Refactor: publish a2a3 stream ownership outside the arming block

[ChaoWao]

Summary

Review follow-up to #1714 (merged as 0e3851a4). Two points from that review, no behavior change.

mark_submitted() moves out of a2a3's arming block. #1714 wrapped the AICore
submit callback's arming prologue in try/catch so an allocation or thread-spawn
failure is reported as an rc rather than grading the run Partial. That block
ended up spanning run_stream_slots_.mark_submitted(slot), which is not arming —
it publishes the slot as owned by query and drain. Nothing is broken today: the
only statement after it inside the block is the non-throwing aicore_done clearing
loop, and the rollback path runs retire_aicore(slot, Unproven), which clears
submitted. But the block's invariant — everything here is rollback-free — held
only by inspection of what happened to follow, and a2a3 and a5 drew the boundary in
different places for no stated reason. a5 already publishes its poll state after
the catch; a2a3 now does the same with its stream ownership, so the two arches
are structurally identical and the invariant is local.

The safe-versus-uncertain rule is restated on ExactLaunchTransaction. #1714's
PR body cited contracts.md for it, which is not a file in this repository — it
lives in untracked working state, so the citation resolved to nothing for any
reader. The docblock already carried the callback half of the contract; it now also
states the rule the callback exists to serve: a failure before the first
execution-visible submission rolls back clean, while an AICPU failure after a
successful AICore submission is uncertain execution that retains resources and
poisons admission.

Testing

• C++ unit tests — 89/89 pass
• Simulation — native_run_lifecycle (the prepared-collector regression barrier
  added in Fix: release prepared collectors and keep arming failures safe #1714) passes on a2a3sim

Not re-run on hardware. The moved statement is on the a2a3 onboard launch path, so
CI's st-onboard-a2a3 is the check that matters here; the full local onboard sweep
was skipped deliberately rather than held up behind a busy shared box.

Two notes carried over from the #1714 review for the record:

• The reviewer suggested the prepared-collector regression test would fail pre-fix
  under a2a3sim and so cost no device time. It does not — I re-injected the
  pre-fix gate and the case still passes on sim, because only the two onboard
  runners ever gated collector release on launched; sim's
  abandon_prepared_execution has always released them unconditionally via
  cleanup_active_run(). The barrier is real but onboard-only, which is how it was
  verified in Fix: release prepared collectors and keep arming failures safe #1714.
• The differing catch-message tails (…before any stream submission vs …before any simulated core started) are left as-is: they name their real mechanism, and
  arming failed is a common greppable stem across all four.

[coderabbitai]

📝 Walkthrough

Walkthrough

The launch flow now publishes stream-set submission after successful arming and before AICore launch. Arming failures no longer publish ownership. Native-run documentation now defines rollback and partial-launch failure states.

Changes

Launch transaction

Layer / File(s)	Summary
Post-arming publication src/a2a3/platform/onboard/host/device_runner.cpp	mark_submitted now runs after successful arming and before kernel submission. Arming failures return without publishing stream ownership.
Launch failure contract src/common/worker/native_run_execution.h	The documentation defines NotStarted rollback behavior, Partial state after AICore submission, and exception versus non-zero return classification.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• hw-native-sys/simpler#1714: Modifies the same launch arming and native-run transaction semantics.
• hw-native-sys/simpler#1700: Introduces the launch transaction refined by this change.
• hw-native-sys/simpler#1683: Changes the related DeviceRunner enqueue and launch flow.

Poem

A rabbit checks the launch with care,
No ownership blooms before arming is fair.
A failed start rolls safely back,
A partial run marks the proper track.
Clear states now guide the way—
Hop, submit, and launch today!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary refactor: moving a2a3 stream ownership publication outside the arming block.
Description check	✅ Passed	The description directly explains the code refactor, documentation update, rationale, and testing status.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/a2a3/platform/onboard/host/device_runner.cpp`:
- Around line 629-635: Update the AICore submission failure path in
ExactLaunchTransaction::run so a non-zero submit_aicore result resets or
unpublishes the stream slot after mark_submitted(slot) and before returning
NotStarted. Ensure polling no longer treats the slot as executable, while
preserving resource recovery via recover_device_or_mark_unusable.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e4e7fe2-2e19-49cf-bde5-a92f9669f4d4

📥 Commits

Reviewing files that changed from the base of the PR and between 0e3851a and b5382a3.

📒 Files selected for processing (2)

• src/a2a3/platform/onboard/host/device_runner.cpp
• src/common/worker/native_run_execution.h