v0.18.48

v0.18.48

• A parquet page that carries a checksum is now verified before any value is
  read from it. A page whose stored bytes do not hash to the checksum its own
  header declares fails the query, naming the file, the column and the page,
  instead of returning corrupted values. Data pages (both format versions) and
  dictionary pages are covered, on every read path.
• A column chunk that ends before the rows its row group declares now fails
  the read, naming the column and both counts. Previously the rows the file
  never supplied were returned as NULLs — including in columns whose schema
  says NULL is impossible.
• A row group that carries no data at all for a column of its own file's
  schema is refused rather than read as a column of NULLs. Reading a column
  the table has and a file predates is unchanged.
• Compaction refuses a file the reader can prove wrong instead of merging it:
  the manifest is left unchanged and every input file stays in place, so
  corruption is never made durable by a rewrite.
• A page of a type the reader cannot decode, sitting inside a column chunk, is
  refused rather than skipped. Skipping it dropped a whole page of values and
  shifted every later page's values into their place, without an error.
• A data page v2 whose declared null count cannot be placed by its definition
  levels, or disagrees with them, is refused. Previously the mismatch appeared
  as holes in a column whose schema says NULL is impossible.
• A data page v2 whose level byte lengths do not fit the page is refused
  rather than crashing the reader.
• The page-checksum check only costs anything on a file that carries
  checksums: none of wadjet's own writer output does, and neither does the
  122 MB ClickBench hits_0.parquet.
• docs/disaster-recovery.md describes the refusals and how to recover the
  file they name.