fix(prefix-cache): reuse slots after aborted snapshots

DU
3mo ago
+562-156

Why

PR #561 combined this production correctness change with the formal-verification
platform and three later targets. This draft extracts the first independently
reviewable and revertible unit.

The inline prefix-cache allocator advances its round-robin cursor when it
reserves a slot. If that reservation is aborted, the resulting hole can be
skipped while the cursor points back at a committed slot. A later reservation
could then return the occupied slot instead of the available hole, putting a
still-valid snapshot at risk when the caller frees or reuses the returned slot.

What changed

  • extracts the inline prefix-cache transitions into dependency-free
    InlinePrefixCacheState production code;
  • selects an actually free slot before considering eviction, preserving the
    round-robin starting point;
  • keeps prefix-aware leaf eviction, stale-entry removal, confirmation,
    cancellation, abort, and clear behavior in the extracted state core;
  • adds a native regression for
    commit/prepare/abort/prepare hole reuse without invalidating the committed
    snapshot;
  • registers that dependency-free regression with CMake and the existing hosted
    C++ CI job.

Scope boundary

This PR contains production correctness work and native CI coverage only. It
adds no formal contracts, verifier images, formal workflow, credentials, AI,
or branch-protection change.

The local formal registry will follow in a separate dependent draft. CI
integration remains a later maintainer/security review.

User impact

Aborted inline snapshot creation no longer causes a later reservation to reuse
an occupied slot while a free slot exists. Public APIs and configuration are
unchanged.

Validation

  • warning-enabled C++17 build and execution of test_prefix_cache_state;
  • warning-enabled compilation of production prefix_cache.cpp;
  • CUDA 12.6 CMake configuration;
  • cmake --build ... --target test_prefix_cache_state -j4;
  • ctest -R '^prefix_cache_state$' --no-tests=error;
  • git diff --check.

The full GPU/server matrix is left to hosted CI.

Release sequence

This is PR 1 of the staged replacement for #561. It has no dependency on the
formal-verification rollout and can be reviewed, merged, or reverted on its
own.