fix(qwen3-dflash): post-merge correctness fixes — capture-shape gate, unified readiness, stream

[xiaguan]

Follow-up to #436, which merged an earlier snapshot of the DFlash feature. These seven correctness/quality fixes were authored after that snapshot and are not in main — the first two are real correctness defects currently live on main.

Fixes (by severity)

1. Verify CUDA Graph capture-shape bug — silent losslessness break.
The verify piecewise CUDA Graph keyed its captured dense segments by batch_size alone, but total_tokens varies at fixed batch size: a request near its output budget shortens its span (plan.rs token_ids.truncate(remaining)). Captured dense kernels bake their row count, so a graph captured at a short span and replayed at a longer one processes too few rows → trailing requests read stale logits → lossless contract broken under heterogeneous request progress. The bs=1 gate and the homogeneous c8/c16 benches only ever hit the safe (over-compute) direction, so this slipped through. Fixed by gating the captured path on the full batch_size * span shape; any truncated step runs eager. Since each span ≤ block_size, equality holds iff every span is full — capture-shape == replay-shape is now an invariant by construction.

2. Unified path skipped DFlash readiness — feature silently no-opped under mixed load.
The fused Unified step neither marked a request draft-ready (like execute_prefill) nor stripped stale draft context (like execute_decode). A greedy request prefilled through a Unified step never became draft-ready and never recovered. Fixed by routing capture-eligible pending to a dedicated prefill step (build_next_plan's needs_dflash_capture, a deliberate safe superset of the real capture eligibility), and dropping stale context in the Unified decode arm.

3. Stream-override race (graph-capture correctness). copy_hidden_rows_into / copy_hidden_token_range_into launched on the base stream instead of active_cu_stream(ctx). copy_hidden_rows_into runs inside the verify capture, so the copy was not recorded into the graph. Now matches the sibling captured ops.

4. Crash-early guard. Reject DFlash + --decode-overlap at launch — the speculative path never takes the overlap route, so the combination only burned VRAM.

5. Refactor. Split dflash.rs (over the 1k-line limit) into dflash/loading.rs + dflash/reservation.rs; byte-identical move, no behavior change.

6. Test. dflash_concurrent_heterogeneous_is_lossless — concurrent greedy requests at staggered budgets, each checked vs its own plain-greedy baseline. Exercises the bs>1 draft+verify path the bs=1 gate and homogeneous benches never reach.

Verification

• cargo build --release green; cargo test --release -p openinfer-qwen3-4b --lib → 50 passed.
• DFlash greedy-lossless gate 4/4 on the local GPU, including the new capture-shape regression and concurrent-heterogeneous tests.
• Adversarial review pass over all seven changes: no fatal / hard defects.

🤖 Generated with Claude Code