Function loadHnswFromDisk

Load a persisted HNSW graph through the legacy two-argument compatibility route. Without trusted runtime shape authority this route deliberately returns null so the caller rebuilds instead of trusting sidecar metadata.

v2.16.0 — load a previously-persisted HNSW index from disk. Returns null (with a stderr warning) if: • The meta pointer or its immutable generation is missing • The compact meta pointer exceeds the bounded 64 KiB read cap • A legacy format-1/format-2/format-3 pointer requires a fail-soft rebuild • The generation digest or pre/post-load generation receipt differs • The pointer's EmbedDb instance UUID or mutation epoch differs • The meta's signature doesn't match the caller's current signature • The meta's formatVersion doesn't match • Trusted runtime shape options are absent (the legacy two-argument call remains source-compatible but intentionally returns null in v4) • Trusted DB-canonical vectors are absent (the former row-only options shape remains source-compatible but intentionally returns null) • The meta's dim/size are outside the bounded native uint32 contract • A supplied trusted dimension or active-row count differs from metadata • The stable 64-bit little-endian hnswlib-v3 header/records are malformed • The native count/capacity disagree with the preflighted binary header • The immutable binary exceeds the 1 GiB persistence fast-path cap • Native + DB-vector/metadata authority exceeds the combined 1 GiB working-set cap • The caller's trusted live-row/vector maps are malformed or differ from the graph • The native lib fails to load the .bin (corrupt / dim mismatch)

On success returns { index, rowsByLabel }, where rowsByLabel is a validated detached projection of the caller's DB-owned manifest rather than content recovered from the sidecar. The actual boot-time win depends on index size and storage.