[TENT] Add scoped configuration validation and change planning

[bugkeep]

Description

TENT's immutable configuration bundles do not yet tell a caller whether a complete candidate is well-formed or which changes require a restart. This adds planTentConfigChange(current, candidate, context), a side-effect-free validation and diff API for an initial set of fields. For example, changing rpc_server_port from 18080 to 28080 produces kRestartRequired, changing merge_requests produces kRuntimeCandidate, and changing an uncovered policy field produces kUnsupported.

This is the initial validation/planning slice of PR2 in RFC #3833, building on #3836. It complements the merged #3934: the analyzer reuses its failover defaults, while submission-time policy pinning, task handling, retries, and snapshot publication remain unchanged. The result is intended for future configuration diagnostics such as #2864.

The API:

• Owns frozen copies of both complete, already-loaded inputs and reports current_status and candidate_status separately. Each input stops at its first error using the existing Status::InvalidArgument convention, with the field/component and reason in the message. Inputs are not patches.
• Shares the RPC port/thread parsers, HP TCP boolean/unsigned-number parsing, TCP/HP TCP selection check, and runtime queue dispatch-window check with startup through config_parser.h/.cpp. Admission and preflight both call QueueLimits::validate() for reserve/capacity constraints.
• Checks canonical paths, conflicting flat/nested aliases, raw types, numeric ranges before narrowing, queue cross-field constraints, and explicitly enabled transports against a captured build context.
• Compares covered fields with their consumer defaults, including the derived RPC thread count and progress-worker setting. RPC integer strings remain supported; backend absence is preserved because device/environment selection is outside this API.
• Returns sorted path/disposition changes without embedding configuration values. Path, traversal, and change-count limits reject incomplete analysis rather than returning a partial plan. Validation uses ordinary functions and CHECK_STATUS propagation.
• Adds Config::toJson() to copy JSON under one lock without losing non-finite numbers through a dump/parse round trip.

Initial coverage: RPC hostname/port/threads, merge/failover settings, progress worker and runtime queue enablement, queue fields consumed by construct(), and transport enable flags. Detailed backend parameters, policy/QoS, metrics, and other uncovered fields may pass through unchanged; their additions, removals, or modifications are always kUnsupported. HP TCP enablement must use its nested transport object, matching its dedicated parser.

valid() means that validation within this documented scope succeeded; callers must still inspect every change disposition. kRuntimeCandidate is eligibility for a future consumer protocol, not a promise of live application. This PR does not add an update entry point, assign generations, publish snapshots, probe devices, or wire the complete preflight into startup. Startup reuses the extracted checks; loading precedence, accepted RPC types/ranges/defaults, and Config::get() fallback behavior are preserved. RPC error messages identify the field and constraint without echoing the configured value.

Module

• Transfer Engine (mooncake-transfer-engine)
• Mooncake Store (mooncake-store)
• Reshard (mooncake-reshard)
• Mooncake EP (mooncake-ep)
• Mooncake PG (mooncake-pg)
• Integration (mooncake-integration)
• P2P Store (mooncake-p2p-store)
• Python Wheel (mooncake-wheel)
• Common (mooncake-common)
• Mooncake RL (mooncake-rl)
• CI/CD
• Docs
• Other

Type of Change

• Bug fix
• New feature
• Refactor
• Breaking change
• Documentation update
• Performance improvement
• Other

How Has This Been Tested?

CPU Debug build in WSL with GCC 15, CUDA/HIP disabled. All six targets passed, totaling 132 test cases. Hardware-dependent GPU/RDMA execution was not tested.

Test commands:

cmake --build build/clion-tent-debug --target \
  config_validation_test config_lifecycle_test admission_queue_test \
  transfer_engine_config_override_test tent_hp_tcp_transport_config_test \
  tent_engine_failover_e2e_test -j2
ctest --test-dir build/clion-tent-debug -R '^(config_validation_test|config_lifecycle_test|admission_queue_test)$' -V
ctest --test-dir build/clion-tent-debug -R '^(transfer_engine_config_override_test|tent_hp_tcp_transport_config_test|tent_engine_failover_e2e_test)$' -V

pre-commit run --files \
  mooncake-transfer-engine/tent/include/tent/common/config.h \
  mooncake-transfer-engine/tent/include/tent/common/config_parser.h \
  mooncake-transfer-engine/tent/include/tent/common/config_validation.h \
  mooncake-transfer-engine/tent/include/tent/runtime/admission_queue.h \
  mooncake-transfer-engine/tent/src/common/config.cpp \
  mooncake-transfer-engine/tent/src/common/config_parser.cpp \
  mooncake-transfer-engine/tent/src/common/config_validation.cpp \
  mooncake-transfer-engine/tent/src/runtime/admission_queue.cpp \
  mooncake-transfer-engine/tent/src/runtime/hp_tcp_transport_config.cpp \
  mooncake-transfer-engine/tent/src/runtime/transfer_engine_impl.cpp \
  mooncake-transfer-engine/tent/tests/CMakeLists.txt \
  mooncake-transfer-engine/tent/tests/config_validation_test.cpp
git diff --cached --check

Test results:

• Unit tests pass
• Integration tests pass (local engine/fake transport coverage)
• Manual testing done (describe below)

config_validation_test passed 24 tests covering defaults, alias/path handling, wrong types, overflow, non-finite numbers, cross-field constraints, build capabilities, unknown-field changes, output limits, frozen-input ownership, independent Status results for both inputs, and shared RPC parser output preservation on failure.

Regression checks: config_lifecycle_test passed 16 tests; admission_queue_test passed 41 tests; tent_engine_failover_e2e_test passed 30 tests, including both #3934 PolicyIsPinnedAtSubmit cases; transfer_engine_config_override_test passed 14 tests; tent_hp_tcp_transport_config_test passed 7 tests. Scoped pre-commit checks passed with clang-format 20.

Checklist

• I have performed a self-review of my own code
• I have formatted my code using ./scripts/code_format.sh
• I have run pre-commit on the files changed in this PR and all hooks pass
• I have updated the documentation (if applicable)
• I have added tests to prove my changes are effective
• For changes >500 LOC: I have filed an RFC issue

The API contract, validation scope, and limits are documented in config_validation.h. RFC: #3833.

AI Assistance Disclosure

• No AI tools were used
• AI tools were used (specify below)

OpenAI Codex assisted with implementation, test development/execution, and this PR description. The human submitter reviewed the code and directed reuse of the repository's existing validation routines and Status convention.