TENT design-reference map

OrbiTE is an independent transfer engine whose design follows Mooncake TENT; it is not wire-, API- or configuration-compatible with TENT. This map records module correspondence and deliberate differences, not compatibility promises. Delivery and evidence live in the completion plan and qualification ledger.

The selected purpose is a transfer engine for CPU DRAM, NVIDIA GPUs and local file/SSD storage that carries every end-to-end OrbitKV cache path, including GPU↔DRAM and GPU↔SSD. CPU and CUDA are the two implementation platforms. GPU vendor selection does not restrict ordinary CPUs, SSDs or compatible network devices to NVIDIA products. CPU-only operation remains supported. Each NVIDIA GPU model/topology needs its own qualification.

The upstream inventory below makes this selection explicit: 10 transport types apply to CPU/NVIDIA; seven require excluded accelerator platforms and UB requires the excluded URMA/UnifiedBus platform. Optional means opt-in build/runtime dependencies, not permission to leave an in-scope requirement unfinished. This target does not claim every upstream platform.

Frozen reference

Reference	Revision	Purpose
Mooncake v0.3.14, released 2026-11-03	e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c	CPU/NVIDIA implementation and differential-test baseline, read through OrbitInfra/Mooncake
Previous baseline	e2d6e8e0f2df113d84f9e39379f98c4b67b199ab	Historical reviews, oracle runs and installed profiles retain this revision where recorded
Initial OrbiTE source	b7e178fe2ac59e6a3ab19037f068236fb083292a	Documents the starting point

The reference exposes 33 C functions and 18 named selectable transport types. There are 19 transport source directories because bufio also exists, but it is not registered by the frozen runtime loader. The test tree contains 88 C++ files ending in test.cpp; that is a source inventory, not a count of executed or passing tests. Compile guards, SDK availability and missing devices affect which tests can run. See the API, types, loader and test tree.

Use implementation, public headers and reachable tests together as the oracle. Resolve contradictory prose against those sources and record the decision. Examples already found:

• Submit-stage failover is implemented in commitPreparedSubmit and covered by engine_failover_e2e_test.cpp; earlier paragraphs in the failover guide still describe it as missing.

• exportLocalSegment and importRemoteSegment return NotImplemented in the implementation. A declaration does not establish a working capability.

• Config lifecycle classes identify runtime-candidate fields and freeze a snapshot. Their presence does not establish public live configuration reload.

• The sample JSON enables some transports that the loader disables by default. Extract defaults from the consumed code, not the example configuration.

Baseline updates must be separate reviewed changes: record the new commit, diff this inventory and the tests, retain old evidence and qualify affected behavior again. Do not silently follow a moving main during implementation.

v0.3.14 delta

The release is 160 commits ahead of the previous baseline. The path-limited Git history contains 31 commits affecting 103 files under mooncake-transfer-engine/tent (14,527 insertions and 1,028 deletions). R1a changes the reference and oracle. R1b owns RDMA, R1c owns storage and CUDA, and R1d owns HP-TCP, TCP and observability. A Port row can require an upstream regression control even where an OrbiTE owner already implements the behavior. Hardware qualification stays with the artifact that ran.

Commit	Upstream change	Status	OrbiTE owner or evidence
33f5ea0f	[Build] Bump yalantinglibs to 45c6463 (#5132)	N/A	C++ build and ASIO/YLT API updates. R1a pins the new YLT archive for the native oracle. OrbiTE has no YLT runtime.
50896982	[TENT] Enable concurrent XPU host-device copies with a queue per copy (#5117)	N/A	Per-copy SYCL queues on Intel XPU. OrbiTE has no XPU platform.
e544719f	[TENT] Add lossless request and transport attempt accounting (#5094)	Port	R1d implemented. Public aliases count at admission commit. Physical attempts carry their own terminal outcome across toggles and retries. Remote staging counts each CROSS.
7d4670b6	[TransferEngine] NVLink: keep the sync memcpy fast path in TENT (#5165)	Port	R1c implemented. Single legacy NVLink tasks below the KiB threshold use cuMemcpy. A DtoD receipt includes the legacy-stream drain. Grouped copies and MNNVL keep event completion.
4c0c5e5a	[TENT] Parse MC_DISABLE_GPU_DIRECT_RDMA and MC_LOG_RDMA_SLICE_AFFINITY as booleans (#5125)	Port	The typed RDMA switches remain; legacy environment aliases were removed with configuration compatibility. Strict typed parsing is covered by config::json::tests.
fec029cc	[TENT]Fix MemFabric SDMA memory allocation and NPU transport initialization for Mooncake TENT (#4834)	N/A	MemFabric SDMA allocation, native host storage and NPU initialization depend on the excluded Ascend/MemFabric runtime.
d0144780	[TENT] Hash the batch address when picking a batch lock shard (#5095)	Already covered	OrbiTE gives each batch its own progress lock. independent_batches_progress_while_a_sibling_progress_lock_is_held exercises independent progress without address-based shard selection.
5e50b615	[TENT] Wait for in-flight io_uring I/O before freeing a sub-batch (#5068)	Port	R1c implemented. Free defers to the consumed-SQE owner. A failed wait switches to the mapped CQ. The existing destruction cutoff quarantines a missing receipt.
5805e845	[TE] hp_tcp: assign each operation to the least-loaded lane (#4935)	Port	R1d implemented. Least-loaded single-operation lanes retain rotating ties. least_loaded_lane_bypasses_a_delayed_ack_and_releases_after_completion holds one real socket while the other carries a READ and a WRITE.
956af65e	[TE/TENT] Skip remote atomic QP access when the HCA reports no RDMA atomics. (#5047)	Port	R1b implemented. Each new QP clamps both READ depths to the local HCA limits. The grant permits only READ and WRITE, including on atomic-capable HCAs.
6692af10	[TENT][FEAT] Reduce CQE Processing with Selective Signaling (#4632)	Port	R1b implemented. Default interval 1. Periodic and tail CQEs retire their own ordered group. Known partial posts, ambiguous posts, flush and probe ownership have separate controls.
d3ef7b1c	[TENT] Add metrics self-observability contract (#4938)	Port	R1d implemented. Both scrape formats report build, sampling, startup and serialization health. exporter_health_survives_pause_and_failed_serialization checks an HTTP failure and recovery.
5fa91fe1	[TENT] Add an opt-in pinned staging pool to the io_uring transport (#5012)	Port	R1c implemented. Optional page-aligned file slots are leased without waiting. Pageable fallback has a byte charge. Device fallback uses the bounded S3 proxy chunks.
c8fe63e5	[TE] TransferEngine support hixl nic topo path (#4558)	N/A	The NIC topology path is consumed by Ascend HIXL resource configuration.
b730bbae	[CI] Enable TENT runtime in T-One e2e as a parallel job (#3600)	N/A	T-One CI and build portability. The MNNVL change supplies missing pidfd syscall numbers in older C headers. OrbiTE already takes those numbers from Rust libc.
1dd37f57	[Bugfix][TENT] Fail stop on terminal RDMA teardown errors (#4383)	Port	R1b implemented. Terminal QP/MR/PD or context teardown reports Unquiesced and keeps its owners. The grant and device retention controls cover repeat close and Drop.
ddda75d3	[TENT][Bugfix] Refresh Local Rail Topology Before Slice Selection (#4708)	Port	R1b implemented. Selection reads current local paths after the peer exchange. A two-context transfer exercises a local topology change during bootstrap.
8a4d4f68	[TENT] Enable GDS on Intel XPU through a cuFile-compatible library (#4904)	N/A	Intel xFile and USE_XPU_GDS supply the XPU-only device/file route. The NVIDIA GDS capability branch keeps DRAM/file and GPU/file.
6b90ea5e	[TENT] Stage XPU buffers through host memory in io_uring transport (#4902)	N/A	Stages XPU memory through a host buffer for file I/O. OrbiTE’s accelerator path is CUDA.
8bfd2988	[Bugfix][TENT] Submit merged staging requests only once (#4797)	Port	R1c implemented. One physical staged TCP submission carries both public aliases. The source counts one Pin, Delegate, CROSS and Unpin, with bytes and guards checked.
58e243fb	[TENT][BUGFIX] Preserve mapped peer rail for wildcard targets (#4923)	Port	R1b implemented. Wildcard targets prefer the mapped healthy peer, including a lower-ranked direct peer. The request mask and current pair health bound alternatives.
6a835cbf	[TENT] Batch register MemFabric buffers to avoid aligned overlaps (#4870)	N/A	Overlapping aligned registrations and rollback are specific to the MemFabric batch API.
db4f146e	[TENT] Add intra-node PCIe P2P copies between Intel XPUs (#4379)	N/A	Intel XPU PCIe peer copies, Level Zero IPC imports and XPU-specific selector capabilities require SYCL.
a7496800	[TENT] Add asynchronous MLU host-device copies (#4720)	Port	R1c implemented. Shared controls cover submit publication before wake, scoped polling, staging-child drain and retained registration rollback. MLU and its runtime remain excluded.
dae22d47	[TENT] Do not advance the notify send slot on a failed post (#4434)	N/A	The corrected send slot belongs to the RDMA notification QP. OrbiTE notifications use local, TCP and control-RPC delivery.
b2c7d0a7	[Bugfix][TENT] Restore caller CUDA context after plugin copies (#4839)	Port	R1c implemented. The CUDA owner restores the exact binding. A handled copy or cleanup error is terminal and cannot enter host memcpy. The external plugin ABI is now out of scope; built-in copies retain the context controls.
042ab8a1	[TENT] Add Intel XPU GPUDirect dma-buf RDMA to the Transfer Engine (#4378)	OrbiTE extension (B04/F04)	XPU stays excluded. CUDA now adopts the export-first, fail-closed registration boundary from rdma/context.cpp, with explicit dma-buf/peermem policy, exact-range MRs and retained fd owners. Routes and negative controls. Installed profile unqualified.
3b08b771	[TE/TENT] Add adaptive RDMA congestion control core (#4197)	Port	R1b implemented. The opt-in rdma-adaptive shared core provides off/observe/enforce windows, generation-scoped evidence and completion classification. As in the TENT build, workers do not call it.
7540f582	[TENT] Add diagnostic core and version CLI (#4154)	Port	R1d implemented. TENT’s C++ diagnostics header and tent CLI map to the Rust version_snapshot() API and packaged orbite diagnostics version [--json] CLI. No C/C++ diagnostics header; unused redaction and external-document rendering are removed.
7a058556	fix(tent): allow CPU clients to select peer GPU TCP memory (#4410)	Port	R1d implemented. cpu_platform_can_select_peer_gpu maps the capability matrix. A separately built CPU-only requester byte-checks READ and WRITE over real TCP against a CUDA-shim source.
e3e9d70e	[Bugfix][TENT] Restore the caller’s exact CUDA context after copies (#4643)	Port	R1c implemented. The Driver guard saves the exact caller binding, including null, and checks it after pop. A failed save precedes all copies. Unproven restoration fences the owner.

Owner correspondence

Frozen TENT module	OrbiTE owner	Boundary
runtime/transfer_engine_impl, admission_queue	engine, runtime/admission_queue	Physical owners, aliases, bounded admission and no uncertain WRITE replay
runtime/segment_manager, segment_tracker	segment, runtime/segment_manager	Consumer-supplied epochs; per-peer fence, drain and sticky cleanup
runtime/proxy_manager, remote_stage_operation	runtime/proxy_manager, CUDA staging	Charged staging chunks retained until native receipts
transport/tcp, hp_tcp, shm	transport/tcp, hp_tcp, shm	Native OrbiTE bootstrap and permissions
transport/rdma, nvlink, mnnvl	transport/rdma, nvlink, mnnvl; cuda	Fallible native tables; uncertain cleanup retains owners
transport/io_uring, gds	transport/io_uring, gds	Bounded submissions and physical completion
metrics	metrics	OrbiTE names with the reference’s types, labels and buckets
common/config, python/pybind	config/json, orbite-python	Own strict JSON and Rust-shaped Python API; no compatibility layer

Settings describe OrbiTE’s units, defaults, limits and retained owners. Their design provenance belongs here, not in a public configuration contract:

Setting or operation	Frozen design reference	OrbiTE meaning
NIC preference tiers and custom topology	runtime/topology*, platform/cpu_probe.cpp	Ranked discovered NIC identities; custom ranks cannot replace physical metadata
RDMA lanes, slices, aging and bandwidth ordering	transport/rdma/workers*, quota*, bw_arbitration*	Bounded work queues, slice geometry and byte charges; priority does not release an owner
Rail health and recovery	transport/rdma/rail_monitor*	Per-pair errors, cooldown and probes; uncertain QPs remain retired
Selector, QoS, receiver credits and progress	runtime/transport_selector*, qos_contract*, receiver_credit*, progress_worker*, deadline_mlu.h	Compiled first-match policies, cumulative ledgers and bounded progress; timeout is not a receipt
HP-TCP settings and framing	runtime/hp_tcp_transport_config.cpp, transport/hp_tcp/*	Persistent IPv4 payload lanes with separate control service and explicit task/byte budgets
NVLink and MNNVL mappings	transport/nvlink/*, transport/mnnvl/*, caller-sync event handling	Retained imports and producer events; MNNVL’s threshold is recorded but does not change asynchronous dispatch
Registration lookup, file segments and notifications	runtime/transfer_engine_impl.cpp, segment_manager*, segment_tracker*	Ordered containing-range lookup, file-relative offsets and separate deliberate notification deliveries
Peer retirement	closeSegment and segment invalidation	Stronger membership fence and physical drain, rather than reversible handle invalidation
io_uring settings	transport/io_uring/*	Single-issuer file rings and bounded drain; no silent provider fallback
Metrics	metrics/tent_metrics.cpp	Reference types, labels and bucket boundaries; names, HELP text and reporter logs identify OrbiTE

Module layout, transfer behavior and documentation style follow the reference. There is no C++ runtime dependency. Safety defects are recorded with negative controls rather than copied. Timeout and cancellation never establish physical quiescence. Hardware comparisons remain profile-specific; source similarity establishes no performance result.

Runtime and service inventory

The IDs below are stable requirement identifiers. Each row needs executable acceptance cases during P0, including relevant error, concurrency and teardown cases. Source families identify where to inspect behavior; they do not imply that every branch or provider has already been qualified upstream.

ID	Required behavior	Reference source/test families	Delivery
F01	TENT configuration compatibility: out of scope by design. OrbiTE owns strict JSON, file and ORBITE_CONF snapshots	common/config remains a design reference	Superseded S17
F02	CPU/NUMA, PCI and device discovery; RDMA allow/deny lists; custom topology and priority matrices; cpu:/cuda:; strict locality; unavailable accelerator locations are rejected	runtime/topology*, platform/*, topology_priority_matrix_test, strict_local_numa_test	P1/P4/P5/P8
F03	External device plugin ABI removed and out of scope. Built-in CPU/CUDA allocation, probing, copy and context owners remain in P1/P5	device_plugin.h, plugins/*; built-in runtime/platform*, memory_prober*, platform/*	Out of scope (plugin ABI)
F04	Single/batch memory allocation and registration; permissions/options; duplicate references, range geometry, warmup/prefault, unregister and partial-failure ownership	transfer_engine_impl.cpp, segment_registry*, local_memory_lifecycle_test, coalesce_regions_test, backend buffer tests	P1/P4/P5/P8
F05	Memory/file segments, file:// addressing, open/close/info, descriptor caching/refresh, update subscription/invalidation and retry coalescing	segment*, control_plane*, segment_manager_test, segment_desc_retry_test	P2/P7
F06	P2P self-description only: segment descriptors, capabilities, registration keys and epochs. Consumer-owned discovery, membership, KV indexes and etcd/Redis/HTTP stores are out of scope. There are no metadata-server configuration keys; unknown keys are rejected. Rust peer retirement adds an endpoint/epoch fence and native drain; Python close remains reversible handle invalidation	runtime/metastore.cpp, runtime/segment_manager.cpp, runtime/segment_tracker.cpp, control_plane*; discovery boundary	P2/P9
F07	RPC bootstrap, peer probe, data READ/WRITE, notifications, Delegate/Pin/Unpin, update subscriptions; reconnect and owned handler shutdown	rpc/*, control_plane*, rpc_reconnect_test, rpc_handler_isolation_test, delegate_rpc_test	P2/P5/P10
F08	Batch capacity/IDs; READ/WRITE; partial submission; merge eligibility and public alias-to-owner mapping; per-task/list/overall status and transferred bytes	transfer_engine_impl.cpp, request_merge_test, request_submit_bench, engine_failover_e2e_test	P1/P2/P6
F09	Observational polling option, explicit progressBatch, background progress worker, bounded wake/fallback timing, terminal-state stability and deferred batch retirement	progress_worker*, progress_worker_test, runtime_queue_dispatch_test, poll_backoff_test	P1/P6
F10	Best-effort queued/posted cancellation with backend-specific support, partial progress and retention; distinguish accepted cancel from physical termination	cancelTransfer, Transport::supportsCancellation, RDMA/HP-TCP cancel tests	Every backend/P10
F11	Attached completion notifications, explicit send/receive, local and transport/RPC fallback, exactly-once logical delivery accounting, empty-poll/free conventions	local_notification_test, notification_fallback_test, transfer_engine_c.cpp	P2/P6/P9
F12	Policy ordering; priority HIGH/MEDIUM/LOW; named policy; segment, location and size filters; device masks; QP pools; explicit transport hint and unavailable-path behavior	transport_selector*, transport_hint_test, qos_contract*, qp_pool_layout_test	P4/P6
F13	All request intents: unspecified, foreground get, prefetch, migration, checkpoint, weight loading and internal staging; policy binding and merge isolation	common/types.h, qos_contract*, transport_selector_test	P6
F14	Request/byte admission; FIFO/EDF and urgency promotion; dispatch windows; staging reserves; deadline-feasibility drop; transport-aware bandwidth provider	admission_queue*, deadline_mlu.h, admission_queue_test, runtime_queue_dispatch_test	P6
F15	Per-worker priority queues, host-shared priority slots, process-local per-NIC byte accounting, named QP pools and four-resource cumulative sender credit	rdma/quota*, shared_quota*, receiver_credit*, quota_accounting_test, receiver_credit_test	P4/P6
F16	Slicing/spraying; round-robin and bandwidth-aware choices; separate selection EWMA and transmit estimate; NUMA penalties, masks and strict-local rules	rdma/workers*, bw_arbitration*, device_selector_test, bw_arbitration_test	P4/P6
F17	Submit- and completion-stage fallback; per-owner retry budgets; merged aliases; no terminal resurrection; explicit-progress versus poll semantics	transfer_engine_impl.cpp, engine_failover_e2e_test	P6/P10
F18	RDMA endpoint caches, bootstrap concurrency, per-rail health, cooldown/probe/half-open recovery, device loss, retirement and failed-cleanup quarantine	rdma/endpoint*, rail_monitor*, endpoint/rail/async-event teardown tests	P4/P6/P10
F19	Local and remote staging; delegate/pin/unpin registry; chunk buffers; mixed direct/staged requests; nested work admission, completion and proxy shutdown	proxy_manager*, remote_stage_operation*, stage_buffer_concurrency_test, proxy_shutdown_timeout_test	P5/P6/P8/P10
F20	Transfer/attempt/queue/failure-stage and deadline observations; labels and histograms; HTTP/JSON/Prometheus output; configuration, disabled mode and available-NIC load snapshots	metrics/*, common/qos_metrics*, metrics tests, getNicLoadStats	P2/P6/P9
F21	TENT API compatibility: out of scope by design. OrbiTE owns Rust and Python APIs with retained exporters and detached blocking calls	python/pybind is historical design input	Superseded S21
F22	Transport/platform feature selection, missing-provider errors, installed artifacts, SDK/runtime discovery, examples and reproducible byte-checking benchmarks	TENT/parent CMake, provider adapters, CI, benchmark sources	Every stage/P11

For F15 the frozen RDMA shared header publishes one rotating priority slot. The local selector owns NIC byte charges. QoS inherits policy fields without charging a parent or cluster budget. The private receiver ledger accepts named resources and monotone grants. Frozen TENT supplies neither a window-sizing algorithm, a dead-sender reaper nor an application-resource mapping.

Primary sources: runtime implementation, runtime directory, tests, configuration, C++ compatibility shim, Python binding, metrics and device plugin ABI.

The deadline-feasibility code’s MLU term and the Cambricon MLU device backend are separate concepts. The former does not establish framework-level local recompute: the frozen engine installs an empty local-decode suggestion hook.

Upstream transport inventory and selected scope

All 18 upstream types are accounted for; only the eight marked core are implementation targets. Capability bits and compiled providers constrain supported transfer directions. Do not infer GPU support for a transport from another transport’s platform support. Every selected row requires normal bytes, negative cases, teardown and installed-artifact gates.

ID / type	Frozen capability and special obligations	Required hardware/provider	Scope / delivery
B01 TCP	RPC data path; host/CUDA copies, retries and explicit copy failures	Two processes/hosts; NVIDIA GPU for CUDA copies	Core, P2/P5
B02 HP_TCP	CPU DRAM only; persistent worker-owned lanes, request/registration IDs, bounds and permissions, remote WRITE ACK, cancellation/drain, IPv4 static rails and large READ slicing	Two TCP hosts; multiple routed interfaces for rail gates	Core, P3
B03 SHM	Host shared mappings, offset/path and permissions, concurrent registration and retirement; CXL mount configuration and locality/default behavior	Same-host processes and actual shared backing; CXL-backed profile separately	Core, P3
B04 RDMA	Host and CUDA device memory; MR/PD/CQ/QP lifecycle, bootstrap, retries, multirail, notifications, quota, GDR capability and physical drain	Two RNIC hosts; IB/RoCE profiles, multiple rails; CUDA combinations separately	Core, P4/P5/P6
B05 NVLINK	Device/host directions actually advertised, CUDA IPC handle sharing and stream completion; no stale mapping reuse	Two local GPU processes with supported CUDA peer access	Core, P5
B06 MNNVL	CUDA fabric memory/export/import; opt-in selection, EGM option and supported directions	Supported CUDA fabric/NVLink topology, plus EGM profile where applicable	Core, P5
B07 IOURING	File segments, read/write offsets and completion/error bytes; staging where selected; short/partial/error I/O	Linux io_uring and real local files/storage	Core storage, P7
B08 GDS	Host/device-to-file directions, cuFile registration and completion/status ownership, explicit fallback behavior	NVIDIA GPU, cuFile/GDS-capable filesystem and storage	Core storage, P7
B09 UB	Host URMA transport, endpoint/device capability negotiation, jetty/JFC lifecycle, slicing/quota, retries, notifications when enabled, cancellation and quarantine	Supported URMA devices/provider on two hosts; bonding profile separately	Excluded platform
B10 AscendDirect	Host/device registration and copy, HIXL/local-copy paths, fabric memory, timeout, resource configuration and agent mode	Ascend runtime and supported HIXL topology	Excluded accelerator
B11 SUNRISE_LINK	Advertised host/device directions, registration, provider endpoint and completion lifecycle	Sunrise runtime and link devices	Excluded accelerator
B12 TPU	Host-device staging through PJRT ABI and provider bridge; ownership of pending device work	Actual supported TPU/PJRT adapter	Excluded accelerator
B13 XPU	Host-device copy and staging with native SYCL allocations/context	Intel XPU, DPC++/SYCL runtime	Excluded accelerator
B14 MLU	Host-device copy/staging, allocation and process ownership	Cambricon MLU runtime/devices	Excluded accelerator
B15 MPCOMM	Deferred: no consumer; provider unavailable	No public identity or provider	Deferred P8.1 / S25
B16 HYLINK	HIP-backed host/device directions, endpoint and registered-region lifecycle	HIP devices and compatible Hylink provider	Excluded accelerator
B17 FABRIC	Host-only libfabric transport; no GPU FI_HMEM path	NVIDIA platforms only; AWS EFA is a non-goal	Excluded by design; P8.2 / S24 removed
B18 MEMFABRIC	Ascend-backed host/device directions, dynamically loaded provider ABI, memory allocator and completion lifecycle	Ascend ACL and compatible MemFabric provider	Excluded accelerator

B17 FABRIC/libfabric is excluded by design. Its host-only path cannot carry GPU KV directly. RDMA covers InfiniBand/RoCE/Spectrum-X; NVLink and MNNVL cover NVIDIA peer fabrics. AWS consumers using NIXL can select NIXL’s own LIBFABRIC backend. Revisit only when a consumer deploys OrbiTE directly on AWS, with GPU memory (FI_HMEM) supported from the start. CUDA fabric handles are unrelated and remain in scope.

B15 MPComm is deferred because no consumer uses it and no libmpcomm provider is available; fake-provider controls would not establish a usable path. MPComm owns slicing, NIC/QP selection and workers, bypassing OrbiTE’s RDMA scheduler, credits, QoS and rail health. The frozen adapter and peer registry provide no peer close, handshake timeout or cancellation; reconnect can leak QPs. Those boundaries do not satisfy physical ownership or per-peer retirement. No MPComm identity, transport implementation or release gate is shipped. Revisit B15 if a consumer brings a provider and hardware.

Source authority: transport types, runtime loader, transport implementations and platform implementations.

The upstream’s eight platform families are CPU, CUDA, ROCm/HIP, Ascend, Sunrise, TPU, XPU and MLU. OrbiTE implements built-in CPU and CUDA owners. The other six platforms and ROCm plugin are excluded by project scope, rather than classified as missing hardware qualification. In-scope provider stubs qualify unavailable/error handling and state-machine controls only; they cannot qualify real transfers.

S22 external device plugins are removed and out of scope. Their declarations and layouts are not shipped; there is no runtime loader.

Frozen TENT builds BufIoTransport as a static target. It caches buffered fds, runs synchronous pread/pwrite at the request’s file offset and stages CUDA through host memory. loadTransports() installs only IOURING and GDS for files and never constructs BufIo. None of its behavior is reachable through the frozen loader. OrbiTE therefore has no public BUFIO transport. BufIo implementation · Frozen loader The fault-proxy transport is a test mechanism, not a nineteenth production type.

HP-TCP’s frozen scope excludes GPU memory, TLS, per-WRITE striping, dynamic rail scheduling, rail failover and transparent replay of ambiguous WRITEs. Its large READ slicing is not dynamic RDMA-style spraying. These omissions are explicit reference boundaries, not missing parity work disguised as implemented support.

OrbiTE local CUDA copy extension

S15b implements the consumer’s local GPU↔pinned DRAM copy mechanics beyond TENT’s transport surface. The DMA geometry and mapped-memory kernel follow OrbitKV’s transfer module at 93541a21. Stream-bound completions own each registered range and descriptor upload. This extension adds no transport, peer capability or wire record. Local CUDA copies

Local SSD paths and module boundary

The frozen TENT source implements both READ and WRITE for local file segments:

User-visible movement	Actual implementation path	Meaning
DRAM to/from SSD	io_uring_prep_writev / io_uring_prep_readv	Host file I/O; aligned host staging when needed
NVIDIA GPU to/from SSD through host memory	CUDA copy to/from host staging plus io_uring	A device-file route that uses DRAM
NVIDIA GPU to/from SSD through cuFile	CUFILE_WRITE / CUFILE_READ, cuFileBatchIOSubmit and completion polling	GDS API path; native direct movement requires separate evidence

See io_uring source and GDS source. These are reference implementations, not OrbiTE hardware qualification. Successful cuFile calls alone do not establish the native storage-to-GPU path; filesystem, device, topology, configuration and actual route observations matter. The NVIDIA API guide describes compatibility mode and supported memory/configuration rules.

Local file segments are part of the default build. The Linux io-uring and gds features enable the file executors. The network/memory core runs without loading storage libraries. The storage transports own byte I/O and its resources. OrbitKV retains KV indexing, placement, eviction, extents, cache policy and recovery semantics. OrbitKV’s SSD tier is expected to move its DRAM↔SSD and GPU↔SSD byte movement onto these modules; that switch is consumer integration with its own P10/P11 qualification. Comparisons explicitly enable equivalent modules on each engine.

Reference fixtures

The compatibility-only S16 inventories and codec captures are removed. tests/reference/wire/rpc.json keeps only the three frozen GetSegmentDesc, SendData and RecvData request headers used by native prefix-rejection controls. The real frozen client in wire/native.cpp exercises that rejection too. The CPU trace’s contract.json, comparator and frozen build remain the oracle and P11 baseline. OrbiTE’s own in-source wire fixtures remain with their owners.

Wire and consumer boundaries

OrbiTE uses wire version 1 throughout pre-release development. Both peers must run the same build. The header carries no build identifier, so it cannot detect a mismatched build. The explicit compatibility policy starts at 0.1.0, as defined in the release ladder. RDMA peers using endpoint QP pools must also share the same ordered pool layout, width and link-layer settings. The control-plane magic keeps its historical spelling, ORBITTE\0.

The removed FABRIC request opcodes 23 and 24 remain reserved forever and decode as Error::Protocol; its native transport tag 16 is unknown. The removed segment capability byte is reserved zero. Remaining field offsets, CUDA fabric capabilities and transport tags are unchanged. The wire stays at VERSION = 1 under the same-build rule above; there is no compatibility downgrade.

Rust is the primary API; Python mirrors the Rust owners with PEP 8 names. Configuration and metric names are OrbiTE’s own. The NIXL design proposes a purpose-built opt-in C bridge for that plugin; no C/C++ ABI is implemented today, and the removed TENT interfaces stay out of scope. There is no TENT protocol autodetection or downgrade. A frozen TENT client is rejected at the native magic/version boundary before admission or payload access. The frozen build remains a behavior oracle and performance baseline only.

OrbiTE owns byte movement and registration/operation lifetimes. OrbitKV owns cache identity, replica authority, cache leases and recovery semantics. An engine source epoch or a region generation does not prove an inference engine’s GPU page generation. P/D page authority remains with the inference engine; NIXL integration must establish its abort/reuse contract before qualification.