Support v1 inline raw multimodal images

[eligotts]

Summary

Intermediate multimodal storage mode — the inline bundle. Keeps the load-bearing architecture of the raw multimodal redesign — the image processor runs nowhere near the env worker: renderers compute token layout via pure geometry math, PrimeRlServingTokens materializes pixels in front of vLLM (with the byte-bounded single-flight materialize cache), and the trainer re-materializes from the same source via family adapters — but images travel inline as base64 data URLs through messages, traces, transport, and refs. No shared image directory, no offload.

Companion inline PRs:

• Renderers: Inline raw image refs for multimodal rendering renderers#110
• Verifiers: Inline raw multimodal images in the v1 train client verifiers#2120

Design:

• Serving: raw mmraw: refs embed the inline image source; materialization decodes and sha256-verifies the inline payload. Expected descriptor failures—including hash, fingerprint, grid, and placeholder-length mismatches—return invalid_mm_image_ref 400s. The byte-bounded single-flight cache keys on a digest of the complete ref plus its modality, outer hash, placeholder length, processor model, and trust setting, so a distinct or stale descriptor cannot alias a validated entry. Cache size is controlled by PRIME_RL_MM_MATERIALIZE_CACHE_GB.
• Trainer: RawImageMaterializer decodes inline bytes from the descriptor. MMImageRef drops the uri field — the image lives once, in the descriptor.
• Removed entirely (nothing to configure, nothing to go missing): [multimodal].offload_dir / MultimodalConfig, utils/run_assets.py, VF_RENDERER_IMAGE_OFFLOAD_DIR launcher + SLURM plumbing, and missing_mm_image_policy + the adapters' synthesize_placeholder machinery — an inline image cannot disappear, so the zero-loss placeholder path has nothing to guard.
• Kept: SFT renderers default to multimodal_output='processed' with a hard guard against 'raw' (storage-independent).
• Rollout records/traces keep the inline base64 (deliberate; noted in the monitor-run skill — expect payloads and results.jsonl to grow with turn count).
• The local RL launcher preserves the inherited process environment when spawning the orchestrator, including the virtualenv PATH and credentials.

Relationship to the offload bundle

This branch is cut from feat/v1-raw-mm-offload (#2836) and targets main independently. The offload bundle (renderers #89 / verifiers #1746 / prime-rl #2836) is the follow-on that layers content-addressed file:// storage on top: ingress offload walker, offload-dir plumbing, missing-image policy, and disk-backed refs.

Validation

• Original branch validation: tests/unit minus GPU-kernel model tests — 482 passed (398 non-train + 84 train non-models); uv lock --check clean; ruff check + format clean.
• Materialization hardening: uv run pytest -q tests/unit/inference/test_serving_tokens.py — 21 passed; touched-file ruff check and format check clean.

Update: hardening + restored main's multimodal packing (7d85b170, fb6ef306)

• Review hardening (7d85b170): subprocess env inheritance restored in rl_local's orchestrator launch; the materialize-cache key now digests the full ref ((sha256(raw_ref), modality, mm_hash, placeholder_len, model, trust_remote_code)) so a distinct descriptor can never alias an already-validated entry; adapter validation errors map to invalid_mm_image_ref 400s.
• Packing parity with main (fb6ef306): the merge had left raw-ref multimodal samples never packing, regressing main's feature. Same-family raw-ref samples now pack with each other and with text from the same run/LoRA; _materialize_bin merges refs with placeholder offsets rebased to the packed stream. Mirrors the offload branch's fix; tests restored to main's semantics.

Validation: tests/unit minus GPU-kernel model tests: 484 passed.

Update: unwrapped the ref payload (603118b / e40dded5)

raw_mm_ref no longer base64-wraps its payload — it serializes compact JSON directly. The ref travels as a string inside a JSON request body, so the only encoding cost is escaping the payload's own quotes (~200 bytes); the base64 wrapper instead inflated the whole payload by a third, and in inline mode the payload contains the image.

Measured on a 75 KiB JPEG: 130.3 KiB → 97.9 KiB per image slot on the wire (the 97.7 KiB data URL plus ~200 bytes of metadata/escapes) — a 25% cut, applied to every image slot of every request. Refs now parse with a single partition(":") since the payload contains colons; the base64-alphabet guard retired with the wrapper.