[Config] One writer for the declaration stash; no exception to the write seal

[ch-wan]

Five functions in server_args.py and arg_groups/overrides.py were hard to
tell apart -- declare_late_resolution, declare_direct_writes,
replace_resolved, resolution_projection and the pass slot all wrote the
same declaration stash, three of them by hand. Two carried their own copy of
the same guard, with different wording. This makes one call the only writer.

declare_resolution is the only writer, and the only guard

run_post_process_pass, capture_foreign_writes and replace_resolved
appended to _resolved_overrides themselves. They declare through the family
function now, so "refuse the published config" -- the stash is projected at
publish and never again, so a later declaration is a silent no-op -- lives in
one place instead of two.

One exception, which the pass slot already documented and I nearly broke: a
pass returning an empty dict is a validation, not a declaration, and must
keep working on the published instance, because Engine(server_args=sa) after
Engine.shutdown() re-runs check_server_args on the very instance the
context holds. Only a non-empty return reaches the guard.

declare_late_resolution is gone. It added a name and a dead
_runtime_mutations log that nothing in the tree read. I first kept the name,
arguing two guardrails scan for it -- that was backwards, since the guardrails
are ours. They need coverage, not the late/not-late distinction: both take
the fields as a union term. The two collectors existed only because they keyed
on different names, so _hook_assignment_targets (which scans arg_groups/
for declare_resolution) could not match the late spelling, which is why
lora_hook's fields reached the census only through it. Renaming the call
sites makes it pick them up.

replace_resolved is gone; the callers declare

It copied a resolved record so the copy could carry one changed field across a
process boundary. None of its three callers needed a copy: the Ray scheduler
actor gets its record as a method argument (its own unpickled instance), the
Ray engine hands it to an in-process controller whose only local reader is
PortArgs.init_new, and the benchmark reassigned over its own variable.

Declaring on the record they hold is also more correct: replace_resolved
went through dataclasses.replace, which wrote the field and then declared
it too, leaving the record no longer a record of what was typed.

A bag override cannot stand in, and not for the reason I first gave.
Overriding does not need a publish -- set_server_args is what projects the
bags. The actual reason is that override writes bag leaves and by contract
never touches the record, so its effect cannot travel inside an object to
another process.

The write seal has no exception

capture_foreign_writes lifted the seal, let an out-of-tree plugin assign
fields on the real record, then diffed the record to find what moved. It is
record_foreign_defaults now, which hands the plugin a stand-in: reads fall
through to resolving_view, writes are captured, what it assigned is
declared. record_writable is deleted along with the only window in which the
record was writable during resolution.

The platform call becomes handle_platform_defaults in platform_hook.py,
beside handle_npu_backends, handle_amd_specifics and the rest. The two
speculative sites split by type: the in-tree dispatcher declares (measured
with AST -- its six _handle_* targets make zero field writes and
thirty-three declarations) and must get the record itself, because handed the
stand-in its own declare_resolution calls would stash on that.

resolution_projection

One caller -- ServerArgs.resolved_dict, whose body was
return resolution_projection(self) -- and both carried a docstring
explaining the same operation, which is most of why this module reads as
arbitrary. Folded into the method.

Testing

19 files, +334/-421. overrides.py goes from 23 public functions to 21;
writers of the declaration stash from five to one; exceptions to the write
seal from one to zero.

Coverage measured rather than assumed, because the exposure ratchet's own
docstring warns that a silently shrinking written set passes forever: nothing
removed from it, one field added (dist_init_addr, from the Ray declarations
that replace_resolved used to hide behind a hand-written append, invisible
to every collector), and supplied-instance reads of a written field stay at
zero. The chain ratchet's set is unchanged at 152.

Two tests were deleted rather than rewritten: they pinned the copy mechanism
itself -- that a copy stays resolved, and that it carries the model_config
memo, the bug that once killed the Ray schedulers. With no copy left in srt
that failure class is gone by construction. The three that pinned real
properties moved onto the surviving mechanism, including the Ray hop end to
end: pickle, declare, publish, and assert the bag moved while everything
resolution decided stayed put.

The sglang-runtime-context skill is updated with all of it, including a
correction: it said a bag override needs a publish.

---

CI States

Latest PR Test (Base): ❌ Run #34417882989
Latest PR Test (Extra): ❌ Run #34417882846
Latest PR Test (AMD ROCm 10): ❌ Run #34417883039