[leerho]

This hardens the checks of HLL coupon hash set (SET mode) images, in line with apache/datasketches-cpp#565. It also documents the key hash of the Array of Strings tuple sketch.

HLL SET image checks

HllUtil.checkPreamble(), which heapify, wrap, writableWrap and HllUnion.heapify all call, now also checks a SET image against the limits a valid sketch keeps:

• Set mode requires lgK ≥ 8.
• A compact image holds at most 3/4 · 2^(lgK−3) coupons, and the segment is large enough for them.
• In an updatable image:
  • lgArr (after the existing recompute for early images) is in [LG_INIT_SET_SIZE, lgK−3];
  • the table is at most 3/4 full;
  • the segment is large enough for the table;
  • the coupon count equals the number of non-empty slots.

Valid writers never produce images outside these limits. The sanity checks inside DirectCouponList's promotions skip them, because there the sketch's own list or set is one coupon past its limit for a moment.

Util.stringArrHash javadoc

This is the key hash of the Array of Strings tuple sketch, so other languages need its exact definition:

• elements are joined with "," without escaping;
• a null element contributes "null";
• the joined string is hashed as UTF-16LE code units, with no byte-order mark;
• the hash is XXH64 with seed 0x7A3CCA71.

Tests

• HllCorruptImageTest gets six new tests: compact count above the limit, a truncated compact image, updatable lgArr out of range, count not matching the table, an overfull table, and set mode with lgK 7. Each one fails if the new check is removed.
• A sweep over valid SET images for lgK 8–14, from both heap and direct sketches, checks that they still load on every path.
• StringArrHashTest checks stringArrHash against the documented definition.

The full suite passes (2,394 tests), and so do the C++, Go and Rust HLL deserialization checks against the local CL files.

🤖 Generated with Claude Code