fix(model cache): make_room honors the admission grace; grace owned by its LoadedModel handle

[lstein]

Problem

make_room's eviction loop checked only is_locked, but multi-model invocations load their whole set before locking any of it (the MiniMax H3 text encoder loads text_encoder → tokenizer → processor, then locks). Under shared-RAM-budget deficit on a dual-GPU rig, the tokenizer's cold-load make_room evicted the 27 GB text encoder admitted one second earlier — freeing nothing (the loader's handle keeps the model alive) while detaching the record from all cache accounting and printing the issue-7513 diagnostic once per paced-lock pass (~25 identical INFO lines per text-encoder load, observed in the field).

Fix (three commits, each shaped by an adversarial review of the previous)

1. make_room spares entries inside their admission grace (awaiting_first_use). The async eviction paths (budget reconcile, peer eviction) already honored it; the synchronous path now does too. The keep-alive timeout clear and the /empty_model_cache button pass spare_awaiting_first_use=False — an idle-expiry or user-requested full clear outranks the grace.
2. The grace is now owned by its LoadedModel handle. Review of commit 1 proved put()'s stale-grace sweep defeated the guard: it cleared every grace on each admission, so only the newest sibling was protected, and only until the next put() — the field failure reproduced with the guard in place. The handle registers a weakref (CacheRecord.grace_holder) alongside its existing release finalizer; the sweep now clears only provably orphaned graces (no handle ever registered, or the handle died without its finalizer running). Live holder ⇒ lock() or the finalizer will release it.
3. Holder-identity check in the release + worker unpinning. The finalizer's release carries the dying handle's ref and leaves a grace that has been re-registered to a newer live handle; the deferred worker unpins the unpacked record local before blocking (the existing anti-pinning test caught this); the route tests assert the spare_awaiting_first_use=False plumbing.

Also demotes continue_lock's detached-record diagnostic to DEBUG — lock() reports it once at INFO; a paced stream repeated the identical line dozens of times.

Verification

• 607 tests pass across tests/backend/model_manager/load/ and the router tests; new coverage: grace survival across sibling admissions (fails on commit 1 — verified), orphan sweeps both ways, finalizer release on handle drop, holder-identity release, explicit-clear override, plus the pre-existing eviction guards.
• Two rounds of adversarial fresh-context review. Round 1 reproduced the sweep hole (fixed in commit 2). Round 2 found no reachable breakage; its two hardening suggestions are commit 3. It also verified the scariest corner — a detached-but-alive record's shared CPU weights cannot be freed under a peer cache's feet (the canonical tensors are ordinary refcounted objects held by the live module; a later adoption misses and cold-loads).

🤖 Generated with Claude Code

https://claude.ai/code/session_01S4B5exWsbC2z2Uu2tA167A