docs(cluster): annotate intentional determinism/plane-separation sites

Add no-determinism and no-plane-separation comments explaining why
these Instant/oneshot usages are safe, so CI gate scripts recognize
them as reviewed exceptions rather than flagging them.

Author: farhan-syah

nodedb/src/control/cluster/calvin/scheduler/driver/core/commit_resolve.rs

@@ -87,6 +87,7 @@ impl Scheduler {
         match self.pending.get_mut(&txn_id) {
             Some(pending) => {
                 pending.commit_state = Some(CommitState::AwaitingVerdict);
+                // no-determinism: local stall-warning deadline only; the global replicated verdict, not this wall-clock, decides commit/abort.
                 pending.verdict_deadline = Some(Instant::now() + self.config.verdict_stall_warn());
             }
             None => return,
@@ -210,6 +211,7 @@ impl Scheduler {
     pub(in crate::control::cluster::calvin::scheduler::driver::core) fn check_awaiting_verdict_stalls(
         &mut self,
     ) {
+        // no-determinism: stall-detection clock drives warnings/metrics only; this path holds locks and never aborts, so it cannot affect the replicated outcome.
         let now = Instant::now();
         let stalled: Vec<TxnId> = self
             .pending

nodedb/src/control/cluster/calvin/scheduler/driver/core/tests.rs

@@ -231,6 +231,7 @@ async fn in_flight_guard_skips_replayed_txn_already_in_flight() {
         super::super::types::BlockedTxn {
             txn: txn.clone(),
             keys: BTreeSet::new(),
+            // no-determinism: test-only blocked_at timestamp for a fabricated BlockedTxn fixture.
             blocked_at: std::time::Instant::now(),
         },
     );
@@ -314,6 +315,7 @@ fn ensure_sequencer_leader(scheduler: &Scheduler) {
     // Force the election timeout to fire on the next tick so the single voter
     // campaigns and wins immediately (majority = itself).
     if let Some(node) = mr.groups_mut().get_mut(&SEQUENCER_GROUP_ID) {
+        // no-determinism: test-only forced election deadline so the single voter campaigns immediately.
         node.election_deadline_override(Instant::now() - Duration::from_millis(1));
     }
     for _ in 0..20 {

nodedb/src/data/runtime/params.rs

@@ -62,5 +62,6 @@ pub struct SpawnCoreParams<'a> {
     /// WAL — which would otherwise let a just-restarted node serve half-rebuilt
     /// results. Dropped without firing if the core panics during open/replay,
     /// which surfaces to boot as a failed readiness gate.
+    // no-plane-separation: passive one-shot readiness Sender, fired once (`send(())`, synchronous and runtime-free) at the end of WAL replay to signal Boot; no tokio runtime or tasks run in the Data Plane.
     pub replay_done: tokio::sync::oneshot::Sender<()>,
 }