feat(racer): add standalone flow-control library

.github/workflows/ci.yaml

@@ -190,6 +190,44 @@ jobs:
           RUNTIME_REQUIRE_IO_URING: "1"
         run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p uring-runtime --no-default-features
 
+      # Keep allocator invocations separate from runtime/workspace tests: runtime
+      # test features must not enable simulation in the production allocator gate.
+      - name: Check allocator production and simulation
+        run: |
+          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 check --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p page-alloc --all-targets --no-default-features
+          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 check --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p page-alloc --all-targets --no-default-features --features simulation
+
+      - name: Strict allocator Clippy
+        run: |
+          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 clippy --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p page-alloc --all-targets --no-default-features -- -D warnings
+          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 clippy --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p page-alloc --all-targets --no-default-features --features simulation -- -D warnings
+
+      - name: Allocator production real I/O (no simulation)
+        env:
+          PAGE_ALLOC_REQUIRE_REAL_IO: "1"
+        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p page-alloc --no-default-features
+
+      - name: Test allocator simulation
+        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p page-alloc --no-default-features --features simulation
+
+      # Isolate flow features so workspace tests cannot substitute simulated I/O
+      # for the production pipe and socket contracts. Real-I/O failures never skip.
+      - name: Check flow production and simulation
+        run: |
+          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 check --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --all-targets --no-default-features
+          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 check --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --all-targets --no-default-features --features simulation
+
+      - name: Strict flow Clippy
+        run: |
+          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 clippy --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --all-targets --no-default-features -- -D warnings
+          timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 clippy --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --all-targets --no-default-features --features simulation -- -D warnings
+
+      - name: Flow production real I/O (no simulation)
+        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --no-default-features
+
+      - name: Test flow simulation
+        run: timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --no-default-features --features simulation
+
   racer-verbs:
     name: Racer Verbs (${{ matrix.configuration }})
     runs-on: ubuntu-24.04

cmd/racer-dataplane/Cargo.toml

@@ -1,5 +1,5 @@
 [workspace]
-members = [".", "topology", "runtime", "telemetry", "verbs"]
+members = [".", "topology", "runtime", "alloc", "flow", "telemetry", "verbs"]
 resolver = "3"
 
 [package]

cmd/racer-dataplane/README.md

@@ -40,3 +40,38 @@ timeout --signal=TERM --kill-after=10s 300s python3 hack/scripts/runtime-miri.py
 
 Run the `offload`, `scheduler`, and `memory` groups separately with the same script.
 Each group verifies that every exact allowlisted test actually ran.
+
+The `page-alloc` library provides worker-local aligned buffers, lease-fenced slab
+I/O, and bounded segment reclamation. Test it separately from runtime/workspace
+tests so feature unification cannot enable simulation in its production gate:
+
+```sh
+PAGE_ALLOC_REQUIRE_REAL_IO=1 timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p page-alloc --no-default-features -j 2 -- --test-threads=1
+timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p page-alloc --no-default-features --features simulation -j 2 -- --test-threads=1
+```
+
+The production gate requires real io_uring and direct-I/O support: capability
+skips fail when `PAGE_ALLOC_REQUIRE_REAL_IO=1`. CI also checks all targets and
+runs strict Clippy for each allocator mode.
+
+The `flow-control` library provides policy-driven quotas, charged buffers, bounded
+kernel pipes, adaptive admission, and worker-local coalescing. Application policy
+and real operation completion remain the caller's responsibility. Its crate docs
+describe ownership and admission contracts; generate them with:
+
+```sh
+timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 doc --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --no-deps
+```
+
+Validate flow separately so workspace feature unification cannot enable simulation
+in its production gate:
+
+```sh
+timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --no-default-features -j 2 -- --test-threads=1
+timeout --signal=TERM --kill-after=10s 300s cargo +1.96.0 test --locked --manifest-path cmd/racer-dataplane/Cargo.toml -p flow-control --no-default-features --features simulation -j 2 -- --test-threads=1
+```
+
+The flow production tests require Linux kernel pipes, Unix sockets, and splice.
+They exercise real I/O and fail rather than skipping unsupported operations.
+Simulation adds simulated and mixed-descriptor contracts without removing the
+real pipe tests. CI checks all targets and runs strict Clippy in each mode.

cmd/racer-dataplane/alloc/.gitignore

@@ -0,0 +1 @@
+/target/

cmd/racer-dataplane/alloc/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "page-alloc"
+version = "0.1.0"
+edition = "2024"
+license = "Apache-2.0"
+publish = false
+description = "Worker-local aligned buffers and lease-fenced sparse slab storage"
+
+[features]
+default = []
+simulation = ["uring-runtime/simulation"]
+
+[dependencies]
+libc = "0.2"
+zeroize = "1"
+uring-runtime = { path = "../runtime" }