pigeonhole-db 1.1.0

data/vendor/format/src/feed.rs

@@ -0,0 +1,285 @@
+//! The change feed's sidecar, `<db>-feed` (D310, FORMAT §10.4).
+//!
+//! An append-only log of the sessions that wrote the database while a change feed may have
+//! history in its WAL. It is not part of the main file: builds that do not know the change
+//! feed never open it. Each writable open of a build that knows it appends one entry: a
+//! [`FeedEntry::Session`] when the open feeds tables, or a [`FeedEntry::Unfed`] when it
+//! does not and the sidecar already exists. A feeding session then appends a
+//! [`FeedEntry::Root`] after each root commit it makes, so a later feeding session can tell
+//! whether any other session, of any build, committed a root in between: the superblock's
+//! `sequence` at its open is then ahead of the last one recorded.
+//!
+//! The file is a 40-byte header, then entries, each `len` u32, `crc` u32 (CRC32C of the
+//! payload), then `len` payload bytes whose first byte is the entry type. A crash can tear
+//! the last entry: [`decode_entries`] stops at the first entry whose length or checksum
+//! fails and reports where the valid entries end, and a writer truncates the file there
+//! before appending.
+//!
+//! ```
+//! use pigeonhole_format::feed::{FeedEntry, FeedHeader, FeedTables, decode_entries};
+//!
+//! let mut file = FeedHeader { db_id: [7; 16] }.encode().to_vec();
+//! let entries = [
+//!     FeedEntry::Session {
+//!         session: 0xfeed,
+//!         opened_at: 4,
+//!         retention_bytes: 1 << 30,
+//!         retention_age_secs: 0,
+//!         streams: 4,
+//!         tables: FeedTables::All,
+//!     },
+//!     FeedEntry::Root { session: 0xfeed, sequence: 5 },
+//!     FeedEntry::Unfed { sequence: 7 },
+//! ];
+//! for e in &entries {
+//!     e.encode(&mut file);
+//! }
+//! file.extend_from_slice(&[3, 0]); // a torn append
+//!
+//! let header = FeedHeader::decode(&file).unwrap();
+//! assert_eq!(header.db_id, [7; 16]);
+//! let (decoded, end) = decode_entries(&file[FeedHeader::LEN..]);
+//! assert_eq!(decoded, entries);
+//! assert_eq!(FeedHeader::LEN + end, file.len() - 2);
+//! ```
+
+use crate::bytes::{Reader, le_u32};
+use crate::{Error, TableId};
+
+/// The sidecar's magic.
+pub const FEED_MAGIC: [u8; 8] = *b"PHDBFEED";
+
+/// The sidecar layout this build writes and reads.
+pub const FEED_VERSION: u32 = 1;
+
+/// The sidecar's path suffix: the sidecar of `data.phdb` is `data.phdb-feed`.
+pub const FEED_SUFFIX: &str = "-feed";
+
+const WHAT: &str = "feed sidecar";
+
+/// The sidecar's header (40 bytes): magic, version, reserved, the database id, reserved, and
+/// a CRC32C of bytes 0..36.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FeedHeader {
+    /// The database id from the superblock: a sidecar of another database is refused.
+    pub db_id: [u8; 16],
+}
+
+impl FeedHeader {
+    /// Length of the encoded header.
+    pub const LEN: usize = 40;
+
+    /// Encodes the header.
+    pub fn encode(&self) -> [u8; Self::LEN] {
+        let mut b = [0u8; Self::LEN];
+        b[0..8].copy_from_slice(&FEED_MAGIC);
+        b[8..12].copy_from_slice(&FEED_VERSION.to_le_bytes());
+        b[16..32].copy_from_slice(&self.db_id);
+        let crc = crate::checksum::crc32c(&b[..36]);
+        b[36..40].copy_from_slice(&crc.to_le_bytes());
+        b
+    }
+
+    /// Decodes and verifies magic, CRC and version.
+    pub fn decode(bytes: &[u8]) -> crate::Result<Self> {
+        let Some(b) = bytes.get(..Self::LEN) else {
+            return Err(Error::Truncated { what: WHAT });
+        };
+        if b[..8] != FEED_MAGIC {
+            return Err(Error::BadMagic { what: WHAT });
+        }
+        if crate::checksum::crc32c(&b[..36]) != le_u32(b, 36) {
+            return Err(Error::Checksum { what: WHAT });
+        }
+        let version = le_u32(b, 8);
+        if version != FEED_VERSION {
+            return Err(Error::UnsupportedVersion {
+                what: WHAT,
+                found: version,
+            });
+        }
+        Ok(Self {
+            db_id: b[16..32].try_into().expect("16 bytes"),
+        })
+    }
+}
+
+/// Which tables a session feeds.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum FeedTables {
+    /// Every table, including those created during the session.
+    All,
+    /// Only these tables.
+    Only(Vec<TableId>),
+}
+
+impl FeedTables {
+    /// Whether `table` is fed.
+    pub fn contains(&self, table: TableId) -> bool {
+        match self {
+            FeedTables::All => true,
+            FeedTables::Only(t) => t.contains(&table),
+        }
+    }
+}
+
+/// One sidecar entry. Numbers (the type byte) are frozen.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum FeedEntry {
+    /// Type 1: a feeding session's open, written and synced before the session writes any
+    /// WAL segment (each of which carries `session` in its header, FORMAT §10.2).
+    Session {
+        /// The session's random id, nonzero.
+        session: u64,
+        /// The superblock's `sequence` when the open read it, before any root commit of its
+        /// own.
+        opened_at: u64,
+        /// The session's feed retention in bytes, for the whole database.
+        retention_bytes: u64,
+        /// Its retention age in seconds, 0 for none.
+        retention_age_secs: u64,
+        /// The session's WAL streams (its shard count): a reader's history never spans
+        /// sessions with different counts.
+        streams: u32,
+        /// The tables it feeds.
+        tables: FeedTables,
+    },
+    /// Type 2: the superblock `sequence` after a root commit of a feeding session.
+    Root {
+        /// The session that committed.
+        session: u64,
+        /// The new root's sequence.
+        sequence: u64,
+    },
+    /// Type 3: an open of a build that knows the feed, with the feed off: the feed's history
+    /// ends here.
+    Unfed {
+        /// The superblock's `sequence` when the open read it.
+        sequence: u64,
+    },
+    /// An entry type this build does not know, written by a newer one (its checksum
+    /// passed). A reader treats it as the end of the history before it.
+    Unknown(u8),
+}
+
+impl FeedEntry {
+    /// Appends the entry, framed (`len`, `crc`, payload), to `out`.
+    pub fn encode(&self, out: &mut Vec<u8>) {
+        let mut p = Vec::with_capacity(48);
+        match self {
+            FeedEntry::Session {
+                session,
+                opened_at,
+                retention_bytes,
+                retention_age_secs,
+                streams,
+                tables,
+            } => {
+                p.push(1);
+                p.extend_from_slice(&session.to_le_bytes());
+                p.extend_from_slice(&opened_at.to_le_bytes());
+                p.extend_from_slice(&retention_bytes.to_le_bytes());
+                p.extend_from_slice(&retention_age_secs.to_le_bytes());
+                p.extend_from_slice(&streams.to_le_bytes());
+                match tables {
+                    FeedTables::All => {
+                        p.push(1);
+                        p.extend_from_slice(&0u32.to_le_bytes());
+                    }
+                    FeedTables::Only(t) => {
+                        p.push(0);
+                        p.extend_from_slice(&(t.len() as u32).to_le_bytes());
+                        for id in t {
+                            p.extend_from_slice(&id.0.to_le_bytes());
+                        }
+                    }
+                }
+            }
+            FeedEntry::Root { session, sequence } => {
+                p.push(2);
+                p.extend_from_slice(&session.to_le_bytes());
+                p.extend_from_slice(&sequence.to_le_bytes());
+            }
+            FeedEntry::Unfed { sequence } => {
+                p.push(3);
+                p.extend_from_slice(&sequence.to_le_bytes());
+            }
+            FeedEntry::Unknown(t) => p.push(*t),
+        }
+        out.extend_from_slice(&(p.len() as u32).to_le_bytes());
+        out.extend_from_slice(&crate::checksum::crc32c(&p).to_le_bytes());
+        out.extend_from_slice(&p);
+    }
+
+    /// Decodes one entry's payload (its checksum already verified).
+    fn decode_payload(p: &[u8]) -> crate::Result<Self> {
+        const WHAT: &str = "feed sidecar entry";
+        let mut r = Reader::new(p, WHAT);
+        let entry = match r.u8()? {
+            1 => {
+                let session = r.u64()?;
+                let opened_at = r.u64()?;
+                let retention_bytes = r.u64()?;
+                let retention_age_secs = r.u64()?;
+                let streams = r.u32()?;
+                let all = r.u8()?;
+                let n = r.u32()? as usize;
+                let tables = match all {
+                    1 if n == 0 => FeedTables::All,
+                    0 => {
+                        if r.remaining() != n * 4 {
+                            return Err(Error::Corrupt { what: WHAT });
+                        }
+                        let mut t = Vec::with_capacity(n);
+                        for _ in 0..n {
+                            t.push(TableId(r.u32()?));
+                        }
+                        FeedTables::Only(t)
+                    }
+                    _ => return Err(Error::Corrupt { what: WHAT }),
+                };
+                FeedEntry::Session {
+                    session,
+                    opened_at,
+                    retention_bytes,
+                    retention_age_secs,
+                    streams,
+                    tables,
+                }
+            }
+            2 => FeedEntry::Root {
+                session: r.u64()?,
+                sequence: r.u64()?,
+            },
+            3 => FeedEntry::Unfed { sequence: r.u64()? },
+            t => return Ok(FeedEntry::Unknown(t)),
+        };
+        if r.remaining() != 0 {
+            return Err(Error::Corrupt { what: WHAT });
+        }
+        Ok(entry)
+    }
+}
+
+/// Decodes the entries after the header, up to the first torn or invalid one. Returns them
+/// and the length of the valid prefix of `bytes` (where a writer truncates before
+/// appending).
+pub fn decode_entries(bytes: &[u8]) -> (Vec<FeedEntry>, usize) {
+    let mut out = Vec::new();
+    let mut pos = 0;
+    while let Some(head) = bytes.get(pos..pos + 8) {
+        let len = le_u32(head, 0) as usize;
+        let Some(payload) = bytes.get(pos + 8..(pos + 8).saturating_add(len)) else {
+            break;
+        };
+        if len == 0 || crate::checksum::crc32c(payload) != le_u32(head, 4) {
+            break;
+        }
+        let Ok(entry) = FeedEntry::decode_payload(payload) else {
+            break;
+        };
+        out.push(entry);
+        pos += 8 + len;
+    }
+    (out, pos)
+}

data/vendor/format/src/filter.rs

@@ -0,0 +1,157 @@
+//! Per-SST filters: a cache-line-blocked bloom filter over row keys and another over
+//! row+qualifier. Pinned in memory while the SST is open. See `FORMAT.md` §6.
+//!
+//! ```
+//! use pigeonhole_format::filter::{Filter, FilterBuilder, row_hash};
+//!
+//! let mut b = FilterBuilder::new(10);
+//! b.add_hash(row_hash(b"alice"));
+//! let mut block = Vec::new();
+//! b.finish(&mut block);
+//! let f = Filter::new(block).unwrap();
+//! assert!(f.may_contain(row_hash(b"alice")));
+//! ```
+//!
+//! The filter block's first byte names the filter kind so a ribbon filter can be added later
+//! without breaking old files.
+
+use std::ops::Deref;
+
+use crate::Error;
+
+/// Filter kinds. Numbers are frozen.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+#[repr(u8)]
+pub enum FilterKind {
+    /// 512-bit blocked bloom filter with double hashing inside one cache line.
+    BlockedBloom = 1,
+}
+
+/// Size of the fixed header of a filter block.
+const HEADER_LEN: usize = 8;
+/// Bits per filter line (one cache line).
+const LINE_BITS: u64 = 512;
+const LINE_BYTES: usize = 64;
+
+/// Hash of a row key for the row filter: xxh3-64 of the escaped row bytes.
+pub fn row_hash(escaped_row: &[u8]) -> u64 {
+    crate::checksum::xxh3_64(escaped_row)
+}
+
+/// Hash of a column for the column filter: xxh3-64 of the column prefix (escaped row,
+/// terminator, escaped qualifier, terminator). For a row's family markers the key is the
+/// marker prefix ([`crate::key::encode_marker_prefix`]); a point get probes both.
+pub fn column_hash(column_prefix: &[u8]) -> u64 {
+    crate::checksum::xxh3_64(column_prefix)
+}
+
+/// The probe sequence of FORMAT §6: the line, then `k` bit positions within it.
+fn probe(hash: u64, num_lines: u32) -> (usize, u32, u32) {
+    let h1 = hash as u32;
+    let h2 = (hash >> 32) as u32;
+    let line = ((u64::from(h2) * u64::from(num_lines)) >> 32) as usize;
+    (line, h1, h1.rotate_right(17))
+}
+
+/// Builds a filter from hashes.
+#[derive(Debug, Default)]
+pub struct FilterBuilder {
+    bits_per_key: u8,
+    hashes: Vec<u64>,
+}
+
+impl FilterBuilder {
+    /// A builder targeting `bits_per_key` bits per distinct key.
+    pub fn new(bits_per_key: u8) -> Self {
+        Self {
+            bits_per_key,
+            hashes: Vec::new(),
+        }
+    }
+
+    /// Adds a key hash. Duplicate consecutive hashes are ignored.
+    pub fn add_hash(&mut self, hash: u64) {
+        if self.hashes.last() != Some(&hash) {
+            self.hashes.push(hash);
+        }
+    }
+
+    /// Appends the logical filter block to `out` and resets the builder.
+    pub fn finish(&mut self, out: &mut Vec<u8>) {
+        let bpk = u64::from(self.bits_per_key);
+        // floor(bpk * 0.69) in integers, so every build computes the same k.
+        let probes = (bpk * 69 / 100).clamp(1, 16) as u32;
+        let bits = self.hashes.len() as u64 * bpk;
+        let num_lines = bits.div_ceil(LINE_BITS).clamp(1, u64::from(u32::MAX)) as u32;
+        out.extend_from_slice(&[FilterKind::BlockedBloom as u8, probes as u8, 0, 0]);
+        out.extend_from_slice(&num_lines.to_le_bytes());
+        let start = out.len();
+        out.resize(start + num_lines as usize * LINE_BYTES, 0);
+        let lines = &mut out[start..];
+        for &h in &self.hashes {
+            let (line, mut x, delta) = probe(h, num_lines);
+            let line = &mut lines[line * LINE_BYTES..(line + 1) * LINE_BYTES];
+            for _ in 0..probes {
+                let bit = (x & 511) as usize;
+                line[bit / 8] |= 1 << (bit % 8);
+                x = x.wrapping_add(delta);
+            }
+        }
+        self.hashes.clear();
+    }
+}
+
+/// A filter over its logical block bytes, held by any byte owner (zero-copy; an SST reader
+/// keeps it pinned beside the rest of its state).
+#[derive(Debug, Clone)]
+pub struct Filter<B> {
+    bytes: B,
+    probes: u32,
+    num_lines: u32,
+}
+
+impl<B: Deref<Target = [u8]>> Filter<B> {
+    /// Parses a logical filter block. Never panics.
+    pub fn new(logical: B) -> crate::Result<Self> {
+        let b: &[u8] = &logical;
+        if b.len() < HEADER_LEN {
+            return Err(Error::Truncated { what: "filter" });
+        }
+        if b[0] != FilterKind::BlockedBloom as u8 {
+            return Err(Error::UnsupportedFeature {
+                what: "filter kind",
+                value: u64::from(b[0]),
+            });
+        }
+        let probes = u32::from(b[1]);
+        let num_lines = crate::bytes::le_u32(b, 4);
+        let expected = (num_lines as usize)
+            .checked_mul(LINE_BYTES)
+            .and_then(|n| n.checked_add(HEADER_LEN));
+        if !(1..=16).contains(&probes) || num_lines == 0 || expected != Some(b.len()) {
+            return Err(Error::Corrupt {
+                what: "filter header",
+            });
+        }
+        Ok(Self {
+            bytes: logical,
+            probes,
+            num_lines,
+        })
+    }
+
+    /// `false` means the key is definitely absent; `true` means it may be present.
+    pub fn may_contain(&self, hash: u64) -> bool {
+        let (line, mut x, delta) = probe(hash, self.num_lines);
+        let start = HEADER_LEN + line * LINE_BYTES;
+        let line = &self.bytes[start..start + LINE_BYTES];
+        for _ in 0..self.probes {
+            let bit = (x & 511) as usize;
+            if line[bit / 8] & (1 << (bit % 8)) == 0 {
+                return false;
+            }
+            x = x.wrapping_add(delta);
+        }
+        true
+    }
+}

data/vendor/format/src/half.rs

@@ -0,0 +1,182 @@
+//! Half-precision vector components (#1263, ICR 0104): IEEE binary16 (`f16`) and bfloat16
+//! (`bf16`), as their raw `u16` bit patterns, little-endian in a vector's payload.
+//!
+//! - **Widening** (`f16_to_f32`, `bf16_to_f32`) is exact and total: every bit pattern widens to
+//!   the `f32` with the same value (an infinity or NaN to an infinity or NaN), without a branch,
+//!   so the distance kernels can widen each lane in their hot loops.
+//! - **Narrowing** (`f32_to_f16`, `f32_to_bf16`) rounds to nearest, ties to even, and refuses a
+//!   value that isn't finite or that rounds past the element's largest finite value.
+//!
+//! ```
+//! use pigeonhole_format::half::{bf16_to_f32, f16_to_f32, f32_to_bf16, f32_to_f16};
+//!
+//! assert_eq!(f32_to_f16(1.5), Some(0x3e00));
+//! assert_eq!(f16_to_f32(0x3e00), 1.5);
+//! assert_eq!(f32_to_f16(65_504.0), Some(0x7bff)); // the largest finite f16
+//! assert_eq!(f32_to_f16(70_000.0), None); // overflows
+//! assert_eq!(f32_to_bf16(1.0), Some(0x3f80));
+//! assert_eq!(bf16_to_f32(0x3f80), 1.0);
+//! ```
+
+/// The `f16` with bits `h`, widened exactly to `f32`: normal and subnormal values, ±0, and
+/// infinities and NaNs (which a write refuses, but corrupt bytes may hold) as infinities and
+/// NaNs. Branch-free: the exponent and mantissa shift into place and the exponent is rebiased,
+/// a subnormal takes one exact float subtraction, and masks choose the result.
+#[inline(always)]
+pub fn f16_to_f32(h: u16) -> f32 {
+    const SHIFTED_EXP: u32 = 0x7c00 << 13;
+    let h = u32::from(h);
+    let sign = (h & 0x8000) << 16;
+    // Exponent and mantissa in an f32's place, the exponent still biased for f16.
+    let x = (h & 0x7fff) << 13;
+    let exp = x & SHIFTED_EXP;
+    // A normal value: rebias the exponent from 15 to 127.
+    let normal = x + ((127 - 15) << 23);
+    // An infinity or NaN: the exponent all ones (rebias again, to 255).
+    let special = normal + ((128 - 16) << 23);
+    // A subnormal (or zero): the mantissa under an exponent of 2^-14, minus 2^-14, which is
+    // exact; the value is mantissa × 2^-24.
+    let sub = (f32::from_bits(x + (113 << 23)) - f32::from_bits(113 << 23)).to_bits();
+    let is_special = 0u32.wrapping_sub(u32::from(exp == SHIFTED_EXP));
+    let is_sub = 0u32.wrapping_sub(u32::from(exp == 0));
+    let is_normal = !(is_special | is_sub);
+    f32::from_bits(sign | (special & is_special) | (sub & is_sub) | (normal & is_normal))
+}
+
+/// The `bf16` with bits `h`, widened exactly to `f32`: its bits in an `f32`'s high half.
+#[inline(always)]
+pub fn bf16_to_f32(h: u16) -> f32 {
+    f32::from_bits(u32::from(h) << 16)
+}
+
+/// `x` rounded to the nearest `f16` (ties to even), or `None` if `x` isn't finite or rounds
+/// past 65,504 (the largest finite `f16`: values from 65,520 up round to infinity).
+pub fn f32_to_f16(x: f32) -> Option<u16> {
+    if !x.is_finite() {
+        return None;
+    }
+    let bits = x.to_bits();
+    let sign = ((bits >> 16) & 0x8000) as u16;
+    let abs = bits & 0x7fff_ffff;
+    // 65,520: the midpoint between 65,504 and 65,536; a tie rounds to even, which is 65,536.
+    if abs >= 0x477f_f000 {
+        return None;
+    }
+    if abs < 0x3880_0000 {
+        // Below 2^-14: an f16 subnormal (or zero), mantissa × 2^-24. Scaling by 2^24 is exact,
+        // and rounding ties to even gives the mantissa (1,024 is the smallest normal's bits).
+        let m = (f32::from_bits(abs) * 16_777_216.0).round_ties_even() as u16;
+        return Some(sign | m);
+    }
+    let exp = (abs >> 23) + 15 - 127;
+    let mant = abs & 0x7f_ffff;
+    let mut h = (exp << 10) | (mant >> 13);
+    let rest = mant & 0x1fff;
+    // Ties to even; a carry out of the mantissa rounds into the exponent, as it should.
+    if rest > 0x1000 || (rest == 0x1000 && h & 1 == 1) {
+        h += 1;
+    }
+    Some(sign | h as u16)
+}
+
+/// `x` rounded to the nearest `bf16` (ties to even), or `None` if `x` isn't finite or rounds
+/// past the largest finite `bf16`.
+pub fn f32_to_bf16(x: f32) -> Option<u16> {
+    if !x.is_finite() {
+        return None;
+    }
+    let bits = x.to_bits();
+    let rounded = bits + 0x7fff + ((bits >> 16) & 1);
+    let h = (rounded >> 16) as u16;
+    // Rounding past the largest finite value reaches the infinity's exponent.
+    if h & 0x7f80 == 0x7f80 {
+        return None;
+    }
+    Some(h)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn same(a: f32, b: f32) -> bool {
+        a.to_bits() == b.to_bits() || (a.is_nan() && b.is_nan())
+    }
+
+    #[test]
+    fn widening_matches_the_half_crate_for_every_pattern() {
+        for h in 0..=u16::MAX {
+            let want = half::f16::from_bits(h).to_f32();
+            assert!(same(f16_to_f32(h), want), "f16 {h:#06x}");
+            let want = half::bf16::from_bits(h).to_f32();
+            assert!(same(bf16_to_f32(h), want), "bf16 {h:#06x}");
+        }
+    }
+
+    #[test]
+    fn narrowing_round_trips_rounds_to_even_and_refuses_overflow() {
+        for h in 0..=u16::MAX {
+            let x = f16_to_f32(h);
+            if x.is_finite() {
+                // Every finite f16 round-trips (−0 included).
+                assert_eq!(f32_to_f16(x), Some(h), "f16 {h:#06x}");
+            } else {
+                assert_eq!(f32_to_f16(x), None, "f16 {h:#06x}");
+            }
+            let y = bf16_to_f32(h);
+            if y.is_finite() {
+                assert_eq!(f32_to_bf16(y), Some(h), "bf16 {h:#06x}");
+            } else {
+                assert_eq!(f32_to_bf16(y), None, "bf16 {h:#06x}");
+            }
+        }
+        // Midpoints between neighbouring f16s land on the even one.
+        for h in 0x0000u16..0x7bff {
+            let (lo, hi) = (f16_to_f32(h), f16_to_f32(h + 1));
+            let mid = ((f64::from(lo) + f64::from(hi)) / 2.0) as f32;
+            if f64::from(mid) == (f64::from(lo) + f64::from(hi)) / 2.0 {
+                let even = if h % 2 == 0 { h } else { h + 1 };
+                assert_eq!(f32_to_f16(mid), Some(even), "midpoint after {h:#06x}");
+            }
+        }
+        // The overflow boundary: below 65,520 rounds to 65,504; 65,520 and up overflow.
+        assert_eq!(f32_to_f16(65_519.996), Some(0x7bff));
+        assert_eq!(f32_to_f16(65_520.0), None);
+        assert_eq!(f32_to_f16(-65_520.0), None);
+        assert_eq!(f32_to_f16(f32::NAN), None);
+        assert_eq!(f32_to_bf16(f32::INFINITY), None);
+        assert_eq!(
+            f32_to_bf16(f32::MAX),
+            None,
+            "rounds up past the largest bf16"
+        );
+        // Tiny values flush to (signed) zero.
+        assert_eq!(f32_to_f16(1e-9), Some(0x0000));
+        assert_eq!(f32_to_f16(-1e-9), Some(0x8000));
+    }
+
+    #[test]
+    fn narrowing_matches_the_half_crate_over_a_seeded_sweep() {
+        let mut s = 0x1263_u64 | 1;
+        for _ in 0..200_000 {
+            s ^= s << 13;
+            s ^= s >> 7;
+            s ^= s << 17;
+            let x = f32::from_bits((s >> 32) as u32);
+            if !x.is_finite() {
+                continue;
+            }
+            let want = half::f16::from_f32(x);
+            let want = want.is_finite().then(|| want.to_bits());
+            assert_eq!(f32_to_f16(x), want, "f16 of {x:e} ({:#010x})", x.to_bits());
+            let want = half::bf16::from_f32(x);
+            let want = want.is_finite().then(|| want.to_bits());
+            assert_eq!(
+                f32_to_bf16(x),
+                want,
+                "bf16 of {x:e} ({:#010x})",
+                x.to_bits()
+            );
+        }
+    }
+}