fix(LTX25-DEVICE-RESIDENCY): bound each leaf record on its own, because the span-slack bound reds an unmutated tree and its multiplier came from the artifact (#1559)

[localai-bot]

Assertion (1c) in test_ltx2_video landed in 6b48edb2c to un-red
build-test-cpu. It reds that lane itself. Measured at that head, unmutated,
one binary and one build directory: five of 53 runs red, worst 10.032 ms of
head-plus-tail against a 0.25 ms bound.

Three defects, and the constant is only the first. Raising it could not have
been enough, because the 0.5 * leaf_seconds cap forbids any useful bound on a
short record: artifacts.frames measured 1.361 ms of slack on a 4.826 ms
record, and decode.video's reopen record is 19-89 us of which 4.6-72.3% is its
own two boundaries.

The multiplier was leaves.size(), read from the table under test and tied to
no independent number, so a defect emitting one extra leaf record enlarged its
own budget. The slack was summed as well, so one record of a three-record leaf
could spend the whole thing. The comment claiming the sum was stricter on
multi-record leaves was false, and the looseness was load-bearing.

The failure message said this quantity does not move with the box. Within one
build configuration on one host it spans 402x.

Each leaf record is now bounded separately against one 30 ms constant, 2.99x the
worst of 636 observations. leaves.size() leaves the arithmetic. The min cap
moves to the record, which makes the forced-strict probe red by construction,
and where that cap binds the record is declared below the instrument's
resolution and held by the coverage floor instead. A new
REQUIRE(c.min_coverage >= 0.5) makes that hand-off executable. The two
per-configuration constants collapse to one, because the plain lane's own
scheduler tail is now three times the largest sanitizer slack ever recorded.

Forced-strict reds 9 of 9 checked records. A 45 ms swallow injected into one
record passes the old formula on decode.video and reds the new one at the
identical constant. 40 runs of the repaired shape across three load
configurations are green. What the repair can no longer see is stated at the
site and under ## Owed.

A fresh review then measured two claims in the record that a smaller batch had
supported. The constant is not bounded from above by decode.video record 0, as
this branch first argued: over 35 runs that record fell below the 60 ms
resolution floor in 4 of 60 shared-box and 8 of 30 two-core observations, and in
2 of 20 shared-box runs its leaf left the gated set entirely. denoise and
decode.audio are what bound the constant, gated in 35 of 35 runs and holding
over 96% of the leaf-seconds. And the hand-off to the coverage floor is exact
only for a single-record leaf; on decode.video's reopen records a swallow may
reach the 60 ms floor, up to 94x their honest size, unseen by either assertion.
Both tables now carry that escape as a ceiling instead of naming an assertion
that does not bind there, and the site scopes its argument. The assertion and the
constant are unchanged by that correction.

Reported and owned by #1559. Context: #1494 and #1499, both closed, are what
#1503 repaired; this change repairs the repair. #1439 stays untouched and is
still owed the same thing this bound is: a name on the un-named time.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5-1m [Claude Code]