Delete dead recovery symbol-walk methods

Production recovery runs one ordered fold (SegmentRing.analyzeRecovery
-> MmapSegment.scanRecovery -> RecoveredFrameAnalysis) and seeds the
producer through CursorSendEngine.addRecoveredSymbolsTo. The older
per-metric walk -- collectReplaySymbolsAbove, maxSymbolDeltaEnd and
maxSymbolDeltaStart on MmapSegment and SegmentRing, plus the
CursorSendEngine.collectReplaySymbolsAbove wrapper -- had no production
caller and diverged from the fold: it lacked the full-dict gap reset,
the unacked-gap distinction and commit-boundary checkpointing, so the
tests routing through it verified an algorithm production never runs.

Delete all seven methods and the now-orphaned
RecoveredFrameAnalysis.appendDecodedSymbols helper, then rewire the two
tests that reached the walk (RecoveredFrameAnalysisTest,
CursorWebSocketSendLoopOrphanTailTest) to the production
addRecoveredSymbolsTo path. That is behavior-preserving -- same
coverage, same decoded symbols -- and stronger, since the tests now
drive the real seeding method. Drop the imports the deletion left
unused.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/CursorSendEngine.java

@@ -25,7 +25,6 @@
 package io.questdb.client.cutlass.qwp.client.sf.cursor;
 
 import io.questdb.client.cutlass.qwp.client.GlobalSymbolDictionary;
-import io.questdb.client.cutlass.qwp.protocol.QwpConstants;
 import io.questdb.client.std.Compat;
 import io.questdb.client.std.Files;
 import io.questdb.client.std.FilesFacade;
@@ -375,14 +374,14 @@ private CursorSendEngine(String sfDir, long segmentSizeBytes, SegmentManager man
                 // .symbol-dict no longer holds, resuming would re-use it. The walk is
                 // bounded to recoveredCommitBoundaryFsn so the aborted orphan-deferred
                 // tail -- retired without ever being transmitted -- does not inflate
-                // this and over-reject an otherwise-recoverable slot. maxSymbolDeltaEnd
+                // this and over-reject an otherwise-recoverable slot. maxDeltaEnd()
                 // returns 0 when no such frame carries a symbol, yielding -1 here.
                 // Computed before the I/O loop or producer append; single-threaded.
                 this.recoveredMaxSymbolId = recoveredFrameAnalysisInProgress.maxDeltaEnd() - 1L;
                 // Full-dict-fallback recovery. When the persisted .symbol-dict is a
                 // SUBSET of the ids the surviving frames reference
                 // (recoveredMaxSymbolId >= its size) YET every such frame is
-                // self-sufficient (maxSymbolDeltaStart == 0 -- a full-dict frame that
+                // self-sufficient (maxDeltaStart() == 0 -- a full-dict frame that
                 // re-registers its dictionary from id 0), the slot was written in
                 // full-dict fallback: the dictionary never opened when writing, so no
                 // side-file exists and this recovery opened a FRESH EMPTY one. Those
@@ -392,7 +391,7 @@ private CursorSendEngine(String sfDir, long segmentSizeBytes, SegmentManager man
                 // was written. Without this the sender's seed-time guard would treat the
                 // empty dictionary as a host-crash tear and brick build(), even though
                 // the orphan drainer drains the same frames fine. A genuine torn DELTA
-                // dictionary keeps a frame with deltaStart > 0 (maxSymbolDeltaStart > 0)
+                // dictionary keeps a frame with deltaStart > 0 (maxDeltaStart() > 0)
                 // and is NOT discarded here: it still fails clean at seed time, since
                 // the ids its delta frames reference cannot be rebuilt without the lost
                 // dictionary. The recoveredMaxSymbolId >= size guard means this never
@@ -741,56 +740,6 @@ public synchronized void close() {
         }
     }
 
-    /**
-     * Rebuilds, from the surviving frames' OWN delta sections, the symbols the upcoming
-     * replay will register ABOVE {@code baseline}, appending them to {@code out} in
-     * ascending id order. Returns the coverage the replay establishes (one past the highest
-     * id it registers), or {@code -1} when the frames have a genuine GAP above the baseline.
-     * <p>
-     * The producer seeds its dictionary from the persisted {@code .symbol-dict} and THEN
-     * from this, so it is fed the same entries, in the same order, that the send loop's
-     * {@code accumulateSentDict} will feed its mirror from as those very frames replay. The
-     * producer's delta baseline and the loop's mirror coverage therefore land on the same
-     * number by construction, which is the invariant the torn-dictionary guard rests on.
-     * <p>
-     * This is what makes a slot whose dictionary was torn -- or lost outright -- still
-     * recoverable when the surviving frames define the ids themselves (they carry the
-     * symbols in their own deltas; it is why the orphan drainer can drain such a slot). Only
-     * a real gap, where the ids were introduced by frames since acked and trimmed away, is
-     * unrecoverable -- and that is precisely when this returns -1.
-     * <p>
-     * Bounded above by {@link #recoveredCommitBoundaryFsn} like {@link #recoveredMaxSymbolId}:
-     * frames past it are the aborted orphan-deferred tail, retired without ever being
-     * transmitted, so their ids never reach a server and must not inflate the baseline.
-     */
-    public long collectReplaySymbolsAbove(int baseline, ObjList<String> out) {
-        if (recoveredFrameAnalysis != null
-                && recoveredFrameAnalysis.baseline() == baseline) {
-            recoveredFrameAnalysis.appendDecodedSymbols(out);
-            return recoveredFrameAnalysis.coverage();
-        }
-        if (ring == null) {
-            return baseline;
-        }
-        return ring.collectReplaySymbolsAbove(
-                QwpConstants.MAGIC_MESSAGE,
-                QwpConstants.HEADER_OFFSET_FLAGS,
-                QwpConstants.FLAG_DELTA_SYMBOL_DICT,
-                QwpConstants.HEADER_SIZE,
-                // Walk from the LOWEST frame still on disk, not from ackedFsn+1. An acked frame
-                // is not trimmed the instant it is acked -- trim drops whole SEALED segments --
-                // so the symbols it registered are usually still sitting right there, and they
-                // are exactly the ids the replay set's deltas start above. Skipping them threw
-                // away the only surviving copy of those symbols and condemned a slot that had
-                // everything it needed. A slot whose registering frames really HAVE been
-                // trimmed still reports the gap, because then no frame on disk holds them.
-                0L,
-                recoveredCommitBoundaryFsn,
-                baseline,
-                out
-        );
-    }
-
     /**
      * Decodes the cached recovery suffix directly into the producer's global
      * dictionary. Recovery always builds the analysis with the persisted

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/MmapSegment.java

@@ -28,11 +28,9 @@
 import io.questdb.client.std.Files;
 import io.questdb.client.std.FilesFacade;
 import io.questdb.client.std.MemoryTag;
-import io.questdb.client.std.ObjList;
 import io.questdb.client.std.Os;
 import io.questdb.client.std.QuietCloseable;
 import io.questdb.client.std.Unsafe;
-import io.questdb.client.std.str.Utf8s;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -588,121 +586,6 @@ public long findLastFrameFsnWithoutPayloadFlag(int flagsOffset, int flagMask, in
         return best;
     }
 
-    /**
-     * Rebuilds, from the frames' own delta sections, the symbols a replay of
-     * {@code [minFsnInclusive .. maxFsnInclusive]} would register ABOVE {@code coverage},
-     * appending them to {@code out} in ascending id order. Returns the coverage the walk
-     * establishes (one past the highest id registered), or {@code -1} when a frame's delta
-     * starts ABOVE the coverage reached so far.
-     * <p>
-     * This is the recovery-time twin of {@code CursorWebSocketSendLoop.accumulateSentDict}:
-     * it visits the same frames, in the same FSN order, and extracts exactly the entries
-     * that method will add to the send loop's mirror as those frames go back on the wire.
-     * The producer's dictionary is seeded from it so the producer's delta baseline and the
-     * loop's mirror coverage stay in lockstep BY CONSTRUCTION -- which is what makes a slot
-     * whose {@code .symbol-dict} was torn (or lost entirely) recoverable, as long as the
-     * surviving frames define the ids themselves.
-     * <p>
-     * A {@code -1} return is a genuine GAP: the ids between the coverage and the frame's
-     * delta start were introduced by frames that were acked and trimmed away, so they lived
-     * ONLY in the lost dictionary and cannot be rebuilt from anything. That is the one case
-     * the data really must be resent, and it is exactly the condition the send loop's
-     * torn-dictionary guard ({@code deltaStart > sentDictCount}) would trip on at replay --
-     * so the two agree, rather than the producer failing on slots the drainer drains fine.
-     * <p>
-     * Same frame layout and FSN bound as {@link #maxSymbolDeltaEnd}.
-     */
-    public long collectReplaySymbolsAbove(
-            int headerMagic,
-            int flagsOffset,
-            int flagDeltaMask,
-            int qwpHeaderSize,
-            long minFsnInclusive,
-            long maxFsnInclusive,
-            long coverage,
-            ObjList<String> out
-    ) {
-        long off = HEADER_SIZE;
-        long frames = frameCount;
-        for (long i = 0; i < frames; i++) {
-            long fsn = baseSeq + i;
-            int payloadLen = Unsafe.getUnsafe().getInt(mmapAddress + off + 4);
-            long payload = mmapAddress + off + FRAME_HEADER_SIZE;
-            if (fsn >= minFsnInclusive
-                    && fsn <= maxFsnInclusive
-                    && payloadLen >= qwpHeaderSize
-                    && payloadLen > flagsOffset
-                    && Unsafe.getUnsafe().getInt(payload) == headerMagic
-                    && (Unsafe.getUnsafe().getByte(payload + flagsOffset) & flagDeltaMask) != 0) {
-                long p = payload + qwpHeaderSize;
-                long limit = payload + payloadLen;
-                long deltaStart = 0L;
-                int shift = 0;
-                while (p < limit) {
-                    byte b = Unsafe.getUnsafe().getByte(p++);
-                    deltaStart |= (long) (b & 0x7F) << shift;
-                    if ((b & 0x80) == 0) {
-                        break;
-                    }
-                    shift += 7;
-                    if (shift > 35) {
-                        break; // corrupt run; recovered frames are CRC-valid, so defensive only
-                    }
-                }
-                long deltaCount = 0L;
-                shift = 0;
-                while (p < limit) {
-                    byte b = Unsafe.getUnsafe().getByte(p++);
-                    deltaCount |= (long) (b & 0x7F) << shift;
-                    if ((b & 0x80) == 0) {
-                        break;
-                    }
-                    shift += 7;
-                    if (shift > 35) {
-                        break;
-                    }
-                }
-                if (deltaStart > coverage) {
-                    return -1L; // gap: ids [coverage, deltaStart) are unrecoverable
-                }
-                // Walk this frame's [len varint][utf8] entries. Ids below the coverage we
-                // already hold are skipped (a replayed frame legitimately overlaps the tip);
-                // ids at or above it extend the dictionary.
-                long id = deltaStart;
-                for (long k = 0; k < deltaCount; k++, id++) {
-                    long len = 0L;
-                    shift = 0;
-                    while (p < limit) {
-                        byte b = Unsafe.getUnsafe().getByte(p++);
-                        len |= (long) (b & 0x7F) << shift;
-                        if ((b & 0x80) == 0) {
-                            break;
-                        }
-                        shift += 7;
-                        if (shift > 35) {
-                            break;
-                        }
-                    }
-                    if (p + len > limit) {
-                        // Malformed entry region. Do NOT guess: report it as unrecoverable
-                        // so the caller fails clean rather than seeding a shifted dictionary.
-                        return -1L;
-                    }
-                    if (id >= coverage) {
-                        out.add(Utf8s.stringFromUtf8Bytes(p, p + len));
-                    }
-                    p += len;
-                }
-                long deltaEnd = deltaStart + deltaCount;
-                if (deltaEnd > coverage) {
-                    coverage = deltaEnd;
-                }
-            }
-            off += FRAME_HEADER_SIZE + payloadLen;
-        }
-        return coverage;
-    }
-
     /**
      * Feeds every recovered frame in this segment to the engine's single-pass
      * recovery fold. Segments are visited oldest-first by {@link SegmentRing}.
@@ -717,146 +600,6 @@ void scanRecovery(RecoveredFrameAnalysis analysis) {
         }
     }
 
-    /**
-     * Highest {@code deltaStart + deltaCount} (one past the highest symbol id) any
-     * delta-flagged frame in this segment carries, or {@code 0} only when NO
-     * delta-flagged frame is present. A frame with {@code deltaCount == 0} (a commit
-     * or a symbol-reusing frame -- the encoder always sets the delta flag) still
-     * contributes its {@code deltaStart}, i.e. the producer's baseline at encode
-     * time, NOT 0. That is deliberate: it anchors the torn-dict guard at that
-     * baseline so a dictionary torn below it is detected -- a conservative
-     * over-strand (it may over-reject a frame whose rows reference only surviving
-     * ids), never an under-strand that could silently shift the dense id map.
-     * Read-only walk over the recovered frames, used
-     * once at recovery to detect a persisted {@code .symbol-dict} torn (host crash,
-     * out-of-order page loss) below the ids the surviving frames still reference: if
-     * the max here reaches at or beyond the recovered dictionary size, a resuming
-     * producer -- seeded from the shorter dictionary -- would re-use ids the frames
-     * already define. Only frames at or below {@code maxFsnInclusive} count: frames
-     * above it are the aborted orphan-deferred tail, which {@code trySendOne} retires
-     * without ever transmitting, so their ids must not inflate the result (a resuming
-     * producer never reuses them on the wire). The frame layout mirrors
-     * {@link #findLastFrameFsnWithoutPayloadFlag}: the QWP message header
-     * ({@code qwpHeaderSize} bytes) is followed by the delta section
-     * {@code [deltaStart varint][deltaCount varint]...}.
-     *
-     * @param headerMagic     the QWP message magic identifying a well-formed frame
-     * @param flagsOffset     byte offset of the flags field within the QWP header
-     * @param flagDeltaMask   the FLAG_DELTA_SYMBOL_DICT bit
-     * @param qwpHeaderSize   the QWP message header size (delta section starts past it)
-     * @param maxFsnInclusive highest frame FSN to consider; frames above it are the
-     *                        retired orphan-deferred tail -- pass
-     *                        {@code recoveredCommitBoundaryFsn}
-     */
-    public long maxSymbolDeltaEnd(int headerMagic, int flagsOffset, int flagDeltaMask, int qwpHeaderSize, long maxFsnInclusive) {
-        long maxEnd = 0L;
-        long off = HEADER_SIZE;
-        long frames = frameCount;
-        for (long i = 0; i < frames; i++) {
-            long fsn = baseSeq + i;
-            int payloadLen = Unsafe.getUnsafe().getInt(mmapAddress + off + 4);
-            long payload = mmapAddress + off + FRAME_HEADER_SIZE;
-            // Skip the orphan-deferred tail (fsn > maxFsnInclusive): retired, never
-            // sent, so its ids must not count. off still advances below.
-            if (fsn <= maxFsnInclusive
-                    && payloadLen >= qwpHeaderSize
-                    && payloadLen > flagsOffset
-                    && Unsafe.getUnsafe().getInt(payload) == headerMagic
-                    && (Unsafe.getUnsafe().getByte(payload + flagsOffset) & flagDeltaMask) != 0) {
-                long p = payload + qwpHeaderSize;
-                long limit = payload + payloadLen;
-                long deltaStart = 0L;
-                int shift = 0;
-                while (p < limit) {
-                    byte b = Unsafe.getUnsafe().getByte(p++);
-                    deltaStart |= (long) (b & 0x7F) << shift;
-                    if ((b & 0x80) == 0) {
-                        break;
-                    }
-                    shift += 7;
-                    if (shift > 35) {
-                        break; // corrupt run; recovered frames are CRC-valid, so defensive only
-                    }
-                }
-                long deltaCount = 0L;
-                shift = 0;
-                while (p < limit) {
-                    byte b = Unsafe.getUnsafe().getByte(p++);
-                    deltaCount |= (long) (b & 0x7F) << shift;
-                    if ((b & 0x80) == 0) {
-                        break;
-                    }
-                    shift += 7;
-                    if (shift > 35) {
-                        break;
-                    }
-                }
-                long end = deltaStart + deltaCount;
-                if (end > maxEnd) {
-                    maxEnd = end;
-                }
-            }
-            off += FRAME_HEADER_SIZE + payloadLen;
-        }
-        return maxEnd;
-    }
-
-    /**
-     * Highest {@code deltaStart} any delta-flagged frame at or below
-     * {@code maxFsnInclusive} carries, or {@code 0} when NO delta-flagged frame is
-     * present. A result of {@code 0} means every surviving symbol-bearing frame is
-     * SELF-SUFFICIENT -- it re-registers its dictionary from id 0 (a full-dict
-     * frame), so the slot replays with no persisted dictionary at all; a result
-     * {@code > 0} means at least one frame is a non-self-sufficient delta whose ids
-     * depend on a prior frame's (or the persisted dictionary's) registrations.
-     * {@link CursorSendEngine} pairs this with {@link #maxSymbolDeltaEnd} at
-     * recovery: when the persisted {@code .symbol-dict} is a subset of the ids the
-     * frames reference BUT this returns {@code 0}, the slot was written in full-dict
-     * fallback (the dictionary never opened when writing) and recovers in full-dict
-     * mode instead of failing clean; a torn DELTA dictionary has a {@code
-     * deltaStart > 0} frame and still fails clean. Same read-only frame walk and
-     * layout as {@link #maxSymbolDeltaEnd}; only frames at or below {@code
-     * maxFsnInclusive} count (the retired orphan-deferred tail is excluded).
-     */
-    public long maxSymbolDeltaStart(int headerMagic, int flagsOffset, int flagDeltaMask, int qwpHeaderSize, long maxFsnInclusive) {
-        long maxStart = 0L;
-        long off = HEADER_SIZE;
-        long frames = frameCount;
-        for (long i = 0; i < frames; i++) {
-            long fsn = baseSeq + i;
-            int payloadLen = Unsafe.getUnsafe().getInt(mmapAddress + off + 4);
-            long payload = mmapAddress + off + FRAME_HEADER_SIZE;
-            // Skip the orphan-deferred tail (fsn > maxFsnInclusive): retired, never
-            // sent, so its baseline must not count. off still advances below.
-            if (fsn <= maxFsnInclusive
-                    && payloadLen >= qwpHeaderSize
-                    && payloadLen > flagsOffset
-                    && Unsafe.getUnsafe().getInt(payload) == headerMagic
-                    && (Unsafe.getUnsafe().getByte(payload + flagsOffset) & flagDeltaMask) != 0) {
-                long p = payload + qwpHeaderSize;
-                long limit = payload + payloadLen;
-                long deltaStart = 0L;
-                int shift = 0;
-                while (p < limit) {
-                    byte b = Unsafe.getUnsafe().getByte(p++);
-                    deltaStart |= (long) (b & 0x7F) << shift;
-                    if ((b & 0x80) == 0) {
-                        break;
-                    }
-                    shift += 7;
-                    if (shift > 35) {
-                        break; // corrupt run; recovered frames are CRC-valid, so defensive only
-                    }
-                }
-                if (deltaStart > maxStart) {
-                    maxStart = deltaStart;
-                }
-            }
-            off += FRAME_HEADER_SIZE + payloadLen;
-        }
-        return maxStart;
-    }
-
     /**
      * Number of frames written since {@link #create} (or recovered by
      * {@link #openExisting}). Used by {@code SegmentRing} to compute