fix(qwp): read the SF recovery scan via pread instead of the mapping

Recovery-time reads of a segment file go through pread into a private
buffer: the header block, the frame scan, the CRC fold, and the
torn-tail probe. Unreadable regions are then ordinary read results
with one deterministic outcome per input on every filesystem, JDK,
and JIT state: a sparse hole reads back as zeros and fails the frame
CRC, a region past real end-of-file gives a short read, and a media
error gives a failed read -- each is the boundary of recoverable
data. The mapping is created only after the scan, for the append
path, whose writes materialize pages rather than faulting.

Reading the same regions through the mapping raises SIGBUS, which
HotSpot converts to an InternalError delivered at an imprecise point
under a JIT-compiled caller -- not reliably catchable by any
try/catch placement, which is the MmapSegmentRecoveryFaultTest flake
on the JDK 8 CI (#69). With no fault to catch, the
catchable-InternalError machinery (isMmapAccessFault, the table-CRC
fallback, the per-method catch arms) is gone, and the frame CRC uses
the native Crc32c again -- safe on a process-private buffer.

The scan is one pass through a sliding 1 MiB pread window (header
fields, lastGood, frame count, torn-tail probe together); frames
larger than the window CRC-fold across refills. The recovery tests
become single-outcome and gain a bad-sector case via the facade's
read seam (renamed MmapSegmentRecoveryBoundaryTest -- there is no
fault delivery left to branch on).

Fixes #69.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mtopolnik

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/MmapSegment.java

@@ -197,7 +197,7 @@ public static SegmentRing openExisting(String sfDir, long maxBytesPerSegment) {
                             // CAUTION: only unlink when the file is genuinely
                             // empty past the header. If frame[0] failed CRC
                             // (bit-rot, partial-page-write at crash, etc.) but
-                            // valid frames followed, scanFrames returns
+                            // valid frames followed, the recovery scan returns
                             // lastGood=HEADER_SIZE and frameCount=0 -- yet
                             // tornTailBytes is non-zero. Treating that as
                             // "empty hot-spare" would silently destroy every
@@ -269,8 +269,9 @@ public static SegmentRing openExisting(String sfDir, long maxBytesPerSegment) {
             // FSNs after recovery. A gap means a segment went missing (a
             // manual deletion) or a sealed segment under-recovered -- its tail
             // was cut short by a sparse/unbacked page or a mid-file media error
-            // (bad sector), the same class of fault scanFrames tolerates on the
-            // active segment but which corrupts the range on a sealed one.
+            // (bad sector), the same unreadable-region boundary the recovery
+            // scan tolerates on the active segment but which corrupts the
+            // range on a sealed one.
             for (int i = 1, n = opened.size(); i < n; i++) {
                 MmapSegment prev = opened.get(i - 1);
                 MmapSegment curr = opened.get(i);

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/SegmentRing.java

@@ -91,15 +91,13 @@ public interface FilesFacade {
      * Stat length of the file at {@code path}, in bytes. Default delegates to
      * {@link Files#length(String)}.
      *
-     * <p>Test injection point: {@code MmapSegment.openExisting} maps the file to
-     * this length and scans straight out of the mapping, so a wrapping facade
-     * that returns a value <em>larger</em> than the real file makes the mapping
-     * extend past end-of-file. A read of a page beyond real EOF raises SIGBUS on
-     * <em>every</em> filesystem (which HotSpot translates to a catchable
-     * {@code InternalError} at an {@code Unsafe} intrinsic site) — the same fault
-     * a genuinely unbacked/sparse page raises on ZFS, but reproduced
-     * deterministically on ext4/xfs too. That is what lets recovery's mmap-fault
-     * guard be regression-tested on any CI runner rather than only on ZFS.
+     * <p>Test injection point: {@code MmapSegment.openExisting} treats this
+     * length as the file's extent and preads its recovery scan against it, so a
+     * wrapping facade that returns a value <em>larger</em> than the real file
+     * makes the scan read past end-of-file. Those reads come back short, which
+     * recovery must treat as the boundary of recoverable data — the same
+     * outcome as a file whose size metadata survived a crash its data blocks
+     * did not, reproduced deterministically on any filesystem and CI runner.
      */
     long length(String path);