fix: null-aware anti join could emit rows after a sibling probe partition saw NULL

Cargo.toml

@@ -175,6 +175,7 @@ itertools = "0.15"
 itoa = "1.0"
 liblzma = { version = "0.4.6", features = ["static"] }
 log = "^0.4"
+loom = "0.7"
 memchr = "2.8.1"
 num-traits = { version = "0.2" }
 object_store = { version = "0.13.2", default-features = false }
@@ -322,6 +323,11 @@ unexpected_cfgs = { level = "warn", check-cfg = [
     'cfg(datafusion_coop, values("tokio", "tokio_fallback", "per_stream"))',
     "cfg(coverage)",
     "cfg(coverage_nightly)",
+    # Enables the loom model-checked concurrency tests; see
+    # datafusion/physical-plan/src/joins/hash_join/probe_completion.rs.
+    # Namespaced rather than a bare `loom`, which tokio also reads and which
+    # would switch tokio itself into its loom build.
+    "cfg(datafusion_loom)",
 ] }
 unused_qualifications = "deny"
 

datafusion/physical-plan/Cargo.toml

@@ -105,6 +105,25 @@ tokio = { workspace = true, features = [
     "parking_lot",
 ] }
 
+# Model checker for the hash join probe-completion protocol; see
+# joins/hash_join/probe_completion.rs.
+#
+# Gated on `--cfg datafusion_loom` rather than declared a plain dev-dependency: loom pulls
+# in tracing-subscriber, which turns on `regex-automata`'s DFA features for
+# every crate in the workspace build. That is not inert. It changes which
+# engine the shared `regex` picks and costs enough extra stack to overflow
+# unrelated deep-recursion tests (`sql::unparser::test_tpch_unparser_roundtrip`
+# aborts in CI). Keeping loom behind its own cfg leaves the ordinary build
+# untouched.
+#
+# Run the model checks with:
+#   RUSTFLAGS="--cfg datafusion_loom" cargo test -p datafusion-physical-plan --lib loom_tests
+#
+# The cfg is namespaced because a bare `loom` is also read by tokio, which
+# would switch tokio into its own loom build and drop `tokio::fs`.
+[target.'cfg(datafusion_loom)'.dev-dependencies]
+loom = { workspace = true }
+
 [[bench]]
 harness = false
 name = "partial_ordering"