ci: wire up CI, fix no_std build, fix stale package names in scripts

- Add .gitea/workflows/ci.yml running scripts/ci-test.sh (fmt, clippy,
  test, no_std check) on push/PR to main.
- Fix stale rustyhdf5-py/rustyhdf5-format package names in
  ci-test.sh/check-nostd.sh, which had been silently no-op'ing those
  checks (cargo warns but doesn't fail on an unknown --exclude/-p
  target).
- With those checks actually running, fix the real issues they surface:
  - clippy: useless_conversion in chunked_write.rs, byte_char_slices in
    global_heap.rs/object_header.rs.
  - cargo fmt: apply formatting across the workspace (whitespace only).
  - no_std (thumbv7em-none-eabihf) build errors in clawhdf5-format:
    core::sync::atomic::AtomicU64 doesn't exist on that target (no
    native 64-bit atomics) — switch profiling.rs's counters to
    portable-atomic, which falls back to a CAS-based emulation there
    and is a no-op wrapper elsewhere. Add missing alloc imports for
    Box (filters.rs), Vec (filters_szip.rs), and format! (dict_encoding.rs)
    on no_std paths. Replace f64::powi (std/libm-only) with a small
    local exponentiation-by-squaring helper in the scale-offset filter.

.gitea/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container: rust:latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Cache cargo registry/target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      - name: Install rustfmt & clippy components
+        run: rustup component add rustfmt clippy
+      - name: Install thumbv7em-none-eabihf target
+        run: rustup target add thumbv7em-none-eabihf
+      - name: Run CI script
+        run: bash scripts/ci-test.sh

crates/clawhdf5-accel/src/avx512.rs

@@ -13,42 +13,44 @@ use std::arch::x86_64::*;
 /// Caller must verify is_x86_feature_detected!("avx512f").
 // SAFETY: Caller must have verified avx512f via is_x86_feature_detected!.
 #[target_feature(enable = "avx512f")]
-pub unsafe fn dot_product(a: &[f32], b: &[f32]) -> f32 { unsafe {
-    assert_eq!(a.len(), b.len());
-    let len = a.len();
-    let mut i = 0;
-    let mut acc0 = _mm512_setzero_ps();
-    let mut acc1 = _mm512_setzero_ps();
+pub unsafe fn dot_product(a: &[f32], b: &[f32]) -> f32 {
+    unsafe {
+        assert_eq!(a.len(), b.len());
+        let len = a.len();
+        let mut i = 0;
+        let mut acc0 = _mm512_setzero_ps();
+        let mut acc1 = _mm512_setzero_ps();
 
-    // Process 32 elements per iteration (2x16 unrolled)
-    while i + 32 <= len {
-        let va0 = _mm512_loadu_ps(a.as_ptr().add(i));
-        let vb0 = _mm512_loadu_ps(b.as_ptr().add(i));
-        acc0 = _mm512_fmadd_ps(va0, vb0, acc0);
+        // Process 32 elements per iteration (2x16 unrolled)
+        while i + 32 <= len {
+            let va0 = _mm512_loadu_ps(a.as_ptr().add(i));
+            let vb0 = _mm512_loadu_ps(b.as_ptr().add(i));
+            acc0 = _mm512_fmadd_ps(va0, vb0, acc0);
 
-        let va1 = _mm512_loadu_ps(a.as_ptr().add(i + 16));
-        let vb1 = _mm512_loadu_ps(b.as_ptr().add(i + 16));
-        acc1 = _mm512_fmadd_ps(va1, vb1, acc1);
+            let va1 = _mm512_loadu_ps(a.as_ptr().add(i + 16));
+            let vb1 = _mm512_loadu_ps(b.as_ptr().add(i + 16));
+            acc1 = _mm512_fmadd_ps(va1, vb1, acc1);
 
-        i += 32;
+            i += 32;
+        }
+
+        if i + 16 <= len {
+            let va = _mm512_loadu_ps(a.as_ptr().add(i));
+            let vb = _mm512_loadu_ps(b.as_ptr().add(i));
+            acc0 = _mm512_fmadd_ps(va, vb, acc0);
+            i += 16;
+        }
+
+        let mut sum = _mm512_reduce_add_ps(_mm512_add_ps(acc0, acc1));
+
+        while i < len {
+            sum += a[i] * b[i];
+            i += 1;
+        }
+
+        sum
     }
-
-    if i + 16 <= len {
-        let va = _mm512_loadu_ps(a.as_ptr().add(i));
-        let vb = _mm512_loadu_ps(b.as_ptr().add(i));
-        acc0 = _mm512_fmadd_ps(va, vb, acc0);
-        i += 16;
-    }
-
-    let mut sum = _mm512_reduce_add_ps(_mm512_add_ps(acc0, acc1));
-
-    while i < len {
-        sum += a[i] * b[i];
-        i += 1;
-    }
-
-    sum
-}}
+}
 
 /// AVX-512 cosine similarity — fused single pass.
 ///
@@ -56,38 +58,40 @@ pub unsafe fn dot_product(a: &[f32], b: &[f32]) -> f32 { unsafe {
 /// Caller must verify is_x86_feature_detected!("avx512f").
 // SAFETY: Caller must have verified avx512f via is_x86_feature_detected!.
 #[target_feature(enable = "avx512f")]
-pub unsafe fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 { unsafe {
-    assert_eq!(a.len(), b.len());
-    let len = a.len();
-    let mut i = 0;
+pub unsafe fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 {
+    unsafe {
+        assert_eq!(a.len(), b.len());
+        let len = a.len();
+        let mut i = 0;
 
-    let mut dot_acc = _mm512_setzero_ps();
-    let mut norm_a_acc = _mm512_setzero_ps();
-    let mut norm_b_acc = _mm512_setzero_ps();
+        let mut dot_acc = _mm512_setzero_ps();
+        let mut norm_a_acc = _mm512_setzero_ps();
+        let mut norm_b_acc = _mm512_setzero_ps();
 
-    while i + 16 <= len {
-        let va = _mm512_loadu_ps(a.as_ptr().add(i));
-        let vb = _mm512_loadu_ps(b.as_ptr().add(i));
-        dot_acc = _mm512_fmadd_ps(va, vb, dot_acc);
-        norm_a_acc = _mm512_fmadd_ps(va, va, norm_a_acc);
-        norm_b_acc = _mm512_fmadd_ps(vb, vb, norm_b_acc);
-        i += 16;
+        while i + 16 <= len {
+            let va = _mm512_loadu_ps(a.as_ptr().add(i));
+            let vb = _mm512_loadu_ps(b.as_ptr().add(i));
+            dot_acc = _mm512_fmadd_ps(va, vb, dot_acc);
+            norm_a_acc = _mm512_fmadd_ps(va, va, norm_a_acc);
+            norm_b_acc = _mm512_fmadd_ps(vb, vb, norm_b_acc);
+            i += 16;
+        }
+
+        let mut dot = _mm512_reduce_add_ps(dot_acc);
+        let mut norm_a = _mm512_reduce_add_ps(norm_a_acc);
+        let mut norm_b = _mm512_reduce_add_ps(norm_b_acc);
+
+        while i < len {
+            dot += a[i] * b[i];
+            norm_a += a[i] * a[i];
+            norm_b += b[i] * b[i];
+            i += 1;
+        }
+
+        let denom = (norm_a * norm_b).sqrt();
+        if denom == 0.0 { 0.0 } else { dot / denom }
     }
-
-    let mut dot = _mm512_reduce_add_ps(dot_acc);
-    let mut norm_a = _mm512_reduce_add_ps(norm_a_acc);
-    let mut norm_b = _mm512_reduce_add_ps(norm_b_acc);
-
-    while i < len {
-        dot += a[i] * b[i];
-        norm_a += a[i] * a[i];
-        norm_b += b[i] * b[i];
-        i += 1;
-    }
-
-    let denom = (norm_a * norm_b).sqrt();
-    if denom == 0.0 { 0.0 } else { dot / denom }
-}}
+}
 
 /// AVX-512 L2 distance.
 ///
@@ -95,27 +99,29 @@ pub unsafe fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 { unsafe {
 /// Caller must verify is_x86_feature_detected!("avx512f").
 // SAFETY: Caller must have verified avx512f via is_x86_feature_detected!.
 #[target_feature(enable = "avx512f")]
-pub unsafe fn l2_distance(a: &[f32], b: &[f32]) -> f32 { unsafe {
-    assert_eq!(a.len(), b.len());
-    let len = a.len();
-    let mut i = 0;
-    let mut acc = _mm512_setzero_ps();
+pub unsafe fn l2_distance(a: &[f32], b: &[f32]) -> f32 {
+    unsafe {
+        assert_eq!(a.len(), b.len());
+        let len = a.len();
+        let mut i = 0;
+        let mut acc = _mm512_setzero_ps();
 
-    while i + 16 <= len {
-        let va = _mm512_loadu_ps(a.as_ptr().add(i));
-        let vb = _mm512_loadu_ps(b.as_ptr().add(i));
-        let diff = _mm512_sub_ps(va, vb);
-        acc = _mm512_fmadd_ps(diff, diff, acc);
-        i += 16;
+        while i + 16 <= len {
+            let va = _mm512_loadu_ps(a.as_ptr().add(i));
+            let vb = _mm512_loadu_ps(b.as_ptr().add(i));
+            let diff = _mm512_sub_ps(va, vb);
+            acc = _mm512_fmadd_ps(diff, diff, acc);
+            i += 16;
+        }
+
+        let mut sum = _mm512_reduce_add_ps(acc);
+
+        while i < len {
+            let d = a[i] - b[i];
+            sum += d * d;
+            i += 1;
+        }
+
+        sum.sqrt()
     }
-
-    let mut sum = _mm512_reduce_add_ps(acc);
-
-    while i < len {
-        let d = a[i] - b[i];
-        sum += d * d;
-        i += 1;
-    }
-
-    sum.sqrt()
-}}
+}

crates/clawhdf5-agent/src/gpu_search.rs

@@ -116,14 +116,15 @@ impl GpuSearchBackend {
 
             // If we don't have an accelerator but now above threshold, try init
             if vectors.len() >= self.threshold
-                && let Ok(mut accel) = clawhdf5_gpu::GpuAccelerator::new() {
-                    let flat: Vec<f32> = vectors.iter().flat_map(|v| v.iter().copied()).collect();
-                    if accel.upload_vectors(&flat, self.dim).is_ok()
-                        && accel.upload_norms(norms).is_ok()
-                    {
-                        self.accelerator = Some(accel);
-                    }
+                && let Ok(mut accel) = clawhdf5_gpu::GpuAccelerator::new()
+            {
+                let flat: Vec<f32> = vectors.iter().flat_map(|v| v.iter().copied()).collect();
+                if accel.upload_vectors(&flat, self.dim).is_ok()
+                    && accel.upload_norms(norms).is_ok()
+                {
+                    self.accelerator = Some(accel);
                 }
+            }
         }
 
         #[cfg(not(feature = "gpu"))]

crates/clawhdf5-agent/src/search.rs

@@ -26,9 +26,7 @@ impl HDF5Memory {
     ) -> Vec<(usize, f32)> {
         self.ensure_hnsw_fresh();
         match self.hnsw.as_ref() {
-            Some(index)
-                if !index.is_empty() && index.dimension() == query_embedding.len() =>
-            {
+            Some(index) if !index.is_empty() && index.dimension() == query_embedding.len() => {
                 // Over-fetch so the merge sees a useful vector pool; cosine
                 // distance from the index converts back to similarity (1 - d).
                 let pool = (k * 8).max(64);
@@ -38,7 +36,13 @@ impl HDF5Memory {
                     .map(|(id, dist)| (id, 1.0 - dist))
                     .collect();
                 let kw_scores = bm25.search(query_text, self.cache.len());
-                hybrid::merge_vector_keyword(vec_scores, kw_scores, vector_weight, keyword_weight, k)
+                hybrid::merge_vector_keyword(
+                    vec_scores,
+                    kw_scores,
+                    vector_weight,
+                    keyword_weight,
+                    k,
+                )
             }
             _ => hybrid::hybrid_search(
                 query_embedding,

crates/clawhdf5-agent/tests/hnsw_integration.rs

@@ -80,8 +80,7 @@ fn hnsw_matches_bruteforce_oracle() {
     oracle.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap());
     let oracle_ids: std::collections::HashSet<usize> =
         oracle.iter().take(k).map(|(i, _)| *i).collect();
-    let hnsw_ids: std::collections::HashSet<usize> =
-        results.iter().map(|r| r.index).collect();
+    let hnsw_ids: std::collections::HashSet<usize> = results.iter().map(|r| r.index).collect();
 
     let overlap = oracle_ids.intersection(&hnsw_ids).count();
     assert!(
@@ -127,17 +126,19 @@ fn incremental_inserts_after_search_are_found() {
     // First batch, then a search to force the index to build.
     for i in 0..40 {
         let v = make_vector(&mut seed, dim);
-        mem.save(entry(&format!("a{i}"), v, &format!("a{i}"))).unwrap();
+        mem.save(entry(&format!("a{i}"), v, &format!("a{i}")))
+            .unwrap();
     }
     let _ = mem.hybrid_search(&make_vector(&mut seed, dim), "", 1.0, 0.0, 5);
 
     // Now insert a distinctive vector incrementally and confirm we can find it.
     let needle = vec![10.0f32; dim];
-    let idx = mem
-        .save(entry("needle", needle.clone(), "needle"))
-        .unwrap();
+    let idx = mem.save(entry("needle", needle.clone(), "needle")).unwrap();
     let hits = mem.hybrid_search(&needle, "", 1.0, 0.0, 1);
-    assert_eq!(hits[0].index, idx, "incrementally inserted vector must be found");
+    assert_eq!(
+        hits[0].index, idx,
+        "incrementally inserted vector must be found"
+    );
 }
 
 #[test]
@@ -158,6 +159,9 @@ fn save_batch_then_search_is_consistent() {
     // Exact-match queries should resolve to themselves after a batch insert.
     for probe in [0usize, 17, 49] {
         let hits = mem.hybrid_search(&vectors[probe], "", 1.0, 0.0, 1);
-        assert_eq!(hits[0].index, probe, "batch-inserted vector {probe} not found");
+        assert_eq!(
+            hits[0].index, probe,
+            "batch-inserted vector {probe} not found"
+        );
     }
 }

crates/clawhdf5-ann/src/hnsw.rs

@@ -379,7 +379,13 @@ impl HnswIndex {
 
         // Phase 1: greedy descent from the top down to node_level + 1.
         for layer in (node_level + 1..=ep_level).rev() {
-            ep = greedy_closest(&self.vectors, &self.graph[layer], &self.vectors[id], ep, self.metric);
+            ep = greedy_closest(
+                &self.vectors,
+                &self.graph[layer],
+                &self.vectors[id],
+                ep,
+                self.metric,
+            );
         }
 
         // Phase 2: search and connect from min(node_level, ep_level) down to 0.
@@ -1012,11 +1018,14 @@ fn get_attr_i64(attrs: &[(String, AttrValue)], name: &str) -> Result<i64, Format
 /// Like [`get_attr_i64`] but returns `None` when the attribute is absent or not
 /// an integer, instead of erroring. Used for optional/back-compat attributes.
 fn get_attr_i64_opt(attrs: &[(String, AttrValue)], name: &str) -> Option<i64> {
-    attrs.iter().find(|(n, _)| n == name).and_then(|(_, v)| match v {
-        AttrValue::I64(val) => Some(*val),
-        AttrValue::U64(val) => Some(*val as i64),
-        _ => None,
-    })
+    attrs
+        .iter()
+        .find(|(n, _)| n == name)
+        .and_then(|(_, v)| match v {
+            AttrValue::I64(val) => Some(*val),
+            AttrValue::U64(val) => Some(*val as i64),
+            _ => None,
+        })
 }
 
 fn get_attr_string(attrs: &[(String, AttrValue)], name: &str) -> Result<String, FormatError> {

crates/clawhdf5-bench/benches/h5bench_meta.rs

@@ -41,11 +41,7 @@ fn bench_metadata_attrs_write(c: &mut Criterion) {
             let path = tmp.path().join("attrs_libhdf5.h5");
             b.iter(|| {
                 let file = hdf5::File::create(&path).unwrap();
-                let ds = file
-                    .new_dataset::<f64>()
-                    .shape([3])
-                    .create("data")
-                    .unwrap();
+                let ds = file.new_dataset::<f64>().shape([3]).create("data").unwrap();
                 ds.write(&[1.0f64, 2.0, 3.0]).unwrap();
                 for i in 0..k {
                     ds.new_attr::<i64>()
@@ -258,11 +254,7 @@ fn bench_metadata_open_from_disk(c: &mut Criterion) {
         let libhdf5_path = tmp.path().join("open_libhdf5.h5");
         {
             let file = hdf5::File::create(&libhdf5_path).unwrap();
-            let ds = file
-                .new_dataset::<f64>()
-                .shape([3])
-                .create("data")
-                .unwrap();
+            let ds = file.new_dataset::<f64>().shape([3]).create("data").unwrap();
             ds.write(&[1.0f64, 2.0, 3.0]).unwrap();
             ds.new_attr::<i64>()
                 .create("label")
@@ -307,13 +299,17 @@ fn bench_metadata_parse_in_memory(c: &mut Criterion) {
         fb.finish().unwrap()
     };
 
-    group.bench_with_input(BenchmarkId::new("clawhdf5", "in_memory"), &bytes, |b, raw| {
-        b.iter(|| {
-            let file = File::from_bytes(raw.clone()).unwrap();
-            let ds = file.dataset("data").unwrap();
-            ds.attrs().unwrap()
-        });
-    });
+    group.bench_with_input(
+        BenchmarkId::new("clawhdf5", "in_memory"),
+        &bytes,
+        |b, raw| {
+            b.iter(|| {
+                let file = File::from_bytes(raw.clone()).unwrap();
+                let ds = file.dataset("data").unwrap();
+                ds.attrs().unwrap()
+            });
+        },
+    );
 
     group.finish();
 }

crates/clawhdf5-bench/benches/h5bench_read.rs

@@ -74,11 +74,7 @@ fn bench_read_sequential(c: &mut Criterion) {
             let data: Vec<f32> = (0..nn).map(|i| i as f32 * 0.001).collect();
             {
                 let lf = hdf5::File::create(&path).unwrap();
-                let lds = lf
-                    .new_dataset::<f32>()
-                    .shape([nn])
-                    .create("data")
-                    .unwrap();
+                let lds = lf.new_dataset::<f32>().shape([nn]).create("data").unwrap();
                 lds.write(data.as_slice()).unwrap();
             }
             b.iter(|| {
@@ -235,19 +231,23 @@ fn bench_read_zerocopy_mmap(c: &mut Criterion) {
 
         group.throughput(Throughput::Bytes((n * size_of::<f64>()) as u64));
 
-        group.bench_with_input(BenchmarkId::new("clawhdf5_mmap_zerocopy", n), &path, |b, p| {
-            b.iter(|| {
-                let file = MmapFile::open(p).unwrap();
-                let ds = file.dataset("data").unwrap();
-                let slice = ds.read_f64_zerocopy().unwrap();
-                // Sum every element to force the mapped pages to actually be
-                // faulted in — returning just `.len()` would measure nothing
-                // but the mmap() syscall, repeating the exact "too-fast-to-
-                // be-real" mistake this benchmark exists to fix.
-                let sum: f64 = slice.map(|s| s.iter().sum()).unwrap_or(0.0);
-                criterion::black_box(sum)
-            });
-        });
+        group.bench_with_input(
+            BenchmarkId::new("clawhdf5_mmap_zerocopy", n),
+            &path,
+            |b, p| {
+                b.iter(|| {
+                    let file = MmapFile::open(p).unwrap();
+                    let ds = file.dataset("data").unwrap();
+                    let slice = ds.read_f64_zerocopy().unwrap();
+                    // Sum every element to force the mapped pages to actually be
+                    // faulted in — returning just `.len()` would measure nothing
+                    // but the mmap() syscall, repeating the exact "too-fast-to-
+                    // be-real" mistake this benchmark exists to fix.
+                    let sum: f64 = slice.map(|s| s.iter().sum()).unwrap_or(0.0);
+                    criterion::black_box(sum)
+                });
+            },
+        );
 
         group.bench_with_input(BenchmarkId::new("clawhdf5_copy", n), &path, |b, p| {
             b.iter(|| {

crates/clawhdf5-bench/benches/h5bench_write.rs

@@ -63,11 +63,8 @@ fn bench_write_2d_chunked(c: &mut Criterion) {
     let mut group = c.benchmark_group("write_2d_chunked");
 
     // (rows, cols, chunk_rows, chunk_cols)
-    let configs: &[(usize, usize, u64, u64)] = &[
-        (32, 32, 8, 32),
-        (128, 128, 32, 128),
-        (512, 512, 64, 512),
-    ];
+    let configs: &[(usize, usize, u64, u64)] =
+        &[(32, 32, 8, 32), (128, 128, 32, 128), (512, 512, 64, 512)];
 
     for &(rows, cols, cr, cc) in configs {
         let n = rows * cols;
@@ -120,11 +117,8 @@ fn bench_write_2d_chunked(c: &mut Criterion) {
 fn bench_write_2d_chunked_zstd(c: &mut Criterion) {
     let mut group = c.benchmark_group("write_2d_chunked_zstd");
 
-    let configs: &[(usize, usize, u64, u64)] = &[
-        (32, 32, 8, 32),
-        (128, 128, 32, 128),
-        (512, 512, 64, 512),
-    ];
+    let configs: &[(usize, usize, u64, u64)] =
+        &[(32, 32, 8, 32), (128, 128, 32, 128), (512, 512, 64, 512)];
 
     for &(rows, cols, cr, cc) in configs {
         let n = rows * cols;
@@ -132,19 +126,23 @@ fn bench_write_2d_chunked_zstd(c: &mut Criterion) {
         let label = format!("{rows}x{cols}");
         group.throughput(Throughput::Bytes((n * size_of::<f32>()) as u64));
 
-        group.bench_with_input(BenchmarkId::new("clawhdf5/zstd-3", &label), &data, |b, d| {
-            let tmp = TempDir::new().unwrap();
-            let path = tmp.path().join("write_2d_chunked_zstd.h5");
-            b.iter(|| {
-                let mut fb = FileBuilder::new();
-                fb.create_dataset("matrix")
-                    .with_f32_data(d)
-                    .with_shape(&[rows as u64, cols as u64])
-                    .with_chunks(&[cr, cc])
-                    .with_zstd(3);
-                fb.write(&path).unwrap();
-            });
-        });
+        group.bench_with_input(
+            BenchmarkId::new("clawhdf5/zstd-3", &label),
+            &data,
+            |b, d| {
+                let tmp = TempDir::new().unwrap();
+                let path = tmp.path().join("write_2d_chunked_zstd.h5");
+                b.iter(|| {
+                    let mut fb = FileBuilder::new();
+                    fb.create_dataset("matrix")
+                        .with_f32_data(d)
+                        .with_shape(&[rows as u64, cols as u64])
+                        .with_chunks(&[cr, cc])
+                        .with_zstd(3);
+                    fb.write(&path).unwrap();
+                });
+            },
+        );
 
         group.bench_with_input(
             BenchmarkId::new("clawhdf5/deflate-6", &label),
@@ -178,11 +176,8 @@ fn bench_write_2d_chunked_zstd(c: &mut Criterion) {
 fn bench_write_2d_chunked_pcodec(c: &mut Criterion) {
     let mut group = c.benchmark_group("write_2d_chunked_pcodec");
 
-    let configs: &[(usize, usize, u64, u64)] = &[
-        (32, 32, 8, 32),
-        (128, 128, 32, 128),
-        (512, 512, 64, 512),
-    ];
+    let configs: &[(usize, usize, u64, u64)] =
+        &[(32, 32, 8, 32), (128, 128, 32, 128), (512, 512, 64, 512)];
 
     for &(rows, cols, cr, cc) in configs {
         let n = rows * cols;

crates/clawhdf5-filters/src/fast_deflate.rs

@@ -270,14 +270,29 @@ pub(crate) fn flate2_decompress_preallocated(
     Ok(output)
 }
 
+/// Absolute ceiling on decompressed output when the caller has no size hint,
+/// preventing unbounded allocation from a hostile/corrupted zlib stream.
+const MAX_DECOMPRESS_SIZE: usize = 256 * 1024 * 1024;
+
 /// Streaming decompress with dynamic sizing (when output size is unknown).
+///
+/// Bounded by [`MAX_DECOMPRESS_SIZE`] since there is no chunk-size hint to
+/// validate against here — an unbounded `read_to_end` would let a hostile
+/// zlib stream force arbitrarily large allocation (a "zlib bomb").
 pub(crate) fn flate2_decompress_streaming(data: &[u8]) -> Result<Vec<u8>, String> {
     use std::io::Read;
-    let mut decoder = flate2::read::ZlibDecoder::new(data);
+    let decoder = flate2::read::ZlibDecoder::new(data);
     let mut result = Vec::new();
     decoder
+        .take(MAX_DECOMPRESS_SIZE as u64 + 1)
         .read_to_end(&mut result)
         .map_err(|e| e.to_string())?;
+    if result.len() > MAX_DECOMPRESS_SIZE {
+        return Err(format!(
+            "decompressed output exceeds {} MiB limit",
+            MAX_DECOMPRESS_SIZE / 1024 / 1024
+        ));
+    }
     Ok(result)
 }
 

crates/clawhdf5-format/Cargo.toml

@@ -11,6 +11,7 @@ categories = ["parser-implementations", "science", "encoding", "no-std"]
 
 [dependencies]
 byteorder = { version = "1", default-features = false }
+portable-atomic = { version = "1" }
 flate2 = { version = "1", default-features = false, features = ["rust_backend"], optional = true }
 sha2 = { version = "0.10", default-features = false, optional = true }
 rayon = { version = "1", optional = true }

crates/clawhdf5-format/src/chunk_cache.rs

@@ -16,6 +16,8 @@ use core::ops::{Deref, DerefMut};
 use alloc::collections::BTreeMap;
 #[cfg(feature = "std")]
 use std::collections::HashMap;
+#[cfg(feature = "std")]
+use std::sync::Arc;
 
 use crate::chunk_index::{ChunkIndex, ChunkLayout};
 use crate::chunked_read::ChunkInfo;
@@ -64,6 +66,11 @@ pub struct CacheAlignedBuffer {
 
 // SAFETY: The raw pointer is exclusively owned — no aliasing.
 unsafe impl Send for CacheAlignedBuffer {}
+// SAFETY: `CacheAlignedBuffer` exposes its contents only via `&[u8]`/`&mut
+// [u8]` through the ordinary borrow-checked `Deref`/`DerefMut` impls below —
+// the same access pattern as `Vec<u8>`, which is `Sync`. Needed so
+// `Arc<CacheAlignedBuffer>` (used by the chunk cache) is itself `Send`.
+unsafe impl Sync for CacheAlignedBuffer {}
 
 impl CacheAlignedBuffer {
     /// Allocate a new cache-line-aligned buffer of exactly `len` bytes,
@@ -223,7 +230,9 @@ pub const DEFAULT_MAX_SLOTS: usize = 521;
 #[cfg(feature = "std")]
 struct CachedChunk {
     coord: ChunkCoord,
-    data: CacheAlignedBuffer,
+    /// Shared so a cache hit is a refcount bump, not a copy of the whole
+    /// (potentially large) decompressed chunk.
+    data: Arc<CacheAlignedBuffer>,
     /// Monotonically increasing access counter for LRU ordering.
     last_access: u64,
 }
@@ -267,6 +276,12 @@ struct CacheInner {
     /// LRU cache of decompressed chunk data.
     slots: Vec<CachedChunk>,
 
+    /// Coordinate -> index into `slots`, for O(1) lookup instead of a linear
+    /// scan. Kept in sync with `slots` on every insert/evict/clear — in
+    /// particular, `slots.swap_remove(i)` moves the last element into slot
+    /// `i`, so the moved element's index entry must be updated too.
+    slot_index: HashMap<ChunkCoord, usize>,
+
     /// Current total bytes of cached decompressed data.
     current_bytes: usize,
 
@@ -344,6 +359,7 @@ impl ChunkCache {
                 index: None,
                 index_addr: None,
                 slots: Vec::with_capacity(max_slots.min(64)),
+                slot_index: HashMap::with_capacity(max_slots.min(64)),
                 current_bytes: 0,
                 max_bytes,
                 max_slots,
@@ -375,6 +391,7 @@ impl ChunkCache {
         inner.chunk_index = None;
         inner.chunk_layout = None;
         inner.slots.clear();
+        inner.slot_index.clear();
         inner.current_bytes = 0;
         inner.last_coord = None;
         inner.index_addr = Some(addr);
@@ -477,8 +494,20 @@ impl ChunkCache {
 
     /// Try to get cached decompressed data for a chunk coordinate.
     ///
-    /// Returns a clone of the cache-line-aligned buffer.
+    /// O(1) lookup. Returns an owned copy for API compatibility with callers
+    /// that need a `Vec<u8>`; prefer [`Self::get_decompressed_aligned`] when
+    /// an `Arc`-shared buffer works for the caller, since that avoids the
+    /// copy entirely.
     pub fn get_decompressed(&self, coord: &[u64]) -> Option<Vec<u8>> {
+        self.get_decompressed_aligned(coord)
+            .map(|arc| arc.as_slice().to_vec())
+    }
+
+    /// Try to get a reference-counted clone of the aligned buffer for a chunk.
+    ///
+    /// O(1) index lookup; the clone is an `Arc` refcount bump, not a copy of
+    /// the underlying decompressed data.
+    pub fn get_decompressed_aligned(&self, coord: &[u64]) -> Option<Arc<CacheAlignedBuffer>> {
         let mut inner = self.inner.lock().unwrap_or_else(|e| e.into_inner());
         inner.tick += 1;
         let tick = inner.tick;
@@ -500,36 +529,12 @@ impl ChunkCache {
         }
         inner.last_coord = Some(coord.to_vec());
 
-        let mut found = None;
-        for slot in inner.slots.iter_mut() {
-            if slot.coord.as_slice() == coord {
-                slot.last_access = tick;
-                found = Some(slot.data.to_vec());
-                break;
-            }
-        }
-        if let Some(ref data) = found {
-            inner.stats.hits += 1;
-            inner.stats.bytes_read += data.len() as u64;
+        let found = if let Some(&idx) = inner.slot_index.get(coord) {
+            inner.slots[idx].last_access = tick;
+            Some(Arc::clone(&inner.slots[idx].data))
         } else {
-            inner.stats.misses += 1;
-        }
-        found
-    }
-
-    /// Try to get a reference-counted clone of the aligned buffer for a chunk.
-    pub fn get_decompressed_aligned(&self, coord: &[u64]) -> Option<CacheAlignedBuffer> {
-        let mut inner = self.inner.lock().unwrap_or_else(|e| e.into_inner());
-        inner.tick += 1;
-        let tick = inner.tick;
-        let mut found = None;
-        for slot in inner.slots.iter_mut() {
-            if slot.coord.as_slice() == coord {
-                slot.last_access = tick;
-                found = Some(slot.data.clone());
-                break;
-            }
-        }
+            None
+        };
         if let Some(ref data) = found {
             inner.stats.hits += 1;
             inner.stats.bytes_read += data.len() as u64;
@@ -542,30 +547,39 @@ impl ChunkCache {
     /// Insert decompressed chunk data into the LRU cache.
     ///
     /// The data is stored in a [`CacheAlignedBuffer`] so subsequent reads
-    /// return cache-line-aligned memory.
-    pub fn put_decompressed(&self, coord: ChunkCoord, data: Vec<u8>) {
-        let aligned = CacheAlignedBuffer::from_slice(&data);
-        self.put_decompressed_aligned(coord, aligned);
+    /// return cache-line-aligned memory. Returns the `Arc`-shared buffer that
+    /// is now cached (or already was), so the caller can reuse it directly
+    /// instead of holding a separate copy of the same data.
+    pub fn put_decompressed(&self, coord: ChunkCoord, data: Vec<u8>) -> Arc<CacheAlignedBuffer> {
+        let aligned = CacheAlignedBuffer::from_vec(data);
+        self.put_decompressed_aligned(coord, aligned)
     }
 
     /// Insert an already-aligned buffer into the LRU cache.
-    pub fn put_decompressed_aligned(&self, coord: ChunkCoord, data: CacheAlignedBuffer) {
+    ///
+    /// Returns the `Arc`-shared buffer now held by the cache (the one just
+    /// inserted, or the existing cached copy if `coord` was already present).
+    pub fn put_decompressed_aligned(
+        &self,
+        coord: ChunkCoord,
+        data: CacheAlignedBuffer,
+    ) -> Arc<CacheAlignedBuffer> {
+        let data = Arc::new(data);
         let mut inner = self.inner.lock().unwrap_or_else(|e| e.into_inner());
         let data_len = data.len();
 
-        // Don't cache if single chunk exceeds budget
+        // Don't cache if single chunk exceeds budget — still return the data
+        // to the caller, just don't retain it.
         if data_len > inner.max_bytes {
-            return;
+            return data;
         }
 
         // Check if already present
         inner.tick += 1;
         let tick = inner.tick;
-        for slot in inner.slots.iter_mut() {
-            if slot.coord == coord {
-                slot.last_access = tick;
-                return; // already cached
-            }
+        if let Some(&idx) = inner.slot_index.get(&coord) {
+            inner.slots[idx].last_access = tick;
+            return Arc::clone(&inner.slots[idx].data); // already cached
         }
 
         // Evict until we have room
@@ -581,16 +595,26 @@ impl ChunkCache {
                 .map(|(i, _)| i)
                 .unwrap();
             let removed = inner.slots.swap_remove(lru_idx);
+            inner.slot_index.remove(&removed.coord);
+            // swap_remove moved the former last element into `lru_idx` (unless
+            // it *was* the last element) — fix up that element's index entry.
+            if lru_idx < inner.slots.len() {
+                let moved_coord = inner.slots[lru_idx].coord.clone();
+                inner.slot_index.insert(moved_coord, lru_idx);
+            }
             inner.current_bytes -= removed.data.len();
             inner.stats.evictions += 1;
         }
 
         inner.current_bytes += data_len;
+        let new_idx = inner.slots.len();
+        inner.slot_index.insert(coord.clone(), new_idx);
         inner.slots.push(CachedChunk {
             coord,
-            data,
+            data: Arc::clone(&data),
             last_access: tick,
         });
+        data
     }
 
     /// Clear the entire cache (index + decompressed data).
@@ -599,6 +623,7 @@ impl ChunkCache {
         inner.index = None;
         inner.index_addr = None;
         inner.slots.clear();
+        inner.slot_index.clear();
         inner.current_bytes = 0;
         inner.tick = 0;
         inner.last_coord = None;
@@ -607,11 +632,13 @@ impl ChunkCache {
         inner.chunk_layout = None;
     }
 
-    /// Hint that the given chunk coordinates will be accessed soon.
+    /// Record that the given chunk coordinates are predicted to be accessed
+    /// soon (bookkeeping only).
     ///
-    /// Pre-populates the chunk index for these coordinates so that
-    /// subsequent lookups are O(1). This does NOT pre-decompress the
-    /// chunks — it only ensures the index entries exist.
+    /// This does **not** prefetch or pre-decompress anything — it only
+    /// checks whether each coordinate is already in the chunk index and
+    /// updates access-pattern stats accordingly. Real prefetching (e.g.
+    /// background pre-decompression) is not implemented.
     pub fn prefetch_hint(&self, next_coords: &[ChunkCoord]) {
         let inner = self.inner.lock().unwrap_or_else(|e| e.into_inner());
         if inner.index.is_none() {
@@ -785,6 +812,50 @@ mod tests {
         assert_eq!(cache.cached_bytes(), 3);
     }
 
+    #[test]
+    fn slot_index_consistent_after_many_evictions() {
+        // Force repeated swap_remove evictions (small slot budget, many
+        // inserts) and confirm the coord -> slot index stays correct: every
+        // remaining coord must still resolve to its own data, not another
+        // slot's (which would happen if swap_remove's index fixup were wrong).
+        let cache = ChunkCache::with_capacity(1024 * 1024, 4); // max 4 slots
+
+        for i in 0..50u64 {
+            cache.put_decompressed(vec![i], vec![(i % 256) as u8; 8]);
+            // Interleave reads of a couple of earlier coords to churn LRU
+            // order (and thus which slot gets swap_remove'd) beyond simple
+            // FIFO eviction.
+            if i >= 2 {
+                let _ = cache.get_decompressed(&[i - 2]);
+            }
+        }
+
+        // Whatever remains in the cache (at most 4 slots) must return its
+        // own correct data.
+        for i in 0..50u64 {
+            if let Some(data) = cache.get_decompressed(&[i]) {
+                assert_eq!(
+                    data,
+                    vec![(i % 256) as u8; 8],
+                    "coord {i} returned wrong data after eviction churn"
+                );
+            }
+        }
+        assert!(cache.cached_chunk_count() <= 4);
+    }
+
+    #[test]
+    fn get_decompressed_aligned_shares_arc_on_hit() {
+        let cache = ChunkCache::new();
+        cache.put_decompressed(vec![0, 0], vec![9, 9, 9, 9]);
+        let a = cache.get_decompressed_aligned(&[0, 0]).unwrap();
+        let b = cache.get_decompressed_aligned(&[0, 0]).unwrap();
+        // A cache hit clones the Arc (refcount bump), not the underlying
+        // buffer — both handles point at the same allocation.
+        assert!(Arc::ptr_eq(&a, &b));
+        assert_eq!(a.as_slice(), &[9, 9, 9, 9]);
+    }
+
     // --- CacheAlignedBuffer tests ---
 
     #[test]

crates/clawhdf5-format/src/chunked_read.rs

@@ -17,6 +17,8 @@ use crate::extensible_array::{ExtensibleArrayHeader, read_extensible_array_chunk
 use crate::filter_pipeline::FilterPipeline;
 use crate::filters::decompress_chunk;
 use crate::fixed_array::{FixedArrayHeader, read_fixed_array_chunks};
+#[cfg(feature = "std")]
+use std::sync::Arc;
 
 #[cfg(feature = "parallel")]
 use crate::parallel_read;
@@ -689,7 +691,7 @@ pub fn read_chunked_data_cached(
         let coord: Vec<u64> = chunk_info.offsets.iter().take(rank).copied().collect();
 
         // Try decompressed cache first
-        let decompressed = if let Some(cached) = cache.get_decompressed(&coord) {
+        let decompressed = if let Some(cached) = cache.get_decompressed_aligned(&coord) {
             cached
         } else {
             // Decompress from file
@@ -711,8 +713,7 @@ pub fn read_chunked_data_cached(
             } else {
                 raw_chunk.to_vec()
             };
-            cache.put_decompressed(coord, dec.clone());
-            dec
+            cache.put_decompressed(coord, dec)
         };
 
         let chunk_offsets: Vec<usize> = chunk_info
@@ -1055,7 +1056,7 @@ pub fn read_chunked_data_sweep(
         }
 
         // Try decompressed cache first
-        let decompressed = if let Some(cached) = cache.get_decompressed(&coord) {
+        let decompressed = if let Some(cached) = cache.get_decompressed_aligned(&coord) {
             cached
         } else {
             // Decompress from file
@@ -1077,8 +1078,7 @@ pub fn read_chunked_data_sweep(
             } else {
                 raw_chunk.to_vec()
             };
-            cache.put_decompressed(coord, dec.clone());
-            dec
+            cache.put_decompressed(coord, dec)
         };
 
         let chunk_offsets: Vec<usize> = chunk_info
@@ -1271,7 +1271,7 @@ pub fn read_chunked_data_indexed(
         .ok_or_else(|| FormatError::ChunkedReadError("chunk layout not available".into()))?;
 
     // Decompress chunks (using LRU cache where possible)
-    let mut chunk_buffers: Vec<CacheAlignedBuffer> = Vec::with_capacity(mappings_info.len());
+    let mut chunk_buffers: Vec<Arc<CacheAlignedBuffer>> = Vec::with_capacity(mappings_info.len());
     for (coord, file_offset, file_size, filter_mask) in &mappings_info {
         if let Some(cached) = cache.get_decompressed_aligned(coord) {
             chunk_buffers.push(cached);
@@ -1295,8 +1295,8 @@ pub fn read_chunked_data_indexed(
                 raw_chunk.to_vec()
             };
             let aligned = CacheAlignedBuffer::from_vec(decompressed);
-            cache.put_decompressed_aligned(coord.clone(), aligned.clone());
-            chunk_buffers.push(aligned);
+            let arc = cache.put_decompressed_aligned(coord.clone(), aligned);
+            chunk_buffers.push(arc);
         }
     }
 

crates/clawhdf5-format/src/chunked_write.rs

@@ -65,10 +65,8 @@ impl ChunkOptions {
     pub fn build_pipeline(&self, element_size: u32) -> Option<FilterPipeline> {
         let mut filters = Vec::new();
 
-        let has_compression = self.deflate_level.is_some()
-            || self.zstd_level.is_some()
-            || self.lz4
-            || self.pcodec;
+        let has_compression =
+            self.deflate_level.is_some() || self.zstd_level.is_some() || self.lz4 || self.pcodec;
 
         // Shuffle before compression. Applied if explicitly requested OR if compression
         // is active and the caller hasn't disabled it — matches h5py default behavior
@@ -608,7 +606,7 @@ pub fn precompress_chunks(
 
     let chunks = raw_chunks
         .into_iter()
-        .zip(compressed.into_iter())
+        .zip(compressed)
         .map(|((_offsets, raw_bytes), c)| (raw_bytes.len() as u64, c))
         .collect();
 
@@ -755,7 +753,11 @@ pub fn build_chunked_data_at_ext(
     maxshape: Option<&[u64]>,
 ) -> Result<ChunkedDataResult, FormatError> {
     let pre = precompress_chunks(raw_data, shape, chunk_dims, element_size, options)?;
-    Ok(build_chunked_data_from_precompressed(&pre, base_address, maxshape))
+    Ok(build_chunked_data_from_precompressed(
+        &pre,
+        base_address,
+        maxshape,
+    ))
 }
 
 /// Write selected elements into an existing in-memory dataset buffer.

crates/clawhdf5-format/src/data_layout.rs

@@ -821,7 +821,8 @@ mod tests {
         let blob = [
             0x00u8, // block version 0
             0x01, 0, 0, 0, 0, 0, 0, 0, // nused = 1
-            0x73, 0x72, 0x63, 0x5f, 0x65, 0x78, 0x74, 0x2e, 0x68, 0x35, 0x00, // "src_ext.h5\0"
+            0x73, 0x72, 0x63, 0x5f, 0x65, 0x78, 0x74, 0x2e, 0x68, 0x35,
+            0x00, // "src_ext.h5\0"
             0x64, 0x61, 0x74, 0x61, 0x00, // "data\0"
             0x03, 0, 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // source sel = ALL
             0x03, 0, 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // virtual sel = ALL
@@ -846,7 +847,7 @@ mod tests {
         // One entry whose source selection (ALL) is truncated to 8 of 16 bytes.
         let blob = [
             0x01u8, // version 1
-            0x01, 0, 0, 0, 0, 0, 0, 0, // nused = 1
+            0x01, 0, 0, 0, 0, 0, 0, 0,    // nused = 1
             0x04, // same-file marker
             0x78, 0x00, // "x\0"
             0x03, 0, 0, 0, 0x01, 0, 0, 0, // ALL header, truncated (8 of 16 bytes)

crates/clawhdf5-format/src/data_read.rs

@@ -94,7 +94,14 @@ pub fn read_raw_data_full(
     length_size: u8,
 ) -> Result<Vec<u8>, FormatError> {
     read_raw_data_full_impl(
-        file_data, layout, dataspace, datatype, pipeline, offset_size, length_size, None,
+        file_data,
+        layout,
+        dataspace,
+        datatype,
+        pipeline,
+        offset_size,
+        length_size,
+        None,
     )
 }
 
@@ -112,7 +119,14 @@ pub fn read_raw_data_full_with_resolver(
     resolver: Option<&VdsSourceResolver>,
 ) -> Result<Vec<u8>, FormatError> {
     read_raw_data_full_impl(
-        file_data, layout, dataspace, datatype, pipeline, offset_size, length_size, resolver,
+        file_data,
+        layout,
+        dataspace,
+        datatype,
+        pipeline,
+        offset_size,
+        length_size,
+        resolver,
     )
 }
 
@@ -465,12 +479,12 @@ fn read_virtual_data(
         FormatError::ChunkedReadError("virtual dataset has no mapping global heap".into())
     })?;
     let coll = GlobalHeapCollection::parse(file_data, addr as usize, length_size)?;
-    let obj = coll
-        .get_object(global_heap_index as u16)
-        .ok_or(FormatError::GlobalHeapObjectNotFound {
-            collection_address: addr,
-            index: global_heap_index as u16,
-        })?;
+    let obj =
+        coll.get_object(global_heap_index as u16)
+            .ok_or(FormatError::GlobalHeapObjectNotFound {
+                collection_address: addr,
+                index: global_heap_index as u16,
+            })?;
     let mappings = parse_vds_mappings(&obj.data, length_size)?;
 
     for m in &mappings {
@@ -1815,13 +1829,19 @@ mod tests {
             0xff, 0xff, 0x00, 0x00, 0x64, 0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x00, 0x80,
             0x00, 0x00,
         ];
-        assert_eq!(read_as_i32(&raw, &arr).unwrap(), vec![-1, 100, 1000, -32768]);
+        assert_eq!(
+            read_as_i32(&raw, &arr).unwrap(),
+            vec![-1, 100, 1000, -32768]
+        );
         // Nested array-of-array unwraps recursively.
         let nested = Datatype::Array {
             base_type: Box::new(arr),
             dimensions: vec![2],
         };
-        assert_eq!(read_as_i32(&raw, &nested).unwrap(), vec![-1, 100, 1000, -32768]);
+        assert_eq!(
+            read_as_i32(&raw, &nested).unwrap(),
+            vec![-1, 100, 1000, -32768]
+        );
     }
 
     fn make_f64_le_type() -> Datatype {

crates/clawhdf5-format/src/datatype.rs

@@ -1030,14 +1030,8 @@ mod tests {
             Datatype::Compound { size, members } => {
                 assert_eq!(size, 20);
                 assert_eq!(members.len(), 3);
-                assert_eq!(
-                    (members[0].name.as_str(), members[0].byte_offset),
-                    ("x", 0)
-                );
-                assert_eq!(
-                    (members[1].name.as_str(), members[1].byte_offset),
-                    ("y", 8)
-                );
+                assert_eq!((members[0].name.as_str(), members[0].byte_offset), ("x", 0));
+                assert_eq!((members[1].name.as_str(), members[1].byte_offset), ("y", 8));
                 assert_eq!(
                     (members[2].name.as_str(), members[2].byte_offset),
                     ("id", 16)
@@ -1076,7 +1070,10 @@ mod tests {
                 dimensions,
             } => {
                 assert_eq!(dimensions, vec![3]);
-                assert!(matches!(*base_type, Datatype::FloatingPoint { size: 8, .. }));
+                assert!(matches!(
+                    *base_type,
+                    Datatype::FloatingPoint { size: 8, .. }
+                ));
             }
             other => panic!("expected Array, got {other:?}"),
         }

crates/clawhdf5-format/src/dict_encoding.rs

@@ -20,7 +20,7 @@
 //! ```
 
 #[cfg(not(feature = "std"))]
-use alloc::{string::String, vec, vec::Vec};
+use alloc::{format, string::String, vec, vec::Vec};
 
 #[cfg(not(feature = "std"))]
 use alloc::collections::BTreeMap;

crates/clawhdf5-format/src/file_writer.rs

@@ -375,7 +375,8 @@ fn build_multiblock_fractal_heap(
     let table_width: u16 = 4;
     let starting_block_size: u64 = 512;
     let dblock_header_size = 4 + 1 + os + block_offset_bytes + 4;
-    let block_capacity = |row: usize| block_size_for_row(starting_block_size, row) - dblock_header_size as u64;
+    let block_capacity =
+        |row: usize| block_size_for_row(starting_block_size, row) - dblock_header_size as u64;
 
     // ---- Pack objects into direct blocks (row-major over the doubling table) ----
     struct Blk {
@@ -542,7 +543,26 @@ fn block_size_for_row(starting_block_size: u64, row: usize) -> u64 {
 
 /// Size in bytes of the FRHP header for the given offset/length sizes.
 fn frhp_header_size(os: usize, ls: usize) -> usize {
-    4 + 1 + 2 + 2 + 1 + 4 + ls + os + ls + os + ls + ls + ls + ls + ls + ls + ls + ls + 2 + ls + ls
+    4 + 1
+        + 2
+        + 2
+        + 1
+        + 4
+        + ls
+        + os
+        + ls
+        + os
+        + ls
+        + ls
+        + ls
+        + ls
+        + ls
+        + ls
+        + ls
+        + ls
+        + 2
+        + ls
+        + ls
         + 2
         + 2
         + os
@@ -670,8 +690,7 @@ pub(crate) fn build_dense_attrs(attrs: &[AttributeMessage], base_address: u64) -
     // Pad to node_size
     btlf.resize(node_size as usize, 0);
 
-    let mut blob =
-        Vec::with_capacity(heap.blob.len() + bthd.len() + btlf.len());
+    let mut blob = Vec::with_capacity(heap.blob.len() + bthd.len() + btlf.len());
     blob.extend_from_slice(&heap.blob);
     blob.extend_from_slice(&bthd);
     blob.extend_from_slice(&btlf);
@@ -762,8 +781,7 @@ pub(crate) fn build_dense_links(links: &[LinkMessage], base_address: u64) -> Den
     btlf.extend_from_slice(&btlf_checksum.to_le_bytes());
     btlf.resize(node_size as usize, 0);
 
-    let mut blob =
-        Vec::with_capacity(heap.blob.len() + bthd.len() + btlf.len());
+    let mut blob = Vec::with_capacity(heap.blob.len() + bthd.len() + btlf.len());
     blob.extend_from_slice(&heap.blob);
     blob.extend_from_slice(&bthd);
     blob.extend_from_slice(&btlf);
@@ -1096,10 +1114,7 @@ impl FileWriter {
             root_attrs.push(build_attr_message(n, v));
         }
 
-        let is_vds: Vec<bool> = all_ds
-            .iter()
-            .map(|d| d.virtual_sources.is_some())
-            .collect();
+        let is_vds: Vec<bool> = all_ds.iter().map(|d| d.virtual_sources.is_some()).collect();
         let is_chunked: Vec<bool> = all_ds
             .iter()
             .enumerate()
@@ -1198,7 +1213,8 @@ impl FileWriter {
                 // Global heap blob size is address-independent; compute it now
                 // so pass 2 can place it correctly.
                 let vds_mappings = d.virtual_sources.as_deref().unwrap_or(&[]);
-                let gcol_bytes = build_global_heap_collection(&serialize_vds_mappings(vds_mappings));
+                let gcol_bytes =
+                    build_global_heap_collection(&serialize_vds_mappings(vds_mappings));
                 dummy_blobs.push(DataBlob {
                     data: gcol_bytes, // store heap blob here temporarily
                     oh_bytes: oh,
@@ -1216,8 +1232,11 @@ impl FileWriter {
                     elem_size,
                     &d.chunk_options,
                 )?;
-                let result =
-                    build_chunked_data_from_precompressed(&pre, dummy_cursor, d.maxshape.as_deref());
+                let result = build_chunked_data_from_precompressed(
+                    &pre,
+                    dummy_cursor,
+                    d.maxshape.as_deref(),
+                );
                 dummy_cursor += result.data_bytes.len() as u64;
                 let dense_blob = if ds_dense[i] {
                     Some(build_dense_attrs(&d.attrs, 0))
@@ -1391,7 +1410,10 @@ impl FileWriter {
                 // Reuse precompressed chunks from Pass 1 — avoids re-compressing
                 // the same data a second time.
                 let result = build_chunked_data_from_precompressed(
-                    dummy_blobs[i].precompressed.as_ref().expect("chunked dataset missing precompressed cache"),
+                    dummy_blobs[i]
+                        .precompressed
+                        .as_ref()
+                        .expect("chunked dataset missing precompressed cache"),
                     base_address,
                     d.maxshape.as_deref(),
                 );
@@ -1492,7 +1514,9 @@ impl FileWriter {
         // Rebuild the root link blob with real target addresses (same size as
         // the dummy used for layout); its LinkInfo goes in the OH.
         let root_link_blob = root_link_blob_addr.map(|addr| build_dense_links(&root_links, addr));
-        let root_dl = root_link_blob.as_ref().map(|b| b.link_info_message.as_slice());
+        let root_dl = root_link_blob
+            .as_ref()
+            .map(|b| b.link_info_message.as_slice());
         buf.extend_from_slice(&build_group_oh(
             &root_links,
             root_dl,
@@ -1903,14 +1927,14 @@ mod tests {
     fn sel_hyper_1d(start: u16, block: u16) -> Vec<u8> {
         let mut v = vec![
             2, 0, 0, 0, // type = HYPER
-            3, 0, 0, 0, // version 3
-            0x01,       // flags = regular
-            0x02,       // enc_size = 2 (u16 per coordinate)
+            3, 0, 0, 0,    // version 3
+            0x01, // flags = regular
+            0x02, // enc_size = 2 (u16 per coordinate)
             1, 0, 0, 0, // rank = 1
         ];
         v.extend_from_slice(&start.to_le_bytes()); // start
-        v.extend_from_slice(&1u16.to_le_bytes());  // stride
-        v.extend_from_slice(&1u16.to_le_bytes());  // count
+        v.extend_from_slice(&1u16.to_le_bytes()); // stride
+        v.extend_from_slice(&1u16.to_le_bytes()); // count
         v.extend_from_slice(&block.to_le_bytes()); // block
         v
     }
@@ -1936,8 +1960,10 @@ mod tests {
 
         let mut fw = FileWriter::new();
         // Source datasets (real data in this file)
-        fw.create_dataset("src_a").with_f64_data(&[1.0, 2.0, 3.0, 4.0]);
-        fw.create_dataset("src_b").with_f64_data(&[5.0, 6.0, 7.0, 8.0]);
+        fw.create_dataset("src_a")
+            .with_f64_data(&[1.0, 2.0, 3.0, 4.0]);
+        fw.create_dataset("src_b")
+            .with_f64_data(&[5.0, 6.0, 7.0, 8.0]);
         // Virtual dataset
         fw.create_dataset("vds")
             .with_shape(&[8])
@@ -1950,13 +1976,8 @@ mod tests {
         let sig = signature::find_signature(&bytes).unwrap();
         let sb = Superblock::parse(&bytes, sig).unwrap();
         let vds_addr = resolve_path_any(&bytes, &sb, "vds").unwrap();
-        let hdr = ObjectHeader::parse(
-            &bytes,
-            vds_addr as usize,
-            sb.offset_size,
-            sb.length_size,
-        )
-        .unwrap();
+        let hdr =
+            ObjectHeader::parse(&bytes, vds_addr as usize, sb.offset_size, sb.length_size).unwrap();
 
         let dl_data = &hdr
             .messages
@@ -1965,8 +1986,7 @@ mod tests {
             .unwrap()
             .data;
 
-        let mut layout =
-            DataLayout::parse(dl_data, sb.offset_size, sb.length_size).unwrap();
+        let mut layout = DataLayout::parse(dl_data, sb.offset_size, sb.length_size).unwrap();
 
         // Before resolution, mappings field is empty.
         assert!(
@@ -2033,8 +2053,7 @@ mod tests {
             .find(|m| m.msg_type == MessageType::DataLayout)
             .unwrap()
             .data;
-        let mut layout =
-            DataLayout::parse(dl_data, sb.offset_size, sb.length_size).unwrap();
+        let mut layout = DataLayout::parse(dl_data, sb.offset_size, sb.length_size).unwrap();
         layout.resolve_vds_mappings(&bytes, sb.length_size).unwrap();
 
         match &layout {
@@ -2112,7 +2131,10 @@ mod tests {
             .expect("external link 'remote_temp' not found in group OH");
 
         match &ext_link.link_target {
-            crate::link_message::LinkTarget::External { filename, object_path } => {
+            crate::link_message::LinkTarget::External {
+                filename,
+                object_path,
+            } => {
                 assert_eq!(filename, "other_file.h5");
                 assert_eq!(object_path, "/temperature");
             }

crates/clawhdf5-format/src/filters.rs

@@ -4,14 +4,19 @@
 extern crate alloc;
 
 #[cfg(not(feature = "std"))]
-use alloc::{vec, vec::Vec};
+use alloc::{boxed::Box, vec, vec::Vec};
 
 use crate::error::FormatError;
 use crate::filter_pipeline::{
-    FILTER_DEFLATE, FILTER_FLETCHER32, FILTER_LZ4, FILTER_NBIT, FILTER_PCODEC,
-    FILTER_SCALEOFFSET, FILTER_SHUFFLE, FILTER_SZIP, FILTER_ZSTD, FilterPipeline,
+    FILTER_DEFLATE, FILTER_FLETCHER32, FILTER_LZ4, FILTER_NBIT, FILTER_PCODEC, FILTER_SCALEOFFSET,
+    FILTER_SHUFFLE, FILTER_SZIP, FILTER_ZSTD, FilterPipeline,
 };
 
+/// Absolute ceiling on a single decompressed chunk's output size, used only
+/// when the pipeline's declared `chunk_size` is unavailable (0). Prevents
+/// unbounded-allocation DoS from a malicious/corrupted compressed chunk.
+pub(crate) const MAX_DECOMPRESS_SIZE: usize = 256 * 1024 * 1024;
+
 /// Apply a filter pipeline to decompress a chunk.
 /// Filters are applied in REVERSE order for decompression.
 pub fn decompress_chunk(
@@ -25,16 +30,22 @@ pub fn decompress_chunk(
     for filter in pipeline.filters.iter().rev() {
         data = match filter.filter_id {
             FILTER_SHUFFLE => shuffle_decompress(&data, element_size as usize)?,
-            FILTER_DEFLATE => deflate_decompress(&data)?,
-            FILTER_LZ4 => lz4_decompress(&data)?,
-            FILTER_ZSTD => zstd_decompress(&data)?,
+            // `chunk_size` is the expected decompressed size (shuffle/fletcher32
+            // are size-preserving, so it bounds these too); pass it so these
+            // decoders can't be forced into unbounded allocation by a hostile
+            // or corrupted compressed payload.
+            FILTER_DEFLATE => deflate_decompress(&data, chunk_size)?,
+            FILTER_LZ4 => lz4_decompress(&data, chunk_size)?,
+            FILTER_ZSTD => zstd_decompress(&data, chunk_size)?,
             FILTER_FLETCHER32 => fletcher32_verify(&data)?,
-            FILTER_PCODEC => pcodec_decompress(&data, element_size as usize)?,
+            FILTER_PCODEC => pcodec_decompress(&data, element_size as usize, chunk_size)?,
             // `chunk_size` is the expected decompressed size; pass it so these
             // decoders can reject an element count that would over-allocate.
             FILTER_SCALEOFFSET => scaleoffset_decompress(&data, &filter.client_data, chunk_size)?,
             FILTER_NBIT => nbit_decompress(&data, &filter.client_data, chunk_size)?,
-            FILTER_SZIP => crate::filters_szip::szip_decompress(&data, &filter.client_data, chunk_size)?,
+            FILTER_SZIP => {
+                crate::filters_szip::szip_decompress(&data, &filter.client_data, chunk_size)?
+            }
             other => return Err(FormatError::UnsupportedFilter(other)),
         };
     }
@@ -89,6 +100,27 @@ pub fn compress_chunk(
 /// E-scale, interpreted as i32 for negative exponents), `[2]`=element count,
 /// `[4]`=element size, `[5]`=signed flag, `[6]`=byte order (1 = big-endian),
 /// `[7]`=fill defined, `[8..]`=fill value bits.
+/// `f64::powi` equivalent that works under `no_std` (no libm/std available).
+/// Exponentiation by squaring, matching `powi`'s semantics for negative
+/// exponents via reciprocal.
+fn powi_f64(base: f64, mut exp: i32) -> f64 {
+    let neg = exp < 0;
+    if neg {
+        exp = -exp;
+    }
+    let mut result = 1.0f64;
+    let mut b = base;
+    let mut e = exp as u32;
+    while e > 0 {
+        if e & 1 == 1 {
+            result *= b;
+        }
+        b *= b;
+        e >>= 1;
+    }
+    if neg { 1.0 / result } else { result }
+}
+
 fn scaleoffset_decompress(
     data: &[u8],
     cd: &[u32],
@@ -207,9 +239,9 @@ fn scaleoffset_decompress(
                 if has_fill_code && code == fill_code {
                     fill_value
                 } else if is_escale {
-                    minval + code as f64 * 2f64.powi(scale_factor)
+                    minval + code as f64 * powi_f64(2.0, scale_factor)
                 } else {
-                    minval + code as f64 / 10f64.powi(scale_factor)
+                    minval + code as f64 / powi_f64(10.0, scale_factor)
                 }
             })
             .collect();
@@ -569,24 +601,48 @@ fn nbit_decompress(data: &[u8], cd: &[u32], expected_bytes: usize) -> Result<Vec
 }
 
 /// Decompress zlib-compressed data.
+///
+/// `expected_bytes` is the pipeline's declared decompressed chunk size (0 if
+/// unavailable); output is rejected if it exceeds this bound (or, when
+/// unavailable, [`MAX_DECOMPRESS_SIZE`]), preventing a hostile/corrupted
+/// compressed payload from forcing unbounded allocation (a "zlib bomb").
 #[cfg(feature = "deflate")]
-fn deflate_decompress(data: &[u8]) -> Result<Vec<u8>, FormatError> {
+fn deflate_decompress(data: &[u8], expected_bytes: usize) -> Result<Vec<u8>, FormatError> {
+    let limit = if expected_bytes != 0 {
+        expected_bytes
+    } else {
+        MAX_DECOMPRESS_SIZE
+    };
+
     // Try system zlib first on macOS (Apple's ARM64-optimized libz is ~1.4x
     // faster at decompression than zlib-ng on Apple Silicon).
     #[cfg(all(target_os = "macos", feature = "system-zlib-decompress"))]
     {
         if let Ok(result) = sysz::decompress(data) {
+            if result.len() > limit {
+                return Err(FormatError::DecompressionError(
+                    "deflate: output exceeds expected chunk size".into(),
+                ));
+            }
             return Ok(result);
         }
         // Fall through to flate2 on error
     }
 
     use std::io::Read;
-    let mut decoder = flate2::read::ZlibDecoder::new(data);
-    let mut result = Vec::new();
+    let decoder = flate2::read::ZlibDecoder::new(data);
+    let mut result = Vec::with_capacity(limit.min(1 << 20));
+    // Read one byte past the limit so an over-size stream is distinguishable
+    // from one that legitimately ends exactly at the limit.
     decoder
+        .take(limit as u64 + 1)
         .read_to_end(&mut result)
         .map_err(|e| FormatError::DecompressionError(e.to_string()))?;
+    if result.len() > limit {
+        return Err(FormatError::DecompressionError(
+            "deflate: output exceeds size limit".into(),
+        ));
+    }
     Ok(result)
 }
 
@@ -659,7 +715,7 @@ mod sysz {
 }
 
 #[cfg(not(feature = "deflate"))]
-fn deflate_decompress(_data: &[u8]) -> Result<Vec<u8>, FormatError> {
+fn deflate_decompress(_data: &[u8], _expected_bytes: usize) -> Result<Vec<u8>, FormatError> {
     Err(FormatError::UnsupportedFilter(FILTER_DEFLATE))
 }
 
@@ -682,20 +738,35 @@ fn deflate_compress(_data: &[u8], _level: u32) -> Result<Vec<u8>, FormatError> {
 }
 
 /// Decompress LZ4 data. Format: 4 bytes LE original size + LZ4 block data.
+///
+/// The 4-byte "original size" header is part of the attacker-controlled
+/// compressed payload itself, so it is bounded against `expected_bytes` (the
+/// pipeline's declared chunk size) before being used to size the output
+/// allocation — otherwise a crafted 4-byte value can request up to ~4 GiB.
 #[cfg(feature = "lz4")]
-fn lz4_decompress(data: &[u8]) -> Result<Vec<u8>, FormatError> {
+fn lz4_decompress(data: &[u8], expected_bytes: usize) -> Result<Vec<u8>, FormatError> {
     if data.len() < 4 {
         return Err(FormatError::DecompressionError(
             "lz4: data too short".into(),
         ));
     }
     let orig_size = u32::from_le_bytes([data[0], data[1], data[2], data[3]]) as usize;
+    if expected_bytes != 0 && orig_size > expected_bytes {
+        return Err(FormatError::DecompressionError(
+            "lz4: declared size exceeds chunk size".into(),
+        ));
+    }
+    if orig_size > MAX_DECOMPRESS_SIZE {
+        return Err(FormatError::DecompressionError(
+            "lz4: declared size exceeds limit".into(),
+        ));
+    }
     lz4_flex::block::decompress(&data[4..], orig_size)
         .map_err(|e| FormatError::DecompressionError(format!("lz4: {e}")))
 }
 
 #[cfg(not(feature = "lz4"))]
-fn lz4_decompress(_data: &[u8]) -> Result<Vec<u8>, FormatError> {
+fn lz4_decompress(_data: &[u8], _expected_bytes: usize) -> Result<Vec<u8>, FormatError> {
     Err(FormatError::UnsupportedFilter(FILTER_LZ4))
 }
 
@@ -715,13 +786,35 @@ fn lz4_compress(_data: &[u8]) -> Result<Vec<u8>, FormatError> {
 }
 
 /// Decompress zstd data.
+///
+/// `expected_bytes` bounds the output (or [`MAX_DECOMPRESS_SIZE`] when
+/// unavailable) to guard against a zstd decompression bomb, since zstd's
+/// compression ratio can exceed 1000:1.
 #[cfg(feature = "zstd")]
-fn zstd_decompress(data: &[u8]) -> Result<Vec<u8>, FormatError> {
-    zstd::decode_all(data).map_err(|e| FormatError::DecompressionError(format!("zstd: {e}")))
+fn zstd_decompress(data: &[u8], expected_bytes: usize) -> Result<Vec<u8>, FormatError> {
+    use std::io::Read;
+    let limit = if expected_bytes != 0 {
+        expected_bytes
+    } else {
+        MAX_DECOMPRESS_SIZE
+    };
+    let decoder = zstd::stream::Decoder::new(data)
+        .map_err(|e| FormatError::DecompressionError(format!("zstd: {e}")))?;
+    let mut out = Vec::with_capacity(limit.min(1 << 20));
+    decoder
+        .take(limit as u64 + 1)
+        .read_to_end(&mut out)
+        .map_err(|e| FormatError::DecompressionError(format!("zstd: {e}")))?;
+    if out.len() > limit {
+        return Err(FormatError::DecompressionError(
+            "zstd: output exceeds chunk size".into(),
+        ));
+    }
+    Ok(out)
 }
 
 #[cfg(not(feature = "zstd"))]
-fn zstd_decompress(_data: &[u8]) -> Result<Vec<u8>, FormatError> {
+fn zstd_decompress(_data: &[u8], _expected_bytes: usize) -> Result<Vec<u8>, FormatError> {
     Err(FormatError::UnsupportedFilter(FILTER_ZSTD))
 }
 
@@ -982,30 +1075,74 @@ fn pcodec_compress(_data: &[u8], _element_size: usize) -> Result<Vec<u8>, Format
     Err(FormatError::UnsupportedFilter(FILTER_PCODEC))
 }
 
+/// `expected_bytes` bounds the number of elements decoded: the output buffer
+/// is pre-sized to exactly `expected_bytes / element_size` elements and
+/// `simple_decompress_into` never writes past it, so a corrupted/hostile pco
+/// stream cannot force over-allocation the way an unbounded `simple_decompress`
+/// (which allocates however many elements the stream claims) could.
 #[cfg(feature = "pcodec")]
-fn pcodec_decompress(data: &[u8], element_size: usize) -> Result<Vec<u8>, FormatError> {
-    use pco::standalone::simple_decompress;
+fn pcodec_decompress(
+    data: &[u8],
+    element_size: usize,
+    expected_bytes: usize,
+) -> Result<Vec<u8>, FormatError> {
+    use pco::standalone::simple_decompress_into;
+    let limit_bytes = if expected_bytes != 0 {
+        expected_bytes
+    } else {
+        MAX_DECOMPRESS_SIZE
+    };
+    let n = if element_size != 0 {
+        limit_bytes / element_size
+    } else {
+        0
+    };
     match element_size {
         4 => {
-            let nums = simple_decompress::<f32>(data)
+            let mut buf = vec![0f32; n];
+            let progress = simple_decompress_into(data, &mut buf)
                 .map_err(|e| FormatError::DecompressionError(format!("pco: {e}")))?;
-            Ok(nums.iter().flat_map(|x| x.to_le_bytes()).collect())
+            if !progress.finished {
+                return Err(FormatError::DecompressionError(
+                    "pco: stream contains more data than expected chunk size allows".into(),
+                ));
+            }
+            buf.truncate(progress.n_processed);
+            Ok(buf.iter().flat_map(|x| x.to_le_bytes()).collect())
         }
         8 => {
-            let nums = simple_decompress::<f64>(data)
+            let mut buf = vec![0f64; n];
+            let progress = simple_decompress_into(data, &mut buf)
                 .map_err(|e| FormatError::DecompressionError(format!("pco: {e}")))?;
-            Ok(nums.iter().flat_map(|x| x.to_le_bytes()).collect())
+            if !progress.finished {
+                return Err(FormatError::DecompressionError(
+                    "pco: stream contains more data than expected chunk size allows".into(),
+                ));
+            }
+            buf.truncate(progress.n_processed);
+            Ok(buf.iter().flat_map(|x| x.to_le_bytes()).collect())
         }
         _ => {
-            let nums = simple_decompress::<u32>(data)
+            let mut buf = vec![0u32; n];
+            let progress = simple_decompress_into(data, &mut buf)
                 .map_err(|e| FormatError::DecompressionError(format!("pco: {e}")))?;
-            Ok(nums.iter().flat_map(|x| x.to_le_bytes()).collect())
+            if !progress.finished {
+                return Err(FormatError::DecompressionError(
+                    "pco: stream contains more data than expected chunk size allows".into(),
+                ));
+            }
+            buf.truncate(progress.n_processed);
+            Ok(buf.iter().flat_map(|x| x.to_le_bytes()).collect())
         }
     }
 }
 
 #[cfg(not(feature = "pcodec"))]
-fn pcodec_decompress(_data: &[u8], _element_size: usize) -> Result<Vec<u8>, FormatError> {
+fn pcodec_decompress(
+    _data: &[u8],
+    _element_size: usize,
+    _expected_bytes: usize,
+) -> Result<Vec<u8>, FormatError> {
     Err(FormatError::UnsupportedFilter(FILTER_PCODEC))
 }
 
@@ -1021,7 +1158,7 @@ mod tests {
     fn deflate_compress_decompress_roundtrip() {
         let data: Vec<u8> = (0..256).map(|i| (i % 256) as u8).collect();
         let compressed = deflate_compress(&data, 6).unwrap();
-        let decompressed = deflate_decompress(&compressed).unwrap();
+        let decompressed = deflate_decompress(&compressed, data.len()).unwrap();
         assert_eq!(decompressed, data);
     }
 
@@ -1034,7 +1171,7 @@ mod tests {
         let compressed: Vec<u8> = vec![
             120, 156, 99, 96, 100, 98, 102, 97, 101, 99, 231, 224, 4, 0, 0, 175, 0, 46,
         ];
-        let decompressed = deflate_decompress(&compressed).unwrap();
+        let decompressed = deflate_decompress(&compressed, 10).unwrap();
         assert_eq!(decompressed, vec![0, 1, 2, 3, 4, 5, 6, 7, 8, 9]);
     }
 
@@ -1045,7 +1182,7 @@ mod tests {
         let data = vec![0u8, 1, 2, 3, 4, 5, 6, 7, 8, 9];
         let compressed = deflate_compress(&data, 6).unwrap();
         assert!(!compressed.is_empty());
-        let decompressed = deflate_decompress(&compressed).unwrap();
+        let decompressed = deflate_decompress(&compressed, data.len()).unwrap();
         assert_eq!(decompressed, data);
     }
 
@@ -1246,7 +1383,7 @@ mod tests {
     fn lz4_compress_decompress_roundtrip() {
         let data: Vec<u8> = (0..256).map(|i| (i % 256) as u8).collect();
         let compressed = lz4_compress(&data).unwrap();
-        let decompressed = lz4_decompress(&compressed).unwrap();
+        let decompressed = lz4_decompress(&compressed, data.len()).unwrap();
         assert_eq!(decompressed, data);
     }
 
@@ -1301,7 +1438,7 @@ mod tests {
     fn zstd_compress_decompress_roundtrip() {
         let data: Vec<u8> = (0..256).map(|i| (i % 256) as u8).collect();
         let compressed = zstd_compress(&data, 3).unwrap();
-        let decompressed = zstd_decompress(&compressed).unwrap();
+        let decompressed = zstd_decompress(&compressed, data.len()).unwrap();
         assert_eq!(decompressed, data);
     }
 
@@ -1372,7 +1509,10 @@ mod tests {
             0x02, 0x00, 0x00, 0x00, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc6, 0x00,
         ];
-        assert_eq!(scaleoffset_decompress(&raw, &cd, 0).unwrap(), i32_le(&[0, 1, 2, 3]));
+        assert_eq!(
+            scaleoffset_decompress(&raw, &cd, 0).unwrap(),
+            i32_le(&[0, 1, 2, 3])
+        );
     }
 
     #[test]
@@ -1450,9 +1590,9 @@ mod tests {
         let cd = [1u32, 1, 4, 0, 8, 0, 0, 0];
         let raw: &[u8] = &[
             2, 0, 0, 0, // minbits=2
-            8,          // minval_width=8
+            8, // minval_width=8
             0, 0, 0, 0, 0, 0, 0, 0, // minval=0.0f64
-            0, 0, 0, 0, 0, 0, 0, 0, // 8 reserved bytes
+            0, 0, 0, 0, 0, 0, 0, 0,    // 8 reserved bytes
             0x1B, // packed codes: 00 01 10 11 MSB-first
         ];
         let got = as_f64(&scaleoffset_decompress(raw, &cd, 0).unwrap());
@@ -1466,9 +1606,9 @@ mod tests {
         let cd = [1u32, 0xFFFF_FFFF, 4, 0, 8, 0, 0, 0];
         let raw: &[u8] = &[
             2, 0, 0, 0, // minbits=2
-            8,          // minval_width=8
+            8, // minval_width=8
             0, 0, 0, 0, 0, 0, 0, 0, // minval=0.0f64
-            0, 0, 0, 0, 0, 0, 0, 0, // 8 reserved bytes
+            0, 0, 0, 0, 0, 0, 0, 0,    // 8 reserved bytes
             0x1B, // packed codes: 00 01 10 11 MSB-first
         ];
         let got = as_f64(&scaleoffset_decompress(raw, &cd, 0).unwrap());
@@ -1531,8 +1671,12 @@ mod tests {
     fn nbit_compound_with_array_member() {
         // Compound { a: array(2,) of i32 prec 16 @0; b: u32@8 prec 8 }, 2 elements.
         // data = [([-1,100],200), ([1000,-32768],7)].
-        let cd = [20u32, 0, 2, 3, 12, 2, 0, 2, 8, 1, 4, 0, 16, 0, 8, 1, 4, 0, 8, 0];
-        let raw = [0xff, 0xff, 0x00, 0x64, 0xc8, 0x03, 0xe8, 0x80, 0x00, 0x07, 0x00];
+        let cd = [
+            20u32, 0, 2, 3, 12, 2, 0, 2, 8, 1, 4, 0, 16, 0, 8, 1, 4, 0, 8, 0,
+        ];
+        let raw = [
+            0xff, 0xff, 0x00, 0x64, 0xc8, 0x03, 0xe8, 0x80, 0x00, 0x07, 0x00,
+        ];
         #[rustfmt::skip]
         let expected: Vec<u8> = vec![
             0xff,0xff,0x00,0x00, 0x64,0x00,0x00,0x00, 0xc8,0x00,0x00,0x00, // ([-1,100], 200)
@@ -1623,4 +1767,79 @@ mod tests {
         // Missing client data entirely.
         assert!(scaleoffset_decompress(&[0u8; 32], &[2, 0], 4).is_err());
     }
+
+    // ----- Decompression-bomb hardening: hostile compressed data must not -----
+    // ----- force unbounded allocation.                                    -----
+
+    #[test]
+    #[cfg(feature = "lz4")]
+    fn lz4_decompress_rejects_oversized_orig_size() {
+        // 4-byte LE header claiming ~4 GiB, followed by a few garbage bytes.
+        let mut data = u32::MAX.to_le_bytes().to_vec();
+        data.extend_from_slice(&[0u8; 8]);
+        assert!(lz4_decompress(&data, 64).is_err());
+    }
+
+    #[test]
+    #[cfg(feature = "lz4")]
+    fn lz4_decompress_rejects_size_exceeding_chunk_size() {
+        // orig_size (1000) is well under MAX_DECOMPRESS_SIZE but exceeds the
+        // pipeline's declared chunk size (64) — must be rejected by the
+        // chunk-size check specifically, not just the absolute cap.
+        let mut data = 1000u32.to_le_bytes().to_vec();
+        data.extend_from_slice(&[0u8; 8]);
+        assert!(lz4_decompress(&data, 64).is_err());
+    }
+
+    #[test]
+    #[cfg(feature = "deflate")]
+    fn deflate_decompress_rejects_output_exceeding_chunk_size() {
+        // A highly-compressible deflate bomb (1 MiB of zeros compresses to a
+        // tiny payload); declared chunk size is far smaller than the real
+        // decompressed size, so this must be rejected rather than allocating
+        // the full 1 MiB.
+        let data = vec![0u8; 1024 * 1024];
+        let compressed = deflate_compress(&data, 6).unwrap();
+        assert!(deflate_decompress(&compressed, 64).is_err());
+    }
+
+    #[test]
+    #[cfg(feature = "zstd")]
+    fn zstd_decompress_rejects_output_exceeding_chunk_size() {
+        let data = vec![0u8; 1024 * 1024];
+        let compressed = zstd_compress(&data, 3).unwrap();
+        assert!(zstd_decompress(&compressed, 64).is_err());
+    }
+
+    #[test]
+    #[cfg(feature = "pcodec")]
+    fn pcodec_decompress_rejects_element_count_exceeding_chunk_size() {
+        let data: Vec<f32> = (0..1000).map(|i| i as f32).collect();
+        let raw: Vec<u8> = data.iter().flat_map(|x| x.to_le_bytes()).collect();
+        let compressed = pcodec_compress(&raw, 4).unwrap();
+        // Declared chunk size only fits 4 f32 elements, far fewer than the
+        // 1000 the stream actually contains.
+        assert!(pcodec_decompress(&compressed, 4, 16).is_err());
+    }
+
+    #[test]
+    #[cfg(feature = "lz4")]
+    fn decompress_chunk_rejects_hostile_lz4_size_via_public_entrypoint() {
+        // The actually-exploited path: a FilterPipeline claiming a small
+        // chunk_size, but whose LZ4-compressed data header claims a huge
+        // decompressed size.
+        use crate::filter_pipeline::{FilterDescription, FilterPipeline};
+        let mut data = u32::MAX.to_le_bytes().to_vec();
+        data.extend_from_slice(&[0u8; 8]);
+        let pipeline = FilterPipeline {
+            version: 2,
+            filters: vec![FilterDescription {
+                filter_id: FILTER_LZ4,
+                name: None,
+                flags: 0,
+                client_data: vec![],
+            }],
+        };
+        assert!(decompress_chunk(&data, &pipeline, 16, 1).is_err());
+    }
 }

crates/clawhdf5-format/src/filters_szip.rs

@@ -2,6 +2,9 @@
 //!
 //! Gated by the `szip` feature which links against the system libaec library.
 
+#[cfg(not(feature = "std"))]
+use alloc::vec::Vec;
+
 use crate::error::FormatError;
 
 /// Decompress SZIP-compressed data using libaec.
@@ -49,9 +52,7 @@ fn szip_decode_impl(data: &[u8], cd: &[u32], chunk_size: usize) -> Result<Vec<u8
         ));
     }
     if data.is_empty() {
-        return Err(FormatError::ChunkedReadError(
-            "szip: empty input".into(),
-        ));
+        return Err(FormatError::ChunkedReadError("szip: empty input".into()));
     }
 
     // Map HDF5 option mask to libaec flags.
@@ -112,7 +113,7 @@ mod tests {
     #[cfg(feature = "szip")]
     #[test]
     fn roundtrip_u8_msb_no_nn() {
-        use libaec_sys::{AecStream, AEC_DATA_MSB};
+        use libaec_sys::{AEC_DATA_MSB, AecStream};
 
         let original: Vec<u8> = (0..1024u32).map(|i| (i % 256) as u8).collect();
 
@@ -144,7 +145,7 @@ mod tests {
     #[cfg(feature = "szip")]
     #[test]
     fn roundtrip_u8_msb_with_nn() {
-        use libaec_sys::{AecStream, AEC_DATA_MSB, AEC_DATA_PREPROCESS};
+        use libaec_sys::{AEC_DATA_MSB, AEC_DATA_PREPROCESS, AecStream};
 
         let original: Vec<u8> = (0..1024u32).map(|i| (i % 256) as u8).collect();
 
@@ -167,6 +168,9 @@ mod tests {
         let cd = [0x20u32, 8, 8, 1024];
         let decoded = szip_decompress(&encoded, &cd, original.len())
             .expect("szip_decompress with NN must succeed");
-        assert_eq!(decoded, original, "NN round-trip must reproduce original data");
+        assert_eq!(
+            decoded, original,
+            "NN round-trip must reproduce original data"
+        );
     }
 }

crates/clawhdf5-format/src/fixed_array.rs

@@ -186,25 +186,26 @@ pub fn read_fixed_array_chunks(
         chunk_dimensions.iter().map(|&d| d as u64).product::<u64>() * element_size as u64;
 
     let mut chunks = Vec::new();
-    let push_element = |i: usize, abs: usize, chunks: &mut Vec<ChunkInfo>| -> Result<(), FormatError> {
-        if let Some((address, chunk_size, filter_mask)) = parse_fa_element(
-            file_data,
-            abs,
-            header.client_id,
-            offset_size,
-            header.element_size,
-            chunk_byte_size,
-        )? {
-            let offsets = index_to_chunk_offsets(i, &num_chunks_per_dim, chunk_dimensions);
-            chunks.push(ChunkInfo {
-                chunk_size,
-                filter_mask,
-                offsets,
-                address,
-            });
-        }
-        Ok(())
-    };
+    let push_element =
+        |i: usize, abs: usize, chunks: &mut Vec<ChunkInfo>| -> Result<(), FormatError> {
+            if let Some((address, chunk_size, filter_mask)) = parse_fa_element(
+                file_data,
+                abs,
+                header.client_id,
+                offset_size,
+                header.element_size,
+                chunk_byte_size,
+            )? {
+                let offsets = index_to_chunk_offsets(i, &num_chunks_per_dim, chunk_dimensions);
+                chunks.push(ChunkInfo {
+                    chunk_size,
+                    filter_mask,
+                    offsets,
+                    address,
+                });
+            }
+            Ok(())
+        };
 
     // A data block is paged when it holds more elements than fit in one page.
     // `max_nelmts_bits` is an untrusted u8; a shift >= the pointer width would
@@ -232,9 +233,8 @@ pub fn read_fixed_array_chunks(
     // only the final page holds fewer elements. Uninitialized pages (bit clear)
     // still occupy their slot on disk but are zero-filled, so the bitmap — not a
     // 0xFF sentinel — is what marks a whole page as unallocated.
-    let stride_overflow = || {
-        FormatError::ChunkedReadError("Fixed Array page offset overflow".into())
-    };
+    let stride_overflow =
+        || FormatError::ChunkedReadError("Fixed Array page offset overflow".into());
     let npages = num_elements.div_ceil(page_nelmts);
     let bitmap_size = npages.div_ceil(8);
     let bitmap_start = elements_start;
@@ -720,10 +720,7 @@ mod tests {
         // Page 1 (elements 4,5,6,7) is uninitialized => skipped. The remaining
         // 7 chunks (0..4 and 8..11) come back with their original linear index.
         assert_eq!(chunks.len(), 7);
-        let mut got: Vec<(u64, u64)> = chunks
-            .iter()
-            .map(|c| (c.offsets[0], c.address))
-            .collect();
+        let mut got: Vec<(u64, u64)> = chunks.iter().map(|c| (c.offsets[0], c.address)).collect();
         got.sort();
         let expect: Vec<(u64, u64)> = [0usize, 1, 2, 3, 8, 9, 10]
             .iter()

crates/clawhdf5-format/src/global_heap.rs

@@ -6,7 +6,7 @@ use alloc::vec::Vec;
 use crate::error::FormatError;
 
 /// Magic signature for global heap collections.
-const GCOL_SIGNATURE: [u8; 4] = [b'G', b'C', b'O', b'L'];
+const GCOL_SIGNATURE: [u8; 4] = *b"GCOL";
 
 /// A parsed global heap collection.
 #[derive(Debug, Clone)]

crates/clawhdf5-format/src/object_header.rs

@@ -9,10 +9,10 @@ use crate::error::FormatError;
 use crate::message_type::MessageType;
 
 /// OHDR signature for v2 object headers.
-const OHDR_SIGNATURE: [u8; 4] = [b'O', b'H', b'D', b'R'];
+const OHDR_SIGNATURE: [u8; 4] = *b"OHDR";
 
 /// OCHK signature for v2 continuation chunks.
-const OCHK_SIGNATURE: [u8; 4] = [b'O', b'C', b'H', b'K'];
+const OCHK_SIGNATURE: [u8; 4] = *b"OCHK";
 
 /// A single parsed header message.
 #[derive(Debug, Clone)]
@@ -555,13 +555,12 @@ mod tests {
         buf.push(2); // version
         buf.push(flags);
 
-        if has_timestamps
-            && let Some((at, mt, ct, bt)) = timestamps {
-                buf.extend_from_slice(&at.to_le_bytes());
-                buf.extend_from_slice(&mt.to_le_bytes());
-                buf.extend_from_slice(&ct.to_le_bytes());
-                buf.extend_from_slice(&bt.to_le_bytes());
-            }
+        if has_timestamps && let Some((at, mt, ct, bt)) = timestamps {
+            buf.extend_from_slice(&at.to_le_bytes());
+            buf.extend_from_slice(&mt.to_le_bytes());
+            buf.extend_from_slice(&ct.to_le_bytes());
+            buf.extend_from_slice(&bt.to_le_bytes());
+        }
 
         if flags & 0x10 != 0 {
             buf.extend_from_slice(&8u16.to_le_bytes()); // max_compact

crates/clawhdf5-format/src/profiling.rs

@@ -4,7 +4,7 @@
 //! events. The [`DefaultProfiler`] implementation uses atomic counters for
 //! thread-safe, low-overhead profiling.
 
-use core::sync::atomic::{AtomicU64, Ordering};
+use portable_atomic::{AtomicU64, Ordering};
 
 /// Trait for profiling I/O operations.
 ///

crates/clawhdf5-format/src/selection.rs

@@ -587,7 +587,7 @@ mod tests {
         // start=0 stride=1 count=1 block=4, version 3, enc_size 2, rank 1.
         let bytes = [
             0x02, 0, 0, 0, // type = HYPER
-            0x03, 0, 0, 0, // version 3
+            0x03, 0, 0, 0,    // version 3
             0x01, // flags = regular
             0x02, // enc_size = 2
             0x01, 0, 0, 0, // rank = 1

crates/clawhdf5-format/tests/derive_tests.rs

@@ -321,9 +321,9 @@ fn roundtrip_through_file_writer() {
                 && let clawhdf5_format::link_message::LinkTarget::Hard {
                     object_header_address,
                 } = link.link_target
-                {
-                    ds_addr = Some(object_header_address);
-                }
+            {
+                ds_addr = Some(object_header_address);
+            }
         }
     }
     let ds_addr = ds_addr.expect("compound_ds link not found");

crates/clawhdf5-format/tests/integration_test.rs

@@ -706,7 +706,10 @@ fn scaleoffset_float_escale_reads_as_raw() {
     let (raw, datatype, _) = read_chunked_dataset(file_data, "x");
     let values = read_as_f64(&raw, &datatype).unwrap();
     let expect: Vec<f64> = (0..20).map(|i| i as f64 * 0.25).collect();
-    assert_eq!(values, expect, "E-scale (raw + masked filter) must read verbatim");
+    assert_eq!(
+        values, expect,
+        "E-scale (raw + masked filter) must read verbatim"
+    );
 }
 
 #[test]
@@ -717,26 +720,48 @@ fn v4_virtual_dataset_cycle_errors_not_overflow() {
     let offset = find_signature(file_data).unwrap();
     let sb = Superblock::parse(file_data, offset).unwrap();
     let addr = resolve_path_any(file_data, &sb, "virt").unwrap();
-    let hdr = ObjectHeader::parse(file_data, addr as usize, sb.offset_size, sb.length_size).unwrap();
+    let hdr =
+        ObjectHeader::parse(file_data, addr as usize, sb.offset_size, sb.length_size).unwrap();
     let ds = Dataspace::parse(
-        &hdr.messages.iter().find(|m| m.msg_type == MessageType::Dataspace).unwrap().data,
+        &hdr.messages
+            .iter()
+            .find(|m| m.msg_type == MessageType::Dataspace)
+            .unwrap()
+            .data,
         sb.length_size,
     )
     .unwrap();
     let (dt, _) = Datatype::parse(
-        &hdr.messages.iter().find(|m| m.msg_type == MessageType::Datatype).unwrap().data,
+        &hdr.messages
+            .iter()
+            .find(|m| m.msg_type == MessageType::Datatype)
+            .unwrap()
+            .data,
     )
     .unwrap();
     let layout = DataLayout::parse(
-        &hdr.messages.iter().find(|m| m.msg_type == MessageType::DataLayout).unwrap().data,
+        &hdr.messages
+            .iter()
+            .find(|m| m.msg_type == MessageType::DataLayout)
+            .unwrap()
+            .data,
         sb.offset_size,
         sb.length_size,
     )
     .unwrap();
     let r = read_raw_data_full(
-        file_data, &layout, &ds, &dt, None, sb.offset_size, sb.length_size,
+        file_data,
+        &layout,
+        &ds,
+        &dt,
+        None,
+        sb.offset_size,
+        sb.length_size,
+    );
+    assert!(
+        r.is_err(),
+        "cyclic virtual dataset must error, not overflow"
     );
-    assert!(r.is_err(), "cyclic virtual dataset must error, not overflow");
 }
 
 #[test]
@@ -751,16 +776,28 @@ fn v4_virtual_dataset_external_file_read() {
     let addr = resolve_path_any(virt, &sb, "virt").unwrap();
     let hdr = ObjectHeader::parse(virt, addr as usize, sb.offset_size, sb.length_size).unwrap();
     let ds = Dataspace::parse(
-        &hdr.messages.iter().find(|m| m.msg_type == MessageType::Dataspace).unwrap().data,
+        &hdr.messages
+            .iter()
+            .find(|m| m.msg_type == MessageType::Dataspace)
+            .unwrap()
+            .data,
         sb.length_size,
     )
     .unwrap();
     let (dt, _) = Datatype::parse(
-        &hdr.messages.iter().find(|m| m.msg_type == MessageType::Datatype).unwrap().data,
+        &hdr.messages
+            .iter()
+            .find(|m| m.msg_type == MessageType::Datatype)
+            .unwrap()
+            .data,
     )
     .unwrap();
     let layout = DataLayout::parse(
-        &hdr.messages.iter().find(|m| m.msg_type == MessageType::DataLayout).unwrap().data,
+        &hdr.messages
+            .iter()
+            .find(|m| m.msg_type == MessageType::DataLayout)
+            .unwrap()
+            .data,
         sb.offset_size,
         sb.length_size,
     )
@@ -790,7 +827,14 @@ fn v4_virtual_dataset_external_file_read() {
 
     // With no resolver, an external source is a clean error (not wrong data).
     let no_resolver = read_raw_data_full_with_resolver(
-        virt, &layout, &ds, &dt, None, sb.offset_size, sb.length_size, None,
+        virt,
+        &layout,
+        &ds,
+        &dt,
+        None,
+        sb.offset_size,
+        sb.length_size,
+        None,
     );
     assert!(no_resolver.is_err());
 }
@@ -805,9 +849,18 @@ fn v4_paged_fixed_array_read() {
     let values = read_as_i32(&raw, &datatype).unwrap();
     assert_eq!(values.len(), 1025 * 16);
     for k in 0..1025usize {
-        assert_eq!(values[k * 16], k as i32, "chunk-start mismatch at chunk {k}");
+        assert_eq!(
+            values[k * 16],
+            k as i32,
+            "chunk-start mismatch at chunk {k}"
+        );
         for j in 1..16 {
-            assert_eq!(values[k * 16 + j], 0, "non-start element nonzero at {}", k * 16 + j);
+            assert_eq!(
+                values[k * 16 + j],
+                0,
+                "non-start element nonzero at {}",
+                k * 16 + j
+            );
         }
     }
 }

crates/clawhdf5-format/tests/reference_tests.rs

@@ -214,9 +214,9 @@ print('ok')
                 && let clawhdf5_format::link_message::LinkTarget::Hard {
                     object_header_address,
                 } = link.link_target
-                {
-                    refs_addr = Some(object_header_address);
-                }
+            {
+                refs_addr = Some(object_header_address);
+            }
         }
     }
 

crates/clawhdf5-migrate/src/main.rs

@@ -309,7 +309,8 @@ mod tests {
         insert_relation(&conn, 1, 1, "self");
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         let opts = hdf5_writer::WriteOptions {
             agent_id: "test-agent".into(),
             embedder: "test-embed".into(),
@@ -319,7 +320,8 @@ mod tests {
         };
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
-        let summary = validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
+        let summary =
+            validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
         assert_eq!(summary.chunks, 2);
         assert_eq!(summary.sessions, 1);
         assert_eq!(summary.entities, 1);
@@ -340,7 +342,8 @@ mod tests {
         insert_chunk(&conn, 3, "also active", &make_embedding(4, 3.0), 0);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, true, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, true, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.chunks.len(), 2);
 
         let opts = hdf5_writer::WriteOptions {
@@ -352,7 +355,8 @@ mod tests {
         };
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
-        let summary = validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
+        let summary =
+            validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
         assert_eq!(summary.chunks, 2);
     }
 
@@ -367,7 +371,8 @@ mod tests {
         insert_chunk(&conn, 2, "deleted", &make_embedding(4, 2.0), 1);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.chunks.len(), 2);
     }
 
@@ -381,7 +386,8 @@ mod tests {
         insert_chunk(&conn, 1, "test", &make_embedding(16, 0.5), 0);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.embedding_dim, 16);
     }
 
@@ -395,7 +401,8 @@ mod tests {
         insert_chunk(&conn, 1, "test", &make_embedding(16, 0.5), 0);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, Some(8), &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, Some(8), &SchemaConfig::default()).unwrap();
         assert_eq!(data.embedding_dim, 8);
         // Embedding truncated to dim 8
         assert_eq!(data.chunks[0].embedding.len(), 8);
@@ -413,7 +420,8 @@ mod tests {
         insert_chunk(&conn, 1, "test", &emb, 0);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         let opts = hdf5_writer::WriteOptions {
             agent_id: "t".into(),
             embedder: "t".into(),
@@ -424,7 +432,8 @@ mod tests {
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
         // Content-validate with the float16 tolerance enabled.
-        let summary = validate::validate_hdf5(h5_path.to_str().unwrap(), &data, true, true).unwrap();
+        let summary =
+            validate::validate_hdf5(h5_path.to_str().unwrap(), &data, true, true).unwrap();
         assert_eq!(summary.chunks, 1);
 
         // Verify float16 values are within tolerance
@@ -453,7 +462,8 @@ mod tests {
         }
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
 
         let opts_compressed = hdf5_writer::WriteOptions {
             agent_id: "t".into(),
@@ -493,7 +503,8 @@ mod tests {
         drop(conn);
 
         // Simulate dry-run: read data but don't write
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.chunks.len(), 1);
         assert!(!h5_path.exists());
     }
@@ -505,7 +516,8 @@ mod tests {
         let db_path = create_test_db(&dir);
         let h5_path = dir.path().join("out.h5");
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.chunks.len(), 0);
         assert_eq!(data.sessions.len(), 0);
         assert_eq!(data.entities.len(), 0);
@@ -520,7 +532,8 @@ mod tests {
         };
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
-        let summary = validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
+        let summary =
+            validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
         assert_eq!(summary.chunks, 0);
     }
 
@@ -543,7 +556,8 @@ mod tests {
         }
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.chunks.len(), 1000);
 
         let opts = hdf5_writer::WriteOptions {
@@ -573,7 +587,8 @@ mod tests {
         insert_session(&conn, "session-gamma", 21, 30);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.sessions.len(), 3);
 
         let opts = hdf5_writer::WriteOptions {
@@ -585,7 +600,8 @@ mod tests {
         };
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
-        let summary = validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
+        let summary =
+            validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
         assert_eq!(summary.sessions, 3);
     }
 
@@ -605,7 +621,8 @@ mod tests {
         insert_relation(&conn, 2, 3, "uses");
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.entities.len(), 3);
         assert_eq!(data.relations.len(), 3);
 
@@ -618,7 +635,8 @@ mod tests {
         };
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
-        let summary = validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
+        let summary =
+            validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
         assert_eq!(summary.entities, 3);
         assert_eq!(summary.relations, 3);
     }
@@ -634,7 +652,8 @@ mod tests {
         insert_chunk(&conn, 1, "test", &make_embedding(4, 1.0), 0);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         let opts = hdf5_writer::WriteOptions {
             agent_id: "t".into(),
             embedder: "t".into(),
@@ -645,8 +664,8 @@ mod tests {
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
         // Validating against a source with an extra (unwritten) chunk must fail.
-        let mut bigger = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default())
-            .unwrap();
+        let mut bigger =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         let mut extra = bigger.chunks[0].clone();
         extra.id = 999;
         bigger.chunks.push(extra);
@@ -666,7 +685,8 @@ mod tests {
         insert_chunk(&conn, 1, "test", &make_embedding(8, 1.0), 0);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         let opts = hdf5_writer::WriteOptions {
             agent_id: "my-agent-42".into(),
             embedder: "openai-ada".into(),
@@ -712,7 +732,8 @@ mod tests {
         insert_chunk(&conn, 1, "test", &emb, 0);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         let opts = hdf5_writer::WriteOptions {
             agent_id: "t".into(),
             embedder: "t".into(),
@@ -758,7 +779,8 @@ mod tests {
         drop(conn);
 
         // Skip deleted
-        let data = sqlite_reader::read_sqlite(&db_path, true, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, true, None, &SchemaConfig::default()).unwrap();
         assert_eq!(data.chunks.len(), 4); // chunk 3 is deleted
 
         let opts = hdf5_writer::WriteOptions {
@@ -770,7 +792,8 @@ mod tests {
         };
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
-        let summary = validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
+        let summary =
+            validate::validate_hdf5(h5_path.to_str().unwrap(), &data, false, false).unwrap();
         assert_eq!(summary.chunks, 4);
         assert_eq!(summary.sessions, 2);
         assert_eq!(summary.entities, 2);
@@ -789,7 +812,8 @@ mod tests {
         insert_session(&conn, "s1", 0, 10);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         let opts = hdf5_writer::WriteOptions {
             agent_id: "t".into(),
             embedder: "t".into(),
@@ -800,8 +824,8 @@ mod tests {
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
         // Validating against a source whose session content differs must fail.
-        let mut tampered = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default())
-            .unwrap();
+        let mut tampered =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         tampered.sessions[0].summary = "DIFFERENT".into();
         let result = validate::validate_hdf5(h5_path.to_str().unwrap(), &tampered, false, false);
         assert!(result.is_err());
@@ -819,7 +843,8 @@ mod tests {
         insert_chunk(&conn, 1, "hello", &make_embedding(8, 1.0), 0);
         drop(conn);
 
-        let data = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
+        let data =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         let opts = hdf5_writer::WriteOptions {
             agent_id: "t".into(),
             embedder: "t".into(),
@@ -830,8 +855,8 @@ mod tests {
         hdf5_writer::write_hdf5(h5_path.to_str().unwrap(), &data, &opts).unwrap();
 
         // A source whose embedding differs (but counts match) must fail validation.
-        let mut tampered = sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default())
-            .unwrap();
+        let mut tampered =
+            sqlite_reader::read_sqlite(&db_path, false, None, &SchemaConfig::default()).unwrap();
         tampered.chunks[0].embedding[3] += 9.0;
         let result = validate::validate_hdf5(h5_path.to_str().unwrap(), &tampered, true, false);
         assert!(result.is_err());
@@ -856,7 +881,10 @@ mod tests {
             CREATE TABLE relations (src INTEGER, tgt INTEGER, relation TEXT, weight REAL, timestamp REAL);",
         )
         .unwrap();
-        let blob: Vec<u8> = make_embedding(4, 1.0).iter().flat_map(|v| v.to_le_bytes()).collect();
+        let blob: Vec<u8> = make_embedding(4, 1.0)
+            .iter()
+            .flat_map(|v| v.to_le_bytes())
+            .collect();
         conn.execute(
             "INSERT INTO my_chunks VALUES (1, 'hi', ?1, 'api', 1.0, 's', '', 0)",
             rusqlite::params![blob],
@@ -908,7 +936,8 @@ mod tests {
         let base = hdf5_reader::read_hdf5(h5_path.to_str().unwrap()).unwrap();
         let max_id = base.chunks.iter().map(|c| c.id).max().unwrap_or(0);
         assert_eq!(max_id, 2);
-        let new = sqlite_reader::read_sqlite_filtered(&db_path, false, Some(4), &cfg, max_id).unwrap();
+        let new =
+            sqlite_reader::read_sqlite_filtered(&db_path, false, Some(4), &cfg, max_id).unwrap();
         assert_eq!(new.chunks.len(), 2); // only id 3 and 4
 
         let mut merged = base;

crates/clawhdf5-migrate/src/sqlite_reader.rs

@@ -91,7 +91,14 @@ impl Default for SchemaConfig {
             },
             sessions: TableSchema {
                 table: "sessions".into(),
-                columns: vec!["id", "start_idx", "end_idx", "channel", "timestamp", "summary"],
+                columns: vec![
+                    "id",
+                    "start_idx",
+                    "end_idx",
+                    "channel",
+                    "timestamp",
+                    "summary",
+                ],
             },
             entities: TableSchema {
                 table: "entities".into(),

crates/clawhdf5-migrate/src/validate.rs

@@ -77,10 +77,9 @@ pub fn validate_hdf5(
         }
         for (k, (&a, &b)) in s.embedding.iter().zip(g.embedding.iter()).enumerate() {
             if (a - b).abs() > emb_abs + emb_rel * a.abs() {
-                return Err(format!(
-                    "chunk[{i}].embedding[{k}] mismatch: source {a}, HDF5 {b}"
-                )
-                .into());
+                return Err(
+                    format!("chunk[{i}].embedding[{k}] mismatch: source {a}, HDF5 {b}").into(),
+                );
             }
         }
         rows_checked += 1;
@@ -108,7 +107,12 @@ pub fn validate_hdf5(
         }
         rows_checked += 1;
     }
-    for (i, (s, g)) in source.relations.iter().zip(got.relations.iter()).enumerate() {
+    for (i, (s, g)) in source
+        .relations
+        .iter()
+        .zip(got.relations.iter())
+        .enumerate()
+    {
         if s.src != g.src || s.tgt != g.tgt || s.relation != g.relation {
             return Err(format!("relation[{i}] mismatch").into());
         }

crates/clawhdf5/src/lib.rs

@@ -494,7 +494,9 @@ mod tests {
         let file = File::open(&path).unwrap();
         let ds = file.dataset("data").unwrap();
 
-        if let Ok(slice) = ds.read_f32_zerocopy() { assert_eq!(slice, &original[..]) }
+        if let Ok(slice) = ds.read_f32_zerocopy() {
+            assert_eq!(slice, &original[..])
+        }
         assert_eq!(ds.read_f32().unwrap(), original);
 
         std::fs::remove_file(&path).ok();

crates/clawhdf5/tests/integration_tests.rs

@@ -715,7 +715,9 @@ fn multiple_chunked_datasets_share_file_cache() {
     use clawhdf5_format::datatype::{CharacterSet, Datatype, StringPadding};
 
     // 1-D chunked + compressed fixed-length strings (payload > compress threshold).
-    let strings: Vec<String> = (0..64).map(|i| format!("entry-{i:06}-{}", "x".repeat(80))).collect();
+    let strings: Vec<String> = (0..64)
+        .map(|i| format!("entry-{i:06}-{}", "x".repeat(80)))
+        .collect();
     let max_len = strings.iter().map(|s| s.len()).max().unwrap();
     let mut sraw = Vec::new();
     for s in &strings {
@@ -743,7 +745,9 @@ fn multiple_chunked_datasets_share_file_cache() {
     {
         let ds = b.create_dataset("mat");
         ds.with_f32_data(&mat).with_shape(&[n as u64, d as u64]);
-        ds.with_chunks(&[10, d as u64]).with_shuffle().with_deflate(6);
+        ds.with_chunks(&[10, d as u64])
+            .with_shuffle()
+            .with_deflate(6);
     }
     let bytes = b.finish().unwrap();
     let file = File::from_bytes(bytes).unwrap();
@@ -755,7 +759,10 @@ fn multiple_chunked_datasets_share_file_cache() {
     let got_mat = file.dataset("mat").unwrap().read_f32().unwrap();
     assert_eq!(got_mat, mat);
     // Read the 1-D one again to confirm the cache rebinds back correctly.
-    assert_eq!(file.dataset("strs").unwrap().read_string().unwrap(), strings);
+    assert_eq!(
+        file.dataset("strs").unwrap().read_string().unwrap(),
+        strings
+    );
 }
 
 #[test]
@@ -850,8 +857,14 @@ fn dense_group_links_roundtrip() {
         );
     }
     // The small (compact) group still works.
-    assert_eq!(file.dataset("small/a").unwrap().read_f64().unwrap(), vec![1.0]);
-    assert_eq!(file.dataset("small/b").unwrap().read_f64().unwrap(), vec![2.0]);
+    assert_eq!(
+        file.dataset("small/a").unwrap().read_f64().unwrap(),
+        vec![1.0]
+    );
+    assert_eq!(
+        file.dataset("small/b").unwrap().read_f64().unwrap(),
+        vec![2.0]
+    );
 }
 
 #[test]
@@ -908,7 +921,10 @@ fn dense_links_multiblock_fractal_heap_roundtrip() {
     b.add_group(g.finish());
     let file = File::from_bytes(b.finish().unwrap()).unwrap();
 
-    assert_eq!(file.group("big").unwrap().datasets().unwrap().len(), n as usize);
+    assert_eq!(
+        file.group("big").unwrap().datasets().unwrap().len(),
+        n as usize
+    );
     for i in [0, 1, 1234, n - 1] {
         assert_eq!(
             file.dataset(&format!("big/dataset_number_{i:05}"))

scripts/check-nostd.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# CI check: verify rustyhdf5-format compiles under no_std (thumbv7em-none-eabihf).
+# CI check: verify clawhdf5-format compiles under no_std (thumbv7em-none-eabihf).
 #
 # Usage:
 #   ./scripts/check-nostd.sh
@@ -11,7 +11,7 @@ set -euo pipefail
 
 TARGET="thumbv7em-none-eabihf"
 
-echo "==> Checking no_std build for rustyhdf5-format (target: $TARGET)"
+echo "==> Checking no_std build for clawhdf5-format (target: $TARGET)"
 
 # Ensure the target is installed
 if ! rustup target list --installed | grep -q "$TARGET"; then
@@ -20,13 +20,13 @@ if ! rustup target list --installed | grep -q "$TARGET"; then
 fi
 
 # Build with no default features (no std, no flate2, no sha2)
-cargo build --target "$TARGET" -p rustyhdf5-format --no-default-features
+cargo build --target "$TARGET" -p clawhdf5-format --no-default-features
 
 echo "==> no_std build succeeded"
 
 # Also verify the default-features (std) build still works
 echo "==> Checking default-features build"
-cargo build -p rustyhdf5-format
+cargo build -p clawhdf5-format
 echo "==> default-features build succeeded"
 
 echo "==> All no_std checks passed"

scripts/ci-test.sh

@@ -34,16 +34,16 @@ run_step() {
 # 1. Format check
 run_step "cargo fmt --check" cargo fmt --check
 
-# 2. Clippy (exclude rustyhdf5-py which needs PyO3/Python)
+# 2. Clippy (exclude clawhdf5-py which needs PyO3/Python)
 run_step "cargo clippy" cargo clippy \
     --workspace \
-    --exclude rustyhdf5-py \
+    --exclude clawhdf5-py \
     -- -D warnings
 
-# 3. Tests (exclude rustyhdf5-py)
+# 3. Tests (exclude clawhdf5-py)
 run_step "cargo test" cargo test \
     --workspace \
-    --exclude rustyhdf5-py
+    --exclude clawhdf5-py
 
 # 4. no_std check
 run_step "check-nostd.sh" "$SCRIPT_DIR/check-nostd.sh"