feat(xla): admit image requests in CLI and continuous-batch serving #861

Parent and dependency

• Parent epic: epic: OpenXLA multimodal / VLM architecture support (Qwen2-VL, Gemma3n, Phi4MM, Molmo, and more) #566
• Blocked by feat(xla): seed single and batched IREE sessions from embeddings #860
• Existing XLA worker: src/server/batch/xla_worker.rs
• Worker construction and media helpers: src/server/model_worker.rs
• Session dispatch: src/backend/session.rs

Problem

XlaServeWorker::admit currently rejects any image, audio, or video input. spawn_xla_model_worker loads only a tokenizer and XlaBatchEngine; it owns no multimodal preprocessor. The single-session dispatch also has a historical path that can ignore input embeddings. As a result, having an embeddings-capable IREE engine is not enough to make either CLI or OpenAI-compatible serving correct.

Goal

Wire the prepared image-prefill path into XLA CLI generation and continuous-batch serving, while preserving media security limits, per-request failure isolation, truthful capabilities, and text batching behavior.

Required implementation

• Make the XLA worker own the host multimodal preprocessor selected for the loaded checkpoint. Construct it once during model startup and fail startup when the model advertises a supported XLA VLM family but required processor/projector weights are missing.
• Reuse the existing server image decoding, URL/data handling, byte/pixel/count limits, and validation policy. Do not add an XLA-only network or decoding path.
• Perform decode/preprocessing in a bounded stage that cannot block the scheduler loop or allow unbounded per-request host memory. Preserve request ordering and cancellation while preprocessing is in flight.
• For supported image requests, tokenize/expand placeholders, create the prepared-prefill DTO, run context-capacity admission on its effective length, and submit it through XlaBatchEngine.
• Keep logical token IDs for detokenization, penalties, stop matching, streaming chunks, and API usage accounting. Track expanded prefill length separately for cache positions and internal metrics; document which value is exposed by each metric.
• Route CLI --image/multimodal generation through the same prepared-prefill/session contract rather than a CLI-only shortcut.
• Set SessionCapabilities.multimodal for XLA only when the loaded model and runtime bundle actually support the path. Capability checks and execution dispatch must use the same predicate.
• Continue to reject audio and video until their dedicated foundation is implemented. Return explicit modality/model/backend errors rather than silently dropping media.
• Preserve per-request isolation: decode, preprocessing, admission, or native failures must finish only that request and leave the worker and other slots healthy.
• Preserve existing unsupported-option behavior for features such as XLA logprobs; adding images must not make unrelated request fields appear supported.

Non-goals

• Emitting the vision encoder through StableHLO.
• Adding Qwen M-RoPE, Gemma image masks, audio, or video support.
• Changing public OpenAI-compatible request schemas.

Validation

• Add worker tests with the deterministic fake preprocessor for successful image admission, malformed media, placeholder mismatch, capacity overflow, cancellation during preprocessing, and preprocessing failure beside active text requests.
• Add mixed continuous-batch tests with text and image requests, verifying independent streaming, stop conditions, token histories, cache lengths, slot reuse, and metrics.
• Add capability tests for text-only XLA, supported image VLM XLA, unsupported VLM XLA, and MLX sessions.
• Add a regression test proving images/audio/video can never be accepted and then ignored.
• Exercise one real image request through the CLI path and one through the OpenAI-compatible streaming server path on an available IREE target.
• Run existing text-only server, scheduler, and XLA batch suites.

Acceptance criteria

• Supported XLA image requests reach embeddings prefill in both CLI and server paths.
• Existing media decode/security limits are reused exactly once.
• Preprocessing is bounded, cancellable, and does not block the scheduler loop.
• Capability reporting and execution support cannot disagree.
• Unsupported modalities fail explicitly and are never dropped.
• A failed image request cannot corrupt another slot or stop the worker.
• Existing text-only continuous batching and API accounting remain unchanged.