Prevent incompatible CP shared-KV transfer mapping

Mooncake is the only disaggregation transfer backend in this branch with CP shared-KV owner filtering plus logical-page-position destination selection. NIXL still slices destination pages by the original chunk slice, so allowing CP shared-KV prefill on NIXL can silently pair filtered prefill pages with the wrong decode pages.

This keeps the supported path narrow while preserving the page-aligned transfer contract: non-page-aligned valid tails transfer their physical tail page, but do not get padded to CP-size pages.

Constraint: CP shared-KV transfer remaps prefill logical pages to per-rank physical pages while decode metadata remains request-position based.

Rejected: Let NIXL continue through the generic slice path | it lacks logical-page-position selection and can silently corrupt CP shared-KV transfers.

Confidence: high

Scope-risk: narrow

Directive: Do not enable CP shared-KV on another PD transfer backend until its sender filters owner pages and selects decode pages by logical request-page position.

Tested: Local py_compile for server_args and touched tests.

Tested: Remote g0034 pytest test_cp_shared_kv_transfer_mapping.py test_req_to_token_pool.py TestHiCacheArgs: 22 passed, 8 subtests passed.

Not-tested: End-to-end PD transfer with a live non-page-aligned prompt.

Co-authored-by: OmX <omx@oh-my-codex.dev>

docs/advanced_features/nsa_prefill_cp_page_aligned_cache_contract.md

@@ -732,6 +732,15 @@ Current state:
   token-length oriented.
 - There is no current checklist proving that decode never infers prompt length
   from transferred padded page count.
+- Mooncake has CP shared-KV page filtering in
+  `MooncakeKVSender.send()` / `filter_kv_pages_for_cp_shared_kv()`, where
+  prefill logical pages are filtered by owner lane and remapped to this rank's
+  physical page ids while destination pages are selected by request-page
+  position.
+- NIXL does not have the equivalent CP shared-KV logical-page-position mapping.
+  Its sender still slices `req.dst_kv_indices[index_slice]` directly.  Under CP
+  shared KV this can silently pair owner-filtered prefill physical pages with the
+  wrong decode destination pages.
 
 Correction:
 
@@ -739,6 +748,9 @@ Correction:
 - Request/bootstrap metadata must carry valid token length separately.
 - Decode-visible prompt length and max-context checks must use valid length.
 - Draft transfer follows target page pattern.
+- Until NIXL gets the same logical-position mapping as Mooncake, CP shared-KV PD
+  transfer must fail fast for non-Mooncake transfer backends instead of silently
+  taking an incompatible path.
 
 Tests:
 
@@ -746,6 +758,21 @@ Tests:
   - transferred pages include the padded tail page;
   - decode sees the original valid length;
   - draft and target transfer page counts match when draft KV is enabled.
+- Unit-level guard:
+  - CP shared-KV page filtering keeps the padded tail page for a valid-tail
+    prompt without padding to CP-size pages;
+  - `ServerArgs` rejects CP shared-KV prefill with NIXL transfer until that
+    backend implements logical-position selection.
+
+Implemented C10 slice:
+
+- Added unit coverage that a 100-token / 64-page prompt covers two transfer
+  pages, and owner rank 1 transfers only the tail page selected by logical
+  request-page position.  This locks the "pad only to page boundary, not
+  cp-size pages" transfer behavior.
+- Added a startup validation guard: CP shared-KV prefill disaggregation is
+  currently Mooncake-only.  NIXL now fails fast because it still lacks
+  Mooncake's logical-page-position mapping for owner-filtered transfer pages.
 
 ### C11. Fallback logging must be audited