fix(qwp): fail closed on SF manifest with uncollapsed boundaries and no segment files

Recovery treated every valid manifest with zero .sfa files as EMPTY and
removed it, even when headBase < activeBase. No in-protocol crash can
produce that state: the close-time drain durably collapses the
boundaries to head == active before its first unlink, and a fresh start
writes (0,0). Uncollapsed boundaries with no segment files therefore
prove durable, never-declared-acked frames vanished outside the protocol
(manual wipe, partial restore) -- yet recovery silently started fresh
and deleted the manifest, destroying the only evidence of the loss.

Accept the segment-less slot as EMPTY only when headBase == activeBase,
matching the existing guard on the some-files clean-drain window;
otherwise throw without mutating the slot. Fix the drain-window test to
model the real crash state (9,9) and add a fail-closed (7,9) test
asserting the directory is left byte-identical.

Author: bluestreak01

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/SegmentRing.java

@@ -276,16 +276,32 @@ static Recovery recover(
                     return Recovery.empty();
                 }
                 if (manifest != null) {
-                    // No .sfa files at all. Two legitimate protocols produce
-                    // this: the close-time drain unlinks the last segment
-                    // before it removes the manifest, and a fresh-start crash
-                    // can leave a boundary-less (0,0) manifest behind. In
-                    // both cases nothing recoverable exists, so accept EMPTY
-                    // -- but shout, because a manual wipe of segment files
-                    // looks identical and the operator should know.
-                    LOG.warn("SF manifest exists in {} with no segment files "
-                            + "(clean-drain or fresh-start crash window, or manual "
-                            + "segment removal); discarding it and starting fresh", sfDir);
+                    // No .sfa files at all. Only two protocols legitimately
+                    // produce this, and both leave head == active: the
+                    // close-time drain durably collapses the boundaries
+                    // BEFORE its first unlink, and a fresh-start crash can
+                    // leave a boundary-less (0,0) manifest behind. Uncollapsed
+                    // boundaries therefore prove durable, never-declared-acked
+                    // frames existed in [headBase, activeBase] whose files
+                    // vanished outside the protocol (manual wipe, partial
+                    // restore) -- fail closed and keep the manifest as
+                    // evidence instead of silently starting fresh.
+                    long manifestHeadBase = manifest.headBase();
+                    long manifestActiveBase = manifest.activeBase();
+                    if (manifestHeadBase != manifestActiveBase) {
+                        throw new MmapSegmentException(SfManifest.FILE_NAME + " in " + sfDir
+                                + " references durable data (headBase=" + manifestHeadBase
+                                + ", activeBase=" + manifestActiveBase
+                                + ") but no segment files exist");
+                    }
+                    // Collapsed boundaries: nothing recoverable exists, so
+                    // accept EMPTY -- but shout, because a manual wipe of a
+                    // fully-acked slot looks identical and the operator
+                    // should know.
+                    LOG.warn("SF manifest exists in {} with collapsed boundaries ({}) and "
+                            + "no segment files (clean-drain or fresh-start crash window, or "
+                            + "manual segment removal); discarding it and starting fresh",
+                            sfDir, manifestActiveBase);
                     manifest.close();
                     manifest = null;
                     if (!SfManifest.removeFile(filesFacade, sfDir)) {

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/sf/cursor/SegmentRecoveryIntegrityTest.java

@@ -423,9 +423,11 @@ public void testRotationCrashWindowEmptyActiveAtChainEndRecovers() throws Except
     @Test
     public void testDrainWindowManifestWithoutSegmentsRecoversEmptyAndRemovesManifest() throws Exception {
         TestUtils.assertMemoryLeak(() -> {
-            // Clean-drain close unlinks the last segment before the manifest;
-            // a crash between the two leaves this state.
-            writeManifest(3, 7, 9);
+            // Clean-drain close durably collapses the boundaries to
+            // head == active before unlinking, then removes segments and
+            // finally the manifest; a crash between the last unlink and the
+            // manifest removal leaves collapsed boundaries with no files.
+            writeManifest(3, 9, 9);
 
             SegmentRing ring = SegmentRing.openExisting(FilesFacade.INSTANCE, tmpDir, SEGMENT_SIZE);
             Assert.assertNull("segment-less slot must recover as EMPTY", ring);
@@ -434,6 +436,34 @@ public void testDrainWindowManifestWithoutSegmentsRecoversEmptyAndRemovesManifes
         });
     }
 
+    @Test
+    public void testZeroSegmentFilesWithUncollapsedBoundariesFailsClosed() throws Exception {
+        TestUtils.assertMemoryLeak(() -> {
+            // headBase(7) < activeBase(9): the manifest durably committed that
+            // segments [7..9] existed and were never declared acked. No
+            // in-protocol crash leaves this next to zero .sfa files -- the
+            // close-time drain collapses boundaries to head == active BEFORE
+            // its first unlink, and a fresh start writes (0,0). Uncollapsed
+            // boundaries with no segment files therefore prove durable data
+            // vanished outside the protocol: recovery must fail closed and
+            // keep the manifest as evidence, not silently start fresh.
+            writeManifest(3, 7, 9);
+            Map<String, byte[]> before = snapshotDir();
+
+            try {
+                SegmentRing ring = SegmentRing.openExisting(FilesFacade.INSTANCE, tmpDir, SEGMENT_SIZE);
+                if (ring != null) {
+                    ring.close();
+                }
+                Assert.fail("recovery must fail closed: manifest boundaries (7,9) reference "
+                        + "durable frames but no segment file survives");
+            } catch (MmapSegmentException expected) {
+                TestUtils.assertContains(expected.getMessage(), "references durable data");
+            }
+            assertDirUnchanged(before);
+        });
+    }
+
     @Test
     public void testFreshStartCrashBeforeManifestCreationRecoversViaLegacyPath() throws Exception {
         TestUtils.assertMemoryLeak(() -> {