feat(server): support DFlash with mixed-backend target layer split

[weicj]

Summary

This PR lets target layer split run across different backends and completes the DFlash speculative decode path on top of mixed-backend target split.

Same-backend layer split could already shard the target across multiple GPUs from the same backend, but CUDA/HIP mixed placement was limited to draft/target separation. The target itself could not be split across backend processes. DFlash also needs more than a plain target forward: verify requires hidden-state capture, draft feature ring or remote draft IPC forwarding, target KV snapshot/restore, and final token projection. This PR wires those required DFlash pieces into the mixed target shard IPC path.

Changes

• Add a mixed-backend target shard IPC path: the local shard can run the first target layers and hand the boundary activation to another backend process for the remaining target layers.
• Let the remote target shard return DFlash capture slices; mixed forward writes local/remote captures into the local DraftFeatureMirror or forwards them to remote draft IPC.
• Add target KV snapshot / restore support to the remote target shard for DFlash speculative verify rollback.
• Add hidden-state-to-token projection on the remote target shard so DFlash target split can finish token decisions when the final layers / LM head live remotely.
• Support in-memory prefix cache for mixed target split: the local shard keeps its local prefix snapshot, while the remote target shard keeps the matching slot inside its own backend process and restores it through IPC control commands instead of transferring large KV payloads.
• Extend server placement validation from requiring all target-split shards to run on the current compiled backend to allowing one local backend group plus one remote backend group when --target-shard-ipc-bin is provided.
• Keep same-backend target layer split on the existing in-process local runtime path.

Notes

• Local runtime validation covered CUDA Tesla P4 + dual HIP Pro VII with Qwen3.6-27B Q4 target split across cuda:0,hip:0,hip:1 and layer split 0.08,0.46,0.46; logs show CUDA running layers [0,5), and the two HIP shards running [5,35) and [35,64).
• DFlash validation covered both local CUDA draft and remote HIP draft IPC modes; both returned valid OpenAI-compatible responses and server logs reported accepted draft tokens.
• In-memory prefix cache was validated on the 27B DFlash mixed-target-split path: the first request committed an inline snapshot, and the second identical request hit restore=true.

[cubic-dev-ai]

6 issues found across 43 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 10 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="server/src/qwen35/qwen35_target_shard_ipc.cpp">

<violation number="1" location="server/src/qwen35/qwen35_target_shard_ipc.cpp:60">
P2: The negative-value guard only checks `raw[0]`, so signed inputs with leading whitespace (for example `"   -1"`) still pass through `strtoull` and can produce an unintended huge shared-memory size.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The negative-value guard only checks raw[0], so signed inputs with leading whitespace (for example " -1") still pass through strtoull and can produce an unintended huge shared-memory size.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At server/src/qwen35/qwen35_target_shard_ipc.cpp, line 60:

<comment>The negative-value guard only checks `raw[0]`, so signed inputs with leading whitespace (for example `"   -1"`) still pass through `strtoull` and can produce an unintended huge shared-memory size.</comment>

<file context>
@@ -57,9 +57,13 @@ size_t target_shard_shared_bytes_from_env(size_t required_bytes) {
     if (!raw || !*raw) {
         return required_bytes;
     }
+    if (raw[0] == '-') {
+        return required_bytes;
+    }
</file context>

Suggested change

	if (raw[0] == '-') {
	return required_bytes;
	}
	char * end = nullptr;
	const unsigned long long parsed = std::strtoull(raw, &end, 10);
	const char * p = raw;
	while (*p == ' ' || *p == '\t' || *p == '\n' || *p == '\r' || *p == '\f' || *p == '\v') {
	++p;
	}
	if (*p == '-') {
	return required_bytes;
	}
	char * end = nullptr;
	const unsigned long long parsed = std::strtoull(p, &end, 10);
	if (end == p || *end != '\0' ||
	parsed > (unsigned long long)std::numeric_limits<size_t>::max()) {
	return required_bytes;
	}