store: Class C flush from live slots, one writer, lock-free gets

.agents/skills/ship-pr/SKILL.md

@@ -75,12 +75,14 @@ Coverage and native `windows` / `macos` stay GitHub Actions;
 
 ## Push and poll
 
-Required jobs: `qc`, `test`, `windows`, `macos`, `coverage`, and `pread`.
-`qc` is fmt, ast-grep, deny, the script self-tests, clippy, then
-nixos-module-eval on one runner. `pread` is GitHub Actions only:
+Required jobs: `qc`, `test`, `windows`, `macos`, `coverage`, `pread`, and
+`rust-forward`. `qc` is fmt, ast-grep, deny, the script self-tests, clippy,
+then nixos-module-eval on one runner. `pread` is GitHub Actions only:
 `RBITCOIN_IO=pread cargo test -p rbitcoin-store -p rbitcoin-query` after
-`qc` and `test`, in parallel with `coverage`. Do not run it in the local
-gate list. The `test` job leaves `RBITCOIN_IO` unset. Mutants run nightly
+`qc` and `test`, in parallel with `coverage`. `rust-forward` is the same
+wait: `cargo check --workspace --all-targets` on the channel in
+`rust-forward.toml`. Do not run either in the local gate list. The `test`
+job leaves `RBITCOIN_IO` unset and stays on rustc 1.95. Mutants run nightly
 with workspace tests (`mutants.yml`); they are not a required check.
 Structural scan is `./scripts/ast-grep.sh`. `windows` / `macos` are native
 store plus `--smoke`, not operator zips.

.github/workflows/ci.yml

@@ -229,6 +229,33 @@ jobs:
       - name: cargo test store and query
         run: cargo test -p rbitcoin-store -p rbitcoin-query
 
+  # Forward rustc. Same wait as pread: a red `test` does not compile it.
+  # Product MSRV stays rust-toolchain.toml. This job checks the dialect still
+  # builds on the channel in rust-forward.toml, beside pread.
+  rust-forward:
+    name: rust-forward
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs: [qc, test]
+    env:
+      CARGO_TARGET_DIR: target/forward
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: install forward toolchain
+        run: |
+          channel=$(sed -n 's/^channel = "\(.*\)"$/\1/p' rust-forward.toml)
+          test -n "$channel"
+          rustup toolchain install --profile minimal "$channel"
+          echo "RUSTUP_TOOLCHAIN=$channel" >> "$GITHUB_ENV"
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          shared-key: ci-rust-forward
+          workspaces: ". -> target/forward"
+      - name: cargo check
+        run: cargo check --workspace --all-targets
+
   # Line-coverage 91% floor + CRAP --fail-above 30 (allowlist in .cargo-crap.toml).
   # Slow; waits for qc and test so a red check does not start
   # this job. Required. Job+step timeouts so a hung llvm-cov test binary

.github/workflows/model.yml

@@ -0,0 +1,66 @@
+# Model-checked concurrency (`--test model`): loom explores script-pool claim
+# order, the UTXO view stamp, and the Class C sequence counter. shuttle runs
+# the script-pool idle turn. Not a required PR check. The engine is a
+# `--cfg`, not a feature, so each job has its own target dir and cache. The
+# nightly schedule raises the budget (TESTING.md) and seeds shuttle with the
+# run id. The index-release order is not a model: it needs a Query full of
+# std locks.
+#
+# rustc comes from rust-toolchain.toml (the nix-shell / crane baseline). The
+# runner image's rustup auto-installs that toolchain and its components on
+# first cargo.
+
+name: model
+
+on:
+  pull_request:
+  push:
+    branches: [master, main, "v*.*.x"]
+  schedule:
+    - cron: "23 6 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: model-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: -D warnings
+  # Actions only. rust-cache restores dep rlibs (not workspace crates) and
+  # strips incremental artifacts before persist; it also sets this so rustc
+  # does not write throwaway dep-graphs.
+  CARGO_INCREMENTAL: "0"
+
+jobs:
+  model:
+    name: ${{ matrix.engine }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      # A loom failure and a shuttle failure are separate findings.
+      fail-fast: false
+      matrix:
+        engine: [loom, shuttle]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          shared-key: model-${{ matrix.engine }}
+          workspaces: ". -> target/model-${{ matrix.engine }}"
+      - name: model-check ${{ matrix.engine }}
+        if: github.event_name != 'schedule'
+        run: ./scripts/model-check.sh ${{ matrix.engine }}
+      - name: model-check ${{ matrix.engine }} (nightly deep budget)
+        if: github.event_name == 'schedule'
+        env:
+          LOOM_MAX_PREEMPTIONS: "4"
+          MODEL_SHUTTLE_ITERS: "50000"
+          MODEL_SHUTTLE_DEPTH: "5"
+          SHUTTLE_RANDOM_SEED: ${{ github.run_id }}
+        run: ./scripts/model-check.sh ${{ matrix.engine }}

CONTRIBUTING.md

@@ -5,7 +5,9 @@
 **Nix is not required** to clone, compile, run `--smoke`, or send a PR.
 CI pins **rustc 1.95.0**; [`rust-toolchain.toml`](./rust-toolchain.toml) makes
 [rustup](https://rustup.rs) install that channel (plus `rustfmt` and `clippy`)
-the first time you run `cargo` in this tree.
+the first time you run `cargo` in this tree. [`rust-forward.toml`](./rust-forward.toml)
+is the newer compiler the `rust-forward` job checks. It is not the compiler
+you develop with. Later pulls move that channel forward.
 
 Operator Linux binaries stay the musl path in [`README.md`](./README.md) /
 [`OPERATOR.md`](./OPERATOR.md). This section is **developing the tree**.
@@ -211,8 +213,9 @@ engineering.
    packed `g` (`mphf_g=0`) versus mmap sealed `.fuse8` (`fuse8=0` heap)
    and SH BDZ3 occupancy (`mphf_occ=` supers only; occ bits are `file=`)
    is that kind of choice. Reclaim of mapped fuse/occ is drop of file pages,
-   not swap. `strong_tx` and mempool stay process `Vec` (Class C tip-last write-behind
-   / live graph); do not mmap those because fuse mapping looked good.
+   not swap. `strong_tx` stays a process-resident bit image and mempool stays a
+   process `Vec` (Class C tip-last write-behind / live graph); do not mmap those
+   because fuse mapping looked good.
 
    Write as if the structure is huge, because in IBD it is. **Address** it
    (hash, slot, page, bit offset, subscript). Do not walk everything resident
@@ -265,11 +268,13 @@ Do not edit [`CHANGELOG.md`](./CHANGELOG.md) on a feature branch. The release
 cut folds those files in. Owner: [`docs/releases.md`](./docs/releases.md).
 
 Required **jobs** match [`.github/workflows/ci.yml`](./.github/workflows/ci.yml)
-(`qc`, `test`, `windows`, `macos`, `coverage`, `pread`). `qc` is fmt, ast-grep, deny, the script self-tests,
+(`qc`, `test`, `windows`, `macos`, `coverage`, `pread`, `rust-forward`). `qc` is fmt, ast-grep, deny, the script self-tests,
 clippy, then nixos-module-eval, in that order on one runner. `pread` is the
 Linux libc backend for `rbitcoin-store` and `rbitcoin-query`
-(`RBITCOIN_IO=pread`). It starts with `coverage`, after `qc` and `test`.
-The `test` job does not set `RBITCOIN_IO`.
+(`RBITCOIN_IO=pread`). `rust-forward` is `cargo check --workspace --all-targets`
+on the channel in [`rust-forward.toml`](./rust-forward.toml). Both start with
+`coverage`, after `qc` and `test`. The `test` job does not set `RBITCOIN_IO`
+and stays on 1.95.
 Label **`nixos-module-runtime`** to run the NixOS module qemu test (not
 eval). That job is not required.