audit: reaudit low fixes (tx.head RAM gate, in-flight bytes, pending FIFO, cut-through batch, tapscript weight)

[rearden-grok]

Summary

Five findings from the 2026-08-28 reaudit, one commit each:

• N-L4 — tx.head rebuild workers sized at 1 GiB peak. The free-RAM gate still used 750 MiB while BDZ peel scratch + keys + g at the default 2²⁵ seal peaks around 1 GiB. Two workers on a 1.5 GiB-free host would oversubscribe. Gate and owner docs now match the peak (1.5 GiB → 1 worker; 2 GiB → 2).
• L9 — in-flight byte meter follows live creates / outs occupancy. Same-txid overwrite saturating-added another 40-byte creates listing while the HashMap still held one slot, so iflight= could exceed live Arc bytes until the older pack pruned. Charge creates occupancy on vacant insert only; subtract only when remove_keys actually drops the map entry or the CreatePin.
• L5 — pending-block eviction at the 128 cap is FIFO. stash_pending_block dropped pending.keys().next() (HashMap iteration order), so a burst could evict the body on the current header path. Insert order is tracked; the oldest hash is popped. Re-stash of the same hash keeps its place. Matches Q-60's pending FIFO.
• N-L1 — Electrum cut-through spentness is one spent.idx batch per wave. Cake historicalMode=false walked idx + body once per eligible tx (up to 16384 serial reads on the serve thread). unspent_create_vouts_batch does one spent_range_batch plus one spent-body walk per create; get_output_spender_metas_at is that walk (not one 8-byte pread per vout). Serial unspent_create_vouts results unchanged.
• L3 — tapscript empty-pubkey fail after BIP342 weight decrement. Core EvalChecksigTapscript subtracts VALIDATION_WEIGHT_PER_SIGOP for a non-empty sig, then rejects an empty pubkey. We rejected empty pubkey first, so a CHECKSIG that was also over the weight budget reported "empty pubkey" instead of "validation weight". Same reject either way; match Core's error class.

Tests

• parse_rebuild_workers_and_1gib_cap / workers_for_free_ram_1gib_head_is_not_sh_1_5gib (store)
• same_txid_overwrite_does_not_double_count_creates_bytes (query)
• pending_blocks_insert_evicts_at_cap (net)
• unspent_create_vouts_batch_matches_serial / get_output_spender_metas_at_one_walk (store); load_thin_cut_through_drops_spent_p2tr (query)
• tapscript_empty_pubkey_reports_weight_when_budget_exhausted (consensus)

Each failed red before its fix. Targeted crate tests green locally; cargo fmt clean.

Made with Cursor