test_ltx2_video's span-slack bound reds an unmutated tree in 5 of 53 runs, and its per-record multiplier is read from the artifact under test

[localai-bot]

ltx2 video: the three carrying phases contain their work and the load keeps its order asserts CHECK(span_slack <= span_bound) — assertion (1c) in
tests/vllm/multimodal/test_ltx2_video.cpp. It landed in 6b48edb2c (#1503) to
un-red the build-test-cpu lane. It reds that lane instead, on an unmutated
tree.

Measured at 6b48edb2c, x86_64, CMAKE_BUILD_TYPE empty exactly as
build-test-cpu configures it, one build directory, no mutation of any kind,
53 runs of the case: five runs red, and the population is what the third shape did not have: three of 33 on the box as shared (loadavg 79.7-118.0), two of 10 with an added eight-way spin load (loadavg 91.7-145.9), and zero of 10 pinned to two cores with taskset -c 18,19 (loadavg 84.5-105.6). 424 leaf checks, 636 leaf-record observations.

run	leaf	records	slack	bound	leaf record
A13	decode.video r2	3	1.161 ms	0.75 ms	1.257 s
A16	artifacts.frames r2	2	1.387 ms	0.50 ms	4.826 ms
A18	decode.audio r1	1	10.032 ms	0.25 ms	6.783 s
B6	denoise r2	1	0.410 ms	0.25 ms	24.181 s
B8	denoise r2	1	0.963 ms	0.25 ms	24.655 s

Three defects, and only the first is about the constant.

F1 — the 0.25 ms constant is inside the honest distribution of the quantity it
bounds, and raising it is not sufficient. The bound is capped at
0.5 * leaf_seconds, so on a short leaf record no constant can lift it.
artifacts.frames r2 record 1 measured 1.361 ms of slack on a 4.826 ms record,
where the cap forbids any bound above 2.413 ms. decode.video's
reopen-after-the-last-chunk record is 19-89 us of which 7-32 us — 4.6% to 72.3% —
is its own two boundaries, so a 50% share sits inside that record's own
distribution.

F2 — the multiplier is read from the artifact under test. The bound is
min(kSpanSlackPerRecord * leaves.size(), 0.5 * leaf_seconds) and
leaves.size() is whatever RecordsNamed(table, c.leaf, c.render) returned,
guarded only by REQUIRE(!leaves.empty()) and tied to no independent number, so
a defect that emits ONE EXTRA leaf record enlarges its own budget by a whole
constant. Assertion (0) counts the SUB-SCOPE records against
Ltx2ConditioningTrace; nothing counts the leaf's own. The slack is also
SUMMED, so a swallow concentrated in one record of a three-record leaf draws on
the whole 3 * kSpanSlackPerRecord. The comment claiming that summing "makes
the bound STRICTER on multi-record leaves rather than looser" is false, and the
looseness is load-bearing: under ASan artifacts.frames r2 measured 3.354 ms of
slack against a 6 ms bound and passed only because that leaf has two records.

F3 — the failure message names the wrong cause. It ends "this quantity is two
instrument boundaries and does not move with the box". Within one build
configuration on one host, decode.audio r1 record 0 spans 36.1 us to 10032.0 us
— 277.9x. That sentence is the first thing a reader sees on a red, and it
points at a swallowed phase when the cause is scheduler contention. The same
stale claim sits in two further comments, which also still say "flat 0.25 ms"
though the bound has been per-record, configuration-dependent and capped since
6b48edb2c.

FIXED IN THE SAME FLOW, in row/GATE-SPAN-SLACK-FLAKE: each leaf record is bounded separately
against one constant, leaves.size() leaves the arithmetic, the min cap moves
to the record and its binding is what declares a record below the instrument's
resolution, and the three comments are corrected. What the repair can no longer
see is stated at the site and under ### Owed out of W0.

Found by a fresh review of #1503, which repaired #1494 and #1499 (both closed).
Owned by LTX25-DEVICE-RESIDENCY (#1264), spec
ltx25-device-residency.md.

[localai-bot]

Fixed on main in f38cd69e7 (PR #1582).

The bound is now per leaf record against one 30 ms constant, 2.99x the worst of 636 leaf-record observations. leaves.size() is out of the arithmetic, so no count the artifact chose enters the budget. The min cap moved to the record, which makes the forced-strict probe red by construction, and the cap BINDING is what declares a record below the instrument's resolution.

Evidence at the landing head: forced-strict reds 9 of 9 checked records; a 45 ms swallow injected into ONE record passes the old formula on decode.video and reds the new one at the identical constant; 40 local runs across shared-box, spin-loaded and two-core geometries are green, plus 35 more in fresh review; CI's build-test-cpu, sanitize-cpu (thread) and sanitize-cpu (address,undefined) all passed on the behaviourally identical head 45e0c6c50.

Two claims in the record were corrected in the same PR after fresh review, and both are recorded rather than silently replaced. The constant is bounded from above by denoise and decode.audio, not by decode.video record 0, which straddles the 60 ms resolution floor. And the hand-off to the coverage floor (2) is exact only for a single-record leaf; on decode.video's reopen records a swallow may reach the floor unseen by either assertion. That escape is carried as a ceiling under ## Owed in .agents/specs/ltx25-device-residency.md, and the fix for it is an anchor inside the reopen, which #1439 is owed the same way.