Assert the facade length injection drove the mapping

The routed header-fault test asserted only that recovery returned no
ring. But SegmentRing.openExisting rebuilds the segment path as
sfDir + "/" + name and swallows the per-file MmapSegmentException, so
the test could no longer see why the skip happened. If the facade's
targetPath ever stopped matching that rebuilt path, openExisting would
read the real length 0, throw "file shorter than header" before the
mmap-fault guard, still skip, and still return null -- the test would
pass even with the guard reverted, silently gutting the only portable
fail-on-revert guard.

MapPastEofFacade now records whether it served the inflated length for
its target path, and the test asserts it did. That proves the
beyond-EOF fault, not a short-file throw, drove the skip, restoring the
structural guarantee the pre-routing reference-identity form had. A
mutation that breaks the path match now fails loudly at the assertion
instead of passing green (verified: it fails at the new assertTrue with
the coupling broken, and passes on JDK 11 and JDK 17 intact).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/sf/cursor/MmapSegmentRecoveryFaultTest.java

@@ -317,11 +317,20 @@ public void testHeaderFaultOnMapPastEofIsSkippableAnyFilesystem() throws Excepti
             // facade reports a full page, so openExisting maps that beyond-EOF
             // page and the header read faults on it on any filesystem.
             truncateTo(path, 0L);
-            FilesFacade ff = new MapPastEofFacade(path, page);
+            MapPastEofFacade ff = new MapPastEofFacade(path, page);
             // SegmentRing opens the sole segment through the facade, catches the
             // converted MmapSegmentException, skips the file, and returns no ring.
             assertNull("a beyond-EOF header page must be skipped, not recovered or fatal",
                     SegmentRing.openExisting(ff, tmpDir, SEGMENT_BYTES));
+            // Guard against a silent pass: the skip must be the beyond-EOF mmap
+            // fault, not a "file shorter than header" throw. That holds only if
+            // the facade's inflated length actually reached the recovery mapping
+            // -- i.e. the path SegmentRing rebuilds (sfDir + "/" + name) matched
+            // targetPath. If that coupling ever broke, openExisting would see the
+            // real length 0 and skip via a throw that survives reverting the
+            // mmap-fault guard, gutting this fail-on-revert guard unnoticed.
+            assertTrue("the injected beyond-EOF length must have driven the recovery mapping",
+                    ff.isInflatedLengthServed);
         });
     }
 
@@ -394,6 +403,10 @@ private static void truncateTo(String path, long keepBytes) {
      * {@link FilesFacade#INSTANCE}.
      */
     private static final class MapPastEofFacade implements FilesFacade {
+        // Set once length() has served the inflated length for targetPath, i.e.
+        // the injection actually reached the recovery mapping. A test asserts
+        // this so a broken path match cannot let the guard pass vacuously.
+        private boolean isInflatedLengthServed;
         private final long reportedLength;
         private final String targetPath;
 
@@ -469,7 +482,11 @@ public long length(long pathPtr) {
 
         @Override
         public long length(String path) {
-            return targetPath.equals(path) ? reportedLength : INSTANCE.length(path);
+            if (targetPath.equals(path)) {
+                isInflatedLengthServed = true;
+                return reportedLength;
+            }
+            return INSTANCE.length(path);
         }
 
         @Override