Tidy catch-up comments and harden two edges

Four minor cleanups on the delta symbol-dictionary catch-up, all
behaviour-preserving on every reachable path:

- The sentDict* field comment said the catch-up mirror is memory-mode
  only; it is also seeded and used in disk mode on a recovered /
  orphan-drained slot. Corrected.

- positionCursorAt's javadoc said it runs after nextWireSeq was reset
  to 0, but the catch-up path leaves nextWireSeq past the frames it
  emitted. Corrected to describe setWireBaselineWithCatchUp anchoring
  the wire baseline; the method only moves the byte cursor.

- The recovery-seed constructor set sentDictCount = pd.size() outside
  the loadedEntriesLen > 0 block. A recovered slot always has entries
  when size > 0, so the result is unchanged, but coupling the count to
  the mirror bytes stops sentDictCount ever claiming symbols the mirror
  does not hold.

- sendDictCatchUp used Integer.MAX_VALUE as the no-cap per-frame
  budget, so sendCatchUpChunk's int frameLen could overflow on a
  multi-GB dictionary. Bound it by MAX_SENT_DICT_BYTES, the same
  ceiling ensureSentDictCapacity enforces. Unreachable at real
  cardinality (~200M+ symbols); defensive.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/CursorWebSocketSendLoop.java

@@ -186,7 +186,9 @@ public final class CursorWebSocketSendLoop implements QuietCloseable {
     private final long reconnectMaxDurationMillis;
     private final WebSocketResponse response = new WebSocketResponse();
     private final ResponseHandler responseHandler = new ResponseHandler();
-    // Delta symbol dictionary catch-up state (memory-mode only; see swapClient).
+    // Delta symbol dictionary catch-up state (see swapClient). Active in memory
+    // mode, and in disk mode on a recovered / orphan-drained slot (the constructor
+    // seeds sentDict* from the persisted dictionary there).
     // deltaDictEnabled gates all of it. The loop mirrors, in sentDict*, every
     // symbol it has ever sent -- the concatenated [len varint][utf8] bytes in
     // global-id order (sentDictBytes*) plus the count (sentDictCount) -- so that
@@ -532,8 +534,12 @@ public CursorWebSocketSendLoop(WebSocketClient client, CursorSendEngine engine,
                     ensureSentDictCapacity(len);
                     Unsafe.getUnsafe().copyMemory(pd.loadedEntriesAddr(), sentDictBytesAddr, len);
                     sentDictBytesLen = len;
+                    // Set the count only alongside the bytes so sentDictCount can
+                    // never claim symbols the mirror does not hold. A recovered slot
+                    // always has loadedEntriesLen > 0 when size > 0, so this is the
+                    // same result -- it just makes the coupling explicit.
+                    sentDictCount = pd.size();
                 }
-                sentDictCount = pd.size();
             }
         }
         this.fsnAtZero = fsnAtZero;
@@ -1784,8 +1790,11 @@ private void ioLoop() {
     /**
      * Walk the engine's segments to find the one containing {@code targetFsn},
      * and set {@code sendOffset} to the byte offset of that frame within it.
-     * This is called at startup and after every reconnect, after fsnAtZero has
-     * already been reset to {@code targetFsn} and nextWireSeq to 0.
+     * This is called at startup and after every reconnect, once
+     * {@link #setWireBaselineWithCatchUp} has anchored the wire baseline
+     * ({@code fsnAtZero} / {@code nextWireSeq}) -- which may leave {@code nextWireSeq}
+     * past the catch-up frames it emitted. This method only positions the byte
+     * cursor at {@code targetFsn}; it does not touch the wire mapping.
      * <p>
      * If {@code targetFsn} is already published, the method positions the byte
      * cursor exactly at that frame. If {@code targetFsn} is not published yet,
@@ -2133,8 +2142,13 @@ private int sendDictCatchUp() {
         int cap = client.getServerMaxBatchSize();
         // Symbol-bytes budget per frame, leaving room for the 12-byte header and
         // the two delta-section varints. cap <= 0 means the server advertised no
-        // limit -> send the whole dictionary in one frame.
-        int budget = cap > 0 ? Math.max(1, cap - QwpConstants.HEADER_SIZE - 16) : Integer.MAX_VALUE;
+        // limit -- send the whole dictionary in one frame, but still bound the
+        // budget by MAX_SENT_DICT_BYTES so sendCatchUpChunk's int frameLen
+        // (HEADER_SIZE + varints + symbolsLen) cannot overflow on a pathological
+        // multi-GB dictionary (unreachable at real cardinality; defensive).
+        int budget = cap > 0
+                ? Math.max(1, cap - QwpConstants.HEADER_SIZE - 16)
+                : MAX_SENT_DICT_BYTES - QwpConstants.HEADER_SIZE - 16;
         int framesSent = 0;
         int chunkStartId = 0;
         long chunkStartAddr = sentDictBytesAddr;