fix(ENG-MM-INPUT-PIPELINE): GetFreedMmHashes reports a same-pass re-allocated mm_hash as freed, so the worker drops a live tensor

Row: ENG-MM-INPUT-PIPELINE (.agents/engine-matrix.md:77)

Found by wave PORTQ-5 (#2679) re-deriving PORT-NOW entry [176], upstream eee538d5da vllm#52482. Nothing was executed — this is a static reading of source.

The defect

EncoderCacheManager::GetFreedMmHashes (src/vllm/v1/core/encoder_cache_manager.cpp:117-121) returns freed_ unfiltered:

std::vector<std::string> EncoderCacheManager::GetFreedMmHashes() {
  std::vector<std::string> freed;
  freed.swap(freed_);
  return freed;
}

Both halves of the race occur inside one Schedule() pass:

• CanAllocate evicts into freed_ and erases from cached_ (encoder_cache_manager.cpp:69-72).
• Allocate re-inserts the same key (:78 cached_.try_emplace(mm_hash);).
• The scheduler then reports the unfiltered list (src/vllm/v1/core/sched/scheduler.cpp:1074-1075), whose own comment at :1070-1073 states the invariant this breaks: the worker "drops exactly these from its own mm_hash-keyed cache, so the two caches cannot disagree about what is resident".

So an mm_hash evicted early in a pass and re-allocated later in the same pass is still reported as freed, and the worker drops a tensor that is live.

Upstream

get_freed_mm_hashes becomes [mm_hash for mm_hash in self.freed if mm_hash not in self.cached].

This tree is at the pin, so it is a genuine post-pin fix

git show 5559679229:vllm/v1/core/encoder_cache_manager.py carries the unfiltered freed = self.freed. This is not a pre-pin hole.

Size

~4 lines of product code (keep an entry only when cached_.find(mm_hash) == cached_.end()), plus a red-first test. tests/vllm/v1/core/test_encoder_cache_manager.cpp:38,55,58 exercises GetFreedMmHashes today but only for the clear-after-read contract, never for a same-pass re-allocation.

Not established

Whether a shipped configuration reaches a same-pass evict-then-reallocate of one mm_hash today. That needs two requests sharing an mm_hash under cache pressure in one step, and nothing here was run. The mirror defect is present regardless.

Start with EncoderCacheManager::GetFreedMmHashes and the eviction/allocation paths at src/vllm/v1/core/encoder_cache_manager.cpp:69-121, then read the scheduler reporting code at scheduler.cpp:1070-1075. Run tests/vllm/v1/core/test_encoder_cache_manager.cpp and add coverage for an mm_hash evicted and re-allocated in one pass. Done means only hashes absent from the cache are reported as freed while the clear-after-read behavior remains intact.