feat(channel): select — ready-index wait over multiple receivers

select(&[&dyn Selectable]) -> usize registers (pid, epoch) in every arm
under one wait epoch, parks once, and returns the first ready index in
documented priority order (BEAM-style; no fairness promise). A closed arm
counts as ready — and stays ready forever, so callers drop it from the set
once observed. Losing arms need no cancellation pass: the winning wake
consumed the epoch, so their registrations die at their wakers' failed CAS
or are overwritten by the receiver's next wait on that channel (the
single-receiver debug_asserts relax to 'none or own pid' accordingly).

The one genuinely new protocol piece is the no-park exit: returning with an
arm ready at registration time leaves earlier arms holding LIVE-epoch
registrations, whose wakes could fault a later one-shot park as a pending
notification. scheduler::retire_wait closes it — bump the epoch (in-flight
wakes die at their CAS), eat a notification that already landed
(StateWord::clear_notify), then re-observe the stop flag, in that order.
Proved by the new loom theorem retire_eats_late_arm_notification; the
integration probes in tests/select.rs fire stale loser-arm wakes and assert
a subsequent sleep's one-shot park holds its full duration.

src/slot_state.rs

@@ -321,6 +321,49 @@ impl StateWord {
         }
     }
 
+    /// Eat a pending notification: RunningNotified → Running, epoch
+    /// preserved; no-op on Running. Called by the RUNNING actor itself, on
+    /// the no-park exit of a wait it registered for but never parked on
+    /// (`select` returning a ready arm at registration time), AFTER bumping
+    /// the epoch and BEFORE re-checking its stop flag:
+    ///
+    /// - post-bump, the only wakers that can have set RunningNotified are
+    ///   ones stamped with the just-retired epoch (a select arm) or a
+    ///   terminal wildcard (`request_stop`);
+    /// - the caller's stop-flag check AFTER the clear catches the terminal
+    ///   case (the flag is set before the wake fires), so eating its
+    ///   notification loses nothing — and a stop arriving later re-notifies
+    ///   a Running word as usual;
+    /// - what remains eaten is exactly the stale arm wake that would
+    ///   otherwise fault the actor's next one-shot park.
+    ///
+    /// Returns whether a notification was eaten.
+    pub(crate) fn clear_notify(&self, gen: u32) -> bool {
+        loop {
+            let w = self.load();
+            debug_assert!(
+                matches!(word_state(w), ST_RUNNING | ST_RUNNING_NOTIFIED)
+                    && word_gen(w) == gen,
+                "clear_notify from invalid word {w:#x}"
+            );
+            if word_state(w) != ST_RUNNING_NOTIFIED {
+                return false;
+            }
+            if self
+                .0
+                .compare_exchange(
+                    w,
+                    pack(gen, word_epoch(w), ST_RUNNING),
+                    Ordering::AcqRel,
+                    Ordering::Acquire,
+                )
+                .is_ok()
+            {
+                return true;
+            }
+        }
+    }
+
     /// Finalize: Running | RunningNotified → Done, epoch zeroed (wait
     /// identity never crosses an occupancy). Called by the scheduler that
     /// just ran the actor to completion (so those are the only legal prior
@@ -499,6 +542,38 @@ mod loom_tests {
         });
     }
 
+    /// The retire theorem — `select`'s no-park exit. An actor opens a wait
+    /// and registers, then finds an arm ready and returns WITHOUT parking;
+    /// a loser arm's waker fires concurrently, stamped with the live epoch.
+    /// The exit retires the wait (bump, then eat): in every interleaving
+    /// the run ends on a clean Running word — no pending notification
+    /// survives to fault the actor's next one-shot park — and the waker
+    /// never enqueues.
+    #[test]
+    fn retire_eats_late_arm_notification() {
+        loom::model(|| {
+            let word = Arc::new(StateWord::new());
+            word.publish_queued(0);
+            assert!(word.try_claim(0));
+            let epoch = word.begin_wait(0); // select opens + registers
+
+            let w = word.clone();
+            let waker = thread::spawn(move || w.unpark(0, Some(epoch)));
+
+            // No-park exit: bump (invalidates in-flight wakes), then eat
+            // (consumes one that already landed).
+            let _ = word.begin_wait(0);
+            word.clear_notify(0);
+
+            assert_ne!(waker.join().unwrap(), Unpark::Enqueue);
+            assert_eq!(
+                word_state(word.load()),
+                ST_RUNNING,
+                "stale arm wake survived the retire"
+            );
+        });
+    }
+
     /// The ABA theorem: a stale-generation unpark racing reclaim + reuse can
     /// never touch the slot's new occupant.
     #[test]