feat(SPEC-DFLASH2): the path walk, so a DFlash2 draft drafts — on a GPU, with the walk's shape contract gated (#1314, #1501)

[localai-bot]

Wave W4 of SPEC-DFLASH2 (#1314):
the path walk. A DFlash2 draft now DRAFTS end to end. RefuseDflash2PathWalk is
retired.

Rows touched by this change: SPEC-DFLASH2, KERNEL-DFLASH2-PATH-WALK,
KERNEL-DFLASH2-SELECTOR-EDGES, KERNEL-TOPK-PAIRS.

vt::Dflash2PathWalk runs in upstream's own grid: one program per request,
a slot's K scores in registers, the slot-to-slot dependency a loop INSIDE the
program rather than a kernel per slot. It runs on device by default. The
identical sequential shape in DSpark shipped host-side and measured 28% of the
27B draft step (#436) before it
had to be moved; that is not repeated here.

The row had recorded the wrong algorithm since its opening brief, and this wave
found it (#1501). Every
version of the spec said the T>0 walk uses INVERSE CDF. It is Gumbel-max at
both PR heads — at 19c93519 a hand-written -log(-log1p(-u)) branch, at
66e5414c one gumbel_noised_argmax call — and no inverse-CDF walk exists
upstream at all. Not a shipped defect, but an implementer scoped to write it
would have written the wrong algorithm with no oracle to catch it, because the
failure would have been acceptance-only and token-invisible. Verified against
real upstream at both SHAs by a fresh reviewer, and corrected in every place the
row states it.

The probabilistic arm is deliberately NOT ported (D13, ## Owed O12). At the
moved head _cache_draft_logits runs only when draft_logits is not None, set
only for draft_sample_method == "probabilistic" — which
ParseSpeculativeConfigJson already refuses BY NAME against an accept-iff-equal
verify. Porting it would land two mechanisms no entry point can reach, so
## Nothing lands dead decides it, the same way O9 already decided
input_embedding_scale. The None-for-greedy half of draft_logits_spec IS
honoured; the fp32/-inf layout and the Philox stream a bit-parity port would
need are recorded in enough detail to finish later.

Reachability, and why "it generated" is not the assertion. A runner that
dropped the DFlash2 arm also generates. The gate reads the drafts off the
production VT_SPEC_TRACE line at real fd 2 — an rdbuf swap cannot see
fprintf(stderr, …) — and requires the drafts to MOVE between two engines
differing only in D9's output scalars, which touch nothing but the candidate
values the selector reads, so a DFlash1 argmax would answer identically for both.
Deleting the runner's walk call site and the closure guard together leaves the
engine still generating 8 blocks with differing: 0, and the gate reds on that.

Reviewed twice, FAIL then repaired. The first review found the walk's entire
[B,L,K,K] shape contract ungated: the negative case set bad.shape[2] = K-1 on
a contiguous tensor, desynchronising the strides so IsContiguous() turned false
and the CONTIGUITY guard threw first — a bare CHECK_THROWS cannot tell two
guards apart. Deleting the whole VT_CHECK left four suites green. It is now
pinned by two genuinely contiguous wrong-extent lattices matched on message, and
all three mutations redden. The same gap was found and fixed in the sibling
test_ops_dflash2_selector_edges rather than deferred.

The second finding was that CPU and CUDA were NOT bit-exact on a NaN-bearing row,
against four written "BIT-EXACT by construction" claims: the CUDA per-lane scan
read v > best || (v == best && j < slot) seeded at best = -inf, slot = K, so a
lane holding -inf claimed a slot the CPU's strict > refuses. Repaired by
fixing the kernel rather than narrowing the claims — the disjunct is unreachable
once a lane has claimed anything, since j only ascends, so its sole live effect
was at the seed. The lower-slot tie rule stays in the cross-lane butterfly, where
lanes combine out of slot order, with the invariant that makes it safe stated
beside it.

Gates. Operator rerun on this head: agent-ready.py 87 ok, 0 FAIL, 0 SKIP.
Full ctest 580/581 at 429153a8c, the single failure test_ltx2_video on a
0.8%-short wall-clock ratio under load. check-agent-record.py ENGINE=168
KERNEL=57, anchor rot unchanged at 38.

On a GPU. The device gate ran on dgx:gpu0 (GB10, sm_121a, nvcc 13.0 matched
to the driver) at this branch's code: CUDA_OBJECTS_BUILT=34,
COMPILE_ERRORS=0, all seven device-bearing suites green with zero
no CUDA backend; skipping lines. test_ops_dflash2_path_walk reports 83
assertions on device against 49 on CPU, and the increment includes the NaN row
now chained into the parity fixture — the case the previous device run
structurally could not contain, which is why the divergence above survived a
green GB10 run once already. test_ops_dflash2_selector_edges reports 3859
against 203.

Still owed, named. ## Owed O5 keeps two ungated LoadDflashDraft lines
recorded with their mutation results rather than as passes. O11 keeps the
CUDA/CPU parity argument. O12 keeps the probabilistic arm.
#1489 keeps the sibling top-k's
NaN reconciliation. No throughput number is claimed and none is admissible: the
acceptance gate has not run, and a DFlash2 draft additionally runs off the paged
CUDA-graph fast path because the selector needs the hidden states of the same
forward its logits came from.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [Claude Code]