5 records directly in Episodic.
@@ -752,7 +869,7 @@ mod tests {
             let id = engine.add_memory(
                 "episodic chunk".to_string(),
                 unit_vec(4, i as usize),
-                MemorySource::User,
+                UntrustedSource::User,
                 i as f64,
             );
             let rec = engine.records.iter_mut().find(|r| r.id == id).unwrap();

crates/clawhdf5-agent/src/entity_extract.rs

@@ -777,8 +777,10 @@ mod tests {
 
     #[test]
     fn test_tech_disabled() {
-        let mut config = ExtractorConfig::default();
+        let config = ExtractorConfig {
-        config.extract_technology = false;
+            extract_technology: false,
+            ..Default::default()
+        };
         let e = EntityExtractor::new(config);
         let entities = e.extract("We use Rust and Docker.");
         assert!(
@@ -847,8 +849,10 @@ mod tests {
 
     #[test]
     fn test_date_disabled() {
-        let mut config = ExtractorConfig::default();
+        let config = ExtractorConfig {
-        config.extract_dates = false;
+            extract_dates: false,
+            ..Default::default()
+        };
         let e = EntityExtractor::new(config);
         let entities = e.extract("Released on 2024-03-19.");
         assert!(
@@ -981,8 +985,10 @@ mod tests {
 
     #[test]
     fn test_confidence_filter() {
-        let mut config = ExtractorConfig::default();
+        let config = ExtractorConfig {
-        config.min_confidence = 0.95;
+            min_confidence: 0.95,
+            ..Default::default()
+        };
         let e = EntityExtractor::new(config);
         // Only dates (0.95) and techs (0.9) should survive; 0.9 < 0.95 filters techs.
         let entities = e.extract("We use Rust since 2024-01-01.");
@@ -1002,7 +1008,7 @@ mod tests {
     fn test_batch_dedup() {
         let e = default_extractor();
         let texts = ["We use Rust.", "Rust is fast.", "Also Rust for safety."];
-        let entities = e.extract_batch(&texts.iter().map(|s| *s).collect::<Vec<_>>());
+        let entities = e.extract_batch(&texts);
         let rust_count = entities.iter().filter(|x| x.text == "Rust").count();
         assert_eq!(rust_count, 1, "Rust should appear exactly once after dedup");
     }
@@ -1011,7 +1017,7 @@ mod tests {
     fn test_batch_multiple_types() {
         let e = default_extractor();
         let texts = ["Deploy with Docker.", "We merged last week."];
-        let entities = e.extract_batch(&texts.iter().map(|s| *s).collect::<Vec<_>>());
+        let entities = e.extract_batch(&texts);
         assert!(
             entities
                 .iter()

crates/clawhdf5-agent/src/hybrid.rs

@@ -28,13 +28,40 @@ use crate::vector_search;
 pub fn hybrid_search(
     query_embedding: &[f32],
     query_text: &str,
-    vectors: &[Vec<f32>],
+    vectors: &(impl crate::vector_search::VectorSet + Sync + ?Sized),
-    _chunks: &[String],
+    chunks: &[String],
     tombstones: &[u8],
     bm25_index: &BM25Index,
     vector_weight: f32,
     keyword_weight: f32,
     k: usize,
+) -> Vec<(usize, f32)> {
+    hybrid_search_fused(
+        query_embedding,
+        query_text,
+        vectors,
+        chunks,
+        tombstones,
+        bm25_index,
+        Fusion::Weighted {
+            vector: vector_weight,
+            keyword: keyword_weight,
+        },
+        k,
+    )
+}
+
+/// [`hybrid_search`] with the fusion method chosen explicitly.
+#[allow(clippy::too_many_arguments)]
+pub fn hybrid_search_fused(
+    query_embedding: &[f32],
+    query_text: &str,
+    vectors: &(impl crate::vector_search::VectorSet + Sync + ?Sized),
+    _chunks: &[String],
+    tombstones: &[u8],
+    bm25_index: &BM25Index,
+    fusion: Fusion,
+    k: usize,
 ) -> Vec<(usize, f32)> {
     // Get raw scores from both systems. Request all results so normalization
     // covers the full distribution.
@@ -42,12 +69,12 @@ pub fn hybrid_search(
     let vec_scores = {
         #[cfg(feature = "parallel")]
         {
-            if vectors.len() > 10_000 {
+            if vectors.count() > 10_000 {
                 vector_search::parallel_cosine_batch(
                     query_embedding,
                     vectors,
                     tombstones,
-                    vectors.len(),
+                    vectors.count(),
                 )
             } else {
                 vector_search::cosine_similarity_batch(query_embedding, vectors, tombstones)
@@ -58,9 +85,9 @@ pub fn hybrid_search(
             vector_search::cosine_similarity_batch(query_embedding, vectors, tombstones)
         }
     };
-    let kw_scores = bm25_index.search(query_text, vectors.len());
+    let kw_scores = bm25_index.scores(query_text);
 
-    merge_vector_keyword(vec_scores, kw_scores, vector_weight, keyword_weight, k)
+    fuse(vec_scores, kw_scores, fusion, k)
 }
 
 /// Merge pre-computed vector-similarity and keyword scores into a single ranking.
@@ -76,29 +103,120 @@ pub fn merge_vector_keyword(
     keyword_weight: f32,
     k: usize,
 ) -> Vec<(usize, f32)> {
-    // Normalize each set to [0, 1].
+    fuse(
-    let vec_normalized = normalize_scores(&vec_scores);
+        vec_scores,
-    let kw_normalized = normalize_scores(&kw_scores);
+        kw_scores,
+        Fusion::Weighted {
+            vector: vector_weight,
+            keyword: keyword_weight,
+        },
+        k,
+    )
+}
 
-    // Merge scores with weights.
+/// How the vector and keyword stages are combined into one ranking.
-    let mut merged: HashMap<usize, f32> = HashMap::new();
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Fusion {
+    /// Min-max normalise each stage over its own candidates, then take a
+    /// weighted sum. Uses the *scores*, so a stage that separates its
+    /// candidates sharply keeps that separation — and a stage whose candidates
+    /// are all near-identical contributes little.
+    Weighted {
+        /// Weight on the vector stage.
+        vector: f32,
+        /// Weight on the keyword stage.
+        keyword: f32,
+    },
+    /// Reciprocal rank fusion: each stage contributes `1 / (k + rank)`,
+    /// ignoring score magnitudes entirely. Robust when the two stages'
+    /// scores aren't comparable, at the cost of discarding confidence.
+    Rrf {
+        /// The rank-damping constant; 60 is the value from the original paper.
+        k: f32,
+    },
+}
 
-    for (idx, score) in &vec_normalized {
+impl Default for Fusion {
-        *merged.entry(*idx).or_insert(0.0) += vector_weight * score;
+    fn default() -> Self {
+        DEFAULT_FUSION
     }
-    for (idx, score) in &kw_normalized {
+}
-        *merged.entry(*idx).or_insert(0.0) += keyword_weight * score;
+
+/// The fusion `hybrid_search` uses unless told otherwise.
+///
+/// The weights are not a guess: a sweep of every 0.1 step over the full
+/// LongMemEval haystack (500 questions, real MiniLM embeddings) found the
+/// long-standing 0.7/0.3 default *strictly dominated* — 0.4/0.6 is better at
+/// Hit@1, Hit@5, Hit@10 and MRR, at both turn and session granularity. See
+/// `BENCHMARKS.md`, "Weight sweep".
+pub const DEFAULT_FUSION: Fusion = Fusion::Weighted {
+    vector: 0.4,
+    keyword: 0.6,
+};
+
+/// Combine one ranked candidate list from each stage into a single top-`k`.
+///
+/// Neither list need be sorted; both are consumed.
+pub fn fuse(
+    vec_scores: Vec<(usize, f32)>,
+    kw_scores: Vec<(usize, f32)>,
+    fusion: Fusion,
+    k: usize,
+) -> Vec<(usize, f32)> {
+    let mut merged: HashMap<usize, f32> = HashMap::new();
+    match fusion {
+        Fusion::Weighted { vector, keyword } => {
+            // Normalize each set to [0, 1].
+            for (idx, score) in &normalize_scores(&vec_scores) {
+                *merged.entry(*idx).or_insert(0.0) += vector * score;
+            }
+            for (idx, score) in &normalize_scores(&kw_scores) {
+                *merged.entry(*idx).or_insert(0.0) += keyword * score;
+            }
+        }
+        Fusion::Rrf { k: damping } => {
+            for mut stage in [vec_scores, kw_scores] {
+                // Rank 1 is the best score. Ties break by index so a stage's
+                // contribution doesn't depend on the candidate order it
+                // happened to be produced in.
+                stage.sort_by(|a, b| {
+                    b.1.partial_cmp(&a.1)
+                        .unwrap_or(std::cmp::Ordering::Equal)
+                        .then(a.0.cmp(&b.0))
+                });
+                for (rank, (idx, _)) in stage.iter().enumerate() {
+                    *merged.entry(*idx).or_insert(0.0) += 1.0 / (damping + (rank + 1) as f32);
+                }
+            }
+        }
     }
 
     let mut results: Vec<(usize, f32)> = merged.into_iter().collect();
-    results.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+    // Index tie-break: `merged` is a HashMap, so without it the ties that
-    results.truncate(k);
+    // survive differ from run to run.
+    let by_score_then_id = |a: &(usize, f32), b: &(usize, f32)| {
+        b.1.partial_cmp(&a.1)
+            .unwrap_or(std::cmp::Ordering::Equal)
+            .then(a.0.cmp(&b.0))
+    };
+    // Only the top k are wanted: partition them out, then order just those,
+    // instead of sorting every candidate (the keyword side can be the corpus).
+    if k == 0 {
+        return Vec::new();
+    }
+    if results.len() > k {
+        results.select_nth_unstable_by(k - 1, by_score_then_id);
+        results.truncate(k);
+    }
+    results.sort_by(by_score_then_id);
     results
 }
 
 /// Normalize a set of scores to the [0, 1] range using min-max normalization.
 ///
-/// If all scores are identical, returns 0.0 for each entry.
+/// If all scores are identical there is no spread to normalise: each entry
+/// gets 1.0 when that score is positive (all equally the best match) and 0.0
+/// otherwise (nothing matched).
 fn normalize_scores(scores: &[(usize, f32)]) -> Vec<(usize, f32)> {
     if scores.is_empty() {
         return Vec::new();
@@ -112,7 +230,13 @@ fn normalize_scores(scores: &[(usize, f32)]) -> Vec<(usize, f32)> {
 
     let range = max - min;
     if range == 0.0 {
-        return scores.iter().map(|(idx, _)| (*idx, 0.0)).collect();
+        // All candidates scored the same (including the single-candidate
+        // case), so min-max has no spread to work with. They are all equally
+        // the best match if that score is positive, and all non-matches
+        // otherwise. This used to return 0.0 unconditionally, which erased a
+        // lone perfect match from the fused score.
+        let level = if max > 0.0 { 1.0 } else { 0.0 };
+        return scores.iter().map(|(idx, _)| (*idx, level)).collect();
     }
 
     scores
@@ -146,7 +270,7 @@ fn normalize_scores(scores: &[(usize, f32)]) -> Vec<(usize, f32)> {
 pub fn rrf_hybrid_search(
     query_embedding: &[f32],
     query_text: &str,
-    vectors: &[Vec<f32>],
+    vectors: &(impl crate::vector_search::VectorSet + Sync + ?Sized),
     _chunks: &[String],
     tombstones: &[u8],
     bm25_index: &BM25Index,
@@ -158,12 +282,12 @@ pub fn rrf_hybrid_search(
     let mut vec_scores = {
         #[cfg(feature = "parallel")]
         {
-            if vectors.len() > 10_000 {
+            if vectors.count() > 10_000 {
                 vector_search::parallel_cosine_batch(
                     query_embedding,
                     vectors,
                     tombstones,
-                    vectors.len(),
+                    vectors.count(),
                 )
             } else {
                 vector_search::cosine_similarity_batch(query_embedding, vectors, tombstones)
@@ -174,7 +298,7 @@ pub fn rrf_hybrid_search(
             vector_search::cosine_similarity_batch(query_embedding, vectors, tombstones)
         }
     };
-    let mut kw_scores = bm25_index.search(query_text, vectors.len());
+    let mut kw_scores = bm25_index.search(query_text, vectors.count());
 
     // Sort both lists descending so rank 1 = best.
     vec_scores.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
@@ -324,10 +448,80 @@ mod tests {
 
     #[test]
     fn normalize_scores_single() {
+        // A lone positive score is the best match there is, not a non-match.
         let result = normalize_scores(&[(0, 5.0)]);
         assert_eq!(result.len(), 1);
-        // Single score normalizes to 0.0 (range is 0)
+        assert_eq!(result[0].1, 1.0);
-        assert_eq!(result[0].1, 0.0);
+    }
+
+    #[test]
+    fn default_fusion_is_the_tuned_operating_point() {
+        // A sweep over the full LongMemEval haystack found 0.7/0.3 strictly
+        // dominated by 0.4/0.6 (BENCHMARKS.md). This guards the finding
+        // against being quietly undone.
+        assert_eq!(
+            DEFAULT_FUSION,
+            Fusion::Weighted {
+                vector: 0.4,
+                keyword: 0.6
+            }
+        );
+    }
+
+    #[test]
+    fn rrf_rewards_agreement_between_the_stages_and_ignores_magnitudes() {
+        // Doc 1 is second-best in both stages; doc 0 is best in one and absent
+        // from the other. RRF prefers the doc both stages liked.
+        let vec_scores = vec![(0, 100.0), (1, 0.9)];
+        let kw_scores = vec![(2, 5.0), (1, 4.9)];
+        let ranked = fuse(vec_scores, kw_scores, Fusion::Rrf { k: 60.0 }, 3);
+        assert_eq!(ranked[0].0, 1, "{ranked:?}");
+
+        // Scaling one stage's scores cannot change an RRF ranking, only the
+        // order within that stage can.
+        let a = fuse(
+            vec![(0, 1.0), (1, 0.5)],
+            vec![(1, 2.0), (0, 1.0)],
+            Fusion::Rrf { k: 60.0 },
+            2,
+        );
+        let b = fuse(
+            vec![(0, 1e6), (1, -3.0)],
+            vec![(1, 0.002), (0, 0.001)],
+            Fusion::Rrf { k: 60.0 },
+            2,
+        );
+        assert_eq!(
+            a.iter().map(|r| r.0).collect::<Vec<_>>(),
+            b.iter().map(|r| r.0).collect::<Vec<_>>()
+        );
+    }
+
+    #[test]
+    fn merge_top_k_matches_a_full_sort() {
+        // Many ties (scores repeat) so the index tie-break is exercised.
+        let vec_scores: Vec<(usize, f32)> = (0..300).map(|i| (i, ((i * 7) % 13) as f32)).collect();
+        let kw_scores: Vec<(usize, f32)> = (100..500).map(|i| (i, ((i * 5) % 11) as f32)).collect();
+        let everything =
+            merge_vector_keyword(vec_scores.clone(), kw_scores.clone(), 0.7, 0.3, 10_000);
+        assert_eq!(everything.len(), 500);
+        assert!(
+            everything
+                .windows(2)
+                .all(|w| { w[0].1 > w[1].1 || (w[0].1 == w[1].1 && w[0].0 < w[1].0) })
+        );
+        for k in [0, 1, 7, 50, 499, 500, 501] {
+            let top = merge_vector_keyword(vec_scores.clone(), kw_scores.clone(), 0.7, 0.3, k);
+            assert_eq!(top, everything[..k.min(500)], "k = {k}");
+        }
+    }
+
+    #[test]
+    fn normalize_scores_all_equal() {
+        let matched = normalize_scores(&[(0, 0.4), (1, 0.4)]);
+        assert!(matched.iter().all(|(_, s)| *s == 1.0));
+        let unmatched = normalize_scores(&[(0, 0.0), (1, 0.0)]);
+        assert!(unmatched.iter().all(|(_, s)| *s == 0.0));
     }
 
     #[test]

crates/clawhdf5-agent/src/knowledge.rs

@@ -50,6 +50,9 @@ impl RelationType {
 pub struct Entity {
     pub id: u64,
     pub name: String,
+    /// Lowercased `name`, cached at construction time to avoid re-allocating
+    /// and re-lowercasing on every entity-resolution scan.
+    pub name_lower: String,
     pub entity_type: String,
     /// Index into the memory embeddings array, or -1 if none.
     pub embedding_idx: i64,
@@ -69,6 +72,7 @@ impl Default for Entity {
         Self {
             id: 0,
             name: String::new(),
+            name_lower: String::new(),
             entity_type: String::new(),
             embedding_idx: -1,
             properties: HashMap::new(),
@@ -151,6 +155,55 @@ fn levenshtein(a: &str, b: &str) -> usize {
     prev[nb]
 }
 
+// ---------------------------------------------------------------------------
+// AdjacencyIndex
+// ---------------------------------------------------------------------------
+
+/// Adjacency index over a snapshot of `entities`/`relations`: an entity-id ->
+/// entities-slice-index map, and an entity-id -> relation-indices map (edges
+/// touching that entity as either source or target).
+///
+/// Built fresh per traversal call rather than cached on `KnowledgeCache`:
+/// entities/relations are plain `pub` `Vec`s that get pushed to directly
+/// (e.g. `schema.rs`'s load path bypasses `add_entity`/`add_relation`), so a
+/// persistent index would need extra bookkeeping to avoid drifting stale. A
+/// one-off O(V+E) build per call is still a large win over the O(V·E) (BFS)
+/// / O(steps·active·E) (spreading activation) scans it replaces.
+struct AdjacencyIndex {
+    entity_index: HashMap<u64, usize>,
+    by_entity: HashMap<u64, Vec<usize>>,
+}
+
+impl AdjacencyIndex {
+    fn build(entities: &[Entity], relations: &[Relation]) -> Self {
+        let mut entity_index = HashMap::with_capacity(entities.len());
+        for (i, e) in entities.iter().enumerate() {
+            entity_index.insert(e.id, i);
+        }
+
+        let mut by_entity: HashMap<u64, Vec<usize>> = HashMap::new();
+        for (i, r) in relations.iter().enumerate() {
+            by_entity.entry(r.src).or_default().push(i);
+            if r.tgt != r.src {
+                by_entity.entry(r.tgt).or_default().push(i);
+            }
+        }
+
+        Self {
+            entity_index,
+            by_entity,
+        }
+    }
+
+    /// Indices into `relations` of every edge touching `entity_id`.
+    fn relations_touching(&self, entity_id: u64) -> &[usize] {
+        self.by_entity
+            .get(&entity_id)
+            .map(|v| v.as_slice())
+            .unwrap_or(&[])
+    }
+}
+
 // ---------------------------------------------------------------------------
 // KnowledgeCache
 // ---------------------------------------------------------------------------
@@ -198,6 +251,7 @@ impl KnowledgeCache {
         self.entities.push(Entity {
             id,
             name: name.to_owned(),
+            name_lower: name.to_lowercase(),
             entity_type: entity_type.to_owned(),
             embedding_idx,
             properties: HashMap::new(),
@@ -310,16 +364,22 @@ impl KnowledgeCache {
     ) -> (u64, bool) {
         let lower_name = name.to_lowercase();
 
-        // Search for the closest existing entity.
+        // Search for the closest existing entity, short-circuiting on an
-        let best = self
+        // exact match since no closer candidate can exist.
-            .entities
+        let mut best: Option<(u64, usize)> = None;
-            .iter()
+        for e in &self.entities {
-            .map(|e| {
+            let dist = levenshtein(&lower_name, &e.name_lower);
-                let dist = levenshtein(&lower_name, &e.name.to_lowercase());
+            if dist > max_distance {
-                (e.id, dist)
+                continue;
-            })
+            }
-            .filter(|&(_, dist)| dist <= max_distance)
+            if dist == 0 {
-            .min_by_key(|&(_, dist)| dist);
+                best = Some((e.id, dist));
+                break;
+            }
+            if best.is_none_or(|(_, best_dist)| dist < best_dist) {
+                best = Some((e.id, dist));
+            }
+        }
 
         if let Some((id, _)) = best {
             return (id, false);
@@ -337,6 +397,7 @@ impl KnowledgeCache {
     /// together with their discovered depth.  The seed entity itself is NOT
     /// included.  Traversal follows both outgoing and incoming relation edges.
     pub fn bfs_neighbors(&self, entity_id: u64, max_depth: usize) -> Vec<(Entity, usize)> {
+        let idx = AdjacencyIndex::build(&self.entities, &self.relations);
         let mut visited: HashSet<u64> = HashSet::new();
         let mut queue: VecDeque<(u64, usize)> = VecDeque::new();
         let mut results: Vec<(Entity, usize)> = Vec::new();
@@ -349,11 +410,13 @@ impl KnowledgeCache {
                 continue;
             }
 
-            // Collect neighbour IDs from outgoing and incoming edges.
+            // Collect neighbour IDs from outgoing and incoming edges touching
-            let neighbours: Vec<u64> = self
+            // this node only, instead of scanning every relation in the graph.
-                .relations
+            let neighbours: Vec<u64> = idx
+                .relations_touching(current_id)
                 .iter()
-                .filter_map(|r| {
+                .filter_map(|&i| {
+                    let r = &self.relations[i];
                     if r.src == current_id {
                         Some(r.tgt)
                     } else if r.tgt == current_id {
@@ -366,9 +429,9 @@ impl KnowledgeCache {
 
             for neighbour_id in neighbours {
                 if visited.insert(neighbour_id)
-                    && let Some(entity) = self.get_entity(neighbour_id)
+                    && let Some(&entity_idx) = idx.entity_index.get(&neighbour_id)
                 {
-                    results.push((entity.clone(), depth + 1));
+                    results.push((self.entities[entity_idx].clone(), depth + 1));
                     queue.push_back((neighbour_id, depth + 1));
                 }
             }
@@ -439,6 +502,7 @@ impl KnowledgeCache {
         min_activation: f32,
         max_steps: usize,
     ) -> Vec<(u64, f32)> {
+        let idx = AdjacencyIndex::build(&self.entities, &self.relations);
         let mut activation: HashMap<u64, f32> = HashMap::new();
 
         // Initialise seeds with activation 1.0.
@@ -461,8 +525,10 @@ impl KnowledgeCache {
             let mut any_spread = false;
 
             for (source_id, source_score) in current {
-                // Spread to all neighbours via outgoing and incoming edges.
+                // Spread only to edges touching this node, instead of
-                for rel in &self.relations {
+                // scanning every relation in the graph per active node.
+                for &rel_idx in idx.relations_touching(source_id) {
+                    let rel = &self.relations[rel_idx];
                     let neighbour_id = if rel.src == source_id {
                         rel.tgt
                     } else if rel.tgt == source_id {
@@ -855,6 +921,19 @@ mod tests {
         assert_eq!(id, orig_id);
     }
 
+    /// An exact match must win even when a near-match with a smaller Levenshtein
+    /// distance-to-zero gap was scanned first — the early exit on dist == 0
+    /// must not skip past a later exact match.
+    #[test]
+    fn test_resolve_or_create_exact_match_beats_earlier_fuzzy_candidate() {
+        let mut cache = KnowledgeCache::new();
+        cache.add_entity("Alyce", "person", -1); // dist 1 from "Alice"
+        let exact_id = cache.add_entity("Alice", "person", -1); // dist 0
+        let (id, created) = cache.resolve_or_create("Alice", "person", -1, 2);
+        assert!(!created);
+        assert_eq!(id, exact_id);
+    }
+
     #[test]
     fn test_resolve_or_create_no_match_beyond_threshold() {
         let mut cache = KnowledgeCache::new();
@@ -1035,6 +1114,30 @@ mod tests {
         assert!(b_score.unwrap() > 0.0);
     }
 
+    /// A self-loop relation (src == tgt) must be visited exactly once by the
+    /// adjacency index, matching the pre-index behavior of iterating
+    /// `self.relations` directly (each relation processed once regardless of
+    /// how many of its endpoints match the current node).
+    #[test]
+    fn test_spreading_activation_self_loop_not_double_counted() {
+        let mut cache = KnowledgeCache::new();
+        let a = cache.add_entity("A", "node", -1);
+        cache.add_relation(a, a, "self", 1.0);
+
+        let result = cache.spreading_activation(&[a], 0.5, 0.0001, 1);
+        let a_score = result
+            .iter()
+            .find(|&&(id, _)| id == a)
+            .map(|&(_, s)| s)
+            .unwrap();
+        // Seed activation (1.0) plus exactly one spread contribution
+        // (1.0 * weight 1.0 * decay 0.5), not two.
+        assert!(
+            (a_score - 1.5).abs() < 1e-5,
+            "expected 1.5 (one self-loop contribution), got {a_score}"
+        );
+    }
+
     #[test]
     fn test_spreading_activation_decay_reduces_signal() {
         let mut cache = KnowledgeCache::new();

crates/clawhdf5-agent/src/openclaw.rs

@@ -466,7 +466,7 @@ impl ClawhdfBackend {
             let record = MemoryRecord {
                 id: i as u64,
                 chunk: cache.chunks[i].clone(),
-                embedding: cache.embeddings[i].clone(),
+                embedding: cache.embeddings[i].to_vec(),
                 tier: MemoryTier::Working,
                 importance: cache.activation_weights[i],
                 access_count: 0,
@@ -531,11 +531,14 @@ impl MemoryBackend for ClawhdfBackend {
         query_embedding: &[f32],
         k: usize,
     ) -> Vec<MemorySearchResult> {
-        // 1. Hybrid retrieval (RRF-blended vector + BM25).
+        // 1. Hybrid retrieval (vector + BM25, fused by score).
         let candidates = k.saturating_mul(3).max(10);
-        let raw = self
+        let raw = self.memory.hybrid_search_with(
-            .memory
+            query_embedding,
-            .hybrid_search(query_embedding, query_text, 0.7, 0.3, candidates);
+            query_text,
+            crate::hybrid::DEFAULT_FUSION,
+            candidates,
+        );
 
         if raw.is_empty() {
             return Vec::new();
@@ -551,6 +554,7 @@ impl MemoryBackend for ClawhdfBackend {
                 timestamp: r.timestamp,
                 source_channel: r.source_channel.clone(),
                 raw_activation: r.activation,
+                relevance: r.score,
             })
             .collect();
 
@@ -713,11 +717,13 @@ impl MemoryBackend for ClawhdfBackend {
 
         let total_records = cache.count_active();
 
+        // A record saved without an embedding occupies a zero row, so "has an
+        // embedding" is "has a non-zero norm" rather than "row is non-empty".
         let total_embeddings = cache
-            .embeddings
+            .norms
             .iter()
             .enumerate()
-            .filter(|(i, emb)| cache.tombstones[*i] == 0 && !emb.is_empty())
+            .filter(|(i, norm)| cache.tombstones[*i] == 0 && **norm > 0.0)
             .count();
 
         let file_size_bytes = std::fs::metadata(&self.hdf5_path)
@@ -748,6 +754,69 @@ impl MemoryBackend for ClawhdfBackend {
     }
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Ephemeral tier methods on ClawhdfBackend
+// ─────────────────────────────────────────────────────────────────────────────
+
+impl ClawhdfBackend {
+    /// Enable the ephemeral (in-memory only) working memory tier.
+    pub fn enable_ephemeral(&mut self, config: crate::ephemeral::EphemeralConfig) {
+        self.memory.enable_ephemeral(config);
+    }
+
+    /// Store a text value in ephemeral memory.
+    ///
+    /// Returns an error string if the ephemeral tier has not been enabled.
+    pub fn ephemeral_set(
+        &mut self,
+        key: &str,
+        value: &str,
+        ttl_secs: Option<f64>,
+    ) -> Result<(), String> {
+        match self.memory.ephemeral_mut() {
+            Some(s) => {
+                s.set_text(key, value, ttl_secs);
+                Ok(())
+            }
+            None => Err("ephemeral tier not enabled".to_string()),
+        }
+    }
+
+    /// Retrieve a text value from ephemeral memory.
+    ///
+    /// Returns `None` if the tier is disabled, the key is absent, or the
+    /// entry has expired.
+    pub fn ephemeral_get(&mut self, key: &str) -> Option<String> {
+        self.memory
+            .ephemeral_mut()?
+            .get_text(key)
+            .map(|s| s.to_string())
+    }
+
+    /// Delete a key from ephemeral memory.
+    ///
+    /// Returns `true` if the key existed and was removed.
+    pub fn ephemeral_delete(&mut self, key: &str) -> bool {
+        self.memory.ephemeral_mut().is_some_and(|s| s.delete(key))
+    }
+
+    /// Return a snapshot of ephemeral tier statistics, or `None` if the tier
+    /// is not enabled.
+    pub fn ephemeral_stats(&self) -> Option<crate::ephemeral::EphemeralStats> {
+        self.memory.ephemeral().map(|s| s.stats())
+    }
+
+    /// Promote frequently-accessed ephemeral entries to persistent HDF5 storage.
+    ///
+    /// Entries with `access_count >= min_access_count` are moved from the
+    /// ephemeral store into the persistent cache.  Returns the count promoted.
+    pub fn promote_ephemeral(&mut self, min_access_count: u32) -> Result<usize, String> {
+        self.memory
+            .promote_ephemeral(min_access_count)
+            .map_err(|e| e.to_string())
+    }
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Tests
 // ─────────────────────────────────────────────────────────────────────────────
@@ -1333,66 +1402,3 @@ mod tests {
         assert!(out.starts_with("# Title"));
     }
 }
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Ephemeral tier methods on ClawhdfBackend
-// ─────────────────────────────────────────────────────────────────────────────
-
-impl ClawhdfBackend {
-    /// Enable the ephemeral (in-memory only) working memory tier.
-    pub fn enable_ephemeral(&mut self, config: crate::ephemeral::EphemeralConfig) {
-        self.memory.enable_ephemeral(config);
-    }
-
-    /// Store a text value in ephemeral memory.
-    ///
-    /// Returns an error string if the ephemeral tier has not been enabled.
-    pub fn ephemeral_set(
-        &mut self,
-        key: &str,
-        value: &str,
-        ttl_secs: Option<f64>,
-    ) -> Result<(), String> {
-        match self.memory.ephemeral_mut() {
-            Some(s) => {
-                s.set_text(key, value, ttl_secs);
-                Ok(())
-            }
-            None => Err("ephemeral tier not enabled".to_string()),
-        }
-    }
-
-    /// Retrieve a text value from ephemeral memory.
-    ///
-    /// Returns `None` if the tier is disabled, the key is absent, or the
-    /// entry has expired.
-    pub fn ephemeral_get(&mut self, key: &str) -> Option<String> {
-        self.memory
-            .ephemeral_mut()?
-            .get_text(key)
-            .map(|s| s.to_string())
-    }
-
-    /// Delete a key from ephemeral memory.
-    ///
-    /// Returns `true` if the key existed and was removed.
-    pub fn ephemeral_delete(&mut self, key: &str) -> bool {
-        self.memory.ephemeral_mut().is_some_and(|s| s.delete(key))
-    }
-
-    /// Return a snapshot of ephemeral tier statistics, or `None` if the tier
-    /// is not enabled.
-    pub fn ephemeral_stats(&self) -> Option<crate::ephemeral::EphemeralStats> {
-        self.memory.ephemeral().map(|s| s.stats())
-    }
-
-    /// Promote frequently-accessed ephemeral entries to persistent HDF5 storage.
-    ///
-    /// Entries with `access_count >= min_access_count` are moved from the
-    /// ephemeral store into the persistent cache.  Returns the count promoted.
-    pub fn promote_ephemeral(&mut self, min_access_count: u32) -> Result<usize, String> {
-        self.memory
-            .promote_ephemeral(min_access_count)
-            .map_err(|e| e.to_string())
-    }
-}

crates/clawhdf5-agent/src/provenance.rs

@@ -1,7 +1,9 @@
 //! Memory provenance tracking and integrity verification.
 //!
-//! Records the origin, authorship, and integrity of every memory chunk
+//! Records the origin, authorship, and a content hash of every memory chunk
-//! so the system can detect tampering and trace data lineage.
+//! so the system can detect *accidental* corruption and trace data lineage.
+//! The hash is unkeyed (see [`fnv1a_64`]) — this is not a tamper-evidence or
+//! authenticity guarantee.
 
 use std::collections::HashMap;
 
@@ -11,6 +13,10 @@ pub use crate::consolidation::MemorySource;
 // Hash helper (std-only FNV-1a 64-bit)
 // ---------------------------------------------------------------------------
 
+/// Unkeyed, non-cryptographic FNV-1a hash for detecting accidental content
+/// corruption. It is trivially forgeable by anyone able to modify the stored
+/// data, since they can recompute and overwrite the stored hash alongside
+/// it — do not rely on this as a tamper-evidence or authenticity control.
 fn fnv1a_64(text: &str) -> u64 {
     const OFFSET: u64 = 14_695_981_039_346_656_037;
     const PRIME: u64 = 1_099_511_628_211;
@@ -99,6 +105,23 @@ impl ProvenanceStore {
         self.records.insert(provenance.record_id, provenance);
     }
 
+    /// Renumber records after the store was compacted. `index_map[old]` is
+    /// the record's new id, or `None` if it was removed. Without this, every
+    /// surviving record's hash ends up filed under some other record's id and
+    /// the next integrity check reports a bogus mismatch.
+    pub fn remap(&mut self, index_map: &[Option<usize>]) {
+        let old = std::mem::take(&mut self.records);
+        for (old_id, mut prov) in old {
+            let new_id = usize::try_from(old_id)
+                .ok()
+                .and_then(|i| index_map.get(i).copied().flatten());
+            if let Some(new_id) = new_id {
+                prov.record_id = new_id as u64;
+                self.records.insert(new_id as u64, prov);
+            }
+        }
+    }
+
     /// Retrieve by record ID.
     pub fn get(&self, record_id: u64) -> Option<&MemoryProvenance> {
         self.records.get(&record_id)
@@ -114,6 +137,11 @@ impl ProvenanceStore {
 
     /// Re-hash `current_chunk` and compare against the stored hash.
     /// Returns `true` if the content matches (integrity intact).
+    ///
+    /// This only detects accidental corruption: the hash is unkeyed, so an
+    /// actor able to modify the stored chunk can also recompute and
+    /// overwrite the stored hash. Do not treat a `true` result as proof the
+    /// data hasn't been tampered with.
     pub fn verify_integrity(&self, record_id: u64, current_chunk: &str) -> bool {
         match self.records.get(&record_id) {
             Some(p) => p.content_hash == fnv1a_64(current_chunk),

crates/clawhdf5-agent/src/query_expand.rs

@@ -6,6 +6,11 @@
 //! - Temporal expansion (time-related rewrites)
 //! - Morphological variants (stemming-like transforms)
 //! - Knowledge graph expansion (entity aliases and neighbors)
+//!
+//! The morphological rules are crude suffix swaps, so some variants are not
+//! words ("during" -> "dured"). That is tolerable for a BM25 stage, which
+//! simply finds no postings for a nonsense term, but it means expansion is not
+//! free: measure before enabling it on a retrieval path.
 
 use crate::knowledge::KnowledgeCache;
 
@@ -340,20 +345,87 @@ fn contains_phrase(text: &str, phrase: &str) -> bool {
 
 /// Replace a phrase in `text` case-insensitively, preserving surrounding case.
 fn replace_word_case_insensitive(text: &str, from: &str, to: &str) -> String {
-    case_insensitive_replace(text, from, to)
+    replace_first(text, from, to, MatchKind::WholeWord)
 }
 
 fn case_insensitive_replace(text: &str, from: &str, to: &str) -> String {
-    let lower = text.to_lowercase();
+    replace_first(text, from, to, MatchKind::Substring)
-    let lower_from = from.to_lowercase();
+}
-    if let Some(pos) = lower.find(&lower_from) {
+
-        let end = pos + from.len();
+/// Whether a match may fall inside a larger word.
-        format!("{}{}{}", &text[..pos], to, &text[end..])
+#[derive(Clone, Copy, PartialEq)]
-    } else {
+enum MatchKind {
-        text.to_string()
+    /// Match anywhere, including inside another word.
+    Substring,
+    /// Match only when both ends sit on a word boundary.
+    WholeWord,
+}
+
+/// Replace the first case-insensitive match of `from` in `text` with `to`.
+///
+/// Matching walks the *original* string rather than a lowercased copy. The
+/// previous implementation searched `text.to_lowercase()` and then sliced
+/// `text` with the offsets it found, which only holds while lowercasing
+/// preserves byte length. It does not: Turkish `İ` (2 bytes) lowercases to
+/// `i` + U+0307 (3 bytes), so every later offset was wrong — silently
+/// corrupting the output, or panicking when an offset landed inside a
+/// character or past the end. `"İ AI"` was enough to panic.
+fn replace_first(text: &str, from: &str, to: &str, kind: MatchKind) -> String {
+    match find_case_insensitive(text, from, kind) {
+        Some((start, end)) => {
+            let mut out = String::with_capacity(text.len() - (end - start) + to.len());
+            out.push_str(&text[..start]);
+            out.push_str(to);
+            out.push_str(&text[end..]);
+            out
+        }
+        None => text.to_string(),
     }
 }
 
+/// Byte range of the first case-insensitive match of `needle` in `haystack`.
+fn find_case_insensitive(haystack: &str, needle: &str, kind: MatchKind) -> Option<(usize, usize)> {
+    if needle.is_empty() {
+        return None;
+    }
+    let lowered: Vec<char> = needle.chars().flat_map(char::to_lowercase).collect();
+    let is_word = |c: char| c.is_alphanumeric() || c == '_';
+
+    for (start, _) in haystack.char_indices() {
+        if kind == MatchKind::WholeWord
+            && haystack[..start].chars().next_back().is_some_and(is_word)
+        {
+            continue; // mid-word: "ai" inside "training"
+        }
+        let mut matched = 0usize;
+        let mut end = start;
+        for (offset, ch) in haystack[start..].char_indices() {
+            if matched == lowered.len() {
+                break;
+            }
+            let mut consumed_all = true;
+            for lc in ch.to_lowercase() {
+                if lowered.get(matched) != Some(&lc) {
+                    consumed_all = false;
+                    break;
+                }
+                matched += 1;
+            }
+            if !consumed_all {
+                break;
+            }
+            end = start + offset + ch.len_utf8();
+        }
+        if matched == lowered.len()
+            && !(kind == MatchKind::WholeWord
+                && haystack[end..].chars().next().is_some_and(is_word))
+        {
+            return Some((start, end));
+        }
+    }
+    None
+}
+
 /// Simple whitespace/punctuation tokenizer.
 fn tokenize(text: &str) -> Vec<String> {
     text.split(|c: char| !c.is_alphanumeric())
@@ -637,4 +709,86 @@ mod tests {
             expanded.iter().map(|x| &x.text).collect::<Vec<_>>()
         );
     }
+    #[test]
+    fn acronyms_only_match_whole_words() {
+        let ex = QueryExpander::new(QueryExpansionConfig::default());
+        // "training" contains "ai", "programming" contains "pr". These used to
+        // be rewritten to "trArtificial Intelligencening" and
+        // "Pull Requestogramming".
+        for query in [
+            "How many miles during my marathon training?",
+            "Which programming language did I pick?",
+            "I updated the maintainer list",
+        ] {
+            for expansion in ex.expand(query) {
+                assert!(
+                    expansion.expansion_type != "acronym",
+                    "{query:?} produced {expansion:?}"
+                );
+            }
+        }
+        // A real acronym still expands, in both directions.
+        let texts: Vec<String> = ex
+            .expand("What about the API and the database?")
+            .into_iter()
+            .filter(|e| e.expansion_type == "acronym")
+            .map(|e| e.text)
+            .collect();
+        assert!(
+            texts
+                .iter()
+                .any(|t| t.contains("Application Programming Interface")),
+            "{texts:?}"
+        );
+        assert!(texts.iter().any(|t| t.contains("DB")), "{texts:?}");
+    }
+
+    #[test]
+    fn non_ascii_queries_do_not_panic_or_corrupt() {
+        let ex = QueryExpander::new(QueryExpansionConfig::default());
+        // Turkish 'İ' is 2 bytes but lowercases to 3, so offsets taken from a
+        // lowercased copy no longer line up with the original. `"İ AI"` used
+        // to panic; `"İstanbul AI trip"` used to silently eat a character.
+        for query in ["İ AI", "İé AI", "İİ ML", "İstanbul AI trip", "ǰ ML notes"] {
+            for expansion in ex.expand(query) {
+                assert!(
+                    expansion.text.contains('İ') || expansion.text.contains('ǰ'),
+                    "{query:?} lost its leading character: {expansion:?}"
+                );
+            }
+        }
+        let expanded = ex.expand("İstanbul AI trip");
+        assert!(
+            expanded
+                .iter()
+                .any(|e| e.text == "İstanbul Artificial Intelligence trip"),
+            "{expanded:?}"
+        );
+    }
+
+    #[test]
+    fn whole_word_matching_handles_string_edges_and_case() {
+        assert_eq!(
+            replace_word_case_insensitive("ai tools", "AI", "Artificial Intelligence"),
+            "Artificial Intelligence tools"
+        );
+        assert_eq!(
+            replace_word_case_insensitive("tools for ai", "AI", "Artificial Intelligence"),
+            "tools for Artificial Intelligence"
+        );
+        assert_eq!(
+            replace_word_case_insensitive("the aim", "AI", "Artificial Intelligence"),
+            "the aim",
+            "must not match inside a word"
+        );
+        assert_eq!(
+            replace_word_case_insensitive("no match here", "xyz", "abc"),
+            "no match here"
+        );
+        // Only the first occurrence is replaced, as before.
+        assert_eq!(
+            replace_word_case_insensitive("ai and ai", "ai", "ML"),
+            "ML and ai"
+        );
+    }
 }

crates/clawhdf5-agent/src/reranker.rs

@@ -4,8 +4,10 @@
 //! into a single composite score for each retrieved result.
 
 /// Configuration for the multi-factor re-ranker.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Copy)]
 pub struct ReRankConfig {
+    /// Weight applied to the retrieval score the candidate arrived with.
+    pub relevance_weight: f32,
     /// Weight applied to the temporal decay score (0.0–1.0).
     pub temporal_weight: f32,
     /// Weight applied to the source authority score (0.0–1.0).
@@ -20,6 +22,9 @@ pub struct ReRankConfig {
 impl Default for ReRankConfig {
     fn default() -> Self {
         Self {
+            // Relevance leads: the metadata signals break ties and nudge, they
+            // do not decide. See `BENCHMARKS.md`, "Recency discrimination".
+            relevance_weight: 1.0,
             temporal_weight: 0.3,
             authority_weight: 0.2,
             activation_weight: 0.5,
@@ -41,6 +46,8 @@ pub struct ReRankResult {
     pub authority_score: f32,
     /// Normalised Hebbian activation score in [0, 1].
     pub activation_score: f32,
+    /// The retrieval score carried through from the input.
+    pub relevance_score: f32,
 }
 
 /// Compute an exponential decay temporal score.
@@ -105,6 +112,15 @@ pub struct RerankInput {
     pub source_channel: String,
     /// Raw Hebbian activation weight for this entry.
     pub raw_activation: f32,
+    /// The retrieval score that put this entry in the candidate list.
+    ///
+    /// Re-ranking is meant to *adjust* the retriever's ordering with signals
+    /// it does not have, not to replace it. Without this the combined score
+    /// was made of recency, authority and activation alone, so a candidate
+    /// pool came back ordered by age with its relevance ordering discarded.
+    /// Callers with no meaningful score can pass the same value for every
+    /// entry, which reduces to the old behaviour.
+    pub relevance: f32,
 }
 
 /// Re-rank a list of retrieval results using multi-factor scoring.
@@ -138,7 +154,8 @@ pub fn rerank(
             let auth = source_authority_score(&inp.source_channel);
             let act = activation_score(inp.raw_activation);
 
-            let combined = config.temporal_weight * ts
+            let combined = config.relevance_weight * inp.relevance
+                + config.temporal_weight * ts
                 + config.authority_weight * auth
                 + config.activation_weight * act;
 
@@ -148,6 +165,7 @@ pub fn rerank(
                 temporal_score: ts,
                 authority_score: auth,
                 activation_score: act,
+                relevance_score: inp.relevance,
             }
         })
         .collect();
@@ -253,22 +271,51 @@ mod tests {
                 timestamp: 0.0, // very old
                 source_channel: "other".to_string(),
                 raw_activation: 0.1,
+                relevance: 0.0,
             },
             RerankInput {
                 index: 1,
                 timestamp: 86_400.0, // one day ago
                 source_channel: "conversation".to_string(),
                 raw_activation: 0.5,
+                relevance: 0.0,
             },
             RerankInput {
                 index: 2,
                 timestamp: 172_800.0, // "now"
                 source_channel: "user_correction".to_string(),
                 raw_activation: 1.0,
+                relevance: 0.0,
             },
         ]
     }
 
+    #[test]
+    fn relevance_leads_but_recency_breaks_near_ties() {
+        let entry = |index, timestamp, relevance| RerankInput {
+            index,
+            timestamp,
+            source_channel: "conversation".to_string(),
+            raw_activation: 1.0,
+            relevance,
+        };
+        let now = 10.0 * 86_400.0;
+        let config = ReRankConfig::default();
+
+        // A clearly better match wins despite being much older. Before
+        // `relevance` existed the combined score ignored it entirely, so this
+        // returned the newer, irrelevant entry.
+        let ranked = rerank(&[entry(0, 0.0, 1.0), entry(1, now, 0.1)], &config, now);
+        assert_eq!(ranked[0].index, 0, "{ranked:?}");
+
+        // Between near-equal matches, the newer one wins.
+        let ranked = rerank(&[entry(0, 0.0, 0.80), entry(1, now, 0.79)], &config, now);
+        assert_eq!(ranked[0].index, 1, "{ranked:?}");
+
+        // The breakdown carries the relevance through.
+        assert_eq!(ranked[0].relevance_score, 0.79);
+    }
+
     #[test]
     fn rerank_returns_all_entries() {
         let inputs = make_inputs();
@@ -302,6 +349,7 @@ mod tests {
     #[test]
     fn rerank_score_breakdown_matches_manual_calculation() {
         let config = ReRankConfig {
+            relevance_weight: 0.0,
             temporal_weight: 1.0,
             authority_weight: 0.0,
             activation_weight: 0.0,
@@ -312,6 +360,7 @@ mod tests {
             timestamp: 0.0,
             source_channel: "other".to_string(),
             raw_activation: 0.5,
+            relevance: 0.0,
         }];
         let now = 3600.0_f64; // exactly one half-life later
         let results = rerank(&inputs, &config, now);

crates/clawhdf5-agent/src/schema.rs

@@ -12,10 +12,18 @@ use crate::MemoryError;
 use crate::cache::MemoryCache;
 use crate::knowledge::KnowledgeCache;
 use crate::session::SessionCache;
+use crate::wal::WalMark;
 
 pub const SCHEMA_VERSION: &str = "1.0";
 pub const ZEROCLAW_VERSION: &str = "0.8.0";
 
+/// `/meta` attributes holding the [`WalMark`] of the WAL prefix already folded
+/// into this file. Absent on files written before the mark existed, and when
+/// the checkpoint was taken with an empty WAL.
+const WAL_APPLIED_LEN_ATTR: &str = "wal_applied_len";
+const WAL_APPLIED_CRC_ATTR: &str = "wal_applied_crc";
+const ANN_GENERATION_ATTR: &str = "ann_generation";
+
 /// Build a complete HDF5 file from the in-memory state.
 pub fn build_hdf5_file(
     config: &MemoryConfig,
@@ -23,6 +31,47 @@ pub fn build_hdf5_file(
     sessions: &SessionCache,
     knowledge: &KnowledgeCache,
 ) -> Result<Vec<u8>, MemoryError> {
+    build_hdf5_file_with_mark(config, cache, sessions, knowledge, None)
+}
+
+/// [`build_hdf5_file`], recording which WAL prefix this state already
+/// contains (see [`WalMark`]) so a crash before the WAL is truncated doesn't
+/// replay those entries a second time.
+pub fn build_hdf5_file_with_mark(
+    config: &MemoryConfig,
+    cache: &MemoryCache,
+    sessions: &SessionCache,
+    knowledge: &KnowledgeCache,
+    wal_applied: Option<WalMark>,
+) -> Result<Vec<u8>, MemoryError> {
+    let meta = CheckpointMeta {
+        wal_applied,
+        ann_generation: None,
+    };
+    build_hdf5_file_with_meta(config, cache, sessions, knowledge, &meta)
+}
+
+/// Bookkeeping a checkpoint records in `/meta` beside the store's contents.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct CheckpointMeta {
+    /// The WAL prefix this checkpoint already contains; see [`WalMark`].
+    pub wal_applied: Option<WalMark>,
+    /// Identifies the vector-index sidecar (`<store>.h5.ann`) written with this
+    /// checkpoint. A sidecar is loaded only if it carries the same value, so
+    /// one left over from another checkpoint can never be attached to records
+    /// it wasn't built from.
+    pub ann_generation: Option<u64>,
+}
+
+/// [`build_hdf5_file`] with checkpoint bookkeeping.
+pub fn build_hdf5_file_with_meta(
+    config: &MemoryConfig,
+    cache: &MemoryCache,
+    sessions: &SessionCache,
+    knowledge: &KnowledgeCache,
+    checkpoint: &CheckpointMeta,
+) -> Result<Vec<u8>, MemoryError> {
+    let wal_applied = checkpoint.wal_applied;
     let mut builder = clawhdf5::FileBuilder::new();
 
     // /meta group with schema attributes
@@ -34,10 +83,53 @@ pub fn build_hdf5_file(
     meta.set_attr("embedding_dim", AttrValue::I64(config.embedding_dim as i64));
     meta.set_attr("chunk_size", AttrValue::I64(config.chunk_size as i64));
     meta.set_attr("overlap", AttrValue::I64(config.overlap as i64));
+    // Behavioural settings. These used to live only in memory, so reopening a
+    // store silently reset them to defaults — e.g. a compressed store was
+    // rewritten uncompressed by the first checkpoint after a reopen. Loaders
+    // treat each one as optional so older files keep opening.
+    meta.set_attr("float16", AttrValue::I64(config.float16.into()));
+    meta.set_attr("compression", AttrValue::I64(config.compression.into()));
+    meta.set_attr(
+        "compression_level",
+        AttrValue::I64(config.compression_level.into()),
+    );
+    meta.set_attr(
+        "compact_threshold",
+        AttrValue::F64(config.compact_threshold.into()),
+    );
+    meta.set_attr("hebbian_boost", AttrValue::F64(config.hebbian_boost.into()));
+    meta.set_attr("decay_factor", AttrValue::F64(config.decay_factor.into()));
+    meta.set_attr("wal_enabled", AttrValue::I64(config.wal_enabled.into()));
+    meta.set_attr(
+        "wal_max_entries",
+        AttrValue::I64(config.wal_max_entries as i64),
+    );
+    meta.set_attr(
+        "quantized_index",
+        AttrValue::I64(config.quantized_index.into()),
+    );
+    meta.set_attr("hnsw_m", AttrValue::I64(config.hnsw_m as i64));
+    meta.set_attr(
+        "hnsw_ef_construction",
+        AttrValue::I64(config.hnsw_ef_construction as i64),
+    );
+    meta.set_attr(
+        "hnsw_ef_search",
+        AttrValue::I64(config.hnsw_ef_search as i64),
+    );
     meta.set_attr(
         "edgehdf5_version",
         AttrValue::String(ZEROCLAW_VERSION.into()),
     );
+    if let Some(mark) = wal_applied.filter(|m| m.len > 0) {
+        meta.set_attr(WAL_APPLIED_LEN_ATTR, AttrValue::I64(mark.len as i64));
+        meta.set_attr(WAL_APPLIED_CRC_ATTR, AttrValue::I64(i64::from(mark.crc)));
+    }
+    if let Some(generation) = checkpoint.ann_generation {
+        // Stored as the i64 with the same bits; attributes have no u64 scalar
+        // round trip through every reader.
+        meta.set_attr(ANN_GENERATION_ATTR, AttrValue::I64(generation as i64));
+    }
     // Need at least one dataset in the group for it to be a proper group
     meta.create_dataset("_marker").with_u8_data(&[1]).compact();
     let finished_meta = meta.finish();
@@ -74,7 +166,7 @@ fn build_memory_group(
     {
         let ds = group
             .create_dataset("embeddings")
-            .with_f32_data(&flat)
+            .with_f32_data(flat)
             .with_shape(&[n, d]);
 
         // Chunk size tuning: target ~256KB per chunk for optimal I/O
@@ -83,15 +175,33 @@ fn build_memory_group(
             let rows_per_chunk = (target_chunk_bytes / (d * 4)).max(1).min(n);
             ds.with_chunks(&[rows_per_chunk, d]);
 
-            // Compression: Zstd for embeddings — faster than deflate at same ratio.
+            // Compression. Shuffle is applied automatically (auto-shuffle
-            // Shuffle is applied automatically (auto-shuffle pre-filter).
+            // pre-filter). Zstd is faster than deflate at the same ratio but
+            // pulls in libzstd, so it is opt-in via the `zstd` feature; the
+            // default build uses deflate, which is always available. (This
+            // used to call `with_zstd` unconditionally, so without the
+            // feature every checkpoint of a compressed store failed with
+            // "unsupported filter: 32015".) Both are standard HDF5 filters;
+            // reading a zstd-compressed store needs a zstd-enabled build.
             if config.compression {
-                let level = if config.compression_level > 0 {
+                #[cfg(feature = "zstd")]
-                    config.compression_level.min(22)
+                {
-                } else {
+                    let level = if config.compression_level > 0 {
-                    3 // Zstd level 3: fast + good ratio for f32 embeddings
+                        config.compression_level.min(22)
-                };
+                    } else {
-                ds.with_zstd(level);
+                        3 // fast + good ratio for f32 embeddings
+                    };
+                    ds.with_zstd(level);
+                }
+                #[cfg(not(feature = "zstd"))]
+                {
+                    let level = if config.compression_level > 0 {
+                        config.compression_level.min(9)
+                    } else {
+                        4
+                    };
+                    ds.with_deflate(level);
+                }
             }
         }
 
@@ -309,6 +419,36 @@ fn write_string_dataset(
 }
 
 /// Validate an HDF5 file has the correct schema and load all data.
+/// Read the checkpoint's [`WalMark`] from `/meta`, if it has one.
+pub fn read_wal_mark(file: &clawhdf5::File) -> Option<WalMark> {
+    let attrs = file.group("meta").ok()?.attrs().ok()?;
+    let len = match attrs.get(WAL_APPLIED_LEN_ATTR)? {
+        AttrValue::I64(v) => u64::try_from(*v).ok()?,
+        _ => return None,
+    };
+    let crc = match attrs.get(WAL_APPLIED_CRC_ATTR)? {
+        AttrValue::I64(v) => u32::try_from(*v).ok()?,
+        _ => return None,
+    };
+    Some(WalMark { len, crc })
+}
+
+/// Read the checkpoint bookkeeping from `/meta`.
+pub fn read_checkpoint_meta(file: &clawhdf5::File) -> CheckpointMeta {
+    let ann_generation = file
+        .group("meta")
+        .ok()
+        .and_then(|g| g.attrs().ok())
+        .and_then(|attrs| match attrs.get(ANN_GENERATION_ATTR) {
+            Some(AttrValue::I64(v)) => Some(*v as u64),
+            _ => None,
+        });
+    CheckpointMeta {
+        wal_applied: read_wal_mark(file),
+        ann_generation,
+    }
+}
+
 pub fn validate_and_load(
     file: &clawhdf5::File,
 ) -> Result<(MemoryConfig, MemoryCache, SessionCache, KnowledgeCache), MemoryError> {
@@ -344,15 +484,29 @@ pub fn validate_and_load(
         embedding_dim,
         chunk_size,
         overlap,
-        float16: false,
+        float16: optional_bool_attr(&attrs, "float16", false),
-        compression: false,
+        compression: optional_bool_attr(&attrs, "compression", false),
-        compression_level: 0,
+        compression_level: optional_i64_attr(&attrs, "compression_level")
-        compact_threshold: 0.3,
+            .and_then(|v| u32::try_from(v).ok())
-        hebbian_boost: 0.15,
+            .unwrap_or(0),
-        decay_factor: 0.98,
+        compact_threshold: optional_f32_attr(&attrs, "compact_threshold", 0.3),
+        hebbian_boost: optional_f32_attr(&attrs, "hebbian_boost", 0.15),
+        decay_factor: optional_f32_attr(&attrs, "decay_factor", 0.98),
         created_at,
-        wal_enabled: true,
+        wal_enabled: optional_bool_attr(&attrs, "wal_enabled", true),
-        wal_max_entries: 500,
+        wal_max_entries: optional_i64_attr(&attrs, "wal_max_entries")
+            .and_then(|v| usize::try_from(v).ok())
+            .unwrap_or(500),
+        quantized_index: optional_bool_attr(&attrs, "quantized_index", false),
+        hnsw_m: optional_i64_attr(&attrs, "hnsw_m")
+            .and_then(|v| usize::try_from(v).ok())
+            .unwrap_or(16),
+        hnsw_ef_construction: optional_i64_attr(&attrs, "hnsw_ef_construction")
+            .and_then(|v| usize::try_from(v).ok())
+            .unwrap_or(64),
+        hnsw_ef_search: optional_i64_attr(&attrs, "hnsw_ef_search")
+            .and_then(|v| usize::try_from(v).ok())
+            .unwrap_or(0),
     };
 
     // Load /memory group
@@ -391,27 +545,48 @@ fn load_memory_group(
     let tags = read_string_dataset_from_group(&group, "tags")?;
     let tombstones = read_u8_dataset(&group, "tombstones")?;
 
-    // Read norms if present, otherwise compute from embeddings
+    // Every per-record dataset must describe exactly `n` records. Without
-    let norms = match read_f32_dataset(&group, "norms") {
+    // this, a truncated or hand-edited file loads "successfully" and then
-        Ok(n) if n.len() == n.len() => n,
+    // panics on the first out-of-bounds index during search/delete.
-        _ => {
+    if embedding_dim == 0 {
-            // Compute norms from flat embeddings
+        return Err(MemoryError::Schema(format!(
-            flat_embeddings
+            "/memory has {n} records but embedding_dim is 0"
-                .chunks(embedding_dim)
+        )));
-                .map(|chunk| {
+    }
-                    let sq_sum: f32 = chunk.iter().map(|x| x * x).sum();
+    let expected_flat = n.checked_mul(embedding_dim).ok_or_else(|| {
-                    sq_sum.sqrt()
+        MemoryError::Schema(format!("/memory size overflow: {n} x {embedding_dim}"))
-                })
+    })?;
-                .collect()
+    let check_len = |name: &str, actual: usize, expected: usize| {
+        if actual == expected {
+            Ok(())
+        } else {
+            Err(MemoryError::Schema(format!(
+                "/memory/{name} has {actual} entries, expected {expected} \
+                 ({n} records)"
+            )))
         }
     };
+    check_len("embeddings", flat_embeddings.len(), expected_flat)?;
+    check_len("source_channel", source_channels.len(), n)?;
+    check_len("timestamps", timestamps.len(), n)?;
+    check_len("session_ids", session_ids.len(), n)?;
+    check_len("tags", tags.len(), n)?;
+    check_len("tombstones", tombstones.len(), n)?;
 
-    // Unflatten embeddings
+    // Norms are derived data: use the stored ones only if they are present
-    let embeddings: Vec<Vec<f32>> = flat_embeddings
+    // and the right length, otherwise recompute from the embeddings.
-        .chunks(embedding_dim)
+    let norms = match read_f32_dataset(&group, "norms") {
-        .map(|c| c.to_vec())
+        Ok(stored) if stored.len() == n => stored,
-        .collect();
+        _ => flat_embeddings
+            .chunks(embedding_dim)
+            .map(|chunk| {
+                let sq_sum: f32 = chunk.iter().map(|x| x * x).sum();
+                sq_sum.sqrt()
+            })
+            .collect(),
+    };
 
+    // No unflattening: the cache stores the buffer as it is on disk.
     // Read activation_weights if present, default to vec![1.0; N] for backward compat
     let activation_weights = match read_f32_dataset(&group, "activation_weights") {
         Ok(w) if w.len() == n => w,
@@ -419,7 +594,7 @@ fn load_memory_group(
     };
 
     cache.chunks = chunks;
-    cache.embeddings = embeddings;
+    cache.embeddings.set_flat(embedding_dim, flat_embeddings);
     cache.source_channels = source_channels;
     cache.timestamps = timestamps;
     cache.session_ids = session_ids;
@@ -480,6 +655,7 @@ fn load_knowledge_group(file: &clawhdf5::File) -> Result<KnowledgeCache, MemoryE
             cache.entities.push(crate::knowledge::Entity {
                 id: entity_ids[i] as u64,
                 name: entity_names[i].clone(),
+                name_lower: entity_names[i].to_lowercase(),
                 entity_type: entity_types[i].clone(),
                 embedding_idx: emb_idxs[i],
                 ..Default::default()
@@ -529,6 +705,27 @@ fn extract_string_attr(
     }
 }
 
+type MetaAttrs = std::collections::HashMap<String, AttrValue>;
+
+fn optional_i64_attr(attrs: &MetaAttrs, name: &str) -> Option<i64> {
+    match attrs.get(name) {
+        Some(AttrValue::I64(v)) => Some(*v),
+        _ => None,
+    }
+}
+
+fn optional_bool_attr(attrs: &MetaAttrs, name: &str, default: bool) -> bool {
+    optional_i64_attr(attrs, name).map_or(default, |v| v != 0)
+}
+
+/// Finite values only: a NaN threshold/decay would poison every comparison.
+fn optional_f32_attr(attrs: &MetaAttrs, name: &str, default: f32) -> f32 {
+    match attrs.get(name) {
+        Some(AttrValue::F64(v)) if v.is_finite() => *v as f32,
+        _ => default,
+    }
+}
+
 fn extract_i64_attr(
     attrs: &std::collections::HashMap<String, AttrValue>,
     name: &str,
@@ -614,3 +811,108 @@ fn read_u8_dataset(group: &clawhdf5::Group<'_>, name: &str) -> Result<Vec<u8>, M
         .map_err(|e| MemoryError::Hdf5(format!("cannot read u8 from {name}: {e}")))?;
     Ok(data.into_iter().map(|v| v as u8).collect())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn config() -> MemoryConfig {
+        MemoryConfig::new(std::path::PathBuf::from("unused.h5"), "agent", 4)
+    }
+
+    fn cache_with(n: usize) -> MemoryCache {
+        let mut cache = MemoryCache::new(4);
+        for i in 0..n {
+            cache.push(
+                format!("chunk {i}"),
+                vec![i as f32 + 1.0, 0.0, 0.0, 0.0],
+                "user".into(),
+                i as f64,
+                "s".into(),
+                "t".into(),
+            );
+        }
+        cache
+    }
+
+    fn roundtrip(cache: &MemoryCache) -> Result<MemoryCache, MemoryError> {
+        let bytes = build_hdf5_file(
+            &config(),
+            cache,
+            &SessionCache::new(),
+            &KnowledgeCache::new(),
+        )?;
+        let file =
+            clawhdf5::File::from_bytes(bytes).map_err(|e| MemoryError::Hdf5(e.to_string()))?;
+        validate_and_load(&file).map(|(_, cache, _, _)| cache)
+    }
+
+    #[test]
+    fn behavioural_config_survives_a_reopen() {
+        let mut cfg = config();
+        cfg.compression = true;
+        cfg.compression_level = 7;
+        cfg.compact_threshold = 0.5;
+        cfg.hebbian_boost = 0.25;
+        cfg.decay_factor = 0.9;
+        cfg.wal_enabled = false;
+        cfg.wal_max_entries = 42;
+        let bytes = build_hdf5_file(
+            &cfg,
+            &cache_with(2),
+            &SessionCache::new(),
+            &KnowledgeCache::new(),
+        )
+        .unwrap();
+        let file = clawhdf5::File::from_bytes(bytes).unwrap();
+        let (loaded, loaded_cache, ..) = validate_and_load(&file).unwrap();
+        // The compressed embeddings must also read back intact.
+        assert_eq!(loaded_cache.embeddings, cache_with(2).embeddings);
+        assert!(loaded.compression);
+        assert_eq!(loaded.compression_level, 7);
+        assert_eq!(loaded.compact_threshold, 0.5);
+        assert_eq!(loaded.hebbian_boost, 0.25);
+        assert_eq!(loaded.decay_factor, 0.9);
+        assert!(!loaded.wal_enabled);
+        assert_eq!(loaded.wal_max_entries, 42);
+    }
+
+    #[test]
+    fn consistent_store_loads() {
+        let loaded = roundtrip(&cache_with(3)).unwrap();
+        assert_eq!(loaded.chunks.len(), 3);
+        assert_eq!(loaded.norms, vec![1.0, 2.0, 3.0]);
+    }
+
+    #[test]
+    fn wrong_length_norms_are_recomputed_not_trusted() {
+        // Regression: the guard used to be `n.len() == n.len()`, so a norms
+        // dataset of any length was accepted and corrupted every cosine score.
+        let mut cache = cache_with(3);
+        cache.norms = vec![99.0];
+        let loaded = roundtrip(&cache).unwrap();
+        assert_eq!(loaded.norms, vec![1.0, 2.0, 3.0]);
+    }
+
+    #[test]
+    fn mismatched_per_record_datasets_are_schema_errors() {
+        type Corrupt = fn(&mut MemoryCache);
+        let cases: [(&str, Corrupt); 5] = [
+            ("tombstones", |c| c.tombstones.truncate(1)),
+            ("timestamps", |c| c.timestamps.truncate(1)),
+            ("tags", |c| c.tags.truncate(1)),
+            ("session_ids", |c| c.session_ids.truncate(1)),
+            ("source_channel", |c| c.source_channels.truncate(1)),
+        ];
+        for (name, corrupt) in cases {
+            let mut cache = cache_with(3);
+            corrupt(&mut cache);
+            match roundtrip(&cache) {
+                Err(MemoryError::Schema(msg)) => {
+                    assert!(msg.contains(name), "{name}: unexpected message {msg}")
+                }
+                other => panic!("{name}: expected Schema error, got {:?}", other.map(|_| ())),
+            }
+        }
+    }
+}

crates/clawhdf5-agent/src/search.rs

@@ -4,7 +4,7 @@ use std::path::Path;
 
 use crate::bm25;
 use crate::hybrid;
-use crate::{HDF5Memory, MemoryError, Result, SearchResult};
+use crate::{HDF5Memory, MAX_ACTIVATION_WEIGHT, MemoryError, Result, SearchResult};
 
 impl HDF5Memory {
     /// Vector + keyword scoring stage of [`HDF5Memory::hybrid_search`].
@@ -20,8 +20,7 @@ impl HDF5Memory {
         query_embedding: &[f32],
         query_text: &str,
         bm25: &bm25::BM25Index,
-        vector_weight: f32,
+        fusion: hybrid::Fusion,
-        keyword_weight: f32,
         k: usize,
     ) -> Vec<(usize, f32)> {
         self.ensure_hnsw_fresh();
@@ -29,30 +28,45 @@ impl HDF5Memory {
             Some(index) if !index.is_empty() && index.dimension() == query_embedding.len() => {
                 // Over-fetch so the merge sees a useful vector pool; cosine
                 // distance from the index converts back to similarity (1 - d).
+                // `ef` is configurable, but the pool the fusion stage sees is
+                // not tied to it: a caller lowering `ef` for speed should not
+                // silently narrow what fusion has to work with.
                 let pool = (k * 8).max(64);
-                let vec_scores: Vec<(usize, f32)> = index
+                let ef = self.hnsw_ef_search(k).max(pool);
-                    .search(query_embedding, pool, pool)
+                let candidates = index.search(query_embedding, pool, ef);
+                // A quantised index returns approximate distances, and no
+                // amount of `ef` fixes that — the loss is in the distances,
+                // not the graph. Re-score the pool against the cache's exact
+                // embeddings, which cost nothing extra to keep: recall then
+                // matches an f32 index. See `BENCHMARKS.md`.
+                let exact = index.storage() == clawhdf5_ann::Storage::Int8;
+                let vec_scores: Vec<(usize, f32)> = candidates
                     .into_iter()
-                    .map(|(id, dist)| (id, 1.0 - dist))
+                    .map(|(id, dist)| {
+                        let score = if exact {
+                            crate::vector_search::cosine_similarity(
+                                query_embedding,
+                                &self.cache.embeddings[id],
+                            )
+                        } else {
+                            1.0 - dist
+                        };
+                        (id, score)
+                    })
                     .collect();
-                let kw_scores = bm25.search(query_text, self.cache.len());
+                // Fusion normalises over every keyword match, so it needs all
-                hybrid::merge_vector_keyword(
+                // the scores — but not ranked.
-                    vec_scores,
+                let kw_scores = bm25.scores(query_text);
-                    kw_scores,
+                hybrid::fuse(vec_scores, kw_scores, fusion, k)
-                    vector_weight,
-                    keyword_weight,
-                    k,
-                )
             }
-            _ => hybrid::hybrid_search(
+            _ => hybrid::hybrid_search_fused(
                 query_embedding,
                 query_text,
                 &self.cache.embeddings,
                 &self.cache.chunks,
                 &self.cache.tombstones,
                 bm25,
-                vector_weight,
+                fusion,
-                keyword_weight,
                 k,
             ),
         }
@@ -64,19 +78,17 @@ impl HDF5Memory {
         query_embedding: &[f32],
         query_text: &str,
         bm25: &bm25::BM25Index,
-        vector_weight: f32,
+        fusion: hybrid::Fusion,
-        keyword_weight: f32,
         k: usize,
     ) -> Vec<(usize, f32)> {
-        hybrid::hybrid_search(
+        hybrid::hybrid_search_fused(
             query_embedding,
             query_text,
             &self.cache.embeddings,
             &self.cache.chunks,
             &self.cache.tombstones,
             bm25,
-            vector_weight,
+            fusion,
-            keyword_weight,
             k,
         )
     }
@@ -90,15 +102,35 @@ impl HDF5Memory {
         keyword_weight: f32,
         k: usize,
     ) -> Vec<SearchResult> {
-        let bm25 = bm25::BM25Index::build(&self.cache.chunks, &self.cache.tombstones);
+        self.hybrid_search_with(
-        let scored = self.vector_keyword_search(
             query_embedding,
             query_text,
-            &bm25,
+            hybrid::Fusion::Weighted {
-            vector_weight,
+                vector: vector_weight,
-            keyword_weight,
+                keyword: keyword_weight,
+            },
             k,
-        );
+        )
+    }
+
+    /// [`HDF5Memory::hybrid_search`] with the fusion method chosen explicitly.
+    ///
+    /// [`hybrid::DEFAULT_FUSION`] is what the weighted form defaults to;
+    /// [`hybrid::Fusion::Rrf`] combines the two stages by rank instead of by
+    /// score.
+    pub fn hybrid_search_with(
+        &mut self,
+        query_embedding: &[f32],
+        query_text: &str,
+        fusion: hybrid::Fusion,
+        k: usize,
+    ) -> Vec<SearchResult> {
+        // The keyword index lives for the life of the store and is updated
+        // incrementally. Take it out for the duration of the call so the
+        // vector stage can borrow `self` mutably, then put it back.
+        self.ensure_bm25_fresh();
+        let bm25 = self.bm25.take().expect("ensure_bm25_fresh leaves an index");
+        let scored = self.vector_keyword_search(query_embedding, query_text, &bm25, fusion, k);
         let mut results: Vec<SearchResult> = scored
             .into_iter()
             .map(|(idx, score)| {
@@ -113,23 +145,45 @@ impl HDF5Memory {
                 }
             })
             .collect();
+        // Ties broken by index so results (and therefore which records get
+        // boosted) don't depend on HashMap iteration order upstream.
         results.sort_by(|a, b| {
             b.score
                 .partial_cmp(&a.score)
                 .unwrap_or(std::cmp::Ordering::Equal)
+                .then(a.index.cmp(&b.index))
         });
 
-        let hit_indices: Vec<usize> = results.iter().map(|r| r.index).collect();
+        // Only reinforce records that actually matched. When fewer than `k`
+        // records are relevant, the rest of the list is zero-score filler;
+        // boosting it would teach the store that arbitrary records are
+        // important just because they were nearby in iteration order.
+        let hit_indices: Vec<usize> = results
+            .iter()
+            .filter(|r| r.score > 0.0)
+            .map(|r| r.index)
+            .collect();
         self.apply_hebbian_boost(&hit_indices);
-        self.flush().ok();
+        self.bm25 = Some(bm25);
 
         results
     }
 
+    /// Reinforce the records a query returned. The new weights are persisted by
+    /// the next checkpoint (any write that flushes, `flush_wal`, or drop) — not
+    /// by rewriting the whole store inside the query, which is what made
+    /// `hybrid_search` cost O(store size) in disk I/O. They are a ranking hint,
+    /// not user data: a crash before the next checkpoint only forgets the
+    /// boosts since the last one.
     fn apply_hebbian_boost(&mut self, hit_indices: &[usize]) {
-        for &idx in hit_indices {
+        if hit_indices.is_empty() || self.config.hebbian_boost == 0.0 {
-            self.cache.activation_weights[idx] += self.config.hebbian_boost;
+            return;
         }
+        for &idx in hit_indices {
+            let w = &mut self.cache.activation_weights[idx];
+            *w = (*w + self.config.hebbian_boost).min(MAX_ACTIVATION_WEIGHT);
+        }
+        self.activations_dirty = true;
     }
 
     /// Get the chunk text for a memory entry by index.

crates/clawhdf5-agent/src/storage.rs

@@ -11,6 +11,7 @@ use crate::cache::MemoryCache;
 use crate::knowledge::KnowledgeCache;
 use crate::schema;
 use crate::session::SessionCache;
+use crate::wal::WalMark;
 
 /// Write all in-memory state to an HDF5 file on disk.
 pub fn write_to_disk(
@@ -20,7 +21,36 @@ pub fn write_to_disk(
     sessions: &SessionCache,
     knowledge: &KnowledgeCache,
 ) -> Result<(), MemoryError> {
-    let bytes = schema::build_hdf5_file(config, cache, sessions, knowledge)?;
+    write_to_disk_with_mark(path, config, cache, sessions, knowledge, None)
+}
+
+/// [`write_to_disk`] for a checkpoint: `wal_applied` is the mark of the WAL
+/// prefix whose entries `cache` already contains.
+pub fn write_to_disk_with_mark(
+    path: &Path,
+    config: &MemoryConfig,
+    cache: &MemoryCache,
+    sessions: &SessionCache,
+    knowledge: &KnowledgeCache,
+    wal_applied: Option<WalMark>,
+) -> Result<(), MemoryError> {
+    let meta = schema::CheckpointMeta {
+        wal_applied,
+        ann_generation: None,
+    };
+    write_to_disk_with_meta(path, config, cache, sessions, knowledge, &meta)
+}
+
+/// [`write_to_disk`] with full checkpoint bookkeeping.
+pub fn write_to_disk_with_meta(
+    path: &Path,
+    config: &MemoryConfig,
+    cache: &MemoryCache,
+    sessions: &SessionCache,
+    knowledge: &KnowledgeCache,
+    checkpoint: &schema::CheckpointMeta,
+) -> Result<(), MemoryError> {
+    let bytes = schema::build_hdf5_file_with_meta(config, cache, sessions, knowledge, checkpoint)?;
 
     if bytes.is_empty() {
         return Err(MemoryError::Hdf5("build_hdf5_file produced 0 bytes".into()));
@@ -28,9 +58,41 @@ pub fn write_to_disk(
 
     // Write to a temp file first, then rename for atomicity
     let tmp_path = path.with_extension("h5.tmp");
-    std::fs::write(&tmp_path, &bytes).map_err(MemoryError::Io)?;
+    write_synced(&tmp_path, &bytes)?;
-    std::fs::rename(&tmp_path, path).map_err(MemoryError::Io)?;
+    rename_synced(&tmp_path, path)
+}
 
+/// Write `bytes` to `path` and flush them to stable storage.
+pub(crate) fn write_synced(path: &Path, bytes: &[u8]) -> Result<(), MemoryError> {
+    use std::io::Write;
+    let mut f = std::fs::File::create(path).map_err(MemoryError::Io)?;
+    f.write_all(bytes).map_err(MemoryError::Io)?;
+    f.sync_all().map_err(MemoryError::Io)
+}
+
+/// Rename `from` over `to`, then sync the parent directory so the rename
+/// itself survives a power loss. `from` must already be synced: without that,
+/// the rename can reach disk before the data and leave an empty or partial
+/// file under the final name.
+///
+/// This is per-checkpoint/snapshot cost only (each is already a full file
+/// write). Individual WAL appends are deliberately not synced — see the
+/// durability notes in the crate docs.
+pub(crate) fn rename_synced(from: &Path, to: &Path) -> Result<(), MemoryError> {
+    std::fs::rename(from, to).map_err(MemoryError::Io)?;
+    #[cfg(unix)]
+    if let Some(dir) = to.parent() {
+        let dir = if dir.as_os_str().is_empty() {
+            Path::new(".")
+        } else {
+            dir
+        };
+        // Directory fsync is best-effort: some filesystems refuse it, and the
+        // rename has already happened.
+        if let Ok(d) = std::fs::File::open(dir) {
+            let _ = d.sync_all();
+        }
+    }
     Ok(())
 }
 
@@ -42,19 +104,39 @@ pub fn write_to_disk(
 pub fn read_from_disk(
     path: &Path,
 ) -> Result<(MemoryConfig, MemoryCache, SessionCache, KnowledgeCache), MemoryError> {
-    let mmap = clawhdf5_io::MmapReader::open(path).map_err(MemoryError::Io)?;
+    read_from_disk_with_mark(path).map(|(state, _mark)| state)
+}
 
-    // Advise the OS we'll need the whole file for parsing
+/// Everything [`read_from_disk`] returns.
-    mmap.advise_willneed(0, mmap.len());
+pub type StoreState = (MemoryConfig, MemoryCache, SessionCache, KnowledgeCache);
 
-    // Parse the HDF5 file from the mmap'd bytes
+/// [`read_from_disk`], plus the checkpoint's [`WalMark`] (if any) so the
-    let file = clawhdf5::File::from_bytes(mmap.as_bytes().to_vec())
+/// caller can skip WAL entries this file already contains.
+pub fn read_from_disk_with_mark(path: &Path) -> Result<(StoreState, Option<WalMark>), MemoryError> {
+    // `File::open` memory-maps the file itself (the facade's `mmap` feature is
+    // on by default). Mapping it here and handing over `as_bytes().to_vec()`
+    // did the same work and then copied the whole store — a second full copy
+    // of the file, live for the whole parse, on top of the mapping.
+    let file = clawhdf5::File::open(path)
         .map_err(|e| MemoryError::Hdf5(format!("cannot open {}: {e}", path.display())))?;
 
     let (mut config, cache, sessions, knowledge) = schema::validate_and_load(&file)?;
     config.path = path.to_path_buf();
+    let wal_applied = schema::read_wal_mark(&file);
 
-    Ok((config, cache, sessions, knowledge))
+    Ok(((config, cache, sessions, knowledge), wal_applied))
+}
+
+/// [`read_from_disk`], plus all checkpoint bookkeeping.
+pub fn read_from_disk_with_meta(
+    path: &Path,
+) -> Result<(StoreState, schema::CheckpointMeta), MemoryError> {
+    let file = clawhdf5::File::open(path)
+        .map_err(|e| MemoryError::Hdf5(format!("cannot open {}: {e}", path.display())))?;
+    let (mut config, cache, sessions, knowledge) = schema::validate_and_load(&file)?;
+    config.path = path.to_path_buf();
+    let meta = schema::read_checkpoint_meta(&file);
+    Ok(((config, cache, sessions, knowledge), meta))
 }
 
 /// Copy an HDF5 file atomically to a destination.
@@ -78,7 +160,10 @@ pub fn snapshot_file(src: &Path, dest: &Path) -> Result<std::path::PathBuf, Memo
     // Atomic copy: write to temp, then rename
     let tmp_path = dest_file.with_extension("h5.tmp");
     std::fs::copy(src, &tmp_path).map_err(MemoryError::Io)?;
-    std::fs::rename(&tmp_path, &dest_file).map_err(MemoryError::Io)?;
+    std::fs::File::open(&tmp_path)
+        .and_then(|f| f.sync_all())
+        .map_err(MemoryError::Io)?;
+    rename_synced(&tmp_path, &dest_file)?;
 
     Ok(dest_file)
 }

crates/clawhdf5-agent/src/store_lock.rs

@@ -0,0 +1,79 @@
+//! Single-writer guard for a memory store.
+//!
+//! `HDF5Memory` keeps the whole store in memory and rewrites the `.h5` file at
+//! every checkpoint, so two handles on one store (two processes, or two opens
+//! in one process) silently destroy each other's data: whoever checkpoints
+//! last wins, and both append to the same WAL with independent CRC chains.
+//! The lock turns that into an immediate, explicit error.
+
+use std::fs::{File, OpenOptions, TryLockError};
+use std::path::{Path, PathBuf};
+
+use crate::MemoryError;
+
+const LOCK_RETRIES: u32 = 25;
+const LOCK_RETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(10);
+
+/// An exclusive advisory lock on `<store>.h5.lock`, held for the lifetime of
+/// the owning `HDF5Memory` and released when it is dropped (or when the
+/// process dies — the OS drops the lock with the file descriptor, so a crash
+/// never leaves a stale lock behind; the empty lock file itself is harmless).
+#[derive(Debug)]
+pub(crate) struct StoreLock {
+    _file: File,
+}
+
+impl StoreLock {
+    pub(crate) fn lock_path(store: &Path) -> PathBuf {
+        store.with_extension("h5.lock")
+    }
+
+    pub(crate) fn acquire(store: &Path) -> Result<Self, MemoryError> {
+        let path = Self::lock_path(store);
+        let file = OpenOptions::new()
+            .create(true)
+            .truncate(false)
+            .write(true)
+            .open(&path)?;
+        // A previous owner may be mid-teardown (e.g. an `AsyncHDF5Memory`
+        // dropped without `shutdown()`: its background task releases the
+        // store a moment later), so give the lock a short, bounded grace
+        // period before reporting a genuine second writer.
+        let mut attempts_left = LOCK_RETRIES;
+        loop {
+            match file.try_lock() {
+                Ok(()) => return Ok(Self { _file: file }),
+                Err(TryLockError::WouldBlock) if attempts_left > 0 => {
+                    attempts_left -= 1;
+                    std::thread::sleep(LOCK_RETRY_DELAY);
+                }
+                Err(TryLockError::WouldBlock) => {
+                    return Err(MemoryError::Locked(format!(
+                        "{} is already open in this or another process (lock file {})",
+                        store.display(),
+                        path.display()
+                    )));
+                }
+                Err(TryLockError::Error(e)) => return Err(MemoryError::Io(e)),
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn second_acquire_fails_until_first_is_dropped() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let store = dir.path().join("s.h5");
+        let first = StoreLock::acquire(&store).unwrap();
+        assert!(matches!(
+            StoreLock::acquire(&store),
+            Err(MemoryError::Locked(_))
+        ));
+        drop(first);
+        StoreLock::acquire(&store).unwrap();
+    }
+}

crates/clawhdf5-agent/src/strategy.rs

@@ -167,10 +167,17 @@ pub fn auto_select_strategy(num_vectors: usize, hw: &HardwareCapabilities) -> Se
 /// This dispatches to the appropriate search implementation based on the
 /// selected strategy. For IVF-PQ, an index must be provided externally
 /// (this function uses brute-force fallback if no IVF-PQ index is available).
+///
+/// `vectors_flat` is `vectors` flattened into one contiguous `[N × dim]`
+/// row-major buffer (e.g. `MemoryCache::embeddings_flat`, maintained
+/// incrementally alongside `vectors`). It's only consulted by the
+/// `Blas`/`Accelerate` strategies, which otherwise re-flatten the whole
+/// corpus on every call — passing the already-flat buffer skips that copy.
 #[allow(clippy::too_many_arguments)]
 pub fn search_with_metrics(
     query: &[f32],
     vectors: &[Vec<f32>],
+    vectors_flat: &[f32],
     norms: &[f32],
     tombstones: &[u8],
     k: usize,
@@ -178,6 +185,10 @@ pub fn search_with_metrics(
     #[cfg(feature = "gpu")] gpu_backend: Option<&crate::gpu_search::GpuSearchBackend>,
     #[cfg(not(feature = "gpu"))] _gpu_backend: Option<&()>,
 ) -> (Vec<(usize, f32)>, SearchMetrics) {
+    // Only read by the Blas/Accelerate arms below, which are themselves
+    // feature-gated — reference it unconditionally so a build with neither
+    // feature enabled doesn't warn about an unused parameter.
+    let _ = vectors_flat;
     let start = Instant::now();
     let active_count = tombstones.iter().filter(|&&t| t == 0).count();
 
@@ -197,7 +208,14 @@ pub fn search_with_metrics(
             gpu_active = false;
             #[cfg(feature = "fast-math")]
             {
-                crate::blas_search::blas_cosine_batch(query, vectors, norms, tombstones, k)
+                crate::blas_search::blas_cosine_batch_flat(
+                    query,
+                    vectors_flat,
+                    norms,
+                    tombstones,
+                    query.len(),
+                    k,
+                )
             }
             #[cfg(not(feature = "fast-math"))]
             {
@@ -211,8 +229,13 @@ pub fn search_with_metrics(
             gpu_active = false;
             #[cfg(any(feature = "accelerate", feature = "openblas"))]
             {
-                crate::accelerate_search::accelerate_cosine_batch_vecs(
+                crate::accelerate_search::accelerate_cosine_batch(
-                    query, vectors, norms, tombstones, k,
+                    query,
+                    vectors_flat,
+                    norms,
+                    tombstones,
+                    query.len(),
+                    k,
                 )
             }
             #[cfg(not(any(feature = "accelerate", feature = "openblas")))]
@@ -325,6 +348,10 @@ mod tests {
         (0..n).map(|_| (0..dim).map(|_| next()).collect()).collect()
     }
 
+    fn flatten(vectors: &[Vec<f32>]) -> Vec<f32> {
+        vectors.iter().flatten().copied().collect()
+    }
+
     // --- auto_select_strategy tests ---
 
     #[test]
@@ -490,6 +517,7 @@ mod tests {
         let (results, metrics) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             5,
@@ -520,6 +548,7 @@ mod tests {
         let (results, metrics) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             10,
@@ -545,6 +574,7 @@ mod tests {
         let (_, metrics) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             10,
@@ -570,6 +600,7 @@ mod tests {
         let (results, _) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             10,
@@ -603,6 +634,7 @@ mod tests {
         let (results, metrics) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             100,
@@ -647,6 +679,7 @@ mod tests {
         let (_, metrics) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             5,
@@ -718,6 +751,7 @@ mod tests {
         let (results, metrics) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             10,
@@ -744,6 +778,7 @@ mod tests {
         let (results, metrics) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             10,
@@ -822,6 +857,7 @@ mod tests {
         let (results, metrics) = search_with_metrics(
             &query,
             &vectors,
+            &flatten(&vectors),
             &norms,
             &tombstones,
             10,

crates/clawhdf5-agent/src/vector_search.rs

@@ -4,6 +4,44 @@
 //! `clawhdf5_accel`, with optional float16 support via the `half` crate.
 //! Supports pre-computed norms for eliminating redundant norm computations.
 
+/// A corpus of equal-length embeddings addressable by index.
+///
+/// Lets the batch kernels read either the cache's flat `[N x dim]` buffer or a
+/// plain `Vec<Vec<f32>>` without either side owning a second copy.
+pub trait VectorSet {
+    /// Number of embeddings.
+    fn count(&self) -> usize;
+    /// Embedding `i`; callers only index below [`VectorSet::count`].
+    fn row(&self, i: usize) -> &[f32];
+}
+
+impl VectorSet for [Vec<f32>] {
+    fn count(&self) -> usize {
+        self.len()
+    }
+    fn row(&self, i: usize) -> &[f32] {
+        &self[i]
+    }
+}
+
+impl VectorSet for Vec<Vec<f32>> {
+    fn count(&self) -> usize {
+        self.len()
+    }
+    fn row(&self, i: usize) -> &[f32] {
+        &self[i]
+    }
+}
+
+impl VectorSet for crate::cache::Embeddings {
+    fn count(&self) -> usize {
+        self.len()
+    }
+    fn row(&self, i: usize) -> &[f32] {
+        &self[i]
+    }
+}
+
 /// Compute cosine similarity between two f32 slices.
 ///
 /// Returns 0.0 if either vector has zero magnitude.
@@ -22,7 +60,7 @@ pub fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 {
 /// Returns `(index, score)` pairs sorted by score descending.
 pub fn cosine_similarity_batch(
     query: &[f32],
-    vectors: &[Vec<f32>],
+    vectors: &(impl VectorSet + ?Sized),
     tombstones: &[u8],
 ) -> Vec<(usize, f32)> {
     let query_norm = clawhdf5_accel::vector_norm(query);
@@ -30,7 +68,7 @@ pub fn cosine_similarity_batch(
         return Vec::new();
     }
 
-    let n = vectors.len();
+    let n = vectors.count();
     let mut results: Vec<(usize, f32)> = Vec::with_capacity(n);
 
     // Process 4 vectors at a time where possible
@@ -42,8 +80,9 @@ pub fn cosine_similarity_batch(
             if i < tombstones.len() && tombstones[i] != 0 {
                 continue;
             }
-            let vec_norm = clawhdf5_accel::vector_norm(&vectors[i]);
+            let vec_norm = clawhdf5_accel::vector_norm(vectors.row(i));
-            let score = crate::cosine_similarity_prenorm(query, query_norm, &vectors[i], vec_norm);
+            let score =
+                crate::cosine_similarity_prenorm(query, query_norm, vectors.row(i), vec_norm);
             results.push((i, score));
         }
     }
@@ -53,8 +92,8 @@ pub fn cosine_similarity_batch(
         if i < tombstones.len() && tombstones[i] != 0 {
             continue;
         }
-        let vec_norm = clawhdf5_accel::vector_norm(&vectors[i]);
+        let vec_norm = clawhdf5_accel::vector_norm(vectors.row(i));
-        let score = crate::cosine_similarity_prenorm(query, query_norm, &vectors[i], vec_norm);
+        let score = crate::cosine_similarity_prenorm(query, query_norm, vectors.row(i), vec_norm);
         results.push((i, score));
     }
 
@@ -68,7 +107,7 @@ pub fn cosine_similarity_batch(
 /// collections. Uses `score = dot(query, vec) / (query_norm * stored_norm)`.
 pub fn cosine_similarity_batch_prenorm(
     query: &[f32],
-    vectors: &[Vec<f32>],
+    vectors: &(impl VectorSet + ?Sized),
     norms: &[f32],
     tombstones: &[u8],
 ) -> Vec<(usize, f32)> {
@@ -77,7 +116,7 @@ pub fn cosine_similarity_batch_prenorm(
         return Vec::new();
     }
 
-    let n = vectors.len();
+    let n = vectors.count();
     let mut results: Vec<(usize, f32)> = Vec::with_capacity(n);
 
     for i in 0..n {
@@ -85,7 +124,7 @@ pub fn cosine_similarity_batch_prenorm(
             continue;
         }
         let vec_norm = norms[i];
-        let score = crate::cosine_similarity_prenorm(query, query_norm, &vectors[i], vec_norm);
+        let score = crate::cosine_similarity_prenorm(query, query_norm, vectors.row(i), vec_norm);
         results.push((i, score));
     }
 
@@ -162,7 +201,7 @@ pub fn cosine_similarity_f16(
 #[cfg(feature = "parallel")]
 pub fn parallel_cosine_batch(
     query: &[f32],
-    vectors: &[Vec<f32>],
+    vectors: &(impl VectorSet + Sync + ?Sized),
     tombstones: &[u8],
     k: usize,
 ) -> Vec<(usize, f32)> {
@@ -174,24 +213,27 @@ pub fn parallel_cosine_batch(
     }
 
     let num_cores = rayon::current_num_threads().max(1);
-    let chunk_size = vectors.len().div_ceil(num_cores);
+    let chunk_size = vectors.count().div_ceil(num_cores);
     if chunk_size == 0 {
         return Vec::new();
     }
 
-    let mut all_results: Vec<(usize, f32)> = vectors
+    // Chunk over index ranges: the corpus may be one flat buffer rather than
-        .par_chunks(chunk_size)
+    // a slice of rows, so there is nothing to `par_chunks` over.
-        .enumerate()
+    let n = vectors.count();
-        .flat_map(|(chunk_idx, chunk)| {
+    let mut all_results: Vec<(usize, f32)> = (0..n.div_ceil(chunk_size))
+        .into_par_iter()
+        .flat_map(|chunk_idx| {
             let base = chunk_idx * chunk_size;
-            let mut local: Vec<(usize, f32)> = Vec::with_capacity(chunk.len());
+            let end = (base + chunk_size).min(n);
-            for (j, vec) in chunk.iter().enumerate() {
+            let mut local: Vec<(usize, f32)> = Vec::with_capacity(end - base);
-                let i = base + j;
+            for i in base..end {
                 if i < tombstones.len() && tombstones[i] != 0 {
                     continue;
                 }
-                let vec_norm = clawhdf5_accel::vector_norm(vec);
+                let vec_norm = clawhdf5_accel::vector_norm(vectors.row(i));
-                let score = crate::cosine_similarity_prenorm(query, query_norm, vec, vec_norm);
+                let score =
+                    crate::cosine_similarity_prenorm(query, query_norm, vectors.row(i), vec_norm);
                 local.push((i, score));
             }
             local.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
@@ -209,7 +251,7 @@ pub fn parallel_cosine_batch(
 #[cfg(feature = "parallel")]
 pub fn parallel_cosine_batch_prenorm(
     query: &[f32],
-    vectors: &[Vec<f32>],
+    vectors: &(impl VectorSet + Sync + ?Sized),
     norms: &[f32],
     tombstones: &[u8],
     k: usize,
@@ -222,23 +264,26 @@ pub fn parallel_cosine_batch_prenorm(
     }
 
     let num_cores = rayon::current_num_threads().max(1);
-    let chunk_size = vectors.len().div_ceil(num_cores);
+    let chunk_size = vectors.count().div_ceil(num_cores);
     if chunk_size == 0 {
         return Vec::new();
     }
 
-    let mut all_results: Vec<(usize, f32)> = vectors
+    // Chunk over index ranges: the corpus may be one flat buffer rather than
-        .par_chunks(chunk_size)
+    // a slice of rows, so there is nothing to `par_chunks` over.
-        .enumerate()
+    let n = vectors.count();
-        .flat_map(|(chunk_idx, chunk)| {
+    let mut all_results: Vec<(usize, f32)> = (0..n.div_ceil(chunk_size))
+        .into_par_iter()
+        .flat_map(|chunk_idx| {
             let base = chunk_idx * chunk_size;
-            let mut local: Vec<(usize, f32)> = Vec::with_capacity(chunk.len());
+            let end = (base + chunk_size).min(n);
-            for (j, vec) in chunk.iter().enumerate() {
+            let mut local: Vec<(usize, f32)> = Vec::with_capacity(end - base);
-                let i = base + j;
+            for i in base..end {
                 if i < tombstones.len() && tombstones[i] != 0 {
                     continue;
                 }
-                let score = crate::cosine_similarity_prenorm(query, query_norm, vec, norms[i]);
+                let score =
+                    crate::cosine_similarity_prenorm(query, query_norm, vectors.row(i), norms[i]);
                 local.push((i, score));
             }
             local.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));

crates/clawhdf5-agent/tests/crash_recovery.rs

@@ -0,0 +1,187 @@
+//! Crash-recovery matrix for `HDF5Memory`.
+//!
+//! A process crash leaves whatever reached the OS on disk. These tests build
+//! the on-disk images such a crash can leave behind — after every operation,
+//! inside the checkpoint window (new `.h5` in place, WAL not yet truncated),
+//! and with the WAL torn at every possible length — then reopen each image
+//! and check the recovered store against a model of what was acknowledged.
+//!
+//! Invariants:
+//! * never a duplicated or invented record;
+//! * an image taken between operations recovers *exactly* the acknowledged
+//!   state;
+//! * a torn WAL recovers the last checkpoint plus a prefix of the operations
+//!   logged since.
+
+use std::path::{Path, PathBuf};
+
+use clawhdf5_agent::{AgentMemory, HDF5Memory, MemoryConfig, MemoryEntry};
+use tempfile::TempDir;
+
+struct Rng(u64);
+
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 = self.0.wrapping_add(0x9E37_79B9_7F4A_7C15);
+        let mut z = self.0;
+        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+fn entry(chunk: &str, tags: &str) -> MemoryEntry {
+    MemoryEntry {
+        chunk: chunk.to_string(),
+        embedding: vec![1.0, 0.0, 0.0, 0.0],
+        source_channel: "test".into(),
+        timestamp: 1.0,
+        session_id: "s".into(),
+        tags: tags.to_string(),
+    }
+}
+
+fn wal_path(h5: &Path) -> PathBuf {
+    h5.with_extension("h5.wal")
+}
+
+/// Copy the store (`.h5` + WAL) into a fresh directory, as a crash image.
+fn image(h5: &Path, into: &TempDir, name: &str) -> PathBuf {
+    let dest = into.path().join(format!("{name}.h5"));
+    std::fs::copy(h5, &dest).unwrap();
+    if wal_path(h5).exists() {
+        std::fs::copy(wal_path(h5), wal_path(&dest)).unwrap();
+    }
+    dest
+}
+
+fn recovered(h5: &Path) -> Vec<String> {
+    // Read-only: the image must not be modified, and no lock is needed.
+    HDF5Memory::open_read_only(h5).unwrap().cache.chunks.clone()
+}
+
+/// Apply one random operation to the store and to the model.
+fn step(mem: &mut HDF5Memory, model: &mut Vec<String>, rng: &mut Rng, n: usize) {
+    match rng.below(6) {
+        0 => mem.flush_wal().unwrap(),
+        1 if !model.is_empty() => {
+            // Update an existing record in place, addressed by its tag.
+            let idx = rng.below(model.len());
+            let chunk = format!("u{n}");
+            assert_eq!(
+                mem.save_or_update(entry(&chunk, &format!("tag{idx}")))
+                    .unwrap(),
+                idx
+            );
+            model[idx] = chunk;
+        }
+        _ => {
+            let chunk = format!("c{n}");
+            mem.save(entry(&chunk, &format!("tag{}", model.len())))
+                .unwrap();
+            model.push(chunk);
+        }
+    }
+}
+
+#[test]
+fn image_after_every_operation_recovers_the_acknowledged_state() {
+    for seed in 0..40u64 {
+        let mut rng = Rng(seed);
+        let dir = TempDir::new().unwrap();
+        let images = TempDir::new().unwrap();
+        let mut config = MemoryConfig::new(dir.path().join("store.h5"), "agent", 4);
+        config.wal_enabled = true;
+        config.wal_max_entries = 1 + rng.below(6); // force frequent checkpoints
+        let h5 = config.path.clone();
+        let mut mem = HDF5Memory::create(config).unwrap();
+        let mut model = Vec::new();
+
+        for n in 0..30 {
+            step(&mut mem, &mut model, &mut rng, n);
+            let img = image(&h5, &images, &format!("s{seed}-{n}"));
+            assert_eq!(recovered(&img), model, "seed {seed}, after op {n}");
+        }
+    }
+}
+
+#[test]
+fn crash_inside_the_checkpoint_window_never_duplicates() {
+    for seed in 0..40u64 {
+        let mut rng = Rng(seed ^ 0xABCD);
+        let dir = TempDir::new().unwrap();
+        let images = TempDir::new().unwrap();
+        let mut config = MemoryConfig::new(dir.path().join("store.h5"), "agent", 4);
+        config.wal_enabled = true;
+        config.wal_max_entries = 1000; // checkpoints only when we ask
+        let h5 = config.path.clone();
+        let mut mem = HDF5Memory::create(config).unwrap();
+        let mut model = Vec::new();
+
+        for round in 0..4 {
+            for n in 0..(1 + rng.below(6)) {
+                step(&mut mem, &mut model, &mut rng, round * 100 + n);
+            }
+            // The WAL as it is just before the checkpoint...
+            let stale_wal = images.path().join(format!("stale-{seed}-{round}.wal"));
+            if wal_path(&h5).exists() {
+                std::fs::copy(wal_path(&h5), &stale_wal).unwrap();
+            }
+            mem.flush_wal().unwrap();
+            // ...put back next to the NEW .h5: the crash-in-the-window image.
+            let img = image(&h5, &images, &format!("w{seed}-{round}"));
+            if stale_wal.exists() {
+                std::fs::copy(&stale_wal, wal_path(&img)).unwrap();
+            }
+            assert_eq!(recovered(&img), model, "seed {seed}, round {round}");
+        }
+    }
+}
+
+#[test]
+fn torn_wal_recovers_checkpoint_plus_a_prefix() {
+    let dir = TempDir::new().unwrap();
+    let images = TempDir::new().unwrap();
+    let mut config = MemoryConfig::new(dir.path().join("store.h5"), "agent", 4);
+    config.wal_enabled = true;
+    config.wal_max_entries = 1000;
+    let h5 = config.path.clone();
+    let mut mem = HDF5Memory::create(config).unwrap();
+
+    for name in ["a", "b"] {
+        mem.save(entry(name, name)).unwrap();
+    }
+    mem.flush_wal().unwrap();
+    let checkpointed = vec!["a".to_string(), "b".to_string()];
+
+    // States the store passes through as each later op is logged.
+    let mut states = vec![checkpointed.clone()];
+    let mut model = checkpointed.clone();
+    mem.save(entry("c", "c")).unwrap();
+    model.push("c".into());
+    states.push(model.clone());
+    mem.save_or_update(entry("a2", "a")).unwrap();
+    model[0] = "a2".into();
+    states.push(model.clone());
+    mem.save(entry("d", "d")).unwrap();
+    model.push("d".into());
+    states.push(model.clone());
+
+    let full_wal = std::fs::read(wal_path(&h5)).unwrap();
+    let mut seen = std::collections::BTreeSet::new();
+    for len in 0..=full_wal.len() {
+        let img = image(&h5, &images, &format!("t{len}"));
+        std::fs::write(wal_path(&img), &full_wal[..len]).unwrap();
+        let got = recovered(&img);
+        let which = states
+            .iter()
+            .position(|s| *s == got)
+            .unwrap_or_else(|| panic!("WAL torn at {len} bytes recovered {got:?}"));
+        seen.insert(which);
+    }
+    // Every intermediate state is reachable, and the full WAL gives the last.
+    assert_eq!(seen.into_iter().collect::<Vec<_>>(), [0, 1, 2, 3]);
+}

crates/clawhdf5-agent/tests/e2e_tests.rs

@@ -196,7 +196,7 @@ fn test_migration_round_trip() {
     mem.add_relation(e1, e2, "discusses", 0.8).unwrap();
 
     // Verify all data transferred by reopening
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.count(), 500);
 
     // Verify sessions
@@ -266,7 +266,7 @@ fn test_knowledge_graph_workflow() {
     assert_eq!(entity.entity_type, "library");
 
     // Persistence
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.knowledge().entities.len(), 4);
     assert_eq!(reopened.knowledge().relations.len(), 4);
 
@@ -316,7 +316,7 @@ fn test_multi_session_workflow() {
     assert_eq!(mem.count(), 100); // 5 sessions * 20 entries
 
     // Reopen and verify sessions
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     for sess in 0..5 {
         let summary = reopened
             .get_session_summary(&format!("sess_{sess}"))
@@ -460,7 +460,7 @@ fn test_snapshot_and_continue() {
     assert_eq!(snap_mem.count(), 50);
 
     // Original should have 100
-    let orig_mem = HDF5Memory::open(&path).unwrap();
+    let orig_mem = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(orig_mem.count(), 100);
 }
 
@@ -483,7 +483,7 @@ fn test_config_persistence_across_ops() {
     mem.add_session("s1", 0, 0, "ch", "summary").unwrap();
     mem.add_entity("Entity", "type", -1).unwrap();
 
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.config().embedding_dim, 128);
     assert_eq!(reopened.config().embedder, "custom:my-embedder-v2");
     assert_eq!(reopened.config().chunk_size, 2048);
@@ -695,7 +695,7 @@ fn test_large_text_chunks() {
     mem.save_batch(entries).unwrap();
 
     // Reopen and verify
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.count(), 10);
 
     let (_, cache, _, _) = read_cache(&path);
@@ -752,7 +752,7 @@ fn test_interleaved_sessions_entries() {
     mem.flush_wal().unwrap();
 
     // Verify
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.count(), 6);
     assert_eq!(
         reopened.get_session_summary("s1").unwrap().as_deref(),
@@ -806,7 +806,7 @@ fn test_knowledge_graph_with_embeddings() {
     mem.add_relation(e_python, e_hdf5, "reads", 0.9).unwrap();
 
     // Verify entity-embedding linkage persists
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     let rust_entity = reopened.knowledge().get_entity(e_rust).unwrap();
     assert_eq!(rust_entity.embedding_idx, idx0 as i64);
 
@@ -1048,7 +1048,7 @@ fn test_gpu_l2_fallback_works() {
     let tombstones = vec![0u8; 3];
 
     let gpu = clawhdf5_agent::gpu_search::GpuSearchBackend::try_init(&vectors, &norms, 2, 1);
-    let results = gpu.search_l2(&vec![0.0, 0.0], &vectors, &tombstones, 3);
+    let results = gpu.search_l2(&[0.0, 0.0], &vectors, &tombstones, 3);
 
     assert_eq!(results.len(), 3);
     assert_eq!(results[0].0, 0);
@@ -1099,7 +1099,7 @@ fn test_mmap_reader_direct_access() {
 
     // Open via MmapReader directly
     let mmap = clawhdf5_io::MmapReader::open(&path).unwrap();
-    assert!(mmap.len() > 0);
+    assert!(!mmap.is_empty());
     // Verify we can read bytes at specific offsets
     let bytes = mmap.read_at(0, 8);
     assert!(bytes.is_some());
@@ -1144,9 +1144,11 @@ fn test_strategy_reports_backend() {
     let tombstones = vec![0u8; n];
     let query = vectors[0].clone();
 
+    let flat: Vec<f32> = vectors.iter().flatten().copied().collect();
     let (_, metrics) = strategy::search_with_metrics(
         &query,
         &vectors,
+        &flat,
         &norms,
         &tombstones,
         5,

crates/clawhdf5-agent/tests/hnsw_integration.rs

@@ -165,3 +165,122 @@ fn save_batch_then_search_is_consistent() {
         );
     }
 }
+
+#[test]
+fn quantized_index_matches_the_f32_index_after_re_scoring() {
+    // A quantised index holds approximate vectors, but the store still has the
+    // exact ones, so the query path re-scores the candidate pool before
+    // fusion. The results a caller sees should therefore be the same.
+    let dim = 64;
+    let n = 400;
+    let mut seed = 0x5EED_1234_5678_9ABC;
+    let vectors: Vec<Vec<f32>> = (0..n).map(|_| make_vector(&mut seed, dim)).collect();
+    let queries: Vec<Vec<f32>> = (0..20).map(|_| make_vector(&mut seed, dim)).collect();
+
+    let build = |dir: &TempDir, quantized: bool| {
+        let mut config = MemoryConfig::new(dir.path().join("mem.h5"), "agent", dim);
+        config.quantized_index = quantized;
+        let mut mem = HDF5Memory::create(config).unwrap();
+        for (i, v) in vectors.iter().enumerate() {
+            mem.save(entry(&format!("chunk {i}"), v.clone(), &format!("k{i}")))
+                .unwrap();
+        }
+        mem
+    };
+
+    let exact_dir = TempDir::new().unwrap();
+    let quant_dir = TempDir::new().unwrap();
+    let mut exact = build(&exact_dir, false);
+    let mut quantized = build(&quant_dir, true);
+
+    let k = 10;
+    let mut agree = 0;
+    for q in &queries {
+        let want: Vec<usize> = exact
+            .hybrid_search(q, "", 1.0, 0.0, k)
+            .iter()
+            .map(|r| r.index)
+            .collect();
+        agree += quantized
+            .hybrid_search(q, "", 1.0, 0.0, k)
+            .iter()
+            .filter(|r| want.contains(&r.index))
+            .count();
+    }
+    let overlap = agree as f64 / (k * queries.len()) as f64;
+    assert!(
+        overlap >= 0.95,
+        "quantised store should match the f32 one: {overlap}"
+    );
+}
+
+#[test]
+fn quantized_index_setting_survives_a_reopen() {
+    let dir = TempDir::new().unwrap();
+    let path = dir.path().join("mem.h5");
+    let mut config = MemoryConfig::new(path.clone(), "agent", 8);
+    config.quantized_index = true;
+    let mut mem = HDF5Memory::create(config).unwrap();
+    let mut seed = 7;
+    for i in 0..30 {
+        mem.save(entry(&format!("c{i}"), make_vector(&mut seed, 8), "t"))
+            .unwrap();
+    }
+    mem.flush_wal().unwrap();
+    drop(mem);
+
+    // Reopening must not silently quadruple the index's memory, so the flag
+    // is part of the stored config rather than a per-session choice.
+    let reopened = HDF5Memory::open(&path).unwrap();
+    assert!(reopened.config().quantized_index);
+}
+
+#[test]
+fn hnsw_parameters_are_configurable_and_persisted() {
+    // The graph degree and both candidate-list sizes used to be constants, so
+    // a deployment could not trade recall against memory or speed at all.
+    let dir = TempDir::new().unwrap();
+    let path = dir.path().join("mem.h5");
+    let mut config = MemoryConfig::new(path.clone(), "agent", 16);
+    config.hnsw_m = 8;
+    config.hnsw_ef_construction = 32;
+    config.hnsw_ef_search = 128;
+    let mut mem = HDF5Memory::create(config).unwrap();
+
+    let mut seed = 99;
+    let vectors: Vec<Vec<f32>> = (0..300).map(|_| make_vector(&mut seed, 16)).collect();
+    for (i, v) in vectors.iter().enumerate() {
+        mem.save(entry(&format!("c{i}"), v.clone(), "t")).unwrap();
+    }
+    // Still correct with a smaller graph: an exact match must rank first.
+    let top = mem.hybrid_search(&vectors[42], "", 1.0, 0.0, 1);
+    assert_eq!(top[0].index, 42);
+
+    mem.flush_wal().unwrap();
+    drop(mem);
+    let reopened = HDF5Memory::open(&path).unwrap();
+    assert_eq!(reopened.config().hnsw_m, 8);
+    assert_eq!(reopened.config().hnsw_ef_construction, 32);
+    assert_eq!(reopened.config().hnsw_ef_search, 128);
+}
+
+#[test]
+fn degenerate_hnsw_parameters_do_not_panic() {
+    // `clawhdf5-ann` asserts m >= 2, so a zero from a config file — or from a
+    // caller who assumed 0 meant "default" — would abort the process inside
+    // the index builder. The store clamps instead.
+    let dir = TempDir::new().unwrap();
+    let mut config = MemoryConfig::new(dir.path().join("mem.h5"), "agent", 8);
+    config.hnsw_m = 0;
+    config.hnsw_ef_construction = 0;
+    config.hnsw_ef_search = 1;
+    let mut mem = HDF5Memory::create(config).unwrap();
+
+    let mut seed = 5;
+    let vectors: Vec<Vec<f32>> = (0..50).map(|_| make_vector(&mut seed, 8)).collect();
+    for (i, v) in vectors.iter().enumerate() {
+        mem.save(entry(&format!("c{i}"), v.clone(), "t")).unwrap();
+    }
+    let results = mem.hybrid_search(&vectors[7], "", 1.0, 0.0, 5);
+    assert_eq!(results[0].index, 7, "exact match should still rank first");
+}

crates/clawhdf5-agent/tests/memx_comparison.rs

@@ -137,10 +137,10 @@ fn bench_hit_at_1_1014_records() {
             0.3,
             1,
         );
-        if let Some((top_idx, _)) = results.first() {
+        if let Some((top_idx, _)) = results.first()
-            if *top_idx == target_indices[qi] {
+            && *top_idx == target_indices[qi]
-                hits += 1;
+        {
-            }
+            hits += 1;
         }
     }
 

crates/clawhdf5-agent/tests/stress_tests.rs

@@ -105,7 +105,7 @@ fn test_heavy_tombstoning() {
     assert_eq!(mem.count_active(), 5000);
 
     // Verify persistence
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.count(), 5000);
 }
 
@@ -163,7 +163,7 @@ fn test_large_embeddings_1536() {
     assert_eq!(mem.count(), 10_000);
 
     // Verify persistence
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.count(), 10_000);
 
     // Verify search works on large dims
@@ -545,7 +545,7 @@ fn test_delete_all_entries() {
     assert_eq!(mem.count(), 0);
 
     // Verify persistence
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.count(), 0);
 }
 
@@ -639,7 +639,7 @@ fn test_unicode_content() {
     ];
     mem.save_batch(entries).unwrap();
 
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.count(), 3);
 
     let (_, cache, _, _) = clawhdf5_agent::storage::read_from_disk(&path).unwrap();
@@ -685,6 +685,6 @@ fn test_rapid_save_delete_cycles() {
     assert_eq!(removed, 250);
     assert_eq!(mem.count(), 250);
 
-    let reopened = HDF5Memory::open(&path).unwrap();
+    let reopened = HDF5Memory::open_read_only(&path).unwrap();
     assert_eq!(reopened.count(), 250);
 }

crates/clawhdf5-agent/tests/wal_properties.rs

@@ -0,0 +1,213 @@
+//! Property tests for the write-ahead log.
+//!
+//! A deterministic generator (no external crates, reproducible from the seed
+//! printed on failure) drives thousands of cases through two properties:
+//!
+//! 1. **Round trip** — whatever was appended is read back, in order, intact.
+//! 2. **Prefix under corruption** — after *any* damage to the file (bit flips,
+//!    truncation, inserted or deleted bytes, duplicated or reordered regions),
+//!    reading never panics and yields an exact *prefix* of what was written.
+//!    This is the guarantee the chained CRC exists to provide: replay may stop
+//!    early, but it never returns a corrupted, reordered, or invented entry.
+
+use clawhdf5_agent::wal::{WalEntry, WalEntryType, WalFile};
+
+/// SplitMix64: tiny, well-distributed, and fully determined by its seed.
+struct Rng(u64);
+
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 = self.0.wrapping_add(0x9E37_79B9_7F4A_7C15);
+        let mut z = self.0;
+        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+
+    fn string(&mut self, max_len: usize) -> String {
+        const ALPHABET: &[char] = &['a', 'Z', '0', ' ', '\n', '\0', 'é', '漢', '🦀', '"'];
+        (0..self.below(max_len + 1))
+            .map(|_| ALPHABET[self.below(ALPHABET.len())])
+            .collect()
+    }
+}
+
+/// What a test appended, in a form comparable with what is read back.
+#[derive(Debug, Clone, PartialEq)]
+enum Logged {
+    Save(String, Vec<u32>, String, String, String, u64),
+    Update(usize, String, Vec<u32>, u64),
+    Tombstone(usize, u64),
+}
+
+fn logged(entry: &WalEntry) -> Logged {
+    // Compare floats by bit pattern so NaN payloads and -0.0 count as intact.
+    let bits: Vec<u32> = entry.embedding.iter().map(|f| f.to_bits()).collect();
+    let ts = entry.timestamp.to_bits();
+    match entry.entry_type {
+        WalEntryType::Save => Logged::Save(
+            entry.chunk.clone(),
+            bits,
+            entry.source_channel.clone(),
+            entry.session_id.clone(),
+            entry.tags.clone(),
+            ts,
+        ),
+        WalEntryType::Update => {
+            Logged::Update(entry.update_index.unwrap(), entry.chunk.clone(), bits, ts)
+        }
+        WalEntryType::Tombstone => Logged::Tombstone(entry.tombstone_index.unwrap(), ts),
+        WalEntryType::ActivationUpdate => unreachable!("never written by these tests"),
+    }
+}
+
+/// Append a random mix of records; return what was written.
+fn write_random_wal(path: &std::path::Path, rng: &mut Rng) -> Vec<Logged> {
+    let mut wal = WalFile::open(path).unwrap();
+    let mut written = Vec::new();
+    for _ in 0..rng.below(12) {
+        let timestamp = f64::from_bits(rng.next());
+        if rng.below(5) == 0 {
+            let index = rng.below(1000);
+            wal.append_tombstone(index, timestamp).unwrap();
+            written.push(Logged::Tombstone(index, timestamp.to_bits()));
+            continue;
+        }
+        let update_index = (rng.below(4) == 0).then(|| rng.below(1000));
+        let entry = WalEntry {
+            entry_type: if update_index.is_some() {
+                WalEntryType::Update
+            } else {
+                WalEntryType::Save
+            },
+            timestamp,
+            chunk: rng.string(40),
+            embedding: (0..rng.below(9))
+                .map(|_| f32::from_bits(rng.next() as u32))
+                .collect(),
+            source_channel: rng.string(8),
+            session_id: rng.string(8),
+            tags: rng.string(8),
+            tombstone_index: None,
+            update_index,
+        };
+        wal.append_save(&entry).unwrap();
+        written.push(logged(&entry));
+    }
+    written
+}
+
+fn read_back(path: &std::path::Path) -> Option<Vec<Logged>> {
+    WalFile::read_entries(path)
+        .ok()
+        .map(|entries| entries.iter().map(logged).collect())
+}
+
+#[test]
+fn everything_appended_is_read_back_intact() {
+    let dir = tempfile::TempDir::new().unwrap();
+    for seed in 0..300u64 {
+        let path = dir.path().join(format!("rt-{seed}.wal"));
+        let written = write_random_wal(&path, &mut Rng(seed));
+        assert_eq!(read_back(&path).unwrap(), written, "seed {seed}");
+        // Reopening (which scans and repositions) must not disturb anything.
+        drop(WalFile::open(&path).unwrap());
+        assert_eq!(
+            read_back(&path).unwrap(),
+            written,
+            "seed {seed} after reopen"
+        );
+    }
+}
+
+/// Damage `bytes` in one of several ways.
+fn corrupt(bytes: &mut Vec<u8>, rng: &mut Rng) {
+    if bytes.is_empty() {
+        return;
+    }
+    match rng.below(7) {
+        0 => {
+            let i = rng.below(bytes.len());
+            bytes[i] ^= 1 << rng.below(8);
+        }
+        1 => bytes.truncate(rng.below(bytes.len())),
+        2 => {
+            let i = rng.below(bytes.len() + 1);
+            bytes.insert(i, rng.next() as u8);
+        }
+        3 => {
+            let i = rng.below(bytes.len());
+            bytes.remove(i);
+        }
+        4 => {
+            // Duplicate a region in place (a replayed/duplicated entry).
+            let a = rng.below(bytes.len());
+            let b = a + rng.below(bytes.len() - a);
+            let region = bytes[a..b].to_vec();
+            let at = rng.below(bytes.len() + 1);
+            bytes.splice(at..at, region);
+        }
+        5 => {
+            // Swap two regions (reordered entries).
+            let mid = rng.below(bytes.len());
+            bytes.rotate_left(mid);
+        }
+        _ => {
+            let i = rng.below(bytes.len());
+            let n = rng.below(bytes.len() - i + 1);
+            for b in &mut bytes[i..i + n] {
+                *b = rng.next() as u8;
+            }
+        }
+    }
+}
+
+#[test]
+fn any_corruption_yields_a_prefix_never_a_wrong_entry() {
+    let dir = tempfile::TempDir::new().unwrap();
+    let mut shortened = 0u32;
+    for seed in 0..1500u64 {
+        let mut rng = Rng(seed ^ 0xC0FF_EE00);
+        let path = dir.path().join("c.wal");
+        let _ = std::fs::remove_file(&path);
+        let written = write_random_wal(&path, &mut rng);
+
+        let mut bytes = std::fs::read(&path).unwrap();
+        for _ in 0..=rng.below(3) {
+            corrupt(&mut bytes, &mut rng);
+        }
+        std::fs::write(&path, &bytes).unwrap();
+
+        // An unreadable header is a clean error; anything else is a prefix.
+        if let Some(read) = read_back(&path) {
+            assert!(
+                read.len() <= written.len() && read[..] == written[..read.len()],
+                "seed {seed}: read {read:?}\nis not a prefix of {written:?}"
+            );
+            if read.len() < written.len() {
+                shortened += 1;
+            }
+            // Opening for append repairs the tail; what was readable stays so,
+            // and a new entry lands right after it.
+            if let Ok(mut wal) = WalFile::open(&path) {
+                wal.append_tombstone(7, 1.0).unwrap();
+                drop(wal);
+                let mut expected = read.clone();
+                expected.push(Logged::Tombstone(7, 1.0f64.to_bits()));
+                assert_eq!(
+                    read_back(&path).unwrap(),
+                    expected,
+                    "seed {seed} after repair"
+                );
+            }
+        }
+    }
+    assert!(
+        shortened > 100,
+        "corruption rarely took effect: {shortened}"
+    );
+}

crates/clawhdf5-android/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "clawhdf5-android"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 description = "Android JNI bridge for edgehdf5-memory HDF5 backend"
 license = "MIT"
@@ -10,3 +10,6 @@ crate-type = ["cdylib"]
 
 [dependencies]
 clawhdf5-agent = { path = "../clawhdf5-agent", default-features = false }
+
+[dev-dependencies]
+tempfile = { workspace = true }

crates/clawhdf5-android/src/lib.rs

@@ -92,11 +92,18 @@ pub unsafe extern "C" fn edgehdf5_close(handle: Handle) {
 
 /// Save a memory entry. Returns the entry index, or -1 on failure.
 ///
+/// `embedding_len` is validated against the handle's configured
+/// `embedding_dim` before the input slice is constructed; a mismatch fails
+/// the call with -1 rather than reading out of bounds. This is a length
+/// check only — it cannot detect a same-length buffer that is otherwise
+/// too short or invalid.
+///
 /// # Safety
 ///
 /// - `handle` must be a valid, non-null handle.
 /// - All `*const c_char` arguments must be valid, null-terminated C strings.
-/// - `embedding_ptr` must point to at least `embedding_len` contiguous `f32` values.
+/// - If `embedding_len` matches the handle's `embedding_dim`, `embedding_ptr`
+///   must point to at least that many contiguous, valid `f32` values.
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn edgehdf5_save(
     handle: Handle,
@@ -135,8 +142,14 @@ pub unsafe extern "C" fn edgehdf5_save(
         None => return -1,
     };
 
+    if embedding_ptr.is_null() || embedding_len as usize != mem.config().embedding_dim {
+        return -1;
+    }
     let embedding =
-        // SAFETY: JNI caller guarantees embedding_ptr points to embedding_len valid f32 values.
+        // SAFETY: embedding_ptr is non-null and embedding_len matches the handle's configured
+        // embedding_dim (checked above); JNI caller guarantees it points to that many valid f32
+        // values. A mismatched-but-equal-length short buffer is not caught by this length check
+        // alone — the caller is still responsible for pointer validity.
         unsafe { std::slice::from_raw_parts(embedding_ptr, embedding_len as usize) }.to_vec();
 
     let entry = MemoryEntry {
@@ -210,11 +223,18 @@ pub unsafe extern "C" fn edgehdf5_delete(handle: Handle, index: u64) -> i32 {
 /// Performs hybrid search and writes up to `max_results` entries into the
 /// provided output arrays. Returns the number of results written.
 ///
+/// `query_embedding_len` is validated against the handle's configured
+/// `embedding_dim` before the input slice is constructed; a mismatch fails
+/// the call (returns 0) rather than reading out of bounds. This is a length
+/// check only — it cannot detect a same-length buffer that is otherwise too
+/// short or invalid.
+///
 /// # Safety
 ///
 /// - `handle` must be a valid, non-null handle.
 /// - `query_text` must be a valid, null-terminated C string.
-/// - `query_embedding_ptr` must point to at least `query_embedding_len` `f32` values.
+/// - If `query_embedding_len` matches the handle's `embedding_dim`,
+///   `query_embedding_ptr` must point to at least that many valid `f32` values.
 /// - `out_indices` and `out_scores` must point to arrays of at least `max_results` elements.
 /// - `out_chunks` must be null or point to an array of at least `max_results` pointers.
 #[unsafe(no_mangle)]
@@ -240,8 +260,14 @@ pub unsafe extern "C" fn edgehdf5_hybrid_search(
         Some(s) => s,
         None => return 0,
     };
+    if query_embedding_ptr.is_null() || query_embedding_len as usize != mem.config().embedding_dim {
+        return 0;
+    }
     let query_embedding =
-        // SAFETY: JNI caller guarantees query_embedding_ptr points to query_embedding_len valid f32 values.
+        // SAFETY: query_embedding_ptr is non-null and query_embedding_len matches the handle's
+        // configured embedding_dim (checked above); JNI caller guarantees it points to that many
+        // valid f32 values. A mismatched-but-equal-length short buffer is not caught by this
+        // length check alone — the caller is still responsible for pointer validity.
         unsafe { std::slice::from_raw_parts(query_embedding_ptr, query_embedding_len as usize) };
 
     let results = mem.hybrid_search(
@@ -456,3 +482,112 @@ unsafe fn cstr_to_string(ptr: *const c_char) -> Option<String> {
         .ok()
         .map(String::from)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const EMBEDDING_DIM: u32 = 4;
+
+    fn open_handle(dir: &tempfile::TempDir) -> Handle {
+        let path = CString::new(dir.path().join("mem.h5").to_str().unwrap()).unwrap();
+        let agent_id = CString::new("test-agent").unwrap();
+        // SAFETY: both C strings are valid and null-terminated.
+        unsafe { edgehdf5_create(path.as_ptr(), agent_id.as_ptr(), EMBEDDING_DIM) }
+    }
+
+    #[test]
+    fn save_rejects_mismatched_embedding_len() {
+        let dir = tempfile::tempdir().unwrap();
+        let handle = open_handle(&dir);
+        assert!(!handle.is_null());
+
+        let embedding = [1.0f32, 2.0, 3.0]; // len 3, dim is 4
+        let chunk = CString::new("hello").unwrap();
+        let channel = CString::new("test").unwrap();
+        let session = CString::new("s1").unwrap();
+        let tags = CString::new("").unwrap();
+
+        // SAFETY: handle is valid; all C strings are valid; embedding_len (3) intentionally
+        // does not match embedding_dim (4), which edgehdf5_save must reject before touching
+        // embedding_ptr.
+        let result = unsafe {
+            edgehdf5_save(
+                handle,
+                chunk.as_ptr(),
+                embedding.as_ptr(),
+                embedding.len() as u32,
+                channel.as_ptr(),
+                0.0,
+                session.as_ptr(),
+                tags.as_ptr(),
+            )
+        };
+        assert_eq!(result, -1, "mismatched embedding_len must be rejected");
+
+        unsafe { edgehdf5_close(handle) };
+    }
+
+    #[test]
+    fn save_rejects_null_embedding_ptr() {
+        let dir = tempfile::tempdir().unwrap();
+        let handle = open_handle(&dir);
+        assert!(!handle.is_null());
+
+        let chunk = CString::new("hello").unwrap();
+        let channel = CString::new("test").unwrap();
+        let session = CString::new("s1").unwrap();
+        let tags = CString::new("").unwrap();
+
+        // SAFETY: handle and C strings are valid; embedding_ptr is intentionally null, which
+        // edgehdf5_save must reject before constructing a slice from it.
+        let result = unsafe {
+            edgehdf5_save(
+                handle,
+                chunk.as_ptr(),
+                ptr::null(),
+                EMBEDDING_DIM,
+                channel.as_ptr(),
+                0.0,
+                session.as_ptr(),
+                tags.as_ptr(),
+            )
+        };
+        assert_eq!(result, -1, "null embedding_ptr must be rejected");
+
+        unsafe { edgehdf5_close(handle) };
+    }
+
+    #[test]
+    fn hybrid_search_rejects_mismatched_embedding_len() {
+        let dir = tempfile::tempdir().unwrap();
+        let handle = open_handle(&dir);
+        assert!(!handle.is_null());
+
+        let query_embedding = [1.0f32, 2.0]; // len 2, dim is 4
+        let query_text = CString::new("hello").unwrap();
+        let mut out_indices = [0u64; 4];
+        let mut out_scores = [0.0f32; 4];
+
+        // SAFETY: handle and query_text are valid; query_embedding_len (2) intentionally does
+        // not match embedding_dim (4), which edgehdf5_hybrid_search must reject before touching
+        // query_embedding_ptr. Output buffers are sized to max_results.
+        let count = unsafe {
+            edgehdf5_hybrid_search(
+                handle,
+                query_embedding.as_ptr(),
+                query_embedding.len() as u32,
+                query_text.as_ptr(),
+                0.7,
+                0.3,
+                4,
+                out_indices.as_mut_ptr(),
+                out_scores.as_mut_ptr(),
+                ptr::null_mut(),
+            )
+        };
+        assert_eq!(count, 0, "mismatched query_embedding_len must be rejected");
+
+        unsafe { edgehdf5_close(handle) };
+    }
+}

crates/clawhdf5-ann/Cargo.toml

@@ -1,14 +1,19 @@
 [package]
 name = "clawhdf5-ann"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 description = "HNSW approximate nearest neighbor index stored as HDF5"
 license = "MIT"
-repository = "https://github.com/redclawsystems/clawhdf5"
+repository = "https://git.redclaw.dev/quantumclaw/clawhdf5"
 readme = "README.md"
 keywords = ["hdf5", "ann", "hnsw", "nearest-neighbor"]
 categories = ["algorithms", "science"]
 
 [dependencies]
-clawhdf5-format = { path = "../clawhdf5-format", version = "2.1.0" }
+clawhdf5-format = { path = "../clawhdf5-format", version = "2.7.0" }
-clawhdf5-io = { path = "../clawhdf5-io", version = "2.1.0" }
+clawhdf5-io = { path = "../clawhdf5-io", version = "2.7.0" }
+clawhdf5-accel = { path = "../clawhdf5-accel", version = "2.7.0" }
+rayon = { version = "1", optional = true }
+
+[features]
+parallel = ["rayon"]

crates/clawhdf5-ann/src/lib.rs

@@ -5,4 +5,4 @@
 
 mod hnsw;
 
-pub use hnsw::{DistanceMetric, HnswIndex};
+pub use hnsw::{DistanceMetric, HnswIndex, Storage};

crates/clawhdf5-bench/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "clawhdf5-bench"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 description = "Benchmark harnesses for clawhdf5-agent (Track 8)"
 license = "MIT"
@@ -13,6 +13,14 @@ path = "src/bin/longmemeval_bench.rs"
 name = "memory_arena"
 path = "src/bin/memory_arena.rs"
 
+[[bin]]
+name = "read_harness"
+path = "src/bin/read_harness.rs"
+
+[[bin]]
+name = "search_harness"
+path = "src/bin/search_harness.rs"
+
 [[bin]]
 name = "footprint_bench"
 path = "src/bin/footprint_bench.rs"
@@ -48,21 +56,36 @@ harness = false
 
 [dependencies]
 clawhdf5-agent = { path = "../clawhdf5-agent" }
+clawhdf5-ann = { path = "../clawhdf5-ann" }
+clawhdf5 = { path = "../clawhdf5" }
+clawhdf5-format = { path = "../clawhdf5-format" }
 clawhdf5-io = { path = "../clawhdf5-io" }
 mpi = { version = "0.8", optional = true }
-serde = { version = "1", features = ["derive"] }
+serde = { workspace = true }
 serde_json = "1"
-tempfile = "3"
+tempfile = { workspace = true }
 # Optional: libhdf5 C wrapper for side-by-side comparison (requires system libhdf5).
 # Enable with: cargo bench -p clawhdf5-bench --features libhdf5-compare
 # Uses hdf5-metno (fork of hdf5 crate) which supports HDF5 1.14.x.
 hdf5 = { version = "0.12", optional = true, package = "hdf5-metno" }
+# Optional: real sentence embeddings for the LongMemEval bench's vector stage.
+# Enable with: cargo run --release --bin longmemeval_bench --features embeddings
+# Off by default — nothing in the shipped crates depends on these.
+candle-core = { version = "0.9", optional = true }
+candle-nn = { version = "0.9", optional = true }
+candle-transformers = { version = "0.9", optional = true }
+tokenizers = { version = "0.21", optional = true }
 
 [dev-dependencies]
 clawhdf5 = { path = "../clawhdf5", features = ["zstd", "pcodec"] }
-criterion = { version = "0.5", features = ["html_reports"] }
+criterion = { workspace = true }
 
 [features]
 # When enabled, benchmarks add matching libhdf5 variants for side-by-side comparison.
 libhdf5-compare = ["hdf5"]
 mpi-io = ["clawhdf5-io/mpi-io", "mpi"]
+# Real MiniLM embeddings for longmemeval_bench, so the vector stage is not inert.
+embeddings = ["candle-core", "candle-nn", "candle-transformers", "tokenizers"]
+# CUDA-accelerated embedding. MiniLM on a CPU takes hours over the full
+# longmemeval_s haystack; on a GPU it is minutes.
+embeddings-cuda = ["embeddings", "candle-core/cuda", "candle-nn/cuda", "candle-transformers/cuda"]

crates/clawhdf5-bench/examples/worldmodel_sampling.rs

@@ -0,0 +1,95 @@
+//! World-model sample-loading benchmark — clawhdf5 vs the h5py counterpart.
+//!
+//! Reproduces the access pattern of `stable-worldmodel`'s HDF5 dataloader
+//! (arXiv 2605.21800): a dataset of `(N, H, W, C)` uint8 observation frames,
+//! read one frame at a time in shuffled (dataloader) order. That paper
+//! reports generic HDF5 at 1,416–1,474 samples/s (vs Lance 4,815); this
+//! measures clawhdf5 and h5py on the **same machine and file**, so the
+//! comparison is hardware-controlled. Absolute numbers are not comparable to
+//! the paper's (different box, smaller frames, no torch/transform) — only
+//! clawhdf5-vs-h5py *here* is.
+//!
+//! clawhdf5 mmaps the file once and takes a zero-copy `&[u8]` over the
+//! contiguous observation dataset; frame `i` is a subslice, and the OS pages
+//! it in on access. Two modes, because fairness demands both:
+//!   * default: sum the frame bytes through the zero-copy view — clawhdf5's
+//!     real advantage, no per-frame allocation;
+//!   * `--copy`: `to_vec()` each frame first, matching h5py's unavoidable
+//!     per-frame numpy materialization, so the two do equal work.
+//!
+//! Usage: `... --example worldmodel_sampling -- <file.h5> [passes] [--copy]`
+
+use std::hint::black_box;
+use std::time::Instant;
+
+use clawhdf5::MmapFile;
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let path = args
+        .get(1)
+        .expect("usage: worldmodel_sampling <file.h5> [passes] [--copy]");
+    let passes: usize = args.get(2).and_then(|s| s.parse().ok()).unwrap_or(5);
+    let copy = args.iter().any(|a| a == "--copy");
+
+    let file = MmapFile::open(path).expect("open");
+    let ds = file.dataset("observation").expect("observation dataset");
+    let shape = ds.shape().expect("shape");
+    let n = shape[0] as usize;
+    let frame_bytes: usize = shape[1..].iter().map(|&d| d as usize).product();
+    let raw = ds
+        .read_raw_slice()
+        .expect("read_raw_slice")
+        .expect("contiguous zero-copy slice");
+    assert_eq!(raw.len(), n * frame_bytes, "unexpected dataset size");
+
+    let order = shuffled(n);
+
+    let touch = |slice: &[u8]| -> u64 {
+        if copy {
+            let owned = slice.to_vec();
+            owned.iter().map(|&b| u64::from(b)).sum()
+        } else {
+            slice.iter().map(|&b| u64::from(b)).sum()
+        }
+    };
+
+    // Warm one pass (page-in), then time.
+    let mut sink = 0u64;
+    for &i in &order {
+        sink = sink.wrapping_add(touch(&raw[i * frame_bytes..(i + 1) * frame_bytes]));
+    }
+    black_box(sink);
+
+    let t0 = Instant::now();
+    let mut sink = 0u64;
+    for _ in 0..passes {
+        for &i in &order {
+            sink = sink.wrapping_add(touch(&raw[i * frame_bytes..(i + 1) * frame_bytes]));
+        }
+    }
+    black_box(sink);
+    let elapsed = t0.elapsed().as_secs_f64();
+
+    let total = (n * passes) as f64;
+    let mode = if copy {
+        "materialized copy"
+    } else {
+        "zero-copy view"
+    };
+    println!("clawhdf5 ({mode}): {n} frames x {passes} passes in {elapsed:.3}s");
+    println!("clawhdf5 ({mode}): {:.0} samples/sec", total / elapsed);
+}
+
+fn shuffled(n: usize) -> Vec<usize> {
+    let mut v: Vec<usize> = (0..n).collect();
+    let mut state: u64 = 0x9E37_79B9_7F4A_7C15;
+    for i in (1..n).rev() {
+        state = state
+            .wrapping_mul(6364136223846793005)
+            .wrapping_add(1442695040888963407);
+        let j = (state >> 33) as usize % (i + 1);
+        v.swap(i, j);
+    }
+    v
+}

crates/clawhdf5-bench/src/bin/consolidation_efficiency.rs

@@ -22,7 +22,9 @@
 use std::time::Instant;
 
 use clawhdf5_agent::bm25::BM25Index;
-use clawhdf5_agent::consolidation::{ConsolidationConfig, ConsolidationEngine, MemorySource};
+use clawhdf5_agent::consolidation::{
+    ConsolidationConfig, ConsolidationEngine, TrustedSource, UntrustedSource,
+};
 use clawhdf5_agent::hybrid::hybrid_search;
 
 const EMBEDDING_DIM: usize = 384;
@@ -232,7 +234,7 @@ fn run_quality_benchmark() {
     for i in 0..SIGNAL_KEYWORDS.len() {
         let chunk = make_signal_content(i);
         let embedding = make_embedding(i * 1000);
-        let id = engine.add_memory(chunk, embedding, MemorySource::Correction, now);
+        let id = engine.add_trusted_memory(chunk, embedding, TrustedSource::Correction, now);
         signal_ids.push(id);
     }
 
@@ -240,7 +242,12 @@ fn run_quality_benchmark() {
     for i in 0..990 {
         let chunk = make_noise_content(i);
         let embedding = make_embedding(i + 100);
-        engine.add_memory(chunk, embedding, MemorySource::System, now + i as f64 * 0.1);
+        engine.add_trusted_memory(
+            chunk,
+            embedding,
+            TrustedSource::System,
+            now + i as f64 * 0.1,
+        );
     }
 
     println!("  → Inserted {} records total", engine.records().len());
@@ -333,7 +340,7 @@ fn run_cycle_time_benchmark() {
         for i in 0..n {
             let chunk = make_noise_content(i);
             let embedding = make_embedding(i);
-            engine.add_memory(chunk, embedding, MemorySource::User, now + i as f64);
+            engine.add_memory(chunk, embedding, UntrustedSource::User, now + i as f64);
         }
 
         // Warmup
@@ -344,7 +351,7 @@ fn run_cycle_time_benchmark() {
         for i in n..(n * 2) {
             let chunk = make_noise_content(i);
             let embedding = make_embedding(i);
-            engine.add_memory(chunk, embedding, MemorySource::User, now + i as f64);
+            engine.add_memory(chunk, embedding, UntrustedSource::User, now + i as f64);
         }
 
         // Timed consolidation
@@ -410,13 +417,13 @@ fn run_memory_reduction_benchmark() {
         for i in 0..signal_count {
             let chunk = make_signal_content(i % SIGNAL_KEYWORDS.len());
             let emb = make_embedding(i * 999);
-            let id = engine.add_memory(chunk, emb, MemorySource::Correction, now);
+            let id = engine.add_trusted_memory(chunk, emb, TrustedSource::Correction, now);
             signal_ids.push(id);
         }
         for i in 0..noise_count {
             let chunk = make_noise_content(i);
             let emb = make_embedding(i + 200);
-            engine.add_memory(chunk, emb, MemorySource::System, now + i as f64 * 0.1);
+            engine.add_trusted_memory(chunk, emb, TrustedSource::System, now + i as f64 * 0.1);
         }
 
         // Access signal records heavily

crates/clawhdf5-bench/src/bin/longmemeval_bench.rs

@@ -4,11 +4,39 @@
 //! Since no embedding model is available at bench time, all embeddings are zero vectors
 //! and `hybrid_search` operates in BM25-only mode (vector_weight=0.0, keyword_weight=1.0).
 //!
-//! This matches the MemX paper methodology: evaluate retrieval recall, not answer generation.
+//! # Scoring target (read before citing any number from this harness)
+//!
+//! - **Metric: retrieval recall.** A "hit" means the gold-labelled memory appeared in
+//!   the top-k. No answer is generated and none is scored — the dataset's `answer`
+//!   field is deserialized and deliberately never read. This is **not** the official
+//!   LongMemEval metric, which is end-to-end QA accuracy (retrieve → generate → LLM
+//!   judge). Reporting retrieval recall as QA accuracy overstates by 20–30 points.
+//! - **Dataset: whichever variant you point it at.** Both `longmemeval_oracle`
+//!   (evidence sessions only — a substantially easier corpus) and the full
+//!   `longmemeval_s` haystack are supported. The harness does not trust the
+//!   filename: [`DatasetProfile`] measures evidence-session density from the
+//!   data and labels the run from that, so a mislabelled input cannot produce a
+//!   mislabelled result.
+//! - **Session-level metrics are degenerate when evidence density is high**, and
+//!   the report says so per run rather than assuming it. On the oracle variant
+//!   the haystack is essentially all-evidence, so any returned document is a
+//!   session-level hit at rank 0 by construction; only turn-level
+//!   (`has_answer == true` on the source turn) measures the retriever there. On
+//!   the full haystack, session-level recall is meaningful.
+//! - **Not comparable to MemX's Hit@5=51.6% / MRR=0.380**, which is *fact-level*
+//!   granularity over 220,349 records from 19,195 sessions.
+//!
+//! See `BENCHMARKS.md` § "Retracted: session-level recall and the MemX comparison".
 //!
 //! # Usage
 //! ```
-//! cargo run --release --bin longmemeval_bench [path/to/longmemeval_oracle.json]
+//! cargo run --release --bin longmemeval_bench [PATH] [--limit N]
+//!
+//! # Usage: full haystack
+//! ```
+//! cargo run --release --bin longmemeval_bench -- \
+//!     benchmarks/longmemeval/longmemeval_s_cleaned.json --limit 50
+//! ```
 //! ```
 //!
 //! # WASM Note
@@ -21,12 +49,186 @@
 use std::collections::{HashMap, HashSet};
 use std::time::{Duration, Instant};
 
-use clawhdf5_agent::{AgentMemory, HDF5Memory, MemoryConfig, MemoryEntry};
+// `#[path]` keeps the module beside its binary without Cargo autodiscovering it
+// as a second bin target (which a bare `src/bin/embedder.rs` would be).
+#[cfg(feature = "embeddings")]
+#[path = "longmemeval_bench/embedder.rs"]
+mod embedder;
+
+use clawhdf5_agent::bm25::TokenFilter;
+use clawhdf5_agent::hybrid::Fusion;
+use clawhdf5_agent::reranker::{ReRankConfig, RerankInput, rerank};
+use clawhdf5_agent::{AgentMemory, HDF5Memory, MemoryConfig, MemoryEntry, SearchResult};
 use serde::Deserialize;
 use tempfile::TempDir;
 
 const EMBEDDING_DIM: usize = 384;
 
+/// A mode's fusion, as one short string for the reports.
+fn describe(mode: Mode) -> String {
+    let fusion = match mode.fusion {
+        Fusion::Weighted { vector, keyword } => format!("vector_{vector:.1}_keyword_{keyword:.1}"),
+        Fusion::Rrf { k } => format!("rrf_k{k:.0}"),
+    };
+    let tokens = match mode.tokens {
+        TokenFilter::Plain => fusion,
+        TokenFilter::Stemmed => format!("{fusion}_stemmed"),
+    };
+    match mode.rerank {
+        None => tokens,
+        Some(cfg) if cfg.relevance_weight == 0.0 => format!("{tokens}_rerank_metadata"),
+        Some(cfg) => format!(
+            "{tokens}_rerank_blended_hl{:.0}d",
+            cfg.temporal_half_life_secs / 86_400.0
+        ),
+    }
+}
+
+/// A retrieval configuration: how much of the score comes from each stage.
+#[derive(Clone, Copy)]
+struct Mode {
+    label: &'static str,
+    /// How the two retrieval stages are combined into one ranking.
+    fusion: Fusion,
+    /// How keyword tokens are normalised before indexing and querying.
+    tokens: TokenFilter,
+    /// Re-rank the retrieved candidates with recency and friends, relative to
+    /// the question's own date.
+    rerank: Option<ReRankConfig>,
+}
+
+impl Mode {
+    const fn weighted(label: &'static str, vector: f32, keyword: f32) -> Self {
+        Self {
+            label,
+            fusion: Fusion::Weighted { vector, keyword },
+            tokens: TokenFilter::Plain,
+            rerank: None,
+        }
+    }
+
+    #[cfg_attr(not(feature = "embeddings"), allow(dead_code))]
+    fn reranked(mut self, label: &'static str, rerank: ReRankConfig) -> Self {
+        self.label = label;
+        self.rerank = Some(rerank);
+        self
+    }
+
+    const fn stemmed(mut self, label: &'static str) -> Self {
+        self.label = label;
+        self.tokens = TokenFilter::Stemmed;
+        self
+    }
+}
+
+/// The only mode available without real embeddings. Passing zero vectors with
+/// `vector_weight = 0.0` is what made the vector stage inert.
+const BM25_ONLY: Mode = Mode::weighted("BM25 only (vector stage inert)", 0.0, 1.0);
+#[cfg(feature = "embeddings")]
+const VECTOR_ONLY: Mode = Mode::weighted("Vector only (MiniLM + HNSW)", 1.0, 0.0);
+/// Tuned by `--sweep` over the full haystack. The former 0.7/0.3 was a
+/// documented default that had never been searched, and the sweep found it
+/// strictly dominated: 0.4/0.6 is better on Hit@1, Hit@5, Hit@10 and MRR at
+/// both granularities.
+#[cfg(feature = "embeddings")]
+const HYBRID: Mode = Mode::weighted("Hybrid (0.4 vector / 0.6 BM25, tuned)", 0.4, 0.6);
+
+/// Reciprocal rank fusion, the documented alternative to the weighted sum.
+/// It ignores score magnitudes, so there is nothing to tune — which is the
+/// claim being tested.
+#[cfg(feature = "embeddings")]
+const RRF: Mode = Mode {
+    label: "Hybrid (reciprocal rank fusion, k=60)",
+    fusion: Fusion::Rrf { k: 60.0 },
+    tokens: TokenFilter::Plain,
+    rerank: None,
+};
+
+/// The same two configurations with stemmed keyword tokens, so the tokenizer's
+/// effect is isolated from everything else.
+const BM25_STEMMED: Mode = BM25_ONLY.stemmed("BM25 only, stemmed tokens");
+
+/// Re-ranking as it behaved before `relevance` was an input: the combined
+/// score was recency + authority + activation only, so the retriever's own
+/// ordering was discarded.
+#[cfg(feature = "embeddings")]
+fn hybrid_rerank_metadata_only() -> Mode {
+    HYBRID.reranked(
+        "Hybrid + rerank (metadata only, pre-fix)",
+        ReRankConfig {
+            relevance_weight: 0.0,
+            ..ReRankConfig::default()
+        },
+    )
+}
+
+/// Re-ranking as it behaves now: relevance leads, recency nudges.
+#[cfg(feature = "embeddings")]
+fn hybrid_rerank_blended() -> Mode {
+    HYBRID.reranked(
+        "Hybrid + rerank (relevance + recency)",
+        ReRankConfig::default(),
+    )
+}
+
+/// The same blend at several half-lives. Decay is `2^(-age / half_life)`, so a
+/// half-life far shorter than the gaps between memories sends every score to
+/// zero and the signal vanishes; far longer and everything scores ~1 and it
+/// vanishes the other way. The right value tracks how far apart the memories
+/// actually are.
+#[cfg(feature = "embeddings")]
+fn hybrid_rerank_half_lives() -> Vec<Mode> {
+    [
+        ("1 day", 86_400.0),
+        ("7 days", 7.0 * 86_400.0),
+        ("30 days", 30.0 * 86_400.0),
+        ("90 days", 90.0 * 86_400.0),
+    ]
+    .into_iter()
+    .map(|(label, half_life)| {
+        HYBRID.reranked(
+            Box::leak(format!("Hybrid + rerank, half-life {label}").into_boxed_str()),
+            ReRankConfig {
+                temporal_half_life_secs: half_life,
+                ..ReRankConfig::default()
+            },
+        )
+    })
+    .collect()
+}
+#[cfg(feature = "embeddings")]
+const HYBRID_STEMMED: Mode = HYBRID.stemmed("Hybrid 0.4/0.6, stemmed tokens");
+
+/// Every 0.1 step of vector weight, keyword weight taking the remainder.
+///
+/// Labels are leaked to `&'static str` because `Mode::label` is a `&'static
+/// str` for the eleven named modes and a sweep is a short-lived process; the
+/// alternative is threading a lifetime through the whole report path for a
+/// diagnostic mode.
+#[cfg(feature = "embeddings")]
+fn sweep_modes() -> Vec<Mode> {
+    (0..=10)
+        .map(|i| {
+            let v = i as f32 / 10.0;
+            Mode::weighted(
+                Box::leak(format!("sweep v={v:.1} / k={:.1}", 1.0 - v).into_boxed_str()),
+                v,
+                1.0 - v,
+            )
+        })
+        .collect()
+}
+
+/// Text -> embedding, built once for the whole corpus.
+type EmbeddingMap = HashMap<String, Vec<f32>>;
+
+/// Look up a real embedding, falling back to zeros when running BM25-only.
+fn embedding_for(map: Option<&EmbeddingMap>, text: &str) -> Vec<f32> {
+    map.and_then(|m| m.get(text))
+        .cloned()
+        .unwrap_or_else(|| vec![0.0f32; EMBEDDING_DIM])
+}
+
 // ---------------------------------------------------------------------------
 // JSON data types
 // ---------------------------------------------------------------------------
@@ -85,6 +287,37 @@ struct Question {
     haystack_session_ids: Vec<String>,
     haystack_sessions: Vec<Vec<Turn>>,
     answer_session_ids: Vec<String>,
+    /// One timestamp per haystack session, e.g. "2023/05/25 (Thu) 20:21".
+    #[serde(default)]
+    haystack_dates: Vec<String>,
+}
+
+/// Seconds since the epoch for a LongMemEval session date, which looks like
+/// `2023/05/25 (Thu) 20:21`. Sessions are stored in chronological order, so a
+/// date that cannot be parsed falls back to its position — order is preserved
+/// even if the interval is not.
+fn session_time(date: &str, position: usize) -> f64 {
+    let stamp = |y: i64, mo: i64, d: i64, h: i64, mi: i64| -> f64 {
+        // Days since 1970-01-01 via the civil-from-days algorithm.
+        let (y, mo) = if mo <= 2 { (y - 1, mo + 12) } else { (y, mo) };
+        let era = y.div_euclid(400);
+        let yoe = y - era * 400;
+        let doy = (153 * (mo - 3) + 2) / 5 + d - 1;
+        let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+        let days = era * 146_097 + doe - 719_468;
+        (days * 86_400 + h * 3_600 + mi * 60) as f64
+    };
+    let parse = || -> Option<f64> {
+        let (ymd, rest) = date.split_once(' ')?;
+        let mut ymd = ymd.split('/');
+        let y = ymd.next()?.parse().ok()?;
+        let mo = ymd.next()?.parse().ok()?;
+        let d = ymd.next()?.parse().ok()?;
+        let hm = rest.rsplit(' ').next()?;
+        let (h, mi) = hm.split_once(':')?;
+        Some(stamp(y, mo, d, h.parse().ok()?, mi.parse().ok()?))
+    };
+    parse().unwrap_or(1_000_000.0 + position as f64 * 86_400.0)
 }
 
 // ---------------------------------------------------------------------------
@@ -103,11 +336,21 @@ struct Metrics {
     rr_turn: f64,
     abstention_correct: u32,
     abstention_total: u32,
+    /// Questions where the newest gold session outranked the older ones, out
+    /// of those with more than one gold session and at least one retrieved.
+    newest_gold_first: u32,
+    newest_gold_total: u32,
     latency_ns: Vec<u64>,
     count: u32,
 }
 
 impl Metrics {
+    /// `None` when no question in this bucket had multiple gold sessions.
+    fn newest_gold_first_pct(&self) -> Option<f64> {
+        (self.newest_gold_total > 0)
+            .then(|| self.newest_gold_first as f64 / self.newest_gold_total as f64 * 100.0)
+    }
+
     fn hit1_session_pct(&self) -> f64 {
         self.hit1_session as f64 / self.count.max(1) as f64 * 100.0
     }
@@ -165,32 +408,54 @@ struct EvalResult {
     hit5_turn: bool,
     hit10_turn: bool,
     rr_turn: Option<f64>,
+    /// For a question whose evidence spans several dated sessions (a
+    /// `knowledge-update`, where an earlier fact is superseded by a later
+    /// one): did the *newest* gold session outrank every older gold session
+    /// that was returned? `None` when the question has one gold session, or
+    /// when none were retrieved, so there is nothing to discriminate.
+    ///
+    /// Plain recall cannot see this. LongMemEval labels *both* the stale and
+    /// the updated session as gold, so returning either counts as a hit — yet
+    /// only one of them answers the question correctly.
+    newest_gold_first: Option<bool>,
     latency: Duration,
 }
 
-fn evaluate_question(q: &Question, top_k: usize) -> EvalResult {
+fn evaluate_question(
+    q: &Question,
+    top_k: usize,
+    mode: Mode,
+    embeddings: Option<&EmbeddingMap>,
+) -> EvalResult {
     let dir = TempDir::new().expect("failed to create temp dir");
     let mut config = MemoryConfig::new(dir.path().join("lme.h5"), "lme-bench", EMBEDDING_DIM);
     config.wal_enabled = false;
     config.compact_threshold = 0.0;
 
     let mut memory = HDF5Memory::create(config).expect("failed to create HDF5Memory");
+    memory.set_token_filter(mode.tokens);
 
     // Build MemoryEntry list from all haystack sessions
     let mut entries: Vec<MemoryEntry> = Vec::new();
     let mut turn_has_answer: Vec<bool> = Vec::new();
-    let mut ts = 1_000_000.0f64;
-
     for (sess_idx, session) in q.haystack_sessions.iter().enumerate() {
         let sess_id = q
             .haystack_session_ids
             .get(sess_idx)
             .map(String::as_str)
             .unwrap_or("unknown");
-        for turn in session {
+        // Real session dates, not a synthetic counter: anything that decays
+        // with age needs true intervals, not just the right order.
+        let session_start = q
+            .haystack_dates
+            .get(sess_idx)
+            .map_or(sess_idx as f64 * 86_400.0, |d| session_time(d, sess_idx));
+        for (turn_idx, turn) in session.iter().enumerate() {
+            // Spread a session's turns over the minutes following its start.
+            let ts = session_start + turn_idx as f64 * 60.0;
             entries.push(MemoryEntry {
                 chunk: turn.content.clone(),
-                embedding: vec![0.0f32; EMBEDDING_DIM],
+                embedding: embedding_for(embeddings, &turn.content),
                 source_channel: "longmemeval".to_string(),
                 timestamp: ts,
                 session_id: sess_id.to_string(),
@@ -201,7 +466,6 @@ fn evaluate_question(q: &Question, top_k: usize) -> EvalResult {
                 },
             });
             turn_has_answer.push(turn.has_answer);
-            ts += 1.0;
         }
     }
 
@@ -218,12 +482,87 @@ fn evaluate_question(q: &Question, top_k: usize) -> EvalResult {
     // Set of session IDs that contain the answer
     let answer_sess_set: HashSet<&str> = q.answer_session_ids.iter().map(String::as_str).collect();
 
-    // Run hybrid search (BM25-only: vector_weight=0.0, keyword_weight=1.0)
+    // When each gold session was recorded, so "newest" is by date rather than
-    let zero_emb = vec![0.0f32; EMBEDDING_DIM];
+    // by position (the two agree in this dataset, but the metric should not
+    // depend on that).
+    let gold_times: HashMap<&str, f64> = q
+        .haystack_session_ids
+        .iter()
+        .enumerate()
+        .filter(|(_, sid)| answer_sess_set.contains(sid.as_str()))
+        .map(|(i, sid)| {
+            let t = q
+                .haystack_dates
+                .get(i)
+                .map_or(i as f64 * 86_400.0, |d| session_time(d, i));
+            (sid.as_str(), t)
+        })
+        .collect();
+
+    let query_emb = embedding_for(embeddings, &q.question);
     let t0 = Instant::now();
-    let results = memory.hybrid_search(&zero_emb, &q.question, 0.0, 1.0, top_k);
+    // Re-ranking only reorders; it needs a candidate pool larger than `top_k`
+    // to have anything to promote.
+    let pool = if mode.rerank.is_some() {
+        top_k * 4
+    } else {
+        top_k
+    };
+    let mut results = memory.hybrid_search_with(&query_emb, &q.question, mode.fusion, pool);
+    if let Some(config) = mode.rerank {
+        // "Now" is the moment the question was asked, so decay measures how
+        // stale each memory was at that point.
+        let now = session_time(&q.question_date, q.haystack_sessions.len());
+        let inputs: Vec<RerankInput> = results
+            .iter()
+            .map(|r| RerankInput {
+                index: r.index,
+                timestamp: r.timestamp,
+                source_channel: r.source_channel.clone(),
+                raw_activation: r.activation,
+                relevance: r.score,
+            })
+            .collect();
+        let order: Vec<usize> = rerank(&inputs, &config, now)
+            .into_iter()
+            .map(|r| r.index)
+            .collect();
+        let by_index: HashMap<usize, SearchResult> =
+            results.into_iter().map(|r| (r.index, r)).collect();
+        results = order
+            .into_iter()
+            .filter_map(|i| by_index.get(&i).cloned())
+            .collect();
+    }
+    results.truncate(top_k);
     let latency = t0.elapsed();
 
+    // Rank of the best-placed result from each gold session.
+    let mut first_rank: HashMap<&str, usize> = HashMap::new();
+    for (rank, result) in results.iter().enumerate() {
+        let sid = memory.cache.session_ids[result.index].as_str();
+        if let Some((gold_sid, _)) = gold_times.get_key_value(sid) {
+            first_rank.entry(gold_sid).or_insert(rank);
+        }
+    }
+    let newest_gold_first = if gold_times.len() < 2 || first_rank.is_empty() {
+        None
+    } else {
+        // The newest gold session must be retrieved, and no older gold session
+        // may outrank it.
+        let newest = gold_times
+            .iter()
+            .max_by(|a, b| a.1.total_cmp(b.1))
+            .map(|(sid, _)| *sid)
+            .expect("at least two gold sessions");
+        Some(match first_rank.get(newest) {
+            Some(&newest_rank) => first_rank
+                .iter()
+                .all(|(sid, &rank)| *sid == newest || rank > newest_rank),
+            None => false,
+        })
+    };
+
     // Session-level recall
     let mut hit1_session = false;
     let mut hit5_session = false;
@@ -278,6 +617,7 @@ fn evaluate_question(q: &Question, top_k: usize) -> EvalResult {
         hit5_turn,
         hit10_turn,
         rr_turn,
+        newest_gold_first,
         latency,
     }
 }
@@ -286,17 +626,130 @@ fn evaluate_question(q: &Question, top_k: usize) -> EvalResult {
 // Report printing
 // ---------------------------------------------------------------------------
 
-fn print_report(overall: &Metrics, by_type: &HashMap<String, Metrics>) {
+// ---------------------------------------------------------------------------
+// Dataset profile — measured, not assumed
+// ---------------------------------------------------------------------------
+
+/// Shape of the loaded corpus, computed from the data itself.
+///
+/// The variant used to be a hardcoded `"oracle"` string in the report and the
+/// JSON summary, so pointing the harness at `longmemeval_s` would have produced
+/// full-haystack numbers labelled oracle. Everything here is derived from the
+/// questions instead, which means the label cannot drift from the corpus and a
+/// mislabelled input file cannot produce a mislabelled result.
+struct DatasetProfile {
+    n_questions: usize,
+    mean_sessions: f64,
+    mean_turns: f64,
+    /// Mean over questions of `|answer_sessions| / |haystack_sessions|`.
+    ///
+    /// This is what actually decides whether session-level recall means
+    /// anything. At ~1.0 every haystack session is an evidence session, so any
+    /// returned document is a session-level hit by construction.
+    evidence_density: f64,
+}
+
+impl DatasetProfile {
+    fn measure(questions: &[Question]) -> Self {
+        let n = questions.len().max(1) as f64;
+        let mut sessions = 0.0;
+        let mut turns = 0.0;
+        let mut density = 0.0;
+        for q in questions {
+            let n_sess = q.haystack_sessions.len();
+            sessions += n_sess as f64;
+            turns += q.haystack_sessions.iter().map(Vec::len).sum::<usize>() as f64;
+            if n_sess > 0 {
+                let evidence: HashSet<&str> =
+                    q.answer_session_ids.iter().map(String::as_str).collect();
+                let hit = q
+                    .haystack_session_ids
+                    .iter()
+                    .filter(|id| evidence.contains(id.as_str()))
+                    .count();
+                density += hit as f64 / n_sess as f64;
+            }
+        }
+        Self {
+            n_questions: questions.len(),
+            mean_sessions: sessions / n,
+            mean_turns: turns / n,
+            evidence_density: density / n,
+        }
+    }
+
+    /// Above this share of evidence sessions, session-level recall is measuring
+    /// the corpus shape rather than the retriever.
+    const DEGENERACY_THRESHOLD: f64 = 0.9;
+
+    const fn session_level_degenerate(&self) -> bool {
+        self.evidence_density > Self::DEGENERACY_THRESHOLD
+    }
+
+    /// Variant name inferred from evidence density, not from the filename.
+    const fn variant(&self) -> &'static str {
+        if self.session_level_degenerate() {
+            "oracle"
+        } else {
+            "full_haystack"
+        }
+    }
+}
+
+fn print_report(
+    overall: &Metrics,
+    by_type: &HashMap<String, Metrics>,
+    profile: &DatasetProfile,
+    mode: Mode,
+) {
     println!("=================================================================");
-    println!("  LongMemEval Benchmark  (BM25-only retrieval, zero embeddings)");
+    println!("  LongMemEval Benchmark  —  {}", mode.label);
     println!("=================================================================");
     println!();
-    println!("Mode: vector_weight=0.0 / keyword_weight=1.0 (pure BM25)");
+    println!("Mode: {}", describe(mode));
-    println!("Note: MemX (arxiv:2603.16171) with full system: Hit@5=51.6%, MRR=0.380");
+    println!();
-    println!("      BM25-only numbers are expected to be lower — honest baseline.");
+    println!("Scoring target: RETRIEVAL RECALL (did the gold memory land in top-k).");
+    println!("  No answer is generated or scored. This is NOT the official");
+    println!("  LongMemEval metric (QA accuracy via retrieve+generate+judge).");
+    println!(
+        "Dataset: {} — {} questions, {:.1} sessions and {:.0} turns per question,",
+        profile.variant(),
+        profile.n_questions,
+        profile.mean_sessions,
+        profile.mean_turns,
+    );
+    println!(
+        "  {:.1}% of haystack sessions are evidence sessions.",
+        profile.evidence_density * 100.0
+    );
+    if profile.session_level_degenerate() {
+        println!("  This is the evidence-only corpus, NOT the full longmemeval_s");
+        println!("  haystack — a substantially easier retrieval problem.");
+    } else {
+        println!("  This is a full-haystack corpus: evidence sessions are a small");
+        println!("  minority, so retrieval has to actually discriminate.");
+    }
+    println!();
+    println!("Do NOT compare these to MemX's Hit@5=51.6% / MRR=0.380: that is");
+    println!("  fact-level granularity over 220,349 records from 19,195 sessions.");
+    println!("  Different granularity and a corpus larger by orders of magnitude.");
     println!();
 
     println!("## Session-Level Recall  (n={})", overall.count);
+    if profile.session_level_degenerate() {
+        println!(
+            "  [DEGENERATE — {:.1}% of haystack sessions are evidence sessions, so a",
+            profile.evidence_density * 100.0
+        );
+        println!("   returned document is a session-level hit almost by construction.");
+        println!("   This measures the corpus shape, not the retriever. Use turn-level.]");
+    } else {
+        println!(
+            "  [Meaningful on this corpus — only {:.1}% of haystack sessions are",
+            profile.evidence_density * 100.0
+        );
+        println!("   evidence sessions, so a hit reflects the retriever's discrimination.]");
+    }
     println!(
         "  Hit@1:  {:5.1}%   Hit@5:  {:5.1}%   Hit@10: {:5.1}%   MRR: {:.4}",
         overall.hit1_session_pct(),
@@ -316,6 +769,24 @@ fn print_report(overall: &Metrics, by_type: &HashMap<String, Metrics>) {
     );
     println!();
 
+    if let Some(pct) = overall.newest_gold_first_pct() {
+        println!(
+            "## Recency Discrimination  (n={})",
+            overall.newest_gold_total
+        );
+        println!(
+            "  Newest gold session ranked first: {}/{} ({pct:.1}%)",
+            overall.newest_gold_first, overall.newest_gold_total
+        );
+        println!(
+            "  Questions whose evidence spans several dated sessions — a fact and\n  \
+             its later correction. Both sessions are labelled gold, so recall\n  \
+             scores either as a hit; this asks whether the *current* one came\n  \
+             first. A retriever with no sense of time scores near chance."
+        );
+        println!();
+    }
+
     if overall.abstention_total > 0 {
         println!("## Abstention Accuracy");
         println!(
@@ -380,7 +851,23 @@ fn print_report(overall: &Metrics, by_type: &HashMap<String, Metrics>) {
     println!("```json");
     println!("{{");
     println!("  \"benchmark\": \"longmemeval\",");
-    println!("  \"mode\": \"bm25_only\",");
+    println!("  \"mode\": \"{}\",", describe(mode));
+    println!("  \"dataset_variant\": \"{}\",", profile.variant());
+    println!("  \"scoring_target\": \"retrieval_recall\",");
+    println!("  \"k\": 10,");
+    println!(
+        "  \"session_level_degenerate\": {},",
+        profile.session_level_degenerate()
+    );
+    println!(
+        "  \"evidence_session_density\": {:.4},",
+        profile.evidence_density
+    );
+    println!(
+        "  \"mean_sessions_per_question\": {:.2},",
+        profile.mean_sessions
+    );
+    println!("  \"mean_turns_per_question\": {:.1},", profile.mean_turns);
     println!(
         "  \"total_questions\": {},",
         overall.count + overall.abstention_total
@@ -403,10 +890,24 @@ fn print_report(overall: &Metrics, by_type: &HashMap<String, Metrics>) {
         overall.mrr_turn()
     );
     println!("  }},");
-    println!(
+    // `null`, not 0.0 — a corpus with no abstention questions has no abstention
-        "  \"abstention_accuracy\": {:.4},",
+    // accuracy, and emitting 0.0 reads as total failure at a task never posed.
-        overall.abstention_pct() / 100.0
+    if overall.abstention_total > 0 {
-    );
+        println!(
+            "  \"abstention_accuracy\": {:.4},",
+            overall.abstention_pct() / 100.0
+        );
+    } else {
+        println!("  \"abstention_accuracy\": null,");
+    }
+    match overall.newest_gold_first_pct() {
+        Some(pct) => println!(
+            "  \"newest_gold_first\": {:.4}, \"newest_gold_n\": {},",
+            pct / 100.0,
+            overall.newest_gold_total
+        ),
+        None => println!("  \"newest_gold_first\": null,"),
+    }
     println!("  \"latency_us\": {{");
     println!(
         "    \"avg\": {:.1}, \"p50\": {:.1}, \"p95\": {:.1}, \"p99\": {:.1}",
@@ -425,17 +926,182 @@ fn print_report(overall: &Metrics, by_type: &HashMap<String, Metrics>) {
 // ---------------------------------------------------------------------------
 
 fn main() {
-    let json_path = std::env::args()
+    let mut json_path: Option<String> = None;
-        .nth(1)
+    let mut limit: Option<usize> = None;
-        .unwrap_or_else(|| "benchmarks/longmemeval/longmemeval_oracle.json".to_string());
+    let mut weights_dir: Option<String> = None;
+    let mut sweep = false;
+    #[cfg_attr(not(feature = "embeddings"), allow(unused_mut, unused_variables))]
+    let mut rerank_sweep = false;
+    let mut args = std::env::args().skip(1);
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--limit" => {
+                let v = args.next().expect("--limit needs a value");
+                limit = Some(v.parse().expect("--limit must be a positive integer"));
+            }
+            "--sweep" => sweep = true,
+            "--rerank-sweep" => {
+                // Re-ranking needs the vector stage to have candidates worth
+                // reordering, so this is an embeddings-only comparison.
+                #[cfg(feature = "embeddings")]
+                {
+                    rerank_sweep = true;
+                }
+                #[cfg(not(feature = "embeddings"))]
+                eprintln!("warning: --rerank-sweep needs --features embeddings; ignoring");
+            }
+            "--embeddings" => {
+                weights_dir = Some(args.next().expect("--embeddings needs a directory"));
+            }
+            "--help" | "-h" => {
+                eprintln!(
+                    "usage: longmemeval_bench [PATH] [--limit N]\n\n\
+                     PATH     dataset JSON; defaults to the oracle variant.\n\
+                              longmemeval_s works too — the harness measures which\n\
+                              variant it was given rather than trusting the filename.\n\
+                     --limit  evaluate N questions, sampled evenly across the file\n\
+                              rather than as a prefix — the dataset is ordered by\n\
+                              question type, so a prefix samples one type only.\n\
+                     --embeddings DIR\n\
+                              directory holding all-MiniLM-L6-v2's model.safetensors\n\
+                              and tokenizer.json. Enables the vector stage and reports\n\
+                              BM25-only, vector-only, and hybrid separately. Requires\n\
+                              --features embeddings; without it the vector stage is\n\
+                              inert and only the BM25 row is produced.\n\
+                     --rerank-sweep\n\
+                              compare re-ranking off, metadata-only (the old\n\
+                              behaviour) and blended at several half-lives.\n\
+                     --sweep  instead of the three named modes, sweep vector_weight\n\
+                              from 0.0 to 1.0 in 0.1 steps. The 0.7/0.3 default was\n\
+                              never searched; this is what searches it."
+                );
+                return;
+            }
+            other => json_path = Some(other.to_string()),
+        }
+    }
+    let json_path =
+        json_path.unwrap_or_else(|| "benchmarks/longmemeval/longmemeval_oracle.json".to_string());
 
     eprintln!("Loading: {json_path}");
     let data = std::fs::read_to_string(&json_path)
         .unwrap_or_else(|e| panic!("Failed to read {json_path}: {e}"));
-    let questions: Vec<Question> = serde_json::from_str(&data).expect("Failed to parse JSON");
+    let mut questions: Vec<Question> = serde_json::from_str(&data).expect("Failed to parse JSON");
+    if let Some(n) = limit
+        && n < questions.len()
+    {
+        // Stride rather than truncate. The dataset is ordered by question type,
+        // so taking a prefix samples one type: `--limit 20` on longmemeval_s
+        // returns 20 `single-session-user` questions and nothing else, which
+        // reads as a whole-dataset result but is not one.
+        let total = questions.len();
+        let step = total as f64 / n as f64;
+        let keep: HashSet<usize> = (0..n)
+            .map(|i| ((i as f64 * step) as usize).min(total - 1))
+            .collect();
+        questions = questions
+            .into_iter()
+            .enumerate()
+            .filter(|(i, _)| keep.contains(i))
+            .map(|(_, q)| q)
+            .collect();
+        eprintln!(
+            "Sampling {} of {total} questions, evenly strided (--limit)",
+            questions.len()
+        );
+    }
     let total = questions.len();
     eprintln!("Loaded {total} questions");
 
+    let profile = DatasetProfile::measure(&questions);
+    eprintln!(
+        "Corpus: {} variant — {:.1} sessions / {:.0} turns per question, \
+         {:.1}% evidence-session density",
+        profile.variant(),
+        profile.mean_sessions,
+        profile.mean_turns,
+        profile.evidence_density * 100.0,
+    );
+
+    // Build the embedding table once for the whole corpus, if asked for.
+    let embeddings: Option<EmbeddingMap> = weights_dir
+        .as_deref()
+        .map(|dir| load_embeddings(dir, &questions));
+    if embeddings.is_none() && weights_dir.is_some() {
+        eprintln!("warning: --embeddings ignored (build with --features embeddings)");
+    }
+
+    let modes: Vec<Mode> = if embeddings.is_some() {
+        #[cfg(feature = "embeddings")]
+        {
+            if sweep {
+                sweep_modes()
+            } else if rerank_sweep {
+                let mut modes = vec![HYBRID, hybrid_rerank_metadata_only()];
+                modes.extend(hybrid_rerank_half_lives());
+                modes
+            } else {
+                vec![
+                    BM25_ONLY,
+                    VECTOR_ONLY,
+                    HYBRID,
+                    RRF,
+                    BM25_STEMMED,
+                    HYBRID_STEMMED,
+                    hybrid_rerank_metadata_only(),
+                    hybrid_rerank_blended(),
+                ]
+            }
+        }
+        #[cfg(not(feature = "embeddings"))]
+        {
+            vec![BM25_ONLY, BM25_STEMMED]
+        }
+    } else {
+        if sweep {
+            eprintln!("warning: --sweep needs --embeddings; running BM25 only");
+        }
+        // Stemming is a property of the keyword stage, so it can be compared
+        // without a model.
+        vec![BM25_ONLY, BM25_STEMMED]
+    };
+
+    for (mode_idx, mode) in modes.iter().enumerate() {
+        eprintln!("[{}/{}] {}", mode_idx + 1, modes.len(), mode.label);
+        run_mode(&questions, *mode, embeddings.as_ref(), &profile);
+    }
+}
+
+/// Load and encode the corpus. Returns `None` unless the `embeddings` feature
+/// is compiled in, so the flag degrades to a warning rather than a hard error.
+#[cfg(feature = "embeddings")]
+fn load_embeddings(dir: &str, questions: &[Question]) -> EmbeddingMap {
+    let enc = embedder::Embedder::load(std::path::Path::new(dir))
+        .unwrap_or_else(|e| panic!("failed to load embedder from {dir}: {e}"));
+    let texts = questions.iter().flat_map(|q| {
+        q.haystack_sessions
+            .iter()
+            .flatten()
+            .map(|t| t.content.clone())
+            .chain(std::iter::once(q.question.clone()))
+    });
+    enc.encode_unique(texts)
+        .unwrap_or_else(|e| panic!("embedding failed: {e}"))
+}
+
+#[cfg(not(feature = "embeddings"))]
+fn load_embeddings(_dir: &str, _questions: &[Question]) -> EmbeddingMap {
+    EmbeddingMap::new()
+}
+
+/// Evaluate every question under one retrieval mode and print its report.
+fn run_mode(
+    questions: &[Question],
+    mode: Mode,
+    embeddings: Option<&EmbeddingMap>,
+    profile: &DatasetProfile,
+) {
+    let total = questions.len();
     let mut overall = Metrics::default();
     let mut by_type: HashMap<String, Metrics> = HashMap::new();
 
@@ -444,7 +1110,7 @@ fn main() {
             eprint!("\r  [{}/{}] evaluating...", i + 1, total);
         }
 
-        let result = evaluate_question(q, 10);
+        let result = evaluate_question(q, 10, mode, embeddings);
 
         let is_abs = q.question_type.ends_with("_abs");
         let base_type = if is_abs {
@@ -500,6 +1166,14 @@ fn main() {
                 entry.rr_turn += rr;
                 overall.rr_turn += rr;
             }
+            if let Some(newest_first) = result.newest_gold_first {
+                entry.newest_gold_total += 1;
+                overall.newest_gold_total += 1;
+                if newest_first {
+                    entry.newest_gold_first += 1;
+                    overall.newest_gold_first += 1;
+                }
+            }
 
             let ns = result.latency.as_nanos() as u64;
             entry.latency_ns.push(ns);
@@ -509,5 +1183,32 @@ fn main() {
 
     eprintln!("\r  [{total}/{total}] done.          ");
     eprintln!();
-    print_report(&overall, &by_type);
+    print_report(&overall, &by_type, profile, mode);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::session_time;
+
+    #[test]
+    fn session_dates_parse_to_the_right_instant() {
+        // Reference values from Python's datetime, UTC.
+        for (date, expected) in [
+            ("2023/05/25 (Thu) 20:21", 1_685_046_060.0),
+            ("1970/01/01 (Thu) 00:00", 0.0),
+            ("2000/02/29 (Tue) 12:00", 951_825_600.0),
+            ("2023/12/31 (Sun) 23:59", 1_704_067_140.0),
+            ("2024/03/01 (Fri) 00:00", 1_709_251_200.0),
+        ] {
+            assert_eq!(session_time(date, 0), expected, "{date}");
+        }
+    }
+
+    #[test]
+    fn unparseable_dates_fall_back_to_position_order() {
+        let a = session_time("not a date", 0);
+        let b = session_time("", 1);
+        let c = session_time("2023/13/99 (???) 99:99", 2);
+        assert!(a < b && b < c, "fallback must preserve session order");
+    }
 }

crates/clawhdf5-bench/src/bin/longmemeval_bench/embedder.rs

@@ -0,0 +1,170 @@
+//! Optional MiniLM sentence embedder for the LongMemEval bench.
+//!
+//! Compiled only under the `embeddings` feature, so the default build of a
+//! project that prides itself on having no heavyweight dependencies stays
+//! exactly as it was. Without it the bench runs BM25-only, as it always has.
+//!
+//! Loads `sentence-transformers/all-MiniLM-L6-v2` — the same checkpoint
+//! omni-cortex uses — and produces 384-d mean-pooled, L2-normalised sentence
+//! embeddings, which is the published recipe for this model (mean over token
+//! states weighted by the attention mask, *not* the `[CLS]` pooler output).
+
+use std::collections::HashMap;
+use std::path::Path;
+
+use candle_core::{DType, Device, Tensor};
+use candle_nn::VarBuilder;
+use candle_transformers::models::bert::{BertModel, Config, HiddenAct};
+use tokenizers::Tokenizer;
+
+/// Sequences encoded per forward pass. Larger batches amortise the transformer
+/// call; 64 keeps peak memory modest while still saturating a CPU.
+const BATCH: usize = 64;
+
+/// A loaded MiniLM encoder.
+pub struct Embedder {
+    model: BertModel,
+    tokenizer: Tokenizer,
+    device: Device,
+}
+
+impl Embedder {
+    /// Load from a directory holding `model.safetensors` and `tokenizer.json`.
+    ///
+    /// `config.json` is read when present; otherwise the published MiniLM-L6-v2
+    /// architecture constants are used, which are pinned rather than guessed.
+    pub fn load(dir: &Path) -> Result<Self, Box<dyn std::error::Error>> {
+        // CUDA when the feature is on and a device is actually present; the CPU
+        // path is correct but roughly two orders of magnitude slower, which is
+        // the difference between minutes and most of a day on the full haystack.
+        let device = match Device::new_cuda(0) {
+            Ok(d) => {
+                eprintln!("Embedder: CUDA device 0");
+                d
+            }
+            Err(e) => {
+                // Loud, because the CPU path is correct but ~100x slower: the
+                // full longmemeval_s haystack is minutes on a GPU and most of a
+                // day on 8 cores. Silently falling back looks like a hang.
+                eprintln!("Embedder: CPU — CUDA unavailable ({e})");
+                eprintln!(
+                    "  WARNING: CPU embedding is roughly two orders of magnitude slower.\n                       Expect minutes for longmemeval_oracle and many hours for the full\n                       longmemeval_s haystack. For the GPU path, rebuild with\n                       `--features embeddings-cuda` and make sure `nvcc` is on PATH\n                       (it ships in /usr/local/cuda/bin, which is often not exported)."
+                );
+                Device::Cpu
+            }
+        };
+        let weights = dir.join("model.safetensors");
+        let tok_path = dir.join("tokenizer.json");
+
+        let config: Config = match std::fs::read_to_string(dir.join("config.json")) {
+            Ok(raw) => serde_json::from_str(&raw)?,
+            Err(_) => Config {
+                vocab_size: 30_522,
+                hidden_size: 384,
+                num_hidden_layers: 6,
+                num_attention_heads: 12,
+                intermediate_size: 1_536,
+                hidden_act: HiddenAct::Gelu,
+                hidden_dropout_prob: 0.0,
+                max_position_embeddings: 512,
+                type_vocab_size: 2,
+                initializer_range: 0.02,
+                layer_norm_eps: 1e-12,
+                pad_token_id: 0,
+                position_embedding_type: Default::default(),
+                use_cache: false,
+                classifier_dropout: None,
+                model_type: None,
+            },
+        };
+
+        let vb = unsafe { VarBuilder::from_mmaped_safetensors(&[weights], DType::F32, &device)? };
+        let model = BertModel::load(vb, &config)?;
+        let tokenizer = Tokenizer::from_file(&tok_path).map_err(|e| e.to_string())?;
+
+        Ok(Self {
+            model,
+            tokenizer,
+            device,
+        })
+    }
+
+    /// Encode `texts` into 384-d unit vectors, in order.
+    fn encode_batch(&self, texts: &[&str]) -> Result<Vec<Vec<f32>>, Box<dyn std::error::Error>> {
+        let mut tk = self.tokenizer.clone();
+        let tk = tk
+            .with_padding(Some(tokenizers::PaddingParams::default()))
+            .with_truncation(Some(tokenizers::TruncationParams {
+                max_length: 512,
+                ..Default::default()
+            }))
+            .map_err(|e| e.to_string())?;
+        let encodings = tk
+            .encode_batch(texts.to_vec(), true)
+            .map_err(|e| e.to_string())?;
+
+        let ids: Vec<u32> = encodings
+            .iter()
+            .flat_map(|e| e.get_ids().to_vec())
+            .collect();
+        let mask: Vec<u32> = encodings
+            .iter()
+            .flat_map(|e| e.get_attention_mask().to_vec())
+            .collect();
+        let (b, l) = (encodings.len(), encodings[0].get_ids().len());
+
+        let ids = Tensor::from_vec(ids, (b, l), &self.device)?;
+        let mask = Tensor::from_vec(mask, (b, l), &self.device)?;
+        let type_ids = ids.zeros_like()?;
+
+        let hidden = self.model.forward(&ids, &type_ids, Some(&mask))?;
+
+        // Mean-pool over real tokens only: sum(hidden * mask) / sum(mask).
+        let mask_f = mask.to_dtype(DType::F32)?.unsqueeze(2)?;
+        let summed = hidden.broadcast_mul(&mask_f)?.sum(1)?;
+        let counts = mask_f.sum(1)?.clamp(1e-9, f32::INFINITY)?;
+        let pooled = summed.broadcast_div(&counts)?;
+
+        // L2-normalise so cosine similarity is a plain dot product.
+        let norm = pooled
+            .sqr()?
+            .sum_keepdim(1)?
+            .sqrt()?
+            .clamp(1e-12, f32::INFINITY)?;
+        let normed = pooled.broadcast_div(&norm)?;
+
+        Ok(normed.to_vec2::<f32>()?)
+    }
+
+    /// Encode every distinct string in `texts` once, returning a lookup map.
+    ///
+    /// LongMemEval's haystack sessions are drawn from a shared pool, so the same
+    /// turn text recurs across many questions. Deduplicating before encoding is
+    /// the difference between encoding the corpus once and encoding it per
+    /// question.
+    pub fn encode_unique(
+        &self,
+        texts: impl IntoIterator<Item = String>,
+    ) -> Result<HashMap<String, Vec<f32>>, Box<dyn std::error::Error>> {
+        let mut unique: Vec<String> = texts.into_iter().collect();
+        unique.sort_unstable();
+        unique.dedup();
+
+        let total = unique.len();
+        eprintln!("Embedding {total} unique texts with MiniLM (batch {BATCH})...");
+
+        let mut out = HashMap::with_capacity(total);
+        for (n, chunk) in unique.chunks(BATCH).enumerate() {
+            let refs: Vec<&str> = chunk.iter().map(String::as_str).collect();
+            let vecs = self.encode_batch(&refs)?;
+            for (text, v) in chunk.iter().zip(vecs) {
+                out.insert(text.clone(), v);
+            }
+            if n % 50 == 0 {
+                eprint!("\r  [{}/{}] embedded...", (n * BATCH).min(total), total);
+            }
+        }
+        eprintln!("\r  [{total}/{total}] embedded.          ");
+        Ok(out)
+    }
+}

crates/clawhdf5-bench/src/bin/read_harness.rs

@@ -0,0 +1,176 @@
+//! HDF5 read-path measurement harness: full reads vs. hyperslab selections on
+//! a chunked 2-D dataset, compressed and uncompressed, plus a contiguous one.
+//!
+//! The question it answers for every read-path change: does the cost of a
+//! selection scale with the *selection*, or with the whole dataset?
+//!
+//! ```text
+//! cargo run --release -p clawhdf5-bench --bin read_harness
+//! cargo run --release -p clawhdf5-bench --bin read_harness -- --large   # 512 MB
+//! ```
+
+use std::time::{Duration, Instant};
+
+use clawhdf5::{File, FileBuilder};
+use clawhdf5_format::selection::Selection;
+
+const CHUNK: u64 = 256;
+
+struct Layout {
+    name: &'static str,
+    chunked: bool,
+    deflate: bool,
+}
+
+const LAYOUTS: [Layout; 3] = [
+    Layout {
+        name: "chunked + deflate",
+        chunked: true,
+        deflate: true,
+    },
+    Layout {
+        name: "chunked",
+        chunked: true,
+        deflate: false,
+    },
+    Layout {
+        name: "contiguous",
+        chunked: false,
+        deflate: false,
+    },
+];
+
+/// Smooth-ish, compressible data whose value encodes its position, so a read
+/// can be verified exactly.
+fn value(row: u64, col: u64) -> f64 {
+    (row * 100_003 + col) as f64 * 0.5
+}
+
+fn write_file(path: &std::path::Path, rows: u64, cols: u64) {
+    let data: Vec<f64> = (0..rows)
+        .flat_map(|r| (0..cols).map(move |c| value(r, c)))
+        .collect();
+    let mut builder = FileBuilder::new();
+    for (i, layout) in LAYOUTS.iter().enumerate() {
+        let ds = builder.create_dataset(&format!("d{i}"));
+        ds.with_f64_data(&data).with_shape(&[rows, cols]);
+        if layout.chunked {
+            ds.with_chunks(&[CHUNK, CHUNK]);
+        }
+        if layout.deflate {
+            ds.with_deflate(4);
+        }
+    }
+    builder.write(path).unwrap();
+}
+
+fn median(mut samples: Vec<Duration>) -> Duration {
+    samples.sort();
+    samples[samples.len() / 2]
+}
+
+fn time<T>(reps: usize, mut f: impl FnMut() -> T) -> Duration {
+    median(
+        (0..reps)
+            .map(|_| {
+                let t = Instant::now();
+                std::hint::black_box(f());
+                t.elapsed()
+            })
+            .collect(),
+    )
+}
+
+fn slab(start: [u64; 2], count: [u64; 2]) -> Selection {
+    Selection::Hyperslab {
+        start: start.to_vec(),
+        stride: vec![1, 1],
+        count: count.to_vec(),
+        block: vec![1, 1],
+    }
+}
+
+fn main() {
+    let large = std::env::args().any(|a| a == "--large");
+    let (rows, cols) = if large { (8192, 8192) } else { (4096, 2048) };
+    let total_mb = (rows * cols * 8) as f64 / (1 << 20) as f64;
+    if cfg!(debug_assertions) {
+        eprintln!("warning: debug build — numbers are meaningless. Use --release.");
+    }
+
+    let dir = tempfile::TempDir::new().unwrap();
+    let path = dir.path().join("read_harness.h5");
+    write_file(&path, rows, cols);
+    let file_mb = std::fs::metadata(&path).unwrap().len() as f64 / (1 << 20) as f64;
+
+    println!("## Read harness");
+    println!(
+        "\n{rows} x {cols} f64 ({total_mb:.0} MB per dataset), chunks {CHUNK} x {CHUNK}, file {file_mb:.0} MB\n"
+    );
+
+    // (label, selection, elements selected)
+    let selections: Vec<(&str, Selection, u64)> = vec![
+        (
+            "64 x 64 window (1 chunk)",
+            slab([300, 300], [64, 64]),
+            64 * 64,
+        ),
+        (
+            "512 x 512 window (4-9 chunks)",
+            slab([1000, 700], [512, 512]),
+            512 * 512,
+        ),
+        ("one row", slab([rows / 2, 0], [1, cols]), cols),
+        ("one column", slab([0, cols / 2], [rows, 1]), rows),
+    ];
+
+    println!("| layout | read | selected | time ms | MB/s of selection | vs full read |");
+    println!("|---|---|---:|---:|---:|---:|");
+    for (i, layout) in LAYOUTS.iter().enumerate() {
+        // Fresh handle per layout so one dataset's cached chunks don't help
+        // (or evict) another's.
+        let file = File::open(&path).unwrap();
+        let ds = file.dataset(&format!("d{i}")).unwrap();
+
+        let full_cold = time(1, || ds.read_f64().unwrap());
+        let full = time(3, || ds.read_f64().unwrap());
+        println!(
+            "| {} | full (first) | {total_mb:.0} MB | {:.1} | {:.0} | |",
+            layout.name,
+            full_cold.as_secs_f64() * 1e3,
+            total_mb / full_cold.as_secs_f64()
+        );
+        println!(
+            "| {} | full (repeat) | {total_mb:.0} MB | {:.1} | {:.0} | 1.00x |",
+            layout.name,
+            full.as_secs_f64() * 1e3,
+            total_mb / full.as_secs_f64()
+        );
+
+        for (label, selection, elements) in &selections {
+            // A fresh handle again: measure the selection on its own, not
+            // served from chunks the full read just cached.
+            let file = File::open(&path).unwrap();
+            let ds = file.dataset(&format!("d{i}")).unwrap();
+            let got = ds.read_f64_selection(selection).unwrap();
+            assert_eq!(got.len() as u64, *elements, "{label}");
+            if let Selection::Hyperslab { start, .. } = selection {
+                assert_eq!(got[0], value(start[0], start[1]), "{label}: wrong data");
+            }
+            let took = time(5, || {
+                let file = File::open(&path).unwrap();
+                let ds = file.dataset(&format!("d{i}")).unwrap();
+                ds.read_f64_selection(selection).unwrap()
+            });
+            let mb = (*elements * 8) as f64 / (1 << 20) as f64;
+            println!(
+                "| {} | {label} | {:.2} MB | {:.2} | {:.0} | {:.3}x |",
+                layout.name,
+                mb,
+                took.as_secs_f64() * 1e3,
+                mb / took.as_secs_f64(),
+                took.as_secs_f64() / full_cold.as_secs_f64()
+            );
+        }
+    }
+}

crates/clawhdf5-bench/src/bin/search_harness.rs

@@ -0,0 +1,710 @@
+//! Search measurement harness: recall vs. speed for the HNSW index, and
+//! end-to-end `hybrid_search` latency as the store grows.
+//!
+//! Every search-path change should be justified by a before/after run of this
+//! binary. It reports, for deterministic synthetic data:
+//!
+//! * **ANN** — index build time, and for each `ef`: recall@10 against an exact
+//!   brute-force scan, queries/second, and p50/p99 latency.
+//! * **End to end** — `HDF5Memory`: ingest time, checkpoint time, `open()`
+//!   time, the one-off cold index build (first query ever), the first query
+//!   after a reopen, and steady-state `hybrid_search` p50/p99 at each size.
+//!
+//! Data is *clustered* (points = cluster centre + noise, unit-normalised), not
+//! uniform: uniform random high-dimensional vectors are nearly equidistant,
+//! which makes recall numbers meaningless and is nothing like embeddings.
+//!
+//! ```text
+//! cargo run --release -p clawhdf5-bench --bin search_harness            # 1K, 10K
+//! cargo run --release -p clawhdf5-bench --bin search_harness -- --full  # + 100K
+//! cargo run --release -p clawhdf5-bench --bin search_harness -- --json out.json
+//! cargo run --release -p clawhdf5-bench --bin search_harness -- --ann-only --uniform
+//! ```
+
+use std::time::{Duration, Instant};
+
+use clawhdf5_agent::{AgentMemory, HDF5Memory, MemoryConfig, MemoryEntry};
+use clawhdf5_ann::{DistanceMetric, HnswIndex, Storage};
+
+const DIM: usize = 384;
+const K: usize = 10;
+const N_QUERIES: usize = 200;
+const HNSW_M: usize = 16;
+const HNSW_EF_CONSTRUCTION: usize = 64;
+const EF_VALUES: [usize; 5] = [16, 32, 64, 128, 256];
+
+// ---------------------------------------------------------------------------
+// Deterministic data
+// ---------------------------------------------------------------------------
+
+struct Rng(u64);
+
+impl Rng {
+    fn next_u64(&mut self) -> u64 {
+        self.0 = self.0.wrapping_add(0x9E37_79B9_7F4A_7C15);
+        let mut z = self.0;
+        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+
+    /// Uniform in [0, 1).
+    fn unit(&mut self) -> f32 {
+        (self.next_u64() >> 40) as f32 / (1u64 << 24) as f32
+    }
+
+    /// Approximately standard normal (sum of uniforms).
+    fn gauss(&mut self) -> f32 {
+        let sum: f32 = (0..6).map(|_| self.unit()).sum();
+        (sum - 3.0) * std::f32::consts::SQRT_2
+    }
+
+    fn below(&mut self, n: usize) -> usize {
+        (self.next_u64() % n as u64) as usize
+    }
+}
+
+fn normalize(v: &mut [f32]) {
+    let norm = v.iter().map(|x| x * x).sum::<f32>().sqrt();
+    if norm > 0.0 {
+        v.iter_mut().for_each(|x| *x /= norm);
+    }
+}
+
+struct Dataset {
+    vectors: Vec<Vec<f32>>,
+    queries: Vec<Vec<f32>>,
+    /// Cluster id of each vector (used to give records topical text).
+    cluster_of: Vec<usize>,
+    query_cluster: Vec<usize>,
+}
+
+/// `--uniform`: isotropic random unit vectors instead of clusters. Not a
+/// realistic workload, but a useful second distribution — a recall problem
+/// that appears only on clustered data points at graph connectivity.
+static UNIFORM: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+
+/// `--int8`: build the HNSW index over int8-quantised vectors (a quarter of
+/// the memory) instead of f32, to price the recall it costs.
+static INT8: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+
+/// `--rerank`: re-score the candidate pool against the exact vectors before
+/// taking the top K.
+static RERANK: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+
+fn storage() -> Storage {
+    if INT8.load(std::sync::atomic::Ordering::Relaxed) {
+        Storage::Int8
+    } else {
+        Storage::Float32
+    }
+}
+
+fn make_dataset(n: usize, seed: u64) -> Dataset {
+    let mut rng = Rng(seed);
+    if UNIFORM.load(std::sync::atomic::Ordering::Relaxed) {
+        let random_unit = |rng: &mut Rng| {
+            let mut v: Vec<f32> = (0..DIM).map(|_| rng.gauss()).collect();
+            normalize(&mut v);
+            v
+        };
+        return Dataset {
+            vectors: (0..n).map(|_| random_unit(&mut rng)).collect(),
+            queries: (0..N_QUERIES).map(|_| random_unit(&mut rng)).collect(),
+            cluster_of: vec![0; n],
+            query_cluster: vec![0; N_QUERIES],
+        };
+    }
+    let n_clusters = (n / 100).clamp(8, 512);
+    let centres: Vec<Vec<f32>> = (0..n_clusters)
+        .map(|_| {
+            let mut c: Vec<f32> = (0..DIM).map(|_| rng.gauss()).collect();
+            normalize(&mut c);
+            c
+        })
+        .collect();
+    let point = |rng: &mut Rng, cluster: usize| {
+        // Noise comparable to the centre's per-dimension magnitude, so
+        // clusters overlap and the nearest neighbours are non-trivial.
+        let scale = 0.6 / (DIM as f32).sqrt();
+        let mut v: Vec<f32> = centres[cluster]
+            .iter()
+            .map(|c| c + rng.gauss() * scale)
+            .collect();
+        normalize(&mut v);
+        v
+    };
+    let mut vectors = Vec::with_capacity(n);
+    let mut cluster_of = Vec::with_capacity(n);
+    for _ in 0..n {
+        let c = rng.below(n_clusters);
+        vectors.push(point(&mut rng, c));
+        cluster_of.push(c);
+    }
+    let mut queries = Vec::with_capacity(N_QUERIES);
+    let mut query_cluster = Vec::with_capacity(N_QUERIES);
+    for _ in 0..N_QUERIES {
+        let c = rng.below(n_clusters);
+        queries.push(point(&mut rng, c));
+        query_cluster.push(c);
+    }
+    Dataset {
+        vectors,
+        queries,
+        cluster_of,
+        query_cluster,
+    }
+}
+
+const WORDS: &[&str] = &[
+    "deploy", "latency", "cache", "schema", "index", "vector", "memory", "agent", "kernel",
+    "buffer", "socket", "thread", "tensor", "gradient", "ledger", "invoice", "meeting", "roadmap",
+    "customer", "contract", "sensor", "orbit", "protein", "genome", "harbor", "bridge", "engine",
+    "battery", "harvest", "weather", "museum", "recipe",
+];
+
+/// Text whose vocabulary is biased by cluster, so keyword and vector signals
+/// agree the way they do for real embedded text.
+fn text_for(cluster: usize, i: usize, rng: &mut Rng) -> String {
+    let topic = [
+        WORDS[cluster % WORDS.len()],
+        WORDS[(cluster / 7 + 3) % WORDS.len()],
+    ];
+    let mut words = Vec::with_capacity(14);
+    for j in 0..14 {
+        if j % 3 == 0 {
+            words.push(topic[j / 3 % 2]);
+        } else {
+            words.push(WORDS[rng.below(WORDS.len())]);
+        }
+    }
+    format!("record {i}: {}", words.join(" "))
+}
+
+// ---------------------------------------------------------------------------
+// Measurement helpers
+// ---------------------------------------------------------------------------
+
+/// Exact cosine distance between unit-length vectors.
+fn exact_dist(a: &[f32], b: &[f32]) -> f32 {
+    1.0 - a.iter().zip(b).map(|(x, y)| x * y).sum::<f32>()
+}
+
+fn exact_top_k(vectors: &[Vec<f32>], query: &[f32], k: usize) -> Vec<usize> {
+    // Vectors are unit length, so cosine order == dot-product order.
+    let mut scored: Vec<(usize, f32)> = vectors
+        .iter()
+        .enumerate()
+        .map(|(i, v)| (i, v.iter().zip(query).map(|(a, b)| a * b).sum()))
+        .collect();
+    scored.sort_by(|a, b| b.1.total_cmp(&a.1).then(a.0.cmp(&b.0)));
+    scored.truncate(k);
+    scored.into_iter().map(|(i, _)| i).collect()
+}
+
+struct Latency {
+    p50: Duration,
+    p99: Duration,
+    qps: f64,
+}
+
+fn summarize(mut samples: Vec<Duration>) -> Latency {
+    samples.sort();
+    let total: Duration = samples.iter().sum();
+    let at = |q: f64| samples[((samples.len() - 1) as f64 * q).round() as usize];
+    Latency {
+        p50: at(0.50),
+        p99: at(0.99),
+        qps: samples.len() as f64 / total.as_secs_f64(),
+    }
+}
+
+/// Counts live heap bytes, so a structure's cost can be measured by
+/// difference.
+///
+/// RSS cannot do this from inside one process: freeing a large structure
+/// returns its pages to the allocator's pool rather than to the OS, so
+/// allocating the next one shows no change. Measured that way, a store that
+/// holds the corpus twice and one that holds it once look identical.
+struct CountingAllocator;
+
+static LIVE_BYTES: std::sync::atomic::AtomicI64 = std::sync::atomic::AtomicI64::new(0);
+
+/// High-water mark of [`LIVE_BYTES`] since it was last reset.
+///
+/// Live bytes at a checkpoint cannot see a buffer that was allocated and
+/// freed in between, and that is exactly the shape of a transient copy —
+/// which still has to fit in memory while it exists.
+static PEAK_BYTES: std::sync::atomic::AtomicI64 = std::sync::atomic::AtomicI64::new(0);
+
+fn note_peak(live: i64) {
+    PEAK_BYTES.fetch_max(live, std::sync::atomic::Ordering::Relaxed);
+}
+
+// SAFETY: every method forwards to the system allocator with the same layout
+// it was given, and only adds bookkeeping around it.
+unsafe impl std::alloc::GlobalAlloc for CountingAllocator {
+    unsafe fn alloc(&self, layout: std::alloc::Layout) -> *mut u8 {
+        let ptr = unsafe { std::alloc::System.alloc(layout) };
+        if !ptr.is_null() {
+            let live = LIVE_BYTES
+                .fetch_add(layout.size() as i64, std::sync::atomic::Ordering::Relaxed)
+                + layout.size() as i64;
+            note_peak(live);
+        }
+        ptr
+    }
+
+    unsafe fn dealloc(&self, ptr: *mut u8, layout: std::alloc::Layout) {
+        LIVE_BYTES.fetch_sub(layout.size() as i64, std::sync::atomic::Ordering::Relaxed);
+        unsafe { std::alloc::System.dealloc(ptr, layout) }
+    }
+
+    unsafe fn realloc(&self, ptr: *mut u8, layout: std::alloc::Layout, new_size: usize) -> *mut u8 {
+        let new_ptr = unsafe { std::alloc::System.realloc(ptr, layout, new_size) };
+        if !new_ptr.is_null() {
+            let delta = new_size as i64 - layout.size() as i64;
+            let live = LIVE_BYTES.fetch_add(delta, std::sync::atomic::Ordering::Relaxed) + delta;
+            note_peak(live);
+        }
+        new_ptr
+    }
+}
+
+#[global_allocator]
+static ALLOCATOR: CountingAllocator = CountingAllocator;
+
+/// Live heap bytes right now.
+fn heap_bytes() -> u64 {
+    LIVE_BYTES.load(std::sync::atomic::Ordering::Relaxed).max(0) as u64
+}
+
+/// Start watching for a new high-water mark from the current live total.
+fn reset_peak() {
+    PEAK_BYTES.store(
+        LIVE_BYTES.load(std::sync::atomic::Ordering::Relaxed),
+        std::sync::atomic::Ordering::Relaxed,
+    );
+}
+
+/// The highest live total seen since [`reset_peak`].
+fn peak_bytes() -> u64 {
+    PEAK_BYTES.load(std::sync::atomic::Ordering::Relaxed).max(0) as u64
+}
+
+fn mib(bytes: u64) -> f64 {
+    bytes as f64 / (1 << 20) as f64
+}
+
+fn micros(d: Duration) -> f64 {
+    d.as_secs_f64() * 1e6
+}
+
+fn millis(d: Duration) -> f64 {
+    d.as_secs_f64() * 1e3
+}
+
+// ---------------------------------------------------------------------------
+// ANN: recall vs speed
+// ---------------------------------------------------------------------------
+
+fn bench_ann(n: usize, json: &mut Vec<serde_json::Value>) {
+    let data = make_dataset(n, 0xA11CE ^ n as u64);
+    let truth: Vec<Vec<usize>> = data
+        .queries
+        .iter()
+        .map(|q| exact_top_k(&data.vectors, q, K))
+        .collect();
+
+    let started = Instant::now();
+    let index = HnswIndex::build_with(
+        &data.vectors,
+        HNSW_M,
+        HNSW_EF_CONSTRUCTION,
+        DistanceMetric::Cosine,
+        storage(),
+    );
+    let build = started.elapsed();
+
+    // Exact scan baseline, for scale.
+    let exact = summarize(
+        data.queries
+            .iter()
+            .map(|q| {
+                let t = Instant::now();
+                std::hint::black_box(exact_top_k(&data.vectors, q, K));
+                t.elapsed()
+            })
+            .collect(),
+    );
+
+    println!(
+        "\n### HNSW, N = {n}, dim = {DIM}, M = {HNSW_M}, ef_construction = {HNSW_EF_CONSTRUCTION}, storage = {:?}\n",
+        index.storage()
+    );
+    println!(
+        "build: {:.1} ms ({:.0} vectors/s) · exact scan: {:.0} QPS, p50 {:.0} µs\n",
+        millis(build),
+        n as f64 / build.as_secs_f64(),
+        exact.qps,
+        micros(exact.p50)
+    );
+    println!("| ef | recall@{K} | QPS | p50 µs | p99 µs |");
+    println!("|---:|---:|---:|---:|---:|");
+    // With a quantised index the distances it returns are approximate, so
+    // the candidates are re-scored against the exact vectors the caller
+    // already holds (in the agent, the embedding cache) before taking the
+    // top K. `--rerank` prices that: it costs one exact distance per
+    // candidate and is what decides whether int8 is usable.
+    let rerank = RERANK.load(std::sync::atomic::Ordering::Relaxed);
+    let pool = if rerank { K * 4 } else { K };
+    for ef in EF_VALUES {
+        let mut hits = 0usize;
+        let mut samples = Vec::with_capacity(data.queries.len());
+        for (q, want) in data.queries.iter().zip(&truth) {
+            let t = Instant::now();
+            let mut got = index.search(q, pool, ef.max(pool));
+            if rerank {
+                for cand in &mut got {
+                    cand.1 = exact_dist(&data.vectors[cand.0], q);
+                }
+                got.select_nth_unstable_by(K - 1, |a, b| a.1.total_cmp(&b.1));
+                got.truncate(K);
+            }
+            samples.push(t.elapsed());
+            hits += got.iter().filter(|(id, _)| want.contains(id)).count();
+        }
+        let recall = hits as f64 / (K * data.queries.len()) as f64;
+        let lat = summarize(samples);
+        println!(
+            "| {ef} | {recall:.4} | {:.0} | {:.0} | {:.0} |",
+            lat.qps,
+            micros(lat.p50),
+            micros(lat.p99)
+        );
+        json.push(serde_json::json!({
+            "bench": "hnsw", "n": n, "ef": ef, "recall_at_10": recall,
+            "qps": lat.qps, "p50_us": micros(lat.p50), "p99_us": micros(lat.p99),
+            "build_ms": millis(build),
+        }));
+    }
+}
+
+// ---------------------------------------------------------------------------
+// End to end: HDF5Memory::hybrid_search
+// ---------------------------------------------------------------------------
+
+fn bench_end_to_end(n: usize, json: &mut Vec<serde_json::Value>) {
+    let data = make_dataset(n, 0xE2E ^ n as u64);
+    let dir = tempfile::TempDir::new().unwrap();
+    let path = dir.path().join("store.h5");
+    let mut rng = Rng(7);
+
+    let entries: Vec<MemoryEntry> = data
+        .vectors
+        .iter()
+        .enumerate()
+        .map(|(i, v)| MemoryEntry {
+            chunk: text_for(data.cluster_of[i], i, &mut rng),
+            embedding: v.clone(),
+            source_channel: "bench".into(),
+            timestamp: i as f64,
+            session_id: format!("s{}", i % 50),
+            tags: format!("t{i}"),
+        })
+        .collect();
+    let query_texts: Vec<String> = data
+        .query_cluster
+        .iter()
+        .enumerate()
+        .map(|(i, c)| text_for(*c, i, &mut rng))
+        .collect();
+
+    let mut mem = HDF5Memory::create(MemoryConfig::new(path.clone(), "bench", DIM)).unwrap();
+    let t = Instant::now();
+    mem.save_batch(entries).unwrap();
+    let ingest = t.elapsed();
+    // The very first query builds the vector and keyword indexes from
+    // scratch. It happens once per store, not once per session: the checkpoint
+    // below saves the vector index, so a later `open()` reloads it.
+    let t = Instant::now();
+    std::hint::black_box(mem.hybrid_search(&data.queries[1], &query_texts[1], 0.7, 0.3, K));
+    let cold_build = t.elapsed();
+
+    let t = Instant::now();
+    mem.flush_wal().unwrap();
+    let checkpoint = t.elapsed();
+    drop(mem);
+
+    let t = Instant::now();
+    let mut mem = HDF5Memory::open(&path).unwrap();
+    let open = t.elapsed();
+
+    // The first query after open pays for whatever is rebuilt lazily.
+    let t = Instant::now();
+    std::hint::black_box(mem.hybrid_search(&data.queries[0], &query_texts[0], 0.7, 0.3, K));
+    let first_query = t.elapsed();
+
+    // Fewer steady-state samples at large N: each query is currently O(N).
+    let samples_wanted = if n >= 100_000 { 20 } else { N_QUERIES.min(100) };
+    let steady = summarize(
+        (0..samples_wanted)
+            .map(|i| {
+                let t = Instant::now();
+                std::hint::black_box(mem.hybrid_search(
+                    &data.queries[i % N_QUERIES],
+                    &query_texts[i % N_QUERIES],
+                    0.7,
+                    0.3,
+                    K,
+                ));
+                t.elapsed()
+            })
+            .collect(),
+    );
+
+    println!(
+        "| {n} | {:.0} | {:.0} | {:.1} | {:.1} | {:.1} | {:.2} | {:.2} | {:.1} |",
+        millis(ingest),
+        millis(cold_build),
+        millis(checkpoint),
+        millis(open),
+        millis(first_query),
+        millis(steady.p50),
+        millis(steady.p99),
+        steady.qps
+    );
+    json.push(serde_json::json!({
+        "bench": "hybrid_search", "n": n,
+        "ingest_ms": millis(ingest), "cold_index_build_ms": millis(cold_build),
+        "checkpoint_ms": millis(checkpoint),
+        "open_ms": millis(open), "first_query_ms": millis(first_query),
+        "p50_ms": millis(steady.p50), "p99_ms": millis(steady.p99), "qps": steady.qps,
+    }));
+}
+
+// ---------------------------------------------------------------------------
+// Fusion study: does capping the keyword candidate pool change the ranking?
+// ---------------------------------------------------------------------------
+
+/// `hybrid_search` min-max normalises each signal over the candidates it is
+/// given. The vector stage supplies a pool of `max(8k, 64)`; the keyword stage
+/// supplies *every* matching record, which is what now dominates query time.
+/// This compares the current fusion with one whose keyword stage is capped to
+/// a pool, reporting how often the final top-k agree and what each costs.
+fn fusion_study(n: usize) {
+    use clawhdf5_agent::bm25::BM25Index;
+    use clawhdf5_agent::hybrid::merge_vector_keyword;
+
+    let data = make_dataset(n, 0xE2E ^ n as u64);
+    let mut rng = Rng(7);
+    let texts: Vec<String> = (0..n)
+        .map(|i| text_for(data.cluster_of[i], i, &mut rng))
+        .collect();
+    let query_texts: Vec<String> = data
+        .query_cluster
+        .iter()
+        .enumerate()
+        .map(|(i, c)| text_for(*c, i, &mut rng))
+        .collect();
+    let bm25 = BM25Index::build(&texts, &vec![0u8; n]);
+    let index = HnswIndex::build_with(
+        &data.vectors,
+        HNSW_M,
+        HNSW_EF_CONSTRUCTION,
+        DistanceMetric::Cosine,
+        storage(),
+    );
+
+    let vec_pool = (K * 8).max(64);
+    println!("\n### Fusion study, N = {n} (k = {K}, weights 0.7 / 0.3, vector pool {vec_pool})\n");
+    println!(
+        "| keyword pool | top-{K} overlap vs full | identical top-{K} | same #1 | keyword+merge µs |"
+    );
+    println!("|---:|---:|---:|---:|---:|");
+
+    let fuse = |q: usize, kw_pool: usize| -> (Vec<usize>, Duration) {
+        let vec_scores: Vec<(usize, f32)> = index
+            .search(&data.queries[q], vec_pool, vec_pool)
+            .into_iter()
+            .map(|(id, d)| (id, 1.0 - d))
+            .collect();
+        let t = Instant::now();
+        let kw = bm25.search(&query_texts[q], kw_pool);
+        let merged = merge_vector_keyword(vec_scores, kw, 0.7, 0.3, K);
+        let took = t.elapsed();
+        (merged.into_iter().map(|(id, _)| id).collect(), took)
+    };
+
+    let full: Vec<(Vec<usize>, Duration)> = (0..N_QUERIES).map(|q| fuse(q, n)).collect();
+    let full_time: Duration = full.iter().map(|f| f.1).sum();
+    println!(
+        "| all ({n}) | 1.0000 | 100.0% | 100.0% | {:.0} |",
+        micros(full_time) / N_QUERIES as f64
+    );
+    for pool in [vec_pool, vec_pool * 4, 1000] {
+        if pool >= n {
+            continue;
+        }
+        let (mut overlap, mut identical, mut same_first) = (0usize, 0usize, 0usize);
+        let mut time = Duration::ZERO;
+        for (q, (want, _)) in full.iter().enumerate() {
+            let (got, took) = fuse(q, pool);
+            time += took;
+            overlap += got.iter().filter(|id| want.contains(id)).count();
+            identical += usize::from(&got == want);
+            same_first += usize::from(got.first() == want.first());
+        }
+        println!(
+            "| {pool} | {:.4} | {:.1}% | {:.1}% | {:.0} |",
+            overlap as f64 / (K * N_QUERIES) as f64,
+            100.0 * identical as f64 / N_QUERIES as f64,
+            100.0 * same_first as f64 / N_QUERIES as f64,
+            micros(time) / N_QUERIES as f64
+        );
+    }
+}
+
+/// What an in-memory store costs, stage by stage. The vectors are the floor:
+/// everything above it is bookkeeping that could in principle be shared.
+fn bench_footprint(n: usize) {
+    let data = make_dataset(n, 0xF007 ^ n as u64);
+    let mut rng = Rng(11);
+    let dir = tempfile::TempDir::new().unwrap();
+    let path = dir.path().join("footprint.h5");
+
+    let base = heap_bytes();
+    let entries: Vec<MemoryEntry> = data
+        .vectors
+        .iter()
+        .enumerate()
+        .map(|(i, v)| MemoryEntry {
+            chunk: text_for(data.cluster_of[i], i, &mut rng),
+            embedding: v.clone(),
+            source_channel: "bench".into(),
+            timestamp: i as f64,
+            session_id: format!("s{}", i % 50),
+            tags: format!("t{i}"),
+        })
+        .collect();
+    let after_entries = heap_bytes();
+
+    let mut config = MemoryConfig::new(path, "bench", DIM);
+    config.quantized_index = INT8.load(std::sync::atomic::Ordering::Relaxed);
+    let mut mem = HDF5Memory::create(config).unwrap();
+    mem.save_batch(entries).unwrap();
+    let after_store = heap_bytes();
+
+    // First query builds the vector and keyword indexes.
+    std::hint::black_box(mem.hybrid_search(&data.queries[0], "record", 0.7, 0.3, K));
+    let after_indexes = heap_bytes();
+
+    // Reopening is the figure that matters for a long-lived process, and the
+    // only one RSS reports honestly: memory freed when the ingest buffers went
+    // away stays in the allocator's pool, so the stage deltas above understate
+    // what was given back.
+    let path = mem.config().path.clone();
+    drop(mem);
+    let before_open = heap_bytes();
+    reset_peak();
+    let reopened = HDF5Memory::open(&path).unwrap();
+    let after_open = heap_bytes();
+    let loaded = after_open.saturating_sub(before_open);
+    // Peak over the open, not just what it leaves behind: a buffer allocated
+    // and freed during the parse never shows up in the live total.
+    let peak = peak_bytes().saturating_sub(before_open);
+    drop(reopened);
+
+    let raw = (n * DIM * 4) as u64;
+    println!(
+        "| {n} | {:.0} | {:.0} | {:.0} | {:.0} | {:.0} | {:.0} | {:.2}x |",
+        mib(raw),
+        mib(after_entries.saturating_sub(base)),
+        mib(after_store.saturating_sub(after_entries)),
+        mib(after_indexes.saturating_sub(after_store)),
+        mib(loaded),
+        mib(peak),
+        loaded as f64 / raw as f64,
+    );
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let full = args.iter().any(|a| a == "--full");
+    let ann_only = args.iter().any(|a| a == "--ann-only");
+    if args.iter().any(|a| a == "--fusion-study") {
+        for &n in if full {
+            &[10_000, 100_000][..]
+        } else {
+            &[10_000][..]
+        } {
+            fusion_study(n);
+        }
+        return;
+    }
+    if args.iter().any(|a| a == "--int8") {
+        INT8.store(true, std::sync::atomic::Ordering::Relaxed);
+        println!("(int8-quantised index vectors)");
+    }
+    if args.iter().any(|a| a == "--rerank") {
+        RERANK.store(true, std::sync::atomic::Ordering::Relaxed);
+        println!("(candidates re-scored against exact vectors)");
+    }
+    if args.iter().any(|a| a == "--uniform") {
+        UNIFORM.store(true, std::sync::atomic::Ordering::Relaxed);
+        println!("(uniform random data)");
+    }
+    let json_path = args
+        .iter()
+        .position(|a| a == "--json")
+        .and_then(|i| args.get(i + 1))
+        .cloned();
+    let sizes: &[usize] = if full {
+        &[1_000, 10_000, 100_000]
+    } else {
+        &[1_000, 10_000]
+    };
+
+    if cfg!(debug_assertions) {
+        eprintln!("warning: debug build — numbers are meaningless. Use --release.");
+    }
+
+    let mut json = Vec::new();
+    println!("## Search harness");
+
+    if args.iter().any(|a| a == "--footprint") {
+        println!("\n### Resident memory, {DIM}-dim f32\n");
+        println!(
+            "| N | vectors (raw) | entries MiB | store MiB | indexes MiB | reopened MiB | peak during open MiB | reopened / raw |"
+        );
+        println!("|---:|---:|---:|---:|---:|---:|---:|---:|");
+        for &n in sizes {
+            bench_footprint(n);
+        }
+        return;
+    }
+    // `--e2e-only` skips the index benchmarks, so the end-to-end section runs
+    // in a process that has not already spun up a thread pool.
+    if !args.iter().any(|a| a == "--e2e-only") {
+        for &n in sizes {
+            bench_ann(n, &mut json);
+        }
+    }
+
+    if ann_only {
+        return;
+    }
+    println!("\n### End to end: `HDF5Memory::hybrid_search` (k = {K}, weights 0.7 / 0.3)\n");
+    println!(
+        "| N | ingest ms | cold index build ms | checkpoint ms | open ms | first query after open ms | p50 ms | p99 ms | QPS |"
+    );
+    println!("|---:|---:|---:|---:|---:|---:|---:|---:|---:|");
+    for &n in sizes {
+        bench_end_to_end(n, &mut json);
+    }
+
+    if let Some(path) = json_path {
+        std::fs::write(&path, serde_json::to_string_pretty(&json).unwrap()).unwrap();
+        eprintln!("wrote {path}");
+    }
+}

crates/clawhdf5-cli/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "clawhdf5-cli"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 license = "MIT"
 description = "CLI for clawhdf5 agent memory — create, save, search, recall, stats"
-repository = "https://github.com/redclawsystems/clawhdf5"
+repository = "https://git.redclaw.dev/quantumclaw/clawhdf5"
 keywords = ["hdf5", "ai", "memory", "agent", "cli"]
 categories = ["command-line-utilities", "science"]
 readme = "../../README.md"
@@ -14,7 +14,7 @@ name = "clawhdf5"
 path = "src/main.rs"
 
 [dependencies]
-clawhdf5-agent = { path = "../clawhdf5-agent", version = "2.1.0" }
+clawhdf5-agent = { path = "../clawhdf5-agent", version = "2.7.0" }
 clap = { version = "4", features = ["derive", "env"] }
 serde_json = "1"
-serde = { version = "1", features = ["derive"] }
+serde = { workspace = true }

crates/clawhdf5-cli/src/main.rs

@@ -28,6 +28,10 @@ enum Commands {
         /// Enable write-ahead log
         #[arg(long)]
         wal: bool,
+        /// Store the vector index's copy of the embeddings as int8, roughly
+        /// halving a loaded store's memory at about 13% fewer queries/second
+        #[arg(long)]
+        quantized_index: bool,
     },
     /// Save a memory entry (reads JSON from stdin or --json)
     Save {
@@ -88,9 +92,15 @@ fn main() {
 
 fn run(cli: Cli) -> Result<(), Box<dyn std::error::Error>> {
     match cli.command {
-        Commands::Create { agent_id, dim, wal } => {
+        Commands::Create {
+            agent_id,
+            dim,
+            wal,
+            quantized_index,
+        } => {
             let mut config = MemoryConfig::new(cli.path.clone(), &agent_id, dim);
             config.wal_enabled = wal;
+            config.quantized_index = quantized_index;
             let mem = HDF5Memory::create(config)?;
             let j = serde_json::json!({
                 "status": "created",
@@ -98,6 +108,7 @@ fn run(cli: Cli) -> Result<(), Box<dyn std::error::Error>> {
                 "agent_id": agent_id,
                 "embedding_dim": dim,
                 "wal_enabled": wal,
+                "quantized_index": quantized_index,
                 "count": mem.count(),
             });
             println!("{}", serde_json::to_string_pretty(&j)?);
@@ -146,7 +157,7 @@ fn run(cli: Cli) -> Result<(), Box<dyn std::error::Error>> {
         }
 
         Commands::Recall { index } => {
-            let mem = HDF5Memory::open(&cli.path)?;
+            let mem = HDF5Memory::open_read_only(&cli.path)?;
             match mem.get_chunk(index) {
                 Some(content) => {
                     let j = serde_json::json!({ "index": index, "chunk": content });
@@ -160,7 +171,7 @@ fn run(cli: Cli) -> Result<(), Box<dyn std::error::Error>> {
         }
 
         Commands::Stats => {
-            let mem = HDF5Memory::open(&cli.path)?;
+            let mem = HDF5Memory::open_read_only(&cli.path)?;
             let cfg = mem.config();
             let j = serde_json::json!({
                 "path": cli.path.display().to_string(),
@@ -187,7 +198,7 @@ fn run(cli: Cli) -> Result<(), Box<dyn std::error::Error>> {
         }
 
         Commands::AgentsMd { output } => {
-            let mem = HDF5Memory::open(&cli.path)?;
+            let mem = HDF5Memory::open_read_only(&cli.path)?;
             let md = mem.generate_agents_md();
             match output {
                 Some(p) => {
@@ -199,7 +210,7 @@ fn run(cli: Cli) -> Result<(), Box<dyn std::error::Error>> {
         }
 
         Commands::Export => {
-            let mem = HDF5Memory::open(&cli.path)?;
+            let mem = HDF5Memory::open_read_only(&cli.path)?;
             for i in 0..mem.count() {
                 if let Some(chunk) = mem.get_chunk(i) {
                     let j = serde_json::json!({ "index": i, "chunk": chunk });

crates/clawhdf5-derive/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "clawhdf5-derive"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 description = "Derive macros for rustyhdf5 HDF5 traits"
 license = "MIT"
-repository = "https://github.com/redclawsystems/clawhdf5"
+repository = "https://git.redclaw.dev/quantumclaw/clawhdf5"
 readme = "README.md"
 keywords = ["hdf5", "derive", "macros", "science"]
 categories = ["development-tools::procedural-macro-helpers"]

crates/clawhdf5-filters/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "clawhdf5-filters"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
-description = "Filter and compression pipeline for rustyhdf5"
+description = "Filter and compression pipeline for clawhdf5"
 license = "MIT"
-repository = "https://github.com/redclawsystems/clawhdf5"
+repository = "https://git.redclaw.dev/quantumclaw/clawhdf5"
 readme = "README.md"
 keywords = ["hdf5", "compression", "deflate", "filters"]
 categories = ["compression", "science"]
@@ -14,7 +14,7 @@ flate2 = { version = "1", default-features = false, features = ["rust_backend"]
 miniz_oxide = "0.8"
 
 [dev-dependencies]
-criterion = { version = "0.5", features = ["html_reports"] }
+criterion = { workspace = true }
 
 [[bench]]
 name = "deflate_bench"

crates/clawhdf5-format/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "clawhdf5-format"
-version = "2.1.0"
+version = "2.7.0"
 edition = "2024"
 description = "Pure-Rust HDF5 binary format parsing and writing — no C dependencies"
 license = "MIT"
-repository = "https://github.com/redclawsystems/clawhdf5"
+repository = "https://git.redclaw.dev/quantumclaw/clawhdf5"
 readme = "README.md"
 keywords = ["hdf5", "science", "data", "binary", "no-std"]
 categories = ["parser-implementations", "science", "encoding", "no-std"]
@@ -24,8 +24,8 @@ pco = { version = "1.0", optional = true }
 
 [dev-dependencies]
 serde_json = "1"
-criterion = { version = "0.5", features = ["html_reports"] }
+criterion = { workspace = true }
-clawhdf5-derive = { path = "../clawhdf5-derive", version = "2.1.0" }
+clawhdf5-derive = { path = "../clawhdf5-derive", version = "2.7.0" }
 
 [[bench]]
 name = "bench"

crates/clawhdf5-format/fuzz/.gitignore

@@ -1 +1,4 @@
 target/
+corpus/
+artifacts/
+coverage/

crates/clawhdf5-format/fuzz/Cargo.toml

@@ -14,6 +14,9 @@ libfuzzer-sys = "0.4"
 path = ".."
 features = ["std", "checksum", "deflate"]
 
+[dependencies.clawhdf5]
+path = "../../clawhdf5"
+
 [workspace]
 members = ["."]
 
@@ -56,3 +59,8 @@ doc = false
 name = "fuzz_full_file"
 path = "fuzz_targets/fuzz_full_file.rs"
 doc = false
+
+[[bin]]
+name = "fuzz_dataset_read"
+path = "fuzz_targets/fuzz_dataset_read.rs"
+doc = false

crates/clawhdf5-format/fuzz/README.md

@@ -1,4 +1,4 @@
-# Fuzz Testing for rustyhdf5-format
+# Fuzz Testing for clawhdf5-format
 
 Uses [cargo-fuzz](https://github.com/rust-fuzz/cargo-fuzz) (libFuzzer) to test parser robustness against malformed inputs.
 
@@ -21,13 +21,14 @@ rustup toolchain install nightly
 | `fuzz_btree_v2` | `BTreeV2Header::parse` | B-tree v2 header parsing |
 | `fuzz_filter_pipeline` | `FilterPipeline::parse` | Filter pipeline messages (v1/v2) |
 | `fuzz_full_file` | signature + superblock + root group | End-to-end file parsing chain |
+| `fuzz_dataset_read` | `Dataset::read_*` (via `clawhdf5`) | Walks every dataset in the parsed file and exercises the contiguous/chunked/compact raw-data read paths (`chunked_read.rs`, `data_read.rs`) that `fuzz_full_file` doesn't reach |
 
 ## Running
 
 Run a single target (runs indefinitely until stopped or a crash is found):
 
 ```bash
-cd crates/rustyhdf5-format
+cd crates/clawhdf5-format
 cargo +nightly fuzz run fuzz_datatype
 ```
 
@@ -41,12 +42,20 @@ Run all targets for 30 seconds each:
 
 ```bash
 for target in fuzz_superblock fuzz_object_header fuzz_datatype fuzz_dataspace \
-              fuzz_fractal_heap fuzz_btree_v2 fuzz_filter_pipeline fuzz_full_file; do
+              fuzz_fractal_heap fuzz_btree_v2 fuzz_filter_pipeline fuzz_full_file \
+              fuzz_dataset_read; do
     echo "=== $target ==="
     cargo +nightly fuzz run "$target" -- -max_total_time=30 -max_len=4096
 done
 ```
 
+## CI
+
+These targets are **not** run in CI (`.gitea/workflows/ci.yml`) — cargo-fuzz
+requires nightly and each meaningful run takes minutes, which doesn't fit a
+per-PR gate. Run them manually on a schedule (e.g. before a release, or after
+touching parser code) instead.
+
 ## Reproducing Crashes
 
 If a crash is found, the input is saved to `fuzz/artifacts/<target>/`. Reproduce with:

crates/clawhdf5-format/fuzz/fuzz_targets/fuzz_btree_v2.rs

@@ -1,15 +1,36 @@
 #![no_main]
+use clawhdf5_format::btree_v2::{BTreeV2Header, collect_btree_v2_records};
 use libfuzzer_sys::fuzz_target;
 
 fuzz_target!(|data: &[u8]| {
     for &offset_size in &[4u8, 8] {
         for &length_size in &[4u8, 8] {
-            let _ = clawhdf5_format::btree_v2::BTreeV2Header::parse(
+            if let Ok(header) = BTreeV2Header::parse(data, 0, offset_size, length_size) {
-                data,
+                let _ = collect_btree_v2_records(data, &header, offset_size, length_size);
-                0,
+            }
-                offset_size,
-                length_size,
-            );
         }
     }
+
+    // Parsing a header requires a valid checksum, which random input almost
+    // never has, so the traversal behind it went unfuzzed — and that is where
+    // a node listing itself as its own child overflowed the stack. Take the
+    // header fields straight from the input instead and walk the rest.
+    let Some((fields, file)) = data.split_first_chunk::<20>() else {
+        return;
+    };
+    let header = BTreeV2Header {
+        tree_type: fields[0],
+        node_size: u32::from_le_bytes([fields[1], fields[2], fields[3], fields[4]]),
+        record_size: u16::from_le_bytes([fields[5], fields[6]]),
+        depth: u16::from_le_bytes([fields[7], fields[8]]),
+        root_node_address: u64::from(u32::from_le_bytes([
+            fields[9], fields[10], fields[11], fields[12],
+        ])),
+        num_records_in_root: u16::from_le_bytes([fields[13], fields[14]]),
+        total_records: u64::from(u32::from_le_bytes([
+            fields[15], fields[16], fields[17], fields[18],
+        ])),
+    };
+    let offset_size = if fields[19] & 1 == 0 { 4 } else { 8 };
+    let _ = collect_btree_v2_records(file, &header, offset_size, 8);
 });

crates/clawhdf5-format/fuzz/fuzz_targets/fuzz_dataset_read.rs

@@ -0,0 +1,45 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+const MAX_WALK_DEPTH: usize = 16;
+
+/// Walk groups/datasets from `group`, exercising every dataset-reading code
+/// path reachable through the public API (contiguous/chunked/compact raw
+/// reads via `chunked_read.rs`/`data_read.rs`). Depth-limited independently
+/// of any parser-level recursion guard, since this is fuzz-harness
+/// bookkeeping, not something under test.
+fn walk_group(group: &clawhdf5::Group, depth: usize) {
+    if depth > MAX_WALK_DEPTH {
+        return;
+    }
+    if let Ok(names) = group.datasets() {
+        for name in names {
+            if let Ok(dataset) = group.dataset(&name) {
+                let _ = dataset.shape();
+                let _ = dataset.max_dimensions();
+                let _ = dataset.dtype();
+                let _ = dataset.read_raw_ref();
+                let _ = dataset.read_f64();
+                let _ = dataset.read_f32();
+                let _ = dataset.read_i32();
+                let _ = dataset.read_i64();
+                let _ = dataset.read_u64();
+                let _ = dataset.read_string();
+            }
+        }
+    }
+    if let Ok(names) = group.groups() {
+        for name in names {
+            if let Ok(subgroup) = group.group(&name) {
+                walk_group(&subgroup, depth + 1);
+            }
+        }
+    }
+}
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(file) = clawhdf5::File::from_bytes(data.to_vec()) else {
+        return;
+    };
+    walk_group(&file.root(), 0);
+});

crates/clawhdf5-format/src/attribute.rs

@@ -1,7 +1,9 @@
 //! HDF5 Attribute message parsing (message type 0x000C).
 
 #[cfg(not(feature = "std"))]
-use alloc::{string::String, vec::Vec};
+use alloc::{borrow::Cow, string::String, vec::Vec};
+#[cfg(feature = "std")]
+use std::borrow::Cow;
 
 use crate::attribute_info::AttributeInfoMessage;
 use crate::btree_v2::{BTreeV2Header, collect_btree_v2_records};
@@ -48,17 +50,64 @@ impl AttributeMessage {
     ///
     /// `length_size` is needed for dataspace dimension parsing.
     pub fn parse(data: &[u8], length_size: u8) -> Result<AttributeMessage, FormatError> {
+        Self::parse_impl(data, length_size, None)
+    }
+
+    /// [`AttributeMessage::parse`] with access to the rest of the file, which
+    /// is needed when the attribute's datatype or dataspace is *shared* (v2/v3
+    /// flag bits 0/1) — e.g. an attribute created with a committed datatype.
+    /// In that case the embedded bytes are a reference to the real message,
+    /// not the message. Without file access such an attribute is an error
+    /// rather than a garbage datatype.
+    pub fn parse_in_file(
+        data: &[u8],
+        file_data: &[u8],
+        offset_size: u8,
+        length_size: u8,
+    ) -> Result<AttributeMessage, FormatError> {
+        Self::parse_impl(data, length_size, Some((file_data, offset_size)))
+    }
+
+    fn parse_impl(
+        data: &[u8],
+        length_size: u8,
+        file: Option<(&[u8], u8)>,
+    ) -> Result<AttributeMessage, FormatError> {
         ensure_len(data, 0, 2)?;
         let version = data[0];
 
         match version {
             1 => Self::parse_v1(data, length_size),
-            2 => Self::parse_v2(data, length_size),
+            2 => Self::parse_v2(data, length_size, file),
-            3 => Self::parse_v3(data, length_size),
+            3 => Self::parse_v3(data, length_size, file),
             _ => Err(FormatError::InvalidAttributeVersion(version)),
         }
     }
 
+    /// The bytes of an embedded datatype/dataspace message, following the
+    /// shared-message reference when `shared` is set.
+    fn embedded_message<'a>(
+        bytes: &'a [u8],
+        shared: bool,
+        msg_type: MessageType,
+        length_size: u8,
+        file: Option<(&[u8], u8)>,
+    ) -> Result<Cow<'a, [u8]>, FormatError> {
+        if !shared {
+            return Ok(Cow::Borrowed(bytes));
+        }
+        let (file_data, offset_size) = file.ok_or(FormatError::UnresolvedSharedMessage)?;
+        let shared_ref = shared_message::parse_shared_ref(bytes, offset_size)?;
+        shared_message::resolve_shared_message(
+            file_data,
+            &shared_ref,
+            msg_type,
+            offset_size,
+            length_size,
+        )
+        .map(Cow::Owned)
+    }
+
     fn parse_v1(data: &[u8], length_size: u8) -> Result<AttributeMessage, FormatError> {
         // version(1) + reserved(1) + name_size(2) + datatype_size(2) + dataspace_size(2) = 8
         ensure_len(data, 0, 8)?;
@@ -94,7 +143,13 @@ impl AttributeMessage {
         })
     }
 
-    fn parse_v2(data: &[u8], length_size: u8) -> Result<AttributeMessage, FormatError> {
+    fn parse_v2(
+        data: &[u8],
+        length_size: u8,
+        file: Option<(&[u8], u8)>,
+    ) -> Result<AttributeMessage, FormatError> {
+        // Flags: bit 0 = datatype is shared, bit 1 = dataspace is shared.
+        let flags = data.get(1).copied().unwrap_or(0);
         // version(1) + flags(1) + name_size(2) + datatype_size(2) + dataspace_size(2) = 8
         ensure_len(data, 0, 8)?;
         let name_size = u16::from_le_bytes([data[2], data[3]]) as usize;
@@ -110,12 +165,26 @@ impl AttributeMessage {
 
         // Datatype (NO padding)
         ensure_len(data, pos, datatype_size)?;
-        let (datatype, _) = Datatype::parse(&data[pos..pos + datatype_size])?;
+        let dt_bytes = Self::embedded_message(
+            &data[pos..pos + datatype_size],
+            flags & 0x01 != 0,
+            MessageType::Datatype,
+            length_size,
+            file,
+        )?;
+        let (datatype, _) = Datatype::parse(&dt_bytes)?;
         pos += datatype_size;
 
         // Dataspace (NO padding)
         ensure_len(data, pos, dataspace_size)?;
-        let dataspace = Dataspace::parse(&data[pos..pos + dataspace_size], length_size)?;
+        let ds_bytes = Self::embedded_message(
+            &data[pos..pos + dataspace_size],
+            flags & 0x02 != 0,
+            MessageType::Dataspace,
+            length_size,
+            file,
+        )?;
+        let dataspace = Dataspace::parse(&ds_bytes, length_size)?;
         pos += dataspace_size;
 
         let raw_data = compute_raw_data(data, pos, &dataspace, &datatype);
@@ -128,7 +197,13 @@ impl AttributeMessage {
         })
     }
 
-    fn parse_v3(data: &[u8], length_size: u8) -> Result<AttributeMessage, FormatError> {
+    fn parse_v3(
+        data: &[u8],
+        length_size: u8,
+        file: Option<(&[u8], u8)>,
+    ) -> Result<AttributeMessage, FormatError> {
+        // Flags: bit 0 = datatype is shared, bit 1 = dataspace is shared.
+        let flags = data.get(1).copied().unwrap_or(0);
         // version(1) + flags(1) + name_size(2) + datatype_size(2) + dataspace_size(2) + encoding(1) = 9
         ensure_len(data, 0, 9)?;
         let name_size = u16::from_le_bytes([data[2], data[3]]) as usize;
@@ -145,12 +220,26 @@ impl AttributeMessage {
 
         // Datatype (NO padding)
         ensure_len(data, pos, datatype_size)?;
-        let (datatype, _) = Datatype::parse(&data[pos..pos + datatype_size])?;
+        let dt_bytes = Self::embedded_message(
+            &data[pos..pos + datatype_size],
+            flags & 0x01 != 0,
+            MessageType::Datatype,
+            length_size,
+            file,
+        )?;
+        let (datatype, _) = Datatype::parse(&dt_bytes)?;
         pos += datatype_size;
 
         // Dataspace (NO padding)
         ensure_len(data, pos, dataspace_size)?;
-        let dataspace = Dataspace::parse(&data[pos..pos + dataspace_size], length_size)?;
+        let ds_bytes = Self::embedded_message(
+            &data[pos..pos + dataspace_size],
+            flags & 0x02 != 0,
+            MessageType::Dataspace,
+            length_size,
+            file,
+        )?;
+        let dataspace = Dataspace::parse(&ds_bytes, length_size)?;
         pos += dataspace_size;
 
         let raw_data = compute_raw_data(data, pos, &dataspace, &datatype);
@@ -326,10 +415,20 @@ pub fn extract_attributes_full(
                     offset_size,
                     length_size,
                 )?;
-                let attr = AttributeMessage::parse(&resolved_data, length_size)?;
+                let attr = AttributeMessage::parse_in_file(
+                    &resolved_data,
+                    file_data,
+                    offset_size,
+                    length_size,
+                )?;
                 attrs.push(attr);
             } else {
-                let attr = AttributeMessage::parse(&msg.data, length_size)?;
+                let attr = AttributeMessage::parse_in_file(
+                    &msg.data,
+                    file_data,
+                    offset_size,
+                    length_size,
+                )?;
                 attrs.push(attr);
             }
         }
@@ -399,7 +498,8 @@ fn extract_dense_attributes(
         let attr_data = fh.read_managed_object(file_data, id_bytes, offset_size)?;
 
         // The data in the heap is a complete attribute message
-        let attr = AttributeMessage::parse(&attr_data, length_size)?;
+        let attr =
+            AttributeMessage::parse_in_file(&attr_data, file_data, offset_size, length_size)?;
         attrs.push(attr);
     }
 
@@ -472,14 +572,13 @@ mod tests {
 
         // Name padded to 8 bytes
         data.extend_from_slice(name);
-        while data.len() % 8 != 0 || data.len() == 8 {
+        if data.len() % 8 != 0 || data.len() == 8 {
             // Pad name to 8-byte boundary from start of name
             let name_start = 8;
             let name_padded = pad8(name_size);
             while data.len() < name_start + name_padded {
                 data.push(0);
             }
-            break;
         }
 
         // Datatype padded to 8 bytes
@@ -749,11 +848,11 @@ mod tests {
         data.extend_from_slice(name);
         data.extend_from_slice(&dt_bytes);
         data.extend_from_slice(&ds_bytes);
-        data.extend_from_slice(&3.14f64.to_le_bytes());
+        data.extend_from_slice(&3.25f64.to_le_bytes());
 
         let attr = AttributeMessage::parse(&data, 8).unwrap();
         let vals = attr.read_as_f64().unwrap();
-        assert_eq!(vals, vec![3.14]);
+        assert_eq!(vals, vec![3.25]);
     }
 
     #[test]

crates/clawhdf5-format/src/btree_v1.rs

@@ -24,6 +24,21 @@ pub struct BTreeV1Node {
     pub children: Vec<u64>,
 }
 
+/// Checks that `[offset, offset + needed)` fits within `data`, guarding the
+/// addition against `usize` overflow from a crafted near-`usize::MAX` offset.
+fn ensure_len(data: &[u8], offset: usize, needed: usize) -> Result<(), FormatError> {
+    if offset
+        .checked_add(needed)
+        .is_none_or(|end| end > data.len())
+    {
+        return Err(FormatError::UnexpectedEof {
+            expected: offset.saturating_add(needed),
+            available: data.len(),
+        });
+    }
+    Ok(())
+}
+
 fn read_offset(data: &[u8], pos: usize, size: u8) -> Result<u64, FormatError> {
     let s = size as usize;
     if pos.checked_add(s).is_none_or(|end| end > data.len()) {
@@ -45,7 +60,7 @@ fn read_offset(data: &[u8], pos: usize, size: u8) -> Result<u64, FormatError> {
 
 fn is_undefined(data: &[u8], pos: usize, size: u8) -> bool {
     let s = size as usize;
-    if pos + s > data.len() {
+    if ensure_len(data, pos, s).is_err() {
         return false;
     }
     data[pos..pos + s].iter().all(|&b| b == 0xFF)
@@ -65,12 +80,7 @@ impl BTreeV1Node {
         // + left_sibling(offset_size) + right_sibling(offset_size)
         let os = offset_size as usize;
         let header_size = 8 + os * 2;
-        if offset + header_size > file_data.len() {
+        ensure_len(file_data, offset, header_size)?;
-            return Err(FormatError::UnexpectedEof {
-                expected: offset + header_size,
-                available: file_data.len(),
-            });
-        }
 
         if &file_data[offset..offset + 4] != b"TREE" {
             return Err(FormatError::InvalidBTreeSignature);
@@ -99,12 +109,7 @@ impl BTreeV1Node {
         let eu = entries_used as usize;
         let key_size = os; // For type 0, key = offset_size
         let needed = eu * (key_size + os) + key_size; // eu children + (eu+1) keys
-        if pos + needed > file_data.len() {
+        ensure_len(file_data, pos, needed)?;
-            return Err(FormatError::UnexpectedEof {
-                expected: pos + needed,
-                available: file_data.len(),
-            });
-        }
 
         let mut keys = Vec::with_capacity(eu + 1);
         let mut children = Vec::with_capacity(eu);
@@ -241,6 +246,16 @@ mod tests {
         assert_eq!(node.right_sibling, None);
     }
 
+    #[test]
+    fn parse_near_usize_max_offset_rejected_without_overflow() {
+        let data = build_btree_node(0, 0, &[0, 5, 10], &[0x100, 0x200], None, None, 8);
+        let result = BTreeV1Node::parse(&data, usize::MAX - 4, 8, 8);
+        assert!(
+            matches!(result, Err(FormatError::UnexpectedEof { .. })),
+            "expected a clean UnexpectedEof, got {result:?}"
+        );
+    }
+
     #[test]
     fn parse_with_siblings_none() {
         let data = build_btree_node(0, 0, &[0, 8], &[0x300], None, None, 8);

crates/clawhdf5-format/src/btree_v2.rs

@@ -172,6 +172,17 @@ fn max_records_leaf(node_size: u32, record_size: u16) -> u64 {
     ((node_size - overhead) / record_size as u32) as u64
 }
 
+/// Deepest B-tree v2 accepted. See [`collect_btree_v2_records`].
+const MAX_DEPTH: u16 = 64;
+
+/// Take `n` records from the traversal's budget, or refuse the tree.
+fn spend(budget: &mut usize, n: usize) -> Result<(), FormatError> {
+    *budget = budget
+        .checked_sub(n)
+        .ok_or(FormatError::NestingDepthExceeded)?;
+    Ok(())
+}
+
 /// Collect all records from a B-tree v2 by traversing from the root.
 pub fn collect_btree_v2_records(
     file_data: &[u8],
@@ -182,6 +193,22 @@ pub fn collect_btree_v2_records(
     if header.total_records == 0 || header.num_records_in_root == 0 {
         return Ok(Vec::new());
     }
+    // Recursion is one frame per level, and the depth is read from the file:
+    // a crafted header claiming 65 535 levels over a node that is its own
+    // child overflowed the stack. 64 matches the fractal heap's guard, and no
+    // real tree comes close — even at the minimum fan-out of two it would
+    // hold more than 2^64 records.
+    if header.depth > MAX_DEPTH {
+        return Err(FormatError::NestingDepthExceeded);
+    }
+    // A valid tree stores each record once, in its own bytes, so it cannot
+    // hold more records than the file has room for. Children are addresses,
+    // though, and nothing makes them distinct: levels whose children all
+    // point at one shared node below reach it fan-out^depth times, which is
+    // millions of records from a few kilobytes. Counting against what the
+    // file could physically contain bounds that without trusting the
+    // header's own `total_records`.
+    let mut budget = file_data.len() / usize::from(header.record_size.max(1));
 
     let max_leaf_nrec = max_records_leaf(header.node_size, header.record_size);
 
@@ -206,6 +233,7 @@ pub fn collect_btree_v2_records(
             offset_size,
             length_size,
             max_leaf_nrec,
+            &mut budget,
             &mut records,
         )?;
         Ok(records)
@@ -273,6 +301,7 @@ fn collect_internal_records(
     offset_size: u8,
     length_size: u8,
     max_leaf_nrec: u64,
+    budget: &mut usize,
     out: &mut Vec<BTreeV2Record>,
 ) -> Result<(), FormatError> {
     // signature(4) + version(1) + type(1) = 6
@@ -350,6 +379,8 @@ fn collect_internal_records(
     // We collect child[0] records, then record[0], then child[1], etc.
     for (i, &(child_addr, child_nrec)) in children.iter().enumerate() {
         if child_depth == 0 {
+            // Before parsing, so a refused tree is not also a large allocation.
+            spend(budget, usize::from(child_nrec))?;
             let leaf_recs =
                 parse_leaf_records(file_data, child_addr as usize, child_nrec, record_size)?;
             out.extend(leaf_recs);
@@ -364,6 +395,7 @@ fn collect_internal_records(
                 offset_size,
                 length_size,
                 max_leaf_nrec,
+                budget,
                 out,
             )?;
         }
@@ -393,6 +425,7 @@ fn collect_internal_records(
                     available: file_data.len(),
                 });
             }
+            spend(budget, 1)?;
             out.push(BTreeV2Record {
                 data: file_data[rec_start..rec_end].to_vec(),
             });
@@ -416,6 +449,7 @@ fn header_max_total_records(max_leaf_nrec: u64, depth: u16) -> u64 {
 mod tests {
     use super::*;
 
+    #[allow(clippy::too_many_arguments)]
     fn build_btree_v2_header(
         tree_type: u8,
         node_size: u32,
@@ -465,6 +499,124 @@ mod tests {
         buf
     }
 
+    /// An internal node laid out exactly as `collect_internal_records` will
+    /// read it at `depth`: `records` zeroed records, then `children` pointers,
+    /// all to `child_addr` claiming `child_nrec` records.
+    fn internal_node(
+        depth: u16,
+        node_size: u32,
+        record_size: u16,
+        records: usize,
+        children: usize,
+        child_addr: u64,
+        child_nrec: u64,
+    ) -> Vec<u8> {
+        let max_leaf = max_records_leaf(node_size, record_size);
+        let nrec_width = bytes_for_max_records(if depth == 1 { max_leaf } else { max_leaf * 2 });
+        let total_width = if depth > 1 {
+            bytes_for_max_records(header_max_total_records(max_leaf, depth - 1))
+        } else {
+            0
+        };
+        let mut buf = b"BTIN".to_vec();
+        buf.extend_from_slice(&[0, 5]);
+        buf.resize(buf.len() + records * record_size as usize, 0);
+        for _ in 0..children {
+            buf.extend_from_slice(&child_addr.to_le_bytes());
+            buf.extend_from_slice(&child_nrec.to_le_bytes()[..nrec_width]);
+            buf.resize(buf.len() + total_width, 0);
+        }
+        buf
+    }
+
+    fn header(depth: u16, root: u64, root_nrec: u16, total: u64) -> BTreeV2Header {
+        BTreeV2Header {
+            tree_type: 5,
+            node_size: 512,
+            record_size: 8,
+            depth,
+            root_node_address: root,
+            num_records_in_root: root_nrec,
+            total_records: total,
+        }
+    }
+
+    #[test]
+    fn a_node_that_is_its_own_child_is_rejected_not_recursed() {
+        // One internal node whose two children are itself, under a header
+        // claiming the deepest tree a u16 allows. The layout stops depending
+        // on depth once the subtree-total width saturates, so every level
+        // parses cleanly and recursion runs ~65 000 frames deep: before the
+        // cap this overflowed the stack and aborted the process, from a file
+        // of under 100 bytes.
+        let mut data = internal_node(u16::MAX, 512, 8, 1, 2, 0, 1);
+        data.resize(4096, 0);
+        let result = collect_btree_v2_records(&data, &header(u16::MAX, 0, 1, 1), 8, 8);
+        assert!(result.is_err(), "{result:?}");
+    }
+
+    #[test]
+    fn a_shared_subtree_cannot_multiply_the_work() {
+        // A chain of distinct levels, each node's children all pointing at the
+        // single node below, ending in a real leaf. Every node parses and
+        // nothing is cyclic, yet the leaf is reached fan-out^depth times: 62
+        // children over 4 levels is ~15 million leaf visits from a few
+        // kilobytes. A valid tree cannot hold more records than the file has
+        // room for, so that bounds the traversal instead.
+        let (node_size, record_size) = (512u32, 8u16);
+        let fanout = 62usize;
+        let depth = 4u16;
+        let leaf = build_leaf_node(5, &[&[0u8; 8][..]]);
+
+        // Lay out root first, then each lower level, then the leaf.
+        let mut nodes: Vec<Vec<u8>> = Vec::new();
+        let mut addrs = Vec::new();
+        let mut at = 0u64;
+        let mut sizes = Vec::new();
+        for d in (1..=depth).rev() {
+            let n = internal_node(d, node_size, record_size, fanout - 1, fanout, 0, 0);
+            sizes.push(n.len());
+        }
+        for size in &sizes {
+            addrs.push(at);
+            at += *size as u64;
+        }
+        let leaf_addr = at;
+        for (i, d) in (1..=depth).rev().enumerate() {
+            let (child, child_nrec) = if d == 1 {
+                (leaf_addr, 1)
+            } else {
+                (addrs[i + 1], fanout as u64 - 1)
+            };
+            nodes.push(internal_node(
+                d,
+                node_size,
+                record_size,
+                fanout - 1,
+                fanout,
+                child,
+                child_nrec,
+            ));
+        }
+        let mut data: Vec<u8> = nodes.concat();
+        data.extend_from_slice(&leaf);
+        data.resize(data.len() + 64, 0);
+
+        let started = std::time::Instant::now();
+        let result =
+            collect_btree_v2_records(&data, &header(depth, 0, fanout as u16 - 1, u64::MAX), 8, 8);
+        assert!(
+            result.is_err(),
+            "expected a refusal, got {} records",
+            result.map_or(0, |r| r.len())
+        );
+        assert!(
+            started.elapsed() < std::time::Duration::from_secs(2),
+            "took {:?}",
+            started.elapsed()
+        );
+    }
+
     #[test]
     fn parse_header() {
         let data = build_btree_v2_header(5, 512, 11, 0, 0x1000, 3, 3, 8, 8);

crates/clawhdf5-format/src/chunk_cache.rs

@@ -374,6 +374,11 @@ impl ChunkCache {
 
     // ----- Index operations -----
 
+    /// The most decompressed bytes this cache will hold.
+    pub fn max_bytes(&self) -> usize {
+        self.inner.lock().map(|g| g.max_bytes).unwrap_or(0)
+    }
+
     /// Bind the cache to the dataset at chunk-index address `addr`.
     ///
     /// The cache is shared per file across all of its datasets. If the cache

crates/clawhdf5-format/src/chunked_write.rs

@@ -15,7 +15,6 @@ use crate::filter_pipeline::{
     FilterDescription, FilterPipeline,
 };
 use crate::filters::compress_chunk;
-
 /// Round a file offset up to the next cache-line boundary.
 ///
 /// This ensures chunk data starts at an address that is a multiple of the
@@ -49,6 +48,38 @@ pub struct ChunkOptions {
     pub pcodec: bool,
 }
 
+/// Largest chunk the automatic choice produces, in bytes.
+const AUTO_CHUNK_TARGET_BYTES: u64 = 1 << 20;
+
+/// Extent assumed for a dimension that is currently empty (an unlimited
+/// dimension not yet written to) — the same stand-in h5py uses.
+const AUTO_CHUNK_EMPTY_DIM: u64 = 1024;
+
+/// Choose chunk dimensions for a dataset nobody specified them for.
+///
+/// Asking for compression (or any filter) without chunk dimensions used to
+/// make the whole dataset one chunk. That defeats the point of chunking: any
+/// read — even a single row — must decompress everything, and a large dataset
+/// cannot be decompressed in parallel. Datasets up to the target size stay a
+/// single chunk, exactly as before; larger ones are split by halving the
+/// dimensions in turn (so chunks keep roughly the dataset's proportions, the
+/// approach h5py takes) until a chunk fits the target.
+pub fn auto_chunk_dims(shape: &[u64], elem_size: usize) -> Vec<u64> {
+    let mut dims: Vec<u64> = shape
+        .iter()
+        .map(|&d| if d == 0 { AUTO_CHUNK_EMPTY_DIM } else { d })
+        .collect();
+    let elem = elem_size.max(1) as u64;
+    let bytes = |dims: &[u64]| dims.iter().fold(elem, |acc, &d| acc.saturating_mul(d));
+    let mut axis = 0;
+    while bytes(&dims) > AUTO_CHUNK_TARGET_BYTES && dims.iter().any(|&d| d > 1) {
+        let i = axis % dims.len();
+        dims[i] = dims[i].div_ceil(2);
+        axis += 1;
+    }
+    dims
+}
+
 impl ChunkOptions {
     /// Whether any chunking option is enabled.
     pub fn is_chunked(&self) -> bool {
@@ -135,11 +166,17 @@ impl ChunkOptions {
 
     /// Determine chunk dimensions, using user-specified or auto-computing.
     pub fn resolve_chunk_dims(&self, shape: &[u64]) -> Vec<u64> {
-        if let Some(ref dims) = self.chunk_dims {
+        // Without the element size, assume 8 bytes (the widest common scalar);
-            dims.clone()
+        // the writer uses `resolve_chunk_dims_for`.
-        } else {
+        self.resolve_chunk_dims_for(shape, 8)
-            // Auto chunk: use the full dataset shape (single chunk)
+    }
-            shape.to_vec()
+
+    /// Chunk dimensions for a dataset of `shape` whose elements are `elem_size`
+    /// bytes: the caller's if given, otherwise chosen automatically.
+    pub fn resolve_chunk_dims_for(&self, shape: &[u64], elem_size: usize) -> Vec<u64> {
+        match self.chunk_dims {
+            Some(ref dims) => dims.clone(),
+            None => auto_chunk_dims(shape, elem_size),
         }
     }
 }
@@ -890,6 +927,7 @@ pub fn write_selection_to_buffer(
 
 #[cfg(test)]
 mod tests {
+
     use super::*;
     use crate::chunked_read::read_chunked_data;
     use crate::data_layout::DataLayout;
@@ -1143,6 +1181,45 @@ mod tests {
         assert_eq!(dims, vec![100, 50]);
     }
 
+    #[test]
+    fn auto_chunking_splits_only_large_datasets() {
+        let bytes = |dims: &[u64], elem: u64| dims.iter().product::<u64>() * elem;
+        // Up to the target: one chunk, as before.
+        assert_eq!(auto_chunk_dims(&[100, 50], 8), [100, 50]);
+        assert_eq!(auto_chunk_dims(&[131_072], 8), [131_072]); // exactly 1 MiB
+        // Larger: split, keeping proportions, never above the target.
+        let big = auto_chunk_dims(&[4096, 2048], 8);
+        assert!(bytes(&big, 8) <= AUTO_CHUNK_TARGET_BYTES, "{big:?}");
+        assert!(bytes(&big, 8) > AUTO_CHUNK_TARGET_BYTES / 4, "{big:?}");
+        assert_eq!(big[0] / big[1], 2, "proportions kept: {big:?}");
+        // Every dimension stays within the dataset and at least 1.
+        for shape in [
+            vec![10_000_000u64],
+            vec![3, 5_000_000],
+            vec![1, 1, 9_000_000],
+            vec![7; 9],
+        ] {
+            let dims = auto_chunk_dims(&shape, 4);
+            assert!(
+                dims.iter().zip(&shape).all(|(c, s)| *c >= 1 && c <= s),
+                "{shape:?} -> {dims:?}"
+            );
+            assert!(
+                bytes(&dims, 4) <= AUTO_CHUNK_TARGET_BYTES,
+                "{shape:?} -> {dims:?}"
+            );
+        }
+        // An empty (unlimited, unwritten) dimension still gets a usable chunk.
+        let growable = auto_chunk_dims(&[0, 128], 8);
+        assert!(growable[0] >= 1 && bytes(&growable, 8) <= AUTO_CHUNK_TARGET_BYTES);
+        // Explicit dimensions always win.
+        let explicit = ChunkOptions {
+            chunk_dims: Some(vec![10, 10]),
+            ..Default::default()
+        };
+        assert_eq!(explicit.resolve_chunk_dims_for(&[4096, 2048], 8), [10, 10]);
+    }
+
     #[test]
     fn chunk_options_pipeline_deflate() {
         // Auto-shuffle is applied before compression by default (matches h5py).
@@ -1435,9 +1512,20 @@ mod tests {
 
     // ---- h5py round-trip tests for chunked writes ----
 
+    /// The Python interpreter to drive interop checks with.
+    ///
+    /// `CLAWHDF5_PYTHON` lets these run against a virtualenv holding h5py,
+    /// which on a PEP 668 "externally managed" system is the only place it
+    /// can be installed. Without it the suite silently skips, and a silent
+    /// skip here is how a datatype bug once reached a release.
+    #[cfg(feature = "std")]
+    fn python() -> String {
+        std::env::var("CLAWHDF5_PYTHON").unwrap_or_else(|_| "python3".to_string())
+    }
+
     #[cfg(feature = "std")]
     fn h5py_available() -> bool {
-        std::process::Command::new("python3")
+        std::process::Command::new(python())
             .args(["-c", "import h5py"])
             .output()
             .map(|o| o.status.success())
@@ -1449,10 +1537,10 @@ mod tests {
         if !h5py_available() {
             panic!("h5py not installed — skipping interop test");
         }
-        let o = std::process::Command::new("python3")
+        let o = std::process::Command::new(python())
             .args(["-c", script])
             .output()
-            .expect("python3");
+            .expect("python interpreter");
         if !o.status.success() {
             panic!("h5py: {}", String::from_utf8_lossy(&o.stderr));
         }

crates/clawhdf5-format/src/data_read.rs

@@ -17,6 +17,21 @@ use crate::datatype::{Datatype, DatatypeByteOrder};
 use crate::error::FormatError;
 use crate::filter_pipeline::FilterPipeline;
 
+/// Checks that `[offset, offset + needed)` fits within `data`, guarding the
+/// addition against `usize` overflow from a crafted near-`usize::MAX` offset.
+fn ensure_len(data: &[u8], offset: usize, needed: usize) -> Result<(), FormatError> {
+    if offset
+        .checked_add(needed)
+        .is_none_or(|end| end > data.len())
+    {
+        return Err(FormatError::UnexpectedEof {
+            expected: offset.saturating_add(needed),
+            available: data.len(),
+        });
+    }
+    Ok(())
+}
+
 /// Zero-copy read of contiguous raw data, returning a borrowed slice.
 ///
 /// For contiguous layouts, returns a direct `&[u8]` slice into `file_data`.
@@ -47,12 +62,7 @@ pub fn read_raw_data_zerocopy<'a>(
                     actual: sz,
                 });
             }
-            if addr + sz > file_data.len() {
+            ensure_len(file_data, addr, sz)?;
-                return Err(FormatError::UnexpectedEof {
-                    expected: addr + sz,
-                    available: file_data.len(),
-                });
-            }
             Ok(Some(&file_data[addr..addr + sz]))
         }
         _ => Ok(None),
@@ -169,12 +179,7 @@ fn read_raw_data_full_impl(
                     actual: sz,
                 });
             }
-            if addr + sz > file_data.len() {
+            ensure_len(file_data, addr, sz)?;
-                return Err(FormatError::UnexpectedEof {
-                    expected: addr + sz,
-                    available: file_data.len(),
-                });
-            }
             Ok(file_data[addr..addr + sz].to_vec())
         }
         DataLayout::Chunked { .. } => read_chunked_data(
@@ -302,6 +307,24 @@ pub fn read_raw_data_selection(
 ) -> Result<Vec<u8>, FormatError> {
     use crate::selection::Selection;
 
+    crate::partial_read::validate(selection, &dataspace.dimensions)?;
+
+    // Read only what the selection's bounding box touches when that is
+    // possible; everything below is the decode-everything-then-pick path,
+    // kept for the cases `partial_read` declines.
+    if let Some(selected) = crate::partial_read::read_selection(
+        file_data,
+        layout,
+        dataspace,
+        datatype.type_size() as usize,
+        pipeline,
+        offset_size,
+        length_size,
+        selection,
+    )? {
+        return Ok(selected);
+    }
+
     match selection {
         Selection::All => {
             return read_raw_data_full(
@@ -470,8 +493,10 @@ fn read_virtual_data(
     use crate::selection::Selection;
 
     let elem_size = datatype.type_size() as usize;
-    let total_elems = dataspace.num_elements() as usize;
+    let mut out = crate::chunked_read::alloc_output(crate::chunked_read::checked_byte_len(
-    let mut out = vec![0u8; total_elems.saturating_mul(elem_size)];
+        dataspace.checked_num_elements()?,
+        elem_size,
+    )?)?;
 
     let virtual_dims = &dataspace.dimensions;
 
@@ -593,7 +618,7 @@ fn read_named_dataset_raw(
 }
 
 /// Extract selected elements from a full dataset buffer.
-fn extract_selection_from_buffer(
+pub fn extract_selection_from_buffer(
     full_data: &[u8],
     dims: &[u64],
     elem_size: usize,
@@ -611,12 +636,14 @@ fn extract_selection_from_buffer(
             block,
         } => {
             let rank = dims.len();
-            let output_elements: usize = count
+            let output_elements = count
                 .iter()
                 .zip(block.iter())
-                .map(|(&c, &b)| (c * b) as usize)
+                .try_fold(1u64, |acc, (&c, &b)| acc.checked_mul(c.checked_mul(b)?))
-                .product();
+                .ok_or_else(|| FormatError::Overflow("hyperslab count x block overflows".into()))?;
-            let mut output = vec![0u8; output_elements * elem_size];
+            let mut output = crate::chunked_read::alloc_output(
+                crate::chunked_read::checked_byte_len(output_elements, elem_size)?,
+            )?;
 
             // Compute dataset strides (row-major)
             let mut ds_strides = vec![1usize; rank];
@@ -849,6 +876,30 @@ fn get_size(dt: &Datatype) -> usize {
     dt.type_size() as usize
 }
 
+/// Reinterpret little-endian bytes as `count` native values of `T` on a
+/// little-endian target, in one copy.
+///
+/// The buffer is allocated uninitialised and filled by the copy. It used to be
+/// `vec![0; count]` first, which for a large dataset meant writing every page
+/// twice (zero it, then overwrite it) — about as expensive as the copy itself.
+#[cfg(target_endian = "little")]
+fn native_le_to_vec<T: Copy>(raw: &[u8], count: usize) -> Vec<T> {
+    let bytes = count * core::mem::size_of::<T>();
+    debug_assert!(bytes <= raw.len());
+    let mut result: Vec<T> = Vec::with_capacity(count);
+    // SAFETY: `result` has capacity for `count` values of `T`, i.e. `bytes`
+    // bytes; `raw` holds at least `bytes` bytes (callers derive `count` from
+    // `raw.len() / size_of::<T>()`); the regions cannot overlap because
+    // `result` was just allocated. Every `T` used here (f32/f64/i32/i64) is
+    // valid for any bit pattern, so after the copy all `count` values are
+    // initialised and `set_len` is sound.
+    unsafe {
+        core::ptr::copy_nonoverlapping(raw.as_ptr(), result.as_mut_ptr().cast::<u8>(), bytes);
+        result.set_len(count);
+    }
+    result
+}
+
 /// Convert raw bytes to `f64` values.
 pub fn read_as_f64(raw: &[u8], datatype: &Datatype) -> Result<Vec<f64>, FormatError> {
     // Array datatypes (e.g. an array-typed compound member) are read as a flat
@@ -876,14 +927,7 @@ pub fn read_as_f64(raw: &[u8], datatype: &Datatype) -> Result<Vec<f64>, FormatEr
             ..
         }
     ) {
-        let mut result = vec![0.0f64; count];
+        return Ok(native_le_to_vec::<f64>(raw, count));
-        // SAFETY: On LE platforms, f64 in-memory representation matches LE bytes.
-        // We copy raw bytes directly into the f64 buffer.
-        // SAFETY: The byte slice is properly aligned for this type and the length is divisible by size_of::<T>().
-        unsafe {
-            core::ptr::copy_nonoverlapping(raw.as_ptr(), result.as_mut_ptr() as *mut u8, raw.len());
-        }
-        return Ok(result);
     }
 
     let order = get_byte_order(datatype);
@@ -966,12 +1010,7 @@ pub fn read_as_i64(raw: &[u8], datatype: &Datatype) -> Result<Vec<i64>, FormatEr
             }
         )
     {
-        let mut result = vec![0i64; count];
+        return Ok(native_le_to_vec::<i64>(raw, count));
-        // SAFETY: The byte slice is properly aligned for this type and the length is divisible by size_of::<T>().
-        unsafe {
-            core::ptr::copy_nonoverlapping(raw.as_ptr(), result.as_mut_ptr() as *mut u8, raw.len());
-        }
-        return Ok(result);
     }
 
     let order = get_byte_order(datatype);
@@ -1035,12 +1074,7 @@ pub fn read_as_f32(raw: &[u8], datatype: &Datatype) -> Result<Vec<f32>, FormatEr
             ..
         }
     ) {
-        let mut result = vec![0.0f32; count];
+        return Ok(native_le_to_vec::<f32>(raw, count));
-        // SAFETY: The byte slice is properly aligned for this type and the length is divisible by size_of::<T>().
-        unsafe {
-            core::ptr::copy_nonoverlapping(raw.as_ptr(), result.as_mut_ptr() as *mut u8, raw.len());
-        }
-        return Ok(result);
     }
 
     let order = get_byte_order(datatype);
@@ -1117,12 +1151,7 @@ pub fn read_as_i32(raw: &[u8], datatype: &Datatype) -> Result<Vec<i32>, FormatEr
             }
         )
     {
-        let mut result = vec![0i32; count];
+        return Ok(native_le_to_vec::<i32>(raw, count));
-        // SAFETY: The byte slice is properly aligned for this type and the length is divisible by size_of::<T>().
-        unsafe {
-            core::ptr::copy_nonoverlapping(raw.as_ptr(), result.as_mut_ptr() as *mut u8, raw.len());
-        }
-        return Ok(result);
     }
 
     let order = get_byte_order(datatype);
@@ -1218,6 +1247,15 @@ pub fn read_compound_fields(
             for m in members {
                 let field_size = m.datatype.type_size() as usize;
                 let offset = m.byte_offset as usize;
+                if offset
+                    .checked_add(field_size)
+                    .is_none_or(|end| end > elem_size)
+                {
+                    return Err(FormatError::Overflow(format!(
+                        "compound member '{}': byte_offset({offset}) + field_size({field_size}) exceeds element size({elem_size})",
+                        m.name
+                    )));
+                }
                 let mut field_raw = Vec::with_capacity(count * field_size);
                 for i in 0..count {
                     let elem_start = i * elem_size + offset;
@@ -1389,6 +1427,26 @@ pub fn read_object_references(
             }
             Ok(result)
         }
+        Datatype::Reference {
+            ref_type: crate::datatype::ReferenceType::Object2,
+            size,
+        } => {
+            let elem_size = *size as usize;
+            if elem_size == 0 {
+                return Ok(Vec::new());
+            }
+            if !raw.len().is_multiple_of(elem_size) {
+                return Err(FormatError::DataSizeMismatch {
+                    expected: 0,
+                    actual: raw.len(),
+                });
+            }
+            raw.chunks_exact(elem_size)
+                .map(|element| {
+                    decode_std_object_ref(element).map(|address| ObjectReference { address })
+                })
+                .collect()
+        }
         _ => Err(FormatError::TypeMismatch {
             expected: "Reference(Object)",
             actual: datatype_name(datatype),
@@ -1396,6 +1454,46 @@ pub fn read_object_references(
     }
 }
 
+/// Decode one `H5T_STD_REF` object reference as stored in a dataset:
+/// `type(1) flags(1) token_size(1) token(token_size)`, zero-padded to the
+/// element size. For a reference within the same file the token is the target
+/// object's header address. An all-zero element is a null reference and
+/// decodes to the undefined address (`u64::MAX`).
+fn decode_std_object_ref(element: &[u8]) -> Result<u64, FormatError> {
+    const STD_REF_OBJECT: u8 = 2;
+    const FLAG_EXTERNAL: u8 = 0x01;
+    if element.iter().all(|&b| b == 0) {
+        return Ok(u64::MAX);
+    }
+    let [ref_type, flags, token_size, token @ ..] = element else {
+        return Err(FormatError::UnexpectedEof {
+            expected: 3,
+            available: element.len(),
+        });
+    };
+    if *ref_type != STD_REF_OBJECT {
+        return Err(FormatError::InvalidReferenceType(*ref_type));
+    }
+    if flags & FLAG_EXTERNAL != 0 {
+        // Carries a file name as well; nothing here follows those.
+        return Err(FormatError::TypeMismatch {
+            expected: "object reference within this file",
+            actual: "external object reference",
+        });
+    }
+    let n = *token_size as usize;
+    if n == 0 || n > 8 || n > token.len() {
+        return Err(FormatError::UnexpectedEof {
+            expected: 3 + n,
+            available: element.len(),
+        });
+    }
+    Ok(token[..n]
+        .iter()
+        .rev()
+        .fold(0u64, |addr, &byte| (addr << 8) | u64::from(byte)))
+}
+
 /// Read region references from raw bytes.
 ///
 /// Region references encode a dataset selection (hyperslab, point list, etc.)
@@ -1749,11 +1847,11 @@ mod tests {
     fn f16_bits(v: f32) -> u16 {
         // Encode a few exact values used by the test.
         match v {
-            x if x == 0.0 => 0x0000,
+            0.0 => 0x0000,
-            x if x == 1.0 => 0x3c00,
+            1.0 => 0x3c00,
-            x if x == -2.0 => 0xc000,
+            -2.0 => 0xc000,
-            x if x == 0.5 => 0x3800,
+            0.5 => 0x3800,
-            x if x == 65504.0 => 0x7bff, // f16 max
+            65504.0 => 0x7bff, // f16 max
             _ => panic!("unsupported test value {v}"),
         }
     }
@@ -2116,6 +2214,43 @@ mod tests {
         assert_eq!(id_vals, vec![10, 20]);
     }
 
+    #[test]
+    fn read_compound_rejects_byte_offset_overrun() {
+        use crate::datatype::CompoundMember;
+        // Compound declares size=8, but the member's byte_offset(4) + its
+        // field_size(8, f64) = 12 > 8 — a crafted out-of-range byte_offset.
+        let dt = Datatype::Compound {
+            size: 8,
+            members: vec![CompoundMember {
+                name: "bad".to_string(),
+                byte_offset: 4,
+                datatype: make_f64_le_type(),
+            }],
+        };
+        let raw = vec![0u8; 8]; // one element, matches declared size
+        let result = read_compound_fields(&raw, &dt);
+        assert!(
+            matches!(result, Err(FormatError::Overflow(_))),
+            "expected a clean Overflow error, got {result:?}"
+        );
+    }
+
+    #[test]
+    fn read_raw_data_zerocopy_rejects_near_usize_max_offset() {
+        let file_data = vec![0u8; 64];
+        let dataspace = make_simple_dataspace(&[4]);
+        let datatype = make_i32_le_type();
+        let layout = DataLayout::Contiguous {
+            address: Some(u64::MAX - 4),
+            size: 16,
+        };
+        let result = read_raw_data_zerocopy(&file_data, &layout, &dataspace, &datatype);
+        assert!(
+            matches!(result, Err(FormatError::UnexpectedEof { .. })),
+            "expected a clean UnexpectedEof, got {result:?}"
+        );
+    }
+
     #[test]
     fn read_compound_single_field_by_name() {
         use crate::datatype::CompoundMember;
@@ -2135,7 +2270,7 @@ mod tests {
             ],
         };
         let mut raw = Vec::new();
-        raw.extend_from_slice(&3.14f64.to_le_bytes());
+        raw.extend_from_slice(&3.25f64.to_le_bytes());
         raw.extend_from_slice(&42i32.to_le_bytes());
 
         let field = read_compound_field(&raw, &dt, "id").unwrap();

crates/clawhdf5-format/src/dataspace.rs

@@ -1,5 +1,7 @@
 //! HDF5 Dataspace message parsing (message type 0x0001).
 
+#[cfg(not(feature = "std"))]
+use alloc::format;
 #[cfg(not(feature = "std"))]
 use alloc::vec::Vec;
 
@@ -167,6 +169,27 @@ impl Dataspace {
         }
     }
 
+    /// [`Dataspace::num_elements`] with the product overflow-checked. The
+    /// dimensions are untrusted 64-bit fields; read paths that size a buffer
+    /// from them must use this one.
+    pub fn checked_num_elements(&self) -> Result<u64, FormatError> {
+        match self.space_type {
+            DataspaceType::Null => Ok(0),
+            DataspaceType::Scalar => Ok(1),
+            DataspaceType::Simple if self.dimensions.is_empty() => Ok(0),
+            DataspaceType::Simple => self
+                .dimensions
+                .iter()
+                .try_fold(1u64, |acc, &d| acc.checked_mul(d))
+                .ok_or_else(|| {
+                    FormatError::Overflow(format!(
+                        "dataspace dimensions {:?} overflow the element count",
+                        self.dimensions
+                    ))
+                }),
+        }
+    }
+
     /// Total number of elements. Scalar = 1, Null = 0.
     pub fn num_elements(&self) -> u64 {
         match self.space_type {
@@ -176,7 +199,12 @@ impl Dataspace {
                 if self.dimensions.is_empty() {
                     0
                 } else {
-                    self.dimensions.iter().product()
+                    // Saturate rather than wrap: a wrapped product could
+                    // under-size a buffer. Size-critical callers use
+                    // `checked_num_elements`.
+                    self.dimensions
+                        .iter()
+                        .fold(1u64, |acc, &d| acc.saturating_mul(d))
                 }
             }
         }
@@ -189,11 +217,7 @@ mod tests {
 
     fn build_v1_dataspace(rank: u8, flags: u8, dims: &[u64], max_dims: Option<&[u64]>) -> Vec<u8> {
         let length_size = 8u8;
-        let mut buf = Vec::new();
+        let mut buf = vec![1, rank, flags, 0]; // version, rank, flags, reserved
-        buf.push(1); // version
-        buf.push(rank);
-        buf.push(flags);
-        buf.push(0); // reserved
         buf.extend_from_slice(&[0u8; 4]); // reserved(4)
         for &d in dims {
             buf.extend_from_slice(&d.to_le_bytes());
@@ -214,11 +238,7 @@ mod tests {
         dims: &[u64],
         max_dims: Option<&[u64]>,
     ) -> Vec<u8> {
-        let mut buf = Vec::new();
+        let mut buf = vec![2, rank, flags, type_byte]; // version, rank, flags, type
-        buf.push(2); // version
-        buf.push(rank);
-        buf.push(flags);
-        buf.push(type_byte);
         for &d in dims {
             buf.extend_from_slice(&d.to_le_bytes());
         }
@@ -298,11 +318,7 @@ mod tests {
 
     #[test]
     fn v1_with_4byte_length() {
-        let mut buf = Vec::new();
+        let mut buf = vec![1, 1, 0, 0]; // version, rank, flags, reserved
-        buf.push(1); // version
-        buf.push(1); // rank
-        buf.push(0); // flags
-        buf.push(0); // reserved
         buf.extend_from_slice(&[0u8; 4]); // reserved(4)
         buf.extend_from_slice(&10u32.to_le_bytes()); // dim with length_size=4
         let ds = Dataspace::parse(&buf, 4).unwrap();

crates/clawhdf5-format/src/datatype.rs

@@ -36,8 +36,18 @@ pub enum CharacterSet {
 /// Reference type.
 #[derive(Debug, Clone, PartialEq)]
 pub enum ReferenceType {
+    /// Legacy object reference: the target's object header address.
     Object,
+    /// Legacy dataset region reference.
     DatasetRegion,
+    /// `H5T_STD_REF` object reference (HDF5 1.12+, datatype message version
+    /// 4): a small header followed by an object token. Decoded by
+    /// `data_read::read_object_references`.
+    Object2,
+    /// `H5T_STD_REF` dataset region reference.
+    DatasetRegion2,
+    /// `H5T_STD_REF` attribute reference.
+    Attribute,
 }
 
 /// A member of a compound datatype.
@@ -204,11 +214,25 @@ fn read_uint(data: &[u8], offset: usize, nbytes: usize) -> Result<u64, FormatErr
     })
 }
 
+/// Maximum recursion depth for nested datatypes (Compound/Enumeration/
+/// VariableLength/Array). A crafted file can nest a message-size-capped
+/// (65535 byte) datatype message ~8000 levels deep, which would blow the
+/// stack — especially on the project's no_std/embedded targets where
+/// available stack is a few KB.
+const MAX_DATATYPE_DEPTH: u16 = 64;
+
 impl Datatype {
     /// Parse a datatype message from raw bytes.
     ///
     /// Returns `(Datatype, bytes_consumed)` for recursive parsing.
     pub fn parse(data: &[u8]) -> Result<(Datatype, usize), FormatError> {
+        Self::parse_with_depth(data, 0)
+    }
+
+    fn parse_with_depth(data: &[u8], depth: u16) -> Result<(Datatype, usize), FormatError> {
+        if depth >= MAX_DATATYPE_DEPTH {
+            return Err(FormatError::NestingDepthExceeded);
+        }
         // Minimum header: 4 bytes (class_and_version + 3 bytes bit field) + 4 bytes size = 8
         ensure_len(data, 0, 8)?;
 
@@ -358,7 +382,8 @@ impl Datatype {
                         pos += name_len;
                         let byte_offset = read_uint(data, pos, ob)?;
                         pos += ob;
-                        let (member_dt, consumed) = Datatype::parse(&data[pos..])?;
+                        let (member_dt, consumed) =
+                            Self::parse_with_depth(&data[pos..], depth + 1)?;
                         pos += consumed;
                         members.push(CompoundMember {
                             name,
@@ -367,24 +392,29 @@ impl Datatype {
                         });
                     }
                 } else if version == 1 || version == 2 {
-                    // v1/v2: name, offset(4), dimensionality(1), reserved(3), dim_perm(4),
+                    // v1/v2: name (null-terminated, padded to a multiple of 8
-                    //         reserved_dims(up to 4*4=16), member datatype
+                    // bytes), offset(4), member datatype. v1 additionally
+                    // carries the legacy per-member array fields between the
+                    // offset and the member datatype: dimensionality(1),
+                    // reserved(3), dim_perm(4), reserved(4), 4 dim sizes(16).
+                    // v1 is what default (non-`latest`) libver bounds emit.
                     for _ in 0..num_members {
                         let (name, name_len) = read_null_terminated_string(data, pos)?;
-                        pos += name_len;
+                        let padded = name_len.checked_add(7).ok_or(FormatError::UnexpectedEof {
-                        // v1: names padded to 8-byte boundary
+                            expected: usize::MAX,
-                        if version == 1 {
+                            available: data.len(),
-                            let total_name_bytes = name_len;
+                        })? & !7;
-                            let padded = (total_name_bytes + 7) & !7;
+                        ensure_len(data, pos, padded)?;
-                            pos = pos - name_len + padded;
+                        pos += padded;
-                        }
                         ensure_len(data, pos, 4)?;
                         let byte_offset = LittleEndian::read_u32(&data[pos..pos + 4]) as u64;
                         pos += 4;
-                        // dimensionality(1) + reserved(3) + dim_perm(4) + 4 dim slots(16) = 24
+                        if version == 1 {
-                        ensure_len(data, pos, 24)?;
+                            ensure_len(data, pos, 28)?;
-                        pos += 24;
+                            pos += 28;
-                        let (member_dt, consumed) = Datatype::parse(&data[pos..])?;
+                        }
+                        let (member_dt, consumed) =
+                            Self::parse_with_depth(&data[pos..], depth + 1)?;
                         pos += consumed;
                         members.push(CompoundMember {
                             name,
@@ -404,9 +434,15 @@ impl Datatype {
             7 => {
                 // Reference
                 let ref_type_val = bf0 & 0x0F;
-                let ref_type = match ref_type_val {
+                // Datatype message version 4 (HDF5 1.12) revised this class:
-                    0 => ReferenceType::Object,
+                // types 2-4 are the new `H5T_STD_REF` references, and the high
-                    1 => ReferenceType::DatasetRegion,
+                // nibble of the first flag byte carries their encoding version.
+                let ref_type = match (ref_type_val, version) {
+                    (0, _) => ReferenceType::Object,
+                    (1, _) => ReferenceType::DatasetRegion,
+                    (2, 4..) => ReferenceType::Object2,
+                    (3, 4..) => ReferenceType::DatasetRegion2,
+                    (4, 4..) => ReferenceType::Attribute,
                     _ => return Err(FormatError::InvalidReferenceType(ref_type_val)),
                 };
                 Ok((Datatype::Reference { size, ref_type }, pos))
@@ -415,7 +451,7 @@ impl Datatype {
                 // Enumeration
                 let num_members = (bf0 as u16) | ((bf1 as u16) << 8);
                 // Parse base type
-                let (base_type, base_consumed) = Datatype::parse(&data[pos..])?;
+                let (base_type, base_consumed) = Self::parse_with_depth(&data[pos..], depth + 1)?;
                 pos += base_consumed;
                 let base_size = base_type.type_size();
                 let mut members = Vec::with_capacity(num_members as usize);
@@ -468,7 +504,7 @@ impl Datatype {
                 } else {
                     None
                 };
-                let (base_type, consumed) = Datatype::parse(&data[pos..])?;
+                let (base_type, consumed) = Self::parse_with_depth(&data[pos..], depth + 1)?;
                 pos += consumed;
                 Ok((
                     Datatype::VariableLength {
@@ -494,7 +530,7 @@ impl Datatype {
                     }
                     // skip permutation indices
                     pos += ndims * 4;
-                    let (base_type, consumed) = Datatype::parse(&data[pos..])?;
+                    let (base_type, consumed) = Self::parse_with_depth(&data[pos..], depth + 1)?;
                     pos += consumed;
                     Ok((
                         Datatype::Array {
@@ -515,7 +551,7 @@ impl Datatype {
                         dimensions.push(LittleEndian::read_u32(&data[pos..pos + 4]));
                         pos += 4;
                     }
-                    let (base_type, consumed) = Datatype::parse(&data[pos..])?;
+                    let (base_type, consumed) = Self::parse_with_depth(&data[pos..], depth + 1)?;
                     pos += consumed;
                     Ok((
                         Datatype::Array {
@@ -532,27 +568,39 @@ impl Datatype {
                 }
             }
             11 => {
-                // Complex number — store as compound of two floats internally
+                // Complex number (HDF5 2.0, datatype version 5). The properties
-                // Parse like compound with version 3 and 2 members
+                // are a single base floating-point datatype message; an element
-                // But actually class 11 has no special properties beyond class 6 compound.
+                // is two consecutive base-type values (real, imaginary). There
-                // It's just recognized as a separate class. For now parse the 2 members
+                // is no member list. Surface it as the equivalent two-member
-                // as compound.
+                // compound `{r, i}` — the same shape h5py writes for numpy
-                let num_members = (bf0 as u16) | ((bf1 as u16) << 8);
+                // complex dtypes — so downstream compound readers work as-is.
-                let mut members = Vec::with_capacity(num_members as usize);
+                if version != 5 {
-                let ob = offset_bytes_for_size(size);
+                    return Err(FormatError::InvalidDatatypeVersion {
-                for _ in 0..num_members {
+                        class: class_id,
-                    let (name, name_len) = read_null_terminated_string(data, pos)?;
+                        version,
-                    pos += name_len;
-                    let byte_offset = read_uint(data, pos, ob)?;
-                    pos += ob;
-                    let (member_dt, consumed) = Datatype::parse(&data[pos..])?;
-                    pos += consumed;
-                    members.push(CompoundMember {
-                        name,
-                        byte_offset,
-                        datatype: member_dt,
                     });
                 }
+                let (base_type, consumed) = Self::parse_with_depth(&data[pos..], depth + 1)?;
+                pos += consumed;
+                let base_size = base_type.type_size();
+                if base_size.checked_mul(2) != Some(size) {
+                    return Err(FormatError::DataSizeMismatch {
+                        expected: (base_size as usize).saturating_mul(2),
+                        actual: size as usize,
+                    });
+                }
+                let members = vec![
+                    CompoundMember {
+                        name: String::from("r"),
+                        byte_offset: 0,
+                        datatype: base_type.clone(),
+                    },
+                    CompoundMember {
+                        name: String::from("i"),
+                        byte_offset: base_size as u64,
+                        datatype: base_type,
+                    },
+                ];
                 Ok((Datatype::Compound { size, members }, pos))
             }
             _ => Err(FormatError::InvalidDatatypeClass(class_id)),
@@ -814,6 +862,39 @@ mod tests {
         buf
     }
 
+    /// A crafted datatype message nesting Variable-Length wrappers deeper
+    /// than `MAX_DATATYPE_DEPTH` must return `NestingDepthExceeded`
+    /// instead of overflowing the stack.
+    #[test]
+    fn nested_variable_length_exceeds_depth_limit() {
+        // Each VL level is just an 8-byte header (class 9, vl_type=0 =>
+        // sequence, no padding/charset fields) immediately followed by the
+        // next level's bytes, terminated by a fixed-point base type.
+        let levels = MAX_DATATYPE_DEPTH as usize + 10;
+        let mut data = Vec::new();
+        for _ in 0..levels {
+            data.extend_from_slice(&build_dt_header(9, 3, [0, 0, 0], 0));
+        }
+        data.extend_from_slice(&build_fixed_point(4, false, false, 0, 32));
+
+        let result = Datatype::parse(&data);
+        assert!(matches!(result, Err(FormatError::NestingDepthExceeded)));
+    }
+
+    /// A datatype nested just within the depth limit must still parse fine.
+    #[test]
+    fn nested_variable_length_within_depth_limit_ok() {
+        let levels = MAX_DATATYPE_DEPTH as usize - 1;
+        let mut data = Vec::new();
+        for _ in 0..levels {
+            data.extend_from_slice(&build_dt_header(9, 3, [0, 0, 0], 0));
+        }
+        data.extend_from_slice(&build_fixed_point(4, false, false, 0, 32));
+
+        let result = Datatype::parse(&data);
+        assert!(result.is_ok());
+    }
+
     #[test]
     fn test_fixed_point_u8() {
         let data = build_fixed_point(1, false, false, 0, 8);
@@ -1079,6 +1160,156 @@ mod tests {
         }
     }
 
+    /// Real datatype message bytes emitted by h5py 3.16 / HDF5 2.0 with
+    /// *default* libver bounds for [('x','f8'),('y','f8'),('id','i4')]:
+    /// compound datatype version 1 (padded names + 28 bytes of legacy
+    /// per-member array fields).
+    fn compound_v1_bytes() -> Vec<u8> {
+        let f64le: [u8; 20] = [
+            0x11, 0x20, 0x3f, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x34, 0x0b,
+            0x00, 0x34, 0xff, 0x03, 0x00, 0x00,
+        ];
+        let i32le: [u8; 12] = [
+            0x10, 0x08, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00,
+        ];
+        let mut b = vec![0x16, 0x03, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00];
+        for (name, offset, dt) in [
+            (&b"x"[..], 0u32, &f64le[..]),
+            (&b"y"[..], 8, &f64le[..]),
+            (&b"id"[..], 16, &i32le[..]),
+        ] {
+            let mut padded = name.to_vec();
+            padded.resize((name.len() + 1 + 7) & !7, 0);
+            b.extend_from_slice(&padded);
+            b.extend_from_slice(&offset.to_le_bytes());
+            b.extend_from_slice(&[0u8; 28]);
+            b.extend_from_slice(dt);
+        }
+        b
+    }
+
+    fn assert_xyid_compound(dt: Datatype) {
+        match dt {
+            Datatype::Compound { size, members } => {
+                assert_eq!(size, 20);
+                let got: Vec<(&str, u64, u32)> = members
+                    .iter()
+                    .map(|m| (m.name.as_str(), m.byte_offset, m.datatype.type_size()))
+                    .collect();
+                assert_eq!(got, vec![("x", 0, 8), ("y", 8, 8), ("id", 16, 4)]);
+            }
+            other => panic!("expected Compound, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn test_compound_v1_default_libver() {
+        let bytes = compound_v1_bytes();
+        let (dt, consumed) = Datatype::parse(&bytes).unwrap();
+        assert_eq!(consumed, bytes.len());
+        assert_xyid_compound(dt);
+    }
+
+    #[test]
+    fn test_compound_v2_padded_names_no_array_fields() {
+        // v2 = v1 without the 28 bytes of per-member array fields; names are
+        // still padded to a multiple of 8 (matches libhdf5's H5O decoder).
+        let v1 = compound_v1_bytes();
+        let mut v2 = vec![0x26, 0x03, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00];
+        let mut pos = 8;
+        for dt_len in [20usize, 20, 12] {
+            v2.extend_from_slice(&v1[pos..pos + 8 + 4]); // padded name + offset
+            pos += 8 + 4 + 28;
+            v2.extend_from_slice(&v1[pos..pos + dt_len]);
+            pos += dt_len;
+        }
+        let (dt, consumed) = Datatype::parse(&v2).unwrap();
+        assert_eq!(consumed, v2.len());
+        assert_xyid_compound(dt);
+    }
+
+    #[test]
+    fn test_compound_v1_truncated_is_error_not_panic() {
+        let bytes = compound_v1_bytes();
+        for cut in 8..bytes.len() {
+            assert!(Datatype::parse(&bytes[..cut]).is_err(), "cut at {cut}");
+        }
+    }
+
+    /// Real datatype message bytes emitted by HDF5 2.0 for the native complex
+    /// type `H5T_COMPLEX_IEEE_F64LE`: class 11, version 5, size 16, followed by
+    /// the base IEEE f64 datatype message.
+    const COMPLEX_F64_HDF5_2_0: [u8; 28] = [
+        0x5b, 0x01, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x11, 0x20, 0x3f, 0x00, 0x08, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x40, 0x00, 0x34, 0x0b, 0x00, 0x34, 0xff, 0x03, 0x00, 0x00,
+    ];
+
+    #[test]
+    fn test_complex_v5_from_hdf5_2_0() {
+        let (dt, consumed) = Datatype::parse(&COMPLEX_F64_HDF5_2_0).unwrap();
+        assert_eq!(consumed, COMPLEX_F64_HDF5_2_0.len());
+        match dt {
+            Datatype::Compound { size, members } => {
+                assert_eq!(size, 16);
+                assert_eq!(members.len(), 2);
+                assert_eq!((members[0].name.as_str(), members[0].byte_offset), ("r", 0));
+                assert_eq!((members[1].name.as_str(), members[1].byte_offset), ("i", 8));
+                for m in &members {
+                    assert!(matches!(
+                        m.datatype,
+                        Datatype::FloatingPoint { size: 8, .. }
+                    ));
+                }
+            }
+            other => panic!("expected Compound, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn test_compound_with_complex_member_from_hdf5_2_0() {
+        // Compound { z: complex f64 @0, k: i64 @16 } as written by HDF5 2.0.
+        // Regression guard: the complex member must consume exactly its own
+        // bytes so the following member parses.
+        let mut bytes = vec![
+            0x56, 0x02, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, b'z', 0x00, 0x00,
+        ];
+        bytes.extend_from_slice(&COMPLEX_F64_HDF5_2_0);
+        bytes.extend_from_slice(&[b'k', 0x00, 0x10]);
+        bytes.extend_from_slice(&[
+            0x10, 0x08, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,
+        ]);
+        let (dt, consumed) = Datatype::parse(&bytes).unwrap();
+        assert_eq!(consumed, bytes.len());
+        match dt {
+            Datatype::Compound { size, members } => {
+                assert_eq!(size, 24);
+                assert_eq!(members.len(), 2);
+                assert!(matches!(
+                    &members[0].datatype,
+                    Datatype::Compound { size: 16, members } if members.len() == 2
+                ));
+                assert_eq!(
+                    (members[1].name.as_str(), members[1].byte_offset),
+                    ("k", 16)
+                );
+            }
+            other => panic!("expected Compound, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn test_complex_size_mismatch_rejected() {
+        let mut bytes = COMPLEX_F64_HDF5_2_0;
+        bytes[4] = 0x0c; // claims 12 bytes, base type is 8
+        assert!(matches!(
+            Datatype::parse(&bytes),
+            Err(FormatError::DataSizeMismatch {
+                expected: 16,
+                actual: 12
+            })
+        ));
+    }
+
     #[test]
     fn test_reference_object() {
         let buf = build_dt_header(7, 1, [0, 0, 0], 8);
@@ -1348,6 +1579,28 @@ mod tests {
         assert_eq!(err, FormatError::InvalidCharacterSet(2));
     }
 
+    #[test]
+    fn test_reference_v4_std_ref_from_hdf5_2_0() {
+        // Datatype message of an H5T_STD_REF dataset written by HDF5 2.0:
+        // class 7, version 4, type 2 (object), encoding version 1, 18 bytes.
+        let bytes = [0x47, 0x12, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00];
+        let (dt, consumed) = Datatype::parse(&bytes).unwrap();
+        assert_eq!(consumed, 8);
+        assert_eq!(
+            dt,
+            Datatype::Reference {
+                size: 18,
+                ref_type: ReferenceType::Object2
+            }
+        );
+        // The new types are only valid from datatype version 4.
+        let old_version = [0x37, 0x12, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00];
+        assert_eq!(
+            Datatype::parse(&old_version).unwrap_err(),
+            FormatError::InvalidReferenceType(2)
+        );
+    }
+
     #[test]
     fn test_error_invalid_reference_type() {
         let buf = build_dt_header(7, 1, [5, 0, 0], 8);

crates/clawhdf5-format/src/error.rs

@@ -114,6 +114,23 @@ pub enum FormatError {
     InvalidAttributeInfoVersion(u8),
     /// Invalid shared message version.
     InvalidSharedMessageVersion(u8),
+    /// A message is marked shared but was parsed without access to the file,
+    /// so the reference to the real message could not be followed.
+    UnresolvedSharedMessage,
+    /// A selection does not fit the dataset it was applied to (wrong rank, or
+    /// it reaches past a dimension's extent).
+    SelectionOutOfBounds(String),
+    /// The dataset's raw data is stored in external files (External Data
+    /// Files message), which this reader does not follow.
+    ExternalDataFilesUnsupported,
+    /// The path goes through an external link (a link into another file),
+    /// which this reader does not follow.
+    ExternalLinkUnsupported {
+        /// The file the link points into.
+        filename: String,
+        /// The object path within that file.
+        object_path: String,
+    },
     /// Invalid SOHM table version.
     InvalidSohmTableVersion(u8),
     /// Invalid SOHM table signature (expected "SMTB").
@@ -307,6 +324,25 @@ impl fmt::Display for FormatError {
             FormatError::InvalidSharedMessageVersion(v) => {
                 write!(f, "invalid shared message version: {v}")
             }
+            FormatError::ExternalLinkUnsupported {
+                filename,
+                object_path,
+            } => write!(
+                f,
+                "path goes through an external link to {object_path} in {filename}, which is \
+                 not supported"
+            ),
+            FormatError::ExternalDataFilesUnsupported => write!(
+                f,
+                "dataset raw data is stored in external file(s), which is not supported"
+            ),
+            FormatError::SelectionOutOfBounds(msg) => {
+                write!(f, "selection out of bounds: {msg}")
+            }
+            FormatError::UnresolvedSharedMessage => write!(
+                f,
+                "message is shared but no file data was available to resolve it"
+            ),
             FormatError::InvalidSohmTableVersion(v) => {
                 write!(f, "invalid SOHM table version: {v}")
             }

crates/clawhdf5-format/src/extensible_array.rs

@@ -12,6 +12,31 @@ use alloc::{format, vec, vec::Vec};
 use crate::chunked_read::ChunkInfo;
 use crate::error::FormatError;
 
+/// Verify the Jenkins lookup3 checksum stored immediately after
+/// `data[start..end]`, as every Extensible Array structure carries one.
+///
+/// A corrupt chunk index yields addresses pointing at the wrong bytes, so a
+/// mismatch is an error: otherwise the damage surfaces as plausible data read
+/// from the wrong chunk.
+#[cfg(feature = "checksum")]
+fn verify_checksum(data: &[u8], start: usize, end: usize) -> Result<(), FormatError> {
+    ensure_len(data, end, 4)?;
+    let stored = u32::from_le_bytes([data[end], data[end + 1], data[end + 2], data[end + 3]]);
+    let computed = crate::checksum::jenkins_lookup3(&data[start..end]);
+    if computed != stored {
+        return Err(FormatError::ChecksumMismatch {
+            expected: stored,
+            computed,
+        });
+    }
+    Ok(())
+}
+
+#[cfg(not(feature = "checksum"))]
+fn verify_checksum(_data: &[u8], _start: usize, _end: usize) -> Result<(), FormatError> {
+    Ok(())
+}
+
 /// Parsed Extensible Array header (AEHD).
 #[derive(Debug, Clone)]
 pub struct ExtensibleArrayHeader {
@@ -54,6 +79,19 @@ fn read_offset(data: &[u8], pos: usize, size: u8) -> Result<u64, FormatError> {
     })
 }
 
+fn ensure_len(data: &[u8], offset: usize, needed: usize) -> Result<(), FormatError> {
+    if offset
+        .checked_add(needed)
+        .is_none_or(|end| end > data.len())
+    {
+        return Err(FormatError::UnexpectedEof {
+            expected: offset.saturating_add(needed),
+            available: data.len(),
+        });
+    }
+    Ok(())
+}
+
 fn is_undefined_addr(addr: u64, offset_size: u8) -> bool {
     match offset_size {
         2 => addr == 0xFFFF,
@@ -98,12 +136,7 @@ impl ExtensibleArrayHeader {
         //   6 stats fields (each length_size) + index_block_address(offset_size) + checksum(4)
         let min_size =
             4 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 6 * length_size as usize + offset_size as usize + 4;
-        if offset + min_size > file_data.len() {
+        ensure_len(file_data, offset, min_size)?;
-            return Err(FormatError::UnexpectedEof {
-                expected: offset + min_size,
-                available: file_data.len(),
-            });
-        }
 
         let d = &file_data[offset..];
         if &d[0..4] != b"EAHD" {
@@ -137,6 +170,8 @@ impl ExtensibleArrayHeader {
         pos += ls; // skip nelmts
         pos += ls; // skip max_idx_set (6th stats field)
         let index_block_address = read_offset(d, pos, offset_size)?;
+        pos += offset_size as usize;
+        verify_checksum(file_data, offset, offset + pos)?;
 
         Ok(ExtensibleArrayHeader {
             client_id,
@@ -262,6 +297,40 @@ fn index_to_chunk_offsets(
 
 /// Collect elements from a data block at the given offset.
 #[allow(clippy::too_many_arguments)]
+/// Layout of super block `u`, per the HDF5 spec: the number of data blocks it
+/// owns and how many elements each of them holds.
+///
+/// `ndblks` and `dblk_nelmts` each double every *other* level, a half-step
+/// apart, so the blocks grow as 1x16, 1x32, 2x32, 2x64, 4x64 ... for a
+/// 16-element minimum. Treating either as doubling every level (the previous
+/// implementation) puts every element after the first data block at the wrong
+/// index.
+fn sblk_info(u: usize, data_blk_min_elmts: usize) -> Option<(usize, usize)> {
+    let ndblks = 1usize.checked_shl((u / 2) as u32)?;
+    let dblk_nelmts = 1usize
+        .checked_shl(u.div_ceil(2) as u32)?
+        .checked_mul(data_blk_min_elmts)?;
+    Some((ndblks, dblk_nelmts))
+}
+
+/// Width of the "offset of the block in the array" field carried by super and
+/// data blocks (`hdr->arr_off_size`).
+fn arr_off_size(header: &ExtensibleArrayHeader) -> usize {
+    (header.max_nelmts_bits as usize).div_ceil(8)
+}
+
+/// Elements per data block page, once a data block is large enough to be paged.
+fn page_nelmts(header: &ExtensibleArrayHeader) -> Option<usize> {
+    1usize.checked_shl(u32::from(header.max_dblk_nelmts_bits))
+}
+
+/// Read the elements of one data block (EADB).
+///
+/// `page_init` is the owning super block's page-init bitmap and `first_page`
+/// this block's first bit in it; both are only consulted when the block is
+/// paged. The bitmap lives in the super block, not here — a paged data block
+/// stores only its prefix, then one slot per page.
+#[allow(clippy::too_many_arguments)]
 fn read_data_block_elements(
     file_data: &[u8],
     db_offset: usize,
@@ -272,122 +341,101 @@ fn read_data_block_elements(
     start_index: usize,
     num_chunks_per_dim: &[u64],
     chunk_dimensions: &[u32],
+    page_init: &[u8],
+    first_page: usize,
 ) -> Result<Vec<ChunkInfo>, FormatError> {
-    // AEDB: signature(4) + version(1) + client_id(1) + header_address(offset_size)
+    // EADB: signature(4) + version(1) + client_id(1) + header_address(offset_size)
-    let db_header_size = 4 + 1 + 1 + offset_size as usize;
+    //       + block offset(arr_off_size)
-    if db_offset + db_header_size > file_data.len() {
+    let db_header_size = 4 + 1 + 1 + offset_size as usize + arr_off_size(header);
-        return Err(FormatError::UnexpectedEof {
+    ensure_len(file_data, db_offset, db_header_size)?;
-            expected: db_offset + db_header_size,
-            available: file_data.len(),
-        });
-    }
 
-    let d = &file_data[db_offset..];
+    if &file_data[db_offset..db_offset + 4] != b"EADB" {
-    if &d[0..4] != b"EADB" {
         return Err(FormatError::ChunkedReadError(
             "invalid Extensible Array data block signature".into(),
         ));
     }
-    // Skip version(1) + client_id(1) + header_address(offset_size) + block_offset
-    // Block offset is encoded in ceil(max_nelmts_bits/8) bytes
-    let blk_off_size = (header.max_nelmts_bits as usize).div_ceil(8);
-    let mut pos = db_offset + db_header_size + blk_off_size;
 
-    // Check if paged
+    let mut pos = db_offset + db_header_size;
-    if header.max_nelmts_bits >= usize::BITS as u8 {
+    let page = page_nelmts(header).ok_or_else(|| {
-        return Err(FormatError::Overflow(
+        FormatError::Overflow("Extensible Array page element count overflows usize".into())
-            "max_nelmts_bits exceeds usize bit width".into(),
+    })?;
-        ));
-    }
-    let page_nelmts = 1usize << header.max_nelmts_bits;
-    let is_paged = nelmts > page_nelmts;
 
     let mut chunks = Vec::new();
-
+    let read_run = |from: usize,
-    if !is_paged {
+                    count: usize,
-        for i in 0..nelmts {
+                    first_index: usize,
+                    chunks: &mut Vec<ChunkInfo>|
+     -> Result<usize, FormatError> {
+        let mut p = from;
+        for i in 0..count {
             let (info, consumed) = read_element(
                 file_data,
-                pos,
+                p,
                 header.client_id,
                 header.element_size,
                 offset_size,
                 chunk_byte_size,
-                start_index + i,
+                first_index + i,
                 num_chunks_per_dim,
                 chunk_dimensions,
             )?;
             if let Some(ci) = info {
                 chunks.push(ci);
             }
-            pos += consumed;
+            p += consumed;
         }
-    } else {
+        Ok(p)
-        // Paged: elements are split into pages of page_nelmts.
+    };
-        // After the data block header comes a page bitmap, then each page
-        // has page_nelmts elements followed by a 4-byte checksum.
-        let npages = nelmts.div_ceil(page_nelmts);
-        // Page bitmap: ceil(npages / 8) bytes
-        let bitmap_size = npages.div_ceil(8);
-        // Read bitmap
-        if pos + bitmap_size > file_data.len() {
-            return Err(FormatError::UnexpectedEof {
-                expected: pos + bitmap_size,
-                available: file_data.len(),
-            });
-        }
-        let bitmap = &file_data[pos..pos + bitmap_size];
-        pos += bitmap_size;
 
+    if nelmts <= page {
+        // Prefix and elements are covered by one checksum.
         let elem_bytes = if header.client_id == 0 {
             offset_size as usize
         } else {
             header.element_size as usize
         };
+        let end = nelmts
+            .checked_mul(elem_bytes)
+            .and_then(|b| pos.checked_add(b))
+            .ok_or_else(|| FormatError::Overflow("Extensible Array data block span".into()))?;
+        verify_checksum(file_data, db_offset, end)?;
+        read_run(pos, nelmts, start_index, &mut chunks)?;
+        return Ok(chunks);
+    }
 
-        let mut global_idx = start_index;
+    // Paged: the prefix ends with its own checksum, then one slot per page,
-        for page_idx in 0..npages {
+    // each holding `page` elements followed by a checksum. Pages whose bit is
-            let byte_idx = page_idx / 8;
+    // clear were never written; their slot still occupies the file, so stride
-            let bit_idx = page_idx % 8;
+    // over it rather than reading zeros as addresses.
-            let page_has_data = (bitmap[byte_idx] >> bit_idx) & 1 != 0;
+    verify_checksum(file_data, db_offset, pos)?;
-
+    pos += 4;
-            let elems_this_page = if page_idx == npages - 1 {
+    let elem_bytes = if header.client_id == 0 {
-                let remainder = nelmts % page_nelmts;
+        offset_size as usize
-                if remainder == 0 {
+    } else {
-                    page_nelmts
+        header.element_size as usize
-                } else {
+    };
-                    remainder
+    let page_stride = page
-                }
+        .checked_mul(elem_bytes)
-            } else {
+        .and_then(|b| b.checked_add(4))
-                page_nelmts
+        .ok_or_else(|| FormatError::Overflow("Extensible Array page stride".into()))?;
-            };
+    let npages = nelmts.div_ceil(page);
-
+    for p in 0..npages {
-            if page_has_data {
+        // One bit per page across the whole super block, packed contiguously
-                for i in 0..elems_this_page {
+        // and MSB-first within each byte, as H5VM_bit_get reads it.
-                    let (info, consumed) = read_element(
+        let bit = first_page + p;
-                        file_data,
+        let initialised = page_init
-                        pos,
+            .get(bit / 8)
-                        header.client_id,
+            .is_some_and(|byte| byte & (0x80 >> (bit % 8)) != 0);
-                        header.element_size,
+        if initialised {
-                        offset_size,
+            let count = core::cmp::min(page, nelmts - p * page);
-                        chunk_byte_size,
+            // Each page carries its own checksum, over a full page's worth of
-                        global_idx + i,
+            // slots even when the last one holds fewer live elements.
-                        num_chunks_per_dim,
+            verify_checksum(file_data, pos, pos + page * elem_bytes)?;
-                        chunk_dimensions,
+            read_run(pos, count, start_index + p * page, &mut chunks)?;
-                    )?;
-                    if let Some(ci) = info {
-                        chunks.push(ci);
-                    }
-                    pos += consumed;
-                }
-                // Skip page checksum (4 bytes)
-                pos += 4;
-            } else {
-                // Empty page: skip all elements + checksum
-                pos += elems_this_page * elem_bytes + 4;
-            }
-            global_idx += elems_this_page;
         }
+        pos = pos
+            .checked_add(page_stride)
+            .ok_or_else(|| FormatError::Overflow("Extensible Array page offset".into()))?;
     }
 
     Ok(chunks)
@@ -424,35 +472,83 @@ pub fn read_extensible_array_chunks(
     let chunk_byte_size: u64 =
         chunk_dimensions.iter().map(|&d| d as u64).product::<u64>() * element_size as u64;
 
-    // Parse index block (AEIB)
+    // Parse index block (EAIB): signature(4) + version(1) + client_id(1)
+    // + header address(offset_size), then the inline elements, then the
+    // direct data block addresses, then the super block addresses.
     let ib_offset = header.index_block_address as usize;
-    let ib_header_size = 4 + 1 + 1 + offset_size as usize; // sig + ver + client + hdr_addr
+    let ib_header_size = 4 + 1 + 1 + os;
-    if ib_offset + ib_header_size > file_data.len() {
+    ensure_len(file_data, ib_offset, ib_header_size)?;
-        return Err(FormatError::UnexpectedEof {
-            expected: ib_offset + ib_header_size,
-            available: file_data.len(),
-        });
-    }
 
-    let ib = &file_data[ib_offset..];
+    if &file_data[ib_offset..ib_offset + 4] != b"EAIB" {
-    if &ib[0..4] != b"EAIB" {
         return Err(FormatError::ChunkedReadError(
             "invalid Extensible Array index block signature".into(),
         ));
     }
-    // Skip version(1) + client_id(1) + header_address(offset_size)
     let mut pos = ib_offset + ib_header_size;
 
     let mut chunks = Vec::new();
-    let mut global_index = 0usize;
     let total_elements = header.num_elements as usize;
 
-    // 1. Read inline elements in index block
+    let dmin = header.min_dblk_nelmts as usize;
-    let n_inline = header.idx_blk_elmts as usize;
+    if dmin == 0 || !dmin.is_power_of_two() {
-    for i in 0..n_inline {
+        return Err(FormatError::ChunkedReadError(
-        if global_index + i >= total_elements {
+            "Extensible Array data block minimum is not a power of two".into(),
-            break;
+        ));
+    }
+    // nsblks = 1 + (max_nelmts_bits - log2(data_blk_min_elmts)), and the index
+    // block holds 2 * (sup_blk_min_data_ptrs - 1) data block addresses.
+    let log2_dmin = dmin.trailing_zeros() as usize;
+    let nsblks = 1 + (header.max_nelmts_bits as usize).saturating_sub(log2_dmin);
+    let ndblk_addrs = 2 * (header.super_blk_min_nelmts as usize).saturating_sub(1);
+
+    // The data blocks listed directly in the index block are the first
+    // `ndblk_addrs` in super-block order, each sized by the level it belongs
+    // to; the super block addresses that follow resume at the next level.
+    let mut direct: Vec<usize> = Vec::with_capacity(ndblk_addrs);
+    let mut level = 0usize;
+    while direct.len() < ndblk_addrs {
+        if level >= nsblks {
+            return Err(FormatError::ChunkedReadError(
+                "Extensible Array index block claims more data blocks than the array has".into(),
+            ));
         }
+        let (ndblks, dblk_nelmts) = sblk_info(level, dmin).ok_or_else(|| {
+            FormatError::Overflow("Extensible Array super block layout overflows usize".into())
+        })?;
+        for _ in 0..ndblks {
+            direct.push(dblk_nelmts);
+        }
+        level += 1;
+    }
+    if direct.len() != ndblk_addrs {
+        // A partial level in the index block is not a layout HDF5 produces,
+        // and guessing where the super blocks resume would misplace elements.
+        return Err(FormatError::ChunkedReadError(
+            "Extensible Array index block ends mid super block".into(),
+        ));
+    }
+
+    // One checksum covers the prefix, every inline element slot, and every
+    // data block and super block address.
+    let elem_bytes = if header.client_id == 0 {
+        os
+    } else {
+        header.element_size as usize
+    };
+    let ib_end = (header.idx_blk_elmts as usize)
+        .checked_mul(elem_bytes)
+        .and_then(|b| pos.checked_add(b))
+        .and_then(|p| {
+            ndblk_addrs
+                .checked_add(nsblks - level)
+                .and_then(|n| n.checked_mul(os).and_then(|b| p.checked_add(b)))
+        })
+        .ok_or_else(|| FormatError::Overflow("Extensible Array index block span".into()))?;
+    verify_checksum(file_data, ib_offset, ib_end)?;
+
+    // 1. Elements stored inline in the index block.
+    let n_inline = (header.idx_blk_elmts as usize).min(total_elements);
+    for i in 0..n_inline {
         let (info, consumed) = read_element(
             file_data,
             pos,
@@ -460,7 +556,7 @@ pub fn read_extensible_array_chunks(
             header.element_size,
             offset_size,
             chunk_byte_size,
-            global_index + i,
+            i,
             &num_chunks_per_dim,
             chunk_dimensions,
         )?;
@@ -469,154 +565,90 @@ pub fn read_extensible_array_chunks(
         }
         pos += consumed;
     }
-    global_index += n_inline.min(total_elements);
+    let mut global_index = n_inline;
-
-    // If all elements were inline, we're done
     if global_index >= total_elements {
         return Ok(chunks);
     }
 
-    // Compute data block and super block counts
+    // 2. Data blocks listed directly in the index block.
-    let min_dblk = header.min_dblk_nelmts as usize;
+    for &dblk_nelmts in &direct {
-    let sblk_min = header.super_blk_min_nelmts as usize;
+        if global_index >= total_elements {
-
+            return Ok(chunks);
-    // The first sblk_min super block levels have their data blocks listed directly
+        }
-    // in the index block. Compute their sizes.
+        ensure_len(file_data, pos, os)?;
-    let mut n_direct_dblks = 0usize;
+        let addr = read_offset(file_data, pos, offset_size)?;
-    let mut dblk_sizes: Vec<usize> = Vec::new();
+        pos += os;
-    {
+        if !is_undefined_addr(addr, offset_size) {
-        let mut nelmts = min_dblk;
+            if dblk_nelmts > page_nelmts(header).unwrap_or(usize::MAX) {
-        for sb_level in 0..sblk_min {
+                // Would need a page-init bitmap, which only a super block
-            if sb_level >= usize::BITS as usize {
+                // carries. HDF5 never pages these small early blocks.
-                return Err(FormatError::Overflow(
+                return Err(FormatError::ChunkedReadError(
-                    "sb_level exceeds usize bit width".into(),
+                    "Extensible Array index block references a paged data block".into(),
                 ));
             }
-            let ndblks = 1usize << sb_level;
+            chunks.extend(read_data_block_elements(
-            for _ in 0..ndblks {
+                file_data,
-                dblk_sizes.push(nelmts);
+                addr as usize,
-                n_direct_dblks += 1;
+                dblk_nelmts,
-            }
+                header,
-            if sb_level > 0 {
+                offset_size,
-                nelmts *= 2;
+                chunk_byte_size,
-            }
+                global_index,
+                &num_chunks_per_dim,
+                chunk_dimensions,
+                &[],
+                0,
+            )?);
         }
+        global_index += dblk_nelmts;
     }
 
-    // Read direct data block addresses from index block
+    // 3. Everything else lives in super blocks, one address per remaining
-    let mut dblk_addrs: Vec<u64> = Vec::with_capacity(n_direct_dblks);
+    //    level, starting at the level after the direct data blocks.
-    for _ in 0..n_direct_dblks {
+    for u in level..nsblks {
-        if pos + os > file_data.len() {
+        if global_index >= total_elements {
             break;
         }
-        let addr = read_offset(file_data, pos, offset_size)?;
+        ensure_len(file_data, pos, os)?;
-        dblk_addrs.push(addr);
+        let sb_addr = read_offset(file_data, pos, offset_size)?;
         pos += os;
-    }
+        let (ndblks, dblk_nelmts) = sblk_info(u, dmin).ok_or_else(|| {
-
+            FormatError::Overflow("Extensible Array super block layout overflows usize".into())
-    // Read elements from direct data blocks
+        })?;
-    for (i, &addr) in dblk_addrs.iter().enumerate() {
+        if !is_undefined_addr(sb_addr, offset_size) {
-        if i >= dblk_sizes.len() {
+            chunks.extend(read_super_block(
-            break;
+                file_data,
+                sb_addr as usize,
+                ndblks,
+                dblk_nelmts,
+                header,
+                offset_size,
+                chunk_byte_size,
+                global_index,
+                &num_chunks_per_dim,
+                chunk_dimensions,
+            )?);
         }
-        let nelmts = dblk_sizes[i];
+        global_index =
-        if is_undefined_addr(addr, offset_size) {
+            global_index.saturating_add(ndblks.checked_mul(dblk_nelmts).ok_or_else(|| {
-            global_index += nelmts;
+                FormatError::Overflow("Extensible Array super block span".into())
-            continue;
+            })?);
-        }
-        let block_chunks = read_data_block_elements(
-            file_data,
-            addr as usize,
-            nelmts,
-            header,
-            offset_size,
-            chunk_byte_size,
-            global_index,
-            &num_chunks_per_dim,
-            chunk_dimensions,
-        )?;
-        chunks.extend(block_chunks);
-        global_index += nelmts;
-    }
-
-    // Remaining elements are in super blocks
-    let total_in_ib_and_direct: usize = n_inline + dblk_sizes.iter().sum::<usize>();
-    if total_elements <= total_in_ib_and_direct {
-        return Ok(chunks);
-    }
-    let remaining_elements = total_elements - total_in_ib_and_direct;
-
-    // Compute super block layout
-    let mut sb_addrs: Vec<u64> = Vec::new();
-    let mut sb_infos: Vec<(usize, usize)> = Vec::new();
-    {
-        let mut covered = 0usize;
-        let mut sb_level = sblk_min;
-        let mut nelmts_per_dblk = min_dblk;
-        for lev in 0..sblk_min {
-            if lev > 0 {
-                nelmts_per_dblk *= 2;
-            }
-        }
-
-        while covered < remaining_elements {
-            if sb_level >= usize::BITS as usize {
-                return Err(FormatError::Overflow(
-                    "sb_level exceeds usize bit width".into(),
-                ));
-            }
-            let ndblks = 1usize << sb_level;
-            nelmts_per_dblk *= 2;
-            let total_in_sb = ndblks * nelmts_per_dblk;
-            sb_infos.push((ndblks, nelmts_per_dblk));
-            covered += total_in_sb;
-            sb_level += 1;
-        }
-    }
-
-    // Read super block addresses from index block
-    for _ in 0..sb_infos.len() {
-        if pos + os > file_data.len() {
-            break;
-        }
-        let addr = read_offset(file_data, pos, offset_size)?;
-        sb_addrs.push(addr);
-        pos += os;
-    }
-
-    // Process each super block
-    for (sb_idx, &sb_addr) in sb_addrs.iter().enumerate() {
-        let (ndblks, nelmts_per_dblk) = sb_infos[sb_idx];
-        if is_undefined_addr(sb_addr, offset_size) {
-            global_index += ndblks * nelmts_per_dblk;
-            continue;
-        }
-        let sb_chunks = read_super_block(
-            file_data,
-            sb_addr as usize,
-            ndblks,
-            nelmts_per_dblk,
-            header,
-            offset_size,
-            chunk_byte_size,
-            global_index,
-            &num_chunks_per_dim,
-            chunk_dimensions,
-        )?;
-        chunks.extend(sb_chunks);
-        global_index += ndblks * nelmts_per_dblk;
     }
 
     Ok(chunks)
 }
 
-/// Read a super block (AESB) and its data blocks.
+/// Read a super block (EASB) and the data blocks it owns.
+///
+/// On disk: signature(4) + version(1) + client_id(1) + header address
+/// + block offset + the page-init bitmap for every data block it owns
+/// + one address per data block + checksum.
 #[allow(clippy::too_many_arguments)]
 fn read_super_block(
     file_data: &[u8],
     sb_offset: usize,
     ndblks: usize,
-    nelmts_per_dblk: usize,
+    dblk_nelmts: usize,
     header: &ExtensibleArrayHeader,
     offset_size: u8,
     chunk_byte_size: u64,
@@ -625,15 +657,8 @@ fn read_super_block(
     chunk_dimensions: &[u32],
 ) -> Result<Vec<ChunkInfo>, FormatError> {
     let os = offset_size as usize;
-
+    let sb_header_size = 4 + 1 + 1 + os + arr_off_size(header);
-    // AESB: signature(4) + version(1) + client_id(1) + header_address(offset_size)
+    ensure_len(file_data, sb_offset, sb_header_size)?;
-    let sb_header_size = 4 + 1 + 1 + os;
-    if sb_offset + sb_header_size > file_data.len() {
-        return Err(FormatError::UnexpectedEof {
-            expected: sb_offset + sb_header_size,
-            available: file_data.len(),
-        });
-    }
 
     if &file_data[sb_offset..sb_offset + 4] != b"EASB" {
         return Err(FormatError::ChunkedReadError(
@@ -641,43 +666,57 @@ fn read_super_block(
         ));
     }
 
-    let mut pos = sb_offset + sb_header_size;
+    // Page-init bitmap: one bit per page, `npages` bits per data block, packed
-
+    // contiguously. HDF5 sizes the buffer `ndblks * ceil(npages / 8)`, which
-    // Read data block addresses
+    // is bigger than the bits need when `npages` is not a multiple of eight.
-    let mut dblk_addrs: Vec<u64> = Vec::with_capacity(ndblks);
+    // Zero-sized unless this level's data blocks are paged.
-    for _ in 0..ndblks {
+    let page = page_nelmts(header).ok_or_else(|| {
-        if pos + os > file_data.len() {
+        FormatError::Overflow("Extensible Array page element count overflows usize".into())
-            return Err(FormatError::UnexpectedEof {
+    })?;
-                expected: pos + os,
+    let npages = if dblk_nelmts > page {
-                available: file_data.len(),
+        dblk_nelmts / page
-            });
+    } else {
-        }
+        0
-        let addr = read_offset(file_data, pos, offset_size)?;
+    };
-        dblk_addrs.push(addr);
+    let per_dblk_bitmap = npages.div_ceil(8);
-        pos += os;
+    let bitmap_bytes = per_dblk_bitmap
-    }
+        .checked_mul(ndblks)
+        .ok_or_else(|| FormatError::Overflow("Extensible Array page bitmap size".into()))?;
+    let bitmap_start = sb_offset + sb_header_size;
+    ensure_len(file_data, bitmap_start, bitmap_bytes)?;
+    let bitmap = &file_data[bitmap_start..bitmap_start + bitmap_bytes];
 
+    let mut pos = bitmap_start + bitmap_bytes;
     let mut chunks = Vec::new();
     let mut global_idx = start_index;
 
-    for &addr in &dblk_addrs {
+    // One checksum covers the prefix, the bitmap and every data block address.
-        if is_undefined_addr(addr, offset_size) {
+    let sb_end = ndblks
-            global_idx += nelmts_per_dblk;
+        .checked_mul(os)
-            continue;
+        .and_then(|b| pos.checked_add(b))
+        .ok_or_else(|| FormatError::Overflow("Extensible Array super block span".into()))?;
+    verify_checksum(file_data, sb_offset, sb_end)?;
+
+    for i in 0..ndblks {
+        ensure_len(file_data, pos, os)?;
+        let addr = read_offset(file_data, pos, offset_size)?;
+        pos += os;
+        if !is_undefined_addr(addr, offset_size) {
+            chunks.extend(read_data_block_elements(
+                file_data,
+                addr as usize,
+                dblk_nelmts,
+                header,
+                offset_size,
+                chunk_byte_size,
+                global_idx,
+                num_chunks_per_dim,
+                chunk_dimensions,
+                bitmap,
+                i * npages,
+            )?);
         }
-        let block_chunks = read_data_block_elements(
+        global_idx += dblk_nelmts;
-            file_data,
-            addr as usize,
-            nelmts_per_dblk,
-            header,
-            offset_size,
-            chunk_byte_size,
-            global_idx,
-            num_chunks_per_dim,
-            chunk_dimensions,
-        )?;
-        chunks.extend(block_chunks);
-        global_idx += nelmts_per_dblk;
     }
 
     Ok(chunks)
@@ -686,6 +725,14 @@ fn read_super_block(
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    /// Stamp the Jenkins checksum a real file would carry over
+    /// `data[start..end]`, writing it at `end`. Hand-built fixtures need this
+    /// now that the reader validates it, exactly as HDF5 writes it.
+    fn stamp_checksum(data: &mut [u8], start: usize, end: usize) {
+        let sum = crate::checksum::jenkins_lookup3(&data[start..end]);
+        data[end..end + 4].copy_from_slice(&sum.to_le_bytes());
+    }
     #[test]
     fn index_to_offsets_1d() {
         let num_chunks = vec![5u64];
@@ -741,6 +788,7 @@ mod tests {
         buf[44..52].copy_from_slice(&5u64.to_le_bytes()); // stat[4] = num_elements
         buf[52..60].copy_from_slice(&0u64.to_le_bytes()); // stat[5]
         buf[60..68].copy_from_slice(&0x1000u64.to_le_bytes()); // index_block_address
+        stamp_checksum(&mut buf, 0, 68);
 
         let hdr = ExtensibleArrayHeader::parse(&buf, 0, os, ls).unwrap();
         assert_eq!(hdr.client_id, 0);
@@ -759,6 +807,33 @@ mod tests {
         assert!(result.is_err());
     }
 
+    /// A near-`usize::MAX` offset must error cleanly, not overflow/panic.
+    #[test]
+    fn parse_rejects_offset_overflow() {
+        let buf = vec![0u8; 64];
+        let result = ExtensibleArrayHeader::parse(&buf, usize::MAX - 4, 8, 8);
+        assert!(result.is_err());
+    }
+
+    /// A near-`usize::MAX` index block address must error cleanly, not overflow/panic.
+    #[test]
+    fn read_rejects_index_block_offset_overflow() {
+        let header = ExtensibleArrayHeader {
+            client_id: 0,
+            element_size: 8,
+            max_nelmts_bits: 10,
+            idx_blk_elmts: 2,
+            min_dblk_nelmts: 4,
+            super_blk_min_nelmts: 2,
+            max_dblk_nelmts_bits: 8,
+            num_elements: 5,
+            index_block_address: (usize::MAX - 4) as u64,
+        };
+        let buf = vec![0u8; 64];
+        let r = read_extensible_array_chunks(&buf, &header, &[100], &[20], 8, 8, 8);
+        assert!(r.is_err());
+    }
+
     #[test]
     fn parse_header_invalid_version() {
         let mut buf = vec![0u8; 256];
@@ -799,6 +874,7 @@ mod tests {
             .copy_from_slice(&(num_chunks as u64).to_le_bytes());
         file_data[aehd_offset + 60..aehd_offset + 68]
             .copy_from_slice(&(aeib_offset as u64).to_le_bytes());
+        stamp_checksum(&mut file_data, aehd_offset, aehd_offset + 68);
         // checksum (4 bytes at +68) — not validated
 
         // Build AEIB at aeib_offset
@@ -816,6 +892,23 @@ mod tests {
             let p = elem_start + i * osv;
             file_data[p..p + osv].copy_from_slice(&addr.to_le_bytes());
         }
+        // The index block's checksum covers its prefix, every inline element
+        // slot, and every data block and super block address slot:
+        // ndblk_addrs = 2 * (sup_blk_min_data_ptrs - 1), and the super block
+        // pointers make up the rest of nsblks levels.
+        let sup_ptrs = file_data[aehd_offset + 10] as usize;
+        let dmin = file_data[aehd_offset + 9] as usize;
+        let nsblks = 1 + 10 - dmin.trailing_zeros() as usize;
+        let ndblk_addrs = 2 * (sup_ptrs - 1);
+        // Levels consumed by those direct data blocks (1, 1, 2, 2, ... per level).
+        let mut consumed = 0usize;
+        let mut levels = 0usize;
+        while consumed < ndblk_addrs {
+            consumed += 1 << (levels / 2);
+            levels += 1;
+        }
+        let ib_end = elem_start + num_chunks * osv + (ndblk_addrs + nsblks - levels) * osv;
+        stamp_checksum(&mut file_data, aeib_offset, ib_end);
 
         let header = ExtensibleArrayHeader::parse(&file_data, aehd_offset, os, ls).unwrap();
         let ds_dims = vec![40u64]; // 2 chunks × 20 elements
@@ -865,6 +958,7 @@ mod tests {
         // idx_blk_addr at offset 12 + 6*8 = 60
         file_data[aehd_offset + 60..aehd_offset + 68]
             .copy_from_slice(&(aeib_offset as u64).to_le_bytes());
+        stamp_checksum(&mut file_data, aehd_offset, aehd_offset + 68);
 
         // AEIB
         file_data[aeib_offset..aeib_offset + 4].copy_from_slice(b"EAIB");
@@ -883,42 +977,48 @@ mod tests {
             pos += osv;
         }
 
-        // Direct data block addresses: first sb_level=0 has 1 dblk, sb_level=1 has 1 dblk
+        // Direct data block addresses. With sup_blk_min_data_ptrs = 2 the index
-        // Total direct dblks for sblk_min=2: 2^0 + 2^1 = 1 + 2 = 3 (oops)
+        // block holds 2 * (2 - 1) = 2 of them, which are the data blocks of
-        // Actually: sblk_min levels. level 0: 2^0=1 dblk, level 1: 2^1=2 dblks => 3 dblks
+        // super block levels 0 and 1: one of `min_dblk_nelmts` elements, then
-        // But we only have 2 remaining elements.
+        // one of twice that (ndblks = 2^(u/2), dblk_nelmts = 2^((u+1)/2) * min).
-        // dblk sizes: level 0: 1 dblk of min_dblk=2; level 1: 2 dblks of 2 each (nelmts doubles at level > 0)
+        // Only the first is allocated here; the rest of the array is empty.
-        // Wait, re-reading the code: at level 0, nelmts=min_dblk=2, 1 dblk.
+        let ndblk_addrs = 2 * (sblk_min as usize - 1);
-        // At level 1, 1 dblk, nelmts still 2 (doubles only at level > 0... but the code says
-        // `if sb_level > 0 { nelmts *= 2 }` after pushing). Let me re-check.
-        // After push at level 0: nelmts=2. Then if 0>0 false, no double. Push 1 dblk of 2.
-        // Level 1: ndblks=2. Push 2 dblks of 2. Then 1>0 true, nelmts=4.
-        // Total: 3 dblks with sizes [2, 2, 2]. Total = 6.
-        // We only need 2 more elements. So only the first dblk has data.
-        let n_direct_dblks = 3;
         file_data[pos..pos + osv].copy_from_slice(&(aedb_offset as u64).to_le_bytes());
         pos += osv;
-        // 2 more dblk addresses - undefined
+        for _ in 1..ndblk_addrs {
-        for _ in 1..n_direct_dblks {
             file_data[pos..pos + osv].copy_from_slice(&u64::MAX.to_le_bytes());
             pos += osv;
         }
+        // Super block addresses fill the remaining levels; all unallocated.
+        let nsblks = 1 + 10 - (min_dblk_nelmts as usize).trailing_zeros() as usize;
+        let mut consumed = 0usize;
+        let mut levels = 0usize;
+        while consumed < ndblk_addrs {
+            consumed += 1 << (levels / 2);
+            levels += 1;
+        }
+        for _ in 0..(nsblks - levels) {
+            file_data[pos..pos + osv].copy_from_slice(&u64::MAX.to_le_bytes());
+            pos += osv;
+        }
+        stamp_checksum(&mut file_data, aeib_offset, pos);
 
-        // EADB at aedb_offset (min_dblk_nelmts elements)
+        // EADB holding the first data block's `min_dblk_nelmts` elements.
         file_data[aedb_offset..aedb_offset + 4].copy_from_slice(b"EADB");
         file_data[aedb_offset + 4] = 0;
         file_data[aedb_offset + 5] = 0;
         file_data[aedb_offset + 6..aedb_offset + 14]
             .copy_from_slice(&(aehd_offset as u64).to_le_bytes());
-        // block_offset: ceil(max_nelmts_bits/8) = ceil(10/8) = 2 bytes
+        // Block offset field: ceil(max_nelmts_bits / 8) bytes, zero here.
-        // block_offset = 0 for first data block
+        let blk_off_size = (10usize).div_ceil(8);
-        let blk_off_size = (10usize).div_ceil(8); // max_nelmts_bits=10
+        let db_elems = aedb_offset + 6 + osv + blk_off_size;
-        let mut dbpos = aedb_offset + 6 + osv + blk_off_size;
+        let mut dbpos = db_elems;
         for i in 0..min_dblk_nelmts as usize {
             let addr = base_addr + (idx_blk_elmts as u64 + i as u64) * chunk_byte_size;
             file_data[dbpos..dbpos + osv].copy_from_slice(&addr.to_le_bytes());
             dbpos += osv;
         }
+        stamp_checksum(&mut file_data, aedb_offset, dbpos);
 
         let header = ExtensibleArrayHeader::parse(&file_data, aehd_offset, os, ls).unwrap();
         let ds_dims = vec![40u64];

crates/clawhdf5-format/src/file_writer.rs

@@ -1221,8 +1221,10 @@ impl FileWriter {
                     precompressed: None,
                 });
             } else if is_chunked[i] {
-                let chunk_dims = d.chunk_options.resolve_chunk_dims(&d.ds.dimensions);
                 let elem_size = d.dt.type_size() as usize;
+                let chunk_dims = d
+                    .chunk_options
+                    .resolve_chunk_dims_for(&d.ds.dimensions, elem_size);
                 // Compress once in Pass 1; cache the result so Pass 2 can skip
                 // re-compression and just rebuild the index with real addresses.
                 let pre = precompress_chunks(