fix(LTX25-RESIDENCY-W0): the phase-table anchors are counted by the RENDER, because four of five assertions were ratios against the anchor itself

[localai-bot]

W0's containment case asserts four things about each carrying phase —
containment, coverage, exclusivity, non-overlap — and all four are ratios taken
against the sub-scope anchor. An anchor that moves WITH its leaf therefore
defeats every one of them at once. That is the shape that let four fresh reviews
each break this gate one level over from the last, and it is what this change
closes.

What the third review broke, and what closed it

Two mutations against the merged 89261c955, both compiling clean, both exit 0
on both gates. M12 emits denoise.step for step 0 only, closes denoise
there and opens phase.finish over steps 1-7: 106/106 and 350/350 assertions,
over a table putting phase.finish at 28.73% of the named leaves against a
denoise of 6.11%, on a run whose honest denoise was 39.3%. M11 leaves the
write(2)s inside decode.video and emits artifacts.frames covering nothing:
124/124 and 422/422, coverage still 99.68%, artifacts.frames reporting four
microseconds while nine PPM files are written, with the whole writer charged to
the leaf W5's lever is measured from.

Two assertions that are not ratios close both.

The record count. Each anchor must be emitted once per unit of work the
RENDER counted. The counts come from Ltx2ConditioningTrace: dit_evaluations,
incremented inside the shared Evaluate lambda every sampler arm reaches, and
video_decode_chunks, added here and incremented in the driver's own streaming
sink beside rendered_frames. Neither is derived from the phase table, so no
placement of a phase scope can move either, and the gate re-derives
video_decode_chunks from Ltx2GroupTilesByTemporalSlice rather than trusting
it.

Nothing but an anchor is nested. A leaf that grows over a NEIGHBOUR does not
overlap it and does not break the sum: PhaseLog::Open marks the neighbour
nested, which removes it from sum_leaf_seconds and from the timeline the
exclusivity check walks. The gate names the six anchors and refuses any other
nested record, and asserts separately that no decode.video leaf encloses
artifacts.frames.

Two anchors are new. artifacts.frames.ppm wraps the WriteFileBytes loop, so
the writer's name has something that moves with the WRITES rather than with the
scope beside it. decode.video.vae opens inside Ltx2ConvVideoDecodeTiled
around AccumulateTemporalGroup — the VAE-side sub-scope the spec recorded as
owed to W5 — so that leaf has a sub-scope whose ends are both production events.

And the load, which had no anchor at all: swapping the load.dit and
load.prompt_embeds scope names moved 96% of the load's seconds onto the wrong
name with every gate green, and load.dit is the phase W2 and W3 both act on. An
anchor for it needs a scope inside ltx2_loader.cpp, outside this stage's
authority, so what is asserted is the ORDER the driver loads in. The case title
now says what it checks, and ### Owed out of W0 names every leaf whose
placement is still unproven, with the stage that acts on it.

What the FOURTH review broke, and what closed it

The fourth reviewer re-ran every earlier mutation against 165db635c and found
all seven RED. Two of this change's own stated guarantees still fell to
two-line mutations, and both are on the anchored set it declares.

N1 — sibling anchor names are swappable. Swap the decode.audio.mel and
decode.audio.vocoder string literals (1 file, +2/-2, compile rc 0). Both gates
were green — containment exit 0, 1/1, 194/194 and SUMS exit 0, 1/1,
446/446, byte-identical to the honest claim — over a table reading
decode.audio.vocoder 0.007 s / decode.audio.mel 0.220 s where the honest
table has them reversed. 96.8% of decode.audio's decomposed seconds land on
the wrong name, on a leaf that is 47.8% of that render's named leaf seconds,
and issue #1010 asks for the vocoder BY NAME. Nothing tied a sub-scope NAME to a
POSITION: the counts are {1, 1} either way, containment holds for both, the
sub-scope intervals are sorted by start before the overlap check, and the nested
assertion is a set-membership test. The sharp part is that the load-order
assertion was added because M13 showed a sibling name swap moves 96% with
everything green, and the identical hole was left on the one sibling pair inside
its own anchored set.

N6 — decode.video.vae's placement was not gated at all. Move the scope off
AccumulateTemporalGroup onto the buffer.Allocate beside it (1 file, +7/-8,
compile rc 0): containment exit 0, 194/194, SUMS exit 0, 446/446. The
table then reports decode.video.vae = 0.000 s beside a five-millisecond
decode.video, with the tile decode inside no sub-scope. That anchor was checked
for cardinality, for nested and for containment in a chunk window and nothing
else — Carrying{"decode.video", ...} lists only decode.video.chunk in
parts, so the vae contributed zero to coverage, and it fired in neither M11
nor M11a. The "both production events" claim was true of the source and unheld by
the gate.

Three repairs close them, and a fourth pays a claim this change had made in prose.

Assertion (1b), the sibling order. Two sub-scopes of one leaf must appear in
the order parts lists them, which is the order the driver runs them, compared
on each name's FIRST record so a part that legitimately repeats
(decode.video.chunk) is unaffected. Same shape as the load-order assertion. It
proves a swapped PAIR is a red — not that either name covers the call it is named
after, which needs a scope inside the callee and is recorded as owed beside
load.dit.

Assertion (6), the VAE coverage floor. decode.video.vae must cover at least
half of the render's decode.video.chunk seconds. The denominator is the chunk
windows rather than the leaf, because the leaf's last chunk record is the empty
window between the final chunk and the end of the decode. Measured 91.1%, 93.6%,
97.4%, 98.2%, 98.5% and 98.6% over six renders; the floor is 0.50 because the
uncovered part is the per-group allocation, the overlap blend and the emit —
real work whose share grows as the tile shrinks — plus two instrument boundaries
against a chunk of about a millisecond on this fixture.

The counts are now demonstrated at N > 1. Every decode-side count was 1 or
1+1, because nine frames decode in ONE temporal chunk, so "once per unit of work"
and "once per render" were indistinguishable — the exact distinction assertion
(0) exists to make. The case now renders a second time at 81 frames, the smallest
request this fixture chunks, and re-runs every per-render assertion against a
table that holds both renders. min_chunks makes a geometry that stopped
chunking a red rather than a quiet regression to N = 1, and the tiling
re-derivation now reads the fixture's own decoder block list through
Ltx2VideoScaleFactorsFromBlocks and the size the render reported, in place of
three constants copied from a header comment.

And the counts are taken per render. PhaseLog resets at LOAD while
Ltx2ConditioningTrace resets on every Generate, so an unfiltered record count
is process-wide against a per-render denominator — correct only while the case
rendered once. RecordsNamed and LeafIntervals now filter on the render
field the records already carry, which the second render makes load-bearing
rather than hypothetical.

One threshold moved and it is a parameter rather than a loosening. denoise's
coverage floor is 0.95 at nine frames and 0.90 at 81, because the uncovered part
is WORK — the post-process and the Euler or res_2s step, which no anchor wraps —
and its share depends on the geometry. Measured 99.28%, 99.38% and 99.55% at
latent_t = 2 against 96.55%, 96.90% and 97.09% at latent_t = 11, same binary,
same box, three runs each: six points of margin on the measured value in both
cases, which is the rule the other thresholds are set by.

Two overstatements are corrected wherever they appear — the driver comment, the
ltx2_video_vae_tiled.cpp comment, docs/USAGE.md, the spec and this body.
artifacts.frames's 0.50 disclosure said "what binds here is the containment and
the count"; a count of one plus containment permits that leaf to be TWICE its
anchor, and what binds is the count and the fact that the writer is not nested.
And ### Owed out of W0 was honest and complete for LEAVES and silent about the
ANCHORS; it now states, per property, what is proven about them and what is not,
including that no anchor covers the CALL it is named after and that a leaf may
still grow over time NOBODY named up to its coverage slack — about 5.3% for
denoise, 11% for decode.video, 1% for decode.audio and up to 100% for
artifacts.frames.

What the FIFTH review broke, and what closed it

The fifth reviewer called the fourth repair "a strict, verified improvement"
where "every claim it makes about its own head reproduces", and then found a
FIFTH transfer shape on the same pair.

R1b — the sibling BOUNDARY, with no name touched. Leave decode.audio.mel
open across the vocoder call and let decode.audio.vocoder open and close EMPTY
beside it (ltx2_video.cpp:4674-4682, 1 file, +2/-2, compile rc 0). Identical
semantics, identical call order; only the instrument moves. Both gates were green
— containment exit 0, 1/1, 527/527 and SUMS exit 0, 1/1, 446/446,
byte-identical to the honest tree — while the vocoder, the model #1010 asks for
BY NAME, reported six microseconds of a half-second leaf. ~100% of
decode.audio's decomposed seconds land on the wrong name, which is the same end
state N1 produces, and N1 is red.

Every assertion survived it, each for its own reason. (1b) passes because the mel
still OPENS first, so it proves an ORDER and not an IDENTITY. The counts are
{1, 1} either way. Containment, nested and non-overlap all hold. And
min_coverage is checked on the SUM of the parts, never per part, so one
part covering everything satisfies it. Enumerating the multi-part leaves says why
this landed on exactly one pair: denoise{denoise.step},
decode.video{decode.video.chunk} and artifacts.frames{artifacts.frames.ppm}
have ONE part each, so (1b) and any per-part rule are vacuous for them.
decode.audio{mel, vocoder} is the only multi-part leaf in the table. This is
round four's lesson recurring: assertion (6) was applied to the anchor that
failed rather than to the property that failed.

Carrying::part_min_coverage closes it — a per-part floor against the leaf,
REQUIRED rather than defaulted and placed before render, so a future leaf
cannot acquire a second part without answering the question. Honest, the vocoder
holds 99.46% and 94.10% of its leaf on the landing head and 97.0% and 99.99%
on the 21B artifact; under R1b it holds 0.00091% and 0.0035%. Four to five
orders of separation, which is the property the 0.50 decode.video.vae floor
already exploits, so this floor is 0.50 too rather than tightened toward a share
this box destroys. It also catches the NAME SWAP, which is why N1 moved from 3
failed assertions to 6: under N1 the vocoder name sits on the mel's work and
reads 2.76% and 7.68%.

The MIRROR is measured, GREEN and left OPEN, and that is a measurement rather
than an omission. Mel emptied, the vocoder covering both calls: honest,
decode.audio.mel holds 0.53% and 5.90% here and 0.0004% to 2.9% on the 21B
artifact; under the mirror it holds 0.00063% and 0.0051%. The honest 21B
render's share is smaller than the mutation's, so the distributions overlap and
any floor that reddens the mirror also reddens an honest render this row has
already produced. ### Owed out of W0 now names the sibling-boundary shape
explicitly, states which direction is closed and which is not, and tells W1 in as
many words that it is ranking a PAIR and not two models until a scope lands
inside Ltx2AudioDecoderForward. The previous entry was true but read as a
PRECISION debt — "opened by a statement ADJACENT to the call" — when the failure
is a 100% attribution transfer.

Two stated reasons also claimed more than their numbers did. The vae
denominator was justified by "without a second threshold for the reopen", but the
reopen is itself a decode.video.chunk record and sits inside BOTH candidate
denominators: on the landing head the leaf is 0.191059 s against 0.191044 s of
chunk, 0.0079%, and the LEAF is the marginally stricter of the two, so the choice
loosens nothing. And (1b) compares FIRST records, which is the whole order only
because these parts do not interleave; a future leaf with two repeating parts
would satisfy first(A) <= first(B) while running A, B, B, A. Both sentences
are corrected at the site.

Evidence

Honest tree at 1160d04b5, the head that lands, x86 CPU, Release,
-DVLLM_CPP_SERVER=OFF:

Suite	Result
test_ltx2_video	exit 0, 96/96 cases, 4017/4017 assertions
test_capi	exit 0, 65/65 cases, 654/654 assertions
test_ltx2_vae	exit 0, 43/43 cases, 3125/3125 assertions
test_ltx2_tiling	exit 0, 10/10 cases, 915/915 assertions

The two gate cases on that head: containment exit 0, 1/1, 554/554, SUMS
exit 0, 1/1, 446/446.

Twelve mutations, run on BOTH merge heads — 17eba8ce2 and 1160d04b5:

#	Mutation	git diff --stat	compile	containment	SUMS
—	honest	(none)	rc 0	exit 0, 1/1 cases, 554/554	exit 0, 1/1, 446/446
R1b	leave decode.audio.mel open across the vocoder call, decode.audio.vocoder opened EMPTY beside it — the sibling-boundary mutation	1 file, +2/-2	rc 0	RED, exit 1, 1 case failed, 554 assertions, 3 failed, on the per-part floor in each of the three per-render checks	exit 0, 446/446
R1b mirror	the same shift the other way: mel emptied, vocoder covering both calls	1 file, +2/-2	rc 0	GREEN, exit 0, 1/1, 554/554 — OPEN, and recorded with the measurement that says no floor separates it	exit 0, 446/446
N1	swap the decode.audio.mel / decode.audio.vocoder scope names	1 file, +2/-2	rc 0	RED, exit 1, 1 case failed, 554 assertions, 6 failed — three on the sibling order, three on the per-part floor	exit 0, 446/446
N6	move decode.video.vae off AccumulateTemporalGroup onto buffer.Allocate	1 file, +4/-2	rc 0	RED, exit 1, 1 case failed, 554 assertions, 3 failed, on the vae coverage floor	exit 0, 446/446
M12	denoise.step emitted for the first evaluation only, denoise closed at step 0, phase.finish over the rest	1 file, +8/-1	rc 0	RED, exit 1, 1 case failed, 479 assertions, 5 failed, first on the denoise.step record count against dit_evaluations = 8	exit 0, 374/374
M11	writes stay inside decode.video, artifacts.frames emitted empty	1 file, +3/-3	rc 0	RED, exit 1, 1 case failed, 126 assertions, 1 failed	exit 0, 446/446
M11b	both Closes below the write, writer still around the loop	1 file, +2/-2	rc 0	RED, exit 1, 1 case failed, 126 assertions, 1 failed	exit 0, 446/446
M13	swap the load.dit / load.prompt_embeds scope names	1 file, +2/-2	rc 0	RED, exit 1, 1 case failed, 554 assertions, 2 failed, on the load order	exit 0, 446/446
M7	close denoise after the first sampler step, open phase.finish there	1 file, +5/-0	rc 0	RED, exit 1, 1 case failed, 556 assertions, 26 failed	exit 0, 458/458
M4	decode.video left open across the audio decode	1 file, +1/-1	rc 0	RED, exit 1, 1 case failed, 92 assertions, 2 failed (a REQUIRE_FALSE aborts the case early)	exit 0, 446/446
M10	after a chunk, re-label the decode as the writer	1 file, +1/-1	rc 0	RED, exit 1, 1 case failed, 556 assertions, 4 failed	exit 0, 446/446
N10	detach artifacts.frames.ppm from the WriteFileBytes loop by closing it before the loop	1 file, +1/-1	rc 0	RED, exit 1, 1 case failed, 554 assertions, 3 failed	exit 0, 446/446

Across the FOURTH merge the counts moved and the verdicts did not — N6 went
from 5 failed assertions to 3, and N1 from 3 to 6. Across the FIFTH merge every
count is byte-identical, all twelve. That merge touches
src/vt/cpu/cpu_ops.cpp, the file whose act(gate) narrowing moved the counts
last time, and git diff --numstat reads 87 insertions and zero deletions there.
"Purely additive" was the prediction; twelve unchanged counts are the evidence,
and the prediction was not accepted in place of the run.

SEVEN OF THE TWELVE ARE RECONSTRUCTIONS, and the body says which. Only R1b,
its mirror, N1, N6 and M13 run from a definition recorded in this tree; the
earlier reviews' own M12, M11, M11b, M7, M4, M10 and N10 are not in the tree or
on the forge, so each is rebuilt from the row that describes it. Two rebuilds
were wrong on the first attempt and a bare RED would have hidden both. A first
M4 that never re-closed decode.video reddened the SUMS case, which the recorded
M4 does not; a first M12 closed denoise.step early instead of SUPPRESSING it —
closing still emits the record — which made M12 and M7 identical in verdict, 556
assertions with 26 failed on the same five failure texts. Both were repaired
until the failure SHAPE matched the recorded one. A reconstruction that merely
reds is not evidence that the recorded mutation reds.

Every mutation was applied by exact-text replacement that refuses unless the
pattern occurs exactly once, its git diff --stat and compile return code
printed, the binary's sha checked to have MOVED, and the tree restored and
re-verified with git status --porcelain afterwards. The refusal earned its keep
again: M4's first anchor matched two sites and was refused rather than applied to
the wrong one.

The SUMS column is not a defect. It is the measurement, for the fifth time: a
sum cannot see a transfer, an anchor that moved with its leaf, a pair of anchor
names that were exchanged, or a scope boundary that moved between two siblings.

No timing conclusion is drawn from this box, and none may be. Every threshold
here is a within-run share. The leaf sums moved 0.658 s, 0.706 s and 0.779 s
across three runs of one binary at one geometry while this was written, and
earlier runs of the same case on the same box reported 0.080 s and 0.476 s. The
box also filled to 100% mid-run once and three cases threw No space left on device; that was ENOSPC and not a verdict, and the suites above were re-run with
headroom.

Component checkers on this head, all rc 0: check-public-doc-tables,
check-windows-portability, check-surface-coverage, check-test-registration,
check-symbol-anchors, check-env-doc, check-gate-commands,
check-now-current, check-agent-record, check-issue-index-append-only,
check-oracle-pins, check-prompt-contract, check-pr-size --base origin/main --head HEAD, check-commit-style and check-commit-trailers over the branch
range.

scripts/agent-preflight.sh reports FOUR failures on this head and none is this
branch's. test_cpu_x86_llamacpp_floor is #618 and prints its own reason — the
box was at load 37 on 20 cores while it ran. doc-checkpoint range is the
per-commit walk on 8e4c57967, which changes user_usage while the
docs/USAGE.md edit rides in f47c2e0e3; once a commit is published on a branch
that may not be force-pushed, no later commit can make that walk green.
Verified on the squashed shape, which is what lands:
check-doc-checkpoint.py --commit <squash> returns rc 0 against a
git commit-tree of this head's tree parented on origin/main.

audit-live-rows and test_audit_live_rows are new, and they are main's. A
detached worktree checked out at origin/main cae8ace0c with nothing applied
fails the same assertion with the same value —
stale ACTIVE rows remain: ['KERNEL-DFLASH2-GROUPED-CONV'], 57 tests, 1 failure
— so the red arrived with 028438e68, whose implementation landed while its
kernel-matrix row stayed ACTIVE under a live claim. Filed as
#1469, owned by
KERNEL-DFLASH2-GROUPED-CONV, and NOT fixed here: that row, the kernel matrix
and the DFlash2 claim are outside this row's authority, and a lifecycle move owes
docs/STATUS.md, docs/BENCHMARKS.md and the moved spec's ## Now. Note how it
hides — scripts/audit-live-rows.py run on its own returns rc 0 while printing
1 abandoned ACTIVE, so the script looks green to anyone who checks it the
obvious way. CI is REMOTE_UNVERIFIED (#1376).

Closes #1440. Also fixes #1446, the fourth review's findings, filed and repaired
in the same flow.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [Claude Code]