#2822 serve: opt-in single-engine preemption for short requests

说明

## Goal

Let an interactive request run during a long single-engine response, while retaining the ordinary speculative decode path. The long stream stays connected and continues afterwards. Closes https://github.com/Niko1221/Strata/issues/2821.

This covers an already-running single `GEN`. #2109 addresses priority when admitting work to batch slots; this option rejects batch/parallel/replica configurations.

## Change

- Add opt-in `solo_priority: true`, off by default. Explicit integer `priority`, or a small-request boost when omitted; five-second minimum run quantum and 30-second queue aging.
- `STOP`, drain accepted tokens through `DONE`, then resume with original token IDs plus accepted output. Keep the original streaming parser, UTF-8 decoder, tool-call identity and sampled seed alive.
- Scoped cancellation for queued/active/parked requests; explicit failure on engine death. Serialize maintenance around parked work. Keep per-request statistics separate.
- Guard restored-prefix prefill: reach decoding before yielding so the engine cannot consume and discard a restored snapshot mid-prefill. Regression reproduces the failure on the earlier implementation.
- Add counters, deployment/rollback documentation, real-pipe tests and reproducible synthetic soak/lifecycle clients. No returned model tool is executed by these clients.

No native source, engine binary, cache format or model change. Default remains off. The old protocol body is extracted into `_generate_single`; normalized AST checks match the old dispatch/validation/protocol after excluding the opt-in callback. `server.py` as a whole is not byte-identical. Full Python regression suite below also exercises the default path.

## Validation

- Python 3.11.7 with regex 2026.9.10: 798 tests, 790 passed and 8 skipped, 296.962 seconds.
- Thirteen focused scheduler tests: trailing accepted tokens after STOP, split UTF-8, tools, cold and restored prefill, fairness, cancellation and engine failure. Old code fails the new restored-prefill regression; current code passes.
- Original non-abliterated Qwen3.8 Flash Next, ISTA-DASLab GSQ-RCO IQ3_S; Windows11 / RTX3090 24GiB / R95900X /128GiB. One-hour runtime `b121239`, final failure-path correction/control runtime `69a6b86`, upstream `296b59d`, unchanged v0.1.44.1 native binary.
- One-hour three-conversation soak plus interactive requests: 409 results (395 normal completions, 14 intentional cancellations), 94 tool/result round trips, 28 exact 20-field audits, 301 pauses and zero processed-prefix losses. Short text TTFT: median 0.669s, p95 7.054s, max 46.503s. Independent strict JSON checks passed all 395 successful responses.
- Queued/active/parked disconnects leave the other client working and queues empty. Native Responses emits one 450-item call and recalls its result. Native-exit injection found a script-launch exception-identity defect; fixed and regression-tested. Final native retest: both Chat/Responses return structured errors within 1.228s; a new request auto-loads and succeeds in 23.621s. The full hour is reported on b121239; the corrected error path and matched control were retested on 69a6b86.
- Final same-build 3-pair-per-arm comparison: short TTFT 20.128→0.561s, aggregate 113.041→108.803tok/s(-3.75%), pair 27.362→28.428s(+3.89%). All six audits and short answers pass. A Windows GBK result-reader error occurred after completed measurements; retained UTF-8 records were independently revalidated and the controller error is disclosed. No measurements were replaced.

See [full report](https://github.com/Zcg2021/Strata/blob/d72db88fa76b9ae8631167eeecf2dada62c50d0f/bench/results/2026-10-16-solo-priority-qwen-soak/README.md) for exact settings, methodology, per-request measurements and the preflight failures. Earlier SC117 measurements are supplementary, not pooled into the original-model result.

## Limits

This is cooperative scheduling, not a hard real-time guarantee. One history rollover restored only 16K of a 132K prompt and a short request waited46.503s while the protected remaining prefill completed; no processed-prefix loss was recorded. Images/GENI and checkpoint opt-outs are not preempted. Cold first-prefill interruption may incur reread work.

The soak uses deterministic synthetic manifests, receipts and fact audits; it is not unrestricted autonomous development, model-generated compaction, or evidence that the model is hallucination-free. An earlier boolean-schema failure occurred equally with the flag off/on and is retained in the reports. One hour on one Windows/CUDA machine is not overnight or cross-backend validation. Native CUDA/HIP/SYCL files are untouched; no native backend build is claimed.

Rollback: remove/disable `solo_priority` and restart. Existing model, config and cache formats continue to work.