Pin the overnight missed mutants in confirm, log, and the mempool

[rearden-grok]

Summary

Pins the 141 mutants the 2026-10-14 overnight run left missed in confirm, logging, and the mempool. Where an operator could not change a block, a peer message, or a reopened pool, the expression is gone. The rest are pinned by an existing journey or by a disk, peer, or operator-visible check.

Confirm progress, parent waits, and reject rewinds run through the functions the confirm thread calls. A disconnect during the parent read is the public reorg note. Mempool compaction uses the dead-slot quarter, equal floored chunk rates keep the earlier chunk, eviction stops when a slot is free, and a package that spends a later txid is not topological.

Test plan

• Hand-applied each missed operator (or confirmed the expression is gone) against the targeted crate test
• cargo fmt, clippy -D warnings, cargo deny, ast-grep, and ci-os-smoke.sh
• GitHub qc, test, windows, macos, and coverage

[rearden-grok]

Summary

The production edits pin overnight mutants by deleting checks the node cannot reach and by extracting confirm reject paths, without changing what a block, a peer package, or a reopened pool does. Every rewritten predicate checked below is equivalent on the inputs the node can actually see: package topology, free-slot eviction, RBFR zero-weight, orphan weight, chunk tie-break, UTF-8 truncation, and the confirm requeue filters. The one new call, spindle_wait before the missing-parent tx.head read, is the same HDD gate lookup and load already use; a disconnect or tip move during that wait retries the block instead of keeping a verdict. No consensus, denial-of-service, or security failure remains. note_disconnect_height is now pub but its body is unchanged and production still calls it only from disconnect.

Issue counts by severity

• bugs: 0
• suggestions: 0
• nits: 0

Adversarial check of production edits

No remote input can take a path these edits newly open. Each deleted or rewritten predicate was compared with the old expression and with the callers that feed it.

• Confirm requeue. prepare_offer_back already drops hashes has_block reports. Removing the second filter in the stale-plan path does not put a connected body back on the queue. script_reject_wave, apply_write_reject, and rewind_after_load_reject are the old conditions moved into functions: a one-block verdict still drops its block; a retry, engine fault, or session fault still keeps the wave; a pin-stage engine fault that is not a uring session fault still rewinds as a cascade. The lookup match split is the same partition: an empty wave with no undecodable item only clears the fault counter; any other Ok still enters the body path and calls on_success.
• Parent read. spindle_wait takes the datadir-hdd lock and drops it. It is a no-op when the flag is off. parent_missing_from_chain does not take that lock, so this is not a deadlock. The wait sits after the 10s parent loop, and the following stop / ready / take_disconnect checks still discard a verdict if the tip moves during the wait. The parent-check clock is thread-local and unset in production, so the confirm thread still uses Instant::now and a 2ms sleep.
• Mempool eviction. The 10_000-iteration cap is gone. The loop still stops when a FREE or DEAD slot exists, or when a pass removes nothing. unlink_txid marks the slot DEAD before it drops the graph entry, and DEAD is a free slot. A missing body fails the unlink and the next pass returns empty, so a stuck tx cannot spin the accept thread.
• Package shape. Duplicates are still rejected first. The shrinking seen set rejects an input that spends this tx or a later package tx, and allows an earlier one. That is the same rule as parent position < i, including a self-spend.
• RBFR. get_virtual_size is (weight + 3) / 4, which is 0 only at weight 0. The vsize check replaces the weight-0 check.
• Orphan cap. max.saturating_sub(total) < weight matches saturating_add(weight) > max whenever the cap is below u64::MAX or the tx weight is non-zero. A bitcoin::Transaction weight is never 0. At a u64::MAX cap the new test is stricter (it rejects an add that saturates), which does not admit extra orphans.
• Chunk order. linearize_delta walks a BTreeSet, so equal rate and fee already keep the lesser txid. Dropping the third compare does not change the pick. The component-rep || is the same two continues. enforce_monotone_desc min matches the old > assign.
• Disk format. VIN_SEQ_FINAL is still 1. u32::try_from(payload.len()) matches len > u32::MAX. Adjacent slot records are still prev_end == off. 1 << 30 is the same 1 GiB inflight line.
• Logging. str::floor_char_boundary is called at max.min(len), so it does not panic, and it stops on the same UTF-8 boundary as the old loop. No new attacker-controlled format string.
• note_disconnect_height. Body still stores the height, bumps the generation, rewinds the lookup watermarks, and drops resolved queue entries from that height. Widening it from pub(crate) to pub is what lets the confirm test call it. The node still invokes it only from disconnect. It is not reachable from a peer message.

Tests and the changelog fragment do not change node behavior.