hybrid unordered kernels: guard token_map_at_dispatch bit packing at JIT time

[Xuan-1998]

The bug

pack_combine_recv_addr in deep_ep/include/deep_ep/impls/combine_utils.cuh:38-40 packs (rank, slot, channel) into an int32 by shifting into 5/14/12 bit fields with no runtime mask:

int pack_combine_recv_addr(const int& rank, const int& slot, const int& channel) {
    return (rank << kCombineRecvMapRankShift) | (slot << kCombineRecvMapSlotShift) | channel;
}

Callers pass unchecked ints:

• hybrid_dispatch_unordered.cuh:704 writes the packed word into token_map_at_dispatch[token][k].
• hybrid_combine_unordered.cuh:719 reads it back and asserts only channel == channel_idx (the low 12 bits).

If slot exceeds its 14-bit field (16383), its high bits bleed into the rank field at bit 26. channel_idx stays intact, so the runtime EP_DEVICE_ASSERT(channel == channel_idx) at hybrid_combine_unordered.cuh:722 still passes. The kernel then routes the partial to a wrong scale-out rank and either misdirects the reduction or hangs in the arrival-count wait at :752-767 because the corrupted rank never sends.

Slot is combine_slot, bounded by kNumMaxTokensPerChannel * kNumTopk. Both rank (bounded by kNumScaleoutRanks, 5-bit field) and channel (bounded by kNumChannels, 12-bit field) have the same silent-overflow shape at 32 / 4096.

The fix

Instantiations of the two hybrid unordered kernels have all three bounds as compile-time constants. Add EP_STATIC_ASSERTs at the top of each kernel body, so an out-of-range template combination fails to instantiate at NVRTC JIT compile time (per csrc/kernels/elastic/dispatch.hpp:108) with a message that names the offending parameter — instead of a silent misrouted put at runtime.

Diff

• deep_ep/include/deep_ep/impls/combine_utils.cuh: a 6-line comment above pack_combine_recv_addr documenting the caller contract and pointing at the enforcing sites.
• deep_ep/include/deep_ep/impls/hybrid_dispatch_unordered.cuh: three EP_STATIC_ASSERTs at the top of hybrid_unordered_dispatch_impl (line 180 area).
• deep_ep/include/deep_ep/impls/hybrid_combine_unordered.cuh: same three EP_STATIC_ASSERTs at the top of hybrid_unordered_combine_impl (line 59 area).

No runtime path change. Total 35 lines added.

Verification

• Parse-only check with nvcc -std=c++17 -arch=sm_90 -c against the real nccl.h: passes.
• The kernels are NVRTC-instantiated at runtime, so the new asserts fire during JIT compile with a message pointing at the offending parameter (before any launch).
• Reviewed each cited line against source at HEAD (54fffef) on p5en48xlarge.

AI disclosure

Found and drafted with Claude Code. Every claim above was verified against source line by line before I opened the PR.