fix(qwp): clear transient sync latch, unpin startup recovery, capture win32 errno at failure point

Review-finding fixes:

- C1: SegmentManager.servicePeriodicSync now clears
  SegmentRing.durabilityFailure after a subsequent fully-successful sync
  pass, so a transient fsync/msync failure no longer permanently bricks
  the producer; recovery is logged like the trim path. Regression test:
  testTransientSyncFailureClearsOnNextSuccess.
- C2: startup SF recovery parks slots whose build persistently fails
  (immediately on SlotLockContentionException, after 3 consecutive
  failures otherwise), keeps scanning the remaining slots, rewinds the
  cursors while parked slots remain, and dedups the per-slot WARN. A
  wedged slot no longer livelocks the driver, floods the log, or starves
  higher slots' orphan data; the server-wide transient retry contract is
  preserved. 3 new regression tests in SenderPoolSfTest.
- M1: windows open_file saves GetLastError() at the CreateFileW failure
  point (before free() can clobber it) and fsyncDir0 classifies the
  ERROR_ACCESS_DENIED best-effort degrade from the saved value via the
  new GetSavedLastError() (defined in os.c beside the TLS index it
  reads), mirroring the FlushFileBuffers branch's capture pattern.
- M2: replaced leftover test reflection with the existing @testonly
  seams in CursorSendEngineSlotReacquisitionTest,
  QueryClientPoolErrorSafetyTest and SlotLockReleasedContractTest.
- Stale comments updated: the durability-latch throw is transient, and
  the recovery streak constant parks on the 3rd consecutive failure.

Author: bluestreak01

core/src/main/c/windows/errno.h

@@ -6,4 +6,10 @@ static DWORD dwTlsIndexLastError = 0;
 
 void SaveLastError();
 
+/* Returns the per-thread error code most recently stored by SaveLastError().
+ * Both functions are defined in os.c, the only translation unit whose static
+ * dwTlsIndexLastError copy is initialised by TlsAlloc() in DllMain; every
+ * other includer's copy of the variable is an unused zero. */
+DWORD GetSavedLastError();
+
 #endif //ZLIB_ERRNO_H

core/src/main/c/windows/files.c

@@ -77,11 +77,16 @@ static jint open_file(const char *utf8Path,
     }
     HANDLE h = CreateFileW(wide, desiredAccess, shareMode, NULL,
                            creationDisposition, flagsAndAttributes, NULL);
-    free(wide);
     if (h == INVALID_HANDLE_VALUE) {
+        // Save the CreateFileW failure code BEFORE free(): the thread's
+        // last-error value may be overwritten by any subsequent API/CRT call
+        // (HeapFree can SetLastError), and callers such as fsyncDir0 rely on
+        // the saved value being the CreateFileW error.
         SaveLastError();
+        free(wide);
         return -1;
     }
+    free(wide);
     return HANDLE_TO_FD(h);
 }
 
@@ -237,10 +242,12 @@ JNIEXPORT jint JNICALL Java_io_questdb_client_std_Files_fsyncDir0
         // directory handle with ERROR_ACCESS_DENIED. Directory-entry durability
         // on NTFS is provided by metadata journaling ($LogFile), so degrade to
         // best-effort success here rather than hard-failing the SF durability
-        // path. open_file() already recorded the error via SaveLastError(); a
-        // genuine failure such as a missing directory (ERROR_PATH_NOT_FOUND)
-        // still propagates as fatal.
-        if (GetLastError() == ERROR_ACCESS_DENIED) {
+        // path. Consult the error open_file() saved at the CreateFileW failure
+        // point rather than the live GetLastError(): the intervening free()
+        // and return path inside open_file() are not guaranteed to preserve
+        // the thread's last-error value. A genuine failure such as a missing
+        // directory (ERROR_PATH_NOT_FOUND) still propagates as fatal.
+        if (GetSavedLastError() == ERROR_ACCESS_DENIED) {
             return 0;
         }
         return -1;

core/src/main/c/windows/os.c

@@ -237,3 +237,7 @@ JNIEXPORT jlong JNICALL Java_io_questdb_client_std_Os_currentTimeMicros
 void SaveLastError() {
     TlsSetValue(dwTlsIndexLastError, (LPVOID) (DWORD_PTR) GetLastError());
 };
+
+DWORD GetSavedLastError() {
+    return (DWORD) (DWORD_PTR) TlsGetValue(dwTlsIndexLastError);
+}

core/src/main/java/io/questdb/client/cutlass/qwp/client/QwpWebSocketSender.java

@@ -869,9 +869,11 @@ public boolean awaitAckedFsn(long targetFsn, long timeoutMillis) {
             return targetFsn < 0L;
         }
         cursorEngine.checkDurability();
-        // Surface latched I/O errors before any early-return path, so a
-        // caller polling with timeoutMillis <= 0 to drive their own loop
-        // sees the terminal throw instead of an indefinite "not yet".
+        // Surface latched errors before any early-return path, so a caller
+        // polling with timeoutMillis <= 0 to drive their own loop sees the
+        // throw instead of an indefinite "not yet". The durability latch
+        // above is transient: it throws while latched, and clears once a
+        // later periodic sync pass fully succeeds so producers can resume.
         if (cursorSendLoop != null) {
             cursorSendLoop.checkError();
         }

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/SegmentManager.java

@@ -1224,8 +1224,15 @@ private void servicePeriodicSync(RingEntry e, long now) {
                 syncScratch.getQuick(i).syncPublished();
             }
             e.ring.clearSyncRequestIfActiveDurable();
+            // The pass above covered every live segment's published range, so
+            // any earlier barrier failure has been remedied — unlatch it so a
+            // transient disk fault doesn't permanently brick the producer.
+            e.ring.clearDurabilityFailure();
             e.nextDataSyncNanos = now + e.syncIntervalNanos;
-            e.syncFailureLogged = false;
+            if (e.syncFailureLogged) {
+                e.syncFailureLogged = false;
+                LOG.info("Periodic SF data sync recovered for {}", e.dir);
+            }
         } catch (Throwable failure) {
             e.ring.recordDurabilityFailure(failure);
             if (!e.syncFailureLogged) {

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/SegmentRing.java

@@ -118,8 +118,10 @@ public final class SegmentRing implements QuietCloseable {
     // call installHotSpare on a closed ring (whose hotSpare was just
     // zeroed by close()) -- the spare's mmap + fd would never be reclaimed.
     private boolean closed;
-    // First periodic data-barrier failure. The manager latches it and the
-    // producer observes it before its next append.
+    // Latest periodic data-barrier failure. The manager latches it and the
+    // producer observes it before its next append; the manager clears it
+    // again once a subsequent periodic sync pass succeeds, so a transient
+    // disk fault does not permanently brick the producer.
     private volatile MmapSegmentException durabilityFailure;
     // hotSpare: written by segment manager (installHotSpare), read+cleared by
     // producer thread on rotation. Volatile so the producer sees fresh installs.
@@ -961,6 +963,22 @@ public void checkDurability() {
         }
     }
 
+    /**
+     * Clears a latched periodic data-barrier failure. Called by the segment
+     * manager after a subsequent periodic sync pass over every live segment
+     * succeeds: the published range the failed barrier was meant to cover is
+     * durable now, so the producer may resume. The monitor serializes the
+     * clear with {@link #recordDurabilityFailure(Throwable)}; the volatile
+     * write publishes it to producer threads calling {@link #checkDurability()}.
+     */
+    void clearDurabilityFailure() {
+        if (durabilityFailure != null) {
+            synchronized (this) {
+                durabilityFailure = null;
+            }
+        }
+    }
+
     synchronized void clearSyncRequestIfActiveDurable() {
         if (active != null && active.isPublishedDurable()) {
             syncRequested = false;