Hataori Review Gate Log

Design input — Blackboard Round 3

• Artifact: /home/shinaoka/tensor4all/.pi-meetings/2026-08-21-hataori_p0_实现就绪审查/transcript.md
• SHA-256: 6cc95faf9a7f919297285109c36441c27e923a82263534b4179859c12109f436
• Participants: GPT, DeepSeek, Researcher
• Result: design input only; not a formal pre-implementation reviewer verdict
• Incorporated findings:
  • root in_place_scope mechanism and event-loop fairness;
  • whole-domain Inner without partial budgets;
  • collective preflight, private communicator, framing, and state transitions;
  • signed deterministic error reduction;
  • non-Linux affinity behavior;
  • exact rsmpi-rt pin and validation matrix;
  • explicit deferred work to prevent premature abstraction.

Pre-implementation design review

Round 1

• Artifacts: docs/design.md, docs/implementation-readiness.md, docs/review-log.md, README.md
• Reviewer selected by user: reviewer-flash-opencode-go (DeepSeek family, read-only)
• Verdict: Correct-to-merge
• Important non-blocking findings:
  1. define the preflight no-error sentinel;
  2. clarify that Communicator is the selected rsmpi trait and enumerate its used surface;
  3. pin upstream rsmpi and disable its optional/default features.
• Minor findings:
  1. define error-key overflow behavior;
  2. define local-map error stopping behavior;
  3. extend same-rank codec bypass to placement helpers;
  4. correct meeting transcript provenance.
• Fixes: all findings incorporated into the reviewed artifacts immediately after Round 1.

Round 2

• Reviewer: reviewer-flash-opencode-go (same retained review role, read-only)
• Scope: exact document state after all Round 1 fixes
• Verdict: Correct-to-merge
• Blocking findings: none
• Non-blocking findings fixed after Round 2:
  1. retitle the combined findings table;
  2. require valid error keys to be strictly less than the reserved i64::MAX sentinel;
  3. add explicit error-key-overflow, local-map error-semantics, and all-helper codec-bypass test gates;
  4. record the external transcript SHA-256 and ensure new review artifacts remain visible in the working-tree status.

Round 3 — final exact-state follow-up

• Reviewer: reviewer-flash-opencode-go (read-only)
• Scope: exact document state after every Round 2 non-blocking fix
• Verified: combined findings title, strict < i64::MAX sentinel, typed overflow/collision preflight failure, explicit acceptance gates, transcript provenance, and absence of introduced contradiction or overengineering
• Blocking findings: none
• Verdict: Correct-to-merge
• Gate status: COMPLETE — core implementation may start

Implementation task reviews

Each independently mergeable implementation step in docs/implementation-readiness.md receives its own post-diff review by the selected different-family reviewer.

Task #9 — crate and feature matrix

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Pre-implementation verdict: Correct-to-merge
• Implementer: Luna (high, write-capable)
• Scope: .gitignore, Cargo.toml, minimal src/lib.rs, and related status/evidence documentation
• Pre-review refinements applied: defer libc to the affinity task; ignore library Cargo.lock; keep distinct MPI dependency keys; assert the exact exclusivity diagnostic; enumerate valid feature sets instead of --all-features.
• Integration corrections: set honest MSRV 1.85 after dependency evidence; disable bincode’s unused derive default; make backend aliases mutually exclusive so the both-feature build reports only Hataori’s intended error; ignore local .codegraph/ state.
• Verification: default, Rayon, upstream MPI, runtime MPI, and both hybrid checks/tests/clippy/docs passed; Rust 1.85.0 check passed for all six valid feature sets; default and Rayon dependency boundaries passed; no tenferro/tensor4all dependency; exact mutual-exclusion diagnostic passed. Upstream MPI on this host required BINDGEN_EXTRA_CLANG_ARGS=-I$(gcc -print-file-name=include) because the installed libclang lacks builtin stddef.h discovery.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high; retry after initial tool-budget stop)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Non-blocking deferral: choose and add project license metadata/files before any crates.io publication; Task #9 does not publish.

Task #10 — serial map

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Pre-implementation verdict: Correct-to-merge
• Implementer: Luna (high, write-capable)
• Scope: unconditional serial map, non-generic MapError, bounded UTF-8 message handling, rustdoc, and focused tests
• Pre-review refinements applied: derive Debug; fix accessor signatures; document zero-based/stop/drop/bounds behavior; avoid post-1.85 UTF-8 APIs; test exactly-once, boundary straddle, and non-Send borrowed types/state.
• Integration verification: default tests and doctest pass on current and Rust 1.85; all feature-set gates are run before push.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Non-blocking note: the crate-visible 4096-byte cap is retained for later PmapError reuse.

Task #11 — Domain and RAII admission

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; retry after timeout)
• Pre-implementation verdict: Correct-to-merge
• Implementer: Luna (high, write-capable)
• Scope: dependency-free DomainId, Place, sequential Domain, typed validation errors, and nonblocking RAII DomainAdmission
• Pre-review refinements applied: name NegativeRank; expose only DomainId::get; derive Debug; omit speculative guard accessors/auto-trait controls; defer the MPI pmap reentrancy guard to the first pmap task.
• Integration verification: ID/Place validation, sequential facts, nested contention, success/error/unwind release, deterministic scoped cross-thread contention, and runnable rustdoc are covered; all feature-set gates run before push.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none

Task #12 — Rayon local execution and affinity

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Pre-implementation Round 1 verdict: Changes requested
• Required design fixes: return typed MapInError; make Outer fully evaluate for deterministic lowest-index errors; wait for every non-panicking managed worker start hook via a bounded channel; do not expose the raw Arc<ThreadPool>.
• Fixes applied: docs/design.md §§3/5/6/15 and readiness Steps/tests now define the error split and precedence, deterministic Outer contract, bounded worker-start reporting, and no raw-pool API.
• Follow-up pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Follow-up pre-implementation verdict: Correct-to-merge
• Implementer: Luna (high, write-capable; continued after bounded timeouts)
• Scope: LocalMode, typed MapInError, explicit-pool map_in, managed/external domains, Linux pinning, non-Linux declared placement, constructor and execution tests
• Integration corrections: split start-handler CPU ownership from report validation; use one total startup deadline; import only required Rayon iterator traits; preserve raw pool access as crate-private only.
• Integration verification: 28 Rayon unit tests and 3 doctests pass; all six feature-set checks/tests and Rust 1.85 Rayon checks pass; full lint/doc matrix is run before push.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Non-blocking notes: defensive unreachable worker-index sentinel and the deterministic Outer second pass are retained as simple, safe implementation choices.

Task #13 — wire codec and signed error keys

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; retry after timeout)
• Pre-implementation verdict: Correct-to-merge
• Scope: MPI-feature-gated fixed header/codec/conversion primitives and deterministic signed error-key arithmetic; no MPI calls, scheduler, transport trait, or same-rank helper
• Pre-review refinements applied: use a 28-byte header without speculative reserved bytes; keep wire/error types crate-private until a public PmapError consumer exists; document status as a checked tag with payload schemas owned by later consumers; defer collective-helper message kinds.
• Implementer: Luna (high, write-capable; parent completed integration after bounded timeout)
• Scope: 28-byte checked header, bincode2 fixed/LE/full-consumption codec, conversion bounds, signed error keys and preflight candidates
• Integration corrections: fixed the exact-overflow boundary assertion; added a narrowly reasoned module-level dead-code allowance because this independently pushed primitive slice precedes its Task #14/#15 consumers. The allowance must be removed when those consumers land.
• Integration verification: 9 wire tests plus all existing tests pass under the runtime MPI feature; full feature/lint/doc matrix runs before push.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Non-blocking coverage notes (world-size decode guard and oversized-header decode branch) are deferred to the final Task #19 coverage audit; shared validation paths are already covered.

Task #14 — pure scheduler state machine

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Pre-implementation Round 1 verdict: Changes requested
• Required design fixes: reject root dispatch while running without mutation; validate success completions even after failure; remove speculative separate TaskId; pin internal accessor/error-completion/extraction contracts and deterministic skew metric.
• Fixes applied: P0 uses checked original indices as task keys and batch IDs from zero; root-running dispatch is a state-preserving error; all completion metadata is two-pass validated after failure and successful values are then discarded; readiness tests define exact skew and drain assertions.
• Follow-up pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; retry after timeout)
• Follow-up pre-implementation verdict: Correct-to-merge
• Implementer: Luna (high, write-capable; parent completed integration/test repair after bounded timeouts)
• Scope: private FIFO coordinator, root/remote capacity-one lanes, checked batches, transactional completions, failure/drain transitions, ordered extraction, deterministic skew tests
• Integration corrections: fixed generic ownership moves, aligned tests to rank-aware completion APIs, replaced an invalid skew trace with real READY/completion scheduling, and removed lint-only test issues.
• Integration verification: 13 scheduler tests pass under the runtime MPI feature; full feature/lint/doc matrix runs before push.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Reviewer-requested coverage added: duplicate and out-of-order completion metadata both return typed errors with state/results unchanged, then a valid retry succeeds.
• is_quiescent is retained for Task #15 transport termination and must become a real consumer there.

Task #15 — upstream MPI-only pmap

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; retry after timeout)
• Pre-implementation Round 1 verdict: Changes requested
• Required design fixes: reject an agreed root outside the communicator range; release a running lane after corrupt completion metadata using coordinator-pinned batch state rather than the untrusted received batch ID.
• Fixes applied: preflight now validates 0 <= root < world_size; scheduler/transport contract adds dedicated root/remote protocol-error completion transitions that derive the batch ID from RunningMeta, mark failure, clear pending, and return the lane to idle for READY→STOP.
• Follow-up pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; two bounded retries after tool timeouts)
• Follow-up pre-implementation verdict: Correct-to-merge
• Implementer: Luna (high, write-capable; parent completed production integration after repeated bounded timeouts)
• Scope: public MPI-only pmap, private communicator/preflight, blocking worker/root loops, scheduler protocol-error release, signed winner convergence, and MPI smoke example
• Integration corrections: fixed root fairness and failed-result extraction; kept remote candidates owned by reporting workers; winner rank now broadcasts class/key/message; added domain admission/thread-main/root-range preflight; added callback abort path, protocol-error reporting, and scheduler consumer visibility.
• Integration verification: upstream MPI library tests/clippy and mpiexec smoke at n=1/2/4 pass; full matrix runs before push.
• Post-implementation Round 1 verdict: Changes requested
• Blocking fix: every post-preflight root_loop/worker_loop error now calls private-communicator MPI_Abort(72) and every convergence-broadcast defensive failure calls MPI_Abort(73), so no rank returns while peers remain in blocking transport/collectives.
• Follow-up post-implementation reviewer: reviewer-flash-opencode-go (read-only, high; retry after tool-budget stop)
• Follow-up post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Non-blocking future hardening: Task #19 must inject malformed frames and verify recoverable in-band paths where promised; unexpected non-folded paths are deliberately abort-only.

Task #16 — rsmpi-rt backend parity

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; retry after timeout)
• Pre-implementation Round 1 verdict: Changes requested
• Clarification/fixes: Task #16 is MPI-only runtime parity; Task #17 owns rsmpi-rt,rayon hybrid pmap. A checked script must poison build-time MPI/C tool discovery, prove dependency-tree exclusion, build the runtime example, use an absolute per-rank MPI_RT_LIB, run n=1/2/4 with whole-process-group timeout, and prove invalid/unset library fails without fallback. MPIwrapper fixture commit is recorded before execution.
• Follow-up pre-implementation verdict: Correct-to-merge
• Implementer: Luna (high, write-capable; parent integrated the runtime fixture script and upstream pin)
• Scope: runtime-only smoke example, poisoned no-system-MPI build/dependency-tree gate, negative loader checks, and shared-implementation parity at n=1/2/4
• Upstream blocker found by the acceptance gate: pinned rsmpi-rt loaded MPIABI data objects incorrectly, resolved native MPI_* dependencies instead of MPIABI_*/MPIXABI_* adapters, and used the wrong LP64 MPI_Status size/alignment. The separately gated upstream fix merged as tensor4all/rsmpi-rt#6, commit 6db6a2d6f96115b17c9a925e53ce719797c15dbb, after all ten CI checks passed.
• Runtime fixture: MPIwrapper commit 966f4231c96153a08295fc7d0bcbd65e916a73fd.
• Integration verification: poisoned fresh-target check/build and dependency exclusion pass; unset/invalid MPI_RT_LIB fail without fallback; runtime pmap smoke passes under mpiexec n=1/2/4 with empty input, batch size two, ordering, converged user error, and reuse.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high; bounded retry after tool timeout)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none

Task #17 — hybrid pmap and root compute

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; bounded retry after initial tool timeout)
• Pre-implementation Round 1 verdict: Changes requested
• Required design fixes: make root panic/channel-disconnect directions explicit; pin scope join-before-return/unwind for borrowed jobs; reject entry from every Rayon worker including the selected pool; state provided-thread-level and no-worker-MPI rules; make trace evidence, not payload-size timing, prove rendezvous progress.
• Fixes applied: capacity-one outcome protocol and abort ownership are normative; Rayon joins scoped jobs before return/unwind; hybrid entry requires the MPI main/initialization thread outside all pools; provided FUNNELED or stronger is accepted while SINGLE is rejected; the ≥1 MiB fixture uses a private serviced-header-before-local-completion trace plus payload integrity and a whole-group watchdog.
• Follow-up pre-implementation verdict: Correct-to-merge
• During implementation, FUNNELED analysis exposed that a Rayon-worker rank cannot safely join an MPI preflight merely to report its invalid context. Implementation stopped and the design gate was reopened.
• Corrected pre-implementation rounds: Changes requested until the portable boundary was exact. The final contract locally rejects exactly rayon::current_thread_index() == Some before any state/MPI call, documents rank disagreement as collective caller misuse, and empirically pins plain/custom/global worker, install, scope, and in_place_scope contexts in a Rayon-only guard test.
• Corrected pre-implementation final verdict: Correct-to-merge
• Implementer: Luna (high, write-capable; two bounded continuation timeouts), with parent completion of the event loop, fairness buffering fix, integration examples, and watchdog gates.
• Scope: shared admitted local-mode kernel; hybrid worker execution; root in_place_scope coordinator with capacity-one outcome channel; alternating local/MPI_Iprobe event selection; both MPI backends; world-size-one/error/reuse/rendezvous/panic watchdog coverage.
• Integration correction: a completed local outcome is retained when fairness selects a simultaneously ready remote event; it is never consumed and dropped before its turn.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high; evidence-preserving bounded retry after repository-tool timeouts)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Reviewer-requested hardening: added a focused disconnected-local-sender test proving the chooser selects the abort path immediately.

Task #18 — collective placement helpers

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; bounded retry after repository timeout)
• Pre-implementation verdict: Correct-to-merge
• Pinned implementation requirements: all helpers execute the identical preflight sequence before branching; scatter ownership uses Vec<Option<T>> and take without cloning; each planned receive drains header and actual payload before validation; no ? return occurs between collective phases; lowest reporting rank owns the bounded converged error.
• Implementer: Luna (high, write-capable; bounded timeout after initial placement/wire slice), with parent completion of convergence, ownership, drain-safe decoding, exports, shared backend smoke, and watchdog integration.
• Scope: public broadcast/scatter/gather, PlacementError, dedicated checked wire kinds, private communicator isolation, pre-encode and post-transport convergence, rank-order gather, root owned-move bypass.
• Integration corrections: removed duplicate receives/decodes, made gather encode/decode failures participate in the same phase on every rank, retained the first root decode failure while draining all sources, and broadcast bounded error bytes rather than mutating a String buffer.
• Verification: both backends n=1/2/4, arbitrary roots, operation/root/shape mismatch, pretraffic encode and postdrain decode errors, original-communicator tag isolation, empty/UTF-8/2 MiB/reuse, size-one unencodable and non-Send owned values, watchdog, feature+Rayon compile matrix.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high; final bounded evidence retry after repository-read timeouts)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none

Task #19 — complete core acceptance matrix

• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high; bounded retry after timeout)
• Pre-implementation Round 1 verdict: Changes requested
• Required fixes: add an explicit fault-free control; assert both assigned fault channels rather than only the final winner; add root/whole-job watchdogs; enforce future MPI-call assertion coverage; pin receive-before-decode length validation.
• Fixes applied: test-only assignment/error counters, exact winner and reuse checks, bounded marker plus process-group watchdog, cfg(test) zero-release-overhead mpi_call!, balanced source scanner, and malformed-length drain test are mandatory. Dependency-internal MPI calls are explicitly outside the Hataori-owned boundary.
• Follow-up pre-implementation verdict: Correct-to-merge
• Implementer: Luna (high, write-capable; bounded timeout after the initial MPI-call assertion slice), with parent completion of deterministic fault seams, source scanner, downstream compile fixtures, orchestration, CI, and acceptance ledger.
• Scope: cfg(test) MPI-main assertions and one-shot fault traces; simultaneous user/decode drain/reuse test; size-one codec counters; delayed/extra-rank smoke; compile-pass/fail fixtures; one-command core matrix; pinned-source CI.
• Verification: scripts/check-core.sh passed in full with both MPI backends, all six feature sets, Rust 1.85, all-target clippy/doc, poisoned runtime build, n=1/2/4 pmap/hybrid/placement, rendezvous/panic/fault watchdogs, source-boundary scanner, dependency trees, and downstream compile boundaries.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only; bounded evidence retry after repository timeout)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• CI remediation: the first Task #19 workflow run reached the MPI matrix but Open MPI rejected n=4 on a two-slot runner. All OpenMPI-only launch paths now add --oversubscribe without reducing rank coverage; the reviewer confirmed the delta Correct-to-merge and the full local core matrix passed again.

Task #20a — tenferro adapter foundation

• Design slice: docs/design/tenferro-adapter.md
• Implementer: Luna (high, write-capable) performed the initial repository/API pass but timed out before edits; the parent agent completed the same approved implementation slice.
• Pre-implementation reviewer: reviewer-flash-opencode-go (read-only, high)
• Initial verdict: Changes requested
• Corrections: replaced the proposed admission-state observation with an explicit admitted-Inner caller contract plus tenferro’s shared hard entry guard; documented the one public pool-handle seam, guard-enforced Outer rejection, exact workspace/MSRV mechanics, exact Faer and no-arbiter source evidence, and non-vacuous thread observations. The reviewer’s apparent missing-upstream-API findings came from its stale local tenferro branch and were rechecked against exact merge commit a21a4c602fc6700b9bc0c3f1b14ebd19b9d7ec45.
• Corrected pre-implementation verdict: Correct-to-merge
• Implementation discovery: exact-revision runtime testing showed tenferro’s caller-managed collision guard panics instead of returning a typed error. The design added a nonblocking adapter-local RAII entry gate solely to convert ordinary concurrent/recursive adapter entry into typed ConcurrentEntry; it carries no capacity/admission policy and leaves Hataori’s running slot as the sole coarse admission.
• Design-delta reviewer verdict: Correct-to-merge
• Ownership preflight: the borrowed constructor could create independently guarded adapters for one Domain. TenferroDomain now consumes and owns the non-Clone domain and exposes only domain(), giving one adapter gate per domain value without core state or a registry.
• Ownership-delta reviewer verdict: Correct-to-merge
• Verification: scripts/check-tenferro.sh passed (adapter tests/doctests, all-target clippy -D warnings, docs -D warnings, exact dependency boundaries, core Rust 1.85 default/Rayon); scripts/check-core.sh also passed its complete six-feature, MPI/rsmpi-rt n=1/2/4, watchdog, compile-boundary, lint, doc, and MSRV matrix.
• Post-implementation reviewer: reviewer-flash-opencode-go (read-only, high; bounded finalization after full-diff inspection exhausted its reporting turn budget)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none

Phase A-1 — immutable legacy performance runner

• Design slice: docs/design/legacy-performance-runner.md
• Reviewer selected by user: reviewer-flash (DeepSeek family, read-only, high; reviewer-flash-opencode-go was unavailable)
• Initial attempt: timed out before producing a verdict; no gate credit was assigned.
• Exact-state retry verdict: Correct-to-merge
• Blocking findings: none
• Verified: immutable full-SHA Hataori pin plus lockfile guard, operation-only timing, deterministic value-dependent workload/checksum, MPI/Rayon feature compatibility, raw-record integrity, bounded smoke coverage, and an explicit block on candidate measurements until the next manifest/statistics slice lands.
• Non-blocking implementation notes: pin the runner’s direct MPI dependency exactly to =0.8.1, include one world-size-two hybrid smoke case, and include the warmup count in each raw record.
• Gate status: COMPLETE — Phase A-1 implementation may start
• Implementer: luna-implementer (GPT family, write-capable) began the runner slice; after two bounded timeouts, the parent completed integration under the same approved design.
• Implementation verification: all four feature sets passed tests and clippy with -D warnings; all four passed Rust 1.85 checks; scripts/check-legacy-runner.sh passed serial, all Rayon modes, MPI world sizes one/two, all placement helpers, and two-rank prefetched hybrid pmap with process-group watchdogs.
• Post-implementation reviewer: reviewer-flash (DeepSeek family, read-only, high)
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Non-blocking notes, with no extra review round requested: align the design’s sample record/input wording, strengthen later orchestrator field validation, avoid misleading mpi-only thread metadata, and make hosted MPI absence fail closed when the manifest/orchestrator slice adds an explicit CI mode.
• Gate status: COMPLETE — Phase A-1 is ready to merge

Phase A-2/3 — protocol and transport foundation

• Design slice: docs/design/phase-a-transport-foundation.md and Phase A requirements in docs/design/distributed-runtime.md §§15.3/20/21.
• Reviewer selected by user: reviewer-flash (DeepSeek family, read-only, high; reviewer-flash-opencode-go was unavailable).
• Post-implementation review: two 60-second evidence attempts expired without a verdict; no gate credit was assigned. The same required review then read the exact remaining implementation ranges under a bounded continuation.
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none.
• Verified: shared atomic close/reservation/RAII rollback, exact queue/byte accounting, TCP partial-frame and partial-write bounds, terminal cleanup, MPI chunk/reassembly bounds, and backend release paths.
• Non-blocking finding fixed before submission: an unreachable-after-validation MPI encode failure now preserves the ticket/reservation, releases accounting, and emits SendFailed, matching TCP. A focused regression test preserves the release metadata. Per the selected minimal-review policy, a non-blocking fix does not trigger another review round.
• Verification: scripts/check-runtime-foundation.sh passed 30 MPI-feature unit tests, default/MPI clippy, rustdoc, Rust 1.85, backend scanners, TCP smoke, and MPI n=1/2/4; the bounded core matrix, immutable runner, performance manifest, and rendered docs also passed.
• Gate status: COMPLETE — Phase A-2/3 is ready to merge

P1 — bounded prefetch

• Design slice: docs/design/bounded-prefetch.md plus the P1 amendments in docs/design.md and docs/implementation-readiness.md
• Reviewer selected by user: reviewer-flash-opencode-go (DeepSeek family, read-only, high)
• Initial verdict: Changes requested
• Blocking finding: a current-batch error while a prefetched batch existed did not normatively retain the prefetched RunningMeta; following the P0 transition would strand its later RESULT in a metadata-less state and abort instead of draining.
• Fix: every current completion in Running(current, prefetched) now consumes only pinned current metadata, retains and promotes the prefetched metadata, sends STOP to its next READY after failure, validates its result in Stopping(prefetched), and then accepts DRAIN; corrupt received IDs cannot overwrite either pinned identity.
• Additional clarifications: removed the duplicate chart edge, added the continuing READY/TASK edge, made preflight flag agreement and MPI-only rejection explicit, and pinned the remote in_place_scope plus capacity-one outcome mechanism.
• Exact-state follow-up verdict: Correct-to-merge
• Blocking findings: none
• Implementation safety delta: once a remote N+1 callback is live, failures in the next READY/header/kind path or preceding RESULT encode/send abort immediately from the MPI init-thread scope body instead of deferring abort behind scoped join; fully received payload decode failures remain recoverable typed outcomes.
• Safety-delta initial verdict: Changes requested (correct the join rationale, enumerate every live-job error site, and require a non-vacuous subprocess watchdog).
• Safety-delta fixes: pinned MPI_Abort(75), the join-before-abort/unmatched-frame rationale, exact live-job sites, unchanged root/P0 behavior, and a result-serialization fault with a deliberately live N+1 callback.
• Safety-delta exact-state verdict: Correct-to-merge
• Gate status: COMPLETE — P1 bounded-prefetch implementation may start
• Implementation commit reviewed: f7050ad (feat: add bounded hybrid prefetch, merged as PR #3 in d829280); the hash previously recorded here referred to a pre-merge revision that is not in this repository’s history
• Post-implementation reviewer: reviewer-flash-opencode-go (DeepSeek family, read-only, high)
• Full-diff evidence: all 1,864 lines / 77,341 bytes of /tmp/hataori-p1-full.diff inspected with current-source context
• Post-implementation verdict: Correct-to-merge
• Blocking findings: none
• Non-blocking coverage findings fixed before submission: execute the upstream MPI-only smoke rather than compile it only; exercise prefetched batch size greater than one; assert a corrupt current ID leaves prefetched metadata and pending work unchanged.
• Retained non-blocking notes: direct abort(75) conservatively covers a few no-successor cases, and the deterministic overlap handshake may have both adjacent callbacks waiting on the same task-transfer marker; neither weakens the contract.

Phase D explicit migration review record

• Design: docs/design/phase-d-migration.md
• Reviewer selected by the user: reviewer-flash (DeepSeek family, read-only, high)
• Review attempts: two 60-second bounded consultations. Both stopped during evidence gathering before reading the complete design and produced no verdict. Neither attempt is recorded as review-gate credit, and neither reported a certified blocking finding.
• Implementation owner: parent agent; no implementation was delegated while the design lacked a reviewer verdict.
• Parent preflight corrections before final validation: preserve a migration lease pin; close admission behind placement tickets; prevent prepared-slot collection during activation; release redirect dedup state before same-ID retry; preserve authority lifetime across repeated migration; retire remote residents after final lease/root release; recover dropped freezes by TTL; reject snapshots that exceed protocol segment/byte limits.
• Verification: scripts/check-phase-d-migration.sh plus Phase A-C/core/docs regression lanes. See phase-d-acceptance-ledger.md and the Phase D worklog.
• External verdict status: NOT OBTAINED — reviewer timeout; no claim of an independent Correct-to-merge verdict.

Phase E algorithms design review record

• Design: docs/design/phase-e-algorithms.md
• Reviewer selected by the user: reviewer-flash (DeepSeek family, read-only, high)
• First bounded attempt exhausted its turn budget before reading the primary document and received no gate credit.
• Focused continuation reviewed the complete design against the Phase E, placement, lowering, boundedness, and performance contracts.
• Verdict: Correct-to-merge
• Blocking findings: none.
• Non-blocking clarifications fixed before implementation: explicitly defer barriers/reductions and state boolean prefetch depth as one versus two batches per target.
• Gate status: COMPLETE — Phase E implementation may start.
• Implementation: parent-owned runtime/facade integration plus a bounded luna-implementer algorithms-crate slice completed by the parent after the worker exhausted its turn budget.
• Post-implementation reviewer: reviewer-flash (read-only, high); two broad attempts timed out during evidence gathering, followed by one focused source continuation.
• Post-implementation verdict: Correct-to-merge; no blocking finding.
• Reviewer caveat: the final bounded session did not re-read the complete batch.rs tail, so parent preflight and deterministic algorithm/TCP/MPI gates remain the evidence for that portion.