ci: clarify compaction correctness baseline vs expanded lanes

Author: belveryin

.github/workflows/rust.yml

@@ -48,8 +48,8 @@ jobs:
       - name: Run cargo test
         run: cargo test --verbose --workspace
 
-  compaction-correctness:
-    name: compaction correctness
+  compaction-correctness-deterministic:
+    name: compaction correctness (required deterministic baseline)
     runs-on: ubuntu-latest
     needs: build
     steps:
@@ -58,11 +58,33 @@ jobs:
       - name: Rust Cache
         uses: Swatinem/rust-cache@v2
         with:
-          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('**/Cargo.toml') }}-compaction-correctness
+          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('**/Cargo.toml') }}-compaction-correctness-deterministic
           cache-on-failure: false
 
-      - name: Run compaction correctness gate (default seeds)
-        run: cargo test --package tonbo --lib compaction_correctness_ -- --nocapture
+      - name: Run deterministic compaction correctness baseline (exclude randomized model)
+        run: cargo test --package tonbo --lib compaction_correctness_ -- --skip compaction_correctness_model_randomized --nocapture
+
+  compaction-correctness-randomized-expanded:
+    name: compaction correctness (optional expanded randomized sst+reopen)
+    runs-on: ubuntu-latest
+    needs: build
+    continue-on-error: true
+    env:
+      TONBO_COMPACTION_MODEL_SST: "1"
+      TONBO_COMPACTION_REOPEN: "1"
+      TONBO_COMPACTION_EAGER_FLUSH: "1"
+      TONBO_COMPACTION_SEED: "1,13,57,101,1009"
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ hashFiles('**/Cargo.toml') }}-compaction-correctness-randomized-expanded
+          cache-on-failure: false
+
+      - name: Run expanded randomized model (sst+reopen enabled)
+        run: cargo test --package tonbo --lib compaction_correctness_model_randomized -- --nocapture
 
   coverage:
     name: coverage (llvm-cov)

docs/rfcs/0012-compaction-correctness-gate.md

@@ -23,7 +23,7 @@ Compaction rewrites physical layout and can silently break logical correctness.
 ## Non-Goals
 
 - Performance benchmarking or tuning.
-- CI gating or long-running fuzzing (added later once validated).
+- Long-running fuzzing as a required CI blocker.
 - Full coverage of crash recovery or manifest/GC interactions (follow-on work).
 - Guaranteeing correctness for future range tombstones or remote compaction (follow-on work).
 
@@ -114,6 +114,11 @@ The gate must emit enough context to replay failures:
 
 Initial coverage targets **minor compaction** and the current read path across mutable + immutable + SST layers. Major compaction, manifest/GC, and remote execution are validated in Phase 1+ after the minimal gate is stable.
 
+### CI Execution Lanes
+
+- **Required deterministic baseline:** run `compaction_correctness_` while skipping `compaction_correctness_model_randomized`. This keeps the required gate reproducible and focused on deterministic scenario coverage.
+- **Optional expanded randomized lane:** run `compaction_correctness_model_randomized` with `TONBO_COMPACTION_MODEL_SST=1`, `TONBO_COMPACTION_REOPEN=1`, and `TONBO_COMPACTION_EAGER_FLUSH=1` (with explicit seed list) to intentionally exercise SST/compaction/reopen model behavior.
+
 ## References
 
 - [Model-based testing](https://en.wikipedia.org/wiki/Model-based_testing)
@@ -125,6 +130,6 @@ Initial coverage targets **minor compaction** and the current read path across m
 
 - Add tombstone pruning safety tests and MVCC watermark checks.
 - Extend coverage to major compaction, manifest updates, and GC integration.
-- Enable CI gating and nightly fuzzing once test stability is confirmed.
+- Promote expanded randomized coverage from optional to required once SST/page-index stability is complete.
 - Add crash/reopen validation as part of the gate.
 - Add range tombstone semantics when supported.

src/db/tests/core/compaction_correctness.rs

@@ -643,6 +643,8 @@ struct ModelRunner {
 
 impl ModelRunner {
     async fn new(seed: u64, name: &str) -> Result<Self, Box<dyn std::error::Error>> {
+        // Baseline runs leave SST/reopen off for deterministic behavior. Expanded CI coverage
+        // opts into randomized SST/compaction/reopen paths via these env toggles.
         let allow_reopen = env::var("TONBO_COMPACTION_REOPEN").is_ok();
         let allow_sst = env::var("TONBO_COMPACTION_MODEL_SST").is_ok();
         let eager_flush = allow_sst