Floor CP HiCache tail splits to page boundaries

CP HiCache ownership is page-granular, so a backed radix node must not be split inside a padded physical tail page. When a shorter hit would require an interior tail-page boundary, matching now floors to the previous page boundary and sacrifices the sub-page cache prefix instead of splitting ownership metadata.

Constraint: Host/device/draft CP HiCache metadata tracks page owners and padded physical spans.

Rejected: Split one padded tail page across two radix nodes | it would require half-page ownership semantics and risks double-counting capacity.

Confidence: high

Scope-risk: moderate

Directive: Keep exact valid-tail hits, but floor partial backed-node splits to page boundaries unless metadata gains explicit sub-page ownership.

Tested: Remote py_compile for hiradix_cache.py and test_cp_hicache_metadata.py in g0034 container.

Tested: Remote pytest targeted backed-tail split tests plus exact valid-tail hit test: 3 passed.

Tested: Remote pytest test_cp_hicache_metadata.py test_cp_hicache_load_back_owner_lanes.py: 92 passed, 5 warnings.

Not-tested: Live ETE traffic under divergent short-prefix prompts.

Co-authored-by: OmX <omx@oh-my-codex.dev>

docs/advanced_features/nsa_prefill_cp_page_aligned_cache_contract.md

@@ -648,13 +648,18 @@ Implemented C7 slice:
 - `_key_match_paged()` now returns the true valid prefix length for a partial
   final page.
 
-Remaining C7 limitation:
+Implemented C7 split policy:
 
-- Splitting an already-backed CP HiCache node inside a padded tail page still
-  needs a deliberate design.  The current safe slice supports exact valid-tail
-  hits and writes; divergent requests that force a split inside a physical tail
-  page are still a follow-up because splitting one physical host page across two
-  radix nodes would otherwise double-count or lose ownership metadata.
+- Cache management treats a page as the minimum ownership unit.  If matching an
+  already-backed CP HiCache node would split inside a padded physical tail page,
+  the match is floored to the previous page boundary instead of splitting that
+  physical page.
+- Exact valid-tail hits still report the valid length.  The floor policy only
+  applies when a shorter/divergent request would require a new radix boundary
+  inside the tail page.
+- If the floored boundary is zero, the match returns the parent/root node and
+  sacrifices the sub-page prefix.  This avoids half-page owner accounting and
+  keeps host/device/draft metadata page-granular.
 
 ### C8. Owner-lane capacity must be padded-page based end to end