Refactor: publish a2a3 stream ownership outside the arming block

src/a2a3/platform/onboard/host/device_runner.cpp

@@ -601,11 +601,6 @@ LaunchTransactionResult DeviceRunner::launch_run(PreparedExecution &prepared, La
                         core_types[i] = runtime.get_workers()[i].core_type;
                     chip_swimlane_collector_.set_core_types(core_types.data(), num_aicore);
                 }
-                int rc = run_stream_slots_.mark_submitted(slot);
-                if (rc != 0) {
-                    LOG_ERROR("launch_run: failed to publish stream set %u: %d", slot, rc);
-                    return rc;
-                }
 
                 // Launch the AICore worker BEFORE the AICPU Run task — mirrors the a5 path
                 // so the two arches stay symmetric. First-launch latency optimization +
@@ -631,6 +626,14 @@ LaunchTransactionResult DeviceRunner::launch_run(PreparedExecution &prepared, La
                 return -1;
             }
 
+            // Publishing query/drain ownership is a state change, so it sits past
+            // the arming block: everything the block covers is rollback-free.
+            int rc = run_stream_slots_.mark_submitted(slot);
+            if (rc != 0) {
+                LOG_ERROR("launch_run: failed to publish stream set %u: %d", slot, rc);
+                return rc;
+            }
+
             LOG_INFO("=== launch_aicore_kernel ===");
             int launch_rc = launch_aicore_kernel(streams.aicore, prepared.kernel_args.device_k_args_);
             if (launch_rc != 0) {

src/common/worker/native_run_execution.h

@@ -129,14 +129,18 @@ struct LaunchTransactionResult {
  * Consumes an identity-bound permit, then submits AICore and AICPU in that
  * order. Only both submissions succeeding produces a `LaunchReceipt`.
  *
+ * A failure before the first execution-visible stream submission is safe: the
+ * run touched no stream, so it rolls back and admission stays clean. Once the
+ * AICore submission succeeds, an AICPU failure leaves execution uncertain, so
+ * the run is `Partial` — resources stay retained and admission is poisoned
+ * until a later drain or teardown proves quiescence.
+ *
  * Callback contract: a submit callback owns everything it does before it
  * attempts its real device submission, and must report such a failure as a
  * non-zero return rather than an exception. An escaping exception is therefore
- * evidence that the submission itself was attempted, and the run is classified
- * `Partial` — uncertain execution, which retains resources and poisons
- * admission. Returning non-zero from `submit_aicore` is by contrast a failure
- * before any execution-visible submission, so it stays `NotStarted` and is safe
- * to roll back.
+ * evidence that the submission itself was attempted, and grades the run
+ * `Partial`. Returning non-zero from `submit_aicore` is by contrast a
+ * before-first-submission failure, so it stays `NotStarted`.
  */
 template <typename AicoreSubmit, typename AicpuSubmit>
 struct ExactLaunchTransaction {