pub fn open_recovery_source(path: &Path) -> Result<Box<dyn FileIo>>
Recovery reads through an OS read-only descriptor while excluding writers. No create semantics: a missing source must stay missing.