A count of passing checks is not evidence that software works. It records that one particular set of questions was asked and answered, and says nothing at all about the questions nobody asked. The second set is the one that decides whether you can depend on something, and only the project itself is in a position to describe it. So this page is written as a boundary rather than a claim: what is checked, what is deliberately not checked, and what can honestly be guaranteed as a result. No total number of checks appears below, for the same reason: a total is a fact about scale, and scale is not an argument.

Six areas. Every row describes checks that exist and run today; nothing here is planned or aspirational.

A test that only asks the code whether it agrees with itself will pass while both the writer and the reader of a format share the same misunderstanding. Four places therefore carry an independent reference, and the check is a comparison rather than an assertion.

• The storage engine is run against a plain dictionary model over a long randomised sequence of writes, deletes and reads on a small key space, with the bucket count forced low so that hash collisions are guaranteed rather than hoped for.
• The index is compared with brute-force substring search over a set of the project's own long-form text files, using randomly cut substrings as queries. Both sides must return the same set of documents.
• Nearest-neighbour search is compared with a pure-Python cosine similarity over the same vectors, because an encoder and a search routine written together can share a mistake.
• The record hash is compared with an independent implementation of the published algorithm. A constant that is internally consistent but wrong passes every test that only uses it to look things up.

Every check that measures a property of the file follows the same four steps, in this order.

  1  clean ..... start from an empty path; no leftovers from an earlier run
  2  load ...... n documents and relations, counted, not estimated
  3  confirm ... search for a known document and get it back
  4  measure ... only now read the size, the ratio, the free space

              step 3 is what stops "broken, therefore small"
              from being read as "efficient"

When a check fails because of a known defect that has not been fixed yet, it is left failing. It is not weakened, marked as expected, or deleted, because it is the only machine-readable record that the defect exists. That means a red check in this suite should be read as an open problem with a name, not as a broken test.

The items below are gaps, not omissions from this page. Each one is something a reader might reasonably assume has been covered, and has not been.

Everything below holds on Windows x64 with Python 3.14, which is the only configuration that has been run. Each one corresponds to checks described above.

• A committed write survives termination of the Hadano process while the operating system keeps running, and a partial write does not. Verified by killing a process mid-transaction and reopening the file. This is not a claim about sudden power loss: the operating system may still hold written bytes in its cache, and that case has not been tested.
• An unclean shutdown is reported, not swallowed. Reopening rebuilds what is derived from the documents and reports the count, and leaves the documents and the relation graph as they were.
• Deleting a document deletes everything derived from it — chunks, index entries and edges — in the same transaction. Not guaranteed: that the bytes are gone. Freed space is reused, not overwritten, so the old content can remain in the file until something else takes the space. Disk encryption is the answer to that, not this software.
• The same query against the same database returns the same result, including the same chunk ids and the same ordering.
• A database path containing non-ASCII characters works, and the file exists under the name that was asked for rather than a silently transliterated one.
• The server opens no listening socket, accepts no path argument, and imports no document or image parser. All three are enforced by checks that fail the build. The socket check covers listening sockets: it intercepts bind and reads the process's listening ports. Outbound connections are constrained by the import allowlist rather than by a check of their own, so “makes no outbound connection” is not something this page claims.
• Stored text is never executed by this software. Not guaranteed: that stored text is safe to act on. Results are returned as data with their provenance, and it remains the client's responsibility not to treat retrieved content as instructions.
• Only one process writes at a time. The file is held exclusively while open, and a location on a network share or a cloud-sync folder is refused when it is opened rather than corrupted later — refused by default, and only reachable by passing an explicit override.

Not guaranteed

• Any behaviour on macOS, Linux or ARM.
• Any behaviour on a Python version other than the one everything here was run on.
• Vector search, backup and restore, which are not connected in this build.
• Anything about corpora substantially larger than those measured, or about databases that have been in continuous use for a long time.
• Durability against hardware that loses acknowledged writes.
• Availability or support commitments of any kind. Nothing here is published as a service.

A number without its conditions is not a result, so numbers are published only alongside what produced them: the dataset and its size, the parameters, the platform and the date. Benchmark output carries the environment — language version, engine version, index format, embeddings mode, concurrency mode, platform — in the result file itself, so a figure can always be traced back to the implementation that produced it, and checks enforce the discipline that would otherwise decay: a metric that was not measured is recorded as null with a note rather than as zero, a measured metric must be a positive number, a tail percentile may not fall below the median, and the counts reported for a dataset must be the counts actually loaded. Figures measured on the storage layer that has since been replaced are not reprinted as current, a measurement still running appears as in progress rather than as a provisional number, and a result that rests on one model or one synthetic corpus is published with that limit attached instead of generalised.